diff --git a/nixos/modules/installer/tools/nix-fallback-paths.nix b/nixos/modules/installer/tools/nix-fallback-paths.nix
index 842976c3574..bfd8970d2b2 100644
--- a/nixos/modules/installer/tools/nix-fallback-paths.nix
+++ b/nixos/modules/installer/tools/nix-fallback-paths.nix
@@ -1,6 +1,6 @@
 {
-  x86_64-linux = "/nix/store/8928ygfyf9iassfrnj76v55s6zid58ja-nix-2.3.4";
-  i686-linux = "/nix/store/b5cx3nmba9ahx3wk5ybxa67k40pdpdxn-nix-2.3.4";
-  aarch64-linux = "/nix/store/p6j4mis6agdjlk4j0cyg7yh58wpm3kif-nix-2.3.4";
-  x86_64-darwin = "/nix/store/aizhr07dljmlbf17wfrj40x3s0b5iv3d-nix-2.3.4";
+  x86_64-linux = "/nix/store/xb0nl3z356n0sfrhswfli2g19a19slys-nix-2.3.5";
+  i686-linux = "/nix/store/k8kdd4yy1yap6lai5idyhmzcwsjh1fik-nix-2.3.5";
+  aarch64-linux = "/nix/store/dr86cbipxqjcb8pf2k0v8wvw0h0adfpz-nix-2.3.5";
+  x86_64-darwin = "/nix/store/n6dqdndkv9kac66kdr988kaiyavl44x8-nix-2.3.5";
 }
diff --git a/nixos/modules/services/databases/mysql.nix b/nixos/modules/services/databases/mysql.nix
index 44183788d93..51885881cf7 100644
--- a/nixos/modules/services/databases/mysql.nix
+++ b/nixos/modules/services/databases/mysql.nix
@@ -32,13 +32,7 @@ in
 
     services.mysql = {
 
-      enable = mkOption {
-        type = types.bool;
-        default = false;
-        description = "
-          Whether to enable the MySQL server.
-        ";
-      };
+      enable = mkEnableOption "MySQL server";
 
       package = mkOption {
         type = types.package;
diff --git a/nixos/modules/services/databases/rethinkdb.nix b/nixos/modules/services/databases/rethinkdb.nix
index f18fbaf5b06..c764d6c21c6 100644
--- a/nixos/modules/services/databases/rethinkdb.nix
+++ b/nixos/modules/services/databases/rethinkdb.nix
@@ -15,10 +15,7 @@ in
 
     services.rethinkdb = {
 
-      enable = mkOption {
-        default = false;
-        description = "Whether to enable the RethinkDB server.";
-      };
+      enable = mkEnableOption "RethinkDB server";
 
       #package = mkOption {
       #  default = pkgs.rethinkdb;
diff --git a/nixos/modules/services/desktops/deepin/deepin.nix b/nixos/modules/services/desktops/deepin/deepin.nix
index 931bac58ace..f8fb73701af 100644
--- a/nixos/modules/services/desktops/deepin/deepin.nix
+++ b/nixos/modules/services/desktops/deepin/deepin.nix
@@ -41,7 +41,6 @@
         pkgs.deepin.dde-session-ui
         pkgs.deepin.deepin-anything
         pkgs.deepin.deepin-image-viewer
-        pkgs.deepin.deepin-screenshot
       ];
 
       services.dbus.packages = [
@@ -55,7 +54,6 @@
         pkgs.deepin.dde-session-ui
         pkgs.deepin.deepin-anything
         pkgs.deepin.deepin-image-viewer
-        pkgs.deepin.deepin-screenshot
       ];
 
       systemd.packages = [
diff --git a/nixos/modules/services/networking/dnscrypt-wrapper.nix b/nixos/modules/services/networking/dnscrypt-wrapper.nix
index e53fb7a1578..b9333cd19a2 100644
--- a/nixos/modules/services/networking/dnscrypt-wrapper.nix
+++ b/nixos/modules/services/networking/dnscrypt-wrapper.nix
@@ -5,12 +5,20 @@ let
   cfg     = config.services.dnscrypt-wrapper;
   dataDir = "/var/lib/dnscrypt-wrapper";
 
+  mkPath = path: default:
+    if path != null
+      then toString path
+      else default;
+
+  publicKey = mkPath cfg.providerKey.public "${dataDir}/public.key";
+  secretKey = mkPath cfg.providerKey.secret "${dataDir}/secret.key";
+
   daemonArgs = with cfg; [
     "--listen-address=${address}:${toString port}"
     "--resolver-address=${upstream.address}:${toString upstream.port}"
     "--provider-name=${providerName}"
-    "--provider-publickey-file=public.key"
-    "--provider-secretkey-file=secret.key"
+    "--provider-publickey-file=${publicKey}"
+    "--provider-secretkey-file=${secretKey}"
     "--provider-cert-file=${providerName}.crt"
     "--crypt-secretkey-file=${providerName}.key"
   ];
@@ -24,17 +32,19 @@ let
       dnscrypt-wrapper --gen-cert-file \
         --crypt-secretkey-file=${cfg.providerName}.key \
         --provider-cert-file=${cfg.providerName}.crt \
-        --provider-publickey-file=public.key \
-        --provider-secretkey-file=secret.key \
+        --provider-publickey-file=${publicKey} \
+        --provider-secretkey-file=${secretKey} \
         --cert-file-expire-days=${toString cfg.keys.expiration}
     }
 
     cd ${dataDir}
 
     # generate provider keypair (first run only)
-    if [ ! -f public.key ] || [ ! -f secret.key ]; then
-      dnscrypt-wrapper --gen-provider-keypair
-    fi
+    ${optionalString (cfg.providerKey.public == null || cfg.providerKey.secret == null) ''
+      if [ ! -f ${publicKey} ] || [ ! -f ${secretKey} ]; then
+        dnscrypt-wrapper --gen-provider-keypair
+      fi
+    ''}
 
     # generate new keys for rotation
     if [ ! -f ${cfg.providerName}.key ] || [ ! -f ${cfg.providerName}.crt ]; then
@@ -64,6 +74,47 @@ let
     fi
   '';
 
+
+  # This is the fork of the original dnscrypt-proxy maintained by Dyne.org.
+  # dnscrypt-proxy2 doesn't provide the `--test` feature that is needed to
+  # correctly implement key rotation of dnscrypt-wrapper ephemeral keys.
+  dnscrypt-proxy1 = pkgs.callPackage
+    ({ stdenv, fetchFromGitHub, autoreconfHook
+    , pkgconfig, libsodium, ldns, openssl, systemd }:
+
+    stdenv.mkDerivation rec {
+      pname = "dnscrypt-proxy";
+      version = "2019-08-20";
+
+      src = fetchFromGitHub {
+        owner = "dyne";
+        repo = "dnscrypt-proxy";
+        rev = "07ac3825b5069adc28e2547c16b1d983a8ed8d80";
+        sha256 = "0c4mq741q4rpmdn09agwmxap32kf0vgfz7pkhcdc5h54chc3g3xy";
+      };
+
+      configureFlags = optional stdenv.isLinux "--with-systemd";
+
+      nativeBuildInputs = [ autoreconfHook pkgconfig ];
+
+      # <ldns/ldns.h> depends on <openssl/ssl.h>
+      buildInputs = [ libsodium openssl.dev ldns ] ++ optional stdenv.isLinux systemd;
+
+      postInstall = ''
+        # Previous versions required libtool files to load plugins; they are
+        # now strictly optional.
+        rm $out/lib/dnscrypt-proxy/*.la
+      '';
+
+      meta = {
+        description = "A tool for securing communications between a client and a DNS resolver";
+        homepage = "https://github.com/dyne/dnscrypt-proxy";
+        license = licenses.isc;
+        maintainers = with maintainers; [ rnhmjoj ];
+        platforms = platforms.linux;
+      };
+    }) { };
+
 in {
 
 
@@ -98,6 +149,26 @@ in {
       '';
     };
 
+    providerKey.public = mkOption {
+      type = types.nullOr types.path;
+      default = null;
+      example = "/etc/secrets/public.key";
+      description = ''
+        The filepath to the provider public key. If not given a new
+        provider key pair will be generated on the first run.
+      '';
+    };
+
+    providerKey.secret = mkOption {
+      type = types.nullOr types.path;
+      default = null;
+      example = "/etc/secrets/secret.key";
+      description = ''
+        The filepath to the provider secret key. If not given a new
+        provider key pair will be generated on the first run.
+      '';
+    };
+
     upstream.address = mkOption {
       type = types.str;
       default = "127.0.0.1";
@@ -179,7 +250,7 @@ in {
       requires = [ "dnscrypt-wrapper.service" ];
       description = "Rotates DNSCrypt wrapper keys if soon to expire";
 
-      path   = with pkgs; [ dnscrypt-wrapper dnscrypt-proxy gawk ];
+      path   = with pkgs; [ dnscrypt-wrapper dnscrypt-proxy1 gawk ];
       script = rotateKeys;
       serviceConfig.User = "dnscrypt-wrapper";
     };
@@ -196,6 +267,13 @@ in {
       };
     };
 
+    assertions = with cfg; [
+      { assertion = (providerKey.public == null && providerKey.secret == null) ||
+                    (providerKey.secret != null && providerKey.public != null);
+        message = "The secret and public provider key must be set together.";
+      }
+    ];
+
   };
 
   meta.maintainers = with lib.maintainers; [ rnhmjoj ];
diff --git a/nixos/modules/services/x11/desktop-managers/plasma5.nix b/nixos/modules/services/x11/desktop-managers/plasma5.nix
index 60ef0159ff1..6d48b899d23 100644
--- a/nixos/modules/services/x11/desktop-managers/plasma5.nix
+++ b/nixos/modules/services/x11/desktop-managers/plasma5.nix
@@ -158,6 +158,19 @@ in
         example = "vlc";
         description = "Phonon audio backend to install.";
       };
+
+      supportDDC = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          Support setting monitor brightness via DDC.
+          </para>
+          <para>
+          This is not needed for controlling brightness of the internal monitor
+          of a laptop and as it is considered experimental by upstream, it is
+          disabled by default.
+        '';
+      };
     };
 
   };
@@ -184,6 +197,12 @@ in
         };
       };
 
+      # DDC support
+      boot.kernelModules = lib.optional cfg.supportDDC "i2c_dev";
+      services.udev.extraRules = lib.optionalString cfg.supportDDC ''
+        KERNEL=="i2c-[0-9]*", TAG+="uaccess"
+      '';
+
       environment.systemPackages = with pkgs; with qt5; with libsForQt5; with plasma5; with kdeApplications;
         [
           frameworkintegration
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 611e89b7285..f3b36e5fa13 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -70,6 +70,7 @@ in
   deluge = handleTest ./deluge.nix {};
   dhparams = handleTest ./dhparams.nix {};
   dnscrypt-proxy2 = handleTestOn ["x86_64-linux"] ./dnscrypt-proxy2.nix {};
+  dnscrypt-wrapper = handleTestOn ["x86_64-linux"] ./dnscrypt-wrapper {};
   doas = handleTest ./doas.nix {};
   docker = handleTestOn ["x86_64-linux"] ./docker.nix {};
   oci-containers = handleTestOn ["x86_64-linux"] ./oci-containers.nix {};
diff --git a/nixos/tests/dnscrypt-wrapper/default.nix b/nixos/tests/dnscrypt-wrapper/default.nix
new file mode 100644
index 00000000000..1dc925f4de7
--- /dev/null
+++ b/nixos/tests/dnscrypt-wrapper/default.nix
@@ -0,0 +1,71 @@
+import ../make-test-python.nix ({ pkgs, ... }: {
+  name = "dnscrypt-wrapper";
+  meta = with pkgs.stdenv.lib.maintainers; {
+    maintainers = [ rnhmjoj ];
+  };
+
+  nodes = {
+    server = { lib, ... }:
+      { services.dnscrypt-wrapper = with builtins;
+          { enable = true;
+            address = "192.168.1.1";
+            keys.expiration = 5; # days
+            keys.checkInterval = 2;  # min
+            # The keypair was generated by the command:
+            # dnscrypt-wrapper --gen-provider-keypair \
+            #  --provider-name=2.dnscrypt-cert.server \
+            #  --ext-address=192.168.1.1:5353
+            providerKey.public = toFile "public.key" (readFile ./public.key);
+            providerKey.secret = toFile "secret.key" (readFile ./secret.key);
+          };
+        services.tinydns.enable = true;
+        services.tinydns.data = ''
+          ..:192.168.1.1:a
+          +it.works:1.2.3.4
+        '';
+        networking.firewall.allowedUDPPorts = [ 5353 ];
+        networking.firewall.allowedTCPPorts = [ 5353 ];
+        networking.interfaces.eth1.ipv4.addresses = lib.mkForce
+          [ { address = "192.168.1.1"; prefixLength = 24; } ];
+      };
+
+    client = { lib, ... }:
+      { services.dnscrypt-proxy2.enable = true;
+        services.dnscrypt-proxy2.settings = {
+          server_names = [ "server" ];
+          static.server.stamp = "sdns://AQAAAAAAAAAAEDE5Mi4xNjguMS4xOjUzNTMgFEHYOv0SCKSuqR5CDYa7-58cCBuXO2_5uTSVU9wNQF0WMi5kbnNjcnlwdC1jZXJ0LnNlcnZlcg";
+        };
+        networking.nameservers = [ "127.0.0.1" ];
+        networking.interfaces.eth1.ipv4.addresses = lib.mkForce
+          [ { address = "192.168.1.2"; prefixLength = 24; } ];
+      };
+
+  };
+
+  testScript = ''
+    start_all()
+
+    with subtest("The server can generate the ephemeral keypair"):
+        server.wait_for_unit("dnscrypt-wrapper")
+        server.wait_for_file("/var/lib/dnscrypt-wrapper/2.dnscrypt-cert.server.key")
+        server.wait_for_file("/var/lib/dnscrypt-wrapper/2.dnscrypt-cert.server.crt")
+
+    with subtest("The client can connect to the server"):
+        server.wait_for_unit("tinydns")
+        client.wait_for_unit("dnscrypt-proxy2")
+        assert "1.2.3.4" in client.succeed(
+            "host it.works"
+        ), "The IP address of 'it.works' does not match 1.2.3.4"
+
+    with subtest("The server rotates the ephemeral keys"):
+        # advance time by a little less than 5 days
+        server.succeed("date -s \"$(date --date '4 days 6 hours')\"")
+        client.succeed("date -s \"$(date --date '4 days 6 hours')\"")
+        server.wait_for_file("/var/lib/dnscrypt-wrapper/oldkeys")
+
+    with subtest("The client can still connect to the server"):
+        server.wait_for_unit("dnscrypt-wrapper")
+        client.succeed("host it.works")
+  '';
+})
+
diff --git a/nixos/tests/dnscrypt-wrapper/public.key b/nixos/tests/dnscrypt-wrapper/public.key
new file mode 100644
index 00000000000..80232b97f52
--- /dev/null
+++ b/nixos/tests/dnscrypt-wrapper/public.key
@@ -0,0 +1 @@
+A�:����B
�����;o��4�S�
@]
\ No newline at end of file
diff --git a/nixos/tests/dnscrypt-wrapper/secret.key b/nixos/tests/dnscrypt-wrapper/secret.key
new file mode 100644
index 00000000000..01fbf8e08b7
--- /dev/null
+++ b/nixos/tests/dnscrypt-wrapper/secret.key
@@ -0,0 +1 @@
+G�>Ʃ�
��>��(����J���=�����l�A�:����B
�����;o��4�S�
@]
\ No newline at end of file
diff --git a/pkgs/applications/audio/bshapr/default.nix b/pkgs/applications/audio/bshapr/default.nix
index a2f96bc288c..aa4374c79bc 100644
--- a/pkgs/applications/audio/bshapr/default.nix
+++ b/pkgs/applications/audio/bshapr/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "BShapr";
-  version = "0.8";
+  version = "0.9";
 
   src = fetchFromGitHub {
     owner = "sjaehn";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0jlq5rjicc4fxlpk869dg0l5bwwz8k9aj2wfk9v89b0qw8l8kaxl";
+    sha256 = "04zd3a178i2nivg5rjailzqvc5mlnilmhj1ziygmbhshbrywplri";
   };
 
   nativeBuildInputs = [ pkgconfig ];
diff --git a/pkgs/applications/audio/kid3/default.nix b/pkgs/applications/audio/kid3/default.nix
index cfcad390f4c..e4df8593ced 100644
--- a/pkgs/applications/audio/kid3/default.nix
+++ b/pkgs/applications/audio/kid3/default.nix
@@ -9,11 +9,11 @@
 stdenv.mkDerivation rec {
 
   pname = "kid3";
-  version = "3.8.2";
+  version = "3.8.3";
 
   src = fetchurl {
     url = "mirror://sourceforge/project/kid3/kid3/${version}/${pname}-${version}.tar.gz";
-    sha256 = "051y77swpi9isx275gwzl4fn3igd2dmixbszv9m3h0h9lqhcjrvr";
+    sha256 = "0i0c4bmsm36jj1v535kil47ig0ig70ykrzcw2f56spr25xns06ka";
   };
 
   nativeBuildInputs = [ wrapQtAppsHook ];
diff --git a/pkgs/applications/audio/qtractor/default.nix b/pkgs/applications/audio/qtractor/default.nix
index 344927bce77..f2ee5eac70f 100644
--- a/pkgs/applications/audio/qtractor/default.nix
+++ b/pkgs/applications/audio/qtractor/default.nix
@@ -5,11 +5,11 @@
 
 stdenv.mkDerivation rec {
   pname = "qtractor";
-  version = "0.9.13";
+  version = "0.9.14";
 
   src = fetchurl {
     url = "mirror://sourceforge/${pname}/${pname}-${version}.tar.gz";
-    sha256 = "1hwxdjlzsf1z6xl82s4bdfxa2bfisklrfx361zbzskmg9iymw1gy";
+    sha256 = "1gh268gdpj7nw19xfh7k2l3aban4yrs1lmx33qswrnngs2izj1fk";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/audio/spotify-tui/default.nix b/pkgs/applications/audio/spotify-tui/default.nix
index 91acab35389..693de28bf47 100644
--- a/pkgs/applications/audio/spotify-tui/default.nix
+++ b/pkgs/applications/audio/spotify-tui/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "spotify-tui";
-  version = "0.19.0";
+  version = "0.20.0";
 
   src = fetchFromGitHub {
     owner = "Rigellute";
     repo = "spotify-tui";
     rev = "v${version}";
-    sha256 = "1bdcfkfbvvn262p4j0nb4kvjzzgrvn3kxlif48yipqkkykzsgz6g";
+    sha256 = "1gdsk620md5nv1r05jysmfhpbcidh15wzyiklkazsb6cppm6qsiy";
   };
 
-  cargoSha256 = "13v2ilmfs9468kavlx6wrsp0dscppxbxgygwpdd35p5hq3vnhl7k";
+  cargoSha256 = "0irfdmik6nrpfs9yzva5q351cfyf1cijxa2a08prwdccrivdk98a";
 
   nativeBuildInputs = stdenv.lib.optionals stdenv.isLinux [ pkgconfig python3 ];
   buildInputs = [ ]
diff --git a/pkgs/applications/graphics/fondo/default.nix b/pkgs/applications/graphics/fondo/default.nix
index 877328e8823..cd0ee8e662b 100644
--- a/pkgs/applications/graphics/fondo/default.nix
+++ b/pkgs/applications/graphics/fondo/default.nix
@@ -20,13 +20,13 @@
 
 stdenv.mkDerivation rec {
   pname = "fondo";
-  version = "1.3.8";
+  version = "1.3.9";
 
   src = fetchFromGitHub {
     owner = "calo001";
     repo = pname;
     rev = version;
-    sha256 = "126diirhmm2igxdpgfv1l20wnz5q8hadgq53d0j83ka72mfd3qg6";
+    sha256 = "1gyi80j2c38j62miv8a8nsx1pad169sa4fx0b85m2yv0x7fz492w";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/misc/copyq/default.nix b/pkgs/applications/misc/copyq/default.nix
index ec2bd6b32c0..fb177e8278f 100644
--- a/pkgs/applications/misc/copyq/default.nix
+++ b/pkgs/applications/misc/copyq/default.nix
@@ -5,13 +5,13 @@
 
 mkDerivation rec {
   pname = "CopyQ";
-  version = "3.11.0";
+  version = "3.11.1";
 
   src  = fetchFromGitHub {
     owner = "hluk";
     repo = "CopyQ";
     rev = "v${version}";
-    sha256 = "1wx6nqcyzknbw71sliwq4cb5qq1gy6pr9867s6x3vpg3n8g2czkf";
+    sha256 = "1xxf8d220pa77195d9f3l3scvvyqsh1pvlrbw4cq6ydj9qbp5kf0";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/applications/misc/etesync-dav/default.nix b/pkgs/applications/misc/etesync-dav/default.nix
index 69e2d3d5598..d4e015f31d7 100644
--- a/pkgs/applications/misc/etesync-dav/default.nix
+++ b/pkgs/applications/misc/etesync-dav/default.nix
@@ -2,11 +2,11 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "etesync-dav";
-  version = "0.16.0";
+  version = "0.17.0";
 
   src = python3Packages.fetchPypi {
     inherit pname version;
-    sha256 = "1r0d52rlhg7dz6hziplzy7ypsfx9lgbs76j3ylinh2csplwkzv69";
+    sha256 = "0lyjv8rknwbx5b5nvq5bgw26lhkymib4cvmv3s3469mrnn2c0ksp";
   };
 
   propagatedBuildInputs = with python3Packages; [
diff --git a/pkgs/applications/misc/jekyll/basic/Gemfile.lock b/pkgs/applications/misc/jekyll/basic/Gemfile.lock
index 7bef929bea1..8731ed26838 100644
--- a/pkgs/applications/misc/jekyll/basic/Gemfile.lock
+++ b/pkgs/applications/misc/jekyll/basic/Gemfile.lock
@@ -24,17 +24,17 @@ GEM
     http_parser.rb (0.6.0)
     i18n (1.8.2)
       concurrent-ruby (~> 1.0)
-    jekyll (4.0.1)
+    jekyll (4.1.0)
       addressable (~> 2.4)
       colorator (~> 1.0)
       em-websocket (~> 0.5)
-      i18n (>= 0.9.5, < 2)
+      i18n (~> 1.0)
       jekyll-sass-converter (~> 2.0)
       jekyll-watch (~> 2.0)
       kramdown (~> 2.1)
       kramdown-parser-gfm (~> 1.0)
       liquid (~> 4.0)
-      mercenary (~> 0.3.3)
+      mercenary (~> 0.4.0)
       pathutil (~> 0.9)
       rouge (~> 3.0)
       safe_yaml (~> 1.0)
@@ -64,7 +64,7 @@ GEM
     listen (3.2.1)
       rb-fsevent (~> 0.10, >= 0.10.3)
       rb-inotify (~> 0.9, >= 0.9.10)
-    mercenary (0.3.6)
+    mercenary (0.4.0)
     mini_portile2 (2.4.0)
     minitest (5.14.1)
     nokogiri (1.10.9)
diff --git a/pkgs/applications/misc/jekyll/basic/gemset.nix b/pkgs/applications/misc/jekyll/basic/gemset.nix
index 3faa3dde82c..8c1773f19dc 100644
--- a/pkgs/applications/misc/jekyll/basic/gemset.nix
+++ b/pkgs/applications/misc/jekyll/basic/gemset.nix
@@ -130,10 +130,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1gw05bh9iidnx2lxw0h5aiknbly818cmndc4a9nhq28fiafizi82";
+      sha256 = "0v01g9cwn4v7rnpsl9yvscjzvah3p4xwh03zp37zxkvw5kv004n8";
       type = "gem";
     };
-    version = "4.0.1";
+    version = "4.1.0";
   };
   jekyll-avatar = {
     dependencies = ["jekyll"];
@@ -260,10 +260,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "10la0xw82dh5mqab8bl0dk21zld63cqxb1g16fk8cb39ylc4n21a";
+      sha256 = "0f2i827w4lmsizrxixsrv2ssa3gk1b7lmqh8brk8ijmdb551wnmj";
       type = "gem";
     };
-    version = "0.3.6";
+    version = "0.4.0";
   };
   mini_portile2 = {
     groups = ["default"];
diff --git a/pkgs/applications/misc/jekyll/full/Gemfile.lock b/pkgs/applications/misc/jekyll/full/Gemfile.lock
index 5f956f406fd..8b771bc1c0f 100644
--- a/pkgs/applications/misc/jekyll/full/Gemfile.lock
+++ b/pkgs/applications/misc/jekyll/full/Gemfile.lock
@@ -35,17 +35,17 @@ GEM
     http_parser.rb (0.6.0)
     i18n (1.8.2)
       concurrent-ruby (~> 1.0)
-    jekyll (4.0.1)
+    jekyll (4.1.0)
       addressable (~> 2.4)
       colorator (~> 1.0)
       em-websocket (~> 0.5)
-      i18n (>= 0.9.5, < 2)
+      i18n (~> 1.0)
       jekyll-sass-converter (~> 2.0)
       jekyll-watch (~> 2.0)
       kramdown (~> 2.1)
       kramdown-parser-gfm (~> 1.0)
       liquid (~> 4.0)
-      mercenary (~> 0.3.3)
+      mercenary (~> 0.4.0)
       pathutil (~> 0.9)
       rouge (~> 3.0)
       safe_yaml (~> 1.0)
@@ -90,7 +90,7 @@ GEM
     listen (3.2.1)
       rb-fsevent (~> 0.10, >= 0.10.3)
       rb-inotify (~> 0.9, >= 0.9.10)
-    mercenary (0.3.6)
+    mercenary (0.4.0)
     mime-types (3.3.1)
       mime-types-data (~> 3.2015)
     mime-types-data (3.2020.0512)
diff --git a/pkgs/applications/misc/jekyll/full/gemset.nix b/pkgs/applications/misc/jekyll/full/gemset.nix
index 04844b47310..5f54a4f7382 100644
--- a/pkgs/applications/misc/jekyll/full/gemset.nix
+++ b/pkgs/applications/misc/jekyll/full/gemset.nix
@@ -227,10 +227,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1gw05bh9iidnx2lxw0h5aiknbly818cmndc4a9nhq28fiafizi82";
+      sha256 = "0v01g9cwn4v7rnpsl9yvscjzvah3p4xwh03zp37zxkvw5kv004n8";
       type = "gem";
     };
-    version = "4.0.1";
+    version = "4.1.0";
   };
   jekyll-avatar = {
     dependencies = ["jekyll"];
@@ -457,10 +457,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "10la0xw82dh5mqab8bl0dk21zld63cqxb1g16fk8cb39ylc4n21a";
+      sha256 = "0f2i827w4lmsizrxixsrv2ssa3gk1b7lmqh8brk8ijmdb551wnmj";
       type = "gem";
     };
-    version = "0.3.6";
+    version = "0.4.0";
   };
   mime-types = {
     dependencies = ["mime-types-data"];
diff --git a/pkgs/applications/misc/minder/default.nix b/pkgs/applications/misc/minder/default.nix
index 0b3d65e21e3..28157d61537 100644
--- a/pkgs/applications/misc/minder/default.nix
+++ b/pkgs/applications/misc/minder/default.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "minder";
-  version = "1.7.3";
+  version = "1.8.0";
 
   src = fetchFromGitHub {
     owner = "phase1geo";
     repo = pname;
     rev = version;
-    sha256 = "00lkb1w536jyhka2znxmgbyss13j4h75yvl42z4hlgz31wljcin4";
+    sha256 = "13klasvrndwsmpcxkgy7kvsl2jqmp2cl52vb4i0hk18lr004scgy";
   };
 
   nativeBuildInputs = [ pkgconfig meson ninja python3 wrapGAppsHook vala shared-mime-info ];
diff --git a/pkgs/applications/misc/qcad/default.nix b/pkgs/applications/misc/qcad/default.nix
index 4f046e34b18..3dfda8b9c5f 100644
--- a/pkgs/applications/misc/qcad/default.nix
+++ b/pkgs/applications/misc/qcad/default.nix
@@ -11,13 +11,13 @@
 
 mkDerivationWith stdenv.mkDerivation rec {
   pname = "qcad";
-  version = "3.24.2.1";
+  version = "3.24.3.4";
 
   src = fetchFromGitHub {
     owner = "qcad";
     repo = "qcad";
     rev = "v${version}";
-    sha256 = "1g295gljq051x09f4d8k586bkg3vs8z22dn3rxj6xrm6803z8zw2";
+    sha256 = "0hv9050srrq7fm1fqla8b52mwpilsvr1jriz4ay633s63svss3zz";
   };
 
   patches = [
diff --git a/pkgs/applications/misc/xmrig/default.nix b/pkgs/applications/misc/xmrig/default.nix
index b564c5c530f..8fb07b1ae79 100644
--- a/pkgs/applications/misc/xmrig/default.nix
+++ b/pkgs/applications/misc/xmrig/default.nix
@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   pname = "xmrig";
-  version = "5.11.1";
+  version = "5.11.2";
 
   src = fetchFromGitHub {
     owner = "xmrig";
     repo = "xmrig";
     rev = "v${version}";
-    sha256 = "04wsz7hcmzm5dv9q1wb26nvcz5gxdcgkf00cp5bpbr3y9vc6dyz6";
+    sha256 = "1mhqa9jb4475phhqnkc7k1mwgkan7zp7y4z2c7n2x43r48ghxpfx";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/applications/misc/xmrig/proxy.nix b/pkgs/applications/misc/xmrig/proxy.nix
index 82247d02c66..524e2a99ae9 100644
--- a/pkgs/applications/misc/xmrig/proxy.nix
+++ b/pkgs/applications/misc/xmrig/proxy.nix
@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   pname = "xmrig-proxy";
-  version = "5.10.0";
+  version = "5.10.2";
 
   src = fetchFromGitHub {
     owner = "xmrig";
     repo = "xmrig-proxy";
     rev = "v${version}";
-    sha256 = "1p8bxp2nv30c3j3kb0bpby86378h6m7nv2vvzw06lqsj5fqbw4g5";
+    sha256 = "1mkamkqhqj7nbvaxdim1rbc3f5sw410wzly4ln73ackzlvdwn319";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/applications/misc/yubioath-desktop/default.nix b/pkgs/applications/misc/yubioath-desktop/default.nix
index 2fffee0f0bb..c6a1022288f 100644
--- a/pkgs/applications/misc/yubioath-desktop/default.nix
+++ b/pkgs/applications/misc/yubioath-desktop/default.nix
@@ -6,11 +6,11 @@
 
 mkDerivation rec {
   pname = "yubioath-desktop";
-  version = "5.0.3";
+  version = "5.0.4";
 
   src = fetchurl {
     url = "https://developers.yubico.com/yubioath-desktop/Releases/yubioath-desktop-${version}.tar.gz";
-    sha256 = "1g0jd7mmch6a6n8k5pp3w27qd5cijnvzk05lwraf0i96m68h7x1k";
+    sha256 = "1aw88xvg6gjsfwmmlcrdcgyycn2cp7b8vxjzj14h7igcj02xh84h";
   };
 
   doCheck = false;
diff --git a/pkgs/applications/networking/cluster/helmsman/default.nix b/pkgs/applications/networking/cluster/helmsman/default.nix
index 992b6c4dc5e..09721356806 100644
--- a/pkgs/applications/networking/cluster/helmsman/default.nix
+++ b/pkgs/applications/networking/cluster/helmsman/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "helmsman";
-  version = "3.3.0";
+  version = "3.4.1";
 
   src = fetchFromGitHub {
     owner = "Praqma";
     repo = "helmsman";
     rev = "v${version}";
-    sha256 = "0i7sg3iwxb07gjxcz6chpdcx3fqykzldmf7s1c9m02hkps910ca8";
+    sha256 = "0h89lgp3n7nd7dy8nq4bfxg938imdjsvs1k6yg8j37vgdmi24sa6";
   };
 
   vendorSha256 = "05vnysr5r3hbayss1pyifgp989kjw81h95iack8ady62k6ys5njl";
diff --git a/pkgs/applications/networking/cluster/kubeseal/default.nix b/pkgs/applications/networking/cluster/kubeseal/default.nix
index 9ef8d943aaa..c739be76324 100644
--- a/pkgs/applications/networking/cluster/kubeseal/default.nix
+++ b/pkgs/applications/networking/cluster/kubeseal/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "kubeseal";
-  version = "0.12.3";
+  version = "0.12.4";
 
   src = fetchFromGitHub {
     owner = "bitnami-labs";
     repo = "sealed-secrets";
     rev = "v${version}";
-    sha256 = "1h8n2219xh0gl42kz3rkv3aj3wfwivvs9skwbbrvmrkwwrpxkgdj";
+    sha256 = "1abm63fb40zky5i97wm6h8ifmdf6i71ws9y7217hv2rnja37f4zd";
   };
 
   vendorSha256 = null;
diff --git a/pkgs/applications/networking/cluster/terraform/default.nix b/pkgs/applications/networking/cluster/terraform/default.nix
index ec9f02fe9e2..080bc832544 100644
--- a/pkgs/applications/networking/cluster/terraform/default.nix
+++ b/pkgs/applications/networking/cluster/terraform/default.nix
@@ -118,13 +118,13 @@ in rec {
   terraform_0_11-full = terraform_0_11.full;
 
   terraform_0_12 = pluggable (generic {
-    version = "0.12.25";
-    sha256 = "0xq4327386x6isw82d4xyq70pw7xxlh4sgmqas0b2pvyz85jxdch";
+    version = "0.12.26";
+    sha256 = "1f0n2zdk1jyqcmchsprqfkiivmsmdlpsf5b7x5f1dmvms9jw3268";
     patches = [
         ./provider-path.patch
         (fetchpatch {
             name = "fix-mac-mojave-crashes.patch";
-            url = "https://github.com/hashicorp/terraform/pull/24562.patch";
+            url = "https://github.com/hashicorp/terraform/commit/cd65b28da051174a13ac76e54b7bb95d3051255c.patch";
             sha256 = "1k70kk4hli72x8gza6fy3vpckdm3sf881w61fmssrah3hgmfmbrs";
         }) ];
     passthru = { inherit plugins; };
diff --git a/pkgs/applications/networking/instant-messengers/deltachat-electron/default.nix b/pkgs/applications/networking/instant-messengers/deltachat-electron/default.nix
index 5418b671633..cfc5f090cd4 100644
--- a/pkgs/applications/networking/instant-messengers/deltachat-electron/default.nix
+++ b/pkgs/applications/networking/instant-messengers/deltachat-electron/default.nix
@@ -2,13 +2,13 @@
 
 let
   pname = "deltachat-electron";
-  version = "1.2.0";
+  version = "1.3.0";
   name = "${pname}-${version}";
 
   src = fetchurl {
     url =
       "https://download.delta.chat/desktop/v${version}/DeltaChat-${version}.AppImage";
-    sha256 = "Cyb34bfQEdwOA6XYZO+1Ri/2e/PRat15aUMn7IElmUI=";
+    sha256 = "sha256-Mk4OzKcZceRv2IEzf/72VBWEq2RWi6BVzqjfEB5D1/c=";
   };
 
   appimageContents = appimageTools.extract { inherit name src; };
diff --git a/pkgs/applications/networking/instant-messengers/pantalaimon/default.nix b/pkgs/applications/networking/instant-messengers/pantalaimon/default.nix
index c7d8ce4b56d..faf4e406935 100644
--- a/pkgs/applications/networking/instant-messengers/pantalaimon/default.nix
+++ b/pkgs/applications/networking/instant-messengers/pantalaimon/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonApplication rec {
   pname = "pantalaimon";
-  version = "0.5.1";
+  version = "0.6.1";
 
   disabled = pythonOlder "3.6";
 
@@ -18,7 +18,7 @@ buildPythonApplication rec {
     owner = "matrix-org";
     repo = pname;
     rev = version;
-    sha256 = "18jihvqlfk8lx97hxcr36zdkp2sffg2l8mkg5lflylwcgwy1dx0y";
+    sha256 = "0hn3731jh6xwyjayzdf41skhpdx002qs7n5l7ffh4dplhnv9vbxx";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/applications/networking/instant-messengers/poezio/default.nix b/pkgs/applications/networking/instant-messengers/poezio/default.nix
index f7238419b53..485ceb2080f 100644
--- a/pkgs/applications/networking/instant-messengers/poezio/default.nix
+++ b/pkgs/applications/networking/instant-messengers/poezio/default.nix
@@ -1,20 +1,20 @@
 { lib, buildPythonApplication, fetchFromGitHub, pythonOlder
-, pytest, aiodns, slixmpp, pyinotify, potr, mpd2, cffi, pkgconfig }:
+, pytest, aiodns, slixmpp, pyinotify, potr, mpd2, cffi, pkgconfig, setuptools }:
 buildPythonApplication rec {
     pname = "poezio";
-    version = "0.12.1";
+    version = "0.13";
 
     disabled = pythonOlder "3.4";
 
     checkInputs = [ pytest ];
-    propagatedBuildInputs = [ aiodns slixmpp pyinotify potr mpd2 cffi ];
+    propagatedBuildInputs = [ aiodns slixmpp pyinotify potr mpd2 cffi setuptools ];
     nativeBuildInputs = [ pkgconfig ];
 
     src = fetchFromGitHub {
       owner = pname;
       repo = pname;
       rev = "v${version}";
-      sha256 = "04qnsr0l12i55k6xl4q4akx317gai9wv5f1wpkfkq01wp181i5ll";
+      sha256 = "14ig7va0yf5wdhi8hk00f1wni8pj37agggdnvsicvcw2rz1cdw0x";
     };
 
     checkPhase = ''
diff --git a/pkgs/applications/networking/remote/remmina/default.nix b/pkgs/applications/networking/remote/remmina/default.nix
index 92f76e5e6d8..ee9ea667927 100644
--- a/pkgs/applications/networking/remote/remmina/default.nix
+++ b/pkgs/applications/networking/remote/remmina/default.nix
@@ -13,13 +13,13 @@ with stdenv.lib;
 
 stdenv.mkDerivation rec {
   pname = "remmina";
-  version = "1.4.3";
+  version = "1.4.4";
 
   src = fetchFromGitLab {
     owner  = "Remmina";
     repo   = "Remmina";
     rev    = "v${version}";
-    sha256 = "11s39xcy80rarkddw31v621zpai1vdr52iam367l69mcbc40xg36";
+    sha256 = "0kc0akr5xvbq2bx3wsgf0hd8x5hjgshwrrzhwixp0584ydax89gv";
   };
 
   nativeBuildInputs = [ cmake ninja pkgconfig wrapGAppsHook ];
diff --git a/pkgs/applications/networking/sync/rclone/default.nix b/pkgs/applications/networking/sync/rclone/default.nix
index 2fde398b2f5..6489c69b161 100644
--- a/pkgs/applications/networking/sync/rclone/default.nix
+++ b/pkgs/applications/networking/sync/rclone/default.nix
@@ -2,13 +2,13 @@
 
 buildGoPackage rec {
   pname = "rclone";
-  version = "1.51.0";
+  version = "1.52.0";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    sha256 = "0z4kaq6wnj5dgl52g7f86phxlvnk5pbpda7prgh3hahpyhxj0z7d";
+    sha256 = "0v0f3pv8qgk8ggrhm4p9brra1ppj53b51jhgh5xi0rhgpxss0d6r";
   };
 
   goPackagePath = "github.com/rclone/rclone";
@@ -28,7 +28,7 @@ buildGoPackage rec {
     in
       ''
         installManPage $src/rclone.1
-        for shell in bash zsh; do
+        for shell in bash zsh fish; do
           ${rcloneBin}/bin/rclone genautocomplete $shell rclone.$shell
           installShellCompletion rclone.$shell
         done
diff --git a/pkgs/applications/office/homebank/default.nix b/pkgs/applications/office/homebank/default.nix
index a34eadde36e..1f60d7df927 100644
--- a/pkgs/applications/office/homebank/default.nix
+++ b/pkgs/applications/office/homebank/default.nix
@@ -2,10 +2,10 @@
 , libsoup, gnome3 }:
 
 stdenv.mkDerivation rec {
-  name = "homebank-5.4.1";
+  name = "homebank-5.4.2";
   src = fetchurl {
     url = "http://homebank.free.fr/public/${name}.tar.gz";
-    sha256 = "1m1hpaby6zi8y0vmj2ljklp34a55l2qsr7pxw3852k2m4v5n9zsx";
+    sha256 = "0bkjvd819kw9cwmr3macggbg8yil3yc8v2za8pjrl6g746s89kn6";
   };
 
   nativeBuildInputs = [ pkgconfig wrapGAppsHook ];
diff --git a/pkgs/applications/office/tudu/default.nix b/pkgs/applications/office/tudu/default.nix
index cb3b2111372..6094e02c5c1 100644
--- a/pkgs/applications/office/tudu/default.nix
+++ b/pkgs/applications/office/tudu/default.nix
@@ -1,20 +1,25 @@
 { stdenv, fetchurl, ncurses }:
-stdenv.mkDerivation rec {
 
+stdenv.mkDerivation rec {
   pname = "tudu";
-  version = "0.10.3";
+  version = "0.10.4";
 
   src = fetchurl {
     url = "https://code.meskio.net/tudu/${pname}-${version}.tar.gz";
-    sha256 = "0140pw457cd05ysws998yhd3b087j98q8m0g3s4br942l65b8n2y";
+    sha256 = "14srqn968ii3sr4v6xc5zzs50dmm9am22lrm57j7n0rhjclwbssy";
   };
 
   buildInputs = [ ncurses ];
 
-  meta = {
+  preConfigure = stdenv.lib.optionalString stdenv.cc.isClang ''
+    substituteInPlace configure \
+      --replace 'echo "main()' 'echo "int main()'
+  '';
+
+  meta = with stdenv.lib; {
     description = "ncurses-based hierarchical todo list manager with vim-like keybindings";
     homepage = "https://code.meskio.net/tudu/";
-    license = stdenv.lib.licenses.gpl3;
-    platforms = stdenv.lib.platforms.linux;
+    license = licenses.gpl3;
+    platforms = platforms.unix;
   };
 }
diff --git a/pkgs/applications/science/chemistry/marvin/default.nix b/pkgs/applications/science/chemistry/marvin/default.nix
index 9512a288d80..1a22544c270 100644
--- a/pkgs/applications/science/chemistry/marvin/default.nix
+++ b/pkgs/applications/science/chemistry/marvin/default.nix
@@ -4,12 +4,12 @@ with stdenv.lib;
 
 stdenv.mkDerivation rec {
   pname = "marvin";
-  version = "20.10.0";
+  version = "20.12.0";
 
   src = fetchurl {
     name = "marvin-${version}.deb";
     url = "http://dl.chemaxon.com/marvin/${version}/marvin_linux_${versions.majorMinor version}.deb";
-    sha256 = "042ndlns48pa6mn6wyrp4q9c1v0a2vzcnhw5l766zdnxdjyv0acx";
+    sha256 = "1imfr56nbq2mbcyapwa8xmcmj5rjhbjz9r438387s73kd1avd6yl";
   };
 
   nativeBuildInputs = [ dpkg makeWrapper ];
diff --git a/pkgs/applications/science/logic/cryptominisat/default.nix b/pkgs/applications/science/logic/cryptominisat/default.nix
index 8c1b3bd0369..591b04ab062 100644
--- a/pkgs/applications/science/logic/cryptominisat/default.nix
+++ b/pkgs/applications/science/logic/cryptominisat/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "cryptominisat";
-  version = "5.7.0";
+  version = "5.7.1";
 
   src = fetchFromGitHub {
     owner  = "msoos";
     repo   = "cryptominisat";
     rev    = version;
-    sha256 = "0ny5ln8fc0irprs04qw01c9mppps8q27lkx01a549zazwhj4b5rm";
+    sha256 = "16lydnbd4rxfyabvvw7l4hbbby3yprcqqzrydd3n8rjbxibi4xyf";
   };
 
   buildInputs = [ python3 boost ];
diff --git a/pkgs/applications/science/logic/proverif/default.nix b/pkgs/applications/science/logic/proverif/default.nix
index 931ad2fc4f3..6a9367b30aa 100644
--- a/pkgs/applications/science/logic/proverif/default.nix
+++ b/pkgs/applications/science/logic/proverif/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "proverif";
-  version = "2.00";
+  version = "2.01";
 
   src = fetchurl {
     url    = "http://prosecco.gforge.inria.fr/personal/bblanche/proverif/proverif${version}.tar.gz";
-    sha256 = "0vjphj85ch9q39vc7sd6n4vxy5bplp017vlshk989yhfwb00r37y";
+    sha256 = "01wp5431c77z0aaa99h8bnm5yhr6jslpqc8iyg0a7gxfqnb19gxi";
   };
 
   buildInputs = with ocamlPackages; [ ocaml findlib lablgtk ];
diff --git a/pkgs/applications/science/math/palp/default.nix b/pkgs/applications/science/math/palp/default.nix
index c0100422c64..c383438002f 100644
--- a/pkgs/applications/science/math/palp/default.nix
+++ b/pkgs/applications/science/math/palp/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "http://hep.itp.tuwien.ac.at/~kreuzer/CY/palp/palp-${version}.tar.gz";
-    sha256 = "0pv3rmgk8xc8z98w173f1jxc1cd67cdl8mjjgmgp3mcvifcfsrjl";
+    sha256 = "00jpm73fw9jjq58z6rysr1mwv489j6rpfqqlhm9ab0dln4kyhh05";
   };
 
   hardeningDisable = [
diff --git a/pkgs/applications/version-management/git-and-tools/lefthook/default.nix b/pkgs/applications/version-management/git-and-tools/lefthook/default.nix
index 613e5bf10d6..d86fca1a6d4 100644
--- a/pkgs/applications/version-management/git-and-tools/lefthook/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/lefthook/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "lefthook";
-  version = "0.7.1";
+  version = "0.7.2";
 
   src = fetchFromGitHub {
     rev = "v${version}";
     owner = "Arkweid";
     repo = "lefthook";
-    sha256 = "14rcvbzzrx0m3xijl8qhw5l2h0q10hqzad2hqm3079g893f2qad0";
+    sha256 = "1ciyxjx3r3dcl8xas49kqsjshs1bv4pafmfmhdfyfdvlaj374hgj";
   };
 
   vendorSha256 = "1pdrw4vwbj9cka2pjbjvxviigfvnrf8sgws27ixwwiblbkj4isc8";
diff --git a/pkgs/applications/video/plex-mpv-shim/default.nix b/pkgs/applications/video/plex-mpv-shim/default.nix
index 268905e3a4c..993bdd67b0d 100644
--- a/pkgs/applications/video/plex-mpv-shim/default.nix
+++ b/pkgs/applications/video/plex-mpv-shim/default.nix
@@ -2,13 +2,13 @@
 
 buildPythonApplication rec {
   pname = "plex-mpv-shim";
-  version = "1.7.16";
+  version = "1.8.0";
 
   src = fetchFromGitHub {
     owner = "iwalton3";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1pnbdxaqnliwqfvv08gi7gdcvflg5vcbgk4g0fw75prgw54vnd9a";
+    sha256 = "0fi0glnl7nr6754r9jk7d7dsnjbdm7civvhcj2l009yxiv2rxzj3";
   };
 
   propagatedBuildInputs = [ mpv requests python-mpv-jsonipc ];
diff --git a/pkgs/applications/video/vlc/default.nix b/pkgs/applications/video/vlc/default.nix
index 229eeffe8f7..31ec6d9ef19 100644
--- a/pkgs/applications/video/vlc/default.nix
+++ b/pkgs/applications/video/vlc/default.nix
@@ -25,11 +25,11 @@ assert (withQt5 -> qtbase != null && qtsvg != null && qtx11extras != null && wra
 
 stdenv.mkDerivation rec {
   pname = "vlc";
-  version = "3.0.8";
+  version = "3.0.10";
 
   src = fetchurl {
     url = "http://get.videolan.org/vlc/${version}/${pname}-${version}.tar.xz";
-    sha256 = "e0149ef4a20a19b9ecd87309c2d27787ee3f47dfd47c6639644bc1f6fd95bdf6";
+    sha256 = "0cackl1084hcmg4myf3kvjvd6sjxmzn0c0qkmanz6brvgzyanrm9";
   };
 
   # VLC uses a *ton* of libraries for various pieces of functionality, many of
diff --git a/pkgs/applications/window-managers/i3/lock-color.nix b/pkgs/applications/window-managers/i3/lock-color.nix
index 062a8c4b8d8..c5e203ab1a5 100644
--- a/pkgs/applications/window-managers/i3/lock-color.nix
+++ b/pkgs/applications/window-managers/i3/lock-color.nix
@@ -4,14 +4,14 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "2.12.c.1";
+  version = "2.12.c.4";
   pname = "i3lock-color";
 
   src = fetchFromGitHub {
     owner = "PandorasFox";
     repo = "i3lock-color";
     rev = version;
-    sha256 = "1q09cfgkikqbrkk1kljg8dsgbs5nacixhdqaww18h94hmlnbbssc";
+    sha256 = "1jbk7kd49vgmakbldwwnbsp484fwh1pbzg8k8qvbq4dzbzf3q5hs";
   };
 
   nativeBuildInputs = [ autoreconfHook pkgconfig ];
diff --git a/pkgs/applications/window-managers/sway/lock.nix b/pkgs/applications/window-managers/sway/lock.nix
index dcff3a5c47f..7cbba5e981b 100644
--- a/pkgs/applications/window-managers/sway/lock.nix
+++ b/pkgs/applications/window-managers/sway/lock.nix
@@ -30,6 +30,8 @@ stdenv.mkDerivation rec {
     description = "Screen locker for Wayland";
     longDescription = ''
       swaylock is a screen locking utility for Wayland compositors.
+      Important note: If you don't use the Sway module (programs.sway.enable)
+      you need to set "security.pam.services.swaylock = {};" manually.
     '';
     inherit (src.meta) homepage;
     license = licenses.mit;
diff --git a/pkgs/data/fonts/tamzen/default.nix b/pkgs/data/fonts/tamzen/default.nix
index c4a2be00d94..6ecc03d7310 100644
--- a/pkgs/data/fonts/tamzen/default.nix
+++ b/pkgs/data/fonts/tamzen/default.nix
@@ -1,28 +1,22 @@
-{ fetchFromGitHub, fontforge, mkfontscale, stdenv }:
+{ fetchFromGitHub, mkfontscale, stdenv }:
 
 stdenv.mkDerivation rec {
   pname = "tamzen-font";
-  version = "1.11.4";
+  version = "1.11.5";
 
   src = fetchFromGitHub {
     owner = "sunaku";
     repo = "tamzen-font";
     rev = "Tamzen-${version}";
-    sha256 = "17kgmvg6q32mqhx9g44hjvzv0si0mnpprga4z7na930g2zdd8846";
+    sha256 = "00x5fipzqimglvshhqwycdhaqslbvn3rl06jnswhyxfvz16ymj7s";
   };
 
-  nativeBuildInputs = [ fontforge mkfontscale ];
+  nativeBuildInputs = [ mkfontscale ];
 
   installPhase = ''
-    # convert pcf fonts to otb
-    for i in pcf/*.pcf; do
-      name=$(basename "$i" .pcf)
-      fontforge -lang=ff -c "Open(\"$i\"); Generate(\"$name.otb\")"
-    done
-
     install -m 644 -D pcf/*.pcf -t "$out/share/fonts/misc"
     install -m 644 -D psf/*.psf -t "$out/share/consolefonts"
-    install -m 644 -D *.otb     -t "$otb/share/fonts/misc"
+    install -m 644 -D otb/*.otb -t "$otb/share/fonts/misc"
     mkfontdir "$out/share/fonts/misc"
     mkfontdir "$otb/share/fonts/misc"
   '';
diff --git a/pkgs/data/misc/cldr-emoji-annotation/default.nix b/pkgs/data/misc/cldr-emoji-annotation/default.nix
index 289f6d66340..d74a9cebcea 100644
--- a/pkgs/data/misc/cldr-emoji-annotation/default.nix
+++ b/pkgs/data/misc/cldr-emoji-annotation/default.nix
@@ -5,13 +5,13 @@
 
 stdenv.mkDerivation rec {
   pname = "cldr-emoji-annotation";
-  version = "36.12.120191002_0";
+  version = "36.12.120200305_0";
 
   src = fetchFromGitHub {
     owner = "fujiwarat";
     repo = "cldr-emoji-annotation";
     rev = version;
-    sha256 = "0nxigzs3mxjgi7c8mmdaxsy5sfl7ihsc2nysaj0db198b33w9clw";
+    sha256 = "1zg4czaqnfjkd4hx06h8q56z8iiw22crwqr69w94s4hy9zcanfrs";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/data/themes/plata/default.nix b/pkgs/data/themes/plata/default.nix
index 3ccd58ccdc0..6437bb1543d 100644
--- a/pkgs/data/themes/plata/default.nix
+++ b/pkgs/data/themes/plata/default.nix
@@ -19,13 +19,13 @@
 
 stdenv.mkDerivation rec {
   pname = "plata-theme";
-  version = "0.9.7";
+  version = "0.9.8";
 
   src = fetchFromGitLab {
     owner = "tista500";
     repo = "plata-theme";
     rev = version;
-    sha256 = "0rm3xl7d3082kdkbds7ib8b85wpynvpaqravpyb4r5pys0y16fws";
+    sha256 = "1sqmydvx36f6r4snw22s2q4dvcyg30jd7kg7dibpzqn3njfkkfag";
   };
 
   preferLocalBuild = true;
diff --git a/pkgs/data/themes/zuki/default.nix b/pkgs/data/themes/zuki/default.nix
index 45f3862ea63..f68f2383127 100644
--- a/pkgs/data/themes/zuki/default.nix
+++ b/pkgs/data/themes/zuki/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "zuki-themes";
-  version = "3.34-2";
+  version = "3.36-2";
 
   src = fetchFromGitHub {
     owner = "lassekongo83";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1nc0qh6qai6ybmz3a44q0rirri0gfg7lyqy4k4l1sci5q5ckl7x4";
+    sha256 = "02gfik9g6kkwcf9h2xlb9nbniajkczhj1xzdnsyk5rlabbvllxcd";
   };
 
   nativeBuildInputs = [ meson ninja sassc ];
diff --git a/pkgs/desktops/deepin/dbus-factory/default.nix b/pkgs/desktops/deepin/dbus-factory/default.nix
deleted file mode 100644
index 06d921cce6d..00000000000
--- a/pkgs/desktops/deepin/dbus-factory/default.nix
+++ /dev/null
@@ -1,43 +0,0 @@
-{ stdenv
-, fetchFromGitHub
-, jq
-, libxml2
-, go-dbus-generator
-, deepin
-}:
-
-stdenv.mkDerivation rec {
-  pname = "dbus-factory";
-  version = "3.1.17";
-
-  src = fetchFromGitHub {
-    owner = "linuxdeepin";
-    repo = pname;
-    rev = version;
-    sha256 = "1llq8wzgikgpzj7z36fyzk8kjych2h9nzi3x6zv53z0xc1xn4256";
-  };
-
-  nativeBuildInputs = [
-    jq
-    libxml2
-    go-dbus-generator
-  ];
-
-  makeFlags = [
-    "GOPATH=${placeholder "out"}/share/go"
-  ];
-
-  postPatch = ''
-    sed -i -e 's:/share/gocode:/share/go:' Makefile
-  '';
-
-  passthru.updateScript = deepin.updateScript { inherit pname version src; };
-
-  meta = with stdenv.lib; {
-    description = "Generates static DBus bindings for Golang and QML at build-time";
-    homepage = "https://github.com/linuxdeepin/dbus-factory";
-    license = licenses.gpl3;
-    platforms = platforms.linux;
-    maintainers = with maintainers; [ romildo ];
-  };
-}
diff --git a/pkgs/desktops/deepin/dde-api/default.nix b/pkgs/desktops/deepin/dde-api/default.nix
index 325f62f3781..011be982df5 100644
--- a/pkgs/desktops/deepin/dde-api/default.nix
+++ b/pkgs/desktops/deepin/dde-api/default.nix
@@ -6,7 +6,6 @@
 , bc
 , blur-effect
 , coreutils
-, dbus-factory
 , deepin
 , deepin-gettext-tools
 , fontconfig
@@ -43,7 +42,6 @@ buildGoPackage rec {
   nativeBuildInputs = [
     pkgconfig
     deepin-gettext-tools # build
-    dbus-factory         # build
     deepin.setupHook
 
     # TODO: using $PATH to find run time executable does not work with cross compiling
diff --git a/pkgs/desktops/deepin/dde-daemon/default.nix b/pkgs/desktops/deepin/dde-daemon/default.nix
index b89b2c25446..c4edcef15af 100644
--- a/pkgs/desktops/deepin/dde-daemon/default.nix
+++ b/pkgs/desktops/deepin/dde-daemon/default.nix
@@ -3,7 +3,6 @@
 , fetchFromGitHub
 , fetchpatch
 , pkgconfig
-, dbus-factory
 , go-dbus-factory
 , go-gir-generator
 , go-lib
@@ -59,7 +58,6 @@ buildGoPackage rec {
 
   nativeBuildInputs = [
     pkgconfig
-    dbus-factory
     deepin-gettext-tools
     gettext
     networkmanager
diff --git a/pkgs/desktops/deepin/deepin-screenshot/default.nix b/pkgs/desktops/deepin/deepin-screenshot/default.nix
deleted file mode 100644
index 0ccc350962a..00000000000
--- a/pkgs/desktops/deepin/deepin-screenshot/default.nix
+++ /dev/null
@@ -1,73 +0,0 @@
-{ stdenv
-, mkDerivation
-, fetchFromGitHub
-, fetchpatch
-, cmake
-, pkgconfig
-, xdg_utils
-, qttools
-, qtx11extras
-, dtkcore
-, dtkwidget
-, dtkwm
-, deepin-turbo
-, deepin-shortcut-viewer
-, deepin
-}:
-
-mkDerivation rec {
-  pname = "deepin-screenshot";
-  version = "5.0.0";
-
-  src = fetchFromGitHub {
-    owner = "linuxdeepin";
-    repo = pname;
-    rev = version;
-    sha256 = "0h1kcf9i8q6rz4jhym3yf84zr6svzff0hh9sl7b24sflzkxx6zwk";
-  };
-
-  nativeBuildInputs = [
-    cmake
-    pkgconfig
-    qttools
-    deepin.setupHook
-  ];
-
-  buildInputs = [
-    deepin-shortcut-viewer
-    deepin-turbo
-    dtkcore
-    dtkwidget
-    dtkwm
-    qtx11extras
-  ];
-
-  patches = [
-    (fetchpatch {
-      url = "https://github.com/linuxdeepin/deepin-screenshot/pull/52/commits/e14508b223fd9965854ed41c944cea2ea19e6e0c.patch";
-      sha256 = "18zvz98z3hr8pcdyb706za6h2nwx23zsjb1hgyp21ycinhzr9j9h";
-    })
-  ];
-
-  postPatch = ''
-    searchHardCodedPaths
-    patchShebangs generate_translations.sh
-    fixPath ${deepin-turbo} /usr/bin/deepin-turbo-invoker src/dbusservice/com.deepin.Screenshot.service
-    fixPath $out /usr/bin/deepin-screenshot src/dbusservice/com.deepin.Screenshot.service
-    substituteInPlace src/mainwindow.cpp --replace '"xdg-open,%1"' '"${xdg_utils}/bin/xdg-open,%1"'
-  '';
-
-  postFixup = ''
-    searchHardCodedPaths $out
-  '';
-
-  passthru.updateScript = deepin.updateScript { inherit pname version src; };
-
-  meta = with stdenv.lib; {
-    description = "Easy-to-use screenshot tool for Deepin Desktop Environment";
-    homepage = "https://github.com/linuxdeepin/deepin-screenshot";
-    license = licenses.gpl3;
-    platforms = platforms.linux;
-    maintainers = with maintainers; [ romildo flokli ];
-  };
-}
diff --git a/pkgs/desktops/deepin/default.nix b/pkgs/desktops/deepin/default.nix
index 8d33ac154af..b177b2ccf35 100644
--- a/pkgs/desktops/deepin/default.nix
+++ b/pkgs/desktops/deepin/default.nix
@@ -12,7 +12,6 @@ let
         ignoredVersions = "^2014(\\.|rc)|^v[0-9]+";
       };
 
-    dbus-factory = callPackage ./dbus-factory { };
     dde-api = callPackage ./dde-api { };
     dde-calendar = callPackage ./dde-calendar { };
     dde-control-center = callPackage ./dde-control-center { };
@@ -36,7 +35,6 @@ let
     deepin-image-viewer = callPackage ./deepin-image-viewer { };
     deepin-menu = callPackage ./deepin-menu { };
     deepin-movie-reborn = callPackage ./deepin-movie-reborn { };
-    deepin-screenshot = callPackage ./deepin-screenshot { };
     deepin-shortcut-viewer = callPackage ./deepin-shortcut-viewer { };
     deepin-sound-theme = callPackage ./deepin-sound-theme { };
     deepin-terminal = callPackage ./deepin-terminal {
@@ -50,12 +48,11 @@ let
     dtkwidget = callPackage ./dtkwidget { };
     dtkwm = callPackage ./dtkwm { };
     go-dbus-factory = callPackage ./go-dbus-factory { };
-    go-dbus-generator = callPackage ./go-dbus-generator { };
     go-gir-generator = callPackage ./go-gir-generator { };
     go-lib = callPackage ./go-lib { };
     qcef = callPackage ./qcef { };
-    qt5dxcb-plugin = callPackage ./qt5dxcb-plugin { };
     qt5integration = callPackage ./qt5integration { };
+    qt5platform-plugins = callPackage ./qt5platform-plugins { };
     startdde = callPackage ./startdde { };
     udisks2-qt5 = callPackage ./udisks2-qt5 { };
 
diff --git a/pkgs/desktops/deepin/go-dbus-generator/default.nix b/pkgs/desktops/deepin/go-dbus-generator/default.nix
deleted file mode 100644
index d0b2d8c07e6..00000000000
--- a/pkgs/desktops/deepin/go-dbus-generator/default.nix
+++ /dev/null
@@ -1,38 +0,0 @@
-{ stdenv
-, fetchFromGitHub
-, go
-, go-lib
-, deepin
-}:
-
-stdenv.mkDerivation rec {
-  pname = "go-dbus-generator";
-  version = "5.0.0";
-
-  src = fetchFromGitHub {
-    owner = "linuxdeepin";
-    repo = pname;
-    rev = version;
-    sha256 = "17rzicqizyyrhjjf4rild7py1cyd07b2zdcd9nabvwn4gvj6lhfb";
-  };
-
-  nativeBuildInputs = [
-    go
-    go-lib
-  ];
-
-  makeFlags = [
-    "PREFIX=${placeholder "out"}"
-    "GOCACHE=$(TMPDIR)/go-cache"
-  ];
-
-  passthru.updateScript = deepin.updateScript { inherit pname version src; };
-
-  meta = with stdenv.lib; {
-    description = "Convert dbus interfaces to go-lang or qml wrapper code";
-    homepage = "https://github.com/linuxdeepin/go-dbus-generator";
-    license = licenses.gpl3;
-    platforms = platforms.linux;
-    maintainers = with maintainers; [ romildo ];
-  };
-}
diff --git a/pkgs/desktops/deepin/qcef/default.nix b/pkgs/desktops/deepin/qcef/default.nix
index fb6bb89d939..c37915377d8 100644
--- a/pkgs/desktops/deepin/qcef/default.nix
+++ b/pkgs/desktops/deepin/qcef/default.nix
@@ -64,14 +64,14 @@ let
 in
 mkDerivation rec {
   pname = "qcef";
-  version = "1.1.7";
+  version = "1.1.8";
 
   srcs = [
     (fetchFromGitHub {
       owner = "linuxdeepin";
       repo = pname;
       rev = version;
-      sha256 = "1x0vb4nkfa1lq0nh6iqpxfvsqmb6qfn305pbc92bsqpgiqd7jvb1";
+      sha256 = "14a33af1h3wj3yph080c1ri3m27bqj1v1k0jdqc63x7c3smnpwfk";
       name = pname;
     })
     (fetchFromGitHub {
diff --git a/pkgs/desktops/deepin/qt5integration/default.nix b/pkgs/desktops/deepin/qt5integration/default.nix
index cc427611c34..e3bbaba068b 100644
--- a/pkgs/desktops/deepin/qt5integration/default.nix
+++ b/pkgs/desktops/deepin/qt5integration/default.nix
@@ -8,7 +8,7 @@
 , qtx11extras
 , qtmultimedia
 , qtsvg
-, qt5dxcb-plugin
+, qt5platform-plugins
 , qtstyleplugins
 , dtkcore
 , dtkwidget
@@ -34,7 +34,7 @@ mkDerivation rec {
   buildInputs = [
     dtkcore
     dtkwidget
-    qt5dxcb-plugin
+    qt5platform-plugins
     mtdev
     lxqt.libqtxdg
     qtstyleplugins
diff --git a/pkgs/desktops/deepin/qt5dxcb-plugin/default.nix b/pkgs/desktops/deepin/qt5platform-plugins/default.nix
similarity index 85%
rename from pkgs/desktops/deepin/qt5dxcb-plugin/default.nix
rename to pkgs/desktops/deepin/qt5platform-plugins/default.nix
index 4aa10fb1a93..33e4863c0d9 100644
--- a/pkgs/desktops/deepin/qt5dxcb-plugin/default.nix
+++ b/pkgs/desktops/deepin/qt5platform-plugins/default.nix
@@ -12,15 +12,15 @@
 }:
 
 mkDerivation rec {
-  pname = "qt5dxcb-plugin";
-  version = "5.0.1";
+  pname = "qt5platform-plugins";
+  version = "5.0.11";
 
   srcs = [
     (fetchFromGitHub {
       owner = "linuxdeepin";
       repo = pname;
       rev = version;
-      sha256 = "1pkhbx4hzjv7n4mscv7dng9ymjcc1csdc82iy62yxshhq32bcfja";
+      sha256 = "14xkr3p49716jc9v7ksj6jgcmfa65qicqrmablizfi71srg3z2pr";
     })
     qtbase.src
   ];
@@ -51,13 +51,11 @@ mkDerivation rec {
     "INSTALL_PATH=${placeholder "out"}/${qtbase.qtPluginPrefix}/platforms"
   ];
 
-  enableParallelBuilding = true;
-
   passthru.updateScript = deepin.updateScript { inherit pname version; src = (builtins.head srcs); };
 
   meta = with stdenv.lib; {
     description = "Qt platform theme integration plugin for DDE";
-    homepage = "https://github.com/linuxdeepin/qt5dxcb-plugin";
+    homepage = "https://github.com/linuxdeepin/qt5platform-plugins";
     license = licenses.gpl3;
     platforms = platforms.linux;
     maintainers = with maintainers; [ romildo ];
diff --git a/pkgs/desktops/deepin/startdde/default.nix b/pkgs/desktops/deepin/startdde/default.nix
index 7d03b00928e..75b36e85de3 100644
--- a/pkgs/desktops/deepin/startdde/default.nix
+++ b/pkgs/desktops/deepin/startdde/default.nix
@@ -4,7 +4,6 @@
 , pkgconfig
 , alsaLib
 , coreutils
-, dbus-factory
 , dde-api
 , dde-daemon
 , dde-dock
@@ -53,7 +52,6 @@ buildGoPackage rec {
 
   nativeBuildInputs = [
     pkgconfig
-    dbus-factory
     jq
     wrapGAppsHook
     deepin.setupHook
diff --git a/pkgs/desktops/plasma-5/powerdevil.nix b/pkgs/desktops/plasma-5/powerdevil.nix
index 65fc5446c16..e53e986060f 100644
--- a/pkgs/desktops/plasma-5/powerdevil.nix
+++ b/pkgs/desktops/plasma-5/powerdevil.nix
@@ -3,7 +3,7 @@
   extra-cmake-modules, kdoctools,
   bluez-qt, kactivities, kauth, kconfig, kdbusaddons, kdelibs4support,
   kglobalaccel, ki18n, kidletime, kio, knotifyconfig, kwayland, libkscreen,
-  networkmanager-qt, plasma-workspace, qtx11extras, solid, udev
+  ddcutil, networkmanager-qt, plasma-workspace, qtx11extras, solid, udev
 }:
 
 mkDerivation {
@@ -13,5 +13,9 @@ mkDerivation {
     kconfig kdbusaddons knotifyconfig solid udev bluez-qt kactivities kauth
     kdelibs4support kglobalaccel ki18n kio kidletime kwayland libkscreen
     networkmanager-qt plasma-workspace qtx11extras
+    ddcutil
+  ];
+  cmakeFlags = [
+    "-DHAVE_DDCUTIL=On"
   ];
 }
diff --git a/pkgs/desktops/xfce/core/thunar/default.nix b/pkgs/desktops/xfce/core/thunar/default.nix
index 24df606e246..00da58f6628 100644
--- a/pkgs/desktops/xfce/core/thunar/default.nix
+++ b/pkgs/desktops/xfce/core/thunar/default.nix
@@ -21,9 +21,9 @@
 let unwrapped = mkXfceDerivation {
   category = "xfce";
   pname = "thunar";
-  version = "1.8.14";
+  version = "1.8.15";
 
-  sha256 = "1ph9bcqfm2nccliagl8zdl1dizh62qnr8m5hacri3cs2jhc0jjpy";
+  sha256 = "1y9d88i0kwl7ak4d65gy3qf4bpkiyaqxd4g6px3v1ykf274k8al8";
 
   nativeBuildInputs = [
     docbook_xsl
diff --git a/pkgs/development/compilers/dotnet/buildDotnet.nix b/pkgs/development/compilers/dotnet/buildDotnet.nix
index 6f4237d2dce..20abc1c78b9 100644
--- a/pkgs/development/compilers/dotnet/buildDotnet.nix
+++ b/pkgs/development/compilers/dotnet/buildDotnet.nix
@@ -13,14 +13,16 @@ assert builtins.elem type [ "aspnetcore" "netcore" "sdk"];
 , curl
 }: 
 let pname = if type == "aspnetcore" then "aspnetcore-runtime" else if type == "netcore" then "dotnet-runtime" else "dotnet-sdk";
+    platform = if stdenv.isDarwin then "osx" else "linux";
     suffix = {
       x86_64-linux  = "x64";
       aarch64-linux = "arm64";
+      x86_64-darwin = "x64";
     }."${stdenv.hostPlatform.system}" or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
     urls = {
-        aspnetcore = "https://dotnetcli.azureedge.net/dotnet/aspnetcore/Runtime/${version}/${pname}-${version}-linux-${suffix}.tar.gz";
-        netcore = "https://dotnetcli.azureedge.net/dotnet/Runtime/${version}/${pname}-${version}-linux-${suffix}.tar.gz";
-        sdk = "https://dotnetcli.azureedge.net/dotnet/Sdk/${version}/${pname}-${version}-linux-${suffix}.tar.gz";
+        aspnetcore = "https://dotnetcli.azureedge.net/dotnet/aspnetcore/Runtime/${version}/${pname}-${version}-${platform}-${suffix}.tar.gz";
+        netcore = "https://dotnetcli.azureedge.net/dotnet/Runtime/${version}/${pname}-${version}-${platform}-${suffix}.tar.gz";
+        sdk = "https://dotnetcli.azureedge.net/dotnet/Sdk/${version}/${pname}-${version}-${platform}-${suffix}.tar.gz";
     };
     descriptions = {
         aspnetcore = "ASP .NET Core runtime ${version}";
@@ -50,7 +52,7 @@ in stdenv.mkDerivation rec {
         runHook postInstall
     '';
 
-    postFixup = ''
+    postFixup = stdenv.lib.optionalString stdenv.isLinux ''
         patchelf --set-interpreter "${stdenv.cc.bintools.dynamicLinker}" $out/dotnet
         patchelf --set-rpath "${rpath}" $out/dotnet
         find $out -type f -name "*.so" -exec patchelf --set-rpath '$ORIGIN:${rpath}' {} \;
@@ -65,7 +67,7 @@ in stdenv.mkDerivation rec {
     meta = with stdenv.lib; {
         homepage = "https://dotnet.github.io/";
         description = builtins.getAttr type descriptions;
-        platforms = [ "x86_64-linux" "aarch64-linux" ];
+        platforms = [ "x86_64-linux" "aarch64-linux" "x86_64-darwin" ];
         maintainers = with maintainers; [ kuznero ];
         license = licenses.mit;
     };
diff --git a/pkgs/development/compilers/dotnet/default.nix b/pkgs/development/compilers/dotnet/default.nix
index 6497e8bdf96..dd1510548a3 100644
--- a/pkgs/development/compilers/dotnet/default.nix
+++ b/pkgs/development/compilers/dotnet/default.nix
@@ -19,6 +19,7 @@ rec {
     sha512 = {
       x86_64-linux = "0awdzi8dysbg8xcy4l8wx2sb8gaaklphmwv61qxh7dj6ih4nla34l02xdax1l8nw41znnnqzsa77avglnrz36pckm9mc52m7wc7877h";
       aarch64-linux = null; # no aarch64 version of this package is available
+      x86_64-darwin = "1psqqpin4hipr2hzfp79712d6cag892jx4fx5001nlsynwrdq3vi4liakz4yz41rvk0jyd7f07z90wj97xlxyrqiqcc1fdbgn2q0px9";
     };
   };
 
@@ -27,6 +28,7 @@ rec {
     sha512 = {
       x86_64-linux = "07vvmza32hsblpw4zpcksm2gicy4agh0d1fwradqj16y6xbh3frdp87mqgbj5m54mmyfp5bc8c46v1w6dfm1w3y80v2y46aynild45l";
       aarch64-linux = "27ab982vz9rn2vzpq68dqfzhryfixq3s0apx7vi0cwiray3scgfmf45fm7qj63k9mvaqnk5g69i339109yasw3q5vpvpyjc1ykbi710";
+      x86_64-darwin = "2pxqpcw3djr18m0y124fbd6pz4lb5brlgvpvd9pdirkpsar8dmipsrhxcsk0d902zyxzgj1ac1ygzxsz49xvrkmh6s1m3w5fk8fws2f";
     };
   };
 
@@ -35,6 +37,7 @@ rec {
     sha512 = {
       x86_64-linux = "1kbzxcdgyvs94kkm6ikr1j0p0k3zq30d10sl69ig0rgbqbqm4rpqi6dq94jjbw7q3jlwz83vgq3549q38d2s9kalmzv9lmddn2kkc42";
       aarch64-linux = "2d97xvhxnkdgghqlichkwdxxh641dzkd9hq5xgffgvbqv1qsh31k9yib2q1nsarpnbx0d758bdn2jm2wvsj7nx0gpxlb3nab0b3hc2g";
+      x86_64-darwin = "0fjn18vizgfdbziklhgppnvka5iw2hb4pfi6047i46il8ydb6z1m40cflq436sdf07sivi0mnldg9247qvqrl6f078w3fwnh3bwlac8";
     };
   };
 
@@ -49,6 +52,7 @@ rec {
     sha512 = {
       x86_64-linux = "342v6kxxbxky09d1c392vvr9rm30lf75wccka1bk2h4advlcga5nlgv93g7vrq48bsyxfi5gc36r3b0dlwl1g409g5mlk1042n6d0yq";
       aarch64-linux = "2xkg4q88q5jw6jdz6cxj8vsjr475nd0fcvifkv1shdm2j9dsjy233hwpxbr140m5n5ggyh6z99238z9j4kp2az977y8y8irz8m8ppvf";
+      x86_64-darwin = "2p04j6p4j93pan71ih13hv57zxalcirh0n3vfjq0cfb80pbhf1f5cgxl24pw6kifh6hhh38rj62c4mr69lxzlqc8sfcfaws8dyz2avm";
     };
   };
 
@@ -57,6 +61,7 @@ rec {
     sha512 = {
       x86_64-linux = "32ykpcw2xx708r2lxcwcbxnmy4sk159rlfjfvkw990qh7n79pm3lm2qwa3zhqcslznmpg18kwxz8qb5fgsa0h49g843xx4kyai0n7rx";
       aarch64-linux = "1lp8din7d5jv5fkyq1a7m01i1xg9jwpiljvam1kcyzsnwzvi0cb4ji336cfx4lqrn95gvc75gkzi6q8b4fz0h21gvk6z6kmlcr63nyg";
+      x86_64-darwin = "0s20k7xawwd09xhy4xdcxp1rw6jd418ibrvhb509dnj480g48xryda2203g4mpswd24v2kx0n9qzxgbrbq9lvasfglkxi84bbqayp83";
     };
   };
 
@@ -65,6 +70,7 @@ rec {
     sha512 = {
       x86_64-linux = "2diiplgxs92fkb6ym68b02d79z4qn63x5qlky5lvr757c1zkh0vfpk3khawdg94kdn4qkn6dmyqr0msxqgmiqyhp63cadzqq4vx7b12";
       aarch64-linux = "32843q2lj7dgciq62g9v1q31vwfjyv5vaxrz712d942mcg5lyzjygwri106bv4naq3a22131ldzwnsifbdn2vq1iz60raqdb7ss9vnf";
+      x86_64-darwin = "3apswk2bhalgi0hm7h2j9p152jvp39h4xilxxzix5j1n36b442l1pwk7lj7019lxafjqkz5y850xkfcp14ks5wcvs33xs2c0aqwxvcn";
     };
   };
 
@@ -75,6 +81,7 @@ rec {
     sha512 = {
       x86_64-linux = "27708bk5liz8r39p4dzs41clgq298d49g8ipzdj56pz613vkfyv7bp91666ydz36aazm265j2g9ji3sk1f9kbgv6024zwrly5w9vqrm";
       aarch64-linux = "2sm5yf376w5dm0za3gbcj251kc909fmlasmlyn70zhqp2jiii075vcqh40racjlwlhsfydx32cw7kgnv238lad5mw5jxy143zql5xl3";
+      x86_64-darwin = "311sihjzg0x5inyrz0px29jikxcibd6l56xfdmxkncgwaikf3663x10dfl246qhz8v0f3lvg2vndgp5icbaqrp8awsnrhsl0vi5d7fh";
     };
   };
 
@@ -83,6 +90,7 @@ rec {
     sha512 = {
       x86_64-linux = "3zwg1anrcni9kagmjxn485bpjvb146hkm7irmikq3v879gjhd2fgpscg226ds83l4pxll3r7lwris6ij952xmy8lsqraapd9111ba14";
       aarch64-linux = "3hf61d5adlfffy51627ypp36qc5r55g9xwgfxqd0c7vj9bqmpiph673bvqqpr189df9shxr21p94cwrc5n36z72a37vw4ic8ks2yayx";
+      x86_64-darwin = "35flr1p5zpcd77mjsl6qy9ipxc5k9j6pk7ca6mnvqqjf0r3agm3qf8cs5fbraprvkwj8fha3giwbp5xir6050fbb374375idn9x12d8";
     };
   };
 
@@ -91,6 +99,7 @@ rec {
     sha512 = {
       x86_64-linux = "0lmz8ac5j0i4zcq4904kr6qibvyjcm2ckfg27kqyqfii00qmm80xb5sk3i7f06xqkbgkrqkbg9rsldk75akw6m5dxg932j602bxrb4w";
       aarch64-linux = "34k6cm69gxm7vcd9m6bp47sdx96j32z6lfhb2vjcdznc6xgs2wy8zcang3b1mjm5919dq7v6iysm6ffcpgjhhphy7prlnaqa69q5mks";
+      x86_64-darwin = "00xs87zj94v6yr6xs294bficp6lxpghyfswhnwqfkx62jy80qr5fa2y7s10ich3cbm2daa8dby56iizdvi7rnlvp23gfkq12gq4w1g8";
     };
   };
 }
diff --git a/pkgs/development/compilers/gcc/common/extra-target-flags.nix b/pkgs/development/compilers/gcc/common/extra-target-flags.nix
index f1696f182c0..62d9818ca95 100644
--- a/pkgs/development/compilers/gcc/common/extra-target-flags.nix
+++ b/pkgs/development/compilers/gcc/common/extra-target-flags.nix
@@ -5,9 +5,12 @@ let
 in
 
 {
+  # For non-cross builds these flags are currently assigned in builder.sh.
+  # It would be good to consolidate the generation of makeFlags
+  # ({C,CXX,LD}FLAGS_FOR_{BUILD,TARGET}, etc...) at some point.
   EXTRA_TARGET_FLAGS = let
       mkFlags = dep: langD: lib.optionals (targetPlatform != hostPlatform && dep != null && !langD) ([
-        "-idirafter ${lib.getDev dep}${dep.incdir or "/include"}"
+        "-O2 -idirafter ${lib.getDev dep}${dep.incdir or "/include"}"
       ] ++ stdenv.lib.optionals (! crossStageStatic) [
         "-B${lib.getLib dep}${dep.libdir or "/lib"}"
       ]);
diff --git a/pkgs/development/compilers/zz/default.nix b/pkgs/development/compilers/zz/default.nix
index 7ac59cc5869..273873c8801 100644
--- a/pkgs/development/compilers/zz/default.nix
+++ b/pkgs/development/compilers/zz/default.nix
@@ -1,19 +1,19 @@
 { lib, rustPlatform, fetchFromGitHub, makeWrapper, z3 }:
 
 rustPlatform.buildRustPackage rec {
-  pname = "zz-unstable";
-  version = "2020-03-02";
+  pname = "zz";
+  version = "0.1";
 
   src = fetchFromGitHub {
     owner = "aep";
     repo = "zz";
-    rev = "2dd92b959f7c34bf99af84b263e3864a5c41a0fe";
-    sha256 = "14ch5qgga2vpxvb53v4v4y6cwy3kkm10x1vbfpyfa7im57syib85";
+    rev = version;
+    sha256 = "0kqrfm2r9wn0p2c3lcprsy03p9qhrwjs990va8qi59jp704l84ad";
   };
 
   nativeBuildInputs = [ makeWrapper ];
 
-  cargoSha256 = "1m9az3adbkx2ab6fkg64cr7f9d73jbx8kx2pmgpw29csmh9hzqjy";
+  cargoSha256 = "0yllcqxyyhwr9h0z8q84l0ms8x6jrqhpg79ik4xng6h5yf4ab0pq";
 
   postInstall = ''
     wrapProgram $out/bin/zz --prefix PATH ":" "${lib.getBin z3}/bin"
diff --git a/pkgs/development/guile-modules/guile-cairo/default.nix b/pkgs/development/guile-modules/guile-cairo/default.nix
index 690fce9da66..99e3ddf34f1 100644
--- a/pkgs/development/guile-modules/guile-cairo/default.nix
+++ b/pkgs/development/guile-modules/guile-cairo/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "guile-cairo";
-  version = "1.10.0";
+  version = "1.11.0";
 
   src = fetchurl {
     url = "mirror://savannah/guile-cairo/${pname}-${version}.tar.gz";
-    sha256 = "0p6xrhf2k6n5dybn88050za7h90gnd7534n62l53vsca187pwgdf";
+    sha256 = "11fn2x2973dizzw94fkz6rj9crsyzchphq5097lvbkvqpzbyidyp";
   };
 
   nativeBuildInputs = [ pkgconfig ];
diff --git a/pkgs/development/libraries/cpputest/default.nix b/pkgs/development/libraries/cpputest/default.nix
index 52d6ce5214e..d219a8e0bec 100644
--- a/pkgs/development/libraries/cpputest/default.nix
+++ b/pkgs/development/libraries/cpputest/default.nix
@@ -1,12 +1,12 @@
 {stdenv, fetchurl}:
 
 stdenv.mkDerivation rec {
-  version = "3.8";
+  version = "4.0";
   pname = "cpputest";
 
   src = fetchurl {
     url = "https://github.com/cpputest/cpputest/releases/download/v${version}/${pname}-${version}.tar.gz";
-    sha256 = "0mk48xd3klyqi7wf3f4wn4zqxxzmvrhhl32r25jzrixzl72wq7f8";
+    sha256 = "1xslavlb1974y5xvs8n1j9zkk05dlw8imy4saasrjlmibl895ii1";
   };
 
   meta = {
diff --git a/pkgs/development/libraries/duckdb/default.nix b/pkgs/development/libraries/duckdb/default.nix
new file mode 100644
index 00000000000..e37856abe2b
--- /dev/null
+++ b/pkgs/development/libraries/duckdb/default.nix
@@ -0,0 +1,26 @@
+{ stdenv
+, fetchFromGitHub
+, cmake
+}:
+
+stdenv.mkDerivation rec {
+  pname = "duckdb";
+  version = "0.1.7";
+
+  src = fetchFromGitHub {
+    owner = "cwida";
+    repo = "duckdb";
+    rev = "v${version}";
+    sha256 = "1pz2q9c3803w8vbqiz9lag4g1kgl4ff9xca0kpcz72ap39pbp5jk";
+  };
+
+  nativeBuildInputs = [ cmake ];
+
+  meta = with stdenv.lib; {
+    homepage = "https://github.com/cwida/duckdb";
+    description = "DuckDB is an embeddable SQL OLAP Database Management System";
+    license = licenses.mit;
+    platforms = platforms.all;
+    maintainers = with maintainers; [ costrouc ];
+  };
+}
diff --git a/pkgs/development/libraries/fmt/default.nix b/pkgs/development/libraries/fmt/default.nix
index 4741a3d156a..856553c6ded 100644
--- a/pkgs/development/libraries/fmt/default.nix
+++ b/pkgs/development/libraries/fmt/default.nix
@@ -2,7 +2,7 @@
 
 stdenv.mkDerivation rec {
   pname = "fmt";
-  version = "6.2.0";
+  version = "6.2.1";
 
   outputs = [ "out" "dev" ];
 
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
     owner = "fmtlib";
     repo = "fmt";
     rev = version;
-    sha256 = "1vr08a8q94j66gas7ddbpdbq72b2ikd0mkgd5zd3l63610n8qajs";
+    sha256 = "1i6nfxazq4d05r3sxyc3ziwkqq7s8rdbv9p16afv66aqmsbqqqic";
   };
 
   patches = [
@@ -28,6 +28,12 @@ stdenv.mkDerivation rec {
       url = "https://github.com/fmtlib/fmt/commit/78f041ab5b40a1145ba686aeb8013e8788b08cd2.patch";
       sha256 = "hjE6Q/ubA4UhvuJXgcsA3wiGoDK031P19njQRL9JF8M=";
     })
+
+    # Fix cmake config paths.
+    (fetchpatch {
+      url = "https://github.com/fmtlib/fmt/pull/1702.patch";
+      sha256 = "18cadqi7nac37ymaz3ykxjqs46rvki396g6qkqwp4k00cmic23y3";
+    })
   ];
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/gsettings-qt/default.nix b/pkgs/development/libraries/gsettings-qt/default.nix
index 5f09f437f04..cbba9c5fcea 100644
--- a/pkgs/development/libraries/gsettings-qt/default.nix
+++ b/pkgs/development/libraries/gsettings-qt/default.nix
@@ -1,16 +1,19 @@
-{ stdenv, fetchbzr, pkgconfig
+{ stdenv, fetchFromGitLab, pkgconfig
 , qmake, qtbase, qtdeclarative, wrapQtAppsHook
 , glib, gobject-introspection
+, genericUpdater, common-updater-scripts
 }:
 
-stdenv.mkDerivation {
+stdenv.mkDerivation rec {
   pname = "gsettings-qt";
-  version = "0.1.20170824";
+  version = "0.2";
 
-  src = fetchbzr {
-    url = "http://bazaar.launchpad.net/~system-settings-touch/gsettings-qt/trunk";
-    rev = "85";
-    sha256 = "1kcw0fgdyndx9c0dyha11wkj0gi05spdc1adf1609mrinbb4rnyi";
+  src = fetchFromGitLab {
+    group = "ubports";
+    owner = "core";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "14l8xphw4jd9ckqba13cyxq0i362x8lfsd0zlfawwi2z1q1vqm92";
   };
 
   nativeBuildInputs = [
@@ -52,9 +55,15 @@ stdenv.mkDerivation {
     done
   '';
 
+  passthru.updateScript = genericUpdater {
+    inherit pname version;
+    rev-prefix = "v";
+    versionLister = "${common-updater-scripts}/bin/list-git-tags ${src.meta.homepage}";
+  };
+
   meta = with stdenv.lib; {
-    description = "Qt/QML bindings for GSettings";
-    homepage = "https://launchpad.net/gsettings-qt";
+    description = "Library to access GSettings from Qt";
+    homepage = "https://gitlab.com/ubports/core/gsettings-qt";
     license = licenses.lgpl3;
     platforms = platforms.linux;
     maintainers = [ maintainers.romildo ];
diff --git a/pkgs/development/libraries/hyperscan/default.nix b/pkgs/development/libraries/hyperscan/default.nix
index d389b69087b..6e0d351b8bc 100644
--- a/pkgs/development/libraries/hyperscan/default.nix
+++ b/pkgs/development/libraries/hyperscan/default.nix
@@ -11,12 +11,12 @@
 
 stdenv.mkDerivation rec {
   pname = "hyperscan";
-  version = "5.2.1";
+  version = "5.3.0";
 
   src = fetchFromGitHub {
     owner = "intel";
     repo = pname;
-    sha256 = "09dgvmjhdbrfgrsmjljl4wn06a8zlv9sd4d4l6h6bfbz57d35f95";
+    sha256 = "0psfkzmyhqfrs750b10d0xv37rcz6nwsw1mnc7zagijckwis2wvj";
     rev = "v${version}";
   };
 
diff --git a/pkgs/development/libraries/libfilezilla/default.nix b/pkgs/development/libraries/libfilezilla/default.nix
index 10f46a67e89..3bd54951994 100644
--- a/pkgs/development/libraries/libfilezilla/default.nix
+++ b/pkgs/development/libraries/libfilezilla/default.nix
@@ -9,11 +9,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libfilezilla";
-  version = "0.21.0";
+  version = "0.22.0";
 
   src = fetchurl {
     url = "https://download.filezilla-project.org/${pname}/${pname}-${version}.tar.bz2";
-    sha256 = "1wjvxi3spkp58lay590bs5s2i8fn94lqkc7qvq4q7ns4l9k9z3av";
+    sha256 = "0ylgxw1lxdqvayy5285mlfrkr9cvsgasy2zci6g6mv9rng261xn5";
   };
 
   nativeBuildInputs = [ pkgconfig ];
diff --git a/pkgs/development/libraries/libmypaint/default.nix b/pkgs/development/libraries/libmypaint/default.nix
index 5cb971f5db8..074e3842933 100644
--- a/pkgs/development/libraries/libmypaint/default.nix
+++ b/pkgs/development/libraries/libmypaint/default.nix
@@ -12,7 +12,7 @@
 
 stdenv.mkDerivation rec {
   pname = "libmypaint";
-  version = "1.6.0";
+  version = "1.6.1";
 
   outputs = [ "out" "dev" ];
 
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
     owner = "mypaint";
     repo = "libmypaint";
     rev = "v${version}";
-    sha256 = "1fdyywm915mmilfmzp7lz4rnmm05kkw0adrdqpqi4n8icp4d530g";
+    sha256 = "1ppgpmnhph9h8ayx9776f79a0bxbdszfw9c6bw7c3ffy2yk40178";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/librsync/default.nix b/pkgs/development/libraries/librsync/default.nix
index d90106f89d8..9499be80f03 100644
--- a/pkgs/development/libraries/librsync/default.nix
+++ b/pkgs/development/libraries/librsync/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "librsync";
-  version = "2.3.0";
+  version = "2.3.1";
 
   src = fetchFromGitHub {
     owner = "librsync";
     repo = "librsync";
     rev = "v${version}";
-    sha256 = "18wwfbbggsjrd4w3dczxa2gv3zvx0fqp68b8h1zzvdbyn91f16mz";
+    sha256 = "131cd4asmpm4nskidzgiy8xibbnpibvvbq857a0pcky77min5g4z";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/mimalloc/default.nix b/pkgs/development/libraries/mimalloc/default.nix
index 03a1e77e7bf..bf6c5b1baf3 100644
--- a/pkgs/development/libraries/mimalloc/default.nix
+++ b/pkgs/development/libraries/mimalloc/default.nix
@@ -7,13 +7,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname   = "mimalloc";
-  version = "1.6.1";
+  version = "1.6.3";
 
   src = fetchFromGitHub {
     owner  = "microsoft";
     repo   = pname;
     rev    = "v${version}";
-    sha256 = "1zql498587wvb0gaavnzxj2zm535sgm22x0sjgl4ncfk7ragnv9c";
+    sha256 = "0hk30adrm0s1g5flfaqfr3lc72y3hlmhqnyrqd7p0y91rsaw86b9";
   };
 
   nativeBuildInputs = [ cmake ninja ];
diff --git a/pkgs/development/libraries/oniguruma/default.nix b/pkgs/development/libraries/oniguruma/default.nix
index ccbb1e3a665..8f6815788f0 100644
--- a/pkgs/development/libraries/oniguruma/default.nix
+++ b/pkgs/development/libraries/oniguruma/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "onig";
-  version = "6.9.4";
+  version = "6.9.5_rev1";
 
   src = fetchFromGitHub {
     owner = "kkos";
     repo = "oniguruma";
     rev = "v${version}";
-    sha256 = "11imbhj4p5w8lvrmcczccm1zq014h9j85r51z2ibb8jhf5p3lslh";
+    sha256 = "1sx683hbb58gbjvla69n5vxdzwqhjqisqbfkf9xi95wr7p9ycjhl";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/openmpi/default.nix b/pkgs/development/libraries/openmpi/default.nix
index 627ac68d68d..38041e6b5d8 100644
--- a/pkgs/development/libraries/openmpi/default.nix
+++ b/pkgs/development/libraries/openmpi/default.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchurl, fetchpatch, gfortran, perl, libnl
-, rdma-core, zlib, numactl, libevent, hwloc, pkgsTargetTarget, symlinkJoin
+, rdma-core, zlib, numactl, libevent, hwloc, targetPackages, symlinkJoin
 , libpsm2, libfabric
 
 # Enable CUDA support
@@ -75,16 +75,16 @@ in stdenv.mkDerivation rec {
     # default compilers should be indentical to the
     # compilers at build time
 
-    sed -i 's:compiler=.*:compiler=${pkgsTargetTarget.stdenv.cc}/bin/${pkgsTargetTarget.stdenv.cc.targetPrefix}cc:' \
+    sed -i 's:compiler=.*:compiler=${targetPackages.stdenv.cc}/bin/${targetPackages.stdenv.cc.targetPrefix}cc:' \
       $out/share/openmpi/mpicc-wrapper-data.txt
 
-    sed -i 's:compiler=.*:compiler=${pkgsTargetTarget.stdenv.cc}/bin/${pkgsTargetTarget.stdenv.cc.targetPrefix}cc:' \
+    sed -i 's:compiler=.*:compiler=${targetPackages.stdenv.cc}/bin/${targetPackages.stdenv.cc.targetPrefix}cc:' \
        $out/share/openmpi/ortecc-wrapper-data.txt
 
-    sed -i 's:compiler=.*:compiler=${pkgsTargetTarget.stdenv.cc}/bin/${pkgsTargetTarget.stdenv.cc.targetPrefix}c++:' \
+    sed -i 's:compiler=.*:compiler=${targetPackages.stdenv.cc}/bin/${targetPackages.stdenv.cc.targetPrefix}c++:' \
        $out/share/openmpi/mpic++-wrapper-data.txt
 
-    sed -i 's:compiler=.*:compiler=${pkgsTargetTarget.gfortran}/bin/${pkgsTargetTarget.gfortran.targetPrefix}gfortran:'  \
+    sed -i 's:compiler=.*:compiler=${gfortran}/bin/${gfortran.targetPrefix}gfortran:'  \
        $out/share/openmpi/mpifort-wrapper-data.txt
   '';
 
diff --git a/pkgs/development/libraries/quazip/default.nix b/pkgs/development/libraries/quazip/default.nix
index 13e3f15c842..4ca3be7fe79 100644
--- a/pkgs/development/libraries/quazip/default.nix
+++ b/pkgs/development/libraries/quazip/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "quazip";
-  version = "0.8.1";
+  version = "0.9";
 
   src = fetchFromGitHub {
     owner = "stachenov";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1g473gnsbkvxpsv8lbsmhspn7jnq86b05zzgqh11r581v8ndvz5s";
+    sha256 = "0psvf3d9akyyx3bckc9325nmbp97xiagf8la4vhca5xn2f430fbn";
   };
 
   buildInputs = [ zlib qtbase ];
diff --git a/pkgs/development/libraries/rdkafka/default.nix b/pkgs/development/libraries/rdkafka/default.nix
index d8f20d74a0d..7539d45627f 100644
--- a/pkgs/development/libraries/rdkafka/default.nix
+++ b/pkgs/development/libraries/rdkafka/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "rdkafka";
-  version = "1.4.0";
+  version = "1.4.2";
 
   src = fetchFromGitHub {
     owner = "edenhill";
     repo = "librdkafka";
     rev = "v${version}";
-    sha256 = "0axrzjmih1njjpxpwfb6pwjwkjy1b6s5s1sjf165m2cmd6x3vbap";
+    sha256 = "05mgrdzacn9kdpr68r5j0cvsvl54s52glnsc1ww9rcxx6p7hq1ly";
   };
 
   nativeBuildInputs = [ pkgconfig ];
diff --git a/pkgs/development/libraries/simgear/default.nix b/pkgs/development/libraries/simgear/default.nix
index bdd8dd9d999..ab4fd2c7bf2 100644
--- a/pkgs/development/libraries/simgear/default.nix
+++ b/pkgs/development/libraries/simgear/default.nix
@@ -4,7 +4,7 @@
 , curl
 }:
 let
-  version = "2019.1.1";
+  version = "2020.1.1";
   shortVersion = builtins.substring 0 6 version;
 in
 stdenv.mkDerivation rec {
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://sourceforge/flightgear/release-${shortVersion}/${pname}-${version}.tar.bz2";
-    sha256 = "12sl18limlj61hlwl3bcv5ysfdpsjmd07cxchhf9xa8shk6d87i0";
+    sha256 = "1z52r28xg05q6hdlh4szzfjlpgkvbdyn2dpaji9b57y58ccrqsfh";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/spdlog/default.nix b/pkgs/development/libraries/spdlog/default.nix
index 1839bb7bff1..add1dcf10cb 100644
--- a/pkgs/development/libraries/spdlog/default.nix
+++ b/pkgs/development/libraries/spdlog/default.nix
@@ -35,8 +35,8 @@ let
 in
 {
   spdlog_1 = generic {
-    version = "1.4.2";
-    sha256 = "1qc3rphvik44136ms0gjq2wmkl6qglri4fqxlhr2l5jwm8zhr8fc";
+    version = "1.6.0";
+    sha256 = "15fn8nd9xj7wrxcg9n4fjffid790qg2m366rx2lq2fc9v9walrxs";
   };
 
   spdlog_0 = generic {
diff --git a/pkgs/development/libraries/xercesc/default.nix b/pkgs/development/libraries/xercesc/default.nix
index 3873fe05e6b..8c7b1232014 100644
--- a/pkgs/development/libraries/xercesc/default.nix
+++ b/pkgs/development/libraries/xercesc/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "xerces-c";
-  version = "3.2.2";
+  version = "3.2.3";
 
   src = fetchurl {
     url = "mirror://apache/xerces/c/3/sources/${pname}-${version}.tar.gz";
-    sha256 = "04q4c460wqzyzmprjm22igcm1d52xr20ajxnhr33nv95mbw92qfx";
+    sha256 = "0zicsydx6s7carwr7q0csgkg1xncibd6lfp5chg2v2gvn54zr5pv";
   };
 
   # Disable SSE2 extensions on platforms for which they are not enabled by default
diff --git a/pkgs/development/libraries/xmlrpc-c/default.nix b/pkgs/development/libraries/xmlrpc-c/default.nix
index d9786d26a71..41cdbf0b4f1 100644
--- a/pkgs/development/libraries/xmlrpc-c/default.nix
+++ b/pkgs/development/libraries/xmlrpc-c/default.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl, curl, libxml2 }:
 
 stdenv.mkDerivation rec {
-  name = "xmlrpc-c-1.39.12";
+  name = "xmlrpc-c-1.51.06";
 
   src = fetchurl {
     url = "mirror://sourceforge/xmlrpc-c/${name}.tgz";
-    sha256 = "026fh7w7y3q9pvxd09i5d4hq3l6gd81n9k19yq4zwbc398kg6c6q";
+    sha256 = "1l4zz22q10081vr06b8sii0l3krr64xyiywz6rcladw8kiyxip06";
   };
 
   buildInputs = [ curl libxml2 ];
diff --git a/pkgs/development/ocaml-modules/biocaml/default.nix b/pkgs/development/ocaml-modules/biocaml/default.nix
index de54c24b774..be62a1c6d2c 100644
--- a/pkgs/development/ocaml-modules/biocaml/default.nix
+++ b/pkgs/development/ocaml-modules/biocaml/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildDunePackage, fetchFromGitHub
+{ stdenv, buildDunePackage, fetchFromGitHub, fetchpatch
 , ounit, async, base64, camlzip, cfstream
 , core, ppx_jane, ppx_sexp_conv, rresult, uri, xmlm }:
 
@@ -17,6 +17,12 @@ buildDunePackage rec {
     sha256 = "1f19nc8ld0iv45jjnsvaah3ddj88s2n9wj8mrz726kzg85cfr8xj";
   };
 
+  # fix compilation without and disable -unsafe-string, needed for Ocaml 4.10:
+  patches = [ (fetchpatch {
+      url = "https://github.com/biocaml/biocaml/commit/597fa7b0d203684e45ffe03f56c74335b6173ffc.patch";
+      sha256 = "0b8jdg215cv2k4y3ww7vak2ag5v6v9w8b76qjivr5d1qxz47mqxv";
+  }) ];
+
   buildInputs = [ ppx_jane ppx_sexp_conv ];
   checkInputs = [ ounit ];
   propagatedBuildInputs = [ async base64 camlzip cfstream core rresult uri xmlm ];
diff --git a/pkgs/development/ocaml-modules/core/default.nix b/pkgs/development/ocaml-modules/core/default.nix
deleted file mode 100644
index a808975d250..00000000000
--- a/pkgs/development/ocaml-modules/core/default.nix
+++ /dev/null
@@ -1,30 +0,0 @@
-{stdenv, buildOcaml, fetchurl, type_conv,
- core_kernel_p4, bin_prot_p4, comparelib, custom_printf, enumerate,
- fieldslib_p4, herelib, pa_bench, pa_test, pa_ounit,
- pipebang, sexplib_p4, typerep_p4, variantslib_p4}:
-
-buildOcaml rec {
-  name = "core";
-  version = "112.24.01";
-
-  minimumSupportedOcamlVersion = "4.02";
-
-  src = fetchurl {
-    url = "https://github.com/janestreet/core/archive/${version}.tar.gz";
-    sha256 = "be5d53ebd4fd04ef23ebf9b3b2840c7aeced6bc4cc6cd3f5e89f71c9949000f4";
-  };
-
-  hasSharedObjects = true;
-
-  buildInputs = [ pa_bench pa_test pa_ounit ];
-  propagatedBuildInputs = [ type_conv core_kernel_p4 bin_prot_p4 comparelib
-                            custom_printf enumerate fieldslib_p4 herelib
-                            pipebang sexplib_p4 typerep_p4 variantslib_p4 ];
-
-  meta = with stdenv.lib; {
-    homepage = "https://github.com/janestreet/core";
-    description = "Jane Street Capital's standard library overlay";
-    license = licenses.asl20;
-    maintainers = [ maintainers.ericbmerritt ];
-  };
-}
diff --git a/pkgs/development/ocaml-modules/janestreet/core.nix b/pkgs/development/ocaml-modules/janestreet/core.nix
deleted file mode 100644
index ac62bc51b07..00000000000
--- a/pkgs/development/ocaml-modules/janestreet/core.nix
+++ /dev/null
@@ -1,19 +0,0 @@
-{stdenv, buildOcamlJane,
- core_kernel,
- bin_prot, fieldslib, sexplib, typerep, variantslib,
- ppx_assert, ppx_bench, ppx_driver, ppx_expect, ppx_inline_test, ppx_jane}:
-
-buildOcamlJane {
-  name = "core";
-  hash = "0nz6d5glgymbpchvcpw77yis9jgi2bll32knzy9vx99wn83zdrmd";
-  propagatedBuildInputs =
-    [ core_kernel bin_prot fieldslib sexplib typerep variantslib
-      ppx_assert ppx_bench ppx_driver ppx_expect ppx_inline_test ppx_jane ];
-
-  meta = with stdenv.lib; {
-    homepage = "https://github.com/janestreet/core";
-    description = "Jane Street Capital's standard library overlay";
-    license = licenses.asl20;
-    maintainers = [ maintainers.maurer maintainers.ericbmerritt ];
-  };
-}
diff --git a/pkgs/development/ocaml-modules/owl-base/default.nix b/pkgs/development/ocaml-modules/owl-base/default.nix
index 9d2bf74a3ac..3e1eb09faad 100644
--- a/pkgs/development/ocaml-modules/owl-base/default.nix
+++ b/pkgs/development/ocaml-modules/owl-base/default.nix
@@ -2,24 +2,25 @@
 
 buildDunePackage rec {
   pname = "owl-base";
-  version = "0.8.0";
+  version = "0.9.0";
 
   useDune2 = true;
 
   src = fetchFromGitHub {
-    owner  = "owlbarn";
-    repo   = "owl";
-    rev    = version;
-    sha256 = "1j3xmr4izfznmv8lbn8vkx9c77py2xr6fqyn6ypjlf5k9b8g4mmw";
+    owner = "owlbarn";
+    repo = "owl";
+    rev  = version;
+    sha256 = "0xxchsymmdbwszs6barqq8x4vqz5hbap64yxq82c2la9sdxgk0vv";
   };
 
   propagatedBuildInputs = [ stdlib-shims ];
 
-  minimumOCamlVersion = "4.06";
+  minimumOCamlVersion = "4.10";
 
   meta = with stdenv.lib; {
     description = "Numerical computing library for Ocaml";
     homepage = "https://ocaml.xyz";
+    changelog = "https://github.com/owlbarn/owl/releases";
     platforms = platforms.x86_64;
     maintainers = [ maintainers.bcdarwin ];
     license = licenses.mit;
diff --git a/pkgs/development/python-modules/branca/default.nix b/pkgs/development/python-modules/branca/default.nix
index 95ba6d537c3..7884ff65f28 100644
--- a/pkgs/development/python-modules/branca/default.nix
+++ b/pkgs/development/python-modules/branca/default.nix
@@ -10,11 +10,11 @@
 
 buildPythonPackage rec {
   pname = "branca";
-  version = "0.3.1";
+  version = "0.4.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "3e762c9bdf40725f3d05ea1fda8fae9b470bfada6474e43a1242c8204a7bb15e";
+    sha256 = "1f7drarwiw8fh17hpq8b3p4mfqgjbh3k045dvpx5z12d3a0zg7ca";
   };
 
   checkInputs = [ pytest selenium ];
diff --git a/pkgs/development/python-modules/cftime/default.nix b/pkgs/development/python-modules/cftime/default.nix
index 60946d23a1e..7638695ff2d 100644
--- a/pkgs/development/python-modules/cftime/default.nix
+++ b/pkgs/development/python-modules/cftime/default.nix
@@ -9,11 +9,11 @@
 
 buildPythonPackage rec {
   pname = "cftime";
-  version = "1.1.2";
+  version = "1.1.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "17w9myl8mg4isv4lb1nv64zim53ishi32f6m5m0s00q9a6v5qfb0";
+    sha256 = "1w2iakkzxfhyrqrspn40am8x7bzdp5qqdqbm1asbj7fa3mivi17x";
   };
 
   checkInputs = [ pytest coveralls pytestcov ];
diff --git a/pkgs/development/python-modules/convertdate/default.nix b/pkgs/development/python-modules/convertdate/default.nix
index 5a8608c5037..c60d4778012 100644
--- a/pkgs/development/python-modules/convertdate/default.nix
+++ b/pkgs/development/python-modules/convertdate/default.nix
@@ -2,14 +2,14 @@
 
 buildPythonPackage rec {
   pname = "convertdate";
-  version = "2.2.0";
+  version = "2.2.1";
 
   # Tests are not available in the PyPI tarball so use GitHub instead.
   src = fetchFromGitHub {
     owner = "fitnr";
     repo = pname;
     rev = "v${version}";
-    sha256 = "04j8k7a9qndmawy3m345py74y18hw7lb6gc0qp0mr8d68x99xjq0";
+    sha256 = "1xgi7x9b9kxm0q51bqnmwdm5lp8vwhx5yk4d1b23r37spz9dbhw5";
   };
 
   propagatedBuildInputs = [ pymeeus pytz ];
diff --git a/pkgs/development/python-modules/datadog/default.nix b/pkgs/development/python-modules/datadog/default.nix
index d08d0903886..807ed5f9a3d 100644
--- a/pkgs/development/python-modules/datadog/default.nix
+++ b/pkgs/development/python-modules/datadog/default.nix
@@ -4,11 +4,11 @@
 
 buildPythonPackage rec {
   pname = "datadog";
-  version = "0.35.0";
+  version = "0.36.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0qpy6mg9gfjxvjms0aaglzayhmdds4agv0lh05g2mkfw620nm8zl";
+    sha256 = "1kkbsrzxc2a6k319lh98qkinn99dzcqz8h4fm25q17dlgmc9gq9z";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/datasette/default.nix b/pkgs/development/python-modules/datasette/default.nix
index 06e611c8cbf..b5d9c3dfad6 100644
--- a/pkgs/development/python-modules/datasette/default.nix
+++ b/pkgs/development/python-modules/datasette/default.nix
@@ -18,6 +18,7 @@
 , aiohttp
 , beautifulsoup4
 , asgiref
+, setuptools
 }:
 
 buildPythonPackage rec {
@@ -43,6 +44,7 @@ buildPythonPackage rec {
     pint
     pluggy
     uvicorn
+    setuptools
   ];
 
   checkInputs = [
diff --git a/pkgs/development/python-modules/deprecated/default.nix b/pkgs/development/python-modules/deprecated/default.nix
index 3411247599e..d6e5acdeaf8 100644
--- a/pkgs/development/python-modules/deprecated/default.nix
+++ b/pkgs/development/python-modules/deprecated/default.nix
@@ -3,11 +3,11 @@
 
 buildPythonPackage rec {
   pname = "Deprecated";
-  version = "1.2.9";
+  version = "1.2.10";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1k7c5kkh8jxxqdm0cbcvmhn3mwj0rcjwapwbzmm5r04n78lpvwqc";
+    sha256 = "0x3zkmykcyjn8k57g8lcf89fxw8q7hvvcj6xkwb0f2zrnmpscnsj";
   };
 
   propagatedBuildInputs = [ wrapt ];
diff --git a/pkgs/development/python-modules/duckdb/default.nix b/pkgs/development/python-modules/duckdb/default.nix
new file mode 100644
index 00000000000..c839dea3d1a
--- /dev/null
+++ b/pkgs/development/python-modules/duckdb/default.nix
@@ -0,0 +1,46 @@
+{ lib
+, buildPythonPackage
+, duckdb
+, numpy
+, pandas
+, pybind11
+, setuptools_scm
+, pytestrunner
+, pytest
+}:
+
+buildPythonPackage rec {
+  pname = "duckdb";
+  inherit (duckdb) version src;
+
+  postConfigure = ''
+    cd tools/pythonpkg
+    export SETUPTOOLS_SCM_PRETEND_VERSION=${version}
+  '';
+
+  nativeBuildInputs = [
+    pybind11
+    setuptools_scm
+    pytestrunner
+  ];
+
+  checkInputs = [
+    pytest
+  ];
+
+  propagatedBuildInputs = [
+    numpy
+    pandas
+  ];
+
+  checkPhase = ''
+    pytest
+  '';
+
+  meta = with lib; {
+    description = "DuckDB is an embeddable SQL OLAP Database Management System";
+    homepage = "https://pypi.python.org/pypi/duckdb";
+    license = licenses.mit;
+    maintainers = [ maintainers.costrouc ];
+  };
+}
diff --git a/pkgs/development/python-modules/elasticsearch-dsl/default.nix b/pkgs/development/python-modules/elasticsearch-dsl/default.nix
index deef21985c6..712766fa58e 100644
--- a/pkgs/development/python-modules/elasticsearch-dsl/default.nix
+++ b/pkgs/development/python-modules/elasticsearch-dsl/default.nix
@@ -10,11 +10,11 @@
 
 buildPythonPackage rec {
   pname = "elasticsearch-dsl";
-  version = "7.1.0";
+  version = "7.2.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "3f860e0304d703f63b458fea3782f09a823ab07da7ee84ae4bff1aa63e22aedb";
+    sha256 = "19q91srlcvfrk5rnk18c0mzvki9l893g7rqgymfg0p8abb9c05a0";
   };
 
   propagatedBuildInputs = [ elasticsearch python-dateutil six ]
diff --git a/pkgs/development/python-modules/foxdot/default.nix b/pkgs/development/python-modules/foxdot/default.nix
index dc59fb6db3e..bbf8395190f 100644
--- a/pkgs/development/python-modules/foxdot/default.nix
+++ b/pkgs/development/python-modules/foxdot/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "FoxDot";
-  version = "0.8.7";
+  version = "0.8.8";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0c5iqdn17ip6lkf26xb1cwjvcly0448gvqmkbkvhnqy4birc8cf5";
+    sha256 = "06y626kgaz1wn1qajlngihpvd4qz8m6lx6sknmjqhhrznyji58wi";
   };
 
   propagatedBuildInputs = [ tkinter supercollider ];
diff --git a/pkgs/development/python-modules/geoalchemy2/default.nix b/pkgs/development/python-modules/geoalchemy2/default.nix
index ae2df2ce607..e4fbb37c966 100644
--- a/pkgs/development/python-modules/geoalchemy2/default.nix
+++ b/pkgs/development/python-modules/geoalchemy2/default.nix
@@ -7,11 +7,11 @@
 
 buildPythonPackage rec {
   pname = "GeoAlchemy2";
-  version = "0.7.0";
+  version = "0.8.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0lnmj9jky9pz227scmjxgvd8243higl24ndc0cc668mm36cnwapc";
+    sha256 = "0kqxm9imqjbhjj5imvf2kl57di454xmnnsr3i0cs66ibq90nx5m8";
   };
 
   propagatedBuildInputs = [ sqlalchemy shapely ];
diff --git a/pkgs/development/python-modules/google-api-python-client/default.nix b/pkgs/development/python-modules/google-api-python-client/default.nix
index b787e08dbbf..12668e979d2 100644
--- a/pkgs/development/python-modules/google-api-python-client/default.nix
+++ b/pkgs/development/python-modules/google-api-python-client/default.nix
@@ -4,11 +4,11 @@
 
 buildPythonPackage rec {
   pname = "google-api-python-client";
-  version = "1.8.3";
+  version = "1.8.4";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "10alijbbv3nsj7dfnv3fpx0gf1s9d4c7yjq0mv51szcx777qskmy";
+    sha256 = "06csvbpdv3kl806nqvh5hpag86wpafp1q9r07m7kc1fw3xhi5qmv";
   };
 
   # No tests included in archive
diff --git a/pkgs/development/python-modules/helpdev/default.nix b/pkgs/development/python-modules/helpdev/default.nix
index 5977ec3aee2..c4caf0e46ad 100644
--- a/pkgs/development/python-modules/helpdev/default.nix
+++ b/pkgs/development/python-modules/helpdev/default.nix
@@ -7,11 +7,11 @@
 
 buildPythonPackage rec {
   pname = "helpdev";
-  version = "0.6.10";
+  version = "0.7.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "9e61d24458b7506809670222ca656b139e67d46c530cd227a899780152d7b44e";
+    sha256 = "0gfvj28i82va7c264jl2p4cdsl3lpf9fpb9cyjnis55crfdafqmv";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/hg-evolve/default.nix b/pkgs/development/python-modules/hg-evolve/default.nix
index 6ec62f25a59..ba70a25a68d 100644
--- a/pkgs/development/python-modules/hg-evolve/default.nix
+++ b/pkgs/development/python-modules/hg-evolve/default.nix
@@ -6,11 +6,11 @@
 
 buildPythonPackage rec {
   pname = "hg-evolve";
-  version = "9.3.1";
+  version = "10.0.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0d3gd8k0p6n2flcf7kny1zjvrbbrwbbq4lq82ah6gvnbvllxm4hj";
+    sha256 = "03kn1c62y6rb851wjhsaxkrwq223hkc4ij59i85999byyb2hyqad";
   };
 
   doCheck = false;
diff --git a/pkgs/development/python-modules/hstspreload/default.nix b/pkgs/development/python-modules/hstspreload/default.nix
index e75894611a1..635ad7a283e 100644
--- a/pkgs/development/python-modules/hstspreload/default.nix
+++ b/pkgs/development/python-modules/hstspreload/default.nix
@@ -6,14 +6,14 @@
 
 buildPythonPackage rec {
   pname = "hstspreload";
-  version = "2020.5.5";
+  version = "2020.5.19";
   disabled = isPy27;
 
   src = fetchFromGitHub {
     owner = "sethmlarson";
     repo = pname;
     rev = version;
-    sha256 = "0n3wp2ihjaxlq002rv141766cx4wgk0amg1cb6v30zp0m4054w7d";
+    sha256 = "09a5vajzw3f2kpdq9ydzx1f840xmdmzb6br3ns79mnqnsw6nfs6z";
   };
 
   # tests require network connection
diff --git a/pkgs/development/python-modules/immutables/default.nix b/pkgs/development/python-modules/immutables/default.nix
index 7de40cdfe5b..41dcc6b2c11 100644
--- a/pkgs/development/python-modules/immutables/default.nix
+++ b/pkgs/development/python-modules/immutables/default.nix
@@ -2,12 +2,12 @@
 
 buildPythonPackage rec {
   pname = "immutables";
-  version = "0.12";
+  version = "0.14";
   disabled = pythonOlder "3.5";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "12i8r5z0y6ya850fwl2r4hig5hyli8skvjmgylapxa4zbr13fqmc";
+    sha256 = "0y0aqw29g525frdnmv9paljzacpp4s21sadfbca5b137iciwr8d0";
   };
 
   meta = {
diff --git a/pkgs/development/python-modules/minidb/default.nix b/pkgs/development/python-modules/minidb/default.nix
index a324c8d7d08..dbe9597ea0c 100644
--- a/pkgs/development/python-modules/minidb/default.nix
+++ b/pkgs/development/python-modules/minidb/default.nix
@@ -5,14 +5,14 @@
 
 buildPythonPackage rec {
   pname = "minidb";
-  version = "2.0.3";
+  version = "2.0.4";
   disabled = !isPy3k;
 
   src = fetchFromGitHub {
     owner = "thp";
     repo = "minidb";
     rev = version;
-    sha256 = "0c6y3x957pc5sxkl34lymhkwpn4nlsfw07fcv4y9p2zdb7kjd1gc";
+    sha256 = "0i607rkfx0rkyllcx4vf3w2z0wxzs1gqigfw87q90pjrbbh2q4sb";
   };
 
   # module imports are incompatible with python2
diff --git a/pkgs/development/python-modules/nbsmoke/default.nix b/pkgs/development/python-modules/nbsmoke/default.nix
index 46d47fd1679..8f263246893 100644
--- a/pkgs/development/python-modules/nbsmoke/default.nix
+++ b/pkgs/development/python-modules/nbsmoke/default.nix
@@ -14,11 +14,11 @@
 
 buildPythonPackage rec {
   pname = "nbsmoke";
-  version = "0.3.0";
+  version = "0.4.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "070e999db3902a0c62a94d76de8fb98da21eaee22d9e90eb42f1636c87e1b805";
+    sha256 = "06as8vh17m0nkp3fpkp42m990a5zjfl2iaa17da99ksh7886mjpc";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/nodeenv/default.nix b/pkgs/development/python-modules/nodeenv/default.nix
index f3f1c2b86c1..14a67fe54ae 100644
--- a/pkgs/development/python-modules/nodeenv/default.nix
+++ b/pkgs/development/python-modules/nodeenv/default.nix
@@ -1,4 +1,4 @@
-{ lib, buildPythonPackage, fetchPypi }:
+{ lib, buildPythonPackage, fetchPypi, setuptools }:
 
 buildPythonPackage rec {
   pname = "nodeenv";
@@ -9,6 +9,10 @@ buildPythonPackage rec {
     sha256 = "ad8259494cf1c9034539f6cced78a1da4840a4b157e23640bc4a0c0546b0cb7a";
   };
 
+  propagatedBuildInputs = [
+    setuptools
+  ];
+
   # Tests not included in PyPI tarball
   doCheck = false;
 
diff --git a/pkgs/development/python-modules/paste/default.nix b/pkgs/development/python-modules/paste/default.nix
index a9c86513fe8..9d45f35d365 100644
--- a/pkgs/development/python-modules/paste/default.nix
+++ b/pkgs/development/python-modules/paste/default.nix
@@ -8,12 +8,12 @@
 
 buildPythonPackage rec {
   pname = "paste";
-  version = "3.2.2";
+  version = "3.4.0";
 
   src = fetchPypi {
     pname = "Paste";
     inherit version;
-    sha256 = "15p95br9x7zjy0cckdy6xmhfg61cg49rhi75jd00svrnz234s7qb";
+    sha256 = "16sichvhyci1gaarkjs35mai8vphh7b244qm14hj1isw38nx4c03";
   };
 
   propagatedBuildInputs = [ six ];
diff --git a/pkgs/development/python-modules/pikepdf/default.nix b/pkgs/development/python-modules/pikepdf/default.nix
index f28ea5b24a6..86aef0d6adf 100644
--- a/pkgs/development/python-modules/pikepdf/default.nix
+++ b/pkgs/development/python-modules/pikepdf/default.nix
@@ -22,12 +22,12 @@
 
 buildPythonPackage rec {
   pname = "pikepdf";
-  version = "1.11.2";
+  version = "1.13.0";
   disabled = ! isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "03y6xkkqz6rsk23304gg0mn4vgdb0mh1wi9xzrk5vz2ma2wyp8i6";
+    sha256 = "0fpsjrppka0mrmkbzysi1s072d18ilsnch4lhd21k2qmvxp2hpmk";
   };
 
   buildInputs = [
diff --git a/pkgs/development/python-modules/plotly/default.nix b/pkgs/development/python-modules/plotly/default.nix
index 2d14488c4ee..eff9e5d8629 100644
--- a/pkgs/development/python-modules/plotly/default.nix
+++ b/pkgs/development/python-modules/plotly/default.nix
@@ -11,11 +11,11 @@
 
 buildPythonPackage rec {
   pname = "plotly";
-  version = "4.6.0";
+  version = "4.7.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0br996lqbyq1prq9hhrzkgpicz5fgvxamzjrrpms20a2y1alkwv1";
+    sha256 = "1s0hg91dvsklgdk3bi483f8in7vr51lx49smvr2ngvrws7nwsj3s";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/ponywhoosh/default.nix b/pkgs/development/python-modules/ponywhoosh/default.nix
new file mode 100644
index 00000000000..589be17b016
--- /dev/null
+++ b/pkgs/development/python-modules/ponywhoosh/default.nix
@@ -0,0 +1,23 @@
+{ lib, buildPythonPackage, fetchPypi, pony, whoosh }:
+
+buildPythonPackage rec {
+  pname = "ponywhoosh";
+  version = "1.7.8";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "1mggj9d265hra4z67qyla686qvl0cf79655cszi136gh9hqlibv9";
+  };
+
+  propagatedBuildInputs = [
+    pony
+    whoosh
+  ];
+
+  meta = with lib; {
+    homepage = "https://pythonhosted.org/ponywhoosh/";
+    description = "Make your database over PonyORM searchable";
+    license = licenses.mit;
+    maintainers = with maintainers; [ alexarice ];
+  };
+}
diff --git a/pkgs/development/python-modules/py_scrypt/default.nix b/pkgs/development/python-modules/py_scrypt/default.nix
index 056a0299670..0606dc35bf7 100644
--- a/pkgs/development/python-modules/py_scrypt/default.nix
+++ b/pkgs/development/python-modules/py_scrypt/default.nix
@@ -19,7 +19,7 @@ buildPythonPackage rec {
   meta = with stdenv.lib; {
     description = "Bindings for scrypt key derivation function library";
     homepage = "https://pypi.python.org/pypi/scrypt";
-    maintainers = with maintainers; [ asymmetric ];
+    maintainers = [];
     license = licenses.bsd2;
   };
 }
diff --git a/pkgs/development/python-modules/pyacoustid/default.nix b/pkgs/development/python-modules/pyacoustid/default.nix
index 29cdfbc6599..75b0964e259 100644
--- a/pkgs/development/python-modules/pyacoustid/default.nix
+++ b/pkgs/development/python-modules/pyacoustid/default.nix
@@ -8,11 +8,11 @@
 
 buildPythonPackage rec {
   pname = "pyacoustid";
-  version = "1.1.7";
+  version = "1.2.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "07394a8ae84625a0a6fef2d891d19687ff59cd955caaf48097da2826043356fd";
+    sha256 = "0c3dsnfyldnsmyzczp5s5aqvbzcn360s0h4l3gm3k53lg57f762z";
   };
 
   propagatedBuildInputs = [ requests audioread ];
diff --git a/pkgs/development/python-modules/pyatv/default.nix b/pkgs/development/python-modules/pyatv/default.nix
index 19aa73bec59..b8a607f4d45 100644
--- a/pkgs/development/python-modules/pyatv/default.nix
+++ b/pkgs/development/python-modules/pyatv/default.nix
@@ -1,19 +1,49 @@
-{ stdenv, buildPythonPackage, fetchPypi, srptools, aiohttp, zeroconf
-, ed25519, cryptography, curve25519-donna, pytest, pytestrunner
-, netifaces, asynctest, virtualenv, toml, filelock, tox }:
+{ stdenv, buildPythonPackage, fetchPypi
+, aiohttp
+, aiozeroconf
+, asynctest
+, cryptography
+, deepdiff
+, netifaces
+, protobuf
+, pytest
+, pytest-aiohttp
+, pytest-asyncio
+, pytestrunner
+, srptools
+}:
 
 buildPythonPackage rec {
   pname = "pyatv";
-  version = "0.3.13";
+  version = "0.6.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "8fc1a903a9d666e4109127410d35a83458559a86bc0de3fe1ffb3f15d2d653b3";
+    sha256 = "0f9wj1ggllwpjd9nh6nsrck7m4gbz29q6vqbrhbkc2kz6waqkgwc";
   };
 
-  propagatedBuildInputs = [ srptools aiohttp zeroconf ed25519 cryptography curve25519-donna tox ];
+  nativeBuildInputs = [ pytestrunner];
 
-  checkInputs = [ pytest pytestrunner netifaces asynctest virtualenv toml filelock ];
+  propagatedBuildInputs = [
+    aiozeroconf
+    srptools
+    aiohttp
+    protobuf
+    cryptography
+    netifaces
+  ];
+
+  checkInputs = [
+    deepdiff
+    pytest
+    pytest-aiohttp
+    pytest-asyncio
+  ];
+
+  # just run vanilla pytest to avoid inclusion of coverage reports and xdist
+  checkPhase = ''
+    pytest
+  '';
 
   meta = with stdenv.lib; {
     description = "A python client library for the Apple TV";
diff --git a/pkgs/development/python-modules/pychromecast/default.nix b/pkgs/development/python-modules/pychromecast/default.nix
index cc69bbc9ee7..c291e6e47fd 100644
--- a/pkgs/development/python-modules/pychromecast/default.nix
+++ b/pkgs/development/python-modules/pychromecast/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "PyChromecast";
-  version = "4.2.3";
+  version = "5.2.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1nqy9zvzxzncfmmbsj4ccb36gymh4pp1n1l9fdhv8fi0ai9b7dyp";
+    sha256 = "052q25k3v5fwa02hf5zdpjpfb94ml9g67cqwjjvf6vdana8w3gwh";
   };
 
   disabled = !isPy3k;
diff --git a/pkgs/development/python-modules/pydub/default.nix b/pkgs/development/python-modules/pydub/default.nix
index 669d798312b..8499db31e02 100644
--- a/pkgs/development/python-modules/pydub/default.nix
+++ b/pkgs/development/python-modules/pydub/default.nix
@@ -2,13 +2,13 @@
 
 buildPythonPackage rec {
   pname = "pydub";
-  version = "0.23.1";
+  version = "0.24.0";
   # pypi version doesn't include required data files for tests
   src = fetchFromGitHub {
     owner = "jiaaro";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1v0bghy4j2nnkgf1r8rbz4s7war872asyy08pc0x1iy1qs275i7s";
+    sha256 = "0cnhkk44cn3wa4fmd1rwzdx2zgrn87qg25pbcp9wsisdlpn4bj6d";
   };
 
 
diff --git a/pkgs/development/python-modules/pygments-better-html/default.nix b/pkgs/development/python-modules/pygments-better-html/default.nix
new file mode 100644
index 00000000000..87b8e0b3ffb
--- /dev/null
+++ b/pkgs/development/python-modules/pygments-better-html/default.nix
@@ -0,0 +1,31 @@
+{ stdenv
+, buildPythonPackage
+, fetchPypi
+, pygments
+, isPy3k
+}:
+
+buildPythonPackage rec {
+  pname = "pygments_better_html";
+  version = "0.1.4";
+  disabled = ! isPy3k;
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "028szd3k295yhz943bj19i4kx6f0pfh1fd2q14id0g84dl4i49dm";
+  };
+
+  propagatedBuildInputs = [ pygments ];
+
+  # has no tests
+  doCheck = false;
+
+  pythonImportsCheck = [ "pygments_better_html" ];
+
+  meta = with stdenv.lib; {
+    homepage = "https://github.com/Kwpolska/pygments_better_html";
+    description = "Improved line numbering for Pygments’ HTML formatter.";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ hexa ];
+  };
+}
diff --git a/pkgs/development/python-modules/qtconsole/default.nix b/pkgs/development/python-modules/qtconsole/default.nix
index 0a932729ff3..4cadba28a8a 100644
--- a/pkgs/development/python-modules/qtconsole/default.nix
+++ b/pkgs/development/python-modules/qtconsole/default.nix
@@ -15,11 +15,11 @@
 
 buildPythonPackage rec {
   pname = "qtconsole";
-  version = "4.7.3";
+  version = "4.7.4";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "8f5ae5571f0e921db9f2d12613ed667c350ee22c7db598d9bbbe143e8533f932";
+    sha256 = "1zgm57011kpbh6388p8cqwkcgqwlmb7rc9cy3zn9rrnna48byj7x";
   };
 
   checkInputs = [ nose ] ++ lib.optionals isPy27 [mock];
diff --git a/pkgs/development/python-modules/rasterio/default.nix b/pkgs/development/python-modules/rasterio/default.nix
index 0916695ed43..f5e418d925a 100644
--- a/pkgs/development/python-modules/rasterio/default.nix
+++ b/pkgs/development/python-modules/rasterio/default.nix
@@ -6,14 +6,14 @@
 
 buildPythonPackage rec {
   pname = "rasterio";
-  version = "1.1.3";
+  version = "1.1.4";
 
   # Pypi doesn't ship the tests, so we fetch directly from GitHub
   src = fetchFromGitHub {
     owner = "mapbox";
     repo = "rasterio";
     rev = version;
-    sha256 = "0i081bkmv7qw24ivmdh92ma6x0hnjlf8jgj6rp2c3rb8hjzmi452";
+    sha256 = "1a1ik66b7n6h9gxlr5yb16hhf5h9117av2ggykpfaw699xxhnz30";
   };
 
   checkInputs = [ boto3 pytest pytestcov packaging hypothesis ] ++ lib.optional (!isPy3k) mock;
diff --git a/pkgs/development/python-modules/slixmpp/default.nix b/pkgs/development/python-modules/slixmpp/default.nix
index b5315549119..2fd7d92e3d7 100644
--- a/pkgs/development/python-modules/slixmpp/default.nix
+++ b/pkgs/development/python-modules/slixmpp/default.nix
@@ -2,13 +2,13 @@
 
 buildPythonPackage rec {
   pname = "slixmpp";
-  version = "1.4.2";
+  version = "1.5.2";
 
   disabled = !isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0rqpmscxjznxyz3dyxpc56gib319k01vl837r8g8w57dinz4y863";
+    sha256 = "0c5g4r5c6zm5fgvk6dd0dbx9gl3ws2swajc5knlacnpfykwzp5b4";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/spglib/default.nix b/pkgs/development/python-modules/spglib/default.nix
index 02155483b20..2044e379937 100644
--- a/pkgs/development/python-modules/spglib/default.nix
+++ b/pkgs/development/python-modules/spglib/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "spglib";
-  version = "1.14.1.post0";
+  version = "1.15.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0kmllcch5p20ylxirqiqzls567jr2808rbld9i8f1kf0205al8qq";
+    sha256 = "0c1nbpd5wy361xga8lw36xwc9yyz7rylsjr0z7aw7bn3s35bnkbx";
   };
 
   propagatedBuildInputs = [ numpy ];
diff --git a/pkgs/development/python-modules/sqlalchemy-utils/default.nix b/pkgs/development/python-modules/sqlalchemy-utils/default.nix
index db23e2ab7db..67242a99165 100644
--- a/pkgs/development/python-modules/sqlalchemy-utils/default.nix
+++ b/pkgs/development/python-modules/sqlalchemy-utils/default.nix
@@ -5,12 +5,12 @@
 
 buildPythonPackage rec {
   pname = "sqlalchemy-utils";
-  version = "0.36.3";
+  version = "0.36.5";
 
   src = fetchPypi {
     inherit version;
     pname = "SQLAlchemy-Utils";
-    sha256 = "0fj9qiz5hq8gf9pnir077sl58chry7jz63fnj1vgx5rmq1dsys7j";
+    sha256 = "0d3lrhqdw3lhkj79wpfxi6cmlxnw99prpq8m70c5q8kinv26h038";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/stevedore/default.nix b/pkgs/development/python-modules/stevedore/default.nix
index d6ec10579f9..0f73f8e8163 100644
--- a/pkgs/development/python-modules/stevedore/default.nix
+++ b/pkgs/development/python-modules/stevedore/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "stevedore";
-  version = "1.31.0";
+  version = "1.32.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "054apq55yg7058pmbnyc8jhrcpi9clmi0sm7znhwg0d676brywz0";
+    sha256 = "02shnm8r8c0bv494m8sjnrrlqy0pz5q5xrzpq069bx9sc8fszbqq";
   };
 
   doCheck = false;
diff --git a/pkgs/development/python-modules/tablib/default.nix b/pkgs/development/python-modules/tablib/default.nix
index a4933f1b206..b1427a81331 100644
--- a/pkgs/development/python-modules/tablib/default.nix
+++ b/pkgs/development/python-modules/tablib/default.nix
@@ -12,12 +12,12 @@
 
 buildPythonPackage rec {
   pname = "tablib";
-  version = "1.1.0";
+  version = "2.0.0";
   disabled = isPy27;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "19wvx40lgm1d1zqscznwjklchczcmv07cqfigalmpj7i7ym0j6ad";
+    sha256 = "1rvvdchdva7j9b29ay0sg8y33pjhpmzynl38wz2rl89pph8gmhlc";
   };
 
   propagatedBuildInputs = [ xlwt openpyxl pyyaml xlrd odfpy ];
diff --git a/pkgs/development/python-modules/zeroconf/default.nix b/pkgs/development/python-modules/zeroconf/default.nix
index 0985da20802..d293ae449c1 100644
--- a/pkgs/development/python-modules/zeroconf/default.nix
+++ b/pkgs/development/python-modules/zeroconf/default.nix
@@ -10,12 +10,12 @@
 
 buildPythonPackage rec {
   pname = "zeroconf";
-  version = "0.26.0";
+  version = "0.26.1";
   disabled = isPy27;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "029wxa50dwf4hsi7w0d8wmywh125aaaa7l4g024z1cyi511iy5h1";
+    sha256 = "09rvliph7phvgzwmmdv1kwcp3andpiiqfpkrwq1vkxvwqa3mgwji";
   };
 
   propagatedBuildInputs = [ ifaddr ]
diff --git a/pkgs/development/tools/agda-pkg/default.nix b/pkgs/development/tools/agda-pkg/default.nix
new file mode 100644
index 00000000000..0d93694b50f
--- /dev/null
+++ b/pkgs/development/tools/agda-pkg/default.nix
@@ -0,0 +1,44 @@
+{ lib, python3Packages }:
+
+with python3Packages;
+
+buildPythonApplication rec {
+  pname = "agda-pkg";
+  version = "0.1.50";
+
+  disabled = pythonOlder "3.6";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "0wpw90kw3danw91m3jzfdn7zmclimmiz74f77mpij9b1w6wvhm11";
+  };
+
+  # Checks need internet access, so we just check the program executes
+  # At the moment the help page needs to write to $HOME, this can
+  # be removed if https://github.com/agda/agda-pkg/issues/40 is fixed
+  checkPhase = ''
+    HOME=$NIX_BUILD_TOP $out/bin/apkg --help > /dev/null
+  '';
+
+  propagatedBuildInputs = [
+    click
+    GitPython
+    pony
+    whoosh
+    natsort
+    click-log
+    requests
+    humanize
+    distlib
+    jinja2
+    pyyaml
+    ponywhoosh
+  ];
+
+  meta = with lib; {
+    homepage = "https://agda.github.io/agda-pkg/";
+    description = "Package manager for Agda";
+    license = licenses.mit;
+    maintainers = with maintainers; [ alexarice ];
+  };
+}
diff --git a/pkgs/development/tools/analysis/cargo-tarpaulin/default.nix b/pkgs/development/tools/analysis/cargo-tarpaulin/default.nix
index 1d880f04dd3..b743ba4a2de 100644
--- a/pkgs/development/tools/analysis/cargo-tarpaulin/default.nix
+++ b/pkgs/development/tools/analysis/cargo-tarpaulin/default.nix
@@ -2,13 +2,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-tarpaulin";
-  version = "0.12.4";
+  version = "0.13.2";
 
   src = fetchFromGitHub {
     owner = "xd009642";
     repo = "tarpaulin";
     rev = "${version}";
-    sha256 = "0y58800n61s8wmpcpgw5vpywznwwbp0d30fz2z0kjx4mpwmva4g4";
+    sha256 = "0sjd0xvphrc2kxzvwk4l0dnshn062ghn9f29h7k2ifsf2myl7066";
   };
 
   nativeBuildInputs = [
@@ -16,7 +16,7 @@ rustPlatform.buildRustPackage rec {
   ];
   buildInputs = [ openssl ];
 
-  cargoSha256 = "12hkzq2xn4g5k94kjirjnnz4dddqg7akxnp3qyfkz092vvp25k9z";
+  cargoSha256 = "1w9pymg989kl29s4dhr32ck0nq61pg9h1qf4aad1sv83llbqahq0";
   #checkFlags = [ "--test-threads" "1" ];
   doCheck = false;
 
diff --git a/pkgs/development/tools/build-managers/mill/default.nix b/pkgs/development/tools/build-managers/mill/default.nix
index 0e7a4f3d979..dffdbdb9aed 100644
--- a/pkgs/development/tools/build-managers/mill/default.nix
+++ b/pkgs/development/tools/build-managers/mill/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "mill";
-  version = "0.6.2";
+  version = "0.7.1";
 
   src = fetchurl {
     url = "https://github.com/lihaoyi/mill/releases/download/${version}/${version}";
-    sha256 = "1s2ndry0mpjs8hy8rrxnyarkzqjz7zzh5h541v3fkzgc9rsd6ifb";
+    sha256 = "1fa7cjrp16618hj6xzrxiy44ghxvzgkvygzdzyi8jj2y5jnwxf10";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/development/tools/fdroidserver/default.nix b/pkgs/development/tools/fdroidserver/default.nix
index b83070296aa..c038e4fdfaf 100644
--- a/pkgs/development/tools/fdroidserver/default.nix
+++ b/pkgs/development/tools/fdroidserver/default.nix
@@ -4,14 +4,14 @@
 , lib }:
 
 python.pkgs.buildPythonApplication rec {
-  version = "1.1.6";
+  version = "1.1.7";
   pname = "fdroidserver";
 
   src = fetchFromGitLab {
     owner = "fdroid";
     repo = "fdroidserver";
     rev = version;
-    sha256 = "0bz3pb34bkdg3l6dvpzynnfhblv18x88a5bh2dm8v31g5f9agh7r";
+    sha256 = "1xs4qmja7mm9m67368k2s9p7pmkdx9xz4g3xrsks0s8hwwyliz1s";
   };
 
   patchPhase = ''
diff --git a/pkgs/development/tools/java/dex2jar/default.nix b/pkgs/development/tools/java/dex2jar/default.nix
new file mode 100644
index 00000000000..c1f7f132985
--- /dev/null
+++ b/pkgs/development/tools/java/dex2jar/default.nix
@@ -0,0 +1,44 @@
+{ stdenv
+, lib
+, fetchurl
+, jre
+, makeWrapper
+, unzip
+}:
+stdenv.mkDerivation rec {
+  name = "${pname}-${version}";
+  pname = "dex2jar";
+  version  = "2.0";
+
+  src = fetchurl {
+    url = "mirror://sourceforge/${pname}/${name}.zip";
+    sha256 = "1g3mrbyl8sdw1nhp17z23qbfzqpa0w2yxrywgphvd04jdr6yn1vr";
+  };
+
+  nativeBuildInputs = [ makeWrapper unzip ];
+
+  postPatch = ''
+    rm *.bat
+    chmod +x *.sh
+  '';
+
+  installPhase = ''
+    f=$out/lib/dex2jar/
+
+    mkdir -p $f $out/bin
+
+    mv * $f
+    for i in $f/*.sh; do
+      n=$(basename ''${i%.sh})
+      makeWrapper $i $out/bin/$n --prefix PATH : ${lib.makeBinPath [ jre ] }
+    done
+  '';
+
+  meta = with stdenv.lib; {
+    homepage = https://sourceforge.net/projects/dex2jar/;
+    description = "Tools to work with android .dex and java .class files";
+    maintainers = with maintainers; [ makefu ];
+    license = licenses.asl20;
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/development/tools/k6/default.nix b/pkgs/development/tools/k6/default.nix
index 9b1b4926270..136b44bd843 100644
--- a/pkgs/development/tools/k6/default.nix
+++ b/pkgs/development/tools/k6/default.nix
@@ -2,7 +2,7 @@
 
 buildGoPackage rec {
   pname = "k6";
-  version = "0.24.0";
+  version = "0.26.2";
 
   goPackagePath = "github.com/loadimpact/k6";
 
@@ -10,14 +10,15 @@ buildGoPackage rec {
     owner = "loadimpact";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1riyyi4lxdaqilzzkxzzw3hzcrjjcylq2jh3p3656f99wiisvj28";
+    sha256 = "0s5haycpfnfyvxxhhm7205gzylsbjndx9f134f245p4xm5bxhxbf";
   };
 
   subPackages = [ "./" ];
 
   meta = with stdenv.lib; {
-    homepage = "https://k6.io/";
     description = "A modern load testing tool, using Go and JavaScript";
+    homepage = "https://k6.io/";
+    changelog = "https://github.com/loadimpact/k6/releases/tag/v${version}";
     license = licenses.agpl3Plus;
     maintainers = with maintainers; [ offline ];
   };
diff --git a/pkgs/development/tools/metals/default.nix b/pkgs/development/tools/metals/default.nix
index cf9ce2bd265..5f4af626877 100644
--- a/pkgs/development/tools/metals/default.nix
+++ b/pkgs/development/tools/metals/default.nix
@@ -31,6 +31,13 @@ stdenv.mkDerivation rec {
   installPhase = ''
     mkdir -p $out/bin
 
+    # This variant is not targeted at any particular client, clients are
+    # expected to declare their supported features in initialization options.
+    makeWrapper ${jre}/bin/java $out/bin/metals \
+      --prefix PATH : ${lib.makeBinPath [ jdk ]} \
+      --add-flags "${extraJavaOpts} -cp $CLASSPATH scala.meta.metals.Main"
+
+    # Further variants targeted at clients with featuresets pre-set.
     makeWrapper ${jre}/bin/java $out/bin/metals-emacs \
       --prefix PATH : ${lib.makeBinPath [ jdk ]} \
       --add-flags "${extraJavaOpts} -Dmetals.client=emacs -cp $CLASSPATH scala.meta.metals.Main"
diff --git a/pkgs/development/tools/micronaut/default.nix b/pkgs/development/tools/micronaut/default.nix
index 36df02ff712..e781bb80ac8 100644
--- a/pkgs/development/tools/micronaut/default.nix
+++ b/pkgs/development/tools/micronaut/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "micronaut";
-  version = "1.3.4";
+  version = "1.3.5";
 
   src = fetchzip {
     url = "https://github.com/micronaut-projects/micronaut-core/releases/download/v${version}/${pname}-${version}.zip";
-    sha256 = "0mddr6jw7bl8k4iqfq3sfpxq8fffm2spi9xwdr4cskkw4qdgrrpz";
+    sha256 = "16n1dk9jgy78mrkvr78m4x772kn09y5aa4d06wl4sdgn6apcq2mc";
   };
 
   nativeBuildInputs = [ makeWrapper installShellFiles ];
diff --git a/pkgs/development/tools/misc/pkgconf/default.nix b/pkgs/development/tools/misc/pkgconf/default.nix
index 02b7ff5fcd3..e3729994375 100644
--- a/pkgs/development/tools/misc/pkgconf/default.nix
+++ b/pkgs/development/tools/misc/pkgconf/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "pkgconf";
-  version = "1.6.3";
+  version = "1.7.0";
 
   src = fetchurl {
     url = "https://distfiles.dereferenced.org/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "04525vv0y849vvc2pi60g5wd9fjp1wbhra2lniifi82y1ldv7w31";
+    sha256 = "0sb1a2lgiqaninv5s3zq09ilrkpsamcl68dyhqyz7yi9vsgb0vhy";
   };
 
   meta = with stdenv.lib; {
diff --git a/pkgs/development/tools/misc/texlab/default.nix b/pkgs/development/tools/misc/texlab/default.nix
index 0076884e2ed..8185b14cd73 100644
--- a/pkgs/development/tools/misc/texlab/default.nix
+++ b/pkgs/development/tools/misc/texlab/default.nix
@@ -1,24 +1,31 @@
 { stdenv
 , rustPlatform
 , fetchFromGitHub
+, installShellFiles
 , Security
 }:
 
 rustPlatform.buildRustPackage rec {
   pname = "texlab";
-  version = "2.1.0";
+  version = "2.2.0";
 
   src = fetchFromGitHub {
     owner = "latex-lsp";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0cmciadiknw6w573v71spzf5ydaz2xxm2snv3n1hks732nahlr56";
+    sha256 = "0iydkbmx9z7xpwaif0han5jvy9xh1afmfyldl7fcyy4r906dsmhx";
   };
 
-  cargoSha256 = "0dhbbni8ia0dkwjacx5jlr5rj7173nsbivm9gjsx9j8ais0f0hff";
+  cargoSha256 = "0iibjh2ll181j69vld1awvjgyv3xwmq0abh10651la4k4jpppx46";
+
+  nativeBuildInputs = [ installShellFiles ];
 
   buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
 
+  postInstall = ''
+    installManPage texlab.1
+  '';
+
   meta = with stdenv.lib; {
     description = "An implementation of the Language Server Protocol for LaTeX";
     homepage = "https://texlab.netlify.com/";
diff --git a/pkgs/development/tools/solarus-quest-editor/default.nix b/pkgs/development/tools/solarus-quest-editor/default.nix
index 7dcde72fc4b..d44622e7e59 100644
--- a/pkgs/development/tools/solarus-quest-editor/default.nix
+++ b/pkgs/development/tools/solarus-quest-editor/default.nix
@@ -5,13 +5,13 @@
 
 mkDerivation rec {
   pname = "solarus-quest-editor";
-  version = "1.6.2";
+  version = "1.6.4";
 
   src = fetchFromGitLab {
     owner = "solarus-games";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0dq94iw9ldl4p83dqcwjs5ilpkvz5jgdk8rbls8pf8b7afpg36rz";
+    sha256 = "1qbc2j9kalk7xqk9j27s7wnm5zawiyjs47xqkqphw683idmzmjzn";
   };
   
   buildInputs = [ cmake luajit SDL2
diff --git a/pkgs/development/web/nodejs/v12.nix b/pkgs/development/web/nodejs/v12.nix
index af8595b5641..ae1536de34a 100644
--- a/pkgs/development/web/nodejs/v12.nix
+++ b/pkgs/development/web/nodejs/v12.nix
@@ -8,6 +8,6 @@ let
 in
   buildNodejs {
     inherit enableNpm;
-    version = "12.16.3";
-    sha256 = "18srfcv9zi39960szdnd4rgfj9w295z1agjvpw8arwn75449nmgh";
+    version = "12.17.0";
+    sha256 = "0csfdwzn1qssmkanxa8m3znjcc6h5qjaw934mkq9bz7zly39wvfa";
   }
diff --git a/pkgs/games/pentobi/default.nix b/pkgs/games/pentobi/default.nix
index 61be5e834a7..909f09a0b39 100644
--- a/pkgs/games/pentobi/default.nix
+++ b/pkgs/games/pentobi/default.nix
@@ -5,12 +5,12 @@
 
 with stdenv.lib;
 stdenv.mkDerivation rec {
-  version = "17.3";
+  version = "18.0";
   pname = "pentobi";
 
   src = fetchurl {
     url = "mirror://sourceforge/pentobi/${pname}-${version}.tar.xz";
-    sha256 = "00c495i4vrji9hs7v8xr9gm8yqs97bfk2wzsayhps11hmbqzllx9";
+    sha256 = "0dlvshywxijl0hrkl66szamcr77arh118f44ngr1ail8mg1fx1fy";
   };
 
   nativeBuildInputs = [ cmake docbook_xsl wrapQtAppsHook ];
diff --git a/pkgs/misc/scrcpy/default.nix b/pkgs/misc/scrcpy/default.nix
index a93f7e6aeaf..b73c6d351a2 100644
--- a/pkgs/misc/scrcpy/default.nix
+++ b/pkgs/misc/scrcpy/default.nix
@@ -1,7 +1,7 @@
 { stdenv, fetchurl, fetchFromGitHub, makeWrapper
 , meson
 , ninja
-, pkgconfig
+, pkg-config
 , fetchpatch
 
 , platform-tools
@@ -10,10 +10,10 @@
 }:
 
 let
-  version = "1.13";
+  version = "1.14";
   prebuilt_server = fetchurl {
     url = "https://github.com/Genymobile/scrcpy/releases/download/v${version}/scrcpy-server-v${version}";
-    sha256 = "11gqsl2x18hgwdjajag9q8qdxqvdqr9m67zka22z7hnd3k569vjz";
+    sha256 = "082n57a9lw39lfjxybgim09qf0id9m0rpfb3zmqng58fp2i1h6qx";
   };
 in
 stdenv.mkDerivation rec {
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
     owner = "Genymobile";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1zc73l5vm4hca8niaa3y76kpk7i9vj89wv4gbxmf1yjmixb71hby";
+    sha256 = "1w06gsvgjdbpb9lvvhpjwmysxjl0daiigjfh3cxfgz88447bgw7j";
   };
 
   # postPatch:
@@ -36,7 +36,7 @@ stdenv.mkDerivation rec {
       --replace "SDL_RENDERER_ACCELERATED" "SDL_RENDERER_ACCELERATED || SDL_RENDERER_SOFTWARE"
   '';
 
-  nativeBuildInputs = [ makeWrapper meson ninja pkgconfig ];
+  nativeBuildInputs = [ makeWrapper meson ninja pkg-config ];
 
   buildInputs = [ ffmpeg SDL2 ];
 
diff --git a/pkgs/misc/screensavers/xlockmore/default.nix b/pkgs/misc/screensavers/xlockmore/default.nix
index 2c39ed599e2..9cc093f222b 100644
--- a/pkgs/misc/screensavers/xlockmore/default.nix
+++ b/pkgs/misc/screensavers/xlockmore/default.nix
@@ -2,11 +2,11 @@
 , libXdmcp, libXt }:
 
 stdenv.mkDerivation rec {
-  name = "xlockmore-5.62";
+  name = "xlockmore-5.63";
 
   src = fetchurl {
     url = "http://sillycycle.com/xlock/${name}.tar.xz";
-    sha256 = "0b05wgj4mpssy4hd7km5c48i454dfg45p11mfmsr7xjd2gnz5gqi";
+    sha256 = "1qhbl6axffbajxzwg4xyf52hdxk5xvg63gxk0s9z8g0fdfj242wr";
     curlOpts = "--user-agent 'Mozilla/5.0'";
   };
 
diff --git a/pkgs/misc/vim-plugins/generated.nix b/pkgs/misc/vim-plugins/generated.nix
index 3094a3244c0..85336adcbc8 100644
--- a/pkgs/misc/vim-plugins/generated.nix
+++ b/pkgs/misc/vim-plugins/generated.nix
@@ -1509,6 +1509,17 @@ let
     meta.homepage = "https://github.com/megaannum/forms/";
   };
 
+  fruzzy = buildVimPluginFrom2Nix {
+    pname = "fruzzy";
+    version = "2019-10-28";
+    src = fetchFromGitHub {
+      owner = "raghur";
+      repo = "fruzzy";
+      rev = "b312ae79db98cf6939c8319f2511efa06889e8e3";
+      sha256 = "01iisbawq2w7yw866qvv109amnvyaymzyz9nqal3cjrrcwk6mmdk";
+    };
+  };
+
   fugitive-gitlab-vim = buildVimPluginFrom2Nix {
     pname = "fugitive-gitlab-vim";
     version = "2019-10-24";
diff --git a/pkgs/misc/vim-plugins/overrides.nix b/pkgs/misc/vim-plugins/overrides.nix
index 4d5b532216d..73c5690b192 100644
--- a/pkgs/misc/vim-plugins/overrides.nix
+++ b/pkgs/misc/vim-plugins/overrides.nix
@@ -30,6 +30,9 @@
 
 # vCoolor dependency
 , gnome3
+
+# fruzzy dependency
+, nim
 }:
 
 self: super: {
@@ -383,6 +386,38 @@ self: super: {
     dependencies = with super; [ super.self ];
   });
 
+  fruzzy = let # until https://github.com/NixOS/nixpkgs/pull/67878 is merged, there's no better way to install nim libraries with nix
+    nimpy = fetchFromGitHub {
+      owner = "yglukhov";
+      repo = "nimpy";
+      rev = "4840d1e438985af759ddf0923e7a9250fd8ea0da";
+      sha256 = "0qqklvaajjqnlqm3rkk36pwwnn7x942mbca7nf2cvryh36yg4q5k";
+    };
+    binaryheap = fetchFromGitHub {
+      owner = "bluenote10";
+      repo = "nim-heap";
+      rev = "c38039309cb11391112571aa332df9c55f625b54";
+      sha256 = "05xdy13vm5n8dw2i366ppbznc4cfhq23rdcklisbaklz2jhdx352";
+    };
+  in super.fruzzy.overrideAttrs(old: {
+    buildInputs = [ nim ];
+    patches = [
+      (substituteAll {
+        src = ./patches/fruzzy/get_version.patch;
+        version = old.version;
+      })
+    ];
+    configurePhase = ''
+      substituteInPlace Makefile \
+        --replace \
+          "nim c" \
+          "nim c --nimcache:$TMP --path:${nimpy} --path:${binaryheap}"
+    '';
+    buildPhase = ''
+      make build
+    '';
+  });
+
   ghcid = super.ghcid.overrideAttrs(old: {
     configurePhase = "cd plugins/nvim";
   });
diff --git a/pkgs/misc/vim-plugins/patches/fruzzy/get_version.patch b/pkgs/misc/vim-plugins/patches/fruzzy/get_version.patch
new file mode 100644
index 00000000000..62aaba118f2
--- /dev/null
+++ b/pkgs/misc/vim-plugins/patches/fruzzy/get_version.patch
@@ -0,0 +1,25 @@
+diff --git a/rplugin/python3/fruzzy_mod.nim b/rplugin/python3/fruzzy_mod.nim
+index dba0689..0109285 100644
+--- a/rplugin/python3/fruzzy_mod.nim
++++ b/rplugin/python3/fruzzy_mod.nim
+@@ -12,9 +12,7 @@ when defined(profile):
+     import nimprof
+
+ proc getVersion(): string {.compileTime.}=
+-    let ver = staticExec("git describe --tags --always --dirty").strip()
+-    # let cTime = format(times.now(), "yyyy-MM-dd hh:mm:ss")
+-    let branch = staticExec("git rev-parse --abbrev-ref HEAD").strip()
++    let ver = "@version@"
+     var options:seq[string] = newSeq[string]()
+     if not defined(removelogger):
+         options.add("info")
+@@ -26,7 +24,7 @@ proc getVersion(): string {.compileTime.}=
+         options.add("release")
+     let optionsStr = options.join(",")
+
+-    return &"rev: {ver} on branch: {branch} with options: {optionsStr}"
++    return &"version: {ver} with options: {optionsStr}"
+
+ let L = newConsoleLogger(levelThreshold = logging.Level.lvlDebug)
+ addHandler(L)
+
diff --git a/pkgs/misc/vim-plugins/vim-plugin-names b/pkgs/misc/vim-plugins/vim-plugin-names
index cbb60707adf..221d486c081 100644
--- a/pkgs/misc/vim-plugins/vim-plugin-names
+++ b/pkgs/misc/vim-plugins/vim-plugin-names
@@ -388,6 +388,7 @@ Quramy/tsuquyomi
 racer-rust/vim-racer
 rafaqz/ranger.vim
 rafi/awesome-vim-colorschemes
+raghur/fruzzy
 raghur/vim-ghost
 Raimondi/delimitMate
 rakr/vim-one
diff --git a/pkgs/os-specific/linux/checksec/default.nix b/pkgs/os-specific/linux/checksec/default.nix
index 01e70fbb040..7984c25bf3f 100644
--- a/pkgs/os-specific/linux/checksec/default.nix
+++ b/pkgs/os-specific/linux/checksec/default.nix
@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   pname = "checksec";
-  version = "2.1.0";
+  version = "2.2.1";
 
   src = fetchFromGitHub {
     owner = "slimm609";
     repo = "checksec.sh";
     rev = version;
-    sha256 = "00s4qg4h9s9vi46jyw7lz36lb5i8h3s9cmicnngp17764xgkr916";
+    sha256 = "035ydf7kp9yh5gpjnq4cgi76j582a0q6dxcbgkraxpkml0d8n2xd";
   };
 
   patches = [ ./0001-attempt-to-modprobe-config-before-checking-kernel.patch ];
diff --git a/pkgs/os-specific/linux/firmware/fwupd/default.nix b/pkgs/os-specific/linux/firmware/fwupd/default.nix
index 2a0e52c658a..9fe40cb60f7 100644
--- a/pkgs/os-specific/linux/firmware/fwupd/default.nix
+++ b/pkgs/os-specific/linux/firmware/fwupd/default.nix
@@ -87,11 +87,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "fwupd";
-  version = "1.4.1";
+  version = "1.4.2";
 
   src = fetchurl {
     url = "https://people.freedesktop.org/~hughsient/releases/fwupd-${version}.tar.xz";
-    sha256 = "ga8MpbY9tTwr0jsmjEAMyFxDC+yD4LBTx5gXRXig31M=";
+    sha256 = "1wch1n0z89ymfxx7ganiab4h64rdxr54rcg37n5nshw35bc3f390";
   };
 
   # libfwupd goes to lib
diff --git a/pkgs/os-specific/linux/fwts/default.nix b/pkgs/os-specific/linux/fwts/default.nix
index 76ec3c691d0..d05a8c52551 100644
--- a/pkgs/os-specific/linux/fwts/default.nix
+++ b/pkgs/os-specific/linux/fwts/default.nix
@@ -3,11 +3,11 @@
 
 stdenv.mkDerivation rec {
   pname = "fwts";
-  version = "20.03.00";
+  version = "20.05.00";
 
   src = fetchzip {
     url = "http://fwts.ubuntu.com/release/${pname}-V${version}.tar.gz";
-    sha256 = "0h56lclvs8l5jf6zh790ki9k4mp9r8sqv2pynnciqlkz8nj71qah";
+    sha256 = "14rqm45al6w42mzi0rqpwbw1spy7iv1jhywhwkdgs4w91zzc4gaj";
     stripRoot = false;
   };
 
diff --git a/pkgs/os-specific/linux/kernel/hardened/patches.json b/pkgs/os-specific/linux/kernel/hardened/patches.json
index fa3718c4ad7..59e6e768a4b 100644
--- a/pkgs/os-specific/linux/kernel/hardened/patches.json
+++ b/pkgs/os-specific/linux/kernel/hardened/patches.json
@@ -1,22 +1,22 @@
 {
     "4.14": {
-        "name": "linux-hardened-4.14.181.a.patch",
-        "sha256": "1rssvfhz10h7sqfi0ari1rsmm4h60v6bfj8fvb0yx6sxsvg7phd7",
-        "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.14.181.a/linux-hardened-4.14.181.a.patch"
+        "name": "linux-hardened-4.14.182.a.patch",
+        "sha256": "1kkchcv3qkm41rgscm12ii852q2846crbpvafywz31qg62lb6qig",
+        "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.14.182.a/linux-hardened-4.14.182.a.patch"
     },
     "4.19": {
-        "name": "linux-hardened-4.19.124.a.patch",
-        "sha256": "0g4kp112iarkyjw6qfdkc7j10d60jak7rlw2c1m537mb1a3zz7qm",
-        "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.19.124.a/linux-hardened-4.19.124.a.patch"
+        "name": "linux-hardened-4.19.125.a.patch",
+        "sha256": "1dhb8syp4j7hc4mx3s7c2x0gxil5dw7jh0swfqzjm02npbwpp19r",
+        "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.19.125.a/linux-hardened-4.19.125.a.patch"
     },
     "5.4": {
-        "name": "linux-hardened-5.4.42.a.patch",
-        "sha256": "1i066nk101banphs9gbcbvmyrhcvf83xf449rs6vxanb0yhwvqvn",
-        "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.4.42.a/linux-hardened-5.4.42.a.patch"
+        "name": "linux-hardened-5.4.43.a.patch",
+        "sha256": "14d9sg1f2a0fnr2q9z6ck5biip1kbzqqwlg4xzpwv83vaycq4i3b",
+        "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.4.43.a/linux-hardened-5.4.43.a.patch"
     },
     "5.6": {
-        "name": "linux-hardened-5.6.14.a.patch",
-        "sha256": "1hnlhlssa2gwmww6j17768gn2fbw2f3v8c0cs423lg14r7plkv44",
-        "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.6.14.a/linux-hardened-5.6.14.a.patch"
+        "name": "linux-hardened-5.6.15.a.patch",
+        "sha256": "0gvp4mra07aj22mrjj8gzd3k7z1zafvak461iajrxfjhzh1z3bdf",
+        "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.6.15.a/linux-hardened-5.6.15.a.patch"
     }
 }
diff --git a/pkgs/os-specific/linux/kernel/linux-4.14.nix b/pkgs/os-specific/linux/kernel/linux-4.14.nix
index 0f19efa1666..ca48ed48558 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.14.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.14.nix
@@ -3,7 +3,7 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "4.14.181";
+  version = "4.14.182";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "0kaasqhmg9in7pf4ldk9z4z1cjgv1c9xdr1ca0pznngygibym6xb";
+    sha256 = "142v7qnfska86jqzilwq00kxdrq08iaaaw7f47xp9bnhb8fiy7b7";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-4.19.nix b/pkgs/os-specific/linux/kernel/linux-4.19.nix
index c96fa330b5c..20aced02a86 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.19.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.19.nix
@@ -3,7 +3,7 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "4.19.124";
+  version = "4.19.125";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "005dznldnj1m03cbkc5pd2q2cv9jj1j6a0x2vh4p79ypg4c01nfm";
+    sha256 = "0zmxs6q2rgssvsh76xq9xgcax7bps19x2448d1q1fj9pzc7g8hwq";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-4.4.nix b/pkgs/os-specific/linux/kernel/linux-4.4.nix
index 4818e714750..a9d45bcdea7 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.4.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.4.nix
@@ -1,11 +1,11 @@
 { stdenv, buildPackages, fetchurl, perl, buildLinux, ... } @ args:
 
 buildLinux (args // rec {
-  version = "4.4.224";
+  version = "4.4.225";
   extraMeta.branch = "4.4";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "1lb8ypn558vk73bj4a20wq40cig9vmzjn2xzzdws78gfair6hxpg";
+    sha256 = "0pn66hf9yrjg15skq1inscr5m0slvgsd2qm8rg5id70llrb4jis9";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-4.9.nix b/pkgs/os-specific/linux/kernel/linux-4.9.nix
index 4cb219d1014..b13ed0e8fc5 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.9.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.9.nix
@@ -1,11 +1,11 @@
 { stdenv, buildPackages, fetchurl, perl, buildLinux, ... } @ args:
 
 buildLinux (args // rec {
-  version = "4.9.224";
+  version = "4.9.225";
   extraMeta.branch = "4.9";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "0jf92cx0b3wq9fxa3169wk4wqvy58hglfk6lsynszy8kjplhfvfz";
+    sha256 = "1s63aymgsc4lsysy9d972ps9cyrf6bncyy5wcpv5a3wbaj678iz5";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-5.4.nix b/pkgs/os-specific/linux/kernel/linux-5.4.nix
index a27977b2bbc..801003dc4f5 100644
--- a/pkgs/os-specific/linux/kernel/linux-5.4.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.4.nix
@@ -3,7 +3,7 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "5.4.42";
+  version = "5.4.43";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "0cdwazpzfrrb2y5fp87v9yihy7v8mlbqjzxpzmv7p83609y1nhsf";
+    sha256 = "0i07g72138xdf1l8x593jndq0waf3fx7plz3m6n5f9fl885bjrr6";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-5.6.nix b/pkgs/os-specific/linux/kernel/linux-5.6.nix
index 4ddb0c76b12..d19fe9cbc6a 100644
--- a/pkgs/os-specific/linux/kernel/linux-5.6.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.6.nix
@@ -3,7 +3,7 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "5.6.14";
+  version = "5.6.15";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "18vyxi64i93v4qyky5q62kkasm1da7wmz91xfkx3j7ki84skyxik";
+    sha256 = "0kh34f9vdfsi9g83fa1i1926djyzfi466w02c4y4d46ljf9pkav5";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/libratbag/default.nix b/pkgs/os-specific/linux/libratbag/default.nix
index 22763130aee..48ee5d16c5c 100644
--- a/pkgs/os-specific/linux/libratbag/default.nix
+++ b/pkgs/os-specific/linux/libratbag/default.nix
@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libratbag";
-  version = "0.13";
+  version = "0.14";
 
   src = fetchFromGitHub {
     owner  = "libratbag";
     repo   = "libratbag";
     rev    = "v${version}";
-    sha256 = "18y8mfr63d91278m1kcid0wvrxa1sgjs8na9af1ks2n28ssvciwq";
+    sha256 = "1fpwp2sj8mf98bqasq2h8qwgprxi7k3iw33gcfid3d1lbyiacw0x";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/os-specific/linux/nvme-cli/default.nix b/pkgs/os-specific/linux/nvme-cli/default.nix
index 616ad9c6764..c05adb33eca 100644
--- a/pkgs/os-specific/linux/nvme-cli/default.nix
+++ b/pkgs/os-specific/linux/nvme-cli/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "nvme-cli";
-  version = "1.11.1";
+  version = "1.11.2";
 
   src = fetchFromGitHub {
     owner = "linux-nvme";
     repo = "nvme-cli";
     rev = "v${version}";
-    sha256 = "06cxs41biqx230grvpk7zid3apcaajjywrccag50krb6h2wqafdl";
+    sha256 = "0ngh7zffjf6ac8b22hdi4ry7hjlafih172hrbpw8j17r7c0wjy9i";
   };
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/os-specific/linux/rtl88xxau-aircrack/default.nix b/pkgs/os-specific/linux/rtl88xxau-aircrack/default.nix
new file mode 100644
index 00000000000..a86d76a3be5
--- /dev/null
+++ b/pkgs/os-specific/linux/rtl88xxau-aircrack/default.nix
@@ -0,0 +1,40 @@
+{ stdenv, fetchFromGitHub, kernel }:
+
+stdenv.mkDerivation rec {
+  name = "rtl88xxau-aircrack-${kernel.version}-${version}";
+  rev = "fc0194c1d90453bf4943089ca237159ef19a7374";
+  version = "${builtins.substring 0 6 rev}";
+
+  src = fetchFromGitHub {
+    owner = "aircrack-ng";
+    repo = "rtl8812au";
+    inherit rev;
+    sha256 = "0hf7mrvxaskc6qcjar5w81y9xc7s2rlsxp34achyqly2hjg7fgmy";
+  };
+
+  buildInputs = kernel.moduleBuildDependencies;
+
+  hardeningDisable = [ "pic" ];
+
+  NIX_CFLAGS_COMPILE="-Wno-error=incompatible-pointer-types";
+
+  prePatch = ''
+    substituteInPlace ./Makefile \
+      --replace /lib/modules/ "${kernel.dev}/lib/modules/" \
+      --replace '$(shell uname -r)' "${kernel.modDirVersion}" \
+      --replace /sbin/depmod \# \
+      --replace '$(MODDESTDIR)' "$out/lib/modules/${kernel.modDirVersion}/kernel/net/wireless/"
+  '';
+
+  preInstall = ''
+    mkdir -p "$out/lib/modules/${kernel.modDirVersion}/kernel/net/wireless/"
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Aircrack-ng kernel module for Realtek 88XXau network cards\n(8811au, 8812au, 8814au and 8821au chipsets) with monitor mode and injection support.";
+    homepage = "https://github.com/aircrack-ng/rtl8812au";
+    license = licenses.gpl2;
+    maintainers = [ maintainers.jethro ];
+    platforms = [ "x86_64-linux" "i686-linux" ];
+  };
+}
diff --git a/pkgs/servers/amqp/rabbitmq-server/default.nix b/pkgs/servers/amqp/rabbitmq-server/default.nix
index e7f0eb73c86..51b5ef06ffa 100644
--- a/pkgs/servers/amqp/rabbitmq-server/default.nix
+++ b/pkgs/servers/amqp/rabbitmq-server/default.nix
@@ -8,12 +8,12 @@
 stdenv.mkDerivation rec {
   pname = "rabbitmq-server";
 
-  version = "3.8.3";
+  version = "3.8.4";
 
   # when updating, consider bumping elixir version in all-packages.nix
   src = fetchurl {
     url = "https://github.com/rabbitmq/rabbitmq-server/releases/download/v${version}/${pname}-${version}.tar.xz";
-    sha256 = "1fhs3g2pgrq2xi4hnlc437hkv3261l4i134m6mxid00sf1c89p5f";
+    sha256 = "1sa9zfd8hv5mxgnxva9sydqnyzwssxjkbba028pwpml2im97z7j5";
   };
 
   buildInputs =
diff --git a/pkgs/servers/gortr/default.nix b/pkgs/servers/gortr/default.nix
index 3b9ed15a849..c0534d0f890 100644
--- a/pkgs/servers/gortr/default.nix
+++ b/pkgs/servers/gortr/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "gortr";
-  version = "0.14.1";
+  version = "0.14.4";
 
   src = fetchFromGitHub {
     owner = "cloudflare";
     repo = pname;
     rev = "v${version}";
-    sha256 = "03wxlras2akk2ig8sxzs89nvbc6zr2kbcmjlqldjdfhs1rcg82ra";
+    sha256 = "1srwlpl8g0pzrxb2nyp6xvg10cidm2i6qb9m08k2g296hfgdqqq3";
   };
   vendorSha256 = "1nwrzbpqycr4ixk8a90pgaxcwakv5nlfnql6hmcc518qrva198wp";
 
diff --git a/pkgs/servers/pinnwand/default.nix b/pkgs/servers/pinnwand/default.nix
new file mode 100644
index 00000000000..37307eae403
--- /dev/null
+++ b/pkgs/servers/pinnwand/default.nix
@@ -0,0 +1,45 @@
+{ lib, python3, fetchFromGitHub }:
+
+let
+  python = python3.override {
+    packageOverrides = self: super: {
+      tornado = super.tornado.overridePythonAttrs (oldAttrs: rec {
+        version = "6.0.4";
+        src = oldAttrs.src.override {
+          inherit version;
+          sha256 = "1p5n7sw4580pkybywg93p8ddqdj9lhhy72rzswfa801vlidx9qhg";
+        };
+      });
+    };
+  };
+in with python.pkgs; buildPythonApplication rec {
+  pname = "pinnwand";
+  version = "1.1.0";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "0j5fbdma9zahx8d4xdj167gqkshzn7c98587awrzxv7wwbmlazxd";
+  };
+
+  propagatedBuildInputs = [
+    click
+    docutils
+    tornado
+    pygments-better-html
+    toml
+    sqlalchemy
+  ];
+
+  # tests are only available when fetching from GitHub, where they in turn don't have a setup.py :(
+  checkPhase = ''
+    $out/bin/pinnwand --help > /dev/null
+  '';
+
+  meta = with lib; {
+    homepage = "https://supakeen.com/project/pinnwand/";
+    license = licenses.mit;
+    description = "A Python pastebin that tries to keep it simple.";
+    maintainers = with maintainers; [ hexa ];
+  };
+}
+
diff --git a/pkgs/servers/sickbeard/sickgear.nix b/pkgs/servers/sickbeard/sickgear.nix
index 3bf72043ec5..e67b7244a32 100644
--- a/pkgs/servers/sickbeard/sickgear.nix
+++ b/pkgs/servers/sickbeard/sickgear.nix
@@ -4,13 +4,13 @@ let
   pythonEnv = python2.withPackages(ps: with ps; [ cheetah ]);
 in stdenv.mkDerivation rec {
   pname = "sickgear";
-  version = "0.21.30";
+  version = "0.21.33";
 
   src = fetchFromGitHub {
     owner = "SickGear";
     repo = "SickGear";
     rev = "release_${version}";
-    sha256 = "19j0hm2d2q279kzmdjbjgfhjwcp7071a2mmvsnb0167wdyaq4bcf";
+    sha256 = "0ilgjm21psfb0ix32qm560976wn84qg0y5cg7506ybwsynlmway2";
   };
 
   dontBuild = true;
diff --git a/pkgs/servers/tautulli/default.nix b/pkgs/servers/tautulli/default.nix
index 27a627dd482..ff2f993ecc1 100644
--- a/pkgs/servers/tautulli/default.nix
+++ b/pkgs/servers/tautulli/default.nix
@@ -1,7 +1,7 @@
 {stdenv, fetchFromGitHub, python }:
 
 stdenv.mkDerivation rec {
-  version = "2.2.3";
+  version = "2.2.4";
   pname = "Tautulli";
 
   pythonPath = [ python.pkgs.setuptools ];
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
     owner = "Tautulli";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0ni3dg5ly1xdyj1g931y2by3w17f0q031mpnrw2slhy6i792r5bp";
+    sha256 = "0yg7r7yscx6jbs1lnl9nbax3v9r6ppvhr4igdm3gbvd2803j8fs7";
   };
 
   buildPhase = ":";
diff --git a/pkgs/shells/zsh/grml-zsh-config/default.nix b/pkgs/shells/zsh/grml-zsh-config/default.nix
index e76ca684210..3a34be6304b 100644
--- a/pkgs/shells/zsh/grml-zsh-config/default.nix
+++ b/pkgs/shells/zsh/grml-zsh-config/default.nix
@@ -5,13 +5,13 @@ with lib;
 
 stdenv.mkDerivation rec {
   pname = "grml-zsh-config";
-  version = "0.16.1";
+  version = "0.16.2";
 
   src = fetchFromGitHub {
     owner = "grml";
     repo = "grml-etc-core";
     rev = "v${version}";
-    sha256 = "1dmhwgs5v4f1yanbi6dg1lbpzmvq1l3dq7sra811ycsf4f6g0d7f";
+    sha256 = "08a63cdjpbvgnja0637zbm8qif4qn8ydgkwcfq3145bxfh5rq8wz";
   };
 
   buildInputs = [ zsh coreutils txt2tags procps ]
diff --git a/pkgs/tools/backup/duplicity/default.nix b/pkgs/tools/backup/duplicity/default.nix
index 8e4014eea9d..6d6da3c9874 100644
--- a/pkgs/tools/backup/duplicity/default.nix
+++ b/pkgs/tools/backup/duplicity/default.nix
@@ -19,11 +19,11 @@ let
 in
 pythonPackages.buildPythonApplication rec {
   pname = "duplicity";
-  version = "0.8.12.1612";
+  version = "0.8.13";
 
   src = fetchurl {
     url = "https://code.launchpad.net/duplicity/${majorMinor version}-series/${majorMinorPatch version}/+download/duplicity-${version}.tar.gz";
-    sha256 = "06n58pwqg6kfigckjlslz2kx1lsykz1kn9a0r1cl8r3kn93zhk07";
+    sha256 = "0lflg1ay4q4w9qzpmh6y2hza4fc3ig12q44qkd80ks17hj21bxa6";
   };
 
   patches = [
diff --git a/pkgs/tools/filesystems/snapraid/default.nix b/pkgs/tools/filesystems/snapraid/default.nix
index 1cb9ccd873e..de6d25e128a 100644
--- a/pkgs/tools/filesystems/snapraid/default.nix
+++ b/pkgs/tools/filesystems/snapraid/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "snapraid";
-  version = "11.4";
+  version = "11.5";
 
   src = fetchFromGitHub {
     owner = "amadvance";
     repo = "snapraid";
     rev = "v${version}";
-    sha256 = "1mhinc9wny4a1xdrbksdl58kfrsh1cxp79zcgsl99gnyw47r22jy";
+    sha256 = "0dlhdsmq5l208zldfr9z9g0p67wry81dr0r23lpybb5c9fm2f2rm";
   };
 
   VERSION = version;
diff --git a/pkgs/tools/graphics/yafaray-core/default.nix b/pkgs/tools/graphics/yafaray-core/default.nix
index be8b20fd052..8e15cd0d328 100644
--- a/pkgs/tools/graphics/yafaray-core/default.nix
+++ b/pkgs/tools/graphics/yafaray-core/default.nix
@@ -7,13 +7,13 @@
 stdenv.mkDerivation rec {
 
     pname = "yafaray-core";
-    version = "3.4.1";
+    version = "3.4.4";
 
     src = fetchFromGitHub {
       owner  = "YafaRay";
       repo   = "Core";
       rev    = "v${version}";
-      sha256 = "0ipkrgn5siad6y8naw1pgxkxas70l09g97vabyfbx1k67xrr4ldp";
+      sha256 = "140vnaihz09rdvp0mqgrs26b3a2fv5wm49ar6817p4qklfx71l0g";
     };
 
     preConfigure = ''
diff --git a/pkgs/tools/misc/bat/default.nix b/pkgs/tools/misc/bat/default.nix
index 9c750171991..e961a5b0695 100644
--- a/pkgs/tools/misc/bat/default.nix
+++ b/pkgs/tools/misc/bat/default.nix
@@ -4,17 +4,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname   = "bat";
-  version = "0.15.3";
+  version = "0.15.4";
 
   src = fetchFromGitHub {
     owner  = "sharkdp";
     repo   = pname;
     rev    = "v${version}";
-    sha256 = "0893xjnrjmhhzccfb57w5s7wlf6z4cwxvrxj8qb5jnmrgkfaw86b";
+    sha256 = "1pjdvhldmjpy8ymb7r91y18hj5dx1iygszsfwkd66v9rncjigd07";
     fetchSubmodules = true;
   };
 
-  cargoSha256 = "0mcff6nsd9g39xdhsf06zxs7pmq27nqfxdk0lwh83lqmnzdp01sf";
+  cargoSha256 = "0myz06hjv4hwzmyqa9l36i9j9d213a0mnq8rvx6wyff7mr9zk99i";
 
   nativeBuildInputs = [ pkgconfig installShellFiles makeWrapper ];
 
diff --git a/pkgs/tools/misc/birdfont/default.nix b/pkgs/tools/misc/birdfont/default.nix
index a0e133ec504..bdf68d708a5 100644
--- a/pkgs/tools/misc/birdfont/default.nix
+++ b/pkgs/tools/misc/birdfont/default.nix
@@ -4,11 +4,11 @@ gobject-introspection, gsettings-desktop-schemas, wrapGAppsHook }:
 
 stdenv.mkDerivation rec {
   pname = "birdfont";
-  version = "2.28.0";
+  version = "2.29.0";
 
   src = fetchurl {
     url = "https://birdfont.org/releases/${pname}-${version}.tar.xz";
-    sha256 = "19i7wzngi695dp4w0235wmfcnagdw3i40mzf89sddr1mqzvipfrz";
+    sha256 = "18z3qbrsbfpn00c4xq3ck1mnmvrnqgl9g1s7m4dgc1871fi6sv8w";
   };
 
   nativeBuildInputs = [ python3 pkgconfig vala_0_44 gobject-introspection wrapGAppsHook ];
diff --git a/pkgs/tools/misc/fd/default.nix b/pkgs/tools/misc/fd/default.nix
index b55b2c0cc4e..4fd4c5428d9 100644
--- a/pkgs/tools/misc/fd/default.nix
+++ b/pkgs/tools/misc/fd/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "fd";
-  version = "8.1.0";
+  version = "8.1.1";
 
   src = fetchFromGitHub {
     owner = "sharkdp";
     repo = "fd";
     rev = "v${version}";
-    sha256 = "0zp9bsa0kmg1rsvnxf93d2fnib0cyla0wxpd3sn9kmz20b0vblvn";
+    sha256 = "0qzqnsjkq8i4gzn9273algx33kr1hzgxid8lnqp4awy2zxm4ksiq";
   };
 
-  cargoSha256 = "17fnf61q32a0ljjna3lb0bafwhsll4zgwfwbcqh2ah5gfk1pwc92";
+  cargoSha256 = "1d7hfgl9l4b9bnq2qcpvdq5rh7lpz33r19hw3wwgnqh142q67m7r";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/tools/misc/fluent-bit/default.nix b/pkgs/tools/misc/fluent-bit/default.nix
index 75294f4d064..439979068f5 100644
--- a/pkgs/tools/misc/fluent-bit/default.nix
+++ b/pkgs/tools/misc/fluent-bit/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "fluent-bit";
-  version = "1.4.4";
+  version = "1.4.5";
 
   src = fetchFromGitHub {
     owner = "fluent";
     repo = "fluent-bit";
     rev = "v${version}";
-    sha256 = "1p6ay2frrxi18965r9c83crlljx92zbdvzkwl4bl9qkb0lpml3yl";
+    sha256 = "0kxbq174a5fdcdh1hvnrlk79cg7lyily7iskfxhyz9l26qana9jp";
   };
 
   nativeBuildInputs = [ cmake flex bison ];
diff --git a/pkgs/tools/misc/hyperfine/default.nix b/pkgs/tools/misc/hyperfine/default.nix
index a5b7b81d77c..5e2b654f4f9 100644
--- a/pkgs/tools/misc/hyperfine/default.nix
+++ b/pkgs/tools/misc/hyperfine/default.nix
@@ -4,16 +4,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "hyperfine";
-  version = "1.9.0";
+  version = "1.10.0";
 
   src = fetchFromGitHub {
     owner  = "sharkdp";
     repo   = pname;
     rev    = "refs/tags/v${version}";
-    sha256 = "0jx2lqhayp14c51dfvgmqrmmadyvxf0p4dsn770ndqpzv66rh6zb";
+    sha256 = "0389lmyipmm4irrl39zw2748f2sdddfzwms4i4763xdykdvi8b57";
   };
 
-  cargoSha256 = "0n0hizldhr026mrzzz1wlw4g0b1z6ybxarybq3fzchs722iqpsis";
+  cargoSha256 = "06scvp7x1yixdadarsm461hbc256spx4aqhmjjn72x7hxn22h9cg";
 
   buildInputs = stdenv.lib.optional stdenv.isDarwin Security;
 
diff --git a/pkgs/tools/misc/intermodal/default.nix b/pkgs/tools/misc/intermodal/default.nix
index 8a2412f86ef..2ebaf7cf258 100644
--- a/pkgs/tools/misc/intermodal/default.nix
+++ b/pkgs/tools/misc/intermodal/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "intermodal";
-  version = "0.1.7";
+  version = "0.1.8";
 
   src = fetchFromGitHub {
     owner = "casey";
     repo = pname;
     rev = "v${version}";
-    sha256 = "05wjzx1ibd7cyl5lgmmn5y8dhsk71wz2bnimbmq7z51ds6cbyw5i";
+    sha256 = "1farcijm5s1836vi7h36yh0i9v48q4l98s4wprmr28z37c3l3n0b";
   };
 
-  cargoSha256 = "04xqk1mmbrz8bjn36nxabwla3y62wfdly5bckkya6y2dhf1vkdjq";
+  cargoSha256 = "1kvrra5i1g1inxpmn4shd8kgkljrk3ymfnpnhwrsnfxrqidi0h2z";
 
   # include_hidden test tries to use `chflags` on darwin
   checkFlagsArray = stdenv.lib.optionals stdenv.isDarwin [ "--skip=subcommand::torrent::create::tests::include_hidden" ];
diff --git a/pkgs/tools/misc/pspg/default.nix b/pkgs/tools/misc/pspg/default.nix
index fa8404615f9..63acdbfc13b 100644
--- a/pkgs/tools/misc/pspg/default.nix
+++ b/pkgs/tools/misc/pspg/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "pspg";
-  version = "3.1.1";
+  version = "3.1.2";
 
   src = fetchFromGitHub {
     owner = "okbob";
     repo = pname;
     rev = version;
-    sha256 = "1hs1cixk1jcx8br81c4drm1b56hwcq6jiww0ywrpdna475jv5vvw";
+    sha256 = "1x4x93c8qqalrhaah1rmrspr4gjcgf1sg6kplf9rg1c42mk672f8";
   };
 
   nativeBuildInputs = [ pkgconfig ];
diff --git a/pkgs/tools/misc/silicon/default.nix b/pkgs/tools/misc/silicon/default.nix
index a59a14d4b90..3fa6551534f 100644
--- a/pkgs/tools/misc/silicon/default.nix
+++ b/pkgs/tools/misc/silicon/default.nix
@@ -16,16 +16,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "silicon";
-  version = "0.3.1";
+  version = "0.3.2";
 
   src = fetchFromGitHub {
     owner = "Aloxaf";
     repo = "silicon";
     rev = "v${version}";
-    sha256 = "1avdzs3v6k4jhkadm8i8dlwg0iffqd99xqpi53smd0zgwks744l5";
+    sha256 = "1ga632c86l30n6wjj8rc3gz43v93mb7kcl9f8vhig16ycgiw8v09";
   };
 
-  cargoSha256 = "0bdb4nadrms5jq3s8pby2qfky7112ynd7vd6mw720mshqklk5zyb";
+  cargoSha256 = "0bgm29v9vmd1xcdazg1psrx6hb1z3zfzr1c4iy8j1r28csbmm6kq";
 
   buildInputs = [ llvmPackages.libclang expat freetype ]
     ++ lib.optionals stdenv.isLinux [ libxcb ]
diff --git a/pkgs/tools/misc/toybox/default.nix b/pkgs/tools/misc/toybox/default.nix
index ea2c07ec97b..23fdc2f7135 100644
--- a/pkgs/tools/misc/toybox/default.nix
+++ b/pkgs/tools/misc/toybox/default.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "toybox";
-  version = "0.8.2";
+  version = "0.8.3";
 
   src = fetchFromGitHub {
     owner = "landley";
     repo = pname;
     rev = version;
-    sha256 = "02mliqz2lry779ba6vmyaa13nxcmj91f8pyhzim9wvcnjq8vc5cj";
+    sha256 = "0cb1n0skanwwkwgzlswwhvfb4iji1bw9iqskmczlhakpw3j1yaqa";
   };
 
   buildInputs = lib.optionals enableStatic [ stdenv.cc.libc stdenv.cc.libc.static ];
diff --git a/pkgs/tools/networking/network-manager/strongswan/default.nix b/pkgs/tools/networking/network-manager/strongswan/default.nix
index a1c6962d3f9..028d852f139 100644
--- a/pkgs/tools/networking/network-manager/strongswan/default.nix
+++ b/pkgs/tools/networking/network-manager/strongswan/default.nix
@@ -3,11 +3,11 @@
 
 stdenv.mkDerivation rec {
   pname = "NetworkManager-strongswan";
-  version = "1.5.0";
+  version = "1.5.2";
 
   src = fetchurl {
     url = "https://download.strongswan.org/NetworkManager/${pname}-${version}.tar.bz2";
-    sha256 = "1x6hivr1v76fxy1dn82xrj9rj8k3r097kf4yiblqq16y631hxzy4";
+    sha256 = "0sc1yzlxjfvl58hjjw99bchqc4061i3apw254z61v22k4sajnif8";
   };
 
   buildInputs = [ networkmanager strongswanNM libsecret gtk3 libnma ];
diff --git a/pkgs/tools/networking/openfortivpn/default.nix b/pkgs/tools/networking/openfortivpn/default.nix
index b0be2ab5e6d..bd1c02f9b54 100644
--- a/pkgs/tools/networking/openfortivpn/default.nix
+++ b/pkgs/tools/networking/openfortivpn/default.nix
@@ -3,7 +3,7 @@
 with stdenv.lib;
 
 let repo = "openfortivpn";
-    version = "1.13.3";
+    version = "1.14.0";
 
 in stdenv.mkDerivation {
   name = "${repo}-${version}";
@@ -12,7 +12,7 @@ in stdenv.mkDerivation {
     owner = "adrienverge";
     inherit repo;
     rev = "v${version}";
-    sha256 = "1y3b3zwzig520nyky7xnr0l0zf68i4w698bysyngpkada14d8dv3";
+    sha256 = "1qn48sp3ydbik7nc9x5l22gvvnr99f89jy1lvnf64bdg218kr0z7";
   };
 
   nativeBuildInputs = [ autoreconfHook pkgconfig ];
diff --git a/pkgs/tools/networking/pirate-get/default.nix b/pkgs/tools/networking/pirate-get/default.nix
index aa4fbd52e28..b89ab8164cc 100644
--- a/pkgs/tools/networking/pirate-get/default.nix
+++ b/pkgs/tools/networking/pirate-get/default.nix
@@ -4,16 +4,14 @@ with python3Packages;
 
 buildPythonApplication rec {
   pname = "pirate-get";
-  version = "0.3.7";
-
-  doCheck = false;
+  version = "0.4.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0i87g7f25dzsi5b3swr9gny2zpmrrgygxmr1ps71rjr1n540si9n";
+    sha256 = "07s5ss9dxccx1mip7pyga1fagywkqchxmzz55ng47ac9053ffxkq";
   };
 
-  propagatedBuildInputs = [ colorama veryprettytable beautifulsoup4 pyperclip ];
+  propagatedBuildInputs = [ colorama veryprettytable pyperclip ];
 
   meta = with stdenv.lib; {
     description = "A command line interface for The Pirate Bay";
diff --git a/pkgs/tools/package-management/morph/default.nix b/pkgs/tools/package-management/morph/default.nix
index 130bf2bb2e5..5ae4f5731ba 100644
--- a/pkgs/tools/package-management/morph/default.nix
+++ b/pkgs/tools/package-management/morph/default.nix
@@ -2,13 +2,13 @@
 
 buildGoPackage rec {
   pname = "morph";
-  version = "1.4.0";
+  version = "1.5.0";
 
   src = fetchFromGitHub {
     owner = "dbcdk";
     repo = "morph";
     rev = "v${version}";
-    sha256 = "1y6clzi8sfnrv4an26b44r24nnxds1kj9aw3lmjbgxl9yrxxsj1k";
+    sha256 = "064ccvvq4yk17jy5jvi1nxfp5ajvnvn2k4zvh9v0n3ragcl3rd20";
   };
 
   goPackagePath = "github.com/dbcdk/morph";
@@ -22,13 +22,13 @@ buildGoPackage rec {
     main.version=${version}
   '';
 
-  prePatch = ''
+  postPatch = ''
     go-bindata -pkg assets -o assets/assets.go data/
   '';
 
   postInstall = ''
     mkdir -p $lib
-    cp -v $src/data/*.nix $lib
+    cp -v go/src/$goPackagePath/data/*.nix $lib
     wrapProgram $out/bin/morph --prefix PATH : ${lib.makeBinPath [ openssh ]};
   '';
 
diff --git a/pkgs/tools/package-management/morph/deps.nix b/pkgs/tools/package-management/morph/deps.nix
index fdae5ef39ee..4da6f0278b7 100644
--- a/pkgs/tools/package-management/morph/deps.nix
+++ b/pkgs/tools/package-management/morph/deps.nix
@@ -63,4 +63,4 @@
       sha256 = "06xrp05njwam4sn031fkmd4gym5wfsw5q0v24nqhs4883lsx9dwq";
     };
   }
-]
+]
\ No newline at end of file
diff --git a/pkgs/tools/package-management/nix/default.nix b/pkgs/tools/package-management/nix/default.nix
index 37eb6e11742..4337705db2f 100644
--- a/pkgs/tools/package-management/nix/default.nix
+++ b/pkgs/tools/package-management/nix/default.nix
@@ -178,10 +178,10 @@ in rec {
   nix = nixStable;
 
   nixStable = callPackage common (rec {
-    name = "nix-2.3.4";
+    name = "nix-2.3.5";
     src = fetchurl {
       url = "https://nixos.org/releases/nix/${name}/${name}.tar.xz";
-      sha256 = "1c626a0de0acc69830b1891ec4d3c96aabe673b2a9fd04cef84f2304d05ad00d";
+      sha256 = "25445353c27d7c2703cd74216bce6458a02068965055d111765ac4186ed678c1";
     };
 
     inherit storeDir stateDir confDir boehmgc;
diff --git a/pkgs/tools/security/bitwarden_rs/vault.nix b/pkgs/tools/security/bitwarden_rs/vault.nix
index 0c60ab62106..256bf458b3b 100644
--- a/pkgs/tools/security/bitwarden_rs/vault.nix
+++ b/pkgs/tools/security/bitwarden_rs/vault.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "bitwarden_rs-vault";
-  version = "2.13.2b";
+  version = "2.14.0";
 
   src = fetchurl {
     url = "https://github.com/dani-garcia/bw_web_builds/releases/download/v${version}/bw_web_v${version}.tar.gz";
-    sha256 = "1pba3d04gfnviv8r98anpv7m8r9r417s352r5fz8qzg8lr070540";
+    sha256 = "16620md9lsxw6s0qzv5vj9kfkgxnlaxfrax6s2h3h39skza80x2c";
   };
 
   buildCommand = ''
diff --git a/pkgs/tools/security/doas/0001-add-NixOS-specific-dirs-to-safe-PATH.patch b/pkgs/tools/security/doas/0001-add-NixOS-specific-dirs-to-safe-PATH.patch
new file mode 100644
index 00000000000..d1a1997ba1f
--- /dev/null
+++ b/pkgs/tools/security/doas/0001-add-NixOS-specific-dirs-to-safe-PATH.patch
@@ -0,0 +1,24 @@
+From 9218347b8f833ab05d016dfba5617dcdeb59eb7b Mon Sep 17 00:00:00 2001
+From: Cole Helbling <cole.e.helbling@outlook.com>
+Date: Wed, 27 May 2020 08:02:57 -0700
+Subject: [PATCH] add NixOS-specific dirs to safe PATH
+
+---
+ doas.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/doas.c b/doas.c
+index e253905..2fdb20f 100644
+--- a/doas.c
++++ b/doas.c
+@@ -234,6 +234,7 @@ int
+ main(int argc, char **argv)
+ {
+ 	const char *safepath = "/bin:/sbin:/usr/bin:/usr/sbin:"
++	    "/run/current-system/sw/bin:/run/current-system/sw/sbin:/run/wrappers/bin:"
+ 	    "/usr/local/bin:/usr/local/sbin";
+ 	const char *confpath = NULL;
+ 	char *shargv[] = { NULL, NULL };
+-- 
+2.26.2
+
diff --git a/pkgs/tools/security/doas/default.nix b/pkgs/tools/security/doas/default.nix
index 8cc9017a8fe..baa2fc301a8 100644
--- a/pkgs/tools/security/doas/default.nix
+++ b/pkgs/tools/security/doas/default.nix
@@ -26,6 +26,12 @@ stdenv.mkDerivation rec {
     "--pamdir=${placeholder "out"}/etc/pam.d"
   ];
 
+  patches = [
+    # Allow doas to discover binaries in /run/current-system/sw/{s,}bin and
+    # /run/wrappers/bin
+    ./0001-add-NixOS-specific-dirs-to-safe-PATH.patch
+  ];
+
   postPatch = ''
     sed -i '/\(chown\|chmod\)/d' bsd.prog.mk
   '';
diff --git a/pkgs/tools/text/poedit/default.nix b/pkgs/tools/text/poedit/default.nix
index 767569e42c2..ccd99a272b5 100644
--- a/pkgs/tools/text/poedit/default.nix
+++ b/pkgs/tools/text/poedit/default.nix
@@ -4,11 +4,11 @@
 
 stdenv.mkDerivation rec {
   pname = "poedit";
-  version = "2.3";
+  version = "2.3.1";
 
   src = fetchurl {
     url = "https://github.com/vslavik/poedit/archive/v${version}-oss.tar.gz";
-    sha256 = "0smvdpvb4hdhqc327pcj29bzjqbzgad6mr7r5pg81461fi2r2myw";
+    sha256 = "04f9za35rwyr7mabk8f8izc0fgvc3sfx45v8dml1xmi634n174ds";
   };
 
   nativeBuildInputs = [ autoconf automake asciidoc wrapGAppsHook 
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index c8f84ff461a..cc37abb5f7a 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -601,6 +601,8 @@ in
 
   afpfs-ng = callPackage ../tools/filesystems/afpfs-ng { };
 
+  agda-pkg = callPackage ../development/tools/agda-pkg { };
+
   agrep = callPackage ../tools/text/agrep { };
 
   aha = callPackage ../tools/text/aha { };
@@ -5974,6 +5976,8 @@ in
 
   pingtcp = callPackage ../tools/networking/pingtcp { };
 
+  pinnwand = callPackage ../servers/pinnwand { };
+
   pirate-get = callPackage ../tools/networking/pirate-get { };
 
   pipreqs = callPackage ../tools/misc/pipreqs { };
@@ -11601,6 +11605,8 @@ in
 
   dssi = callPackage ../development/libraries/dssi {};
 
+  duckdb = callPackage ../development/libraries/duckdb {};
+
   dxflib = callPackage ../development/libraries/dxflib {};
 
   easyloggingpp = callPackage ../development/libraries/easyloggingpp {};
@@ -15593,6 +15599,8 @@ in
 
   dex-oidc = callPackage ../servers/dex { };
 
+  dex2jar = callPackage ../development/tools/java/dex2jar { };
+
   doh-proxy = callPackage ../servers/dns/doh-proxy {
     python3Packages = python36Packages;
   };
@@ -17036,6 +17044,8 @@ in
 
     rtl8814au = callPackage ../os-specific/linux/rtl8814au { };
 
+    rtl88xxau-aircrack = callPackage ../os-specific/linux/rtl88xxau-aircrack { };
+
     rtl8821au = callPackage ../os-specific/linux/rtl8821au { };
 
     rtl8821ce = callPackage ../os-specific/linux/rtl8821ce { };
diff --git a/pkgs/top-level/ocaml-packages.nix b/pkgs/top-level/ocaml-packages.nix
index 7db3335f6a1..821166fca92 100644
--- a/pkgs/top-level/ocaml-packages.nix
+++ b/pkgs/top-level/ocaml-packages.nix
@@ -591,8 +591,6 @@ let
 
     core_kernel_p4 = callPackage ../development/ocaml-modules/core_kernel { };
 
-    core_p4 = callPackage ../development/ocaml-modules/core { };
-
     ocamlbuild =
     if lib.versionOlder "4.03" ocaml.version then
     callPackage ../development/tools/ocaml/ocamlbuild { }
@@ -1169,13 +1167,6 @@ let
       then callPackage ../development/ocaml-modules/janestreet/core_kernel.nix {}
       else core_kernel_p4;
 
-    core =
-      if lib.versionOlder "4.03" ocaml.version
-      then janeStreet.core
-      else if lib.versionOlder "4.02" ocaml.version
-      then callPackage ../development/ocaml-modules/janestreet/core.nix {}
-      else core_p4;
-
     async_rpc_kernel =
       if lib.versionOlder "4.03" ocaml.version
       then janeStreet.async_rpc_kernel
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index d67eb21c1c0..6a054d3a522 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -3621,6 +3621,10 @@ in {
 
   SPARQLWrapper = callPackage ../development/python-modules/sparqlwrapper { };
 
+  duckdb = callPackage ../development/python-modules/duckdb {
+    duckdb = pkgs.duckdb;
+  };
+
   dulwich = callPackage ../development/python-modules/dulwich {
     inherit (pkgs) git glibcLocales;
   };
@@ -5083,6 +5087,8 @@ in {
 
   polib = callPackage ../development/python-modules/polib {};
 
+  ponywhoosh = callPackage ../development/python-modules/ponywhoosh { };
+
   posix_ipc = callPackage ../development/python-modules/posix_ipc { };
 
   portend = callPackage ../development/python-modules/portend { };
@@ -6983,6 +6989,8 @@ in {
 
   ansi = callPackage ../development/python-modules/ansi { };
 
+  pygments-better-html = callPackage ../development/python-modules/pygments-better-html { };
+
   pygments-markdown-lexer = callPackage ../development/python-modules/pygments-markdown-lexer { };
 
   telegram = callPackage ../development/python-modules/telegram { };