diff --git a/nixos/modules/profiles/docker-container.nix b/nixos/modules/profiles/docker-container.nix
index 5d6b11498b5..183645de36f 100644
--- a/nixos/modules/profiles/docker-container.nix
+++ b/nixos/modules/profiles/docker-container.nix
@@ -2,6 +2,8 @@
 
 with lib;
 
+let inherit (pkgs) writeScript; in
+
 let
  pkgs2storeContents = l : map (x: { object = x; symlink = "none"; }) l;
 
@@ -30,7 +32,12 @@ in {
     ];
 
     # Some container managers like lxc need these
-    extraCommands = "mkdir -p proc sys dev";
+    extraCommands =
+      let script = writeScript "extra-commands.sh" ''
+            rm etc
+            mkdir -p proc sys dev etc
+          '';
+      in script;
   };
 
   boot.isContainer = true;
diff --git a/nixos/modules/services/cluster/k3s/default.nix b/nixos/modules/services/cluster/k3s/default.nix
index ccdf54d128e..2e8bf20a68f 100644
--- a/nixos/modules/services/cluster/k3s/default.nix
+++ b/nixos/modules/services/cluster/k3s/default.nix
@@ -81,8 +81,8 @@ in
       after = mkIf cfg.docker [ "docker.service" ];
       wantedBy = [ "multi-user.target" ];
       serviceConfig = {
-        # Taken from https://github.com/rancher/k3s/blob/v1.17.4+k3s1/contrib/ansible/roles/k3s/node/templates/k3s.service.j2
-        Type = "notify";
+        # See: https://github.com/rancher/k3s/blob/dddbd16305284ae4bd14c0aade892412310d7edc/install.sh#L197
+        Type = if cfg.role == "agent" then "exec" else "notify";
         KillMode = "process";
         Delegate = "yes";
         Restart = "always";
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index cbfdf3ad9c2..38e8980b748 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -287,6 +287,7 @@ in
   snapper = handleTest ./snapper.nix {};
   solr = handleTest ./solr.nix {};
   spacecookie = handleTest ./spacecookie.nix {};
+  spike = handleTest ./spike.nix {};
   sonarr = handleTest ./sonarr.nix {};
   strongswan-swanctl = handleTest ./strongswan-swanctl.nix {};
   sudo = handleTest ./sudo.nix {};
diff --git a/pkgs/applications/misc/dmenu/wayland.nix b/pkgs/applications/misc/dmenu/wayland.nix
index 7b17d484771..ca2e6f56e84 100644
--- a/pkgs/applications/misc/dmenu/wayland.nix
+++ b/pkgs/applications/misc/dmenu/wayland.nix
@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   pname = "dmenu-wayland-unstable";
-  version = "2020-02-28";
+  version = "2020-04-03";
 
   src = fetchFromGitHub {
     owner = "nyyManni";
     repo = "dmenu-wayland";
-    rev = "68e08e8bcde10a10ac3290431f173c6c7fce4238";
-    sha256 = "10b1v2brgpgb6wkzn62haj56zmkf3aq6fs3p9rp6bxiw8bs2nvlm";
+    rev = "550a7c39f3f925b803d51c616609c8cb6c0ea543";
+    sha256 = "0az3w1csn4x6mjyacg6lf70kykdfqamic3hbr57mj83i5jjv0jlv";
   };
 
   outputs = [ "out" "man" ];
diff --git a/pkgs/applications/misc/playonlinux/default.nix b/pkgs/applications/misc/playonlinux/default.nix
index fe9838fe0d9..e3b7c48d2b4 100644
--- a/pkgs/applications/misc/playonlinux/default.nix
+++ b/pkgs/applications/misc/playonlinux/default.nix
@@ -9,7 +9,7 @@
 , imagemagick
 , netcat-gnu
 , p7zip
-, python2Packages
+, python2
 , unzip
 , wget
 , wine
@@ -27,25 +27,25 @@
 let
   version = "4.3.4";
 
-  binpath = stdenv.lib.makeBinPath
-    [ cabextract
-      python2Packages.python
-      gettext
-      glxinfo
-      gnupg
-      icoutils
-      imagemagick
-      netcat-gnu
-      p7zip
-      unzip
-      wget
-      wine
-      xdg-user-dirs
-      xterm
-      which
-      curl
-      jq
-    ];
+  binpath = stdenv.lib.makeBinPath [ 
+    cabextract
+    python
+    gettext
+    glxinfo
+    gnupg
+    icoutils
+    imagemagick
+    netcat-gnu
+    p7zip
+    unzip
+    wget
+    wine
+    xdg-user-dirs
+    xterm
+    which
+    curl
+    jq
+  ];
 
   ld32 =
     if stdenv.hostPlatform.system == "x86_64-linux" then "${stdenv.cc}/nix-support/dynamic-linker-m32"
@@ -54,6 +54,11 @@ let
   ld64 = "${stdenv.cc}/nix-support/dynamic-linker";
   libs = pkgs: stdenv.lib.makeLibraryPath [ xorg.libX11 libGL ];
 
+  python = python2.withPackages(ps: with ps; [
+    wxPython
+    setuptools
+  ]);
+
 in stdenv.mkDerivation {
   pname = "playonlinux";
   inherit version;
@@ -65,15 +70,13 @@ in stdenv.mkDerivation {
 
   nativeBuildInputs = [ makeWrapper ];
 
-  buildInputs =
-    [ python2Packages.python
-      python2Packages.wxPython
-      python2Packages.setuptools
-      xorg.libX11
-      libGL
-    ];
+  buildInputs = [ 
+    xorg.libX11
+    libGL
+    python
+  ];
 
-  patchPhase = ''
+  postPatch = ''
     patchShebangs python tests/python
     sed -i "s/ %F//g" etc/PlayOnLinux.desktop
   '';
@@ -85,7 +88,6 @@ in stdenv.mkDerivation {
     install -D -m644 etc/PlayOnLinux.desktop $out/share/applications/playonlinux.desktop
 
     makeWrapper $out/share/playonlinux/playonlinux $out/bin/playonlinux \
-      --prefix PYTHONPATH : $PYTHONPATH:$(toPythonPath "$out") \
       --prefix PATH : ${binpath}
 
     bunzip2 $out/share/playonlinux/bin/check_dd_x86.bz2
diff --git a/pkgs/applications/networking/instant-messengers/jackline/default.nix b/pkgs/applications/networking/instant-messengers/jackline/default.nix
index 92857aa1a66..f2b026e79da 100644
--- a/pkgs/applications/networking/instant-messengers/jackline/default.nix
+++ b/pkgs/applications/networking/instant-messengers/jackline/default.nix
@@ -4,19 +4,19 @@ assert stdenv.lib.versionAtLeast ocamlPackages.ocaml.version "4.07";
 
 stdenv.mkDerivation {
   pname = "jackline";
-  version = "unstable-2020-03-22";
+  version = "unstable-2020-04-24";
 
   src = fetchFromGitHub {
     owner  = "hannesm";
     repo   = "jackline";
-    rev    = "52f84525c74c43e8d03fb1e6ff025ccb2699e4aa";
-    sha256 = "0wir573ah1w16xzdn9rfwk3569zq4ff5frp0ywq70va4gdlb679c";
+    rev    = "885b97b90d565f5f7c2b5f66f5edf14a82251b87";
+    sha256 = "1mdn413ya2g0a1mrdbh1b65gnygrxb08k99z5lmidhh34kd1llsj";
   };
 
   buildInputs = with ocamlPackages; [
                   ocaml ocamlbuild findlib topkg ppx_sexp_conv ppx_deriving
                   erm_xmpp tls mirage-crypto mirage-crypto-pk x509 domain-name
-                  ocaml_lwt otr astring ptime mtime notty sexplib hex uutf
+                  ocaml_lwt otr astring ptime notty sexplib hex uutf
                   dns-client base64
                 ];
 
diff --git a/pkgs/applications/office/gnucash/default.nix b/pkgs/applications/office/gnucash/default.nix
index d7664b347ee..a8630381ebf 100644
--- a/pkgs/applications/office/gnucash/default.nix
+++ b/pkgs/applications/office/gnucash/default.nix
@@ -25,11 +25,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "gnucash";
-  version = "3.9";
+  version = "3.10";
 
   src = fetchurl {
     url = "mirror://sourceforge/gnucash/${pname}-${version}.tar.bz2";
-    sha256 = "1zxrgrjbs13vgr002rvl734w9f7zzxfq4xxmyhj777dwgkfds0ld";
+    sha256 = "05kgg7mhizndwn7icnarqk3c19xrzfawf90y9nb3jdm6fv1741xn";
   };
 
   nativeBuildInputs = [ pkgconfig makeWrapper cmake gtest ];
@@ -69,7 +69,6 @@ stdenv.mkDerivation rec {
   '';
 
   # TODO: The following tests FAILED:
-  #   61 - test-gnc-timezone (Failed)
   #   70 - test-load-c (Failed)
   #   71 - test-modsysver (Failed)
   #   72 - test-incompatdep (Failed)
diff --git a/pkgs/applications/science/misc/snakemake/default.nix b/pkgs/applications/science/misc/snakemake/default.nix
index e54dc785b08..af4e225ca32 100644
--- a/pkgs/applications/science/misc/snakemake/default.nix
+++ b/pkgs/applications/science/misc/snakemake/default.nix
@@ -2,7 +2,7 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "snakemake";
-  version = "5.13.0";
+  version = "5.15.0";
 
   propagatedBuildInputs = with python3Packages; [
     appdirs
@@ -22,13 +22,13 @@ python3Packages.buildPythonApplication rec {
 
   src = python3Packages.fetchPypi {
     inherit pname version;
-    sha256 = "11snr7sgv70d3y63s5svijfx8f4xpggh96g8chr6lccl4mi1s9x9";
+    sha256 = "10cd1k5vg8ra5fnpqpdbl04qwx6h2mmmqbn71pl8j69w9110dkys";
   };
 
   doCheck = false; # Tests depend on Google Cloud credentials at ${HOME}/gcloud-service-key.json
 
   meta = with stdenv.lib; {
-    homepage = "https://snakemake.bitbucket.io";
+    homepage = "https://snakemake.readthedocs.io";
     license = licenses.mit;
     description = "Python-based execution environment for make-like workflows";
     longDescription = ''
diff --git a/pkgs/applications/video/tartube/default.nix b/pkgs/applications/video/tartube/default.nix
new file mode 100644
index 00000000000..ae222ae05a7
--- /dev/null
+++ b/pkgs/applications/video/tartube/default.nix
@@ -0,0 +1,68 @@
+{ stdenv
+, lib
+, fetchFromGitHub
+, gdk-pixbuf
+, gobject-introspection
+, gtk3
+, libnotify
+, pango
+, python3Packages
+, wrapGAppsHook
+, youtube-dl
+, glib
+}:
+
+python3Packages.buildPythonApplication rec {
+  pname = "tartube";
+  version = "2.0.016";
+
+  src = fetchFromGitHub {
+    owner = "axcore";
+    repo = "tartube";
+    rev = "v${version}";
+    sha256 = "1y77ykihyi4v6xlsm5xldbs9lzq229l574rxz6qfvrjcbbwajfj9";
+  };
+
+  nativeBuildInputs = [
+    gobject-introspection
+    wrapGAppsHook
+  ];
+
+  strictDeps = false;
+
+  propagatedBuildInputs = with python3Packages; [
+    moviepy
+    pygobject3
+    pyxdg
+    requests
+  ];
+
+  buildInputs = [
+    gdk-pixbuf
+    gtk3
+    glib
+    libnotify
+    pango
+  ];
+
+  postInstall = ''
+    mkdir -p $out/share/{man/man1,applications,pixmaps}
+    cp pack/tartube.1 $out/share/man/man1
+    cp pack/tartube.desktop $out/share/applications
+    cp pack/tartube.{png,xpm} $out/share/pixmaps
+  '';
+
+  doCheck = false;
+
+  makeWrapperArgs = [
+    "--prefix PATH : ${stdenv.lib.makeBinPath [ youtube-dl ]}"
+  ];
+
+  meta = with lib; {
+    description = "A GUI front-end for youtube-dl";
+    license = licenses.gpl3;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ mkg20001 luc65r ];
+    homepage = "https://tartube.sourceforge.io/";
+  };
+}
diff --git a/pkgs/applications/virtualization/spike/default.nix b/pkgs/applications/virtualization/spike/default.nix
index 4dbb7fbe4a5..0f397bc272a 100644
--- a/pkgs/applications/virtualization/spike/default.nix
+++ b/pkgs/applications/virtualization/spike/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchgit, dtc }:
+{ stdenv, fetchgit, dtc, nixosTests }:
 
 stdenv.mkDerivation rec {
   pname = "spike";
@@ -20,6 +20,10 @@ stdenv.mkDerivation rec {
 
   doCheck = true;
 
+  passthru.tests = {
+    can-run-hello-world = nixosTests.spike;
+  };
+
   meta = with stdenv.lib; {
     description = "A RISC-V ISA Simulator";
     homepage = "https://github.com/riscv/riscv-isa-sim";
diff --git a/pkgs/desktops/gnome-3/core/mutter/3.34/default.nix b/pkgs/desktops/gnome-3/core/mutter/3.34/default.nix
index 51d3c4115d9..87696987850 100644
--- a/pkgs/desktops/gnome-3/core/mutter/3.34/default.nix
+++ b/pkgs/desktops/gnome-3/core/mutter/3.34/default.nix
@@ -43,13 +43,13 @@
 
 stdenv.mkDerivation rec {
   pname = "mutter";
-  version = "3.34.4";
+  version = "3.34.5";
 
   outputs = [ "out" "dev" "man" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/mutter/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "18hbw98p4h3d4qz57415smwmfg72s9a0nk8mb04ds1gn2lsm2d01";
+    sha256 = "1i3r51ghfld1rf1rczzi3jhybz3mhywqcj2jyiqhfcyp1svlklfi";
   };
 
   mesonFlags = [
@@ -111,6 +111,13 @@ stdenv.mkDerivation rec {
       sha256 = "0imy2j8af9477jliwdq4jc40yw1cifsjjf196gnmwxr9rkj0hbrd";
     })
 
+    # gnome-3-34 2020-04-24
+    # also fixes https://mail.gnome.org/archives/distributor-list/2020-April/msg00001.html
+    (fetchpatch {
+      url = "https://github.com/GNOME/mutter/compare/3.34.5..3bafd234248fdcd84bc62fef5e31c29fbb613909.patch";
+      sha256 = "1a7krbdfmvx204p6av44rbp4ckp6ddg1mms8wkixxh2p871zq1pi";
+    })
+
     # Drop inheritable cap_sys_nice, to prevent the ambient set from leaking
     # from mutter/gnome-shell, see https://github.com/NixOS/nixpkgs/issues/71381
     ./drop-inheritable.patch
diff --git a/pkgs/desktops/gnome-3/update.nix b/pkgs/desktops/gnome-3/update.nix
index 555504086a4..1bceddf77eb 100644
--- a/pkgs/desktops/gnome-3/update.nix
+++ b/pkgs/desktops/gnome-3/update.nix
@@ -5,14 +5,14 @@ let
   python = python3.withPackages (p: [ p.requests ]);
   upperBoundFlag =
     let
-      package = lib.getAttrFromPath (lib.splitString "." attrPath) pkgs;
+      package = lib.attrByPath (lib.splitString "." attrPath) (throw "Cannot find attribute ‘${attrPath}’.") pkgs;
       packageVersion = lib.getVersion package;
       versionComponents = lib.versions.splitVersion packageVersion;
       minorVersion = lib.versions.minor packageVersion;
       minorAvailable = builtins.length versionComponents > 1 && builtins.match "[0-9]+" minorVersion != null;
       nextMinor = builtins.fromJSON minorVersion + 1;
       upperBound = "${lib.versions.major packageVersion}.${builtins.toString nextMinor}";
-    in lib.optionalString (minorAvailable && freeze) ''--upper-bound="${upperBound}"'';
+    in lib.optionalString (freeze && minorAvailable) ''--upper-bound="${upperBound}"'';
   updateScript = writeScript "gnome-update-script" ''
     #!${stdenv.shell}
     set -o errexit
diff --git a/pkgs/desktops/xfce/panel-plugins/xfce4-whiskermenu-plugin/default.nix b/pkgs/desktops/xfce/panel-plugins/xfce4-whiskermenu-plugin/default.nix
index 262093af69f..859a580bb70 100644
--- a/pkgs/desktops/xfce/panel-plugins/xfce4-whiskermenu-plugin/default.nix
+++ b/pkgs/desktops/xfce/panel-plugins/xfce4-whiskermenu-plugin/default.nix
@@ -1,15 +1,20 @@
-{ mkXfceDerivation, gtk3, glib, cmake, exo, garcon, libxfce4ui, libxfce4util, xfce4-panel, xfconf }:
+{ mkXfceDerivation, gettext, gtk3, glib, cmake, exo, garcon, libxfce4ui, libxfce4util, xfce4-panel, xfconf }:
 
 mkXfceDerivation {
   category = "panel-plugins";
   pname = "xfce4-whiskermenu-plugin";
-  version = "2.4.3";
+  version = "2.4.4";
   rev-prefix = "v";
-  sha256 = "1cs3fps1bj0dd5az7fwrvw1xl3y621qk4dma3n73p7rr19j7fpsn";
+  sha256 = "08b82j9xp3vzjlc740s9svcjkbsal71ggp23y7dvjqppch7sdxzw";
 
   nativeBuildInputs = [ cmake ];
 
-  buildInputs = [ exo garcon gtk3 glib libxfce4ui libxfce4util xfce4-panel xfconf ];
+  buildInputs = [ gettext exo garcon gtk3 glib libxfce4ui libxfce4util xfce4-panel xfconf ];
+
+  postPatch = ''
+    substituteInPlace panel-plugin/xfce4-popup-whiskermenu.in \
+      --replace gettext ${gettext}/bin/gettext
+  '';
 
   postInstall = ''
     substituteInPlace $out/bin/xfce4-popup-whiskermenu \
diff --git a/pkgs/development/compilers/unison/default.nix b/pkgs/development/compilers/unison/default.nix
index a8867d31465..c2cbc03ca0f 100644
--- a/pkgs/development/compilers/unison/default.nix
+++ b/pkgs/development/compilers/unison/default.nix
@@ -4,18 +4,18 @@
 
 stdenv.mkDerivation rec {
   pname = "unison-code-manager";
-  milestone_id = "M1h";
+  milestone_id = "M1j";
   version = "1.0.${milestone_id}-alpha";
 
   src = if (stdenv.isDarwin) then
     fetchurl {
       url = "https://github.com/unisonweb/unison/releases/download/release/${milestone_id}/unison-osx.tar.gz";
-      sha256 = "0iivm5gmbk0fq0zr3lvck6p1c2i7i54l3rf70z677529w9irzchp";
+      sha256 = "1pvdjmasgl22inbr8nlizsg8s5zagn8bzwhaxqmwafkpsskz0hsg";
     }
   else
     fetchurl {
       url = "https://github.com/unisonweb/unison/releases/download/release/${milestone_id}/unison-linux64.tar.gz";
-      sha256 = "0fb84c1yn8pidflh7kq696j3v4blkvbk1fsqp36h30p7vv676yci";
+      sha256 = "1xpblx405cp3mv0vrhcqwjlxvrhgmc77mxbvcy93srxja3qai1af";
     };
 
   # The tarball is just the prebuilt binary, in the archive root.
diff --git a/pkgs/development/haskell-modules/configuration-common.nix b/pkgs/development/haskell-modules/configuration-common.nix
index d6edaa86470..4b898972ded 100644
--- a/pkgs/development/haskell-modules/configuration-common.nix
+++ b/pkgs/development/haskell-modules/configuration-common.nix
@@ -1457,11 +1457,8 @@ self: super: {
   cryptonite = dontCheck super.cryptonite;
 
   # The test suite depends on an impure cabal-install installation in
-  # $HOME, which we don't have in our build sandbox, and it is keeping
-  # up with the most recent Cabal version.
-  cabal-install-parsers = dontCheck (super.cabal-install-parsers.overrideScope (self: super: {
-    Cabal = self.Cabal_3_2_0_0;
-  }));
+  # $HOME, which we don't have in our build sandbox.
+  cabal-install-parsers = dontCheck super.cabal-install-parsers;
 
   # haskell-ci-0.8 needs cabal-install-parsers ==0.1, but we have 0.2.
   haskell-ci = doJailbreak super.haskell-ci;
diff --git a/pkgs/development/haskell-modules/configuration-ghc-8.10.x.nix b/pkgs/development/haskell-modules/configuration-ghc-8.10.x.nix
index 96ab593cf84..f0d88415616 100644
--- a/pkgs/development/haskell-modules/configuration-ghc-8.10.x.nix
+++ b/pkgs/development/haskell-modules/configuration-ghc-8.10.x.nix
@@ -49,6 +49,7 @@ self: super: {
   async = doJailbreak super.async;
   ChasingBottoms = doJailbreak super.ChasingBottoms;
   hashable = doJailbreak super.hashable;
+  pandoc = doJailbreak super.pandoc;
   parallel = doJailbreak super.parallel;
   regex-base = doJailbreak super.regex-base;
   regex-compat = doJailbreak super.regex-compat;
@@ -56,6 +57,7 @@ self: super: {
   regex-posix = doJailbreak super.regex-posix;
   regex-tdfa = doJailbreak super.regex-tdfa;
   split = doJailbreak super.split;
+  system-fileio = doJailbreak super.system-fileio;
   tar = doJailbreak super.tar;
   tasty-expected-failure = doJailbreak super.tasty-expected-failure;
   unliftio-core = doJailbreak super.unliftio-core;
@@ -63,9 +65,12 @@ self: super: {
   zlib = doJailbreak super.zlib;
 
   # Use the latest version to fix the build.
+  dhall = self.dhall_1_31_1;
+  ghc-lib-parser-ex = self.ghc-lib-parser-ex_8_10_0_4;
+  lens = self.lens_4_19_2;
   optics-core = self.optics-core_0_3;
   repline = self.repline_0_3_0_0;
-  ghc-lib-parser-ex = self.ghc-lib-parser-ex_8_10_0_4;
+  singletons = self.singletons_2_7;
   th-desugar = self.th-desugar_1_11;
 
   # `ghc-lib-parser-ex` (see conditionals in its `.cabal` file) does not need
@@ -77,14 +82,17 @@ self: super: {
 
   # Jailbreak to fix the build.
   aeson-diff = doJailbreak super.aeson-diff;
+  brick = doJailbreak super.brick;
   cborg = doJailbreak super.cborg;
   cborg-json = doJailbreak super.cborg-json;
   exact-pi = doJailbreak super.exact-pi;
+  policeman = doJailbreak super.policeman;
   relude = dontCheck (doJailbreak super.relude);
   serialise = doJailbreak super.serialise;
   setlocale = doJailbreak super.setlocale;
   shellmet = doJailbreak super.shellmet;
-  brick = doJailbreak super.brick;
+  weeder = doJailbreak super.weeder;    # https://github.com/ocharles/weeder/issues/15
+  xmobar = doJailbreak super.xmobar;
 
   # The shipped Setup.hs file is broken.
   csv = overrideCabal super.csv (drv: { preCompileBuildDriver = "rm Setup.hs"; });
@@ -98,4 +106,18 @@ self: super: {
 
   # Only 0.8 is compatible with ghc 8.10 https://hackage.haskell.org/package/apply-refact/changelog
   apply-refact = super.apply-refact_0_8_0_0;
+
+  # Apply patch to fix the build.
+  cabal-plan = appendPatch super.cabal-plan (pkgs.fetchpatch {
+    name = "cabal-plan-fix-for-ghc-8.10.x.patch";
+    url = "https://github.com/haskell-hvr/cabal-plan/pull/55.patch";
+    sha256 = "0lhs4vx5qg5ldhnyb9z7k0jmxhmd2f34x4xbwv6vsljs9vr02pd8";
+  });
+  dbus = appendPatch super.dbus ./patches/fix-dbus-for-ghc-8.10.x.patch;
+
+  # https://github.com/ndmitchell/hlint/issues/959
+  hlint = super.hlint.override {
+    ghc-lib-parser-ex = addBuildDepend super.ghc-lib-parser-ex super.ghc-lib-parser;
+  };
+
 }
diff --git a/pkgs/development/haskell-modules/configuration-ghc-8.8.x.nix b/pkgs/development/haskell-modules/configuration-ghc-8.8.x.nix
index bdd5a9007d7..7395d059b4d 100644
--- a/pkgs/development/haskell-modules/configuration-ghc-8.8.x.nix
+++ b/pkgs/development/haskell-modules/configuration-ghc-8.8.x.nix
@@ -102,4 +102,8 @@ self: super: {
 
   # Only 0.7 is compatible with ghc 8.7 https://hackage.haskell.org/package/apply-refact/changelog
   apply-refact = super.apply-refact_0_7_0_0;
+
+  # The package needs the latest Cabal version.
+  cabal-install-parsers = super.cabal-install-parsers.overrideScope (self: super: { Cabal = self.Cabal_3_2_0_0; });
+
 }
diff --git a/pkgs/development/haskell-modules/configuration-nix.nix b/pkgs/development/haskell-modules/configuration-nix.nix
index ba885c0ecd5..817037e1e43 100644
--- a/pkgs/development/haskell-modules/configuration-nix.nix
+++ b/pkgs/development/haskell-modules/configuration-nix.nix
@@ -720,10 +720,9 @@ self: super: builtins.intersectAttrs super {
   # break infinite recursion with base-orphans
   primitive = dontCheck super.primitive;
 
-  # dhall-1.29.0 tests access the network.  This override can be removed when
-  # dhall_1_29_0 is no longer used, since more recent versions of dhall don't
-  # access the network in checks.
+  # dhall's tests access the network.
   dhall_1_29_0 = dontCheck super.dhall_1_29_0;
+  dhall_1_31_1 = dontCheck super.dhall_1_31_1;
 
   cut-the-crap =
     let path = pkgs.stdenv.lib.makeBinPath [ pkgs.ffmpeg ];
diff --git a/pkgs/development/haskell-modules/patches/fix-dbus-for-ghc-8.10.x.patch b/pkgs/development/haskell-modules/patches/fix-dbus-for-ghc-8.10.x.patch
new file mode 100644
index 00000000000..7ed390d3f23
--- /dev/null
+++ b/pkgs/development/haskell-modules/patches/fix-dbus-for-ghc-8.10.x.patch
@@ -0,0 +1,383 @@
+Only in dbus-1.2.13-new: .codeclimate.yml
+diff -ur dbus-1.2.13-old/dbus.cabal dbus-1.2.13-new/dbus.cabal
+--- dbus-1.2.13-old/dbus.cabal	2020-04-25 19:29:27.372272952 +0200
++++ dbus-1.2.13-new/dbus.cabal	2020-04-25 19:26:36.140991920 +0200
+@@ -1,172 +1,180 @@
+-cabal-version: >=1.8
+ name: dbus
+ version: 1.2.13
+ license: Apache-2.0
+ license-file: license.txt
+-maintainer: Andrey Sverdlichenko <blaze@ruddy.ru>
+ author: John Millikin <john@john-millikin.com>
++maintainer: Andrey Sverdlichenko <blaze@ruddy.ru>
++build-type: Simple
++cabal-version: >= 1.8
++category: Network, Desktop
+ stability: experimental
+ homepage: https://github.com/rblaze/haskell-dbus#readme
++
+ synopsis: A client library for the D-Bus IPC system.
+ description:
+-    D-Bus is a simple, message-based protocol for inter-process
+-    communication, which allows applications to interact with other parts of
+-    the machine and the user's session using remote procedure calls.
+-    .
+-    D-Bus is a essential part of the modern Linux desktop, where it replaces
+-    earlier protocols such as CORBA and DCOP.
+-    .
+-    This library is an implementation of the D-Bus protocol in Haskell. It
+-    can be used to add D-Bus support to Haskell applications, without the
+-    awkward interfaces common to foreign bindings.
+-    .
+-    Example: connect to the session bus, and get a list of active names.
+-    .
+-    @
+-    &#x7b;-\# LANGUAGE OverloadedStrings \#-&#x7d;
+-    .
+-    import Data.List (sort)
+-    import DBus
+-    import DBus.Client
+-    .
+-    main = do
+-    &#x20;   client <- connectSession
+-    &#x20;   //
+-    &#x20;   \-- Request a list of connected clients from the bus
+-    &#x20;   reply <- call_ client (methodCall \"\/org\/freedesktop\/DBus\" \"org.freedesktop.DBus\" \"ListNames\")
+-    &#x20;       &#x7b; methodCallDestination = Just \"org.freedesktop.DBus\"
+-    &#x20;       &#x7d;
+-    &#x20;   //
+-    &#x20;   \-- org.freedesktop.DBus.ListNames() returns a single value, which is
+-    &#x20;   \-- a list of names (here represented as [String])
+-    &#x20;   let Just names = fromVariant (methodReturnBody reply !! 0)
+-    &#x20;   //
+-    &#x20;   \-- Print each name on a line, sorted so reserved names are below
+-    &#x20;   \-- temporary names.
+-    &#x20;   mapM_ putStrLn (sort names)
+-    @
+-    .
+-    >$ ghc --make list-names.hs
+-    >$ ./list-names
+-    >:1.0
+-    >:1.1
+-    >:1.10
+-    >:1.106
+-    >:1.109
+-    >:1.110
+-    >ca.desrt.dconf
+-    >org.freedesktop.DBus
+-    >org.freedesktop.Notifications
+-    >org.freedesktop.secrets
+-    >org.gnome.ScreenSaver
+-category: Network, Desktop
+-build-type: Simple
++  D-Bus is a simple, message-based protocol for inter-process
++  communication, which allows applications to interact with other parts of
++  the machine and the user's session using remote procedure calls.
++  .
++  D-Bus is a essential part of the modern Linux desktop, where it replaces
++  earlier protocols such as CORBA and DCOP.
++  .
++  This library is an implementation of the D-Bus protocol in Haskell. It
++  can be used to add D-Bus support to Haskell applications, without the
++  awkward interfaces common to foreign bindings.
++  .
++  Example: connect to the session bus, and get a list of active names.
++  .
++  @
++  &#x7b;-\# LANGUAGE OverloadedStrings \#-&#x7d;
++  .
++  import Data.List (sort)
++  import DBus
++  import DBus.Client
++  .
++  main = do
++  &#x20;   client <- connectSession
++  &#x20;
++  &#x20;   -- Request a list of connected clients from the bus
++  &#x20;   reply <- call_ client (methodCall \"\/org\/freedesktop\/DBus\" \"org.freedesktop.DBus\" \"ListNames\")
++  &#x20;       &#x7b; methodCallDestination = Just \"org.freedesktop.DBus\"
++  &#x20;       &#x7d;
++  &#x20;
++  &#x20;   -- org.freedesktop.DBus.ListNames() returns a single value, which is
++  &#x20;   -- a list of names (here represented as [String])
++  &#x20;   let Just names = fromVariant (methodReturnBody reply !! 0)
++  &#x20;
++  &#x20;   -- Print each name on a line, sorted so reserved names are below
++  &#x20;   -- temporary names.
++  &#x20;   mapM_ putStrLn (sort names)
++  @
++  .
++  >$ ghc --make list-names.hs
++  >$ ./list-names
++  >:1.0
++  >:1.1
++  >:1.10
++  >:1.106
++  >:1.109
++  >:1.110
++  >ca.desrt.dconf
++  >org.freedesktop.DBus
++  >org.freedesktop.Notifications
++  >org.freedesktop.secrets
++  >org.gnome.ScreenSaver
++
++
+ extra-source-files:
+-    examples/dbus-monitor.hs
+-    examples/export.hs
+-    examples/introspect.hs
+-    examples/list-names.hs
+-    idlxml/dbus.xml
++  examples/dbus-monitor.hs
++  examples/export.hs
++  examples/introspect.hs
++  examples/list-names.hs
++  idlxml/dbus.xml
+ 
+ source-repository head
+-    type: git
+-    location: https://github.com/rblaze/haskell-dbus
++  type: git
++  location: https://github.com/rblaze/haskell-dbus
+ 
+ library
+-    exposed-modules:
+-        DBus
+-        DBus.Client
+-        DBus.Generation
+-        DBus.Internal.Address
+-        DBus.Internal.Message
+-        DBus.Internal.Types
+-        DBus.Internal.Wire
+-        DBus.Introspection
+-        DBus.Introspection.Parse
+-        DBus.Introspection.Render
+-        DBus.Introspection.Types
+-        DBus.Socket
+-        DBus.TH
+-        DBus.Transport
+-    hs-source-dirs: lib
+-    ghc-options: -W -Wall
+-    build-depends:
+-        base ==4.*,
+-        bytestring <0.11,
+-        cereal <0.6,
+-        conduit >=1.3.0 && <1.4,
+-        containers <0.7,
+-        deepseq <1.5,
+-        exceptions <0.11,
+-        filepath <1.5,
+-        lens <4.20,
+-        network >=3.0.1.0 && <3.2,
+-        parsec <3.2,
+-        random <1.2,
+-        split <0.3,
+-        template-haskell <2.16.0.0,
+-        text <1.3,
+-        th-lift <0.9,
+-        transformers <0.6,
+-        unix <2.8,
+-        vector <0.13,
+-        xml-conduit >=1.9.0.0 && <1.10.0.0,
+-        xml-types <0.4
++  ghc-options: -W -Wall
++  hs-source-dirs: lib
++
++  build-depends:
++      base >=4 && <5
++    , bytestring
++    , cereal
++    , conduit >= 1.3.0
++    , containers
++    , deepseq
++    , exceptions
++    , filepath
++    , lens < 4.20
++    , network >= 3.0.1.0 && < 3.2
++    , parsec
++    , random
++    , split
++    , template-haskell < 2.17.0.0
++    , text
++    , th-lift < 0.9
++    , transformers
++    , unix
++    , vector
++    , xml-conduit >= 1.9.0.0 && < 1.10.0.0
++    , xml-types
++
++  exposed-modules:
++    DBus
++    DBus.Client
++    DBus.Generation
++    DBus.Internal.Address
++    DBus.Internal.Message
++    DBus.Internal.Types
++    DBus.Internal.Wire
++    DBus.Introspection
++    DBus.Introspection.Parse
++    DBus.Introspection.Render
++    DBus.Introspection.Types
++    DBus.Socket
++    DBus.TH
++    DBus.Transport
+ 
+ test-suite dbus_tests
+-    type: exitcode-stdio-1.0
+-    main-is: DBusTests.hs
+-    hs-source-dirs: tests
+-    other-modules:
+-        DBusTests.Address
+-        DBusTests.BusName
+-        DBusTests.Client
+-        DBusTests.ErrorName
+-        DBusTests.Generation
+-        DBusTests.Integration
+-        DBusTests.InterfaceName
+-        DBusTests.Introspection
+-        DBusTests.MemberName
+-        DBusTests.Message
+-        DBusTests.ObjectPath
+-        DBusTests.Serialization
+-        DBusTests.Signature
+-        DBusTests.Socket
+-        DBusTests.TH
+-        DBusTests.Transport
+-        DBusTests.Util
+-        DBusTests.Variant
+-        DBusTests.Wire
+-    ghc-options: -W -Wall -fno-warn-orphans
+-    build-depends:
+-        dbus -any,
+-        base ==4.*,
+-        bytestring <0.11,
+-        cereal <0.6,
+-        containers <0.7,
+-        directory <1.4,
+-        extra <1.8,
+-        filepath <1.5,
+-        network >=3.0.1.0 && <3.2,
+-        parsec <3.2,
+-        process <1.7,
+-        QuickCheck <2.15,
+-        random <1.2,
+-        resourcet <1.3,
+-        tasty <1.3,
+-        tasty-hunit <0.11,
+-        tasty-quickcheck <0.11,
+-        text <1.3,
+-        transformers <0.6,
+-        unix <2.8,
+-        vector <0.13
++  type: exitcode-stdio-1.0
++  main-is: DBusTests.hs
++  hs-source-dirs: tests
++  ghc-options: -W -Wall -fno-warn-orphans
++
++  build-depends:
++      dbus
++    , base >=4 && <5
++    , bytestring
++    , cereal
++    , containers
++    , directory
++    , extra < 1.8
++    , filepath
++    , network >= 3.0.1.0 && < 3.2
++    , parsec
++    , process
++    , QuickCheck < 2.15
++    , random
++    , resourcet
++    , tasty
++    , tasty-hunit
++    , tasty-quickcheck
++    , text
++    , transformers
++    , unix
++    , vector
++
++  other-modules:
++    DBusTests.Address
++    DBusTests.BusName
++    DBusTests.Client
++    DBusTests.ErrorName
++    DBusTests.Generation
++    DBusTests.Integration
++    DBusTests.InterfaceName
++    DBusTests.Introspection
++    DBusTests.MemberName
++    DBusTests.Message
++    DBusTests.ObjectPath
++    DBusTests.Serialization
++    DBusTests.Signature
++    DBusTests.Socket
++    DBusTests.TH
++    DBusTests.Transport
++    DBusTests.Util
++    DBusTests.Variant
++    DBusTests.Wire
+ 
+ benchmark dbus_benchmarks
+-    type: exitcode-stdio-1.0
+-    main-is: DBusBenchmarks.hs
+-    hs-source-dirs: benchmarks
+-    ghc-options: -Wall -fno-warn-orphans
+-    build-depends:
+-        dbus -any,
+-        base ==4.*,
+-        criterion <1.6
++  type: exitcode-stdio-1.0
++  main-is: DBusBenchmarks.hs
++  hs-source-dirs: benchmarks
++  ghc-options: -Wall -fno-warn-orphans
++
++  build-depends:
++      dbus
++    , base >=4 && <5
++    , criterion
+Only in dbus-1.2.13-new: .git
+Only in dbus-1.2.13-new: .gitignore
+diff -ur dbus-1.2.13-old/lib/DBus/Generation.hs dbus-1.2.13-new/lib/DBus/Generation.hs
+--- dbus-1.2.13-old/lib/DBus/Generation.hs	2019-02-14 16:37:47.000000000 +0100
++++ dbus-1.2.13-new/lib/DBus/Generation.hs	2020-04-25 19:26:36.144991997 +0200
+@@ -1,3 +1,4 @@
++{-# LANGUAGE CPP #-}
+ {-# LANGUAGE OverloadedStrings #-}
+ {-# LANGUAGE TemplateHaskell #-}
+ module DBus.Generation where
+@@ -26,6 +27,13 @@
+ import           Prelude hiding (mapM)
+ import           System.Posix.Types (Fd(..))
+ 
++-- | Compatibility helper to create (total) tuple expressions
++mkTupE :: [Exp] -> Exp
++mkTupE = TupE
++#if MIN_VERSION_template_haskell(2,16,0)
++         . map Just
++#endif
++
+ type ClientBusPathR a = ReaderT (Client, T.BusName, T.ObjectPath) IO a
+ 
+ dbusInvoke :: (Client -> T.BusName -> T.ObjectPath -> a) -> ClientBusPathR a
+@@ -232,8 +240,8 @@
+     finalOutputNames <- buildOutputNames
+     let variantListExp = map makeToVariantApp methodArgNames
+         mapOrHead' = mapOrHead outputLength
+-        fromVariantExp = mapOrHead' makeFromVariantApp fromVariantOutputNames TupE
+-        finalResultTuple = mapOrHead' VarE finalOutputNames TupE
++        fromVariantExp = mapOrHead' makeFromVariantApp fromVariantOutputNames mkTupE
++        finalResultTuple = mapOrHead' VarE finalOutputNames mkTupE
+         maybeExtractionPattern = mapOrHead' makeJustPattern finalOutputNames TupP
+         getMethodCallDefDec = [d|
+                $( varP methodCallDefN ) =
+@@ -432,7 +440,7 @@
+                      }
+                  |]
+     let mapOrHead' = mapOrHead argCount
+-        fromVariantExp = mapOrHead' makeFromVariantApp fromVariantOutputNames TupE
++        fromVariantExp = mapOrHead' makeFromVariantApp fromVariantOutputNames mkTupE
+         maybeExtractionPattern = mapOrHead' makeJustPattern toHandlerOutputNames TupP
+         applyToName toApply n = AppE toApply $ VarE n
+         finalApplication = foldl applyToName (VarE handlerArgN)
diff --git a/pkgs/development/interpreters/python/tests.nix b/pkgs/development/interpreters/python/tests.nix
index 55065c45d57..f7ec06ce4ff 100644
--- a/pkgs/development/interpreters/python/tests.nix
+++ b/pkgs/development/interpreters/python/tests.nix
@@ -38,21 +38,22 @@ let
       is_nixenv = "False";
     };
 
+  } // lib.optionalAttrs (python.pythonAtLeast "3.8") {
     # Venv built using Python Nix environment (python.buildEnv)
     # TODO: Cannot create venv from a  nix env
     # Error: Command '['/nix/store/ddc8nqx73pda86ibvhzdmvdsqmwnbjf7-python3-3.7.6-venv/bin/python3.7', '-Im', 'ensurepip', '--upgrade', '--default-pip']' returned non-zero exit status 1.
-    # nixenv-venv = rec {
-    #   env = runCommand "${python.name}-venv" {} ''
-    #     ${pythonEnv.interpreter} -m venv $out
-    #   '';
-    #   interpreter = "${env}/bin/${pythonEnv.executable}";
-    #   is_venv = "True";
-    #   is_nixenv = "True";
-    # };
+    nixenv-venv = rec {
+      env = runCommand "${python.name}-venv" {} ''
+        ${pythonEnv.interpreter} -m venv $out
+      '';
+      interpreter = "${env}/bin/${pythonEnv.executable}";
+      is_venv = "True";
+      is_nixenv = "True";
+    };
   };
 
   # All PyPy package builds are broken at the moment
-  integrationTests = lib.optionalAttrs (python.isPy3k  && (!python.isPyPy)) rec {
+  integrationTests = lib.optionalAttrs (python.pythonAtLeast "3.7"  && (!python.isPyPy)) rec {
     # Before the addition of NIX_PYTHONPREFIX mypy was broken with typed packages
     nix-pythonprefix-mypy = callPackage ./tests/test_nix_pythonprefix {
       interpreter = python;
diff --git a/pkgs/development/interpreters/python/tests/test_nix_pythonprefix/typeddep/default.nix b/pkgs/development/interpreters/python/tests/test_nix_pythonprefix/typeddep/default.nix
index 06219a69fca..8d330fcdbfc 100644
--- a/pkgs/development/interpreters/python/tests/test_nix_pythonprefix/typeddep/default.nix
+++ b/pkgs/development/interpreters/python/tests/test_nix_pythonprefix/typeddep/default.nix
@@ -1,4 +1,4 @@
-{ buildPythonPackage }:
+{ buildPythonPackage, pythonOlder }:
 
 
 buildPythonPackage {
@@ -8,4 +8,6 @@ buildPythonPackage {
 
   src = ./.;
 
+  disabled = pythonOlder "3.7";
+
 }
diff --git a/pkgs/development/libraries/goocanvasmm/default.nix b/pkgs/development/libraries/goocanvasmm/default.nix
index ef593c568a2..d8a910d4799 100644
--- a/pkgs/development/libraries/goocanvasmm/default.nix
+++ b/pkgs/development/libraries/goocanvasmm/default.nix
@@ -18,6 +18,7 @@ stdenv.mkDerivation rec {
   passthru = {
     updateScript = gnome3.updateScript {
       packageName = pname;
+      attrPath = "goocanvasmm2";
     };
   };
 
diff --git a/pkgs/development/libraries/pipewire/default.nix b/pkgs/development/libraries/pipewire/default.nix
index 197282c5ac1..d873555c0fa 100644
--- a/pkgs/development/libraries/pipewire/default.nix
+++ b/pkgs/development/libraries/pipewire/default.nix
@@ -1,5 +1,6 @@
 { stdenv
 , fetchFromGitLab
+, fetchpatch
 , meson
 , ninja
 , pkgconfig
@@ -72,6 +73,13 @@ stdenv.mkDerivation rec {
     vulkan-loader
     xorg.libX11
   ];
+  patches = [
+      # fix SIGILL in fmt-ops: https://gitlab.freedesktop.org/pipewire/pipewire/-/issues/227
+      (fetchpatch {
+        url = "https://gitlab.freedesktop.org/pipewire/pipewire/-/commit/1b3aaba206f48e75bb34ff0cd00321bd3d6db2b4.patch";
+        sha256 = "08bmr9k2r0q4r7vhhm28k558nk3mz3jfnqswvq9mcj7p0srmfb4x";
+      })
+  ];
 
   mesonFlags = [
     "-Ddocs=true"
diff --git a/pkgs/development/ocaml-modules/cow/default.nix b/pkgs/development/ocaml-modules/cow/default.nix
index 2a4d7004faa..787854f8e41 100644
--- a/pkgs/development/ocaml-modules/cow/default.nix
+++ b/pkgs/development/ocaml-modules/cow/default.nix
@@ -1,30 +1,29 @@
-{ stdenv, fetchFromGitHub, ocaml, findlib
-, ocamlbuild, topkg
+{ lib, fetchurl, buildDunePackage, alcotest
 , uri, xmlm, omd, ezjsonm }:
 
-stdenv.mkDerivation rec {
-  version = "2.2.0";
-  pname = "ocaml-cow";
+buildDunePackage rec {
+  minimumOCamlVersion = "4.02.3";
 
-  src = fetchFromGitHub {
-    owner  = "mirage";
-    repo   = "ocaml-cow";
-    rev    = "v${version}";
-    sha256 = "0snhabg7rfrrcq2ksr3qghiawd61cw3y4kp6rl7vs87j4cnk3kr2";
+  version = "2.4.0";
+  pname = "cow";
+
+  src = fetchurl {
+    url = "https://github.com/mirage/ocaml-cow/releases/download/v${version}/cow-v${version}.tbz";
+    sha256 = "1x77lwpskda4zyikwxh500xjn90pgdwz6jm7ca7f36pyav4vl6zx";
   };
 
-  buildInputs = [ ocaml ocamlbuild findlib topkg ];
   propagatedBuildInputs = [ xmlm uri ezjsonm omd ];
+  checkInputs = [ alcotest ];
+  doCheck = true;
 
-  inherit (topkg) buildPhase installPhase;
-
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Caml on the Web";
     longDescription = ''
-      Caml on the Web (COW) is a set of parsers and syntax extensions to let you manipulate HTML, CSS, XML, JSON and Markdown directly from OCaml code.
+      Writing web-applications requires a lot of skills: HTML, XML, JSON and
+      Markdown, to name but a few! This library provides OCaml combinators
+      for these web formats.
     '';
     license = licenses.isc;
     maintainers = [ maintainers.sternenseemann ];
-    inherit (ocaml.meta) platforms;
   };
 }
diff --git a/pkgs/development/ocaml-modules/dns/client.nix b/pkgs/development/ocaml-modules/dns/client.nix
index d007533fe45..0dd0541138c 100644
--- a/pkgs/development/ocaml-modules/dns/client.nix
+++ b/pkgs/development/ocaml-modules/dns/client.nix
@@ -1,10 +1,14 @@
-{ lib, buildDunePackage, dns, ocaml_lwt, mirage-clock, mirage-random, mirage-stack, mtime, randomconv }:
+{ lib, buildDunePackage, dns, ocaml_lwt, mirage-clock, mirage-time
+, mirage-random, mirage-stack, mirage-crypto-rng, mtime, randomconv }:
 
 buildDunePackage {
   pname = "dns-client";
   inherit (dns) src version;
 
-  propagatedBuildInputs = [ dns mtime ocaml_lwt mirage-clock mirage-random mirage-stack randomconv ];
+  useDune2 = true;
+
+  propagatedBuildInputs = [ dns mtime ocaml_lwt randomconv mirage-clock mirage-time
+                            mirage-random mirage-stack mirage-crypto-rng ];
 
   meta = dns.meta // {
     description = "Pure DNS resolver API";
diff --git a/pkgs/development/ocaml-modules/dns/default.nix b/pkgs/development/ocaml-modules/dns/default.nix
index e2aac3367bf..01bbffd40b9 100644
--- a/pkgs/development/ocaml-modules/dns/default.nix
+++ b/pkgs/development/ocaml-modules/dns/default.nix
@@ -4,13 +4,13 @@
 
 buildDunePackage rec {
   pname = "dns";
-  version = "4.4.1";
+  version = "4.5.0";
 
   minimumOCamlVersion = "4.07";
 
   src = fetchurl {
     url = "https://github.com/mirage/ocaml-dns/releases/download/v${version}/dns-v${version}.tbz";
-    sha256 = "18c09jf0kicv2xz40n367y774rg8qs07rr1vdk8bx8f7hnaa9cn8";
+    sha256 = "10jrnnxvp06rvzk285wibyi9hn15qhjnqjy9xsfbwl8yhmzzqnq0";
   };
 
   propagatedBuildInputs = [ cstruct domain-name duration gmap ipaddr logs lru metrics ptime rresult ];
diff --git a/pkgs/development/ocaml-modules/mirage-time/default.nix b/pkgs/development/ocaml-modules/mirage-time/default.nix
new file mode 100644
index 00000000000..b98fd3b6279
--- /dev/null
+++ b/pkgs/development/ocaml-modules/mirage-time/default.nix
@@ -0,0 +1,22 @@
+{ lib, buildDunePackage, fetchurl, ocaml_lwt }:
+
+buildDunePackage rec {
+  minimumOCamlVersion = "4.06";
+
+  pname = "mirage-time";
+  version = "2.0.1";
+
+  src = fetchurl {
+    url = "https://github.com/mirage/mirage-time/releases/download/v${version}/mirage-time-v${version}.tbz";
+    sha256 = "1w6mm4g7fc19cs0ncs0s9fsnb1k1s04qqzs9bsqvq8ngsb90cbh0";
+  };
+
+  propagatedBuildInputs = [ ocaml_lwt ];
+
+  meta = with lib; {
+    homepage = "https://github.com/mirage/mirage-time";
+    description = "Time operations for MirageOS";
+    license = licenses.isc;
+    maintainers = with maintainers; [ sternenseemann ];
+  };
+}
diff --git a/pkgs/development/ocaml-modules/mirage-time/unix.nix b/pkgs/development/ocaml-modules/mirage-time/unix.nix
new file mode 100644
index 00000000000..da5326bc075
--- /dev/null
+++ b/pkgs/development/ocaml-modules/mirage-time/unix.nix
@@ -0,0 +1,13 @@
+{ buildDunePackage, fetchurl, mirage-time, ocaml_lwt, duration }:
+
+buildDunePackage {
+  pname = "mirage-time-unix";
+
+  inherit (mirage-time) src version minimumOCamlVersion;
+
+  propagatedBuildInputs = [ mirage-time ocaml_lwt duration ];
+
+  meta = mirage-time.meta // {
+    description = "Time operations for MirageOS on Unix";
+  };
+}
diff --git a/pkgs/development/python-modules/snitun/default.nix b/pkgs/development/python-modules/snitun/default.nix
index 8212379e3d4..901987fbff6 100644
--- a/pkgs/development/python-modules/snitun/default.nix
+++ b/pkgs/development/python-modules/snitun/default.nix
@@ -1,4 +1,6 @@
-{ lib, stdenv, buildPythonPackage, python, fetchFromGitHub, attrs, cryptography, async-timeout, pytest-aiohttp, pytest }:
+{ lib, stdenv, buildPythonPackage, python, fetchFromGitHub
+, attrs, cryptography, async-timeout, pytest-aiohttp, pytestCheckHook
+}:
 
 buildPythonPackage rec {
   pname = "snitun";
@@ -13,12 +15,14 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [ attrs cryptography async-timeout ];
 
-  checkInputs = [ pytest pytest-aiohttp ];
+  checkInputs = [ pytestCheckHook pytest-aiohttp ];
 
-  checkPhase = ''
-    # https://github.com/NabuCasa/snitun/issues/61
-    pytest ${lib.optionalString stdenv.isDarwin "-k 'not test_multiplexer_data_channel_abort_full'"} tests/
-  '';
+  disabledTests = lib.optionals stdenv.isDarwin [
+    "test_multiplexer_data_channel_abort_full" # https://github.com/NabuCasa/snitun/issues/61
+    # port binding conflicts
+    "test_snitun_single_runner_timeout"
+    "test_snitun_single_runner_throttling"
+  ];
 
   meta = with lib; {
     homepage = "https://github.com/nabucasa/snitun";
diff --git a/pkgs/misc/drivers/epson-escpr2/default.nix b/pkgs/misc/drivers/epson-escpr2/default.nix
index 4edc08a3571..a1420a0428b 100644
--- a/pkgs/misc/drivers/epson-escpr2/default.nix
+++ b/pkgs/misc/drivers/epson-escpr2/default.nix
@@ -2,7 +2,7 @@
 
 stdenv.mkDerivation rec {
   pname = "epson-inkjet-printer-escpr2";
-  version = "1.1.1";
+  version = "1.1.11";
 
   src = fetchurl {
     # To find new versions, visit
@@ -11,10 +11,10 @@ stdenv.mkDerivation rec {
     # version.  
     # NOTE: Don't forget to update the webarchive link too!
     urls = [ 
-      "https://download3.ebz.epson.net/dsc/f/03/00/09/72/04/c6d928e83e558c4ba1e7e8bcb5c1fe080b8095eb/epson-inkjet-printer-escpr2-1.1.1-1lsb3.2.src.rpm"
-      "https://web.archive.org/web/https://download3.ebz.epson.net/dsc/f/03/00/09/72/04/c6d928e83e558c4ba1e7e8bcb5c1fe080b8095eb/epson-inkjet-printer-escpr2-1.1.1-1lsb3.2.src.rpm"
+      "https://download3.ebz.epson.net/dsc/f/03/00/11/01/98/8ff121831d0a6be76e86b87c78178f3c93df6d0f/epson-inkjet-printer-escpr2-1.1.11-1lsb3.2.src.rpm"
+      "https://web.archive.org/web/20200425154102/https://download3.ebz.epson.net/dsc/f/03/00/11/01/98/8ff121831d0a6be76e86b87c78178f3c93df6d0f/epson-inkjet-printer-escpr2-1.1.11-1lsb3.2.src.rpm"
     ];
-    sha256 = "02vdlhvinsx6vsjq172b2c1vrfzkg0w9j5lbsnjvj6yq3yqz5b5q";
+    sha256 = "1gcdzmqli7jycljm66mdssivb3lk223ih6zg0l3lyn7hj2gbkinm";
   };
 
   patches = [ ./cups-filter-ppd-dirs.patch ];
@@ -38,7 +38,7 @@ stdenv.mkDerivation rec {
       Refer to the description of epson-escpr for usage.
     '';
     license = licenses.gpl2;
-    maintainers = with maintainers; [ ma9e ];
+    maintainers = with maintainers; [ ma9e ma27 ];
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/os-specific/linux/ell/default.nix b/pkgs/os-specific/linux/ell/default.nix
index 69c1f8de2ea..cb971d452d6 100644
--- a/pkgs/os-specific/linux/ell/default.nix
+++ b/pkgs/os-specific/linux/ell/default.nix
@@ -7,14 +7,14 @@
 
 stdenv.mkDerivation rec {
   pname = "ell";
-  version = "0.30";
+  version = "0.31";
 
   outputs = [ "out" "dev" ];
 
   src = fetchgit {
      url = "https://git.kernel.org/pub/scm/libs/${pname}/${pname}.git";
      rev = version;
-     sha256 = "0kiglgc02a6hqi1nhnl4d8lxax8b1fljp50pvqswrnbh7pgb5676";
+     sha256 = "1qlpc906xd78fzxvvj2kxi3aikgnw0c0h3x620s131apax4qrnqa";
   };
 
   patches = [
diff --git a/pkgs/os-specific/linux/hostapd/default.nix b/pkgs/os-specific/linux/hostapd/default.nix
index 869a394cefb..8152655d457 100644
--- a/pkgs/os-specific/linux/hostapd/default.nix
+++ b/pkgs/os-specific/linux/hostapd/default.nix
@@ -17,7 +17,13 @@ stdenv.mkDerivation rec {
       # Note: fetchurl seems to be unhappy with openwrt git
       # server's URLs containing semicolons. Using the github mirror instead.
       url = "https://raw.githubusercontent.com/openwrt/openwrt/master/package/network/services/hostapd/patches/300-noscan.patch";
-      sha256 = "04wg4yjc19wmwk6gia067z99gzzk9jacnwxh5wyia7k5wg71yj5k";})
+      sha256 = "04wg4yjc19wmwk6gia067z99gzzk9jacnwxh5wyia7k5wg71yj5k";
+    })
+    (fetchurl {
+      name = "CVE-2019-16275.patch";
+      url = "https://w1.fi/security/2019-7/0001-AP-Silently-ignore-management-frame-from-unexpected-.patch";
+      sha256 = "15xjyy7crb557wxpx898b5lnyblxghlij0xby5lmj9hpwwss34dz";
+    })
   ];
 
   outputs = [ "out" "man" ];
diff --git a/pkgs/os-specific/linux/iwd/default.nix b/pkgs/os-specific/linux/iwd/default.nix
index 02bd83d9da6..be2a4ff3e56 100644
--- a/pkgs/os-specific/linux/iwd/default.nix
+++ b/pkgs/os-specific/linux/iwd/default.nix
@@ -13,12 +13,12 @@
 
 stdenv.mkDerivation rec {
   pname = "iwd";
-  version = "1.6";
+  version = "1.7";
 
   src = fetchgit {
     url = "https://git.kernel.org/pub/scm/network/wireless/iwd.git";
     rev = version;
-    sha256 = "0c38c7a234cwdd5y1brq4w56xszs8zlp57rr3nvgp8z8djcy1qvx";
+    sha256 = "1qi25qav1rv8gm5lbrip8ayq5vwynmyv2q4ar7bbmnjh6cglvyh2";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/servers/home-assistant/0001-setup.py-relax-dependencies.patch b/pkgs/servers/home-assistant/0001-setup.py-relax-dependencies.patch
index 52d2daf80b0..e18842f49aa 100644
--- a/pkgs/servers/home-assistant/0001-setup.py-relax-dependencies.patch
+++ b/pkgs/servers/home-assistant/0001-setup.py-relax-dependencies.patch
@@ -1,4 +1,4 @@
-From 80f39643bb4d25f8ffcbd92804844961b303f4d0 Mon Sep 17 00:00:00 2001
+From 679364e1cd95dc7179dbd3114ec35b282fbcb0af Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
 Date: Thu, 9 Apr 2020 07:20:46 +0100
 Subject: [PATCH] setup.py: relax dependencies
@@ -8,11 +8,11 @@ Content-Transfer-Encoding: 8bit
 
 Signed-off-by: Jörg Thalheim <joerg@thalheim.io>
 ---
- setup.py | 10 +++++-----
- 1 file changed, 5 insertions(+), 5 deletions(-)
+ setup.py | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
 
 diff --git a/setup.py b/setup.py
-index f53af0ee1..ff4227487 100755
+index e0daacd98b..7166f1f228 100755
 --- a/setup.py
 +++ b/setup.py
 @@ -32,10 +32,10 @@ PROJECT_URLS = {
@@ -28,7 +28,12 @@ index f53af0ee1..ff4227487 100755
      "bcrypt==3.1.7",
      "certifi>=2019.11.28",
      "ciso8601==2.1.3",
-@@ -47,9 +47,9 @@ REQUIRES = [
+@@ -43,13 +43,13 @@ REQUIRES = [
+     "jinja2>=2.11.1",
+     "PyJWT==1.7.1",
+     # PyJWT has loose dependency. We want the latest one.
+-    "cryptography==2.8",
++    "cryptography>=2.8",
      "pip>=8.0.3",
      "python-slugify==4.0.0",
      "pytz>=2019.03",
@@ -42,5 +47,5 @@ index f53af0ee1..ff4227487 100755
      "voluptuous-serialize==2.3.0",
  ]
 -- 
-2.25.1
+2.26.1
 
diff --git a/pkgs/servers/home-assistant/component-packages.nix b/pkgs/servers/home-assistant/component-packages.nix
index d19b70c426e..0ae33cd4895 100644
--- a/pkgs/servers/home-assistant/component-packages.nix
+++ b/pkgs/servers/home-assistant/component-packages.nix
@@ -2,7 +2,7 @@
 # Do not edit!
 
 {
-  version = "0.108.2";
+  version = "0.108.7";
   components = {
     "abode" = ps: with ps; [ ]; # missing inputs: abodepy
     "acer_projector" = ps: with ps; [ pyserial];
diff --git a/pkgs/servers/home-assistant/default.nix b/pkgs/servers/home-assistant/default.nix
index 51b6d94860c..d04c2fa5c96 100644
--- a/pkgs/servers/home-assistant/default.nix
+++ b/pkgs/servers/home-assistant/default.nix
@@ -67,7 +67,7 @@ let
   extraBuildInputs = extraPackages py.pkgs;
 
   # Don't forget to run parse-requirements.py after updating
-  hassVersion = "0.108.2";
+  hassVersion = "0.108.7";
 
 in with py.pkgs; buildPythonApplication rec {
   pname = "homeassistant";
@@ -86,7 +86,7 @@ in with py.pkgs; buildPythonApplication rec {
     owner = "home-assistant";
     repo = "home-assistant";
     rev = version;
-    sha256 = "0v4i1ak7pkpycas0mzdmxgc42xgfymwx2b0a2a4h13c4z46pbs2l";
+    sha256 = "0nk1615ms6nlmhgmsgsknc6m7b19baan8m4kr4s97njngiardxm7";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/servers/home-assistant/frontend.nix b/pkgs/servers/home-assistant/frontend.nix
index 9e12016320c..6ca763768ea 100644
--- a/pkgs/servers/home-assistant/frontend.nix
+++ b/pkgs/servers/home-assistant/frontend.nix
@@ -4,11 +4,11 @@ buildPythonPackage rec {
   # the frontend version corresponding to a specific home-assistant version can be found here
   # https://github.com/home-assistant/home-assistant/blob/master/homeassistant/components/frontend/manifest.json
   pname = "home-assistant-frontend";
-  version = "20200407.2";
+  version = "20200418.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0krwn67bkybjb69daik6dki5hm36xs4nbfwqkh0q7ami1xr1f56d";
+    sha256 = "12px8znc6nw5ndg4f28lvfpqsnzi00b5qgpdj9jwny0fss4aglnb";
   };
 
   # no Python tests implemented
diff --git a/pkgs/tools/misc/diffoscope/default.nix b/pkgs/tools/misc/diffoscope/default.nix
index 0ce0e1be325..02d9c504070 100644
--- a/pkgs/tools/misc/diffoscope/default.nix
+++ b/pkgs/tools/misc/diffoscope/default.nix
@@ -9,13 +9,15 @@
 # Note: when upgrading this package, please run the list-missing-tools.sh script as described below!
 python3Packages.buildPythonApplication rec {
   pname = "diffoscope";
-  version = "138";
+  version = "142";
 
   src = fetchurl {
     url    = "https://diffoscope.org/archive/diffoscope-${version}.tar.bz2";
-    sha256 = "171nz5n4dayr7bj04h0x282vdk92kp7lgarnb3x0md91m2i9x997";
+    sha256 = "0c6lvppghw9ynjg2radr8z3fc6lpgmgwr6kxyih7q4rxqf4gfv6i";
   };
 
+  outputs = [ "out" "man" ];
+
   patches = [
     ./ignore_links.patch
   ];
diff --git a/pkgs/tools/security/afl/default.nix b/pkgs/tools/security/afl/default.nix
index def5458a240..e32aa034874 100644
--- a/pkgs/tools/security/afl/default.nix
+++ b/pkgs/tools/security/afl/default.nix
@@ -47,6 +47,11 @@ let
       # has totally different semantics in that case(?) - and also set a
       # proper AFL_CC and AFL_CXX so we don't pick up the wrong one out
       # of $PATH.
+      # first though we need to replace the afl-clang-fast++ symlink with
+      # a real copy to prevent wrapProgram skipping the symlink and confusing
+      # nix's cc wrapper
+      rm $out/bin/afl-clang-fast++
+      cp $out/bin/afl-clang-fast $out/bin/afl-clang-fast++
       for x in $out/bin/afl-clang-fast $out/bin/afl-clang-fast++; do
         wrapProgram $x \
           --prefix AFL_PATH : "$out/lib/afl" \
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index bbcdaf3a5a7..1a5ac3065d8 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -6887,6 +6887,8 @@ in
 
   tarsnapper = callPackage ../tools/backup/tarsnapper { };
 
+  tartube = callPackage ../applications/video/tartube { };
+
   tayga = callPackage ../tools/networking/tayga { };
 
   tcpcrypt = callPackage ../tools/security/tcpcrypt { };
diff --git a/pkgs/top-level/ocaml-packages.nix b/pkgs/top-level/ocaml-packages.nix
index 3cbb0a7df33..cef4e913026 100644
--- a/pkgs/top-level/ocaml-packages.nix
+++ b/pkgs/top-level/ocaml-packages.nix
@@ -562,6 +562,10 @@ let
 
     mirage-stack = callPackage ../development/ocaml-modules/mirage-stack { };
 
+    mirage-time = callPackage ../development/ocaml-modules/mirage-time { };
+
+    mirage-time-unix = callPackage ../development/ocaml-modules/mirage-time/unix.nix { };
+
     mlgmp =  callPackage ../development/ocaml-modules/mlgmp { };
 
     mlgmpidl =  callPackage ../development/ocaml-modules/mlgmpidl { };