diff --git a/nixos/modules/services/networking/sabnzbd.nix b/nixos/modules/services/networking/sabnzbd.nix
index ff5aef7d1cb..43566dfd25c 100644
--- a/nixos/modules/services/networking/sabnzbd.nix
+++ b/nixos/modules/services/networking/sabnzbd.nix
@@ -18,16 +18,19 @@ in
       enable = mkEnableOption "the sabnzbd server";
 
       configFile = mkOption {
+        type = types.path;
         default = "/var/lib/sabnzbd/sabnzbd.ini";
         description = "Path to config file.";
       };
 
       user = mkOption {
         default = "sabnzbd";
+        type = types.str;
         description = "User to run the service as";
       };
 
       group = mkOption {
+        type = types.str;
         default = "sabnzbd";
         description = "Group to run the service as";
       };
diff --git a/pkgs/applications/audio/musikcube/default.nix b/pkgs/applications/audio/musikcube/default.nix
index 882fbaf3477..7bcac454b78 100644
--- a/pkgs/applications/audio/musikcube/default.nix
+++ b/pkgs/applications/audio/musikcube/default.nix
@@ -17,13 +17,13 @@
 
 stdenv.mkDerivation rec {
   pname = "musikcube";
-  version = "0.96.2";
+  version = "0.96.4";
 
   src = fetchFromGitHub {
     owner = "clangen";
     repo = pname;
     rev = version;
-    sha256 = "1vvc8295yadprfqpmk9i43ghymgsqxsg8zfx3p5i86a8xrdhd9vn";
+    sha256 = "sha256-DYLLnmRHEK2nJUbJfJUDcA8qHZq+qZpHS5ei8qUGmFA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/editors/gobby/default.nix b/pkgs/applications/editors/gobby/default.nix
index a78692ebf76..27047f8e95a 100644
--- a/pkgs/applications/editors/gobby/default.nix
+++ b/pkgs/applications/editors/gobby/default.nix
@@ -4,15 +4,15 @@
 
 let
   libinf = libinfinity.override { gtkWidgets = true; inherit avahiSupport; };
-in stdenv.mkDerivation {
+in stdenv.mkDerivation rec {
   pname = "gobby";
-  version = "unstable-2020-12-29";
+  version = "0.6.0";
 
   src = fetchFromGitHub {
     owner = "gobby";
     repo = "gobby";
-    rev = "49bfd3c3aa82e6fe9b3d59c3455d7eb4b77379fc";
-    sha256 = "1p2f2rid7c0b9gvmywl3r37sxx57wv3r1rxvs1rwihmf9rkqnfxg";
+    rev = "v${version}";
+    sha256 = "06cbc2y4xkw89jaa0ayhgh7fxr5p2nv3jjs8h2xcbbbgwaw08lk0";
   };
 
   nativeBuildInputs = [ autoconf automake pkg-config intltool itstool yelp-tools wrapGAppsHook ];
diff --git a/pkgs/applications/graphics/ovito/default.nix b/pkgs/applications/graphics/ovito/default.nix
new file mode 100644
index 00000000000..f0dc5f2b363
--- /dev/null
+++ b/pkgs/applications/graphics/ovito/default.nix
@@ -0,0 +1,41 @@
+{ mkDerivation, lib, fetchFromGitLab, cmake
+, boost, netcdf, hdf5, fftwSinglePrec, muparser, openssl, ffmpeg, python
+, qtbase, qtsvg, qttools, qscintilla }:
+
+mkDerivation rec {
+  pname = "ovito";
+  version = "3.4.0";
+
+  src = fetchFromGitLab {
+    owner = "stuko";
+    repo = "ovito";
+    rev = "v${version}";
+    sha256 = "1y3wr6yzpsl0qm7cicp2mppfszxd0fgx8hm99in9wff9qd0r16b5";
+  };
+
+  nativeBuildInputs = [
+    cmake
+  ];
+
+  buildInputs = [
+    boost
+    netcdf
+    hdf5
+    fftwSinglePrec
+    muparser
+    openssl
+    ffmpeg
+    python
+    qtbase
+    qtsvg
+    qttools
+    qscintilla
+  ];
+
+  meta = with lib; {
+    description = "Scientific visualization and analysis software for atomistic and particle simulation data";
+    homepage = "https://ovito.org";
+    license = with licenses;  [ gpl3Only mit ];
+    maintainers = with maintainers; [ twhitehead ];
+  };
+}
diff --git a/pkgs/applications/networking/cluster/fluxcd/default.nix b/pkgs/applications/networking/cluster/fluxcd/default.nix
index 9d44904ec7b..f9dd63c1d81 100644
--- a/pkgs/applications/networking/cluster/fluxcd/default.nix
+++ b/pkgs/applications/networking/cluster/fluxcd/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "fluxcd";
-  version = "0.7.4";
+  version = "0.7.5";
 
   src = fetchFromGitHub {
     owner = "fluxcd";
     repo = "flux2";
     rev = "v${version}";
-    sha256 = "110fb9h7h7hrflrrvwll04ymirrhciq8szm6g54msdjvffp61r4i";
+    sha256 = "1drbfjigrabiqy9mlgbipm8x3mf2hvz7gwgndqky3f3y3h5whvbd";
   };
 
-  vendorSha256 = "1kyj65fc2q1sc4aiy87i2wzf7kqybjf08mmmw0ajcxszcr0mcadb";
+  vendorSha256 = "144dkynr4wkykdbh39q8m2nhkxfq15h0vj7ga58lli8gxrs5mwln";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/applications/networking/cluster/terragrunt/default.nix b/pkgs/applications/networking/cluster/terragrunt/default.nix
index ce8397ccca2..822f33c6c72 100644
--- a/pkgs/applications/networking/cluster/terragrunt/default.nix
+++ b/pkgs/applications/networking/cluster/terragrunt/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "terragrunt";
-  version = "0.27.3";
+  version = "0.27.4";
 
   src = fetchFromGitHub {
     owner = "gruntwork-io";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-J1kwcguBSHTsU/kGviQaj/cX6PpZGs3UI2AJy5+/pCc=";
+    sha256 = "sha256-ReLPQIxuSTzMOZAYArN1dj6T/aojusKdKZ0YytmF1uc=";
   };
 
-  vendorSha256 = "sha256-AMxBzUHRsq1HOMtvgYqIw22Cky7gQ7/2hI8wQnxaXb0=";
+  vendorSha256 = "sha256-UX0HXD4o0QVRffDuH8N+1FeJNyHHnb+A9Kw7aAM5j/w=";
 
   doCheck = false;
 
diff --git a/pkgs/applications/science/robotics/apmplanner2/default.nix b/pkgs/applications/science/robotics/apmplanner2/default.nix
index e6d1c544ee4..e048b881d33 100644
--- a/pkgs/applications/science/robotics/apmplanner2/default.nix
+++ b/pkgs/applications/science/robotics/apmplanner2/default.nix
@@ -5,13 +5,13 @@
 
 mkDerivation rec {
   pname = "apmplanner2";
-  version = "2.0.28-rc1";
+  version = "2.0.28";
 
   src = fetchFromGitHub {
     owner = "ArduPilot";
     repo = "apm_planner";
     rev = version;
-    sha256 = "18yn8bdz5hmgb0m5hlk8bibz4cj4g25w75pm1rvc4ds0mr1qgyjd";
+    sha256 = "0wvbfjnnf7sh6fpgw8gimh5hgzywj3nwrgr80r782f5gayd3v2l1";
   };
 
   buildInputs = [
diff --git a/pkgs/applications/version-management/pijul/default.nix b/pkgs/applications/version-management/pijul/default.nix
index 993db7c2ebd..eaad772f734 100644
--- a/pkgs/applications/version-management/pijul/default.nix
+++ b/pkgs/applications/version-management/pijul/default.nix
@@ -13,14 +13,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "pijul";
-  version = "1.0.0-alpha.37";
+  version = "1.0.0-alpha.38";
 
   src = fetchCrate {
     inherit version pname;
-    sha256 = "02hdnfpy0hlgwhahrd5ddjmq8r05pyny0r91q3avirli1i7rkvs6";
+    sha256 = "0f14jkr1yswwyqz0l47b0287vpyz0g1qmksr3hkskhbmwlkf1q2b";
   };
 
-  cargoSha256 = "16v9nqrfdmrmll72yj6a6wl4rv28n838myjyw2n68kjmijakvnk4";
+  cargoSha256 = "08p2dq48d1islk02xz1j39402fqxfh4isf8qi219aivl0yciwjn3";
 
   cargoBuildFlags = lib.optional gitImportSupport "--features=git";
 
diff --git a/pkgs/desktops/gnome-3/core/yelp-xsl/default.nix b/pkgs/desktops/gnome-3/core/yelp-xsl/default.nix
index b02c7039e51..d4b6561c0de 100644
--- a/pkgs/desktops/gnome-3/core/yelp-xsl/default.nix
+++ b/pkgs/desktops/gnome-3/core/yelp-xsl/default.nix
@@ -38,7 +38,15 @@ stdenv.mkDerivation rec {
     homepage = "https://wiki.gnome.org/Apps/Yelp";
     description = "Yelp's universal stylesheets for Mallard and DocBook";
     maintainers = teams.gnome.members;
-    license = [licenses.gpl2 licenses.lgpl2];
-    platforms = platforms.linux;
+    license = with licenses; [
+      # See https://gitlab.gnome.org/GNOME/yelp-xsl/blob/master/COPYING
+      # Stylesheets
+      lgpl2Plus
+      # Icons, unclear: https://gitlab.gnome.org/GNOME/yelp-xsl/issues/25
+      gpl2
+      # highlight.js
+      bsd3
+    ];
+    platforms = platforms.unix;
   };
 }
diff --git a/pkgs/development/libraries/gtk/2.x.nix b/pkgs/development/libraries/gtk/2.x.nix
index 43b7ff5f127..4304cb388d1 100644
--- a/pkgs/development/libraries/gtk/2.x.nix
+++ b/pkgs/development/libraries/gtk/2.x.nix
@@ -96,5 +96,6 @@ stdenv.mkDerivation rec {
       proprietary software with GTK without any license fees or
       royalties.
     '';
+    changelog = "https://gitlab.gnome.org/GNOME/gtk/-/raw/${version}/NEWS";
   };
 }
diff --git a/pkgs/development/libraries/gtk/3.x.nix b/pkgs/development/libraries/gtk/3.x.nix
index 0e5c6edc964..5180df63460 100644
--- a/pkgs/development/libraries/gtk/3.x.nix
+++ b/pkgs/development/libraries/gtk/3.x.nix
@@ -216,5 +216,6 @@ stdenv.mkDerivation rec {
     license = licenses.lgpl2Plus;
     maintainers = with maintainers; [ raskin vcunat lethalman worldofpeace ];
     platforms = platforms.all;
+    changelog = "https://gitlab.gnome.org/GNOME/gtk/-/raw/${version}/NEWS";
   };
 }
diff --git a/pkgs/development/libraries/gtk/4.x.nix b/pkgs/development/libraries/gtk/4.x.nix
index 43534767f51..59b0b080a52 100644
--- a/pkgs/development/libraries/gtk/4.x.nix
+++ b/pkgs/development/libraries/gtk/4.x.nix
@@ -228,5 +228,6 @@ stdenv.mkDerivation rec {
     license = licenses.lgpl2Plus;
     maintainers = with maintainers; [ raskin vcunat lethalman worldofpeace ];
     platforms = platforms.all;
+    changelog = "https://gitlab.gnome.org/GNOME/gtk/-/raw/${version}/NEWS";
   };
 }
diff --git a/pkgs/development/libraries/libgda/6.x.nix b/pkgs/development/libraries/libgda/6.x.nix
new file mode 100644
index 00000000000..fc24fe41c4d
--- /dev/null
+++ b/pkgs/development/libraries/libgda/6.x.nix
@@ -0,0 +1,92 @@
+{ lib
+, stdenv
+, fetchurl
+, pkg-config
+, intltool
+, meson
+, ninja
+, itstool
+, libxml2
+, python3
+, gtk3
+, json-glib
+, isocodes
+, openssl
+, gnome3
+, gobject-introspection
+, vala
+, libgee
+, sqlite
+, gtk-doc
+, yelp-tools
+, mysqlSupport ? false
+, libmysqlclient ? null
+, postgresSupport ? false
+, postgresql ? null
+}:
+
+assert mysqlSupport -> libmysqlclient != null;
+assert postgresSupport -> postgresql != null;
+
+stdenv.mkDerivation rec {
+  pname = "libgda";
+  version = "6.0.0";
+
+  src = fetchurl {
+    url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
+    sha256 = "0w564z7krgjk19r39mi5qn4kggpdg9ggbyn9pb4aavb61r14npwr";
+  };
+
+  nativeBuildInputs = [
+    pkg-config
+    intltool
+    meson
+    ninja
+    itstool
+    libxml2
+    python3
+    gobject-introspection
+    vala
+    gtk-doc
+    yelp-tools
+  ];
+
+  buildInputs = [
+    gtk3
+    json-glib
+    isocodes
+    openssl
+    libgee
+    sqlite
+  ] ++ lib.optionals mysqlSupport [
+    libmysqlclient
+  ] ++ lib.optionals postgresSupport [
+    postgresql
+  ];
+
+  postPatch = ''
+    patchShebangs \
+      providers/raw_spec.py \
+      providers/mysql/gen_bin.py
+  '';
+
+  passthru = {
+    updateScript = gnome3.updateScript {
+      packageName = pname;
+      attrPath = "libgda6";
+    };
+  };
+
+  meta = with lib; {
+    description = "Database access library";
+    homepage = "https://www.gnome-db.org/";
+    license = with licenses; [
+      # library
+      lgpl2Plus
+      # CLI tools
+      gpl2Plus
+    ];
+    maintainers = teams.gnome.members;
+    platforms = platforms.unix;
+  };
+}
diff --git a/pkgs/development/libraries/libgda/default.nix b/pkgs/development/libraries/libgda/default.nix
index 73e71de4aac..307cc14a6ef 100644
--- a/pkgs/development/libraries/libgda/default.nix
+++ b/pkgs/development/libraries/libgda/default.nix
@@ -1,7 +1,27 @@
-{ lib, stdenv, fetchurl, pkg-config, intltool, itstool, libxml2, gtk3, openssl, gnome3, gobject-introspection, vala, libgee
-, overrideCC, gcc6, fetchpatch, autoreconfHook, gtk-doc, autoconf-archive, yelp-tools
-, mysqlSupport ? false, libmysqlclient ? null
-, postgresSupport ? false, postgresql ? null
+{ lib
+, stdenv
+, fetchurl
+, pkg-config
+, intltool
+, itstool
+, libxml2
+, gtk3
+, openssl
+, gnome3
+, gobject-introspection
+, vala
+, libgee
+, overrideCC
+, gcc6
+, fetchpatch
+, autoreconfHook
+, gtk-doc
+, autoconf-archive
+, yelp-tools
+, mysqlSupport ? false
+, libmysqlclient ? null
+, postgresSupport ? false
+, postgresql ? null
 }:
 
 assert mysqlSupport -> libmysqlclient != null;
@@ -24,7 +44,30 @@ assert postgresSupport -> postgresql != null;
     })
   ];
 
-  configureFlags = with lib; [
+  nativeBuildInputs = [
+    pkg-config
+    intltool
+    itstool
+    libxml2
+    gobject-introspection
+    vala
+    autoreconfHook
+    gtk-doc
+    autoconf-archive
+    yelp-tools
+  ];
+
+  buildInputs = [
+    gtk3
+    openssl
+    libgee
+  ] ++ lib.optionals mysqlSupport [
+    libmysqlclient
+  ] ++ lib.optionals postgresSupport [
+    postgresql
+  ];
+
+  configureFlags = [
     "--with-mysql=${if mysqlSupport then "yes" else "no"}"
     "--with-postgres=${if postgresSupport then "yes" else "no"}"
 
@@ -40,11 +83,6 @@ assert postgresSupport -> postgresql != null;
 
   hardeningDisable = [ "format" ];
 
-  nativeBuildInputs = [ pkg-config intltool itstool libxml2 gobject-introspection vala autoreconfHook gtk-doc autoconf-archive yelp-tools ];
-  buildInputs = with lib; [ gtk3 openssl libgee ]
-    ++ optional (mysqlSupport) libmysqlclient
-    ++ optional (postgresSupport) postgresql;
-
   passthru = {
     updateScript = gnome3.updateScript {
       packageName = pname;
@@ -54,8 +92,13 @@ assert postgresSupport -> postgresql != null;
   meta = with lib; {
     description = "Database access library";
     homepage = "https://www.gnome-db.org/";
-    license = [ licenses.lgpl2 licenses.gpl2 ];
+    license = with licenses; [
+      # library
+      lgpl2Plus
+      # CLI tools
+      gpl2Plus
+    ];
     maintainers = teams.gnome.members;
-    platforms = platforms.linux ++ platforms.darwin;
+    platforms = platforms.unix;
   };
 }
diff --git a/pkgs/development/misc/yelp-tools/default.nix b/pkgs/development/misc/yelp-tools/default.nix
index 9d5eb2af496..bf348d68041 100644
--- a/pkgs/development/misc/yelp-tools/default.nix
+++ b/pkgs/development/misc/yelp-tools/default.nix
@@ -1,4 +1,12 @@
-{ lib, stdenv, fetchurl, libxml2, libxslt, itstool, gnome3, pkg-config }:
+{ lib
+, stdenv
+, fetchurl
+, libxml2
+, libxslt
+, itstool
+, gnome3
+, pkg-config
+}:
 
 stdenv.mkDerivation rec {
   pname = "yelp-tools";
@@ -9,22 +17,30 @@ stdenv.mkDerivation rec {
     sha256 = "1c045c794sm83rrjan67jmsk20qacrw1m814p4nw85w5xsry8z30";
   };
 
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
+  buildInputs = [
+    libxml2
+    libxslt
+    itstool
+    gnome3.yelp-xsl
+  ];
+
+  doCheck = true;
+
   passthru = {
     updateScript = gnome3.updateScript {
       packageName = pname;
     };
   };
 
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ libxml2 libxslt itstool gnome3.yelp-xsl ];
-
-  doCheck = true;
-
   meta = with lib; {
     homepage = "https://wiki.gnome.org/Apps/Yelp/Tools";
     description = "Small programs that help you create, edit, manage, and publish your Mallard or DocBook documentation";
-    maintainers = with maintainers; [ domenkozar ];
-    license = licenses.gpl2;
-    platforms = platforms.linux;
+    maintainers = teams.gnome.members ++ (with maintainers; [ domenkozar ]);
+    license = licenses.gpl2Plus;
+    platforms = platforms.unix;
   };
 }
diff --git a/pkgs/development/python-modules/awesomeversion/default.nix b/pkgs/development/python-modules/awesomeversion/default.nix
index 4fb397e3ab5..8f832f827ed 100644
--- a/pkgs/development/python-modules/awesomeversion/default.nix
+++ b/pkgs/development/python-modules/awesomeversion/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "awesomeversion";
-  version = "21.1.8";
+  version = "21.2.0";
   disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "ludeeus";
     repo = pname;
     rev = version;
-    sha256 = "sha256-hNsFkGSzqt5ujqk+AO1FW/yzwPxEN+AA7EVazvkwz2o=";
+    sha256 = "1rzd0mcxdjnnzg35hvdvacwrr9brwmkw9bwlb5x6bcp24ry9yl0q";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/binwalk/default.nix b/pkgs/development/python-modules/binwalk/default.nix
index 499d442c822..74d79bd677b 100644
--- a/pkgs/development/python-modules/binwalk/default.nix
+++ b/pkgs/development/python-modules/binwalk/default.nix
@@ -17,10 +17,10 @@
 , matplotlib
 , nose
 , pycrypto
-, pyqtgraph ? null }:
+, pyqtgraph
+, visualizationSupport ? false }:
 
 let
-  visualizationSupport = (pyqtgraph != null) && (matplotlib != null);
   version = "2.2.0";
 in
 buildPythonPackage {
diff --git a/pkgs/development/python-modules/blis/default.nix b/pkgs/development/python-modules/blis/default.nix
index 2b8aeb2edcd..5d292c93fbb 100644
--- a/pkgs/development/python-modules/blis/default.nix
+++ b/pkgs/development/python-modules/blis/default.nix
@@ -35,6 +35,5 @@ buildPythonPackage rec {
     homepage = "https://github.com/explosion/cython-blis";
     license = licenses.bsd3;
     platforms = platforms.x86_64;
-    maintainers = with maintainers; [ danieldk ];
   };
 }
diff --git a/pkgs/development/python-modules/boto3/default.nix b/pkgs/development/python-modules/boto3/default.nix
index 41d0ed5f81d..1baabf69203 100644
--- a/pkgs/development/python-modules/boto3/default.nix
+++ b/pkgs/development/python-modules/boto3/default.nix
@@ -13,11 +13,11 @@
 
 buildPythonPackage rec {
   pname =  "boto3";
-  version = "1.16.62"; # N.B: if you change this, change botocore too
+  version = "1.16.63"; # N.B: if you change this, change botocore too
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-u5H+z5guG7+2i7a9LJoMzjyErG+X3TONHvnkd4BnkJE=";
+    sha256 = "sha256-yRnayXcxFQJeHip+Ri9gygguMiu29DVCR1I+QiYTOws=";
   };
 
   propagatedBuildInputs = [ botocore jmespath s3transfer ] ++ lib.optionals (!isPy3k) [ futures ];
diff --git a/pkgs/development/python-modules/botocore/default.nix b/pkgs/development/python-modules/botocore/default.nix
index 1b0f2a347d0..47585feac98 100644
--- a/pkgs/development/python-modules/botocore/default.nix
+++ b/pkgs/development/python-modules/botocore/default.nix
@@ -12,11 +12,11 @@
 
 buildPythonPackage rec {
   pname = "botocore";
-  version = "1.19.62"; # N.B: if you change this, change boto3 and awscli to a matching version
+  version = "1.19.63"; # N.B: if you change this, change boto3 and awscli to a matching version
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-KbS5vltA85KgM5JsCMAEwBvWRxOE728S6qSe44cKAQw=";
+    sha256 = "sha256-02lPbvkY3vgIJRPl7zCc1s2DthLpmE46ZuityYxlCpI=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/catalogue/default.nix b/pkgs/development/python-modules/catalogue/default.nix
index a9c5bae71f4..d07b7f29dc3 100644
--- a/pkgs/development/python-modules/catalogue/default.nix
+++ b/pkgs/development/python-modules/catalogue/default.nix
@@ -26,6 +26,5 @@ buildPythonPackage rec {
     homepage = "https://github.com/explosion/catalogue";
     changelog = "https://github.com/explosion/catalogue/releases/tag/v${version}";
     license = licenses.mit;
-    maintainers = with maintainers; [ danieldk ];
   };
 }
diff --git a/pkgs/development/python-modules/criticality-score/default.nix b/pkgs/development/python-modules/criticality-score/default.nix
new file mode 100644
index 00000000000..6b3348472a4
--- /dev/null
+++ b/pkgs/development/python-modules/criticality-score/default.nix
@@ -0,0 +1,24 @@
+{ lib, buildPythonPackage, fetchPypi, PyGithub, python-gitlab }:
+
+buildPythonPackage rec {
+  pname = "criticality_score";
+  version = "1.0.7";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "0i811a27i87z3j1rw0dwrnw8v0ckbd918ms6shjawhs4cnb1c6x8";
+  };
+
+  propagatedBuildInputs = [ PyGithub python-gitlab ];
+
+  doCheck = false;
+
+  pythonImportsCheck = [ "criticality_score" ];
+
+  meta = with lib; {
+    description = "Python tool for computing the Open Source Project Criticality Score.";
+    homepage = "https://github.com/ossf/criticality_score";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ wamserma ];
+  };
+}
diff --git a/pkgs/development/python-modules/hwi/default.nix b/pkgs/development/python-modules/hwi/default.nix
index d3b7d5c8566..7c34235a190 100644
--- a/pkgs/development/python-modules/hwi/default.nix
+++ b/pkgs/development/python-modules/hwi/default.nix
@@ -2,14 +2,11 @@
 , buildPythonPackage
 , fetchFromGitHub
 , bitbox02
-, btchip
-, ckcc-protocol
 , ecdsa
 , hidapi
 , libusb1
 , mnemonic
 , pyaes
-, trezor
 , pythonAtLeast
 }:
 
@@ -34,14 +31,11 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [
     bitbox02
-    btchip
-    ckcc-protocol
     ecdsa
     hidapi
     libusb1
     mnemonic
     pyaes
-    trezor
   ];
 
   # tests require to clone quite a few firmwares
diff --git a/pkgs/development/python-modules/hydra-check/default.nix b/pkgs/development/python-modules/hydra-check/default.nix
index 7316a6fc971..c01876d3f64 100644
--- a/pkgs/development/python-modules/hydra-check/default.nix
+++ b/pkgs/development/python-modules/hydra-check/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "hydra-check";
-  version = "1.1.1";
+  version = "1.2.0";
   disabled = pythonOlder "3.5";
 
   src = fetchFromGitHub {
     owner = "nix-community";
-    repo = "hydra-check";
+    repo = pname;
     rev = version;
-    sha256 = "1dmsscsib8ckp496gsfqxmq8d35zs71n99xmziq9iprvy7n5clq2";
+    sha256 = "EegoQ8qTrFGFYbCDsbAOE4Afg9haLjYdC0Cux/yvSk8=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/mmh3/default.nix b/pkgs/development/python-modules/mmh3/default.nix
index 8ac24188003..cd2b01d0578 100644
--- a/pkgs/development/python-modules/mmh3/default.nix
+++ b/pkgs/development/python-modules/mmh3/default.nix
@@ -18,6 +18,5 @@ buildPythonPackage rec {
     description = "Python wrapper for MurmurHash3, a set of fast and robust hash functions";
     homepage = "https://pypi.org/project/mmh3/";
     license = licenses.cc0;
-    maintainers = [ maintainers.danieldk ];
   };
 }
diff --git a/pkgs/development/python-modules/nose2/default.nix b/pkgs/development/python-modules/nose2/default.nix
index 29ea73619ff..004991e1ce9 100644
--- a/pkgs/development/python-modules/nose2/default.nix
+++ b/pkgs/development/python-modules/nose2/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, python
 , six
 , pythonOlder
 , coverage
@@ -8,20 +9,21 @@
 
 buildPythonPackage rec {
   pname = "nose2";
-  version = "0.9.2";
+  version = "0.10.0";
 
   # Requires mock 2.0.0 if python < 3.6, but NixPkgs has mock 3.0.5.
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0pmbb6nk31yhgh4zkcblzxsznml7f7pf5q1ihgrwvbxv4mwzfql7";
+    sha256 = "886ba617a96de0130c54b24479bd5c2d74d5c940d40f3809c3a275511a0c4a60";
   };
 
   propagatedBuildInputs = [ six coverage ];
 
-  # AttributeError: 'module' object has no attribute 'collector'
-  doCheck = false;
+  checkPhase = ''
+    ${python.interpreter} -m unittest
+  '';
 
   meta = with lib; {
     description = "nose2 is the next generation of nicer testing for Python";
diff --git a/pkgs/development/python-modules/pkuseg/default.nix b/pkgs/development/python-modules/pkuseg/default.nix
index 1944ac5197c..d59fe56203a 100644
--- a/pkgs/development/python-modules/pkuseg/default.nix
+++ b/pkgs/development/python-modules/pkuseg/default.nix
@@ -31,6 +31,5 @@ buildPythonPackage rec {
     description = "Toolkit for multi-domain Chinese word segmentation";
     homepage = "https://github.com/lancopku/pkuseg-python";
     license = licenses.unfree;
-    maintainers = with maintainers; [ danieldk ];
   };
 }
diff --git a/pkgs/development/python-modules/pyatv/default.nix b/pkgs/development/python-modules/pyatv/default.nix
index 9e4f872e6f2..2fca74b33aa 100644
--- a/pkgs/development/python-modules/pyatv/default.nix
+++ b/pkgs/development/python-modules/pyatv/default.nix
@@ -18,12 +18,12 @@
 
 buildPythonPackage rec {
   pname = "pyatv";
-  version = "0.7.5";
+  version = "0.7.6";
   src = fetchFromGitHub {
     owner = "postlund";
     repo = pname;
     rev = "v${version}";
-    sha256 = "06qj6r9kcal2nimg8rpjfid8rnlz43l7hn0v9v1mpayjmv2fl8sp";
+    sha256 = "1lahv6f97fizgh5b2w5yz9455l8ygn99rslhiygkgjywi2flx3p3";
   };
 
   nativeBuildInputs = [ pytestrunner];
diff --git a/pkgs/development/python-modules/pychromecast/default.nix b/pkgs/development/python-modules/pychromecast/default.nix
index fecf3f09ca7..9eefaa5f364 100644
--- a/pkgs/development/python-modules/pychromecast/default.nix
+++ b/pkgs/development/python-modules/pychromecast/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "PyChromecast";
-  version = "7.7.2";
+  version = "8.0.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1w7jayb0z529bh1ybb16pfm0m08qqi4px1q0qwlvcxlcrd2v3m5a";
+    sha256 = "0dlxgh57j25cvk2pqr2dj4lv6yn0pix2rcl2kzqsg2405rdjks91";
   };
 
   disabled = !isPy3k;
diff --git a/pkgs/development/python-modules/python-levenshtein/default.nix b/pkgs/development/python-modules/python-levenshtein/default.nix
index dda64a85fb2..b4760cef629 100644
--- a/pkgs/development/python-modules/python-levenshtein/default.nix
+++ b/pkgs/development/python-modules/python-levenshtein/default.nix
@@ -5,11 +5,11 @@
 
 buildPythonPackage rec {
   pname = "python-Levenshtein";
-  version = "0.12.0";
+  version = "0.12.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1c9ybqcja31nghfcc8xxbbz9h60s9qi12b9hr4jyl69xbvg12fh3";
+    sha256 = "0489zzjlfgzpc7vggs7s7db13pld2nlnw7iwgdz1f386i0x2fkjm";
   };
 
   # No tests included in archive
diff --git a/pkgs/development/python-modules/spacy/default.nix b/pkgs/development/python-modules/spacy/default.nix
index e13127abeb3..eef7b116b89 100644
--- a/pkgs/development/python-modules/spacy/default.nix
+++ b/pkgs/development/python-modules/spacy/default.nix
@@ -71,6 +71,6 @@ buildPythonPackage rec {
     description = "Industrial-strength Natural Language Processing (NLP) with Python and Cython";
     homepage = "https://github.com/explosion/spaCy";
     license = licenses.mit;
-    maintainers = with maintainers; [ danieldk sdll ];
+    maintainers = with maintainers; [ sdll ];
   };
 }
diff --git a/pkgs/development/python-modules/srsly/default.nix b/pkgs/development/python-modules/srsly/default.nix
index 86b689d09d1..ab7dea9cf53 100644
--- a/pkgs/development/python-modules/srsly/default.nix
+++ b/pkgs/development/python-modules/srsly/default.nix
@@ -40,6 +40,5 @@ buildPythonPackage rec {
     description = "Modern high-performance serialization utilities for Python";
     homepage = "https://github.com/explosion/srsly";
     license = licenses.mit;
-    maintainers = with maintainers; [ danieldk ];
   };
 }
diff --git a/pkgs/development/python-modules/thinc/default.nix b/pkgs/development/python-modules/thinc/default.nix
index bd520f2c4bf..75e1a029a25 100644
--- a/pkgs/development/python-modules/thinc/default.nix
+++ b/pkgs/development/python-modules/thinc/default.nix
@@ -78,6 +78,6 @@ buildPythonPackage rec {
     description = "Practical Machine Learning for NLP in Python";
     homepage = "https://github.com/explosion/thinc";
     license = licenses.mit;
-    maintainers = with maintainers; [ aborsu danieldk sdll ];
+    maintainers = with maintainers; [ aborsu sdll ];
   };
 }
diff --git a/pkgs/development/python-modules/wasabi/default.nix b/pkgs/development/python-modules/wasabi/default.nix
index cce8c4fc466..3e674ae266f 100644
--- a/pkgs/development/python-modules/wasabi/default.nix
+++ b/pkgs/development/python-modules/wasabi/default.nix
@@ -20,6 +20,5 @@ buildPythonPackage rec {
     homepage = "https://github.com/ines/wasabi";
     changelog = "https://github.com/ines/wasabi/releases/tag/v${version}";
     license = licenses.mit;
-    maintainers = with maintainers; [ danieldk ];
   };
 }
diff --git a/pkgs/development/tools/build-managers/sbt/default.nix b/pkgs/development/tools/build-managers/sbt/default.nix
index 6bd0b83cec1..9e45c3e8b90 100644
--- a/pkgs/development/tools/build-managers/sbt/default.nix
+++ b/pkgs/development/tools/build-managers/sbt/default.nix
@@ -3,12 +3,12 @@
 
 stdenv.mkDerivation rec {
   pname = "sbt";
-  version = "1.4.6";
+  version = "1.4.7";
 
   src = fetchurl {
     url =
       "https://github.com/sbt/sbt/releases/download/v${version}/sbt-${version}.tgz";
-    sha256 = "sha256-hqbyjnmWYHQQEGarGqGSZ9DI1E6uIdqpPJxgVspvnaQ=";
+    sha256 = "sha256-wqdZ/kCjwhoWtaiNAM1m869vByHk6mG2OULfuDotVP0=";
   };
 
   patchPhase = ''
diff --git a/pkgs/development/tools/ijq/default.nix b/pkgs/development/tools/ijq/default.nix
new file mode 100644
index 00000000000..0b0af79301e
--- /dev/null
+++ b/pkgs/development/tools/ijq/default.nix
@@ -0,0 +1,28 @@
+{ buildGoModule, fetchgit, lib, jq, makeWrapper }:
+
+buildGoModule rec {
+  pname = "ijq";
+  version = "0.2.3";
+
+  src = fetchgit {
+    url = "https://git.sr.ht/~gpanders/ijq";
+    rev = "v${version}";
+    sha256 = "14n54jh5387jf97zhc7aidn7w60zp5624xbvq4jdbsh96apg3bk1";
+  };
+
+  vendorSha256 = "0xbni6lk6y3ig7pj2234fv7ra6b8qv0k8m3bvh59wwans8xpihzb";
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  postInstall = ''
+    wrapProgram "$out/bin/ijq" \
+      --prefix PATH : "${lib.makeBinPath [ jq ]}"
+  '';
+
+  meta = with lib; {
+    description = "Interactive wrapper for jq";
+    homepage = "https://git.sr.ht/~gpanders/ijq";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ justinas ];
+  };
+}
diff --git a/pkgs/games/minecraft/default.nix b/pkgs/games/minecraft/default.nix
index 1c700de7b43..3d0b53035ed 100644
--- a/pkgs/games/minecraft/default.nix
+++ b/pkgs/games/minecraft/default.nix
@@ -88,11 +88,11 @@ in
 stdenv.mkDerivation rec {
   pname = "minecraft-launcher";
 
-  version = "2.2.1262";
+  version = "2.2.1441";
 
   src = fetchurl {
     url = "https://launcher.mojang.com/download/linux/x86_64/minecraft-launcher_${version}.tar.gz";
-    sha256 = "09fklcnqmpvwykbfwg4lgwl82khr2wimvgyz7ssficm802xkicnc";
+    sha256 = "03q579hvxnsh7d00j6lmfh53rixdpf33xb5zlz7659pvb9j5w0cm";
   };
 
   icon = fetchurl {
diff --git a/pkgs/games/papermc/default.nix b/pkgs/games/papermc/default.nix
index f06d41495a8..e32ec946b2d 100644
--- a/pkgs/games/papermc/default.nix
+++ b/pkgs/games/papermc/default.nix
@@ -1,10 +1,10 @@
 { lib, stdenv, fetchurl, bash, jre }:
 let
-  mcVersion = "1.16.4";
-  buildNum = "296";
+  mcVersion = "1.16.5";
+  buildNum = "457";
   jar = fetchurl {
     url = "https://papermc.io/api/v1/paper/${mcVersion}/${buildNum}/download";
-    sha256 = "0885417w7qahk2fwlzvggbwrhvwgpd7xas8lzzb7ar469vyvd9dz";
+    sha256 = "1xkjaj5wgm9rmzk8mz20n9vd674fynvdgqsy96c9bfifa03lsnmc";
   };
 in stdenv.mkDerivation {
   pname = "papermc";
@@ -31,6 +31,6 @@ in stdenv.mkDerivation {
     homepage    = "https://papermc.io/";
     license     = lib.licenses.gpl3Only;
     platforms   = lib.platforms.unix;
-    maintainers = with lib.maintainers; [ aaronjanse ];
+    maintainers = with lib.maintainers; [ aaronjanse neonfuz ];
   };
 }
diff --git a/pkgs/misc/emulators/yuzu/base.nix b/pkgs/misc/emulators/yuzu/base.nix
new file mode 100644
index 00000000000..89c8f2cd947
--- /dev/null
+++ b/pkgs/misc/emulators/yuzu/base.nix
@@ -0,0 +1,72 @@
+{ pname, version, src, branchName
+, stdenv, lib, fetchFromGitHub, wrapQtAppsHook
+, cmake, pkg-config
+, libpulseaudio, libjack2, alsaLib, sndio, ecasound
+, vulkan-loader, vulkan-headers
+, qtbase, qtwebengine, qttools
+, nlohmann_json, rapidjson
+, zlib, zstd, libzip, lz4
+, glslang
+, boost173
+, catch2
+, fmt
+, SDL2
+, udev
+, libusb1
+, ffmpeg
+}:
+
+stdenv.mkDerivation rec {
+  inherit pname version src;
+
+  nativeBuildInputs = [ cmake pkg-config wrapQtAppsHook ];
+  buildInputs = [
+    libpulseaudio libjack2 alsaLib sndio ecasound
+    vulkan-loader vulkan-headers
+    qtbase qtwebengine qttools
+    nlohmann_json rapidjson
+    zlib zstd libzip lz4
+    glslang
+    boost173
+    catch2
+    fmt
+    SDL2
+    udev
+    libusb1
+    ffmpeg
+  ];
+
+  cmakeFlags = [
+    "-DENABLE_QT_TRANSLATION=ON"
+    "-DYUZU_USE_QT_WEB_ENGINE=ON"
+    "-DUSE_DISCORD_PRESENCE=ON"
+  ];
+
+  # Trick the configure system. This prevents a check for submodule directories.
+  preConfigure = ''
+    rm -f .gitmodules
+  '';
+
+  # Fix vulkan detection
+  postFixup = ''
+    wrapProgram $out/bin/yuzu --prefix LD_LIBRARY_PATH : ${vulkan-loader}/lib
+    wrapProgram $out/bin/yuzu-cmd --prefix LD_LIBRARY_PATH : ${vulkan-loader}/lib
+  '';
+
+  meta = with lib; {
+    homepage = "https://yuzu-emu.org";
+    description = "The ${branchName} branch of an experimental Nintendo Switch emulator written in C++";
+    longDescription = ''
+      An experimental Nintendo Switch emulator written in C++.
+      Using the mainline branch is recommanded for general usage.
+      Using the early-access branch is recommanded if you would like to try out experimental features, with a cost of stability.
+    '';
+    license = with licenses; [
+      gpl2Plus
+      # Icons
+      cc-by-nd-30 cc0
+    ];
+    maintainers = with maintainers; [ ivar joshuafern ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/misc/emulators/yuzu/default.nix b/pkgs/misc/emulators/yuzu/default.nix
index 5bb01b9fca0..89a500bb313 100644
--- a/pkgs/misc/emulators/yuzu/default.nix
+++ b/pkgs/misc/emulators/yuzu/default.nix
@@ -1,47 +1,28 @@
-{ lib, stdenv, fetchFromGitHub
-, cmake, pkg-config, wrapQtAppsHook
-, boost173, catch2, fmt, lz4, nlohmann_json, rapidjson, zlib, zstd, SDL2
-, udev, libusb1, libzip, qtbase, qtwebengine, qttools, ffmpeg
-, libpulseaudio, libjack2, alsaLib, sndio, ecasound
-, useVulkan ? true, vulkan-loader, vulkan-headers
-}:
-
-stdenv.mkDerivation rec {
-  pname = "yuzu";
-  version = "482";
-
-  src = fetchFromGitHub {
-    owner = "yuzu-emu";
-    repo = "yuzu-mainline"; # They use a separate repo for mainline “branch”
-    rev = "mainline-0-${version}";
-    sha256 = "1bhkdbhj1dv33qv0np26gzsw65p4z88whjmd6bc7mh2b5lvrjwxm";
-    fetchSubmodules = true;
+{ branch ? "mainline", libsForQt5, fetchFromGitHub }:
+let
+  inherit libsForQt5 fetchFromGitHub;
+in {
+  mainline = libsForQt5.callPackage ./base.nix rec {
+    pname = "yuzu-mainline";
+    version = "517";
+    branchName = branch;
+    src = fetchFromGitHub {
+      owner = "yuzu-emu";
+      repo = "yuzu-mainline";
+      rev = "mainline-0-${version}";
+      sha256 = "0i73yl2ycs8p9cqn25rw35cll0l6l68605f1mc1qvf4zy82jggbb";
+      fetchSubmodules = true;
+    };
   };
-
-  nativeBuildInputs = [ cmake pkg-config wrapQtAppsHook ];
-  buildInputs = [ qtbase qtwebengine qttools boost173 catch2 fmt lz4 nlohmann_json rapidjson zlib zstd SDL2 udev libusb1 libpulseaudio alsaLib sndio ecasound libjack2 libzip ffmpeg ]
-    ++ lib.optionals useVulkan [ vulkan-loader vulkan-headers ];
-  cmakeFlags = [ "-DENABLE_QT_TRANSLATION=ON" "-DYUZU_USE_QT_WEB_ENGINE=ON" "-DUSE_DISCORD_PRESENCE=ON" ]
-    ++ lib.optionals (!useVulkan) [ "-DENABLE_VULKAN=No" ];
-
-  # Trick the configure system. This prevents a check for submodule directories.
-  preConfigure = "rm .gitmodules";
-
-  # Fix vulkan detection
-  postFixup = lib.optionals useVulkan ''
-    wrapProgram $out/bin/yuzu --prefix LD_LIBRARY_PATH : ${vulkan-loader}/lib
-    wrapProgram $out/bin/yuzu-cmd --prefix LD_LIBRARY_PATH : ${vulkan-loader}/lib
-  '';
-
-  meta = with lib; {
-    homepage = "https://yuzu-emu.org";
-    description = "An experimental Nintendo Switch emulator written in C++";
-    license = with licenses; [
-      gpl2Plus
-      # Icons
-      cc-by-nd-30 cc0
-    ];
-    maintainers = with maintainers; [ ivar joshuafern ];
-    platforms = platforms.linux;
+  early-access = libsForQt5.callPackage ./base.nix rec {
+    pname = "yuzu-ea";
+    version = "1377";
+    branchName = branch;
+    src = fetchFromGitHub {
+      owner = "pineappleEA";
+      repo = "pineapple-src";
+      rev = "EA-${version}";
+      sha256 = "0jjddmcqbkns5iqjwqh51hpjviw5j12n49jwfq7xwrsns6vbpqkf";
+    };
   };
-}
+}.${branch}
diff --git a/pkgs/os-specific/linux/kernel/hardened/patches.json b/pkgs/os-specific/linux/kernel/hardened/patches.json
index 73c4d7b69ea..7fabee2cb88 100644
--- a/pkgs/os-specific/linux/kernel/hardened/patches.json
+++ b/pkgs/os-specific/linux/kernel/hardened/patches.json
@@ -7,20 +7,20 @@
     },
     "4.19": {
         "extra": "-hardened1",
-        "name": "linux-hardened-4.19.171-hardened1.patch",
-        "sha256": "0j0l8pc5hyiga5l2zb697wl4ckbkw1q99nc85r2cyx50g750la2w",
-        "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.19.171-hardened1/linux-hardened-4.19.171-hardened1.patch"
+        "name": "linux-hardened-4.19.172-hardened1.patch",
+        "sha256": "0c64rmlfaxj3jfjl8q3fncwmxjmbn7184d0m3vavznrl7lcy50xa",
+        "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.19.172-hardened1/linux-hardened-4.19.172-hardened1.patch"
     },
     "5.10": {
         "extra": "-hardened1",
-        "name": "linux-hardened-5.10.11-hardened1.patch",
-        "sha256": "0jry808ywmvajys990cz5glnl7magqs8czw7xa2ipm3vrh7r1p0s",
-        "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.10.11-hardened1/linux-hardened-5.10.11-hardened1.patch"
+        "name": "linux-hardened-5.10.12-hardened1.patch",
+        "sha256": "03b6ndq4r7w1az0i8cahfm3pf3cn6a1rwra06lgdp9dk4naf4hby",
+        "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.10.12-hardened1/linux-hardened-5.10.12-hardened1.patch"
     },
     "5.4": {
         "extra": "-hardened1",
-        "name": "linux-hardened-5.4.93-hardened1.patch",
-        "sha256": "1z7j9rxm4nk2fwdsklwmxc70l2mxs6awljfc6c3bwbs6rpcq3a7x",
-        "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.4.93-hardened1/linux-hardened-5.4.93-hardened1.patch"
+        "name": "linux-hardened-5.4.94-hardened1.patch",
+        "sha256": "08lzygjg7n9rx27r5gik360vfmaczpp14z01dc5r5hkmxkiaz8ww",
+        "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.4.94-hardened1/linux-hardened-5.4.94-hardened1.patch"
     }
 }
diff --git a/pkgs/os-specific/linux/kernel/linux-4.14.nix b/pkgs/os-specific/linux/kernel/linux-4.14.nix
index 193f6c3d160..a470017199f 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.14.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.14.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "4.14.217";
+  version = "4.14.218";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "04adj8x7p1has4mh8ygxhqgwb1i08fz9izqw1y6xj5hh8cjnm8v2";
+    sha256 = "0l2rcpccf71amngii7vs18x4x6gb0bwxdb2gszabip03bshqdzp3";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-4.19.nix b/pkgs/os-specific/linux/kernel/linux-4.19.nix
index f5315e30cc3..6fd81e81d24 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.19.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.19.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "4.19.171";
+  version = "4.19.172";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "02n65bmvm309bg6kzxg5ng5lcw564l3rp7dr6asyb1mr1vz55qzl";
+    sha256 = "08hl7vw5r61gnzagnm8nbhlbm0h226crp4m19zh0qr2q0pmwqd2g";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-4.4.nix b/pkgs/os-specific/linux/kernel/linux-4.4.nix
index 6b2e8f08ecb..bc15817a8f6 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.4.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.4.nix
@@ -1,11 +1,11 @@
 { buildPackages, fetchurl, perl, buildLinux, ... } @ args:
 
 buildLinux (args // rec {
-  version = "4.4.253";
+  version = "4.4.254";
   extraMeta.branch = "4.4";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "0nlqnfhrkaj2s582kc0wxqi0881hgp6l9z85qx4ckflc8jwrh7k6";
+    sha256 = "11wca1mprlcyk7r5h1c8rx3hr7l6mj4i85jaaf106s7wqcm8wamd";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-4.9.nix b/pkgs/os-specific/linux/kernel/linux-4.9.nix
index 2c0c3457ef0..e3b4024a132 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.9.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.9.nix
@@ -1,11 +1,11 @@
 { buildPackages, fetchurl, perl, buildLinux, ... } @ args:
 
 buildLinux (args // rec {
-  version = "4.9.253";
+  version = "4.9.254";
   extraMeta.branch = "4.9";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "065w35vb0qp4fvnwmcx7f92inmx64f9r04zzwcwbs0826nl52nws";
+    sha256 = "1djw5mlff73j7m1176qspdzhf6zyv4m0gkdvlxq4g4mdrbqfx6xn";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-5.10.nix b/pkgs/os-specific/linux/kernel/linux-5.10.nix
index d4c8bd3f2e3..88393811c12 100644
--- a/pkgs/os-specific/linux/kernel/linux-5.10.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.10.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "5.10.11";
+  version = "5.10.12";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "03viivkmz9kvn8vak26l80p7fr8jbqisa0y605bi9i8gn1b2pvq2";
+    sha256 = "1an460q3affd7gmd6fqv8g37j3z2fnmq19iy677k8kxb2wl4yi8x";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-5.4.nix b/pkgs/os-specific/linux/kernel/linux-5.4.nix
index 637b0deb499..c5a245cc237 100644
--- a/pkgs/os-specific/linux/kernel/linux-5.4.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.4.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "5.4.93";
+  version = "5.4.94";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "08nmwd13z10866pc16fqbj41krnvk6hxkl4nmhdkpk346r04jx6k";
+    sha256 = "0f9bml584g6jb822j7xyxx9j2g3s49p08xz4bkx9lbiinxyzagf2";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/zfs/default.nix b/pkgs/os-specific/linux/zfs/default.nix
index d61c0931e20..d8729fbe165 100644
--- a/pkgs/os-specific/linux/zfs/default.nix
+++ b/pkgs/os-specific/linux/zfs/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, fetchpatch
+{ lib, stdenv, fetchFromGitHub
 , autoreconfHook269, util-linux, nukeReferences, coreutils
 , perl, buildPackages
 , configFile ? "all"
@@ -21,12 +21,6 @@ let
   buildKernel = any (n: n == configFile) [ "kernel" "all" ];
   buildUser = any (n: n == configFile) [ "user" "all" ];
 
-  # remove this patch at the next ZFS release (> 2.0.1)
-  reapplyPathSanitizerPatch = fetchpatch {
-    url = "https://github.com/openzfs/zfs/commit/03f036cbccdd8699f5fe8540ef317595a35bceb8.patch";
-    sha256 = "c157bbb6551a4e720c3faba005e1b72e4692d304c6ff5e0e685691bd47197dca";
-  };
-
   common = { version
     , sha256
     , extraPatches ? []
@@ -192,11 +186,9 @@ in {
     # incompatibleKernelVersion = "4.20";
 
     # this package should point to the latest release.
-    version = "2.0.1";
+    version = "2.0.2";
 
-    sha256 = "0wmw823ildwm9rcfyk22pvzg100yhps3y9hfjlrpspfd1hhkbp0d";
-
-    extraPatches = [ reapplyPathSanitizerPatch ];
+    sha256 = "sha256-KzrRQwfQRvIQkHG5mj6cGBdcv2VEhC5y7bi09DaKqhY=";
   };
 
   zfsUnstable = common {
@@ -204,10 +196,8 @@ in {
     # incompatibleKernelVersion = "4.19";
 
     # this package should point to a version / git revision compatible with the latest kernel release
-    version = "2.0.1";
+    version = "2.0.2";
 
-    sha256 = "0wmw823ildwm9rcfyk22pvzg100yhps3y9hfjlrpspfd1hhkbp0d";
-
-    extraPatches = [ reapplyPathSanitizerPatch ];
+    sha256 = "sha256-KzrRQwfQRvIQkHG5mj6cGBdcv2VEhC5y7bi09DaKqhY=";
   };
 }
diff --git a/pkgs/shells/zsh/oh-my-zsh/default.nix b/pkgs/shells/zsh/oh-my-zsh/default.nix
index 6a95c1e32f5..bab6ebb686b 100644
--- a/pkgs/shells/zsh/oh-my-zsh/default.nix
+++ b/pkgs/shells/zsh/oh-my-zsh/default.nix
@@ -5,15 +5,15 @@
 , git, nix, nixfmt, jq, coreutils, gnused, curl, cacert }:
 
 stdenv.mkDerivation rec {
-  version = "2021-01-27";
+  version = "2021-01-31";
   pname = "oh-my-zsh";
-  rev = "f75f8bb930c6c7aed5e4e7bded94936f6d9f7724";
+  rev = "c52e646bb7b109e15f6dc4047b29ca8c8e029433";
 
   src = fetchFromGitHub {
     inherit rev;
     owner = "ohmyzsh";
     repo = "ohmyzsh";
-    sha256 = "UyhYTshk62eGw7MpJATkBvd5qE3gGOM/v6Hw6WyAg2o=";
+    sha256 = "0yfpahn9a6aby8ym1slcn8kvric26xy14fk1jjj3f07xvh7xg2y9";
   };
 
   installPhase = ''
diff --git a/pkgs/tools/admin/awscli/default.nix b/pkgs/tools/admin/awscli/default.nix
index 587ceb3a8a6..82dbdc8620f 100644
--- a/pkgs/tools/admin/awscli/default.nix
+++ b/pkgs/tools/admin/awscli/default.nix
@@ -28,11 +28,11 @@ let
 
 in with py.pkgs; buildPythonApplication rec {
   pname = "awscli";
-  version = "1.18.222"; # N.B: if you change this, change botocore to a matching version too
+  version = "1.18.223"; # N.B: if you change this, change botocore to a matching version too
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-nVBQ2Lj5+zyvj3g0W3Rxh+CZwG7sbqKehvg6vAhHexs=";
+    sha256 = "sha256-Myc6iT04VO2DliCiYvn4JtuoLVBWYNp8EbE4giYmrtk=";
   };
 
   # https://github.com/aws/aws-cli/issues/4837
diff --git a/pkgs/tools/networking/boundary/default.nix b/pkgs/tools/networking/boundary/default.nix
new file mode 100644
index 00000000000..878b1ed65c1
--- /dev/null
+++ b/pkgs/tools/networking/boundary/default.nix
@@ -0,0 +1,52 @@
+{ stdenv, lib, fetchzip }:
+
+let
+  inherit (stdenv.hostPlatform) system;
+  suffix = {
+    x86_64-linux = "linux_amd64";
+    aarch64-linux = "linux_arm64";
+    x86_64-darwin = "darwin_amd64";
+  }."${system}" or (throw "Unsupported system: ${system}");
+  fetchsrc = version: sha256: fetchzip {
+      url = "https://releases.hashicorp.com/boundary/${version}/boundary_${version}_${suffix}.zip";
+      sha256 = sha256."${system}";
+    };
+in
+stdenv.mkDerivation rec {
+  pname = "boundary";
+  version = "0.1.4";
+
+  src = fetchsrc version {
+    x86_64-linux = "sha256-+YGXSyaGhfNk+T5P7wCqsNEYwpV/Oet7kOM8OPC1A6I=";
+    aarch64-linux = "sha256-tikxRBF2Y+urv7S1EUu2d60twZWox1pI96yYX357r8o=";
+    x86_64-darwin = "sha256-N+6iiybnWZkruhUe9TRcGaq5xES/iHzlEVGcghT4EUc=";
+  };
+
+  dontConfigure = true;
+  dontBuild = true;
+
+  installPhase = ''
+    install -D boundary $out/bin/boundary
+  '';
+
+  dontPatchELF = true;
+  dontPatchShebangs = true;
+
+  meta = with lib; {
+    homepage = "https://boundaryproject.io/";
+    changelog = "https://github.com/hashicorp/boundary/blob/v${version}/CHANGELOG.md";
+    description = "Enables identity-based access management for dynamic infrastructure";
+    longDescription = ''
+      Boundary provides a secure way to access hosts and critical systems
+      without having to manage credentials or expose your network, and is
+      entirely open source.
+
+      Boundary is designed to be straightforward to understand, highly scalable,
+      and resilient. It can run in clouds, on-prem, secure enclaves and more,
+      and does not require an agent to be installed on every end host.
+    '';
+    license = licenses.mpl20;
+    maintainers = with maintainers; [ jk ];
+    platforms = [ "x86_64-linux" "aarch64-linux" "x86_64-darwin" ];
+  };
+}
diff --git a/pkgs/tools/networking/boundary/update.sh b/pkgs/tools/networking/boundary/update.sh
new file mode 100755
index 00000000000..43733930710
--- /dev/null
+++ b/pkgs/tools/networking/boundary/update.sh
@@ -0,0 +1,39 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p curl gnused gawk nix-prefetch
+
+set -euo pipefail
+
+ROOT="$(dirname "$(readlink -f "$0")")"
+NIX_DRV="$ROOT/default.nix"
+if [ ! -f "$NIX_DRV" ]; then
+  echo "ERROR: cannot find default.nix in $ROOT"
+  exit 1
+fi
+
+fetch_arch() {
+  VER="$1"; ARCH="$2"
+  URL="https://releases.hashicorp.com/boundary/${VER}/boundary_${VER}_${ARCH}.zip"
+  nix-prefetch "{ stdenv, fetchzip }:
+stdenv.mkDerivation rec {
+  pname = \"boundary\"; version = \"${VER}\";
+  src = fetchzip { url = \"$URL\"; };
+}
+"
+}
+
+replace_sha() {
+  sed -i "s#$1 = \"sha256-.\{44\}\"#$1 = \"$2\"#" "$NIX_DRV"
+}
+
+# https://releases.hashicorp.com/boundary/0.1.4/boundary_0.1.4_linux_amd64.zip
+BOUNDARY_VER=$(curl -Ls -w "%{url_effective}" -o /dev/null https://github.com/hashicorp/boundary/releases/latest | awk -F'/' '{print $NF}' | sed 's/v//')
+
+BOUNDARY_LINUX_X64_SHA256=$(fetch_arch "$BOUNDARY_VER" "linux_amd64")
+BOUNDARY_DARWIN_X64_SHA256=$(fetch_arch "$BOUNDARY_VER" "darwin_amd64")
+BOUNDARY_LINUX_AARCH64_SHA256=$(fetch_arch "$BOUNDARY_VER" "linux_arm64")
+
+sed -i "s/version = \".*\"/version = \"$BOUNDARY_VER\"/" "$NIX_DRV"
+
+replace_sha "x86_64-linux" "$BOUNDARY_LINUX_X64_SHA256"
+replace_sha "x86_64-darwin" "$BOUNDARY_DARWIN_X64_SHA256"
+replace_sha "aarch64-linux" "$BOUNDARY_LINUX_AARCH64_SHA256"
diff --git a/pkgs/tools/security/masscan/default.nix b/pkgs/tools/security/masscan/default.nix
index f92ac978f6e..b58163630c6 100644
--- a/pkgs/tools/security/masscan/default.nix
+++ b/pkgs/tools/security/masscan/default.nix
@@ -1,17 +1,23 @@
-{ lib, stdenv, fetchFromGitHub, makeWrapper, libpcap }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, installShellFiles
+, makeWrapper
+, libpcap
+}:
 
 stdenv.mkDerivation rec {
   pname = "masscan";
-  version = "1.3.1";
+  version = "1.3.2";
 
   src = fetchFromGitHub {
     owner = "robertdavidgraham";
     repo = "masscan";
     rev = version;
-    sha256 = "sha256-gH0zOf2kl6cqws1nB3QPtaAjpvNAgbawXRx77bqJTIc=";
+    sha256 = "sha256-mnGC/moQANloR5ODwRjzJzBa55OEZ9QU+9WpAHxQE/g=";
   };
 
-  nativeBuildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper installShellFiles ];
 
   makeFlags = [ "PREFIX=$(out)" "GITVER=${version}" "CC=cc" ];
 
@@ -20,13 +26,13 @@ stdenv.mkDerivation rec {
   '';
 
   postInstall = ''
-    mkdir -p $out/share/man/man8
+    installManPage doc/masscan.8
+
     mkdir -p $out/share/{doc,licenses}/masscan
     mkdir -p $out/etc/masscan
 
     cp data/exclude.conf $out/etc/masscan
     cp -t $out/share/doc/masscan doc/algorithm.js doc/howto-afl.md doc/bot.html
-    cp doc/masscan.8 $out/share/man/man8/masscan.8
     cp LICENSE $out/share/licenses/masscan/LICENSE
 
     wrapProgram $out/bin/masscan --prefix LD_LIBRARY_PATH : "${libpcap}/lib"
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index c9a1bd7aea5..b69909f1d73 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -242,6 +242,7 @@ mapAliases ({
   gnuvd = throw "gnuvd was removed because the backend service is missing"; # added 2020-01-14
   go_1_12 = throw "go_1_12 has been removed"; # added 2020-04-26
   go-pup = pup; # added 2017-12-19
+  gobby5 = gobby; # added 2021-02-01
   gobjectIntrospection = gobject-introspection; # added 2018-12-02
   goimports = gotools; # added 2018-09-16
   gometalinter = throw "gometalinter was abandoned by upstream. Consider switching to golangci-lint instead"; # added 2020-04-23
@@ -752,6 +753,7 @@ mapAliases ({
   xv = xxv; # added 2020-02-22
   youtubeDL = youtube-dl;  # added 2014-10-26
   ytop = throw "ytop has been abandoned by upstream. Consider switching to bottom instead";
+  yuzu = yuzu-mainline; # added 2021-01-25
   zdfmediathk = mediathekview; # added 2019-01-19
   gnome_user_docs = gnome-user-docs; # added 2019-11-20
   # spidermonkey is not ABI upwards-ompatible, so only allow this for nix-shell
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 6d41e7817f5..c88a9aa3f8a 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -1033,6 +1033,8 @@ in
 
   boxes = callPackage ../tools/text/boxes { };
 
+  boundary = callPackage ../tools/networking/boundary { };
+
   chamber = callPackage ../tools/admin/chamber {  };
 
   charm = callPackage ../applications/misc/charm { };
@@ -5207,6 +5209,8 @@ in
     packages = config.ihaskell.packages or (self: []);
   };
 
+  ijq = callPackage ../development/tools/ijq { };
+
   iruby = callPackage ../applications/editors/jupyter-kernels/iruby { };
 
   ike-scan = callPackage ../tools/security/ike-scan { };
@@ -6833,6 +6837,8 @@ in
 
   ovh-ttyrec = callPackage ../tools/misc/ovh-ttyrec { };
 
+  ovito = libsForQt5.callPackage ../applications/graphics/ovito { };
+
   owncloud-client = libsForQt514.callPackage ../applications/networking/owncloud-client { };
 
   oxidized = callPackage ../tools/admin/oxidized { };
@@ -14751,6 +14757,8 @@ in
 
   libgda = callPackage ../development/libraries/libgda { };
 
+  libgda6 = callPackage ../development/libraries/libgda/6.x.nix { };
+
   libgdamm = callPackage ../development/libraries/libgdamm { };
 
   libgdata = callPackage ../development/libraries/libgdata { };
@@ -22415,7 +22423,7 @@ in
 
   gocr = callPackage ../applications/graphics/gocr { };
 
-  gobby5 = callPackage ../applications/editors/gobby { };
+  gobby = callPackage ../applications/editors/gobby { };
 
   gphoto2 = callPackage ../applications/misc/gphoto2 { };
 
@@ -29495,8 +29503,13 @@ in
 
   yaxg = callPackage ../tools/graphics/yaxg {};
 
-  yuzu = libsForQt5.callPackage ../misc/emulators/yuzu {
-    stdenv = gcc10Stdenv;
+  yuzu-mainline = import ../misc/emulators/yuzu {
+    branch = "mainline";
+    inherit (pkgs) libsForQt5 fetchFromGitHub;
+  };
+  yuzu-ea = import ../misc/emulators/yuzu {
+    branch = "early-access";
+    inherit (pkgs) libsForQt5 fetchFromGitHub;
   };
 
   zap = callPackage ../tools/networking/zap { };
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 03420f9b4bc..c7260ac0239 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -931,14 +931,10 @@ in {
 
   binho-host-adapter = callPackage ../development/python-modules/binho-host-adapter { };
 
-  binwalk = callPackage ../development/python-modules/binwalk {
-    pyqtgraph = null;
-    matplotlib = null;
-  };
+  binwalk = callPackage ../development/python-modules/binwalk { };
 
   binwalk-full = appendToName "full" (self.binwalk.override {
-    pyqtgraph = self.pyqtgraph;
-    matplotlib = self.matplotlib;
+    visualizationSupport = true;
   });
 
   biopython = callPackage ../development/python-modules/biopython { };
@@ -1488,6 +1484,8 @@ in {
 
   credstash = callPackage ../development/python-modules/credstash { };
 
+  criticality-score = callPackage ../development/python-modules/criticality-score { };
+
   croniter = callPackage ../development/python-modules/croniter { };
 
   cryptacular = callPackage ../development/python-modules/cryptacular { };