diff --git a/pkgs/applications/audio/clementine/default.nix b/pkgs/applications/audio/clementine/default.nix
index e665edabd07..b84b4e6aa9a 100644
--- a/pkgs/applications/audio/clementine/default.nix
+++ b/pkgs/applications/audio/clementine/default.nix
@@ -10,7 +10,7 @@ let
   withCD = config.clementine.cd or true;
   withCloud = config.clementine.cloud or true;
 
-  # On the update after all 1.4rc, qt5.15 will be supported.
+  # On the update after all 1.4rc, qt5.15 and protobuf 3.15 will be supported.
   version = "1.4.0rc1";
 
   src = fetchFromGitHub {
diff --git a/pkgs/applications/audio/clerk/default.nix b/pkgs/applications/audio/clerk/default.nix
index a2e71b955ec..ebcd09ca6ad 100644
--- a/pkgs/applications/audio/clerk/default.nix
+++ b/pkgs/applications/audio/clerk/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchFromGitHub, makeWrapper, rofi, mpc_cli, perl,
-util-linux, pythonPackages, libnotify }:
+util-linux, python3Packages, libnotify }:
 
 stdenv.mkDerivation {
   name = "clerk-2016-10-14";
@@ -12,10 +12,12 @@ stdenv.mkDerivation {
   };
 
   nativeBuildInputs = [ makeWrapper ];
-  buildInputs = [ pythonPackages.mpd2 ];
+  buildInputs = [ python3Packages.mpd2 ];
 
   dontBuild = true;
 
+  strictDeps = true;
+
   installPhase = ''
     DESTDIR=$out PREFIX=/ make install
     wrapProgram $out/bin/clerk \
diff --git a/pkgs/applications/blockchains/btcpayserver/default.nix b/pkgs/applications/blockchains/btcpayserver/default.nix
index 52914c1128a..61ce54beec2 100644
--- a/pkgs/applications/blockchains/btcpayserver/default.nix
+++ b/pkgs/applications/blockchains/btcpayserver/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchFromGitHub, fetchurl, linkFarmFromDrvs, makeWrapper,
-  dotnetPackages, dotnetCorePackages, writeScript, bash
+  dotnetPackages, dotnetCorePackages
 }:
 
 let
@@ -15,13 +15,13 @@ in
 
 stdenv.mkDerivation rec {
   pname = "btcpayserver";
-  version = "1.0.6.8";
+  version = "1.0.7.0";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    sha256 = "1znmix9w7ahzyb933lxzqv6j8j5qycknq3gmnkakj749ksshql1b";
+    sha256 = "1pbq0kik29sx1lwlic7fvhnjhrpnlk94w53wmywqnlpgjscx8x8a";
   };
 
   nativeBuildInputs = [ dotnetSdk dotnetPackages.Nuget makeWrapper ];
diff --git a/pkgs/applications/blockchains/btcpayserver/deps.nix b/pkgs/applications/blockchains/btcpayserver/deps.nix
index 9065ff49cf8..b579fc8f7f8 100644
--- a/pkgs/applications/blockchains/btcpayserver/deps.nix
+++ b/pkgs/applications/blockchains/btcpayserver/deps.nix
@@ -19,6 +19,11 @@
     version = "3.3.110.10";
     sha256 = "1lf1hfbx792dpa1hxgn0a0jrrvldd16hgbxx229dk2qcz5qlnc38";
   })
+  (fetchNuGet {
+    name = "BIP78.Sender";
+    version = "0.2.0";
+    sha256 = "0gyynn15rc1x9p2703ffi4jnbpbd0k3wvg839xrk2skmaw8nxamf";
+  })
   (fetchNuGet {
     name = "BTCPayServer.Hwi";
     version = "1.1.3";
@@ -26,38 +31,43 @@
   })
   (fetchNuGet {
     name = "BTCPayServer.Lightning.All";
-    version = "1.2.4";
-    sha256 = "1f4wgs8ijk1wmppz5lmas7l6m83szz57jyk6ak0dxhccdld9rdaj";
+    version = "1.2.7";
+    sha256 = "0jzmzvlpf6iba2fsc6cyi69vlaim9slqm2sapknmd7drl3gcn2zj";
   })
   (fetchNuGet {
     name = "BTCPayServer.Lightning.Charge";
-    version = "1.2.1";
-    sha256 = "0iv9frbr6xfxif3pnfd7c87y8mv31nqkdrnhvnaswrx43nv6s272";
+    version = "1.2.3";
+    sha256 = "1rdrwmijx0v4z0xsq4acyvdcj7hv6arfh3hwjy89rqnkkznrzgwv";
   })
   (fetchNuGet {
     name = "BTCPayServer.Lightning.CLightning";
-    version = "1.2.1";
-    sha256 = "14km69jzmnyqg19w27g6znml4z0xkm8l4j7rj0x36bw67cjmgahv";
+    version = "1.2.3";
+    sha256 = "02197rh03q8d0mv40zf67wp1rd2gbxi5l8krd2rzj84n267bcfvc";
   })
   (fetchNuGet {
     name = "BTCPayServer.Lightning.Common";
     version = "1.2.0";
     sha256 = "17di8ndkw8z0ci0zk15mcrqpmganwkz9ys2snr2rqpw5mrlhpwa0";
   })
+  (fetchNuGet {
+    name = "BTCPayServer.Lightning.Common";
+    version = "1.2.2";
+    sha256 = "07xb7fsqvfjmcawxylriw60i73h0cvfb765aznhp9ffyrmjaql7z";
+  })
   (fetchNuGet {
     name = "BTCPayServer.Lightning.Eclair";
-    version = "1.2.0";
-    sha256 = "0w7nwsr0n2hrqak023xa294palsk3r96wlgw2ks8d3p5kxm8kskp";
+    version = "1.2.2";
+    sha256 = "03dymhwxb5s28kb187g5h4aysnz2xzml89p47nmwz9lkg2h4s73h";
   })
   (fetchNuGet {
     name = "BTCPayServer.Lightning.LND";
-    version = "1.2.1";
-    sha256 = "0ql4qyvz0rms6ls46pi3bgak3r6hj2c5ivnzahiq6cb84pbl61cr";
+    version = "1.2.4";
+    sha256 = "0qnj5rsp6hnybsr58zny9dfbsxksg1674q0z9944jwkzm7pcqyg4";
   })
   (fetchNuGet {
     name = "BTCPayServer.Lightning.Ptarmigan";
-    version = "1.2.0";
-    sha256 = "1yd6nhlssb9k08p5491knlwwjij9324ildir99sa9cp24rlq5nis";
+    version = "1.2.2";
+    sha256 = "17yl85vqfp7l12bv3f3w1b861hm41i7cfhs78gaq04s4drvcnj6k";
   })
   (fetchNuGet {
     name = "BuildBundlerMinifier";
@@ -79,11 +89,6 @@
     version = "15.0.5";
     sha256 = "01y8bhsnxghn3flz0pr11vj6wjrpmia8rpdrsp7kjfc1zmhqlgma";
   })
-  (fetchNuGet {
-    name = "DBriize";
-    version = "1.0.1.3";
-    sha256 = "0rsm68hwq2ky8i6mv3ckdjkj4vjygnkgk3disva0skl3apk833dc";
-  })
   (fetchNuGet {
     name = "DigitalRuby.ExchangeSharp";
     version = "0.6.3";
@@ -666,13 +671,8 @@
   })
   (fetchNuGet {
     name = "NBitcoin.Altcoins";
-    version = "2.0.21";
-    sha256 = "0xmygiwjlia7fbxy63893jb15g6fxggxxr9bbm8znd9bs3jzp2g1";
-  })
-  (fetchNuGet {
-    name = "NBitcoin";
-    version = "5.0.33";
-    sha256 = "030q609b9lhapq4wfl1w3impjw5m40kz2rg1s9jn3bn8yjfmsi4a";
+    version = "2.0.28";
+    sha256 = "1zfirfmhgigp733km9rqkgz560h5wg88bpba499x49h5j650cnn4";
   })
   (fetchNuGet {
     name = "NBitcoin";
@@ -686,13 +686,13 @@
   })
   (fetchNuGet {
     name = "NBitcoin";
-    version = "5.0.60";
-    sha256 = "0pin4ldfz5lfxyd47mj1ypyp8lmj0v5nq5zvygdjna956vphd39v";
+    version = "5.0.67";
+    sha256 = "049marx1jwr7srlpqspimrqqgahh53gi2iyp7bpzn5npsbzh9v3h";
   })
   (fetchNuGet {
     name = "NBitcoin";
-    version = "5.0.68";
-    sha256 = "0k275mbp9wannm10pqj4nv8agjc1f6hsrfhl0m6ax1apv81sfxcd";
+    version = "5.0.73";
+    sha256 = "0vqgcb0ws5fnkrdzqfkyh78041c6q4l22b93rr0006dd4bmqrmg1";
   })
   (fetchNuGet {
     name = "NBitpayClient";
@@ -701,8 +701,8 @@
   })
   (fetchNuGet {
     name = "NBXplorer.Client";
-    version = "3.0.19";
-    sha256 = "0nahfxdsryf5snjy87770m51v2jcry02lmb10ilsg4h2ig4pjdk4";
+    version = "3.0.20";
+    sha256 = "1mwa6ncmg5r6q7yn6skm9dgqm631c7r7nadcg9mvbw81113h0xxy";
   })
   (fetchNuGet {
     name = "NETStandard.Library";
@@ -729,11 +729,6 @@
     version = "10.0.3";
     sha256 = "06vy67bkshclpz69kps4vgzc9h2cgg41c8vlqmdbwclfky7c4haq";
   })
-  (fetchNuGet {
-    name = "Newtonsoft.Json";
-    version = "11.0.1";
-    sha256 = "1z68j07if1xf71lbsrgbia52r812i2dv541sy44ph4dzjjp7pd4m";
-  })
   (fetchNuGet {
     name = "Newtonsoft.Json";
     version = "11.0.2";
@@ -921,8 +916,8 @@
   })
   (fetchNuGet {
     name = "Selenium.WebDriver.ChromeDriver";
-    version = "87.0.4280.8800";
-    sha256 = "1zrizydlhjv81r1fa5g8wzxrx1cxly3ip7pargj48hdx419iblfr";
+    version = "88.0.4324.9600";
+    sha256 = "0jm8dpfp329xsrg69lzq2m6x9yin1m43qgrhs15cz2qx9f02pdx9";
   })
   (fetchNuGet {
     name = "Selenium.WebDriver";
diff --git a/pkgs/applications/editors/bluefish/default.nix b/pkgs/applications/editors/bluefish/default.nix
index 2507cb13d7a..59d1f11312d 100644
--- a/pkgs/applications/editors/bluefish/default.nix
+++ b/pkgs/applications/editors/bluefish/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchurl, intltool, wrapGAppsHook, pkg-config , gtk, libxml2
-, enchant, gucharmap, python, gnome3
+, enchant, gucharmap, python3, gnome3
 }:
 
 stdenv.mkDerivation rec {
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ intltool pkg-config wrapGAppsHook ];
   buildInputs = [ gnome3.adwaita-icon-theme gtk libxml2
-    enchant gucharmap python ];
+    enchant gucharmap python3 ];
 
   meta = with lib; {
     description = "A powerful editor targeted towards programmers and webdevelopers";
diff --git a/pkgs/applications/graphics/dia/default.nix b/pkgs/applications/graphics/dia/default.nix
index d9de3eb7fc1..d07904c8597 100644
--- a/pkgs/applications/graphics/dia/default.nix
+++ b/pkgs/applications/graphics/dia/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchgit, autoconf, automake, libtool, gtk2, pkg-config, perlPackages,
-libxml2, gettext, python, libxml2Python, docbook5, docbook_xsl,
+libxml2, gettext, python2, libxml2Python, docbook5, docbook_xsl,
 libxslt, intltool, libart_lgpl, withGNOME ? false, libgnomeui,
 gtk-mac-integration-gtk2 }:
 
@@ -18,7 +18,7 @@ stdenv.mkDerivation {
   ];
 
   buildInputs =
-    [ gtk2 libxml2 gettext python libxml2Python docbook5
+    [ gtk2 libxml2 gettext python2 libxml2Python docbook5
       libxslt docbook_xsl libart_lgpl ]
       ++ lib.optional withGNOME libgnomeui
       ++ lib.optional stdenv.isDarwin gtk-mac-integration-gtk2;
diff --git a/pkgs/applications/misc/bashSnippets/default.nix b/pkgs/applications/misc/bashSnippets/default.nix
index d50f3637988..52d56d5c8f5 100644
--- a/pkgs/applications/misc/bashSnippets/default.nix
+++ b/pkgs/applications/misc/bashSnippets/default.nix
@@ -1,10 +1,10 @@
 { stdenv, lib, fetchFromGitHub, makeWrapper
-, curl, python, bind, iproute, bc, gitMinimal }:
+, curl, python3, bind, iproute, bc, gitMinimal }:
 let
   version = "1.23.0";
   deps = lib.makeBinPath [
     curl
-    python
+    python3
     bind.dnsutils
     iproute
     bc
@@ -24,11 +24,13 @@ stdenv.mkDerivation {
 
   nativeBuildInputs = [ makeWrapper ];
 
-  patchPhase = ''
+  postPatch = ''
     patchShebangs install.sh
     substituteInPlace install.sh --replace /usr/local "$out"
   '';
 
+  strictDeps = true;
+
   dontBuild = true;
 
   installPhase = ''
diff --git a/pkgs/applications/misc/cherrytree/default.nix b/pkgs/applications/misc/cherrytree/default.nix
index c74ac5ffb30..0ce89afa6ce 100644
--- a/pkgs/applications/misc/cherrytree/default.nix
+++ b/pkgs/applications/misc/cherrytree/default.nix
@@ -1,6 +1,6 @@
-{ lib, fetchFromGitHub, pythonPackages, gettext }:
+{ lib, fetchFromGitHub, python2Packages, gettext }:
 
-pythonPackages.buildPythonApplication rec {
+python2Packages.buildPythonApplication rec {
   pname = "cherrytree";
   version = "0.39.4";
 
@@ -14,7 +14,7 @@ pythonPackages.buildPythonApplication rec {
 
   nativeBuildInputs = [ gettext ];
 
-  propagatedBuildInputs = with pythonPackages; [ pygtk dbus-python pygtksourceview ];
+  propagatedBuildInputs = with python2Packages; [ pygtk dbus-python pygtksourceview ];
 
   patches = [ ./subprocess.patch ];
 
diff --git a/pkgs/applications/misc/curabydagoma/default.nix b/pkgs/applications/misc/curabydagoma/default.nix
index 821b88f9b20..a8d041de107 100644
--- a/pkgs/applications/misc/curabydagoma/default.nix
+++ b/pkgs/applications/misc/curabydagoma/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, runtimeShell, lib, fetchurl, python, pythonPackages, unzip }:
+{ stdenv, runtimeShell, lib, fetchurl, python2Packages, unzip }:
 
 # This package uses a precompiled "binary" distribution of CuraByDagoma,
 # distributed by the editor.
@@ -13,7 +13,9 @@
 # I guess people owning a 3D printer generally don't use i686.
 # If, however, someone needs it, we certainly can find a solution.
 
-stdenv.mkDerivation rec {
+let
+  pythonPackages = python2Packages;
+in stdenv.mkDerivation rec {
   pname = "curabydagoma";
   # Version is the date, UNIX format
   version = "1520506579";
@@ -26,7 +28,7 @@ stdenv.mkDerivation rec {
   };
   unpackCmd = "unzip $curSrc && tar zxf CuraByDagoma_amd64.tar.gz";
   nativeBuildInputs = [ unzip ];
-  buildInputs = [ python pythonPackages.pyopengl pythonPackages.wxPython pythonPackages.pyserial pythonPackages.numpy ];
+  buildInputs = [ pythonPackages.python pythonPackages.pyopengl pythonPackages.wxPython pythonPackages.pyserial pythonPackages.numpy ];
 
   # Compile all pyc files because the included pyc files may be older than the
   # py files. However, Python doesn't realize that because the packages
@@ -46,7 +48,7 @@ stdenv.mkDerivation rec {
     cat > $out/bin/curabydago <<EOF
     #!${runtimeShell}
     export PYTHONPATH=$PYTHONPATH
-    ${python.out}/bin/python $out/curabydago/cura.py
+    ${pythonPackages.python.interpreter} $out/curabydago/cura.py
     EOF
     chmod a+x $out/bin/curabydago
 
diff --git a/pkgs/applications/misc/dockbarx/default.nix b/pkgs/applications/misc/dockbarx/default.nix
index b31c17cc319..5bc8de522de 100644
--- a/pkgs/applications/misc/dockbarx/default.nix
+++ b/pkgs/applications/misc/dockbarx/default.nix
@@ -1,6 +1,6 @@
-{ lib, fetchFromGitHub, pythonPackages, gnome2, keybinder }:
+{ lib, fetchFromGitHub, python2Packages, gnome2, keybinder }:
 
-pythonPackages.buildPythonApplication rec {
+python2Packages.buildPythonApplication rec {
   ver = "0.93";
   name = "dockbarx-${ver}";
 
@@ -24,7 +24,7 @@ pythonPackages.buildPythonApplication rec {
     substituteInPlace dockx_applets/volume-control.py         --replace /usr/share/             $out/share/
   '';
 
-  propagatedBuildInputs = (with pythonPackages; [ pygtk pyxdg dbus-python pillow xlib ])
+  propagatedBuildInputs = (with python2Packages; [ pygtk pyxdg dbus-python pillow xlib ])
     ++ (with gnome2; [ gnome_python gnome_python_desktop ])
     ++ [ keybinder ];
 
diff --git a/pkgs/applications/misc/dotfiles/default.nix b/pkgs/applications/misc/dotfiles/default.nix
index 911a319a963..b62d154feb1 100644
--- a/pkgs/applications/misc/dotfiles/default.nix
+++ b/pkgs/applications/misc/dotfiles/default.nix
@@ -1,10 +1,10 @@
-{ lib, pythonPackages }:
+{ lib, python3Packages }:
 
-pythonPackages.buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
   pname = "dotfiles";
   version = "0.6.4";
 
-  src = pythonPackages.fetchPypi {
+  src = python3Packages.fetchPypi {
     inherit version pname;
     sha256 = "03qis6m9r2qh00sqbgwsm883s4bj1ibwpgk86yh4l235mdw8jywv";
   };
@@ -12,8 +12,8 @@ pythonPackages.buildPythonApplication rec {
   # No tests in archive
   doCheck = false;
 
-  checkInputs = with pythonPackages; [ pytest ];
-  propagatedBuildInputs = with pythonPackages; [ click ];
+  checkInputs = with python3Packages; [ pytest ];
+  propagatedBuildInputs = with python3Packages; [ click ];
 
   meta = with lib; {
     description = "Easily manage your dotfiles";
diff --git a/pkgs/applications/misc/gammu/default.nix b/pkgs/applications/misc/gammu/default.nix
index 0a6796a9b07..736685f5eb1 100644
--- a/pkgs/applications/misc/gammu/default.nix
+++ b/pkgs/applications/misc/gammu/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, python, pkg-config, cmake, bluez, libusb1, curl
+{ lib, stdenv, fetchFromGitHub, pkg-config, cmake, bluez, libusb1, curl
 , libiconv, gettext, sqlite
 , dbiSupport ? false, libdbi ? null, libdbiDrivers ? null
 , postgresSupport ? false, postgresql ? null
@@ -21,7 +21,9 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ pkg-config cmake ];
 
-  buildInputs = [ python bluez libusb1 curl gettext sqlite libiconv ]
+  strictDeps = true;
+
+  buildInputs = [ bluez libusb1 curl gettext sqlite libiconv ]
   ++ optionals dbiSupport [ libdbi libdbiDrivers ]
   ++ optionals postgresSupport [ postgresql ];
 
diff --git a/pkgs/applications/networking/browsers/chromium/upstream-info.json b/pkgs/applications/networking/browsers/chromium/upstream-info.json
index d45f21d3603..723ea6235c2 100644
--- a/pkgs/applications/networking/browsers/chromium/upstream-info.json
+++ b/pkgs/applications/networking/browsers/chromium/upstream-info.json
@@ -18,9 +18,9 @@
     }
   },
   "beta": {
-    "version": "90.0.4430.30",
-    "sha256": "01b6naziii72pvw35wphfqz3inih75is038yf1mdp1847jbvxpwp",
-    "sha256bin64": "0k48mfzmyjb0w75fkm2j7ll340qgmzvmskz12awc2l19hgnw1s8p",
+    "version": "90.0.4430.40",
+    "sha256": "0n7g4j981h3fn5wgpb3azpili9682nq0yikhd4z7dr7agvpnfr3k",
+    "sha256bin64": "120rbh8bpcj3z5kqdaicqnsd2mh0xcr8y1411kl0zpwa6hfvgm3r",
     "deps": {
       "gn": {
         "version": "2021-02-09",
diff --git a/pkgs/applications/networking/cluster/helmsman/default.nix b/pkgs/applications/networking/cluster/helmsman/default.nix
index 32ecc8b7c17..ed828feefda 100644
--- a/pkgs/applications/networking/cluster/helmsman/default.nix
+++ b/pkgs/applications/networking/cluster/helmsman/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "helmsman";
-  version = "3.6.5";
+  version = "3.6.6";
 
   src = fetchFromGitHub {
     owner = "Praqma";
     repo = "helmsman";
     rev = "v${version}";
-    sha256 = "sha256-FOBSGXVIb4mLDHMqOljZ04W0q/H/HOuFm9Cl2kK027s=";
+    sha256 = "sha256-SGVch7mMtHi5GYFOrSss4dk29aRTQmBzkPYOetPdF88=";
   };
 
   vendorSha256 = "sha256-mktq5Dnk1mBO2yy5SeMDxa/akXdO5i2WafMTGtH53H8=";
diff --git a/pkgs/applications/networking/instant-messengers/bitlbee/default.nix b/pkgs/applications/networking/instant-messengers/bitlbee/default.nix
index 1a83a04a1fa..c5a718c3a70 100644
--- a/pkgs/applications/networking/instant-messengers/bitlbee/default.nix
+++ b/pkgs/applications/networking/instant-messengers/bitlbee/default.nix
@@ -1,4 +1,4 @@
-{ lib, fetchurl, fetchpatch, stdenv, gnutls, glib, pkg-config, check, libotr, python
+{ lib, fetchurl, fetchpatch, stdenv, gnutls, glib, pkg-config, check, libotr, python2
 , enableLibPurple ? false, pidgin ? null
 , enablePam ? false, pam ? null
 }:
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ pkg-config ] ++ optional doCheck check;
 
-  buildInputs = [ gnutls libotr python ]
+  buildInputs = [ gnutls libotr python2 ]
     ++ optional enableLibPurple pidgin
     ++ optional enablePam pam;
 
diff --git a/pkgs/applications/networking/instant-messengers/blink/default.nix b/pkgs/applications/networking/instant-messengers/blink/default.nix
index 3ee835610f7..805278b4e45 100644
--- a/pkgs/applications/networking/instant-messengers/blink/default.nix
+++ b/pkgs/applications/networking/instant-messengers/blink/default.nix
@@ -1,7 +1,7 @@
-{ lib, fetchdarcs, pythonPackages, libvncserver, zlib
+{ lib, fetchdarcs, python2Packages, libvncserver, zlib
 , gnutls, libvpx, makeDesktopItem, mkDerivationWith }:
 
-mkDerivationWith pythonPackages.buildPythonApplication rec {
+mkDerivationWith python2Packages.buildPythonApplication rec {
 
   pname = "blink";
   version = "3.2.0";
@@ -17,7 +17,7 @@ mkDerivationWith pythonPackages.buildPythonApplication rec {
     sed -i 's|@out@|'"''${out}"'|g' blink/resources.py
   '';
 
-  propagatedBuildInputs = with pythonPackages; [
+  propagatedBuildInputs = with python2Packages; [
     pyqt5_with_qtwebkit
     cjson
     sipsimple
@@ -26,7 +26,7 @@ mkDerivationWith pythonPackages.buildPythonApplication rec {
   ];
 
   buildInputs = [
-    pythonPackages.cython
+    python2Packages.cython
     zlib
     libvncserver
     libvpx
diff --git a/pkgs/applications/radio/direwolf/default.nix b/pkgs/applications/radio/direwolf/default.nix
index e7da78034cc..4f8ca550490 100644
--- a/pkgs/applications/radio/direwolf/default.nix
+++ b/pkgs/applications/radio/direwolf/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchFromGitHub, cmake, alsaLib, espeak, glibc, gpsd
-, hamlib, perl, python, udev }:
+, hamlib, perl, python3, udev }:
 
 with lib;
 
@@ -16,8 +16,10 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake ];
 
+  strictDeps = true;
+
   buildInputs = [
-    espeak gpsd hamlib perl python
+    espeak gpsd hamlib perl python3
   ] ++ (optionals stdenv.isLinux [alsaLib udev]);
 
   patches = [
diff --git a/pkgs/applications/science/biology/bcftools/default.nix b/pkgs/applications/science/biology/bcftools/default.nix
index e15cac60295..80506bb79b6 100644
--- a/pkgs/applications/science/biology/bcftools/default.nix
+++ b/pkgs/applications/science/biology/bcftools/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, htslib, zlib, bzip2, lzma, curl, perl, python, bash }:
+{ lib, stdenv, fetchurl, htslib, zlib, bzip2, lzma, curl, perl, python3, bash }:
 
 stdenv.mkDerivation rec {
   pname = "bcftools";
@@ -9,7 +9,14 @@ stdenv.mkDerivation rec {
     sha256 = "0r508mp15pqzf8r1269kb4v5naw9zsvbwd3cz8s1yj7carsf9viw";
   };
 
-  buildInputs = [ htslib zlib bzip2 lzma curl perl python ];
+  nativeBuildInputs = [
+    perl
+    python3
+  ];
+
+  buildInputs = [ htslib zlib bzip2 lzma curl ];
+
+  strictDeps = true;
 
   makeFlags = [
     "HSTDIR=${htslib}"
diff --git a/pkgs/applications/science/biology/bedtools/default.nix b/pkgs/applications/science/biology/bedtools/default.nix
index d0553bb0649..f5aad5d0554 100644
--- a/pkgs/applications/science/biology/bedtools/default.nix
+++ b/pkgs/applications/science/biology/bedtools/default.nix
@@ -1,4 +1,4 @@
-{lib, stdenv, fetchFromGitHub, zlib, python, bzip2, lzma}:
+{lib, stdenv, fetchFromGitHub, zlib, python3, bzip2, lzma}:
 
 stdenv.mkDerivation rec {
   pname = "bedtools";
@@ -11,7 +11,13 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-NqKldF7ePJn3pT+AkESIQghBKSFFOEBBsTaKEbU+oaQ=";
   };
 
-  buildInputs = [ zlib python bzip2 lzma ];
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    python3
+  ];
+
+  buildInputs = [ zlib bzip2 lzma ];
   cxx = if stdenv.cc.isClang then "clang++" else "g++";
   cc = if stdenv.cc.isClang then "clang" else "gcc";
   buildPhase = "make prefix=$out SHELL=${stdenv.shell} CXX=${cxx} CC=${cc} -j $NIX_BUILD_CORES";
diff --git a/pkgs/applications/virtualization/seabios/default.nix b/pkgs/applications/virtualization/seabios/default.nix
index f97f13dab2a..42e1eaf56d4 100644
--- a/pkgs/applications/virtualization/seabios/default.nix
+++ b/pkgs/applications/virtualization/seabios/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, iasl, python }:
+{ lib, stdenv, fetchurl, iasl, python3 }:
 
 stdenv.mkDerivation rec {
 
@@ -10,7 +10,11 @@ stdenv.mkDerivation rec {
     sha256 = "1zc1brgafbbf5hmdr1qc1p859cabpz73l8sklq83xa4sn9icqw7b";
   };
 
-  buildInputs = [ iasl python ];
+  nativeBuildInputs = [ python3 ];
+
+  buildInputs = [ iasl ];
+
+  strictDeps = true;
 
   hardeningDisable = [ "pic" "stackprotector" "fortify" ];
 
diff --git a/pkgs/data/misc/conway_polynomials/default.nix b/pkgs/data/misc/conway_polynomials/default.nix
index f7da9381e61..cabc28a89ce 100644
--- a/pkgs/data/misc/conway_polynomials/default.nix
+++ b/pkgs/data/misc/conway_polynomials/default.nix
@@ -1,13 +1,13 @@
 { lib, stdenv
 , fetchurl
-, python
+, python2
 }:
 
 stdenv.mkDerivation rec {
   pname = "conway_polynomials";
   version = "0.5";
 
-  pythonEnv = python.withPackages (ps: with ps; [ six ]);
+  pythonEnv = python2.withPackages (ps: with ps; [ six ]);
 
   src = fetchurl {
     url = "mirror://sageupstream/conway_polynomials/conway_polynomials-${version}.tar.bz2";
diff --git a/pkgs/data/misc/elliptic_curves/default.nix b/pkgs/data/misc/elliptic_curves/default.nix
index 988716f5429..98259400021 100644
--- a/pkgs/data/misc/elliptic_curves/default.nix
+++ b/pkgs/data/misc/elliptic_curves/default.nix
@@ -1,6 +1,6 @@
 { lib, stdenv
 , fetchurl
-, python
+, python2
 }:
 
 stdenv.mkDerivation rec {
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
     export SAGE_SHARE="$out/share"
     export PYTHONPATH=$PWD
 
-    ${python.interpreter} ${spkg-install}
+    ${python2.interpreter} ${spkg-install}
   '';
 
   meta = with lib; {
diff --git a/pkgs/data/misc/libkkc-data/default.nix b/pkgs/data/misc/libkkc-data/default.nix
index 96130b2de5e..7fcd2fbf516 100644
--- a/pkgs/data/misc/libkkc-data/default.nix
+++ b/pkgs/data/misc/libkkc-data/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, marisa, libkkc }:
+{ lib, stdenv, fetchurl, python2, libkkc }:
 
 stdenv.mkDerivation rec {
   pname = "libkkc-data";
@@ -9,7 +9,9 @@ stdenv.mkDerivation rec {
     sha256 = "16avb50jasq2f1n9xyziky39dhlnlad0991pisk3s11hl1aqfrwy";
   };
 
-  nativeBuildInputs = [ marisa ];
+  nativeBuildInputs = [ python2.pkgs.marisa ];
+
+  strictDeps = true;
 
   meta = with lib; {
     description = "Language model data package for libkkc";
diff --git a/pkgs/desktops/gnome-3/extensions/unite/default.nix b/pkgs/desktops/gnome-3/extensions/unite/default.nix
index 1949b97fafb..b6fae261ea1 100644
--- a/pkgs/desktops/gnome-3/extensions/unite/default.nix
+++ b/pkgs/desktops/gnome-3/extensions/unite/default.nix
@@ -1,13 +1,13 @@
-{ lib, stdenv, gnome3, fetchFromGitHub, xprop, glib, coreutils }:
+{ lib, stdenv, gnome3, fetchFromGitHub, xprop, glib }:
 stdenv.mkDerivation rec {
   pname = "gnome-shell-extension-unite";
-  version = "45";
+  version = "47";
 
   src = fetchFromGitHub {
     owner = "hardpixel";
     repo = "unite-shell";
     rev = "v${version}";
-    sha256 = "sha256-ghmCnzlPvxHEy2ro1AL+T2yiavJVrPhRfIKbMBwMjac=";
+    sha256 = "1ia8x5mqwsd5gv7sg981h2ngcr3jdr60947iqvnp6xqcw4rc72lr";
   };
 
   uuid = "unite@hardpixel.eu";
diff --git a/pkgs/development/compilers/cmdstan/default.nix b/pkgs/development/compilers/cmdstan/default.nix
index df674b67db8..c52ffa0bafd 100644
--- a/pkgs/development/compilers/cmdstan/default.nix
+++ b/pkgs/development/compilers/cmdstan/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, python, runtimeShell }:
+{ lib, stdenv, fetchurl, python3, runtimeShell }:
 
 stdenv.mkDerivation {
   name = "cmdstan-2.17.1";
@@ -12,7 +12,7 @@ stdenv.mkDerivation {
   enableParallelBuilding = true;
 
   doCheck = true;
-  checkInputs = [ python ];
+  checkInputs = [ python3 ];
   checkPhase = "python ./runCmdStanTests.py src/test/interface"; # see #5368
 
   installPhase = ''
diff --git a/pkgs/development/compilers/dtc/default.nix b/pkgs/development/compilers/dtc/default.nix
index c5d33590daa..245e5bf2f54 100644
--- a/pkgs/development/compilers/dtc/default.nix
+++ b/pkgs/development/compilers/dtc/default.nix
@@ -1,7 +1,9 @@
 { stdenv, lib, fetchgit, flex, bison, pkg-config, which
-, pythonSupport ? false, python, swig
+, pythonSupport ? false, python ? null, swig
 }:
 
+assert pythonSupport -> python != null;
+
 stdenv.mkDerivation rec {
   pname = "dtc";
   version = "1.6.0";
diff --git a/pkgs/development/interpreters/cling/default.nix b/pkgs/development/interpreters/cling/default.nix
index 8f80d2f4ee6..dbc2751e789 100644
--- a/pkgs/development/interpreters/cling/default.nix
+++ b/pkgs/development/interpreters/cling/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv
-, python
+, python3
 , libffi
 , git
 , cmake
@@ -38,9 +38,11 @@ let
       chmod -R a+w ./tools/cling
     '';
 
-    nativeBuildInputs = [ python git cmake ];
+    nativeBuildInputs = [ python3 git cmake ];
     buildInputs = [ libffi llvmPackages_5.llvm zlib ];
 
+    strictDeps = true;
+
     cmakeFlags = [
       "-DLLVM_TARGETS_TO_BUILD=host;NVPTX"
       "-DLLVM_ENABLE_RTTI=ON"
diff --git a/pkgs/development/libraries/arrayfire/default.nix b/pkgs/development/libraries/arrayfire/default.nix
index c636d672332..a66db480017 100644
--- a/pkgs/development/libraries/arrayfire/default.nix
+++ b/pkgs/development/libraries/arrayfire/default.nix
@@ -1,7 +1,7 @@
 { lib, stdenv, fetchurl, fetchFromGitHub, cmake, pkg-config
 , opencl-clhpp, ocl-icd, fftw, fftwFloat
 , blas, lapack, boost, mesa, libGLU, libGL
-, freeimage, python, clfft, clblas
+, freeimage, python3, clfft, clblas
 , doxygen, buildDocs ? false
 , cudaSupport ? false, cudatoolkit
 }:
@@ -39,9 +39,11 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [
     cmake
     pkg-config
-    python
+    python3
   ];
 
+  strictDeps = true;
+
   buildInputs = [
     opencl-clhpp fftw fftwFloat
     blas lapack
diff --git a/pkgs/development/libraries/aubio/default.nix b/pkgs/development/libraries/aubio/default.nix
index 7aa4859ef0e..b1c6c6396c8 100644
--- a/pkgs/development/libraries/aubio/default.nix
+++ b/pkgs/development/libraries/aubio/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchurl, alsaLib, fftw, libjack2, libsamplerate
-, libsndfile, pkg-config, python, wafHook
+, libsndfile, pkg-config, python3, wafHook
 }:
 
 stdenv.mkDerivation rec {
@@ -10,9 +10,11 @@ stdenv.mkDerivation rec {
     sha256 = "1npks71ljc48w6858l9bq30kaf5nph8z0v61jkfb70xb9np850nl";
   };
 
-  nativeBuildInputs = [ pkg-config python wafHook ];
+  nativeBuildInputs = [ pkg-config python3 wafHook ];
   buildInputs = [ alsaLib fftw libjack2 libsamplerate libsndfile ];
 
+  strictDeps = true;
+
   meta = with lib; {
     description = "Library for audio labelling";
     homepage = "https://aubio.org/";
diff --git a/pkgs/development/libraries/botan/generic.nix b/pkgs/development/libraries/botan/generic.nix
index 0369f603b8e..33f9daf7b50 100644
--- a/pkgs/development/libraries/botan/generic.nix
+++ b/pkgs/development/libraries/botan/generic.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, python, bzip2, zlib, gmp, openssl, boost
+{ lib, stdenv, fetchurl, python3, bzip2, zlib, gmp, openssl, boost
 # Passed by version specific builders
 , baseVersion, revision, sha256
 , sourceExtension ? "tar.xz"
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
   };
   inherit postPatch;
 
-  buildInputs = [ python bzip2 zlib gmp openssl boost ]
+  buildInputs = [ python3 bzip2 zlib gmp openssl boost ]
     ++ lib.optionals stdenv.isDarwin [ CoreServices Security ];
 
   configurePhase = ''
diff --git a/pkgs/development/libraries/clearsilver/default.nix b/pkgs/development/libraries/clearsilver/default.nix
index 74d167144a9..73ffd6c12b2 100644
--- a/pkgs/development/libraries/clearsilver/default.nix
+++ b/pkgs/development/libraries/clearsilver/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, fetchpatch, python }:
+{ lib, stdenv, fetchurl, fetchpatch, python2 }:
 
 stdenv.mkDerivation rec {
   name = "clearsilver-0.10.5";
@@ -8,10 +8,10 @@ stdenv.mkDerivation rec {
     sha256 = "1046m1dpq3nkgxbis2dr2x7hynmy51n64465q78d7pdgvqwa178y";
   };
 
-  PYTHON_SITE = "$(out)/site-packages";
+  PYTHON_SITE = "${placeholder "out"}/${python2.sitePackages}";
 
   configureFlags = [
-    "--with-python=${python}/bin/python"
+    "--with-python=${python2.interpreter}"
     "--disable-apache"
     "--disable-perl"
     "--disable-ruby"
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
 
   preInstall = ''
     mkdir -p $out
-    mkdir -p $out/site-packages
+    mkdir -p $out/${python2.sitePackages}
   '';
 
   patches = [
diff --git a/pkgs/development/libraries/cppcms/default.nix b/pkgs/development/libraries/cppcms/default.nix
index aceb2d61e38..e0f9ed59912 100644
--- a/pkgs/development/libraries/cppcms/default.nix
+++ b/pkgs/development/libraries/cppcms/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, cmake, pcre, zlib, python, openssl }:
+{ lib, stdenv, fetchurl, cmake, pcre, zlib, python2, openssl }:
 
 stdenv.mkDerivation rec {
   pname = "cppcms";
@@ -10,7 +10,9 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ cmake ];
-  buildInputs = [ pcre zlib python openssl ];
+  buildInputs = [ pcre zlib python2 openssl ];
+
+  strictDeps = true;
 
   cmakeFlags = [
     "--no-warn-unused-cli"
diff --git a/pkgs/development/libraries/docopt_cpp/default.nix b/pkgs/development/libraries/docopt_cpp/default.nix
index f9456b8acac..3de84b684e5 100644
--- a/pkgs/development/libraries/docopt_cpp/default.nix
+++ b/pkgs/development/libraries/docopt_cpp/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, cmake, python }:
+{ lib, stdenv, fetchFromGitHub, cmake, python2 }:
 
 stdenv.mkDerivation rec {
   version = "0.6.3";
@@ -11,10 +11,12 @@ stdenv.mkDerivation rec {
     sha256 = "0cz3vv7g5snfbsqcf3q8bmd6kv5qp84gj3avwkn4vl00krw13bl7";
   };
 
-  nativeBuildInputs = [ cmake python ];
+  nativeBuildInputs = [ cmake python2 ];
 
   cmakeFlags = ["-DWITH_TESTS=ON"];
 
+  strictDeps = true;
+
   doCheck = true;
 
   postPatch = ''
diff --git a/pkgs/development/libraries/gaia/default.nix b/pkgs/development/libraries/gaia/default.nix
index 088354aecb2..47926e2ec0b 100644
--- a/pkgs/development/libraries/gaia/default.nix
+++ b/pkgs/development/libraries/gaia/default.nix
@@ -9,7 +9,7 @@
 , wafHook
 , makeWrapper
 , qt4
-, pythonPackages
+, pythonPackages ? null
 , pythonSupport ? false
 # Default to false since it breaks the build, see https://github.com/MTG/gaia/issues/11
 , stlfacadeSupport ? false
diff --git a/pkgs/development/libraries/galario/default.nix b/pkgs/development/libraries/galario/default.nix
index 888f26f2da7..4e28f84bacd 100644
--- a/pkgs/development/libraries/galario/default.nix
+++ b/pkgs/development/libraries/galario/default.nix
@@ -5,7 +5,7 @@
 , fftw
 , fftwFloat
 , enablePython ? false
-, pythonPackages
+, pythonPackages ? null
 , llvmPackages
 }:
 let
diff --git a/pkgs/development/libraries/ganv/default.nix b/pkgs/development/libraries/ganv/default.nix
index bf6c030589b..d53206ca667 100644
--- a/pkgs/development/libraries/ganv/default.nix
+++ b/pkgs/development/libraries/ganv/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchgit, graphviz, gtk2, gtkmm2, pkg-config, python, wafHook }:
+{ lib, stdenv, fetchgit, graphviz, gtk2, gtkmm2, pkg-config, python3, wafHook }:
 
 stdenv.mkDerivation rec {
   pname = "ganv";
@@ -11,8 +11,10 @@ stdenv.mkDerivation rec {
     sha256 = "01znnalirbqxpz62fbw2c14c8xn117jc92xv6dhb3hln92k9x37f";
   };
 
-  nativeBuildInputs = [ pkg-config wafHook ];
-  buildInputs = [ graphviz gtk2 gtkmm2 python ];
+  nativeBuildInputs = [ pkg-config wafHook python3 gtk2 ];
+  buildInputs = [ graphviz gtkmm2 ];
+
+  strictDeps = true;
 
   meta = with lib; {
     description = "An interactive Gtk canvas widget for graph-based interfaces";
diff --git a/pkgs/development/libraries/gtksourceview/4.x.nix b/pkgs/development/libraries/gtksourceview/4.x.nix
index 72646fc198b..9ead894e0d2 100644
--- a/pkgs/development/libraries/gtksourceview/4.x.nix
+++ b/pkgs/development/libraries/gtksourceview/4.x.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, pkg-config, atk, cairo, glib, gtk3, pango, fribidi, vala
+{ lib, stdenv, fetchurl, fetchpatch, pkg-config, atk, cairo, glib, gtk3, pango, fribidi, vala
 , libxml2, perl, gettext, gnome3, gobject-introspection, dbus, xvfb_run, shared-mime-info
 , meson, ninja }:
 
@@ -26,7 +26,16 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ atk cairo glib pango fribidi libxml2 ];
 
-  patches = [ ./4.x-nix_share_path.patch ];
+  patches = [
+    ./4.x-nix_share_path.patch
+
+    # fixes intermittent "gtksourceview-gresources.h: no such file" errors
+    (fetchpatch {
+      name = "ensure-access-to-resources-in-corelib-build.patch";
+      url = "https://gitlab.gnome.org/GNOME/gtksourceview/-/commit/9bea9d1c4a56310701717bb106c52a5324ee392a.patch";
+      sha256 = "sha256-rSB6lOFEyz58HfOSj7ZM48/tHxhqbtWWbh60JuySAZ0=";
+    })
+  ];
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/development/libraries/jxrlib/default.nix b/pkgs/development/libraries/jxrlib/default.nix
index 78cc48d8209..b2cc4ab08b4 100644
--- a/pkgs/development/libraries/jxrlib/default.nix
+++ b/pkgs/development/libraries/jxrlib/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, python }:
+{ lib, stdenv, fetchFromGitHub, python3 }:
 
 stdenv.mkDerivation rec {
   pname = "jxrlib";
@@ -19,7 +19,9 @@ stdenv.mkDerivation rec {
       --replace '.so' '.dylib'
   '';
 
-  nativeBuildInputs = [ python ];
+  nativeBuildInputs = [ python3 ];
+
+  strictDeps = true;
 
   makeFlags = [ "DIR_INSTALL=$(out)" "SHARED=1" ];
 
diff --git a/pkgs/development/libraries/leveldb/default.nix b/pkgs/development/libraries/leveldb/default.nix
index 0a1dabef328..2a7fb196ea6 100644
--- a/pkgs/development/libraries/leveldb/default.nix
+++ b/pkgs/development/libraries/leveldb/default.nix
@@ -13,25 +13,28 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ snappy ];
 
-  nativeBuildInputs = []
-    ++ lib.optional stdenv.isDarwin fixDarwinDylibNames;
+  nativeBuildInputs = lib.optional stdenv.isDarwin fixDarwinDylibNames;
 
-  buildPhase = ''
-    make all
+  doCheck = true;
+
+  buildFlags = [ "all" ];
+
+  postPatch = lib.optionalString stdenv.hostPlatform.isStatic ''
+    # remove shared objects from "all" target
+    sed -i '/^all:/ s/$(SHARED_LIBS) $(SHARED_PROGRAMS)//' Makefile
   '';
 
-  installPhase = "
-    mkdir -p $out/{bin,lib,include}
+  installPhase = ''
+    runHook preInstall
 
-    cp -r include $out
-    mkdir -p $out/include/leveldb/helpers
-    cp helpers/memenv/memenv.h $out/include/leveldb/helpers
+    install -D -t $out/include/leveldb include/leveldb/*
+    install -D helpers/memenv/memenv.h $out/include/leveldb/helpers
 
-    cp out-shared/lib* $out/lib
-    cp out-static/lib* $out/lib
+    install -D -t $out/lib out-{static,shared}/lib*
+    install -D -t $out/bin out-static/{leveldbutil,db_bench}
 
-    cp out-static/leveldbutil $out/bin
-  ";
+    runHook postInstall
+  '';
 
   meta = with lib; {
     homepage = "https://github.com/google/leveldb";
diff --git a/pkgs/development/libraries/opencl-clhpp/default.nix b/pkgs/development/libraries/opencl-clhpp/default.nix
index ec40bc393d5..b6aa7149168 100644
--- a/pkgs/development/libraries/opencl-clhpp/default.nix
+++ b/pkgs/development/libraries/opencl-clhpp/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, cmake, python, opencl-headers }:
+{ lib, stdenv, fetchFromGitHub, cmake, python3, opencl-headers }:
 
 stdenv.mkDerivation rec {
   pname = "opencl-clhpp";
@@ -11,10 +11,12 @@ stdenv.mkDerivation rec {
     sha256 = "04g3mg2cpbi048fxxkghra81bpxzqr4r3gspx5mvqipx1lzypsci";
   };
 
-  nativeBuildInputs = [ cmake python ];
+  nativeBuildInputs = [ cmake python3 ];
 
   propagatedBuildInputs = [ opencl-headers ];
 
+  strictDeps = true;
+
   cmakeFlags = [
     "-DBUILD_EXAMPLES=OFF"
     "-DBUILD_TESTS=OFF"
diff --git a/pkgs/development/libraries/opencv/3.x.nix b/pkgs/development/libraries/opencv/3.x.nix
index 11872cd47cc..a65e978f981 100644
--- a/pkgs/development/libraries/opencv/3.x.nix
+++ b/pkgs/development/libraries/opencv/3.x.nix
@@ -18,7 +18,7 @@
 
 , enableUnfree    ? false
 , enableIpp       ? false
-, enablePython    ? false, pythonPackages
+, enablePython    ? false, pythonPackages ? null
 , enableGtk2      ? false, gtk2
 , enableGtk3      ? false, gtk3
 , enableVtk       ? false, vtk
@@ -36,6 +36,8 @@
 
 assert blas.implementation == "openblas" && lapack.implementation == "openblas";
 
+assert enablePython -> pythonPackages != null;
+
 let
   version = "3.4.8";
 
diff --git a/pkgs/development/libraries/openssl/default.nix b/pkgs/development/libraries/openssl/default.nix
index d203d693af0..fda0c71655a 100644
--- a/pkgs/development/libraries/openssl/default.nix
+++ b/pkgs/development/libraries/openssl/default.nix
@@ -180,8 +180,8 @@ in {
   };
 
   openssl_1_1 = common {
-    version = "1.1.1j";
-    sha256 = "1gw17520vh13izy1xf5q0a2fqgcayymjjj5bk0dlkxndfnszrwma";
+    version = "1.1.1k";
+    sha256 = "1rdfzcrxy9y38wqdw5942vmdax9hjhgrprzxm42csal7p5shhal9";
     patches = [
       ./1.1/nix-ssl-cert-file.patch
 
diff --git a/pkgs/development/libraries/partio/default.nix b/pkgs/development/libraries/partio/default.nix
index 0247d12715f..d4af69532b3 100644
--- a/pkgs/development/libraries/partio/default.nix
+++ b/pkgs/development/libraries/partio/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, unzip, cmake, freeglut, libGLU, libGL, zlib, swig, python, doxygen, xorg }:
+{ lib, stdenv, fetchFromGitHub, unzip, cmake, freeglut, libGLU, libGL, zlib, swig, doxygen, xorg }:
 
 stdenv.mkDerivation {
   pname = "partio";
@@ -14,7 +14,7 @@ stdenv.mkDerivation {
   outputs = [ "dev" "out" "lib" ];
 
   nativeBuildInputs = [ unzip cmake doxygen ];
-  buildInputs = [ freeglut libGLU libGL zlib swig python xorg.libXi xorg.libXmu ];
+  buildInputs = [ freeglut libGLU libGL zlib swig xorg.libXi xorg.libXmu ];
 
   buildPhase = ''
     make partio
@@ -32,6 +32,8 @@ stdenv.mkDerivation {
     mv $dev/include/*.h $dev/include/partio
   '';
 
+  strictDeps = true;
+
   meta = with lib; {
     description = "C++ (with python bindings) library for easily reading/writing/manipulating common animation particle formats such as PDB, BGEO, PTC";
     homepage = "https://www.disneyanimation.com/technology/partio.html";
diff --git a/pkgs/development/libraries/science/math/clblas/default.nix b/pkgs/development/libraries/science/math/clblas/default.nix
index aca395001f9..fcb49d70a3b 100644
--- a/pkgs/development/libraries/science/math/clblas/default.nix
+++ b/pkgs/development/libraries/science/math/clblas/default.nix
@@ -4,7 +4,7 @@
 , gfortran
 , blas
 , boost
-, python
+, python3
 , ocl-icd
 , opencl-headers
 , Accelerate, CoreGraphics, CoreVideo, OpenCL
@@ -39,7 +39,7 @@ stdenv.mkDerivation rec {
   buildInputs = [
     gfortran
     blas
-    python
+    python3
     boost
   ] ++ lib.optionals (!stdenv.isDarwin) [
     ocl-icd
@@ -53,6 +53,8 @@ stdenv.mkDerivation rec {
     OpenCL
   ];
 
+  strictDeps = true;
+
   meta = with lib; {
     homepage = "https://github.com/clMathLibraries/clBLAS";
     description = "A software library containing BLAS functions written in OpenCL";
diff --git a/pkgs/development/libraries/silgraphite/graphite2.nix b/pkgs/development/libraries/silgraphite/graphite2.nix
index 166d0f2911d..cd737a82a29 100644
--- a/pkgs/development/libraries/silgraphite/graphite2.nix
+++ b/pkgs/development/libraries/silgraphite/graphite2.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, pkg-config, freetype, cmake, python }:
+{ lib, stdenv, fetchurl, pkg-config, freetype, cmake }:
 
 stdenv.mkDerivation rec {
   version = "1.3.14";
@@ -15,7 +15,6 @@ stdenv.mkDerivation rec {
 
   patches = lib.optionals stdenv.isDarwin [ ./macosx.patch ];
 
-  checkInputs = [ python ];
   doCheck = false; # fails, probably missing something
 
   meta = with lib; {
diff --git a/pkgs/development/ocaml-modules/eliom/default.nix b/pkgs/development/ocaml-modules/eliom/default.nix
index 4c845273d71..b8d90d0d2b7 100644
--- a/pkgs/development/ocaml-modules/eliom/default.nix
+++ b/pkgs/development/ocaml-modules/eliom/default.nix
@@ -1,6 +1,7 @@
 { stdenv, lib, fetchzip, which, ocsigen_server, ocaml,
   lwt_react,
   opaline, ppx_deriving, findlib
+, ocaml-migrate-parsetree
 , ppx_tools_versioned
 , js_of_ocaml-ocamlbuild, js_of_ocaml-ppx, js_of_ocaml-ppx_deriving_json
 , js_of_ocaml-lwt
@@ -22,7 +23,9 @@ stdenv.mkDerivation rec
     sha256 = "00m6v2k4mg8705dy41934lznl6gj91i6dk7p1nkaccm51nna25kz";
   };
 
-  buildInputs = [ ocaml which findlib js_of_ocaml-ocamlbuild js_of_ocaml-ppx_deriving_json opaline
+  buildInputs = [ ocaml which findlib js_of_ocaml-ocamlbuild
+    ocaml-migrate-parsetree
+    js_of_ocaml-ppx_deriving_json opaline
     ppx_tools_versioned
   ];
 
diff --git a/pkgs/development/ocaml-modules/janestreet/0.14.nix b/pkgs/development/ocaml-modules/janestreet/0.14.nix
index 0bcdd78095c..738828e8308 100644
--- a/pkgs/development/ocaml-modules/janestreet/0.14.nix
+++ b/pkgs/development/ocaml-modules/janestreet/0.14.nix
@@ -182,7 +182,8 @@ rec {
 
   base_quickcheck = janePackage {
     pname = "base_quickcheck";
-    hash = "1lmp1h68g0gqiw8m6gqcbrp0fn76nsrlsqrwxp20d7jhh0693f3j";
+    version = "0.14.1";
+    hash = "0apq3d9xb0zdaqsl4cjk5skyig57ff1plndb2mh0nn3czvfhifxs";
     minimumOCamlVersion = "4.04.2";
     meta.description = "Randomized testing framework, designed for compatibility with Base";
     propagatedBuildInputs = [ ppx_base ppx_fields_conv ppx_let ppx_sexp_value splittable_random ];
@@ -450,7 +451,8 @@ rec {
 
   ppx_custom_printf = janePackage {
     pname = "ppx_custom_printf";
-    hash = "0p9hgx0krxqw8hlzfv2bg2m3zi5nxsnzhyp0fj5936rapad02hc5";
+    version = "0.14.1";
+    hash = "0c1m65kn27zvwmfwy7kk46ga76yw2a3ik9jygpy1b6nn6pi026w9";
     minimumOCamlVersion = "4.04.2";
     meta.description = "Printf-style format-strings for user-defined string conversion";
     propagatedBuildInputs = [ ppx_sexp_conv ];
@@ -466,7 +468,8 @@ rec {
 
   ppx_expect = janePackage {
     pname = "ppx_expect";
-    hash = "05v6jzn1nbmwk3vzxxnb3380wzg2nb28jpb3v5m5c4ikn0jrhcwn";
+    version = "0.14.1";
+    hash = "0vbbnjrzpyk5p0js21lafr6fcp2wqka89p1876rdf472cmg0l7fv";
     minimumOCamlVersion = "4.04.2";
     meta.description = "Cram like framework for OCaml";
     propagatedBuildInputs = [ ppx_here ppx_inline_test re ];
@@ -559,7 +562,8 @@ rec {
 
   ppx_optcomp = janePackage {
     pname = "ppx_optcomp";
-    hash = "1wav3zgh4244x1ll562g735cwwrzyk5jj72niq9jgz9qjlpsprlk";
+    version = "0.14.1";
+    hash = "0j5smqa0hig1yn8wfrb4mv0y59kkwsalmqkm5asbd7kcc6589ap4";
     minimumOCamlVersion = "4.04.2";
     meta.description = "Optional compilation for OCaml";
     propagatedBuildInputs = [ ppxlib ];
@@ -591,16 +595,17 @@ rec {
 
   ppx_sexp_conv = janePackage {
     pname = "ppx_sexp_conv";
-    version = "0.14.1";
+    version = "0.14.3";
     minimumOCamlVersion = "4.04.2";
-    hash = "04bx5id99clrgvkg122nx03zig1m7igg75piphhyx04w33shgkz2";
+    hash = "0dbri9d00ydi0dw1cavswnqdmhjaaz80vap29ns2lr6mhhlvyjmj";
     meta.description = "[@@deriving] plugin to generate S-expression conversion functions";
     propagatedBuildInputs = [ ppxlib sexplib0 base ];
   };
 
   ppx_sexp_message = janePackage {
     pname = "ppx_sexp_message";
-    hash = "17xnq345xwfkl9ydn05ljsg37m2glh3alnspayl3fgbhmcjmav3i";
+    version = "0.14.1";
+    hash = "1lvsr0d68kakih1ll33hy6dxbjkly6lmky4q6z0h0hrcbd6z48k4";
     minimumOCamlVersion = "4.04.2";
     meta.description = "A ppx rewriter for easy construction of s-expressions";
     propagatedBuildInputs = [ ppx_here ppx_sexp_conv ];
@@ -634,9 +639,9 @@ rec {
 
   ppx_typerep_conv = janePackage {
     pname = "ppx_typerep_conv";
-    version = "0.14.1";
+    version = "0.14.2";
     minimumOCamlVersion = "4.04.2";
-    hash = "1r0z7qlcpaicas5hkymy2q0gi207814wlay4hys7pl5asd59wcdh";
+    hash = "0yk9vkpnwr8labgfncqdi4rfkj88d8mb3cr8m4gdqpi3f2r27hf0";
     meta.description = "Generation of runtime types from type declarations";
     propagatedBuildInputs = [ ppxlib typerep ];
   };
diff --git a/pkgs/development/ocaml-modules/pgocaml/default.nix b/pkgs/development/ocaml-modules/pgocaml/default.nix
index f67d614af3a..5c00f2c8991 100644
--- a/pkgs/development/ocaml-modules/pgocaml/default.nix
+++ b/pkgs/development/ocaml-modules/pgocaml/default.nix
@@ -4,12 +4,12 @@
 
 buildDunePackage rec {
   pname = "pgocaml";
-  version = "4.2.2";
+  version = "4.2.2-dev-20210111";
   src = fetchFromGitHub {
     owner = "darioteixeira";
     repo = "pgocaml";
-    rev = version;
-    sha256 = "1rdypc83nap9j2ml9r6n1pzgf79gk1yffwyi6fmcrl7zmy01cg0n";
+    rev = "1bb0025deeb3d14029afdcc69aaa7847026e243e";
+    sha256 = "11inbjf87gclc2xmpq56ag4cm4467y9q9hjgbdn69fa1bman2zn2";
   };
 
   minimumOCamlVersion = "4.08";
diff --git a/pkgs/development/ocaml-modules/pgocaml/ppx.nix b/pkgs/development/ocaml-modules/pgocaml/ppx.nix
index 35c19622f88..dce2e2b0c99 100644
--- a/pkgs/development/ocaml-modules/pgocaml/ppx.nix
+++ b/pkgs/development/ocaml-modules/pgocaml/ppx.nix
@@ -1,8 +1,8 @@
-{ buildDunePackage, pgocaml, ppx_optcomp, ppx_tools, ppx_tools_versioned, rresult }:
+{ buildDunePackage, pgocaml, ppx_optcomp }:
 
 buildDunePackage {
   pname = "pgocaml_ppx";
   inherit (pgocaml) src version useDune2 meta;
 
-  propagatedBuildInputs = [ pgocaml ppx_optcomp ppx_tools ppx_tools_versioned rresult ];
+  propagatedBuildInputs = [ pgocaml ppx_optcomp ];
 }
diff --git a/pkgs/development/ocaml-modules/ppxlib/default.nix b/pkgs/development/ocaml-modules/ppxlib/default.nix
index 11b608e6ef5..c92992197d2 100644
--- a/pkgs/development/ocaml-modules/ppxlib/default.nix
+++ b/pkgs/development/ocaml-modules/ppxlib/default.nix
@@ -1,5 +1,8 @@
 { lib, fetchFromGitHub, buildDunePackage, ocaml
-, version ? if lib.versionAtLeast ocaml.version "4.07" then "0.15.0" else "0.13.0"
+, version ?
+  if lib.versionAtLeast ocaml.version "4.07"
+  then if lib.versionAtLeast ocaml.version "4.08"
+  then "0.22.0" else "0.15.0" else "0.13.0"
 , ocaml-compiler-libs, ocaml-migrate-parsetree, ppx_derivers, stdio
 , stdlib-shims, ocaml-migrate-parsetree-2-1
 }:
@@ -19,11 +22,13 @@ let param = {
   "0.15.0" = {
     sha256 = "1p037kqj5858xrhh0dps6vbf4fnijla6z9fjz5zigvnqp4i2xkrn";
     min_version = "4.07";
+    max_version = "4.12";
     useOMP2 = false;
   };
   "0.18.0" = {
     sha256 = "1ciy6va2gjrpjs02kha83pzh0x1gkmfsfsdgabbs1v14a8qgfibm";
     min_version = "4.07";
+    max_version = "4.12";
   };
   "0.22.0" = {
     sha256 = "0kf7lgcwygf6zlx7rwddqpqvasa6v7xiq0bqal8vxlib6lpg074q";
diff --git a/pkgs/development/ocaml-modules/visitors/default.nix b/pkgs/development/ocaml-modules/visitors/default.nix
index bda50bdb78e..a47cd414fb1 100644
--- a/pkgs/development/ocaml-modules/visitors/default.nix
+++ b/pkgs/development/ocaml-modules/visitors/default.nix
@@ -2,18 +2,18 @@
 
 buildDunePackage rec {
   pname = "visitors";
-  version = "20210127";
+  version = "20210316";
 
   useDune2 = true;
 
-  minimumOCamlVersion = "4.07";
+  minimumOCamlVersion = "4.08";
 
   src = fetchFromGitLab {
     owner = "fpottier";
     repo = pname;
     rev = version;
     domain = "gitlab.inria.fr";
-    sha256 = "0b73h7d4yv04a0b5x2i222jknbcgf9vvxzfjxzy2jwanxz9d873z";
+    sha256 = "12d45ncy3g9mpcs6n58aq6yzs5qz662msgcr7ccms9jhiq44m8f7";
   };
 
   propagatedBuildInputs = [ ppxlib ppx_deriving result ];
diff --git a/pkgs/development/tools/analysis/flow/default.nix b/pkgs/development/tools/analysis/flow/default.nix
index bbee2768a54..47c7b0fac9f 100644
--- a/pkgs/development/tools/analysis/flow/default.nix
+++ b/pkgs/development/tools/analysis/flow/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
     install -Dm644 resources/shell/bash-completion $out/share/bash-completion/completions/flow
   '';
 
-  buildInputs = (with ocamlPackages; [ ocaml findlib ocamlbuild dtoa core_kernel sedlex_2 ocaml_lwt lwt_log lwt_ppx ppx_deriving ppx_gen_rec ppx_tools_versioned visitors wtf8 ocaml-migrate-parsetree ])
+  buildInputs = (with ocamlPackages; [ ocaml findlib ocamlbuild ocaml-migrate-parsetree dtoa core_kernel sedlex_2 ocaml_lwt lwt_log lwt_ppx ppx_deriving ppx_gen_rec ppx_tools_versioned visitors wtf8 ])
     ++ lib.optionals stdenv.isDarwin [ CoreServices ];
 
   meta = with lib; {
diff --git a/pkgs/development/tools/bazel-watcher/default.nix b/pkgs/development/tools/bazel-watcher/default.nix
index bc3a2828f6c..657704a653c 100644
--- a/pkgs/development/tools/bazel-watcher/default.nix
+++ b/pkgs/development/tools/bazel-watcher/default.nix
@@ -2,7 +2,7 @@
 , fetchFromGitHub
 , git
 , go
-, python
+, python3
 , lib, stdenv
 }:
 
@@ -22,7 +22,7 @@ buildBazelPackage rec {
     sha256 = "0gigl1lg8sb4bj5crvj54329ws4yirldbncs15f96db6vhp0ig7r";
   };
 
-  nativeBuildInputs = [ go git python ];
+  nativeBuildInputs = [ go git python3 ];
   removeRulesCC = false;
 
   bazelTarget = "//ibazel";
diff --git a/pkgs/development/tools/build-managers/bam/default.nix b/pkgs/development/tools/build-managers/bam/default.nix
index a828c57b8c0..556725cca6c 100644
--- a/pkgs/development/tools/build-managers/bam/default.nix
+++ b/pkgs/development/tools/build-managers/bam/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, lua5_3, python }:
+{ lib, stdenv, fetchFromGitHub, lua5_3, python3 }:
 
 stdenv.mkDerivation rec {
   pname = "bam";
@@ -11,11 +11,13 @@ stdenv.mkDerivation rec {
     sha256 = "13br735ig7lygvzyfd15fc2rdygrqm503j6xj5xkrl1r7w2wipq6";
   };
 
-  buildInputs = [ lua5_3 python ];
+  nativeBuildInputs = [ lua5_3 python3 ];
 
   buildPhase = "${stdenv.shell} make_unix.sh";
 
-  checkPhase = "${python.interpreter} scripts/test.py";
+  checkPhase = "${python3.interpreter} scripts/test.py";
+
+  strictDeps = true;
 
   installPhase = ''
     mkdir -p "$out/share/bam"
diff --git a/pkgs/development/tools/build-managers/bazel/bazel_0_26/default.nix b/pkgs/development/tools/build-managers/bazel/bazel_0_26/default.nix
index 2ec244e502b..f03f42be389 100644
--- a/pkgs/development/tools/build-managers/bazel/bazel_0_26/default.nix
+++ b/pkgs/development/tools/build-managers/bazel/bazel_0_26/default.nix
@@ -1,6 +1,6 @@
 { stdenv, callPackage, lib, fetchurl, fetchpatch, runCommand, makeWrapper
 , zip, unzip, bash, writeCBin, coreutils
-, which, python, perl, gawk, gnused, gnutar, gnugrep, gzip, findutils
+, which, python3, perl, gawk, gnused, gnutar, gnugrep, gzip, findutils
 # Apple dependencies
 , cctools, llvmPackages_8, CoreFoundation, CoreServices, Foundation
 # Allow to independently override the jdks used to build and run respectively
@@ -210,8 +210,8 @@ stdenv'.mkDerivation rec {
       # Substitute python's stub shebang to plain python path. (see TODO add pr URL)
       # See also `postFixup` where python is added to $out/nix-support
       substituteInPlace src/main/java/com/google/devtools/build/lib/bazel/rules/python/python_stub_template.txt\
-          --replace "/usr/bin/env python" "${python}/bin/python" \
-          --replace "NIX_STORE_PYTHON_PATH" "${python}/bin/python" \
+          --replace "/usr/bin/env python" "${python3.interpreter}" \
+          --replace "NIX_STORE_PYTHON_PATH" "${python3.interpreter}" \
 
       # md5sum is part of coreutils
       sed -i 's|/sbin/md5|md5sum|' \
@@ -287,11 +287,13 @@ stdenv'.mkDerivation rec {
     buildJdk
   ];
 
+  strictDeps = true;
+
   # when a command can’t be found in a bazel build, you might also
   # need to add it to `defaultShellPath`.
   nativeBuildInputs = [
     zip
-    python
+    python3
     unzip
     makeWrapper
     which
@@ -380,7 +382,7 @@ stdenv'.mkDerivation rec {
     echo "${customBash} ${defaultShellPath}" >> $out/nix-support/depends
     # The templates get tar’d up into a .jar,
     # so nix can’t detect python is needed in the runtime closure
-    echo "${python}" >> $out/nix-support/depends
+    echo "${python3}" >> $out/nix-support/depends
   '';
 
   dontStrip = true;
diff --git a/pkgs/development/tools/cask/default.nix b/pkgs/development/tools/cask/default.nix
index 886d435b811..1c5f316cea9 100644
--- a/pkgs/development/tools/cask/default.nix
+++ b/pkgs/development/tools/cask/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, python, emacs }:
+{ lib, stdenv, fetchurl, python3, emacs }:
 
 stdenv.mkDerivation rec {
   pname = "cask";
@@ -12,9 +12,11 @@ stdenv.mkDerivation rec {
     s f dash ansi ecukes servant ert-runner el-mock
     noflet ert-async shell-split-string git package-build
   ] ++ [
-    python
+    python3
   ];
 
+  strictDeps = true;
+
   buildPhase = ''
     emacs --batch -L . -f batch-byte-compile cask.el cask-cli.el
   '';
diff --git a/pkgs/development/tools/fedpkg/default.nix b/pkgs/development/tools/fedpkg/default.nix
index d9633e88f34..2ba0f494c21 100644
--- a/pkgs/development/tools/fedpkg/default.nix
+++ b/pkgs/development/tools/fedpkg/default.nix
@@ -1,4 +1,6 @@
-{ lib, buildPythonApplication, buildPythonPackage, isPy3k, fetchurl, rpkg, offtrac, urlgrabber, pyopenssl, python_fedora }:
+{ lib, python2Packages, fetchurl }:
+
+with python2Packages;
 
 let
   fedora_cert = buildPythonPackage rec {
diff --git a/pkgs/development/tools/misc/blackmagic/default.nix b/pkgs/development/tools/misc/blackmagic/default.nix
index fc1af1a4d68..080bc7a7f74 100644
--- a/pkgs/development/tools/misc/blackmagic/default.nix
+++ b/pkgs/development/tools/misc/blackmagic/default.nix
@@ -1,6 +1,6 @@
 { stdenv, lib, fetchFromGitHub
 , gcc-arm-embedded, libftdi1, libusb-compat-0_1, pkg-config
-, python, pythonPackages
+, python3
 }:
 
 with lib;
@@ -21,15 +21,16 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [
     gcc-arm-embedded pkg-config
+    python3
   ];
 
   buildInputs = [
     libftdi1
     libusb-compat-0_1
-    python
-    pythonPackages.intelhex
   ];
 
+  strictDeps = true;
+
   postPatch = ''
     # Prevent calling out to `git' to generate a version number:
     substituteInPlace src/Makefile \
diff --git a/pkgs/development/tools/misc/cli11/default.nix b/pkgs/development/tools/misc/cli11/default.nix
index 03c3e51cb89..d62ad413e1a 100644
--- a/pkgs/development/tools/misc/cli11/default.nix
+++ b/pkgs/development/tools/misc/cli11/default.nix
@@ -3,7 +3,7 @@
   fetchFromGitHub,
   cmake,
   gtest,
-  python,
+  python3,
   boost
 }:
 
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake ];
 
-  checkInputs = [ boost python ];
+  checkInputs = [ boost python3 ];
 
   doCheck = true;
 
diff --git a/pkgs/development/tools/misc/distcc/default.nix b/pkgs/development/tools/misc/distcc/default.nix
index cad9fe0960b..38ddc1ff431 100644
--- a/pkgs/development/tools/misc/distcc/default.nix
+++ b/pkgs/development/tools/misc/distcc/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, popt, avahi, pkg-config, python, gtk2, runCommand
+{ lib, stdenv, fetchFromGitHub, popt, avahi, pkg-config, python3, gtk2, runCommand
 , gcc, autoconf, automake, which, procps, libiberty_static
 , runtimeShell
 , sysconfDir ? ""   # set this parameter to override the default value $out/etc
@@ -18,7 +18,7 @@ let
     };
 
   nativeBuildInputs = [ pkg-config ];
-    buildInputs = [popt avahi pkg-config python gtk2 autoconf automake which procps libiberty_static];
+    buildInputs = [popt avahi pkg-config python3 gtk2 autoconf automake which procps libiberty_static];
     preConfigure =
     ''
       export CPATH=$(ls -d ${gcc.cc}/lib/gcc/*/${gcc.cc.version}/plugin/include)
diff --git a/pkgs/development/tools/misc/doclifter/default.nix b/pkgs/development/tools/misc/doclifter/default.nix
index 8b771788111..0692d84b454 100644
--- a/pkgs/development/tools/misc/doclifter/default.nix
+++ b/pkgs/development/tools/misc/doclifter/default.nix
@@ -1,4 +1,4 @@
-{lib, stdenv, fetchurl, python}:
+{lib, stdenv, fetchurl, python3}:
 
 stdenv.mkDerivation {
   name = "doclifter-2.19";
@@ -6,7 +6,9 @@ stdenv.mkDerivation {
     url = "http://www.catb.org/~esr/doclifter/doclifter-2.19.tar.gz";
     sha256 = "1as6z7mdjrrkw2kism41q5ybvyzvwcmj9qzla2fz98v9f4jbj2s2";
   };
-  buildInputs = [ python ];
+  buildInputs = [ python3 ];
+
+  strictDeps = true;
 
   makeFlags = [ "PREFIX=$(out)" ];
 
diff --git a/pkgs/games/20kly/default.nix b/pkgs/games/20kly/default.nix
index 092e0e4eac2..7cc2ea6220e 100644
--- a/pkgs/games/20kly/default.nix
+++ b/pkgs/games/20kly/default.nix
@@ -1,12 +1,12 @@
 { lib
 , fetchurl
-, python }:
+, python2 }:
 
-python.pkgs.buildPythonApplication rec {
+python2.pkgs.buildPythonApplication rec {
   pname = "20kly";
   version = "1.4";
   format = "other";
-  disabled = !(python.isPy2 or false);
+  disabled = !(python2.isPy2 or false);
 
   src = fetchurl {
     url = "http://jwhitham.org.uk/20kly/lightyears-${version}.tar.bz2";
@@ -20,7 +20,7 @@ python.pkgs.buildPythonApplication rec {
         "LIGHTYEARS_DIR = \"$out/share\""
   '';
 
-  propagatedBuildInputs = with python.pkgs; [ pygame ];
+  propagatedBuildInputs = with python2.pkgs; [ pygame ];
 
   buildPhase = "python -O -m compileall .";
 
diff --git a/pkgs/games/crispy-doom/default.nix b/pkgs/games/crispy-doom/default.nix
index 432600e879f..3d46de725c7 100644
--- a/pkgs/games/crispy-doom/default.nix
+++ b/pkgs/games/crispy-doom/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, autoreconfHook, pkg-config, SDL2, SDL2_mixer, SDL2_net, fetchFromGitHub, python }:
+{ lib, stdenv, autoreconfHook, pkg-config, SDL2, SDL2_mixer, SDL2_net, fetchFromGitHub, python2 }:
 
 stdenv.mkDerivation rec {
   pname = "crispy-doom";
@@ -16,10 +16,12 @@ stdenv.mkDerivation rec {
     for script in $(grep -lr '^#!/usr/bin/env python$'); do patchShebangs $script; done
   '';
 
-  nativeBuildInputs = [ autoreconfHook pkg-config python ];
+  nativeBuildInputs = [ autoreconfHook pkg-config python2 ];
   buildInputs = [ SDL2 SDL2_mixer SDL2_net ];
   enableParallelBuilding = true;
 
+  strictDeps = true;
+
   meta = {
     homepage = "http://fabiangreffrath.github.io/crispy-doom";
     description = "A limit-removing enhanced-resolution Doom source port based on Chocolate Doom";
diff --git a/pkgs/os-specific/linux/dmtcp/default.nix b/pkgs/os-specific/linux/dmtcp/default.nix
index 21458daf966..5a472c73578 100644
--- a/pkgs/os-specific/linux/dmtcp/default.nix
+++ b/pkgs/os-specific/linux/dmtcp/default.nix
@@ -1,4 +1,6 @@
-{ lib, stdenv, fetchFromGitHub, bash, perl, python }:
+{ lib, stdenv, fetchFromGitHub, bash, perl, python2 }:
+
+# There are fixes for python3 compatibility on master
 
 stdenv.mkDerivation rec {
   pname = "dmtcp";
@@ -28,7 +30,7 @@ stdenv.mkDerivation rec {
     substituteInPlace test/autotest.py \
       --replace /bin/bash ${bash}/bin/bash \
       --replace /usr/bin/perl ${perl}/bin/perl \
-      --replace /usr/bin/python ${python}/bin/python \
+      --replace /usr/bin/python ${python2}/bin/python \
       --replace "os.environ['USER']" "\"nixbld1\"" \
       --replace "os.getenv('USER')" "\"nixbld1\""
   '';
diff --git a/pkgs/servers/dico/default.nix b/pkgs/servers/dico/default.nix
index cf0417e332e..6a8c6541c2c 100644
--- a/pkgs/servers/dico/default.nix
+++ b/pkgs/servers/dico/default.nix
@@ -1,5 +1,5 @@
 { fetchurl, lib, stdenv, libtool, gettext, zlib, readline, gsasl
-, guile, python, pcre, libffi, groff }:
+, guile, python2, pcre, libffi, groff }:
 
 stdenv.mkDerivation rec {
   pname = "dico";
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
   hardeningDisable = [ "format" ];
 
   buildInputs =
-    [ libtool gettext zlib readline gsasl guile python pcre libffi groff ];
+    [ libtool gettext zlib readline gsasl guile python2 pcre libffi groff ];
 
   doCheck = true;
 
diff --git a/pkgs/servers/dict/dictd-wordnet.nix b/pkgs/servers/dict/dictd-wordnet.nix
index 3f76d60233c..8378102dac5 100644
--- a/pkgs/servers/dict/dictd-wordnet.nix
+++ b/pkgs/servers/dict/dictd-wordnet.nix
@@ -1,10 +1,10 @@
-{lib, stdenv, python, wordnet, writeScript}:
+{lib, stdenv, python2, wordnet, writeScript}:
 
 stdenv.mkDerivation rec {
   version = "542";
   pname = "dict-db-wordnet";
 
-  buildInputs = [python wordnet];
+  buildInputs = [python2 wordnet];
   convert = ./wordnet_structures.py;
 
   builder = writeScript "builder.sh" ''
diff --git a/pkgs/servers/dict/wiktionary/default.nix b/pkgs/servers/dict/wiktionary/default.nix
index cd0c9c6c24b..3a01120f3a6 100644
--- a/pkgs/servers/dict/wiktionary/default.nix
+++ b/pkgs/servers/dict/wiktionary/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, python, dict, glibcLocales }:
+{ lib, stdenv, fetchurl, python2, dict, glibcLocales }:
 
 stdenv.mkDerivation rec {
   version = "20210201";
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
   };
 
   convert = ./wiktionary2dict.py;
-  buildInputs = [ python dict glibcLocales ];
+  buildInputs = [ python2 dict glibcLocales ];
   builder = ./builder.sh;
 
   passthru.updateScript = ./update.sh;
diff --git a/pkgs/servers/dns/knot-dns/default.nix b/pkgs/servers/dns/knot-dns/default.nix
index 2a9e00b266b..2b407074caf 100644
--- a/pkgs/servers/dns/knot-dns/default.nix
+++ b/pkgs/servers/dns/knot-dns/default.nix
@@ -7,11 +7,11 @@ let inherit (lib) optional optionals; in
 
 stdenv.mkDerivation rec {
   pname = "knot-dns";
-  version = "3.0.4";
+  version = "3.0.5";
 
   src = fetchurl {
     url = "https://secure.nic.cz/files/knot-dns/knot-${version}.tar.xz";
-    sha256 = "451d8913a769b7e4bcb3e250a3181b448e28a82cfc58cea6f2509475d7327983";
+    sha256 = "695e7d7a0abefc5a8fd01f3b3080f030f33b0948215f84cd4892c6d904390802";
   };
 
   outputs = [ "bin" "out" "dev" ];
diff --git a/pkgs/servers/foundationdb/default.nix b/pkgs/servers/foundationdb/default.nix
index 78addfc4aa2..b3a876546e7 100644
--- a/pkgs/servers/foundationdb/default.nix
+++ b/pkgs/servers/foundationdb/default.nix
@@ -2,7 +2,7 @@
 , lib, fetchurl, fetchpatch, fetchFromGitHub
 
 , cmake, ninja, which, findutils, m4, gawk
-, python, python3, openjdk, mono, libressl, boost
+, python2, python3, openjdk, mono, libressl, boost
 }@args:
 
 let
diff --git a/pkgs/servers/foundationdb/vsmake.nix b/pkgs/servers/foundationdb/vsmake.nix
index aac9ab07c0f..e171d714564 100644
--- a/pkgs/servers/foundationdb/vsmake.nix
+++ b/pkgs/servers/foundationdb/vsmake.nix
@@ -4,7 +4,7 @@
 { gcc6Stdenv, lib, fetchurl, fetchFromGitHub
 
 , which, findutils, m4, gawk
-, python, openjdk, mono, libressl
+, python2, openjdk, mono, libressl
 , ...
 }:
 
@@ -51,7 +51,7 @@ let
           inherit rev sha256;
         };
 
-        nativeBuildInputs = [ python openjdk gawk which m4 findutils mono ];
+        nativeBuildInputs = [ python2 openjdk gawk which m4 findutils mono ];
         buildInputs = [ libressl boost ];
 
         inherit patches;
diff --git a/pkgs/servers/ldap/389/default.nix b/pkgs/servers/ldap/389/default.nix
index bfa372ed069..90510d50252 100644
--- a/pkgs/servers/ldap/389/default.nix
+++ b/pkgs/servers/ldap/389/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchurl, fetchpatch, autoreconfHook, pkg-config, doxygen, perl, pam, nspr, nss, openldap
-, db, cyrus_sasl, svrcore, icu, net-snmp, kerberos, pcre, perlPackages, libevent, openssl, python
+, db, cyrus_sasl, svrcore, icu, net-snmp, kerberos, pcre, perlPackages, libevent, openssl, python3
 }:
 
 stdenv.mkDerivation rec {
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ autoreconfHook pkg-config doxygen ];
   buildInputs = [
     perl pam nspr nss openldap db cyrus_sasl svrcore icu
-    net-snmp kerberos pcre libevent openssl python
+    net-snmp kerberos pcre libevent openssl python3
   ] ++ (with perlPackages; [ MozillaLdap NetAddrIP DBFile ]);
 
   patches = [
diff --git a/pkgs/tools/admin/chkcrontab/default.nix b/pkgs/tools/admin/chkcrontab/default.nix
index bbf8d7eaeb1..d91894f0006 100644
--- a/pkgs/tools/admin/chkcrontab/default.nix
+++ b/pkgs/tools/admin/chkcrontab/default.nix
@@ -1,6 +1,6 @@
-{ python, lib }:
+{ python3, lib }:
 
-with python.pkgs;
+with python3.pkgs;
 
 buildPythonApplication rec {
   pname = "chkcrontab";
diff --git a/pkgs/tools/compression/dtrx/default.nix b/pkgs/tools/compression/dtrx/default.nix
index 91d59a4de0f..6c4f2f6e854 100644
--- a/pkgs/tools/compression/dtrx/default.nix
+++ b/pkgs/tools/compression/dtrx/default.nix
@@ -1,4 +1,4 @@
-{ lib, fetchurl, pythonPackages
+{ lib, fetchurl, python2Packages
 , gnutar, unzip, lhasa, rpm, binutils, cpio, gzip, p7zip, cabextract, unrar, unshield
 , bzip2, xz, lzip
 # unzip is handled by p7zip
@@ -11,7 +11,7 @@ let
   ++ lib.optional (unrarSupport) unrar
   ++ [ bzip2 xz lzip ]);
 
-in pythonPackages.buildPythonApplication rec {
+in python2Packages.buildPythonApplication rec {
   pname = "dtrx";
   version = "7.1";
 
@@ -24,6 +24,17 @@ in pythonPackages.buildPythonApplication rec {
     wrapProgram "$out/bin/dtrx" --prefix PATH : "${archivers}"
   '';
 
+  checkPhase = ''
+    python2 tests/compare.py
+  '';
+
+  checkInputs = with python2Packages; [
+    pyyaml
+  ];
+
+  # custom test suite fails
+  doCheck = false;
+
   meta = with lib; {
     description = "Do The Right Extraction: A tool for taking the hassle out of extracting archives";
     homepage = "https://brettcsmith.org/2007/dtrx/";
diff --git a/pkgs/tools/filesystems/cryfs/default.nix b/pkgs/tools/filesystems/cryfs/default.nix
index 3777c4e7cb1..eec257c44b7 100644
--- a/pkgs/tools/filesystems/cryfs/default.nix
+++ b/pkgs/tools/filesystems/cryfs/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchFromGitHub, fetchpatch
-, cmake, pkg-config, python, gtest
+, cmake, pkg-config, python3, gtest
 , boost, cryptopp, curl, fuse, openssl
 }:
 
@@ -44,9 +44,11 @@ stdenv.mkDerivation rec {
       --replace "(4.5L*1024*1024*1024)" "(0.5L*1024*1024*1024)"
   '';
 
-  nativeBuildInputs = [ cmake gtest pkg-config python ];
+  nativeBuildInputs = [ cmake pkg-config python3 ];
 
-  buildInputs = [ boost cryptopp curl fuse openssl ];
+  strictDeps = true;
+
+  buildInputs = [ boost cryptopp curl fuse openssl gtest ];
 
   cmakeFlags = [
     "-DCRYFS_UPDATE_CHECKS:BOOL=FALSE"
diff --git a/pkgs/tools/graphics/blockhash/default.nix b/pkgs/tools/graphics/blockhash/default.nix
index a0ecdde3826..b3426722f79 100644
--- a/pkgs/tools/graphics/blockhash/default.nix
+++ b/pkgs/tools/graphics/blockhash/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, python, pkg-config, imagemagick, wafHook }:
+{ lib, stdenv, fetchFromGitHub, python2, pkg-config, imagemagick, wafHook }:
 
 stdenv.mkDerivation rec {
   pname = "blockhash";
@@ -11,9 +11,11 @@ stdenv.mkDerivation rec {
     sha256 = "0m7ikppl42iicgmwsb7baajmag7v0p1ab06xckifvrr0zm21bq9p";
   };
 
-  nativeBuildInputs = [ python pkg-config wafHook ];
+  nativeBuildInputs = [ python2 pkg-config wafHook ];
   buildInputs = [ imagemagick ];
 
+  strictDeps = true;
+
   meta = with lib; {
     homepage = "http://blockhash.io/";
     description = ''
diff --git a/pkgs/tools/graphics/escrotum/default.nix b/pkgs/tools/graphics/escrotum/default.nix
index 4a887688c4f..decb92615f9 100644
--- a/pkgs/tools/graphics/escrotum/default.nix
+++ b/pkgs/tools/graphics/escrotum/default.nix
@@ -1,9 +1,7 @@
-{ lib, fetchFromGitHub, buildPythonApplication
-, pygtk
-, numpy ? null
+{ lib, python2Packages, fetchFromGitHub
 }:
 
-buildPythonApplication {
+with python2Packages; buildPythonApplication {
   name = "escrotum-2019-06-10";
 
   src = fetchFromGitHub {
diff --git a/pkgs/tools/misc/disper/default.nix b/pkgs/tools/misc/disper/default.nix
index ecbf298132f..3e78bc97732 100644
--- a/pkgs/tools/misc/disper/default.nix
+++ b/pkgs/tools/misc/disper/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, python, xorg, makeWrapper }:
+{ lib, stdenv, fetchFromGitHub, python2, xorg, makeWrapper }:
 
 stdenv.mkDerivation rec {
   pname = "disper";
@@ -13,7 +13,9 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ makeWrapper ];
 
-  buildInputs = [ python ];
+  strictDeps = true;
+
+  buildInputs = [ python2 ];
 
   preConfigure = ''
     export makeFlags="PREFIX=$out"
diff --git a/pkgs/tools/misc/paperlike-go/default.nix b/pkgs/tools/misc/paperlike-go/default.nix
new file mode 100644
index 00000000000..301cc81ec80
--- /dev/null
+++ b/pkgs/tools/misc/paperlike-go/default.nix
@@ -0,0 +1,28 @@
+{ lib
+, buildGoModule
+, fetchFromGitHub
+}:
+
+buildGoModule {
+  pname = "paperlike-go";
+  version = "unstable-2021-03-22";
+
+  src = fetchFromGitHub {
+    owner = "leoluk";
+    repo = "paperlike-go";
+    rev = "a7d89fd4d4cbcec7be016860e9063676ad4cca0f";
+    sha256 = "0ym340520a0j4gvgk4x091lcz1apsv9lnwx0nnha86qvzqcy528l";
+  };
+
+  subPackages = [ "cmd/paperlike-cli" ];
+
+  vendorSha256 = "00mn0zfivxp2h77s7gmyyjp8p5a1vysn73wwaalgajymvljxxx1r";
+
+  meta = with lib; {
+    description = "paperlike-go is a Linux Go library and CLI utility to control a Dasung Paperlike display via I2C DDC.";
+    homepage = "https://github.com/leoluk/paperlike-go";
+    license = lib.licenses.asl20;
+    maintainers = [ lib.maintainers.adisbladis ];
+    platforms = lib.platforms.linux;
+  };
+}
diff --git a/pkgs/tools/networking/bud/default.nix b/pkgs/tools/networking/bud/default.nix
index 724d25d49f9..7a4bd5adcba 100644
--- a/pkgs/tools/networking/bud/default.nix
+++ b/pkgs/tools/networking/bud/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchgit, python, gyp, util-linux }:
+{ stdenv, lib, fetchgit, python2, util-linux }:
 
 stdenv.mkDerivation {
   pname = "bud";
@@ -11,10 +11,12 @@ stdenv.mkDerivation {
     sha256 = "08yr6l4lc2m6rng06253fcaznf6sq0v053wfr8bbym42c32z0xdh";
   };
 
-  buildInputs = [
-    python gyp
+  nativeBuildInputs = [
+    python2 python2.pkgs.gyp
   ] ++ lib.optional stdenv.isLinux util-linux;
 
+  strictDeps = true;
+
   buildPhase = ''
     python ./gyp_bud -f make
     make -C out
diff --git a/pkgs/tools/networking/carddav-util/default.nix b/pkgs/tools/networking/carddav-util/default.nix
index 112a95eccc6..300e03761a6 100644
--- a/pkgs/tools/networking/carddav-util/default.nix
+++ b/pkgs/tools/networking/carddav-util/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchgit, python, pythonPackages, makeWrapper }:
+{ lib, stdenv, fetchgit, python3Packages, makeWrapper }:
 
 stdenv.mkDerivation {
 
@@ -12,7 +12,9 @@ stdenv.mkDerivation {
 
   nativeBuildInputs = [ makeWrapper ];
 
-  propagatedBuildInputs = with pythonPackages; [ requests vobject lxml ];
+  propagatedBuildInputs = with python3Packages; [ requests vobject lxml ];
+
+  strictDeps = true;
 
   doCheck = false; # no test
 
@@ -20,7 +22,7 @@ stdenv.mkDerivation {
     mkdir -p $out/bin
     cp $src/carddav-util.py $out/bin
 
-    pythondir="$out/lib/${python.libPrefix}/site-packages"
+    pythondir="$out/lib/${python3Packages.python.sitePackages}"
     mkdir -p "$pythondir"
     cp $src/carddav.py "$pythondir"
   '';
diff --git a/pkgs/tools/networking/ccnet/default.nix b/pkgs/tools/networking/ccnet/default.nix
index b8fd0679892..3293ebe25c8 100644
--- a/pkgs/tools/networking/ccnet/default.nix
+++ b/pkgs/tools/networking/ccnet/default.nix
@@ -1,4 +1,4 @@
-{lib, stdenv, fetchurl, which, autoreconfHook, pkg-config, vala, python, libsearpc, libzdb, libuuid, libevent, sqlite, openssl}:
+{lib, stdenv, fetchurl, which, autoreconfHook, pkg-config, vala, python3, libsearpc, libzdb, libuuid, libevent, sqlite, openssl}:
 
 stdenv.mkDerivation rec {
   version = "6.1.8";
@@ -10,11 +10,13 @@ stdenv.mkDerivation rec {
     sha256 = "0qlpnrz30ldrqnvbj59d54qdghxpxc5lsq6kf3dw2b93jnzkcmmm";
   };
 
-  nativeBuildInputs = [ pkg-config which autoreconfHook vala python ];
+  nativeBuildInputs = [ pkg-config which autoreconfHook vala python3 libsearpc ];
   propagatedBuildInputs = [ libsearpc libzdb libuuid libevent sqlite openssl ];
 
   configureFlags = [ "--enable-server" ];
 
+  strictDeps = true;
+
   meta = with lib; {
     homepage = "https://github.com/haiwen/ccnet";
     description = "A framework for writing networked applications in C";
diff --git a/pkgs/tools/networking/dd-agent/5.nix b/pkgs/tools/networking/dd-agent/5.nix
index af4ae7ed769..f40ef295d13 100644
--- a/pkgs/tools/networking/dd-agent/5.nix
+++ b/pkgs/tools/networking/dd-agent/5.nix
@@ -1,7 +1,7 @@
-{ lib, stdenv, fetchFromGitHub, python
+{ lib, stdenv, fetchFromGitHub, python2
 , unzip, makeWrapper }:
 let
-  python' = python.override {
+  python' = python2.override {
     packageOverrides = self: super: {
       docker = self.buildPythonPackage rec {
         name = "docker-${version}";
@@ -82,7 +82,7 @@ in stdenv.mkDerivation rec {
 
     cat > $out/bin/dd-jmxfetch <<EOF
     #!/usr/bin/env bash
-    exec ${python}/bin/python $out/agent/jmxfetch.py $@
+    exec ${python'.interpreter} $out/agent/jmxfetch.py $@
     EOF
     chmod a+x $out/bin/dd-jmxfetch
 
diff --git a/pkgs/tools/networking/xh/default.nix b/pkgs/tools/networking/xh/default.nix
index 1d1736cd816..33f3e394d71 100644
--- a/pkgs/tools/networking/xh/default.nix
+++ b/pkgs/tools/networking/xh/default.nix
@@ -1,22 +1,31 @@
-{ stdenv, lib, rustPlatform, fetchFromGitHub, Security }:
+{ stdenv, lib, openssl, pkg-config, rustPlatform, fetchFromGitHub, Security
+, libiconv }:
 
 rustPlatform.buildRustPackage rec {
   pname = "xh";
-  version = "0.7.0";
+  version = "0.9.1";
 
   src = fetchFromGitHub {
     owner = "ducaale";
     repo = "xh";
     rev = "v${version}";
-    sha256 = "0b7q0xbfbrhvpnxbm9bd1ncdza9k2kcmcir3qhqzb2pgsb5b5njx";
+    sha256 = "pRVlcaPfuO7IMH2p0AQfVrCIXCRyF37WIirOJQkcAJE=";
   };
 
-  cargoSha256 = "02fgqys9qf0jzs2n230pyj151v6xbm6wm2rd9qm5gsib6zaq7gfa";
+  cargoSha256 = "dXo1+QvCW3CWN2OhsqGh2Q1xet6cmi2xVy1Xk7s1YR8=";
 
-  buildInputs = lib.optional stdenv.isDarwin Security;
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = if stdenv.isDarwin then [ Security libiconv ] else [ openssl ];
+
+  # Get openssl-sys to use pkg-config
+  OPENSSL_NO_VENDOR = 1;
 
   checkFlagsArray = [ "--skip=basic_options" ];
 
+  # Nix build happens in sandbox without internet connectivity
+  # disable tests as some of them require internet due to nature of application
+  doCheck = false;
   doInstallCheck = true;
   postInstallCheck = ''
     $out/bin/xh --help > /dev/null
diff --git a/pkgs/tools/security/chipsec/default.nix b/pkgs/tools/security/chipsec/default.nix
index 45d6349af40..7e00c0b07cf 100644
--- a/pkgs/tools/security/chipsec/default.nix
+++ b/pkgs/tools/security/chipsec/default.nix
@@ -1,6 +1,6 @@
-{ stdenv, lib, fetchFromGitHub, pythonPackages, nasm, libelf
+{ stdenv, lib, fetchFromGitHub, python2Packages, nasm, libelf
 , kernel ? null, withDriver ? false }:
-pythonPackages.buildPythonApplication rec {
+python2Packages.buildPythonApplication rec {
   pname = "chipsec";
   version = "1.5.1";
 
diff --git a/pkgs/tools/security/cipherscan/default.nix b/pkgs/tools/security/cipherscan/default.nix
index eae5a5256df..23022f92b6a 100644
--- a/pkgs/tools/security/cipherscan/default.nix
+++ b/pkgs/tools/security/cipherscan/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchFromGitHub, openssl, makeWrapper, python, coreutils }:
+{ stdenv, lib, fetchFromGitHub, openssl, makeWrapper, python3, coreutils }:
 
 stdenv.mkDerivation rec {
   pname = "cipherscan";
@@ -12,7 +12,9 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ makeWrapper ];
-  buildInputs = [ python ];
+  buildInputs = [ python3 ];
+
+  strictDeps = true;
 
   buildPhase = ''
     substituteInPlace cipherscan --replace '$0' 'cipherscan'
diff --git a/pkgs/tools/system/evemu/default.nix b/pkgs/tools/system/evemu/default.nix
index 5b3a584bd24..c01a909668e 100644
--- a/pkgs/tools/system/evemu/default.nix
+++ b/pkgs/tools/system/evemu/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchgit, autoreconfHook, pkg-config, pythonPackages
+{ lib, stdenv, fetchgit, autoreconfHook, pkg-config, python3Packages
 , libevdev
 }:
 
@@ -14,9 +14,11 @@ stdenv.mkDerivation rec {
     sha256 = "1m38fxwy2s82vb2qm9aqxinws12akmqqq7q66is931lc3awqkbah";
   };
 
-  nativeBuildInputs = [ pkg-config autoreconfHook ];
+  nativeBuildInputs = [ pkg-config autoreconfHook python3Packages.python ];
 
-  buildInputs = [ pythonPackages.python pythonPackages.evdev libevdev ];
+  buildInputs = [ python3Packages.evdev libevdev ];
+
+  strictDeps = true;
 
   meta = with lib; {
     description = "Records and replays device descriptions and events to emulate input devices through the kernel's input system";
diff --git a/pkgs/tools/system/fio/default.nix b/pkgs/tools/system/fio/default.nix
index d34f0d4b737..fc4ea8d6b33 100644
--- a/pkgs/tools/system/fio/default.nix
+++ b/pkgs/tools/system/fio/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchFromGitHub, makeWrapper
-, libaio, python, zlib
+, libaio, python3, zlib
 , withGnuplot ? false, gnuplot ? null }:
 
 stdenv.mkDerivation rec {
@@ -13,11 +13,13 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-/Si0McndJ6Xp3ifDr+BStv89LmZyAgof95QkHGT8MGQ=";
   };
 
-  buildInputs = [ python zlib ]
+  buildInputs = [ python3 zlib ]
     ++ lib.optional (!stdenv.isDarwin) libaio;
 
   nativeBuildInputs = [ makeWrapper ];
 
+  strictDeps = true;
+
   enableParallelBuilding = true;
 
   postPatch = ''
diff --git a/pkgs/tools/text/miller/default.nix b/pkgs/tools/text/miller/default.nix
index 9cc31be7ed4..383c3603bc8 100644
--- a/pkgs/tools/text/miller/default.nix
+++ b/pkgs/tools/text/miller/default.nix
@@ -3,13 +3,13 @@
 stdenv.mkDerivation rec {
   pname = "miller";
 
-  version = "5.10.0";
+  version = "5.10.1";
 
   src = fetchFromGitHub {
     owner = "johnkerl";
     repo = "miller";
     rev = "v${version}";
-    sha256 = "02jqbxnchljyqnmlbxjaf5zpdi03gxapfy38dfikl5j4f7yyxvjs";
+    sha256 = "sha256-S3OGc7rirNkP5aSnaASP6n7b7zYHSaDDWRVRWWTM2hc=";
   };
 
   nativeBuildInputs = [ autoreconfHook flex libtool ];
diff --git a/pkgs/tools/typesetting/biblatex-check/default.nix b/pkgs/tools/typesetting/biblatex-check/default.nix
index 606e07730e4..63bf7cf1d71 100644
--- a/pkgs/tools/typesetting/biblatex-check/default.nix
+++ b/pkgs/tools/typesetting/biblatex-check/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, python }:
+{ lib, stdenv, fetchFromGitHub, python3 }:
 
 stdenv.mkDerivation {
   pname = "biblatex-check";
@@ -11,7 +11,9 @@ stdenv.mkDerivation {
     sha256 = "1bq0yqckhssazwkivipdjmn1jpsf301i4ppyl88qhc5igx39wg25";
   };
 
-  buildInputs = [ python ];
+  buildInputs = [ python3 ];
+
+  strictDeps = true;
 
   installPhase = ''
     install -Dm755 biblatex_check.py $out/bin/biblatex-check
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 9b3f27bfa64..b7439ed0219 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -1609,7 +1609,7 @@ in
 
   b3sum = callPackage ../tools/security/b3sum {};
 
-  backblaze-b2 = python.pkgs.callPackage ../development/tools/backblaze-b2 { };
+  backblaze-b2 = callPackage ../development/tools/backblaze-b2 { };
 
   bandwhich = callPackage ../tools/networking/bandwhich {
     inherit (darwin.apple_sdk.frameworks) Security;
@@ -3136,9 +3136,7 @@ in
     librsync = librsync_0_9;
   };
 
-  bud = callPackage ../tools/networking/bud {
-    inherit (pythonPackages) gyp;
-  };
+  bud = callPackage ../tools/networking/bud { };
 
   bump2version = python37Packages.callPackage ../applications/version-management/git-and-tools/bump2version { };
 
@@ -3264,6 +3262,7 @@ in
   clementine = libsForQt514.callPackage ../applications/audio/clementine {
     gst_plugins =
       with gst_all_1; [ gst-plugins-base gst-plugins-good gst-plugins-ugly gst-libav ];
+    protobuf = protobuf3_14;
   };
 
   clementineUnfree = clementine.unfree;
@@ -3388,9 +3387,7 @@ in
   skktools = callPackage ../tools/inputmethods/skk/skktools { };
   skk-dicts = callPackage ../tools/inputmethods/skk/skk-dicts { };
 
-  libkkc-data = callPackage ../data/misc/libkkc-data {
-    inherit (pythonPackages) marisa;
-  };
+  libkkc-data = callPackage ../data/misc/libkkc-data { };
 
   libkkc = callPackage ../tools/inputmethods/libkkc { };
 
@@ -4156,9 +4153,7 @@ in
 
   epsxe = callPackage ../misc/emulators/epsxe { };
 
-  escrotum = callPackage ../tools/graphics/escrotum {
-    inherit (pythonPackages) buildPythonApplication pygtk numpy;
-  };
+  escrotum = callPackage ../tools/graphics/escrotum { };
 
   etcher = callPackage ../tools/misc/etcher { };
 
@@ -12548,7 +12543,7 @@ in
     jdk = jdk8; # TODO: remove override https://github.com/NixOS/nixpkgs/pull/89731
   };
 
-  fedpkg = pythonPackages.callPackage ../development/tools/fedpkg { };
+  fedpkg = callPackage ../development/tools/fedpkg { };
 
   flex_2_5_35 = callPackage ../development/tools/parsing/flex/2.5.35.nix { };
   flex = callPackage ../development/tools/parsing/flex { };
@@ -21146,6 +21141,8 @@ in
 
   papis = with python3Packages; toPythonApplication papis;
 
+  paperlike-go = callPackage ../tools/misc/paperlike-go { };
+
   paps = callPackage ../tools/misc/paps { };
 
   pecita = callPackage ../data/fonts/pecita {};
diff --git a/pkgs/top-level/ocaml-packages.nix b/pkgs/top-level/ocaml-packages.nix
index 30f6dca5f16..f319d678e13 100644
--- a/pkgs/top-level/ocaml-packages.nix
+++ b/pkgs/top-level/ocaml-packages.nix
@@ -317,7 +317,15 @@ let
 
     eliom = callPackage ../development/ocaml-modules/eliom { };
 
-    elpi = callPackage ../development/ocaml-modules/elpi { };
+    elpi = callPackage ../development/ocaml-modules/elpi (
+      let ppxlib_0_15 = if lib.versionAtLeast ppxlib.version "0.15"
+        then ppxlib.override { version = "0.15.0"; }
+        else ppxlib; in
+      {
+        ppx_deriving = ppx_deriving.override { ppxlib = ppxlib_0_15; };
+        ppxlib = ppxlib_0_15;
+      }
+    );
 
     encore = callPackage ../development/ocaml-modules/encore { };
 
@@ -1031,13 +1039,23 @@ let
 
     ppx_deriving_protobuf = callPackage ../development/ocaml-modules/ppx_deriving_protobuf {};
 
-    ppx_deriving_rpc = callPackage ../development/ocaml-modules/ppx_deriving_rpc { };
+    ppx_deriving_rpc = callPackage ../development/ocaml-modules/ppx_deriving_rpc {
+      ppxlib = ppxlib.override { version = "0.15.0"; };
+   };
 
     ppx_deriving_yojson = callPackage ../development/ocaml-modules/ppx_deriving_yojson {};
 
     ppx_gen_rec = callPackage ../development/ocaml-modules/ppx_gen_rec {};
 
-    ppx_import = callPackage ../development/ocaml-modules/ppx_import {};
+    ppx_import = callPackage ../development/ocaml-modules/ppx_import (
+      let ppxlib_0_15 = if lib.versionAtLeast ppxlib.version "0.15"
+        then ppxlib.override { version = "0.15.0"; }
+        else ppxlib; in
+      {
+        ppx_deriving = ppx_deriving.override { ppxlib = ppxlib_0_15; };
+        ppxlib = ppxlib_0_15;
+      }
+    );
 
     ppx_irmin = callPackage ../development/ocaml-modules/irmin/ppx.nix {
     };