about summary refs log tree commit diff
path: root/pkgs/tools
diff options
context:
space:
mode:
Diffstat (limited to 'pkgs/tools')
-rw-r--r--pkgs/tools/X11/alttab/default.nix2
-rw-r--r--pkgs/tools/X11/ckbcomp/default.nix4
-rw-r--r--pkgs/tools/X11/xbanish/default.nix4
-rw-r--r--pkgs/tools/X11/xbindkeys/default.nix4
-rw-r--r--pkgs/tools/X11/xdg-utils/default.nix1
-rw-r--r--pkgs/tools/X11/xlayoutdisplay/default.nix4
-rw-r--r--pkgs/tools/X11/xpra/default.nix10
-rw-r--r--pkgs/tools/X11/xpra/fix-41106.patch24
-rw-r--r--pkgs/tools/X11/xpra/fix-paths.patch53
-rw-r--r--pkgs/tools/admin/aws-rotate-key/default.nix2
-rw-r--r--pkgs/tools/admin/awscli/default.nix4
-rw-r--r--pkgs/tools/admin/azure-cli/default.nix4
-rw-r--r--pkgs/tools/admin/azure-cli/python-packages.nix39
-rw-r--r--pkgs/tools/admin/clair/default.nix4
-rw-r--r--pkgs/tools/admin/eksctl/default.nix6
-rw-r--r--pkgs/tools/admin/lego/default.nix2
-rw-r--r--pkgs/tools/admin/lxd/default.nix30
-rw-r--r--pkgs/tools/admin/scaleway-cli/default.nix2
-rw-r--r--pkgs/tools/archivers/p7zip/12-CVE-2016-9296.patch23
-rw-r--r--pkgs/tools/archivers/p7zip/13-CVE-2017-17969.patch35
-rw-r--r--pkgs/tools/archivers/p7zip/default.nix47
-rw-r--r--pkgs/tools/audio/abcmidi/default.nix4
-rw-r--r--pkgs/tools/audio/beets/default.nix8
-rw-r--r--pkgs/tools/audio/playerctl/default.nix2
-rw-r--r--pkgs/tools/audio/video2midi/default.nix4
-rw-r--r--pkgs/tools/backup/bacula/default.nix4
-rw-r--r--pkgs/tools/backup/borg/default.nix4
-rw-r--r--pkgs/tools/backup/duplicati/default.nix6
-rw-r--r--pkgs/tools/backup/easysnap/default.nix2
-rw-r--r--pkgs/tools/backup/monolith/default.nix6
-rw-r--r--pkgs/tools/bluetooth/blueman/default.nix4
-rw-r--r--pkgs/tools/cd-dvd/unetbootin/default.nix4
-rw-r--r--pkgs/tools/compression/dtrx/default.nix17
-rw-r--r--pkgs/tools/compression/gzip/default.nix12
-rw-r--r--pkgs/tools/compression/hactool/default.nix10
-rw-r--r--pkgs/tools/compression/zstd/default.nix9
-rw-r--r--pkgs/tools/filesystems/bees/default.nix4
-rw-r--r--pkgs/tools/filesystems/btrfs-progs/default.nix4
-rw-r--r--pkgs/tools/filesystems/convoy/default.nix4
-rw-r--r--pkgs/tools/filesystems/davfs2/default.nix2
-rw-r--r--pkgs/tools/filesystems/genromfs/default.nix2
-rw-r--r--pkgs/tools/filesystems/moosefs/default.nix3
-rw-r--r--pkgs/tools/filesystems/netatalk/default.nix2
-rw-r--r--pkgs/tools/filesystems/nixpart/0.4/cryptsetup.nix11
-rw-r--r--pkgs/tools/filesystems/nixpart/0.4/default.nix8
-rw-r--r--pkgs/tools/filesystems/nixpart/0.4/lvm2.nix14
-rw-r--r--pkgs/tools/filesystems/nixpart/0.4/multipath-tools.nix19
-rw-r--r--pkgs/tools/filesystems/nixpart/0.4/parted.nix11
-rw-r--r--pkgs/tools/filesystems/nixpart/0.4/pyblock-sysmacros.h.patch12
-rw-r--r--pkgs/tools/filesystems/nixpart/0.4/pyblock.nix6
-rw-r--r--pkgs/tools/graphics/cfdg/default.nix4
-rw-r--r--pkgs/tools/graphics/gmic/default.nix2
-rw-r--r--pkgs/tools/graphics/luxcorerender/default.nix26
-rw-r--r--pkgs/tools/graphics/netpbm/default.nix2
-rw-r--r--pkgs/tools/graphics/shotgun/default.nix2
-rw-r--r--pkgs/tools/graphics/wkhtmltopdf/default.nix4
-rw-r--r--pkgs/tools/graphics/yafaray-core/default.nix4
-rw-r--r--pkgs/tools/graphics/yaxg/default.nix6
-rw-r--r--pkgs/tools/graphics/zbar/default.nix2
-rw-r--r--pkgs/tools/inputmethods/interception-tools/default.nix4
-rw-r--r--pkgs/tools/misc/bat/default.nix5
-rw-r--r--pkgs/tools/misc/bdf2sfd/default.nix4
-rw-r--r--pkgs/tools/misc/broot/default.nix8
-rw-r--r--pkgs/tools/misc/brotab/default.nix4
-rw-r--r--pkgs/tools/misc/capture/default.nix4
-rw-r--r--pkgs/tools/misc/chafa/default.nix2
-rw-r--r--pkgs/tools/misc/chezmoi/default.nix6
-rw-r--r--pkgs/tools/misc/clex/default.nix2
-rw-r--r--pkgs/tools/misc/cowsay/default.nix2
-rw-r--r--pkgs/tools/misc/diffoscope/default.nix53
-rw-r--r--pkgs/tools/misc/diffoscope/ignore_links.patch44
-rw-r--r--pkgs/tools/misc/diffoscope/skip-failing-test.patch12
-rw-r--r--pkgs/tools/misc/direnv/default.nix11
-rw-r--r--pkgs/tools/misc/dua/default.nix6
-rw-r--r--pkgs/tools/misc/exa/default.nix2
-rw-r--r--pkgs/tools/misc/execline/default.nix4
-rw-r--r--pkgs/tools/misc/fd/default.nix2
-rw-r--r--pkgs/tools/misc/fluent-bit/default.nix4
-rw-r--r--pkgs/tools/misc/fluentd/Gemfile1
-rw-r--r--pkgs/tools/misc/fluentd/Gemfile.lock53
-rw-r--r--pkgs/tools/misc/fluentd/gemset.nix112
-rw-r--r--pkgs/tools/misc/fontforge/default.nix35
-rw-r--r--pkgs/tools/misc/fzf/default.nix4
-rw-r--r--pkgs/tools/misc/geekbench/default.nix4
-rw-r--r--pkgs/tools/misc/gh-ost/default.nix4
-rw-r--r--pkgs/tools/misc/gif-for-cli/default.nix4
-rw-r--r--pkgs/tools/misc/graylog/default.nix4
-rw-r--r--pkgs/tools/misc/graylog/plugins.nix58
-rw-r--r--pkgs/tools/misc/h/default.nix2
-rw-r--r--pkgs/tools/misc/hdf4/default.nix7
-rw-r--r--pkgs/tools/misc/hexyl/default.nix6
-rw-r--r--pkgs/tools/misc/hyperfine/default.nix11
-rw-r--r--pkgs/tools/misc/jdupes/default.nix4
-rw-r--r--pkgs/tools/misc/lazydocker/default.nix4
-rw-r--r--pkgs/tools/misc/libcpuid/default.nix4
-rw-r--r--pkgs/tools/misc/libgen-cli/default.nix17
-rw-r--r--pkgs/tools/misc/miniserve/default.nix2
-rw-r--r--pkgs/tools/misc/mutagen/default.nix4
-rw-r--r--pkgs/tools/misc/ncdu/default.nix6
-rw-r--r--pkgs/tools/misc/osinfo-db-tools/default.nix4
-rw-r--r--pkgs/tools/misc/pgmetrics/default.nix4
-rw-r--r--pkgs/tools/misc/phoronix-test-suite/default.nix4
-rw-r--r--pkgs/tools/misc/pistol/default.nix6
-rw-r--r--pkgs/tools/misc/plantuml/default.nix4
-rw-r--r--pkgs/tools/misc/rmlint/default.nix4
-rw-r--r--pkgs/tools/misc/sdate/default.nix4
-rw-r--r--pkgs/tools/misc/shadowenv/default.nix6
-rw-r--r--pkgs/tools/misc/starship/default.nix6
-rw-r--r--pkgs/tools/misc/system-config-printer/default.nix17
-rw-r--r--pkgs/tools/misc/topgrade/default.nix6
-rw-r--r--pkgs/tools/misc/ttwatch/default.nix14
-rw-r--r--pkgs/tools/misc/txt2man/default.nix4
-rw-r--r--pkgs/tools/misc/watchexec/default.nix6
-rw-r--r--pkgs/tools/misc/woeusb/default.nix4
-rw-r--r--pkgs/tools/misc/yle-dl/default.nix4
-rw-r--r--pkgs/tools/misc/youtube-dl/default.nix8
-rw-r--r--pkgs/tools/networking/acme-client/default.nix18
-rw-r--r--pkgs/tools/networking/airfield/node-packages.nix62
-rw-r--r--pkgs/tools/networking/amass/default.nix6
-rw-r--r--pkgs/tools/networking/axel/default.nix4
-rw-r--r--pkgs/tools/networking/cassowary/default.nix6
-rw-r--r--pkgs/tools/networking/corerad/default.nix8
-rw-r--r--pkgs/tools/networking/curl/default.nix11
-rw-r--r--pkgs/tools/networking/dnscrypt-proxy2/default.nix12
-rw-r--r--pkgs/tools/networking/dnsproxy/default.nix4
-rw-r--r--pkgs/tools/networking/findomain/default.nix6
-rw-r--r--pkgs/tools/networking/flannel/default.nix4
-rw-r--r--pkgs/tools/networking/goimapnotify/default.nix26
-rw-r--r--pkgs/tools/networking/goimapnotify/deps.nix66
-rw-r--r--pkgs/tools/networking/haproxy/default.nix4
-rw-r--r--pkgs/tools/networking/i2pd/default.nix4
-rw-r--r--pkgs/tools/networking/ip2unix/default.nix4
-rw-r--r--pkgs/tools/networking/isync/default.nix2
-rw-r--r--pkgs/tools/networking/megatools/default.nix2
-rw-r--r--pkgs/tools/networking/memtier-benchmark/default.nix4
-rw-r--r--pkgs/tools/networking/minidlna/default.nix4
-rw-r--r--pkgs/tools/networking/modem-manager/default.nix4
-rw-r--r--pkgs/tools/networking/mu/default.nix5
-rw-r--r--pkgs/tools/networking/network-manager/fortisslvpn/default.nix53
-rw-r--r--pkgs/tools/networking/openapi-generator-cli/default.nix2
-rw-r--r--pkgs/tools/networking/openconnect_pa/default.nix2
-rw-r--r--pkgs/tools/networking/openfortivpn/default.nix4
-rw-r--r--pkgs/tools/networking/openssh/default.nix2
-rw-r--r--pkgs/tools/networking/privoxy/default.nix2
-rw-r--r--pkgs/tools/networking/shadowsocks-rust/default.nix6
-rw-r--r--pkgs/tools/networking/slirp4netns/default.nix4
-rw-r--r--pkgs/tools/networking/tendermint/default.nix6
-rw-r--r--pkgs/tools/networking/tinyproxy/default.nix2
-rw-r--r--pkgs/tools/networking/tridactyl-native/default.nix4
-rw-r--r--pkgs/tools/networking/unbound/default.nix4
-rw-r--r--pkgs/tools/networking/v2ray/default.nix12
-rw-r--r--pkgs/tools/networking/v2ray/generic.nix2
-rw-r--r--pkgs/tools/networking/wifite2/default.nix4
-rw-r--r--pkgs/tools/package-management/cargo-deb/default.nix11
-rw-r--r--pkgs/tools/package-management/nfpm/default.nix6
-rw-r--r--pkgs/tools/package-management/nix-universal-prefetch/default.nix4
-rw-r--r--pkgs/tools/package-management/nix/default.nix23
-rw-r--r--pkgs/tools/package-management/nixui/node-packages.nix2
-rw-r--r--pkgs/tools/package-management/reuse/default.nix5
-rw-r--r--pkgs/tools/package-management/rpm/default.nix8
-rw-r--r--pkgs/tools/security/aflplusplus/default.nix30
-rw-r--r--pkgs/tools/security/bitwarden/default.nix4
-rw-r--r--pkgs/tools/security/bitwarden_rs/default.nix6
-rw-r--r--pkgs/tools/security/bundler-audit/Gemfile.lock6
-rw-r--r--pkgs/tools/security/bundler-audit/default.nix1
-rw-r--r--pkgs/tools/security/bundler-audit/gemset.nix12
-rw-r--r--pkgs/tools/security/certstrap/default.nix4
-rw-r--r--pkgs/tools/security/chipsec/default.nix4
-rw-r--r--pkgs/tools/security/fprintd/default.nix6
-rw-r--r--pkgs/tools/security/gnupg-pkcs11-scd/default.nix2
-rw-r--r--pkgs/tools/security/hash_extender/default.nix9
-rw-r--r--pkgs/tools/security/ibm-sw-tpm2/default.nix4
-rw-r--r--pkgs/tools/security/keybase/default.nix4
-rw-r--r--pkgs/tools/security/keybase/gui.nix2
-rw-r--r--pkgs/tools/security/keycard-cli/default.nix4
-rw-r--r--pkgs/tools/security/keysmith/default.nix45
-rw-r--r--pkgs/tools/security/mkp224o/default.nix4
-rw-r--r--pkgs/tools/security/rage/default.nix14
-rw-r--r--pkgs/tools/security/ripasso/cursive.nix2
-rw-r--r--pkgs/tools/security/ripasso/fix-tests.patch35
-rw-r--r--pkgs/tools/security/saml2aws/default.nix4
-rw-r--r--pkgs/tools/security/tor/default.nix4
-rw-r--r--pkgs/tools/security/tpm2-abrmd/default.nix40
-rw-r--r--pkgs/tools/security/tpm2-tools/default.nix4
-rw-r--r--pkgs/tools/system/confd/default.nix13
-rw-r--r--pkgs/tools/system/confd/deps.nix74
-rw-r--r--pkgs/tools/system/di/default.nix4
-rw-r--r--pkgs/tools/system/efivar/default.nix10
-rw-r--r--pkgs/tools/system/facter/default.nix4
-rw-r--r--pkgs/tools/system/gotop/default.nix6
-rw-r--r--pkgs/tools/system/inxi/default.nix4
-rw-r--r--pkgs/tools/system/runit/default.nix9
-rw-r--r--pkgs/tools/system/smartmontools/default.nix4
-rw-r--r--pkgs/tools/text/agrep/default.nix8
-rw-r--r--pkgs/tools/text/gtranslator/default.nix2
-rw-r--r--pkgs/tools/text/highlight/default.nix4
-rw-r--r--pkgs/tools/text/mdcat/default.nix6
-rw-r--r--pkgs/tools/text/ocrmypdf/default.nix8
-rw-r--r--pkgs/tools/text/ripgrep-all/default.nix4
-rw-r--r--pkgs/tools/text/ripgrep/default.nix8
-rw-r--r--pkgs/tools/text/shfmt/default.nix3
-rw-r--r--pkgs/tools/text/snippetpixie/default.nix4
-rw-r--r--pkgs/tools/typesetting/scdoc/default.nix5
-rw-r--r--pkgs/tools/typesetting/tex/dblatex/default.nix2
-rw-r--r--pkgs/tools/video/gopro/default.nix4
-rw-r--r--pkgs/tools/video/rav1e/default.nix33
-rw-r--r--pkgs/tools/virtualization/govc/default.nix4
207 files changed, 1234 insertions, 857 deletions
diff --git a/pkgs/tools/X11/alttab/default.nix b/pkgs/tools/X11/alttab/default.nix
index 28c8efffa2a5..d77f2f1c71b9 100644
--- a/pkgs/tools/X11/alttab/default.nix
+++ b/pkgs/tools/X11/alttab/default.nix
@@ -33,7 +33,7 @@ stdenv.mkDerivation rec {
     xorg.libXrender
   ];
 
-  enableParallelBuild = true;
+  enableParallelBuilding = true;
 
   meta = with stdenv.lib; {
     homepage = "https://github.com/sagb/alttab";
diff --git a/pkgs/tools/X11/ckbcomp/default.nix b/pkgs/tools/X11/ckbcomp/default.nix
index dc665bf9c41b..74a6777d9491 100644
--- a/pkgs/tools/X11/ckbcomp/default.nix
+++ b/pkgs/tools/X11/ckbcomp/default.nix
@@ -2,14 +2,14 @@
 
 stdenv.mkDerivation rec {
   pname = "ckbcomp";
-  version = "1.194";
+  version = "1.195";
 
   src = fetchFromGitLab {
     domain = "salsa.debian.org";
     owner = "installer-team";
     repo = "console-setup";
     rev = version;
-    sha256 = "0fkabv05j5dj10mfrpjyvv7lnxl9qaqkbjhwj72r18i9i4019vgh";
+    sha256 = "0d0xagigs5k3appzz5lzxdjncvnkgz4amz6ks7imiq8kkjixvmfy";
   };
 
   buildInputs = [ perl ];
diff --git a/pkgs/tools/X11/xbanish/default.nix b/pkgs/tools/X11/xbanish/default.nix
index af522cca9e10..6267cd1a34c8 100644
--- a/pkgs/tools/X11/xbanish/default.nix
+++ b/pkgs/tools/X11/xbanish/default.nix
@@ -1,7 +1,7 @@
 {stdenv, fetchFromGitHub, libX11, libXi, libXt, libXfixes, libXext}:
 
 stdenv.mkDerivation rec {
-  version = "1.6";
+  version = "1.7";
   pname = "xbanish";
 
   buildInputs = [
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
     owner = "jcs";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0vp8ja68hpmqkl61zyjar3czhmny1hbm74m8f393incfz1ymr3i8";
+    sha256 = "0ic5f7zgc32p5g1wxas9y5h8dhik0pvsa8wmn6skdry56gw9vg9q";
   };
 
   makeFlags=[ "PREFIX=$(out)" ];
diff --git a/pkgs/tools/X11/xbindkeys/default.nix b/pkgs/tools/X11/xbindkeys/default.nix
index e844f4443093..71316bdb36c8 100644
--- a/pkgs/tools/X11/xbindkeys/default.nix
+++ b/pkgs/tools/X11/xbindkeys/default.nix
@@ -1,12 +1,12 @@
 { stdenv, fetchurl, pkgconfig, libX11, guile }:
 
-let version = "1.8.6"; in
+let version = "1.8.7"; in
 stdenv.mkDerivation {
   pname = "xbindkeys";
   inherit version;
   src = fetchurl {
     url = "https://www.nongnu.org/xbindkeys/xbindkeys-${version}.tar.gz";
-    sha256 = "060df6d8y727jp1inp7blp44cs8a7jig7vcm8ndsn6gw36z1h3bc";
+    sha256 = "1wl2vc5alisiwyk8m07y1ryq8w3ll9ym83j27g4apm4ixjl8d6x2";
   };
 
   nativeBuildInputs = [ pkgconfig ];
diff --git a/pkgs/tools/X11/xdg-utils/default.nix b/pkgs/tools/X11/xdg-utils/default.nix
index 64b205bada58..ccea6a2233cc 100644
--- a/pkgs/tools/X11/xdg-utils/default.nix
+++ b/pkgs/tools/X11/xdg-utils/default.nix
@@ -46,6 +46,7 @@ stdenv.mkDerivation rec {
     xset()  { ${xset}/bin/xset      "$@"; }\
     perl()  { PERL5LIB=${perlPath} ${perlPackages.perl}/bin/perl "$@"; }\
     mimetype() { ${perlPackages.FileMimeInfo}/bin/mimetype "$@"; }\
+    PATH=$PATH:'"$out"'/bin\
     &#' -i "$out"/bin/*
 
     substituteInPlace $out/bin/xdg-open \
diff --git a/pkgs/tools/X11/xlayoutdisplay/default.nix b/pkgs/tools/X11/xlayoutdisplay/default.nix
index 47a2c8f3f3ec..9ca3f24b618a 100644
--- a/pkgs/tools/X11/xlayoutdisplay/default.nix
+++ b/pkgs/tools/X11/xlayoutdisplay/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "xlayoutdisplay";
-  version = "1.1.1";
+  version = "1.1.2";
 
   src = fetchFromGitHub {
     owner = "alex-courtis";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0ldqbwsryy7mqhxywdn2c2yi1mzlnl39sw8p3vx10w6q9drya9iv";
+    sha256 = "0n3vg25gzwn1pcg6caxyyd1xf2w6n98m6jpxc70kqpxfqldxwl0m";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/tools/X11/xpra/default.nix b/pkgs/tools/X11/xpra/default.nix
index 0d989fccb02c..6fe433daf8b9 100644
--- a/pkgs/tools/X11/xpra/default.nix
+++ b/pkgs/tools/X11/xpra/default.nix
@@ -1,7 +1,7 @@
 { stdenv, lib, fetchurl, callPackage, substituteAll, python3, pkgconfig, writeText
 , xorg, gtk3, glib, pango, cairo, gdk-pixbuf, atk
 , wrapGAppsHook, xorgserver, getopt, xauth, utillinux, which
-, ffmpeg_4, x264, libvpx, libwebp, x265
+, ffmpeg, x264, libvpx, libwebp, x265
 , libfakeXinerama
 , gst_all_1, pulseaudio, gobject-introspection
 , pam }:
@@ -30,17 +30,18 @@ let
 
 in buildPythonApplication rec {
   pname = "xpra";
-  version = "3.0.9";
+  version = "4.0.2";
 
   src = fetchurl {
     url = "https://xpra.org/src/${pname}-${version}.tar.xz";
-    sha256 = "04qskz1x1pvbdfirpxk58d3dfnf1n6dc69q2rdkak0avzl1nlzi7";
+    sha256 = "1cs39jzi59hkl421xmhi549ndmdfzkg0ap45f4nlsn9zr9zwmp3x";
   };
 
   patches = [
     (substituteAll {
       src = ./fix-paths.patch;
       inherit (xorg) xkeyboardconfig;
+      inherit libfakeXinerama;
     })
     ./fix-41106.patch
   ];
@@ -59,7 +60,7 @@ in buildPythonApplication rec {
 
     pango cairo gdk-pixbuf atk.out gtk3 glib
 
-    ffmpeg_4 libvpx x264 libwebp x265
+    ffmpeg libvpx x264 libwebp x265
 
     gst_all_1.gstreamer
     gst_all_1.gst-plugins-base
@@ -84,7 +85,6 @@ in buildPythonApplication rec {
     "--with-Xdummy"
     "--without-strict"
     "--with-gtk3"
-    "--without-gtk2"
     # Override these, setup.py checks for headers in /usr/* paths
     "--with-pam"
     "--with-vsock"
diff --git a/pkgs/tools/X11/xpra/fix-41106.patch b/pkgs/tools/X11/xpra/fix-41106.patch
index 06387c87154d..d0834543aa9f 100644
--- a/pkgs/tools/X11/xpra/fix-41106.patch
+++ b/pkgs/tools/X11/xpra/fix-41106.patch
@@ -1,15 +1,15 @@
 diff --git a/xpra/server/server_util.py b/xpra/server/server_util.py
-index 2ff2c0c..513201a 100644
+index dd7c7c1..066b9ff 100644
 --- a/xpra/server/server_util.py
 +++ b/xpra/server/server_util.py
-@@ -17,6 +17,10 @@ if PYTHON3:
-         return b"'" + s.replace(b"'", b"'\\''") + b"'"
-     
-     def xpra_runner_shell_script(xpra_file, starting_dir, socket_dir):
-+        # Nixpkgs contortion:
-+        # xpra_file points to a shell wrapper, not to the python script.
-+        dirname, basename = os.path.split(xpra_file)
-+        xpra_file = os.path.join(dirname, "."+basename+"-wrapped")
-         script = []
-         script.append(b"#!/bin/sh\n")
-         for var, value in os.environb.items():
+@@ -37,6 +37,10 @@ def sh_quotemeta(s):
+     return b"'" + s.replace(b"'", b"'\\''") + b"'"
+ 
+ def xpra_runner_shell_script(xpra_file, starting_dir, socket_dir):
++    # Nixpkgs contortion:
++    # xpra_file points to a shell wrapper, not to the python script.
++    dirname, basename = os.path.split(xpra_file)
++    xpra_file = os.path.join(dirname, "."+basename+"-wrapped")
+     script = []
+     script.append(b"#!/bin/sh\n")
+     for var, value in os.environb.items():
diff --git a/pkgs/tools/X11/xpra/fix-paths.patch b/pkgs/tools/X11/xpra/fix-paths.patch
index a934e5e4cc33..70bd9027a1a8 100644
--- a/pkgs/tools/X11/xpra/fix-paths.patch
+++ b/pkgs/tools/X11/xpra/fix-paths.patch
@@ -1,13 +1,13 @@
-gdiff --git a/setup.py b/setup.py
-index 8d3df15..6156206 100755
+diff --git a/setup.py b/setup.py
+index f962330..b02b6dd 100755
 --- a/setup.py
 +++ b/setup.py
- -2322,11 +2322,7 @@ if v4l2_ENABLED:                                                                                                                                                       
-     videodev2_h = "/usr/include/linux/videodev2.h"                                                                                                                                           
-     constants_pxi = "xpra/codecs/v4l2/constants.pxi"                                                                                                                                         
-     if not os.path.exists(videodev2_h) or should_rebuild(videodev2_h, constants_pxi):                                                                                                        
--        ENABLE_DEVICE_CAPS = 0                                                                                                                                                               
--        if os.path.exists(videodev2_h):                                                                                                                                                      
+@@ -2224,11 +2224,7 @@ if v4l2_ENABLED:
+     videodev2_h = "/usr/include/linux/videodev2.h"
+     constants_pxi = "xpra/codecs/v4l2/constants.pxi"
+     if not os.path.exists(videodev2_h) or should_rebuild(videodev2_h, constants_pxi):
+-        ENABLE_DEVICE_CAPS = 0
+-        if os.path.exists(videodev2_h):
 -            with open(videodev2_h) as f:
 -                hdata = f.read()
 -            ENABLE_DEVICE_CAPS = int(hdata.find("device_caps")>=0)
@@ -29,3 +29,40 @@ index bd7023d..064c6b5 100644
 
  ###################################
  # Headers, python magic
+diff --git a/xpra/x11/fakeXinerama.py b/xpra/x11/fakeXinerama.py
+index c867258..617af7c 100755
+--- a/xpra/x11/fakeXinerama.py
++++ b/xpra/x11/fakeXinerama.py
+@@ -22,31 +22,7 @@ fakeXinerama_config_files = [
+            ]
+ 
+ def find_libfakeXinerama():
+-    libname = "fakeXinerama"
+-    try:
+-        from ctypes.util import find_library
+-        flibname = find_library("fakeXinerama")
+-        if flibname:
+-            libname = flibname
+-    except Exception:
+-        pass
+-    if POSIX:
+-        for lib_dir in os.environ.get("LD_LIBRARY_PATH", "/usr/lib").split(os.pathsep):
+-            lib_path = os.path.join(lib_dir, libname)
+-            if not os.path.exists(lib_dir):
+-                continue
+-            if os.path.exists(lib_path) and os.path.isfile(lib_path):
+-                return lib_path
+-    if LINUX:
+-        try:
+-            libpath = find_lib_ldconfig("fakeXinerama")
+-            if libpath:
+-                return libpath
+-        except Exception as e:
+-            log("find_libfakeXinerama()", exc_info=True)
+-            log.error("Error: cannot launch ldconfig -p to locate libfakeXinerama:")
+-            log.error(" %s", e)
+-    return find_lib(libname)
++    return "@libfakeXinerama@/lib/libfakeXinerama.so.1.0"
+ 
+ current_xinerama_config = None
+ 
diff --git a/pkgs/tools/admin/aws-rotate-key/default.nix b/pkgs/tools/admin/aws-rotate-key/default.nix
index 228aa5a26a25..9c2f747e1558 100644
--- a/pkgs/tools/admin/aws-rotate-key/default.nix
+++ b/pkgs/tools/admin/aws-rotate-key/default.nix
@@ -10,7 +10,7 @@ buildGoPackage rec {
     rev = "v${version}";
     owner = "Fullscreen";
     repo = "aws-rotate-key";
-    sha256 = "sha256:1w9704g1l2b0y6g6mk79g28kk0yaswpgljkk85d0i10wyxq4icby";
+    sha256 = "1w9704g1l2b0y6g6mk79g28kk0yaswpgljkk85d0i10wyxq4icby";
   };
 
   goDeps = ./deps.nix;
diff --git a/pkgs/tools/admin/awscli/default.nix b/pkgs/tools/admin/awscli/default.nix
index d64736bc2c52..7acfd7c710e9 100644
--- a/pkgs/tools/admin/awscli/default.nix
+++ b/pkgs/tools/admin/awscli/default.nix
@@ -19,11 +19,11 @@ let
 
 in with py.pkgs; buildPythonApplication rec {
   pname = "awscli";
-  version = "1.17.13"; # N.B: if you change this, change botocore to a matching version too
+  version = "1.18.56"; # N.B: if you change this, change botocore to a matching version too
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "c42fc35d4e9f82ce72b2a8b8d54df3a57fe363b0763a473e72d0006b0d1e06ff";
+    sha256 = "3a442ea0d18d8a60228f1115850b5b8bdc739cd436d34a279bdf711fb918aaa0";
   };
 
   postPatch = ''
diff --git a/pkgs/tools/admin/azure-cli/default.nix b/pkgs/tools/admin/azure-cli/default.nix
index 942346bc1a73..4cfe1beb2cdc 100644
--- a/pkgs/tools/admin/azure-cli/default.nix
+++ b/pkgs/tools/admin/azure-cli/default.nix
@@ -1,12 +1,12 @@
 { stdenv, lib, python, fetchFromGitHub, installShellFiles }:
 
 let
-  version = "2.5.1";
+  version = "2.7.0";
   src = fetchFromGitHub {
     owner = "Azure";
     repo = "azure-cli";
     rev = "azure-cli-${version}";
-    sha256 = "129v01da0whayqi9nvrfnlrq10mn5j096k43xl72214nk7iliwfy";
+    sha256 = "0g0ddg04pwcsmyyzrqllx4ladw4x5zxc5yw29q8f6q59j6jaf1zb";
   };
 
   # put packages that needs to be overriden in the py package scope
diff --git a/pkgs/tools/admin/azure-cli/python-packages.nix b/pkgs/tools/admin/azure-cli/python-packages.nix
index 61633c1bbdc0..157da72a73b5 100644
--- a/pkgs/tools/admin/azure-cli/python-packages.nix
+++ b/pkgs/tools/admin/azure-cli/python-packages.nix
@@ -157,8 +157,8 @@ let
       azure-mgmt-core = overrideAzureMgmtPackage super.azure-mgmt-core "1.0.0" "zip"
         "0pm565v05480f672l0n8z2sg6zk6iqyi91n0dhscibhdl54sy3si";
 
-      azure-mgmt-cosmosdb = overrideAzureMgmtPackage super.azure-mgmt-cosmosdb "0.13.0" "zip"
-        "160cn4arl4dy6ax1zb64bzw0ygmpg8jc942m1zlh4nwx5x322gg8";
+      azure-mgmt-cosmosdb = overrideAzureMgmtPackage super.azure-mgmt-cosmosdb "0.14.0" "zip"
+        "1af2vigpmcg2mp36dqi9g2dx4589bqm4w2af9dx6l9x65zfl89b9";
 
       azure-mgmt-deploymentmanager = overrideAzureMgmtPackage super.azure-mgmt-deploymentmanager "0.2.0" "zip"
         "0c6pyr36n9snx879vas5r6l25db6nlp2z96xn759mz4kg4i45qs6";
@@ -166,8 +166,8 @@ let
       azure-mgmt-imagebuilder = overrideAzureMgmtPackage super.azure-mgmt-imagebuilder "0.2.1" "zip"
         "0mwlvy4x5nr3hsz7wdpdhpzwarzzwz4225bfpd68hr0pcjgzspky";
 
-      azure-mgmt-iothub = overrideAzureMgmtPackage super.azure-mgmt-iothub "0.11.0" "zip"
-        "11887zf61ji1dh62czrsgxwz8idybw93m6iwahjy777jkdyviyzn";
+      azure-mgmt-iothub = overrideAzureMgmtPackage super.azure-mgmt-iothub "0.12.0" "zip"
+        "187z0w5by7d9a2zsz3kidmzjw591akpc6dwhps4jyb4skcmyw86s";
 
       azure-mgmt-iotcentral = overrideAzureMgmtPackage super.azure-mgmt-iotcentral "3.0.0" "zip"
         "0iq04hvivq3fvg2lhax95gx0x35avk5hps42227z3qna5i2cznpn";
@@ -175,8 +175,8 @@ let
       azure-mgmt-kusto = overrideAzureMgmtPackage super.azure-mgmt-kusto "0.3.0" "zip"
         "1pmcdgimd66h964a3d5m2j2fbydshcwhrk87wblhwhfl3xwbgf4y";
 
-      azure-mgmt-devtestlabs = overrideAzureMgmtPackage super.azure-mgmt-devtestlabs "2.2.0" "zip"
-        "15lpyv9z8ss47rjmg1wx5akh22p9br2vckaj7jk3639vi38ac5nl";
+      azure-mgmt-devtestlabs = overrideAzureMgmtPackage super.azure-mgmt-devtestlabs "4.0.0" "zip"
+        "1397ksrd61jv7400mgn8sqngp6ahir55fyq9n5k69wk88169qm2r";
 
       azure-mgmt-netapp = overrideAzureMgmtPackage super.azure-mgmt-netapp "0.8.0" "zip"
         "0vbg5mpahrnnnbj80flgzxxiffic94wsc9srm4ir85y2j5rprpv7";
@@ -184,20 +184,20 @@ let
       azure-mgmt-dns = overrideAzureMgmtPackage super.azure-mgmt-dns "2.1.0" "zip"
         "1l55py4fzzwhxlmnwa41gpmqk9v2ncc79w7zq11sm9a5ynrv2c1p";
 
-      azure-mgmt-loganalytics = overrideAzureMgmtPackage super.azure-mgmt-loganalytics "0.5.0" "zip"
-        "0k91zdlzx6nfly1v2i7qmzqrdiygdx8rmgar3iz8nwgafvvc9x0n";
+      azure-mgmt-loganalytics = overrideAzureMgmtPackage super.azure-mgmt-loganalytics "0.6.0" "zip"
+        "0ffhlbd9fwx05njawhii46wqyvbhhz2xcfx0pxc7b978n7l7ylm1";
 
-      azure-mgmt-network = overrideAzureMgmtPackage super.azure-mgmt-network "10.1.0" "zip"
-        "0fmsdwzyn167lwh87yyadq1bdc4q6rfz3gj5bh1mgavi9ghhxb75";
+      azure-mgmt-network = overrideAzureMgmtPackage super.azure-mgmt-network "10.2.0" "zip"
+        "1nd2rcwl83x3xq4h5brb16jwbbq57gyxz6pgvmhnign9q76p836m";
 
-      azure-mgmt-media = overrideAzureMgmtPackage super.azure-mgmt-media "1.1.1" "zip"
-        "16wk0ksycrscsn3n14qk4vvf7i567vq6f96lwf5dwbc81wx6n32x";
+      azure-mgmt-media = overrideAzureMgmtPackage super.azure-mgmt-media "2.1.0" "zip"
+        "1py0hch0wghzfxazdrrs7p0kln2zn9jh3fmkzwd2z8qggj38q6gm";
 
       azure-mgmt-msi = overrideAzureMgmtPackage super.azure-mgmt-msi "0.2.0" "zip"
         "0rvik03njz940x2hvqg6iiq8k0d88gyygsr86w8s0sa12sdbq8l6";
 
-      azure-mgmt-web = overrideAzureMgmtPackage super.azure-mgmt-web "0.44.0" "zip"
-        "05dqakhfi301k2jnvccxdkigqvwnf9xz858pqg9vsri3dq69f1rw";
+      azure-mgmt-web = overrideAzureMgmtPackage super.azure-mgmt-web "0.46.0" "zip"
+        "19n4cr8a2fwjks3485rkv31bsib9akah5b289sl5lsqyp6i8m671";
 
       azure-mgmt-redhatopenshift = overrideAzureMgmtPackage super.azure-mgmt-redhatopenshift "0.1.0" "zip"
         "1g65lbia1i1jw6qkyjz2ldyl3p90rbr78l8kfryg70sj7z3gnnjn";
@@ -211,6 +211,9 @@ let
       azure-mgmt-security = overrideAzureMgmtPackage super.azure-mgmt-security "0.1.0" "zip"
         "1cb466722bs0ribrirb32kc299716pl0pwivz3jyn40dd78cwhhx";
 
+      azure-mgmt-signalr = overrideAzureMgmtPackage super.azure-mgmt-signalr "0.3.0" "zip"
+        "08b2i6wz9n13h77ahay1hvmg8abk2vvs7kn4y7xip9gi6ij8fv0a";
+
       azure-mgmt-sql = overrideAzureMgmtPackage super.azure-mgmt-sql "0.18.0" "zip"
         "0i9lnhcx85xccddvz1wdz5j0idm6sw2cn3066dww5993nmg0ijlr";
 
@@ -232,8 +235,8 @@ let
       azure-mgmt-cdn = overrideAzureMgmtPackage super.azure-mgmt-cdn "4.1.0rc1" "zip"
         "00q5723gvc57kg2w1iyhfchp018skwd89ibrw23p7ngm2bb76g45";
 
-      azure-mgmt-containerregistry = overrideAzureMgmtPackage super.azure-mgmt-containerregistry "3.0.0rc11" "zip"
-        "1ixh2wmrbm1v2xlrnmy1l513jpqch6b5vyh9x77flm649x1cff2q";
+      azure-mgmt-containerregistry = overrideAzureMgmtPackage super.azure-mgmt-containerregistry "3.0.0rc12" "zip"
+        "0q7w26n53x0lvr1a944jjl9d0yn0l029brx5nzfrz7ydf3jpb2i2";
 
       azure-mgmt-monitor = overrideAzureMgmtPackage super.azure-mgmt-monitor "0.9.0" "zip"
         "170jyr1qzwhv5ihyrsg5d8qzjylqmg31dscd31jzi4i7bwqf3sb8";
@@ -320,12 +323,12 @@ let
       });
 
       knack = super.knack.overridePythonAttrs(oldAttrs: rec {
-        version = "0.7.0rc4";
+        version = "0.7.1";
 
         src = super.fetchPypi {
           inherit (oldAttrs) pname;
           inherit version;
-          sha256 = "10v6qjpr7sbq5irq3kz24jiivpfm0f7jbj9iyx4dm8fgkrhgzlb6";
+          sha256 = "1z50vf0q7kzg3cq9cr24j43ri6wc76dhhklyc9lpvgjf2r061vzw";
         };
       });
 
diff --git a/pkgs/tools/admin/clair/default.nix b/pkgs/tools/admin/clair/default.nix
index 22e490979bc9..77e0638d0d3e 100644
--- a/pkgs/tools/admin/clair/default.nix
+++ b/pkgs/tools/admin/clair/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "clair";
-  version = "2.1.3";
+  version = "2.1.4";
 
   src = fetchFromGitHub {
     owner = "quay";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0wkljfq9lnadzkg1ki3wkimlqd6j405nxcl35npzrxjglkvsdjym";
+    sha256 = "1bvwh3ghxb3ynq8a07ka9i0rzaqg1aikxvqxmpjkwjvhwk63lwqd";
   };
 
   vendorSha256 = "0x31n50vd8660z816as6kms5dkv87b0mhblccpkvd9cbvcv2n37a";
diff --git a/pkgs/tools/admin/eksctl/default.nix b/pkgs/tools/admin/eksctl/default.nix
index 18fb37aa41c0..4fce86557372 100644
--- a/pkgs/tools/admin/eksctl/default.nix
+++ b/pkgs/tools/admin/eksctl/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "eksctl";
-  version = "0.19.0";
+  version = "0.21.0";
 
   src = fetchFromGitHub {
     owner = "weaveworks";
     repo = pname;
     rev = version;
-    sha256 = "0xlr7hsncih4nzydi6sphp7j7k82cbhmi7jb0sd954i8kzl3sc1q";
+    sha256 = "0pfjv5m1fly7n9hmxy8bnpblfh5rzbjkiav3dczy4hkmq226gjsa";
   };
 
-  vendorSha256 = "14d9hl01z7ixp1wa8kp1zs0z1p3pvz6hkp49z582nqllpb2xjmkx";
+  vendorSha256 = "09c3a5g27aqmy4ml42c6zwzrv8yas7i04w3j9jbvp90npwvc62cz";
 
   subPackages = [ "cmd/eksctl" ];
 
diff --git a/pkgs/tools/admin/lego/default.nix b/pkgs/tools/admin/lego/default.nix
index 025afe25e87a..fff8e39aa114 100644
--- a/pkgs/tools/admin/lego/default.nix
+++ b/pkgs/tools/admin/lego/default.nix
@@ -8,7 +8,7 @@ buildGoModule rec {
     owner = "go-acme";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-hjH1TBw6GHYNI9JSBOzdyEtJmp8NhlwNYydGZwsjAg0=";
+    sha256 = "03824c5nfii7cc6mr1hdkyd4jjy8vpn08lnj4c6pc61s3i6gacc6";
   };
 
   vendorSha256 = "14453iiya6algkympyvwm03qgjcwk79z8bbrij7qhnp52qfrbmrp";
diff --git a/pkgs/tools/admin/lxd/default.nix b/pkgs/tools/admin/lxd/default.nix
index f270576e684a..562149414b3d 100644
--- a/pkgs/tools/admin/lxd/default.nix
+++ b/pkgs/tools/admin/lxd/default.nix
@@ -1,22 +1,30 @@
 { stdenv, hwdata, pkgconfig, lxc, buildGoPackage, fetchurl
 , makeWrapper, acl, rsync, gnutar, xz, btrfs-progs, gzip, dnsmasq
-, squashfsTools, iproute, iptables, ebtables, libcap, libco-canonical, dqlite
-, raft-canonical, sqlite-replication, udev
+, squashfsTools, iproute, iptables, ebtables, iptables-nftables-compat, libcap
+, libco-canonical, dqlite, raft-canonical, sqlite-replication, udev
 , writeShellScriptBin, apparmor-profiles, apparmor-parser
 , criu
 , bash
 , installShellFiles
+, nftablesSupport ? false
 }:
 
+let
+  networkPkgs = if nftablesSupport then
+    [ iptables-nftables-compat ]
+  else
+    [ iptables ebtables ];
+
+in
 buildGoPackage rec {
   pname = "lxd";
-  version = "4.1";
+  version = "4.2";
 
   goPackagePath = "github.com/lxc/lxd";
 
   src = fetchurl {
     url = "https://github.com/lxc/lxd/releases/download/${pname}-${version}/${pname}-${version}.tar.gz";
-    sha256 = "0svzj57wwm43d2gnx0myr2p9pzjmkivwhgg0dww6zl169bx32liz";
+    sha256 = "0pv84ywnigrp94kh54fz689i15yv01lhrnkxpk8dg9wypxara9m4";
   };
 
   postPatch = ''
@@ -38,12 +46,14 @@ buildGoPackage rec {
     # test binaries, code generation
     rm $out/bin/{deps,macaroon-identity,generate}
 
-    wrapProgram $out/bin/lxd --prefix PATH : ${stdenv.lib.makeBinPath [
-      acl rsync gnutar xz btrfs-progs gzip dnsmasq squashfsTools iproute iptables ebtables bash criu
-      (writeShellScriptBin "apparmor_parser" ''
-        exec '${apparmor-parser}/bin/apparmor_parser' -I '${apparmor-profiles}/etc/apparmor.d' "$@"
-      '')
-    ]}
+    wrapProgram $out/bin/lxd --prefix PATH : ${stdenv.lib.makeBinPath (
+      networkPkgs
+      ++ [ acl rsync gnutar xz btrfs-progs gzip dnsmasq squashfsTools iproute bash criu ]
+      ++ [ (writeShellScriptBin "apparmor_parser" ''
+             exec '${apparmor-parser}/bin/apparmor_parser' -I '${apparmor-profiles}/etc/apparmor.d' "$@"
+           '') ]
+      )
+    }
 
     installShellCompletion --bash go/src/github.com/lxc/lxd/scripts/bash/lxd-client
   '';
diff --git a/pkgs/tools/admin/scaleway-cli/default.nix b/pkgs/tools/admin/scaleway-cli/default.nix
index f9b608ebc4c6..eeae7fbe1bf0 100644
--- a/pkgs/tools/admin/scaleway-cli/default.nix
+++ b/pkgs/tools/admin/scaleway-cli/default.nix
@@ -1,6 +1,6 @@
 { stdenv, fetchFromGitHub, buildGoPackage }:
 
-buildGoPackage rec{
+buildGoPackage rec {
   pname = "scaleway-cli";
   version = "1.20";
 
diff --git a/pkgs/tools/archivers/p7zip/12-CVE-2016-9296.patch b/pkgs/tools/archivers/p7zip/12-CVE-2016-9296.patch
deleted file mode 100644
index 42245c92c0aa..000000000000
--- a/pkgs/tools/archivers/p7zip/12-CVE-2016-9296.patch
+++ /dev/null
@@ -1,23 +0,0 @@
-From: Robert Luberda <robert@debian.org>
-Date: Sat, 19 Nov 2016 08:48:08 +0100
-Subject: Fix nullptr dereference (CVE-2016-9296)
-
-Patch taken from https://sourceforge.net/p/p7zip/bugs/185/
----
- CPP/7zip/Archive/7z/7zIn.cpp | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/CPP/7zip/Archive/7z/7zIn.cpp b/CPP/7zip/Archive/7z/7zIn.cpp
-index b0c6b98..7c6dde2 100644
---- a/CPP/7zip/Archive/7z/7zIn.cpp
-+++ b/CPP/7zip/Archive/7z/7zIn.cpp
-@@ -1097,7 +1097,8 @@ HRESULT CInArchive::ReadAndDecodePackedStreams(
-       if (CrcCalc(data, unpackSize) != folders.FolderCRCs.Vals[i])
-         ThrowIncorrect();
-   }
--  HeadersSize += folders.PackPositions[folders.NumPackStreams];
-+  if (folders.PackPositions)
-+      HeadersSize += folders.PackPositions[folders.NumPackStreams];
-   return S_OK;
- }
- 
diff --git a/pkgs/tools/archivers/p7zip/13-CVE-2017-17969.patch b/pkgs/tools/archivers/p7zip/13-CVE-2017-17969.patch
deleted file mode 100644
index a9787c4a9088..000000000000
--- a/pkgs/tools/archivers/p7zip/13-CVE-2017-17969.patch
+++ /dev/null
@@ -1,35 +0,0 @@
-From: =?utf-8?q?Antoine_Beaupr=C3=A9?= <anarcat@debian.org>
-Date: Fri, 2 Feb 2018 11:11:41 +0100
-Subject: Heap-based buffer overflow in 7zip/Compress/ShrinkDecoder.cpp
-
-Origin: vendor, https://sourceforge.net/p/p7zip/bugs/_discuss/thread/0920f369/27d7/attachment/CVE-2017-17969.patch
-Forwarded: https://sourceforge.net/p/p7zip/bugs/_discuss/thread/0920f369/#27d7
-Bug: https://sourceforge.net/p/p7zip/bugs/204/
-Bug-Debian: https://bugs.debian.org/888297
-Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2017-17969
-Reviewed-by: Salvatore Bonaccorso <carnil@debian.org>
-Last-Update: 2018-02-01
-Applied-Upstream: 18.00-beta
----
- CPP/7zip/Compress/ShrinkDecoder.cpp | 7 ++++++-
- 1 file changed, 6 insertions(+), 1 deletion(-)
-
-diff --git a/CPP/7zip/Compress/ShrinkDecoder.cpp b/CPP/7zip/Compress/ShrinkDecoder.cpp
-index 80b7e67..ca37764 100644
---- a/CPP/7zip/Compress/ShrinkDecoder.cpp
-+++ b/CPP/7zip/Compress/ShrinkDecoder.cpp
-@@ -121,8 +121,13 @@ HRESULT CDecoder::CodeReal(ISequentialInStream *inStream, ISequentialOutStream *
-     {
-       _stack[i++] = _suffixes[cur];
-       cur = _parents[cur];
-+      if (cur >= kNumItems || i >= kNumItems)
-+        break;
-     }
--    
-+
-+    if (cur >= kNumItems || i >= kNumItems)
-+      break;
-+
-     _stack[i++] = (Byte)cur;
-     lastChar2 = (Byte)cur;
- 
diff --git a/pkgs/tools/archivers/p7zip/default.nix b/pkgs/tools/archivers/p7zip/default.nix
index d6ad699eaa8d..773d37f0b758 100644
--- a/pkgs/tools/archivers/p7zip/default.nix
+++ b/pkgs/tools/archivers/p7zip/default.nix
@@ -1,28 +1,17 @@
-{ stdenv, fetchurl, fetchpatch, lib, enableUnfree ? false }:
+{ stdenv, fetchFromGitHub, lib, enableUnfree ? false }:
 
 stdenv.mkDerivation rec {
   pname = "p7zip";
-  version = "16.02";
+  version = "17.01";
 
-  src = fetchurl {
-    url = "mirror://sourceforge/p7zip/p7zip_${version}_src_all.tar.bz2";
-    sha256 = "5eb20ac0e2944f6cb9c2d51dd6c4518941c185347d4089ea89087ffdd6e2341f";
-  };
 
-  patches = [
-    ./12-CVE-2016-9296.patch
-    ./13-CVE-2017-17969.patch
-    (fetchpatch {
-      name = "3-CVE-2018-5996.patch";
-      url = "https://raw.githubusercontent.com/termux/termux-packages/master/packages/p7zip/3-CVE-2018-5996.patch";
-      sha256 = "1zivvkazmza0653i498ccp3zbpbpc7dvxl3zxwllbx41b6n589yp";
-    })
-    (fetchpatch {
-      name = "4-CVE-2018-10115.patch";
-      url = "https://raw.githubusercontent.com/termux/termux-packages/master/packages/p7zip/4-CVE-2018-10115.patch";
-      sha256 = "1cr7q8gnrk9yp6dcvxaqi1yhdbgp964nkv65ls41mw1kdfm44zn6";
-    })
-  ];
+  src = fetchFromGitHub {
+    owner  = "szcnick";
+    repo   = pname;
+    rev    = "v${version}";
+    sha256 = "0gczdmypwbfnxzb11rjrrndjkkb3jzxfby2cchn5j8ysny13mfps";
+  }
+  ;
 
   # Default makefile is full of impurities on Darwin. The patch doesn't hurt Linux so I'm leaving it unconditional
   postPatch = ''
@@ -39,14 +28,15 @@ stdenv.mkDerivation rec {
     # (see DOC/License.txt, https://fedoraproject.org/wiki/Licensing:Unrar)
     rm -r CPP/7zip/Compress/Rar*
     find . -name makefile'*' -exec sed -i '/Rar/d' {} +
+    chmod +x install.sh
   '';
 
   preConfigure = ''
     makeFlagsArray=(DEST_HOME=$out)
-    buildFlags=all3
-  '' + stdenv.lib.optionalString stdenv.isDarwin ''
-    cp makefile.macosx_llvm_64bits makefile.machine
-  '';
+      buildFlags=all3
+        '' + stdenv.lib.optionalString stdenv.isDarwin ''
+        cp makefile.macosx_llvm_64bits makefile.machine
+'';
 
   enableParallelBuilding = true;
 
@@ -55,15 +45,10 @@ stdenv.mkDerivation rec {
   NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.cc.isClang "-Wno-error=c++11-narrowing";
 
   meta = {
-    homepage = "http://p7zip.sourceforge.net/";
-    description = "A port of the 7-zip archiver";
+    homepage = "https://github.com/szcnick/p7zip";
+    description = "A new p7zip fork with additional codecs and improvements (forked from https://sourceforge.net/projects/p7zip/)";
     platforms = stdenv.lib.platforms.unix;
     maintainers = [ stdenv.lib.maintainers.raskin ];
-    knownVulnerabilities = [
-      # p7zip is abandoned, according to this thread on its forums:
-      # https://sourceforge.net/p/p7zip/discussion/383043/thread/fa143cf2/#1817
-      "p7zip is abandoned and may not receive important security fixes"
-    ];
     # RAR code is under non-free UnRAR license, but we remove it
     license = if enableUnfree then lib.licenses.unfree else lib.licenses.lgpl2Plus;
   };
diff --git a/pkgs/tools/audio/abcmidi/default.nix b/pkgs/tools/audio/abcmidi/default.nix
index 0ccfaa081c9a..1987b0a87c28 100644
--- a/pkgs/tools/audio/abcmidi/default.nix
+++ b/pkgs/tools/audio/abcmidi/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "abcMIDI";
-  version = "2020.03.25";
+  version = "2020.06.07";
 
   src = fetchzip {
     url = "https://ifdo.ca/~seymour/runabc/${pname}-${version}.zip";
-    sha256 = "0rzif8idsja8ryhx0y4zdk8lhn36h10ahfjqa8bmif0rdbyab0kv";
+    sha256 = "06jpawwm4zcss9mi2bjdbdkkfr8cw1q9cpzplq5r83z8pljqb12l";
   };
 
   # There is also a file called "makefile" which seems to be preferred by the standard build phase
diff --git a/pkgs/tools/audio/beets/default.nix b/pkgs/tools/audio/beets/default.nix
index 71ebe7ceb81d..662dba65be42 100644
--- a/pkgs/tools/audio/beets/default.nix
+++ b/pkgs/tools/audio/beets/default.nix
@@ -10,7 +10,7 @@
 , enableAcousticbrainz ? true
 , enableAcoustid       ? true
 , enableBadfiles       ? true, flac ? null, mp3val ? null
-, enableConvert        ? true, ffmpeg ? null
+, enableConvert        ? true, ffmpeg_3 ? null
 , enableDiscogs        ? true
 , enableEmbyupdate     ? true
 , enableFetchart       ? true
@@ -39,7 +39,7 @@ assert enableAbsubmit    -> essentia-extractor            != null;
 assert enableAcoustid    -> pythonPackages.pyacoustid     != null;
 assert enableBadfiles    -> flac != null && mp3val != null;
 assert enableCheck       -> flac != null && mp3val != null && liboggz != null;
-assert enableConvert     -> ffmpeg != null;
+assert enableConvert     -> ffmpeg_3 != null;
 assert enableDiscogs     -> pythonPackages.discogs_client != null;
 assert enableFetchart    -> pythonPackages.responses      != null;
 assert enableGmusic      -> pythonPackages.gmusicapi      != null;
@@ -146,7 +146,7 @@ in pythonPackages.buildPythonApplication rec {
               || enableAcousticbrainz)
                                     pythonPackages.requests
     ++ optional enableCheck         plugins.check
-    ++ optional enableConvert       ffmpeg
+    ++ optional enableConvert       ffmpeg_3
     ++ optional enableDiscogs       pythonPackages.discogs_client
     ++ optional enableGmusic        pythonPackages.gmusicapi
     ++ optional enableKeyfinder     keyfinder-cli
@@ -200,7 +200,7 @@ in pythonPackages.buildPythonApplication rec {
       s,"mp3val","${mp3val}/bin/mp3val",
     }' beetsplug/badfiles.py
   '' + optionalString enableConvert ''
-    sed -i -e 's,\(util\.command_output(\)\([^)]\+\)),\1[b"${ffmpeg.bin}/bin/ffmpeg" if args[0] == b"ffmpeg" else args[0]] + \2[1:]),' beetsplug/convert.py
+    sed -i -e 's,\(util\.command_output(\)\([^)]\+\)),\1[b"${ffmpeg_3.bin}/bin/ffmpeg" if args[0] == b"ffmpeg" else args[0]] + \2[1:]),' beetsplug/convert.py
   '' + optionalString enableReplaygain ''
     sed -i -re '
       s!^( *cmd *= *b?['\'''"])(bs1770gain['\'''"])!\1${bs1770gain}/bin/\2!
diff --git a/pkgs/tools/audio/playerctl/default.nix b/pkgs/tools/audio/playerctl/default.nix
index 3541453bafe4..6d7d92808c1f 100644
--- a/pkgs/tools/audio/playerctl/default.nix
+++ b/pkgs/tools/audio/playerctl/default.nix
@@ -14,6 +14,8 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ meson ninja pkgconfig gtk-doc docbook_xsl gobject-introspection ];
   buildInputs = [ glib ];
 
+  mesonFlags = [ "-Dbash-completions=true" ];
+
   meta = with stdenv.lib; {
     description = "Command-line utility and library for controlling media players that implement MPRIS";
     homepage = "https://github.com/acrisci/playerctl";
diff --git a/pkgs/tools/audio/video2midi/default.nix b/pkgs/tools/audio/video2midi/default.nix
index dca8a0610da8..cf9297119e9f 100644
--- a/pkgs/tools/audio/video2midi/default.nix
+++ b/pkgs/tools/audio/video2midi/default.nix
@@ -8,7 +8,7 @@ let
   });
 in pythonPackages.buildPythonApplication rec {
   pname = "video2midi";
-  version = "0.4.0.1";
+  version = "0.4.0.2";
 
   format = "other";
 
@@ -16,7 +16,7 @@ in pythonPackages.buildPythonApplication rec {
     owner = "svsdval";
     repo = pname;
     rev = version;
-    sha256 = "1869w60kprjdikqk4iwx058zri2jg4aznzlg668w9myka4mp01r9";
+    sha256 = "174ijn8bc306529scd23szvgx1apanm2qmwk4lwmi64rhkm6dapx";
   };
 
   propagatedBuildInputs = with pythonPackages; [ opencv3_ midiutil pygame pyopengl ];
diff --git a/pkgs/tools/backup/bacula/default.nix b/pkgs/tools/backup/bacula/default.nix
index a9fd2f19b897..8bf253a7b121 100644
--- a/pkgs/tools/backup/bacula/default.nix
+++ b/pkgs/tools/backup/bacula/default.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl, sqlite, postgresql, zlib, acl, ncurses, openssl, readline }:
 
 stdenv.mkDerivation rec {
-  name = "bacula-9.6.3";
+  name = "bacula-9.6.5";
 
   src = fetchurl {
     url    = "mirror://sourceforge/bacula/${name}.tar.gz";
-    sha256 = "02jvijwfw8nqrq61pyr5b9d5zjpmrsimkg6dq42rbd71g2k6a4zc";
+    sha256 = "0yn7qwkzix78bs811vmrn5gbywy7ggnsv72mdjz2lirqc6w3a3si";
   };
 
   buildInputs = [ postgresql sqlite zlib ncurses openssl readline ]
diff --git a/pkgs/tools/backup/borg/default.nix b/pkgs/tools/backup/borg/default.nix
index de69a8db3de1..900903675860 100644
--- a/pkgs/tools/backup/borg/default.nix
+++ b/pkgs/tools/backup/borg/default.nix
@@ -2,11 +2,11 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "borgbackup";
-  version = "1.1.11";
+  version = "1.1.13";
 
   src = python3.pkgs.fetchPypi {
     inherit pname version;
-    sha256 = "190gjzx83b6p64nqj840x382dgz9gfv0gm7wj585lnkrpa90j29n";
+    sha256 = "089q3flmwbz7dc28zlscwylf64kgck3jf1n6lqpwww8hlrk8cjhn";
   };
 
   nativeBuildInputs = with python3.pkgs; [
diff --git a/pkgs/tools/backup/duplicati/default.nix b/pkgs/tools/backup/duplicati/default.nix
index e2a5cc1c4cf9..63f35538796a 100644
--- a/pkgs/tools/backup/duplicati/default.nix
+++ b/pkgs/tools/backup/duplicati/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "duplicati";
-  version = "2.0.4.23";
+  version = "2.0.5.1";
   channel = "beta";
-  build_date = "2019-07-14";
+  build_date = "2020-01-18";
 
   src = fetchzip {
     url = "https://github.com/duplicati/duplicati/releases/download/v${version}-${version}_${channel}_${build_date}/duplicati-${version}_${channel}_${build_date}.zip";
-    sha256 = "1m2448vgl1fc2hkxkyasvdfgl728rqv16b41niznv5rsxv5643w2";
+    sha256 = "1k3gfwcw7snxkqn4lf9rx1vzradpyq5vc48pwvaa8wwqnlykiimw";
     stripRoot = false;
   };
 
diff --git a/pkgs/tools/backup/easysnap/default.nix b/pkgs/tools/backup/easysnap/default.nix
index 9b5450ba7a3b..5c2ad1a50a7b 100644
--- a/pkgs/tools/backup/easysnap/default.nix
+++ b/pkgs/tools/backup/easysnap/default.nix
@@ -8,7 +8,7 @@ stdenv.mkDerivation {
     owner = "sjau";
     repo = "easysnap";
     rev = "26f89c0c3cda01e2595ee19ae5fb8518da25b4ef";
-    sha256 = "sha256:1k49k1m7y8s099wyiiz8411i77j1156ncirynmjfyvdhmhcyp5rw";
+    sha256 = "1k49k1m7y8s099wyiiz8411i77j1156ncirynmjfyvdhmhcyp5rw";
   };
 
   installPhase = ''
diff --git a/pkgs/tools/backup/monolith/default.nix b/pkgs/tools/backup/monolith/default.nix
index 261267b809a1..36d90fb8066c 100644
--- a/pkgs/tools/backup/monolith/default.nix
+++ b/pkgs/tools/backup/monolith/default.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "monolith";
-  version = "2.2.6";
+  version = "2.2.7";
 
   src = fetchFromGitHub {
     owner = "Y2Z";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0ifv1h16xrs40gw5wx7kwj7hirnzpgfrznskz2igsslk7ycjlbr1";
+    sha256 = "1ww5q7pk269l2s7d2svkkyd7hb7g4hqmwjn09b287pmjcirnmqn9";
   };
 
-  cargoSha256 = "1plx9p265jcc6wg3bhcdk1f77md8ann08kkv3g2706d82kxy2c1i";
+  cargoSha256 = "0jdbxshvm9hdxdjr3sy1kgszhfs9v4r6gp0nwvv2n92m3z8zri9y";
 
   nativeBuildInputs = stdenv.lib.optionals stdenv.isLinux [ pkg-config ];
   buildInputs = stdenv.lib.optionals stdenv.isLinux [ openssl ]
diff --git a/pkgs/tools/bluetooth/blueman/default.nix b/pkgs/tools/bluetooth/blueman/default.nix
index 69db0053cfa1..aa8693b365a0 100644
--- a/pkgs/tools/bluetooth/blueman/default.nix
+++ b/pkgs/tools/bluetooth/blueman/default.nix
@@ -9,11 +9,11 @@ let
 
 in stdenv.mkDerivation rec {
   pname = "blueman";
-  version = "2.1.2";
+  version = "2.1.3";
 
   src = fetchurl {
     url = "https://github.com/blueman-project/blueman/releases/download/${version}/${pname}-${version}.tar.xz";
-    sha256 = "0k49hgyglsrlszckjzrvlsdm9ysns3qgvczgcmwaz02vvwnb4zai";
+    sha256 = "1pngqbwapbvywhkmflapqvs0wa0af7d1a87wy56l5hg2r462xl1v";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/cd-dvd/unetbootin/default.nix b/pkgs/tools/cd-dvd/unetbootin/default.nix
index d81790d66a85..ae9e6724facc 100644
--- a/pkgs/tools/cd-dvd/unetbootin/default.nix
+++ b/pkgs/tools/cd-dvd/unetbootin/default.nix
@@ -3,13 +3,13 @@
 
 stdenv.mkDerivation rec {
   pname = "unetbootin";
-  version = "677";
+  version = "681";
 
   src = fetchFromGitHub {
     owner  = "unetbootin";
     repo   = "unetbootin";
     rev    = version;
-    sha256 = "1mk6179r2lz2d0pvln1anvf5p4l7vfrnnnlhgyx2dlx6pfacsspy";
+    sha256 = "0ppqb7ywh4cpcjr5nw6f65dx4s8kx09gnhihnby3zjhxdf4l99fm";
   };
 
   setSourceRoot = ''
diff --git a/pkgs/tools/compression/dtrx/default.nix b/pkgs/tools/compression/dtrx/default.nix
index edca969a1e84..81a446066d97 100644
--- a/pkgs/tools/compression/dtrx/default.nix
+++ b/pkgs/tools/compression/dtrx/default.nix
@@ -1,18 +1,15 @@
 {stdenv, lib, fetchurl, pythonPackages
-, gnutar, unzip, lhasa, rpm, binutils, cpio, gzip, cabextract, unrar, unshield
+, gnutar, unzip, lhasa, rpm, binutils, cpio, gzip, p7zip, cabextract, unrar, unshield
 , bzip2, xz, lzip
-# unsafe:
-# ,p7zip
-# unzip is no longer handled by p7zip, since it's unsafe
-, unzipSupport ? true
+# unzip is handled by p7zip
+, unzipSupport ? false
 , unrarSupport ? false }:
 
 let
-  # p7zip
-  archivers = lib.makeBinPath ([ gnutar lhasa rpm binutils cpio gzip cabextract unshield ]
-                               ++ lib.optional (unzipSupport) unzip
-                               ++ lib.optional (unrarSupport) unrar
-                               ++ [ bzip2 xz lzip ]);
+  archivers = lib.makeBinPath ([ gnutar lhasa rpm binutils cpio gzip p7zip cabextract unshield ]
+  ++ lib.optional (unzipSupport) unzip
+  ++ lib.optional (unrarSupport) unrar
+  ++ [ bzip2 xz lzip ]);
 
 in pythonPackages.buildPythonApplication rec {
   pname = "dtrx";
diff --git a/pkgs/tools/compression/gzip/default.nix b/pkgs/tools/compression/gzip/default.nix
index 65760a0b6ccd..eb680ff8a061 100644
--- a/pkgs/tools/compression/gzip/default.nix
+++ b/pkgs/tools/compression/gzip/default.nix
@@ -1,4 +1,8 @@
-{ stdenv, fetchurl, xz }:
+{ stdenv
+, fetchurl
+, xz
+, writeText
+}:
 
 stdenv.mkDerivation rec {
   pname = "gzip";
@@ -26,6 +30,12 @@ stdenv.mkDerivation rec {
     }' $out/bin/*
   '';
 
+  # set GZIP env variable to "-n" to stop gzip from adding timestamps
+  # to archive headers: https://github.com/NixOS/nixpkgs/issues/86348
+  setupHook = writeText "setup-hook" ''
+    export GZIP="-n"
+  '';
+
   meta = {
     homepage = "https://www.gnu.org/software/gzip/";
     description = "GNU zip compression program";
diff --git a/pkgs/tools/compression/hactool/default.nix b/pkgs/tools/compression/hactool/default.nix
index 77382d980e54..d34ca73556bb 100644
--- a/pkgs/tools/compression/hactool/default.nix
+++ b/pkgs/tools/compression/hactool/default.nix
@@ -1,20 +1,22 @@
 { stdenv, fetchFromGitHub }:
 
-stdenv.mkDerivation {
+stdenv.mkDerivation rec {
   pname = "hactool";
-  version = "1.3.3";
+  version = "1.4.0";
 
   src = fetchFromGitHub {
     owner = "SciresM";
     repo = "hactool";
-    rev = "1.3.3";
-    sha256 = "1qb51fck7liqc1ridms8wdlzgbdbvp6iv4an8jvmzhcj5p5xq631";
+    rev = version;
+    sha256 = "0305ngsnwm8npzgyhyifasi4l802xnfz19r0kbzzniirmcn4082d";
   };
 
   preBuild = ''
     mv config.mk.template config.mk
   '';
 
+  makeFlags = stdenv.lib.optionals stdenv.isDarwin [ "CC=cc" ];
+
   installPhase = ''
     install -D hactool $out/bin/hactool
   '';
diff --git a/pkgs/tools/compression/zstd/default.nix b/pkgs/tools/compression/zstd/default.nix
index 2f89331f92c6..f919fb92ed1d 100644
--- a/pkgs/tools/compression/zstd/default.nix
+++ b/pkgs/tools/compression/zstd/default.nix
@@ -30,6 +30,7 @@ stdenv.mkDerivation rec {
 
   cmakeFlags = [
     "-DZSTD_BUILD_SHARED:BOOL=${if enableShared then "ON" else "OFF"}"
+    # They require STATIC for bin/zstd and tests.
     "-DZSTD_LEGACY_SUPPORT:BOOL=${if legacySupport then "ON" else "OFF"}"
     "-DZSTD_BUILD_TESTS:BOOL=ON"
   ];
@@ -50,11 +51,15 @@ stdenv.mkDerivation rec {
   preInstall = ''
     substituteInPlace ../programs/zstdgrep \
       --replace ":-grep" ":-${gnugrep}/bin/grep" \
-      --replace ":-zstdcat" ":-$out/bin/zstdcat"
+      --replace ":-zstdcat" ":-$bin/bin/zstdcat"
 
     substituteInPlace ../programs/zstdless \
-      --replace "zstdcat" "$out/bin/zstdcat"
+      --replace "zstdcat" "$bin/bin/zstdcat"
   '';
+  # Don't duplicate the library code in runtime closures.
+  postInstall = stdenv.lib.optionalString enableShared ''rm "$out"/lib/libzstd.a'';
+
+  outputs = [ "bin" "dev" "man" "out" ];
 
   meta = with stdenv.lib; {
     description = "Zstandard real-time compression algorithm";
diff --git a/pkgs/tools/filesystems/bees/default.nix b/pkgs/tools/filesystems/bees/default.nix
index c6bb07e7b87d..e87cecbf8fd3 100644
--- a/pkgs/tools/filesystems/bees/default.nix
+++ b/pkgs/tools/filesystems/bees/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, runCommand, fetchFromGitHub, bash, btrfs-progs, coreutils, pythonPackages, utillinux }:
+{ stdenv, runCommand, fetchFromGitHub, bash, btrfs-progs, coreutils, python3Packages, utillinux }:
 
 let
 
@@ -22,7 +22,7 @@ let
     ];
 
     nativeBuildInputs = [
-      pythonPackages.markdown   # documentation build
+      python3Packages.markdown   # documentation build
     ];
 
     preBuild = ''
diff --git a/pkgs/tools/filesystems/btrfs-progs/default.nix b/pkgs/tools/filesystems/btrfs-progs/default.nix
index 5c73ee945c79..5a6dafae2980 100644
--- a/pkgs/tools/filesystems/btrfs-progs/default.nix
+++ b/pkgs/tools/filesystems/btrfs-progs/default.nix
@@ -4,11 +4,11 @@
 
 stdenv.mkDerivation rec {
   pname = "btrfs-progs";
-  version = "5.6";
+  version = "5.6.1";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/people/kdave/btrfs-progs/btrfs-progs-v${version}.tar.xz";
-    sha256 = "0srg276yccfmqz0skmmga3vbqx4wiqsk1l6h86n6ryhxa9viqcm1";
+    sha256 = "1nwnvjdnr9fjj2q2p2vpjabfdhcrwykgj9knjcsqy0c7p1bgbk2h";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/filesystems/convoy/default.nix b/pkgs/tools/filesystems/convoy/default.nix
index 77d6dca066a4..f12187be810f 100644
--- a/pkgs/tools/filesystems/convoy/default.nix
+++ b/pkgs/tools/filesystems/convoy/default.nix
@@ -3,7 +3,7 @@
 
 buildGoPackage rec {
   pname = "convoy";
-  version = "0.5.0";
+  version = "0.5.2";
 
   goPackagePath = "github.com/rancher/convoy";
 
@@ -11,7 +11,7 @@ buildGoPackage rec {
     rev = "v${version}";
     owner = "rancher";
     repo = "convoy";
-    sha256 = "0ihy0cfq7sa2wml904ajwr165hx2mas3jb1bqk3i0m4fg1lx1xw1";
+    sha256 = "09nygrxd5hril4xcfsvgjg74xxhhimznqq4sdk0f360c5ra0dbhj";
   };
 
   buildInputs = [lvm2];
diff --git a/pkgs/tools/filesystems/davfs2/default.nix b/pkgs/tools/filesystems/davfs2/default.nix
index e3e4444c6c18..4f818ed213b7 100644
--- a/pkgs/tools/filesystems/davfs2/default.nix
+++ b/pkgs/tools/filesystems/davfs2/default.nix
@@ -35,7 +35,7 @@ stdenv.mkDerivation rec {
     (fetchpatch {
       name = "neon-0.31.patch";
       url = "http://savannah.nongnu.org/bugs/download.php?file_id=48737";
-      sha256 = "EtQfcstWkn8AcbZo93midGt076gq20AvGGJyQ3FO/YQ=";
+      sha256 = "117x9rql6wk230pl1nram3pp8svll9wzfs5nf407z4jnrdr1zm0j";
       extraPrefix = ""; # empty means add 'a/' and 'b/'
     })
   ];
diff --git a/pkgs/tools/filesystems/genromfs/default.nix b/pkgs/tools/filesystems/genromfs/default.nix
index d9d97a424bdd..4adf124d529f 100644
--- a/pkgs/tools/filesystems/genromfs/default.nix
+++ b/pkgs/tools/filesystems/genromfs/default.nix
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
     homepage = "http://romfs.sourceforge.net/";
     description = "Tool for creating romfs file system images";
     license = licenses.gpl2;
-    maintainers = with maintainers; [ pxc ];
+    maintainers = with maintainers; [ ];
     platforms = platforms.all;
   };
 }
diff --git a/pkgs/tools/filesystems/moosefs/default.nix b/pkgs/tools/filesystems/moosefs/default.nix
index af09cafe1dea..8ceb3d7c0aac 100644
--- a/pkgs/tools/filesystems/moosefs/default.nix
+++ b/pkgs/tools/filesystems/moosefs/default.nix
@@ -5,7 +5,7 @@
 , fuse
 , pkgconfig
 , libpcap
-, zlib 
+, zlib
 }:
 
 stdenv.mkDerivation rec {
@@ -25,6 +25,7 @@ stdenv.mkDerivation rec {
     [ fuse libpcap zlib ];
 
   postInstall = ''
+    substituteInPlace $out/sbin/mfscgiserv --replace "datapath=\"$out" "datapath=\""
     wrapProgram $out/sbin/mfscgiserv \
         --prefix PATH ":" "${python}/bin"
   '';
diff --git a/pkgs/tools/filesystems/netatalk/default.nix b/pkgs/tools/filesystems/netatalk/default.nix
index faa0a1ebfe86..f7732cd76fd7 100644
--- a/pkgs/tools/filesystems/netatalk/default.nix
+++ b/pkgs/tools/filesystems/netatalk/default.nix
@@ -3,7 +3,7 @@
 , ed, glibc, libevent
 }:
 
-stdenv.mkDerivation rec{
+stdenv.mkDerivation rec {
   name = "netatalk-3.1.12";
 
   src = fetchurl {
diff --git a/pkgs/tools/filesystems/nixpart/0.4/cryptsetup.nix b/pkgs/tools/filesystems/nixpart/0.4/cryptsetup.nix
index 3feed2388809..88a1716a0e1e 100644
--- a/pkgs/tools/filesystems/nixpart/0.4/cryptsetup.nix
+++ b/pkgs/tools/filesystems/nixpart/0.4/cryptsetup.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, lvm2, libgcrypt, libuuid, pkgconfig, popt
+{ stdenv, fetchurl, fetchpatch, lvm2, libgcrypt, libuuid, pkgconfig, popt
 , enablePython ? true, python ? null
 }:
 
@@ -12,6 +12,15 @@ stdenv.mkDerivation rec {
     sha256 = "1n1qk5chyjspbiianrdb55fhb4wl0vfyqz2br05vfb24v4qlgbx2";
   };
 
+  patches = [
+    # Fix build with glibc >= 2.28
+    # https://github.com/NixOS/nixpkgs/issues/86403
+    (fetchpatch {
+      url = "https://gitweb.gentoo.org/repo/gentoo.git/plain/sys-fs/cryptsetup/files/cryptsetup-1.7.1-sysmacros.patch?id=d72316f97ebcc7fe622b21574442a9ac59b9115f";
+      sha256 = "0xbhazgl44bimqhcrhajk016w9wi7bkrgwyfq13xmrvyrllqvgdx";
+    })
+  ];
+
   configureFlags = [ "--enable-cryptsetup-reencrypt" ]
                 ++ stdenv.lib.optional enablePython "--enable-python";
 
diff --git a/pkgs/tools/filesystems/nixpart/0.4/default.nix b/pkgs/tools/filesystems/nixpart/0.4/default.nix
index 5d7a9dd14ec0..1f672701d382 100644
--- a/pkgs/tools/filesystems/nixpart/0.4/default.nix
+++ b/pkgs/tools/filesystems/nixpart/0.4/default.nix
@@ -18,7 +18,7 @@ let
 
   cryptsetup = import ./cryptsetup.nix {
     inherit stdenv fetchurl python;
-    inherit (pkgs) pkgconfig libgcrypt libuuid popt lvm2;
+    inherit (pkgs) fetchpatch pkgconfig libgcrypt libuuid popt lvm2;
   };
 
   dmraid = import ./dmraid.nix {
@@ -27,17 +27,17 @@ let
 
   lvm2 = import ./lvm2.nix {
     inherit stdenv fetchurl;
-    inherit (pkgs) pkgconfig utillinux systemd coreutils;
+    inherit (pkgs) fetchpatch pkgconfig utillinux systemd coreutils;
   };
 
   multipath_tools = import ./multipath-tools.nix {
     inherit stdenv fetchurl lvm2;
-    inherit (pkgs) readline systemd libaio gzip;
+    inherit (pkgs) fetchpatch readline systemd libaio gzip;
   };
 
   parted = import ./parted.nix {
     inherit stdenv fetchurl;
-    inherit (pkgs) utillinux readline libuuid gettext check lvm2;
+    inherit (pkgs) fetchpatch utillinux readline libuuid gettext check lvm2;
   };
 
   pyblock = import ./pyblock.nix {
diff --git a/pkgs/tools/filesystems/nixpart/0.4/lvm2.nix b/pkgs/tools/filesystems/nixpart/0.4/lvm2.nix
index c8c748b4c45f..fc0005a14d45 100644
--- a/pkgs/tools/filesystems/nixpart/0.4/lvm2.nix
+++ b/pkgs/tools/filesystems/nixpart/0.4/lvm2.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, pkgconfig, systemd, utillinux, coreutils }:
+{ stdenv, fetchurl, fetchpatch, pkgconfig, systemd, utillinux, coreutils }:
 
 let
   v = "2.02.106";
@@ -12,6 +12,18 @@ stdenv.mkDerivation {
     sha256 = "0nr833bl0q4zq52drjxmmpf7bs6kqxwa5kahwwxm9411khkxz0vc";
   };
 
+  patches = [
+    # Fix build with glibc >= 2.28
+    # https://github.com/NixOS/nixpkgs/issues/86403
+    (fetchpatch {
+      url = "https://github.com/lvmteam/lvm2/commit/92d5a8441007f578e000b492cecf67d6b8a87405.patch";
+      sha256 = "1yqd6jng0b370k53vks1shg57yhfyribhpmv19km5zsjqf0qqx2d";
+      excludes = [
+        "libdm/libdm-stats.c"
+      ];
+    })
+  ];
+
   configureFlags = [
     "--disable-readline"
     "--enable-udev_rules"
diff --git a/pkgs/tools/filesystems/nixpart/0.4/multipath-tools.nix b/pkgs/tools/filesystems/nixpart/0.4/multipath-tools.nix
index b3b18579334f..ffed57e6345e 100644
--- a/pkgs/tools/filesystems/nixpart/0.4/multipath-tools.nix
+++ b/pkgs/tools/filesystems/nixpart/0.4/multipath-tools.nix
@@ -1,6 +1,6 @@
 # FIXME: unify with pkgs/os-specific/linux/multipath-tools/default.nix.
 
-{ stdenv, fetchurl, lvm2, libaio, gzip, readline, systemd }:
+{ stdenv, fetchurl, fetchpatch, lvm2, libaio, gzip, readline, systemd }:
 
 stdenv.mkDerivation rec {
   name = "multipath-tools-0.4.9";
@@ -10,6 +10,18 @@ stdenv.mkDerivation rec {
     sha256 = "04n7kazp1zrlqfza32phmqla0xkcq4zwn176qff5ida4a60whi4d";
   };
 
+  patches = [
+    # Fix build with glibc >= 2.28
+    # https://github.com/NixOS/nixpkgs/issues/86403
+    (fetchpatch {
+      url = "https://gitweb.gentoo.org/repo/gentoo.git/plain/sys-fs/multipath-tools/files/multipath-tools-0.6.4-sysmacros.patch?id=eb22b954c177b5c1e2b6ed5c7cdd02f40f40d757";
+      sha256 = "1an0cgmz7g03c4qjimhpm9fcf2iswws18lwqxi688k87qm3xb5qd";
+      excludes = [
+        "libmultipath/util.c"
+      ];
+    })
+  ];
+
   sourceRoot = ".";
 
   buildInputs = [ lvm2 libaio readline gzip ];
@@ -26,6 +38,11 @@ stdenv.mkDerivation rec {
 
       substituteInPlace libmultipath/defaults.h --replace /lib/udev/scsi_id ${systemd.lib}/lib/udev/scsi_id
       substituteInPlace libmultipath/hwtable.c --replace /lib/udev/scsi_id ${systemd.lib}/lib/udev/scsi_id
+
+      sed -i -re '
+         s,^( *#define +DEFAULT_MULTIPATHDIR\>).*,\1 "'"$out/lib/multipath"'",
+      ' libmultipath/defaults.h
+
     '';
 
   meta = {
diff --git a/pkgs/tools/filesystems/nixpart/0.4/parted.nix b/pkgs/tools/filesystems/nixpart/0.4/parted.nix
index 2a0ffe326dcb..16f3a57ea147 100644
--- a/pkgs/tools/filesystems/nixpart/0.4/parted.nix
+++ b/pkgs/tools/filesystems/nixpart/0.4/parted.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, lvm2, libuuid, gettext, readline
+{ stdenv, fetchurl, fetchpatch, lvm2, libuuid, gettext, readline
 , utillinux, check, enableStatic ? false }:
 
 stdenv.mkDerivation rec {
@@ -9,6 +9,15 @@ stdenv.mkDerivation rec {
     sha256 = "05fa4m1bky9d13hqv91jlnngzlyn7y4rnnyq6d86w0dg3vww372y";
   };
 
+  patches = [
+    # Fix build with glibc >= 2.28
+    # https://github.com/NixOS/nixpkgs/issues/86403
+    (fetchpatch {
+      url = "https://gitweb.gentoo.org/repo/gentoo.git/plain/sys-block/parted/files/parted-3.2-sysmacros.patch?id=8e2414f551c14166f259f9a25a594aec7a5b9ea0";
+      sha256 = "0fdgifjbri7n28hv74zksac05gw72p2czzvyar0jp62b9dnql3mp";
+    })
+  ];
+
   buildInputs = [ libuuid ]
     ++ stdenv.lib.optional (readline != null) readline
     ++ stdenv.lib.optional (gettext != null) gettext
diff --git a/pkgs/tools/filesystems/nixpart/0.4/pyblock-sysmacros.h.patch b/pkgs/tools/filesystems/nixpart/0.4/pyblock-sysmacros.h.patch
new file mode 100644
index 000000000000..b8ab7bd53b2b
--- /dev/null
+++ b/pkgs/tools/filesystems/nixpart/0.4/pyblock-sysmacros.h.patch
@@ -0,0 +1,12 @@
+diff --git a/dm.c b/dm.c
+index 5daa0e5..d5b84c8 100644
+--- a/dm.c
++++ b/dm.c
+@@ -19,6 +19,7 @@
+ #define _GNU_SOURCE
+ #include <sys/stat.h>
+ #include <sys/types.h>
++#include <sys/sysmacros.h>
+ #include <unistd.h>
+ #include <fcntl.h>
+ #include <stdarg.h>
diff --git a/pkgs/tools/filesystems/nixpart/0.4/pyblock.nix b/pkgs/tools/filesystems/nixpart/0.4/pyblock.nix
index 2abab9057376..f087edd853d7 100644
--- a/pkgs/tools/filesystems/nixpart/0.4/pyblock.nix
+++ b/pkgs/tools/filesystems/nixpart/0.4/pyblock.nix
@@ -11,6 +11,12 @@ stdenv.mkDerivation rec {
     sha256 = "f6cef88969300a6564498557eeea1d8da58acceae238077852ff261a2cb1d815";
   };
 
+  patches = [
+    # Fix build with glibc >= 2.28
+    # https://github.com/NixOS/nixpkgs/issues/86403
+    ./pyblock-sysmacros.h.patch
+  ];
+
   postPatch = ''
     sed -i -e 's|/usr/include/python|${python}/include/python|' \
            -e 's/-Werror *//' -e 's|/usr/|'"$out"'/|' Makefile
diff --git a/pkgs/tools/graphics/cfdg/default.nix b/pkgs/tools/graphics/cfdg/default.nix
index 8122e5a5ec2d..2cbf43407ffe 100644
--- a/pkgs/tools/graphics/cfdg/default.nix
+++ b/pkgs/tools/graphics/cfdg/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, libpng, bison, flex, ffmpeg, icu }:
+{ stdenv, fetchFromGitHub, libpng, bison, flex, ffmpeg_3, icu }:
 
 stdenv.mkDerivation rec {
   pname = "cfdg";
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
     sha256 = "13m8npccacmgxbs4il45zw53dskjh53ngv2nxahwqw8shjrws4mh";
   };
 
-  buildInputs = [ libpng bison flex ffmpeg icu ];
+  buildInputs = [ libpng bison flex ffmpeg_3 icu ];
 
   postPatch = ''
     sed -e "/YY_NO_UNISTD/a#include <stdio.h>" -i src-common/cfdg.l
diff --git a/pkgs/tools/graphics/gmic/default.nix b/pkgs/tools/graphics/gmic/default.nix
index 42b0e5afef7e..610c1306ecfd 100644
--- a/pkgs/tools/graphics/gmic/default.nix
+++ b/pkgs/tools/graphics/gmic/default.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://gmic.eu/files/source/gmic_${version}.tar.gz";
-    sha256 = "YjNpX5snmZ3MfMOqdICw8ZK9RN6FIJCRo7S4plroxLU=";
+    sha256 = "1df4x1dadf5llf8r0845vr2bv4pin2079an3gk69v697kdgnjcv2";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/graphics/luxcorerender/default.nix b/pkgs/tools/graphics/luxcorerender/default.nix
index fc8a98c19930..3afb6ebd9877 100644
--- a/pkgs/tools/graphics/luxcorerender/default.nix
+++ b/pkgs/tools/graphics/luxcorerender/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, cmake, boost165, pkgconfig, python35
+{ stdenv, fetchFromGitHub, cmake, boost165, pkgconfig, python36
 , tbb, openimageio, libjpeg, libpng, zlib, libtiff, ilmbase
 , freetype, openexr, libXdmcp, libxkbcommon, epoxy, at-spi2-core
 , dbus, doxygen, qt5, c-blosc, libGLU, gnome3, dconf, gtk3, pcre
@@ -7,28 +7,34 @@
 , withOpenCL ? true , opencl-headers, ocl-icd, opencl-clhpp
 }:
 
-let boost_static = boost165.override {
-      python = python35;
+let
+      python = python36;
+
+      boost_static = boost165.override {
+      inherit python;
       enableStatic = true;
       enablePython = true;
     };
 
+    version = "2.0";
+    sha256 = "15nn39ybsfjf3cw3xgkbarvxn4a9ymfd579ankm7yjxkw5gcif38";
+
 in stdenv.mkDerivation {
   pname = "luxcorerender";
-  version = "2.0";
+  inherit version;
 
   src = fetchFromGitHub {
     owner = "LuxCoreRender";
     repo = "LuxCore";
-    rev = "luxcorerender_v2.0";
-    sha256 = "15nn39ybsfjf3cw3xgkbarvxn4a9ymfd579ankm7yjxkw5gcif38";
+    rev = "luxcorerender_v${version}";
+    inherit sha256;
   };
 
   buildInputs =
    [ embree2 pkgconfig cmake zlib boost_static libjpeg
      libtiff libpng ilmbase freetype openexr openimageio
      tbb qt5.full c-blosc libGLU pcre bison
-     flex libX11 libpthreadstubs python35 libXdmcp libxkbcommon
+     flex libX11 libpthreadstubs python libXdmcp libxkbcommon
      epoxy at-spi2-core dbus doxygen
      # needed for GSETTINGS_SCHEMAS_PATH
      gsettings-desktop-schemas glib gtk3
@@ -43,15 +49,15 @@ in stdenv.mkDerivation {
     "-DOpenEXR_IlmThread_INCLUDE_DIR=${ilmbase.dev}/include/OpenEXR"
     "-DOpenEXR_Imath_INCLUDE_DIR=${openexr.dev}/include/OpenEXR"
     "-DOpenEXR_half_INCLUDE_DIR=${ilmbase.dev}/include"
-    "-DPYTHON_LIBRARY=${python35}/lib/libpython3.so"
-    "-DPYTHON_INCLUDE_DIR=${python35}/include/python3.5"
+    "-DPYTHON_LIBRARY=${python}/lib/libpython3.so"
+    "-DPYTHON_INCLUDE_DIR=${python}/include/python${python.pythonVersion}"
     "-DEMBREE_INCLUDE_PATH=${embree2}/include"
     "-DEMBREE_LIBRARY=${embree2}/lib/libembree.so"
     "-DBoost_PYTHON_LIBRARY_RELEASE=${boost_static}/lib/libboost_python3-mt.so"
   ] ++ stdenv.lib.optional withOpenCL
        "-DOPENCL_INCLUDE_DIR=${opencl-headers}/include";
   preConfigure = ''
-    NIX_CFLAGS_COMPILE+=" -isystem ${python35}/include/python3.5"
+    NIX_CFLAGS_COMPILE+=" -isystem ${python}/include/python${python.pythonVersion}"
     NIX_LDFLAGS+=" -lpython3"
   '';
 
diff --git a/pkgs/tools/graphics/netpbm/default.nix b/pkgs/tools/graphics/netpbm/default.nix
index b2452be7339e..bfb50c45f40b 100644
--- a/pkgs/tools/graphics/netpbm/default.nix
+++ b/pkgs/tools/graphics/netpbm/default.nix
@@ -24,7 +24,7 @@ stdenv.mkDerivation {
   src = fetchsvn {
     url = "https://svn.code.sf.net/p/netpbm/code/advanced";
     rev = "3735";
-    sha256 = "hRepEUBlf83p77Amjze+Qz7XTHhCuPdV01K/UabR89Q=";
+    sha256 = "1m7ks6k53gsjsdazgf22g16dfgj3pqvqy9mhxzlwszv5808sj5w5";
   };
 
   postPatch = ''
diff --git a/pkgs/tools/graphics/shotgun/default.nix b/pkgs/tools/graphics/shotgun/default.nix
index aa9fbf55d86c..3c96584029e7 100644
--- a/pkgs/tools/graphics/shotgun/default.nix
+++ b/pkgs/tools/graphics/shotgun/default.nix
@@ -12,7 +12,7 @@ rustPlatform.buildRustPackage rec {
     owner = "neXromancers";
     repo = pname;
     rev = "v${version}";
-    sha256 = "tJnF1X+NI1hP0J/n3rGy8TD/yIveqRPVlJvJvn0C7Do=";
+    sha256 = "0fpc09yvxjcvjkai7afyig4gyc7inaqxxrwzs17mh8wdgzawb6dl";
   };
 
   cargoSha256 = "0sbhij8qh9n05nzhp47dm46hbc59awar515f9nhd3wvahwz53zam";
diff --git a/pkgs/tools/graphics/wkhtmltopdf/default.nix b/pkgs/tools/graphics/wkhtmltopdf/default.nix
index ee083c3e301b..093ab9ad5c43 100644
--- a/pkgs/tools/graphics/wkhtmltopdf/default.nix
+++ b/pkgs/tools/graphics/wkhtmltopdf/default.nix
@@ -3,14 +3,14 @@
 , openssl, libX11, libXext, libXrender }:
 
 mkDerivation rec {
-  version = "0.12.5";
+  version = "0.12.6";
   pname = "wkhtmltopdf";
 
   src = fetchFromGitHub {
     owner  = "wkhtmltopdf";
     repo   = "wkhtmltopdf";
     rev    = version;
-    sha256 = "0i6b6z3f4szspbbi23qr3hv22j9bhmcj7c1jizr7y0ra43mrgws1";
+    sha256 = "0m2zy986kzcpg0g3bvvm815ap9n5ann5f6bdy7pfj6jv482bm5mg";
   };
 
   buildInputs = [
diff --git a/pkgs/tools/graphics/yafaray-core/default.nix b/pkgs/tools/graphics/yafaray-core/default.nix
index 8e15cd0d3280..a02a97739bad 100644
--- a/pkgs/tools/graphics/yafaray-core/default.nix
+++ b/pkgs/tools/graphics/yafaray-core/default.nix
@@ -1,7 +1,7 @@
 { stdenv, fetchFromGitHub, cmake, pkgconfig, opencv, zlib
 , libxml2, freetype, libjpeg, libtiff, swig, openexr
 , ilmbase, boost165
-, withPython ? true, python35
+, withPython ? true, python3
 }:
 
 stdenv.mkDerivation rec {
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
     buildInputs = [
       cmake pkgconfig boost165 opencv zlib libxml2 freetype libjpeg libtiff
       swig openexr ilmbase
-    ] ++ stdenv.lib.optional withPython python35;
+    ] ++ stdenv.lib.optional withPython python3;
 
     meta = with stdenv.lib; {
       description = "A free, open source raytracer";
diff --git a/pkgs/tools/graphics/yaxg/default.nix b/pkgs/tools/graphics/yaxg/default.nix
index 094ec2d5bc49..467210b27b35 100644
--- a/pkgs/tools/graphics/yaxg/default.nix
+++ b/pkgs/tools/graphics/yaxg/default.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchFromGitHub, makeWrapper,
-  maim, slop, ffmpeg, byzanz, libnotify, xdpyinfo }:
+  maim, slop, ffmpeg_3, byzanz, libnotify, xdpyinfo }:
 
 stdenv.mkDerivation rec {
   pname = "yaxg";
@@ -13,13 +13,13 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ makeWrapper ];
-  buildInputs = [ maim slop ffmpeg byzanz libnotify xdpyinfo ];
+  buildInputs = [ maim slop ffmpeg_3 byzanz libnotify xdpyinfo ];
 
   installPhase = ''
     mkdir -p $out/bin/
     mv yaxg $out/bin/
     chmod +x $out/bin/yaxg
-    wrapProgram $out/bin/yaxg --prefix PATH : ${ stdenv.lib.makeBinPath [ maim slop ffmpeg byzanz libnotify xdpyinfo ]}
+    wrapProgram $out/bin/yaxg --prefix PATH : ${ stdenv.lib.makeBinPath [ maim slop ffmpeg_3 byzanz libnotify xdpyinfo ]}
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/graphics/zbar/default.nix b/pkgs/tools/graphics/zbar/default.nix
index 229d3f3cdbdb..8e5d687d2adc 100644
--- a/pkgs/tools/graphics/zbar/default.nix
+++ b/pkgs/tools/graphics/zbar/default.nix
@@ -16,6 +16,7 @@
 , dbus
 , enableVideo ? stdenv.isLinux
 , enableDbus ? stdenv.isLinux
+, libintl
 }:
 
 stdenv.mkDerivation rec {
@@ -43,6 +44,7 @@ stdenv.mkDerivation rec {
   buildInputs = [
     imagemagickBig
     libX11
+    libintl
   ] ++ lib.optionals enableDbus [
     dbus
   ] ++ lib.optionals enableVideo [
diff --git a/pkgs/tools/inputmethods/interception-tools/default.nix b/pkgs/tools/inputmethods/interception-tools/default.nix
index a6aed47d964c..39a28214fe20 100644
--- a/pkgs/tools/inputmethods/interception-tools/default.nix
+++ b/pkgs/tools/inputmethods/interception-tools/default.nix
@@ -2,14 +2,14 @@
   libevdev, udev }:
 
 let
-  version = "0.1.1";
+  version = "0.2.1";
   baseName = "interception-tools";
 in stdenv.mkDerivation {
   name = "${baseName}-${version}";
 
   src = fetchurl {
     url = "https://gitlab.com/interception/linux/tools/repository/v${version}/archive.tar.gz";
-    sha256 = "14g4pphvylqdb922va322z1pbp12ap753hcf7zf9sii1ikvif83j";
+    sha256 = "0lqz89wsf9r5xdgflincysxg4l8fpgg5z8zczhhrg9s5787srfzi";
   };
 
   nativeBuildInputs = [ cmake pkgconfig ];
diff --git a/pkgs/tools/misc/bat/default.nix b/pkgs/tools/misc/bat/default.nix
index e961a5b06950..9902142df352 100644
--- a/pkgs/tools/misc/bat/default.nix
+++ b/pkgs/tools/misc/bat/default.nix
@@ -10,8 +10,7 @@ rustPlatform.buildRustPackage rec {
     owner  = "sharkdp";
     repo   = pname;
     rev    = "v${version}";
-    sha256 = "1pjdvhldmjpy8ymb7r91y18hj5dx1iygszsfwkd66v9rncjigd07";
-    fetchSubmodules = true;
+    sha256 = "0pjdba2c6p7ldgx2yfffxqlpasrcfrlkw63m1ma34zdq0f287w3p";
   };
 
   cargoSha256 = "0myz06hjv4hwzmyqa9l36i9j9d213a0mnq8rvx6wyff7mr9zk99i";
@@ -36,7 +35,7 @@ rustPlatform.buildRustPackage rec {
     description = "A cat(1) clone with syntax highlighting and Git integration";
     homepage    = "https://github.com/sharkdp/bat";
     license     = with licenses; [ asl20 /* or */ mit ];
-    maintainers = with maintainers; [ dywedir lilyball ];
+    maintainers = with maintainers; [ dywedir lilyball zowoq ];
     platforms   = platforms.all;
   };
 }
diff --git a/pkgs/tools/misc/bdf2sfd/default.nix b/pkgs/tools/misc/bdf2sfd/default.nix
index 15154f73a699..ca67525bb8c4 100644
--- a/pkgs/tools/misc/bdf2sfd/default.nix
+++ b/pkgs/tools/misc/bdf2sfd/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "bdf2sfd";
-  version = "1.1.1";
+  version = "1.1.2";
 
   src = fetchFromGitHub {
     owner = "fcambus";
     repo = pname;
     rev = version;
-    sha256 = "02dzvrgwpgbd0wgfnlpiv2qlwvspwl7a0qh8cg363lpnxv8akw9q";
+    sha256 = "1fhdl739a4v8296wpn2390fhlb6vlg9m1zik7mql4l9008ncd5mv";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/tools/misc/broot/default.nix b/pkgs/tools/misc/broot/default.nix
index bf5d569bab48..554d7f9e1dd3 100644
--- a/pkgs/tools/misc/broot/default.nix
+++ b/pkgs/tools/misc/broot/default.nix
@@ -2,23 +2,23 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "broot";
-  version = "0.13.6";
+  version = "0.15.1";
 
   src = fetchFromGitHub {
     owner = "Canop";
     repo = pname;
     rev = "v${version}";
-    sha256 = "08d0zddqqymxj1qcp8c78r7mpii1piy6awaf135jxhzwi775sqqv";
+    sha256 = "1ggzx4w69fmvaxm5gfqhh8ncr2mdx528zm6vwrrwz165lga2fvw6";
   };
 
-  cargoSha256 = "1cxvx51zkmhszmgwsi0aj469xz98v5nk79zvqfyma27gsnh8jczr";
+  cargoSha256 = "0gcq0fww9hl3avh3qcnpnwmpwda4cymr7x3kd3frdizrs8i643mr";
 
   nativeBuildInputs = [ installShellFiles ];
 
   buildInputs = stdenv.lib.optionals stdenv.isDarwin [ libiconv Security ];
 
   postPatch = ''
-    substituteInPlace src/verb_store.rs --replace '"/bin/' '"${coreutils}/bin/'
+    substituteInPlace src/verb/builtin.rs --replace '"/bin/' '"${coreutils}/bin/'
   '';
 
   postInstall = ''
diff --git a/pkgs/tools/misc/brotab/default.nix b/pkgs/tools/misc/brotab/default.nix
index 854958dc8a3b..c7a5642050ac 100644
--- a/pkgs/tools/misc/brotab/default.nix
+++ b/pkgs/tools/misc/brotab/default.nix
@@ -1,14 +1,14 @@
 { lib, fetchFromGitHub, glibcLocales, python }:
 
 python.pkgs.buildPythonApplication rec {
-  version = "1.2.2";
+  version = "1.3.0";
   pname = "brotab";
 
   src = fetchFromGitHub {
     owner = "balta2ar";
     repo = pname;
     rev = version;
-    sha256 = "1c6npyws705qf9rv70mmh7d0almmpxz87a0n65lhw08lms1h3dl2";
+    sha256 = "1ja9qaf3rxm0chgzs5mpw973h7ibb454k9mbfbb2gl12gr9zllyw";
   };
 
   propagatedBuildInputs = with python.pkgs; [
diff --git a/pkgs/tools/misc/capture/default.nix b/pkgs/tools/misc/capture/default.nix
index e7134961c252..e92898ccc4d6 100644
--- a/pkgs/tools/misc/capture/default.nix
+++ b/pkgs/tools/misc/capture/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, slop, ffmpeg, fetchFromGitHub, makeWrapper}:
+{ stdenv, slop, ffmpeg_3, fetchFromGitHub, makeWrapper}:
 
 stdenv.mkDerivation {
   pname = "capture-unstable";
@@ -18,7 +18,7 @@ stdenv.mkDerivation {
 
     patchShebangs $out/bin/capture
     wrapProgram $out/bin/capture \
-      --prefix PATH : '${stdenv.lib.makeBinPath [ slop ffmpeg ]}'
+      --prefix PATH : '${stdenv.lib.makeBinPath [ slop ffmpeg_3 ]}'
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/misc/chafa/default.nix b/pkgs/tools/misc/chafa/default.nix
index 9e1671aec9de..9afdd93ad0a5 100644
--- a/pkgs/tools/misc/chafa/default.nix
+++ b/pkgs/tools/misc/chafa/default.nix
@@ -1,7 +1,7 @@
 { stdenv, fetchFromGitHub, autoconf, automake, libtool, pkgconfig, which, libxslt, libxml2, docbook_xml_dtd_412, docbook_xsl, glib, imagemagick, darwin }:
 
 
-stdenv.mkDerivation rec{
+stdenv.mkDerivation rec {
   version = "1.4.1";
   pname = "chafa";
 
diff --git a/pkgs/tools/misc/chezmoi/default.nix b/pkgs/tools/misc/chezmoi/default.nix
index 75b10bc32ca7..eb372b6b5671 100644
--- a/pkgs/tools/misc/chezmoi/default.nix
+++ b/pkgs/tools/misc/chezmoi/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "chezmoi";
-  version = "1.8.1";
+  version = "1.8.2";
 
   src = fetchFromGitHub {
     owner = "twpayne";
     repo = "chezmoi";
     rev = "v${version}";
-    sha256 = "1b8y0wq3myhvjdnwl0i4x85iil7i7kmsjajvbw1a47afm83jkbaw";
+    sha256 = "0s2a0q3lgrdz7w69sacn23k4dybw6wrk63xxnylj88wss7mqnpj8";
   };
 
-  vendorSha256 = "1za47n08iamhfl4ky928rixgadflmz86vnmnwbczd167bdndh5rq";
+  vendorSha256 = "0hpjvpai2i9jn8hlxhx4pvvawjh6lfmlz7ffi320pp7vanzqhch1";
 
   buildFlagsArray = [
     "-ldflags=-s -w -X main.version=${version} -X main.builtBy=nixpkgs"
diff --git a/pkgs/tools/misc/clex/default.nix b/pkgs/tools/misc/clex/default.nix
index 5e5bf4166ff9..7a6a78af59a9 100644
--- a/pkgs/tools/misc/clex/default.nix
+++ b/pkgs/tools/misc/clex/default.nix
@@ -24,6 +24,6 @@ stdenv.mkDerivation rec {
     '';
     homepage = "http://www.clex.sk";
     license = licenses.gpl2Plus;
-    platforms = platforms.linux;
+    platforms = with platforms; linux ++ darwin;
   };
 }
diff --git a/pkgs/tools/misc/cowsay/default.nix b/pkgs/tools/misc/cowsay/default.nix
index d2a27fa9cb0b..972b2997d810 100644
--- a/pkgs/tools/misc/cowsay/default.nix
+++ b/pkgs/tools/misc/cowsay/default.nix
@@ -1,6 +1,6 @@
 { stdenv, fetchurl, perl }:
 
-stdenv.mkDerivation rec{
+stdenv.mkDerivation rec {
   version = "3.03+dfsg2";
   pname = "cowsay";
 
diff --git a/pkgs/tools/misc/diffoscope/default.nix b/pkgs/tools/misc/diffoscope/default.nix
index a9b014be3561..5e5550e0b41d 100644
--- a/pkgs/tools/misc/diffoscope/default.nix
+++ b/pkgs/tools/misc/diffoscope/default.nix
@@ -1,25 +1,39 @@
-{ lib, stdenv, fetchurl, python3Packages, docutils, help2man
-, acl, apktool, binutils-unwrapped, bzip2, cbfstool, cdrkit, colord, colordiff, coreutils, cpio, db, diffutils, dtc
-, e2fsprogs, file, findutils, fontforge-fonttools, fpc, gettext, ghc, ghostscriptX, giflib, gnumeric, gnupg, gnutar
-, gzip, imagemagick, jdk, libarchive, libcaca, llvm, lz4, mono, openssh, pdftk, pgpdump, poppler_utils, sng, sqlite
-, squashfsTools, tcpdump, unoconv, unzip, xxd, xz
+{ lib, stdenv, fetchurl, fetchpatch, runCommand, makeWrapper, python3Packages, docutils, help2man
+, abootimg, acl, apktool, binutils-unwrapped, build-tools, bzip2, cbfstool, cdrkit, colord, colordiff, coreutils, cpio, db, diffutils, dtc
+, e2fsprogs, file, findutils, fontforge-fonttools, ffmpeg, fpc, gettext, ghc, ghostscriptX, giflib, gnumeric, gnupg, gnutar
+, gzip, hdf5, imagemagick, jdk, libarchive, libcaca, llvm, lz4, mono, openssh, openssl, pdftk, pgpdump, poppler_utils, qemu, R
+, sng, sqlite, squashfsTools, tcpdump, odt2txt, unzip, wabt, xxd, xz, zip, zstd
 , enableBloat ? false
 }:
 
 # Note: when upgrading this package, please run the list-missing-tools.sh script as described below!
+let
+  apksigner = runCommand "apksigner" { nativeBuildInputs = [ makeWrapper ]; } ''
+    mkdir -p $out/bin
+    makeWrapper "${jdk}/bin/java" "$out/bin/apksigner" \
+      --add-flags "-jar ${builtins.head build-tools}/libexec/android-sdk/build-tools/28.0.3/lib/apksigner.jar"
+  '';
+in
 python3Packages.buildPythonApplication rec {
   pname = "diffoscope";
-  version = "144";
+  version = "147";
 
   src = fetchurl {
     url    = "https://diffoscope.org/archive/diffoscope-${version}.tar.bz2";
-    sha256 = "1n916k6z35c8ffksjjglkbl52jjhjv3899w230sg7k4ayzylj6zi";
+    sha256 = "1pichn3l10401cqk08zrys2ya9b6cjznk7ra28awnmvlg6l1cypj";
   };
 
   outputs = [ "out" "man" ];
 
   patches = [
     ./ignore_links.patch
+    ./skip-failing-test.patch
+
+    # Fix for CBFS comparator
+    (fetchpatch {
+      url = "https://salsa.debian.org/reproducible-builds/diffoscope/-/commit/39ec527371c469d61e4afc04b3ee6ae3563f7b4c.patch";
+      sha256 = "1mzdcbxg3ad5ynpf79phvif5hzckmhf7vzd82l1sffhlqxh0v4h3";
+    })
   ];
 
   postPatch = ''
@@ -35,23 +49,24 @@ python3Packages.buildPythonApplication rec {
   # Most of the non-Python dependencies here are optional command-line tools for various file-format parsers.
   # To help figuring out what's missing from the list, run: ./pkgs/tools/misc/diffoscope/list-missing-tools.sh
   #
-  # Still missing these tools: abootimg docx2txt dumpxsb enjarify js-beautify lipo oggDump otool procyon-decompiler Rscript wasm2wat zipnode
-  # Also these libraries: python3-guestfs
+  # Still missing these tools: docx2txt dumppdf dumpxsb enjarify lipo ocamlobjinfo oggDump otool procyon
   pythonPath = [
       binutils-unwrapped bzip2 colordiff coreutils cpio db diffutils
       dtc e2fsprogs file findutils fontforge-fonttools gettext gnutar gzip
-      libarchive libcaca lz4 pgpdump sng sqlite squashfsTools unzip xxd xz
+      libarchive libcaca lz4 openssl pgpdump sng sqlite squashfsTools unzip xxd
+      xz zip zstd
     ]
-    ++ (with python3Packages; [ debian libarchive-c python_magic tlsh rpm progressbar33 ])
+    ++ (with python3Packages; [
+      argcomplete debian defusedxml jsondiff jsbeautifier libarchive-c
+      python_magic progressbar33 pypdf2 rpm tlsh
+    ])
     ++ lib.optionals stdenv.isLinux [ python3Packages.pyxattr acl cdrkit ]
-    ++ lib.optionals enableBloat [
-      apktool cbfstool colord fpc ghc ghostscriptX giflib gnupg gnumeric imagemagick
-      llvm jdk mono openssh pdftk poppler_utils tcpdump unoconv
-      python3Packages.guestfs
-    ];
+    ++ lib.optionals enableBloat ([
+      abootimg apksigner apktool cbfstool colord ffmpeg fpc ghc ghostscriptX giflib gnupg gnumeric
+      hdf5 imagemagick llvm jdk mono odt2txt openssh pdftk poppler_utils qemu R tcpdump wabt
+    ] ++ (with python3Packages; [ binwalk guestfs h5py ]));
 
-  doCheck = false; # Calls 'mknod' in squashfs tests, which needs root
-  checkInputs = with python3Packages; [ pytest ];
+  checkInputs = with python3Packages; [ pytest ] ++ pythonPath;
 
   postInstall = ''
     make -C doc
@@ -73,7 +88,7 @@ python3Packages.buildPythonApplication rec {
     '';
     homepage    = "https://diffoscope.org/";
     license     = licenses.gpl3Plus;
-    maintainers = with maintainers; [ dezgeg ma27 ];
+    maintainers = with maintainers; [ dezgeg ma27 danielfullmer ];
     platforms   = platforms.unix;
   };
 }
diff --git a/pkgs/tools/misc/diffoscope/ignore_links.patch b/pkgs/tools/misc/diffoscope/ignore_links.patch
index b0841ce0bb57..b88d6e0231ea 100644
--- a/pkgs/tools/misc/diffoscope/ignore_links.patch
+++ b/pkgs/tools/misc/diffoscope/ignore_links.patch
@@ -1,32 +1,20 @@
-From a33e8018092e4a91dbc45e15bbeff760b3418512 Mon Sep 17 00:00:00 2001
-From: Tuomas Tynkkynen <tuomas.tynkkynen@iki.fi>
-Date: Wed, 13 Sep 2017 16:53:38 +0300
-Subject: [PATCH] Ignore hard link counts
-
----
- diffoscope/comparators/directory.py | 2 ++
- 1 file changed, 2 insertions(+)
-
 diff --git a/diffoscope/comparators/directory.py b/diffoscope/comparators/directory.py
-index 3b195bc..9071bb3 100644
+index 5f34d62..36999a3 100644
 --- a/diffoscope/comparators/directory.py
 +++ b/diffoscope/comparators/directory.py
-@@ -66,6 +66,7 @@ else:
-         FILE_RE = re.compile(r'^\s*File:.*$')
-         DEVICE_RE = re.compile(r'Device: [0-9a-f]+h/[0-9]+d\s+')
-         INODE_RE = re.compile(r'Inode: [0-9]+\s+')
+@@ -77,6 +77,7 @@ else:
+         FILE_RE = re.compile(r"^\s*File:.*$")
+         DEVICE_RE = re.compile(r"Device: [0-9a-f]+h/[0-9]+d\s+")
+         INODE_RE = re.compile(r"Inode: [0-9]+\s+")
 +        LINKS_RE = re.compile(r'Links: [0-9]+\s+')
-         ACCESS_TIME_RE = re.compile(r'^Access: [0-9]{4}-[0-9]{2}-[0-9]{2}.*$')
-         CHANGE_TIME_RE = re.compile(r'^Change: [0-9]{4}-[0-9]{2}-[0-9]{2}.*$')
- 
-@@ -74,6 +75,7 @@ else:
-             line = Stat.FILE_RE.sub('', line)
-             line = Stat.DEVICE_RE.sub('', line)
-             line = Stat.INODE_RE.sub('', line)
-+            line = Stat.LINKS_RE.sub('', line)
-             line = Stat.ACCESS_TIME_RE.sub('', line)
-             line = Stat.CHANGE_TIME_RE.sub('', line)
-             return line.encode('utf-8')
--- 
-2.13.0
-
+         ACCESS_TIME_RE = re.compile(r"^Access: [0-9]{4}-[0-9]{2}-[0-9]{2}.*$")
+         CHANGE_TIME_RE = re.compile(r"^Change: [0-9]{4}-[0-9]{2}-[0-9]{2}.*$")
+         BIRTH_TIME_RE = re.compile(r"^\s*Birth:.*$")
+@@ -86,6 +87,7 @@ else:
+             line = Stat.FILE_RE.sub("", line)
+             line = Stat.DEVICE_RE.sub("", line)
+             line = Stat.INODE_RE.sub("", line)
++            line = Stat.LINKS_RE.sub("", line)
+             line = Stat.ACCESS_TIME_RE.sub("", line)
+             line = Stat.CHANGE_TIME_RE.sub("", line)
+             line = Stat.BIRTH_TIME_RE.sub("", line)
diff --git a/pkgs/tools/misc/diffoscope/skip-failing-test.patch b/pkgs/tools/misc/diffoscope/skip-failing-test.patch
new file mode 100644
index 000000000000..bf871d295bda
--- /dev/null
+++ b/pkgs/tools/misc/diffoscope/skip-failing-test.patch
@@ -0,0 +1,12 @@
+diff --git a/tests/test_tools.py b/tests/test_tools.py
+index f0010678..1c3c7ce1 100644
+--- a/tests/test_tools.py
++++ b/tests/test_tools.py
+@@ -21,6 +21,7 @@ import os
+ import pytest
+ 
+ 
++@pytest.mark.skip()
+ def test_sbin_added_to_path():
+     from diffoscope.tools import tool_required
+ 
diff --git a/pkgs/tools/misc/direnv/default.nix b/pkgs/tools/misc/direnv/default.nix
index 1b6b87984c6f..47668986a460 100644
--- a/pkgs/tools/misc/direnv/default.nix
+++ b/pkgs/tools/misc/direnv/default.nix
@@ -14,9 +14,14 @@ buildGoModule rec {
   };
 
   # we have no bash at the moment for windows
-  makeFlags = stdenv.lib.optional (!stdenv.hostPlatform.isWindows) [
-    "BASH_PATH=${bash}/bin/bash"
-  ];
+  BASH_PATH =
+    stdenv.lib.optionalString (!stdenv.hostPlatform.isWindows)
+    "${bash}/bin/bash";
+
+  # replace the build phase to use the GNUMakefile instead
+  buildPhase = ''
+    make BASH_PATH=$BASH_PATH
+  '';
 
   installPhase = ''
     make install DESTDIR=$out
diff --git a/pkgs/tools/misc/dua/default.nix b/pkgs/tools/misc/dua/default.nix
index cb000b294723..a79059dff071 100644
--- a/pkgs/tools/misc/dua/default.nix
+++ b/pkgs/tools/misc/dua/default.nix
@@ -2,13 +2,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "dua";
-  version = "2.6.0";
+  version = "2.6.1";
 
   src = fetchFromGitHub {
     owner = "Byron";
     repo = "dua-cli";
     rev = "v${version}";
-    sha256 = "1697z9j0xd4il01bcvz1xwzkcg5mbkpp207mshb9csdhwi9a50wg";
+    sha256 = "0wq6cqznbpkiy9vz3slpcnxlsxff6gx5x7fsbd67q6jv5zhkn881";
     # Remove unicode file names which leads to different checksums on HFS+
     # vs. other filesystems because of unicode normalisation.
     extraPostFetch = ''
@@ -16,7 +16,7 @@ rustPlatform.buildRustPackage rec {
     '';
   };
 
-  cargoSha256 = "1rczq41jpds7kfyf31nxj4v8rk9rccijjixpznhlriam6xhgm90b";
+  cargoSha256 = "096c6i1hqyygaifnm2kg53x22a8hhfxfz22qlssh1rw79bj82q0x";
 
   doCheck = false;
 
diff --git a/pkgs/tools/misc/exa/default.nix b/pkgs/tools/misc/exa/default.nix
index fd6baadb685c..13c8b3f1d4f5 100644
--- a/pkgs/tools/misc/exa/default.nix
+++ b/pkgs/tools/misc/exa/default.nix
@@ -57,6 +57,6 @@ buildRustPackage rec {
     '';
     homepage = "https://the.exa.website";
     license = licenses.mit;
-    maintainers = with maintainers; [ ehegnes lilyball globin ];
+    maintainers = with maintainers; [ ehegnes lilyball globin zowoq ];
   };
 }
diff --git a/pkgs/tools/misc/execline/default.nix b/pkgs/tools/misc/execline/default.nix
index d3a6990a1f83..ecedd2b0b417 100644
--- a/pkgs/tools/misc/execline/default.nix
+++ b/pkgs/tools/misc/execline/default.nix
@@ -7,8 +7,8 @@ with skawarePackages;
 
 buildPackage {
   pname = "execline";
-  version = "2.6.0.0";
-  sha256 = "1m6pvawxqaqjr49456vyjyl8dnqwvr19v77sjj7dnglfijwza5al";
+  version = "2.6.1.0";
+  sha256 = "0mj565xml3hvw27finydms0s9abbbpgbr29vnr8gwi7zjzq7ck52";
 
   description = "A small scripting language, to be used in place of a shell in non-interactive scripts";
 
diff --git a/pkgs/tools/misc/fd/default.nix b/pkgs/tools/misc/fd/default.nix
index 4fd4c5428d98..1f56eda0a422 100644
--- a/pkgs/tools/misc/fd/default.nix
+++ b/pkgs/tools/misc/fd/default.nix
@@ -32,7 +32,7 @@ rustPlatform.buildRustPackage rec {
     '';
     homepage = "https://github.com/sharkdp/fd";
     license = with licenses; [ asl20 /* or */ mit ];
-    maintainers = with maintainers; [ dywedir globin ma27 ];
+    maintainers = with maintainers; [ dywedir globin ma27 zowoq ];
     platforms = platforms.all;
   };
 }
diff --git a/pkgs/tools/misc/fluent-bit/default.nix b/pkgs/tools/misc/fluent-bit/default.nix
index 439979068f5a..d882c6efb5e8 100644
--- a/pkgs/tools/misc/fluent-bit/default.nix
+++ b/pkgs/tools/misc/fluent-bit/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "fluent-bit";
-  version = "1.4.5";
+  version = "1.4.6";
 
   src = fetchFromGitHub {
     owner = "fluent";
     repo = "fluent-bit";
     rev = "v${version}";
-    sha256 = "0kxbq174a5fdcdh1hvnrlk79cg7lyily7iskfxhyz9l26qana9jp";
+    sha256 = "0qxyjmgl85q7xk629l548bpzizma5n4j1r6nqbwh9j15ajvq7mq8";
   };
 
   nativeBuildInputs = [ cmake flex bison ];
diff --git a/pkgs/tools/misc/fluentd/Gemfile b/pkgs/tools/misc/fluentd/Gemfile
index 952c419ad313..8cbed0ebac40 100644
--- a/pkgs/tools/misc/fluentd/Gemfile
+++ b/pkgs/tools/misc/fluentd/Gemfile
@@ -10,3 +10,4 @@ gem 'fluent-plugin-scribe'
 gem 'fluent-plugin-mongo'
 gem 'fluent-plugin-webhdfs'
 gem 'fluent-plugin-rewrite-tag-filter'
+gem 'fluent-plugin-cloudwatch-logs'
diff --git a/pkgs/tools/misc/fluentd/Gemfile.lock b/pkgs/tools/misc/fluentd/Gemfile.lock
index c3e3cb24e83a..1b1f6cec622e 100644
--- a/pkgs/tools/misc/fluentd/Gemfile.lock
+++ b/pkgs/tools/misc/fluentd/Gemfile.lock
@@ -1,11 +1,14 @@
 GEM
   remote: https://rubygems.org/
   specs:
-    addressable (2.6.0)
-      public_suffix (>= 2.0.2, < 4.0)
+    addressable (2.7.0)
+      public_suffix (>= 2.0.2, < 5.0)
     aws-eventstream (1.0.3)
-    aws-partitions (1.193.0)
-    aws-sdk-core (3.61.1)
+    aws-partitions (1.207.0)
+    aws-sdk-cloudwatchlogs (1.25.0)
+      aws-sdk-core (~> 3, >= 3.61.1)
+      aws-sigv4 (~> 1.1)
+    aws-sdk-core (3.65.1)
       aws-eventstream (~> 1.0, >= 1.0.2)
       aws-partitions (~> 1.0)
       aws-sigv4 (~> 1.1)
@@ -19,37 +22,41 @@ GEM
     aws-sdk-kms (1.24.0)
       aws-sdk-core (~> 3, >= 3.61.1)
       aws-sigv4 (~> 1.1)
-    aws-sdk-s3 (1.46.0)
+    aws-sdk-s3 (1.48.0)
       aws-sdk-core (~> 3, >= 3.61.1)
       aws-sdk-kms (~> 1)
       aws-sigv4 (~> 1.1)
-    aws-sdk-sqs (1.20.0)
+    aws-sdk-sqs (1.22.0)
       aws-sdk-core (~> 3, >= 3.61.1)
       aws-sigv4 (~> 1.1)
     aws-sigv4 (1.1.0)
       aws-eventstream (~> 1.0, >= 1.0.2)
     bson (4.5.0)
+    concurrent-ruby (1.1.5)
     cool.io (1.5.4)
     dig_rb (1.0.1)
     digest-crc (0.4.1)
-    elasticsearch (7.2.1)
-      elasticsearch-api (= 7.2.1)
-      elasticsearch-transport (= 7.2.1)
-    elasticsearch-api (7.2.1)
+    elasticsearch (7.3.0)
+      elasticsearch-api (= 7.3.0)
+      elasticsearch-transport (= 7.3.0)
+    elasticsearch-api (7.3.0)
       multi_json
-    elasticsearch-transport (7.2.1)
+    elasticsearch-transport (7.3.0)
       faraday
       multi_json
-    excon (0.65.0)
+    excon (0.66.0)
     faraday (0.15.4)
       multipart-post (>= 1.2, < 3)
     fluent-config-regexp-type (1.0.0)
       fluentd (> 1.0.0, < 2)
-    fluent-plugin-elasticsearch (3.5.3)
+    fluent-plugin-cloudwatch-logs (0.7.4)
+      aws-sdk-cloudwatchlogs (~> 1.0)
+      fluentd (>= 0.14.15)
+    fluent-plugin-elasticsearch (3.5.5)
       elasticsearch
       excon
       fluentd (>= 0.14.22)
-    fluent-plugin-kafka (0.11.0)
+    fluent-plugin-kafka (0.11.1)
       fluentd (>= 0.10.58, < 2)
       ltsv
       ruby-kafka (>= 0.7.8, < 0.8.0)
@@ -76,7 +83,7 @@ GEM
     fluent-plugin-webhdfs (1.2.4)
       fluentd (>= 0.14.22)
       webhdfs (>= 0.6.0)
-    fluentd (1.6.2)
+    fluentd (1.7.0)
       cool.io (>= 1.4.5, < 2.0.0)
       dig_rb (~> 1.0.0)
       http_parser.rb (>= 0.5.1, < 0.7.0)
@@ -84,29 +91,28 @@ GEM
       serverengine (>= 2.0.4, < 3.0.0)
       sigdump (~> 0.2.2)
       strptime (>= 0.2.2, < 1.0.0)
-      tzinfo (~> 1.0)
+      tzinfo (~> 2.0)
       tzinfo-data (~> 1.0)
       yajl-ruby (~> 1.0)
-    google-protobuf (3.9.0)
+    google-protobuf (3.9.1)
     http_parser.rb (0.6.0)
     jmespath (1.4.0)
     ltsv (0.1.2)
     mongo (2.6.4)
       bson (>= 4.3.0, < 5.0.0)
-    msgpack (1.3.0)
+    msgpack (1.3.1)
     multi_json (1.13.1)
     multipart-post (2.1.1)
-    public_suffix (3.1.1)
-    ruby-kafka (0.7.9)
+    public_suffix (4.0.1)
+    ruby-kafka (0.7.10)
       digest-crc
     serverengine (2.1.1)
       sigdump (~> 0.2.2)
     sigdump (0.2.4)
     strptime (0.2.3)
-    thread_safe (0.3.6)
     thrift (0.8.0)
-    tzinfo (1.2.5)
-      thread_safe (~> 0.1)
+    tzinfo (2.0.0)
+      concurrent-ruby (~> 1.0)
     tzinfo-data (1.2019.2)
       tzinfo (>= 1.0.0)
     webhdfs (0.8.0)
@@ -117,6 +123,7 @@ PLATFORMS
   ruby
 
 DEPENDENCIES
+  fluent-plugin-cloudwatch-logs
   fluent-plugin-elasticsearch
   fluent-plugin-kafka
   fluent-plugin-kinesis
diff --git a/pkgs/tools/misc/fluentd/gemset.nix b/pkgs/tools/misc/fluentd/gemset.nix
index 9c8343eb44ad..a4b488597c78 100644
--- a/pkgs/tools/misc/fluentd/gemset.nix
+++ b/pkgs/tools/misc/fluentd/gemset.nix
@@ -5,10 +5,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0bcm2hchn897xjhqj9zzsxf3n9xhddymj4lsclz508f4vw3av46l";
+      sha256 = "1fvchp2rhp2rmigx7qglf69xvjqvzq7x0g49naliw29r2bz656sy";
       type = "gem";
     };
-    version = "2.6.0";
+    version = "2.7.0";
   };
   aws-eventstream = {
     groups = ["default"];
@@ -25,10 +25,21 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "12fbibkq9gp8b9az3s87zi6dcalx92aam98jmbzacw9cvafzm7af";
+      sha256 = "1dr16ryn9514qfdf9zrv06f7gb7gih960b82arkv868nfj4470jx";
       type = "gem";
     };
-    version = "1.193.0";
+    version = "1.207.0";
+  };
+  aws-sdk-cloudwatchlogs = {
+    dependencies = ["aws-sdk-core" "aws-sigv4"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "10vracvnmihazs34nlmar813qdigk34afij66182hjcciby0as6x";
+      type = "gem";
+    };
+    version = "1.25.0";
   };
   aws-sdk-core = {
     dependencies = ["aws-eventstream" "aws-partitions" "aws-sigv4" "jmespath"];
@@ -36,10 +47,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1wir5q6qpj3lxxmzynmybsfabzgbfkk1cjyy7dkfsy5fmxcgm6qq";
+      sha256 = "0vb49n1ydz1m2l0qhc7gp0rvc7fa7qxczf582kyv7nsfn2k2z9s4";
       type = "gem";
     };
-    version = "3.61.1";
+    version = "3.65.1";
   };
   aws-sdk-firehose = {
     dependencies = ["aws-sdk-core" "aws-sigv4"];
@@ -80,10 +91,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1871mqf6b92rcmcgc6061xx9h35dlfvj7r27q2khidb5dzp7yd33";
+      sha256 = "14iv2wqvvbiz0gdms21i9n6rh8390r1yg4zcf8pzzfplbqfwqw4w";
       type = "gem";
     };
-    version = "1.46.0";
+    version = "1.48.0";
   };
   aws-sdk-sqs = {
     dependencies = ["aws-sdk-core" "aws-sigv4"];
@@ -91,10 +102,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0946yrabarr5hvzxkfh6f8mvm19ivpybhd64xnsk3hlk71xc9bip";
+      sha256 = "0pszp0bcgiqn4iskb6xv5j2n540h1k9glz2w85vq5iml1casq769";
       type = "gem";
     };
-    version = "1.20.0";
+    version = "1.22.0";
   };
   aws-sigv4 = {
     dependencies = ["aws-eventstream"];
@@ -117,6 +128,16 @@
     };
     version = "4.5.0";
   };
+  concurrent-ruby = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1x07r23s7836cpp5z9yrlbpljcxpax14yw4fy4bnp6crhr6x24an";
+      type = "gem";
+    };
+    version = "1.1.5";
+  };
   "cool.io" = {
     groups = ["default"];
     platforms = [];
@@ -153,10 +174,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1800algjigydip0855xcfdlyl1cfbl630sl68a0y39xvpvd2fq68";
+      sha256 = "0r4gpskjgg8blk7ws9g1p3d5n8bjrggyzxg2v3q40036rjp3fp1h";
       type = "gem";
     };
-    version = "7.2.1";
+    version = "7.3.0";
   };
   elasticsearch-api = {
     dependencies = ["multi_json"];
@@ -164,10 +185,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "18rd6xxvdjr8h7n6ziwjkrdzxwsx0rf9vd1krz7kgi61q5897jmz";
+      sha256 = "1jyd03ylyvv975iail13cwlkg4h9yknhpm1kcq1dpvmbjqy7q6bz";
       type = "gem";
     };
-    version = "7.2.1";
+    version = "7.3.0";
   };
   elasticsearch-transport = {
     dependencies = ["faraday" "multi_json"];
@@ -175,20 +196,20 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1k0324sbwz292l0nj50k318k2qlznzpimj5mpg7557rkk0b7plrz";
+      sha256 = "0dqm819iqkhbny5lwkf8mh83fmffpwbscal9vmfdw4g9mf08yfnf";
       type = "gem";
     };
-    version = "7.2.1";
+    version = "7.3.0";
   };
   excon = {
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1mc6y6n7i0hhk7i8wwi4qjnpkm013p7z3xr994s696hk74f91a7j";
+      sha256 = "05qmrx7l8abpbvp0z01fdpc731c4k6akk67l424vdp5dywhachpr";
       type = "gem";
     };
-    version = "0.65.0";
+    version = "0.66.0";
   };
   faraday = {
     dependencies = ["multipart-post"];
@@ -212,16 +233,27 @@
     };
     version = "1.0.0";
   };
+  fluent-plugin-cloudwatch-logs = {
+    dependencies = ["aws-sdk-cloudwatchlogs" "fluentd"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "046nx56zgb3l29r5v1s79zhhxsb18fwz2d8v6n6cgbv8i13xhl0l";
+      type = "gem";
+    };
+    version = "0.7.4";
+  };
   fluent-plugin-elasticsearch = {
     dependencies = ["elasticsearch" "excon" "fluentd"];
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "18j0q9x006gps03sh93v8nc83b9w45a6ynic8kd9x6zr2g58ynh7";
+      sha256 = "19nrhgx8mh59lpcv2jf3gb031x4zan93j9fswzjzvyjh4rlfpbmn";
       type = "gem";
     };
-    version = "3.5.3";
+    version = "3.5.5";
   };
   fluent-plugin-kafka = {
     dependencies = ["fluentd" "ltsv" "ruby-kafka"];
@@ -229,10 +261,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1p7xsm6v84z61hkhvg9fmrxahaid7fqdarnpvpp5qj8qnzximkyd";
+      sha256 = "1km7gjcx2icwj2s2svbmrhwb1gmpk85zfa8pivm04wzc8f6vjhy2";
       type = "gem";
     };
-    version = "0.11.0";
+    version = "0.11.1";
   };
   fluent-plugin-kinesis = {
     dependencies = ["aws-sdk-firehose" "aws-sdk-kinesis" "fluentd" "google-protobuf"];
@@ -317,20 +349,20 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1h6zvb4qhhyl8hm19015ha5rbdvg9wpv3ipbyr1ab491igqln1j6";
+      sha256 = "1pyjd31z95l819n9sbl6bl5bvjmyi39is0p2i0im3v0r9ydgyf27";
       type = "gem";
     };
-    version = "1.6.2";
+    version = "1.7.0";
   };
   google-protobuf = {
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0b7r1y30cgm03cj0l8pr6npz4w9i1lh70ycd2w15zf2qcbi9gpng";
+      sha256 = "0pb7v00zya00jddl7cpraz27xi3jsdjn31mm672byqwzdyghpfka";
       type = "gem";
     };
-    version = "3.9.0";
+    version = "3.9.1";
   };
   "http_parser.rb" = {
     groups = ["default"];
@@ -378,10 +410,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1186lhwnxiw5ryv6dbxrsfy0fajfll2l95kf9pmca50iyiqi86zn";
+      sha256 = "1qr2mkm2i3m76zarvy7qgjl9596hmvjrg7x6w42vx8cfsbf5p0y1";
       type = "gem";
     };
-    version = "1.3.0";
+    version = "1.3.1";
   };
   multi_json = {
     groups = ["default"];
@@ -408,10 +440,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0g9ds2ffzljl6jjmkjffwxc1z6lh5nkqqmhhkxjk71q5ggv0rkpm";
+      sha256 = "0xnfv2j2bqgdpg2yq9i2rxby0w2sc9h5iyjkpaas2xknwrgmhdb0";
       type = "gem";
     };
-    version = "3.1.1";
+    version = "4.0.1";
   };
   ruby-kafka = {
     dependencies = ["digest-crc"];
@@ -419,10 +451,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "10q92n67s4x80q87ibirvsaryvq4lqyna6xabl5vgnr59xrap6ym";
+      sha256 = "0m50s1xabvgq36k9jx2qj8bd8ivvkxa6fs2czi22jxhzqsl3xlvc";
       type = "gem";
     };
-    version = "0.7.9";
+    version = "0.7.10";
   };
   serverengine = {
     dependencies = ["sigdump"];
@@ -455,16 +487,6 @@
     };
     version = "0.2.3";
   };
-  thread_safe = {
-    groups = ["default"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0nmhcgq6cgz44srylra07bmaw99f5271l0dpsvl5f75m44l0gmwy";
-      type = "gem";
-    };
-    version = "0.3.6";
-  };
   thrift = {
     groups = ["default"];
     platforms = [];
@@ -476,15 +498,15 @@
     version = "0.8.0";
   };
   tzinfo = {
-    dependencies = ["thread_safe"];
+    dependencies = ["concurrent-ruby"];
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1fjx9j327xpkkdlxwmkl3a8wqj7i4l4jwlrv3z13mg95z9wl253z";
+      sha256 = "0jp9f5120az6q84w5w19nnn6g6yl2whc1cbcnnv4xryw9q8vqbkb";
       type = "gem";
     };
-    version = "1.2.5";
+    version = "2.0.0";
   };
   tzinfo-data = {
     dependencies = ["tzinfo"];
diff --git a/pkgs/tools/misc/fontforge/default.nix b/pkgs/tools/misc/fontforge/default.nix
index 67ab7b2d6917..82fd5c8210dd 100644
--- a/pkgs/tools/misc/fontforge/default.nix
+++ b/pkgs/tools/misc/fontforge/default.nix
@@ -1,21 +1,24 @@
 { stdenv, fetchurl, lib
-, autoconf, automake, gnum4, libtool, perl, uthash, pkgconfig, gettext
+, cmake, perl, uthash, pkgconfig, gettext
 , python, freetype, zlib, glib, libungif, libpng, libjpeg, libtiff, libxml2, cairo, pango
 , readline, woff2, zeromq, libuninameslist
 , withSpiro ? false, libspiro
-, withGTK ? false, gtk2
+, withGTK ? false, gtk3
+, withGUI ? withGTK
 , withPython ? true
 , withExtras ? true
 , Carbon ? null, Cocoa ? null
 }:
 
+assert withGTK -> withGUI;
+
 stdenv.mkDerivation rec {
   pname = "fontforge";
-  version = "20190801";
+  version = "20200314";
 
   src = fetchurl {
-    url = "https://github.com/${pname}/${pname}/releases/download/${version}/${pname}-${version}.tar.gz";
-    sha256 = "0lh8yx01asbzxm6car5cfi64njh5p4lxc7iv8dldr5rwg357a86r";
+    url = "https://github.com/${pname}/${pname}/releases/download/${version}/${pname}-${version}.tar.xz";
+    sha256 = "0qf88wd6riycq56d24brybyc93ns74s0nyyavm43zp2kfcihn6fd";
   };
 
   # use $SOURCE_DATE_EPOCH instead of non-deterministic timestamps
@@ -30,41 +33,33 @@ stdenv.mkDerivation rec {
   # do not use x87's 80-bit arithmetic, rouding errors result in very different font binaries
   NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isi686 "-msse2 -mfpmath=sse";
 
-  nativeBuildInputs = [ pkgconfig autoconf automake gnum4 libtool perl gettext ];
+  nativeBuildInputs = [ pkgconfig cmake ];
   buildInputs = [
     readline uthash woff2 zeromq libuninameslist
     python freetype zlib glib libungif libpng libjpeg libtiff libxml2
   ]
     ++ lib.optionals withSpiro [libspiro]
-    ++ lib.optionals withGTK [ gtk2 cairo pango ]
+    ++ lib.optionals withGUI [ gtk3 cairo pango ]
     ++ lib.optionals stdenv.isDarwin [ Carbon Cocoa ];
 
-    configureFlags = [ "--enable-woff2" ]
-    ++ lib.optionals (!withPython) [ "--disable-python-scripting" "--disable-python-extension" ]
-    ++ lib.optional withGTK "--enable-gtk2-use"
-    ++ lib.optional (!withGTK) "--without-x"
-    ++ lib.optional withExtras "--enable-fontforge-extras";
+  cmakeFlags = [ "-DCMAKE_BUILD_WITH_INSTALL_RPATH=ON" ]
+    ++ lib.optional (!withSpiro) "-DENABLE_LIBSPIRO=OFF"
+    ++ lib.optional (!withGUI) "-DENABLE_GUI=OFF"
+    ++ lib.optional (!withGTK) "-DENABLE_X11=ON"
+    ++ lib.optional withExtras "-DENABLE_FONTFORGE_EXTRAS=ON";
 
   # work-around: git isn't really used, but configuration fails without it
   preConfigure = ''
     # The way $version propagates to $version of .pe-scripts (https://github.com/dejavu-fonts/dejavu-fonts/blob/358190f/scripts/generate.pe#L19)
     export SOURCE_DATE_EPOCH=$(date -d ${version} +%s)
-
-    export GIT="$(type -P true)"
-    ./bootstrap --skip-git --force
   '';
 
-  doCheck = false; # tries to wget some fonts
-  doInstallCheck = doCheck;
-
   postInstall =
     # get rid of the runtime dependency on python
     lib.optionalString (!withPython) ''
       rm -r "$out/share/fontforge/python"
     '';
 
-  enableParallelBuilding = true;
-
   meta = {
     description = "A font editor";
     homepage = "http://fontforge.github.io";
diff --git a/pkgs/tools/misc/fzf/default.nix b/pkgs/tools/misc/fzf/default.nix
index e875dd77b02b..2fe4bac88f0c 100644
--- a/pkgs/tools/misc/fzf/default.nix
+++ b/pkgs/tools/misc/fzf/default.nix
@@ -60,7 +60,7 @@ buildGoModule rec {
     homepage = "https://github.com/junegunn/fzf";
     description = "A command-line fuzzy finder written in Go";
     license = licenses.mit;
-    maintainers = with maintainers; [ filalex77 ma27 ];
+    maintainers = with maintainers; [ filalex77 ma27 zowoq ];
     platforms = platforms.unix;
   };
-}
\ No newline at end of file
+}
diff --git a/pkgs/tools/misc/geekbench/default.nix b/pkgs/tools/misc/geekbench/default.nix
index 153a74f94567..9c250390e11c 100644
--- a/pkgs/tools/misc/geekbench/default.nix
+++ b/pkgs/tools/misc/geekbench/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "geekbench";
-  version = "5.1.1";
+  version = "5.2.0";
 
   src = fetchurl {
     url = "https://cdn.geekbench.com/Geekbench-${version}-Linux.tar.gz";
-    sha256 = "1wjyn3fkc2zgj0xrd73kidrg1d1wqmil278ak36wf87685w4n0b1";
+    sha256 = "1rvzll57igivhlxp058mhmcbq07q2zr52xbi1wyn85qr9ihrhx08";
   };
 
   dontConfigure = true;
diff --git a/pkgs/tools/misc/gh-ost/default.nix b/pkgs/tools/misc/gh-ost/default.nix
index d78e7f9439fd..17893ef18ae6 100644
--- a/pkgs/tools/misc/gh-ost/default.nix
+++ b/pkgs/tools/misc/gh-ost/default.nix
@@ -2,8 +2,8 @@
 
 let
   goPackagePath = "github.com/github/gh-ost";
-  version = "1.0.47";
-  sha256 = "0yyhkqis4j2cl6w2drrjxdy5j8x9zp4j89gsny6w4ql8gm5qgvvk";
+  version = "1.0.49";
+  sha256 = "0mncjhmv25wnhgjkn9gwkz2gzh0v6954w47ql7fs2iqr9al111dq";
 
 in
 buildGoPackage ({
diff --git a/pkgs/tools/misc/gif-for-cli/default.nix b/pkgs/tools/misc/gif-for-cli/default.nix
index 993c20222d8e..fed22e518937 100644
--- a/pkgs/tools/misc/gif-for-cli/default.nix
+++ b/pkgs/tools/misc/gif-for-cli/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, python3Packages, ffmpeg, zlib, libjpeg }:
+{ stdenv, fetchFromGitHub, python3Packages, ffmpeg_3, zlib, libjpeg }:
 
 python3Packages.buildPythonApplication {
   pname = "gif-for-cli";
@@ -12,7 +12,7 @@ python3Packages.buildPythonApplication {
   };
 
   checkInputs = [ python3Packages.coverage ];
-  buildInputs = [ ffmpeg zlib libjpeg ];
+  buildInputs = [ ffmpeg_3 zlib libjpeg ];
   propagatedBuildInputs = with python3Packages; [ pillow requests x256 ];
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/misc/graylog/default.nix b/pkgs/tools/misc/graylog/default.nix
index df645789c582..8530d04b49a3 100644
--- a/pkgs/tools/misc/graylog/default.nix
+++ b/pkgs/tools/misc/graylog/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "graylog";
-  version = "3.2.5";
+  version = "3.3.1";
 
   src = fetchurl {
     url = "https://packages.graylog2.org/releases/graylog/graylog-${version}.tgz";
-    sha256 = "1sbws735w0qww3nj8ai105a743nyrf1iprmcl89w5h8yirq2z1r9";
+    sha256 = "1jcv2dqm49vbz810ypv024r3lqgz804l06yhhwshrih61xzj7dvh";
   };
 
   dontBuild = true;
diff --git a/pkgs/tools/misc/graylog/plugins.nix b/pkgs/tools/misc/graylog/plugins.nix
index 1f351b662038..ec6c16f53131 100644
--- a/pkgs/tools/misc/graylog/plugins.nix
+++ b/pkgs/tools/misc/graylog/plugins.nix
@@ -38,10 +38,10 @@ in {
   auth_sso = glPlugin rec {
     name = "graylog-auth-sso-${version}";
     pluginName = "graylog-plugin-auth-sso";
-    version = "3.1.0";
+    version = "3.3.0";
     src = fetchurl {
       url = "https://github.com/Graylog2/${pluginName}/releases/download/${version}/${pluginName}-${version}.jar";
-      sha256 = "0hwgpq1j3qk0j1zgap5f1avh2nvkcscgds81x8xr0gamphgps8y2";
+      sha256 = "1g47hlld8vzicd47b5i9n2816rbrhv18vjq8gp765c7mdg4a2jn8";
     };
     meta = {
       homepage = "https://github.com/Graylog2/graylog-plugin-auth-sso";
@@ -61,6 +61,25 @@ in {
       description = "Message filter plugin can be used to do DNS lookups for the source field in Graylog messages";
     };
   };
+  enterprise-integrations = glPlugin rec {
+    name = "graylog-enterprise-integrations-${version}";
+    pluginName = "graylog-plugin-enterprise-integrations";
+    version = "3.3.1";
+    src = fetchurl {
+      url = "https://downloads.graylog.org/releases/graylog-enterprise-integrations/graylog-enterprise-integrations-plugins-${version}.tgz";
+      sha256 = "0la91f5hfakrp5d37q3r1z15zzya9vmwgp8gf5ifkh6fasa811ll";
+    };
+    installPhase = ''
+      mkdir -p $out/bin
+      tar --strip-components=2 -xf $src
+      cp ${pluginName}-${version}.jar $out/bin/${pluginName}-${version}.jar
+    '';
+    meta = {
+      homepage = "https://docs.graylog.org/en/3.3/pages/integrations.html#enterprise";
+      description = "Integrations are tools that help Graylog work with external systems (unfree enterprise integrations)";
+      license = stdenv.lib.licenses.unfree;
+    };
+  };
   filter-messagesize = glPlugin rec {
     name = "graylog-filter-messagesize-${version}";
     pluginName = "graylog-plugin-filter-messagesize";
@@ -74,6 +93,24 @@ in {
       description = "Prints out all messages that have an estimated size crossing a configured threshold during processing";
     };
   };
+  integrations = glPlugin rec {
+    name = "graylog-integrations-${version}";
+    pluginName = "graylog-plugin-integrations";
+    version = "3.3.1";
+    src = fetchurl {
+      url = "https://downloads.graylog.org/releases/graylog-integrations/graylog-integrations-plugins-${version}.tgz";
+      sha256 = "1k90q50p4ly9d8fj0riyb1xw0bd6f8wm2xmkr71908j2v0jaskpq";
+    };
+    installPhase = ''
+      mkdir -p $out/bin
+      tar --strip-components=2 -xf $src
+      cp ${pluginName}-${version}.jar $out/bin/${pluginName}-${version}.jar
+    '';
+    meta = {
+      homepage = https://github.com/Graylog2/graylog-plugin-integrations;
+      description = "A collection of open source Graylog integrations that will be released together";
+    };
+  };
   internal-logs = glPlugin rec {
     name = "graylog-internal-logs-${version}";
     pluginName = "graylog-plugin-internal-logs";
@@ -142,10 +179,10 @@ in {
   pagerduty = glPlugin rec {
     name = "graylog-pagerduty-${version}";
     pluginName = "graylog-plugin-pagerduty";
-    version = "1.3.0";
+    version = "2.0.0";
     src = fetchurl {
       url = "https://github.com/graylog-labs/${pluginName}/releases/download/${version}/${pluginName}-${version}.jar";
-      sha256 = "1g63c6rm5pkz7f0d73wb2lmk4zm430jqnhihbyq112cm4i7ymglh";
+      sha256 = "0xhcwfwn7c77giwjilv7k7aijnj9azrjbjgd0r3p6wdrw970f27r";
     };
     meta = {
       homepage = "https://github.com/graylog-labs/graylog-plugin-pagerduty";
@@ -178,6 +215,19 @@ in {
       description = "Can notify Slack or Mattermost channels about triggered alerts in Graylog (Alarm Callback)";
     };
   };
+  snmp = glPlugin rec {
+    name = "graylog-snmp-${version}";
+    pluginName = "graylog-plugin-snmp";
+    version = "0.3.0";
+    src = fetchurl {
+      url = "https://github.com/graylog-labs/${pluginName}/releases/download/${version}/${pluginName}-${version}.jar";
+      sha256 = "1hkaklwzcsvqq45b98chwqxqdgnnbj4dg68agsll13yq4zx37qpp";
+    };
+    meta = {
+      homepage = https://github.com/graylog-labs/graylog-plugin-snmp;
+      description = "Graylog plugin to receive SNMP traps";
+    };
+  };
   spaceweather = glPlugin rec {
     name = "graylog-spaceweather-${version}";
     pluginName = "graylog-plugin-spaceweather";
diff --git a/pkgs/tools/misc/h/default.nix b/pkgs/tools/misc/h/default.nix
index f4897a54cb13..9a80945097b7 100644
--- a/pkgs/tools/misc/h/default.nix
+++ b/pkgs/tools/misc/h/default.nix
@@ -8,7 +8,7 @@ stdenv.mkDerivation rec {
     owner = "zimbatm";
     repo = "h";
     rev = "v${version}";
-    hash = "sha256-chGrMtvLyyNtlM7PO1olVdkzkvMOk6OibHw+mqwVxIM=";
+    sha256 = "10y42nn9lgkwdjia74qfyf937nam4md3pkyfjinj7jybvcran4bj";
   };
 
   buildInputs = [ ruby ];
diff --git a/pkgs/tools/misc/hdf4/default.nix b/pkgs/tools/misc/hdf4/default.nix
index 8d694aa88b75..d5b8291d78ed 100644
--- a/pkgs/tools/misc/hdf4/default.nix
+++ b/pkgs/tools/misc/hdf4/default.nix
@@ -84,10 +84,11 @@ stdenv.mkDerivation rec {
     moveToOutput bin "$bin"
   '';
 
-  meta = {
+  meta = with stdenv.lib; {
     description = "Data model, library, and file format for storing and managing data";
     homepage = "https://support.hdfgroup.org/products/hdf4/";
-    maintainers = with stdenv.lib.maintainers; [ knedlsepp ];
-    platforms = stdenv.lib.platforms.unix;
+    maintainers = with maintainers; [ knedlsepp ];
+    platforms = platforms.unix;
+    license = licenses.bsdOriginal;
   };
 }
diff --git a/pkgs/tools/misc/hexyl/default.nix b/pkgs/tools/misc/hexyl/default.nix
index e67b0116df16..d9bed8c607d0 100644
--- a/pkgs/tools/misc/hexyl/default.nix
+++ b/pkgs/tools/misc/hexyl/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname   = "hexyl";
-  version = "0.7.0";
+  version = "0.8.0";
 
   src = fetchFromGitHub {
     owner  = "sharkdp";
     repo   = pname;
     rev    = "v${version}";
-    sha256 = "0blq81zpmzldngk9ymcg56syspjp1g1ziap4z69idv05mfkf6sp3";
+    sha256 = "0aj2sysl0spf5zlcd5kfzlw97w7dzf9x93pv0d1v9blnbd1rz7lm";
   };
 
-  cargoSha256 = "09kccd1brcbvzimm05dyybwrkganqxdkjrvzgcf1l93xs1z2h94b";
+  cargoSha256 = "1am9vs7l2wzgwqakrsl27x1y7jpn9xaqa4kr48wwqzka401h6j4m";
 
   meta = with stdenv.lib; {
     changelog = "https://github.com/sharkdp/hexyl/releases/tag/v${version}";
diff --git a/pkgs/tools/misc/hyperfine/default.nix b/pkgs/tools/misc/hyperfine/default.nix
index 5e2b654f4f98..b51ca76b12c9 100644
--- a/pkgs/tools/misc/hyperfine/default.nix
+++ b/pkgs/tools/misc/hyperfine/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, rustPlatform
+{ stdenv, fetchFromGitHub, rustPlatform, installShellFiles
 , Security
 }:
 
@@ -15,8 +15,17 @@ rustPlatform.buildRustPackage rec {
 
   cargoSha256 = "06scvp7x1yixdadarsm461hbc256spx4aqhmjjn72x7hxn22h9cg";
 
+  nativeBuildInputs = [ installShellFiles ];
   buildInputs = stdenv.lib.optional stdenv.isDarwin Security;
 
+  postInstall = ''
+    installManPage doc/hyperfine.1
+
+    installShellCompletion \
+      $releaseDir/build/hyperfine-*/out/hyperfine.{bash,fish} \
+      --zsh $releaseDir/build/hyperfine-*/out/_hyperfine
+  '';
+
   meta = with stdenv.lib; {
     description = "Command-line benchmarking tool";
     homepage    = "https://github.com/sharkdp/hyperfine";
diff --git a/pkgs/tools/misc/jdupes/default.nix b/pkgs/tools/misc/jdupes/default.nix
index ae0b32d2120d..ba509d945e16 100644
--- a/pkgs/tools/misc/jdupes/default.nix
+++ b/pkgs/tools/misc/jdupes/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "jdupes";
-  version = "1.15.0";
+  version = "1.16.0";
 
   src = fetchFromGitHub {
     owner = "jbruchon";
     repo  = "jdupes";
     rev   = "v${version}";
-    sha256 = "05q2ys7ii6mqiddl9ixzqhbvk4xy5ckh3yfz26vycxiyh9cp7yls";
+    sha256 = "0z8banifsp6325j572grpghf69j92zz9cxdnvb6pqjsknc96mrf6";
     # Unicode file names lead to different checksums on HFS+ vs. other
     # filesystems because of unicode normalisation. The testdir
     # directories have such files and will be removed.
diff --git a/pkgs/tools/misc/lazydocker/default.nix b/pkgs/tools/misc/lazydocker/default.nix
index b63892178d91..d0c4d71c58a6 100644
--- a/pkgs/tools/misc/lazydocker/default.nix
+++ b/pkgs/tools/misc/lazydocker/default.nix
@@ -2,13 +2,13 @@
 
 buildGoPackage rec {
   pname = "lazydocker";
-  version = "0.8";
+  version = "0.9";
 
   src = fetchFromGitHub {
     owner = "jesseduffield";
     repo = "lazydocker";
     rev = "v${version}";
-    sha256 = "02x03nmkbj0133bziaqmqlh3x515w3n01iqvg7q6b55r7nan7hv7";
+    sha256 = "08j2qp632fdmswnb92wxa9lhnal4mrmq6gmxaxngnxiqgkfx37zy";
   };
 
   goPackagePath = "github.com/jesseduffield/lazydocker";
diff --git a/pkgs/tools/misc/libcpuid/default.nix b/pkgs/tools/misc/libcpuid/default.nix
index b0fe00d44d9c..873399c185bf 100644
--- a/pkgs/tools/misc/libcpuid/default.nix
+++ b/pkgs/tools/misc/libcpuid/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libcpuid";
-  version = "0.4.1";
+  version = "0.5.0";
 
   src = fetchFromGitHub {
     owner = "anrieff";
     repo = "libcpuid";
     rev = "v${version}";
-    sha256 = "03sya0fs76g86syl299lrn0vqjjcf8i0xd7fzaf42qhizbx03b88";
+    sha256 = "13v5x8gyka2v4kx52khwalb6ai328z7kk9jlipbbbys63p6nyddr";
   };
 
   patches = [
diff --git a/pkgs/tools/misc/libgen-cli/default.nix b/pkgs/tools/misc/libgen-cli/default.nix
index c92b4ad42e1b..7d66941c99a3 100644
--- a/pkgs/tools/misc/libgen-cli/default.nix
+++ b/pkgs/tools/misc/libgen-cli/default.nix
@@ -1,19 +1,28 @@
-{ lib, buildGoModule, fetchFromGitHub }:
+{ lib, buildGoModule, fetchFromGitHub, installShellFiles }:
 buildGoModule rec {
   pname = "libgen-cli";
-  version = "1.0.5";
+  version = "1.0.6";
 
   src = fetchFromGitHub {
     owner = "ciehanski";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1lfsnyzin2dqhwhz6phms6yipli88sqiw55ls18dfv7bvx30sqlp";
+    sha256 = "1ahqwrlsvgiig73dwlbjgkarf3a0z3xaihj8psd2ci5i0i07nm5v";
   };
 
-  vendorSha256 = "1j45h8p13xfz0qy1nrddlx1xzbr5vqxd3q76hbb0v60636izfk0r";
+  vendorSha256 = "15ch0zfl4a7qvwszsfkfgw5v9492wjk4l4i324iq9b50g70lgyhd";
 
   subPackages = [ "." ];
 
+  nativeBuildInputs = [ installShellFiles ];
+
+  postInstall = ''
+    for shell in bash zsh; do
+      $out/bin/libgen-cli completion $shell > libgen-cli.$shell || :
+      installShellCompletion libgen-cli.$shell
+    done
+  '';
+
   meta = with lib; {
     homepage = "https://github.com/ciehanski/libgen-cli";
     description =
diff --git a/pkgs/tools/misc/miniserve/default.nix b/pkgs/tools/misc/miniserve/default.nix
index dab44e1eea5a..503131898c8f 100644
--- a/pkgs/tools/misc/miniserve/default.nix
+++ b/pkgs/tools/misc/miniserve/default.nix
@@ -29,7 +29,7 @@ rustPlatform.buildRustPackage rec {
     description = "For when you really just want to serve some files over HTTP right now!";
     homepage = "https://github.com/svenstaro/miniserve";
     license = with licenses; [ mit ];
-    maintainers = with maintainers; [ nequissimus ];
+    maintainers = with maintainers; [ nequissimus zowoq ];
     platforms = platforms.unix;
   };
 }
diff --git a/pkgs/tools/misc/mutagen/default.nix b/pkgs/tools/misc/mutagen/default.nix
index 50f8ffc25d7d..1271c4948515 100644
--- a/pkgs/tools/misc/mutagen/default.nix
+++ b/pkgs/tools/misc/mutagen/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "mutagen";
-  version = "0.11.4";
+  version = "0.11.5";
 
   src = fetchFromGitHub {
     owner = "mutagen-io";
     repo = pname;
     rev = "v${version}";
-    sha256 = "15bknyk6mkrwlm18ypncsf9az8l1nv67n0lf0zav867z0r46cc6x";
+    sha256 = "0z2bf412zfap91ygp7v06vif87d1cxj2jlc0jvfv7fm61801piij";
   };
 
   vendorSha256 = "0szs9yc49fyh55ra1wf8zj76kdah0x49d45cgivk3gqh2hl17j6l";
diff --git a/pkgs/tools/misc/ncdu/default.nix b/pkgs/tools/misc/ncdu/default.nix
index 7eddca8ca6de..2d56ab9c09bd 100644
--- a/pkgs/tools/misc/ncdu/default.nix
+++ b/pkgs/tools/misc/ncdu/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "ncdu";
-  version = "1.14.2";
+  version = "1.15.1";
 
   src = fetchurl {
     url = "https://dev.yorhel.nl/download/${pname}-${version}.tar.gz";
-    sha256 = "1cf6a9qw7ljaw09b0g7c5i252dl7wb2mnkrbwwwf7m0c3mf7yyll";
+    sha256 = "1c1zxalm5asyhn4p1hd51h7khw17515gbqmvdz63kc8xpx6xqbdh";
   };
 
   buildInputs = [ ncurses ];
@@ -16,6 +16,6 @@ stdenv.mkDerivation rec {
     homepage = "https://dev.yorhel.nl/ncdu";
     license = licenses.mit;
     platforms = platforms.all;
-    maintainers = with maintainers; [ pSub ];
+    maintainers = with maintainers; [ pSub zowoq ];
   };
 }
diff --git a/pkgs/tools/misc/osinfo-db-tools/default.nix b/pkgs/tools/misc/osinfo-db-tools/default.nix
index a93ec0ab573f..c0921a496cc2 100644
--- a/pkgs/tools/misc/osinfo-db-tools/default.nix
+++ b/pkgs/tools/misc/osinfo-db-tools/default.nix
@@ -4,11 +4,11 @@
 
 stdenv.mkDerivation rec {
   pname = "osinfo-db-tools";
-  version = "1.7.0";
+  version = "1.8.0";
 
   src = fetchurl {
     url = "https://releases.pagure.org/libosinfo/${pname}-${version}.tar.xz";
-    sha256 = "08x8mrafphyll0d35xdc143rip3ahrz6bmzhc85nwhq7yk2vxpab";
+    sha256 = "038q3gzdbkfkhpicj0755mw1q4gbvn57pslpw8n2dp3lds9im0g9";
   };
 
   nativeBuildInputs = [ meson ninja pkgconfig gettext perl python3 ];
diff --git a/pkgs/tools/misc/pgmetrics/default.nix b/pkgs/tools/misc/pgmetrics/default.nix
index c78aa6a53156..da2e1a9cbe31 100644
--- a/pkgs/tools/misc/pgmetrics/default.nix
+++ b/pkgs/tools/misc/pgmetrics/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "pgmetrics";
-  version = "1.9.0";
+  version = "1.9.1";
 
   src = fetchFromGitHub {
     owner  = "rapidloop";
     repo   = pname;
     rev    = "v${version}";
-    sha256 = "0f7pjagr3zcqmbhmk446j6n7nanyhvyq4rn68f5wljl9g68ni7sj";
+    sha256 = "03c4v24ql9p38m0hmgq5ya9cnvhmdhv2zjxxrxpb2338cxajs4mh";
   };
 
   vendorSha256 = "16x33fmh4q993rw0jr65337yimska4fwgyyw3kmq84q0x28a3zg5";
diff --git a/pkgs/tools/misc/phoronix-test-suite/default.nix b/pkgs/tools/misc/phoronix-test-suite/default.nix
index 0abbcd5c3a28..83e96d8f9e65 100644
--- a/pkgs/tools/misc/phoronix-test-suite/default.nix
+++ b/pkgs/tools/misc/phoronix-test-suite/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "phoronix-test-suite";
-  version = "9.6.0";
+  version = "9.6.1";
 
   src = fetchurl {
     url = "https://phoronix-test-suite.com/releases/${pname}-${version}.tar.gz";
-    sha256 = "1wgw5lwpm3ylby2llnjiq356cdb3v1jghj7xq659c722wj617i88";
+    sha256 = "1qnci0bipzq68mwfgmm7kcxjxcpfdrqf705am2jsj1mfd82y7yla";
   };
 
   buildInputs = [ php ];
diff --git a/pkgs/tools/misc/pistol/default.nix b/pkgs/tools/misc/pistol/default.nix
index eeb392606edd..5c92b70c0983 100644
--- a/pkgs/tools/misc/pistol/default.nix
+++ b/pkgs/tools/misc/pistol/default.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "pistol";
-  version = "0.1.1";
+  version = "0.1.2";
 
   src = fetchFromGitHub {
     owner = "doronbehar";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1d9c1bhidh781dis4427wramfrla4avqw9y2bmpjp81cqq3nc27d";
+    sha256 = "1ar8c7s8ihcwrwfspmqw7cb5560wkbdc5qyvddkx8lj03cjhcslj";
   };
 
-  vendorSha256 = "1f780vhxw0brvnr8hhah4sf6ms8spar29rqmy1kcqf9m75n94g56";
+  vendorSha256 = "1mhxb72fzpa2n88i9h154aci346dgcs2njznkjxchivz28crbqr8";
 
   subPackages = [ "cmd/pistol" ];
 
diff --git a/pkgs/tools/misc/plantuml/default.nix b/pkgs/tools/misc/plantuml/default.nix
index 09dba27a1efe..cb8cf1ec0a8e 100644
--- a/pkgs/tools/misc/plantuml/default.nix
+++ b/pkgs/tools/misc/plantuml/default.nix
@@ -1,12 +1,12 @@
 { stdenv, fetchurl, makeWrapper, jre, graphviz }:
 
 stdenv.mkDerivation rec {
-  version = "1.2020.10";
+  version = "1.2020.12";
   pname = "plantuml";
 
   src = fetchurl {
     url = "mirror://sourceforge/project/plantuml/${version}/plantuml.${version}.jar";
-    sha256 = "00azasannh77ns3wpy6yrlw77pgq89frx0f4c7gk1gqiqjavsvdy";
+    sha256 = "0c0270kjw8vg8nphharap2p66yl72j5k4k3s5r9klafgp3sg4sjj";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/tools/misc/rmlint/default.nix b/pkgs/tools/misc/rmlint/default.nix
index cbe1f7d407ce..2ea1668409a5 100644
--- a/pkgs/tools/misc/rmlint/default.nix
+++ b/pkgs/tools/misc/rmlint/default.nix
@@ -5,13 +5,13 @@
 with stdenv.lib;
 stdenv.mkDerivation rec {
   pname = "rmlint";
-  version = "2.9.0";
+  version = "2.10.1";
 
   src = fetchFromGitHub {
     owner = "sahib";
     repo = "rmlint";
     rev = "v${version}";
-    sha256 = "1b5cziam14h80xrfb285fmfrzz2rligxcpsq1xsig14xf4l2875i";
+    sha256 = "15xfkcw1bkfyf3z8kl23k3rlv702m0h7ghqxvhniynvlwbgh6j2x";
   };
 
   CFLAGS="-I${stdenv.lib.getDev utillinux}/include";
diff --git a/pkgs/tools/misc/sdate/default.nix b/pkgs/tools/misc/sdate/default.nix
index 6c52aa217df6..06b5360086c1 100644
--- a/pkgs/tools/misc/sdate/default.nix
+++ b/pkgs/tools/misc/sdate/default.nix
@@ -1,10 +1,10 @@
 { stdenv, fetchurl, autoreconfHook }:
 stdenv.mkDerivation rec {
   pname = "sdate";
-  version = "0.6";
+  version = "0.7";
   src = fetchurl {
     url = "https://github.com/ChristophBerg/sdate/archive/${version}.tar.gz";
-    sha256 = "11irlbbhlzkg6y621smk351jl8ay3yjhl2j9hila0xa72hs4n7gz";
+    sha256 = "1lfnsb8prac8rspnxcawd138jyhyivwf35rrmfvwq6dhsx23c6vy";
   };
 
   buildInputs = [ autoreconfHook ];
diff --git a/pkgs/tools/misc/shadowenv/default.nix b/pkgs/tools/misc/shadowenv/default.nix
index 7c9352d33100..9becd52273e6 100644
--- a/pkgs/tools/misc/shadowenv/default.nix
+++ b/pkgs/tools/misc/shadowenv/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "shadowenv";
-  version = "2.0.2";
+  version = "2.0.3";
 
   src = fetchFromGitHub {
     owner = "Shopify";
     repo = pname;
     rev = version;
-    sha256 = "1x5i5km6wblqbc0fibdjdlqkamqswxwhy8p6cbfz2nvcia7fgsf1";
+    sha256 = "1h8hfyxxl4bpx8azzxj0snmzccn6xjd9vc2iyp8i2ar7aiyhf5yd";
   };
 
-  cargoSha256 = "1hrsbd6025sfgnwr7smp43yzi7w2lfyfbdxhapgizrpwbq8y7xzd";
+  cargoSha256 = "1bjkwn57vm3in8lajhm7p9fjwyqhmkrb3fyq1k7lqjvrrh9jysb2";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/tools/misc/starship/default.nix b/pkgs/tools/misc/starship/default.nix
index d6ff65adb4ca..3fec20f95bb6 100644
--- a/pkgs/tools/misc/starship/default.nix
+++ b/pkgs/tools/misc/starship/default.nix
@@ -3,13 +3,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "starship";
-  version = "0.41.3";
+  version = "0.42.0";
 
   src = fetchFromGitHub {
     owner = "starship";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0f3d95abivbmjqdzw9pbdbis96sfds26xv3k8k9skxml8iqzq29c";
+    sha256 = "17wc9f07308a97dsmrkq74w2r639sqms0hwh8gavwxycj7wq7xz2";
   };
 
   nativeBuildInputs = stdenv.lib.optionals stdenv.isLinux [ pkg-config ];
@@ -22,7 +22,7 @@ rustPlatform.buildRustPackage rec {
       --replace "/bin/echo" "echo"
   '';
 
-  cargoSha256 = "10h0arvl3gf5hg530d24ypj4yzk3zhm8mgkhz0v61y0jcdy2zdrm";
+  cargoSha256 = "1nvs68qxygi2l43vxw890r40px35dvzbcg6qmrm09g60ykd8pjv2";
   checkPhase = "cargo test -- --skip directory::home_directory --skip directory::directory_in_root";
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/misc/system-config-printer/default.nix b/pkgs/tools/misc/system-config-printer/default.nix
index e9ee91de6776..8a0c881a277b 100644
--- a/pkgs/tools/misc/system-config-printer/default.nix
+++ b/pkgs/tools/misc/system-config-printer/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, udev, intltool, pkgconfig, glib, xmlto, wrapGAppsHook
+{ stdenv, fetchFromGitHub, fetchpatch, udev, intltool, pkgconfig, glib, xmlto, wrapGAppsHook
 , docbook_xml_dtd_412, docbook_xsl
 , libxml2, desktop-file-utils, libusb1, cups, gdk-pixbuf, pango, atk, libnotify
 , gobject-introspection, libsecret, packagekit
@@ -24,7 +24,20 @@ stdenv.mkDerivation rec {
     substituteInPlace Makefile.am --replace /bin/bash ${bash}/bin/bash
   '';
 
-  patches = [ ./detect_serverbindir.patch ];
+  patches = [
+    ./detect_serverbindir.patch
+
+    # https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=958104
+    # (Fixes will be included in next upstream release.)
+    (fetchpatch {
+      url = "https://github.com/OpenPrinting/system-config-printer/commit/cf9903466c1a2d18a701f3b5e8c7e03483e1244d.patch";
+      sha256 = "03gpav618w50q90m2kdkgwclc7fv17m493fgjd633zfavb5kqr3n";
+    })
+    (fetchpatch {
+      url = "https://github.com/OpenPrinting/system-config-printer/commit/b9289dfe105bdb502f183f0afe7a115ecae5f2af.patch";
+      sha256 = "12w47hy3ly4phh8jcqxvdnd5sgbnbp8dnscjd7d5y2i43kxj7b23";
+    })
+  ];
 
   buildInputs = [
     glib udev libusb1 cups
diff --git a/pkgs/tools/misc/topgrade/default.nix b/pkgs/tools/misc/topgrade/default.nix
index 529252901a4a..21e464c6d29e 100644
--- a/pkgs/tools/misc/topgrade/default.nix
+++ b/pkgs/tools/misc/topgrade/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "topgrade";
-  version = "4.5.0";
+  version = "4.7.0";
 
   src = fetchFromGitHub {
     owner = "r-darwish";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0df79vlbclv1qx4zwir728c6ggqfawxh2x1py16m5q0ga1hd799j";
+    sha256 = "1hg03mj3rd778hq1856139nwz7y5gykwvg7xhxlsiabv7gr06m2m";
   };
 
-  cargoSha256 = "0wwxh71i94h68sryckbvrr43gd19qjcs0cgcpycnimkhdcdy8nlj";
+  cargoSha256 = "14qv2157jhj7hilvqi3c00p11rzv0vvimr4d34nyspgzxz2si6sm";
 
   buildInputs = lib.optional stdenv.isDarwin Foundation;
 
diff --git a/pkgs/tools/misc/ttwatch/default.nix b/pkgs/tools/misc/ttwatch/default.nix
index afd5139565c8..8788608876ea 100644
--- a/pkgs/tools/misc/ttwatch/default.nix
+++ b/pkgs/tools/misc/ttwatch/default.nix
@@ -1,19 +1,21 @@
-{ stdenv, fetchFromGitHub, cmake, perl, openssl, curl, libusb1
+{ stdenv, fetchFromGitHub
+, cmake, perl, pkgconfig
+, openssl, curl, libusb1, protobufc
 , enableUnsafe ? false }:
 
 stdenv.mkDerivation {
   pname = "ttwatch";
-  version = "2018-12-04";
+  version = "2020-02-05";
 
   src = fetchFromGitHub {
     owner = "ryanbinns";
     repo = "ttwatch";
-    rev = "eeb4e19bf7ca7ca2cee7f5fbeb483b27198d86a1";
-    sha256 = "18384apdkq35120cgmda686d293354aibwcq2hwhvvjmnq49fnzr";
+    rev = "bfdf1372515574e1fb3871dc1039f8d8a5dbdada";
+    sha256 = "07nd4dbkchxy8js1h1f6pzn63pls2afww97wyiiw6zid43mpqyg4";
   };
 
-  nativeBuildInputs = [ cmake perl ];
-  buildInputs = [ openssl curl libusb1 ];
+  nativeBuildInputs = [ cmake perl pkgconfig ];
+  buildInputs = [ openssl curl libusb1 protobufc ];
 
   cmakeFlags = stdenv.lib.optional enableUnsafe [ "-Dunsafe=on" ];
 
diff --git a/pkgs/tools/misc/txt2man/default.nix b/pkgs/tools/misc/txt2man/default.nix
index c7d8837f8235..6013dc1c26b9 100644
--- a/pkgs/tools/misc/txt2man/default.nix
+++ b/pkgs/tools/misc/txt2man/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "txt2man";
-  version = "1.6.0";
+  version = "1.7.0";
 
   src = fetchurl {
     url = "https://github.com/mvertes/txt2man/archive/${pname}-${version}.tar.gz";
-    sha256 = "168cj96974n2z0igin6j1ic1m45zyic7nm5ark7frq8j78rrx4zn";
+    sha256 = "06jf8hqav095db1v3njavx0rphmpmi3mgki4va6qkxjnvmdx4742";
   };
 
   preConfigure = ''
diff --git a/pkgs/tools/misc/watchexec/default.nix b/pkgs/tools/misc/watchexec/default.nix
index 1c626785483c..01993ebed6d2 100644
--- a/pkgs/tools/misc/watchexec/default.nix
+++ b/pkgs/tools/misc/watchexec/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "watchexec";
-  version = "1.12.0";
+  version = "1.13.1";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = version;
-    sha256 = "03s9nsss4895x4lp90y65jajavk8c2nj1jjnmx0vbbwl210ghlv1";
+    sha256 = "1idyr3h9dhb67xlhd5bsa7866i75w4jzjbbchq6fd9lqd488bsj7";
   };
 
-  cargoSha256 = "0p20d7paiafvl4k9iiazbgq75wk7k42sz2h1y5lalq16f5rp6dbp";
+  cargoSha256 = "14lkvfr1yz8g15ffc8j1vvy7q1nwqbkhz2y0fnskwqfzpd17f9gl";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/tools/misc/woeusb/default.nix b/pkgs/tools/misc/woeusb/default.nix
index 991ab6224907..4c235b4866f2 100644
--- a/pkgs/tools/misc/woeusb/default.nix
+++ b/pkgs/tools/misc/woeusb/default.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchFromGitHub, autoreconfHook, makeWrapper
-, coreutils, dosfstools, findutils, gawk, gnugrep, grub2_light, ncurses, ntfs3g, parted, utillinux, wget
+, coreutils, dosfstools, findutils, gawk, gnugrep, grub2_light, ncurses, ntfs3g, parted, p7zip, utillinux, wget
 , wxGTK30 }:
 
 stdenv.mkDerivation rec {
@@ -39,7 +39,7 @@ stdenv.mkDerivation rec {
     # should be patched with a less useless default PATH, but for now
     # we add everything we need manually.
     wrapProgram "$out/bin/woeusb" \
-      --set PATH '${stdenv.lib.makeBinPath [ coreutils dosfstools findutils gawk gnugrep grub2_light ncurses ntfs3g parted utillinux wget ]}'
+      --set PATH '${stdenv.lib.makeBinPath [ coreutils dosfstools findutils gawk gnugrep grub2_light ncurses ntfs3g parted utillinux wget p7zip ]}'
   '';
 
   doInstallCheck = true;
diff --git a/pkgs/tools/misc/yle-dl/default.nix b/pkgs/tools/misc/yle-dl/default.nix
index d33743025464..00624a482c8e 100644
--- a/pkgs/tools/misc/yle-dl/default.nix
+++ b/pkgs/tools/misc/yle-dl/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, rtmpdump, php, pythonPackages, ffmpeg }:
+{ stdenv, fetchFromGitHub, rtmpdump, php, pythonPackages, ffmpeg_3 }:
 
 pythonPackages.buildPythonApplication rec {
   pname = "yle-dl";
@@ -12,7 +12,7 @@ pythonPackages.buildPythonApplication rec {
   };
 
   propagatedBuildInputs = with pythonPackages; [
-    lxml pyamf pycrypto requests future ffmpeg setuptools
+    lxml pyamf pycrypto requests future ffmpeg_3 setuptools
   ];
   pythonPath = [ rtmpdump php ];
 
diff --git a/pkgs/tools/misc/youtube-dl/default.nix b/pkgs/tools/misc/youtube-dl/default.nix
index 4b399abb61e0..94f4de6e364f 100644
--- a/pkgs/tools/misc/youtube-dl/default.nix
+++ b/pkgs/tools/misc/youtube-dl/default.nix
@@ -1,5 +1,5 @@
 { lib, fetchurl, buildPythonPackage
-, zip, ffmpeg_4, rtmpdump, phantomjs2, atomicparsley, pycryptodome, pandoc
+, zip, ffmpeg, rtmpdump, phantomjs2, atomicparsley, pycryptodome, pandoc
 # Pandoc is required to build the package's man page. Release tarballs contain a
 # formatted man page already, though, it will still be installed. We keep the
 # manpage argument in place in case someone wants to use this derivation to
@@ -18,11 +18,11 @@ buildPythonPackage rec {
   # The websites youtube-dl deals with are a very moving target. That means that
   # downloads break constantly. Because of that, updates should always be backported
   # to the latest stable release.
-  version = "2020.05.08";
+  version = "2020.06.16.1";
 
   src = fetchurl {
     url = "https://yt-dl.org/downloads/${version}/${pname}-${version}.tar.gz";
-    sha256 = "16zxa8ss2rka7cvkqyi67s8i1h9f4nxx88w9vjbxchbga6w0scc6";
+    sha256 = "1q0080cvxpfakgbzigbnl9adnga3jz1sqig2rsiq52rarqbc01px";
   };
 
   nativeBuildInputs = [ installShellFiles makeWrapper ];
@@ -36,7 +36,7 @@ buildPythonPackage rec {
   makeWrapperArgs = let
       packagesToBinPath =
         [ atomicparsley ]
-        ++ lib.optional ffmpegSupport ffmpeg_4
+        ++ lib.optional ffmpegSupport ffmpeg
         ++ lib.optional rtmpSupport rtmpdump
         ++ lib.optional phantomjsSupport phantomjs2;
     in [ ''--prefix PATH : "${lib.makeBinPath packagesToBinPath}"'' ];
diff --git a/pkgs/tools/networking/acme-client/default.nix b/pkgs/tools/networking/acme-client/default.nix
index 06c2898248d0..00f8778cafd5 100644
--- a/pkgs/tools/networking/acme-client/default.nix
+++ b/pkgs/tools/networking/acme-client/default.nix
@@ -1,7 +1,5 @@
 { stdenv
-, fetchFromGitHub
-, autoreconfHook
-, bison
+, fetchurl
 , apple_sdk ? null
 , libbsd
 , libressl
@@ -12,22 +10,20 @@ with stdenv.lib;
 
 stdenv.mkDerivation rec {
   pname = "acme-client";
-  version = "0.2.5";
+  version = "1.0.1";
 
-  src = fetchFromGitHub {
-    owner = "graywolf";
-    repo = "acme-client-portable";
-    rev = "v${version}";
-    sha256 = "1d9yk87nj5gizkq26m4wqfh4xhlrn5xlfj7mfgvrpsdiwibqxrrw";
+  src = fetchurl {
+    url = "https://data.wolfsden.cz/sources/acme-client-${version}.tar.xz";
+    sha256 = "0gmdvmyw8a61w08hrxllypf7rpnqg0fxipbk3zmvsxj7m5i6iysj";
   };
 
-  nativeBuildInputs = [ autoreconfHook bison pkgconfig ];
+  nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ libbsd libressl ] ++ optional stdenv.isDarwin apple_sdk.sdk;
 
   makeFlags = [ "PREFIX=${placeholder "out"}" ];
 
   meta = {
-    homepage = "https://github.com/graywolf/acme-client-portable";
+    homepage = "https://sr.ht/~graywolf/acme-client-portable/";
     description = "Secure ACME/Let's Encrypt client";
     platforms = platforms.unix;
     license = licenses.isc;
diff --git a/pkgs/tools/networking/airfield/node-packages.nix b/pkgs/tools/networking/airfield/node-packages.nix
index 9a246fa319be..66e701626751 100644
--- a/pkgs/tools/networking/airfield/node-packages.nix
+++ b/pkgs/tools/networking/airfield/node-packages.nix
@@ -10,7 +10,7 @@ let
       version = "6.12.0";
       src = fetchurl {
         url = "https://registry.npmjs.org/ajv/-/ajv-6.12.0.tgz";
-        sha512 = "D6gFiFA0RRLyUbvijN74DWAjXSFxWKaWP7mldxkVhyhAV3+SWA9HEJPHQ2c9soIeTFJqcSdFDGFgdqs1iUU2Hw==";
+        sha512 = "0gkcic96nmpcq311i2jfwbaa961x0mj7mkl7iwk213hyn4jgxbl0a472lcpg9dr7ybacn3i45fj6q0dz3g8rqmva7r14i9la240ba0g";
       };
     };
     "asn1-0.2.4" = {
@@ -19,7 +19,7 @@ let
       version = "0.2.4";
       src = fetchurl {
         url = "https://registry.npmjs.org/asn1/-/asn1-0.2.4.tgz";
-        sha512 = "jxwzQpLQjSmWXgwaCZE9Nz+glAG01yF1QnWgbhGwHI5A6FRIEY6IVqtHhIepHqI7/kyEyQEagBC5mBEFlIYvdg==";
+        sha512 = "1v2z1ll0l8rif8hh0d03jc49kz3p8hym63q8ixbas48w4a8akl413hwn08nx83m89sj3mxl06aa0grp7n8hj6hcbsb2k3fhj913674g";
       };
     };
     "assert-plus-1.0.0" = {
@@ -55,7 +55,7 @@ let
       version = "1.9.1";
       src = fetchurl {
         url = "https://registry.npmjs.org/aws4/-/aws4-1.9.1.tgz";
-        sha512 = "wMHVg2EOHaMRxbzgFJ9gtjOOCrI80OHLG14rxi28XwOW8ux6IiEbRCGGGqCtdAIg4FQCbW20k9RsT4y3gJlFug==";
+        sha512 = "2x4b6c0ny64yv6ljfs6sv82akh200klmnh1m1i18hdj28ksxkr9c0szphnwcasy3g5y3l1wn858wcxnc2gi9q5wql8s678fc61xbhf0";
       };
     };
     "bcrypt-pbkdf-1.0.2" = {
@@ -100,7 +100,7 @@ let
       version = "1.0.8";
       src = fetchurl {
         url = "https://registry.npmjs.org/combined-stream/-/combined-stream-1.0.8.tgz";
-        sha512 = "FQN4MRfuJeHf7cBbBMJFXhKSDq+2kAArBlmRBvcvFE5BB1HZKXtSFASDhdlz9zOYwxh8lDdnvmMOe/+5cdoEdg==";
+        sha512 = "1v09nkip7zpn3k3prkkg53w331rhczpfgcqb0q42i97nafra43l2khl5zvhd4ar0qmh145nmw7944jy8p108ny0xpgy29gf2wqph0qm";
       };
     };
     "commander-0.6.1" = {
@@ -172,7 +172,7 @@ let
       version = "4.1.1";
       src = fetchurl {
         url = "https://registry.npmjs.org/debug/-/debug-4.1.1.tgz";
-        sha512 = "pYAIzeRo8J6KPEaJ0VWOh5Pzkbw/RetuzehGM7QRRX5he4fPHx2rdKMB256ehJCkX+XRQm16eZLqLNS8RSZXZw==";
+        sha512 = "1kmf9j5pka2rsljg5x6shniwmgs9444ksgdn0d3fjmis7yghxxn2zj526s36ip8rmpfni9zpj8z74w7irax32a67j59xw38wk6hi055";
       };
     };
     "delayed-stream-1.0.0" = {
@@ -190,7 +190,7 @@ let
       version = "1.4.1";
       src = fetchurl {
         url = "https://registry.npmjs.org/denque/-/denque-1.4.1.tgz";
-        sha512 = "OfzPuSZKGcgr96rf1oODnfjqBFmr1DVoc/TrItj3Ohe0Ah1C5WX5Baquw/9U9KovnQ88EqmJbD66rKYUQYN1tQ==";
+        sha512 = "2spb0s12jkarfiydj4sj4iw1yfjzaplakzw7bma0pwnbra23l1b85rsyzc25szlfdl3bm5bb42fmy4xhf1xdpxaywmwh6aa4swwzz1r";
       };
     };
     "ecc-jsbn-0.1.2" = {
@@ -208,7 +208,7 @@ let
       version = "3.0.2";
       src = fetchurl {
         url = "https://registry.npmjs.org/extend/-/extend-3.0.2.tgz";
-        sha512 = "fjquC59cD7CyW6urNXK0FBufkZcoiGG80wTuPujX590cB5Ttln20E2UB4S/WARVqhXffZl2LNgS+gQdPIIim/g==";
+        sha512 = "3zad2109w3q3gh46s5msrnzfy2nl581sqpy20b52fs7v5pdjh3irpg7szl3xvh4sfy63218jy8ry6qlnir3baxbbfrb03swkw5swfky";
       };
     };
     "extsprintf-1.3.0" = {
@@ -226,7 +226,7 @@ let
       version = "3.1.1";
       src = fetchurl {
         url = "https://registry.npmjs.org/fast-deep-equal/-/fast-deep-equal-3.1.1.tgz";
-        sha512 = "8UEa58QDLauDNfpbrX55Q9jrGHThw2ZMdOky5Gl1CDtVeJDPVrG4Jxx1N8jw2gkWaff5UUuX1KJd+9zGe2B+ZA==";
+        sha512 = "1j7wq3vqvfgnpd2sjblnlgryxlic2fsy343fx8w4ywb2mngj1w5afq8fmly8cp9fi66dhz1fhcfpn23g5zasnzs6n1snb83qkkilhgi";
       };
     };
     "fast-json-stable-stringify-2.1.0" = {
@@ -235,7 +235,7 @@ let
       version = "2.1.0";
       src = fetchurl {
         url = "https://registry.npmjs.org/fast-json-stable-stringify/-/fast-json-stable-stringify-2.1.0.tgz";
-        sha512 = "lhd/wF+Lk98HZoTCtlVraHtfh5XYijIjalXck7saUtuanSDyLMxnHhSXEDJqHxD7msR8D0uCmqlkwjCV8xvwHw==";
+        sha512 = "0gz06zkjlqc4r59ka14n3vwqjdgn40zd8r115ql3rkwqb7j42frmnsj3axr7p2md8ik52nqjn3myyv8ddavdhl4cq3xz4wbbz07y5wn";
       };
     };
     "forever-agent-0.6.1" = {
@@ -253,7 +253,7 @@ let
       version = "2.3.3";
       src = fetchurl {
         url = "https://registry.npmjs.org/form-data/-/form-data-2.3.3.tgz";
-        sha512 = "1lLKB2Mu3aGP1Q/2eCOx0fNbRMe7XdwktwOruhfqqd0rIJWwN4Dh+E3hrPSlDCXnSR7UtZ1N38rVXm+6+MEhJQ==";
+        sha512 = "0jj3hgqp9pmxmfavx6rvdfl3r4yf98clpsarqadz3hq0dxhjlh2ppd9x8bvmaq3nwjdqpdvqx25pwyin4ipixhgsn7s3p9fcc3wllnn";
       };
     };
     "formidable-1.0.11" = {
@@ -298,7 +298,7 @@ let
       version = "5.1.3";
       src = fetchurl {
         url = "https://registry.npmjs.org/har-validator/-/har-validator-5.1.3.tgz";
-        sha512 = "sNvOCzEQNr/qrvJgc3UG/kD4QtlHycrzwS+6mfTrrSq97BvaYcPZZI1ZSqGSPR73Cxn4LKTD4PttRwfU7jWq5g==";
+        sha512 = "3kaldgfsh3lfvgvw31s8b7q345zf7ixjahllncdckcw6qfs3gnbsamdxgs9kfigq7rwmja7v51ghh7y0rsp6q7jmvmbydhh645wxnxh";
       };
     };
     "http-signature-1.2.0" = {
@@ -352,7 +352,7 @@ let
       version = "0.4.1";
       src = fetchurl {
         url = "https://registry.npmjs.org/json-schema-traverse/-/json-schema-traverse-0.4.1.tgz";
-        sha512 = "xbbCH5dCYU5T8LcEhhuh7HJ88HXuW3qsI3Y0zOZFKfZEHcpWiHU/Jxzk629Brsab/mMiHQti9wMP+845RPe3Vg==";
+        sha512 = "1bbgxs4777gn3q3yxi0n792cgz9pimf85pypr0w4wzpb22nr8fl9xi98pkcqd3n4fn7lnzffpq7qwpcl4dqc15py19lwqa2jwgw5dn5";
       };
     };
     "json-stringify-safe-5.0.1" = {
@@ -397,7 +397,7 @@ let
       version = "1.43.0";
       src = fetchurl {
         url = "https://registry.npmjs.org/mime-db/-/mime-db-1.43.0.tgz";
-        sha512 = "+5dsGEEovYbT8UY9yD7eE4XTc4UwJ1jBYlgaQQF38ENsKR3wj/8q8RFZrF9WIZpB2V1ArTVFUva8sAul1NzRzQ==";
+        sha512 = "36x3p6lll5v1g7na92kbba0bpcl36i1argsqn8iy4mgz3zh3llnqhzhfw0l26jqcb0mh9rhhmrx718kvqzchga6y79qdg9884c6r5zv";
       };
     };
     "mime-types-2.1.26" = {
@@ -406,7 +406,7 @@ let
       version = "2.1.26";
       src = fetchurl {
         url = "https://registry.npmjs.org/mime-types/-/mime-types-2.1.26.tgz";
-        sha512 = "01paPWYgLrkqAyrlDorC1uDwl2p3qZT7yl806vW7DvDoxwXi46jsjFbg+WdwotBIk6/MbEhO/dh5aZ5sNj/dWQ==";
+        sha512 = "1cxsgrndjg6jyfqzm74hv6cmy9lil52f1kzkq2niknaiqz20p3yiw0fpgsyld2zrbxr9abpdabz1q6nqa50xr9a0cmbjbi0cqymlnnk";
       };
     };
     "mkdirp-0.3.3" = {
@@ -424,7 +424,7 @@ let
       version = "2.1.2";
       src = fetchurl {
         url = "https://registry.npmjs.org/ms/-/ms-2.1.2.tgz";
-        sha512 = "sGkPx+VjMtmA6MX27oA4FBFELFCZZ4S4XqeGOXCv68tT+jb3vk/RyaKWP0PTKyWtmLSM0b+adUTEvbs1PEaH2w==";
+        sha512 = "3dqfiiw6nxvvi24fndbzlccnjcas99bsd1kz5m2r78lzgpp6vx57jzbmxq3k1m7bsw88rwra0n4848l720fxxn5x20djck3wp3hysdh";
       };
     };
     "oauth-sign-0.9.0" = {
@@ -433,7 +433,7 @@ let
       version = "0.9.0";
       src = fetchurl {
         url = "https://registry.npmjs.org/oauth-sign/-/oauth-sign-0.9.0.tgz";
-        sha512 = "fexhUFFPTGV8ybAtSIGbV6gOkSv8UtRbDBnAyLQw4QPKkgNlsH2ByPGtMUqdWkos6YCRmAqViwgZrJc/mRDzZQ==";
+        sha512 = "1jz644r7ybsq688ifahm64ih3ljqjjskm533bgir20pvc350f9cl0z162scih0r1idx8lpw5f8hxa2pkf0lhbdhr5y6ak2ga5863v3x";
       };
     };
     "pause-0.0.1" = {
@@ -460,7 +460,7 @@ let
       version = "1.7.0";
       src = fetchurl {
         url = "https://registry.npmjs.org/psl/-/psl-1.7.0.tgz";
-        sha512 = "5NsSEDv8zY70ScRnOTn7bK7eanl2MvFrOrS/R6x+dBt5g1ghnj9Zv90kO8GwT8gxcu2ANyFprnFYB85IogIJOQ==";
+        sha512 = "0whj0m29370fn3imrlj2dw0xmr33j2gn30kn96xpxckz7i1b21pj6vlgsn4ggxl79mz2ckng5mdxbkczcwkjry497s8xkgw7c815nz4";
       };
     };
     "punycode-2.1.1" = {
@@ -469,7 +469,7 @@ let
       version = "2.1.1";
       src = fetchurl {
         url = "https://registry.npmjs.org/punycode/-/punycode-2.1.1.tgz";
-        sha512 = "XRsRjdf+j5ml+y/6GKHPZbrF/8p2Yga0JPtdqTIY2Xe5ohJPD9saDJJLPvp9+NSBprVvevdXZybnj2cv8OEd0A==";
+        sha512 = "381vqgh5xkqzrr6cxbzfykgnnk83m7qgpx3wjwj1hddn3sg2aibjxyr30rajpgv4js0cqknrbzwbfk5ryhiiyigzfjrk3zysy6i26sx";
       };
     };
     "qs-0.5.1" = {
@@ -487,7 +487,7 @@ let
       version = "6.5.2";
       src = fetchurl {
         url = "https://registry.npmjs.org/qs/-/qs-6.5.2.tgz";
-        sha512 = "N5ZAX4/LxJmF+7wN74pUD6qAh9/wnvdQcjq9TZjevvXzSUo7bfmw91saqMjzGS2xq91/odN2dW/WOl7qQHNDGA==";
+        sha512 = "0c46ws0x9g3mmkgfmvd78bzvnmv2b8ryg4ah6jvyyqgjv9v994z7xdyvsc4vg9sf98gg7phvy3q1ahgaj5fy3dwzf2rki6bixgl15ip";
       };
     };
     "range-parser-0.0.4" = {
@@ -505,7 +505,7 @@ let
       version = "1.5.0";
       src = fetchurl {
         url = "https://registry.npmjs.org/redis-commands/-/redis-commands-1.5.0.tgz";
-        sha512 = "6KxamqpZ468MeQC3bkWmCB1fp56XL64D4Kf0zJSwDZbVLLm7KFkoIcHrgRvQ+sk8dnhySs7+yBg94yIkAK7aJg==";
+        sha512 = "0kdmbh04hif6g8qr3zcwjkjg1v3rjgss0dq3sy144l5ja5vp4ndb5hdn2acrx57w01swbwpkskmy788lr2nxdq0g46azqsrmad5mb78";
       };
     };
     "redis-errors-1.2.0" = {
@@ -532,7 +532,7 @@ let
       version = "5.2.0";
       src = fetchurl {
         url = "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.2.0.tgz";
-        sha512 = "fZEwUGbVl7kouZs1jCdMLdt95hdIv0ZeHg6L7qPeciMZhZ+/gdesW4wgTARkrFWEpspjEATAzUGPG8N2jJiwbg==";
+        sha512 = "1pb164cfv1ip3s1rp008433rak88mdcch24q84cbfndg0dzky2ij8vjvsiyx2qf3rg4dgs82zk7vnrd9hkqqdcvp4lbk5ymcr8314bx";
       };
     };
     "safer-buffer-2.1.2" = {
@@ -541,7 +541,7 @@ let
       version = "2.1.2";
       src = fetchurl {
         url = "https://registry.npmjs.org/safer-buffer/-/safer-buffer-2.1.2.tgz";
-        sha512 = "YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg==";
+        sha512 = "2v99f22kh56y72d3s8wrgdvf5n10ry40dh3fwnsxr4d5rfvxdfxfmc3qyqkscnj4f8799jy9bpg6cm21x2d811dr9ib83wjrlmkg6k1";
       };
     };
     "send-0.1.0" = {
@@ -559,7 +559,7 @@ let
       version = "1.16.1";
       src = fetchurl {
         url = "https://registry.npmjs.org/sshpk/-/sshpk-1.16.1.tgz";
-        sha512 = "HXXqVUq7+pcKeLqqZj6mHFUMvXtOJt1uoUx09pFW6011inTMxqI8BA8PM95myrIyyKwdnzjdFjLiE6KBPVtJIg==";
+        sha512 = "0i4jnrxh6i17qij2vfki7qxmk435cnacvg363qg0hya5incfj57akgbas8zcx2cl5pds9jfgfyhqm8wlqz6damsg059gymv99aylx8x";
       };
     };
     "tough-cookie-2.5.0" = {
@@ -568,7 +568,7 @@ let
       version = "2.5.0";
       src = fetchurl {
         url = "https://registry.npmjs.org/tough-cookie/-/tough-cookie-2.5.0.tgz";
-        sha512 = "nlLsUzgm1kfLXSXfRZMc1KLAugd4hqJHDTvc2hDIwS3mZAfMEuMbc03SujMF+GEcpaX/qboeycw6iO8JwVv2+g==";
+        sha512 = "3xgcny117pqhfncr4gbmagzlnjiqqgq0lrvmljdfcdy64nc0xjfcbf1r08dmp1v1m3s51kq0yxc18nl3j9lbpr5bp5lgmi6719yqlly";
       };
     };
     "tunnel-agent-0.6.0" = {
@@ -595,7 +595,7 @@ let
       version = "1.9.2";
       src = fetchurl {
         url = "https://registry.npmjs.org/underscore/-/underscore-1.9.2.tgz";
-        sha512 = "D39qtimx0c1fI3ya1Lnhk3E9nONswSKhnffBI0gME9C99fYOkNi04xs8K6pePLhvl1frbDemkaBQ5ikWllR2HQ==";
+        sha512 = "0fpcm4n2qlycl50j6k3fv7baybnzf1wbsm2ng0vwfsdi40fyvsvvl0k1i427hgpknhj5hbcwff3swckw6wx96kw4dgwvldi56v6lzqg";
       };
     };
     "uri-js-4.2.2" = {
@@ -604,7 +604,7 @@ let
       version = "4.2.2";
       src = fetchurl {
         url = "https://registry.npmjs.org/uri-js/-/uri-js-4.2.2.tgz";
-        sha512 = "KY9Frmirql91X2Qgjry0Wd4Y+YTdrdZheS8TFwvkbLWf/G5KNJDCh6pKL5OZctEW4+0Baa5idK2ZQuELRwPznQ==";
+        sha512 = "2fz60s71ghl56ddfiiaws81xpiidlbjk69jyjmahz190d2advy9zdbcwh5if4rgg5hxdbfxhkwiipjrnjy8w834bxsmzambd2p4b3r9";
       };
     };
     "uuid-3.4.0" = {
@@ -613,7 +613,7 @@ let
       version = "3.4.0";
       src = fetchurl {
         url = "https://registry.npmjs.org/uuid/-/uuid-3.4.0.tgz";
-        sha512 = "HjSDRw6gZE5JMggctHBcjVak08+KEVhSIiDzFnT9S9aegmp85S/bReBVTb4QTFaRNptJ9kuYaNhnbNEOkbKb/A==";
+        sha512 = "3y9pcli1v8nqryqd2c4pxj9kcv92mjc22z4smg08pdjzrbwda19xmjbzms1dwr04995h4carz9s8mldbiqb8708694lwr501r3q6d0y";
       };
     };
     "verror-1.10.0" = {
@@ -706,7 +706,7 @@ in
     version = "3.0.2";
     src = fetchurl {
       url = "https://registry.npmjs.org/redis/-/redis-3.0.2.tgz";
-      sha512 = "PNhLCrjU6vKVuMOyFu7oSP296mwBkcE6lrAjruBYG5LgdSqtRBoVQIylrMyVZD/lkF24RSNNatzvYag6HRBHjQ==";
+      sha512 = "26lf40x7al63vywd96j6idqbn8fagv4jp6ar9cc80aili5d59sy14hvb3haw8xhjqxc3481dkmbvza8x3p1dcn3p2az5snlp054pn1w";
     };
     dependencies = [
       sources."denque-1.4.1"
@@ -730,7 +730,7 @@ in
     version = "4.0.4";
     src = fetchurl {
       url = "https://registry.npmjs.org/connect-redis/-/connect-redis-4.0.4.tgz";
-      sha512 = "aXk7btMlG0J5LqtPNRpFKa5fglzlTzukYNx+Fq8cghbUIQHN/gyK9c3+b0XEROMwiSxMoZDADqjp9tdpUoZLAg==";
+      sha512 = "014p1jjd7bzdsd81v0918ac5j4k1qs4qi2nzzndyn50rznd04hx85l23jpicznwc2j3nkz5bj15zbi98ld3akxb5rwl46r5sdp3nyb9";
     };
     buildInputs = globalBuildInputs;
     meta = {
@@ -748,7 +748,7 @@ in
     version = "3.2.0";
     src = fetchurl {
       url = "https://registry.npmjs.org/async/-/async-3.2.0.tgz";
-      sha512 = "TR2mEZFVOj2pLStYxLht7TyfuRzaydfpxr3k9RpHIzMgw7A64dzsdqCxH1WJyQdoe8T10nDXd9wnEigmiuHIZw==";
+      sha512 = "1kwiqca4ql149ywfzbp1lpmqixnh1y9i5aizcd0fvndrq9sn31j0cr38wdgbr5xqvlxgjfs3jwryg7ddnwc8n1b5nlksfjmj48sc7ad";
     };
     buildInputs = globalBuildInputs;
     meta = {
@@ -766,7 +766,7 @@ in
     version = "2.88.2";
     src = fetchurl {
       url = "https://registry.npmjs.org/request/-/request-2.88.2.tgz";
-      sha512 = "MsvtOrfG9ZcrOwAW+Qi+F6HbD0CWXEh9ou77uOb7FM2WPhwT7smM833PzanhJLsgXjN89Ir6V2PczXNnMpwKhw==";
+      sha512 = "23hm71jcxrwvp33azx8mx3w6dg21fr4w6lwvkvxyf6ckvhk3hz9dk8lzgkbiyzfl9ylhp4n807xp88ppq4gj5h07cmrgxf6nwxfvjrj";
     };
     dependencies = [
       sources."ajv-6.12.0"
diff --git a/pkgs/tools/networking/amass/default.nix b/pkgs/tools/networking/amass/default.nix
index ebe67b27e7c7..e2bc592f7a8f 100644
--- a/pkgs/tools/networking/amass/default.nix
+++ b/pkgs/tools/networking/amass/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "amass";
-  version = "3.6.2";
+  version = "3.7.2";
 
   src = fetchFromGitHub {
     owner = "OWASP";
     repo = "Amass";
     rev = "v${version}";
-    sha256 = "1ih681790sp0lqfbsl153dpr5vzxp1jjza28pajrqjzs7zyjmkgs";
+    sha256 = "1acjqpa9xg9ji2mzxag57yq589cdq3rh78a8vz8wnkkkp7b8why8";
   };
 
-  vendorSha256 = "1f8za3z5pv1pznbd91fk5j4y8qg93qk5zvnchjl7inyirciawdf6";
+  vendorSha256 = "1s8g0qqg3m6hdvc5v3s86l3ba5grmyhx0lf2ymi39k5dpcg8l19s";
 
   outputs = [ "out" "wordlists" ];
 
diff --git a/pkgs/tools/networking/axel/default.nix b/pkgs/tools/networking/axel/default.nix
index 3f5a7612d16b..5cd8e41f70c8 100644
--- a/pkgs/tools/networking/axel/default.nix
+++ b/pkgs/tools/networking/axel/default.nix
@@ -3,13 +3,13 @@
 
 stdenv.mkDerivation rec {
   pname = "axel";
-  version = "2.17.8";
+  version = "2.17.9";
 
   src = fetchFromGitHub {
     owner = "axel-download-accelerator";
     repo = pname;
     rev = "v${version}";
-    sha256 = "05hispf152ywlf7i29cc7alxal8lc7lfzx82r42zncdb9v78pdc8";
+    sha256 = "1bhzgvvqcwa5bd487400hg1nycvw8qqxzbzvq5ywyz5d9j12hdrd";
   };
 
   nativeBuildInputs = [ autoreconfHook pkgconfig autoconf-archive txt2man ];
diff --git a/pkgs/tools/networking/cassowary/default.nix b/pkgs/tools/networking/cassowary/default.nix
index be1df3394396..e76a505fe9d7 100644
--- a/pkgs/tools/networking/cassowary/default.nix
+++ b/pkgs/tools/networking/cassowary/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "cassowary";
-  version = "0.7.0";
+  version = "0.11.0";
 
   src = fetchFromGitHub {
     owner = "rogerwelin";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0p5vcs25h5nj36dm9yjmdjymcq0zldm3zlqfppxcjx862h48k8zj";
+    sha256 = "161wzcdq7kpny6fzxsqk2ivnah0xwmh2knv37jn0x18lclga1k9s";
   };
 
-  vendorSha256 = "1m5jaqf5jrib415k0i7w6rf5bjjwfn572wk94jwfpwjcbbvh8fck";
+  vendorSha256 = "1qgilmkai9isbbg4pzqic6i8v5z8cay0ilw1gb69z4a6f2q4zhkp";
 
   buildFlagsArray = [ "-ldflags=-s -w -X main.version=${version}" ];
 
diff --git a/pkgs/tools/networking/corerad/default.nix b/pkgs/tools/networking/corerad/default.nix
index a4eb50d0c773..bbdb98ae4950 100644
--- a/pkgs/tools/networking/corerad/default.nix
+++ b/pkgs/tools/networking/corerad/default.nix
@@ -2,20 +2,20 @@
 
 buildGoModule rec {
   pname = "corerad";
-  version = "0.2.5";
+  version = "0.2.6";
 
   src = fetchFromGitHub {
     owner = "mdlayher";
     repo = "corerad";
     rev = "v${version}";
-    sha256 = "0fi9wgv5aj3ds3r5qjyi4pxnd56psrpdy2sz84jd0sz2w48x4k4p";
+    sha256 = "16rwydvqkzi0jlgwpl3d4f8zd35y4lv4h5xa30ybqmwwp1k5ymf0";
   };
 
-  vendorSha256 = "11r3vpimhik7y09gwb3p6pl0yf53hpaw24ry4a833fw8060rqp3q";
+  vendorSha256 = "1431fvi9b0id3zhgkxhiampc5avvp998lncyd5l2gn5py3qz6sdl";
 
   buildFlagsArray = ''
     -ldflags=
-    -X github.com/mdlayher/corerad/internal/build.linkTimestamp=1590182656
+    -X github.com/mdlayher/corerad/internal/build.linkTimestamp=1591474872
     -X github.com/mdlayher/corerad/internal/build.linkVersion=v${version}
   '';
 
diff --git a/pkgs/tools/networking/curl/default.nix b/pkgs/tools/networking/curl/default.nix
index ba54b2c5671c..11a928a3ef13 100644
--- a/pkgs/tools/networking/curl/default.nix
+++ b/pkgs/tools/networking/curl/default.nix
@@ -28,14 +28,15 @@ assert brotliSupport -> brotli != null;
 assert gssSupport -> libkrb5 != null;
 
 stdenv.mkDerivation rec {
-  name = "curl-7.69.1";
+  pname = "curl";
+  version = "7.70.0";
 
   src = fetchurl {
     urls = [
-      "https://curl.haxx.se/download/${name}.tar.bz2"
-      "https://github.com/curl/curl/releases/download/${lib.replaceStrings ["."] ["_"] name}/${name}.tar.bz2"
+      "https://curl.haxx.se/download/${pname}-${version}.tar.bz2"
+      "https://github.com/curl/curl/releases/download/${lib.replaceStrings ["."] ["_"] pname}-${version}/${pname}-${version}.tar.bz2"
     ];
-    sha256 = "1s2ddjjif1wkp69vx25nzxklhimgqzaazfzliyl6mpvsa2yybx9g";
+    sha256 = "1l19b2xmzwjl2fqlbv46kwlz1823miaxczyx2a5lz8k7mmigw2x5";
   };
 
   outputs = [ "bin" "dev" "out" "man" "devdoc" ];
@@ -119,8 +120,8 @@ stdenv.mkDerivation rec {
   meta = with stdenv.lib; {
     description = "A command line tool for transferring files with URL syntax";
     homepage    = "https://curl.haxx.se/";
-    maintainers = with maintainers; [ lovek323 ];
     license = licenses.curl;
+    maintainers = with maintainers; [ lovek323 ];
     platforms = platforms.all;
   };
 }
diff --git a/pkgs/tools/networking/dnscrypt-proxy2/default.nix b/pkgs/tools/networking/dnscrypt-proxy2/default.nix
index 7f16d9478f3f..d5b92c17a65a 100644
--- a/pkgs/tools/networking/dnscrypt-proxy2/default.nix
+++ b/pkgs/tools/networking/dnscrypt-proxy2/default.nix
@@ -1,16 +1,16 @@
-{ stdenv, buildGoPackage, fetchFromGitHub }:
+{ stdenv, buildGoModule, fetchFromGitHub }:
 
-buildGoPackage rec {
+buildGoModule rec {
   pname = "dnscrypt-proxy2";
-  version = "2.0.42";
+  version = "2.0.44";
 
-  goPackagePath = "github.com/jedisct1/dnscrypt-proxy";
+  vendorSha256 = null;
 
   src = fetchFromGitHub {
-    owner = "jedisct1";
+    owner = "DNSCrypt";
     repo = "dnscrypt-proxy";
     rev = version;
-    sha256 = "1v4n0pkwcilxm4mnj4fsd4gf8pficjj40jnmfkiwl7ngznjxwkyw";
+    sha256 = "08bg60j5z349blj5sip1f8f793q12ix3zmqkayym5nf69s1pfm7l";
   };
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/networking/dnsproxy/default.nix b/pkgs/tools/networking/dnsproxy/default.nix
index b868f075b9b5..8c98f316aae1 100644
--- a/pkgs/tools/networking/dnsproxy/default.nix
+++ b/pkgs/tools/networking/dnsproxy/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "dnsproxy";
-  version = "0.28.1";
+  version = "0.29.0";
 
   src = fetchFromGitHub {
     owner = "AdguardTeam";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1pa4skrhdcblqs8r1kik5g8h9p6pcin5pd7b1dh7xk2n86xs8j22";
+    sha256 = "164l97x1g20a61jkb2dwwmf63md3np9x2m59dri3qf22k4rl4l0d";
   };
 
   vendorSha256 = null;
diff --git a/pkgs/tools/networking/findomain/default.nix b/pkgs/tools/networking/findomain/default.nix
index e19442576988..69e09b60d02a 100644
--- a/pkgs/tools/networking/findomain/default.nix
+++ b/pkgs/tools/networking/findomain/default.nix
@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "findomain";
-  version = "1.5.0";
+  version = "1.7.0";
 
   src = fetchFromGitHub {
     owner = "Edu4rdSHL";
     repo = pname;
     rev = version;
-    sha256 = "1w3parmk3836v5ghn3cgcxyk0alk05r5ljl3j1fpnly5xvl131rd";
+    sha256 = "1q8yxl4y8f787a0q87gxgj1p9lgzhhfk3fgysq9xj8yfvwm8abji";
   };
 
-  cargoSha256 = "1cs076cgkzjan6y78a3bhriv2q2s83hp5vzhkjwz4dqn83r6b8hx";
+  cargoSha256 = "02d538j13v3f1dc99vpzhby42ps7lig000idwdsxa1mwkjxrf2z2";
 
   nativeBuildInputs = [ installShellFiles perl ];
   buildInputs = lib.optional stdenv.isDarwin Security;
diff --git a/pkgs/tools/networking/flannel/default.nix b/pkgs/tools/networking/flannel/default.nix
index a52088ed231d..7ecfb559dcc7 100644
--- a/pkgs/tools/networking/flannel/default.nix
+++ b/pkgs/tools/networking/flannel/default.nix
@@ -4,7 +4,7 @@ with lib;
 
 buildGoPackage rec {
   pname = "flannel";
-  version = "0.11.0";
+  version = "0.12.0";
   rev = "v${version}";
 
   goPackagePath = "github.com/coreos/flannel";
@@ -13,7 +13,7 @@ buildGoPackage rec {
     inherit rev;
     owner = "coreos";
     repo = "flannel";
-    sha256 = "0akxlrrsm2w51g0qd7dnsdy0hdajx98sdhxw4iknjr2kn7j3gph9";
+    sha256 = "04g7rzgyi3xs3sf5p1a9dmd08crdrz6y1b02ziv3444qk40jyswd";
   };
 
   meta = {
diff --git a/pkgs/tools/networking/goimapnotify/default.nix b/pkgs/tools/networking/goimapnotify/default.nix
new file mode 100644
index 000000000000..fb64ff65cc15
--- /dev/null
+++ b/pkgs/tools/networking/goimapnotify/default.nix
@@ -0,0 +1,26 @@
+{ buildGoPackage, fetchFromGitLab, lib }:
+
+buildGoPackage rec {
+  pname = "goimapnotify";
+  version = "2.0";
+
+  goPackagePath = "gitlab.com/shackra/goimapnotify";
+
+  src = fetchFromGitLab {
+    owner = "shackra";
+    repo = "goimapnotify";
+    rev = "${version}";
+    sha256 = "1d42gd3m2rkvy985d181dbcm5i3f7xsg2z8z6s4bpvw24pfnzs42";
+  };
+
+  goDeps = ./deps.nix;
+
+  meta = with lib; {
+    description =
+      "Execute scripts on IMAP mailbox changes (new/deleted/updated messages) using IDLE";
+    homepage = "https://gitlab.com/shackra/goimapnotify";
+    license = licenses.gpl3Plus;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ wohanley ];
+  };
+}
diff --git a/pkgs/tools/networking/goimapnotify/deps.nix b/pkgs/tools/networking/goimapnotify/deps.nix
new file mode 100644
index 000000000000..fc377c50be4c
--- /dev/null
+++ b/pkgs/tools/networking/goimapnotify/deps.nix
@@ -0,0 +1,66 @@
+# file generated from Gopkg.lock using dep2nix (https://github.com/nixcloud/dep2nix)
+[
+  {
+    goPackagePath = "github.com/emersion/go-imap";
+    fetch = {
+      type = "git";
+      url = "https://github.com/emersion/go-imap";
+      rev = "b7db4a2bc5cc04fb568fb036a438da43ee9a9f78";
+      sha256 = "1v5hp02k9rfdq7gqiydz575dw6a991pspynhxypv0fvgh1vgqs0s";
+    };
+  }
+  {
+    goPackagePath = "github.com/emersion/go-imap-idle";
+    fetch = {
+      type = "git";
+      url = "https://github.com/emersion/go-imap-idle";
+      rev = "2af93776db6b042cc1116b0d0af00d7f58eea696";
+      sha256 = "19dh8sryjr3a8f0bgwywiz2fqccxhf4j66sm0w1jkjzh131f3pr7";
+    };
+  }
+  {
+    goPackagePath = "github.com/emersion/go-sasl";
+    fetch = {
+      type = "git";
+      url = "https://github.com/emersion/go-sasl";
+      rev = "7e096a0a6197b89989e8cc31016daa67c8c62051";
+      sha256 = "0mr9nzi4wc3ck730zqfqwmy8wk7d90h80yvvivqnxyfyadqy48kd";
+    };
+  }
+  {
+    goPackagePath = "github.com/konsorten/go-windows-terminal-sequences";
+    fetch = {
+      type = "git";
+      url = "https://github.com/konsorten/go-windows-terminal-sequences";
+      rev = "f55edac94c9bbba5d6182a4be46d86a2c9b5b50e";
+      sha256 = "09mn209ika7ciy87xf2x31dq5fnqw39jidgaljvmqxwk7ff1hnx7";
+    };
+  }
+  {
+    goPackagePath = "github.com/sirupsen/logrus";
+    fetch = {
+      type = "git";
+      url = "https://github.com/sirupsen/logrus";
+      rev = "8bdbc7bcc01dcbb8ec23dc8a28e332258d25251f";
+      sha256 = "1m7ny9jkb98cxqhsp13xa5hnqh1s9f25x04q6arsala4zswsw33c";
+    };
+  }
+  {
+    goPackagePath = "golang.org/x/sys";
+    fetch = {
+      type = "git";
+      url = "https://go.googlesource.com/sys";
+      rev = "a129542de9ae0895210abff9c95d67a1f33cb93d";
+      sha256 = "13p5q7s25rsvfkk8fcwf432j8djf7bjg7chs296rzlig4vqcdxi4";
+    };
+  }
+  {
+    goPackagePath = "golang.org/x/text";
+    fetch = {
+      type = "git";
+      url = "https://go.googlesource.com/text";
+      rev = "342b2e1fbaa52c93f31447ad2c6abc048c63e475";
+      sha256 = "0flv9idw0jm5nm8lx25xqanbkqgfiym6619w575p7nrdh0riqwqh";
+    };
+  }
+]
diff --git a/pkgs/tools/networking/haproxy/default.nix b/pkgs/tools/networking/haproxy/default.nix
index c5aeaaa7bb43..c43edd040e7b 100644
--- a/pkgs/tools/networking/haproxy/default.nix
+++ b/pkgs/tools/networking/haproxy/default.nix
@@ -11,11 +11,11 @@ assert usePcre -> pcre != null;
 
 stdenv.mkDerivation rec {
   pname = "haproxy";
-  version = "2.1.4";
+  version = "2.1.6";
 
   src = fetchurl {
     url = "https://www.haproxy.org/download/${stdenv.lib.versions.majorMinor version}/src/${pname}-${version}.tar.gz";
-    sha256 = "1kcizs5r538chhpwqykdngxyqfi98i03akfjnii721npjvv0y0si";
+    sha256 = "1pyz4gckdn8982vpb1iiw9agwp2s5p8wc0nn1qh1ic0wq3lrnpg6";
   };
 
   buildInputs = [ openssl zlib ]
diff --git a/pkgs/tools/networking/i2pd/default.nix b/pkgs/tools/networking/i2pd/default.nix
index 191035f59f27..b686ea4d04f2 100644
--- a/pkgs/tools/networking/i2pd/default.nix
+++ b/pkgs/tools/networking/i2pd/default.nix
@@ -9,13 +9,13 @@ assert upnpSupport -> miniupnpc != null;
 
 stdenv.mkDerivation rec {
   pname = "i2pd";
-  version = "2.30.0";
+  version = "2.32.1";
 
   src = fetchFromGitHub {
     owner = "PurpleI2P";
     repo = pname;
     rev = version;
-    sha256 = "nGl7c5UY9kJPRaMveMF+aIf8T11WFrB//37oKzREdvM=";
+    sha256 = "15ng2c7i3jxmhpc2q0dl8arc72qbsq9y9paz5hgln907yy7dqx7c";
   };
 
   buildInputs = with stdenv.lib; [ boost zlib openssl ]
diff --git a/pkgs/tools/networking/ip2unix/default.nix b/pkgs/tools/networking/ip2unix/default.nix
index 1d4a6a5545f6..269dd0f1f34e 100644
--- a/pkgs/tools/networking/ip2unix/default.nix
+++ b/pkgs/tools/networking/ip2unix/default.nix
@@ -5,13 +5,13 @@
 
 stdenv.mkDerivation rec {
   pname = "ip2unix";
-  version = "2.1.2";
+  version = "2.1.3";
 
   src = fetchFromGitHub {
     owner = "nixcloud";
     repo = "ip2unix";
     rev = "v${version}";
-    sha256 = "1ci0k3zy3hjkg65ah5h75mfvrd578xf2z1449xmgjm3iz3d6kqs2";
+    sha256 = "19c449h60b2m1d8kawnhpi4y9y4ddm24jmlh8kilqmx8m5l2khr6";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/networking/isync/default.nix b/pkgs/tools/networking/isync/default.nix
index 49efeac02a97..9ce1183d060c 100644
--- a/pkgs/tools/networking/isync/default.nix
+++ b/pkgs/tools/networking/isync/default.nix
@@ -26,6 +26,6 @@ stdenv.mkDerivation rec {
     '';
     license = licenses.gpl2Plus;
     platforms = platforms.unix;
-    maintainers = with maintainers; [ primeos ];
+    maintainers = with maintainers; [ primeos lheckemann ];
   };
 }
diff --git a/pkgs/tools/networking/megatools/default.nix b/pkgs/tools/networking/megatools/default.nix
index b729e9961857..43bbc62be954 100644
--- a/pkgs/tools/networking/megatools/default.nix
+++ b/pkgs/tools/networking/megatools/default.nix
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
     description = "Command line client for Mega.co.nz";
     homepage = "https://megatools.megous.com/";
     license = licenses.gpl2Plus;
-    maintainers = [ maintainers.viric maintainers.AndersonTorres ];
+    maintainers = with maintainers; [ viric AndersonTorres zowoq ];
     platforms = platforms.unix;
   };
 }
diff --git a/pkgs/tools/networking/memtier-benchmark/default.nix b/pkgs/tools/networking/memtier-benchmark/default.nix
index 3579002e4169..a45c3a2e33a1 100644
--- a/pkgs/tools/networking/memtier-benchmark/default.nix
+++ b/pkgs/tools/networking/memtier-benchmark/default.nix
@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   pname = "memtier-benchmark";
-  version = "1.2.17";
+  version = "1.3.0";
 
   src = fetchFromGitHub {
     owner  = "redislabs";
     repo   = "memtier_benchmark";
     rev    = "refs/tags/${version}";
-    sha256 = "18cka6sv3w8ffa81126nzi04if9g1wd3i3apxsgmv7xm2p8fsa39";
+    sha256 = "0m2qnnc71qpdj8w421bxn0zxz6ddvzy7b0n19jvyncnzvk1ff0sq";
   };
 
   patchPhase = ''
diff --git a/pkgs/tools/networking/minidlna/default.nix b/pkgs/tools/networking/minidlna/default.nix
index 0fbd76855a7d..6a14b5f1c82d 100644
--- a/pkgs/tools/networking/minidlna/default.nix
+++ b/pkgs/tools/networking/minidlna/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, ffmpeg, flac, libvorbis, libogg, libid3tag, libexif, libjpeg, sqlite, gettext }:
+{ stdenv, fetchurl, ffmpeg_3, flac, libvorbis, libogg, libid3tag, libexif, libjpeg, sqlite, gettext }:
 
 let version = "1.2.1"; in
 
@@ -15,7 +15,7 @@ stdenv.mkDerivation {
     export makeFlags="INSTALLPREFIX=$out"
   '';
 
-  buildInputs = [ ffmpeg flac libvorbis libogg libid3tag libexif libjpeg sqlite gettext ];
+  buildInputs = [ ffmpeg_3 flac libvorbis libogg libid3tag libexif libjpeg sqlite gettext ];
 
   postInstall = ''
     mkdir -p $out/share/man/man{5,8}
diff --git a/pkgs/tools/networking/modem-manager/default.nix b/pkgs/tools/networking/modem-manager/default.nix
index 7329d78c2c83..c3981b902f2b 100644
--- a/pkgs/tools/networking/modem-manager/default.nix
+++ b/pkgs/tools/networking/modem-manager/default.nix
@@ -3,12 +3,12 @@
 
 stdenv.mkDerivation rec {
   pname = "modem-manager";
-  version = "1.12.8";
+  version = "1.12.10";
 
   package = "ModemManager";
   src = fetchurl {
     url = "https://www.freedesktop.org/software/${package}/${package}-${version}.tar.xz";
-    sha256 = "1zrsf57bn9rmaa2qvavr1aisci76vwlx0viqpwmkw3ds2l33vdb8";
+    sha256 = "1apq9camys2gaw6y6ic1ld20cncfwpmxnzvh4j5zkbbjpf5hbcxj";
   };
 
   nativeBuildInputs = [ vala gobject-introspection gettext pkgconfig ];
diff --git a/pkgs/tools/networking/mu/default.nix b/pkgs/tools/networking/mu/default.nix
index 430607a0c3ba..fc693bae212d 100644
--- a/pkgs/tools/networking/mu/default.nix
+++ b/pkgs/tools/networking/mu/default.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "mu";
-  version = "1.4.7";
+  version = "1.4.10";
 
   src = fetchFromGitHub {
     owner  = "djcb";
     repo   = "mu";
     rev    = version;
-    sha256 = "0inn720prhgxxc1napzd3xyzqgsvv70gqddsyzaa84h6946iz6v5";
+    sha256 = "10vnqlpphjkkiji42sfs954l1zfgwnic7mmpr4nx6yx44z619v0y";
   };
 
   postPatch = stdenv.lib.optionalString (batchSize != null) ''
@@ -50,6 +50,7 @@ stdenv.mkDerivation rec {
     description = "A collection of utilties for indexing and searching Maildirs";
     license = licenses.gpl3Plus;
     homepage = "https://www.djcbsoftware.nl/code/mu/";
+    changelog = "https://github.com/djcb/mu/releases/tag/${version}";
     maintainers = with maintainers; [ antono peterhoeg ];
     platforms = platforms.mesaPlatforms;
   };
diff --git a/pkgs/tools/networking/network-manager/fortisslvpn/default.nix b/pkgs/tools/networking/network-manager/fortisslvpn/default.nix
index 0ce50a3b2d4b..3cc4133b41cf 100644
--- a/pkgs/tools/networking/network-manager/fortisslvpn/default.nix
+++ b/pkgs/tools/networking/network-manager/fortisslvpn/default.nix
@@ -1,10 +1,24 @@
-{ stdenv, fetchurl, substituteAll, openfortivpn, intltool, pkgconfig, file, gtk3,
-networkmanager, ppp, libsecret, withGnome ? true, gnome3, fetchpatch, libnma }:
+{ stdenv
+, fetchurl
+, substituteAll
+, openfortivpn
+, gettext
+, pkg-config
+, file
+, glib
+, gtk3
+, networkmanager
+, ppp
+, libsecret
+, withGnome ? true
+, gnome3
+, fetchpatch
+, libnma
+}:
 
-let
+stdenv.mkDerivation rec {
   pname = "NetworkManager-fortisslvpn";
   version = "1.2.10";
-in stdenv.mkDerivation {
   name = "${pname}${if withGnome then "-gnome" else ""}-${version}";
 
   src = fetchurl {
@@ -17,6 +31,7 @@ in stdenv.mkDerivation {
       src = ./fix-paths.patch;
       inherit openfortivpn;
     })
+
     # Don't use etc/dbus-1/system.d
     (fetchpatch {
       url = "https://gitlab.gnome.org/GNOME/NetworkManager-fortisslvpn/merge_requests/11.patch";
@@ -24,21 +39,34 @@ in stdenv.mkDerivation {
     })
   ];
 
-  buildInputs = [ openfortivpn networkmanager ppp ]
-    ++ stdenv.lib.optionals withGnome [ gtk3 libsecret libnma ];
+  nativeBuildInputs = [
+    gettext
+    pkg-config
+    file
+  ];
 
-  nativeBuildInputs = [ intltool pkgconfig file ];
+  buildInputs = [
+    openfortivpn
+    networkmanager
+    ppp
+    glib
+  ] ++ stdenv.lib.optionals withGnome [
+    gtk3
+    libsecret
+    libnma
+  ];
 
   configureFlags = [
-    "--without-libnm-glib"
     "--with-gnome=${if withGnome then "yes" else "no"}"
     "--localstatedir=/var"
     "--enable-absolute-paths"
   ];
 
-  # the installer only create an empty directory in localstatedir, so
-  # we can drop it
-  installFlags = [ "localstatedir=." ];
+  installFlags = [
+    # the installer only creates an empty directory in localstatedir, so
+    # we can drop it
+    "localstatedir=."
+  ];
 
   passthru = {
     updateScript = gnome3.updateScript {
@@ -48,9 +76,8 @@ in stdenv.mkDerivation {
   };
 
   meta = with stdenv.lib; {
-    description = "NetworkManager's FortiSSL plugin";
+    description = "NetworkManager’s FortiSSL plugin";
     inherit (networkmanager.meta) maintainers platforms;
     license = licenses.gpl2;
   };
 }
-
diff --git a/pkgs/tools/networking/openapi-generator-cli/default.nix b/pkgs/tools/networking/openapi-generator-cli/default.nix
index 2e5695ff4525..2b09fe901d07 100644
--- a/pkgs/tools/networking/openapi-generator-cli/default.nix
+++ b/pkgs/tools/networking/openapi-generator-cli/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
   ];
 
   src = fetchurl {
-    url = "http://central.maven.org/maven2/org/openapitools/${pname}/${version}/${jarfilename}";
+    url = "mirror://maven/org/openapitools/${pname}/${version}/${jarfilename}";
     sha256 = "1pafv432ll3pp52580pbnk0gnrm6byl5fkrf1rarhxfkpkr82yif";
   };
 
diff --git a/pkgs/tools/networking/openconnect_pa/default.nix b/pkgs/tools/networking/openconnect_pa/default.nix
index 2c452847aa3b..4b108dc303e8 100644
--- a/pkgs/tools/networking/openconnect_pa/default.nix
+++ b/pkgs/tools/networking/openconnect_pa/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation {
   };
 
   preConfigure = ''
-      export PKG_CONFIG=${pkgconfig}/bin/pkg-config
+      export PKG_CONFIG=${pkgconfig}/bin/${pkgconfig.targetPrefix}pkg-config
       export LIBXML2_CFLAGS="-I ${libxml2.dev}/include/libxml2"
       export LIBXML2_LIBS="-L${libxml2.out}/lib -lxml2"
   '';
diff --git a/pkgs/tools/networking/openfortivpn/default.nix b/pkgs/tools/networking/openfortivpn/default.nix
index bd1c02f9b545..a5e46c6bc575 100644
--- a/pkgs/tools/networking/openfortivpn/default.nix
+++ b/pkgs/tools/networking/openfortivpn/default.nix
@@ -3,7 +3,7 @@
 with stdenv.lib;
 
 let repo = "openfortivpn";
-    version = "1.14.0";
+    version = "1.14.1";
 
 in stdenv.mkDerivation {
   name = "${repo}-${version}";
@@ -12,7 +12,7 @@ in stdenv.mkDerivation {
     owner = "adrienverge";
     inherit repo;
     rev = "v${version}";
-    sha256 = "1qn48sp3ydbik7nc9x5l22gvvnr99f89jy1lvnf64bdg218kr0z7";
+    sha256 = "1r9lp19fmqx9dw33j5967ydijbnacmr80mqnhbbxyqiw4k5c10ds";
   };
 
   nativeBuildInputs = [ autoreconfHook pkgconfig ];
diff --git a/pkgs/tools/networking/openssh/default.nix b/pkgs/tools/networking/openssh/default.nix
index ad5072342f15..1703e8c75594 100644
--- a/pkgs/tools/networking/openssh/default.nix
+++ b/pkgs/tools/networking/openssh/default.nix
@@ -5,7 +5,7 @@
 , withGssapiPatches ? false
 , kerberos
 , libfido2
-, withFIDO ? stdenv.hostPlatform.isUnix
+, withFIDO ? stdenv.hostPlatform.isUnix && !stdenv.hostPlatform.isMusl
 , linkOpenssl? true
 }:
 
diff --git a/pkgs/tools/networking/privoxy/default.nix b/pkgs/tools/networking/privoxy/default.nix
index 331295ffd1f4..10a25d5bf8b2 100644
--- a/pkgs/tools/networking/privoxy/default.nix
+++ b/pkgs/tools/networking/privoxy/default.nix
@@ -1,6 +1,6 @@
 { stdenv, fetchurl, autoreconfHook, zlib, pcre, w3m, man }:
 
-stdenv.mkDerivation rec{
+stdenv.mkDerivation rec {
 
   pname = "privoxy";
   version = "3.0.28";
diff --git a/pkgs/tools/networking/shadowsocks-rust/default.nix b/pkgs/tools/networking/shadowsocks-rust/default.nix
index ba90a7cacb77..875ba7c988a6 100644
--- a/pkgs/tools/networking/shadowsocks-rust/default.nix
+++ b/pkgs/tools/networking/shadowsocks-rust/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "shadowsocks-rust";
-  version = "1.8.11";
+  version = "1.8.12";
 
   src = fetchFromGitHub {
     rev = "v${version}";
     owner = "shadowsocks";
     repo = pname;
-    sha256 = "0imnvx3v0msk9qf72zy1qg5q52dmc8xfs9iwdwa2q13scjslgmwn";
+    sha256 = "0c9mdy22pjnjq5l2ji2whrfz64azx6yi6m76j17pbhnjf6f4jx9b";
   };
 
-  cargoSha256 = "1aqqx0pdq3vp5c06pjwsrbrqfkz5dhxnpvv3vnr3pqfm62xrffgg";
+  cargoSha256 = "03gf26d7rz4v2v5fypcp5icsqqnb4m5dwil9ad5a98q3ssx80iwq";
 
   SODIUM_USE_PKG_CONFIG = 1;
 
diff --git a/pkgs/tools/networking/slirp4netns/default.nix b/pkgs/tools/networking/slirp4netns/default.nix
index 5aa3219e5b10..6f8446d2243b 100644
--- a/pkgs/tools/networking/slirp4netns/default.nix
+++ b/pkgs/tools/networking/slirp4netns/default.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation rec {
   pname = "slirp4netns";
-  version = "1.0.1";
+  version = "1.1.1";
 
   src = fetchFromGitHub {
     owner = "rootless-containers";
     repo = "slirp4netns";
     rev = "v${version}";
-    sha256 = "1p5cvq0jsjkl136b8cz3j552x01g96j38ygh6m8ss62bmyzb8ayc";
+    sha256 = "0zwaa7lqf8vh4c9mx0ganyz15a6qkisyxyxggmshfsxw77k6djxy";
   };
 
   nativeBuildInputs = [ autoreconfHook pkg-config ];
diff --git a/pkgs/tools/networking/tendermint/default.nix b/pkgs/tools/networking/tendermint/default.nix
index 93b0b69f22f1..4c0f87efbc4e 100644
--- a/pkgs/tools/networking/tendermint/default.nix
+++ b/pkgs/tools/networking/tendermint/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "tendermint";
-  version = "0.32.12";
+  version = "0.33.5";
 
   src = fetchFromGitHub {
     owner = "tendermint";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1d3q5d49pzh86brrwp4kfsxs0n9zdmcnkminarg3wl9w97qrjsr6";
+    sha256 = "0a6wm1gnr75mdfhzb9cgg4an655vln525slgp10r5abg9j3l8202";
   };
 
-  vendorSha256 = "1vhd3s6yxfhirgipxcy0rh8sk55cdzirr8n8r31sijgyak92mq0l";
+  vendorSha256 = "0i0n89lal99fqnzva51kp9f7wzqsfmncpshwxhq26kvykp7ji7sw";
 
   meta = with stdenv.lib; {
     description = "Byzantine-Fault Tolerant State Machines. Or Blockchain, for short.";
diff --git a/pkgs/tools/networking/tinyproxy/default.nix b/pkgs/tools/networking/tinyproxy/default.nix
index 1a476676a258..7d3c49db7b79 100644
--- a/pkgs/tools/networking/tinyproxy/default.nix
+++ b/pkgs/tools/networking/tinyproxy/default.nix
@@ -1,7 +1,7 @@
 { stdenv, fetchFromGitHub, autoreconfHook, asciidoc, libxml2,
   libxslt, docbook_xsl }:
 
-stdenv.mkDerivation rec{
+stdenv.mkDerivation rec {
   pname = "tinyproxy";
   version = "1.10.0";
 
diff --git a/pkgs/tools/networking/tridactyl-native/default.nix b/pkgs/tools/networking/tridactyl-native/default.nix
index c2ea4ee62d85..7072fb96edab 100644
--- a/pkgs/tools/networking/tridactyl-native/default.nix
+++ b/pkgs/tools/networking/tridactyl-native/default.nix
@@ -7,13 +7,13 @@ stdenv.mkDerivation rec {
   pname = "tridactyl-native";
   # this is actually the version of tridactyl itself; the native messenger will
   # probably not change with every tridactyl version
-  version = "1.19.0";
+  version = "1.19.1";
 
   src = fetchFromGitHub {
     owner = "tridactyl";
     repo = "tridactyl";
     rev = version;
-    sha256 = "1myqhhjilj9sjvvw64f2931jqgvwv60ajqngw790ygcs4vr7gmfk";
+    sha256 = "19hldr6ii1z7gghc80h7qsnlz9na586gldm5y33i6lrs93193l82";
   };
   sourceRoot = "source/native";
 
diff --git a/pkgs/tools/networking/unbound/default.nix b/pkgs/tools/networking/unbound/default.nix
index c03f68c36e2f..6390ab35f956 100644
--- a/pkgs/tools/networking/unbound/default.nix
+++ b/pkgs/tools/networking/unbound/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "unbound";
-  version = "1.10.0";
+  version = "1.10.1";
 
   src = fetchurl {
     url = "https://unbound.net/downloads/${pname}-${version}.tar.gz";
-    sha256 = "0mg9divpysr42sp0m693a70693dp8025v6c9dv1yabr4g1jlhbqm";
+    sha256 = "0dnmh9jjh2v274f0hl31bgv40pl77mmfgky8bkqr5kvi3b17fdmp";
   };
 
   # https://github.com/NLnetLabs/unbound/pull/90
diff --git a/pkgs/tools/networking/v2ray/default.nix b/pkgs/tools/networking/v2ray/default.nix
index 762d68acdb1f..0f0c5961c009 100644
--- a/pkgs/tools/networking/v2ray/default.nix
+++ b/pkgs/tools/networking/v2ray/default.nix
@@ -3,20 +3,20 @@
 , ... } @ args:
 
 callPackage ./generic.nix (rec {
-  version = "4.23.0";
+  version = "4.23.3";
 
   src = fetchFromGitHub {
     owner = "v2ray";
     repo = "v2ray-core";
     rev = "v${version}";
-    sha256 = "0if53d1blj1wf572z21dsywx6czbmhs5dpccx5z1knjhh2xgg9lm";
+    sha256 = "1b0cxrpgkmgas7pwxglsvgcig8rnhffkf990b42z7awji5lw055v";
   };
 
   assets = {
     # MIT licensed
     "geoip.dat" = let
-      geoipRev = "202003180002";
-      geoipSha256 = "08d383phc5qk7glq25nkf1g8za38415x2952phy525ail88afpwl";
+      geoipRev = "202005270003";
+      geoipSha256 = "10gf69hr32p4bpl5j8r46v8xzhpcgm70xbcdxm1a8l0jwyj0infs";
     in fetchurl {
       url = "https://github.com/v2ray/geoip/releases/download/${geoipRev}/geoip.dat";
       sha256 = geoipSha256;
@@ -24,8 +24,8 @@ callPackage ./generic.nix (rec {
 
     # MIT licensed
     "geosite.dat" = let
-      geositeRev = "202003221514";
-      geositeSha256 = "1d4gv6714m97i57srrzybnmc4322qv5lypkqbmhcxb8bi4ljpf1m";
+      geositeRev = "202005292154";
+      geositeSha256 = "0w6l0q8y14in5f4a406blpprqq6p438gpclnlfz7y2hkh5zf36cr";
     in fetchurl {
       url = "https://github.com/v2ray/domain-list-community/releases/download/${geositeRev}/dlc.dat";
       sha256 = geositeSha256;
diff --git a/pkgs/tools/networking/v2ray/generic.nix b/pkgs/tools/networking/v2ray/generic.nix
index e4831f5dced7..e8f4d278c322 100644
--- a/pkgs/tools/networking/v2ray/generic.nix
+++ b/pkgs/tools/networking/v2ray/generic.nix
@@ -13,7 +13,7 @@ let
     pname = "v2ray-core";
     inherit version src;
 
-  vendorSha256 = "1lh8382gyss01frq4gxyx9p26p5m8f158qfw55sy5wb7ddrafcc2";
+    vendorSha256 = "0d2qmnmlkl884ccg0qcd2yhfj0dwxnb9dz3cih7rcipz85w2f2rs";
 
     buildPhase = ''
       runHook preBuild
diff --git a/pkgs/tools/networking/wifite2/default.nix b/pkgs/tools/networking/wifite2/default.nix
index 505e461e4806..101c4643a77f 100644
--- a/pkgs/tools/networking/wifite2/default.nix
+++ b/pkgs/tools/networking/wifite2/default.nix
@@ -3,14 +3,14 @@
 , hcxdumptool, pyrit, which }:
 
 python3.pkgs.buildPythonApplication rec {
-  version = "2.5.3";
+  version = "2.5.5";
   pname = "wifite2";
 
   src = fetchFromGitHub {
     owner = "kimocoder";
     repo = "wifite2";
     rev = version;
-    sha256 = "080hbjpbgdnzr6jkmg5cb8dvzxm57zpi4c9x0y92yy472vqll3ax";
+    sha256 = "0rh54gj471dn8442imxwasjrrwzsx4m40nylkw3y6p8rbjmb92h4";
   };
 
   patches = [
diff --git a/pkgs/tools/package-management/cargo-deb/default.nix b/pkgs/tools/package-management/cargo-deb/default.nix
index c6e8b4803ccf..96ef0eef8c5a 100644
--- a/pkgs/tools/package-management/cargo-deb/default.nix
+++ b/pkgs/tools/package-management/cargo-deb/default.nix
@@ -2,7 +2,9 @@
 , lib
 , fetchFromGitHub
 , rustPlatform
-, Security }:
+, rust
+, Security
+}:
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-deb";
@@ -19,6 +21,13 @@ rustPlatform.buildRustPackage rec {
 
   cargoSha256 = "1vqnnqn6rzkdi239bh3lk7gaxr7w6v3c4ws4ya1ah04g6v9hkzlw";
 
+  checkType = "debug";
+
+  preCheck = ''
+    substituteInPlace tests/command.rs \
+      --replace 'target/debug' "target/${rust.toRustTarget stdenv.buildPlatform}/debug"
+  '';
+
   meta = with lib; {
     description = "Generate Debian packages from information in Cargo.toml";
     homepage = "https://github.com/mmstick/cargo-deb";
diff --git a/pkgs/tools/package-management/nfpm/default.nix b/pkgs/tools/package-management/nfpm/default.nix
index c7ad0c30e435..4c04f24b26c3 100644
--- a/pkgs/tools/package-management/nfpm/default.nix
+++ b/pkgs/tools/package-management/nfpm/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "nfpm";
-  version = "1.2.1";
+  version = "1.3.1";
 
   src = fetchFromGitHub {
     owner = "goreleaser";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0q0472kfsm7h9p1g7yvd9k62myv5db3shpmjv39cx9rkfn6z8482";
+    sha256 = "14083sxim17nwmq7w7wvq9sq9pai860v8a2q14vz16hd2i427aqp";
   };
 
-  vendorSha256 = "07xg8cm7pqpnb96drcmzk7rj2dhfn4pd8vr2a7nxqizd3qk6d5bf";
+  vendorSha256 = "0v86fwi1i6b8ngf60ag31mrbah45f0ncqhrjdk5494f139c26067";
 
   buildFlagsArray = [ "-ldflags=-s -w -X main.version=${version}" ];
 
diff --git a/pkgs/tools/package-management/nix-universal-prefetch/default.nix b/pkgs/tools/package-management/nix-universal-prefetch/default.nix
index 7079904735d7..224ccd1cd9ed 100644
--- a/pkgs/tools/package-management/nix-universal-prefetch/default.nix
+++ b/pkgs/tools/package-management/nix-universal-prefetch/default.nix
@@ -6,13 +6,13 @@
 # No gems used, so mkDerivation is fine.
 stdenv.mkDerivation rec {
   pname = "nix-universal-prefetch";
-  version = "0.2.0";
+  version = "0.3.0";
 
   src = fetchFromGitHub {
     owner = "samueldr";
     repo = "nix-universal-prefetch";
     rev = "v${version}";
-    sha256 = "1id9iaibrm2d3fa9dkcxnb3sd0j1vh502181gdd199a1cfsmzh1i";
+    sha256 = "1nmxp6846ip2x3mibys3ymgi0813g18p9szqnsciiib3dbis4kwf";
   };
 
   installPhase = ''
diff --git a/pkgs/tools/package-management/nix/default.nix b/pkgs/tools/package-management/nix/default.nix
index 4337705db2f0..363a7cb04988 100644
--- a/pkgs/tools/package-management/nix/default.nix
+++ b/pkgs/tools/package-management/nix/default.nix
@@ -21,8 +21,8 @@ common =
   , stateDir
   , confDir
   , withLibseccomp ? lib.any (lib.meta.platformMatch stdenv.hostPlatform) libseccomp.meta.platforms, libseccomp
-  , withAWS ? stdenv.isLinux || stdenv.isDarwin, aws-sdk-cpp
-
+  , withAWS ? !enableStatic && (stdenv.isLinux || stdenv.isDarwin), aws-sdk-cpp
+  , enableStatic ? false
   , name, suffix ? "", src, crates ? null
 
   }:
@@ -65,12 +65,21 @@ common =
       propagatedBuildInputs = [ boehmgc ];
 
       # Seems to be required when using std::atomic with 64-bit types
-      NIX_LDFLAGS = lib.optionalString (stdenv.hostPlatform.system == "armv5tel-linux" || stdenv.hostPlatform.system == "armv6l-linux") "-latomic";
+      NIX_LDFLAGS =
+        # need to list libraries individually until
+        # https://github.com/NixOS/nix/commit/3e85c57a6cbf46d5f0fe8a89b368a43abd26daba
+        # is in a release
+          lib.optionalString enableStatic "-lssl -lbrotlicommon -lssh2 -lz -lnghttp2 -lcrypto"
+
+        # need to detect it here until
+        # https://github.com/NixOS/nix/commits/74b4737d8f0e1922ef5314a158271acf81cd79f8
+        # is in a release
+        + lib.optionalString (stdenv.hostPlatform.system == "armv5tel-linux" || stdenv.hostPlatform.system == "armv6l-linux") "-latomic";
 
       preConfigure =
         # Copy libboost_context so we don't get all of Boost in our closure.
         # https://github.com/NixOS/nixpkgs/issues/45462
-        ''
+        lib.optionalString (!enableStatic) ''
           mkdir -p $out/lib
           cp -pd ${boost}/lib/{libboost_context*,libboost_thread*,libboost_system*} $out/lib
           rm -f $out/lib/*.a
@@ -178,10 +187,10 @@ in rec {
   nix = nixStable;
 
   nixStable = callPackage common (rec {
-    name = "nix-2.3.5";
+    name = "nix-2.3.6";
     src = fetchurl {
       url = "https://nixos.org/releases/nix/${name}/${name}.tar.xz";
-      sha256 = "25445353c27d7c2703cd74216bce6458a02068965055d111765ac4186ed678c1";
+      sha256 = "05e90529c9dc9f4bf656cbceae61cafdca49935bb79cd291c8f078a095701d89";
     };
 
     inherit storeDir stateDir confDir boehmgc;
@@ -216,7 +225,7 @@ in rec {
       owner = "NixOS";
       repo = "nix";
       rev = "00b562c87ec4c3bbe514f5dc1f4d1c41f66f66bf";
-      hash = "sha256-GqTFh4wBfkKapixKyd3gA9C1tF0PSzZDD5LN+5nQEWk=";
+      sha256 = "0s8is2czpkcj1x1kcjqgbnsbbl03w3fwjjiclsd44zh1ij3wb90s";
     };
 
     crates = fetchurl {
diff --git a/pkgs/tools/package-management/nixui/node-packages.nix b/pkgs/tools/package-management/nixui/node-packages.nix
index f822bdb53332..b5b42e9164a2 100644
--- a/pkgs/tools/package-management/nixui/node-packages.nix
+++ b/pkgs/tools/package-management/nixui/node-packages.nix
@@ -64,7 +64,7 @@ let
       version = "1.9.2";
       src = fetchurl {
         url = "https://registry.npmjs.org/underscore/-/underscore-1.9.2.tgz";
-        sha512 = "D39qtimx0c1fI3ya1Lnhk3E9nONswSKhnffBI0gME9C99fYOkNi04xs8K6pePLhvl1frbDemkaBQ5ikWllR2HQ==";
+        sha512 = "0fpcm4n2qlycl50j6k3fv7baybnzf1wbsm2ng0vwfsdi40fyvsvvl0k1i427hgpknhj5hbcwff3swckw6wx96kw4dgwvldi56v6lzqg";
       };
     };
   };
diff --git a/pkgs/tools/package-management/reuse/default.nix b/pkgs/tools/package-management/reuse/default.nix
index 13a3a85f082d..b51f0d061a9f 100644
--- a/pkgs/tools/package-management/reuse/default.nix
+++ b/pkgs/tools/package-management/reuse/default.nix
@@ -4,13 +4,13 @@ with python3Packages;
 
 buildPythonApplication rec {
   pname = "reuse";
-  version = "0.7.0";
+  version = "0.11.0";
 
   src = fetchFromGitHub {
     owner = "fsfe";
     repo = "reuse-tool";
     rev = "v${version}";
-    sha256 = "04i8zd66cs152h28k9085nqg937wp31pz2yqywaldx1gywijyd8h";
+    sha256 = "08dzvrv28ylbq1bm16lakwzyqq530fcbrl71k33zyb84mvgszy97";
   };
 
   propagatedBuildInputs = [
@@ -21,6 +21,7 @@ buildPythonApplication rec {
     license-expression
     requests
     setuptools
+    setuptools_scm
   ];
 
   checkInputs = [ pytest ];
diff --git a/pkgs/tools/package-management/rpm/default.nix b/pkgs/tools/package-management/rpm/default.nix
index fdcf9832e667..fee282de52fc 100644
--- a/pkgs/tools/package-management/rpm/default.nix
+++ b/pkgs/tools/package-management/rpm/default.nix
@@ -1,15 +1,15 @@
-{ stdenv
+{ stdenv, lib
 , pkgconfig, autoreconfHook
 , fetchurl, cpio, zlib, bzip2, file, elfutils, libbfd, libarchive, nspr, nss, popt, db, xz, python, lua
 }:
 
 stdenv.mkDerivation rec {
   pname = "rpm";
-  version = "4.14.2.1";
+  version = "4.15.1";
 
   src = fetchurl {
-    url = "http://ftp.rpm.org/releases/rpm-4.14.x/rpm-${version}.tar.bz2";
-    sha256 = "1nmck2fq9h85fgs3zhh6w1avlw5y16cbz5khd459ry3jfd5w4f8i";
+    url = "http://ftp.rpm.org/releases/rpm-${lib.versions.majorMinor version}.x/rpm-${version}.tar.bz2";
+    sha256 = "0c6jwail90fhha3bpx70w4a2i8ycxwvnx6zwxm121l8wc3wlbvyx";
   };
 
   outputs = [ "out" "dev" "man" ];
diff --git a/pkgs/tools/security/aflplusplus/default.nix b/pkgs/tools/security/aflplusplus/default.nix
index f99be6d75758..a0ef58ae8b61 100644
--- a/pkgs/tools/security/aflplusplus/default.nix
+++ b/pkgs/tools/security/aflplusplus/default.nix
@@ -1,6 +1,6 @@
 { stdenv, stdenvNoCC, fetchFromGitHub, callPackage, makeWrapper
-, clang_9, llvm_9, gcc, which, libcgroup, python, perl, gmp
-, file, cmocka, wine ? null, fetchpatch
+, clang, llvm, gcc, which, libcgroup, python, perl, gmp
+, file, wine ? null, fetchpatch
 }:
 
 # wine fuzzing is only known to work for win32 binaries, and using a mixture of
@@ -17,38 +17,28 @@ let
   libtokencap = callPackage ./libtokencap.nix { inherit aflplusplus; };
   aflplusplus = stdenvNoCC.mkDerivation rec {
     pname = "aflplusplus";
-    version = "2.64c";
+    version = "2.65c";
 
     src = fetchFromGitHub {
       owner = "AFLplusplus";
       repo = "AFLplusplus";
       rev = version;
-      sha256 = "0n618pk6nlmkcbv1qm05fny4mnhcprrw0ppmra1phvk1y22iildj";
+      sha256 = "1np2a3kypb2m8nyv6qnij18yzn41pl8619jzydci40br4vxial9l";
     };
     enableParallelBuilding = true;
 
-    # build of unsigaction32 broken in 2.64c:
-    # https://github.com/AFLplusplus/AFLplusplus/commit/079fdbf9bc5be1adba19e4bd08be965bd4dd79dc#commitcomment-38428357
-    # The applied patch fixes it.
-    patches = [
-      (fetchpatch {
-        url = "https://github.com/AFLplusplus/AFLplusplus/commit/5b9928f1a9d4b017ea04365ca8b522fde71236eb.patch";
-        sha256 = "1m4w9w4jaxb2mjkwvr6r4qa2j5cdzzpchjphpwd95861h0zvb6hh";
-      })
-    ];
-
     # Note: libcgroup isn't needed for building, just for the afl-cgroup
     # script.
-    nativeBuildInputs = [ makeWrapper which clang_9 gcc ];
-    buildInputs = [ llvm_9 python gmp ]
+    nativeBuildInputs = [ makeWrapper which clang gcc ];
+    buildInputs = [ llvm python gmp ]
       ++ stdenv.lib.optional (wine != null) python.pkgs.wrapPython;
 
 
     postPatch = ''
       # Replace the CLANG_BIN variables with the correct path
       substituteInPlace llvm_mode/afl-clang-fast.c \
-        --replace "CLANGPP_BIN" '"${clang_9}/bin/clang++"' \
-        --replace "CLANG_BIN" '"${clang_9}/bin/clang"' \
+        --replace "CLANGPP_BIN" '"${clang}/bin/clang++"' \
+        --replace "CLANG_BIN" '"${clang}/bin/clang"' \
         --replace 'getenv("AFL_PATH")' "(getenv(\"AFL_PATH\") ? getenv(\"AFL_PATH\") : \"$out/lib/afl\")"
 
       # Replace "gcc" and friends with full paths in afl-gcc
@@ -115,7 +105,7 @@ let
         wrapPythonProgramsIn $out/bin ${python.pkgs.pefile}
     '';
 
-    installCheckInputs = [ perl file cmocka ];
+    installCheckInputs = [ perl file ];
     doInstallCheck = true;
     installCheckPhase = ''
       # replace references to tools in build directory with references to installed locations
@@ -123,7 +113,7 @@ let
         --replace '../libcompcov.so' '`$out/bin/get-afl-qemu-libcompcov-so`' \
         --replace '../libdislocator.so' '`$out/bin/get-libdislocator-so`' \
         --replace '../libtokencap.so' '`$out/bin/get-libtokencap-so`'
-      perl -pi -e 's|(?<!\.)(\.\./)([^\s\/]+?)(?<!\.c)(?<!\.s?o)(?=\s)|\$out/bin/\2|g' test/test.sh
+      perl -pi -e 's|(?<!\.)(?<!-I)(\.\./)([^\s\/]+?)(?<!\.c)(?<!\.s?o)(?=\s)|\$out/bin/\2|g' test/test.sh
       cd test && ./test.sh
     '';
 
diff --git a/pkgs/tools/security/bitwarden/default.nix b/pkgs/tools/security/bitwarden/default.nix
index f2abc376cd27..2da8840eee1c 100644
--- a/pkgs/tools/security/bitwarden/default.nix
+++ b/pkgs/tools/security/bitwarden/default.nix
@@ -16,11 +16,11 @@ let
   pname = "bitwarden";
 
   version = {
-    x86_64-linux = "1.17.2";
+    x86_64-linux = "1.18.0";
   }.${system} or "";
 
   sha256 = {
-    x86_64-linux = "0v7lrwj3sdypnqayknwg0cg9c2gfsxbjic5wswkfxljy652x8izx";
+    x86_64-linux = "04rry33jccf65smzpjp1dhcirffdb7y36yn8whqaikhsavsawx3j";
   }.${system} or "";
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/security/bitwarden_rs/default.nix b/pkgs/tools/security/bitwarden_rs/default.nix
index 6d3c4bccef9f..f2d0eb9b7d3a 100644
--- a/pkgs/tools/security/bitwarden_rs/default.nix
+++ b/pkgs/tools/security/bitwarden_rs/default.nix
@@ -8,13 +8,13 @@ let
 
 in rustPlatform.buildRustPackage rec {
   pname = "bitwarden_rs";
-  version = "1.14.2";
+  version = "1.15.1";
 
   src = fetchFromGitHub {
     owner = "dani-garcia";
     repo = pname;
     rev = version;
-    sha256 = "0413yjbnj4k917x48h1gnj64kygbr6c1n55f23qkvj0hgbxpgssz";
+    sha256 = "1982bfprixdp8mx2hwidfvsi0zy7wmzf40m9m3cl5r7i2qydznwb";
   };
 
   nativeBuildInputs = [ pkgconfig ];
@@ -25,7 +25,7 @@ in rustPlatform.buildRustPackage rec {
 
   RUSTC_BOOTSTRAP = 1;
 
-  cargoSha256 = "09747f9g7yyq9c8wbfdb3hwxii5xq23ynhba0vc01nhjpjyn0ksd";
+  cargoSha256 = "08cygzgv82i10cj8lkjdah0arrdmlfcbdjwc8piwa629rr0584zf";
   cargoBuildFlags = [ featuresFlag ];
 
   checkPhase = ''
diff --git a/pkgs/tools/security/bundler-audit/Gemfile.lock b/pkgs/tools/security/bundler-audit/Gemfile.lock
index 107e425bc579..f130b57912b4 100644
--- a/pkgs/tools/security/bundler-audit/Gemfile.lock
+++ b/pkgs/tools/security/bundler-audit/Gemfile.lock
@@ -1,10 +1,10 @@
 GEM
   remote: https://rubygems.org/
   specs:
-    bundler-audit (0.6.1)
+    bundler-audit (0.7.0.1)
       bundler (>= 1.2.0, < 3)
-      thor (~> 0.18)
-    thor (0.20.3)
+      thor (>= 0.18, < 2)
+    thor (1.0.1)
 
 PLATFORMS
   ruby
diff --git a/pkgs/tools/security/bundler-audit/default.nix b/pkgs/tools/security/bundler-audit/default.nix
index 6bcb341a8343..c24831f26b06 100644
--- a/pkgs/tools/security/bundler-audit/default.nix
+++ b/pkgs/tools/security/bundler-audit/default.nix
@@ -21,6 +21,7 @@ bundlerEnv rec {
       - Does not require a network connection.
     '';
     homepage    = "https://github.com/rubysec/bundler-audit";
+    changelog   = "https://github.com/rubysec/bundler-audit/blob/v${version}/ChangeLog.md";
     license     = licenses.gpl3Plus;
     maintainers = with maintainers; [ primeos nicknovitski ];
     platforms   = platforms.unix;
diff --git a/pkgs/tools/security/bundler-audit/gemset.nix b/pkgs/tools/security/bundler-audit/gemset.nix
index 56d78b3e8f16..2121a3c08e55 100644
--- a/pkgs/tools/security/bundler-audit/gemset.nix
+++ b/pkgs/tools/security/bundler-audit/gemset.nix
@@ -1,19 +1,23 @@
 {
   bundler-audit = {
     dependencies = ["thor"];
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0pm22xpn3xyymsainixnrk8v3l3xi9bzwkjkspx00cfzp84xvxbq";
+      sha256 = "04l9rs56rlvihbr2ybkrigjajgd3swa98lxvmdl8iylj1g5m7n0j";
       type = "gem";
     };
-    version = "0.6.1";
+    version = "0.7.0.1";
   };
   thor = {
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1yhrnp9x8qcy5vc7g438amd5j9sw83ih7c30dr6g6slgw9zj3g29";
+      sha256 = "1xbhkmyhlxwzshaqa7swy2bx6vd64mm0wrr8g3jywvxy7hg0cwkm";
       type = "gem";
     };
-    version = "0.20.3";
+    version = "1.0.1";
   };
 }
\ No newline at end of file
diff --git a/pkgs/tools/security/certstrap/default.nix b/pkgs/tools/security/certstrap/default.nix
index fb3c00e48f91..4d2e2fe7e950 100644
--- a/pkgs/tools/security/certstrap/default.nix
+++ b/pkgs/tools/security/certstrap/default.nix
@@ -2,7 +2,7 @@
 
 buildGoPackage rec {
   pname = "certstrap";
-  version = "1.1.1";
+  version = "1.2.0";
 
   goPackagePath = "github.com/square/certstrap";
 
@@ -10,7 +10,7 @@ buildGoPackage rec {
     owner = "square";
     repo = "certstrap";
     rev = "v${version}";
-    sha256 = "0j7gi2nzykny7i0gjax9vixw72l9jcm4wnwxgm72hh1pji0ysa8n";
+    sha256 = "1ymchnn7c9g3pq7rw4lrwsd6z3wfjx90g7qgrw6r5hssl77mnscj";
   };
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/security/chipsec/default.nix b/pkgs/tools/security/chipsec/default.nix
index 387fa4d750bd..5dccf295065c 100644
--- a/pkgs/tools/security/chipsec/default.nix
+++ b/pkgs/tools/security/chipsec/default.nix
@@ -2,13 +2,13 @@
 , kernel ? null, withDriver ? false }:
 pythonPackages.buildPythonApplication rec {
   pname = "chipsec";
-  version = "1.4.9";
+  version = "1.5.1";
 
   src = fetchFromGitHub {
     owner = "chipsec";
     repo = "chipsec";
     rev = version;
-    sha256 = "1p6w8294w5z2f4jwc22mqaggv5qajvmf9iifv7fl7wdz3wsvskrk";
+    sha256 = "1rxr9i08a22m15slvlkrhnki30jixi2ds096kmmc2nqzfr9yibmb";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/security/fprintd/default.nix b/pkgs/tools/security/fprintd/default.nix
index 62f5dda17f67..b14aff386aba 100644
--- a/pkgs/tools/security/fprintd/default.nix
+++ b/pkgs/tools/security/fprintd/default.nix
@@ -40,17 +40,17 @@ stdenv.mkDerivation rec {
     # https://gitlab.freedesktop.org/libfprint/fprintd/-/merge_requests/50
     (fetchpatch {
       url = "https://gitlab.freedesktop.org/libfprint/fprintd/-/commit/d7fec03f24d10f88d34581c72f0eef201f5eafac.patch";
-      sha256 = "QNN05WF4YZ0XiTwm5NkfqZDuQpyXlnrh+RJF9SNsCDk=";
+      sha256 = "0f88dhizai8jz7hpm5lpki1fx4593zcy89iwi4brsqbqc7jp9ls0";
     })
 
     # Fix locating libpam_wrapper for tests
     (fetchpatch {
       url = "https://gitlab.freedesktop.org/libfprint/fprintd/-/merge_requests/40.patch";
-      sha256 = "43uPihK6HhygHw1Qplwci80Wseq/S77VUp+OdEECHmM=";
+      sha256 = "0qqy090p93lzabavwjxzxaqidkcb3ifacl0d3yh1q7ms2a58yyz3";
     })
     (fetchpatch {
       url = "https://gitlab.freedesktop.org/libfprint/fprintd/-/commit/f401f399a85dbeb2de165b9b9162eb552ab6eea7.patch";
-      sha256 = "Pga+/QEkln8DOwGZfKM1r2urJX4Y3X0bozWWxKZ5ia0=";
+      sha256 = "1bc9g6kc95imlcdpvp8qgqjsnsxg6nipr6817c1pz5i407yvw1iy";
     })
   ];
 
diff --git a/pkgs/tools/security/gnupg-pkcs11-scd/default.nix b/pkgs/tools/security/gnupg-pkcs11-scd/default.nix
index 4d6b97c7192e..e173f66f7483 100644
--- a/pkgs/tools/security/gnupg-pkcs11-scd/default.nix
+++ b/pkgs/tools/security/gnupg-pkcs11-scd/default.nix
@@ -7,7 +7,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://github.com/alonbl/${pname}/releases/download/${pname}-${version}/${pname}-${version}.tar.bz2";
-    sha256 = "sha256:1mfh9zjbahjd788rq1mzx009pd7p1sq62sbz586rd7szif7pkpgx";
+    sha256 = "1mfh9zjbahjd788rq1mzx009pd7p1sq62sbz586rd7szif7pkpgx";
   };
 
   buildInputs = [ pkcs11helper pkgconfig openssl ];
diff --git a/pkgs/tools/security/hash_extender/default.nix b/pkgs/tools/security/hash_extender/default.nix
index 6efa780e1cd3..5bda599f0f0c 100644
--- a/pkgs/tools/security/hash_extender/default.nix
+++ b/pkgs/tools/security/hash_extender/default.nix
@@ -2,17 +2,20 @@
 
 stdenv.mkDerivation {
   pname = "hash_extender";
-  version = "2017-04-10";
+  version = "unstable-2020-03-24";
 
   src = fetchFromGitHub {
     owner = "iagox86";
     repo = "hash_extender";
-    rev = "d27581e062dd0b534074e11d7d311f65a6d7af21";
-    sha256 = "1npwbgqaynjh5x39halw43i116v89sxkpa1g1bbvc1lpi8hkhhcb";
+    rev = "cb8aaee49f93e9c0d2f03eb3cafb429c9eed723d";
+    sha256 = "1fj118566hr1wv03az2w0iqknazsqqkak0mvlcvwpgr6midjqi9b";
   };
 
   buildInputs = [ openssl ];
 
+  doCheck = true;
+  checkPhase = "./hash_extender --test";
+
   installPhase = ''
     mkdir -p $out/bin
     cp hash_extender $out/bin
diff --git a/pkgs/tools/security/ibm-sw-tpm2/default.nix b/pkgs/tools/security/ibm-sw-tpm2/default.nix
index 5e1d460a4634..d6e8a521a2fa 100644
--- a/pkgs/tools/security/ibm-sw-tpm2/default.nix
+++ b/pkgs/tools/security/ibm-sw-tpm2/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "ibm-sw-tpm2";
-  version = "1563";
+  version = "1628";
 
   src = fetchurl {
     url = "mirror://sourceforge/ibmswtpm2/ibmtpm${version}.tar.gz";
-    sha256 = "1sfi7drmbm08rgd2414s3sxd7h5g8d4kiwk40xklf7sw67w1ffpw";
+    sha256 = "18wywbsdp5sjrapznk2ydbmx0whz513dhybn1lls24xfl7kp9s58";
   };
 
   buildInputs = [ openssl ];
diff --git a/pkgs/tools/security/keybase/default.nix b/pkgs/tools/security/keybase/default.nix
index bbc99c2ac410..ee1cfa9d2a41 100644
--- a/pkgs/tools/security/keybase/default.nix
+++ b/pkgs/tools/security/keybase/default.nix
@@ -6,7 +6,7 @@
 
 buildGoPackage rec {
   pname = "keybase";
-  version = "5.4.2";
+  version = "5.5.1";
 
   goPackagePath = "github.com/keybase/client";
   subPackages = [ "go/kbnm" "go/keybase" ];
@@ -17,7 +17,7 @@ buildGoPackage rec {
     owner = "keybase";
     repo = "client";
     rev = "v${version}";
-    sha256 = "08lw5aw962f75xi42bwbgba94hiql2n2jnsxrkx84czi0ijs1wlr";
+    sha256 = "03y69zmzbnfay173xkbzvnhh8zjjd2rfnqmpgr0wvh1psn7mgpsh";
   };
 
   patches = [
diff --git a/pkgs/tools/security/keybase/gui.nix b/pkgs/tools/security/keybase/gui.nix
index 054907843909..b745b63ca9d1 100644
--- a/pkgs/tools/security/keybase/gui.nix
+++ b/pkgs/tools/security/keybase/gui.nix
@@ -107,7 +107,7 @@ stdenv.mkDerivation rec {
   meta = with stdenv.lib; {
     homepage = "https://www.keybase.io/";
     description = "The Keybase official GUI";
-    platforms = platforms.linux;
+    platforms = [ "x86_64-linux" ];
     maintainers = with maintainers; [ avaq rvolosatovs puffnfresh np filalex77 ];
     license = licenses.bsd3;
   };
diff --git a/pkgs/tools/security/keycard-cli/default.nix b/pkgs/tools/security/keycard-cli/default.nix
index a76c102b2bb9..73eab6c3dec9 100644
--- a/pkgs/tools/security/keycard-cli/default.nix
+++ b/pkgs/tools/security/keycard-cli/default.nix
@@ -2,7 +2,7 @@
 
 buildGoPackage rec {
   pname = "keycard-cli";
-  version = "0.0.12";
+  version = "0.4.0";
 
   goPackagePath = "github.com/status-im/keycard-cli";
   subPackages = [ "." ];
@@ -14,7 +14,7 @@ buildGoPackage rec {
     owner = "status-im";
     repo = pname;
     rev = version;
-    sha256 = "1jnbaq57i6i9bad1hcvd28mxfqq6v8rv806c6l74vlb79ff4v1wb";
+    sha256 = "0917vl5lw8wgvyn5l8q6xa8bqh342fibaa38syr8hmz8b09qkh38";
   };
 
   buildFlagsArray = [
diff --git a/pkgs/tools/security/keysmith/default.nix b/pkgs/tools/security/keysmith/default.nix
new file mode 100644
index 000000000000..b9ab7bb0b4aa
--- /dev/null
+++ b/pkgs/tools/security/keysmith/default.nix
@@ -0,0 +1,45 @@
+{ lib
+, mkDerivation
+, makeWrapper
+, fetchFromGitHub
+, cmake
+, extra-cmake-modules
+, qtbase
+, qtquickcontrols2
+, qtdeclarative
+, qtgraphicaleffects
+, kirigami2
+, oathToolkit
+}:
+mkDerivation rec {
+
+  pname = "keysmith";
+  version = "0.1";
+
+  src = fetchFromGitHub {
+    owner = "KDE";
+    repo = "keysmith";
+    rev = "v${version}";
+    sha256 = "15fzf0bvarivm32zqa5w71mscpxdac64ykiawc5hx6kplz93bsgx";
+  };
+
+  nativeBuildInputs = [ cmake extra-cmake-modules makeWrapper ];
+
+  buildInputs = [ oathToolkit kirigami2 qtquickcontrols2 qtbase ];
+
+  postInstall = ''
+    mv $out/bin/org.kde.keysmith $out/bin/.org.kde.keysmith-wrapped
+    makeWrapper $out/bin/.org.kde.keysmith-wrapped $out/bin/org.kde.keysmith \
+      --set QML2_IMPORT_PATH "${lib.getLib kirigami2}/lib/qt-5.12.7/qml:${lib.getBin qtquickcontrols2}/lib/qt-5.12.7/qml:${lib.getBin qtdeclarative}/lib/qt-5.12.7/qml:${qtgraphicaleffects}/lib/qt-5.12.7/qml" \
+      --set QT_PLUGIN_PATH "${lib.getBin qtbase}/lib/qt-5.12.7/plugins"
+    ln -s $out/bin/org.kde.keysmith $out/bin/keysmith
+  '';
+
+  meta = with lib; {
+    description = "OTP client for Plasma Mobile and Desktop";
+    license = licenses.gpl3;
+    homepage = "https://github.com/KDE/keysmith";
+    maintainers = with maintainers; [ shamilton ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/tools/security/mkp224o/default.nix b/pkgs/tools/security/mkp224o/default.nix
index 5640debf124a..dc17cc602764 100644
--- a/pkgs/tools/security/mkp224o/default.nix
+++ b/pkgs/tools/security/mkp224o/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "mkp224o";
-  version = "1.4.0";
+  version = "1.5.0";
 
   src = fetchFromGitHub {
     owner = "cathugger";
     repo = "mkp224o";
     rev = "v${version}";
-    sha256 = "0b7xs4gnyfhdkwl8wkb6mazas88ybnlbxck59p4n2mnlndvd8kb7";
+    sha256 = "0b2cn96wg4l8jkkqqp8l2295xlmm2jc8nrw6rdqb5g0zkpfmrxbb";
   };
 
   buildCommand =
diff --git a/pkgs/tools/security/rage/default.nix b/pkgs/tools/security/rage/default.nix
index cdba2f2beb01..26ae27dff6b2 100644
--- a/pkgs/tools/security/rage/default.nix
+++ b/pkgs/tools/security/rage/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, rustPlatform, fetchFromGitHub, Security }:
+{ stdenv, rustPlatform, fetchFromGitHub, installShellFiles, Security }:
 
 rustPlatform.buildRustPackage rec {
   pname = "rage";
@@ -13,8 +13,20 @@ rustPlatform.buildRustPackage rec {
 
   cargoSha256 = "08njl8irkqkfxj54pz4sx3l9aqb40h10wxb82zza52pqd4zapgn6";
 
+  nativeBuildInputs = [ installShellFiles ];
+
   buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
 
+  postBuild = ''
+    cargo run --example generate-docs
+    cargo run --example generate-completions
+  '';
+
+  postInstall = ''
+    installManPage target/manpages/*
+    installShellCompletion target/completions/*.{bash,fish,zsh}
+  '';
+
   meta = with stdenv.lib; {
     description = "A simple, secure and modern encryption tool with small explicit keys, no config options, and UNIX-style composability";
     homepage = "https://github.com/str4d/rage";
diff --git a/pkgs/tools/security/ripasso/cursive.nix b/pkgs/tools/security/ripasso/cursive.nix
index c8a55d3f397f..29229bff0028 100644
--- a/pkgs/tools/security/ripasso/cursive.nix
+++ b/pkgs/tools/security/ripasso/cursive.nix
@@ -12,6 +12,8 @@ buildRustPackage rec {
     sha256 = "164da20j727p8l7hh37j2r8pai9sj402nhswvg0nrlgj53nr6083";
   };
 
+  patches = [ ./fix-tests.patch ];
+
   cargoSha256 = "1wpn67v0xmxhn1dgzhh1pwz1yc3cizmfxhpb7qv9b27ynx4486ji";
 
   cargoBuildFlags = [ "-p ripasso-cursive -p ripasso-man" ];
diff --git a/pkgs/tools/security/ripasso/fix-tests.patch b/pkgs/tools/security/ripasso/fix-tests.patch
new file mode 100644
index 000000000000..433ff933b1f7
--- /dev/null
+++ b/pkgs/tools/security/ripasso/fix-tests.patch
@@ -0,0 +1,35 @@
+diff --git a/src/pass/test.rs b/src/pass/test.rs
+index c980a2f..2e6c8cc 100644
+--- a/src/pass/test.rs
++++ b/src/pass/test.rs
+@@ -56,6 +56,7 @@ fn populate_password_list_small_repo() {
+     base_path.pop();
+     base_path.pop();
+     base_path.pop();
++    base_path.pop();
+     base_path.push("testres");
+ 
+     let mut password_dir: PathBuf = base_path.clone();
+@@ -84,6 +85,7 @@ fn populate_password_list_repo_with_deleted_files() {
+     base_path.pop();
+     base_path.pop();
+     base_path.pop();
++    base_path.pop();
+     base_path.push("testres");
+ 
+     let mut password_dir: PathBuf = base_path.clone();
+@@ -112,6 +114,7 @@ fn populate_password_list_directory_without_git() {
+     base_path.pop();
+     base_path.pop();
+     base_path.pop();
++    base_path.pop();
+     base_path.push("testres");
+ 
+     let mut password_dir: PathBuf = base_path.clone();
+@@ -149,4 +152,4 @@ fn parse_signing_keys_empty() {
+     let result = PasswordStore::parse_signing_keys(&None).unwrap();
+ 
+     assert_eq!(result.len(), 0);
+-}
+\ No newline at end of file
++}
diff --git a/pkgs/tools/security/saml2aws/default.nix b/pkgs/tools/security/saml2aws/default.nix
index 42845705ff6b..d3157529215b 100644
--- a/pkgs/tools/security/saml2aws/default.nix
+++ b/pkgs/tools/security/saml2aws/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "saml2aws";
-  version = "2.25.0";
+  version = "2.26.1";
 
   src = fetchFromGitHub {
     owner = "Versent";
     repo = "saml2aws";
     rev = "v${version}";
-    sha256 = "12aidylamrq4rvy2cfdz669lr1p20yqrshigcc5x1hrlhh9y64xc";
+    sha256 = "09b217x10mn3y244rwym0fcqr4ly6n83wnykb77488kn960b0pqb";
   };
 
   hid = fetchFromGitHub {
diff --git a/pkgs/tools/security/tor/default.nix b/pkgs/tools/security/tor/default.nix
index e6cd74eda4b1..1e033fa31cee 100644
--- a/pkgs/tools/security/tor/default.nix
+++ b/pkgs/tools/security/tor/default.nix
@@ -15,11 +15,11 @@
 
 stdenv.mkDerivation rec {
   pname = "tor";
-  version = "0.4.2.7";
+  version = "0.4.3.5";
 
   src = fetchurl {
     url = "https://dist.torproject.org/${pname}-${version}.tar.gz";
-    sha256 = "0v82ngwwmmcb7i9563bgsmrjy6xp83xyhqhaljygd0pkvlsxi886";
+    sha256 = "0s6qspi102drn1nk3gfxs51x992xarc44gkfsi8y3l48wr50wsk1";
   };
 
   outputs = [ "out" "geoip" ];
diff --git a/pkgs/tools/security/tpm2-abrmd/default.nix b/pkgs/tools/security/tpm2-abrmd/default.nix
index fbebde2e7bf6..6fe116d7015a 100644
--- a/pkgs/tools/security/tpm2-abrmd/default.nix
+++ b/pkgs/tools/security/tpm2-abrmd/default.nix
@@ -1,24 +1,44 @@
-{ stdenv, fetchurl, lib
-, tpm2-tss, pkgconfig, glib, which, dbus, cmocka }:
+{ stdenv, lib, fetchFromGitHub
+, autoreconfHook, pkg-config, autoconf-archive, makeWrapper, which
+, tpm2-tss, glib, dbus
+, cmocka
+}:
 
 stdenv.mkDerivation rec {
   pname = "tpm2-abrmd";
-  version = "2.2.0";
+  version = "2.3.2";
 
-  src = fetchurl {
-    url = "https://github.com/tpm2-software/${pname}/releases/download/${version}/${pname}-${version}.tar.gz";
-    sha256 = "1lbfhyyh9k54r8s1h8ca2czxv4hg0yq984kdh3vqh3990aca0x9a";
+  src = fetchFromGitHub {
+    owner = "tpm2-software";
+    repo = pname;
+    rev = version;
+    sha256 = "0jzglnlb700clcq6mjhhgvcq29a6893h888wsn9fbrh4f255sw8q";
   };
 
-  nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [
-    tpm2-tss glib which dbus cmocka
-  ];
+  nativeBuildInputs = [ pkg-config makeWrapper autoreconfHook autoconf-archive which ];
+  buildInputs = [ tpm2-tss glib dbus ];
+  checkInputs = [ cmocka ];
+
+  enableParallelBuilding = true;
+
+  # Emulate the required behavior of ./bootstrap in the original
+  # package
+  preAutoreconf = ''
+    echo "${version}" > VERSION
+  '';
 
   # Unit tests are currently broken as the check phase attempts to start a dbus daemon etc.
   #configureFlags = [ "--enable-unit" ];
   doCheck = false;
 
+  # Even though tpm2-tss is in the RUNPATH, starting from 2.3.0 abrmd
+  # seems to require the path to the device TCTI (used for accessing
+  # /dev/tpm0) in it's LD_LIBRARY_PATH
+  postFixup = ''
+    wrapProgram $out/bin/tpm2-abrmd \
+      --suffix LD_LIBRARY_PATH : "${lib.makeLibraryPath [ tpm2-tss ]}"
+  '';
+
   meta = with lib; {
     description = "TPM2 resource manager, accessible via D-Bus";
     homepage = "https://github.com/tpm2-software/tpm2-tools";
diff --git a/pkgs/tools/security/tpm2-tools/default.nix b/pkgs/tools/security/tpm2-tools/default.nix
index 282b1df299cf..e6a7621d9877 100644
--- a/pkgs/tools/security/tpm2-tools/default.nix
+++ b/pkgs/tools/security/tpm2-tools/default.nix
@@ -4,11 +4,11 @@
 
 stdenv.mkDerivation rec {
   pname = "tpm2-tools";
-  version = "4.1.2";
+  version = "4.1.3";
 
   src = fetchurl {
     url = "https://github.com/tpm2-software/${pname}/releases/download/${version}/${pname}-${version}.tar.gz";
-    sha256 = "0di97zmxdh04m2ibyshcgvillwxx6rnd0543scm7q10y7nv74m0p";
+    sha256 = "0117r0zzdnblkibv81y71v3limixsw5m7g9xwf7lcx8fc8836pdv";
   };
 
   nativeBuildInputs = [ pandoc pkgconfig makeWrapper ];
diff --git a/pkgs/tools/system/confd/default.nix b/pkgs/tools/system/confd/default.nix
index e7a5dc86578a..25f03e1a665f 100644
--- a/pkgs/tools/system/confd/default.nix
+++ b/pkgs/tools/system/confd/default.nix
@@ -1,8 +1,8 @@
-{ buildGoPackage, fetchFromGitHub }:
+{ lib, buildGoPackage, fetchFromGitHub }:
 
 buildGoPackage rec {
   pname = "confd";
-  version = "0.9.0";
+  version = "0.16.0";
   rev = "v${version}";
 
   goPackagePath = "github.com/kelseyhightower/confd";
@@ -12,8 +12,13 @@ buildGoPackage rec {
     inherit rev;
     owner = "kelseyhightower";
     repo = "confd";
-    sha256 = "0rz533575hdcln8ciqaz79wbnga3czj243g7fz8869db6sa7jwlr";
+    sha256 = "0q7r6dkgirnmqi3rhqdaai88jqzw52l6jdrrwsf2qq0hva09961p";
   };
 
-  goDeps = ./deps.nix;
+  meta = {
+    description = "Manage local application configuration files using templates and data from etcd or consul";
+    homepage = "https://github.com/kelseyhightower/confd";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.zimbatm ];
+  };
 }
diff --git a/pkgs/tools/system/confd/deps.nix b/pkgs/tools/system/confd/deps.nix
deleted file mode 100644
index 74467ddf9cc7..000000000000
--- a/pkgs/tools/system/confd/deps.nix
+++ /dev/null
@@ -1,74 +0,0 @@
-[
-  {
-    goPackagePath = "github.com/Sirupsen/logrus";
-    fetch = {
-      type = "git";
-      url = "https://github.com/Sirupsen/logrus";
-      rev = "be52937128b38f1d99787bb476c789e2af1147f1";
-      sha256 = "1m6vvd4pg4lwglhk54lv5mf6cc8h7bi0d9zb3gar4crz531r66y4";
-    };
-  }
-  {
-    goPackagePath = "github.com/coreos/go-etcd";
-    fetch = {
-      type = "git";
-      url = "https://github.com/coreos/go-etcd";
-      rev = "9847b93751a5fbaf227b893d172cee0104ac6427";
-      sha256 = "1ihq01ayqzxvn6hca5j00vl189vi5lm78f0fy2wpk5mrm3xi01l4";
-    };
-  }
-  {
-    goPackagePath = "github.com/ugorji/go";
-    fetch = {
-      type = "git";
-      url = "https://github.com/ugorji/go";
-      rev = "03e33114d4d60a1f37150325e15f51b0fa6fc4f6";
-      sha256 = "01kdzgx23cgb4k867m1pvsw14hhdr9jf2frqy6i4j4221055m57v";
-    };
-  }
-  {
-    goPackagePath = "github.com/samuel/go-zookeeper";
-    fetch = {
-      type = "git";
-      url = "https://github.com/samuel/go-zookeeper";
-      rev = "5bb5cfc093ad18a28148c578f8632cfdb4d802e4";
-      sha256 = "1kpx1ymh7rds0b2km291idnyqi0zck74nd8hnk72crgz7wmpqv6z";
-    };
-  }
-  {
-    goPackagePath = "github.com/BurntSushi/toml";
-    fetch = {
-      type = "git";
-      url = "https://github.com/BurntSushi/toml";
-      rev = "056c9bc7be7190eaa7715723883caffa5f8fa3e4";
-      sha256 = "0gkgkw04ndr5y7hrdy0r4v2drs5srwfcw2bs1gyas066hwl84xyw";
-    };
-  }
-  {
-    goPackagePath = "github.com/kelseyhightower/memkv";
-    fetch = {
-      type = "git";
-      url = "https://github.com/kelseyhightower/memkv";
-      rev = "7f9c7f36f45ba80c62fe22779ee78d9b4ca36580";
-      sha256 = "090x65kr3gqh8fc8z4rm9hc2r0v0k7rfm5vsbmhdh21f48ixw540";
-    };
-  }
-  {
-    goPackagePath = "github.com/armon/consul-api";
-    fetch = {
-      type = "git";
-      url = "https://github.com/armon/consul-api";
-      rev = "f79efe463cdbb62f6d5a55f879a63ec554eb13e5";
-      sha256 = "1rkmzfhsazj9p2b6ywvs8yramzvxfxyvplzxi0ldvhcv04887gcp";
-    };
-  }
-  {
-    goPackagePath = "github.com/garyburd/redigo";
-    fetch = {
-      type = "git";
-      url = "https://github.com/garyburd/redigo";
-      rev = "535138d7bcd717d6531c701ef5933d98b1866257";
-      sha256 = "1m7nc1gvv5yqnq8ii75f33485il6y6prf8gxl97dimsw94qccc5v";
-    };
-  }
-]
diff --git a/pkgs/tools/system/di/default.nix b/pkgs/tools/system/di/default.nix
index 239544d20a6d..0a6ae26547bf 100644
--- a/pkgs/tools/system/di/default.nix
+++ b/pkgs/tools/system/di/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "di";
-  version = "4.47.3";
+  version = "4.48";
 
   src = fetchurl {
     url = "https://gentoo.com/${pname}/${pname}-${version}.tar.gz";
-    sha256 = "0m4npba50sf5s61g5z3xd2r7937zwja941f2h3f081xi24c2hfck";
+    sha256 = "0crvvfsxh8ryc0j19a2x52i9zacvggm8zi6j3kzygkcwnpz4km8r";
   };
 
   makeFlags = [ "INSTALL_DIR=$(out)" ];
diff --git a/pkgs/tools/system/efivar/default.nix b/pkgs/tools/system/efivar/default.nix
index 71389af7423e..ea0ed8afcfd0 100644
--- a/pkgs/tools/system/efivar/default.nix
+++ b/pkgs/tools/system/efivar/default.nix
@@ -28,6 +28,16 @@ stdenv.mkDerivation rec {
       url = "https://github.com/rhboot/efivar/commit/c3c553db85ff10890209d0fe48fb4856ad68e4e0.patch";
       sha256 = "0lc38npydp069nlcga25wzzm204ww9l6mpjfn6wmhdfhn0pgjwky";
     })
+    (fetchurl {
+      name = "remove_unused_variable.patch";
+      url = "https://github.com/rhboot/efivar/commit/fdb803402fb32fa6d020bac57a40c7efe4aabb7d.patch";
+      sha256 = "1xhy8v8ff9lyxb830n9hci2fbh7rfps6rwsqrjh4lw7316gwllsd";
+    })
+    (fetchurl {
+      name = "check_string_termination.patch";
+      url = "https://github.com/rhboot/efivar/commit/4e04afc2df9bbc26e5ab524b53a6f4f1e61d7c9e.patch";
+      sha256 = "1ajj11wwsvamfspq4naanvw08h63gr0g71q0dfbrrywrhc0jlmdw";
+    })
   ];
   # We have no LTO here since commit 22284b07.
   postPatch = if stdenv.isi686 then "sed '/^OPTIMIZE /s/-flto//' -i Make.defaults" else null;
diff --git a/pkgs/tools/system/facter/default.nix b/pkgs/tools/system/facter/default.nix
index 0d2d704ea6c2..b6a04f808a4c 100644
--- a/pkgs/tools/system/facter/default.nix
+++ b/pkgs/tools/system/facter/default.nix
@@ -2,10 +2,10 @@
 
 stdenv.mkDerivation rec {
   pname = "facter";
-  version = "3.14.10";
+  version = "3.14.11";
 
   src = fetchFromGitHub {
-    sha256 = "0yblz8k30kv9jpfs6bd0hcx5nfr23l7nxyw0q7p7c4ygkx3mb1ji";
+    sha256 = "1x7m11bda86xkr8mncy50nga9q3gnvnklcvwwpa7frka99kgai26";
     rev = version;
     repo = pname;
     owner = "puppetlabs";
diff --git a/pkgs/tools/system/gotop/default.nix b/pkgs/tools/system/gotop/default.nix
index 893e3e7e9833..0d8deb11b9e1 100644
--- a/pkgs/tools/system/gotop/default.nix
+++ b/pkgs/tools/system/gotop/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "gotop";
-  version = "3.5.2";
+  version = "4.0.1";
 
   src = fetchFromGitHub {
     owner = "xxxserxxx";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0d08pi213nzvj4vhd2sbri39qlxa7iazc8bcrikhmmr0pghjfwhn";
+    sha256 = "10qfzmq1wdgpvv319khzicalix1x4fqava0wry3bzz84k5c9dabs";
   };
 
-  vendorSha256 = "1ais548gii4q7xzysnw2ykjxyzb7azszsqdlp9hgiwp0bax9nj2n";
+  vendorSha256 = "1crphp41bfivfmfp3cl7pjca3ypds6mr3847msd4wvfq4g6imk55";
 
   meta = with stdenv.lib; {
     description = "A terminal based graphical activity monitor inspired by gtop and vtop";
diff --git a/pkgs/tools/system/inxi/default.nix b/pkgs/tools/system/inxi/default.nix
index 364565016185..bb3ba6ec3713 100644
--- a/pkgs/tools/system/inxi/default.nix
+++ b/pkgs/tools/system/inxi/default.nix
@@ -22,13 +22,13 @@ let
     ++ recommendedDisplayInformationPrograms;
 in stdenv.mkDerivation rec {
   pname = "inxi";
-  version = "3.1.00-1";
+  version = "3.1.03-1";
 
   src = fetchFromGitHub {
     owner = "smxi";
     repo = "inxi";
     rev = version;
-    sha256 = "0md6yfd297l8695g0rsbs4mm74dc3k00rfjl4x2n4i33mkylp6qa";
+    sha256 = "0539hvlq021wxhbwzdp7qliiq1jgw60mxlwrwx0z2x8qi1zqdzg6";
   };
 
   buildInputs = [ perl makeWrapper ];
diff --git a/pkgs/tools/system/runit/default.nix b/pkgs/tools/system/runit/default.nix
index a4319fd57496..acca0acf3ef9 100644
--- a/pkgs/tools/system/runit/default.nix
+++ b/pkgs/tools/system/runit/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl
+{ stdenv, fetchurl, darwin
 
 # Build runit-init as a static binary
 , static ? false
@@ -23,7 +23,8 @@ stdenv.mkDerivation rec {
 
   doCheck = true;
 
-  buildInputs = stdenv.lib.optionals static [ stdenv.cc.libc stdenv.cc.libc.static ];
+  buildInputs = stdenv.lib.optionals static [ stdenv.cc.libc stdenv.cc.libc.static ] ++
+    stdenv.lib.optional stdenv.isDarwin darwin.apple_sdk.libs.utmp;
 
   postPatch = ''
     sed -i "s,\(#define RUNIT\) .*,\1 \"$out/bin/runit\"," src/runit.h
@@ -39,7 +40,7 @@ stdenv.mkDerivation rec {
 
     # Both of these are originally hard-coded to gcc
     echo ${stdenv.cc.targetPrefix}cc > conf-cc
-    echo ${stdenv.cc.targetPrefix}cc > conf-ld
+    echo ${stdenv.cc.targetPrefix}cc ${stdenv.lib.optionalString stdenv.isDarwin "-Xlinker -x "}> conf-ld
   '';
 
   installPhase = ''
@@ -55,6 +56,6 @@ stdenv.mkDerivation rec {
     license = licenses.bsd3;
     homepage = "http://smarden.org/runit";
     maintainers = with maintainers; [ joachifm ];
-    platforms = platforms.linux;
+    platforms = platforms.linux ++ platforms.darwin;
   };
 }
diff --git a/pkgs/tools/system/smartmontools/default.nix b/pkgs/tools/system/smartmontools/default.nix
index 034564949c93..f4941df8ebd3 100644
--- a/pkgs/tools/system/smartmontools/default.nix
+++ b/pkgs/tools/system/smartmontools/default.nix
@@ -4,11 +4,11 @@
 let
   version = "7.1";
 
-  dbrev = "5033";
+  dbrev = "5062";
   drivedbBranch = "RELEASE_7_0_DRIVEDB";
   driverdb = fetchurl {
     url    = "https://sourceforge.net/p/smartmontools/code/${dbrev}/tree/branches/${drivedbBranch}/smartmontools/drivedb.h?format=raw";
-    sha256 = "029j118lwiazn56vg6d3i7ayv73wrpv1fypw3ff4nd4hgs2mlcrg";
+    sha256 = "0gggl55h9gq0z846ndhyd7xrpxh8lqfbidblx0598q2wlh9rvlww";
     name   = "smartmontools-drivedb.h";
   };
 
diff --git a/pkgs/tools/text/agrep/default.nix b/pkgs/tools/text/agrep/default.nix
index c285b892b925..c0816f8ab76c 100644
--- a/pkgs/tools/text/agrep/default.nix
+++ b/pkgs/tools/text/agrep/default.nix
@@ -21,10 +21,12 @@ stdenv.mkDerivation {
     install -Dm 444 docs/* -t "$out/doc"
   '';
 
-  meta = {
+  makeFlags = [ "CC=${stdenv.cc.targetPrefix}cc" ];
+
+  meta = with stdenv.lib; {
     description = "Approximate grep for fast fuzzy string searching";
     homepage = "https://www.tgries.de/agrep/";
-    license = stdenv.lib.licenses.isc;
-    platforms = stdenv.lib.platforms.linux;
+    license = licenses.isc;
+    platforms = with platforms; linux ++ darwin;
   };
 }
diff --git a/pkgs/tools/text/gtranslator/default.nix b/pkgs/tools/text/gtranslator/default.nix
index ff5288f16316..5f217e69ea56 100644
--- a/pkgs/tools/text/gtranslator/default.nix
+++ b/pkgs/tools/text/gtranslator/default.nix
@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "LaodO1m0o171TfCHNFsD4XA+clCB+drFQ1OSKKcVrdM=";
+    sha256 = "1lxd2nkji4jk8g2xmyc1a1r3ww710ddk91zh9psmx8xlb4xivaid";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/text/highlight/default.nix b/pkgs/tools/text/highlight/default.nix
index bc32a60c6727..a918770aa7b9 100644
--- a/pkgs/tools/text/highlight/default.nix
+++ b/pkgs/tools/text/highlight/default.nix
@@ -5,13 +5,13 @@ with stdenv.lib;
 let
   self = stdenv.mkDerivation rec {
     pname = "highlight";
-    version = "3.56";
+    version = "3.57";
 
     src = fetchFromGitLab {
       owner = "saalen";
       repo = "highlight";
       rev = "v${version}";
-      sha256 = "1pilx58dg96zm0yx7i6k92vibwpvpj8ir39f2akrsyjgijnv3sx4";
+      sha256 = "1xrk7c7akjiwh3wh9bll0qh4g0kqvbzjz9ancpadnk0k7bqi0kxf";
     };
 
     enableParallelBuilding = true;
diff --git a/pkgs/tools/text/mdcat/default.nix b/pkgs/tools/text/mdcat/default.nix
index 38ef6561ac6a..314a2acf5757 100644
--- a/pkgs/tools/text/mdcat/default.nix
+++ b/pkgs/tools/text/mdcat/default.nix
@@ -2,19 +2,19 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "mdcat";
-  version = "0.17.1";
+  version = "0.18.2";
 
   src = fetchFromGitHub {
     owner = "lunaryorn";
     repo = pname;
     rev = "mdcat-${version}";
-    sha256 = "0kkpacb31d0rg4774a63x3njifn3813d8r8vc8skzv4ki7gvhxkr";
+    sha256 = "0rbfx7951ascgd16jx0d9vcr46ca1v040dc0kfcdfisr6s9ifygw";
   };
 
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ openssl ] ++ stdenv.lib.optional stdenv.isDarwin Security;
 
-  cargoSha256 = "1pljgnckardy3j81im6k5dssz794c7vjx1dfr7950ndhrzwv7p22";
+  cargoSha256 = "1j70l8g49qm4dbcb15ww1prasqhyf9ygprf65fg9p39jcs6j5gcv";
 
   checkInputs = [ ansi2html ];
   checkPhase = ''
diff --git a/pkgs/tools/text/ocrmypdf/default.nix b/pkgs/tools/text/ocrmypdf/default.nix
index 19690e270af0..874dc59c7fd7 100644
--- a/pkgs/tools/text/ocrmypdf/default.nix
+++ b/pkgs/tools/text/ocrmypdf/default.nix
@@ -12,7 +12,6 @@
 , unpaper
 , substituteAll
 }:
-
 let
   inherit (python3Packages) buildPythonApplication;
 
@@ -27,16 +26,17 @@ let
     pillow
   ];
 
-in buildPythonApplication rec {
+in
+buildPythonApplication rec {
   pname = "ocrmypdf";
-  version = "9.8.0";
+  version = "9.8.2";
   disabled = ! python3Packages.isPy3k;
 
   src = fetchFromGitHub {
     owner = "jbarlow83";
     repo = "OCRmyPDF";
     rev = "v${version}";
-    sha256 = "1l4bwnbd3g0wmdx8yv8hi5wm2z2q67y9mwrvrc4xxmkdrb5y8jcd";
+    sha256 = "0zff9gsbfaf72p8zbjamn6513czpr7papyh1jy0fz1z2a9h7ya0g";
   };
 
   nativeBuildInputs = with python3Packages; [
diff --git a/pkgs/tools/text/ripgrep-all/default.nix b/pkgs/tools/text/ripgrep-all/default.nix
index 44eacacd0e84..97d3f8960d93 100644
--- a/pkgs/tools/text/ripgrep-all/default.nix
+++ b/pkgs/tools/text/ripgrep-all/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchFromGitHub, rustPlatform, makeWrapper, ffmpeg
+{ stdenv, lib, fetchFromGitHub, rustPlatform, makeWrapper, ffmpeg_3
 , pandoc, poppler_utils, ripgrep, Security, imagemagick, tesseract
 }:
 
@@ -19,7 +19,7 @@ rustPlatform.buildRustPackage rec {
 
   postInstall = ''
     wrapProgram $out/bin/rga \
-      --prefix PATH ":" "${lib.makeBinPath [ ffmpeg pandoc poppler_utils ripgrep imagemagick tesseract ]}"
+      --prefix PATH ":" "${lib.makeBinPath [ ffmpeg_3 pandoc poppler_utils ripgrep imagemagick tesseract ]}"
   '';
 
   # Use upstream's example data to run a couple of queries to ensure the dependencies
diff --git a/pkgs/tools/text/ripgrep/default.nix b/pkgs/tools/text/ripgrep/default.nix
index ab589eb87fc1..548b6fd22de5 100644
--- a/pkgs/tools/text/ripgrep/default.nix
+++ b/pkgs/tools/text/ripgrep/default.nix
@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "ripgrep";
-  version = "12.1.0";
+  version = "12.1.1";
 
   src = fetchFromGitHub {
     owner = "BurntSushi";
     repo = pname;
     rev = version;
-    sha256 = "1vgkk78c25ia9y4q5psrh7xrlbfdn7dz7bc20kci40n8zr0vjwww";
+    sha256 = "1hqps7l5qrjh9f914r5i6kmcz6f1yb951nv4lby0cjnp5l253kps";
   };
 
-  cargoSha256 = "143lnf4yah9ik7v8rphv7gbvr2ckhjpmy8zfgqml1n3fqxiqvxnb";
+  cargoSha256 = "03wf9r2csi6jpa7v5sw5lpxkrk4wfzwmzx7k3991q3bdjzcwnnwp";
 
   cargoBuildFlags = stdenv.lib.optional withPCRE2 "--features pcre2";
 
@@ -38,7 +38,7 @@ rustPlatform.buildRustPackage rec {
     description = "A utility that combines the usability of The Silver Searcher with the raw speed of grep";
     homepage = "https://github.com/BurntSushi/ripgrep";
     license = with licenses; [ unlicense /* or */ mit ];
-    maintainers = with maintainers; [ tailhook globin ma27 ];
+    maintainers = with maintainers; [ tailhook globin ma27 zowoq ];
     platforms = platforms.all;
   };
 }
diff --git a/pkgs/tools/text/shfmt/default.nix b/pkgs/tools/text/shfmt/default.nix
index ab96392a95d0..251f6224b403 100644
--- a/pkgs/tools/text/shfmt/default.nix
+++ b/pkgs/tools/text/shfmt/default.nix
@@ -24,5 +24,6 @@ buildGoModule rec {
       You can feed it standard input, any number of files or any number of directories to recurse into.
     '';
     license = licenses.bsd3;
+    maintainers = with maintainers; [ zowoq ];
   };
-}
\ No newline at end of file
+}
diff --git a/pkgs/tools/text/snippetpixie/default.nix b/pkgs/tools/text/snippetpixie/default.nix
index 863e4764b69b..991b496777c2 100644
--- a/pkgs/tools/text/snippetpixie/default.nix
+++ b/pkgs/tools/text/snippetpixie/default.nix
@@ -24,13 +24,13 @@
 
 stdenv.mkDerivation rec {
   pname = "snippetpixie";
-  version = "1.3.2";
+  version = "1.3.3";
 
   src = fetchFromGitHub {
     owner = "bytepixie";
     repo = pname;
     rev = version;
-    sha256 = "0jhc47g5x34c36y4d32lcn32bpw4axxf1sydawgy4886hmkvb6kf";
+    sha256 = "0ml57j6jagqvjlpgn1bcyx08h71kcxalh69y03y2lj84x5ib8qz3";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/typesetting/scdoc/default.nix b/pkgs/tools/typesetting/scdoc/default.nix
index 356433bac41c..5b6cf5e22f21 100644
--- a/pkgs/tools/typesetting/scdoc/default.nix
+++ b/pkgs/tools/typesetting/scdoc/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "scdoc";
-  version = "1.10.1";
+  version = "1.11.0";
 
   src = fetchurl {
     url = "https://git.sr.ht/~sircmpwn/scdoc/archive/${version}.tar.gz";
-    sha256 = "13x7g1r56bshvfmlvapvz35ywnbgsh337kywb5kcv8nc6b3j3q40";
+    sha256 = "17cjh3lcfppyl2mzpanylla93gdgdv5spc8jldshvayzizhfghwa";
   };
 
   postPatch = ''
@@ -24,6 +24,7 @@ stdenv.mkDerivation rec {
       C99.
     '';
     homepage = "https://git.sr.ht/~sircmpwn/scdoc";
+    changelog = "https://git.sr.ht/~sircmpwn/scdoc/refs/${version}";
     license = licenses.mit;
     platforms = platforms.unix;
     maintainers = with maintainers; [ primeos ];
diff --git a/pkgs/tools/typesetting/tex/dblatex/default.nix b/pkgs/tools/typesetting/tex/dblatex/default.nix
index a145e1a42ff2..1f6939e1b11c 100644
--- a/pkgs/tools/typesetting/tex/dblatex/default.nix
+++ b/pkgs/tools/typesetting/tex/dblatex/default.nix
@@ -4,7 +4,7 @@
 , tex ? texlive.combine { # satisfy all packages that ./configure mentions
     inherit (texlive) scheme-basic epstopdf anysize appendix changebar
       fancybox fancyvrb float footmisc listings jknapltx/*for mathrsfs.sty*/
-      multirow overpic pdfpages graphics stmaryrd subfigure titlesec wasysym
+      multirow overpic pdfpages pdflscape graphics stmaryrd subfigure titlesec wasysym
       # pkgs below don't seem requested by dblatex, but our manual fails without them
       ec zapfding symbol eepic times rsfs cs tex4ht courier helvetic ly1;
   }
diff --git a/pkgs/tools/video/gopro/default.nix b/pkgs/tools/video/gopro/default.nix
index f783b086345a..9979b224868a 100644
--- a/pkgs/tools/video/gopro/default.nix
+++ b/pkgs/tools/video/gopro/default.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchFromGitHub
-, ffmpeg
+, ffmpeg_3
 , imagemagick
 , makeWrapper
 , mplayer
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
 
     install -Dm755 gopro -t $out/bin
     wrapProgram $out/bin/gopro \
-      --prefix PATH ":" "${stdenv.lib.makeBinPath [ ffmpeg imagemagick mplayer ]}"
+      --prefix PATH ":" "${stdenv.lib.makeBinPath [ ffmpeg_3 imagemagick mplayer ]}"
 
     runHook postInstall
   '';
diff --git a/pkgs/tools/video/rav1e/default.nix b/pkgs/tools/video/rav1e/default.nix
index 8a5e6c9eb40f..b8e43fe4f10f 100644
--- a/pkgs/tools/video/rav1e/default.nix
+++ b/pkgs/tools/video/rav1e/default.nix
@@ -1,31 +1,17 @@
-{ rustPlatform, fetchFromGitHub, fetchurl, stdenv, lib, nasm }:
+{ rustPlatform, fetchFromGitHub, lib, nasm }:
 
 rustPlatform.buildRustPackage rec {
   pname = "rav1e";
-  version = "0.3.1";
+  version = "0.3.3";
 
-  src = stdenv.mkDerivation rec {
-    name = "${pname}-${version}-source";
-
-    src = fetchFromGitHub {
-      owner = "xiph";
-      repo = "rav1e";
-      rev = "v${version}";
-      sha256 = "001v29baa77pkab13d7imi71llixyvffqax8kgjwhm1dhsqlm7bl";
-    };
-    cargoLock = fetchurl {
-      url = "https://github.com/xiph/rav1e/releases/download/v${version}/Cargo.lock";
-      sha256 = "06l8jj75ma5kvz1m14x58an2zvx12i6wcq70gzq5k47nvj5l0zax";
-    };
-
-    installPhase = ''
-      mkdir -p $out
-      cp -R ./* $out/
-      cp ${cargoLock} $out/Cargo.lock
-    '';
+  src = fetchFromGitHub {
+    owner = "xiph";
+    repo = "rav1e";
+    rev = "v${version}";
+    sha256 = "0a9dryag4x35a2c45qiq1j5xk9ydcpw1g6kici85d2yrc2z3hwrx";
   };
 
-  cargoSha256 = "0n6gkn4iyqk4bijrvcpq884hiihl4mpw1p417w1m0dw7j4y4karn";
+  cargoSha256 = "1xaincrmpicp0skf9788w5631x1hxvifvq06hh5ribdz79zclzx3";
 
   nativeBuildInputs = [ nasm ];
 
@@ -37,7 +23,8 @@ rustPlatform.buildRustPackage rec {
       libaom (the reference encoder) is too slow.
       Features: https://github.com/xiph/rav1e#features
     '';
-    inherit (src.src.meta) homepage;
+    inherit (src.meta) homepage;
+    changelog = "https://github.com/xiph/rav1e/releases/tag/v${version}";
     license = licenses.bsd2;
     maintainers = [ maintainers.primeos ];
     platforms = platforms.all;
diff --git a/pkgs/tools/virtualization/govc/default.nix b/pkgs/tools/virtualization/govc/default.nix
index e3329ea13f11..433da1b07f27 100644
--- a/pkgs/tools/virtualization/govc/default.nix
+++ b/pkgs/tools/virtualization/govc/default.nix
@@ -2,7 +2,7 @@
   
 buildGoPackage rec {
   pname = "govc";
-  version = "0.22.1";
+  version = "0.23.0";
 
   goPackagePath = "github.com/vmware/govmomi";
 
@@ -12,7 +12,7 @@ buildGoPackage rec {
     rev = "v${version}";
     owner = "vmware";
     repo = "govmomi";
-    sha256 = "1z4am6143jrrls0023flnqgadm1z9p60w09cp1j5pnslm60vvw78";
+    sha256 = "05nb5xd90kbazdx4l9bw72729dh5hrcaqdi9wpf5ma7bz7mw9wzi";
   };
 
   meta = {