diff --git a/nixos/modules/config/fonts/fontconfig.nix b/nixos/modules/config/fonts/fontconfig.nix
index 1f1044bc5af..ae7db74d011 100644
--- a/nixos/modules/config/fonts/fontconfig.nix
+++ b/nixos/modules/config/fonts/fontconfig.nix
@@ -35,7 +35,7 @@ let
     in
     pkgs.writeText "fc-00-nixos-cache.conf" ''
       <?xml version='1.0'?>
-      <!DOCTYPE fontconfig SYSTEM 'fonts.dtd'>
+      <!DOCTYPE fontconfig SYSTEM 'urn:fontconfig:fonts.dtd'>
       <fontconfig>
         <!-- Font directories -->
         ${concatStringsSep "\n" (map (font: "<dir>${font}</dir>") config.fonts.fonts)}
@@ -53,7 +53,7 @@ let
   # priority 10
   renderConf = pkgs.writeText "fc-10-nixos-rendering.conf" ''
     <?xml version='1.0'?>
-    <!DOCTYPE fontconfig SYSTEM 'fonts.dtd'>
+    <!DOCTYPE fontconfig SYSTEM 'urn:fontconfig:fonts.dtd'>
     <fontconfig>
 
       <!-- Default rendering settings -->
@@ -110,7 +110,7 @@ let
     in
     pkgs.writeText "fc-52-nixos-default-fonts.conf" ''
     <?xml version='1.0'?>
-    <!DOCTYPE fontconfig SYSTEM 'fonts.dtd'>
+    <!DOCTYPE fontconfig SYSTEM 'urn:fontconfig:fonts.dtd'>
     <fontconfig>
 
       <!-- Default fonts -->
@@ -129,7 +129,7 @@ let
   # priority 53
   rejectBitmaps = pkgs.writeText "fc-53-no-bitmaps.conf" ''
     <?xml version="1.0"?>
-    <!DOCTYPE fontconfig SYSTEM "fonts.dtd">
+    <!DOCTYPE fontconfig SYSTEM "urn:fontconfig:fonts.dtd">
     <fontconfig>
 
     ${optionalString (!cfg.allowBitmaps) ''
@@ -157,7 +157,7 @@ let
   # priority 53
   rejectType1 = pkgs.writeText "fc-53-nixos-reject-type1.conf" ''
     <?xml version="1.0"?>
-    <!DOCTYPE fontconfig SYSTEM "fonts.dtd">
+    <!DOCTYPE fontconfig SYSTEM "urn:fontconfig:fonts.dtd">
     <fontconfig>
 
     <!-- Reject Type 1 fonts -->
diff --git a/nixos/modules/system/boot/stage-1.nix b/nixos/modules/system/boot/stage-1.nix
index 1b2f22a039c..6823e12847c 100644
--- a/nixos/modules/system/boot/stage-1.nix
+++ b/nixos/modules/system/boot/stage-1.nix
@@ -87,9 +87,7 @@ let
   # copy what we need.  Instead of using statically linked binaries,
   # we just copy what we need from Glibc and use patchelf to make it
   # work.
-  extraUtils = let
-    # Use lvm2 without udev support, which is the same lvm2 we already have in the closure anyways
-    lvm2 = pkgs.lvm2.override { udev = null; }; in pkgs.runCommandCC "extra-utils"
+  extraUtils = pkgs.runCommandCC "extra-utils"
     { nativeBuildInputs = [pkgs.buildPackages.nukeReferences];
       allowedReferences = [ "out" ]; # prevent accidents like glibc being included in the initrd
     }
@@ -113,8 +111,8 @@ let
       copy_bin_and_libs ${pkgs.utillinux}/sbin/blkid
 
       # Copy dmsetup and lvm.
-      copy_bin_and_libs ${getBin lvm2}/bin/dmsetup
-      copy_bin_and_libs ${getBin lvm2}/bin/lvm
+      copy_bin_and_libs ${getBin pkgs.lvm2}/bin/dmsetup
+      copy_bin_and_libs ${getBin pkgs.lvm2}/bin/lvm
 
       # Add RAID mdadm tool.
       copy_bin_and_libs ${pkgs.mdadm}/sbin/mdadm
diff --git a/nixos/tests/installer.nix b/nixos/tests/installer.nix
index f64e4101d45..bd1bf733153 100644
--- a/nixos/tests/installer.nix
+++ b/nixos/tests/installer.nix
@@ -317,7 +317,6 @@ let
             texinfo
             unionfs-fuse
             xorg.lndir
-            (lvm2.override { udev = null; }) # for initrd (extra-utils)
 
             # add curl so that rather than seeing the test attempt to download
             # curl's tarball, we see what it's trying to download
diff --git a/pkgs/applications/audio/mpg123/default.nix b/pkgs/applications/audio/mpg123/default.nix
index 5260cb85a27..21dffa8d509 100644
--- a/pkgs/applications/audio/mpg123/default.nix
+++ b/pkgs/applications/audio/mpg123/default.nix
@@ -3,11 +3,11 @@
 }:
 
 stdenv.mkDerivation rec {
-  name = "mpg123-1.26.2";
+  name = "mpg123-1.26.3";
 
   src = fetchurl {
     url = "mirror://sourceforge/mpg123/${name}.tar.bz2";
-    sha256 = "1wrgds46wj6xsnqa6bi8kkh3wd29i2nxclbps34w5kjglrzbzxq0";
+    sha256 = "0vkcfdx0mqq6lmpczsmpa2jsb0s6dryx3i7gvr32i3w9b9w9ij9h";
   };
 
   buildInputs = stdenv.lib.optional (!stdenv.isDarwin) alsaLib;
diff --git a/pkgs/applications/editors/emacs/generic.nix b/pkgs/applications/editors/emacs/generic.nix
index 2067d6c7778..71bb472d097 100644
--- a/pkgs/applications/editors/emacs/generic.nix
+++ b/pkgs/applications/editors/emacs/generic.nix
@@ -11,7 +11,7 @@
 , libtiff, librsvg, gconf, libxml2, imagemagick, gnutls, libselinux
 , alsaLib, cairo, acl, gpm, AppKit, GSS, ImageIO, m17n_lib, libotf
 , jansson, harfbuzz
-, libgccjit, targetPlatform, binutils, binutils-unwrapped, makeWrapper # native-comp params
+, libgccjit, targetPlatform, makeWrapper # native-comp params
 , systemd ? null
 , withX ? !stdenv.isDarwin
 , withNS ? stdenv.isDarwin
@@ -67,18 +67,23 @@ in stdenv.mkDerivation {
 
     # Make native compilation work both inside and outside of nix build
     (lib.optionalString nativeComp (let
-      libPath = lib.concatStringsSep ":" [
-        "${lib.getLib libgccjit}/lib/gcc/${targetPlatform.config}/${libgccjit.version}"
-        "${lib.getLib stdenv.cc.cc}/lib"
-        "${lib.getLib stdenv.glibc}/lib"
-      ];
+      backendPath = (lib.concatStringsSep " "
+        (builtins.map (x: ''\"-B${x}\"'') [
+          # Paths necessary so the JIT compiler finds its libraries:
+          "${lib.getLib libgccjit}/lib"
+          "${lib.getLib libgccjit}/lib/gcc"
+          "${lib.getLib stdenv.cc.libc}/lib"
+
+          # Executable paths necessary for compilation (ld, as):
+          "${lib.getBin stdenv.cc.cc}"
+          "${lib.getBin stdenv.cc.bintools}"
+          "${lib.getBin stdenv.cc.bintools.bintools}"
+        ]));
     in ''
       substituteInPlace lisp/emacs-lisp/comp.el --replace \
-        "(defcustom comp-async-env-modifier-form nil" \
-        "(defcustom comp-async-env-modifier-form '((setenv \"LIBRARY_PATH\" (string-join (seq-filter (lambda (v) (null (eq v nil))) (list (getenv \"LIBRARY_PATH\") \"${libPath}\")) \":\")))"
-
+        "(defcustom comp-native-driver-options nil" \
+        "(defcustom comp-native-driver-options '(${backendPath})"
     ''))
-
     ""
   ];
 
@@ -156,11 +161,6 @@ in stdenv.mkDerivation {
         "$out/bin/emacs"
       patchelf --add-needed "libXcursor.so.1" "$out/bin/emacs"
     '')
-
-    (lib.optionalString nativeComp ''
-      wrapProgram $out/bin/emacs-* --prefix PATH : "${lib.makeBinPath [ binutils binutils-unwrapped ]}"
-    '')
-
   ];
 
   passthru = {
diff --git a/pkgs/applications/editors/vim/common.nix b/pkgs/applications/editors/vim/common.nix
index 5be7078173e..4ae7600f4a1 100644
--- a/pkgs/applications/editors/vim/common.nix
+++ b/pkgs/applications/editors/vim/common.nix
@@ -1,12 +1,12 @@
 { lib, fetchFromGitHub }:
 rec {
-  version = "8.2.1123";
+  version = "8.2.1522";
 
   src = fetchFromGitHub {
     owner = "vim";
     repo = "vim";
     rev = "v${version}";
-    sha256 = "01fgfm5pnmbq12z84d7g3x0iq5gj1irdyihx41c4r2bww55v5q0c";
+    sha256 = "0dah3392cq06pagik5y7kcq61mslqvfsh7vqldv3kvhr5ilqb8qy";
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/applications/gis/openorienteering-mapper/default.nix b/pkgs/applications/gis/openorienteering-mapper/default.nix
index 39f8694dd17..540fa271897 100644
--- a/pkgs/applications/gis/openorienteering-mapper/default.nix
+++ b/pkgs/applications/gis/openorienteering-mapper/default.nix
@@ -56,8 +56,6 @@ mkDerivation rec {
     "-DLICENSING_PROVIDER:BOOL=OFF"
     "-DMapper_MANUAL_QTHELP:BOOL=OFF"
   ] ++ stdenv.lib.optionals stdenv.isDarwin [
-    # Usually enabled on Darwin
-    "-DCMAKE_FIND_FRAMEWORK=never"
     # FindGDAL is broken and always finds /Library/Framework unless this is
     # specified
     "-DGDAL_INCLUDE_DIR=${gdal}/include"
diff --git a/pkgs/applications/kde/default.nix b/pkgs/applications/kde/default.nix
index 8816ae3cbbc..9622404c456 100644
--- a/pkgs/applications/kde/default.nix
+++ b/pkgs/applications/kde/default.nix
@@ -92,8 +92,14 @@ let
       kaddressbook = callPackage ./kaddressbook.nix {};
       kalarm = callPackage ./kalarm.nix {};
       kalarmcal = callPackage ./kalarmcal.nix {};
+      kalzium = callPackage ./kalzium.nix {};
+      kapman = callPackage ./kapman.nix {};
       kapptemplate = callPackage ./kapptemplate.nix { };
       kate = callPackage ./kate.nix {};
+      katomic = callPackage ./katomic.nix {};
+      kblackbox = callPackage ./kblackbox.nix {};
+      kblocks = callPackage ./kblocks.nix {};
+      kbounce = callPackage ./kbounce.nix {};
       kbreakout = callPackage ./kbreakout.nix {};
       kcachegrind = callPackage ./kcachegrind.nix {};
       kcalc = callPackage ./kcalc.nix {};
@@ -110,6 +116,7 @@ let
       kdepim-apps-libs = callPackage ./kdepim-apps-libs {};
       kdf = callPackage ./kdf.nix {};
       kdialog = callPackage ./kdialog.nix {};
+      kdiamond = callPackage ./kdiamond.nix {};
       keditbookmarks = callPackage ./keditbookmarks.nix {};
       kfind = callPackage ./kfind.nix {};
       kfloppy = callPackage ./kfloppy.nix {};
@@ -119,22 +126,32 @@ let
       khelpcenter = callPackage ./khelpcenter.nix {};
       kidentitymanagement = callPackage ./kidentitymanagement.nix {};
       kig = callPackage ./kig.nix {};
+      kigo = callPackage ./kigo.nix {};
+      killbots = callPackage ./killbots.nix {};
       kimap = callPackage ./kimap.nix {};
       kipi-plugins = callPackage ./kipi-plugins.nix {};
       kitinerary = callPackage ./kitinerary.nix {};
       kio-extras = callPackage ./kio-extras.nix {};
       kldap = callPackage ./kldap.nix {};
       kleopatra = callPackage ./kleopatra.nix {};
+      klettres = callPackage ./klettres.nix {};
+      klines = callPackage ./klines.nix {};
+      kmag = callPackage ./kmag.nix {};
       kmahjongg = callPackage ./kmahjongg.nix {};
       kmail = callPackage ./kmail.nix {};
       kmail-account-wizard = callPackage ./kmail-account-wizard.nix {};
       kmailtransport = callPackage ./kmailtransport.nix {};
       kmbox = callPackage ./kmbox.nix {};
       kmime = callPackage ./kmime.nix {};
+      kmines = callPackage ./kmines.nix {};
       kmix = callPackage ./kmix.nix {};
       kmplot = callPackage ./kmplot.nix {};
+      knavalbattle = callPackage ./knavalbattle.nix {};
+      knetwalk = callPackage ./knetwalk.nix {};
+      knights = callPackage ./knights.nix {};
       knotes = callPackage ./knotes.nix {};
       kolf = callPackage ./kolf.nix {};
+      kollision = callPackage ./kollision.nix {};
       kolourpaint = callPackage ./kolourpaint.nix {};
       kompare = callPackage ./kompare.nix {};
       konsole = callPackage ./konsole.nix {};
@@ -149,15 +166,21 @@ let
       ksquares = callPackage ./ksquares.nix {};
       kqtquickcharts = callPackage ./kqtquickcharts.nix {};
       kpkpass = callPackage ./kpkpass.nix {};
+      kreversi = callPackage ./kreversi.nix {};
       krdc = callPackage ./krdc.nix {};
       krfb = callPackage ./krfb.nix {};
       kruler = callPackage ./kruler.nix {};
+      kshisen = callPackage ./kshisen.nix {};
       kspaceduel = callPackage ./kspaceduel.nix {};
       ksudoku = callPackage ./ksudoku.nix {};
       ksystemlog = callPackage ./ksystemlog.nix {};
+      kteatime = callPackage ./kteatime.nix {};
+      ktimer = callPackage ./ktimer.nix {};
       ktnef = callPackage ./ktnef.nix {};
       ktouch = callPackage ./ktouch.nix {};
+      kturtle = callPackage ./kturtle.nix {};
       kwalletmanager = callPackage ./kwalletmanager.nix {};
+      kwave = callPackage ./kwave.nix {};
       libgravatar = callPackage ./libgravatar.nix {};
       libkcddb = callPackage ./libkcddb.nix {};
       libkdcraw = callPackage ./libkdcraw.nix {};
diff --git a/pkgs/applications/kde/kalzium.nix b/pkgs/applications/kde/kalzium.nix
new file mode 100644
index 00000000000..5bb51a6b4e1
--- /dev/null
+++ b/pkgs/applications/kde/kalzium.nix
@@ -0,0 +1,26 @@
+{ mkDerivation, lib, extra-cmake-modules, kdoctools, ki18n, kio, openbabel, avogadro, qtscript, kparts, kplotting, kunitconversion }:
+
+mkDerivation {
+  name = "kalzium";
+  meta = with lib; {
+    homepage = "https://kde.org/applications/en/utilities/org.kde.kalzium";
+    description = "Kalzium is a program that shows you the Periodic Table of Elements";
+    maintainers = with maintainers; [ freezeboy ];
+    license = licenses.gpl2Plus;
+    platforms = platforms.linux;
+  };
+  nativeBuildInputs = [
+    extra-cmake-modules
+  ];
+  buildInputs = [
+    qtscript
+    #avogadro
+    kdoctools
+    ki18n
+    kio
+    openbabel
+    kparts
+    kplotting
+    kunitconversion
+  ];
+}
diff --git a/pkgs/applications/kde/kapman.nix b/pkgs/applications/kde/kapman.nix
new file mode 100644
index 00000000000..68af796dda4
--- /dev/null
+++ b/pkgs/applications/kde/kapman.nix
@@ -0,0 +1,21 @@
+{ mkDerivation, lib, extra-cmake-modules, kdoctools, ki18n, kio, libkdegames }:
+
+mkDerivation {
+  name = "kapman";
+  meta = with lib; {
+    homepage = "https://kde.org/applications/en/games/org.kde.kapman";
+    description = "Kapman is a clone of the well known game Pac-Man";
+    maintainers = with maintainers; [ freezeboy ];
+    license = licenses.gpl2Plus;
+    platforms = platforms.linux;
+  };
+  nativeBuildInputs = [
+    extra-cmake-modules
+  ];
+  buildInputs = [
+    libkdegames
+    kdoctools
+    ki18n
+    kio
+  ];
+}
diff --git a/pkgs/applications/kde/katomic.nix b/pkgs/applications/kde/katomic.nix
new file mode 100644
index 00000000000..a1d0f12b6a1
--- /dev/null
+++ b/pkgs/applications/kde/katomic.nix
@@ -0,0 +1,22 @@
+{ mkDerivation, lib, extra-cmake-modules, kdoctools, ki18n, kio, libkdegames, knewstuff }:
+
+mkDerivation {
+  name = "katomic";
+  meta = with lib; {
+    homepage = "https://kde.org/applications/en/games/org.kde.katomic";
+    description = "KAtomic is a fun educational game built around molecular geometry";
+    maintainers = with maintainers; [ freezeboy ];
+    license = licenses.gpl2Plus;
+    platforms = platforms.linux;
+  };
+  nativeBuildInputs = [
+    extra-cmake-modules
+  ];
+  buildInputs = [
+    knewstuff
+    libkdegames
+    kdoctools
+    ki18n
+    kio
+  ];
+}
diff --git a/pkgs/applications/kde/kblackbox.nix b/pkgs/applications/kde/kblackbox.nix
new file mode 100644
index 00000000000..669c089df80
--- /dev/null
+++ b/pkgs/applications/kde/kblackbox.nix
@@ -0,0 +1,21 @@
+{ mkDerivation, lib, extra-cmake-modules, kdoctools, ki18n, kio, libkdegames }:
+
+mkDerivation {
+  name = "kblackbox";
+  meta = with lib; {
+    homepage = "https://kde.org/applications/en/games/org.kde.kblackbox";
+    description = "KBlackbox is a game of hide and seek played on a grid of boxes";
+    maintainers = with maintainers; [ freezeboy ];
+    license = licenses.gpl2Plus;
+    platforms = platforms.linux;
+  };
+  nativeBuildInputs = [
+    extra-cmake-modules
+  ];
+  buildInputs = [
+    libkdegames
+    kdoctools
+    ki18n
+    kio
+  ];
+}
diff --git a/pkgs/applications/kde/kblocks.nix b/pkgs/applications/kde/kblocks.nix
new file mode 100644
index 00000000000..1dedabb2a08
--- /dev/null
+++ b/pkgs/applications/kde/kblocks.nix
@@ -0,0 +1,21 @@
+{ mkDerivation, lib, extra-cmake-modules, kdoctools, ki18n, kio, libkdegames }:
+
+mkDerivation {
+  name = "kblocks";
+  meta = with lib; {
+    homepage = "https://kde.org/applications/en/games/org.kde.kblocks";
+    description = "KBlocks is the classic falling blocks game";
+    maintainers = with maintainers; [ freezeboy ];
+    license = licenses.gpl2Plus;
+    platforms = platforms.linux;
+  };
+  nativeBuildInputs = [
+    extra-cmake-modules
+  ];
+  buildInputs = [
+    libkdegames
+    kdoctools
+    ki18n
+    kio
+  ];
+}
diff --git a/pkgs/applications/kde/kbounce.nix b/pkgs/applications/kde/kbounce.nix
new file mode 100644
index 00000000000..a24d2155180
--- /dev/null
+++ b/pkgs/applications/kde/kbounce.nix
@@ -0,0 +1,22 @@
+{ mkDerivation, lib, extra-cmake-modules, libkdegames, kconfig, kcrash, kio, ki18n }:
+
+mkDerivation {
+  name = "kbounce";
+  meta = with lib; {
+    homepage = "https://kde.org/applications/en/games/org.kde.kbounce";
+    description = "KBounce is a single player arcade game with the elements of puzzle";
+    maintainers = with maintainers; [ freezeboy ];
+    license = licenses.gpl2Plus;
+    platforms = platforms.linux;
+  };
+  nativeBuildInputs = [
+    extra-cmake-modules
+  ];
+  buildInputs = [
+    libkdegames
+    kconfig
+    kcrash
+    kio
+    ki18n
+  ];
+}
diff --git a/pkgs/applications/kde/kdiamond.nix b/pkgs/applications/kde/kdiamond.nix
new file mode 100644
index 00000000000..26cd731beaf
--- /dev/null
+++ b/pkgs/applications/kde/kdiamond.nix
@@ -0,0 +1,23 @@
+{ mkDerivation, lib, extra-cmake-modules, kdoctools, ki18n, kio, libkdegames, kconfig, knotifyconfig }:
+
+mkDerivation {
+  name = "kdiamond";
+  meta = with lib; {
+    homepage = "https://kde.org/applications/en/games/org.kde.kdiamond";
+    description = "KDiamond is a single player puzzle game";
+    maintainers = with maintainers; [ freezeboy ];
+    license = licenses.gpl2Plus;
+    platforms = platforms.linux;
+  };
+  nativeBuildInputs = [
+    extra-cmake-modules
+  ];
+  buildInputs = [
+    libkdegames
+    knotifyconfig
+    kconfig
+    kdoctools
+    ki18n
+    kio
+  ];
+}
diff --git a/pkgs/applications/kde/kigo.nix b/pkgs/applications/kde/kigo.nix
new file mode 100644
index 00000000000..6585f943f2a
--- /dev/null
+++ b/pkgs/applications/kde/kigo.nix
@@ -0,0 +1,22 @@
+{ mkDerivation, lib, extra-cmake-modules, kdoctools, ki18n, kio, libkdegames, knewstuff }:
+
+mkDerivation {
+  name = "kigo";
+  meta = with lib; {
+    homepage = "https://kde.org/applications/en/games/org.kde.kigo";
+    description = "An open-source implementation of the popular Go game";
+    maintainers = with maintainers; [ freezeboy ];
+    license = licenses.gpl2Plus;
+    platforms = platforms.linux;
+  };
+  nativeBuildInputs = [
+    extra-cmake-modules
+  ];
+  buildInputs = [
+    libkdegames
+    knewstuff
+    kdoctools
+    ki18n
+    kio
+  ];
+}
diff --git a/pkgs/applications/kde/killbots.nix b/pkgs/applications/kde/killbots.nix
new file mode 100644
index 00000000000..ec9b6de82c9
--- /dev/null
+++ b/pkgs/applications/kde/killbots.nix
@@ -0,0 +1,21 @@
+{ mkDerivation, lib, extra-cmake-modules, kdoctools, ki18n, kio, libkdegames }:
+
+mkDerivation {
+  name = "killbots";
+  meta = with lib; {
+    homepage = "https://kde.org/applications/en/games/org.kde.killbots";
+    description = "A game where you avoid robots";
+    maintainers = with maintainers; [ freezeboy ];
+    license = licenses.gpl2Plus;
+    platforms = platforms.linux;
+  };
+  nativeBuildInputs = [
+    extra-cmake-modules
+  ];
+  buildInputs = [
+    libkdegames
+    kdoctools
+    ki18n
+    kio
+  ];
+}
diff --git a/pkgs/applications/kde/klettres.nix b/pkgs/applications/kde/klettres.nix
new file mode 100644
index 00000000000..e8e0a0aa59a
--- /dev/null
+++ b/pkgs/applications/kde/klettres.nix
@@ -0,0 +1,22 @@
+{ mkDerivation, lib, extra-cmake-modules, kdoctools, ki18n, kio, phonon, knewstuff }:
+
+mkDerivation {
+  name = "klettres";
+  meta = with lib; {
+    homepage = "https://kde.org/applications/en/utilities/org.kde.klettres";
+    description = "KLettres is an application specially designed to help the user to learn an alphabet";
+    maintainers = with maintainers; [ freezeboy ];
+    license = licenses.gpl2Plus;
+    platforms = platforms.linux;
+  };
+  nativeBuildInputs = [
+    extra-cmake-modules
+  ];
+  buildInputs = [
+    phonon
+    knewstuff
+    kdoctools
+    ki18n
+    kio
+  ];
+}
diff --git a/pkgs/applications/kde/klines.nix b/pkgs/applications/kde/klines.nix
new file mode 100644
index 00000000000..c6ad883dd63
--- /dev/null
+++ b/pkgs/applications/kde/klines.nix
@@ -0,0 +1,21 @@
+{ mkDerivation, lib, extra-cmake-modules, kdoctools, ki18n, kio, libkdegames }:
+
+mkDerivation {
+  name = "klines";
+  meta = with lib; {
+    homepage = "https://kde.org/applications/en/games/org.kde.klines";
+    description = "KLines is a simple but highly addictive one player game";
+    maintainers = with maintainers; [ freezeboy ];
+    license = licenses.gpl2Plus;
+    platforms = platforms.linux;
+  };
+  nativeBuildInputs = [
+    extra-cmake-modules
+  ];
+  buildInputs = [
+    libkdegames
+    kdoctools
+    ki18n
+    kio
+  ];
+}
diff --git a/pkgs/applications/kde/kmag.nix b/pkgs/applications/kde/kmag.nix
new file mode 100644
index 00000000000..701d8dbf130
--- /dev/null
+++ b/pkgs/applications/kde/kmag.nix
@@ -0,0 +1,20 @@
+{ mkDerivation, lib, extra-cmake-modules, kdoctools, ki18n, kio }:
+
+mkDerivation {
+  name = "kmag";
+  meta = with lib; {
+    homepage = "https://kde.org/applications/en/utilities/org.kde.kmag";
+    description = "KMag is a small utility for Linux to magnify a part of the screen";
+    maintainers = with maintainers; [ freezeboy ];
+    license = licenses.gpl2Plus;
+    platforms = platforms.linux;
+  };
+  nativeBuildInputs = [
+    extra-cmake-modules
+  ];
+  buildInputs = [
+    kdoctools
+    ki18n
+    kio
+  ];
+}
diff --git a/pkgs/applications/kde/kmines.nix b/pkgs/applications/kde/kmines.nix
new file mode 100644
index 00000000000..9314cca4a23
--- /dev/null
+++ b/pkgs/applications/kde/kmines.nix
@@ -0,0 +1,23 @@
+{ mkDerivation, lib, extra-cmake-modules, libkdegames, kconfig, kcrash, kdoctools, ki18n, kio }:
+
+mkDerivation {
+  name = "kmines";
+  meta = with lib; {
+    homepage = "https://kde.org/applications/en/games/org.kde.kmines";
+    description = "KMines is a classic Minesweeper game";
+    maintainers = with maintainers; [ freezeboy ];
+    license = licenses.gpl2Plus;
+    platforms = platforms.linux;
+  };
+  nativeBuildInputs = [
+    extra-cmake-modules
+  ];
+  buildInputs = [
+    libkdegames
+    kconfig
+    kcrash
+    kio
+    kdoctools
+    ki18n
+  ];
+}
diff --git a/pkgs/applications/kde/knavalbattle.nix b/pkgs/applications/kde/knavalbattle.nix
new file mode 100644
index 00000000000..669f9961a49
--- /dev/null
+++ b/pkgs/applications/kde/knavalbattle.nix
@@ -0,0 +1,22 @@
+{ mkDerivation, lib, extra-cmake-modules, kdoctools, ki18n, kio, libkdegames, kdnssd }:
+
+mkDerivation {
+  name = "knavalbattle";
+  meta = with lib; {
+    homepage = "https://kde.org/applications/en/games/org.kde.knavalbattle";
+    description = "Naval Battle is a ship sinking game";
+    maintainers = with maintainers; [ freezeboy ];
+    license = licenses.gpl2Plus;
+    platforms = platforms.linux;
+  };
+  nativeBuildInputs = [
+    extra-cmake-modules
+  ];
+  buildInputs = [
+    libkdegames
+    kdoctools
+    ki18n
+    kio
+    kdnssd
+  ];
+}
diff --git a/pkgs/applications/kde/knetwalk.nix b/pkgs/applications/kde/knetwalk.nix
new file mode 100644
index 00000000000..88d08b56bb1
--- /dev/null
+++ b/pkgs/applications/kde/knetwalk.nix
@@ -0,0 +1,21 @@
+{ mkDerivation, lib, extra-cmake-modules, kdoctools, ki18n, kio, libkdegames }:
+
+mkDerivation {
+  name = "knetwalk";
+  meta = with lib; {
+    homepage = "https://kde.org/applications/en/games/org.kde.knetwalk";
+    description = "KNetWalk is a single player logic game";
+    maintainers = with maintainers; [ freezeboy ];
+    license = licenses.gpl2Plus;
+    platforms = platforms.linux;
+  };
+  nativeBuildInputs = [
+    extra-cmake-modules
+  ];
+  buildInputs = [
+    libkdegames
+    kdoctools
+    ki18n
+    kio
+  ];
+}
diff --git a/pkgs/applications/kde/knights.nix b/pkgs/applications/kde/knights.nix
new file mode 100644
index 00000000000..ee5c37e2e94
--- /dev/null
+++ b/pkgs/applications/kde/knights.nix
@@ -0,0 +1,23 @@
+{ mkDerivation, lib, extra-cmake-modules, kdoctools, ki18n, kio, kplotting, plasma-framework, libkdegames }:
+
+mkDerivation {
+  name = "knights";
+  meta = with lib; {
+    homepage = "https://kde.org/applications/en/games/org.kde.knights";
+    description = "KNights is a chess game";
+    maintainers = with maintainers; [ freezeboy ];
+    license = licenses.gpl2Plus;
+    platforms = platforms.linux;
+  };
+  nativeBuildInputs = [
+    extra-cmake-modules
+  ];
+  buildInputs = [
+    libkdegames
+    plasma-framework
+    kplotting
+    kdoctools
+    ki18n
+    kio
+  ];
+}
diff --git a/pkgs/applications/kde/kollision.nix b/pkgs/applications/kde/kollision.nix
new file mode 100644
index 00000000000..3c0c814cd15
--- /dev/null
+++ b/pkgs/applications/kde/kollision.nix
@@ -0,0 +1,21 @@
+{ mkDerivation, lib, extra-cmake-modules, kdoctools, ki18n, kio, libkdegames }:
+
+mkDerivation {
+  name = "kollision";
+  meta = with lib; {
+    homepage = "https://kde.org/applications/en/games/org.kde.kollision";
+    description = "Kollision is a casual game";
+    maintainers = with maintainers; [ freezeboy ];
+    license = licenses.gpl2Plus;
+    platforms = platforms.linux;
+  };
+  nativeBuildInputs = [
+    extra-cmake-modules
+  ];
+  buildInputs = [
+    libkdegames
+    kdoctools
+    ki18n
+    kio
+  ];
+}
diff --git a/pkgs/applications/kde/kreversi.nix b/pkgs/applications/kde/kreversi.nix
new file mode 100644
index 00000000000..77ac4f05c8a
--- /dev/null
+++ b/pkgs/applications/kde/kreversi.nix
@@ -0,0 +1,19 @@
+{ mkDerivation, lib, extra-cmake-modules, libkdegames, kdeclarative }:
+
+mkDerivation {
+  name = "kreversi";
+  meta = with lib; {
+    homepage = "https://kde.org/applications/en/games/org.kde.kreversi";
+    description = "KReversi is a simple one player strategy game played against the computer";
+    maintainers = with maintainers; [ freezeboy ];
+    license = licenses.gpl2Plus;
+    platforms = platforms.linux;
+  };
+  nativeBuildInputs = [
+    extra-cmake-modules
+  ];
+  buildInputs = [
+    kdeclarative
+    libkdegames
+  ];
+}
diff --git a/pkgs/applications/kde/kshisen.nix b/pkgs/applications/kde/kshisen.nix
new file mode 100644
index 00000000000..7909ed8b2a3
--- /dev/null
+++ b/pkgs/applications/kde/kshisen.nix
@@ -0,0 +1,22 @@
+{ mkDerivation, lib, extra-cmake-modules, kdoctools, ki18n, kio, libkdegames, libkmahjongg }:
+
+mkDerivation {
+  name = "kshisen";
+  meta = with lib; {
+    homepage = "https://kde.org/applications/en/games/org.kde.kshisen";
+    description = "KShisen is a solitaire-like game played using the standard set of Mahjong tiles";
+    maintainers = with maintainers; [ freezeboy ];
+    license = licenses.gpl2Plus;
+    platforms = platforms.linux;
+  };
+  nativeBuildInputs = [
+    extra-cmake-modules
+  ];
+  buildInputs = [
+    libkdegames
+    libkmahjongg
+    kdoctools
+    ki18n
+    kio
+  ];
+}
diff --git a/pkgs/applications/kde/kteatime.nix b/pkgs/applications/kde/kteatime.nix
new file mode 100644
index 00000000000..a69cb991acc
--- /dev/null
+++ b/pkgs/applications/kde/kteatime.nix
@@ -0,0 +1,23 @@
+{ mkDerivation, lib, extra-cmake-modules, kdoctools, ki18n, kconfig, kcrash, kiconthemes, knotifyconfig }:
+
+mkDerivation {
+  name = "kteatime";
+  meta = with lib; {
+    homepage = "https://kde.org/applications/en/utilities/org.kde.kteatime";
+    description = "KTeaTime is a handy timer for steeping tea";
+    maintainers = with maintainers; [ freezeboy ];
+    license = licenses.gpl2Plus;
+    platforms = platforms.linux;
+  };
+  nativeBuildInputs = [
+    extra-cmake-modules
+  ];
+  buildInputs = [
+    kdoctools
+    ki18n
+    kconfig
+    kcrash
+    kiconthemes
+    knotifyconfig
+  ];
+}
diff --git a/pkgs/applications/kde/ktimer.nix b/pkgs/applications/kde/ktimer.nix
new file mode 100644
index 00000000000..aa755f35ce4
--- /dev/null
+++ b/pkgs/applications/kde/ktimer.nix
@@ -0,0 +1,20 @@
+{ mkDerivation, lib, extra-cmake-modules, kdoctools, ki18n, kio }:
+
+mkDerivation {
+  name = "ktimer";
+  meta = with lib; {
+    homepage = "https://kde.org/applications/en/utilities/org.kde.ktimer";
+    description = "KTimer is a little tool to execute programs after some time";
+    maintainers = with maintainers; [ freezeboy ];
+    license = licenses.gpl2Plus;
+    platforms = platforms.linux;
+  };
+  nativeBuildInputs = [
+    extra-cmake-modules
+  ];
+  buildInputs = [
+    kdoctools
+    ki18n
+    kio
+  ];
+}
diff --git a/pkgs/applications/kde/kturtle.nix b/pkgs/applications/kde/kturtle.nix
new file mode 100644
index 00000000000..e16c86dc136
--- /dev/null
+++ b/pkgs/applications/kde/kturtle.nix
@@ -0,0 +1,21 @@
+{ mkDerivation, lib, extra-cmake-modules, kdoctools, ki18n, kio, knewstuff }:
+
+mkDerivation {
+  name = "kturtle";
+  meta = with lib; {
+    homepage = "https://kde.org/applications/en/utilities/org.kde.kturtle";
+    description = "KTurtle is an educational programming environment for learning how to program";
+    maintainers = with maintainers; [ freezeboy ];
+    license = licenses.gpl2Plus;
+    platforms = platforms.linux;
+  };
+  nativeBuildInputs = [
+    extra-cmake-modules
+  ];
+  buildInputs = [
+    kdoctools
+    ki18n
+    kio
+    knewstuff
+  ];
+}
diff --git a/pkgs/applications/kde/kwave.nix b/pkgs/applications/kde/kwave.nix
new file mode 100644
index 00000000000..349787d000b
--- /dev/null
+++ b/pkgs/applications/kde/kwave.nix
@@ -0,0 +1,37 @@
+{ mkDerivation, lib, extra-cmake-modules, kdoctools, qtmultimedia, kcompletion, kconfig, kcrash, kiconthemes, kio, audiofile, libsamplerate
+, alsaLib, libpulseaudio, flac, id3lib, libogg, libmad, libopus, libvorbis, fftw, librsvg }:
+
+mkDerivation {
+  name = "kwave";
+  meta = with lib; {
+    homepage = "https://kde.org/applications/en/multimedia/org.kde.kwave";
+    description = "KWave is a simple media player";
+    maintainers = with maintainers; [ freezeboy ];
+    license = licenses.gpl2Plus;
+    platforms = platforms.linux;
+  };
+  nativeBuildInputs = [
+    extra-cmake-modules
+  ];
+  buildInputs = [
+    alsaLib
+    audiofile
+    kcrash
+    kdoctools
+    qtmultimedia
+    kcompletion
+    kconfig
+    kiconthemes
+    kio
+    libpulseaudio
+    libsamplerate
+    flac
+    fftw
+    id3lib
+    libogg
+    libmad
+    libopus
+    libvorbis
+    librsvg
+  ];
+}
diff --git a/pkgs/applications/misc/octoprint/default.nix b/pkgs/applications/misc/octoprint/default.nix
index 4434bc6d113..82cdf18b484 100644
--- a/pkgs/applications/misc/octoprint/default.nix
+++ b/pkgs/applications/misc/octoprint/default.nix
@@ -30,6 +30,7 @@ let
         (mkOverride "markdown" "3.1.1" "2e50876bcdd74517e7b71f3e7a76102050edec255b3983403f1a63e7c8a41e7a")
         (mkOverride "tornado" "5.1.1" "4e5158d97583502a7e2739951553cbd88a72076f152b4b11b64b9a10c4c49409")
         (mkOverride "unidecode" "0.04.21" "280a6ab88e1f2eb5af79edff450021a0d3f0448952847cd79677e55e58bad051")
+        (mkOverride "sarge" "0.1.5.post0" "1c1ll7pys9vra5cfi8jxlgrgaql6c27l6inpy15aprgqhc4ck36s")
 
         # Built-in dependency
         (
diff --git a/pkgs/applications/networking/irc/weechat/default.nix b/pkgs/applications/networking/irc/weechat/default.nix
index 69c9aeaf891..ea00669006b 100644
--- a/pkgs/applications/networking/irc/weechat/default.nix
+++ b/pkgs/applications/networking/irc/weechat/default.nix
@@ -44,7 +44,7 @@ let
         "-DENABLE_JAVASCRIPT=OFF"  # Requires v8 <= 3.24.3, https://github.com/weechat/weechat/issues/360
         "-DENABLE_PHP=OFF"
       ]
-        ++ optionals stdenv.isDarwin ["-DICONV_LIBRARY=${libiconv}/lib/libiconv.dylib" "-DCMAKE_FIND_FRAMEWORK=LAST"]
+        ++ optionals stdenv.isDarwin ["-DICONV_LIBRARY=${libiconv}/lib/libiconv.dylib"]
         ++ map (p: "-D${p.cmakeFlag}=" + (if p.enabled then "ON" else "OFF")) plugins
         ;
 
diff --git a/pkgs/applications/office/ledger/default.nix b/pkgs/applications/office/ledger/default.nix
index a0a558f5ed8..543545de263 100644
--- a/pkgs/applications/office/ledger/default.nix
+++ b/pkgs/applications/office/ledger/default.nix
@@ -27,10 +27,6 @@ stdenv.mkDerivation rec {
     "-DCMAKE_INSTALL_LIBDIR=lib"
     "-DBUILD_DOCS:BOOL=ON"
     (lib.optionalString usePython "-DUSE_PYTHON=true")
-  ] ++ lib.optionals (usePython && stdenv.isDarwin) [
-    # Fix python lookup on Darwin. Not necessary after
-    # https://github.com/NixOS/nixpkgs/pull/94090 lands in master
-    "-DPython_ROOT_DIR=${python}"
   ];
 
   # by default, it will query the python interpreter for it's sitepackages location
diff --git a/pkgs/applications/version-management/fossil/default.nix b/pkgs/applications/version-management/fossil/default.nix
index b34220c2635..f8ad81c6058 100644
--- a/pkgs/applications/version-management/fossil/default.nix
+++ b/pkgs/applications/version-management/fossil/default.nix
@@ -1,6 +1,16 @@
 { stdenv
-, libiconv, fetchurl, zlib, openssl, tcl, readline, sqlite, ed, which
-, tcllib, withJson ? true
+, installShellFiles
+, tcl
+, libiconv
+, fetchurl
+, zlib
+, openssl
+, readline
+, sqlite
+, ed
+, which
+, tcllib
+, withJson ? true
 }:
 
 stdenv.mkDerivation rec {
@@ -16,26 +26,33 @@ stdenv.mkDerivation rec {
     sha256 = "00v6gmn2wpfms5jzf103hkm5s8i3bfs5mzacmznlhdzdrzzjc8w2";
   };
 
+  nativeBuildInputs = [ installShellFiles tcl ];
+
   buildInputs = [ zlib openssl readline sqlite which ed ]
-             ++ stdenv.lib.optional stdenv.isDarwin libiconv;
-  nativeBuildInputs = [ tcl ];
+    ++ stdenv.lib.optional stdenv.isDarwin libiconv;
 
   doCheck = stdenv.hostPlatform == stdenv.buildPlatform;
+
+  configureFlags = [ "--disable-internal-sqlite" ]
+    ++ stdenv.lib.optional withJson "--json";
+
   preCheck = ''
     export TCLLIBPATH="${tcllib}/lib/tcllib${tcllib.version}"
   '';
-  configureFlags = stdenv.lib.optional withJson "--json";
 
-  preBuild=''
+  preBuild = ''
     export USER=nonexistent-but-specified-user
   '';
 
   installPhase = ''
     mkdir -p $out/bin
     INSTALLDIR=$out/bin make install
+
+    installManPage fossil.1
+    installShellCompletion --name fossil.bash tools/fossil-autocomplete.bash
   '';
 
-  meta = {
+  meta = with stdenv.lib; {
     description = "Simple, high-reliability, distributed software configuration management";
     longDescription = ''
       Fossil is a software configuration management system.  Fossil is
@@ -45,11 +62,7 @@ stdenv.mkDerivation rec {
       from the others by being extremely simple to setup and operate.
     '';
     homepage = "http://www.fossil-scm.org/";
-    license = stdenv.lib.licenses.bsd2;
-    platforms = with stdenv.lib.platforms; all;
-    maintainers = [ #Add your name here!
-      stdenv.lib.maintainers.maggesi
-      stdenv.lib.maintainers.viric
-    ];
+    license = licenses.bsd2;
+    maintainers = with maintainers; [ maggesi viric ];
   };
 }
diff --git a/pkgs/applications/video/lightworks/default.nix b/pkgs/applications/video/lightworks/default.nix
index ae156574f5d..da413915e37 100644
--- a/pkgs/applications/video/lightworks/default.nix
+++ b/pkgs/applications/video/lightworks/default.nix
@@ -47,7 +47,7 @@ let
       # This adds it to lightworks' search path while keeping the default
       # using the FONTCONFIG_FILE env variable
       echo "<?xml version='1.0'?>
-      <!DOCTYPE fontconfig SYSTEM 'fonts.dtd'>
+      <!DOCTYPE fontconfig SYSTEM 'urn:fontconfig:fonts.dtd'>
       <fontconfig>
           <dir>/usr/share/fonts/truetype</dir>
           <include>/etc/fonts/fonts.conf</include>
diff --git a/pkgs/build-support/wrapper-common/utils.bash b/pkgs/build-support/wrapper-common/utils.bash
index 8c4680a8e44..ce569ac2b8c 100644
--- a/pkgs/build-support/wrapper-common/utils.bash
+++ b/pkgs/build-support/wrapper-common/utils.bash
@@ -69,9 +69,9 @@ badPath() {
     # directory (including the build directory).
     test \
         "$p" != "/dev/null" -a \
-        "${p:0:${#NIX_STORE}}" != "$NIX_STORE" -a \
-        "${p:0:4}" != "/tmp" -a \
-        "${p:0:${#NIX_BUILD_TOP}}" != "$NIX_BUILD_TOP"
+        "${p#${NIX_STORE}}" = "$p" -a \
+        "${p#${TMP:-/tmp}}" = "$p" -a \
+        "${p#${NIX_BUILD_TOP}}" = "$p"
 }
 
 expandResponseParams() {
diff --git a/pkgs/data/fonts/caladea/cambria-alias.conf b/pkgs/data/fonts/caladea/cambria-alias.conf
index f763e2a8c34..78452961e8e 100644
--- a/pkgs/data/fonts/caladea/cambria-alias.conf
+++ b/pkgs/data/fonts/caladea/cambria-alias.conf
@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE fontconfig SYSTEM "fonts.dtd">
+<!DOCTYPE fontconfig SYSTEM "urn:fontconfig:fonts.dtd">
 <fontconfig>
   <!-- Configure Caladea as a metric-compatible alias for the
        Microsoft Cambria font family. -->
diff --git a/pkgs/data/fonts/carlito/calibri-alias.conf b/pkgs/data/fonts/carlito/calibri-alias.conf
index 294af3b6c78..bbffff23721 100644
--- a/pkgs/data/fonts/carlito/calibri-alias.conf
+++ b/pkgs/data/fonts/carlito/calibri-alias.conf
@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE fontconfig SYSTEM "fonts.dtd">
+<!DOCTYPE fontconfig SYSTEM "urn:fontconfig:fonts.dtd">
 <fontconfig>
   <!-- Configure Carlito as a metric-compatible alias for the
        Microsoft Calibri font family. -->
diff --git a/pkgs/data/fonts/comic-relief/comic-sans-ms-alias.conf b/pkgs/data/fonts/comic-relief/comic-sans-ms-alias.conf
index be5f6cca866..e1362ec4f5f 100644
--- a/pkgs/data/fonts/comic-relief/comic-sans-ms-alias.conf
+++ b/pkgs/data/fonts/comic-relief/comic-sans-ms-alias.conf
@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE fontconfig SYSTEM "fonts.dtd">
+<!DOCTYPE fontconfig SYSTEM "urn:fontconfig:fonts.dtd">
 <fontconfig>
   <!-- Configure Comic Relief as a metric-compatible alias for the
        Microsoft Comic Sans font family. -->
diff --git a/pkgs/data/fonts/corefonts/no-op.conf b/pkgs/data/fonts/corefonts/no-op.conf
index 503e62cfa29..3f8a9b9b544 100644
--- a/pkgs/data/fonts/corefonts/no-op.conf
+++ b/pkgs/data/fonts/corefonts/no-op.conf
@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE fontconfig SYSTEM "fonts.dtd">
+<!DOCTYPE fontconfig SYSTEM "urn:fontconfig:fonts.dtd">
 <fontconfig>
   <!-- This configuation is intentionally left empty in order to
        override any other font package that may wish to set up an
diff --git a/pkgs/data/fonts/liberation-fonts/default.nix b/pkgs/data/fonts/liberation-fonts/default.nix
index 838a8d4c769..edc39ff0a40 100644
--- a/pkgs/data/fonts/liberation-fonts/default.nix
+++ b/pkgs/data/fonts/liberation-fonts/default.nix
@@ -2,6 +2,7 @@
 let
   inherit (python3.pkgs) fonttools;
 
+  commonNativeBuildInputs = [ fontforge python3 ];
   common =
     { version, repo, sha256, nativeBuildInputs, postPatch ? null }:
       stdenv.mkDerivation rec {
@@ -50,13 +51,13 @@ in
   liberation_ttf_v1 = common {
     repo = "liberation-1.7-fonts";
     version = "1.07.5";
-    nativeBuildInputs = [ fontforge ];
+    nativeBuildInputs = commonNativeBuildInputs ;
     sha256 = "1ffl10mf78hx598sy9qr5m6q2b8n3mpnsj73bwixnd4985gsz56v";
   };
   liberation_ttf_v2 = common {
     repo = "liberation-fonts";
     version = "2.1.0";
-    nativeBuildInputs = [ fontforge fonttools ];
+    nativeBuildInputs = commonNativeBuildInputs ++ [ fonttools ];
     postPatch = ''
       substituteInPlace scripts/setisFixedPitch-fonttools.py --replace \
         'font = ttLib.TTFont(fontfile)' \
diff --git a/pkgs/data/fonts/vista-fonts-chs/no-op.conf b/pkgs/data/fonts/vista-fonts-chs/no-op.conf
index 2d00b624488..20d1b49d158 100644
--- a/pkgs/data/fonts/vista-fonts-chs/no-op.conf
+++ b/pkgs/data/fonts/vista-fonts-chs/no-op.conf
@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE fontconfig SYSTEM "fonts.dtd">
+<!DOCTYPE fontconfig SYSTEM "urn:fontconfig:fonts.dtd">
 <fontconfig>
   <!-- This configuation is intentionally left empty in order to
        override any other font package that may wish to set up an
diff --git a/pkgs/data/fonts/vista-fonts/no-op.conf b/pkgs/data/fonts/vista-fonts/no-op.conf
index 503e62cfa29..3f8a9b9b544 100644
--- a/pkgs/data/fonts/vista-fonts/no-op.conf
+++ b/pkgs/data/fonts/vista-fonts/no-op.conf
@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE fontconfig SYSTEM "fonts.dtd">
+<!DOCTYPE fontconfig SYSTEM "urn:fontconfig:fonts.dtd">
 <fontconfig>
   <!-- This configuation is intentionally left empty in order to
        override any other font package that may wish to set up an
diff --git a/pkgs/development/compilers/gcc/9/default.nix b/pkgs/development/compilers/gcc/9/default.nix
index 7cfc977b3f4..305ed56df78 100644
--- a/pkgs/development/compilers/gcc/9/default.nix
+++ b/pkgs/development/compilers/gcc/9/default.nix
@@ -184,7 +184,7 @@ stdenv.mkDerivation ({
 
   preConfigure = import ../common/pre-configure.nix {
     inherit (stdenv) lib;
-    inherit version hostPlatform gnatboot langAda langGo;
+    inherit version hostPlatform gnatboot langAda langGo langJit;
   };
 
   dontDisableStatic = true;
diff --git a/pkgs/development/compilers/gcc/builder.sh b/pkgs/development/compilers/gcc/builder.sh
index d242f1a822c..2204744a4b5 100644
--- a/pkgs/development/compilers/gcc/builder.sh
+++ b/pkgs/development/compilers/gcc/builder.sh
@@ -261,7 +261,7 @@ postInstall() {
     fi
 
     if type "install_name_tool"; then
-        for i in "${!outputLib}"/lib/*.*.dylib; do
+        for i in "${!outputLib}"/lib/*.*.dylib "${!outputLib}"/lib/*.so.[0-9]; do
             install_name_tool -id "$i" "$i" || true
             for old_path in $(otool -L "$i" | grep "$out" | awk '{print $1}'); do
               new_path=`echo "$old_path" | sed "s,$out,${!outputLib},"`
diff --git a/pkgs/development/compilers/gcc/common/pre-configure.nix b/pkgs/development/compilers/gcc/common/pre-configure.nix
index fff49014800..1c65b4a8ba6 100644
--- a/pkgs/development/compilers/gcc/common/pre-configure.nix
+++ b/pkgs/development/compilers/gcc/common/pre-configure.nix
@@ -2,6 +2,7 @@
 , gnatboot ? null
 , langAda ? false
 , langJava ? false
+, langJit ? false
 , langGo }:
 
 assert langJava -> lib.versionOlder version "7";
@@ -49,3 +50,11 @@ lib.optionalString (hostPlatform.isSunOS && hostPlatform.is64bit) ''
 + lib.optionalString (hostPlatform.isDarwin) ''
   export ac_cv_func_aligned_alloc=no
 ''
+
+# In order to properly install libgccjit on macOS Catalina, strip(1)
+# upon installation must not remove external symbols, otherwise the
+# install step errors with "symbols referenced by indirect symbol
+# table entries that can't be stripped".
++ lib.optionalString (hostPlatform.isDarwin && langJit) ''
+  export STRIP='strip -x'
+''
diff --git a/pkgs/development/compilers/mozart/default.nix b/pkgs/development/compilers/mozart/default.nix
index d2c2d98e411..025652c7492 100644
--- a/pkgs/development/compilers/mozart/default.nix
+++ b/pkgs/development/compilers/mozart/default.nix
@@ -60,7 +60,7 @@ in stdenv.mkDerivation rec {
     # gcc together as compilers and we need clang for the sources generation.
     # However, clang emits tons of warnings about gcc's atomic-base library.
     "-DCMAKE_CXX_FLAGS=-Wno-braced-scalar-init"
-  ] ++ lib.optional stdenv.isDarwin "-DCMAKE_FIND_FRAMEWORK=LAST";
+  ];
 
   fixupPhase = ''
     wrapProgram $out/bin/oz --set OZEMACS ${emacs}/bin/emacs
diff --git a/pkgs/development/interpreters/perl/default.nix b/pkgs/development/interpreters/perl/default.nix
index 8f539d23392..7fad936260c 100644
--- a/pkgs/development/interpreters/perl/default.nix
+++ b/pkgs/development/interpreters/perl/default.nix
@@ -175,11 +175,11 @@ let
       priority = 6; # in `buildEnv' (including the one inside `perl.withPackages') the library files will have priority over files in `perl`
     };
   } // optionalAttrs (stdenv.buildPlatform != stdenv.hostPlatform) rec {
-    crossVersion = "1.3.4"; # Jun 2, 2020
+    crossVersion = "15ca5359f99698ef0a199bc307b7956c08907abc"; # Aug 27, 2020
 
     perl-cross-src = fetchurl {
       url = "https://github.com/arsv/perl-cross/archive/${crossVersion}.tar.gz";
-      sha256 = "15wvlafhpsh9h66s3vazhx46hf8ik75473acrvf6722ijd1wpz45";
+      sha256 = "0pcwv2ac02i2l0fjc8drdw70q6gwbypj2c5a53x2449m919v37h9";
     };
 
     depsBuildBuild = [ buildPackages.stdenv.cc makeWrapper ];
@@ -195,14 +195,6 @@ let
     setupHook = ./setup-hook-cross.sh;
   });
 in {
-  # Maint version
-  perl528 = common {
-    perl = pkgs.perl528;
-    buildPerl = buildPackages.perl528;
-    version = "5.28.3";
-    sha256 = "052if351m81yhaab429i1kv77v9b15qm0g48kr6y2yjrc7bc3jdg";
-  };
-
   # Maint version
   perl530 = common {
     perl = pkgs.perl530;
@@ -211,11 +203,19 @@ in {
     sha256 = "0vs0wwwlw47sswxaflkk4hw0y45cmc7arxx788kwpbminy5lrq1j";
   };
 
+  # Maint version
+  perl532 = common {
+    perl = pkgs.perl532;
+    buildPerl = buildPackages.perl532;
+    version = "5.32.0";
+    sha256 = "1d6001cjnpxfv79000bx00vmv2nvdz7wrnyas451j908y7hirszg";
+  };
+
   # the latest Devel version
   perldevel = common {
     perl = pkgs.perldevel;
     buildPerl = buildPackages.perldevel;
-    version = "5.32.0-RC0";
-    sha256 = "02i6n1xa4j0ksp014yy8q0j7scjcy5mr0yd4iash2ryrrfv5yw5k";
+    version = "5.33.1";
+    sha256 = "1rlnqqqzyhal79ys5dv7fwm3mg81s43dwks28b74x2gcmsngjnw9";
   };
 }
diff --git a/pkgs/development/interpreters/python/default.nix b/pkgs/development/interpreters/python/default.nix
index db60c0ead6f..e4230093e9c 100644
--- a/pkgs/development/interpreters/python/default.nix
+++ b/pkgs/development/interpreters/python/default.nix
@@ -68,10 +68,10 @@ in {
     sourceVersion = {
       major = "3";
       minor = "6";
-      patch = "11";
+      patch = "12";
       suffix = "";
     };
-    sha256 = "dB69y8Tjk3pf8jUX3UVev31UPqn+9vXPb0blddbE/aQ=";
+    sha256 = "cJU6m11okdkuZdGEw1EhJqFYFL7hXh7/LdzOBDNOmpk=";
     inherit (darwin) configd;
     inherit passthruFun;
   };
@@ -81,10 +81,10 @@ in {
     sourceVersion = {
       major = "3";
       minor = "7";
-      patch = "8";
+      patch = "9";
       suffix = "";
     };
-    sha256 = "Q6VDQEs2PwA3+J34R48Z2y28DW8//uMQvCmX+nGFSmM=";
+    sha256 = "008v6g1jkrjrdmiqlgjlq6msbbj848bvkws6ppwva1ahn03k14li";
     inherit (darwin) configd;
     inherit passthruFun;
   };
diff --git a/pkgs/development/libraries/enchant/2.x.nix b/pkgs/development/libraries/enchant/2.x.nix
index 51f13de08a8..5788bbe9c17 100644
--- a/pkgs/development/libraries/enchant/2.x.nix
+++ b/pkgs/development/libraries/enchant/2.x.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation rec {
   pname = "enchant";
-  version = "2.2.9";
+  version = "2.2.10";
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
     url = "https://github.com/AbiWord/${pname}/releases/download/v${version}/${pname}-${version}.tar.gz";
-    sha256 = "0g1gf86jzxxhnhkn7jvgi0k9agzav2zr8pjnpgdwpvgmfci3v6mj";
+    sha256 = "1hxx5kb015a5rvjimrpcb5050xb3988dgc52fd5m5n270v238nva";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/fontconfig/make-fonts-cache.nix b/pkgs/development/libraries/fontconfig/make-fonts-cache.nix
index f1a2e865bb7..47884b9c3b9 100644
--- a/pkgs/development/libraries/fontconfig/make-fonts-cache.nix
+++ b/pkgs/development/libraries/fontconfig/make-fonts-cache.nix
@@ -16,7 +16,7 @@ runCommand "fc-cache"
 
     cat > fonts.conf << EOF
     <?xml version='1.0'?>
-    <!DOCTYPE fontconfig SYSTEM 'fonts.dtd'>
+    <!DOCTYPE fontconfig SYSTEM 'urn:fontconfig:fonts.dtd'>
     <fontconfig>
       <include>${fontconfig.out}/etc/fonts/fonts.conf</include>
       <cachedir>$out</cachedir>
diff --git a/pkgs/development/libraries/fontconfig/make-fonts-conf.xsl b/pkgs/development/libraries/fontconfig/make-fonts-conf.xsl
index 6ec2e7ab515..1d7797e8774 100644
--- a/pkgs/development/libraries/fontconfig/make-fonts-conf.xsl
+++ b/pkgs/development/libraries/fontconfig/make-fonts-conf.xsl
@@ -12,7 +12,7 @@
                 extension-element-prefixes="str"
                 >
 
-  <xsl:output method='xml' encoding="UTF-8" doctype-system="fonts.dtd" />
+  <xsl:output method='xml' encoding="UTF-8" doctype-system="urn:fontconfig:fonts.dtd" />
 
   <xsl:param name="fontDirectories" />
   <xsl:param name="fontconfig" />
diff --git a/pkgs/development/libraries/glib/default.nix b/pkgs/development/libraries/glib/default.nix
index cb2b8a11c03..88848deec41 100644
--- a/pkgs/development/libraries/glib/default.nix
+++ b/pkgs/development/libraries/glib/default.nix
@@ -45,11 +45,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "glib";
-  version = "2.64.4";
+  version = "2.64.5";
 
   src = fetchurl {
     url = "mirror://gnome/sources/glib/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "0l6fggcgdnjif9kzy4crq7520f43bbrgzxz0c821ya3jn8jv7q7p";
+    sha256 = "04fczq693wivkqd2qxvvi3sncqgznsvzfiiwsll1rbayf795pgcw";
   };
 
   patches = optionals stdenv.isDarwin [
diff --git a/pkgs/development/libraries/glibmm/default.nix b/pkgs/development/libraries/glibmm/default.nix
index dff122d38d1..53e924b1325 100644
--- a/pkgs/development/libraries/glibmm/default.nix
+++ b/pkgs/development/libraries/glibmm/default.nix
@@ -11,7 +11,12 @@ stdenv.mkDerivation rec {
 
   outputs = [ "out" "dev" ];
 
-  nativeBuildInputs = [ pkgconfig gnum4 ];
+  nativeBuildInputs = [
+    pkgconfig
+    gnum4
+    glib # for glib-compile-schemas
+  ];
+
   buildInputs = stdenv.lib.optionals stdenv.isDarwin (with darwin.apple_sdk.frameworks; [
     Cocoa
   ]);
diff --git a/pkgs/development/libraries/jbig2dec/default.nix b/pkgs/development/libraries/jbig2dec/default.nix
index 22d38a080ca..a6eb5642395 100644
--- a/pkgs/development/libraries/jbig2dec/default.nix
+++ b/pkgs/development/libraries/jbig2dec/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
     patchShebangs test_jbig2dec.py
   '';
 
-  buildInputs = [ autoreconfHook ];
+  nativeBuildInputs = [ autoreconfHook ];
 
   checkInputs = [ python3 ];
   doCheck = true;
diff --git a/pkgs/development/libraries/libmpc/default.nix b/pkgs/development/libraries/libmpc/default.nix
index c0459e393fa..79fa1743781 100644
--- a/pkgs/development/libraries/libmpc/default.nix
+++ b/pkgs/development/libraries/libmpc/default.nix
@@ -8,7 +8,7 @@
 # files.
 
 let
-  version = "1.1.0";
+  version = "1.2.0";
 in
 stdenv.mkDerivation {
   pname = "libmpc";
@@ -16,7 +16,7 @@ stdenv.mkDerivation {
 
   src = fetchurl {
     url = "mirror://gnu/mpc/mpc-${version}.tar.gz";
-    sha256 = "0biwnhjm3rx3hc0rfpvyniky4lpzsvdcwhmcn7f0h4iw2hwcb1b9";
+    sha256 = "19pxx3gwhwl588v496g3aylhcw91z1dk1d5x3a8ik71sancjs3z9";
   };
 
   buildInputs = [ gmp mpfr ];
diff --git a/pkgs/development/libraries/libpfm/default.nix b/pkgs/development/libraries/libpfm/default.nix
index 3398d3feb94..b29aeb2930a 100644
--- a/pkgs/development/libraries/libpfm/default.nix
+++ b/pkgs/development/libraries/libpfm/default.nix
@@ -1,12 +1,12 @@
 { stdenv, fetchurl, enableShared ? true }:
 
 stdenv.mkDerivation (rec {
-  version = "4.10.1";
+  version = "4.11.0";
   pname = "libpfm";
 
   src = fetchurl {
     url = "mirror://sourceforge/perfmon2/libpfm4/${pname}-${version}.tar.gz";
-    sha256 = "0jabhjx77yppr7x38bkfww6n2a480gj62rw0qp7prhdmg19mf766";
+    sha256 = "1k7yp6xfsglp2b6271r622sjinlbys0dk24n9iiv656y5f3zi9ax";
   };
 
   makeFlags = [
diff --git a/pkgs/development/libraries/libseccomp/default.nix b/pkgs/development/libraries/libseccomp/default.nix
index ebaf43e7681..6ea0e6be465 100644
--- a/pkgs/development/libraries/libseccomp/default.nix
+++ b/pkgs/development/libraries/libseccomp/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, getopt, makeWrapper, utillinux, gperf }:
+{ stdenv, fetchurl, getopt, utillinux, gperf }:
 
 stdenv.mkDerivation rec {
   pname = "libseccomp";
@@ -11,7 +11,8 @@ stdenv.mkDerivation rec {
 
   outputs = [ "out" "lib" "dev" "man" ];
 
-  buildInputs = [ getopt makeWrapper gperf ];
+  nativeBuildInputs = [ gperf ];
+  buildInputs = [ getopt ];
 
   patchPhase = ''
     patchShebangs .
diff --git a/pkgs/development/libraries/libusb1/default.nix b/pkgs/development/libraries/libusb1/default.nix
index 5d6a20b13a4..a3323c8e026 100644
--- a/pkgs/development/libraries/libusb1/default.nix
+++ b/pkgs/development/libraries/libusb1/default.nix
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
     sha256 = "0mxbpg01kgbk5nh6524b0m4xk7ywkyzmc3yhi5asqcsd3rbhjj98";
   };
 
-  outputs = [ "out" "dev" ]; # get rid of propagating systemd closure
+  outputs = [ "out" "dev" ];
 
   nativeBuildInputs = [ pkgconfig autoreconfHook ];
   propagatedBuildInputs =
@@ -31,8 +31,6 @@ stdenv.mkDerivation rec {
 
   dontDisableStatic = withStatic;
 
-  NIX_LDFLAGS = stdenv.lib.optionalString stdenv.isLinux "-lgcc_s";
-
   configureFlags = stdenv.lib.optional (!enableSystemd) "--disable-udev";
 
   preFixup = stdenv.lib.optionalString enableSystemd ''
diff --git a/pkgs/development/libraries/mesa/default.nix b/pkgs/development/libraries/mesa/default.nix
index 3b0be542976..cf452fded14 100644
--- a/pkgs/development/libraries/mesa/default.nix
+++ b/pkgs/development/libraries/mesa/default.nix
@@ -4,7 +4,6 @@
 , llvmPackages, libffi, libomxil-bellagio, libva-minimal
 , libelf, libvdpau, python3Packages
 , libglvnd
-, patchelf, autoreconfHook, fetchFromGitHub
 , enableRadv ? true
 , galliumDrivers ? ["auto"]
 , driDrivers ? ["auto"]
@@ -32,7 +31,7 @@ with stdenv.lib;
 let
   # Release calendar: https://www.mesa3d.org/release-calendar.html
   # Release frequency: https://www.mesa3d.org/releasing.html#schedule
-  version = "20.1.6";
+  version = "20.1.7";
   branch  = versions.major version;
 in
 
@@ -47,7 +46,7 @@ stdenv.mkDerivation {
       "ftp://ftp.freedesktop.org/pub/mesa/${version}/mesa-${version}.tar.xz"
       "ftp://ftp.freedesktop.org/pub/mesa/older-versions/${branch}.x/${version}/mesa-${version}.tar.xz"
     ];
-    sha256 = "0g59gxbgr884a9xvg0fls10zkllyhz675zjvr50dcfmh2h0x9gi3";
+    sha256 = "1252mgwiy05nz8mm4gjkzmnjfvdz5yv1shnsr837cdnan86dvsad";
   };
 
   prePatch = "patchShebangs .";
@@ -148,16 +147,6 @@ stdenv.mkDerivation {
   depsBuildBuild = [ pkgconfig ];
 
   nativeBuildInputs = [
-    (patchelf.overrideAttrs (pa: {
-      src = fetchFromGitHub {
-        owner = "NixOS";
-        repo = "patchelf";
-        rev = "61bc10176"; # current master; what matters is merge of #225
-        sha256 = "0cy77mn77w3mn64ggp20f4ygnbxfjmddhjjhfwkva53lsirg6w93";
-      };
-      nativeBuildInputs = pa.nativeBuildInputs or [] ++ [ autoreconfHook ];
-    }))
-  ] ++ [
     pkgconfig meson ninja
     intltool bison flex file
     python3Packages.python python3Packages.Mako
diff --git a/pkgs/development/libraries/mesa/link-radv-with-ld_args_build_id.patch b/pkgs/development/libraries/mesa/link-radv-with-ld_args_build_id.patch
index e6182009ba8..0a660332392 100644
--- a/pkgs/development/libraries/mesa/link-radv-with-ld_args_build_id.patch
+++ b/pkgs/development/libraries/mesa/link-radv-with-ld_args_build_id.patch
@@ -1,4 +1,4 @@
-From 00f3c6d1b771c11ecc08c3d8bd793a51d6e64166 Mon Sep 17 00:00:00 2001
+From b49bcb6eece322b70fc2e8b0c8498f5a38ea7b82 Mon Sep 17 00:00:00 2001
 From: David McFarland <corngood@gmail.com>
 Date: Sun, 26 Jul 2020 17:29:49 -0300
 Subject: [PATCH] link radv with ld_args_build_id
@@ -9,18 +9,17 @@ This is needed for radv_device_get_cache_uuid to work correctly.
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/src/amd/vulkan/meson.build b/src/amd/vulkan/meson.build
-index efcf2dd6c89..590f286b8cb 100644
+index eec026e8f60..a07a0821938 100644
 --- a/src/amd/vulkan/meson.build
 +++ b/src/amd/vulkan/meson.build
-@@ -173,7 +173,7 @@ libvulkan_radeon = shared_library(
+@@ -183,7 +183,7 @@ libvulkan_radeon = shared_library(
    ],
    c_args : [c_vis_args, no_override_init_args, radv_flags],
    cpp_args : [cpp_vis_args, radv_flags],
--  link_args : [ld_args_bsymbolic, ld_args_gc_sections],
-+  link_args : [ld_args_build_id, ld_args_bsymbolic, ld_args_gc_sections],
+-  link_args : [ld_args_bsymbolic, ld_args_gc_sections, libvulkan_radeon_ld_args],
++  link_args : [ld_args_build_id, ld_args_bsymbolic, ld_args_gc_sections, libvulkan_radeon_ld_args],
+   link_depends : [libvulkan_radeon_link_depends,],
    install : true,
  )
- 
--- 
-2.27.0
-
+--
+2.28.0
diff --git a/pkgs/development/libraries/p11-kit/default.nix b/pkgs/development/libraries/p11-kit/default.nix
index 3c82944baab..46f520e41e4 100644
--- a/pkgs/development/libraries/p11-kit/default.nix
+++ b/pkgs/development/libraries/p11-kit/default.nix
@@ -16,7 +16,12 @@ stdenv.mkDerivation rec {
   outputs = [ "out" "dev"];
   outputBin = "dev";
 
-  nativeBuildInputs = [ autoreconfHook pkgconfig which ];
+  # for cross platform builds of p11-kit, libtasn1 in nativeBuildInputs
+  # provides the asn1Parser binary on the hostPlatform needed for building.
+  # at the same time, libtasn1 in buildInputs provides the libasn1 library
+  # to link against for the target platform.
+  # hence, libtasn1 is required in both native and build inputs.
+  nativeBuildInputs = [ autoreconfHook pkgconfig which libtasn1 ];
   buildInputs = [ gettext libffi libiconv libtasn1 ];
 
   autoreconfPhase = ''
diff --git a/pkgs/development/python-modules/aioesphomeapi/default.nix b/pkgs/development/python-modules/aioesphomeapi/default.nix
index dee85117406..6a128eb5239 100644
--- a/pkgs/development/python-modules/aioesphomeapi/default.nix
+++ b/pkgs/development/python-modules/aioesphomeapi/default.nix
@@ -1,14 +1,16 @@
-{ lib, buildPythonPackage, fetchPypi, isPy3k, attrs, protobuf, zeroconf }:
+{ lib, buildPythonPackage, fetchFromGitHub, isPy3k, attrs, protobuf, zeroconf }:
 
 buildPythonPackage rec {
   pname = "aioesphomeapi";
-  version = "2.6.1";
+  version = "2.6.3";
 
   disabled = !isPy3k;
 
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "139d1d348fcfe2f34926a210a32dff069935d17167c4e1cb66e8b039cbb4d6c1";
+  src = fetchFromGitHub {
+    owner = "esphome";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "1lbjxqdx63fc7qxx7xwq4b9dafmdafj7p1ggs48hyhbqfwkrv9p7";
   };
 
   propagatedBuildInputs = [ attrs protobuf zeroconf ];
@@ -16,14 +18,12 @@ buildPythonPackage rec {
   # no tests implemented
   doCheck = false;
 
+  pythonImportsCheck = [ "aioesphomeapi" ];
+
   meta = with lib; {
     description = "Python Client for ESPHome native API";
     homepage = "https://github.com/esphome/aioesphomeapi";
     license = licenses.mit;
     maintainers = with maintainers; [ dotlambda ];
-
-    # Home Assistant should pin protobuf to the correct version. Can be tested using
-    #     nix-build -E "with import ./. {}; home-assistant.override { extraPackages = ps: [ ps.aioesphomeapi ]; }"
-    broken = !lib.hasPrefix "3.6.1" protobuf.version;
   };
 }
diff --git a/pkgs/development/python-modules/aioftp/default.nix b/pkgs/development/python-modules/aioftp/default.nix
index 6dca5bf906d..181c0be3706 100644
--- a/pkgs/development/python-modules/aioftp/default.nix
+++ b/pkgs/development/python-modules/aioftp/default.nix
@@ -11,12 +11,12 @@
 
 buildPythonPackage rec {
   pname = "aioftp";
-  version = "0.17.1";
+  version = "0.17.2";
   disabled = isPy27;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "87869958fa98c4691acad0815840a94c1b50c6925d037d4dbb51331ddf4911f3";
+    sha256 = "8433ff21317e71ef1f4d8cb8f7fe58365c04b5174142d9643e22343cfb35da1b";
   };
 
   checkInputs = [
diff --git a/pkgs/development/python-modules/asdf/default.nix b/pkgs/development/python-modules/asdf/default.nix
index c1b5ebc786d..474329ed0b7 100644
--- a/pkgs/development/python-modules/asdf/default.nix
+++ b/pkgs/development/python-modules/asdf/default.nix
@@ -15,12 +15,12 @@
 
 buildPythonPackage rec {
   pname = "asdf";
-  version = "2.7.0";
+  version = "2.7.1";
   disabled = isPy27;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "687d741f19db663b769eb188458dafd4fe5cc10201640ffed3210c7f138f15d0";
+    sha256 = "4ba2e31cb24b974a10dfae3edee23db2e6bea2d00608604d062366aa3af6e81a";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/atlassian-python-api/default.nix b/pkgs/development/python-modules/atlassian-python-api/default.nix
index 37cd2211833..077a8558964 100755
--- a/pkgs/development/python-modules/atlassian-python-api/default.nix
+++ b/pkgs/development/python-modules/atlassian-python-api/default.nix
@@ -16,11 +16,11 @@
 
 buildPythonPackage rec {
   pname = "atlassian-python-api";
-  version = "1.16.0";
+  version = "1.16.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1sp036192vdl5nqifcswg2j838vf8i9k8bfd0w4qh1vz4f0pjz7y";
+    sha256 = "b672131be7cc5e239c465909454542623c0aeb0a4d3b05e6a25ee9459959c11d";
   };
 
   checkInputs = [ pytestrunner pytest ];
diff --git a/pkgs/development/python-modules/awkward1/default.nix b/pkgs/development/python-modules/awkward1/default.nix
index 1e4958f37e6..927d620948c 100644
--- a/pkgs/development/python-modules/awkward1/default.nix
+++ b/pkgs/development/python-modules/awkward1/default.nix
@@ -10,11 +10,11 @@
 
 buildPythonPackage rec {
   pname = "awkward1";
-  version = "0.2.33";
+  version = "0.2.35";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "bf3de210d0a88fb14a97c296f54ed2d5b686a785bb5fd7a31277f22b8daa9513";
+    sha256 = "563868f0f2d0cb398ce3616ee3f9734cc68cee9a612d35cab830ec5c728f1474";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/python-modules/boto3/default.nix b/pkgs/development/python-modules/boto3/default.nix
index 595026d8a12..ca3ffa98575 100644
--- a/pkgs/development/python-modules/boto3/default.nix
+++ b/pkgs/development/python-modules/boto3/default.nix
@@ -13,11 +13,11 @@
 
 buildPythonPackage rec {
   pname =  "boto3";
-  version = "1.14.43"; # N.B: if you change this, change botocore too
+  version = "1.14.51"; # N.B: if you change this, change botocore too
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "a6c9a3d3abbad2ff2e5751af599492a9271633a7c9fef343482524464c53e451";
+    sha256 = "a6bdb808e948bd264af135af50efb76253e85732c451fa605b7a287faf022432";
   };
 
   propagatedBuildInputs = [ botocore jmespath s3transfer ] ++ lib.optionals (!isPy3k) [ futures ];
diff --git a/pkgs/development/python-modules/botocore/default.nix b/pkgs/development/python-modules/botocore/default.nix
index b5cbea8e7f9..0ad2816f55c 100644
--- a/pkgs/development/python-modules/botocore/default.nix
+++ b/pkgs/development/python-modules/botocore/default.nix
@@ -12,11 +12,11 @@
 
 buildPythonPackage rec {
   pname = "botocore";
-  version = "1.17.43"; # N.B: if you change this, change boto3 and awscli to a matching version
+  version = "1.17.51"; # N.B: if you change this, change boto3 and awscli to a matching version
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "3fb144d2b5d705127f394f7483737ece6fa79577ca7c493e4f42047ac8636200";
+    sha256 = "198a62d387eb64b4c1dde33a9c41e96b07884c68c1442dd7c7d38123592aae7c";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/catalogue/default.nix b/pkgs/development/python-modules/catalogue/default.nix
index 608d9dc4269..1624cbcf36c 100644
--- a/pkgs/development/python-modules/catalogue/default.nix
+++ b/pkgs/development/python-modules/catalogue/default.nix
@@ -2,8 +2,8 @@
 , buildPythonPackage
 , fetchPypi
 , pythonOlder
-, pytestCheckHook
 , importlib-metadata
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
diff --git a/pkgs/development/python-modules/cheroot/default.nix b/pkgs/development/python-modules/cheroot/default.nix
index 34f1f0fe468..5795b55d91b 100644
--- a/pkgs/development/python-modules/cheroot/default.nix
+++ b/pkgs/development/python-modules/cheroot/default.nix
@@ -18,13 +18,13 @@
 
 buildPythonPackage rec {
   pname = "cheroot";
-  version = "8.4.4";
+  version = "8.4.5";
 
   disabled = !isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "ca92669cc90fbd0920fda1ebcc431147e7d3ae6887216ce404f85f1b3133fa93";
+    sha256 = "b6c18caf5f79cdae668c35fc8309fc88ea4a964cce9e2ca8504fab13bcf57301";
   };
 
   nativeBuildInputs = [ setuptools_scm setuptools-scm-git-archive ];
diff --git a/pkgs/development/python-modules/clifford/default.nix b/pkgs/development/python-modules/clifford/default.nix
index b7ed70f8460..99a2126ee98 100644
--- a/pkgs/development/python-modules/clifford/default.nix
+++ b/pkgs/development/python-modules/clifford/default.nix
@@ -3,6 +3,7 @@
 , fetchPypi
 , numpy
 , scipy
+, sparse
 , numba
 , future
 , h5py
@@ -23,6 +24,7 @@ buildPythonPackage rec {
   propagatedBuildInputs = [
     numpy
     scipy
+    sparse
     numba
     future
     h5py
diff --git a/pkgs/development/python-modules/cloudflare/default.nix b/pkgs/development/python-modules/cloudflare/default.nix
index d18bbd8773c..7692bd1c9d6 100644
--- a/pkgs/development/python-modules/cloudflare/default.nix
+++ b/pkgs/development/python-modules/cloudflare/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, beautifulsoup4
 , requests
 , future
 , pyyaml
@@ -17,6 +18,7 @@ buildPythonPackage rec {
   };
 
   propagatedBuildInputs = [
+    beautifulsoup4
     requests
     future
     pyyaml
diff --git a/pkgs/development/python-modules/cmd2/default.nix b/pkgs/development/python-modules/cmd2/default.nix
index d00c87af704..f6055ae0144 100644
--- a/pkgs/development/python-modules/cmd2/default.nix
+++ b/pkgs/development/python-modules/cmd2/default.nix
@@ -6,11 +6,11 @@
 }:
 buildPythonPackage rec {
   pname = "cmd2";
-  version = "1.3.3";
+  version = "1.3.8";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "38015008ff4639edfd66591063a0e9bb75a62dccb14ee3ec7bf3a6cb130de5cf";
+    sha256 = "b6f6254def8ba479088702f97bca1b999c12e0c38ac5d82dc50a44db93c7108c";
   };
 
   LC_ALL="en_US.UTF-8";
diff --git a/pkgs/development/python-modules/codecov/default.nix b/pkgs/development/python-modules/codecov/default.nix
index ad753c18942..8424a560d26 100644
--- a/pkgs/development/python-modules/codecov/default.nix
+++ b/pkgs/development/python-modules/codecov/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "codecov";
-  version = "2.1.8";
+  version = "2.1.9";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0be9cd6358cc6a3c01a1586134b0fb524dfa65ccbec3a40e9f28d5f976676ba2";
+    sha256 = "355fc7e0c0b8a133045f0d6089bde351c845e7b52b99fec5903b4ea3ab5f6aab";
   };
 
   checkInputs = [ unittest2 ]; # Tests only
diff --git a/pkgs/development/python-modules/cryptography/default.nix b/pkgs/development/python-modules/cryptography/default.nix
index 9f7bb3f1adb..d122c42e846 100644
--- a/pkgs/development/python-modules/cryptography/default.nix
+++ b/pkgs/development/python-modules/cryptography/default.nix
@@ -22,11 +22,11 @@
 
 buildPythonPackage rec {
   pname = "cryptography";
-  version = "3.0"; # Also update the hash in vectors.nix
+  version = "3.1"; # Also update the hash in vectors.nix
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0lr06a9317n2iwfqwz9mpalqm99acqwk1478arvyj1jj0ay4v4lf";
+    sha256 = "021yccbqr446zh1c9l8yj79h9bgbd1cwv0ppj168w9y67i3rlh16";
   };
 
   outputs = [ "out" "dev" ];
diff --git a/pkgs/development/python-modules/cryptography/vectors.nix b/pkgs/development/python-modules/cryptography/vectors.nix
index 02a3f44bb09..99f3b6f8974 100644
--- a/pkgs/development/python-modules/cryptography/vectors.nix
+++ b/pkgs/development/python-modules/cryptography/vectors.nix
@@ -7,7 +7,7 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0fa26ggksyhknb43cja1g0jwp35qkdbavivdq6yynj1igd2z1vsj";
+    sha256 = "10hixzqf2ppw8j61f6p04rgnq8ra6pjml68330s5af8df8xbqq16";
   };
 
   # No tests included
diff --git a/pkgs/development/python-modules/datashader/default.nix b/pkgs/development/python-modules/datashader/default.nix
index b5ae4a4c437..d1e2eb3b24a 100644
--- a/pkgs/development/python-modules/datashader/default.nix
+++ b/pkgs/development/python-modules/datashader/default.nix
@@ -30,11 +30,11 @@
 
 buildPythonPackage rec {
   pname = "datashader";
-  version = "0.11.0";
+  version = "0.11.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "05p81aff7x70yj8llclclgz6klvfzqixwxfng6awn3y5scv18w40";
+    sha256 = "b1f80415f72f92ccb660aaea7b2881ddd35d07254f7c44101709d42e819d6be6";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/django-dynamic-preferences/default.nix b/pkgs/development/python-modules/django-dynamic-preferences/default.nix
index 34fb7a1d7b5..de3424c9fec 100644
--- a/pkgs/development/python-modules/django-dynamic-preferences/default.nix
+++ b/pkgs/development/python-modules/django-dynamic-preferences/default.nix
@@ -4,11 +4,11 @@
 
 buildPythonPackage rec {
   pname = "django-dynamic-preferences";
-  version = "1.10";
+  version = "1.10.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "2310291c7f40606be045938d65e117383549aa8a979c6c4b700464c6a6204a34";
+    sha256 = "e4b2bb7b2563c5064ba56dd76441c77e06b850ff1466a386a1cd308909a6c7de";
   };
 
   propagatedBuildInputs = [ six django persisting-theory ];
diff --git a/pkgs/development/python-modules/django/2_2.nix b/pkgs/development/python-modules/django/2_2.nix
index fa5be71095b..99f71b9d862 100644
--- a/pkgs/development/python-modules/django/2_2.nix
+++ b/pkgs/development/python-modules/django/2_2.nix
@@ -6,13 +6,13 @@
 
 buildPythonPackage rec {
   pname = "Django";
-  version = "2.2.14";
+  version = "2.2.15";
 
   disabled = !isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "14b1w00hrf4n7hla6d6nf2p5r4k6jh3fcmv7bd1v04vpcpvfrw7d";
+    sha256 = "3e2f5d172215862abf2bac3138d8a04229d34dbd2d0dab42c6bf33876cc22323";
   };
 
   patches = stdenv.lib.optional withGdal
diff --git a/pkgs/development/python-modules/django_nose/default.nix b/pkgs/development/python-modules/django_nose/default.nix
index 5d3522c5b47..66a4ad7857b 100644
--- a/pkgs/development/python-modules/django_nose/default.nix
+++ b/pkgs/development/python-modules/django_nose/default.nix
@@ -7,11 +7,11 @@
 
 buildPythonPackage rec {
   pname = "django-nose";
-  version = "1.4.6";
+  version = "1.4.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "01wah0ci5xdpiikash68x6lprxlvnkxg72ly9kjrc9lklq34m4sq";
+    sha256 = "a4885cd002d65fd2de96e2bb2563ef477c3fbe207009360c015fca5c3b5561b7";
   };
 
   # vast dependency list
diff --git a/pkgs/development/python-modules/docker/default.nix b/pkgs/development/python-modules/docker/default.nix
index fff9b272293..d46fbe991ae 100644
--- a/pkgs/development/python-modules/docker/default.nix
+++ b/pkgs/development/python-modules/docker/default.nix
@@ -11,11 +11,11 @@
 
 buildPythonPackage rec {
   pname = "docker";
-  version = "4.3.0";
+  version = "4.3.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "431a268f2caf85aa30613f9642da274c62f6ee8bae7d70d968e01529f7d6af93";
+    sha256 = "bad94b8dd001a8a4af19ce4becc17f41b09f228173ffe6a4e0355389eef142f2";
   };
 
   nativeBuildInputs = lib.optional isPy27 mock;
diff --git a/pkgs/development/python-modules/dogpile.cache/default.nix b/pkgs/development/python-modules/dogpile.cache/default.nix
index de0354f786c..32cb213af4f 100644
--- a/pkgs/development/python-modules/dogpile.cache/default.nix
+++ b/pkgs/development/python-modules/dogpile.cache/default.nix
@@ -1,10 +1,19 @@
-{ stdenv, buildPythonPackage, fetchPypi
-, pytest, pytestcov, mock, Mako, decorator, stevedore
+{ stdenv
+, buildPythonPackage
+, fetchPypi
+, pythonOlder
+, pytest
+, pytestcov
+, mock
+, Mako
+, decorator
+, stevedore
 }:
 
 buildPythonPackage rec {
   pname = "dogpile.cache";
   version = "1.0.2";
+  disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
diff --git a/pkgs/development/python-modules/executor/default.nix b/pkgs/development/python-modules/executor/default.nix
index 8d9b379187b..e36c0e41c45 100644
--- a/pkgs/development/python-modules/executor/default.nix
+++ b/pkgs/development/python-modules/executor/default.nix
@@ -1,8 +1,9 @@
-{ lib, buildPythonPackage, fetchFromGitHub, coloredlogs, property-manager, fasteners, pytest, mock, virtualenv }:
+{ lib, buildPythonPackage, fetchFromGitHub, isPy27, coloredlogs, property-manager, fasteners, pytest, mock, virtualenv }:
 
 buildPythonPackage rec {
   pname = "executor";
   version = "21.3";
+  disabled = isPy27;
 
   src = fetchFromGitHub {
     owner = "xolox";
diff --git a/pkgs/development/python-modules/faker/default.nix b/pkgs/development/python-modules/faker/default.nix
index ced4744d93f..102f506b6a6 100644
--- a/pkgs/development/python-modules/faker/default.nix
+++ b/pkgs/development/python-modules/faker/default.nix
@@ -17,11 +17,11 @@ assert pythonOlder "3.3" -> ipaddress != null;
 
 buildPythonPackage rec {
   pname = "Faker";
-  version = "4.1.1";
+  version = "4.1.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "c006b3664c270a2cfd4785c5e41ff263d48101c4e920b5961cf9c237131d8418";
+    sha256 = "ff188c416864e3f7d8becd8f9ee683a4b4101a2a2d2bcdcb3e84bb1bdd06eaae";
   };
 
   nativeBuildInputs = [ pytestrunner ];
diff --git a/pkgs/development/python-modules/flufl/bounce.nix b/pkgs/development/python-modules/flufl/bounce.nix
index 0a2e8dff1b7..deb92ea9ce8 100644
--- a/pkgs/development/python-modules/flufl/bounce.nix
+++ b/pkgs/development/python-modules/flufl/bounce.nix
@@ -2,13 +2,13 @@
 
 buildPythonPackage rec {
   pname = "flufl.bounce";
-  version = "3.0";
+  version = "3.0.1";
 
   buildInputs = [ nose2 ];
   propagatedBuildInputs = [ atpublic zope_interface ];
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0k5kjqa3x6gvwwxyzb2vwi1g1i6asm1zw5fivylxz3d583y4kid2";
+    sha256 = "e432fa1ca25ddbf23e2716b177d4d1c6ab6c078e357df56b0106b92bc10a8f06";
   };
 }
diff --git a/pkgs/development/python-modules/gdown/default.nix b/pkgs/development/python-modules/gdown/default.nix
index 37bc4ef0bf1..9af10727285 100644
--- a/pkgs/development/python-modules/gdown/default.nix
+++ b/pkgs/development/python-modules/gdown/default.nix
@@ -9,11 +9,11 @@
 
 buildPythonApplication rec {
   pname = "gdown";
-  version = "3.12.0";
+  version = "3.12.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "bf5f001e3a7add296e5298240c64db88ba88e5c136bd1fe84fcbd542feb6fccd";
+    sha256 = "4b3a1301e57bfd8dce939bf25ef8fbb4b23967fd0f878eede328bdcc41386bac";
   };
 
   propagatedBuildInputs = [ filelock requests tqdm setuptools ];
diff --git a/pkgs/development/python-modules/globus-sdk/default.nix b/pkgs/development/python-modules/globus-sdk/default.nix
index ead4b297b8b..7956a31492c 100644
--- a/pkgs/development/python-modules/globus-sdk/default.nix
+++ b/pkgs/development/python-modules/globus-sdk/default.nix
@@ -10,11 +10,11 @@
 
 buildPythonPackage rec {
   pname = "globus-sdk";
-  version = "1.9.0";
+  version = "1.9.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1fm0iqfbzd13m1lkd4h3ss4y9isp5cadd2w2k0qr3yqwfmrqqba2";
+    sha256 = "883a862ddd17b0f4868ec55d6697a64c13d91c41b9fa5103198d2140053abac2";
   };
 
   checkPhase = ''
diff --git a/pkgs/development/python-modules/google_cloud_kms/default.nix b/pkgs/development/python-modules/google_cloud_kms/default.nix
index 0cc5b76f7db..79fe4bcc80f 100644
--- a/pkgs/development/python-modules/google_cloud_kms/default.nix
+++ b/pkgs/development/python-modules/google_cloud_kms/default.nix
@@ -10,11 +10,11 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-kms";
-  version = "2.0.0";
+  version = "2.0.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "5af43d30adbb19023f9fec9d481b1d2d35be690d2a8dcdf9d6abc2c1d302cc17";
+    sha256 = "c590a8ab12a3f776ab35e570d21c0881f9d73c444bd509e54321a4c715233372";
   };
 
   checkInputs = [ pytest mock ];
diff --git a/pkgs/development/python-modules/howdoi/default.nix b/pkgs/development/python-modules/howdoi/default.nix
index 83f340fc8d8..a4f1ab6b772 100644
--- a/pkgs/development/python-modules/howdoi/default.nix
+++ b/pkgs/development/python-modules/howdoi/default.nix
@@ -11,11 +11,11 @@
 
 buildPythonPackage rec {
   pname = "howdoi";
-  version = "2.0.4";
+  version = "2.0.5";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0hq5biy0mpycbji2mikfbflw4r39prylr47iqhlz234kvwdy0jsg";
+    sha256 = "8e4d048ae7ca6182d648f62a66d07360cca2504fe46649c32748b6ef2735f7f4";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/hypothesis/default.nix b/pkgs/development/python-modules/hypothesis/default.nix
index f79fe028203..dac4ca43fc9 100644
--- a/pkgs/development/python-modules/hypothesis/default.nix
+++ b/pkgs/development/python-modules/hypothesis/default.nix
@@ -10,7 +10,7 @@ buildPythonPackage rec {
   # pytz fake_factory django numpy pytest
   # If you need these, you can just add them to your environment.
 
-  version = "5.11.0";
+  version = "5.30.0";
   pname = "hypothesis";
 
   # Use github tarballs that includes tests
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "HypothesisWorks";
     repo = "hypothesis-python";
     rev = "hypothesis-python-${version}";
-    sha256 = "1ca2dwih65s4r8vazwqm963ywngdr3v854ldnfyny7bvx1v28m8k";
+    sha256 = "0fmc4jfaksr285fjhp18ibj2rr8cxmbd0pwx370r5wf8jnhm6jb3";
   };
 
   postUnpack = "sourceRoot=$sourceRoot/hypothesis-python";
diff --git a/pkgs/development/python-modules/identify/default.nix b/pkgs/development/python-modules/identify/default.nix
index 52b1ffd89b9..68a71e0974b 100644
--- a/pkgs/development/python-modules/identify/default.nix
+++ b/pkgs/development/python-modules/identify/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "identify";
-  version = "1.4.27";
+  version = "1.4.29";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "4c3646d765127b003d2bed8db1e125d68f5f83ad0cd85e21c908ef87a5e24be1";
+    sha256 = "9f5fcf22b665eaece583bd395b103c2769772a0f646ffabb5b1f155901b07de2";
   };
 
   # Tests not included in PyPI tarball
diff --git a/pkgs/development/python-modules/inflection/default.nix b/pkgs/development/python-modules/inflection/default.nix
index 5721615c0c5..6f439f0f69a 100644
--- a/pkgs/development/python-modules/inflection/default.nix
+++ b/pkgs/development/python-modules/inflection/default.nix
@@ -2,12 +2,12 @@
 
 buildPythonPackage rec {
   pname = "inflection";
-  version = "0.5.0";
+  version = "0.5.1";
   disabled = isPy27;
 
   src = fetchPypi {
    inherit pname version;
-   sha256 = "f576e85132d34f5bf7df5183c2c6f94cfb32e528f53065345cf71329ba0b8924";
+   sha256 = "1a29730d366e996aaacffb2f1f1cb9593dc38e2ddd30c91250c6dde09ea9b417";
   };
 
   checkInputs = [ pytest ];
diff --git a/pkgs/development/python-modules/ipyvuetify/default.nix b/pkgs/development/python-modules/ipyvuetify/default.nix
index b3874c50617..c63cee79123 100644
--- a/pkgs/development/python-modules/ipyvuetify/default.nix
+++ b/pkgs/development/python-modules/ipyvuetify/default.nix
@@ -7,12 +7,12 @@
 
 buildPythonPackage rec {
   pname = "ipyvuetify";
-  version = "1.5.0";
+  version = "1.5.1";
 
   # GitHub version tries to run npm (Node JS)
   src = fetchPypi {
     inherit pname version;
-    sha256 = "5c311308d3ec9c92e48ab6ca021b5b51295e9e39de640f69827e30d5f03a244b";
+    sha256 = "593f5d6761e304cbb78bca967030485d8835e8d310ef7d83ac1b0e6a13e4911c";
   };
 
   propagatedBuildInputs = [ ipyvue ];
diff --git a/pkgs/development/python-modules/jq/default.nix b/pkgs/development/python-modules/jq/default.nix
index 3f1941b2a2b..30efd75aa3a 100644
--- a/pkgs/development/python-modules/jq/default.nix
+++ b/pkgs/development/python-modules/jq/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "jq";
-  version = "0.1.6";
+  version = "0.1.8";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "34bdf9f9e49e522e1790afc03f3584c6b57329215ea0567fb2157867d6d6f602";
+    sha256 = "9b6bb376237133080185ab556ca2a724e8be5b31946eb2053d4a1f17ae9df9a8";
   };
   patches = [ ./jq-py-setup.patch ];
 
diff --git a/pkgs/development/python-modules/junos-eznc/default.nix b/pkgs/development/python-modules/junos-eznc/default.nix
index 9215344c55d..f351ea7a1c3 100644
--- a/pkgs/development/python-modules/junos-eznc/default.nix
+++ b/pkgs/development/python-modules/junos-eznc/default.nix
@@ -15,11 +15,11 @@
 
 buildPythonPackage rec {
   pname = "junos-eznc";
-  version = "2.5.1";
+  version = "2.5.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0e3a1e74b9254b4832a6cdbf8e6f26f9a269f574cb8cf2dd292dc131e0f4b245";
+    sha256 = "521659fe94da796897abc16773c3d84fa44d3e1f5386c71fbaef44cb80159855";
   };
 
 
diff --git a/pkgs/development/python-modules/jupyter_client/5.nix b/pkgs/development/python-modules/jupyter_client/5.nix
index 8ce8150cbd4..201fbec02ca 100644
--- a/pkgs/development/python-modules/jupyter_client/5.nix
+++ b/pkgs/development/python-modules/jupyter_client/5.nix
@@ -12,11 +12,11 @@
 
 buildPythonPackage rec {
   pname = "jupyter_client";
-  version = "5.3.4";
+  version = "5.3.5";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "60e6faec1031d63df57f1cc671ed673dced0ed420f4377ea33db37b1c188b910";
+    sha256 = "5efdf4131124d4a0d5789101e74827022585f172d2f4b60cf6fa98e0a7511b25";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/jupyter_client/default.nix b/pkgs/development/python-modules/jupyter_client/default.nix
index 39f8c71a4df..47d3bb6af0c 100644
--- a/pkgs/development/python-modules/jupyter_client/default.nix
+++ b/pkgs/development/python-modules/jupyter_client/default.nix
@@ -12,11 +12,11 @@
 
 buildPythonPackage rec {
   pname = "jupyter_client";
-  version = "6.1.6";
+  version = "6.1.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "b360f8d4638bc577a4656e93f86298db755f915098dc763f6fc05da0c5d7a595";
+    sha256 = "49e390b36fe4b4226724704ea28d9fb903f1a3601b6882ce3105221cd09377a1";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/jupyterhub-ldapauthenticator/default.nix b/pkgs/development/python-modules/jupyterhub-ldapauthenticator/default.nix
index cfb89e7f34f..4d0831ff979 100644
--- a/pkgs/development/python-modules/jupyterhub-ldapauthenticator/default.nix
+++ b/pkgs/development/python-modules/jupyterhub-ldapauthenticator/default.nix
@@ -11,7 +11,7 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "12xby5j7wmi6qsbb2fjd5qbckkcg5fmdij8qpc9n7ci8vfxq303m";
+    sha256 = "758081bbdb28b26313bb18c9d8aa2b8fcdc9162e4d3ab196c626567e64f1ab8b";
   };
 
   # No tests implemented
diff --git a/pkgs/development/python-modules/jupyterlab/default.nix b/pkgs/development/python-modules/jupyterlab/default.nix
index 0ee36a5c0c0..fb5ac3d06aa 100644
--- a/pkgs/development/python-modules/jupyterlab/default.nix
+++ b/pkgs/development/python-modules/jupyterlab/default.nix
@@ -8,12 +8,12 @@
 
 buildPythonPackage rec {
   pname = "jupyterlab";
-  version = "2.2.4";
+  version = "2.2.6";
   disabled = pythonOlder "3.5";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "e9d26c4c1cf4f7760dfa9ccd3fd5ea5027ae2767f22c7766dbb2fbb5e5dfcd4b";
+    sha256 = "6554b022d2cd120100e165ec537c6511d70de7f89e253b3c667ea28f2a9263ff";
   };
 
   propagatedBuildInputs = [ jupyterlab_server notebook ];
diff --git a/pkgs/development/python-modules/keyring/default.nix b/pkgs/development/python-modules/keyring/default.nix
index ebb1031796b..560986f9c3d 100644
--- a/pkgs/development/python-modules/keyring/default.nix
+++ b/pkgs/development/python-modules/keyring/default.nix
@@ -11,12 +11,12 @@
 
 buildPythonPackage rec {
   pname = "keyring";
-  version = "21.3.0";
+  version = "21.3.1";
   disabled = isPy27;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "22df6abfed49912fc560806030051067fba9f0069cffa79da72899aeea4ccbd5";
+    sha256 = "182f94fc0381546489e3e4d90384a8c1d43cc09ffe2eb4a826e7312df6e1be7c";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/libcloud/2.nix b/pkgs/development/python-modules/libcloud/2.nix
index e680e45391f..52c1cf9a9d7 100644
--- a/pkgs/development/python-modules/libcloud/2.nix
+++ b/pkgs/development/python-modules/libcloud/2.nix
@@ -14,11 +14,11 @@
 
 buildPythonPackage rec {
   pname = "apache-libcloud";
-  version = "2.8.2";
+  version = "2.8.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1wvm8vixhcapkfv5k6xaf8c8w647kx2rdifarg6j0s34r4jzblfg";
+    sha256 = "70096690b24a7832cc5abdfda1954b49fddc1c09a348a1e6caa781ac867ed4c6";
   };
 
   checkInputs = [ mock pytest pytestrunner requests-mock ];
diff --git a/pkgs/development/python-modules/marionette-harness/mozhttpd.nix b/pkgs/development/python-modules/marionette-harness/mozhttpd.nix
index 9f5a77549da..a7cbb7ece08 100644
--- a/pkgs/development/python-modules/marionette-harness/mozhttpd.nix
+++ b/pkgs/development/python-modules/marionette-harness/mozhttpd.nix
@@ -6,11 +6,11 @@
 
 buildPythonPackage rec {
   pname = "mozhttpd";
-  version = "0.7";
+  version = "0.7.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "10y1cr933ajx9ni701ayb7r361pak9wrzr7pdpyx81kkbjddq7qa";
+    sha256 = "3e2a9b4d6c007a1a9fb729d6e95b5404d138914727747e10155426492dced975";
   };
 
   propagatedBuildInputs = [ moznetwork ];
diff --git a/pkgs/development/python-modules/mutagen/1.43.nix b/pkgs/development/python-modules/mutagen/1.43.nix
index 3947dc05fa4..a7a7c7c6604 100644
--- a/pkgs/development/python-modules/mutagen/1.43.nix
+++ b/pkgs/development/python-modules/mutagen/1.43.nix
@@ -12,11 +12,11 @@
 
 buildPythonPackage rec {
   pname = "mutagen";
-  version = "1.43.0";
+  version = "1.43.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "125m0pkiw5lsffc0236xdlxfhwpr8csvxpmg6855405qy4wjv61s";
+    sha256 = "d873baeb7815311d3420aab0a1d83f050f628228cbc2d6045a14a16460411bc9";
   };
 
   propagatedBuildInputs = [ setuptools ];
diff --git a/pkgs/development/python-modules/nbclient/default.nix b/pkgs/development/python-modules/nbclient/default.nix
index 990854b1098..f6009bf5003 100644
--- a/pkgs/development/python-modules/nbclient/default.nix
+++ b/pkgs/development/python-modules/nbclient/default.nix
@@ -5,12 +5,12 @@
 
 buildPythonPackage rec {
   pname = "nbclient";
-  version = "0.4.1";
+  version = "0.4.3";
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "31fdb4bd45ebcd98eeda01e2c38fb391eae8a8480bdddbebb6cfd088486948a7";
+    sha256 = "311e14e463a300239c558a95023f6d1007c3f69f589bd51a76b1b6b3f19a7f4b";
   };
 
   checkInputs = [ pytest xmltodict nbconvert ipywidgets ];
diff --git a/pkgs/development/python-modules/netdisco/default.nix b/pkgs/development/python-modules/netdisco/default.nix
index a641f4cf558..a26a212d8f7 100644
--- a/pkgs/development/python-modules/netdisco/default.nix
+++ b/pkgs/development/python-modules/netdisco/default.nix
@@ -2,13 +2,13 @@
 
 buildPythonPackage rec {
   pname = "netdisco";
-  version = "2.8.1";
+  version = "2.8.2";
 
   disabled = !isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "05ca5a8a0be88aa1a919818b0c5208293aa1197518a561545c6947232ee22bc1";
+    sha256 = "dcaabf83b204282aacfb213b18799eb7af2d5a6defe529487bbd0548036392fe";
   };
 
   propagatedBuildInputs = [ requests zeroconf netifaces ];
diff --git a/pkgs/development/python-modules/nipype/default.nix b/pkgs/development/python-modules/nipype/default.nix
index 4e47a4a9314..80ee7691a1a 100644
--- a/pkgs/development/python-modules/nipype/default.nix
+++ b/pkgs/development/python-modules/nipype/default.nix
@@ -50,11 +50,11 @@ in
 
 buildPythonPackage rec {
   pname = "nipype";
-  version = "1.5.0";
+  version = "1.5.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "8c837eafdaa68e85d911aca20c8a2cd9210e4fffabbcbc5bd2eb6e26f8553da9";
+    sha256 = "3d6aa37186e1d2f90917dfdf1faf5aeff469912554990e5d182ffe8435f250d5";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/nodeenv/default.nix b/pkgs/development/python-modules/nodeenv/default.nix
index 14a67fe54ae..b4acefaeb6a 100644
--- a/pkgs/development/python-modules/nodeenv/default.nix
+++ b/pkgs/development/python-modules/nodeenv/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "nodeenv";
-  version = "1.3.3";
+  version = "1.3.5";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "ad8259494cf1c9034539f6cced78a1da4840a4b157e23640bc4a0c0546b0cb7a";
+    sha256 = "7389d06a7ea50c80ca51eda1b185db7b9ec38af1304d12d8b8299d6218486e91";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/notebook/2.nix b/pkgs/development/python-modules/notebook/2.nix
index 37f39c44967..0e5cfdf4397 100644
--- a/pkgs/development/python-modules/notebook/2.nix
+++ b/pkgs/development/python-modules/notebook/2.nix
@@ -25,11 +25,11 @@
 
 buildPythonPackage rec {
   pname = "notebook";
-  version = "5.7.8";
+  version = "5.7.10";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "573e0ae650c5d76b18b6e564ba6d21bf321d00847de1d215b418acb64f056eb8";
+    sha256 = "b10107e1438e7a564292aa32510e610c88844cae03c882fe5286b891792b5c11";
   };
 
   LC_ALL = "en_US.utf8";
diff --git a/pkgs/development/python-modules/numba/default.nix b/pkgs/development/python-modules/numba/default.nix
index c46bd4a2f18..c3a6484adbc 100644
--- a/pkgs/development/python-modules/numba/default.nix
+++ b/pkgs/development/python-modules/numba/default.nix
@@ -13,14 +13,14 @@
 }:
 
 buildPythonPackage rec {
-  version = "0.51.0";
+  version = "0.51.1";
   pname = "numba";
   # uses f-strings
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "da57ef00bc814bf54446fb3f8c0374557a7476e40279ceabefd9f12b05cc3c0c";
+    sha256 = "1e765b1a41535684bf3b0465c1d0a24dcbbff6af325270c8f4dad924c0940160";
   };
 
   NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.isDarwin "-I${libcxx}/include/c++/v1";
diff --git a/pkgs/development/python-modules/numpy/1.16.nix b/pkgs/development/python-modules/numpy/1.16.nix
index af419c5e0a4..6fa77d8fa90 100644
--- a/pkgs/development/python-modules/numpy/1.16.nix
+++ b/pkgs/development/python-modules/numpy/1.16.nix
@@ -21,27 +21,30 @@ let
       ${blas.implementation} = {
         include_dirs = "${lib.getDev blas}/include:${lib.getDev lapack}/include";
         library_dirs = "${blas}/lib:${lapack}/lib";
+        runtime_library_dirs = "${blas}/lib:${lapack}/lib";
         libraries = "lapack,lapacke,blas,cblas";
       };
       lapack = {
         include_dirs = "${lib.getDev lapack}/include";
         library_dirs = "${lapack}/lib";
+        runtime_library_dirs = "${lapack}/lib";
       };
       blas = {
         include_dirs = "${lib.getDev blas}/include";
         library_dirs = "${blas}/lib";
+        runtime_library_dirs = "${blas}/lib";
       };
     });
   };
 in buildPythonPackage rec {
   pname = "numpy";
-  version = "1.16.5";
+  version = "1.16.6";
   format = "pyproject.toml";
 
   src = fetchPypi {
     inherit pname version;
     extension = "zip";
-    sha256 = "8bb452d94e964b312205b0de1238dd7209da452343653ab214b5d681780e7a0c";
+    sha256 = "e5cf3fdf13401885e8eea8170624ec96225e2174eb0c611c6f26dd33b489e3ff";
   };
 
   nativeBuildInputs = [ gfortran pytest cython setuptoolsBuildHook ];
diff --git a/pkgs/development/python-modules/numpy/default.nix b/pkgs/development/python-modules/numpy/default.nix
index 98ba0b5c688..9502cdc5b0a 100644
--- a/pkgs/development/python-modules/numpy/default.nix
+++ b/pkgs/development/python-modules/numpy/default.nix
@@ -22,15 +22,18 @@ let
       ${blas.implementation} = {
         include_dirs = "${lib.getDev blas}/include:${lib.getDev lapack}/include";
         library_dirs = "${blas}/lib:${lapack}/lib";
+        runtime_library_dirs = "${blas}/lib:${lapack}/lib";
         libraries = "lapack,lapacke,blas,cblas";
       };
       lapack = {
         include_dirs = "${lib.getDev lapack}/include";
         library_dirs = "${lapack}/lib";
+        runtime_library_dirs = "${lapack}/lib";
       };
       blas = {
         include_dirs = "${lib.getDev blas}/include";
         library_dirs = "${blas}/lib";
+        runtime_library_dirs = "${blas}/lib";
       };
     });
   };
diff --git a/pkgs/development/python-modules/nunavut/default.nix b/pkgs/development/python-modules/nunavut/default.nix
index da0b106b7ce..4905a8da7a3 100644
--- a/pkgs/development/python-modules/nunavut/default.nix
+++ b/pkgs/development/python-modules/nunavut/default.nix
@@ -2,12 +2,12 @@
 
  buildPythonPackage rec {
   pname = "nunavut";
-  version = "0.3.4";
+  version = "0.3.6";
   disabled = pythonOlder "3.5"; # only python>=3.5 is supported
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "5455946d069ac8cfd86e93d3977c1bd31ee7d68d22accdf130addb038e73564a";
+    sha256 = "434edabdc431b9af719896e0de4bd0deead657777d1d8aa4e3cd0dcdff6298bc";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/openpyxl/default.nix b/pkgs/development/python-modules/openpyxl/default.nix
index 72205f8727f..5a7d2a6425b 100644
--- a/pkgs/development/python-modules/openpyxl/default.nix
+++ b/pkgs/development/python-modules/openpyxl/default.nix
@@ -10,12 +10,12 @@
 
 buildPythonPackage rec {
   pname = "openpyxl";
-  version = "3.0.4";
+  version = "3.0.5";
   disabled = isPy27; # 2.6.4 was final python2 release
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "d88dd1480668019684c66cfff3e52a5de4ed41e9df5dd52e008cbf27af0dbf87";
+    sha256 = "18e11f9a650128a12580a58e3daba14e00a11d9e907c554a17ea016bf1a2c71b";
   };
 
   checkInputs = [ pytest ];
diff --git a/pkgs/development/python-modules/pandas/default.nix b/pkgs/development/python-modules/pandas/default.nix
index 7b246a38cb9..d4c9706fe65 100644
--- a/pkgs/development/python-modules/pandas/default.nix
+++ b/pkgs/development/python-modules/pandas/default.nix
@@ -31,11 +31,11 @@ let
 
 in buildPythonPackage rec {
   pname = "pandas";
-  version = "1.1.0";
+  version = "1.1.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "b39508562ad0bb3f384b0db24da7d68a2608b9ddc85b1d931ccaaa92d5e45273";
+    sha256 = "53328284a7bb046e2e885fd1b8c078bd896d7fc4575b915d4936f54984a2ba67";
   };
 
   checkInputs = [ pytest glibcLocales moto hypothesis ];
diff --git a/pkgs/development/python-modules/papermill/default.nix b/pkgs/development/python-modules/papermill/default.nix
index 43c13c2606a..0e5c62277af 100644
--- a/pkgs/development/python-modules/papermill/default.nix
+++ b/pkgs/development/python-modules/papermill/default.nix
@@ -25,11 +25,11 @@
 
 buildPythonPackage rec {
   pname = "papermill";
-  version = "2.1.2";
+  version = "2.1.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "aadc23f0ae2eaa75868e4359f1ea7d75ff46bc8cb1988651f3f3fd5d4ec44679";
+    sha256 = "ecd4cafa9179693b0eedc3b6f4560f9ee47826a6e366e42bfa3cc20f7931b3f8";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/paramiko/default.nix b/pkgs/development/python-modules/paramiko/default.nix
index 6c490cb344b..41951f1d893 100644
--- a/pkgs/development/python-modules/paramiko/default.nix
+++ b/pkgs/development/python-modules/paramiko/default.nix
@@ -1,6 +1,7 @@
 { pkgs
 , buildPythonPackage
 , fetchPypi
+, fetchpatch
 , cryptography
 , bcrypt
 , invoke
@@ -20,6 +21,13 @@ buildPythonPackage rec {
     sha256 = "920492895db8013f6cc0179293147f830b8c7b21fdfc839b6bad760c27459d9f";
   };
 
+  patches = [
+    # fix RSA key loading with cryptography 3.1, remove >2.7.1
+    (fetchpatch {
+      url = "https://github.com/paramiko/paramiko/commit/81064206bf3cec2ca4372257ff138481e1227b91.patch";
+      sha256 = "01b87ffgyvd6rilp1w1kf7lk29z706ch39nwl21ifklqpjhmazww";
+    })
+  ];
   checkInputs = [ invoke pytest mock pytest-relaxed ];
   propagatedBuildInputs = [ bcrypt cryptography pynacl pyasn1 ];
 
@@ -27,6 +35,7 @@ buildPythonPackage rec {
 
   # 2 sftp tests fail (skip for now)
   # test_config relies on artifacts to be to downloaded
+  # RSA tests don't have valid keys
   checkPhase = ''
     pytest tests \
       --ignore=tests/test_sftp.py \
diff --git a/pkgs/development/python-modules/parfive/default.nix b/pkgs/development/python-modules/parfive/default.nix
index 7ce02fb96ab..a6dacf0402e 100644
--- a/pkgs/development/python-modules/parfive/default.nix
+++ b/pkgs/development/python-modules/parfive/default.nix
@@ -13,11 +13,11 @@
 
 buildPythonPackage rec {
   pname = "parfive";
-  version = "1.1.0";
+  version = "1.1.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "faa60c34dfbd080f011c1af0587f932874dcdf602d0336227d540899dbc41b50";
+    sha256 = "5793fdf9859a9a9fc93f033db9dc067a89626910355a14bbe425feb3956df6db";
   };
 
   buildInputs = [
diff --git a/pkgs/development/python-modules/parsedatetime/default.nix b/pkgs/development/python-modules/parsedatetime/default.nix
index 413955c6a36..0b7d5cd6fb4 100644
--- a/pkgs/development/python-modules/parsedatetime/default.nix
+++ b/pkgs/development/python-modules/parsedatetime/default.nix
@@ -1,6 +1,7 @@
 { stdenv
 , buildPythonPackage
 , fetchPypi
+, isPy27
 , pytest
 , pytestrunner
 , future
@@ -9,6 +10,7 @@
 buildPythonPackage rec {
   pname = "parsedatetime";
   version = "2.6";
+  disabled = isPy27; # no longer compatible with icu package
 
   src = fetchPypi {
     inherit pname version;
diff --git a/pkgs/development/python-modules/pyTelegramBotAPI/default.nix b/pkgs/development/python-modules/pyTelegramBotAPI/default.nix
index 9434944a1f7..2ecdfb17aa2 100644
--- a/pkgs/development/python-modules/pyTelegramBotAPI/default.nix
+++ b/pkgs/development/python-modules/pyTelegramBotAPI/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "pyTelegramBotAPI";
-  version = "3.7.2";
+  version = "3.7.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1jbd2npa942f3bqwpvc6kb3b9jxk7ksczd4grrdimfb6w7binzv4";
+    sha256 = "ce42d84442ff2ce4918de6550cf377253f61e28e4fac2634495683d12df66d00";
   };
 
   propagatedBuildInputs = [ requests ];
diff --git a/pkgs/development/python-modules/pyatv/default.nix b/pkgs/development/python-modules/pyatv/default.nix
index 2356cc1a88d..8d6da02e5f1 100644
--- a/pkgs/development/python-modules/pyatv/default.nix
+++ b/pkgs/development/python-modules/pyatv/default.nix
@@ -15,11 +15,11 @@
 
 buildPythonPackage rec {
   pname = "pyatv";
-  version = "0.7.1";
+  version = "0.7.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "17d4fb4fbdfe1c762e421ce2caa6beddab8ef9a6e0e5c7ab7eb54c8d8654c61c";
+    sha256 = "83d86fac517d33a1e3063a547ee2a520fde74c74a1b95cb5a6f20afccfd59843";
   };
 
   nativeBuildInputs = [ pytestrunner];
diff --git a/pkgs/development/python-modules/pychromecast/default.nix b/pkgs/development/python-modules/pychromecast/default.nix
index 07ed842368e..e6aef54557f 100644
--- a/pkgs/development/python-modules/pychromecast/default.nix
+++ b/pkgs/development/python-modules/pychromecast/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "PyChromecast";
-  version = "7.2.0";
+  version = "7.2.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "c522c5ecb554471ca8e5690c05530b1c237c301349061d3839c506984f8d3c2d";
+    sha256 = "9aad074d0361791af8ccb8fb7ea0f1646db3d89600fed85c5562b64c8b1aa899";
   };
 
   disabled = !isPy3k;
diff --git a/pkgs/development/python-modules/pymupdf/default.nix b/pkgs/development/python-modules/pymupdf/default.nix
index 53eee6ed186..bc2f2c6e95f 100644
--- a/pkgs/development/python-modules/pymupdf/default.nix
+++ b/pkgs/development/python-modules/pymupdf/default.nix
@@ -1,11 +1,11 @@
 { stdenv, buildPythonPackage, fetchPypi, mupdf, swig }:
 buildPythonPackage rec {
   pname = "PyMuPDF";
-  version = "1.17.5";
+  version = "1.17.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "ddec02c4dd1c2e0ead4d61cd97b52e725d643602f1f7832b5016190f5c653add";
+    sha256 = "5eef4ff61698016a296932858625a5a0039b923ba692043e2c98ca02966f1da2";
   };
 
   patchPhase = ''
diff --git a/pkgs/development/python-modules/pyopencl/default.nix b/pkgs/development/python-modules/pyopencl/default.nix
index 766952ee267..e5eddd81d99 100644
--- a/pkgs/development/python-modules/pyopencl/default.nix
+++ b/pkgs/development/python-modules/pyopencl/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "pyopencl";
-  version = "2020.2";
+  version = "2020.2.1";
 
   checkInputs = [ pytest ];
   buildInputs = [ opencl-headers ocl-icd pybind11 ];
@@ -25,7 +25,7 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "afd9f22547bcd879b9e54252fc885b45034ebfd1890e630827f1afb408a03d23";
+    sha256 = "deb6c50f37f8f88960a943b379eca8c0a9a80634cf60e09aee691a7453ae202e";
   };
 
   # py.test is not needed during runtime, so remove it from `install_requires`
diff --git a/pkgs/development/python-modules/pytest/4.nix b/pkgs/development/python-modules/pytest/4.nix
index 4fe588f6456..43cfe6c822c 100644
--- a/pkgs/development/python-modules/pytest/4.nix
+++ b/pkgs/development/python-modules/pytest/4.nix
@@ -3,12 +3,12 @@
 , atomicwrites, mock, writeText, pathlib2, wcwidth, packaging, isPyPy
 }:
 buildPythonPackage rec {
-  version = "4.6.9";
+  version = "4.6.11";
   pname = "pytest";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0fgkmpc31nzy97fxfrkqbzycigdwxwwmninx3qhkzp81migggs0r";
+    sha256 = "50fa82392f2120cc3ec2ca0a75ee615be4c479e66669789771f1758332be4353";
   };
 
   checkInputs = [ hypothesis mock ];
diff --git a/pkgs/development/python-modules/python-rtmidi/default.nix b/pkgs/development/python-modules/python-rtmidi/default.nix
index a85d587c21c..c2cced83509 100644
--- a/pkgs/development/python-modules/python-rtmidi/default.nix
+++ b/pkgs/development/python-modules/python-rtmidi/default.nix
@@ -4,12 +4,12 @@
 
 buildPythonPackage rec {
   pname = "python-rtmidi";
-  version = "1.4.3";
+  version = "1.4.5";
   disabled = isPy27;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "7f4bbcd77431917503d6ae738093c8419ed67812d50883fa9cfefce1eb21eb3a";
+    sha256 = "3dd1909d0f44f03a4191131f1829cac2ee6a94f5a4be2a9606354748e594e704";
   };
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/development/python-modules/pywbem/default.nix b/pkgs/development/python-modules/pywbem/default.nix
index 55bd8c8d0a5..345908031cc 100644
--- a/pkgs/development/python-modules/pywbem/default.nix
+++ b/pkgs/development/python-modules/pywbem/default.nix
@@ -5,14 +5,14 @@
 
 buildPythonPackage rec {
   pname = "pywbem";
-  version = "1.0.1";
+  version = "1.0.2";
 
   # Support added in master https://github.com/pywbem/pywbem/commit/b2f2f1a151a30355bbc6652dca69a7b30bfe941e awaiting release
   disabled = isPy37;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "2e738c9eb92591307f4f4d674b1e073bf12192604904e3c4028fde1aa338138c";
+    sha256 = "66d8ec82d30f2b95d8b4bd51659429066c2879d3f46292561f5fdbc7fed10f3d";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/ripser/default.nix b/pkgs/development/python-modules/ripser/default.nix
index 32d902a0e9c..9e2e76464d8 100644
--- a/pkgs/development/python-modules/ripser/default.nix
+++ b/pkgs/development/python-modules/ripser/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, pythonOlder
 , cython
 , numpy
 , scipy
@@ -11,11 +12,12 @@
 
 buildPythonPackage rec {
   pname = "ripser";
-  version = "0.5.3";
+  version = "0.5.4";
+  disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "cb63a03205511cd3d2aae586cec9515dddfbec3ce269dd0560911b0a55d75632";
+    sha256 = "7a54750427e3f1bbb26c625075c831314760a9e5b5bcd3b797df668f020c9eb6";
   };
 
   checkInputs = [
diff --git a/pkgs/development/python-modules/robotframework-requests/default.nix b/pkgs/development/python-modules/robotframework-requests/default.nix
index e62087628a0..72f7aabb70c 100644
--- a/pkgs/development/python-modules/robotframework-requests/default.nix
+++ b/pkgs/development/python-modules/robotframework-requests/default.nix
@@ -8,12 +8,12 @@
 }:
 
 buildPythonPackage rec {
-  version = "0.7.0";
+  version = "0.7.1";
   pname = "robotframework-requests";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "da7bf998f9cbf8261199db7c96b95be1bf29d1db7f59dfbc77c435761698dc75";
+    sha256 = "501a1c7415f839d6837eedd57f2b6ed20576aab318bf14e3878a77c9b106aa45";
   };
 
   buildInputs = [ unittest2 ];
diff --git a/pkgs/development/python-modules/sabyenc3/default.nix b/pkgs/development/python-modules/sabyenc3/default.nix
index 05b667fedc1..aab3201047d 100644
--- a/pkgs/development/python-modules/sabyenc3/default.nix
+++ b/pkgs/development/python-modules/sabyenc3/default.nix
@@ -2,11 +2,11 @@
 
 python3Packages.buildPythonPackage rec {
   pname = "sabyenc3";
-  version = "4.0.0";
+  version = "4.0.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0zfj1k4zij8ph8jwkq4d6i6axym8cil16yijxshqla5163d1031z";
+    sha256 = "dfaa0bdd01752a9cfde0d349a8f4e178b04b1cf9c1bc018b287961192cd2bb90";
   };
 
   # tests are not included in pypi distribution
diff --git a/pkgs/development/python-modules/sarge/default.nix b/pkgs/development/python-modules/sarge/default.nix
index 37a72278d85..1d46e65d349 100644
--- a/pkgs/development/python-modules/sarge/default.nix
+++ b/pkgs/development/python-modules/sarge/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "sarge";
-  version = "0.1.5.post0";
+  version = "0.1.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "da8cc90883f8e5ab4af0d746438f608662f5f2a35da2e858517927edefa134b0";
+    sha256 = "f48fb904e64f10ad6bef62422eaf4736acfd9b13ab64ba44822637a9dbb53265";
   };
 
   # No tests in PyPI tarball
diff --git a/pkgs/development/python-modules/seekpath/default.nix b/pkgs/development/python-modules/seekpath/default.nix
index e387f27c673..e70ba02ce0e 100644
--- a/pkgs/development/python-modules/seekpath/default.nix
+++ b/pkgs/development/python-modules/seekpath/default.nix
@@ -1,8 +1,9 @@
-{ stdenv, buildPythonPackage, fetchFromGitHub, numpy, future, spglib, glibcLocales, pytest, scipy }:
+{ stdenv, buildPythonPackage, fetchFromGitHub, pythonOlder, numpy, future, spglib, glibcLocales, pytest, scipy }:
 
 buildPythonPackage rec {
   pname = "seekpath";
   version = "2.0.1";
+  disabled = pythonOlder "3.5";
 
   src = fetchFromGitHub {
     owner = "giovannipizzi";
diff --git a/pkgs/development/python-modules/smart_open/default.nix b/pkgs/development/python-modules/smart_open/default.nix
index ea283f3a1ba..6dff98a09b4 100644
--- a/pkgs/development/python-modules/smart_open/default.nix
+++ b/pkgs/development/python-modules/smart_open/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, pythonOlder
 , boto
 , boto3
 , bz2file
@@ -12,11 +13,12 @@
 
 buildPythonPackage rec {
   pname = "smart_open";
-  version = "2.1.0";
+  version = "2.1.1";
+  disabled = pythonOlder "3.5";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "c8792d2e77f33b349fbaa62eb28ddc519e6b7e5d36407e9bdc00bececeaa776d";
+    sha256 = "51b05acd85ec007e1d4dcdbf2bbf917218a45026f37d559559401114bb5e5840";
   };
 
   # nixpkgs version of moto is >=1.2.0, remove version pin to fix build
diff --git a/pkgs/development/python-modules/sounddevice/default.nix b/pkgs/development/python-modules/sounddevice/default.nix
index 21dd487aafe..eb46580a7b3 100644
--- a/pkgs/development/python-modules/sounddevice/default.nix
+++ b/pkgs/development/python-modules/sounddevice/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, isPy27
 , cffi
 , numpy
 , portaudio
@@ -10,6 +11,7 @@
 buildPythonPackage rec {
   pname = "sounddevice";
   version = "0.4.0";
+  disabled = isPy27;
 
   src = fetchPypi {
     inherit pname version;
diff --git a/pkgs/development/python-modules/sphinxcontrib-openapi/default.nix b/pkgs/development/python-modules/sphinxcontrib-openapi/default.nix
index 7c5c95d6ad4..d3e9f30f50a 100644
--- a/pkgs/development/python-modules/sphinxcontrib-openapi/default.nix
+++ b/pkgs/development/python-modules/sphinxcontrib-openapi/default.nix
@@ -2,6 +2,7 @@
 , buildPythonPackage
 , fetchPypi
 , setuptools_scm
+, m2r
 , pyyaml
 , jsonschema
 , sphinxcontrib_httpdomain
@@ -16,7 +17,8 @@ buildPythonPackage rec {
     sha256 = "1c1bd10d7653912c59a42f727c62cbb7b75f7905ddd9ccc477ebfd1bc69f0cf3";
   };
 
-  propagatedBuildInputs = [setuptools_scm pyyaml jsonschema sphinxcontrib_httpdomain];
+  nativeBuildInputs = [ setuptools_scm ];
+  propagatedBuildInputs = [ pyyaml jsonschema m2r sphinxcontrib_httpdomain ];
 
   doCheck = false;
 
diff --git a/pkgs/development/python-modules/sqlalchemy/default.nix b/pkgs/development/python-modules/sqlalchemy/default.nix
index dac38c55b7d..a4cb3bd6d73 100644
--- a/pkgs/development/python-modules/sqlalchemy/default.nix
+++ b/pkgs/development/python-modules/sqlalchemy/default.nix
@@ -6,11 +6,11 @@
 
 buildPythonPackage rec {
   pname = "SQLAlchemy";
-  version = "1.3.18";
+  version = "1.3.19";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "da2fb75f64792c1fc64c82313a00c728a7c301efe6a60b7a9fe35b16b4368ce7";
+    sha256 = "3bba2e9fbedb0511769780fe1d63007081008c5c2d7d715e91858c94dbaa260e";
   };
 
   checkInputs = [
diff --git a/pkgs/development/python-modules/supervisor/default.nix b/pkgs/development/python-modules/supervisor/default.nix
index cee258dbd3a..280adcee232 100644
--- a/pkgs/development/python-modules/supervisor/default.nix
+++ b/pkgs/development/python-modules/supervisor/default.nix
@@ -7,11 +7,11 @@
 
 buildPythonPackage rec {
   pname = "supervisor";
-  version = "4.2.0";
+  version = "4.2.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "64082ebedf6d36ff409ab2878f1aad5c9035f916c5f15a9a1ec7dffc6dfbbed8";
+    sha256 = "c479c875853e9c013d1fa73e529fd2165ff1ecaecc7e82810ba57e7362ae984d";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/svglib/default.nix b/pkgs/development/python-modules/svglib/default.nix
index c986b9108b0..acd8fcb7816 100644
--- a/pkgs/development/python-modules/svglib/default.nix
+++ b/pkgs/development/python-modules/svglib/default.nix
@@ -12,11 +12,11 @@
 
 buildPythonPackage rec {
   pname = "svglib";
-  version = "1.0.0";
+  version = "1.0.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "b17d4a6352f6c25ca3718d2b66a2f1ecfcdf558b1f6646c37f5c191b655979f1";
+    sha256 = "ff01593e8c07ea462d3742e1f4141bfa261cbd4400ceb25dfb8fec3508ad0e50";
   };
 
   disabled = !isPy3k;
diff --git a/pkgs/development/python-modules/tifffile/default.nix b/pkgs/development/python-modules/tifffile/default.nix
index d1be6f80be9..77187f42b5e 100644
--- a/pkgs/development/python-modules/tifffile/default.nix
+++ b/pkgs/development/python-modules/tifffile/default.nix
@@ -13,11 +13,11 @@
 
 buildPythonPackage rec {
   pname = "tifffile";
-  version = "2020.8.13";
+  version = "2020.8.25";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "60043e50adab5a1b9f13c3fb1a23992b9af00e1ada13d7ffe48c1ad7e0062cb8";
+    sha256 = "b51e496bd9ee9c6875170a018bdb7b6f67e3946c4ab57afdb95b18b2c6937783";
   };
 
   patches = lib.optional isPy27 ./python2-regex-compat.patch;
diff --git a/pkgs/development/python-modules/timelib/default.nix b/pkgs/development/python-modules/timelib/default.nix
index 39ff4b6de15..559dd0dd92f 100644
--- a/pkgs/development/python-modules/timelib/default.nix
+++ b/pkgs/development/python-modules/timelib/default.nix
@@ -5,12 +5,12 @@
 
 buildPythonPackage rec {
   pname = "timelib";
-  version = "0.2.4";
+  version = "0.2.5";
 
   src = fetchPypi {
     inherit pname version;
     extension = "zip";
-    sha256 = "49142233bdb5971d64a41e05a1f80a408a02be0dc7d9f8c99e7bdd0613ba81cb";
+    sha256 = "6ac9f79b09b63bbc07db88525c1f62de1f6d50b0fd9937a0cb05e3d38ce0af45";
   };
 
   meta = with stdenv.lib; {
diff --git a/pkgs/development/python-modules/transip/default.nix b/pkgs/development/python-modules/transip/default.nix
index e71660d5b88..8ea70a19ead 100644
--- a/pkgs/development/python-modules/transip/default.nix
+++ b/pkgs/development/python-modules/transip/default.nix
@@ -1,6 +1,7 @@
 { stdenv
 , buildPythonPackage
 , fetchFromGitHub
+, isPy27
 , requests
 , cryptography
 , suds-jurko
@@ -10,6 +11,7 @@
 buildPythonPackage rec {
   pname = "transip-api";
   version = "2.0.0";
+  disabled = isPy27;
 
   src = fetchFromGitHub {
     owner = "benkonrath";
diff --git a/pkgs/development/python-modules/typing-extensions/default.nix b/pkgs/development/python-modules/typing-extensions/default.nix
index d6ae7cefc39..655b3384af1 100644
--- a/pkgs/development/python-modules/typing-extensions/default.nix
+++ b/pkgs/development/python-modules/typing-extensions/default.nix
@@ -4,11 +4,11 @@ let
 
 in buildPythonPackage rec {
   pname = "typing_extensions";
-  version = "3.7.4.2";
+  version = "3.7.4.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "79ee589a3caca649a9bfd2a8de4709837400dfa00b6cc81962a1e6a1815969ae";
+    sha256 = "99d4073b617d30288f569d3f13d2bd7548c3a7e4c8de87db09a9d29bb3a4a60c";
   };
 
   checkInputs = lib.optional (pythonOlder "3.5") typing;
diff --git a/pkgs/development/python-modules/unittest-xml-reporting/default.nix b/pkgs/development/python-modules/unittest-xml-reporting/default.nix
index 372cfd7ce0e..c8d1edc4210 100644
--- a/pkgs/development/python-modules/unittest-xml-reporting/default.nix
+++ b/pkgs/development/python-modules/unittest-xml-reporting/default.nix
@@ -2,7 +2,7 @@
 
 buildPythonPackage rec {
   pname = "unittest-xml-reporting";
-  version = "3.0.3";
+  version = "3.0.4";
   disabled = isPy27;
 
   propagatedBuildInputs = [six];
@@ -12,7 +12,7 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "89ad3376cc63dc0f7227c1e39d03d5f6a20807fef989c57d8c623446b5f79575";
+    sha256 = "984cebba69e889401bfe3adb9088ca376b3a1f923f0590d005126c1bffd1a695";
   };
   meta = with lib; {
     homepage = "https://github.com/xmlrunner/unittest-xml-reporting/tree/master/";
diff --git a/pkgs/development/python-modules/validators/default.nix b/pkgs/development/python-modules/validators/default.nix
index c6297fd13fe..6ec8db34068 100644
--- a/pkgs/development/python-modules/validators/default.nix
+++ b/pkgs/development/python-modules/validators/default.nix
@@ -12,6 +12,7 @@
 buildPythonPackage rec {
   pname = "validators";
   version = "0.17.1";
+  disabled = isPy27;
 
   src = fetchPypi {
     inherit pname version;
diff --git a/pkgs/development/python-modules/virtualenv/default.nix b/pkgs/development/python-modules/virtualenv/default.nix
index 7e308d86158..6a9d91d79c8 100644
--- a/pkgs/development/python-modules/virtualenv/default.nix
+++ b/pkgs/development/python-modules/virtualenv/default.nix
@@ -17,11 +17,11 @@
 
 buildPythonPackage rec {
   pname = "virtualenv";
-  version = "20.0.30";
+  version = "20.0.31";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "7b54fd606a1b85f83de49ad8d80dbec08e983a2d2f96685045b262ebc7481ee5";
+    sha256 = "43add625c53c596d38f971a465553f6318decc39d98512bc100fa1b1e839c8dc";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/xml2rfc/default.nix b/pkgs/development/python-modules/xml2rfc/default.nix
index d5795ddf969..d02b7e2e066 100644
--- a/pkgs/development/python-modules/xml2rfc/default.nix
+++ b/pkgs/development/python-modules/xml2rfc/default.nix
@@ -1,5 +1,5 @@
 { lib, fetchPypi, buildPythonPackage, intervaltree, pyflakes, requests, lxml, google-i18n-address
-, pycountry, html5lib, six, kitchen, pypdf2, dict2xml, weasyprint
+, pycountry, html5lib, six, kitchen, pypdf2, dict2xml, weasyprint, pyyaml, jinja2
 , stdenv
 }:
 
@@ -14,7 +14,9 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [
     intervaltree
+    jinja2
     pyflakes
+    pyyaml
     requests
     lxml
     google-i18n-address
diff --git a/pkgs/development/python-modules/zarr/default.nix b/pkgs/development/python-modules/zarr/default.nix
index d7d1df5993b..c51694c6306 100644
--- a/pkgs/development/python-modules/zarr/default.nix
+++ b/pkgs/development/python-modules/zarr/default.nix
@@ -1,5 +1,6 @@
 { lib
 , buildPythonPackage
+, isPy27
 , fetchPypi
 , setuptools_scm
 , asciitree
@@ -12,6 +13,7 @@
 buildPythonPackage rec {
   pname = "zarr";
   version = "2.4.0";
+  disabled = isPy27;
 
   src = fetchPypi {
     inherit pname version;
diff --git a/pkgs/development/python-modules/zeroconf/default.nix b/pkgs/development/python-modules/zeroconf/default.nix
index aa64ad4bd5e..9e8d0853ecf 100644
--- a/pkgs/development/python-modules/zeroconf/default.nix
+++ b/pkgs/development/python-modules/zeroconf/default.nix
@@ -10,12 +10,12 @@
 
 buildPythonPackage rec {
   pname = "zeroconf";
-  version = "0.28.0";
+  version = "0.28.2";
   disabled = isPy27;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "881da2ed3d7c8e0ab59fb1cc8b02b53134351941c4d8d3f3553a96700f257a03";
+    sha256 = "447d6da0b6426c0c67d5c29339e51b2d75e2c1f129605ad35a0cb84a454f09bc";
   };
 
   propagatedBuildInputs = [ ifaddr ]
diff --git a/pkgs/development/tools/build-managers/cmake/setup-hook.sh b/pkgs/development/tools/build-managers/cmake/setup-hook.sh
index 6ae560c5645..0bb695615fc 100755
--- a/pkgs/development/tools/build-managers/cmake/setup-hook.sh
+++ b/pkgs/development/tools/build-managers/cmake/setup-hook.sh
@@ -48,7 +48,7 @@ cmakeConfigurePhase() {
 
     # on macOS we want to prefer Unix-style headers to Frameworks
     # because we usually do not package the framework
-    cmakeFlags="-DCMAKE_FIND_FRAMEWORK=last $cmakeFlags"
+    cmakeFlags="-DCMAKE_FIND_FRAMEWORK=LAST $cmakeFlags"
 
     # on macOS i686 was only relevant for 10.5 or earlier.
     cmakeFlags="-DCMAKE_OSX_ARCHITECTURES=x86_64 $cmakeFlags"
diff --git a/pkgs/development/tools/misc/intltool/default.nix b/pkgs/development/tools/misc/intltool/default.nix
index 0a04e5786f5..20f880938c6 100644
--- a/pkgs/development/tools/misc/intltool/default.nix
+++ b/pkgs/development/tools/misc/intltool/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, fetchpatch, gettext, perlPackages }:
+{ stdenv, fetchurl, fetchpatch, gettext, perlPackages, buildPackages }:
 
 stdenv.mkDerivation rec {
   pname = "intltool";
@@ -19,8 +19,14 @@ stdenv.mkDerivation rec {
     sha256 = "12q2140867r5d0dysly72khi7b0mm2gd7nlm1k81iyg7fxgnyz45";
   })];
 
+  nativeBuildInputs = with perlPackages; [ perl XMLParser ];
   propagatedBuildInputs = [ gettext ] ++ (with perlPackages; [ perl XMLParser ]);
 
+  postInstall = stdenv.lib.optionalString (stdenv.hostPlatform != stdenv.buildPlatform) ''
+    for f in $out/bin/*; do
+      substituteInPlace $f --replace "${buildPackages.perl}" "${perlPackages.perl}"
+    done
+  '';
   meta = with stdenv.lib; {
     description = "Translation helper tool";
     homepage = "https://launchpad.net/intltool/";
diff --git a/pkgs/development/tools/misc/patchelf/default.nix b/pkgs/development/tools/misc/patchelf/default.nix
index 5d2309333a6..1d31709ccf0 100644
--- a/pkgs/development/tools/misc/patchelf/default.nix
+++ b/pkgs/development/tools/misc/patchelf/default.nix
@@ -6,11 +6,12 @@
 # files.
 
 stdenv.mkDerivation rec {
-  name = "patchelf-0.11";
+  pname = "patchelf";
+  version = "0.12";
 
   src = fetchurl {
-    url = "https://nixos.org/releases/patchelf/${name}/${name}.tar.bz2";
-    sha256 = "16ms3ijcihb88j3x6cl8cbvhia72afmfcphczb9cfwr0gbc22chx";
+    url = "https://github.com/NixOS/${pname}/releases/download/${version}/${pname}-${version}.tar.bz2";
+    sha256 = "14npmdxppmh0ci140w8i8cy7zg1pnqg81a1mdsnza711ab7k36k9";
   };
 
   setupHook = [ ./setup-hook.sh ];
diff --git a/pkgs/development/tools/misc/texinfo/6.5.nix b/pkgs/development/tools/misc/texinfo/6.5.nix
deleted file mode 100644
index 34596f30658..00000000000
--- a/pkgs/development/tools/misc/texinfo/6.5.nix
+++ /dev/null
@@ -1,4 +0,0 @@
-import ./common.nix {
-  version = "6.5";
-  sha256 = "0qjzvbvnv9003xdrcpi3jp7y68j4hq2ciw9frh2hghh698zlnxvp";
-}
diff --git a/pkgs/development/tools/misc/texinfo/6.7.nix b/pkgs/development/tools/misc/texinfo/6.7.nix
new file mode 100644
index 00000000000..7915d6e3c6b
--- /dev/null
+++ b/pkgs/development/tools/misc/texinfo/6.7.nix
@@ -0,0 +1,4 @@
+import ./common.nix {
+  version = "6.7";
+  sha256 = "1aicn1v3czqii08wc91jw089n1x3gfchkf808q2as59dak0h714q";
+}
diff --git a/pkgs/development/tools/misc/texinfo/common.nix b/pkgs/development/tools/misc/texinfo/common.nix
index ec51dc2259d..f0f4c269fae 100644
--- a/pkgs/development/tools/misc/texinfo/common.nix
+++ b/pkgs/development/tools/misc/texinfo/common.nix
@@ -12,7 +12,7 @@
 # files.
 
 let
-  crossBuildTools = interactive && stdenv.hostPlatform != stdenv.buildPlatform;
+  crossBuildTools = stdenv.hostPlatform != stdenv.buildPlatform;
 in
 
 with stdenv.lib;
@@ -26,8 +26,7 @@ stdenv.mkDerivation {
     inherit sha256;
   };
 
-  patches = optional (version == "6.5") ./perl.patch
-    ++ optional crossBuildTools ./cross-tools-flags.patch;
+  patches = optional crossBuildTools ./cross-tools-flags.patch;
 
   # ncurses is required to build `makedoc'
   # this feature is introduced by the ./cross-tools-flags.patch
diff --git a/pkgs/development/tools/misc/texinfo/perl.patch b/pkgs/development/tools/misc/texinfo/perl.patch
deleted file mode 100644
index e651b37371c..00000000000
--- a/pkgs/development/tools/misc/texinfo/perl.patch
+++ /dev/null
@@ -1,43 +0,0 @@
-Adapted from http://svn.savannah.gnu.org/viewvc/texinfo/
-Author: gavin
---- trunk/tp/Texinfo/Parser.pm  2018-06-04 19:51:36 UTC (rev 8006)
-+++ trunk/tp/Texinfo/Parser.pm  2018-07-13 15:31:28 UTC (rev 8007)
-@@ -5531,11 +5531,11 @@
-     }
-   } elsif ($command eq 'clickstyle') {
-     # REMACRO
--    if ($line =~ /^\s+@([[:alnum:]][[:alnum:]\-]*)({})?\s*/) {
-+    if ($line =~ /^\s+@([[:alnum:]][[:alnum:]\-]*)(\{\})?\s*/) {
-       $args = ['@'.$1];
-       $self->{'clickstyle'} = $1;
-       $remaining = $line;
--      $remaining =~ s/^\s+@([[:alnum:]][[:alnum:]\-]*)({})?\s*(\@(c|comment)((\@|\s+).*)?)?//;
-+      $remaining =~ s/^\s+@([[:alnum:]][[:alnum:]\-]*)(\{\})?\s*(\@(c|comment)((\@|\s+).*)?)?//;
-       $has_comment = 1 if (defined($4));
-     } else {
-       $self->line_error (sprintf($self->__(
---- trunk/tp/Texinfo/Convert/XSParagraph/xspara.c       2018-07-13 15:31:28 UTC (rev 8007)
-+++ trunk/tp/Texinfo/Convert/XSParagraph/xspara.c       2018-07-13 15:39:29 UTC (rev 8008)
-@@ -248,6 +248,11 @@
- 
-   dTHX;
- 
-+#if PERL_VERSION > 27 || (PERL_VERSION == 27 && PERL_SUBVERSION > 8)
-+  /* needed due to thread-safe locale handling in newer perls */
-+  switch_to_global_locale();
-+#endif
-+
-   if (setlocale (LC_CTYPE, "en_US.UTF-8")
-       || setlocale (LC_CTYPE, "en_US.utf8"))
-     goto success;
-@@ -320,6 +325,10 @@
-     {
- success: ;
-       free (utf8_locale);
-+#if PERL_VERSION > 27 || (PERL_VERSION == 27 && PERL_SUBVERSION > 8)
-+      /* needed due to thread-safe locale handling in newer perls */
-+      sync_locale();
-+#endif
-       /*
-       fprintf (stderr, "tried to set LC_CTYPE to UTF-8.\n");
-       fprintf (stderr, "character encoding is: %s\n",
diff --git a/pkgs/os-specific/linux/kmod/default.nix b/pkgs/os-specific/linux/kmod/default.nix
index f1cc4558b05..805b8a32aed 100644
--- a/pkgs/os-specific/linux/kmod/default.nix
+++ b/pkgs/os-specific/linux/kmod/default.nix
@@ -24,7 +24,7 @@ in stdenv.mkDerivation rec {
     "--with-modulesdirs=${modulesDirs}"
   ] ++ lib.optional withStatic "--enable-static";
 
-  patches = [ ./module-dir.patch ]
+  patches = [ ./module-dir.patch ./no-name-field.patch ]
     ++ lib.optional stdenv.isDarwin ./darwin.patch
     ++ lib.optional withStatic ./enable-static.patch;
 
diff --git a/pkgs/os-specific/linux/kmod/no-name-field.patch b/pkgs/os-specific/linux/kmod/no-name-field.patch
new file mode 100644
index 00000000000..282f59e55e5
--- /dev/null
+++ b/pkgs/os-specific/linux/kmod/no-name-field.patch
@@ -0,0 +1,24 @@
+
+---
+ tools/modinfo.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/tools/modinfo.c b/tools/modinfo.c
+index 0231bb0..7b2259e 100644
+--- a/tools/modinfo.c
++++ b/tools/modinfo.c
+@@ -178,7 +178,10 @@ static int modinfo_do(struct kmod_module *mod)
+ 	is_builtin = (filename == NULL);
+ 
+ 	if (is_builtin) {
+-		printf("%-16s%s%c", "name:", kmod_module_get_name(mod), separator);
++		if (field == NULL || field != NULL && streq(field, "name")){
++			printf("%-16s%s%c", "name:",
++			       kmod_module_get_name(mod), separator);
++		}
+ 		filename = "(builtin)";
+ 	}
+ 
+-- 
+2.28.0
+
diff --git a/pkgs/servers/http/unit/default.nix b/pkgs/servers/http/unit/default.nix
index 2f73a5d9243..27f45fe6e47 100644
--- a/pkgs/servers/http/unit/default.nix
+++ b/pkgs/servers/http/unit/default.nix
@@ -3,8 +3,8 @@
 , withPython3 ? true, python3, ncurses
 , withPHP73 ? false, php73
 , withPHP74 ? true, php74
-, withPerl528 ? false, perl528
-, withPerl530 ? true, perl530
+, withPerl530 ? false, perl530
+, withPerl532 ? true, perl532
 , withPerldevel ? false, perldevel
 , withRuby_2_5 ? false, ruby_2_5
 , withRuby_2_6 ? true, ruby_2_6
@@ -47,8 +47,8 @@ in stdenv.mkDerivation rec {
     ++ optionals withPython3 [ python3 ncurses ]
     ++ optional withPHP73 php73-unit
     ++ optional withPHP74 php74-unit
-    ++ optional withPerl528 perl528
     ++ optional withPerl530 perl530
+    ++ optional withPerl532 perl532
     ++ optional withPerldevel perldevel
     ++ optional withRuby_2_5 ruby_2_5
     ++ optional withRuby_2_6 ruby_2_6
@@ -73,8 +73,8 @@ in stdenv.mkDerivation rec {
     ${optionalString withPython3    "./configure python --module=python3  --config=python3-config  --lib-path=${python3}/lib"}
     ${optionalString withPHP73      "./configure php    --module=php73    --config=${php73-unit.unwrapped.dev}/bin/php-config --lib-path=${php73-unit}/lib"}
     ${optionalString withPHP74      "./configure php    --module=php74    --config=${php74-unit.unwrapped.dev}/bin/php-config --lib-path=${php74-unit}/lib"}
-    ${optionalString withPerl528    "./configure perl   --module=perl528  --perl=${perl528}/bin/perl"}
     ${optionalString withPerl530    "./configure perl   --module=perl530  --perl=${perl530}/bin/perl"}
+    ${optionalString withPerl532    "./configure perl   --module=perl532  --perl=${perl532}/bin/perl"}
     ${optionalString withPerldevel  "./configure perl   --module=perldev  --perl=${perldevel}/bin/perl"}
     ${optionalString withRuby_2_5   "./configure ruby   --module=ruby25   --ruby=${ruby_2_5}/bin/ruby"}
     ${optionalString withRuby_2_6   "./configure ruby   --module=ruby26   --ruby=${ruby_2_6}/bin/ruby"}
diff --git a/pkgs/tools/admin/awscli/default.nix b/pkgs/tools/admin/awscli/default.nix
index 991f099a1ca..4045ab110a8 100644
--- a/pkgs/tools/admin/awscli/default.nix
+++ b/pkgs/tools/admin/awscli/default.nix
@@ -19,11 +19,11 @@ let
 
 in with py.pkgs; buildPythonApplication rec {
   pname = "awscli";
-  version = "1.18.120"; # N.B: if you change this, change botocore to a matching version too
+  version = "1.18.128"; # N.B: if you change this, change botocore to a matching version too
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "3d21dcb0a17b8b623e7b7fd3528ede7d445c485fa4ca6cacfbaf4910a1d17944";
+    sha256 = "c146c1634edbedc32564c536afcaaaeedc3ecc5aa9db3cf64fe5870c1c1a2a32";
   };
 
   postPatch = ''
diff --git a/pkgs/tools/networking/unbound/default.nix b/pkgs/tools/networking/unbound/default.nix
index 4ee330eb918..9b33d53e54f 100644
--- a/pkgs/tools/networking/unbound/default.nix
+++ b/pkgs/tools/networking/unbound/default.nix
@@ -9,13 +9,6 @@ stdenv.mkDerivation rec {
     sha256 = "1xqywn2qdmjjq0csrqxh9p2rnizdrr1f99zdx87z7f3fyyc0fbwz";
   };
 
-  # https://github.com/NLnetLabs/unbound/pull/90
-  postPatch = ''
-    substituteInPlace validator/val_secalgo.c \
-      --replace '&nettle_secp_256r1' 'nettle_get_secp_256r1()' \
-      --replace '&nettle_secp_384r1' 'nettle_get_secp_384r1()'
-  '';
-
   outputs = [ "out" "lib" "man" ]; # "dev" would only split ~20 kB
 
   buildInputs = [ openssl nettle expat libevent ];
diff --git a/pkgs/tools/security/gnupg/22.nix b/pkgs/tools/security/gnupg/22.nix
index 3a99c8eb3f2..48271a2f5bc 100644
--- a/pkgs/tools/security/gnupg/22.nix
+++ b/pkgs/tools/security/gnupg/22.nix
@@ -16,11 +16,11 @@ assert guiSupport -> pinentry != null && enableMinimal == false;
 stdenv.mkDerivation rec {
   pname = "gnupg";
 
-  version = "2.2.21";
+  version = "2.2.23";
 
   src = fetchurl {
     url = "mirror://gnupg/gnupg/${pname}-${version}.tar.bz2";
-    sha256 = "1v3nirp9m7yxjkkcdixibckl379pdyr3mdx8b1k379szzdw35s31";
+    sha256 = "0p6ss4f3vlkf91pmp27bmvfr5bdxxi0pb3dmxpqljglbsx4mxd8h";
   };
 
   depsBuildBuild = [ buildPackages.stdenv.cc ];
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 9cb069ee8fa..3e5434eba13 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -11544,7 +11544,7 @@ in
   texinfo413 = callPackage ../development/tools/misc/texinfo/4.13a.nix { };
   texinfo4 = texinfo413;
   texinfo5 = callPackage ../development/tools/misc/texinfo/5.2.nix { };
-  texinfo6 = callPackage ../development/tools/misc/texinfo/6.5.nix { };
+  texinfo6 = callPackage ../development/tools/misc/texinfo/6.7.nix { };
   texinfo = texinfo6;
   texinfoInteractive = appendToName "interactive" (
     texinfo.override { interactive = true; }
@@ -16033,14 +16033,14 @@ in
   ### DEVELOPMENT / PERL MODULES
 
   perlInterpreters = callPackages ../development/interpreters/perl {};
-  inherit (perlInterpreters) perl528 perl530 perldevel;
+  inherit (perlInterpreters) perl530 perl532 perldevel;
 
-  perl528Packages = recurseIntoAttrs perl528.pkgs;
   perl530Packages = recurseIntoAttrs perl530.pkgs;
+  perl532Packages = recurseIntoAttrs perl532.pkgs;
   perldevelPackages = perldevel.pkgs;
 
-  perl = perl530;
-  perlPackages = perl530Packages;
+  perl = perl532;
+  perlPackages = perl532Packages;
 
   ack = perlPackages.ack;
 
@@ -17232,11 +17232,7 @@ in
 
   criu = callPackage ../os-specific/linux/criu { };
 
-  cryptsetup = callPackage ../os-specific/linux/cryptsetup {
-    # cryptsetup only really needs the devmapper component of cryptsetup
-    # but itself is used as a library in systemd (=udev)
-    lvm2 = lvm2.override { udev = null; };
-  };
+  cryptsetup = callPackage ../os-specific/linux/cryptsetup { };
 
   cramfsprogs = callPackage ../os-specific/linux/cramfsprogs { };
 
@@ -18018,7 +18014,12 @@ in
 
   lsscsi = callPackage ../os-specific/linux/lsscsi { };
 
-  lvm2 = callPackage ../os-specific/linux/lvm2 { };
+  lvm2 = callPackage ../os-specific/linux/lvm2 {
+    # udev is the same package as systemd which depends on cryptsetup
+    # which depends on lvm2 again.  But we only need the libudev part
+    # which does not depend on cryptsetup.
+    udev = udev.override { cryptsetup = null; };
+  };
   lvm2_dmeventd = callPackage ../os-specific/linux/lvm2 {
     enableDmeventd = true;
     enableCmdlib = true;
@@ -21275,10 +21276,36 @@ in
       recurseIntoAttrs (makeOverridable mkApplications attrs);
 
   inherit (kdeApplications)
-    akonadi akregator ark bomber bovo dolphin dragon elisa ffmpegthumbs filelight granatier gwenview k3b
-    kaddressbook kapptemplate kate kcachegrind kcalc kcharselect kcolorchooser kdenlive kdf kdialog
-    keditbookmarks kfind kfloppy kget kgpg khelpcenter kig kleopatra kmail kmix kmplot kolourpaint kompare konsole yakuake
-    kpkpass kitinerary kontact korganizer krdc krfb ksquares ksystemlog ktouch kwalletmanager marble minuet okular picmi spectacle;
+    akonadi akregator ark
+    bomber bovo
+    dolphin dragon
+    elisa
+    ffmpegthumbs filelight
+    granatier gwenview
+    k3b
+    kaddressbook kalzium kapptemplate kapman kate katomic
+    kblackbox kblocks kbounce
+    kcachegrind kcalc kcharselect kcolorchooser
+    kdenlive kdf kdialog kdiamond
+    keditbookmarks
+    kfind kfloppy
+    kget kgpg
+    khelpcenter
+    kig kigo killbots kitinerary
+    kleopatra klettres klines
+    kmag kmail kmines kmix kmplot
+    knavalbattle knetwalk knights
+    kollision kolourpaint kompare konsole kontact korganizer
+    kpkpass
+    krdc kreversi krfb
+    kshisen ksquares ksystemlog
+    kteatime ktimer ktouch kturtle
+    kwalletmanager kwave
+    marble minuet
+    okular
+    picmi
+    spectacle
+    yakuake;
 
   okteta = libsForQt5.callPackage ../applications/editors/okteta { };
 
diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index c85ca5a3c5a..d89bcdf4310 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -11,8 +11,8 @@
 , perl, overrides, buildPerl, shortenPerlShebang
 }:
 
-# cpan2nix assumes that perl-packages.nix will be used only with perl 5.28.3 or above
-assert stdenv.lib.versionAtLeast perl.version "5.28.3";
+# cpan2nix assumes that perl-packages.nix will be used only with perl 5.30.3 or above
+assert stdenv.lib.versionAtLeast perl.version "5.30.3";
 let
   inherit (stdenv.lib) maintainers;
   self = _self // (overrides pkgs);