diff --git a/.editorconfig b/.editorconfig
index bc45523451b..e21731d10cf 100644
--- a/.editorconfig
+++ b/.editorconfig
@@ -90,9 +90,6 @@ insert_final_newline = unset
 indent_style = unset
 trim_trailing_whitespace = unset
 
-[pkgs/development/{perl-modules,ocaml-modules,tools/ocaml}/**]
-indent_style = unset
-
 [pkgs/servers/dict/wordnet_structures.py]
 trim_trailing_whitespace = unset
 
diff --git a/doc/contributing/coding-conventions.xml b/doc/contributing/coding-conventions.xml
index cb6d60c2c13..9005a9ebafd 100644
--- a/doc/contributing/coding-conventions.xml
+++ b/doc/contributing/coding-conventions.xml
@@ -178,6 +178,12 @@ args.stdenv.mkDerivation (args // {
 </programlisting>
     </para>
    </listitem>
+   <listitem>
+    <para>
+     Arguments should be listed in the order they are used, with the
+     exception of <varname>lib</varname>, which always goes first.
+    </para>
+   </listitem>
    <listitem>
     <para>
      Prefer using the top-level <varname>lib</varname> over its alias
diff --git a/doc/languages-frameworks/coq.section.md b/doc/languages-frameworks/coq.section.md
index 5e16a4c546a..8f564c6e46b 100644
--- a/doc/languages-frameworks/coq.section.md
+++ b/doc/languages-frameworks/coq.section.md
@@ -42,8 +42,8 @@ It also takes other standard `mkDerivation` attributes, they are added as such,
 Here is a simple package example. It is a pure Coq library, thus it depends on Coq. It builds on the Mathematical Components library, thus it also takes some `mathcomp` derivations as `extraBuildInputs`.
 
 ```nix
-{ coq, mkCoqDerivation, mathcomp, mathcomp-finmap, mathcomp-bigenough,
-  lib, version ? null }:
+{ lib, mkCoqDerivation, version ? null
+, coq, mathcomp, mathcomp-finmap, mathcomp-bigenough }:
 with lib; mkCoqDerivation {
   /* namePrefix leads to e.g. `name = coq8.11-mathcomp1.11-multinomials-1.5.2` */
   namePrefix = [ "coq" "mathcomp" ];
diff --git a/doc/languages-frameworks/idris.section.md b/doc/languages-frameworks/idris.section.md
index 2d06c4a19de..41e4f7ec312 100644
--- a/doc/languages-frameworks/idris.section.md
+++ b/doc/languages-frameworks/idris.section.md
@@ -69,11 +69,11 @@ prelude
 As an example of how a Nix expression for an Idris package can be created, here is the one for `idrisPackages.yaml`:
 
 ```nix
-{ build-idris-package
+{ lib
+, build-idris-package
 , fetchFromGitHub
 , contrib
 , lightyear
-, lib
 }:
 build-idris-package  {
   name = "yaml";
@@ -94,11 +94,11 @@ build-idris-package  {
     sha256 = "1g4pi0swmg214kndj85hj50ccmckni7piprsxfdzdfhg87s0avw7";
   };
 
-  meta = {
+  meta = with lib; {
     description = "Idris YAML lib";
     homepage = "https://github.com/Heather/Idris.Yaml";
-    license = lib.licenses.mit;
-    maintainers = [ lib.maintainers.brainrape ];
+    license = licenses.mit;
+    maintainers = [ maintainers.brainrape ];
   };
 }
 ```
diff --git a/doc/languages-frameworks/maven.section.md b/doc/languages-frameworks/maven.section.md
index 7a863c500bc..d66931e808d 100644
--- a/doc/languages-frameworks/maven.section.md
+++ b/doc/languages-frameworks/maven.section.md
@@ -116,7 +116,7 @@ The first step will be to build the Maven project as a fixed-output derivation i
 > Traditionally the Maven repository is at `~/.m2/repository`. We will override this to be the `$out` directory.
 
 ```nix
-{ stdenv, lib, maven }:
+{ lib, stdenv, maven }:
 stdenv.mkDerivation {
   name = "maven-repository";
   buildInputs = [ maven ];
@@ -168,7 +168,7 @@ If your package uses _SNAPSHOT_ dependencies or _version ranges_; there is a str
 Regardless of which strategy is chosen above, the step to build the derivation is the same.
 
 ```nix
-{ stdenv, lib, maven, callPackage }:
+{ stdenv, maven, callPackage }:
 # pick a repository derivation, here we will use buildMaven
 let repository = callPackage ./build-maven-repository.nix { };
 in stdenv.mkDerivation rec {
@@ -222,7 +222,7 @@ We will read the Maven repository and flatten it to a single list. This list wil
 We make sure to provide this classpath to the `makeWrapper`.
 
 ```nix
-{ stdenv, lib, maven, callPackage, makeWrapper, jre }:
+{ stdenv, maven, callPackage, makeWrapper, jre }:
 let
   repository = callPackage ./build-maven-repository.nix { };
 in stdenv.mkDerivation rec {
@@ -298,7 +298,7 @@ Main-Class: Main
 We will modify the derivation above to add a symlink to our repository so that it's accessible to our JAR during the `installPhase`.
 
 ```nix
-{ stdenv, lib, maven, callPackage, makeWrapper, jre }:
+{ stdenv, maven, callPackage, makeWrapper, jre }:
 # pick a repository derivation, here we will use buildMaven
 let repository = callPackage ./build-maven-repository.nix { };
 in stdenv.mkDerivation rec {
diff --git a/doc/languages-frameworks/ocaml.section.md b/doc/languages-frameworks/ocaml.section.md
index fa85a27e84f..9b92a80f471 100644
--- a/doc/languages-frameworks/ocaml.section.md
+++ b/doc/languages-frameworks/ocaml.section.md
@@ -32,11 +32,11 @@ buildDunePackage rec {
   propagatedBuildInputs = [ bigstringaf result ];
   doCheck = true;
 
-  meta = {
+  meta = with lib; {
     homepage = "https://github.com/inhabitedtype/angstrom";
     description = "OCaml parser combinators built for speed and memory efficiency";
-    license = lib.licenses.bsd3;
-    maintainers = with lib.maintainers; [ sternenseemann ];
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ sternenseemann ];
   };
 }
 ```
diff --git a/doc/languages-frameworks/perl.section.md b/doc/languages-frameworks/perl.section.md
index 309d8ebcc2b..dcb7dcb77b6 100644
--- a/doc/languages-frameworks/perl.section.md
+++ b/doc/languages-frameworks/perl.section.md
@@ -110,7 +110,7 @@ ClassC3Componentised = buildPerlPackage rec {
 On Darwin, if a script has too many `-Idir` flags in its first line (its “shebang line”), it will not run. This can be worked around by calling the `shortenPerlShebang` function from the `postInstall` phase:
 
 ```nix
-{ stdenv, lib, buildPerlPackage, fetchurl, shortenPerlShebang }:
+{ lib, stdenv, buildPerlPackage, fetchurl, shortenPerlShebang }:
 
 ImageExifTool = buildPerlPackage {
   pname = "Image-ExifTool";
diff --git a/doc/languages-frameworks/qt.section.md b/doc/languages-frameworks/qt.section.md
index 6cfdc663550..5dd415852c1 100644
--- a/doc/languages-frameworks/qt.section.md
+++ b/doc/languages-frameworks/qt.section.md
@@ -8,7 +8,7 @@ There are primarily two problems which the Qt infrastructure is designed to addr
 
 ```{=docbook}
 <programlisting>
-{ mkDerivation, lib, qtbase }: <co xml:id='qt-default-nix-co-1' />
+{ mkDerivation, qtbase }: <co xml:id='qt-default-nix-co-1' />
 
 mkDerivation { <co xml:id='qt-default-nix-co-2' />
   pname = "myapp";
diff --git a/doc/languages-frameworks/r.section.md b/doc/languages-frameworks/r.section.md
index 32a39ade279..c420d112c91 100644
--- a/doc/languages-frameworks/r.section.md
+++ b/doc/languages-frameworks/r.section.md
@@ -32,14 +32,12 @@ However, if you'd like to add a file to your project source to make the
 environment available for other contributors, you can create a `default.nix`
 file like so:
 ```nix
-let
-  pkgs = import <nixpkgs> {};
-  stdenv = pkgs.stdenv;
-in with pkgs; {
+with import <nixpkgs> {};
+{
   myProject = stdenv.mkDerivation {
     name = "myProject";
     version = "1";
-    src = if pkgs.lib.inNixShell then null else nix;
+    src = if lib.inNixShell then null else nix;
 
     buildInputs = with rPackages; [
       R
diff --git a/doc/languages-frameworks/ruby.section.md b/doc/languages-frameworks/ruby.section.md
index e292b3110ff..aeec154586c 100644
--- a/doc/languages-frameworks/ruby.section.md
+++ b/doc/languages-frameworks/ruby.section.md
@@ -232,7 +232,7 @@ If you want to package a specific version, you can use the standard Gemfile synt
 Now you can also also make a `default.nix` that looks like this:
 
 ```nix
-{ lib, bundlerApp }:
+{ bundlerApp }:
 
 bundlerApp {
   pname = "mdl";
diff --git a/doc/languages-frameworks/rust.section.md b/doc/languages-frameworks/rust.section.md
index 550f2b576bd..8f6db28ab4d 100644
--- a/doc/languages-frameworks/rust.section.md
+++ b/doc/languages-frameworks/rust.section.md
@@ -19,6 +19,8 @@ or use Mozilla's [Rust nightlies overlay](#using-the-rust-nightlies-overlay).
 Rust applications are packaged by using the `buildRustPackage` helper from `rustPlatform`:
 
 ```
+{ lib, rustPlatform }:
+
 rustPlatform.buildRustPackage rec {
   pname = "ripgrep";
   version = "12.1.1";
@@ -226,8 +228,6 @@ source code in a reproducible way. If it is missing or out-of-date one can use
 the `cargoPatches` attribute to update or add it.
 
 ```
-{ lib, rustPlatform, fetchFromGitHub }:
-
 rustPlatform.buildRustPackage rec {
   (...)
   cargoPatches = [
@@ -263,7 +263,7 @@ Now, the file produced by the call to `carnix`, called `hello.nix`, looks like:
 
 ```
 # Generated by carnix 0.6.5: carnix -o hello.nix --src ./. Cargo.lock --standalone
-{ lib, stdenv, buildRustCrate, fetchgit }:
+{ stdenv, buildRustCrate, fetchgit }:
 let kernel = stdenv.buildPlatform.parsed.kernel.name;
     # ... (content skipped)
 in
@@ -292,7 +292,7 @@ following nix file:
 
 ```
 # Generated by carnix 0.6.5: carnix -o hello.nix --src ./. Cargo.lock --standalone
-{ lib, stdenv, buildRustCrate, fetchgit }:
+{ stdenv, buildRustCrate, fetchgit }:
 let kernel = stdenv.buildPlatform.parsed.kernel.name;
     # ... (content skipped)
 in
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 196b19ffc0f..e9729538b04 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -5138,6 +5138,12 @@
     githubId = 42153076;
     name = "Alexey Nikashkin";
   };
+  lesuisse = {
+    email = "thomas@gerbet.me";
+    github = "LeSuisse";
+    githubId = 737767;
+    name = "Thomas Gerbet";
+  };
   lethalman = {
     email = "lucabru@src.gnome.org";
     github = "lethalman";
diff --git a/nixos/modules/system/boot/binfmt.nix b/nixos/modules/system/boot/binfmt.nix
index 9eeae0c3ef4..5bcc95be324 100644
--- a/nixos/modules/system/boot/binfmt.nix
+++ b/nixos/modules/system/boot/binfmt.nix
@@ -20,8 +20,14 @@ let
                  optionalString fixBinary "F";
   in ":${name}:${type}:${offset'}:${magicOrExtension}:${mask'}:${interpreter}:${flags}";
 
-  activationSnippet = name: { interpreter, ... }:
-    "ln -sf ${interpreter} /run/binfmt/${name}";
+  activationSnippet = name: { interpreter, ... }: ''
+    rm -f /run/binfmt/${name}
+    cat > /run/binfmt/${name} << 'EOF'
+    #!/usr/bin/env sh
+    exec -- ${interpreter} "$@"
+    EOF
+    chmod +x /run/binfmt/${name}
+  '';
 
   getEmulator = system: (lib.systems.elaborate { inherit system; }).emulator pkgs;
 
diff --git a/nixos/tests/chromium.nix b/nixos/tests/chromium.nix
index d4085bebac0..4d6b726d9e4 100644
--- a/nixos/tests/chromium.nix
+++ b/nixos/tests/chromium.nix
@@ -1,10 +1,14 @@
 { system ? builtins.currentSystem
 , config ? {}
 , pkgs ? import ../.. { inherit system config; }
-, channelMap ? {
-    stable = pkgs.chromium;
-    beta   = pkgs.chromiumBeta;
-    dev    = pkgs.chromiumDev;
+, channelMap ? { # Maps "channels" to packages
+    stable        = pkgs.chromium;
+    beta          = pkgs.chromiumBeta;
+    dev           = pkgs.chromiumDev;
+    ungoogled     = pkgs.ungoogled-chromium;
+    chrome-stable = pkgs.google-chrome;
+    chrome-beta   = pkgs.google-chrome-beta;
+    chrome-dev    = pkgs.google-chrome-dev;
   }
 }:
 
@@ -14,7 +18,7 @@ with pkgs.lib;
 mapAttrs (channel: chromiumPkg: makeTest rec {
   name = "chromium-${channel}";
   meta = {
-    maintainers = with maintainers; [ aszlig ];
+    maintainers = with maintainers; [ aszlig primeos ];
     # https://github.com/NixOS/hydra/issues/591#issuecomment-435125621
     inherit (chromiumPkg.meta) timeout;
   };
@@ -58,6 +62,19 @@ mapAttrs (channel: chromiumPkg: makeTest rec {
         return "su - ${user} -c " + shlex.quote(cmd)
 
 
+    def get_browser_binary():
+        """Returns the name of the browser binary."""
+        pname = "${getName chromiumPkg.name}"
+        if pname.find("chromium") != -1:
+            return "chromium"  # Same name for all channels and ungoogled-chromium
+        if pname == "google-chrome":
+            return "google-chrome-stable"
+        if pname == "google-chrome-dev":
+            return "google-chrome-unstable"
+        # For google-chrome-beta and as fallback:
+        return pname
+
+
     def create_new_win():
         with machine.nested("Creating a new Chromium window"):
             machine.execute(
@@ -153,7 +170,14 @@ mapAttrs (channel: chromiumPkg: makeTest rec {
     machine.wait_for_x()
 
     url = "file://${startupHTML}"
-    machine.succeed(ru(f'ulimit -c unlimited; chromium "{url}" & disown'))
+    machine.succeed(ru(f'ulimit -c unlimited; "{get_browser_binary()}" "{url}" & disown'))
+
+    if get_browser_binary().startswith("google-chrome"):
+        # Need to click away the first window:
+        machine.wait_for_text("Make Google Chrome the default browser")
+        machine.screenshot("google_chrome_default_browser_prompt")
+        machine.send_key("ret")
+
     machine.wait_for_text("startup done")
     machine.wait_until_succeeds(
         ru(
diff --git a/nixos/tests/cifs-utils.nix b/nixos/tests/cifs-utils.nix
new file mode 100644
index 00000000000..98587b10d94
--- /dev/null
+++ b/nixos/tests/cifs-utils.nix
@@ -0,0 +1,12 @@
+import ./make-test-python.nix ({ pkgs, ... }: {
+  name = "cifs-utils";
+
+  machine = { pkgs, ... }: { environment.systemPackages = [ pkgs.cifs-utils ]; };
+
+  testScript = ''
+    machine.succeed("smbinfo -h")
+    machine.succeed("smb2-quota -h")
+    assert "${pkgs.cifs-utils.version}" in machine.succeed("cifs.upcall -v")
+    assert "${pkgs.cifs-utils.version}" in machine.succeed("mount.cifs -V")
+  '';
+})
diff --git a/nixos/tests/opentabletdriver.nix b/nixos/tests/opentabletdriver.nix
index 832d4c25a54..fe345a7bec7 100644
--- a/nixos/tests/opentabletdriver.nix
+++ b/nixos/tests/opentabletdriver.nix
@@ -1,4 +1,6 @@
-import ./make-test-python.nix ( { pkgs, ... }: {
+import ./make-test-python.nix ( { pkgs, ... }: let
+  testUser = "alice";
+in {
   name = "opentabletdriver";
   meta = {
     maintainers = with pkgs.lib.maintainers; [ thiagokokada ];
@@ -10,7 +12,7 @@ import ./make-test-python.nix ( { pkgs, ... }: {
         ./common/user-account.nix
         ./common/x11.nix
       ];
-      test-support.displayManager.auto.user = "alice";
+      test-support.displayManager.auto.user = testUser;
       hardware.opentabletdriver.enable = true;
     };
 
@@ -18,10 +20,11 @@ import ./make-test-python.nix ( { pkgs, ... }: {
     ''
       machine.start()
       machine.wait_for_x()
-      machine.wait_for_unit("opentabletdriver.service", "alice")
+      machine.wait_for_unit("opentabletdriver.service", "${testUser}")
 
-      machine.succeed("cat /etc/udev/rules.d/30-opentabletdriver.rules")
+      machine.succeed("cat /etc/udev/rules.d/99-opentabletdriver.rules")
       # Will fail if service is not running
-      machine.succeed("otd detect")
+      # Needs to run as the same user that started the service
+      machine.succeed("su - ${testUser} -c 'otd detect'")
     '';
 })
diff --git a/nixos/tests/podman.nix b/nixos/tests/podman.nix
index bccd2de7c9b..4985ff60365 100644
--- a/nixos/tests/podman.nix
+++ b/nixos/tests/podman.nix
@@ -61,6 +61,20 @@ import ./make-test-python.nix (
           podman.succeed("podman stop sleeping")
           podman.succeed("podman rm sleeping")
 
+      # create systemd session for rootless
+      podman.succeed("loginctl enable-linger alice")
+
+      with subtest("Run container rootless with runc"):
+          podman.succeed(su_cmd("tar cv --files-from /dev/null | podman import - scratchimg"))
+          podman.succeed(
+              su_cmd(
+                  "podman run --runtime=runc -d --name=sleeping -v /nix/store:/nix/store -v /run/current-system/sw/bin:/bin scratchimg /bin/sleep 10"
+              )
+          )
+          podman.succeed(su_cmd("podman ps | grep sleeping"))
+          podman.succeed(su_cmd("podman stop sleeping"))
+          podman.succeed(su_cmd("podman rm sleeping"))
+
       with subtest("Run container rootless with crun"):
           podman.succeed(su_cmd("tar cv --files-from /dev/null | podman import - scratchimg"))
           podman.succeed(
@@ -71,7 +85,6 @@ import ./make-test-python.nix (
           podman.succeed(su_cmd("podman ps | grep sleeping"))
           podman.succeed(su_cmd("podman stop sleeping"))
           podman.succeed(su_cmd("podman rm sleeping"))
-      # As of 2020-11-20, the runc backend doesn't work with cgroupsv2 yet, so we don't run that test.
 
       with subtest("Run container rootless with the default backend"):
           podman.succeed(su_cmd("tar cv --files-from /dev/null | podman import - scratchimg"))
diff --git a/pkgs/applications/audio/mympd/default.nix b/pkgs/applications/audio/mympd/default.nix
index 4e069e001da..876677c3bea 100644
--- a/pkgs/applications/audio/mympd/default.nix
+++ b/pkgs/applications/audio/mympd/default.nix
@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation rec {
   pname = "mympd";
-  version = "6.8.3";
+  version = "6.10.0";
 
   src = fetchFromGitHub {
     owner = "jcorporation";
     repo = "myMPD";
     rev = "v${version}";
-    sha256 = "1a3jrqslxk2a9h5gj6kch108lg9z0i5zwr0j9yd5viyfhr3ka4cq";
+    sha256 = "sha256-QGJti1tKKJlumLgABPmROplF0UVGMWMnyRXLb2cEieQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/graphics/fig2dev/default.nix b/pkgs/applications/graphics/fig2dev/default.nix
index c22bbbb4827..667f5afe579 100644
--- a/pkgs/applications/graphics/fig2dev/default.nix
+++ b/pkgs/applications/graphics/fig2dev/default.nix
@@ -1,26 +1,32 @@
-{ lib, stdenv, fetchurl, ghostscript, libpng } :
+{ lib, stdenv, fetchurl, ghostscript, libpng, makeWrapper
+, coreutils, bc, gnugrep, gawk, gnused } :
 
-let
-  version = "3.2.7b";
-
-in stdenv.mkDerivation {
+stdenv.mkDerivation rec {
   pname = "fig2dev";
-  inherit version;
+  version = "3.2.8";
 
   src = fetchurl {
     url = "mirror://sourceforge/mcj/fig2dev-${version}.tar.xz";
-    sha256 = "1ck8gnqgg13xkxq4hrdy706i4xdgrlckx6bi6wxm1g514121pp27";
+    sha256 = "0zg29yqknfafyzmmln4k7kydfb2dapk3r8ffvlqhj3cm8fp5h4lk";
   };
 
+  nativeBuildInputs = [ makeWrapper ];
   buildInputs = [ libpng ];
 
   GSEXE="${ghostscript}/bin/gs";
 
+  postInstall = ''
+    wrapProgram $out/bin/fig2ps2tex \
+        --set PATH ${lib.makeBinPath [ coreutils bc gnugrep gawk ]}
+    wrapProgram $out/bin/pic2tpic \
+        --set PATH ${lib.makeBinPath [ gnused ]}
+  '';
+
   meta = with lib; {
     description = "Tool to convert Xfig files to other formats";
     homepage = "http://mcj.sourceforge.net/";
     license = licenses.xfig;
     platforms = platforms.linux;
+    maintainers = with maintainers; [ lesuisse ];
   };
 }
-
diff --git a/pkgs/applications/graphics/pdfcpu/default.nix b/pkgs/applications/graphics/pdfcpu/default.nix
index 3a06c8e31f7..bcc09498121 100644
--- a/pkgs/applications/graphics/pdfcpu/default.nix
+++ b/pkgs/applications/graphics/pdfcpu/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "pdfcpu";
-  version = "0.3.7";
+  version = "0.3.8";
 
   src = fetchFromGitHub {
     owner = "pdfcpu";
     repo = pname;
     rev = "v${version}";
-    sha256 = "13b1ncpx189ca0h70j5cdp0jwlj95kasysryz1l6g13cwn9n6mii";
+    sha256 = "sha256-Rx/LUp5s2DhEKuLUklYXjtTXjqBju+5YzK1hNfBCnIE=";
   };
 
-  vendorSha256 = "11w9i1829hk1qb9w24dyxv1bi49358a274g60x11fp5x5cw7bqa7";
+  vendorSha256 = "sha256-/SsDDFveovJfuEdnOkxHAWccS8PJW5k9IHSxSJAgHMQ=";
 
   # No tests
   doCheck = false;
diff --git a/pkgs/applications/networking/browsers/chromium/README.md b/pkgs/applications/networking/browsers/chromium/README.md
index 5b7c9fe5504..9d23e3143c6 100644
--- a/pkgs/applications/networking/browsers/chromium/README.md
+++ b/pkgs/applications/networking/browsers/chromium/README.md
@@ -36,6 +36,21 @@ update `upstream-info.json`. After updates it is important to test at least
 `nixosTests.chromium` (or basic manual testing) and `google-chrome` (which
 reuses `upstream-info.json`).
 
+To run all automated NixOS VM tests for Chromium, ungoogled-chromium,
+and Google Chrome (not recommended, currently 6x tests!):
+```
+nix-build nixos/tests/chromium.nix
+```
+
+A single test can be selected, e.g. to test `ungoogled-chromium` (see
+`channelMap` in `nixos/tests/chromium.nix` for all available options):
+```
+nix-build nixos/tests/chromium.nix -A ungoogled
+```
+(Note: Testing Google Chrome requires `export NIXPKGS_ALLOW_UNFREE=1`.)
+
+For custom builds it's possible to "override" `channelMap`.
+
 ## Backports
 
 All updates are considered security critical and should be ported to the stable
diff --git a/pkgs/applications/networking/cluster/nerdctl/default.nix b/pkgs/applications/networking/cluster/nerdctl/default.nix
index ed00fb231a6..28f7b540722 100644
--- a/pkgs/applications/networking/cluster/nerdctl/default.nix
+++ b/pkgs/applications/networking/cluster/nerdctl/default.nix
@@ -14,16 +14,16 @@ let
 in
 buildGoModule rec {
   pname = "nerdctl";
-  version = "0.4.0";
+  version = "0.5.0";
 
   src = fetchFromGitHub {
     owner = "AkihiroSuda";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0vjcbvd5yrasw97hd5mrn6cdjvfv2r03z7g1wczlszlcs8gr6nxw";
+    sha256 = "sha256-lSvYiTh67gK9kJls7VsayV8T3H6RzFEEKe49BOWnUBw=";
   };
 
-  vendorSha256 = "181lp9l4i0qpiqm8wbxa4ldi1j5bm3ygmanz1xh3mkjanl0pwqjr";
+  vendorSha256 = "sha256-qywiaNoO3pI7sfyPbwWR8BLd86RvJ2xSWwCJUsm3RkM=";
 
   nativeBuildInputs = [ makeWrapper ];
 
diff --git a/pkgs/applications/networking/instant-messengers/nheko/default.nix b/pkgs/applications/networking/instant-messengers/nheko/default.nix
index 48adc6f03cf..b640d7c5f9a 100644
--- a/pkgs/applications/networking/instant-messengers/nheko/default.nix
+++ b/pkgs/applications/networking/instant-messengers/nheko/default.nix
@@ -57,6 +57,10 @@ mkDerivation rec {
     qtgraphicaleffects
   ] ++ lib.optional stdenv.isDarwin qtmacextras;
 
+  cmakeFlags = [
+    "-DCOMPILE_QML=ON" # see https://github.com/Nheko-Reborn/nheko/issues/389
+  ];
+
   meta = with lib; {
     description = "Desktop client for the Matrix protocol";
     homepage = "https://github.com/Nheko-Reborn/nheko";
diff --git a/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix b/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
index 88cd3dc54c5..19e48bf88d6 100644
--- a/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
@@ -25,7 +25,7 @@ let
       else "");
 in stdenv.mkDerivation rec {
   pname = "signal-desktop";
-  version = "1.39.5"; # Please backport all updates to the stable channel.
+  version = "1.39.6"; # Please backport all updates to the stable channel.
   # All releases have a limited lifetime and "expire" 90 days after the release.
   # When releases "expire" the application becomes unusable until an update is
   # applied. The expiration date for the current release can be extracted with:
@@ -35,7 +35,7 @@ in stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://updates.signal.org/desktop/apt/pool/main/s/signal-desktop/signal-desktop_${version}_amd64.deb";
-    sha256 = "1x29ri4jxd1q2wbv5gf26x986x9sms4rxnhj7d5rhm6pz2ihzb2a";
+    sha256 = "04fd81vc0dxk0b47crm5zacf4x79pdn483xicygnc1z6v7mnrmgk";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/printing/pappl/default.nix b/pkgs/applications/printing/pappl/default.nix
index 5cad364d240..4c7b60c125c 100644
--- a/pkgs/applications/printing/pappl/default.nix
+++ b/pkgs/applications/printing/pappl/default.nix
@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation rec {
   pname = "pappl";
-  version = "1.0.0";
+  version = "1.0.1";
 
   src = fetchFromGitHub {
     owner = "michaelrsweet";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1cg06v8hxska0hnybnmfda1v4h3ifjir24nx2iqx80kb6jq0hayb";
+    sha256 = "sha256-4evyOrPd8zb5y00L8h2t++ayW1S8WQ5P+6MXe6eju68=";
   };
 
   outputs = [ "out" "dev" ];
diff --git a/pkgs/applications/science/biology/picard-tools/default.nix b/pkgs/applications/science/biology/picard-tools/default.nix
index d18ca2e2a4f..054fb66dccb 100644
--- a/pkgs/applications/science/biology/picard-tools/default.nix
+++ b/pkgs/applications/science/biology/picard-tools/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "picard-tools";
-  version = "2.23.9";
+  version = "2.24.0";
 
   src = fetchurl {
     url = "https://github.com/broadinstitute/picard/releases/download/${version}/picard.jar";
-    sha256 = "1ygdl590sbcsxpk0qwr0bx163nx51h0545n1xxkbc3pk2r6n51lk";
+    sha256 = "sha256-cOkQObzMb222DxjEFxMhiozfRfWR8CwQEsBiFSsnzXs=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/applications/terminal-emulators/mrxvt/default.nix b/pkgs/applications/terminal-emulators/mrxvt/default.nix
index d46ff802239..b0b9ee61118 100644
--- a/pkgs/applications/terminal-emulators/mrxvt/default.nix
+++ b/pkgs/applications/terminal-emulators/mrxvt/default.nix
@@ -30,8 +30,8 @@ stdenv.mkDerivation {
   meta = with lib; {
     description = "Lightweight multitabbed feature-rich X11 terminal emulator";
     longDescription = "
-    	Multitabbed lightweight terminal emulator based on rxvt.
-	Supports transparency, backgroundimages, freetype fonts, ...
+      Multitabbed lightweight terminal emulator based on rxvt.
+      Supports transparency, backgroundimages, freetype fonts, ...
     ";
     homepage = "https://sourceforge.net/projects/materm";
     license = licenses.gpl2;
diff --git a/pkgs/applications/version-management/commitizen/node-packages.nix b/pkgs/applications/version-management/commitizen/node-packages.nix
index df50c8e473e..396dedf56fd 100644
--- a/pkgs/applications/version-management/commitizen/node-packages.nix
+++ b/pkgs/applications/version-management/commitizen/node-packages.nix
@@ -9068,4 +9068,4 @@ in
     bypassCache = true;
     reconstructLock = true;
   };
-}
\ No newline at end of file
+}
diff --git a/pkgs/build-support/cc-wrapper/default.nix b/pkgs/build-support/cc-wrapper/default.nix
index 0855c27eff4..d1d5f8e6c86 100644
--- a/pkgs/build-support/cc-wrapper/default.nix
+++ b/pkgs/build-support/cc-wrapper/default.nix
@@ -65,6 +65,7 @@ let
     && libcxx == null
     && !(stdenv.targetPlatform.useLLVM or false)
     && !(stdenv.targetPlatform.useAndroidPrebuilt or false)
+    && !(stdenv.targetPlatform.isiOS or false)
     && gccForLibs != null;
 
   # older compilers (for example bootstrap's GCC 5) fail with -march=too-modern-cpu
diff --git a/pkgs/development/compilers/elm/packages/node-composition.nix b/pkgs/development/compilers/elm/packages/node-composition.nix
index c970861a86f..c43e7cc7f25 100644
--- a/pkgs/development/compilers/elm/packages/node-composition.nix
+++ b/pkgs/development/compilers/elm/packages/node-composition.nix
@@ -14,4 +14,4 @@ in
 import ./node-packages.nix {
   inherit (pkgs) fetchurl fetchgit;
   inherit nodeEnv;
-}
\ No newline at end of file
+}
diff --git a/pkgs/development/compilers/elm/packages/node-packages.nix b/pkgs/development/compilers/elm/packages/node-packages.nix
index c81d2acdf7f..015958d1239 100644
--- a/pkgs/development/compilers/elm/packages/node-packages.nix
+++ b/pkgs/development/compilers/elm/packages/node-packages.nix
@@ -15513,4 +15513,4 @@ in
     bypassCache = true;
     reconstructLock = true;
   };
-}
\ No newline at end of file
+}
diff --git a/pkgs/development/compilers/gleam/default.nix b/pkgs/development/compilers/gleam/default.nix
index f96f2f724a6..b2529986f6e 100644
--- a/pkgs/development/compilers/gleam/default.nix
+++ b/pkgs/development/compilers/gleam/default.nix
@@ -2,13 +2,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "gleam";
-  version = "0.12.1";
+  version = "0.13.2";
 
   src = fetchFromGitHub {
     owner = "gleam-lang";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0n23pn7jk4i2waczw5cczsb7v4lal4x6xqmp01y280hb2vk176fg";
+    sha256 = "sha256-ka1GxukX3HR40fMeiiXHguyPKrpGngG2tXDColR7eQA=";
   };
 
   nativeBuildInputs = [ pkg-config ];
@@ -16,7 +16,7 @@ rustPlatform.buildRustPackage rec {
   buildInputs = [ openssl ] ++
     stdenv.lib.optionals stdenv.isDarwin [ Security ];
 
-  cargoSha256 = "0rnf9agpzlvk53x8zrg32w6r0gxcbank3fs32ydv53frvqv1spj3";
+  cargoSha256 = "sha256-/l54ezS68loljKNh7AdYMIuCiyIbsMI3jqD9ktjZLfc=";
 
   meta = with stdenv.lib; {
     description = "A statically typed language for the Erlang VM";
diff --git a/pkgs/development/compilers/go/1.14.nix b/pkgs/development/compilers/go/1.14.nix
index f9a79b14821..6da01358afe 100644
--- a/pkgs/development/compilers/go/1.14.nix
+++ b/pkgs/development/compilers/go/1.14.nix
@@ -36,11 +36,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "go";
-  version = "1.14.13";
+  version = "1.14.14";
 
   src = fetchurl {
     url = "https://dl.google.com/go/go${version}.src.tar.gz";
-    sha256 = "0xxins5crcgghgvnzplmp0qyv2gbmh36v1fpl15d03jwdd6287ds";
+    sha256 = "0vx7r0bb1a500znnnh7v3wgw22ly3p2x06vzyi9hiblgylrby132";
   };
 
   # perl is used for testing go vet
diff --git a/pkgs/development/compilers/go/1.15.nix b/pkgs/development/compilers/go/1.15.nix
index 9a1ff3dd98e..9c6232b8e8b 100644
--- a/pkgs/development/compilers/go/1.15.nix
+++ b/pkgs/development/compilers/go/1.15.nix
@@ -36,11 +36,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "go";
-  version = "1.15.6";
+  version = "1.15.7";
 
   src = fetchurl {
     url = "https://dl.google.com/go/go${version}.src.tar.gz";
-    sha256 = "05sqcx4fm1nxfm46j6xriq0fnnah4bm8bqw027xrzcg2qmrvl2w9";
+    sha256 = "1g1a39y1cnvw3y0bjwjms55cz0s9icm8myrgxi295jwfznmb6cc6";
   };
 
   # perl is used for testing go vet
diff --git a/pkgs/development/libraries/libmodule/default.nix b/pkgs/development/libraries/libmodule/default.nix
index 94632ed57b0..2848298016d 100644
--- a/pkgs/development/libraries/libmodule/default.nix
+++ b/pkgs/development/libraries/libmodule/default.nix
@@ -3,13 +3,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libmodule";
-  version = "5.0.0";
+  version = "5.0.1";
 
   src = fetchFromGitHub {
     owner = "FedeDP";
     repo = "libmodule";
     rev = version;
-    sha256 = "1cf81sl33xmfn5g150iqcdrjn0lpjlgp53mganwi6x7jda2qk7r6";
+    sha256 = "sha256-wkRiDWO9wUyxkAeqvm99u22Jq4xnQJx6zS7Sb+R8iMg=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/libwpe/default.nix b/pkgs/development/libraries/libwpe/default.nix
new file mode 100644
index 00000000000..102d658000c
--- /dev/null
+++ b/pkgs/development/libraries/libwpe/default.nix
@@ -0,0 +1,39 @@
+{ stdenv
+, lib
+, fetchurl
+, meson
+, pkg-config
+, libxkbcommon
+, libGL
+, ninja
+, libX11 }:
+
+stdenv.mkDerivation rec {
+  pname = "libwpe";
+  version = "1.7.1";
+
+  src = fetchurl {
+    url = "https://wpewebkit.org/releases/${pname}-${version}.tar.xz";
+    sha256 = "0h6kh8wy2b370y705pl2vp6vp18dkdsgdxh0243ji2v51kxbg157";
+  };
+
+  nativeBuildInputs = [
+    pkg-config
+    meson
+    ninja
+  ];
+
+  buildInputs = [
+    libxkbcommon
+    libGL
+    libX11
+  ];
+
+  meta = with lib; {
+    description = "General-purpose library for WPE WebKit";
+    license = licenses.bsd2;
+    homepage = "https://wpewebkit.org";
+    maintainers = with maintainers; [ matthewbauer ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/development/libraries/libwpe/fdo.nix b/pkgs/development/libraries/libwpe/fdo.nix
new file mode 100644
index 00000000000..6f9356a6ad8
--- /dev/null
+++ b/pkgs/development/libraries/libwpe/fdo.nix
@@ -0,0 +1,52 @@
+{ stdenv
+, lib
+, fetchurl
+, meson
+, pkg-config
+, ninja
+, wayland
+, epoxy
+, glib
+, libwpe
+, libxkbcommon
+, libGL
+, libX11 }:
+
+stdenv.mkDerivation rec {
+  pname = "wpebackend-fdo";
+  version = "1.7.1";
+
+  src = fetchurl {
+    url = "https://wpewebkit.org/releases/${pname}-${version}.tar.xz";
+    sha256 = "1xf6akagvpyh0nyxkfijrx5avp6ravnivy28dhk64dsfx9rhm64v";
+  };
+
+  depsBuildBuild = [
+    pkg-config
+  ];
+
+  nativeBuildInputs = [
+    pkg-config
+    meson
+    ninja
+    wayland
+  ];
+
+  buildInputs = [
+    wayland
+    epoxy
+    glib
+    libwpe
+    libxkbcommon
+    libGL
+    libX11
+  ];
+
+  meta = with lib; {
+    description = "Freedesktop.org backend for WPE WebKit";
+    license = licenses.bsd2;
+    homepage = "https://wpewebkit.org";
+    maintainers = with maintainers; [ matthewbauer ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/development/libraries/webkitgtk/default.nix b/pkgs/development/libraries/webkitgtk/default.nix
index 77650b322d7..0a58e997c22 100644
--- a/pkgs/development/libraries/webkitgtk/default.nix
+++ b/pkgs/development/libraries/webkitgtk/default.nix
@@ -51,6 +51,8 @@
 , xdg-dbus-proxy
 , substituteAll
 , glib
+, libwpe
+, libwpe-fdo
 }:
 
 assert enableGeoLocation -> geoclue2 != null;
@@ -120,6 +122,8 @@ stdenv.mkDerivation rec {
     libsecret
     libtasn1
     libwebp
+    libwpe
+    libwpe-fdo
     libxkbcommon
     libxml2
     libxslt
@@ -154,7 +158,6 @@ stdenv.mkDerivation rec {
     "-DENABLE_INTROSPECTION=ON"
     "-DPORT=GTK"
     "-DUSE_LIBHYPHEN=OFF"
-    "-DUSE_WPE_RENDERER=OFF"
   ] ++ optionals stdenv.isDarwin [
     "-DENABLE_GRAPHICS_CONTEXT_3D=OFF"
     "-DENABLE_GTKDOC=OFF"
diff --git a/pkgs/development/misc/google-clasp/google-clasp.nix b/pkgs/development/misc/google-clasp/google-clasp.nix
index be260edb643..b565c6d2f5d 100644
--- a/pkgs/development/misc/google-clasp/google-clasp.nix
+++ b/pkgs/development/misc/google-clasp/google-clasp.nix
@@ -14,4 +14,4 @@ in
 import ./node-packages.nix {
   inherit (pkgs) fetchurl fetchgit;
   inherit nodeEnv;
-}
\ No newline at end of file
+}
diff --git a/pkgs/development/misc/google-clasp/node-packages.nix b/pkgs/development/misc/google-clasp/node-packages.nix
index c73c122e572..a58f58e05c6 100644
--- a/pkgs/development/misc/google-clasp/node-packages.nix
+++ b/pkgs/development/misc/google-clasp/node-packages.nix
@@ -2102,4 +2102,4 @@ in
     bypassCache = true;
     reconstructLock = true;
   };
-}
\ No newline at end of file
+}
diff --git a/pkgs/development/node-packages/node-packages.nix b/pkgs/development/node-packages/node-packages.nix
index 38fc84d5523..94c0b38fc76 100644
--- a/pkgs/development/node-packages/node-packages.nix
+++ b/pkgs/development/node-packages/node-packages.nix
@@ -110969,4 +110969,4 @@ in
     bypassCache = true;
     reconstructLock = true;
   };
-}
\ No newline at end of file
+}
diff --git a/pkgs/development/ocaml-modules/optint/default.nix b/pkgs/development/ocaml-modules/optint/default.nix
index 508bbfba605..18e4bd1ae86 100644
--- a/pkgs/development/ocaml-modules/optint/default.nix
+++ b/pkgs/development/ocaml-modules/optint/default.nix
@@ -2,11 +2,11 @@
 
 buildDunePackage rec {
   minimumOCamlVersion = "4.03";
-  version = "0.0.3";
+  version = "0.0.4";
   pname = "optint";
   src = fetchurl {
     url = "https://github.com/mirage/optint/releases/download/v${version}/optint-v${version}.tbz";
-    sha256 = "0c7r3s6lal9xkixngkj25nqncj4s33ka40bjdi7fz7mly08djycj";
+    sha256 = "1a7gabxqmfvii8qnxq1clx43md2h9glskxhac8y8r0rhzblx3s1a";
   };
 
   meta = {
diff --git a/pkgs/development/php-packages/phpstan/default.nix b/pkgs/development/php-packages/phpstan/default.nix
index 6bd3fb00c4e..c363150babc 100644
--- a/pkgs/development/php-packages/phpstan/default.nix
+++ b/pkgs/development/php-packages/phpstan/default.nix
@@ -1,14 +1,14 @@
 { mkDerivation, fetchurl, pkgs, lib, php }:
 let
   pname = "phpstan";
-  version = "0.12.59";
+  version = "0.12.68";
 in
 mkDerivation {
   inherit pname version;
 
   src = pkgs.fetchurl {
     url = "https://github.com/phpstan/phpstan/releases/download/${version}/phpstan.phar";
-    sha256 = "0lp25d9b7w8lk4ffrd17mjw93i234qnfpwz42k8lww1lrk5abnfa";
+    sha256 = "sha256-qplQi12ecZjtaM8XawiO+qSwEdTXByrxWZLf3N7gfNc=";
   };
 
   phases = [ "installPhase" ];
diff --git a/pkgs/development/php-packages/psalm/default.nix b/pkgs/development/php-packages/psalm/default.nix
index 473b035d23a..1de01d1d09d 100644
--- a/pkgs/development/php-packages/psalm/default.nix
+++ b/pkgs/development/php-packages/psalm/default.nix
@@ -1,14 +1,14 @@
 { mkDerivation, fetchurl, pkgs, lib, php }:
 let
   pname = "psalm";
-  version = "4.3.1";
+  version = "4.4.1";
 in
 mkDerivation {
   inherit pname version;
 
   src = fetchurl {
     url = "https://github.com/vimeo/psalm/releases/download/${version}/psalm.phar";
-    sha256 = "1hv9r5m1mdywm7qi9rs9054jp77cpip3jyw048iq3l7s0vpslkc5";
+    sha256 = "sha256-4hqgAPflzNmeQQaxQATpWYBB5Pz7jKu8Vlw3BiMyhtw=";
   };
 
   phases = [ "installPhase" ];
diff --git a/pkgs/development/python-modules/azure-synapse-artifacts/default.nix b/pkgs/development/python-modules/azure-synapse-artifacts/default.nix
index f33df1fdbe8..5a414388c4c 100644
--- a/pkgs/development/python-modules/azure-synapse-artifacts/default.nix
+++ b/pkgs/development/python-modules/azure-synapse-artifacts/default.nix
@@ -23,8 +23,8 @@ buildPythonPackage rec {
   pythonImportsCheck = [ "azure.synapse.artifacts" ];
 
   meta = with lib; {
-    description = "CHANGE";
-    homepage = "https://github.com/CHANGE/azure-synapse-artifacts/";
+    description = "Microsoft Azure Synapse Artifacts Client Library for Python";
+    homepage = "https://github.com/Azure/azure-sdk-for-python";
     license = licenses.mit;
     maintainers = with maintainers; [ jonringer ];
   };
diff --git a/pkgs/development/python-modules/bellows/default.nix b/pkgs/development/python-modules/bellows/default.nix
index 614a1ad98a9..6ee8b6499b5 100644
--- a/pkgs/development/python-modules/bellows/default.nix
+++ b/pkgs/development/python-modules/bellows/default.nix
@@ -1,26 +1,27 @@
-{ lib, stdenv, buildPythonPackage, fetchPypi
+{ lib, stdenv, buildPythonPackage, fetchFromGitHub
 , click, click-log, pure-pcapy3
-, pyserial, pyserial-asyncio, voluptuous, zigpy
-, asynctest, pytest, pytest-asyncio }:
+, pyserial-asyncio, voluptuous, zigpy
+, asynctest, pytestCheckHook, pytest-asyncio }:
 
-let
+buildPythonPackage rec {
   pname = "bellows";
   version = "0.21.0";
 
-in buildPythonPackage rec {
-  inherit pname version;
-
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "fd2ac40c1f3550580dc561ae58d7d15cfa12e6a7cc5d35ee80e7a1cb6a4cda4f";
+  src = fetchFromGitHub {
+    owner = "zigpy";
+    repo = "bellows";
+    rev = version;
+    sha256 = "1gja7cb1cyzbi19k8awa2gyc3bjam0adapalpk5slxny0vxlc73a";
   };
 
   propagatedBuildInputs = [
-    click click-log pure-pcapy3 pyserial pyserial-asyncio voluptuous zigpy
+    click click-log pure-pcapy3 pyserial-asyncio voluptuous zigpy
   ];
 
   checkInputs = [
-    asynctest pytest pytest-asyncio
+    asynctest
+    pytestCheckHook
+    pytest-asyncio
   ];
 
   prePatch = ''
diff --git a/pkgs/development/python-modules/bidict/default.nix b/pkgs/development/python-modules/bidict/default.nix
index 34b9f4cf5ff..dcb684a55e0 100644
--- a/pkgs/development/python-modules/bidict/default.nix
+++ b/pkgs/development/python-modules/bidict/default.nix
@@ -3,7 +3,7 @@
 , sphinx
 , hypothesis
 , py
-, pytest
+, pytestCheckHook
 , pytest-benchmark
 , sortedcollections
 , sortedcontainers
@@ -23,23 +23,14 @@ buildPythonPackage rec {
   nativeBuildInputs = [ setuptools_scm ];
   propagatedBuildInputs = [ sphinx ];
 
-  # this can be removed >0.19.0
-  postPatch = ''
-    substituteInPlace setup.py \
-      --replace "setuptools_scm < 4" "setuptools_scm"
-  '';
-
   checkInputs = [
     hypothesis
     py
-    pytest
+    pytestCheckHook
     pytest-benchmark
     sortedcollections
     sortedcontainers
   ];
-  checkPhase = ''
-    pytest tests
-  '';
 
   meta = with lib; {
     homepage = "https://github.com/jab/bidict";
diff --git a/pkgs/development/python-modules/google-music/default.nix b/pkgs/development/python-modules/google-music/default.nix
index e5b42c5310f..90978ad2cba 100644
--- a/pkgs/development/python-modules/google-music/default.nix
+++ b/pkgs/development/python-modules/google-music/default.nix
@@ -19,11 +19,6 @@ buildPythonPackage rec {
     sha256 = "0fsp491ifsw0i1r98l8xr41m8d00nw9n5bin8k3laqzq1p65d6dp";
   };
 
-  postPatch = ''
-    substituteInPlace setup.py \
-      --replace "audio-metadata>=0.8,<0.9" "audio-metadata"
-  '';
-
   propagatedBuildInputs = [
     appdirs
     audio-metadata
diff --git a/pkgs/development/python-modules/mxnet/default.nix b/pkgs/development/python-modules/mxnet/default.nix
index 65eb2d44ffc..d32905e7e61 100644
--- a/pkgs/development/python-modules/mxnet/default.nix
+++ b/pkgs/development/python-modules/mxnet/default.nix
@@ -20,9 +20,7 @@ buildPythonPackage {
 
   postPatch = ''
     substituteInPlace python/setup.py \
-      --replace "graphviz<0.9.0," "graphviz" \
-      --replace "numpy<=1.15.2," "numpy" \
-      --replace "requests<2.19.0," "requests"
+      --replace "graphviz<0.9.0," "graphviz"
   '';
 
   preConfigure = ''
diff --git a/pkgs/development/python-modules/spyder/default.nix b/pkgs/development/python-modules/spyder/default.nix
index de1b8123dd9..26013e71158 100644
--- a/pkgs/development/python-modules/spyder/default.nix
+++ b/pkgs/development/python-modules/spyder/default.nix
@@ -44,8 +44,7 @@ buildPythonPackage rec {
     sed -i /pyqtwebengine/d setup.py
     substituteInPlace setup.py \
       --replace "pyqt5<5.13" "pyqt5" \
-      --replace "parso==0.7.0" "parso" \
-      --replace "jedi==0.17.1" "jedi"
+      --replace "parso==0.7.0" "parso"
   '';
 
   postInstall = ''
diff --git a/pkgs/development/tools/operator-sdk/default.nix b/pkgs/development/tools/operator-sdk/default.nix
index f97611c7785..c09331de598 100644
--- a/pkgs/development/tools/operator-sdk/default.nix
+++ b/pkgs/development/tools/operator-sdk/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "operator-sdk";
-  version = "1.2.0";
+  version = "1.3.0";
 
   src = fetchFromGitHub {
     owner = "operator-framework";
     repo = pname;
     rev = "v${version}";
-    sha256 = "03iy4a5jlsmmzn8cpyp35sc2kgz6shg18ah0qdzkadqqalqlldy8";
+    sha256 = "sha256-xYG605Z8WGFH5byJA+sHPBjBmWi8b+TTtWRnQnmYN/4=";
   };
 
-  vendorSha256 = "0dls086lw3sbal4rf0l3xb0sp6g393n9ylkpzppp75myj7v900vv";
+  vendorSha256 = "sha256-0ZowddIiVHVg1OKhaCFo+vQKcUe6wZ6L0J8RdMvZyGk=";
 
   doCheck = false;
 
diff --git a/pkgs/development/web/cog/default.nix b/pkgs/development/web/cog/default.nix
new file mode 100644
index 00000000000..f1ddaea80d7
--- /dev/null
+++ b/pkgs/development/web/cog/default.nix
@@ -0,0 +1,70 @@
+{ stdenv
+, lib
+, fetchpatch
+, fetchFromGitHub
+, cmake
+, pkg-config
+, wayland
+, wayland-protocols
+, libwpe
+, libwpe-fdo
+, glib
+, glib-networking
+, webkitgtk
+, makeWrapper
+, wrapGAppsHook
+, gnome3
+, gdk-pixbuf
+}:
+
+stdenv.mkDerivation rec {
+  pname = "cog";
+  version = "0.6.0";
+
+  src = fetchFromGitHub {
+    owner = "igalia";
+    repo = "cog";
+    rev = "v${version}";
+    sha256 = "0a0zpdki1whm5gb6ycbazvwmm1fz094mkfwjfy4a7zz0pk54h1jw";
+  };
+
+  buildInputs = [
+    wayland-protocols
+    wayland
+    libwpe
+    libwpe-fdo
+    webkitgtk
+    glib-networking
+    gdk-pixbuf
+    gnome3.adwaita-icon-theme
+  ];
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+    wayland
+    makeWrapper
+    wrapGAppsHook
+  ];
+
+  depsBuildsBuild = [
+    pkg-config
+  ];
+
+  cmakeFlags = [
+    "-DCOG_USE_WEBKITGTK=ON"
+  ];
+
+  # not ideal, see https://github.com/WebPlatformForEmbedded/libwpe/issues/59
+  preFixup = ''
+    wrapProgram $out/bin/cog \
+      --prefix LD_LIBRARY_PATH : ${libwpe-fdo}/lib
+  '';
+
+  meta = with lib; {
+    description = "A small single “window” launcher for the WebKit WPE port";
+    license = licenses.mit;
+    maintainers = [ maintainers.matthewbauer ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/development/web/newman/node-composition.nix b/pkgs/development/web/newman/node-composition.nix
index 17879f381d5..027a981ea57 100644
--- a/pkgs/development/web/newman/node-composition.nix
+++ b/pkgs/development/web/newman/node-composition.nix
@@ -14,4 +14,4 @@ in
 import ./node-packages.nix {
   inherit (pkgs) fetchurl fetchgit;
   inherit nodeEnv;
-}
\ No newline at end of file
+}
diff --git a/pkgs/development/web/newman/node-packages.nix b/pkgs/development/web/newman/node-packages.nix
index a7c29ca49c7..680be3d499c 100644
--- a/pkgs/development/web/newman/node-packages.nix
+++ b/pkgs/development/web/newman/node-packages.nix
@@ -5727,4 +5727,4 @@ in
     bypassCache = true;
     reconstructLock = true;
   };
-}
\ No newline at end of file
+}
diff --git a/pkgs/development/web/remarkjs/nodepkgs.nix b/pkgs/development/web/remarkjs/nodepkgs.nix
index be260edb643..b565c6d2f5d 100644
--- a/pkgs/development/web/remarkjs/nodepkgs.nix
+++ b/pkgs/development/web/remarkjs/nodepkgs.nix
@@ -14,4 +14,4 @@ in
 import ./node-packages.nix {
   inherit (pkgs) fetchurl fetchgit;
   inherit nodeEnv;
-}
\ No newline at end of file
+}
diff --git a/pkgs/games/0ad/default.nix b/pkgs/games/0ad/default.nix
index d53942766bb..860db7c6d5a 100644
--- a/pkgs/games/0ad/default.nix
+++ b/pkgs/games/0ad/default.nix
@@ -1,14 +1,14 @@
-{ wxGTK, newScope }:
-
+{ wxGTK, stdenv, newScope }:
 let
   callPackage = newScope self;
 
   self = {
-    zeroad-unwrapped = callPackage ./game.nix { inherit wxGTK; };
+    zeroad-unwrapped = callPackage ./game.nix { inherit wxGTK stdenv; };
 
-    zeroad-data = callPackage ./data.nix { };
+    zeroad-data = callPackage ./data.nix { inherit stdenv; };
 
     zeroad = callPackage ./wrapper.nix { };
   };
 
-in self
+in
+self
diff --git a/pkgs/games/0ad/game.nix b/pkgs/games/0ad/game.nix
index ae0b2180a80..1ba975aa885 100644
--- a/pkgs/games/0ad/game.nix
+++ b/pkgs/games/0ad/game.nix
@@ -50,7 +50,7 @@ stdenv.mkDerivation rec {
     # Workaround invalid pkg-config name for mozjs
     mkdir pkg-config
     ln -s ${spidermonkey_38}/lib/pkgconfig/* pkg-config/mozjs-38.pc
-    PKG_CONFIG_PATH="$PWD/pkgconfig:$PKG_CONFIG_PATH"
+    PKG_CONFIG_PATH="$PWD/pkg-config:$PKG_CONFIG_PATH"
 
     # Update Makefiles
     pushd build/workspaces
diff --git a/pkgs/games/crispy-doom/default.nix b/pkgs/games/crispy-doom/default.nix
index 2b04e31f548..432600e879f 100644
--- a/pkgs/games/crispy-doom/default.nix
+++ b/pkgs/games/crispy-doom/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "crispy-doom";
-  version = "5.9.2";
+  version = "5.10.0";
 
   src = fetchFromGitHub {
     owner = "fabiangreffrath";
     repo = pname;
     rev = "${pname}-${version}";
-    sha256 = "0fkw9z66sjcz7k528wyla6mgi4impqimn93yhqmc194ycrjirraa";
+    sha256 = "sha256-hRdd5ZrcVBU7tn1juvrLdbenULzu6OsXefG0oLjjFIg=";
   };
 
   postPatch = ''
diff --git a/pkgs/misc/base16-builder/node-packages-generated.nix b/pkgs/misc/base16-builder/node-packages-generated.nix
index 426b6229e1c..7ccb5cab835 100644
--- a/pkgs/misc/base16-builder/node-packages-generated.nix
+++ b/pkgs/misc/base16-builder/node-packages-generated.nix
@@ -1634,4 +1634,4 @@ in
     bypassCache = true;
     reconstructLock = true;
   };
-}
\ No newline at end of file
+}
diff --git a/pkgs/misc/base16-builder/node-packages.nix b/pkgs/misc/base16-builder/node-packages.nix
index bb6ff246daa..396f2b2657d 100644
--- a/pkgs/misc/base16-builder/node-packages.nix
+++ b/pkgs/misc/base16-builder/node-packages.nix
@@ -18,4 +18,4 @@ in
 import ./node-packages-generated.nix {
   inherit (pkgs) fetchurl fetchgit;
   inherit nodeEnv globalBuildInputs;
-}
\ No newline at end of file
+}
diff --git a/pkgs/misc/base16-builder/supplement.nix b/pkgs/misc/base16-builder/supplement.nix
index 8183eb1a1e8..3d4c43d5e70 100644
--- a/pkgs/misc/base16-builder/supplement.nix
+++ b/pkgs/misc/base16-builder/supplement.nix
@@ -690,4 +690,4 @@ in
     bypassCache = true;
     reconstructLock = true;
   };
-}
\ No newline at end of file
+}
diff --git a/pkgs/misc/emulators/mednaffe/default.nix b/pkgs/misc/emulators/mednaffe/default.nix
index e8cda5170cc..dbbbe4da557 100644
--- a/pkgs/misc/emulators/mednaffe/default.nix
+++ b/pkgs/misc/emulators/mednaffe/default.nix
@@ -1,7 +1,13 @@
-{ lib, stdenv, fetchFromGitHub, makeWrapper, autoreconfHook, pkg-config, wrapGAppsHook
-, gtk2 ? null, gtk3 ? null, mednafen }:
-
-with lib;
+{ stdenv
+, lib
+, fetchFromGitHub
+, autoreconfHook
+, pkg-config
+, mednafen
+, gtk2 ? null
+, gtk3 ? null
+, wrapGAppsHook
+}:
 
 stdenv.mkDerivation rec {
   pname = "mednaffe";
@@ -14,13 +20,20 @@ stdenv.mkDerivation rec {
     sha256 = "15qk3a3l1phr8bap2ayh3c0vyvw2jwhny1iz1ajq2adyjpm9fhr7";
   };
 
-  nativeBuildInputs = [ autoreconfHook makeWrapper pkg-config wrapGAppsHook ];
+  nativeBuildInputs = [ autoreconfHook pkg-config wrapGAppsHook ];
   buildInputs = [ gtk2 gtk3 mednafen ];
 
-  configureFlags = [ (enableFeature (gtk3 != null) "gtk3") ];
-  postInstall = "wrapProgram $out/bin/mednaffe --set PATH ${mednafen}/bin";
+  configureFlags = [ (lib.enableFeature (gtk3 != null) "gtk3") ];
 
-  meta = {
+  dontWrapGApps = true;
+
+  postInstall = ''
+    wrapProgram $out/bin/mednaffe \
+      --prefix PATH ':' "${mednafen}/bin" \
+      "''${gappsWrapperArgs[@]}"
+   '';
+
+  meta = with lib; {
     description = "GTK-based frontend for mednafen emulator";
     homepage = "https://github.com/AmatCoder/mednaffe";
     license = licenses.gpl3Plus;
diff --git a/pkgs/os-specific/darwin/duti/default.nix b/pkgs/os-specific/darwin/duti/default.nix
index 5c63b8e0dfb..9daed151ce4 100644
--- a/pkgs/os-specific/darwin/duti/default.nix
+++ b/pkgs/os-specific/darwin/duti/default.nix
@@ -1,17 +1,25 @@
-{stdenv, lib, fetchFromGitHub, autoreconfHook, darwin}:
+{stdenv, lib, fetchFromGitHub, autoreconfHook, ApplicationServices}:
 
 stdenv.mkDerivation rec {
   pname = "duti";
-  version = "1.5.4pre";
+  version = "1.5.5pre";
   src = fetchFromGitHub {
     owner = "moretension";
     repo = pname;
-    rev = "7dbcae86f99fedef5a6c4311f032a0f1ca0539cc";
-    sha256 = "1z9sa0yk87vs57d5338y6lvm1v1vvynxb7dy1x5aqzkcr0imhljl";
+    rev = "fe3d3dc411bcea6af7a8cbe53c0e08ed5ecacdb2";
+    sha256 = "1pg4i6ghpib2gy1sqpml7dbnhr1vbr43fs2pqkd09i4w3nmgpic9";
   };
+
   nativeBuildInputs = [autoreconfHook];
-  buildInputs = [darwin.apple_sdk.frameworks.ApplicationServices];
-  configureFlags = ["--with-macosx-sdk=/homeless-shelter"];
+  buildInputs = [ApplicationServices];
+  configureFlags = [
+    "--with-macosx-sdk=/homeless-shelter"
+
+    # needed to prevent duti from trying to guess our sdk
+    # NOTE: this is different than stdenv.hostPlatform.config!
+    "--host=x86_64-apple-darwin18"
+  ];
+
   meta = with lib; {
     description = "A command-line tool to select default applications for document types and URL schemes on Mac OS X";
     longDescription = ''
diff --git a/pkgs/os-specific/linux/cifs-utils/default.nix b/pkgs/os-specific/linux/cifs-utils/default.nix
index dcffe770dee..c4ed4d4fc0f 100644
--- a/pkgs/os-specific/linux/cifs-utils/default.nix
+++ b/pkgs/os-specific/linux/cifs-utils/default.nix
@@ -1,5 +1,5 @@
 { stdenv, lib, fetchurl, autoreconfHook, docutils, pkg-config
-, kerberos, keyutils, pam, talloc }:
+, kerberos, keyutils, pam, talloc, python3 }:
 
 stdenv.mkDerivation rec {
   pname = "cifs-utils";
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ autoreconfHook docutils pkg-config ];
 
-  buildInputs = [ kerberos keyutils pam talloc ];
+  buildInputs = [ kerberos keyutils pam talloc python3 ];
 
   configureFlags = [ "ROOTSBINDIR=$(out)/sbin" ] ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
     # AC_FUNC_MALLOC is broken on cross builds.
diff --git a/pkgs/os-specific/linux/sysklogd/default.nix b/pkgs/os-specific/linux/sysklogd/default.nix
index 454527321fb..af180b5e524 100644
--- a/pkgs/os-specific/linux/sysklogd/default.nix
+++ b/pkgs/os-specific/linux/sysklogd/default.nix
@@ -8,7 +8,7 @@ stdenv.mkDerivation {
     sha256 = "00f2wy6f0qng7qzga4iicyzl9j8b7mp6mrpfky5jxj93ms2w2rji";
   };
 
-  patches = [ ./systemd.patch ./union-wait.patch ];
+  patches = [ ./systemd.patch ./union-wait.patch ./fix-includes-for-musl.patch ];
 
   NIX_CFLAGS_COMPILE = "-DSYSV";
 
diff --git a/pkgs/os-specific/linux/sysklogd/fix-includes-for-musl.patch b/pkgs/os-specific/linux/sysklogd/fix-includes-for-musl.patch
new file mode 100644
index 00000000000..87e56a10db8
--- /dev/null
+++ b/pkgs/os-specific/linux/sysklogd/fix-includes-for-musl.patch
@@ -0,0 +1,120 @@
+# this patch both fixes some include paths as well as removes glibc
+# gates around defines that musl-libc also depends on.
+diff -u sysklogd-1.5.1.orig/klogd.c sysklogd-1.5.1/klogd.c
+--- sysklogd-1.5.1.orig/klogd.c	2014-10-04 15:47:18.000000000 -0400
++++ sysklogd-1.5.1/klogd.c	2021-01-18 23:09:23.000000000 -0500
+@@ -260,11 +260,8 @@
+ #include <unistd.h>
+ #include <signal.h>
+ #include <errno.h>
+-#include <sys/fcntl.h>
++#include <fcntl.h>
+ #include <sys/stat.h>
+-#if !defined(__GLIBC__)
+-#include <linux/time.h>
+-#endif /* __GLIBC__ */
+ #include <stdarg.h>
+ #include <paths.h>
+ #include <stdlib.h>
+@@ -277,13 +274,8 @@
+ 
+ #define __LIBRARY__
+ #include <linux/unistd.h>
+-#if !defined(__GLIBC__)
+-# define __NR_ksyslog __NR_syslog
+-_syscall3(int,ksyslog,int, type, char *, buf, int, len);
+-#else
+ #include <sys/klog.h>
+ #define ksyslog klogctl
+-#endif
+ 
+ #define LOG_BUFFER_SIZE 4096
+ #define LOG_LINE_LENGTH 1000
+diff -u sysklogd-1.5.1.orig/ksym_mod.c sysklogd-1.5.1/ksym_mod.c
+--- sysklogd-1.5.1.orig/ksym_mod.c	2014-10-04 15:47:18.000000000 -0400
++++ sysklogd-1.5.1/ksym_mod.c	2021-01-18 23:09:57.000000000 -0500
+@@ -113,12 +113,9 @@
+ #include <unistd.h>
+ #include <signal.h>
+ #include <errno.h>
+-#include <sys/fcntl.h>
++#include <fcntl.h>
+ #include <sys/stat.h>
+ #include "module.h"
+-#if !defined(__GLIBC__)
+-#include <linux/time.h>
+-#endif /* __GLIBC__ */
+ #include <stdarg.h>
+ #include <paths.h>
+ #include <linux/version.h>
+diff -u sysklogd-1.5.1.orig/pidfile.c sysklogd-1.5.1/pidfile.c
+--- sysklogd-1.5.1.orig/pidfile.c	2014-10-04 15:47:18.000000000 -0400
++++ sysklogd-1.5.1/pidfile.c	2021-01-18 23:23:55.000000000 -0500
+@@ -25,6 +25,7 @@
+  */
+ 
+ #include <stdio.h>
++#include <fcntl.h>
+ #include <unistd.h>
+ #include <sys/stat.h>
+ #include <sys/file.h>
+diff -u sysklogd-1.5.1.orig/syslog.c sysklogd-1.5.1/syslog.c
+--- sysklogd-1.5.1.orig/syslog.c	2014-10-04 15:47:18.000000000 -0400
++++ sysklogd-1.5.1/syslog.c	2021-01-18 23:11:45.000000000 -0500
+@@ -55,7 +55,6 @@
+ #include <sys/types.h>
+ #include <sys/socket.h>
+ #include <sys/file.h>
+-#include <sys/signal.h>
+ #include <sys/syslog.h>
+ #if 0
+ #include "syslog.h"
+@@ -64,6 +63,8 @@
+ 
+ #include <sys/uio.h>
+ #include <sys/wait.h>
++#include <signal.h>
++#include <fcntl.h>
+ #include <netdb.h>
+ #include <string.h>
+ #include <time.h>
+diff -u sysklogd-1.5.1.orig/syslogd.c sysklogd-1.5.1/syslogd.c
+--- sysklogd-1.5.1.orig/syslogd.c	2014-10-04 15:47:18.000000000 -0400
++++ sysklogd-1.5.1/syslogd.c	2021-01-18 23:13:25.000000000 -0500
+@@ -519,9 +519,9 @@
+ #include <time.h>
+ 
+ #define SYSLOG_NAMES
++#include <errno.h>
+ #include <sys/syslog.h>
+ #include <sys/param.h>
+-#include <sys/errno.h>
+ #include <sys/ioctl.h>
+ #include <sys/stat.h>
+ #include <sys/wait.h>
+@@ -818,9 +818,7 @@
+ void init();
+ void cfline(char *line, register struct filed *f);
+ int decode(char *name, struct code *codetab);
+-#if defined(__GLIBC__)
+ #define dprintf mydprintf
+-#endif /* __GLIBC__ */
+ static void dprintf(char *, ...);
+ static void allocate_log(void);
+ void sighup_handler();
+@@ -840,15 +838,9 @@
+ 	register char *p;
+ #ifndef TESTING
+ 	ssize_t msglen;
+-#endif
+-#if !defined(__GLIBC__)
+-	int len, num_fds;
+-#else /* __GLIBC__ */
+-#ifndef TESTING
+ 	socklen_t len;
+ #endif
+ 	int num_fds;
+-#endif /* __GLIBC__ */
+ 	/*
+ 	 * It took me quite some time to figure out how this is
+ 	 * supposed to work so I guess I should better write it down.
diff --git a/pkgs/os-specific/linux/sysklogd/systemd.patch b/pkgs/os-specific/linux/sysklogd/systemd.patch
index 0a7fb166bd7..a170f67cadb 100644
--- a/pkgs/os-specific/linux/sysklogd/systemd.patch
+++ b/pkgs/os-specific/linux/sysklogd/systemd.patch
@@ -71,9 +71,9 @@ diff -ruN -x '*~' sysklogd-1.5-old/sd-daemon.c sysklogd-1.5/sd-daemon.c
 +#include <sys/stat.h>
 +#include <sys/socket.h>
 +#include <sys/un.h>
-+#include <sys/fcntl.h>
 +#include <netinet/in.h>
 +#include <stdlib.h>
++#include <fcntl.h>
 +#include <errno.h>
 +#include <unistd.h>
 +#include <string.h>
diff --git a/pkgs/servers/dns/knot-dns/default.nix b/pkgs/servers/dns/knot-dns/default.nix
index 07e8e7d5210..2a9e00b266b 100644
--- a/pkgs/servers/dns/knot-dns/default.nix
+++ b/pkgs/servers/dns/knot-dns/default.nix
@@ -7,11 +7,11 @@ let inherit (lib) optional optionals; in
 
 stdenv.mkDerivation rec {
   pname = "knot-dns";
-  version = "3.0.3";
+  version = "3.0.4";
 
   src = fetchurl {
     url = "https://secure.nic.cz/files/knot-dns/knot-${version}.tar.xz";
-    sha256 = "fbc51897ef0ed0639ebad59b988a91382b9544288a2db8254f0b1de433140e38";
+    sha256 = "451d8913a769b7e4bcb3e250a3181b448e28a82cfc58cea6f2509475d7327983";
   };
 
   outputs = [ "bin" "out" "dev" ];
diff --git a/pkgs/servers/matrix-synapse/matrix-appservice-slack/node-composition.nix b/pkgs/servers/matrix-synapse/matrix-appservice-slack/node-composition.nix
index 0f86a16aef5..693eeaeaec6 100644
--- a/pkgs/servers/matrix-synapse/matrix-appservice-slack/node-composition.nix
+++ b/pkgs/servers/matrix-synapse/matrix-appservice-slack/node-composition.nix
@@ -14,4 +14,4 @@ in
 import ./node-packages.nix {
   inherit (pkgs) fetchurl fetchgit;
   inherit nodeEnv;
-}
\ No newline at end of file
+}
diff --git a/pkgs/servers/monitoring/prometheus/sql-exporter.nix b/pkgs/servers/monitoring/prometheus/sql-exporter.nix
index d6c69a6089b..2784dae63af 100644
--- a/pkgs/servers/monitoring/prometheus/sql-exporter.nix
+++ b/pkgs/servers/monitoring/prometheus/sql-exporter.nix
@@ -2,15 +2,15 @@
 
 buildGoModule rec {
   pname = "sql_exporter";
-  version = "0.3.0";
+  version = "0.4.0";
 
   vendorSha256 = null;
 
   src = fetchFromGitHub {
     owner = "justwatchcom";
-    repo = "sql_exporter";
+    repo = pname;
     rev = "v${version}";
-    sha256 = "125brlxgwhkn3z5v0522gpm0sk6v905ghh05c4c3wf1hlm7bhnrc";
+    sha256 = "0dxzcd3b430xby741fdc85k4d2380jrh34xxskmdzxbf2kqdc5k8";
   };
 
   meta = with lib; {
diff --git a/pkgs/servers/plex/raw.nix b/pkgs/servers/plex/raw.nix
index 77ce52db91f..b040c86c9fa 100644
--- a/pkgs/servers/plex/raw.nix
+++ b/pkgs/servers/plex/raw.nix
@@ -12,16 +12,16 @@
 # server, and the FHS userenv and corresponding NixOS module should
 # automatically pick up the changes.
 stdenv.mkDerivation rec {
-  version = "1.21.1.3842-b0c7a97d9";
+  version = "1.21.1.3876-3c3adfcb4";
   pname = "plexmediaserver";
 
   # Fetch the source
   src = if stdenv.hostPlatform.system == "aarch64-linux" then fetchurl {
     url = "https://downloads.plex.tv/plex-media-server-new/${version}/debian/plexmediaserver_${version}_arm64.deb";
-    sha256 = "0wq8q9dvdwciazidvh9plxjzngjr6ibg077yksxhy41dv14vkw7s";
+    sha256 = "1xpsmk5l0f0blqp5ba9n1w0npsk692p07hp4ipkq7yz3mfag50p0";
   } else fetchurl {
     url = "https://downloads.plex.tv/plex-media-server-new/${version}/debian/plexmediaserver_${version}_amd64.deb";
-    sha256 = "14pa50kvgi4m5hbw4a0q7y3s4xn9ghvnm4vdim9g18p1khfmwmwp";
+    sha256 = "0dyw84x9h295428l7r8iqfb2vxkv0f1d68z1j2ka3wsw7cj1yq78";
   };
 
   outputs = [ "out" "basedb" ];
diff --git a/pkgs/servers/web-apps/cryptpad/node-packages-generated.nix b/pkgs/servers/web-apps/cryptpad/node-packages-generated.nix
index 349ad59c60a..c8186e1d02c 100644
--- a/pkgs/servers/web-apps/cryptpad/node-packages-generated.nix
+++ b/pkgs/servers/web-apps/cryptpad/node-packages-generated.nix
@@ -741,4 +741,4 @@ in
     bypassCache = true;
     reconstructLock = true;
   };
-}
\ No newline at end of file
+}
diff --git a/pkgs/servers/web-apps/cryptpad/node-packages.nix b/pkgs/servers/web-apps/cryptpad/node-packages.nix
index 208bb3c72c7..d0273cfe1f9 100644
--- a/pkgs/servers/web-apps/cryptpad/node-packages.nix
+++ b/pkgs/servers/web-apps/cryptpad/node-packages.nix
@@ -14,4 +14,4 @@ in
 import ./node-packages-generated.nix {
   inherit (pkgs) fetchurl fetchgit;
   inherit nodeEnv;
-}
\ No newline at end of file
+}
diff --git a/pkgs/servers/web-apps/whitebophir/node-packages-generated.nix b/pkgs/servers/web-apps/whitebophir/node-packages-generated.nix
index 78d4b9ccd77..af58cbf3f9b 100644
--- a/pkgs/servers/web-apps/whitebophir/node-packages-generated.nix
+++ b/pkgs/servers/web-apps/whitebophir/node-packages-generated.nix
@@ -1492,4 +1492,4 @@ in
     bypassCache = true;
     reconstructLock = true;
   };
-}
\ No newline at end of file
+}
diff --git a/pkgs/servers/zigbee2mqtt/node-packages.nix b/pkgs/servers/zigbee2mqtt/node-packages.nix
index 374b97bb509..a9da40e3fe4 100644
--- a/pkgs/servers/zigbee2mqtt/node-packages.nix
+++ b/pkgs/servers/zigbee2mqtt/node-packages.nix
@@ -10090,4 +10090,4 @@ in
   tarball = nodeEnv.buildNodeSourceDist args;
   package = nodeEnv.buildNodePackage args;
   shell = nodeEnv.buildNodeShell args;
-}
\ No newline at end of file
+}
diff --git a/pkgs/servers/zigbee2mqtt/node.nix b/pkgs/servers/zigbee2mqtt/node.nix
index 6080388b05e..2d0fadffa97 100644
--- a/pkgs/servers/zigbee2mqtt/node.nix
+++ b/pkgs/servers/zigbee2mqtt/node.nix
@@ -14,4 +14,4 @@ in
 import ./node-packages.nix {
   inherit (pkgs) fetchurl fetchgit;
   inherit nodeEnv;
-}
\ No newline at end of file
+}
diff --git a/pkgs/tools/X11/opentabletdriver/default.nix b/pkgs/tools/X11/opentabletdriver/default.nix
index dc527f47dd3..6955f36b8f1 100644
--- a/pkgs/tools/X11/opentabletdriver/default.nix
+++ b/pkgs/tools/X11/opentabletdriver/default.nix
@@ -23,18 +23,18 @@
 
 stdenv.mkDerivation rec {
   pname = "OpenTabletDriver";
-  version = "0.4.2";
+  version = "0.5.0";
 
   src = fetchFromGitHub {
     owner = "InfinityGhost";
     repo = "OpenTabletDriver";
     rev = "v${version}";
-    sha256 = "048y7gjlk2yw4vh62px1d9w0va6ap1a0cndcpbirlyj9q6b8jxax";
+    sha256 = "1xi97nn5zb4fs3pyyqznvxnz07j30j3p967s7jigjmlm9321vkqp";
   };
 
   debPkg = fetchurl {
     url = "https://github.com/InfinityGhost/OpenTabletDriver/releases/download/v${version}/OpenTabletDriver.deb";
-    sha256 = "13gg0dhvjy88h9lhcrp30fjiwgb9dzjsgk1k760pi1ki71a5vz2r";
+    sha256 = "06m2g5qvc02ga9f98f2ssa7wr2b7b2qm90qwaf17fz5z8rr0qmp0";
   };
 
   nativeBuildInputs = [
@@ -134,8 +134,8 @@ stdenv.mkDerivation rec {
     install -Dm644 $src/OpenTabletDriver.UX/Assets/otd.png -t $out/share/pixmaps
 
     # TODO: Ideally this should be build from OpenTabletDriver/OpenTabletDriver-udev instead
-    dpkg-deb --fsys-tarfile ${debPkg} | tar xf - ./usr/lib/udev/rules.d/30-opentabletdriver.rules
-    install -Dm644 ./usr/lib/udev/rules.d/30-opentabletdriver.rules -t $out/lib/udev/rules.d
+    dpkg-deb --fsys-tarfile ${debPkg} | tar xf - ./usr/lib/udev/rules.d/99-opentabletdriver.rules
+    install -Dm644 ./usr/lib/udev/rules.d/99-opentabletdriver.rules -t $out/lib/udev/rules.d
 
     runHook postInstall
   '';
@@ -155,8 +155,11 @@ stdenv.mkDerivation rec {
   dontWrapGApps = true;
   dontStrip = true;
 
-  passthru.tests = {
-    otd-runs = nixosTests.opentabletdriver;
+  passthru = {
+    updateScript = ./update.sh;
+    tests = {
+      otd-runs = nixosTests.opentabletdriver;
+    };
   };
 
   meta = with lib; {
diff --git a/pkgs/tools/X11/opentabletdriver/deps.nix b/pkgs/tools/X11/opentabletdriver/deps.nix
index 34d2981cff5..ccb7097153b 100644
--- a/pkgs/tools/X11/opentabletdriver/deps.nix
+++ b/pkgs/tools/X11/opentabletdriver/deps.nix
@@ -11,13 +11,13 @@
   })
   (fetchNuGet {
     name = "Eto.Forms";
-    version = "2.5.6";
-    sha256 = "035ny8jlanchwq16gcq0xb6ywabjl71c7qbpv26sjwg96na8vz51";
+    version = "2.5.10";
+    sha256 = "1d71wglk4ixfqfbm6sxmj753x5iwbar8i9zzjy3bh64fy1dn8lz7";
   })
   (fetchNuGet {
     name = "Eto.Platform.Gtk";
-    version = "2.5.6";
-    sha256 = "1ijkjd3lc7x59yk369kxipzgk1zhyr9g6k319wc0n033vij26mwl";
+    version = "2.5.10";
+    sha256 = "1pkqvlfx7bzracnw19bl50i9jg4ym376vihmy9qq7m5z5nfdqn4g";
   })
   (fetchNuGet {
     name = "GdkSharp";
@@ -41,8 +41,8 @@
   })
   (fetchNuGet {
     name = "HidSharpCore";
-    version = "1.1.0";
-    sha256 = "122s5j3wrv8hcgnbxrnjqydvcfz7gdm8xq0wlwzrgwdjk44lr45a";
+    version = "1.2.1";
+    sha256 = "0vcw38skr9g691gxbzv3cf6y9rk11vh5pvcyjshdgii2z1z8a4g2";
   })
   (fetchNuGet {
     name = "MessagePack.Annotations";
@@ -120,9 +120,9 @@
     sha256 = "0w2fbji1smd2y7x25qqibf1qrznmv4s6s0jvrbvr6alb7mfyqvh5";
   })
   (fetchNuGet {
-    name = "Newtonsoft.Json";
-    version = "12.0.3";
-    sha256 = "17dzl305d835mzign8r15vkmav2hq8l6g7942dfjpnzr17wwl89x";
+    name = "Octokit";
+    version = "0.48.0";
+    sha256 = "17ria1shx04rb6knbaswpqndmwam6v3r3lsfsd486q584798ccn8";
   })
   (fetchNuGet {
     name = "PangoSharp";
@@ -204,6 +204,11 @@
     version = "4.3.2";
     sha256 = "1x0g58pbpjrmj2x2qw17rdwwnrcl0wvim2hdwz48lixvwvp22n9c";
   })
+  (fetchNuGet {
+    name = "SharpZipLib";
+    version = "1.3.1";
+    sha256 = "09zypjfils38143da507s5fi4hzvdlz32wfav219hksnpl35y8x0";
+  })
   (fetchNuGet {
     name = "StreamJsonRpc";
     version = "2.6.121";
@@ -229,11 +234,6 @@
     version = "2.0.0-beta1.20253.1";
     sha256 = "16saf1fm9q80bb624fkqz0ksrwpnbw9617d7xg3jib7a2wgagm2r";
   })
-  (fetchNuGet {
-    name = "System.CommandLine";
-    version = "2.0.0-beta1.20303.1";
-    sha256 = "0isnz8ipqlqim06hf56zlaq2vnsy5facvf5nvq6kzm5h1dm3l2vn";
-  })
   (fetchNuGet {
     name = "System.ComponentModel.Annotations";
     version = "4.7.0";
@@ -319,11 +319,6 @@
     version = "4.3.0";
     sha256 = "1gfj800078kggcgl0xyl00a6y5k4wwh2k2qm69rjy22wbmq7fy4p";
   })
-  (fetchNuGet {
-    name = "System.Numerics.Vectors";
-    version = "4.5.0";
-    sha256 = "1kzrj37yzawf1b19jq0253rcs8hsq1l2q8g69d7ipnhzb0h97m59";
-  })
   (fetchNuGet {
     name = "System.Reflection.Emit.Lightweight";
     version = "4.6.0";
diff --git a/pkgs/tools/X11/opentabletdriver/update.sh b/pkgs/tools/X11/opentabletdriver/update.sh
index 04fae30c05a..715857cf8f4 100755
--- a/pkgs/tools/X11/opentabletdriver/update.sh
+++ b/pkgs/tools/X11/opentabletdriver/update.sh
@@ -14,6 +14,14 @@ if [[ "$new_version" == "$old_version" ]]; then
   [[ "${1}" != "--force" ]] && exit 0
 fi
 
+# Updating the hash of deb package manually since there seems to be no way to do it automatically
+oldDebPkgUrl="https://github.com/InfinityGhost/OpenTabletDriver/releases/download/v${old_version}/OpenTabletDriver.deb";
+newDebPkgUrl="https://github.com/InfinityGhost/OpenTabletDriver/releases/download/v${new_version}/OpenTabletDriver.deb";
+oldDebSha256=$(nix-prefetch-url "$oldDebPkgUrl")
+newDebSha256=$(nix-prefetch-url "$newDebPkgUrl")
+echo "oldDebSha256: $oldDebSha256 newDebSha256: $newDebSha256"
+sed -i ./default.nix -re "s|\"$oldDebSha256\"|\"$newDebSha256\"|"
+
 cd ../../../..
 update-source-version opentabletdriver "$new_version"
 store_src="$(nix-build . -A opentabletdriver.src --no-out-link)"
diff --git a/pkgs/tools/compression/zdelta/default.nix b/pkgs/tools/compression/zdelta/default.nix
index b3932ec3da8..46760c91306 100644
--- a/pkgs/tools/compression/zdelta/default.nix
+++ b/pkgs/tools/compression/zdelta/default.nix
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
   };
 
   meta = with lib; {
-	  homepage = "http://cis.poly.edu/zdelta";
+    homepage = "http://cis.poly.edu/zdelta";
     platforms = platforms.linux;
     license = licenses.zlib;
   };
diff --git a/pkgs/tools/graphics/ldgallery/viewer/node-composition.nix b/pkgs/tools/graphics/ldgallery/viewer/node-composition.nix
index f6c53f6c58d..55566aafc58 100644
--- a/pkgs/tools/graphics/ldgallery/viewer/node-composition.nix
+++ b/pkgs/tools/graphics/ldgallery/viewer/node-composition.nix
@@ -14,4 +14,4 @@ in
 import ./node-packages.nix {
   inherit (pkgs) fetchurl fetchgit;
   inherit nodeEnv;
-}
\ No newline at end of file
+}
diff --git a/pkgs/tools/graphics/ldgallery/viewer/node-packages.nix b/pkgs/tools/graphics/ldgallery/viewer/node-packages.nix
index 14691f64065..9946ce0e63c 100644
--- a/pkgs/tools/graphics/ldgallery/viewer/node-packages.nix
+++ b/pkgs/tools/graphics/ldgallery/viewer/node-packages.nix
@@ -13266,4 +13266,4 @@ in
   tarball = nodeEnv.buildNodeSourceDist args;
   package = nodeEnv.buildNodePackage args;
   shell = nodeEnv.buildNodeShell args;
-}
\ No newline at end of file
+}
diff --git a/pkgs/tools/graphics/pdfredacttools/default.nix b/pkgs/tools/graphics/pdfredacttools/default.nix
index 31a327331d7..71d927913c3 100644
--- a/pkgs/tools/graphics/pdfredacttools/default.nix
+++ b/pkgs/tools/graphics/pdfredacttools/default.nix
@@ -22,8 +22,8 @@ python2Packages.buildPythonApplication rec {
   meta = with lib; {
     description = "Redact and strip metadata from documents before publishing";
     longDescription = ''
-	PDF Redact Tools helps with securely redacting and stripping metadata
-	from documents before publishing. Note that this is not a security tool.
+        PDF Redact Tools helps with securely redacting and stripping metadata
+        from documents before publishing. Note that this is not a security tool.
         It uses ImageMagick to parse PDFs.  While ImageMagick is a versatile tool, it has
         a history of several security bugs. A malicious PDF could exploit a bug in
         ImageMagick to take over your computer. If you're working with potentially
diff --git a/pkgs/tools/misc/disfetch/default.nix b/pkgs/tools/misc/disfetch/default.nix
index 30d4d79488e..afce1429e69 100644
--- a/pkgs/tools/misc/disfetch/default.nix
+++ b/pkgs/tools/misc/disfetch/default.nix
@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   pname = "disfetch";
-  version = "1.13";
+  version = "1.14";
 
   src = fetchFromGitHub {
     owner = "llathasa-veleth";
     repo = "disfetch";
     rev = version;
-    sha256 = "14vccp1z0g2hr9alx2ydz29hfa4xfv9irdjsvqm94fbyi5fa87k0";
+    sha256 = "0p5pj8d761gz95ar35s8q6lrybrg9jik33kwnsxvb14n990kya0p";
   };
 
   dontBuild = true;
diff --git a/pkgs/tools/security/bitwarden/default.nix b/pkgs/tools/security/bitwarden/default.nix
index 9d700686b1c..8763c361d70 100644
--- a/pkgs/tools/security/bitwarden/default.nix
+++ b/pkgs/tools/security/bitwarden/default.nix
@@ -17,11 +17,11 @@ let
   pname = "bitwarden";
 
   version = {
-    x86_64-linux = "1.23.0";
+    x86_64-linux = "1.23.1";
   }.${system} or "";
 
   sha256 = {
-    x86_64-linux = "1z1r8327xymqf2h98wb2fb02s41pxc6fh5w4bxmdgpx7k1jx5kvg";
+    x86_64-linux = "1jv6w1g6b9c4xa5zy7pgzrkn8k4pyy3cdkh0nw2czn1cw2gaccs1";
   }.${system} or "";
 
   meta = with lib; {
diff --git a/pkgs/tools/security/chkrootkit/default.nix b/pkgs/tools/security/chkrootkit/default.nix
index 5753784542d..f9f0dd96a11 100644
--- a/pkgs/tools/security/chkrootkit/default.nix
+++ b/pkgs/tools/security/chkrootkit/default.nix
@@ -1,11 +1,11 @@
 { lib, stdenv, fetchurl }:
 
 stdenv.mkDerivation rec {
-  name = "chkrootkit-0.53";
+  name = "chkrootkit-0.54";
 
   src = fetchurl {
     url = "ftp://ftp.pangeia.com.br/pub/seg/pac/${name}.tar.gz";
-    sha256 = "1da5ry3p7jb6xs6xlfml1ly09q2rs5q6n5axif17d29k7gixlqkj";
+    sha256 = "sha256-FUySaSH1PbYHKKfLyXyohli2lMFLfSiO/jg+CEmRVgc=";
   };
 
   # TODO: a lazy work-around for linux build failure ...
diff --git a/pkgs/tools/security/sigurlx/default.nix b/pkgs/tools/security/sigurlx/default.nix
new file mode 100644
index 00000000000..b6908c27422
--- /dev/null
+++ b/pkgs/tools/security/sigurlx/default.nix
@@ -0,0 +1,25 @@
+{ buildGoModule
+, fetchFromGitHub
+, lib
+}:
+
+buildGoModule rec {
+  pname = "sigurlx";
+  version = "2.1.0";
+
+  src = fetchFromGitHub {
+    owner = "drsigned";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "1q5vy05387qx7h4xcccvn2z2ks1kiff3mfbd2w3w0l0a4qgz74xs";
+  };
+
+  vendorSha256 = "1bp6bf99rxlyg91pn1y228q18lawpykmvkl22cydmclms0q0n238";
+
+  meta = with lib; {
+    description = "Tool to map the attack surface of web applications";
+    homepage = "https://github.com/drsigned/sigurlx";
+    license = with licenses; [ mit ];
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/tools/system/monit/default.nix b/pkgs/tools/system/monit/default.nix
index 29536a59546..3460020618f 100644
--- a/pkgs/tools/system/monit/default.nix
+++ b/pkgs/tools/system/monit/default.nix
@@ -6,11 +6,11 @@
 }:
 
 stdenv.mkDerivation rec {
-  name = "monit-5.27.1";
+  name = "monit-5.27.2";
 
   src = fetchurl {
     url = "${meta.homepage}dist/${name}.tar.gz";
-    sha256 = "0lgdhif6x11fcpli0qn138rpdvrfnwmkzsy4lc9pas45c78hhx7m";
+    sha256 = "sha256-2ICceNXcHtenujKlpVxRFIVRMsxNpIBfjTqvjPRuqkw=";
   };
 
   nativeBuildInputs = [ bison flex ];
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index e2cd3cde339..5985483c4ed 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -11626,6 +11626,7 @@ in
   bingrep = callPackage ../development/tools/analysis/bingrep { };
 
   binutils-unwrapped = callPackage ../development/tools/misc/binutils {
+    autoreconfHook = if targetPlatform.isiOS then autoreconfHook269 else autoreconfHook;
     # FHS sys dirs presumably only have stuff for the build platform
     noSysDirs = (stdenv.targetPlatform != stdenv.hostPlatform) || noSysDirs;
   };
@@ -13183,6 +13184,8 @@ in
 
   cointop = callPackage ../applications/misc/cointop { };
 
+  cog = callPackage ../development/web/cog { };
+
   ctl = callPackage ../development/libraries/ctl { };
 
   ctpp2 = callPackage ../development/libraries/ctpp2 { };
@@ -15455,6 +15458,10 @@ in
 
   libixp_hg = callPackage ../development/libraries/libixp-hg { };
 
+  libwpe = callPackage ../development/libraries/libwpe { };
+
+  libwpe-fdo = callPackage ../development/libraries/libwpe/fdo.nix { };
+
   libyaml = callPackage ../development/libraries/libyaml { };
 
   libyamlcpp = callPackage ../development/libraries/libyaml-cpp { };
@@ -18231,6 +18238,8 @@ in
 
   sickrage = callPackage ../servers/sickbeard/sickrage.nix { };
 
+  sigurlx = callPackage ../tools/security/sigurlx { };
+
   sipwitch = callPackage ../servers/sip/sipwitch { };
 
   slimserver = callPackage ../servers/slimserver { };
@@ -27097,6 +27106,7 @@ in
 
   zeroadPackages = dontRecurseIntoAttrs (callPackage ../games/0ad {
     wxGTK = wxGTK30;
+    stdenv = gcc9Stdenv;
   });
 
   zeroad = zeroadPackages.zeroad;
@@ -29510,7 +29520,9 @@ in
 
   phonetisaurus = callPackage ../development/libraries/phonetisaurus {};
 
-  duti = callPackage ../os-specific/darwin/duti {};
+  duti = callPackage ../os-specific/darwin/duti {
+    inherit (darwin.apple_sdk.frameworks) ApplicationServices;
+  };
 
   dnstracer = callPackage ../tools/networking/dnstracer {
     inherit (darwin) libresolv;
diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index a9c0c79ba8b..8a5b9bd6ae5 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -19038,6 +19038,7 @@ let
       description = "lib/Safe/Hole.pm";
       license = with lib.licenses; [ artistic1 gpl1Plus ];
       homepage = "https://github.com/toddr/Safe-Hole";
+      broken = stdenv.isDarwin;
     };
   };