diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index f7a7ce20c70..38ed481b7c6 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -1616,6 +1616,12 @@
     githubId = 12202789;
     name = "CrazedProgrammer";
   };
+  cript0nauta = {
+    email = "shareman1204@gmail.com";
+    github = "cript0nauta";
+    githubId = 1222362;
+    name = "Matías Lang";
+  };
   cryptix = {
     email = "cryptix@riseup.net";
     github = "cryptix";
@@ -2546,6 +2552,16 @@
     githubId = 11909469;
     name = "Fabian Geiselhart";
   };
+  fabianhauser = {
+    email = "fabian.nixos@fh2.ch";
+    github = "fabianhauser";
+    githubId = 368799;
+    name = "Fabian Hauser";
+    keys = [{
+      longkeyid = "rsa4096/0x8A52A140BEBF7D2C";
+      fingerprint = "50B7 11F4 3DFD 2018 DCE6  E8D0 8A52 A140 BEBF 7D2C";
+    }];
+  };
   fadenb = {
     email = "tristan.helmich+nixos@gmail.com";
     github = "fadenb";
@@ -3867,6 +3883,12 @@
     githubId = 11947756;
     name = "Julien Dehos";
   };
+  julm = {
+    email = "julm+nix@sourcephile.fr";
+    github = "ju1m";
+    githubId = 21160136;
+    name = "Julien Moutinho";
+  };
   jumper149 = {
     email = "felixspringer149@gmail.com";
     github = "jumper149";
diff --git a/nixos/doc/manual/release-notes/rl-2009.xml b/nixos/doc/manual/release-notes/rl-2009.xml
index 43661125338..d1eecd65085 100644
--- a/nixos/doc/manual/release-notes/rl-2009.xml
+++ b/nixos/doc/manual/release-notes/rl-2009.xml
@@ -94,6 +94,22 @@ services.mysql.initialScript = pkgs.writeText "mariadb-init.sql" ''
       When MariaDB data directory is just upgraded (not initialized), the users are not created or modified.
     </para>
    </listitem>
+   <listitem>
+    <para>
+      MySQL server is now started with additional systemd sandbox/hardening options for better security. The PrivateTmp, ProtectHome, and ProtectSystem options
+      may be problematic when MySQL is attempting to read from or write to your filesystem anywhere outside of its own state directory, for example when
+      calling <literal>LOAD DATA INFILE or SELECT * INTO OUTFILE</literal>. In this scenario a variant of the following may be required:
+        - allow MySQL to read from /home and /tmp directories when using <literal>LOAD DATA INFILE</literal>
+<programlisting>
+systemd.services.mysql.serviceConfig.ProtectHome = lib.mkForce "read-only";
+</programlisting>
+        - allow MySQL to write to custom folder <literal>/var/data</literal> when using <literal>SELECT * INTO OUTFILE</literal>, assuming the mysql user has write
+          access to <literal>/var/data</literal>
+<programlisting>
+systemd.services.mysql.serviceConfig.ReadWritePaths = [ "/var/data" ];
+</programlisting>
+    </para>
+   </listitem>
   </itemizedlist>
  </section>
 
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index c82c70a7b86..448d432853d 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -126,6 +126,7 @@
   ./programs/gpaste.nix
   ./programs/gnupg.nix
   ./programs/gphoto2.nix
+  ./programs/hamster.nix
   ./programs/iftop.nix
   ./programs/iotop.nix
   ./programs/java.nix
diff --git a/nixos/modules/programs/hamster.nix b/nixos/modules/programs/hamster.nix
new file mode 100644
index 00000000000..ddf26a22fb5
--- /dev/null
+++ b/nixos/modules/programs/hamster.nix
@@ -0,0 +1,15 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+{
+  meta.maintainers = maintainers.fabianhauser;
+
+  options.programs.hamster.enable =
+    mkEnableOption "Whether to enable hamster time tracking.";
+
+  config = lib.mkIf config.programs.hamster.enable {
+    environment.systemPackages = [ pkgs.hamster ];
+    services.dbus.packages = [ pkgs.hamster ];
+  };
+}
diff --git a/nixos/modules/services/databases/mysql.nix b/nixos/modules/services/databases/mysql.nix
index 51885881cf7..2e8c5b7640b 100644
--- a/nixos/modules/services/databases/mysql.nix
+++ b/nixos/modules/services/databases/mysql.nix
@@ -334,7 +334,8 @@ in
     environment.etc."my.cnf".source = cfg.configFile;
 
     systemd.tmpfiles.rules = [
-      "d '${cfg.dataDir}' 0700 ${cfg.user} mysql -"
+      "d '${cfg.dataDir}' 0700 ${cfg.user} mysql - -"
+      "z '${cfg.dataDir}' 0700 ${cfg.user} mysql - -"
     ];
 
     systemd.services.mysql = let
@@ -357,21 +358,17 @@ in
         preStart = if isMariaDB then ''
           if ! test -e ${cfg.dataDir}/mysql; then
             ${mysql}/bin/mysql_install_db --defaults-file=/etc/my.cnf ${mysqldOptions}
-            touch /tmp/mysql_init
+            touch ${cfg.dataDir}/mysql_init
           fi
         '' else ''
           if ! test -e ${cfg.dataDir}/mysql; then
             ${mysql}/bin/mysqld --defaults-file=/etc/my.cnf ${mysqldOptions} --initialize-insecure
-            touch /tmp/mysql_init
+            touch ${cfg.dataDir}/mysql_init
           fi
         '';
 
         serviceConfig = {
-          User = cfg.user;
-          Group = "mysql";
           Type = if hasNotify then "notify" else "simple";
-          RuntimeDirectory = "mysqld";
-          RuntimeDirectoryMode = "0755";
           Restart = "on-abort";
           RestartSec = "5s";
           # The last two environment variables are used for starting Galera clusters
@@ -398,7 +395,7 @@ in
                   done
                 ''}
 
-                if [ -f /tmp/mysql_init ]
+                if [ -f ${cfg.dataDir}/mysql_init ]
                 then
                     ${concatMapStrings (database: ''
                       # Create initial databases
@@ -452,7 +449,7 @@ in
                         cat ${toString cfg.initialScript} | ${mysql}/bin/mysql -u root -N
                       ''}
 
-                    rm /tmp/mysql_init
+                    rm ${cfg.dataDir}/mysql_init
                 fi
 
                 ${optionalString (cfg.ensureDatabases != []) ''
@@ -476,6 +473,35 @@ in
               # ensureDatbases & ensureUsers depends on this script being run as root
               # when the user has secured their mysql install
               "+${setupScript}";
+          # User and group
+          User = cfg.user;
+          Group = "mysql";
+          # Runtime directory and mode
+          RuntimeDirectory = "mysqld";
+          RuntimeDirectoryMode = "0755";
+          # Access write directories
+          ReadWritePaths = [ cfg.dataDir ];
+          # Capabilities
+          CapabilityBoundingSet = "";
+          # Security
+          NoNewPrivileges = true;
+          # Sandboxing
+          ProtectSystem = "strict";
+          ProtectHome = true;
+          PrivateTmp = true;
+          PrivateDevices = true;
+          ProtectHostname = true;
+          ProtectKernelTunables = true;
+          ProtectKernelModules = true;
+          ProtectControlGroups = true;
+          RestrictAddressFamilies = [ "AF_UNIX" "AF_INET" "AF_INET6" ];
+          LockPersonality = true;
+          MemoryDenyWriteExecute = true;
+          RestrictRealtime = true;
+          RestrictSUIDSGID = true;
+          PrivateMounts = true;
+          # System Call Filtering
+          SystemCallArchitectures = "native";
         };
       };
 
diff --git a/nixos/modules/system/boot/systemd.nix b/nixos/modules/system/boot/systemd.nix
index 99892a28115..a8e51fc0901 100644
--- a/nixos/modules/system/boot/systemd.nix
+++ b/nixos/modules/system/boot/systemd.nix
@@ -826,8 +826,13 @@ in
   config = {
 
     warnings = concatLists (mapAttrsToList (name: service:
-      optional (service.serviceConfig.Type or "" == "oneshot" && service.serviceConfig.Restart or "no" != "no")
-        "Service ‘${name}.service’ with ‘Type=oneshot’ must have ‘Restart=no’") cfg.services);
+      let
+        type = service.serviceConfig.Type or "";
+        restart = service.serviceConfig.Restart or "no";
+      in optional
+      (type == "oneshot" && (restart == "always" || restart == "on-success"))
+      "Service '${name}.service' with 'Type=oneshot' cannot have 'Restart=always' or 'Restart=on-success'")
+      cfg.services);
 
     system.build.units = cfg.units;
 
diff --git a/pkgs/applications/audio/ft2-clone/default.nix b/pkgs/applications/audio/ft2-clone/default.nix
index c5661f3336f..acf373fc41a 100644
--- a/pkgs/applications/audio/ft2-clone/default.nix
+++ b/pkgs/applications/audio/ft2-clone/default.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "ft2-clone";
-  version = "1.24";
+  version = "1.25_fix";
 
   src = fetchFromGitHub {
     owner = "8bitbubsy";
     repo = "ft2-clone";
     rev = "v${version}";
-    sha256 = "0wb7xsc2m9f4q5zsf5ai6h6c0558lkziv30b5a8ic64wp0layr6k";
+    sha256 = "0q2mcp3xpgwilmiwzr9nnxlyg9c1kynh6cxzlyd95n520j00s6i7";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/applications/audio/pulseaudio-modules-bt/default.nix b/pkgs/applications/audio/pulseaudio-modules-bt/default.nix
index 49cc8318935..556dd5f1061 100644
--- a/pkgs/applications/audio/pulseaudio-modules-bt/default.nix
+++ b/pkgs/applications/audio/pulseaudio-modules-bt/default.nix
@@ -3,7 +3,7 @@
 , fetchFromGitHub
 , pulseaudio
 , pkgconfig
-, ffmpeg_4
+, ffmpeg
 , patchelf
 , fdk_aac
 , libtool
@@ -45,7 +45,7 @@ in stdenv.mkDerivation rec {
 
   buildInputs = [
     pulseaudio
-    ffmpeg_4
+    ffmpeg
     fdk_aac
     libtool
     ldacbt
@@ -72,7 +72,7 @@ in stdenv.mkDerivation rec {
     for so in $out/lib/pulse-${pulseaudio.version}/modules/*.so; do
       orig_rpath=$(patchelf --print-rpath "$so")
       patchelf \
-        --set-rpath "${ldacbt}/lib:${lib.getLib ffmpeg_4}/lib:$out/lib/pulse-${pulseaudio.version}/modules:$orig_rpath" \
+        --set-rpath "${ldacbt}/lib:${lib.getLib ffmpeg}/lib:$out/lib/pulse-${pulseaudio.version}/modules:$orig_rpath" \
         "$so"
     done
   '';
diff --git a/pkgs/applications/graphics/feh/default.nix b/pkgs/applications/graphics/feh/default.nix
index cecd2a3776d..4782d920148 100644
--- a/pkgs/applications/graphics/feh/default.nix
+++ b/pkgs/applications/graphics/feh/default.nix
@@ -1,6 +1,7 @@
 { stdenv, fetchurl, makeWrapper
 , xorg, imlib2, libjpeg, libpng
-, curl, libexif, jpegexiforient, perlPackages }:
+, curl, libexif, jpegexiforient, perlPackages
+, enableAutoreload ? true }:
 
 with stdenv.lib;
 
@@ -21,7 +22,8 @@ stdenv.mkDerivation rec {
 
   makeFlags = [
     "PREFIX=${placeholder "out"}" "exif=1"
-  ] ++ optional stdenv.isDarwin "verscmp=0";
+  ] ++ optional stdenv.isDarwin "verscmp=0"
+    ++ optional enableAutoreload "inotify=1";
 
   installTargets = [ "install" ];
   postInstall = ''
diff --git a/pkgs/applications/graphics/krop/default.nix b/pkgs/applications/graphics/krop/default.nix
index 2337dfb370e..ee490676977 100644
--- a/pkgs/applications/graphics/krop/default.nix
+++ b/pkgs/applications/graphics/krop/default.nix
@@ -2,22 +2,24 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "krop";
-  version = "0.5.1";
+  version = "0.6.0";
 
   src = fetchFromGitHub {
     owner = "arminstraub";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0b1zqpks4vzq7sfhf7r9qrshr77f1ncj18x7d0fa3g29rxa42dcr";
+    sha256 = "1ygzc7vlwszqmsd3v1dsqp1dpsn6inx7g8gck63alvf88dbn8m3s";
   };
 
   propagatedBuildInputs = with python3Packages; [
     pyqt5
     pypdf2
     poppler-qt5
-    libsForQt5.poppler
     ghostscript
   ];
+  buildInputs = [
+    libsForQt5.poppler
+  ];
 
   nativeBuildInputs = [ qt5.wrapQtAppsHook ];
   makeWrapperArgs = [
diff --git a/pkgs/applications/misc/hamster/default.nix b/pkgs/applications/misc/hamster/default.nix
new file mode 100644
index 00000000000..57b36e00436
--- /dev/null
+++ b/pkgs/applications/misc/hamster/default.nix
@@ -0,0 +1,62 @@
+{ stdenv, fetchFromGitHub, python3Packages, intltool, glib, itstool
+, wrapGAppsHook, gobject-introspection, pango, gdk-pixbuf, atk, wafHook }:
+
+python3Packages.buildPythonApplication rec {
+  pname = "hamster";
+  version = "3.0.2";
+
+  format = "other";
+
+  src = fetchFromGitHub {
+    owner = "projecthamster";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "09ikiwc2izjvwqbbyp8knn190x5y4anwslkmb9k2h3r3jwrg2vd2";
+  };
+
+  nativeBuildInputs = [
+    python3Packages.setuptools
+    wrapGAppsHook
+    intltool
+    itstool
+    wafHook
+    glib
+    gobject-introspection
+  ];
+
+  buildInputs = [
+    pango
+    gdk-pixbuf
+    atk
+  ];
+
+  propagatedBuildInputs = with python3Packages; [
+    pygobject3
+    pycairo
+    pyxdg
+    dbus-python
+  ];
+
+  # Setup hooks have trouble with strict deps.
+  # https://github.com/NixOS/nixpkgs/issues/56943
+  strictDeps = false;
+
+  dontWrapGApps = true;
+
+  # Arguments to be passed to `makeWrapper`, only used by buildPython*
+  preFixup = ''
+    makeWrapperArgs+=("''${gappsWrapperArgs[@]}")
+  '';
+
+  postFixup = ''
+    wrapPythonProgramsIn $out/libexec "$out $pythonPath"
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Time tracking application";
+    homepage = "http://projecthamster.org/";
+    license = licenses.gpl3Plus;
+    platforms = platforms.all;
+    maintainers = [ maintainers.fabianhauser ];
+  };
+}
diff --git a/pkgs/applications/misc/menumaker/default.nix b/pkgs/applications/misc/menumaker/default.nix
index 22cf63e536c..f76d6cb6b8a 100644
--- a/pkgs/applications/misc/menumaker/default.nix
+++ b/pkgs/applications/misc/menumaker/default.nix
@@ -2,11 +2,11 @@
 
 pythonPackages.buildPythonApplication rec {
   pname = "menumaker";
-  version = "0.99.11";
+  version = "0.99.12";
 
   src = fetchurl {
     url = "mirror://sourceforge/menumaker/${pname}-${version}.tar.gz";
-    sha256 = "0dprndnhwm7b803zkp4pisiq06ic9iv8vr42in5is47jmvdim0wx";
+    sha256 = "034v5204bsgkzzk6zfa5ia63q95gln47f7hwf96yvad5hrhmd8z3";
   };
 
   format = "other";
diff --git a/pkgs/applications/misc/opentx/default.nix b/pkgs/applications/misc/opentx/default.nix
index f20d5ccdc4a..a117ecc06a9 100644
--- a/pkgs/applications/misc/opentx/default.nix
+++ b/pkgs/applications/misc/opentx/default.nix
@@ -6,13 +6,13 @@
 
 mkDerivation rec {
   pname = "opentx";
-  version = "2.3.7";
+  version = "2.3.9";
 
   src = fetchFromGitHub {
     owner = "opentx";
     repo = "opentx";
     rev = "release/${version}";
-    sha256 = "1wl3bk7s8h20dfys1hblzxc0br9zlwhcqlghgsbn81ki0xb6jmkf";
+    sha256 = "0kh3jdy1pgvns8lrncf61ayaq0hmsv41j8xv4r4rf17zyvjl0qph";
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/applications/networking/browsers/firefox/wrapper.nix b/pkgs/applications/networking/browsers/firefox/wrapper.nix
index 52773bf291a..7505e7e2196 100644
--- a/pkgs/applications/networking/browsers/firefox/wrapper.nix
+++ b/pkgs/applications/networking/browsers/firefox/wrapper.nix
@@ -2,7 +2,7 @@
 
 ## various stuff that can be plugged in
 , flashplayer, hal-flash
-, ffmpeg_4, xorg, libpulseaudio, libcanberra-gtk2, libglvnd
+, ffmpeg, xorg, libpulseaudio, libcanberra-gtk2, libglvnd
 , gnome3/*.gnome-shell*/
 , browserpass, chrome-gnome-shell, uget-integrator, plasma-browser-integration, bukubrow
 , tridactyl-native
@@ -66,7 +66,7 @@ let
           ++ extraNativeMessagingHosts
         );
       libs =   lib.optionals stdenv.isLinux [ udev libva ]
-            ++ lib.optional ffmpegSupport ffmpeg_4
+            ++ lib.optional ffmpegSupport ffmpeg
             ++ lib.optional gssSupport kerberos
             ++ lib.optional gdkWayland libglvnd
             ++ lib.optionals (cfg.enableQuakeLive or false)
diff --git a/pkgs/applications/networking/instant-messengers/riot/riot-desktop-package.json b/pkgs/applications/networking/instant-messengers/riot/riot-desktop-package.json
index acb63ff7454..f9a5ebdbebe 100644
--- a/pkgs/applications/networking/instant-messengers/riot/riot-desktop-package.json
+++ b/pkgs/applications/networking/instant-messengers/riot/riot-desktop-package.json
@@ -2,7 +2,7 @@
   "name": "riot-desktop",
   "productName": "Riot",
   "main": "src/electron-main.js",
-  "version": "1.6.4",
+  "version": "1.6.5",
   "description": "A feature-rich client for Matrix.org",
   "author": "New Vector Ltd.",
   "repository": {
@@ -48,7 +48,7 @@
     "find-npm-prefix": "^1.0.2",
     "fs-extra": "^8.1.0",
     "glob": "^7.1.6",
-    "matrix-js-sdk": "6.2.1",
+    "matrix-js-sdk": "6.2.2",
     "mkdirp": "^1.0.3",
     "needle": "^2.3.2",
     "node-pre-gyp": "^0.14.0",
diff --git a/pkgs/applications/networking/instant-messengers/riot/riot-desktop-yarndeps.nix b/pkgs/applications/networking/instant-messengers/riot/riot-desktop-yarndeps.nix
index e6573a50818..30e1c946475 100644
--- a/pkgs/applications/networking/instant-messengers/riot/riot-desktop-yarndeps.nix
+++ b/pkgs/applications/networking/instant-messengers/riot/riot-desktop-yarndeps.nix
@@ -3154,11 +3154,11 @@
       };
     }
     {
-      name = "matrix_js_sdk___matrix_js_sdk_6.2.1.tgz";
+      name = "matrix_js_sdk___matrix_js_sdk_6.2.2.tgz";
       path = fetchurl {
-        name = "matrix_js_sdk___matrix_js_sdk_6.2.1.tgz";
-        url  = "https://registry.yarnpkg.com/matrix-js-sdk/-/matrix-js-sdk-6.2.1.tgz";
-        sha1 = "d5f76491a650c0a36fcdd078cff59f2da96edd7b";
+        name = "matrix_js_sdk___matrix_js_sdk_6.2.2.tgz";
+        url  = "https://registry.yarnpkg.com/matrix-js-sdk/-/matrix-js-sdk-6.2.2.tgz";
+        sha1 = "103d951f61945217b110962f55ae43996756f615";
       };
     }
     {
diff --git a/pkgs/applications/networking/instant-messengers/riot/riot-desktop.nix b/pkgs/applications/networking/instant-messengers/riot/riot-desktop.nix
index 64652afd7e4..acdf40e772e 100644
--- a/pkgs/applications/networking/instant-messengers/riot/riot-desktop.nix
+++ b/pkgs/applications/networking/instant-messengers/riot/riot-desktop.nix
@@ -8,12 +8,12 @@
 
 let
   executableName = "riot-desktop";
-  version = "1.6.4";
+  version = "1.6.5";
   src = fetchFromGitHub {
     owner = "vector-im";
     repo = "riot-desktop";
     rev = "v${version}";
-    sha256 = "05z7mggsp33m7ljl4ibk9r4dccglbsc2arp4i3dknq364zdga3m2";
+    sha256 = "1snmfn98z63a8ahh5c7y7h00i8qsdq6wsnidmjjrkzcz3mchfq60";
   };
   electron = electron_7;
 
diff --git a/pkgs/applications/networking/instant-messengers/riot/riot-web.nix b/pkgs/applications/networking/instant-messengers/riot/riot-web.nix
index 942917a4675..c08d1dbe033 100644
--- a/pkgs/applications/networking/instant-messengers/riot/riot-web.nix
+++ b/pkgs/applications/networking/instant-messengers/riot/riot-web.nix
@@ -12,11 +12,11 @@ let
 
 in stdenv.mkDerivation rec {
   pname = "riot-web";
-  version = "1.6.4";
+  version = "1.6.5";
 
   src = fetchurl {
     url = "https://github.com/vector-im/riot-web/releases/download/v${version}/riot-v${version}.tar.gz";
-    sha256 = "0n99ivpfsz48zl0nibhkmli26sks2lpd2h0iph73f2w1p7zw1ln2";
+    sha256 = "0mx7ql76cbivc0d9gzix51bc1rdp9yg9vjx05mbf5r9sxrwmihz5";
   };
 
   installPhase = ''
diff --git a/pkgs/applications/networking/instant-messengers/telegram/tdesktop/default.nix b/pkgs/applications/networking/instant-messengers/telegram/tdesktop/default.nix
index 388144c4e12..d4493355951 100644
--- a/pkgs/applications/networking/instant-messengers/telegram/tdesktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/telegram/tdesktop/default.nix
@@ -1,7 +1,7 @@
 { mkDerivation, lib, fetchurl, fetchsvn
 , pkgconfig, cmake, ninja, python3, wrapGAppsHook, wrapQtAppsHook
 , qtbase, qtimageformats, gtk3, libsForQt5, enchant2, lz4, xxHash
-, dee, ffmpeg_4, openalSoft, minizip, libopus, alsaLib, libpulseaudio, range-v3
+, dee, ffmpeg, openalSoft, minizip, libopus, alsaLib, libpulseaudio, range-v3
 , tl-expected, hunspell
 # TODO: Shouldn't be required:
 , pcre, xorg, utillinux, libselinux, libsepol, epoxy, at-spi2-core, libXtst
@@ -42,7 +42,7 @@ mkDerivation rec {
 
   buildInputs = [
     qtbase qtimageformats gtk3 libsForQt5.libdbusmenu enchant2 lz4 xxHash
-    dee ffmpeg_4 openalSoft minizip libopus alsaLib libpulseaudio range-v3
+    dee ffmpeg openalSoft minizip libopus alsaLib libpulseaudio range-v3
     tl-expected hunspell
     # TODO: Shouldn't be required:
     pcre xorg.libpthreadstubs xorg.libXdmcp utillinux libselinux libsepol epoxy at-spi2-core libXtst
diff --git a/pkgs/applications/networking/remote/waypipe/default.nix b/pkgs/applications/networking/remote/waypipe/default.nix
index 03be60a9948..c72c7c6da8a 100644
--- a/pkgs/applications/networking/remote/waypipe/default.nix
+++ b/pkgs/applications/networking/remote/waypipe/default.nix
@@ -1,7 +1,7 @@
 { stdenv, fetchFromGitLab
 , meson, ninja, pkgconfig, scdoc
 , wayland, wayland-protocols, openssh
-, mesa, lz4, zstd, ffmpeg_4, libva
+, mesa, lz4, zstd, ffmpeg, libva
 }:
 
 stdenv.mkDerivation rec {
@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
   buildInputs = [
     wayland wayland-protocols
     # Optional dependencies:
-    mesa lz4 zstd ffmpeg_4 libva
+    mesa lz4 zstd ffmpeg libva
   ];
 
   enableParallelBuilding = true;
diff --git a/pkgs/applications/networking/ssb/patchwork/default.nix b/pkgs/applications/networking/ssb-patchwork/default.nix
similarity index 100%
rename from pkgs/applications/networking/ssb/patchwork/default.nix
rename to pkgs/applications/networking/ssb-patchwork/default.nix
diff --git a/pkgs/applications/networking/ssb/patchwork-classic/default.nix b/pkgs/applications/networking/ssb/patchwork-classic/default.nix
deleted file mode 100644
index 74a02f47c3b..00000000000
--- a/pkgs/applications/networking/ssb/patchwork-classic/default.nix
+++ /dev/null
@@ -1,106 +0,0 @@
-{ stdenv, fetchurl, lib, makeWrapper,
-  # build dependencies
-  alsaLib, atk, cairo, cups, dbus, expat, fontconfig,
-  freetype, gdk-pixbuf, glib, gnome2, nspr, nss, xorg,
-  glibc, systemd
-}:
-
-stdenv.mkDerivation {
-
-  version = "2.12.0";
-
-  pname = "patchwork-classic";
-
-  src = fetchurl {
-    url    = "https://github.com/ssbc/patchwork-classic-electron/releases/download/v2.12.0/ssb-patchwork-electron_2.12.0_linux-amd64.deb";
-    sha256 = "1rvp07cgqwv7ac319p0qwpfxd7l8f53m1rlvvig7qf7q23fnmbsj";
-  };
-
-  sourceRoot = ".";
-
-  unpackCmd = ''
-    ar p "$src" data.tar.xz | tar xJ
-  '';
-
-  dontBuild = true;
-
-  nativeBuildInputs = [ makeWrapper ];
-
-  installPhase = ''
-    mkdir -p $out/bin
-    cp -R usr/share opt $out/
-
-    # fix the path in the desktop file
-    substituteInPlace \
-      $out/share/applications/ssb-patchwork-electron.desktop \
-      --replace /opt/ $out/opt/
-
-    # symlink the binary to bin/
-    ln -s $out/opt/ssb-patchwork-electron/ssb-patchwork-electron $out/bin/patchwork-classic
-  '';
-
-
-  preFixup = let
-    packages = [
-      alsaLib
-      atk
-      cairo
-      cups
-      dbus
-      expat
-      fontconfig
-      freetype
-      gdk-pixbuf
-      glib
-      gnome2.GConf
-      gnome2.gtk
-      gnome2.pango
-      nspr
-      nss
-      xorg.libX11
-      xorg.libXScrnSaver
-      xorg.libXcomposite
-      xorg.libXcursor
-      xorg.libXdamage
-      xorg.libXext
-      xorg.libXfixes
-      xorg.libXi
-      xorg.libXrandr
-      xorg.libXrender
-      xorg.libXtst
-      stdenv.cc.cc.lib
-      stdenv.cc.cc
-      glibc
-    ];
-    libPathNative = lib.makeLibraryPath packages;
-    libPath64 = lib.makeSearchPathOutput "lib" "lib64" packages;
-    libPath = "${libPathNative}:${libPath64}";
-  in ''
-    # patch executable
-    patchelf \
-      --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
-      --set-rpath "${libPath}:$out/opt/ssb-patchwork-electron" \
-      $out/opt/ssb-patchwork-electron/ssb-patchwork-electron
-
-    # patch libnode
-    patchelf \
-      --set-rpath "${libPath}" \
-      $out/opt/ssb-patchwork-electron/libnode.so
-
-    # libffmpeg is for some reason  not executable
-    chmod a+x $out/opt/ssb-patchwork-electron/libffmpeg.so
-
-    # fix missing libudev
-    ln -s ${systemd.lib}/lib/libudev.so.1 $out/opt/ssb-patchwork-electron/libudev.so.1
-    wrapProgram $out/opt/ssb-patchwork-electron/ssb-patchwork-electron \
-      --prefix LD_LIBRARY_PATH : $out/opt/ssb-patchwork-electron
-  '';
-
-  meta = with stdenv.lib; {
-    description = "Electron wrapper for Patchwork Classic: run as a desktop app outside the browser";
-    homepage    = "https://github.com/ssbc/patchwork-classic-electron";
-    license     = licenses.gpl3;
-    maintainers = with maintainers; [ mrVanDalo ];
-    platforms   = platforms.linux;
-  };
-}
diff --git a/pkgs/applications/science/electronics/verilator/default.nix b/pkgs/applications/science/electronics/verilator/default.nix
index 189e09f8241..0613e22bbda 100644
--- a/pkgs/applications/science/electronics/verilator/default.nix
+++ b/pkgs/applications/science/electronics/verilator/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "verilator";
-  version = "4.034";
+  version = "4.036";
 
   src = fetchurl {
     url    = "https://www.veripool.org/ftp/${pname}-${version}.tgz";
-    sha256 = "02xqvl9ic21jpda0xldh4ihqwl4ss8389s8fklgx5d98xq37pval";
+    sha256 = "1sy02pgq3kvk8548l57hsh08vfbqdg8dghj8mwlybdi8fdjz4z1h";
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/applications/version-management/mercurial/default.nix b/pkgs/applications/version-management/mercurial/default.nix
index ffbd9879135..47453cb5e6f 100644
--- a/pkgs/applications/version-management/mercurial/default.nix
+++ b/pkgs/applications/version-management/mercurial/default.nix
@@ -8,11 +8,11 @@ let
 
 in python3Packages.buildPythonApplication rec {
   pname = "mercurial";
-  version = "5.3.1";
+  version = "5.4.1";
 
   src = fetchurl {
     url = "https://mercurial-scm.org/release/mercurial-${version}.tar.gz";
-    sha256 = "1nbjpzjrzgql4hrvslpxwbcgn885ikq6ba1yb4w6p78rw9nzkhgp";
+    sha256 = "1ilam0dz121nn4852jgkgyzyrvk3hn5cqnivy8gk1qg815mh4763";
   };
 
   format = "other";
diff --git a/pkgs/applications/video/mpv/default.nix b/pkgs/applications/video/mpv/default.nix
index 9cb39d68140..697a468f890 100644
--- a/pkgs/applications/video/mpv/default.nix
+++ b/pkgs/applications/video/mpv/default.nix
@@ -1,6 +1,6 @@
 { config, stdenv, fetchurl, fetchFromGitHub, fetchpatch
 , addOpenGLRunpath, docutils, perl, pkgconfig, python3, wafHook, which
-, ffmpeg_4, freefont_ttf, freetype, libass, libpthreadstubs, mujs
+, ffmpeg, freefont_ttf, freetype, libass, libpthreadstubs, mujs
 , nv-codec-headers, lua, libuchardet, libiconv ? null
 , CoreFoundation, Cocoa, CoreAudio, MediaPlayer
 
@@ -39,7 +39,10 @@
 , libpngSupport      ? true,           libpng        ? null
 , pulseSupport       ? config.pulseaudio or stdenv.isLinux, libpulseaudio ? null
 , rubberbandSupport  ? stdenv.isLinux, rubberband    ? null
-, sambaSupport       ? stdenv.isLinux, samba         ? null
+# NOTE: samba support should be removed on the next mpv release, see also:
+# https://github.com/NixOS/nixpkgs/pull/89145#issuecomment-636424362
+# Please remove this line on the next mpv release.
+, sambaSupport       ? false,          samba         ? null
 , screenSaverSupport ? true,           libXScrnSaver ? null
 , sdl2Support        ? true,           SDL2          ? null
 , sndioSupport       ? true,           sndio         ? null
@@ -152,7 +155,7 @@ in stdenv.mkDerivation rec {
     ++ optional swiftSupport swift;
 
   buildInputs = [
-    ffmpeg_4 freetype libass libpthreadstubs
+    ffmpeg freetype libass libpthreadstubs
     luaEnv libuchardet mujs
   ] ++ optional alsaSupport        alsaLib
     ++ optional archiveSupport     libarchive
diff --git a/pkgs/applications/video/mpv/scripts/simple-mpv-webui.nix b/pkgs/applications/video/mpv/scripts/simple-mpv-webui.nix
new file mode 100644
index 00000000000..d51434e241c
--- /dev/null
+++ b/pkgs/applications/video/mpv/scripts/simple-mpv-webui.nix
@@ -0,0 +1,33 @@
+{ stdenv
+, fetchFromGitHub }:
+stdenv.mkDerivation rec {
+  pname = "simple-mpv-ui";
+  version = "1.0.0";
+
+  src = fetchFromGitHub {
+    owner = "open-dynaMIX";
+    repo = "simple-mpv-webui";
+    rev = "v${version}";
+    sha256 = "1glrnnl1slcl0ri0zs4j64lc9aa52p9ffh6av0d81fk95nm98917";
+  };
+
+  dontBuild = true;
+  installPhase = ''
+    mkdir -p $out/share/mpv/scripts
+    cp -r webui.lua webui-page $out/share/mpv/scripts/
+  '';
+  passthru.scriptName = "webui.lua";
+
+  meta = with stdenv.lib; {
+    description = "A web based user interface with controls for the mpv mediaplayer";
+    homepage = "https://github.com/open-dynaMIX/simple-mpv-webui";
+    maintainers = [ maintainers.cript0nauta ];
+    longDescription = ''
+      You can access the webui when accessing http://127.0.0.1:8080 or
+      http://[::1]:8080 in your webbrowser. By default it listens on
+      0.0.0.0:8080 and [::0]:8080
+    '';
+    license = licenses.mit;
+  };
+}
+
diff --git a/pkgs/applications/video/tartube/default.nix b/pkgs/applications/video/tartube/default.nix
index ae222ae05a7..23ee76eb469 100644
--- a/pkgs/applications/video/tartube/default.nix
+++ b/pkgs/applications/video/tartube/default.nix
@@ -14,13 +14,13 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "tartube";
-  version = "2.0.016";
+  version = "2.1.0";
 
   src = fetchFromGitHub {
     owner = "axcore";
     repo = "tartube";
     rev = "v${version}";
-    sha256 = "1y77ykihyi4v6xlsm5xldbs9lzq229l574rxz6qfvrjcbbwajfj9";
+    sha256 = "1klqjwqm29y2f6nc8gn222ykfvb5d64z1w2kifw9bq5bv0np9bda";
   };
 
   nativeBuildInputs = [
@@ -35,6 +35,8 @@ python3Packages.buildPythonApplication rec {
     pygobject3
     pyxdg
     requests
+    feedparser
+    playsound
   ];
 
   buildInputs = [
@@ -45,6 +47,10 @@ python3Packages.buildPythonApplication rec {
     pango
   ];
 
+  postPatch = ''
+    sed -i "/^\s*install_requires/s/, 'gi'\|'gi', \|'gi'//" setup.py
+  '';
+
   postInstall = ''
     mkdir -p $out/share/{man/man1,applications,pixmaps}
     cp pack/tartube.1 $out/share/man/man1
diff --git a/pkgs/applications/video/wf-recorder/default.nix b/pkgs/applications/video/wf-recorder/default.nix
index cb97e5b1090..09b67149f5a 100644
--- a/pkgs/applications/video/wf-recorder/default.nix
+++ b/pkgs/applications/video/wf-recorder/default.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchFromGitHub, meson, ninja, pkg-config, wayland, scdoc
-, wayland-protocols, ffmpeg_4, x264, libpulseaudio, ocl-icd, opencl-headers
+, wayland-protocols, ffmpeg, x264, libpulseaudio, ocl-icd, opencl-headers
 }:
 
 stdenv.mkDerivation rec {
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ meson ninja pkg-config wayland scdoc ];
   buildInputs = [
-    wayland-protocols ffmpeg_4 x264 libpulseaudio ocl-icd opencl-headers
+    wayland-protocols ffmpeg x264 libpulseaudio ocl-icd opencl-headers
   ];
 
   meta = with stdenv.lib; {
diff --git a/pkgs/data/documentation/man-pages/default.nix b/pkgs/data/documentation/man-pages/default.nix
index a9a64fb4029..5d58284cb66 100644
--- a/pkgs/data/documentation/man-pages/default.nix
+++ b/pkgs/data/documentation/man-pages/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "man-pages";
-  version = "5.06";
+  version = "5.07";
 
   src = fetchurl {
     url = "mirror://kernel/linux/docs/man-pages/${pname}-${version}.tar.xz";
-    sha256 = "0l7ypgl36jswa077qvdh1rcsvnwr64vja6cc32bab86sm41akf3h";
+    sha256 = "13b3q7c67r0wkla4pdihl1qh09k67ms2z5jgzfqgpdqqy6mgziwd";
   };
 
   makeFlags = [ "MANDIR=$(out)/share/man" ];
diff --git a/pkgs/development/compilers/yosys/default.nix b/pkgs/development/compilers/yosys/default.nix
index 33282418561..09e51e4c647 100644
--- a/pkgs/development/compilers/yosys/default.nix
+++ b/pkgs/development/compilers/yosys/default.nix
@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation rec {
   pname   = "yosys";
-  version = "2020.06.11";
+  version = "2020.06.16";
 
   src = fetchFromGitHub {
     owner  = "YosysHQ";
     repo   = "yosys";
-    rev    = "a1785e988b2b51dac32985dd6b0afdcedc6bda1d";
-    sha256 = "0987f5vm2zb0i02c3vlw21gihky2cfj5l9b78ddzhxfiv0qfkdfp";
+    rev    = "39ba90a8b84d740b670a9f1df5148b824d441c63";
+    sha256 = "1ncscbhyq4f07d28l32j37y5d84vyqxfx0fbzhb7nzfhplk8hh0s";
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/development/go-modules/generic/default.nix b/pkgs/development/go-modules/generic/default.nix
index 9baeefe1b2c..0d8b382167e 100644
--- a/pkgs/development/go-modules/generic/default.nix
+++ b/pkgs/development/go-modules/generic/default.nix
@@ -17,7 +17,7 @@
 #
 # if vendorSha256 is null, then we won't fetch any dependencies and
 # rely on the vendor folder within the source.
-, vendorSha256 ? null
+, vendorSha256
 # Whether to delete the vendor folder supplied with the source.
 , deleteVendor ? false
 
diff --git a/pkgs/development/interpreters/janet/default.nix b/pkgs/development/interpreters/janet/default.nix
index f6f4e36532e..32312401f96 100644
--- a/pkgs/development/interpreters/janet/default.nix
+++ b/pkgs/development/interpreters/janet/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "janet";
-  version = "1.9.1";
+  version = "1.10.0";
 
   src = fetchFromGitHub {
     owner = "janet-lang";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1zdiwddnppwg5zrizy2ypd449zj4mivib76h73xhvr1syl7dk7sc";
+    sha256 = "0kx3c4v0481b4xx239w10ajwp8ngq8smxzh3m77dazd89r997n1g";
   };
 
   nativeBuildInputs = [ meson ninja ];
diff --git a/pkgs/development/libraries/libraspberrypi/default.nix b/pkgs/development/libraries/libraspberrypi/default.nix
index 1cd1f5e62ac..bbe0b614550 100644
--- a/pkgs/development/libraries/libraspberrypi/default.nix
+++ b/pkgs/development/libraries/libraspberrypi/default.nix
@@ -2,12 +2,12 @@
 
 stdenv.mkDerivation rec {
   name = "libraspberrypi";
-  version = "2019-10-22";
+  version = "2020-05-28";
   src = fetchFromGitHub {
     owner = "raspberrypi";
     repo = "userland";
-    rev = "5070cb7fc150fc98f1ed64a7739c3356970d9f76";
-    sha256 = "08yfzwn9s7lhrblcsxyag9p5lj5vk3n66b1pv3f7r3hah7qcggyq";
+    rev = "f97b1af1b3e653f9da2c1a3643479bfd469e3b74";
+    sha256 = "1r7n05rv96hqjq0rn0qzchmfqs0j7vh3p8jalgh66s6l0vms5mwy";
   };
 
   cmakeFlags = if (stdenv.targetPlatform.system == "aarch64-linux")
diff --git a/pkgs/development/libraries/lmdb/default.nix b/pkgs/development/libraries/lmdb/default.nix
index 513e842edfa..64f6fccefa7 100644
--- a/pkgs/development/libraries/lmdb/default.nix
+++ b/pkgs/development/libraries/lmdb/default.nix
@@ -1,14 +1,13 @@
-{ stdenv, fetchFromGitHub }:
+{ stdenv, fetchgit }:
 
 stdenv.mkDerivation rec {
   pname = "lmdb";
-  version = "0.9.24";
+  version = "0.9.25";
 
-  src = fetchFromGitHub {
-    owner = "LMDB";
-    repo = "lmdb";
+  src = fetchgit {
+    url = "https://git.openldap.org/openldap/openldap.git";
     rev = "LMDB_${version}";
-    sha256 = "088q6m8fvr12w43s461h7cvpg5hj8csaqj6n9pci150dz7bk5lxm";
+    sha256 = "0i60zlca8r6fib23gdgl4c80gxpx24772ggpvz94yr7zaai4k11w";
   };
 
   postUnpack = "sourceRoot=\${sourceRoot}/libraries/liblmdb";
diff --git a/pkgs/development/libraries/protobufc/1.3.nix b/pkgs/development/libraries/protobufc/1.3.nix
index 304f9d61f39..82126727282 100644
--- a/pkgs/development/libraries/protobufc/1.3.nix
+++ b/pkgs/development/libraries/protobufc/1.3.nix
@@ -1,12 +1,11 @@
 { callPackage, fetchFromGitHub, ... } @ args:
 
-callPackage ./generic.nix (args // {
-  version = "1.3.1";
+callPackage ./generic.nix (args // rec {
+  version = "1.3.3";
   src = fetchFromGitHub {
     owner = "protobuf-c";
     repo = "protobuf-c";
-    #rev = "v${version}";
-    rev = "9412830d0680150d429d2aa170b8d7218ab49397";
-    sha256 = "175cmaj5231iqzhf5a9sxw2y3i165chk3681m1b5mp8di927q5ai";
+    rev = "v${version}";
+    sha256 = "13948amsjj9xpa4yl6amlyk3ksr96bbd4ngshh2yzflwcslhg6gv";
   };
 })
diff --git a/pkgs/development/libraries/swiften/build-fix.patch b/pkgs/development/libraries/swiften/build-fix.patch
new file mode 100644
index 00000000000..01814cadfbd
--- /dev/null
+++ b/pkgs/development/libraries/swiften/build-fix.patch
@@ -0,0 +1,32 @@
+diff -wbBur swift-4.0.2/Swift/QtUI/UserSearch/QtUserSearchWindow.h swift-4.0.2.my/Swift/QtUI/UserSearch/QtUserSearchWindow.h
+--- swift-4.0.2/Swift/QtUI/UserSearch/QtUserSearchWindow.h	2018-04-06 13:06:46.000000000 +0300
++++ swift-4.0.2.my/Swift/QtUI/UserSearch/QtUserSearchWindow.h	2019-10-08 20:52:23.171475337 +0300
+@@ -9,6 +9,7 @@
+ #include <set>
+ 
+ #include <QWizard>
++#include <QAbstractItemModel>
+ 
+ #include <Swiften/Base/Override.h>
+ 
+diff -wbBur swift-4.0.2/Swiften/Network/PlatformNATTraversalWorker.cpp swift-4.0.2.my/Swiften/Network/PlatformNATTraversalWorker.cpp
+--- swift-4.0.2/Swiften/Network/PlatformNATTraversalWorker.cpp	2018-04-06 13:06:46.000000000 +0300
++++ swift-4.0.2.my/Swiften/Network/PlatformNATTraversalWorker.cpp	2019-10-08 21:12:25.284754131 +0300
+@@ -157,7 +157,7 @@
+         miniUPnPInterface = new MiniUPnPInterface();
+         miniUPnPSupported = miniUPnPInterface->isAvailable();
+     }
+-    SWIFT_LOG(debug) << "UPnP NAT traversal supported: " << miniUPnPSupported << std::endl;
++//    SWIFT_LOG(debug) << "UPnP NAT traversal supported: " << miniUPnPSupported << std::endl;
+     if (miniUPnPSupported) {
+         return miniUPnPInterface;
+     }
+@@ -168,7 +168,7 @@
+         natPMPInterface = new NATPMPInterface();
+         natPMPSupported = natPMPInterface->isAvailable();
+     }
+-    SWIFT_LOG(debug) << "NAT-PMP NAT traversal supported: " << natPMPSupported << std::endl;
++//    SWIFT_LOG(debug) << "NAT-PMP NAT traversal supported: " << natPMPSupported << std::endl;
+     if (natPMPSupported) {
+         return natPMPInterface;
+     }
diff --git a/pkgs/development/libraries/swiften/default.nix b/pkgs/development/libraries/swiften/default.nix
index bdac55fe2ec..19bacdd2a61 100644
--- a/pkgs/development/libraries/swiften/default.nix
+++ b/pkgs/development/libraries/swiften/default.nix
@@ -12,17 +12,21 @@ stdenv.mkDerivation rec {
     sha256 = "0w0aiszjd58ynxpacwcgf052zpmbpcym4dhci64vbfgch6wryz0w";
   };
 
-  patches = [ ./scons.patch ];
+  patches = [ ./scons.patch ./build-fix.patch ];
 
   sconsFlags = [
     "openssl=${openssl.dev}"
     "boost_includedir=${boost.dev}/include"
     "boost_libdir=${boost.out}/lib"
     "boost_bundled_enable=false"
+    "max_jobs=1"
+    "optimize=1"
+    "debug=0"
+    "swiften_dll=1"
   ];
   preInstall = ''
     installTargets="$out"
-    installFlags+=" SWIFT_INSTALLDIR=$out"
+    installFlags+=" SWIFTEN_INSTALLDIR=$out"
   '';
 
   enableParallelBuilding = true;
@@ -33,6 +37,5 @@ stdenv.mkDerivation rec {
     license     = licenses.gpl2Plus;
     platforms   = platforms.linux;
     maintainers = [ maintainers.twey ];
-    broken = true; # Broken since 2019-11-20 (https://hydra.nixos.org/build/114681755)
   };
 }
diff --git a/pkgs/development/libraries/wlroots/default.nix b/pkgs/development/libraries/wlroots/default.nix
index 104e0c3440a..33db6e9d75b 100644
--- a/pkgs/development/libraries/wlroots/default.nix
+++ b/pkgs/development/libraries/wlroots/default.nix
@@ -1,7 +1,7 @@
 { stdenv, fetchFromGitHub, meson, ninja, pkg-config, wayland
 , libGL, wayland-protocols, libinput, libxkbcommon, pixman
 , xcbutilwm, libX11, libcap, xcbutilimage, xcbutilerrors, mesa
-, libpng, ffmpeg_4
+, libpng, ffmpeg
 }:
 
 stdenv.mkDerivation rec {
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
   buildInputs = [
     libGL wayland-protocols libinput libxkbcommon pixman
     xcbutilwm libX11 libcap xcbutilimage xcbutilerrors mesa
-    libpng ffmpeg_4
+    libpng ffmpeg
   ];
 
   postInstall = ''
diff --git a/pkgs/development/misc/rpiboot/unstable.nix b/pkgs/development/misc/rpiboot/unstable.nix
index 1591a1efd17..a8f7e4795e7 100644
--- a/pkgs/development/misc/rpiboot/unstable.nix
+++ b/pkgs/development/misc/rpiboot/unstable.nix
@@ -1,7 +1,7 @@
 { stdenv, fetchFromGitHub, libusb1 }:
 
 let
-  version = "2018-03-27";
+  version = "2020-05-11";
   name = "rpiboot-unstable-${version}";
 in stdenv.mkDerivation {
   inherit name;
@@ -9,8 +9,8 @@ in stdenv.mkDerivation {
   src = fetchFromGitHub {
     owner = "raspberrypi";
     repo = "usbboot";
-    rev = "fb86716935f2e820333b037a2ff93a338ad9b695";
-    sha256 = "163g7iw7kf6ra71adx6lf1xzf3kv20bppva15ljwn54jlah5mv98";
+    rev = "c650cd747c1d0597487dcf319bf95b5ba775d78b";
+    sha256 = "17kapny79dh05vfmrniqdvz6xhpwnqnw0511ycfx4qcjh4krxh8n";
   };
 
   nativeBuildInputs = [ libusb1 ];
diff --git a/pkgs/development/python-modules/av/default.nix b/pkgs/development/python-modules/av/default.nix
index 3a2fcc04d04..594ac42018b 100644
--- a/pkgs/development/python-modules/av/default.nix
+++ b/pkgs/development/python-modules/av/default.nix
@@ -3,7 +3,7 @@
 , fetchPypi
 , isPy27
 , numpy
-, ffmpeg_4
+, ffmpeg
 , pkgconfig
 }:
 
@@ -20,7 +20,7 @@ buildPythonPackage rec {
   checkInputs = [ numpy ];
 
   nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [ ffmpeg_4 ];
+  buildInputs = [ ffmpeg ];
 
   # Tests require downloading files from internet
   doCheck = false;
diff --git a/pkgs/development/python-modules/jc/default.nix b/pkgs/development/python-modules/jc/default.nix
index e7942760b72..e48fec89b9d 100644
--- a/pkgs/development/python-modules/jc/default.nix
+++ b/pkgs/development/python-modules/jc/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "jc";
-  version = "1.11.2";
+  version = "1.11.6";
   disabled = isPy27;
 
   src = fetchFromGitHub {
     owner = "kellyjonbrazil";
     repo = "jc";
     rev = "v${version}";
-    sha256 = "1gsvjgypjgw5a0k85kdvbbf7q6wspmv6z76acrgnidhav8sdn4dm";
+    sha256 = "0jyygq7zmam7yriiv5j4d6mpjdi2p3p7d53bn3qwfzkh4ifsbfan";
   };
 
   propagatedBuildInputs = [ ruamel_yaml xmltodict pygments ];
diff --git a/pkgs/development/python-modules/matrix-nio/default.nix b/pkgs/development/python-modules/matrix-nio/default.nix
index ff4f6198aa5..aca4bf35434 100644
--- a/pkgs/development/python-modules/matrix-nio/default.nix
+++ b/pkgs/development/python-modules/matrix-nio/default.nix
@@ -19,14 +19,14 @@
 }:
 
 buildPythonPackage rec {
-  pname = "nio";
-  version = "0.10.0";
+  pname = "matrix-nio";
+  version = "0.12.0";
 
   src = fetchFromGitHub {
     owner = "poljar";
     repo = "matrix-nio";
     rev = version;
-    sha256 = "04ryf9lrm0820hqij46hav6mgplabnyl9dfj46iwvxasn06fh2j8";
+    sha256 = "1d4jhl2xjjp31yjs4zz2cfkvzbi2vr5bsrp07s6nhyc18azxr7ba";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/playsound/default.nix b/pkgs/development/python-modules/playsound/default.nix
new file mode 100644
index 00000000000..589a8f3db81
--- /dev/null
+++ b/pkgs/development/python-modules/playsound/default.nix
@@ -0,0 +1,28 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+}:
+
+buildPythonPackage rec {
+  pname = "playsound";
+  version = "1.2.2";
+
+  src = fetchFromGitHub {
+    owner = "TaylorSMarks";
+    repo = "playsound";
+    rev = "907f1fe73375a2156f7e0900c4b42c0a60fa1d00";
+    sha256 = "1fh3m115h0c57lj2pfhhqhmsh5awzblb7csi1xc5a6f6slhl059k";
+  };
+
+  doCheck = false;
+
+  pythonImportsCheck = [ "playsound" ];
+
+  meta = with lib; {
+    homepage = "https://github.com/TaylorSMarks/playsound";
+    description = "Pure Python, cross platform, single function module with no dependencies for playing sounds";
+    license = licenses.mit;
+    platforms = platforms.all;
+    maintainers = with maintainers; [ luc65r ];
+  };
+}
diff --git a/pkgs/development/tools/analysis/cppcheck/default.nix b/pkgs/development/tools/analysis/cppcheck/default.nix
index bdd275a218b..8e2c28336cf 100644
--- a/pkgs/development/tools/analysis/cppcheck/default.nix
+++ b/pkgs/development/tools/analysis/cppcheck/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "cppcheck";
-  version = "2.0";
+  version = "2.1";
 
   src = fetchurl {
     url = "mirror://sourceforge/${pname}/${pname}-${version}.tar.bz2";
-    sha256 = "0gssnb50cndr77xva4nar4a82ii0vfqy96dlm27gb7pd6xmd6xsz";
+    sha256 = "1xx5i6z9a36h7k4ipikrk2zidk7jcjv8ryqyq2m5hnwy0gpyw9mb";
   };
 
   buildInputs = [ pcre ] ++ stdenv.lib.optionals withZ3 [ z3 ];
diff --git a/pkgs/development/tools/poetry2nix/poetry2nix/overrides.nix b/pkgs/development/tools/poetry2nix/poetry2nix/overrides.nix
index c5ae5e19121..62f2ed6e306 100644
--- a/pkgs/development/tools/poetry2nix/poetry2nix/overrides.nix
+++ b/pkgs/development/tools/poetry2nix/poetry2nix/overrides.nix
@@ -24,7 +24,7 @@ self: super:
       nativeBuildInputs = old.nativeBuildInputs ++ [
         pkgs.pkgconfig
       ];
-      buildInputs = old.buildInputs ++ [ pkgs.ffmpeg_4 ];
+      buildInputs = old.buildInputs ++ [ pkgs.ffmpeg ];
     }
   );
 
diff --git a/pkgs/development/tools/vagrant/default.nix b/pkgs/development/tools/vagrant/default.nix
index 32e205a6f8d..338e8f68d35 100644
--- a/pkgs/development/tools/vagrant/default.nix
+++ b/pkgs/development/tools/vagrant/default.nix
@@ -5,9 +5,9 @@
 let
   # NOTE: bumping the version and updating the hash is insufficient;
   # you must use bundix to generate a new gemset.nix in the Vagrant source.
-  version = "2.2.8";
+  version = "2.2.9";
   url = "https://github.com/hashicorp/vagrant/archive/v${version}.tar.gz";
-  sha256 = "0nvxda0dyhncgcl9qs34l4rj0jbdbg65a3ii5765p4899z6gzx95";
+  sha256 = "0fbickjjliaw3cpkh3pl9bp56b2gcqn87c5ag67amc450ah43rdq";
 
   deps = bundlerEnv rec {
     name = "${pname}-${version}";
diff --git a/pkgs/development/tools/vagrant/gemset.nix b/pkgs/development/tools/vagrant/gemset.nix
index f5d70b912df..00838c6e0c5 100644
--- a/pkgs/development/tools/vagrant/gemset.nix
+++ b/pkgs/development/tools/vagrant/gemset.nix
@@ -85,10 +85,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "10lfhahnnc91v63xpvk65apn61pib086zha3z5sp1xk9acfx12h4";
+      sha256 = "12lpwaw82bb0rm9f52v1498bpba8aj2l2q359mkwbxsswhpga5af";
       type = "gem";
     };
-    version = "1.12.2";
+    version = "1.13.1";
   };
   gssapi = {
     dependencies = ["ffi"];
@@ -149,10 +149,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0jwrd1l4mxz06iyx6053lr6hz2zy7ah2k3ranfzisvych5q19kwm";
+      sha256 = "10nq1xjqvkhngiygji831qx9bryjwws95r4vrnlq9142bzkg670s";
       type = "gem";
     };
-    version = "1.8.2";
+    version = "1.8.3";
   };
   listen = {
     dependencies = ["rb-fsevent" "rb-inotify" "ruby_dep"];
@@ -212,10 +212,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1zin0q26wc5p7zb7glpwary7ms60s676vcq987yv22jgm6hnlwlh";
+      sha256 = "1z75svngyhsglx0y2f9rnil2j08f9ab54b3l95bpgz67zq2if753";
       type = "gem";
     };
-    version = "3.2020.0425";
+    version = "3.2020.0512";
   };
   multi_json = {
     groups = ["default"];
diff --git a/pkgs/games/openmw/default.nix b/pkgs/games/openmw/default.nix
index cae97dc4215..22f3ea8d6ad 100644
--- a/pkgs/games/openmw/default.nix
+++ b/pkgs/games/openmw/default.nix
@@ -6,19 +6,19 @@ let
     src = fetchFromGitHub {
       owner = "OpenMW";
       repo = "osg";
-      rev = "2b4c8e37268e595b82da4b9aadd5507852569b87";
-      sha256 = "0admnllxic6dcpic0h100927yw766ab55dix002vvdx36i6994jb";
+      rev = "1556cd7966ebc1c80b6626988d2b25fb43a744cf";
+      sha256 = "0d74hijzmj82nx3jkv5qmr3pkgvplra0b8fbjx1y3vmzxamb0axd";
     };
   });
 in mkDerivationWith stdenv.mkDerivation rec {
-  version = "0.45.0";
+  version = "0.46.0";
   pname = "openmw";
 
   src = fetchFromGitHub {
     owner = "OpenMW";
     repo = "openmw";
     rev = "${pname}-${version}";
-    sha256 = "1r87zrsnza2v9brksh809zzqj6zhk5xj15qs8iq11v1bscm2a2j4";
+    sha256 = "0rm32zsmxvr6b0jjihfj543skhicbw5kg6shjx312clhlm035w2x";
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/misc/drivers/hplip/default.nix b/pkgs/misc/drivers/hplip/default.nix
index 2ecd163fbf2..98ced28b877 100644
--- a/pkgs/misc/drivers/hplip/default.nix
+++ b/pkgs/misc/drivers/hplip/default.nix
@@ -5,7 +5,7 @@
 , net-snmp, openssl, perl, nettools
 , bash, coreutils, utillinux
 # To remove references to gcc-unwrapped
-, removeReferencesTo
+, removeReferencesTo, qt5
 , withQt5 ? true
 , withPlugin ? false
 , withStaticPPDInstall ? false
@@ -67,12 +67,15 @@ python3Packages.buildPythonApplication {
     zlib
   ];
 
-  nativeBuildInputs = [ pkgconfig removeReferencesTo ];
+  nativeBuildInputs = [
+    pkgconfig
+    removeReferencesTo
+  ] ++ stdenv.lib.optional withQt5 qt5.wrapQtAppsHook;
 
   pythonPath = with python3Packages; [
     dbus
     pillow
-    pygobject2
+    pygobject3
     reportlab
     usbutils
     sip
@@ -219,6 +222,10 @@ python3Packages.buildPythonApplication {
       --replace {,${utillinux}/bin/}logger \
       --replace {/usr,$out}/bin
     remove-references-to -t ${stdenv.cc.cc} $(readlink -f $out/lib/*.so)
+  '' + stdenv.lib.optionalString withQt5 ''
+    for f in $out/bin/hp-*;do
+      wrapQtApp $f
+    done
   '';
 
   # There are some binaries there, which reference gcc-unwrapped otherwise.
diff --git a/pkgs/os-specific/linux/firmware/raspberrypi/default.nix b/pkgs/os-specific/linux/firmware/raspberrypi/default.nix
index bd9c58d33c9..77a28444636 100644
--- a/pkgs/os-specific/linux/firmware/raspberrypi/default.nix
+++ b/pkgs/os-specific/linux/firmware/raspberrypi/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "raspberrypi-firmware";
-  version = "1.20190925";
+  version = "1.20200601";
 
   src = fetchFromGitHub {
     owner = "raspberrypi";
     repo = "firmware";
     rev = version;
-    sha256 = "0xyj3f04dcfnl9hp8hakgwcb1msqh7934n0pclcmzy47xjkz7ris";
+    sha256 = "1vm038f9digwg8gdxl2bypzlip3ycjb6bl56274gh5i9abl6wjvf";
   };
 
   installPhase = ''
diff --git a/pkgs/os-specific/linux/firmware/raspberrypi/tools-dont-install-sysv-init-scripts.patch b/pkgs/os-specific/linux/firmware/raspberrypi/tools-dont-install-sysv-init-scripts.patch
deleted file mode 100644
index e12aeeb0cdb..00000000000
--- a/pkgs/os-specific/linux/firmware/raspberrypi/tools-dont-install-sysv-init-scripts.patch
+++ /dev/null
@@ -1,20 +0,0 @@
-diff --git a/interface/vmcs_host/linux/vcfiled/CMakeLists.txt b/interface/vmcs_host/linux/vcfiled/CMakeLists.txt
-index aed0e83..b325676 100644
---- a/interface/vmcs_host/linux/vcfiled/CMakeLists.txt
-+++ b/interface/vmcs_host/linux/vcfiled/CMakeLists.txt
-@@ -17,15 +17,6 @@ target_link_libraries(vcfiled
- install(TARGETS vcfiled 
-         RUNTIME DESTINATION sbin)
- 
--configure_file (etc/init.d/vcfiled ${PROJECT_BINARY_DIR}/etc/init.d/vcfiled)
--
--# script to start up vcfiled at start of day
--install(PROGRAMS ${PROJECT_BINARY_DIR}/etc/init.d/vcfiled
--        DESTINATION /etc/init.d)
--# install locally to the installation directory too
--install(PROGRAMS ${PROJECT_BINARY_DIR}/etc/init.d/vcfiled
--        DESTINATION ${VMCS_INSTALL_PREFIX}/share/install)
--
- # test program for vcfiled_check library
- add_executable(vcfiled_lock_test vcfiled_lock_test.c)
- target_link_libraries(vcfiled_lock_test vcfiled_check)
diff --git a/pkgs/os-specific/linux/firmware/raspberrypi/tools.nix b/pkgs/os-specific/linux/firmware/raspberrypi/tools.nix
index e3fa90ac388..6c4d49e4e24 100644
--- a/pkgs/os-specific/linux/firmware/raspberrypi/tools.nix
+++ b/pkgs/os-specific/linux/firmware/raspberrypi/tools.nix
@@ -2,17 +2,15 @@
 
 stdenv.mkDerivation {
   pname = "raspberrypi-tools";
-  version = "2018-10-03";
+  version = "2020-05-28";
 
   src = fetchFromGitHub {
     owner = "raspberrypi";
     repo = "userland";
-    rev = "de4a7f2e3c391e2d3bc76af31864270e7802d9ac";
-    sha256 = "0w96xa98ngdk9m6wv185w8waa7wm2hkn2bhxz52zd477hchzrxlg";
+    rev = "f97b1af1b3e653f9da2c1a3643479bfd469e3b74";
+    sha256 = "1r7n05rv96hqjq0rn0qzchmfqs0j7vh3p8jalgh66s6l0vms5mwy";
   };
 
-  patches = [ ./tools-dont-install-sysv-init-scripts.patch ];
-
   nativeBuildInputs = [ cmake pkgconfig ];
 
   preConfigure = ''
diff --git a/pkgs/os-specific/linux/kernel/linux-rpi.nix b/pkgs/os-specific/linux/kernel/linux-rpi.nix
index 31a2cc2aa15..a3d2bfd4836 100644
--- a/pkgs/os-specific/linux/kernel/linux-rpi.nix
+++ b/pkgs/os-specific/linux/kernel/linux-rpi.nix
@@ -1,8 +1,8 @@
 { stdenv, lib, buildPackages, fetchFromGitHub, perl, buildLinux, rpiVersion, ... } @ args:
 
 let
-  modDirVersion = "4.19.75";
-  tag = "1.20190925";
+  modDirVersion = "4.19.118";
+  tag = "1.20200601";
 in
 lib.overrideDerivation (buildLinux (args // {
   version = "${modDirVersion}-${tag}";
@@ -12,7 +12,7 @@ lib.overrideDerivation (buildLinux (args // {
     owner = "raspberrypi";
     repo = "linux";
     rev = "raspberrypi-kernel_${tag}-1";
-    sha256 = "0l91kb4jjxg4fcp7d2aqm1fj34ns137rys93k907mdgnarcliafs";
+    sha256 = "11jzsmnd1qry2ir9vmsv0nfdzjpgkn5yab5ylxcz406plc073anp";
   };
 
   defconfig = {
diff --git a/pkgs/os-specific/linux/microcode/intel.nix b/pkgs/os-specific/linux/microcode/intel.nix
index c0201fb01fd..475288a0b6f 100644
--- a/pkgs/os-specific/linux/microcode/intel.nix
+++ b/pkgs/os-specific/linux/microcode/intel.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "microcode-intel";
-  version = "20200520";
+  version = "20200616";
 
   src = fetchFromGitHub {
     owner = "intel";
     repo = "Intel-Linux-Processor-Microcode-Data-Files";
     rev = "microcode-${version}";
-    sha256 = "1cs4b7q9j2lw2y09rfa82aijbfmy4lddahz8qlz9gwajf2ziqns8";
+    sha256 = "13jrs8hwh7dhjjb9kncb8lk199afaxglkh1cfisl6zca1h36g563";
   };
 
   nativeBuildInputs = [ iucode-tool libarchive ];
diff --git a/pkgs/os-specific/linux/wireguard/default.nix b/pkgs/os-specific/linux/wireguard/default.nix
index 4617db5e767..6af465da473 100644
--- a/pkgs/os-specific/linux/wireguard/default.nix
+++ b/pkgs/os-specific/linux/wireguard/default.nix
@@ -7,11 +7,11 @@ assert stdenv.lib.versionOlder kernel.version "5.6";
 
 stdenv.mkDerivation rec {
   pname = "wireguard";
-  version = "1.0.20200520";
+  version = "1.0.20200611";
 
   src = fetchzip {
     url = "https://git.zx2c4.com/wireguard-linux-compat/snapshot/wireguard-linux-compat-${version}.tar.xz";
-    sha256 = "1zggpm0zh6m30b9mchj3bg3z721k346r5m5a130inp779s4xm0sm";
+    sha256 = "0a8xsjxp8krmm2px07x9qw8nhvp5ispf4mnc6k59p0qp26qbva5d";
   };
 
   hardeningDisable = [ "pic" ];
diff --git a/pkgs/servers/mail/dovecot/plugins/fts_xapian/default.nix b/pkgs/servers/mail/dovecot/plugins/fts_xapian/default.nix
new file mode 100644
index 00000000000..8a0f2d4efab
--- /dev/null
+++ b/pkgs/servers/mail/dovecot/plugins/fts_xapian/default.nix
@@ -0,0 +1,35 @@
+{ stdenv, fetchFromGitHub, autoconf, automake, pkg-config, dovecot, libtool, xapian, icu64, sqlite }:
+stdenv.mkDerivation {
+  pname = "fts-xapian";
+  version = "1.3.1";
+
+  src = fetchFromGitHub {
+    owner = "grosjo";
+    repo = "fts-xapian";
+    rev = "1.3.1";
+    sha256 = "10yl5fyfbx2ijqckx13vbmzj9mpm5pkh8qzichbdgplrzm738q43";
+  };
+
+  buildInputs = [ dovecot xapian icu64 sqlite ];
+
+  nativeBuildInputs = [ autoconf automake libtool pkg-config ];
+
+  preConfigure = ''
+    export PANDOC=false
+    autoreconf -vi
+  '';
+
+  configureFlags = [
+    "--with-dovecot=${dovecot}/lib/dovecot"
+    "--without-dovecot-install-dirs"
+    "--with-moduledir=$(out)/lib/dovecot"
+  ];
+
+  meta = with stdenv.lib; {
+    homepage = "https://github.com/grosjo/fts-xapian";
+    description = "Dovecot FTS plugin based on Xapian";
+    license = licenses.lgpl21;
+    maintainers = with maintainers; [ julm ];
+    platforms = platforms.unix;
+  };
+}
diff --git a/pkgs/servers/monitoring/prometheus/mysqld-exporter.nix b/pkgs/servers/monitoring/prometheus/mysqld-exporter.nix
index 3ef947b2873..8787a39de32 100644
--- a/pkgs/servers/monitoring/prometheus/mysqld-exporter.nix
+++ b/pkgs/servers/monitoring/prometheus/mysqld-exporter.nix
@@ -2,7 +2,7 @@
 
 buildGoPackage rec {
   pname = "mysqld_exporter";
-  version = "0.11.0";
+  version = "0.12.1";
   rev = "v${version}";
 
   goPackagePath = "github.com/prometheus/mysqld_exporter";
@@ -11,7 +11,7 @@ buildGoPackage rec {
     inherit rev;
     owner = "prometheus";
     repo = "mysqld_exporter";
-    sha256 = "1684jf96dy5bs0y0689vlcw82lqw8kw2phlnp6pq1cq56fcwdxjn";
+    sha256 = "0nzbfzx4dzs3cagdid1fqddrqimgr8x6r8gmmxglrss05c8srgs8";
   };
 
   meta = with stdenv.lib; {
diff --git a/pkgs/servers/monitoring/prometheus/node-exporter.nix b/pkgs/servers/monitoring/prometheus/node-exporter.nix
index ba10cfa1485..8d5134437d9 100644
--- a/pkgs/servers/monitoring/prometheus/node-exporter.nix
+++ b/pkgs/servers/monitoring/prometheus/node-exporter.nix
@@ -2,7 +2,7 @@
 
 buildGoPackage rec {
   pname = "node_exporter";
-  version = "1.0.0";
+  version = "1.0.1";
   rev = "v${version}";
 
   goPackagePath = "github.com/prometheus/node_exporter";
@@ -11,7 +11,7 @@ buildGoPackage rec {
     inherit rev;
     owner = "prometheus";
     repo = "node_exporter";
-    sha256 = "12v7vaknvll3g1n7730miwxiwz8nbjq8y18lzljq9d9s8apcy32f";
+    sha256 = "1r0xx81r9v019fl0iv078yl21ndhb356y7s7zx171zi02k7a4p2l";
   };
 
   # FIXME: tests fail due to read-only nix store
diff --git a/pkgs/servers/mqtt/mosquitto/default.nix b/pkgs/servers/mqtt/mosquitto/default.nix
index b52cfb09d4f..8f632ed9b58 100644
--- a/pkgs/servers/mqtt/mosquitto/default.nix
+++ b/pkgs/servers/mqtt/mosquitto/default.nix
@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   pname = "mosquitto";
-  version = "1.6.8";
+  version = "1.6.10";
 
   src = fetchFromGitHub {
     owner  = "eclipse";
     repo   = "mosquitto";
     rev    = "v${version}";
-    sha256 = "1py13vg3vwwwg6jdnmq46z6rlzb84r4ggqsmsrn4yar5hrw9pa90";
+    sha256 = "0g9iywm0s08b0ax1qx4j5lixfc1m6p48lv14vlil6wns4azc3fsc";
   };
 
   postPatch = ''
diff --git a/pkgs/tools/X11/xpra/default.nix b/pkgs/tools/X11/xpra/default.nix
index 91a58438c17..6fe433daf8b 100644
--- a/pkgs/tools/X11/xpra/default.nix
+++ b/pkgs/tools/X11/xpra/default.nix
@@ -1,7 +1,7 @@
 { stdenv, lib, fetchurl, callPackage, substituteAll, python3, pkgconfig, writeText
 , xorg, gtk3, glib, pango, cairo, gdk-pixbuf, atk
 , wrapGAppsHook, xorgserver, getopt, xauth, utillinux, which
-, ffmpeg_4, x264, libvpx, libwebp, x265
+, ffmpeg, x264, libvpx, libwebp, x265
 , libfakeXinerama
 , gst_all_1, pulseaudio, gobject-introspection
 , pam }:
@@ -60,7 +60,7 @@ in buildPythonApplication rec {
 
     pango cairo gdk-pixbuf atk.out gtk3 glib
 
-    ffmpeg_4 libvpx x264 libwebp x265
+    ffmpeg libvpx x264 libwebp x265
 
     gst_all_1.gstreamer
     gst_all_1.gst-plugins-base
diff --git a/pkgs/tools/misc/diffoscope/default.nix b/pkgs/tools/misc/diffoscope/default.nix
index dfd227f917e..5e5550e0b41 100644
--- a/pkgs/tools/misc/diffoscope/default.nix
+++ b/pkgs/tools/misc/diffoscope/default.nix
@@ -1,6 +1,6 @@
 { lib, stdenv, fetchurl, fetchpatch, runCommand, makeWrapper, python3Packages, docutils, help2man
 , abootimg, acl, apktool, binutils-unwrapped, build-tools, bzip2, cbfstool, cdrkit, colord, colordiff, coreutils, cpio, db, diffutils, dtc
-, e2fsprogs, file, findutils, fontforge-fonttools, ffmpeg_4, fpc, gettext, ghc, ghostscriptX, giflib, gnumeric, gnupg, gnutar
+, e2fsprogs, file, findutils, fontforge-fonttools, ffmpeg, fpc, gettext, ghc, ghostscriptX, giflib, gnumeric, gnupg, gnutar
 , gzip, hdf5, imagemagick, jdk, libarchive, libcaca, llvm, lz4, mono, openssh, openssl, pdftk, pgpdump, poppler_utils, qemu, R
 , sng, sqlite, squashfsTools, tcpdump, odt2txt, unzip, wabt, xxd, xz, zip, zstd
 , enableBloat ? false
@@ -62,7 +62,7 @@ python3Packages.buildPythonApplication rec {
     ])
     ++ lib.optionals stdenv.isLinux [ python3Packages.pyxattr acl cdrkit ]
     ++ lib.optionals enableBloat ([
-      abootimg apksigner apktool cbfstool colord ffmpeg_4 fpc ghc ghostscriptX giflib gnupg gnumeric
+      abootimg apksigner apktool cbfstool colord ffmpeg fpc ghc ghostscriptX giflib gnupg gnumeric
       hdf5 imagemagick llvm jdk mono odt2txt openssh pdftk poppler_utils qemu R tcpdump wabt
     ] ++ (with python3Packages; [ binwalk guestfs h5py ]));
 
diff --git a/pkgs/tools/misc/youtube-dl/default.nix b/pkgs/tools/misc/youtube-dl/default.nix
index dc2d3cf8a1e..94f4de6e364 100644
--- a/pkgs/tools/misc/youtube-dl/default.nix
+++ b/pkgs/tools/misc/youtube-dl/default.nix
@@ -1,5 +1,5 @@
 { lib, fetchurl, buildPythonPackage
-, zip, ffmpeg_4, rtmpdump, phantomjs2, atomicparsley, pycryptodome, pandoc
+, zip, ffmpeg, rtmpdump, phantomjs2, atomicparsley, pycryptodome, pandoc
 # Pandoc is required to build the package's man page. Release tarballs contain a
 # formatted man page already, though, it will still be installed. We keep the
 # manpage argument in place in case someone wants to use this derivation to
@@ -18,11 +18,11 @@ buildPythonPackage rec {
   # The websites youtube-dl deals with are a very moving target. That means that
   # downloads break constantly. Because of that, updates should always be backported
   # to the latest stable release.
-  version = "2020.06.06";
+  version = "2020.06.16.1";
 
   src = fetchurl {
     url = "https://yt-dl.org/downloads/${version}/${pname}-${version}.tar.gz";
-    sha256 = "1qrrr14glv0jv377n61paq55b6k58jpnwbz2sp5xfl4wnxy5hqny";
+    sha256 = "1q0080cvxpfakgbzigbnl9adnga3jz1sqig2rsiq52rarqbc01px";
   };
 
   nativeBuildInputs = [ installShellFiles makeWrapper ];
@@ -36,7 +36,7 @@ buildPythonPackage rec {
   makeWrapperArgs = let
       packagesToBinPath =
         [ atomicparsley ]
-        ++ lib.optional ffmpegSupport ffmpeg_4
+        ++ lib.optional ffmpegSupport ffmpeg
         ++ lib.optional rtmpSupport rtmpdump
         ++ lib.optional phantomjsSupport phantomjs2;
     in [ ''--prefix PATH : "${lib.makeBinPath packagesToBinPath}"'' ];
diff --git a/pkgs/tools/networking/acme-client/default.nix b/pkgs/tools/networking/acme-client/default.nix
index 06c2898248d..00f8778cafd 100644
--- a/pkgs/tools/networking/acme-client/default.nix
+++ b/pkgs/tools/networking/acme-client/default.nix
@@ -1,7 +1,5 @@
 { stdenv
-, fetchFromGitHub
-, autoreconfHook
-, bison
+, fetchurl
 , apple_sdk ? null
 , libbsd
 , libressl
@@ -12,22 +10,20 @@ with stdenv.lib;
 
 stdenv.mkDerivation rec {
   pname = "acme-client";
-  version = "0.2.5";
+  version = "1.0.1";
 
-  src = fetchFromGitHub {
-    owner = "graywolf";
-    repo = "acme-client-portable";
-    rev = "v${version}";
-    sha256 = "1d9yk87nj5gizkq26m4wqfh4xhlrn5xlfj7mfgvrpsdiwibqxrrw";
+  src = fetchurl {
+    url = "https://data.wolfsden.cz/sources/acme-client-${version}.tar.xz";
+    sha256 = "0gmdvmyw8a61w08hrxllypf7rpnqg0fxipbk3zmvsxj7m5i6iysj";
   };
 
-  nativeBuildInputs = [ autoreconfHook bison pkgconfig ];
+  nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ libbsd libressl ] ++ optional stdenv.isDarwin apple_sdk.sdk;
 
   makeFlags = [ "PREFIX=${placeholder "out"}" ];
 
   meta = {
-    homepage = "https://github.com/graywolf/acme-client-portable";
+    homepage = "https://sr.ht/~graywolf/acme-client-portable/";
     description = "Secure ACME/Let's Encrypt client";
     platforms = platforms.unix;
     license = licenses.isc;
diff --git a/pkgs/tools/networking/dnscrypt-proxy2/default.nix b/pkgs/tools/networking/dnscrypt-proxy2/default.nix
index 508d9ecd0f3..d5b92c17a65 100644
--- a/pkgs/tools/networking/dnscrypt-proxy2/default.nix
+++ b/pkgs/tools/networking/dnscrypt-proxy2/default.nix
@@ -2,7 +2,7 @@
 
 buildGoModule rec {
   pname = "dnscrypt-proxy2";
-  version = "2.0.43";
+  version = "2.0.44";
 
   vendorSha256 = null;
 
@@ -10,7 +10,7 @@ buildGoModule rec {
     owner = "DNSCrypt";
     repo = "dnscrypt-proxy";
     rev = version;
-    sha256 = "1c12y8h7dww72a3agb74vr5fzxzy6k8394rdbgz9knk82fdwah1c";
+    sha256 = "08bg60j5z349blj5sip1f8f793q12ix3zmqkayym5nf69s1pfm7l";
   };
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/security/bitwarden_rs/default.nix b/pkgs/tools/security/bitwarden_rs/default.nix
index 158485dc982..f2d0eb9b7d3 100644
--- a/pkgs/tools/security/bitwarden_rs/default.nix
+++ b/pkgs/tools/security/bitwarden_rs/default.nix
@@ -8,13 +8,13 @@ let
 
 in rustPlatform.buildRustPackage rec {
   pname = "bitwarden_rs";
-  version = "1.15.0";
+  version = "1.15.1";
 
   src = fetchFromGitHub {
     owner = "dani-garcia";
     repo = pname;
     rev = version;
-    sha256 = "12mr7d0mjlh7za4nc3s7cizzbd6v0zfmd7q9s0f7pqz56vw5m21s";
+    sha256 = "1982bfprixdp8mx2hwidfvsi0zy7wmzf40m9m3cl5r7i2qydznwb";
   };
 
   nativeBuildInputs = [ pkgconfig ];
@@ -25,7 +25,7 @@ in rustPlatform.buildRustPackage rec {
 
   RUSTC_BOOTSTRAP = 1;
 
-  cargoSha256 = "0nacc8xvbkdzbyx4c17hdh03v9ykpis74pbpxkn6v95njw14wq53";
+  cargoSha256 = "08cygzgv82i10cj8lkjdah0arrdmlfcbdjwc8piwa629rr0584zf";
   cargoBuildFlags = [ featuresFlag ];
 
   checkPhase = ''
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index e502fab10d7..64392f49a52 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -201,7 +201,6 @@ mapAliases ({
   gupnp_igd = gupnp-igd; # added 2018-02-25
   gupnptools = gupnp-tools;  # added 2015-12-19
   gutenberg = zola;  # added 2018-11-17
-  hamster-time-traker = throw "hamster-time-tracker has been removed from nixpkgs, as it was unmaintained."; # added 2019-12-10
   heimdalFull = heimdal; # added 2018-05-01
   hepmc = hepmc2; # added 2019-08-05
   hexen = throw "hexen (SDL port) has been removed: Abandoned by upstream."; # added 2019-12-11
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 8465c506003..52cdce81aab 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -1968,7 +1968,7 @@ in
 
   interlock = callPackage ../servers/interlock {};
 
-  jellyfin = callPackage ../servers/jellyfin { ffmpeg = ffmpeg_4; };
+  jellyfin = callPackage ../servers/jellyfin { };
 
   jellyfin-mpv-shim = python3Packages.callPackage ../applications/video/jellyfin-mpv-shim { };
 
@@ -5871,8 +5871,6 @@ in
 
   patchage = callPackage ../applications/audio/patchage { };
 
-  patchwork-classic = callPackage ../applications/networking/ssb/patchwork-classic { };
-
   pcapfix = callPackage ../tools/networking/pcapfix { };
 
   pbzip2 = callPackage ../tools/compression/pbzip2 { };
@@ -6842,7 +6840,7 @@ in
 
   svgcleaner = callPackage ../tools/graphics/svgcleaner { };
 
-  ssb-patchwork = callPackage ../applications/networking/ssb/patchwork { };
+  ssb-patchwork = callPackage ../applications/networking/ssb-patchwork { };
 
   ssdeep = callPackage ../tools/security/ssdeep { };
 
@@ -11721,8 +11719,6 @@ in
   ffmpeg = ffmpeg_4;
 
   ffmpeg-full = callPackage ../development/libraries/ffmpeg-full {
-    ffmpeg = ffmpeg_4;
-
     # The following need to be fixed on Darwin
     frei0r = if stdenv.isDarwin then null else frei0r;
     game-music-emu = if stdenv.isDarwin then null else game-music-emu;
@@ -12079,7 +12075,7 @@ in
   gsettings-qt = libsForQt5.callPackage ../development/libraries/gsettings-qt { };
 
   gst_all_1 = recurseIntoAttrs(callPackage ../development/libraries/gstreamer {
-    callPackage = newScope { libav = pkgs.ffmpeg_4; };
+    callPackage = newScope { libav = pkgs.ffmpeg; };
     inherit (darwin.apple_sdk.frameworks) CoreServices;
   });
 
@@ -13813,7 +13809,7 @@ in
     withGUI = false;
   };
 
-  mlt = callPackage ../development/libraries/mlt { ffmpeg = ffmpeg_4; };
+  mlt = callPackage ../development/libraries/mlt { };
 
   mlv-app = libsForQt5.callPackage ../applications/video/mlv-app { };
 
@@ -14369,9 +14365,7 @@ in
 
     kpmcore = callPackage ../development/libraries/kpmcore { };
 
-    mlt = callPackage ../development/libraries/mlt/qt-5.nix {
-      ffmpeg = ffmpeg_4;
-    };
+    mlt = callPackage ../development/libraries/mlt/qt-5.nix { };
 
     openbr = callPackage ../development/libraries/openbr { };
 
@@ -15680,6 +15674,7 @@ in
 
   dovecot = callPackage ../servers/mail/dovecot { };
   dovecot_pigeonhole = callPackage ../servers/mail/dovecot/plugins/pigeonhole { };
+  dovecot_fts_xapian = callPackage ../servers/mail/dovecot/plugins/fts_xapian { };
 
   dspam = callPackage ../servers/mail/dspam { };
 
@@ -15770,7 +15765,7 @@ in
 
   hiawatha = callPackage ../servers/http/hiawatha {};
 
-  home-assistant = callPackage ../servers/home-assistant { 
+  home-assistant = callPackage ../servers/home-assistant {
     python3 = python37;
   };
 
@@ -18872,7 +18867,6 @@ in
   bibletime = libsForQt5.callPackage ../applications/misc/bibletime { };
 
   bino3d = libsForQt5.callPackage ../applications/video/bino3d {
-    ffmpeg = ffmpeg_4;
     glew = glew110;
   };
 
@@ -20086,6 +20080,8 @@ in
 
   hakuneko = callPackage ../tools/misc/hakuneko { };
 
+  hamster = callPackage ../applications/misc/hamster { };
+
   hashit = callPackage ../tools/misc/hashit { };
 
   hactool = callPackage ../tools/compression/hactool { };
@@ -21063,6 +21059,7 @@ in
   mpvScripts = recurseIntoAttrs {
     convert = callPackage ../applications/video/mpv/scripts/convert.nix {};
     mpris = callPackage ../applications/video/mpv/scripts/mpris.nix {};
+    simple-mpv-webui = callPackage ../applications/video/mpv/scripts/simple-mpv-webui.nix {};
   };
 
   mrpeach = callPackage ../applications/audio/pd-plugins/mrpeach { };
@@ -21380,7 +21377,7 @@ in
 
   obs-linuxbrowser = callPackage ../applications/video/obs-studio/linuxbrowser.nix { };
 
-  obs-studio = libsForQt5.callPackage ../applications/video/obs-studio { ffmpeg = ffmpeg_4; };
+  obs-studio = libsForQt5.callPackage ../applications/video/obs-studio { };
 
   obs-wlrobs = callPackage ../applications/video/obs-studio/wlrobs.nix { };
 
@@ -23661,7 +23658,6 @@ in
     inherit (plasma5) oxygen;
     inherit (kdeApplications) akonadi-contacts;
     inherit (kdeFrameworks) kcalendarcore;
-    ffmpeg = ffmpeg_4;
     opencv3 = opencv3WithoutCuda;
   };
 
@@ -26368,9 +26364,7 @@ in
 
   vazir-fonts = callPackage ../data/fonts/vazir-fonts { };
 
-  vbam = callPackage ../misc/emulators/vbam {
-    ffmpeg = ffmpeg_4;
-  };
+  vbam = callPackage ../misc/emulators/vbam { };
 
   vice = callPackage ../misc/emulators/vice {
     giflib = giflib_4_1;
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 199554f2c52..a09610a1922 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -1933,7 +1933,9 @@ in {
 
   bids-validator = callPackage ../development/python-modules/bids-validator { };
 
-  binwalk = callPackage ../development/python-modules/binwalk { };
+  binwalk = callPackage ../development/python-modules/binwalk {
+    pyqtgraph = null;
+  };
 
   binwalk-full = appendToName "full" (self.binwalk.override {
     pyqtgraph = self.pyqtgraph;
@@ -3264,6 +3266,8 @@ in {
 
   plaster-pastedeploy = callPackage ../development/python-modules/plaster-pastedeploy {};
 
+  playsound = callPackage ../development/python-modules/playsound { };
+
   plexapi = callPackage ../development/python-modules/plexapi { };
 
   plexauth = callPackage ../development/python-modules/plexauth { };