diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index a7313e8fdfa..a6c6c547aed 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -868,6 +868,12 @@
     githubId = 706854;
     name = "Etienne Laurin";
   };
+  attila-lendvai = {
+    name = "Attila Lendvai";
+    email = "attila@lendvai.name";
+    github = "attila-lendvai";
+    githubId = 840345;
+  };
   auntie = {
     email = "auntieNeo@gmail.com";
     github = "auntieNeo";
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index f64f2dbb2cb..30fdde78009 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -609,6 +609,8 @@
   ./services/networking/atftpd.nix
   ./services/networking/avahi-daemon.nix
   ./services/networking/babeld.nix
+  ./services/networking/bee.nix
+  ./services/networking/bee-clef.nix
   ./services/networking/biboumi.nix
   ./services/networking/bind.nix
   ./services/networking/bitcoind.nix
diff --git a/nixos/modules/services/backup/mysql-backup.nix b/nixos/modules/services/backup/mysql-backup.nix
index 31d606b141a..506ded5e9e8 100644
--- a/nixos/modules/services/backup/mysql-backup.nix
+++ b/nixos/modules/services/backup/mysql-backup.nix
@@ -48,6 +48,7 @@ in
       };
 
       user = mkOption {
+        type = types.str;
         default = defaultUser;
         description = ''
           User to be used to perform backup.
@@ -56,12 +57,14 @@ in
 
       databases = mkOption {
         default = [];
+        type = types.listOf types.str;
         description = ''
           List of database names to dump.
         '';
       };
 
       location = mkOption {
+        type = types.path;
         default = "/var/backup/mysql";
         description = ''
           Location to put the gzipped MySQL database dumps.
@@ -70,6 +73,7 @@ in
 
       singleTransaction = mkOption {
         default = false;
+        type = types.bool;
         description = ''
           Whether to create database dump in a single transaction
         '';
diff --git a/nixos/modules/services/backup/postgresql-backup.nix b/nixos/modules/services/backup/postgresql-backup.nix
index 428861a7598..f4bd3aa447e 100644
--- a/nixos/modules/services/backup/postgresql-backup.nix
+++ b/nixos/modules/services/backup/postgresql-backup.nix
@@ -48,6 +48,7 @@ in {
 
       startAt = mkOption {
         default = "*-*-* 01:15:00";
+        type = types.str;
         description = ''
           This option defines (see <literal>systemd.time</literal> for format) when the
           databases should be dumped.
@@ -70,6 +71,7 @@ in {
 
       databases = mkOption {
         default = [];
+        type = types.listOf types.str;
         description = ''
           List of database names to dump.
         '';
@@ -77,6 +79,7 @@ in {
 
       location = mkOption {
         default = "/var/backup/postgresql";
+        type = types.path;
         description = ''
           Location to put the gzipped PostgreSQL database dumps.
         '';
diff --git a/nixos/modules/services/networking/bee-clef.nix b/nixos/modules/services/networking/bee-clef.nix
new file mode 100644
index 00000000000..719714b2898
--- /dev/null
+++ b/nixos/modules/services/networking/bee-clef.nix
@@ -0,0 +1,107 @@
+{ config, lib, pkgs, ... }:
+
+# NOTE for now nothing is installed into /etc/bee-clef/. the config files are used as read-only from the nix store.
+
+with lib;
+let
+  cfg = config.services.bee-clef;
+in {
+  meta = {
+    maintainers = with maintainers; [ attila-lendvai ];
+  };
+
+  ### interface
+
+  options = {
+    services.bee-clef = {
+      enable = mkEnableOption "clef external signer instance for Ethereum Swarm Bee";
+
+      dataDir = mkOption {
+        type = types.nullOr types.str;
+        default = "/var/lib/bee-clef";
+        description = ''
+          Data dir for bee-clef. Beware that some helper scripts may not work when changed!
+          The service itself should work fine, though.
+        '';
+      };
+
+      passwordFile = mkOption {
+        type = types.nullOr types.str;
+        default = "/var/lib/bee-clef/password";
+        description = "Password file for bee-clef.";
+      };
+
+      user = mkOption {
+        type = types.str;
+        default = "bee-clef";
+        description = ''
+          User the bee-clef daemon should execute under.
+        '';
+      };
+
+      group = mkOption {
+        type = types.str;
+        default = "bee-clef";
+        description = ''
+          Group the bee-clef daemon should execute under.
+        '';
+      };
+    };
+  };
+
+  ### implementation
+
+  config = mkIf cfg.enable {
+    # if we ever want to have rules.js under /etc/bee-clef/
+    # environment.etc."bee-clef/rules.js".source = ${pkgs.bee-clef}/rules.js
+
+    systemd.packages = [ pkgs.bee-clef ]; # include the upstream bee-clef.service file
+
+    systemd.tmpfiles.rules = [
+        "d '${cfg.dataDir}/'         0750 ${cfg.user} ${cfg.group}"
+        "d '${cfg.dataDir}/keystore' 0700 ${cfg.user} ${cfg.group}"
+      ];
+
+    systemd.services.bee-clef = {
+      path = [
+        # these are needed for the ensure-clef-account script
+        pkgs.coreutils
+        pkgs.gnused
+        pkgs.gawk
+      ];
+
+      wantedBy = [ "bee.service" "multi-user.target" ];
+
+      serviceConfig = {
+        User = cfg.user;
+        Group = cfg.group;
+        ExecStartPre = ''${pkgs.bee-clef}/share/bee-clef/ensure-clef-account "${cfg.dataDir}" "${pkgs.bee-clef}/share/bee-clef/"'';
+        ExecStart = [
+          "" # this hides/overrides what's in the original entry
+          "${pkgs.bee-clef}/share/bee-clef/bee-clef-service start"
+        ];
+        ExecStop = [
+          "" # this hides/overrides what's in the original entry
+          "${pkgs.bee-clef}/share/bee-clef/bee-clef-service stop"
+        ];
+        Environment = [
+          "CONFIGDIR=${cfg.dataDir}"
+          "PASSWORD_FILE=${cfg.passwordFile}"
+        ];
+      };
+    };
+
+    users.users = optionalAttrs (cfg.user == "bee-clef") {
+      bee-clef = {
+        group = cfg.group;
+        home = cfg.dataDir;
+        isSystemUser = true;
+        description = "Daemon user for the bee-clef service";
+      };
+    };
+
+    users.groups = optionalAttrs (cfg.group == "bee-clef") {
+      bee-clef = {};
+    };
+  };
+}
diff --git a/nixos/modules/services/networking/bee.nix b/nixos/modules/services/networking/bee.nix
new file mode 100644
index 00000000000..8a77ce23ab4
--- /dev/null
+++ b/nixos/modules/services/networking/bee.nix
@@ -0,0 +1,149 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+let
+  cfg = config.services.bee;
+  format = pkgs.formats.yaml {};
+  configFile = format.generate "bee.yaml" cfg.settings;
+in {
+  meta = {
+    # doc = ./bee.xml;
+    maintainers = with maintainers; [ attila-lendvai ];
+  };
+
+  ### interface
+
+  options = {
+    services.bee = {
+      enable = mkEnableOption "Ethereum Swarm Bee";
+
+      package = mkOption {
+        type = types.package;
+        default = pkgs.bee;
+        defaultText = "pkgs.bee";
+        example = "pkgs.bee-unstable";
+        description = "The package providing the bee binary for the service.";
+      };
+
+      settings = mkOption {
+        type = format.type;
+        description = ''
+          Ethereum Swarm Bee configuration. Refer to
+          <link xlink:href="https://gateway.ethswarm.org/bzz/docs.swarm.eth/docs/installation/configuration/"/>
+          for details on supported values.
+        '';
+      };
+
+      daemonNiceLevel = mkOption {
+        type = types.int;
+        default = 0;
+        description = ''
+          Daemon process priority for bee.
+          0 is the default Unix process priority, 19 is the lowest.
+        '';
+      };
+
+      user = mkOption {
+        type = types.str;
+        default = "bee";
+        description = ''
+          User the bee binary should execute under.
+        '';
+      };
+
+      group = mkOption {
+        type = types.str;
+        default = "bee";
+        description = ''
+          Group the bee binary should execute under.
+        '';
+      };
+    };
+  };
+
+  ### implementation
+
+  config = mkIf cfg.enable {
+    assertions = [
+      { assertion = (hasAttr "password" cfg.settings) != true;
+        message = ''
+          `services.bee.settings.password` is insecure. Use `services.bee.settings.password-file` or `systemd.services.bee.serviceConfig.EnvironmentFile` instead.
+        '';
+      }
+      { assertion = (hasAttr "swap-endpoint" cfg.settings) || (cfg.settings.swap-enable or true == false);
+        message = ''
+          In a swap-enabled network a working Ethereum blockchain node is required. You must specify one using `services.bee.settings.swap-endpoint`, or disable `services.bee.settings.swap-enable` = false.
+        '';
+      }
+    ];
+
+    warnings = optional (! config.services.bee-clef.enable) "The bee service requires an external signer. Consider setting `config.services.bee-clef.enable` = true";
+
+    services.bee.settings = {
+      data-dir             = lib.mkDefault "/var/lib/bee";
+      password-file        = lib.mkDefault "/var/lib/bee/password";
+      clef-signer-enable   = lib.mkDefault true;
+      clef-signer-endpoint = lib.mkDefault "/var/lib/bee-clef/clef.ipc";
+      swap-endpoint        = lib.mkDefault "https://rpc.slock.it/goerli";
+    };
+
+    systemd.packages = [ cfg.package ]; # include the upstream bee.service file
+
+    systemd.tmpfiles.rules = [
+      "d '${cfg.settings.data-dir}' 0750 ${cfg.user} ${cfg.group}"
+    ];
+
+    systemd.services.bee = {
+      requires = optional config.services.bee-clef.enable
+        "bee-clef.service";
+
+      wantedBy = [ "multi-user.target" ];
+
+      serviceConfig = {
+        Nice = cfg.daemonNiceLevel;
+        User = cfg.user;
+        Group = cfg.group;
+        ExecStart = [
+          "" # this hides/overrides what's in the original entry
+          "${cfg.package}/bin/bee --config=${configFile} start"
+        ];
+      };
+
+      preStart = with cfg.settings; ''
+        if ! test -f ${password-file}; then
+          < /dev/urandom tr -dc _A-Z-a-z-0-9 2> /dev/null | head -c32 > ${password-file}
+          chmod 0600 ${password-file}
+          echo "Initialized ${password-file} from /dev/urandom"
+        fi
+        if [ ! -f ${data-dir}/keys/libp2p.key ]; then
+          ${cfg.package}/bin/bee init --config=${configFile} >/dev/null
+          echo "
+Logs:   journalctl -f -u bee.service
+
+Bee has SWAP enabled by default and it needs ethereum endpoint to operate.
+It is recommended to use external signer with bee.
+Check documentation for more info:
+- SWAP https://docs.ethswarm.org/docs/installation/manual#swap-bandwidth-incentives
+- External signer https://docs.ethswarm.org/docs/installation/bee-clef
+
+After you finish configuration run 'sudo bee-get-addr'."
+        fi
+      '';
+    };
+
+    users.users = optionalAttrs (cfg.user == "bee") {
+      bee = {
+        group = cfg.group;
+        home = cfg.settings.data-dir;
+        isSystemUser = true;
+        description = "Daemon user for Ethereum Swarm Bee";
+        extraGroups = optional config.services.bee-clef.enable
+          config.services.bee-clef.group;
+      };
+    };
+
+    users.groups = optionalAttrs (cfg.group == "bee") {
+      bee = {};
+    };
+  };
+}
diff --git a/pkgs/applications/audio/plexamp/default.nix b/pkgs/applications/audio/plexamp/default.nix
index 2c33584e362..c484f6e1924 100644
--- a/pkgs/applications/audio/plexamp/default.nix
+++ b/pkgs/applications/audio/plexamp/default.nix
@@ -2,13 +2,13 @@
 
 let
   pname = "plexamp";
-  version = "3.3.1";
+  version = "3.4.1";
   name = "${pname}-${version}";
 
   src = fetchurl {
     url = "https://plexamp.plex.tv/plexamp.plex.tv/desktop/Plexamp-${version}.AppImage";
     name="${pname}-${version}.AppImage";
-    sha256 = "6/asP8VR+rJ52lKKds46gSw1or9suUEmyR75pjdWHIQ=";
+    sha256 = "Vv+e1q5ThuXDPX8baSU+7/U63p6/dvh0ZvScO1Loj+U=";
   };
 
   appimageContents = appimageTools.extractType2 {
diff --git a/pkgs/applications/editors/vscode/update-vscode.sh b/pkgs/applications/editors/vscode/update-vscode.sh
index cb1400f048e..d1ae71cd11e 100755
--- a/pkgs/applications/editors/vscode/update-vscode.sh
+++ b/pkgs/applications/editors/vscode/update-vscode.sh
@@ -1,5 +1,5 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -i bash -p curl gnugrep gnused gawk
+#!nix-shell -i bash -p curl jq gnused
 
 # Update script for the vscode versions and hashes.
 # Usually doesn't need to be called by hand,
@@ -16,8 +16,7 @@ fi
 
 # VSCode
 
-VSCODE_VER=$(curl -s -L "https://code.visualstudio.com/Download" | grep "is now available" | awk -F'</span>' '{print $1}' | awk -F'>' '{print $NF}')
-VSCODE_VER=$(curl -s -L "https://code.visualstudio.com/updates/v${VSCODE_VER/./_}" | grep "Downloads:" | awk -F'code.visualstudio.com/' '{print $2}' | awk -F'/' '{print $1}')
+VSCODE_VER=$(curl --fail --silent https://api.github.com/repos/Microsoft/vscode/releases/latest | jq --raw-output .tag_name)
 sed -i "s/version = \".*\"/version = \"${VSCODE_VER}\"/" "$ROOT/vscode.nix"
 
 VSCODE_LINUX_URL="https://vscode-update.azurewebsites.net/${VSCODE_VER}/linux-x64/stable"
diff --git a/pkgs/applications/misc/octoprint/default.nix b/pkgs/applications/misc/octoprint/default.nix
index f35d03c6d17..9f229e4821b 100644
--- a/pkgs/applications/misc/octoprint/default.nix
+++ b/pkgs/applications/misc/octoprint/default.nix
@@ -3,6 +3,7 @@
 , lib
 , fetchFromGitHub
 , python3
+, nix-update-script
   # To include additional plugins, pass them here as an overlay.
 , packageOverrides ? self: super: {}
 }:
@@ -89,13 +90,13 @@ let
           self: super: {
             octoprint = self.buildPythonPackage rec {
               pname = "OctoPrint";
-              version = "1.5.1";
+              version = "1.5.3";
 
               src = fetchFromGitHub {
                 owner = "OctoPrint";
                 repo = "OctoPrint";
                 rev = version;
-                sha256 = "04x58cjivslsrld341ip11c50d50p2q01090nsyji0j255v986j9";
+                sha256 = "sha256-ZL/P/YIHynPmP8ssZZUKZDJscBsSsCq3UtOHrTVLpec=";
               };
 
               propagatedBuildInputs = with super; [
@@ -170,7 +171,10 @@ let
                 "test_set_external_modification"
               ];
 
-              passthru.python = self.python;
+              passthru = {
+                python = self.python;
+                updateScript = nix-update-script { attrPath = "octoprint"; };
+              };
 
               meta = with lib; {
                 homepage = "https://octoprint.org/";
diff --git a/pkgs/applications/networking/bee/0001-clef-service-accept-default-CONFIGDIR-from-the-envir.patch b/pkgs/applications/networking/bee/0001-clef-service-accept-default-CONFIGDIR-from-the-envir.patch
new file mode 100644
index 00000000000..fb551646b7c
--- /dev/null
+++ b/pkgs/applications/networking/bee/0001-clef-service-accept-default-CONFIGDIR-from-the-envir.patch
@@ -0,0 +1,44 @@
+From 04933c578f51aa1f536991318dc5aede57f81c0d Mon Sep 17 00:00:00 2001
+From: Attila Lendvai <attila@lendvai.name>
+Date: Sat, 30 Jan 2021 14:02:02 +0100
+Subject: [PATCH 1/2] clef-service: accept default CONFIGDIR from the
+ environment
+
+---
+ packaging/bee-clef-service | 15 ++++++++++-----
+ 1 file changed, 10 insertions(+), 5 deletions(-)
+
+diff --git a/packaging/bee-clef-service b/packaging/bee-clef-service
+index 10bcd92..34c7edd 100755
+--- a/packaging/bee-clef-service
++++ b/packaging/bee-clef-service
+@@ -1,16 +1,21 @@
+ #!/usr/bin/env sh
+ 
+ start() {
+-    KEYSTORE=/var/lib/bee-clef/keystore
+-    CONFIGDIR=/var/lib/bee-clef
++    if [ -z "$CONFIGDIR" ]; then
++        CONFIGDIR=/var/lib/bee-clef
++    fi
++    if [ -z "$PASSWORD_FILE" ]; then
++        PASSWORD_FILE=${CONFIGDIR}/password
++    fi
++    KEYSTORE=${CONFIGDIR}/keystore
++    SECRET=$(cat ${PASSWORD_FILE})
+     CHAINID=5
+-    SECRET=$(cat /var/lib/bee-clef/password)
+     # clef with every start sets permissions back to 600
+-    (sleep 4; chmod 660 /var/lib/bee-clef/clef.ipc) &
++    (sleep 4; chmod 660 ${CONFIGDIR}/clef.ipc) &
+     ( sleep 2; cat << EOF
+ { "jsonrpc": "2.0", "id":1, "result": { "text":"$SECRET" } }
+ EOF
+-) | clef --stdio-ui --keystore $KEYSTORE --configdir $CONFIGDIR --chainid $CHAINID --rules /etc/bee-clef/rules.js --nousb --4bytedb-custom /etc/bee-clef/4byte.json --pcscdpath "" --auditlog "" --loglevel 3 --ipcpath /var/lib/bee-clef
++) | clef --stdio-ui --keystore $KEYSTORE --configdir $CONFIGDIR --chainid $CHAINID --rules /etc/bee-clef/rules.js --nousb --4bytedb-custom /etc/bee-clef/4byte.json --pcscdpath "" --auditlog "" --loglevel 3 --ipcpath ${CONFIGDIR}
+ }
+ 
+ stop() {
+-- 
+2.29.2
+
diff --git a/pkgs/applications/networking/bee/0002-nix-diff-for-substituteAll.patch b/pkgs/applications/networking/bee/0002-nix-diff-for-substituteAll.patch
new file mode 100644
index 00000000000..611aed0b890
--- /dev/null
+++ b/pkgs/applications/networking/bee/0002-nix-diff-for-substituteAll.patch
@@ -0,0 +1,25 @@
+From 1a1ab986245e8b74648a1a0adb5d1c7019561d18 Mon Sep 17 00:00:00 2001
+From: Attila Lendvai <attila@lendvai.name>
+Date: Sat, 30 Jan 2021 15:24:57 +0100
+Subject: [PATCH 2/2] nix diff for substituteAll
+
+---
+ packaging/bee-clef-service | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/packaging/bee-clef-service b/packaging/bee-clef-service
+index 34c7edd..31e9d95 100755
+--- a/packaging/bee-clef-service
++++ b/packaging/bee-clef-service
+@@ -15,7 +15,7 @@ start() {
+     ( sleep 2; cat << EOF
+ { "jsonrpc": "2.0", "id":1, "result": { "text":"$SECRET" } }
+ EOF
+-) | clef --stdio-ui --keystore $KEYSTORE --configdir $CONFIGDIR --chainid $CHAINID --rules /etc/bee-clef/rules.js --nousb --4bytedb-custom /etc/bee-clef/4byte.json --pcscdpath "" --auditlog "" --loglevel 3 --ipcpath ${CONFIGDIR}
++) | @clefBinary@ --stdio-ui --keystore $KEYSTORE --configdir $CONFIGDIR --chainid $CHAINID --rules @out@/share/bee-clef/rules.js --nousb --4bytedb-custom @out@/share/bee-clef/4byte.json --pcscdpath "" --auditlog "" --loglevel 3 --ipcpath ${CONFIGDIR}
+ }
+ 
+ stop() {
+-- 
+2.29.2
+
diff --git a/pkgs/applications/networking/bee/bee-clef.nix b/pkgs/applications/networking/bee/bee-clef.nix
new file mode 100644
index 00000000000..a94386ea3f1
--- /dev/null
+++ b/pkgs/applications/networking/bee/bee-clef.nix
@@ -0,0 +1,57 @@
+{ version ? "release", stdenv, lib, substituteAll, fetchFromGitHub, go-ethereum }:
+
+stdenv.mkDerivation rec {
+  pname = "bee-clef";
+  version = "0.4.7";
+
+  src = fetchFromGitHub {
+    owner = "ethersphere";
+    repo = "bee-clef";
+    rev = "refs/tags/v${version}";
+    sha256 = "1sfwql0kvnir8b9ggpqcyc0ar995gxgfbhqb1xpfzp6wl0g3g4zz";
+  };
+
+  buildInputs = [ go-ethereum ];
+
+  clefBinary = "${go-ethereum}/bin/clef";
+
+  patches = [
+    ./0001-clef-service-accept-default-CONFIGDIR-from-the-envir.patch
+    ./0002-nix-diff-for-substituteAll.patch
+  ];
+
+  dontBuild = true;
+
+  installPhase = ''
+    mkdir -p $out/bin/
+    mkdir -p $out/share/bee-clef/
+    mkdir -p $out/lib/systemd/system/
+    cp packaging/bee-clef.service $out/lib/systemd/system/
+    substituteAll packaging/bee-clef-service $out/share/bee-clef/bee-clef-service
+    substituteAll ${./ensure-clef-account} $out/share/bee-clef/ensure-clef-account
+    substituteAll packaging/bee-clef-keys $out/bin/bee-clef-keys
+    cp packaging/rules.js packaging/4byte.json $out/share/bee-clef/
+    chmod +x $out/bin/bee-clef-keys
+    chmod +x $out/share/bee-clef/bee-clef-service
+    chmod +x $out/share/bee-clef/ensure-clef-account
+    patchShebangs $out/
+  '';
+
+  meta = with lib; {
+    # homepage = "https://gateway.ethswarm.org/bzz/docs.swarm.eth/docs/installation/bee-clef/";
+    homepage = "https://docs.ethswarm.org/docs/installation/bee-clef";
+    description = "External signer for Ethereum Swarm Bee";
+    longDescription = ''
+      clef is go-ethereum's external signer.
+
+      bee-clef is a package that starts up a vanilla clef instance as a systemd service,
+      but configured in such a way that is suitable for bee (relaxed security for
+      automated operation).
+
+      This package contains the files necessary to run the bee-clef service.
+    '';
+    license = with licenses; [ bsd3 ];
+    maintainers = with maintainers; [ attila-lendvai ];
+    platforms = go-ethereum.meta.platforms;
+  };
+}
diff --git a/pkgs/applications/networking/bee/bee.nix b/pkgs/applications/networking/bee/bee.nix
new file mode 100644
index 00000000000..5ffff918750
--- /dev/null
+++ b/pkgs/applications/networking/bee/bee.nix
@@ -0,0 +1,77 @@
+{ version ? "release", stdenv, lib, fetchFromGitHub, buildGoModule, coreutils }:
+
+let
+
+  versionSpec = rec {
+    unstable = rec {
+      pname = "bee-unstable";
+      version = "2021-01-30";
+      rev = "824636a2c2629c329ab10275cef6a0b7395343ad";
+      goVersionString = "g" + builtins.substring 0 7 rev;     # this seems to be some kind of standard of git describe...
+      sha256 = "0ly1yqjq29arbak8lchdradf39l5bmxpbfir6ljjc7nyqdxz0sxg";
+      vendorSha256 = "0w1db7xpissdpf8i5bb96z92zbasj5x9kk3kcisxn0dwla6n55n3";
+    };
+    release = rec {
+      pname = "bee";
+      version = "0.4.2";
+      rev = "refs/tags/v${version}";
+      sha256 = "1jg7aivsgdb9bm87dlmwpf1g6gla8j6v55xmzs8h5xmwqcybbmag";
+      vendorSha256 = "0w1db7xpissdpf8i5bb96z92zbasj5x9kk3kcisxn0dwla6n55n3";
+    };
+    "0.4.2" = release;
+    "0.4.1" = rec {
+      pname = "bee";
+      version = "0.4.1";
+      rev = "refs/tags/v${version}";
+      sha256 = "1bmgbav52pcb5p7cgq9756512fzfqhjybyr0dv538plkqx47mpv7";
+      vendorSha256 = "0j393va4jrg9q3wlc9mgkbpgnn2w2s3k2hcn8phzj8d5fl4n4v2h";
+    };
+  }.${version};
+
+in
+
+buildGoModule {
+  inherit (versionSpec) pname version vendorSha256;
+
+  src = fetchFromGitHub {
+    owner = "ethersphere";
+    repo = "bee";
+    inherit (versionSpec) rev sha256;
+  };
+
+  nativeBuildInputs = [ coreutils ];
+
+  subPackages = [ "cmd/bee" ];
+
+  # no symbol table, no debug info, and pass the commit for the version string
+  buildFlags = lib.optionalString ( lib.hasAttr "goVersionString" versionSpec)
+    "-ldflags -s -ldflags -w -ldflags -X=github.com/ethersphere/bee.commit=${versionSpec.goVersionString}";
+
+  # Mimic the bee Makefile: without disabling CGO, two (transitive and
+  # unused) dependencies would fail to compile.
+  preBuild = ''
+    export CGO_ENABLED=0
+  '';
+
+  postInstall = ''
+    mkdir -p $out/lib/systemd/system
+    cp packaging/bee.service $out/lib/systemd/system/
+    cp packaging/bee-get-addr $out/bin/
+    chmod +x $out/bin/bee-get-addr
+    patchShebangs $out/bin/
+  '';
+
+  meta = with lib; {
+    homepage = "https://swarm.ethereum.org/";
+    description = "Ethereum Swarm Bee";
+    longDescription = ''
+      A decentralised storage and communication system for a sovereign digital society.
+
+      Swarm is a system of peer-to-peer networked nodes that create a decentralised storage and communication service. The system is economically self-sustaining due to a built-in incentive system enforced through smart contracts on the Ethereum blockchain.
+
+      Bee is a Swarm node implementation, written in Go.
+    '';
+    license = with licenses; [ bsd3 ];
+    maintainers = with maintainers; [ attila-lendvai ];
+  };
+}
diff --git a/pkgs/applications/networking/bee/ensure-clef-account b/pkgs/applications/networking/bee/ensure-clef-account
new file mode 100644
index 00000000000..def67ff9cc3
--- /dev/null
+++ b/pkgs/applications/networking/bee/ensure-clef-account
@@ -0,0 +1,47 @@
+#!/usr/bin/env sh
+
+set -e
+
+# NOTE This file is called by the systemd service in its preStart
+# hook, but it's not Nix specific in any way. Ideally, the same file
+# should be called from the postinst scripts of the other packages,
+# but... the world is not ideal.
+
+# What follows was extracted from, and should be in sync with
+# https://github.com/ethersphere/bee-clef/tree/master/packaging
+
+DATA_DIR="$1"
+CONFIG_DIR="$2"
+PASSWORD_FILE=${DATA_DIR}/password
+MASTERSEED=${DATA_DIR}/masterseed.json
+KEYSTORE=${DATA_DIR}/keystore
+
+echo "ensure-clef-account $DATA_DIR $CONFIG_DIR"
+
+if ! test -f ${PASSWORD_FILE}; then
+    < /dev/urandom tr -dc _A-Z-a-z-0-9 2> /dev/null | head -c32 > ${PASSWORD_FILE}
+    chmod 0400 ${PASSWORD_FILE}
+    echo "Initialized ${PASSWORD_FILE} from /dev/urandom"
+fi
+
+if ! test -f ${MASTERSEED}; then
+    parse_json() { echo $1|sed -e 's/[{}]/''/g'|sed -e 's/", "/'\",\"'/g'|sed -e 's/" ,"/'\",\"'/g'|sed -e 's/" , "/'\",\"'/g'|sed -e 's/","/'\"---SEPERATOR---\"'/g'|awk -F=':' -v RS='---SEPERATOR---' "\$1~/\"$2\"/ {print}"|sed -e "s/\"$2\"://"|tr -d "\n\t"|sed -e 's/\\"/"/g'|sed -e 's/\\\\/\\/g'|sed -e 's/^[ \t]*//g'|sed -e 's/^"//' -e 's/"$//' ; }
+    SECRET=$(cat ${PASSWORD_FILE})
+    CLEF="@clefBinary@ --configdir ${DATA_DIR} --keystore ${KEYSTORE} --stdio-ui"
+    $CLEF init >/dev/null << EOF
+$SECRET
+$SECRET
+EOF
+    $CLEF newaccount >/dev/null << EOF
+$SECRET
+EOF
+    $CLEF setpw 0x$(parse_json $(cat ${KEYSTORE}/*) address) >/dev/null << EOF
+$SECRET
+$SECRET
+$SECRET
+EOF
+    $CLEF attest $(sha256sum ${CONFIG_DIR}/rules.js | cut -d' ' -f1 | tr -d '\n') >/dev/null << EOF
+$SECRET
+EOF
+    echo "Clef data dir initialized"
+fi
diff --git a/pkgs/applications/networking/instant-messengers/rambox/pro.nix b/pkgs/applications/networking/instant-messengers/rambox/pro.nix
index 7051799a277..827cac7c297 100644
--- a/pkgs/applications/networking/instant-messengers/rambox/pro.nix
+++ b/pkgs/applications/networking/instant-messengers/rambox/pro.nix
@@ -4,14 +4,14 @@ let
   mkRambox = opts: callPackage (import ./rambox.nix opts) { };
 in mkRambox rec {
   pname = "rambox-pro";
-  version = "1.4.1";
+  version = "1.5.0";
 
   desktopName = "Rambox Pro";
 
   src = {
     x86_64-linux = fetchurl {
       url = "https://github.com/ramboxapp/download/releases/download/v${version}/RamboxPro-${version}-linux-x64.AppImage";
-      sha256 = "18383v3g26hd1czvw06gmjn8bdw2w9c7zb04zkfl6szgakrv26x4";
+      sha256 = "1g7lrjm8yxklqpc2mp8gy0g61wfilr15dl80r3sh6pa5b4k5spir";
     };
   }.${stdenv.system} or (throw "Unsupported system: ${stdenv.system}");
 
diff --git a/pkgs/development/compilers/llvm/rocm/default.nix b/pkgs/development/compilers/llvm/rocm/default.nix
index 94b6ee71032..54a7733f4ba 100644
--- a/pkgs/development/compilers/llvm/rocm/default.nix
+++ b/pkgs/development/compilers/llvm/rocm/default.nix
@@ -1,12 +1,12 @@
 { lib, stdenv, fetchFromGitHub, callPackage, wrapCCWith }:
 
 let
-  version = "4.0.0";
+  version = "4.0.1";
   src = fetchFromGitHub {
     owner = "RadeonOpenCompute";
     repo = "llvm-project";
     rev = "rocm-${version}";
-    hash = "sha256-nIvqEk18NLtY8Hec2Iq6ufWMblzYJ8SOIXgqomtqa0s=";
+    hash = "sha256-5mQ8tN7A045JCF7tHKgAZAbyVmXOd6Wf0CVUiPA80YM=";
   };
 in rec {
   clang = wrapCCWith rec {
diff --git a/pkgs/development/libraries/amdvlk/default.nix b/pkgs/development/libraries/amdvlk/default.nix
index fb48ef73905..7141849a5e5 100644
--- a/pkgs/development/libraries/amdvlk/default.nix
+++ b/pkgs/development/libraries/amdvlk/default.nix
@@ -21,13 +21,13 @@ let
 
 in stdenv.mkDerivation rec {
   pname = "amdvlk";
-  version = "2020.Q4.6";
+  version = "2021.Q1.2";
 
   src = fetchRepoProject {
     name = "${pname}-src";
     manifest = "https://github.com/GPUOpen-Drivers/AMDVLK.git";
     rev = "refs/tags/v-${version}";
-    sha256 = "wminJxfku8Myag+SI7iLSvS+VzHlUd4c86BbpF/cr1w=";
+    sha256 = "+oAetAHJ530e3IFPJDQiQn5vbUKeI1z0oF3Gy6mRVGM=";
   };
 
   buildInputs = [
diff --git a/pkgs/development/python-modules/gradient-utils/default.nix b/pkgs/development/python-modules/gradient-utils/default.nix
new file mode 100644
index 00000000000..cf0ffb6bb41
--- /dev/null
+++ b/pkgs/development/python-modules/gradient-utils/default.nix
@@ -0,0 +1,46 @@
+{ buildPythonPackage
+, fetchFromGitHub
+, hyperopt
+, lib
+, mock
+, numpy
+, poetry
+, prometheus_client
+, pytestCheckHook
+}:
+
+buildPythonPackage rec {
+  pname = "gradient-utils";
+  version = "0.3.2";
+  format = "pyproject";
+
+  src = fetchFromGitHub {
+    owner = "Paperspace";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "083hnkv19mhvdc8nx28f1nph50c903gxh9g9q8531abv0w8m0744";
+  };
+
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace 'numpy = "1.18.5"' 'numpy = "^1.18.5"' \
+      --replace 'hyperopt = "0.1.2"' 'hyperopt = ">=0.1.2"'
+  '';
+
+  nativeBuildInputs = [ poetry ];
+  checkInputs = [ mock pytestCheckHook ];
+  propagatedBuildInputs = [ hyperopt prometheus_client numpy ];
+
+  preCheck = "export HOSTNAME=myhost-experimentId";
+  disabledTests = [
+    "test_add_metrics_pushes_metrics" # requires a working prometheus push gateway
+  ];
+
+  meta = with lib; {
+    description = "Gradient ML SDK";
+    homepage    = "https://github.com/Paperspace/gradient-utils";
+    license     = licenses.mit;
+    platforms   = platforms.unix;
+    maintainers = with maintainers; [ freezeboy ];
+  };
+}
diff --git a/pkgs/development/python-modules/gradient/default.nix b/pkgs/development/python-modules/gradient/default.nix
new file mode 100644
index 00000000000..14df3b882bb
--- /dev/null
+++ b/pkgs/development/python-modules/gradient/default.nix
@@ -0,0 +1,40 @@
+{ lib, fetchPypi, buildPythonPackage
+, attrs, boto3, requests, gradient_statsd, terminaltables
+, click-completion , click-didyoumean, click-help-colors
+, colorama, requests_toolbelt, gradient-utils, halo, progressbar2
+, marshmallow, pyyaml, websocket_client
+}:
+
+buildPythonPackage rec {
+  pname = "gradient";
+  version = "1.4.0";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "15s21945hg342195ig7nchap5mdnsw931iis92pr7hy8ff0rks3n";
+  };
+
+  postPatch = ''
+    substituteInPlace setup.py \
+      --replace 'attrs<=' 'attrs>=' \
+      --replace 'colorama==' 'colorama>=' \
+      --replace 'PyYAML==' 'PyYAML>=' \
+      --replace 'marshmallow<' 'marshmallow>='
+  '';
+
+  propagatedBuildInputs = [ attrs boto3 requests gradient_statsd terminaltables
+    click-completion click-didyoumean click-help-colors requests_toolbelt
+    colorama gradient-utils halo marshmallow progressbar2 pyyaml websocket_client
+  ];
+
+  # tries to use /homeless-shelter to mimic container usage, etc
+  doCheck = false;
+
+  meta = with lib; {
+    description = "The command line interface for Gradient";
+    homepage    = "https://github.com/Paperspace/gradient-cli";
+    license     = licenses.isc;
+    platforms   = platforms.unix;
+    maintainers = with maintainers; [ thoughtpolice ];
+  };
+}
diff --git a/pkgs/development/python-modules/gradient_sdk/default.nix b/pkgs/development/python-modules/gradient_sdk/default.nix
deleted file mode 100644
index 3dffb38f2ff..00000000000
--- a/pkgs/development/python-modules/gradient_sdk/default.nix
+++ /dev/null
@@ -1,25 +0,0 @@
-{ lib, fetchPypi, buildPythonPackage
-, hyperopt
-}:
-
-buildPythonPackage rec {
-  pname = "gradient_sdk";
-  version = "0.0.4";
-
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "Q9oeYjjgJf2lhxW1ypsweQAPpMglmW9PxgzMsgTqJkY=";
-  };
-
-  propagatedBuildInputs = [ hyperopt ];
-
-  pythonImportsCheck = [ "gradient_sdk" ];
-
-  meta = with lib; {
-    description = "Gradient ML SDK";
-    homepage    = "https://github.com/Paperspace/gradient-sdk";
-    license     = licenses.mit;
-    platforms   = platforms.unix;
-    maintainers = with maintainers; [ freezeboy ];
-  };
-}
diff --git a/pkgs/development/python-modules/halo/default.nix b/pkgs/development/python-modules/halo/default.nix
new file mode 100644
index 00000000000..e167371b42a
--- /dev/null
+++ b/pkgs/development/python-modules/halo/default.nix
@@ -0,0 +1,34 @@
+{ buildPythonPackage
+, colorama
+, fetchPypi
+, isPy27
+, lib
+, log-symbols
+, pytestCheckHook
+, six
+, spinners
+, termcolor }:
+
+buildPythonPackage rec {
+  pname = "halo";
+  version = "0.0.31";
+  disabled = isPy27;
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "1mn97h370ggbc9vi6x8r6akd5q8i512y6kid2nvm67g93r9a6rvv";
+  };
+
+  propagatedBuildInputs = [ colorama log-symbols termcolor six spinners ];
+
+  # Tests are not included in the PyPI distribution and the git repo does not have tagged releases
+  doCheck = false;
+  pythonImportsCheck = [ "halo" ];
+
+  meta = with lib; {
+    description = "Beautiful Spinners for Terminal, IPython and Jupyter.";
+    homepage = "https://github.com/manrajgrover/halo";
+    license = licenses.mit;
+    maintainers = with maintainers; [ urbas ];
+  };
+}
diff --git a/pkgs/development/python-modules/log-symbols/default.nix b/pkgs/development/python-modules/log-symbols/default.nix
new file mode 100644
index 00000000000..f8cdce634ac
--- /dev/null
+++ b/pkgs/development/python-modules/log-symbols/default.nix
@@ -0,0 +1,30 @@
+{ buildPythonPackage
+, colorama
+, fetchPypi
+, isPy27
+, pytestCheckHook
+, lib }:
+
+buildPythonPackage rec {
+  pname = "log_symbols";
+  version = "0.0.14";
+  disabled = isPy27;
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "0mh5d0igw33libfmbsr1ri1p1y644p36nwaa2w6kzrd8w5pvq2yg";
+  };
+
+  propagatedBuildInputs = [ colorama ];
+
+  # Tests are not included in the PyPI distribution and the git repo does not have tagged releases
+  doCheck = false;
+  pythonImportsCheck = [ "log_symbols" ];
+
+  meta = with lib; {
+    description = "Colored Symbols for Various Log Levels.";
+    homepage = "https://github.com/manrajgrover/py-log-symbols";
+    license = licenses.mit;
+    maintainers = with maintainers; [ urbas ];
+  };
+}
diff --git a/pkgs/development/python-modules/paperspace/default.nix b/pkgs/development/python-modules/paperspace/default.nix
deleted file mode 100644
index 86dbffd76b7..00000000000
--- a/pkgs/development/python-modules/paperspace/default.nix
+++ /dev/null
@@ -1,31 +0,0 @@
-{ lib, fetchPypi, buildPythonPackage
-, boto3, requests, gradient_statsd, terminaltables
-, click-completion , click-didyoumean, click-help-colors
-, colorama, requests_toolbelt, gradient_sdk, progressbar2
-}:
-
-buildPythonPackage rec {
-  pname = "paperspace";
-  version = "0.2.0";
-
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "7959305128fea6da8ca0cdc528783a89859dacb9b54bf8eb89fd04a518872191";
-  };
-
-  propagatedBuildInputs = [ boto3 requests gradient_statsd terminaltables
-    click-completion click-didyoumean click-help-colors requests_toolbelt
-    colorama gradient_sdk progressbar2
-  ];
-
-  # tries to use /homeless-shelter to mimic container usage, etc
-  doCheck = false;
-
-  meta = with lib; {
-    description = "Python API for Paperspace Cloud";
-    homepage    = "https://paperspace.com";
-    license     = licenses.isc;
-    platforms   = platforms.unix;
-    maintainers = with maintainers; [ thoughtpolice ];
-  };
-}
diff --git a/pkgs/development/python-modules/spinners/default.nix b/pkgs/development/python-modules/spinners/default.nix
new file mode 100644
index 00000000000..1e71296fd17
--- /dev/null
+++ b/pkgs/development/python-modules/spinners/default.nix
@@ -0,0 +1,26 @@
+{ buildPythonPackage
+, fetchPypi
+, isPy27
+, lib }:
+
+buildPythonPackage rec {
+  pname = "spinners";
+  version = "0.0.24";
+  disabled = isPy27;
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "0zz2z6dpdjdq5z8m8w8dfi8by0ih1zrdq0caxm1anwhxg2saxdhy";
+  };
+
+  # Tests are not included in the PyPI distribution and the git repo does not have tagged releases
+  doCheck = false;
+  pythonImportsCheck = [ "spinners" ];
+
+  meta = with lib; {
+    description = "Spinners for the Terminal.";
+    homepage = "https://github.com/manrajgrover/py-spinners";
+    license = licenses.mit;
+    maintainers = with maintainers; [ urbas ];
+  };
+}
diff --git a/pkgs/development/tools/scry/default.nix b/pkgs/development/tools/scry/default.nix
index dcb8087372d..7346ace2ff3 100644
--- a/pkgs/development/tools/scry/default.nix
+++ b/pkgs/development/tools/scry/default.nix
@@ -1,16 +1,18 @@
-{ lib, fetchFromGitHub, crystal_0_31, coreutils, shards, makeWrapper, which }:
+{ lib, fetchFromGitHub, crystal_0_35, coreutils, makeWrapper }:
+let
+  crystal = crystal_0_35;
 
-let crystal = crystal_0_31;
-
-in crystal.buildCrystalPackage rec {
+in
+crystal.buildCrystalPackage rec {
   pname = "scry";
-  version = "0.8.1";
+  version = "unstable-2020-09-02"; # to make it work with crystal 0.35
 
   src = fetchFromGitHub {
     owner = "crystal-lang-tools";
     repo = pname;
-    rev = "v${version}";
-    sha256 = "0ii4k9l3dgm1c9lllc8ni9dar59lrxik0v9iz7gk3d6v62wwnq79";
+    # rev = "v${version}";
+    rev = "580a1879810a9f5d63d8a0d90fbdaa99d86b58da";
+    sha256 = "sha256-WjpkkHfy38wDj/ejXyyMtd5rLfTRoj/7D+SAhRROnbU=";
   };
 
   # we are already testing for this, so we can ignore the failures
@@ -18,14 +20,12 @@ in crystal.buildCrystalPackage rec {
     rm spec/scry/executable_spec.cr
   '';
 
-  format = "crystal";
+  format = "shards";
 
   nativeBuildInputs = [ makeWrapper ];
 
   shardsFile = ./shards.nix;
 
-  crystalBinaries.scry.src = "src/scry.cr";
-
   postFixup = ''
     wrapProgram $out/bin/scry \
       --prefix PATH : ${lib.makeBinPath [ crystal coreutils ]}
diff --git a/pkgs/development/tools/scry/fix_for_crystal_0_28_and_above.patch b/pkgs/development/tools/scry/fix_for_crystal_0_28_and_above.patch
deleted file mode 100644
index 909b790b81a..00000000000
--- a/pkgs/development/tools/scry/fix_for_crystal_0_28_and_above.patch
+++ /dev/null
@@ -1,20 +0,0 @@
-diff --git a/src/scry/completion_provider.cr b/src/scry/completion_provider.cr
-index 29e0d36..f67438c 100644
---- a/src/scry/completion_provider.cr
-+++ b/src/scry/completion_provider.cr
-@@ -1,4 +1,5 @@
- require "./log"
-+require "compiler/crystal/codegen/target"
- require "compiler/crystal/crystal_path"
- require "./completion/*"
-
-diff --git a/src/scry/parse_analyzer.cr b/src/scry/parse_analyzer.cr
-index d87eca4..bbe9ed5 100644
---- a/src/scry/parse_analyzer.cr
-+++ b/src/scry/parse_analyzer.cr
-@@ -1,4 +1,5 @@
- require "compiler/crystal/syntax"
-+require "compiler/crystal/codegen/target"
- require "compiler/crystal/crystal_path"
- require "./workspace"
- require "./text_document"
diff --git a/pkgs/games/gimx/default.nix b/pkgs/games/gimx/default.nix
new file mode 100644
index 00000000000..727945ff2b4
--- /dev/null
+++ b/pkgs/games/gimx/default.nix
@@ -0,0 +1,72 @@
+{ stdenv, lib, fetchFromGitHub, makeWrapper, curl, libusb1, xorg, libxml2
+, ncurses5, bluez, libmhash, gimxAuth ? "" }:
+
+let
+  gimx-config = fetchFromGitHub {
+    owner = "matlo";
+    repo = "GIMX-configurations";
+    rev = "f31bba7d3be57519540be290cd69ba6a8dc4e4d4";
+    sha256 = "0wpxx2qxyiiblz2qrl5swg00ls1aq7i5vzlk0qlnqdq8ss8jssax";
+  };
+
+in stdenv.mkDerivation rec {
+  pname = "gimx";
+  version = "8.0";
+
+  src = fetchFromGitHub {
+    owner = "matlo";
+    repo = "GIMX";
+    rev = "v${version}";
+    fetchSubmodules = true;
+    sha256 = "0265gg6q7ymg76fb4pjrfdwjd280b3zzry96qy92w0h411slph85";
+  };
+
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [
+    curl libusb1 bluez libxml2 ncurses5 libmhash
+    xorg.libX11 xorg.libXi xorg.libXext
+  ];
+
+  patches = [ ./env.patch ];
+  prePatch = (if gimxAuth == "afterglow" then (import ./variant.nix).afterglow
+              else "");
+
+  makeFlags = "build-core";
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out
+    substituteInPlace ./core/Makefile --replace "chmod ug+s" "echo"
+
+    export DESTDIR="$out"
+    make install-shared install-core
+    mv $out/usr/lib $out/lib
+    mv $out/usr/bin $out/bin
+    rmdir $out/usr
+
+    runHook postInstall
+  '';
+
+  postInstall = ''
+    mkdir -p $out/share
+    cp -r ./loader/firmware $out/share/firmware
+    cp -r ${gimx-config}/Linux $out/share/config
+    patch ${gimx-config}/Linux/Dualshock4.xml ${./ds4.patch} -o $out/share/DS4_noff.xml
+
+    makeWrapper $out/bin/gimx $out/bin/gimx-with-confs \
+      --set GIMXCONF $out/share
+
+    makeWrapper $out/bin/gimx $out/bin/gimx-test-ds4 \
+      --set GIMXCONF $out/share \
+      --add-flags "--nograb" --add-flags "--curses" \
+      --add-flags "-p /dev/ttyUSB0" --add-flags "-c DS4_noff.xml"
+  '';
+
+  meta = with lib; {
+    homepage = "https://github.com/matlo/GIMX";
+    description = "Game Input Multiplexer";
+    license = licenses.gpl3Only;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ bb2020 ];
+  };
+}
diff --git a/pkgs/games/gimx/ds4.patch b/pkgs/games/gimx/ds4.patch
new file mode 100644
index 00000000000..86b36adda23
--- /dev/null
+++ b/pkgs/games/gimx/ds4.patch
@@ -0,0 +1,16 @@
+diff --git a/Linux/Dualshock4.xml b/Linux/Dualshock4.xml
+index 5e53ed3..45ee5ed 100644
+--- a/Linux/Dualshock4.xml
++++ b/Linux/Dualshock4.xml
+@@ -94,6 +94,11 @@
+         </axis>
+       </axis_map>
+       <joystick_corrections_list/>
++      <force_feedback>
++        <device type="joystick" id="0" name="Sony Computer Entertainment Wireless Controller"/>
++        <inversion enable="no"/>
++        <gain rumble="0" constant="0" spring="0" damper="0"/>
++      </force_feedback>
+     </configuration>
+   </controller>
+ </root>
diff --git a/pkgs/games/gimx/env.patch b/pkgs/games/gimx/env.patch
new file mode 100644
index 00000000000..e1f8ed8bb6f
--- /dev/null
+++ b/pkgs/games/gimx/env.patch
@@ -0,0 +1,30 @@
+--- a/core/config_reader.c
++++ b/core/config_reader.c
+@@ -1353,8 +1353,10 @@ static int read_file(char* file_path)
+ int read_config_file(const char* file)
+ {
+   char file_path[PATH_MAX];
+-
+-  snprintf(file_path, sizeof(file_path), "%s%s%s%s", gimx_params.homedir, GIMX_DIR, CONFIG_DIR, file);
++  char* e = getenv("GIMXCONF"); if (e) { snprintf(file_path, sizeof(file_path), "%s/%s", e, file); }
++  else {
++    snprintf(file_path, sizeof(file_path), "%s%s%s%s", gimx_params.homedir, GIMX_DIR, CONFIG_DIR, file);
++  }
+ 
+   if(read_file(file_path) == -1)
+   {
+--- a/core/gimx.c
++++ b/core/gimx.c
+@@ -190,8 +190,10 @@ void show_config()
+   }
+ 
+   char file_path[PATH_MAX];
+-
+-  snprintf(file_path, sizeof(file_path), "%s%s%s%s", gimx_params.homedir, GIMX_DIR, CONFIG_DIR, gimx_params.config_file);
++  char* e = getenv("GIMXCONF"); if (e) { snprintf(file_path, sizeof(file_path), "%s/%s", e, gimx_params.config_file); }
++  else {
++    snprintf(file_path, sizeof(file_path), "%s%s%s%s", gimx_params.homedir, GIMX_DIR, CONFIG_DIR, gimx_params.config_file);
++  }
+ 
+   FILE * fp = gfile_fopen(file_path, "r");
+   if (fp == NULL)
diff --git a/pkgs/games/gimx/variant.nix b/pkgs/games/gimx/variant.nix
new file mode 100644
index 00000000000..8396f72b4e7
--- /dev/null
+++ b/pkgs/games/gimx/variant.nix
@@ -0,0 +1,14 @@
+{
+  afterglow = ''
+    substituteInPlace ./shared/gimxcontroller/include/x360.h \
+      --replace "0x045e" "0x0e6f" --replace "0x028e" "0x0213"
+
+    HEX="./loader/firmware/EMU360.hex"
+    sed -i '34s|1B2100|1B2110|' "$HEX"
+    sed -i '38s|092100|092110|' "$HEX"
+    sed -i '40s|5E048E021001|6F0E13020001|' "$HEX"
+    sed -i '34s|1C\r|0C\r|' "$HEX"
+    sed -i '38s|FE\r|EE\r|' "$HEX"
+    sed -i '40s|6D\r|DD\r|' "$HEX"
+  '';
+}
diff --git a/pkgs/misc/vim-plugins/overrides.nix b/pkgs/misc/vim-plugins/overrides.nix
index 6fefca59271..a7ee9d2db1f 100644
--- a/pkgs/misc/vim-plugins/overrides.nix
+++ b/pkgs/misc/vim-plugins/overrides.nix
@@ -297,8 +297,11 @@ self: super: {
   });
 
   sql-nvim = super.sql-nvim.overrideAttrs(old: {
-    buildInputs = [ sqlite ];
-  });
+    postPatch = ''
+      substituteInPlace lua/sql/defs.lua \
+        --replace "vim.g.sql_clib_path or" "vim.g.sql_clib_path or '${sqlite.out}/lib/libsqlite3.so' or"
+    '';
+   });
 
   sved = let
     # we put the script in its own derivation to benefit the magic of wrapGAppsHook
@@ -687,6 +690,10 @@ self: super: {
     '';
   });
 
+  telescope-frecency-nvim = super.telescope-frecency-nvim.overrideAttrs(old: {
+    dependencies = [ self.sql-nvim ];
+  });
+
   telescope-fzy-native-nvim = super.telescope-fzy-native-nvim.overrideAttrs (old: {
     preFixup =
       let
diff --git a/pkgs/os-specific/linux/wpa_supplicant/default.nix b/pkgs/os-specific/linux/wpa_supplicant/default.nix
index 32b61b02bee..c90407ec6e6 100644
--- a/pkgs/os-specific/linux/wpa_supplicant/default.nix
+++ b/pkgs/os-specific/linux/wpa_supplicant/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, openssl, pkg-config, libnl
+{ lib, stdenv, fetchurl, fetchpatch, openssl, pkg-config, libnl
 , dbus, readline ? null, pcsclite ? null
 }:
 
@@ -19,6 +19,12 @@ stdenv.mkDerivation rec {
       url = "https://w1.fi/security/2019-7/0001-AP-Silently-ignore-management-frame-from-unexpected-.patch";
       sha256 = "15xjyy7crb557wxpx898b5lnyblxghlij0xby5lmj9hpwwss34dz";
     })
+    (fetchpatch {
+      # Expose OWE key management capability over DBus, remove >= 2.10
+      name = "dbus-Export-OWE-capability-and-OWE-BSS-key_mgmt.patch";
+      url = "https://w1.fi/cgit/hostap/patch/?id=7800725afb27397f7d6033d4969e2aeb61af4737";
+      sha256 = "0c1la7inf4m5y9gzdjjdnhpkx32pm8vi6m5knih8p77q4mbrdgg8";
+    })
   ];
 
   # TODO: Patch epoll so that the dbus actually responds
@@ -32,6 +38,7 @@ stdenv.mkDerivation rec {
     CONFIG_EAP_SAKE=y
     CONFIG_EAP_GPSK=y
     CONFIG_EAP_GPSK_SHA256=y
+    CONFIG_OWE=y
     CONFIG_WPS=y
     CONFIG_WPS_ER=y
     CONFIG_WPS_NFS=y
diff --git a/pkgs/os-specific/linux/zfs/default.nix b/pkgs/os-specific/linux/zfs/default.nix
index 86deebb5014..d61c0931e20 100644
--- a/pkgs/os-specific/linux/zfs/default.nix
+++ b/pkgs/os-specific/linux/zfs/default.nix
@@ -21,6 +21,12 @@ let
   buildKernel = any (n: n == configFile) [ "kernel" "all" ];
   buildUser = any (n: n == configFile) [ "user" "all" ];
 
+  # remove this patch at the next ZFS release (> 2.0.1)
+  reapplyPathSanitizerPatch = fetchpatch {
+    url = "https://github.com/openzfs/zfs/commit/03f036cbccdd8699f5fe8540ef317595a35bceb8.patch";
+    sha256 = "c157bbb6551a4e720c3faba005e1b72e4692d304c6ff5e0e685691bd47197dca";
+  };
+
   common = { version
     , sha256
     , extraPatches ? []
@@ -190,7 +196,7 @@ in {
 
     sha256 = "0wmw823ildwm9rcfyk22pvzg100yhps3y9hfjlrpspfd1hhkbp0d";
 
-    extraPatches = [ ];
+    extraPatches = [ reapplyPathSanitizerPatch ];
   };
 
   zfsUnstable = common {
@@ -202,6 +208,6 @@ in {
 
     sha256 = "0wmw823ildwm9rcfyk22pvzg100yhps3y9hfjlrpspfd1hhkbp0d";
 
-    extraPatches = [ ];
+    extraPatches = [ reapplyPathSanitizerPatch ];
   };
 }
diff --git a/pkgs/servers/http/jetty/default.nix b/pkgs/servers/http/jetty/default.nix
index d6207e79554..d95740b6d15 100644
--- a/pkgs/servers/http/jetty/default.nix
+++ b/pkgs/servers/http/jetty/default.nix
@@ -2,14 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "jetty";
-  version = "9.4.35.v20201120";
+  version = "9.4.36.v20210114";
   src = fetchurl {
     url = "https://repo1.maven.org/maven2/org/eclipse/jetty/jetty-distribution/${version}/jetty-distribution-${version}.tar.gz";
-    name = "jetty-distribution-${version}.tar.gz";
-    sha256 = "1cpdrqz6wi7fd228lh4ijs82jq51qr5aym6vff464w3y2sd0jbav";
+    sha256 = "1bsqxzjcdgdg2qdgc64pvrimkn9j2di2s3prlgdpbwi566744q54";
   };
 
-  phases = [ "unpackPhase" "installPhase" ];
+  dontBuild = true;
 
   installPhase = ''
     mkdir -p $out
diff --git a/pkgs/servers/klipper/default.nix b/pkgs/servers/klipper/default.nix
index 9c44dabe3df..23b44be0316 100644
--- a/pkgs/servers/klipper/default.nix
+++ b/pkgs/servers/klipper/default.nix
@@ -2,16 +2,17 @@
 , lib
 , fetchFromGitHub
 , python2
+, unstableGitUpdater
 }:
 stdenv.mkDerivation rec {
   name = "klipper";
-  version = "0.9.1";
+  version = "unstable-2021-01-31";
 
   src = fetchFromGitHub {
     owner = "KevinOConnor";
     repo = "klipper";
-    rev = "v${version}";
-    sha256 = "1wgklngsz6xxl25qxi9fkqhbyhwy61iyyk76ycq68b3miayrkgpj";
+    rev = "ef4d9c3abd30ae8a485020fd9ff2fb4529a143b3";
+    sha256 = "puAkSGL0DD0JUWejPdzr7zKIW2UP2soBBtgm2msUKzA=";
   };
 
   sourceRoot = "source/klippy";
@@ -39,6 +40,8 @@ stdenv.mkDerivation rec {
     runHook postInstall
   '';
 
+  passthru.updateScript = unstableGitUpdater { url = meta.homepage; };
+
   meta = with lib; {
     description = "The Klipper 3D printer firmware";
     homepage = "https://github.com/KevinOConnor/klipper";
diff --git a/pkgs/servers/nextcloud/default.nix b/pkgs/servers/nextcloud/default.nix
index 3bea50b5620..e146adbe12c 100644
--- a/pkgs/servers/nextcloud/default.nix
+++ b/pkgs/servers/nextcloud/default.nix
@@ -58,7 +58,7 @@ in {
   };
 
   nextcloud20 = generic {
-    version = "20.0.5";
-    sha256 = "5c70dd33024012a1651fd099133d052d129a4dadc6935f44bb9c3e2b360befe3";
+    version = "20.0.6";
+    sha256 = "859167170402b876b6ef1a37fa4aaa5617b6bf847bb5d50a94f636bae65a34b9";
   };
 }
diff --git a/pkgs/tools/audio/beets/default.nix b/pkgs/tools/audio/beets/default.nix
index f72692c845c..d531b22738b 100644
--- a/pkgs/tools/audio/beets/default.nix
+++ b/pkgs/tools/audio/beets/default.nix
@@ -2,6 +2,7 @@
 , pythonPackages, imagemagick, gobject-introspection, gst_all_1
 , runtimeShell
 , fetchpatch
+, unstableGitUpdater
 
 # Attributes needed for tests of the external plugins
 , callPackage, beets
@@ -132,13 +133,13 @@ in pythonPackages.buildPythonApplication rec {
   # unstable does not require bs1770gain[2].
   # [1]: https://discourse.beets.io/t/forming-a-beets-core-team/639
   # [2]: https://github.com/NixOS/nixpkgs/pull/90504
-  version = "unstable-2020-12-22";
+  version = "unstable-2021-01-29";
 
   src = fetchFromGitHub {
     owner = "beetbox";
     repo = "beets";
-    rev = "53dcb24d10788897f20c341774b474808ec2c0b6";
-    sha256 = "sha256-P++NA13T2TRHW3Se10np8BSe/WRBYAKRte5xKoHKW50=";
+    rev = "04ea754d00e2873ae9aa2d9e07c5cefd790eaee2";
+    sha256 = "sha256-BIa3hnOsBxThbA2WCE4q9eaFNtObr3erZBBqobVOSiQ=";
   };
 
   propagatedBuildInputs = [
@@ -290,6 +291,7 @@ in pythonPackages.buildPythonApplication rec {
 
   passthru = {
     externalPlugins = plugins;
+    updateScript = unstableGitUpdater { url = "https://github.com/beetbox/beets"; };
   };
 
   meta = {
diff --git a/pkgs/tools/security/ssh-to-pgp/default.nix b/pkgs/tools/security/ssh-to-pgp/default.nix
new file mode 100644
index 00000000000..487cc44cdd7
--- /dev/null
+++ b/pkgs/tools/security/ssh-to-pgp/default.nix
@@ -0,0 +1,29 @@
+{ lib, fetchFromGitHub, buildGoModule, gnupg }:
+
+buildGoModule rec {
+  pname = "ssh-to-pgp";
+  version = "1.0.0";
+
+  src = fetchFromGitHub {
+    owner = "Mic92";
+    repo = "ssh-to-pgp";
+    rev = version;
+    sha256 = "sha256-TDrpnWAez8muysMdmKFBDZfK8CyhGn1VqHB8+zD6jSk=";
+  };
+
+  vendorSha256 = "sha256-ZF/WsmqmGHZIAGTPKJ70UhtmssNhiInEZfzrKxQLw9I=";
+
+  checkInputs = [ gnupg ];
+  checkPhase = ''
+    HOME=$TMPDIR go test .
+  '';
+
+  doCheck = true;
+
+  meta = with lib; {
+    description = "Convert ssh private keys to PGP";
+    homepage = "https://github.com/Mic92/ssh-to-pgp";
+    license = licenses.mit;
+    maintainers = with maintainers; [ mic92 ];
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 7f69d035573..fb49cde2e6b 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -2908,6 +2908,16 @@ in
 
   beanstalkd = callPackage ../servers/beanstalkd { };
 
+  bee = callPackage ../applications/networking/bee/bee.nix {
+    version = "release";
+  };
+
+  bee-unstable = bee.override {
+    version = "unstable";
+  };
+
+  bee-clef = callPackage ../applications/networking/bee/bee-clef.nix { };
+
   beets = callPackage ../tools/audio/beets {
     pythonPackages = python3Packages;
   };
@@ -7900,6 +7910,8 @@ in
 
   ssh-chat = callPackage ../applications/networking/instant-messengers/ssh-chat { };
 
+  ssh-to-pgp = callPackage ../tools/security/ssh-to-pgp { };
+
   suricata = callPackage ../applications/networking/ids/suricata {
     python = python3;
   };
@@ -9570,7 +9582,7 @@ in
 
   icr = callPackage ../development/tools/icr { };
 
-  scry = callPackage ../development/tools/scry {};
+  scry = callPackage ../development/tools/scry { };
 
   dasm = callPackage ../development/compilers/dasm/default.nix { };
 
@@ -26549,6 +26561,9 @@ in
 
   gemrb = callPackage ../games/gemrb { };
 
+  gimx = callPackage ../games/gimx {};
+  gimx-afterglow = lowPrio (gimx.override { gimxAuth = "afterglow"; });
+
   gl117 = callPackage ../games/gl-117 {};
 
   globulation2 = callPackage ../games/globulation {
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index c612cb9cde1..c13d9e079d2 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -2755,7 +2755,9 @@ in {
 
   gpyopt = callPackage ../development/python-modules/gpyopt { };
 
-  gradient_sdk = callPackage ../development/python-modules/gradient_sdk { };
+  gradient = callPackage ../development/python-modules/gradient { };
+
+  gradient-utils = callPackage ../development/python-modules/gradient-utils { };
 
   gradient_statsd = callPackage ../development/python-modules/gradient_statsd { };
 
@@ -2879,6 +2881,8 @@ in {
 
   ha-ffmpeg = callPackage ../development/python-modules/ha-ffmpeg { };
 
+  halo = callPackage ../development/python-modules/halo { };
+
   handout = callPackage ../development/python-modules/handout { };
 
   HAP-python = callPackage ../development/python-modules/HAP-python { };
@@ -3782,6 +3786,8 @@ in {
 
   lockfile = callPackage ../development/python-modules/lockfile { };
 
+  log-symbols = callPackage ../development/python-modules/log-symbols { };
+
   Logbook = callPackage ../development/python-modules/Logbook { };
 
   logfury = callPackage ../development/python-modules/logfury { };
@@ -4648,8 +4654,6 @@ in {
 
   papermill = callPackage ../development/python-modules/papermill { };
 
-  paperspace = callPackage ../development/python-modules/paperspace { };
-
   openpaperwork-core = callPackage ../applications/office/paperwork/openpaperwork-core.nix { };
   openpaperwork-gtk = callPackage ../applications/office/paperwork/openpaperwork-gtk.nix { };
   paperwork-backend = callPackage ../applications/office/paperwork/paperwork-backend.nix { };
@@ -7300,6 +7304,8 @@ in {
 
   sphfile = callPackage ../development/python-modules/sphfile { };
 
+  spinners = callPackage ../development/python-modules/spinners { };
+
   sphinxcontrib-applehelp = callPackage ../development/python-modules/sphinxcontrib-applehelp { };
 
   sphinxcontrib-autoapi = callPackage ../development/python-modules/sphinxcontrib-autoapi { };