diff --git a/nixos/modules/services/system/dbus.nix b/nixos/modules/services/system/dbus.nix
index f8d909a4a3c..d4cacb85694 100644
--- a/nixos/modules/services/system/dbus.nix
+++ b/nixos/modules/services/system/dbus.nix
@@ -11,6 +11,7 @@ let
   homeDir = "/run/dbus";
 
   configDir = pkgs.makeDBusConf {
+    inherit (cfg) apparmor;
     suidHelper = "${config.security.wrapperDir}/dbus-daemon-launch-helper";
     serviceDirectories = cfg.packages;
   };
@@ -51,6 +52,20 @@ in
         '';
       };
 
+      apparmor = mkOption {
+        type = types.enum [ "enabled" "disabled" "required" ];
+        description = ''
+          AppArmor mode for dbus.
+
+          <literal>enabled</literal> enables mediation when it's
+          supported in the kernel, <literal>disabled</literal>
+          always disables AppArmor even with kernel support, and
+          <literal>required</literal> fails when AppArmor was not found
+          in the kernel.
+        '';
+        default = "disabled";
+      };
+
       socketActivated = mkOption {
         type = types.nullOr types.bool;
         default = null;
diff --git a/pkgs/applications/misc/gammu/bashcomp-dir.patch b/pkgs/applications/misc/gammu/bashcomp-dir.patch
index d41aa432cf3..de402595cd3 100644
--- a/pkgs/applications/misc/gammu/bashcomp-dir.patch
+++ b/pkgs/applications/misc/gammu/bashcomp-dir.patch
@@ -5,7 +5,7 @@
      macro_optional_find_package (BashCompletion)
      if (NOT BASH_COMPLETION_FOUND)
 -      set (BASH_COMPLETION_COMPLETIONSDIR "/etc/bash_completion.d" CACHE PATH "Location of bash_completion.d")
-+      set (BASH_COMPLETION_COMPLETIONSDIR "${CMAKE_INSTALL_PREFIX}/etc/bash_completion.d" CACHE PATH "Location of bash_completion.d")
++      set (BASH_COMPLETION_COMPLETIONSDIR "${CMAKE_INSTALL_PREFIX}/share/bash-completion/completions" CACHE PATH "Location of bash_completion.d")
      endif (NOT BASH_COMPLETION_FOUND)
      install (
          FILES bash-completion/gammu
diff --git a/pkgs/applications/misc/moolticute/default.nix b/pkgs/applications/misc/moolticute/default.nix
index c815a74e019..bc825b94fac 100644
--- a/pkgs/applications/misc/moolticute/default.nix
+++ b/pkgs/applications/misc/moolticute/default.nix
@@ -9,13 +9,13 @@
 
 mkDerivation rec {
   pname = "moolticute";
-  version = "0.44.0";
+  version = "0.44.17";
 
   src = fetchFromGitHub {
     owner = "mooltipass";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1xlbhx6f1ysx8gka8g67271whzhkzsnkavpq3x58hdxr8v88khby";
+    sha256 = "1bqp99n8cqr7kjiffbs39v0dd280f50hid5py3c4zgc7aqj9k0bx";
   };
 
   outputs = [ "out" "udev" ];
diff --git a/pkgs/applications/misc/prevo/tools.nix b/pkgs/applications/misc/prevo/tools.nix
index 6a85e73bf85..39c54b73b2f 100644
--- a/pkgs/applications/misc/prevo/tools.nix
+++ b/pkgs/applications/misc/prevo/tools.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ glib expat ];
 
   postInstall = ''
-    installShellCompletion --bash $out/etc/bash_completion.d/prevo-completion
+    installShellCompletion --bash src/prevo-completion
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/applications/office/todo.txt-cli/default.nix b/pkgs/applications/office/todo.txt-cli/default.nix
index 489b759f48c..8db5691ed84 100644
--- a/pkgs/applications/office/todo.txt-cli/default.nix
+++ b/pkgs/applications/office/todo.txt-cli/default.nix
@@ -13,8 +13,8 @@ in stdenv.mkDerivation {
   installPhase = ''
     install -vd $out/bin
     install -vm 755 todo.sh $out/bin
-    install -vd $out/etc/bash_completion.d
-    install -vm 644 todo_completion $out/etc/bash_completion.d/todo
+    install -vd $out/share/bash-completion/completions
+    install -vm 644 todo_completion $out/share/bash-completion/completions/todo
     install -vd $out/etc/todo
     install -vm 644 todo.cfg $out/etc/todo/config
   '';
diff --git a/pkgs/applications/version-management/git-and-tools/git-bug/default.nix b/pkgs/applications/version-management/git-and-tools/git-bug/default.nix
index 44eba8c4b39..7c345639e9f 100644
--- a/pkgs/applications/version-management/git-and-tools/git-bug/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git-bug/default.nix
@@ -24,7 +24,7 @@ buildGoModule rec {
   '';
 
   postInstall = ''
-    install -D -m 0644 misc/bash_completion/git-bug "$out/etc/bash_completion.d/git-bug"
+    install -D -m 0644 misc/bash_completion/git-bug "$out/share/bash-completion/completions/git-bug"
     install -D -m 0644 misc/zsh_completion/git-bug "$out/share/zsh/site-functions/git-bug"
     install -D -m 0644 -t "$out/share/man/man1" doc/man/*
   '';
diff --git a/pkgs/applications/version-management/git-and-tools/git-stree/default.nix b/pkgs/applications/version-management/git-and-tools/git-stree/default.nix
index dc636571acc..aa53529933f 100644
--- a/pkgs/applications/version-management/git-and-tools/git-stree/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git-stree/default.nix
@@ -12,9 +12,9 @@ stdenv.mkDerivation {
   };
 
   installPhase = ''
-    mkdir -p $out/bin $out/etc/bash_completion.d
+    mkdir -p $out/bin $out/share/bash-completion/completions
     install -m 0755 git-stree $out/bin/
-    install -m 0644 git-stree-completion.bash $out/etc/bash_completion.d/
+    install -m 0644 git-stree-completion.bash $out/share/bash-completion/completions/
   '';
 
   meta = with lib; {
diff --git a/pkgs/applications/version-management/git-and-tools/git/default.nix b/pkgs/applications/version-management/git-and-tools/git/default.nix
index b6efb78513c..b7e4f3e6c48 100644
--- a/pkgs/applications/version-management/git-and-tools/git/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git/default.nix
@@ -153,8 +153,8 @@ stdenv.mkDerivation {
       cp -a contrib $out/share/git/
       mkdir -p $out/share/bash-completion/completions
       ln -s $out/share/git/contrib/completion/git-completion.bash $out/share/bash-completion/completions/git
-      mkdir -p $out/etc/bash_completion.d
-      ln -s $out/share/git/contrib/completion/git-prompt.sh $out/etc/bash_completion.d/
+      mkdir -p $out/share/bash-completion/completions
+      ln -s $out/share/git/contrib/completion/git-prompt.sh $out/share/bash-completion/completions/
 
       # grep is a runtime dependency, need to patch so that it's found
       substituteInPlace $out/libexec/git-core/git-sh-setup \
@@ -249,6 +249,7 @@ stdenv.mkDerivation {
      '')
    + stdenv.lib.optionalString stdenv.isDarwin ''
     # enable git-credential-osxkeychain by default if darwin
+    mkdir -p $out/etc
     cat > $out/etc/gitconfig << EOF
     [credential]
       helper = osxkeychain
diff --git a/pkgs/applications/version-management/git-and-tools/topgit/default.nix b/pkgs/applications/version-management/git-and-tools/topgit/default.nix
index 0da0cfa02b6..9577b56b6c7 100644
--- a/pkgs/applications/version-management/git-and-tools/topgit/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/topgit/default.nix
@@ -16,8 +16,8 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ perl git ];
 
   postInstall = ''
-    install -Dm644 README -t"$out/share/doc/${pname}-${version}/"
-    install -Dm755 contrib/tg-completion.bash -t "$out/etc/bash_completion.d/"
+    install -Dm644 README -t "$out/share/doc/${pname}-${version}/"
+    install -Dm755 contrib/tg-completion.bash -t "$out/share/bash-completion/completions/"
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/build-support/bintools-wrapper/default.nix b/pkgs/build-support/bintools-wrapper/default.nix
index 06c51303dc3..3b1b8ff570a 100644
--- a/pkgs/build-support/bintools-wrapper/default.nix
+++ b/pkgs/build-support/bintools-wrapper/default.nix
@@ -254,7 +254,7 @@ stdenv.mkDerivation {
 
     # Ensure consistent LC_VERSION_MIN_MACOSX and remove LC_UUID.
     + optionalString stdenv.targetPlatform.isMacOS ''
-      echo "-macosx_version_min 10.12 -sdk_version 10.12 -no_uuid" >> $out/nix-support/libc-ldflags-before
+      echo "-sdk_version 10.12 -no_uuid" >> $out/nix-support/libc-ldflags-before
     ''
 
     ##
diff --git a/pkgs/development/compilers/orc/default.nix b/pkgs/development/compilers/orc/default.nix
index 34e79945f61..210aa786cdd 100644
--- a/pkgs/development/compilers/orc/default.nix
+++ b/pkgs/development/compilers/orc/default.nix
@@ -1,23 +1,31 @@
-{ stdenv, fetchurl }:
-
-stdenv.mkDerivation rec {
-  name = "orc-0.4.29";
+{ stdenv, fetchurl, meson, ninja
+, gtk-doc ? null, file, docbook_xsl
+, buildDevDoc ? gtk-doc != null
+}: let
+  inherit (stdenv.lib) optional optionals;
+in stdenv.mkDerivation rec {
+  pname = "orc";
+  version = "0.4.32";
 
   src = fetchurl {
-    url = "https://gstreamer.freedesktop.org/src/orc/${name}.tar.xz";
-    sha256 = "1cisbbn69p9c8vikn0nin14q0zscby5m8cyvzxyw2pjb2kwh32ag";
+    url = "https://gstreamer.freedesktop.org/src/orc/${pname}-${version}.tar.xz";
+    sha256 = "1w0qmyj3v9sb2g7ff39pp38b9850y9hyy0bag26ifrby5f7ksvm6";
   };
 
-  outputs = [ "out" "dev" ];
+  outputs = [ "out" "dev" ]
+     ++ optional buildDevDoc "devdoc"
+  ;
   outputBin = "dev"; # compilation tools
 
-  postInstall = ''
-    sed "/^toolsdir=/ctoolsdir=$dev/bin" -i "$dev"/lib/pkgconfig/orc*.pc
-  '';
+  mesonFlags =
+    optional (!buildDevDoc) [ "-Dgtk_doc=disabled" ]
+  ;
 
-  # i686   https://gitlab.freedesktop.org/gstreamer/orc/issues/18
-  # armv7l https://gitlab.freedesktop.org/gstreamer/orc/issues/9
-  doCheck = (!stdenv.hostPlatform.isi686 && !stdenv.hostPlatform.isAarch32);
+  nativeBuildInputs = [ meson ninja ]
+    ++ optionals buildDevDoc [ gtk-doc file docbook_xsl ]
+  ;
+
+  doCheck = true;
 
   meta = with stdenv.lib; {
     description = "The Oil Runtime Compiler";
diff --git a/pkgs/development/compilers/purescript/purescript/default.nix b/pkgs/development/compilers/purescript/purescript/default.nix
index 8a7fb96723a..8dd19ecf858 100644
--- a/pkgs/development/compilers/purescript/purescript/default.nix
+++ b/pkgs/development/compilers/purescript/purescript/default.nix
@@ -47,8 +47,8 @@ in stdenv.mkDerivation rec {
     install -D -m555 -T purs $PURS
     ${patchelf libPath}
 
-    mkdir -p $out/etc/bash_completion.d/
-    $PURS --bash-completion-script $PURS > $out/etc/bash_completion.d/purs-completion.bash
+    mkdir -p $out/share/bash-completion/completions
+    $PURS --bash-completion-script $PURS > $out/share/bash-completion/completions/purs-completion.bash
   '';
 
   passthru.tests = {
diff --git a/pkgs/development/interpreters/python/mk-python-derivation.nix b/pkgs/development/interpreters/python/mk-python-derivation.nix
index c3be76790eb..c85a5939055 100644
--- a/pkgs/development/interpreters/python/mk-python-derivation.nix
+++ b/pkgs/development/interpreters/python/mk-python-derivation.nix
@@ -17,7 +17,6 @@
 , pythonCatchConflictsHook
 , pythonImportsCheckHook
 , pythonNamespacesHook
-, pythonRecompileBytecodeHook
 , pythonRemoveBinBytecodeHook
 , pythonRemoveTestsDirHook
 , setuptoolsBuildHook
@@ -113,7 +112,6 @@ let
       python
       wrapPython
       ensureNewerSourcesForZipFilesHook  # move to wheel installer (pip) or builder (setuptools, flit, ...)?
-      pythonRecompileBytecodeHook  # Remove when solved https://github.com/NixOS/nixpkgs/issues/81441
       pythonRemoveTestsDirHook
     ] ++ lib.optionals catchConflicts [
       setuptools pythonCatchConflictsHook
@@ -167,9 +165,6 @@ let
     # Python packages built through cross-compilation are always for the host platform.
     disallowedReferences = lib.optionals (python.stdenv.hostPlatform != python.stdenv.buildPlatform) [ python.pythonForBuild ];
 
-    # For now, revert recompilation of bytecode.
-    dontUsePythonRecompileBytecode = true;
-
     meta = {
       # default to python's platforms
       platforms = python.meta.platforms;
diff --git a/pkgs/development/interpreters/ruby/default.nix b/pkgs/development/interpreters/ruby/default.nix
index cfd5c7e5180..87aa5aca1e1 100644
--- a/pkgs/development/interpreters/ruby/default.nix
+++ b/pkgs/development/interpreters/ruby/default.nix
@@ -140,10 +140,6 @@ let
             "--with-out-ext=tk"
             # on yosemite, "generating encdb.h" will hang for a very long time without this flag
             "--with-setjmp-type=setjmp"
-            # silence linker warnings after upgrading darwin.cctools to 949.0.1,
-            # which ruby treats as problem with LDFLAGS
-            # https://github.com/NixOS/nixpkgs/issues/101330
-            "LDFLAGS=-Wl,-w"
           ]
           ++ op (stdenv.hostPlatform != stdenv.buildPlatform)
              "--with-baseruby=${buildRuby}";
@@ -210,6 +206,8 @@ let
           sed -i "s|'--with-baseruby=${baseruby}/bin/ruby'||" $rbConfig
         '';
 
+        disallowedRequisites = op (!jitSupport) stdenv.cc.cc;
+
         meta = with stdenv.lib; {
           description = "The Ruby language";
           homepage    = "http://www.ruby-lang.org/en/";
diff --git a/pkgs/development/libraries/audiofile/default.nix b/pkgs/development/libraries/audiofile/default.nix
index 46c29e2fa12..9f945b15dec 100644
--- a/pkgs/development/libraries/audiofile/default.nix
+++ b/pkgs/development/libraries/audiofile/default.nix
@@ -28,6 +28,21 @@ stdenv.mkDerivation rec {
   # fix build with gcc9
   NIX_CFLAGS_LINK = lib.optional (stdenv.system == "i686-linux") "-lgcc";
 
+  # Even when statically linking, libstdc++.la is put in dependency_libs here,
+  # and hence libstdc++.so passed to the linker, just pass -lstdc++ and let the
+  # compiler do what it does best.  (libaudiofile.la is a generated file, so we
+  # have to run `make` that far first).
+  #
+  # Without this, the executables in this package (sfcommands and examples)
+  # fail to build: https://github.com/NixOS/nixpkgs/issues/103215
+  #
+  # There might be a more sensible way to do this with autotools, but I am not
+  # smart enough to discover it.
+  preBuild = lib.optionalString stdenv.targetPlatform.isStatic ''
+    make -C libaudiofile $makeFlags
+    sed -i "s/dependency_libs=.*/dependency_libs=' -lstdc++'/" libaudiofile/libaudiofile.la
+  '';
+
   patches = [
     ./gcc-6.patch
     ./CVE-2015-7747.patch
diff --git a/pkgs/development/libraries/dbus/default.nix b/pkgs/development/libraries/dbus/default.nix
index b3723f1b4d2..4480d197fa7 100644
--- a/pkgs/development/libraries/dbus/default.nix
+++ b/pkgs/development/libraries/dbus/default.nix
@@ -5,6 +5,8 @@
 , expat
 , enableSystemd ? stdenv.isLinux && !stdenv.hostPlatform.isMusl
 , systemd
+, audit
+, libapparmor
 , libX11 ? null
 , libICE ? null
 , libSM ? null
@@ -70,7 +72,8 @@ stdenv.mkDerivation rec {
       libX11
       libICE
       libSM
-    ] ++ lib.optional enableSystemd systemd;
+    ] ++ lib.optional enableSystemd systemd
+    ++ lib.optionals (!stdenv.isDarwin) [ audit libapparmor ];
   # ToDo: optional selinux?
 
   configureFlags = [
@@ -86,7 +89,8 @@ stdenv.mkDerivation rec {
     "--with-system-socket=/run/dbus/system_bus_socket"
     "--with-systemdsystemunitdir=${placeholder ''out''}/etc/systemd/system"
     "--with-systemduserunitdir=${placeholder ''out''}/etc/systemd/user"
-  ] ++ lib.optional (!x11Support) "--without-x";
+  ] ++ lib.optional (!x11Support) "--without-x"
+  ++ lib.optionals (!stdenv.isDarwin) [ "--enable-apparmor" "--enable-libaudit" ];
 
   # Enable X11 autolaunch support in libdbus. This doesn't actually depend on X11
   # (it just execs dbus-launch in dbus.tools), contrary to what the configure script demands.
diff --git a/pkgs/development/libraries/dbus/make-dbus-conf.nix b/pkgs/development/libraries/dbus/make-dbus-conf.nix
index e714b96b7e9..ce5c0b3b577 100644
--- a/pkgs/development/libraries/dbus/make-dbus-conf.nix
+++ b/pkgs/development/libraries/dbus/make-dbus-conf.nix
@@ -1,6 +1,7 @@
 { runCommand, writeText, libxslt, dbus
 , serviceDirectories ? []
 , suidHelper ? "/var/setuid-wrappers/dbus-daemon-launch-helper"
+, apparmor ? "disabled" # one of enabled, disabled, required
 }:
 
 /* DBus has two configuration parsers -- normal and "trivial", which is used
@@ -10,7 +11,7 @@
  */
 runCommand "dbus-1"
   {
-    inherit serviceDirectories suidHelper;
+    inherit serviceDirectories suidHelper apparmor;
     preferLocalBuild = true;
     allowSubstitutes = false;
     XML_CATALOG_FILES = writeText "dbus-catalog.xml" ''
@@ -33,10 +34,12 @@ runCommand "dbus-1"
     xsltproc --nonet \
       --stringparam serviceDirectories "$serviceDirectories" \
       --stringparam suidHelper "$suidHelper" \
+      --stringparam apparmor "$apparmor" \
       ${./make-system-conf.xsl} ${dbus}/share/dbus-1/system.conf \
       > $out/system.conf
     xsltproc --nonet \
       --stringparam serviceDirectories "$serviceDirectories" \
+      --stringparam apparmor "$apparmor" \
       ${./make-session-conf.xsl} ${dbus}/share/dbus-1/session.conf \
       > $out/session.conf
   ''
diff --git a/pkgs/development/libraries/dbus/make-session-conf.xsl b/pkgs/development/libraries/dbus/make-session-conf.xsl
index 6a19ee14a22..a744905cdd3 100644
--- a/pkgs/development/libraries/dbus/make-session-conf.xsl
+++ b/pkgs/development/libraries/dbus/make-session-conf.xsl
@@ -15,12 +15,16 @@
   <xsl:output method='xml' encoding="UTF-8" doctype-system="busconfig.dtd" />
 
   <xsl:param name="serviceDirectories" />
+  <xsl:param name="apparmor" />
 
   <xsl:template match="/busconfig">
     <busconfig>
       <!-- We leave <standard_session_servicedirs/> because it includes XDG dirs and therefore user Nix profile. -->
       <xsl:copy-of select="child::node()[name() != 'include' and name() != 'servicedir' and name() != 'includedir']" />
 
+      <!-- configure AppArmor -->
+      <apparmor mode="{$apparmor}"/>
+
       <xsl:for-each select="str:tokenize($serviceDirectories)">
         <servicedir><xsl:value-of select="." />/share/dbus-1/services</servicedir>
         <includedir><xsl:value-of select="." />/etc/dbus-1/session.d</includedir>
diff --git a/pkgs/development/libraries/dbus/make-system-conf.xsl b/pkgs/development/libraries/dbus/make-system-conf.xsl
index dd644b4bce7..06233e764e1 100644
--- a/pkgs/development/libraries/dbus/make-system-conf.xsl
+++ b/pkgs/development/libraries/dbus/make-system-conf.xsl
@@ -16,11 +16,15 @@
 
   <xsl:param name="serviceDirectories" />
   <xsl:param name="suidHelper" />
+  <xsl:param name="apparmor" />
 
   <xsl:template match="/busconfig">
     <busconfig>
       <xsl:copy-of select="child::node()[name() != 'include' and name() != 'standard_system_servicedirs' and name() != 'servicehelper' and name() != 'servicedir' and name() != 'includedir']" />
 
+      <!-- configure AppArmor -->
+      <apparmor mode="{$apparmor}"/>
+
       <!-- set suid helper -->
       <servicehelper><xsl:value-of select="$suidHelper" /></servicehelper>
 
diff --git a/pkgs/development/libraries/faad2/default.nix b/pkgs/development/libraries/faad2/default.nix
index 6842f191abe..90b1a182e55 100644
--- a/pkgs/development/libraries/faad2/default.nix
+++ b/pkgs/development/libraries/faad2/default.nix
@@ -5,13 +5,13 @@
 with stdenv.lib;
 stdenv.mkDerivation rec {
   pname = "faad2";
-  version = "2.9.2";
+  version = "2.10.0";
 
   src = fetchFromGitHub {
     owner = "knik0";
     repo = "faad2";
     rev = builtins.replaceStrings [ "." ] [ "_" ] version;
-    sha256 = "0rdi6bmyryhkwf4mpprrsp78m6lv1nppav2f0lf1ywifm92ng59c";
+    sha256 = "0q52kdd95ls6ihzyspx176wg9x22425v5qsknrmrjq30q25qmmlg";
   };
 
   configureFlags = []
diff --git a/pkgs/development/libraries/fontconfig/default.nix b/pkgs/development/libraries/fontconfig/default.nix
index 72df121200e..e08149903a2 100644
--- a/pkgs/development/libraries/fontconfig/default.nix
+++ b/pkgs/development/libraries/fontconfig/default.nix
@@ -83,7 +83,6 @@ stdenv.mkDerivation rec {
     "--sysconfdir=/etc"
     "--with-arch=${stdenv.hostPlatform.parsed.cpu.name}"
     "--with-cache-dir=/var/cache/fontconfig" # otherwise the fallback is in $out/
-    "--disable-docs"
     # just <1MB; this is what you get when loading config fails for some reason
     "--with-default-fonts=${dejavu_fonts.minimal}"
   ] ++ stdenv.lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
@@ -108,6 +107,9 @@ stdenv.mkDerivation rec {
       ${./make-fonts-conf.xsl} $out/etc/fonts/fonts.conf \
       > fonts.conf.tmp
     mv fonts.conf.tmp $out/etc/fonts/fonts.conf
+    # We don't keep section 3 of the manpages, as they are quite large and
+    # probably not so useful.
+    rm -r $bin/share/man/man3
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/development/libraries/fribidi/default.nix b/pkgs/development/libraries/fribidi/default.nix
index 35ae4c8e6ca..0022cbde7c5 100644
--- a/pkgs/development/libraries/fribidi/default.nix
+++ b/pkgs/development/libraries/fribidi/default.nix
@@ -1,6 +1,5 @@
 { stdenv
 , fetchurl
-, fetchpatch
 , meson
 , ninja
 , pkgconfig
@@ -10,24 +9,16 @@
 
 stdenv.mkDerivation rec {
   pname = "fribidi";
-  version = "1.0.7";
+  version = "1.0.10";
 
   outputs = [ "out" "devdoc" ];
 
   # NOTE: Only URL tarball has "Have pre-generated man pages: true", which works-around upstream usage of some rare ancient `c2man` fossil application.
   src = fetchurl {
-    url = "https://github.com/fribidi/fribidi/releases/download/v${version}/${pname}-${version}.tar.bz2";
-    sha256 = "0pckda4fcn0aw32lpycwdp25r2m7vca8zspq815ppi9gkwgg5das";
+    url = "https://github.com/fribidi/fribidi/releases/download/v${version}/${pname}-${version}.tar.xz";
+    sha256 = "009wcpgk4jj5x52skjkfs6xar6x38mcngs75rb59nj9ig1y6h73z";
   };
 
-  patches = [
-    (fetchpatch {
-      name = "CVE-2019-18397.patch";
-      url = "https://github.com/fribidi/fribidi/commit/034c6e9a1d296286305f4cfd1e0072b879f52568.patch";
-      sha256 = "102xrbf1l5gvavkxd6csx8pj3rlgcw10c0y4h4d40yhn84b1p0y8";
-    })
-  ];
-
   postPatch = ''
     patchShebangs test
   '';
diff --git a/pkgs/development/libraries/gdbm/0001-Remove-duplicate-assignments.patch b/pkgs/development/libraries/gdbm/0001-Remove-duplicate-assignments.patch
new file mode 100644
index 00000000000..7583deb8109
--- /dev/null
+++ b/pkgs/development/libraries/gdbm/0001-Remove-duplicate-assignments.patch
@@ -0,0 +1,25 @@
+From 2c31a95d9e57a4308c5159c50e69b5c9178dee72 Mon Sep 17 00:00:00 2001
+From: Christian Kampka <christian@kampka.net>
+Date: Fri, 13 Nov 2020 16:52:12 +0100
+Subject: [PATCH] Remove duplicate assignments
+
+---
+ src/parseopt.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/src/parseopt.c b/src/parseopt.c
+index 268e080..a4c8576 100644
+--- a/src/parseopt.c
++++ b/src/parseopt.c
+@@ -255,8 +255,6 @@ print_option_descr (const char *descr, size_t lmargin, size_t rmargin)
+ }
+ 
+ char *parseopt_program_name;
+-char *parseopt_program_doc;
+-char *parseopt_program_args;
+ const char *program_bug_address = "<" PACKAGE_BUGREPORT ">";
+ void (*parseopt_help_hook) (FILE *stream);
+ 
+-- 
+2.25.4
+
diff --git a/pkgs/development/libraries/gdbm/default.nix b/pkgs/development/libraries/gdbm/default.nix
index 6cee01e799e..3d333e503b2 100644
--- a/pkgs/development/libraries/gdbm/default.nix
+++ b/pkgs/development/libraries/gdbm/default.nix
@@ -11,6 +11,8 @@ stdenv.mkDerivation rec {
 
   doCheck = true; # not cross;
 
+  patches = [ ./0001-Remove-duplicate-assignments.patch ];
+
   # Linking static stubs on cygwin requires correct ordering.
   # Consider upstreaming this.
 
diff --git a/pkgs/development/libraries/gpgme/default.nix b/pkgs/development/libraries/gpgme/default.nix
index ed07d8ba058..067d62a11a2 100644
--- a/pkgs/development/libraries/gpgme/default.nix
+++ b/pkgs/development/libraries/gpgme/default.nix
@@ -14,11 +14,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "gpgme";
-  version = "1.14.0";
+  version = "1.15.0";
 
   src = fetchurl {
     url = "mirror://gnupg/gpgme/${pname}-${version}.tar.bz2";
-    sha256 = "01s3rlspykbm9vmi5rfbdm3d20ip6yni69r48idqzlmhlq8ggwff";
+    sha256 = "0nqfipv5s4npfidsm1rs3kpq0r0av9bfqfd5r035jibx5k0jniqb";
   };
 
   patches = [
diff --git a/pkgs/development/libraries/libevdev/default.nix b/pkgs/development/libraries/libevdev/default.nix
index fdd5e20640a..ba846ed07db 100644
--- a/pkgs/development/libraries/libevdev/default.nix
+++ b/pkgs/development/libraries/libevdev/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libevdev";
-  version = "1.9.1";
+  version = "1.10.0";
 
   src = fetchurl {
     url = "https://www.freedesktop.org/software/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "1jvsphdrs1i54ccjcn6ll26jy42am7h28lbsvwa6pmxgqm43qq7m";
+    sha256 = "0jidjv78lay8kl3yigwhx9fii908sk7gn9nfd2ny12ql5ipc48im";
   };
 
   nativeBuildInputs = [ python3 ];
diff --git a/pkgs/development/libraries/libinput/default.nix b/pkgs/development/libraries/libinput/default.nix
index 3a651087510..18a5dcbab65 100644
--- a/pkgs/development/libraries/libinput/default.nix
+++ b/pkgs/development/libraries/libinput/default.nix
@@ -27,14 +27,14 @@ in
 with stdenv.lib;
 stdenv.mkDerivation rec {
   pname = "libinput";
-  version = "1.16.2";
+  version = "1.16.3";
 
   src = fetchFromGitLab {
     domain = "gitlab.freedesktop.org";
     owner = pname;
     repo = pname;
     rev = version;
-    sha256 = "0qii6yh3dlhgv9z970cpzbz19ii8zjvq4k7pg75sy2gmia7smwd1";
+    sha256 = "0dj2m92kh3xpnjmzp416c73hpw6ban0f6yj39chwxckdgyliak6z";
   };
 
   outputs = [ "bin" "out" "dev" ];
diff --git a/pkgs/development/libraries/libpaper/default.nix b/pkgs/development/libraries/libpaper/default.nix
index 28c6030a0ff..d7863e29d58 100644
--- a/pkgs/development/libraries/libpaper/default.nix
+++ b/pkgs/development/libraries/libpaper/default.nix
@@ -1,14 +1,16 @@
-{ stdenv, fetchurl }:
+{ stdenv, fetchurl, autoreconfHook }:
 
 stdenv.mkDerivation rec {
-  version = "1.1.24";
+  version = "1.1.28";
   pname = "libpaper";
 
   src = fetchurl {
     url = "mirror://debian/pool/main/libp/libpaper/libpaper_${version}.tar.gz";
-    sha256 = "0zhcx67afb6b5r936w5jmaydj3ks8zh83n9rm5sv3m3k8q8jib1q";
+    sha256 = "sha256-yLuUbsk9PCxyu7HXJX6QFyoipEoHoH+2uAKluyyV/dw=";
   };
 
+  nativeBuildInputs = [ autoreconfHook ];
+
   # The configure script of libpaper is buggy: it uses AC_SUBST on a headerfile
   # to compile sysconfdir into the library. Autoconf however defines sysconfdir
   # as "${prefix}/etc", which is not expanded by AC_SUBST so libpaper will look
diff --git a/pkgs/development/libraries/libsndfile/default.nix b/pkgs/development/libraries/libsndfile/default.nix
index 7b20120290d..739bc7d7332 100644
--- a/pkgs/development/libraries/libsndfile/default.nix
+++ b/pkgs/development/libraries/libsndfile/default.nix
@@ -1,50 +1,20 @@
-{ stdenv, fetchurl, flac, libogg, libvorbis, pkgconfig
+{ stdenv, fetchFromGitHub, autoreconfHook, autogen, flac, libogg, libopus, libvorbis, pkgconfig, python3
 , Carbon, AudioToolbox
 }:
 
 stdenv.mkDerivation rec {
-  name = "libsndfile-1.0.28";
+  pname = "libsndfile";
+  version = "1.0.30";
 
-  src = fetchurl {
-    url = "http://www.mega-nerd.com/libsndfile/files/${name}.tar.gz";
-    sha256 = "1afzm7jx34jhqn32clc5xghyjglccam2728yxlx37yj2y0lkkwqz";
+  src = fetchFromGitHub {
+    owner = pname;
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "1rh79y4s4m2wcm2kahmzs2kijpdpayif2gyca6m71f3k7jbhgcwa";
   };
 
-  patches = [
-    (fetchurl {
-      name = "CVE-2017-12562.patch";
-      url = "https://github.com/erikd/libsndfile/commit/cf7a8182c2642c50f1cf90dddea9ce96a8bad2e8.patch";
-      sha256 = "1jg3wq30wdn9nv52mcyv6jyi4d80h4r1h9p96czcria7l91yh4sy";
-    })
-    (fetchurl {
-      name = "CVE-2017-6892.patch";
-      url = "https://github.com/erikd/libsndfile/commit/f833c53cb596e9e1792949f762e0b33661822748.patch";
-      sha256 = "05xkmz2ihc1zcj73sbmj1ikrv9qlcym2bkp1v6ak7w53ky619mwq";
-    })
-    (fetchurl {
-      name = "CVE-2017-8361+CVE-2017-8363+CVE-2017-8365.patch";
-      url = "https://github.com/erikd/libsndfile/commit/fd0484aba8e51d16af1e3a880f9b8b857b385eb3.patch";
-      sha256 = "0ccndnvjzx5fw18zvy03vnb29rr81h5vsh1m16msqbxk8ibndln2";
-    })
-    (fetchurl {
-      name = "CVE-2017-8362.patch";
-      url = "https://github.com/erikd/libsndfile/commit/ef1dbb2df1c0e741486646de40bd638a9c4cd808.patch";
-      sha256 = "1xyv30ga71cpy4wx5f76sc4dma91la2lcc6s9f3pk9rndyi7gj9x";
-    })
-    (fetchurl {
-      name = "CVE-2017-14634.patch";
-      url = "https://github.com/erikd/libsndfile/commit/85c877d5072866aadbe8ed0c3e0590fbb5e16788.patch";
-      sha256 = "0kc7vp22qsxidhvmlc6nfamw7k92n0hcfpmwhb3gaksjamwhb2df";
-    })
-    (fetchurl {
-      name = "CVE-2018-13139.patch";
-      url = "https://github.com/erikd/libsndfile/commit/aaea680337267bfb6d2544da878890ee7f1c5077.patch";
-      sha256 = "01q3m7pa3xqkh05ijmfgv064v8flkg4p24bgy9wxnc6wfcdifggx";
-    })
-  ];
-
-  nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [ flac libogg libvorbis ]
+  nativeBuildInputs = [ autoreconfHook autogen pkgconfig python3 ];
+  buildInputs = [ flac libogg libopus libvorbis ]
     ++ stdenv.lib.optionals stdenv.isDarwin [ Carbon AudioToolbox ];
 
   enableParallelBuilding = true;
@@ -63,7 +33,7 @@ stdenv.mkDerivation rec {
 
   meta = with stdenv.lib; {
     description = "A C library for reading and writing files containing sampled sound";
-    homepage    = "http://www.mega-nerd.com/libsndfile/";
+    homepage    = "https://libsndfile.github.io/libsndfile/";
     license     = licenses.lgpl2Plus;
     maintainers = with maintainers; [ lovek323 ];
     platforms   = platforms.unix;
diff --git a/pkgs/development/libraries/libwacom/default.nix b/pkgs/development/libraries/libwacom/default.nix
index 7c71dc4388b..6ae116356f8 100644
--- a/pkgs/development/libraries/libwacom/default.nix
+++ b/pkgs/development/libraries/libwacom/default.nix
@@ -2,7 +2,7 @@
 
 stdenv.mkDerivation rec {
   pname = "libwacom";
-  version = "1.5";
+  version = "1.6";
 
   outputs = [ "out" "dev" ];
 
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
     owner = "linuxwacom";
     repo = "libwacom";
     rev = "libwacom-${version}";
-    sha256 = "1a3qkzpkag1vqd2xl7b7f2b8kbg1y1g6gg5ydzb1ppyqw3zdjf9x";
+    sha256 = "10wphlk5v591mlvcyr6bjqp60zmhbpqg3lmsq9dza738v97ws8ci";
   };
 
   nativeBuildInputs = [ pkgconfig meson ninja doxygen ];
diff --git a/pkgs/development/libraries/openldap/default.nix b/pkgs/development/libraries/openldap/default.nix
index 1304799f56c..fdf3298a6fa 100644
--- a/pkgs/development/libraries/openldap/default.nix
+++ b/pkgs/development/libraries/openldap/default.nix
@@ -1,23 +1,14 @@
 { stdenv, fetchurl, openssl, cyrus_sasl, db, groff, libtool }:
 
 stdenv.mkDerivation rec {
-  name = "openldap-2.4.51";
+  pname = "openldap";
+  version = "2.4.56";
 
   src = fetchurl {
-    url = "https://www.openldap.org/software/download/OpenLDAP/openldap-release/${name}.tgz";
-    sha256 = "0qmy2jkk6v9iqwrsdsn8s7lwzaplr01a2mgf21r6nl66lig7g47l";
+    url = "https://www.openldap.org/software/download/OpenLDAP/openldap-release/${pname}-${version}.tgz";
+    sha256 = "1q0m26kbab96r73y0dll0c36411kvfillal0i75kngy9cc1hwli5";
   };
 
-  patches = [
-    (fetchurl {
-      # Fix a null-ptr dereference for unauthenticated packet in slapd
-      # NO CVE yet
-      # https://bugs.openldap.org/show_bug.cgi?id=9370
-      url = "https://git.openldap.org/openldap/openldap/-/commit/4c774220a752bf8e3284984890dc0931fe73165d.patch";
-      sha256 = "1vkbb6szscnhch5zzf6iq104l3dkwd50rih8jk9y0s2vgyz76mil";
-    })
-  ];
-
   # TODO: separate "out" and "bin"
   outputs = [ "out" "dev" "man" "devdoc" ];
 
diff --git a/pkgs/development/libraries/polkit/default.nix b/pkgs/development/libraries/polkit/default.nix
index 43dc2550b12..6aea7053014 100644
--- a/pkgs/development/libraries/polkit/default.nix
+++ b/pkgs/development/libraries/polkit/default.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchurl, pkgconfig, glib, expat, pam, perl, fetchpatch
-, intltool, spidermonkey_60 , gobject-introspection, libxslt, docbook_xsl, dbus
+, intltool, spidermonkey_78, gobject-introspection, libxslt, docbook_xsl, dbus
 , docbook_xml_dtd_412, gtk-doc, coreutils
 , useSystemd ? (stdenv.isLinux && !stdenv.hostPlatform.isMusl), systemd, elogind
 , withIntrospection ? true
@@ -19,11 +19,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "polkit";
-  version = "0.116";
+  version = "0.118";
 
   src = fetchurl {
     url = "https://www.freedesktop.org/software/${pname}/releases/${pname}-${version}.tar.gz";
-    sha256 = "1c9lbpndh5zis22f154vjrhnqw65z8s85nrgl42v738yf6g0q5w8";
+    sha256 = "0swmg37jsxsxfsd2b3qm0l3zxr9ldvhpjw8lsgq3j8q7wy2fjm3d";
   };
 
   patches = [
@@ -54,7 +54,7 @@ stdenv.mkDerivation rec {
     [ glib gtk-doc pkgconfig intltool perl ]
     ++ [ libxslt docbook_xsl docbook_xml_dtd_412 ]; # man pages
   buildInputs =
-    [ expat pam spidermonkey_60 ]
+    [ expat pam spidermonkey_78 ]
     # On Linux, fall back to elogind when systemd support is off.
     ++ stdenv.lib.optional stdenv.isLinux (if useSystemd then systemd else elogind)
     ++ stdenv.lib.optional withIntrospection gobject-introspection;
@@ -102,6 +102,10 @@ stdenv.mkDerivation rec {
   inherit doCheck;
   checkInputs = [ dbus ];
   checkPhase = ''
+    # unfortunately this test needs python-dbusmock, but python-dbusmock needs polkit,
+    # leading to a circular dependency
+    substituteInPlace test/Makefile --replace polkitbackend ""
+
     # tests need access to the system bus
     dbus-run-session --config-file=${./system_bus.conf} -- sh -c 'DBUS_SYSTEM_BUS_ADDRESS=$DBUS_SESSION_BUS_ADDRESS make check'
   '';
diff --git a/pkgs/development/libraries/protobuf/3.13.nix b/pkgs/development/libraries/protobuf/3.13.nix
index 3e3740a7c50..8499ac069e8 100644
--- a/pkgs/development/libraries/protobuf/3.13.nix
+++ b/pkgs/development/libraries/protobuf/3.13.nix
@@ -1,6 +1,6 @@
 { callPackage, ... }:
 
 callPackage ./generic-v3.nix {
-  version = "3.13.0";
-  sha256 = "1nqsvi2yfr93kiwlinz8z7c68ilg1j75b2vcpzxzvripxx5h6xhd";
+  version = "3.13.0.1";
+  sha256 = "1r3hvbvjjww6pdk0mlg1lym7avxn8851xm8dg98bf4zq4vyrcw12";
 }
diff --git a/pkgs/development/libraries/protobuf/3.14.nix b/pkgs/development/libraries/protobuf/3.14.nix
new file mode 100644
index 00000000000..82896b0dade
--- /dev/null
+++ b/pkgs/development/libraries/protobuf/3.14.nix
@@ -0,0 +1,6 @@
+{ callPackage, ... }:
+
+callPackage ./generic-v3.nix {
+  version = "3.14.0";
+  sha256 = "1k4kkb78kdbz732wsph07v3zy3cz7l1msk2byrfvp0nb02sfl3a4";
+}
diff --git a/pkgs/development/ocaml-modules/qtest/default.nix b/pkgs/development/ocaml-modules/qtest/default.nix
index 3bbb542bcba..e7f00803a19 100644
--- a/pkgs/development/ocaml-modules/qtest/default.nix
+++ b/pkgs/development/ocaml-modules/qtest/default.nix
@@ -2,13 +2,13 @@
 
 buildDunePackage rec {
   pname = "qtest";
-  version = "2.11";
+  version = "2.11.1";
 
   src = fetchFromGitHub {
     owner = "vincent-hugot";
     repo = pname;
     rev = "v${version}";
-    sha256 = "10fi2093ny8pp3jsi1gdqsllp3lr4r5mfcs2hrm7qvbnhrdbb0g3";
+    sha256 = "01aaqnblpkrkv1b2iy5cwn92vxdj4yjiav9s2nvvrqz5m8b9hi1f";
   };
 
   propagatedBuildInputs = [ qcheck ];
diff --git a/pkgs/development/python-modules/3to2/default.nix b/pkgs/development/python-modules/3to2/default.nix
index 8870388c284..ff64a6d1a47 100644
--- a/pkgs/development/python-modules/3to2/default.nix
+++ b/pkgs/development/python-modules/3to2/default.nix
@@ -24,8 +24,6 @@ buildPythonPackage rec {
   # Test failing due to upstream issue (https://bitbucket.org/amentajo/lib3to2/issues/50/testsuite-fails-with-new-python-35)
   doCheck = false;
 
-  dontUsePythonRecompileBytecode = true;
-
   meta = {
     homepage = "https://bitbucket.org/amentajo/lib3to2";
     description = "Refactors valid 3.x syntax into valid 2.x syntax, if a syntactical conversion is possible";
diff --git a/pkgs/development/python-modules/invoke/default.nix b/pkgs/development/python-modules/invoke/default.nix
index 7189727cf3a..45f3ee7a04d 100644
--- a/pkgs/development/python-modules/invoke/default.nix
+++ b/pkgs/development/python-modules/invoke/default.nix
@@ -20,9 +20,6 @@ buildPythonPackage rec {
   # errors with vendored libs
   doCheck = false;
 
-  # has vendored python2 code
-  dontUsePythonRecompileBytecode = true;
-
   meta = {
     description = "Pythonic task execution";
     license = lib.licenses.bsd2;
diff --git a/pkgs/development/python-modules/linecache2/default.nix b/pkgs/development/python-modules/linecache2/default.nix
index a2c7080e270..ba2525155d3 100644
--- a/pkgs/development/python-modules/linecache2/default.nix
+++ b/pkgs/development/python-modules/linecache2/default.nix
@@ -5,7 +5,7 @@
 , isPy3k
 }:
 
-buildPythonPackage (rec {
+buildPythonPackage rec {
   pname = "linecache2";
   version = "1.0.0";
 
@@ -23,8 +23,4 @@ buildPythonPackage (rec {
     homepage = "https://github.com/testing-cabal/linecache2";
     license = licenses.psfl;
   };
-# TODO: move into main set, this was to avoid a rebuild
-} // stdenv.lib.optionalAttrs (!isPy3k ) {
-  # syntax error in tests. Tests are likely Python 3 only.
-  dontUsePythonRecompileBytecode = !isPy3k;
-})
+}
diff --git a/pkgs/development/python-modules/numpy/1.16.nix b/pkgs/development/python-modules/numpy/1.16.nix
index ab4991cad14..1ab958a15f0 100644
--- a/pkgs/development/python-modules/numpy/1.16.nix
+++ b/pkgs/development/python-modules/numpy/1.16.nix
@@ -60,6 +60,7 @@ in buildPythonPackage rec {
   preConfigure = ''
     sed -i 's/-faltivec//' numpy/distutils/system_info.py
     export NPY_NUM_BUILD_JOBS=$NIX_BUILD_CORES
+    export OMP_NUM_THREADS=$((NIX_BUILD_CORES > 64 ? 64 : NIX_BUILD_CORES))
   '';
 
   preBuild = ''
diff --git a/pkgs/development/python-modules/numpy/default.nix b/pkgs/development/python-modules/numpy/default.nix
index b8faccb155b..622f784fb8b 100644
--- a/pkgs/development/python-modules/numpy/default.nix
+++ b/pkgs/development/python-modules/numpy/default.nix
@@ -58,9 +58,13 @@ in buildPythonPackage rec {
     ./numpy-distutils-C++.patch
   ];
 
+  # we default openblas to build with 64 threads
+  # if a machine has more than 64 threads, it will segfault
+  # see https://github.com/xianyi/OpenBLAS/issues/2993
   preConfigure = ''
     sed -i 's/-faltivec//' numpy/distutils/system_info.py
     export NPY_NUM_BUILD_JOBS=$NIX_BUILD_CORES
+    export OMP_NUM_THREADS=$((NIX_BUILD_CORES > 64 ? 64 : NIX_BUILD_CORES))
   '';
 
   preBuild = ''
diff --git a/pkgs/development/python-modules/pexpect/default.nix b/pkgs/development/python-modules/pexpect/default.nix
index aead62913c7..60655708bea 100644
--- a/pkgs/development/python-modules/pexpect/default.nix
+++ b/pkgs/development/python-modules/pexpect/default.nix
@@ -41,8 +41,4 @@ buildPythonPackage (rec {
       any platform that supports the standard Python pty module.
     '';
   };
-# TODO: move into main set, this was to avoid a rebuild
-} // lib.optionalAttrs (!isPy3k ) {
-  # syntax error in _async module, likely intended only for Python 3.
-  dontUsePythonRecompileBytecode = !isPy3k;
 })
diff --git a/pkgs/development/python-modules/requests/default.nix b/pkgs/development/python-modules/requests/default.nix
index 9ed590ba19b..47431274b2c 100644
--- a/pkgs/development/python-modules/requests/default.nix
+++ b/pkgs/development/python-modules/requests/default.nix
@@ -4,11 +4,11 @@
 
 buildPythonPackage rec {
   pname = "requests";
-  version = "2.24.0";
+  version = "2.25.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "b3559a131db72c33ee969480840fff4bb6dd111de7dd27c8ee1f820f4f00231b";
+    sha256 = "1y6mb8c0ipd64d5axq2p368yxndp3f966hmabjka2q2a5y9hn6kz";
   };
 
   nativeBuildInputs = [ pytest ];
diff --git a/pkgs/development/python-modules/setuptools/44.0.nix b/pkgs/development/python-modules/setuptools/44.0.nix
index 66330ca250f..c2f6eb230b4 100644
--- a/pkgs/development/python-modules/setuptools/44.0.nix
+++ b/pkgs/development/python-modules/setuptools/44.0.nix
@@ -27,14 +27,23 @@ let
       name = "${pname}-${version}-source";
     };
 
+    patches = [
+      ./tag-date.patch
+    ];
+
     buildPhase = ''
       ${python.pythonForBuild.interpreter} bootstrap.py
       ${python.pythonForBuild.interpreter} setup.py sdist --formats=gztar
+
+      # Here we untar the sdist and retar it in order to control the timestamps
+      # of all the files included
+      tar -xzf dist/${pname}-${version}.post0.tar.gz -C dist/
+      tar -czf dist/${name} -C dist/ --mtime="@$SOURCE_DATE_EPOCH" ${pname}-${version}.post0
     '';
 
     installPhase = ''
       echo "Moving sdist..."
-      mv dist/*.tar.gz $out
+      mv dist/${name} $out
     '';
   };
 in buildPythonPackage rec {
diff --git a/pkgs/development/python-modules/setuptools/default.nix b/pkgs/development/python-modules/setuptools/default.nix
index b618ec6f634..54eacea892e 100644
--- a/pkgs/development/python-modules/setuptools/default.nix
+++ b/pkgs/development/python-modules/setuptools/default.nix
@@ -27,14 +27,23 @@ let
       name = "${pname}-${version}-source";
     };
 
+    patches = [
+      ./tag-date.patch
+    ];
+
     buildPhase = ''
       ${python.pythonForBuild.interpreter} bootstrap.py
       ${python.pythonForBuild.interpreter} setup.py sdist --formats=gztar
+
+      # Here we untar the sdist and retar it in order to control the timestamps
+      # of all the files included
+      tar -xzf dist/${pname}-${version}.post0.tar.gz -C dist/
+      tar -czf dist/${name} -C dist/ --mtime="@$SOURCE_DATE_EPOCH"  ${pname}-${version}.post0
     '';
 
     installPhase = ''
       echo "Moving sdist..."
-      mv dist/*.tar.gz $out
+      mv dist/${name} $out
     '';
   };
 in buildPythonPackage rec {
diff --git a/pkgs/development/python-modules/setuptools/tag-date.patch b/pkgs/development/python-modules/setuptools/tag-date.patch
new file mode 100644
index 00000000000..441177a5d17
--- /dev/null
+++ b/pkgs/development/python-modules/setuptools/tag-date.patch
@@ -0,0 +1,12 @@
+diff --git a/setup.cfg b/setup.cfg
+index f23714b6..8aaeb330 100644
+--- a/setup.cfg
++++ b/setup.cfg
+@@ -1,6 +1,6 @@
+ [egg_info]
+ tag_build = .post
+-tag_date = 1
++tag_date = 0
+
+ [aliases]
+ clean_egg_info = egg_info -Db ''
diff --git a/pkgs/development/tools/backblaze-b2/default.nix b/pkgs/development/tools/backblaze-b2/default.nix
index 46e54465ab6..32161a43798 100644
--- a/pkgs/development/tools/backblaze-b2/default.nix
+++ b/pkgs/development/tools/backblaze-b2/default.nix
@@ -35,8 +35,8 @@ python3Packages.buildPythonApplication rec {
 
     sed 's/b2/backblaze-b2/' -i contrib/bash_completion/b2
 
-    mkdir -p "$out/etc/bash_completion.d"
-    cp contrib/bash_completion/b2 "$out/etc/bash_completion.d/backblaze-b2"
+    mkdir -p "$out/share/bash-completion/completions"
+    cp contrib/bash_completion/b2 "$out/share/bash-completion/completions/backblaze-b2"
   '';
 
   meta = with lib; {
diff --git a/pkgs/development/tools/build-managers/meson/default.nix b/pkgs/development/tools/build-managers/meson/default.nix
index 32948adfb6c..cd506b970f6 100644
--- a/pkgs/development/tools/build-managers/meson/default.nix
+++ b/pkgs/development/tools/build-managers/meson/default.nix
@@ -3,7 +3,6 @@
 , stdenv
 , writeTextDir
 , substituteAll
-, pkgsHostHost
 , fetchpatch
 }:
 
@@ -61,10 +60,6 @@ python3.pkgs.buildPythonApplication rec {
 
   setupHook = ./setup-hook.sh;
 
-  # Ensure there will always be a native C compiler when meson is used, as a
-  # workaround until https://github.com/mesonbuild/meson/pull/6512 lands.
-  depsHostHostPropagated = [ pkgsHostHost.stdenv.cc ];
-
   # 0.45 update enabled tests but they are failing
   doCheck = false;
   # checkInputs = [ ninja pkgconfig ];
diff --git a/pkgs/development/tools/documentation/gtk-doc/default.nix b/pkgs/development/tools/documentation/gtk-doc/default.nix
index d7779540f97..4645c63e71d 100644
--- a/pkgs/development/tools/documentation/gtk-doc/default.nix
+++ b/pkgs/development/tools/documentation/gtk-doc/default.nix
@@ -68,10 +68,6 @@ python3.pkgs.buildPythonApplication rec {
       --replace "${python3}" ""
   '';
 
-  # find: ‘...-gtk-doc-1.32/lib/python3.8/site-packages’: No such file or directory
-  # https://github.com/NixOS/nixpkgs/pull/90208#issuecomment-644051108
-  dontUsePythonRecompileBytecode = true;
-
   passthru = {
     # Consumers are expected to copy the m4 files to their source tree, let them reuse the patch
     respect_xml_catalog_files_var_patch = ./respect-xml-catalog-files-var.patch;
diff --git a/pkgs/development/tools/misc/autogen/default.nix b/pkgs/development/tools/misc/autogen/default.nix
index 87b8bde58ad..23235499cfb 100644
--- a/pkgs/development/tools/misc/autogen/default.nix
+++ b/pkgs/development/tools/misc/autogen/default.nix
@@ -42,6 +42,10 @@ stdenv.mkDerivation rec {
     guile libxml2
   ];
 
+  preConfigure = ''
+    export MAN_PAGE_DATE=$(date '+%Y-%m-%d' -d "@$SOURCE_DATE_EPOCH")
+  '';
+
   configureFlags =
     [
       # Make sure to use a static value for the timeout. If we do not set a value
diff --git a/pkgs/development/tools/parsing/bison/default.nix b/pkgs/development/tools/parsing/bison/default.nix
index 70fd733e1ee..2fe17a23fc2 100644
--- a/pkgs/development/tools/parsing/bison/default.nix
+++ b/pkgs/development/tools/parsing/bison/default.nix
@@ -7,11 +7,11 @@
 
 stdenv.mkDerivation rec {
   pname = "bison";
-  version = "3.7.2";
+  version = "3.7.3";
 
   src = fetchurl {
     url = "mirror://gnu/${pname}/${pname}-${version}.tar.gz";
-    sha256 = "111ax2imnydvrpcys5ami8ixn0a50m7a5pims7cbyysi8h8djp21";
+    sha256 = "1ixk4wglpign8glpil9qziph96ki7flqiy4xlpjb8ai1y89fjkqh";
   };
 
   nativeBuildInputs = [ m4 perl ] ++ stdenv.lib.optional stdenv.isSunOS help2man;
diff --git a/pkgs/development/tools/poetry2nix/poetry2nix/plugins.nix b/pkgs/development/tools/poetry2nix/poetry2nix/plugins.nix
index b5e807c6e2d..e7125c2ff57 100644
--- a/pkgs/development/tools/poetry2nix/poetry2nix/plugins.nix
+++ b/pkgs/development/tools/poetry2nix/poetry2nix/plugins.nix
@@ -23,7 +23,6 @@ let
 
       dontConfigure = true;
       dontBuild = true;
-      dontUsePythonRecompileBytecode = true;
 
       passthru = {
         inherit (drv.passthru) withPlugins;
diff --git a/pkgs/os-specific/linux/nftables/default.nix b/pkgs/os-specific/linux/nftables/default.nix
index 9ec42ad66b0..c5879fcc021 100644
--- a/pkgs/os-specific/linux/nftables/default.nix
+++ b/pkgs/os-specific/linux/nftables/default.nix
@@ -10,17 +10,17 @@
 with stdenv.lib;
 
 stdenv.mkDerivation rec {
-  version = "0.9.6";
+  version = "0.9.7";
   pname = "nftables";
 
   src = fetchurl {
     url = "https://netfilter.org/projects/nftables/files/${pname}-${version}.tar.bz2";
-    sha256 = "0vmn6xwqa1nq6crfxshh049b199d0aj6hfgin7k068xhibzgvmk8";
+    sha256 = "1c1c2475nifncv0ng8z77h2dpanlsx0bhqm15k00jb3a6a68lszy";
   };
 
   nativeBuildInputs = [
     pkgconfig bison file flex
-    asciidoc docbook_xml_dtd_45 docbook_xsl findXMLCatalogs libxslt 
+    asciidoc docbook_xml_dtd_45 docbook_xsl findXMLCatalogs libxslt
   ];
 
   buildInputs = [
@@ -45,5 +45,6 @@ stdenv.mkDerivation rec {
     homepage = "https://netfilter.org/projects/nftables/";
     license = licenses.gpl2;
     platforms = platforms.linux;
+    maintainers = with maintainers; [ izorkin ];
   };
 }
diff --git a/pkgs/os-specific/linux/trace-cmd/default.nix b/pkgs/os-specific/linux/trace-cmd/default.nix
index a80635c53ce..ddd41170215 100644
--- a/pkgs/os-specific/linux/trace-cmd/default.nix
+++ b/pkgs/os-specific/linux/trace-cmd/default.nix
@@ -23,7 +23,7 @@ stdenv.mkDerivation {
     "man_dir=${placeholder "man"}/share/man"
     "libdir=${placeholder "lib"}/lib"
     "includedir=${placeholder "dev"}/include"
-    "BASH_COMPLETE_DIR=${placeholder "out"}/etc/bash_completion.d"
+    "BASH_COMPLETE_DIR=${placeholder "out"}/share/bash-completion/completions"
   ];
 
   meta = with stdenv.lib; {
diff --git a/pkgs/stdenv/linux/default.nix b/pkgs/stdenv/linux/default.nix
index 6c396b27746..6d6bca870bf 100644
--- a/pkgs/stdenv/linux/default.nix
+++ b/pkgs/stdenv/linux/default.nix
@@ -274,9 +274,9 @@ in
       gmp = super.gmp.override { stdenv = self.makeStaticLibraries self.stdenv; };
       mpfr = super.mpfr.override { stdenv = self.makeStaticLibraries self.stdenv; };
       libmpc = super.libmpc.override { stdenv = self.makeStaticLibraries self.stdenv; };
-      isl_0_17 = super.isl_0_17.override { stdenv = self.makeStaticLibraries self.stdenv; };
+      isl_0_20 = super.isl_0_20.override { stdenv = self.makeStaticLibraries self.stdenv; };
       gcc-unwrapped = super.gcc-unwrapped.override {
-        isl = isl_0_17;
+        isl = isl_0_20;
       };
     };
     extraNativeBuildInputs = [ prevStage.patchelf ] ++
diff --git a/pkgs/stdenv/linux/make-bootstrap-tools.nix b/pkgs/stdenv/linux/make-bootstrap-tools.nix
index ec5f1092a46..421bb8502a4 100644
--- a/pkgs/stdenv/linux/make-bootstrap-tools.nix
+++ b/pkgs/stdenv/linux/make-bootstrap-tools.nix
@@ -152,7 +152,7 @@ in with pkgs; rec {
         # These needed for cross but not native tools because the stdenv
         # GCC has certain things built in statically. See
         # pkgs/stdenv/linux/default.nix for the details.
-        cp -d ${isl_0_17.out}/lib/libisl*.so* $out/lib
+        cp -d ${isl_0_20.out}/lib/libisl*.so* $out/lib
 
       '' + ''
         cp -d ${bzip2.out}/lib/libbz2.so* $out/lib
diff --git a/pkgs/tools/admin/awscli/default.nix b/pkgs/tools/admin/awscli/default.nix
index 79d6f42628f..7c78587a05e 100644
--- a/pkgs/tools/admin/awscli/default.nix
+++ b/pkgs/tools/admin/awscli/default.nix
@@ -47,10 +47,12 @@ in with py.pkgs; buildPythonApplication rec {
   ];
 
   postInstall = ''
-    mkdir -p $out/etc/bash_completion.d
-    echo "complete -C $out/bin/aws_completer aws" > $out/etc/bash_completion.d/awscli
+    mkdir -p $out/share/bash-completion/completions
+    echo "complete -C $out/bin/aws_completer aws" > $out/share/bash-completion/completions/awscli
+
     mkdir -p $out/share/zsh/site-functions
     mv $out/bin/aws_zsh_completer.sh $out/share/zsh/site-functions
+
     rm $out/bin/aws.cmd
   '';
 
diff --git a/pkgs/tools/admin/awscli2/default.nix b/pkgs/tools/admin/awscli2/default.nix
index e89df04e3bd..b6844767e60 100644
--- a/pkgs/tools/admin/awscli2/default.nix
+++ b/pkgs/tools/admin/awscli2/default.nix
@@ -67,10 +67,12 @@ with py.pkgs; buildPythonApplication rec {
   ];
 
   postInstall = ''
-    mkdir -p $out/etc/bash_completion.d
-    echo "complete -C $out/bin/aws_completer aws" > $out/etc/bash_completion.d/awscli
+    mkdir -p $out/share/bash-completion/completions
+    echo "complete -C $out/bin/aws_completer aws" > $out/share/bash-completion/completions/awscli
+
     mkdir -p $out/share/zsh/site-functions
     mv $out/bin/aws_zsh_completer.sh $out/share/zsh/site-functions
+
     rm $out/bin/aws.cmd
   '';
 
diff --git a/pkgs/tools/admin/bluemix-cli/default.nix b/pkgs/tools/admin/bluemix-cli/default.nix
index f97a6e5df89..b0a5af35def 100644
--- a/pkgs/tools/admin/bluemix-cli/default.nix
+++ b/pkgs/tools/admin/bluemix-cli/default.nix
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
     install -m755 -D -t $out/bin/cfcli bin/cfcli/cf
     ln -sv $out/bin/ibmcloud $out/bin/bx
     ln -sv $out/bin/ibmcloud $out/bin/bluemix
-    install -D -t "$out/etc/bash_completion.d" bx/bash_autocomplete
+    install -D -t "$out/share/bash-completion/completions" bx/bash_autocomplete
     install -D -t "$out/share/zsh/site-functions" bx/zsh_autocomplete
   '';
 
diff --git a/pkgs/tools/admin/google-cloud-sdk/default.nix b/pkgs/tools/admin/google-cloud-sdk/default.nix
index 53cbaf1229a..904cab31228 100644
--- a/pkgs/tools/admin/google-cloud-sdk/default.nix
+++ b/pkgs/tools/admin/google-cloud-sdk/default.nix
@@ -74,8 +74,8 @@ in stdenv.mkDerivation rec {
     disable_update_check = true" >> $out/google-cloud-sdk/properties
 
     # setup bash completion
-    mkdir -p $out/etc/bash_completion.d
-    mv $out/google-cloud-sdk/completion.bash.inc $out/etc/bash_completion.d/gcloud.inc
+    mkdir -p $out/share/bash-completion/completions
+    mv $out/google-cloud-sdk/completion.bash.inc $out/share/bash-completion/completions/gcloud.inc
 
     # This directory contains compiled mac binaries. We used crcmod from
     # nixpkgs instead.
diff --git a/pkgs/tools/backup/tarsnap/default.nix b/pkgs/tools/backup/tarsnap/default.nix
index 8d23e955095..34955a979a4 100644
--- a/pkgs/tools/backup/tarsnap/default.nix
+++ b/pkgs/tools/backup/tarsnap/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
   };
 
   preConfigure = ''
-    configureFlags="--with-bash-completion-dir=$out/etc/bash_completion.d"
+    configureFlags="--with-bash-completion-dir=$out/share/bash-completion/completions"
   '';
 
   patchPhase = ''
diff --git a/pkgs/tools/compression/lz4/default.nix b/pkgs/tools/compression/lz4/default.nix
index 6bc365b8e1e..0124a0b3d63 100644
--- a/pkgs/tools/compression/lz4/default.nix
+++ b/pkgs/tools/compression/lz4/default.nix
@@ -4,10 +4,10 @@
 
 stdenv.mkDerivation rec {
   pname = "lz4";
-  version = "1.9.2";
+  version = "1.9.3";
 
   src = fetchFromGitHub {
-    sha256 = "0lpaypmk70ag2ks3kf2dl4ac3ba40n5kc1ainkp9wfjawz76mh61";
+    sha256 = "1w02kazh1fps3sji2sn89fz862j1199c5ajrqcgl1bnlxj09kcbz";
     rev = "v${version}";
     repo = pname;
     owner = pname;
diff --git a/pkgs/tools/filesystems/btrfs-progs/default.nix b/pkgs/tools/filesystems/btrfs-progs/default.nix
index 3358d1c0277..03db1d913e2 100644
--- a/pkgs/tools/filesystems/btrfs-progs/default.nix
+++ b/pkgs/tools/filesystems/btrfs-progs/default.nix
@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
   postPatch = "sed -i s/-O1/-O2/ configure";
 
   postInstall = ''
-    install -v -m 444 -D btrfs-completion $out/etc/bash_completion.d/btrfs
+    install -v -m 444 -D btrfs-completion $out/share/bash-completion/completions/btrfs
   '';
 
   configureFlags = stdenv.lib.optional stdenv.hostPlatform.isMusl "--disable-backtrace";
diff --git a/pkgs/tools/filesystems/ceph/default.nix b/pkgs/tools/filesystems/ceph/default.nix
index b221025f85b..7ada070aba6 100644
--- a/pkgs/tools/filesystems/ceph/default.nix
+++ b/pkgs/tools/filesystems/ceph/default.nix
@@ -208,12 +208,12 @@ in rec {
   ceph-client = runCommand "ceph-client-${version}" {
       meta = getMeta "Tools needed to mount Ceph's RADOS Block Devices";
     } ''
-      mkdir -p $out/{bin,etc,${sitePackages}}
+      mkdir -p $out/{bin,etc,${sitePackages},share/bash-completion/completions}
       cp -r ${ceph}/bin/{ceph,.ceph-wrapped,rados,rbd,rbdmap} $out/bin
       cp -r ${ceph}/bin/ceph-{authtool,conf,dencoder,rbdnamer,syn} $out/bin
       cp -r ${ceph}/bin/rbd-replay* $out/bin
       cp -r ${ceph}/${sitePackages} $out/${sitePackages}
-      cp -r ${ceph}/etc/bash_completion.d $out/etc
+      cp -r ${ceph}/etc/bash_completion.d $out/share/bash-completion/completions
       # wrapPythonPrograms modifies .ceph-wrapped, so lets just update its paths
       substituteInPlace $out/bin/ceph          --replace ${ceph} $out
       substituteInPlace $out/bin/.ceph-wrapped --replace ${ceph} $out
diff --git a/pkgs/tools/filesystems/yandex-disk/default.nix b/pkgs/tools/filesystems/yandex-disk/default.nix
index 334aa6ad9c6..152fd1d7a71 100644
--- a/pkgs/tools/filesystems/yandex-disk/default.nix
+++ b/pkgs/tools/filesystems/yandex-disk/default.nix
@@ -32,12 +32,13 @@ stdenv.mkDerivation rec {
     cd unpacked
     ${rpmextract}/bin/rpmextract $src
 
+    mkdir -p $out/share/bash-completion/completions
     cp -r -t $out/bin usr/bin/*
     cp -r -t $out/share usr/share/*
-    cp -r -t $out/etc etc/*
+    cp -r -t $out/share/bash-completion/completions etc/bash_completion.d/*
 
     sed -i 's@have@${which}/bin/which >/dev/null 2>\&1@' \
-      $out/etc/bash_completion.d/yandex-disk-completion.bash
+      $out/share/bash-completion/completions/yandex-disk-completion.bash
 
     ${patchelf}/bin/patchelf \
       --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
diff --git a/pkgs/tools/misc/gibo/default.nix b/pkgs/tools/misc/gibo/default.nix
index abee4950d87..1357ab5196d 100644
--- a/pkgs/tools/misc/gibo/default.nix
+++ b/pkgs/tools/misc/gibo/default.nix
@@ -14,15 +14,15 @@ stdenv.mkDerivation rec {
   phases = [ "unpackPhase" "installPhase" "fixupPhase" ];
 
   installPhase = ''
-    mkdir -p $out/bin $out/etc/bash_completion.d
+    mkdir -p $out/bin $out/share/bash-completion/completions
     cp gibo $out/bin
-    cp gibo-completion.bash $out/etc/bash_completion.d
+    cp gibo-completion.bash $out/share/bash-completion/completions
 
     sed -e 's|\<git |${git}/bin/git |g' \
         -e 's|\<basename |${coreutils}/bin/basename |g' \
         -i "$out/bin/gibo"
     sed -e 's|\<find |${findutils}/bin/find |g' \
-        -i "$out/etc/bash_completion.d/gibo-completion.bash"
+        -i "$out/share/bash-completion/completions/gibo-completion.bash"
   '';
 
   meta = {
diff --git a/pkgs/tools/misc/powerline-rs/default.nix b/pkgs/tools/misc/powerline-rs/default.nix
index df0d344afaa..6df48f0effb 100644
--- a/pkgs/tools/misc/powerline-rs/default.nix
+++ b/pkgs/tools/misc/powerline-rs/default.nix
@@ -19,7 +19,7 @@ rustPlatform.buildRustPackage rec {
 
   COMPLETION_OUT = "out";
   postInstall = ''
-    install -Dm 755 "${COMPLETION_OUT}/${pname}.bash" "$out/etc/bash_completion.d/${pname}"
+    install -Dm 755 "${COMPLETION_OUT}/${pname}.bash" "$out/share/bash-completion/completions/${pname}"
     install -Dm 755 "${COMPLETION_OUT}/${pname}.fish" "$out/share/fish/vendor_completions.d/${pname}"
   '';
 
diff --git a/pkgs/tools/security/pass/extensions/import.nix b/pkgs/tools/security/pass/extensions/import.nix
index cc5f0c94e11..bd41ae0c593 100644
--- a/pkgs/tools/security/pass/extensions/import.nix
+++ b/pkgs/tools/security/pass/extensions/import.nix
@@ -38,7 +38,7 @@ in stdenv.mkDerivation rec {
 
   installFlags = [
     "PREFIX=$(out)"
-    "BASHCOMPDIR=$(out)/etc/bash_completion.d"
+    "BASHCOMPDIR=$(out)/share/bash-completion/completions"
   ];
 
   postFixup = ''
diff --git a/pkgs/tools/security/pass/extensions/update.nix b/pkgs/tools/security/pass/extensions/update.nix
index b2f331f1375..c364c341bda 100644
--- a/pkgs/tools/security/pass/extensions/update.nix
+++ b/pkgs/tools/security/pass/extensions/update.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
 
   postPatch = ''
     substituteInPlace Makefile \
-      --replace "BASHCOMPDIR ?= /etc/bash_completion.d" "BASHCOMPDIR ?= $out/etc/bash_completion.d"
+      --replace "BASHCOMPDIR ?= /etc/bash_completion.d" "BASHCOMPDIR ?= $out/share/bash-completion/completions"
   '';
 
   dontBuild = true;
diff --git a/pkgs/tools/text/recode/default.nix b/pkgs/tools/text/recode/default.nix
index b6503f88848..e8dd5c8bbf7 100644
--- a/pkgs/tools/text/recode/default.nix
+++ b/pkgs/tools/text/recode/default.nix
@@ -2,12 +2,12 @@
 
 stdenv.mkDerivation rec {
   pname = "recode";
-  version = "3.7.7";
+  version = "3.7.8";
 
   # Use official tarball, avoid need to bootstrap/generate build system
   src = fetchurl {
     url = "https://github.com/rrthomas/${pname}/releases/download/v${version}/${pname}-${version}.tar.gz";
-    sha256 = "1yrqgw74qrdmy82lxd1cxlfclrf2fqi0qp7afjmfc6b7f0xzcih9";
+    sha256 = "19yg20z1smj9kag1axgvc4s4kd6jmw75h0pa8xqxl3xqqyn5rdsg";
   };
 
   nativeBuildInputs = [ python3 python3.pkgs.cython perl intltool flex texinfo libiconv ];
diff --git a/pkgs/tools/virtualization/awsebcli/default.nix b/pkgs/tools/virtualization/awsebcli/default.nix
index aff00519a2d..00f8ed89a2b 100644
--- a/pkgs/tools/virtualization/awsebcli/default.nix
+++ b/pkgs/tools/virtualization/awsebcli/default.nix
@@ -83,8 +83,8 @@ in with localPython.pkgs; buildPythonApplication rec {
   ];
 
   postInstall = ''
-    mkdir -p $out/etc/bash_completion.d
-    mv $out/bin/eb_completion.bash $out/etc/bash_completion.d
+    mkdir -p $out/share/bash-completion/completions
+    mv $out/bin/eb_completion.bash $out/share/bash-completion/completions/
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/virtualization/nixos-container/default.nix b/pkgs/tools/virtualization/nixos-container/default.nix
index 94a19c5375e..32a7c1e2c33 100644
--- a/pkgs/tools/virtualization/nixos-container/default.nix
+++ b/pkgs/tools/virtualization/nixos-container/default.nix
@@ -10,7 +10,7 @@ substituteAll {
     inherit utillinux;
 
     postInstall = ''
-      t=$out/etc/bash_completion.d
+      t=$out/share/bash-completion/completions
       mkdir -p $t
       cp ${./nixos-container-completion.sh} $t/nixos-container
     '';
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index e2efe9633b9..467fa9df2ca 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -5528,7 +5528,6 @@ in
   mailpile = callPackage ../applications/networking/mailreaders/mailpile { };
 
   mailutils = callPackage ../tools/networking/mailutils {
-    guile = guile_2_0;  # compilation fails with guile 2.2
     sasl = gsasl;
   };
 
@@ -8948,7 +8947,7 @@ in
         inherit noSysDirs;
         # PGO seems to speed up compilation by gcc by ~10%, see #445 discussion
         profiledCompiler = with stdenv; (!isDarwin && (isi686 || isx86_64));
-        isl = if !stdenv.isDarwin then isl_0_17 else null;
+        isl = if !stdenv.isDarwin then isl_0_20 else null;
 
         # just for stage static
         crossStageStatic = true;
@@ -9041,7 +9040,7 @@ in
     libcCross = if stdenv.targetPlatform != stdenv.buildPlatform then libcCross else null;
     threadsCross = if stdenv.targetPlatform != stdenv.buildPlatform then threadsCross else null;
 
-    isl = if !stdenv.isDarwin then isl_0_17 else null;
+    isl = if !stdenv.isDarwin then isl_0_20 else null;
   }));
 
   gcc10 = lowPrio (wrapCC (callPackage ../development/compilers/gcc/10 {
@@ -9055,7 +9054,7 @@ in
     libcCross = if stdenv.targetPlatform != stdenv.buildPlatform then libcCross else null;
     threadsCross = if stdenv.targetPlatform != stdenv.buildPlatform then threadsCross else null;
 
-    isl = if !stdenv.isDarwin then isl_0_17 else null;
+    isl = if !stdenv.isDarwin then isl_0_20 else null;
   }));
 
   gcc_latest = gcc10;
@@ -12494,9 +12493,9 @@ julia_15 = callPackage ../development/compilers/julia/1.5.nix {
   dbus-sharp-glib-1_0 = callPackage ../development/libraries/dbus-sharp-glib/dbus-sharp-glib-1.0.nix { };
   dbus-sharp-glib-2_0 = callPackage ../development/libraries/dbus-sharp-glib { };
 
-  makeDBusConf = { suidHelper, serviceDirectories }:
+  makeDBusConf = { suidHelper, serviceDirectories, apparmor }:
     callPackage ../development/libraries/dbus/make-dbus-conf.nix {
-      inherit suidHelper serviceDirectories;
+      inherit suidHelper serviceDirectories apparmor;
     };
 
   dee = callPackage ../development/libraries/dee { };
@@ -15167,8 +15166,9 @@ julia_15 = callPackage ../development/compilers/julia/1.5.nix {
     python = python37;
   };
 
-  protobuf = protobuf3_13;
+  protobuf = protobuf3_14;
 
+  protobuf3_14 = callPackage ../development/libraries/protobuf/3.14.nix { };
   protobuf3_13 = callPackage ../development/libraries/protobuf/3.13.nix { };
   protobuf3_12 = callPackage ../development/libraries/protobuf/3.12.nix { };
   protobuf3_11 = callPackage ../development/libraries/protobuf/3.11.nix { };
diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index f88b68d73c7..fea50e92958 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -511,10 +511,10 @@ let
     buildInputs = [ DataDump FileWhich Readonly TestDifferences TestTrap ];
     preCheck = "rm t/30cluster.t"; # do not run failing tests
     postInstall = ''
-      mkdir -p $out/etc/bash_completion.d
+      mkdir -p $out/share/bash-completion/completions
       mv $out/bin/clusterssh_bash_completion.dist \
-         $out/etc/bash_completion.d/clusterssh_bash_completion
-      substituteInPlace $out/etc/bash_completion.d/clusterssh_bash_completion \
+         $out/share/bash-completion/completions/clusterssh_bash_completion
+      substituteInPlace $out/share/bash-completion/completions/clusterssh_bash_completion \
          --replace '/bin/true' '${pkgs.coreutils}/bin/true' \
          --replace 'grep' '${pkgs.gnugrep}/bin/grep' \
          --replace 'sed' '${pkgs.gnused}/bin/sed'