diff --git a/.github/workflows/pending-set.yml b/.github/workflows/pending-set.yml
index f59ac9439ea..944d1deefb9 100644
--- a/.github/workflows/pending-set.yml
+++ b/.github/workflows/pending-set.yml
@@ -16,5 +16,5 @@ jobs:
           -X POST \
           -H "Accept: application/vnd.github.v3+json" \
           -H "Authorization: token $GITHUB_TOKEN" \
-          -d '{"state": "failure", "target_url": " ", "description": "This failed status will be cleared when ofborg finishes eval.", "context": "Wait for ofborg"}' \
+          -d '{"state": "pending", "target_url": " ", "description": "This pending status will be cleared when ofborg starts eval.", "context": "Wait for ofborg"}' \
           "https://api.github.com/repos/NixOS/nixpkgs/statuses/${{ github.event.pull_request.head.sha }}"
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index ef1dda5dc37..464c6256542 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -3473,6 +3473,12 @@
       fingerprint = "7FC7 98AB 390E 1646 ED4D  8F1F 797F 6238 68CD 00C2";
     }];
   };
+  greizgh = {
+    email = "greizgh@ephax.org";
+    github = "greizgh";
+    githubId = 1313624;
+    name = "greizgh";
+  };
   greydot = {
     email = "lanablack@amok.cc";
     github = "greydot";
diff --git a/nixos/modules/services/continuous-integration/gocd-agent/default.nix b/nixos/modules/services/continuous-integration/gocd-agent/default.nix
index 2e9e1c94857..8cae08bf1fa 100644
--- a/nixos/modules/services/continuous-integration/gocd-agent/default.nix
+++ b/nixos/modules/services/continuous-integration/gocd-agent/default.nix
@@ -90,6 +90,7 @@ in {
       };
 
       startupOptions = mkOption {
+        type = types.listOf types.str;
         default = [
           "-Xms${cfg.initialJavaHeapSize}"
           "-Xmx${cfg.maxJavaHeapMemory}"
@@ -105,6 +106,7 @@ in {
 
       extraOptions = mkOption {
         default = [ ];
+        type = types.listOf types.str;
         example = [
           "-X debug"
           "-Xrunjdwp:transport=dt_socket,server=y,suspend=n,address=5006"
diff --git a/nixos/modules/services/continuous-integration/gocd-server/default.nix b/nixos/modules/services/continuous-integration/gocd-server/default.nix
index 4fa41ac49ed..4c829664a0a 100644
--- a/nixos/modules/services/continuous-integration/gocd-server/default.nix
+++ b/nixos/modules/services/continuous-integration/gocd-server/default.nix
@@ -27,6 +27,7 @@ in {
 
       extraGroups = mkOption {
         default = [ ];
+        type = types.listOf types.str;
         example = [ "wheel" "docker" ];
         description = ''
           List of extra groups that the "gocd-server" user should be a part of.
@@ -92,6 +93,7 @@ in {
       };
 
       startupOptions = mkOption {
+        type = types.listOf types.str;
         default = [
           "-Xms${cfg.initialJavaHeapSize}"
           "-Xmx${cfg.maxJavaHeapMemory}"
@@ -113,6 +115,7 @@ in {
 
       extraOptions = mkOption {
         default = [ ];
+        type = types.listOf types.str;
         example = [
           "-X debug"
           "-Xrunjdwp:transport=dt_socket,server=y,suspend=n,address=5005"
diff --git a/nixos/modules/services/web-apps/nextcloud.nix b/nixos/modules/services/web-apps/nextcloud.nix
index da019aa2507..1b643bd3260 100644
--- a/nixos/modules/services/web-apps/nextcloud.nix
+++ b/nixos/modules/services/web-apps/nextcloud.nix
@@ -6,17 +6,19 @@ let
   cfg = config.services.nextcloud;
   fpm = config.services.phpfpm.pools.nextcloud;
 
-  phpPackage =
-    let
-      base = pkgs.php74;
-    in
-      base.buildEnv {
-        extensions = { enabled, all }: with all;
-          enabled ++ [
-            apcu redis memcached imagick
-          ];
-        extraConfig = phpOptionsStr;
-      };
+  phpPackage = pkgs.php74.buildEnv {
+    extensions = { enabled, all }:
+      (with all;
+        enabled
+        ++ [ imagick ] # Always enabled
+        # Optionally enabled depending on caching settings
+        ++ optional cfg.caching.apcu apcu
+        ++ optional cfg.caching.redis redis
+        ++ optional cfg.caching.memcached memcached
+      )
+      ++ cfg.phpExtraExtensions all; # Enabled by user
+    extraConfig = toKeyValue phpOptions;
+  };
 
   toKeyValue = generators.toKeyValue {
     mkKeyValue = generators.mkKeyValueDefault {} " = ";
@@ -27,7 +29,6 @@ let
     post_max_size = cfg.maxUploadSize;
     memory_limit = cfg.maxUploadSize;
   } // cfg.phpOptions;
-  phpOptionsStr = toKeyValue phpOptions;
 
   occ = pkgs.writeScriptBin "nextcloud-occ" ''
     #! ${pkgs.runtimeShell}
@@ -116,6 +117,21 @@ in {
       '';
     };
 
+    phpExtraExtensions = mkOption {
+      type = with types; functionTo (listOf package);
+      default = all: [];
+      defaultText = "all: []";
+      description = ''
+        Additional PHP extensions to use for nextcloud.
+        By default, only extensions necessary for a vanilla nextcloud installation are enabled,
+        but you may choose from the list of available extensions and add further ones.
+        This is sometimes necessary to be able to install a certain nextcloud app that has additional requirements.
+      '';
+      example = literalExample ''
+        all: [ all.pdlib all.bz2 ]
+      '';
+    };
+
     phpOptions = mkOption {
       type = types.attrsOf types.str;
       default = {
@@ -511,7 +527,6 @@ in {
         pools.nextcloud = {
           user = "nextcloud";
           group = "nextcloud";
-          phpOptions = phpOptionsStr;
           phpPackage = phpPackage;
           phpEnv = {
             NEXTCLOUD_CONFIG_DIR = "${cfg.home}/config";
diff --git a/nixos/modules/services/web-apps/nextcloud.xml b/nixos/modules/services/web-apps/nextcloud.xml
index f71c8df6c6d..6cbfda118c4 100644
--- a/nixos/modules/services/web-apps/nextcloud.xml
+++ b/nixos/modules/services/web-apps/nextcloud.xml
@@ -182,6 +182,17 @@
   </para>
  </section>
 
+ <section xml:id="installing-apps-php-extensions-nextcloud">
+  <title>Installing Apps and PHP extensions</title>
+
+  <para>
+   Nextcloud apps are installed statefully through the web interface.
+
+   Some apps may require extra PHP extensions to be installed.
+   This can be configured with the <xref linkend="opt-services.nextcloud.phpExtraExtensions" /> setting.
+  </para>
+ </section>
+
  <section xml:id="module-services-nextcloud-maintainer-info">
   <title>Maintainer information</title>
 
diff --git a/nixos/tests/nextcloud/basic.nix b/nixos/tests/nextcloud/basic.nix
index 78142d37966..90050447042 100644
--- a/nixos/tests/nextcloud/basic.nix
+++ b/nixos/tests/nextcloud/basic.nix
@@ -42,6 +42,7 @@ in {
           enable = true;
           startAt = "20:00";
         };
+        phpExtraExtensions = all: [ all.bz2 ];
       };
 
       environment.systemPackages = [ cfg.services.nextcloud.occ ];
diff --git a/pkgs/applications/misc/koreader/default.nix b/pkgs/applications/misc/koreader/default.nix
index fd00cefdf39..a903600b46d 100644
--- a/pkgs/applications/misc/koreader/default.nix
+++ b/pkgs/applications/misc/koreader/default.nix
@@ -11,12 +11,12 @@
 let font-droid = nerdfonts.override { fonts = [ "DroidSansMono" ]; };
 in stdenv.mkDerivation rec {
   pname = "koreader";
-  version = "2021.01";
+  version = "2021.01.1";
 
   src = fetchurl {
     url =
       "https://github.com/koreader/koreader/releases/download/v${version}/koreader-${version}-amd64.deb";
-    sha256 = "0cc7pk27wlvziihggzlrb3wsjmndafa13cy1snqr5x71bb81fv6r";
+    sha256 = "0kignyia2xrg84bqzsp8rid4c79zg11lhw52z1854jw9v9324pja";
   };
 
   sourceRoot = ".";
diff --git a/pkgs/applications/networking/cluster/kubecfg/default.nix b/pkgs/applications/networking/cluster/kubecfg/default.nix
index b8bef9ecc05..561bcbf7ad3 100644
--- a/pkgs/applications/networking/cluster/kubecfg/default.nix
+++ b/pkgs/applications/networking/cluster/kubecfg/default.nix
@@ -1,6 +1,6 @@
 { lib, buildGoPackage, fetchFromGitHub, ... }:
 
-let version = "0.16.0"; in
+let version = "0.17.0"; in
 
 buildGoPackage {
   pname = "kubecfg";
@@ -10,7 +10,7 @@ buildGoPackage {
     owner = "bitnami";
     repo = "kubecfg";
     rev = "v${version}";
-    sha256 = "1ipw7r9fyqbh1bjvk7ifmj3skh799ly90y4ph37r8mqk1wb92rz4";
+    sha256 = "sha256-/91im204vBS3NjrMOvwTVO6tEBgdpirqJFqCnbIB+iQ=";
   };
 
   goPackagePath = "github.com/bitnami/kubecfg";
diff --git a/pkgs/applications/networking/cluster/minikube/default.nix b/pkgs/applications/networking/cluster/minikube/default.nix
index 570cb57a357..81ca2283d20 100644
--- a/pkgs/applications/networking/cluster/minikube/default.nix
+++ b/pkgs/applications/networking/cluster/minikube/default.nix
@@ -11,9 +11,9 @@
 
 buildGoModule rec {
   pname = "minikube";
-  version = "1.17.0";
+  version = "1.17.1";
 
-  vendorSha256 = "sha256-cA0sgH00XawwaOAGCDbabmBE/+5Y87kThXgPe5zwlro=";
+  vendorSha256 = "1flny2f7n3vqhl9vkwsqxvzl8q3fv8v0h1p0d0qaqp9lgn02q3bh";
 
   doCheck = false;
 
@@ -21,7 +21,7 @@ buildGoModule rec {
     owner = "kubernetes";
     repo = "minikube";
     rev = "v${version}";
-    sha256 = "sha256-IQ/AAr5b8ZOaQKkSrU8JsPxjqAwVmT4Kt3hf3e1dMeA=";
+    sha256 = "1m4kw77j4swwg3vqwmwrys7cq790w4g6y4gvdg33z9n1y9xzqys3";
   };
 
   nativeBuildInputs = [ go-bindata installShellFiles pkg-config which ];
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index c015afb787d..406f89decb5 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -342,9 +342,9 @@
     "owner": "gitlabhq",
     "provider-source-address": "registry.terraform.io/gitlabhq/gitlab",
     "repo": "terraform-provider-gitlab",
-    "rev": "v3.1.0",
-    "sha256": "1an34ckz7lz1k25lkjpbmls55zp9pacr46vjnjjpqx6bx5s95f5g",
-    "version": "3.1.0"
+    "rev": "v3.4.0",
+    "sha256": "03k3xjhxw70n00dvwd0fkdshff9hnicrah6rm6zqmksb4mb7wji3",
+    "version": "3.4.0"
   },
   "google": {
     "owner": "hashicorp",
diff --git a/pkgs/development/compilers/flutter/default.nix b/pkgs/development/compilers/flutter/default.nix
index 8572040cb0c..14f4d93caa0 100644
--- a/pkgs/development/compilers/flutter/default.nix
+++ b/pkgs/development/compilers/flutter/default.nix
@@ -1,11 +1,10 @@
 { callPackage, fetchurl, dart }:
-
 let
   mkFlutter = opts: callPackage (import ./flutter.nix opts) { };
   getPatches = dir:
     let files = builtins.attrNames (builtins.readDir dir);
     in map (f: dir + ("/" + f)) files;
-  version = "1.22.5";
+  version = "1.22.4";
   channel = "stable";
   filename = "flutter_linux_${version}-${channel}.tar.xz";
 in
@@ -14,11 +13,10 @@ in
   stable = mkFlutter rec {
     inherit dart version;
     pname = "flutter";
-    patches = getPatches ./patches;
     src = fetchurl {
       url = "https://storage.googleapis.com/flutter_infra/releases/${channel}/linux/${filename}";
-      sha256 = "1dv5kczcj9npf7xxlanmpc9ijnxa3ap46521cxn14c0i3y9295ja";
+      sha256 = "0qalgav9drqddcj8lfvl9ddf3325n953pvkmgha47lslg9sa88zw";
     };
-    depsSha256 = "0d7vhk6axgqajy2d9ia9lc6awcnz6cc3n04r7hnh7bx4hb0jv0l1";
+    patches = getPatches ./patches;
   };
 }
diff --git a/pkgs/development/compilers/flutter/flutter.nix b/pkgs/development/compilers/flutter/flutter.nix
index e3fcf77e391..8cac4a18fbe 100644
--- a/pkgs/development/compilers/flutter/flutter.nix
+++ b/pkgs/development/compilers/flutter/flutter.nix
@@ -3,7 +3,6 @@
 , patches
 , dart
 , src
-, depsSha256
 }:
 
 { bash
@@ -30,18 +29,13 @@
 , nspr
 , nss
 , systemd
-, callPackage
 }:
 let
-  repository = callPackage ./repository.nix {
-    inherit src pname version dart depsSha256;
-  };
   drvName = "flutter-${version}";
-
   flutter = stdenv.mkDerivation {
     name = "${drvName}-unwrapped";
 
-    buildInputs = [ git repository ];
+    buildInputs = [ git ];
 
     inherit src patches;
 
@@ -55,12 +49,13 @@ let
       export FLUTTER_TOOLS_DIR="$FLUTTER_ROOT/packages/flutter_tools"
       export SCRIPT_PATH="$FLUTTER_TOOLS_DIR/bin/flutter_tools.dart"
 
-      mkdir -p "$out/bin/cache"
-      export SNAPSHOT_PATH="$out/bin/cache/flutter_tools.snapshot"
-      export STAMP_PATH="$out/bin/cache/flutter_tools.stamp"
+      export SNAPSHOT_PATH="$FLUTTER_ROOT/bin/cache/flutter_tools.snapshot"
+      export STAMP_PATH="$FLUTTER_ROOT/bin/cache/flutter_tools.stamp"
 
       export DART_SDK_PATH="${dart}"
-      export PUB_CACHE="${repository}"
+
+      HOME=../.. # required for pub upgrade --offline, ~/.pub-cache
+                 # path is relative otherwise it's replaced by /build/flutter
 
       pushd "$FLUTTER_TOOLS_DIR"
       ${dart}/bin/pub get --offline
@@ -70,6 +65,9 @@ let
       ${dart}/bin/dart --snapshot="$SNAPSHOT_PATH" --packages="$FLUTTER_TOOLS_DIR/.packages" "$SCRIPT_PATH"
       echo "$revision" > "$STAMP_PATH"
       echo -n "${version}" > version
+
+      rm -r bin/cache/{artifacts,dart-sdk,downloads}
+      rm bin/cache/*.stamp
     '';
 
     installPhase = ''
diff --git a/pkgs/development/compilers/flutter/repository.nix b/pkgs/development/compilers/flutter/repository.nix
deleted file mode 100644
index 0f8de0a912f..00000000000
--- a/pkgs/development/compilers/flutter/repository.nix
+++ /dev/null
@@ -1,24 +0,0 @@
-{ lib, stdenv, dart, fetchurl, src, pname, version, depsSha256 }:
-
-stdenv.mkDerivation {
-  inherit src version;
-
-  pname = "${pname}-deps";
-  buildInputs = [ dart ];
-
-  buildPhase = ''
-    export PUB_CACHE="$out"
-    export FLUTTER_ROOT="$(pwd)"
-    export FLUTTER_TOOLS_DIR="$FLUTTER_ROOT/packages/flutter_tools"
-
-    pushd "$FLUTTER_TOOLS_DIR"
-    ${dart}/bin/pub get
-  '';
-
-  dontInstall = true;
-  dontFixup = true;
-
-  outputHashAlgo = "sha256";
-  outputHashMode = "recursive";
-  outputHash = depsSha256;
-}
diff --git a/pkgs/development/libraries/libgcrypt/1.5.nix b/pkgs/development/libraries/libgcrypt/1.5.nix
index f90ea502c40..b6968ff2d4e 100644
--- a/pkgs/development/libraries/libgcrypt/1.5.nix
+++ b/pkgs/development/libraries/libgcrypt/1.5.nix
@@ -38,5 +38,16 @@ stdenv.mkDerivation rec {
     license = licenses.lgpl2Plus;
     platforms = platforms.all;
     repositories.git = "git://git.gnupg.org/libgcrypt.git";
+    knownVulnerabilities = [
+      "CVE-2014-3591"
+      "CVE-2015-0837"
+      "CVE-2015-7511"
+      "CVE-2017-0379"
+      "CVE-2017-7526"
+      "CVE-2017-9526"
+      "CVE-2018-0495"
+      "CVE-2018-6829"
+      "CVE-2018-12437"
+    ];
   };
 }
diff --git a/pkgs/development/tools/flyway/default.nix b/pkgs/development/tools/flyway/default.nix
index bcad4ffb4e9..4f2bd805260 100644
--- a/pkgs/development/tools/flyway/default.nix
+++ b/pkgs/development/tools/flyway/default.nix
@@ -1,13 +1,13 @@
 { lib, stdenv, fetchurl, jre_headless, makeWrapper }:
   let
-    version = "7.3.1";
+    version = "7.5.2";
   in
     stdenv.mkDerivation {
       pname = "flyway";
       inherit version;
       src = fetchurl {
         url = "https://repo1.maven.org/maven2/org/flywaydb/flyway-commandline/${version}/flyway-commandline-${version}.tar.gz";
-        sha256 = "1qridl42jldwv6wka7l54g354aj9f3vbgzhyz5gdz5vdzs9x93w8";
+        sha256 = "sha256-oO7k6JOKUm11OYNN+tH/zqF9ucgrsnF4PcphT8+xnS8=";
       };
       nativeBuildInputs = [ makeWrapper ];
       dontBuild = true;
diff --git a/pkgs/development/tools/rust/sqlx-cli/default.nix b/pkgs/development/tools/rust/sqlx-cli/default.nix
new file mode 100644
index 00000000000..c6f34a9e20d
--- /dev/null
+++ b/pkgs/development/tools/rust/sqlx-cli/default.nix
@@ -0,0 +1,29 @@
+{ lib, rustPlatform, fetchFromGitHub, pkg-config, openssl }:
+
+rustPlatform.buildRustPackage rec {
+  pname = "sqlx-cli";
+  version = "0.4.2";
+
+  src = fetchFromGitHub {
+    owner = "launchbadge";
+    repo = "sqlx";
+    rev = "v${version}";
+    sha256 = "1q6p4qly9qjn333nj72sar6nbyclfdw9i9l6rnimswylj0rr9n27";
+  };
+
+  cargoSha256 = "1393mwx6iccnqrry4ia4prcnnjxhp4zjq1s3gzwzfyzsrqyad54g";
+
+  doCheck = false;
+  cargoBuildFlags = [ "-p sqlx-cli" ];
+
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [ openssl ];
+
+  meta = with lib; {
+    description =
+      "SQLx's associated command-line utility for managing databases, migrations, and enabling offline mode with sqlx::query!() and friends.";
+    homepage = "https://github.com/launchbadge/sqlx";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ greizgh ];
+  };
+}
diff --git a/pkgs/servers/keycloak/default.nix b/pkgs/servers/keycloak/default.nix
index 91234cdb410..468904b3f0d 100644
--- a/pkgs/servers/keycloak/default.nix
+++ b/pkgs/servers/keycloak/default.nix
@@ -18,11 +18,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname   = "keycloak";
-  version = "11.0.3";
+  version = "12.0.2";
 
   src = fetchzip {
-    url    = "https://downloads.jboss.org/keycloak/${version}/keycloak-${version}.zip";
-    sha256 = "15fw49rhnjky108hh71dkdlafd0ajr1n13vhivqcw6c18zvyan35";
+    url    = "https://github.com/keycloak/keycloak/releases/download/${version}/keycloak-${version}.zip";
+    sha256 = "006k6ac00iz61s6hi3wzj6w71mhhv7n00vh82ak4yhwr97jffqbz";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/tools/text/shfmt/default.nix b/pkgs/tools/text/shfmt/default.nix
index 70599963905..cb5bb8a28e8 100644
--- a/pkgs/tools/text/shfmt/default.nix
+++ b/pkgs/tools/text/shfmt/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "shfmt";
-  version = "3.2.1";
+  version = "3.2.2";
 
   src = fetchFromGitHub {
     owner = "mvdan";
     repo = "sh";
     rev = "v${version}";
-    sha256 = "1kp4ib0a64cc9qylny48ff5q9ciklzx93yhv7fgqhl1v2c7fm1jp";
+    sha256 = "sha256-ZeyHidw8iHboo/LHTR9E3Sqj8euaRvDaYbPQMdecsrk=";
   };
 
   vendorSha256 = "1ma7nvyn6ylbi8bd7x900i94pzs877kfy9xh0nf1bbify1vcpd29";
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index bec49463f9d..172406ec710 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -10839,6 +10839,8 @@ in
     jdk = oraclejdk;
   };
 
+  sqlx-cli = callPackage ../development/tools/rust/sqlx-cli { };
+
   squeak = callPackage ../development/compilers/squeak { };
 
   squirrel-sql = callPackage ../development/tools/database/squirrel-sql {
diff --git a/pkgs/top-level/release-cross.nix b/pkgs/top-level/release-cross.nix
index df476db0a7a..639c54a8a1e 100644
--- a/pkgs/top-level/release-cross.nix
+++ b/pkgs/top-level/release-cross.nix
@@ -150,6 +150,9 @@ in
 
   x86_64-musl = mapTestOnCross lib.systems.examples.musl64 linuxCommon;
 
+  ppc64le = mapTestOnCross lib.systems.examples.powernv linuxCommon;
+  ppc64le-musl = mapTestOnCross lib.systems.examples.musl-power linuxCommon;
+
   android64 = mapTestOnCross lib.systems.examples.aarch64-android-prebuilt linuxCommon;
   android32 = mapTestOnCross lib.systems.examples.armv7a-android-prebuilt linuxCommon;