diff --git a/nixos/modules/services/databases/postgresql.nix b/nixos/modules/services/databases/postgresql.nix
index 900185fbbdf..ee8cdf2d285 100644
--- a/nixos/modules/services/databases/postgresql.nix
+++ b/nixos/modules/services/databases/postgresql.nix
@@ -163,7 +163,7 @@ in
               '';
               example = literalExample ''
                 {
-                  "DATABASE nextcloud" = "ALL PRIVILEGES";
+                  "DATABASE \"nextcloud\"" = "ALL PRIVILEGES";
                   "ALL TABLES IN SCHEMA public" = "ALL PRIVILEGES";
                 }
               '';
diff --git a/nixos/modules/services/networking/spacecookie.nix b/nixos/modules/services/networking/spacecookie.nix
index c4d06df6ad4..e0bef9e9628 100644
--- a/nixos/modules/services/networking/spacecookie.nix
+++ b/nixos/modules/services/networking/spacecookie.nix
@@ -4,10 +4,22 @@ with lib;
 
 let
   cfg = config.services.spacecookie;
-  configFile = pkgs.writeText "spacecookie.json" (lib.generators.toJSON {} {
-    inherit (cfg) hostname port root;
-  });
+
+  spacecookieConfig = {
+    listen = {
+      inherit (cfg) port;
+    };
+  } // cfg.settings;
+
+  format = pkgs.formats.json {};
+
+  configFile = format.generate "spacecookie.json" spacecookieConfig;
+
 in {
+  imports = [
+    (mkRenamedOptionModule [ "services" "spacecookie" "root" ] [ "services" "spacecookie" "settings" "root" ])
+    (mkRenamedOptionModule [ "services" "spacecookie" "hostname" ] [ "services" "spacecookie" "settings" "hostname" ])
+  ];
 
   options = {
 
@@ -15,32 +27,149 @@ in {
 
       enable = mkEnableOption "spacecookie";
 
-      hostname = mkOption {
-        type = types.str;
-        default = "localhost";
-        description = "The hostname the service is reachable via. Clients will use this hostname for further requests after loading the initial gopher menu.";
+      package = mkOption {
+        type = types.package;
+        default = pkgs.spacecookie;
+        defaultText = literalExample "pkgs.spacecookie";
+        example = literalExample "pkgs.haskellPackages.spacecookie";
+        description = ''
+          The spacecookie derivation to use. This can be used to
+          override the used package or to use another version.
+        '';
+      };
+
+      openFirewall = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          Whether to open the necessary port in the firewall for spacecookie.
+        '';
       };
 
       port = mkOption {
         type = types.port;
         default = 70;
-        description = "Port the gopher service should be exposed on.";
+        description = ''
+          Port the gopher service should be exposed on.
+        '';
       };
 
-      root = mkOption {
-        type = types.path;
-        default = "/srv/gopher";
-        description = "The root directory spacecookie serves via gopher.";
+      address = mkOption {
+        type = types.str;
+        default = "[::]";
+        description = ''
+          Address to listen on. Must be in the
+          <literal>ListenStream=</literal> syntax of
+          <link xlink:href="https://www.freedesktop.org/software/systemd/man/systemd.socket.html">systemd.socket(5)</link>.
+        '';
+      };
+
+      settings = mkOption {
+        type = types.submodule {
+          freeformType = format.type;
+
+          options.hostname = mkOption {
+            type = types.str;
+            default = "localhost";
+            description = ''
+              The hostname the service is reachable via. Clients
+              will use this hostname for further requests after
+              loading the initial gopher menu.
+            '';
+          };
+
+          options.root = mkOption {
+            type = types.path;
+            default = "/srv/gopher";
+            description = ''
+              The directory spacecookie should serve via gopher.
+              Files in there need to be world-readable since
+              the spacecookie service file sets
+              <literal>DynamicUser=true</literal>.
+            '';
+          };
+
+          options.log = {
+            enable = mkEnableOption "logging for spacecookie"
+              // { default = true; example = false; };
+
+            hide-ips = mkOption {
+              type = types.bool;
+              default = true;
+              description = ''
+                If enabled, spacecookie will hide personal
+                information of users like IP addresses from
+                log output.
+              '';
+            };
+
+            hide-time = mkOption {
+              type = types.bool;
+              # since we are starting with systemd anyways
+              # we deviate from the default behavior here:
+              # journald will add timestamps, so no need
+              # to double up.
+              default = true;
+              description = ''
+                If enabled, spacecookie will not print timestamps
+                at the beginning of every log line.
+              '';
+            };
+
+            level = mkOption {
+              type = types.enum [
+                "info"
+                "warn"
+                "error"
+              ];
+              default = "info";
+              description = ''
+                Log level for the spacecookie service.
+              '';
+            };
+          };
+        };
+
+        description = ''
+          Settings for spacecookie. The settings set here are
+          directly translated to the spacecookie JSON config
+          file. See
+          <link xlink:href="https://sternenseemann.github.io/spacecookie/spacecookie.json.5.html">spacecookie.json(5)</link>
+          for explanations of all options.
+        '';
       };
     };
   };
 
   config = mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = !(cfg.settings ? user);
+        message = ''
+          spacecookie is started as a normal user, so the setuid
+          feature doesn't work. If you want to run spacecookie as
+          a specific user, set:
+          systemd.services.spacecookie.serviceConfig = {
+            DynamicUser = false;
+            User = "youruser";
+            Group = "yourgroup";
+          }
+        '';
+      }
+      {
+        assertion = !(cfg.settings ? listen || cfg.settings ? port);
+        message = ''
+          The NixOS spacecookie module uses socket activation,
+          so the listen options have no effect. Use the port
+          and address options in services.spacecookie instead.
+        '';
+      }
+    ];
 
     systemd.sockets.spacecookie = {
       description = "Socket for the Spacecookie Gopher Server";
       wantedBy = [ "sockets.target" ];
-      listenStreams = [ "[::]:${toString cfg.port}" ];
+      listenStreams = [ "${cfg.address}:${toString cfg.port}" ];
       socketConfig = {
         BindIPv6Only = "both";
       };
@@ -53,7 +182,7 @@ in {
 
       serviceConfig = {
         Type = "notify";
-        ExecStart = "${pkgs.haskellPackages.spacecookie}/bin/spacecookie ${configFile}";
+        ExecStart = "${lib.getBin cfg.package}/bin/spacecookie ${configFile}";
         FileDescriptorStoreMax = 1;
 
         DynamicUser = true;
@@ -79,5 +208,9 @@ in {
         RestrictAddressFamilies = "AF_UNIX AF_INET6";
       };
     };
+
+    networking.firewall = mkIf cfg.openFirewall {
+      allowedTCPPorts = [ cfg.port ];
+    };
   };
 }
diff --git a/nixos/tests/spacecookie.nix b/nixos/tests/spacecookie.nix
index 5b5022a7427..a640657d8a6 100644
--- a/nixos/tests/spacecookie.nix
+++ b/nixos/tests/spacecookie.nix
@@ -1,47 +1,52 @@
 let
-  gopherRoot  = "/tmp/gopher";
-  gopherHost  = "gopherd";
-  fileContent = "Hello Gopher!";
-  fileName    = "file.txt";
+  gopherRoot   = "/tmp/gopher";
+  gopherHost   = "gopherd";
+  gopherClient = "client";
+  fileContent  = "Hello Gopher!\n";
+  fileName     = "file.txt";
 in
   import ./make-test-python.nix ({...}: {
     name = "spacecookie";
     nodes = {
       ${gopherHost} = {
-        networking.firewall.allowedTCPPorts = [ 70 ];
         systemd.services.spacecookie = {
           preStart = ''
             mkdir -p ${gopherRoot}/directory
-            echo "${fileContent}" > ${gopherRoot}/${fileName}
+            printf "%s" "${fileContent}" > ${gopherRoot}/${fileName}
           '';
         };
 
         services.spacecookie = {
           enable = true;
-          root = gopherRoot;
-          hostname = gopherHost;
+          openFirewall = true;
+          settings = {
+            root = gopherRoot;
+            hostname = gopherHost;
+          };
         };
       };
 
-      client = {};
+      ${gopherClient} = {};
     };
 
     testScript = ''
       start_all()
-      ${gopherHost}.wait_for_open_port(70)
-      ${gopherHost}.wait_for_unit("spacecookie.service")
-      client.wait_for_unit("network.target")
 
-      fileResponse = client.succeed("curl -f -s gopher://${gopherHost}//${fileName}")
+      # with daemon type notify, the unit being started
+      # should also mean the port is open
+      ${gopherHost}.wait_for_unit("spacecookie.service")
+      ${gopherClient}.wait_for_unit("network.target")
+
+      fileResponse = ${gopherClient}.succeed("curl -f -s gopher://${gopherHost}/0/${fileName}")
 
       # the file response should return our created file exactly
-      if not (fileResponse == "${fileContent}\n"):
+      if not (fileResponse == "${builtins.replaceStrings [ "\n" ] [ "\\n" ] fileContent}"):
           raise Exception("Unexpected file response")
 
       # sanity check on the directory listing: we serve a directory and a file
       # via gopher, so the directory listing should have exactly two entries,
       # one with gopher file type 0 (file) and one with file type 1 (directory).
-      dirResponse = client.succeed("curl -f -s gopher://${gopherHost}")
+      dirResponse = ${gopherClient}.succeed("curl -f -s gopher://${gopherHost}")
       dirEntries = [l[0] for l in dirResponse.split("\n") if len(l) > 0]
       dirEntries.sort()
 
diff --git a/pkgs/applications/audio/snd/default.nix b/pkgs/applications/audio/snd/default.nix
index 61d1647087e..164f266462a 100644
--- a/pkgs/applications/audio/snd/default.nix
+++ b/pkgs/applications/audio/snd/default.nix
@@ -1,30 +1,30 @@
 { lib, stdenv, fetchurl, pkg-config
-, gtk2, alsaLib
-, fftw, gsl
+, alsaLib, fftw, gsl, motif, xorg
 }:
 
 stdenv.mkDerivation rec {
-  name = "snd-20.3";
+  pname = "snd";
+  version = "21.1";
 
   src = fetchurl {
-    url = "mirror://sourceforge/snd/${name}.tar.gz";
-    sha256 = "016slh34gb6qqb38m8k9yg48rbhc5p12084szcwvanhh5v7fc7mk";
+    url = "mirror://sourceforge/snd/snd-${version}.tar.gz";
+    sha256 = "1jxvpgx1vqa6bwdzlzyzrjn2swjf9nfhzi9r1r96ivi0870vvjk3";
   };
 
   nativeBuildInputs = [ pkg-config ];
 
-  buildInputs = [
-    gtk2 alsaLib
-    fftw gsl
-  ];
+  buildInputs = [ alsaLib fftw gsl motif ]
+    ++ (with xorg; [ libXext libXft libXpm libXt ]);
 
-  meta = {
+  configureFlags = [ "--with-motif" ];
+
+  enableParallelBuilding = true;
+
+  meta = with lib; {
     description = "Sound editor";
-    homepage = "http://ccrma.stanford.edu/software/snd";
-    platforms = lib.platforms.linux;
-    license = lib.licenses.free;
-    maintainers = with lib.maintainers; [ ];
+    homepage = "https://ccrma.stanford.edu/software/snd/";
+    platforms = platforms.unix;
+    license = licenses.free;
+    maintainers = with maintainers; [ ];
   };
-
-
 }
diff --git a/pkgs/applications/graphics/ImageMagick/7.0.nix b/pkgs/applications/graphics/ImageMagick/7.0.nix
index d4a7d292322..8cf7966703f 100644
--- a/pkgs/applications/graphics/ImageMagick/7.0.nix
+++ b/pkgs/applications/graphics/ImageMagick/7.0.nix
@@ -16,13 +16,13 @@ in
 
 stdenv.mkDerivation rec {
   pname = "imagemagick";
-  version = "7.0.11-5";
+  version = "7.0.11-6";
 
   src = fetchFromGitHub {
     owner = "ImageMagick";
     repo = "ImageMagick";
     rev = version;
-    sha256 = "sha256-HJUC8lUHORZMHvSv1/EYM+JOsd89quFaU1Fz08AckG8=";
+    sha256 = "sha256-QClOS58l17KHeQXya+IKNx6nIkd6jCKp8uupRH7Fwnk=";
   };
 
   outputs = [ "out" "dev" "doc" ]; # bin/ isn't really big
diff --git a/pkgs/applications/networking/browsers/chromium/common.nix b/pkgs/applications/networking/browsers/chromium/common.nix
index 8d0a59f2919..f043ec60f4e 100644
--- a/pkgs/applications/networking/browsers/chromium/common.nix
+++ b/pkgs/applications/networking/browsers/chromium/common.nix
@@ -156,7 +156,10 @@ let
       # To fix the build of chromiumBeta and chromiumDev:
       "b5b80df7dafba8cafa4c6c0ba2153dfda467dfc9" # add dependency on opus in webcodecs
       "1r4wmwaxz5xbffmj5wspv2xj8s32j9p6jnwimjmalqg3al2ba64x"
-    );
+    ) ++ optional (versionRange "89" "90.0.4422.0") (fetchpatch {
+      url = "https://raw.githubusercontent.com/archlinux/svntogit-packages/61b0ab526d2aa3c62fa20bb756461ca9a482f6c6/trunk/chromium-fix-libva-redef.patch";
+      sha256 = "1qj4sn1ngz0p1l1w3346kanr1sqlr3xdzk1f1i86lqa45mhv77ny";
+    });
 
     postPatch = ''
       # remove unused third-party
diff --git a/pkgs/applications/networking/cluster/octant/default.nix b/pkgs/applications/networking/cluster/octant/default.nix
index 0e97b541a5d..734a1eb3ac3 100644
--- a/pkgs/applications/networking/cluster/octant/default.nix
+++ b/pkgs/applications/networking/cluster/octant/default.nix
@@ -6,7 +6,7 @@ let
     x86_64-linux = "Linux-64bit";
     aarch64-linux = "Linux-arm64";
     x86_64-darwin = "macOS-64bit";
-  }."${system}" or (throw "Unsupported system: ${system}");
+  }.${system} or (throw "Unsupported system: ${system}");
   baseurl = "https://github.com/vmware-tanzu/octant/releases/download";
   fetchsrc = version: sha256: fetchzip {
       url = "${baseurl}/v${version}/octant_${version}_${suffix}.tar.gz";
@@ -48,12 +48,14 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     homepage = "https://octant.dev/";
     changelog = "https://github.com/vmware-tanzu/octant/blob/v${version}/CHANGELOG.md";
-    description = "Highly extensible platform for developers to better understand the complexity of Kubernetes clusters.";
+    description = "Highly extensible platform for developers to better understand the complexity of Kubernetes clusters";
     longDescription = ''
-      Octant is a tool for developers to understand how applications run on a Kubernetes cluster.
-      It aims to be part of the developer's toolkit for gaining insight and approaching complexity found in Kubernetes.
-      Octant offers a combination of introspective tooling, cluster navigation, and object management along with a
-      plugin system to further extend its capabilities.
+      Octant is a tool for developers to understand how applications run on a
+      Kubernetes cluster.
+      It aims to be part of the developer's toolkit for gaining insight and
+      approaching complexity found in Kubernetes. Octant offers a combination of
+      introspective tooling, cluster navigation, and object management along
+      with a plugin system to further extend its capabilities.
     '';
     license = licenses.asl20;
     maintainers = with maintainers; [ jk ];
diff --git a/pkgs/applications/networking/cluster/octant/desktop.nix b/pkgs/applications/networking/cluster/octant/desktop.nix
new file mode 100644
index 00000000000..0f43e29e628
--- /dev/null
+++ b/pkgs/applications/networking/cluster/octant/desktop.nix
@@ -0,0 +1,78 @@
+{ lib, stdenv, appimageTools, fetchurl, gsettings-desktop-schemas, gtk3, undmg }:
+
+let
+  pname = "octant-desktop";
+  version = "0.18.0";
+  name = "${pname}-${version}";
+
+  inherit (stdenv.hostPlatform) system;
+
+  suffix = {
+    x86_64-linux = "AppImage";
+    x86_64-darwin = "dmg";
+  }.${system} or (throw "Unsupported system: ${system}");
+
+  src = fetchurl {
+    url = "https://github.com/vmware-tanzu/octant/releases/download/v${version}/Octant-${version}.${suffix}";
+    sha256 = {
+      x86_64-linux = "sha256-sQxplTJ3xfHELepx+t7FtMpPTxTDoqTAL8oUz4sLaW0=";
+      x86_64-darwin = "sha256-ov9j+SgGXCwUjQaX3eCxVvPwPgUIwtHJ6Lmx2crOfIM=";
+    }.${system};
+  };
+
+  linux = appimageTools.wrapType2 {
+    inherit name src passthru meta;
+
+    profile = ''
+      export LC_ALL=C.UTF-8
+      export XDG_DATA_DIRS=${gsettings-desktop-schemas}/share/gsettings-schemas/${gsettings-desktop-schemas.name}:${gtk3}/share/gsettings-schemas/${gtk3.name}:$XDG_DATA_DIRS
+    '';
+
+    multiPkgs = null; # no 32bit needed
+    extraPkgs = appimageTools.defaultFhsEnvArgs.multiPkgs;
+    extraInstallCommands =
+      let appimageContents = appimageTools.extractType2 { inherit name src; }; in
+      ''
+        mv $out/bin/{${name},${pname}}
+        install -Dm444 ${appimageContents}/octant.desktop -t $out/share/applications
+        substituteInPlace $out/share/applications/octant.desktop \
+          --replace 'Exec=AppRun --no-sandbox' 'Exec=${pname}'
+        install -m 444 -D ${appimageContents}/octant.png \
+          $out/share/icons/hicolor/512x512/apps/octant.png
+      '';
+  };
+
+  darwin = stdenv.mkDerivation {
+    inherit name src passthru meta;
+
+    nativeBuildInputs = [ undmg ];
+    sourceRoot = "Octant.app";
+    installPhase = ''
+      mkdir -p $out/Applications/Octant.app
+      cp -R . $out/Applications/Octant.app
+    '';
+  };
+
+  passthru = { updateScript = ./update-desktop.sh; };
+
+  meta = with lib; {
+    homepage = "https://octant.dev/";
+    changelog = "https://github.com/vmware-tanzu/octant/blob/v${version}/CHANGELOG.md";
+    description = "Highly extensible platform for developers to better understand the complexity of Kubernetes clusters";
+    longDescription = ''
+      Octant is a tool for developers to understand how applications run on a
+      Kubernetes cluster.
+      It aims to be part of the developer's toolkit for gaining insight and
+      approaching complexity found in Kubernetes. Octant offers a combination of
+      introspective tooling, cluster navigation, and object management along
+      with a plugin system to further extend its capabilities.
+    '';
+    license = licenses.asl20;
+    maintainers = with maintainers; [ jk ];
+    platforms = [ "x86_64-linux" "x86_64-darwin" ];
+  };
+
+in
+if stdenv.isDarwin
+then darwin
+else linux
diff --git a/pkgs/applications/networking/cluster/octant/update-desktop.sh b/pkgs/applications/networking/cluster/octant/update-desktop.sh
new file mode 100755
index 00000000000..4450834b4b7
--- /dev/null
+++ b/pkgs/applications/networking/cluster/octant/update-desktop.sh
@@ -0,0 +1,36 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p curl gnused gawk nix-prefetch
+
+set -euo pipefail
+
+ROOT="$(dirname "$(readlink -f "$0")")"
+NIX_DRV="$ROOT/desktop.nix"
+if [ ! -f "$NIX_DRV" ]; then
+  echo "ERROR: cannot find desktop.nix in $ROOT"
+  exit 1
+fi
+
+fetch_arch() {
+  VER="$1"; SUFFIX="$2"
+  URL="https://github.com/vmware-tanzu/octant/releases/download/v${VER}/Octant-${VER}.${SUFFIX}"
+  nix-prefetch "{ stdenv, fetchurl }:
+stdenv.mkDerivation rec {
+  pname = \"octant-desktop\"; version = \"${VER}\";
+  src = fetchurl { url = \"$URL\"; };
+}
+"
+}
+
+replace_sha() {
+  sed -i "s#$1 = \"sha256-.\{44\}\"#$1 = \"$2\"#" "$NIX_DRV"
+}
+
+OCTANT_VER=$(curl -Ls -w "%{url_effective}" -o /dev/null https://github.com/vmware-tanzu/octant/releases/latest | awk -F'/' '{print $NF}' | sed 's/v//')
+
+OCTANT_DESKTOP_LINUX_X64_SHA256=$(fetch_arch "$OCTANT_VER" "AppImage")
+OCTANT_DESKTOP_DARWIN_X64_SHA256=$(fetch_arch "$OCTANT_VER" "dmg")
+
+sed -i "s/version = \".*\"/version = \"$OCTANT_VER\"/" "$NIX_DRV"
+
+replace_sha "x86_64-linux" "$OCTANT_DESKTOP_LINUX_X64_SHA256"
+replace_sha "x86_64-darwin" "$OCTANT_DESKTOP_DARWIN_X64_SHA256"
diff --git a/pkgs/applications/networking/cluster/octant/update.sh b/pkgs/applications/networking/cluster/octant/update.sh
index 4ffe4aefb30..6c34fc4b37a 100755
--- a/pkgs/applications/networking/cluster/octant/update.sh
+++ b/pkgs/applications/networking/cluster/octant/update.sh
@@ -28,11 +28,11 @@ replace_sha() {
 OCTANT_VER=$(curl -Ls -w "%{url_effective}" -o /dev/null https://github.com/vmware-tanzu/octant/releases/latest | awk -F'/' '{print $NF}' | sed 's/v//')
 
 OCTANT_LINUX_X64_SHA256=$(fetch_arch "$OCTANT_VER" "Linux-64bit")
-OCTANT_DARWIN_X64_SHA256=$(fetch_arch "$OCTANT_VER" "Linux-arm64")
-OCTANT_LINUX_AARCH64_SHA256=$(fetch_arch "$OCTANT_VER" "macOS-64bit")
+OCTANT_LINUX_AARCH64_SHA256=$(fetch_arch "$OCTANT_VER" "Linux-arm64")
+OCTANT_DARWIN_X64_SHA256=$(fetch_arch "$OCTANT_VER" "macOS-64bit")
 
 sed -i "s/version = \".*\"/version = \"$OCTANT_VER\"/" "$NIX_DRV"
 
 replace_sha "x86_64-linux" "$OCTANT_LINUX_X64_SHA256"
-replace_sha "x86_64-darwin" "$OCTANT_LINUX_AARCH64_SHA256"
-replace_sha "aarch64-linux" "$OCTANT_DARWIN_X64_SHA256"
+replace_sha "aarch64-linux" "$OCTANT_LINUX_AARCH64_SHA256"
+replace_sha "x86_64-darwin" "$OCTANT_DARWIN_X64_SHA256"
diff --git a/pkgs/applications/office/qownnotes/default.nix b/pkgs/applications/office/qownnotes/default.nix
index e397743b22d..451e4b92185 100644
--- a/pkgs/applications/office/qownnotes/default.nix
+++ b/pkgs/applications/office/qownnotes/default.nix
@@ -2,13 +2,13 @@
 
 mkDerivation rec {
   pname = "qownnotes";
-  version = "21.3.2";
+  version = "21.4.0";
 
   src = fetchurl {
     url = "https://download.tuxfamily.org/${pname}/src/${pname}-${version}.tar.xz";
     # Can grab official version like so:
-    # $ curl https://download.tuxfamily.org/qownnotes/src/qownnotes-21.3.2.tar.xz.sha256
-    sha256 = "a8e8ab2ca1ef6684407adeb8fc63abcafff407a367471e053c583a1c4215e5ee";
+    # $ curl https://download.tuxfamily.org/qownnotes/src/qownnotes-21.4.0.tar.xz.sha256
+    sha256 = "bda454031a79a768b472677036ada7501ea430482277f1694757066922428eec";
   };
 
   nativeBuildInputs = [ qmake qttools ];
diff --git a/pkgs/development/libraries/libqalculate/default.nix b/pkgs/development/libraries/libqalculate/default.nix
index e55cda51748..45b79571b43 100644
--- a/pkgs/development/libraries/libqalculate/default.nix
+++ b/pkgs/development/libraries/libqalculate/default.nix
@@ -3,13 +3,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libqalculate";
-  version = "3.17.0";
+  version = "3.18.0";
 
   src = fetchFromGitHub {
     owner = "qalculate";
     repo = "libqalculate";
     rev = "v${version}";
-    sha256 = "sha256-VlKJrGZOMmnWFmdwV3SchBfyRsHM78eNV+uWONLZbJI=";
+    sha256 = "sha256-cQNcKa/mEdeH1MaLhj203MOphfYDTQ5pn/GzUmSZGcE=";
   };
 
   outputs = [ "out" "dev" "doc" ];
diff --git a/pkgs/development/libraries/physics/pythia/default.nix b/pkgs/development/libraries/physics/pythia/default.nix
index 1bec3300f80..48fc95e788a 100644
--- a/pkgs/development/libraries/physics/pythia/default.nix
+++ b/pkgs/development/libraries/physics/pythia/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "pythia";
-  version = "8.303";
+  version = "8.304";
 
   src = fetchurl {
     url = "http://home.thep.lu.se/~torbjorn/pythia8/pythia${builtins.replaceStrings ["."] [""] version}.tgz";
-    sha256 = "0gli6zf8931i7kyminppisc9d0q69xxnalvhld5fgnkh4q82nz6d";
+    sha256 = "18frx7xyvxnz57fxjncjyjzsk169h0jz6hxzjfpmwm3dzcc712fk";
   };
 
   buildInputs = [ boost fastjet hepmc zlib rsync lhapdf ];
diff --git a/pkgs/development/python-modules/devolo-home-control-api/default.nix b/pkgs/development/python-modules/devolo-home-control-api/default.nix
index 8fba64d0a8f..90e34288154 100644
--- a/pkgs/development/python-modules/devolo-home-control-api/default.nix
+++ b/pkgs/development/python-modules/devolo-home-control-api/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "devolo-home-control-api";
-  version = "0.17.1";
+  version = "0.17.3";
   disabled = pythonOlder "3.6";
 
   src = fetchFromGitHub {
     owner = "2Fake";
     repo = "devolo_home_control_api";
     rev = "v${version}";
-    sha256 = "sha256-5PaIZPwikDmT4kmh0Qfg65gBAUYralmO6a22GtzoB7A=";
+    sha256 = "1h7admqb1l28sxwhhkkhw0sfzgpn8zpczvmi3h28f68csflkv379";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pykwalify/default.nix b/pkgs/development/python-modules/pykwalify/default.nix
index d2b31ebbf4c..b65c0fd4670 100644
--- a/pkgs/development/python-modules/pykwalify/default.nix
+++ b/pkgs/development/python-modules/pykwalify/default.nix
@@ -1,32 +1,40 @@
-{ lib, buildPythonPackage, fetchPypi
-, dateutil, docopt, pyyaml
-, pytest, testfixtures
+{ lib
+, buildPythonPackage
+, dateutil
+, docopt
+, fetchPypi
+, pytestCheckHook
+, pyyaml
+, ruamel-yaml
+, testfixtures
 }:
 
 buildPythonPackage rec {
-  version = "1.7.0";
+  version = "1.8.0";
   pname = "pykwalify";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1cnfzkg1b01f825ikpw2fhjclf9c8akxjfrbd1vc22x1lg2kk2vy";
+    sha256 = "sha256-eWsq0+1MuZuIMItTP7L1WcMPpu+0+p/aETR/SD0kWIQ=";
   };
 
   propagatedBuildInputs = [
     dateutil
     docopt
     pyyaml
+    ruamel-yaml
   ];
 
   checkInputs = [
-    pytest
+    pytestCheckHook
     testfixtures
   ];
 
-  checkPhase = ''
-    pytest \
-      -k 'not test_multi_file_support'
-  '';
+  disabledTests = [
+    "test_multi_file_support"
+  ];
+
+  pythonImportsCheck = [ "pykwalify" ];
 
   meta = with lib; {
     homepage = "https://github.com/Grokzen/pykwalify";
diff --git a/pkgs/development/python-modules/pynvim/default.nix b/pkgs/development/python-modules/pynvim/default.nix
index 53bb06b13dd..84e7b686980 100644
--- a/pkgs/development/python-modules/pynvim/default.nix
+++ b/pkgs/development/python-modules/pynvim/default.nix
@@ -12,11 +12,11 @@
 
 buildPythonPackage rec {
   pname = "pynvim";
-  version = "0.4.2";
+  version = "0.4.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "6bc6204d465de5888a0c5e3e783fe01988b032e22ae87875912280bef0e40f8f";
+    sha256 = "sha256-OnlTeL3l6AkvvrOhqZvpxhPSaFVC8dsOXG/UZ+7Vbf8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/python-smarttub/default.nix b/pkgs/development/python-modules/python-smarttub/default.nix
index 372c12c3599..ec47b88daa9 100644
--- a/pkgs/development/python-modules/python-smarttub/default.nix
+++ b/pkgs/development/python-modules/python-smarttub/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "python-smarttub";
-  version = "0.0.21";
+  version = "0.0.23";
   disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "mdz";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-7phx6CI6sqUCZIUxL6ea25UWAcI3NAz66hIleUfN4bk=";
+    sha256 = "0maqbmk50xjhv9f0zm62ayzyf99kic3c0g5714cqkw3pfp8k75cx";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/splinter/default.nix b/pkgs/development/python-modules/splinter/default.nix
index fde5733a864..1ae05cab973 100644
--- a/pkgs/development/python-modules/splinter/default.nix
+++ b/pkgs/development/python-modules/splinter/default.nix
@@ -1,30 +1,50 @@
 { lib
 , buildPythonPackage
-, fetchPypi
+, fetchFromGitHub
 , selenium
+, six
 , flask
-, coverage
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "splinter";
   version = "0.14.0";
 
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "459e39e7a9f7572db6f1cdb5fdc5ccfc6404f021dccb969ee6287be2386a40db";
+  src = fetchFromGitHub {
+    owner = "cobrateam";
+    repo = "splinter";
+    rev = version;
+    sha256 = "0480bqprv8581cvnc80ls91rz9780wvdnfw99zsw44hvy2yg15a6";
   };
 
-  propagatedBuildInputs = [ selenium ];
+  propagatedBuildInputs = [
+    selenium
+    six
+  ];
 
-  checkInputs = [ flask coverage ];
+  checkInputs = [
+    flask
+    pytestCheckHook
+  ];
 
-  # No tests included
-  doCheck = false;
+  disabledTestPaths = [
+    "samples"
+    "tests/test_djangoclient.py"
+    "tests/test_flaskclient.py"
+    "tests/test_webdriver.py"
+    "tests/test_webdriver_chrome.py"
+    "tests/test_webdriver_firefox.py"
+    "tests/test_webdriver_remote.py"
+    "tests/test_zopetestbrowser.py"
+  ];
 
-  meta = {
+  pythonImportsCheck = [ "splinter" ];
+
+  meta = with lib; {
     description = "Browser abstraction for web acceptance testing";
     homepage = "https://github.com/cobrateam/splinter";
-    license = lib.licenses.bsd3;
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ dotlambda ];
   };
 }
diff --git a/pkgs/development/python-modules/west/default.nix b/pkgs/development/python-modules/west/default.nix
index 8958f37b0f8..6b937509314 100644
--- a/pkgs/development/python-modules/west/default.nix
+++ b/pkgs/development/python-modules/west/default.nix
@@ -3,14 +3,14 @@
 }:
 
 buildPythonPackage rec {
-  version = "0.8.0";
+  version = "0.10.1";
   pname = "west";
 
   disabled = !isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "672053c3392248846694e5619a7fe6ab4c40f010a8f5be6350821b39f6132a26";
+    sha256 = "sha256-gwbrxnQ0j0FV2Cv+hQEoK0HthstEw/xjaozPjgV7GEc=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/tools/cloud-nuke/default.nix b/pkgs/development/tools/cloud-nuke/default.nix
index 0be4faf0ed8..9085be14284 100644
--- a/pkgs/development/tools/cloud-nuke/default.nix
+++ b/pkgs/development/tools/cloud-nuke/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "cloud-nuke";
-  version = "0.1.27";
+  version = "0.1.28";
 
   src = fetchFromGitHub {
     owner = "gruntwork-io";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1708g8msv5cw0b4gljyjqns328wbci3p3avwysms4aknm4vky0g0";
+    sha256 = "sha256-UssjIix2sFLqau5PMFNDP9XPCSNUdRO6aBixIQNtSy8=";
   };
 
-  vendorSha256 = "0m7k6k790i06i8a5r8y7787mmikfibbvl7s8xqxygq1f5cpdspd6";
+  vendorSha256 = "sha256-pl3dLisu4Oc77kgfuteKbsZaDzrHo1wUigZEkM4081Q=";
 
   buildFlagsArray = [ "-ldflags=-s -w -X main.VERSION=${version}" ];
 
diff --git a/pkgs/development/tools/database/dbmate/default.nix b/pkgs/development/tools/database/dbmate/default.nix
index 6634c2b6384..0e4609a1fa2 100644
--- a/pkgs/development/tools/database/dbmate/default.nix
+++ b/pkgs/development/tools/database/dbmate/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "dbmate";
-  version = "1.11.0";
+  version = "1.12.0";
 
   src = fetchFromGitHub {
     owner = "amacneil";
     repo = "dbmate";
     rev = "v${version}";
-    sha256 = "1q1hyrd1zlynyb0720fd1lwg22l3bwjbcak2aplh259p698gwyf5";
+    sha256 = "sha256-Kk8CtGw1lGNky2CUjaedh0IcDooaxWkeEnaYl/5jSTc=";
   };
 
-  vendorSha256 = "197zpjvvv9xpfbw443kbxvhjmjqmx1h2bj1xl2vwgf0w64mkk84z";
+  vendorSha256 = "sha256-Qe3fwyEf/NiGmUSha/zZHRBR1okw2vE97u7tybqiWNI=";
 
   doCheck = false;
 
diff --git a/pkgs/development/tools/go-toml/default.nix b/pkgs/development/tools/go-toml/default.nix
index 3d892378133..9a0fa54fb2d 100644
--- a/pkgs/development/tools/go-toml/default.nix
+++ b/pkgs/development/tools/go-toml/default.nix
@@ -2,13 +2,13 @@
 
 buildGoPackage rec {
   pname = "go-toml";
-  version = "1.8.1";
+  version = "1.9.0";
 
   src = fetchFromGitHub {
     owner = "pelletier";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1pi1r9ds0vxjza4qrbk52y98wxrzh1ghwzc9c2v1w6i02pdwdcz9";
+    sha256 = "sha256-m8VgjfNDxSX6fRG2/gEJlVc9hCnua+o79ttrd8P20kU=";
   };
 
   goPackagePath = "github.com/pelletier/go-toml";
diff --git a/pkgs/development/tools/metals/default.nix b/pkgs/development/tools/metals/default.nix
index 100190b0894..78c99d94c8d 100644
--- a/pkgs/development/tools/metals/default.nix
+++ b/pkgs/development/tools/metals/default.nix
@@ -2,7 +2,7 @@
 
 stdenv.mkDerivation rec {
   pname = "metals";
-  version = "0.10.0";
+  version = "0.10.1";
 
   deps = stdenv.mkDerivation {
     name = "${pname}-deps-${version}";
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
     '';
     outputHashMode = "recursive";
     outputHashAlgo = "sha256";
-    outputHash     = "1v9br6nad6yhq9y1z4b9z6xdsjrgqh7wlxww7vp7ws28cg85mqyg";
+    outputHash     = "0z4ddnwx510hnx6w72fxmksmnwxg8p2nqxg7i7xix24gykgmgj5a";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/games/cdogs-sdl/default.nix b/pkgs/games/cdogs-sdl/default.nix
new file mode 100644
index 00000000000..1c35e1e86e7
--- /dev/null
+++ b/pkgs/games/cdogs-sdl/default.nix
@@ -0,0 +1,52 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, pkg-config
+, SDL2
+, SDL2_image
+, SDL2_mixer
+, cmake
+, gtk3-x11
+, python3
+, protobuf
+}:
+
+stdenv.mkDerivation rec {
+  pname = "cdogs";
+  version = "0.11.0";
+
+  src = fetchFromGitHub {
+    repo = "cdogs-sdl";
+    owner = "cxong";
+    rev = version;
+    sha256 = "sha256-zWwlcEM2KsYiB48cmRTjou0C86SqeoOLrbacCR0SfIA=";
+  };
+
+  postPatch = ''
+    patchShebangs src/proto/nanopb/generator/*
+  '';
+
+  cmakeFlags = [ "-DCDOGS_DATA_DIR=${placeholder "out"}/" ];
+
+  nativeBuildInputs = [
+    pkg-config
+    cmake
+    (python3.withPackages (pp: with pp; [ pp.protobuf setuptools ]))
+  ];
+
+  buildInputs = [
+    SDL2
+    SDL2_image
+    SDL2_mixer
+    gtk3-x11
+    protobuf
+  ];
+
+  meta = with lib; {
+    homepage = "https://cxong.github.io/cdogs-sdl";
+    description = "Open source classic overhead run-and-gun game";
+    license = licenses.gpl2Only;
+    maintainers = with maintainers; [ nixinator ];
+    platforms = platforms.unix;
+  };
+}
diff --git a/pkgs/os-specific/linux/openvswitch/default.nix b/pkgs/os-specific/linux/openvswitch/default.nix
index 25410553486..5faccc14ce7 100644
--- a/pkgs/os-specific/linux/openvswitch/default.nix
+++ b/pkgs/os-specific/linux/openvswitch/default.nix
@@ -8,12 +8,12 @@ let
   _kernel = kernel;
   pythonEnv = python3.withPackages (ps: with ps; [ six ]);
 in stdenv.mkDerivation rec {
-  version = "2.14.1";
+  version = "2.14.2";
   pname = "openvswitch";
 
   src = fetchurl {
     url = "https://www.openvswitch.org/releases/${pname}-${version}.tar.gz";
-    sha256 = "sha256-GAttQsCrSybyH1i4vzszdiA9dHWqeo7xUTZVFMNQiP4=";
+    sha256 = "sha256-ZfQg+VTiUNiV+y2yKhMuHLVgvF4rkFHoNFETSBCOWXo=";
   };
 
   kernel = optional (_kernel != null) _kernel.dev;
diff --git a/pkgs/os-specific/linux/openvswitch/lts.nix b/pkgs/os-specific/linux/openvswitch/lts.nix
index 4a6cf887c3b..15c6c05b061 100644
--- a/pkgs/os-specific/linux/openvswitch/lts.nix
+++ b/pkgs/os-specific/linux/openvswitch/lts.nix
@@ -7,12 +7,12 @@ with lib;
 let
   _kernel = kernel;
 in stdenv.mkDerivation rec {
-  version = "2.5.9";
+  version = "2.5.12";
   pname = "openvswitch";
 
   src = fetchurl {
     url = "https://www.openvswitch.org/releases/${pname}-${version}.tar.gz";
-    sha256 = "0iv0ncwl6s4qyyb655yj5xvqrjr1zbymmab96q259wa09xnyw7b7";
+    sha256 = "0a8wa1lj5p28x3vq0yaxjhqmppp4hvds6hhm0j3czpp8mc09fsfq";
   };
 
   patches = [ ./patches/lts-ssl.patch ];
diff --git a/pkgs/servers/home-assistant/component-packages.nix b/pkgs/servers/home-assistant/component-packages.nix
index 3ba0db4114d..391352fc797 100644
--- a/pkgs/servers/home-assistant/component-packages.nix
+++ b/pkgs/servers/home-assistant/component-packages.nix
@@ -2,7 +2,7 @@
 # Do not edit!
 
 {
-  version = "2021.4.2";
+  version = "2021.4.3";
   components = {
     "abode" = ps: with ps; [ abodepy ];
     "accuweather" = ps: with ps; [ accuweather ];
diff --git a/pkgs/servers/home-assistant/default.nix b/pkgs/servers/home-assistant/default.nix
index 5dcc6f46322..e0f7db7a577 100644
--- a/pkgs/servers/home-assistant/default.nix
+++ b/pkgs/servers/home-assistant/default.nix
@@ -95,7 +95,7 @@ let
   extraBuildInputs = extraPackages py.pkgs;
 
   # Don't forget to run parse-requirements.py after updating
-  hassVersion = "2021.4.2";
+  hassVersion = "2021.4.3";
 
 in with py.pkgs; buildPythonApplication rec {
   pname = "homeassistant";
@@ -114,7 +114,7 @@ in with py.pkgs; buildPythonApplication rec {
     owner = "home-assistant";
     repo = "core";
     rev = version;
-    sha256 = "0z6a5m1yflnz468njp8v7vd189gv5pc63kji14f4fx4nfzbxhqdk";
+    sha256 = "00jgnk8vssvk7mdnlijwddwaj56hs1hcyw83r1jqhn5nk5qj3b7q";
   };
 
   # leave this in, so users don't have to constantly update their downstream patch handling
diff --git a/pkgs/tools/misc/osm2pgsql/default.nix b/pkgs/tools/misc/osm2pgsql/default.nix
index a6b8d01dd46..4d959c6480a 100644
--- a/pkgs/tools/misc/osm2pgsql/default.nix
+++ b/pkgs/tools/misc/osm2pgsql/default.nix
@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation rec {
   pname = "osm2pgsql";
-  version = "1.4.1";
+  version = "1.4.2";
 
   src = fetchFromGitHub {
     owner = "openstreetmap";
     repo = pname;
     rev = version;
-    sha256 = "0ld43k7xx395hd6kcn8wyacvb1cfjy670lh9w6yhfi78nxqj9mmy";
+    sha256 = "141blh6lwbgn8hh45xaa0yiwygdc444h9zahx5xrzx5pck9zb5ps";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/tools/networking/clash/default.nix b/pkgs/tools/networking/clash/default.nix
index ede7dce2724..9cad36c68a6 100644
--- a/pkgs/tools/networking/clash/default.nix
+++ b/pkgs/tools/networking/clash/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "clash";
-  version = "1.4.2";
+  version = "1.5.0";
 
   src = fetchFromGitHub {
     owner = "Dreamacro";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-ObnlcKTuO/yFNMXLwGvRTLnz18bNquq6dye2qpL7+VM=";
+    sha256 = "sha256-I4qpcHsN8WGt7YLNXO08BJypilhMSVmZjqECDjlEqXU=";
   };
 
-  vendorSha256 = "sha256-6ZQMDXc2NFs6l/DWPPCFJ+c40764hXzFTdi1Pxk1fnU=";
+  vendorSha256 = "sha256-Nfzk7p52msGxTPDbs4g9KuRPFxp4Npt0QXkdVOZvipc=";
 
   doCheck = false;
 
diff --git a/pkgs/tools/networking/dnsproxy/default.nix b/pkgs/tools/networking/dnsproxy/default.nix
index 0b36c76ca62..20256aa006b 100644
--- a/pkgs/tools/networking/dnsproxy/default.nix
+++ b/pkgs/tools/networking/dnsproxy/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "dnsproxy";
-  version = "0.36.0";
+  version = "0.37.0";
 
   src = fetchFromGitHub {
     owner = "AdguardTeam";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-VTmQ37kUWlc18p8Qdm2ZFID+t6OIp7y2qU12rXqE6Xo=";
+    sha256 = "sha256-3zsEEq6pVo5yHY4v5TXhZo4jo6htjCYypzxMMv8zQGE=";
   };
 
   vendorSha256 = null;
diff --git a/pkgs/tools/security/httpx/default.nix b/pkgs/tools/security/httpx/default.nix
index bff9e03bc6f..129395912f9 100644
--- a/pkgs/tools/security/httpx/default.nix
+++ b/pkgs/tools/security/httpx/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "httpx";
-  version = "1.0.3";
+  version = "1.0.4";
 
   src = fetchFromGitHub {
     owner = "projectdiscovery";
     repo = "httpx";
     rev = "v${version}";
-    sha256 = "15ihc5926kbai16i59c7bmvgd162qq9dpd52g4vrp7dq4jrz155m";
+    sha256 = "sha256-w5CNvtlhvm1SyAKaoA7Fw8ZSY9Z78MentrSNS4mpr1Q=";
   };
 
-  vendorSha256 = "0fg93vhwpx113fpw8qg4ram4bdh6a8x3a36pr1c962s4vhrabwy2";
+  vendorSha256 = "sha256-VBxGapvC2QE/0slsAiCBzmwOSMeGepZU0pYVDepSrwg=";
 
   meta = with lib; {
     description = "Fast and multi-purpose HTTP toolkit";
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 403ed59ba32..32c6eb4ee80 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -562,6 +562,7 @@ in
   ociTools = callPackage ../build-support/oci-tools { };
 
   octant = callPackage ../applications/networking/cluster/octant { };
+  octant-desktop = callPackage ../applications/networking/cluster/octant/desktop.nix { };
   starboard-octant-plugin = callPackage ../applications/networking/cluster/octant/plugins/starboard-octant-plugin.nix { };
 
   pathsFromGraph = ../build-support/kernel/paths-from-graph.pl;
@@ -19108,6 +19109,9 @@ in
 
   sogo = callPackage ../servers/web-apps/sogo { };
 
+  spacecookie =
+    haskell.lib.justStaticExecutables haskellPackages.spacecookie;
+
   spawn_fcgi = callPackage ../servers/http/spawn-fcgi { };
 
   spring-boot-cli = callPackage ../development/tools/spring-boot-cli { };
@@ -27309,6 +27313,8 @@ in
 
   cbonsai = callPackage ../games/cbonsai { };
 
+  cdogs-sdl = callPackage ../games/cdogs-sdl { };
+
   chessdb = callPackage ../games/chessdb { };
 
   chessx = libsForQt5.callPackage ../games/chessx { };