Merge remote-tracking branch 'origin/release-21.05' into staging-next-21.05

138 files changed, 1682 insertions, 2438 deletions

diff --git a/doc/contributing/coding-conventions.chapter.md b/doc/contributing/coding-conventions.chapter.md
index 6076460b893b..6516172adde9 100644
--- a/doc/contributing/coding-conventions.chapter.md
+++ b/doc/contributing/coding-conventions.chapter.md
@@ -526,6 +526,16 @@ If you do need to do create this sort of patch file, one way to do so is with gi
     $ git diff > nixpkgs/pkgs/the/package/0001-changes.patch
     ```
 
+If a patch is available online but does not cleanly apply, it can be modified in some fixed ways by using additional optional arguments for `fetchpatch`:
+
+- `stripLen`: Remove the first `stripLen` components of pathnames in the patch.
+- `extraPrefix`: Prefix pathnames by this string.
+- `excludes`: Exclude files matching this pattern.
+- `includes`: Include only files matching this pattern.
+- `revert`: Revert the patch.
+
+Note that because the checksum is computed after applying these effects, using or modifying these arguments will have no effect unless the `sha256` argument is changed as well.
+
 ## Package tests {#sec-package-tests}
 
 Tests are important to ensure quality and make reviews and automatic updates easy.
diff --git a/nixos/doc/manual/release-notes/rl-2105.xml b/nixos/doc/manual/release-notes/rl-2105.xml
index a5501533be7f..410d24327868 100644
--- a/nixos/doc/manual/release-notes/rl-2105.xml
+++ b/nixos/doc/manual/release-notes/rl-2105.xml
@@ -25,6 +25,7 @@
    </listitem>
    <listitem>
     <para>The default Linux kernel was updated to the 5.10 LTS series, coming from the 5.4 LTS series.</para>
+    <para>The <package>linux_latest</package> kernel was updated to the 5.12 series. It currently is not officially supported for use with the zfs filesystem. If you use zfs, you should use a different kernel version (either the LTS kernel, or track a specific one). </para>
    </listitem>
    <listitem>
     <para>GNOME desktop environment was upgraded to 40, see the release notes for <link xlink:href="https://help.gnome.org/misc/release-notes/40.0/">40.0</link> and <link xlink:href="https://help.gnome.org/misc/release-notes/3.38/">3.38</link>. The <code>gnome3</code> attribute set has been renamed to <code>gnome</code> and so have been the NixOS options.</para>
@@ -307,6 +308,24 @@
    </listitem>
    <listitem>
      <para>
+       The <literal>mediatomb</literal> service is
+       now using by default the new and maintained fork
+       <literal>gerbera</literal> package instead of the unmaintained
+       <literal>mediatomb</literal> package. If you want to keep the old
+       behavior, you must declare it with:
+       <programlisting>
+       services.mediatomb.package = pkgs.mediatomb;
+       </programlisting>
+       One new option <literal>openFirewall</literal> has been introduced which
+       defaults to false. If you relied on the service declaration to add the
+       firewall rules itself before, you should now declare it with:
+       <programlisting>
+       services.mediatomb.openFirewall = true;
+       </programlisting>
+     </para>
+   </listitem>
+   <listitem>
+     <para>
        xfsprogs was update from 4.19 to 5.11. It now enables reflink support by default on filesystem creation.
        Support for reflinks was added with an experimental status to kernel 4.9 and deemed stable in kernel 4.16.
        If you want to be able to mount XFS filesystems created with this release of xfsprogs on kernel releases older than those, you need to format them
@@ -427,7 +446,7 @@
     </para>
     <programlisting>
       TMPDIR=$(mktemp -d)
-      slaptest -f /path/to/slapd.conf $TMPDIR
+      slaptest -f /path/to/slapd.conf -F $TMPDIR
       slapcat -F $TMPDIR -n0 -H 'ldap:///???(!(objectClass=olcSchemaConfig))'
     </programlisting>
     <para>
@@ -836,6 +855,29 @@ environment.systemPackages = [
     </para>
    </listitem>
    <listitem>
+     <para>
+       The <literal>mediatomb</literal> service
+       declares new options. It also adapts existing options so the
+       configuration generation is now lazy. The existing option
+       <literal>customCfg</literal> (defaults to false), when enabled, stops
+       the service configuration generation completely. It then expects the
+       users to provide their own correct configuration at the right location
+       (whereas the configuration was generated and not used at all before).
+       The new option <literal>transcodingOption</literal> (defaults to no)
+       allows a generated configuration. It makes the mediatomb service pulls
+       the necessary runtime dependencies in the nix store (whereas it was
+       generated with hardcoded values before). The new option
+       <literal>mediaDirectories</literal> allows the users to declare autoscan
+       media directories from their nixos configuration:
+       <programlisting>
+       services.mediatomb.mediaDirectories = [
+         { path = "/var/lib/mediatomb/pictures"; recursive = false; hidden-files = false; }
+         { path = "/var/lib/mediatomb/audio"; recursive = true; hidden-files = false; }
+       ];
+       </programlisting>
+     </para>
+   </listitem>
+   <listitem>
     <para>
      The Unbound DNS resolver service (<literal>services.unbound</literal>) has been refactored to allow reloading, control sockets and to fix startup ordering issues.
     </para>
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index aa4e2ccc46bc..7a0a90f4bd20 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -472,7 +472,6 @@
   ./services/misc/cgminer.nix
   ./services/misc/confd.nix
   ./services/misc/couchpotato.nix
-  ./services/misc/dendrite.nix
   ./services/misc/devmon.nix
   ./services/misc/dictd.nix
   ./services/misc/duckling.nix
diff --git a/nixos/modules/services/misc/dendrite.nix b/nixos/modules/services/misc/dendrite.nix
deleted file mode 100644
index c967fc3a362a..000000000000
--- a/nixos/modules/services/misc/dendrite.nix
+++ /dev/null
@@ -1,181 +0,0 @@
-{ config, lib, pkgs, ... }:
-let
-  cfg = config.services.dendrite;
-  settingsFormat = pkgs.formats.yaml { };
-  configurationYaml = settingsFormat.generate "dendrite.yaml" cfg.settings;
-  workingDir = "/var/lib/dendrite";
-in
-{
-  options.services.dendrite = {
-    enable = lib.mkEnableOption "matrix.org dendrite";
-    httpPort = lib.mkOption {
-      type = lib.types.nullOr lib.types.port;
-      default = 8008;
-      description = ''
-        The port to listen for HTTP requests on.
-      '';
-    };
-    httpsPort = lib.mkOption {
-      type = lib.types.nullOr lib.types.port;
-      default = null;
-      description = ''
-        The port to listen for HTTPS requests on.
-      '';
-    };
-    tlsCert = lib.mkOption {
-      type = lib.types.nullOr lib.types.path;
-      example = "/var/lib/dendrite/server.cert";
-      default = null;
-      description = ''
-        The path to the TLS certificate.
-
-        <programlisting>
-          nix-shell -p dendrite --command "generate-keys --tls-cert server.crt --tls-key server.key"
-        </programlisting>
-      '';
-    };
-    tlsKey = lib.mkOption {
-      type = lib.types.nullOr lib.types.path;
-      example = "/var/lib/dendrite/server.key";
-      default = null;
-      description = ''
-        The path to the TLS key.
-
-        <programlisting>
-          nix-shell -p dendrite --command "generate-keys --tls-cert server.crt --tls-key server.key"
-        </programlisting>
-      '';
-    };
-    environmentFile = lib.mkOption {
-      type = lib.types.nullOr lib.types.path;
-      example = "/var/lib/dendrite/registration_secret";
-      default = null;
-      description = ''
-        Environment file as defined in <citerefentry>
-        <refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum>
-        </citerefentry>.
-        Secrets may be passed to the service without adding them to the world-readable
-        Nix store, by specifying placeholder variables as the option value in Nix and
-        setting these variables accordingly in the environment file. Currently only used
-        for the registration secret to allow secure registration when
-        client_api.registration_disabled is true.
-
-        <programlisting>
-          # snippet of dendrite-related config
-          services.dendrite.settings.client_api.registration_shared_secret = "$REGISTRATION_SHARED_SECRET";
-        </programlisting>
-
-        <programlisting>
-          # content of the environment file
-          REGISTRATION_SHARED_SECRET=verysecretpassword
-        </programlisting>
-
-        Note that this file needs to be available on the host on which
-        <literal>dendrite</literal> is running.
-      '';
-    };
-    settings = lib.mkOption {
-      type = lib.types.submodule {
-        freeformType = settingsFormat.type;
-        options.global = {
-          server_name = lib.mkOption {
-            type = lib.types.str;
-            example = "example.com";
-            description = ''
-              The domain name of the server, with optional explicit port.
-              This is used by remote servers to connect to this server.
-              This is also the last part of your UserID.
-            '';
-          };
-          private_key = lib.mkOption {
-            type = lib.types.path;
-            example = "${workingDir}/matrix_key.pem";
-            description = ''
-              The path to the signing private key file, used to sign
-              requests and events.
-
-              <programlisting>
-                nix-shell -p dendrite --command "generate-keys --private-key matrix_key.pem"
-              </programlisting>
-            '';
-          };
-          trusted_third_party_id_servers = lib.mkOption {
-            type = lib.types.listOf lib.types.str;
-            example = [ "matrix.org" ];
-            default = [ "matrix.org" "vector.im" ];
-            description = ''
-              Lists of domains that the server will trust as identity
-              servers to verify third party identifiers such as phone
-              numbers and email addresses
-            '';
-          };
-        };
-        options.client_api = {
-          registration_disabled = lib.mkOption {
-            type = lib.types.bool;
-            default = true;
-            description = ''
-              Whether to disable user registration to the server
-              without the shared secret.
-            '';
-          };
-        };
-      };
-      default = { };
-      description = ''
-        Configuration for dendrite, see:
-        <link xlink:href="https://github.com/matrix-org/dendrite/blob/master/dendrite-config.yaml"/>
-        for available options with which to populate settings.
-      '';
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    assertions = [{
-      assertion = cfg.httpsPort != null -> (cfg.tlsCert != null && cfg.tlsKey != null);
-      message = ''
-        If Dendrite is configured to use https, tlsCert and tlsKey must be provided.
-
-        nix-shell -p dendrite --command "generate-keys --tls-cert server.crt --tls-key server.key"
-      '';
-    }];
-
-    systemd.services.dendrite = {
-      description = "Dendrite Matrix homeserver";
-      after = [
-        "network.target"
-      ];
-      wantedBy = [ "multi-user.target" ];
-      serviceConfig = {
-        Type = "simple";
-        DynamicUser = true;
-        StateDirectory = "dendrite";
-        WorkingDirectory = workingDir;
-        RuntimeDirectory = "dendrite";
-        RuntimeDirectoryMode = "0700";
-        EnvironmentFile = lib.mkIf (cfg.environmentFile != null) cfg.environmentFile;
-        ExecStartPre =
-          if (cfg.environmentFile != null) then ''
-            ${pkgs.envsubst}/bin/envsubst \
-              -i ${configurationYaml} \
-              -o /run/dendrite/dendrite.yaml
-          '' else ''
-            ${pkgs.coreutils}/bin/cp ${configurationYaml} /run/dendrite/dendrite.yaml
-          '';
-        ExecStart = lib.strings.concatStringsSep " " ([
-          "${pkgs.dendrite}/bin/dendrite-monolith-server"
-          "--config /run/dendrite/dendrite.yaml"
-        ] ++ lib.optionals (cfg.httpPort != null) [
-          "--http-bind-address :${builtins.toString cfg.httpPort}"
-        ] ++ lib.optionals (cfg.httpsPort != null) [
-          "--https-bind-address :${builtins.toString cfg.httpsPort}"
-          "--tls-cert ${cfg.tlsCert}"
-          "--tls-key ${cfg.tlsKey}"
-        ]);
-        ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
-        Restart = "on-failure";
-      };
-    };
-  };
-  meta.maintainers = lib.teams.matrix.members;
-}
diff --git a/nixos/modules/services/networking/kresd.nix b/nixos/modules/services/networking/kresd.nix
index 9b94c390e985..6882a315f616 100644
--- a/nixos/modules/services/networking/kresd.nix
+++ b/nixos/modules/services/networking/kresd.nix
@@ -115,6 +115,8 @@ in {
   config = mkIf cfg.enable {
     environment.etc."knot-resolver/kresd.conf".source = configFile; # not required
 
+    networking.resolvconf.useLocalResolver = mkDefault true;
+
     users.users.knot-resolver =
       { isSystemUser = true;
         group = "knot-resolver";
diff --git a/nixos/modules/services/networking/wireguard.nix b/nixos/modules/services/networking/wireguard.nix
index 043bce16e542..455f1861e622 100644
--- a/nixos/modules/services/networking/wireguard.nix
+++ b/nixos/modules/services/networking/wireguard.nix
@@ -219,17 +219,6 @@ let
 
   };
 
-  generatePathUnit = name: values:
-    assert (values.privateKey == null);
-    assert (values.privateKeyFile != null);
-    nameValuePair "wireguard-${name}"
-      {
-        description = "WireGuard Tunnel - ${name} - Private Key";
-        requiredBy = [ "wireguard-${name}.service" ];
-        before = [ "wireguard-${name}.service" ];
-        pathConfig.PathExists = values.privateKeyFile;
-      };
-
   generateKeyServiceUnit = name: values:
     assert values.generatePrivateKeyFile;
     nameValuePair "wireguard-${name}-key"
@@ -448,9 +437,6 @@ in
       // (mapAttrs' generateKeyServiceUnit
       (filterAttrs (name: value: value.generatePrivateKeyFile) cfg.interfaces));
 
-    systemd.paths = mapAttrs' generatePathUnit
-      (filterAttrs (name: value: value.privateKeyFile != null) cfg.interfaces);
-
   });
 
 }
diff --git a/nixos/modules/services/security/bitwarden_rs/default.nix b/nixos/modules/services/security/bitwarden_rs/default.nix
index a04bc883bf0f..bed59dbf821f 100644
--- a/nixos/modules/services/security/bitwarden_rs/default.nix
+++ b/nixos/modules/services/security/bitwarden_rs/default.nix
@@ -121,7 +121,6 @@ in {
         EnvironmentFile = [ configFile ] ++ optional (cfg.environmentFile != null) cfg.environmentFile;
         ExecStart = "${bitwarden_rs}/bin/bitwarden_rs";
         LimitNOFILE = "1048576";
-        LimitNPROC = "64";
         PrivateTmp = "true";
         PrivateDevices = "true";
         ProtectHome = "true";
diff --git a/nixos/modules/services/web-apps/discourse.nix b/nixos/modules/services/web-apps/discourse.nix
index 0e2e182ffe93..49958fc6190c 100644
--- a/nixos/modules/services/web-apps/discourse.nix
+++ b/nixos/modules/services/web-apps/discourse.nix
@@ -5,11 +5,16 @@ let
 
   cfg = config.services.discourse;
 
+  # Keep in sync with https://github.com/discourse/discourse_docker/blob/master/image/base/Dockerfile#L5
+  upstreamPostgresqlVersion = lib.getVersion pkgs.postgresql_13;
+
   postgresqlPackage = if config.services.postgresql.enable then
                         config.services.postgresql.package
                       else
                         pkgs.postgresql;
 
+  postgresqlVersion = lib.getVersion postgresqlPackage;
+
   # We only want to create a database if we're actually going to connect to it.
   databaseActuallyCreateLocally = cfg.database.createLocally && cfg.database.host == null;
 
@@ -263,6 +268,17 @@ in
             Discourse database user.
           '';
         };
+
+        ignorePostgresqlVersion = lib.mkOption {
+          type = lib.types.bool;
+          default = false;
+          description = ''
+            Whether to allow other versions of PostgreSQL than the
+            recommended one. Only effective when
+            <option>services.discourse.database.createLocally</option>
+            is enabled.
+          '';
+        };
       };
 
       redis = {
@@ -398,6 +414,14 @@ in
               How OpenSSL checks the certificate, see http://api.rubyonrails.org/classes/ActionMailer/Base.html
             '';
           };
+
+          forceTLS = lib.mkOption {
+            type = lib.types.bool;
+            default = false;
+            description = ''
+              Force implicit TLS as per RFC 8314 3.3.
+            '';
+          };
         };
 
         incoming = {
@@ -497,6 +521,12 @@ in
         assertion = cfg.hostname != "";
         message = "Could not automatically determine hostname, set service.discourse.hostname manually.";
       }
+      {
+        assertion = cfg.database.ignorePostgresqlVersion || (databaseActuallyCreateLocally -> upstreamPostgresqlVersion == postgresqlVersion);
+        message = "The PostgreSQL version recommended for use with Discourse is ${upstreamPostgresqlVersion}, you're using ${postgresqlVersion}. "
+                  + "Either update your PostgreSQL package to the correct version or set services.discourse.database.ignorePostgresqlVersion. "
+                  + "See https://nixos.org/manual/nixos/stable/index.html#module-postgresql for details on how to upgrade PostgreSQL.";
+      }
     ];
 
 
@@ -530,6 +560,7 @@ in
       smtp_authentication = cfg.mail.outgoing.authentication;
       smtp_enable_start_tls = cfg.mail.outgoing.enableStartTLSAuto;
       smtp_openssl_verify_mode = cfg.mail.outgoing.opensslVerifyMode;
+      smtp_force_tls = cfg.mail.outgoing.forceTLS;
 
       load_mini_profiler = true;
       mini_profiler_snapshots_period = 0;
@@ -542,8 +573,8 @@ in
 
       redis_host = cfg.redis.host;
       redis_port = 6379;
-      redis_slave_host = null;
-      redis_slave_port = 6379;
+      redis_replica_host = null;
+      redis_replica_port = 6379;
       redis_db = cfg.redis.dbNumber;
       redis_password = cfg.redis.passwordFile;
       redis_skip_client_commands = false;
@@ -552,8 +583,8 @@ in
       message_bus_redis_enabled = false;
       message_bus_redis_host = "localhost";
       message_bus_redis_port = 6379;
-      message_bus_redis_slave_host = null;
-      message_bus_redis_slave_port = 6379;
+      message_bus_redis_replica_host = null;
+      message_bus_redis_replica_port = 6379;
       message_bus_redis_db = 0;
       message_bus_redis_password = null;
       message_bus_redis_skip_client_commands = false;
@@ -606,6 +637,7 @@ in
       allowed_theme_repos = null;
       enable_email_sync_demon = false;
       max_digests_enqueued_per_30_mins_per_site = 10000;
+      cluster_name = null;
     };
 
     services.redis.enable = lib.mkDefault (cfg.redis.host == "localhost");
@@ -667,6 +699,7 @@ in
       environment = cfg.package.runtimeEnv // {
         UNICORN_TIMEOUT = builtins.toString cfg.unicornTimeout;
         UNICORN_SIDEKIQS = builtins.toString cfg.sidekiqProcesses;
+        MALLOC_ARENA_MAX = "2";
       };
 
       preStart =
diff --git a/nixos/modules/services/web-apps/wordpress.nix b/nixos/modules/services/web-apps/wordpress.nix
index f251cfe32db6..775ecb3acaf0 100644
--- a/nixos/modules/services/web-apps/wordpress.nix
+++ b/nixos/modules/services/web-apps/wordpress.nix
@@ -61,8 +61,10 @@ let
     ?>
   '';
 
-  secretsVars = [ "AUTH_KEY" "SECURE_AUTH_KEY" "LOOGGED_IN_KEY" "NONCE_KEY" "AUTH_SALT" "SECURE_AUTH_SALT" "LOGGED_IN_SALT" "NONCE_SALT" ];
+  secretsVars = [ "AUTH_KEY" "SECURE_AUTH_KEY" "LOGGED_IN_KEY" "NONCE_KEY" "AUTH_SALT" "SECURE_AUTH_SALT" "LOGGED_IN_SALT" "NONCE_SALT" ];
   secretsScript = hostStateDir: ''
+    # The match in this line is not a typo, see https://github.com/NixOS/nixpkgs/pull/124839
+    grep -q "LOOGGED_IN_KEY" "${hostStateDir}/secret-keys.php" && rm "${hostStateDir}/secret-keys.php"
     if ! test -e "${hostStateDir}/secret-keys.php"; then
       umask 0177
       echo "<?php" >> "${hostStateDir}/secret-keys.php"
diff --git a/nixos/modules/virtualisation/libvirtd.nix b/nixos/modules/virtualisation/libvirtd.nix
index f43c44f5dcab..303f672b822f 100644
--- a/nixos/modules/virtualisation/libvirtd.nix
+++ b/nixos/modules/virtualisation/libvirtd.nix
@@ -159,7 +159,7 @@ in {
       etc."qemu/bridge.conf".text = lib.concatMapStringsSep "\n" (e:
         "allow ${e}") cfg.allowedBridges;
       systemPackages = with pkgs; [ libressl.nc iptables cfg.package cfg.qemuPackage ];
-      etc.ethertypes.source = "${pkgs.iptables}/etc/ethertypes";
+      etc.ethertypes.source = "${pkgs.ebtables}/etc/ethertypes";
     };
 
     boot.kernelModules = [ "tun" ];
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 99393e5b1842..e3f92ce451ce 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -53,7 +53,7 @@ in
   caddy = handleTest ./caddy.nix {};
   cadvisor = handleTestOn ["x86_64-linux"] ./cadvisor.nix {};
   cage = handleTestOn ["x86_64-linux"] ./cage.nix {};
-  cagebreak = handleTest ./cagebreak.nix {};
+  cagebreak = handleTestOn ["x86_64-linux"] ./cagebreak.nix {};
   calibre-web = handleTest ./calibre-web.nix {};
   cassandra_2_1 = handleTest ./cassandra.nix { testPackage = pkgs.cassandra_2_1; };
   cassandra_2_2 = handleTest ./cassandra.nix { testPackage = pkgs.cassandra_2_2; };
@@ -93,7 +93,6 @@ in
   custom-ca = handleTest ./custom-ca.nix {};
   croc = handleTest ./croc.nix {};
   deluge = handleTest ./deluge.nix {};
-  dendrite = handleTest ./dendrite.nix {};
   dhparams = handleTest ./dhparams.nix {};
   discourse = handleTest ./discourse.nix {};
   dnscrypt-proxy2 = handleTestOn ["x86_64-linux"] ./dnscrypt-proxy2.nix {};
@@ -395,7 +394,7 @@ in
   sssd-ldap = handleTestOn ["x86_64-linux"] ./sssd-ldap.nix {};
   strongswan-swanctl = handleTest ./strongswan-swanctl.nix {};
   sudo = handleTest ./sudo.nix {};
-  sway = handleTest ./sway.nix {};
+  sway = handleTestOn ["x86_64-linux"] ./sway.nix {};
   switchTest = handleTest ./switch-test.nix {};
   sympa = handleTest ./sympa.nix {};
   syncthing = handleTest ./syncthing.nix {};
diff --git a/nixos/tests/dendrite.nix b/nixos/tests/dendrite.nix
deleted file mode 100644
index a444c9b20018..000000000000
--- a/nixos/tests/dendrite.nix
+++ /dev/null
@@ -1,99 +0,0 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-    let
-      homeserverUrl = "http://homeserver:8008";
-
-      private_key = pkgs.runCommand "matrix_key.pem" {
-        buildInputs = [ pkgs.dendrite ];
-      } "generate-keys --private-key $out";
-    in
-      {
-        name = "dendrite";
-        meta = with pkgs.lib; {
-          maintainers = teams.matrix.members;
-        };
-
-        nodes = {
-          homeserver = { pkgs, ... }: {
-            services.dendrite = {
-              enable = true;
-              settings = {
-                global.server_name = "test-dendrite-server.com";
-                global.private_key = private_key;
-                client_api.registration_disabled = false;
-              };
-            };
-
-            networking.firewall.allowedTCPPorts = [ 8008 ];
-          };
-
-          client = { pkgs, ... }: {
-            environment.systemPackages = [
-              (
-                pkgs.writers.writePython3Bin "do_test"
-                  { libraries = [ pkgs.python3Packages.matrix-nio ]; } ''
-                  import asyncio
-
-                  from nio import AsyncClient
-
-
-                  async def main() -> None:
-                      # Connect to dendrite
-                      client = AsyncClient("http://homeserver:8008", "alice")
-
-                      # Register as user alice
-                      response = await client.register("alice", "my-secret-password")
-
-                      # Log in as user alice
-                      response = await client.login("my-secret-password")
-
-                      # Create a new room
-                      response = await client.room_create(federate=False)
-                      room_id = response.room_id
-
-                      # Join the room
-                      response = await client.join(room_id)
-
-                      # Send a message to the room
-                      response = await client.room_send(
-                          room_id=room_id,
-                          message_type="m.room.message",
-                          content={
-                              "msgtype": "m.text",
-                              "body": "Hello world!"
-                          }
-                      )
-
-                      # Sync responses
-                      response = await client.sync(timeout=30000)
-
-                      # Check the message was received by dendrite
-                      last_message = response.rooms.join[room_id].timeline.events[-1].body
-                      assert last_message == "Hello world!"
-
-                      # Leave the room
-                      response = await client.room_leave(room_id)
-
-                      # Close the client
-                      await client.close()
-
-                  asyncio.get_event_loop().run_until_complete(main())
-                ''
-              )
-            ];
-          };
-        };
-
-        testScript = ''
-          start_all()
-
-          with subtest("start the homeserver"):
-              homeserver.wait_for_unit("dendrite.service")
-              homeserver.wait_for_open_port(8008)
-
-          with subtest("ensure messages can be exchanged"):
-              client.succeed("do_test")
-        '';
-
-      }
-)
diff --git a/nixos/tests/discourse.nix b/nixos/tests/discourse.nix
index 3c965550fe0a..2ed6fb957c20 100644
--- a/nixos/tests/discourse.nix
+++ b/nixos/tests/discourse.nix
@@ -51,6 +51,8 @@ import ./make-test-python.nix (
 
         environment.systemPackages = [ pkgs.jq ];
 
+        services.postgresql.package = pkgs.postgresql_13;
+
         services.discourse = {
           enable = true;
           inherit admin;
diff --git a/pkgs/applications/audio/bjumblr/default.nix b/pkgs/applications/audio/bjumblr/default.nix
index 104c795c11e7..608839fc16ac 100644
--- a/pkgs/applications/audio/bjumblr/default.nix
+++ b/pkgs/applications/audio/bjumblr/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "BJumblr";
-  version = "1.4.2";
+  version = "1.6.6";
 
   src = fetchFromGitHub {
     owner = "sjaehn";
     repo = pname;
     rev = version;
-    sha256 = "0kl6hrxmqrdf0195bfnzsa2h1073fgiqrfhg2276fm1954sm994v";
+    sha256 = "1nbxi54023vck3qgmr385cjzinmdnvz62ywb6bcksmc3shl080mg";
   };
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/applications/audio/goattracker/default.nix b/pkgs/applications/audio/goattracker/default.nix
index 30bb4099233c..743417570c16 100644
--- a/pkgs/applications/audio/goattracker/default.nix
+++ b/pkgs/applications/audio/goattracker/default.nix
@@ -27,16 +27,16 @@ let
 in stdenv.mkDerivation rec {
   inherit pname;
   version = if isStereo
-    then "2.76"  # stereo
-    else "2.75"; # normal
+    then "2.77"  # stereo
+    else "2.76"; # normal
 
   src = fetchurl {
     url = "mirror://sourceforge/goattracker2/GoatTracker_${version}${optionalString isStereo "_Stereo"}.zip";
     sha256 = if isStereo
-      then "12cz3780x5k047jqdv69n6rjgbfiwv67z850kfl4i37lxja432l7"  # stereo
-      else "1km97nl7qvk6qc5l5j69wncbm76hf86j47sgzgr968423g0bxxlk"; # normal
+      then "1hiig2d152sv9kazwz33i56x1c54h5sh21ipkqnp6qlnwj8x1ksy"  # stereo
+      else "0d7a3han4jw4bwiba3j87racswaajgl3pj4sb5lawdqdxicv3dn1"; # normal
   };
-  sourceRoot = (if isStereo then "gt2stereo/trunk" else "goattrk2") + "/src";
+  sourceRoot = "src";
 
   nativeBuildInputs = [ copyDesktopItems unzip imagemagick ];
   buildInputs = [ SDL ];
diff --git a/pkgs/applications/audio/gxplugins-lv2/default.nix b/pkgs/applications/audio/gxplugins-lv2/default.nix
index d71d40f401c4..5e8747f76566 100644
--- a/pkgs/applications/audio/gxplugins-lv2/default.nix
+++ b/pkgs/applications/audio/gxplugins-lv2/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "GxPlugins.lv2";
-  version = "0.8";
+  version = "0.9";
 
   src = fetchFromGitHub {
     owner = "brummer10";
     repo = pname;
     rev = "v${version}";
-    sha256 = "11iv7bwvvspm74pisqvcpsxpg9xi6b08hq4i8q67mri4mvy9hmal";
+    sha256 = "02fksl8wr443ygwgcd1c2zab8kp67a6ps12k71ysqx7szv4zq877";
     fetchSubmodules = true;
   };
 
@@ -29,6 +29,6 @@ stdenv.mkDerivation rec {
     homepage = "https://github.com/brummer10/GxPlugins.lv2";
     description = "A set of extra lv2 plugins from the guitarix project";
     maintainers = [ maintainers.magnetophon ];
-    license = licenses.gpl3;
+    license = licenses.gpl3Plus;
   };
 }
diff --git a/pkgs/applications/audio/schismtracker/default.nix b/pkgs/applications/audio/schismtracker/default.nix
index 3b5708529e06..797d2c1d7337 100644
--- a/pkgs/applications/audio/schismtracker/default.nix
+++ b/pkgs/applications/audio/schismtracker/default.nix
@@ -13,7 +13,8 @@ stdenv.mkDerivation rec {
     sha256 = "1n6cgjiw3vkv7a1h1nki5syyjxjb6icknr9s049w2jrag10bxssn";
   };
 
-  configureFlags = [ "--enable-dependency-tracking" ];
+  configureFlags = [ "--enable-dependency-tracking" ]
+    ++ lib.optional stdenv.isDarwin "--disable-sdltest";
 
   nativeBuildInputs = [ autoreconfHook python ];
 
diff --git a/pkgs/applications/audio/whipper/default.nix b/pkgs/applications/audio/whipper/default.nix
index b63680a8f488..a295788c117b 100644
--- a/pkgs/applications/audio/whipper/default.nix
+++ b/pkgs/applications/audio/whipper/default.nix
@@ -1,7 +1,17 @@
-{ lib, fetchFromGitHub, python3, cdparanoia, cdrdao, flac
-, sox, accuraterip-checksum, libsndfile, util-linux, substituteAll }:
+{ lib
+, python3
+, fetchFromGitHub
+, libcdio-paranoia
+, cdrdao
+, libsndfile
+, flac
+, sox
+, util-linux
+}:
 
-python3.pkgs.buildPythonApplication rec {
+let
+  bins = [ libcdio-paranoia cdrdao flac sox util-linux ];
+in python3.pkgs.buildPythonApplication rec {
   pname = "whipper";
   version = "0.10.0";
 
@@ -12,44 +22,43 @@ python3.pkgs.buildPythonApplication rec {
     sha256 = "00cq03cy5dyghmibsdsq5sdqv3bzkzhshsng74bpnb5lasxp3ia5";
   };
 
-  pythonPath = with python3.pkgs; [
+  nativeBuildInputs = with python3.pkgs; [
+    setuptools_scm
+    docutils
+  ];
+
+  propagatedBuildInputs = with python3.pkgs; [
     musicbrainzngs
     mutagen
     pycdio
     pygobject3
-    requests
     ruamel_yaml
-    setuptools
-    setuptools_scm
+    discid
+    pillow
   ];
 
   buildInputs = [ libsndfile ];
 
   checkInputs = with python3.pkgs; [
     twisted
-  ];
-
-  patches = [
-    (substituteAll {
-      src = ./paths.patch;
-      inherit cdparanoia;
-    })
-  ];
+  ] ++ bins;
 
   makeWrapperArgs = [
-    "--prefix" "PATH" ":" (lib.makeBinPath [ accuraterip-checksum cdrdao util-linux flac sox ])
+    "--prefix" "PATH" ":" (lib.makeBinPath bins)
   ];
 
   preBuild = ''
     export SETUPTOOLS_SCM_PRETEND_VERSION="${version}"
   '';
 
-  # some tests require internet access
-  # https://github.com/JoeLametta/whipper/issues/291
-  doCheck = false;
-
-  preCheck = ''
-    HOME=$TMPDIR
+  checkPhase = ''
+    runHook preCheck
+    # disable tests that require internet access
+    # https://github.com/JoeLametta/whipper/issues/291
+    substituteInPlace whipper/test/test_common_accurip.py \
+      --replace "test_AccurateRipResponse" "dont_test_AccurateRipResponse"
+    HOME=$TMPDIR ${python3.interpreter} -m unittest discover
+    runHook postCheck
   '';
 
   meta = with lib; {
diff --git a/pkgs/applications/audio/whipper/paths.patch b/pkgs/applications/audio/whipper/paths.patch
deleted file mode 100644
index 14b5384330da..000000000000
--- a/pkgs/applications/audio/whipper/paths.patch
+++ /dev/null
@@ -1,32 +0,0 @@
---- a/whipper/program/cdparanoia.py
-+++ b/whipper/program/cdparanoia.py
-@@ -280,10 +280,10 @@
- 
-         bufsize = 1024
-         if self._overread:
--            argv = ["cd-paranoia", "--stderr-progress",
-+            argv = ["@cdparanoia@/bin/cdparanoia", "--stderr-progress",
-                     "--sample-offset=%d" % self._offset, "--force-overread", ]
-         else:
--            argv = ["cd-paranoia", "--stderr-progress",
-+            argv = ["@cdparanoia@/bin/cdparanoia", "--stderr-progress",
-                     "--sample-offset=%d" % self._offset, ]
-         if self._device:
-             argv.extend(["--force-cdrom-device", self._device, ])
-@@ -560,7 +560,7 @@
- 
- def getCdParanoiaVersion():
-     getter = common.VersionGetter('cd-paranoia',
--                                  ["cd-paranoia", "-V"],
-+                                  ["@cdparanoia@/bin/cdparanoia", "-V"],
-                                   _VERSION_RE,
-                                   "%(version)s %(release)s")
- 
-@@ -585,7 +585,7 @@
-     def __init__(self, device=None):
-         # cdparanoia -A *always* writes cdparanoia.log
-         self.cwd = tempfile.mkdtemp(suffix='.whipper.cache')
--        self.command = ['cd-paranoia', '-A']
-+        self.command = ['@cdparanoia@/bin/cdparanoia', '-A']
-         if device:
-             self.command += ['-d', device]
diff --git a/pkgs/applications/backup/pika-backup/default.nix b/pkgs/applications/backup/pika-backup/default.nix
index 63f197dd9c84..fd6c0f0cf835 100644
--- a/pkgs/applications/backup/pika-backup/default.nix
+++ b/pkgs/applications/backup/pika-backup/default.nix
@@ -19,20 +19,20 @@
 
 stdenv.mkDerivation rec {
   pname = "pika-backup";
-  version = "0.3.1";
+  version = "0.3.2";
 
   src = fetchFromGitLab {
     domain = "gitlab.gnome.org";
     owner = "World";
     repo = "pika-backup";
     rev = "v${version}";
-    sha256 = "0cr3axfp15nzwmsqyz6j781qhr2gsn9p69m0jfzy89pl83d6vcz0";
+    sha256 = "sha256-dKVyvB4s1MZHri0dFJDBUXQKsi2KgP30ZhsJ486M+og=";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src;
     name = "${pname}-${version}";
-    sha256 = "1z0cbrkhxyzwf7vjjsvdppb7zhflpkw4m5cy90a2315nbll3hpbp";
+    sha256 = "1vsh8vqgmfady82d7wfxkknmrp7mq7nizpif2zwg3kqbl964mp3y";
   };
 
   patches = [
diff --git a/pkgs/applications/blockchains/stellar-core-dirty-version.patch b/pkgs/applications/blockchains/stellar-core-dirty-version.patch
deleted file mode 100644
index 57d66ce5919a..000000000000
--- a/pkgs/applications/blockchains/stellar-core-dirty-version.patch
+++ /dev/null
@@ -1,15 +0,0 @@
-Subject: Prevent "-dirty" from being erroneously added to the version
-
-diff --git a/src/Makefile.am b/src/Makefile.am
-index d36d1a3..00048fc 100644
---- a/src/Makefile.am
-+++ b/src/Makefile.am
-@@ -28,7 +28,7 @@ always:
- # Always rebuild because .git/HEAD is a symbolic ref one can't depend on
- StellarCoreVersion.h: always
- 	@vers=$$(cd "$(srcdir)" \
--		&& git describe --always --dirty --tags 2>/dev/null \
-+		&& git describe --always --tags 2>/dev/null \
- 		|| echo "$(PACKAGE) $(VERSION)"); \
- 	    echo "#define STELLAR_CORE_VERSION \"$$vers\"" > $@~
- 	@if cmp -s $@~ $@; then rm -f $@~; else \
diff --git a/pkgs/applications/blockchains/stellar-core.nix b/pkgs/applications/blockchains/stellar-core.nix
index ceb48bf6aa4d..197453599b28 100644
--- a/pkgs/applications/blockchains/stellar-core.nix
+++ b/pkgs/applications/blockchains/stellar-core.nix
@@ -1,31 +1,30 @@
-{ lib, stdenv, fetchgit, autoconf, libtool, automake, pkg-config, git
-, bison, flex, postgresql }:
+{ lib, stdenv, fetchFromGitHub, autoconf, libtool, automake, pkg-config, git
+, bison, flex, postgresql, ripgrep }:
 
-let
+stdenv.mkDerivation rec {
   pname = "stellar-core";
-  version = "0.5.1";
+  version = "17.0.0";
 
-in stdenv.mkDerivation {
-  name = "${pname}-${version}";
-
-  src = fetchgit {
-    url = "https://github.com/stellar/stellar-core.git";
-    rev = "refs/tags/v${version}";
-    sha256 = "0ldw3qr0sajgam38z2w2iym0214ial6iahbzx3b965cw92n8n88z";
+  src = fetchFromGitHub {
+    owner = "stellar";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "1ngl8yjqb8xzhdwzlxzzxf14q2hgwy2ysb17sn5380rrn0jswin1";
     fetchSubmodules = true;
-    leaveDotGit = true;
   };
 
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ autoconf automake libtool git ];
+  nativeBuildInputs = [ automake autoconf git libtool pkg-config ripgrep ];
 
   propagatedBuildInputs = [ bison flex postgresql ];
 
-  patches = [ ./stellar-core-dirty-version.patch ];
-
   preConfigure = ''
+    # Due to https://github.com/NixOS/nixpkgs/issues/8567 we cannot rely on
+    # having the .git directory present, so directly provide the version
+    substituteInPlace src/Makefile.am --replace '$$vers' '${pname} ${version}';
+
     # Everything needs to be staged in git because the build uses
     # `git ls-files` to search for source files to compile.
+    git init
     git add .
 
     ./autogen.sh
diff --git a/pkgs/applications/misc/tellico/default.nix b/pkgs/applications/misc/tellico/default.nix
index 65cd003253dc..10d8dc026141 100644
--- a/pkgs/applications/misc/tellico/default.nix
+++ b/pkgs/applications/misc/tellico/default.nix
@@ -24,15 +24,15 @@
 
 mkDerivation rec {
   pname = "tellico";
-  version = "3.4";
+  version = "3.4.1";
 
   src = fetchurl {
-    # version 3.3.0 just uses 3.3 in its name
+    # version 3.3.0 just uses 3.3 in its file name
     urls = [
       "https://tellico-project.org/files/tellico-${version}.tar.xz"
       "https://tellico-project.org/files/tellico-${lib.versions.majorMinor version}.tar.xz"
     ];
-    sha256 = "sha256-YXMJrAkfehe3ox4WZ19igyFbXwtjO5wxN3bmgP01jPs=";
+    sha256 = "sha256-+FFN6sO0mvlage8JazyrqNZk4onejz1XJPiOK3gnhWE=";
   };
 
   nativeBuildInputs = [
@@ -63,7 +63,7 @@ mkDerivation rec {
   meta = with lib; {
     description = "Collection management software, free and simple";
     homepage = "https://tellico-project.org/";
-    license = with licenses; [ gpl2 gpl3 ];
+    license = with licenses; [ gpl2Only gpl3Only lgpl2Only ];
     maintainers = with maintainers; [ numkem ];
     platforms = platforms.linux;
   };
diff --git a/pkgs/applications/networking/browsers/chromium/common.nix b/pkgs/applications/networking/browsers/chromium/common.nix
index 2cf3556e7ea3..7e95da747d1e 100644
--- a/pkgs/applications/networking/browsers/chromium/common.nix
+++ b/pkgs/applications/networking/browsers/chromium/common.nix
@@ -165,14 +165,10 @@ let
       ./patches/widevine-79.patch # For bundling Widevine (DRM), might be replaceable via bundle_widevine_cdm=true in gnFlags
       # Fix the build by adding a missing dependency (s. https://crbug.com/1197837):
       ./patches/fix-missing-atspi2-dependency.patch
-    ] ++ optionals (chromiumVersionAtLeast "91") [
       ./patches/closure_compiler-Use-the-Java-binary-from-the-system.patch
     ];
 
-    postPatch = lib.optionalString (chromiumVersionAtLeast "91") ''
-      # Required for patchShebangs (unsupported):
-      chmod -x third_party/webgpu-cts/src/tools/deno
-    '' + ''
+    postPatch = ''
       # remove unused third-party
       for lib in ${toString gnSystemLibraries}; do
         if [ -d "third_party/$lib" ]; then
@@ -191,6 +187,7 @@ let
         substituteInPlace third_party/harfbuzz-ng/src/src/update-unicode-tables.make \
           --replace "/usr/bin/env -S make -f" "/usr/bin/make -f"
       fi
+      chmod -x third_party/webgpu-cts/src/tools/deno
 
       # We want to be able to specify where the sandbox is via CHROME_DEVEL_SANDBOX
       substituteInPlace sandbox/linux/suid/client/setuid_sandbox_host.cc \
diff --git a/pkgs/applications/networking/browsers/chromium/upstream-info.json b/pkgs/applications/networking/browsers/chromium/upstream-info.json
index af288536fb7d..ab0afd9b54eb 100644
--- a/pkgs/applications/networking/browsers/chromium/upstream-info.json
+++ b/pkgs/applications/networking/browsers/chromium/upstream-info.json
@@ -44,19 +44,19 @@
     }
   },
   "ungoogled-chromium": {
-    "version": "90.0.4430.212",
-    "sha256": "17nmhrkl81qqvzbh861k2mmifncx4wg1mv1fmn52f8gzn461vqdb",
-    "sha256bin64": "1y33c5829s22yfj0qmsj8fpcxnjhcm3fsxz7744csfsa9cy4fjr7",
+    "version": "91.0.4472.77",
+    "sha256": "0c8vj3gq3nmb7ssiwj6875g0a8hcprss1a4gqw9h7llqywza9ma5",
+    "sha256bin64": "0caf47xam5igdnbhipal1iyicnxxvadhi61k199rwysrvyv5sdad",
     "deps": {
       "gn": {
-        "version": "2021-02-09",
+        "version": "2021-04-06",
         "url": "https://gn.googlesource.com/gn",
-        "rev": "dfcbc6fed0a8352696f92d67ccad54048ad182b3",
-        "sha256": "1941bzg37c4dpsk3sh6ga3696gpq6vjzpcw9rsnf6kdr9mcgdxvn"
+        "rev": "dba01723a441c358d843a575cb7720d54ddcdf92",
+        "sha256": "199xkks67qrn0xa5fhp24waq2vk8qb78a96cb3kdd8v1hgacgb8x"
       },
       "ungoogled-patches": {
-        "rev": "90.0.4430.212-1",
-        "sha256": "05jh05a4g50ws7pr18dl5pwi95knygh6xywp7kyydir7wy1pbin8"
+        "rev": "91.0.4472.77-1",
+        "sha256": "1jfmmkw1y4rcjfgsm7b4v2lrgd3sks5qpajvq0djflbhkpsqxfk0"
       }
     }
   }
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index 994b212d9df6..a3d8a98b77f5 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -440,10 +440,10 @@
     "owner": "DeterminateSystems",
     "provider-source-address": "registry.terraform.io/DeterminateSystems/hydra",
     "repo": "terraform-provider-hydra",
-    "rev": "v0.1.1",
-    "sha256": "093al7crxgjimy4nnxvb1xy9p7yc0c7gf2rgvql7y3y3n8bz5q1b",
+    "rev": "v0.1.2",
+    "sha256": "1a1ah5pzng9ik8f18kqx87fdh1c5wqbn2bsbhqrzd1nb8fc5xl03",
     "vendorSha256": null,
-    "version": "0.1.1"
+    "version": "0.1.2"
   },
   "ibm": {
     "owner": "IBM-Cloud",
diff --git a/pkgs/applications/networking/cluster/tilt/default.nix b/pkgs/applications/networking/cluster/tilt/default.nix
index ccbe9d9a7ac0..d717bd42652b 100644
--- a/pkgs/applications/networking/cluster/tilt/default.nix
+++ b/pkgs/applications/networking/cluster/tilt/default.nix
@@ -5,13 +5,13 @@ buildGoModule rec {
   /* Do not use "dev" as a version. If you do, Tilt will consider itself
     running in development environment and try to serve assets from the
     source tree, which is not there once build completes.  */
-  version = "0.18.10";
+  version = "0.20.5";
 
   src = fetchFromGitHub {
     owner  = "tilt-dev";
     repo   = pname;
     rev    = "v${version}";
-    sha256 = "sha256-SvvvHGR3UPyV61MaoFB68SaZKUT3ItYOPT1a7AddxlY=";
+    sha256 = "sha256-pUKKHrShED7yp5WSmHSbS+eiYs22Nm2/ouc2a8WYc38=";
   };
   vendorSha256 = null;
 
diff --git a/pkgs/applications/networking/feedreaders/newsflash/default.nix b/pkgs/applications/networking/feedreaders/newsflash/default.nix
index ee85bd8024ea..f93b8ed50b75 100644
--- a/pkgs/applications/networking/feedreaders/newsflash/default.nix
+++ b/pkgs/applications/networking/feedreaders/newsflash/default.nix
@@ -35,6 +35,12 @@ stdenv.mkDerivation rec {
     hash = "sha256-qq8cZplt5YWUwsXUShMDhQm3RGH2kCEBk64x6bOa50E=";
   };
 
+  # https://github.com/CasualX/obfstr/blob/v0.2.4/build.rs#L5
+  # obfstr 0.2.4 fails to set RUSTC_BOOTSTRAP in its build script because cargo
+  # build scripts are forbidden from setting RUSTC_BOOTSTRAP since rustc 1.52.0
+  # https://github.com/rust-lang/rust/blob/1.52.0/RELEASES.md#compatibility-notes
+  RUSTC_BOOTSTRAP = 1;
+
   patches = [
     # Post install tries to generate an icon cache & update the
     # desktop database. The gtk setup hook drop-icon-theme-cache.sh
diff --git a/pkgs/applications/networking/instant-messengers/element/element-desktop.nix b/pkgs/applications/networking/instant-messengers/element/element-desktop.nix
index 8487b1d180f6..6642d4ca0249 100644
--- a/pkgs/applications/networking/instant-messengers/element/element-desktop.nix
+++ b/pkgs/applications/networking/instant-messengers/element/element-desktop.nix
@@ -45,8 +45,7 @@ in mkYarnPackage rec {
 
     # executable wrapper
     makeWrapper '${electron}/bin/electron' "$out/bin/${executableName}" \
-      --add-flags "$out/share/element/electron" \
-      --set-default MOZ_DBUS_REMOTE 1
+      --add-flags "$out/share/element/electron"
   '';
 
   # Do not attempt generating a tarball for element-web again.
diff --git a/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix b/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
index ac035335b240..0f0e5f062dca 100644
--- a/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
@@ -25,7 +25,7 @@ let
       else "");
 in stdenv.mkDerivation rec {
   pname = "signal-desktop";
-  version = "5.2.1"; # Please backport all updates to the stable channel.
+  version = "5.3.0"; # Please backport all updates to the stable channel.
   # All releases have a limited lifetime and "expire" 90 days after the release.
   # When releases "expire" the application becomes unusable until an update is
   # applied. The expiration date for the current release can be extracted with:
@@ -35,7 +35,7 @@ in stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://updates.signal.org/desktop/apt/pool/main/s/signal-desktop/signal-desktop_${version}_amd64.deb";
-    sha256 = "0hkl8h49565kncvczv5fv4gak55lycygwb8i8igkgc4my0ykzs2z";
+    sha256 = "15lclxw3njih90zlh2n90v8ljg0wnglw5w8jrpa7rbd789yagvq7";
   };
 
   nativeBuildInputs = [
@@ -134,7 +134,7 @@ in stdenv.mkDerivation rec {
       --replace /opt/Signal/signal-desktop $out/bin/signal-desktop
 
     autoPatchelf --no-recurse -- $out/lib/Signal/
-    patchelf --add-needed ${libpulseaudio}/lib/libpulse.so $out/lib/Signal/resources/app.asar.unpacked/node_modules/ringrtc/build/linux/libringrtc.node
+    patchelf --add-needed ${libpulseaudio}/lib/libpulse.so $out/lib/Signal/resources/app.asar.unpacked/node_modules/ringrtc/build/linux/libringrtc-x64.node
   '';
 
   # Tests if the application launches and waits for "Link your phone to Signal Desktop":
diff --git a/pkgs/applications/networking/irc/catgirl/default.nix b/pkgs/applications/networking/irc/catgirl/default.nix
index afc308039de1..d2e8e93d8534 100644
--- a/pkgs/applications/networking/irc/catgirl/default.nix
+++ b/pkgs/applications/networking/irc/catgirl/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "catgirl";
-  version = "1.7";
+  version = "1.8";
 
   src = fetchurl {
     url = "https://git.causal.agency/catgirl/snapshot/${pname}-${version}.tar.gz";
-    sha256 = "sha256-3shSdeq4l6Y5DEJZEVMHAngp6vjnkPjzpLpcp407X/0=";
+    sha256 = "0svpd2nqsr55ac98vczyhihs6pvgw7chspf6bdlwl98gch39dxif";
   };
 
   nativeBuildInputs = [ ctags pkg-config ];
diff --git a/pkgs/applications/networking/irc/weechat/scripts/wee-slack/0001-hardcode-json-file-path.patch b/pkgs/applications/networking/irc/weechat/scripts/wee-slack/0001-hardcode-json-file-path.patch
deleted file mode 100644
index 45e620db258d..000000000000
--- a/pkgs/applications/networking/irc/weechat/scripts/wee-slack/0001-hardcode-json-file-path.patch
+++ /dev/null
@@ -1,35 +0,0 @@
-From 5dd2593369645b11a9dc03e1930617d2f5dbd039 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
-Date: Wed, 11 Nov 2020 11:48:49 +0100
-Subject: [PATCH] hardcode json file path
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Signed-off-by: Jörg Thalheim <joerg@thalheim.io>
----
- wee_slack.py | 8 +-------
- 1 file changed, 1 insertion(+), 7 deletions(-)
-
-diff --git a/wee_slack.py b/wee_slack.py
-index a3d779c..5942289 100644
---- a/wee_slack.py
-+++ b/wee_slack.py
-@@ -5136,13 +5136,7 @@ def create_slack_debug_buffer():
- 
- def load_emoji():
-     try:
--        weechat_dir = w.info_get('weechat_dir', '')
--        weechat_sharedir = w.info_get('weechat_sharedir', '')
--        local_weemoji, global_weemoji = ('{}/weemoji.json'.format(path)
--                for path in (weechat_dir, weechat_sharedir))
--        path = (global_weemoji if os.path.exists(global_weemoji) and
--                not os.path.exists(local_weemoji) else local_weemoji)
--        with open(path, 'r') as ef:
-+        with open('@out@/share/wee-slack/weemoji.json', 'r') as ef:
-             emojis = json.loads(ef.read())
-             if 'emoji' in emojis:
-                 print_error('The weemoji.json file is in an old format. Please update it.')
--- 
-2.29.0
-
diff --git a/pkgs/applications/networking/irc/weechat/scripts/wee-slack/default.nix b/pkgs/applications/networking/irc/weechat/scripts/wee-slack/default.nix
index 679e278c8a09..698ee80edf60 100644
--- a/pkgs/applications/networking/irc/weechat/scripts/wee-slack/default.nix
+++ b/pkgs/applications/networking/irc/weechat/scripts/wee-slack/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "wee-slack";
-  version = "2.7.0";
+  version = "2.8.0";
 
   src = fetchFromGitHub {
     repo = "wee-slack";
     owner = "wee-slack";
     rev = "v${version}";
-    sha256 = "sha256-6Z/H15bKe0PKpNe9PCgc5mLOii3CILCAVon7EgzIkx8=";
+    sha256 = "0xfklr0gsc9jgxfyrrb2j756lclz9g8imcb0pk0xgyj8mhsw23zk";
   };
 
   patches = [
@@ -16,10 +16,13 @@ stdenv.mkDerivation rec {
       src = ./libpath.patch;
       env = "${buildEnv {
         name = "wee-slack-env";
-        paths = with python3Packages; [ websocket_client six ];
+        paths = with python3Packages; [
+          websocket_client
+          six
+        ];
       }}/${python3Packages.python.sitePackages}";
     })
-    ./0001-hardcode-json-file-path.patch
+    ./load_weemoji_path.patch
   ];
 
   postPatch = ''
diff --git a/pkgs/applications/networking/irc/weechat/scripts/wee-slack/libpath.patch b/pkgs/applications/networking/irc/weechat/scripts/wee-slack/libpath.patch
index af2dd36b41c5..a6e38c16fb14 100644
--- a/pkgs/applications/networking/irc/weechat/scripts/wee-slack/libpath.patch
+++ b/pkgs/applications/networking/irc/weechat/scripts/wee-slack/libpath.patch
@@ -1,13 +1,13 @@
 diff --git a/wee_slack.py b/wee_slack.py
-index dbe6446..d1b7546 100644
+index e4716b4..f673b7c 100644
 --- a/wee_slack.py
 +++ b/wee_slack.py
-@@ -25,6 +25,8 @@ import random
- import socket
- import string
+@@ -31,6 +31,8 @@ import string
+ # See https://github.com/numpy/numpy/issues/11925
+ sys.modules["numpy"] = None
  
 +sys.path.append('@env@')
 +
- from websocket import ABNF, create_connection, WebSocketConnectionClosedException
- 
- try:
+ from websocket import (  # noqa: E402
+     ABNF,
+     create_connection,
diff --git a/pkgs/applications/networking/irc/weechat/scripts/wee-slack/load_weemoji_path.patch b/pkgs/applications/networking/irc/weechat/scripts/wee-slack/load_weemoji_path.patch
new file mode 100644
index 000000000000..1e97dc32fa65
--- /dev/null
+++ b/pkgs/applications/networking/irc/weechat/scripts/wee-slack/load_weemoji_path.patch
@@ -0,0 +1,25 @@
+diff --git a/wee_slack.py b/wee_slack.py
+index e4716b4..ffd122d 100644
+--- a/wee_slack.py
++++ b/wee_slack.py
+@@ -6092,19 +6092,7 @@ def create_slack_debug_buffer():
+ 
+ def load_emoji():
+     try:
+-        weechat_dir = w.info_get("weechat_data_dir", "") or w.info_get(
+-            "weechat_dir", ""
+-        )
+-        weechat_sharedir = w.info_get("weechat_sharedir", "")
+-        local_weemoji, global_weemoji = (
+-            "{}/weemoji.json".format(path) for path in (weechat_dir, weechat_sharedir)
+-        )
+-        path = (
+-            global_weemoji
+-            if os.path.exists(global_weemoji) and not os.path.exists(local_weemoji)
+-            else local_weemoji
+-        )
+-        with open(path, "r") as ef:
++        with open("@out@/share/wee-slack/weemoji.json", "r") as ef:
+             emojis = json.loads(ef.read())
+             if "emoji" in emojis:
+                 print_error(
diff --git a/pkgs/applications/networking/mailreaders/mblaze/default.nix b/pkgs/applications/networking/mailreaders/mblaze/default.nix
index 278561e0e5f4..f24ed3a51df6 100644
--- a/pkgs/applications/networking/mailreaders/mblaze/default.nix
+++ b/pkgs/applications/networking/mailreaders/mblaze/default.nix
@@ -1,10 +1,12 @@
-{ stdenv, lib, fetchFromGitHub, installShellFiles, libiconv, ruby ? null }:
+{ coreutils, fetchFromGitHub, fetchpatch, file, gawk, gnugrep, gnused
+, installShellFiles, less, lib, libiconv, makeWrapper, nano, stdenv, ruby
+}:
 
 stdenv.mkDerivation rec {
   pname = "mblaze";
   version = "1.1";
 
-  nativeBuildInputs = [ installShellFiles ];
+  nativeBuildInputs = [ installShellFiles makeWrapper ];
   buildInputs = [ ruby ] ++ lib.optionals stdenv.isDarwin [ libiconv ];
 
   src = fetchFromGitHub {
@@ -22,6 +24,24 @@ stdenv.mkDerivation rec {
     installShellCompletion contrib/_mblaze
   '' + lib.optionalString (ruby != null) ''
     install -Dt $out/bin contrib/msuck contrib/mblow
+
+    # The following wrappings are used to preserve the executable
+    # names (the value of $0 in a script). The script mcom is
+    # designed to be run directly or via symlinks such as mrep. Using
+    # symlinks changes the value of $0 in the script, and makes it
+    # behave differently. When using the wrapProgram tool, the resulting
+    # wrapper breaks this behaviour. The following wrappers preserve it.
+
+    mkdir -p $out/wrapped
+    for x in mcom mbnc mfwd mrep; do
+      mv $out/bin/$x $out/wrapped
+      makeWrapper $out/wrapped/$x $out/bin/$x \
+        --argv0 $out/bin/$x \
+        --prefix PATH : $out/bin \
+        --prefix PATH : ${lib.makeBinPath [
+          coreutils file gawk gnugrep gnused
+        ]}
+    done
   '';
 
   meta = with lib; {
diff --git a/pkgs/applications/networking/mailreaders/neomutt/default.nix b/pkgs/applications/networking/mailreaders/neomutt/default.nix
index b2187371f299..50b3b66f15dc 100644
--- a/pkgs/applications/networking/mailreaders/neomutt/default.nix
+++ b/pkgs/applications/networking/mailreaders/neomutt/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, gettext, makeWrapper, tcl, which
+{ lib, stdenv, fetchFromGitHub, gettext, makeWrapper, tcl, which, fetchpatch
 , ncurses, perl , cyrus_sasl, gss, gpgme, libkrb5, libidn, libxml2, notmuch, openssl
 , lmdb, libxslt, docbook_xsl, docbook_xml_dtd_42, w3m, mailcap, sqlite, zlib
 }:
@@ -14,6 +14,14 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-ADg/+gmndOiuQHsncOzS5K4chthXeUFz6RRJsrZNeZY=";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "CVE-2021-32055.patch";
+      url = "https://github.com/neomutt/neomutt/commit/fa1db5785e5cfd9d3cd27b7571b9fe268d2ec2dc.patch";
+      sha256 = "0bb7gisjynq3w7hhl6vxa469h609bcz6fkdi8vf740pqrwhk68yn";
+    })
+  ];
+
   buildInputs = [
     cyrus_sasl gss gpgme libkrb5 libidn ncurses
     notmuch openssl perl lmdb
diff --git a/pkgs/applications/office/libreoffice/src-still/download.nix b/pkgs/applications/office/libreoffice/src-still/download.nix
index d956a3b08a61..19dee4e1f136 100644
--- a/pkgs/applications/office/libreoffice/src-still/download.nix
+++ b/pkgs/applications/office/libreoffice/src-still/download.nix
@@ -721,25 +721,25 @@
     md5name = "505e70834d35383537b6491e7ae8641f1a4bed1876dbfe361201fc80868d88ca-libpng-1.6.37.tar.xz";
   }
   {
-    name = "poppler-0.82.0.tar.xz";
-    url = "https://dev-www.libreoffice.org/src/poppler-0.82.0.tar.xz";
-    sha256 = "234f8e573ea57fb6a008e7c1e56bfae1af5d1adf0e65f47555e1ae103874e4df";
+    name = "poppler-21.01.0.tar.xz";
+    url = "https://dev-www.libreoffice.org/src/poppler-21.01.0.tar.xz";
+    sha256 = "016dde34e5f868ea98a32ca99b643325a9682281500942b7113f4ec88d20e2f3";
     md5 = "";
-    md5name = "234f8e573ea57fb6a008e7c1e56bfae1af5d1adf0e65f47555e1ae103874e4df-poppler-0.82.0.tar.xz";
+    md5name = "016dde34e5f868ea98a32ca99b643325a9682281500942b7113f4ec88d20e2f3-poppler-21.01.0.tar.xz";
   }
   {
-    name = "postgresql-9.2.24.tar.bz2";
-    url = "https://dev-www.libreoffice.org/src/postgresql-9.2.24.tar.bz2";
-    sha256 = "a754c02f7051c2f21e52f8669a421b50485afcde9a581674d6106326b189d126";
+    name = "postgresql-13.1.tar.bz2";
+    url = "https://dev-www.libreoffice.org/src/postgresql-13.1.tar.bz2";
+    sha256 = "12345c83b89aa29808568977f5200d6da00f88a035517f925293355432ffe61f";
     md5 = "";
-    md5name = "a754c02f7051c2f21e52f8669a421b50485afcde9a581674d6106326b189d126-postgresql-9.2.24.tar.bz2";
+    md5name = "12345c83b89aa29808568977f5200d6da00f88a035517f925293355432ffe61f-postgresql-13.1.tar.bz2";
   }
   {
-    name = "Python-3.7.7.tar.xz";
-    url = "https://dev-www.libreoffice.org/src/Python-3.7.7.tar.xz";
-    sha256 = "06a0a9f1bf0d8cd1e4121194d666c4e28ddae4dd54346de6c343206599f02136";
+    name = "Python-3.7.10.tar.xz";
+    url = "https://dev-www.libreoffice.org/src/Python-3.7.10.tar.xz";
+    sha256 = "f8d82e7572c86ec9d55c8627aae5040124fd2203af400c383c821b980306ee6b";
     md5 = "";
-    md5name = "06a0a9f1bf0d8cd1e4121194d666c4e28ddae4dd54346de6c343206599f02136-Python-3.7.7.tar.xz";
+    md5name = "f8d82e7572c86ec9d55c8627aae5040124fd2203af400c383c821b980306ee6b-Python-3.7.10.tar.xz";
   }
   {
     name = "QR-Code-generator-1.4.0.tar.gz";
diff --git a/pkgs/applications/office/libreoffice/src-still/primary.nix b/pkgs/applications/office/libreoffice/src-still/primary.nix
index c9b182647114..d42f31bff3f9 100644
--- a/pkgs/applications/office/libreoffice/src-still/primary.nix
+++ b/pkgs/applications/office/libreoffice/src-still/primary.nix
@@ -8,7 +8,7 @@ rec {
 
   major = "7";
   minor = "0";
-  patch = "4";
+  patch = "6";
   tweak = "2";
 
   subdir = "${major}.${minor}.${patch}";
@@ -17,13 +17,13 @@ rec {
 
   src = fetchurl {
     url = "https://download.documentfoundation.org/libreoffice/src/${subdir}/libreoffice-${version}.tar.xz";
-    sha256 = "1g9akxvm7fh6lnprnc3g184qdy8gbinhb4rb60gjpw82ip6d5acz";
+    sha256 = "0bk1dc6g8z5akrprfxxy3dm0vdmihaaxnsprxpqbqmqrqzkzg8cn";
   };
 
   # FIXME rename
   translations = fetchSrc {
     name = "translations";
-    sha256 = "1v3kpk56fm783d5wihx41jqidpclizkfxrg4n0pq95d79hdiljsl";
+    sha256 = "04f76r311hppil656ajab52x0xwqszazlgssyi5w97wak2zkmqgj";
   };
 
   # the "dictionaries" archive is not used for LO build because we already build hunspellDicts packages from
@@ -31,6 +31,6 @@ rec {
 
   help = fetchSrc {
     name = "help";
-    sha256 = "1np9f799ww12kggl5az6piv5fi9rf737il5a5r47r4wl2li56qqb";
+    sha256 = "1xmvlj9nrmg8448k4zfaxn5qqxa4amnvvhs1l1smi2bz3xh4xn2d";
   };
 }
diff --git a/pkgs/applications/office/paperwork/paperwork-gtk.nix b/pkgs/applications/office/paperwork/paperwork-gtk.nix
index e61968391913..8f1278d99266 100644
--- a/pkgs/applications/office/paperwork/paperwork-gtk.nix
+++ b/pkgs/applications/office/paperwork/paperwork-gtk.nix
@@ -13,10 +13,24 @@
 , gettext
 , gobject-introspection
 , gdk-pixbuf
+, texlive
+, imagemagick
+, perlPackages
 }:
 
+let
+  documentation_deps = [
+    (texlive.combine {
+      inherit (texlive) scheme-small wrapfig was;
+    })
+    xvfb-run
+    imagemagick
+    perlPackages.Po4a
+  ];
+in
+
 python3Packages.buildPythonApplication rec {
-  inherit (import ./src.nix { inherit fetchFromGitLab; }) version src;
+  inherit (import ./src.nix { inherit fetchFromGitLab; }) version src sample_documents;
   pname = "paperwork";
 
   sourceRoot = "source/paperwork-gtk";
@@ -52,9 +66,16 @@ python3Packages.buildPythonApplication rec {
     for i in $site/data/paperwork_*.png; do
       ln -s $i $site/icon/out;
     done
+
+    export XDG_DATA_DIRS=$XDG_DATA_DIRS:${gnome.adwaita-icon-theme}/share
+    # build the user manual
+    PATH=$out/bin:$PATH PAPERWORK_TEST_DOCUMENTS=${sample_documents} make data
+    for i in src/paperwork_gtk/model/help/out/*.pdf; do
+      install -Dt $site/model/help/out $i
+    done
   '';
 
-  checkInputs = [ xvfb-run dbus.daemon ];
+  checkInputs = [ dbus.daemon ];
 
   nativeBuildInputs = [
     wrapGAppsHook
@@ -62,7 +83,7 @@ python3Packages.buildPythonApplication rec {
     (lib.getBin gettext)
     which
     gdk-pixbuf # for the setup hook
-  ];
+  ] ++ documentation_deps;
 
   buildInputs = [
     gnome.adwaita-icon-theme
@@ -78,13 +99,20 @@ python3Packages.buildPythonApplication rec {
     makeWrapperArgs+=("''${gappsWrapperArgs[@]}")
   '';
 
-  # A few parts of chkdeps need to have a display and a dbus session, so we not
-  # only need to run a virtual X server + dbus but also have a large enough
-  # resolution, because the Cairo test tries to draw a 200x200 window.
-  preCheck = ''
+  checkPhase = ''
+    runHook preCheck
+
+    # A few parts of chkdeps need to have a display and a dbus session, so we not
+    # only need to run a virtual X server + dbus but also have a large enough
+    # resolution, because the Cairo test tries to draw a 200x200 window.
     xvfb-run -s '-screen 0 800x600x24' dbus-run-session \
       --config-file=${dbus.daemon}/share/dbus-1/session.conf \
       $out/bin/paperwork-gtk chkdeps
+
+    # content of make test, without the dep on make install
+    python -m unittest discover --verbose -s tests
+
+    runHook postCheck
   '';
 
   propagatedBuildInputs = with python3Packages; [
@@ -98,6 +126,8 @@ python3Packages.buildPythonApplication rec {
     setuptools
   ];
 
+  disallowedRequisites = documentation_deps;
+
   meta = {
     description = "A personal document manager for scanned documents";
     homepage = "https://openpaper.work/";
diff --git a/pkgs/applications/office/paperwork/src.nix b/pkgs/applications/office/paperwork/src.nix
index 45c05cc4962e..72293ef3903f 100644
--- a/pkgs/applications/office/paperwork/src.nix
+++ b/pkgs/applications/office/paperwork/src.nix
@@ -1,12 +1,22 @@
 {fetchFromGitLab}:
 rec {
-  version = "2.0.2";
+  version = "2.0.3";
   src = fetchFromGitLab {
     domain = "gitlab.gnome.org";
     repo = "paperwork";
     group = "World";
     owner = "OpenPaperwork";
     rev = version;
-    sha256 = "1di7nnl8ywyiwfpl5m1kvip1m0hvijbmqmkdpviwqw7ajizrr1ly";
+    sha256 = "02c2ysca75j59v87n1axqfncvs167kmdr40m0f05asdh2akwrbi9";
   };
+  sample_documents = fetchFromGitLab {
+    domain = "gitlab.gnome.org";
+    repo = "paperwork-test-documents";
+    group = "World";
+    owner = "OpenPaperwork";
+    # https://gitlab.gnome.org/World/OpenPaperwork/paperwork/-/blob/master/paperwork-gtk/src/paperwork_gtk/model/help/screenshot.sh see TEST_DOCS_TAG
+    rev = "1.0";
+    sha256 = "155nhw2jmlgfi6c3wm241vrr3yma6lw85k9lxn844z96kyi7wbpr";
+  };
+
 }
diff --git a/pkgs/applications/office/softmaker/softmaker_office.nix b/pkgs/applications/office/softmaker/softmaker_office.nix
index 9228037e8bf8..68f92c74a87c 100644
--- a/pkgs/applications/office/softmaker/softmaker_office.nix
+++ b/pkgs/applications/office/softmaker/softmaker_office.nix
@@ -6,9 +6,9 @@
   # Softmaker Office or when the upstream archive was replaced and
   # nixpkgs is not in sync yet.
 , officeVersion ? {
-  version = "1030";
+  version = "1032";
   edition = "2021";
-  hash = "sha256-bpnyPyZnJc9RFVrFM2o3M7Gc4PSKFGpaM1Yo8ZKGHrE=";
+  hash = "sha256-LchSqLVBdkmWJQ8hCEvtwRPgIUSDE0URKPzCkEexGbc=";
 }
 
 , ... } @ args:
diff --git a/pkgs/applications/radio/welle-io/default.nix b/pkgs/applications/radio/welle-io/default.nix
index 97bf84a2bf39..cfd339c2d1ea 100644
--- a/pkgs/applications/radio/welle-io/default.nix
+++ b/pkgs/applications/radio/welle-io/default.nix
@@ -1,20 +1,17 @@
 { mkDerivation, lib, fetchFromGitHub, cmake, pkg-config
 , qtbase, qtcharts, qtmultimedia, qtquickcontrols, qtquickcontrols2, qtgraphicaleffects
-, faad2, rtl-sdr, soapysdr-with-plugins, libusb-compat-0_1, fftwSinglePrec, lame, mpg123 }:
-let
-
-  version = "2.2";
-
-in mkDerivation {
+, faad2, rtl-sdr, soapysdr-with-plugins, libusb-compat-0_1, fftwSinglePrec, lame, mpg123
+} :
 
+mkDerivation rec {
   pname = "welle-io";
-  inherit version;
+  version = "2.3";
 
   src = fetchFromGitHub {
     owner = "AlbrechtL";
     repo = "welle.io";
     rev = "v${version}";
-    sha256 = "04fpm6sc431dl9i5h53xpd6k85j22sv8aawl7b6wv2fzpfsd9fwa";
+    sha256 = "1xl1lanw0xgmgks67dbfb2h52jxnrd1i2zik56v0q8dwsr7f0daw";
   };
 
   nativeBuildInputs = [ cmake pkg-config ];
diff --git a/pkgs/applications/science/logic/lean/default.nix b/pkgs/applications/science/logic/lean/default.nix
index aa7fe5ab9147..214f4e218fd3 100644
--- a/pkgs/applications/science/logic/lean/default.nix
+++ b/pkgs/applications/science/logic/lean/default.nix
@@ -7,7 +7,11 @@ stdenv.mkDerivation rec {
   src = fetchFromGitHub {
     owner  = "leanprover-community";
     repo   = "lean";
-    rev    = "v${version}";
+    # lean's version string contains the commit sha1 it was built
+    # from. this is then used to check whether an olean file should be
+    # rebuilt. don't use a tag as rev because this will get replaced into
+    # src/githash.h.in in preConfigure.
+    rev    = "a5822ea47ebc52eec6323d8f1b60f6ec025daf99";
     sha256 = "sha256-gJhbkl19iilNyfCt2TfPmghYA3yCjg6kS+yk/x/k14Y=";
   };
 
@@ -20,6 +24,13 @@ stdenv.mkDerivation rec {
   # library.
   doCheck = true;
 
+  preConfigure = assert builtins.stringLength src.rev == 40; ''
+     substituteInPlace src/githash.h.in \
+       --subst-var-by GIT_SHA1 "${src.rev}"
+     substituteInPlace library/init/version.lean.in \
+       --subst-var-by GIT_SHA1 "${src.rev}"
+  '';
+
   postPatch = "patchShebangs .";
 
   postInstall = lib.optionalString stdenv.isDarwin ''
diff --git a/pkgs/applications/science/math/sage/sagedoc.nix b/pkgs/applications/science/math/sage/sagedoc.nix
index f4a8bf19b69c..d53947d806d1 100644
--- a/pkgs/applications/science/math/sage/sagedoc.nix
+++ b/pkgs/applications/science/math/sage/sagedoc.nix
@@ -76,7 +76,7 @@ stdenv.mkDerivation rec {
     mv html/en/_static{,.tmp}
     for _dir in `find -name _static` ; do
           rm -r $_dir
-          ln -s html/en/_static $_dir
+          ln -rs html/en/_static $_dir
     done
     mv html/en/_static{.tmp,}
   '';
diff --git a/pkgs/applications/science/physics/xfitter/default.nix b/pkgs/applications/science/physics/xfitter/default.nix
index 4390826ccee0..230f2f0e0efb 100644
--- a/pkgs/applications/science/physics/xfitter/default.nix
+++ b/pkgs/applications/science/physics/xfitter/default.nix
@@ -16,9 +16,6 @@ stdenv.mkDerivation rec {
     ./undefined_behavior.patch
   ];
 
-  # patch needs to updated due to version bump
-  #CXXFLAGS = "-Werror=return-type";
-
   preConfigure =
   # Fix F77LD to workaround for a following build error:
   #
@@ -48,8 +45,6 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  hardeningDisable = [ "format" ];
-
   NIX_CFLAGS_COMPILE = lib.optional (stdenv.hostPlatform.libc == "glibc") "-I${libtirpc.dev}/include/tirpc";
   NIX_LDFLAGS = lib.optional (stdenv.hostPlatform.libc == "glibc") "-ltirpc";
 
diff --git a/pkgs/applications/version-management/git-and-tools/delta/default.nix b/pkgs/applications/version-management/git-and-tools/delta/default.nix
index c6a92413949b..f642a7d9afb3 100644
--- a/pkgs/applications/version-management/git-and-tools/delta/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/delta/default.nix
@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "delta";
-  version = "0.7.1";
+  version = "0.8.0";
 
   src = fetchFromGitHub {
     owner = "dandavison";
     repo = pname;
     rev = version;
-    sha256 = "02gm3fxqq91gn1hffy9kc6dkc0y7p09sl6f8njfpsaficij4bs7a";
+    sha256 = "01s73ld3npdmrjbay1lmd13bn9lg2pbmj14gklxi3j9aj0y2q8w8";
   };
 
-  cargoSha256 = "1w1w98vhjd561mkiwv89zb8k0nf1p5fc67jb5dddwg9nj6mqjrhp";
+  cargoSha256 = "1pi4sm07nm1irigrfgysfw99vw96zzz07a1qw5m7bmj6aqp0r3fr";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/applications/version-management/git-repo/default.nix b/pkgs/applications/version-management/git-repo/default.nix
index cd6d9b0fd51c..7b29e466160b 100644
--- a/pkgs/applications/version-management/git-repo/default.nix
+++ b/pkgs/applications/version-management/git-repo/default.nix
@@ -1,10 +1,10 @@
-{ lib, stdenv, fetchFromGitHub, makeWrapper
+{ lib, stdenv, fetchFromGitHub, makeWrapper, nix-update-script
 , python3, git, gnupg, less
 }:
 
 stdenv.mkDerivation rec {
   pname = "git-repo";
-  version = "2.14.5";
+  version = "2.15.3";
 
   src = fetchFromGitHub {
     owner = "android";
@@ -13,8 +13,6 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-3FSkWpHda1jVhy/633B+ippWcbKd83IlQcJYS9Qx5wQ=";
   };
 
-  patches = [ ./import-ssl-module.patch ];
-
   nativeBuildInputs = [ makeWrapper ];
   buildInputs = [ python3 ];
 
@@ -25,8 +23,12 @@ stdenv.mkDerivation rec {
   '';
 
   installPhase = ''
+    runHook preInstall
+
     mkdir -p $out/bin
     cp repo $out/bin/repo
+
+    runHook postInstall
   '';
 
   # Important runtime dependencies
@@ -35,6 +37,12 @@ stdenv.mkDerivation rec {
       "${lib.makeBinPath [ git gnupg less ]}"
   '';
 
+  passthru = {
+    updateScript = nix-update-script {
+      attrPath = "gitRepo";
+    };
+  };
+
   meta = with lib; {
     description = "Android's repo management tool";
     longDescription = ''
@@ -45,7 +53,7 @@ stdenv.mkDerivation rec {
     '';
     homepage = "https://android.googlesource.com/tools/repo";
     license = licenses.asl20;
-    maintainers = [ ];
+    maintainers = with maintainers; [ otavio ];
     platforms = platforms.unix;
   };
 }
diff --git a/pkgs/applications/version-management/git-repo/import-ssl-module.patch b/pkgs/applications/version-management/git-repo/import-ssl-module.patch
deleted file mode 100644
index f1ec4e3a7ddb..000000000000
--- a/pkgs/applications/version-management/git-repo/import-ssl-module.patch
+++ /dev/null
@@ -1,12 +0,0 @@
-diff --git a/repo b/repo
-index 8b05def..f394b3e 100755
---- a/repo
-+++ b/repo
-@@ -236,6 +236,7 @@ import optparse
- import re
- import shutil
- import stat
-+import ssl
- 
- if sys.version_info[0] == 3:
-   import urllib.request
diff --git a/pkgs/applications/video/kooha/default.nix b/pkgs/applications/video/kooha/default.nix
index 223ed132c928..6203041ed63e 100644
--- a/pkgs/applications/video/kooha/default.nix
+++ b/pkgs/applications/video/kooha/default.nix
@@ -1,17 +1,17 @@
 { lib, fetchFromGitHub, appstream-glib, desktop-file-utils, glib
-, gobject-introspection, gst_all_1, gtk3, libhandy, librsvg, meson, ninja
+, gobject-introspection, gst_all_1, gtk4, libadwaita, librsvg, meson, ninja
 , pkg-config, python3, wrapGAppsHook }:
 
 python3.pkgs.buildPythonApplication rec {
   pname = "kooha";
-  version = "1.1.3";
+  version = "1.2.1";
   format = "other";
 
   src = fetchFromGitHub {
     owner = "SeaDve";
     repo = "Kooha";
     rev = "v${version}";
-    sha256 = "14lrx6wplvlk3cg3wij88h4ydp3m69pw7lvvzrq3j9qnh431bs36";
+    sha256 = "1qwbzdn0n1nxcfci1bhhkfchdhw5yz74fdvsa84cznyyx2jils8w";
   };
 
   buildInputs = [
@@ -19,8 +19,8 @@ python3.pkgs.buildPythonApplication rec {
     gobject-introspection
     gst_all_1.gstreamer
     gst_all_1.gst-plugins-base
-    gtk3
-    libhandy
+    gtk4
+    libadwaita
     librsvg
   ];
 
@@ -48,6 +48,10 @@ python3.pkgs.buildPythonApplication rec {
     patchShebangs build-aux/meson/postinstall.py
   '';
 
+  installCheckPhase = ''
+    $out/bin/kooha --help
+  '';
+
   meta = with lib; {
     description = "Simple screen recorder";
     homepage = "https://github.com/SeaDve/Kooha";
diff --git a/pkgs/applications/virtualization/virt-manager/default.nix b/pkgs/applications/virtualization/virt-manager/default.nix
index 4d74b5d66102..1d5044cd213d 100644
--- a/pkgs/applications/virtualization/virt-manager/default.nix
+++ b/pkgs/applications/virtualization/virt-manager/default.nix
@@ -32,10 +32,9 @@ python3Packages.buildPythonApplication rec {
     gobject-introspection # Temporary fix, see https://github.com/NixOS/nixpkgs/issues/56943
   ] ++ optional spiceSupport spice-gtk;
 
-  propagatedBuildInputs = with python3Packages;
-    [
-      pygobject3 ipaddress libvirt libxml2 requests
-    ];
+  propagatedBuildInputs = with python3Packages; [
+    pygobject3 ipaddress libvirt libxml2 requests cdrtools
+  ];
 
   patchPhase = ''
     sed -i 's|/usr/share/libvirt/cpu_map.xml|${system-libvirt}/share/libvirt/cpu_map.xml|g' virtinst/capabilities.py
diff --git a/pkgs/development/compilers/halide/default.nix b/pkgs/development/compilers/halide/default.nix
index 69b7cd4d8682..916d8fa56f75 100644
--- a/pkgs/development/compilers/halide/default.nix
+++ b/pkgs/development/compilers/halide/default.nix
@@ -41,7 +41,17 @@ llvmPackages.stdenv.mkDerivation rec {
   # Note: only openblas and not atlas part of this Nix expression
   # see pkgs/development/libraries/science/math/liblapack/3.5.0.nix
   # to get a hint howto setup atlas instead of openblas
-  buildInputs = [ llvmPackages.llvm libpng libjpeg mesa eigen openblas ];
+  buildInputs = [
+    llvmPackages.llvm
+    llvmPackages.lld
+    llvmPackages.openmp
+    llvmPackages.libclang
+    libpng
+    libjpeg
+    mesa
+    eigen
+    openblas
+  ];
 
   nativeBuildInputs = [ cmake ];
 
diff --git a/pkgs/development/interpreters/clojure/babashka.nix b/pkgs/development/interpreters/clojure/babashka.nix
index 543f443a796f..e52d6c20b970 100644
--- a/pkgs/development/interpreters/clojure/babashka.nix
+++ b/pkgs/development/interpreters/clojure/babashka.nix
@@ -2,7 +2,7 @@
 
 stdenv.mkDerivation rec {
   pname = "babashka";
-  version = "0.4.1";
+  version = "0.4.3";
 
   reflectionJson = fetchurl {
     name = "reflection.json";
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://github.com/babashka/${pname}/releases/download/v${version}/${pname}-${version}-standalone.jar";
-    sha256 = "sha256-tKMxi0umMmM99NusSSE9tT95TBcfXm1lfo95fQRUBrs=";
+    sha256 = "sha256-teZKAwSv9wliVFKdT76yQjMC5g7SGPAqcq/jZ07sYjQ=";
   };
 
   dontUnpack = true;
@@ -110,9 +110,15 @@ stdenv.mkDerivation rec {
     - Batteries included (tools.cli, cheshire, ...)
     - Library support via popular tools like the clojure CLI
     '';
-    homepage = "https://github.com/borkdude/babashka";
+    homepage = "https://github.com/babashka/babashka";
     license = licenses.epl10;
     platforms = graalvm11-ce.meta.platforms;
-    maintainers = with maintainers; [ bandresen bhougland DerGuteMoritz jlesquembre ];
+    maintainers = with maintainers; [
+      bandresen
+      bhougland
+      DerGuteMoritz
+      jlesquembre
+      thiagokokada
+    ];
   };
 }
diff --git a/pkgs/development/libraries/arrow-cpp/default.nix b/pkgs/development/libraries/arrow-cpp/default.nix
index ac53ae3bbd44..a13ebf281934 100644
--- a/pkgs/development/libraries/arrow-cpp/default.nix
+++ b/pkgs/development/libraries/arrow-cpp/default.nix
@@ -22,12 +22,12 @@ let
 
 in stdenv.mkDerivation rec {
   pname = "arrow-cpp";
-  version = "4.0.0";
+  version = "4.0.1";
 
   src = fetchurl {
     url =
       "mirror://apache/arrow/arrow-${version}/apache-arrow-${version}.tar.gz";
-    sha256 = "1bj9jr0pgq9f2nyzqiyj3cl0hcx3c83z2ym6rpdkp59ff2zx0caa";
+    sha256 = "0vl926i6jvsvj5vigdgqzp9v1i1h5zzj1abqr6qwc9drfsibzk3m";
   };
   sourceRoot = "apache-arrow-${version}/cpp";
 
@@ -146,11 +146,11 @@ in stdenv.mkDerivation rec {
       --exclude-regex '^(${builtins.concatStringsSep "|" excludedTests})$'
   '';
 
-  meta = {
+  meta = with lib; {
     description = "A  cross-language development platform for in-memory data";
     homepage = "https://arrow.apache.org/";
-    license = lib.licenses.asl20;
-    platforms = lib.platforms.unix;
-    maintainers = with lib.maintainers; [ tobim veprbl ];
+    license = licenses.asl20;
+    platforms = platforms.unix;
+    maintainers = with maintainers; [ tobim veprbl ];
   };
 }
diff --git a/pkgs/development/libraries/getdata/default.nix b/pkgs/development/libraries/getdata/default.nix
index de76924844fe..25321c22434e 100644
--- a/pkgs/development/libraries/getdata/default.nix
+++ b/pkgs/development/libraries/getdata/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, libtool }:
+{ lib, stdenv, fetchurl, fetchpatch, libtool }:
 stdenv.mkDerivation rec {
   pname = "getdata";
   version = "0.10.0";
@@ -7,6 +7,13 @@ stdenv.mkDerivation rec {
     sha256 = "18xbb32vygav9x6yz0gdklif4chjskmkgp06rwnjdf9myhia0iym";
   };
 
+  patches = [
+    (fetchpatch {
+      url = "https://sources.debian.org/data/main/libg/libgetdata/0.10.0-10/debian/patches/CVE-2021-20204.patch";
+      sha256 = "1lvp1c2pkk9kxniwlvax6d8fsmjrkpxawf71c7j4rfjm6dgvivzm";
+    })
+  ];
+
   buildInputs = [ libtool ];
 
   meta = with lib; {
diff --git a/pkgs/development/libraries/libiio/cmake-fix-libxml2-find-package.patch b/pkgs/development/libraries/libiio/cmake-fix-libxml2-find-package.patch
new file mode 100644
index 000000000000..25345bef90c4
--- /dev/null
+++ b/pkgs/development/libraries/libiio/cmake-fix-libxml2-find-package.patch
@@ -0,0 +1,13 @@
+diff --color -ur a/CMakeLists.txt b/CMakeLists.txt
+--- a/CMakeLists.txt	2021-05-30 13:46:22.256040282 +0200
++++ b/CMakeLists.txt	2021-05-30 14:15:42.530181216 +0200
+@@ -333,7 +333,7 @@
+ # So, try first to find the CMake module provided by libxml2 package, then fallback
+ # on the CMake's FindLibXml2.cmake module (which can lack some definition, especially
+ # in static build case).
+-find_package(LibXml2 QUIET NO_MODULE)
++find_package(LibXml2 QUIET MODULE)
+ if(DEFINED LIBXML2_VERSION_STRING)
+ 	set(LIBXML2_FOUND ON)
+ 	set(LIBXML2_INCLUDE_DIR ${LIBXML2_INCLUDE_DIRS})
+Seulement dans b: good.patch
diff --git a/pkgs/development/libraries/libiio/default.nix b/pkgs/development/libraries/libiio/default.nix
index 043e27fb4b2a..e704076ab57a 100644
--- a/pkgs/development/libraries/libiio/default.nix
+++ b/pkgs/development/libraries/libiio/default.nix
@@ -23,6 +23,10 @@ stdenv.mkDerivation rec {
     sha256 = "0psw67mzysdb8fkh8xpcwicm7z94k8plkcc8ymxyvl6inshq0mc7";
   };
 
+  # Revert after https://github.com/NixOS/nixpkgs/issues/125008 is
+  # fixed properly
+  patches = [ ./cmake-fix-libxml2-find-package.patch ];
+
   nativeBuildInputs = [
     cmake
     flex
diff --git a/pkgs/development/libraries/libxlsxwriter/default.nix b/pkgs/development/libraries/libxlsxwriter/default.nix
index d323c2d962e5..4bb80cb04a45 100644
--- a/pkgs/development/libraries/libxlsxwriter/default.nix
+++ b/pkgs/development/libraries/libxlsxwriter/default.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libxlsxwriter";
-  version = "1.0.5";
+  version = "1.0.6";
 
   src = fetchFromGitHub {
     owner = "jmcnamara";
     repo = "libxlsxwriter";
     rev = "RELEASE_${version}";
-    sha256 = "1jjmwg1mk7pvf36q30rng42qphgz6qdjvn96agrym2q0hhwxc99v";
+    sha256 = "03fdcbm0xnkxwv6fir4yy4x9q2p5h08j099w9xh5gc2ni7ygjlyx";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/mpich/default.nix b/pkgs/development/libraries/mpich/default.nix
index d2cbee14c3a0..9227cd705430 100644
--- a/pkgs/development/libraries/mpich/default.nix
+++ b/pkgs/development/libraries/mpich/default.nix
@@ -1,5 +1,5 @@
 { stdenv, lib, fetchurl, perl, gfortran
-, openssh, hwloc, autoconf, automake, libtool
+, openssh, hwloc
 # either libfabric or ucx work for ch4backend on linux. On darwin, neither of
 # these libraries currently build so this argument is ignored on Darwin.
 , ch4backend
@@ -11,29 +11,13 @@ assert (ch4backend.pname == "ucx" || ch4backend.pname == "libfabric");
 
 stdenv.mkDerivation  rec {
   pname = "mpich";
-  version = "3.4.1";
+  version = "3.4.2";
 
   src = fetchurl {
     url = "https://www.mpich.org/static/downloads/${version}/mpich-${version}.tar.gz";
-    sha256 = "09wpfw9lsrc84vcmfw94razd4xv4znx4mmg7rqmljvgg0jc96dl8";
+    sha256 = "1gw7qpb27mhsj7ip0hhljshgpwvz2hmyhizhlp6793afp2lbw6aw";
   };
 
-  patches = [
-    # Reverts an upstream change that causes json-c test to fail
-    ./jsonc-test.patch
-  ];
-
-  # Required for the json-c patch
-  nativeBuildInputs = [ autoconf automake libtool ];
-
-  # Update configure after patch
-  postPatch = ''
-    cd modules/json-c
-    ./autogen.sh
-    cd ../..
-  '';
-
-
   configureFlags = [
     "--enable-shared"
     "--enable-sharedlib"
diff --git a/pkgs/development/libraries/mpich/jsonc-test.patch b/pkgs/development/libraries/mpich/jsonc-test.patch
deleted file mode 100644
index 2f8d87b409b4..000000000000
--- a/pkgs/development/libraries/mpich/jsonc-test.patch
+++ /dev/null
@@ -1,62 +0,0 @@
---- b/modules/json-c/configure.ac
-+++ a/modules/json-c/configure.ac
-@@ -75,7 +75,7 @@
- AC_FUNC_VPRINTF
- AC_FUNC_MEMCMP
- AC_CHECK_FUNCS([realloc])
-+AC_CHECK_FUNCS(strcasecmp strdup strerror snprintf vsnprintf vasprintf open strncasecmp setlocale)
--AC_CHECK_FUNCS(strcasecmp strdup strerror snprintf vsnprintf open strncasecmp setlocale)
- AC_CHECK_DECLS([INFINITY], [], [], [[#include <math.h>]])
- AC_CHECK_DECLS([nan], [], [], [[#include <math.h>]])
- AC_CHECK_DECLS([isnan], [], [], [[#include <math.h>]])
---- b/modules/json-c/json_pointer.c
-+++ a/modules/json-c/json_pointer.c
-@@ -208,7 +208,7 @@
- 	}
-
- 	va_start(args, path_fmt);
-+	rc = vasprintf(&path_copy, path_fmt, args);
--	rc = json_vasprintf(&path_copy, path_fmt, args);
- 	va_end(args);
-
- 	if (rc < 0)
-@@ -287,7 +287,7 @@
-
- 	/* pass a working copy to the recursive call */
- 	va_start(args, path_fmt);
-+	rc = vasprintf(&path_copy, path_fmt, args);
--	rc = json_vasprintf(&path_copy, path_fmt, args);
- 	va_end(args);
-
- 	if (rc < 0)
---- b/modules/json-c/printbuf.c
-+++ a/modules/json-c/printbuf.c
-@@ -129,7 +129,7 @@
-      would have been written - this code handles both cases. */
-   if(size == -1 || size > 127) {
-     va_start(ap, msg);
-+    if((size = vasprintf(&t, msg, ap)) < 0) { va_end(ap); return -1; }
--    if((size = json_vasprintf(&t, msg, ap)) < 0) { va_end(ap); return -1; }
-     va_end(ap);
-     printbuf_memappend(p, t, size);
-     free(t);
---- b/modules/json-c/vasprintf_compat.h
-+++ a/modules/json-c/vasprintf_compat.h
-@@ -8,8 +8,9 @@
-
- #include "snprintf_compat.h"
-
-+#if !defined(HAVE_VASPRINTF)
- /* CAW: compliant version of vasprintf */
-+static int vasprintf(char **buf, const char *fmt, va_list ap)
--static int json_vasprintf(char **buf, const char *fmt, va_list ap)
- {
- #ifndef WIN32
- 	static char _T_emptybuffer = '\0';
-@@ -40,5 +41,6 @@
-
- 	return chars;
- }
-+#endif /* !HAVE_VASPRINTF */
-
- #endif /* __vasprintf_compat_h */
diff --git a/pkgs/development/libraries/nv-codec-headers/10_x.nix b/pkgs/development/libraries/nv-codec-headers/10_x.nix
new file mode 100644
index 000000000000..b1fe1611301f
--- /dev/null
+++ b/pkgs/development/libraries/nv-codec-headers/10_x.nix
@@ -0,0 +1,22 @@
+{ lib, stdenv, fetchgit }:
+
+stdenv.mkDerivation rec {
+  pname = "nv-codec-headers";
+  version = "10.0.26.2";
+
+  src = fetchgit {
+    url = "https://git.videolan.org/git/ffmpeg/nv-codec-headers.git";
+    rev = "n${version}";
+    sha256 = "0n5jlwjfv5irx1if1g0n52m279bw7ab6bd3jz2v4vwg9cdzbxx85";
+  };
+
+  makeFlags = [ "PREFIX=$(out)" ];
+
+  meta = {
+    description = "FFmpeg version of headers for NVENC";
+    homepage = "https://ffmpeg.org/";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.MP2E ];
+    platforms = lib.platforms.all;
+  };
+}
diff --git a/pkgs/development/libraries/poppler/default.nix b/pkgs/development/libraries/poppler/default.nix
index 0146d80221bf..8a5c6e132a71 100644
--- a/pkgs/development/libraries/poppler/default.nix
+++ b/pkgs/development/libraries/poppler/default.nix
@@ -65,10 +65,9 @@ stdenv.mkDerivation rec {
     cairo
     lcms
     curl
+    nss
   ] ++ lib.optionals qt5Support [
     qtbase
-  ] ++ lib.optionals utils [
-    nss
   ] ++ lib.optionals introspectionSupport [
     gobject-introspection
   ];
diff --git a/pkgs/development/libraries/qhull/default.nix b/pkgs/development/libraries/qhull/default.nix
index 0a6f39e672cd..a7f1bc271155 100644
--- a/pkgs/development/libraries/qhull/default.nix
+++ b/pkgs/development/libraries/qhull/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, cmake }:
+{ lib, stdenv, fetchFromGitHub, cmake, fixDarwinDylibNames }:
 
 stdenv.mkDerivation rec {
   pname = "qhull";
@@ -11,7 +11,8 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-djUO3qzY8ch29AuhY3Bn1ajxWZ4/W70icWVrxWRAxRc=";
   };
 
-  nativeBuildInputs = [ cmake ];
+  nativeBuildInputs = [ cmake ]
+    ++ lib.optional stdenv.isDarwin fixDarwinDylibNames;
 
   meta = with lib; {
     homepage = "http://www.qhull.org/";
diff --git a/pkgs/development/libraries/vapoursynth/plugin-interface.nix b/pkgs/development/libraries/vapoursynth/plugin-interface.nix
index 55b2b03c893e..95df3c97747f 100644
--- a/pkgs/development/libraries/vapoursynth/plugin-interface.nix
+++ b/pkgs/development/libraries/vapoursynth/plugin-interface.nix
@@ -8,10 +8,11 @@ plugins: let
 
   getRecursivePropagatedBuildInputs = pkgs: lib.flatten
     (map
-      (pkg: pkg.propagatedBuildInputs ++ (getRecursivePropagatedBuildInputs pkg.propagatedBuildInputs))
+      (pkg: let cleanPropagatedBuildInputs = lib.filter lib.isDerivation pkg.propagatedBuildInputs;
+        in cleanPropagatedBuildInputs ++ (getRecursivePropagatedBuildInputs cleanPropagatedBuildInputs))
       pkgs);
 
-  deepPlugins = plugins ++ (getRecursivePropagatedBuildInputs plugins);
+  deepPlugins = lib.unique (plugins ++ (getRecursivePropagatedBuildInputs plugins));
 
   pluginsEnv = buildEnv {
     name = "vapoursynth-plugins-env";
diff --git a/pkgs/development/libraries/webkitgtk/428774.patch b/pkgs/development/libraries/webkitgtk/428774.patch
new file mode 100644
index 000000000000..85da185dc4e4
--- /dev/null
+++ b/pkgs/development/libraries/webkitgtk/428774.patch
@@ -0,0 +1,86 @@
+diff -aru a/Source/WebKit/NetworkProcess/ServiceWorker/WebSWOriginStore.cpp b/Source/WebKit/NetworkProcess/ServiceWorker/WebSWOriginStore.cpp
+--- a/Source/WebKit/NetworkProcess/ServiceWorker/WebSWOriginStore.cpp	2021-02-26 04:57:15.000000000 -0500
++++ b/Source/WebKit/NetworkProcess/ServiceWorker/WebSWOriginStore.cpp	2021-05-16 14:45:32.000000000 -0400
+@@ -87,7 +87,7 @@
+     if (!m_store.createSharedMemoryHandle(handle))
+         return;
+ 
+-#if OS(DARWIN) || OS(WINDOWS)
++#if (OS(DARWIN) || OS(WINDOWS)) && !USE(UNIX_DOMAIN_SOCKETS)
+     uint64_t dataSize = handle.size();
+ #else
+     uint64_t dataSize = 0;
+diff -aru a/Source/WebKit/Platform/IPC/IPCSemaphore.cpp b/Source/WebKit/Platform/IPC/IPCSemaphore.cpp
+--- a/Source/WebKit/Platform/IPC/IPCSemaphore.cpp	2021-02-26 04:57:15.000000000 -0500
++++ b/Source/WebKit/Platform/IPC/IPCSemaphore.cpp	2021-05-16 15:54:53.000000000 -0400
+@@ -26,8 +26,6 @@
+ #include "config.h"
+ #include "IPCSemaphore.h"
+ 
+-#if !OS(DARWIN)
+-
+ namespace IPC {
+ 
+ Semaphore::Semaphore() = default;
+@@ -46,5 +44,3 @@
+ }
+ 
+ }
+-
+-#endif
+diff -aru a/Source/WebKit/Platform/IPC/IPCSemaphore.h b/Source/WebKit/Platform/IPC/IPCSemaphore.h
+--- a/Source/WebKit/Platform/IPC/IPCSemaphore.h	2021-02-26 04:57:15.000000000 -0500
++++ b/Source/WebKit/Platform/IPC/IPCSemaphore.h	2021-05-16 14:46:13.000000000 -0400
+@@ -29,7 +29,7 @@
+ #include <wtf/Optional.h>
+ #include <wtf/Seconds.h>
+ 
+-#if OS(DARWIN)
++#if PLATFORM(COCOA)
+ #include <mach/semaphore.h>
+ #include <wtf/MachSendRight.h>
+ #endif
+@@ -51,7 +51,7 @@
+     void encode(Encoder&) const;
+     static Optional<Semaphore> decode(Decoder&);
+ 
+-#if OS(DARWIN)
++#if PLATFORM(COCOA)
+     explicit Semaphore(MachSendRight&&);
+ 
+     void signal();
+@@ -64,7 +64,7 @@
+ #endif
+ 
+ private:
+-#if OS(DARWIN)
++#if PLATFORM(COCOA)
+     void destroy();
+     MachSendRight m_sendRight;
+     semaphore_t m_semaphore { SEMAPHORE_NULL };
+Only in b/Source/WebKit/Platform/IPC: IPCSemaphore.h.orig
+diff -aru a/Source/WebKit/Platform/SharedMemory.h b/Source/WebKit/Platform/SharedMemory.h
+--- a/Source/WebKit/Platform/SharedMemory.h	2021-02-26 04:57:15.000000000 -0500
++++ b/Source/WebKit/Platform/SharedMemory.h	2021-05-16 14:45:32.000000000 -0400
+@@ -75,7 +75,7 @@
+ 
+         bool isNull() const;
+ 
+-#if OS(DARWIN) || OS(WINDOWS)
++#if (OS(DARWIN) || OS(WINDOWS)) && !USE(UNIX_DOMAIN_SOCKETS)
+         size_t size() const { return m_size; }
+ #endif
+ 
+diff -aru a/Source/WebKit/UIProcess/VisitedLinkStore.cpp b/Source/WebKit/UIProcess/VisitedLinkStore.cpp
+--- a/Source/WebKit/UIProcess/VisitedLinkStore.cpp	2021-02-26 04:57:16.000000000 -0500
++++ b/Source/WebKit/UIProcess/VisitedLinkStore.cpp	2021-05-16 14:45:32.000000000 -0400
+@@ -119,7 +119,7 @@
+         return;
+ 
+     // FIXME: Get the actual size of data being sent from m_linkHashStore and send it in the SharedMemory::IPCHandle object.
+-#if OS(DARWIN) || OS(WINDOWS)
++#if (OS(DARWIN) || OS(WINDOWS)) && !USE(UNIX_DOMAIN_SOCKETS)
+     uint64_t dataSize = handle.size();
+ #else
+     uint64_t dataSize = 0;
+Only in b/Source/WebKit/WebProcess/WebPage/CoordinatedGraphics: DrawingAreaCoordinatedGraphics.cpp.orig
diff --git a/pkgs/development/libraries/webkitgtk/default.nix b/pkgs/development/libraries/webkitgtk/default.nix
index f37ba500a227..40f51d6f48a3 100644
--- a/pkgs/development/libraries/webkitgtk/default.nix
+++ b/pkgs/development/libraries/webkitgtk/default.nix
@@ -1,5 +1,7 @@
 { lib, stdenv
+, runCommandNoCC
 , fetchurl
+, fetchpatch
 , perl
 , python3
 , ruby
@@ -34,6 +36,7 @@
 , libidn
 , libedit
 , readline
+, sdk
 , libGL
 , libGLU
 , mesa
@@ -78,6 +81,32 @@ stdenv.mkDerivation rec {
       inherit (addOpenGLRunpath) driverLink;
     })
     ./libglvnd-headers.patch
+  ] ++ lib.optionals stdenv.isDarwin [
+    (fetchpatch {
+      url = "https://github.com/WebKit/WebKit/commit/94cdcd289b993ed4d39c17d4b8b90db7c81a9b10.diff";
+      sha256 = "sha256-ywrTEjf3ATqI0Vvs60TeAZ+m58kCibum4DamRWrQfaA=";
+      excludes = [ "Source/WebKit/ChangeLog" ];
+    })
+
+    # https://bugs.webkit.org/show_bug.cgi?id=225856
+    (fetchpatch {
+      url = "https://bug-225856-attachments.webkit.org/attachment.cgi?id=428797";
+      sha256 = "sha256-ffo5p2EyyjXe3DxdrvAcDKqxwnoqHtYBtWod+1fOjMU=";
+      excludes = [ "Source/WebCore/ChangeLog" ];
+    })
+
+    # https://bugs.webkit.org/show_bug.cgi?id=225850
+    ./428774.patch # https://bug-225850-attachments.webkit.org/attachment.cgi?id=428774
+    (fetchpatch {
+      url = "https://bug-225850-attachments.webkit.org/attachment.cgi?id=428776";
+      sha256 = "sha256-ryNRYMsk72SL0lNdh6eaAdDV3OT8KEqVq1H0j581jmQ=";
+      excludes = [ "Source/WTF/ChangeLog" ];
+    })
+    (fetchpatch {
+      url = "https://bug-225850-attachments.webkit.org/attachment.cgi?id=428778";
+      sha256 = "sha256-78iP+T2vaIufO8TmIPO/tNDgmBgzlDzalklrOPrtUeo=";
+      excludes = [ "Source/WebKit/ChangeLog" ];
+    })
   ];
 
   preConfigure = lib.optionalString (stdenv.hostPlatform != stdenv.buildPlatform) ''
@@ -96,6 +125,7 @@ stdenv.mkDerivation rec {
     gperf
     ninja
     perl
+    perl.pkgs.FileCopyRecursive # used by copy-user-interface-resources.pl
     pkg-config
     python3
     ruby
@@ -143,6 +173,12 @@ stdenv.mkDerivation rec {
   ]) ++ lib.optionals stdenv.isDarwin [
     libedit
     readline
+    # Pull a header that contains a definition of proc_pid_rusage().
+    # (We pick just that one because using the other headers from `sdk` is not
+    # compatible with our C++ standard library)
+    (runCommandNoCC "${pname}_headers" {} ''
+      install -Dm444 "${lib.getDev sdk}"/include/libproc.h "$out"/include/libproc.h
+    '')
   ] ++ lib.optionals stdenv.isLinux [
     bubblewrap
     libseccomp
diff --git a/pkgs/development/ocaml-modules/tyxml/default.nix b/pkgs/development/ocaml-modules/tyxml/default.nix
index bf0e06507c9e..c49327d7d338 100644
--- a/pkgs/development/ocaml-modules/tyxml/default.nix
+++ b/pkgs/development/ocaml-modules/tyxml/default.nix
@@ -2,13 +2,13 @@
 
 buildDunePackage rec {
   pname = "tyxml";
-  version = "4.4.0";
+  version = "4.5.0";
 
   useDune2 = true;
 
   src = fetchurl {
     url = "https://github.com/ocsigen/tyxml/releases/download/${version}/tyxml-${version}.tbz";
-    sha256 = "0c150h2f4c4id73ickkdqkir3jya66m6c7f5jxlp4caw9bfr8qsi";
+    sha256 = "0s30f72m457c3gbdmdwbx7ls9zg806nvm83aiz9qkpglbppwr6n6";
   };
 
   propagatedBuildInputs = [ uutf re ];
@@ -19,7 +19,7 @@ buildDunePackage rec {
     license = licenses.lgpl21;
     maintainers = with maintainers; [
       gal_bolle vbgl
-      ];
+    ];
   };
 
 }
diff --git a/pkgs/development/python-modules/acoustics/default.nix b/pkgs/development/python-modules/acoustics/default.nix
index 7b62c6791cb1..b652c28c6293 100644
--- a/pkgs/development/python-modules/acoustics/default.nix
+++ b/pkgs/development/python-modules/acoustics/default.nix
@@ -15,7 +15,7 @@ buildPythonPackage rec {
 
   checkPhase = ''
     pushd tests
-    py.test ./.
+    py.test -Wignore::DeprecationWarning ./.
     popd
   '';
 
diff --git a/pkgs/development/python-modules/cock/default.nix b/pkgs/development/python-modules/cock/default.nix
new file mode 100644
index 000000000000..c11646decd74
--- /dev/null
+++ b/pkgs/development/python-modules/cock/default.nix
@@ -0,0 +1,19 @@
+{ lib, buildPythonPackage, fetchPypi, locale, pytestCheckHook, click, sortedcontainers, pyyaml }:
+
+buildPythonPackage rec {
+  pname = "cock";
+  version = "0.8.0";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "1gwaklvwlyvhz2c07hdmhbnqqmpybssxzzr0399dpjk7dgdqgam3";
+  };
+
+  propagatedBuildInputs = [ click sortedcontainers pyyaml ];
+
+  meta = with lib; {
+    homepage = "https://github.com/pohmelie/cock";
+    description = "Configuration file with click";
+    license = licenses.mit;
+  };
+}
diff --git a/pkgs/development/python-modules/cocotb-bus/default.nix b/pkgs/development/python-modules/cocotb-bus/default.nix
new file mode 100644
index 000000000000..af740e8d298f
--- /dev/null
+++ b/pkgs/development/python-modules/cocotb-bus/default.nix
@@ -0,0 +1,35 @@
+{ lib
+, stdenv
+, buildPythonPackage
+, fetchPypi
+}:
+
+buildPythonPackage rec {
+  pname = "cocotb-bus";
+  version = "0.1.1";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "cc9b0bb00c95061a67f650caf96e3a294bb74ef437124dea456dd9e2a9431854";
+  };
+
+  postPatch = ''
+    # remove circular dependency cocotb from setup.py
+    substituteInPlace setup.py --replace '"cocotb>=1.5.0.dev,<2.0"' ""
+  '';
+
+  # tests require cocotb, disable for now to avoid circular dependency
+  doCheck = false;
+
+  # checkPhase = ''
+  #   export PATH=$out/bin:$PATH
+  #   make test
+  # '';
+
+  meta = with lib; {
+    description = "Pre-packaged testbenching tools and reusable bus interfaces for cocotb";
+    homepage = "https://github.com/cocotb/cocotb-bus";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ prusnak ];
+  };
+}
diff --git a/pkgs/development/python-modules/cocotb/default.nix b/pkgs/development/python-modules/cocotb/default.nix
index b63432383832..17fe45f1cf49 100644
--- a/pkgs/development/python-modules/cocotb/default.nix
+++ b/pkgs/development/python-modules/cocotb/default.nix
@@ -1,19 +1,31 @@
-{ lib, stdenv, buildPythonPackage, fetchFromGitHub, setuptools, swig, verilog }:
+{ lib
+, stdenv
+, buildPythonPackage
+, fetchPypi
+, setuptools
+, setuptools-scm
+, cocotb-bus
+, pytest
+, swig
+, verilog
+}:
 
 buildPythonPackage rec {
   pname = "cocotb";
-  version = "1.5.1";
+  version = "1.5.2";
 
-  src = fetchFromGitHub {
-    owner = pname;
-    repo = pname;
-    rev = "v${version}";
-    sha256 = "02bw2i03vd4rcvdk10qdjl2lbvvy81cn9qpr8vzq8cm9h45689mv";
+  # - we need to use the tarball from PyPi
+  #   or the full git checkout (with .git)
+  # - using fetchFromGitHub will cause a build failure,
+  #   because it does not include required metadata
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "9f4f3e6eb9caeb479e98d604770645b57469cd25b39e28df1916ffcd593efbe6";
   };
 
-  propagatedBuildInputs = [
-    setuptools
-  ];
+  nativeBuildInputs = [ setuptools-scm ];
+
+  buildInputs = [ setuptools ];
 
   postPatch = ''
     patchShebangs bin/*.py
@@ -25,16 +37,14 @@ buildPythonPackage rec {
     do
       substituteInPlace $f --replace 'shell which' 'shell command -v'
     done
+
+    # remove circular dependency cocotb-bus from setup.py
+    substituteInPlace setup.py --replace "'cocotb-bus<1.0'" ""
   '';
 
-  checkInputs = [ swig verilog ];
+  checkInputs = [ cocotb-bus pytest swig verilog ];
 
   checkPhase = ''
-    # test expected failures actually pass because of a fix in our icarus version
-    # https://github.com/cocotb/cocotb/issues/1952
-    substituteInPlace tests/test_cases/test_discovery/test_discovery.py \
-      --replace 'def access_single_bit' $'def foo(x): pass\ndef foo'
-
     export PATH=$out/bin:$PATH
     make test
   '';
diff --git a/pkgs/development/python-modules/cssutils/default.nix b/pkgs/development/python-modules/cssutils/default.nix
index 8bfe8ea2948d..9d1aec862508 100644
--- a/pkgs/development/python-modules/cssutils/default.nix
+++ b/pkgs/development/python-modules/cssutils/default.nix
@@ -5,19 +5,21 @@
 , setuptools-scm
 , toml
 , importlib-metadata
+, cssselect
+, lxml
 , mock
 , pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "cssutils";
-  version = "2.2.0";
+  version = "2.3.0";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "5bef59f6b59bdccbea8e36cb292d2be1b6be1b485fc4a9f5886616f19eb31aaf";
+    sha256 = "sha256-stOxYEfKroLlxZADaTW6+htiHPRcLziIWvS+SDjw/QA=";
   };
 
   nativeBuildInputs = [
@@ -30,6 +32,8 @@ buildPythonPackage rec {
   ];
 
   checkInputs = [
+    cssselect
+    lxml
     mock
     pytestCheckHook
   ];
@@ -38,6 +42,12 @@ buildPythonPackage rec {
     # access network
     "test_parseUrl"
     "encutils"
+    "website.logging"
+  ] ++ lib.optionals (pythonOlder "3.9") [
+    # AttributeError: module 'importlib.resources' has no attribute 'files'
+    "test_parseFile"
+    "test_parseString"
+    "test_combine"
   ];
 
   pythonImportsCheck = [ "cssutils" ];
diff --git a/pkgs/development/python-modules/drf-jwt/default.nix b/pkgs/development/python-modules/drf-jwt/default.nix
index ad3edc59246d..2cf125c8df35 100644
--- a/pkgs/development/python-modules/drf-jwt/default.nix
+++ b/pkgs/development/python-modules/drf-jwt/default.nix
@@ -3,18 +3,17 @@
 , fetchFromGitHub
 , pyjwt
 , djangorestframework
-, pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "drf-jwt";
-  version = "1.19.0";
+  version = "1.19.1";
 
   src = fetchFromGitHub {
     owner = "Styria-Digital";
     repo = "django-rest-framework-jwt";
     rev = version;
-    sha256 = "012rmm25w5gvkzi4lyyhn47y1n6g68q9gasga2mkv9i6mn8n4kp7";
+    sha256 = "sha256-++8rFXVsA5WMTt+aC4di3Rpa0BAW285/qM087i9uQ0g=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/google-api-python-client/default.nix b/pkgs/development/python-modules/google-api-python-client/default.nix
index 39ed8d68345f..f5c8bcc6c31c 100644
--- a/pkgs/development/python-modules/google-api-python-client/default.nix
+++ b/pkgs/development/python-modules/google-api-python-client/default.nix
@@ -4,11 +4,11 @@
 
 buildPythonPackage rec {
   pname = "google-api-python-client";
-  version = "2.0.2";
+  version = "2.6.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "04c0c8m4c7lzqv0m3jm0zks9wjcv1myas80rxswvi36wn376qs28";
+    sha256 = "1s1q1nw05925ryvnycq4bmqrxc14cicdl1j4l9xvyis26cjg71va";
   };
 
   # No tests included in archive
diff --git a/pkgs/development/python-modules/hdbscan/default.nix b/pkgs/development/python-modules/hdbscan/default.nix
index 5264ff24890d..bf48d6cf5e76 100644
--- a/pkgs/development/python-modules/hdbscan/default.nix
+++ b/pkgs/development/python-modules/hdbscan/default.nix
@@ -40,6 +40,8 @@ buildPythonPackage rec {
     "test_mem_vec_diff_clusters"
     "test_all_points_mem_vec_diff_clusters"
     "test_approx_predict_diff_clusters"
+    # another flaky test https://github.com/scikit-learn-contrib/hdbscan/issues/421
+    "test_hdbscan_boruvka_balltree_matches"
   ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/jupyter_server/default.nix b/pkgs/development/python-modules/jupyter_server/default.nix
index e444b2ea3c0d..f90c521b553b 100644
--- a/pkgs/development/python-modules/jupyter_server/default.nix
+++ b/pkgs/development/python-modules/jupyter_server/default.nix
@@ -77,6 +77,8 @@ buildPythonPackage rec {
     "test_delete"
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   meta = with lib; {
     description = "The backend—i.e. core services, APIs, and REST endpoints—to Jupyter web applications.";
     homepage = "https://github.com/jupyter-server/jupyter_server";
diff --git a/pkgs/development/python-modules/jupyterlab_server/default.nix b/pkgs/development/python-modules/jupyterlab_server/default.nix
index c110cc0590fe..d5d1318ed63c 100644
--- a/pkgs/development/python-modules/jupyterlab_server/default.nix
+++ b/pkgs/development/python-modules/jupyterlab_server/default.nix
@@ -41,6 +41,8 @@ buildPythonPackage rec {
     "test_get_language_pack"
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   meta = with lib; {
     description = "JupyterLab Server";
     homepage = "https://jupyter.org";
diff --git a/pkgs/development/python-modules/mat2/default.nix b/pkgs/development/python-modules/mat2/default.nix
index 0b097024a55f..6c1ba9a40c63 100644
--- a/pkgs/development/python-modules/mat2/default.nix
+++ b/pkgs/development/python-modules/mat2/default.nix
@@ -3,6 +3,7 @@
 , python
 , pythonOlder
 , fetchFromGitLab
+, fetchpatch
 , substituteAll
 , bubblewrap
 , exiftool
@@ -49,6 +50,12 @@ buildPythonPackage rec {
     ./executable-name.patch
     # hardcode path to mat2 executable
     ./tests.patch
+    # remove for next release
+    (fetchpatch {
+      name = "fix-tests-ffmpeg-4.4.patch";
+      url = "https://0xacab.org/jvoisin/mat2/-/commit/c9be50f968212b01f8d8ad85e59e19c3e67d8578.patch";
+      sha256 = "0895dkv6575ps3drdfnli15cggx27n9irjx0axigrm4ql4ma0648";
+    })
   ];
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/matplotlib/default.nix b/pkgs/development/python-modules/matplotlib/default.nix
index 7364920cba22..12ef896117ab 100644
--- a/pkgs/development/python-modules/matplotlib/default.nix
+++ b/pkgs/development/python-modules/matplotlib/default.nix
@@ -1,16 +1,21 @@
-{ lib, stdenv, fetchPypi, writeText, python, buildPythonPackage, isPy3k, pycairo, backports_functools_lru_cache
-, which, cycler, dateutil, nose, numpy, pyparsing, sphinx, tornado, kiwisolver
+{ lib, stdenv, fetchPypi, writeText, buildPythonPackage, isPy3k, pycairo
+, which, cycler, dateutil, numpy, pyparsing, sphinx, tornado, kiwisolver
 , freetype, qhull, libpng, pkg-config, mock, pytz, pygobject3, gobject-introspection
 , certifi, pillow
 , enableGhostscript ? true, ghostscript, gtk3
 , enableGtk3 ? false, cairo
 # darwin has its own "MacOSX" backend
-, enableTk ? !stdenv.isDarwin, tcl, tk, tkinter, libX11
+, enableTk ? !stdenv.isDarwin, tcl, tk, tkinter
 , enableQt ? false, pyqt5
+# required for headless detection
+, libX11, wayland
 , Cocoa
-, pythonOlder
 }:
 
+let
+  interactive = enableTk || enableGtk3 || enableQt;
+in
+
 buildPythonPackage rec {
   version = "3.4.1";
   pname = "matplotlib";
@@ -62,8 +67,14 @@ buildPythonPackage rec {
     let
       tcl_tk_cache = ''"${tk}/lib", "${tcl}/lib", "${lib.strings.substring 0 3 tk.version}"'';
     in
-    lib.optionalString enableTk
-      "sed -i '/self.tcl_tk_cache = None/s|None|${tcl_tk_cache}|' setupext.py";
+    lib.optionalString enableTk ''
+      sed -i '/self.tcl_tk_cache = None/s|None|${tcl_tk_cache}|' setupext.py
+    '' + lib.optionalString (stdenv.isLinux && interactive) ''
+      # fix paths to libraries in dlopen calls (headless detection)
+      substituteInPlace src/_c_internal_utils.c \
+        --replace libX11.so.6 ${libX11}/lib/libX11.so.6 \
+        --replace libwayland-client.so.0 ${wayland}/lib/libwayland-client.so.0
+    '';
 
   # Matplotlib needs to be built against a specific version of freetype in
   # order for all of the tests to pass.
@@ -72,6 +83,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Python plotting library, making publication quality plots";
     homepage    = "https://matplotlib.org/";
+    license     = with licenses; [ psfl bsd0 ];
     maintainers = with maintainers; [ lovek323 veprbl ];
   };
 
diff --git a/pkgs/development/python-modules/nbclassic/default.nix b/pkgs/development/python-modules/nbclassic/default.nix
index 3644b4e48dd7..a6aa34a88ec8 100644
--- a/pkgs/development/python-modules/nbclassic/default.nix
+++ b/pkgs/development/python-modules/nbclassic/default.nix
@@ -28,6 +28,8 @@ buildPythonPackage rec {
     pytest-tornasync
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   meta = with lib; {
     description = "Jupyter lab environment notebook server extension.";
     license = with licenses; [ bsd3 ];
diff --git a/pkgs/development/python-modules/pyrituals/default.nix b/pkgs/development/python-modules/pyrituals/default.nix
index 84bf62ff6d3b..f9f556dba52b 100644
--- a/pkgs/development/python-modules/pyrituals/default.nix
+++ b/pkgs/development/python-modules/pyrituals/default.nix
@@ -7,7 +7,7 @@
 
 buildPythonPackage rec {
   pname = "pyrituals";
-  version = "0.0.2";
+  version = "0.0.3";
   format = "pyproject";
   disabled = pythonOlder "3.8";
 
@@ -15,7 +15,7 @@ buildPythonPackage rec {
     owner = "milanmeu";
     repo = pname;
     rev = version;
-    sha256 = "0hrwhk3kpvdg78fgnvhmnnh3wprdv10j8jqjm4ly64chr8cdi6f2";
+    sha256 = "sha256-oAxQRGP6GxiidnGshSJZEh2RD3XsZ/7kFGwcqaYaBnM=";
   };
 
   propagatedBuildInputs = [ aiohttp ];
diff --git a/pkgs/development/python-modules/scikit-learn/default.nix b/pkgs/development/python-modules/scikit-learn/default.nix
index dfce61df6c6e..6f4ad1d2bd15 100644
--- a/pkgs/development/python-modules/scikit-learn/default.nix
+++ b/pkgs/development/python-modules/scikit-learn/default.nix
@@ -66,10 +66,30 @@ buildPythonPackage rec {
 
   doCheck = !stdenv.isAarch64;
 
-  # Skip test_feature_importance_regression - does web fetch
-  disabledTests = [ "test_feature_importance_regression" ];
+  disabledTests = [
+    # Skip test_feature_importance_regression - does web fetch
+    "test_feature_importance_regression"
 
-  pytestFlagsArray = [ "-n" "$NIX_BUILD_CORES" "--pyargs" "sklearn" ];
+    # failing on macos
+    "check_regressors_train"
+    "check_classifiers_train"
+    "xfail_ignored_in_check_estimator"
+  ];
+
+  pytestFlagsArray = [
+    # verbose build outputs needed to debug hard-to-reproduce hydra failures
+    "-v"
+    "--pyargs" "sklearn"
+
+    # NuSVC memmap tests causes segmentation faults in certain environments
+    # (e.g. Hydra Darwin machines) related to a long-standing joblib issue
+    # (https://github.com/joblib/joblib/issues/563). See also:
+    # https://github.com/scikit-learn/scikit-learn/issues/17582
+    # Since we are overriding '-k' we need to include the 'disabledTests' from above manually.
+    "-k" "'not (NuSVC and memmap) ${toString (lib.forEach disabledTests (t: "and not ${t}"))}'"
+
+    "-n" "$NIX_BUILD_CORES"
+  ];
 
   preCheck = ''
     cd $TMPDIR
@@ -89,6 +109,6 @@ buildPythonPackage rec {
       "https://scikit-learn.org/stable/whats_new/v${major}.${minor}.html#version-${dashVer}";
     homepage = "https://scikit-learn.org";
     license = licenses.bsd3;
-    maintainers = with maintainers; [ ];
+    maintainers = with maintainers; [ davhau ];
   };
 }
diff --git a/pkgs/development/python-modules/smhi-pkg/default.nix b/pkgs/development/python-modules/smhi-pkg/default.nix
index 3308697cf549..f6693da46be7 100644
--- a/pkgs/development/python-modules/smhi-pkg/default.nix
+++ b/pkgs/development/python-modules/smhi-pkg/default.nix
@@ -8,13 +8,13 @@
 
 buildPythonPackage rec {
   pname = "smhi-pkg";
-  version = "1.0.14";
+  version = "1.0.15";
 
   src = fetchFromGitHub {
     owner = "joysoftware";
     repo = "pypi_smhi";
     rev = version;
-    sha256 = "186xwrg3hvr0hszq2kxvygd241q2sp11gfk6mwj9z4zqywwfcbn3";
+    sha256 = "sha256-tBNmfn2hBkS36B9zKDP+TgqeumbgzBVDiJ5L54RaSc8=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/xgboost/default.nix b/pkgs/development/python-modules/xgboost/default.nix
index 4f02d72c9a18..1045b86a4441 100644
--- a/pkgs/development/python-modules/xgboost/default.nix
+++ b/pkgs/development/python-modules/xgboost/default.nix
@@ -1,4 +1,5 @@
-{ buildPythonPackage
+{ lib
+, buildPythonPackage
 , pytestCheckHook
 , cmake
 , scipy
@@ -56,6 +57,11 @@ buildPythonPackage {
   disabledTests = [
     "test_cli_binary_classification"
     "test_model_compatibility"
+  ] ++ lib.optionals stdenv.isDarwin [
+    # fails to connect to the com.apple.fonts daemon in sandboxed mode
+    "test_plotting"
+    "test_sklearn_plotting"
   ];
 
+  __darwinAllowLocalNetworking = true;
 }
diff --git a/pkgs/development/tools/analysis/radare2/default.nix b/pkgs/development/tools/analysis/radare2/default.nix
index e59c48f91d30..0ffe937a93fb 100644
--- a/pkgs/development/tools/analysis/radare2/default.nix
+++ b/pkgs/development/tools/analysis/radare2/default.nix
@@ -20,6 +20,7 @@
 , ruby
 , lua
 , capstone
+, fetchpatch
 , useX11 ? false
 , rubyBindings ? false
 , pythonBindings ? false
@@ -37,6 +38,19 @@ stdenv.mkDerivation rec {
     sha256 = "0n3k190qjhdlj10fjqijx6ismz0g7fk28i83j0480cxdqgmmlbxc";
   };
 
+  patches = [
+    # fix for CVE-2021-32613
+    (fetchpatch {
+      url = "https://github.com/radareorg/radare2/commit/5e16e2d1c9fe245e4c17005d779fde91ec0b9c05.patch";
+      sha256 = "sha256-zCFNn968buLuSqfUT5E+72qz0l1tA3fEUQIxJl2nd3I=";
+    })
+    (fetchpatch {
+      name = "CVE-2021-32613.patch";
+      url = "https://github.com/radareorg/radare2/commit/049de62730f4954ef9a642f2eeebbca30a8eccdc.patch";
+      sha256 = "sha256-s8SWGuSQ6fxDCybtjO2ZW8w7H6mr+AuzVLL6dw+XKDw=";
+    })
+  ];
+
   postInstall = ''
     install -D -m755 $src/binr/r2pm/r2pm $out/bin/r2pm
   '';
diff --git a/pkgs/development/tools/build-managers/rebar3/default.nix b/pkgs/development/tools/build-managers/rebar3/default.nix
index d6798c2d8e39..d551b98b5b84 100644
--- a/pkgs/development/tools/build-managers/rebar3/default.nix
+++ b/pkgs/development/tools/build-managers/rebar3/default.nix
@@ -3,7 +3,7 @@
   writeScript, common-updater-scripts, coreutils, git, gnused, nix, rebar3-nix }:
 
 let
-  version = "3.16.0";
+  version = "3.16.1";
   owner = "erlang";
   deps = import ./rebar-deps.nix { inherit fetchFromGitHub fetchHex; };
   rebar3 = stdenv.mkDerivation rec {
@@ -16,7 +16,7 @@ let
       inherit owner;
       repo = pname;
       rev = version;
-      sha256 = "1yqvm37l5rn5dyg4sc2hv47930s2524qrdpnjwy3zqa27r7k5n36";
+      sha256 = "0dhwlx7zykf9y3znk2k8fxrq5j43jy3c3gd76k74q34p1xbajgzr";
     };
 
     buildInputs = [ erlang ];
diff --git a/pkgs/development/tools/database/pgsync/Gemfile.lock b/pkgs/development/tools/database/pgsync/Gemfile.lock
index 5ee736430af5..d147a5a74546 100644
--- a/pkgs/development/tools/database/pgsync/Gemfile.lock
+++ b/pkgs/development/tools/database/pgsync/Gemfile.lock
@@ -3,12 +3,12 @@ GEM
   specs:
     parallel (1.20.1)
     pg (1.2.3)
-    pgsync (0.6.6)
+    pgsync (0.6.7)
       parallel
       pg (>= 0.18.2)
       slop (>= 4.8.2)
       tty-spinner
-    slop (4.8.2)
+    slop (4.9.0)
     tty-cursor (0.7.1)
     tty-spinner (0.9.3)
       tty-cursor (~> 0.7)
diff --git a/pkgs/development/tools/database/pgsync/gemset.nix b/pkgs/development/tools/database/pgsync/gemset.nix
index 18a833970722..0240300ff052 100644
--- a/pkgs/development/tools/database/pgsync/gemset.nix
+++ b/pkgs/development/tools/database/pgsync/gemset.nix
@@ -25,20 +25,20 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0wjvcfsgm7xxhb2lxil19qjxvvihqxbjd2ykmm5d43p0h2l9wvxr";
+      sha256 = "0kn7cf048zwbap0mifdpzz8if1ah803vgzbx09dfgjwgvfx5w5w6";
       type = "gem";
     };
-    version = "0.6.6";
+    version = "0.6.7";
   };
   slop = {
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "05d1xv8r9cmd0mmlqpa853yzd7xhcyha063w1g8dpf84scxbxmd3";
+      sha256 = "09n6sj4p3b43qq6jmghr9zhgny6719bpca8j6rxnlbq9bsnrd8rj";
       type = "gem";
     };
-    version = "4.8.2";
+    version = "4.9.0";
   };
   tty-cursor = {
     groups = ["default"];
diff --git a/pkgs/development/tools/devpi-client/default.nix b/pkgs/development/tools/devpi-client/default.nix
index 5bca87337714..11fa78f1f02e 100644
--- a/pkgs/development/tools/devpi-client/default.nix
+++ b/pkgs/development/tools/devpi-client/default.nix
@@ -49,6 +49,8 @@ buildPythonApplication rec {
 
   LC_ALL = "en_US.UTF-8";
 
+  __darwinAllowLocalNetworking = true;
+
   meta = with lib; {
     homepage = "http://doc.devpi.net";
     description = "Client for devpi, a pypi index server and packaging meta tool";
diff --git a/pkgs/development/tools/devpi-server/default.nix b/pkgs/development/tools/devpi-server/default.nix
index 8a484a23349c..b5ddda9f08b1 100644
--- a/pkgs/development/tools/devpi-server/default.nix
+++ b/pkgs/development/tools/devpi-server/default.nix
@@ -55,6 +55,8 @@ python3Packages.buildPythonApplication rec {
     "TestMirrorIndexThings"
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   meta = with lib;{
     homepage = "http://doc.devpi.net";
     description = "Github-style pypi index server and packaging meta tool";
diff --git a/pkgs/development/tools/electron/default.nix b/pkgs/development/tools/electron/default.nix
index 5ecec0059a02..1f10f6021244 100644
--- a/pkgs/development/tools/electron/default.nix
+++ b/pkgs/development/tools/electron/default.nix
@@ -86,32 +86,32 @@ rec {
     headers = "0yx8mkrm15ha977hzh7g2sc5fab9sdvlk1bk3yxignhxrqqbw885";
   };
 
-  electron_10 = mkElectron "10.4.5" {
-    x86_64-linux = "d7f6203d09b4419262e985001d4c4f6c1fdfa3150eddb0708df9e124bebd0503";
-    x86_64-darwin = "e3ae7228010055b1d198d8dbaf0f34882d369d8caf76206a59f198301a3f3913";
-    i686-linux = "dd6abc0dc00d8f9d0e31c8f2bb70f7bbbaec58af4c446f8b493bbae9a9428e2f";
-    armv7l-linux = "86bc5f9d3dc94d19e847bf10ab22d98926b616d9febcbdceafd30e35b8f2b2db";
-    aarch64-linux = "655b36d68332131250f7496de0bb03a1e93f74bb5fc4b4286148855874673dcd";
-    headers = "1kfgww8wha86yw75k5yfq4mxvjlxgf1jmmzxy0p3hyr000kw26pk";
+  electron_10 = mkElectron "10.4.7" {
+    x86_64-linux = "e3ea75fcedce588c6b59cfa3a6e46ba67b789e14dc2e5b9dfe1ddf3f82b0f995";
+    x86_64-darwin = "8f01e020563b7fce68dc2e3d4bbf419320d13b088e89eb64f9645e9d73ad88fb";
+    i686-linux = "dd7fde9b3993538333ec701101554050b27d0b680196d0883ab563e8e696fc79";
+    armv7l-linux = "56f11ed14f8a620650d31c21ebd095ce59ef4286c98276802b18f9cc85560ddd";
+    aarch64-linux = "0550584518c8e98fe1113706c10fd7456ec519f7aa6867fbff17c8913327d758";
+    headers = "01x6a0r2jawjpl09ixgzap3g0z6znj34hsnnhzanavkbds0ri4k6";
   };
 
-  electron_11 = mkElectron "11.4.6" {
-    x86_64-linux = "03932a0b3328a00e7ed49947c70143b7b3455a3c1976defab2f74127cdae43e9";
-    x86_64-darwin = "47de03b17ab20213c95d5817af3d7db2b942908989649202efdcd1d566dd24c3";
-    i686-linux = "b76e69ad4b654384b4f1647f0cb362e78c1d99be7b814d7d32abc22294639ace";
-    armv7l-linux = "cc4be8e0c348bc8db5002cf6c63c1d02fcb594f1f8bfc358168738c930098857";
-    aarch64-linux = "75665dd5b2b9938bb4572344d459db65f46c5f7c637a32946c5a822cc23a77dc";
-    aarch64-darwin = "0c782b1d4eb848bae780f4e3a236caa1671486264c1f8e72fde98f1256d8f9e5";
-    headers = "0ip1wxgflifs86vk4xpz1555xa7yjy64ygqgd5a2g723148m52rk";
+  electron_11 = mkElectron "11.4.7" {
+    x86_64-linux = "05005d351a1b08a550a8186efba6f4fdd96842355a634934d9a9d7d31c2cd539";
+    x86_64-darwin = "e6445ad3d7e851fc3227785788d0706d58c9c8ea3821afa7f871c6254c463043";
+    i686-linux = "5473f36eb2a9772da7e4f1a162a724b4a5335e8f78fb51d585bac3bd50ff12fc";
+    armv7l-linux = "0de0d74b1206f7ffd9e4c75754bbf6fdf27c83a0ce6b4cd8a6b5af81d7a20ba7";
+    aarch64-linux = "f2261dde71197c358aff85d7a320cbd2315a5adf228218fd9a2f5c8561589323";
+    aarch64-darwin = "a2abc83c21402e30f4f42f4615cccc4369884faa2f2fa576d71f423834988622";
+    headers = "1dqkx861vfq6xbzdlbgza6h4j7bib8p3xahllrnfc0s65y8gf0ry";
   };
 
-  electron_12 = mkElectron "12.0.7" {
-    x86_64-linux = "335b77b35361fac4e2df1b7e8de5cf055e0a1a2065759cb2dd4508e8a77949fa";
-    x86_64-darwin = "c3238c9962c5ad0f9de23c9314f07e03410d096d7e9f9d91016dab2856606a9e";
-    i686-linux = "16023d86b88c7fccafd491c020d064caa2138d6a3493664739714555f72e5b06";
-    armv7l-linux = "53cc1250ff62f2353d8dd37552cbd7bdcaaa756106faee8b809303bed00e040a";
-    aarch64-linux = "3eddc0c507a43cce4e714bfe509d99218b5ab99f4660dd173aac2a895576dc71";
-    aarch64-darwin = "2bc8f37af68e220f93fb9abc62d1c56d8b64baaf0ef9ef974f24ddcbe4f8b488";
-    headers = "1ji9aj7qr4b27m5kprsgsrl21rjphz5bbnmn6q0n2x84l429nyfb";
+  electron_12 = mkElectron "12.0.9" {
+    x86_64-linux = "3ab0a873f720d3bf56cce6ca1bf9d8b956843920798f659ca0829e4cc3126f6d";
+    x86_64-darwin = "b3f1e378f58e7c36b54451c5a3485adc370277827974e1eb0790b6965737c872";
+    i686-linux = "37405b3b27779ad417c3ae432d7f0d969c126c958a0ad8f2585c34fc8ee6c6e6";
+    armv7l-linux = "2d41ef3ed6a215efe2c7d03d8055fcfda0079f09e9580e5bf70e8ac4a22b0898";
+    aarch64-linux = "22a85817ea2edbba2e17b35f6e3a8104b2165e070ea21a1f2fa3b40e8d7aecc9";
+    aarch64-darwin = "cb8aa8153005ea0d801182eb714d56af0217345b1152d867317291670731daeb";
+    headers = "1vwcjzkjag2wxrwnsbi8bgbv8bi6vn5iq9b04krwlk7mlhm4ax66";
   };
 }
diff --git a/pkgs/development/tools/rust/cargo-raze/default.nix b/pkgs/development/tools/rust/cargo-raze/default.nix
index 2e75c08b42bb..0299fe516d94 100644
--- a/pkgs/development/tools/rust/cargo-raze/default.nix
+++ b/pkgs/development/tools/rust/cargo-raze/default.nix
@@ -19,7 +19,9 @@ rustPlatform.buildRustPackage rec {
   buildInputs = [ curl libgit2 openssl ]
     ++ lib.optional stdenv.isDarwin Security;
 
-  doCheck = true;
+  # thread 'main' panicked at 'Cannot ping mock server.: "cannot send request to mock server: cannot send request to mock server: failed to resolve host name"'
+  # __darwinAllowLocalNetworking does not fix the panic
+  doCheck = !stdenv.isDarwin;
 
   meta = with lib; {
     description = "Generate Bazel BUILD files from Cargo dependencies";
diff --git a/pkgs/games/terraria-server/default.nix b/pkgs/games/terraria-server/default.nix
index b21f1008885d..b5a8c7e486bd 100644
--- a/pkgs/games/terraria-server/default.nix
+++ b/pkgs/games/terraria-server/default.nix
@@ -2,12 +2,12 @@
 
 stdenv.mkDerivation rec {
   pname = "terraria-server";
-  version = "1.4.2.2";
+  version = "1.4.2.3";
   urlVersion = lib.replaceChars [ "." ] [ "" ] version;
 
   src = fetchurl {
-    url = "https://terraria.org/system/dedicated_servers/archives/000/000/045/original/terraria-server-${urlVersion}.zip";
-    sha256 = "0jz79yidnri6hrqp2aqbi8hg0w3k4nrnfbvxgy5q612fr04g6nsw";
+    url = "https://terraria.org/system/dedicated_servers/archives/000/000/046/original/terraria-server-${urlVersion}.zip";
+    sha256 = "0qm4pbm1d9gax47fk4zhw9rcxvajxs36w7dghirli89i994r7g8j";
   };
 
   buildInputs = [ file ];
diff --git a/pkgs/misc/emulators/retroarch/cores.nix b/pkgs/misc/emulators/retroarch/cores.nix
index 887e79999ca1..7153c378f8a3 100644
--- a/pkgs/misc/emulators/retroarch/cores.nix
+++ b/pkgs/misc/emulators/retroarch/cores.nix
@@ -1,6 +1,6 @@
-{ lib, stdenv, fetchgit, fetchFromGitHub, fetchFromGitLab, fetchpatch, cmake, pkg-config, makeWrapper, python27, python37, retroarch
+{ lib, stdenv, fetchgit, fetchFromGitHub, fetchFromGitLab, fetchpatch, cmake, pkg-config, makeWrapper, python27, python3, retroarch
 , alsaLib, fluidsynth, curl, hidapi, libGLU, gettext, glib, gtk2, portaudio, SDL, SDL_net, SDL2, SDL2_image, libGL
-, ffmpeg_3, pcre, libevdev, libpng, libjpeg, libzip, udev, libvorbis, snappy, which, hexdump
+, ffmpeg, pcre, libevdev, libpng, libjpeg, libzip, udev, libvorbis, snappy, which, hexdump
 , miniupnpc, sfml, xorg, zlib, nasm, libpcap, boost, icu, openssl
 , buildPackages }:
 
@@ -831,15 +831,24 @@ in with lib.licenses;
 
   ppsspp = mkLibRetroCore {
     core = "ppsspp";
-    src = fetchgit {
-      url = "https://github.com/hrydgard/ppsspp";
-      rev = "bf1777f7d3702e6a0f71c7ec1fc51976e23c2327";
-      sha256 = "17sym0vk72lzbh9a1501mhw98c78x1gq7k1fpy69nvvb119j37wa";
+    src = fetchFromGitHub {
+      owner = "hrydgard";
+      repo = "ppsspp";
+      rev = "v1.11";
+      fetchSubmodules = true;
+      sha256 = "sha256-vfp/vacIItlPP5dR7jzDT7oOUNFnjvvdR46yi79EJKU=";
     };
+    patches = [
+      (fetchpatch {
+        name = "fix_ffmpeg_4.4.patch";  # to be removed with next release
+        url = "https://patch-diff.githubusercontent.com/raw/hrydgard/ppsspp/pull/14176.patch";
+        sha256 = "sha256-ecDoOydaLfL6+eFpahcO1TnRl866mZZVHlr6Qrib1mo=";
+      })
+    ];
     description = "ppsspp libretro port";
     license = gpl2;
-    extraNativeBuildInputs = [ cmake pkg-config ];
-    extraBuildInputs = [ libGLU libGL libzip ffmpeg_3 python37 snappy xorg.libX11 ];
+    extraNativeBuildInputs = [ cmake pkg-config python3 ];
+    extraBuildInputs = [ libGLU libGL libzip ffmpeg snappy xorg.libX11 ];
     makefile = "Makefile";
     cmakeFlags = [ "-DLIBRETRO=ON -DUSE_SYSTEM_FFMPEG=ON -DUSE_SYSTEM_SNAPPY=ON -DUSE_SYSTEM_LIBZIP=ON -DOpenGL_GL_PREFERENCE=GLVND" ];
     postBuild = "mv lib/ppsspp_libretro${stdenv.hostPlatform.extensions.sharedLibrary} ppsspp_libretro${stdenv.hostPlatform.extensions.sharedLibrary}";
diff --git a/pkgs/misc/lightspark/default.nix b/pkgs/misc/lightspark/default.nix
index 7c9a4815e0a5..0e99767a2cb6 100644
--- a/pkgs/misc/lightspark/default.nix
+++ b/pkgs/misc/lightspark/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, pkg-config, cmake, curl, zlib, ffmpeg_3, glew, pcre
+{ lib, stdenv, fetchFromGitHub, pkg-config, cmake, curl, zlib, ffmpeg, glew, pcre
 , rtmpdump, cairo, boost, SDL2, SDL2_mixer, libjpeg, pango, xz, nasm
 , llvm, glibmm
 }:
@@ -14,21 +14,21 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-pIiv5wEDLvTHjlYSicXUTTI6pVAsO6FC39Gie9Z/hZ4=";
   };
 
-  patchPhase = ''
+  postPatch = ''
     sed -i 's/SET(ETCDIR "\/etc")/SET(ETCDIR "etc")/g' CMakeLists.txt
   '';
 
   nativeBuildInputs = [ pkg-config cmake ];
 
   buildInputs = [
-    curl zlib ffmpeg_3 glew pcre rtmpdump cairo boost SDL2 SDL2_mixer libjpeg
+    curl zlib ffmpeg glew pcre rtmpdump cairo boost SDL2 SDL2_mixer libjpeg
     pango xz nasm llvm glibmm
   ];
 
   meta = with lib; {
     description = "Open source Flash Player implementation";
     homepage = "https://lightspark.github.io/";
-    license = licenses.lgpl3;
+    license = licenses.lgpl3Plus;
     maintainers = with maintainers; [ jchw ];
     platforms = platforms.linux;
   };
diff --git a/pkgs/os-specific/linux/sssd/default.nix b/pkgs/os-specific/linux/sssd/default.nix
index d768546b12bb..94b1a6d799dc 100644
--- a/pkgs/os-specific/linux/sssd/default.nix
+++ b/pkgs/os-specific/linux/sssd/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, fetchpatch, glibc, augeas, dnsutils, c-ares, curl,
+{ lib, stdenv, fetchFromGitHub, autoreconfHook, fetchpatch, glibc, augeas, dnsutils, c-ares, curl,
   cyrus_sasl, ding-libs, libnl, libunistring, nss, samba, nfs-utils, doxygen,
   python, python3, pam, popt, talloc, tdb, tevent, pkg-config, ldb, openldap,
   pcre, libkrb5, cifs-utils, glib, keyutils, dbus, fakeroot, libxslt, libxml2,
@@ -12,11 +12,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "sssd";
-  version = "1.16.4";
+  version = "1.16.5";
 
-  src = fetchurl {
-    url = "https://fedorahosted.org/released/sssd/${pname}-${version}.tar.gz";
-    sha256 = "0ngr7cgimyjc6flqkm7psxagp1m4jlzpqkn28pliifbmdg6i5ckb";
+  src = fetchFromGitHub {
+    owner = "SSSD";
+    repo = pname;
+    rev = "${pname}-${lib.replaceStrings ["."] ["_"] version}";
+    sha256 = "0zbs04lkjbp7y92anmafl7gzamcnq1f147p13hc4byyvjk9rg6f7";
   };
   patches = [
     # Fix build failure against samba 4.12.0rc1
@@ -60,9 +62,10 @@ stdenv.mkDerivation rec {
   '';
 
   enableParallelBuilding = true;
+  nativeBuildInputs = [ autoreconfHook pkg-config doxygen ];
   buildInputs = [ augeas dnsutils c-ares curl cyrus_sasl ding-libs libnl libunistring nss
-                  samba nfs-utils doxygen python python3 popt
-                  talloc tdb tevent pkg-config ldb pam openldap pcre libkrb5
+                  samba nfs-utils python python3 popt
+                  talloc tdb tevent ldb pam openldap pcre libkrb5
                   cifs-utils glib keyutils dbus fakeroot libxslt libxml2
                   libuuid ldap systemd nspr check cmocka uid_wrapper
                   nss_wrapper ncurses Po4a http-parser jansson ];
@@ -95,8 +98,9 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "System Security Services Daemon";
-    homepage = "https://fedorahosted.org/sssd/";
-    license = licenses.gpl3;
+    homepage = "https://sssd.io/";
+    changelog = "https://sssd.io/release-notes/sssd-${version}.html";
+    license = licenses.gpl3Plus;
     platforms = platforms.linux;
     maintainers = [ maintainers.e-user ];
   };
diff --git a/pkgs/servers/dendrite/default.nix b/pkgs/servers/dendrite/default.nix
index 5f070aa398c1..529cc49c07d9 100644
--- a/pkgs/servers/dendrite/default.nix
+++ b/pkgs/servers/dendrite/default.nix
@@ -13,10 +13,6 @@ buildGoModule rec {
 
   vendorSha256 = "1l1wydvi0yalas79cvhrqg563cvs57hg9rv6qnkw879r6smb2x1n";
 
-  passthru.tests = {
-    inherit (nixosTests) dendrite;
-  };
-
   meta = with lib; {
     homepage = "https://matrix.org";
     description = "Dendrite is a second-generation Matrix homeserver written in Go!";
diff --git a/pkgs/servers/gotty/default.nix b/pkgs/servers/gotty/default.nix
index 7bd09569248f..58335c79fe95 100644
--- a/pkgs/servers/gotty/default.nix
+++ b/pkgs/servers/gotty/default.nix
@@ -1,23 +1,29 @@
-{ lib, buildGoPackage, fetchFromGitHub }:
+{ lib
+, buildGoModule
+, fetchFromGitHub
+}:
 
-buildGoPackage rec {
+buildGoModule rec {
   pname = "gotty";
-  version = "2.0.0-alpha.3";
-  rev = "v${version}";
-
-  goPackagePath = "github.com/yudai/gotty";
+  version = "1.2.0";
 
   src = fetchFromGitHub {
-    inherit rev;
-    owner = "yudai";
+    owner = "sorenisanerd";
     repo = "gotty";
-    sha256 = "1vhhs7d4k1vpkf2k69ai2r3bp3zwnwa8l9q7vza0rck69g4nmz7a";
+    rev = "v${version}";
+    sha256 = "06ngxnblwkmiln9bxikg9q2wdlh45481pnz87bpsw2r7hc69bv9n";
   };
 
+  vendorSha256 = "0mzf5209r3fzqf9q98j3b2cdzvfa3kg62xn0spx5zr6nabmhaa79";
+
+  # upstream did not update the tests, so they are broken now
+  # https://github.com/sorenisanerd/gotty/issues/13
+  doCheck = false;
+
   meta = with lib; {
     description = "Share your terminal as a web application";
-    homepage = "https://github.com/yudai/gotty";
-    maintainers = with maintainers; [ ];
+    homepage = "https://github.com/sorenisanerd/gotty";
+    maintainers = with maintainers; [ prusnak ];
     license = licenses.mit;
   };
 }
diff --git a/pkgs/servers/home-assistant/default.nix b/pkgs/servers/home-assistant/default.nix
index 194569924c99..cd90a2ecd0b8 100644
--- a/pkgs/servers/home-assistant/default.nix
+++ b/pkgs/servers/home-assistant/default.nix
@@ -677,6 +677,8 @@ in with py.pkgs; buildPythonApplication rec {
     "--deselect tests/components/shelly/test_config_flow.py::test_zeroconf_sleeping_device_error"
     "--deselect tests/components/shelly/test_config_flow.py::test_zeroconf_sleeping_device_error"
     "--deselect tests/components/shelly/test_config_flow.py::test_zeroconf_require_auth"
+    # prometheus/test_init.py: Spurious AssertionError regarding humidifier_target_humidity_percent metric
+    "--deselect tests/components/prometheus/test_init.py::test_view"
     # tests are located in tests/
     "tests"
     # dynamically add packages required for component tests
diff --git a/pkgs/servers/keycloak/default.nix b/pkgs/servers/keycloak/default.nix
index 3138a68a9bcf..9788e04ac445 100644
--- a/pkgs/servers/keycloak/default.nix
+++ b/pkgs/servers/keycloak/default.nix
@@ -18,11 +18,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname   = "keycloak";
-  version = "13.0.0";
+  version = "13.0.1";
 
   src = fetchzip {
     url    = "https://github.com/keycloak/keycloak/releases/download/${version}/keycloak-${version}.zip";
-    sha256 = "sha256-jpjAPldmJkyXGsokw9MO1u0VysYBXeQ8MamEPWvBGvs=";
+    sha256 = "sha256-81i8Yf9rEuHtUDqYThUCn0/Lb9YokRi4tGi/Ooyyxr8=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/servers/mediatomb/default.nix b/pkgs/servers/mediatomb/default.nix
index d84aa954a00f..6294f9df2bd3 100644
--- a/pkgs/servers/mediatomb/default.nix
+++ b/pkgs/servers/mediatomb/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchgit
-, sqlite, expat, mp4v2, flac, spidermonkey_68, taglib, libexif, curl, ffmpeg_3, file
+, sqlite, expat, mp4v2, flac, spidermonkey_68, taglib, libexif, curl, ffmpeg, file
 , pkg-config, autoreconfHook }:
 
 stdenv.mkDerivation rec {
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
     sha256 = "1mimslr4q6mky865y6561rr64cbn4gf0qc2dhgb31hxp4rc1kmzd";
   };
 
-  buildInputs = [ sqlite expat spidermonkey_68 taglib libexif curl ffmpeg_3 file mp4v2 flac
+  buildInputs = [ sqlite expat spidermonkey_68 taglib libexif curl ffmpeg file mp4v2 flac
                   pkg-config autoreconfHook ];
 
   meta = with lib; {
diff --git a/pkgs/servers/monitoring/icinga2/default.nix b/pkgs/servers/monitoring/icinga2/default.nix
index e3ea1a802510..44c512196c65 100644
--- a/pkgs/servers/monitoring/icinga2/default.nix
+++ b/pkgs/servers/monitoring/icinga2/default.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "icinga2${nameSuffix}";
-  version = "2.12.3";
+  version = "2.12.4";
 
   src = fetchFromGitHub {
     owner = "icinga";
     repo = "icinga2";
     rev = "v${version}";
-    sha256 = "0pq6ixv7d9bqys8qjxqq0jki3zncj8jdfavkp7qw125iyfjq48xk";
+    sha256 = "sha256-SJBOZzLbmW4525G3w6BVS53kOd2bJ5rEbwwb4Lo5q8I=";
   };
 
   patches = [
diff --git a/pkgs/servers/samba/0001-lib-util-Standardize-use-of-st_-acm-time-ns.patch b/pkgs/servers/samba/0001-lib-util-Standardize-use-of-st_-acm-time-ns.patch
deleted file mode 100644
index 6de704cba285..000000000000
--- a/pkgs/servers/samba/0001-lib-util-Standardize-use-of-st_-acm-time-ns.patch
+++ /dev/null
@@ -1,569 +0,0 @@
-From 55a5b9c8254126d0acef8702526c92a31200a07c Mon Sep 17 00:00:00 2001
-From: Matthew DeVore <matvore@google.com>
-Date: Tue, 4 Aug 2020 17:49:42 -0700
-Subject: [PATCH] lib/util: Standardize use of st_[acm]time ns
-
-Commit 810397f89a10, and possibly others, broke the build for macOS and
-other environments which don't have st_[acm]tim fields on 'struct stat'.
-
-Multiple places in the codebase used the config.h values to determine
-how to access the nanosecond or microsecond values of the stat
-timestamps, so rather than add more, centralize them all into
-lib/util/time.c.
-
-Also allow pvfs_fileinfo.c to read nanosecond-granularity timestamps on
-platforms where it didn't before, since its #if branches were not
-complete.
-
-Signed-off-by: Matthew DeVore <matvore@google.com>
-Reviewed-by: Jeremy Allison <jra@samba.org>
-Reviewed-by: Volker Lendecke <vl@samba.org>
-
-Autobuild-User(master): Volker Lendecke <vl@samba.org>
-Autobuild-Date(master): Sat Aug 15 08:51:09 UTC 2020 on sn-devel-184
----
- lib/replace/wscript                         |   2 -
- lib/util/time.c                             | 230 ++++++++++++++++++++
- lib/util/time.h                             |  18 ++
- source3/lib/system.c                        | 121 +---------
- source3/libsmb/libsmb_stat.c                |  24 +-
- source4/ntvfs/posix/pvfs_fileinfo.c         |  11 +-
- source4/torture/libsmbclient/libsmbclient.c |   7 +-
- 7 files changed, 277 insertions(+), 136 deletions(-)
-
-diff --git a/lib/replace/wscript b/lib/replace/wscript
-index 64f305d6df0..85bc11d2f01 100644
---- a/lib/replace/wscript
-+++ b/lib/replace/wscript
-@@ -746,8 +746,6 @@ def configure(conf):
- 
-     conf.CHECK_CODE('mkdir("foo",0777)', define='HAVE_MKDIR_MODE', headers='sys/stat.h')
- 
--    conf.CHECK_STRUCTURE_MEMBER('struct stat', 'st_mtim.tv_nsec', define='HAVE_STAT_TV_NSEC',
--                                headers='sys/stat.h')
-     # we need the st_rdev test under two names
-     conf.CHECK_STRUCTURE_MEMBER('struct stat', 'st_rdev',
-                                 define='HAVE_STRUCT_STAT_ST_RDEV',
-diff --git a/lib/util/time.c b/lib/util/time.c
-index 0fac5e2e397..b5c1d700b23 100644
---- a/lib/util/time.c
-+++ b/lib/util/time.c
-@@ -26,6 +26,10 @@
- #include "byteorder.h"
- #include "time_basic.h"
- #include "lib/util/time.h" /* Avoid /usr/include/time.h */
-+#include <sys/stat.h>
-+#ifndef NO_CONFIG_H
-+#include "config.h"
-+#endif
- 
- /**
-  * @file
-@@ -1232,3 +1236,229 @@ struct timespec time_t_to_full_timespec(time_t t)
- 	}
- 	return (struct timespec){.tv_sec = t};
- }
-+
-+#if !defined(HAVE_STAT_HIRES_TIMESTAMPS)
-+
-+/* Old system - no ns timestamp. */
-+time_t get_atimensec(const struct stat *st)
-+{
-+	return 0;
-+}
-+
-+time_t get_mtimensec(const struct stat *st)
-+{
-+	return 0;
-+}
-+
-+time_t get_ctimensec(const struct stat *st)
-+{
-+	return 0;
-+}
-+
-+/* Set does nothing with no ns timestamp. */
-+void set_atimensec(struct stat *st, time_t ns)
-+{
-+	return;
-+}
-+
-+void set_mtimensec(struct stat *st, time_t ns)
-+{
-+	return;
-+}
-+
-+void set_ctimensec(struct stat *st, time_t ns)
-+{
-+	return;
-+}
-+
-+#elif HAVE_STRUCT_STAT_ST_MTIMESPEC_TV_NSEC
-+
-+time_t get_atimensec(const struct stat *st)
-+{
-+	return st->st_atimespec.tv_nsec;
-+}
-+
-+time_t get_mtimensec(const struct stat *st)
-+{
-+	return st->st_mtimespec.tv_nsec;
-+}
-+
-+time_t get_ctimensec(const struct stat *st)
-+{
-+	return st->st_ctimespec.tv_nsec;
-+}
-+
-+void set_atimensec(struct stat *st, time_t ns)
-+{
-+	st->st_atimespec.tv_nsec = ns;
-+}
-+
-+void set_mtimensec(struct stat *st, time_t ns)
-+{
-+	st->st_mtimespec.tv_nsec = ns;
-+}
-+
-+void set_ctimensec(struct stat *st, time_t ns)
-+{
-+	st->st_ctimespec.tv_nsec = ns;
-+}
-+
-+#elif HAVE_STRUCT_STAT_ST_MTIM_TV_NSEC
-+
-+time_t get_atimensec(const struct stat *st)
-+{
-+	return st->st_atim.tv_nsec;
-+}
-+
-+time_t get_mtimensec(const struct stat *st)
-+{
-+	return st->st_mtim.tv_nsec;
-+}
-+
-+time_t get_ctimensec(const struct stat *st)
-+{
-+	return st->st_ctim.tv_nsec;
-+}
-+
-+void set_atimensec(struct stat *st, time_t ns)
-+{
-+	st->st_atim.tv_nsec = ns;
-+}
-+
-+void set_mtimensec(struct stat *st, time_t ns)
-+{
-+	st->st_mtim.tv_nsec = ns;
-+}
-+void set_ctimensec(struct stat *st, time_t ns)
-+{
-+	st->st_ctim.tv_nsec = ns;
-+}
-+
-+#elif HAVE_STRUCT_STAT_ST_MTIMENSEC
-+
-+time_t get_atimensec(const struct stat *st)
-+{
-+	return st->st_atimensec;
-+}
-+
-+time_t get_mtimensec(const struct stat *st)
-+{
-+	return st->st_mtimensec;
-+}
-+
-+time_t get_ctimensec(const struct stat *st)
-+{
-+	return st->st_ctimensec;
-+}
-+
-+void set_atimensec(struct stat *st, time_t ns)
-+{
-+	st->st_atimensec = ns;
-+}
-+
-+void set_mtimensec(struct stat *st, time_t ns)
-+{
-+	st->st_mtimensec = ns;
-+}
-+
-+void set_ctimensec(struct stat *st, time_t ns)
-+{
-+	st->st_ctimensec = ns;
-+}
-+
-+#elif HAVE_STRUCT_STAT_ST_MTIME_N
-+
-+time_t get_atimensec(const struct stat *st)
-+{
-+	return st->st_atime_n;
-+}
-+
-+time_t get_mtimensec(const struct stat *st)
-+{
-+	return st->st_mtime_n;
-+}
-+
-+time_t get_ctimensec(const struct stat *st)
-+{
-+	return st->st_ctime_n;
-+}
-+
-+void set_atimensec(struct stat *st, time_t ns)
-+{
-+	st->st_atime_n = ns;
-+}
-+
-+void set_mtimensec(struct stat *st, time_t ns)
-+{
-+	st->st_mtime_n = ns;
-+}
-+
-+void set_ctimensec(struct stat *st, time_t ns)
-+{
-+	st->st_ctime_n = ns;
-+}
-+
-+#elif HAVE_STRUCT_STAT_ST_UMTIME
-+
-+/* Only usec timestamps available. Convert to/from nsec. */
-+
-+time_t get_atimensec(const struct stat *st)
-+{
-+	return st->st_uatime * 1000;
-+}
-+
-+time_t get_mtimensec(const struct stat *st)
-+{
-+	return st->st_umtime * 1000;
-+}
-+
-+time_t get_ctimensec(const struct stat *st)
-+{
-+	return st->st_uctime * 1000;
-+}
-+
-+void set_atimensec(struct stat *st, time_t ns)
-+{
-+	st->st_uatime = ns / 1000;
-+}
-+
-+void set_mtimensec(struct stat *st, time_t ns)
-+{
-+	st->st_umtime = ns / 1000;
-+}
-+
-+void set_ctimensec(struct stat *st, time_t ns)
-+{
-+	st->st_uctime = ns / 1000;
-+}
-+
-+#else
-+#error CONFIGURE_ERROR_IN_DETECTING_TIMESPEC_IN_STAT
-+#endif
-+
-+struct timespec get_atimespec(const struct stat *pst)
-+{
-+	struct timespec ret;
-+
-+	ret.tv_sec = pst->st_atime;
-+	ret.tv_nsec = get_atimensec(pst);
-+	return ret;
-+}
-+
-+struct timespec get_mtimespec(const struct stat *pst)
-+{
-+	struct timespec ret;
-+
-+	ret.tv_sec = pst->st_mtime;
-+	ret.tv_nsec = get_mtimensec(pst);
-+	return ret;
-+}
-+
-+struct timespec get_ctimespec(const struct stat *pst)
-+{
-+	struct timespec ret;
-+
-+	ret.tv_sec = pst->st_mtime;
-+	ret.tv_nsec = get_ctimensec(pst);
-+	return ret;
-+}
-diff --git a/lib/util/time.h b/lib/util/time.h
-index 4a90b40d5ce..04945b5f25f 100644
---- a/lib/util/time.h
-+++ b/lib/util/time.h
-@@ -375,4 +375,22 @@ time_t full_timespec_to_time_t(const struct timespec *ts);
- time_t nt_time_to_full_time_t(NTTIME nt);
- struct timespec time_t_to_full_timespec(time_t t);
- 
-+/*
-+ * Functions to get and set the number of nanoseconds for times in a stat field.
-+ * If the stat has timestamp granularity less than nanosecond, then the set_*
-+ * operations will be lossy.
-+ */
-+struct stat;
-+time_t get_atimensec(const struct stat *);
-+time_t get_mtimensec(const struct stat *);
-+time_t get_ctimensec(const struct stat *);
-+void set_atimensec(struct stat *, time_t);
-+void set_mtimensec(struct stat *, time_t);
-+void set_ctimensec(struct stat *, time_t);
-+
-+/* These are convenience wrappers for the above getters. */
-+struct timespec get_atimespec(const struct stat *);
-+struct timespec get_mtimespec(const struct stat *);
-+struct timespec get_ctimespec(const struct stat *);
-+
- #endif /* _SAMBA_TIME_H_ */
-diff --git a/source3/lib/system.c b/source3/lib/system.c
-index f1265e0c43f..7c8cd19d11f 100644
---- a/source3/lib/system.c
-+++ b/source3/lib/system.c
-@@ -25,7 +25,8 @@
- #include "system/capability.h"
- #include "system/passwd.h"
- #include "system/filesys.h"
--#include "../lib/util/setid.h"
-+#include "lib/util/setid.h"
-+#include "lib/util/time.h"
- 
- #ifdef HAVE_SYS_SYSCTL_H
- #include <sys/sysctl.h>
-@@ -122,124 +123,6 @@ int sys_fcntl_int(int fd, int cmd, int arg)
- 	return ret;
- }
- 
--/****************************************************************************
-- Get/Set all the possible time fields from a stat struct as a timespec.
--****************************************************************************/
--
--static struct timespec get_atimespec(const struct stat *pst)
--{
--#if !defined(HAVE_STAT_HIRES_TIMESTAMPS)
--	struct timespec ret;
--
--	/* Old system - no ns timestamp. */
--	ret.tv_sec = pst->st_atime;
--	ret.tv_nsec = 0;
--	return ret;
--#else
--#if defined(HAVE_STRUCT_STAT_ST_MTIM_TV_NSEC)
--	struct timespec ret;
--	ret.tv_sec = pst->st_atim.tv_sec;
--	ret.tv_nsec = pst->st_atim.tv_nsec;
--	return ret;
--#elif defined(HAVE_STRUCT_STAT_ST_MTIMENSEC)
--	struct timespec ret;
--	ret.tv_sec = pst->st_atime;
--	ret.tv_nsec = pst->st_atimensec;
--	return ret;
--#elif defined(HAVE_STRUCT_STAT_ST_MTIME_N)
--	struct timespec ret;
--	ret.tv_sec = pst->st_atime;
--	ret.tv_nsec = pst->st_atime_n;
--	return ret;
--#elif defined(HAVE_STRUCT_STAT_ST_UMTIME)
--	struct timespec ret;
--	ret.tv_sec = pst->st_atime;
--	ret.tv_nsec = pst->st_uatime * 1000;
--	return ret;
--#elif defined(HAVE_STRUCT_STAT_ST_MTIMESPEC_TV_NSEC)
--	return pst->st_atimespec;
--#else
--#error	CONFIGURE_ERROR_IN_DETECTING_TIMESPEC_IN_STAT
--#endif
--#endif
--}
--
--static struct timespec get_mtimespec(const struct stat *pst)
--{
--#if !defined(HAVE_STAT_HIRES_TIMESTAMPS)
--	struct timespec ret;
--
--	/* Old system - no ns timestamp. */
--	ret.tv_sec = pst->st_mtime;
--	ret.tv_nsec = 0;
--	return ret;
--#else
--#if defined(HAVE_STRUCT_STAT_ST_MTIM_TV_NSEC)
--	struct timespec ret;
--	ret.tv_sec = pst->st_mtim.tv_sec;
--	ret.tv_nsec = pst->st_mtim.tv_nsec;
--	return ret;
--#elif defined(HAVE_STRUCT_STAT_ST_MTIMENSEC)
--	struct timespec ret;
--	ret.tv_sec = pst->st_mtime;
--	ret.tv_nsec = pst->st_mtimensec;
--	return ret;
--#elif defined(HAVE_STRUCT_STAT_ST_MTIME_N)
--	struct timespec ret;
--	ret.tv_sec = pst->st_mtime;
--	ret.tv_nsec = pst->st_mtime_n;
--	return ret;
--#elif defined(HAVE_STRUCT_STAT_ST_UMTIME)
--	struct timespec ret;
--	ret.tv_sec = pst->st_mtime;
--	ret.tv_nsec = pst->st_umtime * 1000;
--	return ret;
--#elif defined(HAVE_STRUCT_STAT_ST_MTIMESPEC_TV_NSEC)
--	return pst->st_mtimespec;
--#else
--#error	CONFIGURE_ERROR_IN_DETECTING_TIMESPEC_IN_STAT
--#endif
--#endif
--}
--
--static struct timespec get_ctimespec(const struct stat *pst)
--{
--#if !defined(HAVE_STAT_HIRES_TIMESTAMPS)
--	struct timespec ret;
--
--	/* Old system - no ns timestamp. */
--	ret.tv_sec = pst->st_ctime;
--	ret.tv_nsec = 0;
--	return ret;
--#else
--#if defined(HAVE_STRUCT_STAT_ST_MTIM_TV_NSEC)
--	struct timespec ret;
--	ret.tv_sec = pst->st_ctim.tv_sec;
--	ret.tv_nsec = pst->st_ctim.tv_nsec;
--	return ret;
--#elif defined(HAVE_STRUCT_STAT_ST_MTIMENSEC)
--	struct timespec ret;
--	ret.tv_sec = pst->st_ctime;
--	ret.tv_nsec = pst->st_ctimensec;
--	return ret;
--#elif defined(HAVE_STRUCT_STAT_ST_MTIME_N)
--	struct timespec ret;
--	ret.tv_sec = pst->st_ctime;
--	ret.tv_nsec = pst->st_ctime_n;
--	return ret;
--#elif defined(HAVE_STRUCT_STAT_ST_UMTIME)
--	struct timespec ret;
--	ret.tv_sec = pst->st_ctime;
--	ret.tv_nsec = pst->st_uctime * 1000;
--	return ret;
--#elif defined(HAVE_STRUCT_STAT_ST_MTIMESPEC_TV_NSEC)
--	return pst->st_ctimespec;
--#else
--#error	CONFIGURE_ERROR_IN_DETECTING_TIMESPEC_IN_STAT
--#endif
--#endif
--}
--
- /****************************************************************************
-  Return the best approximation to a 'create time' under UNIX from a stat
-  structure.
-diff --git a/source3/libsmb/libsmb_stat.c b/source3/libsmb/libsmb_stat.c
-index 790934bd565..b01aeb51ac1 100644
---- a/source3/libsmb/libsmb_stat.c
-+++ b/source3/libsmb/libsmb_stat.c
-@@ -27,6 +27,7 @@
- #include "libsmbclient.h"
- #include "libsmb_internal.h"
- #include "../libcli/smb/smbXcli_base.h"
-+#include "lib/util/time.h"
- 
- /*
-  * Generate an inode number from file name for those things that need it
-@@ -102,18 +103,29 @@ void setup_stat(struct stat *st,
- 	}
- 
- 	st->st_dev = dev;
--	st->st_atim = access_time_ts;
--	st->st_ctim = change_time_ts;
--	st->st_mtim = write_time_ts;
-+
-+	st->st_atime = access_time_ts.tv_sec;
-+	set_atimensec(st, access_time_ts.tv_nsec);
-+
-+	st->st_ctime = change_time_ts.tv_sec;
-+	set_ctimensec(st, change_time_ts.tv_nsec);
-+
-+	st->st_mtime = write_time_ts.tv_sec;
-+	set_mtimensec(st, write_time_ts.tv_nsec);
- }
- 
- void setup_stat_from_stat_ex(const struct stat_ex *stex,
- 			     const char *fname,
- 			     struct stat *st)
- {
--	st->st_atim = stex->st_ex_atime;
--	st->st_ctim = stex->st_ex_ctime;
--	st->st_mtim = stex->st_ex_mtime;
-+	st->st_atime = stex->st_ex_atime.tv_sec;
-+	set_atimensec(st, stex->st_ex_atime.tv_nsec);
-+
-+	st->st_ctime = stex->st_ex_ctime.tv_sec;
-+	set_ctimensec(st, stex->st_ex_ctime.tv_nsec);
-+
-+	st->st_mtime = stex->st_ex_mtime.tv_sec;
-+	set_mtimensec(st, stex->st_ex_mtime.tv_nsec);
- 
- 	st->st_mode = stex->st_ex_mode;
- 	st->st_size = stex->st_ex_size;
-diff --git a/source4/ntvfs/posix/pvfs_fileinfo.c b/source4/ntvfs/posix/pvfs_fileinfo.c
-index d2e2aeea265..977ea4fa3d5 100644
---- a/source4/ntvfs/posix/pvfs_fileinfo.c
-+++ b/source4/ntvfs/posix/pvfs_fileinfo.c
-@@ -21,6 +21,7 @@
- 
- #include "includes.h"
- #include "vfs_posix.h"
-+#include "lib/util/time.h"
- 
- /****************************************************************************
-  Change a unix mode to a dos mode.
-@@ -72,12 +73,10 @@ NTSTATUS pvfs_fill_dos_info(struct pvfs_state *pvfs, struct pvfs_filename *name,
- 	unix_to_nt_time(&name->dos.access_time, name->st.st_atime);
- 	unix_to_nt_time(&name->dos.write_time,  name->st.st_mtime);
- 	unix_to_nt_time(&name->dos.change_time, name->st.st_ctime);
--#ifdef HAVE_STAT_TV_NSEC
--	name->dos.create_time += name->st.st_ctim.tv_nsec / 100;
--	name->dos.access_time += name->st.st_atim.tv_nsec / 100;
--	name->dos.write_time  += name->st.st_mtim.tv_nsec / 100;
--	name->dos.change_time += name->st.st_ctim.tv_nsec / 100;
--#endif
-+	name->dos.create_time += get_ctimensec(&name->st) / 100;
-+	name->dos.access_time += get_atimensec(&name->st) / 100;
-+	name->dos.write_time  += get_mtimensec(&name->st) / 100;
-+	name->dos.change_time += get_ctimensec(&name->st) / 100;
- 	name->dos.attrib = dos_mode_from_stat(pvfs, &name->st);
- 	name->dos.alloc_size = pvfs_round_alloc_size(pvfs, name->st.st_size);
- 	name->dos.nlink = name->st.st_nlink;
-diff --git a/source4/torture/libsmbclient/libsmbclient.c b/source4/torture/libsmbclient/libsmbclient.c
-index 3f3992593f9..4fbd759487b 100644
---- a/source4/torture/libsmbclient/libsmbclient.c
-+++ b/source4/torture/libsmbclient/libsmbclient.c
-@@ -27,6 +27,7 @@
- #include "lib/param/loadparm.h"
- #include "lib/param/param_global.h"
- #include "dynconfig.h"
-+#include "lib/util/time.h"
- 
- /* test string to compare with when debug_callback is called */
- #define TEST_STRING "smbc_setLogCallback test"
-@@ -1231,8 +1232,8 @@ static bool torture_libsmbclient_utimes(struct torture_context *tctx)
- 	ret = smbc_fstat(fhandle, &st);
- 	torture_assert_int_not_equal(tctx, ret, -1, "smbc_fstat failed");
- 
--	tbuf[0] = convert_timespec_to_timeval(st.st_atim);
--	tbuf[1] = convert_timespec_to_timeval(st.st_mtim);
-+	tbuf[0] = convert_timespec_to_timeval(get_atimespec(&st));
-+	tbuf[1] = convert_timespec_to_timeval(get_mtimespec(&st));
- 
- 	tbuf[1] = timeval_add(&tbuf[1], 0, 100000); /* 100 msec */
- 
-@@ -1244,7 +1245,7 @@ static bool torture_libsmbclient_utimes(struct torture_context *tctx)
- 
- 	torture_assert_int_equal(
- 		tctx,
--		st.st_mtim.tv_nsec / 1000,
-+		get_mtimensec(&st) / 1000,
- 		tbuf[1].tv_usec,
- 		"smbc_utimes did not update msec");
- 
--- 
-2.29.2
-
diff --git a/pkgs/servers/samba/4.x.nix b/pkgs/servers/samba/4.x.nix
index c540fb20d448..7beaeb20943d 100644
--- a/pkgs/servers/samba/4.x.nix
+++ b/pkgs/servers/samba/4.x.nix
@@ -44,11 +44,11 @@ with lib;
 
 stdenv.mkDerivation rec {
   pname = "samba";
-  version = "4.13.7";
+  version = "4.14.4";
 
   src = fetchurl {
     url = "mirror://samba/pub/samba/stable/${pname}-${version}.tar.gz";
-    sha256 = "1ajvr5hzl9kmrf77hb9c71zvnm8j0xgy40nqfjz4f407cw470zaf";
+    sha256 = "1fc9ix91hb1f35j69sk7rsi9pky2p0vsmw47s973bx801cm0kbw9";
   };
 
   outputs = [ "out" "dev" "man" ];
@@ -58,8 +58,6 @@ stdenv.mkDerivation rec {
     ./patch-source3__libads__kerberos_keytab.c.patch
     ./4.x-no-persistent-install-dynconfig.patch
     ./4.x-fix-makeflags-parsing.patch
-    # Backport, should be removed for version 4.14
-    ./0001-lib-util-Standardize-use-of-st_-acm-time-ns.patch
   ];
 
   nativeBuildInputs = [
diff --git a/pkgs/servers/sql/postgresql/ext/pg_partman.nix b/pkgs/servers/sql/postgresql/ext/pg_partman.nix
index fb690e96328d..d2e7dd37be15 100644
--- a/pkgs/servers/sql/postgresql/ext/pg_partman.nix
+++ b/pkgs/servers/sql/postgresql/ext/pg_partman.nix
@@ -2,7 +2,7 @@
 
 stdenv.mkDerivation rec {
   pname = "pg_partman";
-  version = "4.4.1";
+  version = "4.5.1";
 
   buildInputs = [ postgresql ];
 
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
     owner  = "pgpartman";
     repo   = pname;
     rev    = "refs/tags/v${version}";
-    sha256 = "sha256-jFG2Zna97FHZin2V3Cwy5JcdeFh09Yy/eoyHtcCorPA=";
+    sha256 = "182yqvgcpgw99swn7w516f6d1bid2gnmf6dfsgmldx5viz0d6vi0";
   };
 
   installPhase = ''
diff --git a/pkgs/servers/tailscale/default.nix b/pkgs/servers/tailscale/default.nix
index bd75a45154d6..be3b4209eb9e 100644
--- a/pkgs/servers/tailscale/default.nix
+++ b/pkgs/servers/tailscale/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "tailscale";
-  version = "1.8.5";
+  version = "1.8.6";
 
   src = fetchFromGitHub {
     owner = "tailscale";
     repo = "tailscale";
     rev = "v${version}";
-    sha256 = "0wr6zb8v5082gbh0isz8inmndvqfqgmh5bgaz8ij2id5qwx5znx6";
+    sha256 = "1h3ry4y62wwcv4z3yjqal4ch4xy40k9s3rq20lqs3r58kblnaxs2";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/servers/web-apps/discourse/action_mailer_ca_cert.patch b/pkgs/servers/web-apps/discourse/action_mailer_ca_cert.patch
index 83c44a466fac..3872eb751406 100644
--- a/pkgs/servers/web-apps/discourse/action_mailer_ca_cert.patch
+++ b/pkgs/servers/web-apps/discourse/action_mailer_ca_cert.patch
@@ -1,5 +1,5 @@
 diff --git a/config/environments/production.rb b/config/environments/production.rb
-index 75c3a69512..7fc374cd9d 100644
+index a523888a8d..422c2c1ee8 100644
 --- a/config/environments/production.rb
 +++ b/config/environments/production.rb
 @@ -32,6 +32,7 @@ Discourse::Application.configure do
diff --git a/pkgs/servers/web-apps/discourse/default.nix b/pkgs/servers/web-apps/discourse/default.nix
index 4bcbee1d4283..12ae858ea3a4 100644
--- a/pkgs/servers/web-apps/discourse/default.nix
+++ b/pkgs/servers/web-apps/discourse/default.nix
@@ -1,23 +1,24 @@
-{ stdenv, makeWrapper, runCommandNoCC, lib, nixosTests
-, fetchFromGitHub, bundlerEnv, ruby, replace, gzip, gnutar, git
+{ stdenv, makeWrapper, runCommandNoCC, lib, nixosTests, writeShellScript
+, fetchFromGitHub, bundlerEnv, ruby, replace, gzip, gnutar, git, cacert
 , util-linux, gawk, imagemagick, optipng, pngquant, libjpeg, jpegoptim
-, gifsicle, libpsl, redis, postgresql, which, brotli, procps
+, gifsicle, libpsl, redis, postgresql, which, brotli, procps, rsync
 , nodePackages, v8
 }:
 
 let
-  version = "2.6.5";
+  version = "2.7.0";
 
   src = fetchFromGitHub {
     owner = "discourse";
     repo = "discourse";
     rev = "v${version}";
-    sha256 = "sha256-JQUgHxs2Cl2LBpg/6JLhZxje4RmPREL1IPta84kXwPw=";
+    sha256 = "sha256-w26pwGDL2j7qbporUzZATgw7E//E6xwahCbXv35QNnc=";
   };
 
   runtimeDeps = [
     # For backups, themes and assets
     rubyEnv.wrappedRuby
+    rsync
     gzip
     gnutar
     git
@@ -65,24 +66,38 @@ let
         gems = import ./rubyEnv/gemset.nix;
       in
         gems // {
-          mini_racer = gems.mini_racer // {
-            buildInputs = [ v8 ];
-            dontBuild = false;
-            # The Ruby extension makefile generator assumes the source
-            # is C, when it's actually C++ ¯\_(ツ)_/¯
-            postPatch = ''
-              substituteInPlace ext/mini_racer_extension/extconf.rb \
-                --replace '" -std=c++0x"' \
-                          '" -x c++ -std=c++0x"'
-            '';
-          };
+          libv8-node =
+            let
+              noopScript = writeShellScript "noop" "exit 0";
+              linkFiles = writeShellScript "link-files" ''
+                cd ../..
+
+                mkdir -p vendor/v8/out.gn/libv8/obj/
+                ln -s "${v8}/lib/libv8.a" vendor/v8/out.gn/libv8/obj/libv8_monolith.a
+
+                ln -s ${v8}/include vendor/v8/include
+
+                mkdir -p ext/libv8-node
+                echo '--- !ruby/object:Libv8::Node::Location::Vendor {}' >ext/libv8-node/.location.yml
+              '';
+            in gems.libv8-node // {
+              dontBuild = false;
+              postPatch = ''
+                cp ${noopScript} libexec/build-libv8
+                cp ${noopScript} libexec/build-monolith
+                cp ${noopScript} libexec/download-node
+                cp ${noopScript} libexec/extract-node
+                cp ${linkFiles} libexec/inject-libv8
+              '';
+            };
           mini_suffix = gems.mini_suffix // {
             propagatedBuildInputs = [ libpsl ];
             dontBuild = false;
             # Use our libpsl instead of the vendored one, which isn't
-            # available for aarch64
+            # available for aarch64. It has to be called
+            # libpsl.x86_64.so or it isn't found.
             postPatch = ''
-              cp $(readlink -f ${libpsl}/lib/libpsl.so) vendor/libpsl.so
+              cp $(readlink -f ${libpsl}/lib/libpsl.so) vendor/libpsl.x86_64.so
             '';
           };
         };
@@ -111,6 +126,8 @@ let
     # run. This means that Redis and PostgreSQL has to be running and
     # database migrations performed.
     preBuild = ''
+      export SSL_CERT_FILE=${cacert}/etc/ssl/certs/ca-bundle.crt
+
       redis-server >/dev/null &
 
       initdb -A trust $NIX_BUILD_TOP/postgres >/dev/null
diff --git a/pkgs/servers/web-apps/discourse/disable_jhead.patch b/pkgs/servers/web-apps/discourse/disable_jhead.patch
index 709a1959d637..a7ee56ff1855 100644
--- a/pkgs/servers/web-apps/discourse/disable_jhead.patch
+++ b/pkgs/servers/web-apps/discourse/disable_jhead.patch
@@ -1,12 +1,12 @@
 diff --git a/lib/file_helper.rb b/lib/file_helper.rb
-index 162de9a40b..9ac8807e9d 100644
+index d87da5a85e..f5323292d7 100644
 --- a/lib/file_helper.rb
 +++ b/lib/file_helper.rb
-@@ -124,6 +124,7 @@ class FileHelper
-         jpegoptim: { strip: strip_image_metadata ? "all" : "none" },
-         jpegtran: false,
+@@ -127,6 +127,7 @@ class FileHelper
          jpegrecompress: false,
+         # Skip looking for gifsicle, svgo binaries
+         gifsicle: false,
 +        jhead: false,
+         svgo: false
        )
      end
-   end
diff --git a/pkgs/servers/web-apps/discourse/rubyEnv/Gemfile b/pkgs/servers/web-apps/discourse/rubyEnv/Gemfile
index cb86d7e4bacf..71ee3f910c0e 100644
--- a/pkgs/servers/web-apps/discourse/rubyEnv/Gemfile
+++ b/pkgs/servers/web-apps/discourse/rubyEnv/Gemfile
@@ -18,13 +18,13 @@ else
   # this allows us to include the bits of rails we use without pieces we do not.
   #
   # To issue a rails update bump the version number here
-  gem 'actionmailer', '6.0.3.3'
-  gem 'actionpack', '6.0.3.3'
-  gem 'actionview', '6.0.3.3'
-  gem 'activemodel', '6.0.3.3'
-  gem 'activerecord', '6.0.3.3'
-  gem 'activesupport', '6.0.3.3'
-  gem 'railties', '6.0.3.3'
+  gem 'actionmailer', '6.1.3.2'
+  gem 'actionpack', '6.1.3.2'
+  gem 'actionview', '6.1.3.2'
+  gem 'activemodel', '6.1.3.2'
+  gem 'activerecord', '6.1.3.2'
+  gem 'activesupport', '6.1.3.2'
+  gem 'railties', '6.1.3.2'
   gem 'sprockets-rails'
 end
 
@@ -40,7 +40,7 @@ gem 'actionview_precompiler', require: false
 
 gem 'seed-fu'
 
-gem 'mail', require: false
+gem 'mail', git: 'https://github.com/discourse/mail.git', require: false
 gem 'mini_mime'
 gem 'mini_suffix'
 
@@ -96,6 +96,7 @@ gem 'discourse_image_optim', require: 'image_optim'
 gem 'multi_json'
 gem 'mustache'
 gem 'nokogiri'
+gem 'loofah'
 gem 'css_parser', require: false
 
 gem 'omniauth'
@@ -132,6 +133,7 @@ gem 'rack-protection' # security
 gem 'cbor', require: false
 gem 'cose', require: false
 gem 'addressable'
+gem 'json_schemer'
 
 # Gems used only for assets and not required in production environments by default.
 # Allow everywhere for now cause we are allowing asset debugging in production
@@ -176,6 +178,7 @@ group :development do
   gem 'binding_of_caller'
   gem 'yaml-lint'
   gem 'annotate'
+  gem 'discourse_dev'
 end
 
 # this is an optional gem, it provides a high performance replacement
@@ -192,7 +195,6 @@ gem 'htmlentities', require: false
 #  If you want to amend mini profiler to do the monkey patches in the railties
 #  we are open to it. by deferring require to the initializer we can configure discourse installs without it
 
-gem 'flamegraph', require: false
 gem 'rack-mini-profiler', require: ['enable_rails_patches']
 
 gem 'unicorn', require: false, platform: :ruby
diff --git a/pkgs/servers/web-apps/discourse/rubyEnv/Gemfile.lock b/pkgs/servers/web-apps/discourse/rubyEnv/Gemfile.lock
index 4f0674932277..d3f999d34f47 100644
--- a/pkgs/servers/web-apps/discourse/rubyEnv/Gemfile.lock
+++ b/pkgs/servers/web-apps/discourse/rubyEnv/Gemfile.lock
@@ -1,21 +1,29 @@
+GIT
+  remote: https://github.com/discourse/mail.git
+  revision: 5b700fc95ee66378e0cf2559abc73c8bc3062a4b
+  specs:
+    mail (2.8.0.edge)
+      mini_mime (>= 0.1.1)
+
 GEM
   remote: https://rubygems.org/
   specs:
-    actionmailer (6.0.3.3)
-      actionpack (= 6.0.3.3)
-      actionview (= 6.0.3.3)
-      activejob (= 6.0.3.3)
+    actionmailer (6.1.3.2)
+      actionpack (= 6.1.3.2)
+      actionview (= 6.1.3.2)
+      activejob (= 6.1.3.2)
+      activesupport (= 6.1.3.2)
       mail (~> 2.5, >= 2.5.4)
       rails-dom-testing (~> 2.0)
-    actionpack (6.0.3.3)
-      actionview (= 6.0.3.3)
-      activesupport (= 6.0.3.3)
-      rack (~> 2.0, >= 2.0.8)
+    actionpack (6.1.3.2)
+      actionview (= 6.1.3.2)
+      activesupport (= 6.1.3.2)
+      rack (~> 2.0, >= 2.0.9)
       rack-test (>= 0.6.3)
       rails-dom-testing (~> 2.0)
       rails-html-sanitizer (~> 1.0, >= 1.2.0)
-    actionview (6.0.3.3)
-      activesupport (= 6.0.3.3)
+    actionview (6.1.3.2)
+      activesupport (= 6.1.3.2)
       builder (~> 3.1)
       erubi (~> 1.4)
       rails-dom-testing (~> 2.0)
@@ -24,44 +32,44 @@ GEM
       actionview (>= 6.0.a)
     active_model_serializers (0.8.4)
       activemodel (>= 3.0)
-    activejob (6.0.3.3)
-      activesupport (= 6.0.3.3)
+    activejob (6.1.3.2)
+      activesupport (= 6.1.3.2)
       globalid (>= 0.3.6)
-    activemodel (6.0.3.3)
-      activesupport (= 6.0.3.3)
-    activerecord (6.0.3.3)
-      activemodel (= 6.0.3.3)
-      activesupport (= 6.0.3.3)
-    activesupport (6.0.3.3)
+    activemodel (6.1.3.2)
+      activesupport (= 6.1.3.2)
+    activerecord (6.1.3.2)
+      activemodel (= 6.1.3.2)
+      activesupport (= 6.1.3.2)
+    activesupport (6.1.3.2)
       concurrent-ruby (~> 1.0, >= 1.0.2)
-      i18n (>= 0.7, < 2)
-      minitest (~> 5.1)
-      tzinfo (~> 1.1)
-      zeitwerk (~> 2.2, >= 2.2.2)
+      i18n (>= 1.6, < 2)
+      minitest (>= 5.1)
+      tzinfo (~> 2.0)
+      zeitwerk (~> 2.3)
     addressable (2.7.0)
       public_suffix (>= 2.0.2, < 5.0)
     annotate (3.1.1)
       activerecord (>= 3.2, < 7.0)
       rake (>= 10.4, < 14.0)
-    ast (2.4.1)
-    aws-eventstream (1.1.0)
-    aws-partitions (1.390.0)
-    aws-sdk-core (3.109.2)
+    ast (2.4.2)
+    aws-eventstream (1.1.1)
+    aws-partitions (1.432.0)
+    aws-sdk-core (3.112.1)
       aws-eventstream (~> 1, >= 1.0.2)
       aws-partitions (~> 1, >= 1.239.0)
       aws-sigv4 (~> 1.1)
       jmespath (~> 1.0)
-    aws-sdk-kms (1.39.0)
-      aws-sdk-core (~> 3, >= 3.109.0)
+    aws-sdk-kms (1.42.0)
+      aws-sdk-core (~> 3, >= 3.112.0)
       aws-sigv4 (~> 1.1)
-    aws-sdk-s3 (1.83.2)
-      aws-sdk-core (~> 3, >= 3.109.0)
+    aws-sdk-s3 (1.90.0)
+      aws-sdk-core (~> 3, >= 3.112.0)
       aws-sdk-kms (~> 1)
       aws-sigv4 (~> 1.1)
-    aws-sdk-sns (1.35.0)
-      aws-sdk-core (~> 3, >= 3.109.0)
+    aws-sdk-sns (1.38.0)
+      aws-sdk-core (~> 3, >= 3.112.0)
       aws-sigv4 (~> 1.1)
-    aws-sigv4 (1.2.2)
+    aws-sigv4 (1.2.3)
       aws-eventstream (~> 1, >= 1.0.2)
     barber (0.12.2)
       ember-source (>= 1.0, < 3.1)
@@ -70,31 +78,32 @@ GEM
       coderay (>= 1.0.0)
       erubi (>= 1.0.0)
       rack (>= 0.9.0)
-    binding_of_caller (0.8.0)
+    binding_of_caller (1.0.0)
       debug_inspector (>= 0.0.1)
-    bootsnap (1.5.1)
+    bootsnap (1.7.5)
       msgpack (~> 1.0)
     builder (3.2.4)
-    bullet (6.1.0)
+    bullet (6.1.4)
       activesupport (>= 3.0.0)
       uniform_notifier (~> 1.11)
     byebug (11.1.3)
     cbor (0.5.9.6)
     certified (1.0.0)
-    chunky_png (1.3.14)
+    chunky_png (1.4.0)
     coderay (1.1.3)
     colored2 (3.1.2)
-    concurrent-ruby (1.1.7)
-    connection_pool (2.2.3)
+    concurrent-ruby (1.1.8)
+    connection_pool (2.2.5)
     cose (1.2.0)
       cbor (~> 0.5.9)
       openssl-signature_algorithm (~> 1.0)
     cppjieba_rb (0.3.3)
-    crack (0.4.4)
+    crack (0.4.5)
+      rexml
     crass (1.0.6)
-    css_parser (1.7.1)
+    css_parser (1.9.0)
       addressable
-    debug_inspector (0.0.3)
+    debug_inspector (1.1.0)
     diff-lcs (1.4.4)
     diffy (3.4.0)
     discourse-ember-rails (0.18.6)
@@ -104,15 +113,19 @@ GEM
       ember-source (>= 1.1.0)
       jquery-rails (>= 1.0.17)
       railties (>= 3.1)
-    discourse-ember-source (3.12.2.2)
-    discourse-fonts (0.0.5)
+    discourse-ember-source (3.12.2.3)
+    discourse-fonts (0.0.8)
+    discourse_dev (0.2.1)
+      faker (~> 2.16)
     discourse_image_optim (0.26.2)
       exifr (~> 1.2, >= 1.2.2)
       fspath (~> 3.0)
       image_size (~> 1.5)
       in_threads (~> 1.3)
       progress (~> 3.0, >= 3.0.1)
-    docile (1.3.2)
+    docile (1.4.0)
+    ecma-re-validator (0.3.0)
+      regexp_parser (~> 2.0)
     email_reply_trimmer (0.1.13)
     ember-data-source (3.0.2)
       ember-source (>= 2, < 3.0)
@@ -121,31 +134,39 @@ GEM
       sprockets (>= 3.3, < 4.1)
     ember-source (2.18.2)
     erubi (1.10.0)
-    excon (0.78.0)
-    execjs (2.7.0)
+    excon (0.81.0)
+    execjs (2.8.1)
     exifr (1.3.9)
-    fabrication (2.21.1)
+    fabrication (2.22.0)
+    faker (2.17.0)
+      i18n (>= 1.6, < 2)
     fakeweb (1.3.0)
-    faraday (1.1.0)
+    faraday (1.4.1)
+      faraday-excon (~> 1.1)
+      faraday-net_http (~> 1.0)
+      faraday-net_http_persistent (~> 1.1)
       multipart-post (>= 1.2, < 3)
-      ruby2_keywords
+      ruby2_keywords (>= 0.0.4)
+    faraday-excon (1.1.0)
+    faraday-net_http (1.0.1)
+    faraday-net_http_persistent (1.1.0)
     fast_blank (1.0.0)
     fast_xs (0.8.0)
-    fastimage (2.2.0)
-    ffi (1.13.1)
-    flamegraph (0.9.5)
+    fastimage (2.2.3)
+    ffi (1.15.0)
     fspath (3.1.2)
     gc_tracer (1.5.1)
     globalid (0.4.2)
       activesupport (>= 4.2.0)
     guess_html_encoding (0.0.11)
+    hana (1.3.7)
     hashdiff (1.0.1)
     hashie (4.1.0)
     highline (2.0.3)
     hkdf (0.3.0)
     htmlentities (4.3.4)
     http_accept_language (2.1.1)
-    i18n (1.8.5)
+    i18n (1.8.10)
       concurrent-ruby (~> 1.0)
     image_size (1.5.0)
     in_threads (1.5.4)
@@ -154,13 +175,23 @@ GEM
       rails-dom-testing (>= 1, < 3)
       railties (>= 4.2.0)
       thor (>= 0.14, < 2.0)
-    json (2.3.1)
+    json (2.5.1)
     json-schema (2.8.1)
       addressable (>= 2.4)
-    jwt (2.2.2)
+    json_schemer (0.2.18)
+      ecma-re-validator (~> 0.3)
+      hana (~> 1.3)
+      regexp_parser (~> 2.0)
+      uri_template (~> 0.7)
+    jwt (2.2.3)
     kgio (2.11.3)
-    libv8 (8.4.255.0)
-    listen (3.3.1)
+    libv8-node (15.14.0.1)
+    libv8-node (15.14.0.1-arm64-darwin-20)
+    libv8-node (15.14.0.1-x86_64-darwin-18)
+    libv8-node (15.14.0.1-x86_64-darwin-19)
+    libv8-node (15.14.0.1-x86_64-darwin-20)
+    libv8-node (15.14.0.1-x86_64-linux)
+    listen (3.5.1)
       rb-fsevent (~> 0.10, >= 0.10.3)
       rb-inotify (~> 0.9, >= 0.9.10)
     lograge (0.11.2)
@@ -171,49 +202,49 @@ GEM
     logstash-event (1.2.02)
     logstash-logger (0.26.1)
       logstash-event (~> 1.2)
-    logster (2.9.4)
-    loofah (2.8.0)
+    logster (2.9.6)
+    loofah (2.9.1)
       crass (~> 1.0.2)
       nokogiri (>= 1.5.9)
     lru_redux (1.1.0)
     lz4-ruby (0.3.3)
-    mail (2.7.1)
-      mini_mime (>= 0.1.1)
     maxminddb (0.1.22)
-    memory_profiler (0.9.14)
-    message_bus (3.3.4)
+    memory_profiler (1.0.0)
+    message_bus (3.3.5)
       rack (>= 1.1.3)
     method_source (1.0.0)
-    mini_mime (1.0.2)
-    mini_portile2 (2.4.0)
-    mini_racer (0.3.1)
-      libv8 (~> 8.4.255)
-    mini_scheduler (0.12.3)
-      sidekiq
-    mini_sql (0.3)
-    mini_suffix (0.3.0)
+    mini_mime (1.1.0)
+    mini_portile2 (2.5.1)
+    mini_racer (0.4.0)
+      libv8-node (~> 15.14.0.0)
+    mini_scheduler (0.13.0)
+      sidekiq (>= 4.2.3)
+    mini_sql (1.1.3)
+    mini_suffix (0.3.2)
       ffi (~> 1.9)
-    minitest (5.14.2)
-    mocha (1.11.2)
-    mock_redis (0.26.0)
-    msgpack (1.3.3)
+    minitest (5.14.4)
+    mocha (1.12.0)
+    mock_redis (0.28.0)
+      ruby2_keywords
+    msgpack (1.4.2)
     multi_json (1.15.0)
     multi_xml (0.6.0)
     multipart-post (2.1.1)
     mustache (1.1.1)
-    nio4r (2.5.4)
-    nokogiri (1.10.10)
-      mini_portile2 (~> 2.4.0)
-    nokogumbo (2.0.2)
+    nio4r (2.5.7)
+    nokogiri (1.11.3)
+      mini_portile2 (~> 2.5.0)
+      racc (~> 1.4)
+    nokogumbo (2.0.5)
       nokogiri (~> 1.8, >= 1.8.4)
-    oauth (0.5.4)
-    oauth2 (1.4.4)
+    oauth (0.5.6)
+    oauth2 (1.4.7)
       faraday (>= 0.8, < 2.0)
       jwt (>= 1.0, < 3.0)
       multi_json (~> 1.3)
       multi_xml (~> 0.5)
       rack (>= 1.2, < 3)
-    oj (3.10.16)
+    oj (3.11.5)
     omniauth (1.9.1)
       hashie (>= 3.4.6)
       rack (>= 1.6.2, < 3)
@@ -222,35 +253,38 @@ GEM
     omniauth-github (1.4.0)
       omniauth (~> 1.5)
       omniauth-oauth2 (>= 1.4.0, < 2.0)
-    omniauth-google-oauth2 (0.8.0)
+    omniauth-google-oauth2 (0.8.2)
       jwt (>= 2.0)
-      omniauth (>= 1.1.1)
+      oauth2 (~> 1.1)
+      omniauth (~> 1.1)
       omniauth-oauth2 (>= 1.6)
-    omniauth-oauth (1.1.0)
+    omniauth-oauth (1.2.0)
       oauth
-      omniauth (~> 1.0)
-    omniauth-oauth2 (1.7.0)
+      omniauth (>= 1.0, < 3)
+    omniauth-oauth2 (1.7.1)
       oauth2 (~> 1.4)
-      omniauth (~> 1.9)
+      omniauth (>= 1.9, < 3)
     omniauth-twitter (1.4.0)
       omniauth-oauth (~> 1.1)
       rack
-    onebox (2.2.1)
+    onebox (2.2.15)
       addressable (~> 2.7.0)
       htmlentities (~> 4.3)
       multi_json (~> 1.11)
       mustache
       nokogiri (~> 1.7)
       sanitize
-    openssl-signature_algorithm (1.0.0)
+    openssl (2.2.0)
+    openssl-signature_algorithm (1.1.1)
+      openssl (~> 2.0)
     optimist (3.0.1)
     parallel (1.20.1)
-    parallel_tests (3.4.0)
+    parallel_tests (3.7.0)
       parallel
-    parser (2.7.2.0)
+    parser (3.0.1.1)
       ast (~> 2.4.1)
     pg (1.2.3)
-    progress (3.5.2)
+    progress (3.6.0)
     pry (0.13.1)
       coderay (~> 1.1)
       method_source (~> 1.0)
@@ -260,11 +294,12 @@ GEM
     pry-rails (0.3.9)
       pry (>= 0.10.4)
     public_suffix (4.0.6)
-    puma (5.0.4)
+    puma (5.3.1)
       nio4r (~> 2.0)
     r2 (0.2.7)
+    racc (1.5.2)
     rack (2.2.3)
-    rack-mini-profiler (2.2.0)
+    rack-mini-profiler (2.3.2)
       rack (>= 1.2.0)
     rack-protection (2.1.0)
       rack
@@ -275,23 +310,23 @@ GEM
       nokogiri (>= 1.6)
     rails-html-sanitizer (1.3.0)
       loofah (~> 2.3)
-    rails_failover (0.6.2)
+    rails_failover (0.7.3)
       activerecord (~> 6.0)
       concurrent-ruby
       railties (~> 6.0)
-    rails_multisite (2.5.0)
+    rails_multisite (3.0.0)
       activerecord (> 5.0, < 7)
       railties (> 5.0, < 7)
-    railties (6.0.3.3)
-      actionpack (= 6.0.3.3)
-      activesupport (= 6.0.3.3)
+    railties (6.1.3.2)
+      actionpack (= 6.1.3.2)
+      activesupport (= 6.1.3.2)
       method_source
       rake (>= 0.8.7)
-      thor (>= 0.20.3, < 2.0)
+      thor (~> 1.0)
     rainbow (3.0.0)
     raindrops (0.19.1)
-    rake (13.0.1)
-    rb-fsevent (0.10.4)
+    rake (13.0.3)
+    rb-fsevent (0.11.0)
     rb-inotify (0.10.1)
       ffi (~> 1.0)
     rbtrace (0.4.14)
@@ -300,72 +335,72 @@ GEM
       optimist (>= 3.0.0)
     rchardet (1.8.0)
     redis (4.2.5)
-    redis-namespace (1.8.0)
+    redis-namespace (1.8.1)
       redis (>= 3.0.4)
-    regexp_parser (2.0.0)
+    regexp_parser (2.1.1)
     request_store (1.5.0)
       rack (>= 1.4)
-    rexml (3.2.4)
+    rexml (3.2.5)
     rinku (2.0.6)
     rotp (6.2.0)
-    rqrcode (1.1.2)
+    rqrcode (2.0.0)
       chunky_png (~> 1.0)
-      rqrcode_core (~> 0.1)
-    rqrcode_core (0.1.2)
+      rqrcode_core (~> 1.0)
+    rqrcode_core (1.0.0)
     rspec (3.10.0)
       rspec-core (~> 3.10.0)
       rspec-expectations (~> 3.10.0)
       rspec-mocks (~> 3.10.0)
-    rspec-core (3.10.0)
+    rspec-core (3.10.1)
       rspec-support (~> 3.10.0)
-    rspec-expectations (3.10.0)
+    rspec-expectations (3.10.1)
       diff-lcs (>= 1.2.0, < 2.0)
       rspec-support (~> 3.10.0)
     rspec-html-matchers (0.9.4)
       nokogiri (~> 1)
       rspec (>= 3.0.0.a, < 4)
-    rspec-mocks (3.10.0)
+    rspec-mocks (3.10.2)
       diff-lcs (>= 1.2.0, < 2.0)
       rspec-support (~> 3.10.0)
-    rspec-rails (4.0.1)
-      actionpack (>= 4.2)
-      activesupport (>= 4.2)
-      railties (>= 4.2)
-      rspec-core (~> 3.9)
-      rspec-expectations (~> 3.9)
-      rspec-mocks (~> 3.9)
-      rspec-support (~> 3.9)
-    rspec-support (3.10.0)
-    rswag-specs (2.3.1)
+    rspec-rails (5.0.1)
+      actionpack (>= 5.2)
+      activesupport (>= 5.2)
+      railties (>= 5.2)
+      rspec-core (~> 3.10)
+      rspec-expectations (~> 3.10)
+      rspec-mocks (~> 3.10)
+      rspec-support (~> 3.10)
+    rspec-support (3.10.2)
+    rswag-specs (2.4.0)
       activesupport (>= 3.1, < 7.0)
       json-schema (~> 2.2)
       railties (>= 3.1, < 7.0)
     rtlit (0.0.5)
-    rubocop (1.4.2)
+    rubocop (1.14.0)
       parallel (~> 1.10)
-      parser (>= 2.7.1.5)
+      parser (>= 3.0.0.0)
       rainbow (>= 2.2.2, < 4.0)
-      regexp_parser (>= 1.8)
+      regexp_parser (>= 1.8, < 3.0)
       rexml
-      rubocop-ast (>= 1.1.1)
+      rubocop-ast (>= 1.5.0, < 2.0)
       ruby-progressbar (~> 1.7)
-      unicode-display_width (>= 1.4.0, < 2.0)
-    rubocop-ast (1.2.0)
-      parser (>= 2.7.1.5)
+      unicode-display_width (>= 1.4.0, < 3.0)
+    rubocop-ast (1.5.0)
+      parser (>= 3.0.1.1)
     rubocop-discourse (2.4.1)
       rubocop (>= 1.1.0)
       rubocop-rspec (>= 2.0.0)
-    rubocop-rspec (2.0.0)
+    rubocop-rspec (2.3.0)
       rubocop (~> 1.0)
       rubocop-ast (>= 1.1.0)
-    ruby-prof (1.4.2)
-    ruby-progressbar (1.10.1)
+    ruby-prof (1.4.3)
+    ruby-progressbar (1.11.0)
     ruby-readability (0.7.0)
       guess_html_encoding (>= 0.0.4)
       nokogiri (>= 1.6.0)
-    ruby2_keywords (0.0.2)
+    ruby2_keywords (0.0.4)
     rubyzip (2.3.0)
-    sanitize (5.2.1)
+    sanitize (5.2.3)
       crass (~> 1.0.2)
       nokogiri (>= 1.8.0)
       nokogumbo (~> 2.0)
@@ -381,18 +416,18 @@ GEM
     seed-fu (2.3.9)
       activerecord (>= 3.1)
       activesupport (>= 3.1)
-    shoulda-matchers (4.4.1)
+    shoulda-matchers (4.5.1)
       activesupport (>= 4.2.0)
-    sidekiq (6.1.2)
+    sidekiq (6.2.1)
       connection_pool (>= 2.2.2)
       rack (~> 2.0)
       redis (>= 4.2.0)
-    simplecov (0.20.0)
+    simplecov (0.21.2)
       docile (~> 1.1)
       simplecov-html (~> 0.11)
       simplecov_json_formatter (~> 0.1)
     simplecov-html (0.12.3)
-    simplecov_json_formatter (0.1.2)
+    simplecov_json_formatter (0.1.3)
     sprockets (3.7.2)
       concurrent-ruby (~> 1.0)
       rack (> 1, < 3)
@@ -401,24 +436,24 @@ GEM
       activesupport (>= 4.0)
       sprockets (>= 3.0.0)
     sshkey (2.0.0)
-    stackprof (0.2.16)
-    test-prof (0.12.2)
-    thor (1.0.1)
-    thread_safe (0.3.6)
+    stackprof (0.2.17)
+    test-prof (1.0.5)
+    thor (1.1.0)
     tilt (2.0.10)
-    tzinfo (1.2.8)
-      thread_safe (~> 0.1)
+    tzinfo (2.0.4)
+      concurrent-ruby (~> 1.0)
     uglifier (4.2.0)
       execjs (>= 0.3.0, < 3)
     unf (0.1.4)
       unf_ext
     unf_ext (0.0.7.7)
-    unicode-display_width (1.7.0)
-    unicorn (5.7.0)
+    unicode-display_width (2.0.0)
+    unicorn (6.0.0)
       kgio (~> 2.6)
       raindrops (~> 0.7)
-    uniform_notifier (1.13.0)
-    webmock (3.10.0)
+    uniform_notifier (1.14.2)
+    uri_template (0.7.0)
+    webmock (3.12.2)
       addressable (>= 2.3.6)
       crack (>= 0.3.2)
       hashdiff (>= 0.4.0, < 2.0.0)
@@ -427,20 +462,25 @@ GEM
       jwt (~> 2.0)
     xorcist (1.1.2)
     yaml-lint (0.0.10)
-    zeitwerk (2.4.1)
+    zeitwerk (2.4.2)
 
 PLATFORMS
+  arm64-darwin-20
   ruby
+  x86_64-darwin-18
+  x86_64-darwin-19
+  x86_64-darwin-20
+  x86_64-linux
 
 DEPENDENCIES
-  actionmailer (= 6.0.3.3)
-  actionpack (= 6.0.3.3)
-  actionview (= 6.0.3.3)
+  actionmailer (= 6.1.3.2)
+  actionpack (= 6.1.3.2)
+  actionview (= 6.1.3.2)
   actionview_precompiler
   active_model_serializers (~> 0.8.3)
-  activemodel (= 6.0.3.3)
-  activerecord (= 6.0.3.3)
-  activesupport (= 6.0.3.3)
+  activemodel (= 6.1.3.2)
+  activerecord (= 6.1.3.2)
+  activesupport (= 6.1.3.2)
   addressable
   annotate
   aws-sdk-s3
@@ -461,6 +501,7 @@ DEPENDENCIES
   discourse-ember-rails (= 0.18.6)
   discourse-ember-source (~> 3.12.2)
   discourse-fonts
+  discourse_dev
   discourse_image_optim
   email_reply_trimmer
   ember-handlebars-template (= 0.8.0)
@@ -471,20 +512,21 @@ DEPENDENCIES
   fast_blank
   fast_xs
   fastimage
-  flamegraph
   gc_tracer
   highline
   htmlentities
   http_accept_language
   json
+  json_schemer
   listen
   lograge
   logstash-event
   logstash-logger
   logster
+  loofah
   lru_redux
   lz4-ruby
-  mail
+  mail!
   maxminddb
   memory_profiler
   message_bus
@@ -518,7 +560,7 @@ DEPENDENCIES
   rack-protection
   rails_failover
   rails_multisite
-  railties (= 6.0.3.3)
+  railties (= 6.1.3.2)
   rake
   rb-fsevent
   rbtrace
@@ -558,4 +600,4 @@ DEPENDENCIES
   yaml-lint
 
 BUNDLED WITH
-   2.1.4
+   2.2.16
diff --git a/pkgs/servers/web-apps/discourse/rubyEnv/gemset.nix b/pkgs/servers/web-apps/discourse/rubyEnv/gemset.nix
index b2cf191a4444..4b3ce8ce2192 100644
--- a/pkgs/servers/web-apps/discourse/rubyEnv/gemset.nix
+++ b/pkgs/servers/web-apps/discourse/rubyEnv/gemset.nix
@@ -1,14 +1,14 @@
 {
   actionmailer = {
-    dependencies = ["actionpack" "actionview" "activejob" "mail" "rails-dom-testing"];
+    dependencies = ["actionpack" "actionview" "activejob" "activesupport" "mail" "rails-dom-testing"];
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1spq0dbfn0qkqg9sq0rsjn360b4j36zly8hawaivkrwr3rsvyz75";
+      sha256 = "1nqdaykzgib8fsldkxdkw0w44jzz4grvb028crzg0qpwvv03g2wp";
       type = "gem";
     };
-    version = "6.0.3.3";
+    version = "6.1.3.2";
   };
   actionpack = {
     dependencies = ["actionview" "activesupport" "rack" "rack-test" "rails-dom-testing" "rails-html-sanitizer"];
@@ -16,10 +16,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1p873nqwmpsvmkb5n86d70wndx1qhy15pc9mbcd1mc8sj174578b";
+      sha256 = "1wdgv5llgbl4nayx5j78lfvhhjssrzfmypb45mjy37mgm8z5l5m5";
       type = "gem";
     };
-    version = "6.0.3.3";
+    version = "6.1.3.2";
   };
   actionview = {
     dependencies = ["activesupport" "builder" "erubi" "rails-dom-testing" "rails-html-sanitizer"];
@@ -27,10 +27,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "08pvmjddlw01q5r9zdfgddwp4csndpf5i2w47677z5r36jznz36q";
+      sha256 = "1r6db2g3fsrca1hp9kbyvjx9psipsxw0g306qharkcblxl8h1ysn";
       type = "gem";
     };
-    version = "6.0.3.3";
+    version = "6.1.3.2";
   };
   actionview_precompiler = {
     dependencies = ["actionview"];
@@ -60,10 +60,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0w54ckvc229iaax879hkhyc93j7z8p0v7acp6mk3h8xjfvmwy5jp";
+      sha256 = "0p80rbahcxhxlkxgf4bh580hbifn9q4gr5g9fy8fd0z5g6gr9xxq";
       type = "gem";
     };
-    version = "6.0.3.3";
+    version = "6.1.3.2";
   };
   activemodel = {
     dependencies = ["activesupport"];
@@ -71,10 +71,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "166jlx6kbby01vr37srh081a9fykgsz873yg5i9gl2ar3vw9gs56";
+      sha256 = "1gpd3hh4ryyr84drj6m0b5sy6929nyf50bfgksw1hpc594542nal";
       type = "gem";
     };
-    version = "6.0.3.3";
+    version = "6.1.3.2";
   };
   activerecord = {
     dependencies = ["activemodel" "activesupport"];
@@ -82,10 +82,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0y2a4ss6ld6yrhpcbcb3kjn5gj6zk9qklp2aq5rl1awl8vbdbdb7";
+      sha256 = "0fg58qma2zgrz0gr61p61qcz8c3h88fd5lbdrkpkm96aq5shwh68";
       type = "gem";
     };
-    version = "6.0.3.3";
+    version = "6.1.3.2";
   };
   activesupport = {
     dependencies = ["concurrent-ruby" "i18n" "minitest" "tzinfo" "zeitwerk"];
@@ -93,10 +93,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1dmkqbvndbz011a1byg6f990936vfadbnwjwjw9vjzr4kd8bxk96";
+      sha256 = "1csxddyhl6k773ycxjvmyshyr4g9jb1icbs3pnm7crnavqs4h1yr";
       type = "gem";
     };
-    version = "6.0.3.3";
+    version = "6.1.3.2";
   };
   addressable = {
     dependencies = ["public_suffix"];
@@ -125,30 +125,30 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1l3468czzjmxl93ap40hp7z94yxp4nbag0bxqs789bm30md90m2a";
+      sha256 = "04nc8x27hlzlrr5c2gn7mar4vdr0apw5xg22wp6m8dx3wqr04a0y";
       type = "gem";
     };
-    version = "2.4.1";
+    version = "2.4.2";
   };
   aws-eventstream = {
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0r0pn66yqrdkrfdin7qdim0yj2x75miyg4wp6mijckhzhrjb7cv5";
+      sha256 = "0jfki5ikfr8ln5cdgv4iv1643kax0bjpp29jh78chzy713274jh3";
       type = "gem";
     };
-    version = "1.1.0";
+    version = "1.1.1";
   };
   aws-partitions = {
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "17xranmng1mg6238zdmnfvaig82r2ymp2apra9yh5d8rhvn8hkwm";
+      sha256 = "0y0z25hgghy3i8azx0mn8pda2qvd47zkilwjps0x32zn091blzgg";
       type = "gem";
     };
-    version = "1.390.0";
+    version = "1.432.0";
   };
   aws-sdk-core = {
     dependencies = ["aws-eventstream" "aws-partitions" "aws-sigv4" "jmespath"];
@@ -156,10 +156,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "05dq7jfv5qf1y00ib96nqsipf08hflw8n8fwkyjw4qav84wjqaq4";
+      sha256 = "0r5f7pb9dh95f7cb4rdj1z766c88735y6y6msbgzak0v8g8j3dw9";
       type = "gem";
     };
-    version = "3.109.2";
+    version = "3.112.1";
   };
   aws-sdk-kms = {
     dependencies = ["aws-sdk-core" "aws-sigv4"];
@@ -167,10 +167,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0ly1m631qm2ciif7sysbzrgczjvz95ga3g6w6vrzvfdv31jjnl9a";
+      sha256 = "00wgf83cdy6z77b2y0ld0aqiidfyldi71hx0z8b73gxjdlbwpq1i";
       type = "gem";
     };
-    version = "1.39.0";
+    version = "1.42.0";
   };
   aws-sdk-s3 = {
     dependencies = ["aws-sdk-core" "aws-sdk-kms" "aws-sigv4"];
@@ -178,10 +178,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1mld0yh6q6i2nbb143g5xc6gm70sqpvpwxfknlihrd8jmw3xc0bs";
+      sha256 = "0sm1x1pm2wb8gj3p4yv45r7n8m4k3qawk3lrnd2lvk2vg5nyfh61";
       type = "gem";
     };
-    version = "1.83.2";
+    version = "1.90.0";
   };
   aws-sdk-sns = {
     dependencies = ["aws-sdk-core" "aws-sigv4"];
@@ -189,10 +189,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1dw80ldqhb1mny5irgi2jh36hykcmyd07xalv21xncxqzmf8aiag";
+      sha256 = "0cqri14igfmcxlapbagg0nmy79zzg29awzybv51gl76m3mljbafb";
       type = "gem";
     };
-    version = "1.35.0";
+    version = "1.38.0";
   };
   aws-sigv4 = {
     dependencies = ["aws-eventstream"];
@@ -200,10 +200,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1ll9382c1x2hp750cilh01h1cycgyhdr4cmmgx23k94hyyb8chv5";
+      sha256 = "1d9zhmi3mpfzkkpg7yw7s9r1dwk157kh9875j3c7gh6cy95lmmaw";
       type = "gem";
     };
-    version = "1.2.2";
+    version = "1.2.3";
   };
   barber = {
     dependencies = ["ember-source" "execjs"];
@@ -237,10 +237,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "05syqlks7463zsy1jdfbbdravdhj9hpj5pv2m74blqpv8bq4vv5g";
+      sha256 = "078n2dkpgsivcf0pr50981w95nfc2bsrp3wpf9wnxz1qsp8jbb9s";
       type = "gem";
     };
-    version = "0.8.0";
+    version = "1.0.0";
   };
   bootsnap = {
     dependencies = ["msgpack"];
@@ -252,10 +252,10 @@
     }];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1qx1f729bgh391agsqb4ngzn22wdn4cc6mkp0cipf0d5hsg9cpaq";
+      sha256 = "12n09iwpssnsfw9s140ynfxr9psd0xcfx42yqdsk0hq60zhq2nlx";
       type = "gem";
     };
-    version = "1.5.1";
+    version = "1.7.5";
   };
   builder = {
     groups = ["default" "development" "test"];
@@ -273,10 +273,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "18ifwnvn13755qkfigapyj5bflpby3phxzbb7x5336d0kzv5k7d9";
+      sha256 = "0r8d3vh1xjfx46qlv75228rkshzgqxpmf491vxzpicpqi1xad5ni";
       type = "gem";
     };
-    version = "6.1.0";
+    version = "6.1.4";
   };
   byebug = {
     groups = ["development" "test"];
@@ -317,10 +317,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1v52ndgx9r4jybq8yzr8anzfbnjk4y2hvz97nm9924wi4bad3xkf";
+      sha256 = "1znw5x86hmm9vfhidwdsijz8m38pqgmv98l9ryilvky0aldv7mc9";
       type = "gem";
     };
-    version = "1.3.14";
+    version = "1.4.0";
   };
   coderay = {
     groups = ["default" "development"];
@@ -351,20 +351,20 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1vnxrbhi7cq3p4y2v9iwd10v1c7l15is4var14hwnb2jip4fyjzz";
+      sha256 = "0mr23wq0szj52xnj0zcn1k0c7j4v79wlwbijkpfcscqww3l6jlg3";
       type = "gem";
     };
-    version = "1.1.7";
+    version = "1.1.8";
   };
   connection_pool = {
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1qikl4av1z8kqnk5ba18136dpqzw8wjawc2w9b4zb5psdd5z8nwf";
+      sha256 = "0ffdxhgirgc86qb42yvmfj6v1v0x4lvi0pxn9zhghkff44wzra0k";
       type = "gem";
     };
-    version = "2.2.3";
+    version = "2.2.5";
   };
   cose = {
     dependencies = ["cbor" "openssl-signature_algorithm"];
@@ -388,14 +388,15 @@
     version = "0.3.3";
   };
   crack = {
+    dependencies = ["rexml"];
     groups = ["default" "test"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1awi8jy4jn0f7vxpdvz3xvn1zzjbjh33n28lfkijh77dla5zb7lc";
+      sha256 = "1cr1kfpw3vkhysvkk3wg7c54m75kd68mbm9rs5azdjdq57xid13r";
       type = "gem";
     };
-    version = "0.4.4";
+    version = "0.4.5";
   };
   crass = {
     groups = ["default" "development" "test"];
@@ -413,20 +414,20 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "04c4dl8cm5rjr50k9qa6yl9r05fk9zcb1zxh0y0cdahxlsgcydfw";
+      sha256 = "0xs4ind9xd099rb52b73pch8ha143dl8bhivqsbba4wrvxpbx751";
       type = "gem";
     };
-    version = "1.7.1";
+    version = "1.9.0";
   };
   debug_inspector = {
     groups = ["default" "development"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0vxr0xa1mfbkfcrn71n7c4f2dj7la5hvphn904vh20j3x4j5lrx0";
+      sha256 = "01l678ng12rby6660pmwagmyg8nccvjfgs3487xna7ay378a59ga";
       type = "gem";
     };
-    version = "0.0.3";
+    version = "1.1.0";
   };
   diff-lcs = {
     groups = ["default" "development" "test"];
@@ -464,20 +465,31 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0mqkwiqb5n64lc5jdjnmpgb9apq08ywkz9yk8mj1sx2lqcsw11pc";
+      sha256 = "0q4wypjiqvjlwaif5z3pnv0z02rsiysx58d7iljrw8xx9sxwxn6x";
       type = "gem";
     };
-    version = "3.12.2.2";
+    version = "3.12.2.3";
   };
   discourse-fonts = {
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0xhwgqclh3jncjr55m0hyq3w3iw8jw2r7ickzq1zn1282pc3n2i7";
+      sha256 = "1gr1d80wmb1jvip82jlbsz5bcpwsz9lryxxfnwiw537vx8pqkk3p";
       type = "gem";
     };
-    version = "0.0.5";
+    version = "0.0.8";
+  };
+  discourse_dev = {
+    dependencies = ["faker"];
+    groups = ["development"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1sn2lcgjhsbqnaca97a37bfk249c55b3cn1q8abnf1am9jq5hdiw";
+      type = "gem";
+    };
+    version = "0.2.1";
   };
   discourse_image_optim = {
     dependencies = ["exifr" "fspath" "image_size" "in_threads" "progress"];
@@ -495,10 +507,21 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0qrwiyagxzl8zlx3dafb0ay8l14ib7imb2rsmx70i5cp420v8gif";
+      sha256 = "1lxqxgq71rqwj1lpl9q1mbhhhhhhdkkj7my341f2889pwayk85sz";
       type = "gem";
     };
-    version = "1.3.2";
+    version = "1.4.0";
+  };
+  ecma-re-validator = {
+    dependencies = ["regexp_parser"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1mz0nsl2093jd94nygw8qs13rwfwl1ax76xz3ypinr5hqbc5pab6";
+      type = "gem";
+    };
+    version = "0.3.0";
   };
   email_reply_trimmer = {
     groups = ["default"];
@@ -561,20 +584,20 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1hi89v53pm2abfv9j8lgqdd7hgkr7fr0gwrczr940iwbb3xv7rrs";
+      sha256 = "19g5nvkycnkzqq4mqn1zjznq9adrlv2jz0dr9w10cbn42hhqpiz7";
       type = "gem";
     };
-    version = "0.78.0";
+    version = "0.81.0";
   };
   execjs = {
     groups = ["assets" "default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1yz55sf2nd3l666ms6xr18sm2aggcvmb8qr3v53lr4rir32y1yp1";
+      sha256 = "121h6af4i6wr3wxvv84y53jcyw2sk71j5wsncm6wq6yqrwcrk4vd";
       type = "gem";
     };
-    version = "2.7.0";
+    version = "2.8.1";
   };
   exifr = {
     groups = ["default"];
@@ -591,10 +614,21 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1pdrl55xf76pbc5kjzp7diawxxvgbk2cm38532in6df823431n6z";
+      sha256 = "1a1zv94hcss44n1b04w0rg0swg8npigrj3nva9h0y2f1iflj124k";
+      type = "gem";
+    };
+    version = "2.22.0";
+  };
+  faker = {
+    dependencies = ["i18n"];
+    groups = ["default" "development"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0z3d4y6xg8prn3zdjw1qpqrnziq1d3zigqil4sxjj0pbr46gc1d6";
       type = "gem";
     };
-    version = "2.21.1";
+    version = "2.17.0";
   };
   fakeweb = {
     groups = ["test"];
@@ -607,12 +641,42 @@
     version = "1.3.0";
   };
   faraday = {
-    dependencies = ["multipart-post" "ruby2_keywords"];
+    dependencies = ["faraday-excon" "faraday-net_http" "faraday-net_http_persistent" "multipart-post" "ruby2_keywords"];
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "16dapwi5pivrl25r4lkr1mxjrzkznj4wlcb08fzkmxnj4g5c6y35";
+      sha256 = "0q646m07lfahakx5jdq77j004rcgfj6lkg13c0f84993gi78dhvi";
+      type = "gem";
+    };
+    version = "1.4.1";
+  };
+  faraday-excon = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0h09wkb0k0bhm6dqsd47ac601qiaah8qdzjh8gvxfd376x1chmdh";
+      type = "gem";
+    };
+    version = "1.1.0";
+  };
+  faraday-net_http = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1fi8sda5hc54v1w3mqfl5yz09nhx35kglyx72w7b8xxvdr0cwi9j";
+      type = "gem";
+    };
+    version = "1.0.1";
+  };
+  faraday-net_http_persistent = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0l2c835wl7gv34xp49fhd1bl4czkpw2g3ahqsak2251iqv5589ka";
       type = "gem";
     };
     version = "1.1.0";
@@ -654,10 +718,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "11ny2pj0j6pljszrf1w3iqdv2pcl2iwwghjbgcjlizy424zbh0hb";
+      sha256 = "0lgr0vs9kg5622qaf2l3f37b238dncs037fisiygvkbq8sg11i68";
       type = "gem";
     };
-    version = "2.2.0";
+    version = "2.2.3";
   };
   ffi = {
     groups = ["default" "development" "test"];
@@ -668,20 +732,10 @@
     }];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "12lpwaw82bb0rm9f52v1498bpba8aj2l2q359mkwbxsswhpga5af";
-      type = "gem";
-    };
-    version = "1.13.1";
-  };
-  flamegraph = {
-    groups = ["default"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1p785nmhdzbwj0qpxn5fzrmr4kgimcds83v4f95f387z6w3050x6";
+      sha256 = "0nq1fb3vbfylccwba64zblxy96qznxbys5900wd7gm9bpplmf432";
       type = "gem";
     };
-    version = "0.9.5";
+    version = "1.15.0";
   };
   fspath = {
     groups = ["default"];
@@ -728,6 +782,16 @@
     };
     version = "0.0.11";
   };
+  hana = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "03cvrv2wl25j9n4n509hjvqnmwa60k92j741b64a1zjisr1dn9al";
+      type = "gem";
+    };
+    version = "1.3.7";
+  };
   hashdiff = {
     groups = ["default" "test"];
     platforms = [];
@@ -794,10 +858,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "153sx77p16vawrs4qpkv7qlzf9v5fks4g7xqcj1dwk40i6g7rfzk";
+      sha256 = "0g2fnag935zn2ggm5cn6k4s4xvv53v2givj1j90szmvavlpya96a";
       type = "gem";
     };
-    version = "1.8.5";
+    version = "1.8.10";
   };
   image_size = {
     groups = ["default"];
@@ -845,10 +909,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "158fawfwmv2sq4whqqaksfykkiad2xxrrj0nmpnc6vnlzi1bp7iz";
+      sha256 = "0lrirj0gw420kw71bjjlqkqhqbrplla61gbv1jzgsz6bv90qr3ci";
       type = "gem";
     };
-    version = "2.3.1";
+    version = "2.5.1";
   };
   json-schema = {
     dependencies = ["addressable"];
@@ -861,15 +925,26 @@
     };
     version = "2.8.1";
   };
+  json_schemer = {
+    dependencies = ["ecma-re-validator" "hana" "regexp_parser" "uri_template"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1rkb7gz819g82n3xshb5g8kgv1nvgwg1lm2fk7715pggzcgc4qik";
+      type = "gem";
+    };
+    version = "0.2.18";
+  };
   jwt = {
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "14ynyq1q483spj20ffl4xayfqx1a8qr761mqjfxczf8lwlap392n";
+      sha256 = "036i5fc09275ms49mw43mh4i9pwaap778ra2pmx06ipzyyjl6bfs";
       type = "gem";
     };
-    version = "2.2.2";
+    version = "2.2.3";
   };
   kgio = {
     groups = ["default"];
@@ -887,15 +962,15 @@
     };
     version = "2.11.3";
   };
-  libv8 = {
+  libv8-node = {
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0317sr3nrl51sp844bps71smkrwim3fjn47wdfpbycixnbxspivm";
+      sha256 = "1xx217hrkpcm41p41inmy05kb7g8p9w5fwabgjgmpvz0d60j2862";
       type = "gem";
     };
-    version = "8.4.255.0";
+    version = "15.14.0.1";
   };
   listen = {
     dependencies = ["rb-fsevent" "rb-inotify"];
@@ -903,10 +978,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0028p1fss6pvw4mlpjqdmxfzsm8ww79irsadbibrr7f23qfn8ykr";
+      sha256 = "0h2v34xhi30w0d9gfzds2w6v89grq2gkpgvmdj9m8x1ld1845xnj";
       type = "gem";
     };
-    version = "3.3.1";
+    version = "3.5.1";
   };
   lograge = {
     dependencies = ["actionpack" "activesupport" "railties" "request_store"];
@@ -945,10 +1020,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1ldikj3p0bakxg57didaw05pldjn0i5r20zawhqa34knlsqm66r6";
+      sha256 = "1a65kp9d3n34nnd0vr49s3gxxjzi4l197s3qyq4njjf81smd2764";
       type = "gem";
     };
-    version = "2.9.4";
+    version = "2.9.6";
   };
   loofah = {
     dependencies = ["crass" "nokogiri"];
@@ -956,10 +1031,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0ndimir6k3kfrh8qrb7ir1j836l4r3qlwyclwjh88b86clblhszh";
+      sha256 = "1w9mbii8515p28xd4k72f3ab2g6xiyq15497ys5r8jn6m355lgi7";
       type = "gem";
     };
-    version = "2.8.0";
+    version = "2.9.1";
   };
   lru_redux = {
     groups = ["default"];
@@ -992,11 +1067,13 @@
     groups = ["default"];
     platforms = [];
     source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "00wwz6ys0502dpk8xprwcqfwyf3hmnx6lgxaiq6vj43mkx43sapc";
-      type = "gem";
+      fetchSubmodules = false;
+      rev = "5b700fc95ee66378e0cf2559abc73c8bc3062a4b";
+      sha256 = "0j084s1gsdwiqvm4jdayi0x4rsdrazqv8z8wkz28v7zmaymw18lz";
+      type = "git";
+      url = "https://github.com/discourse/mail.git";
     };
-    version = "2.7.1";
+    version = "2.8.0.edge";
   };
   maxminddb = {
     groups = ["default"];
@@ -1017,10 +1094,10 @@
     }];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "04ivhv1bilwqm33jv28gar2vwzsichb5nipaq395d3axabv8qmfy";
+      sha256 = "0s8qaf19yr4lhvdxk3cy3ifc47cgxdz2jybg6hzxsy9gh88c1f7v";
       type = "gem";
     };
-    version = "0.9.14";
+    version = "1.0.0";
   };
   message_bus = {
     dependencies = ["rack"];
@@ -1028,10 +1105,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0hckijk9aa628nx66vr7axfsk7zfdkskaxj1mdzikk019q3h54fr";
+      sha256 = "0gg8axd71vjanzis8w4h4if2qi4fx0glmc258dwa5b3z6zvzsbz8";
       type = "gem";
     };
-    version = "3.3.4";
+    version = "3.3.5";
   };
   method_source = {
     groups = ["default" "development" "test"];
@@ -1048,31 +1125,31 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1axm0rxyx3ss93wbmfkm78a6x03l8y4qy60rhkkiq0aza0vwq3ha";
+      sha256 = "0kb7jq3wjgckmkzna799y5qmvn6vg52878bkgw35qay6lflcrwih";
       type = "gem";
     };
-    version = "1.0.2";
+    version = "1.1.0";
   };
   mini_portile2 = {
     groups = ["default" "development" "test"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "15zplpfw3knqifj9bpf604rb3wc1vhq6363pd6lvhayng8wql5vy";
+      sha256 = "0xg1x4708a4pn2wk8qs2d8kfzzdyv9kjjachg2f1phsx62ap2rx2";
       type = "gem";
     };
-    version = "2.4.0";
+    version = "2.5.1";
   };
   mini_racer = {
-    dependencies = ["libv8"];
+    dependencies = ["libv8-node"];
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0r7j241mvhyyc017bqgp0pvf3jyrwbcqvz2pzm0r8zn2r85ks1jl";
+      sha256 = "0334q46gi3il9izw7k4z32fj06nm8pznqdkr9r51033lnwwy9zy3";
       type = "gem";
     };
-    version = "0.3.1";
+    version = "0.4.0";
   };
   mini_scheduler = {
     dependencies = ["sidekiq"];
@@ -1080,20 +1157,20 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0vigv7f1q5bkcb55ab2lyhq15yqfkg5mq61p7m7mw9b3jac7qjz1";
+      sha256 = "1cy9c2wv19m4h2sv9fs66hh1an7hq3y9513678dzx43vm3kjvhz5";
       type = "gem";
     };
-    version = "0.12.3";
+    version = "0.13.0";
   };
   mini_sql = {
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0qi4bj5jkh3673ybsxvsf7y485znyxb72vxg84gk9x65mf0y0m6h";
+      sha256 = "1yvln5wx2jfpd9q2pvjdid96vdz1ynnfk8ip913wpx28wp8ww7jn";
       type = "gem";
     };
-    version = "0.3";
+    version = "1.1.3";
   };
   mini_suffix = {
     dependencies = ["ffi"];
@@ -1101,40 +1178,41 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0bxd1fgzb20gvfvhbkrxym9fr7skm5x6fzvqfg4a0jijb34ww50h";
+      sha256 = "1r6pwyv1vpyza0rn1pyxls4qdw5jd3vg4k5dp1iaqa57n6fiqrvi";
       type = "gem";
     };
-    version = "0.3.0";
+    version = "0.3.2";
   };
   minitest = {
     groups = ["default" "development" "test"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "170y2cvx51gm3cm3nhdf7j36sxnkh6vv8ls36p90ric7w8w16h4v";
+      sha256 = "19z7wkhg59y8abginfrm2wzplz7py3va8fyngiigngqvsws6cwgl";
       type = "gem";
     };
-    version = "5.14.2";
+    version = "5.14.4";
   };
   mocha = {
     groups = ["development" "test"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0hxmkm8qxd04vwj8mqnpyrf2dwy7g1k9zipdfhl4y71cw7ijm9n4";
+      sha256 = "05yw6rwgjppq116jgqfg4pv4bql3ci4r2fmmg0m2c3sqib1bq41a";
       type = "gem";
     };
-    version = "1.11.2";
+    version = "1.12.0";
   };
   mock_redis = {
+    dependencies = ["ruby2_keywords"];
     groups = ["development" "test"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "06yj6j9x4zjckah4ixiwhy3hb6xzjp7yk7lmmcvcb8hpd0z0x95q";
+      sha256 = "0x6ng2p1884pjpwj169p6xyas5bvshi4q1wfcfmxvk82jwm0cz3c";
       type = "gem";
     };
-    version = "0.26.0";
+    version = "0.28.0";
   };
   msgpack = {
     groups = ["default"];
@@ -1145,10 +1223,10 @@
     }];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1lva6bkvb4mfa0m3bqn4lm4s4gi81c40jvdcsrxr6vng49q9daih";
+      sha256 = "06iajjyhx0rvpn4yr3h1hc4w4w3k59bdmfhxnjzzh76wsrdxxrc6";
       type = "gem";
     };
-    version = "1.3.3";
+    version = "1.4.2";
   };
   multi_json = {
     groups = ["default"];
@@ -1195,21 +1273,21 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1cbwp1kbv6b2qfxv8sarv0d0ilb257jihlvdqj8f5pdm0ksq1sgk";
+      sha256 = "00fwz0qq7agd2xkdz02i8li236qvwhma3p0jdn5bdvc21b7ydzd5";
       type = "gem";
     };
-    version = "2.5.4";
+    version = "2.5.7";
   };
   nokogiri = {
-    dependencies = ["mini_portile2"];
+    dependencies = ["mini_portile2" "racc"];
     groups = ["default" "development" "test"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0xmf60nj5kg9vaj5bysy308687sgmkasgx06vbbnf94p52ih7si2";
+      sha256 = "19d78mdg2lbz9jb4ph6nk783c9jbsdm8rnllwhga6pd53xffp6x0";
       type = "gem";
     };
-    version = "1.10.10";
+    version = "1.11.3";
   };
   nokogumbo = {
     dependencies = ["nokogiri"];
@@ -1217,20 +1295,20 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0sxjnpjvrn10gdmfw2dimhch861lz00f28hvkkz0b1gc2rb65k9s";
+      sha256 = "0ngsnr0l6r4yccdwvky18n9a81plhpviaw6g7ym45mr1q0y0aj2w";
       type = "gem";
     };
-    version = "2.0.2";
+    version = "2.0.5";
   };
   oauth = {
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1zszdg8q1b135z7l7crjj234k4j0m347hywp5kj6zsq7q78pw09y";
+      sha256 = "1zwd6v39yqfdrpg1p3d9jvzs9ljg55ana2p06m0l7qn5w0lgx1a0";
       type = "gem";
     };
-    version = "0.5.4";
+    version = "0.5.6";
   };
   oauth2 = {
     dependencies = ["faraday" "jwt" "multi_json" "multi_xml" "rack"];
@@ -1238,20 +1316,20 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1bhakjh30vi8scqwnhd1c9qkac9r8hh2lr0dbs5ynwmrc5djxknm";
+      sha256 = "1q6q2kgpxmygk8kmxqn54zkw8cs57a34zzz5cxpsh1bj3ag06rk3";
       type = "gem";
     };
-    version = "1.4.4";
+    version = "1.4.7";
   };
   oj = {
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1xqmzqldi9a0wpilwx87yh61xd7647gg8ffammg4ava0bsx375g2";
+      sha256 = "1cnadm83qwnmbpyild9whb9bgf9r7gs046ydxypclb2l756gcnva";
       type = "gem";
     };
-    version = "3.10.16";
+    version = "3.11.5";
   };
   omniauth = {
     dependencies = ["hashie" "rack"];
@@ -1287,15 +1365,15 @@
     version = "1.4.0";
   };
   omniauth-google-oauth2 = {
-    dependencies = ["jwt" "omniauth" "omniauth-oauth2"];
+    dependencies = ["jwt" "oauth2" "omniauth" "omniauth-oauth2"];
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "17pgqasl048irs2c6w6g57zvk0ygb5ml1krwir4qi4b6y53zyr55";
+      sha256 = "10pnxvb6wpnf58dja3yz4ja527443x3q13hzhcbays4amnnp8i4a";
       type = "gem";
     };
-    version = "0.8.0";
+    version = "0.8.2";
   };
   omniauth-oauth = {
     dependencies = ["oauth" "omniauth"];
@@ -1303,10 +1381,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1n5vk4by7hkyc09d9blrw2argry5awpw4gbw1l4n2s9b3j4qz037";
+      sha256 = "0yw2vzx633p9wpdkd4jxsih6mw604mj7f6myyfikmj4d95c8d9z7";
       type = "gem";
     };
-    version = "1.1.0";
+    version = "1.2.0";
   };
   omniauth-oauth2 = {
     dependencies = ["oauth2" "omniauth"];
@@ -1314,10 +1392,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0v6rw7sd223k7qw0l13wikgfcqbvbk81r53a9i2z0k7jl5vd97w5";
+      sha256 = "10fr2b58sp7l6nfdvxpbi67374hkrvsf507cvda89jjs0jacy319";
       type = "gem";
     };
-    version = "1.7.0";
+    version = "1.7.1";
   };
   omniauth-twitter = {
     dependencies = ["omniauth-oauth" "rack"];
@@ -1336,20 +1414,31 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0b2aih0d5cva9bris36gh1mk3ym61wgxlpwvzjd6qphdrjfzqx8v";
+      sha256 = "0a76xmwikcg2lv8k2cawzhmi2hx7j145v12mbpriby6zff797z4g";
       type = "gem";
     };
-    version = "2.2.1";
+    version = "2.2.15";
+  };
+  openssl = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "03wbynzkhay7l1x76srjkg91q48mxl575vrxb3blfxlpqwsvvp0w";
+      type = "gem";
+    };
+    version = "2.2.0";
   };
   openssl-signature_algorithm = {
+    dependencies = ["openssl"];
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0h1pfx49j8d9vbdbi8jyj0mr63l7rhflgvgc0nhfygm1v77d7nkn";
+      sha256 = "173p9agv45hj62fdgl9bzqr9f6xg7hi2sf5iyd3ahiwbv220x332";
       type = "gem";
     };
-    version = "1.0.0";
+    version = "1.1.1";
   };
   optimist = {
     groups = ["default"];
@@ -1381,10 +1470,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1mvdk8vgzqjv2pvadxwc8w2vf8dmiw145rjf47c36nn6l5hh02j6";
+      sha256 = "1vrd24lg1pqxvp63664hrndywpdyn8i38j4gfvqk8zjl1mxy9840";
       type = "gem";
     };
-    version = "3.4.0";
+    version = "3.7.0";
   };
   parser = {
     dependencies = ["ast"];
@@ -1392,10 +1481,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1f7gmm60yla325wlnd3qkxs59qm2y0aan8ljpg6k18rwzrrfil6z";
+      sha256 = "1pxsi1i5z506xfzhiyavlasf8777h55ab40phvp7pfv9npmd5pnj";
       type = "gem";
     };
-    version = "2.7.2.0";
+    version = "3.0.1.1";
   };
   pg = {
     groups = ["default"];
@@ -1412,10 +1501,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1pm3bv5n8c8j0vfm7wghd7xf6yq4m068cksxjldmna11qi0h0s8s";
+      sha256 = "0wymdk40cwrqn32gwg1kw94s5p1n0z3n7ma7x1s62gd4vw3d63in";
       type = "gem";
     };
-    version = "3.5.2";
+    version = "3.6.0";
   };
   pry = {
     dependencies = ["coderay" "method_source"];
@@ -1466,10 +1555,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0mkmfbf4qyiknwi9bb5432cpbbz06r855gknxb8grn24gmgs4d9i";
+      sha256 = "00839fhvcq73h9a4crbrk87y6bi2z4vp1zazxihn6w0mrwr51c3i";
       type = "gem";
     };
-    version = "5.0.4";
+    version = "5.3.1";
   };
   r2 = {
     groups = ["default"];
@@ -1481,6 +1570,16 @@
     };
     version = "0.2.7";
   };
+  racc = {
+    groups = ["default" "development" "test"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "178k7r0xn689spviqzhvazzvxfq6fyjldxb3ywjbgipbfi4s8j1g";
+      type = "gem";
+    };
+    version = "1.5.2";
+  };
   rack = {
     groups = ["default" "development" "test"];
     platforms = [{
@@ -1501,10 +1600,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "05s7y56ayn56bn7y5ah3krm5d53vsj7apmcxlwc2qp7ik0xlypvq";
+      sha256 = "02rkbmi66pqcx8l4yxnhpiywdqhbza4m2i2b457q8imjvw950jhs";
       type = "gem";
     };
-    version = "2.2.0";
+    version = "2.3.2";
   };
   rack-protection = {
     dependencies = ["rack"];
@@ -1556,10 +1655,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0ibxn7lk6rqk7q76cd9ir3xnh19p2pqr9mzam46n3h37f12yyax5";
+      sha256 = "0g3snqmsbdl2jyf2h7q4ds333hizp0j89chca75xv10gv2lq6sa8";
       type = "gem";
     };
-    version = "0.6.2";
+    version = "0.7.3";
   };
   rails_multisite = {
     dependencies = ["activerecord" "railties"];
@@ -1567,10 +1666,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0p7g9gkcmw030zfqlw3k933i40j31wf3jh4bj1niihzk7slha97y";
+      sha256 = "09lwi5pd0bisy45pv85l8w7wm5f7l5bxpva0y7bcvqdrk49ykm1g";
       type = "gem";
     };
-    version = "2.5.0";
+    version = "3.0.0";
   };
   railties = {
     dependencies = ["actionpack" "activesupport" "method_source" "rake" "thor"];
@@ -1578,10 +1677,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "05b79r0ms8jrs91zml1190qfxmnmks90g0sd820ks9msyr8xdp7j";
+      sha256 = "17r1pr8d467vh3zkciw4wmrcixj9zjrvd11nxn2z091bkzf66xq2";
       type = "gem";
     };
-    version = "6.0.3.3";
+    version = "6.1.3.2";
   };
   rainbow = {
     groups = ["default" "development" "test"];
@@ -1614,20 +1713,20 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0w6qza25bq1s825faaglkx1k6d59aiyjjk3yw3ip5sb463mhhai9";
+      sha256 = "1iik52mf9ky4cgs38fp2m8r6skdkq1yz23vh18lk95fhbcxb6a67";
       type = "gem";
     };
-    version = "13.0.1";
+    version = "13.0.3";
   };
   rb-fsevent = {
     groups = ["development" "test"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1k9bsj7ni0g2fd7scyyy1sk9dy2pg9akniahab0iznvjmhn54h87";
+      sha256 = "1qsx9c4jr11vr3a9s5j83avczx9qn9rjaf32gxpc2v451hvbc0is";
       type = "gem";
     };
-    version = "0.10.4";
+    version = "0.11.0";
   };
   rb-inotify = {
     dependencies = ["ffi"];
@@ -1681,20 +1780,20 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "05i6s898z5w31z385cba1683pgg5nnmj4m686cbravg7j4pgbcgv";
+      sha256 = "0k65fr7f8ciq7d9nwc5ziw1d32zsxilgmqdlj3359rz5jgb0f5y8";
       type = "gem";
     };
-    version = "1.8.0";
+    version = "1.8.1";
   };
   regexp_parser = {
     groups = ["default" "development" "test"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1racz3w9s4w0ls32bvjypfifk4a7qxngm2cv1rh16jyz0c1wjd70";
+      sha256 = "0vg7imjnfcqjx7kw94ccj5r78j4g190cqzi1i59sh4a0l940b9cr";
       type = "gem";
     };
-    version = "2.0.0";
+    version = "2.1.1";
   };
   request_store = {
     dependencies = ["rack"];
@@ -1712,10 +1811,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1mkvkcw9fhpaizrhca0pdgjcrbns48rlz4g6lavl5gjjq3rk2sq3";
+      sha256 = "08ximcyfjy94pm1rhcx04ny1vx2sk0x4y185gzn86yfsbzwkng53";
       type = "gem";
     };
-    version = "3.2.4";
+    version = "3.2.5";
   };
   rinku = {
     groups = ["default"];
@@ -1743,20 +1842,20 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "06lw8b6wfshxd61xw98xyp1a0zsz6av4nls2c9fwb7q59wb05sci";
+      sha256 = "073w0qgjydkqpsqsb9yr8qg0mhvwlzx6z53hqr2b5zifvb9wzh02";
       type = "gem";
     };
-    version = "1.1.2";
+    version = "2.0.0";
   };
   rqrcode_core = {
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "071jqmhk3hf0grsvi0jx5sl449pf82p40ls5b3likbq4q516zc0j";
+      sha256 = "1djrfpzdy19c336nlzxdsm9qkrgqnm1himdawflsjsmxpq4j826c";
       type = "gem";
     };
-    version = "0.1.2";
+    version = "1.0.0";
   };
   rspec = {
     dependencies = ["rspec-core" "rspec-expectations" "rspec-mocks"];
@@ -1775,10 +1874,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0n2rdv8f26yw8c6asymc0mgddyr5d2b5n6mfvpd3n6lnpf1jdyv2";
+      sha256 = "0wwnfhxxvrlxlk1a3yxlb82k2f9lm0yn0598x7lk8fksaz4vv6mc";
       type = "gem";
     };
-    version = "3.10.0";
+    version = "3.10.1";
   };
   rspec-expectations = {
     dependencies = ["diff-lcs" "rspec-support"];
@@ -1786,10 +1885,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0j37dvnvfbjwj8dqx27yfvz0frl7f2jc1abqg99h0ppriz9za6dc";
+      sha256 = "1sz9bj4ri28adsklnh257pnbq4r5ayziw02qf67wry0kvzazbb17";
       type = "gem";
     };
-    version = "3.10.0";
+    version = "3.10.1";
   };
   rspec-html-matchers = {
     dependencies = ["nokogiri" "rspec"];
@@ -1808,10 +1907,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1pz89y1522i6f8wzrg72ykmch3318ih87nlpl0y1ghsrs5hqymw3";
+      sha256 = "1d13g6kipqqc9lmwz5b244pdwc97z15vcbnbq6n9rlf32bipdz4k";
       type = "gem";
     };
-    version = "3.10.0";
+    version = "3.10.2";
   };
   rspec-rails = {
     dependencies = ["actionpack" "activesupport" "railties" "rspec-core" "rspec-expectations" "rspec-mocks" "rspec-support"];
@@ -1819,20 +1918,20 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0lzik01ziaskgpdpy8knffpw0fsy9151f5lfigyhb89wq4q45hfs";
+      sha256 = "1pj2a9vrkp2xzlq0810q90sdc2zcqc7k92n57hxzhri2vcspy7n6";
       type = "gem";
     };
-    version = "4.0.1";
+    version = "5.0.1";
   };
   rspec-support = {
     groups = ["default" "development" "test"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0j0n28i6zci5j7gg370bdy87dy43hlwx6dw428d9kamf5a0i2klz";
+      sha256 = "15j52parvb8cgvl6s0pbxi2ywxrv6x0764g222kz5flz0s4mycbl";
       type = "gem";
     };
-    version = "3.10.0";
+    version = "3.10.2";
   };
   rswag-specs = {
     dependencies = ["activesupport" "json-schema" "railties"];
@@ -1840,10 +1939,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0lyp2m76p960bvgy4xcz0dilp4w5lq2cwh8md5z7cwxdg8qsbr83";
+      sha256 = "1dma3j5vfjhyclg8y0gsp44vs4wn9chf4jgfhc9r6ws018xrbxzd";
       type = "gem";
     };
-    version = "2.3.1";
+    version = "2.4.0";
   };
   rtlit = {
     groups = ["assets"];
@@ -1861,10 +1960,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1kvzhzhzcdd5bqwjilb0fpp51sqjniww2b0g713n0cvhnlgchn2y";
+      sha256 = "0chjr6i0g7frbp7dhi4d83ppf7akkdaw7mcgcwbxd6a9mairafpp";
       type = "gem";
     };
-    version = "1.4.2";
+    version = "1.14.0";
   };
   rubocop-ast = {
     dependencies = ["parser"];
@@ -1872,10 +1971,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0q0kdi89ad7dd1xmzrdf5ikk32bllzr68hf4x8fd7azcv5jnch2l";
+      sha256 = "0hx4im1a2qpiwipvsl3fma358ixjp4h0mhj56ichq15xrq709qlf";
       type = "gem";
     };
-    version = "1.2.0";
+    version = "1.5.0";
   };
   rubocop-discourse = {
     dependencies = ["rubocop" "rubocop-rspec"];
@@ -1894,10 +1993,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1gl7hdd9lq0si4gb510g33dbysmk3iydas2b0sbl5pwfkhv0k4g1";
+      sha256 = "0r69qcwm74vsbp1s2gaqaf91kkrsn2mv4gk6rvfb2pxzmgyi0r9g";
       type = "gem";
     };
-    version = "2.0.0";
+    version = "2.3.0";
   };
   ruby-prof = {
     groups = ["development"];
@@ -1908,20 +2007,20 @@
     }];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1lm3wdxc6gjldkb5pdwwipapf84lgrvxck4h5kg8jdfd8arrpyis";
+      sha256 = "1r3xalp91l07m0cwllcxjzg6nkviiqnxkcbgg5qnzsdji6rgy65m";
       type = "gem";
     };
-    version = "1.4.2";
+    version = "1.4.3";
   };
   ruby-progressbar = {
     groups = ["default" "development" "test"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1k77i0d4wsn23ggdd2msrcwfy0i376cglfqypkk2q77r2l3408zf";
+      sha256 = "02nmaw7yx9kl7rbaan5pl8x5nn0y4j5954mzrkzi9i3dhsrps4nc";
       type = "gem";
     };
-    version = "1.10.1";
+    version = "1.11.0";
   };
   ruby-readability = {
     dependencies = ["guess_html_encoding" "nokogiri"];
@@ -1935,14 +2034,14 @@
     version = "0.7.0";
   };
   ruby2_keywords = {
-    groups = ["default"];
+    groups = ["default" "development" "test"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "17pcc0wgvh3ikrkr7bm3nx0qhyiqwidd13ij0fa50k7gsbnr2p0l";
+      sha256 = "15wfcqxyfgka05v2a7kpg64x57gl1y4xzvnc9lh60bqx5sf1iqrs";
       type = "gem";
     };
-    version = "0.0.2";
+    version = "0.0.4";
   };
   rubyzip = {
     groups = ["default"];
@@ -1960,10 +2059,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "18m3zcf207gcrmghx288w3n2kpphc22lbmbc1wdx1nzcn8g2yddh";
+      sha256 = "0xi2c9vbfjs0gk4i9y4mrlb3xx6g5lj22hlg5cx6hyc88ri7j4bc";
       type = "gem";
     };
-    version = "5.2.1";
+    version = "5.2.3";
   };
   sassc = {
     dependencies = ["ffi" "rake"];
@@ -2004,10 +2103,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1wd1bblxr4dfmrnh3j83kvfds6a7nak4ifq37ab0pg1kdi6iiw7l";
+      sha256 = "1qi7gzli00mqlaq9an28m6xd323k7grgq19r6dqa2amjnnxy41ld";
       type = "gem";
     };
-    version = "4.4.1";
+    version = "4.5.1";
   };
   sidekiq = {
     dependencies = ["connection_pool" "rack" "redis"];
@@ -2015,10 +2114,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0mjxrxppv08a1hwqi8gpg6n168cxqhp7c2r2jwc4rbz9j5k41vcw";
+      sha256 = "1ac57q6lnqg9h9lsj49wlwhgsfqfr83lgka1c1srk6g8vghhz662";
       type = "gem";
     };
-    version = "6.1.2";
+    version = "6.2.1";
   };
   simplecov = {
     dependencies = ["docile" "simplecov-html" "simplecov_json_formatter"];
@@ -2026,10 +2125,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1mm20dvd64w46l5k11il9z5sjgdpp0bknml76glcngvl2w03k3cb";
+      sha256 = "1hrv046jll6ad1s964gsmcq4hvkr3zzr6jc7z1mns22mvfpbc3cr";
       type = "gem";
     };
-    version = "0.20.0";
+    version = "0.21.2";
   };
   simplecov-html = {
     groups = ["default" "test"];
@@ -2046,10 +2145,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0cl3j7p3b5q7sxsx1va63c8imc5x6g99xablz08qrmqhpi0d6g6j";
+      sha256 = "19r15hyvh52jx7fmsrcflb58xh8l7l0zx4sxkh3hqzhq68y81pjl";
       type = "gem";
     };
-    version = "0.1.2";
+    version = "0.1.3";
   };
   sprockets = {
     dependencies = ["concurrent-ruby" "rack"];
@@ -2092,40 +2191,30 @@
     }];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "147rb66p3n062vc433afqhkd99iazvkrqnghxgh871r62yhha93f";
+      sha256 = "06lz70k8c0r7fyxk1nc3idh14x7nvsr21ydm1bsmbj00jyhmfzsn";
       type = "gem";
     };
-    version = "0.2.16";
+    version = "0.2.17";
   };
   test-prof = {
     groups = ["test"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1jfq8ylxpxanc3f0i6qb3nchawx9hj6qcqj6ccfyixrnvzswwjvi";
+      sha256 = "15jbm45jf1i8s1g5kj6pcfp6ddq9qfyy31lx3pff8g2w2hkhpik4";
       type = "gem";
     };
-    version = "0.12.2";
+    version = "1.0.5";
   };
   thor = {
     groups = ["default" "development" "test"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1xbhkmyhlxwzshaqa7swy2bx6vd64mm0wrr8g3jywvxy7hg0cwkm";
-      type = "gem";
-    };
-    version = "1.0.1";
-  };
-  thread_safe = {
-    groups = ["default" "development" "test"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0nmhcgq6cgz44srylra07bmaw99f5271l0dpsvl5f75m44l0gmwy";
+      sha256 = "18yhlvmfya23cs3pvhr1qy38y41b6mhr5q9vwv5lrgk16wmf3jna";
       type = "gem";
     };
-    version = "0.3.6";
+    version = "1.1.0";
   };
   tilt = {
     groups = ["default"];
@@ -2138,15 +2227,15 @@
     version = "2.0.10";
   };
   tzinfo = {
-    dependencies = ["thread_safe"];
+    dependencies = ["concurrent-ruby"];
     groups = ["default" "development" "test"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0skr6ih9cr3pwp8l84f0z7fy3q9kiq8hw0sg3zqw0hpbbyj05743";
+      sha256 = "10qp5x7f9hvlc0psv9gsfbxg4a7s0485wsbq1kljkxq94in91l4z";
       type = "gem";
     };
-    version = "1.2.8";
+    version = "2.0.4";
   };
   uglifier = {
     dependencies = ["execjs"];
@@ -2185,10 +2274,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "06i3id27s60141x6fdnjn5rar1cywdwy64ilc59cz937303q3mna";
+      sha256 = "1bilbnc8j6jkb59lrf177i3p1pdyxll0n8400hzqr35vl3r3kv2m";
       type = "gem";
     };
-    version = "1.7.0";
+    version = "2.0.0";
   };
   unicorn = {
     dependencies = ["kgio" "raindrops"];
@@ -2202,20 +2291,30 @@
     }];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1qzdhbmab2w034wpdj5ippnyyvgqm8gpx9wbchb4zgs4i1mswzhv";
+      sha256 = "1jcm85d7j7njfgims712svlgml32zjim6qwabm99645aj5laayln";
       type = "gem";
     };
-    version = "5.7.0";
+    version = "6.0.0";
   };
   uniform_notifier = {
     groups = ["default" "development"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0vm4aix8jmv42s1x58m3lj3xwkbxyn9qn6lzhhig0d1j8fv6j30c";
+      sha256 = "1614dqnky0f9f1znj0lih8i184vfps86md93dw0kxrg3af9gnqb4";
       type = "gem";
     };
-    version = "1.13.0";
+    version = "1.14.2";
+  };
+  uri_template = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0p8qbxlpmg3msw0ihny6a3gsn0yvydx9ksh5knn8dnq06zhqyb1i";
+      type = "gem";
+    };
+    version = "0.7.0";
   };
   webmock = {
     dependencies = ["addressable" "crack" "hashdiff"];
@@ -2223,10 +2322,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0wbdjagk2qpr76k3zw2gmkfp5aqlrc1a4qrpjv7sq1q39qbn8xax";
+      sha256 = "038igpmkpmn0nw0k7s4db8x88af1nwcy7wzh9m9c9q4p74h7rii0";
       type = "gem";
     };
-    version = "3.10.0";
+    version = "3.12.2";
   };
   webpush = {
     dependencies = ["hkdf" "jwt"];
@@ -2264,9 +2363,9 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "12n0hiawqayzchi0yga5n19hi63b2snd49fv3n23n2i4pp05jzrp";
+      sha256 = "1746czsjarixq0x05f7p3hpzi38ldg6wxnxxw74kbjzh1sdjgmpl";
       type = "gem";
     };
-    version = "2.4.1";
+    version = "2.4.2";
   };
 }
diff --git a/pkgs/servers/web-apps/discourse/unicorn_logging_and_timeout.patch b/pkgs/servers/web-apps/discourse/unicorn_logging_and_timeout.patch
index 1dbfed679192..d78b511f6ad9 100644
--- a/pkgs/servers/web-apps/discourse/unicorn_logging_and_timeout.patch
+++ b/pkgs/servers/web-apps/discourse/unicorn_logging_and_timeout.patch
@@ -1,10 +1,10 @@
 diff --git a/config/unicorn.conf.rb b/config/unicorn.conf.rb
-index 373e235b3f..57d4d7a55b 100644
+index ffcafcb618..31ba691983 100644
 --- a/config/unicorn.conf.rb
 +++ b/config/unicorn.conf.rb
 @@ -27,18 +27,10 @@ pid (ENV["UNICORN_PID_PATH"] || "#{discourse_path}/tmp/pids/unicorn.pid")
  
- if ENV["RAILS_ENV"] == "development" || !ENV["RAILS_ENV"]
+ if ENV["RAILS_ENV"] != "production"
    logger Logger.new($stdout)
 -  # we want a longer timeout in dev cause first request can be really slow
 -  timeout (ENV["UNICORN_TIMEOUT"] && ENV["UNICORN_TIMEOUT"].to_i || 60)
diff --git a/pkgs/servers/web-apps/wordpress/default.nix b/pkgs/servers/web-apps/wordpress/default.nix
index 8ad888e759b6..7dbf4054ef27 100644
--- a/pkgs/servers/web-apps/wordpress/default.nix
+++ b/pkgs/servers/web-apps/wordpress/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "wordpress";
-  version = "5.7.1";
+  version = "5.7.2";
 
   src = fetchurl {
     url = "https://wordpress.org/${pname}-${version}.tar.gz";
-    sha256 = "08c9g80lhs4h2psf3ykn0l4k1yyy0x21kxjqy8ckjpjvw3281nd4";
+    sha256 = "sha256-640FIIFZRp0L48szn3tqFQo59QP69nnCVQKEM/UTEhk=";
   };
 
   installPhase = ''
diff --git a/pkgs/stdenv/darwin/make-bootstrap-tools.nix b/pkgs/stdenv/darwin/make-bootstrap-tools.nix
index a42499eebce7..3af444a2e52c 100644
--- a/pkgs/stdenv/darwin/make-bootstrap-tools.nix
+++ b/pkgs/stdenv/darwin/make-bootstrap-tools.nix
@@ -136,9 +136,7 @@ in rec {
         local libs=$(${stdenv.cc.targetPrefix}otool -L "$1" | tail -n +2 | grep -o "$NIX_STORE.*-\S*") || true
         local newlib
         for lib in $libs; do
-          newlib=''${lib:${toString (storePrefixLen + 1)}}
-          newlib=''${newlib#*/}
-          ${stdenv.cc.targetPrefix}install_name_tool -change $lib "@rpath/$newlib" "$1"
+          ${stdenv.cc.targetPrefix}install_name_tool -change $lib "@rpath/$(basename "$lib")" "$1"
         done
       }
 
@@ -160,7 +158,7 @@ in rec {
       for i in $out/bin/*; do
         if test -x "$i" -a ! -L "$i" -a "$(basename $i)" != codesign; then
           echo "Adding @executable_path to rpath in $i"
-          ${stdenv.cc.targetPrefix}install_name_tool -add_rpath '@executable_path/..' $i
+          ${stdenv.cc.targetPrefix}install_name_tool -add_rpath '@executable_path/../lib' $i
         fi
       done
 
diff --git a/pkgs/tools/X11/xpra/default.nix b/pkgs/tools/X11/xpra/default.nix
index 8fd0cf016bf4..c3cea1ed0612 100644
--- a/pkgs/tools/X11/xpra/default.nix
+++ b/pkgs/tools/X11/xpra/default.nix
@@ -1,12 +1,13 @@
 { lib
 , fetchurl
 , fetchpatch
-, substituteAll, python3, pkg-config, writeText
+, substituteAll, python3, pkg-config, runCommand, writeText
 , xorg, gtk3, glib, pango, cairo, gdk-pixbuf, atk, pandoc
 , wrapGAppsHook, xorgserver, getopt, xauth, util-linux, which
 , ffmpeg, x264, libvpx, libwebp, x265, librsvg
 , libfakeXinerama
 , gst_all_1, pulseaudio, gobject-introspection
+, withNvenc ? false, cudatoolkit, nv-codec-headers-10, nvidia_x11 ? null
 , pam }:
 
 with lib;
@@ -34,6 +35,13 @@ let
     EndSection
   '';
 
+  nvencHeaders = runCommand "nvenc-headers" {
+    inherit nvidia_x11;
+  } ''
+    mkdir -p $out/include $out/lib/pkgconfig
+    cp ${nv-codec-headers-10}/include/ffnvcodec/nvEncodeAPI.h $out/include
+    substituteAll ${./nvenc.pc} $out/lib/pkgconfig/nvenc.pc
+  '';
 in buildPythonApplication rec {
   pname = "xpra";
   version = "4.2";
@@ -60,7 +68,8 @@ in buildPythonApplication rec {
     substituteInPlace setup.py --replace '/usr/include/security' '${pam}/include/security'
   '';
 
-  nativeBuildInputs = [ pkg-config wrapGAppsHook pandoc ];
+  nativeBuildInputs = [ pkg-config wrapGAppsHook pandoc ]
+    ++ lib.optional withNvenc cudatoolkit;
   buildInputs = with xorg; [
     libX11 xorgproto libXrender libXi
     libXtst libXfixes libXcomposite libXdamage
@@ -81,13 +90,13 @@ in buildPythonApplication rec {
 
     pam
     gobject-introspection
-  ];
+  ] ++ lib.optional withNvenc nvencHeaders;
   propagatedBuildInputs = with python3.pkgs; [
     pillow rencode pycrypto cryptography pycups lz4 dbus-python
     netifaces numpy pygobject3 pycairo gst-python pam
     pyopengl paramiko opencv4 python-uinput pyxdg
     ipaddress idna pyinotify
-  ];
+  ] ++ lib.optionals withNvenc (with python3.pkgs; [pynvml pycuda]);
 
     # error: 'import_cairo' defined but not used
   NIX_CFLAGS_COMPILE = "-Wno-error=unused-function";
@@ -100,7 +109,7 @@ in buildPythonApplication rec {
     # Override these, setup.py checks for headers in /usr/* paths
     "--with-pam"
     "--with-vsock"
-  ];
+  ] ++ lib.optional withNvenc "--with-nvenc";
 
   dontWrapGApps = true;
   preFixup = ''
@@ -111,6 +120,9 @@ in buildPythonApplication rec {
       --set XPRA_XKB_CONFIG_ROOT "${xorg.xkeyboardconfig}/share/X11/xkb"
       --prefix LD_LIBRARY_PATH : ${libfakeXinerama}/lib
       --prefix PATH : ${lib.makeBinPath [ getopt xorgserver xauth which util-linux pulseaudio ]}
+  '' + lib.optionalString withNvenc ''
+      --prefix LD_LIBRARY_PATH : ${nvidia_x11}/lib
+  '' + ''
     )
   '';
 
diff --git a/pkgs/tools/X11/xpra/nvenc.pc b/pkgs/tools/X11/xpra/nvenc.pc
new file mode 100644
index 000000000000..6d8d916a0251
--- /dev/null
+++ b/pkgs/tools/X11/xpra/nvenc.pc
@@ -0,0 +1,11 @@
+prefix=@out@
+includedir=${prefix}/include
+libdir=@nvidia_x11@/lib
+
+Name: nvenc
+Description: NVENC
+Version: 10
+Requires:
+Conflicts:
+Libs: -L${libdir} -lnvidia-encode
+Cflags: -I${includedir}
diff --git a/pkgs/tools/admin/fioctl/default.nix b/pkgs/tools/admin/fioctl/default.nix
index c27b18ac6d5d..0e0c977acd01 100644
--- a/pkgs/tools/admin/fioctl/default.nix
+++ b/pkgs/tools/admin/fioctl/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "fioctl";
-  version = "0.16";
+  version = "0.17";
 
   src = fetchFromGitHub {
     owner = "foundriesio";
     repo = "fioctl";
     rev = "v${version}";
-    sha256 = "1mm62piih7x2886wpgqd8ks22vpmrjgxs4alskiqz61bgshks9vw";
+    sha256 = "sha256-u23BQ/sRAfUO36uqv7xY+DkseDnlVesgamsgne8N8kU=";
   };
 
-  vendorSha256 = "170z5a1iwwcpz890nficqnz7rr7yzdxr5jx9pa7s31z17lr8kbz9";
+  vendorSha256 = "sha256-6a+JMj3hh6GPuqnLknv7/uR8vsUsOgsS+pdxHoMqH5w=";
 
   runVend = true;
 
diff --git a/pkgs/tools/audio/patray/default.nix b/pkgs/tools/audio/patray/default.nix
new file mode 100644
index 000000000000..5f86f1b88557
--- /dev/null
+++ b/pkgs/tools/audio/patray/default.nix
@@ -0,0 +1,43 @@
+{ lib
+, python3
+, qt5
+}:
+
+python3.pkgs.buildPythonApplication rec {
+  pname = "patray";
+  version = "0.1.1";
+
+  src = python3.pkgs.fetchPypi {
+    inherit version pname;
+    sha256 = "0vaapn2p4257m1d5nbnwnh252b7lhl00560gr9pqh2b7xqm1bh6g";
+  };
+
+  patchPhase = ''
+    sed -i '30i entry_points = { "console_scripts": [ "patray = patray.__main__:main" ] },' setup.py
+    sed -i 's/production.txt/production.in/' setup.py
+    sed -i '/pyside2/d' requirements/production.in
+  '';
+
+  propagatedBuildInputs = with python3.pkgs; [
+    pulsectl
+    loguru
+    cock
+    pyside2
+  ];
+
+  doCheck = false;
+
+  nativeBuildInputs = [ qt5.wrapQtAppsHook ];
+  postFixup = ''
+    wrapQtApp $out/bin/patray
+  '';
+
+
+
+  meta = with lib; {
+    description = "Yet another tray pulseaudio frontend";
+    homepage = "https://github.com/pohmelie/patray";
+    license = licenses.mit;
+    maintainers = with maintainers; [ domenkozar ];
+  };
+}
diff --git a/pkgs/tools/audio/spotdl/default.nix b/pkgs/tools/audio/spotdl/default.nix
index 9306c516af51..38f69b4d2b77 100644
--- a/pkgs/tools/audio/spotdl/default.nix
+++ b/pkgs/tools/audio/spotdl/default.nix
@@ -6,13 +6,13 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "spotdl";
-  version = "3.5.2";
+  version = "3.6.1";
 
   src = fetchFromGitHub {
     owner = "spotDL";
     repo = "spotify-downloader";
     rev = "v${version}";
-    sha256 = "sha256-V9jIA+ULjZRj+uVy4Yh55PapPiqFy9I9ZVln1nt/bJw=";
+    sha256 = "sha256-F3bP8f1LtcFZL7qahYkCUvhtc27fcL8WBnmyLcS9lCY=";
   };
 
   propagatedBuildInputs = with python3.pkgs; [
@@ -25,6 +25,7 @@ python3.pkgs.buildPythonApplication rec {
     tqdm
     beautifulsoup4
     requests
+    unidecode
   ];
 
   checkInputs = with python3.pkgs; [
diff --git a/pkgs/tools/graphics/feedgnuplot/default.nix b/pkgs/tools/graphics/feedgnuplot/default.nix
index 02bb022dfb47..51d3e1e868da 100644
--- a/pkgs/tools/graphics/feedgnuplot/default.nix
+++ b/pkgs/tools/graphics/feedgnuplot/default.nix
@@ -1,5 +1,6 @@
 { lib, fetchFromGitHub, makeWrapper, gawk
 , makeFontsConf, freefont_ttf, gnuplot, perl, perlPackages
+, stdenv, shortenPerlShebang
 }:
 
 let
@@ -10,18 +11,18 @@ in
 
 perlPackages.buildPerlPackage rec {
   pname = "feedgnuplot";
-  version = "1.51";
+  version = "1.58";
 
   src = fetchFromGitHub {
     owner = "dkogan";
     repo = "feedgnuplot";
     rev = "v${version}";
-    sha256 = "0npk2l032cnmibjj5zf3ii09mpxciqn32lx6g5bal91bkxwn7r5i";
+    sha256 = "1qix4lwwyhqibz0a6q2rrb497rmk00v1fvmdyinj0dqmgjw155zr";
   };
 
   outputs = [ "out" ];
 
-  nativeBuildInputs = [ makeWrapper gawk ];
+  nativeBuildInputs = [ makeWrapper gawk ] ++ lib.optional stdenv.isDarwin shortenPerlShebang;
 
   buildInputs = [ gnuplot perl ]
     ++ (with perlPackages; [ ListMoreUtils IPCRun StringShellQuote ]);
@@ -36,7 +37,9 @@ perlPackages.buildPerlPackage rec {
   # Tests require gnuplot 4.6.4 and are completely skipped with gnuplot 5.
   doCheck = false;
 
-  postInstall = ''
+  postInstall = lib.optionalString stdenv.isDarwin ''
+    shortenPerlShebang $out/bin/feedgnuplot
+  '' + ''
     wrapProgram $out/bin/feedgnuplot \
         --prefix "PATH" ":" "$PATH" \
         --prefix "PERL5LIB" ":" "$PERL5LIB"
diff --git a/pkgs/tools/graphics/graphviz/base.nix b/pkgs/tools/graphics/graphviz/base.nix
index 000e2b280891..1a387042b2d5 100644
--- a/pkgs/tools/graphics/graphviz/base.nix
+++ b/pkgs/tools/graphics/graphviz/base.nix
@@ -21,7 +21,14 @@ let
     buildCommand = "sed s/dot_root/agroot/g ${raw_patch} > $out";
   };
   # 2.42 has the patch included
-  patches = optional (lib.versionOlder version "2.42") patchToUse;
+  patches = optional (lib.versionOlder version "2.42") patchToUse
+  ++ optionals (lib.versionOlder version "2.46.0") [
+    (fetchpatch {
+      name = "CVE-2020-18032.patch";
+      url = "https://gitlab.com/graphviz/graphviz/-/commit/784411ca3655c80da0f6025ab20634b2a6ff696b.patch";
+      sha256 = "1nkw9ism8lkfvxsp5fh95i2l5s5cbjsidbb3g1kjfv10rxkyb41m";
+    })
+  ];
 in
 
 stdenv.mkDerivation {
diff --git a/pkgs/tools/misc/betterdiscordctl/default.nix b/pkgs/tools/misc/betterdiscordctl/default.nix
index e839d9ef09ce..f75f3a6f8223 100644
--- a/pkgs/tools/misc/betterdiscordctl/default.nix
+++ b/pkgs/tools/misc/betterdiscordctl/default.nix
@@ -2,22 +2,28 @@
 
 stdenv.mkDerivation rec {
   pname = "betterdiscordctl";
-  version = "1.7.1";
+  version = "2.0.0";
 
   src = fetchFromGitHub {
     owner = "bb010g";
     repo = "betterdiscordctl";
     rev = "v${version}";
-    sha256 = "12c3phcfwl4p2jfh22ihm57vxw4nq5kwqirb7y4gzc91swfh5yj1";
+    sha256 = "1wys3wbcz5hq8275ia2887kr5fzz4b3gkcp56667j9k0p3k3zfac";
   };
 
-  preBuild = "sed -i 's/^nix=$/&yes/g;s/^DISABLE_UPGRADE=$/&yes/g' ./betterdiscordctl";
+  postPatch = ''
+    substituteInPlace betterdiscordctl \
+      --replace "DISABLE_SELF_UPGRADE=" "DISABLE_SELF_UPGRADE=yes"
+  '';
 
   installPhase = ''
-    mkdir -p $out/bin
-    mkdir -p $out/share/doc/betterdiscordctl
+    runHook preInstall
+
+    mkdir -p "$out/bin" "$out/share/doc/betterdiscordctl"
     install -Dm744 betterdiscordctl $out/bin/betterdiscordctl
     install -Dm644 README.md $out/share/doc/betterdiscordctl/README.md
+
+    runHook postInstall
   '';
 
   meta = with lib; {
diff --git a/pkgs/tools/misc/capture/default.nix b/pkgs/tools/misc/capture/default.nix
index d858e0fbc461..d8b2fe676518 100644
--- a/pkgs/tools/misc/capture/default.nix
+++ b/pkgs/tools/misc/capture/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, slop, ffmpeg_3, fetchFromGitHub, makeWrapper}:
+{ lib, stdenv, slop, ffmpeg, fetchFromGitHub, makeWrapper}:
 
 stdenv.mkDerivation {
   pname = "capture-unstable";
@@ -18,7 +18,7 @@ stdenv.mkDerivation {
 
     patchShebangs $out/bin/capture
     wrapProgram $out/bin/capture \
-      --prefix PATH : '${lib.makeBinPath [ slop ffmpeg_3 ]}'
+      --prefix PATH : '${lib.makeBinPath [ slop ffmpeg ]}'
   '';
 
   meta = with lib; {
diff --git a/pkgs/tools/misc/diffoscope/default.nix b/pkgs/tools/misc/diffoscope/default.nix
index ce0d920ca4ab..21a02f1e99c7 100644
--- a/pkgs/tools/misc/diffoscope/default.nix
+++ b/pkgs/tools/misc/diffoscope/default.nix
@@ -16,11 +16,11 @@ let
 in
 python3Packages.buildPythonApplication rec {
   pname = "diffoscope";
-  version = "175";
+  version = "176";
 
   src = fetchurl {
     url = "https://diffoscope.org/archive/diffoscope-${version}.tar.bz2";
-    sha256 = "sha256-ofRu5bD+kymdXdViPxfGD/2cf7lUvnEQfYAqog5GIIk=";
+    sha256 = "sha256-Hr3GNgpvKCLs+HA8QLOewh5nz9npZr5MZ65wRrat7l0=";
   };
 
   outputs = [ "out" "man" ];
diff --git a/pkgs/tools/misc/fetchutils/default.nix b/pkgs/tools/misc/fetchutils/default.nix
index bda9175724f1..e9ee3fba516d 100644
--- a/pkgs/tools/misc/fetchutils/default.nix
+++ b/pkgs/tools/misc/fetchutils/default.nix
@@ -5,7 +5,7 @@ stdenvNoCC.mkDerivation rec {
   version = "unstable-2021-03-16";
 
   src = fetchFromGitHub {
-    owner = "lptstr";
+    owner = "kiedtl";
     repo = pname;
     rev = "882781a297e86f4ad4eaf143e0777fb3e7c69526";
     sha256 = "sha256-ONrVZC6GBV5v3TeBekW9ybZjDHF3FNyXw1rYknqKRbk=";
@@ -13,7 +13,7 @@ stdenvNoCC.mkDerivation rec {
 
   buildInputs = [ bash scdoc ];
 
-  installFlags = [ "DESTDIR=$(out)" "PREFIX=" ];
+  installFlags = [ "PREFIX=$(out)/" ];
 
   postPatch = ''
     patchShebangs --host src/*
diff --git a/pkgs/tools/misc/sacad/default.nix b/pkgs/tools/misc/sacad/default.nix
index c5c48c271db7..50599fbbabd7 100644
--- a/pkgs/tools/misc/sacad/default.nix
+++ b/pkgs/tools/misc/sacad/default.nix
@@ -2,11 +2,11 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "sacad";
-  version = "2.3.4";
+  version = "2.4.0";
 
   src = python3Packages.fetchPypi {
     inherit pname version;
-    sha256 = "1qv2mrz6vy2sl7zhrj9vw016pjd7hmjr2ls0w8bbv1hgrddicn9r";
+    sha256 = "sha256-KLVkyiXjpqskM67W9uPl9aPKc3pYMu0nAfwI0OpOniE=";
   };
 
   propagatedBuildInputs = with python3Packages; [
diff --git a/pkgs/tools/networking/corerad/default.nix b/pkgs/tools/networking/corerad/default.nix
index a7e5026d83af..f5b0875e6ffb 100644
--- a/pkgs/tools/networking/corerad/default.nix
+++ b/pkgs/tools/networking/corerad/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "corerad";
-  version = "0.3.0";
+  version = "0.3.1";
 
   src = fetchFromGitHub {
     owner = "mdlayher";
     repo = "corerad";
     rev = "v${version}";
-    sha256 = "1q4wcliifas8xvwy7kcq4fbc1iv7dha3k6j1nbwl7pjqmyggs3f4";
+    sha256 = "0ky4zfmxzgxidsizfj2lwm5z3zl666khw9cgsxfgbzn3cjgr33c3";
   };
 
-  vendorSha256 = "07khxs15z9xzcmp4gyggdwqyz361y96h6ib92qax8k83cr0l494p";
+  vendorSha256 = "0ddni8hl8fv0m9kinwfnhcj3k51fk8h61yksv7ws6agdx0bl1rwh";
 
   doCheck = false;
 
diff --git a/pkgs/tools/networking/openconnect/default.nix b/pkgs/tools/networking/openconnect/default.nix
index da4dab4980c0..8afe546c4593 100644
--- a/pkgs/tools/networking/openconnect/default.nix
+++ b/pkgs/tools/networking/openconnect/default.nix
@@ -1,4 +1,19 @@
-{ lib, stdenv, fetchurl, pkg-config, openssl ? null, gnutls ? null, gmp, libxml2, stoken, zlib, fetchgit, darwin } :
+{ lib
+, stdenv
+, fetchurl
+, pkg-config
+, openssl ? null
+, gnutls ? null
+, gmp
+, libxml2
+, stoken
+, zlib
+, fetchgit
+, darwin
+, head ? false
+  , fetchFromGitLab
+  , autoreconfHook
+}:
 
 assert (openssl != null) == (gnutls == null);
 
@@ -9,15 +24,20 @@ let vpnc = fetchgit {
 };
 
 in stdenv.mkDerivation rec {
-  pname = "openconnect";
-  version = "8.10";
+  pname = "openconnect${lib.optionalString head "-head"}";
+  version = if head then "2021-05-05" else "8.10";
 
-  src = fetchurl {
-    urls = [
-      "ftp://ftp.infradead.org/pub/openconnect/${pname}-${version}.tar.gz"
-    ];
-    sha256 = "1cdsx4nsrwawbsisfkldfc9i4qn60g03vxb13nzppr2br9p4rrih";
-  };
+  src =
+    if head then fetchFromGitLab {
+      owner = "openconnect";
+      repo = "openconnect";
+      rev = "684f6db1aef78e61e01f511c728bf658c30b9114";
+      sha256 = "0waclawcymgd8sq9xbkn2q8mnqp4pd0gpyv5wrnb7i0nsv860wz8";
+    }
+    else fetchurl {
+      url = "ftp://ftp.infradead.org/pub/openconnect/${pname}-${version}.tar.gz";
+      sha256 = "1cdsx4nsrwawbsisfkldfc9i4qn60g03vxb13nzppr2br9p4rrih";
+    };
 
   outputs = [ "out" "dev" ];
 
@@ -29,12 +49,13 @@ in stdenv.mkDerivation rec {
 
   buildInputs = [ openssl gnutls gmp libxml2 stoken zlib ]
     ++ lib.optional stdenv.isDarwin darwin.apple_sdk.frameworks.PCSC;
-  nativeBuildInputs = [ pkg-config ];
+  nativeBuildInputs = [ pkg-config ]
+    ++ lib.optional head autoreconfHook;
 
   meta = with lib; {
     description = "VPN Client for Cisco's AnyConnect SSL VPN";
     homepage = "http://www.infradead.org/openconnect/";
-    license = licenses.lgpl21;
+    license = licenses.lgpl21Only;
     maintainers = with maintainers; [ pradeepchhetri tricktron ];
     platforms = lib.platforms.linux ++ lib.platforms.darwin;
   };
diff --git a/pkgs/tools/networking/openvpn/default.nix b/pkgs/tools/networking/openvpn/default.nix
index 6b98df215023..46375b60fe46 100644
--- a/pkgs/tools/networking/openvpn/default.nix
+++ b/pkgs/tools/networking/openvpn/default.nix
@@ -78,12 +78,12 @@ let
 in
 {
   openvpn_24 = generic {
-    version = "2.4.9";
-    sha256 = "1qpbllwlha7cffsd5dlddb8rl22g9rar5zflkz1wrcllhvfkl7v4";
+    version = "2.4.11";
+    sha256 = "06s4m0xvixjhd3azrzbsf4j86kah4xwr2jp6cmcpc7db33rfyyg5";
   };
 
   openvpn = generic {
-    version = "2.5.0";
-    sha256 = "sha256-AppCbkTWVstOEYkxnJX+b8mGQkdyT1WZ2Z35xMNHj70=";
+    version = "2.5.2";
+    sha256 = "sha256-sSdDg2kB82Xvr4KrJJOWfhshwh60POmo2hACoXycHcg=";
   };
 }
diff --git a/pkgs/tools/networking/openvpn/openvpn-auth-ldap.nix b/pkgs/tools/networking/openvpn/openvpn-auth-ldap.nix
index bb06479be30e..70dacddafc37 100644
--- a/pkgs/tools/networking/openvpn/openvpn-auth-ldap.nix
+++ b/pkgs/tools/networking/openvpn/openvpn-auth-ldap.nix
@@ -1,65 +1,50 @@
-{ stdenv, lib, fetchFromGitHub, fetchpatch,
-  autoreconfHook, re2c, openldap, openvpn, gnustep, check
+{ lib
+, stdenv
+, fetchFromGitHub
+, autoreconfHook
+, gnustep
+, re2c
+, openldap
+, openssl
+, openvpn
 }:
 
-let
-  srcName = "openvpn-auth-ldap";
-  srcVersion = "2.0.3";
-  debianRev = "6.1";
-
-  fetchPatchFromDebian =
-    {patch, sha256}:
-    fetchpatch {
-      inherit sha256;
-      url = "http://sources.debian.net/data/main/o/${srcName}/${srcVersion}-${debianRev}/debian/patches/${patch}";
-    };
-in
-
 stdenv.mkDerivation rec {
-  name = "${srcName}-${version}";
-  version = "${srcVersion}+deb${debianRev}";
+  pname = "openvpn-auth-ldap";
+  version = "2.0.4";
 
   src = fetchFromGitHub {
     owner = "threerings";
-    repo = srcName;
-    rev = "auth-ldap-${srcVersion}";
-    sha256 = "1v635ylzf5x3l3lirf3n6173q1w8g0ssjjkf27qqw98c3iqp63sq";
+    repo = "openvpn-auth-ldap";
+    rev = "auth-ldap-${version}";
+    sha256 = "1j30sygj8nm8wjqxzpb7pfzr3dxqxggswzxd7z5yk7y04c0yp1hb";
   };
 
-  patches = map fetchPatchFromDebian [
-    {patch = "STARTTLS_before_auth.patch";
-     sha256 = "02kky73mgx9jf16lpabppl271zyjn4a1160k8b6a0fax5ic8gbwk";}
-    {patch = "gobjc_4.7_runtime.patch";
-     sha256 = "0ljmdn70g5xp4kjcv59wg2wnqaifjdfdv1wlj356d10a7fzvxc76";}
-    {patch = "openvpn_ldap_simpler_add_handler_4";
-     sha256 = "0nha9mazp3dywbs1ywj8xi4ahzsjsasyrcic87v8c0x2nwl9kaa0";}
-    {patch = "auth-ldap-gnustep.patch";
-     sha256 = "053jni1s3pacpi2s43dkmk95j79ifh8rybjly13yy2dqffbasr31";}
-  ];
-
   nativeBuildInputs = [
     autoreconfHook
-  ];
-
-  buildInputs = [
-    check
     gnustep.base
     gnustep.libobjc
     gnustep.make
+    re2c
+  ];
+
+  buildInputs = [
     openldap
+    openssl
     openvpn
-    re2c
   ];
 
   configureFlags = [
-    "--with-objc-runtime=modern"
+    "--with-objc-runtime=GNU"
     "--with-openvpn=${openvpn}/include"
     "--libdir=$(out)/lib/openvpn"
   ];
 
+  doCheck = true;
+
   preInstall = ''
     mkdir -p $out/lib/openvpn $out/share/doc/openvpn/examples
-    cp README $out/share/doc/openvpn/
+    cp README.md $out/share/doc/openvpn/
     cp auth-ldap.conf $out/share/doc/openvpn/examples/
   '';
 
diff --git a/pkgs/tools/networking/v2ray/default.nix b/pkgs/tools/networking/v2ray/default.nix
index 89e2f0f320df..4c4b46c25206 100644
--- a/pkgs/tools/networking/v2ray/default.nix
+++ b/pkgs/tools/networking/v2ray/default.nix
@@ -3,22 +3,22 @@
 }:
 
 let
-  version = "4.38.3";
+  version = "4.39.2";
 
   src = fetchFromGitHub {
     owner = "v2fly";
     repo = "v2ray-core";
     rev = "v${version}";
-    sha256 = "1vsq98h6zbm3wz1mgphl7dqlabgfg53fhkyn47vfbhhkbx6nwl7c";
+    sha256 = "0rgwxsix2qy5w44s2ramalsn1bqznj2yra8bakcms8yl9yh0gbvd";
   };
 
-  vendorSha256 = "sha256-jXpGlJ30xBttysbUekMdw8fH0KVfPufWq0t7AXZrDEQ=";
+  vendorSha256 = "sha256-1LEKg9kyF4QBrzLP5TyKmFLPBprJRNqGxtkAI1mHx4Y=";
 
   assets = {
     # MIT licensed
     "geoip.dat" = let
-      geoipRev = "202104300531";
-      geoipSha256 = "0srskpp0pmw4fzp4lgachjjvig4fy96523r7aj2bwig0ipfgr401";
+      geoipRev = "202105270041";
+      geoipSha256 = "0g67lggc41himpnbbghm4xlnbv4dl2fyidxplh3pl6ajqb4wxwd5";
     in fetchurl {
       url = "https://github.com/v2fly/geoip/releases/download/${geoipRev}/geoip.dat";
       sha256 = geoipSha256;
@@ -26,8 +26,8 @@ let
 
     # MIT licensed
     "geosite.dat" = let
-      geositeRev = "20210430100800";
-      geositeSha256 = "0wp111iip3lhkgpbrzzivl5flj44vj7slx9w7k307sls6hmjzlcb";
+      geositeRev = "20210527065138";
+      geositeSha256 = "1335zyc5zrwws46ldv0sqn51kpkfwfksbfw6hd53fakz0whxki0g";
     in fetchurl {
       url = "https://github.com/v2fly/domain-list-community/releases/download/${geositeRev}/dlc.dat";
       sha256 = geositeSha256;
diff --git a/pkgs/tools/package-management/morph/default.nix b/pkgs/tools/package-management/morph/default.nix
index 61e4a897f48d..56d824059f53 100644
--- a/pkgs/tools/package-management/morph/default.nix
+++ b/pkgs/tools/package-management/morph/default.nix
@@ -1,18 +1,17 @@
-{ buildGoPackage, fetchFromGitHub, go-bindata, openssh, makeWrapper, lib }:
+{ buildGoModule, fetchFromGitHub, go-bindata, openssh, makeWrapper, lib }:
 
-buildGoPackage rec {
+buildGoModule rec {
   pname = "morph";
-  version = "1.5.0";
+  version = "1.6.0";
 
   src = fetchFromGitHub {
     owner = "dbcdk";
     repo = "morph";
     rev = "v${version}";
-    sha256 = "064ccvvq4yk17jy5jvi1nxfp5ajvnvn2k4zvh9v0n3ragcl3rd20";
+    sha256 = "0aibs4gsb9pl21nd93bf963kdzf0661qn0liaw8v8ak2xbz7nbs8";
   };
 
-  goPackagePath = "github.com/dbcdk/morph";
-  goDeps = ./deps.nix;
+  vendorSha256 = "08zzp0h4c4i5hk4whz06a3da7qjms6lr36596vxz0d8q0n7rspr9";
 
   nativeBuildInputs = [ makeWrapper go-bindata ];
 
@@ -28,7 +27,7 @@ buildGoPackage rec {
 
   postInstall = ''
     mkdir -p $lib
-    cp -v go/src/$goPackagePath/data/*.nix $lib
+    cp -v ./data/*.nix $lib
     wrapProgram $out/bin/morph --prefix PATH : ${lib.makeBinPath [ openssh ]};
   '';
 
diff --git a/pkgs/tools/security/b3sum/cargo-lock.patch b/pkgs/tools/security/b3sum/cargo-lock.patch
deleted file mode 100644
index 1f8494089477..000000000000
--- a/pkgs/tools/security/b3sum/cargo-lock.patch
+++ /dev/null
@@ -1,513 +0,0 @@
-diff --git a/Cargo.lock b/Cargo.lock
-new file mode 100644
-index 0000000..1dff162
---- /dev/null
-+++ b/Cargo.lock
-@@ -0,0 +1,507 @@
-+# This file is automatically @generated by Cargo.
-+# It is not intended for manual editing.
-+[[package]]
-+name = "ansi_term"
-+version = "0.11.0"
-+source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "ee49baf6cb617b853aa8d93bf420db2383fab46d314482ca2803b40d5fde979b"
-+dependencies = [
-+ "winapi",
-+]
-+
-+[[package]]
-+name = "anyhow"
-+version = "1.0.34"
-+source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "bf8dcb5b4bbaa28653b647d8c77bd4ed40183b48882e130c1f1ffb73de069fd7"
-+
-+[[package]]
-+name = "arrayref"
-+version = "0.3.6"
-+source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "a4c527152e37cf757a3f78aae5a06fbeefdb07ccc535c980a3208ee3060dd544"
-+
-+[[package]]
-+name = "arrayvec"
-+version = "0.5.2"
-+source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "23b62fc65de8e4e7f52534fb52b0f3ed04746ae267519eef2a83941e8085068b"
-+
-+[[package]]
-+name = "atty"
-+version = "0.2.14"
-+source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "d9b39be18770d11421cdb1b9947a45dd3f37e93092cbf377614828a319d5fee8"
-+dependencies = [
-+ "hermit-abi",
-+ "libc",
-+ "winapi",
-+]
-+
-+[[package]]
-+name = "autocfg"
-+version = "1.0.1"
-+source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "cdb031dd78e28731d87d56cc8ffef4a8f36ca26c38fe2de700543e627f8a464a"
-+
-+[[package]]
-+name = "b3sum"
-+version = "0.3.7"
-+dependencies = [
-+ "anyhow",
-+ "blake3",
-+ "clap",
-+ "duct",
-+ "hex",
-+ "memmap",
-+ "rayon",
-+ "tempfile",
-+ "wild",
-+]
-+
-+[[package]]
-+name = "bitflags"
-+version = "1.2.1"
-+source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "cf1de2fe8c75bc145a2f577add951f8134889b4795d47466a54a5c846d691693"
-+
-+[[package]]
-+name = "blake3"
-+version = "0.3.7"
-+dependencies = [
-+ "arrayref",
-+ "arrayvec",
-+ "cc",
-+ "cfg-if 0.1.10",
-+ "constant_time_eq",
-+ "crypto-mac",
-+ "digest",
-+ "rayon",
-+]
-+
-+[[package]]
-+name = "cc"
-+version = "1.0.62"
-+source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "f1770ced377336a88a67c473594ccc14eca6f4559217c34f64aac8f83d641b40"
-+
-+[[package]]
-+name = "cfg-if"
-+version = "0.1.10"
-+source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "4785bdd1c96b2a846b2bd7cc02e86b6b3dbf14e7e53446c4f54c92a361040822"
-+
-+[[package]]
-+name = "cfg-if"
-+version = "1.0.0"
-+source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
-+
-+[[package]]
-+name = "clap"
-+version = "2.33.3"
-+source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "37e58ac78573c40708d45522f0d80fa2f01cc4f9b4e2bf749807255454312002"
-+dependencies = [
-+ "ansi_term",
-+ "atty",
-+ "bitflags",
-+ "strsim",
-+ "textwrap",
-+ "unicode-width",
-+ "vec_map",
-+]
-+
-+[[package]]
-+name = "const_fn"
-+version = "0.4.3"
-+source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "c478836e029dcef17fb47c89023448c64f781a046e0300e257ad8225ae59afab"
-+
-+[[package]]
-+name = "constant_time_eq"
-+version = "0.1.5"
-+source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "245097e9a4535ee1e3e3931fcfcd55a796a44c643e8596ff6566d68f09b87bbc"
-+
-+[[package]]
-+name = "crossbeam-channel"
-+version = "0.5.0"
-+source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "dca26ee1f8d361640700bde38b2c37d8c22b3ce2d360e1fc1c74ea4b0aa7d775"
-+dependencies = [
-+ "cfg-if 1.0.0",
-+ "crossbeam-utils",
-+]
-+
-+[[package]]
-+name = "crossbeam-deque"
-+version = "0.8.0"
-+source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "94af6efb46fef72616855b036a624cf27ba656ffc9be1b9a3c931cfc7749a9a9"
-+dependencies = [
-+ "cfg-if 1.0.0",
-+ "crossbeam-epoch",
-+ "crossbeam-utils",
-+]
-+
-+[[package]]
-+name = "crossbeam-epoch"
-+version = "0.9.0"
-+source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "ec0f606a85340376eef0d6d8fec399e6d4a544d648386c6645eb6d0653b27d9f"
-+dependencies = [
-+ "cfg-if 1.0.0",
-+ "const_fn",
-+ "crossbeam-utils",
-+ "lazy_static",
-+ "memoffset",
-+ "scopeguard",
-+]
-+
-+[[package]]
-+name = "crossbeam-utils"
-+version = "0.8.0"
-+source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "ec91540d98355f690a86367e566ecad2e9e579f230230eb7c21398372be73ea5"
-+dependencies = [
-+ "autocfg",
-+ "cfg-if 1.0.0",
-+ "const_fn",
-+ "lazy_static",
-+]
-+
-+[[package]]
-+name = "crypto-mac"
-+version = "0.8.0"
-+source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "b584a330336237c1eecd3e94266efb216c56ed91225d634cb2991c5f3fd1aeab"
-+dependencies = [
-+ "generic-array",
-+ "subtle",
-+]
-+
-+[[package]]
-+name = "digest"
-+version = "0.9.0"
-+source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "d3dd60d1080a57a05ab032377049e0591415d2b31afd7028356dbf3cc6dcb066"
-+dependencies = [
-+ "generic-array",
-+]
-+
-+[[package]]
-+name = "duct"
-+version = "0.13.4"
-+source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "f90a9c3a25aafbd538c7d40a53f83c4487ee8216c12d1c8ef2c01eb2f6ea1553"
-+dependencies = [
-+ "libc",
-+ "once_cell",
-+ "os_pipe",
-+ "shared_child",
-+]
-+
-+[[package]]
-+name = "either"
-+version = "1.6.1"
-+source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "e78d4f1cc4ae33bbfc157ed5d5a5ef3bc29227303d595861deb238fcec4e9457"
-+
-+[[package]]
-+name = "generic-array"
-+version = "0.14.4"
-+source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "501466ecc8a30d1d3b7fc9229b122b2ce8ed6e9d9223f1138d4babb253e51817"
-+dependencies = [
-+ "typenum",
-+ "version_check",
-+]
-+
-+[[package]]
-+name = "getrandom"
-+version = "0.1.15"
-+source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "fc587bc0ec293155d5bfa6b9891ec18a1e330c234f896ea47fbada4cadbe47e6"
-+dependencies = [
-+ "cfg-if 0.1.10",
-+ "libc",
-+ "wasi",
-+]
-+
-+[[package]]
-+name = "glob"
-+version = "0.3.0"
-+source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "9b919933a397b79c37e33b77bb2aa3dc8eb6e165ad809e58ff75bc7db2e34574"
-+
-+[[package]]
-+name = "hermit-abi"
-+version = "0.1.17"
-+source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "5aca5565f760fb5b220e499d72710ed156fdb74e631659e99377d9ebfbd13ae8"
-+dependencies = [
-+ "libc",
-+]
-+
-+[[package]]
-+name = "hex"
-+version = "0.4.2"
-+source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "644f9158b2f133fd50f5fb3242878846d9eb792e445c893805ff0e3824006e35"
-+
-+[[package]]
-+name = "lazy_static"
-+version = "1.4.0"
-+source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "e2abad23fbc42b3700f2f279844dc832adb2b2eb069b2df918f455c4e18cc646"
-+
-+[[package]]
-+name = "libc"
-+version = "0.2.80"
-+source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "4d58d1b70b004888f764dfbf6a26a3b0342a1632d33968e4a179d8011c760614"
-+
-+[[package]]
-+name = "memmap"
-+version = "0.7.0"
-+source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "6585fd95e7bb50d6cc31e20d4cf9afb4e2ba16c5846fc76793f11218da9c475b"
-+dependencies = [
-+ "libc",
-+ "winapi",
-+]
-+
-+[[package]]
-+name = "memoffset"
-+version = "0.5.6"
-+source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "043175f069eda7b85febe4a74abbaeff828d9f8b448515d3151a14a3542811aa"
-+dependencies = [
-+ "autocfg",
-+]
-+
-+[[package]]
-+name = "num_cpus"
-+version = "1.13.0"
-+source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "05499f3756671c15885fee9034446956fff3f243d6077b91e5767df161f766b3"
-+dependencies = [
-+ "hermit-abi",
-+ "libc",
-+]
-+
-+[[package]]
-+name = "once_cell"
-+version = "1.5.2"
-+source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "13bd41f508810a131401606d54ac32a467c97172d74ba7662562ebba5ad07fa0"
-+
-+[[package]]
-+name = "os_pipe"
-+version = "0.9.2"
-+source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "fb233f06c2307e1f5ce2ecad9f8121cffbbee2c95428f44ea85222e460d0d213"
-+dependencies = [
-+ "libc",
-+ "winapi",
-+]
-+
-+[[package]]
-+name = "ppv-lite86"
-+version = "0.2.10"
-+source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "ac74c624d6b2d21f425f752262f42188365d7b8ff1aff74c82e45136510a4857"
-+
-+[[package]]
-+name = "rand"
-+version = "0.7.3"
-+source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "6a6b1679d49b24bbfe0c803429aa1874472f50d9b363131f0e89fc356b544d03"
-+dependencies = [
-+ "getrandom",
-+ "libc",
-+ "rand_chacha",
-+ "rand_core",
-+ "rand_hc",
-+]
-+
-+[[package]]
-+name = "rand_chacha"
-+version = "0.2.2"
-+source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "f4c8ed856279c9737206bf725bf36935d8666ead7aa69b52be55af369d193402"
-+dependencies = [
-+ "ppv-lite86",
-+ "rand_core",
-+]
-+
-+[[package]]
-+name = "rand_core"
-+version = "0.5.1"
-+source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "90bde5296fc891b0cef12a6d03ddccc162ce7b2aff54160af9338f8d40df6d19"
-+dependencies = [
-+ "getrandom",
-+]
-+
-+[[package]]
-+name = "rand_hc"
-+version = "0.2.0"
-+source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "ca3129af7b92a17112d59ad498c6f81eaf463253766b90396d39ea7a39d6613c"
-+dependencies = [
-+ "rand_core",
-+]
-+
-+[[package]]
-+name = "rayon"
-+version = "1.5.0"
-+source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "8b0d8e0819fadc20c74ea8373106ead0600e3a67ef1fe8da56e39b9ae7275674"
-+dependencies = [
-+ "autocfg",
-+ "crossbeam-deque",
-+ "either",
-+ "rayon-core",
-+]
-+
-+[[package]]
-+name = "rayon-core"
-+version = "1.9.0"
-+source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "9ab346ac5921dc62ffa9f89b7a773907511cdfa5490c572ae9be1be33e8afa4a"
-+dependencies = [
-+ "crossbeam-channel",
-+ "crossbeam-deque",
-+ "crossbeam-utils",
-+ "lazy_static",
-+ "num_cpus",
-+]
-+
-+[[package]]
-+name = "redox_syscall"
-+version = "0.1.57"
-+source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "41cc0f7e4d5d4544e8861606a285bb08d3e70712ccc7d2b84d7c0ccfaf4b05ce"
-+
-+[[package]]
-+name = "remove_dir_all"
-+version = "0.5.3"
-+source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "3acd125665422973a33ac9d3dd2df85edad0f4ae9b00dafb1a05e43a9f5ef8e7"
-+dependencies = [
-+ "winapi",
-+]
-+
-+[[package]]
-+name = "scopeguard"
-+version = "1.1.0"
-+source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "d29ab0c6d3fc0ee92fe66e2d99f700eab17a8d57d1c1d3b748380fb20baa78cd"
-+
-+[[package]]
-+name = "shared_child"
-+version = "0.3.4"
-+source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "8cebcf3a403e4deafaf34dc882c4a1b6a648b43e5670aa2e4bb985914eaeb2d2"
-+dependencies = [
-+ "libc",
-+ "winapi",
-+]
-+
-+[[package]]
-+name = "strsim"
-+version = "0.8.0"
-+source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "8ea5119cdb4c55b55d432abb513a0429384878c15dde60cc77b1c99de1a95a6a"
-+
-+[[package]]
-+name = "subtle"
-+version = "2.3.0"
-+source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "343f3f510c2915908f155e94f17220b19ccfacf2a64a2a5d8004f2c3e311e7fd"
-+
-+[[package]]
-+name = "tempfile"
-+version = "3.1.0"
-+source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "7a6e24d9338a0a5be79593e2fa15a648add6138caa803e2d5bc782c371732ca9"
-+dependencies = [
-+ "cfg-if 0.1.10",
-+ "libc",
-+ "rand",
-+ "redox_syscall",
-+ "remove_dir_all",
-+ "winapi",
-+]
-+
-+[[package]]
-+name = "textwrap"
-+version = "0.11.0"
-+source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "d326610f408c7a4eb6f51c37c330e496b08506c9457c9d34287ecc38809fb060"
-+dependencies = [
-+ "unicode-width",
-+]
-+
-+[[package]]
-+name = "typenum"
-+version = "1.12.0"
-+source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "373c8a200f9e67a0c95e62a4f52fbf80c23b4381c05a17845531982fa99e6b33"
-+
-+[[package]]
-+name = "unicode-width"
-+version = "0.1.8"
-+source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "9337591893a19b88d8d87f2cec1e73fad5cdfd10e5a6f349f498ad6ea2ffb1e3"
-+
-+[[package]]
-+name = "vec_map"
-+version = "0.8.2"
-+source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "f1bddf1187be692e79c5ffeab891132dfb0f236ed36a43c7ed39f1165ee20191"
-+
-+[[package]]
-+name = "version_check"
-+version = "0.9.2"
-+source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "b5a972e5669d67ba988ce3dc826706fb0a8b01471c088cb0b6110b805cc36aed"
-+
-+[[package]]
-+name = "wasi"
-+version = "0.9.0+wasi-snapshot-preview1"
-+source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "cccddf32554fecc6acb585f82a32a72e28b48f8c4c1883ddfeeeaa96f7d8e519"
-+
-+[[package]]
-+name = "wild"
-+version = "2.0.4"
-+source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "035793abb854745033f01a07647a79831eba29ec0be377205f2a25b0aa830020"
-+dependencies = [
-+ "glob",
-+]
-+
-+[[package]]
-+name = "winapi"
-+version = "0.3.9"
-+source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "5c839a674fcd7a98952e593242ea400abe93992746761e38641405d28b00f419"
-+dependencies = [
-+ "winapi-i686-pc-windows-gnu",
-+ "winapi-x86_64-pc-windows-gnu",
-+]
-+
-+[[package]]
-+name = "winapi-i686-pc-windows-gnu"
-+version = "0.4.0"
-+source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
-+
-+[[package]]
-+name = "winapi-x86_64-pc-windows-gnu"
-+version = "0.4.0"
-+source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
diff --git a/pkgs/tools/security/b3sum/default.nix b/pkgs/tools/security/b3sum/default.nix
index 9cfc68146f95..1d9b2f66debf 100644
--- a/pkgs/tools/security/b3sum/default.nix
+++ b/pkgs/tools/security/b3sum/default.nix
@@ -1,21 +1,15 @@
-{ lib, fetchFromGitHub, rustPlatform }:
+{ lib, fetchCrate, rustPlatform }:
 
 rustPlatform.buildRustPackage rec {
   pname = "b3sum";
-  version = "0.3.7";
+  version = "0.3.8";
 
-  src = fetchFromGitHub {
-    owner = "BLAKE3-team";
-    repo = "BLAKE3";
-    rev = version;
-    sha256 = "0r3nj7jbrpb2gkkfa9h6nv6blrbv6dlrhxg131qnh340q1ysh0x7";
+  src = fetchCrate {
+    inherit version pname;
+    sha256 = "1a42kwbl886yymm3v7h6y957x5f4yi9j40jy4szg9k0iy8bsdfmh";
   };
 
-  sourceRoot = "source/b3sum";
-
-  cargoSha256 = "18l6j756s6qfmiy3z2cai7i62wskf04xi7y4dlcv4aiv4sv3nx9r";
-
-  cargoPatches = [ ./cargo-lock.patch ];
+  cargoSha256 = "0v7ric12agicppg5ax5q0vwbslw7kmxpinafvdjj5sc2ysinw1zm";
 
   meta = {
     description = "BLAKE3 cryptographic hash function";
diff --git a/pkgs/tools/security/b3sum/update-cargo-lock.sh b/pkgs/tools/security/b3sum/update-cargo-lock.sh
deleted file mode 100755
index 8c52ad5cf6c0..000000000000
--- a/pkgs/tools/security/b3sum/update-cargo-lock.sh
+++ /dev/null
@@ -1,19 +0,0 @@
-#!/bin/sh
-
-# This updates cargo-lock.patch for the b3sum version listed in default.nix.
-
-set -eu -o verbose
-
-here=$PWD
-version=$(cat default.nix | grep '^  version = "' | cut -d '"' -f 2)
-checkout=$(mktemp -d)
-git clone -b "$version" --depth=1 https://github.com/BLAKE3-team/BLAKE3 "$checkout"
-cd "$checkout"
-
-(cd b3sum && cargo generate-lockfile)
-mv b3sum/Cargo.lock ./
-git add -f Cargo.lock
-git diff HEAD -- Cargo.lock > "$here"/cargo-lock.patch
-
-cd "$here"
-rm -rf "$checkout"
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 42abd70c9acd..e563a29cb2ee 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -984,6 +984,8 @@ in
 
   tilix = callPackage ../applications/terminal-emulators/tilix { };
 
+  twine = with python3Packages; toPythonApplication twine;
+
   wayst = callPackage ../applications/terminal-emulators/wayst { };
 
   wezterm = callPackage ../applications/terminal-emulators/wezterm {
@@ -7138,6 +7140,8 @@ in
 
   pandoc-plantuml-filter = python3Packages.callPackage ../tools/misc/pandoc-plantuml-filter { };
 
+  patray = callPackage ../tools/audio/patray { };
+
   pasystray = callPackage ../tools/audio/pasystray { };
 
   phash = callPackage ../development/libraries/phash { };
@@ -9429,6 +9433,11 @@ in
     openssl = null;
   };
 
+  openconnect_head = callPackage ../tools/networking/openconnect {
+    head = true;
+    openssl = null;
+  };
+
   ding-libs = callPackage ../tools/misc/ding-libs { };
 
   sssd = callPackage ../os-specific/linux/sssd {
@@ -17148,6 +17157,7 @@ in
   nuspellWithDicts = dicts: callPackage ../development/libraries/nuspell/wrapper.nix { inherit dicts; };
 
   nv-codec-headers = callPackage ../development/libraries/nv-codec-headers { };
+  nv-codec-headers-10 = callPackage ../development/libraries/nv-codec-headers/10_x.nix { };
 
   mkNvidiaContainerPkg = { name, containerRuntimePath, configTemplate, additionalPaths ? [] }:
     let
@@ -18346,6 +18356,7 @@ in
   webkitgtk = callPackage ../development/libraries/webkitgtk {
     harfbuzz = harfbuzzFull;
     inherit (gst_all_1) gst-plugins-base gst-plugins-bad;
+    inherit (darwin.apple_sdk) sdk;
   };
 
   websocketpp = callPackage ../development/libraries/websocket++ { };
@@ -20676,7 +20687,7 @@ in
 
   # Update this when adding the newest kernel major version!
   # And update linux_latest_for_hardened below if the patches are already available
-  linuxPackages_latest = linuxPackages_5_11;
+  linuxPackages_latest = linuxPackages_5_12;
   linux_latest = linuxPackages_latest.kernel;
 
   # Realtime kernel packages.
@@ -27590,6 +27601,10 @@ in
   libxpdf = callPackage ../applications/misc/xpdf/libxpdf.nix { };
 
   xpra = callPackage ../tools/X11/xpra { };
+  xpraWithNvenc = callPackage ../tools/X11/xpra {
+    withNvenc = true;
+    nvidia_x11 = linuxPackages.nvidia_x11.override { libsOnly = true; };
+  };
   libfakeXinerama = callPackage ../tools/X11/xpra/libfakeXinerama.nix { };
 
 
@@ -28490,10 +28505,7 @@ in
     boost = boost166;
   };
 
-  pinball = callPackage ../games/pinball {
-    autoreconfHook = with buildPackages;
-      autoreconfHook.override { automake = automake115x; };
-  };
+  pinball = callPackage ../games/pinball { };
 
   pingus = callPackage ../games/pingus {};
 
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 2661bef8ed57..e562c64b5ffe 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -1391,6 +1391,8 @@ in {
 
   clf = callPackage ../development/python-modules/clf { };
 
+  cock = callPackage ../development/python-modules/cock { };
+
   click = callPackage ../development/python-modules/click { };
 
   clickclick = callPackage ../development/python-modules/clickclick { };
@@ -1481,6 +1483,8 @@ in {
 
   cocotb = callPackage ../development/python-modules/cocotb { };
 
+  cocotb-bus = callPackage ../development/python-modules/cocotb-bus { };
+
   codecov = callPackage ../development/python-modules/codecov { };
 
   codespell = callPackage ../development/python-modules/codespell { };