diff --git a/doc/languages-frameworks/python.section.md b/doc/languages-frameworks/python.section.md
index 71193ed0cc0..f36f5cf0cbb 100644
--- a/doc/languages-frameworks/python.section.md
+++ b/doc/languages-frameworks/python.section.md
@@ -611,7 +611,7 @@ Using the example above, the analagous pytestCheckHook usage would be:
     "update"
   ];
 
-  disabledTestFiles = [
+  disabledTestPaths = [
     "tests/test_failing.py"
   ];
 ```
diff --git a/doc/languages-frameworks/rust.section.md b/doc/languages-frameworks/rust.section.md
index 8f6db28ab4d..2290d92f7ad 100644
--- a/doc/languages-frameworks/rust.section.md
+++ b/doc/languages-frameworks/rust.section.md
@@ -196,7 +196,7 @@ sometimes it may be necessary to disable this so the tests run consecutively.
 ```nix
 rustPlatform.buildRustPackage {
   /* ... */
-  cargoParallelTestThreads = false;
+  dontUseCargoParallelTests = true;
 }
 ```
 
@@ -237,6 +237,198 @@ rustPlatform.buildRustPackage rec {
 }
 ```
 
+## Compiling non-Rust packages that include Rust code
+
+Several non-Rust packages incorporate Rust code for performance- or
+security-sensitive parts. `rustPlatform` exposes several functions and
+hooks that can be used to integrate Cargo in non-Rust packages.
+
+### Vendoring of dependencies
+
+Since network access is not allowed in sandboxed builds, Rust crate
+dependencies need to be retrieved using a fetcher. `rustPlatform`
+provides the `fetchCargoTarball` fetcher, which vendors all
+dependencies of a crate. For example, given a source path `src`
+containing `Cargo.toml` and `Cargo.lock`, `fetchCargoTarball`
+can be used as follows:
+
+```nix
+cargoDeps = rustPlatform.fetchCargoTarball {
+  inherit src;
+  hash = "sha256-BoHIN/519Top1NUBjpB/oEMqi86Omt3zTQcXFWqrek0=";
+};
+```
+
+The `src` attribute is required, as well as a hash specified through
+one of the `sha256` or `hash` attributes. The following optional
+attributes can also be used:
+
+* `name`: the name that is used for the dependencies tarball.  If
+  `name` is not specified, then the name `cargo-deps` will be used.
+* `sourceRoot`: when the `Cargo.lock`/`Cargo.toml` are in a
+  subdirectory, `sourceRoot` specifies the relative path to these
+  files.
+* `patches`: patches to apply before vendoring. This is useful when
+  the `Cargo.lock`/`Cargo.toml` files need to be patched before
+  vendoring.
+
+### Hooks
+
+`rustPlatform` provides the following hooks to automate Cargo builds:
+
+* `cargoSetupHook`: configure Cargo to use depenencies vendored
+  through `fetchCargoTarball`. This hook uses the `cargoDeps`
+  environment variable to find the vendored dependencies. If a project
+  already vendors its dependencies, the variable `cargoVendorDir` can
+  be used instead. When the `Cargo.toml`/`Cargo.lock` files are not in
+  `sourceRoot`, then the optional `cargoRoot` is used to specify the
+  Cargo root directory relative to `sourceRoot`.
+* `cargoBuildHook`: use Cargo to build a crate. If the crate to be
+  built is a crate in e.g. a Cargo workspace, the relative path to the
+  crate to build can be set through the optional `buildAndTestSubdir`
+  environment variable. Additional Cargo build flags can be passed
+  through `cargoBuildFlags`.
+* `maturinBuildHook`: use [Maturin](https://github.com/PyO3/maturin)
+  to build a Python wheel. Similar to `cargoBuildHook`, the optional
+  variable `buildAndTestSubdir` can be used to build a crate in a
+  Cargo workspace. Additional maturin flags can be passed through
+  `maturinBuildFlags`.
+* `cargoCheckHook`: run tests using Cargo. Additional flags can be
+  passed to Cargo using `checkFlags` and `checkFlagsArray`. By
+  default, tests are run in parallel. This can be disabled by setting
+  `dontUseCargoParallelTests`.
+* `cargoInstallHook`: install binaries and static/shared libraries
+  that were built using `cargoBuildHook`.
+
+### Examples
+
+#### Python package using `setuptools-rust`
+
+For Python packages using `setuptools-rust`, you can use
+`fetchCargoTarball` and `cargoSetupHook` to retrieve and set up Cargo
+dependencies. The build itself is then performed by
+`buildPythonPackage`.
+
+The following example outlines how the `tokenizers` Python package is
+built. Since the Python package is in the `source/bindings/python`
+directory of the *tokenizers* project's source archive, we use
+`sourceRoot` to point the tooling to this directory:
+
+```nix
+{ fetchFromGitHub
+, buildPythonPackage
+, rustPlatform
+, setuptools-rust
+}:
+
+buildPythonPackage rec {
+  pname = "tokenizers";
+  version = "0.10.0";
+
+  src = fetchFromGitHub {
+    owner = "huggingface";
+    repo = pname;
+    rev = "python-v${version}";
+    hash = "sha256-rQ2hRV52naEf6PvRsWVCTN7B1oXAQGmnpJw4iIdhamw=";
+  };
+
+  cargoDeps = rustPlatform.fetchCargoTarball {
+    inherit src sourceRoot;
+    name = "${pname}-${version}";
+    hash = "sha256-BoHIN/519Top1NUBjpB/oEMqi86Omt3zTQcXFWqrek0=";
+  };
+
+  sourceRoot = "source/bindings/python";
+
+  nativeBuildInputs = [ setuptools-rust ] ++ (with rustPlatform; [
+    cargoSetupHook
+    rust.cargo
+    rust.rustc
+  ]);
+
+  # ...
+}
+```
+
+In some projects, the Rust crate is not in the main Python source
+directory.  In such cases, the `cargoRoot` attribute can be used to
+specify the crate's directory relative to `sourceRoot`. In the
+following example, the crate is in `src/rust`, as specified in the
+`cargoRoot` attribute. Note that we also need to specify the correct
+path for `fetchCargoTarball`.
+
+```nix
+
+{ buildPythonPackage
+, fetchPypi
+, rustPlatform
+, setuptools-rust
+, openssl
+}:
+
+buildPythonPackage rec {
+  pname = "cryptography";
+  version = "3.4.2"; # Also update the hash in vectors.nix
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "1i1mx5y9hkyfi9jrrkcw804hmkcglxi6rmf7vin7jfnbr2bf4q64";
+  };
+
+  cargoDeps = rustPlatform.fetchCargoTarball {
+    inherit src;
+    sourceRoot = "${pname}-${version}/${cargoRoot}";
+    name = "${pname}-${version}";
+    hash = "sha256-PS562W4L1NimqDV2H0jl5vYhL08H9est/pbIxSdYVfo=";
+  };
+
+  cargoRoot = "src/rust";
+
+  # ...
+}
+```
+
+#### Python package using `maturin`
+
+Python packages that use [Maturin](https://github.com/PyO3/maturin)
+can be built with `fetchCargoTarball`, `cargoSetupHook`, and
+`maturinBuildHook`. For example, the following (partial) derivation
+builds the `retworkx` Python package. `fetchCargoTarball` and
+`cargoSetupHook` are used to fetch and set up the crate dependencies.
+`maturinBuildHook` is used to perform the build.
+
+```nix
+{ lib
+, buildPythonPackage
+, rustPlatform
+, fetchFromGitHub
+}:
+
+buildPythonPackage rec {
+  pname = "retworkx";
+  version = "0.6.0";
+
+  src = fetchFromGitHub {
+    owner = "Qiskit";
+    repo = "retworkx";
+    rev = version;
+    sha256 = "11n30ldg3y3y6qxg3hbj837pnbwjkqw3nxq6frds647mmmprrd20";
+  };
+
+  cargoDeps = rustPlatform.fetchCargoTarball {
+    inherit src;
+    name = "${pname}-${version}";
+    hash = "sha256-heOBK8qi2nuc/Ib+I/vLzZ1fUUD/G/KTw9d7M4Hz5O0=";
+  };
+
+  format = "pyproject";
+
+  nativeBuildInputs = with rustPlatform; [ cargoSetupHook maturinBuildHook ];
+
+  # ...
+}
+```
+
 ## Compiling Rust crates using Nix instead of Cargo
 
 ### Simple operation
diff --git a/maintainers/scripts/nixpkgs-lint.nix b/maintainers/scripts/nixpkgs-lint.nix
index b0267281b38..873905373af 100644
--- a/maintainers/scripts/nixpkgs-lint.nix
+++ b/maintainers/scripts/nixpkgs-lint.nix
@@ -3,7 +3,8 @@
 stdenv.mkDerivation {
   name = "nixpkgs-lint-1";
 
-  buildInputs = [ makeWrapper perl perlPackages.XMLSimple ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ perl perlPackages.XMLSimple ];
 
   dontUnpack = true;
   buildPhase = "true";
diff --git a/nixos/modules/tasks/network-interfaces-systemd.nix b/nixos/modules/tasks/network-interfaces-systemd.nix
index 088bffd7c50..23e1e611a71 100644
--- a/nixos/modules/tasks/network-interfaces-systemd.nix
+++ b/nixos/modules/tasks/network-interfaces-systemd.nix
@@ -93,17 +93,7 @@ in
             (if i.useDHCP != null then i.useDHCP else false));
           address = forEach (interfaceIps i)
             (ip: "${ip.address}/${toString ip.prefixLength}");
-          # IPv6PrivacyExtensions=kernel seems to be broken with networkd.
-          # Instead of using IPv6PrivacyExtensions=kernel, configure it according to the value of
-          # `tempAddress`:
-          networkConfig.IPv6PrivacyExtensions = {
-            # generate temporary addresses and use them by default
-            "default" = true;
-            # generate temporary addresses but keep using the standard EUI-64 ones by default
-            "enabled" = "prefer-public";
-            # completely disable temporary addresses
-            "disabled" = false;
-          }.${i.tempAddress};
+          networkConfig.IPv6PrivacyExtensions = "kernel";
           linkConfig = optionalAttrs (i.macAddress != null) {
             MACAddress = i.macAddress;
           } // optionalAttrs (i.mtu != null) {
diff --git a/pkgs/applications/audio/MMA/default.nix b/pkgs/applications/audio/MMA/default.nix
index ade595732c3..25cb9696509 100644
--- a/pkgs/applications/audio/MMA/default.nix
+++ b/pkgs/applications/audio/MMA/default.nix
@@ -9,7 +9,8 @@
     sha256 = "18k0hwlqky5x4y461fxmw77gvz7z8jyrvxicrqphsgvwwinzy732";
   };
 
-  buildInputs = [ makeWrapper python3 alsaUtils timidity ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ python3 alsaUtils timidity ];
 
   patchPhase = ''
     sed -i 's@/usr/bin/aplaymidi@/${alsaUtils}/bin/aplaymidi@g' mma-splitrec
diff --git a/pkgs/applications/audio/baudline/default.nix b/pkgs/applications/audio/baudline/default.nix
index 29c5130f575..7d6d51011cc 100644
--- a/pkgs/applications/audio/baudline/default.nix
+++ b/pkgs/applications/audio/baudline/default.nix
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
     else
       throw "baudline isn't supported (yet?) on ${stdenv.hostPlatform.system}";
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   # Prebuilt binary distribution.
   # "patchelf --set-rpath" seems to break the application (cannot start), using
diff --git a/pkgs/applications/audio/caudec/default.nix b/pkgs/applications/audio/caudec/default.nix
index 0360922c819..15ebb85136b 100644
--- a/pkgs/applications/audio/caudec/default.nix
+++ b/pkgs/applications/audio/caudec/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation {
     patchShebangs ./install.sh
   '';
 
-  buildInputs = [ bash makeWrapper ];
+  nativeBuildInputs = [ bash makeWrapper ];
 
   installPhase = ''
     ./install.sh --prefix=$out/bin
diff --git a/pkgs/applications/audio/clementine/default.nix b/pkgs/applications/audio/clementine/default.nix
index be0f2f72529..e665edabd07 100644
--- a/pkgs/applications/audio/clementine/default.nix
+++ b/pkgs/applications/audio/clementine/default.nix
@@ -24,7 +24,7 @@ let
     ./clementine-spotify-blob.patch
   ];
 
-  nativeBuildInputs = [ cmake pkg-config ];
+  nativeBuildInputs = [ cmake pkg-config makeWrapper ];
 
   buildInputs = [
     boost
@@ -68,7 +68,7 @@ let
     inherit src patches nativeBuildInputs postPatch;
 
     # gst_plugins needed for setup-hooks
-    buildInputs = buildInputs ++ [ makeWrapper ] ++ gst_plugins;
+    buildInputs = buildInputs ++ gst_plugins;
 
     preConfigure = ''
       rm -rf ext/{,lib}clementine-spotifyblob
@@ -102,7 +102,7 @@ let
     # Use the same patches and sources as Clementine
     inherit src nativeBuildInputs patches postPatch;
 
-    buildInputs = buildInputs ++ [ libspotify makeWrapper ];
+    buildInputs = buildInputs ++ [ libspotify ];
     # Only build and install the Spotify blob
     preBuild = ''
       cd ext/clementine-spotifyblob
diff --git a/pkgs/applications/audio/clerk/default.nix b/pkgs/applications/audio/clerk/default.nix
index 0724632a63e..a2e71b955ec 100644
--- a/pkgs/applications/audio/clerk/default.nix
+++ b/pkgs/applications/audio/clerk/default.nix
@@ -11,7 +11,8 @@ stdenv.mkDerivation {
     sha256 = "0y045my65hr3hjyx13jrnyg6g3wb41phqb1m7azc4l6vx6r4124b";
   };
 
-  buildInputs = [ makeWrapper pythonPackages.mpd2 ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ pythonPackages.mpd2 ];
 
   dontBuild = true;
 
diff --git a/pkgs/applications/audio/deadbeef/wrapper.nix b/pkgs/applications/audio/deadbeef/wrapper.nix
index cd45ef5926b..66108deab1e 100644
--- a/pkgs/applications/audio/deadbeef/wrapper.nix
+++ b/pkgs/applications/audio/deadbeef/wrapper.nix
@@ -5,7 +5,7 @@ symlinkJoin {
 
   paths = [ deadbeef ] ++ plugins;
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   postBuild = ''
     wrapProgram $out/bin/deadbeef \
diff --git a/pkgs/applications/audio/faust/faust1.nix b/pkgs/applications/audio/faust/faust1.nix
index 6d7d2e2c2ba..81ce11b9ea1 100644
--- a/pkgs/applications/audio/faust/faust1.nix
+++ b/pkgs/applications/audio/faust/faust1.nix
@@ -30,7 +30,7 @@ let
 
     inherit src;
 
-    buildInputs = [ makeWrapper ];
+    nativeBuildInputs = [ makeWrapper ];
 
     passthru = {
       inherit wrap wrapWithBuildEnv;
@@ -159,8 +159,7 @@ let
 
     stdenv.mkDerivation ((faust2ApplBase args) // {
 
-      nativeBuildInputs = [ pkg-config ];
-      buildInputs = [ makeWrapper ];
+      nativeBuildInputs = [ pkg-config makeWrapper ];
 
       propagatedBuildInputs = [ faust ] ++ propagatedBuildInputs;
 
@@ -195,7 +194,7 @@ let
 
     in stdenv.mkDerivation ((faust2ApplBase args) // {
 
-      buildInputs = [ makeWrapper ];
+      nativeBuildInputs = [ makeWrapper ];
 
       postFixup = ''
         for script in "$out"/bin/*; do
diff --git a/pkgs/applications/audio/faust/faust2.nix b/pkgs/applications/audio/faust/faust2.nix
index 990d073528e..051caf120fa 100644
--- a/pkgs/applications/audio/faust/faust2.nix
+++ b/pkgs/applications/audio/faust/faust2.nix
@@ -168,8 +168,7 @@ let
 
     stdenv.mkDerivation ((faust2ApplBase args) // {
 
-      nativeBuildInputs = [ pkg-config ];
-      buildInputs = [ makeWrapper ];
+      nativeBuildInputs = [ pkg-config makeWrapper ];
 
       propagatedBuildInputs = [ faust ] ++ propagatedBuildInputs;
 
@@ -209,7 +208,7 @@ let
 
     in stdenv.mkDerivation ((faust2ApplBase args) // {
 
-      buildInputs = [ makeWrapper ];
+      nativeBuildInputs = [ makeWrapper ];
 
       postFixup = ''
         for script in "$out"/bin/*; do
diff --git a/pkgs/applications/audio/google-play-music-desktop-player/default.nix b/pkgs/applications/audio/google-play-music-desktop-player/default.nix
index 0be1cc45717..f86eed1d34d 100644
--- a/pkgs/applications/audio/google-play-music-desktop-player/default.nix
+++ b/pkgs/applications/audio/google-play-music-desktop-player/default.nix
@@ -53,7 +53,7 @@ stdenv.mkDerivation {
   };
 
   dontBuild = true;
-  buildInputs = [ dpkg makeWrapper ];
+  nativeBuildInputs = [ dpkg makeWrapper ];
 
   unpackPhase = ''
     dpkg -x $src .
diff --git a/pkgs/applications/audio/jamin/default.nix b/pkgs/applications/audio/jamin/default.nix
index f111c4e99d7..325d115b581 100644
--- a/pkgs/applications/audio/jamin/default.nix
+++ b/pkgs/applications/audio/jamin/default.nix
@@ -11,8 +11,8 @@ stdenv.mkDerivation rec {
     sha256 = "0g5v74cm0q3p3pzl6xmnp4rqayaymfli7c6z8s78h9rgd24fwbvn";
   };
 
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ fftwFloat gtk2 ladspaPlugins libjack2 liblo libxml2 makeWrapper ]
+  nativeBuildInputs = [ pkg-config makeWrapper ];
+  buildInputs = [ fftwFloat gtk2 ladspaPlugins libjack2 liblo libxml2 ]
     ++ (with perlPackages; [ perl XMLParser ]);
 
   NIX_LDFLAGS = "-ldl";
diff --git a/pkgs/applications/audio/lash/default.nix b/pkgs/applications/audio/lash/default.nix
index eb355a43409..74bbeb9b7bb 100644
--- a/pkgs/applications/audio/lash/default.nix
+++ b/pkgs/applications/audio/lash/default.nix
@@ -15,8 +15,8 @@ stdenv.mkDerivation  rec {
   # http://permalink.gmane.org/gmane.linux.redhat.fedora.extras.cvs/822346
   patches = [ ./socket.patch ./gcc-47.patch ];
 
-  buildInputs = [ alsaLib gtk2 libjack2 libxml2 makeWrapper
-    pkg-config readline ];
+  nativeBuildInputs = [ pkg-config makeWrapper ];
+  buildInputs = [ alsaLib gtk2 libjack2 libxml2 readline ];
   propagatedBuildInputs = [ libuuid ];
   NIX_LDFLAGS = "-lm -lpthread -luuid";
 
diff --git a/pkgs/applications/audio/linuxband/default.nix b/pkgs/applications/audio/linuxband/default.nix
index 118b54ad858..ec034ae238d 100644
--- a/pkgs/applications/audio/linuxband/default.nix
+++ b/pkgs/applications/audio/linuxband/default.nix
@@ -11,8 +11,8 @@ in stdenv.mkDerivation rec {
     sha256 = "1r71h4yg775m4gax4irrvygmrsclgn503ykmc2qwjsxa42ri4n2n";
   };
 
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ makeWrapper MMA libjack2 libsmf python pyGtkGlade pygtksourceview ];
+  nativeBuildInputs = [ pkg-config makeWrapper ];
+  buildInputs = [ MMA libjack2 libsmf python pyGtkGlade pygtksourceview ];
 
   patchPhase = ''
     sed -i 's@/usr/@${MMA}/@g' src/main/config/linuxband.rc.in
diff --git a/pkgs/applications/audio/mda-lv2/default.nix b/pkgs/applications/audio/mda-lv2/default.nix
index 30d654ab87a..92f8506483f 100644
--- a/pkgs/applications/audio/mda-lv2/default.nix
+++ b/pkgs/applications/audio/mda-lv2/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "mda-lv2";
-  version = "1.2.4";
+  version = "1.2.6";
 
   src = fetchurl {
     url = "https://download.drobilla.net/${pname}-${version}.tar.bz2";
-    sha256 = "1a3cv6w5xby9yn11j695rbh3c4ih7rxfxmkca9s1324ljphh06m8";
+    sha256 = "sha256-zWYRcCSuBJzzrKg/npBKcCdyJOI6lp9yqcXQEKSYV9s=";
   };
 
   nativeBuildInputs = [ pkg-config wafHook python3 ];
diff --git a/pkgs/applications/audio/puredata/wrapper.nix b/pkgs/applications/audio/puredata/wrapper.nix
index 80968e2700b..3444ef9acbd 100644
--- a/pkgs/applications/audio/puredata/wrapper.nix
+++ b/pkgs/applications/audio/puredata/wrapper.nix
@@ -7,7 +7,7 @@ in symlinkJoin {
 
   paths = [ puredata ] ++ plugins;
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   postBuild = ''
     wrapProgram $out/bin/pd \
diff --git a/pkgs/applications/audio/real_time_config_quick_scan/default.nix b/pkgs/applications/audio/real_time_config_quick_scan/default.nix
index 3fb476b65cc..8bc2553f521 100644
--- a/pkgs/applications/audio/real_time_config_quick_scan/default.nix
+++ b/pkgs/applications/audio/real_time_config_quick_scan/default.nix
@@ -11,7 +11,8 @@ stdenv.mkDerivation rec {
     sha256 = "16kanzp5i353x972zjkwgi3m8z90wc58613mlfzb0n01djdnm6k5";
   };
 
-  buildInputs = [ perlPackages.perl makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ perlPackages.perl ];
 
   dontBuild = true;
 
diff --git a/pkgs/applications/audio/rubyripper/default.nix b/pkgs/applications/audio/rubyripper/default.nix
index b7abfa40b86..e8a275db98d 100644
--- a/pkgs/applications/audio/rubyripper/default.nix
+++ b/pkgs/applications/audio/rubyripper/default.nix
@@ -10,7 +10,8 @@ stdenv.mkDerivation rec {
   preConfigure = "patchShebangs .";
 
   configureFlags = [ "--enable-cli" ];
-  buildInputs = [ ruby cdparanoia makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ ruby cdparanoia ];
   postInstall = ''
     wrapProgram "$out/bin/rrip_cli" \
       --prefix PATH : "${ruby}/bin" \
diff --git a/pkgs/applications/audio/spotify/default.nix b/pkgs/applications/audio/spotify/default.nix
index 43ecb67d64a..655a047a3a6 100644
--- a/pkgs/applications/audio/spotify/default.nix
+++ b/pkgs/applications/audio/spotify/default.nix
@@ -81,7 +81,8 @@ stdenv.mkDerivation {
     sha512 = "5b3d5d1f52a554c8e775b8aed16ef84e96bf3b61a2b53266e10d3c47e341899310af13cc8513b04424fc14532e36543a6fae677f80a036e3f51c75166d8d53d1";
   };
 
-  buildInputs = [ squashfsTools makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ squashfsTools ];
 
   dontStrip = true;
   dontPatchELF = true;
diff --git a/pkgs/applications/audio/vkeybd/default.nix b/pkgs/applications/audio/vkeybd/default.nix
index 3409d8a4907..943bd0d8032 100644
--- a/pkgs/applications/audio/vkeybd/default.nix
+++ b/pkgs/applications/audio/vkeybd/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation  rec {
     sha256 = "0107b5j1gf7dwp7qb4w2snj4bqiyps53d66qzl2rwj4jfpakws5a";
   };
 
-  buildInputs = [ alsaLib libX11 makeWrapper tcl tk ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ alsaLib libX11 tcl tk ];
 
   configurePhase = ''
     mkdir -p $out/bin
diff --git a/pkgs/applications/editors/eclipse/default.nix b/pkgs/applications/editors/eclipse/default.nix
index cff482e887d..2c067250309 100644
--- a/pkgs/applications/editors/eclipse/default.nix
+++ b/pkgs/applications/editors/eclipse/default.nix
@@ -162,7 +162,7 @@ in rec {
       # Eclipse.
       name = (lib.meta.appendToName "with-plugins" eclipse).name;
     in
-      runCommand name { buildInputs = [ makeWrapper ]; } ''
+      runCommand name { nativeBuildInputs = [ makeWrapper ]; } ''
         mkdir -p $out/bin $out/etc
 
         # Prepare an eclipse.ini with the plugin directory.
diff --git a/pkgs/applications/editors/kakoune/wrapper.nix b/pkgs/applications/editors/kakoune/wrapper.nix
index 7ac56d9cb1e..451507885ce 100644
--- a/pkgs/applications/editors/kakoune/wrapper.nix
+++ b/pkgs/applications/editors/kakoune/wrapper.nix
@@ -9,7 +9,7 @@ in
   symlinkJoin {
     name = "kakoune-${kakoune.version}";
 
-    buildInputs = [ makeWrapper ];
+    nativeBuildInputs = [ makeWrapper ];
 
     paths = [ kakoune ] ++ requestedPlugins;
 
diff --git a/pkgs/applications/editors/kodestudio/default.nix b/pkgs/applications/editors/kodestudio/default.nix
index e0704cdbc85..aa7b7b19448 100644
--- a/pkgs/applications/editors/kodestudio/default.nix
+++ b/pkgs/applications/editors/kodestudio/default.nix
@@ -29,7 +29,8 @@ in
         inherit sha256;
     };
 
-    buildInputs = [ makeWrapper libXScrnSaver ];
+    nativeBuildInputs = [ makeWrapper ];
+    buildInputs = [ libXScrnSaver ];
 
     desktopItem = makeDesktopItem {
       name = "kodestudio";
diff --git a/pkgs/applications/editors/music/tuxguitar/default.nix b/pkgs/applications/editors/music/tuxguitar/default.nix
index 63be87ee86c..90879b352e1 100644
--- a/pkgs/applications/editors/music/tuxguitar/default.nix
+++ b/pkgs/applications/editors/music/tuxguitar/default.nix
@@ -14,7 +14,7 @@ in stdenv.mkDerivation rec {
     sha256 = metadata.sha256;
   };
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   installPhase = ''
     mkdir -p $out/bin
diff --git a/pkgs/applications/editors/neovim/wrapper.nix b/pkgs/applications/editors/neovim/wrapper.nix
index 5c6c6c1a8d5..41ff62a619f 100644
--- a/pkgs/applications/editors/neovim/wrapper.nix
+++ b/pkgs/applications/editors/neovim/wrapper.nix
@@ -106,7 +106,7 @@ let
 
     preferLocalBuild = true;
 
-    buildInputs = [makeWrapper];
+    nativeBuildInputs = [ makeWrapper ];
     passthru = { unwrapped = neovim; };
 
     meta = neovim.meta // {
diff --git a/pkgs/applications/editors/netbeans/default.nix b/pkgs/applications/editors/netbeans/default.nix
index 9206b296b9a..f968b85c6ff 100644
--- a/pkgs/applications/editors/netbeans/default.nix
+++ b/pkgs/applications/editors/netbeans/default.nix
@@ -56,7 +56,8 @@ stdenv.mkDerivation {
     ln -s ${desktopItem}/share/applications/* $out/share/applications
   '';
 
-  buildInputs = [ makeWrapper perl python unzip libicns imagemagick ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ perl python unzip libicns imagemagick ];
 
   meta = {
     description = "An integrated development environment for Java, C, C++ and PHP";
diff --git a/pkgs/applications/editors/supertux-editor/default.nix b/pkgs/applications/editors/supertux-editor/default.nix
index e474ff5f19b..6e3580a563c 100644
--- a/pkgs/applications/editors/supertux-editor/default.nix
+++ b/pkgs/applications/editors/supertux-editor/default.nix
@@ -10,8 +10,8 @@ stdenv.mkDerivation {
     sha256 = "08y5haclgxvcii3hpdvn1ah8qd0f3n8xgxxs8zryj02b8n7cz3vx";
   };
 
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [mono gtk-sharp-2_0 makeWrapper gnome2.libglade gtk2 ];
+  nativeBuildInputs = [ pkg-config makeWrapper ];
+  buildInputs = [mono gtk-sharp-2_0 gnome2.libglade gtk2 ];
 
   installPhase = ''
     mkdir -p $out/bin $out/lib/supertux-editor
diff --git a/pkgs/applications/editors/vim/macvim-configurable.nix b/pkgs/applications/editors/vim/macvim-configurable.nix
index 6ea6b6c6094..7ed3dee9b6b 100644
--- a/pkgs/applications/editors/vim/macvim-configurable.nix
+++ b/pkgs/applications/editors/vim/macvim-configurable.nix
@@ -29,7 +29,7 @@ let
           "/Applications/MacVim.app/Contents/MacOS"
           "/Applications/MacVim.app/Contents/bin"
         ];
-        buildInputs = [ makeWrapper ];
+        nativeBuildInputs = [ makeWrapper ];
         # We need to do surgery on the resulting app. We can't just make a wrapper for vim because this
         # is a GUI app. We need to copy the actual GUI executable image as AppKit uses the loaded image's
         # path to locate the bundle. We can use symlinks for other executables and resources though.
diff --git a/pkgs/applications/editors/vscode/with-extensions.nix b/pkgs/applications/editors/vscode/with-extensions.nix
index c30b52782ef..d2c91f155d5 100644
--- a/pkgs/applications/editors/vscode/with-extensions.nix
+++ b/pkgs/applications/editors/vscode/with-extensions.nix
@@ -57,7 +57,8 @@ in
 # When no extensions are requested, we simply redirect to the original
 # non-wrapped vscode executable.
 runCommand "${wrappedPkgName}-with-extensions-${wrappedPkgVersion}" {
-  buildInputs = [ vscode makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ vscode ];
   dontPatchELF = true;
   dontStrip = true;
   meta = vscode.meta;
diff --git a/pkgs/applications/graphics/gimp/wrapper.nix b/pkgs/applications/graphics/gimp/wrapper.nix
index 8fde04d0d1d..bb81a374fea 100644
--- a/pkgs/applications/graphics/gimp/wrapper.nix
+++ b/pkgs/applications/graphics/gimp/wrapper.nix
@@ -11,7 +11,7 @@ in symlinkJoin {
 
   paths = [ gimp ] ++ selectedPlugins;
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   postBuild = ''
     for each in gimp-${versionBranch} gimp-console-${versionBranch}; do
diff --git a/pkgs/applications/graphics/glimpse/wrapper.nix b/pkgs/applications/graphics/glimpse/wrapper.nix
index cdfb2f66873..daa540d31e5 100644
--- a/pkgs/applications/graphics/glimpse/wrapper.nix
+++ b/pkgs/applications/graphics/glimpse/wrapper.nix
@@ -12,7 +12,7 @@ symlinkJoin {
 
   paths = [ glimpse ] ++ selectedPlugins;
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   postBuild = ''
     for each in glimpse-${versionBranch} glimpse-console-${versionBranch}; do
diff --git a/pkgs/applications/graphics/imagej/default.nix b/pkgs/applications/graphics/imagej/default.nix
index 7e3238e94bb..312316b3397 100644
--- a/pkgs/applications/graphics/imagej/default.nix
+++ b/pkgs/applications/graphics/imagej/default.nix
@@ -15,7 +15,8 @@ let
       url = "https://wsr.imagej.net/distros/cross-platform/ij150.zip";
       sha256 = "97aba6fc5eb908f5160243aebcdc4965726693cb1353d9c0d71b8f5dd832cb7b";
     };
-    buildInputs = [ unzip makeWrapper ];
+    nativeBuildInputs = [ makeWrapper ];
+    buildInputs = [ unzip ];
     inherit jre;
 
     # JAR files that are intended to be used by other packages
diff --git a/pkgs/applications/graphics/inkscape/with-extensions.nix b/pkgs/applications/graphics/inkscape/with-extensions.nix
index cca7b1fc3a5..c558a6bb062 100644
--- a/pkgs/applications/graphics/inkscape/with-extensions.nix
+++ b/pkgs/applications/graphics/inkscape/with-extensions.nix
@@ -10,7 +10,7 @@ symlinkJoin {
 
   paths = [ inkscape ] ++ inkscapeExtensions;
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   postBuild = ''
     rm -f $out/bin/inkscape
diff --git a/pkgs/applications/graphics/tesseract/wrapper.nix b/pkgs/applications/graphics/tesseract/wrapper.nix
index 313920d8154..1dfc4393c46 100644
--- a/pkgs/applications/graphics/tesseract/wrapper.nix
+++ b/pkgs/applications/graphics/tesseract/wrapper.nix
@@ -17,7 +17,7 @@ let
   tesseractWithData = tesseractBase.overrideAttrs (_: {
     inherit tesseractBase tessdata;
 
-    buildInputs = [ makeWrapper ];
+    nativeBuildInputs = [ makeWrapper ];
 
     buildCommand = ''
       makeWrapper {$tesseractBase,$out}/bin/tesseract --set-default TESSDATA_PREFIX $out/share/tessdata
diff --git a/pkgs/applications/graphics/unigine-valley/default.nix b/pkgs/applications/graphics/unigine-valley/default.nix
index 0c5c8f3ff28..3187f573de7 100644
--- a/pkgs/applications/graphics/unigine-valley/default.nix
+++ b/pkgs/applications/graphics/unigine-valley/default.nix
@@ -38,7 +38,7 @@ in
     sourceRoot = "Unigine_Valley-${version}";
     instPath = "lib/unigine/valley";
 
-    buildInputs = [file makeWrapper];
+    nativeBuildInputs = [file makeWrapper];
 
     libPath = lib.makeLibraryPath [
       stdenv.cc.cc  # libstdc++.so.6
diff --git a/pkgs/applications/kde/akonadi-contacts.nix b/pkgs/applications/kde/akonadi-contacts.nix
index 2076723a372..ad94c79e0f3 100644
--- a/pkgs/applications/kde/akonadi-contacts.nix
+++ b/pkgs/applications/kde/akonadi-contacts.nix
@@ -2,9 +2,9 @@
   mkDerivation, lib, kdepimTeam,
   extra-cmake-modules,
   qtwebengine,
-  grantlee,
+  grantlee, grantleetheme,
   kdbusaddons, ki18n, kiconthemes, kio, kitemmodels, ktextwidgets, prison,
-  akonadi, akonadi-mime, kcontacts, kmime,
+  akonadi, akonadi-mime, kcontacts, kmime, libkleo,
 }:
 
 mkDerivation {
@@ -16,9 +16,9 @@ mkDerivation {
   nativeBuildInputs = [ extra-cmake-modules ];
   buildInputs = [
     qtwebengine
-    grantlee
+    grantlee grantleetheme
     kdbusaddons ki18n kiconthemes kio kitemmodels ktextwidgets prison
-    akonadi-mime kcontacts kmime
+    akonadi-mime kcontacts kmime libkleo
   ];
   propagatedBuildInputs = [ akonadi ];
   outputs = [ "out" "dev" ];
diff --git a/pkgs/applications/kde/akonadi/0001-akonadi-paths.patch b/pkgs/applications/kde/akonadi/0001-akonadi-paths.patch
index 58390cba226..3e5ccc9cdaa 100644
--- a/pkgs/applications/kde/akonadi/0001-akonadi-paths.patch
+++ b/pkgs/applications/kde/akonadi/0001-akonadi-paths.patch
@@ -1,6 +1,6 @@
-From 90969b9b36400d47b1afe761fb8468c1acb8a04a Mon Sep 17 00:00:00 2001
+From f4d718502ecd8242500078a7783e27caba72871e Mon Sep 17 00:00:00 2001
 From: Thomas Tuegel <ttuegel@mailbox.org>
-Date: Mon, 13 Jul 2020 11:41:19 -0500
+Date: Sun, 31 Jan 2021 11:00:03 -0600
 Subject: [PATCH 1/3] akonadi paths
 
 ---
@@ -11,10 +11,10 @@ Subject: [PATCH 1/3] akonadi paths
  4 files changed, 11 insertions(+), 40 deletions(-)
 
 diff --git a/src/akonadicontrol/agentmanager.cpp b/src/akonadicontrol/agentmanager.cpp
-index 23b4a1f..c13b658 100644
+index 31e0cf2..6436e87 100644
 --- a/src/akonadicontrol/agentmanager.cpp
 +++ b/src/akonadicontrol/agentmanager.cpp
-@@ -61,7 +61,7 @@ public:
+@@ -48,7 +48,7 @@ public:
                  []() {
                      QCoreApplication::instance()->exit(255);
                  });
@@ -23,7 +23,7 @@ index 23b4a1f..c13b658 100644
      }
  
      ~StorageProcessControl() override
-@@ -84,7 +84,7 @@ public:
+@@ -70,7 +70,7 @@ public:
                  []() {
                      qCCritical(AKONADICONTROL_LOG) << "Failed to start AgentServer!";
                  });
@@ -33,10 +33,10 @@ index 23b4a1f..c13b658 100644
  
      ~AgentServerProcessControl() override
 diff --git a/src/akonadicontrol/agentprocessinstance.cpp b/src/akonadicontrol/agentprocessinstance.cpp
-index 4e58f7e..e8bb532 100644
+index c98946c..aa307ca 100644
 --- a/src/akonadicontrol/agentprocessinstance.cpp
 +++ b/src/akonadicontrol/agentprocessinstance.cpp
-@@ -62,7 +62,7 @@ bool AgentProcessInstance::start(const AgentType &agentInfo)
+@@ -49,7 +49,7 @@ bool AgentProcessInstance::start(const AgentType &agentInfo)
      } else {
          Q_ASSERT(agentInfo.launchMethod == AgentType::Launcher);
          const QStringList arguments = QStringList() << executable << identifier();
@@ -46,10 +46,10 @@ index 4e58f7e..e8bb532 100644
      }
      return true;
 diff --git a/src/server/storage/dbconfigmysql.cpp b/src/server/storage/dbconfigmysql.cpp
-index cac40f5..527649b 100644
+index d595a3a..99324f6 100644
 --- a/src/server/storage/dbconfigmysql.cpp
 +++ b/src/server/storage/dbconfigmysql.cpp
-@@ -83,7 +83,6 @@ bool DbConfigMysql::init(QSettings &settings)
+@@ -69,7 +69,6 @@ bool DbConfigMysql::init(QSettings &settings, bool storeSettings)
      // determine default settings depending on the driver
      QString defaultHostName;
      QString defaultOptions;
@@ -57,7 +57,7 @@ index cac40f5..527649b 100644
      QString defaultCleanShutdownCommand;
  
  #ifndef Q_OS_WIN
-@@ -92,16 +91,7 @@ bool DbConfigMysql::init(QSettings &settings)
+@@ -78,16 +77,7 @@ bool DbConfigMysql::init(QSettings &settings, bool storeSettings)
  #endif
  
      const bool defaultInternalServer = true;
@@ -75,7 +75,7 @@ index cac40f5..527649b 100644
      if (!mysqladminPath.isEmpty()) {
  #ifndef Q_OS_WIN
          defaultCleanShutdownCommand = QStringLiteral("%1 --defaults-file=%2/mysql.conf --socket=%3/%4 shutdown")
-@@ -111,10 +101,10 @@ bool DbConfigMysql::init(QSettings &settings)
+@@ -97,10 +87,10 @@ bool DbConfigMysql::init(QSettings &settings, bool storeSettings)
  #endif
      }
  
@@ -88,7 +88,7 @@ index cac40f5..527649b 100644
      qCDebug(AKONADISERVER_LOG) << "Found mysqlcheck: " << mMysqlCheckPath;
  
      mInternalServer = settings.value(QStringLiteral("QMYSQL/StartServer"), defaultInternalServer).toBool();
-@@ -131,7 +121,7 @@ bool DbConfigMysql::init(QSettings &settings)
+@@ -117,7 +107,7 @@ bool DbConfigMysql::init(QSettings &settings, bool storeSettings)
      mUserName = settings.value(QStringLiteral("User")).toString();
      mPassword = settings.value(QStringLiteral("Password")).toString();
      mConnectionOptions = settings.value(QStringLiteral("Options"), defaultOptions).toString();
@@ -97,7 +97,7 @@ index cac40f5..527649b 100644
      mCleanServerShutdownCommand = settings.value(QStringLiteral("CleanServerShutdownCommand"), defaultCleanShutdownCommand).toString();
      settings.endGroup();
  
-@@ -141,9 +131,6 @@ bool DbConfigMysql::init(QSettings &settings)
+@@ -127,9 +117,6 @@ bool DbConfigMysql::init(QSettings &settings, bool storeSettings)
          // intentionally not namespaced as we are the only one in this db instance when using internal mode
          mDatabaseName = QStringLiteral("akonadi");
      }
@@ -107,17 +107,17 @@ index cac40f5..527649b 100644
  
      qCDebug(AKONADISERVER_LOG) << "Using mysqld:" << mMysqldPath;
  
-@@ -152,9 +139,6 @@ bool DbConfigMysql::init(QSettings &settings)
-     settings.setValue(QStringLiteral("Name"), mDatabaseName);
-     settings.setValue(QStringLiteral("Host"), mHostName);
-     settings.setValue(QStringLiteral("Options"), mConnectionOptions);
--    if (!mMysqldPath.isEmpty()) {
--        settings.setValue(QStringLiteral("ServerPath"), mMysqldPath);
--    }
-     settings.setValue(QStringLiteral("StartServer"), mInternalServer);
-     settings.endGroup();
-     settings.sync();
-@@ -209,7 +193,7 @@ bool DbConfigMysql::startInternalServer()
+@@ -139,9 +126,6 @@ bool DbConfigMysql::init(QSettings &settings, bool storeSettings)
+         settings.setValue(QStringLiteral("Name"), mDatabaseName);
+         settings.setValue(QStringLiteral("Host"), mHostName);
+         settings.setValue(QStringLiteral("Options"), mConnectionOptions);
+-        if (!mMysqldPath.isEmpty()) {
+-            settings.setValue(QStringLiteral("ServerPath"), mMysqldPath);
+-        }
+         settings.setValue(QStringLiteral("StartServer"), mInternalServer);
+         settings.endGroup();
+         settings.sync();
+@@ -214,7 +198,7 @@ bool DbConfigMysql::startInternalServer()
  #endif
  
      // generate config file
@@ -127,10 +127,10 @@ index cac40f5..527649b 100644
      const QString actualConfig = StandardDirs::saveDir("data") + QLatin1String("/mysql.conf");
      if (globalConfig.isEmpty()) {
 diff --git a/src/server/storage/dbconfigpostgresql.cpp b/src/server/storage/dbconfigpostgresql.cpp
-index 09cdbd5..1c8996b 100644
+index dd273fc..05288d9 100644
 --- a/src/server/storage/dbconfigpostgresql.cpp
 +++ b/src/server/storage/dbconfigpostgresql.cpp
-@@ -141,9 +141,7 @@ bool DbConfigPostgresql::init(QSettings &settings)
+@@ -127,9 +127,7 @@ bool DbConfigPostgresql::init(QSettings &settings, bool storeSettings)
      // determine default settings depending on the driver
      QString defaultHostName;
      QString defaultOptions;
@@ -140,7 +140,7 @@ index 09cdbd5..1c8996b 100644
      QString defaultPgData;
  
  #ifndef Q_WS_WIN // We assume that PostgreSQL is running as service on Windows
-@@ -154,12 +152,8 @@ bool DbConfigPostgresql::init(QSettings &settings)
+@@ -140,12 +138,8 @@ bool DbConfigPostgresql::init(QSettings &settings, bool storeSettings)
  
      mInternalServer = settings.value(QStringLiteral("QPSQL/StartServer"), defaultInternalServer).toBool();
      if (mInternalServer) {
@@ -154,7 +154,7 @@ index 09cdbd5..1c8996b 100644
          defaultPgData = StandardDirs::saveDir("data", QStringLiteral("db_data"));
      }
  
-@@ -178,20 +172,14 @@ bool DbConfigPostgresql::init(QSettings &settings)
+@@ -164,20 +158,14 @@ bool DbConfigPostgresql::init(QSettings &settings, bool storeSettings)
      mUserName = settings.value(QStringLiteral("User")).toString();
      mPassword = settings.value(QStringLiteral("Password")).toString();
      mConnectionOptions = settings.value(QStringLiteral("Options"), defaultOptions).toString();
@@ -177,14 +177,14 @@ index 09cdbd5..1c8996b 100644
      qCDebug(AKONADISERVER_LOG) << "Found pg_upgrade:" << mPgUpgradePath;
      mPgData = settings.value(QStringLiteral("PgData"), defaultPgData).toString();
      if (mPgData.isEmpty()) {
-@@ -207,7 +195,6 @@ bool DbConfigPostgresql::init(QSettings &settings)
-         settings.setValue(QStringLiteral("Port"), mHostPort);
-     }
-     settings.setValue(QStringLiteral("Options"), mConnectionOptions);
--    settings.setValue(QStringLiteral("ServerPath"), mServerPath);
-     settings.setValue(QStringLiteral("InitDbPath"), mInitDbPath);
-     settings.setValue(QStringLiteral("StartServer"), mInternalServer);
-     settings.endGroup();
+@@ -194,7 +182,6 @@ bool DbConfigPostgresql::init(QSettings &settings, bool storeSettings)
+             settings.setValue(QStringLiteral("Port"), mHostPort);
+         }
+         settings.setValue(QStringLiteral("Options"), mConnectionOptions);
+-        settings.setValue(QStringLiteral("ServerPath"), mServerPath);
+         settings.setValue(QStringLiteral("InitDbPath"), mInitDbPath);
+         settings.setValue(QStringLiteral("StartServer"), mInternalServer);
+         settings.endGroup();
 -- 
-2.25.4
+2.29.2
 
diff --git a/pkgs/applications/kde/akonadi/0002-akonadi-timestamps.patch b/pkgs/applications/kde/akonadi/0002-akonadi-timestamps.patch
index ac9b3146e17..24f59f67916 100644
--- a/pkgs/applications/kde/akonadi/0002-akonadi-timestamps.patch
+++ b/pkgs/applications/kde/akonadi/0002-akonadi-timestamps.patch
@@ -1,6 +1,6 @@
-From b8c6a2a017321649db8fec553a644b8da2300514 Mon Sep 17 00:00:00 2001
+From badd4be311afd37a99126c60490f1ae5daced6c4 Mon Sep 17 00:00:00 2001
 From: Thomas Tuegel <ttuegel@mailbox.org>
-Date: Mon, 13 Jul 2020 11:41:35 -0500
+Date: Sun, 31 Jan 2021 11:00:15 -0600
 Subject: [PATCH 2/3] akonadi timestamps
 
 ---
@@ -8,10 +8,10 @@ Subject: [PATCH 2/3] akonadi timestamps
  1 file changed, 1 insertion(+), 2 deletions(-)
 
 diff --git a/src/server/storage/dbconfigmysql.cpp b/src/server/storage/dbconfigmysql.cpp
-index 527649b..08c3dd4 100644
+index 99324f6..3c170a8 100644
 --- a/src/server/storage/dbconfigmysql.cpp
 +++ b/src/server/storage/dbconfigmysql.cpp
-@@ -235,8 +235,7 @@ bool DbConfigMysql::startInternalServer()
+@@ -240,8 +240,7 @@ bool DbConfigMysql::startInternalServer()
      bool confUpdate = false;
      QFile actualFile(actualConfig);
      // update conf only if either global (or local) is newer than actual
@@ -22,5 +22,5 @@ index 527649b..08c3dd4 100644
          QFile localFile(localConfig);
          if (globalFile.open(QFile::ReadOnly) && actualFile.open(QFile::WriteOnly)) {
 -- 
-2.25.4
+2.29.2
 
diff --git a/pkgs/applications/kde/akonadi/0003-akonadi-revert-make-relocatable.patch b/pkgs/applications/kde/akonadi/0003-akonadi-revert-make-relocatable.patch
index 1a0bc000c80..3aa61da73e4 100644
--- a/pkgs/applications/kde/akonadi/0003-akonadi-revert-make-relocatable.patch
+++ b/pkgs/applications/kde/akonadi/0003-akonadi-revert-make-relocatable.patch
@@ -1,6 +1,6 @@
-From 7afe018382cf68b477b35f87b666424d62d19ef4 Mon Sep 17 00:00:00 2001
+From 82bfa975af60757374ffad787e56a981d6df0f98 Mon Sep 17 00:00:00 2001
 From: Thomas Tuegel <ttuegel@mailbox.org>
-Date: Mon, 13 Jul 2020 11:41:55 -0500
+Date: Sun, 31 Jan 2021 11:01:24 -0600
 Subject: [PATCH 3/3] akonadi revert make relocatable
 
 ---
@@ -9,10 +9,10 @@ Subject: [PATCH 3/3] akonadi revert make relocatable
  2 files changed, 3 insertions(+), 6 deletions(-)
 
 diff --git a/CMakeLists.txt b/CMakeLists.txt
-index d927471..83a74c0 100644
+index 4bb5fec..35720b4 100644
 --- a/CMakeLists.txt
 +++ b/CMakeLists.txt
-@@ -330,9 +330,6 @@ configure_package_config_file(
+@@ -343,9 +343,6 @@ configure_package_config_file(
      "${CMAKE_CURRENT_SOURCE_DIR}/KF5AkonadiConfig.cmake.in"
      "${CMAKE_CURRENT_BINARY_DIR}/KF5AkonadiConfig.cmake"
      INSTALL_DESTINATION ${CMAKECONFIG_INSTALL_DIR}
@@ -23,29 +23,23 @@ index d927471..83a74c0 100644
  
  install(FILES
 diff --git a/KF5AkonadiConfig.cmake.in b/KF5AkonadiConfig.cmake.in
-index 421e1df..e3abf27 100644
+index bcf7320..1574319 100644
 --- a/KF5AkonadiConfig.cmake.in
 +++ b/KF5AkonadiConfig.cmake.in
-@@ -24,8 +24,8 @@ if(BUILD_TESTING)
-     find_dependency(Qt5Test "@QT_REQUIRED_VERSION@")
- endif()
+@@ -1,10 +1,10 @@
+ @PACKAGE_INIT@
  
 -set_and_check(AKONADI_DBUS_INTERFACES_DIR  "@PACKAGE_AKONADI_DBUS_INTERFACES_INSTALL_DIR@")
 -set_and_check(AKONADI_INCLUDE_DIR          "@PACKAGE_AKONADI_INCLUDE_DIR@")
 +set_and_check(AKONADI_DBUS_INTERFACES_DIR  "@AKONADI_DBUS_INTERFACES_INSTALL_DIR@")
 +set_and_check(AKONADI_INCLUDE_DIR          "@AKONADI_INCLUDE_DIR@")
  
- find_dependency(Boost "@Boost_MINIMUM_VERSION@")
- 
-@@ -33,7 +33,7 @@ include(${CMAKE_CURRENT_LIST_DIR}/KF5AkonadiTargets.cmake)
- include(${CMAKE_CURRENT_LIST_DIR}/KF5AkonadiMacros.cmake)
- 
  # The directory where akonadi-xml.xsd and kcfg2dbus.xsl are installed
 -set(KF5Akonadi_DATA_DIR "@PACKAGE_KF5Akonadi_DATA_DIR@")
 +set(KF5Akonadi_DATA_DIR "@KF5Akonadi_DATA_DIR@")
  
- ####################################################################################
- # CMAKE_AUTOMOC
+ # set the directories
+ if(NOT AKONADI_INSTALL_DIR)
 -- 
-2.25.4
+2.29.2
 
diff --git a/pkgs/applications/kde/akonadi/default.nix b/pkgs/applications/kde/akonadi/default.nix
index d24e19f89e7..e0b0e2324b1 100644
--- a/pkgs/applications/kde/akonadi/default.nix
+++ b/pkgs/applications/kde/akonadi/default.nix
@@ -3,7 +3,7 @@
   extra-cmake-modules, shared-mime-info, qtbase, accounts-qt,
   boost, kaccounts-integration, kcompletion, kconfigwidgets, kcrash, kdbusaddons,
   kdesignerplugin, ki18n, kiconthemes, kio, kitemmodels, kwindowsystem, mysql, qttools,
-  signond,
+  signond, lzma,
 }:
 
 mkDerivation {
@@ -21,7 +21,7 @@ mkDerivation {
   nativeBuildInputs = [ extra-cmake-modules shared-mime-info ];
   buildInputs = [
     kaccounts-integration kcompletion kconfigwidgets kcrash kdbusaddons kdesignerplugin
-    ki18n kiconthemes kio kwindowsystem accounts-qt qttools signond
+    ki18n kiconthemes kio kwindowsystem lzma accounts-qt qttools signond
   ];
   propagatedBuildInputs = [ boost kitemmodels ];
   outputs = [ "out" "dev" ];
diff --git a/pkgs/applications/kde/calendarsupport.nix b/pkgs/applications/kde/calendarsupport.nix
index b316ab4e568..c7ef5c4615c 100644
--- a/pkgs/applications/kde/calendarsupport.nix
+++ b/pkgs/applications/kde/calendarsupport.nix
@@ -1,7 +1,7 @@
 {
   mkDerivation, lib, kdepimTeam, fetchpatch,
   extra-cmake-modules, kdoctools,
-  akonadi, akonadi-calendar, akonadi-mime, akonadi-notes, kcalutils, kdepim-apps-libs,
+  akonadi, akonadi-calendar, akonadi-mime, akonadi-notes, kcalutils,
   kholidays, kidentitymanagement, kmime, pimcommon, qttools,
 }:
 
@@ -11,16 +11,9 @@ mkDerivation {
     license = with lib.licenses; [ gpl2 lgpl21 fdl12 ];
     maintainers = kdepimTeam;
   };
-  patches = [
-    # Patch for Qt 5.15.2 until version 20.12.0
-    (fetchpatch {
-      url = "https://invent.kde.org/pim/calendarsupport/-/commit/b4193facb223bd5b73a65318dec8ced51b66adf7.patch";
-      sha256 = "sha256:1da11rqbxxrl06ld3avc41p064arz4n6w5nxq8r008v8ws3s64dy";
-    })
-  ];
   nativeBuildInputs = [ extra-cmake-modules kdoctools ];
   buildInputs = [
-    akonadi akonadi-mime akonadi-notes kcalutils kdepim-apps-libs kholidays pimcommon qttools
+    akonadi akonadi-mime akonadi-notes kcalutils kholidays pimcommon qttools
   ];
   propagatedBuildInputs = [ akonadi-calendar kidentitymanagement kmime ];
   outputs = [ "out" "dev" ];
diff --git a/pkgs/applications/kde/default.nix b/pkgs/applications/kde/default.nix
index 33f392fdccc..b312a566a70 100644
--- a/pkgs/applications/kde/default.nix
+++ b/pkgs/applications/kde/default.nix
@@ -109,10 +109,9 @@ let
       kdegraphics-mobipocket = callPackage ./kdegraphics-mobipocket.nix {};
       kdegraphics-thumbnailers = callPackage ./kdegraphics-thumbnailers.nix {};
       kdenetwork-filesharing = callPackage ./kdenetwork-filesharing.nix {};
-      kdenlive = callPackage ./kdenlive.nix {};
+      kdenlive = callPackage ./kdenlive {};
       kdepim-runtime = callPackage ./kdepim-runtime {};
       kdepim-addons = callPackage ./kdepim-addons.nix {};
-      kdepim-apps-libs = callPackage ./kdepim-apps-libs {};
       kdf = callPackage ./kdf.nix {};
       kdialog = callPackage ./kdialog.nix {};
       kdiamond = callPackage ./kdiamond.nix {};
diff --git a/pkgs/applications/kde/dolphin.nix b/pkgs/applications/kde/dolphin.nix
index 3774c7e00b6..a558ad26677 100644
--- a/pkgs/applications/kde/dolphin.nix
+++ b/pkgs/applications/kde/dolphin.nix
@@ -5,7 +5,7 @@
   kcompletion, kconfig, kcoreaddons, kdelibs4support, kdbusaddons,
   kfilemetadata, ki18n, kiconthemes, kinit, kio, knewstuff, knotifications,
   kparts, ktexteditor, kwindowsystem, phonon, solid,
-  wayland, qtwayland
+  wayland, qtbase, qtwayland
 }:
 
 mkDerivation {
@@ -13,6 +13,7 @@ mkDerivation {
   meta = {
     license = with lib.licenses; [ gpl2 fdl12 ];
     maintainers = [ lib.maintainers.ttuegel ];
+    broken = lib.versionOlder qtbase.version "5.14";
   };
   nativeBuildInputs = [ extra-cmake-modules kdoctools ];
   propagatedUserEnvPkgs = [ baloo ];
diff --git a/pkgs/applications/kde/fetch.sh b/pkgs/applications/kde/fetch.sh
index e3bba77f972..d659c551bd6 100644
--- a/pkgs/applications/kde/fetch.sh
+++ b/pkgs/applications/kde/fetch.sh
@@ -1 +1 @@
-WGET_ARGS=( http://download.kde.org/stable/release-service/20.08.3/src -A '*.tar.xz' )
+WGET_ARGS=( http://download.kde.org/stable/release-service/20.12.1/src -A '*.tar.xz' )
diff --git a/pkgs/applications/kde/ffmpegthumbs.nix b/pkgs/applications/kde/ffmpegthumbs.nix
index 2a8b82352b4..f19ee160984 100644
--- a/pkgs/applications/kde/ffmpegthumbs.nix
+++ b/pkgs/applications/kde/ffmpegthumbs.nix
@@ -1,7 +1,7 @@
 {
   mkDerivation, lib,
   extra-cmake-modules,
-  ffmpeg_3, kio
+  ffmpeg_3, kio, taglib
 }:
 
 mkDerivation {
@@ -11,5 +11,5 @@ mkDerivation {
     maintainers = [ lib.maintainers.ttuegel ];
   };
   nativeBuildInputs = [ extra-cmake-modules ];
-  buildInputs = [ ffmpeg_3 kio ];
+  buildInputs = [ ffmpeg_3 kio taglib ];
 }
diff --git a/pkgs/applications/kde/filelight.nix b/pkgs/applications/kde/filelight.nix
index 1aeff531862..95a89b01b8c 100644
--- a/pkgs/applications/kde/filelight.nix
+++ b/pkgs/applications/kde/filelight.nix
@@ -1,7 +1,7 @@
 {
   mkDerivation, lib,
   extra-cmake-modules, kdoctools,
-  kio, kparts, kxmlgui, qtscript, solid
+  kio, kparts, kxmlgui, qtbase, qtscript, solid
 }:
 
 mkDerivation {
@@ -9,6 +9,7 @@ mkDerivation {
   meta = {
     license = with lib.licenses; [ gpl2 ];
     maintainers = with lib.maintainers; [ fridh vcunat ];
+    broken = lib.versionOlder qtbase.version "5.13";
   };
   nativeBuildInputs = [ extra-cmake-modules kdoctools ];
   propagatedBuildInputs = [
diff --git a/pkgs/applications/kde/incidenceeditor.nix b/pkgs/applications/kde/incidenceeditor.nix
index 981c184d151..7f2c284ad74 100644
--- a/pkgs/applications/kde/incidenceeditor.nix
+++ b/pkgs/applications/kde/incidenceeditor.nix
@@ -1,7 +1,7 @@
 {
   mkDerivation, lib, kdepimTeam,
   extra-cmake-modules, kdoctools,
-  akonadi, akonadi-mime, calendarsupport, eventviews, kdepim-apps-libs,
+  akonadi, akonadi-mime, calendarsupport, eventviews,
   kdiagram, kldap, kmime, pimcommon, qtbase
 }:
 
@@ -13,7 +13,7 @@ mkDerivation {
   };
   nativeBuildInputs = [ extra-cmake-modules kdoctools ];
   buildInputs = [
-    akonadi akonadi-mime calendarsupport eventviews kdepim-apps-libs kdiagram
+    akonadi akonadi-mime calendarsupport eventviews kdiagram
     kldap kmime pimcommon qtbase
   ];
   outputs = [ "out" "dev" ];
diff --git a/pkgs/applications/kde/kaddressbook.nix b/pkgs/applications/kde/kaddressbook.nix
index 452c5142157..2672d815fb0 100644
--- a/pkgs/applications/kde/kaddressbook.nix
+++ b/pkgs/applications/kde/kaddressbook.nix
@@ -2,7 +2,7 @@
   mkDerivation, lib, kdepimTeam, fetchpatch,
   extra-cmake-modules, kdoctools,
   akonadi, akonadi-search, grantlee, grantleetheme, kcmutils, kcompletion,
-  kcrash, kdbusaddons, kdepim-apps-libs, ki18n, kontactinterface, kparts,
+  kcrash, kdbusaddons, ki18n, kontactinterface, kparts,
   kpimtextedit, kxmlgui, libkdepim, libkleo, mailcommon, pimcommon, prison,
   qgpgme, qtbase,
 }:
@@ -13,17 +13,10 @@ mkDerivation {
     license = with lib.licenses; [ gpl2 lgpl21 fdl12 ];
     maintainers = kdepimTeam;
   };
-  patches = [
-    # Patch for Qt 5.15.2 until version 20.12.0
-    (fetchpatch {
-      url = "https://invent.kde.org/pim/kaddressbook/-/commit/8aee8d40ae2a1c920d3520163d550d3b49720226.patch";
-      sha256 = "sha256:0dsy119cd5w9khiwgk6fb7xnjzmj94rfphf327k331lf15zq4853";
-    })
-  ];
   nativeBuildInputs = [ extra-cmake-modules kdoctools ];
   buildInputs = [
     akonadi akonadi-search grantlee grantleetheme kcmutils kcompletion kcrash
-    kdbusaddons kdepim-apps-libs ki18n kontactinterface kparts kpimtextedit
+    kdbusaddons ki18n kontactinterface kparts kpimtextedit
     kxmlgui libkdepim libkleo mailcommon pimcommon prison qgpgme qtbase
   ];
 }
diff --git a/pkgs/applications/kde/kalarm.nix b/pkgs/applications/kde/kalarm.nix
index 70ee3f74185..8709f26bd12 100644
--- a/pkgs/applications/kde/kalarm.nix
+++ b/pkgs/applications/kde/kalarm.nix
@@ -3,12 +3,13 @@
   extra-cmake-modules,
 
   kauth, kcodecs, kcompletion, kconfig, kconfigwidgets, kdbusaddons, kdoctools,
-  kguiaddons, ki18n, kiconthemes, kjobwidgets, kcmutils, kdelibs4support, kio,
-  knotifications, kservice, kwidgetsaddons, kwindowsystem, kxmlgui, phonon,
+  kguiaddons, ki18n, kiconthemes, kidletime, kjobwidgets, kcmutils,
+  kdelibs4support, kio, knotifications, knotifyconfig, kservice, kwidgetsaddons,
+  kwindowsystem, kxmlgui, phonon,
 
   kimap, akonadi, akonadi-contacts, akonadi-mime, kalarmcal, kcalendarcore, kcalutils,
   kholidays, kidentitymanagement, libkdepim, mailcommon, kmailtransport, kmime,
-  pimcommon, kpimtextedit, kdepim-apps-libs, messagelib,
+  pimcommon, kpimtextedit, messagelib,
 
   qtx11extras,
 
@@ -24,12 +25,13 @@ mkDerivation {
   nativeBuildInputs = [ extra-cmake-modules kdoctools ];
   buildInputs = [
     kauth kcodecs kcompletion kconfig kconfigwidgets kdbusaddons kdoctools
-    kguiaddons ki18n kiconthemes kjobwidgets kcmutils kdelibs4support kio
-    knotifications kservice kwidgetsaddons kwindowsystem kxmlgui phonon
+    kguiaddons ki18n kiconthemes kidletime kjobwidgets kcmutils kdelibs4support
+    kio knotifications knotifyconfig kservice kwidgetsaddons kwindowsystem
+    kxmlgui phonon
 
-    kimap akonadi akonadi-contacts akonadi-mime kalarmcal kcalendarcore kcalutils
-    kholidays kidentitymanagement libkdepim mailcommon kmailtransport kmime
-    pimcommon kpimtextedit kdepim-apps-libs messagelib
+    kimap akonadi akonadi-contacts akonadi-mime kalarmcal kcalendarcore
+    kcalutils kholidays kidentitymanagement libkdepim mailcommon kmailtransport
+    kmime pimcommon kpimtextedit messagelib
 
     qtx11extras
   ];
diff --git a/pkgs/applications/kde/kdebugsettings.nix b/pkgs/applications/kde/kdebugsettings.nix
index f4dd7ec145d..0287830485e 100644
--- a/pkgs/applications/kde/kdebugsettings.nix
+++ b/pkgs/applications/kde/kdebugsettings.nix
@@ -3,7 +3,7 @@
   extra-cmake-modules, kdoctools,
   gettext,
   kcoreaddons, kconfig, kdbusaddons, kwidgetsaddons, kitemviews, kcompletion,
-  python
+  qtbase, python
 }:
 
 mkDerivation {
@@ -11,6 +11,7 @@ mkDerivation {
   meta = {
     license = with lib.licenses; [ gpl2 ];
     maintainers = [ lib.maintainers.rittelle ];
+    broken = lib.versionOlder qtbase.version "5.13";
   };
   nativeBuildInputs = [ extra-cmake-modules kdoctools ];
   buildInputs = [
diff --git a/pkgs/applications/kde/kdenetwork-filesharing.nix b/pkgs/applications/kde/kdenetwork-filesharing.nix
index 94656b02671..a7da03ffdd1 100644
--- a/pkgs/applications/kde/kdenetwork-filesharing.nix
+++ b/pkgs/applications/kde/kdenetwork-filesharing.nix
@@ -1,7 +1,7 @@
 {
   mkDerivation, lib,
   extra-cmake-modules, kdoctools,
-  kcoreaddons, ki18n, kio, kwidgetsaddons, samba
+  kcoreaddons, kdeclarative, ki18n, kio, kwidgetsaddons, samba, qtbase,
 }:
 
 mkDerivation {
@@ -9,7 +9,8 @@ mkDerivation {
   meta = {
     license = [ lib.licenses.gpl2 lib.licenses.lgpl21 ];
     maintainers = [ lib.maintainers.ttuegel ];
+    broken = lib.versionOlder qtbase.version "5.13";
   };
   nativeBuildInputs = [ extra-cmake-modules kdoctools ];
-  buildInputs = [ kcoreaddons ki18n kio kwidgetsaddons samba ];
+  buildInputs = [ kcoreaddons kdeclarative ki18n kio kwidgetsaddons samba ];
 }
diff --git a/pkgs/applications/kde/kdenlive.nix b/pkgs/applications/kde/kdenlive/default.nix
similarity index 100%
rename from pkgs/applications/kde/kdenlive.nix
rename to pkgs/applications/kde/kdenlive/default.nix
diff --git a/pkgs/applications/kde/ffmpeg-path.patch b/pkgs/applications/kde/kdenlive/ffmpeg-path.patch
similarity index 100%
rename from pkgs/applications/kde/ffmpeg-path.patch
rename to pkgs/applications/kde/kdenlive/ffmpeg-path.patch
diff --git a/pkgs/applications/kde/mlt-path.patch b/pkgs/applications/kde/kdenlive/mlt-path.patch
similarity index 100%
rename from pkgs/applications/kde/mlt-path.patch
rename to pkgs/applications/kde/kdenlive/mlt-path.patch
diff --git a/pkgs/applications/kde/kdepim-addons.nix b/pkgs/applications/kde/kdepim-addons.nix
index 0939b0ecd26..42532644a1a 100644
--- a/pkgs/applications/kde/kdepim-addons.nix
+++ b/pkgs/applications/kde/kdepim-addons.nix
@@ -3,7 +3,7 @@
   extra-cmake-modules, shared-mime-info,
   akonadi-import-wizard, akonadi-notes, calendarsupport, eventviews,
   incidenceeditor, kcalendarcore, kcalutils, kconfig, kdbusaddons, kdeclarative,
-  kdepim-apps-libs, kholidays, ki18n, kmime, ktexteditor, ktnef, libgravatar,
+  kholidays, ki18n, kmime, ktexteditor, ktnef, libgravatar,
   libksieve, mailcommon, mailimporter, messagelib, poppler, prison, kpkpass,
   kitinerary, kontactinterface
 }:
@@ -18,7 +18,7 @@ mkDerivation {
   buildInputs = [
     akonadi-import-wizard akonadi-notes calendarsupport eventviews
     incidenceeditor kcalendarcore kcalutils kconfig kdbusaddons kdeclarative
-    kdepim-apps-libs kholidays ki18n kmime ktexteditor ktnef libgravatar
+    kholidays ki18n kmime ktexteditor ktnef libgravatar
     libksieve mailcommon mailimporter messagelib poppler prison kpkpass
     kitinerary kontactinterface
   ];
diff --git a/pkgs/applications/kde/kdepim-apps-libs/default.nix b/pkgs/applications/kde/kdepim-apps-libs/default.nix
deleted file mode 100644
index 19f476fd781..00000000000
--- a/pkgs/applications/kde/kdepim-apps-libs/default.nix
+++ /dev/null
@@ -1,20 +0,0 @@
-{
-  mkDerivation, lib, kdepimTeam,
-  extra-cmake-modules, kdoctools,
-  akonadi, akonadi-contacts, grantlee, grantleetheme, kconfig, kconfigwidgets,
-  kcontacts, ki18n, kiconthemes, kio, libkleo, pimcommon, prison,
-}:
-
-mkDerivation {
-  pname = "kdepim-apps-libs";
-  meta = {
-    license = with lib.licenses; [ gpl2 lgpl21 fdl12 ];
-    maintainers = kdepimTeam;
-  };
-  nativeBuildInputs = [ extra-cmake-modules kdoctools ];
-  buildInputs = [
-    akonadi akonadi-contacts grantlee grantleetheme kconfig kconfigwidgets
-    kcontacts ki18n kiconthemes kio libkleo pimcommon prison
-  ];
-  outputs = [ "out" "dev" ];
-}
diff --git a/pkgs/applications/kde/kmail.nix b/pkgs/applications/kde/kmail.nix
index fa3fe033035..e742f566678 100644
--- a/pkgs/applications/kde/kmail.nix
+++ b/pkgs/applications/kde/kmail.nix
@@ -2,7 +2,7 @@
   mkDerivation, lib, kdepimTeam,
   extra-cmake-modules, kdoctools,
   akonadi-search, kbookmarks, kcalutils, kcmutils, kcompletion, kconfig,
-  kconfigwidgets, kcoreaddons, kdelibs4support, kdepim-apps-libs, libkdepim,
+  kconfigwidgets, kcoreaddons, kdelibs4support, libkdepim,
   kdepim-runtime, kguiaddons, ki18n, kiconthemes, kinit, kio, kldap,
   kmail-account-wizard, kmailtransport, knotifications, knotifyconfig,
   kontactinterface, kparts, kpty, kservice, ktextwidgets, ktnef, kwallet,
@@ -19,7 +19,7 @@ mkDerivation {
   nativeBuildInputs = [ extra-cmake-modules kdoctools ];
   buildInputs = [
     akonadi-search kbookmarks kcalutils kcmutils kcompletion kconfig
-    kconfigwidgets kcoreaddons kdelibs4support kdepim-apps-libs kguiaddons ki18n
+    kconfigwidgets kcoreaddons kdelibs4support kguiaddons ki18n
     kiconthemes kinit kio kldap kmail-account-wizard kmailtransport libkdepim
     knotifications knotifyconfig kontactinterface kparts kpty kservice
     ktextwidgets ktnef kwidgetsaddons kwindowsystem kxmlgui libgravatar
diff --git a/pkgs/applications/kde/kompare.nix b/pkgs/applications/kde/kompare.nix
index a449a1e4f51..d4d49c6a942 100644
--- a/pkgs/applications/kde/kompare.nix
+++ b/pkgs/applications/kde/kompare.nix
@@ -12,15 +12,5 @@ mkDerivation {
   buildInputs = [
     kiconthemes kparts ktexteditor kwidgetsaddons libkomparediff2
   ];
-
-  patches = [
-    (fetchpatch {
-      # Portaway from Obsolete methods of QPrinter
-      # Part of v20.12.0
-      url = "https://invent.kde.org/sdk/kompare/-/commit/68d3eee36c48a2f44ccfd3f9e5a36311b829104b.patch";
-      sha256 = "B2i5n5cUDjCqTEF0OyTb1+LhPa5yWCnFycwijf35kwU=";
-    })
-  ];
-
   outputs = [ "out" "dev" ];
 }
diff --git a/pkgs/applications/kde/konqueror.nix b/pkgs/applications/kde/konqueror.nix
index 72fcf8ff220..eb188ccef11 100644
--- a/pkgs/applications/kde/konqueror.nix
+++ b/pkgs/applications/kde/konqueror.nix
@@ -2,7 +2,7 @@
 , mkDerivation
 , extra-cmake-modules, kdoctools
 , kdelibs4support, kcmutils, khtml, kdesu
-, qtwebkit, qtwebengine, qtx11extras, qtscript, qtwayland
+, qtbase, qtwebkit, qtwebengine, qtx11extras, qtscript, qtwayland
 }:
 
 mkDerivation {
@@ -24,5 +24,6 @@ mkDerivation {
   meta = {
     license = with lib.licenses; [ gpl2 ];
     maintainers = with lib.maintainers; [ ];
+    broken = lib.versionOlder qtbase.version "5.13";
   };
 }
diff --git a/pkgs/applications/kde/kontact.nix b/pkgs/applications/kde/kontact.nix
index 3dfa28e9dfe..801c6845e40 100644
--- a/pkgs/applications/kde/kontact.nix
+++ b/pkgs/applications/kde/kontact.nix
@@ -3,7 +3,7 @@
   extra-cmake-modules, kdoctools,
   qtwebengine,
   kcmutils, kcrash, kdbusaddons, kparts, kwindowsystem,
-  akonadi, grantleetheme, kdepim-apps-libs, kontactinterface, kpimtextedit,
+  akonadi, grantleetheme, kontactinterface, kpimtextedit,
   mailcommon, libkdepim, pimcommon
 }:
 
@@ -17,7 +17,7 @@ mkDerivation {
   buildInputs = [
     qtwebengine
     kcmutils kcrash kdbusaddons kparts kwindowsystem
-    akonadi grantleetheme kdepim-apps-libs kontactinterface kpimtextedit
+    akonadi grantleetheme kontactinterface kpimtextedit
     mailcommon libkdepim pimcommon
   ];
 }
diff --git a/pkgs/applications/kde/korganizer.nix b/pkgs/applications/kde/korganizer.nix
index f28e0406b13..a6a28427772 100644
--- a/pkgs/applications/kde/korganizer.nix
+++ b/pkgs/applications/kde/korganizer.nix
@@ -5,7 +5,7 @@
   phonon,
   knewstuff,
   akonadi-calendar, akonadi-contacts, akonadi-notes, akonadi-search,
-  calendarsupport, eventviews, incidenceeditor, kcalutils, kdepim-apps-libs,
+  calendarsupport, eventviews, incidenceeditor, kcalutils,
   kholidays, kidentitymanagement, kldap, kmailtransport, kontactinterface,
   kpimtextedit, pimcommon,
 }:
@@ -22,7 +22,7 @@ mkDerivation {
     phonon
     knewstuff
     akonadi-calendar akonadi-contacts akonadi-notes akonadi-search
-    calendarsupport eventviews incidenceeditor kcalutils kdepim-apps-libs
+    calendarsupport eventviews incidenceeditor kcalutils
     kholidays kidentitymanagement kldap kmailtransport kontactinterface
     kpimtextedit pimcommon
   ];
diff --git a/pkgs/applications/kde/kpat.nix b/pkgs/applications/kde/kpat.nix
index d1e47af6b72..96bd6dd542e 100644
--- a/pkgs/applications/kde/kpat.nix
+++ b/pkgs/applications/kde/kpat.nix
@@ -5,6 +5,7 @@
 , shared-mime-info
 , libkdegames
 , freecell-solver
+, black-hole-solver
 }:
 
 mkDerivation {
@@ -14,6 +15,7 @@ mkDerivation {
     shared-mime-info
   ];
   buildInputs = [
+    black-hole-solver
     knewstuff
     libkdegames
     freecell-solver
diff --git a/pkgs/applications/kde/krdc.nix b/pkgs/applications/kde/krdc.nix
index 01cc39d9895..b0e79b0ff89 100644
--- a/pkgs/applications/kde/krdc.nix
+++ b/pkgs/applications/kde/krdc.nix
@@ -2,7 +2,7 @@
   mkDerivation, lib,
   extra-cmake-modules, kdoctools, makeWrapper,
   kcmutils, kcompletion, kconfig, kdnssd, knotifyconfig, kwallet, kwidgetsaddons,
-  kwindowsystem, libvncserver, freerdp
+  kwindowsystem, libvncserver, freerdp, qtbase,
 }:
 
 mkDerivation {
@@ -21,5 +21,6 @@ mkDerivation {
     license = with licenses; [ gpl2 lgpl21 fdl12 bsd3 ];
     maintainers = with maintainers; [ peterhoeg ];
     platforms = platforms.linux;
+    broken = lib.versionOlder qtbase.version "5.14";
   };
 }
diff --git a/pkgs/applications/kde/messagelib.nix b/pkgs/applications/kde/messagelib.nix
index d47a5504417..6709a1f072a 100644
--- a/pkgs/applications/kde/messagelib.nix
+++ b/pkgs/applications/kde/messagelib.nix
@@ -3,7 +3,7 @@
   extra-cmake-modules, kdoctools,
   akonadi, akonadi-mime, akonadi-notes, akonadi-search, gpgme, grantlee,
   grantleetheme, karchive, kcodecs, kconfig, kconfigwidgets, kcontacts,
-  kdepim-apps-libs, kiconthemes, kidentitymanagement, kio, kjobwidgets, kldap,
+  kiconthemes, kidentitymanagement, kio, kjobwidgets, kldap,
   kmailtransport, kmbox, kmime, kwindowsystem, libgravatar, libkdepim, libkleo,
   pimcommon, qca-qt5, qtwebengine, syntax-highlighting
 }:
@@ -17,7 +17,7 @@ mkDerivation {
   nativeBuildInputs = [ extra-cmake-modules kdoctools ];
   buildInputs = [
     akonadi-notes akonadi-search gpgme grantlee grantleetheme karchive kcodecs
-    kconfig kconfigwidgets kdepim-apps-libs kiconthemes kio kjobwidgets kldap
+    kconfig kconfigwidgets kiconthemes kio kjobwidgets kldap
     kmailtransport kmbox kmime kwindowsystem libgravatar libkdepim qca-qt5
     syntax-highlighting
   ];
diff --git a/pkgs/applications/kde/srcs.nix b/pkgs/applications/kde/srcs.nix
index 5ff13eaf240..f78d29db6bc 100644
--- a/pkgs/applications/kde/srcs.nix
+++ b/pkgs/applications/kde/srcs.nix
@@ -4,1731 +4,1795 @@
 
 {
   akonadi = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/akonadi-20.08.3.tar.xz";
-      sha256 = "1hwaan45cyw2nmfmdp5pbhvm00xdxy9la68ms3sa8a67zcsfljhl";
-      name = "akonadi-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/akonadi-20.12.1.tar.xz";
+      sha256 = "1173365c84fq5vn58blsmbdp9x34gf2yrwvsi89i0l7xhpz8zx5k";
+      name = "akonadi-20.12.1.tar.xz";
     };
   };
   akonadi-calendar = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/akonadi-calendar-20.08.3.tar.xz";
-      sha256 = "18rwvn5i6i4ng335rxpwx3a2m4vyq96w9m3fa1gvmr8ls7vkaqrk";
-      name = "akonadi-calendar-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/akonadi-calendar-20.12.1.tar.xz";
+      sha256 = "0zzy4f03zypj4crjy0fhk5xjgipflal3gpfibav2wcmgx034znw5";
+      name = "akonadi-calendar-20.12.1.tar.xz";
     };
   };
   akonadi-calendar-tools = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/akonadi-calendar-tools-20.08.3.tar.xz";
-      sha256 = "1pnm3xi26bnbjmnv9zwi9w5rkr1pdry50hzy3gxw7b0g11zz036w";
-      name = "akonadi-calendar-tools-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/akonadi-calendar-tools-20.12.1.tar.xz";
+      sha256 = "1x5zmv32iaf17n9b8y034yhwq0dhwjwxw3i5cj97k4dpyar5s72q";
+      name = "akonadi-calendar-tools-20.12.1.tar.xz";
     };
   };
   akonadiconsole = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/akonadiconsole-20.08.3.tar.xz";
-      sha256 = "061r0p9pj22x0hiz6piz4vramll3w5xy92sx8nfhcp2gmnvj9890";
-      name = "akonadiconsole-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/akonadiconsole-20.12.1.tar.xz";
+      sha256 = "0rf7ckra0yjkwspmd4401lssiss2p8qrw9rd6j5gbw7kii05bcmz";
+      name = "akonadiconsole-20.12.1.tar.xz";
     };
   };
   akonadi-contacts = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/akonadi-contacts-20.08.3.tar.xz";
-      sha256 = "18n9x41fmh4q9q9lfv882iwk6j1hvgpl11y4qn873vwr9sdrcf4s";
-      name = "akonadi-contacts-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/akonadi-contacts-20.12.1.tar.xz";
+      sha256 = "0gxcs8nn07y6ln5ymsbdhcm63zqxcq2ja2sxziim65bfg9g85arl";
+      name = "akonadi-contacts-20.12.1.tar.xz";
     };
   };
   akonadi-import-wizard = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/akonadi-import-wizard-20.08.3.tar.xz";
-      sha256 = "0gny0rxvyks5w4rdb73ly06lyvz7kcfvff1268bn6i96xr83kmim";
-      name = "akonadi-import-wizard-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/akonadi-import-wizard-20.12.1.tar.xz";
+      sha256 = "1wdhgvv2zblyhcxrvby7ic3449hdmcnn3hvcswgwrgbcy4bzz7zz";
+      name = "akonadi-import-wizard-20.12.1.tar.xz";
     };
   };
   akonadi-mime = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/akonadi-mime-20.08.3.tar.xz";
-      sha256 = "12ps633y64mj72iryd9z2nmrf7lxbkqj7xnzj28549cvg6jizgl7";
-      name = "akonadi-mime-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/akonadi-mime-20.12.1.tar.xz";
+      sha256 = "1xsrc8572zlslabn47km58sr48wdb0pmfrh3jbn9227w9iwir3z5";
+      name = "akonadi-mime-20.12.1.tar.xz";
     };
   };
   akonadi-notes = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/akonadi-notes-20.08.3.tar.xz";
-      sha256 = "1z90r37lqc7ydmily730idd4s8rcbr6i3a8x9m647snbala16z36";
-      name = "akonadi-notes-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/akonadi-notes-20.12.1.tar.xz";
+      sha256 = "15d23wm0kymifcxcbip0hpnzwmzdjwxmcvqvmwgq00vy81j6k7wm";
+      name = "akonadi-notes-20.12.1.tar.xz";
     };
   };
   akonadi-search = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/akonadi-search-20.08.3.tar.xz";
-      sha256 = "0izpkvjybp6r79rai0p5j74bm0f8ksgsl3z34ggb51j6vj9rla7h";
-      name = "akonadi-search-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/akonadi-search-20.12.1.tar.xz";
+      sha256 = "065qp3nf8274fh0bna8hjs28p030wgfnr3gnp7b2791kzp25l488";
+      name = "akonadi-search-20.12.1.tar.xz";
     };
   };
   akregator = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/akregator-20.08.3.tar.xz";
-      sha256 = "1gqh820s5by3r9lz7r16r0krh916idsks6sgy26hcrwfmva45wn5";
-      name = "akregator-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/akregator-20.12.1.tar.xz";
+      sha256 = "0xs5adbq9ra0ziccl1z0nsm6kvrf8vjwa8djd3nwc2csjw8wim5k";
+      name = "akregator-20.12.1.tar.xz";
     };
   };
   analitza = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/analitza-20.08.3.tar.xz";
-      sha256 = "16s6kjyclj73lq8z8mvrbsl75h1nrnv7syp6wpip6gvfs5ynai90";
-      name = "analitza-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/analitza-20.12.1.tar.xz";
+      sha256 = "1qnqqbrjpzndbffjwqlyfqmxxxz04fi3i2g8dx6y8q79z927fzkd";
+      name = "analitza-20.12.1.tar.xz";
     };
   };
   ark = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/ark-20.08.3.tar.xz";
-      sha256 = "03kwjp2nj570k9ph8bgj042sjj4x0h9jwv8nwx0pfpcxkgxv5pzy";
-      name = "ark-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/ark-20.12.1.tar.xz";
+      sha256 = "18zaaawwhlci23hkzjl535qsi8wdjc05hij3r76225jb1jb6cwrm";
+      name = "ark-20.12.1.tar.xz";
     };
   };
   artikulate = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/artikulate-20.08.3.tar.xz";
-      sha256 = "0bx97qi6zi7jmlzm3g7qamnzg0966g4w9xpskbxbr4cgjr312x19";
-      name = "artikulate-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/artikulate-20.12.1.tar.xz";
+      sha256 = "1cvpya408r521p9398mk0xn8pb6awqm74qcjy2r0ylx0l6bkv3ca";
+      name = "artikulate-20.12.1.tar.xz";
     };
   };
   audiocd-kio = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/audiocd-kio-20.08.3.tar.xz";
-      sha256 = "01n4nyda7l7by1nyx2sgxdl8qkdfndk0w6hj0qc6a7fllcfj5cpb";
-      name = "audiocd-kio-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/audiocd-kio-20.12.1.tar.xz";
+      sha256 = "1rlr1w0cy3q31jsaqiv50frqcl3x5jq31pnrkmyhgy23mays8ly1";
+      name = "audiocd-kio-20.12.1.tar.xz";
     };
   };
   baloo-widgets = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/baloo-widgets-20.08.3.tar.xz";
-      sha256 = "0ciidrsvwc3ppxhw7w5116q4lfbsvij9jsvyzm292pmjln2vikrg";
-      name = "baloo-widgets-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/baloo-widgets-20.12.1.tar.xz";
+      sha256 = "115y0cdlsdzx6c017gr8x6in9jxyw0sqyamakqgfyy5phn203yr3";
+      name = "baloo-widgets-20.12.1.tar.xz";
     };
   };
   blinken = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/blinken-20.08.3.tar.xz";
-      sha256 = "1gfw0w66nm3sx81bnr0p0yz1bhjj63lvd3cr86x3b2pny5rcw1da";
-      name = "blinken-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/blinken-20.12.1.tar.xz";
+      sha256 = "05dbmh1lk1ag735yiv7vql6fx15lw9a3qihxflzhbfrgng7dsxks";
+      name = "blinken-20.12.1.tar.xz";
     };
   };
   bomber = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/bomber-20.08.3.tar.xz";
-      sha256 = "1nw1a9cf0nqgk00hvzcqch3bl97lx6bih0wsax5q0z1kzwlz0kgr";
-      name = "bomber-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/bomber-20.12.1.tar.xz";
+      sha256 = "07iy6b8hwklb5mgrf8sagmrza78p3yf7i4x7w9lb2z9v2x5qw22y";
+      name = "bomber-20.12.1.tar.xz";
     };
   };
   bovo = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/bovo-20.08.3.tar.xz";
-      sha256 = "06pbivyvfgjx6zkadvwfwnrg9vjy4rf52k2a74qjcnl2ms16sr1g";
-      name = "bovo-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/bovo-20.12.1.tar.xz";
+      sha256 = "1wrw81xrayhjadvjfi0zdc0vw445f4zmd32n0rca78i68ls5qbxv";
+      name = "bovo-20.12.1.tar.xz";
     };
   };
   calendarsupport = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/calendarsupport-20.08.3.tar.xz";
-      sha256 = "09w06n745764fs440nh0piy5sahfn50kh3zrljhgzadcij6165vd";
-      name = "calendarsupport-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/calendarsupport-20.12.1.tar.xz";
+      sha256 = "1accj2vx6zvqp632i5c85q4rzpg54xlihzf1rs80sdb9lch8nwrp";
+      name = "calendarsupport-20.12.1.tar.xz";
     };
   };
   cantor = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/cantor-20.08.3.tar.xz";
-      sha256 = "1njqycx0v3zq5mdcvfdfgxs8vgl01v80s27qgapsxxrgr9hgxbhl";
-      name = "cantor-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/cantor-20.12.1.tar.xz";
+      sha256 = "1qj6lmcgmqr110qw2r906b0kp73f9gzvm75ry1gdb77bza5g67x2";
+      name = "cantor-20.12.1.tar.xz";
     };
   };
   cervisia = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/cervisia-20.08.3.tar.xz";
-      sha256 = "1bsc72kxcmzx25408ngzqzj4a0168vqfr3a2gvmm6d8klbgpm3gv";
-      name = "cervisia-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/cervisia-20.12.1.tar.xz";
+      sha256 = "0hnpysp01z5a3gmm2jr2m1y7a5hcfl32lhmnrm0rg589pdxb30xf";
+      name = "cervisia-20.12.1.tar.xz";
     };
   };
   dolphin = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/dolphin-20.08.3.tar.xz";
-      sha256 = "107n763qix95b1hgy86hddpj9x2clzhaiw8q8yjn9lzj1rz5facx";
-      name = "dolphin-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/dolphin-20.12.1.tar.xz";
+      sha256 = "0n2g8mqq28xrjy17jyja4siaf2ac2b8gppqc19wjxn981zs545mp";
+      name = "dolphin-20.12.1.tar.xz";
     };
   };
   dolphin-plugins = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/dolphin-plugins-20.08.3.tar.xz";
-      sha256 = "0fmay0sycfj9s7zyxbldgcal5lj2psi0n9zrgq812s5qr4rb5c8c";
-      name = "dolphin-plugins-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/dolphin-plugins-20.12.1.tar.xz";
+      sha256 = "0kn79c3w6qx70d7f8kdavl5ifq1pmcs4dc88i0zma8hskgvcjvcj";
+      name = "dolphin-plugins-20.12.1.tar.xz";
     };
   };
   dragon = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/dragon-20.08.3.tar.xz";
-      sha256 = "14qsb7h8w58i9jsh1gpcj8pwjgy7y3mqfy51hca82yrd82z5b9rn";
-      name = "dragon-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/dragon-20.12.1.tar.xz";
+      sha256 = "0nj2cba4w7q4q1w7lv63s9zgqrvha5figp5w9apklqps4z1d2p0s";
+      name = "dragon-20.12.1.tar.xz";
     };
   };
   elisa = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/elisa-20.08.3.tar.xz";
-      sha256 = "0893nbj0jsapnfd09cp961k2m7lq6sjvzynpa4hfp9ch1jbc912c";
-      name = "elisa-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/elisa-20.12.1.tar.xz";
+      sha256 = "1lmgxi7xdyzjyi15ighkp2ylc6riqzgjmnfjc7p6na88vl2h2diy";
+      name = "elisa-20.12.1.tar.xz";
     };
   };
   eventviews = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/eventviews-20.08.3.tar.xz";
-      sha256 = "158j5g3i0wbbxpg9jmr50dvbpms4c4vgcnpmn3b3vfbszzwsy6rg";
-      name = "eventviews-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/eventviews-20.12.1.tar.xz";
+      sha256 = "10nq8gx1bybhjx5dnrx2x5gslg8nw3vazy22jz03slgspm0gsajc";
+      name = "eventviews-20.12.1.tar.xz";
     };
   };
   ffmpegthumbs = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/ffmpegthumbs-20.08.3.tar.xz";
-      sha256 = "186hpq949r3xx2a64nqjy4pcn67d6kdvsy80zr238lgb9qqcqygi";
-      name = "ffmpegthumbs-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/ffmpegthumbs-20.12.1.tar.xz";
+      sha256 = "17p9xqyfsaibhkfkhbx9mxjkdl5xdc3h91gsrkkwkqyfa5vs9c5g";
+      name = "ffmpegthumbs-20.12.1.tar.xz";
     };
   };
   filelight = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/filelight-20.08.3.tar.xz";
-      sha256 = "1jljsnjdhnqphh1kanj6hi2rswq3i9119iah1j33jy5pladcyf5q";
-      name = "filelight-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/filelight-20.12.1.tar.xz";
+      sha256 = "0k7ia3q1j520n3i1va7v4nhdfycxv54sis6vq62ihm53kb0jrj4i";
+      name = "filelight-20.12.1.tar.xz";
     };
   };
   granatier = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/granatier-20.08.3.tar.xz";
-      sha256 = "195bc2rcz11v76c0cwa9mb7rfixjn7sb0a52wrzz0sf9624m0rcs";
-      name = "granatier-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/granatier-20.12.1.tar.xz";
+      sha256 = "0mhqjg0wznvf1dc7f9dmw6ccva84g09cds2jls37zzblqbfdnzw3";
+      name = "granatier-20.12.1.tar.xz";
     };
   };
   grantlee-editor = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/grantlee-editor-20.08.3.tar.xz";
-      sha256 = "1k2rdicd68jdk3pazyn3q0vj99n0vnkpzkrnacpymkjy85cjgrv9";
-      name = "grantlee-editor-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/grantlee-editor-20.12.1.tar.xz";
+      sha256 = "1684k6gpmvbbxjha5qkvfvas2lws0zm5v5s41z6yjxyshrbc29jh";
+      name = "grantlee-editor-20.12.1.tar.xz";
     };
   };
   grantleetheme = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/grantleetheme-20.08.3.tar.xz";
-      sha256 = "07b7v5v2vyz3vyj1jjzryzaak8bbqg8a2caxwb6s7cwhy19y6my5";
-      name = "grantleetheme-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/grantleetheme-20.12.1.tar.xz";
+      sha256 = "1w87pz09lb3n511w0qir70c317j4gqgc7iyw3cgs2pqzz9f19vcx";
+      name = "grantleetheme-20.12.1.tar.xz";
     };
   };
   gwenview = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/gwenview-20.08.3.tar.xz";
-      sha256 = "09mwp3z97hgd7c15w0hz8k61qn5icb81rj27nxzy877ph1xnrixc";
-      name = "gwenview-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/gwenview-20.12.1.tar.xz";
+      sha256 = "0xjipr1ib8r42xsd75ack2198q6gf3xxl1zc9ir2ihdk3sg6lsb1";
+      name = "gwenview-20.12.1.tar.xz";
     };
   };
   incidenceeditor = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/incidenceeditor-20.08.3.tar.xz";
-      sha256 = "15kkl8z1nig9qyxfrq54c3sqh1xs1lzlbm5rphj34y0yb8dbn8kx";
-      name = "incidenceeditor-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/incidenceeditor-20.12.1.tar.xz";
+      sha256 = "1hdyy1sisavxjhwgpxh4ab4a3cvsvjj6hfa9w8kn8ypipd6nmqac";
+      name = "incidenceeditor-20.12.1.tar.xz";
+    };
+  };
+  itinerary = {
+    version = "20.12.1";
+    src = fetchurl {
+      url = "${mirror}/stable/release-service/20.12.1/src/itinerary-20.12.1.tar.xz";
+      sha256 = "02mmbj32ankv06mlgdrfyppkfi1dkgy9ky22d6bnz3l1vyld76s9";
+      name = "itinerary-20.12.1.tar.xz";
     };
   };
   juk = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/juk-20.08.3.tar.xz";
-      sha256 = "1jvj0r4grm55cnck4apnh4fh44mv1ycm0pprrkh57iwj1dlf7kif";
-      name = "juk-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/juk-20.12.1.tar.xz";
+      sha256 = "0rx4dmnk15xrf9knwsvjmf963xn59rlzwwsa6wrjjpi8r6br8x4r";
+      name = "juk-20.12.1.tar.xz";
     };
   };
   k3b = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/k3b-20.08.3.tar.xz";
-      sha256 = "0qg2p6gdg0clgv6qab5vr0i451m9hqqmpwq335w8m9nwb6wg30cx";
-      name = "k3b-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/k3b-20.12.1.tar.xz";
+      sha256 = "02ybzn8gg82r7i7rg8swyza30zwsf3fassmp6hqffn15g4kc2lrp";
+      name = "k3b-20.12.1.tar.xz";
     };
   };
   kaccounts-integration = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/kaccounts-integration-20.08.3.tar.xz";
-      sha256 = "006cglw5ai274a1r5jbk109mdrvw8v6fp3cdyi1kbrq7lp3123a2";
-      name = "kaccounts-integration-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/kaccounts-integration-20.12.1.tar.xz";
+      sha256 = "01xy3ih2fw4xnf5jkadrbq1dzmvvvrslbq4afj9501vhzyfqgm92";
+      name = "kaccounts-integration-20.12.1.tar.xz";
     };
   };
   kaccounts-providers = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/kaccounts-providers-20.08.3.tar.xz";
-      sha256 = "1vpv366bzj0sk7dqyxrq06a8ixgaaqi125mf2gmybvhj5yvrn3fp";
-      name = "kaccounts-providers-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/kaccounts-providers-20.12.1.tar.xz";
+      sha256 = "1f3gr63jwm7b8nkpdmpkgvsrhrpaxf7wcl0gczhdli1v6svjv8vq";
+      name = "kaccounts-providers-20.12.1.tar.xz";
     };
   };
   kaddressbook = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/kaddressbook-20.08.3.tar.xz";
-      sha256 = "00mia1jh2c5rcnsyx3wizjdg65pvpazfb8ayppjzv4rrc2nhr9nn";
-      name = "kaddressbook-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/kaddressbook-20.12.1.tar.xz";
+      sha256 = "0j6mjj902h5zpipywp5xhbifrbgrb1lz1cg317md7ya4wc7z36fp";
+      name = "kaddressbook-20.12.1.tar.xz";
     };
   };
   kajongg = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/kajongg-20.08.3.tar.xz";
-      sha256 = "0wr045xqm1q03vy0jbgrldpdc9k3lgnhd39yhi574la367ayffpa";
-      name = "kajongg-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/kajongg-20.12.1.tar.xz";
+      sha256 = "0v9sq5l6w3x78dpimdlbm36g9n4qy06xr0bzfzn2jf3bzgzrn2zk";
+      name = "kajongg-20.12.1.tar.xz";
     };
   };
   kalarm = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/kalarm-20.08.3.tar.xz";
-      sha256 = "0194rapyvnpmhkba0rgclrai1ywx9anr8dski0j6z1yg0kgav8df";
-      name = "kalarm-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/kalarm-20.12.1.tar.xz";
+      sha256 = "0k4fxrzxb6vvpdqlln4g7iz1s34d9jkk415c44f1i34kl2mfsyq0";
+      name = "kalarm-20.12.1.tar.xz";
     };
   };
   kalarmcal = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/kalarmcal-20.08.3.tar.xz";
-      sha256 = "1i9hi3y4j2pmdmlj13kl13vfplxrh8w23fxz0mmawi1wn533fp66";
-      name = "kalarmcal-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/kalarmcal-20.12.1.tar.xz";
+      sha256 = "104fbq2mf20p67rs7x76h36qk8d0srkkll2pq39ln4hc7nhsrws5";
+      name = "kalarmcal-20.12.1.tar.xz";
     };
   };
   kalgebra = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/kalgebra-20.08.3.tar.xz";
-      sha256 = "0k7miil5ilrw68j6xl9g6cf3zfw7g52h0gfwd5j248nx2nxr150c";
-      name = "kalgebra-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/kalgebra-20.12.1.tar.xz";
+      sha256 = "10y9zygpik418y5781xmy5xysvf3xa97sbzdbch8lrvxwprbmkzm";
+      name = "kalgebra-20.12.1.tar.xz";
     };
   };
   kalzium = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/kalzium-20.08.3.tar.xz";
-      sha256 = "1r80bnpdrybsdwcblpj7cg32dv90l79gs0i42gpm6inilfr3vp5n";
-      name = "kalzium-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/kalzium-20.12.1.tar.xz";
+      sha256 = "1n1ar12zq2maa4dn5yq7m6l3m60n7c98c460mrd6rp7f73kadnsj";
+      name = "kalzium-20.12.1.tar.xz";
     };
   };
   kamera = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/kamera-20.08.3.tar.xz";
-      sha256 = "06fwxdgbyywdrf1r0w17w3chfr0s8jhqswz9chmdfds9f2bb45cr";
-      name = "kamera-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/kamera-20.12.1.tar.xz";
+      sha256 = "1bj01d9h26ifq8nsa1bw49xfihmisnbk7p557zpqvixxayq6v8dq";
+      name = "kamera-20.12.1.tar.xz";
     };
   };
   kamoso = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/kamoso-20.08.3.tar.xz";
-      sha256 = "0zhl3va65ajz3hdggg0jvvgvj14s461pjw9adw9bnfcbs4jzkl2y";
-      name = "kamoso-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/kamoso-20.12.1.tar.xz";
+      sha256 = "087m9lphj6s0xssaryyh91gh9v3ji5423rjd549dkd3vscgda4lb";
+      name = "kamoso-20.12.1.tar.xz";
     };
   };
   kanagram = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/kanagram-20.08.3.tar.xz";
-      sha256 = "1cyx8yq03xaw34ic69ghz9gafk8l30qinp0kkp9a1wh4pry8rnxf";
-      name = "kanagram-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/kanagram-20.12.1.tar.xz";
+      sha256 = "0bflybrm3kz1p1n6fksihvd8m0h0jj968b2wjz88663bs48jqf6q";
+      name = "kanagram-20.12.1.tar.xz";
     };
   };
   kapman = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/kapman-20.08.3.tar.xz";
-      sha256 = "0nh1f0v026rib5ahj1mhvs99yabrgdq71bis465vfpm4favnirzy";
-      name = "kapman-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/kapman-20.12.1.tar.xz";
+      sha256 = "1hs88q4h5l58fvr09vb5ns9pdj4k064ax5ccnj9yan4bn0s9b4f9";
+      name = "kapman-20.12.1.tar.xz";
     };
   };
   kapptemplate = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/kapptemplate-20.08.3.tar.xz";
-      sha256 = "1r98ym9sazjzknxfw58hjiyxhmi49fyhrdn02v0b8fm711vprxab";
-      name = "kapptemplate-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/kapptemplate-20.12.1.tar.xz";
+      sha256 = "1a8fpwbvs2zmmak7zyv75z67ja31vx68s9lz9vldmiik9rrslyy6";
+      name = "kapptemplate-20.12.1.tar.xz";
     };
   };
   kate = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/kate-20.08.3.tar.xz";
-      sha256 = "1m7ximinknc0l9zqv4p25ybn6zysz59l4vvdb9xkhjp53aqskdz9";
-      name = "kate-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/kate-20.12.1.tar.xz";
+      sha256 = "13m24b3fxb1d1k9rg2xfa7i28cjx68g9dbjrbd34acmpg01vp6vk";
+      name = "kate-20.12.1.tar.xz";
     };
   };
   katomic = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/katomic-20.08.3.tar.xz";
-      sha256 = "1v31x6371r9ccvc676vq5dlpkp4829xf0r37dnvdxlfm22mgsdnk";
-      name = "katomic-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/katomic-20.12.1.tar.xz";
+      sha256 = "15s5kwddd1m9g5lhpc61bj6yzxpwzcc8fm24yhslb8l44nk685id";
+      name = "katomic-20.12.1.tar.xz";
     };
   };
   kbackup = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/kbackup-20.08.3.tar.xz";
-      sha256 = "1sayzvj46ckhn5zgp7qi6zmrmd7bjh5mg05mcl5pfwv4dcvxkrng";
-      name = "kbackup-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/kbackup-20.12.1.tar.xz";
+      sha256 = "043dkgpdk56jmx0z8izlgj8r9j8h9rvjc3yalpqd5nrlgmj0smym";
+      name = "kbackup-20.12.1.tar.xz";
     };
   };
   kblackbox = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/kblackbox-20.08.3.tar.xz";
-      sha256 = "0vka2pswbza1z8f97nhxcjrczx4w1x0qyjpzs9ycn9a14smqpsrh";
-      name = "kblackbox-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/kblackbox-20.12.1.tar.xz";
+      sha256 = "001yf4j14xzpabwg37yisls5na9rpxpgs45d4wdlqa90d50syzl7";
+      name = "kblackbox-20.12.1.tar.xz";
     };
   };
   kblocks = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/kblocks-20.08.3.tar.xz";
-      sha256 = "1jc063xn6dphydf49kv0izzy0nv06dr412xxjvkp7vccwv9qd5gf";
-      name = "kblocks-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/kblocks-20.12.1.tar.xz";
+      sha256 = "029dxqg2d6c08r99ng16lc3b1dnnrj5bpz25zgv90aygzx31qq4s";
+      name = "kblocks-20.12.1.tar.xz";
     };
   };
   kbounce = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/kbounce-20.08.3.tar.xz";
-      sha256 = "0863vlirljvf101mdv6jxprj9axs4cikrnld3wvxrcqw3w2dy6wy";
-      name = "kbounce-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/kbounce-20.12.1.tar.xz";
+      sha256 = "1vdc7xhbh0wpvk66sqs0xly0mmbpw922vg4kjjn21awamv4r52pm";
+      name = "kbounce-20.12.1.tar.xz";
     };
   };
   kbreakout = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/kbreakout-20.08.3.tar.xz";
-      sha256 = "14nd1dnbdyxv59y8iildhydhxgal38hvj7bk6544glwl8yalak8z";
-      name = "kbreakout-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/kbreakout-20.12.1.tar.xz";
+      sha256 = "11bx32lffagmyvxx2wss794fy3icz9k5yq4mjs2qxpf9pyvg6qgd";
+      name = "kbreakout-20.12.1.tar.xz";
     };
   };
   kbruch = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/kbruch-20.08.3.tar.xz";
-      sha256 = "03s1hl4h8rsx0gn7wqfssi1ga4igx48jb47gpw6f9rfjm8f199vb";
-      name = "kbruch-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/kbruch-20.12.1.tar.xz";
+      sha256 = "06sbr6wrn4nh69hq96i5rgzbr9g0rc6c54h9g2zpnpff339lnsqi";
+      name = "kbruch-20.12.1.tar.xz";
     };
   };
   kcachegrind = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/kcachegrind-20.08.3.tar.xz";
-      sha256 = "17j06z9cpj5qhfbp1xgw4qmhi4jckf2i99c9brys4ifb3p0rkbrs";
-      name = "kcachegrind-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/kcachegrind-20.12.1.tar.xz";
+      sha256 = "0v06y1mybda4rmvjrjxhmxp7bj0wp6v45xahn08j253d20k7qixi";
+      name = "kcachegrind-20.12.1.tar.xz";
     };
   };
   kcalc = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/kcalc-20.08.3.tar.xz";
-      sha256 = "1mk30fkv51w3fqlpkzgm1yj5sp98h26kkphplqkjva5v6s1jzmjy";
-      name = "kcalc-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/kcalc-20.12.1.tar.xz";
+      sha256 = "1p59i6k0kq4xgcfsgcsb9z3yrrzgk564fh0apwmbawrmg6pp78dw";
+      name = "kcalc-20.12.1.tar.xz";
     };
   };
   kcalutils = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/kcalutils-20.08.3.tar.xz";
-      sha256 = "1i2yh4gvdwlylj7f7p32g1z7lzh3p19rrbd96l1gqhy700f2whpw";
-      name = "kcalutils-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/kcalutils-20.12.1.tar.xz";
+      sha256 = "0b7w9n8sf31qbpxiw998xd4dls46mxf2bvl4n937vgzisfwb5sxs";
+      name = "kcalutils-20.12.1.tar.xz";
     };
   };
   kcharselect = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/kcharselect-20.08.3.tar.xz";
-      sha256 = "1p6rijjfa2jk4vr0ivjn6p5qf2ys5kvhw0cwfyjs45ff7zg0s2ga";
-      name = "kcharselect-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/kcharselect-20.12.1.tar.xz";
+      sha256 = "1ss5zwp0zggk9phdccj7bcn8h49p9avzg8qm38c3wnwddgaw1pdb";
+      name = "kcharselect-20.12.1.tar.xz";
     };
   };
   kcolorchooser = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/kcolorchooser-20.08.3.tar.xz";
-      sha256 = "1874qa04whiivyydxfcn0f1xch515ga1af4ym42zqz64j3kq7i47";
-      name = "kcolorchooser-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/kcolorchooser-20.12.1.tar.xz";
+      sha256 = "07qvwk8amvmgiwxrl6gbyf25ms666hradmg1vl8lf3hmfxx6j40z";
+      name = "kcolorchooser-20.12.1.tar.xz";
     };
   };
   kcron = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/kcron-20.08.3.tar.xz";
-      sha256 = "1piwssyg9fvah25gql6w0n8xf634f6gy475cz52gb1bl7rp72q6j";
-      name = "kcron-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/kcron-20.12.1.tar.xz";
+      sha256 = "01xabwaxhxgwk6kh44rz3fm20jis2f6g9mrska5s03gxk7n0p1dc";
+      name = "kcron-20.12.1.tar.xz";
     };
   };
   kdebugsettings = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/kdebugsettings-20.08.3.tar.xz";
-      sha256 = "11xnvr9qib3hnp48whsw659c724s2114p5dr3fswvhm3hkw1aky7";
-      name = "kdebugsettings-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/kdebugsettings-20.12.1.tar.xz";
+      sha256 = "1jlxp6v6yci4cff1mcz0w7dz0hfjig0wck9cc9maaw1a9swqc3r1";
+      name = "kdebugsettings-20.12.1.tar.xz";
     };
   };
   kdeconnect-kde = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/kdeconnect-kde-20.08.3.tar.xz";
-      sha256 = "0x10ga81qlsahavmv356xzjxyds41y2b4v338rqcyqkxvfmxj01k";
-      name = "kdeconnect-kde-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/kdeconnect-kde-20.12.1.tar.xz";
+      sha256 = "0q11319ydibn1jgch98r66gzh3n6nb67l7xgzg0crdalm3dvf5gw";
+      name = "kdeconnect-kde-20.12.1.tar.xz";
     };
   };
   kde-dev-scripts = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/kde-dev-scripts-20.08.3.tar.xz";
-      sha256 = "0x8ba4mlxx17vk674738xln2dy696b148fa3s87za4yb4jj9gc5n";
-      name = "kde-dev-scripts-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/kde-dev-scripts-20.12.1.tar.xz";
+      sha256 = "0hlabgf75qmww1161nd4ggqccp6h9ibsfkzpxdqvgxr9f1f31zz5";
+      name = "kde-dev-scripts-20.12.1.tar.xz";
     };
   };
   kde-dev-utils = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/kde-dev-utils-20.08.3.tar.xz";
-      sha256 = "0k7zb1km89nnqfi2p1mhp6dvwkhmgbcgw89301acag34yy954dvn";
-      name = "kde-dev-utils-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/kde-dev-utils-20.12.1.tar.xz";
+      sha256 = "1bir6ifq5wlwgdna48s5c1al7hfq6vl9pi2yvbnzf0rz4ix1sw4r";
+      name = "kde-dev-utils-20.12.1.tar.xz";
     };
   };
   kdeedu-data = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/kdeedu-data-20.08.3.tar.xz";
-      sha256 = "1k164h4n8r4yjlll5900fz764lr0qiy3q1fpcpkr8f1n7qs7f797";
-      name = "kdeedu-data-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/kdeedu-data-20.12.1.tar.xz";
+      sha256 = "1hzrwkb2333dkvp1n50p18gfci21klafibaknm4hdrk96b3s4fxp";
+      name = "kdeedu-data-20.12.1.tar.xz";
     };
   };
   kdegraphics-mobipocket = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/kdegraphics-mobipocket-20.08.3.tar.xz";
-      sha256 = "0ifxbwn7pmxr7y4ri617a303b27nqwqa418isgfrfk11jc4yyxhq";
-      name = "kdegraphics-mobipocket-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/kdegraphics-mobipocket-20.12.1.tar.xz";
+      sha256 = "1n3x4cf5ck0lfn70d9g0iiy4pddc0r49gwir71q5six5l4pz21hd";
+      name = "kdegraphics-mobipocket-20.12.1.tar.xz";
     };
   };
   kdegraphics-thumbnailers = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/kdegraphics-thumbnailers-20.08.3.tar.xz";
-      sha256 = "0mbzkw7pxcfmkpb8ivhahnxkkrkjhmbjqy2l9gqx35gp5855gmxf";
-      name = "kdegraphics-thumbnailers-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/kdegraphics-thumbnailers-20.12.1.tar.xz";
+      sha256 = "0lrijvphyc6wbkb499zf0gjpmqrjgrx5li93kvpsil1ivfpflv7w";
+      name = "kdegraphics-thumbnailers-20.12.1.tar.xz";
     };
   };
   kdenetwork-filesharing = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/kdenetwork-filesharing-20.08.3.tar.xz";
-      sha256 = "0id19wmiivdrx10r1hwbwi7bx6g1v9g5lpbhlmfrapvy82ijfmbg";
-      name = "kdenetwork-filesharing-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/kdenetwork-filesharing-20.12.1.tar.xz";
+      sha256 = "0axi5vdgqkjdcbq0x34b3lnh1497vk54p9aca9d2wfhkd55zjbcv";
+      name = "kdenetwork-filesharing-20.12.1.tar.xz";
     };
   };
   kdenlive = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/kdenlive-20.08.3.tar.xz";
-      sha256 = "187d5khqq9ckmqp8amd7ghlvig1z97w2jzm9s4zsfhjzyqv3d3wz";
-      name = "kdenlive-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/kdenlive-20.12.1.tar.xz";
+      sha256 = "0n543nswn0gxasc1445nqg35z5466a3ssivigxz4acqw66nj4vlv";
+      name = "kdenlive-20.12.1.tar.xz";
     };
   };
   kdepim-addons = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/kdepim-addons-20.08.3.tar.xz";
-      sha256 = "17m8pwiig46pc6x4ylvymb3b6c7xcm2df3vjma665kcir1dr0q7p";
-      name = "kdepim-addons-20.08.3.tar.xz";
-    };
-  };
-  kdepim-apps-libs = {
-    version = "20.08.3";
-    src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/kdepim-apps-libs-20.08.3.tar.xz";
-      sha256 = "08iw1p9mv4jic7pk6skxc5anp7k46lhcdqxpq1i6wlhbrk6bpsvg";
-      name = "kdepim-apps-libs-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/kdepim-addons-20.12.1.tar.xz";
+      sha256 = "1dc5sl9ksk5i2sgs2vf41blb5cdpl8fv3vzmrrz9sl3r75pga5m0";
+      name = "kdepim-addons-20.12.1.tar.xz";
     };
   };
   kdepim-runtime = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/kdepim-runtime-20.08.3.tar.xz";
-      sha256 = "0zz2zwq3gr177vgkwz6b70q4n2ra4ym58f167pgvi9kxv3884fib";
-      name = "kdepim-runtime-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/kdepim-runtime-20.12.1.tar.xz";
+      sha256 = "1np7xbdhm2wczm04cmsr25a74421i28iln39myiybq01im2ahapq";
+      name = "kdepim-runtime-20.12.1.tar.xz";
     };
   };
   kdesdk-kioslaves = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/kdesdk-kioslaves-20.08.3.tar.xz";
-      sha256 = "1kwzms0qha058cm92d4f8pr89r3bqaqx5zfw6gz05s6lg892j5in";
-      name = "kdesdk-kioslaves-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/kdesdk-kioslaves-20.12.1.tar.xz";
+      sha256 = "18yy2s39sxfzi5lcky1jvlv7z77ygidhnfa4zhwas27yhcc6h0w4";
+      name = "kdesdk-kioslaves-20.12.1.tar.xz";
     };
   };
   kdesdk-thumbnailers = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/kdesdk-thumbnailers-20.08.3.tar.xz";
-      sha256 = "10fc0agpvzpqdxqynd70vzya0g1nbdw0ylbnl9w35n9jhww42jff";
-      name = "kdesdk-thumbnailers-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/kdesdk-thumbnailers-20.12.1.tar.xz";
+      sha256 = "1hgqd2d2a9iwaxvd4xd7sdj7pyf3p3v2xg6v9dyy9y39q2f1qs23";
+      name = "kdesdk-thumbnailers-20.12.1.tar.xz";
     };
   };
   kdf = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/kdf-20.08.3.tar.xz";
-      sha256 = "02k5nhsf1zzkx9cl3r2500pj2zfmvjhlfsb3smgpka6in7iivxyp";
-      name = "kdf-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/kdf-20.12.1.tar.xz";
+      sha256 = "0ba67hs4vlb3qyvdzhnpmf8p62df12s8aqw4hzf9vnxff3qix5k1";
+      name = "kdf-20.12.1.tar.xz";
     };
   };
   kdialog = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/kdialog-20.08.3.tar.xz";
-      sha256 = "0knl6176bjazjiacg1qqaldlqcjlb3bi829sliq1sdh4lzzwrbzk";
-      name = "kdialog-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/kdialog-20.12.1.tar.xz";
+      sha256 = "13n6bc3aqi9v6i4p4vkwzjv4rsqinx45n028ls6ndlapayd750f4";
+      name = "kdialog-20.12.1.tar.xz";
     };
   };
   kdiamond = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/kdiamond-20.08.3.tar.xz";
-      sha256 = "0ls1kg3wank1al46knq12jilmp8gaa4rn7zbgflcrhgy5gw8l5px";
-      name = "kdiamond-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/kdiamond-20.12.1.tar.xz";
+      sha256 = "0iaq3cai1sn3vlym4zshfziviy9k4s7pm92c7bzwa9adfak6y9h4";
+      name = "kdiamond-20.12.1.tar.xz";
     };
   };
   keditbookmarks = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/keditbookmarks-20.08.3.tar.xz";
-      sha256 = "0m8ap5hvjgldj9hdk6shpkv8xylhhjla2xn1zs86pvj4la3zh4f8";
-      name = "keditbookmarks-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/keditbookmarks-20.12.1.tar.xz";
+      sha256 = "1a41zpl2wzqdmp13m915agcc2nlxndyamy5aqyn98y3s8k5n6d9p";
+      name = "keditbookmarks-20.12.1.tar.xz";
     };
   };
   kfind = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/kfind-20.08.3.tar.xz";
-      sha256 = "10i5mw6q2parq5w7pi955kgfvdlw8hwis2p7r9vkvabjdk69nkdr";
-      name = "kfind-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/kfind-20.12.1.tar.xz";
+      sha256 = "0rlxq4dl221ycxcybav7yf88wz23v07n5yzp7jgrd602lk5k8jdp";
+      name = "kfind-20.12.1.tar.xz";
     };
   };
   kfloppy = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/kfloppy-20.08.3.tar.xz";
-      sha256 = "1cp0pwgldscc7va508gk43im3fv0lsxd5sbhpw8kxlzjlpbwlp8v";
-      name = "kfloppy-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/kfloppy-20.12.1.tar.xz";
+      sha256 = "1wpcv2ipx0izg60rbgf8qwhys3bhw8i36qpsvh8bihkzij28xc84";
+      name = "kfloppy-20.12.1.tar.xz";
     };
   };
   kfourinline = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/kfourinline-20.08.3.tar.xz";
-      sha256 = "0h1n44dncr2siw447n7b0gkx3380vajvqjsgjvapkg7m7bmz7nsv";
-      name = "kfourinline-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/kfourinline-20.12.1.tar.xz";
+      sha256 = "1fv68smci1f59xzqzqj36qry2ibgr0ps731vhvafn210q8h2f5b5";
+      name = "kfourinline-20.12.1.tar.xz";
     };
   };
   kgeography = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/kgeography-20.08.3.tar.xz";
-      sha256 = "1mk5cip55chc8pmh8wfl7an5x076ywisr0i7isqcjaij2cv54283";
-      name = "kgeography-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/kgeography-20.12.1.tar.xz";
+      sha256 = "13jsrfv17lzlwi9rg7i8q2sfl8n19k15qdbv1y5lggykvf8prp8h";
+      name = "kgeography-20.12.1.tar.xz";
     };
   };
   kget = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/kget-20.08.3.tar.xz";
-      sha256 = "144ydk8bbfirph464mkkvwpnynj465i2ynhm8n9d330kcrhnaxd0";
-      name = "kget-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/kget-20.12.1.tar.xz";
+      sha256 = "03s8wpfrzl3j6whxbfbmbydghaghcnr8xbskf4wkyk9kvyk4bqha";
+      name = "kget-20.12.1.tar.xz";
     };
   };
   kgoldrunner = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/kgoldrunner-20.08.3.tar.xz";
-      sha256 = "101cdl04wb6xbq95b51ax36570y9ahkcy5gccqsyvc307ij9yg7r";
-      name = "kgoldrunner-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/kgoldrunner-20.12.1.tar.xz";
+      sha256 = "0n96clxf0bmhm8hlyvd7q9w1zhjn5irvh2vrf9d79ng44zgygjvh";
+      name = "kgoldrunner-20.12.1.tar.xz";
     };
   };
   kgpg = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/kgpg-20.08.3.tar.xz";
-      sha256 = "1ip21yal37yxg5i5sfy6lgfb3sz9lld0dwa7a1w4lbddf9w3akd6";
-      name = "kgpg-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/kgpg-20.12.1.tar.xz";
+      sha256 = "05wwdbx90wg3rm6hcin1dykbrbzz82g01dxnkgh21zzab72wmx8a";
+      name = "kgpg-20.12.1.tar.xz";
     };
   };
   khangman = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/khangman-20.08.3.tar.xz";
-      sha256 = "1zwdd2gpjkld3vkawp0lj83il257ryxf8wpmbgzn1wz8sxxi01jj";
-      name = "khangman-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/khangman-20.12.1.tar.xz";
+      sha256 = "0ljavjbh69qyp2323pqlkibzjkwgddmdjd35m0m5n4nwvnz3l5y7";
+      name = "khangman-20.12.1.tar.xz";
     };
   };
   khelpcenter = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/khelpcenter-20.08.3.tar.xz";
-      sha256 = "1xan4awwgs08k7ksfy80rfcxqd6bi8i1fjdgy55hh7wshv76zf5r";
-      name = "khelpcenter-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/khelpcenter-20.12.1.tar.xz";
+      sha256 = "1cba8siq3g78xjap4mhfkgvk9n031qy81ir08fpwk6zp9fkkgqb6";
+      name = "khelpcenter-20.12.1.tar.xz";
     };
   };
   kidentitymanagement = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/kidentitymanagement-20.08.3.tar.xz";
-      sha256 = "0vkydvf4yw3qlqrg9m1zdm6j0c1crxdvc7l24yls9fjbj957vbls";
-      name = "kidentitymanagement-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/kidentitymanagement-20.12.1.tar.xz";
+      sha256 = "1f8l8xbwy7qk5hadvknr45ihhg1j7zpqvpf5wxj3h6zg9fmadly9";
+      name = "kidentitymanagement-20.12.1.tar.xz";
     };
   };
   kig = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/kig-20.08.3.tar.xz";
-      sha256 = "1dvizdfkvl7p7hr4xm4zh51lpr8qr3s5j5zz162s7arr7sws4w8h";
-      name = "kig-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/kig-20.12.1.tar.xz";
+      sha256 = "0ns4rhk822p7jjqy9wnhkbrbais4ih1viw405rl5r5xlqn9bvsiz";
+      name = "kig-20.12.1.tar.xz";
     };
   };
   kigo = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/kigo-20.08.3.tar.xz";
-      sha256 = "0sx3klivzn8h96mpnbkiv2nbi2l6w0j6fclj7q3ql3cm81jh6n15";
-      name = "kigo-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/kigo-20.12.1.tar.xz";
+      sha256 = "0lvcc423mw3gs6c5x4lrlny07q93pa8ivaqphq6y4771n5y5dqqa";
+      name = "kigo-20.12.1.tar.xz";
     };
   };
   killbots = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/killbots-20.08.3.tar.xz";
-      sha256 = "1j41my0brpqpvd8xibv39z4x4kmw1sqz7wy7ibhh0zir3jh64n83";
-      name = "killbots-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/killbots-20.12.1.tar.xz";
+      sha256 = "0cdlixd7rakcxa8f5pf3pmq86mlipg7yhygnii858165v0gwkpx3";
+      name = "killbots-20.12.1.tar.xz";
     };
   };
   kimagemapeditor = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/kimagemapeditor-20.08.3.tar.xz";
-      sha256 = "1m9mrksdl08ijmpmx3lhdysnm70mrnqz9rlbcn1h95p2sq0bk8cg";
-      name = "kimagemapeditor-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/kimagemapeditor-20.12.1.tar.xz";
+      sha256 = "0vj2w3bgkq020gdi5q1zh650ipf4zc0hvzx5fpjknx4hd8b52rf8";
+      name = "kimagemapeditor-20.12.1.tar.xz";
     };
   };
   kimap = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/kimap-20.08.3.tar.xz";
-      sha256 = "16paglkqgnyzwjydhn02qw7zg0d4casir4bsfch15wdmqv389mrg";
-      name = "kimap-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/kimap-20.12.1.tar.xz";
+      sha256 = "1x6lapmb3srw3pddi7rmlzjdsw54x94pkr6jyrncpfpqqsgb3l4v";
+      name = "kimap-20.12.1.tar.xz";
     };
   };
   kio-extras = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/kio-extras-20.08.3.tar.xz";
-      sha256 = "0i7k9asc97r9z4lfk5hyf7mcbx0za7j6v4dhqn43j5v4x2i0201c";
-      name = "kio-extras-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/kio-extras-20.12.1.tar.xz";
+      sha256 = "1ym07jzy4w21frf3j5aadxg8ny7bgrm5dbhrc3xdyyj2rwh3iygg";
+      name = "kio-extras-20.12.1.tar.xz";
     };
   };
   kio-gdrive = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/kio-gdrive-20.08.3.tar.xz";
-      sha256 = "0pp0nvsnfdm8vskw194qjfac4agnlsjm44w1704b5sqx6i27dafy";
-      name = "kio-gdrive-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/kio-gdrive-20.12.1.tar.xz";
+      sha256 = "0axh8138rcfpa0a7s5w8zi8i6chz3z1q7560v497x6rd3d1z2zp0";
+      name = "kio-gdrive-20.12.1.tar.xz";
     };
   };
   kipi-plugins = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/kipi-plugins-20.08.3.tar.xz";
-      sha256 = "1pplhv8yjfl1ifx9ykf4w2lgma8jvshihmd5c5mz9liqk3lawq15";
-      name = "kipi-plugins-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/kipi-plugins-20.12.1.tar.xz";
+      sha256 = "0pv5f6v37n75vrz4vaw755bjyyqk1mm9dla26k0jy3qr76g8bg9d";
+      name = "kipi-plugins-20.12.1.tar.xz";
     };
   };
   kirigami-gallery = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/kirigami-gallery-20.08.3.tar.xz";
-      sha256 = "0l100ng8ai55s0vl8nkpq4vysy2nc6sk1dbisc2mp7br74ykyfp9";
-      name = "kirigami-gallery-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/kirigami-gallery-20.12.1.tar.xz";
+      sha256 = "00f3alhlvlphcz81465nfrdvvabbzy5n1s06bvwzsvf290h5chbh";
+      name = "kirigami-gallery-20.12.1.tar.xz";
     };
   };
   kiriki = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/kiriki-20.08.3.tar.xz";
-      sha256 = "1gddjii84cbz1dg8k0pnd3dyzar4lvj03j9v84vabggjjjbpir0f";
-      name = "kiriki-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/kiriki-20.12.1.tar.xz";
+      sha256 = "07qsmyf1ylgcwy704s8x9g1h4kalsipqz4z3bj1z5m5a2y9l8y8q";
+      name = "kiriki-20.12.1.tar.xz";
     };
   };
   kiten = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/kiten-20.08.3.tar.xz";
-      sha256 = "0n9mq86gcl6s2f45l8lbp4gsdj356l78xjkdvm14f6qlh81vsqlc";
-      name = "kiten-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/kiten-20.12.1.tar.xz";
+      sha256 = "0dfz2wdscgn0f967lnhzpyb3iz1iw068x0l10542pm5dh32afs4m";
+      name = "kiten-20.12.1.tar.xz";
     };
   };
   kitinerary = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/kitinerary-20.08.3.tar.xz";
-      sha256 = "169pmy5fyjkbya8r2kdkd9s83sim0jplc3lx8bv2xh6r10mvzgm6";
-      name = "kitinerary-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/kitinerary-20.12.1.tar.xz";
+      sha256 = "07zjd3ikbx6rw39ndy04aia8q35r75p5n52fijwnc4fkfc40xyxz";
+      name = "kitinerary-20.12.1.tar.xz";
     };
   };
   kjumpingcube = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/kjumpingcube-20.08.3.tar.xz";
-      sha256 = "19246jwwd686x8i0jrvz2c8mpkf6qhm7rnskzin59dqzr76xrpgz";
-      name = "kjumpingcube-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/kjumpingcube-20.12.1.tar.xz";
+      sha256 = "0li9bq7j30fbdzg981i6jkpxgrv1z84bpig8m5mxfyfhs5c55j69";
+      name = "kjumpingcube-20.12.1.tar.xz";
     };
   };
   kldap = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/kldap-20.08.3.tar.xz";
-      sha256 = "1ihaazsnb9r30m2qhzcp2ns9f5fs7l3agsc9f9wxi4cyw73bq0n3";
-      name = "kldap-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/kldap-20.12.1.tar.xz";
+      sha256 = "02w4hk9j1f1d81k0j8dzrj4hxwk2xwrf48305hzmm658wjvkv4k3";
+      name = "kldap-20.12.1.tar.xz";
     };
   };
   kleopatra = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/kleopatra-20.08.3.tar.xz";
-      sha256 = "1r879g7hw3c5cww58z0kvqj47pgzbiq1vpgxz847smrylqajcpyi";
-      name = "kleopatra-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/kleopatra-20.12.1.tar.xz";
+      sha256 = "1g06mq8vl1jhkyrjfrgsbl44v7yq04m8xbb8dxlyhyv40dwlz7l6";
+      name = "kleopatra-20.12.1.tar.xz";
     };
   };
   klettres = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/klettres-20.08.3.tar.xz";
-      sha256 = "0irc0f7vjznlsczan30zzprbnvgnbg19vabr97cw9rkkfa28azx9";
-      name = "klettres-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/klettres-20.12.1.tar.xz";
+      sha256 = "0k66xdkyv6i1zgk9nvz9633pmxygv1bwm4nkbg3izlh4g23rn3kk";
+      name = "klettres-20.12.1.tar.xz";
     };
   };
   klickety = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/klickety-20.08.3.tar.xz";
-      sha256 = "1qsm9grmy0bnalpdghg48xi68zzk6ysmg6n0d74ldmmnirv3r0zf";
-      name = "klickety-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/klickety-20.12.1.tar.xz";
+      sha256 = "17ml80p02sndhac5q6lkf7bb1kz9snsia991fghhahcjvd1g2qn6";
+      name = "klickety-20.12.1.tar.xz";
     };
   };
   klines = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/klines-20.08.3.tar.xz";
-      sha256 = "1l95ph1sjp3r1q065k3rj18lm36krl7bh41zgqh021p692ywc48c";
-      name = "klines-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/klines-20.12.1.tar.xz";
+      sha256 = "1ba71n90x0s8nf300p53libzfjd0j9r6m0fng636m1qjaz6z9a3c";
+      name = "klines-20.12.1.tar.xz";
     };
   };
   kmag = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/kmag-20.08.3.tar.xz";
-      sha256 = "0y44gz3qn91vl840xz25l5kc5jj82k5qqxkgsvvyld2s99rif84k";
-      name = "kmag-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/kmag-20.12.1.tar.xz";
+      sha256 = "0m4zy1ybk2p4wzdfrdf64n06ck39sn7s0nb82miizcpscaxqswhj";
+      name = "kmag-20.12.1.tar.xz";
     };
   };
   kmahjongg = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/kmahjongg-20.08.3.tar.xz";
-      sha256 = "0wgp9m7xzf5ysmrrnyng4p4jypvzfnqkyw62gknl0qhk531cgq3h";
-      name = "kmahjongg-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/kmahjongg-20.12.1.tar.xz";
+      sha256 = "1hszrp81pffg7rp0rk54qx49v3acmqfdi0if47kh9w124iicsi3z";
+      name = "kmahjongg-20.12.1.tar.xz";
     };
   };
   kmail = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/kmail-20.08.3.tar.xz";
-      sha256 = "0g59s7wl0n4bp8kw559rdlamlqxl47qvwfms9kr9ign35rvs0ghg";
-      name = "kmail-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/kmail-20.12.1.tar.xz";
+      sha256 = "128l57x29mqg3fcx50hviqydl7gw6n2zbjnmzrj7fzgl6gafcdgw";
+      name = "kmail-20.12.1.tar.xz";
     };
   };
   kmail-account-wizard = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/kmail-account-wizard-20.08.3.tar.xz";
-      sha256 = "0vama5a02dfgxrl4iz88lbi8dvq3d9b055xil770d90pwp0sljcz";
-      name = "kmail-account-wizard-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/kmail-account-wizard-20.12.1.tar.xz";
+      sha256 = "1gl4pvn7lyyc9rsk70yp5mikpdbakp4zgwx3plypqhmqd1z92pin";
+      name = "kmail-account-wizard-20.12.1.tar.xz";
     };
   };
   kmailtransport = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/kmailtransport-20.08.3.tar.xz";
-      sha256 = "07552qj3ngwvyss7f8cy87c0gmzc47agn54wk85qq0v1fwr73n6z";
-      name = "kmailtransport-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/kmailtransport-20.12.1.tar.xz";
+      sha256 = "08i4fmhkpxil7q6vn045xha54x00jkm19kibphx2q3sb3c6s3plm";
+      name = "kmailtransport-20.12.1.tar.xz";
     };
   };
   kmbox = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/kmbox-20.08.3.tar.xz";
-      sha256 = "0ipmwcicn3qklybqy9v41lh7byn7j62ja8b0xf06z9nliwkk4b0b";
-      name = "kmbox-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/kmbox-20.12.1.tar.xz";
+      sha256 = "1w172gqanhpkmcd9hc62lsmrkylg8mlfyk3nq3n89k6m2dkcfvqd";
+      name = "kmbox-20.12.1.tar.xz";
     };
   };
   kmime = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/kmime-20.08.3.tar.xz";
-      sha256 = "1ndbx712vm4v0fi7p8j28d8z35h3bmsixc97z5r9dg03v1kzd36v";
-      name = "kmime-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/kmime-20.12.1.tar.xz";
+      sha256 = "0hr5mh8a4b9bi0dqs055x4mpig7awqy9sd6j0i8lxix4cngcb6a2";
+      name = "kmime-20.12.1.tar.xz";
     };
   };
   kmines = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/kmines-20.08.3.tar.xz";
-      sha256 = "1mn5hip3vnzmkk1hy14glsplp7f5pm56yv0d5mz25icfgw0xa6lp";
-      name = "kmines-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/kmines-20.12.1.tar.xz";
+      sha256 = "18jzzn03c6mlmc02qg5fimid77b8gs0h4lci6wmj11fmb94g1hic";
+      name = "kmines-20.12.1.tar.xz";
     };
   };
   kmix = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/kmix-20.08.3.tar.xz";
-      sha256 = "00gm93faqmqx0hhkxi3k2pn6sq82k2f622vqgk7mwznkpg66mf4k";
-      name = "kmix-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/kmix-20.12.1.tar.xz";
+      sha256 = "1q1jz33mwnr5nr2mw92g40g7paclaxhwcvqik91la6dnvl0vpi8p";
+      name = "kmix-20.12.1.tar.xz";
     };
   };
   kmousetool = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/kmousetool-20.08.3.tar.xz";
-      sha256 = "09qznykysr42rzz5cmqvhvz91cr8dbzwjd73hwaib2lfs3c2cgbl";
-      name = "kmousetool-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/kmousetool-20.12.1.tar.xz";
+      sha256 = "1nahq9cgffcd4llqc8lwkicxjw8nwphvpws9xkalwsswb7ai9jrk";
+      name = "kmousetool-20.12.1.tar.xz";
     };
   };
   kmouth = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/kmouth-20.08.3.tar.xz";
-      sha256 = "0ajhnl1sjllfb42nyafpirmlgcs6waqp8qxvgsz5dk5zkb8daqmr";
-      name = "kmouth-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/kmouth-20.12.1.tar.xz";
+      sha256 = "0qhparw2qszv7z7lrzb76kyvkcgr9sgry9ir9965dd0sp4c1fhgc";
+      name = "kmouth-20.12.1.tar.xz";
     };
   };
   kmplot = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/kmplot-20.08.3.tar.xz";
-      sha256 = "0cv7q1wmbb3fkf4s6ns4q1il5zr4q02b3xghpp661ma82d8jhjcy";
-      name = "kmplot-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/kmplot-20.12.1.tar.xz";
+      sha256 = "0iz61jjr7z0j5bh5nqdv9nbdbiz0jhda89bxjds0n9636q42rifm";
+      name = "kmplot-20.12.1.tar.xz";
     };
   };
   knavalbattle = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/knavalbattle-20.08.3.tar.xz";
-      sha256 = "1028i8zl5ynm3vvqajsms2hq8gmmjmjc5dc6r3jyh6r964vxq3nq";
-      name = "knavalbattle-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/knavalbattle-20.12.1.tar.xz";
+      sha256 = "0k7kqnc8zp3n0ckrmmih12x6h1vgn9s7hrgp7n37bns2g39ij0xn";
+      name = "knavalbattle-20.12.1.tar.xz";
     };
   };
   knetwalk = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/knetwalk-20.08.3.tar.xz";
-      sha256 = "13pspvi2p68irpbr3f2ck78qmvfl3vahm5qjw2fwhidhpindf9nl";
-      name = "knetwalk-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/knetwalk-20.12.1.tar.xz";
+      sha256 = "0px8yfi5h9nipgdjcgskrm66dr23yg5ks0kyxjsly6mv41qxjiw8";
+      name = "knetwalk-20.12.1.tar.xz";
     };
   };
   knights = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/knights-20.08.3.tar.xz";
-      sha256 = "0zqb87mr2x085hi3r9cvdrx2kvxmclh4ffi1ajcb8v1f79wiwzin";
-      name = "knights-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/knights-20.12.1.tar.xz";
+      sha256 = "098ywblshbr3qx7b8m4qj0036dq3c3mackmsbjnr85acb0204bjb";
+      name = "knights-20.12.1.tar.xz";
     };
   };
   knotes = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/knotes-20.08.3.tar.xz";
-      sha256 = "0ysw8js2s6njilg4v4vqrl1bzcmqvk42l68pzvyflr112zviqz28";
-      name = "knotes-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/knotes-20.12.1.tar.xz";
+      sha256 = "11gfk2p240a2gqxgkn9ymf7ds2zpij8h2vbbkax6ariddmhmlqk0";
+      name = "knotes-20.12.1.tar.xz";
     };
   };
   kolf = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/kolf-20.08.3.tar.xz";
-      sha256 = "1ywyny8iq2sxglsvpgw6p3w3w567k6cw6waywfcfy0lcnfarg1n0";
-      name = "kolf-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/kolf-20.12.1.tar.xz";
+      sha256 = "12b424dl6rizj2pdcd4cr01lmp4kmirii79k40v22hn0yn6a9qdv";
+      name = "kolf-20.12.1.tar.xz";
     };
   };
   kollision = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/kollision-20.08.3.tar.xz";
-      sha256 = "1l8a32bni40jz5jna0ip9ggbx7zp1hhiw2mip7v8f6qc4arbknl8";
-      name = "kollision-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/kollision-20.12.1.tar.xz";
+      sha256 = "1hxv4qd5dl61d5440r4hnd9r24prn78ibmnk3m06c15zc3hfdsdn";
+      name = "kollision-20.12.1.tar.xz";
     };
   };
   kolourpaint = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/kolourpaint-20.08.3.tar.xz";
-      sha256 = "0d64gnnb553rxscr8710h5bx8ijxd87jrbix07k41y79i5x60irh";
-      name = "kolourpaint-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/kolourpaint-20.12.1.tar.xz";
+      sha256 = "1a2wgrf9hirvj61k2nd8x7rv5v8i9r1vrvpdmi9ik4qdg6lpvqay";
+      name = "kolourpaint-20.12.1.tar.xz";
     };
   };
   kompare = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/kompare-20.08.3.tar.xz";
-      sha256 = "0r9m2vcw9hbdkfdy24pfpqs2b5r0jyxh1ma2h66hfv4ycd470ilc";
-      name = "kompare-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/kompare-20.12.1.tar.xz";
+      sha256 = "13di8dzp7xzlfacas5f92h1vwiqf64cd0rkc4yv4l2g8aq2jzcqh";
+      name = "kompare-20.12.1.tar.xz";
     };
   };
   konqueror = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/konqueror-20.08.3.tar.xz";
-      sha256 = "1ssjj83jcbcq8i7wx5zd12z7crh2zg6awbpy38maq3c7747nqz7k";
-      name = "konqueror-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/konqueror-20.12.1.tar.xz";
+      sha256 = "026f8fybr8azq3diw2k3p3qpmqj9lk6n9ipcl3xkwdss7i5v5w3y";
+      name = "konqueror-20.12.1.tar.xz";
     };
   };
   konquest = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/konquest-20.08.3.tar.xz";
-      sha256 = "1wq0j02dzdah6yhx8r2cg191617hid9fs780yr317fprkwkgb8cb";
-      name = "konquest-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/konquest-20.12.1.tar.xz";
+      sha256 = "1s08mvj7z91r86i0zwkcv05fnnr4lzhp596qr38d2yv6rxf5vr57";
+      name = "konquest-20.12.1.tar.xz";
     };
   };
   konsole = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/konsole-20.08.3.tar.xz";
-      sha256 = "0jjidy756x8n456qbm977a73l8229kk8i489jh52296k8pkh6yjx";
-      name = "konsole-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/konsole-20.12.1.tar.xz";
+      sha256 = "1v39sx00c115apnm32wn00yir69z1h0y3lblmjmvbjk24hwvx45n";
+      name = "konsole-20.12.1.tar.xz";
     };
   };
   kontact = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/kontact-20.08.3.tar.xz";
-      sha256 = "0qasgxvq7xps0zxk4hf2sizmy90mxyq70m2pq49pq17ij2pa9ynl";
-      name = "kontact-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/kontact-20.12.1.tar.xz";
+      sha256 = "0dr59jj97zxkgc61zgwa8i26m81sfxvymxcrh5midwd24z8nslkz";
+      name = "kontact-20.12.1.tar.xz";
     };
   };
   kontactinterface = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/kontactinterface-20.08.3.tar.xz";
-      sha256 = "1ah2814js08sm49ykarqdw7z03w4fbym5cc4vwmzimcvh2bc78j3";
-      name = "kontactinterface-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/kontactinterface-20.12.1.tar.xz";
+      sha256 = "0sdlgmwvir2s9ys466i4bj4raf2af43w838and64jwsr9qb1hg4j";
+      name = "kontactinterface-20.12.1.tar.xz";
+    };
+  };
+  kontrast = {
+    version = "20.12.1";
+    src = fetchurl {
+      url = "${mirror}/stable/release-service/20.12.1/src/kontrast-20.12.1.tar.xz";
+      sha256 = "0cs31sn4va2hhfi7ps3bz9sy2hlxb8cawn5vijfdhzb9mmc962br";
+      name = "kontrast-20.12.1.tar.xz";
+    };
+  };
+  konversation = {
+    version = "20.12.1";
+    src = fetchurl {
+      url = "${mirror}/stable/release-service/20.12.1/src/konversation-20.12.1.tar.xz";
+      sha256 = "1x6pyiv73avc3qmxlbnwwzk3gz6qbr991p896f9yb4rqfqj8j7j4";
+      name = "konversation-20.12.1.tar.xz";
     };
   };
   kopete = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/kopete-20.08.3.tar.xz";
-      sha256 = "1lsab66k0xq1g0w0cxcpadmf9kkc09x8wwbv4i8y3aj2mn7849gh";
-      name = "kopete-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/kopete-20.12.1.tar.xz";
+      sha256 = "1cfbl3jalmaphwrzw443l4q5k1fx4nja65ajgrv3nly8rfabfnfl";
+      name = "kopete-20.12.1.tar.xz";
     };
   };
   korganizer = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/korganizer-20.08.3.tar.xz";
-      sha256 = "112h6vn2y9d3q3z62cwg3zrak3xgx9affibc9cvr6fzhp4z0x9ps";
-      name = "korganizer-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/korganizer-20.12.1.tar.xz";
+      sha256 = "1ci6ca6w3a77gf3d7fh9rjkblm5qa2jic176rwmax79qgvjjq8wm";
+      name = "korganizer-20.12.1.tar.xz";
+    };
+  };
+  kosmindoormap = {
+    version = "20.12.1";
+    src = fetchurl {
+      url = "${mirror}/stable/release-service/20.12.1/src/kosmindoormap-20.12.1.tar.xz";
+      sha256 = "186kfqaznxyxqchwqsrb4dvk4v69rhqwfg93fcjsp43l14ml5rnx";
+      name = "kosmindoormap-20.12.1.tar.xz";
     };
   };
   kpat = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/kpat-20.08.3.tar.xz";
-      sha256 = "1id4b9jkphi8pp29gc2vb3n9f0g8kl9yy5v8cnyv3jq673aj0fs9";
-      name = "kpat-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/kpat-20.12.1.tar.xz";
+      sha256 = "1kd3i7qhjwxi04x8dkc7q9rgx73zyx3njm5rhq0hc1v32m8nn659";
+      name = "kpat-20.12.1.tar.xz";
     };
   };
   kpimtextedit = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/kpimtextedit-20.08.3.tar.xz";
-      sha256 = "1m4r5zbhbjvj3za78xfp3dibyf7mp9gan5ir5zd0k2p7adp3i652";
-      name = "kpimtextedit-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/kpimtextedit-20.12.1.tar.xz";
+      sha256 = "15m26qssw80nxv1m51jq3q629nginhh4hb69a5y15jgvrv4k59b4";
+      name = "kpimtextedit-20.12.1.tar.xz";
     };
   };
   kpkpass = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/kpkpass-20.08.3.tar.xz";
-      sha256 = "0zw3xx5mi38za0xbvld97f5bqvwwgyz47kybyrdm7jrhvmmiiiis";
-      name = "kpkpass-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/kpkpass-20.12.1.tar.xz";
+      sha256 = "09idbgf9gnzyr520indlzhwb9pr5hx3dag26qrfi7l8ywzdkrsr2";
+      name = "kpkpass-20.12.1.tar.xz";
+    };
+  };
+  kpmcore = {
+    version = "20.12.1";
+    src = fetchurl {
+      url = "${mirror}/stable/release-service/20.12.1/src/kpmcore-20.12.1.tar.xz";
+      sha256 = "0nyqz1jfr9h9n80npvp7yyizbyga6iv8yljq52myk6b40vs9q41v";
+      name = "kpmcore-20.12.1.tar.xz";
+    };
+  };
+  kpublictransport = {
+    version = "20.12.1";
+    src = fetchurl {
+      url = "${mirror}/stable/release-service/20.12.1/src/kpublictransport-20.12.1.tar.xz";
+      sha256 = "0saqykqb9rrm3ngvcx910dmhyh1hc3n0x3qfzlzrxlq678ag94hq";
+      name = "kpublictransport-20.12.1.tar.xz";
     };
   };
   kqtquickcharts = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/kqtquickcharts-20.08.3.tar.xz";
-      sha256 = "0l7v8vrc7by0w0yshnh21jaqhspmhkvm5cd0hpay6jc9v2azkcf3";
-      name = "kqtquickcharts-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/kqtquickcharts-20.12.1.tar.xz";
+      sha256 = "0025vj4n0k3g5bsmjq6ydx80izvpx6g73jxz27hp69vbl8p4ylpc";
+      name = "kqtquickcharts-20.12.1.tar.xz";
     };
   };
   krdc = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/krdc-20.08.3.tar.xz";
-      sha256 = "1g9lxdldljh5a2s4g7g9b98lij168l99ah0vr6nvdl53n35pfr8n";
-      name = "krdc-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/krdc-20.12.1.tar.xz";
+      sha256 = "067xrhs55di2ff0lxvcl2x7qblmv2pbrgjkc5bjsx6ai6w9bv4dh";
+      name = "krdc-20.12.1.tar.xz";
     };
   };
   kreversi = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/kreversi-20.08.3.tar.xz";
-      sha256 = "0d3y072q61xcik9lf0pz0c9njvarwlvf6hqv5fp5jyqaf2902pmi";
-      name = "kreversi-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/kreversi-20.12.1.tar.xz";
+      sha256 = "1yw9lxzqyxk6fsh2lzsrp2cmdw545hszdz9253lm6b5ppax6z42a";
+      name = "kreversi-20.12.1.tar.xz";
     };
   };
   krfb = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/krfb-20.08.3.tar.xz";
-      sha256 = "13nypbcdhh53wq72w59z5q46a09g1w4yyi1pmsjwa8r7jnk8cafk";
-      name = "krfb-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/krfb-20.12.1.tar.xz";
+      sha256 = "0pfxd0nci9g4wkh4qcgk3yhm9rl9yx2d4jpfxgdmiacfp9hkqxj6";
+      name = "krfb-20.12.1.tar.xz";
     };
   };
   kross-interpreters = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/kross-interpreters-20.08.3.tar.xz";
-      sha256 = "0mr5vpbbcv66s6dyrrypy1ai6ba744z8cn4r0iwys35p6am075qj";
-      name = "kross-interpreters-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/kross-interpreters-20.12.1.tar.xz";
+      sha256 = "1csk3xkkkqvffms5ivy08hyd2mizg7ywcrdapxx40m5kwsn6vpxs";
+      name = "kross-interpreters-20.12.1.tar.xz";
     };
   };
   kruler = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/kruler-20.08.3.tar.xz";
-      sha256 = "1vhl8acccdqfdj7lci8r2mig9qf1js4f8v7b4fqljpnc3gdg8749";
-      name = "kruler-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/kruler-20.12.1.tar.xz";
+      sha256 = "1jiz9s647bndpi4gg3f7wwg0c0cv8wf1myjxwdpx5a0ggdr2xh3q";
+      name = "kruler-20.12.1.tar.xz";
     };
   };
   kshisen = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/kshisen-20.08.3.tar.xz";
-      sha256 = "1vy8qh8s60a4ikyw3sh4cbr3p3fk35d4dwdqc263gn4skyrsb1l9";
-      name = "kshisen-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/kshisen-20.12.1.tar.xz";
+      sha256 = "1awnpj66080g2y41014g2pgb5llyqw56b54z6ydhfya4a0a8gsds";
+      name = "kshisen-20.12.1.tar.xz";
     };
   };
   ksirk = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/ksirk-20.08.3.tar.xz";
-      sha256 = "1kxc1b05r8x6pvaiwpvjpgrr88qkm5qs4d3s1ym8rki60c724qpl";
-      name = "ksirk-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/ksirk-20.12.1.tar.xz";
+      sha256 = "11bcmxjjyf095i790f5r3cr5hskw2x9458vwfm7yd57qx3r01axz";
+      name = "ksirk-20.12.1.tar.xz";
     };
   };
   ksmtp = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/ksmtp-20.08.3.tar.xz";
-      sha256 = "1p9clzvmsym2fijwvs3s0zqx57bk82mlks52j5ni3il6lvklaayc";
-      name = "ksmtp-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/ksmtp-20.12.1.tar.xz";
+      sha256 = "1yahcgchfhk742n6hmpr2b2fll6jrw0vs1hrfvms3n7w7vxnkyxg";
+      name = "ksmtp-20.12.1.tar.xz";
     };
   };
   ksnakeduel = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/ksnakeduel-20.08.3.tar.xz";
-      sha256 = "03ydbwknn20gadjpwcw0z8zw777hgj8j10w4gvp2dwpb07rdg1pn";
-      name = "ksnakeduel-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/ksnakeduel-20.12.1.tar.xz";
+      sha256 = "1647m2a918kr762fmvffj2ipamhvcihc8yg8z80b8lwinpspcdfc";
+      name = "ksnakeduel-20.12.1.tar.xz";
     };
   };
   kspaceduel = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/kspaceduel-20.08.3.tar.xz";
-      sha256 = "1ii3lnxd11d3ihl8j1abh9qn9q0qq8ra9hbrwjs5df2kk36bnirj";
-      name = "kspaceduel-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/kspaceduel-20.12.1.tar.xz";
+      sha256 = "17i2saa48xq62j0aca555lqjxf6ry3wkxw5vm5v32g3kwkr10m78";
+      name = "kspaceduel-20.12.1.tar.xz";
     };
   };
   ksquares = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/ksquares-20.08.3.tar.xz";
-      sha256 = "1ch7lbylzb9ngdzvpzqq5f30gkm2l4rzk6iqa8xm53rawr7jjqcy";
-      name = "ksquares-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/ksquares-20.12.1.tar.xz";
+      sha256 = "085bvcx5p13j32017c0vm3zvcr0r0dzcbxpp21mvrp1xzy2dw7v2";
+      name = "ksquares-20.12.1.tar.xz";
     };
   };
   ksudoku = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/ksudoku-20.08.3.tar.xz";
-      sha256 = "0hnqbd3krxi3zwj8p4n9ydhwfwhw8wljhjdfv0llv0nhj1wb89p9";
-      name = "ksudoku-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/ksudoku-20.12.1.tar.xz";
+      sha256 = "0a0i87ddxa75admnxl181dsqmab4cwbb6pncl34z4sppf272z8km";
+      name = "ksudoku-20.12.1.tar.xz";
     };
   };
   ksystemlog = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/ksystemlog-20.08.3.tar.xz";
-      sha256 = "11fc2mn4hkcibpxp7s2gihpp05yix7ws84a0bm6vjiqlidmrk192";
-      name = "ksystemlog-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/ksystemlog-20.12.1.tar.xz";
+      sha256 = "0535s6sq4wccdxv0xw12x3zzjkp0746s3hmlk93sginwq5fixxc0";
+      name = "ksystemlog-20.12.1.tar.xz";
     };
   };
   kteatime = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/kteatime-20.08.3.tar.xz";
-      sha256 = "1vj738s2a7nnrvxi847mdmn1vg79kh9k8gqaflcwnvyxanf6n4f7";
-      name = "kteatime-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/kteatime-20.12.1.tar.xz";
+      sha256 = "0j9c3wy398z61ciyf91hv7l3bxski827di9ib94wyjkwqd6516zx";
+      name = "kteatime-20.12.1.tar.xz";
     };
   };
   ktimer = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/ktimer-20.08.3.tar.xz";
-      sha256 = "1rc1z93s24b7p2ixr4xbpg0sj8ls90gzfijwj9f8b0lrwd905ysv";
-      name = "ktimer-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/ktimer-20.12.1.tar.xz";
+      sha256 = "0iac06mzszg6g1flbs0mzj8ddnvh6kdgbhakjxl969in4c1frz9w";
+      name = "ktimer-20.12.1.tar.xz";
     };
   };
   ktnef = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/ktnef-20.08.3.tar.xz";
-      sha256 = "1lj93sqyi522k91jiyf7d26vx5sgn5njhyaf8plsfz5rj82dw1m4";
-      name = "ktnef-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/ktnef-20.12.1.tar.xz";
+      sha256 = "1pq4mabh7glpxl2iwj5rrfwim4x6xfg2vlpx7z0d0n13gh85b4fd";
+      name = "ktnef-20.12.1.tar.xz";
+    };
+  };
+  ktorrent = {
+    version = "20.12.1";
+    src = fetchurl {
+      url = "${mirror}/stable/release-service/20.12.1/src/ktorrent-20.12.1.tar.xz";
+      sha256 = "0m43wsz0k87ncvg3zdffsp06nwdrlfnw52fi1ry12z2rnkcm4pwc";
+      name = "ktorrent-20.12.1.tar.xz";
     };
   };
   ktouch = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/ktouch-20.08.3.tar.xz";
-      sha256 = "1ssxd7f75866rn5k192bnm016d8674q13ibcgmaxqsmr7wqkyd39";
-      name = "ktouch-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/ktouch-20.12.1.tar.xz";
+      sha256 = "10lm2p8w26c9n6lhvw3301myfss0dq7hl7rawzb3hsy1lqvmvdib";
+      name = "ktouch-20.12.1.tar.xz";
     };
   };
   ktp-accounts-kcm = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/ktp-accounts-kcm-20.08.3.tar.xz";
-      sha256 = "0039svbzx7fphyk6cw4hb8k4h7l6q31pbwvp6pvls450rycz8i8y";
-      name = "ktp-accounts-kcm-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/ktp-accounts-kcm-20.12.1.tar.xz";
+      sha256 = "0440s2rrh03x8h5bp6xywidngrb1pinndsigaj4k4yvz122j2y53";
+      name = "ktp-accounts-kcm-20.12.1.tar.xz";
     };
   };
   ktp-approver = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/ktp-approver-20.08.3.tar.xz";
-      sha256 = "1kqsdw7vkcd0ka98y2r7qz7dp5hsrr2m8k1xlh3gpj7fdxpla2bh";
-      name = "ktp-approver-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/ktp-approver-20.12.1.tar.xz";
+      sha256 = "14ygpqvjhyzryrlinz0i2a6nyn1gnxs0hwx35imiz8hg4sb9402k";
+      name = "ktp-approver-20.12.1.tar.xz";
     };
   };
   ktp-auth-handler = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/ktp-auth-handler-20.08.3.tar.xz";
-      sha256 = "0wbhg458ysipwma8sygimasq71sbrzmx3vwqi51ai8y5hwrx04j4";
-      name = "ktp-auth-handler-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/ktp-auth-handler-20.12.1.tar.xz";
+      sha256 = "1bysipq957kqbl33zj88m1g987b02v25gmh5lpnmrnlqznxw0ws7";
+      name = "ktp-auth-handler-20.12.1.tar.xz";
     };
   };
   ktp-call-ui = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/ktp-call-ui-20.08.3.tar.xz";
-      sha256 = "1fh8bz9kc6f8v28x12xp3vw19swgcq07zyjzhd6qcnwf1bv6gl7i";
-      name = "ktp-call-ui-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/ktp-call-ui-20.12.1.tar.xz";
+      sha256 = "154zgg84ln823al40s5fwxf10k3p73mz4fjn2lyhdqgsx68l08sy";
+      name = "ktp-call-ui-20.12.1.tar.xz";
     };
   };
   ktp-common-internals = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/ktp-common-internals-20.08.3.tar.xz";
-      sha256 = "193yx4g1fwlwysy5scb7m24wqmvwmfyyb9sv7arw7zn5czlg480z";
-      name = "ktp-common-internals-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/ktp-common-internals-20.12.1.tar.xz";
+      sha256 = "1f8l1ywccxga3ff8qvf4ybabkd57apidkx7ky49dfi785kgvym16";
+      name = "ktp-common-internals-20.12.1.tar.xz";
     };
   };
   ktp-contact-list = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/ktp-contact-list-20.08.3.tar.xz";
-      sha256 = "0093z17r1xqlb1zlgxfayrnrkyl8zmnnasfd8i97dx712wmbbxxa";
-      name = "ktp-contact-list-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/ktp-contact-list-20.12.1.tar.xz";
+      sha256 = "122p2xp6wqmvk7mbplgnilsbnk6hfzrgbxpr39n462pkwbmvs44j";
+      name = "ktp-contact-list-20.12.1.tar.xz";
     };
   };
   ktp-contact-runner = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/ktp-contact-runner-20.08.3.tar.xz";
-      sha256 = "063jylnq3gm0s0jh1xs6b591a161sb6gdi840l40mqlhhg7i8x55";
-      name = "ktp-contact-runner-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/ktp-contact-runner-20.12.1.tar.xz";
+      sha256 = "1w8jp1nmjwaaqpim2jfpbv3d7w9asn93qi2ag2d6wx6mcc2q84jb";
+      name = "ktp-contact-runner-20.12.1.tar.xz";
     };
   };
   ktp-desktop-applets = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/ktp-desktop-applets-20.08.3.tar.xz";
-      sha256 = "1i69qzfa455phjnd5ycflyggcbq7ycn2cc7a3ni5195isjzq6r6s";
-      name = "ktp-desktop-applets-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/ktp-desktop-applets-20.12.1.tar.xz";
+      sha256 = "0z3vv7q5kk27fm32bmhffpj6w72mldcdxsq6p3d33zf6rkz2rb74";
+      name = "ktp-desktop-applets-20.12.1.tar.xz";
     };
   };
   ktp-filetransfer-handler = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/ktp-filetransfer-handler-20.08.3.tar.xz";
-      sha256 = "0a26ziacl3fkd0a0h1579jnwjzjlsz0zymj9k4da4sb60zad5y72";
-      name = "ktp-filetransfer-handler-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/ktp-filetransfer-handler-20.12.1.tar.xz";
+      sha256 = "0b8ha1jxhrdk67mzwrd0ypz99shlfr6sanxbbv0j3xh77sjcqpq3";
+      name = "ktp-filetransfer-handler-20.12.1.tar.xz";
     };
   };
   ktp-kded-module = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/ktp-kded-module-20.08.3.tar.xz";
-      sha256 = "105vh6b7a0v02arksbwxn30slpcg11cpvb7dqmvf041iyr13sqsv";
-      name = "ktp-kded-module-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/ktp-kded-module-20.12.1.tar.xz";
+      sha256 = "1hbb5pj3gaw9sg5rj2rb7a8xqrixfhr040rcdjsln337zyy98iqf";
+      name = "ktp-kded-module-20.12.1.tar.xz";
     };
   };
   ktp-send-file = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/ktp-send-file-20.08.3.tar.xz";
-      sha256 = "08pp3029jplc6rcbav40cgy787gn3jjl312gbgvnwzglxaqvcg4b";
-      name = "ktp-send-file-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/ktp-send-file-20.12.1.tar.xz";
+      sha256 = "1vgfqa062h5yxdsz71h2zz247mzv6mn0zm7dz1v8p4pzns9kscq1";
+      name = "ktp-send-file-20.12.1.tar.xz";
     };
   };
   ktp-text-ui = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/ktp-text-ui-20.08.3.tar.xz";
-      sha256 = "1anxl9wa5ndyi9r9w0kpivx8nv1xpx28xjvkdplkc75cc1wl88sw";
-      name = "ktp-text-ui-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/ktp-text-ui-20.12.1.tar.xz";
+      sha256 = "13cx2pv4wqmrgbi4sg51fhp418r50ajjhc9yz5mv7ad2gxml5c61";
+      name = "ktp-text-ui-20.12.1.tar.xz";
     };
   };
   ktuberling = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/ktuberling-20.08.3.tar.xz";
-      sha256 = "0q6ynmn6w5q65a77fq8n9vxqswrimln22b1zfgxmb2i3qwnhkrmz";
-      name = "ktuberling-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/ktuberling-20.12.1.tar.xz";
+      sha256 = "06la1cvwvpiqjdwv7icdg55dd8pkc587bfwwjdq2fhp2pyh3ws6j";
+      name = "ktuberling-20.12.1.tar.xz";
     };
   };
   kturtle = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/kturtle-20.08.3.tar.xz";
-      sha256 = "0riv76vwvz94zixqhhwkxw8sz2r2xqai39yh9hr31d28q9rza384";
-      name = "kturtle-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/kturtle-20.12.1.tar.xz";
+      sha256 = "12jr4sbchjpvc730cy4bp2cccdsd8vw901dgyq0nar8p0pvg4ybb";
+      name = "kturtle-20.12.1.tar.xz";
     };
   };
   kubrick = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/kubrick-20.08.3.tar.xz";
-      sha256 = "03k73gr33dr3va69vc70fsfcdwkqz70bg87yk2l2j33x8wsgl4wx";
-      name = "kubrick-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/kubrick-20.12.1.tar.xz";
+      sha256 = "1hdkm9vw9wpc8b3mw0yy9cz5ylm0h75zbg51rw4glai48bb3gs8i";
+      name = "kubrick-20.12.1.tar.xz";
     };
   };
   kwalletmanager = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/kwalletmanager-20.08.3.tar.xz";
-      sha256 = "1l07vxl2x3jl8553rbvr3p0k3rc95nmrw4vhxxynl3102xshrg5i";
-      name = "kwalletmanager-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/kwalletmanager-20.12.1.tar.xz";
+      sha256 = "0nsg2xjzz6qvjqpxj1bbzzikvcl1ipqjwwab2kdwg71vlp99ravj";
+      name = "kwalletmanager-20.12.1.tar.xz";
     };
   };
   kwave = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/kwave-20.08.3.tar.xz";
-      sha256 = "0zk8ik03qcc6y0vhpih8sk2jpkxwxalmqmaan2767k9h92grdpc8";
-      name = "kwave-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/kwave-20.12.1.tar.xz";
+      sha256 = "1w5r7di9401dm60p3bkp8qg41pvlz4226szki5s6pmmq89dixdgq";
+      name = "kwave-20.12.1.tar.xz";
     };
   };
   kwordquiz = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/kwordquiz-20.08.3.tar.xz";
-      sha256 = "1kiqk3xyd0l7kqdxqjqs8mw4drcdbdri9xxi5gcav57ndcinknqb";
-      name = "kwordquiz-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/kwordquiz-20.12.1.tar.xz";
+      sha256 = "1dvbvfwaja4n2v9binj8pbdjizqz4zp49fiq8b4k5jxygcsgnx2p";
+      name = "kwordquiz-20.12.1.tar.xz";
     };
   };
   libgravatar = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/libgravatar-20.08.3.tar.xz";
-      sha256 = "09dvx2rb1j7q4r0gkbhz0vjk8ya3njqprpjqdhwcq7xwc2j9h0hr";
-      name = "libgravatar-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/libgravatar-20.12.1.tar.xz";
+      sha256 = "12byf7p0fwsfy61gcv112bhq3zczjy5n1dm32x2lrjyis2dh2z9j";
+      name = "libgravatar-20.12.1.tar.xz";
     };
   };
   libkcddb = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/libkcddb-20.08.3.tar.xz";
-      sha256 = "0r36hs79hmq0znsds0d04lj7ffs6l2d866kyn1z1fdwr9b3crirg";
-      name = "libkcddb-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/libkcddb-20.12.1.tar.xz";
+      sha256 = "07ky4ly72689gb58jxqqzq5bgmb9wslxkqj0ldam6v82ldk8ss7k";
+      name = "libkcddb-20.12.1.tar.xz";
     };
   };
   libkcompactdisc = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/libkcompactdisc-20.08.3.tar.xz";
-      sha256 = "1nglk3kbx5czqla3cnpnf1fk71pf2cl9h6rgb40ak1xw4z31d456";
-      name = "libkcompactdisc-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/libkcompactdisc-20.12.1.tar.xz";
+      sha256 = "101szps2js8dhxdn913mj9b2z953rp47ikkbrrdjl1fq1i8dh6ib";
+      name = "libkcompactdisc-20.12.1.tar.xz";
     };
   };
   libkdcraw = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/libkdcraw-20.08.3.tar.xz";
-      sha256 = "1806i99qsrmixdg5b0hyi8h55fk00q6wxsnrblbwcmsb268jddp7";
-      name = "libkdcraw-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/libkdcraw-20.12.1.tar.xz";
+      sha256 = "1vkjyccyax622a3jvqdfnppansabxaxplyk9prn302zqmgvl05h3";
+      name = "libkdcraw-20.12.1.tar.xz";
     };
   };
   libkdegames = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/libkdegames-20.08.3.tar.xz";
-      sha256 = "1ccbcwwqb53bgqlr1rq9plpw21mipxp8rsi1f7l0p1jzpw054p08";
-      name = "libkdegames-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/libkdegames-20.12.1.tar.xz";
+      sha256 = "1zy44k98xjjydsa35bagf152kfb394wxpdx0c06vcf404jkhk7ng";
+      name = "libkdegames-20.12.1.tar.xz";
     };
   };
   libkdepim = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/libkdepim-20.08.3.tar.xz";
-      sha256 = "1v77g02v5sdqprh8psx5xpjgf8v91il60ca59yivm5jvc3hdf3f6";
-      name = "libkdepim-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/libkdepim-20.12.1.tar.xz";
+      sha256 = "0kp2xssl1qbl3ziskxl3hhvyp8nc35d2fijk6hl99j3sxpdi2s4f";
+      name = "libkdepim-20.12.1.tar.xz";
     };
   };
   libkeduvocdocument = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/libkeduvocdocument-20.08.3.tar.xz";
-      sha256 = "0ghkx6x5sn5fl934ybhl32knwv9zky0n1vkjw2w93lpms45xmw76";
-      name = "libkeduvocdocument-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/libkeduvocdocument-20.12.1.tar.xz";
+      sha256 = "0kqnhaabfi91clqg7nlnjcybl5ca0p3ysn5zlwhxz1fcjxm83g4w";
+      name = "libkeduvocdocument-20.12.1.tar.xz";
     };
   };
   libkexiv2 = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/libkexiv2-20.08.3.tar.xz";
-      sha256 = "1lh3947w6xgzl2r1wm6m4kd478q6bv89f0c3c38ldv30imfw7rfl";
-      name = "libkexiv2-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/libkexiv2-20.12.1.tar.xz";
+      sha256 = "1vylyl3gxk3xais7c640kdnp4s4jwd9y2xxkwmf36ax0dv8wdcv0";
+      name = "libkexiv2-20.12.1.tar.xz";
     };
   };
   libkgapi = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/libkgapi-20.08.3.tar.xz";
-      sha256 = "1kmgf9v9rvb67l7aw5xsx7v44l4pz8rl6p09lk26irq7gd4k68la";
-      name = "libkgapi-20.08.3.tar.xz";
-    };
-  };
-  libkgeomap = {
-    version = "20.08.3";
-    src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/libkgeomap-20.08.3.tar.xz";
-      sha256 = "14ipksxnvgk2s1sw7a70153iy9aik9mf4i7k8y3pzdr3l3155ayk";
-      name = "libkgeomap-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/libkgapi-20.12.1.tar.xz";
+      sha256 = "0cx8lbzq8ambz2lbslakczzcfmhri4268p7zf7hnf3ymd17a5y8d";
+      name = "libkgapi-20.12.1.tar.xz";
     };
   };
   libkipi = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/libkipi-20.08.3.tar.xz";
-      sha256 = "1b5qby7xm926qnzrf1zpb89fwx1a2syhqnznmdjxifj499p1jqjb";
-      name = "libkipi-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/libkipi-20.12.1.tar.xz";
+      sha256 = "1ln4f1n9ghiqb9h4lpw6qcwz7wrvm8jlcqn1ingjh9s58zw8wqsg";
+      name = "libkipi-20.12.1.tar.xz";
     };
   };
   libkleo = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/libkleo-20.08.3.tar.xz";
-      sha256 = "1d6dal4qnrikg6ma2ird4b2sdivqqkkhamvd3s1srcxppc3aiq79";
-      name = "libkleo-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/libkleo-20.12.1.tar.xz";
+      sha256 = "0dq86pg0jchlpsynk0355wwq3pggqkj0mxhyvgi6a0xb2riy2r4a";
+      name = "libkleo-20.12.1.tar.xz";
     };
   };
   libkmahjongg = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/libkmahjongg-20.08.3.tar.xz";
-      sha256 = "0xabp1vzbzs52m3bb9nzm1d9md1n4j4pr13izn6nv28ja7477nnm";
-      name = "libkmahjongg-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/libkmahjongg-20.12.1.tar.xz";
+      sha256 = "0cq0bcl7hkgj1v7giqzbrvlds2933ji52fg53cakz29fkgxibj3x";
+      name = "libkmahjongg-20.12.1.tar.xz";
     };
   };
   libkomparediff2 = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/libkomparediff2-20.08.3.tar.xz";
-      sha256 = "0nk0jkf0jwaz1yqzzp44c6xyjgw42gclkcvw8w61w1f8sdl40wb8";
-      name = "libkomparediff2-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/libkomparediff2-20.12.1.tar.xz";
+      sha256 = "04klqvhh8zl5lyblpqgm92wycq4r0hh6gx18nqnsgx6lknlrx9y3";
+      name = "libkomparediff2-20.12.1.tar.xz";
     };
   };
   libksane = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/libksane-20.08.3.tar.xz";
-      sha256 = "0d2cnmvk16g1vnx9jd7jvp3bpw07ss54khmhqip8iskkvcfll9j0";
-      name = "libksane-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/libksane-20.12.1.tar.xz";
+      sha256 = "07xsfs0lkh35nj0fy7y1r46nkdmm26nbpsm846v18lh7wflxi36j";
+      name = "libksane-20.12.1.tar.xz";
     };
   };
   libksieve = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/libksieve-20.08.3.tar.xz";
-      sha256 = "0bhpdqynazssql2iivvpb9l8npa441345gcn59fc0va6barl9sam";
-      name = "libksieve-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/libksieve-20.12.1.tar.xz";
+      sha256 = "07zgcsdl38fdy5pskp51rj5p7m3pz9szwidyg24mdyzb08k5xpdz";
+      name = "libksieve-20.12.1.tar.xz";
+    };
+  };
+  libktorrent = {
+    version = "20.12.1";
+    src = fetchurl {
+      url = "${mirror}/stable/release-service/20.12.1/src/libktorrent-20.12.1.tar.xz";
+      sha256 = "18mcrb064gizqb699cs9bvm918gg06wm6sq33pi87kwki5cniamv";
+      name = "libktorrent-20.12.1.tar.xz";
     };
   };
   lokalize = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/lokalize-20.08.3.tar.xz";
-      sha256 = "0iab8sd1qh7h0zna7lc3v43z6rcmxba9v4nynhl5miiac4r6ddr8";
-      name = "lokalize-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/lokalize-20.12.1.tar.xz";
+      sha256 = "0mxzk9s0yrjf8gj70dpl1wbvnrkzc3ncqab2bj3yx0xk05hagjlx";
+      name = "lokalize-20.12.1.tar.xz";
     };
   };
   lskat = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/lskat-20.08.3.tar.xz";
-      sha256 = "1rcmh592w5gd5b69czfxycypidj74y2d91cw92rccariadz9vnjz";
-      name = "lskat-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/lskat-20.12.1.tar.xz";
+      sha256 = "0p8n2cgfdxxjbx4jcpqf85h6k36nggj32h982yj3ig5dh1csym5d";
+      name = "lskat-20.12.1.tar.xz";
     };
   };
   mailcommon = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/mailcommon-20.08.3.tar.xz";
-      sha256 = "0bhs60cz4qcrqkmw2sm6cd2laq8lzj9vcwi8kjqkajsidh342wdv";
-      name = "mailcommon-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/mailcommon-20.12.1.tar.xz";
+      sha256 = "191d6l314njlj227qhz7qqmkjkz9zm7xnvm9rlfj302san90a338";
+      name = "mailcommon-20.12.1.tar.xz";
     };
   };
   mailimporter = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/mailimporter-20.08.3.tar.xz";
-      sha256 = "0w6yfgqx0adlkwx32vmb23kl6n50737jiabmad3pnhqw8rv41h80";
-      name = "mailimporter-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/mailimporter-20.12.1.tar.xz";
+      sha256 = "0jqdckpwlipc4zxxwnvysl44ri19h0hgr37dp36k99sxa3688jxc";
+      name = "mailimporter-20.12.1.tar.xz";
     };
   };
   marble = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/marble-20.08.3.tar.xz";
-      sha256 = "1xpxgy724z97k063fdk0l3mrl8i6nvnhj35b4987jqji76i92ffb";
-      name = "marble-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/marble-20.12.1.tar.xz";
+      sha256 = "0w398igxx7pmyd4bj65ppbxfc4fiz4hsjmcffya88dnxxz73djb5";
+      name = "marble-20.12.1.tar.xz";
+    };
+  };
+  markdownpart = {
+    version = "20.12.1";
+    src = fetchurl {
+      url = "${mirror}/stable/release-service/20.12.1/src/markdownpart-20.12.1.tar.xz";
+      sha256 = "1389hswbhcssl9ybb605h9i50fv6jajggldkiyfwqxbi7aysghwk";
+      name = "markdownpart-20.12.1.tar.xz";
     };
   };
   mbox-importer = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/mbox-importer-20.08.3.tar.xz";
-      sha256 = "1qh0f93df228cqlcqdwc7g6im3g0gkfmzir3ccsmb5iv0ygvjl6f";
-      name = "mbox-importer-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/mbox-importer-20.12.1.tar.xz";
+      sha256 = "1kgbiq933f93sb8m2nqmpp1x6qkqqcm2hcb3ihk5741dcpdmxx9n";
+      name = "mbox-importer-20.12.1.tar.xz";
     };
   };
   messagelib = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/messagelib-20.08.3.tar.xz";
-      sha256 = "16amni6qrq96h8jr313gc7k9frwr20d4pk9y2i61a1xm2w3xsqd4";
-      name = "messagelib-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/messagelib-20.12.1.tar.xz";
+      sha256 = "0yjh7s80ksyyi78vxjw4i5f1bmsfziphwm6flgnw18gfzj3pyyy7";
+      name = "messagelib-20.12.1.tar.xz";
     };
   };
   minuet = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/minuet-20.08.3.tar.xz";
-      sha256 = "1l45g7labnyz0pkwcfhjl5a3ypr7cy3bsshr06ab85364yjwazvi";
-      name = "minuet-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/minuet-20.12.1.tar.xz";
+      sha256 = "13jlz2m57x379zyv4x5zk2h6jc0qcz1zymkyrzs431bfmhyhdna2";
+      name = "minuet-20.12.1.tar.xz";
     };
   };
   okular = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/okular-20.08.3.tar.xz";
-      sha256 = "1q59ikcwsfgjc0202daingxv15iarnzba6szdncznzcafd6hhk9z";
-      name = "okular-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/okular-20.12.1.tar.xz";
+      sha256 = "0gpm7n47yijsjg4yba561j5pbvd98hgvr93w1kvzk851nb87m89c";
+      name = "okular-20.12.1.tar.xz";
     };
   };
   palapeli = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/palapeli-20.08.3.tar.xz";
-      sha256 = "107z3izfznrq7g5aqb5a7r8a4ibaia90g334d7wwvd7prm7hdgfp";
-      name = "palapeli-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/palapeli-20.12.1.tar.xz";
+      sha256 = "05d3f0snbg0iz78ggxk7hv1qn3blvpnpclhrhzcw1c5znr7al2xm";
+      name = "palapeli-20.12.1.tar.xz";
     };
   };
   parley = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/parley-20.08.3.tar.xz";
-      sha256 = "0wli09zkk5z50y1gzp5wc9k056xjaadlq97j09lf6lqyg6kb56ya";
-      name = "parley-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/parley-20.12.1.tar.xz";
+      sha256 = "00xc1dv3fj783brfqh3ggvrwv26m840k35vrx2izzq5lqx2g1p5a";
+      name = "parley-20.12.1.tar.xz";
+    };
+  };
+  partitionmanager = {
+    version = "20.12.1";
+    src = fetchurl {
+      url = "${mirror}/stable/release-service/20.12.1/src/partitionmanager-20.12.1.tar.xz";
+      sha256 = "1zypkah2smmqclni2r8571sd6qd5cbc0915r6gzf800yyccsfb65";
+      name = "partitionmanager-20.12.1.tar.xz";
     };
   };
   picmi = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/picmi-20.08.3.tar.xz";
-      sha256 = "1lkpazsi9dyb2y9q5bk56d80x7x035rf4hdap25i8qfj3ilykv3w";
-      name = "picmi-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/picmi-20.12.1.tar.xz";
+      sha256 = "0aiaq99sb57vvz5wjwdwm0jj456nj26qs4m6vwibb1f0f8js4i03";
+      name = "picmi-20.12.1.tar.xz";
     };
   };
   pimcommon = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/pimcommon-20.08.3.tar.xz";
-      sha256 = "0mpl7li2y5xjzk4hdb85d1x7cz15cicd91c1krlw74q7pbrjinlq";
-      name = "pimcommon-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/pimcommon-20.12.1.tar.xz";
+      sha256 = "1w5avmvssqnvxl31xrlh1xfns6q386w8ixlzfbzjkz5m95m4wr57";
+      name = "pimcommon-20.12.1.tar.xz";
     };
   };
   pim-data-exporter = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/pim-data-exporter-20.08.3.tar.xz";
-      sha256 = "0f08c16d3730fbdsbrwlr9w5c4l9xcmd1bdbv5m38h5r2ddlkvzr";
-      name = "pim-data-exporter-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/pim-data-exporter-20.12.1.tar.xz";
+      sha256 = "0k9lh3llkzx0n5x8q14hkbjjrkczm10kr246bzr1zz8lcv1za1jc";
+      name = "pim-data-exporter-20.12.1.tar.xz";
     };
   };
   pim-sieve-editor = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/pim-sieve-editor-20.08.3.tar.xz";
-      sha256 = "1falzw2a2v912fdzlyljsw9rcy1whrn9ys9ccrskkpvjn8y444x4";
-      name = "pim-sieve-editor-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/pim-sieve-editor-20.12.1.tar.xz";
+      sha256 = "0lifarfkpcpdvwmn61gmfd45k5i0dbf3sjrb0z1yaqsq7m158di1";
+      name = "pim-sieve-editor-20.12.1.tar.xz";
     };
   };
   poxml = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/poxml-20.08.3.tar.xz";
-      sha256 = "0gzg3vbsjrfhs1jg59g7b3gf3b4qajiffkb94njkz8v1f0fadlxp";
-      name = "poxml-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/poxml-20.12.1.tar.xz";
+      sha256 = "1smjvblx0jcv3afs2sr4qcmvhqd44iw24hvr9fppa3nxhrmjwmlk";
+      name = "poxml-20.12.1.tar.xz";
     };
   };
   print-manager = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/print-manager-20.08.3.tar.xz";
-      sha256 = "18nl9gpmzz4g9fqzyvbh858nxz23b2vyi505qacqvcrz13r0l78z";
-      name = "print-manager-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/print-manager-20.12.1.tar.xz";
+      sha256 = "1nx442bi41gd64i4j0nc8hx0wdv6ayvnp2wydn4l7sgsf0ms4x6y";
+      name = "print-manager-20.12.1.tar.xz";
     };
   };
   rocs = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/rocs-20.08.3.tar.xz";
-      sha256 = "0bd9x7kh2s4z79ff9byd3ly7k040c574zwrrgi8sq21yd531hxhj";
-      name = "rocs-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/rocs-20.12.1.tar.xz";
+      sha256 = "11gg2pmx21wfrw63qv7w8bjzcsxf86j5ripa2dwqfl3355wvi5mb";
+      name = "rocs-20.12.1.tar.xz";
     };
   };
   signon-kwallet-extension = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/signon-kwallet-extension-20.08.3.tar.xz";
-      sha256 = "1s0syq9aw2q34k1wxrpjqqi12xay1h0vc4s2d8l184hzzg8qq71i";
-      name = "signon-kwallet-extension-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/signon-kwallet-extension-20.12.1.tar.xz";
+      sha256 = "0m48a5mqmwrjl4wc4m30n5csl7fwp8g70pv0nib0v36lp0424xjb";
+      name = "signon-kwallet-extension-20.12.1.tar.xz";
     };
   };
   spectacle = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/spectacle-20.08.3.tar.xz";
-      sha256 = "16dwbsk9hik7gmz9s4x78hibz4x9d1fpx8x2i2giry5hwzknfcw4";
-      name = "spectacle-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/spectacle-20.12.1.tar.xz";
+      sha256 = "04jsm0ipfaccc80qxnhhbfc9fn009cxa7dys89iqfqza6ssvq51l";
+      name = "spectacle-20.12.1.tar.xz";
     };
   };
   step = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/step-20.08.3.tar.xz";
-      sha256 = "05ljsmgpra1az64yddy8idi46cv3afaf2v4n7d5j81a8vvlz7fj1";
-      name = "step-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/step-20.12.1.tar.xz";
+      sha256 = "05xj4zv4r82nnz5rzb0rmrps4dagnkw9f5lapil5mi1i1gwqfi2k";
+      name = "step-20.12.1.tar.xz";
     };
   };
   svgpart = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/svgpart-20.08.3.tar.xz";
-      sha256 = "0wwq576dblqmfknr0qs8kskw7nar6hah95fqicdn97xdy4nvzhc6";
-      name = "svgpart-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/svgpart-20.12.1.tar.xz";
+      sha256 = "09n0pf5saww8gppmd501i3dfr13yvn4r2rfbdz42zlvcpcpgxdry";
+      name = "svgpart-20.12.1.tar.xz";
     };
   };
   sweeper = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/sweeper-20.08.3.tar.xz";
-      sha256 = "0i4zvbljdzkj47vh8kizam7vsc9k7mvf8dqd2j6ixr4p0cqvw5a8";
-      name = "sweeper-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/sweeper-20.12.1.tar.xz";
+      sha256 = "06a9a9vbkfhmlcc927ysa0qnp5qqbl5iywhkgbvyz90nsdaw3jjl";
+      name = "sweeper-20.12.1.tar.xz";
     };
   };
   umbrello = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/umbrello-20.08.3.tar.xz";
-      sha256 = "1hh5gyggb4f3pjip8dfvx00hi83gj65c92jgzkzahj7p35mkplgl";
-      name = "umbrello-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/umbrello-20.12.1.tar.xz";
+      sha256 = "07fxxyw5zn1xj05kjr16rkgpj7ms9xvgpj4zlg428037gfa8g9vl";
+      name = "umbrello-20.12.1.tar.xz";
     };
   };
   yakuake = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/yakuake-20.08.3.tar.xz";
-      sha256 = "05zd2xm5vgrgz0bxbkh1mpiknlqzpzk5jb74lnd5x7wn5b80ngv0";
-      name = "yakuake-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/yakuake-20.12.1.tar.xz";
+      sha256 = "02pal9xx1wbpw7dimvs2aw1xnyjqlvbjlybkkfhf8x7c6m1r63aa";
+      name = "yakuake-20.12.1.tar.xz";
     };
   };
   zeroconf-ioslave = {
-    version = "20.08.3";
+    version = "20.12.1";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.08.3/src/zeroconf-ioslave-20.08.3.tar.xz";
-      sha256 = "1afga0liiy9n98kb0gmxzbb6ckhdgbrdc4ig1x9pwp98wr1fzmcg";
-      name = "zeroconf-ioslave-20.08.3.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.1/src/zeroconf-ioslave-20.12.1.tar.xz";
+      sha256 = "1lx94qgrqhyva3nv7sgzy0blbdgx3b6m0g0i0psg74qckdh8glas";
+      name = "zeroconf-ioslave-20.12.1.tar.xz";
     };
   };
 }
diff --git a/pkgs/applications/misc/ape/default.nix b/pkgs/applications/misc/ape/default.nix
index f16d6e15733..c359d606a85 100644
--- a/pkgs/applications/misc/ape/default.nix
+++ b/pkgs/applications/misc/ape/default.nix
@@ -10,7 +10,8 @@ stdenv.mkDerivation rec {
   inherit pname;
   version = "2019-08-10";
 
-  buildInputs = [ swiProlog makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ swiProlog ];
 
   src = fetchFromGitHub {
      owner = "Attempto";
diff --git a/pkgs/applications/misc/audio/sox/0001-musl-rewind-pipe-workaround.patch b/pkgs/applications/misc/audio/sox/0001-musl-rewind-pipe-workaround.patch
new file mode 100644
index 00000000000..6aacbcc65bc
--- /dev/null
+++ b/pkgs/applications/misc/audio/sox/0001-musl-rewind-pipe-workaround.patch
@@ -0,0 +1,24 @@
+From e7446c9bcb47674c9d0ee3b5bab129e9b86eb1c9 Mon Sep 17 00:00:00 2001
+From: Walter Franzini <walter.franzini@gmail.com>
+Date: Fri, 7 Jun 2019 17:57:11 +0200
+Subject: [PATCH] musl does not support rewind pipe, make it build anyway
+
+---
+ src/formats.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/src/formats.c b/src/formats.c
+index f3efe764..477bf451 100644
+--- a/src/formats.c
++++ b/src/formats.c
+@@ -424,7 +424,6 @@ static void UNUSED rewind_pipe(FILE * fp)
+   /* To fix this #error, either simply remove the #error line and live without
+    * file-type detection with pipes, or add support for your compiler in the
+    * lines above.  Test with cat monkey.wav | ./sox --info - */
+-  #error FIX NEEDED HERE
+   #define NO_REWIND_PIPE
+   (void)fp;
+ #endif
+-- 
+2.19.2
+
diff --git a/pkgs/applications/misc/audio/sox/default.nix b/pkgs/applications/misc/audio/sox/default.nix
index dd5dbde5286..946150d2b88 100644
--- a/pkgs/applications/misc/audio/sox/default.nix
+++ b/pkgs/applications/misc/audio/sox/default.nix
@@ -27,6 +27,8 @@ stdenv.mkDerivation rec {
   # configure.ac uses pkg-config only to locate libopusfile
   nativeBuildInputs = optional enableOpusfile pkg-config;
 
+  patches = [ ./0001-musl-rewind-pipe-workaround.patch ];
+
   buildInputs =
     optional (enableAlsa && stdenv.isLinux) alsaLib ++
     optional enableLibao libao ++
diff --git a/pkgs/applications/misc/audio/wavesurfer/default.nix b/pkgs/applications/misc/audio/wavesurfer/default.nix
index 6e276d592b0..b7e738cfc12 100644
--- a/pkgs/applications/misc/audio/wavesurfer/default.nix
+++ b/pkgs/applications/misc/audio/wavesurfer/default.nix
@@ -8,7 +8,8 @@ stdenv.mkDerivation {
     sha256 = "1yx9s1j47cq0v40cwq2gn7bdizpw46l95ba4zl9z4gg31mfvm807";
   };
 
-  buildInputs = [ snack tcl tk makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ snack tcl tk ];
 
   installPhase = ''
     mkdir -p $out/{bin,nix-support,share/wavesurfer/}
diff --git a/pkgs/applications/misc/bashSnippets/default.nix b/pkgs/applications/misc/bashSnippets/default.nix
index 4a023849f39..d50f3637988 100644
--- a/pkgs/applications/misc/bashSnippets/default.nix
+++ b/pkgs/applications/misc/bashSnippets/default.nix
@@ -22,7 +22,7 @@ stdenv.mkDerivation {
     sha256 = "044nxgd3ic2qr6hgq5nymn3dyf5i4s8mv5z4az6jvwlrjnvbg8cp";
   };
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   patchPhase = ''
     patchShebangs install.sh
diff --git a/pkgs/applications/misc/cli-visualizer/default.nix b/pkgs/applications/misc/cli-visualizer/default.nix
index 74dd82a3c6e..524f8985537 100644
--- a/pkgs/applications/misc/cli-visualizer/default.nix
+++ b/pkgs/applications/misc/cli-visualizer/default.nix
@@ -15,9 +15,9 @@ stdenv.mkDerivation rec {
     sed '1i#include <cmath>' -i src/Transformer/SpectrumCircleTransformer.cpp
   '';
 
-  nativeBuildInputs = [ cmake ];
+  nativeBuildInputs = [ cmake makeWrapper ];
 
-  buildInputs = [ fftw ncurses5 libpulseaudio makeWrapper ];
+  buildInputs = [ fftw ncurses5 libpulseaudio ];
 
   buildFlags = [ "ENABLE_PULSE=1" ];
 
diff --git a/pkgs/applications/misc/clipmenu/default.nix b/pkgs/applications/misc/clipmenu/default.nix
index e3a0046205e..c47dd972ccf 100644
--- a/pkgs/applications/misc/clipmenu/default.nix
+++ b/pkgs/applications/misc/clipmenu/default.nix
@@ -27,8 +27,7 @@ stdenv.mkDerivation rec {
   '';
 
   makeFlags = [ "PREFIX=$(out)" ];
-  buildInputs = [ makeWrapper ];
-  nativeBuildInputs = [ xsel clipnotify ];
+  nativeBuildInputs = [ makeWrapper xsel clipnotify ];
 
   postFixup = ''
     sed -i "$out/bin/clipctl" -e 's,clipmenud\$,\.clipmenud-wrapped\$,'
diff --git a/pkgs/applications/misc/ding/default.nix b/pkgs/applications/misc/ding/default.nix
index 36e2923522d..649fbe55fae 100644
--- a/pkgs/applications/misc/ding/default.nix
+++ b/pkgs/applications/misc/ding/default.nix
@@ -17,7 +17,8 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-aabIH894WihsBTo1LzIBzIZxxyhRYVxLcHpDQwmwmOU=";
   };
 
-  buildInputs = [ aspellEnv fortune gnugrep makeWrapper tk tre ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ aspellEnv fortune gnugrep tk tre ];
 
   patches = [ ./dict.patch ];
 
diff --git a/pkgs/applications/misc/gremlin-console/default.nix b/pkgs/applications/misc/gremlin-console/default.nix
index 6c3ba132d0b..22444e22054 100644
--- a/pkgs/applications/misc/gremlin-console/default.nix
+++ b/pkgs/applications/misc/gremlin-console/default.nix
@@ -8,7 +8,7 @@ stdenv.mkDerivation rec {
     sha256 = "13ycr6ppyrz9rq7dasabjdk8lcsxdj3krb4j7d2jmbh2hij1rdvf";
   };
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   installPhase = ''
     mkdir -p $out/opt
diff --git a/pkgs/applications/misc/icesl/default.nix b/pkgs/applications/misc/icesl/default.nix
index 9f1431a2340..5c50ac24538 100644
--- a/pkgs/applications/misc/icesl/default.nix
+++ b/pkgs/applications/misc/icesl/default.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
     sha256 = "0sl54fsb2gz6dy0bwdscpdq1ab6ph5b7zald3bwzgkqsvna7p1jr";
   } else throw "Unsupported architecture";
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
   installPhase = ''
     cp -r ./ $out
     mkdir $out/oldbin
diff --git a/pkgs/applications/misc/josm/default.nix b/pkgs/applications/misc/josm/default.nix
index 28c7de12c8c..3828fc654d6 100644
--- a/pkgs/applications/misc/josm/default.nix
+++ b/pkgs/applications/misc/josm/default.nix
@@ -23,7 +23,8 @@ stdenv.mkDerivation {
 
   dontUnpack = true;
 
-  buildInputs = lib.optionals (!stdenv.isDarwin) [ jre makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = lib.optionals (!stdenv.isDarwin) [ jre ];
 
   installPhase =
     if stdenv.isDarwin then ''
diff --git a/pkgs/applications/misc/keepass/default.nix b/pkgs/applications/misc/keepass/default.nix
index 32572ffcdb3..6388d005fe5 100644
--- a/pkgs/applications/misc/keepass/default.nix
+++ b/pkgs/applications/misc/keepass/default.nix
@@ -12,7 +12,8 @@ with builtins; buildDotnetPackage rec {
 
   sourceRoot = ".";
 
-  buildInputs = [ unzip makeWrapper icoutils ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ unzip icoutils ];
 
   patches = [
     (substituteAll {
diff --git a/pkgs/applications/misc/mpvc/default.nix b/pkgs/applications/misc/mpvc/default.nix
index 64b55cce7a0..69aca239d31 100644
--- a/pkgs/applications/misc/mpvc/default.nix
+++ b/pkgs/applications/misc/mpvc/default.nix
@@ -17,7 +17,8 @@ stdenv.mkDerivation {
     wrapProgram $out/bin/mpvc --prefix PATH : "${socat}/bin/"
   '';
 
-  buildInputs = [ socat makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ socat ];
 
   meta = with lib; {
     description = "A mpc-like control interface for mpv";
diff --git a/pkgs/applications/misc/omegat.nix b/pkgs/applications/misc/omegat.nix
index 7b91d245f81..2bb3d14e1d2 100644
--- a/pkgs/applications/misc/omegat.nix
+++ b/pkgs/applications/misc/omegat.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation {
     sha256 = "0axz7r30p34z5hgvdglznc82g7yvm3g56dv5190jixskx6ba58rs";
   };
 
-  buildInputs = [ unzip makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ unzip ];
 
   unpackCmd = "unzip -o $curSrc";  # tries to go interactive without -o
 
diff --git a/pkgs/applications/misc/openjump/default.nix b/pkgs/applications/misc/openjump/default.nix
index 28becefa5b1..b3e93ce5127 100644
--- a/pkgs/applications/misc/openjump/default.nix
+++ b/pkgs/applications/misc/openjump/default.nix
@@ -18,7 +18,8 @@ stdenv.mkDerivation {
     cd $out; unzip $src
   '';
 
-  buildInputs = [unzip makeWrapper];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ unzip ];
 
   installPhase = ''
     dir=$(echo $out/OpenJUMP-*)
diff --git a/pkgs/applications/misc/projectlibre/default.nix b/pkgs/applications/misc/projectlibre/default.nix
index fd83d74edd5..ceb61d71866 100644
--- a/pkgs/applications/misc/projectlibre/default.nix
+++ b/pkgs/applications/misc/projectlibre/default.nix
@@ -10,7 +10,8 @@ stdenv.mkDerivation rec {
     sha256 = "0vy5vgbp45ai957gaby2dj1hvmbxfdlfnwcanwqm9f8q16qipdbq";
   };
 
-  buildInputs = [ ant jdk makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ ant jdk ];
   buildPhase = ''
     export ANT_OPTS=-Dbuild.sysclasspath=ignore
     ${ant}/bin/ant -f openproj_build/build.xml
diff --git a/pkgs/applications/misc/sidequest/default.nix b/pkgs/applications/misc/sidequest/default.nix
index 6dad2eaf812..c904c221260 100644
--- a/pkgs/applications/misc/sidequest/default.nix
+++ b/pkgs/applications/misc/sidequest/default.nix
@@ -19,7 +19,7 @@
         sha256 = "0fw952kdh1gn00y6sx2ag0rnb2paxq9ikg4bzgmbj7rrd1c6l2k9";
       };
 
-      buildInputs = [ makeWrapper ];
+      nativeBuildInputs = [ makeWrapper ];
 
       buildCommand = ''
         mkdir -p "$out/lib/SideQuest" "$out/bin"
diff --git a/pkgs/applications/misc/sweethome3d/default.nix b/pkgs/applications/misc/sweethome3d/default.nix
index afbf5b364ed..e1be229b087 100644
--- a/pkgs/applications/misc/sweethome3d/default.nix
+++ b/pkgs/applications/misc/sweethome3d/default.nix
@@ -34,7 +34,8 @@ let
       patchelf --set-rpath ${libXxf86vm}/lib lib/java3d-1.6/linux/i586/libnativewindow_x11.so
     '';
 
-    buildInputs = [ ant jdk makeWrapper p7zip gtk3 gsettings-desktop-schemas ];
+    nativeBuildInputs = [ makeWrapper ];
+    buildInputs = [ ant jdk p7zip gtk3 gsettings-desktop-schemas ];
 
     buildPhase = ''
       ant furniture textures help
diff --git a/pkgs/applications/misc/sweethome3d/editors.nix b/pkgs/applications/misc/sweethome3d/editors.nix
index 08bc5b90fd9..c0cdc764dc3 100644
--- a/pkgs/applications/misc/sweethome3d/editors.nix
+++ b/pkgs/applications/misc/sweethome3d/editors.nix
@@ -23,7 +23,8 @@ let
       categories = "Graphics;2DGraphics;3DGraphics;";
     };
 
-    buildInputs = [ ant jre jdk makeWrapper gtk3 gsettings-desktop-schemas ];
+    nativeBuildInputs = [ makeWrapper ];
+    buildInputs = [ ant jre jdk gtk3 gsettings-desktop-schemas ];
 
     patchPhase = ''
       sed -i -e 's,../SweetHome3D,${application.src},g' build.xml
diff --git a/pkgs/applications/misc/tabula/default.nix b/pkgs/applications/misc/tabula/default.nix
index 1804f3c04e8..b396c578c90 100644
--- a/pkgs/applications/misc/tabula/default.nix
+++ b/pkgs/applications/misc/tabula/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
   };
 
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
 
   installPhase = ''
diff --git a/pkgs/applications/misc/translate-shell/default.nix b/pkgs/applications/misc/translate-shell/default.nix
index 03ed031be85..319ba3643da 100644
--- a/pkgs/applications/misc/translate-shell/default.nix
+++ b/pkgs/applications/misc/translate-shell/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     sha256 = "075vqnha21rhr1b61dim7dqlfwm1yffyzcaa83s36rpk9r5sddzx";
   };
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   installFlags = [ "PREFIX=$(out)" ];
 
diff --git a/pkgs/applications/misc/viking/default.nix b/pkgs/applications/misc/viking/default.nix
index 61ebfb0fcc6..71f67baa6c5 100644
--- a/pkgs/applications/misc/viking/default.nix
+++ b/pkgs/applications/misc/viking/default.nix
@@ -25,8 +25,8 @@ stdenv.mkDerivation rec {
     })
   ];
 
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ makeWrapper intltool gettext gtk2 expat curl gpsd bc file gnome-doc-utils
+  nativeBuildInputs = [ pkg-config makeWrapper ];
+  buildInputs = [ intltool gettext gtk2 expat curl gpsd bc file gnome-doc-utils
     libexif libxml2 libxslt scrollkeeper docbook_xml_dtd_412 gexiv2
   ] ++ lib.optional withMapnik mapnik
     ++ lib.optional withGeoClue geoclue2
diff --git a/pkgs/applications/misc/wordnet/default.nix b/pkgs/applications/misc/wordnet/default.nix
index 32c1f0eaa64..27694174d70 100644
--- a/pkgs/applications/misc/wordnet/default.nix
+++ b/pkgs/applications/misc/wordnet/default.nix
@@ -8,7 +8,8 @@ stdenv.mkDerivation rec {
     sha256 = "08pgjvd2vvmqk3h641x63nxp7wqimb9r30889mkyfh2agc62sjbc";
   };
 
-  buildInputs = [ tcl tk xlibsWrapper makeWrapper ]
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ tcl tk xlibsWrapper ]
     ++ lib.optionals stdenv.isDarwin [ Cocoa ];
 
   hardeningDisable = [ "format" ];
diff --git a/pkgs/applications/misc/xfontsel/default.nix b/pkgs/applications/misc/xfontsel/default.nix
index 10034fbe1b1..365f6217861 100644
--- a/pkgs/applications/misc/xfontsel/default.nix
+++ b/pkgs/applications/misc/xfontsel/default.nix
@@ -11,8 +11,8 @@ stdenv.mkDerivation rec {
     sha256 = "0700lf6hx7dg88wq1yll7zjvf9gbwh06xff20yffkxb289y0pai5";
   };
 
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [libX11 makeWrapper libXaw];
+  nativeBuildInputs = [ pkg-config makeWrapper ];
+  buildInputs = [libX11 libXaw];
 
   # Without this, it gets Xmu as a dependency, but without rpath entry
   NIX_LDFLAGS = "-lXmu";
diff --git a/pkgs/applications/misc/zathura/wrapper.nix b/pkgs/applications/misc/zathura/wrapper.nix
index 60e3bb9fd53..49f78729a31 100644
--- a/pkgs/applications/misc/zathura/wrapper.nix
+++ b/pkgs/applications/misc/zathura/wrapper.nix
@@ -4,8 +4,7 @@ symlinkJoin {
 
   paths = with zathura_core; [ man dev out ] ++ plugins;
 
-
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   postBuild = let
     fishCompletion = "share/fish/vendor_completions.d/zathura.fish";
diff --git a/pkgs/applications/networking/browsers/castor/default.nix b/pkgs/applications/networking/browsers/castor/default.nix
index be3d8295f99..daead82e485 100644
--- a/pkgs/applications/networking/browsers/castor/default.nix
+++ b/pkgs/applications/networking/browsers/castor/default.nix
@@ -39,7 +39,7 @@ rustPlatform.buildRustPackage rec {
   postInstall = "make PREFIX=$out copy-data";
 
   # Sometimes tests fail when run in parallel
-  cargoParallelTestThreads = false;
+  dontUseCargoParallelThreads = true;
 
   meta = with lib; {
     description = "A graphical client for plain-text protocols written in Rust with GTK. It currently supports the Gemini, Gopher and Finger protocols";
diff --git a/pkgs/applications/networking/charles/default.nix b/pkgs/applications/networking/charles/default.nix
index 03d1911333e..1dd0b408a13 100644
--- a/pkgs/applications/networking/charles/default.nix
+++ b/pkgs/applications/networking/charles/default.nix
@@ -28,7 +28,7 @@ let
         url = "https://www.charlesproxy.com/assets/release/${version}/charles-proxy-${version}.tar.gz";
         inherit sha256;
       };
-      buildInputs = [ makeWrapper ];
+      nativeBuildInputs = [ makeWrapper ];
 
       installPhase = ''
         makeWrapper ${jdk8.jre}/bin/java $out/bin/charles \
diff --git a/pkgs/applications/networking/cluster/spark/default.nix b/pkgs/applications/networking/cluster/spark/default.nix
index 071636ec443..76230b8e100 100644
--- a/pkgs/applications/networking/cluster/spark/default.nix
+++ b/pkgs/applications/networking/cluster/spark/default.nix
@@ -14,7 +14,8 @@ stdenv.mkDerivation rec {
     sha256 = "1a9w5k0207fysgpxx6db3a00fs5hdc2ncx99x4ccy2s0v5ndc66g";
   };
 
-  buildInputs = [ makeWrapper jre pythonPackages.python pythonPackages.numpy ]
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ jre pythonPackages.python pythonPackages.numpy ]
     ++ optional RSupport R;
 
   untarDir = "${pname}-${version}-bin-without-hadoop";
diff --git a/pkgs/applications/networking/cluster/ssm-agent/default.nix b/pkgs/applications/networking/cluster/ssm-agent/default.nix
index 928fb351c6a..b042f8ff15f 100644
--- a/pkgs/applications/networking/cluster/ssm-agent/default.nix
+++ b/pkgs/applications/networking/cluster/ssm-agent/default.nix
@@ -14,7 +14,7 @@ buildGoPackage rec {
     "agent/cli-main"
   ];
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   src = fetchFromGitHub {
     rev    = version;
diff --git a/pkgs/applications/networking/cluster/terraform/default.nix b/pkgs/applications/networking/cluster/terraform/default.nix
index 59a7039fb28..4a6e95057a4 100644
--- a/pkgs/applications/networking/cluster/terraform/default.nix
+++ b/pkgs/applications/networking/cluster/terraform/default.nix
@@ -117,7 +117,7 @@ let
         else
           lib.appendToName "with-plugins" (stdenv.mkDerivation {
             inherit (terraform) name meta;
-            buildInputs = [ makeWrapper ];
+            nativeBuildInputs = [ makeWrapper ];
 
             buildCommand = pluginDir + ''
               mkdir -p $out/bin/
diff --git a/pkgs/applications/networking/ids/snort/default.nix b/pkgs/applications/networking/ids/snort/default.nix
index 17ace3021d8..714ca1c8990 100644
--- a/pkgs/applications/networking/ids/snort/default.nix
+++ b/pkgs/applications/networking/ids/snort/default.nix
@@ -12,7 +12,8 @@ stdenv.mkDerivation rec {
     sha256 = "13lzvjli6kbsnkd7lf0rm71l2mnz38pxk76ia9yrjb6clfhlbb73";
   };
 
-  buildInputs = [ makeWrapper pkg-config luajit openssl libpcap pcre libdnet daq zlib flex bison libtirpc ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ pkg-config luajit openssl libpcap pcre libdnet daq zlib flex bison libtirpc ];
 
   NIX_CFLAGS_COMPILE = [ "-I${libtirpc.dev}/include/tirpc" ];
 
diff --git a/pkgs/applications/networking/instant-messengers/gomuks/default.nix b/pkgs/applications/networking/instant-messengers/gomuks/default.nix
index a2d12124dbf..428e4e70601 100644
--- a/pkgs/applications/networking/instant-messengers/gomuks/default.nix
+++ b/pkgs/applications/networking/instant-messengers/gomuks/default.nix
@@ -26,7 +26,8 @@ buildGoModule rec {
 
   doCheck = false;
 
-  buildInputs = [ makeWrapper olm ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ olm ];
 
   # Upstream issue: https://github.com/tulir/gomuks/issues/260
   patches = lib.optional stdenv.isLinux (substituteAll {
diff --git a/pkgs/applications/networking/instant-messengers/hipchat/default.nix b/pkgs/applications/networking/instant-messengers/hipchat/default.nix
index f3736bfc64f..cbbe74481c2 100644
--- a/pkgs/applications/networking/instant-messengers/hipchat/default.nix
+++ b/pkgs/applications/networking/instant-messengers/hipchat/default.nix
@@ -47,7 +47,7 @@ in stdenv.mkDerivation {
     sha256 = "03pz8wskafn848yvciq29kwdvqcgjrk6sjnm8nk9acl89xf0sn96";
   };
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   buildCommand = ''
     ar x $src
diff --git a/pkgs/applications/networking/instant-messengers/telepathy/idle/default.nix b/pkgs/applications/networking/instant-messengers/telepathy/idle/default.nix
index bc66d77e224..041ec5e7c5b 100644
--- a/pkgs/applications/networking/instant-messengers/telepathy/idle/default.nix
+++ b/pkgs/applications/networking/instant-messengers/telepathy/idle/default.nix
@@ -9,8 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "1argdzbif1vdmwp5vqbgkadq9ancjmgdm2ncp0qfckni715ss4rh";
   };
 
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ glib telepathy-glib dbus-glib libxslt telepathy-glib.python (lib.getLib dconf) makeWrapper ];
+  nativeBuildInputs = [ pkg-config makeWrapper ];
+  buildInputs = [ glib telepathy-glib dbus-glib libxslt telepathy-glib.python (lib.getLib dconf) ];
 
   preFixup = ''
     wrapProgram "$out/libexec/telepathy-idle" \
diff --git a/pkgs/applications/networking/instant-messengers/viber/default.nix b/pkgs/applications/networking/instant-messengers/viber/default.nix
index 4389ee153c5..0224edc652f 100644
--- a/pkgs/applications/networking/instant-messengers/viber/default.nix
+++ b/pkgs/applications/networking/instant-messengers/viber/default.nix
@@ -13,7 +13,8 @@ stdenv.mkDerivation {
     sha256 = "0rs26x0lycavybn6k1hbb5kzms0zzcmxlrmi4g8k7vyafj6s8dqh";
   };
 
-  buildInputs = [ dpkg makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ dpkg ];
 
   dontUnpack = true;
 
diff --git a/pkgs/applications/networking/insync/default.nix b/pkgs/applications/networking/insync/default.nix
index b52a81932e4..380aad6c329 100644
--- a/pkgs/applications/networking/insync/default.nix
+++ b/pkgs/applications/networking/insync/default.nix
@@ -12,9 +12,7 @@ stdenv.mkDerivation rec {
     else
       throw "${pname}-${version} is not supported on ${stdenv.hostPlatform.system}";
 
-  buildInputs = [ makeWrapper ];
-
-  nativeBuildInputs = [ autoPatchelfHook ];
+  nativeBuildInputs = [ makeWrapper autoPatchelfHook ];
 
   postPatch = ''
     patchelf --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" client/insync-portable
diff --git a/pkgs/applications/networking/jnetmap/default.nix b/pkgs/applications/networking/jnetmap/default.nix
index bac0048cc28..e6332832e3e 100644
--- a/pkgs/applications/networking/jnetmap/default.nix
+++ b/pkgs/applications/networking/jnetmap/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "0nxsfa600jhazwbabxmr9j37mhwysp0fyrvczhv3f1smiy8rjanl";
   };
 
-  buildInputs = [ jre makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ jre ];
 
   dontUnpack = true;
 
diff --git a/pkgs/applications/networking/mailreaders/evolution/evolution/wrapper.nix b/pkgs/applications/networking/mailreaders/evolution/evolution/wrapper.nix
index 050082c6f93..ea3f09b8f4c 100644
--- a/pkgs/applications/networking/mailreaders/evolution/evolution/wrapper.nix
+++ b/pkgs/applications/networking/mailreaders/evolution/evolution/wrapper.nix
@@ -4,7 +4,7 @@ symlinkJoin {
   name = "evolution-with-plugins";
   paths = [ gnome3.evolution-data-server ] ++ plugins;
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   postBuild = ''
     for i in $out/bin/* $out/libexec/**; do
diff --git a/pkgs/applications/networking/p2p/vuze/default.nix b/pkgs/applications/networking/p2p/vuze/default.nix
index 557914439a9..fe8743ee1cd 100644
--- a/pkgs/applications/networking/p2p/vuze/default.nix
+++ b/pkgs/applications/networking/p2p/vuze/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "07w6ipyiy8hi88d6yxbbf3vkv26mj7dcz9yr8141hb2ig03v0h0p";
   };
 
-  buildInputs = [ makeWrapper jdk ant ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ jdk ant ];
 
   buildPhase = "ant";
 
diff --git a/pkgs/applications/networking/remote/vmware-horizon-client/default.nix b/pkgs/applications/networking/remote/vmware-horizon-client/default.nix
index a9ddf48bae6..f52373f2624 100644
--- a/pkgs/applications/networking/remote/vmware-horizon-client/default.nix
+++ b/pkgs/applications/networking/remote/vmware-horizon-client/default.nix
@@ -52,7 +52,7 @@ let
       url = "https://download3.vmware.com/software/view/viewclients/CART21FQ4/VMware-Horizon-Client-Linux-2012-8.1.0-17349998.tar.gz";
       sha256 = "0afda1f3116e75a4e7f89990d8ee60ccea5f3bb8a2360652162fa11c795724ce";
     };
-    buildInputs = [ makeWrapper ];
+    nativeBuildInputs = [ makeWrapper ];
     installPhase = ''
       mkdir ext $out
       find ${sysArch} -type f -print0 | xargs -0n1 tar -Cext --strip-components=1 -xf
diff --git a/pkgs/applications/networking/sync/unison/default.nix b/pkgs/applications/networking/sync/unison/default.nix
index 86126e86169..23bbd19b00e 100644
--- a/pkgs/applications/networking/sync/unison/default.nix
+++ b/pkgs/applications/networking/sync/unison/default.nix
@@ -14,7 +14,8 @@ stdenv.mkDerivation (rec {
     sha256 = "sha256-42hmdMwOYSWGiDCmhuqtpCWtvtyD2l+kA/bhHD/Qh5Y=";
   };
 
-  buildInputs = [ ocaml makeWrapper ncurses ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ ocaml ncurses ];
 
   preBuild = (if enableX11 then ''
     sed -i "s|\(OCAMLOPT=.*\)$|\1 -I $(echo "${lablgtk}"/lib/ocaml/*/site-lib/lablgtk2)|" src/Makefile.OCaml
diff --git a/pkgs/applications/networking/tsung/default.nix b/pkgs/applications/networking/tsung/default.nix
index 41bc6c64da8..346fd175257 100644
--- a/pkgs/applications/networking/tsung/default.nix
+++ b/pkgs/applications/networking/tsung/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
     sha256 = "6394445860ef34faedf8c46da95a3cb206bc17301145bc920151107ffa2ce52a";
   };
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
   propagatedBuildInputs = [
     erlang
     gnuplot
diff --git a/pkgs/applications/networking/wg-bond/default.nix b/pkgs/applications/networking/wg-bond/default.nix
index 32ffbde400b..bef44d42862 100644
--- a/pkgs/applications/networking/wg-bond/default.nix
+++ b/pkgs/applications/networking/wg-bond/default.nix
@@ -12,7 +12,7 @@ rustPlatform.buildRustPackage rec {
 
   cargoSha256 = "1v2az0v6l8mqryvq3898hm7bpvqdd2c4kpv6ck7932jfjyna512k";
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
   postInstall = ''
     wrapProgram $out/bin/wg-bond --set PATH ${
       lib.makeBinPath [ wireguard-tools ]
diff --git a/pkgs/applications/office/docear/default.nix b/pkgs/applications/office/docear/default.nix
index 683e6681573..f8cd25ad784 100644
--- a/pkgs/applications/office/docear/default.nix
+++ b/pkgs/applications/office/docear/default.nix
@@ -12,7 +12,8 @@ stdenv.mkDerivation {
     sha256 = "1g5n7r2x4gas6dl2fbyh7v9yxdcb6bzml8n3ldmpzv1rncgjcdp4";
   };
 
-  buildInputs = [ oraclejre makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ oraclejre ];
 
   buildPhase = "";
   installPhase = ''
diff --git a/pkgs/applications/office/impressive/default.nix b/pkgs/applications/office/impressive/default.nix
index 4614a543694..f46d893d894 100644
--- a/pkgs/applications/office/impressive/default.nix
+++ b/pkgs/applications/office/impressive/default.nix
@@ -16,7 +16,8 @@ in stdenv.mkDerivation {
       sha256 = "1r7ihv41awnlnlry1kymb8fka053wdhzibfwcarn78rr3vs338vl";
     };
 
-    buildInputs = [ makeWrapper pythonEnv ];
+    nativeBuildInputs = [ makeWrapper ];
+    buildInputs = [ pythonEnv ];
 
     configurePhase = ''
       # Let's fail at build time if the library we're substituting in doesn't
diff --git a/pkgs/applications/office/treesheets/default.nix b/pkgs/applications/office/treesheets/default.nix
index 552d28d1e95..1f084e182af 100644
--- a/pkgs/applications/office/treesheets/default.nix
+++ b/pkgs/applications/office/treesheets/default.nix
@@ -11,7 +11,8 @@ stdenv.mkDerivation rec {
     sha256 = "0krsj7i5yr76imf83krz2lmlmpbsvpwqg2d4r0jwxiydjfyj4qr4";
   };
 
-  buildInputs = [ wxGTK makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ wxGTK ];
 
   preConfigure = "cd src";
 
diff --git a/pkgs/applications/science/biology/eggnog-mapper/default.nix b/pkgs/applications/science/biology/eggnog-mapper/default.nix
index 7eb3afd437a..b42fed8da28 100644
--- a/pkgs/applications/science/biology/eggnog-mapper/default.nix
+++ b/pkgs/applications/science/biology/eggnog-mapper/default.nix
@@ -16,7 +16,7 @@ python27Packages.buildPythonApplication rec {
     sha256 = "0abnmn0bh11jihf5d3cggiild1ykawzv5f5fhb4cyyi8fvy4hcxf";
   });
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
   propagatedBuildInputs = [ python27Packages.biopython wget diamond hmmer ];
 
   # make emapper find diamond & hmmer
diff --git a/pkgs/applications/science/biology/platypus/default.nix b/pkgs/applications/science/biology/platypus/default.nix
index 30bc68fb0e8..d602395b875 100644
--- a/pkgs/applications/science/biology/platypus/default.nix
+++ b/pkgs/applications/science/biology/platypus/default.nix
@@ -13,7 +13,8 @@ in stdenv.mkDerivation {
     sha256 = "0nah6r54b8xm778gqyb8b7rsd76z8ji4g73sm6rvpw5s96iib1vw";
   };
 
-  buildInputs = [ htslib python zlib makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ htslib python zlib ];
 
   buildPhase = ''
     patchShebangs .
diff --git a/pkgs/applications/science/biology/snpeff/default.nix b/pkgs/applications/science/biology/snpeff/default.nix
index 32701af8392..b48e13ecf00 100644
--- a/pkgs/applications/science/biology/snpeff/default.nix
+++ b/pkgs/applications/science/biology/snpeff/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "0i12mv93bfv8xjwc3rs2x73d6hkvi7kgbbbx3ry984l3ly4p6nnm";
   };
 
-  buildInputs = [ unzip jre makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ unzip jre ];
 
   sourceRoot = "snpEff";
 
diff --git a/pkgs/applications/science/biology/varscan/default.nix b/pkgs/applications/science/biology/varscan/default.nix
index 65a19b83a70..2a232d64693 100644
--- a/pkgs/applications/science/biology/varscan/default.nix
+++ b/pkgs/applications/science/biology/varscan/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-+yO3KrZ2+1qJvQIJHCtsmv8hC5a+4E2d7mrvTYtygU0=";
   };
 
-  buildInputs = [ jre makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ jre ];
 
   phases = [ "installPhase" ];
 
diff --git a/pkgs/applications/science/logic/isabelle/default.nix b/pkgs/applications/science/logic/isabelle/default.nix
index a0f81a543f1..600ae83ff91 100644
--- a/pkgs/applications/science/logic/isabelle/default.nix
+++ b/pkgs/applications/science/logic/isabelle/default.nix
@@ -17,7 +17,8 @@ stdenv.mkDerivation rec {
       sha256 = "1bibabhlsvf6qsjjkgxcpq3cvl1z7r8yfcgqbhbvsiv69n3gyfk3";
     };
 
-  buildInputs = [ perl polyml z3 makeWrapper ]
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ perl polyml z3 ]
              ++ lib.optionals (!stdenv.isDarwin) [ nettools java ];
 
   sourceRoot = dirname;
diff --git a/pkgs/applications/science/logic/leo2/default.nix b/pkgs/applications/science/logic/leo2/default.nix
index 520c47d7500..fc2c1e5cba4 100644
--- a/pkgs/applications/science/logic/leo2/default.nix
+++ b/pkgs/applications/science/logic/leo2/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "1wjpmizb181iygnd18lx7p77fwaci2clgzs5ix5j51cc8f3pazmv";
   };
 
-  buildInputs = [ makeWrapper eprover ocaml perl zlib ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ eprover ocaml perl zlib ];
 
   sourceRoot = "leo2/src";
 
diff --git a/pkgs/applications/science/logic/satallax/default.nix b/pkgs/applications/science/logic/satallax/default.nix
index dffb66b2fcf..8c88f47327e 100644
--- a/pkgs/applications/science/logic/satallax/default.nix
+++ b/pkgs/applications/science/logic/satallax/default.nix
@@ -3,7 +3,8 @@ stdenv.mkDerivation rec {
   pname = "satallax";
   version = "2.7";
 
-  buildInputs = [ocaml zlib which eprover makeWrapper coq];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ocaml zlib which eprover coq];
   src = fetchurl {
     url = "https://www.ps.uni-saarland.de/~cebrown/satallax/downloads/${pname}-${version}.tar.gz";
     sha256 = "1kvxn8mc35igk4vigi5cp7w3wpxk2z3bgwllfm4n3h2jfs0vkpib";
diff --git a/pkgs/applications/science/logic/tlaplus/default.nix b/pkgs/applications/science/logic/tlaplus/default.nix
index c4ba334b85f..f002b808e0a 100644
--- a/pkgs/applications/science/logic/tlaplus/default.nix
+++ b/pkgs/applications/science/logic/tlaplus/default.nix
@@ -13,7 +13,8 @@ stdenv.mkDerivation rec {
     sha256 = "1mm6r9bq79zks50yk0agcpdkw9yy994m38ibmgpb3bi3wkpq9891";
   };
 
-  buildInputs = [ makeWrapper adoptopenjdk-bin ant ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ adoptopenjdk-bin ant ];
 
   buildPhase = "ant -f tlatools/org.lamport.tlatools/customBuild.xml compile dist";
   installPhase = ''
diff --git a/pkgs/applications/science/logic/tlaplus/toolbox.nix b/pkgs/applications/science/logic/tlaplus/toolbox.nix
index 1c33d923289..da8985818e7 100644
--- a/pkgs/applications/science/logic/tlaplus/toolbox.nix
+++ b/pkgs/applications/science/logic/tlaplus/toolbox.nix
@@ -28,7 +28,7 @@ in stdenv.mkDerivation {
     sha256 = "0v15wscawair5bghr5ixb4i062kmh9by1m0hnz2r1sawlqyafz02";
   };
 
-  buildInputs = [ makeWrapper  ];
+  nativeBuildInputs = [ makeWrapper ];
 
   phases = [ "installPhase" ];
 
diff --git a/pkgs/applications/science/logic/why3/with-provers.nix b/pkgs/applications/science/logic/why3/with-provers.nix
index 3528dbd3a64..d4fdbfd6937 100644
--- a/pkgs/applications/science/logic/why3/with-provers.nix
+++ b/pkgs/applications/science/logic/why3/with-provers.nix
@@ -15,7 +15,8 @@ in stdenv.mkDerivation {
 
   phases = [ "buildPhase" "installPhase" ];
 
-  buildInputs = [ why3 makeWrapper ] ++ provers;
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ why3 ] ++ provers;
 
   buildPhase = ''
       mkdir -p $out/share/why3/
diff --git a/pkgs/applications/science/logic/workcraft/default.nix b/pkgs/applications/science/logic/workcraft/default.nix
index cb0d668f536..7fb73419c07 100644
--- a/pkgs/applications/science/logic/workcraft/default.nix
+++ b/pkgs/applications/science/logic/workcraft/default.nix
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
     sha256 = "0v71x3fph2j3xrnysvkm7zsgnbxisfbdfgxzvzxxfdg59a6l3xid";
   };
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   phases = [ "unpackPhase" "installPhase" "fixupPhase" ];
 
diff --git a/pkgs/applications/science/math/calc/default.nix b/pkgs/applications/science/math/calc/default.nix
index c5449171fff..9c5a8960d32 100644
--- a/pkgs/applications/science/math/calc/default.nix
+++ b/pkgs/applications/science/math/calc/default.nix
@@ -19,7 +19,8 @@ stdenv.mkDerivation rec {
       --replace '-install_name ''${LIBDIR}/libcustcalc''${LIB_EXT_VERSION}' '-install_name ''${T}''${LIBDIR}/libcustcalc''${LIB_EXT_VERSION}'
   '';
 
-  buildInputs = [ util-linux makeWrapper ]
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ util-linux ]
              ++ lib.optionals enableReadline [ readline ncurses ];
 
   makeFlags = [
diff --git a/pkgs/applications/science/math/weka/default.nix b/pkgs/applications/science/math/weka/default.nix
index 179801da379..05b95140b1b 100644
--- a/pkgs/applications/science/math/weka/default.nix
+++ b/pkgs/applications/science/math/weka/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "0zwmhspmqb0a7cm6k6i0s6q3w19ws1g9dx3cp2v3g3vsif6cdh31";
   };
 
-  buildInputs = [ unzip makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ unzip ];
 
   # The -Xmx1000M comes suggested from their download page:
   # http://www.cs.waikato.ac.nz/ml/weka/downloading.html
diff --git a/pkgs/applications/science/medicine/aliza/default.nix b/pkgs/applications/science/medicine/aliza/default.nix
index c6bfd6361f2..e8e764ef26d 100644
--- a/pkgs/applications/science/medicine/aliza/default.nix
+++ b/pkgs/applications/science/medicine/aliza/default.nix
@@ -11,7 +11,8 @@ stdenv.mkDerivation {
     name = "aliza.rpm";
   };
 
-  buildInputs = [ rpmextract makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ rpmextract ];
 
   unpackCmd = "rpmextract $curSrc";
 
diff --git a/pkgs/applications/science/misc/cytoscape/default.nix b/pkgs/applications/science/misc/cytoscape/default.nix
index db98e0db348..3ab7d57f95a 100644
--- a/pkgs/applications/science/misc/cytoscape/default.nix
+++ b/pkgs/applications/science/misc/cytoscape/default.nix
@@ -18,7 +18,8 @@ stdenv.mkDerivation rec {
     })
   ];
 
-  buildInputs = [jre makeWrapper];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ jre ];
 
   installPhase = ''
     mkdir -pv $out/{share,bin}
diff --git a/pkgs/applications/science/programming/plm/default.nix b/pkgs/applications/science/programming/plm/default.nix
index dd61c3668cc..e56282b6863 100644
--- a/pkgs/applications/science/programming/plm/default.nix
+++ b/pkgs/applications/science/programming/plm/default.nix
@@ -14,7 +14,8 @@ stdenv.mkDerivation rec {
     name = "${pname}-${version}.jar";
   };
 
-  buildInputs = [ makeWrapper jre gcc valgrind ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ jre gcc valgrind ];
 
   phases = [ "installPhase" ];
 
diff --git a/pkgs/applications/terminal-emulators/rxvt-unicode/wrapper.nix b/pkgs/applications/terminal-emulators/rxvt-unicode/wrapper.nix
index b03acb99530..5255d40b9ce 100644
--- a/pkgs/applications/terminal-emulators/rxvt-unicode/wrapper.nix
+++ b/pkgs/applications/terminal-emulators/rxvt-unicode/wrapper.nix
@@ -40,7 +40,7 @@ let
 
         paths = [ rxvt-unicode-unwrapped ] ++ plugins ++ extraDeps;
 
-        buildInputs = [ makeWrapper ];
+        nativeBuildInputs = [ makeWrapper ];
 
         postBuild = ''
           wrapProgram $out/bin/urxvt \
diff --git a/pkgs/applications/terminal-emulators/terminus/default.nix b/pkgs/applications/terminal-emulators/terminus/default.nix
index 67c660275f5..87394241ef7 100644
--- a/pkgs/applications/terminal-emulators/terminus/default.nix
+++ b/pkgs/applications/terminal-emulators/terminus/default.nix
@@ -18,7 +18,8 @@ stdenv.mkDerivation rec {
     url = "https://github.com/Eugeny/terminus/releases/download/v${version}/terminus_${version}_amd64.deb";
     sha256 = "1r5n75n71zwahg4rxlnf9qzrb0651gxv0987m6bykqmfpnw91nmb";
   };
-  buildInputs = [ dpkg makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ dpkg ];
   unpackPhase = ''
     mkdir pkg
     dpkg-deb -x $src pkg
diff --git a/pkgs/applications/version-management/cvs2svn/default.nix b/pkgs/applications/version-management/cvs2svn/default.nix
index ae1929565b6..af2b5cdc9a3 100644
--- a/pkgs/applications/version-management/cvs2svn/default.nix
+++ b/pkgs/applications/version-management/cvs2svn/default.nix
@@ -12,7 +12,7 @@ python2Packages.buildPythonApplication  rec {
     sha256 = "1ska0z15sjhyfi860rjazz9ya1gxbf5c0h8dfqwz88h7fccd22b4";
   };
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   checkInputs = [ subversion git breezy ];
 
diff --git a/pkgs/applications/version-management/git-and-tools/bfg-repo-cleaner/default.nix b/pkgs/applications/version-management/git-and-tools/bfg-repo-cleaner/default.nix
index 1ffc0653675..036eef1c9c3 100644
--- a/pkgs/applications/version-management/git-and-tools/bfg-repo-cleaner/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/bfg-repo-cleaner/default.nix
@@ -15,7 +15,8 @@ in
       sha256 = "1kn84rsvms1v5l1j2xgrk7dc7mnsmxkc6sqd94mnim22vnwvl8mz";
     };
 
-    buildInputs = [ jre makeWrapper ];
+    nativeBuildInputs = [ makeWrapper ];
+    buildInputs = [ jre ];
 
     phases = "installPhase";
 
diff --git a/pkgs/applications/version-management/git-and-tools/fast-export/default.nix b/pkgs/applications/version-management/git-and-tools/fast-export/default.nix
index 5aea15769c0..565fe180ba1 100644
--- a/pkgs/applications/version-management/git-and-tools/fast-export/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/fast-export/default.nix
@@ -11,7 +11,8 @@ stdenv.mkDerivation rec {
     sha256 = "0hzyh66rlawxip4n2pvz7pbs0cq82clqv1d6c7hf60v1drjxw287";
   };
 
-  buildInputs = [mercurial.python mercurial makeWrapper];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [mercurial.python mercurial];
 
   installPhase = ''
     binPath=$out/bin
diff --git a/pkgs/applications/version-management/git-and-tools/git-crypt/default.nix b/pkgs/applications/version-management/git-and-tools/git-crypt/default.nix
index 08875dabd0f..f0184c66377 100644
--- a/pkgs/applications/version-management/git-and-tools/git-crypt/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git-crypt/default.nix
@@ -13,9 +13,9 @@ stdenv.mkDerivation rec {
     sha256 = "13m9y0m6gc3mlw3pqv9x4i0him2ycbysizigdvdanhh514kga602";
   };
 
-  nativeBuildInputs = [ libxslt ];
+  nativeBuildInputs = [ libxslt makeWrapper ];
 
-  buildInputs = [ openssl makeWrapper ];
+  buildInputs = [ openssl ];
 
   patchPhase = ''
     substituteInPlace commands.cpp \
diff --git a/pkgs/applications/version-management/git-and-tools/git-octopus/default.nix b/pkgs/applications/version-management/git-and-tools/git-octopus/default.nix
index 942a12e239b..7b8b5fed90f 100644
--- a/pkgs/applications/version-management/git-and-tools/git-octopus/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git-octopus/default.nix
@@ -8,7 +8,7 @@ stdenv.mkDerivation rec {
 
   installFlags = [ "prefix=$(out)" ];
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   # perl provides shasum
   postInstall = ''
diff --git a/pkgs/applications/version-management/git-and-tools/git-open/default.nix b/pkgs/applications/version-management/git-and-tools/git-open/default.nix
index 5e5bba3df72..c67a575172c 100644
--- a/pkgs/applications/version-management/git-and-tools/git-open/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git-open/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     sha256 = "11n46bngvca5wbdbfcxzjhjbfdbad7sgf7h9gf956cb1q8swsdm0";
   };
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   buildPhase = null;
 
diff --git a/pkgs/applications/version-management/git-and-tools/git-recent/default.nix b/pkgs/applications/version-management/git-and-tools/git-recent/default.nix
index 2ecc5d872b8..1a1811b2f43 100644
--- a/pkgs/applications/version-management/git-and-tools/git-recent/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git-recent/default.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
     sha256 = "1g8i6vpjnnfh7vc1269c91bap267w4bxdqqwnzb8x18vqgn2fx8i";
   };
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   buildPhase = null;
 
diff --git a/pkgs/applications/version-management/git-and-tools/git-reparent/default.nix b/pkgs/applications/version-management/git-and-tools/git-reparent/default.nix
index 037de14658d..ec1c44b9613 100644
--- a/pkgs/applications/version-management/git-and-tools/git-reparent/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git-reparent/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     sha256 = "0v0yxydpw6r4awy0hb7sbnh520zsk86ibzh1xjf3983yhsvkfk5v";
   };
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   dontBuild = true;
 
diff --git a/pkgs/applications/version-management/git-and-tools/git-secret/default.nix b/pkgs/applications/version-management/git-and-tools/git-secret/default.nix
index eea7bed011b..3143d7ef9c3 100644
--- a/pkgs/applications/version-management/git-and-tools/git-secret/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git-secret/default.nix
@@ -14,7 +14,7 @@ in stdenv.mkDerivation {
     sha256 = "0hc7yavcp8jmn6b7wngjqhy8kl7f4191sfpik8ycvqghkvvimxj4";
   };
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   installPhase = ''
     install -D git-secret $out/bin/git-secret
diff --git a/pkgs/applications/version-management/git-and-tools/git-sync/default.nix b/pkgs/applications/version-management/git-and-tools/git-sync/default.nix
index 87cb7452c75..add7bfc5526 100644
--- a/pkgs/applications/version-management/git-and-tools/git-sync/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git-sync/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
     sha256 = "01if8y93wa0mwbkzkzx2v1vqh47zlz4k1dysl6yh5rmppd1psknz";
   };
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   dontBuild = true;
 
diff --git a/pkgs/applications/version-management/git-and-tools/git/default.nix b/pkgs/applications/version-management/git-and-tools/git/default.nix
index 3cb214bd8b0..5d1589446be 100644
--- a/pkgs/applications/version-management/git-and-tools/git/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git/default.nix
@@ -7,6 +7,7 @@
 , svnSupport, subversionClient, perlLibs, smtpPerlLibs
 , perlSupport ? true
 , nlsSupport ? true
+, osxkeychainSupport ? stdenv.isDarwin
 , guiSupport
 , withManual ? true
 , pythonSupport ? true
@@ -18,11 +19,12 @@
 , gzip # needed at runtime by gitweb.cgi
 }:
 
+assert osxkeychainSupport -> stdenv.isDarwin;
 assert sendEmailSupport -> perlSupport;
 assert svnSupport -> perlSupport;
 
 let
-  version = "2.30.0";
+  version = "2.30.1";
   svn = subversionClient.override { perlBindings = perlSupport; };
 
   gitwebPerlLibs = with perlPackages; [ CGI HTMLParser CGIFast FCGI FCGIProcManager HTMLTagCloud ];
@@ -34,7 +36,7 @@ stdenv.mkDerivation {
 
   src = fetchurl {
     url = "https://www.kernel.org/pub/software/scm/git/git-${version}.tar.xz";
-    sha256 = "06ad6dylgla34k9am7d5z8y3rryc8ln3ibq5z0d74rcm20hm0wsm";
+    sha256 = "0rwlbps9x8kgk2hsm0bvsrkpsk9bnbnz8alknbd7i688jnhai27r";
   };
 
   outputs = [ "out" ] ++ lib.optional withManual "doc";
@@ -64,10 +66,10 @@ stdenv.mkDerivation {
         --subst-var-by gettext ${gettext}
   '';
 
-  nativeBuildInputs = [ gettext perlPackages.perl ]
+  nativeBuildInputs = [ gettext perlPackages.perl makeWrapper ]
     ++ lib.optionals withManual [ asciidoctor texinfo xmlto docbook2x
          docbook_xsl docbook_xsl_ns docbook_xml_dtd_45 libxslt ];
-  buildInputs = [curl openssl zlib expat cpio makeWrapper libiconv]
+  buildInputs = [curl openssl zlib expat cpio libiconv]
     ++ lib.optionals perlSupport [ perlPackages.perl ]
     ++ lib.optionals guiSupport [tcl tk]
     ++ lib.optionals withpcre2 [ pcre2 ]
@@ -114,7 +116,7 @@ stdenv.mkDerivation {
     make -C contrib/subtree
   '' + (lib.optionalString perlSupport ''
     make -C contrib/diff-highlight
-  '') + (lib.optionalString stdenv.isDarwin ''
+  '') + (lib.optionalString osxkeychainSupport ''
     make -C contrib/credential/osxkeychain
   '') + (lib.optionalString withLibsecret ''
     make -C contrib/credential/libsecret
@@ -128,7 +130,7 @@ stdenv.mkDerivation {
 
   installFlags = [ "NO_INSTALL_HARDLINKS=1" ];
 
-  preInstall = (lib.optionalString stdenv.isDarwin ''
+  preInstall = (lib.optionalString osxkeychainSupport ''
     mkdir -p $out/bin
     ln -s $out/share/git/contrib/credential/osxkeychain/git-credential-osxkeychain $out/bin/
     rm -f $PWD/contrib/credential/osxkeychain/git-credential-osxkeychain.o
@@ -247,8 +249,8 @@ stdenv.mkDerivation {
          notSupported "$out/$prog"
        done
      '')
-   + lib.optionalString stdenv.isDarwin ''
-    # enable git-credential-osxkeychain by default if darwin
+   + lib.optionalString osxkeychainSupport ''
+    # enable git-credential-osxkeychain on darwin if desired (default)
     mkdir -p $out/etc
     cat > $out/etc/gitconfig << EOF
     [credential]
diff --git a/pkgs/applications/version-management/git-and-tools/gitflow/default.nix b/pkgs/applications/version-management/git-and-tools/gitflow/default.nix
index 08bf5eb6ba0..6572b9b7fc8 100644
--- a/pkgs/applications/version-management/git-and-tools/gitflow/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/gitflow/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-kHirHG/bfsU6tKyQ0khNSTyChhzHfzib+HyA3LOtBI8=";
   };
 
-  buildInputs = [ pkgs.makeWrapper ];
+  nativeBuildInputs = [ pkgs.makeWrapper ];
 
   preBuild = ''
     makeFlagsArray+=(prefix="$out")
diff --git a/pkgs/applications/version-management/git-and-tools/svn2git/default.nix b/pkgs/applications/version-management/git-and-tools/svn2git/default.nix
index 69742b6d760..74f10a14288 100644
--- a/pkgs/applications/version-management/git-and-tools/svn2git/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/svn2git/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation {
     sha256 = "0ly2vrv6q31n0xhciwb7a1ilr5c6ndyi3bg81yfp4axiypps7l41";
   };
 
-  buildInputs = [ ruby makeWrapper ];
+  nativeBuildInputs = [ ruby makeWrapper ];
 
   dontBuild = true;
 
diff --git a/pkgs/applications/version-management/git-and-tools/transcrypt/default.nix b/pkgs/applications/version-management/git-and-tools/transcrypt/default.nix
index aebd488fe30..3225744abc5 100644
--- a/pkgs/applications/version-management/git-and-tools/transcrypt/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/transcrypt/default.nix
@@ -11,7 +11,8 @@ stdenv.mkDerivation rec {
     sha256 = "1dkr69plk16wllk5bzlkchrzw63pk239dgbjhrb3mb61i065jdam";
   };
 
-  buildInputs = [ makeWrapper git openssl coreutils util-linux gnugrep gnused gawk ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ git openssl coreutils util-linux gnugrep gnused gawk ];
 
   patches = [ ./helper-scripts_depspathprefix.patch ];
 
diff --git a/pkgs/applications/version-management/mercurial/4.9.nix b/pkgs/applications/version-management/mercurial/4.9.nix
index 29440724274..f499be17f7c 100644
--- a/pkgs/applications/version-management/mercurial/4.9.nix
+++ b/pkgs/applications/version-management/mercurial/4.9.nix
@@ -21,7 +21,8 @@ in python2Packages.buildPythonApplication {
 
   inherit python; # pass it so that the same version can be used in hg2git
 
-  buildInputs = [ makeWrapper docutils unzip ]
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ docutils unzip ]
     ++ lib.optionals stdenv.isDarwin [ ApplicationServices ];
 
   propagatedBuildInputs = [ hg-git dulwich ];
diff --git a/pkgs/applications/version-management/mercurial/default.nix b/pkgs/applications/version-management/mercurial/default.nix
index c841482126a..7c0a96583e7 100644
--- a/pkgs/applications/version-management/mercurial/default.nix
+++ b/pkgs/applications/version-management/mercurial/default.nix
@@ -19,7 +19,8 @@ in python3Packages.buildPythonApplication rec {
 
   passthru = { inherit python; }; # pass it so that the same version can be used in hg2git
 
-  buildInputs = [ makeWrapper docutils unzip ]
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ docutils unzip ]
     ++ lib.optionals stdenv.isDarwin [ ApplicationServices ];
 
   makeFlags = [ "PREFIX=$(out)" ];
diff --git a/pkgs/applications/version-management/monotone-viz/default.nix b/pkgs/applications/version-management/monotone-viz/default.nix
index d6d55eaa4eb..56cc2a4ea5a 100644
--- a/pkgs/applications/version-management/monotone-viz/default.nix
+++ b/pkgs/applications/version-management/monotone-viz/default.nix
@@ -13,8 +13,8 @@ stdenv.mkDerivation rec {
   version = "1.0.2";
   pname = "monotone-viz";
 
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ocaml lablgtk libgnomecanvas glib graphviz_2_0 makeWrapper camlp4];
+  nativeBuildInputs = [ pkg-config makeWrapper ];
+  buildInputs = [ocaml lablgtk libgnomecanvas glib graphviz_2_0 camlp4];
   src = fetchurl {
     url = "http://oandrieu.nerim.net/monotone-viz/${pname}-${version}-nolablgtk.tar.gz";
     sha256 = "1l5x4xqz5g1aaqbc1x80mg0yzkiah9ma9k9mivmn08alkjlakkdk";
diff --git a/pkgs/applications/video/lightworks/default.nix b/pkgs/applications/video/lightworks/default.nix
index 1776aab0033..0312c34bf70 100644
--- a/pkgs/applications/video/lightworks/default.nix
+++ b/pkgs/applications/video/lightworks/default.nix
@@ -30,7 +30,8 @@ let
         }
       else throw "${pname}-${version} is not supported on ${stdenv.hostPlatform.system}";
 
-    buildInputs = [ dpkg makeWrapper ];
+    nativeBuildInputs = [ makeWrapper ];
+    buildInputs = [ dpkg ];
 
     phases = [ "unpackPhase" "installPhase" ];
     unpackPhase = "dpkg-deb -x ${src} ./";
diff --git a/pkgs/applications/video/quvi/tool.nix b/pkgs/applications/video/quvi/tool.nix
index 6718fc1dc36..87c8066a976 100644
--- a/pkgs/applications/video/quvi/tool.nix
+++ b/pkgs/applications/video/quvi/tool.nix
@@ -9,8 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "1h52s265rp3af16dvq1xlscp2926jqap2l4ah94vrfchv6m1hffb";
   };
 
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ lua5 curl quvi_scripts libquvi glib makeWrapper ];
+  nativeBuildInputs = [ pkg-config makeWrapper ];
+  buildInputs = [ lua5 curl quvi_scripts libquvi glib ];
   postInstall = ''
       wrapProgram $out/bin/quvi --set LUA_PATH "${lua5_sockets}/share/lua/${lua5.luaversion}/?.lua"
   '';
diff --git a/pkgs/applications/video/xscast/default.nix b/pkgs/applications/video/xscast/default.nix
index 49f5b43bb73..6501a399088 100644
--- a/pkgs/applications/video/xscast/default.nix
+++ b/pkgs/applications/video/xscast/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation {
     sha256 = "0br27bq9bpglfdpv63h827bipgvhlh10liyhmhcxls4227kagz72";
   };
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   installPhase = ''
     runHook preInstall
diff --git a/pkgs/applications/virtualization/docker/gc.nix b/pkgs/applications/virtualization/docker/gc.nix
index f7bd5a4b069..52ca54501d7 100644
--- a/pkgs/applications/virtualization/docker/gc.nix
+++ b/pkgs/applications/virtualization/docker/gc.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
     sha256 = "07wf9yn0f771xkm3x12946x5rp83hxjkd70xgfgy35zvj27wskzm";
   };
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   installPhase = ''
     mkdir -p $out/bin
diff --git a/pkgs/applications/window-managers/leftwm/default.nix b/pkgs/applications/window-managers/leftwm/default.nix
index 72170401d79..04c232a3e89 100644
--- a/pkgs/applications/window-managers/leftwm/default.nix
+++ b/pkgs/applications/window-managers/leftwm/default.nix
@@ -17,7 +17,8 @@ rustPlatform.buildRustPackage rec {
 
   cargoSha256 = "sha256-j57LHPU3U3ipUGQDrZ8KCuELOVJ3BxhLXsJePOO6rTM=";
 
-  buildInputs = [ makeWrapper libX11 libXinerama ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ libX11 libXinerama ];
 
   postInstall = ''
     wrapProgram $out/bin/leftwm --prefix LD_LIBRARY_PATH : "${rpath}"
diff --git a/pkgs/build-support/cc-wrapper/default.nix b/pkgs/build-support/cc-wrapper/default.nix
index 341e2850437..c8af8789fcc 100644
--- a/pkgs/build-support/cc-wrapper/default.nix
+++ b/pkgs/build-support/cc-wrapper/default.nix
@@ -451,6 +451,8 @@ stdenv.mkDerivation {
       hardening_unsupported_flags+=" stackprotector pic"
     '' + optionalString (targetPlatform.libc == "newlib") ''
       hardening_unsupported_flags+=" stackprotector fortify pie pic"
+    '' + optionalString (targetPlatform.libc == "musl" && targetPlatform.isx86_32) ''
+      hardening_unsupported_flags+=" stackprotector"
     '' + optionalString targetPlatform.isNetBSD ''
       hardening_unsupported_flags+=" stackprotector fortify"
     '' + optionalString cc.langAda or false ''
diff --git a/pkgs/build-support/rust/default.nix b/pkgs/build-support/rust/default.nix
index dc86a7dc581..a7bd296d673 100644
--- a/pkgs/build-support/rust/default.nix
+++ b/pkgs/build-support/rust/default.nix
@@ -2,8 +2,10 @@
 , lib
 , buildPackages
 , cacert
-, cargo
-, diffutils
+, cargoBuildHook
+, cargoCheckHook
+, cargoInstallHook
+, cargoSetupHook
 , fetchCargoTarball
 , runCommandNoCC
 , rustPlatform
@@ -34,14 +36,11 @@
 , nativeBuildInputs ? []
 , cargoUpdateHook ? ""
 , cargoDepsHook ? ""
-, cargoBuildFlags ? []
 , buildType ? "release"
 , meta ? {}
-, target ? rust.toRustTargetSpec stdenv.hostPlatform
 , cargoVendorDir ? null
 , checkType ? buildType
 , depsExtraArgs ? {}
-, cargoParallelTestThreads ? true
 
 # Toggles whether a custom sysroot is created when the target is a .json file.
 , __internal_dontAddSysroot ? false
@@ -71,19 +70,7 @@ let
   # against the src fixed-output derivation to check consistency.
   validateCargoDeps = !(cargoHash == "" && cargoSha256 == "");
 
-  # Some cargo builds include build hooks that modify their own vendor
-  # dependencies. This copies the vendor directory into the build tree and makes
-  # it writable. If we're using a tarball, the unpackFile hook already handles
-  # this for us automatically.
-  setupVendorDir = if cargoVendorDir == null
-    then (''
-      unpackFile "$cargoDeps"
-      cargoDepsCopy=$(stripHash $cargoDeps)
-    '')
-    else ''
-      cargoDepsCopy="$sourceRoot/${cargoVendorDir}"
-    '';
-
+  target = rust.toRustTargetSpec stdenv.hostPlatform;
   targetIsJSON = lib.hasSuffix ".json" target;
   useSysroot = targetIsJSON && !__internal_dontAddSysroot;
 
@@ -99,18 +86,6 @@ let
     originalCargoToml = src + /Cargo.toml; # profile info is later extracted
   };
 
-  ccForBuild="${buildPackages.stdenv.cc}/bin/${buildPackages.stdenv.cc.targetPrefix}cc";
-  cxxForBuild="${buildPackages.stdenv.cc}/bin/${buildPackages.stdenv.cc.targetPrefix}c++";
-  ccForHost="${stdenv.cc}/bin/${stdenv.cc.targetPrefix}cc";
-  cxxForHost="${stdenv.cc}/bin/${stdenv.cc.targetPrefix}c++";
-  releaseDir = "target/${shortTarget}/${buildType}";
-  tmpDir = "${releaseDir}-tmp";
-
-  # Specify the stdenv's `diff` by abspath to ensure that the user's build
-  # inputs do not cause us to find the wrong `diff`.
-  # The `.nativeDrv` stanza works like nativeBuildInputs and ensures cross-compiling has the right version available.
-  diff = "${diffutils.nativeDrv or diffutils}/bin/diff";
-
 in
 
 # Tests don't currently work for `no_std`, and all custom sysroots are currently built without `std`.
@@ -120,11 +95,22 @@ assert useSysroot -> !(args.doCheck or true);
 stdenv.mkDerivation ((removeAttrs args ["depsExtraArgs"]) // lib.optionalAttrs useSysroot {
   RUSTFLAGS = "--sysroot ${sysroot} " + (args.RUSTFLAGS or "");
 } // {
-  inherit cargoDeps;
+  inherit buildAndTestSubdir cargoDeps;
+
+  cargoBuildType = buildType;
 
   patchRegistryDeps = ./patch-registry-deps;
 
-  nativeBuildInputs = nativeBuildInputs ++ [ cacert git cargo rustc ];
+  nativeBuildInputs = nativeBuildInputs ++ [
+    cacert
+    git
+    cargoBuildHook
+    cargoCheckHook
+    cargoInstallHook
+    cargoSetupHook
+    rustc
+  ];
+
   buildInputs = buildInputs ++ lib.optional stdenv.hostPlatform.isMinGW windows.pthreads;
 
   patches = cargoPatches ++ patches;
@@ -135,147 +121,18 @@ stdenv.mkDerivation ((removeAttrs args ["depsExtraArgs"]) // lib.optionalAttrs u
   postUnpack = ''
     eval "$cargoDepsHook"
 
-    ${setupVendorDir}
-
-    mkdir .cargo
-    config="$(pwd)/$cargoDepsCopy/.cargo/config";
-    if [[ ! -e $config ]]; then
-      config=${./fetchcargo-default-config.toml};
-    fi;
-    substitute $config .cargo/config \
-      --subst-var-by vendor "$(pwd)/$cargoDepsCopy"
-
-    cat >> .cargo/config <<'EOF'
-    [target."${rust.toRustTarget stdenv.buildPlatform}"]
-    "linker" = "${ccForBuild}"
-    ${lib.optionalString (stdenv.buildPlatform.config != stdenv.hostPlatform.config) ''
-    [target."${shortTarget}"]
-    "linker" = "${ccForHost}"
-    ${# https://github.com/rust-lang/rust/issues/46651#issuecomment-433611633
-      lib.optionalString (stdenv.hostPlatform.isMusl && stdenv.hostPlatform.isAarch64) ''
-    "rustflags" = [ "-C", "target-feature=+crt-static", "-C", "link-arg=-lgcc" ]
-    ''}
-    ''}
-    EOF
-
     export RUST_LOG=${logLevel}
   '' + (args.postUnpack or "");
 
-  # After unpacking and applying patches, check that the Cargo.lock matches our
-  # src package. Note that we do this after the patchPhase, because the
-  # patchPhase may create the Cargo.lock if upstream has not shipped one.
-  postPatch = (args.postPatch or "") + lib.optionalString validateCargoDeps ''
-    cargoDepsLockfile=$NIX_BUILD_TOP/$cargoDepsCopy/Cargo.lock
-    srcLockfile=$NIX_BUILD_TOP/$sourceRoot/Cargo.lock
-
-    echo "Validating consistency between $srcLockfile and $cargoDepsLockfile"
-    if ! ${diff} $srcLockfile $cargoDepsLockfile; then
-
-      # If the diff failed, first double-check that the file exists, so we can
-      # give a friendlier error msg.
-      if ! [ -e $srcLockfile ]; then
-        echo "ERROR: Missing Cargo.lock from src. Expected to find it at: $srcLockfile"
-        echo "Hint: You can use the cargoPatches attribute to add a Cargo.lock manually to the build."
-        exit 1
-      fi
-
-      if ! [ -e $cargoDepsLockfile ]; then
-        echo "ERROR: Missing lockfile from cargo vendor. Expected to find it at: $cargoDepsLockfile"
-        exit 1
-      fi
-
-      echo
-      echo "ERROR: cargoSha256 is out of date"
-      echo
-      echo "Cargo.lock is not the same in $cargoDepsCopy"
-      echo
-      echo "To fix the issue:"
-      echo '1. Use "0000000000000000000000000000000000000000000000000000" as the cargoSha256 value'
-      echo "2. Build the derivation and wait for it to fail with a hash mismatch"
-      echo "3. Copy the 'got: sha256:' value back into the cargoSha256 field"
-      echo
-
-      exit 1
-    fi
-  '' + ''
-    unset cargoDepsCopy
-  '';
-
   configurePhase = args.configurePhase or ''
     runHook preConfigure
     runHook postConfigure
   '';
 
-  buildPhase = with builtins; args.buildPhase or ''
-    ${lib.optionalString (buildAndTestSubdir != null) "pushd ${buildAndTestSubdir}"}
-    runHook preBuild
-
-    (
-    set -x
-    env \
-      "CC_${rust.toRustTarget stdenv.buildPlatform}"="${ccForBuild}" \
-      "CXX_${rust.toRustTarget stdenv.buildPlatform}"="${cxxForBuild}" \
-      "CC_${rust.toRustTarget stdenv.hostPlatform}"="${ccForHost}" \
-      "CXX_${rust.toRustTarget stdenv.hostPlatform}"="${cxxForHost}" \
-      cargo build -j $NIX_BUILD_CORES \
-        ${lib.optionalString (buildType == "release") "--release"} \
-        --target ${target} \
-        --frozen ${concatStringsSep " " cargoBuildFlags}
-    )
-
-    runHook postBuild
-
-    ${lib.optionalString (buildAndTestSubdir != null) "popd"}
-
-    # This needs to be done after postBuild: packages like `cargo` do a pushd/popd in
-    # the pre/postBuild-hooks that need to be taken into account before gathering
-    # all binaries to install.
-    mkdir -p $tmpDir
-    cp -r $releaseDir/* $tmpDir/
-    bins=$(find $tmpDir \
-      -maxdepth 1 \
-      -type f \
-      -executable ! \( -regex ".*\.\(so.[0-9.]+\|so\|a\|dylib\)" \))
-  '';
-
-  checkPhase = args.checkPhase or (let
-    argstr = "${lib.optionalString (checkType == "release") "--release"} --target ${target} --frozen";
-    threads = if cargoParallelTestThreads then "$NIX_BUILD_CORES" else "1";
-  in ''
-    ${lib.optionalString (buildAndTestSubdir != null) "pushd ${buildAndTestSubdir}"}
-    runHook preCheck
-    echo "Running cargo test ${argstr} -- ''${checkFlags} ''${checkFlagsArray+''${checkFlagsArray[@]}}"
-    cargo test -j $NIX_BUILD_CORES ${argstr} -- --test-threads=${threads} ''${checkFlags} ''${checkFlagsArray+"''${checkFlagsArray[@]}"}
-    runHook postCheck
-    ${lib.optionalString (buildAndTestSubdir != null) "popd"}
-  '');
-
   doCheck = args.doCheck or true;
 
   strictDeps = true;
 
-  inherit releaseDir tmpDir;
-
-  installPhase = args.installPhase or ''
-    runHook preInstall
-
-    # rename the output dir to a architecture independent one
-    mapfile -t targets < <(find "$NIX_BUILD_TOP" -type d | grep '${tmpDir}$')
-    for target in "''${targets[@]}"; do
-      rm -rf "$target/../../${buildType}"
-      ln -srf "$target" "$target/../../"
-    done
-    mkdir -p $out/bin $out/lib
-
-    xargs -r cp -t $out/bin <<< $bins
-    find $tmpDir \
-      -maxdepth 1 \
-      -regex ".*\.\(so.[0-9.]+\|so\|a\|dylib\)" \
-      -print0 | xargs -r -0 cp -t $out/lib
-    rmdir --ignore-fail-on-non-empty $out/lib $out/bin
-    runHook postInstall
-  '';
-
   passthru = { inherit cargoDeps; } // (args.passthru or {});
 
   meta = {
diff --git a/pkgs/build-support/rust/fetchCargoTarball.nix b/pkgs/build-support/rust/fetchCargoTarball.nix
index c30e88d99b8..3b36554e707 100644
--- a/pkgs/build-support/rust/fetchCargoTarball.nix
+++ b/pkgs/build-support/rust/fetchCargoTarball.nix
@@ -21,7 +21,7 @@ in
 , src ? null
 , srcs ? []
 , patches ? []
-, sourceRoot
+, sourceRoot ? ""
 , hash ? ""
 , sha256 ? ""
 , cargoUpdateHook ? ""
diff --git a/pkgs/build-support/rust/hooks/cargo-build-hook.sh b/pkgs/build-support/rust/hooks/cargo-build-hook.sh
new file mode 100644
index 00000000000..54f4512d67c
--- /dev/null
+++ b/pkgs/build-support/rust/hooks/cargo-build-hook.sh
@@ -0,0 +1,35 @@
+declare -a cargoBuildFlags
+
+cargoBuildHook() {
+    echo "Executing cargoBuildHook"
+
+    runHook preBuild
+
+    if [ ! -z "${buildAndTestSubdir-}" ]; then
+        pushd "${buildAndTestSubdir}"
+    fi
+
+    (
+    set -x
+    env \
+      "CC_@rustBuildPlatform@=@ccForBuild@" \
+      "CXX_@rustBuildPlatform@=@cxxForBuild@" \
+      "CC_@rustTargetPlatform@=@ccForHost@" \
+      "CXX_@rustTargetPlatform@=@cxxForHost@" \
+      cargo build -j $NIX_BUILD_CORES \
+        --target @rustTargetPlatformSpec@ \
+        --frozen \
+        --${cargoBuildType} \
+        ${cargoBuildFlags}
+    )
+
+    if [ ! -z "${buildAndTestSubdir-}" ]; then
+        popd
+    fi
+
+    runHook postBuild
+
+    echo "Finished cargoBuildHook"
+}
+
+buildPhase=cargoBuildHook
diff --git a/pkgs/build-support/rust/hooks/cargo-check-hook.sh b/pkgs/build-support/rust/hooks/cargo-check-hook.sh
new file mode 100644
index 00000000000..8c5b1a13219
--- /dev/null
+++ b/pkgs/build-support/rust/hooks/cargo-check-hook.sh
@@ -0,0 +1,41 @@
+declare -a checkFlags
+
+cargoCheckHook() {
+    echo "Executing cargoCheckHook"
+
+    runHook preCheck
+
+    if [[ -n "${buildAndTestSubdir-}" ]]; then
+        pushd "${buildAndTestSubdir}"
+    fi
+
+    if [[ -z ${dontUseCargoParallelTests-} ]]; then
+        threads=$NIX_BUILD_CORES
+    else
+        threads=1
+    fi
+
+    argstr="--${cargoBuildType} --target @rustTargetPlatformSpec@ --frozen";
+
+    (
+        set -x
+        cargo test \
+              -j $NIX_BUILD_CORES \
+              ${argstr} -- \
+              --test-threads=${threads} \
+              ${checkFlags} \
+              ${checkFlagsArray+"${checkFlagsArray[@]}"}
+    )
+
+    if [[ -n "${buildAndTestSubdir-}" ]]; then
+        popd
+    fi
+
+    echo "Finished cargoCheckHook"
+
+    runHook postCheck
+}
+
+if [ -z "${checkPhase-}" ]; then
+  checkPhase=cargoCheckHook
+fi
diff --git a/pkgs/build-support/rust/hooks/cargo-install-hook.sh b/pkgs/build-support/rust/hooks/cargo-install-hook.sh
new file mode 100644
index 00000000000..e6ffa300706
--- /dev/null
+++ b/pkgs/build-support/rust/hooks/cargo-install-hook.sh
@@ -0,0 +1,49 @@
+cargoInstallPostBuildHook() {
+    echo "Executing cargoInstallPostBuildHook"
+
+    releaseDir=target/@shortTarget@/$cargoBuildType
+    tmpDir="${releaseDir}-tmp";
+
+    mkdir -p $tmpDir
+    cp -r ${releaseDir}/* $tmpDir/
+    bins=$(find $tmpDir \
+      -maxdepth 1 \
+      -type f \
+      -executable ! \( -regex ".*\.\(so.[0-9.]+\|so\|a\|dylib\)" \))
+
+    echo "Finished cargoInstallPostBuildHook"
+}
+
+cargoInstallHook() {
+    echo "Executing cargoInstallHook"
+
+    runHook preInstall
+
+    # rename the output dir to a architecture independent one
+
+    releaseDir=target/@shortTarget@/$cargoBuildType
+    tmpDir="${releaseDir}-tmp";
+
+    mapfile -t targets < <(find "$NIX_BUILD_TOP" -type d | grep "${tmpDir}$")
+    for target in "${targets[@]}"; do
+      rm -rf "$target/../../${cargoBuildType}"
+      ln -srf "$target" "$target/../../"
+    done
+    mkdir -p $out/bin $out/lib
+
+    xargs -r cp -t $out/bin <<< $bins
+    find $tmpDir \
+      -maxdepth 1 \
+      -regex ".*\.\(so.[0-9.]+\|so\|a\|dylib\)" \
+      -print0 | xargs -r -0 cp -t $out/lib
+    rmdir --ignore-fail-on-non-empty $out/lib $out/bin
+    runHook postInstall
+
+    echo "Finished cargoInstallHook"
+}
+
+
+if [ -z "${installPhase-}" ]; then
+  installPhase=cargoInstallHook
+  postBuildHooks+=(cargoInstallPostBuildHook)
+fi
diff --git a/pkgs/build-support/rust/hooks/cargo-setup-hook.sh b/pkgs/build-support/rust/hooks/cargo-setup-hook.sh
new file mode 100644
index 00000000000..0fddd30582a
--- /dev/null
+++ b/pkgs/build-support/rust/hooks/cargo-setup-hook.sh
@@ -0,0 +1,84 @@
+cargoSetupPostUnpackHook() {
+    echo "Executing cargoSetupPostUnpackHook"
+
+    # Some cargo builds include build hooks that modify their own vendor
+    # dependencies. This copies the vendor directory into the build tree and makes
+    # it writable. If we're using a tarball, the unpackFile hook already handles
+    # this for us automatically.
+    if [ -z $cargoVendorDir ]; then
+        unpackFile "$cargoDeps"
+        export cargoDepsCopy=$(stripHash $cargoDeps)
+    else
+      cargoDepsCopy="$sourceRoot/${cargoRoot:+$cargoRoot/}${cargoVendorDir}"
+    fi
+
+    if [ ! -d .cargo ]; then
+        mkdir .cargo
+    fi
+
+    config="$(pwd)/$cargoDepsCopy/.cargo/config";
+    if [[ ! -e $config ]]; then
+      config=@defaultConfig@
+    fi;
+
+    tmp_config=$(mktemp)
+    substitute $config $tmp_config \
+      --subst-var-by vendor "$(pwd)/$cargoDepsCopy"
+    cat ${tmp_config} >> .cargo/config
+
+    cat >> .cargo/config <<'EOF'
+    @rustTarget@
+EOF
+
+    echo "Finished cargoSetupPostUnpackHook"
+}
+
+# After unpacking and applying patches, check that the Cargo.lock matches our
+# src package. Note that we do this after the patchPhase, because the
+# patchPhase may create the Cargo.lock if upstream has not shipped one.
+cargoSetupPostPatchHook() {
+    echo "Executing cargoSetupPostPatchHook"
+
+    cargoDepsLockfile="$NIX_BUILD_TOP/$cargoDepsCopy/Cargo.lock"
+    srcLockfile="$NIX_BUILD_TOP/$sourceRoot/${cargoRoot:+$cargoRoot/}/Cargo.lock"
+
+    echo "Validating consistency between $srcLockfile and $cargoDepsLockfile"
+    if ! @diff@ $srcLockfile $cargoDepsLockfile; then
+
+      # If the diff failed, first double-check that the file exists, so we can
+      # give a friendlier error msg.
+      if ! [ -e $srcLockfile ]; then
+        echo "ERROR: Missing Cargo.lock from src. Expected to find it at: $srcLockfile"
+        echo "Hint: You can use the cargoPatches attribute to add a Cargo.lock manually to the build."
+        exit 1
+      fi
+
+      if ! [ -e $cargoDepsLockfile ]; then
+        echo "ERROR: Missing lockfile from cargo vendor. Expected to find it at: $cargoDepsLockfile"
+        exit 1
+      fi
+
+      echo
+      echo "ERROR: cargoSha256 is out of date"
+      echo
+      echo "Cargo.lock is not the same in $cargoDepsCopy"
+      echo
+      echo "To fix the issue:"
+      echo '1. Use "0000000000000000000000000000000000000000000000000000" as the cargoSha256 value'
+      echo "2. Build the derivation and wait for it to fail with a hash mismatch"
+      echo "3. Copy the 'got: sha256:' value back into the cargoSha256 field"
+      echo
+
+      exit 1
+    fi
+
+    unset cargoDepsCopy
+
+    echo "Finished cargoSetupPostPatchHook"
+}
+
+postUnpackHooks+=(cargoSetupPostUnpackHook)
+
+if [ -z ${cargoVendorDir-} ]; then
+  postPatchHooks+=(cargoSetupPostPatchHook)
+fi
diff --git a/pkgs/build-support/rust/hooks/default.nix b/pkgs/build-support/rust/hooks/default.nix
new file mode 100644
index 00000000000..e8927e2b542
--- /dev/null
+++ b/pkgs/build-support/rust/hooks/default.nix
@@ -0,0 +1,94 @@
+{ buildPackages
+, callPackage
+, cargo
+, diffutils
+, lib
+, makeSetupHook
+, maturin
+, rust
+, stdenv
+, target ? rust.toRustTargetSpec stdenv.hostPlatform
+}:
+
+let
+  targetIsJSON = lib.hasSuffix ".json" target;
+
+  # see https://github.com/rust-lang/cargo/blob/964a16a28e234a3d397b2a7031d4ab4a428b1391/src/cargo/core/compiler/compile_kind.rs#L151-L168
+  # the "${}" is needed to transform the path into a /nix/store path before baseNameOf
+  shortTarget = if targetIsJSON then
+      (lib.removeSuffix ".json" (builtins.baseNameOf "${target}"))
+    else target;
+  ccForBuild = "${buildPackages.stdenv.cc}/bin/${buildPackages.stdenv.cc.targetPrefix}cc";
+  cxxForBuild = "${buildPackages.stdenv.cc}/bin/${buildPackages.stdenv.cc.targetPrefix}c++";
+  ccForHost = "${stdenv.cc}/bin/${stdenv.cc.targetPrefix}cc";
+  cxxForHost = "${stdenv.cc}/bin/${stdenv.cc.targetPrefix}c++";
+  rustBuildPlatform = rust.toRustTarget stdenv.buildPlatform;
+  rustTargetPlatform = rust.toRustTarget stdenv.hostPlatform;
+  rustTargetPlatformSpec = rust.toRustTargetSpec stdenv.hostPlatform;
+in {
+  cargoBuildHook = callPackage ({ }:
+    makeSetupHook {
+      name = "cargo-build-hook.sh";
+      deps = [ cargo ];
+      substitutions = {
+        inherit ccForBuild ccForHost cxxForBuild cxxForHost
+          rustBuildPlatform rustTargetPlatform rustTargetPlatformSpec;
+      };
+    } ./cargo-build-hook.sh) {};
+
+  cargoCheckHook = callPackage ({ }:
+    makeSetupHook {
+      name = "cargo-check-hook.sh";
+      deps = [ cargo ];
+      substitutions = {
+        inherit rustTargetPlatformSpec;
+      };
+    } ./cargo-check-hook.sh) {};
+
+  cargoInstallHook = callPackage ({ }:
+    makeSetupHook {
+      name = "cargo-install-hook.sh";
+      deps = [ ];
+      substitutions = {
+        inherit shortTarget;
+      };
+    } ./cargo-install-hook.sh) {};
+
+  cargoSetupHook = callPackage ({ }:
+    makeSetupHook {
+      name = "cargo-setup-hook.sh";
+      deps = [ ];
+      substitutions = {
+        defaultConfig = ../fetchcargo-default-config.toml;
+
+        # Specify the stdenv's `diff` by abspath to ensure that the user's build
+        # inputs do not cause us to find the wrong `diff`.
+        # The `.nativeDrv` stanza works like nativeBuildInputs and ensures cross-compiling has the right version available.
+        diff = "${diffutils.nativeDrv or diffutils}/bin/diff";
+
+        # Target platform
+        rustTarget = ''
+          [target."${rust.toRustTarget stdenv.buildPlatform}"]
+          "linker" = "${ccForBuild}"
+          ${lib.optionalString (stdenv.buildPlatform.config != stdenv.hostPlatform.config) ''
+            [target."${shortTarget}"]
+            "linker" = "${ccForHost}"
+            ${# https://github.com/rust-lang/rust/issues/46651#issuecomment-433611633
+            lib.optionalString (stdenv.hostPlatform.isMusl && stdenv.hostPlatform.isAarch64) ''
+              "rustflags" = [ "-C", "target-feature=+crt-static", "-C", "link-arg=-lgcc" ]
+            ''}
+          ''}
+        '';
+      };
+    } ./cargo-setup-hook.sh) {};
+
+  maturinBuildHook = callPackage ({ }:
+    makeSetupHook {
+      name = "maturin-build-hook.sh";
+      deps = [ cargo maturin ];
+      substitutions = {
+        inherit ccForBuild ccForHost cxxForBuild cxxForHost
+          rustBuildPlatform rustTargetPlatform rustTargetPlatformSpec;
+      };
+    } ./maturin-build-hook.sh) {};
+}
diff --git a/pkgs/build-support/rust/hooks/maturin-build-hook.sh b/pkgs/build-support/rust/hooks/maturin-build-hook.sh
new file mode 100644
index 00000000000..7e2599d9224
--- /dev/null
+++ b/pkgs/build-support/rust/hooks/maturin-build-hook.sh
@@ -0,0 +1,39 @@
+maturinBuildHook() {
+    echo "Executing maturinBuildHook"
+
+    runHook preBuild
+
+    if [ ! -z "${buildAndTestSubdir-}" ]; then
+        pushd "${buildAndTestSubdir}"
+    fi
+
+    (
+    set -x
+    env \
+      "CC_@rustBuildPlatform@=@ccForBuild@" \
+      "CXX_@rustBuildPlatform@=@cxxForBuild@" \
+      "CC_@rustTargetPlatform@=@ccForHost@" \
+      "CXX_@rustTargetPlatform@=@cxxForHost@" \
+      maturin build \
+        --cargo-extra-args="-j $NIX_BUILD_CORES --frozen" \
+        --target @rustTargetPlatformSpec@ \
+        --manylinux off \
+        --strip \
+        --release \
+        ${maturinBuildFlags-}
+    )
+
+    runHook postBuild
+
+    if [ ! -z "${buildAndTestSubdir-}" ]; then
+        popd
+    fi
+
+    # Move the wheel to dist/ so that regular Python tooling can find it.
+    mkdir -p dist
+    mv target/wheels/*.whl dist/
+
+    echo "Finished maturinBuildHook"
+}
+
+buildPhase=maturinBuildHook
diff --git a/pkgs/build-support/setup-systemd-units.nix b/pkgs/build-support/setup-systemd-units.nix
index 4fa2f42c39d..4c7ee86669f 100644
--- a/pkgs/build-support/setup-systemd-units.nix
+++ b/pkgs/build-support/setup-systemd-units.nix
@@ -58,7 +58,7 @@
 
           unitDir=/etc/systemd/system
           if [ ! -w "$unitDir" ]; then
-            unitDir=/etc/systemd-mutable/system
+            unitDir=/nix/var/nix/profiles/default/lib/systemd/system
             mkdir -p "$unitDir"
           fi
           declare -a unitsToStop unitsToStart
diff --git a/pkgs/build-support/templaterpm/default.nix b/pkgs/build-support/templaterpm/default.nix
index ffe5b0b4581..efe70efe6c4 100644
--- a/pkgs/build-support/templaterpm/default.nix
+++ b/pkgs/build-support/templaterpm/default.nix
@@ -4,7 +4,8 @@ stdenv.mkDerivation {
   pname = "nix-template-rpm";
   version = "0.1";
 
-  buildInputs = [ makeWrapper python toposort rpm ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ python toposort rpm ];
 
   phases = [ "installPhase" "fixupPhase" ];
 
diff --git a/pkgs/common-updater/scripts.nix b/pkgs/common-updater/scripts.nix
index 351db619884..26c77e87636 100644
--- a/pkgs/common-updater/scripts.nix
+++ b/pkgs/common-updater/scripts.nix
@@ -3,7 +3,7 @@
 stdenv.mkDerivation {
   name = "common-updater-scripts";
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   dontUnpack = true;
 
diff --git a/pkgs/data/themes/matcha/default.nix b/pkgs/data/themes/matcha/default.nix
index f7f139a9ea9..5297fe05683 100644
--- a/pkgs/data/themes/matcha/default.nix
+++ b/pkgs/data/themes/matcha/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "matcha-gtk-theme";
-  version = "2021-01-12";
+  version = "2021-02-04";
 
   src = fetchFromGitHub {
     owner = "vinceliuice";
     repo = pname;
     rev = version;
-    sha256 = "1h6y89aajygbp1rc3d5dw2vgb64a3hiajlifb4xnzhycc77vjskr";
+    sha256 = "sha256-CDym+yqLu7QpqmdUpXAbJTCjQf/r9D1sl7ZdpaWaXFE=";
   };
 
   buildInputs = [ gdk-pixbuf librsvg ];
diff --git a/pkgs/desktops/xfce/core/thunar/wrapper.nix b/pkgs/desktops/xfce/core/thunar/wrapper.nix
index b0b4268db6e..4e9732ce1c4 100644
--- a/pkgs/desktops/xfce/core/thunar/wrapper.nix
+++ b/pkgs/desktops/xfce/core/thunar/wrapper.nix
@@ -5,7 +5,7 @@ symlinkJoin {
 
   paths = [ thunar ] ++ thunarPlugins;
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   postBuild = ''
     wrapProgram "$out/bin/thunar" \
diff --git a/pkgs/development/compilers/adoptopenjdk-bin/jdk-linux-base.nix b/pkgs/development/compilers/adoptopenjdk-bin/jdk-linux-base.nix
index 0fcad6c333f..1c5fd67f2d9 100644
--- a/pkgs/development/compilers/adoptopenjdk-bin/jdk-linux-base.nix
+++ b/pkgs/development/compilers/adoptopenjdk-bin/jdk-linux-base.nix
@@ -4,16 +4,31 @@ sourcePerArch:
 , lib
 , fetchurl
 , autoPatchelfHook
+, makeWrapper
+# minimum dependencies
 , alsaLib
-, freetype
 , fontconfig
-, zlib
-, xorg
+, freetype
 , libffi
+, xorg
+, zlib
+# runtime dependencies
+, cups
+# runtime dependencies for GTK+ Look and Feel
+, gtkSupport ? true
+, cairo
+, glib
+, gtk3
 }:
 
 let
   cpuName = stdenv.hostPlatform.parsed.cpu.name;
+  runtimeDependencies = [
+    cups
+  ] ++ lib.optionals gtkSupport [
+    cairo glib gtk3
+  ];
+  runtimeLibraryPath = lib.makeLibraryPath runtimeDependencies;
 in
 
 let result = stdenv.mkDerivation rec {
@@ -28,11 +43,19 @@ let result = stdenv.mkDerivation rec {
   };
 
   buildInputs = [
-    alsaLib freetype fontconfig zlib xorg.libX11 xorg.libXext xorg.libXtst
-    xorg.libXi xorg.libXrender stdenv.cc.cc.lib
+    alsaLib # libasound.so wanted by lib/libjsound.so
+    fontconfig
+    freetype
+    stdenv.cc.cc.lib # libstdc++.so.6
+    xorg.libX11
+    xorg.libXext
+    xorg.libXi
+    xorg.libXrender
+    xorg.libXtst
+    zlib
   ] ++ lib.optional stdenv.isAarch32 libffi;
 
-  nativeBuildInputs = [ autoPatchelfHook ];
+  nativeBuildInputs = [ autoPatchelfHook makeWrapper ];
 
   # See: https://github.com/NixOS/patchelf/issues/10
   dontStrip = 1;
@@ -57,6 +80,13 @@ let result = stdenv.mkDerivation rec {
     cat <<EOF >> "$out/nix-support/setup-hook"
     if [ -z "\''${JAVA_HOME-}" ]; then export JAVA_HOME=$out; fi
     EOF
+
+    # We cannot use -exec since wrapProgram is a function but not a command.
+    for bin in $( find "$out" -executable -type f ); do
+      if patchelf --print-interpreter "$bin" &> /dev/null; then
+        wrapProgram "$bin" --prefix LD_LIBRARY_PATH : "${runtimeLibraryPath}"
+      fi
+    done
   '';
 
   preFixup = ''
diff --git a/pkgs/development/compilers/aldor/default.nix b/pkgs/development/compilers/aldor/default.nix
index 2654cc467fe..3799f2c9212 100644
--- a/pkgs/development/compilers/aldor/default.nix
+++ b/pkgs/development/compilers/aldor/default.nix
@@ -10,8 +10,8 @@ stdenv.mkDerivation {
     rev = "15471e75f3d65b93150f414ebcaf59a03054b68d";
   };
 
-  buildInputs = [ gmp which flex bison makeWrapper autoconf automake libtool
-                  jdk perl ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ gmp which flex bison autoconf automake libtool jdk perl ];
 
   preConfigure = ''
     cd aldor ;
diff --git a/pkgs/development/compilers/chicken/4/eggDerivation.nix b/pkgs/development/compilers/chicken/4/eggDerivation.nix
index 4c84ef8c42b..10cf91579a4 100644
--- a/pkgs/development/compilers/chicken/4/eggDerivation.nix
+++ b/pkgs/development/compilers/chicken/4/eggDerivation.nix
@@ -18,7 +18,8 @@ in
 stdenv.mkDerivation ({
   name = "chicken-${name}";
   propagatedBuildInputs = buildInputs;
-  buildInputs = [ makeWrapper chicken ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ chicken ];
 
   CSC_OPTIONS = lib.concatStringsSep " " cscOptions;
 
diff --git a/pkgs/development/compilers/chicken/5/eggDerivation.nix b/pkgs/development/compilers/chicken/5/eggDerivation.nix
index 7102126206a..a6d19eaeb13 100644
--- a/pkgs/development/compilers/chicken/5/eggDerivation.nix
+++ b/pkgs/development/compilers/chicken/5/eggDerivation.nix
@@ -17,7 +17,8 @@ in
 stdenv.mkDerivation ({
   name = "chicken-${name}";
   propagatedBuildInputs = buildInputs;
-  buildInputs = [ makeWrapper chicken ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ chicken ];
 
   CSC_OPTIONS = lib.concatStringsSep " " cscOptions;
 
diff --git a/pkgs/development/compilers/factor-lang/default.nix b/pkgs/development/compilers/factor-lang/default.nix
index fc5f478177c..2c9999ccdb4 100644
--- a/pkgs/development/compilers/factor-lang/default.nix
+++ b/pkgs/development/compilers/factor-lang/default.nix
@@ -19,7 +19,8 @@ stdenv.mkDerivation rec {
     ./fuel-dir.patch
   ];
 
-  buildInputs = with xorg; [ git rlwrap curl pkg-config perl makeWrapper
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = with xorg; [ git rlwrap curl pkg-config perl
     libX11 pango cairo gtk2 gdk-pixbuf gtkglext
     mesa libXmu libXt libICE libSM openssl unzip ];
 
diff --git a/pkgs/development/compilers/gcc/6/default.nix b/pkgs/development/compilers/gcc/6/default.nix
index fa7881e398a..93c9dde61fc 100644
--- a/pkgs/development/compilers/gcc/6/default.nix
+++ b/pkgs/development/compilers/gcc/6/default.nix
@@ -78,7 +78,11 @@ let majorVersion = "6";
       ++ optional (targetPlatform.libc == "musl") ../libgomp-dont-force-initial-exec.patch
 
       # Obtain latest patch with ../update-mcfgthread-patches.sh
-      ++ optional (!crossStageStatic && targetPlatform.isMinGW) ./Added-mcf-thread-model-support-from-mcfgthread.patch;
+      ++ optional (!crossStageStatic && targetPlatform.isMinGW) ./Added-mcf-thread-model-support-from-mcfgthread.patch
+      ++ optional (targetPlatform.libc == "musl" && targetPlatform.isx86_32) (fetchpatch {
+        url = "https://git.alpinelinux.org/aports/plain/main/gcc/gcc-6.1-musl-libssp.patch?id=5e4b96e23871ee28ef593b439f8c07ca7c7eb5bb";
+        sha256 = "1jf1ciz4gr49lwyh8knfhw6l5gvfkwzjy90m7qiwkcbsf4a3fqn2";
+      });
 
     javaEcj = fetchurl {
       # The `$(top_srcdir)/ecj.jar' file is automatically picked up at
diff --git a/pkgs/development/compilers/gcc/7/default.nix b/pkgs/development/compilers/gcc/7/default.nix
index 2ea9033ba63..d9b4c639b5a 100644
--- a/pkgs/development/compilers/gcc/7/default.nix
+++ b/pkgs/development/compilers/gcc/7/default.nix
@@ -72,6 +72,10 @@ let majorVersion = "7";
       })
       ++ optional langFortran ../gfortran-driving.patch
       ++ optional (targetPlatform.libc == "musl" && targetPlatform.isPower) ../ppc-musl.patch
+      ++ optional (targetPlatform.libc == "musl" && targetPlatform.isx86_32) (fetchpatch {
+        url = "https://git.alpinelinux.org/aports/plain/main/gcc/gcc-6.1-musl-libssp.patch?id=5e4b96e23871ee28ef593b439f8c07ca7c7eb5bb";
+        sha256 = "1jf1ciz4gr49lwyh8knfhw6l5gvfkwzjy90m7qiwkcbsf4a3fqn2";
+      })
       ++ optional (targetPlatform.libc == "musl") ../libgomp-dont-force-initial-exec.patch
 
       # Obtain latest patch with ../update-mcfgthread-patches.sh
diff --git a/pkgs/development/compilers/gcc/common/configure-flags.nix b/pkgs/development/compilers/gcc/common/configure-flags.nix
index 4bdec26fd99..443ed19235d 100644
--- a/pkgs/development/compilers/gcc/common/configure-flags.nix
+++ b/pkgs/development/compilers/gcc/common/configure-flags.nix
@@ -94,9 +94,6 @@ let
       # In uclibc cases, libgomp needs an additional '-ldl'
       # and as I don't know how to pass it, I disable libgomp.
       "--disable-libgomp"
-    ] ++ lib.optionals (targetPlatform.libc == "musl") [
-      # musl at least, disable: https://git.buildroot.net/buildroot/commit/?id=873d4019f7fb00f6a80592224236b3ba7d657865
-      "--disable-libmpx"
     ] ++ lib.optional (targetPlatform.libc == "newlib") "--with-newlib"
       ++ lib.optional (targetPlatform.libc == "avrlibc") "--with-avrlibc"
     );
@@ -181,6 +178,9 @@ let
       # On Illumos/Solaris GNU as is preferred
       "--with-gnu-as" "--without-gnu-ld"
     ]
+    ++ lib.optional (targetPlatform.libc == "musl")
+      # musl at least, disable: https://git.buildroot.net/buildroot/commit/?id=873d4019f7fb00f6a80592224236b3ba7d657865
+      "--disable-libmpx"
     ++ lib.optionals (targetPlatform == hostPlatform && targetPlatform.libc == "musl") [
       "--disable-libsanitizer"
       "--disable-symvers"
diff --git a/pkgs/development/compilers/graalvm/community-edition.nix b/pkgs/development/compilers/graalvm/community-edition.nix
index 96ba9afc237..ea18be56250 100644
--- a/pkgs/development/compilers/graalvm/community-edition.nix
+++ b/pkgs/development/compilers/graalvm/community-edition.nix
@@ -1,7 +1,37 @@
-{ lib, stdenv, fetchurl, perl, unzip, glibc, zlib, setJavaClassPath, Foundation, openssl }:
+{ stdenv
+, lib
+, fetchurl
+, autoPatchelfHook
+, setJavaClassPath
+, makeWrapper
+# minimum dependencies
+, Foundation
+, alsaLib
+, fontconfig
+, freetype
+, glibc
+, openssl
+, perl
+, unzip
+, xorg
+, zlib
+# runtime dependencies
+, cups
+# runtime dependencies for GTK+ Look and Feel
+, gtkSupport ? true
+, cairo
+, glib
+, gtk3
+}:
 
 let
   platform = if stdenv.isDarwin then "darwin-amd64" else "linux-amd64";
+  runtimeDependencies = [
+    cups
+  ] ++ lib.optionals gtkSupport [
+    cairo glib gtk3
+  ];
+  runtimeLibraryPath = lib.makeLibraryPath runtimeDependencies;
   common = javaVersion:
     let
       javaVersionPlatform = "${javaVersion}-${platform}";
@@ -50,7 +80,27 @@ let
              url    = "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-${version}/wasm-installable-svm-java${javaVersionPlatform}-${version}.jar";
           })
         ];
-        nativeBuildInputs = [ unzip perl ];
+
+        buildInputs = lib.optionals stdenv.isLinux [
+          alsaLib # libasound.so wanted by lib/libjsound.so
+          fontconfig
+          freetype
+          openssl # libssl.so wanted by languages/ruby/lib/mri/openssl.so
+          stdenv.cc.cc.lib # libstdc++.so.6
+          xorg.libX11
+          xorg.libXext
+          xorg.libXi
+          xorg.libXrender
+          xorg.libXtst
+          zlib
+        ];
+
+        # Workaround for libssl.so.10 wanted by TruffleRuby
+        # Resulting TruffleRuby cannot use `openssl` library.
+        autoPatchelfIgnoreMissingDeps = true;
+
+        nativeBuildInputs = [ unzip perl autoPatchelfHook makeWrapper ];
+
         unpackPhase = ''
            unpack_jar() {
              jar=$1
@@ -136,32 +186,25 @@ let
 
         dontStrip = true;
 
-        # copy-paste openjdk's preFixup
         preFixup = ''
+          # We cannot use -exec since wrapProgram is a function but not a
+          # command.
+          for bin in $( find "$out" -executable -type f -not -path '*/languages/ruby/lib/gems/*' ); do
+            if patchelf --print-interpreter "$bin" &> /dev/null || head -n 1 "$bin" | grep '^#!' -q; then
+              wrapProgram "$bin" \
+                --prefix LD_LIBRARY_PATH : "${runtimeLibraryPath}"
+            fi
+          done
+
+          # copy-paste openjdk's preFixup
           # Set JAVA_HOME automatically.
           mkdir -p $out/nix-support
           cat <<EOF > $out/nix-support/setup-hook
             if [ -z "\''${JAVA_HOME-}" ]; then export JAVA_HOME=$out; fi
           EOF
-        '';
 
-        postFixup = ''
-          rpath="${ {  "8" = "$out/jre/lib/amd64/jli:$out/jre/lib/amd64/server:$out/jre/lib/amd64:$out/jre/languages/ruby/lib/cext";
-                      "11" = "$out/lib/jli:$out/lib/server:$out/lib:$out/languages/ruby/lib/cext";
-                    }.${javaVersion}
-                 }:${
-            lib.makeLibraryPath [
-              stdenv.cc.cc.lib # libstdc++.so.6
-              zlib             # libz.so.1
-            ]}"
-
-          ${lib.optionalString stdenv.isLinux ''
-          for f in $(find $out -type f -perm -0100); do
-            patchelf --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" "$f" || true
-            patchelf --set-rpath   "$rpath"                                    "$f" || true
-            if ldd "$f" | fgrep 'not found'; then echo "in file $f"; fi
-          done
-          ''}
+          find "$out" -name libfontmanager.so -exec \
+            patchelf --add-needed libfontconfig.so {} \;
         '';
 
         # $out/bin/native-image needs zlib to build native executables.
diff --git a/pkgs/development/compilers/kotlin/default.nix b/pkgs/development/compilers/kotlin/default.nix
index cd613c1b33b..2ddc5b3d3a8 100644
--- a/pkgs/development/compilers/kotlin/default.nix
+++ b/pkgs/development/compilers/kotlin/default.nix
@@ -12,7 +12,8 @@ in stdenv.mkDerivation {
   };
 
   propagatedBuildInputs = [ jre ] ;
-  buildInputs = [ makeWrapper unzip ] ;
+  buildInputs = [ unzip ] ;
+  nativeBuildInputs = [ makeWrapper ];
 
   installPhase = ''
     mkdir -p $out
diff --git a/pkgs/development/compilers/llvm/11/clang/default.nix b/pkgs/development/compilers/llvm/11/clang/default.nix
index 3a3e384ad98..2e03112d827 100644
--- a/pkgs/development/compilers/llvm/11/clang/default.nix
+++ b/pkgs/development/compilers/llvm/11/clang/default.nix
@@ -8,7 +8,7 @@ let
     pname = "clang";
     inherit version;
 
-    src = fetch "clang" "0kab4zmkxffg98a3rx95756jlwhxflalin5w05g1anpwxv175xbk";
+    src = fetch "clang" "12sm91qx2m79cvj75a9aazf2x8xybjbd593dv6v7rxficpq8i0ha";
     inherit clang-tools-extra_src;
 
     unpackPhase = ''
diff --git a/pkgs/development/compilers/llvm/11/compiler-rt.nix b/pkgs/development/compilers/llvm/11/compiler-rt.nix
index 091f327550b..5e9e4367685 100644
--- a/pkgs/development/compilers/llvm/11/compiler-rt.nix
+++ b/pkgs/development/compilers/llvm/11/compiler-rt.nix
@@ -11,7 +11,7 @@ in
 stdenv.mkDerivation rec {
   pname = "compiler-rt";
   inherit version;
-  src = fetch pname "1z470r8c5aahdwkmflglx998n0i77j8b1c69d7cir1kf27qy6yq8";
+  src = fetch pname "0x1j8ngf1zj63wlnns9vlibafq48qcm72p4jpaxkmkb4qw0grwfy";
 
   nativeBuildInputs = [ cmake python3 llvm ];
   buildInputs = lib.optional stdenv.hostPlatform.isDarwin libcxxabi;
diff --git a/pkgs/development/compilers/llvm/11/default.nix b/pkgs/development/compilers/llvm/11/default.nix
index ca9ef4382b4..e4d9f45c955 100644
--- a/pkgs/development/compilers/llvm/11/default.nix
+++ b/pkgs/development/compilers/llvm/11/default.nix
@@ -6,7 +6,7 @@
 }:
 
 let
-  release_version = "11.0.1";
+  release_version = "11.1.0";
   candidate = ""; # empty or "rcN"
   dash-candidate = lib.optionalString (candidate != "") "-${candidate}";
   version = "${release_version}${dash-candidate}"; # differentiating these (variables) is important for RCs
@@ -17,7 +17,7 @@ let
     inherit sha256;
   };
 
-  clang-tools-extra_src = fetch "clang-tools-extra" "1j8n6n4l54k2lrdxh266y1fl4z8vy5dc76wsf0csk5n3ikfi38ic";
+  clang-tools-extra_src = fetch "clang-tools-extra" "18n1w1hkv931xzq02b34wglbv6zd6sd0r5kb8piwvag7klj7qw3n";
 
   tools = lib.makeExtensible (tools: let
     callPackage = newScope (tools // { inherit stdenv cmake libxml2 python3 isl release_version version fetch; });
diff --git a/pkgs/development/compilers/llvm/11/libc++/default.nix b/pkgs/development/compilers/llvm/11/libc++/default.nix
index 7a34977afe2..0bb1ae33acd 100644
--- a/pkgs/development/compilers/llvm/11/libc++/default.nix
+++ b/pkgs/development/compilers/llvm/11/libc++/default.nix
@@ -6,7 +6,7 @@ stdenv.mkDerivation {
   pname = "libc++";
   inherit version;
 
-  src = fetch "libcxx" "0gaybwkn76vhakvipxslp7pmv2wm7agxkqwk5f5aizhzc9lzdmcz";
+  src = fetch "libcxx" "1rgqsqpgi0vkga5d7hy0iyfsqgzfz7q1xy7afdfa1snp1qjks8xv";
 
   postUnpack = ''
     unpackFile ${libcxxabi.src}
diff --git a/pkgs/development/compilers/llvm/11/libc++abi.nix b/pkgs/development/compilers/llvm/11/libc++abi.nix
index 22e4ac4abe4..d941044ca60 100644
--- a/pkgs/development/compilers/llvm/11/libc++abi.nix
+++ b/pkgs/development/compilers/llvm/11/libc++abi.nix
@@ -6,7 +6,7 @@ stdenv.mkDerivation {
   pname = "libc++abi";
   inherit version;
 
-  src = fetch "libcxxabi" "0gv8pxq95gvsybldj21hdfkmm0r5cn1z7jhd72l231n0lmb70saa";
+  src = fetch "libcxxabi" "1azcf31mxw59hb1x17xncnm3dyw90ylh8rqx462lvypqh3nr6c8l";
 
   nativeBuildInputs = [ cmake ];
   buildInputs = lib.optional (!stdenv.isDarwin && !stdenv.isFreeBSD && !stdenv.hostPlatform.isWasm) libunwind;
diff --git a/pkgs/development/compilers/llvm/11/libunwind.nix b/pkgs/development/compilers/llvm/11/libunwind.nix
index 1b5fe0f5788..0c635cabc0a 100644
--- a/pkgs/development/compilers/llvm/11/libunwind.nix
+++ b/pkgs/development/compilers/llvm/11/libunwind.nix
@@ -6,7 +6,7 @@ stdenv.mkDerivation rec {
   pname = "libunwind";
   inherit version;
 
-  src = fetch pname "0zsixkaiwp007afxlpsf5dc7wfrv8sj9wxzjw6f1r4bjv1rv3cvd";
+  src = fetch pname "1vpqs2c358v8fbr1r8jmzkfqk12jllimjcfmgxga127ksq9b37nj";
 
   nativeBuildInputs = [ cmake ];
 
diff --git a/pkgs/development/compilers/llvm/11/lld.nix b/pkgs/development/compilers/llvm/11/lld.nix
index cead886f49b..1a16184a6e7 100644
--- a/pkgs/development/compilers/llvm/11/lld.nix
+++ b/pkgs/development/compilers/llvm/11/lld.nix
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
   pname = "lld";
   inherit version;
 
-  src = fetch pname "1dq82dkam8x2niha18v7ckh30zmzyclydzipqkf7h41r3ah0vfk0";
+  src = fetch pname "1kk61i7z5bi9i11rzsd2b388d42if1c7a45zkaa4mk0yps67hyh1";
 
   nativeBuildInputs = [ cmake ];
   buildInputs = [ llvm libxml2 ];
diff --git a/pkgs/development/compilers/llvm/11/lldb.nix b/pkgs/development/compilers/llvm/11/lldb.nix
index fcc73cfdeb6..2f54305736a 100644
--- a/pkgs/development/compilers/llvm/11/lldb.nix
+++ b/pkgs/development/compilers/llvm/11/lldb.nix
@@ -20,7 +20,7 @@ stdenv.mkDerivation (rec {
   pname = "lldb";
   inherit version;
 
-  src = fetch pname "1yzjbsn81l2r3v9js2fxrglkwvz1f2rxyxh6430nydbrs0bqklz8";
+  src = fetch pname "1vlyg015dyng43xqb8cg2l6r9ix8klibxsajazbfnckdnh54hwxj";
 
   patches = [ ./lldb-procfs.patch ];
 
diff --git a/pkgs/development/compilers/llvm/11/llvm.nix b/pkgs/development/compilers/llvm/11/llvm.nix
index 868da1a5b20..cb44643ff78 100644
--- a/pkgs/development/compilers/llvm/11/llvm.nix
+++ b/pkgs/development/compilers/llvm/11/llvm.nix
@@ -32,8 +32,8 @@ in stdenv.mkDerivation (rec {
   pname = "llvm";
   inherit version;
 
-  src = fetch pname "0a5mb65xa5bal8q6cb37xgkqis2bip87fsafgq3wbsva9cjprn6c";
-  polly_src = fetch "polly" "1smrqm9s0r2g9h0v0nil6y9wn2ih4l5bddk4dhgn538ngc7cxpq8";
+  src = fetch pname "199yq3a214avcbi4kk2q0ajriifkvsr0l2dkx3a666m033ihi1ff";
+  polly_src = fetch "polly" "031r23ijhx7v93a5n33m2nc0x9xyqmx0d8xg80z7q971p6qd63sq";
 
   unpackPhase = ''
     unpackFile $src
diff --git a/pkgs/development/compilers/llvm/11/openmp.nix b/pkgs/development/compilers/llvm/11/openmp.nix
index 5503a98ae5f..86e3faee090 100644
--- a/pkgs/development/compilers/llvm/11/openmp.nix
+++ b/pkgs/development/compilers/llvm/11/openmp.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
   pname = "openmp";
   inherit version;
 
-  src = fetch pname "19rcv25y41ww3zlfg0lwprzijl3cn7jgc0v5540jzpp7j0ds45ad";
+  src = fetch pname "0bh5cswgpc79awlq8j5i7hp355adaac7s6zaz0zwp6mkflxli1yi";
 
   nativeBuildInputs = [ cmake perl ];
   buildInputs = [ llvm ];
diff --git a/pkgs/development/compilers/mercury/default.nix b/pkgs/development/compilers/mercury/default.nix
index e063c4c0921..c5e767a46cd 100644
--- a/pkgs/development/compilers/mercury/default.nix
+++ b/pkgs/development/compilers/mercury/default.nix
@@ -10,8 +10,8 @@ stdenv.mkDerivation rec {
     sha256 = "ef093ae81424c4f3fe696eff9aefb5fb66899e11bb17ae0326adfb70d09c1c1f";
   };
 
-  buildInputs = [ gcc flex bison texinfo jdk erlang makeWrapper
-                  readline ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ gcc flex bison texinfo jdk erlang readline ];
 
   patchPhase = ''
     # Fix calls to programs in /bin
diff --git a/pkgs/development/compilers/mozart/binary.nix b/pkgs/development/compilers/mozart/binary.nix
index 8366fd77a47..b043187e6c1 100644
--- a/pkgs/development/compilers/mozart/binary.nix
+++ b/pkgs/development/compilers/mozart/binary.nix
@@ -33,7 +33,7 @@ stdenv.mkDerivation {
 
   TK_LIBRARY = "${tk-8_5}/lib/tk8.5";
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   buildCommand = ''
     mkdir $out
diff --git a/pkgs/development/compilers/openjdk/11.nix b/pkgs/development/compilers/openjdk/11.nix
index 18440a718d1..a24dca373f1 100644
--- a/pkgs/development/compilers/openjdk/11.nix
+++ b/pkgs/development/compilers/openjdk/11.nix
@@ -11,8 +11,8 @@
 let
   major = "11";
   minor = "0";
-  update = "9";
-  build = "11";
+  update = "10";
+  build = "9";
 
   openjdk = stdenv.mkDerivation rec {
     pname = "openjdk" + lib.optionalString headless "-headless";
@@ -22,7 +22,7 @@ let
       owner = "openjdk";
       repo = "jdk${major}u";
       rev = "jdk-${version}";
-      sha256 = "11j2rqz9nag5y562g99py4p72f2kv4wwwyrnaspmrzax00wynyx7";
+      sha256 = "06pm3hpz4ggiqwvkgzxr39y9kga7vk4flakfznz5979bvgb926vw";
     };
 
     nativeBuildInputs = [ pkg-config autoconf ];
diff --git a/pkgs/development/compilers/oraclejdk/jdk-linux-base.nix b/pkgs/development/compilers/oraclejdk/jdk-linux-base.nix
index 7a6cdf4d705..41f4befe469 100644
--- a/pkgs/development/compilers/oraclejdk/jdk-linux-base.nix
+++ b/pkgs/development/compilers/oraclejdk/jdk-linux-base.nix
@@ -83,11 +83,9 @@ let result = stdenv.mkDerivation rec {
       sha256 = sha256.${stdenv.hostPlatform.system};
     };
 
-  nativeBuildInputs = [ file ]
+  nativeBuildInputs = [ file makeWrapper ]
     ++ lib.optional installjce unzip;
 
-  buildInputs = [ makeWrapper ];
-
   # See: https://github.com/NixOS/patchelf/issues/10
   dontStrip = 1;
 
diff --git a/pkgs/development/compilers/rust/binary.nix b/pkgs/development/compilers/rust/binary.nix
index 770cc3415f2..ce4250f675e 100644
--- a/pkgs/development/compilers/rust/binary.nix
+++ b/pkgs/development/compilers/rust/binary.nix
@@ -83,8 +83,8 @@ rec {
       license = [ licenses.mit licenses.asl20 ];
     };
 
-    buildInputs = [ makeWrapper bash ]
-      ++ lib.optional stdenv.isDarwin Security;
+    nativeBuildInputs = [ makeWrapper ];
+    buildInputs = [ bash ] ++ lib.optional stdenv.isDarwin Security;
 
     postPatch = ''
       patchShebangs .
diff --git a/pkgs/development/compilers/rust/make-rust-platform.nix b/pkgs/development/compilers/rust/make-rust-platform.nix
index 4b1f572bebb..584b1fdbe43 100644
--- a/pkgs/development/compilers/rust/make-rust-platform.nix
+++ b/pkgs/development/compilers/rust/make-rust-platform.nix
@@ -12,7 +12,8 @@ rec {
   };
 
   buildRustPackage = callPackage ../../../build-support/rust {
-    inherit rustc cargo fetchCargoTarball;
+    inherit cargoBuildHook cargoCheckHook cargoInstallHook cargoSetupHook
+      fetchCargoTarball rustc;
   };
 
   rustcSrc = callPackage ./rust-src.nix {
@@ -22,4 +23,9 @@ rec {
   rustLibSrc = callPackage ./rust-lib-src.nix {
     inherit rustc;
   };
+
+  # Hooks
+  inherit (callPackage ../../../build-support/rust/hooks {
+    inherit cargo;
+  }) cargoBuildHook cargoCheckHook cargoInstallHook cargoSetupHook maturinBuildHook;
 }
diff --git a/pkgs/development/compilers/rust/rls/default.nix b/pkgs/development/compilers/rust/rls/default.nix
index ee860d78258..aa55866def5 100644
--- a/pkgs/development/compilers/rust/rls/default.nix
+++ b/pkgs/development/compilers/rust/rls/default.nix
@@ -2,7 +2,7 @@
 , openssh, openssl, pkg-config, cmake, zlib, curl, libiconv
 , CoreFoundation, Security }:
 
-rustPlatform.buildRustPackage {
+rustPlatform.buildRustPackage rec {
   pname = "rls";
   inherit (rustPlatform.rust.rustc) src version;
 
@@ -14,7 +14,7 @@ rustPlatform.buildRustPackage {
 
   preBuild = ''
     # client tests are flaky
-    rm tests/client.rs
+    rm ${buildAndTestSubdir}/tests/client.rs
   '';
 
   # a nightly compiler is required unless we use this cheat code.
@@ -28,8 +28,8 @@ rustPlatform.buildRustPackage {
   # rls-rustc links to rustc_private crates
   CARGO_BUILD_RUSTFLAGS = if stdenv.isDarwin then "-C rpath" else null;
 
-  nativeBuildInputs = [ pkg-config cmake ];
-  buildInputs = [ openssh openssl curl zlib libiconv makeWrapper rustPlatform.rust.rustc.llvm ]
+  nativeBuildInputs = [ pkg-config cmake makeWrapper ];
+  buildInputs = [ openssh openssl curl zlib libiconv rustPlatform.rust.rustc.llvm ]
     ++ (lib.optionals stdenv.isDarwin [ CoreFoundation Security ]);
 
   doCheck = true;
diff --git a/pkgs/development/compilers/sbcl/bootstrap.nix b/pkgs/development/compilers/sbcl/bootstrap.nix
index cb42235bc8e..8bdbbadc9d6 100644
--- a/pkgs/development/compilers/sbcl/bootstrap.nix
+++ b/pkgs/development/compilers/sbcl/bootstrap.nix
@@ -51,7 +51,7 @@ stdenv.mkDerivation rec {
     sha256 = cfg.sha256;
   };
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   installPhase = ''
     mkdir -p $out/bin
diff --git a/pkgs/development/compilers/scala/2.x.nix b/pkgs/development/compilers/scala/2.x.nix
index d3fa31ddd94..a91e0dbe1c7 100644
--- a/pkgs/development/compilers/scala/2.x.nix
+++ b/pkgs/development/compilers/scala/2.x.nix
@@ -46,7 +46,7 @@ stdenv.mkDerivation rec {
 
   propagatedBuildInputs = [ jre ];
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   installPhase = ''
       mkdir -p $out
diff --git a/pkgs/development/compilers/scala/dotty-bare.nix b/pkgs/development/compilers/scala/dotty-bare.nix
index b173de58049..66a634914df 100644
--- a/pkgs/development/compilers/scala/dotty-bare.nix
+++ b/pkgs/development/compilers/scala/dotty-bare.nix
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
   };
 
   propagatedBuildInputs = [ jre ncurses.dev ] ;
-  buildInputs = [ makeWrapper ] ;
+  nativeBuildInputs = [ makeWrapper ];
 
   installPhase = ''
     mkdir -p $out
diff --git a/pkgs/development/compilers/smlnj/bootstrap.nix b/pkgs/development/compilers/smlnj/bootstrap.nix
index 113b22768d9..91eb9fc8417 100644
--- a/pkgs/development/compilers/smlnj/bootstrap.nix
+++ b/pkgs/development/compilers/smlnj/bootstrap.nix
@@ -10,7 +10,8 @@ stdenv.mkDerivation rec {
     sha256 = "12jn50h5jz0ac1vzld2mb94p1dyc8h0mk0hip2wj5xqk1dbzwxl4";
   };
 
-  buildInputs = [ cpio rsync makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ cpio rsync ];
 
   unpackPhase = ''
     ${xar}/bin/xar -xf $src
diff --git a/pkgs/development/compilers/tinygo/default.nix b/pkgs/development/compilers/tinygo/default.nix
index 0aee1ca1f39..218b207f243 100644
--- a/pkgs/development/compilers/tinygo/default.nix
+++ b/pkgs/development/compilers/tinygo/default.nix
@@ -40,7 +40,8 @@ buildGoModule rec {
   '';
 
   subPackages = [ "." ];
-  buildInputs = [ llvm clang-unwrapped makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ llvm clang-unwrapped ];
   propagatedBuildInputs = [ lld avrgcc avrdude openocd gcc-arm-embedded ];
 
   postInstall = ''
diff --git a/pkgs/development/compilers/urn/default.nix b/pkgs/development/compilers/urn/default.nix
index f7e338cf43f..8b74f46fd04 100644
--- a/pkgs/development/compilers/urn/default.nix
+++ b/pkgs/development/compilers/urn/default.nix
@@ -30,7 +30,7 @@ stdenv.mkDerivation {
     sha256 = "0nclr3d8ap0y5cg36i7g4ggdqci6m5q27y9f26b57km8p266kcpy";
   };
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
   # Any packages that depend on the compiler have a transitive
   # dependency on the Urn runtime support.
   propagatedBuildInputs = [ urn-rt ];
diff --git a/pkgs/development/compilers/zulu/8.nix b/pkgs/development/compilers/zulu/8.nix
index 2bc90539be1..dd1660d9fec 100644
--- a/pkgs/development/compilers/zulu/8.nix
+++ b/pkgs/development/compilers/zulu/8.nix
@@ -1,7 +1,24 @@
-{ stdenv, lib, fetchurl, unzip, makeWrapper, setJavaClassPath
-, zulu, glib, libxml2, ffmpeg_3, libxslt, libGL, alsaLib
-, fontconfig, freetype, pango, gtk2, cairo, gdk-pixbuf, atk, xorg
-, swingSupport ? true }:
+{ stdenv
+, lib
+, fetchurl
+, autoPatchelfHook
+, unzip
+, makeWrapper
+, setJavaClassPath
+, zulu
+# minimum dependencies
+, alsaLib
+, fontconfig
+, freetype
+, xorg
+# runtime dependencies
+, cups
+# runtime dependencies for GTK+ Look and Feel
+, gtkSupport ? stdenv.isLinux
+, cairo
+, glib
+, gtk3
+}:
 
 let
   version = "8.48.0.53";
@@ -14,14 +31,12 @@ let
   hash = if stdenv.isDarwin then sha256_darwin else sha256_linux;
   extension = if stdenv.isDarwin then "zip" else "tar.gz";
 
-  libraries = [
-    stdenv.cc.libc glib libxml2 ffmpeg_3 libxslt libGL
-    xorg.libXxf86vm alsaLib fontconfig freetype pango
-    gtk2 cairo gdk-pixbuf atk
-  ] ++ (lib.optionals swingSupport (with xorg; [
-    xorg.libX11 xorg.libXext xorg.libXtst xorg.libXi xorg.libXp
-    xorg.libXt xorg.libXrender stdenv.cc.cc
-  ]));
+  runtimeDependencies = [
+    cups
+  ] ++ lib.optionals gtkSupport [
+    cairo glib gtk3
+  ];
+  runtimeLibraryPath = lib.makeLibraryPath runtimeDependencies;
 
 in stdenv.mkDerivation {
   inherit version openjdk platform hash extension;
@@ -33,26 +48,28 @@ in stdenv.mkDerivation {
     sha256 = hash;
   };
 
-  buildInputs = [ makeWrapper ] ++ lib.optional stdenv.isDarwin unzip;
+  buildInputs = lib.optionals stdenv.isLinux [
+    alsaLib # libasound.so wanted by lib/libjsound.so
+    fontconfig
+    freetype
+    stdenv.cc.cc # libstdc++.so.6
+    xorg.libX11
+    xorg.libXext
+    xorg.libXi
+    xorg.libXrender
+    xorg.libXtst
+  ];
+
+  nativeBuildInputs = [
+    autoPatchelfHook makeWrapper
+  ] ++ lib.optionals stdenv.isDarwin [
+    unzip
+  ];
 
   installPhase = ''
     mkdir -p $out
     cp -r ./* "$out/"
 
-    jrePath="$out/jre"
-
-    rpath=$rpath''${rpath:+:}$jrePath/lib/amd64/jli
-    rpath=$rpath''${rpath:+:}$jrePath/lib/amd64/server
-    rpath=$rpath''${rpath:+:}$jrePath/lib/amd64/xawt
-    rpath=$rpath''${rpath:+:}$jrePath/lib/amd64
-
-    # set all the dynamic linkers
-    find $out -type f -perm -0100 \
-        -exec patchelf --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
-        --set-rpath "$rpath" {} \;
-
-    find $out -name "*.so" -exec patchelf --set-rpath "$rpath" {} \;
-
     mkdir -p $out/nix-support
     printWords ${setJavaClassPath} > $out/nix-support/propagated-build-inputs
 
@@ -60,9 +77,19 @@ in stdenv.mkDerivation {
     cat <<EOF >> $out/nix-support/setup-hook
     if [ -z "\''${JAVA_HOME-}" ]; then export JAVA_HOME=$out; fi
     EOF
+  '' + lib.optionalString stdenv.isLinux ''
+    # We cannot use -exec since wrapProgram is a function but not a command.
+    for bin in $( find "$out" -executable -type f ); do
+      if patchelf --print-interpreter "$bin" &> /dev/null; then
+        wrapProgram "$bin" --prefix LD_LIBRARY_PATH : "${runtimeLibraryPath}"
+      fi
+    done
   '';
 
-  rpath = lib.strings.makeLibraryPath libraries;
+  preFixup = ''
+    find "$out" -name libfontmanager.so -exec \
+      patchelf --add-needed libfontconfig.so {} \;
+  '';
 
   passthru = {
     home = zulu;
diff --git a/pkgs/development/compilers/zulu/default.nix b/pkgs/development/compilers/zulu/default.nix
index cbfa9997b8d..000530e66a7 100644
--- a/pkgs/development/compilers/zulu/default.nix
+++ b/pkgs/development/compilers/zulu/default.nix
@@ -1,7 +1,25 @@
-{ stdenv, lib, fetchurl, unzip, makeWrapper, setJavaClassPath
-, zulu, glib, libxml2, ffmpeg_3, libxslt, libGL, alsaLib
-, fontconfig, freetype, pango, gtk2, cairo, gdk-pixbuf, atk, xorg, zlib
-, swingSupport ? true }:
+{ stdenv
+, lib
+, fetchurl
+, autoPatchelfHook
+, unzip
+, makeWrapper
+, setJavaClassPath
+, zulu
+# minimum dependencies
+, alsaLib
+, fontconfig
+, freetype
+, zlib
+, xorg
+# runtime dependencies
+, cups
+# runtime dependencies for GTK+ Look and Feel
+, gtkSupport ? stdenv.isLinux
+, cairo
+, glib
+, gtk3
+}:
 
 let
   version = "11.41.23";
@@ -14,14 +32,12 @@ let
   hash = if stdenv.isDarwin then sha256_darwin else sha256_linux;
   extension = if stdenv.isDarwin then "zip" else "tar.gz";
 
-  libraries = [
-    stdenv.cc.libc glib libxml2 ffmpeg_3 libxslt libGL
-    xorg.libXxf86vm alsaLib fontconfig freetype pango
-    gtk2 cairo gdk-pixbuf atk zlib
-  ] ++ (lib.optionals swingSupport (with xorg; [
-    xorg.libX11 xorg.libXext xorg.libXtst xorg.libXi xorg.libXp
-    xorg.libXt xorg.libXrender stdenv.cc.cc
-  ]));
+  runtimeDependencies = [
+    cups
+  ] ++ lib.optionals gtkSupport [
+    cairo glib gtk3
+  ];
+  runtimeLibraryPath = lib.makeLibraryPath runtimeDependencies;
 
 in stdenv.mkDerivation {
   inherit version openjdk platform hash extension;
@@ -33,23 +49,29 @@ in stdenv.mkDerivation {
     sha256 = hash;
   };
 
-  buildInputs = [ makeWrapper ] ++ lib.optional stdenv.isDarwin unzip;
+  buildInputs = lib.optionals stdenv.isLinux [
+    alsaLib # libasound.so wanted by lib/libjsound.so
+    fontconfig
+    freetype
+    stdenv.cc.cc # libstdc++.so.6
+    xorg.libX11
+    xorg.libXext
+    xorg.libXi
+    xorg.libXrender
+    xorg.libXtst
+    zlib
+  ];
+
+  nativeBuildInputs = [
+    autoPatchelfHook makeWrapper
+  ] ++ lib.optionals stdenv.isDarwin [
+    unzip
+  ];
 
   installPhase = ''
     mkdir -p $out
     cp -r ./* "$out/"
 
-    rpath=$rpath''${rpath:+:}$out/lib/jli
-    rpath=$rpath''${rpath:+:}$out/lib/server
-    rpath=$rpath''${rpath:+:}$out/lib
-
-    # set all the dynamic linkers
-    find $out -type f -perm -0100 \
-        -exec patchelf --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
-        --set-rpath "$rpath" {} \;
-
-    find $out -name "*.so" -exec patchelf --set-rpath "$rpath" {} \;
-
     mkdir -p $out/nix-support
     printWords ${setJavaClassPath} > $out/nix-support/propagated-build-inputs
 
@@ -57,9 +79,17 @@ in stdenv.mkDerivation {
     cat <<EOF >> $out/nix-support/setup-hook
     if [ -z "\''${JAVA_HOME-}" ]; then export JAVA_HOME=$out; fi
     EOF
+  '' + lib.optionalString stdenv.isLinux ''
+    # We cannot use -exec since wrapProgram is a function but not a command.
+    for bin in $( find "$out" -executable -type f ); do
+      wrapProgram "$bin" --prefix LD_LIBRARY_PATH : "${runtimeLibraryPath}"
+    done
   '';
 
-  rpath = lib.strings.makeLibraryPath libraries;
+  preFixup = ''
+    find "$out" -name libfontmanager.so -exec \
+      patchelf --add-needed libfontconfig.so {} \;
+  '';
 
   passthru = {
     home = zulu;
diff --git a/pkgs/development/interpreters/chibi/default.nix b/pkgs/development/interpreters/chibi/default.nix
index 96c884ab602..92531eacd20 100644
--- a/pkgs/development/interpreters/chibi/default.nix
+++ b/pkgs/development/interpreters/chibi/default.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation {
     sha256 = "0nd63i924ifh39cba1hd4sbi6vh1cb73v97nrn4bf8rrjh3k8pdi";
   };
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   installPhase = ''
     make install PREFIX="$out"
diff --git a/pkgs/development/interpreters/clojure/clooj.nix b/pkgs/development/interpreters/clojure/clooj.nix
index 57da5e862e9..baf83c64776 100644
--- a/pkgs/development/interpreters/clojure/clooj.nix
+++ b/pkgs/development/interpreters/clojure/clooj.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation {
     sha256 = "0hbc29bg2a86rm3sx9kvj7h7db9j0kbnrb706wsfiyk3zi3bavnd";
   };
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   phases = "installPhase";
 
diff --git a/pkgs/development/interpreters/elixir/generic-builder.nix b/pkgs/development/interpreters/elixir/generic-builder.nix
index aaf368017ff..0e4beaa8508 100644
--- a/pkgs/development/interpreters/elixir/generic-builder.nix
+++ b/pkgs/development/interpreters/elixir/generic-builder.nix
@@ -20,7 +20,8 @@ in
 
     inherit src version;
 
-    buildInputs = [ erlang makeWrapper ];
+    nativeBuildInputs = [ makeWrapper ];
+    buildInputs = [ erlang ];
 
     LANG = "C.UTF-8";
     LC_TYPE = "C.UTF-8";
diff --git a/pkgs/development/interpreters/groovy/default.nix b/pkgs/development/interpreters/groovy/default.nix
index 0e3a0a46afd..114bc13f5d8 100644
--- a/pkgs/development/interpreters/groovy/default.nix
+++ b/pkgs/development/interpreters/groovy/default.nix
@@ -11,7 +11,8 @@ stdenv.mkDerivation rec {
     sha256 = "1xdpjqx7qaq0syw448b32q36g12pgh1hn6knyqi3k5isp0f09qmr";
   };
 
-  buildInputs = [ unzip makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ unzip ];
 
   installPhase = ''
     mkdir -p $out
diff --git a/pkgs/development/interpreters/jruby/default.nix b/pkgs/development/interpreters/jruby/default.nix
index f792471c061..fb1fdd3c8e0 100644
--- a/pkgs/development/interpreters/jruby/default.nix
+++ b/pkgs/development/interpreters/jruby/default.nix
@@ -13,7 +13,7 @@ jruby = stdenv.mkDerivation rec {
     sha256 = "1dg0fz9b8m1k0sypvpxnf4xjqwc0pyy35xw4rsg4a7pha4jkprrj";
   };
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   installPhase = ''
      mkdir -pv $out/docs
diff --git a/pkgs/development/interpreters/jython/default.nix b/pkgs/development/interpreters/jython/default.nix
index 61cc8f9cd0f..38b599d339e 100644
--- a/pkgs/development/interpreters/jython/default.nix
+++ b/pkgs/development/interpreters/jython/default.nix
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
     sha256 = "142285hd9mx0nx5zw0jvkpqkb4kbhgyyy52p5bj061ya8bg5jizy";
   };
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   dontUnpack = true;
 
diff --git a/pkgs/development/interpreters/perl/default.nix b/pkgs/development/interpreters/perl/default.nix
index 75fe1bac8cb..66e0b284fc0 100644
--- a/pkgs/development/interpreters/perl/default.nix
+++ b/pkgs/development/interpreters/perl/default.nix
@@ -168,11 +168,11 @@ let
       priority = 6; # in `buildEnv' (including the one inside `perl.withPackages') the library files will have priority over files in `perl`
     };
   } // optionalAttrs (stdenv.buildPlatform != stdenv.hostPlatform) rec {
-    crossVersion = "4c55233ae95a6aef4d93291fe8ad12709b11e575"; # Jan 21, 2021
+    crossVersion = "1.3.5"; # Jan 24, 2021
 
     perl-cross-src = fetchurl {
       url = "https://github.com/arsv/perl-cross/archive/${crossVersion}.tar.gz";
-      sha256 = "04bxn43ir7b4c2bb1z1l71l93hrysjv00h879nm70m99q6vxq2hc";
+      sha256 = "1sa2f8s1hc604g5y98w6m6y5q43s9jiyrpnp4b34zkfx1qs3w6l4";
     };
 
     depsBuildBuild = [ buildPackages.stdenv.cc makeWrapper ];
@@ -200,8 +200,8 @@ in {
   perl532 = common {
     perl = pkgs.perl532;
     buildPerl = buildPackages.perl532;
-    version = "5.32.0";
-    sha256 = "1d6001cjnpxfv79000bx00vmv2nvdz7wrnyas451j908y7hirszg";
+    version = "5.32.1";
+    sha256 = "0b7brakq9xs4vavhg391as50nbhzryc7fy5i65r81bnq3j897dh3";
   };
 
   # the latest Devel version
diff --git a/pkgs/development/interpreters/picolisp/default.nix b/pkgs/development/interpreters/picolisp/default.nix
index 341797fa3f4..623eefec416 100644
--- a/pkgs/development/interpreters/picolisp/default.nix
+++ b/pkgs/development/interpreters/picolisp/default.nix
@@ -8,7 +8,8 @@ stdenv.mkDerivation rec {
     url = "https://www.software-lab.de/${pname}-${version}.tgz";
     sha256 = "0l51x98bn1hh6kv40sdgp0x09pzg5i8yxbcjvm9n5bxsd6bbk5w2";
   };
-  buildInputs = [makeWrapper openssl] ++ optional stdenv.is64bit jdk;
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [openssl] ++ optional stdenv.is64bit jdk;
   patchPhase = ''
     sed -i "s/which java/command -v java/g" mkAsm
 
diff --git a/pkgs/development/interpreters/pure/default.nix b/pkgs/development/interpreters/pure/default.nix
index 19e6c93378f..863df66899b 100644
--- a/pkgs/development/interpreters/pure/default.nix
+++ b/pkgs/development/interpreters/pure/default.nix
@@ -11,7 +11,8 @@ stdenv.mkDerivation rec {
     sha256="0px6x5ivcdbbp2pz5n1r1cwg1syadklhjw8piqhl63n91i4r7iyb";
   };
 
-  buildInputs = [ bison flex makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ bison flex ];
   propagatedBuildInputs = [ llvm gmp mpfr readline ];
   NIX_LDFLAGS = "-lLLVMJIT";
 
diff --git a/pkgs/development/interpreters/python/hooks/pytest-check-hook.sh b/pkgs/development/interpreters/python/hooks/pytest-check-hook.sh
index 85811a37475..eb45205ff73 100644
--- a/pkgs/development/interpreters/python/hooks/pytest-check-hook.sh
+++ b/pkgs/development/interpreters/python/hooks/pytest-check-hook.sh
@@ -2,7 +2,7 @@
 echo "Sourcing pytest-check-hook"
 
 declare -ar disabledTests
-declare -ar disabledTestFiles
+declare -ar disabledTestPaths
 
 function _concatSep {
     local result
@@ -37,12 +37,12 @@ function pytestCheckPhase() {
         disabledTestsString=$(_pytestComputeDisabledTestsString "${disabledTests[@]}")
       args+=" -k \""$disabledTestsString"\""
     fi
-    for file in ${disabledTestFiles[@]}; do
-      if [ ! -f "$file" ]; then
-        echo "Disabled test file \"$file\" does not exist. Aborting"
+    for path in ${disabledTestPaths[@]}; do
+      if [ ! -e "$path" ]; then
+        echo "Disabled tests path \"$path\" does not exist. Aborting"
         exit 1
       fi
-      args+=" --ignore=\"$file\""
+      args+=" --ignore=\"$path\""
     done
     args+=" ${pytestFlagsArray[@]}"
     eval "@pythonCheckInterpreter@ $args"
diff --git a/pkgs/development/interpreters/rakudo/zef.nix b/pkgs/development/interpreters/rakudo/zef.nix
index 5eccebf0245..42e82cd3a51 100644
--- a/pkgs/development/interpreters/rakudo/zef.nix
+++ b/pkgs/development/interpreters/rakudo/zef.nix
@@ -11,7 +11,8 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-wccVMEUAfTWs/8hnrT7nrxfYPHyNl+lXt+KUDkyplto=";
   };
 
-  buildInputs = [ rakudo makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ rakudo ];
 
   installPhase = ''
     mkdir -p "$out"
diff --git a/pkgs/development/interpreters/rascal/default.nix b/pkgs/development/interpreters/rascal/default.nix
index cd2b74db052..8b49a743b4a 100644
--- a/pkgs/development/interpreters/rascal/default.nix
+++ b/pkgs/development/interpreters/rascal/default.nix
@@ -8,7 +8,8 @@ stdenv.mkDerivation rec {
     sha256 = "1z4mwdbdc3r24haljnxng8znlfg2ihm9bf9zq8apd9a32ipcw4i6";
   };
 
-  buildInputs = [ makeWrapper jdk ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ jdk ];
 
   dontUnpack = true;
 
diff --git a/pkgs/development/interpreters/spidermonkey/78.nix b/pkgs/development/interpreters/spidermonkey/78.nix
index 81ebcedf7bc..e04069f6aec 100644
--- a/pkgs/development/interpreters/spidermonkey/78.nix
+++ b/pkgs/development/interpreters/spidermonkey/78.nix
@@ -15,7 +15,7 @@
 , rustc
 , rust-cbindgen
 , yasm
-, llvmPackages
+, llvmPackages_11
 , nspr
 }:
 
@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [
     autoconf213
     cargo
-    llvmPackages.llvm # for llvm-objdump
+    llvmPackages_11.llvm # for llvm-objdump
     perl
     pkg-config
     python3
diff --git a/pkgs/development/interpreters/tcl/8.6.nix b/pkgs/development/interpreters/tcl/8.6.nix
index d76ceb3421d..37a7fee8a85 100644
--- a/pkgs/development/interpreters/tcl/8.6.nix
+++ b/pkgs/development/interpreters/tcl/8.6.nix
@@ -2,10 +2,10 @@
 
 callPackage ./generic.nix (args // rec {
   release = "8.6";
-  version = "${release}.9";
+  version = "${release}.11";
 
   src = fetchurl {
     url = "mirror://sourceforge/tcl/tcl${version}-src.tar.gz";
-    sha256 = "0kjzj7mkzfnb7ksxanbibibfpciyvsh5ffdlhs0bmfc75kgd435d";
+    sha256 = "0n4211j80mxr6ql0xx52rig8r885rcbminfpjdb2qrw6hmk8c14c";
   };
 })
diff --git a/pkgs/development/interpreters/wasmer/default.nix b/pkgs/development/interpreters/wasmer/default.nix
index 60ce4d89f19..91e13ed32cd 100644
--- a/pkgs/development/interpreters/wasmer/default.nix
+++ b/pkgs/development/interpreters/wasmer/default.nix
@@ -26,7 +26,7 @@ rustPlatform.buildRustPackage rec {
   # using the [makefile](https://github.com/wasmerio/wasmer/blob/master/Makefile).
   # Enabling cranelift as this used to be the old default. At least one backend is
   # needed for the run subcommand to work.
-  cargoBuildFlags = [ "--features 'backend-cranelift'" ];
+  cargoBuildFlags = [ "--features" "backend-cranelift" ];
 
   LIBCLANG_PATH = "${llvmPackages.libclang}/lib";
 
diff --git a/pkgs/development/libraries/audio/lilv/default.nix b/pkgs/development/libraries/audio/lilv/default.nix
index 79f09f48464..f074287ab16 100644
--- a/pkgs/development/libraries/audio/lilv/default.nix
+++ b/pkgs/development/libraries/audio/lilv/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "lilv";
-  version = "0.24.10";
+  version = "0.24.12";
 
   src = fetchurl {
     url = "https://download.drobilla.net/${pname}-${version}.tar.bz2";
-    sha256 = "1565zy0yz46cf2f25pi46msdnzkj6bbhml9gfigdpjnsdlyskfyi";
+    sha256 = "sha256-JqN3kIkMnB+DggO0f1sjIDNP6SwCpNJuu+Jmnb12kGE=";
   };
 
   patches = [ ./lilv-pkgconfig.patch ];
diff --git a/pkgs/development/libraries/audio/lv2/default.nix b/pkgs/development/libraries/audio/lv2/default.nix
index 45caf0b36c5..616ad5b0c89 100644
--- a/pkgs/development/libraries/audio/lv2/default.nix
+++ b/pkgs/development/libraries/audio/lv2/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "lv2";
-  version = "1.18.0";
+  version = "1.18.2";
 
   src = fetchurl {
     url = "https://lv2plug.in/spec/${pname}-${version}.tar.bz2";
-    sha256 = "0gs7401xz23q9vajqr31aa2db8dvssgyh5zrvr4ipa6wig7yb8wh";
+    sha256 = "sha256-TokfvHRMBYVb6136gugisUkX3Wbpj4K4Iw29HHqy4F4=";
   };
 
   nativeBuildInputs = [ pkg-config wafHook ];
diff --git a/pkgs/development/libraries/glibc/2.32-35.patch.gz b/pkgs/development/libraries/glibc/2.32-master.patch.gz
similarity index 87%
rename from pkgs/development/libraries/glibc/2.32-35.patch.gz
rename to pkgs/development/libraries/glibc/2.32-master.patch.gz
index f77e490ebf5..36aaf51cce9 100644
Binary files a/pkgs/development/libraries/glibc/2.32-35.patch.gz and b/pkgs/development/libraries/glibc/2.32-master.patch.gz differ
diff --git a/pkgs/development/libraries/glibc/common.nix b/pkgs/development/libraries/glibc/common.nix
index 54882ba6718..8bf78300739 100644
--- a/pkgs/development/libraries/glibc/common.nix
+++ b/pkgs/development/libraries/glibc/common.nix
@@ -42,7 +42,7 @@
 
 let
   version = "2.32";
-  patchSuffix = "-35";
+  patchSuffix = "-37";
   sha256 = "0di848ibffrnwq7g2dvgqrnn4xqhj3h96csn69q4da51ymafl9qn";
 in
 
@@ -63,10 +63,10 @@ stdenv.mkDerivation ({
          and using git or something would complicate bootstrapping.
          Fortunately it's not too big.
           $ git checkout origin/release/2.32/master; git describe
-          glibc-2.32-35-g082798622d
-          $ git show --reverse glibc-2.32.. | gzip -n -9 --rsyncable - > 2.32-35.patch.gz
+          glibc-2.32-37-g760e1d2878
+          $ git show --reverse glibc-2.32.. | gzip -n -9 --rsyncable - > 2.32-master.patch.gz
        */
-      ./2.32-35.patch.gz
+      ./2.32-master.patch.gz
 
       /* Allow NixOS and Nix to handle the locale-archive. */
       ./nix-locale-archive.patch
diff --git a/pkgs/development/libraries/gnu-config/default.nix b/pkgs/development/libraries/gnu-config/default.nix
index 74b94e68f56..a08997ea2cd 100644
--- a/pkgs/development/libraries/gnu-config/default.nix
+++ b/pkgs/development/libraries/gnu-config/default.nix
@@ -1,20 +1,20 @@
 { lib, stdenv, fetchurl }:
 
 let
-  rev = "e78c96e5288993aaea3ec44e5c6ee755c668da79";
+  rev = "6faca61810d335c7837f320733fe8e15a1431fc2";
 
   # Don't use fetchgit as this is needed during Aarch64 bootstrapping
   configGuess = fetchurl {
     url = "https://git.savannah.gnu.org/cgit/config.git/plain/config.guess?id=${rev}";
-    sha256 = "sha256-TSLpYIDGSp1flqCBi2Sgg9IWDV5bcO+Hn2Menv3R6KU=";
+    sha256 = "06wkkhpbx9slmknr2g7mcd8x3zsdhnmmay25l31h3rkdp1wkq7kx";
   };
   configSub = fetchurl {
     url = "https://git.savannah.gnu.org/cgit/config.git/plain/config.sub?id=${rev}";
-    sha256 = "sha256-DkCGDN/DE3phQ1GO/Ua5ZPPtp0Ya93PnW3yfSK8EV9s=";
+    sha256 = "1qkph8cqanmgy3s4a18bm1a4vk62i8pf8cy5pc1hkpqwn4g6l0di";
   };
 in stdenv.mkDerivation {
   pname = "gnu-config";
-  version = "2020-05-04";
+  version = "2021-01-25";
 
   buildCommand = ''
     mkdir -p $out
diff --git a/pkgs/development/libraries/harfbuzz/default.nix b/pkgs/development/libraries/harfbuzz/default.nix
index b3615893b53..3f31a3f6db3 100644
--- a/pkgs/development/libraries/harfbuzz/default.nix
+++ b/pkgs/development/libraries/harfbuzz/default.nix
@@ -11,7 +11,7 @@
 }:
 
 let
-  version = "2.7.2";
+  version = "2.7.4";
   inherit (lib) optional optionals optionalString;
   mesonFeatureFlag = opt: b:
     "-D${opt}=${if b then "enabled" else "disabled"}";
@@ -24,7 +24,7 @@ stdenv.mkDerivation {
     owner  = "harfbuzz";
     repo   = "harfbuzz";
     rev    = version;
-    sha256 = "0vfyxr3lvzp80j1347nrwpr1ndv265p15rj2q8rj31lb26nyz4dm";
+    sha256 = "sha256-uMkniDNBQ2mxDmeM7K/YQtZ3Avh9RVXYe7XsUErGas8=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/libraries/hunspell/wrapper.nix b/pkgs/development/libraries/hunspell/wrapper.nix
index 34c3d26c55e..4ae17723275 100644
--- a/pkgs/development/libraries/hunspell/wrapper.nix
+++ b/pkgs/development/libraries/hunspell/wrapper.nix
@@ -5,7 +5,7 @@ let
 in
 stdenv.mkDerivation {
   name = (appendToName "with-dicts" hunspell).name;
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
   buildCommand = ''
     makeWrapper ${hunspell.bin}/bin/hunspell $out/bin/hunspell --prefix DICPATH : ${searchPath}
   '';
diff --git a/pkgs/development/libraries/icu/68.nix b/pkgs/development/libraries/icu/68.nix
new file mode 100644
index 00000000000..5aeba0f2628
--- /dev/null
+++ b/pkgs/development/libraries/icu/68.nix
@@ -0,0 +1,4 @@
+import ./base.nix {
+  version = "68.2";
+  sha256 = "09fng7a80xj8d5r1cgbgq8r47dsw5jsr6si9p2cj2ylhwgg974f7";
+}
diff --git a/pkgs/development/libraries/java/lombok/default.nix b/pkgs/development/libraries/java/lombok/default.nix
index ddf95ead249..5519a1fb766 100644
--- a/pkgs/development/libraries/java/lombok/default.nix
+++ b/pkgs/development/libraries/java/lombok/default.nix
@@ -8,7 +8,7 @@ stdenv.mkDerivation rec {
     sha256 = "1msys7xkaj0d7fi112fmb2z50mk46db58agzrrdyimggsszwn1kj";
   };
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   outputs = [ "out" "bin" ];
 
diff --git a/pkgs/development/libraries/json-glib/default.nix b/pkgs/development/libraries/json-glib/default.nix
index a820d947b7f..ed086dac90f 100644
--- a/pkgs/development/libraries/json-glib/default.nix
+++ b/pkgs/development/libraries/json-glib/default.nix
@@ -1,23 +1,47 @@
-{ lib, stdenv, fetchurl, glib, meson, ninja, pkg-config, gettext
-, gobject-introspection, fixDarwinDylibNames, gnome3
+{ lib
+, stdenv
+, fetchurl
+, glib
+, meson
+, ninja
+, pkg-config
+, gettext
+, gobject-introspection
+, fixDarwinDylibNames
+, gtk-doc
+, docbook-xsl-nons
+, docbook_xml_dtd_43
+, gnome3
 }:
 
-let
+stdenv.mkDerivation rec {
   pname = "json-glib";
-  version = "1.4.4";
-in stdenv.mkDerivation rec {
-  name = "${pname}-${version}";
+  version = "1.6.2";
+
+  outputs = [ "out" "dev" "devdoc" ];
 
   src = fetchurl {
-    url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${name}.tar.xz";
-    sha256 = "0ixwyis47v5bkx6h8a1iqlw3638cxcv57ivxv4gw2gaig51my33j";
+    url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
+    sha256 = "092g2dyy1hhl0ix9kp33wcab0pg1qicnsv0cj5ms9g9qs336cgd3";
   };
 
-  propagatedBuildInputs = [ glib ];
-  nativeBuildInputs = [ meson ninja pkg-config gettext gobject-introspection glib ]
-    ++ lib.optional stdenv.hostPlatform.isDarwin fixDarwinDylibNames;
+  nativeBuildInputs = [
+    meson
+    ninja
+    pkg-config
+    gettext
+    gobject-introspection
+    glib
+    gtk-doc
+    docbook-xsl-nons
+    docbook_xml_dtd_43
+  ] ++ lib.optional stdenv.hostPlatform.isDarwin [
+    fixDarwinDylibNames
+  ];
 
-  outputs = [ "out" "dev" ];
+  propagatedBuildInputs = [
+    glib
+  ];
 
   doCheck = true;
 
@@ -30,8 +54,8 @@ in stdenv.mkDerivation rec {
   meta = with lib; {
     description = "A library providing (de)serialization support for the JavaScript Object Notation (JSON) format";
     homepage = "https://wiki.gnome.org/Projects/JsonGlib";
-    license = licenses.lgpl2;
-    maintainers = with maintainers; [ lethalman ];
+    license = licenses.lgpl21Plus;
+    maintainers = teams.gnome.members;
     platforms = with platforms; unix;
   };
 }
diff --git a/pkgs/development/libraries/lcms2/default.nix b/pkgs/development/libraries/lcms2/default.nix
index 129b5785198..66bdcc03b96 100644
--- a/pkgs/development/libraries/lcms2/default.nix
+++ b/pkgs/development/libraries/lcms2/default.nix
@@ -1,11 +1,11 @@
 { lib, stdenv, fetchurl, libtiff, libjpeg, zlib }:
 
 stdenv.mkDerivation rec {
-  name = "lcms2-2.11";
+  name = "lcms2-2.12";
 
   src = fetchurl {
     url = "mirror://sourceforge/lcms/${name}.tar.gz";
-    sha256 = "0bkpf315925lhmd9i4mzjnkq5dh255r1lms0c0vzzkfpwk4bjjfw";
+    sha256 = "sha256-GGY5hehkEARVrD5QdiXEOMNxA1TYXly7fNQEPhH+EPU=";
   };
 
   outputs = [ "bin" "dev" "out" ];
diff --git a/pkgs/development/libraries/libaom/default.nix b/pkgs/development/libraries/libaom/default.nix
index edbc61957c0..5483909689d 100644
--- a/pkgs/development/libraries/libaom/default.nix
+++ b/pkgs/development/libraries/libaom/default.nix
@@ -2,12 +2,12 @@
 
 stdenv.mkDerivation rec {
   pname = "libaom";
-  version = "2.0.1";
+  version = "2.0.2";
 
   src = fetchgit {
     url = "https://aomedia.googlesource.com/aom";
     rev	= "v${version}";
-    sha256 = "1vakwmcwvmmrdw7460m8hzq96y71lxqix8b2g07c6s12br0rrdhl";
+    sha256 = "0f3i983s9yvh9zc6mpy1ck5sjcg9l09lpw9v4md3mv8gbih9f0z0";
   };
 
   patches = [ ./outputs.patch ];
diff --git a/pkgs/development/libraries/libblockdev/default.nix b/pkgs/development/libraries/libblockdev/default.nix
index 11a65006422..584ea93293e 100644
--- a/pkgs/development/libraries/libblockdev/default.nix
+++ b/pkgs/development/libraries/libblockdev/default.nix
@@ -6,13 +6,13 @@
 }:
 stdenv.mkDerivation rec {
   pname = "libblockdev";
-  version = "2.24";
+  version = "2.25";
 
   src = fetchFromGitHub {
     owner = "storaged-project";
     repo = "libblockdev";
     rev = "${version}-1";
-    sha256 = "1gzwlwdv0jyb3lh2n016limy2ngfdsa05x7jvg9llf2ls672nq89";
+    sha256 = "sha256-eHUHTogKoNrnwwSo6JaI7NMxVt9JeMqfWyhR62bDMuQ=";
   };
 
   outputs = [ "out" "dev" "devdoc" ];
diff --git a/pkgs/development/libraries/libbytesize/default.nix b/pkgs/development/libraries/libbytesize/default.nix
index a84f010b9e6..7ce8d6e7f83 100644
--- a/pkgs/development/libraries/libbytesize/default.nix
+++ b/pkgs/development/libraries/libbytesize/default.nix
@@ -4,7 +4,7 @@
 }:
 
 let
-  version = "2.4";
+  version = "2.5";
 in stdenv.mkDerivation rec {
   pname = "libbytesize";
   inherit version;
@@ -13,7 +13,7 @@ in stdenv.mkDerivation rec {
     owner = "storaged-project";
     repo = "libbytesize";
     rev = version;
-    sha256 = "1kq0hnw2yxjdmcrwvgp0x4j1arkka23k8vp2l6nqcw9lc15x18fp";
+    sha256 = "sha256-F8Ur8gtNYp4PYfBQ9sDJGBgW7KohJYNEU9SI2SbNuvM=";
   };
 
   outputs = [ "out" "dev" "devdoc" ];
diff --git a/pkgs/development/libraries/libdatrie/default.nix b/pkgs/development/libraries/libdatrie/default.nix
index f4e2df36d91..257673b1a96 100644
--- a/pkgs/development/libraries/libdatrie/default.nix
+++ b/pkgs/development/libraries/libdatrie/default.nix
@@ -7,6 +7,8 @@ stdenv.mkDerivation rec {
   pname = "libdatrie";
   version = "2019-12-20";
 
+  outputs = [ "bin" "out" "lib" "dev" ];
+
   src = fetchFromGitHub {
     owner = "tlwg";
     repo = "libdatrie";
diff --git a/pkgs/development/libraries/libevdev/default.nix b/pkgs/development/libraries/libevdev/default.nix
index daae6984ab2..33b3f0b32e1 100644
--- a/pkgs/development/libraries/libevdev/default.nix
+++ b/pkgs/development/libraries/libevdev/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libevdev";
-  version = "1.10.0";
+  version = "1.11.0";
 
   src = fetchurl {
     url = "https://www.freedesktop.org/software/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "0jidjv78lay8kl3yigwhx9fii908sk7gn9nfd2ny12ql5ipc48im";
+    sha256 = "sha256-Y/TqFImFihCQgOC0C9Q+TgkDoeEuqIjVgduMSVdHwtA=";
   };
 
   nativeBuildInputs = [ python3 ];
diff --git a/pkgs/development/libraries/libexecinfo/30-linux-makefile.patch b/pkgs/development/libraries/libexecinfo/30-linux-makefile.patch
new file mode 100644
index 00000000000..134c64441d3
--- /dev/null
+++ b/pkgs/development/libraries/libexecinfo/30-linux-makefile.patch
@@ -0,0 +1,44 @@
+--- Makefile.orig
++++ Makefile
+@@ -23,24 +23,25 @@
+ # SUCH DAMAGE.
+ #
+ # $Id: Makefile,v 1.3 2004/07/19 05:19:55 sobomax Exp $
++#
++# Linux Makefile by Matt Smith <mcs@darkregion.net>, 2011/01/04
+ 
+-LIB=	execinfo
++CC=cc
++AR=ar
++EXECINFO_CFLAGS=$(CFLAGS) -O2 -pipe -fno-strict-aliasing -std=gnu99 -c
++EXECINFO_LDFLAGS=$(LDFLAGS)
+ 
+-SRCS=	stacktraverse.c stacktraverse.h execinfo.c execinfo.h
++all: static dynamic
+ 
+-INCS=	execinfo.h
++static:
++	$(CC) $(EXECINFO_CFLAGS) $(EXECINFO_LDFLAGS) stacktraverse.c
++	$(CC) $(EXECINFO_CFLAGS) $(EXECINFO_LDFLAGS) execinfo.c
++	$(AR) rcs libexecinfo.a stacktraverse.o execinfo.o
+ 
+-SHLIB_MAJOR=	1
+-SHLIB_MINOR=	0
++dynamic:
++	$(CC) -fpic -DPIC $(EXECINFO_CFLAGS) $(EXECINFO_LDFLAGS) stacktraverse.c -o stacktraverse.So
++	$(CC) -fpic -DPIC $(EXECINFO_CFLAGS) $(EXECINFO_LDFLAGS) execinfo.c -o execinfo.So
++	$(CC) -shared -Wl,-soname,libexecinfo.so.1 -o libexecinfo.so.1 stacktraverse.So execinfo.So
+ 
+-NOPROFILE=	yes
+-
+-DPADD=		${LIBM}
+-LDADD=		-lm
+-
+-#WARNS?=	4
+-
+-#stacktraverse.c: gen.py
+-#	./gen.py > stacktraverse.c
+-
+-.include <bsd.lib.mk>
++clean:
++	rm -rf *.o *.So *.a *.so
diff --git a/pkgs/development/libraries/libexecinfo/default.nix b/pkgs/development/libraries/libexecinfo/default.nix
index f3f89209707..36f956e7772 100644
--- a/pkgs/development/libraries/libexecinfo/default.nix
+++ b/pkgs/development/libraries/libexecinfo/default.nix
@@ -23,14 +23,11 @@ stdenv.mkDerivation rec {
       url = "https://git.alpinelinux.org/aports/plain/main/libexecinfo/20-define-gnu-source.patch?id=730cdcef6901750f4029d4c3b8639ce02ee3ead1";
       sha256 = "1mp8mc639b0h2s69m5z6s2h3q3n1zl298j9j0plzj7f979j76302";
     })
-    (fetchpatch {
-      name = "30-linux-makefile.patch";
-      url = "https://git.alpinelinux.org/aports/plain/main/libexecinfo/30-linux-makefile.patch?id=730cdcef6901750f4029d4c3b8639ce02ee3ead1";
-      sha256 = "1jwjz22z5cjy5h2bfghn62yl9ar8jiqhdvbwrcfavv17ihbhwcaf";
-    })
+    ./30-linux-makefile.patch
   ];
 
   makeFlags = [ "CC:=$(CC)" "AR:=$(AR)" ];
+  hardeningEnable = [ "stackprotector" ];
 
   buildFlags =
       lib.optional enableStatic "static"
diff --git a/pkgs/development/libraries/libgcrypt/default.nix b/pkgs/development/libraries/libgcrypt/default.nix
index 081b67b1663..f3db8d8c03b 100644
--- a/pkgs/development/libraries/libgcrypt/default.nix
+++ b/pkgs/development/libraries/libgcrypt/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchurl, gettext, libgpgerror, enableCapabilities ? false, libcap
-, buildPackages
+, buildPackages, fetchpatch
 }:
 
 assert enableCapabilities -> stdenv.isLinux;
@@ -13,6 +13,15 @@ stdenv.mkDerivation rec {
     sha256 = "1nb50bgzp83q6r5cz4v40y1mcbhpqwqyxlay87xp1lrbkf5pm9n5";
   };
 
+  patches = [
+    # fix build on 32bit musl
+    (fetchpatch {
+      name = "fix_building_with_disable-asm_on_x86.patch";
+      url = "https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git;a=commitdiff_plain;h=af23ab5c5482d625ff52e60606cf044e2b0106c8";
+      sha256 = "1m8apm8wra6fk89ggha4d0bba5absihm38zvb2khklqh9q5hj9jw";
+    })
+  ];
+
   outputs = [ "out" "dev" "info" ];
   outputBin = "dev";
 
@@ -27,6 +36,8 @@ stdenv.mkDerivation rec {
     ++ lib.optional stdenv.isDarwin gettext
     ++ lib.optional enableCapabilities libcap;
 
+  strictDeps = true;
+
   configureFlags = [ "--with-libgpg-error-prefix=${libgpgerror.dev}" ]
    ++ lib.optional stdenv.hostPlatform.isMusl "--disable-asm";
 
diff --git a/pkgs/development/libraries/libheif/default.nix b/pkgs/development/libraries/libheif/default.nix
index b0872b9da1e..71dfca5e643 100644
--- a/pkgs/development/libraries/libheif/default.nix
+++ b/pkgs/development/libraries/libheif/default.nix
@@ -1,9 +1,9 @@
-{ lib, stdenv, fetchFromGitHub, autoreconfHook, pkg-config, libde265, x265, libpng,
+{ lib, stdenv, fetchFromGitHub, autoreconfHook, pkg-config, dav1d, rav1e, libde265, x265, libpng,
   libjpeg, libaom }:
 
 stdenv.mkDerivation rec {
   pname = "libheif";
-  version = "1.9.1";
+  version = "1.11.0";
 
   outputs = [ "bin" "out" "dev" "man" ];
 
@@ -11,21 +11,19 @@ stdenv.mkDerivation rec {
     owner = "strukturag";
     repo = "libheif";
     rev = "v${version}";
-    sha256 = "0hjs1i076jmy4ryj8y2zs293wx53kzg38y8i42cbcsqydvsdp6hz";
+    sha256 = "sha256-xT0sfYPp5atYXnVpP8TYu2TC9/Z/ClyEP1OTSfcw1gw=";
   };
 
   nativeBuildInputs = [ autoreconfHook pkg-config ];
-  buildInputs = [ libde265 x265 libpng libjpeg libaom ];
-  # TODO: enable dav1d and rav1e codecs when libheif can find them via pkg-config
+  buildInputs = [ dav1d rav1e libde265 x265 libpng libjpeg libaom ];
 
   enableParallelBuilding = true;
 
   meta = {
     homepage = "http://www.libheif.org/";
     description = "ISO/IEC 23008-12:2017 HEIF image file format decoder and encoder";
-    license = lib.licenses.lgpl3;
+    license = lib.licenses.lgpl3Plus;
     platforms = lib.platforms.unix;
     maintainers = with lib.maintainers; [ gebner ];
   };
-
 }
diff --git a/pkgs/development/libraries/libical/default.nix b/pkgs/development/libraries/libical/default.nix
index 7f5e739a99c..51e2ff52ff6 100644
--- a/pkgs/development/libraries/libical/default.nix
+++ b/pkgs/development/libraries/libical/default.nix
@@ -1,7 +1,6 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, fetchpatch
 , buildPackages
 , cmake
 , glib
@@ -22,7 +21,7 @@ assert introspectionSupport -> gobject-introspection != null && vala != null;
 
 stdenv.mkDerivation rec {
   pname = "libical";
-  version = "3.0.8";
+  version = "3.0.9";
 
   outputs = [ "out" "dev" ]; # "devdoc" ];
 
@@ -30,7 +29,7 @@ stdenv.mkDerivation rec {
     owner = "libical";
     repo = "libical";
     rev = "v${version}";
-    sha256 = "0pkh74bfrgp1slv8wsv7lbmal2m7qkixwm5llpmfwaiv14njlp68";
+    sha256 = "sha256-efdiGktLGITaQ6VinnfYG52fMhO0Av+JKROt2kTvS1U=";
   };
 
   nativeBuildInputs = [
@@ -75,12 +74,6 @@ stdenv.mkDerivation rec {
     # Will appear in 3.1.0
     # https://github.com/libical/libical/issues/350
     ./respect-env-tzdir.patch
-    # Export src-generator binary for use while cross-compiling
-    # https://github.com/libical/libical/pull/439
-    (fetchpatch {
-      url = "https://github.com/libical/libical/commit/1197d84b63dce179b55a6293cfd6d0523607baf1.patch";
-      sha256 = "18i1khnwmw488s7g5a1kf05sladf8dbyhfc69mbcf6dkc4nnc3dg";
-    })
   ];
 
   # Using install check so we do not have to manually set
diff --git a/pkgs/development/libraries/libmbim/default.nix b/pkgs/development/libraries/libmbim/default.nix
index 850c7aa1df0..9695b221cb9 100644
--- a/pkgs/development/libraries/libmbim/default.nix
+++ b/pkgs/development/libraries/libmbim/default.nix
@@ -10,11 +10,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libmbim";
-  version = "1.24.4";
+  version = "1.24.6";
 
   src = fetchurl {
     url = "https://www.freedesktop.org/software/libmbim/${pname}-${version}.tar.xz";
-    sha256 = "11djb1d8w9ms07aklfm3pskjw9rnff4p4n3snanschv22zk8wj6x";
+    sha256 = "sha256-dgRlyqoczWmcFCkOl5HaRW1TAN0R6/TBSGFRAz6HXf0=";
   };
 
   outputs = [ "out" "dev" "man" ];
diff --git a/pkgs/development/libraries/libpcap/default.nix b/pkgs/development/libraries/libpcap/default.nix
index 0b30bf6c2b0..c04d4a001a1 100644
--- a/pkgs/development/libraries/libpcap/default.nix
+++ b/pkgs/development/libraries/libpcap/default.nix
@@ -4,11 +4,11 @@ with lib;
 
 stdenv.mkDerivation rec {
   pname = "libpcap";
-  version = "1.9.1";
+  version = "1.10.0";
 
   src = fetchurl {
     url = "https://www.tcpdump.org/release/${pname}-${version}.tar.gz";
-    sha256 = "153h1378diqyc27jjgz6gg5nxmb4ddk006d9xg69nqavgiikflk3";
+    sha256 = "sha256-jRK0JiPu7+6HLxI70NyF1TWwDfTULoZfmTxA97/JKx4=";
   };
 
   nativeBuildInputs = [ flex bison ]
@@ -21,13 +21,11 @@ stdenv.mkDerivation rec {
       linux = "linux";
       darwin = "bpf";
     }.${stdenv.hostPlatform.parsed.kernel.name})
+  ] ++ optionals stdenv.isDarwin [
+    "--disable-universal"
   ] ++ optionals (stdenv.hostPlatform == stdenv.buildPlatform)
     [ "ac_cv_linux_vers=2" ];
 
-  prePatch = optionalString stdenv.isDarwin ''
-    substituteInPlace configure --replace " -arch i386" ""
-  '';
-
   postInstall = ''
     if [ "$dontDisableStatic" -ne "1" ]; then
       rm -f $out/lib/libpcap.a
diff --git a/pkgs/development/libraries/libqmi/default.nix b/pkgs/development/libraries/libqmi/default.nix
index 7bd3fa97029..42d8cbf2859 100644
--- a/pkgs/development/libraries/libqmi/default.nix
+++ b/pkgs/development/libraries/libqmi/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libqmi";
-  version = "1.26.8";
+  version = "1.26.10";
 
   src = fetchurl {
     url = "https://www.freedesktop.org/software/libqmi/${pname}-${version}.tar.xz";
-    sha256 = "sha256-73bclasKBjIaG9Jeh1SJy6Esn2YRl0ygE1zwZ7sgyWA=";
+    sha256 = "sha256-fABD8GyHXlzx3jwMlMzH9bBYYry82eT7DV0UJ30dq1k=";
   };
 
   outputs = [ "out" "dev" "devdoc" ];
diff --git a/pkgs/development/libraries/libsodium/default.nix b/pkgs/development/libraries/libsodium/default.nix
index db2cd044592..64ae1713fd4 100644
--- a/pkgs/development/libraries/libsodium/default.nix
+++ b/pkgs/development/libraries/libsodium/default.nix
@@ -12,6 +12,11 @@ stdenv.mkDerivation rec {
   separateDebugInfo = stdenv.isLinux && stdenv.hostPlatform.libc != "musl";
 
   enableParallelBuilding = true;
+  hardeningDisable = lib.optional (stdenv.targetPlatform.isMusl && stdenv.targetPlatform.isx86_32) "stackprotector";
+
+  # FIXME: the hardeingDisable attr above does not seems effective, so
+  # the need to disable stackprotector via configureFlags
+  configureFlags = lib.optional (stdenv.targetPlatform.isMusl && stdenv.targetPlatform.isx86_32) "--disable-ssp";
 
   doCheck = true;
 
diff --git a/pkgs/development/libraries/libthai/default.nix b/pkgs/development/libraries/libthai/default.nix
index ad00906bb8c..97745813ef2 100644
--- a/pkgs/development/libraries/libthai/default.nix
+++ b/pkgs/development/libraries/libthai/default.nix
@@ -4,12 +4,16 @@ stdenv.mkDerivation rec {
   pname = "libthai";
   version = "0.1.28";
 
+  outputs = [ "out" "dev" ];
+
   src = fetchurl {
     url = "https://github.com/tlwg/libthai/releases/download/v${version}/libthai-${version}.tar.xz";
     sha256 = "04g93bgxrcnay9fglpq2lj9nr7x1xh06i60m7haip8as9dxs3q7z";
   };
 
-  nativeBuildInputs = [ installShellFiles pkg-config ];
+  strictDeps = true;
+
+  nativeBuildInputs = [ installShellFiles (lib.getBin libdatrie) pkg-config ];
 
   buildInputs = [ libdatrie ];
 
diff --git a/pkgs/development/libraries/libusb1/default.nix b/pkgs/development/libraries/libusb1/default.nix
index d69c8d670c4..69410cf2b98 100644
--- a/pkgs/development/libraries/libusb1/default.nix
+++ b/pkgs/development/libraries/libusb1/default.nix
@@ -1,5 +1,6 @@
 { lib, stdenv
 , fetchFromGitHub
+, fetchpatch
 , autoreconfHook
 , pkg-config
 , enableUdev ? stdenv.isLinux && !stdenv.hostPlatform.isMusl
@@ -22,6 +23,13 @@ stdenv.mkDerivation rec {
 
   outputs = [ "out" "dev" ];
 
+  patches = [ (fetchpatch {
+    # https://bugs.archlinux.org/task/69121
+    url = "https://github.com/libusb/libusb/commit/f6d2cb561402c3b6d3627c0eb89e009b503d9067.patch";
+    sha256 = "1dbahikcbwkjhyvks7wbp7fy2bf7nca48vg5z0zqvqzjb9y595cq";
+    excludes = [ "libusb/version_nano.h" ];
+  }) ];
+
   nativeBuildInputs = [ pkg-config autoreconfHook ];
   propagatedBuildInputs =
     lib.optional enableUdev udev ++
diff --git a/pkgs/development/libraries/libuv/default.nix b/pkgs/development/libraries/libuv/default.nix
index a4447ed3378..6b1a0120e49 100644
--- a/pkgs/development/libraries/libuv/default.nix
+++ b/pkgs/development/libraries/libuv/default.nix
@@ -1,19 +1,20 @@
 { stdenv, lib, fetchFromGitHub, autoconf, automake, libtool, pkg-config, ApplicationServices, CoreServices }:
 
 stdenv.mkDerivation rec {
-  version = "1.40.0";
+  version = "1.41.0";
   pname = "libuv";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    sha256 = "1hd0x6i80ca3j0c3a7laygzab5qkgxjkz692jwzrsinsfhvbq0pg";
+    sha256 = "sha256-i6AYD1Ony0L2+3yWK6bxOfwoZEvd9qCg33QSqA7bRXI=";
   };
 
   postPatch = let
     toDisable = [
       "getnameinfo_basic" "udp_send_hang_loop" # probably network-dependent
+      "tcp_connect_timeout" # tries to reach out to 8.8.8.8
       "spawn_setuid_fails" "spawn_setgid_fails" "fs_chown" # user namespaces
       "getaddrinfo_fail" "getaddrinfo_fail_sync"
       "threadpool_multiple_event_loops" # times out on slow machines
diff --git a/pkgs/development/libraries/neardal/default.nix b/pkgs/development/libraries/neardal/default.nix
index 5e02a9fd522..43f63d91a61 100644
--- a/pkgs/development/libraries/neardal/default.nix
+++ b/pkgs/development/libraries/neardal/default.nix
@@ -10,8 +10,8 @@ stdenv.mkDerivation {
     sha256 = "12qwg7qiw2wfpaxfg2fjkmj5lls0g33xp6w433g8bnkvwlq4s29g";
   };
 
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ autoconf automake libtool glib readline makeWrapper ];
+  nativeBuildInputs = [ pkg-config makeWrapper ];
+  buildInputs = [ autoconf automake libtool glib readline ];
 
   preConfigure = ''
     substituteInPlace "ncl/Makefile.am" --replace "noinst_PROGRAMS" "bin_PROGRAMS"
diff --git a/pkgs/development/libraries/nuspell/wrapper.nix b/pkgs/development/libraries/nuspell/wrapper.nix
index 4386542ff20..ab09931579c 100644
--- a/pkgs/development/libraries/nuspell/wrapper.nix
+++ b/pkgs/development/libraries/nuspell/wrapper.nix
@@ -5,7 +5,7 @@ let
 in
 stdenv.mkDerivation {
   name = (appendToName "with-dicts" nuspell).name;
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
   buildCommand = ''
     makeWrapper ${nuspell}/bin/nuspell $out/bin/nuspell --prefix DICPATH : ${searchPath}
   '';
diff --git a/pkgs/development/libraries/openldap/default.nix b/pkgs/development/libraries/openldap/default.nix
index a71b2a61910..44a0e017a2a 100644
--- a/pkgs/development/libraries/openldap/default.nix
+++ b/pkgs/development/libraries/openldap/default.nix
@@ -1,4 +1,7 @@
-{ lib, stdenv, fetchurl, openssl, cyrus_sasl, db, groff, libtool }:
+{ lib, stdenv, fetchurl, openssl, db, groff, libtool
+, withCyrusSasl ? true
+, cyrus_sasl
+}:
 
 stdenv.mkDerivation rec {
   pname = "openldap";
@@ -37,8 +40,7 @@ stdenv.mkDerivation rec {
   ] ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
     "--with-yielding_select=yes"
     "ac_cv_func_memcmp_working=yes"
-  ] ++ lib.optional (openssl == null) "--without-tls"
-    ++ lib.optional (cyrus_sasl == null) "--without-cyrus-sasl"
+  ] ++ lib.optional (!withCyrusSasl) "--without-cyrus-sasl"
     ++ lib.optional stdenv.isFreeBSD "--with-pic";
 
   postBuild = ''
@@ -54,19 +56,21 @@ stdenv.mkDerivation rec {
     "moduledir=$(out)/lib/modules"
   ];
 
-  # 1. Fixup broken libtool
-  # 2. Libraries left in the build location confuse `patchelf --shrink-rpath`
+  # 1. Libraries left in the build location confuse `patchelf --shrink-rpath`
   #    Delete these to let patchelf discover the right path instead.
   #    FIXME: that one can be removed when https://github.com/NixOS/patchelf/pull/98
   #    is in Nixpkgs patchelf.
+  # 2. Fixup broken libtool for openssl and cyrus_sasl (if it is not disabled)
   preFixup = ''
-    sed -e 's,-lsasl2,-L${cyrus_sasl.out}/lib -lsasl2,' \
-        -e 's,-lssl,-L${openssl.out}/lib -lssl,' \
-        -i $out/lib/libldap.la -i $out/lib/libldap_r.la
-
-    rm -rf $out/var
+    rm -r $out/var
     rm -r libraries/*/.libs
     rm -r contrib/slapd-modules/passwd/*/.libs
+    for f in $out/lib/libldap.la $out/lib/libldap_r.la; do
+      substituteInPlace "$f" --replace '-lssl' '-L${openssl.out}/lib -lssl'
+  '' + lib.optionalString withCyrusSasl ''
+      substituteInPlace "$f" --replace '-lsasl2' '-L${cyrus_sasl.out}/lib -lsasl2'
+  '' + ''
+    done
   '';
 
   postInstall = ''
diff --git a/pkgs/development/libraries/openssl/default.nix b/pkgs/development/libraries/openssl/default.nix
index ce4374be331..2edf02e738f 100644
--- a/pkgs/development/libraries/openssl/default.nix
+++ b/pkgs/development/libraries/openssl/default.nix
@@ -160,8 +160,8 @@ in {
   };
 
   openssl_1_1 = common {
-    version = "1.1.1i";
-    sha256 = "0hjj1phcwkz69lx1lrvr9grhpl4y529mwqycqc1hdla1zqsnmgp8";
+    version = "1.1.1j";
+    sha256 = "1gw17520vh13izy1xf5q0a2fqgcayymjjj5bk0dlkxndfnszrwma";
     patches = [
       ./1.1/nix-ssl-cert-file.patch
 
diff --git a/pkgs/development/libraries/rabbitmq-java-client/default.nix b/pkgs/development/libraries/rabbitmq-java-client/default.nix
index b649b1d9c11..e5657bcb3c3 100644
--- a/pkgs/development/libraries/rabbitmq-java-client/default.nix
+++ b/pkgs/development/libraries/rabbitmq-java-client/default.nix
@@ -8,7 +8,8 @@ stdenv.mkDerivation {
     sha256 = "03kspkgzzjsbq6f8yl2zj5m30qwgxv3l58hrbf6gcgxb5rpfk6sh";
   };
 
-  buildInputs = [ ant jdk python makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ ant jdk python ];
 
   buildPhase = "ant dist";
 
diff --git a/pkgs/development/libraries/rinutils/default.nix b/pkgs/development/libraries/rinutils/default.nix
new file mode 100644
index 00000000000..35e48140fdd
--- /dev/null
+++ b/pkgs/development/libraries/rinutils/default.nix
@@ -0,0 +1,21 @@
+{
+  stdenv, lib, fetchurl,
+  cmake, perl,
+}:
+
+stdenv.mkDerivation rec {
+  pname = "rinutils";
+  version = "0.8.0";
+
+  meta = with lib; {
+    homepage = "https://github.com/shlomif/rinutils";
+    license = licenses.mit;
+  };
+
+  src = fetchurl {
+    url = "https://github.com/shlomif/${pname}/releases/download/${version}/${pname}-${version}.tar.xz";
+    sha256 = "1q09aihm5m42xiq2prpa9mf0srwiirzgzblkp5nl74i7zg6pg5hx";
+  };
+
+  nativeBuildInputs = [ cmake perl ];
+}
diff --git a/pkgs/development/libraries/zeromq/4.x.nix b/pkgs/development/libraries/zeromq/4.x.nix
index a3c35d123b6..b37dfbdd707 100644
--- a/pkgs/development/libraries/zeromq/4.x.nix
+++ b/pkgs/development/libraries/zeromq/4.x.nix
@@ -3,13 +3,13 @@
 
 stdenv.mkDerivation rec {
   pname = "zeromq";
-  version = "4.3.3";
+  version = "4.3.4";
 
   src = fetchFromGitHub {
     owner = "zeromq";
     repo = "libzmq";
     rev = "v${version}";
-    sha256 = "155kb0ih0xj4jvd39bq8d04bgvhy9143r3632ks1m04455z4qdzd";
+    sha256 = "sha256-epOEyHOswUGVwzz0FLxhow/zISmZHxsIgmpOV8C8bQM=";
   };
 
   nativeBuildInputs = [ cmake asciidoc pkg-config ];
diff --git a/pkgs/development/mobile/genymotion/default.nix b/pkgs/development/mobile/genymotion/default.nix
index 5602f598e9d..1aa81132c26 100644
--- a/pkgs/development/mobile/genymotion/default.nix
+++ b/pkgs/development/mobile/genymotion/default.nix
@@ -18,7 +18,8 @@ stdenv.mkDerivation rec {
     sha256 = "0lvfdlpmmsyq2i9gs4mf6a8fxkfimdr4rhyihqnfhjij3fzxz4lk";
   };
 
-  buildInputs = [ makeWrapper which xdg-utils ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ which xdg-utils ];
 
   unpackPhase = ''
     mkdir -p phony-home $out/share/applications
diff --git a/pkgs/development/mobile/titaniumenv/titaniumsdk-7.5.nix b/pkgs/development/mobile/titaniumenv/titaniumsdk-7.5.nix
index f471dc977b3..601cac372c8 100644
--- a/pkgs/development/mobile/titaniumenv/titaniumsdk-7.5.nix
+++ b/pkgs/development/mobile/titaniumenv/titaniumsdk-7.5.nix
@@ -64,7 +64,8 @@ stdenv.mkDerivation {
   }
   else throw "Platform: ${stdenv.system} not supported!";
 
-  buildInputs = [ unzip makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ unzip ];
 
   buildCommand = ''
     mkdir -p $out
diff --git a/pkgs/development/mobile/titaniumenv/titaniumsdk-8.2.nix b/pkgs/development/mobile/titaniumenv/titaniumsdk-8.2.nix
index 0742247893c..52257bfd461 100644
--- a/pkgs/development/mobile/titaniumenv/titaniumsdk-8.2.nix
+++ b/pkgs/development/mobile/titaniumenv/titaniumsdk-8.2.nix
@@ -64,7 +64,8 @@ stdenv.mkDerivation {
   }
   else throw "Platform: ${stdenv.system} not supported!";
 
-  buildInputs = [ unzip makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ unzip ];
 
   buildCommand = ''
     mkdir -p $out
diff --git a/pkgs/development/mobile/titaniumenv/titaniumsdk-8.3.nix b/pkgs/development/mobile/titaniumenv/titaniumsdk-8.3.nix
index 965a385ac56..78044752b54 100644
--- a/pkgs/development/mobile/titaniumenv/titaniumsdk-8.3.nix
+++ b/pkgs/development/mobile/titaniumenv/titaniumsdk-8.3.nix
@@ -64,7 +64,8 @@ stdenv.mkDerivation {
   }
   else throw "Platform: ${stdenv.system} not supported!";
 
-  buildInputs = [ unzip makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ unzip ];
 
   buildCommand = ''
     mkdir -p $out
diff --git a/pkgs/development/ocaml-modules/ocsigen-server/default.nix b/pkgs/development/ocaml-modules/ocsigen-server/default.nix
index b4842da12dd..cf869b6e5ef 100644
--- a/pkgs/development/ocaml-modules/ocsigen-server/default.nix
+++ b/pkgs/development/ocaml-modules/ocsigen-server/default.nix
@@ -29,9 +29,8 @@ stdenv.mkDerivation rec {
     sha256 = "0xda4fj8p5102lh9xmrn5mv3s0ps6yykqj3mpjf72gf4zd6fzcn7";
   }) ];
 
-  buildInputs = [ which makeWrapper ocaml findlib
-    lwt_react pgocaml camlzip ocaml_sqlite3
-  ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ which ocaml findlib lwt_react pgocaml camlzip ocaml_sqlite3 ];
 
   propagatedBuildInputs = [ cryptokit ipaddr lwt_log lwt_ssl ocamlnet
     ocaml_pcre tyxml xml-light
diff --git a/pkgs/development/perl-modules/ham/default.nix b/pkgs/development/perl-modules/ham/default.nix
index 4f6dc5d9ddb..8b19c9404fe 100644
--- a/pkgs/development/perl-modules/ham/default.nix
+++ b/pkgs/development/perl-modules/ham/default.nix
@@ -13,7 +13,7 @@ buildPerlPackage {
 
   outputs = [ "out" ];
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
   propagatedBuildInputs = [ openssh GitRepository URI XMLMini ];
 
   preConfigure = ''
diff --git a/pkgs/development/python-modules/adblock/default.nix b/pkgs/development/python-modules/adblock/default.nix
index de6d72a61ec..c608f48fdf9 100644
--- a/pkgs/development/python-modules/adblock/default.nix
+++ b/pkgs/development/python-modules/adblock/default.nix
@@ -1,10 +1,9 @@
 { stdenv
 , lib
-, rustPlatform
 , fetchFromGitHub
-, pipInstallHook
+, buildPythonPackage
+, rustPlatform
 , pythonImportsCheckHook
-, maturin
 , pkg-config
 , openssl
 , publicsuffix-list
@@ -13,7 +12,7 @@
 , Security
 }:
 
-rustPlatform.buildRustPackage rec {
+buildPythonPackage rec {
   pname = "adblock";
   version = "0.4.0";
   disabled = isPy27;
@@ -25,33 +24,27 @@ rustPlatform.buildRustPackage rec {
     rev = version;
     sha256 = "10d6ks2fyzbizq3kb69q478idj0h86k6ygjb6wl3zq3mf65ma4zg";
   };
+
+  cargoDeps = rustPlatform.fetchCargoTarball {
+    inherit src;
+    name = "${pname}-${version}";
+    hash = "sha256-gEFmj3/KvhvvsOK2nX2L1RUD4Wfp3nYzEzVnQZIsIDY=";
+  };
+
   format = "pyproject";
 
-  cargoSha256 = "0di05j942rrm2crpdpp9czhh65fmidyrvdp2n3pipgnagy7nchc0";
-
-  nativeBuildInputs = [ pipInstallHook maturin pkg-config pythonImportsCheckHook ];
+  nativeBuildInputs = [ pkg-config pythonImportsCheckHook ]
+    ++ (with rustPlatform; [ cargoSetupHook maturinBuildHook ]);
 
   buildInputs = [ openssl ]
     ++ lib.optionals stdenv.isDarwin [ CoreFoundation Security ];
 
   PSL_PATH = "${publicsuffix-list}/share/publicsuffix/public_suffix_list.dat";
 
-  buildPhase = ''
-    runHook preBuild
-    maturin build --release --manylinux off --strip
-    runHook postBuild
-  '';
-
   # There are no rust tests
   doCheck = false;
-  pythonImportsCheck = [ "adblock" ];
 
-  installPhase = ''
-    runHook preInstall
-    install -Dm644 -t dist target/wheels/*.whl
-    pipInstallPhase
-    runHook postInstall
-  '';
+  pythonImportsCheck = [ "adblock" ];
 
   passthru.meta = with lib; {
     description = "Python wrapper for Brave's adblocking library, which is written in Rust";
diff --git a/pkgs/development/python-modules/blinker/default.nix b/pkgs/development/python-modules/blinker/default.nix
index 5591113ab0a..ca59a0d710a 100644
--- a/pkgs/development/python-modules/blinker/default.nix
+++ b/pkgs/development/python-modules/blinker/default.nix
@@ -1,4 +1,4 @@
-{ lib, buildPythonPackage, fetchPypi }:
+{ lib, buildPythonPackage, fetchPypi, nose, pytestCheckHook }:
 
 buildPythonPackage rec {
   pname = "blinker";
@@ -9,6 +9,9 @@ buildPythonPackage rec {
     sha256 = "1dpq0vb01p36jjwbhhd08ylvrnyvcc82yxx3mwjx6awrycjyw6j7";
   };
 
+  checkInputs = [ nose pytestCheckHook ];
+  pythonImportsCheck = [ "blinker" ];
+
   meta = with lib; {
     homepage = "https://pythonhosted.org/blinker/";
     description = "Fast, simple object-to-object and broadcast signaling";
diff --git a/pkgs/development/python-modules/buildbot/default.nix b/pkgs/development/python-modules/buildbot/default.nix
index 6b27e8e5d42..30a7e5174a6 100644
--- a/pkgs/development/python-modules/buildbot/default.nix
+++ b/pkgs/development/python-modules/buildbot/default.nix
@@ -9,7 +9,7 @@ let
   withPlugins = plugins: buildPythonPackage {
     name = "${package.name}-with-plugins";
     phases = [ "installPhase" "fixupPhase" ];
-    buildInputs = [ makeWrapper ];
+    nativeBuildInputs = [ makeWrapper ];
     propagatedBuildInputs = plugins ++ package.propagatedBuildInputs;
 
     installPhase = ''
diff --git a/pkgs/development/python-modules/cheroot/default.nix b/pkgs/development/python-modules/cheroot/default.nix
index e5c7c23e2e4..4d6c71a7e2a 100644
--- a/pkgs/development/python-modules/cheroot/default.nix
+++ b/pkgs/development/python-modules/cheroot/default.nix
@@ -73,7 +73,7 @@ buildPythonPackage rec {
     "bind_addr_unix"
   ];
 
-  disabledTestFiles = [
+  disabledTestPaths = [
     # avoid attempting to use 3 packages not available on nixpkgs
     # (jaraco.apt, jaraco.context, yg.lockfile)
     "cheroot/test/test_wsgi.py"
diff --git a/pkgs/development/python-modules/cryptography/default.nix b/pkgs/development/python-modules/cryptography/default.nix
index eb4eba0f587..1038431d31c 100644
--- a/pkgs/development/python-modules/cryptography/default.nix
+++ b/pkgs/development/python-modules/cryptography/default.nix
@@ -2,8 +2,8 @@
 , buildPythonPackage
 , fetchPypi
 , fetchpatch
-, isPy27
-, ipaddress
+, rustPlatform
+, setuptools-rust
 , openssl
 , cryptography_vectors
 , darwin
@@ -13,27 +13,38 @@
 , isPyPy
 , cffi
 , pytest
+, pytest-subtests
 , pretend
 , iso8601
 , pytz
 , hypothesis
-, enum34
 }:
 
 buildPythonPackage rec {
   pname = "cryptography";
-  version = "3.3.2"; # Also update the hash in vectors.nix
+  version = "3.4.6"; # Also update the hash in vectors.nix
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1vcvw4lkw1spiq322pm1256kail8nck6bbgpdxx3pqa905wd6q2s";
+    sha256 = "11wgsihfq72fav67c3igi0xbhbd6c5dj869byd1jkq0fbcz24cid";
   };
 
+  cargoDeps = rustPlatform.fetchCargoTarball {
+    inherit src;
+    sourceRoot = "${pname}-${version}/${cargoRoot}";
+    name = "${pname}-${version}";
+    sha256 = "1i0sd2y4a5g1yqwcpw2ycp6p4p8sk5v7clblq756i5864j52v6w1";
+  };
+
+  cargoRoot = "src/rust";
+
   outputs = [ "out" "dev" ];
 
   nativeBuildInputs = lib.optionals (!isPyPy) [
     cffi
-  ];
+    rustPlatform.cargoSetupHook
+    setuptools-rust
+  ] ++ (with rustPlatform; [ rust.cargo rust.rustc ]);
 
   buildInputs = [ openssl ]
              ++ lib.optional stdenv.isDarwin darwin.apple_sdk.frameworks.Security;
@@ -42,8 +53,6 @@ buildPythonPackage rec {
     six
   ] ++ lib.optionals (!isPyPy) [
     cffi
-  ] ++ lib.optionals isPy27 [
-    ipaddress enum34
   ];
 
   checkInputs = [
@@ -52,6 +61,7 @@ buildPythonPackage rec {
     iso8601
     pretend
     pytest
+    pytest-subtests
     pytz
   ];
 
diff --git a/pkgs/development/python-modules/cryptography/vectors.nix b/pkgs/development/python-modules/cryptography/vectors.nix
index f9b7c525237..a807be9c3bb 100644
--- a/pkgs/development/python-modules/cryptography/vectors.nix
+++ b/pkgs/development/python-modules/cryptography/vectors.nix
@@ -7,7 +7,7 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1yhaps0f3h2yjb6lmz953z1l1d84y9swk4k3gj9nqyk4vbx5m7cc";
+    sha256 = "1a1d5ix5b3ajhrqaf8rm6qmd6gkaidij0jgd1vrb8q1xn1gqmy75";
   };
 
   # No tests included
diff --git a/pkgs/development/python-modules/fixtures/default.nix b/pkgs/development/python-modules/fixtures/default.nix
index 9f1549e98f9..e802dbaa269 100644
--- a/pkgs/development/python-modules/fixtures/default.nix
+++ b/pkgs/development/python-modules/fixtures/default.nix
@@ -1,11 +1,12 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, fetchpatch
+, pythonAtLeast
 , pbr
 , testtools
 , mock
 , python
-, isPy39
 }:
 
 buildPythonPackage rec {
@@ -17,7 +18,26 @@ buildPythonPackage rec {
     sha256 = "fcf0d60234f1544da717a9738325812de1f42c2fa085e2d9252d8fff5712b2ef";
   };
 
-  propagatedBuildInputs = [ pbr testtools mock ];
+  patches = lib.optional (pythonAtLeast "3.9") [
+    # drop tests that try to monkeypatch a classmethod, which fails on python3.9
+    # https://github.com/testing-cabal/fixtures/issues/44
+    (fetchpatch {
+       url = "https://salsa.debian.org/openstack-team/python/python-fixtures/-/raw/debian/victoria/debian/patches/remove-broken-monkey-patch-test.patch";
+       sha256 = "1s3hg2zmqc4shmnf90kscphzj5qlqpxghzw2a59p8f88zrbsj97r";
+    })
+  ];
+
+  nativeBuildInputs = [
+    pbr
+  ];
+
+  propagatedBuildInputs = [
+    testtools
+  ];
+
+  checkInputs = [
+    mock
+  ];
 
   checkPhase = ''
     ${python.interpreter} -m testtools.run fixtures.test_suite
@@ -27,6 +47,5 @@ buildPythonPackage rec {
     description = "Reusable state for writing clean tests and more";
     homepage = "https://pypi.python.org/pypi/fixtures";
     license = lib.licenses.asl20;
-    broken = isPy39; # see https://github.com/testing-cabal/fixtures/issues/44
   };
 }
diff --git a/pkgs/development/python-modules/johnnycanencrypt/default.nix b/pkgs/development/python-modules/johnnycanencrypt/default.nix
index 77789fa44db..a0c82902d3e 100644
--- a/pkgs/development/python-modules/johnnycanencrypt/default.nix
+++ b/pkgs/development/python-modules/johnnycanencrypt/default.nix
@@ -1,14 +1,13 @@
 { lib
 , stdenv
-, rustPlatform
 , fetchFromGitHub
-, pipInstallHook
+, buildPythonPackage
+, rustPlatform
 , llvmPackages
 , pkg-config
 , maturin
 , pcsclite
 , nettle
-, python
 , requests
 , vcrpy
 , numpy
@@ -17,7 +16,7 @@
 , PCSC
 }:
 
-rustPlatform.buildRustPackage rec {
+buildPythonPackage rec {
   pname = "johnnycanencrypt";
   version = "0.5.0";
   disabled = pythonOlder "3.7";
@@ -28,7 +27,16 @@ rustPlatform.buildRustPackage rec {
     rev = "v${version}";
     sha256 = "192wfrlyylrpzq70yki421mi1smk8q2cyki2a1d03q7h6apib3j4";
   };
-  cargoPatches = [ ./Cargo.lock.patch ];
+
+  cargoDeps = rustPlatform.fetchCargoTarball {
+    inherit patches src;
+    name = "${pname}-${version}";
+    hash = "sha256-2XhXCKyXVlFgbcOoMy/A5ajiIVxBii56YeI29mO720U=";
+  };
+
+  format = "pyproject";
+
+  patches = [ ./Cargo.lock.patch ];
 
   cargoSha256 = "0ifvpdizcdp2c5x2x2j1bhhy5a75q0pk7a63dmh52mlpmh45fy6r";
 
@@ -42,10 +50,10 @@ rustPlatform.buildRustPackage rec {
   nativeBuildInputs = [
     llvmPackages.clang
     pkg-config
-    python
-    maturin
-    pipInstallHook
-  ];
+  ] ++ (with rustPlatform; [
+    cargoSetupHook
+    maturinBuildHook
+  ]);
 
   buildInputs = [
     pcsclite
@@ -67,17 +75,6 @@ rustPlatform.buildRustPackage rec {
     sed '/project-url = /d' -i Cargo.toml
   '';
 
-  buildPhase = ''
-    runHook preBuild
-    maturin build --release --manylinux off --strip --cargo-extra-args="-j $NIX_BUILD_CORES --frozen"
-    runHook postBuild
-  '';
-
-  installPhase = ''
-    install -Dm644 -t dist target/wheels/*.whl
-    pipInstallPhase
-  '';
-
   preCheck = ''
     export TESTDIR=$(mktemp -d)
     cp -r tests/ $TESTDIR
diff --git a/pkgs/development/python-modules/livestreamer/default.nix b/pkgs/development/python-modules/livestreamer/default.nix
index 184a215c407..98878c90640 100644
--- a/pkgs/development/python-modules/livestreamer/default.nix
+++ b/pkgs/development/python-modules/livestreamer/default.nix
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     sha256 = "1fp3d3z2grb1ls97smjkraazpxnvajda2d1g1378s6gzmda2jvjd";
   };
 
-  buildInputs = [ pkgs.makeWrapper ];
+  nativeBuildInputs = [ pkgs.makeWrapper ];
 
   propagatedBuildInputs = [ pkgs.rtmpdump pycrypto requests ]
     ++ lib.optionals isPy27 [ singledispatch futures ];
diff --git a/pkgs/development/python-modules/lxml/default.nix b/pkgs/development/python-modules/lxml/default.nix
index aa009e0a3e7..b5837603103 100644
--- a/pkgs/development/python-modules/lxml/default.nix
+++ b/pkgs/development/python-modules/lxml/default.nix
@@ -7,13 +7,13 @@
 
 buildPythonPackage rec {
   pname = "lxml";
-  version = "4.5.2";
+  version = "4.6.2";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "${pname}-${version}";
-    sha256 = "1d0cpwdjxfzwjzmnz066ibzicyj2vhx15qxmm775l8hxqi65xps4";
+    sha256 = "1zidx62sxh2r4fmjfjzd4f6i4yxgzkpd20nafbyr0i0wnw9da3fd";
   };
 
   # setuptoolsBuildPhase needs dependencies to be passed through nativeBuildInputs
diff --git a/pkgs/development/python-modules/pyxml/default.nix b/pkgs/development/python-modules/pyxml/default.nix
index a528de8e0ca..49796054b56 100644
--- a/pkgs/development/python-modules/pyxml/default.nix
+++ b/pkgs/development/python-modules/pyxml/default.nix
@@ -10,7 +10,7 @@ buildPythonPackage rec {
     sha256 = "04wc8i7cdkibhrldy6j65qp5l75zjxf5lx6qxdxfdf2gb3wndawz";
   };
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
   buildPhase = "${python.interpreter} ./setup.py build";
   installPhase = ''
     ${python.interpreter} ./setup.py install --prefix="$out" || exit 1
diff --git a/pkgs/development/python-modules/requests/default.nix b/pkgs/development/python-modules/requests/default.nix
index e0dfb9a24a6..169583586a1 100644
--- a/pkgs/development/python-modules/requests/default.nix
+++ b/pkgs/development/python-modules/requests/default.nix
@@ -1,24 +1,59 @@
-{ lib, fetchPypi, buildPythonPackage
-, urllib3, idna, chardet, certifi
-, pytest }:
+{ lib
+, buildPythonPackage
+, certifi
+, chardet
+, fetchPypi
+, idna
+, pytest-mock
+, pytest-xdist
+, pytestCheckHook
+, urllib3
+}:
 
 buildPythonPackage rec {
   pname = "requests";
-  version = "2.25.0";
+  version = "2.25.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1y6mb8c0ipd64d5axq2p368yxndp3f966hmabjka2q2a5y9hn6kz";
+    sha256 = "sha256-J5c91KkEpPE7JjoZyGbBO5KjntHJZGVfAl8/jT11uAQ=";
   };
 
-  nativeBuildInputs = [ pytest ];
-  propagatedBuildInputs = [ urllib3 idna chardet certifi ];
-  # sadly, tests require networking
-  doCheck = false;
+  propagatedBuildInputs = [
+    certifi
+    chardet
+    idna
+    urllib3
+  ];
+
+  checkInputs = [
+    pytest-mock
+    pytest-xdist
+    pytestCheckHook
+  ];
+
+  disabledTests = [
+    # Disable tests that require network access and use httpbin
+    "requests.api.request"
+    "requests.models.PreparedRequest"
+    "requests.sessions.Session"
+    "requests"
+    "test_redirecting_to_bad_url"
+    "test_requests_are_updated_each_time"
+    "test_should_bypass_proxies_pass_only_hostname"
+    "test_urllib3_pool_connection_closed"
+    "test_urllib3_retries"
+    "test_use_proxy_from_environment"
+    "TestRequests"
+    "TestTimeout"
+  ];
+
+  pythonImportsCheck = [ "requests" ];
 
   meta = with lib; {
-    description = "An Apache2 licensed HTTP library, written in Python, for human beings";
+    description = "Simple HTTP library for Python";
     homepage = "http://docs.python-requests.org/en/latest/";
     license = licenses.asl20;
+    maintainers = with maintainers; [ fab ];
   };
 }
diff --git a/pkgs/development/python-modules/retworkx/default.nix b/pkgs/development/python-modules/retworkx/default.nix
index 02a3ef64c57..8cce139facb 100644
--- a/pkgs/development/python-modules/retworkx/default.nix
+++ b/pkgs/development/python-modules/retworkx/default.nix
@@ -1,16 +1,14 @@
 { lib
+, buildPythonPackage
 , rustPlatform
-, python
 , fetchFromGitHub
-, pipInstallHook
-, maturin
-, pip
+
   # Check inputs
 , pytestCheckHook
 , numpy
 }:
 
-rustPlatform.buildRustPackage rec {
+buildPythonPackage rec {
   pname = "retworkx";
   version = "0.6.0";
 
@@ -21,11 +19,15 @@ rustPlatform.buildRustPackage rec {
     sha256 = "11n30ldg3y3y6qxg3hbj837pnbwjkqw3nxq6frds647mmmprrd20";
   };
 
-  cargoSha256 = "1vg4yf0k6yypqf9z46zz818mz7fdrgxj7zl6zjf7pnm2r8mq3qw5";
+  cargoDeps = rustPlatform.fetchCargoTarball {
+    inherit src;
+    name = "${pname}-${version}";
+    hash = "sha256-heOBK8qi2nuc/Ib+I/vLzZ1fUUD/G/KTw9d7M4Hz5O0=";
+  };
 
-  propagatedBuildInputs = [ python ];
+  format = "pyproject";
 
-  nativeBuildInputs = [ pipInstallHook maturin pip ];
+  nativeBuildInputs = with rustPlatform; [ cargoSetupHook maturinBuildHook ];
 
   # Needed b/c need to check AFTER python wheel is installed (using Rust Build, not buildPythonPackage)
   doCheck = false;
@@ -33,17 +35,6 @@ rustPlatform.buildRustPackage rec {
 
   installCheckInputs = [ pytestCheckHook numpy ];
 
-  buildPhase = ''
-    runHook preBuild
-    maturin build --release --manylinux off --strip
-    runHook postBuild
-  '';
-
-  installPhase = ''
-    install -Dm644 -t dist target/wheels/*.whl
-    pipInstallPhase
-  '';
-
   preCheck = ''
     export TESTDIR=$(mktemp -d)
     cp -r tests/ $TESTDIR
diff --git a/pkgs/development/python-modules/scipy/default.nix b/pkgs/development/python-modules/scipy/default.nix
index 8d08e43bc71..0bc8499a373 100644
--- a/pkgs/development/python-modules/scipy/default.nix
+++ b/pkgs/development/python-modules/scipy/default.nix
@@ -9,11 +9,11 @@ let
   });
 in buildPythonPackage rec {
   pname = "scipy";
-  version = "1.6.0";
+  version = "1.6.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0rh5b1rwdcvvagld8vpxnpaibszy1skpx39a0fwzd5gx5pwcjvfb";
+    sha256 = "048vd4c843xaq45yk3kn491gvqnvhp2i9rxhg671ddlh923fpz64";
   };
 
   checkInputs = [ nose pytest ];
@@ -53,9 +53,10 @@ in buildPythonPackage rec {
 
   SCIPY_USE_G77_ABI_WRAPPER = 1;
 
-  meta = {
-    description = "SciPy (pronounced 'Sigh Pie') is open-source software for mathematics, science, and engineering. ";
+  meta = with lib; {
+    description = "SciPy (pronounced 'Sigh Pie') is open-source software for mathematics, science, and engineering";
     homepage = "https://www.scipy.org/";
-    maintainers = with lib.maintainers; [ fridh ];
+    license = licenses.bsd3;
+    maintainers = [ maintainers.fridh ];
   };
 }
diff --git a/pkgs/development/python-modules/shapely/default.nix b/pkgs/development/python-modules/shapely/default.nix
index b5dd0be5445..519d9bd3415 100644
--- a/pkgs/development/python-modules/shapely/default.nix
+++ b/pkgs/development/python-modules/shapely/default.nix
@@ -1,17 +1,25 @@
-{ lib, stdenv, buildPythonPackage, fetchPypi, substituteAll, pythonOlder
-, geos, pytest, cython
+{ lib
+, stdenv
+, buildPythonPackage
+, fetchPypi
+, substituteAll
+, pythonOlder
+, geos
+, pytest
+, cython
 , numpy
+, fetchpatch
 }:
 
 buildPythonPackage rec {
   pname = "Shapely";
   version = "1.7.1";
+  disabled = pythonOlder "3.5";
 
   src = fetchPypi {
     inherit pname version;
     sha256 = "0adiz4jwmwxk7k1awqifb1a9bj5x4nx4gglb5dz9liam21674h8n";
   };
-  disabled = pythonOlder "3.5";
 
   nativeBuildInputs = [
     geos # for geos-config
@@ -26,6 +34,18 @@ buildPythonPackage rec {
   GEOS_LIBRARY_PATH = "${geos}/lib/libgeos_c${stdenv.hostPlatform.extensions.sharedLibrary}";
 
   patches = [
+    # Fix with geos 3.9. This patch will be part of the next release after 1.7.1
+    (fetchpatch {
+      url = "https://github.com/Toblerity/Shapely/commit/77879a954d24d1596f986d16ba3eff5e13861164.patch";
+      sha256 = "1w7ngjqbpf9vnvrfg4nyv34kckim9a60gvx20h6skc79xwihd4m5";
+      excludes = [
+        "tests/test_create_inconsistent_dimensionality.py"
+        "appveyor.yml"
+        ".travis.yml"
+      ];
+    })
+
+    # Patch to search form GOES .so/.dylib files in a Nix-aware way
     (substituteAll {
       src = ./library-paths.patch;
       libgeos_c = GEOS_LIBRARY_PATH;
diff --git a/pkgs/development/python-modules/slixmpp/default.nix b/pkgs/development/python-modules/slixmpp/default.nix
index 341f53cfe0b..f648905251e 100644
--- a/pkgs/development/python-modules/slixmpp/default.nix
+++ b/pkgs/development/python-modules/slixmpp/default.nix
@@ -39,7 +39,7 @@ buildPythonPackage rec {
   checkInputs = [ pytestCheckHook ];
 
   # Exclude live tests
-  disabledTestFiles = [ "tests/live_test.py" ];
+  disabledTestPaths = [ "tests/live_test.py" ];
 
   pythonImportsCheck = [ "slixmpp" ];
 
diff --git a/pkgs/development/python-modules/starlette/default.nix b/pkgs/development/python-modules/starlette/default.nix
index 94513e5d620..071bbcd3061 100644
--- a/pkgs/development/python-modules/starlette/default.nix
+++ b/pkgs/development/python-modules/starlette/default.nix
@@ -50,7 +50,7 @@ buildPythonPackage rec {
     typing-extensions
   ];
 
-  disabledTestFiles = [ "tests/test_graphql.py" ];
+  disabledTestPaths = [ "tests/test_graphql.py" ];
   # https://github.com/encode/starlette/issues/1131
   disabledTests = [ "test_debug_html" ];
   pythonImportsCheck = [ "starlette" ];
diff --git a/pkgs/development/python-modules/tokenizers/default.nix b/pkgs/development/python-modules/tokenizers/default.nix
index cf122613f63..ef265b87c05 100644
--- a/pkgs/development/python-modules/tokenizers/default.nix
+++ b/pkgs/development/python-modules/tokenizers/default.nix
@@ -1,12 +1,10 @@
 { lib
-, rustPlatform
 , fetchFromGitHub
 , fetchurl
-, pipInstallHook
+, buildPythonPackage
+, rustPlatform
 , setuptools-rust
-, wheel
 , numpy
-, python
 , datasets
 , pytestCheckHook
 , requests
@@ -49,7 +47,7 @@ let
     url = "https://s3.amazonaws.com/models.huggingface.co/bert/openai-gpt-merges.txt";
     sha256 = "09a754pm4djjglv3x5pkgwd6f79i2rq8ydg0f7c3q1wmwqdbba8f";
   };
-in rustPlatform.buildRustPackage rec {
+in buildPythonPackage rec {
   pname = "tokenizers";
   version = "0.10.0";
 
@@ -60,19 +58,22 @@ in rustPlatform.buildRustPackage rec {
     hash = "sha256-rQ2hRV52naEf6PvRsWVCTN7B1oXAQGmnpJw4iIdhamw=";
   };
 
-  cargoSha256 = "sha256-BoHIN/519Top1NUBjpB/oEMqi86Omt3zTQcXFWqrek0=";
+  cargoDeps = rustPlatform.fetchCargoTarball {
+    inherit src sourceRoot;
+    name = "${pname}-${version}";
+    hash = "sha256-BoHIN/519Top1NUBjpB/oEMqi86Omt3zTQcXFWqrek0=";
+  };
 
   sourceRoot = "source/bindings/python";
 
-  nativeBuildInputs = [
-    pipInstallHook
-    setuptools-rust
-    wheel
-  ];
+  nativeBuildInputs = [ setuptools-rust ] ++ (with rustPlatform; [
+    cargoSetupHook
+    rust.cargo
+    rust.rustc
+  ]);
 
   propagatedBuildInputs = [
     numpy
-    python
   ];
 
   installCheckInputs = [
@@ -99,14 +100,6 @@ in rustPlatform.buildRustPackage rec {
       ln -s ${openaiMerges} openai-gpt-merges.txt )
   '';
 
-  buildPhase = ''
-    ${python.interpreter} setup.py bdist_wheel
-  '';
-
-  installPhase = ''
-    pipInstallPhase
-  '';
-
   preCheck = ''
     HOME=$TMPDIR
   '';
diff --git a/pkgs/development/python-modules/typesystem/default.nix b/pkgs/development/python-modules/typesystem/default.nix
index e93fd83656f..c278680404b 100644
--- a/pkgs/development/python-modules/typesystem/default.nix
+++ b/pkgs/development/python-modules/typesystem/default.nix
@@ -35,7 +35,7 @@ buildPythonPackage rec {
     # the default string formatting of regular expression flags which breaks test assertion
     "test_to_json_schema_complex_regular_expression"
   ];
-  disabledTestFiles = [
+  disabledTestPaths = [
     # for some reason jinja2 not picking up forms directory (1% of tests)
     "tests/test_forms.py"
   ];
diff --git a/pkgs/development/python-modules/virtualenv/default.nix b/pkgs/development/python-modules/virtualenv/default.nix
index 8b64bddc5a4..6d2c19d3675 100644
--- a/pkgs/development/python-modules/virtualenv/default.nix
+++ b/pkgs/development/python-modules/virtualenv/default.nix
@@ -69,7 +69,7 @@ buildPythonPackage rec {
   '';
 
   # Ignore tests which require network access
-  disabledTestFiles = [
+  disabledTestPaths = [
     "tests/unit/create/test_creator.py"
     "tests/unit/seed/embed/test_bootstrap_link_via_app_data.py"
   ];
diff --git a/pkgs/development/python-modules/wasmer/default.nix b/pkgs/development/python-modules/wasmer/default.nix
index ff4fffc821f..28c9b8b5c16 100644
--- a/pkgs/development/python-modules/wasmer/default.nix
+++ b/pkgs/development/python-modules/wasmer/default.nix
@@ -1,62 +1,34 @@
 { lib
 , rustPlatform
 , fetchFromGitHub
-, maturin
 , buildPythonPackage
-, python
 }:
 let
   pname = "wasmer";
   version = "1.0.0";
-
-  wheel = rustPlatform.buildRustPackage rec {
-    inherit pname version;
-
-    src = fetchFromGitHub {
-      owner = "wasmerio";
-      repo = "wasmer-python";
-      rev = version;
-      hash = "sha256-I1GfjLaPYMIHKh2m/5IQepUsJNiVUEJg49wyuuzUYtY=";
-    };
-
-    cargoHash = "sha256-txOOia1C4W+nsXuXp4EytEn82CFfSmiOYwRLC4WPImc=";
-
-    nativeBuildInputs = [ maturin python ];
-
-    preBuild = ''
-      cd packages/api
-    '';
-
-    buildPhase = ''
-      runHook preBuild
-      maturin build --release --manylinux off --strip
-      runHook postBuild
-    '';
-
-    postBuild = ''
-      cd ../..
-    '';
-
-    doCheck = false;
-
-    installPhase = ''
-      runHook preInstall
-      install -Dm644 -t $out target/wheels/*.whl
-      runHook postInstall
-    '';
-  };
-
-in
-buildPythonPackage rec {
+in buildPythonPackage rec {
   inherit pname version;
 
-  format = "wheel";
-  src = wheel;
+  src = fetchFromGitHub {
+    owner = "wasmerio";
+    repo = "wasmer-python";
+    rev = version;
+    hash = "sha256-I1GfjLaPYMIHKh2m/5IQepUsJNiVUEJg49wyuuzUYtY=";
+  };
 
-  unpackPhase = ''
-    mkdir -p dist
-    cp $src/*.whl dist
-  '';
+  cargoDeps = rustPlatform.fetchCargoTarball {
+    inherit src;
+    name = "${pname}-${version}";
+    hash = "sha256-txOOia1C4W+nsXuXp4EytEn82CFfSmiOYwRLC4WPImc=";
+  };
+
+  format = "pyproject";
+
+  nativeBuildInputs = with rustPlatform; [ cargoSetupHook maturinBuildHook ];
+
+  buildAndTestSubdir = "packages/api";
+
+  doCheck = false;
 
   pythonImportsCheck = [ "wasmer" ];
 
diff --git a/pkgs/development/tools/analysis/lcov/default.nix b/pkgs/development/tools/analysis/lcov/default.nix
index 35c75d67da5..30df5daed6f 100644
--- a/pkgs/development/tools/analysis/lcov/default.nix
+++ b/pkgs/development/tools/analysis/lcov/default.nix
@@ -11,7 +11,8 @@ stdenv.mkDerivation rec {
     sha256 = "1kvc7fkp45w48f0bxwbxvxkicnjrrydki0hllg294n1wrp80zzyk";
   };
 
-  buildInputs = [ perl makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ perl ];
 
   preBuild = ''
     patchShebangs bin/
diff --git a/pkgs/development/tools/analysis/panopticon/default.nix b/pkgs/development/tools/analysis/panopticon/default.nix
index 91f3f24d6f1..f7f933392ab 100644
--- a/pkgs/development/tools/analysis/panopticon/default.nix
+++ b/pkgs/development/tools/analysis/panopticon/default.nix
@@ -12,8 +12,7 @@ rustPlatform.buildRustPackage rec {
     sha256 = "1zv87nqhrzsxx0m891df4vagzssj3kblfv9yp7j96dw0vn9950qa";
   };
 
-  nativeBuildInputs = [ cmake pkg-config ];
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ cmake pkg-config makeWrapper ];
   propagatedBuildInputs = with qt5; [
      qt5.qtbase
      qtdeclarative
diff --git a/pkgs/development/tools/build-managers/apache-ant/1.9.nix b/pkgs/development/tools/build-managers/apache-ant/1.9.nix
index 182b8633aa0..93644caa5a4 100644
--- a/pkgs/development/tools/build-managers/apache-ant/1.9.nix
+++ b/pkgs/development/tools/build-managers/apache-ant/1.9.nix
@@ -6,7 +6,7 @@ stdenv.mkDerivation {
   pname = "ant";
   inherit version;
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   src = fetchurl {
     url = "mirror://apache/ant/binaries/apache-ant-${version}-bin.tar.bz2";
diff --git a/pkgs/development/tools/build-managers/apache-ant/default.nix b/pkgs/development/tools/build-managers/apache-ant/default.nix
index d88068c1c3e..d2ef8361ec0 100644
--- a/pkgs/development/tools/build-managers/apache-ant/default.nix
+++ b/pkgs/development/tools/build-managers/apache-ant/default.nix
@@ -6,7 +6,7 @@ stdenv.mkDerivation {
   pname = "ant";
   inherit version;
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   src = fetchurl {
     url = "mirror://apache/ant/binaries/apache-ant-${version}-bin.tar.bz2";
diff --git a/pkgs/development/tools/build-managers/apache-maven/default.nix b/pkgs/development/tools/build-managers/apache-maven/default.nix
index 4658703f8b1..3a1866e0b39 100644
--- a/pkgs/development/tools/build-managers/apache-maven/default.nix
+++ b/pkgs/development/tools/build-managers/apache-maven/default.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
     sha256 = "1i9qlj3vy4j1yyf22nwisd0pg88n9qzp9ymfhwqabadka7br3b96";
   };
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   inherit jdk;
 
diff --git a/pkgs/development/tools/build-managers/cmake/default.nix b/pkgs/development/tools/build-managers/cmake/default.nix
index 5de894bd1b4..7c2e5372e73 100644
--- a/pkgs/development/tools/build-managers/cmake/default.nix
+++ b/pkgs/development/tools/build-managers/cmake/default.nix
@@ -20,12 +20,12 @@ stdenv.mkDerivation (rec {
           + lib.optionalString useNcurses "-cursesUI"
           + lib.optionalString withQt5 "-qt5UI"
           + lib.optionalString useQt4 "-qt4UI";
-  version = "3.19.3";
+  version = "3.19.4";
 
   src = fetchurl {
     url = "${meta.homepage}files/v${lib.versions.majorMinor version}/cmake-${version}.tar.gz";
     # compare with https://cmake.org/files/v${lib.versions.majorMinor version}/cmake-${version}-SHA-256.txt
-    sha256 = "sha256-P6ynwTFJSh401m6fiXL/U2nkjUGeqM6qPcFbTBE2dzI=";
+    sha256 = "sha256-fQIyufHFfo3oHzgHHvggPmgg/n7siuRqHfEl2I28wuE=";
   };
 
   patches = [
diff --git a/pkgs/development/tools/build-managers/gradle/default.nix b/pkgs/development/tools/build-managers/gradle/default.nix
index d314064904d..4735a7559cf 100644
--- a/pkgs/development/tools/build-managers/gradle/default.nix
+++ b/pkgs/development/tools/build-managers/gradle/default.nix
@@ -33,7 +33,8 @@ rec {
         echo ${stdenv.cc.cc} > $out/nix-support/manual-runtime-dependencies
       '';
 
-    buildInputs = [ unzip java makeWrapper ];
+    nativeBuildInputs = [ makeWrapper ];
+    buildInputs = [ unzip java ];
 
     meta = {
       description = "Enterprise-grade build system";
diff --git a/pkgs/development/tools/build-managers/leiningen/default.nix b/pkgs/development/tools/build-managers/leiningen/default.nix
index 488697033d9..51b97b242d5 100644
--- a/pkgs/development/tools/build-managers/leiningen/default.nix
+++ b/pkgs/development/tools/build-managers/leiningen/default.nix
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
 
   dontUnpack = true;
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
   propagatedBuildInputs = [ jdk ];
 
   # the jar is not in share/java, because it's a standalone jar and should
diff --git a/pkgs/development/tools/build-managers/redo-sh/default.nix b/pkgs/development/tools/build-managers/redo-sh/default.nix
index d22f4bc487f..093a825723c 100644
--- a/pkgs/development/tools/build-managers/redo-sh/default.nix
+++ b/pkgs/development/tools/build-managers/redo-sh/default.nix
@@ -9,7 +9,7 @@ stdenv.mkDerivation {
     sha256 = "0d3hz3vy5qmjr9r4f8a5cx9hikpzs8h8f0fsl3dpbialf4wck24g";
   };
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   sourceRoot = ".";
   installPhase = ''
diff --git a/pkgs/development/tools/build-managers/sbt-extras/default.nix b/pkgs/development/tools/build-managers/sbt-extras/default.nix
index efc6523cd98..cb977191eaf 100644
--- a/pkgs/development/tools/build-managers/sbt-extras/default.nix
+++ b/pkgs/development/tools/build-managers/sbt-extras/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
 
   dontBuild = true;
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   installPhase = ''
     mkdir -p $out/bin
diff --git a/pkgs/development/tools/database/ephemeralpg/default.nix b/pkgs/development/tools/database/ephemeralpg/default.nix
index ae10c402945..0fb3ae81030 100644
--- a/pkgs/development/tools/database/ephemeralpg/default.nix
+++ b/pkgs/development/tools/database/ephemeralpg/default.nix
@@ -6,7 +6,7 @@ stdenv.mkDerivation rec {
     url = "http://ephemeralpg.org/code/${pname}-${version}.tar.gz";
     sha256 = "1ap22ki8yz6agd0qybcjgs4b9izw1rwwcgpxn3jah2ccfyax34s6";
   };
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
   installPhase = ''
     mkdir -p $out
     PREFIX=$out make install
diff --git a/pkgs/development/tools/database/liquibase/default.nix b/pkgs/development/tools/database/liquibase/default.nix
index eacd35ed760..92249282267 100644
--- a/pkgs/development/tools/database/liquibase/default.nix
+++ b/pkgs/development/tools/database/liquibase/default.nix
@@ -17,7 +17,8 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-Zwh8baMD8jt+yfsK0jpsTEU32rT+IAQGwavVT3rpRsU=";
   };
 
-  buildInputs = [ jre makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ jre ];
 
   unpackPhase = ''
     tar xfz ${src}
diff --git a/pkgs/development/tools/database/sqldeveloper/default.nix b/pkgs/development/tools/database/sqldeveloper/default.nix
index c42197e13cf..8fb7677f584 100644
--- a/pkgs/development/tools/database/sqldeveloper/default.nix
+++ b/pkgs/development/tools/database/sqldeveloper/default.nix
@@ -49,7 +49,8 @@ in
     sha256 = "1h53gl41ydr7kim6q9ckg3xyhb0rhmwj7jnis0xz6vms52b3h59k";
   };
 
-  buildInputs = [ makeWrapper unzip ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ unzip ];
 
   unpackCmd = "unzip $curSrc";
 
diff --git a/pkgs/development/tools/diesel-cli/default.nix b/pkgs/development/tools/diesel-cli/default.nix
index bd8e71090c5..20185ff7d13 100644
--- a/pkgs/development/tools/diesel-cli/default.nix
+++ b/pkgs/development/tools/diesel-cli/default.nix
@@ -9,11 +9,9 @@ assert lib.assertMsg (sqliteSupport == true || postgresqlSupport == true || mysq
 
 let
   inherit (lib) optional optionals optionalString;
-  features = ''
-    ${optionalString sqliteSupport "sqlite"} \
-    ${optionalString postgresqlSupport "postgres"} \
-    ${optionalString mysqlSupport "mysql"} \
-  '';
+  features = optional sqliteSupport "sqlite"
+    ++ optional postgresqlSupport "postgres"
+    ++ optional mysqlSupport "mysql";
 in
 
 rustPlatform.buildRustPackage rec {
@@ -35,11 +33,12 @@ rustPlatform.buildRustPackage rec {
     ./allow-warnings.patch
   ];
 
-  cargoBuildFlags = [ "--no-default-features --features \"${features}\"" ];
+  cargoBuildFlags = [ "--no-default-features" "--features" "${lib.concatStringsSep "," features}" ];
   cargoPatches = [ ./cargo-lock.patch ];
   cargoSha256 = "1vbb7r0dpmq8363i040bkhf279pz51c59kcq9v5qr34hs49ish8g";
 
   nativeBuildInputs = [ pkg-config ];
+
   buildInputs = [ openssl ]
     ++ optional stdenv.isDarwin Security
     ++ optional (stdenv.isDarwin && mysqlSupport) libiconv
@@ -47,12 +46,7 @@ rustPlatform.buildRustPackage rec {
     ++ optional postgresqlSupport postgresql
     ++ optionals mysqlSupport [ mysql zlib ];
 
-  # We must `cd diesel_cli`, we cannot use `--package diesel_cli` to build
-  # because --features fails to apply to the package:
-  # https://github.com/rust-lang/cargo/issues/5015
-  # https://github.com/rust-lang/cargo/issues/4753
-  preBuild = "cd diesel_cli";
-  postBuild = "cd ..";
+  buildAndTestSubdir = "diesel_cli";
 
   checkPhase = optionalString sqliteSupport ''
     (cd diesel_cli && cargo check --features sqlite)
@@ -65,7 +59,7 @@ rustPlatform.buildRustPackage rec {
 
   # Fix the build with mariadb, which otherwise shows "error adding symbols:
   # DSO missing from command line" errors for libz and libssl.
-  NIX_LDFLAGS = lib.optionalString mysqlSupport "-lz -lssl -lcrypto";
+  NIX_LDFLAGS = optionalString mysqlSupport "-lz -lssl -lcrypto";
 
   meta = with lib; {
     description = "Database tool for working with Rust projects that use Diesel";
diff --git a/pkgs/development/tools/documentation/gtk-doc/default.nix b/pkgs/development/tools/documentation/gtk-doc/default.nix
index d82c288e5aa..e74a6b9c3c6 100644
--- a/pkgs/development/tools/documentation/gtk-doc/default.nix
+++ b/pkgs/development/tools/documentation/gtk-doc/default.nix
@@ -5,7 +5,7 @@
 , pkg-config
 , python3
 , docbook_xml_dtd_43
-, docbook_xsl
+, docbook-xsl-nons
 , libxslt
 , gettext
 , gnome3
@@ -14,7 +14,9 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "gtk-doc";
-  version = "1.33.1";
+  version = "1.33.2";
+
+  outputDevdoc = "out";
 
   format = "other";
 
@@ -23,15 +25,13 @@ python3.pkgs.buildPythonApplication rec {
     owner = "GNOME";
     repo = pname;
     rev = version;
-    sha256 = "L9CjhZ60F42xbo50x7cdKfJrav/9mf38pff8S4xkEVo=";
+    sha256 = "A6OXpazrJ05SUIO1ZPVN0xHTXOSov8UnPvUolZAv/Iw=";
   };
 
   patches = [
     passthru.respect_xml_catalog_files_var_patch
   ];
 
-  outputDevdoc = "out";
-
   nativeBuildInputs = [
     pkg-config
     gettext
@@ -42,7 +42,7 @@ python3.pkgs.buildPythonApplication rec {
 
   buildInputs = [
     docbook_xml_dtd_43
-    docbook_xsl
+    docbook-xsl-nons
     libxslt
   ] ++ lib.optionals withDblatex [
     dblatex
@@ -50,7 +50,6 @@ python3.pkgs.buildPythonApplication rec {
 
   pythonPath = with python3.pkgs; [
     pygments # Needed for https://gitlab.gnome.org/GNOME/gtk-doc/blob/GTK_DOC_1_32/meson.build#L42
-    (anytree.override { withGraphviz = false; })
     lxml
   ];
 
@@ -79,8 +78,8 @@ python3.pkgs.buildPythonApplication rec {
 
   meta = with lib; {
     description = "Tools to extract documentation embedded in GTK and GNOME source code";
-    homepage = "https://www.gtk.org/gtk-doc";
-    license = licenses.gpl2;
-    maintainers = with maintainers; [ pSub worldofpeace ];
+    homepage = "https://gitlab.gnome.org/GNOME/gtk-doc";
+    license = licenses.gpl2Plus;
+    maintainers = teams.gnome.members ++ (with maintainers; [ pSub ]);
   };
 }
diff --git a/pkgs/development/tools/google-app-engine-go-sdk/default.nix b/pkgs/development/tools/google-app-engine-go-sdk/default.nix
index 4d572e070e7..c20d7a2e49a 100644
--- a/pkgs/development/tools/google-app-engine-go-sdk/default.nix
+++ b/pkgs/development/tools/google-app-engine-go-sdk/default.nix
@@ -17,7 +17,8 @@ stdenv.mkDerivation rec {
         sha256 = "0s8sqyc72lnc7dxd4cl559gyfx83x71jjpsld3i3nbp3mwwamczp";
       };
 
-  buildInputs = [ python makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ python ];
 
   installPhase = ''
     mkdir -p $out/bin $out/share/
diff --git a/pkgs/development/tools/jbake/default.nix b/pkgs/development/tools/jbake/default.nix
index 97d1c753682..e14cfe87404 100644
--- a/pkgs/development/tools/jbake/default.nix
+++ b/pkgs/development/tools/jbake/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "0ripayv1vf4f4ylxr7h9kad2xhy3y98ca8s4p38z7dn8l47zg0qw";
   };
 
-  buildInputs = [ makeWrapper jre ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ jre ];
 
   postPatch = "patchShebangs .";
 
diff --git a/pkgs/development/tools/jbang/default.nix b/pkgs/development/tools/jbang/default.nix
index c41fb4c639f..afabfc4b881 100644
--- a/pkgs/development/tools/jbang/default.nix
+++ b/pkgs/development/tools/jbang/default.nix
@@ -1,12 +1,12 @@
 { stdenv, lib, fetchzip, jdk, makeWrapper, coreutils, curl }:
 
 stdenv.mkDerivation rec {
-  version = "0.65.1";
+  version = "0.66.0";
   pname = "jbang";
 
   src = fetchzip {
     url = "https://github.com/jbangdev/jbang/releases/download/v${version}/${pname}-${version}.tar";
-    sha256 = "sha256-Puddnem03RGORKkvcLy5o/eOzKzrOuRvqPk5FsjQ3Lw=";
+    sha256 = "sha256-iWM9IcvrcsX/rTzouT7rQbuGSFTIVPnHSCmAHxzFOQo=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/development/tools/jsduck/default.nix b/pkgs/development/tools/jsduck/default.nix
index 233b3933876..15a3a683403 100644
--- a/pkgs/development/tools/jsduck/default.nix
+++ b/pkgs/development/tools/jsduck/default.nix
@@ -13,7 +13,8 @@ stdenv.mkDerivation rec {
 
   phases = [ "installPhase" ];
 
-  buildInputs = [ env makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ env ];
 
   installPhase = ''
     mkdir -p $out/bin
diff --git a/pkgs/development/tools/misc/autobuild/default.nix b/pkgs/development/tools/misc/autobuild/default.nix
index da387105cef..186608cde3f 100644
--- a/pkgs/development/tools/misc/autobuild/default.nix
+++ b/pkgs/development/tools/misc/autobuild/default.nix
@@ -8,7 +8,8 @@ stdenv.mkDerivation rec {
     sha256 = "0gv7g61ja9q9zg1m30k4snqwwy1kq7b4df6sb7d2qra7kbdq8af1";
   };
 
-  buildInputs = [ makeWrapper perl openssh rsync ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ perl openssh rsync ];
 
   doCheck = true;
 
diff --git a/pkgs/development/tools/misc/cbrowser/default.nix b/pkgs/development/tools/misc/cbrowser/default.nix
index 0f7edeea812..62aa0ab5dec 100644
--- a/pkgs/development/tools/misc/cbrowser/default.nix
+++ b/pkgs/development/tools/misc/cbrowser/default.nix
@@ -10,7 +10,8 @@ stdenv.mkDerivation rec {
 
   patches = [ ./backslashes-quotes.diff ];
 
-  buildInputs = [ tk makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ tk ];
 
   installPhase = ''
     mkdir -p $out/bin $out/share/${name}
diff --git a/pkgs/development/tools/misc/dejagnu/default.nix b/pkgs/development/tools/misc/dejagnu/default.nix
index 285805ccb02..61251434578 100644
--- a/pkgs/development/tools/misc/dejagnu/default.nix
+++ b/pkgs/development/tools/misc/dejagnu/default.nix
@@ -8,7 +8,8 @@ stdenv.mkDerivation rec {
     sha256 = "0qfj2wd4qk1yn9yzam6g8nmyxfazcc0knjyyibycb2ainkhp21hd";
   };
 
-  buildInputs = [ expect makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ expect ];
 
   doCheck = true;
 
diff --git a/pkgs/development/tools/misc/fswatch/default.nix b/pkgs/development/tools/misc/fswatch/default.nix
index 6f9f5e113c0..47716b5ea9e 100644
--- a/pkgs/development/tools/misc/fswatch/default.nix
+++ b/pkgs/development/tools/misc/fswatch/default.nix
@@ -20,8 +20,8 @@ stdenv.mkDerivation rec {
     sha256 = "11479ac436g8bwk0lfnmdms0cirv9k11pdvfrrg9jwkki1j1abkk";
   };
 
-  nativeBuildInputs = [ autoreconfHook ] ++ lib.optionals stdenv.isDarwin [ CoreServices ];
-  buildInputs = [ gettext libtool makeWrapper texinfo ];
+  nativeBuildInputs = [ autoreconfHook makeWrapper ] ++ lib.optionals stdenv.isDarwin [ CoreServices ];
+  buildInputs = [ gettext libtool texinfo ];
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/development/tools/misc/gpshell/default.nix b/pkgs/development/tools/misc/gpshell/default.nix
index 13437b71953..f5298d685eb 100644
--- a/pkgs/development/tools/misc/gpshell/default.nix
+++ b/pkgs/development/tools/misc/gpshell/default.nix
@@ -11,8 +11,8 @@ stdenv.mkDerivation rec {
     sha256 = "19a77zvyf2vazbv17185s4pynhylk2ky8vhl4i8pg9zww29sicqi";
   };
 
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ globalplatform pcsclite makeWrapper ];
+  nativeBuildInputs = [ pkg-config makeWrapper ];
+  buildInputs = [ globalplatform pcsclite ];
 
   postFixup = ''
     wrapProgram "$out/bin/gpshell" --prefix LD_LIBRARY_PATH : "${gppcscconnectionplugin}/lib"
diff --git a/pkgs/development/tools/misc/help2man/default.nix b/pkgs/development/tools/misc/help2man/default.nix
index 6afc4415e11..ba1fa720dd4 100644
--- a/pkgs/development/tools/misc/help2man/default.nix
+++ b/pkgs/development/tools/misc/help2man/default.nix
@@ -6,11 +6,11 @@
 # files.
 
 stdenv.mkDerivation rec {
-  name = "help2man-1.47.16";
+  name = "help2man-1.47.17";
 
   src = fetchurl {
     url = "mirror://gnu/help2man/${name}.tar.xz";
-    sha256 = "1x586h7wvripcay35kdh2kvydx84y8yy93ffjah2rqw6bc65iy1y";
+    sha256 = "sha256-2jo1xQseH4yPoyLWn6R8kBHORDqPuNHWcbHwG4sACOs=";
   };
 
   nativeBuildInputs = [ gettext perlPackages.LocaleGettext ];
diff --git a/pkgs/development/tools/misc/kibana/6.x.nix b/pkgs/development/tools/misc/kibana/6.x.nix
index 3fa2d219fe3..9ba19c836b5 100644
--- a/pkgs/development/tools/misc/kibana/6.x.nix
+++ b/pkgs/development/tools/misc/kibana/6.x.nix
@@ -42,7 +42,7 @@ in stdenv.mkDerivation rec {
     ./disable-nodejs-version-check.patch
   ];
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   installPhase = ''
     mkdir -p $out/libexec/kibana $out/bin
diff --git a/pkgs/development/tools/misc/kibana/7.x.nix b/pkgs/development/tools/misc/kibana/7.x.nix
index 7f46d6f6512..754559969d5 100644
--- a/pkgs/development/tools/misc/kibana/7.x.nix
+++ b/pkgs/development/tools/misc/kibana/7.x.nix
@@ -42,7 +42,7 @@ in stdenv.mkDerivation rec {
     ./disable-nodejs-version-check-7.patch
   ];
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   installPhase = ''
     mkdir -p $out/libexec/kibana $out/bin
diff --git a/pkgs/development/tools/misc/macdylibbundler/default.nix b/pkgs/development/tools/misc/macdylibbundler/default.nix
index c92d7b07798..f37815081ee 100644
--- a/pkgs/development/tools/misc/macdylibbundler/default.nix
+++ b/pkgs/development/tools/misc/macdylibbundler/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation {
     sha256 = "149p3dcnap4hs3nhq5rfvr3m70rrb5hbr5xkj1h0gsfp0d7gvxnj";
   };
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   makeFlags = [ "PREFIX=$(out)" ];
 
diff --git a/pkgs/development/tools/misc/rolespec/default.nix b/pkgs/development/tools/misc/rolespec/default.nix
index d86277993ca..b26fbf75031 100644
--- a/pkgs/development/tools/misc/rolespec/default.nix
+++ b/pkgs/development/tools/misc/rolespec/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
     inherit name;
   };
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   # The default build phase (`make`) runs the test code. It's difficult to do
   # the test in the build environment because it depends on the system package
diff --git a/pkgs/development/tools/neoload/default.nix b/pkgs/development/tools/neoload/default.nix
index fb85aa80dc3..63452728b91 100644
--- a/pkgs/development/tools/neoload/default.nix
+++ b/pkgs/development/tools/neoload/default.nix
@@ -41,7 +41,7 @@ in stdenv.mkDerivation {
       { url = "http://neoload.installers.neotys.com/documents/download/neoload/v4.1/neoload_4_1_4_linux_x86.sh";
         sha256 = "1z66jiwcxixsqqwa0f4q8m2p5kna4knq6lic8y8l74dgv25mw912"; } );
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
   phases = [ "installPhase" ];
 
   # TODO: load generator / monitoring agent only builds
diff --git a/pkgs/development/tools/node-webkit/nw12.nix b/pkgs/development/tools/node-webkit/nw12.nix
index 31358129821..475c08eb169 100644
--- a/pkgs/development/tools/node-webkit/nw12.nix
+++ b/pkgs/development/tools/node-webkit/nw12.nix
@@ -49,7 +49,7 @@ in stdenv.mkDerivation rec {
     ln -s $out/share/nwjs/nwjc $out/bin
   '';
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   meta = with lib; {
     description = "An app runtime based on Chromium and node.js";
diff --git a/pkgs/development/tools/nrpl/default.nix b/pkgs/development/tools/nrpl/default.nix
index 72177582919..67a86ca8dec 100644
--- a/pkgs/development/tools/nrpl/default.nix
+++ b/pkgs/development/tools/nrpl/default.nix
@@ -11,7 +11,8 @@ stdenv.mkDerivation {
     sha256 = "1cly9lhrawnc42r31b7r0p0i6hcx8r00aa17gv7w9pcpj8ngb4v2";
   };
 
-  buildInputs = [ makeWrapper nim pcre ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ nim pcre ];
 
   patches = [
     (fetchpatch {
diff --git a/pkgs/development/tools/nwjs/default.nix b/pkgs/development/tools/nwjs/default.nix
index d3490b2b9c9..1356bc46ced 100644
--- a/pkgs/development/tools/nwjs/default.nix
+++ b/pkgs/development/tools/nwjs/default.nix
@@ -83,7 +83,7 @@ in stdenv.mkDerivation rec {
       ln -s $out/share/nwjs/nw $out/bin
   '';
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   meta = with lib; {
     description = "An app runtime based on Chromium and node.js";
diff --git a/pkgs/development/tools/ocaml/omake/0.9.8.6-rc1.nix b/pkgs/development/tools/ocaml/omake/0.9.8.6-rc1.nix
index 047246cd0a0..5a4b55cc7fe 100644
--- a/pkgs/development/tools/ocaml/omake/0.9.8.6-rc1.nix
+++ b/pkgs/development/tools/ocaml/omake/0.9.8.6-rc1.nix
@@ -20,7 +20,8 @@ stdenv.mkDerivation {
   patchFlags = [ "-p0" ];
   patches = [ ./warn.patch ];
 
-  buildInputs = [ ocaml makeWrapper ncurses ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ ocaml ncurses ];
 
   phases = "unpackPhase patchPhase buildPhase";
   buildPhase = ''
diff --git a/pkgs/development/tools/ocaml/opam/1.2.2.nix b/pkgs/development/tools/ocaml/opam/1.2.2.nix
index a128f2144e9..610093af19f 100644
--- a/pkgs/development/tools/ocaml/opam/1.2.2.nix
+++ b/pkgs/development/tools/ocaml/opam/1.2.2.nix
@@ -47,7 +47,8 @@ in stdenv.mkDerivation {
   pname = "opam";
   version = "1.2.2";
 
-  buildInputs = [ unzip curl ncurses ocaml makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ unzip curl ncurses ocaml ];
 
   src = srcs.opam;
 
diff --git a/pkgs/development/tools/ocaml/opam/default.nix b/pkgs/development/tools/ocaml/opam/default.nix
index b99880fe7f3..30bc089ee0f 100644
--- a/pkgs/development/tools/ocaml/opam/default.nix
+++ b/pkgs/development/tools/ocaml/opam/default.nix
@@ -63,7 +63,8 @@ in stdenv.mkDerivation {
   pname = "opam";
   version = "2.0.8";
 
-  buildInputs = [ unzip curl ncurses ocaml makeWrapper getconf ] ++ lib.optional stdenv.isLinux bubblewrap;
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ unzip curl ncurses ocaml getconf ] ++ lib.optional stdenv.isLinux bubblewrap;
 
   src = srcs.opam;
 
diff --git a/pkgs/development/tools/operator-sdk/default.nix b/pkgs/development/tools/operator-sdk/default.nix
index 2cc46d018ec..0df9b0e15d1 100644
--- a/pkgs/development/tools/operator-sdk/default.nix
+++ b/pkgs/development/tools/operator-sdk/default.nix
@@ -17,7 +17,8 @@ buildGoModule rec {
 
   subPackages = [ "cmd/operator-sdk" ];
 
-  buildInputs = [ go makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ go ];
 
   # operator-sdk uses the go compiler at runtime
   allowGoReference = true;
diff --git a/pkgs/development/tools/out-of-tree/default.nix b/pkgs/development/tools/out-of-tree/default.nix
index 4547012e2f3..597d680cc2b 100644
--- a/pkgs/development/tools/out-of-tree/default.nix
+++ b/pkgs/development/tools/out-of-tree/default.nix
@@ -4,7 +4,7 @@ buildGoModule rec {
   pname = "out-of-tree";
   version = "1.4.0";
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   src = fetchgit {
     rev = "refs/tags/v${version}";
diff --git a/pkgs/development/tools/parsing/bison/default.nix b/pkgs/development/tools/parsing/bison/default.nix
index 662961ae46a..42c9ee872fe 100644
--- a/pkgs/development/tools/parsing/bison/default.nix
+++ b/pkgs/development/tools/parsing/bison/default.nix
@@ -7,11 +7,11 @@
 
 stdenv.mkDerivation rec {
   pname = "bison";
-  version = "3.7.4";
+  version = "3.7.5";
 
   src = fetchurl {
     url = "mirror://gnu/${pname}/${pname}-${version}.tar.gz";
-    sha256 = "1qkp2rfi5njyp5c5avajab00aj74pkmkgzkvshv4p2ydkhswgazv";
+    sha256 = "sha256-FRy18ScW4/6TonoxfNRIeDKWWfJ1s0J3m/rvSlJrv3A=";
   };
 
   nativeBuildInputs = [ m4 perl ] ++ lib.optional stdenv.isSunOS help2man;
diff --git a/pkgs/development/tools/profiling/systemtap/default.nix b/pkgs/development/tools/profiling/systemtap/default.nix
index c5d65a8239e..641c1581b05 100644
--- a/pkgs/development/tools/profiling/systemtap/default.nix
+++ b/pkgs/development/tools/profiling/systemtap/default.nix
@@ -37,7 +37,7 @@ let
 
 in runCommand "systemtap-${kernel.version}-${version}" {
   inherit stapBuild kernelBuildDir;
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
   meta = {
     homepage = "https://sourceware.org/systemtap/";
     repositories.git = url;
diff --git a/pkgs/development/tools/quilt/default.nix b/pkgs/development/tools/quilt/default.nix
index 71cf10e63b9..94b5e5a6dcc 100644
--- a/pkgs/development/tools/quilt/default.nix
+++ b/pkgs/development/tools/quilt/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "01vfvk4pqigahx82fhaaffg921ivd3k7rylz1yfvy4zbdyd32jri";
   };
 
-  buildInputs = [ makeWrapper perl bash diffutils patch findutils diffstat ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ perl bash diffutils patch findutils diffstat ];
 
   postInstall = ''
     wrapProgram $out/bin/quilt --prefix PATH : \
diff --git a/pkgs/development/tools/ronn/default.nix b/pkgs/development/tools/ronn/default.nix
index 9e4ac0b58eb..8b516627220 100644
--- a/pkgs/development/tools/ronn/default.nix
+++ b/pkgs/development/tools/ronn/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
 
   phases = ["installPhase"];
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   installPhase = ''
     mkdir -p $out/bin
diff --git a/pkgs/development/tools/scalafix/default.nix b/pkgs/development/tools/scalafix/default.nix
index 00fda8bfc36..c27d6e8a65f 100644
--- a/pkgs/development/tools/scalafix/default.nix
+++ b/pkgs/development/tools/scalafix/default.nix
@@ -19,7 +19,8 @@ in
 stdenv.mkDerivation {
   name = "${baseName}-${version}";
 
-  buildInputs = [ jdk makeWrapper deps ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ jdk deps ];
 
   doCheck = true;
 
diff --git a/pkgs/development/tools/selenium/selendroid/default.nix b/pkgs/development/tools/selenium/selendroid/default.nix
index c25190cab74..b029e7711a3 100644
--- a/pkgs/development/tools/selenium/selendroid/default.nix
+++ b/pkgs/development/tools/selenium/selendroid/default.nix
@@ -23,7 +23,8 @@ stdenv.mkDerivation {
 
   dontUnpack = true;
 
-  buildInputs = [ jdk makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ jdk ];
 
   installPhase = ''
     mkdir -p $out/share/lib/selendroid
diff --git a/pkgs/development/tools/selenium/server/default.nix b/pkgs/development/tools/selenium/server/default.nix
index 10893a9d170..c4f8653794f 100644
--- a/pkgs/development/tools/selenium/server/default.nix
+++ b/pkgs/development/tools/selenium/server/default.nix
@@ -18,7 +18,8 @@ in stdenv.mkDerivation rec {
 
   dontUnpack = true;
 
-  buildInputs = [ jre makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ jre ];
 
   installPhase = ''
     mkdir -p $out/share/lib/${pname}-${version}
diff --git a/pkgs/development/tools/sslmate/default.nix b/pkgs/development/tools/sslmate/default.nix
index cdf2242bdba..ef04725e562 100644
--- a/pkgs/development/tools/sslmate/default.nix
+++ b/pkgs/development/tools/sslmate/default.nix
@@ -10,7 +10,8 @@ stdenv.mkDerivation rec {
 
   makeFlags = [ "PREFIX=$(out)" ];
 
-  buildInputs = [ perlPackages.perl makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ perlPackages.perl ];
 
   postInstall = ''
     wrapProgram $out/bin/sslmate --prefix PERL5LIB : \
diff --git a/pkgs/development/tools/the-way/default.nix b/pkgs/development/tools/the-way/default.nix
index e8f52fa8334..6d7fbef2f19 100644
--- a/pkgs/development/tools/the-way/default.nix
+++ b/pkgs/development/tools/the-way/default.nix
@@ -17,7 +17,7 @@ rustPlatform.buildRustPackage rec {
 
   cargoSha256 = "sha256-jTZso61Lyt6jprBxBAhvchgOsgM9y1qBleTxUx1jCnE=";
   checkFlagsArray = lib.optionals stdenv.isDarwin [ "--skip=copy" ];
-  cargoParallelTestThreads = false;
+  dontUseCargoParallelTests = true;
 
   postInstall = ''
     $out/bin/the-way config default tmp.toml
diff --git a/pkgs/development/tools/thrust/default.nix b/pkgs/development/tools/thrust/default.nix
index 44dfa1a4ba1..02183282ce1 100644
--- a/pkgs/development/tools/thrust/default.nix
+++ b/pkgs/development/tools/thrust/default.nix
@@ -22,7 +22,8 @@ in stdenv.mkDerivation rec {
     sha256 = "07rrnlj0gk500pvar4b1wdqm05p4n9yjwn911x93bd2qwc8r5ymc";
   };
 
-  buildInputs = [ thrustEnv makeWrapper unzip ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ thrustEnv unzip ];
 
   phases = [ "installPhase" "fixupPhase" ];
 
diff --git a/pkgs/games/airstrike/default.nix b/pkgs/games/airstrike/default.nix
index f45ac2f0153..12b485764a5 100644
--- a/pkgs/games/airstrike/default.nix
+++ b/pkgs/games/airstrike/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "1h6rv2zcp84ycmd0kv1pbpqjgwx57dw42x7878d2c2vnpi5jn8qi";
   };
 
-  buildInputs = [ makeWrapper SDL SDL_image ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ SDL SDL_image ];
 
   NIX_LDFLAGS = "-lm";
 
diff --git a/pkgs/games/black-hole-solver/default.nix b/pkgs/games/black-hole-solver/default.nix
new file mode 100644
index 00000000000..e859e72d96b
--- /dev/null
+++ b/pkgs/games/black-hole-solver/default.nix
@@ -0,0 +1,30 @@
+{
+  stdenv, lib, fetchurl,
+  cmake, perl, pkg-config, python3,
+  rinutils, PathTiny,
+}:
+
+stdenv.mkDerivation rec {
+  pname = "black-hole-solver";
+  version = "1.10.1";
+
+  meta = with lib; {
+    homepage = "https://www.shlomifish.org/open-source/projects/black-hole-solitaire-solver/";
+    description = "A solver for Solitaire variants Golf, Black Hole, and All in a Row.";
+    license = licenses.mit;
+  };
+
+  src = fetchurl {
+    url = "https://fc-solve.shlomifish.org/downloads/fc-solve/${pname}-${version}.tar.xz";
+    sha256 = "1qhihmk4fwz6n16c7bnxnh3v7jhbb7xhkc9wk9484bp0k4x9bq9n";
+  };
+
+  nativeBuildInputs = [ cmake perl pkg-config python3 ];
+
+  buildInputs = [ rinutils PathTiny ];
+
+  prePatch = ''
+    patchShebangs ./scripts
+  '';
+
+}
diff --git a/pkgs/games/chessdb/default.nix b/pkgs/games/chessdb/default.nix
index 656e4ab6add..40f90e75ff8 100644
--- a/pkgs/games/chessdb/default.nix
+++ b/pkgs/games/chessdb/default.nix
@@ -8,7 +8,8 @@ stdenv.mkDerivation {
     sha256 = "0brc3wln3bxp979iqj2w1zxpfd0pch8zzazhdmwf7acww4hrsz62";
   };
 
-  buildInputs = [ tcl tk libX11 makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ tcl tk libX11 ];
 
   makeFlags = [
     "BINDIR=$(out)/bin"
diff --git a/pkgs/games/ckan/default.nix b/pkgs/games/ckan/default.nix
index 052982bf15d..26a0ba748ba 100644
--- a/pkgs/games/ckan/default.nix
+++ b/pkgs/games/ckan/default.nix
@@ -11,7 +11,8 @@ stdenv.mkDerivation rec {
 
   dontUnpack = true;
 
-  buildInputs = [ makeWrapper mono ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ mono ];
 
   libraries = lib.makeLibraryPath [ gtk2 curl ];
 
diff --git a/pkgs/games/dwarf-fortress/dwarf-therapist/wrapper.nix b/pkgs/games/dwarf-fortress/dwarf-therapist/wrapper.nix
index bd75a66b487..7db79012ec6 100644
--- a/pkgs/games/dwarf-fortress/dwarf-therapist/wrapper.nix
+++ b/pkgs/games/dwarf-fortress/dwarf-therapist/wrapper.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation {
 
   paths = [ dwarf-therapist ];
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   passthru = { inherit dwarf-fortress dwarf-therapist; };
 
diff --git a/pkgs/games/factorio/default.nix b/pkgs/games/factorio/default.nix
index 356cedd3507..879bbfa2311 100644
--- a/pkgs/games/factorio/default.nix
+++ b/pkgs/games/factorio/default.nix
@@ -178,7 +178,8 @@ let
     headless = base;
     demo = base // {
 
-      buildInputs = [ makeWrapper libpulseaudio ];
+      nativeBuildInputs = [ makeWrapper ];
+      buildInputs = [ libpulseaudio ];
 
       libPath = lib.makeLibraryPath [
         alsaLib
diff --git a/pkgs/games/gcs/default.nix b/pkgs/games/gcs/default.nix
index a471b425f0c..9d8d74921e5 100644
--- a/pkgs/games/gcs/default.nix
+++ b/pkgs/games/gcs/default.nix
@@ -42,7 +42,8 @@ in stdenv.mkDerivation rec {
     cp -r ${library} gcs_library
   '';
 
-  buildInputs = [ jdk8 jre8 ant makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ jdk8 jre8 ant ];
   buildPhase = ''
     cd apple_stubs
     ant
diff --git a/pkgs/games/gogui/default.nix b/pkgs/games/gogui/default.nix
index 8eb989a8f47..fa901c14f81 100644
--- a/pkgs/games/gogui/default.nix
+++ b/pkgs/games/gogui/default.nix
@@ -5,7 +5,8 @@ let
 in stdenv.mkDerivation {
   pname = "gogui";
   inherit version;
-  buildInputs = [ unzip makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ unzip ];
   src = fetchurl {
     url = "mirror://sourceforge/project/gogui/gogui/${version}/gogui-${version}.zip";
     sha256 = "0qk6p1bhi1816n638bg11ljyj6zxvm75jdf02aabzdmmd9slns1j";
diff --git a/pkgs/games/gtypist/default.nix b/pkgs/games/gtypist/default.nix
index d0ddf43fe2a..43b95bacefc 100644
--- a/pkgs/games/gtypist/default.nix
+++ b/pkgs/games/gtypist/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "0xzrkkmj0b1dw3yr0m9hml2y634cc4h61im6zwcq57s7285z8fn1";
   };
 
-  buildInputs = [ makeWrapper ncurses perl fortune ]
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ ncurses perl fortune ]
    ++ lib.optional stdenv.isDarwin libiconv;
 
   preFixup = ''
diff --git a/pkgs/games/mrrescue/default.nix b/pkgs/games/mrrescue/default.nix
index c5b2b7d20eb..ae7519c948b 100644
--- a/pkgs/games/mrrescue/default.nix
+++ b/pkgs/games/mrrescue/default.nix
@@ -29,8 +29,7 @@ stdenv.mkDerivation {
     sha256 = "0kzahxrgpb4vsk9yavy7f8nc34d62d1jqjrpsxslmy9ywax4yfpi";
   };
 
-  nativeBuildInputs = [ lua love ];
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ lua love makeWrapper ];
 
   phases = "installPhase";
 
diff --git a/pkgs/games/newtonwars/default.nix b/pkgs/games/newtonwars/default.nix
index 0da6d9352e0..0be3d9bf7a0 100644
--- a/pkgs/games/newtonwars/default.nix
+++ b/pkgs/games/newtonwars/default.nix
@@ -11,7 +11,8 @@ stdenv.mkDerivation {
     sha256 = "0g63fwfcdxxlnqlagj1fb8ngm385gmv8f7p8b4r1z5cny2znxdvs";
   };
 
-  buildInputs = [ makeWrapper freeglut libGL libGLU ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ freeglut libGL libGLU ];
 
   patchPhase = ''
     sed -i "s;font24.raw;$out/share/font24.raw;g" display.c
diff --git a/pkgs/games/nottetris2/default.nix b/pkgs/games/nottetris2/default.nix
index 53e7dec0803..42e5a33cad7 100644
--- a/pkgs/games/nottetris2/default.nix
+++ b/pkgs/games/nottetris2/default.nix
@@ -25,8 +25,8 @@ stdenv.mkDerivation {
     sha256 = "17iabh6rr8jim70n96rbhif4xq02g2kppscm8l339yqx6mhb64hs";
   };
 
-  nativeBuildInputs = [ zip ];
-  buildInputs = [ love_0_7 makeWrapper ];
+  nativeBuildInputs = [ zip makeWrapper ];
+  buildInputs = [ love_0_7 ];
 
   phases = [ "unpackPhase" "installPhase" ];
 
diff --git a/pkgs/games/r2mod_cli/default.nix b/pkgs/games/r2mod_cli/default.nix
index b81f1814ac9..b5b14ba2363 100644
--- a/pkgs/games/r2mod_cli/default.nix
+++ b/pkgs/games/r2mod_cli/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
     sha256 = "1g64f8ms7yz4rzm6xb93agc08kh9sbwkhvq35dpfhvi6v59j3n5m";
   };
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   makeFlags = [ "PREFIX=$(out)" ];
 
diff --git a/pkgs/games/racer/default.nix b/pkgs/games/racer/default.nix
index dfbe9bc45e1..16507fa219e 100644
--- a/pkgs/games/racer/default.nix
+++ b/pkgs/games/racer/default.nix
@@ -12,8 +12,8 @@ stdenv.mkDerivation {
   } else
     throw "System not supported";
 
-
-  buildInputs = [ allegro libjpeg makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ allegro libjpeg ];
 
   prePatch = ''
     sed -i s,/usr/local,$out, Makefile src/HGFX.cpp src/STDH.cpp
diff --git a/pkgs/games/runelite/default.nix b/pkgs/games/runelite/default.nix
index df8a5c3e8dc..e9e77e275dc 100644
--- a/pkgs/games/runelite/default.nix
+++ b/pkgs/games/runelite/default.nix
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
     startupNotify = null;
   };
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   # colon is bash form of no-op (do nothing)
   dontUnpack = true;
diff --git a/pkgs/games/scid/default.nix b/pkgs/games/scid/default.nix
index f0fdef8e62e..7b1a15c0a55 100644
--- a/pkgs/games/scid/default.nix
+++ b/pkgs/games/scid/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation {
     sha256 = "0zb5qp04x8w4gn2kvfdfq2p44kmzfcqn7v167dixz6nlyxg41hrw";
   };
 
-  buildInputs = [ tcl tk libX11 zlib makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ tcl tk libX11 zlib ];
 
   prePatch = ''
     sed -i -e '/^ *set headerPath *{/a ${tcl}/include ${tk}/include' \
diff --git a/pkgs/games/sil/default.nix b/pkgs/games/sil/default.nix
index 3128ed5358b..5f589ede2bc 100644
--- a/pkgs/games/sil/default.nix
+++ b/pkgs/games/sil/default.nix
@@ -18,7 +18,8 @@ stdenv.mkDerivation rec {
     stripRoot=false;
   };
 
-  buildInputs = [ makeWrapper ncurses libX11 libXaw libXt libXext libXmu ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ ncurses libX11 libXaw libXt libXext libXmu ];
 
   sourceRoot = "source/Sil/src";
 
diff --git a/pkgs/games/vassal/default.nix b/pkgs/games/vassal/default.nix
index effb999e02c..2a916094af4 100644
--- a/pkgs/games/vassal/default.nix
+++ b/pkgs/games/vassal/default.nix
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
     sha256 = "0xn403fxz6ay5lv8whyfdq611kvxj5q309bj317yw5cxbb08w1yb";
   };
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   installPhase = ''
     mkdir -p $out/bin $out/share/vassal $out/doc
diff --git a/pkgs/games/zod/default.nix b/pkgs/games/zod/default.nix
index b07db62aa15..6c48caf8756 100644
--- a/pkgs/games/zod/default.nix
+++ b/pkgs/games/zod/default.nix
@@ -24,7 +24,8 @@ stdenv.mkDerivation {
     sourceRoot=`pwd`/src
   '';
 
-  buildInputs = [ unrar unzip SDL SDL_image SDL_ttf SDL_mixer libmysqlclient makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ unrar unzip SDL SDL_image SDL_ttf SDL_mixer libmysqlclient ];
 
   NIX_LDFLAGS = "-L${libmysqlclient}/lib/mysql";
 
diff --git a/pkgs/misc/emulators/blastem/default.nix b/pkgs/misc/emulators/blastem/default.nix
index eba646e2f20..a2dc86449d9 100644
--- a/pkgs/misc/emulators/blastem/default.nix
+++ b/pkgs/misc/emulators/blastem/default.nix
@@ -25,7 +25,8 @@ stdenv.mkDerivation {
     url = "https://www.retrodev.com/repos/blastem/archive/3d48cb0c28be.tar.gz";
     sha256 = "07wzbmzp0y8mh59jxg81q17gqagz3psxigxh8dmzsipgg68y6a8r";
   };
-  buildInputs = [ pkg-config SDL2 glew xcftools python pillow vasm makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ pkg-config SDL2 glew xcftools python pillow vasm ];
   preBuild = ''
     patchShebangs img2tiles.py
   '';
diff --git a/pkgs/misc/emulators/mednaffe/default.nix b/pkgs/misc/emulators/mednaffe/default.nix
index 7d0d6c6f68e..8a11b633d28 100644
--- a/pkgs/misc/emulators/mednaffe/default.nix
+++ b/pkgs/misc/emulators/mednaffe/default.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation rec {
   pname = "mednaffe";
-  version = "0.9.0";
+  version = "0.9.1";
 
   src = fetchFromGitHub {
     owner = "AmatCoder";
     repo = "mednaffe";
     rev = version;
-    sha256 = "sha256-BS/GNnRYj9klc4RRj7LwNikgApNttv4IyWPL694j+gM=";
+    sha256 = "sha256-YU8PHnQHAsY90LN/WDugi4WhsuZGBj/z3BS4o69qMS4=";
   };
 
   nativeBuildInputs = [ autoreconfHook pkg-config wrapGAppsHook ];
diff --git a/pkgs/misc/emulators/retroarch/wrapper.nix b/pkgs/misc/emulators/retroarch/wrapper.nix
index 08ebf8ea854..40d9f07846b 100644
--- a/pkgs/misc/emulators/retroarch/wrapper.nix
+++ b/pkgs/misc/emulators/retroarch/wrapper.nix
@@ -4,7 +4,7 @@ stdenv.mkDerivation {
   pname = "retroarch";
   version = lib.getVersion retroarch;
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   buildCommand = ''
     mkdir -p $out/lib
diff --git a/pkgs/misc/jackaudio/default.nix b/pkgs/misc/jackaudio/default.nix
index 24d2b5e135c..9dd97367441 100644
--- a/pkgs/misc/jackaudio/default.nix
+++ b/pkgs/misc/jackaudio/default.nix
@@ -48,6 +48,9 @@ stdenv.mkDerivation rec {
         --replace /bin/bash ${bash}/bin/bash
   '';
 
+  PKGCONFIG = "${stdenv.cc.targetPrefix}pkg-config";
+
+  dontAddWafCrossFlags = "true";
   wafConfigureFlags = [
     "--classic"
     "--autostart=${if (optDbus != null) then "dbus" else "classic"}"
diff --git a/pkgs/misc/lilypond/with-fonts.nix b/pkgs/misc/lilypond/with-fonts.nix
index 2f3a95a3302..47cbb59f2f0 100644
--- a/pkgs/misc/lilypond/with-fonts.nix
+++ b/pkgs/misc/lilypond/with-fonts.nix
@@ -7,7 +7,8 @@ lib.appendToName "with-fonts" (symlinkJoin {
 
   paths = [ lilypond ] ++ openlilylib-fonts.all;
 
-  buildInputs = [ makeWrapper lndir ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ lndir ];
 
   postBuild = ''
     for p in $out/bin/*; do
diff --git a/pkgs/misc/screensavers/pipes/default.nix b/pkgs/misc/screensavers/pipes/default.nix
index 11d85e59776..be605192acc 100644
--- a/pkgs/misc/screensavers/pipes/default.nix
+++ b/pkgs/misc/screensavers/pipes/default.nix
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
     sha256 = "09m4alb3clp3rhnqga5v6070p7n1gmnwp2ssqhq87nf2ipfpcaak";
   };
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   installPhase = ''
     mkdir $out -p
diff --git a/pkgs/os-specific/linux/alsa-plugins/default.nix b/pkgs/os-specific/linux/alsa-plugins/default.nix
index 602d4278183..09dbdbc9b6f 100644
--- a/pkgs/os-specific/linux/alsa-plugins/default.nix
+++ b/pkgs/os-specific/linux/alsa-plugins/default.nix
@@ -15,8 +15,7 @@ stdenv.mkDerivation rec {
   buildInputs =
     [ alsaLib libogg ]
     ++ lib.optional (libpulseaudio != null) libpulseaudio
-    # https://github.com/NixOS/nixpkgs/issues/96548
-    ++ lib.optional (libjack2 != null && (stdenv.buildPlatform == stdenv.hostPlatform)) libjack2;
+    ++ lib.optional (libjack2 != null) libjack2;
 
   meta = with lib; {
     description = "Various plugins for ALSA";
diff --git a/pkgs/os-specific/linux/alsa-utils/default.nix b/pkgs/os-specific/linux/alsa-utils/default.nix
index da365fb7d99..dd747bbbf6f 100644
--- a/pkgs/os-specific/linux/alsa-utils/default.nix
+++ b/pkgs/os-specific/linux/alsa-utils/default.nix
@@ -9,8 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "09m4dnn4kplawprd2bl15nwa0b4r1brab3x44ga7f1fyk7aw5zwq";
   };
 
-  nativeBuildInputs = [ gettext ];
-  buildInputs = [ makeWrapper alsaLib ncurses libsamplerate fftw ];
+  nativeBuildInputs = [ gettext makeWrapper ];
+  buildInputs = [ alsaLib ncurses libsamplerate fftw ];
 
   configureFlags = [ "--disable-xmlto" "--with-udev-rules-dir=$(out)/lib/udev/rules.d" ];
 
diff --git a/pkgs/os-specific/linux/hwdata/default.nix b/pkgs/os-specific/linux/hwdata/default.nix
index 6cee603664d..bd52f37e62f 100644
--- a/pkgs/os-specific/linux/hwdata/default.nix
+++ b/pkgs/os-specific/linux/hwdata/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "hwdata";
-  version = "0.335";
+  version = "0.344";
 
   src = fetchFromGitHub {
     owner = "vcrhonek";
     repo = "hwdata";
     rev = "v${version}";
-    sha256 = "0f8ikwfrs6xd5sywypd9rq9cln8a0rf3vj6nm0adwzn1p8mgmrb2";
+    sha256 = "0rsnm94r814shr86jk6f2323i1n4p58inkgkx7362yz9k4a8ir7a";
   };
 
   preConfigure = "patchShebangs ./configure";
@@ -19,12 +19,12 @@ stdenv.mkDerivation rec {
 
   outputHashMode = "recursive";
   outputHashAlgo = "sha256";
-  outputHash = "101lppd1805drwd038b4njr5czzjnqqxf3xlf6v3l22wfwr2cn3l";
+  outputHash = "011lyldzskfb4sfn4i7qyyq3i4gaf1v9yfbc82889cabka0n4nfz";
 
   meta = {
     homepage = "https://github.com/vcrhonek/hwdata";
     description = "Hardware Database, including Monitors, pci.ids, usb.ids, and video cards";
-    license = lib.licenses.gpl2;
-    platforms = lib.platforms.linux;
+    license = lib.licenses.gpl2Plus;
+    platforms = lib.platforms.all;
   };
 }
diff --git a/pkgs/os-specific/linux/kernel-headers/default.nix b/pkgs/os-specific/linux/kernel-headers/default.nix
index 7a81d9434e3..a2a63e2bcab 100644
--- a/pkgs/os-specific/linux/kernel-headers/default.nix
+++ b/pkgs/os-specific/linux/kernel-headers/default.nix
@@ -69,12 +69,12 @@ let
 in {
   inherit makeLinuxHeaders;
 
-  linuxHeaders = let version = "5.10.9"; in
+  linuxHeaders = let version = "5.11"; in
     makeLinuxHeaders {
       inherit version;
       src = fetchurl {
         url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-        sha256 = "0la7dklpy6xd79fkzavpmlfyrc60kmmwz491msd95dmvv06kwwvz";
+        sha256 = "1d37w0zvmf8c1l99xvy1hy6p55icjhmbsv7f0amxy2nly1a7pw04";
       };
       patches = [
          ./no-relocs.patch # for building x86 kernel headers on non-ELF platforms
diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix
index 186d112e81d..24c992dc907 100644
--- a/pkgs/os-specific/linux/kernel/common-config.nix
+++ b/pkgs/os-specific/linux/kernel/common-config.nix
@@ -252,11 +252,17 @@ let
       DRM_AMDGPU_SI = whenAtLeast "4.9" yes;
       # (stable) amdgpu support for bonaire and newer chipsets
       DRM_AMDGPU_CIK = whenAtLeast "4.9" yes;
-      # amdgpu support for RX6000 series
-      DRM_AMD_DC_DCN3_0 = whenBetween "5.9.12" "5.11" yes;
-      DRM_AMD_DC_DCN = whenAtLeast "5.11" yes;
       # Allow device firmware updates
       DRM_DP_AUX_CHARDEV = whenAtLeast "4.6" yes;
+      # amdgpu display core (DC) support
+      DRM_AMD_DC_DCN1_0 = whenBetween "4.15" "5.6" yes;
+      DRM_AMD_DC_PRE_VEGA = whenBetween "4.15" "4.18" yes;
+      DRM_AMD_DC_DCN2_0 = whenBetween "5.3" "5.6" yes;
+      DRM_AMD_DC_DCN2_1 = whenBetween "5.4" "5.6" yes;
+      DRM_AMD_DC_DCN3_0 = whenBetween "5.9" "5.11" yes;
+      DRM_AMD_DC_DCN = whenAtLeast "5.11" yes;
+      DRM_AMD_DC_HDCP = whenAtLeast "5.5" yes;
+      DRM_AMD_DC_SI = whenAtLeast "5.10" yes;
     } // optionalAttrs (stdenv.hostPlatform.system == "x86_64-linux") {
       # Intel GVT-g graphics virtualization supports 64-bit only
       DRM_I915_GVT = whenAtLeast "4.16" yes;
@@ -640,7 +646,12 @@ let
       XZ_DEC_TEST              = option no;
     };
 
-    criu = optionalAttrs (features.criu or false) ({
+    criu = if (versionAtLeast version "4.19") then {
+      # Unconditionally enabled, because it is required for CRIU and
+      # it provides the kcmp() system call that Mesa depends on.
+      CHECKPOINT_RESTORE  = yes;
+    } else optionalAttrs (features.criu or false) ({
+      # For older kernels, CHECKPOINT_RESTORE is hidden behind EXPERT.
       EXPERT              = yes;
       CHECKPOINT_RESTORE  = yes;
     } // optionalAttrs (features.criu_revert_expert or true) {
diff --git a/pkgs/os-specific/linux/lxcfs/default.nix b/pkgs/os-specific/linux/lxcfs/default.nix
index ab148af72f2..bcc86b72de0 100644
--- a/pkgs/os-specific/linux/lxcfs/default.nix
+++ b/pkgs/os-specific/linux/lxcfs/default.nix
@@ -14,8 +14,8 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-gC1Q+kG/oKfYvuHVKstpRWfL/thsemULrimPrV/eeaI=";
   };
 
-  nativeBuildInputs = [ pkg-config help2man autoreconfHook ];
-  buildInputs = [ fuse makeWrapper ];
+  nativeBuildInputs = [ pkg-config help2man autoreconfHook makeWrapper ];
+  buildInputs = [ fuse ];
 
   preConfigure = lib.optionalString enableDebugBuild ''
     sed -i 's,#AM_CFLAGS += -DDEBUG,AM_CFLAGS += -DDEBUG,' Makefile.am
diff --git a/pkgs/os-specific/linux/musl/default.nix b/pkgs/os-specific/linux/musl/default.nix
index 63d8114ac77..3310692b31d 100644
--- a/pkgs/os-specific/linux/musl/default.nix
+++ b/pkgs/os-specific/linux/musl/default.nix
@@ -16,6 +16,11 @@ let
     sha256 = "14igk6k00bnpfw660qhswagyhvr0gfqg4q55dxvaaq7ikfkrir71";
   };
 
+  stack_chk_fail_local_c = fetchurl {
+    url = "https://git.alpinelinux.org/aports/plain/main/musl/__stack_chk_fail_local.c?h=3.10-stable";
+    sha256 = "1nhkzzy9pklgjcq2yg89d3l18jif331srd3z3vhy5qwxl1spv6i9";
+  };
+
   # iconv tool, implemented by musl author.
   # Original: http://git.etalabs.net/cgit/noxcuse/plain/src/iconv.c?id=02d288d89683e99fd18fe9f54d4e731a6c474a4f
   # We use copy from Alpine which fixes error messages, see:
@@ -87,6 +92,16 @@ stdenv.mkDerivation rec {
 
   NIX_DONT_SET_RPATH = true;
 
+  preBuild = ''
+    ${if (stdenv.targetPlatform.libc == "musl" && stdenv.targetPlatform.isx86_32) then
+    "# the -x c flag is required since the file extension confuses gcc
+    # that detect the file as a linker script.
+    $CC -x c -c ${stack_chk_fail_local_c} -o __stack_chk_fail_local.o
+    $AR r libssp_nonshared.a __stack_chk_fail_local.o"
+      else ""
+    }
+  '';
+
   postInstall = ''
     # Not sure why, but link in all but scsi directory as that's what uclibc/glibc do.
     # Apparently glibc provides scsi itself?
@@ -96,6 +111,13 @@ stdenv.mkDerivation rec {
     $STRIP -S $out/lib/libc.a
     mkdir -p $out/bin
 
+
+    ${if (stdenv.targetPlatform.libc == "musl" && stdenv.targetPlatform.isx86_32) then
+      "install -D libssp_nonshared.a $out/lib/libssp_nonshared.a
+      $STRIP -S $out/lib/libssp_nonshared.a"
+      else ""
+    }
+
     # Create 'ldd' symlink, builtin
     ln -rs $out/lib/libc.so $out/bin/ldd
 
diff --git a/pkgs/os-specific/linux/openvswitch/default.nix b/pkgs/os-specific/linux/openvswitch/default.nix
index f90c7966190..25410553486 100644
--- a/pkgs/os-specific/linux/openvswitch/default.nix
+++ b/pkgs/os-specific/linux/openvswitch/default.nix
@@ -18,8 +18,8 @@ in stdenv.mkDerivation rec {
 
   kernel = optional (_kernel != null) _kernel.dev;
 
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ makeWrapper util-linux openssl libcap_ng pythonEnv
+  nativeBuildInputs = [ pkg-config makeWrapper ];
+  buildInputs = [ util-linux openssl libcap_ng pythonEnv
                   perl procps which ];
 
   configureFlags = [
diff --git a/pkgs/os-specific/linux/openvswitch/lts.nix b/pkgs/os-specific/linux/openvswitch/lts.nix
index ddb5eff9723..f379633e198 100644
--- a/pkgs/os-specific/linux/openvswitch/lts.nix
+++ b/pkgs/os-specific/linux/openvswitch/lts.nix
@@ -19,9 +19,8 @@ in stdenv.mkDerivation rec {
 
   kernel = optional (_kernel != null) _kernel.dev;
 
-  nativeBuildInputs = [ autoconf libtool automake pkg-config  ];
-  buildInputs = [ makeWrapper util-linux openssl libcap_ng python2
-                  perl procps which ];
+  nativeBuildInputs = [ autoconf libtool automake pkg-config makeWrapper ];
+  buildInputs = [ util-linux openssl libcap_ng python2 perl procps which ];
 
   preConfigure = "./boot.sh";
 
diff --git a/pkgs/os-specific/linux/pipework/default.nix b/pkgs/os-specific/linux/pipework/default.nix
index 14d1eb85998..e58b97654af 100644
--- a/pkgs/os-specific/linux/pipework/default.nix
+++ b/pkgs/os-specific/linux/pipework/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation {
     rev = "ae42f1b5fef82b3bc23fe93c95c345e7af65fef3";
     sha256 = "0c342m0bpq6ranr7dsxk9qi5mg3j5aw9wv85ql8gprdb2pz59qy8";
   };
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
   installPhase = ''
     install -D pipework $out/bin/pipework
     wrapProgram $out/bin/pipework --prefix PATH : \
diff --git a/pkgs/os-specific/linux/syslinux/default.nix b/pkgs/os-specific/linux/syslinux/default.nix
index 1b2415dd805..0f69cb13fcd 100644
--- a/pkgs/os-specific/linux/syslinux/default.nix
+++ b/pkgs/os-specific/linux/syslinux/default.nix
@@ -63,8 +63,8 @@ stdenv.mkDerivation {
     touch gnu-efi/inc/ia32/gnu/stubs-32.h
   '';
 
-  nativeBuildInputs = [ nasm perl python3 ];
-  buildInputs = [ libuuid makeWrapper ];
+  nativeBuildInputs = [ nasm perl python3 makeWrapper ];
+  buildInputs = [ libuuid ];
 
   enableParallelBuilding = false; # Fails very rarely with 'No rule to make target: ...'
   hardeningDisable = [ "pic" "stackprotector" "fortify" ];
diff --git a/pkgs/os-specific/linux/systemd/0005-Add-some-NixOS-specific-unit-directories.patch b/pkgs/os-specific/linux/systemd/0005-Add-some-NixOS-specific-unit-directories.patch
index 476ebe06e70..3e40385c3bb 100644
--- a/pkgs/os-specific/linux/systemd/0005-Add-some-NixOS-specific-unit-directories.patch
+++ b/pkgs/os-specific/linux/systemd/0005-Add-some-NixOS-specific-unit-directories.patch
@@ -1,24 +1,23 @@
-From 6ede8baac88aba769030f5bc5f5b2070098c7428 Mon Sep 17 00:00:00 2001
+From 95e4533f1eeb6e0d509f9129d0133f0b849cc3c5 Mon Sep 17 00:00:00 2001
 From: Eelco Dolstra <eelco.dolstra@logicblox.com>
 Date: Fri, 19 Dec 2014 14:46:17 +0100
 Subject: [PATCH 05/18] Add some NixOS-specific unit directories
 
-Look in `/nix/var/nix/profiles/default/lib/systemd` for units provided
-by packages installed into the default profile via
-`nix-env -iA nixos.$package`, and into `/etc/systemd-mutable/system` for
-persistent, mutable units (used for Dysnomia).
+Look in `/nix/var/nix/profiles/default/lib/systemd/{system,user}` for
+units provided by packages installed into the default profile via
+`nix-env -iA nixos.$package`.
 
 Also, remove /usr and /lib as these don't exist on NixOS.
 ---
- src/basic/path-lookup.c | 20 +++++---------------
+ src/basic/path-lookup.c | 17 ++---------------
  src/core/systemd.pc.in  |  5 +++--
- 2 files changed, 8 insertions(+), 17 deletions(-)
+ 2 files changed, 5 insertions(+), 17 deletions(-)
 
 diff --git a/src/basic/path-lookup.c b/src/basic/path-lookup.c
-index 96b82170d0..b9fbed5c61 100644
+index 96b82170d0..bf66bd6b77 100644
 --- a/src/basic/path-lookup.c
 +++ b/src/basic/path-lookup.c
-@@ -94,17 +94,14 @@ int xdg_user_data_dir(char **ret, const char *suffix) {
+@@ -94,11 +94,7 @@ int xdg_user_data_dir(char **ret, const char *suffix) {
  }
  
  static const char* const user_data_unit_paths[] = {
@@ -30,18 +29,10 @@ index 96b82170d0..b9fbed5c61 100644
          NULL
  };
  
- static const char* const user_config_unit_paths[] = {
-         USER_CONFIG_UNIT_DIR,
-         "/etc/systemd/user",
-+        "/etc/systemd-mutable/user",
-         NULL
- };
- 
-@@ -616,15 +613,14 @@ int lookup_paths_init(
+@@ -616,15 +612,13 @@ int lookup_paths_init(
                                          persistent_config,
                                          SYSTEM_CONFIG_UNIT_DIR,
                                          "/etc/systemd/system",
-+                                        "/etc/systemd-mutable/system",
 +                                        "/nix/var/nix/profiles/default/lib/systemd/system",
                                          STRV_IFNOTNULL(persistent_attached),
                                          runtime_config,
@@ -55,11 +46,10 @@ index 96b82170d0..b9fbed5c61 100644
                                          STRV_IFNOTNULL(generator_late));
                          break;
  
-@@ -640,14 +636,12 @@ int lookup_paths_init(
+@@ -640,14 +634,11 @@ int lookup_paths_init(
                                          persistent_config,
                                          USER_CONFIG_UNIT_DIR,
                                          "/etc/systemd/user",
-+                                        "/etc/systemd-mutable/user",
 +                                        "/nix/var/nix/profiles/default/lib/systemd/user",
                                          runtime_config,
                                          "/run/systemd/user",
@@ -72,7 +62,7 @@ index 96b82170d0..b9fbed5c61 100644
                                          STRV_IFNOTNULL(generator_late));
                          break;
  
-@@ -797,7 +791,6 @@ char **generator_binary_paths(UnitFileScope scope) {
+@@ -797,7 +788,6 @@ char **generator_binary_paths(UnitFileScope scope) {
                  case UNIT_FILE_SYSTEM:
                          add = strv_new("/run/systemd/system-generators",
                                         "/etc/systemd/system-generators",
@@ -80,7 +70,7 @@ index 96b82170d0..b9fbed5c61 100644
                                         SYSTEM_GENERATOR_DIR);
                          break;
  
-@@ -805,7 +798,6 @@ char **generator_binary_paths(UnitFileScope scope) {
+@@ -805,7 +795,6 @@ char **generator_binary_paths(UnitFileScope scope) {
                  case UNIT_FILE_USER:
                          add = strv_new("/run/systemd/user-generators",
                                         "/etc/systemd/user-generators",
@@ -88,7 +78,7 @@ index 96b82170d0..b9fbed5c61 100644
                                         USER_GENERATOR_DIR);
                          break;
  
-@@ -844,12 +836,10 @@ char **env_generator_binary_paths(bool is_system) {
+@@ -844,12 +833,10 @@ char **env_generator_binary_paths(bool is_system) {
                  if (is_system)
                          add = strv_new("/run/systemd/system-environment-generators",
                                          "/etc/systemd/system-environment-generators",
@@ -102,7 +92,7 @@ index 96b82170d0..b9fbed5c61 100644
  
                  if (!add)
 diff --git a/src/core/systemd.pc.in b/src/core/systemd.pc.in
-index f2c045511d..ccb382e421 100644
+index f2c045511d..d38a3a0302 100644
 --- a/src/core/systemd.pc.in
 +++ b/src/core/systemd.pc.in
 @@ -38,10 +38,11 @@ systemdsystemconfdir=${systemd_system_conf_dir}
@@ -110,11 +100,11 @@ index f2c045511d..ccb382e421 100644
  systemduserconfdir=${systemd_user_conf_dir}
  
 -systemd_system_unit_path=${systemd_system_conf_dir}:/etc/systemd/system:/run/systemd/system:/usr/local/lib/systemd/system:${systemd_system_unit_dir}:/usr/lib/systemd/system:/lib/systemd/system
-+systemd_system_unit_path=${systemd_system_conf_dir}:/etc/systemd/system:/etc/systemd-mutable/system:/nix/var/nix/profiles/default/lib/systemd/system:/run/systemd/system:${systemdsystemunitdir}
++systemd_system_unit_path=${systemd_system_conf_dir}:/etc/systemd/system:/nix/var/nix/profiles/default/lib/systemd/system:/run/systemd/system:${systemdsystemunitdir}
  systemdsystemunitpath=${systemd_system_unit_path}
  
 -systemd_user_unit_path=${systemd_user_conf_dir}:/etc/systemd/user:/run/systemd/user:/usr/local/lib/systemd/user:/usr/local/share/systemd/user:${systemd_user_unit_dir}:/usr/lib/systemd/user:/usr/share/systemd/user
-+systemd_user_unit_path=${systemd_user_conf_dir}:/etc/systemd/user:/etc/systemd-mutable/user:/nix/var/nix/profiles/default/lib/systemd/user:/run/systemd/user:${systemduserunitdir}
++systemd_user_unit_path=${systemd_user_conf_dir}:/etc/systemd/user:/nix/var/nix/profiles/default/lib/systemd/user:/run/systemd/user:${systemduserunitdir}
 +
  systemduserunitpath=${systemd_user_unit_path}
  
diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index 421fc5986af..7e3c6d1fe51 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -1,3 +1,5 @@
+# NOTE: Make sure to (re-)format this file on changes with `nixpkgs-fmt`!
+
 { stdenv
 , lib
 , fetchFromGitHub
@@ -111,7 +113,7 @@ assert withCryptsetup ->
 let
   wantCurl = withRemote || withImportd;
 
-  version = "247.2";
+  version = "247.3";
 in
 stdenv.mkDerivation {
   inherit version pname;
@@ -122,7 +124,7 @@ stdenv.mkDerivation {
     owner = "systemd";
     repo = "systemd-stable";
     rev = "v${version}";
-    sha256 = "091pwrvxz3gcf80shlp28d6l4gvjzc6pb61v4mwxmk9d71qaq7ry";
+    sha256 = "0zn0b74iwz3vxabqsk4yydwpgky3c5z4dl83wxbs1qi5d2dnbqa7";
   };
 
   # If these need to be regenerated, `git am path/to/00*.patch` them into a
@@ -160,83 +162,87 @@ stdenv.mkDerivation {
       --replace \
       "find_program('objcopy'" \
       "find_program('${stdenv.cc.bintools.targetPrefix}objcopy'"
-  '' + (let
+  '' + (
+    let
+      # The folllowing dlopen patches ensure that all the features that are
+      # implemented via dlopen(3) are available (or explicitly deactivated) by
+      # pointing dlopen to the absolute store path instead of relying on the
+      # linkers runtime lookup code.
+      #
+      # All of the dlopen calls have to be handled. When new ones are introduced
+      # by upstream (or one of our patches) they must be explicitly declared,
+      # otherwise the build will fail.
+      #
+      # As of systemd version 247 we've seen a few errors like `libpcre2.… not
+      # found` when using e.g. --grep with journalctl. Those errors should
+      # become less unexpected now.
+      #
+      # There are generally two classes of dlopen(3) calls. Those that we want to
+      # support and those that should be deactivated / unsupported. This change
+      # enforces that we handle all dlopen calls explicitly. Meaning: There is
+      # not a single dlopen call in the source code tree that we did not
+      # explicitly handle.
+      #
+      # In order to do this we introduced a list of attributes that maps from
+      # shared object name to the package that contains them. The package can be
+      # null meaning the reference should be nuked and the shared object will
+      # never be loadable during runtime (because it points at an invalid store
+      # path location).
+      #
+      # To get a list of dynamically loaded libraries issue something like
+      # `grep -ri 'dlopen("lib' $src` and update the below list.
+      dlopenLibs = [
+        # We did never provide support for libxkbcommon & qrencode
+        { name = "libxkbcommon.so.0"; pkg = null; }
+        { name = "libqrencode.so.4"; pkg = null; }
 
-    # The folllowing dlopen patches ensure that all the features that are
-    # implemented via dlopen(3) are available (or explicitly deactivated) by
-    # pointing dlopen to the absolute store path instead of relying on the
-    # linkers runtime lookup code.
-    #
-    # All of the dlopen calls have to be handled. When new ones are introduced
-    # by upstream (or one of our patches) they must be explicitly declared,
-    # otherwise the build will fail.
-    #
-    # As of systemd version 247 we've seen a few errors like `libpcre2.… not
-    # found` when using e.g. --grep with journalctl. Those errors should
-    # become less unexpected now.
-    #
-    # There are generally two classes of dlopen(3) calls. Those that we want to
-    # support and those that should be deactivated / unsupported. This change
-    # enforces that we handle all dlopen calls explicitly. Meaning: There is
-    # not a single dlopen call in the source code tree that we did not
-    # explicitly handle.
-    #
-    # In order to do this we introduced a list of attributes that maps from
-    # shared object name to the package that contains them. The package can be
-    # null meaning the reference should be nuked and the shared object will
-    # never be loadable during runtime (because it points at an invalid store
-    # path location).
-    #
-    # To get a list of dynamically loaded libraries issue something like
-    # `grep -ri 'dlopen("lib' $src` and update the below list.
-    dlopenLibs = [
-      # We did never provide support for libxkbcommon & qrencode
-      { name = "libxkbcommon.so.0"; pkg = null; }
-      { name = "libqrencode.so.4"; pkg = null; }
+        # We did not provide libpwquality before so it is safe to disable it for
+        # now.
+        { name = "libpwquality.so.1"; pkg = null; }
 
-      # We did not provide libpwquality before so it is safe to disable it for
-      # now.
-      { name = "libpwquality.so.1"; pkg = null; }
+        # Only include cryptsetup if it is enabled. We might not be able to
+        # provide it during "bootstrap" in e.g. the minimal systemd build as
+        # cryptsetup has udev (aka systemd) in it's dependencies.
+        { name = "libcryptsetup.so.12"; pkg = if withCryptsetup then cryptsetup else null; }
 
-      # Only include cryptsetup if it is enabled. We might not be able to
-      # provide it during "bootstrap" in e.g. the minimal systemd build as
-      # cryptsetup has udev (aka systemd) in it's dependencies.
-      { name = "libcryptsetup.so.12"; pkg = if withCryptsetup then cryptsetup else null; }
+        # We are using libidn2 so we only provide that and ignore the others.
+        # Systemd does this decision during configure time and uses ifdef's to
+        # enable specific branches. We can safely ignore (nuke) the libidn "v1"
+        # libraries.
+        { name = "libidn2.so.0"; pkg = libidn2; }
+        { name = "libidn.so.12"; pkg = null; }
+        { name = "libidn.so.11"; pkg = null; }
 
-      # We are using libidn2 so we only provide that and ignore the others.
-      # Systemd does this decision during configure time and uses ifdef's to
-      # enable specific branches. We can safely ignore (nuke) the libidn "v1"
-      # libraries.
-      { name = "libidn2.so.0"; pkg = libidn2; }
-      { name = "libidn.so.12"; pkg = null; }
-      { name = "libidn.so.11"; pkg = null; }
+        # journalctl --grep requires libpcre so lets provide it
+        { name = "libpcre2-8.so.0"; pkg = pcre2; }
+      ];
 
-      # journalctl --grep requires libpcre so lets provide it
-      { name = "libpcre2-8.so.0"; pkg = pcre2; }
-    ];
-
-    patchDlOpen = dl: let
-      library = "${lib.makeLibraryPath [dl.pkg]}/${dl.name}";
-    in if dl.pkg == null then ''
-      # remove the dependency on the library by replacing it with an invalid path
-      for file in $(grep -lr 'dlopen("${dl.name}"' src); do
-        echo "patching dlopen(\"${dl.name}\", …) in $file to an invalid store path ("/nix/store/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee-not-implemented/${dl.name}")…"
-        substituteInPlace "$file" --replace 'dlopen("${dl.name}"' 'dlopen("/nix/store/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee-not-implemented/${dl.name}"'
-      done
-    '' else ''
-      # ensure that the library we provide actually exists
-      if ! [ -e ${library} ]; then
-        echo 'The shared library `${library}` does not exist but was given as subtitute for `${dl.name}`'
-        exit 1
-      fi
-      # make the path to the dependency explicit
-      for file in $(grep -lr 'dlopen("${dl.name}"' src); do
-        echo "patching dlopen(\"${dl.name}\", …) in $file to ${library}…"
-        substituteInPlace "$file" --replace 'dlopen("${dl.name}"' 'dlopen("${library}"'
-      done
-    '';
-  in # patch all the dlopen calls to contain absolute paths to the libraries
-  lib.concatMapStringsSep "\n" patchDlOpen dlopenLibs)
+      patchDlOpen = dl:
+        let
+          library = "${lib.makeLibraryPath [ dl.pkg ]}/${dl.name}";
+        in
+        if dl.pkg == null then ''
+          # remove the dependency on the library by replacing it with an invalid path
+          for file in $(grep -lr 'dlopen("${dl.name}"' src); do
+            echo "patching dlopen(\"${dl.name}\", …) in $file to an invalid store path ("/nix/store/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee-not-implemented/${dl.name}")…"
+            substituteInPlace "$file" --replace 'dlopen("${dl.name}"' 'dlopen("/nix/store/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee-not-implemented/${dl.name}"'
+          done
+        '' else ''
+          # ensure that the library we provide actually exists
+          if ! [ -e ${library} ]; then
+            echo 'The shared library `${library}` does not exist but was given as subtitute for `${dl.name}`'
+            exit 1
+          fi
+          # make the path to the dependency explicit
+          for file in $(grep -lr 'dlopen("${dl.name}"' src); do
+            echo "patching dlopen(\"${dl.name}\", …) in $file to ${library}…"
+            substituteInPlace "$file" --replace 'dlopen("${dl.name}"' 'dlopen("${library}"'
+          done
+        '';
+    in
+    # patch all the dlopen calls to contain absolute paths to the libraries
+    lib.concatMapStringsSep "\n" patchDlOpen dlopenLibs
+  )
   # finally ensure that there are no left-over dlopen calls that we didn't handle
   + ''
     if grep -qr 'dlopen("[^/]' src; then
diff --git a/pkgs/servers/apache-kafka/default.nix b/pkgs/servers/apache-kafka/default.nix
index 826e952376c..4bd50653d52 100644
--- a/pkgs/servers/apache-kafka/default.nix
+++ b/pkgs/servers/apache-kafka/default.nix
@@ -29,7 +29,8 @@ stdenv.mkDerivation rec {
     inherit sha256;
   };
 
-  buildInputs = [ jre makeWrapper bash gnugrep gnused coreutils ps ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ jre bash gnugrep gnused coreutils ps ];
 
   installPhase = ''
     mkdir -p $out
diff --git a/pkgs/servers/confluent-platform/default.nix b/pkgs/servers/confluent-platform/default.nix
index e1cf4909932..4a5846d0116 100644
--- a/pkgs/servers/confluent-platform/default.nix
+++ b/pkgs/servers/confluent-platform/default.nix
@@ -18,7 +18,8 @@ stdenv.mkDerivation rec {
     sha256 = "18yvp56b8l074qfkgr4afirgd43g8b023n9ija6dnk6p6dib1f4j";
   };
 
-  buildInputs = [ jre makeWrapper bash ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ jre bash ];
 
   installPhase = ''
     cp -R $confluentCli confluent-cli
diff --git a/pkgs/servers/exhibitor/default.nix b/pkgs/servers/exhibitor/default.nix
index 0b92aca74c7..5636f51a169 100644
--- a/pkgs/servers/exhibitor/default.nix
+++ b/pkgs/servers/exhibitor/default.nix
@@ -31,8 +31,7 @@ stdenv.mkDerivation rec {
   # (given the state of Maven support in Nix). We're not actually building any java
   # source here.
   pomFileDir = "exhibitor-standalone/src/main/resources/buildscripts/standalone/maven";
-  nativeBuildInputs = [ maven ];
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ maven makeWrapper ];
   buildPhase = ''
       cd ${pomFileDir}
       mvn package --offline -Dmaven.repo.local=$(cp -dpR ${fetchedMavenDeps}/.m2 ./ && chmod +w -R .m2 && pwd)/.m2
diff --git a/pkgs/servers/h2/default.nix b/pkgs/servers/h2/default.nix
index be28578bcb0..d05232193d7 100644
--- a/pkgs/servers/h2/default.nix
+++ b/pkgs/servers/h2/default.nix
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
     sha256 = "0pdvbnx7nqfqs7x1zkwz2q34331l55jknpk6arf6dksvnd71hinj";
   };
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   installPhase =
     let
diff --git a/pkgs/servers/hbase/default.nix b/pkgs/servers/hbase/default.nix
index 09600082633..32d2c09de97 100644
--- a/pkgs/servers/hbase/default.nix
+++ b/pkgs/servers/hbase/default.nix
@@ -8,7 +8,7 @@ stdenv.mkDerivation rec {
     sha256 = "0kz72wqsii09v9hxkw10mzyvjhji5sx3l6aijjalgbybavpcxglb";
   };
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
   installPhase = ''
     mkdir -p $out
     cp -R * $out
diff --git a/pkgs/servers/jetbrains/youtrack.nix b/pkgs/servers/jetbrains/youtrack.nix
index 5aab96d1bc0..c3680d76b96 100644
--- a/pkgs/servers/jetbrains/youtrack.nix
+++ b/pkgs/servers/jetbrains/youtrack.nix
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
     sha256 = "1fnnpyikr1x443vxy6f7vlv550sbahpps8awyn13jpg7kpgfm7lk";
   };
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   dontUnpack = true;
 
diff --git a/pkgs/servers/jitsi-videobridge/default.nix b/pkgs/servers/jitsi-videobridge/default.nix
index 138051e13c0..35cd6906012 100644
--- a/pkgs/servers/jitsi-videobridge/default.nix
+++ b/pkgs/servers/jitsi-videobridge/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation {
 
   unpackCmd = "${dpkg}/bin/dpkg-deb -x $src debcontents";
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   installPhase = ''
     runHook preInstall
diff --git a/pkgs/servers/livepeer/default.nix b/pkgs/servers/livepeer/default.nix
index a016c8e7f09..ad67cdf4348 100644
--- a/pkgs/servers/livepeer/default.nix
+++ b/pkgs/servers/livepeer/default.nix
@@ -4,16 +4,16 @@
 
 buildGoModule rec {
   pname = "livepeer";
-  version = "0.5.13";
+  version = "0.5.14";
 
   runVend = true;
-  vendorSha256 = "sha256-wAjGgYDyBWqE8KCQ6TQ+LGDDZqF+5XY+NzU74RwPuRE=";
+  vendorSha256 = "sha256-StkgU11VLEKg89kn3zPcdC8HBw9MmJrfDPGk1SUQO64=";
 
   src = fetchFromGitHub {
     owner = "livepeer";
     repo = "go-livepeer";
     rev = "v${version}";
-    sha256 = "sha256-b4O8Hc8A8TN5KFcQ7KYvFPVFgposDgPw06WowrXzpAs=";
+    sha256 = "sha256-GxgpGI1ymhbYhzCP2Bs5wJ5kq5rHHkClXcAsYlaQ/AM=";
   };
 
   # livepeer_cli has a vendoring problem
diff --git a/pkgs/servers/mail/mailman/wrapped.nix b/pkgs/servers/mail/mailman/wrapped.nix
index 2a620763d87..c244af10e78 100644
--- a/pkgs/servers/mail/mailman/wrapped.nix
+++ b/pkgs/servers/mail/mailman/wrapped.nix
@@ -8,7 +8,7 @@ in
 
 runCommand "${mailman.name}-wrapped" {
   inherit (mailman) meta;
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
   passthru = mailman.passthru // { unwrapped = mailman; };
 } ''
   mkdir -p "$out/bin"
diff --git a/pkgs/servers/mail/spamassassin/default.nix b/pkgs/servers/mail/spamassassin/default.nix
index ff96f0e7c82..71bcc3fc687 100644
--- a/pkgs/servers/mail/spamassassin/default.nix
+++ b/pkgs/servers/mail/spamassassin/default.nix
@@ -9,7 +9,8 @@ perlPackages.buildPerlPackage rec {
     sha256 = "0ga5mi2nv2v91kakk9xakkg71rnxnddlzv76ca13vfyd4jgcfasf";
   };
 
-  buildInputs = [ makeWrapper ] ++ (with perlPackages; [
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = (with perlPackages; [
     HTMLParser NetCIDRLite NetDNS NetAddrIP DBFile HTTPDate MailDKIM LWP
     IOSocketSSL DBI EncodeDetect IPCountry NetIdent Razor2ClientAgent MailSPF
     NetDNSResolverProgrammable Socket6
diff --git a/pkgs/servers/monitoring/fusion-inventory/default.nix b/pkgs/servers/monitoring/fusion-inventory/default.nix
index 0034c253c77..02841c6acb9 100644
--- a/pkgs/servers/monitoring/fusion-inventory/default.nix
+++ b/pkgs/servers/monitoring/fusion-inventory/default.nix
@@ -24,7 +24,8 @@ perlPackages.buildPerlPackage rec {
   '';
 
   buildTools = [];
-  buildInputs = [ makeWrapper ] ++ (with perlPackages; [
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = (with perlPackages; [
     CGI
     DataStructureUtil
     FileCopyRecursive
diff --git a/pkgs/servers/monitoring/longview/default.nix b/pkgs/servers/monitoring/longview/default.nix
index 96048005cb1..5d05dfd1ebb 100644
--- a/pkgs/servers/monitoring/longview/default.nix
+++ b/pkgs/servers/monitoring/longview/default.nix
@@ -25,7 +25,8 @@ stdenv.mkDerivation rec {
         --replace /etc/linode /run/longview
   '';
 
-  buildInputs = [ perl makeWrapper glibc ]
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ perl glibc ]
     ++ (with perlPackages; [
       LWP
       LWPProtocolHttps
diff --git a/pkgs/servers/monitoring/prometheus/jmx-httpserver.nix b/pkgs/servers/monitoring/prometheus/jmx-httpserver.nix
index 0c5aa7d8a43..e6505857bf5 100644
--- a/pkgs/servers/monitoring/prometheus/jmx-httpserver.nix
+++ b/pkgs/servers/monitoring/prometheus/jmx-httpserver.nix
@@ -14,7 +14,8 @@ in stdenv.mkDerivation {
     sha256 = "1pvqphrirq48xhmx0aa6vkxz6qy1cx2q6jxsh7rin432iap7j62f";
   };
 
-  buildInputs = [ jre makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ jre ];
 
   phases = "installPhase";
 
diff --git a/pkgs/servers/monitoring/seyren/default.nix b/pkgs/servers/monitoring/seyren/default.nix
index 1d26afad3d8..4dd90cacb8b 100644
--- a/pkgs/servers/monitoring/seyren/default.nix
+++ b/pkgs/servers/monitoring/seyren/default.nix
@@ -11,7 +11,8 @@ stdenv.mkDerivation rec {
 
   phases = ["installPhase"];
 
-  buildInputs = [ makeWrapper jre ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ jre ];
 
   installPhase = ''
     mkdir -p "$out"/bin
diff --git a/pkgs/servers/monitoring/uchiwa/default.nix b/pkgs/servers/monitoring/uchiwa/default.nix
index 121b31e46eb..a871bf87db2 100644
--- a/pkgs/servers/monitoring/uchiwa/default.nix
+++ b/pkgs/servers/monitoring/uchiwa/default.nix
@@ -33,7 +33,7 @@ in stdenv.mkDerivation {
 
   inherit src;
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   buildCommand = ''
     mkdir -p $out/bin $out/public
diff --git a/pkgs/servers/monitoring/zipkin/default.nix b/pkgs/servers/monitoring/zipkin/default.nix
index e84c422ea64..9395c3c61c1 100644
--- a/pkgs/servers/monitoring/zipkin/default.nix
+++ b/pkgs/servers/monitoring/zipkin/default.nix
@@ -6,7 +6,7 @@ stdenv.mkDerivation rec {
     url = "https://search.maven.org/remotecontent?filepath=io/zipkin/java/zipkin-server/${version}/zipkin-server-${version}-exec.jar";
     sha256 = "02369fkv0kbl1isq6y26fh2zj5wxv3zck522m5wypsjlcfcw2apa";
   };
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   buildCommand =
   ''
diff --git a/pkgs/servers/nosql/neo4j/default.nix b/pkgs/servers/nosql/neo4j/default.nix
index 684cdbe287c..d9c9ddf8752 100644
--- a/pkgs/servers/nosql/neo4j/default.nix
+++ b/pkgs/servers/nosql/neo4j/default.nix
@@ -11,7 +11,8 @@ stdenv.mkDerivation rec {
     sha256 = "1zjb6cgk2lpzx6pq1cs5fh65in6b5ccpl1cgfiglgpjc948mnhzv";
   };
 
-  buildInputs = [ makeWrapper jre8 which gawk ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ jre8 which gawk ];
 
 
   installPhase = ''
diff --git a/pkgs/servers/nosql/rethinkdb/default.nix b/pkgs/servers/nosql/rethinkdb/default.nix
index 558fdad9841..4c5be92e765 100644
--- a/pkgs/servers/nosql/rethinkdb/default.nix
+++ b/pkgs/servers/nosql/rethinkdb/default.nix
@@ -31,11 +31,11 @@ stdenv.mkDerivation rec {
 
   makeFlags = [ "rethinkdb" ];
 
-  buildInputs = [ protobuf boost zlib curl openssl icu makeWrapper ]
+  buildInputs = [ protobuf boost zlib curl openssl icu ]
     ++ lib.optional (!stdenv.isDarwin) jemalloc
     ++ lib.optional stdenv.isDarwin libtool;
 
-  nativeBuildInputs = [ which m4 python2Packages.python ];
+  nativeBuildInputs = [ which m4 python2Packages.python makeWrapper ];
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/servers/sabnzbd/default.nix b/pkgs/servers/sabnzbd/default.nix
index 5f1f8e6230e..4533e3138a7 100644
--- a/pkgs/servers/sabnzbd/default.nix
+++ b/pkgs/servers/sabnzbd/default.nix
@@ -30,7 +30,8 @@ in stdenv.mkDerivation rec {
     sha256 = "0m39r2il7d014kf2p6v28lw2hzshm6bhhdchqa8wzyvvmygqmwf2";
   };
 
-  buildInputs = [ pythonEnv makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ pythonEnv ];
 
   installPhase = ''
     mkdir -p $out
diff --git a/pkgs/servers/search/elasticsearch/6.x.nix b/pkgs/servers/search/elasticsearch/6.x.nix
index 86230e11cb9..b3ad305687a 100644
--- a/pkgs/servers/search/elasticsearch/6.x.nix
+++ b/pkgs/servers/search/elasticsearch/6.x.nix
@@ -35,7 +35,8 @@ stdenv.mkDerivation (rec {
       "ES_CLASSPATH=\"\$ES_CLASSPATH:$out/\$additional_classpath_directory/*\""
   '';
 
-  buildInputs = [ makeWrapper jre_headless util-linux ]
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ jre_headless util-linux ]
              ++ optional enableUnfree zlib;
 
   installPhase = ''
diff --git a/pkgs/servers/search/elasticsearch/7.x.nix b/pkgs/servers/search/elasticsearch/7.x.nix
index 6a51e5ea62f..ffe8a75412b 100644
--- a/pkgs/servers/search/elasticsearch/7.x.nix
+++ b/pkgs/servers/search/elasticsearch/7.x.nix
@@ -46,7 +46,8 @@ stdenv.mkDerivation (rec {
       "ES_CLASSPATH=\"\$ES_CLASSPATH:$out/\$additional_classpath_directory/*\""
   '';
 
-  buildInputs = [ makeWrapper jre_headless util-linux ]
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ jre_headless util-linux ]
              ++ optional enableUnfree zlib;
 
   installPhase = ''
diff --git a/pkgs/servers/sql/postgresql/default.nix b/pkgs/servers/sql/postgresql/default.nix
index 27345616f89..3dd811b51fa 100644
--- a/pkgs/servers/sql/postgresql/default.nix
+++ b/pkgs/servers/sql/postgresql/default.nix
@@ -35,12 +35,12 @@ let
     setOutputFlags = false; # $out retains configureFlags :-/
 
     buildInputs =
-      [ zlib readline openssl libxml2 makeWrapper ]
+      [ zlib readline openssl libxml2 ]
       ++ lib.optionals icuEnabled [ icu ]
       ++ lib.optionals enableSystemd [ systemd ]
       ++ lib.optionals (!stdenv.isDarwin) [ libossp_uuid ];
 
-    nativeBuildInputs = lib.optionals icuEnabled [ pkg-config ];
+    nativeBuildInputs = [ makeWrapper ] ++ lib.optionals icuEnabled [ pkg-config ];
 
     enableParallelBuilding = !stdenv.isDarwin;
 
@@ -192,54 +192,54 @@ let
 in self: {
 
   postgresql_9_5 = self.callPackage generic {
-    version = "9.5.24";
+    version = "9.5.25";
     psqlSchema = "9.5";
-    sha256 = "0an2k4m1da96897hyxlff8p4p63wg4dffwsfg57aib7mp4yzsp06";
+    sha256 = "00yny0sskxrqk4ji2phgv3iqxd1aiy6rh660k73s4s1pn9gcaa3n";
     this = self.postgresql_9_5;
     thisAttr = "postgresql_9_5";
     inherit self;
   };
 
   postgresql_9_6 = self.callPackage generic {
-    version = "9.6.20";
+    version = "9.6.21";
     psqlSchema = "9.6";
-    sha256 = "1dkv916y7vrfbygrfbfvs6y3fxaysnh32i5j88nvcnnl16jcn21x";
+    sha256 = "0d0ngpadf1i7c0i2psaxcbmiwx8334ibcsn283n9fp4853pyl3wk";
     this = self.postgresql_9_6;
     thisAttr = "postgresql_9_6";
     inherit self;
   };
 
   postgresql_10 = self.callPackage generic {
-    version = "10.15";
+    version = "10.16";
     psqlSchema = "10.0"; # should be 10, but changing it is invasive
-    sha256 = "0zhzj9skag1pgqas2rnd217vj41ilaalqna17j47gyngpvhbqmjr";
+    sha256 = "1cvv8qw0gkkczqhiwx6ns7w88dwkvdz4cvb2d4ff14363f5p2p53";
     this = self.postgresql_10;
     thisAttr = "postgresql_10";
     inherit self;
   };
 
   postgresql_11 = self.callPackage generic {
-    version = "11.10";
+    version = "11.11";
     psqlSchema = "11.1"; # should be 11, but changing it is invasive
-    sha256 = "16bqp6ds37kbwqx7mk5gg3y6gv59wq6xz33iqwxldzk20vwd5rhk";
+    sha256 = "0v0qk298nxmpzpgsxcsxma328hdkyzd7fwjs0zsn6zavl5zpnq20";
     this = self.postgresql_11;
     thisAttr = "postgresql_11";
     inherit self;
   };
 
   postgresql_12 = self.callPackage generic {
-    version = "12.5";
+    version = "12.6";
     psqlSchema = "12";
-    sha256 = "15gzg778da23sbfmy7sqg443f9ny480301lm7i3vay4m3ls2a3dx";
+    sha256 = "028asz92mi3706zabfs8w9z03mzyx62d1l71qy9zdwfabj6xjzfz";
     this = self.postgresql_12;
     thisAttr = "postgresql_12";
     inherit self;
   };
 
   postgresql_13 = self.callPackage generic {
-    version = "13.1";
+    version = "13.2";
     psqlSchema = "13";
-    sha256 = "07z6zwr58dckaa97yl9ml240z83d1lhgaxw9aq49i8lsp21mqd0j";
+    sha256 = "1z5d847jnajcfr3wa6jn52a8xjhamvwzmz18xlm5nvxqip8grmsz";
     this = self.postgresql_13;
     thisAttr = "postgresql_13";
     inherit self;
diff --git a/pkgs/servers/ums/default.nix b/pkgs/servers/ums/default.nix
index 61bb815892a..3d4e4fdf51d 100644
--- a/pkgs/servers/ums/default.nix
+++ b/pkgs/servers/ums/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
    };
   }.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   installPhase = ''
     cp -a . $out/
diff --git a/pkgs/servers/xmpp/ejabberd/default.nix b/pkgs/servers/xmpp/ejabberd/default.nix
index 5336df42cbe..69b55a6f3c2 100644
--- a/pkgs/servers/xmpp/ejabberd/default.nix
+++ b/pkgs/servers/xmpp/ejabberd/default.nix
@@ -32,9 +32,9 @@ in stdenv.mkDerivation rec {
     sha256 = "sha256-nZxdYXRyv4UejPLHNT/p6CrvW22Koo7rZSi96KRjqFQ=";
   };
 
-  nativeBuildInputs = [ fakegit ];
+  nativeBuildInputs = [ fakegit makeWrapper ];
 
-  buildInputs = [ erlang openssl expat libyaml gd makeWrapper ]
+  buildInputs = [ erlang openssl expat libyaml gd ]
     ++ lib.optional withSqlite sqlite
     ++ lib.optional withPam pam
     ++ lib.optional withZlib zlib
diff --git a/pkgs/servers/zookeeper/default.nix b/pkgs/servers/zookeeper/default.nix
index 526a8d2956b..c2315999b3c 100644
--- a/pkgs/servers/zookeeper/default.nix
+++ b/pkgs/servers/zookeeper/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation rec {
     sha512 = "caff5111bb6876b7124760bc006e6fa2523efa54b99321a3c9cd8192ea0d5596abc7d70a054b1aac9b20a411407dae7611c7aba870c23bff28eb1643ba499199";
   };
 
-  buildInputs = [ makeWrapper jre ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ jre ];
 
   phases = ["unpackPhase" "installPhase"];
 
diff --git a/pkgs/shells/liquidprompt/default.nix b/pkgs/shells/liquidprompt/default.nix
index 4463d70cf52..a84e2e14677 100644
--- a/pkgs/shells/liquidprompt/default.nix
+++ b/pkgs/shells/liquidprompt/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "liquidprompt";
-  version = "1.12.1";
+  version = "2.0.0";
 
   src = fetchFromGitHub {
     owner = "nojhan";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0vlwwkdbkxjsjcfmcspmq3f163kf0x4mwa8svxkzgnn2g4kl41ja";
+    sha256 = "sha256-+qNH4Df0wCI3KE6LT3YWKpp7yzJcedmVlm/f1Myz108=";
   };
 
   installPhase = ''
diff --git a/pkgs/tools/X11/run-scaled/default.nix b/pkgs/tools/X11/run-scaled/default.nix
index bae91bbc464..012eedf0779 100644
--- a/pkgs/tools/X11/run-scaled/default.nix
+++ b/pkgs/tools/X11/run-scaled/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation {
     sha256 = "1ma4ax7ydq4xvyzrc4zapihmf7v3d9zl9mbi8bgpps7nlgz544ys";
   };
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   installPhase = ''
     mkdir -p $out/bin
diff --git a/pkgs/tools/X11/xbindkeys-config/default.nix b/pkgs/tools/X11/xbindkeys-config/default.nix
index ec40e0b06db..bdade93329b 100644
--- a/pkgs/tools/X11/xbindkeys-config/default.nix
+++ b/pkgs/tools/X11/xbindkeys-config/default.nix
@@ -4,8 +4,8 @@ stdenv.mkDerivation rec {
   pname = "xbindkeys-config";
   version = "0.1.3";
 
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ gtk makeWrapper ];
+  nativeBuildInputs = [ pkg-config makeWrapper ];
+  buildInputs = [ gtk ];
 
   src = fetchurl {
     url = "mirror://debian/pool/main/x/xbindkeys-config/xbindkeys-config_${version}.orig.tar.gz";
diff --git a/pkgs/tools/X11/xdg-user-dirs/default.nix b/pkgs/tools/X11/xdg-user-dirs/default.nix
index 6d0c46e52e9..207c052686f 100644
--- a/pkgs/tools/X11/xdg-user-dirs/default.nix
+++ b/pkgs/tools/X11/xdg-user-dirs/default.nix
@@ -8,7 +8,8 @@ stdenv.mkDerivation rec {
     sha256 = "13216b8rfkzak5k6bvpx6jvqv3cnbgpijnjwj8a8d3kq4cl0a1ra";
   };
 
-  buildInputs = [ libxslt docbook_xsl makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ libxslt docbook_xsl ];
 
   preFixup = ''
     # fallback values need to be last
diff --git a/pkgs/tools/archivers/unp/default.nix b/pkgs/tools/archivers/unp/default.nix
index 34f8cb1c40e..c63ec008d67 100644
--- a/pkgs/tools/archivers/unp/default.nix
+++ b/pkgs/tools/archivers/unp/default.nix
@@ -10,7 +10,8 @@ let
 in stdenv.mkDerivation {
   pname = "unp";
   version = "2.0-pre7";
-  buildInputs = [ perl makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ perl ];
 
   src = fetchurl {
     # url = "http://http.debian.net/debian/pool/main/u/unp/unp_2.0~pre7+nmu1.tar.bz2";
diff --git a/pkgs/tools/backup/diskrsync/default.nix b/pkgs/tools/backup/diskrsync/default.nix
index 3b5d901daf0..97870d5dedd 100644
--- a/pkgs/tools/backup/diskrsync/default.nix
+++ b/pkgs/tools/backup/diskrsync/default.nix
@@ -14,7 +14,7 @@ buildGoPackage rec {
   goPackagePath = "github.com/dop251/diskrsync";
   goDeps = ./deps.nix;
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   preFixup = ''
     wrapProgram "$out/bin/diskrsync" --argv0 diskrsync --prefix PATH : ${openssh}/bin
diff --git a/pkgs/tools/backup/duplicati/default.nix b/pkgs/tools/backup/duplicati/default.nix
index 5330ca60a4d..2d9124d6f51 100644
--- a/pkgs/tools/backup/duplicati/default.nix
+++ b/pkgs/tools/backup/duplicati/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
     stripRoot = false;
   };
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   installPhase = ''
     mkdir -p $out/{bin,share/${pname}-${version}}
diff --git a/pkgs/tools/backup/duply/default.nix b/pkgs/tools/backup/duply/default.nix
index 15ac5acbe84..82d6bd5c601 100644
--- a/pkgs/tools/backup/duply/default.nix
+++ b/pkgs/tools/backup/duply/default.nix
@@ -11,7 +11,8 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-I1KkblFnZVOCvcWEarGsSXnzlod2+yZ4okaTpckLFbE=";
   };
 
-  buildInputs = [ txt2man makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ txt2man ];
 
   postPatch = "patchShebangs .";
 
diff --git a/pkgs/tools/backup/store-backup/default.nix b/pkgs/tools/backup/store-backup/default.nix
index d0ca5324cab..026a3141fed 100644
--- a/pkgs/tools/backup/store-backup/default.nix
+++ b/pkgs/tools/backup/store-backup/default.nix
@@ -20,7 +20,8 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  buildInputs = [ perl makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ perl ];
 
   src = fetchurl {
     url = "https://download.savannah.gnu.org/releases/storebackup/storeBackup-${version}.tar.bz2";
diff --git a/pkgs/tools/filesystems/btrfs-progs/default.nix b/pkgs/tools/filesystems/btrfs-progs/default.nix
index ec9cd7ca61a..c55c1bc1c5d 100644
--- a/pkgs/tools/filesystems/btrfs-progs/default.nix
+++ b/pkgs/tools/filesystems/btrfs-progs/default.nix
@@ -4,11 +4,11 @@
 
 stdenv.mkDerivation rec {
   pname = "btrfs-progs";
-  version = "5.10";
+  version = "5.10.1";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/people/kdave/btrfs-progs/btrfs-progs-v${version}.tar.xz";
-    sha256 = "sha256-5xoNbdUE86XZV/zpowKB62Hs+ZHIrzFf4AYaG5eh0CE=";
+    sha256 = "sha256-E3nMcx/q5/RzrZ43yEW7+4czge9ns0Dxoi+8qaTaA0Q=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/filesystems/fuse-7z-ng/default.nix b/pkgs/tools/filesystems/fuse-7z-ng/default.nix
index aaffc70e10d..8a0671957c3 100644
--- a/pkgs/tools/filesystems/fuse-7z-ng/default.nix
+++ b/pkgs/tools/filesystems/fuse-7z-ng/default.nix
@@ -11,8 +11,8 @@ stdenv.mkDerivation rec {
     sha256 = "17v1gcmg5q661b047zxjar735i4d3508dimw1x3z1pk4d1zjhp3x";
   };
 
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ fuse autoconf automake makeWrapper ];
+  nativeBuildInputs = [ pkg-config makeWrapper ];
+  buildInputs = [ fuse autoconf automake ];
 
   preConfigure = "./autogen.sh";
 
diff --git a/pkgs/tools/filesystems/rmount/default.nix b/pkgs/tools/filesystems/rmount/default.nix
index 96d950e74ff..1d8ced17aae 100644
--- a/pkgs/tools/filesystems/rmount/default.nix
+++ b/pkgs/tools/filesystems/rmount/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
     sha256 = "0j1ayncw1nnmgna7vyx44vwinh4ah1b0l5y8agc7i4s8clbvy3h0";
   };
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   installPhase = ''
     install -D ${src}/rmount.man  $out/share/man/man1/rmount.1
diff --git a/pkgs/tools/filesystems/xtreemfs/default.nix b/pkgs/tools/filesystems/xtreemfs/default.nix
index d8d41450079..9c49c4677d2 100644
--- a/pkgs/tools/filesystems/xtreemfs/default.nix
+++ b/pkgs/tools/filesystems/xtreemfs/default.nix
@@ -13,7 +13,8 @@ stdenv.mkDerivation {
   pname = "XtreemFS";
   version = "1.5.1.81";
 
-  buildInputs = [ which attr makeWrapper python ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ which attr python ];
 
   patches = [
     (fetchpatch {
diff --git a/pkgs/tools/graphics/diagrams-builder/default.nix b/pkgs/tools/graphics/diagrams-builder/default.nix
index 3422b9a53bd..9337d5cca23 100644
--- a/pkgs/tools/graphics/diagrams-builder/default.nix
+++ b/pkgs/tools/graphics/diagrams-builder/default.nix
@@ -33,7 +33,7 @@ in
 stdenv.mkDerivation {
   name = "diagrams-builder";
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   buildCommand = with lib;
     concatStrings (intersperse "\n" (map exeWrapper backends));
diff --git a/pkgs/tools/graphics/fgallery/default.nix b/pkgs/tools/graphics/fgallery/default.nix
index 40308ffa1a9..865e0f141ff 100644
--- a/pkgs/tools/graphics/fgallery/default.nix
+++ b/pkgs/tools/graphics/fgallery/default.nix
@@ -16,7 +16,8 @@ stdenv.mkDerivation rec {
     sha256 = "18wlvqbxcng8pawimbc8f2422s8fnk840hfr6946lzsxr0ijakvf";
   };
 
-  buildInputs = [ unzip makeWrapper ] ++ (with perlPackages; [ perl ImageExifTool CpanelJSONXS ]);
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ unzip ] ++ (with perlPackages; [ perl ImageExifTool CpanelJSONXS ]);
 
   installPhase = ''
     mkdir -p "$out/bin"
diff --git a/pkgs/tools/graphics/icoutils/default.nix b/pkgs/tools/graphics/icoutils/default.nix
index 704c3a2db52..9fe41d91db2 100644
--- a/pkgs/tools/graphics/icoutils/default.nix
+++ b/pkgs/tools/graphics/icoutils/default.nix
@@ -8,7 +8,8 @@ stdenv.mkDerivation rec {
     sha256 = "1q66cksms4l62y0wizb8vfavhmf7kyfgcfkynil3n99s0hny1aqp";
   };
 
-  buildInputs = [ makeWrapper libpng perl ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ libpng perl ];
   propagatedBuildInputs = [ perlPackages.LWP ];
 
   patchPhase = ''
diff --git a/pkgs/tools/graphics/pdfread/default.nix b/pkgs/tools/graphics/pdfread/default.nix
index abe560c81fe..6201b2d5888 100644
--- a/pkgs/tools/graphics/pdfread/default.nix
+++ b/pkgs/tools/graphics/pdfread/default.nix
@@ -13,7 +13,8 @@ stdenv.mkDerivation {
     sha256 = "0mzxpnk97f0ww5ds7h4wsval3g4lnrhv6rhspjs7cy4i41gmk8an";
   };
 
-  buildInputs = [ unzip python makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ unzip python ];
 
   broken = true; # Not found.
 
diff --git a/pkgs/tools/graphics/structure-synth/default.nix b/pkgs/tools/graphics/structure-synth/default.nix
index ec2cb359a5e..a4772cad3c4 100644
--- a/pkgs/tools/graphics/structure-synth/default.nix
+++ b/pkgs/tools/graphics/structure-synth/default.nix
@@ -10,8 +10,8 @@ stdenv.mkDerivation {
     sha256 = "1kiammx46719az6jzrav8yrwz82nk4m72ybj0kpbnvp9wfl3swbb";
   };
 
-  buildInputs = [ qt4 unzip libGLU makeWrapper ];
-  nativeBuildInputs = [ qmake4Hook ];
+  buildInputs = [ qt4 unzip libGLU ];
+  nativeBuildInputs = [ qmake4Hook makeWrapper ];
 
   # Thanks to https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=672000#15:
   patches = [ ./gcc47.patch ];
diff --git a/pkgs/tools/graphics/welkin/default.nix b/pkgs/tools/graphics/welkin/default.nix
index 53e7378bd3b..2f9c43373bb 100644
--- a/pkgs/tools/graphics/welkin/default.nix
+++ b/pkgs/tools/graphics/welkin/default.nix
@@ -12,7 +12,8 @@ stdenv.mkDerivation rec {
 
   sourceRoot = "welkin-r9638/tags/${version}";
 
-  buildInputs = [ jre makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ jre ];
 
   installPhase = ''
     mkdir -p $out/{bin,share}
diff --git a/pkgs/tools/inputmethods/fcitx5/with-addons.nix b/pkgs/tools/inputmethods/fcitx5/with-addons.nix
index 17501d5f362..020e829f098 100644
--- a/pkgs/tools/inputmethods/fcitx5/with-addons.nix
+++ b/pkgs/tools/inputmethods/fcitx5/with-addons.nix
@@ -5,7 +5,7 @@ symlinkJoin {
 
   paths = [ fcitx5 fcitx5-configtool fcitx5-lua fcitx5-qt fcitx5-gtk ] ++ addons;
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   postBuild = ''
     wrapProgram $out/bin/fcitx5 \
diff --git a/pkgs/tools/misc/0x0/default.nix b/pkgs/tools/misc/0x0/default.nix
index e0f84329b89..39cfcefaee8 100644
--- a/pkgs/tools/misc/0x0/default.nix
+++ b/pkgs/tools/misc/0x0/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation {
     sha256 = "1qpylyxrisy3p2lyirfarfj5yzrdjgsgxwf8gqwljpcjn207hr72";
   };
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   installPhase = ''
     install -Dm755 0x0 $out/bin/0x0
diff --git a/pkgs/tools/misc/arp-scan/default.nix b/pkgs/tools/misc/arp-scan/default.nix
index e25543b5145..720b0a875a8 100644
--- a/pkgs/tools/misc/arp-scan/default.nix
+++ b/pkgs/tools/misc/arp-scan/default.nix
@@ -18,8 +18,8 @@ stdenv.mkDerivation rec {
     URI
   ];
 
-  nativeBuildInputs = [ autoreconfHook ];
-  buildInputs = [ perlPackages.perl libpcap makeWrapper ];
+  nativeBuildInputs = [ autoreconfHook makeWrapper ];
+  buildInputs = [ perlPackages.perl libpcap ];
 
   postInstall = ''
     for name in get-{oui,iab}; do
diff --git a/pkgs/tools/misc/bc/default.nix b/pkgs/tools/misc/bc/default.nix
index 96c2d00ffa8..bb5ed84e7d7 100644
--- a/pkgs/tools/misc/bc/default.nix
+++ b/pkgs/tools/misc/bc/default.nix
@@ -3,9 +3,10 @@
 }:
 
 stdenv.mkDerivation rec {
-  name = "bc-1.07.1";
+  pname = "bc";
+  version = "1.07.1";
   src = fetchurl {
-    url = "mirror://gnu/bc/${name}.tar.gz";
+    url = "mirror://gnu/bc/${pname}-${version}.tar.gz";
     sha256 = "62adfca89b0a1c0164c2cdca59ca210c1d44c3ffc46daf9931cf4942664cb02a";
   };
 
@@ -30,10 +31,10 @@ stdenv.mkDerivation rec {
   # masss-rebuild.
   strictDeps = true;
 
-  meta = {
+  meta = with lib; {
     description = "GNU software calculator";
     homepage = "https://www.gnu.org/software/bc/";
-    license = lib.licenses.gpl3;
-    platforms = lib.platforms.all;
+    license = licenses.gpl3Plus;
+    platforms = platforms.all;
   };
 }
diff --git a/pkgs/tools/misc/byobu/default.nix b/pkgs/tools/misc/byobu/default.nix
index c647d3b3902..ffe3fd0fe16 100644
--- a/pkgs/tools/misc/byobu/default.nix
+++ b/pkgs/tools/misc/byobu/default.nix
@@ -16,7 +16,8 @@ stdenv.mkDerivation rec {
 
   doCheck = true;
 
-  buildInputs = [ perl makeWrapper gettext ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ perl gettext ];
   propagatedBuildInputs = [ textual-window-manager screen ];
 
   postPatch = ''
diff --git a/pkgs/tools/misc/capture/default.nix b/pkgs/tools/misc/capture/default.nix
index d0e6c167349..d858e0fbc46 100644
--- a/pkgs/tools/misc/capture/default.nix
+++ b/pkgs/tools/misc/capture/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation {
     sha256 = "0zyyg4mvrny7cc2xgvfip97b6yc75ka5ni39rwls93971jbk83d6";
   };
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   installPhase = ''
     install -Dm755 src/capture.sh $out/bin/capture
diff --git a/pkgs/tools/misc/cloc/default.nix b/pkgs/tools/misc/cloc/default.nix
index f518c1b8e3f..3e18d3f4b54 100644
--- a/pkgs/tools/misc/cloc/default.nix
+++ b/pkgs/tools/misc/cloc/default.nix
@@ -15,9 +15,8 @@ stdenv.mkDerivation rec {
     sourceRoot=$(echo */Unix)
   '';
 
-  buildInputs = [ makeWrapper ] ++ (with perlPackages; [
-    perl AlgorithmDiff ParallelForkManager RegexpCommon
-  ]);
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = (with perlPackages; [ perl AlgorithmDiff ParallelForkManager RegexpCommon ]);
 
   makeFlags = [ "prefix=" "DESTDIR=$(out)" "INSTALL=install" ];
 
diff --git a/pkgs/tools/misc/debian-devscripts/default.nix b/pkgs/tools/misc/debian-devscripts/default.nix
index 8de7cc99336..cbeede0cc30 100644
--- a/pkgs/tools/misc/debian-devscripts/default.nix
+++ b/pkgs/tools/misc/debian-devscripts/default.nix
@@ -16,7 +16,8 @@ in stdenv.mkDerivation rec {
     sha256 = "0xy1nvqrnifx46g8ch69pk31by0va6hn10wpi1fkrsrgncanjjh1";
   };
 
-  buildInputs = [ unzip xz dpkg libxslt python setuptools makeWrapper curl gnupg diffutils ] ++
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ unzip xz dpkg libxslt python setuptools curl gnupg diffutils ] ++
     (with perlPackages; [ perl CryptSSLeay LWP TimeDate DBFile FileDesktopEntry ParseDebControl LWPProtocolHttps ]);
 
   preConfigure = ''
diff --git a/pkgs/tools/misc/graylog/default.nix b/pkgs/tools/misc/graylog/default.nix
index 5be309be582..8ebb2924b03 100644
--- a/pkgs/tools/misc/graylog/default.nix
+++ b/pkgs/tools/misc/graylog/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
   dontBuild = true;
   dontStrip = true;
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
   makeWrapperArgs = [ "--prefix" "PATH" ":" "${jre_headless}/bin" ];
 
   passthru.tests = { inherit (nixosTests) graylog; };
diff --git a/pkgs/tools/misc/hdf4/default.nix b/pkgs/tools/misc/hdf4/default.nix
index d127bc25c3c..5373c64d647 100644
--- a/pkgs/tools/misc/hdf4/default.nix
+++ b/pkgs/tools/misc/hdf4/default.nix
@@ -4,11 +4,15 @@
 , fixDarwinDylibNames
 , cmake
 , libjpeg
+, uselibtirpc ? stdenv.isLinux
 , libtirpc
 , zlib
 , szip ? null
+, javaSupport ? false
+, jdk
 }:
-let uselibtirpc = stdenv.isLinux;
+let
+  javabase = "${jdk}/jre/lib/${jdk.architecture}";
 in
 stdenv.mkDerivation rec {
   pname = "hdf";
@@ -52,9 +56,9 @@ stdenv.mkDerivation rec {
     libjpeg
     szip
     zlib
-  ] ++ lib.optionals uselibtirpc [
-    libtirpc
-  ];
+  ]
+  ++ lib.optional javaSupport jdk
+  ++ lib.optional uselibtirpc libtirpc;
 
   preConfigure = lib.optionalString uselibtirpc ''
     # Make tirpc discovery work with CMAKE_PREFIX_PATH
@@ -75,6 +79,11 @@ stdenv.mkDerivation rec {
     "-DHDF4_ENABLE_Z_LIB_SUPPORT=ON"
     "-DHDF4_BUILD_FORTRAN=OFF"
     "-DJPEG_DIR=${libjpeg}"
+  ] ++ lib.optionals javaSupport [
+    "-DHDF4_BUILD_JAVA=ON"
+    "-DJAVA_HOME=${jdk}"
+    "-DJAVA_AWT_LIBRARY=${javabase}/libawt.so"
+    "-DJAVA_JVM_LIBRARY=${javabase}/server/libjvm.so"
   ] ++ lib.optionals (szip != null) [
     "-DHDF4_ENABLE_SZIP_ENCODING=ON"
     "-DHDF4_ENABLE_SZIP_SUPPORT=ON"
diff --git a/pkgs/tools/misc/hdf5/default.nix b/pkgs/tools/misc/hdf5/default.nix
index fc7bb635040..e97a6dbdd18 100644
--- a/pkgs/tools/misc/hdf5/default.nix
+++ b/pkgs/tools/misc/hdf5/default.nix
@@ -8,6 +8,8 @@
 , mpiSupport ? false
 , mpi
 , enableShared ? !stdenv.hostPlatform.isStatic
+, javaSupport ? false
+, jdk
 }:
 
 # cpp and mpi options are mutually exclusive
@@ -17,11 +19,11 @@ assert !cpp || !mpiSupport;
 let inherit (lib) optional optionals; in
 
 stdenv.mkDerivation rec {
-  version = "1.10.6";
+  version = "1.10.7";
   pname = "hdf5";
   src = fetchurl {
     url = "https://support.hdfgroup.org/ftp/HDF5/releases/hdf5-1.10/${pname}-${version}/src/${pname}-${version}.tar.bz2";
-    sha256 = "1gf38x51128hn00744358w27xgzjk0ff4wra4yxh2lk804ck1mh9";
+    sha256 = "0pm5xxry55i0h7wmvc7svzdaa90rnk7h78rrjmnlkz2ygsn8y082";
   };
 
   passthru = {
@@ -35,7 +37,8 @@ stdenv.mkDerivation rec {
 
   buildInputs = []
     ++ optional (gfortran != null) gfortran
-    ++ optional (szip != null) szip;
+    ++ optional (szip != null) szip
+    ++ optional javaSupport jdk;
 
   propagatedBuildInputs = []
     ++ optional (zlib != null) zlib
@@ -46,7 +49,8 @@ stdenv.mkDerivation rec {
     ++ optional (gfortran != null) "--enable-fortran"
     ++ optional (szip != null) "--with-szlib=${szip}"
     ++ optionals mpiSupport ["--enable-parallel" "CC=${mpi}/bin/mpicc"]
-    ++ optional enableShared "--enable-shared";
+    ++ optional enableShared "--enable-shared"
+    ++ optional javaSupport "--enable-java";
 
   patches = [
     ./bin-mv.patch
diff --git a/pkgs/tools/misc/hdfjava/default.nix b/pkgs/tools/misc/hdfjava/default.nix
deleted file mode 100644
index 70a2f091116..00000000000
--- a/pkgs/tools/misc/hdfjava/default.nix
+++ /dev/null
@@ -1,27 +0,0 @@
-{ lib, stdenv, fetchurl, cmake, javac }:
-
-stdenv.mkDerivation rec {
-  pname = "hdf-java";
-  version = "3.3.2";
-
-  src = fetchurl {
-    url = "http://www.hdfgroup.org/ftp/HDF5/releases/HDF-JAVA/hdfjni-${version}/src/CMake-hdfjava-${version}.tar.gz";
-    sha256 = "0m1gp2aspcblqzmpqbdpfp6giskws85ds6p5gz8sx7asyp7wznpr";
-  };
-
-  nativeBuildInputs = [ cmake javac ];
-
-  dontConfigure = true;
-  buildPhase = "./build-hdfjava-unix.sh";
-  installPhase = ''
-    mkdir -p $out
-    cp -r build/_CPack_Packages/Linux/TGZ/HDFJava-3.3.2-Linux/HDF_Group/HDFJava/${version}/* $out/
-  '';
-
-  meta = {
-    description = "A Java package that implements HDF4 and HDF5 data objects in an object-oriented form";
-    license = lib.licenses.free; # BSD-like
-    homepage = "https://support.hdfgroup.org/products/java/index.html";
-    platforms = lib.platforms.linux;
-  };
-}
diff --git a/pkgs/tools/misc/hdfview/default.nix b/pkgs/tools/misc/hdfview/default.nix
index dc13bb52791..8537e5748c3 100644
--- a/pkgs/tools/misc/hdfview/default.nix
+++ b/pkgs/tools/misc/hdfview/default.nix
@@ -1,39 +1,58 @@
-{ lib, stdenv, fetchurl, ant, javac, hdf_java }:
+{ lib, stdenv, fetchurl, ant, jdk, nettools, hdf4, hdf5, makeDesktopItem, copyDesktopItems }:
 
 stdenv.mkDerivation rec {
   pname = "hdfview";
-  version = "2.14";
+  version = "3.1.2";
 
   src = fetchurl {
-    url = "https://support.hdfgroup.org/ftp/HDF5/hdf-java/current/src/${pname}-${version}.tar.gz";
-    sha256 = "0lv9djfm7hnp14mcyzbiax3xjb8vkbzhh7bdl6cvgy53pc08784p";
+    url = "https://support.hdfgroup.org/ftp/HDF5/releases/HDF-JAVA/${pname}-${version}/src/${pname}-${version}.tar.gz";
+    sha256 = "0kyw9i3f817z71l0ak7shl0wqxasz9h5fl05mklyapa7cj27637c";
   };
 
-  nativeBuildInputs = [ ant javac ];
+  nativeBuildInputs = [
+    ant jdk
+    nettools  # "hostname" required
+    copyDesktopItems
+  ];
 
-  HDFLIBS = hdf_java;
+  HDFLIBS = (hdf4.override { javaSupport = true; }).out;
+  HDF5LIBS = (hdf5.override { javaSupport = true; }).out;
 
   buildPhase = ''
-    ant run
-    ant package
+    runHook preBuild
+
+    ant createJPackage
+
+    runHook postBuild
   '';
 
+  desktopItem = makeDesktopItem rec {
+    name = "HDFView";
+    desktopName = name;
+    exec = name;
+    icon = name;
+    comment = meta.description;
+    categories = "Science;DataVisualization;";
+  };
+
   installPhase = ''
-    mkdir $out
-    # exclude jre
-    cp -r build/HDF_Group/HDFView/*/{lib,share} $out/
-    mkdir $out/bin
-    cp -r build/HDF_Group/HDFView/*/hdfview.sh $out/bin/hdfview
-    chmod +x $out/bin/hdfview
-    substituteInPlace $out/bin/hdfview \
-      --replace "@JAVABIN@" "${javac}/bin/" \
-      --replace "@INSTALLDIR@" "$out"
+    runHook preInstall
+
+    mkdir -p $out/bin $out/lib
+    cp -a build/dist/HDFView/bin/HDFView $out/bin/
+    cp -a build/dist/HDFView/lib/app $out/lib/
+    ln -s ${jdk}/lib/openjdk $out/lib/runtime
+
+    mkdir -p $out/share/applications $out/share/icons/hicolor/32x32/apps
+    cp src/HDFView.png $out/share/icons/hicolor/32x32/apps/
+
+    runHook postInstall
   '';
 
   meta = {
     description = "A visual tool for browsing and editing HDF4 and HDF5 files";
     license = lib.licenses.free; # BSD-like
-    homepage = "https://support.hdfgroup.org/products/java/index.html";
+    homepage = "https://portal.hdfgroup.org/display/HDFVIEW/HDFView";
     platforms = lib.platforms.linux;
   };
 }
diff --git a/pkgs/tools/misc/ix/default.nix b/pkgs/tools/misc/ix/default.nix
index ed47e477854..83d8a770419 100644
--- a/pkgs/tools/misc/ix/default.nix
+++ b/pkgs/tools/misc/ix/default.nix
@@ -9,7 +9,7 @@ stdenv.mkDerivation {
     sha256 =  "0xc2s4s1aq143zz8lgkq5k25dpf049dw253qxiav5k7d7qvzzy57";
   };
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   phases = [ "installPhase" "fixupPhase" ];
 
diff --git a/pkgs/tools/misc/keychain/default.nix b/pkgs/tools/misc/keychain/default.nix
index 49b3ffbb7dd..61abb3eee10 100644
--- a/pkgs/tools/misc/keychain/default.nix
+++ b/pkgs/tools/misc/keychain/default.nix
@@ -12,7 +12,8 @@ stdenv.mkDerivation rec {
     sha256 = "1bkjlg0a2bbdjhwp37ci1rwikvrl4s3xlbf2jq2z4azc96dr83mj";
   };
 
-  buildInputs = [ makeWrapper perl ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ perl ];
 
   installPhase = ''
     mkdir -p $out/{bin,share/man/man1}
diff --git a/pkgs/tools/misc/lbdb/default.nix b/pkgs/tools/misc/lbdb/default.nix
index d33cdbacb15..fd8b805743a 100644
--- a/pkgs/tools/misc/lbdb/default.nix
+++ b/pkgs/tools/misc/lbdb/default.nix
@@ -19,7 +19,8 @@ stdenv.mkDerivation {
     sha256 = "1gr5l2fr9qbdccga8bhsrpvz6jxigvfkdxrln9wyf2xpps5cdjxh";
   };
 
-  buildInputs = [ goobook makeWrapper perl ConvertASN1 perlldap AuthenSASL ]
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ goobook perl ConvertASN1 perlldap AuthenSASL ]
     ++ optional (!stdenv.isDarwin) finger_bsd
     ++ optional   (abook != null) abook
     ++ optional   (gnupg != null) gnupg
diff --git a/pkgs/tools/misc/man-db/default.nix b/pkgs/tools/misc/man-db/default.nix
index 44cb6962b8e..4ac11aa62c1 100644
--- a/pkgs/tools/misc/man-db/default.nix
+++ b/pkgs/tools/misc/man-db/default.nix
@@ -1,11 +1,11 @@
 { lib, stdenv, fetchurl, pkg-config, libpipeline, db, groff, libiconv, makeWrapper, buildPackages }:
 
 stdenv.mkDerivation rec {
-  name = "man-db-2.9.3";
+  name = "man-db-2.9.4";
 
   src = fetchurl {
     url = "mirror://savannah/man-db/${name}.tar.xz";
-    sha256 = "1f4palf5bdyf3f8sa0981cqxn9cjcr2pz53ngrrsybb9n0da2nps";
+    sha256 = "sha256-tmyZ7frRatkoyIn4fPdjgCY8FgkyPCgLOp5pY/2xZ1Y=";
   };
 
   outputs = [ "out" "doc" ];
diff --git a/pkgs/tools/misc/moreutils/default.nix b/pkgs/tools/misc/moreutils/default.nix
index 05149fb7a3f..5a1452007af 100644
--- a/pkgs/tools/misc/moreutils/default.nix
+++ b/pkgs/tools/misc/moreutils/default.nix
@@ -15,7 +15,8 @@ stdenv.mkDerivation rec {
     substituteInPlace Makefile --replace /usr/share/xml/docbook/stylesheet/docbook-xsl ${docbook-xsl}/xml/xsl/docbook
   '';
 
-  buildInputs = [ libxml2 libxslt docbook-xsl docbook_xml_dtd_44 makeWrapper ]
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ libxml2 libxslt docbook-xsl docbook_xml_dtd_44 ]
     ++ optional stdenv.isDarwin darwin.cctools;
 
   propagatedBuildInputs = with perlPackages; [ perl IPCRun TimeDate TimeDuration ];
diff --git a/pkgs/tools/misc/ocz-ssd-guru/default.nix b/pkgs/tools/misc/ocz-ssd-guru/default.nix
index c5ac32af3be..0c021591e5e 100644
--- a/pkgs/tools/misc/ocz-ssd-guru/default.nix
+++ b/pkgs/tools/misc/ocz-ssd-guru/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
     sha256 = "0ri7qmpc1xpy12lpzl6k298c641wcibcwrzz8jn75wdg4rr176r5";
   };
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   libPath = lib.makeLibraryPath [
       xorg.libX11
diff --git a/pkgs/tools/misc/opentsdb/default.nix b/pkgs/tools/misc/opentsdb/default.nix
index 168eda1cf3d..678c2607b61 100644
--- a/pkgs/tools/misc/opentsdb/default.nix
+++ b/pkgs/tools/misc/opentsdb/default.nix
@@ -13,7 +13,8 @@ stdenv.mkDerivation rec {
     sha256 = "0b0hilqmgz6n1q7irp17h48v8fjpxhjapgw1py8kyav1d51s7mm2";
   };
 
-  buildInputs = [ autoconf automake curl jdk makeWrapper nettools python git ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ autoconf automake curl jdk nettools python git ];
 
   preConfigure = ''
     patchShebangs ./build-aux/
diff --git a/pkgs/tools/misc/os-prober/default.nix b/pkgs/tools/misc/os-prober/default.nix
index 07279400fc4..bc5dbe4672e 100644
--- a/pkgs/tools/misc/os-prober/default.nix
+++ b/pkgs/tools/misc/os-prober/default.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-mfv1b40n/opXdyj6IXWVf/32sWlS+/DbXIRwE1zX4KM=";
   };
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
   installPhase = ''
     # executables
     install -Dt $out/bin os-prober linux-boot-prober
diff --git a/pkgs/tools/misc/parted/default.nix b/pkgs/tools/misc/parted/default.nix
index 7c7a611b97c..e954bfbe5e4 100644
--- a/pkgs/tools/misc/parted/default.nix
+++ b/pkgs/tools/misc/parted/default.nix
@@ -15,11 +15,11 @@
 }:
 
 stdenv.mkDerivation rec {
-  name = "parted-3.3";
+  name = "parted-3.4";
 
   src = fetchurl {
     url = "mirror://gnu/parted/${name}.tar.xz";
-    sha256 = "0i1xp367wpqw75b20c3jnism3dg3yqj4a7a22p2jb1h1hyyv9qjp";
+    sha256 = "sha256-4SmAIkctpVibfyvh1e48G2bsPZbfutA9xkKv0AnaU0I=";
   };
 
   outputs = [ "out" "dev" "man" "info" ];
diff --git a/pkgs/tools/misc/pb_cli/default.nix b/pkgs/tools/misc/pb_cli/default.nix
index eacbc0d6bd2..48b819d5bfd 100644
--- a/pkgs/tools/misc/pb_cli/default.nix
+++ b/pkgs/tools/misc/pb_cli/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
     sha256 = "0w6a789zffvz4ixsb92q45n5s4xyx7s2l2f07972i3dajaaai8z7";
   };
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   liveDeps = [ jq curl ] ++ lib.optional screenshots maim
                          ++ lib.optional video capture
diff --git a/pkgs/tools/misc/pk2cmd/default.nix b/pkgs/tools/misc/pk2cmd/default.nix
index 7ffbd8ded1c..009d841bf55 100644
--- a/pkgs/tools/misc/pk2cmd/default.nix
+++ b/pkgs/tools/misc/pk2cmd/default.nix
@@ -16,7 +16,8 @@ stdenv.mkDerivation {
     wrapProgram $out/bin/pk2cmd --prefix PATH : $out/share/pk2
   '';
 
-  buildInputs = [ libusb-compat-0_1 makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ libusb-compat-0_1 ];
 
   meta = {
     homepage = "https://www.microchip.com/pickit2";
diff --git a/pkgs/tools/misc/plowshare/default.nix b/pkgs/tools/misc/plowshare/default.nix
index d9c208510fc..0b5005b9c82 100644
--- a/pkgs/tools/misc/plowshare/default.nix
+++ b/pkgs/tools/misc/plowshare/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
     sha256 = "1p8s60dlzaldp006yj710s371aan915asyjhd99188vrj4jj1x79";
   };
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   phases = [ "unpackPhase" "installPhase" "fixupPhase" ];
 
diff --git a/pkgs/tools/misc/ponysay/default.nix b/pkgs/tools/misc/ponysay/default.nix
index b94ca6cfea3..113c2b05ff5 100644
--- a/pkgs/tools/misc/ponysay/default.nix
+++ b/pkgs/tools/misc/ponysay/default.nix
@@ -8,7 +8,8 @@ stdenv.mkDerivation {
     sha256 = "12mjabf5cpp5dgg63s19rlyq3dhhpzzy2sa439yncqzsk7rdg0n3";
   };
 
-  buildInputs = [ python3 texinfo makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ python3 texinfo  ];
 
   inherit python3;
 
diff --git a/pkgs/tools/misc/profile-cleaner/default.nix b/pkgs/tools/misc/profile-cleaner/default.nix
index c8a2b338817..77f865a6a16 100644
--- a/pkgs/tools/misc/profile-cleaner/default.nix
+++ b/pkgs/tools/misc/profile-cleaner/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     sha256 = "11sjf4j9dr6ih9jkg6vqq6gkfg6wly4182bi1008bsm1zdmm5iz7";
   };
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   installPhase = ''
     PREFIX=\"\" DESTDIR=$out make install
diff --git a/pkgs/tools/misc/pws/default.nix b/pkgs/tools/misc/pws/default.nix
index 0edec63c8c9..e98323b75ee 100644
--- a/pkgs/tools/misc/pws/default.nix
+++ b/pkgs/tools/misc/pws/default.nix
@@ -3,7 +3,7 @@
 stdenv.mkDerivation rec {
   name = "pws-${(import ./gemset.nix).pws.version}";
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   phases = ["installPhase"];
 
diff --git a/pkgs/tools/misc/svtplay-dl/default.nix b/pkgs/tools/misc/svtplay-dl/default.nix
index 423135d53fd..1cfc039273e 100644
--- a/pkgs/tools/misc/svtplay-dl/default.nix
+++ b/pkgs/tools/misc/svtplay-dl/default.nix
@@ -18,8 +18,8 @@ in stdenv.mkDerivation rec {
   };
 
   pythonPaths = [ pycrypto pyyaml requests ];
-  buildInputs = [ python perl nose mock makeWrapper python-dateutil setuptools ] ++ pythonPaths;
-  nativeBuildInputs = [ gitMinimal zip ];
+  buildInputs = [ python perl nose mock python-dateutil setuptools ] ++ pythonPaths;
+  nativeBuildInputs = [ gitMinimal zip makeWrapper ];
 
   postPatch = ''
     substituteInPlace scripts/run-tests.sh \
diff --git a/pkgs/tools/misc/tmux-cssh/default.nix b/pkgs/tools/misc/tmux-cssh/default.nix
index f3f53627956..830c365fa40 100644
--- a/pkgs/tools/misc/tmux-cssh/default.nix
+++ b/pkgs/tools/misc/tmux-cssh/default.nix
@@ -10,7 +10,7 @@ stdenv.mkDerivation {
     sha256 = "473e27f3b69864b905d1340d97917cd202705c761611eb3aec4c24521f69b52c";
   };
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   installPhase = ''
     mkdir -p $out/bin
diff --git a/pkgs/tools/misc/xvfb-run/default.nix b/pkgs/tools/misc/xvfb-run/default.nix
index a0392bf4754..05750b962f0 100644
--- a/pkgs/tools/misc/xvfb-run/default.nix
+++ b/pkgs/tools/misc/xvfb-run/default.nix
@@ -10,7 +10,7 @@ let
 in
 stdenv.mkDerivation {
   name = "xvfb-run";
-  buildInputs = [makeWrapper];
+  nativeBuildInputs = [ makeWrapper ];
   buildCommand = ''
     mkdir -p $out/bin
     cp ${xvfb_run} $out/bin/xvfb-run
diff --git a/pkgs/tools/networking/airfield/default.nix b/pkgs/tools/networking/airfield/default.nix
index 0976a764a6f..374a76871cb 100644
--- a/pkgs/tools/networking/airfield/default.nix
+++ b/pkgs/tools/networking/airfield/default.nix
@@ -42,7 +42,8 @@ let
 in stdenv.mkDerivation {
   inherit name version src;
 
-  buildInputs = [ makeWrapper nodejs ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ nodejs ];
 
   dontBuild = true;
 
diff --git a/pkgs/tools/networking/atftp/default.nix b/pkgs/tools/networking/atftp/default.nix
index 0038a5e2e7f..0e76cb94346 100644
--- a/pkgs/tools/networking/atftp/default.nix
+++ b/pkgs/tools/networking/atftp/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-08nNDZcd/Hhtel9AVcNdTmaq/IECrANHPvIlvfftsmo=";
   };
 
-  buildInputs = [ readline tcp_wrappers pcre makeWrapper gcc ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ readline tcp_wrappers pcre gcc ];
 
   # Expects pre-GCC5 inline semantics
   NIX_CFLAGS_COMPILE = "-std=gnu89";
diff --git a/pkgs/tools/networking/carddav-util/default.nix b/pkgs/tools/networking/carddav-util/default.nix
index 39728f7e9a0..112a95eccc6 100644
--- a/pkgs/tools/networking/carddav-util/default.nix
+++ b/pkgs/tools/networking/carddav-util/default.nix
@@ -10,7 +10,7 @@ stdenv.mkDerivation {
     sha256 = "0f0raffdy032wlnxfck6ky60r163nhqfbr311y4ry55l60s4497n";
   };
 
-  buildInputs = [makeWrapper];
+  nativeBuildInputs = [ makeWrapper ];
 
   propagatedBuildInputs = with pythonPackages; [ requests vobject lxml ];
 
diff --git a/pkgs/tools/networking/dhcp/default.nix b/pkgs/tools/networking/dhcp/default.nix
index c56ba5a4a66..751dd2c8c1f 100644
--- a/pkgs/tools/networking/dhcp/default.nix
+++ b/pkgs/tools/networking/dhcp/default.nix
@@ -20,9 +20,9 @@ stdenv.mkDerivation rec {
       ./set-hostname.patch
     ];
 
-  nativeBuildInputs = [ perl ];
+  nativeBuildInputs = [ perl makeWrapper ];
 
-  buildInputs = [ makeWrapper openldap ];
+  buildInputs = [ openldap ];
 
   depsBuildBuild = [ buildPackages.stdenv.cc ];
 
diff --git a/pkgs/tools/networking/dnsmasq/default.nix b/pkgs/tools/networking/dnsmasq/default.nix
index d92408b3669..d8f4285e0b8 100644
--- a/pkgs/tools/networking/dnsmasq/default.nix
+++ b/pkgs/tools/networking/dnsmasq/default.nix
@@ -13,11 +13,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "dnsmasq";
-  version = "2.83";
+  version = "2.84";
 
   src = fetchurl {
     url = "http://www.thekelleys.org.uk/dnsmasq/${pname}-${version}.tar.xz";
-    sha256 = "1sjamz1v588qf35m8z6wcqkjk5w12bqhj7d7p48dj8jyn3lgghgz";
+    sha256 = "sha256-YDGVxktzE3YJsH4QJK4LN/ZSsvX+Rn3OZphbPRhQBQw=";
   };
 
   postPatch = lib.optionalString stdenv.hostPlatform.isLinux ''
diff --git a/pkgs/tools/networking/mosh/default.nix b/pkgs/tools/networking/mosh/default.nix
index 5ddbf24bb6a..92c241967ae 100644
--- a/pkgs/tools/networking/mosh/default.nix
+++ b/pkgs/tools/networking/mosh/default.nix
@@ -11,8 +11,8 @@ stdenv.mkDerivation rec {
     sha256 = "05hjhlp6lk8yjcy59zywpf0r6s0h0b9zxq0lw66dh9x8vxrhaq6s";
   };
 
-  nativeBuildInputs = [ autoreconfHook pkg-config ];
-  buildInputs = [ protobuf ncurses zlib makeWrapper openssl bash-completion ]
+  nativeBuildInputs = [ autoreconfHook pkg-config makeWrapper ];
+  buildInputs = [ protobuf ncurses zlib openssl bash-completion ]
     ++ (with perlPackages; [ perl IOTty ])
     ++ lib.optional withUtempter libutempter;
 
diff --git a/pkgs/tools/networking/openresolv/default.nix b/pkgs/tools/networking/openresolv/default.nix
index bc7db4fc6f3..f486c903c5d 100644
--- a/pkgs/tools/networking/openresolv/default.nix
+++ b/pkgs/tools/networking/openresolv/default.nix
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-QrMFCOhXoihTXGMeqsk2hi2G7KaMFLXAvzh7oXa5G5c=";
   };
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   configurePhase =
     ''
diff --git a/pkgs/tools/networking/openvpn/openvpn_learnaddress.nix b/pkgs/tools/networking/openvpn/openvpn_learnaddress.nix
index 16e97bab214..2120679fef3 100644
--- a/pkgs/tools/networking/openvpn/openvpn_learnaddress.nix
+++ b/pkgs/tools/networking/openvpn/openvpn_learnaddress.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation {
     sha256 = "16pcyvyhwsx34i0cjkkx906lmrwdd9gvznvqdwlad4ha8l8f8z42";
   };
 
-  buildInputs = [ makeWrapper coreutils gawk util-linux ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ coreutils gawk util-linux ];
 
   installPhase = ''
     install -Dm555 ovpn-learnaddress $out/libexec/openvpn/openvpn-learnaddress
diff --git a/pkgs/tools/networking/snabb/default.nix b/pkgs/tools/networking/snabb/default.nix
index f65f97ed91d..9ee01439653 100644
--- a/pkgs/tools/networking/snabb/default.nix
+++ b/pkgs/tools/networking/snabb/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
     sha256 = "1sas9d9kk92mc2wrwgmm0xxz7ycmh388dwvyxf1hy183yvin1nac";
   };
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   NIX_CFLAGS_COMPILE = [ "-Wno-error=stringop-truncation" ];
 
diff --git a/pkgs/tools/networking/swaks/default.nix b/pkgs/tools/networking/swaks/default.nix
index fb822177725..49ef0afc060 100644
--- a/pkgs/tools/networking/swaks/default.nix
+++ b/pkgs/tools/networking/swaks/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "0c2sx4nrh4whsqzj6m5ay8d7yqan3aqgg436p8jb25bs91ykn2pv";
   };
 
-  buildInputs = [ perl makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ perl ];
 
   installPhase = ''
     mkdir -p $out/bin
diff --git a/pkgs/tools/networking/swec/default.nix b/pkgs/tools/networking/swec/default.nix
index 71fea1c2e83..c98a3417d1c 100644
--- a/pkgs/tools/networking/swec/default.nix
+++ b/pkgs/tools/networking/swec/default.nix
@@ -8,7 +8,8 @@ stdenv.mkDerivation rec {
     sha256 = "1m3971z4z1wr0paggprfz0n8ng8vsnkc9m6s3bdplgyz7qjk6jwx";
   };
 
-  buildInputs = [ makeWrapper perlPackages.perl perlPackages.LWP perlPackages.URI perlPackages.HTMLParser ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ perlPackages.perl perlPackages.LWP perlPackages.URI perlPackages.HTMLParser ];
   checkInputs = [ perlPackages.HTTPServerSimple perlPackages.Parent ];
 
   configurePhase = ''
diff --git a/pkgs/tools/networking/telepresence/default.nix b/pkgs/tools/networking/telepresence/default.nix
index a077ddb3de4..5d1966114b7 100644
--- a/pkgs/tools/networking/telepresence/default.nix
+++ b/pkgs/tools/networking/telepresence/default.nix
@@ -31,7 +31,7 @@ in pythonPackages.buildPythonPackage rec {
     sha256 = "6V0sM0Z+2xNDgL0wIzJOdaUp2Ol4ejNTk9K/pllVa7g=";
   };
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   postInstall = ''
     wrapProgram $out/bin/telepresence \
diff --git a/pkgs/tools/networking/vpnc/default.nix b/pkgs/tools/networking/vpnc/default.nix
index a754e7e9937..edb50559fc0 100644
--- a/pkgs/tools/networking/vpnc/default.nix
+++ b/pkgs/tools/networking/vpnc/default.nix
@@ -19,7 +19,8 @@ stdenv.mkDerivation {
   # `ifconfig' as found in net-tools (not GNU Inetutils).
   propagatedBuildInputs = [ nettools ];
 
-  buildInputs = [libgcrypt perl makeWrapper openssl ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [libgcrypt perl openssl ];
 
   preConfigure = ''
     sed -i 's|^#OPENSSL|OPENSSL|g' Makefile
diff --git a/pkgs/tools/package-management/nix-bundle/default.nix b/pkgs/tools/package-management/nix-bundle/default.nix
index 41ce0967b2e..7b52f2585f3 100644
--- a/pkgs/tools/package-management/nix-bundle/default.nix
+++ b/pkgs/tools/package-management/nix-bundle/default.nix
@@ -11,8 +11,10 @@ stdenv.mkDerivation rec {
     sha256 = "0hdvdjm467w37clkhbifn54hbdmnxlbk66cj88lwaz26j4s2ik5g";
   };
 
+  nativeBuildInputs = [ makeWrapper ];
+
   # coreutils, gnutar is actually needed by nix for bootstrap
-  buildInputs = [ nix coreutils makeWrapper gnutar gzip bzip2 ];
+  buildInputs = [ nix coreutils gnutar gzip bzip2 ];
 
   binPath = lib.makeBinPath [ nix coreutils gnutar gzip bzip2 ];
 
diff --git a/pkgs/tools/package-management/nix-pin/default.nix b/pkgs/tools/package-management/nix-pin/default.nix
index 0e4005022ff..4dc0098316c 100644
--- a/pkgs/tools/package-management/nix-pin/default.nix
+++ b/pkgs/tools/package-management/nix-pin/default.nix
@@ -9,7 +9,8 @@ let self = stdenv.mkDerivation rec {
     rev = "version-${version}";
     sha256 = "1pccvc0iqapms7kidrh09g5fdx44x622r5l9k7bkmssp3v4c68vy";
   };
-  buildInputs = [ python3 mypy makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ python3 mypy ];
   checkPhase = ''
     mypy bin/*
   '';
diff --git a/pkgs/tools/security/ecryptfs/default.nix b/pkgs/tools/security/ecryptfs/default.nix
index 569b83feb9a..cd90342738e 100644
--- a/pkgs/tools/security/ecryptfs/default.nix
+++ b/pkgs/tools/security/ecryptfs/default.nix
@@ -35,11 +35,11 @@ stdenv.mkDerivation rec {
 
   configureFlags = lib.optionals (!enablePython) [ "--disable-pywrap" ];
 
-  nativeBuildInputs = [ pkg-config ]
+  nativeBuildInputs = [ pkg-config makeWrapper ]
   # if python2 support is requested, it is needed at builtime as well as runtime.
   ++ lib.optionals (enablePython) [ python2 ]
   ;
-  buildInputs = [ perl nss nspr pam intltool makeWrapper ]
+  buildInputs = [ perl nss nspr pam intltool ]
   ++ lib.optionals (enablePython) [ python2 ]
   ;
   propagatedBuildInputs = [ coreutils gettext cryptsetup lvm2 rsync keyutils which ];
diff --git a/pkgs/tools/security/ecryptfs/helper.nix b/pkgs/tools/security/ecryptfs/helper.nix
index ecd12a2738d..bd558b7ab66 100644
--- a/pkgs/tools/security/ecryptfs/helper.nix
+++ b/pkgs/tools/security/ecryptfs/helper.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation {
 
   phases = [ "installPhase" ];
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   # Do not hardcode PATH to ${ecryptfs} as we need the script to invoke executables from /run/wrappers/bin
   installPhase = ''
diff --git a/pkgs/tools/security/enpass/default.nix b/pkgs/tools/security/enpass/default.nix
index 7e2c0fcdb33..107bf56cf82 100644
--- a/pkgs/tools/security/enpass/default.nix
+++ b/pkgs/tools/security/enpass/default.nix
@@ -59,7 +59,8 @@ let
       maintainers = with maintainers; [ ewok ];
     };
 
-    buildInputs = [makeWrapper dpkg];
+    nativeBuildInputs = [ makeWrapper ];
+    buildInputs = [dpkg];
     phases = [ "unpackPhase" "installPhase" ];
 
     unpackPhase = "dpkg -X $src .";
diff --git a/pkgs/tools/security/gen-oath-safe/default.nix b/pkgs/tools/security/gen-oath-safe/default.nix
index 20ee69eeaea..19e5f16924a 100644
--- a/pkgs/tools/security/gen-oath-safe/default.nix
+++ b/pkgs/tools/security/gen-oath-safe/default.nix
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
     sha256 = "1914z0jgj7lni0nf3hslkjgkv87mhxdr92cmhmbzhpjgjgr23ydp";
   };
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   dontBuild = true;
 
diff --git a/pkgs/tools/security/ipscan/default.nix b/pkgs/tools/security/ipscan/default.nix
index a5b0fe8d928..d1c56beb081 100644
--- a/pkgs/tools/security/ipscan/default.nix
+++ b/pkgs/tools/security/ipscan/default.nix
@@ -12,7 +12,8 @@ stdenv.mkDerivation rec {
   sourceRoot = ".";
   unpackCmd = "${dpkg}/bin/dpkg-deb -x $src .";
 
-  buildInputs = [ makeWrapper jdk ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ jdk ];
 
   installPhase = ''
     mkdir -p $out/share
diff --git a/pkgs/tools/security/kpcli/default.nix b/pkgs/tools/security/kpcli/default.nix
index d0e260bb677..37af42e33cc 100644
--- a/pkgs/tools/security/kpcli/default.nix
+++ b/pkgs/tools/security/kpcli/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "1srd6vrqgjlf906zdyxp4bg6gihkxn62cpzyfv0zzpsqsj13iwh1";
   };
 
-  buildInputs = [ makeWrapper perl ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ perl ];
 
   phases = [ "installPhase" "fixupPhase" ];
 
diff --git a/pkgs/tools/security/metasploit/default.nix b/pkgs/tools/security/metasploit/default.nix
index 619cc9c3192..f2358d1f80d 100644
--- a/pkgs/tools/security/metasploit/default.nix
+++ b/pkgs/tools/security/metasploit/default.nix
@@ -17,7 +17,7 @@ in stdenv.mkDerivation rec {
     sha256 = "sha256-DD/nFbSNs3nVNe+W+5zAmDlvMCseYuWWpKX9Dp+9Etc=";
   };
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   dontPatchELF = true; # stay away from exploit executables
 
diff --git a/pkgs/tools/security/open-ecard/default.nix b/pkgs/tools/security/open-ecard/default.nix
index c46d5b65cd8..5c07add9056 100644
--- a/pkgs/tools/security/open-ecard/default.nix
+++ b/pkgs/tools/security/open-ecard/default.nix
@@ -25,7 +25,7 @@ in stdenv.mkDerivation rec {
 
   phases = "installPhase";
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   desktopItem = makeDesktopItem {
     name = appName;
diff --git a/pkgs/tools/security/pass/rofi-pass.nix b/pkgs/tools/security/pass/rofi-pass.nix
index b6547deb560..3b5aedf81a8 100644
--- a/pkgs/tools/security/pass/rofi-pass.nix
+++ b/pkgs/tools/security/pass/rofi-pass.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
     sha256 = "131jpcwyyzgzjn9lx4k1zn95pd68pjw4i41jfzcp9z9fnazyln5n";
   };
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   dontBuild = true;
 
diff --git a/pkgs/tools/security/pcsclite/default.nix b/pkgs/tools/security/pcsclite/default.nix
index 1d874a16da6..3d966c575cf 100644
--- a/pkgs/tools/security/pcsclite/default.nix
+++ b/pkgs/tools/security/pcsclite/default.nix
@@ -3,13 +3,13 @@
 
 stdenv.mkDerivation rec {
   pname = "pcsclite";
-  version = "1.9.0";
+  version = "1.9.1";
 
   outputs = [ "bin" "out" "dev" "doc" "man" ];
 
   src = fetchurl {
     url = "https://pcsclite.apdu.fr/files/pcsc-lite-${version}.tar.bz2";
-    sha256 = "1y9f9zipnrmgiw0mxrvcgky8vfrcmg6zh40gbln5a93i2c1x8j01";
+    sha256 = "sha256-c8R4m3h2qDOnD0k82iFlXf6FaJ2bfilwHCQyduVeaDo=";
   };
 
   patches = [ ./no-dropdir-literals.patch ];
diff --git a/pkgs/tools/security/rage/default.nix b/pkgs/tools/security/rage/default.nix
index 3724637c604..d248fb19a27 100644
--- a/pkgs/tools/security/rage/default.nix
+++ b/pkgs/tools/security/rage/default.nix
@@ -3,16 +3,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "rage";
-  version = "0.5.0";
+  version = "0.5.1";
 
   src = fetchFromGitHub {
     owner = "str4d";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-XSDfAsXfwSoe5JMdJtZlC324Sra+4fVJhE3/k2TthEc=";
+    sha256 = "sha256-oYCARqG5YwKO0b73aEMLr/xzXl6xBEMCvE1HMCtMq20=";
   };
 
-  cargoSha256 = "sha256-GPr5zxeODAjD+ynp/nned9gZUiReYcdzosuEbLIKZSs=";
+  cargoSha256 = "sha256-vadXIdqfmol4thHIwpkQCn7HsXdxo0l+6CBm3QIJmeA=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/tools/security/rhash/default.nix b/pkgs/tools/security/rhash/default.nix
index f4cc65f5d8e..c602ec622cd 100644
--- a/pkgs/tools/security/rhash/default.nix
+++ b/pkgs/tools/security/rhash/default.nix
@@ -1,14 +1,14 @@
 { lib, stdenv, fetchFromGitHub, which }:
 
 stdenv.mkDerivation rec {
-  version = "1.4.0";
+  version = "1.4.1";
   pname = "rhash";
 
   src = fetchFromGitHub {
     owner = "rhash";
     repo = "RHash";
     rev = "v${version}";
-    sha256 = "18zgr1bjzz8v6rckz2q2hx9f2ssbv8qfwclzpbyjaz0c1c9lqqar";
+    sha256 = "sha256-kmi1FtJYPBUdMfJlzEsQkTwcYB99isP3yzH1EYlk54g=";
   };
 
   nativeBuildInputs = [ which ];
diff --git a/pkgs/tools/system/bpytop/default.nix b/pkgs/tools/system/bpytop/default.nix
index 6c0143a34b6..9a010153960 100644
--- a/pkgs/tools/system/bpytop/default.nix
+++ b/pkgs/tools/system/bpytop/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-ds+N0z7Vfw7xv+nE8RIfFjel81mJgIo1u1KspOHLxKc=";
   };
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
   propagatedBuildInputs = with python3Packages; [ python psutil ];
 
   dontBuild = true;
diff --git a/pkgs/tools/system/inxi/default.nix b/pkgs/tools/system/inxi/default.nix
index b941c5f7275..1cceb5b009c 100644
--- a/pkgs/tools/system/inxi/default.nix
+++ b/pkgs/tools/system/inxi/default.nix
@@ -31,7 +31,8 @@ in stdenv.mkDerivation rec {
     sha256 = "sha256-wY9wsxBByxqy9qk/7UoKiUSpFGS1rFpdyTs3ig6OJRs=";
   };
 
-  buildInputs = [ perl makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ perl ];
 
   installPhase = ''
     mkdir -p $out/bin
diff --git a/pkgs/tools/system/pciutils/default.nix b/pkgs/tools/system/pciutils/default.nix
index 20a96311176..8c017c42d7a 100644
--- a/pkgs/tools/system/pciutils/default.nix
+++ b/pkgs/tools/system/pciutils/default.nix
@@ -1,4 +1,5 @@
 { lib, stdenv, fetchurl, pkg-config, zlib, kmod, which
+, hwdata
 , static ? stdenv.hostPlatform.isStatic
 , IOKit
 }:
@@ -30,8 +31,15 @@ stdenv.mkDerivation rec {
 
   installTargets = [ "install" "install-lib" ];
 
-  # Get rid of update-pciids as it won't work.
-  postInstall = "rm $out/sbin/update-pciids $out/man/man8/update-pciids.8";
+  postInstall = ''
+    # Remove update-pciids as it won't work on nixos
+    rm $out/sbin/update-pciids $out/man/man8/update-pciids.8
+
+    # use database from hwdata instead
+    # (we don't create a symbolic link because we do not want to pull in the
+    # full closure of hwdata)
+    cp --reflink=auto ${hwdata}/share/hwdata/pci.ids $out/share/pci.ids
+  '';
 
   meta = with lib; {
     homepage = "http://mj.ucw.cz/pciutils.html";
diff --git a/pkgs/tools/system/rofi-systemd/default.nix b/pkgs/tools/system/rofi-systemd/default.nix
index 4a2e14edc91..f64a84c5509 100644
--- a/pkgs/tools/system/rofi-systemd/default.nix
+++ b/pkgs/tools/system/rofi-systemd/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
     sha256 = "0lgffb6rk1kf91j4j303lzpx8w2g9zy2gk99p8g8pk62a30c5asm";
   };
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   dontBuild = true;
 
diff --git a/pkgs/tools/text/jsawk/default.nix b/pkgs/tools/text/jsawk/default.nix
index e700d7c486e..951f236d04a 100644
--- a/pkgs/tools/text/jsawk/default.nix
+++ b/pkgs/tools/text/jsawk/default.nix
@@ -10,7 +10,7 @@ stdenv.mkDerivation {
     sha256 = "0z3vdr3c8nvdrrxkjv9b4xg47mdb2hsknxpimw6shgwbigihapyr";
   };
   dontBuild = true;
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
   installPhase = ''
     mkdir -p $out/bin
     cp $src/jsawk $out/bin/
diff --git a/pkgs/tools/text/popfile/default.nix b/pkgs/tools/text/popfile/default.nix
index ef945235a90..e2f5952077f 100644
--- a/pkgs/tools/text/popfile/default.nix
+++ b/pkgs/tools/text/popfile/default.nix
@@ -12,7 +12,8 @@ stdenv.mkDerivation rec {
     stripRoot = false;
   };
 
-  buildInputs = [ makeWrapper ] ++ (with perlPackages; [
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = (with perlPackages; [
     ## These are all taken from the popfile documentation as applicable to Linux
     ## http://getpopfile.org/docs/howtos:allplatformsrequireperl
     perl
diff --git a/pkgs/tools/text/reckon/default.nix b/pkgs/tools/text/reckon/default.nix
index bbefa94637d..b37928fc7c5 100644
--- a/pkgs/tools/text/reckon/default.nix
+++ b/pkgs/tools/text/reckon/default.nix
@@ -6,7 +6,7 @@ stdenv.mkDerivation rec {
 
   phases = [ "installPhase" ];
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   installPhase = let
     env = bundlerEnv {
diff --git a/pkgs/tools/text/unoconv/default.nix b/pkgs/tools/text/unoconv/default.nix
index 97a3b4d725e..9f3375c7e41 100644
--- a/pkgs/tools/text/unoconv/default.nix
+++ b/pkgs/tools/text/unoconv/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
     sha256 = "1akx64686in8j8arl6vsgp2n3bv770q48pfv283c6fz6wf9p8fvr";
   };
 
-  buildInputs = [ asciidoc makeWrapper ];
+  nativeBuildInputs = [ asciidoc makeWrapper ];
 
   preBuild = ''
     makeFlags=prefix="$out"
diff --git a/pkgs/tools/typesetting/docbook2odf/default.nix b/pkgs/tools/typesetting/docbook2odf/default.nix
index 91d8f6f8d32..affa12c4019 100644
--- a/pkgs/tools/typesetting/docbook2odf/default.nix
+++ b/pkgs/tools/typesetting/docbook2odf/default.nix
@@ -8,7 +8,8 @@ stdenv.mkDerivation rec {
     sha256 = "10k44g0qqa37k30pfj8vz95j6zdzz0nmnqjq1lyahfs2h4glzgwb";
   };
 
-  buildInputs = [ perlPackages.perl makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ perlPackages.perl ];
 
   installPhase = ''
     mkdir -p "$out/bin/"
diff --git a/pkgs/tools/typesetting/docbook2x/default.nix b/pkgs/tools/typesetting/docbook2x/default.nix
index fdfa05f20c1..4b9e571c0ad 100644
--- a/pkgs/tools/typesetting/docbook2x/default.nix
+++ b/pkgs/tools/typesetting/docbook2x/default.nix
@@ -15,7 +15,8 @@ stdenv.mkDerivation rec {
   # writes its output to stdout instead of creating a file.
   patches = [ ./db2x_texixml-to-stdout.patch ];
 
-  buildInputs = [ texinfo groff libxml2 libxslt makeWrapper opensp libiconv ]
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ texinfo groff libxml2 libxslt opensp libiconv ]
     ++ (with perlPackages; [ perl XMLSAX XMLParser XMLNamespaceSupport ]);
 
   postConfigure = ''
diff --git a/pkgs/tools/typesetting/pdfsandwich/default.nix b/pkgs/tools/typesetting/pdfsandwich/default.nix
index 10f8525da08..755ac6bb32a 100644
--- a/pkgs/tools/typesetting/pdfsandwich/default.nix
+++ b/pkgs/tools/typesetting/pdfsandwich/default.nix
@@ -10,7 +10,8 @@ stdenv.mkDerivation {
     sha256 = "1420c33divch087xrr61lvyf975bapqkgjqaighl581i69nlzsm6";
   };
 
-  buildInputs = [ ocaml perl makeWrapper];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ ocaml perl ];
   installPhase = ''
     mkdir -p $out/bin
     cp -p pdfsandwich $out/bin
diff --git a/pkgs/tools/typesetting/sshlatex/default.nix b/pkgs/tools/typesetting/sshlatex/default.nix
index 07c972420ab..8a5b4811d77 100644
--- a/pkgs/tools/typesetting/sshlatex/default.nix
+++ b/pkgs/tools/typesetting/sshlatex/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     sha256 = "0kaah8is74zba9373xccmsxmnnn6kh0isr4qpg21x3qhdzhlxl7q";
   };
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   installPhase = let
     binPath = lib.makeBinPath [ openssh perl gnutar bash inotify-tools ];
diff --git a/pkgs/tools/typesetting/ted/default.nix b/pkgs/tools/typesetting/ted/default.nix
index 937e3ffd7d7..07e89f9f8ed 100644
--- a/pkgs/tools/typesetting/ted/default.nix
+++ b/pkgs/tools/typesetting/ted/default.nix
@@ -58,7 +58,8 @@ stdenv.mkDerivation rec {
     runHook postInstall
   '';
 
-  buildInputs = [ pkg-config zlib pcre xorg.xlibsWrapper xorg.libXpm libjpeg libtiff libpng gtk2 libpaper makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ pkg-config zlib pcre xorg.xlibsWrapper xorg.libXpm libjpeg libtiff libpng gtk2 libpaper ];
 
   meta = with lib; {
     description = "An easy rich text processor";
diff --git a/pkgs/tools/typesetting/tex/texlive/bin.nix b/pkgs/tools/typesetting/tex/texlive/bin.nix
index fd1815efa94..d2858a90885 100644
--- a/pkgs/tools/typesetting/tex/texlive/bin.nix
+++ b/pkgs/tools/typesetting/tex/texlive/bin.nix
@@ -270,8 +270,8 @@ dvipng = stdenv.mkDerivation {
 
   inherit (common) src;
 
-  nativeBuildInputs = [ perl pkg-config ];
-  buildInputs = [ core/*kpathsea*/ zlib libpng freetype gd ghostscript makeWrapper ];
+  nativeBuildInputs = [ perl pkg-config makeWrapper ];
+  buildInputs = [ core/*kpathsea*/ zlib libpng freetype gd ghostscript ];
 
   preConfigure = ''
     cd texk/dvipng
diff --git a/pkgs/tools/virtualization/ec2-ami-tools/default.nix b/pkgs/tools/virtualization/ec2-ami-tools/default.nix
index eafd740b065..00df6bd97e1 100644
--- a/pkgs/tools/virtualization/ec2-ami-tools/default.nix
+++ b/pkgs/tools/virtualization/ec2-ami-tools/default.nix
@@ -5,7 +5,8 @@ stdenv.mkDerivation rec {
 
   version = "1.5.7";
 
-  buildInputs = [ unzip makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ unzip ];
 
   src = fetchurl {
     url = "https://s3.amazonaws.com/ec2-downloads/${pname}-${version}.zip";
diff --git a/pkgs/tools/virtualization/ec2-api-tools/default.nix b/pkgs/tools/virtualization/ec2-api-tools/default.nix
index 8e3ab0d9f28..0c3aec2aadf 100644
--- a/pkgs/tools/virtualization/ec2-api-tools/default.nix
+++ b/pkgs/tools/virtualization/ec2-api-tools/default.nix
@@ -8,7 +8,8 @@ stdenv.mkDerivation rec {
     sha256 = "0figmvcm82ghmpz3018ihysz8zpxpysgbpdx7rmciq9y80qbw6l5";
   };
 
-  buildInputs = [ unzip makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ unzip ];
 
   installPhase =
     ''
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 2ddecc16470..d77b084f777 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -515,7 +515,7 @@ in
 
   makeInitrd = callPackage ../build-support/kernel/make-initrd.nix; # Args intentionally left out
 
-  makeWrapper = makeSetupHook { deps = [ dieHook ]; substitutions = { shell = pkgs.runtimeShell; }; }
+  makeWrapper = makeSetupHook { deps = [ dieHook ]; substitutions = { shell = targetPackages.runtimeShell; }; }
                               ../build-support/setup-hooks/make-wrapper.sh;
 
   makeModulesClosure = { kernel, firmware, rootModules, allowMissing ? false }:
@@ -5125,13 +5125,7 @@ in
 
   hdf5-blosc = callPackage ../development/libraries/hdf5-blosc { };
 
-  hdfview = callPackage ../tools/misc/hdfview {
-    javac = jdk8; # TODO: https://github.com/NixOS/nixpkgs/pull/89731
-  };
-
-  hdf_java = callPackage ../tools/misc/hdfjava {
-    javac = jdk8; # TODO: https://github.com/NixOS/nixpkgs/pull/89731
-  };
+  hdfview = callPackage ../tools/misc/hdfview { };
 
   hecate = callPackage ../applications/editors/hecate { };
 
@@ -9909,6 +9903,9 @@ in
     libcCross = if stdenv.targetPlatform != stdenv.buildPlatform then libcCross else null;
     threadsCross = if stdenv.targetPlatform != stdenv.buildPlatform then threadsCross else null;
 
+    # gcc 10 is too strict to cross compile gcc <= 8
+    stdenv = if (stdenv.targetPlatform != stdenv.buildPlatform) && stdenv.cc.isGNU then gcc7Stdenv else stdenv;
+
     isl = if stdenv.isDarwin
             then null
           else if stdenv.targetPlatform.isRedox
@@ -9925,6 +9922,9 @@ in
     libcCross = if stdenv.targetPlatform != stdenv.buildPlatform then libcCross else null;
     threadsCross = if stdenv.targetPlatform != stdenv.buildPlatform then threadsCross else null;
 
+    # gcc 10 is too strict to cross compile gcc <= 8
+    stdenv = if (stdenv.targetPlatform != stdenv.buildPlatform) && stdenv.cc.isGNU then gcc7Stdenv else stdenv;
+
     isl = if !stdenv.isDarwin then isl_0_17 else null;
   }));
 
@@ -9937,6 +9937,9 @@ in
     libcCross = if stdenv.targetPlatform != stdenv.buildPlatform then libcCross else null;
     threadsCross = if stdenv.targetPlatform != stdenv.buildPlatform then threadsCross else null;
 
+    # gcc 10 is too strict to cross compile gcc <= 8
+    stdenv = if (stdenv.targetPlatform != stdenv.buildPlatform) && stdenv.cc.isGNU then gcc7Stdenv else stdenv;
+
     isl = if !stdenv.isDarwin then isl_0_17 else null;
   }));
 
@@ -14403,8 +14406,13 @@ in
   } // (lib.optionalAttrs (stdenv.hostPlatform.isi686 && stdenv.cc.isGNU) {
       stdenv = gcc6Stdenv; # with gcc-7: undefined reference to `__divmoddi4'
     }));
+  icu68 = callPackage ../development/libraries/icu/68.nix ({
+    nativeBuildRoot = buildPackages.icu68.override { buildRootOnly = true; };
+  } // (lib.optionalAttrs (stdenv.hostPlatform.isi686 && stdenv.cc.isGNU) {
+      stdenv = gcc6Stdenv; # with gcc-7: undefined reference to `__divmoddi4'
+    }));
 
-  icu = icu67;
+  icu = icu68;
 
   id3lib = callPackage ../development/libraries/id3lib { };
 
@@ -16554,6 +16562,8 @@ in
 
   readosm = callPackage ../development/libraries/readosm { };
 
+  rinutils = callPackage ../development/libraries/rinutils { };
+
   kissfft = callPackage ../development/libraries/kissfft { };
 
   lambdabot = callPackage ../development/tools/haskell/lambdabot {
@@ -26596,6 +26606,10 @@ in
     lua = lua5;
   };
 
+  black-hole-solver = callPackage ../games/black-hole-solver {
+    inherit (perlPackages) PathTiny;
+  };
+
   blackshades = callPackage ../games/blackshades { };
 
   blobby = callPackage ../games/blobby { };