about summary refs log tree commit diff
path: root/pkgs
diff options
context:
space:
mode:
Diffstat (limited to 'pkgs')
-rw-r--r--pkgs/applications/audio/amarok/default.nix14
-rw-r--r--pkgs/applications/audio/munt/default.nix8
-rw-r--r--pkgs/applications/audio/spek/default.nix25
-rw-r--r--pkgs/applications/blockchains/ergo/default.nix4
-rw-r--r--pkgs/applications/editors/neovim/gnvim/default.nix4
-rw-r--r--pkgs/applications/editors/notepadqq/default.nix2
-rw-r--r--pkgs/applications/graphics/yeetgif/default.nix4
-rw-r--r--pkgs/applications/misc/ArchiSteamFarm/default.nix42
-rw-r--r--pkgs/applications/misc/blender/default.nix4
-rw-r--r--pkgs/applications/misc/cointop/default.nix4
-rw-r--r--pkgs/applications/misc/cpu-x/default.nix4
-rw-r--r--pkgs/applications/misc/lyx/default.nix4
-rw-r--r--pkgs/applications/misc/pueue/default.nix6
-rw-r--r--pkgs/applications/misc/qmapshack/default.nix4
-rw-r--r--pkgs/applications/misc/remarkable/remarkable-mouse/default.nix20
-rw-r--r--pkgs/applications/networking/browsers/firefox/common.nix6
-rw-r--r--pkgs/applications/networking/browsers/firefox/packages.nix4
-rw-r--r--pkgs/applications/networking/cluster/helmsman/default.nix4
-rw-r--r--pkgs/applications/networking/cluster/luigi/default.nix7
-rw-r--r--pkgs/applications/networking/cluster/minishift/default.nix4
-rw-r--r--pkgs/applications/networking/cluster/nomad/default.nix4
-rw-r--r--pkgs/applications/networking/cluster/qbec/default.nix6
-rw-r--r--pkgs/applications/networking/dnscontrol/default.nix4
-rw-r--r--pkgs/applications/networking/ftp/filezilla/default.nix12
-rw-r--r--pkgs/applications/networking/instant-messengers/bluejeans/default.nix7
-rw-r--r--pkgs/applications/networking/instant-messengers/discord/base.nix1
-rw-r--r--pkgs/applications/networking/mailreaders/mutt/default.nix4
-rw-r--r--pkgs/applications/networking/mailreaders/thunderbird/default.nix7
-rw-r--r--pkgs/applications/networking/nym/default.nix16
-rw-r--r--pkgs/applications/networking/remote/wayvnc/add-missing-librt.patch20
-rw-r--r--pkgs/applications/networking/remote/wayvnc/default.nix2
-rw-r--r--pkgs/applications/networking/sync/onedrive/default.nix28
-rw-r--r--pkgs/applications/radio/cubicsdr/default.nix5
-rw-r--r--pkgs/applications/radio/limesuite/default.nix24
-rw-r--r--pkgs/applications/science/biology/picard-tools/default.nix4
-rw-r--r--pkgs/applications/science/logic/lean/default.nix4
-rw-r--r--pkgs/applications/version-management/git-and-tools/git/default.nix9
-rw-r--r--pkgs/applications/window-managers/sway/contrib.nix107
-rw-r--r--pkgs/build-support/rust/default.nix50
-rw-r--r--pkgs/data/fonts/fira-code/default.nix4
-rw-r--r--pkgs/desktops/gnome-3/apps/evolution/default.nix4
-rw-r--r--pkgs/desktops/gnome-3/core/evince/default.nix4
-rw-r--r--pkgs/desktops/gnome-3/core/gnome-desktop/default.nix4
-rw-r--r--pkgs/development/compilers/binaryen/default.nix4
-rw-r--r--pkgs/development/compilers/rust/cargo.nix3
-rw-r--r--pkgs/development/compilers/rust/clippy.nix3
-rw-r--r--pkgs/development/compilers/rust/rls/default.nix5
-rw-r--r--pkgs/development/compilers/rust/rustfmt.nix9
-rw-r--r--pkgs/development/interpreters/perl/default.nix16
-rw-r--r--pkgs/development/interpreters/php/default.nix16
-rw-r--r--pkgs/development/interpreters/python/cpython/2.7/default.nix14
-rw-r--r--pkgs/development/interpreters/python/cpython/2.7/profile-task.patch21
-rw-r--r--pkgs/development/interpreters/python/cpython/3.5/profile-task.patch21
-rw-r--r--pkgs/development/interpreters/python/cpython/3.6/profile-task.patch21
-rw-r--r--pkgs/development/interpreters/python/cpython/default.nix22
-rw-r--r--pkgs/development/interpreters/python/default.nix3
-rw-r--r--pkgs/development/interpreters/python/hooks/pip-build-hook.sh3
-rw-r--r--pkgs/development/interpreters/python/hooks/setuptools-build-hook.sh3
-rw-r--r--pkgs/development/libraries/audio/libgme/default.nix12
-rw-r--r--pkgs/development/libraries/dbus/default.nix4
-rw-r--r--pkgs/development/libraries/gcc/libgcc/default.nix2
-rw-r--r--pkgs/development/libraries/glibc/2.30-cve-2020-1752.patch62
-rw-r--r--pkgs/development/libraries/glibc/common.nix4
-rw-r--r--pkgs/development/libraries/gnutls/default.nix4
-rw-r--r--pkgs/development/libraries/jbig2dec/default.nix11
-rw-r--r--pkgs/development/libraries/libarchive/default.nix4
-rw-r--r--pkgs/development/libraries/libdap/default.nix4
-rw-r--r--pkgs/development/libraries/libexif/default.nix47
-rw-r--r--pkgs/development/libraries/libgpg-error/default.nix17
-rw-r--r--pkgs/development/libraries/libheif/default.nix4
-rw-r--r--pkgs/development/libraries/liblastfm/default.nix31
-rw-r--r--pkgs/development/libraries/libpcap/default.nix6
-rw-r--r--pkgs/development/libraries/librealsense/default.nix4
-rw-r--r--pkgs/development/libraries/libssh2/CVE-2019-17498.patch210
-rw-r--r--pkgs/development/libraries/libssh2/default.nix8
-rw-r--r--pkgs/development/libraries/libu2f-host/default.nix4
-rw-r--r--pkgs/development/libraries/libxslt/default.nix11
-rw-r--r--pkgs/development/libraries/mesa/default.nix46
-rw-r--r--pkgs/development/libraries/nss/default.nix4
-rw-r--r--pkgs/development/libraries/openh264/default.nix4
-rw-r--r--pkgs/development/libraries/pcre2/default.nix4
-rw-r--r--pkgs/development/libraries/readline/6.3.nix4
-rw-r--r--pkgs/development/libraries/readline/7.0.nix4
-rw-r--r--pkgs/development/libraries/readline/8.0.nix4
-rw-r--r--pkgs/development/libraries/sqlite/analyzer.nix4
-rw-r--r--pkgs/development/libraries/sqlite/default.nix4
-rw-r--r--pkgs/development/libraries/trompeloeil/default.nix4
-rw-r--r--pkgs/development/libraries/wxwidgets/3.0/default.nix14
-rw-r--r--pkgs/development/libraries/wxwidgets/3.1/default.nix12
-rw-r--r--pkgs/development/ocaml-modules/ocsigen-start/default.nix4
-rw-r--r--pkgs/development/python-modules/Cython/default.nix4
-rw-r--r--pkgs/development/python-modules/GitPython/default.nix4
-rw-r--r--pkgs/development/python-modules/JPype1/default.nix4
-rw-r--r--pkgs/development/python-modules/Mako/default.nix4
-rw-r--r--pkgs/development/python-modules/aioharmony/default.nix4
-rw-r--r--pkgs/development/python-modules/aiohttp/default.nix45
-rw-r--r--pkgs/development/python-modules/aiolifx/default.nix4
-rw-r--r--pkgs/development/python-modules/aioresponses/default.nix4
-rw-r--r--pkgs/development/python-modules/appdirs/default.nix4
-rwxr-xr-xpkgs/development/python-modules/atlassian-python-api/default.nix4
-rw-r--r--pkgs/development/python-modules/autopep8/default.nix4
-rw-r--r--pkgs/development/python-modules/awkward1/default.nix4
-rw-r--r--pkgs/development/python-modules/bids-validator/default.nix4
-rw-r--r--pkgs/development/python-modules/bleak/default.nix4
-rw-r--r--pkgs/development/python-modules/block-io/default.nix4
-rw-r--r--pkgs/development/python-modules/boto3/default.nix4
-rw-r--r--pkgs/development/python-modules/bpython/clipboard-make-which-substitutable.patch27
-rw-r--r--pkgs/development/python-modules/bpython/default.nix17
-rw-r--r--pkgs/development/python-modules/bugsnag/default.nix4
-rw-r--r--pkgs/development/python-modules/buildbot/default.nix4
-rw-r--r--pkgs/development/python-modules/buildbot/pkg.nix2
-rw-r--r--pkgs/development/python-modules/buildbot/plugins.nix10
-rw-r--r--pkgs/development/python-modules/buildbot/worker.nix2
-rw-r--r--pkgs/development/python-modules/can/default.nix4
-rw-r--r--pkgs/development/python-modules/cnvkit/default.nix4
-rw-r--r--pkgs/development/python-modules/coverage/default.nix4
-rw-r--r--pkgs/development/python-modules/croniter/default.nix4
-rw-r--r--pkgs/development/python-modules/django-mailman3/default.nix4
-rw-r--r--pkgs/development/python-modules/django_modelcluster/default.nix4
-rw-r--r--pkgs/development/python-modules/dnslib/default.nix4
-rw-r--r--pkgs/development/python-modules/doc8/default.nix4
-rw-r--r--pkgs/development/python-modules/docker/default.nix4
-rw-r--r--pkgs/development/python-modules/dockerfile-parse/default.nix4
-rw-r--r--pkgs/development/python-modules/dot2tex/default.nix24
-rw-r--r--pkgs/development/python-modules/dot2tex/path.patch104
-rw-r--r--pkgs/development/python-modules/dot2tex/test.patch12
-rw-r--r--pkgs/development/python-modules/elasticsearch-dsl/default.nix4
-rw-r--r--pkgs/development/python-modules/elasticsearch/default.nix4
-rw-r--r--pkgs/development/python-modules/eve/default.nix4
-rw-r--r--pkgs/development/python-modules/flask-sqlalchemy/default.nix4
-rw-r--r--pkgs/development/python-modules/geoalchemy2/default.nix4
-rw-r--r--pkgs/development/python-modules/google_cloud_resource_manager/default.nix4
-rw-r--r--pkgs/development/python-modules/google_resumable_media/default.nix4
-rw-r--r--pkgs/development/python-modules/greenlet/default.nix4
-rw-r--r--pkgs/development/python-modules/hsaudiotag3k/default.nix4
-rw-r--r--pkgs/development/python-modules/httplib2/default.nix4
-rw-r--r--pkgs/development/python-modules/hvac/default.nix4
-rw-r--r--pkgs/development/python-modules/identify/default.nix4
-rw-r--r--pkgs/development/python-modules/importlib-metadata/default.nix6
-rw-r--r--pkgs/development/python-modules/importlib-resources/default.nix14
-rw-r--r--pkgs/development/python-modules/ipython/7.9.nix2
-rw-r--r--pkgs/development/python-modules/ipython/default.nix4
-rw-r--r--pkgs/development/python-modules/isbnlib/default.nix4
-rw-r--r--pkgs/development/python-modules/jupyter_client/5.nix2
-rw-r--r--pkgs/development/python-modules/jupyterlab/default.nix4
-rw-r--r--pkgs/development/python-modules/jupyterlab_server/default.nix4
-rw-r--r--pkgs/development/python-modules/keras-preprocessing/default.nix4
-rw-r--r--pkgs/development/python-modules/kombu/default.nix4
-rw-r--r--pkgs/development/python-modules/libevdev/default.nix21
-rw-r--r--pkgs/development/python-modules/mailmanclient/default.nix8
-rw-r--r--pkgs/development/python-modules/meinheld/default.nix4
-rw-r--r--pkgs/development/python-modules/msgpack-numpy/default.nix4
-rw-r--r--pkgs/development/python-modules/multidict/default.nix4
-rw-r--r--pkgs/development/python-modules/nbformat/2.nix2
-rw-r--r--pkgs/development/python-modules/notebook/2.nix2
-rw-r--r--pkgs/development/python-modules/numpy/default.nix4
-rw-r--r--pkgs/development/python-modules/pandas/default.nix4
-rw-r--r--pkgs/development/python-modules/phik/default.nix4
-rw-r--r--pkgs/development/python-modules/phonenumbers/default.nix2
-rw-r--r--pkgs/development/python-modules/pycurl/default.nix3
-rw-r--r--pkgs/development/python-modules/pydantic/default.nix9
-rw-r--r--pkgs/development/python-modules/pyenchant/default.nix4
-rw-r--r--pkgs/development/python-modules/pygdbmi/default.nix6
-rw-r--r--pkgs/development/python-modules/pyhomematic/default.nix4
-rw-r--r--pkgs/development/python-modules/pynput/default.nix25
-rw-r--r--pkgs/development/python-modules/pysonos/default.nix4
-rw-r--r--pkgs/development/python-modules/pytest-flake8/default.nix4
-rw-r--r--pkgs/development/python-modules/pytest/default.nix4
-rw-r--r--pkgs/development/python-modules/python-engineio/default.nix1
-rw-r--r--pkgs/development/python-modules/python-miio/default.nix4
-rw-r--r--pkgs/development/python-modules/pytrends/default.nix4
-rw-r--r--pkgs/development/python-modules/readthedocs-sphinx-ext/default.nix4
-rw-r--r--pkgs/development/python-modules/restructuredtext_lint/default.nix4
-rw-r--r--pkgs/development/python-modules/rethinkdb/default.nix4
-rw-r--r--pkgs/development/python-modules/screeninfo/default.nix35
-rw-r--r--pkgs/development/python-modules/setuptools-lint/default.nix21
-rw-r--r--pkgs/development/python-modules/snapcast/default.nix4
-rw-r--r--pkgs/development/python-modules/snowflake-connector-python/default.nix4
-rw-r--r--pkgs/development/python-modules/snscrape/default.nix4
-rw-r--r--pkgs/development/python-modules/soupsieve/default.nix4
-rw-r--r--pkgs/development/python-modules/sphinxcontrib-katex/default.nix4
-rw-r--r--pkgs/development/python-modules/sqlalchemy/default.nix4
-rw-r--r--pkgs/development/python-modules/sqlmap/default.nix4
-rw-r--r--pkgs/development/python-modules/stytra/default.nix4
-rw-r--r--pkgs/development/python-modules/toml/default.nix4
-rw-r--r--pkgs/development/python-modules/tqdm/default.nix4
-rw-r--r--pkgs/development/python-modules/trimesh/default.nix4
-rw-r--r--pkgs/development/python-modules/txdbus/default.nix4
-rw-r--r--pkgs/development/python-modules/uproot/default.nix4
-rw-r--r--pkgs/development/python-modules/vertica-python/default.nix4
-rw-r--r--pkgs/development/python-modules/zeroc-ice/default.nix4
-rw-r--r--pkgs/development/python-modules/zeroconf/default.nix4
-rw-r--r--pkgs/development/python-modules/zope_interface/default.nix8
-rw-r--r--pkgs/development/python-modules/zstd/default.nix4
-rw-r--r--pkgs/development/tools/analysis/flow/default.nix4
-rw-r--r--pkgs/development/tools/analysis/tfsec/default.nix4
-rw-r--r--pkgs/development/tools/cloudfoundry-cli/default.nix4
-rw-r--r--pkgs/development/tools/continuous-integration/buildkite-cli/default.nix26
-rw-r--r--pkgs/development/tools/continuous-integration/fly/default.nix6
-rw-r--r--pkgs/development/tools/dapper/default.nix4
-rw-r--r--pkgs/development/tools/delve/default.nix4
-rw-r--r--pkgs/development/tools/doctl/default.nix4
-rw-r--r--pkgs/development/tools/gauge/default.nix4
-rw-r--r--pkgs/development/tools/lazygit/default.nix4
-rw-r--r--pkgs/development/tools/misc/autogen/default.nix62
-rw-r--r--pkgs/development/tools/misc/autogen/pkg-config-use-var.patch13
-rw-r--r--pkgs/development/tools/misc/circleci-cli/default.nix4
-rw-r--r--pkgs/development/tools/misc/cquery/default.nix64
-rw-r--r--pkgs/development/tools/misc/cquery/wrapper12
-rw-r--r--pkgs/development/tools/misc/gdb/default.nix4
-rw-r--r--pkgs/development/tools/misc/libtool/libtool2.nix4
-rw-r--r--pkgs/development/tools/misc/pkgconf/default.nix4
-rw-r--r--pkgs/development/tools/ocaml/js_of_ocaml/3.0.nix18
-rw-r--r--pkgs/development/tools/ocaml/js_of_ocaml/default.nix42
-rw-r--r--pkgs/development/tools/rust/rust-analyzer/generic.nix4
-rw-r--r--pkgs/development/tools/skaffold/default.nix4
-rw-r--r--pkgs/games/steam/runtime.nix19
-rw-r--r--pkgs/misc/drivers/hplip/default.nix6
-rw-r--r--pkgs/misc/ghostscript/0001-Bug-702364-Fix-missing-echogs-dependencies.patch105
-rw-r--r--pkgs/misc/ghostscript/default.nix9
-rw-r--r--pkgs/os-specific/darwin/yabai/default.nix4
-rw-r--r--pkgs/os-specific/linux/firmware/sof-firmware/default.nix23
-rw-r--r--pkgs/os-specific/linux/fscrypt/default.nix4
-rw-r--r--pkgs/os-specific/linux/iproute/default.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/common-config.nix5
-rw-r--r--pkgs/os-specific/linux/kernel/hardened/patches.json24
-rw-r--r--pkgs/os-specific/linux/kernel/linux-testing.nix6
-rw-r--r--pkgs/os-specific/linux/systemd/0005-Add-some-NixOS-specific-unit-directories.patch4
-rw-r--r--pkgs/os-specific/linux/systemd/default.nix3
-rw-r--r--pkgs/servers/blockbook/default.nix6
-rw-r--r--pkgs/servers/consul/default.nix4
-rw-r--r--pkgs/servers/dns/bind/default.nix3
-rw-r--r--pkgs/servers/mail/mailman/default.nix4
-rw-r--r--pkgs/servers/mail/mailman/hyperkitty.nix4
-rw-r--r--pkgs/servers/mail/mailman/postorius.nix4
-rw-r--r--pkgs/servers/mail/postfix/default.nix4
-rw-r--r--pkgs/servers/sql/postgresql/default.nix20
-rw-r--r--pkgs/servers/web-apps/searx/default.nix3
-rw-r--r--pkgs/shells/fish/default.nix4
-rw-r--r--pkgs/tools/audio/video2midi/default.nix4
-rw-r--r--pkgs/tools/compression/zstd/default.nix6
-rw-r--r--pkgs/tools/filesystems/btrfs-progs/default.nix4
-rw-r--r--pkgs/tools/graphics/luxcorerender/default.nix26
-rw-r--r--pkgs/tools/misc/bdf2sfd/default.nix4
-rw-r--r--pkgs/tools/misc/chezmoi/default.nix6
-rw-r--r--pkgs/tools/misc/fontforge/default.nix35
-rw-r--r--pkgs/tools/misc/hexyl/default.nix6
-rw-r--r--pkgs/tools/misc/lazydocker/default.nix4
-rw-r--r--pkgs/tools/misc/pistol/default.nix6
-rw-r--r--pkgs/tools/misc/rmlint/default.nix4
-rw-r--r--pkgs/tools/misc/system-config-printer/default.nix17
-rw-r--r--pkgs/tools/misc/topgrade/default.nix6
-rw-r--r--pkgs/tools/misc/ttwatch/default.nix14
-rw-r--r--pkgs/tools/networking/amass/default.nix6
-rw-r--r--pkgs/tools/networking/cassowary/default.nix6
-rw-r--r--pkgs/tools/networking/findomain/default.nix6
-rw-r--r--pkgs/tools/package-management/cargo-deb/default.nix11
-rw-r--r--pkgs/tools/package-management/rpm/default.nix8
-rw-r--r--pkgs/tools/security/certstrap/default.nix4
-rw-r--r--pkgs/tools/security/chipsec/default.nix4
-rw-r--r--pkgs/tools/security/keybase/default.nix4
-rw-r--r--pkgs/tools/security/keycard-cli/default.nix4
-rw-r--r--pkgs/tools/security/ripasso/cursive.nix2
-rw-r--r--pkgs/tools/security/ripasso/fix-tests.patch35
-rw-r--r--pkgs/tools/security/saml2aws/default.nix4
-rw-r--r--pkgs/tools/system/di/default.nix4
-rw-r--r--pkgs/tools/system/gotop/default.nix6
-rw-r--r--pkgs/tools/text/highlight/default.nix4
-rw-r--r--pkgs/tools/typesetting/scdoc/default.nix5
-rw-r--r--pkgs/top-level/aliases.nix2
-rw-r--r--pkgs/top-level/all-packages.nix81
-rw-r--r--pkgs/top-level/ocaml-packages.nix10
-rw-r--r--pkgs/top-level/perl-packages.nix16
-rw-r--r--pkgs/top-level/python-packages.nix14
-rw-r--r--pkgs/top-level/release-lib.nix2
275 files changed, 1849 insertions, 1053 deletions
diff --git a/pkgs/applications/audio/amarok/default.nix b/pkgs/applications/audio/amarok/default.nix
index 29d97d8bc8ab..063cfcaa9fae 100644
--- a/pkgs/applications/audio/amarok/default.nix
+++ b/pkgs/applications/audio/amarok/default.nix
@@ -3,21 +3,21 @@
 , qca-qt5, qjson, qtquickcontrols2, qtscript, qtwebengine
 , karchive, kcmutils, kconfig, kdnssd, kguiaddons, kinit, kirigami2, knewstuff, knotifyconfig, ktexteditor, kwindowsystem
 , fftw, phonon, plasma-framework, threadweaver
-, curl, ffmpeg_3, gdk-pixbuf, libaio, libmtp, loudmouth, lzo, lz4, mysql57, pcre, snappy, taglib, taglib_extras
+, curl, ffmpeg_3, gdk-pixbuf, libaio, liblastfm, libmtp, loudmouth, lzo, lz4, mysql57, pcre, snappy, taglib, taglib_extras
 }:
 
 mkDerivation rec {
-  pname = "amarok";
-  version = "2.9.0-20190824";
+  pname = "amarok-unstable";
+  version = "2020-06-12";
 
   src = fetchgit {
     # master has the Qt5 version as of April 2018 but a formal release has not
     # yet been made so change this back to the proper upstream when such a
     # release is out
-    url    = "git://anongit.kde.org/amarok.git";
+    url    = "https://invent.kde.org/multimedia/amarok.git";
     # url = "mirror://kde/stable/${pname}/${version}/src/${name}.tar.xz";
-    rev    = "457fbda25a85a102bfda92aa7137e7ef5e4c8b00";
-    sha256 = "1ig2mg8pqany6m2zplkrvldcv4ibxwsypnyv5igm7nz7ax82cd5j";
+    rev    = "fece39b0e81db310b6a6e08f93d83b0d498cd02b";
+    sha256 = "12casnq6w5yp2jlvnr466pjpkn0vriry8jzfq2qkjl564y0vhy9x";
   };
 
   nativeBuildInputs = [ extra-cmake-modules kdoctools ];
@@ -26,7 +26,7 @@ mkDerivation rec {
     qca-qt5 qjson qtquickcontrols2 qtscript qtwebengine
     karchive kcmutils kconfig kdnssd kguiaddons kinit kirigami2 knewstuff knotifyconfig ktexteditor kwindowsystem
     phonon plasma-framework threadweaver
-    curl fftw ffmpeg_3 gdk-pixbuf libaio libmtp loudmouth lz4 lzo mysql57.server mysql57.server.static
+    curl fftw ffmpeg_3 gdk-pixbuf libaio liblastfm libmtp loudmouth lz4 lzo mysql57.server mysql57.server.static
     pcre snappy taglib taglib_extras
   ];
 
diff --git a/pkgs/applications/audio/munt/default.nix b/pkgs/applications/audio/munt/default.nix
index c9a1e9bea808..bf9710fb17ee 100644
--- a/pkgs/applications/audio/munt/default.nix
+++ b/pkgs/applications/audio/munt/default.nix
@@ -9,14 +9,14 @@ let
     categories = "Audio;AudioVideo;";
   };
 in mkDerivation rec {
-  version = "2.3.0";
+  version = "2.4.0";
   pname = "munt";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
-    rev = with stdenv.lib.versions; "${pname}_${major version}_${minor version}_${patch version}";
-    sha256 = "0fjhshs4w942rlfksalalqshflbq83pyz1z0hcq53falh9v54cyw";
+    rev = with stdenv.lib.versions; "libmt32emu_${major version}_${minor version}_${patch version}";
+    sha256 = "0521i7js5imlsxj6n7181w5szfjikam0k4vq1d2ilkqgcwrkg6ln";
   };
 
   postInstall = ''
@@ -31,7 +31,7 @@ in mkDerivation rec {
   meta = with stdenv.lib; {
     description = "Multi-platform software synthesiser emulating Roland MT-32, CM-32L, CM-64 and LAPC-I devices";
     homepage = "http://munt.sourceforge.net/";
-    license = licenses.gpl2;
+    license = with licenses; [ lgpl21 gpl3 ];
     platforms = platforms.linux;
     maintainers = with maintainers; [ gnidorah ];
   };
diff --git a/pkgs/applications/audio/spek/default.nix b/pkgs/applications/audio/spek/default.nix
index 88b22c59ae50..d6918b192315 100644
--- a/pkgs/applications/audio/spek/default.nix
+++ b/pkgs/applications/audio/spek/default.nix
@@ -1,27 +1,28 @@
-{ stdenv, fetchzip, autoconf, automake, intltool, pkgconfig, ffmpeg, wxGTK }:
+{ stdenv, fetchFromGitHub, autoreconfHook, intltool, pkgconfig, ffmpeg, wxGTK30-gtk3, wrapGAppsHook }:
 
 stdenv.mkDerivation rec {
   pname = "spek";
-  version = "0.8.3";
+  version = "unstable-2018-12-29";
 
-  src = fetchzip {
-    name = "${pname}-${version}-src";
-    url = "https://github.com/alexkay/spek/archive/v${version}.tar.gz";
-    sha256 = "0y4hlhswpqkqpsglrhg5xbfy1a6f9fvasgdf336vhwcjqsc3k2xv";
+  src = fetchFromGitHub {
+    owner = "alexkay";
+    repo = "spek";
+    rev = "f071c2956176ad53c7c8059e5c00e694ded31ded";
+    sha256 = "1l9gj9c1n92zlcjnyjyk211h83dk0idk644xnm5rs7q40p2zliy5";
   };
 
-  nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [ autoconf automake intltool ffmpeg wxGTK ];
+  # needed for autoreconfHook
+  AUTOPOINT="intltoolize --automake --copy";
 
-  preConfigure = ''
-    ./autogen.sh
-  '';
+  nativeBuildInputs = [ autoreconfHook intltool pkgconfig wrapGAppsHook ];
+
+  buildInputs = [ ffmpeg wxGTK30-gtk3 wxGTK30-gtk3.gtk ];
 
   meta = with stdenv.lib; {
     description = "Analyse your audio files by showing their spectrogram";
     homepage = "http://spek.cc/";
     license = licenses.gpl3;
+    maintainers = with maintainers; [ bjornfor ];
     platforms = platforms.all;
-    maintainers = [ maintainers.bjornfor ];
   };
 }
diff --git a/pkgs/applications/blockchains/ergo/default.nix b/pkgs/applications/blockchains/ergo/default.nix
index bae7326c2554..29990dae4049 100644
--- a/pkgs/applications/blockchains/ergo/default.nix
+++ b/pkgs/applications/blockchains/ergo/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "ergo";
-  version = "3.2.5";
+  version = "3.2.6";
 
   src = fetchurl {
     url = "https://github.com/ergoplatform/ergo/releases/download/v${version}/ergo-${version}.jar";
-    sha256 = "0vaq6cqz03ps0fg3rvk298jnbf8mazvmyfcj7zsf1cgw41xdjjcf";
+    sha256 = "1a38j7dy6ax9xvcjbdkiz0z33ln4rlmgrxznvqhdf11j70g1sr6x";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/applications/editors/neovim/gnvim/default.nix b/pkgs/applications/editors/neovim/gnvim/default.nix
index e9f42d2b9b5e..3693ff322338 100644
--- a/pkgs/applications/editors/neovim/gnvim/default.nix
+++ b/pkgs/applications/editors/neovim/gnvim/default.nix
@@ -33,6 +33,10 @@ rustPlatform.buildRustPackage rec {
     EOF
   '';
 
+  buildPhase = ''
+    make build
+  '';
+
   installPhase = ''
     make install PREFIX="${placeholder "out"}"
   '';
diff --git a/pkgs/applications/editors/notepadqq/default.nix b/pkgs/applications/editors/notepadqq/default.nix
index a51f5106930e..cd4fe34ef33b 100644
--- a/pkgs/applications/editors/notepadqq/default.nix
+++ b/pkgs/applications/editors/notepadqq/default.nix
@@ -3,12 +3,12 @@
 mkDerivation rec {
   pname = "notepadqq";
   version = "1.4.8";
+
   src = fetchFromGitHub {
     owner = "notepadqq";
     repo = "notepadqq";
     rev = "v${version}";
     sha256 = "0lbv4s7ng31dkznzbkmp2cvkqglmfj6lv4mbg3r410fif2nrva7k";
-    fetchSubmodules = true;
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/graphics/yeetgif/default.nix b/pkgs/applications/graphics/yeetgif/default.nix
index 157ef3753e08..3ae1b98661a6 100644
--- a/pkgs/applications/graphics/yeetgif/default.nix
+++ b/pkgs/applications/graphics/yeetgif/default.nix
@@ -2,7 +2,7 @@
 
 buildGoPackage rec {
   pname = "yeetgif";
-  version = "1.23.5";
+  version = "1.23.6";
 
   goPackagePath = "github.com/sgreben/yeetgif";
 
@@ -10,7 +10,7 @@ buildGoPackage rec {
     owner = "sgreben";
     repo = pname;
     rev = version;
-    sha256 = "1yz4pps8g378lvmi92cnci6msjj7fprp9bxqmnsyn6lqw7s2wb47";
+    sha256 = "05z1ylsra60bb4cvr383g9im94zsph1dgicqbv5p73qgs634ckk7";
   };
 
   meta = with lib; {
diff --git a/pkgs/applications/misc/ArchiSteamFarm/default.nix b/pkgs/applications/misc/ArchiSteamFarm/default.nix
index c165003d8f8c..6201d881a882 100644
--- a/pkgs/applications/misc/ArchiSteamFarm/default.nix
+++ b/pkgs/applications/misc/ArchiSteamFarm/default.nix
@@ -1,27 +1,15 @@
-{ stdenv, fetchurl, unzip, makeWrapper, autoPatchelfHook
-, zlib, lttng-ust, curl, icu, openssl }:
+{ stdenv, fetchurl, unzip, makeWrapper, dotnetCorePackages, jq }:
 
 stdenv.mkDerivation rec {
   pname = "ArchiSteamFarm";
-  version = "4.2.0.6";
-
-  src = {
-    x86_64-linux = fetchurl {
-      url = "https://github.com/JustArchiNET/ArchiSteamFarm/releases/download/${version}/ASF-linux-x64.zip";
-      sha256 = "05hx6q1lkbjbqhwi9xxvm7ycnsnpl1cnqzyy2yn0q4x27im399cn";
-    };
-    armv7l-linux = fetchurl {
-      url = "https://github.com/JustArchiNET/ArchiSteamFarm/releases/download/${version}/ASF-linux-arm.zip";
-      sha256 = "0l8irqrpl5vbjj84k4makj2ph2z6kpny7qz51zrzbgwhrlw0w4vg";
-    };
-    aarch64-linux = fetchurl {
-      url = "https://github.com/JustArchiNET/ArchiSteamFarm/releases/download/${version}/ASF-linux-arm64.zip";
-      sha256 = "0hg2g4i8sj3fxqfy4imz1iarby1d9f8dh59j266lbbdf2vfz2cml";
-    };
-  }.${stdenv.system} or (throw "Unsupported system: ${stdenv.system}");
-
-  nativeBuildInputs = [ unzip makeWrapper autoPatchelfHook ];
-  buildInputs = [ stdenv.cc.cc zlib lttng-ust curl ];
+  version = "4.2.2.1";
+
+  src = fetchurl {
+    url = "https://github.com/JustArchiNET/ArchiSteamFarm/releases/download/${version}/ASF-generic.zip";
+    sha256 = "0pr9rrhi44yl99c2i12rimmc4mhbh0ma9jn17cgsh8p0kbj8sq94";
+  };
+
+  nativeBuildInputs = [ unzip makeWrapper jq ];
 
   sourceRoot = ".";
 
@@ -29,23 +17,25 @@ stdenv.mkDerivation rec {
     dist=$out/opt/asf
     mkdir -p $dist
     cp -r * $dist
-    chmod +x $dist/ArchiSteamFarm
-    makeWrapper $dist/ArchiSteamFarm $out/bin/ArchiSteamFarm \
-      --prefix LD_LIBRARY_PATH : "${stdenv.lib.makeLibraryPath [ icu openssl ] }" \
+
+    jq "del(.runtimeOptions.framework.version)" ArchiSteamFarm.runtimeconfig.json > $dist/ArchiSteamFarm.runtimeconfig.json
+
+    makeWrapper ${dotnetCorePackages.aspnetcore_3_1}/bin/dotnet $out/bin/ArchiSteamFarm \
+      --add-flags $dist/ArchiSteamFarm.dll \
       --add-flags "--path ~/.config/asf" \
       --run "mkdir -p ~/.config/asf" \
       --run "cd ~/.config/asf" \
       --run "[ -d config ] || cp --no-preserve=mode -r $dist/config ." \
       --run "[ -d logs ] || cp --no-preserve=mode -r $dist/logs ." \
       --run "[ -d plugins ] || cp --no-preserve=mode -r $dist/plugins ." \
-      --run "[ -d www ] || cp --no-preserve=mode -r $dist/www ." \
+      --run "[ -d www ] || ln -sf $dist/www ."
   '';
 
   meta = with stdenv.lib; {
     description = "Application with primary purpose of idling Steam cards from multiple accounts simultaneously";
     homepage = "https://github.com/JustArchiNET/ArchiSteamFarm";
     license = licenses.asl20;
-    platforms = [ "x86_64-linux" "armv7l-linux" "aarch64-linux" ];
+    platforms = dotnetCorePackages.aspnetcore_3_1.meta.platforms;
     maintainers = with maintainers; [ gnidorah ];
     hydraPlatforms = [];
   };
diff --git a/pkgs/applications/misc/blender/default.nix b/pkgs/applications/misc/blender/default.nix
index 9a868d1699a1..bf2a89ade559 100644
--- a/pkgs/applications/misc/blender/default.nix
+++ b/pkgs/applications/misc/blender/default.nix
@@ -86,9 +86,9 @@ stdenv.mkDerivation rec {
       "-DWITH_SDL=OFF"
       "-DWITH_OPENCOLORIO=ON"
       "-DWITH_OPENSUBDIV=ON"
-      "-DPYTHON_LIBRARY=${python.libPrefix}m"
+      "-DPYTHON_LIBRARY=${python.libPrefix}"
       "-DPYTHON_LIBPATH=${python}/lib"
-      "-DPYTHON_INCLUDE_DIR=${python}/include/${python.libPrefix}m"
+      "-DPYTHON_INCLUDE_DIR=${python}/include/${python.libPrefix}"
       "-DPYTHON_VERSION=${python.pythonVersion}"
       "-DWITH_PYTHON_INSTALL=OFF"
       "-DWITH_PYTHON_INSTALL_NUMPY=OFF"
diff --git a/pkgs/applications/misc/cointop/default.nix b/pkgs/applications/misc/cointop/default.nix
index ef897d2ea598..8d91531dd1f8 100644
--- a/pkgs/applications/misc/cointop/default.nix
+++ b/pkgs/applications/misc/cointop/default.nix
@@ -2,13 +2,13 @@
 
 buildGoPackage rec {
   pname = "cointop";
-  version = "1.4.4";
+  version = "1.4.6";
 
   src = fetchFromGitHub {
     owner = "miguelmota";
     repo = pname;
     rev = version;
-    sha256 = "12yi1lmyd5y4cgcjclkczf93jj7wd6k8aqnhq21dd1mx65l77swv";
+    sha256 = "1mkb97x73vzxnbvhnxx3msicr1z0b3sjmydx257ax3nscrmf1l5z";
   };
 
   goPackagePath = "github.com/miguelmota/cointop";
diff --git a/pkgs/applications/misc/cpu-x/default.nix b/pkgs/applications/misc/cpu-x/default.nix
index fb81bbdd40c7..a92ca30c5d80 100644
--- a/pkgs/applications/misc/cpu-x/default.nix
+++ b/pkgs/applications/misc/cpu-x/default.nix
@@ -3,13 +3,13 @@
 
 stdenv.mkDerivation rec {
   pname = "cpu-x";
-  version = "4.0.0";
+  version = "4.0.1";
 
   src = fetchFromGitHub {
     owner = "X0rg";
     repo = "CPU-X";
     rev = "v${version}";
-    sha256 = "00xngmlayblvkg3l0rcfpxmnkkdz49ydh4smlhpii23gqii0rds3";
+    sha256 = "191zkkswlbbsw492yygc3idf7wh3bxs97drrqvqqw0mqvrzykxm3";
   };
 
   nativeBuildInputs = [ cmake pkgconfig wrapGAppsHook nasm makeWrapper ];
diff --git a/pkgs/applications/misc/lyx/default.nix b/pkgs/applications/misc/lyx/default.nix
index b96e6b2a02d5..4f6b73d592c2 100644
--- a/pkgs/applications/misc/lyx/default.nix
+++ b/pkgs/applications/misc/lyx/default.nix
@@ -3,12 +3,12 @@
 }:
 
 mkDerivation rec {
-  version = "2.3.4.3";
+  version = "2.3.5.1";
   pname = "lyx";
 
   src = fetchurl {
     url = "ftp://ftp.lyx.org/pub/lyx/stable/2.3.x/${pname}-${version}.tar.xz";
-    sha256 = "1rpp6wq0dc0bxwc0pipajv98vi7cpg391nq10d3c4pmpq38m08wx";
+    sha256 = "0mv32s26igm0pd8vs7d2mk1240dpr83y0a2wyh3xz6b67ph0w157";
   };
 
   # LaTeX is used from $PATH, as people often want to have it with extra pkgs
diff --git a/pkgs/applications/misc/pueue/default.nix b/pkgs/applications/misc/pueue/default.nix
index a51cd75e7990..db84f5fbb9bf 100644
--- a/pkgs/applications/misc/pueue/default.nix
+++ b/pkgs/applications/misc/pueue/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "pueue";
-  version = "0.5.1";
+  version = "0.6.0";
 
   src = fetchFromGitHub {
     owner = "Nukesor";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1n85b41kvx7x7qdizdnq1p0zrkap4gkwnnvhh4pz6j9njxj8d9ir";
+    sha256 = "06jxj89ya91grrwxfs7l1ahy46y993kxsc8gpkxajc0j5ihax2al";
   };
 
-  cargoSha256 = "0hkkz74hllc5dzmgls6bgdxsdr871df2fn51sa3shv68ah0avxff";
+  cargoSha256 = "191j3lpd24ycissw0y2hv65i1cjzf24draamq3sxv7hv0sxcjw4d";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/applications/misc/qmapshack/default.nix b/pkgs/applications/misc/qmapshack/default.nix
index edb5a9b37889..1a8758955cef 100644
--- a/pkgs/applications/misc/qmapshack/default.nix
+++ b/pkgs/applications/misc/qmapshack/default.nix
@@ -3,13 +3,13 @@
 
 mkDerivation rec {
   pname = "qmapshack";
-  version = "1.14.1";
+  version = "1.15.0";
 
   src = fetchFromGitHub {
     owner = "Maproom";
     repo = pname;
     rev = "V_${version}";
-    sha256 = "0hghynb4ac98fg1pwc645zriqkghxwp8mr3jhr87pa6fh0y848py";
+    sha256 = "157bssrbwcc1w58b0v60jb3wrjf2ig4z6z6crjnpvflkqj5p8vwy";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/applications/misc/remarkable/remarkable-mouse/default.nix b/pkgs/applications/misc/remarkable/remarkable-mouse/default.nix
new file mode 100644
index 000000000000..8d668f7a38d1
--- /dev/null
+++ b/pkgs/applications/misc/remarkable/remarkable-mouse/default.nix
@@ -0,0 +1,20 @@
+{ stdenv, buildPythonApplication, fetchPypi, python3Packages }:
+
+buildPythonApplication rec {
+  pname = "remarkable-mouse";
+  version = "5.2.1";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "0k2wjfcgnvb8yqn4c4ddfyyhrvl6hj61kn1ddnyp6ay9vklnw160";
+  };
+
+  propagatedBuildInputs = with python3Packages; [ screeninfo paramiko pynput libevdev ];
+
+  meta = with stdenv.lib; {
+    description = "A program to use a reMarkable as a graphics tablet";
+    homepage = "https://github.com/evidlo/remarkable_mouse";
+    license = licenses.gpl3;
+    maintainers = [ maintainers.nickhu ];
+  };
+}
diff --git a/pkgs/applications/networking/browsers/firefox/common.nix b/pkgs/applications/networking/browsers/firefox/common.nix
index 817d17e8fad0..8060895a2e0f 100644
--- a/pkgs/applications/networking/browsers/firefox/common.nix
+++ b/pkgs/applications/networking/browsers/firefox/common.nix
@@ -94,11 +94,6 @@ stdenv.mkDerivation ({
 
   patches = [
     ./env_var_for_system_dir.patch
-    # Fix for NSS 3.52 (add missing CK_GCM_PARMS field)
-    (fetchpatch {
-      url = "https://hg.mozilla.org/mozilla-central/raw-rev/463069687b3d";
-      sha256 = "00yhz67flnkww3rbry0kqn6z6bm7vxfb2sgf7qikgbjcm3ysvpsm";
-    })
   ]
   ++ patches;
 
@@ -143,7 +138,6 @@ stdenv.mkDerivation ({
     "-Wno-error=format-security");
 
   postPatch = ''
-    substituteInPlace third_party/prio/prio/rand.c --replace 'nspr/prinit.h' 'prinit.h'
     rm -rf obj-x86_64-pc-linux-gnu
   '';
 
diff --git a/pkgs/applications/networking/browsers/firefox/packages.nix b/pkgs/applications/networking/browsers/firefox/packages.nix
index 753791be07c5..f0ca1c7cd154 100644
--- a/pkgs/applications/networking/browsers/firefox/packages.nix
+++ b/pkgs/applications/networking/browsers/firefox/packages.nix
@@ -7,10 +7,10 @@ in
 rec {
   firefox = common rec {
     pname = "firefox";
-    ffversion = "76.0.1";
+    ffversion = "77.0.1";
     src = fetchurl {
       url = "mirror://mozilla/firefox/releases/${ffversion}/source/firefox-${ffversion}.source.tar.xz";
-      sha512 = "0gnhfcgrz6022xf3vqia3s3639xa5pjp13h343d3c09mn8r919cmm6s38vzj1v3734fm25zb68acyarsp72xqq8z1420rh02b2pv38q";
+      sha512 = "ngLihC0YuclLJEV3iPEX+tRzDKIdBe+CCOuFxvWNo7DnX8royOvTj2m4YyWyZoTQ5UCbPTQYmP4otgfovZSe8g==";
     };
 
     patches = [
diff --git a/pkgs/applications/networking/cluster/helmsman/default.nix b/pkgs/applications/networking/cluster/helmsman/default.nix
index 097213568065..5fb0b3658851 100644
--- a/pkgs/applications/networking/cluster/helmsman/default.nix
+++ b/pkgs/applications/networking/cluster/helmsman/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "helmsman";
-  version = "3.4.1";
+  version = "3.4.3";
 
   src = fetchFromGitHub {
     owner = "Praqma";
     repo = "helmsman";
     rev = "v${version}";
-    sha256 = "0h89lgp3n7nd7dy8nq4bfxg938imdjsvs1k6yg8j37vgdmi24sa6";
+    sha256 = "0jbinnzdw32l7zh02k81gnw9rnqi8f5k5sp2qv8p9l9kgziaycvn";
   };
 
   vendorSha256 = "05vnysr5r3hbayss1pyifgp989kjw81h95iack8ady62k6ys5njl";
diff --git a/pkgs/applications/networking/cluster/luigi/default.nix b/pkgs/applications/networking/cluster/luigi/default.nix
index ced4c45d059d..c6e2b7d85598 100644
--- a/pkgs/applications/networking/cluster/luigi/default.nix
+++ b/pkgs/applications/networking/cluster/luigi/default.nix
@@ -2,11 +2,11 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "luigi";
-  version = "2.8.13";
+  version = "3.0.0";
 
   src = python3Packages.fetchPypi {
     inherit pname version;
-    sha256 = "0x14549iwj7r1knc0hmic9ny9hp960yjjqi4mxl78jb69gd3bhmf";
+    sha256 = "1km9fnq4pf0iqqcmz94idm0zb3l92zinz0bn6ip86xqhchafd4vf";
   };
 
   propagatedBuildInputs = with python3Packages; [ dateutil tornado_4 python-daemon boto3 ];
@@ -18,12 +18,13 @@ python3Packages.buildPythonApplication rec {
   makeWrapperArgs = ["--prefix PYTHONPATH . :"];
 
   meta = with lib; {
-    homepage = "https://github.com/spotify/luigi";
     description = "Python package that helps you build complex pipelines of batch jobs";
     longDescription = ''
       Luigi handles dependency resolution, workflow management, visualization,
       handling failures, command line integration, and much more.
     '';
+    homepage = "https://github.com/spotify/luigi";
+    changelog = "https://github.com/spotify/luigi/releases/tag/${version}";
     license =  [ licenses.asl20 ];
     maintainers = [ maintainers.bhipple ];
   };
diff --git a/pkgs/applications/networking/cluster/minishift/default.nix b/pkgs/applications/networking/cluster/minishift/default.nix
index 0c932396e9e2..cd11bcbb431c 100644
--- a/pkgs/applications/networking/cluster/minishift/default.nix
+++ b/pkgs/applications/networking/cluster/minishift/default.nix
@@ -4,7 +4,7 @@
 }:
 
 let
-  version = "1.34.0";
+  version = "1.34.2";
 
   # Update these on version bumps according to Makefile
   centOsIsoVersion = "v1.15.0";
@@ -18,7 +18,7 @@ in buildGoPackage rec {
     owner = "minishift";
     repo = "minishift";
     rev = "v${version}";
-    sha256 = "0nc1g4lmz5ww6rjyyanp9vq4sj6fvi9zf9qjc4lpsmapddhjkdy7";
+    sha256 = "1xzjzmjs2ijg7zzw53v02lgrg1j82jd7ljcn6lprg01hhvfrwgg7";
   };
 
   nativeBuildInputs = [ pkgconfig go-bindata makeWrapper ];
diff --git a/pkgs/applications/networking/cluster/nomad/default.nix b/pkgs/applications/networking/cluster/nomad/default.nix
index da668b9589af..990679a86688 100644
--- a/pkgs/applications/networking/cluster/nomad/default.nix
+++ b/pkgs/applications/networking/cluster/nomad/default.nix
@@ -2,7 +2,7 @@
 
 buildGoPackage rec {
   pname = "nomad";
-  version = "0.11.1";
+  version = "0.11.3";
   rev = "v${version}";
 
   goPackagePath = "github.com/hashicorp/nomad";
@@ -12,7 +12,7 @@ buildGoPackage rec {
     owner = "hashicorp";
     repo = pname;
     inherit rev;
-    sha256 = "1pcn1bk7sqhhsrm3izqljwyrwdz6bdlplrajvjzka39l3k6f9hgc";
+    sha256 = "1p7g7x2gl77h1w7aip3xji3s530fj46gspargz4j3i6h4wkyvafb";
   };
 
   # ui:
diff --git a/pkgs/applications/networking/cluster/qbec/default.nix b/pkgs/applications/networking/cluster/qbec/default.nix
index a48016d5069c..0689fd096b3b 100644
--- a/pkgs/applications/networking/cluster/qbec/default.nix
+++ b/pkgs/applications/networking/cluster/qbec/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "qbec";
-  version = "0.11.2";
+  version = "0.12.0";
 
   src = fetchFromGitHub {
     owner = "splunk";
     repo = "qbec";
     rev = "v${version}";
-    sha256 = "1lf9srkmi7r6p3him19akzag13hj8arwlkm9mdy8a8fg1ascqbm4";
+    sha256 = "0vy1cqqyga68qjbvyhsgl281qkbsvhvmwbxc93hygsxzm9kczy4p";
   };
 
-  vendorSha256 = "1cyr621fb6hxwswz9lf75brc9qjy1n9rqjkwi6r8s3y6nhw20db6";
+  vendorSha256 = "15hbjghi2ifylg7nr85qlk0alsy97h9zj6hf5w84m76dla2bcjf3";
 
   meta = with lib; {
     description = "Configure kubernetes objects on multiple clusters using jsonnet https://qbec.io";
diff --git a/pkgs/applications/networking/dnscontrol/default.nix b/pkgs/applications/networking/dnscontrol/default.nix
index e8500872d52c..70e107c063fb 100644
--- a/pkgs/applications/networking/dnscontrol/default.nix
+++ b/pkgs/applications/networking/dnscontrol/default.nix
@@ -2,7 +2,7 @@
 
 buildGoPackage rec {
   pname = "dnscontrol";
-  version = "3.0.0";
+  version = "3.2.0";
 
   goPackagePath = "github.com/StackExchange/dnscontrol";
 
@@ -10,7 +10,7 @@ buildGoPackage rec {
     owner = "StackExchange";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1j8i4k7bqkqmi6dmc9fxfab49a7qigig72rlbga902lw336p6cc7";
+    sha256 = "1lrn1whmx9zkyvs505zxrsmnr5s6kpj3kjkr6rblfwdlnadkgfj7";
   };
 
   subPackages = [ "." ];
diff --git a/pkgs/applications/networking/ftp/filezilla/default.nix b/pkgs/applications/networking/ftp/filezilla/default.nix
index 96a4227b36e1..04f0296fe82e 100644
--- a/pkgs/applications/networking/ftp/filezilla/default.nix
+++ b/pkgs/applications/networking/ftp/filezilla/default.nix
@@ -10,16 +10,10 @@
 , pugixml
 , sqlite
 , tinyxml
-, wxGTK30
+, wxGTK30-gtk3
 , xdg_utils
 }:
 
-let
-  # we can drop this when wxgtk is built with gtk3 by default
-  # see: https://github.com/NixOS/nixpkgs/pull/73145
-  wxgtk' = wxGTK30.override { compat26 = false; withGtk2 = false; };
-
-in
 stdenv.mkDerivation rec {
   pname = "filezilla";
   version = "3.48.1";
@@ -52,8 +46,8 @@ stdenv.mkDerivation rec {
     pugixml
     sqlite
     tinyxml
-    wxgtk'
-    wxgtk'.gtk
+    wxGTK30-gtk3
+    wxGTK30-gtk3.gtk
     xdg_utils
   ];
 
diff --git a/pkgs/applications/networking/instant-messengers/bluejeans/default.nix b/pkgs/applications/networking/instant-messengers/bluejeans/default.nix
index 14fbd4db1a00..bd71166be222 100644
--- a/pkgs/applications/networking/instant-messengers/bluejeans/default.nix
+++ b/pkgs/applications/networking/instant-messengers/bluejeans/default.nix
@@ -40,11 +40,11 @@
 
 stdenv.mkDerivation rec {
   pname = "bluejeans";
-  version = "2.1.0";
+  version = "2.3.0";
 
   src = fetchurl {
     url = "https://swdl.bluejeans.com/desktop-app/linux/${version}/BlueJeans.rpm";
-    sha256 = "1zhh0pla5gk75p8x84va9flvnk456pbcm1n6x8l82c9682fwr7dd";
+    sha256 = "06lcpkga8h0zpl2wlysj6n979f0yg361frp3zr0vwzln3fiil2a7";
   };
 
   nativeBuildInputs = [ rpmextract makeWrapper ];
@@ -110,6 +110,9 @@ stdenv.mkDerivation rec {
       --set LD_LIBRARY_PATH "${libPath}":"${placeholder "out"}"/opt/BlueJeans \
       --set LD_PRELOAD "$out"/opt/BlueJeans/liblocaltime64_stub.so
 
+    substituteInPlace "$out"/share/applications/bluejeans-v2.desktop \
+      --replace "/opt/BlueJeans/bluejeans-v2" "$out/bin/bluejeans"
+
     patchShebangs "$out"
   '';
 
diff --git a/pkgs/applications/networking/instant-messengers/discord/base.nix b/pkgs/applications/networking/instant-messengers/discord/base.nix
index 653da669d386..c2af3e4d3e7d 100644
--- a/pkgs/applications/networking/instant-messengers/discord/base.nix
+++ b/pkgs/applications/networking/instant-messengers/discord/base.nix
@@ -17,6 +17,7 @@ in stdenv.mkDerivation rec {
     autoPatchelfHook
     cups
     libdrm
+    libuuid
     libX11
     libXScrnSaver
     libXtst
diff --git a/pkgs/applications/networking/mailreaders/mutt/default.nix b/pkgs/applications/networking/mailreaders/mutt/default.nix
index c188e46d0076..30b3194d590b 100644
--- a/pkgs/applications/networking/mailreaders/mutt/default.nix
+++ b/pkgs/applications/networking/mailreaders/mutt/default.nix
@@ -27,11 +27,11 @@ with stdenv.lib;
 
 stdenv.mkDerivation rec {
   pname = "mutt";
-  version = "1.14.2";
+  version = "1.14.3";
 
   src = fetchurl {
     url = "http://ftp.mutt.org/pub/mutt/${pname}-${version}.tar.gz";
-    sha256 = "0cdcls0x6f2w99hkjz48hxhnx86w3bnyxzibchdc9yspih770bz2";
+    sha256 = "0wd4cv1c9hqymvml979g607nh3xxmlyx1ifc4r4qf39v6grnsmdi";
   };
 
   patches = optional smimeSupport (fetchpatch {
diff --git a/pkgs/applications/networking/mailreaders/thunderbird/default.nix b/pkgs/applications/networking/mailreaders/thunderbird/default.nix
index e36d99886e21..73536ae5fc1b 100644
--- a/pkgs/applications/networking/mailreaders/thunderbird/default.nix
+++ b/pkgs/applications/networking/mailreaders/thunderbird/default.nix
@@ -43,6 +43,7 @@
 , rustc
 , sqlite
 , stdenv
+, systemd
 , unzip
 , which
 , writeScript
@@ -305,11 +306,11 @@ stdenv.mkDerivation rec {
     )
   '';
 
-  # FIXME: This can probably be removed as soon as we package a
-  # Thunderbird >=71.0 since XUL shouldn't be anymore (in use)?
+  # FIXME: The XUL portion of this can probably be removed as soon as we
+  # package a Thunderbird >=71.0 since XUL shouldn't be anymore (in use)?
   postFixup = ''
     local xul="$out/lib/thunderbird/libxul.so"
-    patchelf --set-rpath "${libnotify}/lib:$(patchelf --print-rpath $xul)" $xul
+    patchelf --set-rpath "${libnotify}/lib:${systemd.lib}/lib:$(patchelf --print-rpath $xul)" $xul
   '';
 
   doInstallCheck = true;
diff --git a/pkgs/applications/networking/nym/default.nix b/pkgs/applications/networking/nym/default.nix
index 4a4f5c54f6b6..4dfe1dc54929 100644
--- a/pkgs/applications/networking/nym/default.nix
+++ b/pkgs/applications/networking/nym/default.nix
@@ -24,8 +24,20 @@ rustPlatform.buildRustPackage rec {
 
   buildInputs = [ openssl ];
 
-  # tests disabled until a release with https://github.com/nymtech/nym/pull/260 is available
-  doCheck = false;
+  checkType = "debug";
+
+  /*
+  Nym's test presence::converting_mixnode_presence_into_topology_mixnode::it_returns_resolved_ip_on_resolvable_hostname tries to resolve nymtech.net.
+  Since there is no external DNS resolution available in the build sandbox, we point cargo and its children (that's what we remove the 'unsetenv' call for) to a hosts file in which we statically resolve nymtech.net.
+  */
+  preCheck = ''
+    export LD_PRELOAD=${libredirect.overrideAttrs (drv: {
+      postPatch = "sed -i -e /unsetenv/d libredirect.c";
+    })}/lib/libredirect.so
+    export NIX_REDIRECTS=/etc/hosts=${writeText "nym_resolve_test_hosts" "127.0.0.1 nymtech.net"}
+  '';
+
+  postCheck = "unset NIX_REDIRECTS LD_PRELOAD";
 
 
   passthru.updateScript = ./update.sh;
diff --git a/pkgs/applications/networking/remote/wayvnc/add-missing-librt.patch b/pkgs/applications/networking/remote/wayvnc/add-missing-librt.patch
new file mode 100644
index 000000000000..e2d617bcc7ca
--- /dev/null
+++ b/pkgs/applications/networking/remote/wayvnc/add-missing-librt.patch
@@ -0,0 +1,20 @@
+diff --git a/meson.build b/meson.build
+index cc6fa03..7c2b280 100644
+--- a/meson.build
++++ b/meson.build
+@@ -24,6 +24,7 @@ add_project_arguments(c_args, language: 'c')
+ cc = meson.get_compiler('c')
+ 
+ libm = cc.find_library('m', required: false)
++librt = cc.find_library('rt', required: false)
+ 
+ pixman = dependency('pixman-1')
+ libuv = dependency('libuv')
+@@ -65,6 +66,7 @@ sources = [
+ 
+ dependencies = [
+ 	libm,
++	librt,
+ 	pixman,
+ 	libuv,
+ 	egl,
diff --git a/pkgs/applications/networking/remote/wayvnc/default.nix b/pkgs/applications/networking/remote/wayvnc/default.nix
index 865710184f93..4ca6ae952580 100644
--- a/pkgs/applications/networking/remote/wayvnc/default.nix
+++ b/pkgs/applications/networking/remote/wayvnc/default.nix
@@ -13,6 +13,8 @@ stdenv.mkDerivation rec {
     sha256 = "0aa12fkbwhzs0g2pqw1b27l33nn5dpbcvsf1z8h88kwsf9xdvb2r";
   };
 
+  patches = [ ./add-missing-librt.patch ];
+
   postPatch = ''
     substituteInPlace meson.build \
       --replace "version: '0.1.0'" "version: '${version}'"
diff --git a/pkgs/applications/networking/sync/onedrive/default.nix b/pkgs/applications/networking/sync/onedrive/default.nix
index 636761d2aaff..be255a6c1465 100644
--- a/pkgs/applications/networking/sync/onedrive/default.nix
+++ b/pkgs/applications/networking/sync/onedrive/default.nix
@@ -1,21 +1,37 @@
-{ stdenv, fetchFromGitHub, dmd, pkgconfig, curl, sqlite, libnotify }:
+{ stdenv, lib, fetchFromGitHub, autoreconfHook, ldc, installShellFiles, pkgconfig
+, curl, sqlite, libnotify
+, withSystemd ? stdenv.isLinux, systemd ? null }:
 
 stdenv.mkDerivation rec {
   pname = "onedrive";
-  version = "2.3.13";
+  version = "2.4.2";
 
   src = fetchFromGitHub {
     owner = "abraunegg";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0bcsrfh1g7bdlcp0zjn6np88qzpn5frv61lzxz9b2ayxf7wyybvi";
+    sha256 = "10s33p1xzq9c5n1bxv9n7n31afxgx9i6c17w0xgxdrma75micm3a";
   };
 
-  nativeBuildInputs = [ dmd pkgconfig ];
+  nativeBuildInputs = [ autoreconfHook ldc installShellFiles pkgconfig ];
 
-  buildInputs = [ curl sqlite libnotify ];
+  buildInputs = [
+    curl sqlite libnotify
+  ] ++ lib.optional withSystemd systemd;
 
-  configureFlags = [ "--enable-notifications" ];
+  configureFlags = [
+    "--enable-notifications"
+  ] ++ lib.optionals withSystemd [
+    "--with-systemdsystemunitdir=${placeholder "out"}/lib/systemd/system"
+    "--with-systemduserunitdir=${placeholder "out"}/lib/systemd/user"
+  ];
+
+  # we could also pass --enable-completions to configure but we would then have to
+  # figure out the paths manually and pass those along.
+  postInstall = ''
+    installShellCompletion --bash --name ${pname}  contrib/completions/complete.bash
+    installShellCompletion --zsh  --name _${pname} contrib/completions/complete.zsh
+  '';
 
   meta = with stdenv.lib; {
     description = "A complete tool to interact with OneDrive on Linux";
diff --git a/pkgs/applications/radio/cubicsdr/default.nix b/pkgs/applications/radio/cubicsdr/default.nix
index ef4d68af54c6..c85299606c03 100644
--- a/pkgs/applications/radio/cubicsdr/default.nix
+++ b/pkgs/applications/radio/cubicsdr/default.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchFromGitHub, cmake, fftw, hamlib, libpulseaudio, libGL, libX11, liquid-dsp,
-  pkgconfig, soapysdr-with-plugins, wxGTK, enableDigitalLab ? false }:
+  pkgconfig, soapysdr-with-plugins, wxGTK31-gtk3, enableDigitalLab ? false }:
 
 stdenv.mkDerivation rec {
   pname = "cubicsdr";
@@ -13,7 +13,8 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ cmake pkgconfig ];
-  buildInputs = [ fftw hamlib libpulseaudio libGL libX11 liquid-dsp soapysdr-with-plugins wxGTK ];
+
+  buildInputs = [ fftw hamlib libpulseaudio libGL libX11 liquid-dsp soapysdr-with-plugins wxGTK31-gtk3 ];
 
   cmakeFlags = [ "-DUSE_HAMLIB=ON" ]
     ++ stdenv.lib.optional enableDigitalLab "-DENABLE_DIGITAL_LAB=ON";
diff --git a/pkgs/applications/radio/limesuite/default.nix b/pkgs/applications/radio/limesuite/default.nix
index ef36eac28e42..7cadceab5611 100644
--- a/pkgs/applications/radio/limesuite/default.nix
+++ b/pkgs/applications/radio/limesuite/default.nix
@@ -1,14 +1,11 @@
 { stdenv, fetchFromGitHub, cmake
-, sqlite, wxGTK30, libusb1, soapysdr
+, sqlite, wxGTK30-gtk3, libusb1, soapysdr
 , mesa_glu, libX11, gnuplot, fltk
 } :
 
-let
-  version = "20.01.0";
-
-in stdenv.mkDerivation {
+stdenv.mkDerivation rec {
   pname = "limesuite";
-  inherit version;
+  version = "20.01.0";
 
   src = fetchFromGitHub {
     owner = "myriadrf";
@@ -17,14 +14,16 @@ in stdenv.mkDerivation {
     sha256 = "01z4idcby2lm34bbnpbp400ski7p61jjiir6sy6dalnvsl52m7vx";
   };
 
-  enableParallelBuilding = true;
-
   nativeBuildInputs = [ cmake ];
 
+  cmakeFlags = [
+    "-DOpenGL_GL_PREFERENCE=GLVND"
+  ];
+
   buildInputs = [
     libusb1
     sqlite
-    wxGTK30
+    wxGTK30-gtk3
     fltk
     gnuplot
     libusb1
@@ -34,11 +33,8 @@ in stdenv.mkDerivation {
   ];
 
   postInstall = ''
-    mkdir -p $out/lib/udev/rules.d
-    cp ../udev-rules/64-limesuite.rules $out/lib/udev/rules.d
-
-    mkdir -p $out/share/limesuite
-    cp bin/Release/lms7suite_mcu/* $out/share/limesuite
+    install -Dm444 -t $out/lib/udev/rules.d ../udev-rules/64-limesuite.rules
+    install -Dm444 -t $out/share/limesuite bin/Release/lms7suite_mcu/*
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/applications/science/biology/picard-tools/default.nix b/pkgs/applications/science/biology/picard-tools/default.nix
index a1616774d5d7..85d92d3af843 100644
--- a/pkgs/applications/science/biology/picard-tools/default.nix
+++ b/pkgs/applications/science/biology/picard-tools/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "picard-tools";
-  version = "2.22.9";
+  version = "2.23.0";
 
   src = fetchurl {
     url = "https://github.com/broadinstitute/picard/releases/download/${version}/picard.jar";
-    sha256 = "0qm32a58b2asiw8rnw1r6vz3bi61vfdan6wyr9f78fj4d07q7n53";
+    sha256 = "0yhgfz5jjw55ipgdb32wjdcb01xx2g9ikgvwinnfwswx50iscf5a";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/applications/science/logic/lean/default.nix b/pkgs/applications/science/logic/lean/default.nix
index 451aab6c049a..7fcc4cdd062e 100644
--- a/pkgs/applications/science/logic/lean/default.nix
+++ b/pkgs/applications/science/logic/lean/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "lean";
-  version = "3.15.0";
+  version = "3.16.2";
 
   src = fetchFromGitHub {
     owner  = "leanprover-community";
     repo   = "lean";
     rev    = "v${version}";
-    sha256 = "0fl8v8n53fr5qdnabici1mj3zpmjrkssx970y3q4m48s68q665v6";
+    sha256 = "0fvm7gvbr5kn258sqpnxa7dvzz84iv1dx1n066vih5gz80plz4lh";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/applications/version-management/git-and-tools/git/default.nix b/pkgs/applications/version-management/git-and-tools/git/default.nix
index 78981ef9ad0f..5686b1c6f3f5 100644
--- a/pkgs/applications/version-management/git-and-tools/git/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git/default.nix
@@ -21,7 +21,7 @@ assert sendEmailSupport -> perlSupport;
 assert svnSupport -> perlSupport;
 
 let
-  version = "2.26.2";
+  version = "2.27.0";
   svn = subversionClient.override { perlBindings = perlSupport; };
 
   gitwebPerlLibs = with perlPackages; [ CGI HTMLParser CGIFast FCGI FCGIProcManager HTMLTagCloud ];
@@ -33,7 +33,7 @@ stdenv.mkDerivation {
 
   src = fetchurl {
     url = "https://www.kernel.org/pub/software/scm/git/git-${version}.tar.xz";
-    sha256 = "0j685w6pzkn926z5nf5r8fij4ziipvw4c9yb0wc577nzf4j16rbd";
+    sha256 = "1ybk39ylvs32lywq7ra4l2kdr5izc80r9461hwfnw8pssxs9gjkk";
   };
 
   outputs = [ "out" ] ++ stdenv.lib.optional withManual "doc";
@@ -286,13 +286,14 @@ stdenv.mkDerivation {
         mv t/{,skip-}$test.sh || true
       else
         sed -i t/$test.sh \
-          -e "/^ *test_expect_.*$pattern/,/^ *' *\$/{s/^/#/}"
+          -e "/^\s*test_expect_.*$pattern/,/^\s*' *\$/{s/^/: #/}"
       fi
     }
 
     # Shared permissions are forbidden in sandbox builds.
     disable_test t0001-init shared
     disable_test t1301-shared-repo
+    disable_test t5324-split-commit-graph 'split commit-graph respects core.sharedrepository'
 
     # Our patched gettext never fallbacks
     disable_test t0201-gettext-fallbacks
@@ -343,6 +344,6 @@ stdenv.mkDerivation {
     '';
 
     platforms = stdenv.lib.platforms.all;
-    maintainers = with stdenv.lib.maintainers; [ peti wmertens globin ];
+    maintainers = with stdenv.lib.maintainers; [ primeos peti wmertens globin ];
   };
 }
diff --git a/pkgs/applications/window-managers/sway/contrib.nix b/pkgs/applications/window-managers/sway/contrib.nix
new file mode 100644
index 000000000000..e2c27fb470f7
--- /dev/null
+++ b/pkgs/applications/window-managers/sway/contrib.nix
@@ -0,0 +1,107 @@
+{ stdenv
+
+, fetchurl
+, coreutils
+, makeWrapper
+, sway-unwrapped
+, installShellFiles
+, wl-clipboard
+, libnotify
+, slurp
+, grim
+, jq
+
+, python3Packages
+}:
+
+{
+
+grimshot = stdenv.mkDerivation rec {
+  pname = "grimshot";
+  version = "2020-05-08";
+  rev = "b1d08db5f5112ab562f89564825e3e791b0682c4";
+
+  # master has new fixes and features, and a man page
+  # after sway-1.5 these may be switched to sway-unwrapped.src
+  bsrc = fetchurl {
+    url = "https://raw.githubusercontent.com/swaywm/sway/${rev}/contrib/grimshot";
+    sha256 = "1awzmzkib8a7q5s78xyh8za03lplqfpbasqp3lidqqmjqs882jq9";
+  };
+
+  msrc = fetchurl {
+    url = "https://raw.githubusercontent.com/swaywm/sway/${rev}/contrib/grimshot.1";
+    sha256 = "191xxjfhf61gkxl3b0f694h0nrwd7vfnyp5afk8snhhr6q7ia4jz";
+  };
+
+  dontBuild = true;
+  dontUnpack = true;
+  dontConfigure = true;
+
+  outputs = [ "out" "man" ];
+
+  nativeBuildInputs = [ makeWrapper installShellFiles ];
+
+  installPhase = ''
+    installManPage ${msrc}
+
+    install -Dm 0755 ${bsrc} $out/bin/grimshot
+    wrapProgram $out/bin/grimshot --set PATH \
+      "${stdenv.lib.makeBinPath [
+        sway-unwrapped
+        wl-clipboard
+        coreutils
+        libnotify
+        slurp
+        grim
+        jq
+        ] }"
+  '';
+
+  doInstallCheck = true;
+
+  installCheckPhase = ''
+    # check always returns 0
+    if [[ $($out/bin/grimshot check | grep "NOT FOUND") ]]; then false
+    else
+      echo "grimshot check passed"
+    fi
+  '';
+
+  meta = with stdenv.lib; {
+    description = "A helper for screenshots within sway";
+    homepage = "https://github.com/swaywm/sway/tree/master/contrib";
+    license = licenses.mit;
+    platforms = platforms.all;
+    maintainers = with maintainers; [
+      sway-unwrapped.meta.maintainers
+      evils
+    ];
+  };
+};
+
+
+inactive-windows-transparency = python3Packages.buildPythonApplication rec {
+  # long name is long
+  lname = "inactive-windows-transparency";
+  pname = "sway-${lname}";
+  version = sway-unwrapped.version;
+
+  src = sway-unwrapped.src;
+
+  format = "other";
+  dontBuild = true;
+  dontConfigure = true;
+
+  propagatedBuildInputs = [ python3Packages.i3ipc ];
+
+  installPhase = ''
+    install -Dm 0755 $src/contrib/${lname}.py $out/bin/${lname}.py
+  '';
+
+  meta = sway-unwrapped.meta // {
+    description = "It makes inactive sway windows transparent";
+    homepage    = "https://github.com/swaywm/sway/tree/${sway-unwrapped.version}/contrib";
+  };
+};
+
+}
diff --git a/pkgs/build-support/rust/default.nix b/pkgs/build-support/rust/default.nix
index 770a6d1042e7..8d3a7ba6929c 100644
--- a/pkgs/build-support/rust/default.nix
+++ b/pkgs/build-support/rust/default.nix
@@ -28,6 +28,13 @@
 , meta ? {}
 , target ? null
 , cargoVendorDir ? null
+, checkType ? buildType
+
+# Needed to `pushd`/`popd` into a subdir of a tarball if this subdir
+# contains a Cargo.toml, but isn't part of a workspace (which is e.g. the
+# case for `rustfmt`/etc from the `rust-sources).
+# Otherwise, everything from the tarball would've been built/tested.
+, buildAndTestSubdir ? null
 , ... } @ args:
 
 assert cargoVendorDir == null -> cargoSha256 != "unset";
@@ -163,6 +170,7 @@ stdenv.mkDerivation (args // {
   '';
 
   buildPhase = with builtins; args.buildPhase or ''
+    ${stdenv.lib.optionalString (buildAndTestSubdir != null) "pushd ${buildAndTestSubdir}"}
     runHook preBuild
 
     (
@@ -178,22 +186,29 @@ stdenv.mkDerivation (args // {
         --frozen ${concatStringsSep " " cargoBuildFlags}
     )
 
-    # rename the output dir to a architecture independent one
-    mapfile -t targets < <(find "$NIX_BUILD_TOP" -type d | grep '${releaseDir}$')
-    for target in "''${targets[@]}"; do
-      rm -rf "$target/../../${buildType}"
-      ln -srf "$target" "$target/../../"
-    done
-
     runHook postBuild
+
+    ${stdenv.lib.optionalString (buildAndTestSubdir != null) "popd"}
+
+    # This needs to be done after postBuild: packages like `cargo` do a pushd/popd in
+    # the pre/postBuild-hooks that need to be taken into account before gathering
+    # all binaries to install.
+    bins=$(find $releaseDir \
+      -maxdepth 1 \
+      -type f \
+      -executable ! \( -regex ".*\.\(so.[0-9.]+\|so\|a\|dylib\)" \))
   '';
 
-  checkPhase = args.checkPhase or ''
+  checkPhase = args.checkPhase or (let
+    argstr = "${stdenv.lib.optionalString (checkType == "release") "--release"} --target ${rustTarget} --frozen";
+  in ''
+    ${stdenv.lib.optionalString (buildAndTestSubdir != null) "pushd ${buildAndTestSubdir}"}
     runHook preCheck
-    echo "Running cargo cargo test -- ''${checkFlags} ''${checkFlagsArray+''${checkFlagsArray[@]}}"
-    cargo test -- ''${checkFlags} ''${checkFlagsArray+"''${checkFlagsArray[@]}"}
+    echo "Running cargo test ${argstr} -- ''${checkFlags} ''${checkFlagsArray+''${checkFlagsArray[@]}}"
+    cargo test ${argstr} -- ''${checkFlags} ''${checkFlagsArray+"''${checkFlagsArray[@]}"}
     runHook postCheck
-  '';
+    ${stdenv.lib.optionalString (buildAndTestSubdir != null) "popd"}
+  '');
 
   doCheck = args.doCheck or true;
 
@@ -203,13 +218,16 @@ stdenv.mkDerivation (args // {
 
   installPhase = args.installPhase or ''
     runHook preInstall
+
+    # rename the output dir to a architecture independent one
+    mapfile -t targets < <(find "$NIX_BUILD_TOP" -type d | grep '${releaseDir}$')
+    for target in "''${targets[@]}"; do
+      rm -rf "$target/../../${buildType}"
+      ln -srf "$target" "$target/../../"
+    done
     mkdir -p $out/bin $out/lib
 
-    find $releaseDir \
-      -maxdepth 1 \
-      -type f \
-      -executable ! \( -regex ".*\.\(so.[0-9.]+\|so\|a\|dylib\)" \) \
-      -print0 | xargs -r -0 cp -t $out/bin
+    xargs -r cp -t $out/bin <<< $bins
     find $releaseDir \
       -maxdepth 1 \
       -regex ".*\.\(so.[0-9.]+\|so\|a\|dylib\)" \
diff --git a/pkgs/data/fonts/fira-code/default.nix b/pkgs/data/fonts/fira-code/default.nix
index 2fd5a4bb2241..4f0fb1e81c16 100644
--- a/pkgs/data/fonts/fira-code/default.nix
+++ b/pkgs/data/fonts/fira-code/default.nix
@@ -1,7 +1,7 @@
 { stdenv, fetchzip }:
 
 let
-  version = "5";
+  version = "5.2";
 in fetchzip {
   name = "fira-code-${version}";
 
@@ -12,7 +12,7 @@ in fetchzip {
     unzip -j $downloadedFile \*.ttf -d $out/share/fonts/truetype
   '';
 
-  sha256 = "0y2871fd4l304gd7x5xmqyxv5ch9zrqng83xl95rdhlj9zqqk4fz";
+  sha256 = "16v62wj872ba4w7qxn4l6zjgqh7lrpwh1xax1bp1x9dpz08mnq06";
 
   meta = with stdenv.lib; {
     homepage = "https://github.com/tonsky/FiraCode";
diff --git a/pkgs/desktops/gnome-3/apps/evolution/default.nix b/pkgs/desktops/gnome-3/apps/evolution/default.nix
index 467971b2dba4..b9ac719004aa 100644
--- a/pkgs/desktops/gnome-3/apps/evolution/default.nix
+++ b/pkgs/desktops/gnome-3/apps/evolution/default.nix
@@ -43,11 +43,11 @@
 
 stdenv.mkDerivation rec {
   pname = "evolution";
-  version = "3.36.2";
+  version = "3.36.3";
 
   src = fetchurl {
     url = "mirror://gnome/sources/evolution/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "12ii8crp4v4bpdxrc2rkxwdxqz3qjizyfgfrmir9pcyxlg0lh2f5";
+    sha256 = "00yann3cibbsap7vh6qq08aklvydynmk6gmljkzd80kc52m6rqal";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/desktops/gnome-3/core/evince/default.nix b/pkgs/desktops/gnome-3/core/evince/default.nix
index e268b8f8f121..d9d9f916d46d 100644
--- a/pkgs/desktops/gnome-3/core/evince/default.nix
+++ b/pkgs/desktops/gnome-3/core/evince/default.nix
@@ -43,13 +43,13 @@
 
 stdenv.mkDerivation rec {
   pname = "evince";
-  version = "3.36.3";
+  version = "3.36.5";
 
   outputs = [ "out" "dev" "devdoc" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/evince/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "1clx580n8vb6w0fhdbmcsxs07yczdgidyax1y7280rafyzvvsbmg";
+    sha256 = "0z79jl0j9xq9wgwkfr0d1w1qrdy4447y8shs407n5srr0vixc3bg";
   };
 
   postPatch = ''
diff --git a/pkgs/desktops/gnome-3/core/gnome-desktop/default.nix b/pkgs/desktops/gnome-3/core/gnome-desktop/default.nix
index 94de64c9ea98..22b3f17b4256 100644
--- a/pkgs/desktops/gnome-3/core/gnome-desktop/default.nix
+++ b/pkgs/desktops/gnome-3/core/gnome-desktop/default.nix
@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-desktop";
-  version = "3.36.2";
+  version = "3.36.3.1";
 
   outputs = [ "out" "dev" "devdoc" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-desktop/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "12f724inw3sv289xqprvwh8r3qw89z67m74j3hyhkbp1n7f99y9q";
+    sha256 = "0zkbx5inprjpf4abqwn0bxc2d1rwbhv450cjh1wgz82ylagi3vab";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/compilers/binaryen/default.nix b/pkgs/development/compilers/binaryen/default.nix
index 3a03f633ff0d..651c88704da3 100644
--- a/pkgs/development/compilers/binaryen/default.nix
+++ b/pkgs/development/compilers/binaryen/default.nix
@@ -1,11 +1,11 @@
 { stdenv, cmake, python3, fetchFromGitHub, emscriptenRev ? null, substituteAll }:
 
 let
-  defaultVersion = "93";
+  defaultVersion = "94";
 
   # Map from git revs to SHA256 hashes
   sha256s = {
-    version_93 = "15y3703ha6mxcq168br0wlydas5rq66msrcsd650zrjz0ndxwsfx";
+    version_94 = "1wk20fhyppb2ljni7ifqnsx9kl1kcl6c0svc0qljf0bs6rvr9qdm";
     "1.39.1" = "0ygm9m5322h4vfpf3j63q32qxk2l26yk62hh7dkb49j51zwl1y3y";
   };
 in
diff --git a/pkgs/development/compilers/rust/cargo.nix b/pkgs/development/compilers/rust/cargo.nix
index 65614b9480e7..dfea7f6c8ef6 100644
--- a/pkgs/development/compilers/rust/cargo.nix
+++ b/pkgs/development/compilers/rust/cargo.nix
@@ -9,8 +9,7 @@ rustPlatform.buildRustPackage {
 
   # the rust source tarball already has all the dependencies vendored, no need to fetch them again
   cargoVendorDir = "vendor";
-  preBuild = "pushd src/tools/cargo";
-  postBuild = "popd";
+  buildAndTestSubdir = "src/tools/cargo";
 
   passthru.rustc = rustc;
 
diff --git a/pkgs/development/compilers/rust/clippy.nix b/pkgs/development/compilers/rust/clippy.nix
index 4857b587847e..0546ad9bac1a 100644
--- a/pkgs/development/compilers/rust/clippy.nix
+++ b/pkgs/development/compilers/rust/clippy.nix
@@ -5,8 +5,7 @@ rustPlatform.buildRustPackage {
 
   # the rust source tarball already has all the dependencies vendored, no need to fetch them again
   cargoVendorDir = "vendor";
-  preBuild = "pushd src/tools/clippy";
-  postBuild = "popd";
+  buildAndTestSubdir = "src/tools/clippy";
 
   # changes hash of vendor directory otherwise
   dontUpdateAutotoolsGnuConfigScripts = true;
diff --git a/pkgs/development/compilers/rust/rls/default.nix b/pkgs/development/compilers/rust/rls/default.nix
index 05a9d5049a4f..63a3c96a8f92 100644
--- a/pkgs/development/compilers/rust/rls/default.nix
+++ b/pkgs/development/compilers/rust/rls/default.nix
@@ -10,8 +10,9 @@ rustPlatform.buildRustPackage {
   dontUpdateAutotoolsGnuConfigScripts = true;
 
   cargoVendorDir = "vendor";
+  buildAndTestSubdir = "src/tools/rls";
+
   preBuild = ''
-    pushd src/tools/rls
     # client tests are flaky
     rm tests/client.rs
   '';
@@ -28,8 +29,6 @@ rustPlatform.buildRustPackage {
 
   doCheck = true;
 
-  preInstall = "popd";
-
   doInstallCheck = true;
   installCheckPhase = ''
     $out/bin/rls --version
diff --git a/pkgs/development/compilers/rust/rustfmt.nix b/pkgs/development/compilers/rust/rustfmt.nix
index f8ed0bce2e0d..66a18f40ad42 100644
--- a/pkgs/development/compilers/rust/rustfmt.nix
+++ b/pkgs/development/compilers/rust/rustfmt.nix
@@ -6,8 +6,7 @@ rustPlatform.buildRustPackage rec {
 
   # the rust source tarball already has all the dependencies vendored, no need to fetch them again
   cargoVendorDir = "vendor";
-  preBuild = "pushd src/tools/rustfmt";
-  preInstall = "popd";
+  buildAndTestSubdir = "src/tools/rustfmt";
 
   # changes hash of vendor directory otherwise
   dontUpdateAutotoolsGnuConfigScripts = true;
@@ -17,12 +16,6 @@ rustPlatform.buildRustPackage rec {
   # As of 1.0.0 and rustc 1.30 rustfmt requires a nightly compiler
   RUSTC_BOOTSTRAP = 1;
 
-  # we run tests in debug mode so tests look for a debug build of
-  # rustfmt. Anyway this adds nearly no compilation time.
-  preCheck = ''
-    cargo build
-  '';
-
   meta = with stdenv.lib; {
     description = "A tool for formatting Rust code according to style guidelines";
     homepage = "https://github.com/rust-lang-nursery/rustfmt";
diff --git a/pkgs/development/interpreters/perl/default.nix b/pkgs/development/interpreters/perl/default.nix
index cc43a7d2f858..9690dfac2f20 100644
--- a/pkgs/development/interpreters/perl/default.nix
+++ b/pkgs/development/interpreters/perl/default.nix
@@ -170,11 +170,11 @@ let
       priority = 6; # in `buildEnv' (including the one inside `perl.withPackages') the library files will have priority over files in `perl`
     };
   } // optionalAttrs (stdenv.buildPlatform != stdenv.hostPlatform) rec {
-    crossVersion = "1.3.2"; # Mar 21, 2020
+    crossVersion = "1.3.4"; # Jun 2, 2020
 
     perl-cross-src = fetchurl {
       url = "https://github.com/arsv/perl-cross/archive/${crossVersion}.tar.gz";
-      sha256 = "1283crdjsyi45mgdiak4jmy907mqn09frxzxp21b18hvxmfn4smq";
+      sha256 = "15wvlafhpsh9h66s3vazhx46hf8ik75473acrvf6722ijd1wpz45";
     };
 
     depsBuildBuild = [ buildPackages.stdenv.cc makeWrapper ];
@@ -194,23 +194,23 @@ in {
   perl528 = common {
     perl = pkgs.perl528;
     buildPerl = buildPackages.perl528;
-    version = "5.28.2";
-    sha256 = "1iynpsxdym4h76kgndmn3ykvwxhqz444xvaz8z2irsxkvmnlb5da";
+    version = "5.28.3";
+    sha256 = "052if351m81yhaab429i1kv77v9b15qm0g48kr6y2yjrc7bc3jdg";
   };
 
   # Maint version
   perl530 = common {
     perl = pkgs.perl530;
     buildPerl = buildPackages.perl530;
-    version = "5.30.2";
-    sha256 = "128nfdxcvxfn5kq55qcfrx2851ys8hv794dcdxbyny8rm7w7vnv6";
+    version = "5.30.3";
+    sha256 = "0vs0wwwlw47sswxaflkk4hw0y45cmc7arxx788kwpbminy5lrq1j";
   };
 
   # the latest Devel version
   perldevel = common {
     perl = pkgs.perldevel;
     buildPerl = buildPackages.perldevel;
-    version = "5.31.10";
-    sha256 = "1gvv5zs54gzb947x7ryjkaalm9rbqf8l8hwjwdm9lbfgkpg07kny";
+    version = "5.32.0-RC0";
+    sha256 = "02i6n1xa4j0ksp014yy8q0j7scjcy5mr0yd4iash2ryrrfv5yw5k";
   };
 }
diff --git a/pkgs/development/interpreters/php/default.nix b/pkgs/development/interpreters/php/default.nix
index 6ab682d97e6c..b56824c77238 100644
--- a/pkgs/development/interpreters/php/default.nix
+++ b/pkgs/development/interpreters/php/default.nix
@@ -195,9 +195,10 @@ let
 
           hardeningDisable = [ "bindnow" ];
 
-          preConfigure = ''
-            # Don't record the configure flags since this causes unnecessary
-            # runtime dependencies
+          preConfigure =
+          # Don't record the configure flags since this causes unnecessary
+          # runtime dependencies
+          ''
             for i in main/build-defs.h.in scripts/php-config.in; do
               substituteInPlace $i \
                 --replace '@CONFIGURE_COMMAND@' '(omitted)' \
@@ -206,7 +207,14 @@ let
             done
 
             export EXTENSION_DIR=$out/lib/php/extensions
-
+          ''
+          # PKG_CONFIG need not be a relative path
+          + lib.optionalString (! lib.versionAtLeast version "7.4") ''
+            for i in $(find . -type f -name "*.m4"); do
+              substituteInPlace $i \
+                --replace 'test -x "$PKG_CONFIG"' 'type -P "$PKG_CONFIG" >/dev/null'
+            done
+          '' + ''
             ./buildconf --copy --force
 
             if test -f $src/genfiles; then
diff --git a/pkgs/development/interpreters/python/cpython/2.7/default.nix b/pkgs/development/interpreters/python/cpython/2.7/default.nix
index 696be2136ecc..62aae7b22129 100644
--- a/pkgs/development/interpreters/python/cpython/2.7/default.nix
+++ b/pkgs/development/interpreters/python/cpython/2.7/default.nix
@@ -12,6 +12,7 @@
 , zlib
 , self
 , configd, coreutils
+, autoreconfHook
 , python-setup-hook
 # Some proprietary libs assume UCS2 unicode, especially on darwin :(
 , ucsEncoding ? 4
@@ -22,6 +23,7 @@
 , sha256
 , passthruFun
 , static ? false
+, enableOptimizations ? (!stdenv.isDarwin)
 }:
 
 assert x11Support -> tcl != null
@@ -85,6 +87,9 @@ let
       # backported in debian since 2013.
       # https://bugs.python.org/issue13146
       ./atomic_pyc.patch
+
+      # Backport from CPython 3.8 of a good list of tests to run for PGO.
+      ./profile-task.patch
     ] ++ optionals (x11Support && stdenv.isDarwin) [
       ./use-correct-tcl-tk-on-darwin.patch
     ] ++ optionals stdenv.isLinux [
@@ -134,7 +139,9 @@ let
         --replace 'os.popen(comm)' 'os.popen("${coreutils}/bin/nproc")'
     '';
 
-  configureFlags = [
+  configureFlags = optionals enableOptimizations [
+    "--enable-optimizations"
+  ] ++ [
     "--enable-shared"
     "--with-threads"
     "--enable-unicode=ucs${toString ucsEncoding}"
@@ -182,8 +189,9 @@ let
     ++ optionals x11Support [ tcl tk xlibsWrapper libX11 ]
     ++ optional (stdenv.isDarwin && configd != null) configd;
   nativeBuildInputs =
-    optionals (stdenv.hostPlatform != stdenv.buildPlatform)
-    [ buildPackages.stdenv.cc buildPackages.python ];
+    [ autoreconfHook ]
+    ++ optionals (stdenv.hostPlatform != stdenv.buildPlatform)
+      [ buildPackages.stdenv.cc buildPackages.python ];
 
   mkPaths = paths: {
     C_INCLUDE_PATH = makeSearchPathOutput "dev" "include" paths;
diff --git a/pkgs/development/interpreters/python/cpython/2.7/profile-task.patch b/pkgs/development/interpreters/python/cpython/2.7/profile-task.patch
new file mode 100644
index 000000000000..9c085657ac9d
--- /dev/null
+++ b/pkgs/development/interpreters/python/cpython/2.7/profile-task.patch
@@ -0,0 +1,21 @@
+Backport from CPython 3.8 of a good list of tests to run for PGO.
+
+Upstream commit:
+  https://github.com/python/cpython/commit/4e16a4a31
+
+Upstream discussion:
+  https://bugs.python.org/issue36044
+
+diff --git a/Makefile.pre.in b/Makefile.pre.in
+index 00fdd21ce..713dc1e53 100644
+--- a/Makefile.pre.in
++++ b/Makefile.pre.in
+@@ -259,7 +259,7 @@ TCLTK_LIBS=
+ # The task to run while instrumented when building the profile-opt target.
+ # We exclude unittests with -x that take a rediculious amount of time to
+ # run in the instrumented training build or do not provide much value.
+-PROFILE_TASK=-m test.regrtest --pgo -x test_asyncore test_gdb test_multiprocessing test_subprocess
++PROFILE_TASK=-m test.regrtest --pgo test_array test_base64 test_binascii test_binop test_bisect test_bytes test_bz2 test_cmath test_codecs test_collections test_complex test_dataclasses test_datetime test_decimal test_difflib test_embed test_float test_fstring test_functools test_generators test_hashlib test_heapq test_int test_itertools test_json test_long test_lzma test_math test_memoryview test_operator test_ordered_dict test_pickle test_pprint test_re test_set test_sqlite test_statistics test_struct test_tabnanny test_time test_unicode test_xml_etree test_xml_etree_c
+ 
+ # report files for gcov / lcov coverage report
+ COVERAGE_INFO= $(abs_builddir)/coverage.info
diff --git a/pkgs/development/interpreters/python/cpython/3.5/profile-task.patch b/pkgs/development/interpreters/python/cpython/3.5/profile-task.patch
new file mode 100644
index 000000000000..39d5587379ca
--- /dev/null
+++ b/pkgs/development/interpreters/python/cpython/3.5/profile-task.patch
@@ -0,0 +1,21 @@
+Backport from CPython 3.8 of a good list of tests to run for PGO.
+
+Upstream commit:
+  https://github.com/python/cpython/commit/4e16a4a31
+
+Upstream discussion:
+  https://bugs.python.org/issue36044
+
+diff --git a/Makefile.pre.in b/Makefile.pre.in
+index 00fdd21ce..713dc1e53 100644
+--- a/Makefile.pre.in
++++ b/Makefile.pre.in
+@@ -259,7 +259,7 @@ TCLTK_LIBS=
+ # The task to run while instrumented when building the profile-opt target.
+ # We exclude unittests with -x that take a rediculious amount of time to
+ # run in the instrumented training build or do not provide much value.
+-PROFILE_TASK=-m test.regrtest --pgo -x test_asyncore test_gdb test_multiprocessing_fork test_multiprocessing_forkserver test_multiprocessing_main_handling test_multiprocessing_spawn test_subprocess
++PROFILE_TASK=-m test.regrtest --pgo test_array test_base64 test_binascii test_binop test_bisect test_bytes test_bz2 test_cmath test_codecs test_collections test_complex test_dataclasses test_datetime test_decimal test_difflib test_embed test_float test_fstring test_functools test_generators test_hashlib test_heapq test_int test_itertools test_json test_long test_lzma test_math test_memoryview test_operator test_ordered_dict test_pickle test_pprint test_re test_set test_sqlite test_statistics test_struct test_tabnanny test_time test_unicode test_xml_etree test_xml_etree_c
+ 
+ # report files for gcov / lcov coverage report
+ COVERAGE_INFO= $(abs_builddir)/coverage.info
diff --git a/pkgs/development/interpreters/python/cpython/3.6/profile-task.patch b/pkgs/development/interpreters/python/cpython/3.6/profile-task.patch
new file mode 100644
index 000000000000..df55da3a4132
--- /dev/null
+++ b/pkgs/development/interpreters/python/cpython/3.6/profile-task.patch
@@ -0,0 +1,21 @@
+Backport from CPython 3.8 of a good list of tests to run for PGO.
+
+Upstream commit:
+  https://github.com/python/cpython/commit/4e16a4a31
+
+Upstream discussion:
+  https://bugs.python.org/issue36044
+
+diff --git a/Makefile.pre.in b/Makefile.pre.in
+index 00fdd21ce..713dc1e53 100644
+--- a/Makefile.pre.in
++++ b/Makefile.pre.in
+@@ -259,7 +259,7 @@ TCLTK_LIBS=
+ # The task to run while instrumented when building the profile-opt target.
+ # We exclude unittests with -x that take a rediculious amount of time to
+ # run in the instrumented training build or do not provide much value.
+-PROFILE_TASK=-m test.regrtest --pgo
++PROFILE_TASK=-m test.regrtest --pgo test_array test_base64 test_binascii test_binop test_bisect test_bytes test_bz2 test_cmath test_codecs test_collections test_complex test_dataclasses test_datetime test_decimal test_difflib test_embed test_float test_fstring test_functools test_generators test_hashlib test_heapq test_int test_itertools test_json test_long test_lzma test_math test_memoryview test_operator test_ordered_dict test_pickle test_pprint test_re test_set test_sqlite test_statistics test_struct test_tabnanny test_time test_unicode test_xml_etree test_xml_etree_c
+ 
+ # report files for gcov / lcov coverage report
+ COVERAGE_INFO= $(abs_builddir)/coverage.info
diff --git a/pkgs/development/interpreters/python/cpython/default.nix b/pkgs/development/interpreters/python/cpython/default.nix
index 32fc65368623..694f661a9669 100644
--- a/pkgs/development/interpreters/python/cpython/default.nix
+++ b/pkgs/development/interpreters/python/cpython/default.nix
@@ -12,6 +12,7 @@
 , zlib
 , self
 , configd
+, autoreconfHook
 , python-setup-hook
 , nukeReferences
 # For the Python package set
@@ -30,6 +31,9 @@
 , stripBytecode ? false
 , includeSiteCustomize ? true
 , static ? false
+# Not using optimizations on Darwin
+# configure: error: llvm-profdata is required for a --enable-optimizations build but could not be found.
+, enableOptimizations ? (!stdenv.isDarwin)
 }:
 
 assert x11Support -> tcl != null
@@ -52,7 +56,9 @@ let
 
   version = with sourceVersion; "${major}.${minor}.${patch}${suffix}";
 
-  nativeBuildInputs = [
+  nativeBuildInputs = optionals (!stdenv.isDarwin) [
+    autoreconfHook
+  ] ++ [
     nukeReferences
   ] ++ optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
     buildPackages.stdenv.cc
@@ -110,6 +116,14 @@ in with passthru; stdenv.mkDerivation {
   ] ++ optionals (isPy37 || isPy38 || isPy39) [
     # Fix darwin build https://bugs.python.org/issue34027
     ./3.7/darwin-libutil.patch
+  ] ++ optionals (pythonOlder "3.8") [
+    # Backport from CPython 3.8 of a good list of tests to run for PGO.
+    (
+      if isPy36 || isPy37 then
+        ./3.6/profile-task.patch
+      else
+        ./3.5/profile-task.patch
+    )
   ] ++ optionals (isPy3k && hasDistutilsCxxPatch) [
     # Fix for http://bugs.python.org/issue1222585
     # Upstream distutils is calling C compiler to compile C++ code, which
@@ -142,10 +156,14 @@ in with passthru; stdenv.mkDerivation {
 
   configureFlags = [
     "--enable-shared"
-    "--with-threads"
     "--without-ensurepip"
     "--with-system-expat"
     "--with-system-ffi"
+  ] ++ optionals enableOptimizations [
+    "--enable-optimizations"
+  ] ++ optionals (pythonOlder "3.7") [
+    # This is unconditionally true starting in CPython 3.7.
+    "--with-threads"
   ] ++ optionals (sqlite != null && isPy3k) [
     "--enable-loadable-sqlite-extensions"
   ] ++ optionals (openssl != null) [
diff --git a/pkgs/development/interpreters/python/default.nix b/pkgs/development/interpreters/python/default.nix
index a3ba72a27b27..b05f989714a5 100644
--- a/pkgs/development/interpreters/python/default.nix
+++ b/pkgs/development/interpreters/python/default.nix
@@ -129,7 +129,7 @@ in {
   };
 
   # Minimal versions of Python (built without optional dependencies)
-  python3Minimal = (python37.override {
+  python3Minimal = (python38.override {
     self = python3Minimal;
     pythonForBuild = pkgs.buildPackages.python3Minimal;
     # strip down that python version as much as possible
@@ -146,6 +146,7 @@ in {
     rebuildBytecode = false;
     stripBytecode = true;
     includeSiteCustomize = false;
+    enableOptimizations = false;
   }).overrideAttrs(old: {
     pname = "python3-minimal";
     meta = old.meta // {
diff --git a/pkgs/development/interpreters/python/hooks/pip-build-hook.sh b/pkgs/development/interpreters/python/hooks/pip-build-hook.sh
index 292f13d30154..6dd384b4847f 100644
--- a/pkgs/development/interpreters/python/hooks/pip-build-hook.sh
+++ b/pkgs/development/interpreters/python/hooks/pip-build-hook.sh
@@ -24,7 +24,8 @@ pipShellHook() {
       export PATH="$tmp_path/bin:$PATH"
       export PYTHONPATH="$tmp_path/@pythonSitePackages@:$PYTHONPATH"
       mkdir -p "$tmp_path/@pythonSitePackages@"
-      @pythonInterpreter@ -m pip install -e . --prefix "$tmp_path" >&2
+      @pythonInterpreter@ -m pip install -e . --prefix "$tmp_path" \
+         --no-build-isolation >&2
     fi
 
     runHook postShellHook
diff --git a/pkgs/development/interpreters/python/hooks/setuptools-build-hook.sh b/pkgs/development/interpreters/python/hooks/setuptools-build-hook.sh
index 2aec92793825..311590425e68 100644
--- a/pkgs/development/interpreters/python/hooks/setuptools-build-hook.sh
+++ b/pkgs/development/interpreters/python/hooks/setuptools-build-hook.sh
@@ -29,7 +29,8 @@ setuptoolsShellHook() {
         export PATH="$tmp_path/bin:$PATH"
         export PYTHONPATH="$tmp_path/@pythonSitePackages@:$PYTHONPATH"
         mkdir -p "$tmp_path/@pythonSitePackages@"
-        eval "@pythonInterpreter@ -m pip install -e . --prefix $tmp_path >&2"
+        eval "@pythonInterpreter@ -m pip install -e . --prefix $tmp_path \
+          --no-build-isolation >&2"
     fi
 
     runHook postShellHook
diff --git a/pkgs/development/libraries/audio/libgme/default.nix b/pkgs/development/libraries/audio/libgme/default.nix
index bcd6070831bb..3ac8293986d8 100644
--- a/pkgs/development/libraries/audio/libgme/default.nix
+++ b/pkgs/development/libraries/audio/libgme/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromBitbucket, cmake }:
+{ stdenv, fetchFromBitbucket, cmake, removeReferencesTo }:
 let
   version = "0.6.3";
 in stdenv.mkDerivation {
@@ -21,4 +21,14 @@ in stdenv.mkDerivation {
   };
 
   buildInputs = [ cmake ];
+
+  nativeBuildInputs = [ removeReferencesTo ];
+
+  # It used to reference it, in the past, but thanks to the postFixup hook, now
+  # it doesn't.
+  disallowedReferences = [ stdenv.cc.cc ];
+
+  postFixup = stdenv.lib.optionalString stdenv.isLinux ''
+    remove-references-to -t ${stdenv.cc.cc} "$(readlink -f $out/lib/libgme.so)"
+  '';
 }
diff --git a/pkgs/development/libraries/dbus/default.nix b/pkgs/development/libraries/dbus/default.nix
index a3e3c4ebd89a..049623d3d911 100644
--- a/pkgs/development/libraries/dbus/default.nix
+++ b/pkgs/development/libraries/dbus/default.nix
@@ -20,11 +20,11 @@ assert enableSystemd -> systemd != null;
 
 stdenv.mkDerivation rec {
   pname = "dbus";
-  version = "1.12.16";
+  version = "1.12.18";
 
   src = fetchurl {
     url = "https://dbus.freedesktop.org/releases/dbus/dbus-${version}.tar.gz";
-    sha256 = "107ckxaff1cv4q6kmfdi2fb1nlsv03312a7kf6lb4biglhpjv8jl";
+    sha256 = "01jkm6shm76bl3cflmnn37dv6nkph0w1akbqpklyac02hiq4vkv4";
   };
 
   patches = lib.optional stdenv.isSunOS ./implement-getgrouplist.patch;
diff --git a/pkgs/development/libraries/gcc/libgcc/default.nix b/pkgs/development/libraries/gcc/libgcc/default.nix
index d638c2bb2788..f579da5f1d6c 100644
--- a/pkgs/development/libraries/gcc/libgcc/default.nix
+++ b/pkgs/development/libraries/gcc/libgcc/default.nix
@@ -63,7 +63,7 @@ stdenvNoLibs.mkDerivation rec {
       export CPP_FOR_TARGET=${stdenvNoLibs.cc}/bin/$CPP
       export LD_FOR_TARGET=${stdenvNoLibs.cc.bintools}/bin/$LD
 
-      export NIX_BUILD_CFLAGS_COMPILE+=' -DGENERATOR_FILE=1'
+      export NIX_CFLAGS_COMPILE_FOR_BUILD+=' -DGENERATOR_FILE=1'
 
       "$sourceRoot/../gcc/configure" $gccConfigureFlags
 
diff --git a/pkgs/development/libraries/glibc/2.30-cve-2020-1752.patch b/pkgs/development/libraries/glibc/2.30-cve-2020-1752.patch
new file mode 100644
index 000000000000..75d874b93d09
--- /dev/null
+++ b/pkgs/development/libraries/glibc/2.30-cve-2020-1752.patch
@@ -0,0 +1,62 @@
+From: Andreas Schwab <schwab@suse.de>
+Date: Wed, 19 Feb 2020 16:21:46 +0000 (+0100)
+Subject: Fix use-after-free in glob when expanding ~user (bug 25414)
+X-Git-Url: https://sourceware.org/git/?p=glibc.git;a=commitdiff_plain;h=da97c6b88eb03fb834e92964b0895c2ac8d61f63;hp=dd34bce38c822b67fcc42e73969bf6699d6874b6
+
+Fix use-after-free in glob when expanding ~user (bug 25414)
+
+The value of `end_name' points into the value of `dirname', thus don't
+deallocate the latter before the last use of the former.
+
+(cherry picked from commit ddc650e9b3dc916eab417ce9f79e67337b05035c)
+---
+
+diff --git a/posix/glob.c b/posix/glob.c
+index e73e35c510..c6cbd0eb43 100644
+--- a/posix/glob.c
++++ b/posix/glob.c
+@@ -827,31 +827,32 @@ __glob (const char *pattern, int flags, int (*errfunc) (const char *, int),
+ 	      {
+ 		size_t home_len = strlen (p->pw_dir);
+ 		size_t rest_len = end_name == NULL ? 0 : strlen (end_name);
+-		char *d;
++		char *d, *newp;
++		bool use_alloca = glob_use_alloca (alloca_used,
++						   home_len + rest_len + 1);
+ 
+-		if (__glibc_unlikely (malloc_dirname))
+-		  free (dirname);
+-		malloc_dirname = 0;
+-
+-		if (glob_use_alloca (alloca_used, home_len + rest_len + 1))
+-		  dirname = alloca_account (home_len + rest_len + 1,
+-					    alloca_used);
++		if (use_alloca)
++		  newp = alloca_account (home_len + rest_len + 1, alloca_used);
+ 		else
+ 		  {
+-		    dirname = malloc (home_len + rest_len + 1);
+-		    if (dirname == NULL)
++		    newp = malloc (home_len + rest_len + 1);
++		    if (newp == NULL)
+ 		      {
+ 			scratch_buffer_free (&pwtmpbuf);
+ 			retval = GLOB_NOSPACE;
+ 			goto out;
+ 		      }
+-		    malloc_dirname = 1;
+ 		  }
+-		d = mempcpy (dirname, p->pw_dir, home_len);
++		d = mempcpy (newp, p->pw_dir, home_len);
+ 		if (end_name != NULL)
+ 		  d = mempcpy (d, end_name, rest_len);
+ 		*d = '\0';
+ 
++		if (__glibc_unlikely (malloc_dirname))
++		  free (dirname);
++		dirname = newp;
++		malloc_dirname = !use_alloca;
++
+ 		dirlen = home_len + rest_len;
+ 		dirname_modified = 1;
+ 	      }
diff --git a/pkgs/development/libraries/glibc/common.nix b/pkgs/development/libraries/glibc/common.nix
index 0429c7295fb8..36b6bea61cd4 100644
--- a/pkgs/development/libraries/glibc/common.nix
+++ b/pkgs/development/libraries/glibc/common.nix
@@ -106,10 +106,10 @@ stdenv.mkDerivation ({
         url = "https://salsa.debian.org/glibc-team/glibc/raw/49767c9f7de4828220b691b29de0baf60d8a54ec/debian/patches/localedata/locale-C.diff";
         sha256 = "0irj60hs2i91ilwg5w7sqrxb695c93xg0ik7yhhq9irprd7fidn4";
       })
-    ]
-    ++ lib.optionals stdenv.isx86_64 [
+
       ./fix-x64-abi.patch
       ./2.27-CVE-2019-19126.patch
+      ./2.30-cve-2020-1752.patch
     ]
     ++ lib.optional stdenv.hostPlatform.isMusl ./fix-rpc-types-musl-conflicts.patch
     ++ lib.optional stdenv.buildPlatform.isDarwin ./darwin-cross-build.patch;
diff --git a/pkgs/development/libraries/gnutls/default.nix b/pkgs/development/libraries/gnutls/default.nix
index 6d0faa03a888..f75d107718da 100644
--- a/pkgs/development/libraries/gnutls/default.nix
+++ b/pkgs/development/libraries/gnutls/default.nix
@@ -8,7 +8,7 @@
 
 assert guileBindings -> guile != null;
 let
-  version = "3.6.13";
+  version = "3.6.14";
 
   # XXX: Gnulib's `test-select' fails on FreeBSD:
   # https://hydra.nixos.org/build/2962084/nixlog/1/raw .
@@ -24,7 +24,7 @@ stdenv.mkDerivation {
 
   src = fetchurl {
     url = "mirror://gnupg/gnutls/v3.6/gnutls-${version}.tar.xz";
-    sha256 = "0f1gnm0756qms5cpx6yn6xb8d3imc2gkqmygf12n9x6r8zs1s11j";
+    sha256 = "0qwxsfizynly0ns537vnhnlm5lh03la4vbsmz675n0n7vqd7ac2n";
   };
 
   outputs = [ "bin" "dev" "out" "man" "devdoc" ];
diff --git a/pkgs/development/libraries/jbig2dec/default.nix b/pkgs/development/libraries/jbig2dec/default.nix
index 8cc2ce008716..22d38a080cab 100644
--- a/pkgs/development/libraries/jbig2dec/default.nix
+++ b/pkgs/development/libraries/jbig2dec/default.nix
@@ -1,18 +1,19 @@
-{ stdenv, fetchurl, python3, autoconf }:
+{ stdenv, fetchurl, python3, autoreconfHook }:
 
 stdenv.mkDerivation rec {
-  name = "jbig2dec-0.17";
+  pname = "jbig2dec";
+  version = "0.18";
 
   src = fetchurl {
-    url = "https://github.com/ArtifexSoftware/ghostpdl-downloads/releases/download/gs950/${name}.tar.gz";
-    sha256 = "0wpvslmwazia3z8gyk343kbq6yj47pxr4x5yjvx332v309qssazp";
+    url = "https://github.com/ArtifexSoftware/ghostpdl-downloads/releases/download/gs952/${pname}-${version}.tar.gz";
+    sha256 = "0pigfw2v0ppvr0lbysm69gx0zsa5q2q92yrb8af2j3im6x97f6cy";
   };
 
   postPatch = ''
     patchShebangs test_jbig2dec.py
   '';
 
-  buildInputs = [ autoconf ];
+  buildInputs = [ autoreconfHook ];
 
   checkInputs = [ python3 ];
   doCheck = true;
diff --git a/pkgs/development/libraries/libarchive/default.nix b/pkgs/development/libraries/libarchive/default.nix
index 118adc61623a..d1917de37d6a 100644
--- a/pkgs/development/libraries/libarchive/default.nix
+++ b/pkgs/development/libraries/libarchive/default.nix
@@ -1,6 +1,6 @@
 {
   fetchFromGitHub, stdenv, pkgconfig, autoreconfHook,
-  acl, attr, bzip2, e2fsprogs, libxml2, lzo, openssl, sharutils, xz, zlib,
+  acl, attr, bzip2, e2fsprogs, libxml2, lzo, openssl, sharutils, xz, zlib, zstd,
 
   # Optional but increases closure only negligibly.
   xarSupport ? true,
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
   outputs = [ "out" "lib" "dev" ];
 
   nativeBuildInputs = [ pkgconfig autoreconfHook ];
-  buildInputs = [ sharutils zlib bzip2 openssl xz lzo ]
+  buildInputs = [ sharutils zlib bzip2 openssl xz lzo zstd ]
     ++ stdenv.lib.optionals stdenv.isLinux [ e2fsprogs attr acl ]
     ++ stdenv.lib.optional xarSupport libxml2;
 
diff --git a/pkgs/development/libraries/libdap/default.nix b/pkgs/development/libraries/libdap/default.nix
index 27084e54a827..bc05e774cd86 100644
--- a/pkgs/development/libraries/libdap/default.nix
+++ b/pkgs/development/libraries/libdap/default.nix
@@ -1,7 +1,7 @@
 { stdenv, fetchurl, bison, libuuid, curl, libxml2, flex }:
 
 stdenv.mkDerivation rec {
-  version = "3.20.5";
+  version = "3.20.6";
   pname = "libdap";
 
   nativeBuildInputs = [ bison flex ];
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://www.opendap.org/pub/source/${pname}-${version}.tar.gz";
-    sha256 = "15jysnsmdjs7q4iafb4qzq4b76cfyvmbxgcxnqg4sr0x4bplwfnb";
+    sha256 = "0jn5bi8k2lq6mmrsw7r1r5aviyf8gb39b2iy20v4kpkj5napzk1m";
   };
 
   meta = with stdenv.lib; {
diff --git a/pkgs/development/libraries/libexif/default.nix b/pkgs/development/libraries/libexif/default.nix
index 090c6a2fff34..fd2ed39e34a4 100644
--- a/pkgs/development/libraries/libexif/default.nix
+++ b/pkgs/development/libraries/libexif/default.nix
@@ -1,45 +1,24 @@
-{ stdenv, fetchurl, fetchpatch, gettext }:
+{ stdenv, fetchFromGitHub, autoreconfHook, gettext }:
 
 stdenv.mkDerivation rec {
-  name = "libexif-0.6.21";
+  pname = "libexif";
+  version = "0.6.22";
 
-  src = fetchurl {
-    url = "mirror://sourceforge/libexif/${name}.tar.bz2";
-    sha256 = "06nlsibr3ylfwp28w8f5466l6drgrnydgxrm4jmxzrmk5svaxk8n";
+  src = fetchFromGitHub {
+    owner = pname;
+    repo = pname;
+    rev = "${pname}-${builtins.replaceStrings ["."] ["_"] version}-release";
+    sha256 = "0mzndakdi816zcs13z7yzp7hj031p2dcyfq2p391r63d9z21jmy1";
   };
 
-  patches = [
-    (fetchpatch {
-      name = "CVE-2017-7544.patch";
-      url = "https://github.com/libexif/libexif/commit/c39acd1692023b26290778a02a9232c873f9d71a.patch";
-      sha256 = "0xgx6ly2i4q05shb61mfx6njwf1yp347jkznm0ka4m85i41xm6sd";
-    })
-    (fetchpatch {
-      name = "CVE-2018-20030-1.patch";
-      url = "https://github.com/libexif/libexif/commit/5d28011c40ec86cf52cffad541093d37c263898a.patch";
-      sha256 = "1wv8s962wmbn2m2xypgirf12g6msrbplpsmd5bh86irfwhkcppj3";
-    })
-    (fetchpatch {
-      name = "CVE-2018-20030-2.patch";
-      url = "https://github.com/libexif/libexif/commit/6aa11df549114ebda520dde4cdaea2f9357b2c89.patch";
-      sha256 = "01aqvz63glwq6wg0wr7ykqqghb4abgq77ghvhizbzadg1k4h7drx";
-      excludes = [ "NEWS" ];
-    })
-    (fetchpatch {
-      name = "CVE-2019-9278.patch";
-      url = "https://github.com/libexif/libexif/commit/75aa73267fdb1e0ebfbc00369e7312bac43d0566.patch";
-      sha256 = "10ikg33mips5zq9as7l9xqnyzbg1wwr4sw17517nzf4hafjpasrj";
-    })
-  ];
+  nativeBuildInputs = [ autoreconfHook gettext ];
 
-  buildInputs = [ gettext ];
-
-  meta = {
+  meta = with stdenv.lib; {
     homepage = "https://libexif.github.io/";
     description = "A library to read and manipulate EXIF data in digital photographs";
-    license = stdenv.lib.licenses.lgpl21;
-    platforms = stdenv.lib.platforms.unix;
-    maintainers = [ stdenv.lib.maintainers.erictapen ];
+    license = licenses.lgpl21;
+    platforms = platforms.unix;
+    maintainers = with maintainers; [ erictapen ];
   };
 
 }
diff --git a/pkgs/development/libraries/libgpg-error/default.nix b/pkgs/development/libraries/libgpg-error/default.nix
index e170e4931b83..1e49a72096a3 100644
--- a/pkgs/development/libraries/libgpg-error/default.nix
+++ b/pkgs/development/libraries/libgpg-error/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, buildPackages, fetchurl, gettext, fetchpatch
+{ stdenv, lib, buildPackages, fetchurl, gettext
 , genPosixLockObjOnly ? false
 }: let
   genPosixLockObjOnlyAttrs = lib.optionalAttrs genPosixLockObjOnly {
@@ -17,25 +17,14 @@
   };
 in stdenv.mkDerivation (rec {
   pname = "libgpg-error";
-  version = "1.36";
+  version = "1.38";
 
   src = fetchurl {
     url = "mirror://gnupg/${pname}/${pname}-${version}.tar.bz2";
-    sha256 = "0z696dmhfxm2n6pmr8b857wwljq9h633yi99bhbn7h88f91rigds";
+    sha256 = "00px79xzyc5lj8aig7i4fhk29h1lkqp4840wjfgi9mv9m9sq566q";
   };
 
-  # Remove gawk buildfix on > 1.36
-  patches = [
-    (fetchpatch {
-      url = "https://dev.gnupg.org/rE7865041c77f4f7005282f10f9b6666b19072fbdf?diff=1";
-      sha256 = "0hs4rpwqq2afpsbqliq451jjaysq2iyzxvd9sx3992b4vnllgqqq";
-    })
-  ];
-
   postPatch = ''
-    # Remove on > 1.36 release: gawk upgrade fix didn't include Makefile regeneration
-    sed 's/-v namespace=errnos_/-v pkg_namespace=errnos_/' -i src/Makefile.in
-
     sed '/BUILD_TIMESTAMP=/s/=.*/=1970-01-01T00:01+0000/' -i ./configure
   '' + lib.optionalString (stdenv.hostPlatform.isAarch32 && stdenv.buildPlatform != stdenv.hostPlatform) ''
     ln -s lock-obj-pub.arm-unknown-linux-gnueabi.h src/syscfg/lock-obj-pub.linux-gnueabihf.h
diff --git a/pkgs/development/libraries/libheif/default.nix b/pkgs/development/libraries/libheif/default.nix
index b5717034da0e..d147820cff1c 100644
--- a/pkgs/development/libraries/libheif/default.nix
+++ b/pkgs/development/libraries/libheif/default.nix
@@ -2,7 +2,7 @@
 
 stdenv.mkDerivation rec {
   pname = "libheif";
-  version = "1.6.2";
+  version = "1.7.0";
 
   outputs = [ "bin" "out" "dev" "man" ];
 
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
     owner = "strukturag";
     repo = "libheif";
     rev = "v${version}";
-    sha256 = "0ngbzban585hsgs6fb6fkhccc91kxn1n59qvqjp8bw41l24i3nr2";
+    sha256 = "0alri5h486ck9b5z6wwrmlpzydhz58l223z3zxkizqrzxlllhr6p";
   };
 
   nativeBuildInputs = [ autoreconfHook pkgconfig ];
diff --git a/pkgs/development/libraries/liblastfm/default.nix b/pkgs/development/libraries/liblastfm/default.nix
index 762e707528a6..830e125685e7 100644
--- a/pkgs/development/libraries/liblastfm/default.nix
+++ b/pkgs/development/libraries/liblastfm/default.nix
@@ -1,27 +1,24 @@
-{ stdenv, fetchurl, pkgconfig, which, cmake
+{ stdenv, fetchFromGitHub, fetchpatch, pkgconfig, which, cmake
 , fftwSinglePrec, libsamplerate, qtbase
 , darwin }:
 
-let version = "1.1.0"; in
-
 stdenv.mkDerivation rec {
-  pname = "liblastfm";
-  inherit version;
+  pname = "liblastfm-unstable";
+  version = "2019-08-23";
 
-  # Upstream does not package git tags as tarballs. Get tarball from github.
-  src = fetchurl {
-    url = "https://github.com/lastfm/liblastfm/tarball/${version}";
-    name = "${pname}-${version}.tar.gz";
-    sha256 = "1j34xc30vg7sfszm2jx9mlz9hy7p1l929fka9wnfcpbib8gfi43x";
+  src = fetchFromGitHub {
+    owner = "lastfm";
+    repo = "liblastfm";
+    rev = "2ce2bfe1879227af8ffafddb82b218faff813db9";
+    sha256 = "1crih9xxf3rb109aqw12bjqv47z28lvlk2dpvyym5shf82nz6yd0";
   };
 
-  postPatch = ''
-    substituteInPlace CMakeLists.txt \
-      --replace 'find_package(Qt5Core QUIET)' \
-                'find_package(Qt5 REQUIRED COMPONENTS Core Network Sql Test Xml)'
-  '';
+  patches = [(fetchpatch {
+    url = "https://github.com/lastfm/liblastfm/commit/9c5d072b55f2863310e40291677e6397e9cbc3c2.patch";
+    name = "0001-Remove-deprecated-staging-server-and-fix-test-for-QT5-at-Ubuntu-19.10.patch";
+    sha256 = "04r14prydxshjgfws3pjajjmp2msszhjjs1mjh8s66yg29vq620l";
+  })];
 
-  prefixKey = "--prefix ";
   nativeBuildInputs = [ pkgconfig which cmake ];
   buildInputs = [ fftwSinglePrec libsamplerate qtbase ]
     ++ stdenv.lib.optional stdenv.isDarwin darwin.apple_sdk.frameworks.SystemConfiguration;
@@ -31,7 +28,7 @@ stdenv.mkDerivation rec {
     repositories.git = "git://github.com/lastfm/liblastfm.git";
     description = "Official LastFM library";
     platforms = platforms.unix;
-    maintainers =  [ maintainers.phreedom ];
+    maintainers = [ maintainers.phreedom ];
     license = licenses.gpl3;
   };
 }
diff --git a/pkgs/development/libraries/libpcap/default.nix b/pkgs/development/libraries/libpcap/default.nix
index 35cf4485f72e..d9cb91e4fb3b 100644
--- a/pkgs/development/libraries/libpcap/default.nix
+++ b/pkgs/development/libraries/libpcap/default.nix
@@ -24,12 +24,14 @@ stdenv.mkDerivation rec {
   ] ++ optionals (stdenv.hostPlatform == stdenv.buildPlatform)
     [ "ac_cv_linux_vers=2" ];
 
-  dontStrip = stdenv.hostPlatform != stdenv.buildPlatform;
-
   prePatch = optionalString stdenv.isDarwin ''
     substituteInPlace configure --replace " -arch i386" ""
   '';
 
+  postInstall = ''
+    rm -f $out/lib/libpcap.a
+  '';
+
   meta = {
     homepage = "https://www.tcpdump.org";
     description = "Packet Capture Library";
diff --git a/pkgs/development/libraries/librealsense/default.nix b/pkgs/development/libraries/librealsense/default.nix
index 8fd90c60bdad..21f80f80efa0 100644
--- a/pkgs/development/libraries/librealsense/default.nix
+++ b/pkgs/development/libraries/librealsense/default.nix
@@ -2,7 +2,7 @@
 
 stdenv.mkDerivation rec {
   pname = "librealsense";
-  version = "2.34.0";
+  version = "2.35.2";
 
   outputs = [ "out" "dev" ];
 
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
     owner = "IntelRealSense";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0bi7pszrryz18aqna0z73mb1hzz2vqdb0m00pf93hnwc2hba7hwm";
+    sha256 = "14vf76vlyhh7b4yjzsnqpg1x3wdhwxrf1syvgf8wyxbjwb9plw82";
   };
 
   buildInputs = [
diff --git a/pkgs/development/libraries/libssh2/CVE-2019-17498.patch b/pkgs/development/libraries/libssh2/CVE-2019-17498.patch
new file mode 100644
index 000000000000..8681c3ef6091
--- /dev/null
+++ b/pkgs/development/libraries/libssh2/CVE-2019-17498.patch
@@ -0,0 +1,210 @@
+From b9aa7c2495694d0527e4e7fd560a3f0f18556c72 Mon Sep 17 00:00:00 2001
+From: Will Cosgrove <will@panic.com>
+Date: Thu, 29 Aug 2019 15:14:19 -0700
+Subject: [PATCH 1/5] packet.c: improve parsing of packets
+
+file: packet.c
+
+notes:
+Use _libssh2_get_string API in SSH_MSG_DEBUG, additional uint32 bounds check in SSH_MSG_GLOBAL_REQUEST
+---
+ src/packet.c | 30 +++++++++++++++---------------
+ 1 file changed, 15 insertions(+), 15 deletions(-)
+
+diff --git a/src/packet.c b/src/packet.c
+index 38ab62944..ac69768cd 100644
+--- a/src/packet.c
++++ b/src/packet.c
+@@ -537,26 +537,26 @@ _libssh2_packet_add(LIBSSH2_SESSION * session, unsigned char *data,
+         case SSH_MSG_DEBUG:
+             if(datalen >= 2) {
+                 int always_display = data[1];
+-
++            
+                 if(datalen >= 6) {
+-                    message_len = _libssh2_ntohu32(data + 2);
+-
+-                    if(message_len <= (datalen - 10)) {
+-                        /* 6 = packet_type(1) + display(1) + message_len(4) */
+-                        message = (char *) data + 6;
+-                        language_len = _libssh2_ntohu32(data + 6 +
+-                                                        message_len);
+-
+-                        if(language_len <= (datalen - 10 - message_len))
+-                            language = (char *) data + 10 + message_len;
+-                    }
++                    struct string_buf buf;
++                    buf.data = (unsigned char *)data;
++                    buf.dataptr = buf.data;
++                    buf.len = datalen;
++                    buf.dataptr += 2; /* advance past type & always display */
++
++                    _libssh2_get_string(&buf, &message, &message_len);
++                    _libssh2_get_string(&buf, &language, &language_len);
+                 }
+ 
+                 if(session->ssh_msg_debug) {
+-                    LIBSSH2_DEBUG(session, always_display, message,
+-                                  message_len, language, language_len);
++                    LIBSSH2_DEBUG(session, always_display,
++                                  (const char *)message,
++                                  message_len, (const char *)language,
++                                  language_len);
+                 }
+             }
++
+             /*
+              * _libssh2_debug will actually truncate this for us so
+              * that it's not an inordinate about of data
+@@ -579,7 +579,7 @@ _libssh2_packet_add(LIBSSH2_SESSION * session, unsigned char *data,
+                 uint32_t len = 0;
+                 unsigned char want_reply = 0;
+                 len = _libssh2_ntohu32(data + 1);
+-                if(datalen >= (6 + len)) {
++                if((len <= (UINT_MAX - 6) && (datalen >= (6 + len))) {
+                     want_reply = data[5 + len];
+                     _libssh2_debug(session,
+                                    LIBSSH2_TRACE_CONN,
+
+From 8b3cf0b17c1b84a138bed9423a9e0743452b4de9 Mon Sep 17 00:00:00 2001
+From: Will Cosgrove <will@panic.com>
+Date: Thu, 29 Aug 2019 15:15:33 -0700
+Subject: [PATCH 2/5] stray whitespace
+
+---
+ src/packet.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/packet.c b/src/packet.c
+index ac69768cd..8908b2c5a 100644
+--- a/src/packet.c
++++ b/src/packet.c
+@@ -537,7 +537,7 @@ _libssh2_packet_add(LIBSSH2_SESSION * session, unsigned char *data,
+         case SSH_MSG_DEBUG:
+             if(datalen >= 2) {
+                 int always_display = data[1];
+-            
++
+                 if(datalen >= 6) {
+                     struct string_buf buf;
+                     buf.data = (unsigned char *)data;
+
+From 1c6fa92b77e34d089493fe6d3e2c6c8775858b94 Mon Sep 17 00:00:00 2001
+From: Will Cosgrove <will@panic.com>
+Date: Thu, 29 Aug 2019 15:24:22 -0700
+Subject: [PATCH 3/5] fixed type issue, updated SSH_MSG_DISCONNECT
+
+SSH_MSG_DISCONNECT now also uses  _libssh2_get API.
+---
+ src/packet.c | 40 +++++++++++++++-------------------------
+ 1 file changed, 15 insertions(+), 25 deletions(-)
+
+diff --git a/src/packet.c b/src/packet.c
+index 8908b2c5a..97f0cdd4b 100644
+--- a/src/packet.c
++++ b/src/packet.c
+@@ -419,8 +419,8 @@ _libssh2_packet_add(LIBSSH2_SESSION * session, unsigned char *data,
+                     size_t datalen, int macstate)
+ {
+     int rc = 0;
+-    char *message = NULL;
+-    char *language = NULL;
++    unsigned char *message = NULL;
++    unsigned char *language = NULL;
+     size_t message_len = 0;
+     size_t language_len = 0;
+     LIBSSH2_CHANNEL *channelp = NULL;
+@@ -472,33 +472,23 @@ _libssh2_packet_add(LIBSSH2_SESSION * session, unsigned char *data,
+ 
+         case SSH_MSG_DISCONNECT:
+             if(datalen >= 5) {
+-                size_t reason = _libssh2_ntohu32(data + 1);
++                uint32_t reason = 0;
++                struct string_buf buf;
++                buf.data = (unsigned char *)data;
++                buf.dataptr = buf.data;
++                buf.len = datalen;
++                buf.dataptr++; /* advance past type */
+ 
+-                if(datalen >= 9) {
+-                    message_len = _libssh2_ntohu32(data + 5);
++                _libssh2_get_u32(&buf, &reason);
++                _libssh2_get_string(&buf, &message, &message_len);
++                _libssh2_get_string(&buf, &language, &language_len);
+ 
+-                    if(message_len < datalen-13) {
+-                        /* 9 = packet_type(1) + reason(4) + message_len(4) */
+-                        message = (char *) data + 9;
+-
+-                        language_len =
+-                            _libssh2_ntohu32(data + 9 + message_len);
+-                        language = (char *) data + 9 + message_len + 4;
+-
+-                        if(language_len > (datalen-13-message_len)) {
+-                            /* bad input, clear info */
+-                            language = message = NULL;
+-                            language_len = message_len = 0;
+-                        }
+-                    }
+-                    else
+-                        /* bad size, clear it */
+-                        message_len = 0;
+-                }
+                 if(session->ssh_msg_disconnect) {
+-                    LIBSSH2_DISCONNECT(session, reason, message,
+-                                       message_len, language, language_len);
++                    LIBSSH2_DISCONNECT(session, reason, (const char *)message,
++                                       message_len, (const char *)language,
++                                       language_len);
+                 }
++
+                 _libssh2_debug(session, LIBSSH2_TRACE_TRANS,
+                                "Disconnect(%d): %s(%s)", reason,
+                                message, language);
+
+From 77616117cc9dbbdd0fe1157098435bff73a83a0f Mon Sep 17 00:00:00 2001
+From: Will Cosgrove <will@panic.com>
+Date: Thu, 29 Aug 2019 15:26:32 -0700
+Subject: [PATCH 4/5] fixed stray (
+
+bad paste
+---
+ src/packet.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/packet.c b/src/packet.c
+index 97f0cdd4b..bd4c39e46 100644
+--- a/src/packet.c
++++ b/src/packet.c
+@@ -569,7 +569,7 @@ _libssh2_packet_add(LIBSSH2_SESSION * session, unsigned char *data,
+                 uint32_t len = 0;
+                 unsigned char want_reply = 0;
+                 len = _libssh2_ntohu32(data + 1);
+-                if((len <= (UINT_MAX - 6) && (datalen >= (6 + len))) {
++                if(len <= (UINT_MAX - 6) && datalen >= (6 + len)) {
+                     want_reply = data[5 + len];
+                     _libssh2_debug(session,
+                                    LIBSSH2_TRACE_CONN,
+
+From 436c45dc143cadc8c59afac6c4255be332856581 Mon Sep 17 00:00:00 2001
+From: Will Cosgrove <will@panic.com>
+Date: Thu, 29 Aug 2019 15:29:00 -0700
+Subject: [PATCH 5/5] added additional parentheses for clarity
+
+---
+ src/packet.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/packet.c b/src/packet.c
+index bd4c39e46..2e01bfc5d 100644
+--- a/src/packet.c
++++ b/src/packet.c
+@@ -569,7 +569,7 @@ _libssh2_packet_add(LIBSSH2_SESSION * session, unsigned char *data,
+                 uint32_t len = 0;
+                 unsigned char want_reply = 0;
+                 len = _libssh2_ntohu32(data + 1);
+-                if(len <= (UINT_MAX - 6) && datalen >= (6 + len)) {
++                if((len <= (UINT_MAX - 6)) && (datalen >= (6 + len))) {
+                     want_reply = data[5 + len];
+                     _libssh2_debug(session,
+                                    LIBSSH2_TRACE_CONN,
diff --git a/pkgs/development/libraries/libssh2/default.nix b/pkgs/development/libraries/libssh2/default.nix
index 5cc0232e17de..8ce9c814df05 100644
--- a/pkgs/development/libraries/libssh2/default.nix
+++ b/pkgs/development/libraries/libssh2/default.nix
@@ -15,12 +15,8 @@ stdenv.mkDerivation rec {
     ++ stdenv.lib.optional stdenv.hostPlatform.isMinGW windows.mingw_w64;
 
   patches = [
-    # not able to use fetchpatch here: infinite recursion
-    (fetchurl {
-      name = "CVE-2019-17498.patch";
-      url = "https://github.com/libssh2/libssh2/pull/402.patch";
-      sha256 = "1n9s2mcz5dkw0xpm3c5x4hzj8bar4i6z0pr1rmqjplhfg888vdvc";
-    })
+    # Not able to use fetchpatch here: infinite recursion
+    ./CVE-2019-17498.patch
   ];
 
   meta = with stdenv.lib; {
diff --git a/pkgs/development/libraries/libu2f-host/default.nix b/pkgs/development/libraries/libu2f-host/default.nix
index 3becd075b255..f033aa9f610f 100644
--- a/pkgs/development/libraries/libu2f-host/default.nix
+++ b/pkgs/development/libraries/libu2f-host/default.nix
@@ -14,10 +14,6 @@ stdenv.mkDerivation rec {
 
   doCheck = true;
 
-  postInstall = ''
-    install -D -t $out/lib/udev/rules.d 70-u2f.rules
-  '';
-
   meta = with stdenv.lib; {
     homepage = "https://developers.yubico.com/libu2f-host";
     description = "A C library and command-line tool that implements the host-side of the U2F protocol";
diff --git a/pkgs/development/libraries/libxslt/default.nix b/pkgs/development/libraries/libxslt/default.nix
index a03fca12581f..cf91d7656bf0 100644
--- a/pkgs/development/libraries/libxslt/default.nix
+++ b/pkgs/development/libraries/libxslt/default.nix
@@ -1,10 +1,8 @@
-{ stdenv, fetchurl, fetchpatch, libxml2, findXMLCatalogs, python, libgcrypt
+{ stdenv, fetchurl, fetchpatch, libxml2, findXMLCatalogs, gettext, python, libgcrypt
 , cryptoSupport ? false
 , pythonSupport ? stdenv.buildPlatform == stdenv.hostPlatform
 }:
 
-with stdenv.lib;
-
 stdenv.mkDerivation rec {
   pname = "libxslt";
   version = "1.1.34";
@@ -17,6 +15,7 @@ stdenv.mkDerivation rec {
   outputs = [ "bin" "dev" "out" "man" "doc" ] ++ stdenv.lib.optional pythonSupport "py";
 
   buildInputs = [ libxml2.dev ]
+    ++ stdenv.lib.optional stdenv.isDarwin gettext
     ++ stdenv.lib.optionals pythonSupport [ libxml2.py python ]
     ++ stdenv.lib.optionals cryptoSupport [ libgcrypt ];
 
@@ -27,14 +26,14 @@ stdenv.mkDerivation rec {
     "--without-debug"
     "--without-mem-debug"
     "--without-debugger"
-  ] ++ optional pythonSupport "--with-python=${python}"
-    ++ optional (!cryptoSupport) "--without-crypto";
+  ] ++ stdenv.lib.optional pythonSupport "--with-python=${python}"
+    ++ stdenv.lib.optional (!cryptoSupport) "--without-crypto";
 
   postFixup = ''
     moveToOutput bin/xslt-config "$dev"
     moveToOutput lib/xsltConf.sh "$dev"
     moveToOutput share/man/man1 "$bin"
-  '' + optionalString pythonSupport ''
+  '' + stdenv.lib.optionalString pythonSupport ''
     mkdir -p $py/nix-support
     echo ${libxml2.py} >> $py/nix-support/propagated-build-inputs
     moveToOutput ${python.libPrefix} "$py"
diff --git a/pkgs/development/libraries/mesa/default.nix b/pkgs/development/libraries/mesa/default.nix
index aa70e9e5a549..03977c74f11d 100644
--- a/pkgs/development/libraries/mesa/default.nix
+++ b/pkgs/development/libraries/mesa/default.nix
@@ -11,6 +11,8 @@
 , eglPlatforms ? [ "x11" "surfaceless" ] ++ lib.optionals stdenv.isLinux [ "wayland" "drm" ]
 , OpenGL, Xplugin
 , withValgrind ? stdenv.hostPlatform.isLinux && !stdenv.hostPlatform.isAarch32, valgrind-light
+, enableGalliumNine ? stdenv.isLinux
+, enableOSMesa ? stdenv.isLinux
 }:
 
 /** Packaging design:
@@ -27,7 +29,9 @@
 with stdenv.lib;
 
 let
-  version = "20.0.2";
+  # Release calendar: https://www.mesa3d.org/release-calendar.html
+  # Release frequency: https://www.mesa3d.org/releasing.html#schedule
+  version = "20.0.7"; # Update only to the final (last planned) release (i.e. X.Y.MAX)?
   branch  = versions.major version;
 in
 
@@ -37,12 +41,12 @@ stdenv.mkDerivation {
 
   src = fetchurl {
     urls = [
+      "https://mesa.freedesktop.org/archive/mesa-${version}.tar.xz"
       "ftp://ftp.freedesktop.org/pub/mesa/mesa-${version}.tar.xz"
       "ftp://ftp.freedesktop.org/pub/mesa/${version}/mesa-${version}.tar.xz"
       "ftp://ftp.freedesktop.org/pub/mesa/older-versions/${branch}.x/${version}/mesa-${version}.tar.xz"
-      "https://mesa.freedesktop.org/archive/mesa-${version}.tar.xz"
     ];
-    sha256 = "0vz8k07d23qdwy67fnna9y0ynnni0m8lgswcmdm60l4mcv5z2m5a";
+    sha256 = "0y517qpdg6v6dsdgzb365p03m30511sbyh8pq0mcvhvjwy7javpy";
   };
 
   prePatch = "patchShebangs .";
@@ -79,7 +83,7 @@ stdenv.mkDerivation {
       "find_program('${buildPackages.pkg-config.targetPrefix}pkg-config')"
   '';
 
-  outputs = [ "out" "dev" "drivers" "osmesa" ];
+  outputs = [ "out" "dev" "drivers" ] ++ lib.optional enableOSMesa "osmesa";
 
   # TODO: Figure out how to enable opencl without having a runtime dependency on clang
   mesonFlags = [
@@ -103,10 +107,10 @@ stdenv.mkDerivation {
     "-Domx-libs-path=${placeholder "drivers"}/lib/bellagio"
     "-Dva-libs-path=${placeholder "drivers"}/lib/dri"
     "-Dd3d-drivers-path=${placeholder "drivers"}/lib/d3d"
+    "-Dgallium-nine=${if enableGalliumNine then "true" else "false"}" # Direct3D in Wine
+    "-Dosmesa=${if enableOSMesa then "gallium" else "none"}" # used by wine
   ] ++ optionals stdenv.isLinux [
     "-Dglvnd=true"
-    "-Dosmesa=gallium" # used by wine
-    "-Dgallium-nine=true" # Direct3D in Wine
   ];
 
   buildInputs = with xorg; [
@@ -142,17 +146,17 @@ stdenv.mkDerivation {
   '' + optionalString stdenv.isLinux ''
     mkdir -p $drivers/lib
 
-    # move gallium-related stuff to $drivers, so $out doesn't depend on LLVM
-    mv -t $drivers/lib       \
-      $out/lib/libxatracker* \
-      $out/lib/libvulkan_*
-
-    # Move other drivers to a separate output
-    mv $out/lib/lib*_mesa* $drivers/lib
+    if [ -n "$(shopt -s nullglob; echo "$out/lib/libxatracker"*)" -o -n "$(shopt -s nullglob; echo "$out/lib/libvulkan_"*)" ]; then
+      # move gallium-related stuff to $drivers, so $out doesn't depend on LLVM
+      mv -t $drivers/lib       \
+        $out/lib/libxatracker* \
+        $out/lib/libvulkan_*
+    fi
 
-    # move libOSMesa to $osmesa, as it's relatively big
-    mkdir -p $osmesa/lib
-    mv -t $osmesa/lib/ $out/lib/libOSMesa*
+    if [ -n "$(shopt -s nullglob; echo "$out"/lib/lib*_mesa*)" ]; then
+      # Move other drivers to a separate output
+      mv $out/lib/lib*_mesa* $drivers/lib
+    fi
 
     # move vendor files
     mv $out/share/ $drivers/
@@ -167,6 +171,10 @@ stdenv.mkDerivation {
     for js in $drivers/share/vulkan/icd.d/*.json; do
       substituteInPlace "$js" --replace "$out" "$drivers"
     done
+  '' + lib.optionalString enableOSMesa ''
+    # move libOSMesa to $osmesa, as it's relatively big
+    mkdir -p $osmesa/lib
+    mv -t $osmesa/lib/ $out/lib/libOSMesa*
   '';
 
   # TODO:
@@ -181,7 +189,9 @@ stdenv.mkDerivation {
 
     # Update search path used by pkg-config
     for pc in $dev/lib/pkgconfig/{d3d,dri,xatracker}.pc; do
-      substituteInPlace "$pc" --replace $out $drivers
+      if [ -f "$pc" ]; then
+        substituteInPlace "$pc" --replace $out $drivers
+      fi
     done
 
     # add RPATH so the drivers can find the moved libgallium and libdricore9
@@ -215,6 +225,6 @@ stdenv.mkDerivation {
     changelog = "https://www.mesa3d.org/relnotes/${version}.html";
     license = licenses.mit; # X11 variant, in most files
     platforms = platforms.mesaPlatforms;
-    maintainers = with maintainers; [ vcunat ];
+    maintainers = with maintainers; [ primeos vcunat ]; # Help is welcome :)
   };
 }
diff --git a/pkgs/development/libraries/nss/default.nix b/pkgs/development/libraries/nss/default.nix
index 622d11c31605..4ec5518008a1 100644
--- a/pkgs/development/libraries/nss/default.nix
+++ b/pkgs/development/libraries/nss/default.nix
@@ -5,7 +5,7 @@ let
     url = "http://dev.gentoo.org/~polynomial-c/mozilla/nss-3.15.4-pem-support-20140109.patch.xz";
     sha256 = "10ibz6y0hknac15zr6dw4gv9nb5r5z9ym6gq18j3xqx7v7n3vpdw";
   };
-  version = "3.52";
+  version = "3.52.1";
   underscoreVersion = builtins.replaceStrings ["."] ["_"] version;
 
 in stdenv.mkDerivation rec {
@@ -14,7 +14,7 @@ in stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://mozilla/security/nss/releases/NSS_${underscoreVersion}_RTM/src/${pname}-${version}.tar.gz";
-    sha256 = "0q8m9jf6zgkbhx71myjb7y0gcl5ib3gj6qkl9yvdqpd6vl6fn2ha";
+    sha256 = "0y4jb9095f7bbgw7d7kvzm4c3g4p5i6y68fwhb8wlkpb7b1imj5w";
   };
 
   depsBuildBuild = [ buildPackages.stdenv.cc ];
diff --git a/pkgs/development/libraries/openh264/default.nix b/pkgs/development/libraries/openh264/default.nix
index e038bb7f66de..ee430f800dd3 100644
--- a/pkgs/development/libraries/openh264/default.nix
+++ b/pkgs/development/libraries/openh264/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "openh264";
-  version = "2.1.0";
+  version = "2.1.1";
 
   src = fetchFromGitHub {
     owner = "cisco";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1wba260n1932vafd5ni2jqv9kzc7lj6a1asm1cqk8jv690m6zvpi";
+    sha256 = "0ffav46pz3sbj92nipd62z03fibyqgclfq9w8lgr80s6za6zdk5s";
   };
 
   nativeBuildInputs = [ nasm ];
diff --git a/pkgs/development/libraries/pcre2/default.nix b/pkgs/development/libraries/pcre2/default.nix
index 6c5d526d523b..d39b91355b98 100644
--- a/pkgs/development/libraries/pcre2/default.nix
+++ b/pkgs/development/libraries/pcre2/default.nix
@@ -2,10 +2,10 @@
 
 stdenv.mkDerivation rec {
   pname = "pcre2";
-  version = "10.34";
+  version = "10.35";
   src = fetchurl {
     url = "https://ftp.pcre.org/pub/pcre/${pname}-${version}.tar.bz2";
-    sha256 = "1jlqnzcz2yi70dm40wyfa9w8is9z2kh4dl8zjnv3vqd9mgzp7i3l";
+    sha256 = "04s6kmk9qdd4rjz477h547j4bx7hfz0yalpvrm381rqc5ghaijww";
   };
 
   configureFlags = [
diff --git a/pkgs/development/libraries/readline/6.3.nix b/pkgs/development/libraries/readline/6.3.nix
index 3f3503bb2ba6..2b0cf978d43e 100644
--- a/pkgs/development/libraries/readline/6.3.nix
+++ b/pkgs/development/libraries/readline/6.3.nix
@@ -32,10 +32,6 @@ stdenv.mkDerivation {
      in
        import ./readline-6.3-patches.nix patch);
 
-  # Don't run the native `strip' when cross-compiling.
-  dontStrip = stdenv.hostPlatform != stdenv.buildPlatform;
-  bash_cv_func_sigsetjmp = if stdenv.isCygwin then "missing" else null;
-
   meta = with stdenv.lib; {
     description = "Library for interactive line editing";
 
diff --git a/pkgs/development/libraries/readline/7.0.nix b/pkgs/development/libraries/readline/7.0.nix
index c4bcda0110a4..248ef55cce88 100644
--- a/pkgs/development/libraries/readline/7.0.nix
+++ b/pkgs/development/libraries/readline/7.0.nix
@@ -32,10 +32,6 @@ stdenv.mkDerivation rec {
     ]
     ++ upstreamPatches;
 
-  # Don't run the native `strip' when cross-compiling.
-  dontStrip = stdenv.hostPlatform != stdenv.buildPlatform;
-  bash_cv_func_sigsetjmp = if stdenv.isCygwin then "missing" else null;
-
   meta = with stdenv.lib; {
     description = "Library for interactive line editing";
 
diff --git a/pkgs/development/libraries/readline/8.0.nix b/pkgs/development/libraries/readline/8.0.nix
index 23075abd6f2e..6e1182647c29 100644
--- a/pkgs/development/libraries/readline/8.0.nix
+++ b/pkgs/development/libraries/readline/8.0.nix
@@ -32,10 +32,6 @@ stdenv.mkDerivation rec {
     ]
     ++ upstreamPatches;
 
-  # Don't run the native `strip' when cross-compiling.
-  dontStrip = stdenv.hostPlatform != stdenv.buildPlatform;
-  bash_cv_func_sigsetjmp = if stdenv.isCygwin then "missing" else null;
-
   meta = with stdenv.lib; {
     description = "Library for interactive line editing";
 
diff --git a/pkgs/development/libraries/sqlite/analyzer.nix b/pkgs/development/libraries/sqlite/analyzer.nix
index 4e37febbe756..cf8a9aaa7326 100644
--- a/pkgs/development/libraries/sqlite/analyzer.nix
+++ b/pkgs/development/libraries/sqlite/analyzer.nix
@@ -6,11 +6,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "sqlite-analyzer";
-  version = "3.31.1";
+  version = "3.32.2";
 
   src = assert version == sqlite.version; fetchurl {
     url = "https://sqlite.org/2020/sqlite-src-${archiveVersion version}.zip";
-    sha256 = "0n7f3w59gr80s6k4l5a9bp2s97dlfapfbhb3qdhak6axhn127p7j";
+    sha256 = "1jqhs896cvp9l399mjpbv1x2qbfvq875l1vrgnl3zc4ffdjxs9z0";
   };
 
   nativeBuildInputs = [ unzip ];
diff --git a/pkgs/development/libraries/sqlite/default.nix b/pkgs/development/libraries/sqlite/default.nix
index 245c55e9ea88..35d3d062ab78 100644
--- a/pkgs/development/libraries/sqlite/default.nix
+++ b/pkgs/development/libraries/sqlite/default.nix
@@ -10,12 +10,12 @@ in
 
 stdenv.mkDerivation rec {
   pname = "sqlite";
-  version = "3.31.1";
+  version = "3.32.2";
 
   # NB! Make sure to update analyzer.nix src (in the same directory).
   src = fetchurl {
     url = "https://sqlite.org/2020/sqlite-autoconf-${archiveVersion version}.tar.gz";
-    sha256 = "1bj936svd8i5g25xd1bj52hj4zca01fgl3sqkj86z9q5pkz4wa32";
+    sha256 = "1130bcd70s2vlsq0d638pb5qrw9kwqvjswnp2dfypghx9hjz3gid";
   };
 
   outputs = [ "bin" "dev" "out" ];
diff --git a/pkgs/development/libraries/trompeloeil/default.nix b/pkgs/development/libraries/trompeloeil/default.nix
index 782af4ab0331..625b16cc99a0 100644
--- a/pkgs/development/libraries/trompeloeil/default.nix
+++ b/pkgs/development/libraries/trompeloeil/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "trompeloeil";
-  version = "37";
+  version = "38";
 
   src = fetchFromGitHub {
     owner = "rollbear";
     repo = "trompeloeil";
     rev = "v${version}";
-    sha256 = "04f9vpzh4fc15w4ynirzs9ipm9r31dbggb2zilmk0fj4qr79am42";
+    sha256 = "068q4xx09vwjs7i89w47qzymdb4l6jqi27gx2jmd3yb6fp2k7nsb";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/wxwidgets/3.0/default.nix b/pkgs/development/libraries/wxwidgets/3.0/default.nix
index 8de7f99fe5fd..da29eacdc0e9 100644
--- a/pkgs/development/libraries/wxwidgets/3.0/default.nix
+++ b/pkgs/development/libraries/wxwidgets/3.0/default.nix
@@ -1,8 +1,9 @@
 { stdenv, fetchFromGitHub, fetchurl, pkgconfig
-, gtk2, gtk3, libXinerama, libSM, libXxf86vm
-, xorgproto, gstreamer, gst-plugins-base, GConf, setfile
+, libXinerama, libSM, libXxf86vm
+, gtk2, GConf ? null, gtk3
+, xorgproto, gstreamer, gst-plugins-base, setfile
 , libGLSupported ? stdenv.lib.elem stdenv.hostPlatform.system stdenv.lib.platforms.mesaPlatforms
-, withMesa ? stdenv.lib.elem stdenv.hostPlatform.system stdenv.lib.platforms.mesaPlatforms
+, withMesa ? libGLSupported
 , libGLU ? null, libGL ? null
 , compat24 ? false, compat26 ? true, unicode ? true
 , withGtk2 ? true
@@ -28,9 +29,10 @@ stdenv.mkDerivation rec {
     sha256 = "19mqglghjjqjgz4rbybn3qdgn2cz9xc511nq1pvvli9wx2k8syl1";
   };
 
-  buildInputs =
-    [ (if withGtk2 then gtk2 else gtk3) libXinerama libSM libXxf86vm xorgproto gstreamer
-      gst-plugins-base GConf ]
+  buildInputs = [
+    libXinerama libSM libXxf86vm xorgproto gstreamer gst-plugins-base
+  ] ++ optionals withGtk2 [ gtk2 GConf ]
+    ++ optional (!withGtk2) gtk3
     ++ optional withMesa libGLU
     ++ optional withWebKit webkitgtk
     ++ optionals stdenv.isDarwin [ setfile Carbon Cocoa Kernel QTKit ];
diff --git a/pkgs/development/libraries/wxwidgets/3.1/default.nix b/pkgs/development/libraries/wxwidgets/3.1/default.nix
index 99f86974cdb4..790968a88f76 100644
--- a/pkgs/development/libraries/wxwidgets/3.1/default.nix
+++ b/pkgs/development/libraries/wxwidgets/3.1/default.nix
@@ -1,6 +1,7 @@
 { stdenv, fetchFromGitHub, fetchurl, pkgconfig
-, gtk2, gtk3, libXinerama, libSM, libXxf86vm
-, xorgproto, gstreamer, gst-plugins-base, GConf, setfile
+, libXinerama, libSM, libXxf86vm
+, gtk2, GConf ? null, gtk3
+, xorgproto, gstreamer, gst-plugins-base, setfile
 , libGLSupported ? stdenv.lib.elem stdenv.hostPlatform.system stdenv.lib.platforms.mesaPlatforms
 , withMesa ? libGLSupported, libGLU ? null, libGL ? null
 , compat28 ? false, compat30 ? true, unicode ? true
@@ -27,9 +28,10 @@ stdenv.mkDerivation rec {
     sha256 = "0gfdhb7xq5vzasm7s1di39nchv42zsp0dmn4v6knzb7mgsb107wb";
   };
 
-  buildInputs =
-    [ (if withGtk2 then gtk2 else gtk3) libXinerama libSM libXxf86vm xorgproto gstreamer
-      gst-plugins-base GConf ]
+  buildInputs = [
+    libXinerama libSM libXxf86vm xorgproto gstreamer gst-plugins-base
+  ] ++ optionals withGtk2 [ gtk2 GConf ]
+    ++ optional (!withGtk2) gtk3
     ++ optional withMesa libGLU
     ++ optional withWebKit webkitgtk
     ++ optionals stdenv.isDarwin [ setfile Carbon Cocoa Kernel QTKit ];
diff --git a/pkgs/development/ocaml-modules/ocsigen-start/default.nix b/pkgs/development/ocaml-modules/ocsigen-start/default.nix
index cc6650df1578..637c06e98dcf 100644
--- a/pkgs/development/ocaml-modules/ocsigen-start/default.nix
+++ b/pkgs/development/ocaml-modules/ocsigen-start/default.nix
@@ -5,7 +5,7 @@
 
 stdenv.mkDerivation rec {
   name = "ocaml${ocaml.version}-ocsigen-start-${version}";
-  version = "2.16.1";
+  version = "2.18.0";
 
   buildInputs = [ ocaml findlib ];
   propagatedBuildInputs = [ pgocaml_ppx safepass ocsigen-toolkit yojson resource-pooling cohttp-lwt-unix ];
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
     owner = "ocsigen";
     repo = "ocsigen-start";
     rev = version;
-    sha256 = "1pzpyrd3vbhc7zvzh6bv44793ikx5bglpd5p4wk5jj65v1w39jwd";
+    sha256 = "0wvh4c26g6qd6i1fryilcqz9giz7v6pnhc90sknhxh6jmwrbjl50";
   };
 
   meta = {
diff --git a/pkgs/development/python-modules/Cython/default.nix b/pkgs/development/python-modules/Cython/default.nix
index f0b8a5dd560d..3d5afd52abdd 100644
--- a/pkgs/development/python-modules/Cython/default.nix
+++ b/pkgs/development/python-modules/Cython/default.nix
@@ -26,11 +26,11 @@ let
 
 in buildPythonPackage rec {
   pname = "Cython";
-  version = "0.29.14";
+  version = "0.29.19";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "e4d6bb8703d0319eb04b7319b12ea41580df44fd84d83ccda13ea463c6801414";
+    sha256 = "0n2j87nka8cs772qc60d0c7lrpvsw0y8p3qzvhrsi3nmq1yqmycp";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/GitPython/default.nix b/pkgs/development/python-modules/GitPython/default.nix
index b5ffacae2964..7b39ebb7a390 100644
--- a/pkgs/development/python-modules/GitPython/default.nix
+++ b/pkgs/development/python-modules/GitPython/default.nix
@@ -1,13 +1,13 @@
 { lib, buildPythonPackage, fetchPypi, isPy27, substituteAll, git, gitdb, mock, nose, ddt }:
 
 buildPythonPackage rec {
-  version = "3.1.2";
+  version = "3.1.3";
   pname = "GitPython";
   disabled = isPy27; # no longer supported
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "864a47472548f3ba716ca202e034c1900f197c0fb3a08f641c20c3cafd15ed94";
+    sha256 = "e107af4d873daed64648b4f4beb89f89f0cfbe3ef558fc7821ed2331c2f8da1a";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/JPype1/default.nix b/pkgs/development/python-modules/JPype1/default.nix
index c43b2a05a519..b70879952f4e 100644
--- a/pkgs/development/python-modules/JPype1/default.nix
+++ b/pkgs/development/python-modules/JPype1/default.nix
@@ -6,11 +6,11 @@
 
 buildPythonPackage rec {
   pname = "JPype1";
-  version = "0.7.4";
+  version = "0.7.5";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "92f24b0fe11e90b57343494ce38699043d9e6828a22a99dddbcf99c0adb4c1f7";
+    sha256 = "7bbd25453dc04704d77d854c80acb5537ecb18b9de8a5572e5f22649a2160aaf";
   };
 
   checkInputs = [
diff --git a/pkgs/development/python-modules/Mako/default.nix b/pkgs/development/python-modules/Mako/default.nix
index 597a4695c0cb..375a02968646 100644
--- a/pkgs/development/python-modules/Mako/default.nix
+++ b/pkgs/development/python-modules/Mako/default.nix
@@ -10,11 +10,11 @@
 
 buildPythonPackage rec {
   pname = "Mako";
-  version = "1.1.2";
+  version = "1.1.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "3139c5d64aa5d175dbafb95027057128b5fbd05a40c53999f3905ceb53366d9d";
+    sha256 = "8195c8c1400ceb53496064314c6736719c6f25e7479cd24c77be3d9361cddc27";
   };
 
   checkInputs = [ markupsafe nose mock ];
diff --git a/pkgs/development/python-modules/aioharmony/default.nix b/pkgs/development/python-modules/aioharmony/default.nix
index 13769bbeaed3..09b6919495de 100644
--- a/pkgs/development/python-modules/aioharmony/default.nix
+++ b/pkgs/development/python-modules/aioharmony/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "aioharmony";
-  version = "0.2.1";
+  version = "0.2.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "8c8f6e3b776e4e7eba5a1d2ae739aac6a1dd558a7f15951c34ffe0ee28f7f538";
+    sha256 = "445323810978454ba3b32be53ba6b43cf9948586de3f9734b8743b55858b3cc7";
   };
 
   disabled = !isPy3k;
diff --git a/pkgs/development/python-modules/aiohttp/default.nix b/pkgs/development/python-modules/aiohttp/default.nix
index 7d164cf5e4f0..2f623dd0f0ef 100644
--- a/pkgs/development/python-modules/aiohttp/default.nix
+++ b/pkgs/development/python-modules/aiohttp/default.nix
@@ -12,7 +12,7 @@
 , idna-ssl
 , typing-extensions
 , pytestrunner
-, pytest
+, pytestCheckHook
 , gunicorn
 , pytest-timeout
 , async_generator
@@ -22,13 +22,14 @@
 , trustme
 , brotlipy
 , freezegun
+, isPy38
 }:
 
 buildPythonPackage rec {
   pname = "aiohttp";
   version = "3.6.2";
   # https://github.com/aio-libs/aiohttp/issues/4525 python3.8 failures
-  disabled = pythonOlder "3.5" || pythonAtLeast "3.8";
+  disabled = pythonOlder "3.5";
 
   src = fetchPypi {
     inherit pname version;
@@ -36,28 +37,38 @@ buildPythonPackage rec {
   };
 
   checkInputs = [
-    pytestrunner pytest gunicorn async_generator pytest_xdist
+    pytestrunner pytestCheckHook gunicorn async_generator pytest_xdist
     pytest-mock pytestcov trustme brotlipy freezegun
   ];
 
   propagatedBuildInputs = [ attrs chardet multidict async-timeout yarl ]
     ++ lib.optionals (pythonOlder "3.7") [ idna-ssl typing-extensions ];
 
-  # disable tests which attempt to do loopback connections
-  checkPhase = ''
+  disabledTests = [
+    # disable tests which attempt to do loopback connections
+    "get_valid_log_format_exc"
+    "test_access_logger_atoms"
+    "aiohttp_request_coroutine"
+    "server_close_keepalive_connection"
+    "connector"
+    "client_disconnect"
+    "handle_keepalive_on_closed_connection"
+    "proxy_https_bad_response"
+    "partially_applied_handler"
+    "middleware"
+  ] ++ lib.optionals stdenv.is32bit [
+    "test_cookiejar"
+  ] ++ lib.optionals isPy38 [
+    # Python 3.8  https://github.com/aio-libs/aiohttp/issues/4525
+    "test_read_boundary_with_incomplete_chunk"
+    "test_read_incomplete_chunk"
+    "test_request_tracing_exception"
+  ];
+
+  # aiohttp in current folder shadows installed version
+  # Probably because we run `python -m pytest` instead of `pytest` in the hook.
+  preCheck = ''
     cd tests
-    pytest -k "not get_valid_log_format_exc \
-               and not test_access_logger_atoms \
-               and not aiohttp_request_coroutine \
-               and not server_close_keepalive_connection \
-               and not connector \
-               and not client_disconnect \
-               and not handle_keepalive_on_closed_connection \
-               and not proxy_https_bad_response \
-               and not partially_applied_handler \
-               ${lib.optionalString stdenv.is32bit "and not test_cookiejar"} \
-               and not middleware" \
-      --ignore=test_connector.py
   '';
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/aiolifx/default.nix b/pkgs/development/python-modules/aiolifx/default.nix
index c40f8d3b4471..7b33b1c508f8 100644
--- a/pkgs/development/python-modules/aiolifx/default.nix
+++ b/pkgs/development/python-modules/aiolifx/default.nix
@@ -8,11 +8,11 @@
 
 buildPythonPackage rec {
   pname = "aiolifx";
-  version = "0.6.7";
+  version = "0.6.8";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "cf53c9faea6eee25a466e73eef1753b82a75c7497648149c19c15342df2678f2";
+    sha256 = "9f9055bc2a9a72c5eab17e0ce5522edecd6de07e21cf347bf0cffabdabe5570e";
   };
 
   # tests are not implemented
diff --git a/pkgs/development/python-modules/aioresponses/default.nix b/pkgs/development/python-modules/aioresponses/default.nix
index bbeca1c31507..9034e6a67316 100644
--- a/pkgs/development/python-modules/aioresponses/default.nix
+++ b/pkgs/development/python-modules/aioresponses/default.nix
@@ -11,12 +11,12 @@
 
 buildPythonPackage rec {
   pname = "aioresponses";
-  version = "0.6.3";
+  version = "0.6.4";
   disabled = pythonOlder "3.5";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "06w15iyr07s861hkzqfdclzxkpvgg83sx8f235mz8k2490hnyqvv";
+    sha256 = "4397ca736238a1ada8c7f47e557dda05e9ecfdd467b9f6b83871efd365af7e9f";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/appdirs/default.nix b/pkgs/development/python-modules/appdirs/default.nix
index 2f7f2ae0281b..22fa3dc98fb0 100644
--- a/pkgs/development/python-modules/appdirs/default.nix
+++ b/pkgs/development/python-modules/appdirs/default.nix
@@ -5,11 +5,11 @@
 
 buildPythonPackage rec {
   pname = "appdirs";
-  version = "1.4.3";
+  version = "1.4.4";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "9e5896d1372858f8dd3344faf4e5014d21849c756c8d5701f78f8a103b372d92";
+    sha256 = "7d5d0167b2b1ba821647616af46a749d1c653740dd0d2415100fe26e27afdf41";
   };
 
   meta = {
diff --git a/pkgs/development/python-modules/atlassian-python-api/default.nix b/pkgs/development/python-modules/atlassian-python-api/default.nix
index f9462c5b0a50..5f124cc09434 100755
--- a/pkgs/development/python-modules/atlassian-python-api/default.nix
+++ b/pkgs/development/python-modules/atlassian-python-api/default.nix
@@ -16,11 +16,11 @@
 
 buildPythonPackage rec {
   pname = "atlassian-python-api";
-  version = "1.15.7";
+  version = "1.15.9";
   
   src = fetchPypi {
     inherit pname version;
-    sha256 = "b54cce1ca4bea838a949b4362410b1d717597951e5b7efbfa34ce89bc5df805e";
+    sha256 = "c6a3125ee68ecf4d11947497c1f891b6436df9d8453f8865cabf595813504cc1";
   };
   
   checkInputs = [ pytestrunner pytest ];
diff --git a/pkgs/development/python-modules/autopep8/default.nix b/pkgs/development/python-modules/autopep8/default.nix
index 715e4da8f44e..7b7131f2a7fc 100644
--- a/pkgs/development/python-modules/autopep8/default.nix
+++ b/pkgs/development/python-modules/autopep8/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "autopep8";
-  version = "1.5.2";
+  version = "1.5.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0m29ndgrcgrzi3y1fsxmdl421x6n4gn02l70hsz8486h8zzdhbqm";
+    sha256 = "60fd8c4341bab59963dafd5d2a566e94f547e660b9b396f772afe67d8481dbf0";
   };
 
   propagatedBuildInputs = [ pycodestyle ];
diff --git a/pkgs/development/python-modules/awkward1/default.nix b/pkgs/development/python-modules/awkward1/default.nix
index 3e2b08061d92..e3549e0a4a85 100644
--- a/pkgs/development/python-modules/awkward1/default.nix
+++ b/pkgs/development/python-modules/awkward1/default.nix
@@ -10,11 +10,11 @@
 
 buildPythonPackage rec {
   pname = "awkward1";
-  version = "0.2.19";
+  version = "0.2.23";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "23446eacdf52cad1fb0b5bb0f2ed16c1ae8bb5a282d667ad37ab69494e1ef27f";
+    sha256 = "d7458b499959af66e0a640e29e6b676a39cc9614cd504e5a2e8f8d0c7f546597";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/python-modules/bids-validator/default.nix b/pkgs/development/python-modules/bids-validator/default.nix
index 56a941e60e09..036f54346144 100644
--- a/pkgs/development/python-modules/bids-validator/default.nix
+++ b/pkgs/development/python-modules/bids-validator/default.nix
@@ -4,12 +4,12 @@
 }:
 
 buildPythonPackage rec {
-  version = "1.5.1";
+  version = "1.5.2";
   pname = "bids-validator";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1fy8w56m0x546zjk3is1xp83jm19fkn4y15g5jgmq29sfzc8n3y3";
+    sha256 = "6f3bd0402d41ee9be03637d74f34a7db279d00cb9c6386b0597cbbac16ee8f4e";
   };
 
   propagatedBuildInputs = [ ];
diff --git a/pkgs/development/python-modules/bleak/default.nix b/pkgs/development/python-modules/bleak/default.nix
index 559fd33e8eb0..b7ebca9eb034 100644
--- a/pkgs/development/python-modules/bleak/default.nix
+++ b/pkgs/development/python-modules/bleak/default.nix
@@ -2,13 +2,13 @@
 
 buildPythonPackage rec {
   pname = "bleak";
-  version = "0.6.2";
+  version = "0.6.4";
 
   disabled = !isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1kmq2z3dhq6dd20i5w71gshjrfvyw0pkpnld8iib9ai2rz6a8aj0";
+    sha256 = "1dc32899d0700c5b5ed9abf642dfee28ac62b1fb5d7be5fa5a6db104dec9a03c";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/block-io/default.nix b/pkgs/development/python-modules/block-io/default.nix
index f80c8a8c145f..505d3ffe149c 100644
--- a/pkgs/development/python-modules/block-io/default.nix
+++ b/pkgs/development/python-modules/block-io/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "block-io";
-  version = "1.1.10";
+  version = "1.1.13";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "ba2e750085d9da4d1567932f3f719974fdc3f02649ee0d5c2f85fce592208723";
+    sha256 = "a45e31361d17ce272a0d563a689d6b87b65cc16e9348f8cd3a6460c93359b1bd";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/boto3/default.nix b/pkgs/development/python-modules/boto3/default.nix
index 2903b8ae7c66..1baa668d3c89 100644
--- a/pkgs/development/python-modules/boto3/default.nix
+++ b/pkgs/development/python-modules/boto3/default.nix
@@ -13,11 +13,11 @@
 
 buildPythonPackage rec {
   pname =  "boto3";
-  version = "1.13.6"; # N.B: if you change this, change botocore too
+  version = "1.13.23"; # N.B: if you change this, change botocore too
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "f1ac7eb23ff8b1d7e314123668ff1e93b874dd396ac5424adc443d68bd8a6fbf";
+    sha256 = "bcaa88b2f81b88741c47da52f3414c876236700441df87b6198f860e6a200d6f";
   };
 
   propagatedBuildInputs = [ botocore jmespath s3transfer ] ++ lib.optionals (!isPy3k) [ futures ];
diff --git a/pkgs/development/python-modules/bpython/clipboard-make-which-substitutable.patch b/pkgs/development/python-modules/bpython/clipboard-make-which-substitutable.patch
new file mode 100644
index 000000000000..685d34228a1b
--- /dev/null
+++ b/pkgs/development/python-modules/bpython/clipboard-make-which-substitutable.patch
@@ -0,0 +1,27 @@
+From 6f544a5bd43446859754cb80e012af933b843db9 Mon Sep 17 00:00:00 2001
+From: Florian Klink <flokli@flokli.de>
+Date: Wed, 3 Jun 2020 22:05:34 +0200
+Subject: [PATCH] clipboard: make which substitutable
+
+This is used to detect the presence of xclip and other clipboard
+handling tools.
+---
+ bpython/clipboard.py | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/bpython/clipboard.py b/bpython/clipboard.py
+index aee429b..f346429 100644
+--- a/bpython/clipboard.py
++++ b/bpython/clipboard.py
+@@ -58,7 +58,7 @@ class OSXClipboard(object):
+ 
+ def command_exists(command):
+     process = subprocess.Popen(
+-        ["which", command], stderr=subprocess.STDOUT, stdout=subprocess.PIPE
++        ["@which@", command], stderr=subprocess.STDOUT, stdout=subprocess.PIPE
+     )
+     process.communicate()
+ 
+-- 
+2.26.2
+
diff --git a/pkgs/development/python-modules/bpython/default.nix b/pkgs/development/python-modules/bpython/default.nix
index 73ce843cf018..ad7322cbf661 100644
--- a/pkgs/development/python-modules/bpython/default.nix
+++ b/pkgs/development/python-modules/bpython/default.nix
@@ -1,4 +1,14 @@
-{ stdenv, buildPythonPackage, fetchPypi, pygments, greenlet, curtsies, urwid, requests, mock }:
+{ stdenv
+, buildPythonPackage
+, fetchPypi
+, curtsies
+, greenlet
+, mock
+, pygments
+, requests
+, substituteAll
+, urwid
+, which }:
 
 buildPythonPackage rec {
   pname = "bpython";
@@ -9,6 +19,11 @@ buildPythonPackage rec {
     sha256 = "1764ikgj24jjq46s50apwkydqvy5a13adb2nbszk8kbci6df0v27";
   };
 
+  patches = [ (substituteAll {
+    src = ./clipboard-make-which-substitutable.patch;
+    which = "${which}/bin/which";
+  })];
+
   propagatedBuildInputs = [ curtsies greenlet pygments requests urwid ];
 
   postInstall = ''
diff --git a/pkgs/development/python-modules/bugsnag/default.nix b/pkgs/development/python-modules/bugsnag/default.nix
index 2f0e67683d9a..612ab13c1934 100644
--- a/pkgs/development/python-modules/bugsnag/default.nix
+++ b/pkgs/development/python-modules/bugsnag/default.nix
@@ -7,11 +7,11 @@
 
 buildPythonPackage rec {
   pname = "bugsnag";
-  version = "3.6.0";
+  version = "3.6.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "17cjh7g8gbr0gb22nzybkw7vq9x5wfa5ln94hhzijbz934bw1f37";
+    sha256 = "8878437aa44ec485cecb255742035b3b98a6c7e7d167a943b5fbe597b2f8f7f9";
   };
 
   propagatedBuildInputs = [ six webob ];
diff --git a/pkgs/development/python-modules/buildbot/default.nix b/pkgs/development/python-modules/buildbot/default.nix
index 2b2e703026d8..c5a12c997d9d 100644
--- a/pkgs/development/python-modules/buildbot/default.nix
+++ b/pkgs/development/python-modules/buildbot/default.nix
@@ -25,11 +25,11 @@ let
 
   package = buildPythonPackage rec {
     pname = "buildbot";
-    version = "2.8.1";
+    version = "2.8.2";
 
     src = fetchPypi {
       inherit pname version;
-      sha256 = "1nrbn8a2c56l5j0axmn9ijaviw0a6nrd34sg81r5j05mzzpb69is";
+      sha256 = "0rdrz2zkd6xaf9kb5l41xmbfzq618sz498w23irshih4c802pdv5";
     };
 
     propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/buildbot/pkg.nix b/pkgs/development/python-modules/buildbot/pkg.nix
index ebf8fb9c94e7..4bb8613afeab 100644
--- a/pkgs/development/python-modules/buildbot/pkg.nix
+++ b/pkgs/development/python-modules/buildbot/pkg.nix
@@ -6,7 +6,7 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "03ppmrnpyd77azylv1c673cffk6x53j9flx4i99k33bljmdy8iv4";
+    sha256 = "1yz3k6dg15q4911x8kjy396dccfgrs50mjz278l09p6zmm71llax";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/buildbot/plugins.nix b/pkgs/development/python-modules/buildbot/plugins.nix
index 302615dc469c..4c5aa374562a 100644
--- a/pkgs/development/python-modules/buildbot/plugins.nix
+++ b/pkgs/development/python-modules/buildbot/plugins.nix
@@ -7,7 +7,7 @@
 
     src = fetchPypi {
       inherit pname version;
-      sha256 = "051y4z70dq0j343rb02wn3a1vkdbi8khjfib2msa80vdld3nxcyv";
+      sha256 = "19qwr0h6qavznx8rfjq6zjccyd2y7x4nc8asldvay3b44xfsr385";
     };
 
     # Remove unneccessary circular dependency on buildbot
@@ -34,7 +34,7 @@
 
     src = fetchPypi {
       inherit pname version;
-      sha256 = "0chw111j2c6ybvbb09x39zg7ghjz4ysw67wbpcmzd1v5jnwbaqdi";
+      sha256 = "1wfhwmb1d32k8isk7k8525pmkfih8hlvy53zsj19l3gvjm0da9gw";
     };
 
     buildInputs = [ buildbot-pkg ];
@@ -56,7 +56,7 @@
 
     src = fetchPypi {
       inherit pname version;
-      sha256 = "14v2lj65ccgmijxqrr61vpgba30q6w5vnisz78y3hbf3qpxmmd7g";
+      sha256 = "0g62v0maz3b9bmjvvjcin6ayg0f5k0n8m93zk75lagyr69g5vaka";
     };
 
     buildInputs = [ buildbot-pkg ];
@@ -78,7 +78,7 @@
 
     src = fetchPypi {
       inherit pname version;
-      sha256 = "03q9am237f2r8ivqm1dfkyzm3bmns4xjn99c27ps6dw9an15f73a";
+      sha256 = "0dlq8pchgccc66gfdlssydacisia5fbwc8b4gd8f9gcbish8jmf7";
     };
 
     buildInputs = [ buildbot-pkg ];
@@ -100,7 +100,7 @@
 
     src = fetchPypi {
       inherit pname version;
-      sha256 = "0wv5ghsfmhkbk96zimihcwn16rxjz1q1g5ppahb8gfrclmzhdynl";
+      sha256 = "193nni55py6yzw730yyp5va2n4313sjf6a7jmi0xs9bivvvzg5w9";
     };
 
     buildInputs = [ buildbot-pkg ];
diff --git a/pkgs/development/python-modules/buildbot/worker.nix b/pkgs/development/python-modules/buildbot/worker.nix
index 936ef661eeee..05938e43ad69 100644
--- a/pkgs/development/python-modules/buildbot/worker.nix
+++ b/pkgs/development/python-modules/buildbot/worker.nix
@@ -7,7 +7,7 @@ buildPythonPackage (rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1cba1zmm3gfw3ikax7q4vbrxnvjxlby79x5lc4fg9c3igbm0nmwj";
+    sha256 = "0p1w6ailp6xpa6ckl5prj413ilxx5s3lga5mzqxj9nn00vni8ik2";
   };
 
   propagatedBuildInputs = [ twisted future ];
diff --git a/pkgs/development/python-modules/can/default.nix b/pkgs/development/python-modules/can/default.nix
index 3629e0097eda..0a7e58ac8006 100644
--- a/pkgs/development/python-modules/can/default.nix
+++ b/pkgs/development/python-modules/can/default.nix
@@ -16,11 +16,11 @@
 
 buildPythonPackage rec {
   pname = "python-can";
-  version = "3.3.2";
+  version = "3.3.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "5fefb5c1e7e7f07faefc02c6eac79f9b58376f007048a04d8e7f325d48ec6b2e";
+    sha256 = "ecd69cf6b2f0235345ebe607a15325cf1384c85b24ffbe1d68c3754357f87488";
   };
 
   propagatedBuildInputs = [ wrapt pyserial aenum ] ++ lib.optional (pythonOlder "3.5") typing;
diff --git a/pkgs/development/python-modules/cnvkit/default.nix b/pkgs/development/python-modules/cnvkit/default.nix
index 054e302dfe76..f4f46f2dff0f 100644
--- a/pkgs/development/python-modules/cnvkit/default.nix
+++ b/pkgs/development/python-modules/cnvkit/default.nix
@@ -18,11 +18,11 @@
 
 buildPythonPackage rec {
   pname = "CNVkit";
-  version = "0.9.6";
+  version = "0.9.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1hj8c98s538i0hg5mrz4bw4v07qmcl51rhxq611rj2nglnc9r25y";
+    sha256 = "d68adc0121e17c61a3aa28c0a9ba6526510a5a0df0f0a6eb1818bab71b7e927a";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/coverage/default.nix b/pkgs/development/python-modules/coverage/default.nix
index 04c469204d78..a22009ac9db1 100644
--- a/pkgs/development/python-modules/coverage/default.nix
+++ b/pkgs/development/python-modules/coverage/default.nix
@@ -6,11 +6,11 @@
 
 buildPythonPackage rec {
   pname = "coverage";
-  version = "4.5.4";
+  version = "5.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "e07d9f1a23e9e93ab5c62902833bf3e4b1f65502927379148b6622686223125c";
+    sha256 = "0ll0hr8g3szbxa4al6khhzi6l92a3vwyldj0085whl44s55gq2zr";
   };
 
   # No tests in archive
diff --git a/pkgs/development/python-modules/croniter/default.nix b/pkgs/development/python-modules/croniter/default.nix
index 90334fd42250..15aaf97d15c0 100644
--- a/pkgs/development/python-modules/croniter/default.nix
+++ b/pkgs/development/python-modules/croniter/default.nix
@@ -8,11 +8,11 @@
 
 buildPythonPackage rec {
   pname = "croniter";
-  version = "0.3.31";
+  version = "0.3.32";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "15riw8sl8jzzkvvjlz3i3p7jcx423zipxhff5ddvki6zgnrb9149";
+    sha256 = "0d5bf45f12861c1b718c51bd6e2ab056da94e651bf22900658421cdde0ff7088";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/django-mailman3/default.nix b/pkgs/development/python-modules/django-mailman3/default.nix
index bcb39633f7ea..c8fdd57c98e1 100644
--- a/pkgs/development/python-modules/django-mailman3/default.nix
+++ b/pkgs/development/python-modules/django-mailman3/default.nix
@@ -4,11 +4,11 @@
 
 buildPythonPackage rec {
   pname = "django-mailman3";
-  version = "1.3.2";
+  version = "1.3.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1vq5qa136h4rz4hjznnk6y8l443i41yh4w4wxg20f9b059xrsld1";
+    sha256 = "1q9ciy2yawgvbha5kwlzwdmdqvas287dc0i60ygp2799jnfr5dr6";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/django_modelcluster/default.nix b/pkgs/development/python-modules/django_modelcluster/default.nix
index 27060e18ae27..4ded69bc3256 100644
--- a/pkgs/development/python-modules/django_modelcluster/default.nix
+++ b/pkgs/development/python-modules/django_modelcluster/default.nix
@@ -8,11 +8,11 @@
 
 buildPythonPackage rec {
   pname = "django-modelcluster";
-  version = "5.0.1";
+  version = "5.0.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1fk7fh30i0fzi0hjd841vxh25iryvgp4lirmxfpq428w4nq7p1bg";
+    sha256 = "c7a42cf9b93d1161a10bf59919f7ee52d996a523a4134b2a136f6fe1eba7a2fa";
   };
 
   disabled = pythonOlder "3.5";
diff --git a/pkgs/development/python-modules/dnslib/default.nix b/pkgs/development/python-modules/dnslib/default.nix
index fafa4c5cbf57..df9843893238 100644
--- a/pkgs/development/python-modules/dnslib/default.nix
+++ b/pkgs/development/python-modules/dnslib/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "dnslib";
-  version = "0.9.12";
+  version = "0.9.13";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "c206f09948f3ad17884adffdb552b700072c6022fa59744a0f0606114c475e19";
+    sha256 = "a0fed3e139c12ee4884b19bcde1d4a170745bcabb6026397876e3236ce38b9db";
   };
 
   checkPhase = "VERSIONS=${python.interpreter} ./run_tests.sh";
diff --git a/pkgs/development/python-modules/doc8/default.nix b/pkgs/development/python-modules/doc8/default.nix
index f7e620f491cb..c2a7df098f4b 100644
--- a/pkgs/development/python-modules/doc8/default.nix
+++ b/pkgs/development/python-modules/doc8/default.nix
@@ -12,11 +12,11 @@
 
 buildPythonPackage rec {
   pname = "doc8";
-  version = "0.8.0";
+  version = "0.8.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "2df89f9c1a5abfb98ab55d0175fed633cae0cf45025b8b1e0ee5ea772be28543";
+    sha256 = "4d1df12598807cf08ffa9a1d5ef42d229ee0de42519da01b768ff27211082c12";
   };
 
   buildInputs = [ pbr ];
diff --git a/pkgs/development/python-modules/docker/default.nix b/pkgs/development/python-modules/docker/default.nix
index a31ba7c69c03..9c788bde123d 100644
--- a/pkgs/development/python-modules/docker/default.nix
+++ b/pkgs/development/python-modules/docker/default.nix
@@ -11,11 +11,11 @@
 
 buildPythonPackage rec {
   pname = "docker";
-  version = "4.2.0";
+  version = "4.2.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0bkj1xfp6mnvk1i9hl5awsmwi07q6iwwsjznd7kvrx5m19i6dbnx";
+    sha256 = "380a20d38fbfaa872e96ee4d0d23ad9beb0f9ed57ff1c30653cbeb0c9c0964f2";
   };
 
   nativeBuildInputs = lib.optional isPy27 mock;
diff --git a/pkgs/development/python-modules/dockerfile-parse/default.nix b/pkgs/development/python-modules/dockerfile-parse/default.nix
index ffed5fb170d4..580945656b4c 100644
--- a/pkgs/development/python-modules/dockerfile-parse/default.nix
+++ b/pkgs/development/python-modules/dockerfile-parse/default.nix
@@ -1,12 +1,12 @@
 { stdenv, buildPythonPackage, fetchPypi, six, pytestcov, pytest }:
 
 buildPythonPackage rec {
-  version = "0.0.17";
+  version = "0.0.18";
   pname = "dockerfile-parse";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "a69d4ed44c4a890c16437327009ae59ec3a3afeb1abc3819d0c1b14a46099220";
+    sha256 = "a09eae6871b7b314f8a8bddb67b6c5002708b22247511906cf2a9a45564b83db";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/dot2tex/default.nix b/pkgs/development/python-modules/dot2tex/default.nix
index f671cdc9642a..03445f79117f 100644
--- a/pkgs/development/python-modules/dot2tex/default.nix
+++ b/pkgs/development/python-modules/dot2tex/default.nix
@@ -1,8 +1,11 @@
 { stdenv
+, python
 , buildPythonPackage
 , fetchPypi
-, isPy3k
+, substituteAll
 , pyparsing
+, graphviz
+, texlive
 }:
 
 buildPythonPackage rec {
@@ -14,11 +17,26 @@ buildPythonPackage rec {
     sha256 = "1kp77wiv7b5qib82i3y3sn9r49rym43aaqm5aw1bwnzfbbq2m6i9";
   };
 
-  # Tests fail with 3.x. Furthermore, package is no longer maintained.
-  disabled = isPy3k;
+  patches = [
+    (substituteAll {
+      src = ./path.patch;
+      inherit graphviz;
+    })
+    ./test.patch # https://github.com/kjellmf/dot2tex/issues/5
+  ];
 
   propagatedBuildInputs = [ pyparsing ];
 
+  checkInputs = [
+    (texlive.combine {
+      inherit (texlive) scheme-small preview pstricks;
+    })
+  ];
+
+  checkPhase = ''
+    ${python.interpreter} tests/test_dot2tex.py
+  '';
+
   meta = with stdenv.lib; {
     description = "Convert graphs generated by Graphviz to LaTeX friendly formats";
     homepage = "https://github.com/kjellmf/dot2tex";
diff --git a/pkgs/development/python-modules/dot2tex/path.patch b/pkgs/development/python-modules/dot2tex/path.patch
new file mode 100644
index 000000000000..4e05b7a8dff3
--- /dev/null
+++ b/pkgs/development/python-modules/dot2tex/path.patch
@@ -0,0 +1,104 @@
+diff --git a/dot2tex/dotparsing.py b/dot2tex/dotparsing.py
+index 391b5dc..6dc77a3 100644
+--- a/dot2tex/dotparsing.py
++++ b/dot2tex/dotparsing.py
+@@ -180,18 +180,8 @@ def __find_executables(path):
+ def find_graphviz():
+     """Locate Graphviz's executables in the system.
+ 
+-    Tries three methods:
+-
+-    First: Windows Registry (Windows only)
+-    This requires Mark Hammond's pywin32 is installed.
+-
+-    Secondly: Search the path
+-    It will look for 'dot', 'twopi' and 'neato' in all the directories
+-    specified in the PATH environment variable.
+-
+-    Thirdly: Default install location (Windows only)
+-    It will look for 'dot', 'twopi' and 'neato' in the default install
+-    location under the "Program Files" directory.
++    It will look for 'dot', 'twopi' and 'neato' in
++    @graphviz@/bin.
+ 
+     It will return a dictionary containing the program names as keys
+     and their paths as values.
+@@ -199,75 +189,9 @@ def find_graphviz():
+     If this fails, it returns None.
+     """
+ 
+-    # Method 1 (Windows only)
+-    #
+-    if os.sys.platform == 'win32':
+-        try:
+-            import win32api, win32con
+-
+-            # Get the GraphViz install path from the registry
+-            #
+-            hkey = win32api.RegOpenKeyEx(win32con.HKEY_LOCAL_MACHINE,
+-                                         "SOFTWARE\AT&T Research Labs\Graphviz", 0, win32con.KEY_QUERY_VALUE)
+-
+-            path = win32api.RegQueryValueEx(hkey, "InstallPath")[0]
+-            win32api.RegCloseKey(hkey)
+-
+-            # Now append the "bin" subdirectory:
+-            #
+-            path = os.path.join(path, "bin")
+-            progs = __find_executables(path)
+-            if progs is not None:
+-                # print("Used Windows registry")
+-                return progs
+-
+-        except ImportError:
+-            # Print a messaged suggesting they install these?
+-            #
+-            log.debug('The win32api is not installed')
+-            pass
+-        except:
+-            log.debug('Failed to access the registry key')
+-
+-    # Method 2 (Linux, Windows etc)
+-    #
+-    if 'PATH' in os.environ:
+-        for path in os.environ['PATH'].split(os.pathsep):
+-            progs = __find_executables(path)
+-            if progs is not None:
+-                return progs
+-
+-    # Method 3 (Windows only)
+-    #
+-    if os.sys.platform == 'win32':
+-        # Try and work out the equivalent of "C:\Program Files" on this
+-        # machine (might be on drive D:, or in a different language)
+-        #
+-        if 'PROGRAMFILES' in os.environ:
+-            # Note, we could also use the win32api to get this
+-            # information, but win32api may not be installed.
+-
+-            path = os.path.join(os.environ['PROGRAMFILES'], 'ATT', 'GraphViz', 'bin')
+-
+-        else:
+-            # Just in case, try the default...
+-            path = r"C:\Program Files\att\Graphviz\bin"
+-
+-        progs = __find_executables(path)
+-
+-        if progs is not None:
+-            # print("Used default install location")
+-            return progs
+-
+-    for path in (
+-            '/usr/bin', '/usr/local/bin',
+-            '/opt/local/bin',
+-            '/opt/bin', '/sw/bin', '/usr/share',
+-            '/Applications/Graphviz.app/Contents/MacOS/'):
+-        progs = __find_executables(path)
+-        if progs is not None:
+-            # print("Used path")
+-            return progs
++    progs = __find_executables('@graphviz@/bin')
++    if progs is not None:
++        return progs
+ 
+     # Failed to find GraphViz
+     #
diff --git a/pkgs/development/python-modules/dot2tex/test.patch b/pkgs/development/python-modules/dot2tex/test.patch
new file mode 100644
index 000000000000..9ead8ac5ee5c
--- /dev/null
+++ b/pkgs/development/python-modules/dot2tex/test.patch
@@ -0,0 +1,12 @@
+diff --git a/tests/test_dot2tex.py b/tests/test_dot2tex.py
+index 74b01ed..7be9aba 100644
+--- a/tests/test_dot2tex.py
++++ b/tests/test_dot2tex.py
+@@ -147,6 +147,7 @@ class NeedsQuotesTests(unittest.TestCase):
+ 
+ class MultipleStatements(unittest.TestCase):
+     # https://github.com/kjellmf/dot2tex/issues/5
++    @unittest.skip('fails upstream')
+     def test_semicolon(self):
+         """Test for issue 5"""
+         testgraph1 = """
diff --git a/pkgs/development/python-modules/elasticsearch-dsl/default.nix b/pkgs/development/python-modules/elasticsearch-dsl/default.nix
index 712766fa58e2..68d658f4989e 100644
--- a/pkgs/development/python-modules/elasticsearch-dsl/default.nix
+++ b/pkgs/development/python-modules/elasticsearch-dsl/default.nix
@@ -10,11 +10,11 @@
 
 buildPythonPackage rec {
   pname = "elasticsearch-dsl";
-  version = "7.2.0";
+  version = "7.2.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "19q91srlcvfrk5rnk18c0mzvki9l893g7rqgymfg0p8abb9c05a0";
+    sha256 = "1e345535164cb684de4b825e1d0daf81b75554b30d3905446584a9e4af0cc3e7";
   };
 
   propagatedBuildInputs = [ elasticsearch python-dateutil six ]
diff --git a/pkgs/development/python-modules/elasticsearch/default.nix b/pkgs/development/python-modules/elasticsearch/default.nix
index 821a890346fc..b04bc9069f71 100644
--- a/pkgs/development/python-modules/elasticsearch/default.nix
+++ b/pkgs/development/python-modules/elasticsearch/default.nix
@@ -7,11 +7,11 @@
 
 buildPythonPackage (rec {
   pname = "elasticsearch";
-  version = "7.7.0";
+  version = "7.7.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1fm6lalyiy4ayj0mp400dvy629j2av5cqww72w4cg8bqifb83pim";
+    sha256 = "9bfcb2bd137d6d7ca123e252b9d7261cfe4f7723f7b749a99c52b47766cf387c";
   };
 
   # Check is disabled because running them destroy the content of the local cluster!
diff --git a/pkgs/development/python-modules/eve/default.nix b/pkgs/development/python-modules/eve/default.nix
index 7a74de03d522..062d6e3bedb8 100644
--- a/pkgs/development/python-modules/eve/default.nix
+++ b/pkgs/development/python-modules/eve/default.nix
@@ -11,11 +11,11 @@
 
 buildPythonPackage rec {
   pname = "Eve";
-  version = "1.1";
+  version = "1.1.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1a7i7x77p5wjqfzmgn30m9sz2mcz06k4qf5af6a45109lafcq0bv";
+    sha256 = "dbb409c481ffd5100a5ab13177f6ef6284257e33ac8e5090cd50e42533607ebd";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/flask-sqlalchemy/default.nix b/pkgs/development/python-modules/flask-sqlalchemy/default.nix
index 2453bb50766d..594af9f74bf4 100644
--- a/pkgs/development/python-modules/flask-sqlalchemy/default.nix
+++ b/pkgs/development/python-modules/flask-sqlalchemy/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "Flask-SQLAlchemy";
-  version = "2.4.1";
+  version = "2.4.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "6974785d913666587949f7c2946f7001e4fa2cb2d19f4e69ead02e4b8f50b33d";
+    sha256 = "0b656fbf87c5f24109d859bafa791d29751fabbda2302b606881ae5485b557a5";
   };
 
   propagatedBuildInputs = [ flask sqlalchemy ];
diff --git a/pkgs/development/python-modules/geoalchemy2/default.nix b/pkgs/development/python-modules/geoalchemy2/default.nix
index e4fbb37c966e..892b373f065c 100644
--- a/pkgs/development/python-modules/geoalchemy2/default.nix
+++ b/pkgs/development/python-modules/geoalchemy2/default.nix
@@ -7,11 +7,11 @@
 
 buildPythonPackage rec {
   pname = "GeoAlchemy2";
-  version = "0.8.0";
+  version = "0.8.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0kqxm9imqjbhjj5imvf2kl57di454xmnnsr3i0cs66ibq90nx5m8";
+    sha256 = "a5a2444d90ce7f2c6b2d7bd7346c8aed16fd32c3e190e631576a51814e8f7ee9";
   };
 
   propagatedBuildInputs = [ sqlalchemy shapely ];
diff --git a/pkgs/development/python-modules/google_cloud_resource_manager/default.nix b/pkgs/development/python-modules/google_cloud_resource_manager/default.nix
index d1d4217b3ccc..84fac88bcfa9 100644
--- a/pkgs/development/python-modules/google_cloud_resource_manager/default.nix
+++ b/pkgs/development/python-modules/google_cloud_resource_manager/default.nix
@@ -9,11 +9,11 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-resource-manager";
-  version = "0.30.1";
+  version = "0.30.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "03n9ahf4qiyamblh217m5bjc8n57gh09xz87l2iw84c81xxdfcpg";
+    sha256 = "de7eba5235df61deee2291a2fe70b904154df613a334109488afdea7a4c0011f";
   };
 
   checkInputs = [ pytest mock ];
diff --git a/pkgs/development/python-modules/google_resumable_media/default.nix b/pkgs/development/python-modules/google_resumable_media/default.nix
index e9c7eecbc3a7..40c8f2596bb1 100644
--- a/pkgs/development/python-modules/google_resumable_media/default.nix
+++ b/pkgs/development/python-modules/google_resumable_media/default.nix
@@ -10,11 +10,11 @@
 
 buildPythonPackage rec {
   pname = "google-resumable-media";
-  version = "0.5.0";
+  version = "0.5.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "2a8fd188afe1cbfd5998bf20602f76b0336aa892de88fe842a806b9a3ed78d2a";
+    sha256 = "97155236971970382b738921f978a6f86a7b5a0b0311703d991e065d3cb55773";
   };
 
   checkInputs = [ pytest mock ];
diff --git a/pkgs/development/python-modules/greenlet/default.nix b/pkgs/development/python-modules/greenlet/default.nix
index f6cff7411d21..c325c9652491 100644
--- a/pkgs/development/python-modules/greenlet/default.nix
+++ b/pkgs/development/python-modules/greenlet/default.nix
@@ -8,12 +8,12 @@
 
 buildPythonPackage rec {
   pname = "greenlet";
-  version = "0.4.15";
+  version = "0.4.16";
   disabled = isPyPy;  # builtin for pypy
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "9416443e219356e3c31f1f918a91badf2e37acf297e2fa13d24d1cc2380f8fbc";
+    sha256 = "6e06eac722676797e8fce4adb8ad3dc57a1bb3adfb0dd3fdf8306c055a38456c";
   };
 
   propagatedBuildInputs = [ six ];
diff --git a/pkgs/development/python-modules/hsaudiotag3k/default.nix b/pkgs/development/python-modules/hsaudiotag3k/default.nix
index 28fa42b70f04..d12d3bc8c832 100644
--- a/pkgs/development/python-modules/hsaudiotag3k/default.nix
+++ b/pkgs/development/python-modules/hsaudiotag3k/default.nix
@@ -6,12 +6,12 @@
 
 buildPythonPackage rec {
   pname = "hsaudiotag3k";
-  version = "1.1.3";
+  version = "1.1.3.post1";
   disabled = !isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0bv5k5594byr2bmhh77xv10fkdpckcmxg3w380yp30aqf83rcsx3";
+    sha256 = "ef60e9210d4727e82f0095a686cb07b676d055918f0c59c5bfa8598da03e59d1";
   };
 
   # no tests
diff --git a/pkgs/development/python-modules/httplib2/default.nix b/pkgs/development/python-modules/httplib2/default.nix
index f0191ad8226c..5495c806dc0f 100644
--- a/pkgs/development/python-modules/httplib2/default.nix
+++ b/pkgs/development/python-modules/httplib2/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "httplib2";
-  version = "0.17.3";
+  version = "0.17.4";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "39dd15a333f67bfb70798faa9de8a6e99c819da6ad82b77f9a259a5c7b1225a2";
+    sha256 = "1e9340ecf0187a621bdcfb407c32e04e8e09fc6ab28b050efa38f20eae0e975f";
   };
 
   # Needs setting up
diff --git a/pkgs/development/python-modules/hvac/default.nix b/pkgs/development/python-modules/hvac/default.nix
index a783246ee5c3..d68e12b37732 100644
--- a/pkgs/development/python-modules/hvac/default.nix
+++ b/pkgs/development/python-modules/hvac/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "hvac";
-  version = "0.10.1";
+  version = "0.10.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1fcd2psvkfsqy45iygm59rzhb7qkbgv3c1dk3x3jvhy6a1ls4kkq";
+    sha256 = "391b558a465d1919a2862926ab9a7c6bef1f2ac2c46daf8dd5115080c42978e4";
   };
 
   propagatedBuildInputs = [ requests six ];
diff --git a/pkgs/development/python-modules/identify/default.nix b/pkgs/development/python-modules/identify/default.nix
index 19ad7317ce41..9f78298a3f3a 100644
--- a/pkgs/development/python-modules/identify/default.nix
+++ b/pkgs/development/python-modules/identify/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "identify";
-  version = "1.4.16";
+  version = "1.4.19";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "19zk3qmcf0afbcbfnj7cmmgr47pxhjqwa1bfdc3fp60yy10kvbgr";
+    sha256 = "249ebc7e2066d6393d27c1b1be3b70433f824a120b1d8274d362f1eb419e3b52";
   };
 
   # Tests not included in PyPI tarball
diff --git a/pkgs/development/python-modules/importlib-metadata/default.nix b/pkgs/development/python-modules/importlib-metadata/default.nix
index 76545edcbeba..5a3137922475 100644
--- a/pkgs/development/python-modules/importlib-metadata/default.nix
+++ b/pkgs/development/python-modules/importlib-metadata/default.nix
@@ -13,12 +13,12 @@
 
 buildPythonPackage rec {
   pname = "importlib-metadata";
-  version = "1.5.0";
+  version = "1.6.0";
 
   src = fetchPypi {
     pname = "importlib_metadata";
     inherit version;
-    sha256 = "00ikdj4gjhankdljnz7g5ggak4k9lql2926x0x117ir9j2lv7x86";
+    sha256 = "07icyggasn38yv2swdrd8z6i0plazmc9adavsdkbqqj91j53ll9l";
   };
 
   nativeBuildInputs = [ setuptools_scm ];
@@ -26,7 +26,7 @@ buildPythonPackage rec {
   propagatedBuildInputs = [ zipp ]
     ++ lib.optionals (!isPy3k) [ pathlib2 contextlib2 configparser ];
 
-  checkInputs = [ importlib-resources packaging ];
+  doCheck = false; # Cyclic dependencies.
 
   # removing test_main.py - it requires 'pyflakefs'
   # and adding `pyflakefs` to `checkInputs` causes infinite recursion.
diff --git a/pkgs/development/python-modules/importlib-resources/default.nix b/pkgs/development/python-modules/importlib-resources/default.nix
index 6fba0a703e16..7faefd4c0e1e 100644
--- a/pkgs/development/python-modules/importlib-resources/default.nix
+++ b/pkgs/development/python-modules/importlib-resources/default.nix
@@ -1,24 +1,28 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, pathlib2
+, setuptools_scm
+, toml
+, importlib-metadata
 , typing
-, isPy3k
+, singledispatch
 , pythonOlder
 , python
 }:
 
 buildPythonPackage rec {
   pname = "importlib_resources";
-  version = "1.0.2";
+  version = "1.5.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "d3279fd0f6f847cced9f7acc19bd3e5df54d34f93a2e7bb5f238f81545787078";
+    sha256 = "1jilyxyb2z7hzcjhx1ddni52mq00i728wqh8f5k4469yhdkdz1vg";
   };
 
+  nativeBuildInputs = [ setuptools_scm toml ];
   propagatedBuildInputs = [
-  ] ++ lib.optional (!isPy3k) pathlib2
+    importlib-metadata
+  ] ++ lib.optional (pythonOlder "3.4") singledispatch
     ++ lib.optional (pythonOlder "3.5") typing
   ;
 
diff --git a/pkgs/development/python-modules/ipython/7.9.nix b/pkgs/development/python-modules/ipython/7.9.nix
index 4c8086def330..9953868df5f3 100644
--- a/pkgs/development/python-modules/ipython/7.9.nix
+++ b/pkgs/development/python-modules/ipython/7.9.nix
@@ -64,6 +64,6 @@ buildPythonPackage rec {
     description = "IPython: Productive Interactive Computing";
     homepage = "http://ipython.org/";
     license = licenses.bsd3;
-    maintainers = with maintainers; [ bjornfor fridh ];
+    maintainers = with maintainers; [ bjornfor ];
   };
 }
diff --git a/pkgs/development/python-modules/ipython/default.nix b/pkgs/development/python-modules/ipython/default.nix
index 69fe73eb3423..692daa7b2f38 100644
--- a/pkgs/development/python-modules/ipython/default.nix
+++ b/pkgs/development/python-modules/ipython/default.nix
@@ -22,12 +22,12 @@
 
 buildPythonPackage rec {
   pname = "ipython";
-  version = "7.14.0";
+  version = "7.15.0";
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "f0126781d0f959da852fb3089e170ed807388e986a8dd4e6ac44855845b0fb1c";
+    sha256 = "0ef1433879816a960cd3ae1ae1dc82c64732ca75cec8dab5a4e29783fb571d0e";
   };
 
   prePatch = lib.optionalString stdenv.isDarwin ''
diff --git a/pkgs/development/python-modules/isbnlib/default.nix b/pkgs/development/python-modules/isbnlib/default.nix
index 11ae3157615a..2c454fd9ce0c 100644
--- a/pkgs/development/python-modules/isbnlib/default.nix
+++ b/pkgs/development/python-modules/isbnlib/default.nix
@@ -7,11 +7,11 @@
 
 buildPythonPackage rec {
   pname = "isbnlib";
-  version = "3.10.1";
+  version = "3.10.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1ky5ynb8p580y2x3vpib6yrvdjgjb0wpqmdfnq5pqi3qzjyzsqra";
+    sha256 = "2295c01465fe19776b1f9432fd99fd24e61230d146ded2752e0d980ef6f4101f";
   };
 
   checkInputs = [
diff --git a/pkgs/development/python-modules/jupyter_client/5.nix b/pkgs/development/python-modules/jupyter_client/5.nix
index 4855663ebc7d..8ce8150cbd47 100644
--- a/pkgs/development/python-modules/jupyter_client/5.nix
+++ b/pkgs/development/python-modules/jupyter_client/5.nix
@@ -34,6 +34,6 @@ buildPythonPackage rec {
     description = "Jupyter protocol implementation and client libraries";
     homepage = "https://jupyter.org/";
     license = lib.licenses.bsd3;
-    maintainers = with lib.maintainers; [ fridh ];
+    maintainers = with lib.maintainers; [  ];
   };
 }
diff --git a/pkgs/development/python-modules/jupyterlab/default.nix b/pkgs/development/python-modules/jupyterlab/default.nix
index a8057ed06ae5..8d08fec6f5d9 100644
--- a/pkgs/development/python-modules/jupyterlab/default.nix
+++ b/pkgs/development/python-modules/jupyterlab/default.nix
@@ -8,12 +8,12 @@
 
 buildPythonPackage rec {
   pname = "jupyterlab";
-  version = "2.1.2";
+  version = "2.1.4";
   disabled = pythonOlder "3.5";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "380c29d674f6dcf8e380615334c7813bb4feb7bbb6222baf1d4c9f8318f4b104";
+    sha256 = "7b5bd4a05330a01c8522ee7f1cda5cb2e0d96412d9e1e879a19b3afb63d4ac69";
   };
 
   propagatedBuildInputs = [ jupyterlab_server notebook ];
diff --git a/pkgs/development/python-modules/jupyterlab_server/default.nix b/pkgs/development/python-modules/jupyterlab_server/default.nix
index cd166b2d801e..9185c2940060 100644
--- a/pkgs/development/python-modules/jupyterlab_server/default.nix
+++ b/pkgs/development/python-modules/jupyterlab_server/default.nix
@@ -11,12 +11,12 @@
 
 buildPythonPackage rec {
   pname = "jupyterlab_server";
-  version = "1.1.3";
+  version = "1.1.5";
   disabled = pythonOlder "3.5";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "17eac20af10167abebbeca72e7e390b9c19a400b8fffa158b5cfdcac344253d4";
+    sha256 = "3398e401b95da868bc96bdaa44fa61252bf3e68fc9dd1645bd93293cce095f6c";
   };
 
   checkInputs = [ requests pytest ];
diff --git a/pkgs/development/python-modules/keras-preprocessing/default.nix b/pkgs/development/python-modules/keras-preprocessing/default.nix
index cb4b6d249b60..d62a179136f4 100644
--- a/pkgs/development/python-modules/keras-preprocessing/default.nix
+++ b/pkgs/development/python-modules/keras-preprocessing/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "Keras_Preprocessing";
-  version = "1.1.0";
+  version = "1.1.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1r98nm4k1svsqjyaqkfk23i31bl1kcfcyp7094yyj3c43phfp3as";
+    sha256 = "add82567c50c8bc648c14195bf544a5ce7c1f76761536956c3d2978970179ef3";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/kombu/default.nix b/pkgs/development/python-modules/kombu/default.nix
index 437f03276708..27d225c6f7cf 100644
--- a/pkgs/development/python-modules/kombu/default.nix
+++ b/pkgs/development/python-modules/kombu/default.nix
@@ -11,11 +11,11 @@
 
 buildPythonPackage rec {
   pname = "kombu";
-  version = "4.6.8";
+  version = "4.6.10";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0xlv1rsfc3vn22l35csaj939zygd15nzmxbz3bcl981685vxl71d";
+    sha256 = "437b9cdea193cc2ed0b8044c85fd0f126bb3615ca2f4d4a35b39de7cacfa3c1a";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/libevdev/default.nix b/pkgs/development/python-modules/libevdev/default.nix
new file mode 100644
index 000000000000..ab00340cfe19
--- /dev/null
+++ b/pkgs/development/python-modules/libevdev/default.nix
@@ -0,0 +1,21 @@
+{ stdenv, buildPythonPackage, isPy27, fetchPypi }:
+
+buildPythonPackage rec {
+  pname = "libevdev";
+  version = "0.7";
+  disabled = isPy27;
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "10gwj08kn2rs4waq7807mq34cbavgkpg8fpir8mvnba601b8q4r4";
+  };
+
+  doCheck = false;
+
+  meta = with stdenv.lib; {
+    description = "Python wrapper around the libevdev C library";
+    homepage = "https://gitlab.freedesktop.org/libevdev/python-libevdev";
+    license = licenses.mit;
+    maintainers = with maintainers; [ nickhu ];
+  };
+}
diff --git a/pkgs/development/python-modules/mailmanclient/default.nix b/pkgs/development/python-modules/mailmanclient/default.nix
index 247a7ed1b004..45dfc55ae9a8 100644
--- a/pkgs/development/python-modules/mailmanclient/default.nix
+++ b/pkgs/development/python-modules/mailmanclient/default.nix
@@ -2,20 +2,16 @@
 
 buildPythonPackage rec {
   pname = "mailmanclient";
-  version = "3.3.0";
+  version = "3.3.1";
   disabled = !isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "c8736cbe152ae1bd58b46ccfbcafb6a1e301513530772e7fda89f91d1e5c1ae9";
+    sha256 = "0pjgzpvhdb6ql8asb20xr8d01m646zpghmcp9fmscks0n1k4di4g";
   };
 
   propagatedBuildInputs = [ six httplib2 requests ];
 
-  # no tests with Pypi tar ball, checkPhase removes setup.py which invalidates import check
-  doCheck = false;
-  pythonImportsCheck = [ "mailmanclient" ];
-
   meta = with stdenv.lib; {
     homepage = "https://www.gnu.org/software/mailman/";
     description = "REST client for driving Mailman 3";
diff --git a/pkgs/development/python-modules/meinheld/default.nix b/pkgs/development/python-modules/meinheld/default.nix
index 247523a9a830..2941505184de 100644
--- a/pkgs/development/python-modules/meinheld/default.nix
+++ b/pkgs/development/python-modules/meinheld/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "meinheld";
-  version = "1.0.1";
+  version = "1.0.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "447de7189e4dc9c1f425aa1b9c8210aab492fda4d86f73a24059264e7d8b0134";
+    sha256 = "008c76937ac2117cc69e032dc69cea9f85fc605de9bac1417f447c41c16a56d6";
   };
 
   propagatedBuildInputs = [ greenlet ];
diff --git a/pkgs/development/python-modules/msgpack-numpy/default.nix b/pkgs/development/python-modules/msgpack-numpy/default.nix
index d646c1ed15f2..9be30fff5383 100644
--- a/pkgs/development/python-modules/msgpack-numpy/default.nix
+++ b/pkgs/development/python-modules/msgpack-numpy/default.nix
@@ -9,11 +9,11 @@
 
 buildPythonPackage rec {
   pname = "msgpack-numpy";
-  version = "0.4.5";
+  version = "0.4.6.post0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0z3ls52iamqv6fbn1ljnd5nnnzaiakczciry5c3vym5r77wgc9mg";
+    sha256 = "dfcb0c9cb5850e656344ac464a260e7b8b9b1c62d77c2e1d3d9ef15a88f1df6b";
   };
 
   buildInputs = [
diff --git a/pkgs/development/python-modules/multidict/default.nix b/pkgs/development/python-modules/multidict/default.nix
index 155395efa4ad..d818a63cd5d0 100644
--- a/pkgs/development/python-modules/multidict/default.nix
+++ b/pkgs/development/python-modules/multidict/default.nix
@@ -8,11 +8,11 @@
 
 buildPythonPackage rec {
   pname = "multidict";
-  version = "4.7.5";
+  version = "4.7.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "aee283c49601fa4c13adc64c09c978838a7e812f85377ae130a24d7198c0331e";
+    sha256 = "fbb77a75e529021e7c4a8d4e823d88ef4d23674a202be4f5addffc72cbb91430";
   };
 
   checkInputs = [ pytest pytestrunner pytestcov ];
diff --git a/pkgs/development/python-modules/nbformat/2.nix b/pkgs/development/python-modules/nbformat/2.nix
index faf2cee2b008..06d02520b20d 100644
--- a/pkgs/development/python-modules/nbformat/2.nix
+++ b/pkgs/development/python-modules/nbformat/2.nix
@@ -36,6 +36,6 @@ buildPythonPackage rec {
     description = "The Jupyter Notebook format";
     homepage = "https://jupyter.org/";
     license = lib.licenses.bsd3;
-    maintainers = with lib.maintainers; [ fridh globin ];
+    maintainers = with lib.maintainers; [ globin ];
   };
 }
diff --git a/pkgs/development/python-modules/notebook/2.nix b/pkgs/development/python-modules/notebook/2.nix
index 8b8cce2f8245..37f39c44967c 100644
--- a/pkgs/development/python-modules/notebook/2.nix
+++ b/pkgs/development/python-modules/notebook/2.nix
@@ -71,6 +71,6 @@ buildPythonPackage rec {
     description = "The Jupyter HTML notebook is a web-based notebook environment for interactive computing";
     homepage = "https://jupyter.org/";
     license = lib.licenses.bsd3;
-    maintainers = with lib.maintainers; [ fridh ];
+    maintainers = with lib.maintainers; [ ];
   };
 }
diff --git a/pkgs/development/python-modules/numpy/default.nix b/pkgs/development/python-modules/numpy/default.nix
index 62a871fda092..0c9bac973203 100644
--- a/pkgs/development/python-modules/numpy/default.nix
+++ b/pkgs/development/python-modules/numpy/default.nix
@@ -35,13 +35,13 @@ let
   };
 in buildPythonPackage rec {
   pname = "numpy";
-  version = "1.18.4";
+  version = "1.18.5";
   format = "pyproject.toml";
 
   src = fetchPypi {
     inherit pname version;
     extension = "zip";
-    sha256 = "bbcc85aaf4cd84ba057decaead058f43191cc0e30d6bc5d44fe336dc3d3f4509";
+    sha256 = "34e96e9dae65c4839bd80012023aadd6ee2ccb73ce7fdf3074c62f301e63120b";
   };
 
   nativeBuildInputs = [ gfortran pytest cython setuptoolsBuildHook ];
diff --git a/pkgs/development/python-modules/pandas/default.nix b/pkgs/development/python-modules/pandas/default.nix
index 0f4a35420865..5d7bb4a6d696 100644
--- a/pkgs/development/python-modules/pandas/default.nix
+++ b/pkgs/development/python-modules/pandas/default.nix
@@ -30,11 +30,11 @@ let
 
 in buildPythonPackage rec {
   pname = "pandas";
-  version = "1.0.3";
+  version = "1.0.4";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "11j5s6hz29yh3rwa2rjgric0knbhp9shphd4i7hx00xr5wr2xx1j";
+    sha256 = "b35d625282baa7b51e82e52622c300a1ca9f786711b2af7cbe64f1e6831f4126";
   };
 
   checkInputs = [ pytest glibcLocales moto hypothesis ];
diff --git a/pkgs/development/python-modules/phik/default.nix b/pkgs/development/python-modules/phik/default.nix
index e09182d5e714..ca1b5ba65da7 100644
--- a/pkgs/development/python-modules/phik/default.nix
+++ b/pkgs/development/python-modules/phik/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage rec {
   pname = "phik";
-  version = "0.9.11";
+  version = "0.9.12";
   format = "wheel";
   disabled = !isPy3k;
 
   src = fetchPypi {
     inherit pname version format;
     python = "py3";
-    sha256 = "b8c36dc50265d8c0626b34e3bc74cd0edd342d9d8ecc3d78c06817200bb31d10";
+    sha256 = "c4f86e5587e5b456e69bf69d95d07fe7aafc341c40f8f3a21dd5b52272e9ae7b";
   };
 
   checkInputs = [
diff --git a/pkgs/development/python-modules/phonenumbers/default.nix b/pkgs/development/python-modules/phonenumbers/default.nix
index e9f50420ca9e..2ba64faad31e 100644
--- a/pkgs/development/python-modules/phonenumbers/default.nix
+++ b/pkgs/development/python-modules/phonenumbers/default.nix
@@ -6,7 +6,7 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "09kww3fzn85gbj4lw8kqrppm9kq7nmy7b96p76sscamrpsdg31im";
+    sha256 = "3586f19abeb92aa6b539d7a4757cb507cf54efcd78224e895caf20fbdde07c26";
   };
 
   meta = {
diff --git a/pkgs/development/python-modules/pycurl/default.nix b/pkgs/development/python-modules/pycurl/default.nix
index 6b6aad2b2342..7531bb8f7bbc 100644
--- a/pkgs/development/python-modules/pycurl/default.nix
+++ b/pkgs/development/python-modules/pycurl/default.nix
@@ -47,7 +47,8 @@ buildPythonPackage rec {
                      and not test_libcurl_ssl_openssl" \
                  --ignore=tests/getinfo_test.py \
                  --ignore=tests/memory_mgmt_test.py \
-                 --ignore=tests/multi_memory_mgmt_test.py
+                 --ignore=tests/multi_memory_mgmt_test.py \
+                 --ignore=tests/multi_timer_test.py
   '';
 
   preConfigure = ''
diff --git a/pkgs/development/python-modules/pydantic/default.nix b/pkgs/development/python-modules/pydantic/default.nix
index ef33b6fb2bd5..371bfba2f0f9 100644
--- a/pkgs/development/python-modules/pydantic/default.nix
+++ b/pkgs/development/python-modules/pydantic/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+, fetchpatch
 , ujson
 , email_validator
 , typing-extensions
@@ -22,6 +23,14 @@ buildPythonPackage rec {
     sha256 = "0fwrx7p6d5vskg9ibganahiz9y9299idvdmzhjw62jy84gn1vrb4";
   };
 
+  # fix tests, remove on next version bump
+  patches = [
+    (fetchpatch {
+      url = "https://github.com/samuelcolvin/pydantic/commit/a5b0e741e585040a0ab8b0be94dd9dc2dd3afcc7.patch";
+      sha256 = "0v91ac3dw23rm73370s2ns84vi0xqbfzpvj84zb7xdiicx8fhmf1";
+    })
+  ];
+
   propagatedBuildInputs = [
     ujson
     email_validator
diff --git a/pkgs/development/python-modules/pyenchant/default.nix b/pkgs/development/python-modules/pyenchant/default.nix
index 1d2686ec2992..1c82f7c9d630 100644
--- a/pkgs/development/python-modules/pyenchant/default.nix
+++ b/pkgs/development/python-modules/pyenchant/default.nix
@@ -7,12 +7,12 @@
 
 buildPythonPackage rec {
   pname = "pyenchant";
-  version = "3.1.0";
+  version = "3.1.1";
   disabled = isPy27;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "14is5p40f516plzccwg6yf51zkja38abw46kybzwgyy94phr8i9b";
+    sha256 = "ce0915d7acd771fde6e8c2dce8ad0cb0e6f7c4fa8430cc96e3e7134e99aeb12f";
   };
 
   propagatedBuildInputs = [ enchant2 ];
diff --git a/pkgs/development/python-modules/pygdbmi/default.nix b/pkgs/development/python-modules/pygdbmi/default.nix
index 447fbdfcdc44..b3d1fb3d26df 100644
--- a/pkgs/development/python-modules/pygdbmi/default.nix
+++ b/pkgs/development/python-modules/pygdbmi/default.nix
@@ -1,4 +1,5 @@
-{ lib
+{ stdenv
+, lib
 , buildPythonPackage
 , fetchFromGitHub
 , gdb
@@ -19,6 +20,9 @@ buildPythonPackage rec {
 
   checkInputs = [ gdb ];
 
+  # tests require gcc for some reason
+  doCheck = !stdenv.hostPlatform.isDarwin;
+
   postPatch = ''
     # tries to execute flake8,
     # which is likely to break on flake8 updates
diff --git a/pkgs/development/python-modules/pyhomematic/default.nix b/pkgs/development/python-modules/pyhomematic/default.nix
index 5349ea994a44..14bf1cfe7be0 100644
--- a/pkgs/development/python-modules/pyhomematic/default.nix
+++ b/pkgs/development/python-modules/pyhomematic/default.nix
@@ -2,13 +2,13 @@
 
 buildPythonPackage rec {
   pname = "pyhomematic";
-  version = "0.1.66";
+  version = "0.1.67";
 
   disabled = !isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "f046db8406ee8a1aea6f6b05de8a133d3459b990c065c3f66446050e9aad5d79";
+    sha256 = "2d18e0059367e9e32d6472023322113fce431bcc72187b4a6eb7402fe5d2794b";
   };
 
   # PyPI tarball does not include tests/ directory
diff --git a/pkgs/development/python-modules/pynput/default.nix b/pkgs/development/python-modules/pynput/default.nix
new file mode 100644
index 000000000000..2b83f4c1223b
--- /dev/null
+++ b/pkgs/development/python-modules/pynput/default.nix
@@ -0,0 +1,25 @@
+{ stdenv, buildPythonPackage, fetchPypi, sphinx, setuptools-lint, xlib }:
+
+buildPythonPackage rec {
+  pname = "pynput";
+  version = "1.6.8";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "16h4wn7f54rw30jrya7rmqkx3f51pxn8cplid95v880md8yqdhb8";
+  };
+
+  nativeBuildInputs = [ sphinx ];
+
+  propagatedBuildInputs = [ setuptools-lint xlib ];
+
+  doCheck = false;
+
+  meta = with stdenv.lib; {
+    description = "A library to control and monitor input devices";
+    homepage = "https://github.com/moses-palmer/pynput";
+    license = licenses.lgpl3;
+    maintainers = with maintainers; [ nickhu ];
+  };
+}
+
diff --git a/pkgs/development/python-modules/pysonos/default.nix b/pkgs/development/python-modules/pysonos/default.nix
index 67e8e5573d7f..427c42545c5a 100644
--- a/pkgs/development/python-modules/pysonos/default.nix
+++ b/pkgs/development/python-modules/pysonos/default.nix
@@ -13,13 +13,13 @@
 
 buildPythonPackage rec {
   pname = "pysonos";
-  version = "0.0.28";
+  version = "0.0.31";
 
   disabled = !isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "09852c0bfe07e3529f8665527381f586c7ea3beabcd7291311e679d56459069d";
+    sha256 = "03f21d2fb27cd938bd2c47f8582c0737eb7426a0cd59e5a60171fabe5e963e62";
   };
 
   propagatedBuildInputs = [ xmltodict requests ifaddr ];
diff --git a/pkgs/development/python-modules/pytest-flake8/default.nix b/pkgs/development/python-modules/pytest-flake8/default.nix
index af1cbb2add51..a5ed447aceac 100644
--- a/pkgs/development/python-modules/pytest-flake8/default.nix
+++ b/pkgs/development/python-modules/pytest-flake8/default.nix
@@ -2,7 +2,7 @@
 
 buildPythonPackage rec {
   pname = "pytest-flake8";
-  version = "1.0.5";
+  version = "1.0.6";
 
   # although pytest is a runtime dependency, do not add it as
   # propagatedBuildInputs in order to allow packages depend on another version
@@ -12,7 +12,7 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "d85efaafbdb9580791cfa8671799dd40d482fc30bd4476c1ca5efd661e751333";
+    sha256 = "1b82bb58c88eb1db40524018d3fcfd0424575029703b4e2d8e3ee873f2b17027";
   };
 
   checkPhase = ''
diff --git a/pkgs/development/python-modules/pytest/default.nix b/pkgs/development/python-modules/pytest/default.nix
index 9e0cd88cf0a4..daf43961ea67 100644
--- a/pkgs/development/python-modules/pytest/default.nix
+++ b/pkgs/development/python-modules/pytest/default.nix
@@ -19,7 +19,7 @@
 }:
 
 buildPythonPackage rec {
-  version = "5.4.2";
+  version = "5.4.3";
   pname = "pytest";
 
   disabled = !isPy3k;
@@ -31,7 +31,7 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "eb2b5e935f6a019317e455b6da83dd8650ac9ffd2ee73a7b657a30873d67a698";
+    sha256 = "7979331bfcba207414f5e1263b5a0f8f521d0f457318836a7355531ed1a4c7d8";
   };
 
   checkInputs = [ hypothesis pygments ];
diff --git a/pkgs/development/python-modules/python-engineio/default.nix b/pkgs/development/python-modules/python-engineio/default.nix
index 128fb8961d4d..cb3fe1a9f38d 100644
--- a/pkgs/development/python-modules/python-engineio/default.nix
+++ b/pkgs/development/python-modules/python-engineio/default.nix
@@ -47,7 +47,6 @@ buildPythonPackage rec {
     description = "Engine.IO server";
     homepage = "https://github.com/miguelgrinberg/python-engineio/";
     license = licenses.mit;
-    platforms = platforms.linux;
     maintainers = [ maintainers.mic92 ];
   };
 }
diff --git a/pkgs/development/python-modules/python-miio/default.nix b/pkgs/development/python-modules/python-miio/default.nix
index 5b8c140df67e..a18645697089 100644
--- a/pkgs/development/python-modules/python-miio/default.nix
+++ b/pkgs/development/python-modules/python-miio/default.nix
@@ -15,11 +15,11 @@
 
 buildPythonPackage rec {
   pname = "python-miio";
-  version = "0.5.0.1";
+  version = "0.5.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "fa9c318256945ad4a8623fdf921ce81c466a7aea18b04a6711efb662f520b195";
+    sha256 = "8d23caf4906f2112dc88b9a6d5e1767877744cae016cd71c2bf75592a4be3b79";
   };
 
   checkInputs = [ pytest ];
diff --git a/pkgs/development/python-modules/pytrends/default.nix b/pkgs/development/python-modules/pytrends/default.nix
index db7f781c5bf4..0b0bad801e12 100644
--- a/pkgs/development/python-modules/pytrends/default.nix
+++ b/pkgs/development/python-modules/pytrends/default.nix
@@ -8,11 +8,11 @@
 
 buildPythonPackage rec {
   pname = "pytrends";
-  version = "4.7.2";
+  version = "4.7.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1cf80573276b3a93c4fb2ff296c260fa86e7ab43709473ce34f3bad3841f06df";
+    sha256 = "8ccb06c57c31fa157b978a0d810de7718ee46583d28cf818250d45f36abd2faa";
   };
 
   doCheck = false;
diff --git a/pkgs/development/python-modules/readthedocs-sphinx-ext/default.nix b/pkgs/development/python-modules/readthedocs-sphinx-ext/default.nix
index efadd4337126..68ccf676f292 100644
--- a/pkgs/development/python-modules/readthedocs-sphinx-ext/default.nix
+++ b/pkgs/development/python-modules/readthedocs-sphinx-ext/default.nix
@@ -9,11 +9,11 @@
 
 buildPythonPackage rec {
   pname = "readthedocs-sphinx-ext";
-  version = "1.0.3";
+  version = "1.0.4";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "faccf1c52aab34b1fdfd672ec4ce4321975453b05741e32a94b33cc682d045b2";
+    sha256 = "33dbb135373d539233f7fbdb5e8dcfa07d41254300ee23719eb9caa8c68a40ae";
   };
 
   propagatedBuildInputs = [ requests ];
diff --git a/pkgs/development/python-modules/restructuredtext_lint/default.nix b/pkgs/development/python-modules/restructuredtext_lint/default.nix
index 4f62d232ab5e..17bf5fbf2974 100644
--- a/pkgs/development/python-modules/restructuredtext_lint/default.nix
+++ b/pkgs/development/python-modules/restructuredtext_lint/default.nix
@@ -8,11 +8,11 @@
 
 buildPythonPackage rec {
   pname = "restructuredtext_lint";
-  version = "1.3.0";
+  version = "1.3.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "97b3da356d5b3a8514d8f1f9098febd8b41463bed6a1d9f126cf0a048b6fd908";
+    sha256 = "470e53b64817211a42805c3a104d2216f6f5834b22fe7adb637d1de4d6501fb8";
   };
 
   checkInputs = [ nose testtools ];
diff --git a/pkgs/development/python-modules/rethinkdb/default.nix b/pkgs/development/python-modules/rethinkdb/default.nix
index fc33d7206e76..f1239b75d481 100644
--- a/pkgs/development/python-modules/rethinkdb/default.nix
+++ b/pkgs/development/python-modules/rethinkdb/default.nix
@@ -5,11 +5,11 @@
 
 buildPythonPackage rec {
   pname = "rethinkdb";
-  version = "2.4.6";
+  version = "2.4.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "4eb4252b498af3f5d01e07d7870eb35f78b96bccc45812d313c14c5184789d74";
+    sha256 = "945b5efdc10f468fc056bd53a4e4224ec4c2fe1a7e83ae47443bbb6e7c7a1f7d";
   };
 
   doCheck = false;
diff --git a/pkgs/development/python-modules/screeninfo/default.nix b/pkgs/development/python-modules/screeninfo/default.nix
new file mode 100644
index 000000000000..9ee04cb50a82
--- /dev/null
+++ b/pkgs/development/python-modules/screeninfo/default.nix
@@ -0,0 +1,35 @@
+{ stdenv, buildPythonApplication, fetchPypi, isPy36, dataclasses, libX11, libXinerama, libXrandr }:
+
+buildPythonApplication rec {
+  pname = "screeninfo";
+  version = "0.6.5";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "0vcw54crdgmbzwlrfg80kd1a8p9i10yks8k0szzi0k5q80zhp8xz";
+  };
+
+  # dataclasses is a compatibility shim for python 3.6 ONLY
+  patchPhase = if isPy36 then "" else ''
+    substituteInPlace setup.py \
+      --replace "\"dataclasses\"," ""
+  '' + ''
+    substituteInPlace screeninfo/enumerators/xinerama.py \
+      --replace "load_library(\"X11\")" "ctypes.cdll.LoadLibrary(\"${libX11}/lib/libX11.so\")" \
+      --replace "load_library(\"Xinerama\")" "ctypes.cdll.LoadLibrary(\"${libXinerama}/lib/libXinerama.so\")"
+    substituteInPlace screeninfo/enumerators/xrandr.py \
+      --replace "load_library(\"X11\")" "ctypes.cdll.LoadLibrary(\"${libX11}/lib/libX11.so\")" \
+      --replace "load_library(\"Xrandr\")" "ctypes.cdll.LoadLibrary(\"${libXrandr}/lib/libXrandr.so\")"
+  '';
+
+  propagatedBuildInputs = stdenv.lib.optional isPy36 dataclasses;
+
+  buildInputs = [ libX11 libXinerama libXrandr];
+
+  meta = with stdenv.lib; {
+    description = "Fetch location and size of physical screens";
+    homepage = "https://github.com/rr-/screeninfo";
+    license = licenses.mit;
+    maintainers = [ maintainers.nickhu ];
+  };
+}
diff --git a/pkgs/development/python-modules/setuptools-lint/default.nix b/pkgs/development/python-modules/setuptools-lint/default.nix
new file mode 100644
index 000000000000..fbe1528c4c3b
--- /dev/null
+++ b/pkgs/development/python-modules/setuptools-lint/default.nix
@@ -0,0 +1,21 @@
+{ stdenv, buildPythonPackage, fetchPypi, pylint }:
+
+buildPythonPackage rec {
+  pname = "setuptools-lint";
+  version = "0.6.0";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "16a1ac5n7k7sx15cnk03gw3fmslab3a7m74dc45rgpldgiff3577";
+  };
+
+  propagatedBuildInputs = [ pylint ];
+
+  meta = with stdenv.lib; {
+    description = "Package to expose pylint as a lint command into setup.py";
+    homepage = "https://github.com/johnnoone/setuptools-pylint";
+    license = licenses.bsdOriginal;
+    maintainers = with maintainers; [ nickhu ];
+  };
+}
+
diff --git a/pkgs/development/python-modules/snapcast/default.nix b/pkgs/development/python-modules/snapcast/default.nix
index 6e319a183418..93d7d1d9d9cf 100644
--- a/pkgs/development/python-modules/snapcast/default.nix
+++ b/pkgs/development/python-modules/snapcast/default.nix
@@ -3,13 +3,13 @@
 
 buildPythonPackage rec {
   pname = "snapcast";
-  version = "2.1.0";
+  version = "2.1.1";
 
   disabled = !isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1z3c9p22pm3823jzh917c3rryv02mhigrjkjf9wlhzmjwx5vmjqf";
+    sha256 = "c3ecd63d997fbcf6e5322dc47c1f02615f1d9611cba01ec18e9c9f8c14ed824b";
   };
 
   checkInputs = [ pytest ];
diff --git a/pkgs/development/python-modules/snowflake-connector-python/default.nix b/pkgs/development/python-modules/snowflake-connector-python/default.nix
index 0b14a97b647f..1d8389d80640 100644
--- a/pkgs/development/python-modules/snowflake-connector-python/default.nix
+++ b/pkgs/development/python-modules/snowflake-connector-python/default.nix
@@ -25,12 +25,12 @@
 
 buildPythonPackage rec {
   pname = "snowflake-connector-python";
-  version = "2.2.5";
+  version = "2.2.7";
   disabled = isPy27;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "2f720c4989b2ad92c1fc3c221f049102155f2d8006527daa15f2b54ecfdaf652";
+    sha256 = "84974778dd8d1efd4ff87d8404d71241f90e02044b1b94a52eea567080f93ac4";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/snscrape/default.nix b/pkgs/development/python-modules/snscrape/default.nix
index 9f0b805a19da..4370388959d0 100644
--- a/pkgs/development/python-modules/snscrape/default.nix
+++ b/pkgs/development/python-modules/snscrape/default.nix
@@ -11,13 +11,13 @@
 
 buildPythonPackage rec {
   pname = "snscrape";
-  version = "0.3.1";
+  version = "0.3.2";
 
   disabled = !isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "11jv5mv3l11qjlsjihd74gc1jafq0i7360cksqjkx1wv2hcc32rf";
+    sha256 = "ea038827afe439577eb109ebd1b5c481d516d489c624fc3fe6e92ec71ef42be9";
   };
 
   # There are no tests; make sure the executable works.
diff --git a/pkgs/development/python-modules/soupsieve/default.nix b/pkgs/development/python-modules/soupsieve/default.nix
index b8cdd63cbde5..bb5ecbc839c2 100644
--- a/pkgs/development/python-modules/soupsieve/default.nix
+++ b/pkgs/development/python-modules/soupsieve/default.nix
@@ -9,11 +9,11 @@
 
 buildPythonPackage rec {
   pname = "soupsieve";
-  version = "1.9.5";
+  version = "1.9.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "e2c1c5dee4a1c36bcb790e0fabd5492d874b8ebd4617622c4f6a731701060dda";
+    sha256 = "7985bacc98c34923a439967c1a602dc4f1e15f923b6fcf02344184f86cc7efaa";
   };
 
   checkPhase = ''
diff --git a/pkgs/development/python-modules/sphinxcontrib-katex/default.nix b/pkgs/development/python-modules/sphinxcontrib-katex/default.nix
index d3c9fe152806..95bd4b592010 100644
--- a/pkgs/development/python-modules/sphinxcontrib-katex/default.nix
+++ b/pkgs/development/python-modules/sphinxcontrib-katex/default.nix
@@ -2,7 +2,7 @@
 
 buildPythonPackage rec {
   pname = "sphinxcontrib-katex";
-  version = "0.6.0";
+  version = "0.6.1";
 
   # pkgutil namespaces are broken in nixpkgs (because they can't scan multiple
   # directories). But python2 is EOL, so not supporting it should be ok.
@@ -10,7 +10,7 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1692q3f3z1rsd3nyxd8wrv0vscwcq2gqjbv79c8ws402y3m7y5ni";
+    sha256 = "88320b2780f350d67f84a5424973ce24aee65701e8e163a7f5856c5df3353188";
   };
 
   propagatedBuildInputs = [ sphinx ];
diff --git a/pkgs/development/python-modules/sqlalchemy/default.nix b/pkgs/development/python-modules/sqlalchemy/default.nix
index 9be357fbed33..cd2b00021e7b 100644
--- a/pkgs/development/python-modules/sqlalchemy/default.nix
+++ b/pkgs/development/python-modules/sqlalchemy/default.nix
@@ -6,11 +6,11 @@
 
 buildPythonPackage rec {
   pname = "SQLAlchemy";
-  version = "1.3.16";
+  version = "1.3.17";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0w1xfy7j1h0dyfwk6zc6lfbv2m77lmxk7g17sbgpi08bq0kf293j";
+    sha256 = "156a27548ba4e1fed944ff9fcdc150633e61d350d673ae7baaf6c25c04ac1f71";
   };
 
   checkInputs = [
diff --git a/pkgs/development/python-modules/sqlmap/default.nix b/pkgs/development/python-modules/sqlmap/default.nix
index bc94ad50861a..81aede240eeb 100644
--- a/pkgs/development/python-modules/sqlmap/default.nix
+++ b/pkgs/development/python-modules/sqlmap/default.nix
@@ -7,11 +7,11 @@
 
 buildPythonPackage rec {
   pname = "sqlmap";
-  version = "1.4.5";
+  version = "1.4.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1ec0d320aca95be3ba53d1af0faefc047864dfe6328622ae10e33a6ed9446ca8";
+    sha256 = "0da3a6700a370fcd671265502c7c4aca39a1d055de9a1dcc8b9b751c9ad3efa8";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/stytra/default.nix b/pkgs/development/python-modules/stytra/default.nix
index 8a1154d66c88..9fba92ca12f7 100644
--- a/pkgs/development/python-modules/stytra/default.nix
+++ b/pkgs/development/python-modules/stytra/default.nix
@@ -30,12 +30,12 @@
 
 buildPythonPackage rec {
   pname = "stytra";
-  version = "0.8.27";
+  version = "0.8.33";
   disabled = !isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "8fc1ca5f75f47ec1eeb3d62722437bed4ddf598e130b3dd22f0e663f61857df5";
+    sha256 = "b0aacc8e2c1bba33c337ebc76c0d8f2971c113d298aea2a375d84a5eeff5d83e";
   };
   doCheck = false;
   checkInputs = [
diff --git a/pkgs/development/python-modules/toml/default.nix b/pkgs/development/python-modules/toml/default.nix
index 29d0a4c692f3..8e96efcdf444 100644
--- a/pkgs/development/python-modules/toml/default.nix
+++ b/pkgs/development/python-modules/toml/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "toml";
-  version = "0.10.0";
+  version = "0.10.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0p1xww2mzkhqvxkfvmfzm58bbfj812zhdz4rwdjiv94ifz2q37r2";
+    sha256 = "926b612be1e5ce0634a2ca03470f95169cf16f939018233a670519cb4ac58b0f";
   };
 
   # This package has a test script (built for Travis) that involves a)
diff --git a/pkgs/development/python-modules/tqdm/default.nix b/pkgs/development/python-modules/tqdm/default.nix
index af72dc6b8a5f..138c24ebbe3c 100644
--- a/pkgs/development/python-modules/tqdm/default.nix
+++ b/pkgs/development/python-modules/tqdm/default.nix
@@ -9,11 +9,11 @@
 
 buildPythonPackage rec {
   pname = "tqdm";
-  version = "4.46.0";
+  version = "4.46.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "4733c4a10d0f2a4d098d801464bdaf5240c7dadd2a7fde4ee93b0a0efd9fb25e";
+    sha256 = "cd140979c2bebd2311dfb14781d8f19bd5a9debb92dcab9f6ef899c987fcf71f";
   };
 
   checkInputs = [ nose coverage glibcLocales flake8 ];
diff --git a/pkgs/development/python-modules/trimesh/default.nix b/pkgs/development/python-modules/trimesh/default.nix
index be135f651213..c6d1ba00a850 100644
--- a/pkgs/development/python-modules/trimesh/default.nix
+++ b/pkgs/development/python-modules/trimesh/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "trimesh";
-  version = "3.6.38";
+  version = "3.6.43";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0rdffk6a1jlfanb4i0prvy68qya8waa390yyw2kix4ja8fk7y6sx";
+    sha256 = "f62dbaf4739858148fe4889f3b4dff93da281982b6592f211c4d33c2e00678eb";
   };
 
   propagatedBuildInputs = [ numpy ];
diff --git a/pkgs/development/python-modules/txdbus/default.nix b/pkgs/development/python-modules/txdbus/default.nix
index 0fbe4900f9e5..8ef694d34ff2 100644
--- a/pkgs/development/python-modules/txdbus/default.nix
+++ b/pkgs/development/python-modules/txdbus/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "txdbus";
-  version = "1.1.0";
+  version = "1.1.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0z41n1ikpdvk0nm8dbyh6g9bg781q4j6hg2b09b5k4wdqm17zxbg";
+    sha256 = "eefcffa4efbf82ba11222f17f5989fe1b2b6ef57226ef896c4a7084c990ba217";
   };
 
   propagatedBuildInputs = [ six twisted ];
diff --git a/pkgs/development/python-modules/uproot/default.nix b/pkgs/development/python-modules/uproot/default.nix
index 55c215ac75a3..3d472a604d64 100644
--- a/pkgs/development/python-modules/uproot/default.nix
+++ b/pkgs/development/python-modules/uproot/default.nix
@@ -16,11 +16,11 @@
 
 buildPythonPackage rec {
   pname = "uproot";
-  version = "3.11.5";
+  version = "3.11.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "05bb55d0576813bb7bf252654cf854fcbabe34e30eb99beb70eff6abc4d3f121";
+    sha256 = "3fbf9dfe5ce996ffda3a49d16eba804b95fb05bc041fc4e7bc05317a03bf6cba";
   };
 
   nativeBuildInputs = [ pytestrunner ];
diff --git a/pkgs/development/python-modules/vertica-python/default.nix b/pkgs/development/python-modules/vertica-python/default.nix
index cfbfcde6fd50..8beb39b26d9e 100644
--- a/pkgs/development/python-modules/vertica-python/default.nix
+++ b/pkgs/development/python-modules/vertica-python/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "vertica-python";
-  version = "0.10.3";
+  version = "0.10.4";
   
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0de23c0a09f0d849db626569207d52d324ffd51c69b4f7f3650f167c3c2c9de9";
+    sha256 = "570525d0371806993874bd2ee0f47cc5d68994abb5aa382e964e53e0b81160b2";
   };
   
   propagatedBuildInputs = [ future dateutil six ];
diff --git a/pkgs/development/python-modules/zeroc-ice/default.nix b/pkgs/development/python-modules/zeroc-ice/default.nix
index ccc34b42afb4..16bf5b7855c5 100644
--- a/pkgs/development/python-modules/zeroc-ice/default.nix
+++ b/pkgs/development/python-modules/zeroc-ice/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "zeroc-ice";
-  version = "3.7.3";
+  version = "3.7.4";
 
   src = fetchPypi {
     inherit version pname;
-    sha256 = "1adec3b54c77c46acfc8a99d6336ce9a0223a7016852666358133cbe37d99744";
+    sha256 = "dc79a1eaad1d1cd1cf8cfe636e1bc413c60645e3e87a5a8e9b97ce882690e0e4";
   };
 
   buildInputs = [ openssl bzip2 ];
diff --git a/pkgs/development/python-modules/zeroconf/default.nix b/pkgs/development/python-modules/zeroconf/default.nix
index d293ae449c1d..e9d3c6e038ea 100644
--- a/pkgs/development/python-modules/zeroconf/default.nix
+++ b/pkgs/development/python-modules/zeroconf/default.nix
@@ -10,12 +10,12 @@
 
 buildPythonPackage rec {
   pname = "zeroconf";
-  version = "0.26.1";
+  version = "0.26.3";
   disabled = isPy27;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "09rvliph7phvgzwmmdv1kwcp3andpiiqfpkrwq1vkxvwqa3mgwji";
+    sha256 = "43ad5006c00be2040cdca1fe768206f4a25356d3cc87eff8b66bd7ead2a82440";
   };
 
   propagatedBuildInputs = [ ifaddr ]
diff --git a/pkgs/development/python-modules/zope_interface/default.nix b/pkgs/development/python-modules/zope_interface/default.nix
index 9214c0badf0a..5e7086191cce 100644
--- a/pkgs/development/python-modules/zope_interface/default.nix
+++ b/pkgs/development/python-modules/zope_interface/default.nix
@@ -6,15 +6,17 @@
 
 buildPythonPackage rec {
   pname = "zope.interface";
-  version = "4.7.2";
-  
+  version = "5.1.0";
+
   src = fetchPypi {
     inherit pname version;
-    sha256 = "fd1101bd3fcb4f4cf3485bb20d6cb0b56909b94d3bd2a53a6cb9d381c3da3365";
+    sha256 = "03nrl6b8cb600dnnh46y149awvrm0gxyqgwq5hdw3lvys8mw9r20";
   };
 
   propagatedBuildInputs = [ zope_event ];
 
+  doCheck = false; # Circular deps.
+
   meta = with stdenv.lib; {
     description = "Zope.Interface";
     homepage = "http://zope.org/Products/ZopeInterface";
diff --git a/pkgs/development/python-modules/zstd/default.nix b/pkgs/development/python-modules/zstd/default.nix
index c96e08ccb513..8f61f2ffc66e 100644
--- a/pkgs/development/python-modules/zstd/default.nix
+++ b/pkgs/development/python-modules/zstd/default.nix
@@ -3,11 +3,11 @@
 
 buildPythonPackage rec {
   pname = "zstd";
-  version = "1.4.4.0";
+  version = "1.4.5.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "33f2c1fd8d3f9ac8e35fb3e199896afc54cceb68878570c6d4b72985dc6584a5";
+    sha256 = "2a1806d625bd2d8944ead4b3018fc6444a31467fa09935e9c1d4296275f024c6";
   };
 
   postPatch = ''
diff --git a/pkgs/development/tools/analysis/flow/default.nix b/pkgs/development/tools/analysis/flow/default.nix
index 8df10222a88e..aed991dab30a 100644
--- a/pkgs/development/tools/analysis/flow/default.nix
+++ b/pkgs/development/tools/analysis/flow/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "flow";
-  version = "0.126.1";
+  version = "0.127.0";
 
   src = fetchFromGitHub {
     owner  = "facebook";
     repo   = "flow";
     rev    = "refs/tags/v${version}";
-    sha256 = "1acmhyhbl4s2c907nj8jwgg9fjjrfr306vagwkcx2lza4clb2aan";
+    sha256 = "0daacbb4il3mm8fkbk5qlpvzp3pmrqagq2hr1gsjaf8vnmissvvm";
   };
 
   installPhase = ''
diff --git a/pkgs/development/tools/analysis/tfsec/default.nix b/pkgs/development/tools/analysis/tfsec/default.nix
index 49009570e57b..251162efd8f7 100644
--- a/pkgs/development/tools/analysis/tfsec/default.nix
+++ b/pkgs/development/tools/analysis/tfsec/default.nix
@@ -2,13 +2,13 @@
 
 buildGoPackage rec {
   pname = "tfsec";
-  version = "0.19.0";
+  version = "0.21.0";
 
   src = fetchFromGitHub {
     owner = "liamg";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1ddyvkv0949p0b6m1rwai5r87mca5xwyjwsjq7gbyqz9h10bv7nf";
+    sha256 = "0mmh161zwrkjwpw01zcgh7hsap7lgdxhg191bajzig6vlq287jyh";
   };
 
   goPackagePath = "github.com/liamg/tfsec";
diff --git a/pkgs/development/tools/cloudfoundry-cli/default.nix b/pkgs/development/tools/cloudfoundry-cli/default.nix
index 1fa45a32c05f..9d0c1ab92ff4 100644
--- a/pkgs/development/tools/cloudfoundry-cli/default.nix
+++ b/pkgs/development/tools/cloudfoundry-cli/default.nix
@@ -2,7 +2,7 @@
 
 buildGoPackage rec {
   pname = "cloudfoundry-cli";
-  version = "6.46.1";
+  version = "6.51.0";
 
   goPackagePath = "code.cloudfoundry.org/cli";
 
@@ -12,7 +12,7 @@ buildGoPackage rec {
     owner = "cloudfoundry";
     repo = "cli";
     rev = "v${version}";
-    sha256 = "0dqrkimwhw016icgyf4cyipzy6vdz5jgickm33xxd9018dh3ibwq";
+    sha256 = "189cqng7y12knqm4n1bfajbc2lx027rwb44wddmj5iya27i7fv8f";
   };
 
   nativeBuildInputs = [ installShellFiles ];
diff --git a/pkgs/development/tools/continuous-integration/buildkite-cli/default.nix b/pkgs/development/tools/continuous-integration/buildkite-cli/default.nix
new file mode 100644
index 000000000000..06d69c152bad
--- /dev/null
+++ b/pkgs/development/tools/continuous-integration/buildkite-cli/default.nix
@@ -0,0 +1,26 @@
+{ lib, buildGoModule, fetchFromGitHub }:
+
+buildGoModule rec {
+  pname = "buildkite-cli";
+  version = "1.1.0";
+
+  src = fetchFromGitHub {
+    owner = "buildkite";
+    repo = "cli";
+    rev = "v${version}";
+    sha256 = "05hz59qzadkk4ji5icv5sxih31pnn0abnmiwcyfa2mr3l5jaqjnd";
+  };
+
+  vendorSha256 = "0jxh3yhh0sdvaykhinxngpipk369hw8z1y3g2z4c1115m5rjp2bb";
+
+  subPackages = [ "cmd/bk" ];
+
+  buildFlagsArray = [ "-ldflags=-s -w -X main.VERSION=${version}" ];
+
+  meta = with lib; {
+    description = "A command line interface for Buildkite";
+    homepage = "https://github.com/buildkite/cli";
+    license = licenses.mit;
+    maintainers = with maintainers; [ groodt ];
+  };
+}
diff --git a/pkgs/development/tools/continuous-integration/fly/default.nix b/pkgs/development/tools/continuous-integration/fly/default.nix
index 3bf48084bbd8..bdad33dee742 100644
--- a/pkgs/development/tools/continuous-integration/fly/default.nix
+++ b/pkgs/development/tools/continuous-integration/fly/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "fly";
-  version = "6.1.0";
+  version = "6.3.0";
 
   src = fetchFromGitHub {
     owner = "concourse";
     repo = "concourse";
     rev = "v${version}";
-    sha256 = "14sm3xwhm6pfln18i9f9dyj7s2wcri43rxj4s1cja7nwqr5sqb3x";
+    sha256 = "006qkg661hzbc2gpcnpxm09bp1kbb98y0bgdr49bjlnapcmdgr1b";
   };
 
-  vendorSha256 = "1c099sn5rrvj805va1lyjlbv7i2g1z5bxyaisv5l9365z0lv1cwm";
+  vendorSha256 = "03az7l9rf2syw837zliny82xhkqlad16z0vfcg5h21m3bhz6v6jy";
 
   subPackages = [ "fly" ];
 
diff --git a/pkgs/development/tools/dapper/default.nix b/pkgs/development/tools/dapper/default.nix
index d5c7d309e98d..c2dadeb6a933 100644
--- a/pkgs/development/tools/dapper/default.nix
+++ b/pkgs/development/tools/dapper/default.nix
@@ -5,7 +5,7 @@
 
 buildGoPackage rec {
   pname = "dapper";
-  version = "0.4.1";
+  version = "0.5.1";
 
   goPackagePath = "github.com/rancher/dapper";
 
@@ -13,7 +13,7 @@ buildGoPackage rec {
     owner = "rancher";
     repo = "dapper";
     rev = "v${version}";
-    sha256 = "03rmkmlvhmfwcln5v1rqww1kirxm0d1p58h6pj8f5fnhk9spb162";
+    sha256 = "0sf56ii4sn2wdq5kiyl02sgvq0lvynzgiq8v5wrkkabj5107fiqw";
   };
    patchPhase = ''
      substituteInPlace main.go --replace 0.0.0 ${version}
diff --git a/pkgs/development/tools/delve/default.nix b/pkgs/development/tools/delve/default.nix
index 33eda13b6044..b990fe10b05c 100644
--- a/pkgs/development/tools/delve/default.nix
+++ b/pkgs/development/tools/delve/default.nix
@@ -2,7 +2,7 @@
 
 buildGoPackage rec {
   pname = "delve";
-  version = "1.2.0";
+  version = "1.4.1";
 
   goPackagePath = "github.com/go-delve/delve";
   excludedPackages = "\\(_fixtures\\|scripts\\|service/test\\)";
@@ -11,7 +11,7 @@ buildGoPackage rec {
     owner = "go-delve";
     repo = "delve";
     rev = "v${version}";
-    sha256 = "1xz1xm0lb1arwm3w2ydq5y5xglq60fc0q46x9xndr3i9j0rm8bxh";
+    sha256 = "007bc69r26w0sv6v9mbjdnmnkahpfk5998isx81ma7cinqdhi1cj";
   };
 
   meta = with stdenv.lib; {
diff --git a/pkgs/development/tools/doctl/default.nix b/pkgs/development/tools/doctl/default.nix
index 5fe7ca69b036..e65fb4a64b73 100644
--- a/pkgs/development/tools/doctl/default.nix
+++ b/pkgs/development/tools/doctl/default.nix
@@ -2,7 +2,7 @@
 
 buildGoModule rec {
   pname = "doctl";
-  version = "1.45.0";
+  version = "1.45.1";
 
   vendorSha256 = null;
 
@@ -30,7 +30,7 @@ buildGoModule rec {
     owner = "digitalocean";
     repo = "doctl";
     rev = "v${version}";
-    sha256 = "1wnrvswysms8p26d8hnxpimx12bhi3sa9k4kwd2dbxg74569gq6d";
+    sha256 = "1zzdjpbag23kr6j3c7zkgqaavlna1q792qhs6s234vxm85zmwh4j";
   };
 
   meta = with lib; {
diff --git a/pkgs/development/tools/gauge/default.nix b/pkgs/development/tools/gauge/default.nix
index c9df63cabb78..c9a462f1832e 100644
--- a/pkgs/development/tools/gauge/default.nix
+++ b/pkgs/development/tools/gauge/default.nix
@@ -2,7 +2,7 @@
 
 buildGoPackage rec {
   pname = "gauge";
-  version = "1.0.4";
+  version = "1.1.1";
 
   goPackagePath = "github.com/getgauge/gauge";
   excludedPackages = ''\(build\|man\)'';
@@ -11,7 +11,7 @@ buildGoPackage rec {
     owner = "getgauge";
     repo = "gauge";
     rev = "v${version}";
-    sha256 = "1b52kpv5561pyjvqi8xmidarqp6lcyyy4sjsl4qjx4cr7hmk8kc7";
+    sha256 = "01x4838jljhhhcwfh6zbhy3g7l7nqvypv3g0ch9n2amsf2s16s3l";
   };
 
   meta = with stdenv.lib; {
diff --git a/pkgs/development/tools/lazygit/default.nix b/pkgs/development/tools/lazygit/default.nix
index d08c9057c0fe..c3ae1eb30e87 100644
--- a/pkgs/development/tools/lazygit/default.nix
+++ b/pkgs/development/tools/lazygit/default.nix
@@ -2,7 +2,7 @@
 
 buildGoPackage rec {
   pname = "lazygit";
-  version = "0.20.3";
+  version = "0.20.4";
 
   goPackagePath = "github.com/jesseduffield/lazygit";
 
@@ -12,7 +12,7 @@ buildGoPackage rec {
     owner = "jesseduffield";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1p05lfm74g28ci5575vr22q5db50h19fcvc3lzddp0vyiw570isl";
+    sha256 = "134f04ybzgghm7ghyxair111aflmkjrbfj0bkxfp1w0a3jm6sfsk";
   };
 
   meta = with stdenv.lib; {
diff --git a/pkgs/development/tools/misc/autogen/default.nix b/pkgs/development/tools/misc/autogen/default.nix
index 65c4f3174051..3e634bedfd19 100644
--- a/pkgs/development/tools/misc/autogen/default.nix
+++ b/pkgs/development/tools/misc/autogen/default.nix
@@ -1,34 +1,39 @@
-{ stdenv, buildPackages, fetchurl, which, pkgconfig, perl, guile, libxml2 }:
+{ stdenv, buildPackages, fetchurl, autoreconfHook, which, pkgconfig, perl, guile, libxml2 }:
 
 stdenv.mkDerivation rec {
   pname = "autogen";
-  version = "5.18.12";
+  version = "5.18.16";
 
   src = fetchurl {
     url = "mirror://gnu/autogen/rel${version}/autogen-${version}.tar.xz";
-    sha256 = "1n5zq4872sakvz9c7ncsdcfp0z8rsybsxvbmhkpbd19ii0pacfxy";
+    sha256 = "16mlbdys8q4ckxlvxyhwkdnh1ay9f6g0cyp1kylkpalgnik398gq";
   };
 
-  outputs = [ "bin" "dev" "lib" "out" "man" "info" ];
-
-  patches = [
-    # Temporary, so builds with a prefixed pkg-config (like cross builds) work.
-    #
-    # https://savannah.gnu.org/support/?109050 was supposed to fix this, but
-    # the generated configure script mysteriously still contained hard-coded
-    # pkg-config. I tried regenerating it, but that didn't help. Only
-    # https://git.savannah.gnu.org/cgit/autogen.git/commit/?h=5cbe233387d7f7b36752736338d1cd4f71287daa,
-    # in the next release, finally fixes this, by getting rid of some
-    # metaprogramming of the autoconf m4 metaprogram! There evidentally was
-    # some sort escaping error such that the `PKG_CONFIG` check got evaluated
-    # before `configure` was generated.
-    #
-    # Remove this when the version is bumped
-    ./pkg-config-use-var.patch
+  patches = let
+    dp = { ver ? "1%255.18.16-4", pname, name ? (pname + ".diff"), sha256 }: fetchurl {
+      url = "https://salsa.debian.org/debian/autogen/-/raw/debian/${ver}"
+          + "/debian/patches/${pname}.diff?inline=false";
+      inherit name sha256;
+    };
+  in [
+    (dp {
+      pname = "20_no_Werror";
+      sha256 = "08z4s2ifiqyaacjpd9pzr59w8m4j3548kkaq1bwvp2gjn29m680x";
+    })
+    (dp {
+      pname = "30_ag_macros.m4_syntax_error";
+      sha256 = "1z8vmbwbkz3505wd33i2xx91mlf8rwsa7klndq37nw821skxwyh3";
+    })
+    (dp {
+      pname = "31_allow_overriding_AGexe_for_crossbuild";
+      sha256 = "0h9wkc9bqb509knh8mymi43hg6n6sxg2lixvjlchcx7z0j7p8xkf";
+    })
   ];
 
+  outputs = [ "bin" "dev" "lib" "out" "man" "info" ];
+
   nativeBuildInputs = [
-    which pkgconfig perl
+    which pkgconfig perl autoreconfHook/*patches applied*/
   ] ++ stdenv.lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
     # autogen needs a build autogen when cross-compiling
     buildPackages.buildPackages.autogen buildPackages.texinfo
@@ -45,13 +50,7 @@ stdenv.mkDerivation rec {
     #"MAKEINFO=${buildPackages.texinfo}/bin/makeinfo"
   ];
 
-  postPatch = ''
-    # Fix a broken sed expression used for detecting the minor
-    # version of guile we are using
-    sed -i "s,sed '.*-I.*',sed 's/\\\(^\\\| \\\)-I/\\\1/g',g" configure
-
-    substituteInPlace pkg/libopts/mklibsrc.sh --replace /tmp $TMPDIR
-  '';
+  #doCheck = true; # not reliable
 
   postInstall = ''
     mkdir -p $dev/bin
@@ -62,9 +61,14 @@ stdenv.mkDerivation rec {
       sed -e "s|$bin/bin|/no-such-autogen-bin-path|" -i $f
       sed -e "s|$lib/lib|/no-such-autogen-lib-path|" -i $f
     done
-  '';
 
-  #doCheck = true; # 2 tests fail because of missing /dev/tty
+  '' + stdenv.lib.optionalString (!stdenv.hostPlatform.isDarwin) ''
+    # remove /build/** from RPATHs
+    for f in "$bin"/bin/*; do
+      local nrp="$(patchelf --print-rpath "$f" | sed -E 's@(:|^)/build/[^:]*:@\1@g')"
+      patchelf --set-rpath "$nrp" "$f"
+    done
+  '';
 
   meta = with stdenv.lib; {
     description = "Automated text and program generation tool";
diff --git a/pkgs/development/tools/misc/autogen/pkg-config-use-var.patch b/pkgs/development/tools/misc/autogen/pkg-config-use-var.patch
deleted file mode 100644
index 69476f62c6db..000000000000
--- a/pkgs/development/tools/misc/autogen/pkg-config-use-var.patch
+++ /dev/null
@@ -1,13 +0,0 @@
-diff --git a/configure b/configure
-index c3f761d1c3f..14b101f67c1
---- a/configure
-+++ b/configure
-@@ -16683,7 +16683,7 @@ fi
- 
- 
- 
--  ag_gv=`gdir=\`pkg-config --cflags-only-I \
-+  ag_gv=`gdir=\`${PKG_CONFIG} --cflags-only-I \
-   guile-${GUILE_EFFECTIVE_VERSION} | \
-   sed 's/\(^\| \)-I/\1/g'\`
-   for d in $gdir
diff --git a/pkgs/development/tools/misc/circleci-cli/default.nix b/pkgs/development/tools/misc/circleci-cli/default.nix
index 7144c2bd0ae5..8c87e1642df3 100644
--- a/pkgs/development/tools/misc/circleci-cli/default.nix
+++ b/pkgs/development/tools/misc/circleci-cli/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "circleci-cli";
-  version = "0.1.7868";
+  version = "0.1.7971";
 
   src = fetchFromGitHub {
     owner = "CircleCI-Public";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1a9gnqrkvifrwr8wpv5f6zv8xs8myzbzlhn5w72xxzh2gxdaflwg";
+    sha256 = "0nrmdql3h9jnfgmp8898c9v07f5h5r9dvabaqhk98r6a77g3rr98";
   };
 
   vendorSha256 = "0y35ps2pw9z7gi4z50byd1py87bf2jdvj7l7w2gxpppmhi83myc9";
diff --git a/pkgs/development/tools/misc/cquery/default.nix b/pkgs/development/tools/misc/cquery/default.nix
deleted file mode 100644
index 33a8bf1df61d..000000000000
--- a/pkgs/development/tools/misc/cquery/default.nix
+++ /dev/null
@@ -1,64 +0,0 @@
-{ fetchFromGitHub, makeWrapper
-, cmake, llvmPackages, ncurses
-, runtimeShell }:
-
-let
-  src = fetchFromGitHub {
-    owner = "cquery-project";
-    repo = "cquery";
-    rev = "a95a6503d68a85baa25465ce147b7fc20f4a552e";
-    sha256 = "0rxbdln7dqkdw4q8rhclssgwypq16g9flkwmaabsr8knckbszxrx";
-    fetchSubmodules = true;
-  };
-
-  stdenv = llvmPackages.stdenv;
-
-in
-stdenv.mkDerivation {
-  pname = "cquery";
-  version = "2018-10-14";
-
-  inherit src;
-
-  nativeBuildInputs = [ cmake makeWrapper ];
-  buildInputs = with llvmPackages; [ clang clang-unwrapped llvm ncurses ];
-
-  cmakeFlags = [
-    "-DSYSTEM_CLANG=ON"
-    "-DCLANG_CXX=ON"
-  ];
-
-  shell = runtimeShell;
-  postFixup = ''
-    # We need to tell cquery where to find the standard library headers.
-
-    standard_library_includes="\\\"-isystem\\\", \\\"${stdenv.lib.getDev stdenv.cc.libc}/include\\\""
-    standard_library_includes+=", \\\"-isystem\\\", \\\"${llvmPackages.libcxx}/include/c++/v1\\\""
-    export standard_library_includes
-
-    wrapped=".cquery-wrapped"
-    export wrapped
-
-    mv $out/bin/cquery $out/bin/$wrapped
-    substituteAll ${./wrapper} $out/bin/cquery
-    chmod --reference=$out/bin/$wrapped $out/bin/cquery
-  '';
-
-  doInstallCheck = true;
-  installCheckPhase = ''
-    pushd ${src}
-    $out/bin/cquery --ci --test-unit
-
-    # The integration tests have to be disabled because cquery ignores `--init`
-    # if they are invoked, which means it won't find the system includes.
-    #$out/bin/cquery --ci --test-index
-  '';
-
-  meta = with stdenv.lib; {
-    description = "A c/c++ language server powered by libclang";
-    homepage    = "https://github.com/cquery-project/cquery";
-    license     = licenses.mit;
-    platforms   = platforms.linux ++ platforms.darwin;
-    maintainers = [ maintainers.tobim ];
-  };
-}
diff --git a/pkgs/development/tools/misc/cquery/wrapper b/pkgs/development/tools/misc/cquery/wrapper
deleted file mode 100644
index 8b3e57290429..000000000000
--- a/pkgs/development/tools/misc/cquery/wrapper
+++ /dev/null
@@ -1,12 +0,0 @@
-#! @shell@ -e
-
-initString="--init={\"cacheDirectory\": \"/tmp/cquery\", \"extraClangArguments\": [@standard_library_includes@"
-
-if [ "${NIX_CFLAGS_COMPILE}" != "" ]; then
-  read -a cflags_array <<< ${NIX_CFLAGS_COMPILE}
-  initString+=$(printf ', \"%s\"' "${cflags_array[@]}")
-fi
-
-initString+="]}"
-
-exec -a "$0" "@out@/bin/@wrapped@" "${initString}" "$@"
diff --git a/pkgs/development/tools/misc/gdb/default.nix b/pkgs/development/tools/misc/gdb/default.nix
index f6a001e488c3..7702df423bb5 100644
--- a/pkgs/development/tools/misc/gdb/default.nix
+++ b/pkgs/development/tools/misc/gdb/default.nix
@@ -18,7 +18,7 @@
 
 let
   basename = "gdb-${version}";
-  version = "9.1";
+  version = "9.2";
 in
 
 assert pythonSupport -> python3 != null;
@@ -31,7 +31,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://gnu/gdb/${basename}.tar.xz";
-    sha256 = "0dqp1p7w836iwijg1zb4a784n0j4pyjiw5v6h8fg5lpx6b40x7k9";
+    sha256 = "0mf5fn8v937qwnal4ykn3ji1y2sxk0fa1yfqi679hxmpg6pdf31n";
   };
 
   postPatch = if stdenv.isDarwin then ''
diff --git a/pkgs/development/tools/misc/libtool/libtool2.nix b/pkgs/development/tools/misc/libtool/libtool2.nix
index 4bf637c0eba8..fbe49dc68b2a 100644
--- a/pkgs/development/tools/misc/libtool/libtool2.nix
+++ b/pkgs/development/tools/misc/libtool/libtool2.nix
@@ -26,10 +26,6 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  # Don't run the native `strip' when cross-compiling.  This breaks at least
-  # with `.a' files for MinGW.
-  dontStrip = stdenv.hostPlatform != stdenv.buildPlatform;
-
   meta = with stdenv.lib; {
     description = "GNU Libtool, a generic library support script";
     longDescription = ''
diff --git a/pkgs/development/tools/misc/pkgconf/default.nix b/pkgs/development/tools/misc/pkgconf/default.nix
index 153257c85ae1..6fca02ad788b 100644
--- a/pkgs/development/tools/misc/pkgconf/default.nix
+++ b/pkgs/development/tools/misc/pkgconf/default.nix
@@ -2,7 +2,7 @@
 
 stdenv.mkDerivation rec {
   pname = "pkgconf";
-  version = "1.7.0";
+  version = "1.7.3";
 
   nativeBuildInputs = [ removeReferencesTo ];
 
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://distfiles.dereferenced.org/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "0sb1a2lgiqaninv5s3zq09ilrkpsamcl68dyhqyz7yi9vsgb0vhy";
+    sha256 = "1h7rf5cch0cbxp8nmjkkf272zrz2jgpqpr8a58ww75pn3jjswimq";
   };
 
   # Debian has outputs like these too:
diff --git a/pkgs/development/tools/ocaml/js_of_ocaml/3.0.nix b/pkgs/development/tools/ocaml/js_of_ocaml/3.0.nix
deleted file mode 100644
index 9ca6ca67421f..000000000000
--- a/pkgs/development/tools/ocaml/js_of_ocaml/3.0.nix
+++ /dev/null
@@ -1,18 +0,0 @@
-{ stdenv, ocaml, findlib, dune, js_of_ocaml-compiler
-, ocaml-migrate-parsetree, ppx_tools_versioned, uchar
-}:
-
-stdenv.mkDerivation {
-  pname = "js_of_ocaml"; 
-
-  inherit (js_of_ocaml-compiler) version src installPhase meta;
-
-  buildInputs = [ findlib ocaml-migrate-parsetree ppx_tools_versioned ];
-  nativeBuildInputs = [ ocaml findlib dune ];
-
-  postPatch = "patchShebangs lib/generate_stubs.sh";
-
-	propagatedBuildInputs = [ js_of_ocaml-compiler uchar ];
-
-	buildPhase = "dune build -p js_of_ocaml";
-}
diff --git a/pkgs/development/tools/ocaml/js_of_ocaml/default.nix b/pkgs/development/tools/ocaml/js_of_ocaml/default.nix
index 7f6426c9610d..9ca6ca67421f 100644
--- a/pkgs/development/tools/ocaml/js_of_ocaml/default.nix
+++ b/pkgs/development/tools/ocaml/js_of_ocaml/default.nix
@@ -1,40 +1,18 @@
-{ stdenv, fetchurl, ocaml, findlib, lwt, menhir, ocsigen_deriving, ppx_deriving, camlp4, ocamlbuild
-, cmdliner, tyxml, reactivedata, cppo, which, base64, uchar, yojson
+{ stdenv, ocaml, findlib, dune, js_of_ocaml-compiler
+, ocaml-migrate-parsetree, ppx_tools_versioned, uchar
 }:
 
-let version = if stdenv.lib.versionAtLeast ocaml.version "4.02"
-  then "2.8.4" else "2.7";
-in
-
 stdenv.mkDerivation {
-  pname = "js_of_ocaml";
-  inherit version;
-  src = fetchurl {
-    url = "https://github.com/ocsigen/js_of_ocaml/archive/${version}.tar.gz";
-    sha256 = {
-      "2.7" = "1dali1akyd4zmkwav0d957ynxq2jj6cc94r4xiaql7ca89ajz4jj";
-      "2.8.4" = "098ph50s9kqw6rc3qjn39zv9b5swdf4qr44afwqfkkjgjs5d7vbl";
-    }.${version};
-  };
+  pname = "js_of_ocaml"; 
+
+  inherit (js_of_ocaml-compiler) version src installPhase meta;
 
-  buildInputs = [ ocaml findlib menhir ocsigen_deriving ocamlbuild
-                 cmdliner reactivedata cppo which base64 ]
-  ++ stdenv.lib.optionals (stdenv.lib.versionAtLeast ocaml.version "4.02") [ yojson tyxml ];
-  propagatedBuildInputs = [ lwt camlp4 ppx_deriving ]
-  ++ stdenv.lib.optional (version == "2.8.4") uchar;
+  buildInputs = [ findlib ocaml-migrate-parsetree ppx_tools_versioned ];
+  nativeBuildInputs = [ ocaml findlib dune ];
 
-  patches = [ ./Makefile.conf.diff ];
+  postPatch = "patchShebangs lib/generate_stubs.sh";
 
-  createFindlibDestdir = true;
+	propagatedBuildInputs = [ js_of_ocaml-compiler uchar ];
 
-  meta = with stdenv.lib; {
-    homepage = "http://ocsigen.org/js_of_ocaml/";
-    description = "Compiler of OCaml bytecode to Javascript. It makes it possible to run Ocaml programs in a Web browser";
-    license = licenses.lgpl2;
-    platforms = ocaml.meta.platforms or [];
-    maintainers = [
-      maintainers.gal_bolle
-    ];
-    broken = versionAtLeast ocaml.version "4.05";
-  };
+	buildPhase = "dune build -p js_of_ocaml";
 }
diff --git a/pkgs/development/tools/rust/rust-analyzer/generic.nix b/pkgs/development/tools/rust/rust-analyzer/generic.nix
index de755ec17ff5..ae6ad80cdd9a 100644
--- a/pkgs/development/tools/rust/rust-analyzer/generic.nix
+++ b/pkgs/development/tools/rust/rust-analyzer/generic.nix
@@ -15,9 +15,7 @@ rustPlatform.buildRustPackage {
     inherit rev sha256;
   };
 
-  preBuild = "pushd crates/rust-analyzer";
-  # Do not checking other crates in checkPhase.
-  preInstall = "popd";
+  buildAndTestSubdir = "crates/rust-analyzer";
 
   cargoBuildFlags = lib.optional useJemalloc "--features=jemalloc";
 
diff --git a/pkgs/development/tools/skaffold/default.nix b/pkgs/development/tools/skaffold/default.nix
index 2d87c490452b..e104784fbe8f 100644
--- a/pkgs/development/tools/skaffold/default.nix
+++ b/pkgs/development/tools/skaffold/default.nix
@@ -2,7 +2,7 @@
 
 buildGoPackage rec {
   pname = "skaffold";
-  version = "1.10.1";
+  version = "1.11.0";
   # rev is the ${version} commit, mainly for skaffold version command output
   rev = "931a70a6334436735bfc4ff7633232dd5fc73cc1";
 
@@ -20,7 +20,7 @@ buildGoPackage rec {
     owner = "GoogleContainerTools";
     repo = "skaffold";
     rev = "v${version}";
-    sha256 = "1qi4b0304jjpv5npa5yfrrfg7yv5p838qqql3sgx4f47ysyyq0as";
+    sha256 = "035xp34m8kzb75mivgf3kw026n2h6g2a7j2mi32nxl1a794w36zi";
   };
 
   nativeBuildInputs = [ installShellFiles ];
diff --git a/pkgs/games/steam/runtime.nix b/pkgs/games/steam/runtime.nix
index 44d80c0d7948..6d81d6c775e2 100644
--- a/pkgs/games/steam/runtime.nix
+++ b/pkgs/games/steam/runtime.nix
@@ -1,4 +1,4 @@
-{ stdenv, steamArch, fetchurl, }:
+{ stdenv, fetchurl }:
 
 stdenv.mkDerivation rec {
 
@@ -6,20 +6,15 @@ stdenv.mkDerivation rec {
   # from https://repo.steampowered.com/steamrt-images-scout/snapshots/
   version = "0.20200417.0";
 
-  src =
-    if steamArch == "amd64" then fetchurl {
-      url = "https://repo.steampowered.com/steamrt-images-scout/snapshots/${version}/com.valvesoftware.SteamRuntime.Platform-amd64,i386-scout-runtime.tar.gz";
-      sha256 = "0kps8i5v23sycqm69xz389n8k831jd7ncsmlrkky7nib2q91rbvj";
-      name = "scout-runtime-${version}.tar.gz";
-    } else fetchurl {
-      url = "https://repo.steampowered.com/steamrt-images-scout/snapshots/${version}/com.valvesoftware.SteamRuntime.Platform-i386-scout-runtime.tar.gz";
-      sha256 = "03fhac1r25xf7ia2pd35wjw360v5pa9h4870yrhhygp9h7v4klzf";
-      name = "scout-runtime-i386-${version}.tar.gz";
-    };
+  src = fetchurl {
+    url = "https://repo.steampowered.com/steamrt-images-scout/snapshots/${version}/steam-runtime.tar.xz";
+    sha256 = "0d4dfl6i31i8187wj8rr9yvmrg32bx96bsgs2ya21b00czf070sy";
+    name = "scout-runtime-${version}.tar.gz";
+  };
 
   buildCommand = ''
     mkdir -p $out
-    tar -C $out -x --strip=1 -f $src files/
+    tar -C $out --strip=1 -x -f $src
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/misc/drivers/hplip/default.nix b/pkgs/misc/drivers/hplip/default.nix
index 7c9eb35b9af4..2ecd163fbf24 100644
--- a/pkgs/misc/drivers/hplip/default.nix
+++ b/pkgs/misc/drivers/hplip/default.nix
@@ -14,16 +14,16 @@
 let
 
   name = "hplip-${version}";
-  version = "3.20.3";
+  version = "3.20.5";
 
   src = fetchurl {
     url = "mirror://sourceforge/hplip/${name}.tar.gz";
-    sha256 = "0sh6cg7yjc11x1cm4477iaslj9n8ksghs85hqwgfbk7m5b2pw2a1";
+    sha256 = "004bbd78487b7803cdcf2a96b00de938797227068c4de43ee7ad7d174c4e475a";
   };
 
   plugin = fetchurl {
     url = "https://developers.hp.com/sites/default/files/${name}-plugin.run";
-    sha256 = "13xyv30jqjysfk7gh0gyn7qj0pb0qvk2rlbhm85a3lw7bjycal8g";
+    sha256 = "ff3dedda3158be64b985efbf636890ddda5b271ae1f1fbd788219e1344a9c2e7";
   };
 
   hplipState = substituteAll {
diff --git a/pkgs/misc/ghostscript/0001-Bug-702364-Fix-missing-echogs-dependencies.patch b/pkgs/misc/ghostscript/0001-Bug-702364-Fix-missing-echogs-dependencies.patch
index c914634f579c..dd31260302c6 100644
--- a/pkgs/misc/ghostscript/0001-Bug-702364-Fix-missing-echogs-dependencies.patch
+++ b/pkgs/misc/ghostscript/0001-Bug-702364-Fix-missing-echogs-dependencies.patch
@@ -1,18 +1,5 @@
-From 9f56e78d111d726ca95a59b2d64e5c3298451505 Mon Sep 17 00:00:00 2001
-From: Chris Liddell <chris.liddell@artifex.com>
-Date: Mon, 27 Apr 2020 11:04:57 +0100
-Subject: [PATCH] Bug 702364: Fix missing echogs dependencies
-
-Rebased version of http://git.ghostscript.com/?p=ghostpdl.git;a=patch;h=1b4c3669a20c
-to fix parallel build
----
- contrib/contrib.mak | 281 ++++++++++++++++++++++----------------------
- 1 file changed, 143 insertions(+), 138 deletions(-)
-
-diff --git a/contrib/contrib.mak b/contrib/contrib.mak
-index 5411ae902..7dd9822a9 100644
---- a/contrib/contrib.mak
-+++ b/contrib/contrib.mak
+--- a/contrib/contrib.mak	2020-03-19 09:21:42.000000000 +0100
++++ b/contrib/contrib.mak	2020-05-14 13:41:03.202258445 +0200
 @@ -22,6 +22,10 @@
  CONTRIB_MAK=$(CONTRIBDIR)$(D)contrib.mak $(TOP_MAKEFILES)
  CONTRIBSRC=$(CONTRIBDIR)$(D)
@@ -24,7 +11,7 @@ index 5411ae902..7dd9822a9 100644
  ###### --------------------------- Catalog -------------------------- ######
  
  # The following drivers are user-contributed, and maintained (if at all) by
-@@ -161,19 +165,19 @@ $(DEVOBJ)gdevbjca.$(OBJ) : $(CONTRIBSRC)gdevbjca.c $(PDEVH) $(bjc_h) \
+@@ -185,19 +189,19 @@
  	$(DEVCC) $(DEVO_)gdevbjca.$(OBJ) $(C_) $(CONTRIBSRC)gdevbjca.c
  
  $(DD)bjcmono.dev : $(bjc_) $(DD)page.dev \
@@ -48,7 +35,7 @@ index 5411ae902..7dd9822a9 100644
  	$(SETPDEV) $(DD)bjccolor $(bjc_)
  
  
-@@ -184,25 +188,25 @@ cdeskjet8_=$(DEVOBJ)gdevcd8.$(OBJ) $(HPPCL)
+@@ -208,25 +212,25 @@
  # Author: Uli Wortmann (uliw@erdw.ethz.ch), Martin Gerbershagen (ger@ulm.temic.de)
  # Printer: HP 670
  $(DD)cdj670.dev : $(cdeskjet8_) $(DD)page.dev \
@@ -78,7 +65,7 @@ index 5411ae902..7dd9822a9 100644
  	$(SETPDEV2) $(DD)cdj1600 $(cdeskjet8_)
  
  $(DEVOBJ)gdevcd8.$(OBJ) : $(CONTRIBSRC)gdevcd8.c $(PDEVH) $(math__h)\
-@@ -220,7 +224,8 @@ $(DEVOBJ)gdevcd8.$(OBJ) : $(CONTRIBSRC)gdevcd8.c $(PDEVH) $(math__h)\
+@@ -244,7 +248,8 @@
  
  # Author: Matthew Gelhaus (mgelhaus@proaxis.com)
  # Printer: HP 880c
@@ -88,7 +75,7 @@ index 5411ae902..7dd9822a9 100644
  	$(SETPDEV2) $(DD)cdj880 $(cdeskjet8_)
  
  
-@@ -231,7 +236,7 @@ cdeskjet9_=$(DEVOBJ)gdevdj9.$(OBJ) $(HPPCL)
+@@ -255,7 +260,7 @@
  # Author: Rene Harsch (rene@harsch.net)
  # Printer: HP 970Cxi
  $(DD)cdj970.dev : $(cdeskjet9_) $(DD)page.dev \
@@ -97,7 +84,7 @@ index 5411ae902..7dd9822a9 100644
  	$(SETPDEV2) $(DD)cdj970 $(cdeskjet9_)
  
  $(DEVOBJ)gdevdj9.$(OBJ) : $(CONTRIBSRC)gdevdj9.c $(PDEVH) $(math__h) $(string__h)\
-@@ -244,7 +249,7 @@ $(DEVOBJ)gdevdj9.$(OBJ) : $(CONTRIBSRC)gdevdj9.c $(PDEVH) $(math__h) $(string__h
+@@ -268,7 +273,7 @@
  ### NOTE:  Same as chp2200 (some PJL and CRD changes).
  
  $(DD)cdnj500.dev : $(cdeskjet8_) $(DD)page.dev \
@@ -106,7 +93,7 @@ index 5411ae902..7dd9822a9 100644
  	$(SETPDEV2) $(DD)cdnj500 $(cdeskjet8_)
  
  
-@@ -253,7 +258,7 @@ $(DD)cdnj500.dev : $(cdeskjet8_) $(DD)page.dev \
+@@ -277,7 +282,7 @@
  ### NOTE:  Depends on the presence of the cdj850 section.
  
  $(DD)chp2200.dev : $(cdeskjet8_) $(DD)page.dev \
@@ -115,7 +102,7 @@ index 5411ae902..7dd9822a9 100644
  	$(SETPDEV2) $(DD)chp2200 $(cdeskjet8_)
  
  
-@@ -264,11 +269,11 @@ $(DD)chp2200.dev : $(cdeskjet8_) $(DD)page.dev \
+@@ -288,11 +293,11 @@
  GDIMONO=$(DEVOBJ)gdevgdi.$(OBJ) $(HPPCL)
  
  $(DD)gdi.dev : $(GDIMONO) $(DD)page.dev \
@@ -129,7 +116,7 @@ index 5411ae902..7dd9822a9 100644
  	$(SETPDEV) $(DD)samsunggdi $(GDIMONO)
  
  $(DEVOBJ)gdevgdi.$(OBJ) : $(CONTRIBSRC)gdevgdi.c $(PDEVH) $(gdevpcl_h) \
-@@ -282,17 +287,17 @@ $(DEVOBJ)gdevgdi.$(OBJ) : $(CONTRIBSRC)gdevgdi.c $(PDEVH) $(gdevpcl_h) \
+@@ -306,17 +311,17 @@
  
  hl1250_=$(DEVOBJ)gdevhl12.$(OBJ) $(HPDLJM)
  $(DD)hl1250.dev : $(hl1250_) $(DD)page.dev \
@@ -150,7 +137,7 @@ index 5411ae902..7dd9822a9 100644
  	$(DEVCC) $(DEVO_)gdevhl12.$(OBJ) $(C_) $(CONTRIBSRC)gdevhl12.c
  
  
-@@ -303,37 +308,37 @@ ln03_=$(DEVOBJ)gdevln03.$(OBJ)
+@@ -327,37 +332,37 @@
  # Author: Ulrich Mueller (ulm@vsnhd1.cern.ch)
  # Printer: DEC LN03
  $(DD)ln03.dev : $(ln03_) $(DD)page.dev \
@@ -194,7 +181,7 @@ index 5411ae902..7dd9822a9 100644
  	$(SETPDEV) $(DD)la75plus $(ln03_)
  
  $(DEVOBJ)gdevln03.$(OBJ) : $(CONTRIBSRC)gdevln03.c $(PDEVH) \
-@@ -356,27 +361,27 @@ $(DEVOBJ)gdevescv.$(OBJ) : $(ESCV_SRC)gdevescv.c $(ESCV_SRC)gdevescv.h $(PDEVH)
+@@ -380,233 +385,233 @@
  	$(DEVCC) -DA4 $(DEVO_)gdevescv.$(OBJ) $(C_) $(escv_opts) $(ESCV_SRC)gdevescv.c
  
  $(DD)alc1900.dev : $(escv_) $(DD)page.dev \
@@ -228,7 +215,8 @@ index 5411ae902..7dd9822a9 100644
  	$(SETPDEV) $(DD)alc8600 $(escv_)
  
  $(DD)alc9100.dev : $(escv_) $(DD)page.dev \
-@@ -384,11 +389,11 @@ $(DD)alc9100.dev : $(escv_) $(DD)page.dev \
+-                           $(CONTRIB_MAK) $(MAKEDIRS)
++                           $(CONTDEV) $(CONTRIB_MAK) $(MAKEDIRS)
  	$(SETPDEV) $(DD)alc9100 $(escv_)
  
  $(DD)lp3000c.dev : $(escv_) $(DD)page.dev \
@@ -242,7 +230,8 @@ index 5411ae902..7dd9822a9 100644
  	$(SETPDEV) $(DD)lp8000c $(escv_)
  
  $(DD)lp8200c.dev : $(escv_) $(DD)page.dev \
-@@ -396,15 +401,15 @@ $(DD)lp8200c.dev : $(escv_) $(DD)page.dev \
+-                           $(CONTRIB_MAK) $(MAKEDIRS)
++                           $(CONTDEV) $(CONTRIB_MAK) $(MAKEDIRS)
  	$(SETPDEV) $(DD)lp8200c $(escv_)
  
  $(DD)lp8300c.dev : $(escv_) $(DD)page.dev \
@@ -261,7 +250,8 @@ index 5411ae902..7dd9822a9 100644
  	$(SETPDEV) $(DD)lp8800c $(escv_)
  
  $(DD)lp9000c.dev : $(escv_) $(DD)page.dev \
-@@ -412,177 +417,177 @@ $(DD)lp9000c.dev : $(escv_) $(DD)page.dev \
+-                           $(CONTRIB_MAK) $(MAKEDIRS)
++                           $(CONTDEV) $(CONTRIB_MAK) $(MAKEDIRS)
  	$(SETPDEV) $(DD)lp9000c $(escv_)
  
  $(DD)lp9200c.dev : $(escv_) $(DD)page.dev \
@@ -481,7 +471,7 @@ index 5411ae902..7dd9822a9 100644
  	$(SETPDEV) $(DD)lex2050 $(lex2050_)
  
  $(DEVOBJ)gdevlx7.$(OBJ) : $(CONTRIBSRC)gdevlx7.c $(PDEVH) \
-@@ -599,7 +604,7 @@ $(DEVOBJ)gdevlx32.$(OBJ) : $(CONTRIBSRC)gdevlx32.c $(PDEVH) $(gsparam_h) \
+@@ -623,7 +628,7 @@
  	$(DEVCC) $(DEVO_)gdevlx32.$(OBJ) $(C_) $(CONTRIBSRC)gdevlx32.c
  
  $(DD)lxm3200.dev : $(lxm3200_) $(DD)page.dev \
@@ -490,7 +480,7 @@ index 5411ae902..7dd9822a9 100644
  	$(SETPDEV) $(DD)lxm3200 $(lxm3200_)
  
  
-@@ -625,13 +630,13 @@ $(DEVOBJ)gdevlips.$(OBJ) : $(GX) $(LIPS_SRC)gdevlips.c $(std_h) \
+@@ -649,13 +654,13 @@
  	$(DEVCC) $(DEVO_)gdevlips.$(OBJ) $(LIPS_OPT) $(C_) $(LIPS_SRC)gdevlips.c
  
  $(DD)lips4.dev : $(lipsr_) $(DD)page.dev \
@@ -506,7 +496,7 @@ index 5411ae902..7dd9822a9 100644
  	$(SETDEV) $(DD)lips4v $(lipsv_)
  	$(ADDMOD) $(DD)lips4v -include $(GLD)vector
  
-@@ -644,11 +649,11 @@ $(DEVOBJ)gdevl4v.$(OBJ) : $(LIPS_SRC)gdevl4v.c $(LIPS_SRC)gdevlips.h $(GDEV)\
+@@ -668,11 +673,11 @@
  ### --------------- Some extra devices: lips2p, bjc880j ---------------- ###
  
  $(DD)lips2p.dev : $(lipsr_) $(DD)page.dev \
@@ -520,7 +510,7 @@ index 5411ae902..7dd9822a9 100644
  	$(SETPDEV) $(DD)bjc880j $(lipsr_)
  
  
-@@ -657,15 +662,15 @@ $(DD)bjc880j.dev : $(lipsr_) $(DD)page.dev \
+@@ -681,15 +686,15 @@
  md2k_=$(DEVOBJ)gdevmd2k.$(OBJ)
  
  $(DD)md2k.dev : $(md2k_) $(DD)page.dev \
@@ -539,7 +529,7 @@ index 5411ae902..7dd9822a9 100644
  	$(DEVCC) $(DEVO_)gdevmd2k.$(OBJ) $(C_) $(CONTRIBSRC)gdevmd2k.c
   
  
-@@ -673,7 +678,7 @@ $(DEVOBJ)gdevmd2k.$(OBJ) : $(CONTRIBSRC)gdevmd2k.c $(PDEVH) $(gsparam_h) \
+@@ -697,7 +702,7 @@
  
  oki4w_=$(DEVOBJ)gdevop4w.$(OBJ)
  $(DD)oki4w.dev : $(oki4w_) $(DD)page.dev \
@@ -548,7 +538,7 @@ index 5411ae902..7dd9822a9 100644
  	$(SETPDEV) $(DD)oki4w $(oki4w_)
  
  # Author: Ivan Schreter (ivan@shadow.sk)
-@@ -696,11 +701,11 @@ $(DEVOBJ)gdevopvp.$(OBJ) : $(OPVP_SRC)gdevopvp.c $(OPVP_SRC)opvp_common.h\
+@@ -720,11 +725,11 @@
  	$(DEVCC) $(DEVO_)gdevopvp.$(OBJ) $(OPVP_OPT) $(C_) $(OPVP_SRC)gdevopvp.c
  
  $(DD)opvp.dev : $(opvp_) $(DD)page.dev \
@@ -562,7 +552,7 @@ index 5411ae902..7dd9822a9 100644
  	$(SETPDEV) $(DD)oprp $(opvp_)
  
  
-@@ -877,78 +882,78 @@ $(DEVOBJ)pclcomp.$(OBJ) : $(pcl3_src)pclcomp.c $(pcl3_src)pclgen.h \
+@@ -901,78 +906,78 @@
  
  # The generic pcl3 device with selectable subdevices
  $(DD)pcl3.dev : $(pcl3_) $(DD)page.dev \
@@ -665,7 +655,7 @@ index 5411ae902..7dd9822a9 100644
  	$(SETPDEV) $(DD)hpdj1120c $(pcl3_)
  
  #------------------------------------------------------------------------------
-@@ -985,7 +990,7 @@ pcl3-install:
+@@ -1009,7 +1014,7 @@
  
  xes_=$(DEVOBJ)gdevxes.$(OBJ)
  $(DD)xes.dev : $(xes_) $(DD)page.dev \
@@ -674,7 +664,7 @@ index 5411ae902..7dd9822a9 100644
  	$(SETPDEV) $(DD)xes $(xes_)
  
  # Author: Peter Flass (flass@lbdrscs.bitnet)
-@@ -1005,16 +1010,16 @@ JAPSRC=$(JAPDIR)$(D)
+@@ -1029,16 +1034,16 @@
  
  pr201_=$(DEVOBJ)gdevp201.$(OBJ) $(DEVOBJ)gdevprn.$(OBJ)
  
@@ -695,7 +685,7 @@ index 5411ae902..7dd9822a9 100644
  	$(SETPDEV) $(DD)pr1000_4 $(pr201_)
  
  $(DEVOBJ)gdevp201.$(OBJ) : $(JAPSRC)gdevp201.c $(PDEVH) \
-@@ -1025,7 +1030,7 @@ $(DEVOBJ)gdevp201.$(OBJ) : $(JAPSRC)gdevp201.c $(PDEVH) \
+@@ -1049,7 +1054,7 @@
  
  jj100_=$(DEVOBJ)gdevj100.$(OBJ) $(DEVOBJ)gdevprn.$(OBJ)
  
@@ -704,7 +694,7 @@ index 5411ae902..7dd9822a9 100644
  	$(SETPDEV) $(DD)jj100 $(jj100_)
  
  $(DEVOBJ)gdevj100.$(OBJ) : $(JAPSRC)gdevj100.c $(PDEVH) \
-@@ -1037,11 +1042,11 @@ $(DEVOBJ)gdevj100.$(OBJ) : $(JAPSRC)gdevj100.c $(PDEVH) \
+@@ -1061,11 +1066,11 @@
  bj10v_=$(DEVOBJ)gdev10v.$(OBJ) $(DEVOBJ)gdevprn.$(OBJ)
  
  $(DD)bj10v.dev : $(bj10v_) \
@@ -718,7 +708,7 @@ index 5411ae902..7dd9822a9 100644
  	$(SETPDEV) $(DD)bj10vh $(bj10v_)
  
  # Uncomment the following line if you are using MS-DOS on PC9801 series.
-@@ -1056,7 +1061,7 @@ $(DEVOBJ)gdev10v.$(OBJ) : $(JAPSRC)gdev10v.c $(PDEVH) \
+@@ -1080,7 +1085,7 @@
  dmprt_=$(DEVOBJ)gdevdmpr.$(OBJ) $(DEVOBJ)dviprlib.$(OBJ) $(DEVOBJ)gdevprn.$(OBJ)
  
  $(DD)dmprt.dev : $(dmprt_) $(DD)page.dev \
@@ -727,7 +717,7 @@ index 5411ae902..7dd9822a9 100644
  	$(SETDEV) $(DD)dmprt $(dmprt_)
  	$(ADDMOD) $(DD)dmprt -ps dmp_init
  
-@@ -1086,19 +1091,19 @@ $(DEVOBJ)gdevmjc.$(OBJ) : $(JAPSRC)gdevmjc.c $(JAPSRC)gdevmjc.h $(PDEVH) $(gdevp
+@@ -1110,19 +1115,19 @@
  	$(DEVCC) -DA4 $(DEVO_)gdevmjc.$(OBJ) $(C_) $(JAPSRC)gdevmjc.c
  
  $(DD)mj700v2c.dev : $(mj700v2c_) $(DD)page.dev \
@@ -751,7 +741,7 @@ index 5411ae902..7dd9822a9 100644
  	$(SETPDEV) $(DD)mj8000c $(mj700v2c_)
  
  ### ----------------- The Fujitsu FMPR printer device ----------------- ###
-@@ -1106,7 +1111,7 @@ $(DD)mj8000c.dev : $(mj700v2c_) $(DD)page.dev \
+@@ -1130,7 +1135,7 @@
  fmpr_=$(DEVOBJ)gdevfmpr.$(OBJ) $(DEVOBJ)gdevprn.$(OBJ)
  
  $(DD)fmpr.dev : $(fmpr_) $(DD)page.dev \
@@ -760,7 +750,7 @@ index 5411ae902..7dd9822a9 100644
  	$(SETPDEV) $(DD)fmpr $(fmpr_)
  
  $(DEVOBJ)gdevfmpr.$(OBJ) : $(JAPSRC)gdevfmpr.c $(PDEVH) \
-@@ -1118,7 +1123,7 @@ $(DEVOBJ)gdevfmpr.$(OBJ) : $(JAPSRC)gdevfmpr.c $(PDEVH) \
+@@ -1142,7 +1147,7 @@
  fmlbp_=$(DEVOBJ)gdevfmlbp.$(OBJ) $(DEVOBJ)gdevprn.$(OBJ)
  
  $(DD)fmlbp.dev : $(fmlbp_) $(DD)page.dev \
@@ -769,7 +759,7 @@ index 5411ae902..7dd9822a9 100644
  	$(SETPDEV) $(DD)fmlbp $(fmlbp_)
  
  $(DEVOBJ)gdevfmlbp.$(OBJ) : $(JAPSRC)gdevfmlbp.c $(PDEVH) \
-@@ -1135,7 +1140,7 @@ $(DEVOBJ)gdevfmlbp.$(OBJ) : $(JAPSRC)gdevfmlbp.c $(PDEVH) \
+@@ -1159,7 +1164,7 @@
  ml6_=$(DEVOBJ)gdevml6.$(OBJ) $(DEVOBJ)gdevprn.$(OBJ)
  
  $(DD)ml600.dev : $(ml6_) $(DD)page.dev \
@@ -778,7 +768,7 @@ index 5411ae902..7dd9822a9 100644
  	$(SETPDEV) $(DD)ml600 $(ml6_)
  
  $(DEVOBJ)gdevml6.$(OBJ) : $(JAPSRC)gdevml6.c $(PDEVH) \
-@@ -1148,11 +1153,11 @@ $(DEVOBJ)gdevml6.$(OBJ) : $(JAPSRC)gdevml6.c $(PDEVH) \
+@@ -1172,11 +1177,11 @@
  lbp3x0_=$(DEVOBJ)gdevlbp3.$(OBJ)
  
  $(DD)lbp310.dev :$(lbp3x0_) $(DD)page.dev \
@@ -792,7 +782,7 @@ index 5411ae902..7dd9822a9 100644
  	$(SETPDEV) $(DD)lbp320 $(lbp3x0_)
  
  $(DEVOBJ)gdevlbp3.$(OBJ) : $(JAPSRC)gdevlbp3.c $(PDEVH)
-@@ -1167,7 +1172,7 @@ $(DEVOBJ)gdevnpdl.$(OBJ) : $(JAPSRC)gdevnpdl.c $(LIPS_SRC)gdevlprn.h $(PDEVH) \
+@@ -1191,7 +1196,7 @@
  	$(DEVCC) -DA4 $(DEVO_)gdevnpdl.$(OBJ) $(LIPS_OPT) $(C_) $(JAPSRC)gdevnpdl.c
  
  $(DD)npdl.dev : $(npdl_) $(DD)page.dev \
@@ -801,7 +791,7 @@ index 5411ae902..7dd9822a9 100644
  	$(SETPDEV) $(DD)npdl $(npdl_)
  
  ### ------- EPSON ESC/Page printer device ----------------- ###
-@@ -1179,11 +1184,11 @@ $(DEVOBJ)gdevespg.$(OBJ) : $(JAPSRC)gdevespg.c $(LIPS_SRC)gdevlprn.h $(PDEVH) \
+@@ -1203,11 +1208,11 @@
  	$(DEVCC) -DA4 $(DEVO_)gdevespg.$(OBJ) $(LIPS_OPT) $(C_) $(JAPSRC)gdevespg.c
  
  $(DD)escpage.dev : $(escpage_) $(DD)page.dev \
@@ -815,7 +805,7 @@ index 5411ae902..7dd9822a9 100644
  	$(SETPDEV) $(DD)lp2000 $(escpage_)
  
  ### --- The RICOH RPDL language printer device ------ ###
-@@ -1194,7 +1199,7 @@ $(DEVOBJ)gdevrpdl.$(OBJ) : $(JAPSRC)gdevrpdl.c $(LIPS_SRC)gdevlprn.h $(PDEVH) \
+@@ -1218,7 +1223,7 @@
  	$(DEVCC) $(DEVO_)gdevrpdl.$(OBJ) $(LIPS_OPT) $(C_) $(JAPSRC)gdevrpdl.c
  
  $(DD)rpdl.dev : $(rpdl_) $(DD)page.dev \
@@ -824,21 +814,7 @@ index 5411ae902..7dd9822a9 100644
  	$(SETPDEV) $(DD)rpdl $(rpdl_)
  
  ### ---------- RICOH RPDL IV(600dpi) printer devices ---------- ###
-@@ -1204,11 +1209,11 @@ $(DD)rpdl.dev : $(rpdl_) $(DD)page.dev \
- #	$(DEVCC) $(DEVO_)gdevrpdl.$(OBJ) $(C_) $(JAPSRC)gdevrpdl.c
- #
- #$(DD)nx100f.dev : $(rpdl_) $(DD)page.dev \
--                           $(CONTRIB_MAK) $(MAKEDIRS)
-+                           $(CONTDEV) $(CONTRIB_MAK) $(MAKEDIRS)
- #	$(SETPDEV2) $(DD)nx100f $(rpdl_)
- #
- #$(DD)nx100v.dev : $(rpdl_) $(DD)page.dev \
--                           $(CONTRIB_MAK) $(MAKEDIRS)
-+                           $(CONTDEV) $(CONTRIB_MAK) $(MAKEDIRS)
- #	$(SETPDEV2) $(DD)nx100v $(rpdl_)
- 
- ### ------------ The ALPS Micro Dry printer devices ------------ ###
-@@ -1216,15 +1221,15 @@ $(DD)rpdl.dev : $(rpdl_) $(DD)page.dev \
+@@ -1240,15 +1245,15 @@
  alps_=$(DEVOBJ)gdevalps.$(OBJ)
  
  $(DD)md50Mono.dev : $(alps_) $(DD)page.dev \
@@ -857,6 +833,3 @@ index 5411ae902..7dd9822a9 100644
  	$(SETPDEV) $(DD)md1xMono $(alps_)
  
  $(DEVOBJ)gdevalps.$(OBJ) : $(JAPSRC)gdevalps.c $(PDEVH) \
--- 
-2.26.2
-
diff --git a/pkgs/misc/ghostscript/default.nix b/pkgs/misc/ghostscript/default.nix
index 7f6766cf4624..a10595591875 100644
--- a/pkgs/misc/ghostscript/default.nix
+++ b/pkgs/misc/ghostscript/default.nix
@@ -10,8 +10,8 @@ assert cupsSupport -> cups != null;
 
 let
   version = "9.${ver_min}";
-  ver_min = "50";
-  sha512 = "3p46kzn6kh7z4qqnqydmmvdlgzy5730z3yyvyxv6i4yb22mgihzrwqmhmvfn3b7lypwf6fdkkndarzv7ly3zndqpyvg89x436sms7iw";
+  ver_min = "52";
+  sha512 = "1ksm3v4nw8acc4j817n44l1c65ijk0mr3mp4kryy17jz41bmzzql5d8vr40h59n9dmf8b2wmnbq45bj3an1zrpfagavlf0i9s436jjc";
 
   fonts = stdenv.mkDerivation {
     name = "ghostscript-fonts";
@@ -47,11 +47,6 @@ stdenv.mkDerivation rec {
   patches = [
     ./urw-font-files.patch
     ./doc-no-ref.diff
-    (fetchpatch {
-      name = "CVE-2019-14869.patch";
-      url = "https://git.ghostscript.com/?p=ghostpdl.git;a=patch;h=485904772c5f0aa1140032746e5a0abfc40f4cef";
-      sha256 = "0z5gnvgpp0dlzgvpw9a1yan7qyycv3mf88l93fvb1kyay893rshp";
-    })
     # rebased version of upstream http://git.ghostscript.com/?p=ghostpdl.git;a=patch;h=1b4c3669a20c,
     # Remove on update to version > 9.52
     ./0001-Bug-702364-Fix-missing-echogs-dependencies.patch
diff --git a/pkgs/os-specific/darwin/yabai/default.nix b/pkgs/os-specific/darwin/yabai/default.nix
index b4a7fc4c695c..5d8c8f60aec6 100644
--- a/pkgs/os-specific/darwin/yabai/default.nix
+++ b/pkgs/os-specific/darwin/yabai/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "yabai";
-  version = "3.1.2";
+  version = "3.2.0";
 
   src = fetchFromGitHub {
     owner = "koekeishiya";
     repo = pname;
     rev = "v${version}";
-    sha256 = "01vkx8nqds4f7nnzml4qf976xm89w6psxbpswkn98r5k03zfa8r0";
+    sha256 = "1iq5p4k6klffglxfhmzc2jvlilwn0w97vb5v4b91spiyp39nqcfw";
   };
 
   buildInputs = [ Carbon Cocoa ScriptingBridge ];
diff --git a/pkgs/os-specific/linux/firmware/sof-firmware/default.nix b/pkgs/os-specific/linux/firmware/sof-firmware/default.nix
index 73ab46b3c8a6..a9fc44e48cc8 100644
--- a/pkgs/os-specific/linux/firmware/sof-firmware/default.nix
+++ b/pkgs/os-specific/linux/firmware/sof-firmware/default.nix
@@ -1,28 +1,33 @@
-{ stdenv, fetchurl }:
+{ stdenv, fetchFromGitHub }:
 
 with stdenv.lib;
 stdenv.mkDerivation rec {
   pname = "sof-firmware";
-  version = "1.4.2";
+  version = "1.5.1";
 
-  src = fetchurl {
-    url = "https://www.alsa-project.org/files/pub/misc/sof/${pname}-${version}.tar.bz2";
-    sha256 = "1nkh020gjm45vxd6fvmz63hj16ilff2nl5avvsklajjs6xci1sf5";
+  src = fetchFromGitHub {
+    owner = "thesofproject";
+    repo = "sof-bin";
+    rev = "ae61d2778b0a0f47461a52da0d1f191f651e0763";
+    sha256 = "0j6bpwz49skvdvian46valjw4anwlrnkq703n0snkbngmq78prba";
   };
 
   phases = [ "unpackPhase" "installPhase" ];
 
   installPhase = ''
-    rm lib/firmware/intel/{sof/LICENCE,sof-tplg/LICENCE}
-    mkdir $out
-    cp -r lib $out/lib
+    mkdir -p $out/lib/firmware/intel
+
+    sed -i 's/ROOT=.*$/ROOT=$out/g' go.sh
+    sed -i 's/VERSION=.*$/VERSION=v${version}/g' go.sh
+
+    ./go.sh
   '';
 
   meta = with stdenv.lib; {
     description = "Sound Open Firmware";
     homepage = "https://www.sofproject.org/";
     license = with licenses; [ bsd3 isc ];
-    maintainers = with maintainers; [ lblasc ];
+    maintainers = with maintainers; [ lblasc evenbrenden ];
     platforms = with platforms; linux;
   };
 }
diff --git a/pkgs/os-specific/linux/fscrypt/default.nix b/pkgs/os-specific/linux/fscrypt/default.nix
index 608a6d5fa70a..aee406b03f0c 100644
--- a/pkgs/os-specific/linux/fscrypt/default.nix
+++ b/pkgs/os-specific/linux/fscrypt/default.nix
@@ -4,13 +4,13 @@
 
 buildGoModule rec {
   pname = "fscrypt";
-  version = "0.2.8";
+  version = "0.2.9";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "fscrypt";
     rev = "v${version}";
-    sha256 = "0433f9kx43842ic8dydxhz8plyyrrxvqqwg7kd5ghn599ix28avy";
+    sha256 = "020hhdarbn3bwlc2j2g89868v8nfx8562z1a778ihpvvsa4ykr31";
   };
 
   postPatch = ''
diff --git a/pkgs/os-specific/linux/iproute/default.nix b/pkgs/os-specific/linux/iproute/default.nix
index 46312a637dab..3ac79464ac4b 100644
--- a/pkgs/os-specific/linux/iproute/default.nix
+++ b/pkgs/os-specific/linux/iproute/default.nix
@@ -5,11 +5,11 @@
 
 stdenv.mkDerivation rec {
   pname = "iproute2";
-  version = "5.6.0";
+  version = "5.7.0";
 
   src = fetchurl {
     url = "mirror://kernel/linux/utils/net/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "14j6n1bc09xhq8lxs40vfsx8bb8lx12a07ga4rsxl8vfrqjhwnqv";
+    sha256 = "088gs56iqhdlpw1iqjwrss4zxd4zbl2wl8s2implrrdajjxcfpbj";
   };
 
   preConfigure = ''
diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix
index b1193c7fa734..36fb39fd1308 100644
--- a/pkgs/os-specific/linux/kernel/common-config.nix
+++ b/pkgs/os-specific/linux/kernel/common-config.nix
@@ -206,8 +206,8 @@ let
       B43_PHY_HT            = option yes;
       BCMA_HOST_PCI         = option yes;
       RTW88                 = whenAtLeast "5.2" module;
-      RTW88_8822BE          = whenAtLeast "5.2" yes;
-      RTW88_8822CE          = whenAtLeast "5.2" yes;
+      RTW88_8822BE          = mkMerge [ (whenBetween "5.2" "5.8" yes) (whenAtLeast "5.8" module) ];
+      RTW88_8822CE          = mkMerge [ (whenBetween "5.2" "5.8" yes) (whenAtLeast "5.8" module) ];
     };
 
     fb = {
@@ -727,6 +727,7 @@ let
       PSI = whenAtLeast "4.20" yes;
 
       MODVERSIONS        = whenOlder "4.9" yes;
+      MOUSE_ELAN_I2C_SMBUS = yes;
       MOUSE_PS2_ELANTECH = yes; # Elantech PS/2 protocol extension
       MTRR_SANITIZER     = yes;
       NET_FC             = yes; # Fibre Channel driver support
diff --git a/pkgs/os-specific/linux/kernel/hardened/patches.json b/pkgs/os-specific/linux/kernel/hardened/patches.json
index 2e4ea7478065..654615ebe500 100644
--- a/pkgs/os-specific/linux/kernel/hardened/patches.json
+++ b/pkgs/os-specific/linux/kernel/hardened/patches.json
@@ -1,22 +1,22 @@
 {
     "4.14": {
-        "name": "linux-hardened-4.14.183.a.patch",
-        "sha256": "0k9dg37q3hcm13iyw662indwy23aylc03ldqfn7613c7ymqmbzj7",
-        "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.14.183.a/linux-hardened-4.14.183.a.patch"
+        "name": "linux-hardened-4.14.184.a.patch",
+        "sha256": "1g12kz6ikdwp6b7000pfy3myga90mvxyl04b9267fk88jwih6yhk",
+        "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.14.184.a/linux-hardened-4.14.184.a.patch"
     },
     "4.19": {
-        "name": "linux-hardened-4.19.127.a.patch",
-        "sha256": "00nfcs5yn2a70an3ygzzv4s3qa3hf7pni4ad70aw87vyvrqlyx3k",
-        "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.19.127.a/linux-hardened-4.19.127.a.patch"
+        "name": "linux-hardened-4.19.128.a.patch",
+        "sha256": "19ayzx9rf4j31ypavxwamd290lm95wmi7v165avxslahnx6pdsxs",
+        "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.19.128.a/linux-hardened-4.19.128.a.patch"
     },
     "5.4": {
-        "name": "linux-hardened-5.4.45.a.patch",
-        "sha256": "0gihrcxqg3hax20xhvna4lmgsivari6wwsyqz09w34v8p1fhd5nx",
-        "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.4.45.a/linux-hardened-5.4.45.a.patch"
+        "name": "linux-hardened-5.4.46.a.patch",
+        "sha256": "0f2d53na7g6dhiba2ym09lm4fp3hwm6kw6mpm5jk46jmb6j7iwk5",
+        "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.4.46.a/linux-hardened-5.4.46.a.patch"
     },
     "5.6": {
-        "name": "linux-hardened-5.6.17.a.patch",
-        "sha256": "0nci30k7xh56b6454cd0hkpvpkfqb98cqdpvjaamlnmiphz4sk1f",
-        "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.6.17.a/linux-hardened-5.6.17.a.patch"
+        "name": "linux-hardened-5.6.18.a.patch",
+        "sha256": "0idvgjg7kji4w3341acfqywi0qqn3pvxcmiz70cd7inhlqaqrw63",
+        "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.6.18.a/linux-hardened-5.6.18.a.patch"
     }
 }
diff --git a/pkgs/os-specific/linux/kernel/linux-testing.nix b/pkgs/os-specific/linux/kernel/linux-testing.nix
index f2f0fac3b7dd..2a7a1fa93425 100644
--- a/pkgs/os-specific/linux/kernel/linux-testing.nix
+++ b/pkgs/os-specific/linux/kernel/linux-testing.nix
@@ -3,15 +3,15 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "5.7-rc6";
-  extraMeta.branch = "5.7";
+  version = "5.8-rc1";
+  extraMeta.branch = "5.1";
 
   # modDirVersion needs to be x.y.z, will always add .0
   modDirVersion = if (modDirVersionArg == null) then builtins.replaceStrings ["-"] [".0-"] version else modDirVersionArg;
 
   src = fetchurl {
     url = "https://git.kernel.org/torvalds/t/linux-${version}.tar.gz";
-    sha256 = "0g04zwdxks7pa5q6shl5xl2rml1w95rxq7sqkkadj11mpk2k89w4";
+    sha256 = "1gb7g2vrgg0zz281lv1ir1r0535spc40j65p0azmdxlk24fkfxfc";
   };
 
   # Should the testing kernels ever be built on Hydra?
diff --git a/pkgs/os-specific/linux/systemd/0005-Add-some-NixOS-specific-unit-directories.patch b/pkgs/os-specific/linux/systemd/0005-Add-some-NixOS-specific-unit-directories.patch
index 23aa893362b5..a9b60cbb2e20 100644
--- a/pkgs/os-specific/linux/systemd/0005-Add-some-NixOS-specific-unit-directories.patch
+++ b/pkgs/os-specific/linux/systemd/0005-Add-some-NixOS-specific-unit-directories.patch
@@ -24,8 +24,8 @@ index 8331832c7a..bedb97115d 100644
  systemduserconfdir=${sysconfdir}/systemd/user
 -systemdsystemunitpath=${systemdsystemconfdir}:/etc/systemd/system:/run/systemd/system:/usr/local/lib/systemd/system:${systemdsystemunitdir}:/usr/lib/systemd/system:/lib/systemd/system
 -systemduserunitpath=${systemduserconfdir}:/etc/systemd/user:/run/systemd/user:/usr/local/lib/systemd/user:/usr/local/share/systemd/user:${systemduserunitdir}:/usr/lib/systemd/user:/usr/share/systemd/user
-+systemdsystemunitpath=${systemdsystemconfdir}:/etc/systemd/system:/etc/systemd-mutable/system:/nix/var/nix/profiles/default/lib/systemd/user:/run/systemd/system:${systemdsystemunitdir}
-+systemduserunitpath=${systemduserconfdir}:/etc/systemd/user:/etc/systemd-mutable/user:/nix/var/nix/profiles/default/lib/systemd/system:/run/systemd/user:${systemduserunitdir}
++systemdsystemunitpath=${systemdsystemconfdir}:/etc/systemd/system:/etc/systemd-mutable/system:/nix/var/nix/profiles/default/lib/systemd/system:/run/systemd/system:${systemdsystemunitdir}
++systemduserunitpath=${systemduserconfdir}:/etc/systemd/user:/etc/systemd-mutable/user:/nix/var/nix/profiles/default/lib/systemd/user:/run/systemd/user:${systemduserunitdir}
  systemdsystemgeneratordir=${rootprefix}/lib/systemd/system-generators
  systemdusergeneratordir=${prefix}/lib/systemd/user-generators
  systemdsystemgeneratorpath=/run/systemd/system-generators:/etc/systemd/system-generators:/usr/local/lib/systemd/system-generators:${systemdsystemgeneratordir}
diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index 722b4db9a80a..3235fb3b95cd 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -66,9 +66,6 @@ in stdenv.mkDerivation {
 
   postPatch = ''
     substituteInPlace src/basic/path-util.h --replace "@defaultPathNormal@" "${placeholder "out"}/bin/"
-  ''
-    # TODO: unconditionalize on the next rebuild
-  + stdenv.lib.optionalString (stdenv.hostPlatform != stdenv.buildPlatform) ''
     substituteInPlace src/boot/efi/meson.build \
       --replace \
       "find_program('ld'" \
diff --git a/pkgs/servers/blockbook/default.nix b/pkgs/servers/blockbook/default.nix
index 627ac42efd20..4afabb858c38 100644
--- a/pkgs/servers/blockbook/default.nix
+++ b/pkgs/servers/blockbook/default.nix
@@ -14,14 +14,14 @@
 
 buildGoModule rec {
   pname = "blockbook";
-  version = "0.3.3";
-  commit = "b6961ca";
+  version = "0.3.4";
+  commit = "eb4e10a";
 
   src = fetchFromGitHub {
     owner = "trezor";
     repo = "blockbook";
     rev = "v${version}";
-    sha256 = "01nb4if2dix2h95xvqvafil325jjw2a4v1izb9mad0cjqcf8rk6n";
+    sha256 = "0da1kav5x2xcmwvdgfk1q70l1k0sqqj3njgx2xx885d40m6qbnrs";
   };
 
   vendorSha256 = "1qjlvhizl8cy06cgf4phia70bgbm4lj57z5z2gyr8aglx98bnpdn";
diff --git a/pkgs/servers/consul/default.nix b/pkgs/servers/consul/default.nix
index a702626e1c14..d550a5cb699e 100644
--- a/pkgs/servers/consul/default.nix
+++ b/pkgs/servers/consul/default.nix
@@ -2,7 +2,7 @@
 
 buildGoModule rec {
   pname = "consul";
-  version = "1.7.3";
+  version = "1.7.4";
   rev = "v${version}";
 
   # Note: Currently only release tags are supported, because they have the Consul UI
@@ -17,7 +17,7 @@ buildGoModule rec {
     owner = "hashicorp";
     repo = pname;
     inherit rev;
-    sha256 = "05p893mfdrlf5fy9ywwnqb7blw1ffidgviyyh6a3bp82wk49f8ph";
+    sha256 = "0yx0ry8gwgvw1mkz3nv4rn2pwslm0q7jxlk70gaw6386mxxmj0sk";
   };
 
   passthru.tests.consul = nixosTests.consul;
diff --git a/pkgs/servers/dns/bind/default.nix b/pkgs/servers/dns/bind/default.nix
index a7581ccbb119..2aae5634cc5e 100644
--- a/pkgs/servers/dns/bind/default.nix
+++ b/pkgs/servers/dns/bind/default.nix
@@ -54,7 +54,8 @@ stdenv.mkDerivation rec {
     "--without-eddsa"
     "--with-aes"
   ] ++ lib.optional stdenv.isLinux "--with-libcap=${libcap.dev}"
-    ++ lib.optional enableSeccomp "--enable-seccomp";
+    ++ lib.optional enableSeccomp "--enable-seccomp"
+    ++ lib.optional (stdenv.hostPlatform != stdenv.buildPlatform) "BUILD_CC=$(CC_FOR_BUILD)";
 
   postInstall = ''
     moveToOutput bin/bind9-config $dev
diff --git a/pkgs/servers/mail/mailman/default.nix b/pkgs/servers/mail/mailman/default.nix
index 8443a1968fdf..37b4d29eeb16 100644
--- a/pkgs/servers/mail/mailman/default.nix
+++ b/pkgs/servers/mail/mailman/default.nix
@@ -6,12 +6,12 @@
 
 buildPythonPackage rec {
   pname = "mailman";
-  version = "3.3.0";
+  version = "3.3.1";
   disabled = !isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1qph9i93ndahfxi3bb2sd0kjm2c0pkh844ai6zacfmvihl1k3pvy";
+    sha256 = "0idfiv48jjgc0jq4731094ddhraqq8bxnwmjk6sg5ask0jss9kxq";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/servers/mail/mailman/hyperkitty.nix b/pkgs/servers/mail/mailman/hyperkitty.nix
index 57c1b355bf26..5ed5b74d309a 100644
--- a/pkgs/servers/mail/mailman/hyperkitty.nix
+++ b/pkgs/servers/mail/mailman/hyperkitty.nix
@@ -7,12 +7,12 @@
 
 buildPythonPackage rec {
   pname = "HyperKitty";
-  version = "1.3.2";
+  version = "1.3.3";
   disabled = !isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "092fkv0xyf5vgj33xwq0mh9h5c5d56ifwimaqbfpx5cwc6yivb88";
+    sha256 = "0p85r9q6mn5as5b39xp9hkkipnk0156acx540n2ygk3qb3jd4a5n";
   };
 
   nativeBuildInputs = [ isort ];
diff --git a/pkgs/servers/mail/mailman/postorius.nix b/pkgs/servers/mail/mailman/postorius.nix
index 5f542b9036ea..ae797fa6cbc7 100644
--- a/pkgs/servers/mail/mailman/postorius.nix
+++ b/pkgs/servers/mail/mailman/postorius.nix
@@ -4,11 +4,11 @@
 
 buildPythonPackage rec {
   pname = "postorius";
-  version = "1.3.2";
+  version = "1.3.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0wrm0hda7ym9qaygxirqaaii66ndmgyy7gx8wqdg07pfx14zcyja";
+    sha256 = "08jn23gblbkfl09qlykbpsmp39mmach3sl69h1j5cd5kkx839rwa";
   };
 
   propagatedBuildInputs = [ django-mailman3 readme_renderer ];
diff --git a/pkgs/servers/mail/postfix/default.nix b/pkgs/servers/mail/postfix/default.nix
index 3b14fab68753..585a6196831b 100644
--- a/pkgs/servers/mail/postfix/default.nix
+++ b/pkgs/servers/mail/postfix/default.nix
@@ -26,11 +26,11 @@ in stdenv.mkDerivation rec {
 
   pname = "postfix";
 
-  version = "3.5.2";
+  version = "3.5.3";
 
   src = fetchurl {
     url = "ftp://ftp.cs.uu.nl/mirror/postfix/postfix-release/official/${pname}-${version}.tar.gz";
-    sha256 = "1hxy9458apnzfg4n0alncsdgy5dwzn5dbn4xm46iv15xynbj9gz3";
+    sha256 = "0xcd9pmv2p4znn6bqvka19h5h2lw90inyxrm5020acd0yaf0i0g3";
   };
 
   nativeBuildInputs = [ makeWrapper m4 ];
diff --git a/pkgs/servers/sql/postgresql/default.nix b/pkgs/servers/sql/postgresql/default.nix
index 8ba7e9c96cfc..2b440f78e99d 100644
--- a/pkgs/servers/sql/postgresql/default.nix
+++ b/pkgs/servers/sql/postgresql/default.nix
@@ -182,41 +182,41 @@ let
 in self: {
 
   postgresql_9_5 = self.callPackage generic {
-    version = "9.5.21";
+    version = "9.5.22";
     psqlSchema = "9.5";
-    sha256 = "0b3kzc0431bvp55jns42q9h1119gy075mp4aywnkq93pm17nxdby";
+    sha256 = "03v4d4nr9f86y0i1j5jmvfan5w8y4ga1mar59lhcnj3jl5q58ma8";
     this = self.postgresql_9_5;
     inherit self;
   };
 
   postgresql_9_6 = self.callPackage generic {
-    version = "9.6.17";
+    version = "9.6.18";
     psqlSchema = "9.6";
-    sha256 = "1hm0w6n988n9qn2wylhjq02i5ayzb16rzhgkcv09fpsl68ny7qgn";
+    sha256 = "16crr2a1sl97aiacqzd0bk56yl1abq6blc0c6qpx5rl5ny1c4zji";
     this = self.postgresql_9_6;
     inherit self;
   };
 
   postgresql_10 = self.callPackage generic {
-    version = "10.12";
+    version = "10.13";
     psqlSchema = "10.0"; # should be 10, but changing it is invasive
-    sha256 = "1rsab4zf4rx7pvvhlwhb04kb95aiad9cwazc4ksbvg2gij47z3rq";
+    sha256 = "1qal0yp7a90yzya7hl56gsmw5fvacplrdhpn7h9gnbyr1i2iyw2d";
     this = self.postgresql_10;
     inherit self;
   };
 
   postgresql_11 = self.callPackage generic {
-    version = "11.7";
+    version = "11.8";
     psqlSchema = "11.1"; # should be 11, but changing it is invasive
-    sha256 = "04x343i4v0w4jf1v5ial8rwsizs1qhdjfbanbnibdys6i0xfjjij";
+    sha256 = "1qksqyayxmnccmbapg3ajsw9pjgqva0inxjhx64rqd6ckhrg9wpa";
     this = self.postgresql_11;
     inherit self;
   };
 
   postgresql_12 = self.callPackage generic {
-    version = "12.2";
+    version = "12.3";
     psqlSchema = "12";
-    sha256 = "1pmmd59pvfs50gsi728bw9f1jl59xghsjdanfimph0659x6cq7dd";
+    sha256 = "0hfg3n7rlz96579cj3z1dh2idl15rh3wfvn8jl31jj4h2yk69vcl";
     this = self.postgresql_12;
     inherit self;
   };
diff --git a/pkgs/servers/web-apps/searx/default.nix b/pkgs/servers/web-apps/searx/default.nix
index d0ff13917969..bcfa8a410219 100644
--- a/pkgs/servers/web-apps/searx/default.nix
+++ b/pkgs/servers/web-apps/searx/default.nix
@@ -25,7 +25,8 @@ buildPythonApplication rec {
       --replace 'pygments==2.1.3' 'pygments>=2.1,<3.0' \
       --replace 'pyopenssl==19.0.0' 'pyopenssl' \
       --replace 'python-dateutil==2.8.0' 'python-dateutil==2.8.*' \
-      --replace 'pyyaml==5.1' 'pyyaml'
+      --replace 'pyyaml==5.1' 'pyyaml' \
+      --replace 'requests[socks]==2.22.0' 'requests[socks]'
     substituteInPlace requirements-dev.txt \
       --replace 'plone.testing==5.0.0' 'plone.testing' \
       --replace 'pep8==1.7.0' 'pep8==1.7.*' \
diff --git a/pkgs/shells/fish/default.nix b/pkgs/shells/fish/default.nix
index 11d9e48008fa..420aac7607e4 100644
--- a/pkgs/shells/fish/default.nix
+++ b/pkgs/shells/fish/default.nix
@@ -125,6 +125,10 @@ let
       pcre2
     ];
 
+    cmakeFlags = [
+      "-DCMAKE_INSTALL_DOCDIR=${placeholder "out"}/share/doc/fish"
+    ];
+
     preConfigure = ''
       patchShebangs ./build_tools/git_version_gen.sh
     '';
diff --git a/pkgs/tools/audio/video2midi/default.nix b/pkgs/tools/audio/video2midi/default.nix
index dca8a0610da8..cf9297119e9f 100644
--- a/pkgs/tools/audio/video2midi/default.nix
+++ b/pkgs/tools/audio/video2midi/default.nix
@@ -8,7 +8,7 @@ let
   });
 in pythonPackages.buildPythonApplication rec {
   pname = "video2midi";
-  version = "0.4.0.1";
+  version = "0.4.0.2";
 
   format = "other";
 
@@ -16,7 +16,7 @@ in pythonPackages.buildPythonApplication rec {
     owner = "svsdval";
     repo = pname;
     rev = version;
-    sha256 = "1869w60kprjdikqk4iwx058zri2jg4aznzlg668w9myka4mp01r9";
+    sha256 = "174ijn8bc306529scd23szvgx1apanm2qmwk4lwmi64rhkm6dapx";
   };
 
   propagatedBuildInputs = with pythonPackages; [ opencv3_ midiutil pygame pyopengl ];
diff --git a/pkgs/tools/compression/zstd/default.nix b/pkgs/tools/compression/zstd/default.nix
index eb42fdbaff4f..f919fb92ed1d 100644
--- a/pkgs/tools/compression/zstd/default.nix
+++ b/pkgs/tools/compression/zstd/default.nix
@@ -51,14 +51,16 @@ stdenv.mkDerivation rec {
   preInstall = ''
     substituteInPlace ../programs/zstdgrep \
       --replace ":-grep" ":-${gnugrep}/bin/grep" \
-      --replace ":-zstdcat" ":-$out/bin/zstdcat"
+      --replace ":-zstdcat" ":-$bin/bin/zstdcat"
 
     substituteInPlace ../programs/zstdless \
-      --replace "zstdcat" "$out/bin/zstdcat"
+      --replace "zstdcat" "$bin/bin/zstdcat"
   '';
   # Don't duplicate the library code in runtime closures.
   postInstall = stdenv.lib.optionalString enableShared ''rm "$out"/lib/libzstd.a'';
 
+  outputs = [ "bin" "dev" "man" "out" ];
+
   meta = with stdenv.lib; {
     description = "Zstandard real-time compression algorithm";
     longDescription = ''
diff --git a/pkgs/tools/filesystems/btrfs-progs/default.nix b/pkgs/tools/filesystems/btrfs-progs/default.nix
index 5c73ee945c79..5a6dafae2980 100644
--- a/pkgs/tools/filesystems/btrfs-progs/default.nix
+++ b/pkgs/tools/filesystems/btrfs-progs/default.nix
@@ -4,11 +4,11 @@
 
 stdenv.mkDerivation rec {
   pname = "btrfs-progs";
-  version = "5.6";
+  version = "5.6.1";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/people/kdave/btrfs-progs/btrfs-progs-v${version}.tar.xz";
-    sha256 = "0srg276yccfmqz0skmmga3vbqx4wiqsk1l6h86n6ryhxa9viqcm1";
+    sha256 = "1nwnvjdnr9fjj2q2p2vpjabfdhcrwykgj9knjcsqy0c7p1bgbk2h";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/graphics/luxcorerender/default.nix b/pkgs/tools/graphics/luxcorerender/default.nix
index fc8a98c19930..3afb6ebd9877 100644
--- a/pkgs/tools/graphics/luxcorerender/default.nix
+++ b/pkgs/tools/graphics/luxcorerender/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, cmake, boost165, pkgconfig, python35
+{ stdenv, fetchFromGitHub, cmake, boost165, pkgconfig, python36
 , tbb, openimageio, libjpeg, libpng, zlib, libtiff, ilmbase
 , freetype, openexr, libXdmcp, libxkbcommon, epoxy, at-spi2-core
 , dbus, doxygen, qt5, c-blosc, libGLU, gnome3, dconf, gtk3, pcre
@@ -7,28 +7,34 @@
 , withOpenCL ? true , opencl-headers, ocl-icd, opencl-clhpp
 }:
 
-let boost_static = boost165.override {
-      python = python35;
+let
+      python = python36;
+
+      boost_static = boost165.override {
+      inherit python;
       enableStatic = true;
       enablePython = true;
     };
 
+    version = "2.0";
+    sha256 = "15nn39ybsfjf3cw3xgkbarvxn4a9ymfd579ankm7yjxkw5gcif38";
+
 in stdenv.mkDerivation {
   pname = "luxcorerender";
-  version = "2.0";
+  inherit version;
 
   src = fetchFromGitHub {
     owner = "LuxCoreRender";
     repo = "LuxCore";
-    rev = "luxcorerender_v2.0";
-    sha256 = "15nn39ybsfjf3cw3xgkbarvxn4a9ymfd579ankm7yjxkw5gcif38";
+    rev = "luxcorerender_v${version}";
+    inherit sha256;
   };
 
   buildInputs =
    [ embree2 pkgconfig cmake zlib boost_static libjpeg
      libtiff libpng ilmbase freetype openexr openimageio
      tbb qt5.full c-blosc libGLU pcre bison
-     flex libX11 libpthreadstubs python35 libXdmcp libxkbcommon
+     flex libX11 libpthreadstubs python libXdmcp libxkbcommon
      epoxy at-spi2-core dbus doxygen
      # needed for GSETTINGS_SCHEMAS_PATH
      gsettings-desktop-schemas glib gtk3
@@ -43,15 +49,15 @@ in stdenv.mkDerivation {
     "-DOpenEXR_IlmThread_INCLUDE_DIR=${ilmbase.dev}/include/OpenEXR"
     "-DOpenEXR_Imath_INCLUDE_DIR=${openexr.dev}/include/OpenEXR"
     "-DOpenEXR_half_INCLUDE_DIR=${ilmbase.dev}/include"
-    "-DPYTHON_LIBRARY=${python35}/lib/libpython3.so"
-    "-DPYTHON_INCLUDE_DIR=${python35}/include/python3.5"
+    "-DPYTHON_LIBRARY=${python}/lib/libpython3.so"
+    "-DPYTHON_INCLUDE_DIR=${python}/include/python${python.pythonVersion}"
     "-DEMBREE_INCLUDE_PATH=${embree2}/include"
     "-DEMBREE_LIBRARY=${embree2}/lib/libembree.so"
     "-DBoost_PYTHON_LIBRARY_RELEASE=${boost_static}/lib/libboost_python3-mt.so"
   ] ++ stdenv.lib.optional withOpenCL
        "-DOPENCL_INCLUDE_DIR=${opencl-headers}/include";
   preConfigure = ''
-    NIX_CFLAGS_COMPILE+=" -isystem ${python35}/include/python3.5"
+    NIX_CFLAGS_COMPILE+=" -isystem ${python}/include/python${python.pythonVersion}"
     NIX_LDFLAGS+=" -lpython3"
   '';
 
diff --git a/pkgs/tools/misc/bdf2sfd/default.nix b/pkgs/tools/misc/bdf2sfd/default.nix
index 15154f73a699..ca67525bb8c4 100644
--- a/pkgs/tools/misc/bdf2sfd/default.nix
+++ b/pkgs/tools/misc/bdf2sfd/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "bdf2sfd";
-  version = "1.1.1";
+  version = "1.1.2";
 
   src = fetchFromGitHub {
     owner = "fcambus";
     repo = pname;
     rev = version;
-    sha256 = "02dzvrgwpgbd0wgfnlpiv2qlwvspwl7a0qh8cg363lpnxv8akw9q";
+    sha256 = "1fhdl739a4v8296wpn2390fhlb6vlg9m1zik7mql4l9008ncd5mv";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/tools/misc/chezmoi/default.nix b/pkgs/tools/misc/chezmoi/default.nix
index 75b10bc32ca7..eb372b6b5671 100644
--- a/pkgs/tools/misc/chezmoi/default.nix
+++ b/pkgs/tools/misc/chezmoi/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "chezmoi";
-  version = "1.8.1";
+  version = "1.8.2";
 
   src = fetchFromGitHub {
     owner = "twpayne";
     repo = "chezmoi";
     rev = "v${version}";
-    sha256 = "1b8y0wq3myhvjdnwl0i4x85iil7i7kmsjajvbw1a47afm83jkbaw";
+    sha256 = "0s2a0q3lgrdz7w69sacn23k4dybw6wrk63xxnylj88wss7mqnpj8";
   };
 
-  vendorSha256 = "1za47n08iamhfl4ky928rixgadflmz86vnmnwbczd167bdndh5rq";
+  vendorSha256 = "0hpjvpai2i9jn8hlxhx4pvvawjh6lfmlz7ffi320pp7vanzqhch1";
 
   buildFlagsArray = [
     "-ldflags=-s -w -X main.version=${version} -X main.builtBy=nixpkgs"
diff --git a/pkgs/tools/misc/fontforge/default.nix b/pkgs/tools/misc/fontforge/default.nix
index 67ab7b2d6917..82fd5c8210dd 100644
--- a/pkgs/tools/misc/fontforge/default.nix
+++ b/pkgs/tools/misc/fontforge/default.nix
@@ -1,21 +1,24 @@
 { stdenv, fetchurl, lib
-, autoconf, automake, gnum4, libtool, perl, uthash, pkgconfig, gettext
+, cmake, perl, uthash, pkgconfig, gettext
 , python, freetype, zlib, glib, libungif, libpng, libjpeg, libtiff, libxml2, cairo, pango
 , readline, woff2, zeromq, libuninameslist
 , withSpiro ? false, libspiro
-, withGTK ? false, gtk2
+, withGTK ? false, gtk3
+, withGUI ? withGTK
 , withPython ? true
 , withExtras ? true
 , Carbon ? null, Cocoa ? null
 }:
 
+assert withGTK -> withGUI;
+
 stdenv.mkDerivation rec {
   pname = "fontforge";
-  version = "20190801";
+  version = "20200314";
 
   src = fetchurl {
-    url = "https://github.com/${pname}/${pname}/releases/download/${version}/${pname}-${version}.tar.gz";
-    sha256 = "0lh8yx01asbzxm6car5cfi64njh5p4lxc7iv8dldr5rwg357a86r";
+    url = "https://github.com/${pname}/${pname}/releases/download/${version}/${pname}-${version}.tar.xz";
+    sha256 = "0qf88wd6riycq56d24brybyc93ns74s0nyyavm43zp2kfcihn6fd";
   };
 
   # use $SOURCE_DATE_EPOCH instead of non-deterministic timestamps
@@ -30,41 +33,33 @@ stdenv.mkDerivation rec {
   # do not use x87's 80-bit arithmetic, rouding errors result in very different font binaries
   NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isi686 "-msse2 -mfpmath=sse";
 
-  nativeBuildInputs = [ pkgconfig autoconf automake gnum4 libtool perl gettext ];
+  nativeBuildInputs = [ pkgconfig cmake ];
   buildInputs = [
     readline uthash woff2 zeromq libuninameslist
     python freetype zlib glib libungif libpng libjpeg libtiff libxml2
   ]
     ++ lib.optionals withSpiro [libspiro]
-    ++ lib.optionals withGTK [ gtk2 cairo pango ]
+    ++ lib.optionals withGUI [ gtk3 cairo pango ]
     ++ lib.optionals stdenv.isDarwin [ Carbon Cocoa ];
 
-    configureFlags = [ "--enable-woff2" ]
-    ++ lib.optionals (!withPython) [ "--disable-python-scripting" "--disable-python-extension" ]
-    ++ lib.optional withGTK "--enable-gtk2-use"
-    ++ lib.optional (!withGTK) "--without-x"
-    ++ lib.optional withExtras "--enable-fontforge-extras";
+  cmakeFlags = [ "-DCMAKE_BUILD_WITH_INSTALL_RPATH=ON" ]
+    ++ lib.optional (!withSpiro) "-DENABLE_LIBSPIRO=OFF"
+    ++ lib.optional (!withGUI) "-DENABLE_GUI=OFF"
+    ++ lib.optional (!withGTK) "-DENABLE_X11=ON"
+    ++ lib.optional withExtras "-DENABLE_FONTFORGE_EXTRAS=ON";
 
   # work-around: git isn't really used, but configuration fails without it
   preConfigure = ''
     # The way $version propagates to $version of .pe-scripts (https://github.com/dejavu-fonts/dejavu-fonts/blob/358190f/scripts/generate.pe#L19)
     export SOURCE_DATE_EPOCH=$(date -d ${version} +%s)
-
-    export GIT="$(type -P true)"
-    ./bootstrap --skip-git --force
   '';
 
-  doCheck = false; # tries to wget some fonts
-  doInstallCheck = doCheck;
-
   postInstall =
     # get rid of the runtime dependency on python
     lib.optionalString (!withPython) ''
       rm -r "$out/share/fontforge/python"
     '';
 
-  enableParallelBuilding = true;
-
   meta = {
     description = "A font editor";
     homepage = "http://fontforge.github.io";
diff --git a/pkgs/tools/misc/hexyl/default.nix b/pkgs/tools/misc/hexyl/default.nix
index e67b0116df16..d9bed8c607d0 100644
--- a/pkgs/tools/misc/hexyl/default.nix
+++ b/pkgs/tools/misc/hexyl/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname   = "hexyl";
-  version = "0.7.0";
+  version = "0.8.0";
 
   src = fetchFromGitHub {
     owner  = "sharkdp";
     repo   = pname;
     rev    = "v${version}";
-    sha256 = "0blq81zpmzldngk9ymcg56syspjp1g1ziap4z69idv05mfkf6sp3";
+    sha256 = "0aj2sysl0spf5zlcd5kfzlw97w7dzf9x93pv0d1v9blnbd1rz7lm";
   };
 
-  cargoSha256 = "09kccd1brcbvzimm05dyybwrkganqxdkjrvzgcf1l93xs1z2h94b";
+  cargoSha256 = "1am9vs7l2wzgwqakrsl27x1y7jpn9xaqa4kr48wwqzka401h6j4m";
 
   meta = with stdenv.lib; {
     changelog = "https://github.com/sharkdp/hexyl/releases/tag/v${version}";
diff --git a/pkgs/tools/misc/lazydocker/default.nix b/pkgs/tools/misc/lazydocker/default.nix
index b63892178d91..d0c4d71c58a6 100644
--- a/pkgs/tools/misc/lazydocker/default.nix
+++ b/pkgs/tools/misc/lazydocker/default.nix
@@ -2,13 +2,13 @@
 
 buildGoPackage rec {
   pname = "lazydocker";
-  version = "0.8";
+  version = "0.9";
 
   src = fetchFromGitHub {
     owner = "jesseduffield";
     repo = "lazydocker";
     rev = "v${version}";
-    sha256 = "02x03nmkbj0133bziaqmqlh3x515w3n01iqvg7q6b55r7nan7hv7";
+    sha256 = "08j2qp632fdmswnb92wxa9lhnal4mrmq6gmxaxngnxiqgkfx37zy";
   };
 
   goPackagePath = "github.com/jesseduffield/lazydocker";
diff --git a/pkgs/tools/misc/pistol/default.nix b/pkgs/tools/misc/pistol/default.nix
index eeb392606edd..5c92b70c0983 100644
--- a/pkgs/tools/misc/pistol/default.nix
+++ b/pkgs/tools/misc/pistol/default.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "pistol";
-  version = "0.1.1";
+  version = "0.1.2";
 
   src = fetchFromGitHub {
     owner = "doronbehar";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1d9c1bhidh781dis4427wramfrla4avqw9y2bmpjp81cqq3nc27d";
+    sha256 = "1ar8c7s8ihcwrwfspmqw7cb5560wkbdc5qyvddkx8lj03cjhcslj";
   };
 
-  vendorSha256 = "1f780vhxw0brvnr8hhah4sf6ms8spar29rqmy1kcqf9m75n94g56";
+  vendorSha256 = "1mhxb72fzpa2n88i9h154aci346dgcs2njznkjxchivz28crbqr8";
 
   subPackages = [ "cmd/pistol" ];
 
diff --git a/pkgs/tools/misc/rmlint/default.nix b/pkgs/tools/misc/rmlint/default.nix
index 4dd440850120..2ea1668409a5 100644
--- a/pkgs/tools/misc/rmlint/default.nix
+++ b/pkgs/tools/misc/rmlint/default.nix
@@ -5,13 +5,13 @@
 with stdenv.lib;
 stdenv.mkDerivation rec {
   pname = "rmlint";
-  version = "2.10.0";
+  version = "2.10.1";
 
   src = fetchFromGitHub {
     owner = "sahib";
     repo = "rmlint";
     rev = "v${version}";
-    sha256 = "1r7j1bmm83p6wdw0jhvkm4sa568r534zsy45bvas7qq4433jl019";
+    sha256 = "15xfkcw1bkfyf3z8kl23k3rlv702m0h7ghqxvhniynvlwbgh6j2x";
   };
 
   CFLAGS="-I${stdenv.lib.getDev utillinux}/include";
diff --git a/pkgs/tools/misc/system-config-printer/default.nix b/pkgs/tools/misc/system-config-printer/default.nix
index e9ee91de6776..8a0c881a277b 100644
--- a/pkgs/tools/misc/system-config-printer/default.nix
+++ b/pkgs/tools/misc/system-config-printer/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, udev, intltool, pkgconfig, glib, xmlto, wrapGAppsHook
+{ stdenv, fetchFromGitHub, fetchpatch, udev, intltool, pkgconfig, glib, xmlto, wrapGAppsHook
 , docbook_xml_dtd_412, docbook_xsl
 , libxml2, desktop-file-utils, libusb1, cups, gdk-pixbuf, pango, atk, libnotify
 , gobject-introspection, libsecret, packagekit
@@ -24,7 +24,20 @@ stdenv.mkDerivation rec {
     substituteInPlace Makefile.am --replace /bin/bash ${bash}/bin/bash
   '';
 
-  patches = [ ./detect_serverbindir.patch ];
+  patches = [
+    ./detect_serverbindir.patch
+
+    # https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=958104
+    # (Fixes will be included in next upstream release.)
+    (fetchpatch {
+      url = "https://github.com/OpenPrinting/system-config-printer/commit/cf9903466c1a2d18a701f3b5e8c7e03483e1244d.patch";
+      sha256 = "03gpav618w50q90m2kdkgwclc7fv17m493fgjd633zfavb5kqr3n";
+    })
+    (fetchpatch {
+      url = "https://github.com/OpenPrinting/system-config-printer/commit/b9289dfe105bdb502f183f0afe7a115ecae5f2af.patch";
+      sha256 = "12w47hy3ly4phh8jcqxvdnd5sgbnbp8dnscjd7d5y2i43kxj7b23";
+    })
+  ];
 
   buildInputs = [
     glib udev libusb1 cups
diff --git a/pkgs/tools/misc/topgrade/default.nix b/pkgs/tools/misc/topgrade/default.nix
index 529252901a4a..21e464c6d29e 100644
--- a/pkgs/tools/misc/topgrade/default.nix
+++ b/pkgs/tools/misc/topgrade/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "topgrade";
-  version = "4.5.0";
+  version = "4.7.0";
 
   src = fetchFromGitHub {
     owner = "r-darwish";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0df79vlbclv1qx4zwir728c6ggqfawxh2x1py16m5q0ga1hd799j";
+    sha256 = "1hg03mj3rd778hq1856139nwz7y5gykwvg7xhxlsiabv7gr06m2m";
   };
 
-  cargoSha256 = "0wwxh71i94h68sryckbvrr43gd19qjcs0cgcpycnimkhdcdy8nlj";
+  cargoSha256 = "14qv2157jhj7hilvqi3c00p11rzv0vvimr4d34nyspgzxz2si6sm";
 
   buildInputs = lib.optional stdenv.isDarwin Foundation;
 
diff --git a/pkgs/tools/misc/ttwatch/default.nix b/pkgs/tools/misc/ttwatch/default.nix
index afd5139565c8..8788608876ea 100644
--- a/pkgs/tools/misc/ttwatch/default.nix
+++ b/pkgs/tools/misc/ttwatch/default.nix
@@ -1,19 +1,21 @@
-{ stdenv, fetchFromGitHub, cmake, perl, openssl, curl, libusb1
+{ stdenv, fetchFromGitHub
+, cmake, perl, pkgconfig
+, openssl, curl, libusb1, protobufc
 , enableUnsafe ? false }:
 
 stdenv.mkDerivation {
   pname = "ttwatch";
-  version = "2018-12-04";
+  version = "2020-02-05";
 
   src = fetchFromGitHub {
     owner = "ryanbinns";
     repo = "ttwatch";
-    rev = "eeb4e19bf7ca7ca2cee7f5fbeb483b27198d86a1";
-    sha256 = "18384apdkq35120cgmda686d293354aibwcq2hwhvvjmnq49fnzr";
+    rev = "bfdf1372515574e1fb3871dc1039f8d8a5dbdada";
+    sha256 = "07nd4dbkchxy8js1h1f6pzn63pls2afww97wyiiw6zid43mpqyg4";
   };
 
-  nativeBuildInputs = [ cmake perl ];
-  buildInputs = [ openssl curl libusb1 ];
+  nativeBuildInputs = [ cmake perl pkgconfig ];
+  buildInputs = [ openssl curl libusb1 protobufc ];
 
   cmakeFlags = stdenv.lib.optional enableUnsafe [ "-Dunsafe=on" ];
 
diff --git a/pkgs/tools/networking/amass/default.nix b/pkgs/tools/networking/amass/default.nix
index ebe67b27e7c7..e2bc592f7a8f 100644
--- a/pkgs/tools/networking/amass/default.nix
+++ b/pkgs/tools/networking/amass/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "amass";
-  version = "3.6.2";
+  version = "3.7.2";
 
   src = fetchFromGitHub {
     owner = "OWASP";
     repo = "Amass";
     rev = "v${version}";
-    sha256 = "1ih681790sp0lqfbsl153dpr5vzxp1jjza28pajrqjzs7zyjmkgs";
+    sha256 = "1acjqpa9xg9ji2mzxag57yq589cdq3rh78a8vz8wnkkkp7b8why8";
   };
 
-  vendorSha256 = "1f8za3z5pv1pznbd91fk5j4y8qg93qk5zvnchjl7inyirciawdf6";
+  vendorSha256 = "1s8g0qqg3m6hdvc5v3s86l3ba5grmyhx0lf2ymi39k5dpcg8l19s";
 
   outputs = [ "out" "wordlists" ];
 
diff --git a/pkgs/tools/networking/cassowary/default.nix b/pkgs/tools/networking/cassowary/default.nix
index be1df3394396..e76a505fe9d7 100644
--- a/pkgs/tools/networking/cassowary/default.nix
+++ b/pkgs/tools/networking/cassowary/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "cassowary";
-  version = "0.7.0";
+  version = "0.11.0";
 
   src = fetchFromGitHub {
     owner = "rogerwelin";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0p5vcs25h5nj36dm9yjmdjymcq0zldm3zlqfppxcjx862h48k8zj";
+    sha256 = "161wzcdq7kpny6fzxsqk2ivnah0xwmh2knv37jn0x18lclga1k9s";
   };
 
-  vendorSha256 = "1m5jaqf5jrib415k0i7w6rf5bjjwfn572wk94jwfpwjcbbvh8fck";
+  vendorSha256 = "1qgilmkai9isbbg4pzqic6i8v5z8cay0ilw1gb69z4a6f2q4zhkp";
 
   buildFlagsArray = [ "-ldflags=-s -w -X main.version=${version}" ];
 
diff --git a/pkgs/tools/networking/findomain/default.nix b/pkgs/tools/networking/findomain/default.nix
index e19442576988..69e09b60d02a 100644
--- a/pkgs/tools/networking/findomain/default.nix
+++ b/pkgs/tools/networking/findomain/default.nix
@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "findomain";
-  version = "1.5.0";
+  version = "1.7.0";
 
   src = fetchFromGitHub {
     owner = "Edu4rdSHL";
     repo = pname;
     rev = version;
-    sha256 = "1w3parmk3836v5ghn3cgcxyk0alk05r5ljl3j1fpnly5xvl131rd";
+    sha256 = "1q8yxl4y8f787a0q87gxgj1p9lgzhhfk3fgysq9xj8yfvwm8abji";
   };
 
-  cargoSha256 = "1cs076cgkzjan6y78a3bhriv2q2s83hp5vzhkjwz4dqn83r6b8hx";
+  cargoSha256 = "02d538j13v3f1dc99vpzhby42ps7lig000idwdsxa1mwkjxrf2z2";
 
   nativeBuildInputs = [ installShellFiles perl ];
   buildInputs = lib.optional stdenv.isDarwin Security;
diff --git a/pkgs/tools/package-management/cargo-deb/default.nix b/pkgs/tools/package-management/cargo-deb/default.nix
index c6e8b4803ccf..96ef0eef8c5a 100644
--- a/pkgs/tools/package-management/cargo-deb/default.nix
+++ b/pkgs/tools/package-management/cargo-deb/default.nix
@@ -2,7 +2,9 @@
 , lib
 , fetchFromGitHub
 , rustPlatform
-, Security }:
+, rust
+, Security
+}:
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-deb";
@@ -19,6 +21,13 @@ rustPlatform.buildRustPackage rec {
 
   cargoSha256 = "1vqnnqn6rzkdi239bh3lk7gaxr7w6v3c4ws4ya1ah04g6v9hkzlw";
 
+  checkType = "debug";
+
+  preCheck = ''
+    substituteInPlace tests/command.rs \
+      --replace 'target/debug' "target/${rust.toRustTarget stdenv.buildPlatform}/debug"
+  '';
+
   meta = with lib; {
     description = "Generate Debian packages from information in Cargo.toml";
     homepage = "https://github.com/mmstick/cargo-deb";
diff --git a/pkgs/tools/package-management/rpm/default.nix b/pkgs/tools/package-management/rpm/default.nix
index fdcf9832e667..fee282de52fc 100644
--- a/pkgs/tools/package-management/rpm/default.nix
+++ b/pkgs/tools/package-management/rpm/default.nix
@@ -1,15 +1,15 @@
-{ stdenv
+{ stdenv, lib
 , pkgconfig, autoreconfHook
 , fetchurl, cpio, zlib, bzip2, file, elfutils, libbfd, libarchive, nspr, nss, popt, db, xz, python, lua
 }:
 
 stdenv.mkDerivation rec {
   pname = "rpm";
-  version = "4.14.2.1";
+  version = "4.15.1";
 
   src = fetchurl {
-    url = "http://ftp.rpm.org/releases/rpm-4.14.x/rpm-${version}.tar.bz2";
-    sha256 = "1nmck2fq9h85fgs3zhh6w1avlw5y16cbz5khd459ry3jfd5w4f8i";
+    url = "http://ftp.rpm.org/releases/rpm-${lib.versions.majorMinor version}.x/rpm-${version}.tar.bz2";
+    sha256 = "0c6jwail90fhha3bpx70w4a2i8ycxwvnx6zwxm121l8wc3wlbvyx";
   };
 
   outputs = [ "out" "dev" "man" ];
diff --git a/pkgs/tools/security/certstrap/default.nix b/pkgs/tools/security/certstrap/default.nix
index fb3c00e48f91..4d2e2fe7e950 100644
--- a/pkgs/tools/security/certstrap/default.nix
+++ b/pkgs/tools/security/certstrap/default.nix
@@ -2,7 +2,7 @@
 
 buildGoPackage rec {
   pname = "certstrap";
-  version = "1.1.1";
+  version = "1.2.0";
 
   goPackagePath = "github.com/square/certstrap";
 
@@ -10,7 +10,7 @@ buildGoPackage rec {
     owner = "square";
     repo = "certstrap";
     rev = "v${version}";
-    sha256 = "0j7gi2nzykny7i0gjax9vixw72l9jcm4wnwxgm72hh1pji0ysa8n";
+    sha256 = "1ymchnn7c9g3pq7rw4lrwsd6z3wfjx90g7qgrw6r5hssl77mnscj";
   };
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/security/chipsec/default.nix b/pkgs/tools/security/chipsec/default.nix
index 387fa4d750bd..5dccf295065c 100644
--- a/pkgs/tools/security/chipsec/default.nix
+++ b/pkgs/tools/security/chipsec/default.nix
@@ -2,13 +2,13 @@
 , kernel ? null, withDriver ? false }:
 pythonPackages.buildPythonApplication rec {
   pname = "chipsec";
-  version = "1.4.9";
+  version = "1.5.1";
 
   src = fetchFromGitHub {
     owner = "chipsec";
     repo = "chipsec";
     rev = version;
-    sha256 = "1p6w8294w5z2f4jwc22mqaggv5qajvmf9iifv7fl7wdz3wsvskrk";
+    sha256 = "1rxr9i08a22m15slvlkrhnki30jixi2ds096kmmc2nqzfr9yibmb";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/security/keybase/default.nix b/pkgs/tools/security/keybase/default.nix
index bbc99c2ac410..ee1cfa9d2a41 100644
--- a/pkgs/tools/security/keybase/default.nix
+++ b/pkgs/tools/security/keybase/default.nix
@@ -6,7 +6,7 @@
 
 buildGoPackage rec {
   pname = "keybase";
-  version = "5.4.2";
+  version = "5.5.1";
 
   goPackagePath = "github.com/keybase/client";
   subPackages = [ "go/kbnm" "go/keybase" ];
@@ -17,7 +17,7 @@ buildGoPackage rec {
     owner = "keybase";
     repo = "client";
     rev = "v${version}";
-    sha256 = "08lw5aw962f75xi42bwbgba94hiql2n2jnsxrkx84czi0ijs1wlr";
+    sha256 = "03y69zmzbnfay173xkbzvnhh8zjjd2rfnqmpgr0wvh1psn7mgpsh";
   };
 
   patches = [
diff --git a/pkgs/tools/security/keycard-cli/default.nix b/pkgs/tools/security/keycard-cli/default.nix
index a76c102b2bb9..73eab6c3dec9 100644
--- a/pkgs/tools/security/keycard-cli/default.nix
+++ b/pkgs/tools/security/keycard-cli/default.nix
@@ -2,7 +2,7 @@
 
 buildGoPackage rec {
   pname = "keycard-cli";
-  version = "0.0.12";
+  version = "0.4.0";
 
   goPackagePath = "github.com/status-im/keycard-cli";
   subPackages = [ "." ];
@@ -14,7 +14,7 @@ buildGoPackage rec {
     owner = "status-im";
     repo = pname;
     rev = version;
-    sha256 = "1jnbaq57i6i9bad1hcvd28mxfqq6v8rv806c6l74vlb79ff4v1wb";
+    sha256 = "0917vl5lw8wgvyn5l8q6xa8bqh342fibaa38syr8hmz8b09qkh38";
   };
 
   buildFlagsArray = [
diff --git a/pkgs/tools/security/ripasso/cursive.nix b/pkgs/tools/security/ripasso/cursive.nix
index c8a55d3f397f..29229bff0028 100644
--- a/pkgs/tools/security/ripasso/cursive.nix
+++ b/pkgs/tools/security/ripasso/cursive.nix
@@ -12,6 +12,8 @@ buildRustPackage rec {
     sha256 = "164da20j727p8l7hh37j2r8pai9sj402nhswvg0nrlgj53nr6083";
   };
 
+  patches = [ ./fix-tests.patch ];
+
   cargoSha256 = "1wpn67v0xmxhn1dgzhh1pwz1yc3cizmfxhpb7qv9b27ynx4486ji";
 
   cargoBuildFlags = [ "-p ripasso-cursive -p ripasso-man" ];
diff --git a/pkgs/tools/security/ripasso/fix-tests.patch b/pkgs/tools/security/ripasso/fix-tests.patch
new file mode 100644
index 000000000000..433ff933b1f7
--- /dev/null
+++ b/pkgs/tools/security/ripasso/fix-tests.patch
@@ -0,0 +1,35 @@
+diff --git a/src/pass/test.rs b/src/pass/test.rs
+index c980a2f..2e6c8cc 100644
+--- a/src/pass/test.rs
++++ b/src/pass/test.rs
+@@ -56,6 +56,7 @@ fn populate_password_list_small_repo() {
+     base_path.pop();
+     base_path.pop();
+     base_path.pop();
++    base_path.pop();
+     base_path.push("testres");
+ 
+     let mut password_dir: PathBuf = base_path.clone();
+@@ -84,6 +85,7 @@ fn populate_password_list_repo_with_deleted_files() {
+     base_path.pop();
+     base_path.pop();
+     base_path.pop();
++    base_path.pop();
+     base_path.push("testres");
+ 
+     let mut password_dir: PathBuf = base_path.clone();
+@@ -112,6 +114,7 @@ fn populate_password_list_directory_without_git() {
+     base_path.pop();
+     base_path.pop();
+     base_path.pop();
++    base_path.pop();
+     base_path.push("testres");
+ 
+     let mut password_dir: PathBuf = base_path.clone();
+@@ -149,4 +152,4 @@ fn parse_signing_keys_empty() {
+     let result = PasswordStore::parse_signing_keys(&None).unwrap();
+ 
+     assert_eq!(result.len(), 0);
+-}
+\ No newline at end of file
++}
diff --git a/pkgs/tools/security/saml2aws/default.nix b/pkgs/tools/security/saml2aws/default.nix
index 42845705ff6b..d3157529215b 100644
--- a/pkgs/tools/security/saml2aws/default.nix
+++ b/pkgs/tools/security/saml2aws/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "saml2aws";
-  version = "2.25.0";
+  version = "2.26.1";
 
   src = fetchFromGitHub {
     owner = "Versent";
     repo = "saml2aws";
     rev = "v${version}";
-    sha256 = "12aidylamrq4rvy2cfdz669lr1p20yqrshigcc5x1hrlhh9y64xc";
+    sha256 = "09b217x10mn3y244rwym0fcqr4ly6n83wnykb77488kn960b0pqb";
   };
 
   hid = fetchFromGitHub {
diff --git a/pkgs/tools/system/di/default.nix b/pkgs/tools/system/di/default.nix
index 239544d20a6d..0a6ae26547bf 100644
--- a/pkgs/tools/system/di/default.nix
+++ b/pkgs/tools/system/di/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "di";
-  version = "4.47.3";
+  version = "4.48";
 
   src = fetchurl {
     url = "https://gentoo.com/${pname}/${pname}-${version}.tar.gz";
-    sha256 = "0m4npba50sf5s61g5z3xd2r7937zwja941f2h3f081xi24c2hfck";
+    sha256 = "0crvvfsxh8ryc0j19a2x52i9zacvggm8zi6j3kzygkcwnpz4km8r";
   };
 
   makeFlags = [ "INSTALL_DIR=$(out)" ];
diff --git a/pkgs/tools/system/gotop/default.nix b/pkgs/tools/system/gotop/default.nix
index bc6d24cf9175..0d8deb11b9e1 100644
--- a/pkgs/tools/system/gotop/default.nix
+++ b/pkgs/tools/system/gotop/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "gotop";
-  version = "3.5.3";
+  version = "4.0.1";
 
   src = fetchFromGitHub {
     owner = "xxxserxxx";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0m1a5bdqjgsm9fy3d2c6r4nil013cizqyqf19k6r4p9bq8rajnzp";
+    sha256 = "10qfzmq1wdgpvv319khzicalix1x4fqava0wry3bzz84k5c9dabs";
   };
 
-  vendorSha256 = "1pxp0a1hldkdmh174adhq8q0wyz005g7wm8yxknchvp7krxi9r0v";
+  vendorSha256 = "1crphp41bfivfmfp3cl7pjca3ypds6mr3847msd4wvfq4g6imk55";
 
   meta = with stdenv.lib; {
     description = "A terminal based graphical activity monitor inspired by gtop and vtop";
diff --git a/pkgs/tools/text/highlight/default.nix b/pkgs/tools/text/highlight/default.nix
index bc32a60c6727..a918770aa7b9 100644
--- a/pkgs/tools/text/highlight/default.nix
+++ b/pkgs/tools/text/highlight/default.nix
@@ -5,13 +5,13 @@ with stdenv.lib;
 let
   self = stdenv.mkDerivation rec {
     pname = "highlight";
-    version = "3.56";
+    version = "3.57";
 
     src = fetchFromGitLab {
       owner = "saalen";
       repo = "highlight";
       rev = "v${version}";
-      sha256 = "1pilx58dg96zm0yx7i6k92vibwpvpj8ir39f2akrsyjgijnv3sx4";
+      sha256 = "1xrk7c7akjiwh3wh9bll0qh4g0kqvbzjz9ancpadnk0k7bqi0kxf";
     };
 
     enableParallelBuilding = true;
diff --git a/pkgs/tools/typesetting/scdoc/default.nix b/pkgs/tools/typesetting/scdoc/default.nix
index 356433bac41c..5b6cf5e22f21 100644
--- a/pkgs/tools/typesetting/scdoc/default.nix
+++ b/pkgs/tools/typesetting/scdoc/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "scdoc";
-  version = "1.10.1";
+  version = "1.11.0";
 
   src = fetchurl {
     url = "https://git.sr.ht/~sircmpwn/scdoc/archive/${version}.tar.gz";
-    sha256 = "13x7g1r56bshvfmlvapvz35ywnbgsh337kywb5kcv8nc6b3j3q40";
+    sha256 = "17cjh3lcfppyl2mzpanylla93gdgdv5spc8jldshvayzizhfghwa";
   };
 
   postPatch = ''
@@ -24,6 +24,7 @@ stdenv.mkDerivation rec {
       C99.
     '';
     homepage = "https://git.sr.ht/~sircmpwn/scdoc";
+    changelog = "https://git.sr.ht/~sircmpwn/scdoc/refs/${version}";
     license = licenses.mit;
     platforms = platforms.unix;
     maintainers = with maintainers; [ primeos ];
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 03efd40d2714..e502fab10d7c 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -88,6 +88,7 @@ mapAliases ({
   cpp-gsl = microsoft_gsl; # added 2019-05-24
   cupsBjnp = cups-bjnp; # added 2016-01-02
   cups_filters = cups-filters; # added 2016-08
+  cquery = throw "cquery has been removed because it is abandoned by upstream. Consider switching to clangd or ccls instead."; # added 2020-06-15
   cv = progress; # added 2015-09-06
   d1x_rebirth = dxx-rebirth; # added 2018-04-25
   d2x_rebirth = dxx-rebirth; # added 2018-04-25
@@ -252,6 +253,7 @@ mapAliases ({
   libjpeg_drop = libjpeg_original; # added 2020-06-05
   libjson_rpc_cpp = libjson-rpc-cpp; # added 2017-02-28
   liblapackWithoutAtlas = lapack-reference; # added 2018-11-05
+  liblastfm = libsForQt5.liblastfm; # added 2020-06-14
   liblrdf = lrdf; # added 2018-04-25
   libqrencode = qrencode;  # added 2019-01-01
   librdf = lrdf; # added 2020-03-22
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 934575e01ecf..58d88fdfb9fa 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -624,7 +624,7 @@ in
 
   airfield = callPackage ../tools/networking/airfield { };
 
-  apache-airflow = with python3.pkgs; toPythonApplication apache-airflow;
+  apache-airflow = with python37.pkgs; toPythonApplication apache-airflow;
 
   airsonic = callPackage ../servers/misc/airsonic { };
 
@@ -777,7 +777,7 @@ in
 
   iamy = callPackage ../tools/admin/iamy { };
 
-  azure-cli = callPackage ../tools/admin/azure-cli { python = python3; };
+  azure-cli = callPackage ../tools/admin/azure-cli { python = python37; };
 
   azure-storage-azcopy = callPackage ../development/tools/azcopy { };
 
@@ -1133,9 +1133,7 @@ in
 
   atftp = callPackage ../tools/networking/atftp { };
 
-  autogen = callPackage ../development/tools/misc/autogen {
-    guile = guile_2_0;
-  };
+  autogen = callPackage ../development/tools/misc/autogen { };
 
   autojump = callPackage ../tools/misc/autojump { };
 
@@ -2174,6 +2172,8 @@ in
 
   rmapi = callPackage ../applications/misc/remarkable/rmapi { };
 
+  remarkable-mouse = python3Packages.callPackage ../applications/misc/remarkable/remarkable-mouse { };
+
   scour = with python3Packages; toPythonApplication scour;
 
   s2png = callPackage ../tools/graphics/s2png { };
@@ -3527,7 +3527,7 @@ in
   fontforge-gtk = fontforge.override {
     withSpiro = true;
     withGTK = true;
-    gtk2 = gtk2-x11;
+    gtk3 = gtk3-x11;
     inherit (darwin.apple_sdk.frameworks) Carbon Cocoa;
   };
 
@@ -5232,7 +5232,9 @@ in
 
   mirrorbits = callPackage ../servers/mirrorbits { };
 
-  mitmproxy = callPackage ../tools/networking/mitmproxy { };
+  mitmproxy = callPackage ../tools/networking/mitmproxy {
+    python3Packages = python37Packages;
+  };
 
   mjpegtools = callPackage ../tools/video/mjpegtools { };
 
@@ -6399,7 +6401,9 @@ in
 
   rpiboot-unstable = callPackage ../development/misc/rpiboot/unstable.nix { };
 
-  rpm = callPackage ../tools/package-management/rpm { };
+  rpm = callPackage ../tools/package-management/rpm {
+    python = python3;
+  };
 
   rpm-ostree = callPackage ../tools/misc/rpm-ostree {
     gperf = gperf_3_0;
@@ -7914,7 +7918,11 @@ in
 
   zssh = callPackage ../tools/networking/zssh { };
 
-  zstd = callPackage ../tools/compression/zstd { };
+  zstd = callPackage ../tools/compression/zstd {
+    cmake = cmake.override {
+      libarchive = libarchive.override { zstd = null; };
+    };
+  };
 
   zsync = callPackage ../tools/compression/zsync { };
 
@@ -9656,7 +9664,7 @@ in
   # When switching these sets, please update docs at ../../doc/languages-frameworks/python.md
   python = python2;
   python2 = python27;
-  python3 = python37;
+  python3 = python38;
   pypy = pypy2;
   pypy2 = pypy27;
   pypy3 = pypy36;
@@ -10139,6 +10147,8 @@ in
   buildkite-agent2 = throw "pkgs.buildkite-agent2 has been discontinued. Please use pkgs.buildkite-agent (v3.x)";
   buildkite-agent3 = callPackage ../development/tools/continuous-integration/buildkite-agent { };
 
+  buildkite-cli = callPackage ../development/tools/continuous-integration/buildkite-cli { };
+
   libbpf = callPackage ../os-specific/linux/libbpf { };
 
   bpftool = callPackage ../os-specific/linux/bpftool { };
@@ -10266,12 +10276,6 @@ in
 
   cpplint = callPackage ../development/tools/analysis/cpplint { };
 
-  cquery = callPackage ../development/tools/misc/cquery {
-    # 7 is the default, but only on Linux, so keep this for now
-    llvmPackages = llvmPackages_7;
-  };
-
-
   ccls = callPackage ../development/tools/misc/ccls {
     llvmPackages = llvmPackages_8;
     stdenv = llvmPackages_8.stdenv;
@@ -10375,7 +10379,7 @@ in
 
   dolt = callPackage ../servers/sql/dolt { };
 
-  dot2tex = pythonPackages.dot2tex;
+  dot2tex = with python3.pkgs; toPythonApplication dot2tex;
 
   doxygen = callPackage ../development/tools/documentation/doxygen {
     qt4 = null;
@@ -11136,7 +11140,9 @@ in
 
   vultr-cli = callPackage ../development/tools/vultr-cli { };
 
-  vulnix = callPackage ../tools/security/vulnix { };
+  vulnix = callPackage ../tools/security/vulnix {
+    python3Packages = python37Packages;
+  };
 
   vtable-dumper = callPackage ../development/tools/misc/vtable-dumper { };
 
@@ -13072,8 +13078,6 @@ in
 
   liblastfmSF = callPackage ../development/libraries/liblastfmSF { };
 
-  liblastfm = libsForQt5.callPackage ../development/libraries/liblastfm { };
-
   liblcf = callPackage ../development/libraries/liblcf { };
 
   liblqr1 = callPackage ../development/libraries/liblqr-1 { };
@@ -14347,6 +14351,8 @@ in
 
     libktorrent = callPackage ../development/libraries/libktorrent { };
 
+    liblastfm = callPackage ../development/libraries/liblastfm { };
+
     libopenshot = callPackage ../applications/video/openshot-qt/libopenshot.nix { };
 
     libopenshot-audio = callPackage ../applications/video/openshot-qt/libopenshot-audio.nix { };
@@ -15139,6 +15145,9 @@ in
 
   wxGTK = wxGTK28;
 
+  wxGTK30 = wxGTK30-gtk2;
+  wxGTK31 = wxGTK31-gtk2;
+
   wxGTK28 = callPackage ../development/libraries/wxwidgets/2.8 {
     inherit (gnome2) GConf;
   };
@@ -15149,18 +15158,32 @@ in
     inherit (darwin.apple_sdk.frameworks) AGL Carbon Cocoa Kernel QuickTime;
   };
 
-  wxGTK30 = callPackage ../development/libraries/wxwidgets/3.0 {
+  wxGTK30-gtk2 = callPackage ../development/libraries/wxwidgets/3.0 {
+    withGtk2 = true;
     inherit (gnome2) GConf;
     inherit (darwin.stubs) setfile;
     inherit (darwin.apple_sdk.frameworks) AGL Carbon Cocoa Kernel QTKit;
   };
 
-  wxGTK31 = callPackage ../development/libraries/wxwidgets/3.1 {
+  wxGTK30-gtk3 = callPackage ../development/libraries/wxwidgets/3.0 {
+    withGtk2 = false;
+    inherit (darwin.stubs) setfile;
+    inherit (darwin.apple_sdk.frameworks) AGL Carbon Cocoa Kernel QTKit;
+  };
+
+  wxGTK31-gtk2 = callPackage ../development/libraries/wxwidgets/3.1 {
+    withGtk2 = true;
     inherit (gnome2) GConf;
     inherit (darwin.stubs) setfile;
     inherit (darwin.apple_sdk.frameworks) AGL Carbon Cocoa Kernel QTKit;
   };
 
+  wxGTK31-gtk3 = callPackage ../development/libraries/wxwidgets/3.1 {
+    withGtk2 = false;
+    inherit (darwin.stubs) setfile;
+    inherit (darwin.apple_sdk.frameworks) AGL Carbon Cocoa Kernel QTKit;
+  };
+
   wxmac = callPackage ../development/libraries/wxwidgets/3.0/mac.nix {
     inherit (darwin.apple_sdk.frameworks) AGL Cocoa Kernel;
     inherit (darwin.stubs) setfile rez derez;
@@ -15743,7 +15766,9 @@ in
 
   hiawatha = callPackage ../servers/http/hiawatha {};
 
-  home-assistant = callPackage ../servers/home-assistant { };
+  home-assistant = callPackage ../servers/home-assistant { 
+    python3 = python37;
+  };
 
   home-assistant-cli = callPackage ../servers/home-assistant/cli.nix { };
 
@@ -16251,8 +16276,9 @@ in
     libtool = darwin.cctools;
   };
 
+  # Fails to compile with boost >= 1.72
   rippled = callPackage ../servers/rippled {
-    boost = boost17x;
+    boost = boost171;
   };
 
   rippled-validator-keys-tool = callPackage ../servers/rippled/validator-keys-tool.nix {
@@ -19111,7 +19137,7 @@ in
 
   ctop = callPackage ../tools/system/ctop { };
 
-  cubicsdr = callPackage ../applications/radio/cubicsdr { wxGTK = wxGTK31; };
+  cubicsdr = callPackage ../applications/radio/cubicsdr { };
 
   cum = callPackage ../applications/misc/cum { };
 
@@ -20194,6 +20220,7 @@ in
   swaybg = callPackage ../applications/window-managers/sway/bg.nix { };
   swayidle = callPackage ../applications/window-managers/sway/idle.nix { };
   swaylock = callPackage ../applications/window-managers/sway/lock.nix { };
+  sway-contrib = recurseIntoAttrs (callPackages ../applications/window-managers/sway/contrib.nix { });
 
   swaylock-fancy = callPackage ../applications/window-managers/sway/lock-fancy.nix { };
 
@@ -22177,9 +22204,7 @@ in
 
   soxr = callPackage ../applications/misc/audio/soxr { };
 
-  spek = callPackage ../applications/audio/spek {
-    ffmpeg = ffmpeg_2;
-  };
+  spek = callPackage ../applications/audio/spek { };
 
   spotify = callPackage ../applications/audio/spotify {
     libgcrypt = libgcrypt_1_5;
diff --git a/pkgs/top-level/ocaml-packages.nix b/pkgs/top-level/ocaml-packages.nix
index 602e131ad9e6..4be489c76ebb 100644
--- a/pkgs/top-level/ocaml-packages.nix
+++ b/pkgs/top-level/ocaml-packages.nix
@@ -401,15 +401,7 @@ let
 
     jingoo = callPackage ../development/ocaml-modules/jingoo { };
 
-    js_of_ocaml =
-    if lib.versionOlder "4.02" ocaml.version
-    then callPackage ../development/tools/ocaml/js_of_ocaml/3.0.nix { }
-    else js_of_ocaml_2;
-
-    js_of_ocaml_2 = callPackage ../development/tools/ocaml/js_of_ocaml {
-      base64 = base64_2;
-      lwt = lwt2;
-    };
+    js_of_ocaml = callPackage ../development/tools/ocaml/js_of_ocaml { };
 
     js_of_ocaml-camlp4 = callPackage ../development/tools/ocaml/js_of_ocaml/camlp4.nix {};
 
diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index bbc5277cd648..89bf25c15908 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -13858,6 +13858,22 @@ let
     };
   };
 
+  NetIPLite = buildPerlPackage {
+    pname = "Net-IP-Lite";
+    version = "0.03";
+    src = fetchurl {
+      url = "mirror://cpan/authors/id/A/AL/ALEXKOM/Net-IP-Lite-0.03.tar.gz";
+      sha256 = "c9916e6cfaa53be275379ce4b2a550ae176ddfab50dad43b43ed43e8267802a9";
+    };
+    buildInputs = [ TestException ];
+    meta = {
+      homepage = "https://metacpan.org/pod/Net::IP::Lite";
+      description = "Perl extension for manipulating IPv4/IPv6 addresses";
+      license = with stdenv.lib.licenses; [ artistic1 gpl1Plus ];
+      maintainers = [ maintainers.sgo ];
+    };
+  };
+
   NetIPv4Addr = buildPerlPackage {
     pname = "Net-IPv4Addr";
     version = "0.10";
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index ed1127ba0462..5e7e70563526 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -1256,6 +1256,8 @@ in {
 
   pynisher = callPackage ../development/python-modules/pynisher { };
 
+  pynput = callPackage ../development/python-modules/pynput { };
+
   pyparser = callPackage ../development/python-modules/pyparser { };
 
   pyres = callPackage ../development/python-modules/pyres { };
@@ -2622,6 +2624,8 @@ in {
 
   libais = callPackage ../development/python-modules/libais { };
 
+  libevdev = callPackage ../development/python-modules/libevdev { };
+
   libfdt = toPythonModule (pkgs.dtc.override {
     inherit python;
     pythonSupport = true;
@@ -3454,6 +3458,8 @@ in {
 
   samplerate = callPackage ../development/python-modules/samplerate { };
 
+  screeninfo = callPackage ../development/python-modules/screeninfo { };
+
   ssdeep = callPackage ../development/python-modules/ssdeep { };
 
   ssdp = callPackage ../development/python-modules/ssdp { };
@@ -3476,6 +3482,8 @@ in {
 
   setuptools-git = callPackage ../development/python-modules/setuptools-git { };
 
+  setuptools-lint = callPackage ../development/python-modules/setuptools-lint { };
+
   sievelib = callPackage ../development/python-modules/sievelib { };
 
   watchdog = callPackage ../development/python-modules/watchdog { };
@@ -5710,7 +5718,7 @@ in {
 
   rply = callPackage ../development/python-modules/rply {};
 
-  rpm = toPythonModule (pkgs.rpm.override{inherit python;});
+  rpm = disabledIf (!isPy3k) (toPythonModule (pkgs.rpm.override{ inherit python; }));
 
   rpmfluff = callPackage ../development/python-modules/rpmfluff {};
 
@@ -6795,7 +6803,9 @@ in {
 
   jenkins-job-builder = callPackage ../development/python-modules/jenkins-job-builder { };
 
-  dot2tex = callPackage ../development/python-modules/dot2tex { };
+  dot2tex = callPackage ../development/python-modules/dot2tex {
+    inherit (pkgs) graphviz;
+  };
 
   poezio = callPackage ../applications/networking/instant-messengers/poezio {
     inherit (pkgs) pkgconfig;
diff --git a/pkgs/top-level/release-lib.nix b/pkgs/top-level/release-lib.nix
index 9dff0503d23a..1e33c7b0585b 100644
--- a/pkgs/top-level/release-lib.nix
+++ b/pkgs/top-level/release-lib.nix
@@ -145,7 +145,7 @@ rec {
     let res = builtins.tryEval (
       if isDerivation value then
         value.meta.hydraPlatforms
-          or (supportedMatches (value.meta.platforms or [ "x86_64-linux" ]))
+          or (value.meta.platforms or [ "x86_64-linux" ])
       else if value.recurseForDerivations or false || value.recurseForRelease or false then
         packagePlatforms value
       else