about summary refs log tree commit diff
diff options
context:
space:
mode:
-rw-r--r--maintainers/maintainer-list.nix10
-rw-r--r--nixos/modules/config/nsswitch.nix20
-rw-r--r--nixos/modules/services/backup/znapzend.nix35
-rw-r--r--nixos/modules/services/misc/gitea.nix146
-rw-r--r--nixos/modules/services/networking/hostapd.nix37
-rw-r--r--nixos/modules/services/x11/desktop-managers/pantheon.nix2
-rw-r--r--nixos/modules/system/boot/resolved.nix4
-rw-r--r--nixos/modules/system/boot/systemd.nix21
-rw-r--r--nixos/modules/virtualisation/podman.nix8
-rw-r--r--nixos/modules/virtualisation/qemu-vm.nix13
-rw-r--r--nixos/tests/all-tests.nix1
-rw-r--r--nixos/tests/systemd-boot.nix31
-rw-r--r--pkgs/applications/audio/chuck/default.nix4
-rw-r--r--pkgs/applications/audio/faust/faust2jack.nix4
-rw-r--r--pkgs/applications/audio/faust/faust2jaqt.nix4
-rw-r--r--pkgs/applications/audio/ninjas2/default.nix39
-rw-r--r--pkgs/applications/audio/spotify-tui/default.nix12
-rw-r--r--pkgs/applications/blockchains/particl/particl-core.nix4
-rw-r--r--pkgs/applications/editors/bluefish/default.nix4
-rw-r--r--pkgs/applications/editors/focuswriter/default.nix4
-rw-r--r--pkgs/applications/editors/leo-editor/default.nix4
-rw-r--r--pkgs/applications/gis/saga/default.nix4
-rw-r--r--pkgs/applications/graphics/avocode/default.nix4
-rw-r--r--pkgs/applications/misc/cherrytree/default.nix4
-rw-r--r--pkgs/applications/misc/copyq/default.nix4
-rw-r--r--pkgs/applications/misc/fetchmail/default.nix4
-rw-r--r--pkgs/applications/misc/gallery-dl/default.nix4
-rw-r--r--pkgs/applications/misc/grip/default.nix4
-rw-r--r--pkgs/applications/misc/joplin-desktop/default.nix4
-rw-r--r--pkgs/applications/misc/khard/default.nix4
-rw-r--r--pkgs/applications/misc/xastir/default.nix4
-rw-r--r--pkgs/applications/misc/xmrig/default.nix4
-rw-r--r--pkgs/applications/networking/Sylk/default.nix4
-rw-r--r--pkgs/applications/networking/browsers/firefox/wrapper.nix7
-rw-r--r--pkgs/applications/networking/instant-messengers/riot/riot-desktop-package.json2
-rw-r--r--pkgs/applications/networking/instant-messengers/riot/riot-desktop-yarndeps.nix8
-rw-r--r--pkgs/applications/networking/instant-messengers/riot/riot-desktop.nix4
-rw-r--r--pkgs/applications/networking/instant-messengers/riot/riot-web.nix4
-rw-r--r--pkgs/applications/networking/mailreaders/afew/default.nix10
-rw-r--r--pkgs/applications/networking/remote/anydesk/default.nix4
-rw-r--r--pkgs/applications/networking/syncthing/default.nix6
-rw-r--r--pkgs/applications/radio/dablin/default.nix4
-rw-r--r--pkgs/applications/radio/tlf/default.nix4
-rw-r--r--pkgs/applications/science/astronomy/kstars/default.nix48
-rw-r--r--pkgs/applications/science/math/mathematica/10.nix4
-rw-r--r--pkgs/applications/science/math/mathematica/11.nix4
-rw-r--r--pkgs/applications/science/math/mathematica/9.nix4
-rw-r--r--pkgs/applications/science/math/mathematica/default.nix4
-rw-r--r--pkgs/applications/science/molecular-dynamics/gromacs/default.nix6
-rw-r--r--pkgs/applications/version-management/git-and-tools/git-subtrac/default.nix4
-rw-r--r--pkgs/applications/version-management/git-and-tools/git-trim/default.nix6
-rw-r--r--pkgs/applications/video/p2pvc/default.nix4
-rw-r--r--pkgs/applications/virtualization/podman/wrapper.nix26
-rw-r--r--pkgs/build-support/fetchurl/builder.sh15
-rw-r--r--pkgs/desktops/cinnamon/cinnamon-session/default.nix4
-rw-r--r--pkgs/desktops/gnome-3/misc/pomodoro/default.nix4
-rw-r--r--pkgs/desktops/xfce/core/xfwm4/default.nix4
-rw-r--r--pkgs/development/compilers/abcl/default.nix4
-rw-r--r--pkgs/development/compilers/closure/default.nix4
-rw-r--r--pkgs/development/compilers/fasm/bin.nix4
-rw-r--r--pkgs/development/interpreters/elixir/1.10.nix4
-rw-r--r--pkgs/development/interpreters/joker/default.nix6
-rw-r--r--pkgs/development/interpreters/python/default.nix2
-rw-r--r--pkgs/development/interpreters/racket/default.nix9
-rw-r--r--pkgs/development/interpreters/racket/minimal.nix2
-rw-r--r--pkgs/development/libraries/enet/default.nix4
-rw-r--r--pkgs/development/libraries/freetds/default.nix4
-rw-r--r--pkgs/development/libraries/geos/default.nix4
-rw-r--r--pkgs/development/libraries/java/commons/compress/default.nix4
-rw-r--r--pkgs/development/libraries/libjcat/default.nix11
-rw-r--r--pkgs/development/libraries/rdkafka/default.nix4
-rw-r--r--pkgs/development/ocaml-modules/async_find/default.nix22
-rw-r--r--pkgs/development/python-modules/ansible/default.nix4
-rw-r--r--pkgs/development/python-modules/autopep8/default.nix4
-rw-r--r--pkgs/development/python-modules/clikit/default.nix5
-rw-r--r--pkgs/development/python-modules/evdev/default.nix4
-rw-r--r--pkgs/development/python-modules/livestreamer/default.nix4
-rw-r--r--pkgs/development/python-modules/nipype/default.nix14
-rw-r--r--pkgs/development/python-modules/numba/default.nix4
-rw-r--r--pkgs/development/python-modules/poetry/default.nix6
-rw-r--r--pkgs/development/python-modules/pycairo/default.nix4
-rw-r--r--pkgs/development/python-modules/pydicom/default.nix4
-rw-r--r--pkgs/development/python-modules/pymssql/default.nix26
-rw-r--r--pkgs/development/python-modules/rencode/default.nix2
-rw-r--r--pkgs/development/python-modules/rig/default.nix4
-rw-r--r--pkgs/development/python-modules/rl-coach/default.nix4
-rw-r--r--pkgs/development/python-modules/serpent/default.nix3
-rw-r--r--pkgs/development/python-modules/softlayer/default.nix2
-rw-r--r--pkgs/development/python-modules/tensorflow/2/bin.nix12
-rw-r--r--pkgs/development/python-modules/toggl-cli/default.nix1
-rw-r--r--pkgs/development/python-modules/tomlkit/default.nix4
-rw-r--r--pkgs/development/python-modules/traits/default.nix3
-rw-r--r--pkgs/development/tools/flyway/default.nix4
-rw-r--r--pkgs/development/tools/golangci-lint/default.nix6
-rw-r--r--pkgs/development/tools/jbake/default.nix4
-rw-r--r--pkgs/development/tools/just/default.nix15
-rw-r--r--pkgs/development/tools/vagrant/default.nix4
-rw-r--r--pkgs/development/tools/vagrant/gemset.nix37
-rw-r--r--pkgs/development/tools/vgo2nix/default.nix10
-rw-r--r--pkgs/development/tools/vgo2nix/deps.nix71
-rw-r--r--pkgs/development/tools/wabt/default.nix13
-rw-r--r--pkgs/development/tools/wabt/version.patch28
-rw-r--r--pkgs/games/bzflag/default.nix4
-rw-r--r--pkgs/games/crispy-doom/default.nix4
-rw-r--r--pkgs/games/cutemaze/default.nix4
-rw-r--r--pkgs/games/netris/default.nix32
-rw-r--r--pkgs/games/pokerth/default.nix4
-rw-r--r--pkgs/games/super-tux-kart/default.nix22
-rw-r--r--pkgs/misc/emulators/fs-uae/default.nix4
-rw-r--r--pkgs/misc/emulators/stella/default.nix4
-rw-r--r--pkgs/os-specific/linux/firmware/fwupd/default.nix32
-rw-r--r--pkgs/os-specific/linux/kernel/linux-4.14.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/linux-4.4.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/linux-4.9.nix4
-rw-r--r--pkgs/os-specific/linux/syslinux/default.nix3
-rw-r--r--pkgs/servers/caddy/v2.nix6
-rw-r--r--pkgs/servers/dns/knot-dns/default.nix4
-rw-r--r--pkgs/servers/http/tomcat/tomcat-native.nix4
-rw-r--r--pkgs/servers/mpd/default.nix4
-rw-r--r--pkgs/servers/search/groonga/default.nix4
-rw-r--r--pkgs/servers/sql/postgresql/ext/pg_auto_failover.nix4
-rw-r--r--pkgs/shells/fish/default.nix68
-rw-r--r--pkgs/shells/xonsh/default.nix4
-rw-r--r--pkgs/shells/zsh/oh-my-zsh/default.nix6
-rw-r--r--pkgs/tools/admin/ansible/default.nix8
-rw-r--r--pkgs/tools/backup/znapzend/default.nix39
-rw-r--r--pkgs/tools/filesystems/avfs/default.nix4
-rw-r--r--pkgs/tools/filesystems/bindfs/default.nix4
-rw-r--r--pkgs/tools/filesystems/ceph/default.nix4
-rw-r--r--pkgs/tools/graphics/pfstools/default.nix4
-rw-r--r--pkgs/tools/misc/blsd/default.nix29
-rw-r--r--pkgs/tools/misc/blsd/deps.nix12
-rw-r--r--pkgs/tools/misc/datamash/default.nix4
-rw-r--r--pkgs/tools/misc/entr/default.nix4
-rw-r--r--pkgs/tools/networking/davix/default.nix6
-rw-r--r--pkgs/tools/networking/drill/default.nix13
-rw-r--r--pkgs/tools/networking/tridactyl-native/default.nix4
-rw-r--r--pkgs/tools/package-management/clib/default.nix4
-rw-r--r--pkgs/tools/package-management/emplace/default.nix6
-rw-r--r--pkgs/tools/security/gopass/default.nix13
-rw-r--r--pkgs/tools/system/facter/default.nix4
-rw-r--r--pkgs/tools/system/kmon/default.nix6
-rw-r--r--pkgs/tools/text/colordiff/default.nix4
-rw-r--r--pkgs/tools/text/languagetool/default.nix4
-rw-r--r--pkgs/tools/text/shfmt/default.nix4
-rw-r--r--pkgs/tools/virtualization/linode-cli/default.nix4
-rw-r--r--pkgs/top-level/all-packages.nix18
-rw-r--r--pkgs/top-level/ocaml-packages.nix5
-rw-r--r--pkgs/top-level/python-packages.nix6
149 files changed, 858 insertions, 623 deletions
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index b4552bd874f1..4154b2721179 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -5862,6 +5862,16 @@
     githubId = 131844;
     name = "Igor Pashev";
   };
+  patryk27 = {
+    email = "wychowaniec.patryk@gmail.com";
+    github = "Patryk27";
+    githubId = 3395477;
+    name = "Patryk Wychowaniec";
+    keys = [{
+      longkeyid = "rsa4096/0xF62547D075E09767";
+      fingerprint = "196A BFEC 6A1D D1EC 7594  F8D1 F625 47D0 75E0 9767";
+    }];
+  };
   patternspandemic = {
     email = "patternspandemic@live.com";
     github = "patternspandemic";
diff --git a/nixos/modules/config/nsswitch.nix b/nixos/modules/config/nsswitch.nix
index 77e47a350ecb..22ddb3490c8e 100644
--- a/nixos/modules/config/nsswitch.nix
+++ b/nixos/modules/config/nsswitch.nix
@@ -8,30 +8,22 @@ let
 
   # only with nscd up and running we can load NSS modules that are not integrated in NSS
   canLoadExternalModules = config.services.nscd.enable;
-  myhostname = canLoadExternalModules;
-  mymachines = canLoadExternalModules;
   # XXX Move these to their respective modules
   nssmdns = canLoadExternalModules && config.services.avahi.nssmdns;
   nsswins = canLoadExternalModules && config.services.samba.nsswins;
   ldap = canLoadExternalModules && (config.users.ldap.enable && config.users.ldap.nsswitch);
-  resolved = canLoadExternalModules && config.services.resolved.enable;
 
   hostArray = mkMerge [
     (mkBefore [ "files" ])
-    (mkIf mymachines [ "mymachines" ])
     (mkIf nssmdns [ "mdns_minimal [NOTFOUND=return]" ])
     (mkIf nsswins [ "wins" ])
-    (mkIf resolved [ "resolve [!UNAVAIL=return]" ])
     (mkAfter [ "dns" ])
     (mkIf nssmdns (mkOrder 1501 [ "mdns" ])) # 1501 to ensure it's after dns
-    (mkIf myhostname (mkOrder 1600 [ "myhostname" ])) # 1600 to ensure it's always the last
   ];
 
   passwdArray = mkMerge [
     (mkBefore [ "files" ])
     (mkIf ldap [ "ldap" ])
-    (mkIf mymachines [ "mymachines" ])
-    (mkIf canLoadExternalModules (mkAfter [ "systemd" ]))
   ];
 
   shadowArray = mkMerge [
@@ -134,11 +126,6 @@ in {
         assertion = config.system.nssModules.path != "" -> canLoadExternalModules;
         message = "Loading NSS modules from path ${config.system.nssModules.path} requires nscd being enabled.";
       }
-      {
-        # resolved does not need to add to nssModules, therefore needs an extra assertion
-        assertion = resolved -> canLoadExternalModules;
-        message = "Loading systemd-resolved's nss-resolve NSS module requires nscd being enabled.";
-      }
     ];
 
     # Name Service Switch configuration file.  Required by the C
@@ -164,12 +151,5 @@ in {
       hosts = hostArray;
       services = mkBefore [ "files" ];
     };
-
-    # Systemd provides nss-myhostname to ensure that our hostname
-    # always resolves to a valid IP address.  It returns all locally
-    # configured IP addresses, or ::1 and 127.0.0.2 as
-    # fallbacks. Systemd also provides nss-mymachines to return IP
-    # addresses of local containers.
-    system.nssModules = (optionals canLoadExternalModules [ config.systemd.package.out ]);
   };
 }
diff --git a/nixos/modules/services/backup/znapzend.nix b/nixos/modules/services/backup/znapzend.nix
index 203631a577f0..98cd647f61ac 100644
--- a/nixos/modules/services/backup/znapzend.nix
+++ b/nixos/modules/services/backup/znapzend.nix
@@ -372,6 +372,41 @@ in
         and <citerefentry><refentrytitle>zfs</refentrytitle><manvolnum>8</manvolnum></citerefentry>
         for more info.
       '';
+      features.sendRaw = mkEnableOption ''
+        sendRaw feature which adds the options <literal>-w</literal> to the
+        <command>zfs send</command> command. For encrypted source datasets this
+        instructs zfs not to decrypt before sending which results in a remote
+        backup that can't be read without the encryption key/passphrase, useful
+        when the remote isn't fully trusted or not physically secure. This
+        option must be used consistently, raw incrementals cannot be based on
+        non-raw snapshots and vice versa.
+      '';
+      features.skipIntermediates = mkEnableOption ''
+        Enable the skipIntermediates feature to send a single increment
+        between latest common snapshot and the newly made one. It may skip
+        several source snaps if the destination was offline for some time, and
+        it should skip snapshots not managed by znapzend. Normally for online
+        destinations, the new snapshot is sent as soon as it is created on the
+        source, so there are no automatic increments to skip.
+      '';
+      features.lowmemRecurse = mkEnableOption ''
+        use lowmemRecurse on systems where you have too many datasets, so a
+        recursive listing of attributes to find backup plans exhausts the
+        memory available to <command>znapzend</command>: instead, go the slower
+        way to first list all impacted dataset names, and then query their
+        configs one by one.
+      '';
+      features.zfsGetType = mkEnableOption ''
+        use zfsGetType if your <command>zfs get</command> supports a
+        <literal>-t</literal> argument for filtering by dataset type at all AND
+        lists properties for snapshots by default when recursing, so that there
+        is too much data to process while searching for backup plans.
+        If these two conditions apply to your system, the time needed for a
+        <literal>--recursive</literal> search for backup plans can literally
+        differ by hundreds of times (depending on the amount of snapshots in
+        that dataset tree... and a decent backup plan will ensure you have a lot
+        of those), so you would benefit from requesting this feature.
+      '';
     };
   };
 
diff --git a/nixos/modules/services/misc/gitea.nix b/nixos/modules/services/misc/gitea.nix
index 38910a5a005d..d6a11c23014a 100644
--- a/nixos/modules/services/misc/gitea.nix
+++ b/nixos/modules/services/misc/gitea.nix
@@ -14,53 +14,9 @@ let
     RUN_USER = ${cfg.user}
     RUN_MODE = prod
 
-    [database]
-    DB_TYPE = ${cfg.database.type}
-    ${optionalString (usePostgresql || useMysql) ''
-      HOST = ${if cfg.database.socket != null then cfg.database.socket else cfg.database.host + ":" + toString cfg.database.port}
-      NAME = ${cfg.database.name}
-      USER = ${cfg.database.user}
-      PASSWD = #dbpass#
-    ''}
-    ${optionalString useSqlite ''
-      PATH = ${cfg.database.path}
-    ''}
-    ${optionalString usePostgresql ''
-      SSL_MODE = disable
-    ''}
-
-    [repository]
-    ROOT = ${cfg.repositoryRoot}
-
-    [server]
-    DOMAIN = ${cfg.domain}
-    HTTP_ADDR = ${cfg.httpAddress}
-    HTTP_PORT = ${toString cfg.httpPort}
-    ROOT_URL = ${cfg.rootUrl}
-    STATIC_ROOT_PATH = ${cfg.staticRootPath}
-    LFS_JWT_SECRET = #jwtsecret#
-
-    [session]
-    COOKIE_NAME = session
-    COOKIE_SECURE = ${boolToString cfg.cookieSecure}
-
-    [security]
-    SECRET_KEY = #secretkey#
-    INSTALL_LOCK = true
-
-    [log]
-    ROOT_PATH = ${cfg.log.rootPath}
-    LEVEL = ${cfg.log.level}
-
-    [service]
-    DISABLE_REGISTRATION = ${boolToString cfg.disableRegistration}
-
-    ${optionalString (cfg.mailerPasswordFile != null) ''
-      [mailer]
-      PASSWD = #mailerpass#
-    ''}
-
-    ${cfg.extraConfig}
+    ${generators.toINI {} cfg.settings}
+
+    ${optionalString (cfg.extraConfig != null) cfg.extraConfig}
   '';
 in
 
@@ -279,9 +235,36 @@ in
         '';
       };
 
+      settings = mkOption {
+        type = with types; attrsOf (attrsOf (oneOf [ bool int str ]));
+        default = {};
+        description = ''
+          Gitea configuration. Refer to <link xlink:href="https://docs.gitea.io/en-us/config-cheat-sheet/"/>
+          for details on supported values.
+        '';
+        example = literalExample ''
+          {
+            "cron.sync_external_users" = {
+              RUN_AT_START = true;
+              SCHEDULE = "@every 24h";
+              UPDATE_EXISTING = true;
+            };
+            mailer = {
+              ENABLED = true;
+              MAILER_TYPE = "sendmail";
+              FROM = "do-not-reply@example.org";
+              SENDMAIL_PATH = "${pkgs.system-sendmail}/bin/sendmail";
+            };
+            other = {
+              SHOW_FOOTER_VERSION = false;
+            };
+          }
+        '';
+      };
+
       extraConfig = mkOption {
-        type = types.str;
-        default = "";
+        type = with types; nullOr str;
+        default = null;
         description = "Configuration lines appended to the generated gitea configuration file.";
       };
     };
@@ -294,6 +277,62 @@ in
       }
     ];
 
+    services.gitea.settings = {
+      database = mkMerge [
+        {
+          DB_TYPE = cfg.database.type;
+        }
+        (mkIf (useMysql || usePostgresql) {
+          HOST = if cfg.database.socket != null then cfg.database.socket else cfg.database.host + ":" + toString cfg.database.port;
+          NAME = cfg.database.name;
+          USER = cfg.database.user;
+          PASSWD = "#dbpass#";
+        })
+        (mkIf useSqlite {
+          PATH = cfg.database.path;
+        })
+        (mkIf usePostgresql {
+          SSL_MODE = "disable";
+        })
+      ];
+
+      repository = {
+        ROOT = cfg.repositoryRoot;
+      };
+
+      server = {
+        DOMAIN = cfg.domain;
+        HTTP_ADDR = cfg.httpAddress;
+        HTTP_PORT = cfg.httpPort;
+        ROOT_URL = cfg.rootUrl;
+        STATIC_ROOT_PATH = cfg.staticRootPath;
+        LFS_JWT_SECRET = "#jwtsecret#";
+      };
+
+      session = {
+        COOKIE_NAME = "session";
+        COOKIE_SECURE = cfg.cookieSecure;
+      };
+
+      security = {
+        SECRET_KEY = "#secretkey#";
+        INSTALL_LOCK = true;
+      };
+
+      log = {
+        ROOT_PATH = cfg.log.rootPath;
+        LEVEL = cfg.log.level;
+      };
+
+      service = {
+        DISABLE_REGISTRATION = cfg.disableRegistration;
+      };
+
+      mailer = mkIf (cfg.mailerPasswordFile != null) {
+        PASSWD = "#mailerpass#";
+      };
+    };
+
     services.postgresql = optionalAttrs (usePostgresql && cfg.database.createDatabase) {
       enable = mkDefault true;
 
@@ -435,9 +474,12 @@ in
 
     users.groups.gitea = {};
 
-    warnings = optional (cfg.database.password != "")
-      ''config.services.gitea.database.password will be stored as plaintext
-        in the Nix store. Use database.passwordFile instead.'';
+    warnings =
+      optional (cfg.database.password != "") ''
+        config.services.gitea.database.password will be stored as plaintext in the Nix store. Use database.passwordFile instead.'' ++
+      optional (cfg.extraConfig != null) ''
+        services.gitea.`extraConfig` is deprecated, please use services.gitea.`settings`.
+      '';
 
     # Create database passwordFile default when password is configured.
     services.gitea.database.passwordFile =
diff --git a/nixos/modules/services/networking/hostapd.nix b/nixos/modules/services/networking/hostapd.nix
index 6418ae699431..5d73038363a9 100644
--- a/nixos/modules/services/networking/hostapd.nix
+++ b/nixos/modules/services/networking/hostapd.nix
@@ -20,12 +20,14 @@ let
     ssid=${cfg.ssid}
     hw_mode=${cfg.hwMode}
     channel=${toString cfg.channel}
+    ${optionalString (cfg.countryCode != null) ''country_code=${cfg.countryCode}''}
+    ${optionalString (cfg.countryCode != null) ''ieee80211d=1''}
 
     # logging (debug level)
     logger_syslog=-1
-    logger_syslog_level=2
+    logger_syslog_level=${toString cfg.logLevel}
     logger_stdout=-1
-    logger_stdout_level=2
+    logger_stdout_level=${toString cfg.logLevel}
 
     ctrl_interface=/run/hostapd
     ctrl_interface_group=${cfg.group}
@@ -147,6 +149,35 @@ in
         '';
       };
 
+      logLevel = mkOption {
+        default = 2;
+        type = types.int;
+        description = ''
+          Levels (minimum value for logged events):
+          0 = verbose debugging
+          1 = debugging
+          2 = informational messages
+          3 = notification
+          4 = warning
+        '';
+      };
+
+      countryCode = mkOption {
+        default = null;
+        example = "US";
+        type = with types; nullOr str;
+        description = ''
+          Country code (ISO/IEC 3166-1). Used to set regulatory domain.
+          Set as needed to indicate country in which device is operating.
+          This can limit available channels and transmit power.
+          These two octets are used as the first two octets of the Country String
+          (dot11CountryString).
+          If set this enables IEEE 802.11d. This advertises the countryCode and
+          the set of allowed channels and transmit power levels based on the
+          regulatory limits.
+        '';
+      };
+
       extraConfig = mkOption {
         default = "";
         example = ''
@@ -167,6 +198,8 @@ in
 
     environment.systemPackages =  [ pkgs.hostapd ];
 
+    services.udev.packages = optional (cfg.countryCode != null) [ pkgs.crda ];
+
     systemd.services.hostapd =
       { description = "hostapd wireless AP";
 
diff --git a/nixos/modules/services/x11/desktop-managers/pantheon.nix b/nixos/modules/services/x11/desktop-managers/pantheon.nix
index 01fe230b8a43..5fcc8590232a 100644
--- a/nixos/modules/services/x11/desktop-managers/pantheon.nix
+++ b/nixos/modules/services/x11/desktop-managers/pantheon.nix
@@ -109,7 +109,7 @@ in
 
       # Without this, elementary LightDM greeter will pre-select non-existent `default` session
       # https://github.com/elementary/greeter/issues/368
-      services.xserver.displayManager.defaultSession = "pantheon";
+      services.xserver.displayManager.defaultSession = mkDefault "pantheon";
 
       services.xserver.displayManager.sessionCommands = ''
         if test "$XDG_CURRENT_DESKTOP" = "Pantheon"; then
diff --git a/nixos/modules/system/boot/resolved.nix b/nixos/modules/system/boot/resolved.nix
index da61c64faf8b..b7aaef575ac1 100644
--- a/nixos/modules/system/boot/resolved.nix
+++ b/nixos/modules/system/boot/resolved.nix
@@ -138,6 +138,10 @@ in
 
     users.users.resolved.group = "systemd-resolve";
 
+    # add resolve to nss hosts database if enabled and nscd enabled
+    # system.nssModules is configured in nixos/modules/system/boot/systemd.nix
+    system.nssDatabases.hosts = optional config.services.nscd.enable "resolve [!UNAVAIL=return]";
+
     systemd.additionalUpstreamSystemUnits = [
       "systemd-resolved.service"
     ];
diff --git a/nixos/modules/system/boot/systemd.nix b/nixos/modules/system/boot/systemd.nix
index 2167df60bc9a..df20a433d524 100644
--- a/nixos/modules/system/boot/systemd.nix
+++ b/nixos/modules/system/boot/systemd.nix
@@ -827,6 +827,27 @@ in
 
     system.build.units = cfg.units;
 
+    # Systemd provides various NSS modules to look up dynamic users, locally
+    # configured IP adresses and local container hostnames.
+    # On NixOS, these can only be passed to the NSS system via nscd (and its
+    # LD_LIBRARY_PATH), which is why it's usually a very good idea to have nscd
+    # enabled (also see the config.nscd.enable description).
+    # While there is already an assertion in place complaining loudly about
+    # having nssModules configured and nscd disabled, for some reason we still
+    # check for nscd being enabled before adding to nssModules.
+    system.nssModules = optional config.services.nscd.enable systemd.out;
+    system.nssDatabases = mkIf config.services.nscd.enable {
+      hosts = (mkMerge [
+        [ "mymachines" ]
+        (mkOrder 1600 [ "myhostname" ] # 1600 to ensure it's always the last
+      )
+      ]);
+      passwd = (mkMerge [
+        [ "mymachines" ]
+        (mkAfter [ "systemd" ])
+      ]);
+    };
+
     environment.systemPackages = [ systemd ];
 
     environment.etc = let
diff --git a/nixos/modules/virtualisation/podman.nix b/nixos/modules/virtualisation/podman.nix
index 9f98c2086d10..652850bf5006 100644
--- a/nixos/modules/virtualisation/podman.nix
+++ b/nixos/modules/virtualisation/podman.nix
@@ -8,13 +8,11 @@ let
 
   # Provides a fake "docker" binary mapping to podman
   dockerCompat = pkgs.runCommandNoCC "${podmanPackage.pname}-docker-compat-${podmanPackage.version}" {
-    outputs = [ "out" "bin" "man" ];
+    outputs = [ "out" "man" ];
     inherit (podmanPackage) meta;
   } ''
-    mkdir $out
-
-    mkdir -p $bin/bin
-    ln -s ${podmanPackage.bin}/bin/podman $bin/bin/docker
+    mkdir -p $out/bin
+    ln -s ${podmanPackage}/bin/podman $out/bin/docker
 
     mkdir -p $man/share/man/man1
     for f in ${podmanPackage.man}/share/man/man1/*; do
diff --git a/nixos/modules/virtualisation/qemu-vm.nix b/nixos/modules/virtualisation/qemu-vm.nix
index 85b75ba6804b..ac86330c098b 100644
--- a/nixos/modules/virtualisation/qemu-vm.nix
+++ b/nixos/modules/virtualisation/qemu-vm.nix
@@ -189,9 +189,18 @@ let
           mkdir /boot/grub
           echo '(hd0) /dev/vda' > /boot/grub/device.map
 
-          # Install GRUB and generate the GRUB boot menu.
-          touch /etc/NIXOS
+          # This is needed for systemd-boot to find ESP, and udev is not available here to create this
+          mkdir -p /dev/block
+          ln -s /dev/vda2 /dev/block/254:2
+
+          # Set up system profile (normally done by nixos-rebuild / nix-env --set)
           mkdir -p /nix/var/nix/profiles
+          ln -s ${config.system.build.toplevel} /nix/var/nix/profiles/system-1-link
+          ln -s /nix/var/nix/profiles/system-1-link /nix/var/nix/profiles/system
+
+          # Install bootloader
+          touch /etc/NIXOS
+          export NIXOS_INSTALL_BOOTLOADER=1
           ${config.system.build.toplevel}/bin/switch-to-configuration boot
 
           umount /boot
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index ebb0dfef15ac..46f552b26a46 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -297,6 +297,7 @@ in
   syncthing-relay = handleTest ./syncthing-relay.nix {};
   systemd = handleTest ./systemd.nix {};
   systemd-analyze = handleTest ./systemd-analyze.nix {};
+  systemd-boot = handleTestOn ["x86_64-linux"] ./systemd-boot.nix {};
   systemd-confinement = handleTest ./systemd-confinement.nix {};
   systemd-timesyncd = handleTest ./systemd-timesyncd.nix {};
   systemd-networkd-vrf = handleTest ./systemd-networkd-vrf.nix {};
diff --git a/nixos/tests/systemd-boot.nix b/nixos/tests/systemd-boot.nix
new file mode 100644
index 000000000000..e911c3933616
--- /dev/null
+++ b/nixos/tests/systemd-boot.nix
@@ -0,0 +1,31 @@
+{ system ? builtins.currentSystem,
+  config ? {},
+  pkgs ? import ../.. { inherit system config; }
+}:
+
+with import ../lib/testing-python.nix { inherit system pkgs; };
+with pkgs.lib;
+
+makeTest {
+  name = "systemd-boot";
+  meta.maintainers = with pkgs.stdenv.lib.maintainers; [ danielfullmer ];
+
+  machine = { pkgs, lib, ... }: {
+    virtualisation.useBootLoader = true;
+    virtualisation.useEFIBoot = true;
+    boot.loader.systemd-boot.enable = true;
+  };
+
+  testScript = ''
+    machine.start()
+    machine.wait_for_unit("multi-user.target")
+
+    machine.succeed("test -e /boot/loader/entries/nixos-generation-1.conf")
+
+    # Ensure we actually booted using systemd-boot.
+    # Magic number is the vendor UUID used by systemd-boot.
+    machine.succeed(
+        "test -e /sys/firmware/efi/efivars/LoaderEntrySelected-4a67b082-0a4c-41cf-b6c7-440b29bb8c4f"
+    )
+  '';
+}
diff --git a/pkgs/applications/audio/chuck/default.nix b/pkgs/applications/audio/chuck/default.nix
index 6970296cbd99..f30b5dba5b6b 100644
--- a/pkgs/applications/audio/chuck/default.nix
+++ b/pkgs/applications/audio/chuck/default.nix
@@ -3,12 +3,12 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "1.4.0.0";
+  version = "1.4.0.1";
   pname = "chuck";
 
   src = fetchurl {
     url = "http://chuck.cs.princeton.edu/release/files/chuck-${version}.tgz";
-    sha256 = "1b17rsf7bv45gfhyhfmpz9d4rkxn24c0m2hgmpfjz3nlp0rf7bic";
+    sha256 = "1m0fhndbqaf0lii1asyc50c66bv55ib6mbnm8fzk5qc5ncs0r8hi";
   };
 
   nativeBuildInputs = [ flex bison which ];
diff --git a/pkgs/applications/audio/faust/faust2jack.nix b/pkgs/applications/audio/faust/faust2jack.nix
index f032f435a35e..26478b2bb2e5 100644
--- a/pkgs/applications/audio/faust/faust2jack.nix
+++ b/pkgs/applications/audio/faust/faust2jack.nix
@@ -2,7 +2,7 @@
 , gtk2
 , jack2Full
 , alsaLib
-, opencv
+, opencv2
 , libsndfile
 }:
 
@@ -20,7 +20,7 @@ faust.wrapWithBuildEnv {
     gtk2
     jack2Full
     alsaLib
-    opencv
+    opencv2
     libsndfile
   ];
 
diff --git a/pkgs/applications/audio/faust/faust2jaqt.nix b/pkgs/applications/audio/faust/faust2jaqt.nix
index 144d19cb01e4..a2f1c2139a1a 100644
--- a/pkgs/applications/audio/faust/faust2jaqt.nix
+++ b/pkgs/applications/audio/faust/faust2jaqt.nix
@@ -1,6 +1,6 @@
 { faust
 , jack2Full
-, opencv
+, opencv2
 , qt4
 , libsndfile
 , which
@@ -17,7 +17,7 @@ faust.wrapWithBuildEnv {
 
   propagatedBuildInputs = [
     jack2Full
-    opencv
+    opencv2
     qt4
     libsndfile
     which
diff --git a/pkgs/applications/audio/ninjas2/default.nix b/pkgs/applications/audio/ninjas2/default.nix
new file mode 100644
index 000000000000..3a23347c1e76
--- /dev/null
+++ b/pkgs/applications/audio/ninjas2/default.nix
@@ -0,0 +1,39 @@
+{ stdenv, fetchFromGitHub, libjack2, libGL, pkgconfig, xorg, mesa, libsndfile, libsamplerate }:
+
+stdenv.mkDerivation rec {
+  pname = "ninjas2";
+  version = "0.2.0";
+
+  src = fetchFromGitHub {
+    owner = "clearly-broken-software";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "1kwp6pmnfar2ip9693gprfbcfscklgri1k1ycimxzlqr61nkd2k9";
+    fetchSubmodules = true;
+  };
+
+  patchPhase = ''
+    patchShebangs dpf/utils/generate-ttl.sh
+  '';
+
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [
+    libjack2 xorg.libX11 libGL mesa libsndfile libsamplerate
+  ];
+
+  installPhase = ''
+    install -dD bin/ninjas2.lv2 $out/lib/lv2/ninjas2.lv2
+    install -D bin/ninjas2-vst.so  $out/lib/vst/ninjas2-vst.so
+    install -D bin/ninjas2 $out/bin/ninjas2
+  '';
+
+  makeFlags = [ "PREFIX=$(out)" ];
+
+  meta = with stdenv.lib; {
+    homepage = "https://github.com/clearly-broken-software/ninjas2";
+    description = "sample slicer plugin for LV2, VST, and jack standalone";
+    license = with licenses; [ gpl3 ];
+    maintainers = [ maintainers.magnetophon ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/applications/audio/spotify-tui/default.nix b/pkgs/applications/audio/spotify-tui/default.nix
index d29e9e33568b..91acab353892 100644
--- a/pkgs/applications/audio/spotify-tui/default.nix
+++ b/pkgs/applications/audio/spotify-tui/default.nix
@@ -2,20 +2,20 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "spotify-tui";
-  version = "0.18.0";
+  version = "0.19.0";
 
   src = fetchFromGitHub {
     owner = "Rigellute";
     repo = "spotify-tui";
     rev = "v${version}";
-    sha256 = "15icg332iyacdn4ydr4nivblayg4xkcnjh4f0sjnhj4q173v8fq2";
+    sha256 = "1bdcfkfbvvn262p4j0nb4kvjzzgrvn3kxlif48yipqkkykzsgz6g";
   };
 
-  cargoSha256 = "0rw8pj74k88rvcr18837g356lwsn2vdq384yma9df462xd2cw823";
+  cargoSha256 = "13v2ilmfs9468kavlx6wrsp0dscppxbxgygwpdd35p5hq3vnhl7k";
 
-  nativeBuildInputs = [ pkgconfig ] ++ stdenv.lib.optionals stdenv.isLinux [ python3 ];
-  buildInputs = [ openssl ]
-    ++ stdenv.lib.optional stdenv.isLinux libxcb
+  nativeBuildInputs = stdenv.lib.optionals stdenv.isLinux [ pkgconfig python3 ];
+  buildInputs = [ ]
+    ++ stdenv.lib.optionals stdenv.isLinux [ openssl libxcb ]
     ++ stdenv.lib.optionals stdenv.isDarwin [ AppKit Security ];
 
   meta = with stdenv.lib; {
diff --git a/pkgs/applications/blockchains/particl/particl-core.nix b/pkgs/applications/blockchains/particl/particl-core.nix
index 5cb94b8bd547..f30e9a609808 100644
--- a/pkgs/applications/blockchains/particl/particl-core.nix
+++ b/pkgs/applications/blockchains/particl/particl-core.nix
@@ -17,11 +17,11 @@ with stdenv.lib;
 
 stdenv.mkDerivation rec {
   pname = "particl-core";
-  version = "0.17.1.2";
+  version = "0.19.1.1";
 
   src = fetchurl {
     url = "https://github.com/particl/particl-core/archive/v${version}.tar.gz";
-    sha256 = "16hcyxwp6yrypwvxz6i2987z3jmpk47xcgnsgh9klih8baqg64p5";
+    sha256 = "11y5q2srkh6r2samppjb5mg6hl79y16j2lj1r23p0968vb9c45kl";
   };
 
   nativeBuildInputs = [ pkgconfig autoreconfHook ];
diff --git a/pkgs/applications/editors/bluefish/default.nix b/pkgs/applications/editors/bluefish/default.nix
index ff1daef8b80d..c7ac671c15bf 100644
--- a/pkgs/applications/editors/bluefish/default.nix
+++ b/pkgs/applications/editors/bluefish/default.nix
@@ -3,11 +3,11 @@
 }:
 
 stdenv.mkDerivation rec {
-  name = "bluefish-2.2.10";
+  name = "bluefish-2.2.11";
 
   src = fetchurl {
     url = "mirror://sourceforge/bluefish/${name}.tar.bz2";
-    sha256 = "1ciygj79q6i3ga5x1j8aivc05nh6rhhnm7hrq8q8xd9vd4ms3v5g";
+    sha256 = "1zy2ppdg3nq9iy3zgfhnw93bq5zbbhyampf7bk3grpfvq5zqfk25";
   };
 
   nativeBuildInputs = [ intltool pkgconfig wrapGAppsHook ];
diff --git a/pkgs/applications/editors/focuswriter/default.nix b/pkgs/applications/editors/focuswriter/default.nix
index 30e8af7facdb..c30cfcb1fb9c 100644
--- a/pkgs/applications/editors/focuswriter/default.nix
+++ b/pkgs/applications/editors/focuswriter/default.nix
@@ -2,11 +2,11 @@
 
 mkDerivation rec {
   pname = "focuswriter";
-  version = "1.7.5";
+  version = "1.7.6";
 
   src = fetchurl {
     url = "https://gottcode.org/focuswriter/focuswriter-${version}-src.tar.bz2";
-    sha256 = "19fqxyas941xcqjj68qpj42ayq0vw5rbd4ms5kvx8jyspp7wysqc";
+    sha256 = "0h85f6cs9zbxv118mjfxqfv41j19zkx2xq36mpnlmrlzkjj7dx9l";
   };
 
   nativeBuildInputs = [ pkgconfig qmake qttools ];
diff --git a/pkgs/applications/editors/leo-editor/default.nix b/pkgs/applications/editors/leo-editor/default.nix
index f7c6d80dbf1a..f09fd2ec2779 100644
--- a/pkgs/applications/editors/leo-editor/default.nix
+++ b/pkgs/applications/editors/leo-editor/default.nix
@@ -2,13 +2,13 @@
 
 mkDerivation rec {
   pname = "leo-editor";
-  version = "6.2";
+  version = "6.2.1";
 
   src = fetchFromGitHub {
     owner = "leo-editor";
     repo = "leo-editor";
     rev = version;
-    sha256 = "07f10qwvi3p7bskzxnx5rlhlfrh7rx8v0xdlc4vs2271438j1j2z";
+    sha256 = "1s9jvxwzsl32clp78g92nq9p2byf08libr5widl1jnkv1cpkbvh9";
   };
 
   dontBuild = true;
diff --git a/pkgs/applications/gis/saga/default.nix b/pkgs/applications/gis/saga/default.nix
index 05f895bdee15..388ac1ee7a7f 100644
--- a/pkgs/applications/gis/saga/default.nix
+++ b/pkgs/applications/gis/saga/default.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchurl, gdal, wxGTK30, proj, libiodbc, lzma,
-  libharu, opencv, vigra, postgresql, Cocoa,
+  libharu, opencv2, vigra, postgresql, Cocoa,
   unixODBC , poppler, hdf4, hdf5, netcdf, sqlite, qhull, giflib }:
 
 stdenv.mkDerivation {
@@ -8,7 +8,7 @@ stdenv.mkDerivation {
 
   # See https://groups.google.com/forum/#!topic/nix-devel/h_vSzEJAPXs
   # for why the have additional buildInputs on darwin
-  buildInputs = [ gdal wxGTK30 proj libharu opencv vigra postgresql libiodbc lzma
+  buildInputs = [ gdal wxGTK30 proj libharu opencv2 vigra postgresql libiodbc lzma
                   qhull giflib ]
                 ++ stdenv.lib.optionals stdenv.isDarwin
                   [ Cocoa unixODBC poppler hdf4.out hdf5 netcdf sqlite ];
diff --git a/pkgs/applications/graphics/avocode/default.nix b/pkgs/applications/graphics/avocode/default.nix
index 8b1811c645f2..9981e8a439ee 100644
--- a/pkgs/applications/graphics/avocode/default.nix
+++ b/pkgs/applications/graphics/avocode/default.nix
@@ -5,11 +5,11 @@
 
 stdenv.mkDerivation rec {
   pname = "avocode";
-  version = "4.4.3";
+  version = "4.6.2";
 
   src = fetchurl {
     url = "https://media.avocode.com/download/avocode-app/${version}/avocode-${version}-linux.zip";
-    sha256 = "03pq55mdgbaf6c2q57ww2990wr6qz8hk1r6xs1irqy8990m4afvk";
+    sha256 = "1ldvscxfvwpsir8vr1ca9ra0841m6xy331ys31dngcp77nwncjqc";
   };
 
   libPath = stdenv.lib.makeLibraryPath (with xorg; [
diff --git a/pkgs/applications/misc/cherrytree/default.nix b/pkgs/applications/misc/cherrytree/default.nix
index 7c00add77971..d2ade055d6fd 100644
--- a/pkgs/applications/misc/cherrytree/default.nix
+++ b/pkgs/applications/misc/cherrytree/default.nix
@@ -2,13 +2,13 @@
 
 pythonPackages.buildPythonApplication rec {
   pname = "cherrytree";
-  version = "0.39.2";
+  version = "0.39.3";
 
   src = fetchFromGitHub {
     owner = "giuspen";
     repo = "cherrytree";
     rev = version;
-    sha256 = "1l6wh24bhp4yhmsfmc0r4n2n10nlilkv4cmv5sfl80i250fiw7xa";
+    sha256 = "1k9i7acpphx0if6ij2p9fkmj638ry6hcyr1rdr039a8zi8hq98gz";
 
   };
 
diff --git a/pkgs/applications/misc/copyq/default.nix b/pkgs/applications/misc/copyq/default.nix
index 081acb3acb61..ec2bd6b32c07 100644
--- a/pkgs/applications/misc/copyq/default.nix
+++ b/pkgs/applications/misc/copyq/default.nix
@@ -5,13 +5,13 @@
 
 mkDerivation rec {
   pname = "CopyQ";
-  version = "3.10.0";
+  version = "3.11.0";
 
   src  = fetchFromGitHub {
     owner = "hluk";
     repo = "CopyQ";
     rev = "v${version}";
-    sha256 = "05nhgndiq0sm1bvb80sf5fgnm38249dclwzmfm7hzrablmkwgv3c";
+    sha256 = "1wx6nqcyzknbw71sliwq4cb5qq1gy6pr9867s6x3vpg3n8g2czkf";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/applications/misc/fetchmail/default.nix b/pkgs/applications/misc/fetchmail/default.nix
index 9e3790090272..1b892c7f536c 100644
--- a/pkgs/applications/misc/fetchmail/default.nix
+++ b/pkgs/applications/misc/fetchmail/default.nix
@@ -1,7 +1,7 @@
 { stdenv, fetchurl, openssl }:
 
 let
-  version = "6.4.3";
+  version = "6.4.4";
 in
 stdenv.mkDerivation {
   pname = "fetchmail";
@@ -9,7 +9,7 @@ stdenv.mkDerivation {
 
   src = fetchurl {
     url = "mirror://sourceforge/fetchmail/fetchmail-${version}.tar.xz";
-    sha256 = "1r6k14m40ni9114i3j1lr6zwpxky6k89mycgxxg0cpdap4a0wdmh";
+    sha256 = "1smbydwfjq29a2l44g6mgj0cd412fz40gbq6vq0klm7pmgd606si";
   };
 
   buildInputs = [ openssl ];
diff --git a/pkgs/applications/misc/gallery-dl/default.nix b/pkgs/applications/misc/gallery-dl/default.nix
index 791db13e4239..6845cbcb59db 100644
--- a/pkgs/applications/misc/gallery-dl/default.nix
+++ b/pkgs/applications/misc/gallery-dl/default.nix
@@ -2,11 +2,11 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "gallery_dl";
-  version = "1.13.3";
+  version = "1.13.6";
 
   src = python3Packages.fetchPypi {
     inherit pname version;
-    sha256 = "0nhbhli45i2xhkmyj9mpg8fn1l58y2zmr6nnnnms557wpdpg112x";
+    sha256 = "17hgryj8qsxcx3c96ir25q0wsh5q0s6c6fb33lqfdbrfxrjcixbk";
   };
 
   doCheck = false;
diff --git a/pkgs/applications/misc/grip/default.nix b/pkgs/applications/misc/grip/default.nix
index e64ae08037a3..b1985be2c946 100644
--- a/pkgs/applications/misc/grip/default.nix
+++ b/pkgs/applications/misc/grip/default.nix
@@ -2,11 +2,11 @@
 , curl, cdparanoia, libid3tag, ncurses, libtool }:
 
 stdenv.mkDerivation rec {
-  name = "grip-4.1.0";
+  name = "grip-4.1.1";
 
   src = fetchurl {
     url = "mirror://sourceforge/grip/${name}.tar.gz";
-    sha256 = "0iy7bcyrxm7zyrxah06qyxdshkgq6yqkadlw211j2qzld38a79j5";
+    sha256 = "1sbjgawb7qrinixybwi0adk7mpdfb565gkffp5gxxsw8fqd068fs";
   };
 
   nativeBuildInputs = [ pkgconfig ];
diff --git a/pkgs/applications/misc/joplin-desktop/default.nix b/pkgs/applications/misc/joplin-desktop/default.nix
index 5787836487b4..3c84588530cc 100644
--- a/pkgs/applications/misc/joplin-desktop/default.nix
+++ b/pkgs/applications/misc/joplin-desktop/default.nix
@@ -2,7 +2,7 @@
 
 let
   pname = "joplin-desktop";
-  version = "1.0.200";
+  version = "1.0.201";
   desktopItem = makeDesktopItem {
      name = "Joplin";
      exec = "joplin-desktop";
@@ -13,7 +13,7 @@ in appimageTools.wrapType2 rec {
   name = "${pname}-${version}";
   src = fetchurl {
     url = "https://github.com/laurent22/joplin/releases/download/v${version}/Joplin-${version}.AppImage";
-    sha256 = "14gwv8i6dprvl96mifadq0zj77a82rww8xd5bmzm8ql6sidi2216";
+    sha256 = "060dkgamsv59vgslqyjfh1g8wg3nldrvfb9lf0y9sxjlbsv8bc55";
   };
 
 
diff --git a/pkgs/applications/misc/khard/default.nix b/pkgs/applications/misc/khard/default.nix
index 0d3c9d0cbd06..8646b9864d9e 100644
--- a/pkgs/applications/misc/khard/default.nix
+++ b/pkgs/applications/misc/khard/default.nix
@@ -1,12 +1,12 @@
 { stdenv, glibcLocales, python3 }:
 
 python3.pkgs.buildPythonApplication rec {
-  version = "0.16.0";
+  version = "0.16.1";
   pname = "khard";
 
   src = python3.pkgs.fetchPypi {
     inherit pname version;
-    sha256 = "0a1zpkq0pplmn9flxczq2wafs6zc07r9xx9qi6dqmyv9mhy9d87f";
+    sha256 = "0fg4qh5gzki5wg958wlpc8a2icnk74gzg33lqxjm755cfnjng7qd";
   };
 
   propagatedBuildInputs = with python3.pkgs; [
diff --git a/pkgs/applications/misc/xastir/default.nix b/pkgs/applications/misc/xastir/default.nix
index 719d26c7199b..e5dc92c4ad62 100644
--- a/pkgs/applications/misc/xastir/default.nix
+++ b/pkgs/applications/misc/xastir/default.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "xastir";
-  version = "2.1.4";
+  version = "2.1.6";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "Release-${version}";
-    sha256 = "14f908jy5jzvgm1h1sr47hjqjq3q2nq91byhimk84kj044fn21w9";
+    sha256 = "sha256-IdlRScAy7tCyVCElCceY4PvqPXWfZZ35f+MwCo3nO3s=";
   };
 
   buildInputs = [
diff --git a/pkgs/applications/misc/xmrig/default.nix b/pkgs/applications/misc/xmrig/default.nix
index a205b402bc8a..b564c5c530fb 100644
--- a/pkgs/applications/misc/xmrig/default.nix
+++ b/pkgs/applications/misc/xmrig/default.nix
@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   pname = "xmrig";
-  version = "5.10.0";
+  version = "5.11.1";
 
   src = fetchFromGitHub {
     owner = "xmrig";
     repo = "xmrig";
     rev = "v${version}";
-    sha256 = "06nxhrb5vnlq3sxybiyzdpbv6ah1zam7r07s1c31sv37znlb77d5";
+    sha256 = "04wsz7hcmzm5dv9q1wb26nvcz5gxdcgkf00cp5bpbr3y9vc6dyz6";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/applications/networking/Sylk/default.nix b/pkgs/applications/networking/Sylk/default.nix
index 64e0a9dcba27..7079e3afa9a6 100644
--- a/pkgs/applications/networking/Sylk/default.nix
+++ b/pkgs/applications/networking/Sylk/default.nix
@@ -2,7 +2,7 @@
 
 let
   pname = "Sylk";
-  version = "2.6.1";
+  version = "2.7.0";
 in
 
 appimageTools.wrapType2 rec {
@@ -10,7 +10,7 @@ appimageTools.wrapType2 rec {
 
   src = fetchurl {
     url = "http://download.ag-projects.com/Sylk/Sylk-${version}-x86_64.AppImage";
-    hash = "sha256:0417qk925k7p3fiq1zha9al86jrz6mqspda7mi3h9blpbyvlcy7w";
+    hash = "sha256:0xjg9j69yj06ys8229x6mwsjlk3mvxi8gnr2kymx0vhhg1zvqi1k";
   };
 
   profile = ''
diff --git a/pkgs/applications/networking/browsers/firefox/wrapper.nix b/pkgs/applications/networking/browsers/firefox/wrapper.nix
index 0afa8ca7b834..52773bf291a6 100644
--- a/pkgs/applications/networking/browsers/firefox/wrapper.nix
+++ b/pkgs/applications/networking/browsers/firefox/wrapper.nix
@@ -2,13 +2,14 @@
 
 ## various stuff that can be plugged in
 , flashplayer, hal-flash
-, ffmpeg, xorg, libpulseaudio, libcanberra-gtk2, libglvnd
+, ffmpeg_4, xorg, libpulseaudio, libcanberra-gtk2, libglvnd
 , gnome3/*.gnome-shell*/
 , browserpass, chrome-gnome-shell, uget-integrator, plasma-browser-integration, bukubrow
 , tridactyl-native
 , fx_cast_bridge
 , udev
 , kerberos
+, libva
 }:
 
 ## configurability of the wrapper itself
@@ -64,8 +65,8 @@ let
           ++ lib.optional (cfg.enableFXCastBridge or false) fx_cast_bridge
           ++ extraNativeMessagingHosts
         );
-      libs =   lib.optional stdenv.isLinux udev
-            ++ lib.optional ffmpegSupport ffmpeg
+      libs =   lib.optionals stdenv.isLinux [ udev libva ]
+            ++ lib.optional ffmpegSupport ffmpeg_4
             ++ lib.optional gssSupport kerberos
             ++ lib.optional gdkWayland libglvnd
             ++ lib.optionals (cfg.enableQuakeLive or false)
diff --git a/pkgs/applications/networking/instant-messengers/riot/riot-desktop-package.json b/pkgs/applications/networking/instant-messengers/riot/riot-desktop-package.json
index 390b61d8d367..d036050a4768 100644
--- a/pkgs/applications/networking/instant-messengers/riot/riot-desktop-package.json
+++ b/pkgs/applications/networking/instant-messengers/riot/riot-desktop-package.json
@@ -2,7 +2,7 @@
   "name": "riot-web",
   "productName": "Riot",
   "main": "src/electron-main.js",
-  "version": "1.5.15",
+  "version": "1.6.0",
   "description": "A feature-rich client for Matrix.org",
   "author": "New Vector Ltd.",
   "dependencies": {
diff --git a/pkgs/applications/networking/instant-messengers/riot/riot-desktop-yarndeps.nix b/pkgs/applications/networking/instant-messengers/riot/riot-desktop-yarndeps.nix
index e1dce803b408..0db687dff0bc 100644
--- a/pkgs/applications/networking/instant-messengers/riot/riot-desktop-yarndeps.nix
+++ b/pkgs/applications/networking/instant-messengers/riot/riot-desktop-yarndeps.nix
@@ -610,11 +610,11 @@
       };
     }
     {
-      name = "minimist___minimist_1.2.2.tgz";
+      name = "minimist___minimist_1.2.3.tgz";
       path = fetchurl {
-        name = "minimist___minimist_1.2.2.tgz";
-        url  = "https://registry.yarnpkg.com/minimist/-/minimist-1.2.2.tgz";
-        sha1 = "b00a00230a1108c48c169e69a291aafda3aacd63";
+        name = "minimist___minimist_1.2.3.tgz";
+        url  = "https://registry.yarnpkg.com/minimist/-/minimist-1.2.3.tgz";
+        sha1 = "3db5c0765545ab8637be71f333a104a965a9ca3f";
       };
     }
     {
diff --git a/pkgs/applications/networking/instant-messengers/riot/riot-desktop.nix b/pkgs/applications/networking/instant-messengers/riot/riot-desktop.nix
index a30df623050d..3b4f968c129c 100644
--- a/pkgs/applications/networking/instant-messengers/riot/riot-desktop.nix
+++ b/pkgs/applications/networking/instant-messengers/riot/riot-desktop.nix
@@ -8,12 +8,12 @@
 
 let
   executableName = "riot-desktop";
-  version = "1.5.15";
+  version = "1.6.0";
   riot-web-src = fetchFromGitHub {
     owner = "vector-im";
     repo = "riot-web";
     rev = "v${version}";
-    sha256 = "08yk5is6n9ci1jml0b94a3swdybx01k5klbl30i1b76biyn75m77";
+    sha256 = "16zm6l4c7vkfdlxh6gdw531k5r4v3mb0h66q41h94dvmj79dz2bj";
   };
   electron = electron_7;
 
diff --git a/pkgs/applications/networking/instant-messengers/riot/riot-web.nix b/pkgs/applications/networking/instant-messengers/riot/riot-web.nix
index 78fc4b45f6b1..3aeb715ac67f 100644
--- a/pkgs/applications/networking/instant-messengers/riot/riot-web.nix
+++ b/pkgs/applications/networking/instant-messengers/riot/riot-web.nix
@@ -12,11 +12,11 @@ let
 
 in stdenv.mkDerivation rec {
   pname = "riot-web";
-  version = "1.5.15";
+  version = "1.6.0";
 
   src = fetchurl {
     url = "https://github.com/vector-im/riot-web/releases/download/v${version}/riot-v${version}.tar.gz";
-    sha256 = "09a9l1l65m2c4ldycjhnqn0mmblm3j65vc9rcjfkdxqbd6bh86h7";
+    sha256 = "1mm4xk69ya1k3gz6jjhc4njx7b3rp157jmrqsxr5i382zs035ff7";
   };
 
   installPhase = ''
diff --git a/pkgs/applications/networking/mailreaders/afew/default.nix b/pkgs/applications/networking/mailreaders/afew/default.nix
index 7d7f660df7c7..8b2a6f05c4e5 100644
--- a/pkgs/applications/networking/mailreaders/afew/default.nix
+++ b/pkgs/applications/networking/mailreaders/afew/default.nix
@@ -2,18 +2,22 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "afew";
-  version = "2.0.0";
+  version = "3.0.0";
 
   src = python3Packages.fetchPypi {
     inherit pname version;
-    sha256 = "0j60501nm242idf2ig0h7p6wrg58n5v2p6zfym56v9pbvnbmns0s";
+    sha256 = "18j3xyzchlslcrkycr2i59jg73cb6yh5s7l3qnl6sa7vgxcbhq7c";
   };
 
   nativeBuildInputs = with python3Packages; [ sphinx setuptools_scm ];
 
   propagatedBuildInputs = with python3Packages; [
     python3Packages.setuptools python3Packages.notmuch chardet dkimpy
-  ] ++ stdenv.lib.optional (!python3Packages.isPy3k) subprocess32;
+  ];
+
+  checkInputs = with python3Packages; [
+    freezegun notmuch
+  ];
 
   makeWrapperArgs = [
     ''--prefix PATH ':' "${notmuch}/bin"''
diff --git a/pkgs/applications/networking/remote/anydesk/default.nix b/pkgs/applications/networking/remote/anydesk/default.nix
index 3e639c283493..8830881b69fb 100644
--- a/pkgs/applications/networking/remote/anydesk/default.nix
+++ b/pkgs/applications/networking/remote/anydesk/default.nix
@@ -5,7 +5,7 @@
 
 let
   sha256 = {
-    x86_64-linux = "1ry21zw5ghba4xjx8dvimlpprgap7n8j9lqhjsciahbvc16vx5ks";
+    x86_64-linux = "09ajpsmgrgjhw7b91id76w84kwk2d678n0b81zzpwq7sgjcm0sb0";
     i386-linux   = "0vjxbg5hwkqkh600rr75xviwy848r1xw9mxwf6bb6l8b0isvlsgg";
   }.${stdenv.hostPlatform.system} or (throw "system ${stdenv.hostPlatform.system} not supported");
 
@@ -28,7 +28,7 @@ let
 
 in stdenv.mkDerivation rec {
   pname = "anydesk";
-  version = "5.5.4";
+  version = "5.5.5";
 
   src = fetchurl {
     urls = [
diff --git a/pkgs/applications/networking/syncthing/default.nix b/pkgs/applications/networking/syncthing/default.nix
index 94fec82fdf72..fa3290f74850 100644
--- a/pkgs/applications/networking/syncthing/default.nix
+++ b/pkgs/applications/networking/syncthing/default.nix
@@ -3,17 +3,17 @@
 let
   common = { stname, target, postInstall ? "" }:
     buildGoModule rec {
-      version = "1.4.2";
+      version = "1.5.0";
       name = "${stname}-${version}";
 
       src = fetchFromGitHub {
         owner  = "syncthing";
         repo   = "syncthing";
         rev    = "v${version}";
-        sha256 = "0pfzpbdir2agwsyfjh1rxlyyd225xmyrr4k2g4vlg5r12kpcjwya";
+        sha256 = "0yy31rfvr9d6kidfvvy36ljxlc14x5ir3ln19zg4k02hdqn0xkpj";
       };
 
-      modSha256 = "0qjhb55nd8mlnswbk8bgl2sb9angmv8fnympmmyqj1dqa7lcs87z";
+      modSha256 = "1vs7lxlqd7jr4r9xkk7w7k6gxzjmm7ic0a1scfpx8rcr5swa9cq1";
 
       patches = [
         ./add-stcli-target.patch
diff --git a/pkgs/applications/radio/dablin/default.nix b/pkgs/applications/radio/dablin/default.nix
index d365596b9c30..287649ddbe1e 100644
--- a/pkgs/applications/radio/dablin/default.nix
+++ b/pkgs/applications/radio/dablin/default.nix
@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   pname = "dablin";
-  version = "1.12.0";
+  version = "1.13.0";
 
   src = fetchFromGitHub {
     owner = "Opendigitalradio";
     repo = "dablin";
     rev = version;
-    sha256 = "0d514ixz062xyyh4k3laxwhn3k3a1l4jq4w7rxf8x46d3743zrf7";
+    sha256 = "0143jnhwwh4din6mlrkbm8m2wm8vnrlk0yk9r5qcvj70r2314bgq";
   };
 
   nativeBuildInputs = [ cmake pkgconfig ];
diff --git a/pkgs/applications/radio/tlf/default.nix b/pkgs/applications/radio/tlf/default.nix
index e3fdb9718e4a..fd9ab82b321c 100644
--- a/pkgs/applications/radio/tlf/default.nix
+++ b/pkgs/applications/radio/tlf/default.nix
@@ -3,13 +3,13 @@
 
 stdenv.mkDerivation rec {
   pname = "tlf";
-  version = "1.4.0";
+  version = "1.4.1";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "${pname}-${version}";
-    sha256 = "0f97hxiwc6blp5haik871q6zzvwy0b3p2jg8ad2dvaxg07xc76l0";
+    sha256 = "1xpgs4k27pjd9mianfknknp6mf34365bcp96wrv5xh4dhph573rj";
   };
 
   nativeBuildInputs = [ autoreconfHook autoconf automake pkgconfig perl ];
diff --git a/pkgs/applications/science/astronomy/kstars/default.nix b/pkgs/applications/science/astronomy/kstars/default.nix
new file mode 100644
index 000000000000..0b53e3e85ac3
--- /dev/null
+++ b/pkgs/applications/science/astronomy/kstars/default.nix
@@ -0,0 +1,48 @@
+{
+  mkDerivation, lib, fetchgit,
+  extra-cmake-modules,
+
+  kconfig, kdoctools, kguiaddons, ki18n, kinit, kiconthemes, kio,
+  knewstuff, kplotting, kwidgetsaddons, kxmlgui,
+
+  qtx11extras, qtwebsockets,
+
+  eigen, zlib,
+
+  cfitsio, indilib, xplanet
+}:
+
+mkDerivation {
+  name = "kstars";
+  
+  src = fetchgit {
+    url = "https://anongit.kde.org/kstars.git";
+    rev = "7acc527939280edd22823371dc4e22494c6c626a";
+    sha256 = "1n1lgi7p3dj893fdnzjbnrha40p4apl0dy8zppcabxwrb1khb84v";
+  };
+  
+  nativeBuildInputs = [ extra-cmake-modules kdoctools ];
+  buildInputs = [
+    kconfig kdoctools kguiaddons ki18n kinit kiconthemes kio
+    knewstuff kplotting kwidgetsaddons kxmlgui
+
+    qtx11extras qtwebsockets
+
+    eigen zlib
+
+    cfitsio indilib xplanet
+  ];
+
+  meta = with lib; {
+    description = "Virtual planetarium astronomy software";
+    homepage = "https://kde.org/applications/education/org.kde.kstars";
+    longDescription = ''
+      It provides an accurate graphical simulation of the night sky, from any location on Earth, at any date and time.
+      The display includes up to 100 million stars, 13.000 deep-sky objects, all 8 planets, the Sun and Moon, and thousands of comets, asteroids, supernovae, and satellites.
+      For students and teachers, it supports adjustable simulation speeds in order to view phenomena that happen over long timescales, the KStars Astrocalculator to predict conjunctions, and many common astronomical calculations.
+    '';
+    license = licenses.gpl2;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ timput ];
+  };
+}
diff --git a/pkgs/applications/science/math/mathematica/10.nix b/pkgs/applications/science/math/mathematica/10.nix
index c7da7b16da8f..277fb1984c44 100644
--- a/pkgs/applications/science/math/mathematica/10.nix
+++ b/pkgs/applications/science/math/mathematica/10.nix
@@ -8,7 +8,7 @@
 , gcc
 , glib
 , ncurses
-, opencv
+, opencv2
 , openssl
 , unixODBC
 , xorg
@@ -49,7 +49,7 @@ stdenv.mkDerivation rec {
     gcc.libc
     glib
     ncurses
-    opencv
+    opencv2
     openssl
     unixODBC
     libxml2
diff --git a/pkgs/applications/science/math/mathematica/11.nix b/pkgs/applications/science/math/mathematica/11.nix
index 898d6a486351..1c698a5e5428 100644
--- a/pkgs/applications/science/math/mathematica/11.nix
+++ b/pkgs/applications/science/math/mathematica/11.nix
@@ -10,7 +10,7 @@
 , gcc
 , glib
 , ncurses
-, opencv
+, opencv2
 , openssl
 , unixODBC
 , xkeyboard_config
@@ -46,7 +46,7 @@ stdenv.mkDerivation rec {
     gcc.libc
     glib
     ncurses
-    opencv
+    opencv2
     openssl
     unixODBC
     xkeyboard_config
diff --git a/pkgs/applications/science/math/mathematica/9.nix b/pkgs/applications/science/math/mathematica/9.nix
index 617ac8657132..d0967485c01f 100644
--- a/pkgs/applications/science/math/mathematica/9.nix
+++ b/pkgs/applications/science/math/mathematica/9.nix
@@ -8,7 +8,7 @@
 , gcc
 , glib
 , ncurses
-, opencv
+, opencv2
 , openssl
 , unixODBC
 , xorg
@@ -46,7 +46,7 @@ stdenv.mkDerivation rec {
     gcc.libc
     glib
     ncurses
-    opencv
+    opencv2
     openssl
     unixODBC
   ] ++ (with xorg; [
diff --git a/pkgs/applications/science/math/mathematica/default.nix b/pkgs/applications/science/math/mathematica/default.nix
index 7831640b1244..94d72eec6ae4 100644
--- a/pkgs/applications/science/math/mathematica/default.nix
+++ b/pkgs/applications/science/math/mathematica/default.nix
@@ -11,7 +11,7 @@
 , glib
 , libssh2
 , ncurses
-, opencv
+, opencv2
 , openssl
 , unixODBC
 , xkeyboard_config
@@ -47,7 +47,7 @@ stdenv.mkDerivation rec {
     glib
     libssh2
     ncurses
-    opencv
+    opencv2
     openssl
     stdenv.cc.cc.lib
     unixODBC
diff --git a/pkgs/applications/science/molecular-dynamics/gromacs/default.nix b/pkgs/applications/science/molecular-dynamics/gromacs/default.nix
index fadd60d9ebbf..d345827ed4eb 100644
--- a/pkgs/applications/science/molecular-dynamics/gromacs/default.nix
+++ b/pkgs/applications/science/molecular-dynamics/gromacs/default.nix
@@ -9,11 +9,11 @@
 }:
 
 stdenv.mkDerivation {
-  name = "gromacs-2020.1";
+  name = "gromacs-2020.2";
 
   src = fetchurl {
-    url = "ftp://ftp.gromacs.org/pub/gromacs/gromacs-2020.1.tar.gz";
-    sha256 = "1kwrk3i1dxp8abhqqsl049lh361n4910h0415g052f8shdc6arp1";
+    url = "ftp://ftp.gromacs.org/pub/gromacs/gromacs-2020.2.tar.gz";
+    sha256 = "1wyjgcdl30wy4hy6jvi9lkq53bqs9fgfq6fri52dhnb3c76y8rbl";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/applications/version-management/git-and-tools/git-subtrac/default.nix b/pkgs/applications/version-management/git-and-tools/git-subtrac/default.nix
index 07c63ea0119b..a5097697a867 100644
--- a/pkgs/applications/version-management/git-and-tools/git-subtrac/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git-subtrac/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "git-subtrac";
-  version = "0.01";
+  version = "0.02";
 
   src = fetchFromGitHub {
     owner = "apenwarr";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1w6gd0x1902lzpqr74gsdrnxq36f6v14bv8h0vhlrfhbwbsih7n6";
+    sha256 = "1nj950r38sxzrgw69m1xphm7a4km2g29iw2897gfx4wx57jl957k";
   };
 
   modSha256 = "147vzllp1gydk2156hif313vwykagrj35vaiqy1swqczxs7p9hhs";
diff --git a/pkgs/applications/version-management/git-and-tools/git-trim/default.nix b/pkgs/applications/version-management/git-and-tools/git-trim/default.nix
index 0a3360b33b0d..d843cdc307c0 100644
--- a/pkgs/applications/version-management/git-and-tools/git-trim/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git-trim/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "git-trim";
-  version = "0.3.1";
+  version = "0.3.2";
 
   src = fetchFromGitHub {
     owner = "foriequal0";
     repo = pname;
     rev = "v${version}";
-    sha256 = "06wni47s8yq274bh5f7bcy0sah23938kjiw5pdxnma5kwwnrccrr";
+    sha256 = "079kavm3n776wvmy25jq1g4qdvmhh3d3x1vdpb1f6pw5rkky8lyw";
   };
 
-  cargoSha256 = "06ndja8212xy4rybh1117wijsyj70w4z8h6km538a7598s49vzdk";
+  cargoSha256 = "1ii5l7z9avg0gzlaav2gnfbr8wkbp008i5rz6k6bs2sfqnpnn5k6";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/applications/video/p2pvc/default.nix b/pkgs/applications/video/p2pvc/default.nix
index 219954ff9f20..91468ea1ee60 100644
--- a/pkgs/applications/video/p2pvc/default.nix
+++ b/pkgs/applications/video/p2pvc/default.nix
@@ -1,10 +1,10 @@
-{ stdenv, pkgconfig, fetchFromGitHub, opencv, ncurses, portaudio }:
+{ stdenv, pkgconfig, fetchFromGitHub, opencv2, ncurses, portaudio }:
 
 stdenv.mkDerivation {
   name = "p2pvc";
 
   nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [ opencv ncurses portaudio ];
+  buildInputs = [ opencv2 ncurses portaudio ];
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/applications/virtualization/podman/wrapper.nix b/pkgs/applications/virtualization/podman/wrapper.nix
index 0b905c0c709e..99233696b3ed 100644
--- a/pkgs/applications/virtualization/podman/wrapper.nix
+++ b/pkgs/applications/virtualization/podman/wrapper.nix
@@ -28,21 +28,25 @@ let
   ] ++ extraPackages);
 
 in runCommand podman.name {
-  inherit (podman) name pname version meta outputs;
+  name = "${podman.pname}-wrapper-${podman.version}";
+  inherit (podman) pname version;
+
+  meta = builtins.removeAttrs podman.meta [ "outputsToInstall" ];
+
+  outputs = [
+    "out"
+    "man"
+  ];
+
   nativeBuildInputs = [
     makeWrapper
   ];
 
 } ''
-  # Symlink everything but $bin from podman-unwrapped
-  ${
-    lib.concatMapStringsSep "\n"
-    (o: "ln -s ${podman.${o}} ${placeholder o}")
-    (builtins.filter (o: o != "bin")
-    podman.outputs)}
-
-  mkdir -p $bin/bin
-  ln -s ${podman-unwrapped}/share $bin/share
-  makeWrapper ${podman-unwrapped}/bin/podman $bin/bin/podman \
+  ln -s ${podman.man} $man
+
+  mkdir -p $out/bin
+  ln -s ${podman-unwrapped}/share $out/share
+  makeWrapper ${podman-unwrapped}/bin/podman $out/bin/podman \
     --prefix PATH : ${binPath}
 ''
diff --git a/pkgs/build-support/fetchurl/builder.sh b/pkgs/build-support/fetchurl/builder.sh
index 74fdc320835f..e93c98419a67 100644
--- a/pkgs/build-support/fetchurl/builder.sh
+++ b/pkgs/build-support/fetchurl/builder.sh
@@ -47,13 +47,18 @@ tryDownload() {
 
 
 finish() {
+    local skipPostFetch="$1"
+
     set +o noglob
 
     if [[ $executable == "1" ]]; then
       chmod +x $downloadedFile
     fi
 
-    runHook postFetch
+    if [ -z "$skipPostFetch" ]; then
+        runHook postFetch
+    fi
+
     exit 0
 }
 
@@ -69,7 +74,13 @@ tryHashedMirrors() {
             --fail --silent --show-error --head "$url" \
             --write-out "%{http_code}" --output /dev/null > code 2> log; then
             tryDownload "$url"
-            if test -n "$success"; then finish; fi
+
+            # We skip postFetch here, because hashed-mirrors are
+            # already content addressed. So if $outputHash is in the
+            # hashed-mirror, changes from ‘postFetch’ would already be
+            # made. So, running postFetch will end up applying the
+            # change /again/, which we don’t want.
+            if test -n "$success"; then finish skipPostFetch; fi
         else
             # Be quiet about 404 errors, which we interpret as the file
             # not being present on this particular mirror.
diff --git a/pkgs/desktops/cinnamon/cinnamon-session/default.nix b/pkgs/desktops/cinnamon/cinnamon-session/default.nix
index 56ff4b106e33..96910052ac9f 100644
--- a/pkgs/desktops/cinnamon/cinnamon-session/default.nix
+++ b/pkgs/desktops/cinnamon/cinnamon-session/default.nix
@@ -27,13 +27,13 @@
 
 stdenv.mkDerivation rec {
   pname = "cinnamon-session";
-  version = "4.4.0";
+  version = "4.4.1";
 
   src = fetchFromGitHub {
     owner = "linuxmint";
     repo = pname;
     rev = version;
-    sha256 = "0hplck17rksfgqm2z58ajvz4p2m4zg6ksdpbc27ki20iv4fv620s";
+    sha256 = "1bkhzgdinsk4ahp1b4jf50phxwv2da23rh35cmg9fbm5c88701ga";
   };
 
   patches = [
diff --git a/pkgs/desktops/gnome-3/misc/pomodoro/default.nix b/pkgs/desktops/gnome-3/misc/pomodoro/default.nix
index fce6b71c4c8e..b9489526dd71 100644
--- a/pkgs/desktops/gnome-3/misc/pomodoro/default.nix
+++ b/pkgs/desktops/gnome-3/misc/pomodoro/default.nix
@@ -23,13 +23,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-shell-pomodoro";
-  version = "0.16.0";
+  version = "0.17.0";
 
   src = fetchFromGitHub {
     owner = "codito";
     repo = "gnome-pomodoro";
     rev = version;
-    sha256 = "1bjsjkbms9irn7nkzi0hmgr5vwcgh9xzr5vw4sk2n711wj5d96bi";
+    sha256 = "0s9wzx7wbynpqgj7nlgs5wwx4w2akz7nli89sy7pxcn4xpnahqgn";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/desktops/xfce/core/xfwm4/default.nix b/pkgs/desktops/xfce/core/xfwm4/default.nix
index ed77699f191e..1d119014cab6 100644
--- a/pkgs/desktops/xfce/core/xfwm4/default.nix
+++ b/pkgs/desktops/xfce/core/xfwm4/default.nix
@@ -5,9 +5,9 @@
 mkXfceDerivation {
   category = "xfce";
   pname = "xfwm4";
-  version = "4.14.0"; # TODO: remove xfce4-14 alias when this gets bumped
+  version = "4.14.2";
 
-  sha256 = "1z5aqij2d8n9wnha88b0qzkvss54jvqs8w1w5m3mzjl4c9mn9n8m";
+  sha256 = "1zzc4q1j55hjljksmlyghk58bx7kxyq3scihsr9zgyqc24ww1ks3";
 
   nativeBuildInputs = [ exo librsvg ];
 
diff --git a/pkgs/development/compilers/abcl/default.nix b/pkgs/development/compilers/abcl/default.nix
index 2c9de7617781..005e4186b152 100644
--- a/pkgs/development/compilers/abcl/default.nix
+++ b/pkgs/development/compilers/abcl/default.nix
@@ -1,11 +1,11 @@
 {stdenv, fetchurl, ant, jre, jdk}:
 stdenv.mkDerivation rec {
   pname = "abcl";
-  version = "1.6.0";
+  version = "1.6.1";
   # or fetchFromGitHub(owner,repo,rev) or fetchgit(rev)
   src = fetchurl {
     url = "https://common-lisp.net/project/armedbear/releases/${version}/${pname}-src-${version}.tar.gz";
-    sha256 = "0hvbcsffr8n2xwdixc8wyw1bfl9fxn2gyy0c4nma7j9zbn0wwgw9";
+    sha256 = "04myiba6g0vij2ym2dmb0156k20ki2lz13dxwp2bk9kvjn2zg88b";
   };
   configurePhase = ''
     mkdir nix-tools
diff --git a/pkgs/development/compilers/closure/default.nix b/pkgs/development/compilers/closure/default.nix
index 5204932448b1..896b3a767898 100644
--- a/pkgs/development/compilers/closure/default.nix
+++ b/pkgs/development/compilers/closure/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "closure-compiler";
-  version = "20200315";
+  version = "20200406";
 
   src = fetchurl {
     url = "https://dl.google.com/closure-compiler/compiler-${version}.tar.gz";
-    sha256 = "0akif1wgsyyqrfkidkwhw47dsx471h3b4zsjhnh4rf6kv7by3q65";
+    sha256 = "1dd6fakavnadpm8h8r4d1saf9flm7ilhknfy0q6i5i237psjf7i5";
   };
 
   sourceRoot = ".";
diff --git a/pkgs/development/compilers/fasm/bin.nix b/pkgs/development/compilers/fasm/bin.nix
index 8b5230d2e726..c595c86615b8 100644
--- a/pkgs/development/compilers/fasm/bin.nix
+++ b/pkgs/development/compilers/fasm/bin.nix
@@ -3,11 +3,11 @@
 stdenvNoCC.mkDerivation rec {
   pname = "fasm-bin";
 
-  version = "1.73.23";
+  version = "1.73.24";
 
   src = fetchurl {
     url = "https://flatassembler.net/fasm-${version}.tgz";
-    sha256 = "1p7hs4sqnfxw6axdifjbdcllvl1ycx5vf6n7nvq1gampz0yfcl6j";
+    sha256 = "142vxhs8mh8isvlzq7ir0asmqda410phzxmk9gk9b43dldskkj7k";
   };
 
   installPhase = ''
diff --git a/pkgs/development/interpreters/elixir/1.10.nix b/pkgs/development/interpreters/elixir/1.10.nix
index afab770da353..d63a94d98d6d 100644
--- a/pkgs/development/interpreters/elixir/1.10.nix
+++ b/pkgs/development/interpreters/elixir/1.10.nix
@@ -3,7 +3,7 @@
 # How to obtain `sha256`:
 # nix-prefetch-url --unpack https://github.com/elixir-lang/elixir/archive/v${version}.tar.gz
 mkDerivation {
-  version = "1.10.2";
-  sha256 = "04yi1hljq7ii9flh6pmb5411z7q1bdq9f9sq8323k9hm1f5jwkx6";
+  version = "1.10.3";
+  sha256 = "18bqqqzvhr1zj491wc3d36a310mg1wcs12npp70zfmgqrc60q65a";
   minimumOTPVersion = "21";
 }
diff --git a/pkgs/development/interpreters/joker/default.nix b/pkgs/development/interpreters/joker/default.nix
index b176c55cbfd1..39588a0c363b 100644
--- a/pkgs/development/interpreters/joker/default.nix
+++ b/pkgs/development/interpreters/joker/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "joker";
-  version = "0.15.0";
+  version = "0.15.3";
 
   src = fetchFromGitHub {
     rev = "v${version}";
     owner = "candid82";
     repo = "joker";
-    sha256 = "03lbvxmkn0rr7yv7kj6c4dh4zayiwbhrkqbz2m22dw568rjbp8az";
+    sha256 = "1pxj6flyhf522zjab1dfvxfajyx3v3rzs7l8ma7ma6b8zmwp2wdn";
   };
 
-  modSha256 = "1mylgim9nm0v5wybgzi74nqzmvzwzws0027wzl86dbj5id83ab9v";
+  modSha256 = "165mjfjk4x95ckw7wg96bg9pzb3297sggnip38nz2jxxbqr0ff8b";
 
   preBuild = ''
     go generate ./...
diff --git a/pkgs/development/interpreters/python/default.nix b/pkgs/development/interpreters/python/default.nix
index 5dc3b224720a..2def54de12d1 100644
--- a/pkgs/development/interpreters/python/default.nix
+++ b/pkgs/development/interpreters/python/default.nix
@@ -23,8 +23,6 @@ with pkgs;
       };
     in rec {
         isPy27 = pythonVersion == "2.7";
-        isPy33 = pythonVersion == "3.3"; # TODO: remove
-        isPy34 = pythonVersion == "3.4"; # TODO: remove
         isPy35 = pythonVersion == "3.5";
         isPy36 = pythonVersion == "3.6";
         isPy37 = pythonVersion == "3.7";
diff --git a/pkgs/development/interpreters/racket/default.nix b/pkgs/development/interpreters/racket/default.nix
index 725b1d5106df..1db01c0d7758 100644
--- a/pkgs/development/interpreters/racket/default.nix
+++ b/pkgs/development/interpreters/racket/default.nix
@@ -46,7 +46,7 @@ in
 
 stdenv.mkDerivation rec {
   pname = "racket";
-  version = "7.6"; # always change at once with ./minimal.nix
+  version = "7.7"; # always change at once with ./minimal.nix
 
   src = (stdenv.lib.makeOverridable ({ name, sha256 }:
     fetchurl {
@@ -55,7 +55,7 @@ stdenv.mkDerivation rec {
     }
   )) {
     name = "${pname}-${version}";
-    sha256 = "0yagy7qrnz96gwafnj3whh2vs54788k1ci3vkm100h68gsw638b8";
+    sha256 = "0cx5h3k0n58cb442qzp3jlc7n1b9dbaxv9blg2rjil2rn119yrb2";
   };
 
   FONTCONFIG_FILE = fontsConf;
@@ -82,10 +82,7 @@ stdenv.mkDerivation rec {
   '';
 
   shared = if stdenv.isDarwin then "dylib" else "shared";
-  configureFlags = [ "--enable-${shared}"  "--enable-lt=${libtool}/bin/libtool"
-                     # The following flag is a temporary workaround for an upstream bug:
-                     #   https://github.com/racket/racket/issues/3046
-                     "--enable-useprefix" ]
+  configureFlags = [ "--enable-${shared}"  "--enable-lt=${libtool}/bin/libtool" ]
                    ++ stdenv.lib.optional disableDocs [ "--disable-docs" ]
                    ++ stdenv.lib.optional stdenv.isDarwin [ "--enable-xonx" ];
 
diff --git a/pkgs/development/interpreters/racket/minimal.nix b/pkgs/development/interpreters/racket/minimal.nix
index 9e817b760003..a4a7a5c12cd4 100644
--- a/pkgs/development/interpreters/racket/minimal.nix
+++ b/pkgs/development/interpreters/racket/minimal.nix
@@ -5,7 +5,7 @@ racket.overrideAttrs (oldAttrs: rec {
   name = "racket-minimal-${oldAttrs.version}";
   src = oldAttrs.src.override {
     inherit name;
-    sha256 = "0id094q9024hj2n3907l7dblp3iix1v5289xzskmh5c26xfygp9y";
+    sha256 = "1lxcd4ix8q3089xql48hwccxvcpkinfxwxnc6fhcjdgzqcyxh3ln";
   };
 
   meta = oldAttrs.meta // {
diff --git a/pkgs/development/libraries/enet/default.nix b/pkgs/development/libraries/enet/default.nix
index 90c312bb7a64..e1172870ede7 100644
--- a/pkgs/development/libraries/enet/default.nix
+++ b/pkgs/development/libraries/enet/default.nix
@@ -1,11 +1,11 @@
 {stdenv, fetchurl}:
 
 stdenv.mkDerivation rec {
-  name = "enet-1.3.14";
+  name = "enet-1.3.15";
 
   src = fetchurl {
     url = "http://enet.bespin.org/download/${name}.tar.gz";
-    sha256 = "0w780zc6cy8yq4cskpphx0f91lzh51vh9lwyc5ll8hhamdxgbxlq";
+    sha256 = "1yxxf9bkx6dx3j8j70fj17c05likyfibb1419ls74hp58qrzdgas";
   };
 
   meta = {
diff --git a/pkgs/development/libraries/freetds/default.nix b/pkgs/development/libraries/freetds/default.nix
index 89ea40c1c65e..31ce6602963c 100644
--- a/pkgs/development/libraries/freetds/default.nix
+++ b/pkgs/development/libraries/freetds/default.nix
@@ -8,11 +8,11 @@ assert odbcSupport -> unixODBC != null;
 
 stdenv.mkDerivation rec {
   pname = "freetds";
-  version = "1.1.26";
+  version = "1.1.33";
 
   src = fetchurl {
     url    = "https://www.freetds.org/files/stable/${pname}-${version}.tar.bz2";
-    sha256 = "1nqxcnf6lax7grsxhajq87h92ngm487nzzz87kkmh1nzk33r7dwd";
+    sha256 = "1gq972ngpdmpb63mc6myxsd0rf3qph95qx542021xh9f2791qffi";
   };
 
   buildInputs = [
diff --git a/pkgs/development/libraries/geos/default.nix b/pkgs/development/libraries/geos/default.nix
index be0edab3155d..4e7ce1d5ac85 100644
--- a/pkgs/development/libraries/geos/default.nix
+++ b/pkgs/development/libraries/geos/default.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl, python }:
 
 stdenv.mkDerivation rec {
-  name = "geos-3.8.0";
+  name = "geos-3.8.1";
 
   src = fetchurl {
     url = "https://download.osgeo.org/geos/${name}.tar.bz2";
-    sha256 = "1mb2v9fy1gnbjhcgv0xny11ggfb17vkzsajdyibigwsxr4ylq4cr";
+    sha256 = "1xqpmr10xi0n9sj47fbwc89qb0yr9imh4ybk0jsxpffy111syn22";
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/development/libraries/java/commons/compress/default.nix b/pkgs/development/libraries/java/commons/compress/default.nix
index a9624ff243cb..5307c635834c 100644
--- a/pkgs/development/libraries/java/commons/compress/default.nix
+++ b/pkgs/development/libraries/java/commons/compress/default.nix
@@ -1,12 +1,12 @@
 { stdenv, fetchurl }:
 
 stdenv.mkDerivation rec {
-  version = "1.18";
+  version = "1.20";
   pname = "commons-compress";
 
   src = fetchurl {
     url    = "mirror://apache/commons/compress/binaries/${pname}-${version}-bin.tar.gz";
-    sha256 = "0ciwzq134rqh1fp7qba091rajf2pdagfb665rarni7glb2x4lha1";
+    sha256 = "0zx1sc0rw3vzjan69vxr2qw82y9b0hqdzp4plcahc3c1y0vkz3fg";
   };
 
   installPhase = ''
diff --git a/pkgs/development/libraries/libjcat/default.nix b/pkgs/development/libraries/libjcat/default.nix
index dc95f9199326..54ab31e2702b 100644
--- a/pkgs/development/libraries/libjcat/default.nix
+++ b/pkgs/development/libraries/libjcat/default.nix
@@ -1,6 +1,5 @@
 { stdenv
 , fetchFromGitHub
-, fetchpatch
 , docbook_xml_dtd_43
 , docbook-xsl-nons
 , glib
@@ -20,7 +19,7 @@
 
 stdenv.mkDerivation rec {
   pname = "libjcat";
-  version = "0.1.1";
+  version = "0.1.2";
 
   outputs = [ "bin" "out" "dev" "devdoc" "man" "installedTests" ];
 
@@ -28,18 +27,12 @@ stdenv.mkDerivation rec {
     owner = "hughsie";
     repo = "libjcat";
     rev = version;
-    sha256 = "hWJUzpQvy2V4pS8C/nW7Xrs9U9LQWMsGuTVOnm5UJc0=";
+    sha256 = "zb9zKEvYUOSyo/j6hXTYZlQOSLdMkkT2I+Pe/0wMrWo=";
   };
 
   patches = [
     # Installed tests are installed to different output
     ./installed-tests-path.patch
-
-    # Fix version file generation
-    (fetchpatch {
-      url = "https://github.com/hughsie/libjcat/commit/cf2d9298a5fab7278ee040bc0b4be384a7b5538e.patch";
-      sha256 = "3749qih+wfhU8ECklh5BvReJ7pS+Ao1Q7YueZ1tT0Is=";
-    })
   ];
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/rdkafka/default.nix b/pkgs/development/libraries/rdkafka/default.nix
index f955f464d32d..d8f20d74a0df 100644
--- a/pkgs/development/libraries/rdkafka/default.nix
+++ b/pkgs/development/libraries/rdkafka/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "rdkafka";
-  version = "1.3.0";
+  version = "1.4.0";
 
   src = fetchFromGitHub {
     owner = "edenhill";
     repo = "librdkafka";
     rev = "v${version}";
-    sha256 = "1arwpvva2b1m3yd618s59v38gwsi0nnm07g6yc9dapcgxrkg5n0h";
+    sha256 = "0axrzjmih1njjpxpwfb6pwjwkjy1b6s5s1sjf165m2cmd6x3vbap";
   };
 
   nativeBuildInputs = [ pkgconfig ];
diff --git a/pkgs/development/ocaml-modules/async_find/default.nix b/pkgs/development/ocaml-modules/async_find/default.nix
deleted file mode 100644
index aa797cdace35..000000000000
--- a/pkgs/development/ocaml-modules/async_find/default.nix
+++ /dev/null
@@ -1,22 +0,0 @@
-{stdenv, buildOcaml, fetchurl, async_p4, core_p4, sexplib_p4}:
-
-buildOcaml rec {
-  name = "async_find";
-  version = "111.28.00";
-
-  minimumSupportedOcamlVersion = "4.02";
-
-  src = fetchurl {
-    url = "https://github.com/janestreet/async_find/archive/${version}.tar.gz";
-    sha256 = "4e3fda72f50174f05d96a5a09323f236c041b1a685890c155822956f3deb8803";
-  };
-
-  propagatedBuildInputs = [ async_p4 core_p4 sexplib_p4 ];
-
-  meta = with stdenv.lib; {
-    homepage = "https://github.com/janestreet/async_find";
-    description = "Directory traversal with Async";
-    license = licenses.asl20;
-    maintainers = [ maintainers.ericbmerritt ];
-  };
-}
diff --git a/pkgs/development/python-modules/ansible/default.nix b/pkgs/development/python-modules/ansible/default.nix
index bd3e5662e185..b9c710e68884 100644
--- a/pkgs/development/python-modules/ansible/default.nix
+++ b/pkgs/development/python-modules/ansible/default.nix
@@ -18,13 +18,13 @@
 
 buildPythonPackage rec {
   pname = "ansible";
-  version = "2.9.2";
+  version = "2.9.7";
 
   src = fetchFromGitHub {
     owner = "ansible";
     repo = "ansible";
     rev = "v${version}";
-    sha256 = "06vxvn5q13rxzndwzq3g6yxiqm361ma9zcvwbrfn630xkmsg4pd8";
+    sha256 = "0miid7h720i630qljcjdmgdblflhrl2pwqjgiq5wm8jr61c3ld6s";
   };
 
   prePatch = ''
diff --git a/pkgs/development/python-modules/autopep8/default.nix b/pkgs/development/python-modules/autopep8/default.nix
index ccefe60ea089..715e4da8f44e 100644
--- a/pkgs/development/python-modules/autopep8/default.nix
+++ b/pkgs/development/python-modules/autopep8/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "autopep8";
-  version = "1.5.1";
+  version = "1.5.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1swr8ccm3mafcm3zpbwyn22kjs39lbqmg8w41sh7yb3gskgy2syc";
+    sha256 = "0m29ndgrcgrzi3y1fsxmdl421x6n4gn02l70hsz8486h8zzdhbqm";
   };
 
   propagatedBuildInputs = [ pycodestyle ];
diff --git a/pkgs/development/python-modules/clikit/default.nix b/pkgs/development/python-modules/clikit/default.nix
index 32e9b4fcb4a6..98533f95f922 100644
--- a/pkgs/development/python-modules/clikit/default.nix
+++ b/pkgs/development/python-modules/clikit/default.nix
@@ -1,5 +1,5 @@
 { lib, buildPythonPackage, fetchPypi
-, isPy27, isPy34
+, isPy27
 , pylev, pastel, typing, enum34 }:
 
 buildPythonPackage rec {
@@ -13,8 +13,7 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [
     pylev pastel
-  ] ++ lib.optional (isPy27 || isPy34) typing
-    ++ lib.optional isPy27 enum34;
+  ] ++ lib.optionals isPy27 [ typing enum34 ];
 
   # The Pypi tarball doesn't include tests, and the GitHub source isn't
   # buildable until we bootstrap poetry, see
diff --git a/pkgs/development/python-modules/evdev/default.nix b/pkgs/development/python-modules/evdev/default.nix
index cef6c27e59cf..ab169fe679d8 100644
--- a/pkgs/development/python-modules/evdev/default.nix
+++ b/pkgs/development/python-modules/evdev/default.nix
@@ -1,4 +1,4 @@
-{ lib, buildPythonPackage, isPy34, fetchPypi, linuxHeaders }:
+{ lib, buildPythonPackage, fetchPypi, linuxHeaders }:
 
 buildPythonPackage rec {
   pname = "evdev";
@@ -17,8 +17,6 @@ buildPythonPackage rec {
 
   doCheck = false;
 
-  disabled = isPy34;  # see http://bugs.python.org/issue21121
-
   meta = with lib; {
     description = "Provides bindings to the generic input event interface in Linux";
     homepage = "https://pythonhosted.org/evdev";
diff --git a/pkgs/development/python-modules/livestreamer/default.nix b/pkgs/development/python-modules/livestreamer/default.nix
index da789c0f6a66..83bd4bcfb72c 100644
--- a/pkgs/development/python-modules/livestreamer/default.nix
+++ b/pkgs/development/python-modules/livestreamer/default.nix
@@ -7,7 +7,6 @@
 , singledispatch
 , futures
 , isPy27
-, isPy33
 }:
 
 buildPythonPackage rec {
@@ -23,8 +22,7 @@ buildPythonPackage rec {
   buildInputs = [ pkgs.makeWrapper ];
 
   propagatedBuildInputs = [ pkgs.rtmpdump pycrypto requests ]
-    ++ stdenv.lib.optionals isPy27 [ singledispatch futures ]
-    ++ stdenv.lib.optionals isPy33 [ singledispatch ];
+    ++ stdenv.lib.optionals isPy27 [ singledispatch futures ];
 
   postInstall = ''
     wrapProgram $out/bin/livestreamer --prefix PATH : ${pkgs.rtmpdump}/bin
diff --git a/pkgs/development/python-modules/nipype/default.nix b/pkgs/development/python-modules/nipype/default.nix
index 436c9fe63794..06c6f9cb0c1f 100644
--- a/pkgs/development/python-modules/nipype/default.nix
+++ b/pkgs/development/python-modules/nipype/default.nix
@@ -31,6 +31,7 @@
 , xvfbwrapper
 , pytestcov
 , codecov
+, sphinx
 # other dependencies
 , which
 , bash
@@ -49,11 +50,11 @@ in
 
 buildPythonPackage rec {
   pname = "nipype";
-  version = "1.3.1";
+  version = "1.4.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "bb190964b568d64b04b73d2aa7eae31061fdbc3051d8c27bb34b1632db07ec71";
+    sha256 = "1nr0z0k4xx1vswkp03g1lf8141mr4j2fbwd7wmpay4vz46qcp786";
   };
 
   postPatch = ''
@@ -61,6 +62,10 @@ buildPythonPackage rec {
       --replace "/usr/bin/env bash" "${bash}/bin/bash"
   '';
 
+  nativeBuildInputs = [
+    sphinx
+  ];
+
   propagatedBuildInputs = [
     click
     dateutil
@@ -102,15 +107,14 @@ buildPythonPackage rec {
   doCheck = !stdenv.isDarwin;
   # ignore tests which incorrect fail to detect xvfb
   checkPhase = ''
-    LC_ALL="en_US.UTF-8" pytest -v nipype -k 'not display'
+    LC_ALL="en_US.UTF-8" pytest nipype/tests -k 'not display'
   '';
+  pythonImportsCheck = [ "nipype" ];
 
   meta = with stdenv.lib; {
     homepage = "https://nipy.org/nipype/";
     description = "Neuroimaging in Python: Pipelines and Interfaces";
     license = licenses.bsd3;
     maintainers = with maintainers; [ ashgillman ];
-    # tests hang, blocking reviews of other packages
-    broken = isPy38;
   };
 }
diff --git a/pkgs/development/python-modules/numba/default.nix b/pkgs/development/python-modules/numba/default.nix
index 8fbbdb677fd5..71e8eec39416 100644
--- a/pkgs/development/python-modules/numba/default.nix
+++ b/pkgs/development/python-modules/numba/default.nix
@@ -4,7 +4,6 @@
 , python
 , buildPythonPackage
 , isPy27
-, isPy33
 , isPy3k
 , numpy
 , llvmlite
@@ -26,7 +25,8 @@ buildPythonPackage rec {
 
   NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.isDarwin "-I${libcxx}/include/c++/v1";
 
-  propagatedBuildInputs = [numpy llvmlite] ++ stdenv.lib.optional (!isPy3k) funcsigs ++ stdenv.lib.optional (isPy27 || isPy33) singledispatch;
+  propagatedBuildInputs = [numpy llvmlite]
+    ++ stdenv.lib.optionals isPy27 [ funcsigs singledispatch];
 
   # Copy test script into $out and run the test suite.
   checkPhase = ''
diff --git a/pkgs/development/python-modules/poetry/default.nix b/pkgs/development/python-modules/poetry/default.nix
index 481fd2c5feb7..46be9bc92a28 100644
--- a/pkgs/development/python-modules/poetry/default.nix
+++ b/pkgs/development/python-modules/poetry/default.nix
@@ -1,5 +1,6 @@
 { lib, buildPythonPackage, fetchPypi, callPackage
-, isPy27, isPy34, pythonOlder
+, isPy27
+, pythonOlder
 , cleo
 , requests
 , cachy
@@ -66,8 +67,7 @@ in buildPythonPackage rec {
     pexpect
     keyring
     lockfile
-  ] ++ lib.optionals (isPy27 || isPy34) [ typing pathlib2 glob2 ]
-    ++ lib.optionals isPy27 [ virtualenv functools32 subprocess32 ]
+  ] ++ lib.optionals isPy27 [ typing pathlib2 glob2 virtualenv functools32 subprocess32 ]
     ++ lib.optionals (pythonOlder "3.8") [ importlib-metadata ];
 
   postInstall = ''
diff --git a/pkgs/development/python-modules/pycairo/default.nix b/pkgs/development/python-modules/pycairo/default.nix
index fbefd7efefa6..d61279e38d5d 100644
--- a/pkgs/development/python-modules/pycairo/default.nix
+++ b/pkgs/development/python-modules/pycairo/default.nix
@@ -1,4 +1,4 @@
-{ lib, fetchFromGitHub, meson, ninja, buildPythonPackage, pytest, pkgconfig, cairo, xlibsWrapper, isPy33, isPy3k }:
+{ lib, fetchFromGitHub, meson, ninja, buildPythonPackage, pytest, pkgconfig, cairo, xlibsWrapper, isPy3k }:
 
 buildPythonPackage rec {
   pname = "pycairo";
@@ -6,8 +6,6 @@ buildPythonPackage rec {
 
   format = "other";
 
-  disabled = isPy33;
-
   src = fetchFromGitHub {
     owner = "pygobject";
     repo = "pycairo";
diff --git a/pkgs/development/python-modules/pydicom/default.nix b/pkgs/development/python-modules/pydicom/default.nix
index 339775c2f54f..6f4e4c97fd1c 100644
--- a/pkgs/development/python-modules/pydicom/default.nix
+++ b/pkgs/development/python-modules/pydicom/default.nix
@@ -8,12 +8,12 @@
 }:
 
 buildPythonPackage rec {
-  version = "1.4.1";
+  version = "1.4.2";
   pname = "pydicom";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0ki4736h6mp77733rsrwicl8pyig39idywzcmwvw3nzi2r1yc7w8";
+    sha256 = "1483hv74fhfk4q18r4rda7yixqqdxrd1djzp3492s81ykxd4k24l";
   };
 
   propagatedBuildInputs = [ numpy pillow ];
diff --git a/pkgs/development/python-modules/pymssql/default.nix b/pkgs/development/python-modules/pymssql/default.nix
deleted file mode 100644
index 5c013efc2d1b..000000000000
--- a/pkgs/development/python-modules/pymssql/default.nix
+++ /dev/null
@@ -1,26 +0,0 @@
-{ lib, buildPythonPackage, fetchPypi, freetds, cython, setuptools-git }:
-
-buildPythonPackage rec {
-  pname = "pymssql";
-  version = "3.0.3";
-
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "4d0ed31c76983d723c0c979b18e2273623621e630ca4901f17a86128aca13f84";
-  };
-
-  buildInputs = [cython setuptools-git];
-  propagatedBuildInputs = [freetds];
-
-  # The tests require a running instance of SQLServer, so we skip them
-  doCheck = false;
-
-  meta = with lib; {
-    homepage = "http://pymssql.org/en/stable/";
-    description = "A simple database interface for Python that builds on top
-      of FreeTDS to provide a Python DB-API (PEP-249) interface to Microsoft
-      SQL Server";
-    license = licenses.lgpl21;
-    maintainers = with maintainers; [ mredaelli ];
-  };
-}
diff --git a/pkgs/development/python-modules/rencode/default.nix b/pkgs/development/python-modules/rencode/default.nix
index 7769adf22194..3240c524d3bd 100644
--- a/pkgs/development/python-modules/rencode/default.nix
+++ b/pkgs/development/python-modules/rencode/default.nix
@@ -1,6 +1,5 @@
 { stdenv
 , buildPythonPackage
-, isPy33
 , fetchgit
 , cython
 }:
@@ -8,7 +7,6 @@
 buildPythonPackage {
   pname = "rencode";
   version = "git20150810";
-  disabled = isPy33;
 
   src = fetchgit {
     url = "https://github.com/aresch/rencode";
diff --git a/pkgs/development/python-modules/rig/default.nix b/pkgs/development/python-modules/rig/default.nix
index d83afd7885f0..bc43aac3551a 100644
--- a/pkgs/development/python-modules/rig/default.nix
+++ b/pkgs/development/python-modules/rig/default.nix
@@ -1,5 +1,5 @@
 { lib, buildPythonPackage, fetchPypi
-, isPy34, isPy35, isPy27
+, isPy35, isPy27
 , numpy, pytz, six, enum-compat, sentinel
 }:
 
@@ -16,7 +16,7 @@ buildPythonPackage rec {
 
   # This is the list of officially supported versions. Other versions may work
   # as well.
-  disabled = !(isPy35 || isPy34 || isPy27);
+  disabled = !(isPy27 || isPy35);
 
   # Test Phase is only supported in development sources.
   doCheck = false;
diff --git a/pkgs/development/python-modules/rl-coach/default.nix b/pkgs/development/python-modules/rl-coach/default.nix
index bee588457ff2..e9efb0c02b4e 100644
--- a/pkgs/development/python-modules/rl-coach/default.nix
+++ b/pkgs/development/python-modules/rl-coach/default.nix
@@ -28,7 +28,7 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0c4f3a334ff55d534d2fc7f83d5e791f64b780391039e367f6cd9b4381838744";
+    sha256 = "0i47hf0l76ydyrky6f8h760bfr0zg5g3vy675x6m6pgm9wrklkqc";
   };
 
   propagatedBuildInputs = [
@@ -94,5 +94,7 @@ buildPythonPackage rec {
     homepage = "https://nervanasystems.github.io/coach/";
     license = licenses.asl20;
     maintainers = with maintainers; [ timokau ];
+    # pythonPackages.gym is too new
+    broken = true; # since 2020-04-20
   };
 }
diff --git a/pkgs/development/python-modules/serpent/default.nix b/pkgs/development/python-modules/serpent/default.nix
index 353ea1cbe26b..701de5200461 100644
--- a/pkgs/development/python-modules/serpent/default.nix
+++ b/pkgs/development/python-modules/serpent/default.nix
@@ -4,7 +4,6 @@
 , lib
 , python
 , isPy27
-, isPy33
 , enum34
 , attrs
 , pytz
@@ -19,7 +18,7 @@ buildPythonPackage rec {
     sha256 = "1arnckykpkvv2qrp49l1k7q5mr5pisswl0rvdx98x8wsl1n361pk";
   };
 
-  propagatedBuildInputs = lib.optionals (isPy27 || isPy33) [ enum34 ];
+  propagatedBuildInputs = lib.optionals isPy27 [ enum34 ];
 
   checkInputs = [ attrs pytz ];
   checkPhase = ''
diff --git a/pkgs/development/python-modules/softlayer/default.nix b/pkgs/development/python-modules/softlayer/default.nix
index 93b0e309b7c4..3c2a5e2a356d 100644
--- a/pkgs/development/python-modules/softlayer/default.nix
+++ b/pkgs/development/python-modules/softlayer/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+, isPy27
 , ptable
 , click
 , requests
@@ -17,6 +18,7 @@
 buildPythonPackage rec {
   pname = "softlayer-python";
   version = "5.8.4";
+  disabled = isPy27;
 
   propagatedBuildInputs = [ ptable click requests prompt_toolkit pygments urllib3 ];
 
diff --git a/pkgs/development/python-modules/tensorflow/2/bin.nix b/pkgs/development/python-modules/tensorflow/2/bin.nix
index d32305ff5133..acb5f473ec9d 100644
--- a/pkgs/development/python-modules/tensorflow/2/bin.nix
+++ b/pkgs/development/python-modules/tensorflow/2/bin.nix
@@ -19,7 +19,7 @@
 , opt-einsum
 , backports_weakref
 , tensorflow-estimator_2
-, tensorflow-tensorboard
+, tensorflow-tensorboard_2
 , cudaSupport ? false
 , cudatoolkit ? null
 , cudnn ? null
@@ -77,7 +77,7 @@ in buildPythonPackage {
     google-pasta
     wrapt
     tensorflow-estimator_2
-    tensorflow-tensorboard
+    tensorflow-tensorboard_2
     keras-applications
     keras-preprocessing
   ] ++ lib.optional (!isPy3k) mock
@@ -159,6 +159,14 @@ in buildPythonPackage {
       done
     '';
 
+  # Upstream has a pip hack that results in bin/tensorboard being in both tensorflow
+  # and the propagated input tensorflow-tensorboard, which causes environment collisions.
+  # Another possibility would be to have tensorboard only in the buildInputs
+  # See https://github.com/NixOS/nixpkgs/pull/44381 for more information.
+  postInstall = ''
+    rm $out/bin/tensorboard
+  '';
+
   pythonImportsCheck = [
     "tensorflow"
     "tensorflow.keras"
diff --git a/pkgs/development/python-modules/toggl-cli/default.nix b/pkgs/development/python-modules/toggl-cli/default.nix
index 6834876d8f81..62d3f2dde24d 100644
--- a/pkgs/development/python-modules/toggl-cli/default.nix
+++ b/pkgs/development/python-modules/toggl-cli/default.nix
@@ -19,6 +19,7 @@ buildPythonPackage rec {
    substituteInPlace requirements.txt \
      --replace "pendulum==2.0.4" "pendulum>=2.0.4" \
      --replace "click-completion==0.5.0" "click-completion>=0.5.0" \
+     --replace "click==7.0" "click>=7.0" \
      --replace "pbr==5.1.2" "pbr>=5.1.2" \
      --replace "inquirer==2.5.1" "inquirer>=2.5.1"
   '';
diff --git a/pkgs/development/python-modules/tomlkit/default.nix b/pkgs/development/python-modules/tomlkit/default.nix
index de48b3736cfc..deff7769dfb4 100644
--- a/pkgs/development/python-modules/tomlkit/default.nix
+++ b/pkgs/development/python-modules/tomlkit/default.nix
@@ -1,4 +1,4 @@
-{ lib, buildPythonPackage, fetchPypi, isPy27, isPy34
+{ lib, buildPythonPackage, fetchPypi, isPy27
 , enum34, functools32, typing
 }:
 
@@ -13,7 +13,7 @@ buildPythonPackage rec {
 
   propagatedBuildInputs =
     lib.optionals isPy27 [ enum34 functools32 ]
-    ++ lib.optional (isPy27 || isPy34) typing;
+    ++ lib.optional isPy27 typing;
 
   # The Pypi tarball doesn't include tests, and the GitHub source isn't
   # buildable until we bootstrap poetry, see
diff --git a/pkgs/development/python-modules/traits/default.nix b/pkgs/development/python-modules/traits/default.nix
index 47bbbee04e7e..5bd849908356 100644
--- a/pkgs/development/python-modules/traits/default.nix
+++ b/pkgs/development/python-modules/traits/default.nix
@@ -4,7 +4,6 @@
 , python
 , pytest
 , numpy
-, isPy33
 }:
 
 buildPythonPackage rec {
@@ -28,7 +27,7 @@ buildPythonPackage rec {
   # https://github.com/enthought/traits/issues/187
   # https://github.com/enthought/traits/pull/188
   # Furthermore, some tests fail due to being in a chroot
-  doCheck = isPy33;
+  doCheck = false;
 
   meta = with stdenv.lib; {
     description = "Explicitly typed attributes for Python";
diff --git a/pkgs/development/tools/flyway/default.nix b/pkgs/development/tools/flyway/default.nix
index 746d66c2dbe8..2d639467910d 100644
--- a/pkgs/development/tools/flyway/default.nix
+++ b/pkgs/development/tools/flyway/default.nix
@@ -1,13 +1,13 @@
 { stdenv, fetchurl, jre_headless, makeWrapper }:
   let
-    version = "6.3.2";
+    version = "6.4.1";
   in
     stdenv.mkDerivation {
       pname = "flyway";
       inherit version;
       src = fetchurl {
         url = "https://repo1.maven.org/maven2/org/flywaydb/flyway-commandline/${version}/flyway-commandline-${version}.tar.gz";
-        sha256 = "1av1q7znphpsi1iz4dbh0fgh3jsx9prz980b25yk5r89h518s76q";
+        sha256 = "00vm2p4xn8jnldjxcj0djpjjx2hppq0ii8367abhbswq7xfhy2d2";
       };
       nativeBuildInputs = [ makeWrapper ];
       dontBuild = true;
diff --git a/pkgs/development/tools/golangci-lint/default.nix b/pkgs/development/tools/golangci-lint/default.nix
index c33a4cf69f59..be5820471570 100644
--- a/pkgs/development/tools/golangci-lint/default.nix
+++ b/pkgs/development/tools/golangci-lint/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "golangci-lint";
-  version = "1.25.1";
+  version = "1.26.0";
 
   src = fetchFromGitHub {
     owner = "golangci";
     repo = "golangci-lint";
     rev = "v${version}";
-    sha256 = "04r26nn72myacs6v2jq8mi4kjik82iwsh6w59h4k9yk0my3fjwia";
+    sha256 = "1xw6m4ps6yw8gnkwy8v7rrz2b8c8n72cd7vkpx481dkd36vccpkc";
   };
 
-  modSha256 = "1pz5f2hv2lssiwsp60hsycg2ijyafb7r5fl2yrvflqg547k3n8x2";
+  modSha256 = "0xgnimr1jydrgwhbyjaz710kx3m3505nhy5cs10p501qxbnzkjf9";
   subPackages = [ "cmd/golangci-lint" ];
 
   meta = with lib; {
diff --git a/pkgs/development/tools/jbake/default.nix b/pkgs/development/tools/jbake/default.nix
index 79054c7f667b..ad127b94960f 100644
--- a/pkgs/development/tools/jbake/default.nix
+++ b/pkgs/development/tools/jbake/default.nix
@@ -1,12 +1,12 @@
 { stdenv, fetchzip, makeWrapper, jre }:
 
 stdenv.mkDerivation rec {
-  version = "2.6.4";
+  version = "2.6.5";
   pname = "jbake";
 
   src = fetchzip {
     url = "https://dl.bintray.com/jbake/binary/${pname}-${version}-bin.zip";
-    sha256 = "0zgp0wwxxmi13v5q5jvr610igx2vxg0bwck9j1imnn9ciakg1aaw";
+    sha256 = "0ripayv1vf4f4ylxr7h9kad2xhy3y98ca8s4p38z7dn8l47zg0qw";
   };
 
   buildInputs = [ makeWrapper jre ];
diff --git a/pkgs/development/tools/just/default.nix b/pkgs/development/tools/just/default.nix
index 5ae2ee1c14d0..8ba536e3b5f5 100644
--- a/pkgs/development/tools/just/default.nix
+++ b/pkgs/development/tools/just/default.nix
@@ -1,4 +1,5 @@
-{ stdenv, fetchFromGitHub, rustPlatform, coreutils, bash, dash }:
+{ stdenv, fetchFromGitHub, rustPlatform, coreutils, bash, dash
+, installShellFiles }:
 
 rustPlatform.buildRustPackage rec {
   pname = "just";
@@ -13,14 +14,14 @@ rustPlatform.buildRustPackage rec {
 
   cargoSha256 = "05mrzav3aydvwac9jjckdmlxvxnlcncmkfsdb9z7zvxia4k89w1l";
 
-  postInstall = ''
-    # generate completion scripts for just
+  nativeBuildInputs = [ installShellFiles ];
 
-    mkdir -p "$out/share/"{bash-completion/completions,fish/vendor_completions.d,zsh/site-functions}
+  postInstall = ''
+    installManPage man/just.1
 
-    $out/bin/just --completions bash > "$out/share/bash-completion/completions/just"
-    $out/bin/just --completions fish > "$out/share/fish/vendor_completions.d/just.fish"
-    $out/bin/just --completions zsh  > "$out/share/zsh/site-functions/_just"
+    installShellCompletion --bash --name just.bash completions/just.bash
+    installShellCompletion --fish --name just.fish completions/just.fish
+    installShellCompletion --zsh  --name _just     completions/just.zsh
   '';
 
   checkInputs = [ coreutils bash dash ];
diff --git a/pkgs/development/tools/vagrant/default.nix b/pkgs/development/tools/vagrant/default.nix
index cc1f1c8021a5..32e205a6f8d3 100644
--- a/pkgs/development/tools/vagrant/default.nix
+++ b/pkgs/development/tools/vagrant/default.nix
@@ -5,9 +5,9 @@
 let
   # NOTE: bumping the version and updating the hash is insufficient;
   # you must use bundix to generate a new gemset.nix in the Vagrant source.
-  version = "2.2.7";
+  version = "2.2.8";
   url = "https://github.com/hashicorp/vagrant/archive/v${version}.tar.gz";
-  sha256 = "1z31y1nqiyj6rml9lz8gcbr29myhs5wcap8jsvgm3pb7p9p9y8m9";
+  sha256 = "0nvxda0dyhncgcl9qs34l4rj0jbdbg65a3ii5765p4899z6gzx95";
 
   deps = bundlerEnv rec {
     name = "${pname}-${version}";
diff --git a/pkgs/development/tools/vagrant/gemset.nix b/pkgs/development/tools/vagrant/gemset.nix
index 64f24f8270db..f5d70b912df5 100644
--- a/pkgs/development/tools/vagrant/gemset.nix
+++ b/pkgs/development/tools/vagrant/gemset.nix
@@ -20,25 +20,24 @@
     version = "3.2.4";
   };
   childprocess = {
-    dependencies = ["ffi"];
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1p3f43scdzx9zxmy2kw5zsc3az6v46nq4brwcxmnscjy4w4racbv";
+      sha256 = "1ic028k8xgm2dds9mqnvwwx3ibaz32j8455zxr9f4bcnviyahya5";
       type = "gem";
     };
-    version = "0.6.3";
+    version = "3.0.0";
   };
   concurrent-ruby = {
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1x07r23s7836cpp5z9yrlbpljcxpax14yw4fy4bnp6crhr6x24an";
+      sha256 = "094387x4yasb797mv07cs3g6f08y56virc2rjcpb1k79rzaj3nhl";
       type = "gem";
     };
-    version = "1.1.5";
+    version = "1.1.6";
   };
   domain_name = {
     dependencies = ["unf"];
@@ -213,10 +212,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "18x61fc36951vw7f74gq8cyybdpxvyg5d0azvqhrs82ddw3v16xh";
+      sha256 = "1zin0q26wc5p7zb7glpwary7ms60s676vcq987yv22jgm6hnlwlh";
       type = "gem";
     };
-    version = "3.2019.1009";
+    version = "3.2020.0425";
   };
   multi_json = {
     groups = ["default"];
@@ -255,10 +254,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0jglf8rxvlw6is5019r6kwsdhw38zm3z39jbghdbj449r6h7h77n";
+      sha256 = "101wd2px9lady54aqmkibvy4j62zk32w0rjz4vnigyg974fsga40";
       type = "gem";
     };
-    version = "5.1.0";
+    version = "5.2.0";
   };
   netrc = {
     groups = ["default"];
@@ -285,10 +284,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1lm1k7wpz69jx7jrc92w3ggczkjyjbfziq5mg62vjnxmzs383xx8";
+      sha256 = "1k9bsj7ni0g2fd7scyyy1sk9dy2pg9akniahab0iznvjmhn54h87";
       type = "gem";
     };
-    version = "0.10.3";
+    version = "0.10.4";
   };
   rb-inotify = {
     dependencies = ["ffi"];
@@ -348,10 +347,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1qxc2zxwwipm6kviiar4gfhcakpx1jdcs89v6lvzivn5hq1xk78l";
+      sha256 = "0590m2pr9i209pp5z4mx0nb1961ishdiqb28995hw1nln1d1b5ji";
       type = "gem";
     };
-    version = "1.3.0";
+    version = "2.3.0";
   };
   unf = {
     dependencies = ["unf_ext"];
@@ -369,10 +368,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1ll6w64ibh81qwvjx19h8nj7mngxgffg7aigjx11klvf5k2g4nxf";
+      sha256 = "0wc47r23h063l8ysws8sy24gzh74mks81cak3lkzlrw4qkqb3sg4";
       type = "gem";
     };
-    version = "0.0.7.6";
+    version = "0.0.7.7";
   };
   vagrant_cloud = {
     dependencies = ["rest-client"];
@@ -412,10 +411,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "12fzg9liydl244xq6r7x0wy06zn1n4czdbnjavy3150c3qsnv71a";
+      sha256 = "1yawwrs3pnvbbm9xn0nbzvyl92kgf1jr439qfbqx0mb8zzkyi2dv";
       type = "gem";
     };
-    version = "1.2.0";
+    version = "1.2.1";
   };
   winrm-fs = {
     dependencies = ["erubi" "logging" "rubyzip" "winrm"];
@@ -423,9 +422,9 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0phhzliw47hmpi3ddygs500kfxa7il5yzmp7dw4ix2dvhrxrj7s6";
+      sha256 = "093f698l9b9cx6vcqwjc9hi5hbd86ynp1g5c7g9k18y6h7fxjk43";
       type = "gem";
     };
-    version = "1.3.3";
+    version = "1.3.4";
   };
 }
\ No newline at end of file
diff --git a/pkgs/development/tools/vgo2nix/default.nix b/pkgs/development/tools/vgo2nix/default.nix
index 5f2a45f74273..27860661167a 100644
--- a/pkgs/development/tools/vgo2nix/default.nix
+++ b/pkgs/development/tools/vgo2nix/default.nix
@@ -9,16 +9,16 @@
 
 buildGoPackage {
   pname = "vgo2nix";
-  version = "unstable-2019-02-06";
+  version = "unstable-2020-05-05";
   goPackagePath = "github.com/adisbladis/vgo2nix";
 
   nativeBuildInputs = [ makeWrapper ];
 
   src = fetchFromGitHub {
-    owner = "adisbladis";
+    owner = "nix-community";
     repo = "vgo2nix";
-    rev = "f2694cd352830f0561bc00bbcaa08cefb2e36439";
-    sha256 = "10cwi67cyhqjq1pwhry2n1v8z7wybl4cawzmjmfgs5mbsvqp0h78";
+    rev = "71e59bf268d5257a0f89b2f59cd20fd468c8c6ac";
+    sha256 = "1pcdkknq2v7nrs0siqcvvq2x0qqz5snwdz2lpjnad8i33rwhmayh";
   };
 
   goDeps = ./deps.nix;
@@ -33,7 +33,7 @@ buildGoPackage {
 
   meta = with stdenv.lib; {
     description = "Convert go.mod files to nixpkgs buildGoPackage compatible deps.nix files";
-    homepage = "https://github.com/adisbladis/vgo2nix";
+    homepage = "https://github.com/nix-community/vgo2nix";
     license = licenses.mit;
     maintainers = with maintainers; [ adisbladis ];
   };
diff --git a/pkgs/development/tools/vgo2nix/deps.nix b/pkgs/development/tools/vgo2nix/deps.nix
index 4f8506794d36..2d9a130e43e3 100644
--- a/pkgs/development/tools/vgo2nix/deps.nix
+++ b/pkgs/development/tools/vgo2nix/deps.nix
@@ -127,12 +127,66 @@
     };
   }
   {
+    goPackagePath = "github.com/yuin/goldmark";
+    fetch = {
+      type = "git";
+      url = "https://github.com/yuin/goldmark";
+      rev = "v1.1.27";
+      sha256 = "1872cqnii0kwiqcy81yin0idvjy5mdy4zlzz0csb319lcjs3b923";
+    };
+  }
+  {
+    goPackagePath = "golang.org/x/crypto";
+    fetch = {
+      type = "git";
+      url = "https://go.googlesource.com/crypto";
+      rev = "87dc89f01550";
+      sha256 = "0z4i1m2yn3f31ci7wvcm2rxkx2yiv7a78mfzklncmsz2k97rlh2g";
+    };
+  }
+  {
+    goPackagePath = "golang.org/x/mod";
+    fetch = {
+      type = "git";
+      url = "https://go.googlesource.com/mod";
+      rev = "v0.2.0";
+      sha256 = "1fp6885dclq77mh73v7i54v2b9llpv4di193zc8vmsbbkkc483cl";
+    };
+  }
+  {
+    goPackagePath = "golang.org/x/net";
+    fetch = {
+      type = "git";
+      url = "https://go.googlesource.com/net";
+      rev = "0de0cce0169b";
+      sha256 = "1db7s5kbzyh2zd5lpv05n7hp8wbwdvgk0wpiwrlnig94mkr0y5aq";
+    };
+  }
+  {
+    goPackagePath = "golang.org/x/sync";
+    fetch = {
+      type = "git";
+      url = "https://go.googlesource.com/sync";
+      rev = "cd5d95a43a6e";
+      sha256 = "1nqkyz2y1qvqcma52ijh02s8aiqmkfb95j08f6zcjhbga3ds6hds";
+    };
+  }
+  {
     goPackagePath = "golang.org/x/sys";
     fetch = {
       type = "git";
       url = "https://go.googlesource.com/sys";
-      rev = "d99a578cf41b";
-      sha256 = "10q9xx4pmnq92qn6ff4xp7n1hx766wvw2rf7pqcd6rx5plgwz8cm";
+      rev = "97732733099d";
+      sha256 = "118hkp01i4z1f5h6hcjm0ff2ngqhrzj1f7731n0kw8dr6hvbx0sw";
+    };
+  }
+  {
+    goPackagePath = "golang.org/x/text";
+    fetch = {
+      type = "git";
+      url = "https://go.googlesource.com/text";
+      rev = "v0.3.0";
+      sha256 = "0r6x6zjzhr8ksqlpiwm5gdd7s209kwk5p4lw54xjvz10cs3qlq19";
     };
   }
   {
@@ -140,8 +194,17 @@
     fetch = {
       type = "git";
       url = "https://go.googlesource.com/tools";
-      rev = "ded554d0681e";
-      sha256 = "04rlq9hc3ccww9sbsrl48fl6wbjprb136rqxyr7dmgfj444aml56";
+      rev = "0c9eba77bc32";
+      sha256 = "1xz0jyxdmibkams6vd61va5cw963l25jjf3i9r33m0i739qwg4lj";
+    };
+  }
+  {
+    goPackagePath = "golang.org/x/xerrors";
+    fetch = {
+      type = "git";
+      url = "https://go.googlesource.com/xerrors";
+      rev = "9bdfabe68543";
+      sha256 = "1yjfi1bk9xb81lqn85nnm13zz725wazvrx3b50hx19qmwg7a4b0c";
     };
   }
 ]
diff --git a/pkgs/development/tools/wabt/default.nix b/pkgs/development/tools/wabt/default.nix
index 281d68d27de6..376593eefb8b 100644
--- a/pkgs/development/tools/wabt/default.nix
+++ b/pkgs/development/tools/wabt/default.nix
@@ -2,25 +2,18 @@
 
 stdenv.mkDerivation rec {
   pname = "wabt";
-  version = "1.0.13";
+  version = "1.0.14";
 
   src = fetchFromGitHub {
     owner = "WebAssembly";
     repo = "wabt";
     rev = version;
-    sha256 = "07x8m5sf4c7zjq1flypycw1d15ylqdp38l81vn961ds089ngvpgg";
+    sha256 = "0zis0190zs37x1wq044qd2vyvzcrkm8kp0734byz1lpdlgl5257b";
     fetchSubmodules = true;
   };
 
-  patches = [
-    (substituteAll {
-      src = ./version.patch;
-      inherit version;
-    })
-  ];
-
   nativeBuildInputs = [ cmake ];
-  cmakeFlags = [ "-DBUILD_TESTS=OFF" ];
+  cmakeFlags = [ "-DBUILD_TESTS=OFF" "-DCMAKE_PROJECT_VERSION=${version}" ];
   buildInputs = [ python3 ];
 
   meta = with stdenv.lib; {
diff --git a/pkgs/development/tools/wabt/version.patch b/pkgs/development/tools/wabt/version.patch
deleted file mode 100644
index a49cd0bc1552..000000000000
--- a/pkgs/development/tools/wabt/version.patch
+++ /dev/null
@@ -1,28 +0,0 @@
-diff --git a/CMakeLists.txt b/CMakeLists.txt
-index 363a5660..ad3300ed 100644
---- a/CMakeLists.txt
-+++ b/CMakeLists.txt
-@@ -68,22 +68,7 @@ endif ()
- include(CheckTypeSize)
- check_type_size(ssize_t SSIZE_T)
- check_type_size(size_t SIZEOF_SIZE_T)
--
--FIND_PACKAGE(Git QUIET REQUIRED)
--EXECUTE_PROCESS(COMMAND
--        "${GIT_EXECUTABLE}" --git-dir=${CMAKE_CURRENT_SOURCE_DIR}/.git describe --tags
--        RESULT_VARIABLE
--            GIT_HASH_RESULT
--        OUTPUT_VARIABLE
--            GIT_HASH
--        OUTPUT_STRIP_TRAILING_WHITESPACE)
--
--IF(${GIT_HASH_RESULT} EQUAL 0)
--    SET(WABT_VERSION_INFO "${GIT_HASH}")
--ELSE()
--    MESSAGE(WARNING "Error running git describe to determine version")
--    SET(WABT_VERSION_INFO "(unable to determine version)")
--ENDIF()
-+SET(WABT_VERSION_INFO "@version@")
- 
- configure_file(
-   ${WABT_SOURCE_DIR}/src/config.h.in
diff --git a/pkgs/games/bzflag/default.nix b/pkgs/games/bzflag/default.nix
index c1d1c38990d6..1ec24e02be05 100644
--- a/pkgs/games/bzflag/default.nix
+++ b/pkgs/games/bzflag/default.nix
@@ -4,11 +4,11 @@
 
 stdenv.mkDerivation rec {
   pname = "bzflag";
-  version = "2.4.18";
+  version = "2.4.20";
 
   src = fetchurl {
     url = "https://download.bzflag.org/${pname}/source/${version}/${pname}-${version}.tar.bz2";
-    sha256 = "1gmz31wmn3f8zq1bfilkgbf4qmi4fa0c93cs76mhg8h978pm23cx";
+    sha256 = "16brxqmfiyz4j4lb8ihzjcbwqmpsms6vm3ijbp34lnw0blbwdjb2";
   };
 
   nativeBuildInputs = [ pkgconfig ];
diff --git a/pkgs/games/crispy-doom/default.nix b/pkgs/games/crispy-doom/default.nix
index c10e79418be4..ea7c3c6e4784 100644
--- a/pkgs/games/crispy-doom/default.nix
+++ b/pkgs/games/crispy-doom/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "crispy-doom";
-  version = "5.7.2";
+  version = "5.8.0";
 
   src = fetchFromGitHub {
     owner = "fabiangreffrath";
     repo = pname;
     rev = "${pname}-${version}";
-    sha256 = "002aqbgsksrgzqridwdlkrjincaxh0dkvwlrbb8d2f3kwk7lj4fq";
+    sha256 = "1b6gn0dysv631jynh769whww9xcss1gms78sz3nrn855q1dsvcb4";
   };
 
   postPatch = ''
diff --git a/pkgs/games/cutemaze/default.nix b/pkgs/games/cutemaze/default.nix
index 32e173de2b8a..a293989d5e6a 100644
--- a/pkgs/games/cutemaze/default.nix
+++ b/pkgs/games/cutemaze/default.nix
@@ -2,11 +2,11 @@
 
 mkDerivation rec {
   pname = "cutemaze";
-  version = "1.2.5";
+  version = "1.2.6";
 
   src = fetchurl {
     url = "https://gottcode.org/cutemaze/${pname}-${version}-src.tar.bz2";
-    sha256 = "1xrjv3h1bpbji1dl9hkcvmp6qk4j618saffl41455vhrzn170lrj";
+    sha256 = "0pw31j2i3ifndikhz9w684ia00r8zvcgnb66ign9w4lgs1zjgcrw";
   };
 
   nativeBuildInputs = [ qmake qttools ];
diff --git a/pkgs/games/netris/default.nix b/pkgs/games/netris/default.nix
new file mode 100644
index 000000000000..994db4e67f8a
--- /dev/null
+++ b/pkgs/games/netris/default.nix
@@ -0,0 +1,32 @@
+{ stdenv, fetchFromGitHub, ncurses }:
+
+stdenv.mkDerivation {
+  pname = "netris";
+  version = "0.52";
+
+  src = fetchFromGitHub {
+    owner = "naclander";
+    repo = "netris";
+    rev = "6773c9b2d39a70481a5d6eb5368e9ced6229ad2b";
+    sha256 = "0gmxbpn50pnffidwjchkzph9rh2jm4wfq7hj8msp5vhdq5h0z9hm";
+  };
+
+  buildInputs = [
+    ncurses
+  ];
+
+  configureScript = "./Configure";
+  dontAddPrefix = true;
+
+  installPhase = ''
+    mkdir -p $out/bin
+    cp ./netris $out/bin
+  '';
+
+  meta = with stdenv.lib; {
+    description = "A free networked version of T*tris";
+    license = licenses.gpl2;
+    maintainers = with maintainers; [ patryk27 ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/games/pokerth/default.nix b/pkgs/games/pokerth/default.nix
index 5d6316b1ddd6..00b1f68e1371 100644
--- a/pkgs/games/pokerth/default.nix
+++ b/pkgs/games/pokerth/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, runCommand, fetchpatch, patchutils, qmake, qtbase
+{ mkDerivation, stdenv, fetchFromGitHub, runCommand, fetchpatch, patchutils, qmake, qtbase
 , SDL, SDL_mixer, boost, curl, gsasl, libgcrypt, libircclient, protobuf, sqlite
 , wrapQtAppsHook
 , tinyxml2, target ? "client" }:
@@ -16,7 +16,7 @@ let
   '';
 in
 
-stdenv.mkDerivation rec {
+mkDerivation rec {
   name = "pokerth-${target}-${version}";
   version = "1.1.2";
 
diff --git a/pkgs/games/super-tux-kart/default.nix b/pkgs/games/super-tux-kart/default.nix
index dcf1081e4d0b..70c5657508bd 100644
--- a/pkgs/games/super-tux-kart/default.nix
+++ b/pkgs/games/super-tux-kart/default.nix
@@ -1,9 +1,15 @@
-{ stdenv, fetchFromGitHub, fetchsvn, cmake, pkgconfig
+{ stdenv, fetchFromGitHub, fetchsvn, cmake, pkgconfig, makeWrapper
 , openal, freealut, libGLU, libGL, libvorbis, libogg, gettext, curl, freetype
 , fribidi, libtool, bluez, libjpeg, libpng, zlib, libX11, libXrandr, enet, harfbuzz }:
 
 let
   dir = "stk-code";
+  assets = fetchsvn {
+    url    = "https://svn.code.sf.net/p/supertuxkart/code/stk-assets";
+    rev    = "18212";
+    sha256 = "1dyj8r5rfifhnhayga8w8irkpa99vw57xjmy74cp8xz8g7zvdzqf";
+    name   = "stk-assets";
+  };
 
 in stdenv.mkDerivation rec {
   pname = "supertuxkart";
@@ -17,15 +23,9 @@ in stdenv.mkDerivation rec {
       sha256 = "01vxxl94583ixswzmi4caz8dk64r56pn3zxh7v63zml60yfvxbvp";
       name   = dir;
     })
-    (fetchsvn {
-      url    = "https://svn.code.sf.net/p/supertuxkart/code/stk-assets";
-      rev    = "18212";
-      sha256 = "1dyj8r5rfifhnhayga8w8irkpa99vw57xjmy74cp8xz8g7zvdzqf";
-      name   = "stk-assets";
-    })
   ];
 
-  nativeBuildInputs = [ cmake gettext libtool pkgconfig ];
+  nativeBuildInputs = [ cmake gettext libtool pkgconfig makeWrapper ];
 
   buildInputs = [
     libX11 libXrandr
@@ -38,8 +38,14 @@ in stdenv.mkDerivation rec {
   cmakeFlags = [
     "-DBUILD_RECORDER=OFF"         # libopenglrecorder is not in nixpkgs
     "-DUSE_SYSTEM_ANGELSCRIPT=OFF" # doesn't work with 2.31.2 or 2.32.0
+    "-DCHECK_ASSETS=OFF"
   ];
 
+  # Obtain the assets directly from the fetched store path, to avoid duplicating assets across multiple engine builds
+  preFixup = ''
+    wrapProgram $out/bin/supertuxkart --set-default SUPERTUXKART_ASSETS_DIR "${assets}"
+  '';
+
   sourceRoot = dir;
 
   meta = with stdenv.lib; {
diff --git a/pkgs/misc/emulators/fs-uae/default.nix b/pkgs/misc/emulators/fs-uae/default.nix
index 38730ec752ba..214c1e6e75b8 100644
--- a/pkgs/misc/emulators/fs-uae/default.nix
+++ b/pkgs/misc/emulators/fs-uae/default.nix
@@ -5,11 +5,11 @@ with stdenv.lib;
 stdenv.mkDerivation rec {
 
   pname = "fs-uae";
-  version = "3.0.3";
+  version = "3.0.5";
 
   src = fetchurl {
     url = "https://fs-uae.net/stable/${version}/${pname}-${version}.tar.gz";
-    sha256 = "0v5c8ns00bam4myj7454hpkrnm9i81jwdzrp5nl7gaa18qb60hjq";
+    sha256 = "1qwzhp34wy7bnd3c0plv11rg9fs5m92rh3ffnr9pn6ng0cpc8vpj";
   };
 
   nativeBuildInputs = [ pkgconfig ];
diff --git a/pkgs/misc/emulators/stella/default.nix b/pkgs/misc/emulators/stella/default.nix
index 72dc48c1f4d0..14189e5b3871 100644
--- a/pkgs/misc/emulators/stella/default.nix
+++ b/pkgs/misc/emulators/stella/default.nix
@@ -4,13 +4,13 @@ with stdenv.lib;
 stdenv.mkDerivation rec {
 
   pname = "stella";
-  version = "6.1.1";
+  version = "6.1.2";
 
   src = fetchFromGitHub {
     owner = "stella-emu";
     repo = "stella";
     rev = version;
-    sha256 = "1iwhslrkq887v035j68lhblybww8r792515rp2m5qzmdgnjzsvbb";
+    sha256 = "0m4vdgn7gqhga7hamy4djnlkfgz78gfkmg8by3mai5lw0cps7hr1";
   };
 
   nativeBuildInputs = [ pkgconfig ];
diff --git a/pkgs/os-specific/linux/firmware/fwupd/default.nix b/pkgs/os-specific/linux/firmware/fwupd/default.nix
index 13f4f71c3c14..2a0e52c658ae 100644
--- a/pkgs/os-specific/linux/firmware/fwupd/default.nix
+++ b/pkgs/os-specific/linux/firmware/fwupd/default.nix
@@ -87,11 +87,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "fwupd";
-  version = "1.4.0";
+  version = "1.4.1";
 
   src = fetchurl {
     url = "https://people.freedesktop.org/~hughsient/releases/fwupd-${version}.tar.xz";
-    sha256 = "V131/l05FKYFavRMXRaiW1bQkTCEn7MTyyD+bqYClU4=";
+    sha256 = "ga8MpbY9tTwr0jsmjEAMyFxDC+yD4LBTx5gXRXig31M=";
   };
 
   # libfwupd goes to lib
@@ -154,34 +154,6 @@ stdenv.mkDerivation rec {
     # they are not really part of the library.
     ./install-fwupdplugin-to-out.patch
 
-    # Make it easier to patch installed-tests directory.
-    # https://github.com/fwupd/fwupd/pull/2002
-    (fetchpatch {
-      url = "https://github.com/fwupd/fwupd/commit/2f12e38e61d982dea63778736e2b71d16f0e9925.patch";
-      sha256 = "goTyDj0v50FOQYCS+LhPjo0AEugubr6aBIGfO9ztZOA=";
-    })
-
-    # Install systemd files to our prefix.
-    # https://github.com/fwupd/fwupd/pull/2006
-    (fetchpatch {
-      url = "https://github.com/fwupd/fwupd/commit/463db5162fe4f6fea417973ff95a44ed51ec6402.patch";
-      sha256 = "I0TIfnCca83QpINABUINtl8nIB78dG8OR9MC/hP2hg8=";
-    })
-
-    # Fix installed tests.
-    # https://github.com/fwupd/fwupd/issues/2007
-    (fetchpatch {
-      url = "https://github.com/fwupd/fwupd/commit/c727742df3702fc934e2d9488c883dcbdfa59e9c.patch";
-      sha256 = "b9D2Xblf1VbpS5XZpHtwEJhzuq7+840l7skW5w0NMBU=";
-    })
-
-    # Fix build with bash-completion 2.10
-    # https://github.com/fwupd/fwupd/pull/2014
-    (fetchpatch {
-      url = "https://github.com/fwupd/fwupd/commit/0f035013dfb150c2c3fc7f51090103ba84bd1c06.patch";
-      sha256 = "VXRf5N3inaWThudk6pc4mtp6cMEIyybkdfqKin+9XSw=";
-    })
-
     # Installed tests are installed to different output
     # we also cannot have fwupd-tests.conf in $out/etc since it would form a cycle.
     (substituteAll {
diff --git a/pkgs/os-specific/linux/kernel/linux-4.14.nix b/pkgs/os-specific/linux/kernel/linux-4.14.nix
index 013893c1cddb..b3dea589cd65 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.14.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.14.nix
@@ -3,7 +3,7 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "4.14.178";
+  version = "4.14.179";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "1pcqxmq9ir4f963aiw5bab9w2mp4vfiwaq2bk7nksbl2bs3k6b7x";
+    sha256 = "10arrj3ppbxkn15yxqpxlz4k8yp2afzbfpp2nwfy6klhjiffp9sx";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-4.4.nix b/pkgs/os-specific/linux/kernel/linux-4.4.nix
index 09b34e26a476..81b32a932e1d 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.4.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.4.nix
@@ -1,11 +1,11 @@
 { stdenv, buildPackages, fetchurl, perl, buildLinux, ... } @ args:
 
 buildLinux (args // rec {
-  version = "4.4.221";
+  version = "4.4.222";
   extraMeta.branch = "4.4";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "06rpjnvrdp71flz948mfmx7jv8x2vmdg54zz1xpkb2458mwh5hbq";
+    sha256 = "02zxy5vjxgrqs0mkz5aj70v6pazhif7x5cm26rf8zh4idpmhk2zh";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-4.9.nix b/pkgs/os-specific/linux/kernel/linux-4.9.nix
index 0db1d2908e32..a9757aa2f10d 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.9.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.9.nix
@@ -1,11 +1,11 @@
 { stdenv, buildPackages, fetchurl, perl, buildLinux, ... } @ args:
 
 buildLinux (args // rec {
-  version = "4.9.221";
+  version = "4.9.222";
   extraMeta.branch = "4.9";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "1gh1x73xblxkb927igc3shrqnn49lcscwrq2fixmk9n7jb7q2hp6";
+    sha256 = "0aajgflf96bj7chbd83rdmgcdwd025c6mz6li4cwbfx7xcb91kjc";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/syslinux/default.nix b/pkgs/os-specific/linux/syslinux/default.nix
index 06b31302eb8e..edb951dae3da 100644
--- a/pkgs/os-specific/linux/syslinux/default.nix
+++ b/pkgs/os-specific/linux/syslinux/default.nix
@@ -70,7 +70,8 @@ stdenv.mkDerivation {
     "DATADIR=$(out)/share"
     "MANDIR=$(out)/share/man"
     "PERL=perl"
-  ];
+  ]
+    ++ stdenv.lib.optionals stdenv.hostPlatform.isi686 [ "bios" "efi32" ];
 
   doCheck = false; # fails. some fail in a sandbox, others require qemu
 
diff --git a/pkgs/servers/caddy/v2.nix b/pkgs/servers/caddy/v2.nix
index 599e2e8c9066..4175dfa20fcb 100644
--- a/pkgs/servers/caddy/v2.nix
+++ b/pkgs/servers/caddy/v2.nix
@@ -2,7 +2,7 @@
 
 buildGoModule rec {
   pname = "caddy";
-  version = "2.0.0-rc.3";
+  version = "2.0.0";
 
   subPackages = [ "cmd/caddy" ];
 
@@ -10,10 +10,10 @@ buildGoModule rec {
     owner = "caddyserver";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1jsjh8q5wsnp7j7r1rlnw0w4alihpcmpmlpqncmhik10f6v7xm3y";
+    sha256 = "1c1frfx0qkprhf4var70cncvrw8s9gjag2hygndbd9055hb52bvv";
   };
 
-  modSha256 = "0n0k0w9y2z87z6m6j3sxsgqn9sm82rdcqpdck236fxj23k4akyp6";
+  modSha256 = "19sxyvfq1bpg85w8cd1yk2s6rd8759cf2zqs5b6wyny4cak2bl83";
 
   meta = with stdenv.lib; {
     homepage = "https://caddyserver.com";
diff --git a/pkgs/servers/dns/knot-dns/default.nix b/pkgs/servers/dns/knot-dns/default.nix
index 73881ff1092d..d76b51bcc661 100644
--- a/pkgs/servers/dns/knot-dns/default.nix
+++ b/pkgs/servers/dns/knot-dns/default.nix
@@ -8,11 +8,11 @@ let inherit (stdenv.lib) optional optionals; in
 # Note: ATM only the libraries have been tested in nixpkgs.
 stdenv.mkDerivation rec {
   pname = "knot-dns";
-  version = "2.9.3";
+  version = "2.9.4";
 
   src = fetchurl {
     url = "https://secure.nic.cz/files/knot-dns/knot-${version}.tar.xz";
-    sha256 = "f2adf137d70955a4a20df90c5409e10be8e1127204a98b27d626ac090531a07e";
+    sha256 = "57f3c93a1b40dfa0431508203f559b7ea257afab79078c38bcddf960d5a4a501";
   };
 
   outputs = [ "bin" "out" "dev" ];
diff --git a/pkgs/servers/http/tomcat/tomcat-native.nix b/pkgs/servers/http/tomcat/tomcat-native.nix
index 57ab2a96b4df..17c4367866fb 100644
--- a/pkgs/servers/http/tomcat/tomcat-native.nix
+++ b/pkgs/servers/http/tomcat/tomcat-native.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "tomcat-native";
-  version = "1.2.23";
+  version = "1.2.24";
 
   src = fetchurl {
     url = "mirror://apache/tomcat/tomcat-connectors/native/${version}/source/${pname}-${version}-src.tar.gz";
-    sha512 = "89a0363961d322a87f4e752f4727f54f28ac6e4ad10fa21b6b7390c62b041d4068672d95495d9233c1cad7d6c1dc3c85fbd0186894085b3b94e476876af160ee";
+    sha512 = "5dae151a60f8bd5a9a29d63eca838c77174426025ee65a826f0698943494dd3656d50bcd417e220a926b9ce111ea167043d4b806264030e951873d06767b3d6f";
   };
 
   sourceRoot = "${pname}-${version}-src/native";
diff --git a/pkgs/servers/mpd/default.nix b/pkgs/servers/mpd/default.nix
index d5a3b9de3c0a..8d862373b995 100644
--- a/pkgs/servers/mpd/default.nix
+++ b/pkgs/servers/mpd/default.nix
@@ -103,13 +103,13 @@ let
 
     in stdenv.mkDerivation rec {
       pname = "mpd";
-      version = "0.21.21";
+      version = "0.21.23";
 
       src = fetchFromGitHub {
         owner  = "MusicPlayerDaemon";
         repo   = "MPD";
         rev    = "v${version}";
-        sha256 = "0ysyjlmmfm1y5jqyv83bs9p7zqr9pgj1hmdq2b7kx9kridclbnng";
+        sha256 = "0jnhjhm1ilpcwb4f58b8pgyzjq3dlr0j2xyk0zck0afwkdxyj9cb";
       };
 
       buildInputs = [ glib boost ]
diff --git a/pkgs/servers/search/groonga/default.nix b/pkgs/servers/search/groonga/default.nix
index 40d59611da2a..b53a207a6c57 100644
--- a/pkgs/servers/search/groonga/default.nix
+++ b/pkgs/servers/search/groonga/default.nix
@@ -7,11 +7,11 @@
 stdenv.mkDerivation rec {
 
   pname = "groonga";
-  version = "10.0.0";
+  version = "10.0.2";
 
   src = fetchurl {
     url    = "https://packages.groonga.org/source/groonga/${pname}-${version}.tar.gz";
-    sha256 = "01wacd9rijnjydshsl7z0waasr87gxkwr0kr647chczcxlh1b9gr";
+    sha256 = "0851sdzgg5krf05b1pg29gmwzvzxvawfp37ny3lrb5xcdqbr379c";
   };
 
   buildInputs = with stdenv.lib;
diff --git a/pkgs/servers/sql/postgresql/ext/pg_auto_failover.nix b/pkgs/servers/sql/postgresql/ext/pg_auto_failover.nix
index 257af21cec97..168cee9711bc 100644
--- a/pkgs/servers/sql/postgresql/ext/pg_auto_failover.nix
+++ b/pkgs/servers/sql/postgresql/ext/pg_auto_failover.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "pg_auto_failover";
-  version = "1.2";
+  version = "1.3";
 
   src = fetchFromGitHub {
     owner = "citusdata";
     repo = pname;
     rev = "v${version}";
-    sha256 = "128bfxy7aabyvlcrzdi20f51k9xxgynd76f01v6w1314wrjg2r8f";
+    sha256 = "1si4k37azigp7hqibnkzr1p6zknadxm7pb33lygrxarqkifx67j4";
   };
 
   buildInputs = [ postgresql openssl zlib readline ];
diff --git a/pkgs/shells/fish/default.nix b/pkgs/shells/fish/default.nix
index 0f18eb79d2d8..11d9e48008fa 100644
--- a/pkgs/shells/fish/default.nix
+++ b/pkgs/shells/fish/default.nix
@@ -16,6 +16,7 @@
 , python3
 , cmake
 
+, runCommand
 , writeText
 , nixosTests
 , useOperatingSystemEtc ? true
@@ -202,38 +203,41 @@ let
 
     passthru = {
       shellPath = "/bin/fish";
-      tests.nixos = nixosTests.fish;
+      tests = {
+        nixos = nixosTests.fish;
+
+        # Test the fish_config tool by checking the generated splash page.
+        # Since the webserver requires a port to run, it is not started.
+        fishConfig =
+          let fishScript = writeText "test.fish" ''
+            set -x __fish_bin_dir ${fish}/bin
+            echo $__fish_bin_dir
+            cp -r ${fish}/share/fish/tools/web_config/* .
+            chmod -R +w *
+
+            # if we don't set `delete=False`, the file will get cleaned up
+            # automatically (leading the test to fail because there's no
+            # tempfile to check)
+            sed -e "s@, mode='w'@, mode='w', delete=False@" -i webconfig.py
+
+            # we delete everything after the fileurl is assigned
+            sed -e '/fileurl =/q' -i webconfig.py
+            echo "print(fileurl)" >> webconfig.py
+
+            # and check whether the message appears on the page
+            cat (${python3}/bin/python ./webconfig.py \
+              | tail -n1 | sed -ne 's|.*\(/build/.*\)|\1|p' \
+            ) | grep 'a href="http://localhost.*Start the Fish Web config'
+
+            # cannot test the http server because it needs a localhost port
+          '';
+          in
+          runCommand "test-web-config" { } ''
+            HOME=$(mktemp -d)
+            ${fish}/bin/fish ${fishScript} && touch $out
+          '';
+      };
     };
   };
-
-  tests = {
-
-    # Test the fish_config tool by checking the generated splash page.
-    # Since the webserver requires a port to run, it is not started.
-    fishConfig =
-      let
-        fishScript = writeText "test.fish" ''
-          set -x __fish_bin_dir ${fish}/bin
-          echo $__fish_bin_dir
-          cp -r ${fish}/share/fish/tools/web_config/* .
-          chmod -R +w *
-          # we delete everything after the fileurl is assigned
-          sed -e '/fileurl =/q' -i webconfig.py
-          echo "print(fileurl)" >> webconfig.py
-          # and check whether the message appears on the page
-          cat (${python3}/bin/python ./webconfig.py \
-            | tail -n1 | sed -ne 's|.*\(/tmp/.*\)|\1|p' \
-          ) | grep 'a href="http://localhost.*Start the Fish Web config'
-
-          # cannot test the http server because it needs a localhost port
-        '';
-      in ''
-        HOME=$(mktemp -d)
-        ${fish}/bin/fish ${fishScript}
-      '';
-  };
-
-  # FIXME(Profpatsch) replace withTests stub
-  withTests = with lib; flip const;
 in
-withTests tests fish
+fish
diff --git a/pkgs/shells/xonsh/default.nix b/pkgs/shells/xonsh/default.nix
index dc0a45c3e523..192e38b963d3 100644
--- a/pkgs/shells/xonsh/default.nix
+++ b/pkgs/shells/xonsh/default.nix
@@ -8,14 +8,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "xonsh";
-  version = "0.9.17";
+  version = "0.9.18";
 
   # fetch from github because the pypi package ships incomplete tests
   src = fetchFromGitHub {
     owner  = "xonsh";
     repo   = "xonsh";
     rev    = version;
-    sha256 = "0ynfnphbp69am390m5zfzk5rzj1749vs7rzyq310f6mk7xdq6j4v";
+    sha256 = "1zg5dl9qdysbaw2djy9f7f1ydp7vzjv840cjwqxlmg9615lgg7xa";
   };
 
   LC_ALL = "en_US.UTF-8";
diff --git a/pkgs/shells/zsh/oh-my-zsh/default.nix b/pkgs/shells/zsh/oh-my-zsh/default.nix
index fe30a6f9e9aa..fae5f80fbf11 100644
--- a/pkgs/shells/zsh/oh-my-zsh/default.nix
+++ b/pkgs/shells/zsh/oh-my-zsh/default.nix
@@ -4,13 +4,13 @@
 { stdenv, fetchgit }:
 
 stdenv.mkDerivation rec {
-  version = "2020-05-01";
+  version = "2020-05-05";
   pname = "oh-my-zsh";
-  rev = "173d4ca68f1ff4b04e9f3fd783244c309d848092";
+  rev = "ff987384cf721e7e0812636dea8100b485968bb2";
 
   src = fetchgit { inherit rev;
     url = "https://github.com/ohmyzsh/ohmyzsh";
-    sha256 = "0k8w5cf5fyz69bji947i1yd7pd49bpkg82k2wlx9964lgl21bip5";
+    sha256 = "0hc03sb2i65zrfj7r7c3p6f1g9997h74n12n4r253hrsp7az9p05";
   };
 
   pathsToLink = [ "/share/oh-my-zsh" ];
diff --git a/pkgs/tools/admin/ansible/default.nix b/pkgs/tools/admin/ansible/default.nix
index 4af031118693..d0cb07197cd3 100644
--- a/pkgs/tools/admin/ansible/default.nix
+++ b/pkgs/tools/admin/ansible/default.nix
@@ -7,21 +7,21 @@ rec {
 
   ansible_2_8 = python3Packages.toPythonApplication (python3Packages.ansible.overridePythonAttrs (old: rec {
     pname = "ansible";
-    version = "2.8.7";
+    version = "2.8.11";
 
     src = fetchurl {
       url = "https://releases.ansible.com/ansible/${pname}-${version}.tar.gz";
-      sha256 = "0iy90kqxs52nspfkhj1y7z4zf017jfm5qhdb01d8d4jd5g53k0l2";
+      sha256 = "14f1m4jjkicadaz4d1dm8xhj53kdwksf0znmqzaz1fb0dj5slv0m";
     };
   }));
 
   ansible_2_7 = python3Packages.toPythonApplication (python3Packages.ansible.overridePythonAttrs (old: rec {
     pname = "ansible";
-    version = "2.7.15";
+    version = "2.7.17";
 
     src = fetchurl {
       url = "https://releases.ansible.com/ansible/${pname}-${version}.tar.gz";
-      sha256 = "1kjqr35c11njyi3f2rjab6821bhqcrdykv4285q76gwv0qynigwr";
+      sha256 = "1k2cz4w3r3an37305f40vi93wqixapls9y6ggkf75nbs7z27knwz";
     };
   }));
 
diff --git a/pkgs/tools/backup/znapzend/default.nix b/pkgs/tools/backup/znapzend/default.nix
index 90ed1068ca6e..5ca460beb3be 100644
--- a/pkgs/tools/backup/znapzend/default.nix
+++ b/pkgs/tools/backup/znapzend/default.nix
@@ -1,27 +1,28 @@
-{ stdenv, fetchFromGitHub, fetchurl, perl, perlPackages, wget, autoconf, automake }:
+{ stdenv, fetchFromGitHub, fetchurl, perl, perlPackages, wget, autoconf, automake, autoreconfHook }:
 
 let
-  # when upgrade znapzend, check versions of Perl libs here: https://github.com/oetiker/znapzend/blob/master/PERL_MODULES
-  Mojolicious-6-46 = perlPackages.buildPerlPackage rec {
+  # when upgrade znapzend, check versions of Perl libs here: https://github.com/oetiker/znapzend/blob/master/cpanfile
+  # pinned versions are listed at https://github.com/oetiker/znapzend/blob/master/thirdparty/cpanfile-5.26.1.snapshot
+  Mojolicious-8-35 = perlPackages.buildPerlPackage rec {
     pname = "Mojolicious";
-    version = "6.46";
+    version = "8.35";
     src = fetchurl {
       url = "mirror://cpan/authors/id/S/SR/SRI/${pname}-${version}.tar.gz";
-      sha256 = "0i3axmx4506fx5gms148pj65x6ys7flaz1aqjd8hd9zfkd8pzdfr";
+      sha256 = "1bll0ahh5v1y3x0ql29klwsa68cj46wzqc385srsnn2m8kh2ak8h";
     };
   };
-  MojoIOLoopForkCall-0-17 = perlPackages.buildPerlModule rec {
+  MojoIOLoopForkCall-0-20 = perlPackages.buildPerlModule rec {
     pname = "Mojo-IOLoop-ForkCall";
-    version = "0.17";
+    version = "0.20";
     src = fetchurl {
       url = "mirror://cpan/authors/id/J/JB/JBERGER/${pname}-${version}.tar.gz";
-      sha256 = "090qxz1nbah2qxvfg4whl6yp6q03qkx7a42751iai521nk1yavc8";
+      sha256 = "19pih5x0ayxs2m8j29qwdpi6ky3w4ghv6vrmax3ix9r59hj6569b";
     };
-    propagatedBuildInputs = [ perlPackages.IOPipely Mojolicious-6-46 ];
+    propagatedBuildInputs = [ perlPackages.IOPipely Mojolicious-8-35 ];
   };
 
-  version = "0.18.0";
-  checksum = "1nlvw56viwgafma506slywfg54z6009jmzc9q6wljgr6mqfmmchd";
+  version = "0.20.0";
+  checksum = "15lb5qwksa508m9bj6d3n4rrjpakfaas9qxspg408bcqfp7pqjw3";
 in
 stdenv.mkDerivation {
   pname = "znapzend";
@@ -34,9 +35,9 @@ stdenv.mkDerivation {
     sha256 = checksum;
   };
 
-  buildInputs = [ wget perl MojoIOLoopForkCall-0-17 perlPackages.TAPParserSourceHandlerpgTAP ];
+  buildInputs = [ wget perl MojoIOLoopForkCall-0-20 perlPackages.TAPParserSourceHandlerpgTAP ];
 
-  nativeBuildInputs = [ autoconf automake ];
+  nativeBuildInputs = [ autoconf automake autoreconfHook ];
 
   preConfigure = ''
     sed -i 's/^SUBDIRS =.*$/SUBDIRS = lib/' Makefile.am
@@ -55,23 +56,23 @@ stdenv.mkDerivation {
   postInstall = ''
     substituteInPlace $out/bin/znapzend --replace "${perl}/bin/perl" \
       "${perl}/bin/perl \
-      -I${Mojolicious-6-46}/${perl.libPrefix} \
+      -I${Mojolicious-8-35}/${perl.libPrefix} \
       -I${perlPackages.TAPParserSourceHandlerpgTAP}/${perl.libPrefix} \
-      -I${MojoIOLoopForkCall-0-17}/${perl.libPrefix} \
+      -I${MojoIOLoopForkCall-0-20}/${perl.libPrefix} \
       -I${perlPackages.IOPipely}/${perl.libPrefix} \
       "
     substituteInPlace $out/bin/znapzendzetup --replace "${perl}/bin/perl" \
       "${perl}/bin/perl \
-      -I${Mojolicious-6-46}/${perl.libPrefix} \
+      -I${Mojolicious-8-35}/${perl.libPrefix} \
       -I${perlPackages.TAPParserSourceHandlerpgTAP}/${perl.libPrefix} \
-      -I${MojoIOLoopForkCall-0-17}/${perl.libPrefix} \
+      -I${MojoIOLoopForkCall-0-20}/${perl.libPrefix} \
       -I${perlPackages.IOPipely}/${perl.libPrefix} \
       "
     substituteInPlace $out/bin/znapzendztatz --replace "${perl}/bin/perl" \
       "${perl}/bin/perl \
-      -I${Mojolicious-6-46}/${perl.libPrefix} \
+      -I${Mojolicious-8-35}/${perl.libPrefix} \
       -I${perlPackages.TAPParserSourceHandlerpgTAP}/${perl.libPrefix} \
-      -I${MojoIOLoopForkCall-0-17}/${perl.libPrefix} \
+      -I${MojoIOLoopForkCall-0-20}/${perl.libPrefix} \
       -I${perlPackages.IOPipely}/${perl.libPrefix} \
       "
   '';
diff --git a/pkgs/tools/filesystems/avfs/default.nix b/pkgs/tools/filesystems/avfs/default.nix
index 2df5043867aa..eaf9ac634a17 100644
--- a/pkgs/tools/filesystems/avfs/default.nix
+++ b/pkgs/tools/filesystems/avfs/default.nix
@@ -2,10 +2,10 @@
 
 stdenv.mkDerivation rec {
   pname = "avfs";
-  version = "1.1.1";
+  version = "1.1.2";
   src = fetchurl {
     url = "mirror://sourceforge/avf/${version}/${pname}-${version}.tar.bz2";
-    sha256 = "0fxzigpyi08ipqz30ihjcpqmmx8g7r1kqdqq1bnnznvnhrzyygn8";
+    sha256 = "035b6y49nzgswf5n70aph8pm48sbv9nqwlnp3wwbq892c39kk4xn";
   };
 
   nativeBuildInputs = [ pkgconfig ];
diff --git a/pkgs/tools/filesystems/bindfs/default.nix b/pkgs/tools/filesystems/bindfs/default.nix
index 065a673eb03b..bf6c68072aa2 100644
--- a/pkgs/tools/filesystems/bindfs/default.nix
+++ b/pkgs/tools/filesystems/bindfs/default.nix
@@ -1,12 +1,12 @@
 { stdenv, fetchurl, fuse, pkgconfig }:
 
 stdenv.mkDerivation rec {
-  version = "1.14.4";
+  version = "1.14.5";
   pname = "bindfs";
 
   src = fetchurl {
     url    = "https://bindfs.org/downloads/${pname}-${version}.tar.gz";
-    sha256 = "1vk42bq8y13gv4yvajf65qsh59lscwcaw3xv94qpjxld3786i8c7";
+    sha256 = "173c5fcnfbnlw5a437r2x899ax77j3wp8gg8gffhryahcgyn1abq";
   };
 
   dontStrip = true;
diff --git a/pkgs/tools/filesystems/ceph/default.nix b/pkgs/tools/filesystems/ceph/default.nix
index ea610dfcc7f0..c2234404d34a 100644
--- a/pkgs/tools/filesystems/ceph/default.nix
+++ b/pkgs/tools/filesystems/ceph/default.nix
@@ -93,7 +93,7 @@ let
   ]);
   sitePackages = ceph-python-env.python.sitePackages;
 
-  version = "14.2.8";
+  version = "14.2.9";
 in rec {
   ceph = stdenv.mkDerivation {
     pname = "ceph";
@@ -101,7 +101,7 @@ in rec {
 
     src = fetchurl {
       url = "http://download.ceph.com/tarballs/ceph-${version}.tar.gz";
-      sha256 = "0p7pjycqhxqg1mmix8ykx3xqq01d560p54iiidxps0rcvwfkyyki";
+      sha256 = "0zkh1a23v8g1fa5flqa2d53lv08ancab3li57gybpqpnja90k7il";
     };
 
     patches = [
diff --git a/pkgs/tools/graphics/pfstools/default.nix b/pkgs/tools/graphics/pfstools/default.nix
index 051adb0742f9..1c437a3f05cd 100644
--- a/pkgs/tools/graphics/pfstools/default.nix
+++ b/pkgs/tools/graphics/pfstools/default.nix
@@ -1,6 +1,6 @@
 { stdenv, fetchurl, cmake, pkgconfig, darwin
 , openexr, zlib, imagemagick, libGLU, libGL, freeglut, fftwFloat
-, fftw, gsl, libexif, perl, opencv, qt5, netpbm
+, fftw, gsl, libexif, perl, opencv2, qt5, netpbm
 }:
 
 stdenv.mkDerivation rec {
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ cmake pkgconfig ];
   buildInputs = [
     openexr zlib imagemagick fftwFloat
-    fftw gsl libexif perl opencv qt5.qtbase netpbm
+    fftw gsl libexif perl opencv2 qt5.qtbase netpbm
   ] ++ (if stdenv.isDarwin then (with darwin.apple_sdk.frameworks; [
     OpenGL GLUT
   ]) else [
diff --git a/pkgs/tools/misc/blsd/default.nix b/pkgs/tools/misc/blsd/default.nix
deleted file mode 100644
index 6e6a9b7c5abd..000000000000
--- a/pkgs/tools/misc/blsd/default.nix
+++ /dev/null
@@ -1,29 +0,0 @@
-{ stdenv, buildGoPackage, fetchFromGitHub, pkgconfig, libgit2 }:
-
-buildGoPackage {
-  pname = "blsd";
-  version = "2017-07-27";
-
-  goPackagePath = "github.com/junegunn/blsd";
-
-  src = fetchFromGitHub {
-    owner = "junegunn";
-    repo = "blsd";
-    rev = "a2ac619821e502452abdeae9ebab45026893b9e8";
-    sha256 = "0b0q6i4i28cjqgxqmwxbps22gp9rcd3jz562q5wvxrwlpbzlls2h";
-  };
-
-  goDeps = ./deps.nix;
-
-  nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [ libgit2 ];
-
-  meta = with stdenv.lib; {
-    homepage = "https://github.com/junegunn/blsd";
-    description = "List directories in breadth-first order";
-    license = licenses.mit;
-    maintainers = [ maintainers.magnetophon ];
-    platforms = platforms.unix;
-    broken = true; # since 2020-02-08, libgit2 is incompatible upstream is dead.
-  };
-}
diff --git a/pkgs/tools/misc/blsd/deps.nix b/pkgs/tools/misc/blsd/deps.nix
deleted file mode 100644
index d212f213a60e..000000000000
--- a/pkgs/tools/misc/blsd/deps.nix
+++ /dev/null
@@ -1,12 +0,0 @@
-# This file was generated by https://github.com/kamilchm/go2nix v1.2.1
-[
-  {
-    goPackagePath = "github.com/libgit2/git2go";
-    fetch = {
-      type = "git";
-      url = "https://github.com/libgit2/git2go";
-      rev = "14280de4da0f392935854a7cbdd67b2a5505c3a8";
-      sha256 = "17ppd7byzir8rhdk645dmggi700scb8f401yiwx8zy81q41dk1qi";
-    };
-  }
-]
diff --git a/pkgs/tools/misc/datamash/default.nix b/pkgs/tools/misc/datamash/default.nix
index f66f2b97d141..8e9782506fb9 100644
--- a/pkgs/tools/misc/datamash/default.nix
+++ b/pkgs/tools/misc/datamash/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "datamash";
-  version = "1.6";
+  version = "1.7";
 
   src = fetchurl {
     url = "mirror://gnu/${pname}/${pname}-${version}.tar.gz";
-    sha256 = "1jvqxcyh0aghnqh3m2rk5av1x0038flcmfzd493vasv1k69vgfdr";
+    sha256 = "1cxdlhgz3wzjqlq8bgwad93fgqymk2abbldfzw1ffnhcp4mmjjjp";
   };
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/misc/entr/default.nix b/pkgs/tools/misc/entr/default.nix
index aeb88d0c68b1..be8134a92a33 100644
--- a/pkgs/tools/misc/entr/default.nix
+++ b/pkgs/tools/misc/entr/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "entr";
-  version = "4.4";
+  version = "4.5";
 
   src = fetchurl {
     url = "http://entrproject.org/code/${pname}-${version}.tar.gz";
-    sha256 = "1x2hyc8vc5dz6k7b3291vxz36wllhinvqrb0d8zx9bv0ydj6qmjl";
+    sha256 = "08gsd99w20fdi0apppmzsh06z29ga8y89nfcizidil2hkl8b7jyn";
   };
 
   postPatch = ''
diff --git a/pkgs/tools/networking/davix/default.nix b/pkgs/tools/networking/davix/default.nix
index 9f1eff220c3c..797791e1c0b9 100644
--- a/pkgs/tools/networking/davix/default.nix
+++ b/pkgs/tools/networking/davix/default.nix
@@ -1,17 +1,17 @@
 { stdenv, fetchurl, cmake, pkgconfig, openssl, libxml2, boost, python3, libuuid }:
 
 stdenv.mkDerivation rec {
-  version = "0.7.5";
+  version = "0.7.6";
   pname = "davix";
   nativeBuildInputs = [ cmake pkgconfig python3 ];
   buildInputs = [ openssl libxml2 boost libuuid ];
 
-  # using the url below since the 0.7.5 release did carry a broken CMake file,
+  # using the url below since the 0.7.6 release did carry a broken CMake file,
   # supposedly fixed in the next release
   # https://github.com/cern-fts/davix/issues/40
   src = fetchurl {
     url = "http://grid-deployment.web.cern.ch/grid-deployment/dms/lcgutil/tar/davix/${version}/davix-${version}.tar.gz";
-    sha256 = "1j3gzsjhzrsk6irxalc3rwgp9cqb52chriadmy1mv1s6d2bwl86r";
+    sha256 = "0wq66spnr616cns72f9dvr2xfvkdvfqqmc6d7dx29fpp57zzvrx2";
   };
 
 
diff --git a/pkgs/tools/networking/drill/default.nix b/pkgs/tools/networking/drill/default.nix
index 7636bd44d2db..572dc0d83848 100644
--- a/pkgs/tools/networking/drill/default.nix
+++ b/pkgs/tools/networking/drill/default.nix
@@ -3,23 +3,26 @@
 , fetchFromGitHub
 , pkg-config
 , openssl
+, Security
 }:
 
 rustPlatform.buildRustPackage rec {
   pname = "drill";
-  version = "0.5.0";
+  version = "0.6.0";
 
   src = fetchFromGitHub {
     owner = "fcsonline";
     repo = pname;
     rev = version;
-    sha256 = "0aqd709fg0ha0lzri2p4pgraxvif7z8zcm8rx7sk6s2n605sc4gn";
+    sha256 = "0pcc91nk68z7hlhj7xvh6v3rybxpy6bzv3pzjcyaq7l0szjljrpw";
   };
 
-  cargoSha256 = "1c8vmyf388kbbs56h8b62nxgxvgy9yj9cnmvax6ycnslkcwmvld0";
+  cargoSha256 = "1611w8b60d3x16ik8v96za0mkr5p0f9gdpz0awprfgj6c3r6s16m";
 
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ openssl ];
+  nativeBuildInputs = stdenv.lib.optionals stdenv.isLinux [ pkg-config ];
+  buildInputs = [ ]
+    ++ stdenv.lib.optionals stdenv.isLinux [ openssl ]
+    ++ stdenv.lib.optionals stdenv.isDarwin [ Security ];
 
   meta = with stdenv.lib; {
     description = "HTTP load testing application inspired by Ansible syntax";
diff --git a/pkgs/tools/networking/tridactyl-native/default.nix b/pkgs/tools/networking/tridactyl-native/default.nix
index 5efca2cb7fd3..bca0fcb81c7e 100644
--- a/pkgs/tools/networking/tridactyl-native/default.nix
+++ b/pkgs/tools/networking/tridactyl-native/default.nix
@@ -7,13 +7,13 @@ stdenv.mkDerivation rec {
   pname = "tridactyl-native";
   # this is actually the version of tridactyl itself; the native messenger will
   # probably not change with every tridactyl version
-  version = "1.17.1";
+  version = "1.18.1";
 
   src = fetchFromGitHub {
     owner = "tridactyl";
     repo = "tridactyl";
     rev = version;
-    sha256 = "197vh3k9nh58djl6ph0lznkdb2schqlksxxr93xjkk4xsc7k6j1g";
+    sha256 = "0f4agsh0gqpyhl3nysv4x9f74hlnch27gp3l8bpl645kbbfkg0di";
   };
   sourceRoot = "source/native";
 
diff --git a/pkgs/tools/package-management/clib/default.nix b/pkgs/tools/package-management/clib/default.nix
index 5fdf6d663627..c7e3c0fb6653 100644
--- a/pkgs/tools/package-management/clib/default.nix
+++ b/pkgs/tools/package-management/clib/default.nix
@@ -1,14 +1,14 @@
 { stdenv, fetchFromGitHub, curl  }:
 
 stdenv.mkDerivation rec {
-  version = "1.11.2";
+  version = "1.11.3";
   pname = "clib";
 
   src = fetchFromGitHub {
     rev    = version;
     owner  = "clibs";
     repo   = "clib";
-    sha256 = "03q5l873zc1dm478f35ibqandypakf47hzqb5gjpnpbcyb2m2jxz";
+    sha256 = "0qwds9w9y2dy39bwh2523wra5dj820cjl11ynkshh7k94fk7qgpm";
   };
 
   hardeningDisable = [ "fortify" ];
diff --git a/pkgs/tools/package-management/emplace/default.nix b/pkgs/tools/package-management/emplace/default.nix
index 389d1feb346d..8041264341c8 100644
--- a/pkgs/tools/package-management/emplace/default.nix
+++ b/pkgs/tools/package-management/emplace/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "emplace";
-  version = "0.2.19";
+  version = "0.2.21";
 
   src = fetchFromGitHub {
     owner = "tversteeg";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0vw0axnb7gil6lr72rixp4v3pspi0jq99x8h954mdcff2jr031x5";
+    sha256 = "07h4ngn0ypjfhipb13lw56can6zcpiglzaqii1yy1avqwc4rjsln";
   };
 
-  cargoSha256 = "118rxiwvi9k6jq5y0k7yn4w9zlb0fd6xdcyrv38ipr8qrj16cjrq";
+  cargoSha256 = "12znw98jf1sy3iz6lrwdxya9rvwskc3yjkqir3xjfxw99w2jsiqb";
 
   meta = with lib; {
     description = "Mirror installed software on multiple machines";
diff --git a/pkgs/tools/security/gopass/default.nix b/pkgs/tools/security/gopass/default.nix
index 410b63ec7d75..59a5e800aedb 100644
--- a/pkgs/tools/security/gopass/default.nix
+++ b/pkgs/tools/security/gopass/default.nix
@@ -1,4 +1,11 @@
-{ stdenv, buildGoModule, fetchFromGitHub, git, gnupg, xclip, wl-clipboard, installShellFiles, makeWrapper }:
+{ stdenv, makeWrapper
+, buildGoModule, fetchFromGitHub, installShellFiles
+, git
+, gnupg
+, xclip
+, wl-clipboard
+, passAlias ? false
+}:
 
 buildGoModule rec {
   pname = "gopass";
@@ -28,6 +35,8 @@ buildGoModule rec {
       $out/bin/gopass completion $shell > gopass.$shell
       installShellCompletion gopass.$shell
     done
+  '' + stdenv.lib.optionalString passAlias ''
+    ln -s $out/bin/gopass $out/bin/pass
   '';
 
   postFixup = ''
@@ -39,7 +48,7 @@ buildGoModule rec {
     description     = "The slightly more awesome Standard Unix Password Manager for Teams. Written in Go.";
     homepage        = "https://www.gopass.pw/";
     license         = licenses.mit;
-    maintainers     = with maintainers; [ andir ];
+    maintainers     = with maintainers; [ andir rvolosatovs ];
     platforms       = platforms.unix;
 
     longDescription = ''
diff --git a/pkgs/tools/system/facter/default.nix b/pkgs/tools/system/facter/default.nix
index d6f7a782824d..0d2d704ea6c2 100644
--- a/pkgs/tools/system/facter/default.nix
+++ b/pkgs/tools/system/facter/default.nix
@@ -2,10 +2,10 @@
 
 stdenv.mkDerivation rec {
   pname = "facter";
-  version = "3.14.9";
+  version = "3.14.10";
 
   src = fetchFromGitHub {
-    sha256 = "1c8g4fg8c9x816xx3m33njfn9h6ksl8g4rmc20y39v1y9jn72vxk";
+    sha256 = "0yblz8k30kv9jpfs6bd0hcx5nfr23l7nxyw0q7p7c4ygkx3mb1ji";
     rev = version;
     repo = pname;
     owner = "puppetlabs";
diff --git a/pkgs/tools/system/kmon/default.nix b/pkgs/tools/system/kmon/default.nix
index 1a4cdb9acdfe..afb59b25059e 100644
--- a/pkgs/tools/system/kmon/default.nix
+++ b/pkgs/tools/system/kmon/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "kmon";
-  version = "1.1.0";
+  version = "1.2.0";
 
   src = fetchFromGitHub {
     owner = "orhun";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0lpwp5fzlf037bn03x1dldw8nfa5pyqi4qsqbscwn42idvs94mhx";
+    sha256 = "1l2zdp5f9spkfx1dhxyj32791kgvc8hqjr1kk75vds4c1wgwq8gk";
   };
 
-  cargoSha256 = "1g5k6dkv0zznh8q359n7sg9wf0gcix6m36pg9ql8wi5hnlsvg1s1";
+  cargoSha256 = "08a7gr70a3rh7a52gglck16qlwngb6ap723lg3b3mxmkyigdf6i6";
 
   nativeBuildInputs = [ python3 ];
 
diff --git a/pkgs/tools/text/colordiff/default.nix b/pkgs/tools/text/colordiff/default.nix
index 1ba1db1f7cb5..c3da9a605558 100644
--- a/pkgs/tools/text/colordiff/default.nix
+++ b/pkgs/tools/text/colordiff/default.nix
@@ -1,14 +1,14 @@
 { stdenv, fetchurl, perl /*, xmlto */}:
 
 stdenv.mkDerivation rec {
-  name = "colordiff-1.0.18";
+  name = "colordiff-1.0.19";
 
   src = fetchurl {
     urls = [
       "https://www.colordiff.org/${name}.tar.gz"
       "http://www.colordiff.org/archive/${name}.tar.gz"
     ];
-    sha256 = "1q6n60n4b9fnzccxyxv04mxjsql4ddq17vl2c74ijvjdhpcfrkr9";
+    sha256 = "069vzzgs7b44bmfh3ks2psrdb26s1w19gp9w4xxbgi7nhx6w3s26";
   };
 
   buildInputs = [ perl /* xmlto */ ];
diff --git a/pkgs/tools/text/languagetool/default.nix b/pkgs/tools/text/languagetool/default.nix
index 154e099d3dd2..fccd2174a6d6 100644
--- a/pkgs/tools/text/languagetool/default.nix
+++ b/pkgs/tools/text/languagetool/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "LanguageTool";
-  version = "4.9";
+  version = "4.9.1";
 
   src = fetchzip {
     url = "https://www.languagetool.org/download/${pname}-${version}.zip";
-    sha256 = "05jqqamdvi5x35yy9bqw6wf7qagrm1r9488f7cfbbv764zfirz17";
+    sha256 = "0hvzckb92yijzmp2vphjp1wgql3xqq0xd83v5x6pbhziq9yxc5yh";
   };
   nativeBuildInputs = [ makeWrapper ];
   buildInputs = [ jre ];
diff --git a/pkgs/tools/text/shfmt/default.nix b/pkgs/tools/text/shfmt/default.nix
index 71f79724b9cb..cad595079037 100644
--- a/pkgs/tools/text/shfmt/default.nix
+++ b/pkgs/tools/text/shfmt/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "shfmt";
-  version = "3.1.0";
+  version = "3.1.1";
 
   src = fetchFromGitHub {
     owner = "mvdan";
     repo = "sh";
     rev = "v${version}";
-    sha256 = "1k0bq4b4rv6wrh24jvcnpg1mfqrzqhl90zg4zibxzv3zkhjdskzh";
+    sha256 = "0zlk1jjk65jwd9cx0xarz4yg2r2h86kd5g00gcnsav6dp6rx3aw8";
   };
 
   modSha256 = "080k8d5rp8kyg0x7vjxm758b9ya9z336yd4rcqws7yhqawxiv55z";
diff --git a/pkgs/tools/virtualization/linode-cli/default.nix b/pkgs/tools/virtualization/linode-cli/default.nix
index bcb0c545d455..c16eb003d8d4 100644
--- a/pkgs/tools/virtualization/linode-cli/default.nix
+++ b/pkgs/tools/virtualization/linode-cli/default.nix
@@ -13,8 +13,8 @@
 let
 
   spec = fetchurl {
-    url = "https://developers.linode.com/api/docs/v4/openapi.yaml";
-    sha256 = "1l2fahdcmv7sp1qkwr5nv2vls8fypvlybwylqfzhyjmn7jqkw4hq";
+    url = "https://raw.githubusercontent.com/linode/linode-api-docs/v4.63.1/openapi.yaml";
+    sha256 = "03ngzbq24zazfqmfd7xjmxixkcb9vv1jgamplsj633j7sjj708s0";
   };
 
 in
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index cfea73736d6e..a643a0f8fa86 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -1270,8 +1270,6 @@ in
 
   blockdiag = with python3Packages; toPythonApplication blockdiag;
 
-  blsd = callPackage ../tools/misc/blsd { };
-
   bluez-alsa = callPackage ../tools/bluetooth/bluez-alsa { };
 
   bluez-tools = callPackage ../tools/bluetooth/bluez-tools { };
@@ -2974,7 +2972,9 @@ in
 
   driftnet = callPackage ../tools/networking/driftnet {};
 
-  drill = callPackage ../tools/networking/drill { };
+  drill = callPackage ../tools/networking/drill {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
 
   drone = callPackage ../development/tools/continuous-integration/drone { };
 
@@ -4553,6 +4553,8 @@ in
 
   kst = libsForQt5.callPackage ../tools/graphics/kst { gsl = gsl_1; };
 
+  kstars = libsForQt5.callPackage ../applications/science/astronomy/kstars { };
+
   kytea = callPackage ../tools/text/kytea { };
 
   k6 = callPackage ../development/tools/k6 { };
@@ -13804,7 +13806,7 @@ in
 
   openct = callPackage ../development/libraries/openct { };
 
-  opencv = callPackage ../development/libraries/opencv {
+  opencv2 = callPackage ../development/libraries/opencv {
     inherit (darwin.apple_sdk.frameworks) Cocoa QTKit;
   };
 
@@ -13820,6 +13822,8 @@ in
     inherit (darwin.apple_sdk.frameworks) AVFoundation Cocoa VideoDecodeAcceleration;
   };
 
+  opencv = opencv4;
+
   openexr = callPackage ../development/libraries/openexr { };
 
   openexrid-unstable = callPackage ../development/libraries/openexrid-unstable { };
@@ -20819,6 +20823,8 @@ in
 
   node-problem-detector = callPackage ../applications/networking/cluster/node-problem-detector { };
 
+  ninjas2 = callPackage ../applications/audio/ninjas2 {};
+
   notion = callPackage ../applications/window-managers/notion { };
 
   nootka = qt5.callPackage ../applications/audio/nootka { };
@@ -23598,7 +23604,7 @@ in
     lua = lua5_1;
   };
 
-  n2048 = callPackage ../games/n2048 {};
+  n2048 = callPackage ../games/n2048 { };
 
   naev = callPackage ../games/naev { };
 
@@ -23610,6 +23616,8 @@ in
   };
 
   nethack-x11 = callPackage ../games/nethack { x11Mode = true; };
+  
+  netris = callPackage ../games/netris { };
 
   neverball = callPackage ../games/neverball { };
 
diff --git a/pkgs/top-level/ocaml-packages.nix b/pkgs/top-level/ocaml-packages.nix
index 9517769f7b38..44b90219606e 100644
--- a/pkgs/top-level/ocaml-packages.nix
+++ b/pkgs/top-level/ocaml-packages.nix
@@ -38,11 +38,6 @@ let
 
     async_extra_p4 = callPackage ../development/ocaml-modules/async_extra { };
 
-    async_find =
-      if lib.versionOlder "4.03" ocaml.version
-      then janeStreet.async_find
-      else callPackage ../development/ocaml-modules/async_find { };
-
     async_kernel_p4 = callPackage ../development/ocaml-modules/async_kernel { };
 
     async_unix_p4 = callPackage ../development/ocaml-modules/async_unix { };
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 5548f8c75a7d..3a6953c701a5 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -18,7 +18,7 @@ let
   packages = ( self:
 
 let
-  inherit (python.passthru) isPy27 isPy33 isPy34 isPy35 isPy36 isPy37 isPy38 isPy39 isPy3k isPyPy pythonAtLeast pythonOlder;
+  inherit (python.passthru) isPy27 isPy35 isPy36 isPy37 isPy38 isPy39 isPy3k isPyPy pythonAtLeast pythonOlder;
 
   callPackage = pkgs.newScope self;
 
@@ -100,7 +100,7 @@ let
 
 in {
 
-  inherit (python.passthru) isPy27 isPy33 isPy34 isPy35 isPy36 isPy37 isPy38 isPy39 isPy3k isPyPy pythonAtLeast pythonOlder;
+  inherit (python.passthru) isPy27 isPy35 isPy36 isPy37 isPy38 isPy39 isPy3k isPyPy pythonAtLeast pythonOlder;
   inherit python bootstrapped-pip buildPythonPackage buildPythonApplication;
   inherit fetchPypi callPackage;
   inherit hasPythonModule requiredPythonModules makePythonPath disabledIf;
@@ -7266,7 +7266,7 @@ in {
 
   scour = callPackage ../development/python-modules/scour { };
 
-  pymssql = callPackage ../development/python-modules/pymssql { };
+  pymssql = throw "pymssql has been abandoned upstream."; # added 2020-05-04
 
   nanoleaf = callPackage ../development/python-modules/nanoleaf { };