diff --git a/lib/strings.nix b/lib/strings.nix
index 0f23b6b9d41..2e502588bf8 100644
--- a/lib/strings.nix
+++ b/lib/strings.nix
@@ -606,7 +606,7 @@ rec {
      This function will fail if the input string is longer than the
      requested length.
 
-     Type: fixedWidthString :: int -> string -> string
+     Type: fixedWidthString :: int -> string -> string -> string
 
      Example:
        fixedWidthString 5 "0" (toString 15)
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 1cdce85531c..60c6f093f3b 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -3029,6 +3029,12 @@
       fingerprint = "F178 B4B4 6165 6D1B 7C15  B55D 4029 3358 C7B9 326B";
     }];
   };
+  erikbackman = {
+    email = "contact@ebackman.net";
+    github = "erikbackman";
+    githubId = 46724898;
+    name = "Erik Backman";
+  };
   erikryb = {
     email = "erik.rybakken@math.ntnu.no";
     github = "erikryb";
@@ -3107,6 +3113,16 @@
     githubId = 2147649;
     name = "Euan Kemp";
   };
+  evalexpr = {
+    name = "Jonathan Wilkins";
+    email = "nixos@wilkins.tech";
+    github = "evalexpr";
+    githubId = 23485511;
+    keys = [{
+      longkeyid = "rsa4096/0x2D1D402E17763DD6";
+      fingerprint = "8129 5B85 9C5A F703 C2F4  1E29 2D1D 402E 1776 3DD6";
+    }];
+  };
   evanjs = {
     email = "evanjsx@gmail.com";
     github = "evanjs";
@@ -6144,11 +6160,11 @@
       fingerprint = "B573 5118 0375 A872 FBBF  7770 B629 036B E399 EEE9";
     }];
   };
-  mausch = {
-    email = "mauricioscheffer@gmail.com";
-    github = "mausch";
-    githubId = 95194;
-    name = "Mauricio Scheffer";
+  masipcat = {
+    email = "jordi@masip.cat";
+    github = "masipcat";
+    githubId = 775189;
+    name = "Jordi Masip";
   };
   matejc = {
     email = "cotman.matej@gmail.com";
@@ -6204,6 +6220,12 @@
     githubId = 136037;
     name = "Matthew Maurer";
   };
+  mausch = {
+    email = "mauricioscheffer@gmail.com";
+    github = "mausch";
+    githubId = 95194;
+    name = "Mauricio Scheffer";
+  };
   maxdamantus = {
     email = "maxdamantus@gmail.com";
     github = "Maxdamantus";
diff --git a/nixos/modules/installer/sd-card/sd-image.nix b/nixos/modules/installer/sd-card/sd-image.nix
index b811ae07eb0..45c8c67169b 100644
--- a/nixos/modules/installer/sd-card/sd-image.nix
+++ b/nixos/modules/installer/sd-card/sd-image.nix
@@ -126,6 +126,13 @@ in
       '';
     };
 
+    expandOnBoot = mkOption {
+      type = types.bool;
+      default = true;
+      description = ''
+        Whether to configure the sd image to expand it's partition on boot.
+      '';
+    };
   };
 
   config = {
@@ -215,7 +222,7 @@ in
       '';
     }) {};
 
-    boot.postBootCommands = ''
+    boot.postBootCommands = lib.mkIf config.sdImage.expandOnBoot ''
       # On the first boot do some maintenance tasks
       if [ -f /nix-path-registration ]; then
         set -euo pipefail
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index dd6fa483281..3a828992320 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -130,6 +130,7 @@
   ./programs/droidcam.nix
   ./programs/environment.nix
   ./programs/evince.nix
+  ./programs/feedbackd.nix
   ./programs/file-roller.nix
   ./programs/firejail.nix
   ./programs/fish.nix
@@ -163,6 +164,7 @@
   ./programs/partition-manager.nix
   ./programs/plotinus.nix
   ./programs/proxychains.nix
+  ./programs/phosh.nix
   ./programs/qt5ct.nix
   ./programs/screen.nix
   ./programs/sedutil.nix
diff --git a/nixos/modules/programs/feedbackd.nix b/nixos/modules/programs/feedbackd.nix
new file mode 100644
index 00000000000..bb14489a6f4
--- /dev/null
+++ b/nixos/modules/programs/feedbackd.nix
@@ -0,0 +1,32 @@
+{ pkgs, lib, config, ... }:
+
+with lib;
+
+let
+  cfg = config.programs.feedbackd;
+in {
+  options = {
+    programs.feedbackd = {
+      enable = mkEnableOption ''
+        Whether to enable the feedbackd D-BUS service and udev rules.
+
+        Your user needs to be in the `feedbackd` group to trigger effects.
+      '';
+      package = mkOption {
+        description = ''
+          Which feedbackd package to use.
+        '';
+        type = types.package;
+        default = pkgs.feedbackd;
+      };
+    };
+  };
+  config = mkIf cfg.enable {
+    environment.systemPackages = [ cfg.package ];
+
+    services.dbus.packages = [ cfg.package ];
+    services.udev.packages = [ cfg.package ];
+
+    users.groups.feedbackd = {};
+  };
+}
diff --git a/nixos/modules/programs/phosh.nix b/nixos/modules/programs/phosh.nix
new file mode 100644
index 00000000000..f6faf7990dd
--- /dev/null
+++ b/nixos/modules/programs/phosh.nix
@@ -0,0 +1,167 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.programs.phosh;
+
+  # Based on https://source.puri.sm/Librem5/librem5-base/-/blob/4596c1056dd75ac7f043aede07887990fd46f572/default/sm.puri.OSK0.desktop
+  oskItem = pkgs.makeDesktopItem {
+    name = "sm.puri.OSK0";
+    type = "Application";
+    desktopName = "On-screen keyboard";
+    exec = "${pkgs.squeekboard}/bin/squeekboard";
+    categories = "GNOME;Core;";
+    extraEntries = ''
+      OnlyShowIn=GNOME;
+      NoDisplay=true
+      X-GNOME-Autostart-Phase=Panel
+      X-GNOME-Provides=inputmethod
+      X-GNOME-Autostart-Notify=true
+      X-GNOME-AutoRestart=true
+    '';
+  };
+
+  phocConfigType = types.submodule {
+    options = {
+      xwayland = mkOption {
+        description = ''
+          Whether to enable XWayland support.
+
+          To start XWayland immediately, use `immediate`.
+        '';
+        type = types.enum [ "true" "false" "immediate" ];
+        default = "false";
+      };
+      cursorTheme = mkOption {
+        description = ''
+          Cursor theme to use in Phosh.
+        '';
+        type = types.str;
+        default = "default";
+      };
+      outputs = mkOption {
+        description = ''
+          Output configurations.
+        '';
+        type = types.attrsOf phocOutputType;
+        default = {
+          DSI-1 = {
+            scale = 2;
+          };
+        };
+      };
+    };
+  };
+
+  phocOutputType = types.submodule {
+    options = {
+      modeline = mkOption {
+        description = ''
+          One or more modelines.
+        '';
+        type = types.either types.str (types.listOf types.str);
+        default = [];
+        example = [
+          "87.25 720 776 848  976 1440 1443 1453 1493 -hsync +vsync"
+          "65.13 768 816 896 1024 1024 1025 1028 1060 -HSync +VSync"
+        ];
+      };
+      mode = mkOption {
+        description = ''
+          Default video mode.
+        '';
+        type = types.nullOr types.str;
+        default = null;
+        example = "768x1024";
+      };
+      scale = mkOption {
+        description = ''
+          Display scaling factor.
+        '';
+        type = types.nullOr types.ints.unsigned;
+        default = null;
+        example = 2;
+      };
+      rotate = mkOption {
+        description = ''
+          Screen transformation.
+        '';
+        type = types.enum [
+          "90" "180" "270" "flipped" "flipped-90" "flipped-180" "flipped-270" null
+        ];
+        default = null;
+      };
+    };
+  };
+
+  optionalKV = k: v: if v == null then "" else "${k} = ${builtins.toString v}";
+
+  renderPhocOutput = name: output: let
+    modelines = if builtins.isList output.modeline
+      then output.modeline
+      else [ output.modeline ];
+    renderModeline = l: "modeline = ${l}";
+  in ''
+    [output:${name}]
+    ${concatStringsSep "\n" (map renderModeline modelines)}
+    ${optionalKV "mode" output.mode}
+    ${optionalKV "scale" output.scale}
+    ${optionalKV "rotate" output.rotate}
+  '';
+
+  renderPhocConfig = phoc: let
+    outputs = mapAttrsToList renderPhocOutput phoc.outputs;
+  in ''
+    [core]
+    xwayland = ${phoc.xwayland}
+    ${concatStringsSep "\n" outputs}
+    [cursor]
+    theme = ${phoc.cursorTheme}
+  '';
+in {
+  options = {
+    programs.phosh = {
+      enable = mkEnableOption ''
+        Whether to enable, Phosh, related packages and default configurations.
+      '';
+      phocConfig = mkOption {
+        description = ''
+          Configurations for the Phoc compositor.
+        '';
+        type = types.oneOf [ types.lines types.path phocConfigType ];
+        default = {};
+      };
+    };
+  };
+
+  config = mkIf cfg.enable {
+    environment.systemPackages = [
+      pkgs.phoc
+      pkgs.phosh
+      pkgs.squeekboard
+      oskItem
+    ];
+
+    programs.feedbackd.enable = true;
+
+    # https://source.puri.sm/Librem5/phosh/-/issues/303
+    security.pam.services.phosh = {
+      text = ''
+        auth    requisite       pam_nologin.so
+        auth    required        pam_succeed_if.so user != root quiet_success
+        auth    required        pam_securetty.so
+        auth    requisite       pam_nologin.so
+      '';
+    };
+
+    services.gnome3.core-shell.enable = true;
+    services.gnome3.core-os-services.enable = true;
+    services.xserver.displayManager.sessionPackages = [ pkgs.phosh ];
+
+    environment.etc."phosh/phoc.ini".source =
+      if builtins.isPath cfg.phocConfig then cfg.phocConfig
+      else if builtins.isString cfg.phocConfig then pkgs.writeText "phoc.ini" cfg.phocConfig
+      else pkgs.writeText "phoc.ini" (renderPhocConfig cfg.phocConfig);
+  };
+}
diff --git a/nixos/modules/services/continuous-integration/buildkite-agents.nix b/nixos/modules/services/continuous-integration/buildkite-agents.nix
index b0045409ae6..3dd1c40aaa4 100644
--- a/nixos/modules/services/continuous-integration/buildkite-agents.nix
+++ b/nixos/modules/services/continuous-integration/buildkite-agents.nix
@@ -76,7 +76,7 @@ let
       };
 
       tags = mkOption {
-        type = types.attrsOf types.str;
+        type = types.attrsOf (types.either types.str (types.listOf types.str));
         default = {};
         example = { queue = "default"; docker = "true"; ruby2 ="true"; };
         description = ''
@@ -230,7 +230,11 @@ in
         ##     don't end up in the Nix store.
         preStart = let
           sshDir = "${cfg.dataDir}/.ssh";
-          tagStr = lib.concatStringsSep "," (lib.mapAttrsToList (name: value: "${name}=${value}") cfg.tags);
+          tagStr = name: value:
+            if lib.isList value
+            then lib.concatStringsSep "," (builtins.map (v: "${name}=${v}") value)
+            else "${name}=${value}";
+          tagsStr = lib.concatStringsSep "," (lib.mapAttrsToList tagStr cfg.tags);
         in
           optionalString (cfg.privateSshKeyPath != null) ''
             mkdir -m 0700 -p "${sshDir}"
@@ -241,7 +245,7 @@ in
             token="$(cat ${toString cfg.tokenPath})"
             name="${cfg.name}"
             shell="${cfg.shell}"
-            tags="${tagStr}"
+            tags="${tagsStr}"
             build-path="${cfg.dataDir}/builds"
             hooks-path="${cfg.hooksPath}"
             ${cfg.extraConfig}
diff --git a/nixos/modules/services/hardware/pcscd.nix b/nixos/modules/services/hardware/pcscd.nix
index 59c12ee12ca..4fc1e351f50 100644
--- a/nixos/modules/services/hardware/pcscd.nix
+++ b/nixos/modules/services/hardware/pcscd.nix
@@ -50,6 +50,7 @@ in
 
     environment.etc."reader.conf".source = cfgFile;
 
+    environment.systemPackages = [ pkgs.pcsclite ];
     systemd.packages = [ (getBin pkgs.pcsclite) ];
 
     systemd.sockets.pcscd.wantedBy = [ "sockets.target" ];
diff --git a/nixos/modules/services/security/fail2ban.nix b/nixos/modules/services/security/fail2ban.nix
index b901b19cf31..0c24972823d 100644
--- a/nixos/modules/services/security/fail2ban.nix
+++ b/nixos/modules/services/security/fail2ban.nix
@@ -62,6 +62,22 @@ in
         description = "The firewall package used by fail2ban service.";
       };
 
+      extraPackages = mkOption {
+        default = [];
+        type = types.listOf types.package;
+        example = lib.literalExample "[ pkgs.ipset ]";
+        description = ''
+          Extra packages to be made available to the fail2ban service. The example contains
+          the packages needed by the `iptables-ipset-proto6` action.
+        '';
+      };
+
+      maxretry = mkOption {
+        default = 3;
+        type = types.ints.unsigned;
+        description = "Number of failures before a host gets banned.";
+      };
+
       banaction = mkOption {
         default = "iptables-multiport";
         type = types.str;
@@ -243,7 +259,7 @@ in
       restartTriggers = [ fail2banConf jailConf pathsConf ];
       reloadIfChanged = true;
 
-      path = [ cfg.package cfg.packageFirewall pkgs.iproute2 ];
+      path = [ cfg.package cfg.packageFirewall pkgs.iproute2 ] ++ cfg.extraPackages;
 
       unitConfig.Documentation = "man:fail2ban(1)";
 
@@ -291,7 +307,7 @@ in
       ''}
       # Miscellaneous options
       ignoreip    = 127.0.0.1/8 ${optionalString config.networking.enableIPv6 "::1"} ${concatStringsSep " " cfg.ignoreIP}
-      maxretry    = 3
+      maxretry    = ${toString cfg.maxretry}
       backend     = systemd
       # Actions
       banaction   = ${cfg.banaction}
diff --git a/pkgs/applications/audio/ocenaudio/default.nix b/pkgs/applications/audio/ocenaudio/default.nix
index d770396a6ad..68edf99e010 100644
--- a/pkgs/applications/audio/ocenaudio/default.nix
+++ b/pkgs/applications/audio/ocenaudio/default.nix
@@ -11,17 +11,17 @@
 
 stdenv.mkDerivation rec {
   pname = "ocenaudio";
-  version = "3.10.2";
+  version = "3.10.6";
 
   src = fetchurl {
     url = "https://www.ocenaudio.com/downloads/index.php/ocenaudio_debian9_64.deb?version=${version}";
-    sha256 = "sha256-mmo6/zc/3R8ptXfY01RKUOLgmDhWTHiYBMlGqpdMTAo=";
+    sha256 = "0fgvm1xw2kgrqj3w6slpfxbb3pw9k8i0dz16q9d5d8gyyvr2mh8g";
   };
 
-
   nativeBuildInputs = [
     autoPatchelfHook
     qt5.qtbase
+    qt5.wrapQtAppsHook
     libjack2
     libpulseaudio
     bzip2
@@ -33,7 +33,6 @@ stdenv.mkDerivation rec {
   dontUnpack = true;
   dontBuild = true;
   dontStrip = true;
-  dontWrapQtApps = true;
 
   installPhase = ''
     mkdir -p $out
diff --git a/pkgs/applications/misc/feedbackd/default.nix b/pkgs/applications/misc/feedbackd/default.nix
index 34119c2006d..1cf2fee3710 100644
--- a/pkgs/applications/misc/feedbackd/default.nix
+++ b/pkgs/applications/misc/feedbackd/default.nix
@@ -41,6 +41,11 @@ stdenv.mkDerivation rec {
     json-glib
   ];
 
+  postInstall = ''
+    mkdir -p $out/lib/udev/rules.d
+    sed "s|/usr/libexec/|$out/libexec/|" < $src/debian/feedbackd.udev > $out/lib/udev/rules.d/90-feedbackd.rules
+  '';
+
   meta = with lib; {
     description = "A daemon to provide haptic (and later more) feedback on events";
     homepage = "https://source.puri.sm/Librem5/feedbackd";
diff --git a/pkgs/applications/misc/geoipupdate/default.nix b/pkgs/applications/misc/geoipupdate/default.nix
index 12b5a38877a..e85ada2253f 100644
--- a/pkgs/applications/misc/geoipupdate/default.nix
+++ b/pkgs/applications/misc/geoipupdate/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "geoipupdate";
-  version = "4.6.0";
+  version = "4.7.1";
 
   src = fetchFromGitHub {
     owner = "maxmind";
     repo = "geoipupdate";
     rev = "v${version}";
-    sha256 = "1rzc8kidm8nr9pbcbq96kax3cbf39afrk5vzpl04lzpw3jbbakjq";
+    sha256 = "sha256-nshQxr6y3TxKsAVSA9mzL7LJfCtpv0QuuTTqk3/lENc=";
   };
 
-  vendorSha256 = "1f858k8cl0dgiw124jv0p9jhi9aqxnc3nmc7hksw70fla2nzjrv0";
+  vendorSha256 = "sha256-fqQWFhFeyW4GntRBxEeN6WSOo0G+1hH9vSEZmBKglz8=";
 
   doCheck = false;
 
diff --git a/pkgs/applications/misc/phoc/default.nix b/pkgs/applications/misc/phoc/default.nix
new file mode 100644
index 00000000000..6ef88fb07c6
--- /dev/null
+++ b/pkgs/applications/misc/phoc/default.nix
@@ -0,0 +1,84 @@
+{ lib
+, stdenv
+, fetchFromGitLab
+, fetchpatch
+, meson
+, ninja
+, pkg-config
+, python3
+, wrapGAppsHook
+, libinput
+, gnome3
+, glib
+, gtk3
+, wayland
+, libdrm
+, libxkbcommon
+, wlroots
+}:
+
+let
+  phocWlroots = wlroots.overrideAttrs (old: {
+    patches = (old.patches or []) ++ [
+      # Temporary fix. Upstream report: https://source.puri.sm/Librem5/phosh/-/issues/422
+      (fetchpatch {
+        name = "0001-Revert-layer-shell-error-on-0-dimension-without-anch.patch";
+        url = "https://gitlab.alpinelinux.org/alpine/aports/-/raw/78fde4aaf1a74eb13a3f083cb6dfb29f578c3265/community/wlroots/0001-Revert-layer-shell-error-on-0-dimension-without-anch.patch";
+        sha256 = "1zjn7mwdj21z0jsc2mz90cnrzk97yqkiq58qqgpjav4h4dgpfb38";
+      })
+      # To fix missing header `EGL/eglmesaext.h` dropped upstream
+      (fetchpatch {
+        name = "0002-stop-including-eglmesaext-h.patch";
+        url = "https://github.com/swaywm/wlroots/commit/e18599b05e0f0cbeba11adbd489e801285470eab.patch";
+        sha256 = "17ax4dyk0584yhs3lq8ija5bkainjf7psx9c9r50cr4jm9c0i37l";
+      })
+    ];
+  });
+in stdenv.mkDerivation rec {
+  pname = "phoc";
+  version = "0.7.0";
+
+  src = fetchFromGitLab {
+    domain = "source.puri.sm";
+    owner = "Librem5";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "0afiyr2slg38ksrqn19zygsmjy9k5bpwv6n7zjas3s5djr6hch45";
+  };
+
+  nativeBuildInputs = [
+    meson
+    ninja
+    pkg-config
+    python3
+    wrapGAppsHook
+  ];
+
+  buildInputs = [
+    libdrm.dev
+    libxkbcommon
+    libinput
+    glib
+    gtk3
+    gnome3.gnome-desktop
+    # For keybindings settings schemas
+    gnome3.mutter
+    wayland
+    phocWlroots
+  ];
+
+  mesonFlags = ["-Dembed-wlroots=disabled"];
+
+  postPatch = ''
+    chmod +x build-aux/post_install.py
+    patchShebangs build-aux/post_install.py
+  '';
+
+  meta = with lib; {
+    description = "Wayland compositor for mobile phones like the Librem 5";
+    homepage = "https://source.puri.sm/Librem5/phoc";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ archseer masipcat zhaofengli ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/applications/networking/browsers/firefox/common.nix b/pkgs/applications/networking/browsers/firefox/common.nix
index 0b79da754f8..24195e578bd 100644
--- a/pkgs/applications/networking/browsers/firefox/common.nix
+++ b/pkgs/applications/networking/browsers/firefox/common.nix
@@ -9,7 +9,7 @@
 , hunspell, libevent, libstartup_notification
 , libvpx_1_8
 , icu67, libpng, jemalloc, glib, pciutils
-, autoconf213, which, gnused, rustPackages
+, autoconf213, which, gnused, rustPackages, rustPackages_1_45
 , rust-cbindgen, nodejs, nasm, fetchpatch
 , gnum4
 , debugBuild ? false
@@ -90,13 +90,19 @@ let
             then "/Applications/${binaryNameCapitalized}.app/Contents/MacOS"
             else "/bin";
 
-  inherit (rustPackages) rustc cargo;
+  # 78 ESR won't build with rustc 1.47
+  inherit (if lib.versionAtLeast ffversion "82" then rustPackages else rustPackages_1_45)
+    rustc cargo;
 
   # Darwin's stdenv provides the default llvmPackages version, match that since
   # clang LTO on Darwin is broken so the stdenv is not being changed.
+  # Target the LLVM version that rustc -Vv reports it is built with for LTO.
+  # rustPackages_1_45 -> LLVM 10, rustPackages -> LLVM 11
   llvmPackages = if stdenv.isDarwin
                  then buildPackages.llvmPackages
-                 else buildPackages.llvmPackages_11;
+                 else if lib.versionAtLeast rustc.llvm.version "11"
+                      then buildPackages.llvmPackages_11
+                      else buildPackages.llvmPackages_10;
 
   # When LTO for Darwin is fixed, the following will need updating as lld
   # doesn't work on it. For now it is fine since ltoSupport implies no Darwin.
diff --git a/pkgs/applications/networking/cluster/fluxcd/default.nix b/pkgs/applications/networking/cluster/fluxcd/default.nix
index a0593aab989..4a338ac9a42 100644
--- a/pkgs/applications/networking/cluster/fluxcd/default.nix
+++ b/pkgs/applications/networking/cluster/fluxcd/default.nix
@@ -1,11 +1,11 @@
 { lib, buildGoModule, fetchFromGitHub, fetchzip, installShellFiles }:
 
 let
-  version = "0.12.0";
+  version = "0.13.2";
 
   manifests = fetchzip {
     url = "https://github.com/fluxcd/flux2/releases/download/v${version}/manifests.tar.gz";
-    sha256 = "sha256-8NgKr5uRVFBD1pARaD+vH9wPA5gUNltwMe0i0icED1c=";
+    sha256 = "sha256-+2JvJFzH1CjU/WQ7MLtqd5Adfi/ktX9lPq4IyxPcUD8=";
     stripRoot = false;
   };
 in
@@ -19,10 +19,10 @@ buildGoModule rec {
     owner = "fluxcd";
     repo = "flux2";
     rev = "v${version}";
-    sha256 = "sha256-idHMijca1lYQF4aW+RPyzRraLDNdVavMuj4TP6z90Oo=";
+    sha256 = "sha256-yWcoHUHEiRp4YxTDxi+inJkpb8dnTVTwSO3MgFyhvps=";
   };
 
-  vendorSha256 = "sha256-VrDO8y6omRKf3mPRAnRMZsSMwQHxQxShUa9HZ3dfCgM=";
+  vendorSha256 = "sha256-hSnTM89s3R7UDn1gLlb1gu6rhTPqVKJpWKCz1SDyfmg=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/applications/networking/google-drive-ocamlfuse/default.nix b/pkgs/applications/networking/google-drive-ocamlfuse/default.nix
index 72ff8bd8b4b..29ae860cdad 100644
--- a/pkgs/applications/networking/google-drive-ocamlfuse/default.nix
+++ b/pkgs/applications/networking/google-drive-ocamlfuse/default.nix
@@ -4,7 +4,7 @@
 
 buildDunePackage rec {
   pname = "google-drive-ocamlfuse";
-  version = "0.7.22";
+  version = "0.7.26";
 
   useDune2 = true;
 
@@ -14,7 +14,7 @@ buildDunePackage rec {
     owner = "astrada";
     repo = "google-drive-ocamlfuse";
     rev = "v${version}";
-    sha256 = "027j1r2iy8vnbqs8bv893f0909yk5312ki5p3zh2pdz6s865h750";
+    sha256 = "sha256-8s3DnpdYIVyJj5rtsof3WpLvX9wCrWU47dp4D6c986s=";
   };
 
   buildInputs = [ ocaml_extlib ocamlfuse gapi_ocaml ocaml_sqlite3 ];
diff --git a/pkgs/applications/science/math/numworks-epsilon/default.nix b/pkgs/applications/science/math/numworks-epsilon/default.nix
new file mode 100644
index 00000000000..9ec41386da5
--- /dev/null
+++ b/pkgs/applications/science/math/numworks-epsilon/default.nix
@@ -0,0 +1,53 @@
+{ stdenv
+, lib
+, fetchFromGitHub
+, libpng
+, xorg
+, python3
+, imagemagick
+, gcc-arm-embedded
+, pkg-config
+}:
+
+stdenv.mkDerivation rec {
+  pname = "numworks-epsilon";
+  version = "15.3.2";
+
+  src = fetchFromGitHub {
+    owner = "numworks";
+    repo = "epsilon";
+    rev = version;
+    sha256 = "1q34dilyypiggjs16486jm122yf20wcigqxvspc77ig9albaxgh5";
+  };
+
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [
+    libpng
+    xorg.libXext
+    python3
+    imagemagick
+    gcc-arm-embedded
+  ];
+
+  makeFlags = [
+    "PLATFORM=simulator"
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    mv ./output/release/simulator/linux/{epsilon.bin,epsilon}
+    mkdir -p $out/bin
+    cp -r ./output/release/simulator/linux/* $out/bin/
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "Emulator for Epsilon, a High-performance graphing calculator operating system";
+    homepage = "https://numworks.com/";
+    license = licenses.cc-by-nc-sa-40;
+    maintainers = with maintainers; [ erikbackman ];
+    platforms = [ "x86_64-linux" ];
+  };
+}
diff --git a/pkgs/applications/video/openshot-qt/libopenshot.nix b/pkgs/applications/video/openshot-qt/libopenshot.nix
index 169bd33b709..246c3d5cab8 100644
--- a/pkgs/applications/video/openshot-qt/libopenshot.nix
+++ b/pkgs/applications/video/openshot-qt/libopenshot.nix
@@ -1,8 +1,8 @@
 { lib, stdenv, fetchFromGitHub, fetchpatch
 , pkg-config, cmake, doxygen
-, libopenshot-audio, imagemagick, ffmpeg_3
-, swig, python3
-, unittest-cpp, cppzmq, zeromq
+, libopenshot-audio, imagemagick, ffmpeg
+, swig, python3, jsoncpp
+, cppzmq, zeromq
 , qtbase, qtmultimedia
 , llvmPackages
 }:
@@ -20,6 +20,7 @@ stdenv.mkDerivation rec {
   };
 
   patches = [
+    # Fix build with GCC 10.
     (fetchpatch {
       name = "fix-build-with-gcc-10.patch";
       url = "https://github.com/OpenShot/libopenshot/commit/13290364e7bea54164ab83d973951f2898ad9e23.diff";
@@ -33,10 +34,10 @@ stdenv.mkDerivation rec {
     export _REL_PYTHON_MODULE_PATH=$(toPythonPath $out)
   '';
 
-  nativeBuildInputs = [ pkg-config cmake doxygen ];
+  nativeBuildInputs = [ pkg-config cmake doxygen swig ];
 
   buildInputs =
-  [ imagemagick ffmpeg_3 swig python3 unittest-cpp
+  [ imagemagick ffmpeg python3 jsoncpp
     cppzmq zeromq qtbase qtmultimedia ]
     ++ optional stdenv.isDarwin llvmPackages.openmp
   ;
@@ -44,7 +45,6 @@ stdenv.mkDerivation rec {
   dontWrapQtApps = true;
 
   LIBOPENSHOT_AUDIO_DIR = libopenshot-audio;
-  "UNITTEST++_INCLUDE_DIR" = "${unittest-cpp}/include/UnitTest++";
 
   doCheck = false;
 
diff --git a/pkgs/applications/virtualization/virt-manager/default.nix b/pkgs/applications/virtualization/virt-manager/default.nix
index 11ddaff8d3b..922d6fa9ff1 100644
--- a/pkgs/applications/virtualization/virt-manager/default.nix
+++ b/pkgs/applications/virtualization/virt-manager/default.nix
@@ -1,7 +1,7 @@
 { lib, fetchurl, python3Packages, intltool, file
 , wrapGAppsHook, gtk-vnc, vte, avahi, dconf
 , gobject-introspection, libvirt-glib, system-libvirt
-, gsettings-desktop-schemas, glib, libosinfo, gnome3
+, gsettings-desktop-schemas, libosinfo, gnome3
 , gtksourceview4, docutils
 , spiceSupport ? true, spice-gtk ? null
 , cpio, e2fsprogs, findutils, gzip
@@ -11,11 +11,11 @@ with lib;
 
 python3Packages.buildPythonApplication rec {
   pname = "virt-manager";
-  version = "3.1.0";
+  version = "3.2.0";
 
   src = fetchurl {
-    url = "http://virt-manager.org/download/sources/virt-manager/${pname}-${version}.tar.gz";
-    sha256 = "0al34lxlywqnj98hdm72a38zk8ns91wkqgrc3h1mhv1kikd8pjfc";
+    url = "https://releases.pagure.org/virt-manager/${pname}-${version}.tar.gz";
+    sha256 = "11kvpzcmyir91qz0dsnk7748jbb4wr8mrc744w117qc91pcy6vrb";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/virtualization/xen/4.10.nix b/pkgs/applications/virtualization/xen/4.10.nix
index bc9003e128a..765baa0a3b4 100644
--- a/pkgs/applications/virtualization/xen/4.10.nix
+++ b/pkgs/applications/virtualization/xen/4.10.nix
@@ -160,6 +160,9 @@ callPackage (import ./generic.nix (rec {
     "-Wno-error=address-of-packed-member"
     "-Wno-error=format-overflow"
     "-Wno-error=absolute-value"
+    # Fix build with GCC 10
+    "-Wno-error=enum-conversion"
+    "-Wno-error=zero-length-bounds"
   ];
 
   postPatch = ''
diff --git a/pkgs/applications/window-managers/phosh/default.nix b/pkgs/applications/window-managers/phosh/default.nix
new file mode 100644
index 00000000000..95faee74dbc
--- /dev/null
+++ b/pkgs/applications/window-managers/phosh/default.nix
@@ -0,0 +1,158 @@
+{ lib
+, stdenv
+, fetchFromGitLab
+, meson
+, ninja
+, pkg-config
+, python3
+, wrapGAppsHook
+, libhandy
+, libxkbcommon
+, pulseaudio
+, glib
+, gtk3
+, gnome3
+, gcr
+, pam
+, systemd
+, upower
+, wayland
+, dbus
+, xvfb_run
+, phoc
+, feedbackd
+, networkmanager
+, polkit
+, libsecret
+, writeText
+}:
+
+let
+  gvc = fetchFromGitLab {
+    domain = "gitlab.gnome.org";
+    owner = "GNOME";
+    repo = "libgnome-volume-control";
+    rev = "ae1a34aafce7026b8c0f65a43c9192d756fe1057";
+    sha256 = "0a4qh5pgyjki904qf7qmvqz2ksxb0p8xhgl2aixfbhixn0pw6saw";
+  };
+
+  executable = writeText "phosh" ''
+    PHOC_INI=@out@/share/phosh/phoc.ini
+    GNOME_SESSION_ARGS="--disable-acceleration-check --session=phosh --debug"
+
+    if [ -f /etc/phosh/phoc.ini ]; then
+      PHOC_INI=/etc/phosh/phoc.ini
+    elif  [ -f /etc/phosh/rootston.ini ]; then
+      # honor old configs
+      PHOC_INI=/etc/phosh/rootston.ini
+    fi
+
+    # Run gnome-session through a login shell so it picks
+    # variables from /etc/profile.d (XDG_*)
+    [ -n "$WLR_BACKENDS" ] || WLR_BACKENDS=drm,libinput
+    export WLR_BACKENDS
+    exec "${phoc}/bin/phoc" -C "$PHOC_INI" \
+      -E "bash -lc 'XDG_DATA_DIRS=$XDG_DATA_DIRS:\$XDG_DATA_DIRS ${gnome3.gnome-session}/bin/gnome-session $GNOME_SESSION_ARGS'"
+  '';
+
+in stdenv.mkDerivation rec {
+  pname = "phosh";
+  version = "0.10.2";
+
+  src = fetchFromGitLab {
+    domain = "source.puri.sm";
+    owner = "Librem5";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "07i8wpzl7311dcf9s57s96qh1v672c75wv6cllrxx7fsmpf8fhx4";
+  };
+
+  nativeBuildInputs = [
+    meson
+    ninja
+    pkg-config
+    python3
+    wrapGAppsHook
+  ];
+
+  buildInputs = [
+    phoc
+    libhandy
+    libsecret
+    libxkbcommon
+    pulseaudio
+    glib
+    gcr
+    networkmanager
+    polkit
+    gnome3.gnome-control-center
+    gnome3.gnome-desktop
+    gnome3.gnome-session
+    gtk3
+    pam
+    systemd
+    upower
+    wayland
+    feedbackd
+  ];
+
+  checkInputs = [
+    dbus
+    xvfb_run
+  ];
+
+  # Temporarily disabled - Test is broken (SIGABRT)
+  doCheck = false;
+
+  postUnpack = ''
+    rmdir $sourceRoot/subprojects/gvc
+    ln -s ${gvc} $sourceRoot/subprojects/gvc
+  '';
+
+  postPatch = ''
+    chmod +x build-aux/post_install.py
+    patchShebangs build-aux/post_install.py
+  '';
+
+  checkPhase = ''
+    runHook preCheck
+    export NO_AT_BRIDGE=1
+    xvfb-run -s '-screen 0 800x600x24' dbus-run-session \
+      --config-file=${dbus.daemon}/share/dbus-1/session.conf \
+      meson test --print-errorlogs
+    runHook postCheck
+  '';
+
+  # Replace the launcher script with ours
+  postInstall = ''
+    substituteAll ${executable} $out/bin/phosh
+  '';
+
+  # Depends on GSettings schemas in gnome-shell
+  preFixup = ''
+    gappsWrapperArgs+=(
+      --prefix XDG_DATA_DIRS : "${gnome3.gnome-shell}/share/gsettings-schemas/${gnome3.gnome-shell.name}"
+    )
+  '';
+
+  postFixup = ''
+    mkdir -p $out/share/wayland-sessions
+    ln -s $out/share/applications/sm.puri.Phosh.desktop $out/share/wayland-sessions/
+    # The OSK0.desktop points to a dummy stub that's not needed
+    rm $out/share/applications/sm.puri.OSK0.desktop
+  '';
+
+  passthru = {
+    providedSessions = [
+     "sm.puri.Phosh"
+    ];
+  };
+
+  meta = with lib; {
+    description = "A pure Wayland shell prototype for GNOME on mobile devices";
+    homepage = "https://source.puri.sm/Librem5/phosh";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ archseer jtojnar masipcat zhaofengli ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/development/libraries/aws-c-common/default.nix b/pkgs/development/libraries/aws-c-common/default.nix
index 988a27a5878..580eaec2ebe 100644
--- a/pkgs/development/libraries/aws-c-common/default.nix
+++ b/pkgs/development/libraries/aws-c-common/default.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "aws-c-common";
-  version = "0.5.4";
+  version = "0.5.5";
 
   src = fetchFromGitHub {
     owner = "awslabs";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-NH66WAOqAaMm/IIu8L5R7CUFhX56yTLH7mPY1Q4jDC4=";
+    sha256 = "sha256-rGv+fa+UF/f6mY8CmZpkjP98CAcAQCTjL3OI7HsUHcU=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/python-modules/click-configfile/default.nix b/pkgs/development/python-modules/click-configfile/default.nix
new file mode 100644
index 00000000000..0d87aa890d2
--- /dev/null
+++ b/pkgs/development/python-modules/click-configfile/default.nix
@@ -0,0 +1,38 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, click
+, six
+, pytestCheckHook
+}:
+
+buildPythonPackage rec {
+  pname = "click-configfile";
+  version = "0.2.3";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "lb7sE77pUOmPQ8gdzavvT2RAkVWepmKY+drfWTUdkNE=";
+  };
+
+  propagatedBuildInputs = [
+    click
+    six
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  disabledTests = [
+    "test_configfile__with_unbound_section"
+    "test_matches_section__with_bad_arg"
+  ];
+
+  meta = with lib; {
+    description = "Add support for commands that use configuration files to Click";
+    homepage = "https://github.com/click-contrib/click-configfile";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ jtojnar ];
+  };
+}
diff --git a/pkgs/development/python-modules/click-spinner/default.nix b/pkgs/development/python-modules/click-spinner/default.nix
new file mode 100644
index 00000000000..e0d862ab131
--- /dev/null
+++ b/pkgs/development/python-modules/click-spinner/default.nix
@@ -0,0 +1,30 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, click
+, six
+, pytestCheckHook
+}:
+
+buildPythonPackage rec {
+  pname = "click-spinner";
+  version = "0.1.10";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "h+rPnXKYlzol12Fe9X1Hgq6/kTpTK7pLKKN+Nm6XXa8=";
+  };
+
+  checkInputs = [
+    click
+    six
+    pytestCheckHook
+  ];
+
+  meta = with lib; {
+    description = "Add support for showwing that command line app is active to Click";
+    homepage = "https://github.com/click-contrib/click-spinner";
+    license = licenses.mit;
+    maintainers = with maintainers; [ jtojnar ];
+  };
+}
diff --git a/pkgs/development/python-modules/cloudsmith-api/default.nix b/pkgs/development/python-modules/cloudsmith-api/default.nix
new file mode 100644
index 00000000000..57316ae9d6c
--- /dev/null
+++ b/pkgs/development/python-modules/cloudsmith-api/default.nix
@@ -0,0 +1,42 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, certifi
+, six
+, dateutil
+, urllib3
+}:
+
+buildPythonPackage rec {
+  pname = "cloudsmith-api";
+  version = "0.54.15";
+
+  format = "wheel";
+
+  src = fetchPypi {
+    pname = "cloudsmith_api";
+    inherit format version;
+    sha256 = "X72xReosUnUlj69Gq+i+izhaKZuakM9mUrRHZI5L9h0=";
+  };
+
+  propagatedBuildInputs = [
+    certifi
+    six
+    dateutil
+    urllib3
+  ];
+
+  # Wheels have no tests
+  doCheck = false;
+
+  pythonImportsCheck = [
+    "cloudsmith_api"
+  ];
+
+  meta = with lib; {
+    description = "Cloudsmith API Client";
+    homepage = "https://github.com/cloudsmith-io/cloudsmith-api";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ jtojnar ];
+  };
+}
diff --git a/pkgs/development/python-modules/pyotgw/default.nix b/pkgs/development/python-modules/pyotgw/default.nix
new file mode 100644
index 00000000000..b48c190ca1e
--- /dev/null
+++ b/pkgs/development/python-modules/pyotgw/default.nix
@@ -0,0 +1,41 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, pyserial-asyncio
+, pytest-asyncio
+, pytestCheckHook
+, pythonOlder
+}:
+
+buildPythonPackage rec {
+  pname = "pyotgw";
+  version = "unstable-2021-03-25";
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "mvn23";
+    repo = pname;
+    rev = "1854ef4ffb907524ff457ba558e4979ba7fabd02";
+    sha256 = "0zckd85dmzpz0drcgx16ly6kzh1f1slcxb9lrcf81wh1p4q9bcaa";
+  };
+
+  propagatedBuildInputs = [
+    pyserial-asyncio
+  ];
+
+  checkInputs = [
+    pytest-asyncio
+    pytestCheckHook
+  ];
+
+  pytestFlagsArray = [ "tests" ];
+
+  pythonImportsCheck = [ "pyotgw" ];
+
+  meta = with lib; {
+    description = "Python module to interact the OpenTherm Gateway";
+    homepage = "https://github.com/mvn23/pyotgw";
+    license = with licenses; [ gpl3Plus ];
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/development/tools/cloudsmith-cli/default.nix b/pkgs/development/tools/cloudsmith-cli/default.nix
new file mode 100644
index 00000000000..8de2bc1aeed
--- /dev/null
+++ b/pkgs/development/tools/cloudsmith-cli/default.nix
@@ -0,0 +1,43 @@
+{ python3
+, lib
+}:
+
+python3.pkgs.buildPythonApplication rec {
+  pname = "cloudsmith-cli";
+  version = "0.26.0";
+
+  format = "wheel";
+
+  src = python3.pkgs.fetchPypi {
+    pname = "cloudsmith_cli";
+    inherit format version;
+    sha256 = "c2W5+z+X4oRZxlNhB6for4mN4NeBX9MtEtmXhU5sz4A=";
+  };
+
+  propagatedBuildInputs = with python3.pkgs; [
+    click
+    click-configfile
+    click-didyoumean
+    click-spinner
+    cloudsmith-api
+    colorama
+    future
+    requests
+    requests_toolbelt
+    semver
+    simplejson
+    six
+    setuptools # needs pkg_resources
+  ];
+
+  # Wheels have no tests
+  doCheck = false;
+
+  meta = {
+    homepage = "https://help.cloudsmith.io/docs/cli/";
+    description = "Cloudsmith Command Line Interface";
+    maintainers = with lib.maintainers; [ jtojnar ];
+    license = lib.licenses.asl20;
+    platforms = with lib.platforms; unix;
+  };
+}
diff --git a/pkgs/development/tools/continuous-integration/buildkite-agent/default.nix b/pkgs/development/tools/continuous-integration/buildkite-agent/default.nix
index 4a402111b08..db1f2aeabc7 100644
--- a/pkgs/development/tools/continuous-integration/buildkite-agent/default.nix
+++ b/pkgs/development/tools/continuous-integration/buildkite-agent/default.nix
@@ -2,16 +2,16 @@
   makeWrapper, coreutils, git, openssh, bash, gnused, gnugrep }:
 buildGoModule rec {
   name = "buildkite-agent-${version}";
-  version = "3.28.1";
+  version = "3.29.0";
 
   src = fetchFromGitHub {
     owner = "buildkite";
     repo = "agent";
     rev = "v${version}";
-    sha256 = "sha256-5YOXYOAh/0fOagcqdK2IEwm5XDCxyfTeTzwBGtsQRCs=";
+    sha256 = "sha256-76yyqZi+ktcwRXo0ZIcdFJ9YCuHm9Te4AI+4meuhMNA=";
   };
 
-  vendorSha256 = "sha256-3UXZxeiL0WO4X/3/hW8ubL1TormGbn9X/k0PX+/cLuM=";
+  vendorSha256 = "sha256-6cejbCbr0Rn4jWFJ0fxG4v0L0xUM8k16cbACmcQ6m4o=";
 
   postPatch = ''
     substituteInPlace bootstrap/shell/shell.go --replace /bin/bash ${bash}/bin/bash
diff --git a/pkgs/os-specific/linux/android-udev-rules/default.nix b/pkgs/os-specific/linux/android-udev-rules/default.nix
index e542c0dbc63..d41c3e2dc33 100644
--- a/pkgs/os-specific/linux/android-udev-rules/default.nix
+++ b/pkgs/os-specific/linux/android-udev-rules/default.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "android-udev-rules";
-  version = "20210302";
+  version = "20210425";
 
   src = fetchFromGitHub {
     owner = "M0Rf30";
     repo = "android-udev-rules";
     rev = version;
-    sha256 = "sha256-yIVHcaQAr2gKH/NZeN+vRmGS8OgyNeRsZkCYyqjsSsI=";
+    sha256 = "sha256-crNK6mZCCqD/Lm3rNtfH/4F48RuQCqHWP+qsTNVLOGY=";
   };
 
   installPhase = ''
diff --git a/pkgs/os-specific/linux/conky/default.nix b/pkgs/os-specific/linux/conky/default.nix
index 0e7eaa19b4d..9bd8890e713 100644
--- a/pkgs/os-specific/linux/conky/default.nix
+++ b/pkgs/os-specific/linux/conky/default.nix
@@ -68,13 +68,13 @@ with lib;
 
 stdenv.mkDerivation rec {
   pname = "conky";
-  version = "1.12.1";
+  version = "1.12.2";
 
   src = fetchFromGitHub {
     owner = "brndnmtthws";
     repo = "conky";
     rev = "v${version}";
-    sha256 = "sha256-qQx9+Z1OAQlbHupflzHD5JV4NqedoF8A57F1+rPT3/o=";
+    sha256 = "sha256-x6bR5E5LIvKWiVM15IEoUgGas/hcRp3F/O4MTOhVPb8=";
   };
 
   postPatch = ''
diff --git a/pkgs/servers/home-assistant/component-packages.nix b/pkgs/servers/home-assistant/component-packages.nix
index cf8c0641bc7..b6e8dedf2ec 100644
--- a/pkgs/servers/home-assistant/component-packages.nix
+++ b/pkgs/servers/home-assistant/component-packages.nix
@@ -598,7 +598,7 @@
     "openhome" = ps: with ps; [ openhomedevice ];
     "opensensemap" = ps: with ps; [ opensensemap-api ];
     "opensky" = ps: with ps; [ ];
-    "opentherm_gw" = ps: with ps; [ ]; # missing inputs: pyotgw
+    "opentherm_gw" = ps: with ps; [ pyotgw ];
     "openuv" = ps: with ps; [ pyopenuv ];
     "openweathermap" = ps: with ps; [ pyowm ];
     "opnsense" = ps: with ps; [ pyopnsense ];
diff --git a/pkgs/servers/home-assistant/default.nix b/pkgs/servers/home-assistant/default.nix
index cb455738080..960535b5ec6 100644
--- a/pkgs/servers/home-assistant/default.nix
+++ b/pkgs/servers/home-assistant/default.nix
@@ -336,6 +336,7 @@ in with py.pkgs; buildPythonApplication rec {
     "omnilogic"
     "ondilo_ico"
     "openerz"
+    "opentherm_gw"
     "ozw"
     "panel_custom"
     "panel_iframe"
diff --git a/pkgs/shells/zsh/zsh-z/default.nix b/pkgs/shells/zsh/zsh-z/default.nix
new file mode 100644
index 00000000000..9623ff6648c
--- /dev/null
+++ b/pkgs/shells/zsh/zsh-z/default.nix
@@ -0,0 +1,28 @@
+{ lib, stdenvNoCC, fetchFromGitHub }:
+
+stdenvNoCC.mkDerivation rec {
+  pname = "zsh-z";
+  version = "unstable-2021-02-15";
+
+  src = fetchFromGitHub {
+    owner = "agkozak";
+    repo = pname;
+    rev = "595c883abec4682929ffe05eb2d088dd18e97557";
+    sha256 = "sha256-HnwUWqzwavh/Qox+siOe5lwTp7PBdiYx+9M0NMNFx00=";
+  };
+
+  dontBuild = true;
+
+  installPhase = ''
+    mkdir -p $out/share/zsh-z
+    cp _zshz zsh-z.plugin.zsh $out/share/zsh-z
+  '';
+
+  meta = with lib; {
+    description = "Jump quickly to directories that you have visited frequently in the past, or recently";
+    homepage = "https://github.com/agkozak/zsh-z";
+    license = licenses.mit;
+    platforms = platforms.unix;
+    maintainers = [ maintainers.evalexpr ];
+  };
+}
diff --git a/pkgs/tools/admin/credhub-cli/default.nix b/pkgs/tools/admin/credhub-cli/default.nix
index 55af1679d7a..0c71850f849 100644
--- a/pkgs/tools/admin/credhub-cli/default.nix
+++ b/pkgs/tools/admin/credhub-cli/default.nix
@@ -1,4 +1,4 @@
-{ lib, buildGoModule, fetchFromGitHub }:
+{ lib, buildGoModule, fetchFromGitHub, fetchpatch }:
 
 buildGoModule rec {
   pname = "credhub-cli";
@@ -11,6 +11,14 @@ buildGoModule rec {
     sha256 = "1j0i0b79ph2i52cj0qln8wvp6gwhl73akkn026h27vvmlw9sndc2";
   };
 
+  patches = [
+    # Fix test with Go 1.15
+    (fetchpatch {
+        url = "https://github.com/cloudfoundry-incubator/credhub-cli/commit/4bd1accd513dc5e163e155c4b428878ca0bcedbc.patch";
+        sha256 = "180n3q3d19aw02q7xsn7dxck18jgndz5garj2mb056cwa7mmhw0j";
+    })
+  ];
+
   # these tests require network access that we're not going to give them
   postPatch = ''
     rm commands/api_test.go
diff --git a/pkgs/tools/audio/yabridge/default.nix b/pkgs/tools/audio/yabridge/default.nix
index c09045bdb6e..d8ddf3ee561 100644
--- a/pkgs/tools/audio/yabridge/default.nix
+++ b/pkgs/tools/audio/yabridge/default.nix
@@ -1,6 +1,8 @@
 { lib
 , stdenv
 , fetchFromGitHub
+, fetchpatch
+, substituteAll
 , meson
 , ninja
 , pkg-config
@@ -77,6 +79,24 @@ in stdenv.mkDerivation rec {
     cp -R --no-preserve=mode,ownership ${vst3.src} vst3
   )'';
 
+  patches = [
+    # Fix printing wine version when using absolute path (remove patches in next release):
+    (fetchpatch {
+      url = "https://github.com/robbert-vdh/yabridge/commit/2aadf5256b3eafeb86efa8626247972dd33baa13.patch";
+      sha256 = "sha256-Nq9TQJxa22vJLmf+USyPBkF8cKyEzb1Lp2Rx86pDxnY=";
+    })
+    (fetchpatch {
+      url = "https://github.com/robbert-vdh/yabridge/commit/93df3fa1da6ffcc69a5b384ba04e3da7c5ef23ef.patch";
+      sha256 = "sha256-//8Dxolqe6n+aFo4yVnnMR9kSq/iEFE0qZPvcIBehvI=";
+    })
+
+    # Hard code wine path so wine version is correct in logs
+    (substituteAll {
+      src = ./hardcode-wine.patch;
+      inherit wine;
+    })
+  ];
+
   postPatch = ''
     patchShebangs .
   '';
@@ -117,6 +137,14 @@ in stdenv.mkDerivation rec {
     cp libyabridge-vst3.so "$out/lib"
   '';
 
+  # Hard code wine path in wrapper scripts generated by winegcc
+  postFixup = ''
+    for exe in "$out"/bin/*.exe; do
+      substituteInPlace "$exe" \
+        --replace 'WINELOADER="wine"' 'WINELOADER="${wine}/bin/wine"'
+    done
+  '';
+
   meta = with lib; {
     description = "Yet Another VST bridge, run Windows VST2 plugins under Linux";
     homepage = "https://github.com/robbert-vdh/yabridge";
diff --git a/pkgs/tools/audio/yabridge/hardcode-wine.patch b/pkgs/tools/audio/yabridge/hardcode-wine.patch
new file mode 100644
index 00000000000..2b6ce1f448f
--- /dev/null
+++ b/pkgs/tools/audio/yabridge/hardcode-wine.patch
@@ -0,0 +1,13 @@
+diff --git a/src/plugin/utils.cpp b/src/plugin/utils.cpp
+index 1ff05bc..0723456 100644
+--- a/src/plugin/utils.cpp
++++ b/src/plugin/utils.cpp
+@@ -351,7 +351,7 @@ std::string get_wine_version() {
+         access(wineloader_path.c_str(), X_OK) == 0) {
+         wine_path = wineloader_path;
+     } else {
+-        wine_path = bp::search_path("wine").string();
++        wine_path = "@wine@/bin/wine";
+     }
+ 
+     bp::ipstream output;
diff --git a/pkgs/tools/audio/yabridgectl/default.nix b/pkgs/tools/audio/yabridgectl/default.nix
index 4548b288b69..2cbaf3f4ad5 100644
--- a/pkgs/tools/audio/yabridgectl/default.nix
+++ b/pkgs/tools/audio/yabridgectl/default.nix
@@ -1,4 +1,9 @@
-{ lib, rustPlatform, yabridge }:
+{ lib
+, rustPlatform
+, yabridge
+, makeWrapper
+, wine
+}:
 
 rustPlatform.buildRustPackage rec {
   pname = "yabridgectl";
@@ -17,6 +22,13 @@ rustPlatform.buildRustPackage rec {
 
   patchFlags = [ "-p3" ];
 
+  nativeBuildInputs = [ makeWrapper ];
+
+  postFixup = ''
+    wrapProgram "$out/bin/yabridgectl" \
+      --prefix PATH : ${lib.makeBinPath [ wine ]}
+  '';
+
   meta = with lib; {
     description = "A small, optional utility to help set up and update yabridge for several directories at once";
     homepage = "https://github.com/robbert-vdh/yabridge/tree/master/tools/yabridgectl";
diff --git a/pkgs/tools/graphics/mangohud/combined.nix b/pkgs/tools/graphics/mangohud/combined.nix
new file mode 100644
index 00000000000..4947cd66e3a
--- /dev/null
+++ b/pkgs/tools/graphics/mangohud/combined.nix
@@ -0,0 +1,14 @@
+{ stdenv, pkgs, lib
+, libXNVCtrl
+}:
+let
+  mangohud_64 = pkgs.callPackage ./default.nix { inherit libXNVCtrl; };
+  mangohud_32 = pkgs.pkgsi686Linux.callPackage ./default.nix { inherit libXNVCtrl; };
+in
+pkgs.buildEnv rec {
+  name = "mangohud-${mangohud_64.version}";
+
+  paths = [ mangohud_32 ] ++ lib.optionals stdenv.is64bit [ mangohud_64 ];
+
+  meta = mangohud_64.meta;
+}
diff --git a/pkgs/tools/graphics/mangohud/default.nix b/pkgs/tools/graphics/mangohud/default.nix
new file mode 100644
index 00000000000..26260af50fe
--- /dev/null
+++ b/pkgs/tools/graphics/mangohud/default.nix
@@ -0,0 +1,79 @@
+{ stdenv
+, lib
+, fetchFromGitHub
+, fetchpatch
+, meson
+, ninja
+, pkg-config
+, python3Packages
+, dbus
+, glslang
+, libglvnd
+, libXNVCtrl
+, mesa
+, vulkan-headers
+, vulkan-loader
+, xorg
+}:
+
+
+stdenv.mkDerivation rec {
+  pname = "mangohud${lib.optionalString stdenv.is32bit "_32"}";
+  version = "0.4.1";
+
+  src = fetchFromGitHub {
+    owner = "flightlessmango";
+    repo = "MangoHud";
+    rev = "v${version}";
+    sha256 = "04v2ps8n15ph2smjgnssax5hq88bszw2kbcff37cnd5c8yysvfi6";
+    fetchSubmodules = true;
+  };
+
+  patches = [
+    (fetchpatch {
+      # FIXME obsolete in >=0.5.0
+      url = "https://patch-diff.githubusercontent.com/raw/flightlessmango/MangoHud/pull/208.patch";
+      sha256 = "1i6x6sr4az1zv0p6vpw99n947c7awgbbv087fghjlczhry676nmh";
+    })
+  ];
+
+  mesonFlags = [
+    "-Dappend_libdir_mangohud=false"
+    "-Duse_system_vulkan=enabled"
+    "--libdir=lib${lib.optionalString stdenv.is32bit "32"}"
+  ];
+
+  buildInputs = [
+    dbus
+    glslang
+    libglvnd
+    libXNVCtrl
+    mesa
+    python3Packages.Mako
+    vulkan-headers
+    vulkan-loader
+    xorg.libX11
+  ];
+
+  nativeBuildInputs = [
+    meson
+    ninja
+    pkg-config
+    python3Packages.Mako
+    python3Packages.python
+  ];
+
+  preConfigure = ''
+    mkdir -p "$out/share/vulkan/"
+    ln -sf "${vulkan-headers}/share/vulkan/registry/" $out/share/vulkan/
+    ln -sf "${vulkan-headers}/include" $out
+  '';
+
+  meta = with lib; {
+    description = "A Vulkan and OpenGL overlay for monitoring FPS, temperatures, CPU/GPU load and more";
+    homepage = "https://github.com/flightlessmango/MangoHud";
+    platforms = platforms.linux;
+    license = licenses.mit;
+    maintainers = with maintainers; [ zeratax ];
+  };
+}
diff --git a/pkgs/tools/misc/fluent-bit/default.nix b/pkgs/tools/misc/fluent-bit/default.nix
index 8b751237f6e..d51676f4a5a 100644
--- a/pkgs/tools/misc/fluent-bit/default.nix
+++ b/pkgs/tools/misc/fluent-bit/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "fluent-bit";
-  version = "1.7.3";
+  version = "1.7.4";
 
   src = fetchFromGitHub {
     owner = "fluent";
     repo = "fluent-bit";
     rev = "v${version}";
-    sha256 = "sha256-a3AVem+VbYKUsxAzGNu/VPqDiqG99bmj9p1/iiG1ZFw=";
+    sha256 = "sha256-xOrEPZ+AUihVVaxrqCCeO6n3XFkVahCzHOuX947LRFs=";
   };
 
   nativeBuildInputs = [ cmake flex bison ];
diff --git a/pkgs/tools/security/clevis/default.nix b/pkgs/tools/security/clevis/default.nix
index 7f26dcabb7d..e5415f6d09b 100644
--- a/pkgs/tools/security/clevis/default.nix
+++ b/pkgs/tools/security/clevis/default.nix
@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   pname = "clevis";
-  version = "16";
+  version = "18";
 
   src = fetchFromGitHub {
     owner = "latchset";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-DWrxk+Nb2ptF5nCaXYvRY8hAFa/n+6OGdKWO+Sq61yk=";
+    sha256 = "sha256-m1UhyjD5ydSgCTBu6sECLlxFx0rnQxFnBA7frbdUqU8=";
   };
 
   nativeBuildInputs = [ meson ninja pkg-config asciidoc ];
diff --git a/pkgs/tools/security/doppler/default.nix b/pkgs/tools/security/doppler/default.nix
index b5fa405e93e..0f2dee26ffc 100644
--- a/pkgs/tools/security/doppler/default.nix
+++ b/pkgs/tools/security/doppler/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "doppler";
-  version = "3.23.2";
+  version = "3.24.3";
 
   src = fetchFromGitHub {
     owner = "dopplerhq";
     repo = "cli";
     rev = version;
-    sha256 = "sha256-qdBq1vjvvb55gyL4XuPDrPK58YLSSH5kLp1oP84vJsU=";
+    sha256 = "sha256-G7oyyvrn+19N0C0V5MBwls+dQNzHh+DJmMTmsln8rC4=";
   };
 
   vendorSha256 = "sha256-UaR/xYGMI+C9aID85aPSfVzmTWXj4KcjfOJ6TTJ8KoY=";
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index cd038c72939..a649cb50409 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -573,6 +573,8 @@ in
 
   nix-gitignore = callPackage ../build-support/nix-gitignore { };
 
+  numworks-epsilon = callPackage ../applications/science/math/numworks-epsilon { };
+
   ociTools = callPackage ../build-support/oci-tools { };
 
   octant = callPackage ../applications/networking/cluster/octant { };
@@ -807,10 +809,12 @@ in
   xtrt = callPackage ../tools/archivers/xtrt { };
 
   yabridge = callPackage ../tools/audio/yabridge {
-    wine = wineWowPackages.minimal;
+    wine = wineWowPackages.staging;
   };
 
-  yabridgectl = callPackage ../tools/audio/yabridgectl { };
+  yabridgectl = callPackage ../tools/audio/yabridgectl {
+    wine = wineWowPackages.staging;
+  };
 
   ### APPLICATIONS/TERMINAL-EMULATORS
 
@@ -1256,6 +1260,8 @@ in
 
   cloud-sql-proxy = callPackage ../tools/misc/cloud-sql-proxy { };
 
+  cloudsmith-cli = callPackage ../development/tools/cloudsmith-cli { };
+
   codeql = callPackage ../development/tools/analysis/codeql { };
 
   container-linux-config-transpiler = callPackage ../development/tools/container-linux-config-transpiler { };
@@ -2196,9 +2202,7 @@ in
 
   cppclean = callPackage ../development/tools/cppclean {};
 
-  credhub-cli = callPackage ../tools/admin/credhub-cli {
-    buildGoModule = buildGo114Module;
-  };
+  credhub-cli = callPackage ../tools/admin/credhub-cli {};
 
   crex = callPackage ../tools/misc/crex { };
 
@@ -6566,6 +6570,10 @@ in
 
   mandoc = callPackage ../tools/misc/mandoc { };
 
+  mangohud = callPackage ../tools/graphics/mangohud/combined.nix {
+    libXNVCtrl = linuxPackages.nvidia_x11.settings.libXNVCtrl;
+  };
+
   manix = callPackage ../tools/nix/manix {
     inherit (darwin.apple_sdk.frameworks) Security;
   };
@@ -7532,10 +7540,16 @@ in
 
   philter = callPackage ../tools/networking/philter { };
 
+  phoc = callPackage ../applications/misc/phoc {
+    wlroots = wlroots_0_12;
+  };
+
   phodav = callPackage ../tools/networking/phodav { };
 
   pim6sd = callPackage ../servers/pim6sd { };
 
+  phosh = callPackage ../applications/window-managers/phosh { };
+
   pinentry = libsForQt5.callPackage ../tools/security/pinentry {
     libcap = if stdenv.isDarwin then null else libcap;
   };
@@ -9869,6 +9883,8 @@ in
 
   zsh-you-should-use = callPackage ../shells/zsh/zsh-you-should-use { };
 
+  zsh-z = callPackage ../shells/zsh/zsh-z { };
+
   zssh = callPackage ../tools/networking/zssh { };
 
   zstd = callPackage ../tools/compression/zstd {
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index ec7afc633ea..cc390b22213 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -1359,6 +1359,8 @@ in {
 
   click-completion = callPackage ../development/python-modules/click-completion { };
 
+  click-configfile = callPackage ../development/python-modules/click-configfile { };
+
   click-datetime = callPackage ../development/python-modules/click-datetime { };
 
   click-default-group = callPackage ../development/python-modules/click-default-group { };
@@ -1371,6 +1373,8 @@ in {
 
   click-plugins = callPackage ../development/python-modules/click-plugins { };
 
+  click-spinner = callPackage ../development/python-modules/click-spinner { };
+
   click-repl = callPackage ../development/python-modules/click-repl { };
 
   click-threading = callPackage ../development/python-modules/click-threading { };
@@ -1405,6 +1409,8 @@ in {
 
   cloudscraper = callPackage ../development/python-modules/cloudscraper { };
 
+  cloudsmith-api = callPackage ../development/python-modules/cloudsmith-api { };
+
   clustershell = callPackage ../development/python-modules/clustershell { };
 
   cma = callPackage ../development/python-modules/cma { };
@@ -5855,6 +5861,8 @@ in {
     inherit (pkgs) lz4;
   };
 
+  pyotgw = callPackage ../development/python-modules/pyotgw { };
+
   pyotp = callPackage ../development/python-modules/pyotp { };
 
   pyowm = callPackage ../development/python-modules/pyowm { };