diff --git a/nixos/modules/config/fonts/fontconfig.nix b/nixos/modules/config/fonts/fontconfig.nix
index ac2a024eaa89..52d284f739b3 100644
--- a/nixos/modules/config/fonts/fontconfig.nix
+++ b/nixos/modules/config/fonts/fontconfig.nix
@@ -214,15 +214,7 @@ let
     # fontconfig default config files
     ln -s ${supportPkg.out}/etc/fonts/conf.d/*.conf \
           $support_folder/
-    ln -s ${latestPkg.out}/etc/fonts/conf.d/*.conf \
-          $latest_folder/
-
-    # update latest 51-local.conf path to look at the latest local.conf
-    rm    $latest_folder/51-local.conf
-
-    substitute ${latestPkg.out}/etc/fonts/conf.d/51-local.conf \
-               $latest_folder/51-local.conf \
-               --replace local.conf /etc/fonts/${latestVersion}/local.conf
+    # Latest fontconfig is configured to look for the upstream defaults inside the package.
 
     # 00-nixos-cache.conf
     ln -s ${cacheConfSupport} \
@@ -236,7 +228,11 @@ let
     # 50-user.conf
     ${optionalString (!cfg.includeUserConf) ''
     rm $support_folder/50-user.conf
-    rm $latest_folder/50-user.conf
+    ''}
+    # Since latest fontconfig looks for default files inside the package,
+    # we had to move this one elsewhere to be able to exclude it here.
+    ${optionalString cfg.includeUserConf ''
+    ln -s ${latestPkg.out}/etc/fonts/conf.d.bak/50-user.conf $latest_folder/50-user.conf
     ''}
 
     # local.conf (indirect priority 51)
diff --git a/nixos/modules/system/boot/stage-1.nix b/nixos/modules/system/boot/stage-1.nix
index d551466f52eb..63005b26f6f5 100644
--- a/nixos/modules/system/boot/stage-1.nix
+++ b/nixos/modules/system/boot/stage-1.nix
@@ -111,8 +111,8 @@ let
       copy_bin_and_libs ${pkgs.utillinux}/sbin/blkid
 
       # Copy dmsetup and lvm.
-      copy_bin_and_libs ${pkgs.lvm2}/sbin/dmsetup
-      copy_bin_and_libs ${pkgs.lvm2}/sbin/lvm
+      copy_bin_and_libs ${getBin pkgs.lvm2}/bin/dmsetup
+      copy_bin_and_libs ${getBin pkgs.lvm2}/bin/lvm
 
       # Add RAID mdadm tool.
       copy_bin_and_libs ${pkgs.mdadm}/sbin/mdadm
@@ -235,7 +235,7 @@ let
             --replace cdrom_id ${extraUtils}/bin/cdrom_id \
             --replace ${pkgs.coreutils}/bin/basename ${extraUtils}/bin/basename \
             --replace ${pkgs.utillinux}/bin/blkid ${extraUtils}/bin/blkid \
-            --replace ${pkgs.lvm2}/sbin ${extraUtils}/bin \
+            --replace ${getBin pkgs.lvm2}/bin ${extraUtils}/bin \
             --replace ${pkgs.mdadm}/sbin ${extraUtils}/sbin \
             --replace ${pkgs.bash}/bin/sh ${extraUtils}/bin/sh \
             --replace ${udev} ${extraUtils}
diff --git a/nixos/modules/tasks/lvm.nix b/nixos/modules/tasks/lvm.nix
index d56a8a2f63a8..b8f7a01e44ed 100644
--- a/nixos/modules/tasks/lvm.nix
+++ b/nixos/modules/tasks/lvm.nix
@@ -1,17 +1,70 @@
 { config, lib, pkgs, ... }:
 
 with lib;
-
-{
-
-  ###### implementation
-
-  config = mkIf (!config.boot.isContainer) {
-
-    environment.systemPackages = [ pkgs.lvm2 ];
-
-    services.udev.packages = [ pkgs.lvm2 ];
-
+let
+  cfg = config.services.lvm;
+in {
+  options.services.lvm = {
+    package = mkOption {
+      type = types.package;
+      default = if cfg.dmeventd.enable then pkgs.lvm2_dmeventd else pkgs.lvm2;
+      internal = true;
+      defaultText = "pkgs.lvm2";
+      description = ''
+        This option allows you to override the LVM package that's used on the system
+        (udev rules, tmpfiles, systemd services).
+        Defaults to pkgs.lvm2, or pkgs.lvm2_dmeventd if dmeventd is enabled.
+      '';
+    };
+    dmeventd.enable = mkEnableOption "the LVM dmevent daemon";
+    boot.thin.enable = mkEnableOption "support for booting from ThinLVs";
   };
 
+  config = mkMerge [
+    (mkIf (!config.boot.isContainer) {
+      environment.etc."tmpfiles.d/lvm2.conf".source = "${cfg.package}/lib/tmpfiles.d/lvm2.conf";
+      environment.systemPackages = [ cfg.package ];
+      systemd.packages = [ cfg.package ];
+
+      # TODO: update once https://github.com/NixOS/nixpkgs/pull/93006 was merged
+      services.udev.packages = [ cfg.package.out ];
+    })
+    (mkIf cfg.dmeventd.enable {
+      systemd.sockets."dm-event".wantedBy = [ "sockets.target" ];
+      systemd.services."lvm2-monitor".wantedBy = [ "sysinit.target" ];
+
+      environment.etc."lvm/lvm.conf".text = ''
+        dmeventd/executable = "${cfg.package}/bin/dmeventd"
+      '';
+    })
+    (mkIf cfg.boot.thin.enable {
+      boot.initrd = {
+        kernelModules = [ "dm-snapshot" "dm-thin-pool" ];
+
+        extraUtilsCommands = ''
+          copy_bin_and_libs ${pkgs.thin-provisioning-tools}/bin/pdata_tools
+          copy_bin_and_libs ${pkgs.thin-provisioning-tools}/bin/thin_check
+        '';
+      };
+
+      environment.etc."lvm/lvm.conf".text = ''
+        global/thin_check_executable = "${pkgs.thin-provisioning-tools}/bin/thin_check"
+      '';
+    })
+    (mkIf (cfg.dmeventd.enable || cfg.boot.thin.enable) {
+      boot.initrd.preLVMCommands = ''
+          mkdir -p /etc/lvm
+          cat << EOF >> /etc/lvm/lvm.conf
+          ${optionalString cfg.boot.thin.enable ''
+            global/thin_check_executable = "$(command -v thin_check)"
+          ''}
+          ${optionalString cfg.dmeventd.enable ''
+            dmeventd/executable = "$(command -v false)"
+            activation/monitoring = 0
+          ''}
+          EOF
+      '';
+    })
+  ];
+
 }
diff --git a/nixos/tests/installer.nix b/nixos/tests/installer.nix
index eef9abebf9f2..22132073142f 100644
--- a/nixos/tests/installer.nix
+++ b/nixos/tests/installer.nix
@@ -64,7 +64,7 @@ let
   # a test script fragment `createPartitions', which must create
   # partitions and filesystems.
   testScriptFun = { bootLoader, createPartitions, grubVersion, grubDevice, grubUseEfi
-                  , grubIdentifier, preBootCommands, extraConfig
+                  , grubIdentifier, preBootCommands, postBootCommands, extraConfig
                   , testSpecialisationConfig
                   }:
     let iface = if grubVersion == 1 then "ide" else "virtio";
@@ -216,6 +216,7 @@ let
       machine = create_machine_named("boot-after-rebuild-switch")
       ${preBootCommands}
       machine.wait_for_unit("network.target")
+      ${postBootCommands}
       machine.shutdown()
 
       # Tests for validating clone configuration entries in grub menu
@@ -238,6 +239,7 @@ let
       with subtest("Set grub to boot the second configuration"):
           machine.succeed("grub-reboot 1")
 
+      ${postBootCommands}
       machine.shutdown()
 
       # Reboot Machine
@@ -252,12 +254,13 @@ let
       with subtest("We should find a file named /etc/gitconfig"):
           machine.succeed("test -e /etc/gitconfig")
 
+      ${postBootCommands}
       machine.shutdown()
     '';
 
 
   makeInstallerTest = name:
-    { createPartitions, preBootCommands ? "", extraConfig ? ""
+    { createPartitions, preBootCommands ? "", postBootCommands ? "", extraConfig ? ""
     , extraInstallerConfig ? {}
     , bootLoader ? "grub" # either "grub" or "systemd-boot"
     , grubVersion ? 2, grubDevice ? "/dev/vda", grubIdentifier ? "uuid", grubUseEfi ? false
@@ -335,7 +338,7 @@ let
       };
 
       testScript = testScriptFun {
-        inherit bootLoader createPartitions preBootCommands
+        inherit bootLoader createPartitions preBootCommands postBootCommands
                 grubVersion grubDevice grubIdentifier grubUseEfi extraConfig
                 testSpecialisationConfig;
       };
@@ -552,16 +555,26 @@ in {
           + " mkpart primary 2048M -1s"  # PV2
           + " set 2 lvm on",
           "udevadm settle",
+          "sleep 1",
           "pvcreate /dev/vda1 /dev/vda2",
+          "sleep 1",
           "vgcreate MyVolGroup /dev/vda1 /dev/vda2",
+          "sleep 1",
           "lvcreate --size 1G --name swap MyVolGroup",
+          "sleep 1",
           "lvcreate --size 2G --name nixos MyVolGroup",
+          "sleep 1",
           "mkswap -f /dev/MyVolGroup/swap -L swap",
           "swapon -L swap",
           "mkfs.xfs -L nixos /dev/MyVolGroup/nixos",
           "mount LABEL=nixos /mnt",
       )
     '';
+    postBootCommands = ''
+      assert "loaded active" in machine.succeed(
+          "systemctl list-units 'lvm2-pvscan@*' -ql --no-legend | tee /dev/stderr"
+      )
+    '';
   };
 
   # Boot off an encrypted root partition with the default LUKS header format
diff --git a/nixos/tests/systemd.nix b/nixos/tests/systemd.nix
index ce950be48460..a653932fb37c 100644
--- a/nixos/tests/systemd.nix
+++ b/nixos/tests/systemd.nix
@@ -104,6 +104,11 @@ import ./make-test-python.nix ({ pkgs, ... }: {
             re.search(r"^Filesystem state: *clean$", extinfo, re.MULTILINE) is not None
         ), ("File system was not cleanly unmounted: " + extinfo)
 
+    # Regression test for https://github.com/NixOS/nixpkgs/pull/91232
+    with subtest("setting transient hostnames works"):
+        machine.succeed("hostnamectl set-hostname --transient machine-transient")
+        machine.fail("hostnamectl set-hostname machine-all")
+
     with subtest("systemd-shutdown works"):
         machine.shutdown()
         machine.wait_for_unit("multi-user.target")
diff --git a/pkgs/applications/audio/jackmix/default.nix b/pkgs/applications/audio/jackmix/default.nix
index c3a46439ba70..ad01a3ff76ec 100644
--- a/pkgs/applications/audio/jackmix/default.nix
+++ b/pkgs/applications/audio/jackmix/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, pkgconfig, scons, qt4, lash, libjack2, jack ? libjack2 }:
+{ stdenv, fetchurl, pkgconfig, sconsPackages, qt4, lash, libjack2, jack ? libjack2 }:
 
 stdenv.mkDerivation {
   name = "jackmix-0.5.2";
@@ -9,7 +9,7 @@ stdenv.mkDerivation {
 
   patches = [ ./no_error.patch ];
 
-  nativeBuildInputs = [ scons.py2 pkgconfig ];
+  nativeBuildInputs = [ sconsPackages.scons_3_1_2 pkgconfig ];
   buildInputs = [
     qt4
     lash
diff --git a/pkgs/applications/audio/mixxx/default.nix b/pkgs/applications/audio/mixxx/default.nix
index e1d1585cacc0..84e445e8538c 100644
--- a/pkgs/applications/audio/mixxx/default.nix
+++ b/pkgs/applications/audio/mixxx/default.nix
@@ -3,7 +3,7 @@
 , libid3tag, libmad, libopus, libshout, libsndfile, libusb1, libvorbis
 , libGLU, libxcb, lilv, lv2, opusfile
 , pkgconfig, portaudio, portmidi, protobuf, qtbase, qtscript, qtsvg
-, qtx11extras, rubberband, scons, sqlite, taglib, upower, vamp-plugin-sdk
+, qtx11extras, rubberband, sconsPackages, sqlite, taglib, upower, vamp-plugin-sdk
 }:
 
 let
@@ -28,7 +28,7 @@ mkDerivation rec {
     sha256 = "1dj9li8av9b2kbm76jvvbdmihy1pyrw0s4xd7dd524wfhwr1llxr";
   };
 
-  nativeBuildInputs = [ scons.py2 ];
+  nativeBuildInputs = [ sconsPackages.scons_3_1_2 ];
   buildInputs = [
     chromaprint fftw flac faad2 glibcLocales mp4v2 libid3tag libmad libopus libshout241 libsndfile
     libusb1 libvorbis libxcb libGLU lilv lv2 opusfile pkgconfig portaudio portmidi protobuf qtbase qtscript qtsvg
diff --git a/pkgs/applications/audio/rhvoice/default.nix b/pkgs/applications/audio/rhvoice/default.nix
index 7a0a8a59a084..a29fcf383b8e 100644
--- a/pkgs/applications/audio/rhvoice/default.nix
+++ b/pkgs/applications/audio/rhvoice/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, pkgconfig, fetchFromGitHub, scons
+{ stdenv, lib, pkgconfig, fetchFromGitHub, sconsPackages
 , python, glibmm, libpulseaudio, libao }:
 
 let
@@ -15,7 +15,7 @@ in stdenv.mkDerivation {
   };
 
   nativeBuildInputs = [
-    scons.py2 pkgconfig
+    sconsPackages.scons_3_1_2 pkgconfig
   ];
 
   buildInputs = [
diff --git a/pkgs/applications/editors/vim/common.nix b/pkgs/applications/editors/vim/common.nix
index 47e71e2da4d1..5be7078173e0 100644
--- a/pkgs/applications/editors/vim/common.nix
+++ b/pkgs/applications/editors/vim/common.nix
@@ -1,12 +1,12 @@
 { lib, fetchFromGitHub }:
 rec {
-  version = "8.2.0701";
+  version = "8.2.1123";
 
   src = fetchFromGitHub {
     owner = "vim";
     repo = "vim";
     rev = "v${version}";
-    sha256 = "1cbh2nhbvhp4kclc9fd8gqij2vi11c5zwdwn1nzg805k06hwmsrp";
+    sha256 = "01fgfm5pnmbq12z84d7g3x0iq5gj1irdyihx41c4r2bww55v5q0c";
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/applications/graphics/darktable/default.nix b/pkgs/applications/graphics/darktable/default.nix
index e0bcf9ab95ca..6327548dc142 100644
--- a/pkgs/applications/graphics/darktable/default.nix
+++ b/pkgs/applications/graphics/darktable/default.nix
@@ -34,8 +34,6 @@ stdenv.mkDerivation rec {
     "-DUSE_KWALLET=OFF"
   ];
 
-  # Doc has high risk of collisions
-  postInstall = "rm -r $out/share/doc";
 
   # darktable changed its rpath handling in commit
   # 83c70b876af6484506901e6b381304ae0d073d3c and as a result the
diff --git a/pkgs/applications/graphics/fluxus/default.nix b/pkgs/applications/graphics/fluxus/default.nix
index a53eb806bcf1..f560ad45c574 100644
--- a/pkgs/applications/graphics/fluxus/default.nix
+++ b/pkgs/applications/graphics/fluxus/default.nix
@@ -18,7 +18,7 @@
 , openal
 , openssl
 , racket
-, scons
+, sconsPackages
 , zlib
 }:
 let
@@ -69,7 +69,7 @@ stdenv.mkDerivation rec {
     openssl.dev
     racket
   ];
-  nativeBuildInputs = [ scons.py2 ];
+  nativeBuildInputs = [ sconsPackages.scons_3_1_2 ];
 
   patches = [ ./fix-build.patch ];
   sconsFlags = [
diff --git a/pkgs/applications/networking/browsers/firefox/common.nix b/pkgs/applications/networking/browsers/firefox/common.nix
index c3228a6a728c..2f86870ea8ae 100644
--- a/pkgs/applications/networking/browsers/firefox/common.nix
+++ b/pkgs/applications/networking/browsers/firefox/common.nix
@@ -8,7 +8,7 @@
 , yasm, libGLU, libGL, sqlite, unzip, makeWrapper
 , hunspell, libXdamage, libevent, libstartup_notification
 , libvpx, libvpx_1_8
-, icu, libpng, jemalloc, glib
+, icu, icu67, libpng, jemalloc, glib
 , autoconf213, which, gnused, cargo, rustc, llvmPackages
 , rust-cbindgen, nodejs, nasm, fetchpatch
 , debugBuild ? false
@@ -111,7 +111,7 @@ stdenv.mkDerivation ({
     xorg.libXScrnSaver xorg.xorgproto
     xorg.libXext unzip makeWrapper
     libevent libstartup_notification /* cairo */
-    icu libpng jemalloc glib
+    libpng jemalloc glib
     nasm
     # >= 66 requires nasm for the AV1 lib dav1d
     # yasm can potentially be removed in future versions
@@ -119,8 +119,10 @@ stdenv.mkDerivation ({
     # https://groups.google.com/forum/#!msg/mozilla.dev.platform/o-8levmLU80/SM_zQvfzCQAJ
     nspr nss
   ]
-  ++ lib.optionals  (lib.versionOlder ffversion "75") [ libvpx sqlite ]
+  ++ lib.optionals (lib.versionOlder ffversion "75") [ libvpx sqlite ]
   ++ lib.optional  (lib.versionAtLeast ffversion "75.0") libvpx_1_8
+  ++ lib.optional  (lib.versionOlder ffversion "78") icu
+  ++ lib.optional  (lib.versionAtLeast ffversion "78.0") icu67
   ++ lib.optional  alsaSupport alsaLib
   ++ lib.optional  pulseaudioSupport libpulseaudio # only headers are needed
   ++ lib.optional  gtk3Support gtk3
@@ -200,7 +202,6 @@ stdenv.mkDerivation ({
     "--enable-application=browser"
     "--with-system-jpeg"
     "--with-system-zlib"
-    "--with-system-bz2"
     "--with-system-libevent"
     "--with-system-libvpx"
     "--with-system-png" # needs APNG support
@@ -208,19 +209,21 @@ stdenv.mkDerivation ({
     "--enable-system-ffi"
     "--enable-system-pixman"
     #"--enable-system-cairo"
-    "--enable-startup-notification"
-    #"--enable-content-sandbox" # TODO: probably enable after 54
     "--disable-tests"
     "--disable-necko-wifi" # maybe we want to enable this at some point
     "--disable-updater"
     "--enable-jemalloc"
-    "--disable-gconf"
     "--enable-default-toolkit=${default-toolkit}"
     "--with-libclang-path=${llvmPackages.libclang}/lib"
     "--with-clang-path=${llvmPackages.clang}/bin/clang"
     "--with-system-nspr"
     "--with-system-nss"
   ]
+  ++ lib.optionals (lib.versionOlder ffversion "78") [
+    "--with-system-bz2"
+    "--enable-startup-notification"
+    "--disable-gconf"
+  ]
   ++ lib.optional (lib.versionOlder ffversion "75") "--enable-system-sqlite"
   ++ lib.optional (stdenv.isDarwin) "--disable-xcode-checks"
   ++ lib.optionals (lib.versionOlder ffversion "69") [
diff --git a/pkgs/applications/networking/browsers/firefox/packages.nix b/pkgs/applications/networking/browsers/firefox/packages.nix
index e551cd8b2ea3..eca636863965 100644
--- a/pkgs/applications/networking/browsers/firefox/packages.nix
+++ b/pkgs/applications/networking/browsers/firefox/packages.nix
@@ -1,4 +1,4 @@
-{ config, stdenv, lib, callPackage, fetchurl }:
+{ config, stdenv, lib, callPackage, fetchurl, nss_3_44 }:
 
 let
   common = opts: callPackage (import ./common.nix opts) {};
@@ -7,10 +7,10 @@ in
 rec {
   firefox = common rec {
     pname = "firefox";
-    ffversion = "77.0.1";
+    ffversion = "78.0.1";
     src = fetchurl {
       url = "mirror://mozilla/firefox/releases/${ffversion}/source/firefox-${ffversion}.source.tar.xz";
-      sha512 = "ngLihC0YuclLJEV3iPEX+tRzDKIdBe+CCOuFxvWNo7DnX8royOvTj2m4YyWyZoTQ5UCbPTQYmP4otgfovZSe8g==";
+      sha512 = "mdO6masIpiZBvYi6kpYUTSnsOda04CUs2CL1LNf1Yad+rfY4ga4aFuLtfKqfgV5IcIIl86XeiC+0grd4irbCYg==";
     };
 
     patches = [
@@ -33,7 +33,7 @@ rec {
     };
   };
 
-  firefox-esr-68 = common rec {
+  firefox-esr-68 = (common rec {
     pname = "firefox-esr";
     ffversion = "68.10.0esr";
     src = fetchurl {
@@ -53,5 +53,11 @@ rec {
       versionSuffix = "esr";
       versionKey = "ffversion";
     };
+  }).override {
+    # Mozilla unfortunately doesn't support building with latest NSS anymore;
+    # instead they provide ESR releases for NSS:
+    # https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_Releases
+    nss = nss_3_44;
   };
+
 }
diff --git a/pkgs/applications/networking/instant-messengers/swift-im/default.nix b/pkgs/applications/networking/instant-messengers/swift-im/default.nix
index 953ce2809c43..c520835b1f0c 100644
--- a/pkgs/applications/networking/instant-messengers/swift-im/default.nix
+++ b/pkgs/applications/networking/instant-messengers/swift-im/default.nix
@@ -1,4 +1,4 @@
-{ mkDerivation, stdenv, fetchurl, pkgconfig, qttools, scons
+{ mkDerivation, stdenv, fetchurl, pkgconfig, qttools, sconsPackages
 , GConf, avahi, boost, hunspell, libXScrnSaver, libedit, libidn, libnatpmp, libxml2
 , lua, miniupnpc, openssl, qtbase, qtmultimedia, qtsvg, qtwebkit, qtx11extras, zlib
 }:
@@ -14,7 +14,7 @@ mkDerivation rec {
 
   patches = [ ./qt-5.11.patch ./scons.patch ];
 
-  nativeBuildInputs = [ pkgconfig qttools scons.py2 ];
+  nativeBuildInputs = [ pkgconfig qttools sconsPackages.scons_3_1_2 ];
 
   buildInputs = [
     GConf avahi boost hunspell libXScrnSaver libedit libidn libnatpmp libxml2
diff --git a/pkgs/applications/networking/p2p/transmission/default.nix b/pkgs/applications/networking/p2p/transmission/default.nix
index 9d37f1f43981..ab4fc0908ba8 100644
--- a/pkgs/applications/networking/p2p/transmission/default.nix
+++ b/pkgs/applications/networking/p2p/transmission/default.nix
@@ -57,9 +57,6 @@ in stdenv.mkDerivation {
   ++ lib.optionals enableQt [ qt5.wrapQtAppsHook ]
   ;
 
-  # Doc has high risk of collisions
-  postInstall = "rm -r $out/share/doc";
-
   buildInputs = [
     openssl
     curl
diff --git a/pkgs/applications/radio/flrig/default.nix b/pkgs/applications/radio/flrig/default.nix
index 968b2fd0df9b..d95d894bdef7 100644
--- a/pkgs/applications/radio/flrig/default.nix
+++ b/pkgs/applications/radio/flrig/default.nix
@@ -6,12 +6,12 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "1.3.50";
+  version = "1.3.51";
   pname = "flrig";
 
   src = fetchurl {
     url = "mirror://sourceforge/fldigi/${pname}-${version}.tar.gz";
-    sha256 = "0fzrknzzi8kmzmrcfpc8rxr7v4a4ny6z6z5q5qwh95sp2kn2qzp9";
+    sha256 = "0aq4x0ai9q08ypfhzfj2inc4z3q39zq1l6h9as1kil9yn4zbay61";
   };
 
   buildInputs = [
diff --git a/pkgs/build-support/rust/default.nix b/pkgs/build-support/rust/default.nix
index 9e9f2cb4e3bc..c292b8ea4d43 100644
--- a/pkgs/build-support/rust/default.nix
+++ b/pkgs/build-support/rust/default.nix
@@ -74,6 +74,7 @@ let
   ccForHost="${stdenv.cc}/bin/${stdenv.cc.targetPrefix}cc";
   cxxForHost="${stdenv.cc}/bin/${stdenv.cc.targetPrefix}c++";
   releaseDir = "target/${rustTarget}/${buildType}";
+  tmpDir = "${releaseDir}-tmp";
 
   # Specify the stdenv's `diff` by abspath to ensure that the user's build
   # inputs do not cause us to find the wrong `diff`.
@@ -193,13 +194,15 @@ stdenv.mkDerivation (args // {
     # This needs to be done after postBuild: packages like `cargo` do a pushd/popd in
     # the pre/postBuild-hooks that need to be taken into account before gathering
     # all binaries to install.
-    bins=$(find $releaseDir \
+    mkdir -p $tmpDir
+    cp -r $releaseDir/* $tmpDir/
+    bins=$(find $tmpDir \
       -maxdepth 1 \
       -type f \
       -executable ! \( -regex ".*\.\(so.[0-9.]+\|so\|a\|dylib\)" \))
   '';
 
-  installCheckPhase = args.checkPhase or (let
+  checkPhase = args.checkPhase or (let
     argstr = "${stdenv.lib.optionalString (checkType == "release") "--release"} --target ${rustTarget} --frozen";
   in ''
     ${stdenv.lib.optionalString (buildAndTestSubdir != null) "pushd ${buildAndTestSubdir}"}
@@ -214,13 +217,13 @@ stdenv.mkDerivation (args // {
 
   strictDeps = true;
 
-  inherit releaseDir;
+  inherit releaseDir tmpDir;
 
   installPhase = args.installPhase or ''
     runHook preInstall
 
     # rename the output dir to a architecture independent one
-    mapfile -t targets < <(find "$NIX_BUILD_TOP" -type d | grep '${releaseDir}$')
+    mapfile -t targets < <(find "$NIX_BUILD_TOP" -type d | grep '${tmpDir}$')
     for target in "''${targets[@]}"; do
       rm -rf "$target/../../${buildType}"
       ln -srf "$target" "$target/../../"
@@ -228,7 +231,7 @@ stdenv.mkDerivation (args // {
     mkdir -p $out/bin $out/lib
 
     xargs -r cp -t $out/bin <<< $bins
-    find $releaseDir \
+    find $tmpDir \
       -maxdepth 1 \
       -regex ".*\.\(so.[0-9.]+\|so\|a\|dylib\)" \
       -print0 | xargs -r -0 cp -t $out/lib
diff --git a/pkgs/development/compilers/go/1.14.nix b/pkgs/development/compilers/go/1.14.nix
index 6ddd61253a4e..d9fc67cf46ee 100644
--- a/pkgs/development/compilers/go/1.14.nix
+++ b/pkgs/development/compilers/go/1.14.nix
@@ -31,11 +31,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "go";
-  version = "1.14.4";
+  version = "1.14.6";
 
   src = fetchurl {
     url = "https://dl.google.com/go/go${version}.src.tar.gz";
-    sha256 = "1105qk2l4kfy1ki9n9gh8j4gfqrfgfwapa1fp38hih9aphxsy4bh";
+    sha256 = "02acr52bxfjlr3m11576gdwn8hjv1pr2pffcis913m0m31w9vz3k";
   };
 
   # perl is used for testing go vet
diff --git a/pkgs/development/compilers/rust/1_45.nix b/pkgs/development/compilers/rust/1_45.nix
new file mode 100644
index 000000000000..c72292679e56
--- /dev/null
+++ b/pkgs/development/compilers/rust/1_45.nix
@@ -0,0 +1,42 @@
+# New rust versions should first go to staging.
+# Things to check after updating:
+# 1. Rustc should produce rust binaries on x86_64-linux, aarch64-linux and x86_64-darwin:
+#    i.e. nix-shell -p fd or @GrahamcOfBorg build fd on github
+#    This testing can be also done by other volunteers as part of the pull
+#    request review, in case platforms cannot be covered.
+# 2. The LLVM version used for building should match with rust upstream.
+# 3. Firefox and Thunderbird should still build on x86_64-linux.
+
+{ stdenv, lib
+, buildPackages
+, newScope, callPackage
+, CoreFoundation, Security
+, llvmPackages_5
+, pkgsBuildTarget, pkgsBuildBuild
+} @ args:
+
+import ./default.nix {
+  rustcVersion = "1.45.0";
+  rustcSha256 = "0z6dh0yd3fcm3qh960wi4s6fa6pxz9mh77psycsqfkkx5kqra15s";
+
+  # Note: the version MUST be one version prior to the version we're
+  # building
+  bootstrapVersion = "1.44.1";
+
+  # fetch hashes by running `print-hashes.sh 1.45.0`
+  bootstrapHashes = {
+    i686-unknown-linux-gnu = "e69689b0a1b66599cf83e7dd54f839419007e44376195e93e301a3175da3d854";
+    x86_64-unknown-linux-gnu = "a41df89a461a580536aeb42755e43037556fba2e527dd13a1e1bb0749de28202";
+    arm-unknown-linux-gnueabihf = "ea18ccdfb62a153c2d43d013fdec56993cc9267f1cdc6f3834df8a2b9b468f08";
+    armv7-unknown-linux-gnueabihf = "d44294732cf268ea84908f1135f574ab9489132a332eaa9d5bda547374b15d54";
+    aarch64-unknown-linux-gnu = "a2d74ebeec0b6778026b6c37814cdc91d14db3b0d8b6d69d036216f4d9cf7e49";
+    x86_64-apple-darwin = "a5464e7bcbce9647607904a4afa8362382f1fc55d39e7bbaf4483ac00eb5d56a";
+  };
+
+  selectRustPackage = pkgs: pkgs.rust_1_45;
+
+  rustcPatches = [
+  ];
+}
+
+(builtins.removeAttrs args [ "fetchpatch" ])
diff --git a/pkgs/development/compilers/rust/rustfmt.nix b/pkgs/development/compilers/rust/rustfmt.nix
index 66a18f40ad42..eb8560ada84a 100644
--- a/pkgs/development/compilers/rust/rustfmt.nix
+++ b/pkgs/development/compilers/rust/rustfmt.nix
@@ -16,6 +16,11 @@ rustPlatform.buildRustPackage rec {
   # As of 1.0.0 and rustc 1.30 rustfmt requires a nightly compiler
   RUSTC_BOOTSTRAP = 1;
 
+  # As of rustc 1.45.0, these env vars are required to build rustfmt (due to
+  # https://github.com/rust-lang/rust/pull/72001)
+  CFG_RELEASE = "${rustPlatform.rust.rustc.version}-nightly";
+  CFG_RELEASE_CHANNEL = "nightly";
+
   meta = with stdenv.lib; {
     description = "A tool for formatting Rust code according to style guidelines";
     homepage = "https://github.com/rust-lang-nursery/rustfmt";
diff --git a/pkgs/development/compilers/vala/default.nix b/pkgs/development/compilers/vala/default.nix
index 6afc14688aec..3b4cd1a5a790 100644
--- a/pkgs/development/compilers/vala/default.nix
+++ b/pkgs/development/compilers/vala/default.nix
@@ -123,8 +123,8 @@ in rec {
   };
 
   vala_0_48 = generic {
-    version = "0.48.1";
-    sha256 = "1m3igqlryj1161ymksy7666v7mp9l6gy0yfi4cvgd3wh1963jmzb";
+    version = "0.48.7";
+    sha256 = "0lswkb7gj0chas9n3l3dbrm9l71hs77adhvm2v600id2ipi37pi8";
   };
 
   vala = vala_0_48;
diff --git a/pkgs/development/interpreters/python/default.nix b/pkgs/development/interpreters/python/default.nix
index b05f989714a5..6e9bbb45e4b9 100644
--- a/pkgs/development/interpreters/python/default.nix
+++ b/pkgs/development/interpreters/python/default.nix
@@ -81,10 +81,10 @@ in {
     sourceVersion = {
       major = "3";
       minor = "6";
-      patch = "10";
+      patch = "11";
       suffix = "";
     };
-    sha256 = "1pj0mz1xl27khi250p29c0y99vxg662js8zp71aprkf8i8wkr0qa";
+    sha256 = "dB69y8Tjk3pf8jUX3UVev31UPqn+9vXPb0blddbE/aQ=";
     inherit (darwin) configd;
     inherit passthruFun;
   };
@@ -94,10 +94,10 @@ in {
     sourceVersion = {
       major = "3";
       minor = "7";
-      patch = "7";
+      patch = "8";
       suffix = "";
     };
-    sha256 = "0di1y2cna823qgk6sd2lvpjdm3g2qikdd50i2bjd330dpzqsk806";
+    sha256 = "Q6VDQEs2PwA3+J34R48Z2y28DW8//uMQvCmX+nGFSmM=";
     inherit (darwin) configd;
     inherit passthruFun;
   };
diff --git a/pkgs/development/interpreters/ruby/default.nix b/pkgs/development/interpreters/ruby/default.nix
index 1756c13b53d1..dbfea17437d5 100644
--- a/pkgs/development/interpreters/ruby/default.nix
+++ b/pkgs/development/interpreters/ruby/default.nix
@@ -116,7 +116,7 @@ let
         # https://github.com/ruby/ruby/commit/97a5af62a318fcd93a4e5e4428d576c0280ddbae
         buildFlags = lib.optionals atLeast27 [ "REVISION_LATEST=0" ];
 
-        configureFlags = ["--enable-shared" "--enable-pthread" "--with-soname=ruby_${tag}"]
+        configureFlags = ["--enable-shared" "--enable-pthread" "--with-soname=ruby-${version}"]
           ++ op useRailsExpress "--with-baseruby=${baseruby}/bin/ruby"
           ++ op (!docSupport) "--disable-install-doc"
           ++ ops stdenv.isDarwin [
diff --git a/pkgs/development/libraries/arrow-cpp/default.nix b/pkgs/development/libraries/arrow-cpp/default.nix
index d9bf6752da0b..a989833249cc 100644
--- a/pkgs/development/libraries/arrow-cpp/default.nix
+++ b/pkgs/development/libraries/arrow-cpp/default.nix
@@ -96,7 +96,7 @@ in stdenv.mkDerivation rec {
     "-DARROW_WITH_SNAPPY=ON"
     "-DARROW_WITH_ZLIB=ON"
     "-DARROW_WITH_ZSTD=ON"
-    "-DARROW_ZSTD_USE_SHARED=OFF" # TODO use shared zstd once #91984 hits the master
+    "-DARROW_ZSTD_USE_SHARED=${if enableShared then "ON" else "OFF"}"
     # Parquet options:
     "-DARROW_PARQUET=ON"
     "-DPARQUET_BUILD_EXECUTABLES=ON"
diff --git a/pkgs/development/libraries/dbus/default.nix b/pkgs/development/libraries/dbus/default.nix
index 049623d3d911..3598d8d938e0 100644
--- a/pkgs/development/libraries/dbus/default.nix
+++ b/pkgs/development/libraries/dbus/default.nix
@@ -20,11 +20,11 @@ assert enableSystemd -> systemd != null;
 
 stdenv.mkDerivation rec {
   pname = "dbus";
-  version = "1.12.18";
+  version = "1.12.20";
 
   src = fetchurl {
     url = "https://dbus.freedesktop.org/releases/dbus/dbus-${version}.tar.gz";
-    sha256 = "01jkm6shm76bl3cflmnn37dv6nkph0w1akbqpklyac02hiq4vkv4";
+    sha256 = "1zp5gpx61v1cpqf2zwb1cidhp9xylvw49d3zydkxqk6b1qa20xpp";
   };
 
   patches = lib.optional stdenv.isSunOS ./implement-getgrouplist.patch;
diff --git a/pkgs/development/libraries/fontconfig/config-compat.patch b/pkgs/development/libraries/fontconfig/config-compat.patch
index e86f08fb553c..ddf7bc78180c 100644
--- a/pkgs/development/libraries/fontconfig/config-compat.patch
+++ b/pkgs/development/libraries/fontconfig/config-compat.patch
@@ -1,17 +1,22 @@
-commit 05c6adf8104b4321d3a3716a7b9feb6bf223ed0c (HEAD, nixpkgs)
-Author: Vladimír Čunát <vcunat@gmail.com>
-Date:   Tue Nov 4 12:24:25 2014 +0100
+From 2ff9b53ce755be183ef9274f7dd3f9ac537173f6 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <vcunat@gmail.com>
+Date: Tue, 4 Nov 2014 12:24:25 +0100
+Subject: [PATCH] add check for /etc/fonts/@configVersion@/fonts.conf
 
-    add check for /etc/fonts/@configVersion@/fonts.conf
-    
-    It's checked between FONTCONFIG_FILE and the usual /etc/fonts/fonts.conf.
-    Also, hardcode /etc/fonts/fonts.conf to prevent accidental override.
+It's checked between FONTCONFIG_FILE and the in-package etc/fonts/fonts.conf.
+The latter is used so that on non-NixOS distributions, fontconfig works at least
+with upstream defaults, even when the global config is incompatible.
+
+Co-Authored-By: Jan Tojnar <jtojnar@gmail.com>
+---
+ src/fccfg.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
 
 diff --git a/src/fccfg.c b/src/fccfg.c
-index 6377fd7..e9eb10a 100644
+index 342c996..98a1324 100644
 --- a/src/fccfg.c
 +++ b/src/fccfg.c
-@@ -2070,8 +2070,13 @@ FcConfigFilename (const FcChar8 *url)
+@@ -2391,8 +2391,13 @@ FcConfigGetFilename (FcConfig      *config,
      if (!url || !*url)
      {
  	url = (FcChar8 *) getenv ("FONTCONFIG_FILE");
@@ -22,7 +27,10 @@ index 6377fd7..e9eb10a 100644
 +	}
  	if (!url)
 -	    url = (FcChar8 *) FONTCONFIG_FILE;
-+	    url = (FcChar8 *) "/etc/fonts/fonts.conf";
++	    url = (FcChar8 *) FONTCONFIG_PATH "/" FONTCONFIG_FILE;
      }
      file = 0;
  
+-- 
+2.26.2
+
diff --git a/pkgs/development/libraries/fontconfig/default.nix b/pkgs/development/libraries/fontconfig/default.nix
index 0518cb257ab2..29d9e3289c1b 100644
--- a/pkgs/development/libraries/fontconfig/default.nix
+++ b/pkgs/development/libraries/fontconfig/default.nix
@@ -1,12 +1,22 @@
-{ stdenv, substituteAll, fetchurl
-, pkgconfig, freetype, expat, libxslt, gperf, dejavu_fonts
+{ stdenv
+, fetchpatch
+, substituteAll
+, fetchurl
+, pkg-config
+, freetype
+, expat
+, libxslt
+, gperf
+, dejavu_fonts
+, autoreconfHook
 }:
 
 /** Font configuration scheme
  - ./config-compat.patch makes fontconfig try the following root configs, in order:
-    $FONTCONFIG_FILE, /etc/fonts/${configVersion}/fonts.conf, /etc/fonts/fonts.conf
+    $FONTCONFIG_FILE, /etc/fonts/${configVersion}/fonts.conf, ${fontconfig.out}/etc/fonts/fonts.conf
     This is done not to override config of pre-2.11 versions (which just blow up)
-    and still use *global* font configuration at both NixOS or non-NixOS.
+    and still use *global* font configuration at NixOS,
+    falling back to upstream defaults on non-NixOS.
  - NixOS creates /etc/fonts/${configVersion}/fonts.conf link to $out/etc/fonts/fonts.conf,
     and other modifications should go to /etc/fonts/${configVersion}/conf.d
  - See ./make-fonts-conf.xsl for config details.
@@ -18,11 +28,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "fontconfig";
-  version = "2.12.6";
+  version = "2.13.92";
 
   src = fetchurl {
-    url = "http://fontconfig.org/release/${pname}-${version}.tar.bz2";
-    sha256 = "05zh65zni11kgnhg726gjbrd55swspdvhqbcnj5a5xh8gn03036g";
+    url = "http://fontconfig.org/release/${pname}-${version}.tar.xz";
+    sha256 = "0kkfsvxcvcphm9zcgsh646gix3qn4spz555wa1jp5hbq70l62vjh";
   };
 
   patches = [
@@ -31,15 +41,56 @@ stdenv.mkDerivation rec {
       inherit configVersion;
     })
 
+    # Fix fonts not being loaded when missing included configs that have ignore_missing="yes".
+    # https://bugzilla.redhat.com/show_bug.cgi?id=1744377
+    (fetchpatch {
+      url = "https://gitlab.freedesktop.org/fontconfig/fontconfig/commit/fcada522913e5e07efa6367eff87ace9f06d24c8.patch";
+      sha256 = "1jbm3vw45b3qjnqrh2545v1k8vmb29c09v2wj07jnrq3lnchbvmn";
+    })
+
+    # Register JoyPixels as an emoji font.
     # https://gitlab.freedesktop.org/fontconfig/fontconfig/merge_requests/67
-    ./fix-joypixels.patch
+    (fetchpatch {
+      url = "https://gitlab.freedesktop.org/fontconfig/fontconfig/commit/65087ac7ce4cc5f2109967c1380b474955dcb590.patch";
+      sha256 = "1dkrbqx1c1d8yfnx0igvv516wanw2ksrpm3fbpm2h9nw0hccwqvm";
+    })
+
+    # Fix invalid DTD in reset-dirs.
+    # https://gitlab.freedesktop.org/fontconfig/fontconfig/merge_requests/78
+    (fetchpatch {
+      url = "https://gitlab.freedesktop.org/fontconfig/fontconfig/commit/a4aa66a858f1ecd375c5efe5916398281f73f794.patch";
+      sha256 = "1j4ky8jhpllfm1lh2if34xglh2hl79nsa0xxgzxpj9sx6h4v99j5";
+    })
+
+    # Do not include its tags, they are external now and only cause warnings with old fontconfig clients.
+    # https://gitlab.freedesktop.org/fontconfig/fontconfig/merge_requests/97
+    (fetchpatch {
+      url = "https://gitlab.freedesktop.org/fontconfig/fontconfig/commit/528b17b2837c3b102acd90cc7548d07bacaccb1f.patch";
+      sha256 = "1zf4wcd2xlprh805jalfy8ja5c2qzgkh4fwd1m9d638nl9gx932m";
+    })
+    # https://gitlab.freedesktop.org/fontconfig/fontconfig/merge_requests/100
+    (fetchpatch {
+      url = "https://gitlab.freedesktop.org/fontconfig/fontconfig/commit/37c7c748740bf6f2468d59e67951902710240b34.patch";
+      sha256 = "1rz5zrfwhpn9g49wrzzrmdglj78pbvpnw8ksgsw6bxq8l5d84jfr";
+    })
   ];
 
   outputs = [ "bin" "dev" "lib" "out" ]; # $out contains all the config
 
-  propagatedBuildInputs = [ freetype ];
-  nativeBuildInputs = [ pkgconfig gperf libxslt ];
-  buildInputs = [ expat ];
+  nativeBuildInputs = [
+    gperf
+    libxslt
+    pkg-config
+    autoreconfHook
+  ];
+
+  buildInputs = [
+    expat
+  ];
+
+  propagatedBuildInputs = [
+    freetype
+  ];
 
   configureFlags = [
     "--with-arch=${stdenv.hostPlatform.parsed.cpu.name}"
@@ -61,11 +112,20 @@ stdenv.mkDerivation rec {
   postInstall = ''
     cd "$out/etc/fonts"
     xsltproc --stringparam fontDirectories "${dejavu_fonts.minimal}" \
+      --stringparam fontconfig "$out" \
       --stringparam fontconfigConfigVersion "${configVersion}" \
       --path $out/share/xml/fontconfig \
       ${./make-fonts-conf.xsl} $out/etc/fonts/fonts.conf \
       > fonts.conf.tmp
     mv fonts.conf.tmp $out/etc/fonts/fonts.conf
+
+    # Make it easier to remove user config in NixOS module.
+    mkdir -p $out/etc/fonts/conf.d.bak
+    mv $out/etc/fonts/conf.d/50-user.conf $out/etc/fonts/conf.d.bak
+
+    # update latest 51-local.conf path to look at the latest local.conf
+    substituteInPlace $out/etc/fonts/conf.d/51-local.conf \
+      --replace local.conf /etc/fonts/${configVersion}/local.conf
   '';
 
   passthru = {
diff --git a/pkgs/development/libraries/fontconfig/fix-joypixels.patch b/pkgs/development/libraries/fontconfig/fix-joypixels.patch
deleted file mode 100644
index d5654063fe89..000000000000
--- a/pkgs/development/libraries/fontconfig/fix-joypixels.patch
+++ /dev/null
@@ -1,23 +0,0 @@
---- a/conf.d/45-generic.conf
-+++ b/conf.d/45-generic.conf
-@@ -5,6 +5,10 @@
- 
- <!-- Emoji -->
- 
-+	<alias binding="same">
-+		<family>JoyPixels</family>
-+		<default><family>emoji</family></default>
-+	</alias>
- 	<alias binding="same">
- 		<family>Emoji Two</family>
- 		<default><family>emoji</family></default>
---- a/conf.d/60-generic.conf
-+++ b/conf.d/60-generic.conf
-@@ -29,6 +29,7 @@
- 	<alias binding="same">
- 		<family>emoji</family>
- 		<prefer>
-+			<family>JoyPixels</family>
- 			<family>Emoji Two</family>
- 			<family>Emoji One</family>
- 			<!-- System fonts -->
diff --git a/pkgs/development/libraries/fontconfig/make-fonts-conf.xsl b/pkgs/development/libraries/fontconfig/make-fonts-conf.xsl
index dddbbe9e516b..6ec2e7ab5153 100644
--- a/pkgs/development/libraries/fontconfig/make-fonts-conf.xsl
+++ b/pkgs/development/libraries/fontconfig/make-fonts-conf.xsl
@@ -31,6 +31,9 @@
       <!-- versioned system-wide config -->
       <include ignore_missing="yes">/etc/fonts/<xsl:value-of select="$fontconfigConfigVersion" />/conf.d</include>
 
+      <!-- upstream config -->
+      <include><xsl:value-of select="$fontconfig" />/etc/fonts/conf.d</include>
+
       <dir prefix="xdg">fonts</dir>
       <xsl:for-each select="str:tokenize($fontDirectories)">
         <dir><xsl:value-of select="." /></dir>
@@ -40,6 +43,11 @@
       <!-- nix user profile -->
       <dir>~/.nix-profile/lib/X11/fonts</dir>
       <dir>~/.nix-profile/share/fonts</dir>
+
+      <!-- FHS paths for non-NixOS platforms -->
+      <dir>/usr/share/fonts</dir>
+      <dir>/usr/local/share/fonts</dir>
+
       <!-- nix default profile -->
       <dir>/nix/var/nix/profiles/default/lib/X11/fonts</dir>
       <dir>/nix/var/nix/profiles/default/share/fonts</dir>
diff --git a/pkgs/development/libraries/gd/default.nix b/pkgs/development/libraries/gd/default.nix
index 4a0d918cabea..3b4533890a76 100644
--- a/pkgs/development/libraries/gd/default.nix
+++ b/pkgs/development/libraries/gd/default.nix
@@ -1,5 +1,7 @@
-{ stdenv, fetchurl
-, pkgconfig
+{ stdenv, fetchurl, fetchpatch
+, autoconf
+, automake
+, pkg-config
 , zlib
 , libpng
 , libjpeg ? null
@@ -20,11 +22,24 @@ stdenv.mkDerivation rec {
   };
 
   hardeningDisable = [ "format" ];
+  patches = [
+    # Fixes an issue where some other packages would fail to build
+    # their documentation with an error like:
+    # "Error: Problem doing text layout"
+    #
+    # Can be removed if Wayland can still be built successfully with
+    # documentation.
+    (fetchpatch {
+      url = "https://github.com/libgd/libgd/commit/3dd0e308cbd2c24fde2fc9e9b707181252a2de95.patch";
+      excludes = [ "tests/gdimagestringft/.gitignore" ];
+      sha256 = "12iqlanl9czig9d7c3rvizrigw2iacimnmimfcny392dv9iazhl1";
+    })
+  ];
 
   # -pthread gets passed to clang, causing warnings
   configureFlags = stdenv.lib.optional stdenv.isDarwin "--enable-werror=no";
 
-  nativeBuildInputs = [ pkgconfig ];
+  nativeBuildInputs = [ autoconf automake pkg-config ];
 
   buildInputs = [ zlib fontconfig freetype ];
   propagatedBuildInputs = [ libpng libjpeg libwebp libtiff libXpm ];
diff --git a/pkgs/development/libraries/glib/default.nix b/pkgs/development/libraries/glib/default.nix
index 47e372cf9a36..f7b0667741d3 100644
--- a/pkgs/development/libraries/glib/default.nix
+++ b/pkgs/development/libraries/glib/default.nix
@@ -48,11 +48,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "glib";
-  version = "2.64.3";
+  version = "2.64.4";
 
   src = fetchurl {
     url = "mirror://gnome/sources/glib/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "08pbgiv5m3rica4ydvwvpq5mrxbyswx7l1jzjc2ch52xjabvr77y";
+    sha256 = "0l6fggcgdnjif9kzy4crq7520f43bbrgzxz0c821ya3jn8jv7q7p";
   };
 
   patches = optionals stdenv.isDarwin [
diff --git a/pkgs/development/libraries/gpgme/default.nix b/pkgs/development/libraries/gpgme/default.nix
index 1c4f63142a9b..ed07d8ba0580 100644
--- a/pkgs/development/libraries/gpgme/default.nix
+++ b/pkgs/development/libraries/gpgme/default.nix
@@ -14,22 +14,15 @@ in
 
 stdenv.mkDerivation rec {
   pname = "gpgme";
-  version = "1.13.1";
+  version = "1.14.0";
 
   src = fetchurl {
     url = "mirror://gnupg/gpgme/${pname}-${version}.tar.bz2";
-    sha256 = "0imyjfryvvjdbai454p70zcr95m94j9xnzywrlilqdw2fqi0pqy4";
+    sha256 = "01s3rlspykbm9vmi5rfbdm3d20ip6yni69r48idqzlmhlq8ggwff";
   };
 
   patches = [
-    # Fix tests with gnupg > 2.2.19
-    # https://dev.gnupg.org/T4820
-    (fetchpatch {
-      name = "cff600f1f65a2164ab25ff2b039cba008776ce62.patch";
-      url = "http://git.gnupg.org/cgi-bin/gitweb.cgi?p=gpgme.git;a=patch;h=cff600f1f65a2164ab25ff2b039cba008776ce62";
-      sha256 = "0ds3pvcws37q4hr4g5iwg2b98fj6whvhhcbm9c8f1kgp7dlpdw7n";
-    })
-    (fetchpatch {
+    (fetchpatch { # gpg: Send --with-keygrip when listing keys
       name = "c4cf527ea227edb468a84bf9b8ce996807bd6992.patch";
       url = "http://git.gnupg.org/cgi-bin/gitweb.cgi?p=gpgme.git;a=patch;h=c4cf527ea227edb468a84bf9b8ce996807bd6992";
       sha256 = "0y0b0lb2nq5p9kx13b59b2jaz157mvflliw1qdvg1v1hynvgb8m4";
@@ -79,6 +72,7 @@ stdenv.mkDerivation rec {
 
   meta = with stdenv.lib; {
     homepage = "https://gnupg.org/software/gpgme/index.html";
+    changelog = "https://git.gnupg.org/cgi-bin/gitweb.cgi?p=gpgme.git;a=blob;f=NEWS;hb=refs/tags/gpgme-${version}";
     description = "Library for making GnuPG easier to use";
     longDescription = ''
       GnuPG Made Easy (GPGME) is a library designed to make access to GnuPG
diff --git a/pkgs/development/libraries/gssdp/default.nix b/pkgs/development/libraries/gssdp/default.nix
index 8ad92eb833a4..0a808b71a71c 100644
--- a/pkgs/development/libraries/gssdp/default.nix
+++ b/pkgs/development/libraries/gssdp/default.nix
@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gssdp";
-  version = "1.2.2";
+  version = "1.2.3";
 
   outputs = [ "out" "bin" "dev" "devdoc" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/gssdp/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "195hi10vrsvh6i927mm6rm1ld5sxah3h5sr3bsjm90vb8lxrxfya";
+    sha256 = "1s57i8a8wnnxnsfl27cq4503dkdlzbrhry5zpg23sfqfffvdqqx2";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/gtk/3.x.nix b/pkgs/development/libraries/gtk/3.x.nix
index aec5c4d2dedf..bf78d15d39c6 100644
--- a/pkgs/development/libraries/gtk/3.x.nix
+++ b/pkgs/development/libraries/gtk/3.x.nix
@@ -48,7 +48,7 @@ with stdenv.lib;
 
 stdenv.mkDerivation rec {
   pname = "gtk+3";
-  version = "3.24.20";
+  version = "3.24.21";
 
   outputs = [ "out" "dev" ] ++ optional withGtkDoc "devdoc";
   outputBin = "dev";
@@ -60,7 +60,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://gnome/sources/gtk+/${stdenv.lib.versions.majorMinor version}/gtk+-${version}.tar.xz";
-    sha256 = "1wqxkd3xnqwihcawncp9mkf9bv5a5fg5i4ahm6klpl782vvnkb1d";
+    sha256 = "0llgq2adzn9p3bfq9rv2dhscmvzs35jp3glrfvy3vs1mrpknmsmf";
   };
 
   patches = [
diff --git a/pkgs/development/libraries/json-c/default.nix b/pkgs/development/libraries/json-c/default.nix
index c7a9b3c4a125..164f7c44ba9d 100644
--- a/pkgs/development/libraries/json-c/default.nix
+++ b/pkgs/development/libraries/json-c/default.nix
@@ -1,24 +1,24 @@
-{ stdenv, fetchurl, fetchpatch, autoconf }:
+{ stdenv, fetchurl, fetchpatch, cmake }:
 
 stdenv.mkDerivation rec {
-  name = "json-c-0.13.1";
+  name = "json-c-0.14";
   src = fetchurl {
     url    = "https://s3.amazonaws.com/json-c_releases/releases/${name}-nodoc.tar.gz";
-    sha256 = "0ch1v18wk703bpbyzj7h1mkwvsw4rw4qdwvgykscypvqq10678ll";
+    sha256 = "1yia8417qljmczs9w3rn4c4i2p2iywq098pgrj11s81599j4x4cr";
   };
 
   patches = [
     # https://nvd.nist.gov/vuln/detail/CVE-2020-12762
     (fetchpatch {
       name = "CVE-2020-12762.patch";
-      url = "https://github.com/json-c/json-c/commit/865b5a65199973bb63dff8e47a2f57e04fec9736.patch";
-      sha256 = "1g5afk4khhm1sb70xrva1pyznshcw3ipzp1g5z60dpzxy303pp6h";
+      url = "https://github.com/json-c/json-c/commit/5d6fa331418d49f1bd488553fd1cfa9ab023fabb.patch";
+      sha256 = "0aar7kgbycqxnhh0lrr61adfbb903nbapalhs5i6h8anxwy1ylcm";
     })
   ];
 
   outputs = [ "out" "dev" ];
 
-  nativeBuildInputs = [ autoconf ];  # for autoheader
+  nativeBuildInputs = [ cmake ];
 
   meta = with stdenv.lib; {
     description = "A JSON implementation in C";
diff --git a/pkgs/development/libraries/lcms2/default.nix b/pkgs/development/libraries/lcms2/default.nix
index 2584e26b3c0b..0cf622858900 100644
--- a/pkgs/development/libraries/lcms2/default.nix
+++ b/pkgs/development/libraries/lcms2/default.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl, libtiff, libjpeg, zlib }:
 
 stdenv.mkDerivation rec {
-  name = "lcms2-2.10";
+  name = "lcms2-2.11";
 
   src = fetchurl {
     url = "mirror://sourceforge/lcms/${name}.tar.gz";
-    sha256 = "0ipkw2r8h3yhm4vn5nx04dz5s943x9fw023fhrrnjz2c97yi3m2h";
+    sha256 = "0bkpf315925lhmd9i4mzjnkq5dh255r1lms0c0vzzkfpwk4bjjfw";
   };
 
   outputs = [ "bin" "dev" "out" ];
diff --git a/pkgs/development/libraries/libdrm/cross-build-nm-path.patch b/pkgs/development/libraries/libdrm/cross-build-nm-path.patch
index 478534e65e51..547ef0d09691 100644
--- a/pkgs/development/libraries/libdrm/cross-build-nm-path.patch
+++ b/pkgs/development/libraries/libdrm/cross-build-nm-path.patch
@@ -17,18 +17,17 @@ Signed-off-by: Jörg Thalheim <joerg@thalheim.io>
  2 files changed, 7 insertions(+), 1 deletion(-)
 
 diff --git a/meson.build b/meson.build
-index e292554a..64607139 100644
---- a/meson.build
-+++ b/meson.build
-@@ -327,7 +327,7 @@ pkg.generate(
- )
- 
- env_test = environment()
--env_test.set('NM', find_program('nm').path())
-+env_test.set('NM', find_program(get_option('nm-path')).path())
- 
- if with_libkms
-   subdir('libkms')
+--- meson.build.orig	2020-06-18 11:13:57.716321962 +0200
++++ meson.build	2020-06-18 11:19:50.456861311 +0200
+@@ -45,7 +45,7 @@
+ cc = meson.get_compiler('c')
+
+ symbols_check = find_program('symbols-check.py')
+-prog_nm = find_program('nm')
++prog_nm = find_program(get_option('nm-path'))
+
+ # Check for atomics
+ intel_atomics = false
 diff --git a/meson_options.txt b/meson_options.txt
 index 8af33f1c..b4f46a52 100644
 --- a/meson_options.txt
diff --git a/pkgs/development/libraries/libdrm/default.nix b/pkgs/development/libraries/libdrm/default.nix
index 0d6ff189765f..4296e56c7432 100644
--- a/pkgs/development/libraries/libdrm/default.nix
+++ b/pkgs/development/libraries/libdrm/default.nix
@@ -4,11 +4,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libdrm";
-  version = "2.4.100";
+  version = "2.4.102";
 
   src = fetchurl {
-    url = "https://dri.freedesktop.org/${pname}/${pname}-${version}.tar.bz2";
-    sha256 = "0p8a1l3a3s40i81mawm8nhrbk7p97ss05qkawp1yx73c30lchz67";
+    url = "https://dri.freedesktop.org/${pname}/${pname}-${version}.tar.xz";
+    sha256 = "0nx0bd9dhymdsd99v4ifib77yjirkvkxf5hzdkbr7qr8dhrzkjwb";
   };
 
   outputs = [ "out" "dev" "bin" ];
diff --git a/pkgs/development/libraries/libevdev/default.nix b/pkgs/development/libraries/libevdev/default.nix
index 9b1184f1c0b1..c769006e0bff 100644
--- a/pkgs/development/libraries/libevdev/default.nix
+++ b/pkgs/development/libraries/libevdev/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, python3 }:
+{ stdenv, fetchurl, fetchpatch, python3 }:
 
 stdenv.mkDerivation rec {
   pname = "libevdev";
@@ -9,6 +9,15 @@ stdenv.mkDerivation rec {
     sha256 = "17pb5375njb1r05xmk0r57a2j986ihglh2n5nqcylbag4rj8mqg7";
   };
 
+  patches = [
+    # Fix libevdev-python tests on aarch64
+    # https://gitlab.freedesktop.org/libevdev/libevdev/merge_requests/63
+    (fetchpatch {
+      url = "https://gitlab.freedesktop.org/libevdev/libevdev/commit/66113fe84f62bab3a672a336eb10b255d2aa5ce7.patch";
+      sha256 = "gZKr/P+/OqU69IGslP8CQlcGuyzA/ulcm+nGwHdis58=";
+    })
+  ];
+
   nativeBuildInputs = [ python3 ];
 
   meta = with stdenv.lib; {
diff --git a/pkgs/development/libraries/libevent/default.nix b/pkgs/development/libraries/libevent/default.nix
index eaa2933505c4..880ba746bb9e 100644
--- a/pkgs/development/libraries/libevent/default.nix
+++ b/pkgs/development/libraries/libevent/default.nix
@@ -6,11 +6,11 @@ assert sslSupport -> openssl != null;
 
 stdenv.mkDerivation rec {
   pname = "libevent";
-  version = "2.1.11";
+  version = "2.1.12";
 
   src = fetchurl {
     url = "https://github.com/libevent/libevent/releases/download/release-${version}-stable/libevent-${version}-stable.tar.gz";
-    sha256 = "0g988zqm45sj1hlhhz4il5z4dpi5dl74hzjwzl4md37a09iaqnx6";
+    sha256 = "1fq30imk8zd26x8066di3kpc5zyfc5z6frr3zll685zcx4dxxrlj";
   };
 
   # libevent_openssl is moved into its own output, so that openssl isn't present
diff --git a/pkgs/development/libraries/libgcrypt/default.nix b/pkgs/development/libraries/libgcrypt/default.nix
index 49aaec66c29b..d49fa37325aa 100644
--- a/pkgs/development/libraries/libgcrypt/default.nix
+++ b/pkgs/development/libraries/libgcrypt/default.nix
@@ -6,11 +6,11 @@ assert enableCapabilities -> stdenv.isLinux;
 
 stdenv.mkDerivation rec {
   pname = "libgcrypt";
-  version = "1.8.5";
+  version = "1.8.6";
 
   src = fetchurl {
     url = "mirror://gnupg/libgcrypt/${pname}-${version}.tar.bz2";
-    sha256 = "1hvsazms1bfd769q0ngl0r9g5i4m9mpz9jmvvrdzyzk3rfa2ljiv";
+    sha256 = "0xdrsxgqw5v7szshjdgdv60rgpvzzaqic32ahqrzr6bvc402gfhc";
   };
 
   outputs = [ "out" "dev" "info" ];
diff --git a/pkgs/development/libraries/libinput/default.nix b/pkgs/development/libraries/libinput/default.nix
index f490dfbd23a2..cb8009011b62 100644
--- a/pkgs/development/libraries/libinput/default.nix
+++ b/pkgs/development/libraries/libinput/default.nix
@@ -27,11 +27,11 @@ in
 with stdenv.lib;
 stdenv.mkDerivation rec {
   pname = "libinput";
-  version = "1.15.5";
+  version = "1.15.6";
 
   src = fetchurl {
     url = "https://www.freedesktop.org/software/libinput/${pname}-${version}.tar.xz";
-    sha256 = "15ww4jl3lcxyi8m8idg8canklbqv729gnwpkz7r98c1w8a7zq3m9";
+    sha256 = "073z61dw46cyq0635a5n1mw7hw4qdgr58gbwwb3ds5v3d8hymvdf";
   };
 
   outputs = [ "bin" "out" "dev" ];
@@ -47,10 +47,23 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ pkgconfig meson ninja ]
     ++ optionals documentationSupport [ doxygen graphviz sphinx-build ];
 
-  buildInputs = [ libevdev mtdev libwacom ]
+  buildInputs = [
+    libevdev
+    mtdev
+    libwacom
+    (python3.withPackages (pp: with pp; [
+      pp.libevdev # already in scope
+      pyudev
+      pyyaml
+      setuptools
+    ]))
+  ]
     ++ optionals eventGUISupport [ cairo glib gtk3 ];
 
-  checkInputs = [ (python3.withPackages (pkgs: with pkgs; [ evdev ])) check valgrind ];
+  checkInputs = [
+    check
+    valgrind
+  ];
 
   propagatedBuildInputs = [ udev ];
 
@@ -60,6 +73,7 @@ stdenv.mkDerivation rec {
     patchShebangs tools/helper-copy-and-exec-from-tmp.sh
     patchShebangs test/symbols-leak-test
     patchShebangs test/check-leftover-udev-rules.sh
+    patchShebangs test/helper-copy-and-exec-from-tmp.sh
   '';
 
   doCheck = testsSupport && stdenv.hostPlatform == stdenv.buildPlatform;
diff --git a/pkgs/development/libraries/libmbim/default.nix b/pkgs/development/libraries/libmbim/default.nix
index 8750ee599ce6..0cc911fbd019 100644
--- a/pkgs/development/libraries/libmbim/default.nix
+++ b/pkgs/development/libraries/libmbim/default.nix
@@ -1,23 +1,33 @@
-{ stdenv, fetchurl, pkgconfig, glib, python3, systemd, libgudev }:
+{ stdenv
+, fetchurl
+, pkg-config
+, gobject-introspection
+, glib
+, python3
+, systemd
+, libgudev
+}:
 
 stdenv.mkDerivation rec {
   pname = "libmbim";
-  version = "1.23.900";
+  version = "1.24.0";
 
   src = fetchurl {
     url = "https://www.freedesktop.org/software/libmbim/${pname}-${version}.tar.xz";
-    sha256 = "0ikzjs44q44cj4m786gvm575a7x61rgmav6b60n2y74pgqvj3791";
+    sha256 = "15hi1vq327drgi6h4dsi74lb7wg0sxd7mipa3irh5zgc7gn5qj9x";
   };
 
   outputs = [ "out" "dev" "man" ];
 
   configureFlags = [
     "--with-udev-base-dir=${placeholder "out"}/lib/udev"
+    "--enable-introspection"
   ];
 
   nativeBuildInputs = [
-    pkgconfig
+    pkg-config
     python3
+    gobject-introspection
   ];
 
   buildInputs = [
diff --git a/pkgs/development/libraries/libqmi/default.nix b/pkgs/development/libraries/libqmi/default.nix
index 15a2a1db18fa..e577b403823e 100644
--- a/pkgs/development/libraries/libqmi/default.nix
+++ b/pkgs/development/libraries/libqmi/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libqmi";
-  version = "1.25.900";
+  version = "1.26.0";
 
   src = fetchurl {
     url = "https://www.freedesktop.org/software/libqmi/${pname}-${version}.tar.xz";
-    sha256 = "0a96f4ab7qy4szwzqs8ir2mvsnpqzk7zsiv6zahlhpf0jhp1vxf7";
+    sha256 = "0h3fzmjlla7ib9wn4rv98bm40y2k28jcl29da4hjwyaqmvh2j13z";
   };
 
   outputs = [ "out" "dev" "devdoc" ];
diff --git a/pkgs/development/libraries/librsvg/default.nix b/pkgs/development/libraries/librsvg/default.nix
index 2c68d27323ff..fb61b50346d1 100644
--- a/pkgs/development/libraries/librsvg/default.nix
+++ b/pkgs/development/libraries/librsvg/default.nix
@@ -4,14 +4,14 @@
 
 let
   pname = "librsvg";
-  version = "2.48.7";
+  version = "2.48.8";
 in
 stdenv.mkDerivation rec {
   name = "${pname}-${version}";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${name}.tar.xz";
-    sha256 = "1h7yw9bszsi174lkq8ig15p1rll7fqafx72jligxiz32wa9mvpim";
+    sha256 = "14i6xzghcidv64cyd3g0wdjbl82rph737yxn9s3x29nzpcjs707l";
   };
 
   outputs = [ "out" "dev" "installedTests" ];
diff --git a/pkgs/development/libraries/libu2f-host/default.nix b/pkgs/development/libraries/libu2f-host/default.nix
index f033aa9f610f..a9c62673115a 100644
--- a/pkgs/development/libraries/libu2f-host/default.nix
+++ b/pkgs/development/libraries/libu2f-host/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, pkgconfig, json_c, hidapi }:
+{ stdenv, fetchurl, fetchpatch, pkgconfig, json_c, hidapi }:
 
 stdenv.mkDerivation rec {
   pname = "libu2f-host";
@@ -9,6 +9,15 @@ stdenv.mkDerivation rec {
     sha256 = "0vrivl1dwql6nfi48z6dy56fwy2z13d7abgahgrs2mcmqng7hra2";
   };
 
+  patches = [
+    # remove after updating to next release
+    (fetchpatch {
+      name = "json-c-0.14-support.patch";
+      url = "https://github.com/Yubico/libu2f-host/commit/840f01135d2892f45e71b9e90405de587991bd03.patch";
+      sha256 = "0xplx394ppsbsb4h4l8b9m4dv9shbl0zyck3y26vbm9i1g981ki7";
+    })
+  ];
+
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ json_c hidapi ];
 
diff --git a/pkgs/development/libraries/libu2f-server/default.nix b/pkgs/development/libraries/libu2f-server/default.nix
index be5658914d17..cd961cde1d28 100644
--- a/pkgs/development/libraries/libu2f-server/default.nix
+++ b/pkgs/development/libraries/libu2f-server/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, pkgconfig, json_c, openssl, check, file, help2man, which, gengetopt }:
+{ stdenv, fetchurl, fetchpatch, pkgconfig, json_c, openssl, check, file, help2man, which, gengetopt }:
 
 stdenv.mkDerivation rec {
   name = "libu2f-server-1.1.0";
@@ -7,6 +7,15 @@ stdenv.mkDerivation rec {
     sha256 = "0xx296nmmqa57w0v5p2kasl5zr1ms2gh6qi4lhv6xvzbmjp3rkcd";
   };
 
+  patches = [
+    # remove after updating to next release
+    (fetchpatch {
+      name = "json-c-0.14-support.patch";
+      url = "https://github.com/Yubico/libu2f-server/commit/f7c4983b31909299c47bf9b2627c84b6bfe225de.patch";
+      sha256 = "10q66w3paii1yhfdmjskpip078fk9p3sjllbqx1yx71qbjki55b0";
+    })
+  ];
+
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ json_c openssl check file help2man which gengetopt ];
 
diff --git a/pkgs/development/libraries/libuv/default.nix b/pkgs/development/libraries/libuv/default.nix
index e22bcdd86b4f..3462c423ffde 100644
--- a/pkgs/development/libraries/libuv/default.nix
+++ b/pkgs/development/libraries/libuv/default.nix
@@ -1,14 +1,14 @@
 { stdenv, lib, fetchFromGitHub, autoconf, automake, libtool, pkgconfig, ApplicationServices, CoreServices }:
 
 stdenv.mkDerivation rec {
-  version = "1.38.0";
+  version = "1.38.1";
   pname = "libuv";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    sha256 = "04598jglikma5plfiprnw4pcxwp7b6aqxphxs65pdd5xira6dz0s";
+    sha256 = "0cvabjhi53qw94zyjkqamx0c607ayydfb4f3djx2gj8ab2p7s29n";
   };
 
   postPatch = let
diff --git a/pkgs/development/libraries/libwacom/default.nix b/pkgs/development/libraries/libwacom/default.nix
index c33317550b5f..e762ead19231 100644
--- a/pkgs/development/libraries/libwacom/default.nix
+++ b/pkgs/development/libraries/libwacom/default.nix
@@ -2,7 +2,7 @@
 
 stdenv.mkDerivation rec {
   pname = "libwacom";
-  version = "1.3";
+  version = "1.4.1";
 
   outputs = [ "out" "dev" ];
 
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
     owner = "linuxwacom";
     repo = "libwacom";
     rev = "libwacom-${version}";
-    sha256 = "12g8jb67wj6sgg9ar2w8kkw1m1431rn9nd0j64qkrd3vy9g4l0hk";
+    sha256 = "0m96zjj832l18rzg9l31ambm6rv9vnh2a1sfk8531da8m347z287";
   };
 
   nativeBuildInputs = [ pkgconfig meson ninja doxygen ];
diff --git a/pkgs/development/libraries/mesa/default.nix b/pkgs/development/libraries/mesa/default.nix
index 7ae59c119a0e..0b0db12c09cd 100644
--- a/pkgs/development/libraries/mesa/default.nix
+++ b/pkgs/development/libraries/mesa/default.nix
@@ -31,7 +31,7 @@ with stdenv.lib;
 let
   # Release calendar: https://www.mesa3d.org/release-calendar.html
   # Release frequency: https://www.mesa3d.org/releasing.html#schedule
-  version = "20.0.8"; # Update only to the final (last planned) release (i.e. X.Y.MAX)?
+  version = "20.1.3";
   branch  = versions.major version;
 in
 
@@ -46,7 +46,7 @@ stdenv.mkDerivation {
       "ftp://ftp.freedesktop.org/pub/mesa/${version}/mesa-${version}.tar.xz"
       "ftp://ftp.freedesktop.org/pub/mesa/older-versions/${branch}.x/${version}/mesa-${version}.tar.xz"
     ];
-    sha256 = "6cf0c010df89680f9b2bc6432ff01400031795e39bceda7535fa00af06740b6c";
+    sha256 = "1w9b6sl82a3birmpgzn1xx6biggpvynr4hmyzxvj30pfdgabhwlq";
   };
 
   prePatch = "patchShebangs .";
diff --git a/pkgs/development/libraries/nspr/default.nix b/pkgs/development/libraries/nspr/default.nix
index 31a9f7f20d1a..9ab89aaefbfe 100644
--- a/pkgs/development/libraries/nspr/default.nix
+++ b/pkgs/development/libraries/nspr/default.nix
@@ -2,7 +2,7 @@
 , CoreServices ? null
 , buildPackages }:
 
-let version = "4.25"; in
+let version = "4.26"; in
 
 stdenv.mkDerivation {
   pname = "nspr";
@@ -10,7 +10,7 @@ stdenv.mkDerivation {
 
   src = fetchurl {
     url = "mirror://mozilla/nspr/releases/v${version}/src/nspr-${version}.tar.gz";
-    sha256 = "0mjjk2b7ika3v4y99cnaqz3z1iq1a50r1psn9i3s87gr46z0khqb";
+    sha256 = "0gbp3g9p4nhf0zrlvqi5883sqb9zdw0wk83lccpgskxphlni97gw";
   };
 
   patches = [
diff --git a/pkgs/development/libraries/nss/3.44.nix b/pkgs/development/libraries/nss/3.44.nix
new file mode 100644
index 000000000000..ad58bfccaee6
--- /dev/null
+++ b/pkgs/development/libraries/nss/3.44.nix
@@ -0,0 +1,144 @@
+{ stdenv, fetchurl, nspr, perl, zlib, sqlite, fixDarwinDylibNames, buildPackages }:
+
+let
+  nssPEM = fetchurl {
+    url = "http://dev.gentoo.org/~polynomial-c/mozilla/nss-3.15.4-pem-support-20140109.patch.xz";
+    sha256 = "10ibz6y0hknac15zr6dw4gv9nb5r5z9ym6gq18j3xqx7v7n3vpdw";
+  };
+  version = "3.44.4";
+  underscoreVersion = builtins.replaceStrings ["."] ["_"] version;
+
+in stdenv.mkDerivation rec {
+  pname = "nss";
+  inherit version;
+
+  src = fetchurl {
+    url = "mirror://mozilla/security/nss/releases/NSS_${underscoreVersion}_RTM/src/${pname}-${version}.tar.gz";
+    sha256 = "7ec1a52e20fd9a23e1907eeba8f4f2ecd619dac5d20fa023ec5b4faa1843e847";
+  };
+
+  depsBuildBuild = [ buildPackages.stdenv.cc ];
+
+  nativeBuildInputs = [ perl ];
+
+  buildInputs = [ zlib sqlite ]
+    ++ stdenv.lib.optional stdenv.isDarwin fixDarwinDylibNames;
+
+  propagatedBuildInputs = [ nspr ];
+
+  prePatch = ''
+    xz -d < ${nssPEM} | patch -p1
+  '';
+
+  patches =
+    [
+      # Based on http://patch-tracker.debian.org/patch/series/dl/nss/2:3.15.4-1/85_security_load.patch
+      ./85_security_load-3.44.patch
+      ./ckpem.patch
+    ];
+
+  patchFlags = [ "-p0" ];
+
+  postPatch = stdenv.lib.optionalString stdenv.isDarwin ''
+    substituteInPlace nss/coreconf/Darwin.mk --replace '@executable_path/$(notdir $@)' "$out/lib/\$(notdir \$@)"
+  '';
+
+  outputs = [ "out" "dev" "tools" ];
+
+  preConfigure = "cd nss";
+
+  makeFlags = let
+    # NSS's build systems expects aarch32 to be called arm; if we pass in armv6l/armv7l, it
+    # fails with a linker error
+    cpu = if stdenv.hostPlatform.isAarch32 then "arm" else stdenv.hostPlatform.parsed.cpu.name;
+  in [
+    "NSPR_INCLUDE_DIR=${nspr.dev}/include"
+    "NSPR_LIB_DIR=${nspr.out}/lib"
+    "NSDISTMODE=copy"
+    "BUILD_OPT=1"
+    "SOURCE_PREFIX=\$(out)"
+    "NSS_ENABLE_ECC=1"
+    "USE_SYSTEM_ZLIB=1"
+    "NSS_USE_SYSTEM_SQLITE=1"
+    "NATIVE_CC=${buildPackages.stdenv.cc}/bin/cc"
+  ] ++ stdenv.lib.optionals (!stdenv.isDarwin) [
+    # Pass in CPU even if we're not cross compiling, because otherwise it tries to guess with
+    # uname, which can be wrong if e.g. we're compiling for aarch32 on aarch64
+    "OS_TEST=${cpu}"
+    "CPU_ARCH=${cpu}"
+  ] ++ stdenv.lib.optional (stdenv.hostPlatform != stdenv.buildPlatform) [
+    "CROSS_COMPILE=1"
+    "NSS_DISABLE_GTESTS=1" # don't want to build tests when cross-compiling
+  ] ++ stdenv.lib.optional stdenv.is64bit "USE_64=1"
+    ++ stdenv.lib.optional stdenv.isDarwin "CCC=clang++";
+
+  NIX_CFLAGS_COMPILE = "-Wno-error";
+
+  # TODO(@oxij): investigate this: `make -n check` works but `make
+  # check` fails with "no rule", same for "installcheck".
+  doCheck = false;
+  doInstallCheck = false;
+
+  postInstall = ''
+    rm -rf $out/private
+    mv $out/public $out/include
+    mv $out/*.OBJ/* $out/
+    rmdir $out/*.OBJ
+
+    ln -s lib $out/lib64
+
+    # Upstream issue: https://bugzilla.mozilla.org/show_bug.cgi?id=530672
+    # https://gitweb.gentoo.org/repo/gentoo.git/plain/dev-libs/nss/files/nss-3.32-gentoo-fixups.patch?id=af1acce6c6d2c3adb17689261dfe2c2b6771ab8a
+    NSS_MAJOR_VERSION=`grep "NSS_VMAJOR" lib/nss/nss.h | awk '{print $3}'`
+    NSS_MINOR_VERSION=`grep "NSS_VMINOR" lib/nss/nss.h | awk '{print $3}'`
+    NSS_PATCH_VERSION=`grep "NSS_VPATCH" lib/nss/nss.h | awk '{print $3}'`
+    PREFIX="$out"
+
+    mkdir -p $out/lib/pkgconfig
+    sed -e "s,%prefix%,$PREFIX," \
+        -e "s,%exec_prefix%,$PREFIX," \
+        -e "s,%libdir%,$PREFIX/lib64," \
+        -e "s,%includedir%,$dev/include/nss," \
+        -e "s,%NSS_VERSION%,$NSS_MAJOR_VERSION.$NSS_MINOR_VERSION.$NSS_PATCH_VERSION,g" \
+        -e "s,%NSPR_VERSION%,4.16,g" \
+        pkg/pkg-config/nss.pc.in > $out/lib/pkgconfig/nss.pc
+    chmod 0644 $out/lib/pkgconfig/nss.pc
+
+    sed -e "s,@prefix@,$PREFIX," \
+        -e "s,@MOD_MAJOR_VERSION@,$NSS_MAJOR_VERSION," \
+        -e "s,@MOD_MINOR_VERSION@,$NSS_MINOR_VERSION," \
+        -e "s,@MOD_PATCH_VERSION@,$NSS_PATCH_VERSION," \
+        pkg/pkg-config/nss-config.in > $out/bin/nss-config
+    chmod 0755 $out/bin/nss-config
+  '';
+
+  postFixup = let
+    isCross = stdenv.hostPlatform != stdenv.buildPlatform;
+    nss = if isCross then buildPackages.nss.tools else "$out";
+  in ''
+    for libname in freebl3 nssdbm3 softokn3
+    do '' +
+    (if stdenv.isDarwin
+     then ''
+       libfile="$out/lib/lib$libname.dylib"
+       DYLD_LIBRARY_PATH=$out/lib:${nspr.out}/lib \
+     '' else ''
+       libfile="$out/lib/lib$libname.so"
+       LD_LIBRARY_PATH=$out/lib:${nspr.out}/lib \
+     '') + ''
+        ${nss}/bin/shlibsign -v -i "$libfile"
+    done
+
+    moveToOutput bin "$tools"
+    moveToOutput bin/nss-config "$dev"
+    moveToOutput lib/libcrmf.a "$dev" # needed by firefox, for example
+    rm -f "$out"/lib/*.a
+  '';
+
+  meta = with stdenv.lib; {
+    homepage = "https://developer.mozilla.org/en-US/docs/NSS";
+    description = "A set of libraries for development of security-enabled client and server applications";
+    license = licenses.mpl20;
+    platforms = platforms.all;
+  };
+}
diff --git a/pkgs/development/libraries/nss/85_security_load-3.44.patch b/pkgs/development/libraries/nss/85_security_load-3.44.patch
new file mode 100644
index 000000000000..132d5a96b29f
--- /dev/null
+++ b/pkgs/development/libraries/nss/85_security_load-3.44.patch
@@ -0,0 +1,81 @@
+diff -ru -x '*~' -x '*.orig' -x '*.rej' nss/cmd/shlibsign/shlibsign.c nss/cmd/shlibsign/shlibsign.c
+--- nss/cmd/shlibsign/shlibsign.c	2017-01-04 15:24:24.000000000 +0100
++++ nss/cmd/shlibsign/shlibsign.c	2017-01-24 14:43:31.030420852 +0100
+@@ -875,6 +875,8 @@
+         goto cleanup;
+     }
+     lib = PR_LoadLibrary(libname);
++    if (!lib)
++        lib = PR_LoadLibrary(NIX_NSS_LIBDIR"libsoftokn3.so");
+     assert(lib != NULL);
+     if (!lib) {
+         PR_fprintf(PR_STDERR, "loading softokn3 failed");
+diff -ru -x '*~' -x '*.orig' -x '*.rej' nss/coreconf/config.mk nss/coreconf/config.mk
+--- nss/coreconf/config.mk	2017-01-04 15:24:24.000000000 +0100
++++ nss/coreconf/config.mk	2017-01-24 14:43:47.989432372 +0100
+@@ -202,3 +202,6 @@
+ 
+ # Hide old, deprecated, TLS cipher suite names when building NSS
+ DEFINES += -DSSL_DISABLE_DEPRECATED_CIPHER_SUITE_NAMES
++
++# Nix specific stuff.
++DEFINES += -DNIX_NSS_LIBDIR=\"$(out)/lib/\"
+diff -ru -x '*~' -x '*.orig' -x '*.rej' nss/lib/pk11wrap/pk11load.c nss/lib/pk11wrap/pk11load.c
+--- nss/lib/pk11wrap/pk11load.c	2017-01-04 15:24:24.000000000 +0100
++++ nss/lib/pk11wrap/pk11load.c	2017-01-24 14:45:06.883485652 +0100
+@@ -440,6 +440,13 @@
+          * unload the library if anything goes wrong from here on out...
+          */
+         library = PR_LoadLibrary(mod->dllName);
++        if ((library == NULL) &&
++            !rindex(mod->dllName, PR_GetDirectorySeparator())) {
++            library = PORT_LoadLibraryFromOrigin(my_shlib_name,
++                (PRFuncPtr) &softoken_LoadDSO,
++                mod->dllName);
++        }
++
+         mod->library = (void *)library;
+ 
+         if (library == NULL) {
+diff -ru -x '*~' -x '*.orig' -x '*.rej' nss/lib/util/secload.c nss/lib/util/secload.c
+--- nss/lib/util/secload.c	2017-01-04 15:24:24.000000000 +0100
++++ nss/lib/util/secload.c	2017-01-24 14:43:31.030420852 +0100
+@@ -70,9 +70,14 @@
+ 
+     /* Remove the trailing filename from referencePath and add the new one */
+     c = strrchr(referencePath, PR_GetDirectorySeparator());
++    if (!c) { /* referencePath doesn't contain a / means that dladdr gave us argv[0]
++               * and program was called from $PATH. Hack to get libs from NIX_NSS_LIBDIR */
++        referencePath = NIX_NSS_LIBDIR;
++        c = (char*) &referencePath[sizeof(NIX_NSS_LIBDIR) - 1]; /* last / */
++    }
+     if (c) {
+         size_t referencePathSize = 1 + c - referencePath;
+-        fullName = (char*)PORT_Alloc(strlen(name) + referencePathSize + 1);
++        fullName = (char*) PORT_Alloc(strlen(name) + referencePathSize + 5);
+         if (fullName) {
+             memcpy(fullName, referencePath, referencePathSize);
+             strcpy(fullName + referencePathSize, name);
+@@ -82,6 +87,11 @@
+ #endif
+             libSpec.type = PR_LibSpec_Pathname;
+             libSpec.value.pathname = fullName;
++            if ((referencePathSize >= 4) &&
++                (strncmp(fullName + referencePathSize - 4, "bin", 3) == 0)) {
++                memcpy(fullName + referencePathSize -4, "lib", 3);
++            }
++            strcpy(fullName + referencePathSize, name);
+             dlh = PR_LoadLibraryWithFlags(libSpec, PR_LD_NOW | PR_LD_LOCAL
+ #ifdef PR_LD_ALT_SEARCH_PATH
+                                                        /* allow library's dependencies to be found in the same directory
+@@ -89,6 +99,10 @@
+                                                        | PR_LD_ALT_SEARCH_PATH
+ #endif
+                                           );
++            if (! dlh) {
++                strcpy(fullName + referencePathSize, name);
++                dlh = PR_LoadLibraryWithFlags(libSpec, PR_LD_NOW | PR_LD_LOCAL);
++            }
+             PORT_Free(fullName);
+         }
+     }
diff --git a/pkgs/development/libraries/nss/85_security_load.patch b/pkgs/development/libraries/nss/85_security_load.patch
index 132d5a96b29f..2b2cce465ba7 100644
--- a/pkgs/development/libraries/nss/85_security_load.patch
+++ b/pkgs/development/libraries/nss/85_security_load.patch
@@ -1,7 +1,8 @@
-diff -ru -x '*~' -x '*.orig' -x '*.rej' nss/cmd/shlibsign/shlibsign.c nss/cmd/shlibsign/shlibsign.c
---- nss/cmd/shlibsign/shlibsign.c	2017-01-04 15:24:24.000000000 +0100
-+++ nss/cmd/shlibsign/shlibsign.c	2017-01-24 14:43:31.030420852 +0100
-@@ -875,6 +875,8 @@
+diff --git nss/cmd/shlibsign/shlibsign.c nss/cmd/shlibsign/shlibsign.c
+index ad8f3b84e..74676d039 100644
+--- nss/cmd/shlibsign/shlibsign.c
++++ nss/cmd/shlibsign/shlibsign.c
+@@ -875,6 +875,8 @@ main(int argc, char **argv)
          goto cleanup;
      }
      lib = PR_LoadLibrary(libname);
@@ -10,37 +11,31 @@ diff -ru -x '*~' -x '*.orig' -x '*.rej' nss/cmd/shlibsign/shlibsign.c nss/cmd/sh
      assert(lib != NULL);
      if (!lib) {
          PR_fprintf(PR_STDERR, "loading softokn3 failed");
-diff -ru -x '*~' -x '*.orig' -x '*.rej' nss/coreconf/config.mk nss/coreconf/config.mk
---- nss/coreconf/config.mk	2017-01-04 15:24:24.000000000 +0100
-+++ nss/coreconf/config.mk	2017-01-24 14:43:47.989432372 +0100
-@@ -202,3 +202,6 @@
- 
- # Hide old, deprecated, TLS cipher suite names when building NSS
- DEFINES += -DSSL_DISABLE_DEPRECATED_CIPHER_SUITE_NAMES
-+
-+# Nix specific stuff.
-+DEFINES += -DNIX_NSS_LIBDIR=\"$(out)/lib/\"
-diff -ru -x '*~' -x '*.orig' -x '*.rej' nss/lib/pk11wrap/pk11load.c nss/lib/pk11wrap/pk11load.c
---- nss/lib/pk11wrap/pk11load.c	2017-01-04 15:24:24.000000000 +0100
-+++ nss/lib/pk11wrap/pk11load.c	2017-01-24 14:45:06.883485652 +0100
-@@ -440,6 +440,13 @@
+diff --git nss/lib/pk11wrap/pk11load.c nss/lib/pk11wrap/pk11load.c
+index 9e7a0a546..a0a23a1a4 100644
+--- nss/lib/pk11wrap/pk11load.c
++++ nss/lib/pk11wrap/pk11load.c
+@@ -466,6 +466,15 @@ secmod_LoadPKCS11Module(SECMODModule *mod, SECMODModule **oldModule)
           * unload the library if anything goes wrong from here on out...
           */
          library = PR_LoadLibrary(mod->dllName);
++#ifndef NSS_STATIC_SOFTOKEN
 +        if ((library == NULL) &&
 +            !rindex(mod->dllName, PR_GetDirectorySeparator())) {
 +            library = PORT_LoadLibraryFromOrigin(my_shlib_name,
 +                (PRFuncPtr) &softoken_LoadDSO,
 +                mod->dllName);
 +        }
++#endif
 +
          mod->library = (void *)library;
  
          if (library == NULL) {
-diff -ru -x '*~' -x '*.orig' -x '*.rej' nss/lib/util/secload.c nss/lib/util/secload.c
---- nss/lib/util/secload.c	2017-01-04 15:24:24.000000000 +0100
-+++ nss/lib/util/secload.c	2017-01-24 14:43:31.030420852 +0100
-@@ -70,9 +70,14 @@
+diff --git nss/lib/util/secload.c nss/lib/util/secload.c
+index 12efd2f75..8b74478f6 100644
+--- nss/lib/util/secload.c
++++ nss/lib/util/secload.c
+@@ -70,9 +70,14 @@ loader_LoadLibInReferenceDir(const char* referencePath, const char* name)
  
      /* Remove the trailing filename from referencePath and add the new one */
      c = strrchr(referencePath, PR_GetDirectorySeparator());
@@ -56,7 +51,7 @@ diff -ru -x '*~' -x '*.orig' -x '*.rej' nss/lib/util/secload.c nss/lib/util/secl
          if (fullName) {
              memcpy(fullName, referencePath, referencePathSize);
              strcpy(fullName + referencePathSize, name);
-@@ -82,6 +87,11 @@
+@@ -82,6 +87,11 @@ loader_LoadLibInReferenceDir(const char* referencePath, const char* name)
  #endif
              libSpec.type = PR_LibSpec_Pathname;
              libSpec.value.pathname = fullName;
@@ -68,7 +63,7 @@ diff -ru -x '*~' -x '*.orig' -x '*.rej' nss/lib/util/secload.c nss/lib/util/secl
              dlh = PR_LoadLibraryWithFlags(libSpec, PR_LD_NOW | PR_LD_LOCAL
  #ifdef PR_LD_ALT_SEARCH_PATH
                                                         /* allow library's dependencies to be found in the same directory
-@@ -89,6 +99,10 @@
+@@ -89,6 +99,10 @@ loader_LoadLibInReferenceDir(const char* referencePath, const char* name)
                                                         | PR_LD_ALT_SEARCH_PATH
  #endif
                                            );
diff --git a/pkgs/development/libraries/nss/default.nix b/pkgs/development/libraries/nss/default.nix
index 4ec5518008a1..ab1f05044708 100644
--- a/pkgs/development/libraries/nss/default.nix
+++ b/pkgs/development/libraries/nss/default.nix
@@ -1,11 +1,11 @@
-{ stdenv, fetchurl, nspr, perl, zlib, sqlite, fixDarwinDylibNames, buildPackages }:
+{ stdenv, fetchurl, nspr, perl, zlib, sqlite, darwin, fixDarwinDylibNames, buildPackages, ninja }:
 
 let
   nssPEM = fetchurl {
     url = "http://dev.gentoo.org/~polynomial-c/mozilla/nss-3.15.4-pem-support-20140109.patch.xz";
     sha256 = "10ibz6y0hknac15zr6dw4gv9nb5r5z9ym6gq18j3xqx7v7n3vpdw";
   };
-  version = "3.52.1";
+  version = "3.54";
   underscoreVersion = builtins.replaceStrings ["."] ["_"] version;
 
 in stdenv.mkDerivation rec {
@@ -14,12 +14,13 @@ in stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://mozilla/security/nss/releases/NSS_${underscoreVersion}_RTM/src/${pname}-${version}.tar.gz";
-    sha256 = "0y4jb9095f7bbgw7d7kvzm4c3g4p5i6y68fwhb8wlkpb7b1imj5w";
+    sha256 = "0hvfip056pl07h6w91i6fyji5nczrrsxyr56rls7jd2yryzqpcfs";
   };
 
   depsBuildBuild = [ buildPackages.stdenv.cc ];
 
-  nativeBuildInputs = [ perl ];
+  nativeBuildInputs = [ perl ninja (buildPackages.python3.withPackages (ps: with ps; [ gyp ])) ]
+    ++ stdenv.lib.optional stdenv.isDarwin darwin.cctools;
 
   buildInputs = [ zlib sqlite ]
     ++ stdenv.lib.optional stdenv.isDarwin fixDarwinDylibNames;
@@ -29,10 +30,18 @@ in stdenv.mkDerivation rec {
   prePatch = ''
     # strip the trailing whitespace from the patch line and the renamed CKO_NETSCAPE_ enum to CKO_NSS_
     xz -d < ${nssPEM} | sed \
-       -e '/^-DIRS = builtins $/ s/ $//' \
+       -e 's/-DIRS = builtins $/-DIRS = . builtins/g' \
        -e 's/CKO_NETSCAPE_/CKO_NSS_/g' \
        -e 's/CKT_NETSCAPE_/CKT_NSS_/g' \
        | patch -p1
+
+    patchShebangs nss
+
+    for f in nss/coreconf/config.gypi nss/build.sh nss/coreconf/config.gypi; do
+      substituteInPlace "$f" --replace "/usr/bin/env" "${buildPackages.coreutils}/bin/env"
+    done
+
+    substituteInPlace nss/coreconf/config.gypi --replace "/usr/bin/grep" "${buildPackages.coreutils}/bin/env grep"
   '';
 
   patches =
@@ -40,55 +49,49 @@ in stdenv.mkDerivation rec {
       # Based on http://patch-tracker.debian.org/patch/series/dl/nss/2:3.15.4-1/85_security_load.patch
       ./85_security_load.patch
       ./ckpem.patch
+      ./fix-cross-compilation.patch
     ];
 
   patchFlags = [ "-p0" ];
 
-  postPatch = stdenv.lib.optionalString stdenv.isDarwin ''
-    substituteInPlace nss/coreconf/Darwin.mk --replace '@executable_path/$(notdir $@)' "$out/lib/\$(notdir \$@)"
-  '';
-
   outputs = [ "out" "dev" "tools" ];
 
   preConfigure = "cd nss";
 
-  makeFlags = let
-    # NSS's build systems expects aarch32 to be called arm; if we pass in armv6l/armv7l, it
-    # fails with a linker error
-    cpu = if stdenv.hostPlatform.isAarch32 then "arm" else stdenv.hostPlatform.parsed.cpu.name;
-  in [
-    "NSPR_INCLUDE_DIR=${nspr.dev}/include"
-    "NSPR_LIB_DIR=${nspr.out}/lib"
-    "NSDISTMODE=copy"
-    "BUILD_OPT=1"
-    "SOURCE_PREFIX=\$(out)"
-    "NSS_ENABLE_ECC=1"
-    "USE_SYSTEM_ZLIB=1"
-    "NSS_USE_SYSTEM_SQLITE=1"
-    "NATIVE_CC=${buildPackages.stdenv.cc}/bin/cc"
-  ] ++ stdenv.lib.optionals (!stdenv.isDarwin) [
-    # Pass in CPU even if we're not cross compiling, because otherwise it tries to guess with
-    # uname, which can be wrong if e.g. we're compiling for aarch32 on aarch64
-    "OS_TEST=${cpu}"
-    "CPU_ARCH=${cpu}"
-  ] ++ stdenv.lib.optional (stdenv.hostPlatform != stdenv.buildPlatform) [
-    "CROSS_COMPILE=1"
-    "NSS_DISABLE_GTESTS=1" # don't want to build tests when cross-compiling
-  ] ++ stdenv.lib.optional stdenv.is64bit "USE_64=1"
-    ++ stdenv.lib.optional stdenv.isDarwin "CCC=clang++";
+  buildPhase = let
+    getArch = platform: if platform.isx86_64 then "x64"
+          else if platform.isx86_32 then "ia32"
+          else if platform.isAarch32 then "arm"
+          else if platform.isAarch64 then "arm64"
+          else platform.parsed.cpu.name;
+    # yes, this is correct. nixpkgs uses "host" for the platform the binary will run on whereas nss uses "host" for the platform that the build is running on
+    target = getArch stdenv.hostPlatform;
+    host = getArch stdenv.buildPlatform;
+  in ''
+    runHook preBuild
 
-  NIX_CFLAGS_COMPILE = "-Wno-error";
+    sed -i 's|nss_dist_dir="$dist_dir"|nss_dist_dir="'$out'"|;s|nss_dist_obj_dir="$obj_dir"|nss_dist_obj_dir="'$out'"|' build.sh
+    ./build.sh -v --opt \
+      --with-nspr=${nspr.dev}/include:${nspr.out}/lib \
+      --system-sqlite \
+      --enable-legacy-db \
+      --target ${target} \
+      -Dhost_arch=${host} \
+      -Duse_system_zlib=1 \
+      ${stdenv.lib.optionalString stdenv.isDarwin "--clang"} \
+      ${stdenv.lib.optionalString (stdenv.hostPlatform != stdenv.buildPlatform) "--disable-tests"}
 
-  # TODO(@oxij): investigate this: `make -n check` works but `make
-  # check` fails with "no rule", same for "installcheck".
-  doCheck = false;
-  doInstallCheck = false;
+    runHook postBuild
+  '';
+
+  NIX_CFLAGS_COMPILE = "-Wno-error -DNIX_NSS_LIBDIR=\"${placeholder "out"}/lib/\"";
+
+  installPhase = ''
+    runHook preInstall
 
-  postInstall = ''
     rm -rf $out/private
+    find $out -name "*.TOC" -delete
     mv $out/public $out/include
-    mv $out/*.OBJ/* $out/
-    rmdir $out/*.OBJ
 
     ln -s lib $out/lib64
 
@@ -138,6 +141,8 @@ in stdenv.mkDerivation rec {
     moveToOutput bin/nss-config "$dev"
     moveToOutput lib/libcrmf.a "$dev" # needed by firefox, for example
     rm -f "$out"/lib/*.a
+
+    runHook postInstall
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/development/libraries/nss/fix-cross-compilation.patch b/pkgs/development/libraries/nss/fix-cross-compilation.patch
new file mode 100644
index 000000000000..42b0620f48d9
--- /dev/null
+++ b/pkgs/development/libraries/nss/fix-cross-compilation.patch
@@ -0,0 +1,11 @@
+--- nss/nss.gyp
++++ nss/nss.gyp
+@@ -280,7 +280,7 @@
+                   'outputs/': [['exclude', 'nssdbm3']]
+                 }],
+               ],
+-              'action': ['<(python)', '<(DEPTH)/coreconf/shlibsign.py', '<@(_inputs)']
++              'action': ['true']
+             }
+           ],
+         },
diff --git a/pkgs/development/libraries/poppler/default.nix b/pkgs/development/libraries/poppler/default.nix
index 71ff58eaebeb..cd39e61a0cb7 100644
--- a/pkgs/development/libraries/poppler/default.nix
+++ b/pkgs/development/libraries/poppler/default.nix
@@ -12,11 +12,11 @@ let
 in
 stdenv.mkDerivation rec {
   name = "poppler-${suffix}-${version}";
-  version = "0.89.0"; # beware: updates often break cups-filters build, check texlive and scribusUnstable too!
+  version = "0.90.1"; # beware: updates often break cups-filters build, check texlive and scribusUnstable too!
 
   src = fetchurl {
     url = "${meta.homepage}/poppler-${version}.tar.xz";
-    sha256 = "0p4vxyl5cw8jgcy6hjb35236bhv9xy9xc21vsk2jqy1p8lv318pv";
+    sha256 = "mE2C5y6RQY0oCIUpjIvchVov2SZl/VKhNFsnI14MccQ=";
   };
 
   outputs = [ "out" "dev" ];
diff --git a/pkgs/development/libraries/serf/default.nix b/pkgs/development/libraries/serf/default.nix
index 2742ba1577b3..92dde2111fc8 100644
--- a/pkgs/development/libraries/serf/default.nix
+++ b/pkgs/development/libraries/serf/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, apr, scons, openssl, aprutil, zlib, kerberos
+{ stdenv, fetchurl, apr, sconsPackages, openssl, aprutil, zlib, kerberos
 , pkgconfig, libiconv }:
 
 stdenv.mkDerivation rec {
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
     sha256 = "1k47gbgpp52049andr28y28nbwh9m36bbb0g8p0aka3pqlhjv72l";
   };
 
-  nativeBuildInputs = [ pkgconfig scons.py2 ];
+  nativeBuildInputs = [ pkgconfig sconsPackages.scons_3_1_2 ];
   buildInputs = [ apr openssl aprutil zlib libiconv ]
     ++ stdenv.lib.optional (!stdenv.isCygwin) kerberos;
 
diff --git a/pkgs/development/libraries/swiften/default.nix b/pkgs/development/libraries/swiften/default.nix
index 19bacdd2a614..2fe20cc9e882 100644
--- a/pkgs/development/libraries/swiften/default.nix
+++ b/pkgs/development/libraries/swiften/default.nix
@@ -1,9 +1,9 @@
-{ stdenv, python, fetchurl, openssl, boost, scons }:
+{ stdenv, python, fetchurl, openssl, boost, sconsPackages }:
 stdenv.mkDerivation rec {
   pname = "swiften";
   version = "4.0.2";
 
-  nativeBuildInputs = [ scons.py2 ];
+  nativeBuildInputs = [ sconsPackages.scons_3_1_2 ];
   buildInputs           = [ python ];
   propagatedBuildInputs = [ openssl boost ];
 
diff --git a/pkgs/development/libraries/wayland/default.nix b/pkgs/development/libraries/wayland/default.nix
index 402177b899c3..1821d7a72374 100644
--- a/pkgs/development/libraries/wayland/default.nix
+++ b/pkgs/development/libraries/wayland/default.nix
@@ -1,7 +1,8 @@
 { lib, stdenv, fetchurl, meson, pkgconfig, ninja
 , libffi, libxml2, wayland
 , expat ? null # Build wayland-scanner (currently cannot be disabled as of 1.7.0)
-, withDocumentation ? false, graphviz-nox, doxygen, libxslt, xmlto, python3
+, withDocumentation ? stdenv.hostPlatform == stdenv.buildPlatform
+, graphviz-nox, doxygen, libxslt, xmlto, python3
 , docbook_xsl, docbook_xml_dtd_45, docbook_xml_dtd_42
 }:
 
@@ -19,6 +20,7 @@ in stdenv.mkDerivation rec {
     sha256 = "0k995rn96xkplrapz5k648j651wc43kq817xk1x8280h16gsfxa6";
   };
 
+  outputs = [ "out" ] ++ lib.optionals withDocumentation [ "doc" "man" ];
   separateDebugInfo = true;
 
   mesonFlags = [ "-Ddocumentation=${lib.boolToString withDocumentation}" ];
diff --git a/pkgs/development/python-modules/awkward1/default.nix b/pkgs/development/python-modules/awkward1/default.nix
index e3549e0a4a85..3b53dd0eeb7b 100644
--- a/pkgs/development/python-modules/awkward1/default.nix
+++ b/pkgs/development/python-modules/awkward1/default.nix
@@ -10,11 +10,11 @@
 
 buildPythonPackage rec {
   pname = "awkward1";
-  version = "0.2.23";
+  version = "0.2.24";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "d7458b499959af66e0a640e29e6b676a39cc9614cd504e5a2e8f8d0c7f546597";
+    sha256 = "d2f4c9e3153ba18e3ef867c4804e3f17aefd0cc32b5174b38718d06ada4503e9";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/python-modules/blivet/default.nix b/pkgs/development/python-modules/blivet/default.nix
index f3efba1f378f..b8d1b4670aea 100644
--- a/pkgs/development/python-modules/blivet/default.nix
+++ b/pkgs/development/python-modules/blivet/default.nix
@@ -1,11 +1,8 @@
 { stdenv, fetchFromGitHub, buildPythonPackage, pykickstart, pyparted, pyblock
-, pyudev, six, libselinux, cryptsetup, multipath-tools, lsof, utillinux
+, pyudev, six, libselinux, multipath-tools, lsof, utillinux
 }:
 
-let
-  pyenable = { enablePython = true; };
-  cryptsetupWithPython = cryptsetup.override pyenable;
-in buildPythonPackage rec {
+buildPythonPackage rec {
   pname = "blivet";
   version = "0.67";
 
@@ -30,7 +27,7 @@ in buildPythonPackage rec {
   '';
 
   propagatedBuildInputs = [
-    pykickstart pyparted pyblock pyudev libselinux cryptsetupWithPython
+    pykickstart pyparted pyblock pyudev libselinux
     six
   ];
 
diff --git a/pkgs/development/python-modules/gyp/default.nix b/pkgs/development/python-modules/gyp/default.nix
index b9ad6ccec24a..8bb20fafe76e 100644
--- a/pkgs/development/python-modules/gyp/default.nix
+++ b/pkgs/development/python-modules/gyp/default.nix
@@ -6,13 +6,12 @@
 
 buildPythonPackage {
   pname = "gyp";
-  version = "2015-06-11";
-  disabled = isPy3k;
+  version = "2020-05-12";
 
   src = fetchFromGitiles {
     url = "https://chromium.googlesource.com/external/gyp";
-    rev = "fdc7b812f99e48c00e9a487bd56751bbeae07043";
-    sha256 = "1imgxsl4mr1662vsj2mlnpvvrbz71yk00w8p85vi5bkgmc6awgiz";
+    rev = "caa60026e223fc501e8b337fd5086ece4028b1c6";
+    sha256 = "0r9phq5yrmj968vdvy9vivli35wn1j9a6iwshp69wl7q4p0x8q2b";
   };
 
   prePatch = stdenv.lib.optionals stdenv.isDarwin ''
diff --git a/pkgs/development/python-modules/libevdev/default.nix b/pkgs/development/python-modules/libevdev/default.nix
index 220d60663a3a..a17612c79cbc 100644
--- a/pkgs/development/python-modules/libevdev/default.nix
+++ b/pkgs/development/python-modules/libevdev/default.nix
@@ -1,4 +1,11 @@
-{ stdenv, buildPythonPackage, isPy27, fetchPypi }:
+{ stdenv
+, buildPythonPackage
+, isPy27
+, fetchPypi
+, substituteAll
+, pkgs
+, pytestCheckHook
+}:
 
 buildPythonPackage rec {
   pname = "libevdev";
@@ -10,7 +17,14 @@ buildPythonPackage rec {
     sha256 = "17agnigmzscmdjqmrylg1lza03hwjhgxbpf4l705s6i7p7ndaqrs";
   };
 
-  doCheck = false;
+  patches = [
+    (substituteAll {
+      src = ./fix-paths.patch;
+      libevdev = stdenv.lib.getLib pkgs.libevdev;
+    })
+  ];
+
+  checkInputs = [ pytestCheckHook ];
 
   meta = with stdenv.lib; {
     description = "Python wrapper around the libevdev C library";
diff --git a/pkgs/development/python-modules/libevdev/fix-paths.patch b/pkgs/development/python-modules/libevdev/fix-paths.patch
new file mode 100644
index 000000000000..e73c360b1460
--- /dev/null
+++ b/pkgs/development/python-modules/libevdev/fix-paths.patch
@@ -0,0 +1,22 @@
+diff --git a/libevdev/_clib.py b/libevdev/_clib.py
+index 6e4ab2c..9db54d1 100644
+--- a/libevdev/_clib.py
++++ b/libevdev/_clib.py
+@@ -120,7 +120,7 @@ class Libevdev(_LibraryWrapper):
+ 
+     @staticmethod
+     def _cdll():
+-        return ctypes.CDLL("libevdev.so.2", use_errno=True)
++        return ctypes.CDLL("@libevdev@/lib/libevdev.so.2", use_errno=True)
+ 
+     _api_prototypes = {
+         # const char *libevdev_event_type_get_name(unsigned int type);
+@@ -910,7 +910,7 @@ class UinputDevice(_LibraryWrapper):
+ 
+     @staticmethod
+     def _cdll():
+-        return ctypes.CDLL("libevdev.so.2", use_errno=True)
++        return ctypes.CDLL("@libevdev@/lib/libevdev.so.2", use_errno=True)
+ 
+     _api_prototypes = {
+         # int libevdev_uinput_create_from_device(const struct libevdev *, int, struct libevdev_uinput **)
diff --git a/pkgs/development/python-modules/pyudev/default.nix b/pkgs/development/python-modules/pyudev/default.nix
index c26f9bcabe6e..c0a401a1b2a2 100644
--- a/pkgs/development/python-modules/pyudev/default.nix
+++ b/pkgs/development/python-modules/pyudev/default.nix
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     '';
 
   checkInputs = [ pytest mock hypothesis docutils ];
-  propagatedBuildInputs = [ systemd six ];
+  propagatedBuildInputs = [ six ];
 
   checkPhase = ''
     py.test
diff --git a/pkgs/development/tools/build-managers/cmake/setup-hook.sh b/pkgs/development/tools/build-managers/cmake/setup-hook.sh
index 87bbefa6bbfa..73f24a9a2054 100755
--- a/pkgs/development/tools/build-managers/cmake/setup-hook.sh
+++ b/pkgs/development/tools/build-managers/cmake/setup-hook.sh
@@ -68,6 +68,24 @@ cmakeConfigurePhase() {
     # nix/store directory.
     cmakeFlags="-DCMAKE_INSTALL_NAME_DIR=${!outputLib}/lib $cmakeFlags"
 
+    # The docdir flag needs to include PROJECT_NAME as per GNU guidelines,
+    # try to extract it from CMakeLists.txt.
+    if [[ -z "$shareDocName" ]]; then
+        local cmakeLists="${cmakeDir}/CMakeLists.txt"
+        if [[ -f "$cmakeLists" ]]; then
+            local shareDocName="$(grep --only-matching --perl-regexp --ignore-case '\bproject\s*\(\s*"?\K([^[:space:]")]+)' < "$cmakeLists" | head -n1)"
+        fi
+        # The argument sometimes contains garbage or variable interpolation.
+        # When that is the case, let’s fall back to the derivation name.
+        if [[ -z "$shareDocName" ]] || echo "$shareDocName" | grep -q '[^a-zA-Z0-9_-+]'; then
+            if [[ -n "${pname-}" ]]; then
+                shareDocName="$pname"
+            else
+                shareDocName="$(echo "$name" | sed 's/-[^a-zA-Z].*//')"
+            fi
+        fi
+    fi
+
     # This ensures correct paths with multiple output derivations
     # It requires the project to use variables from GNUInstallDirs module
     # https://cmake.org/cmake/help/latest/module/GNUInstallDirs.html
diff --git a/pkgs/development/tools/build-managers/scons/common.nix b/pkgs/development/tools/build-managers/scons/common.nix
index 41ac16bed7a1..7a15c193423c 100644
--- a/pkgs/development/tools/build-managers/scons/common.nix
+++ b/pkgs/development/tools/build-managers/scons/common.nix
@@ -1,6 +1,6 @@
 { version, sha256 }:
 
-{ stdenv, fetchurl, python3Packages, python2Packages, scons }:
+{ stdenv, fetchurl, python3Packages, lib }:
 
 python3Packages.buildPythonApplication rec {
   pname = "scons";
@@ -13,7 +13,13 @@ python3Packages.buildPythonApplication rec {
 
   setupHook = ./setup-hook.sh;
 
-  passthru.py2 = scons.override { python3Packages = python2Packages; };
+  postPatch = lib.optionalString (lib.versionAtLeast version "4.0.0") ''
+    substituteInPlace setup.cfg \
+      --replace "build/dist" "dist"
+  '';
+
+  # The release tarballs don't contain any tests (runtest.py and test/*):
+  doCheck = lib.versionOlder version "4.0.0";
 
   meta = with stdenv.lib; {
     description = "An improved, cross-platform substitute for Make";
diff --git a/pkgs/development/tools/build-managers/scons/default.nix b/pkgs/development/tools/build-managers/scons/default.nix
index 19b092b86bab..eb86d5955971 100644
--- a/pkgs/development/tools/build-managers/scons/default.nix
+++ b/pkgs/development/tools/build-managers/scons/default.nix
@@ -7,8 +7,12 @@ in {
     version = "3.0.1";
     sha256 = "0wzid419mlwqw9llrg8gsx4nkzhqy16m4m40r0xnh6cwscw5wir4";
   }).override { python3Packages = python2Packages; };
-  scons_latest = mkScons {
+  scons_3_1_2 = (mkScons {
     version = "3.1.2";
     sha256 = "1yzq2gg9zwz9rvfn42v5jzl3g4qf1khhny6zfbi2hib55zvg60bq";
+  }).override { python3Packages = python2Packages; };
+  scons_latest = mkScons {
+    version = "4.0.1";
+    sha256 = "0z00l9wzaiqyjq0hapbvsjclvcfjjjq04kmxi7ffq966nl2d2bkj";
   };
 }
diff --git a/pkgs/development/tools/continuous-integration/fly/default.nix b/pkgs/development/tools/continuous-integration/fly/default.nix
index bdad33dee742..8497cea01b67 100644
--- a/pkgs/development/tools/continuous-integration/fly/default.nix
+++ b/pkgs/development/tools/continuous-integration/fly/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "fly";
-  version = "6.3.0";
+  version = "6.4.0";
 
   src = fetchFromGitHub {
     owner = "concourse";
     repo = "concourse";
     rev = "v${version}";
-    sha256 = "006qkg661hzbc2gpcnpxm09bp1kbb98y0bgdr49bjlnapcmdgr1b";
+    sha256 = "08lw345kzkic5b2dqj3d0d9x1mas9rpi4rdmbhww9r60swj169i7";
   };
 
-  vendorSha256 = "03az7l9rf2syw837zliny82xhkqlad16z0vfcg5h21m3bhz6v6jy";
+  vendorSha256 = "0a78cjfj909ic8wci8id2h5f6r34h90myk6z7m918n08vxv60jvw";
 
   subPackages = [ "fly" ];
 
diff --git a/pkgs/development/tools/misc/automake/automake-1.15.x.nix b/pkgs/development/tools/misc/automake/automake-1.15.x.nix
index 858cb9a4f223..bf0967e9ddb4 100644
--- a/pkgs/development/tools/misc/automake/automake-1.15.x.nix
+++ b/pkgs/development/tools/misc/automake/automake-1.15.x.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl, perl, autoconf }:
 
 stdenv.mkDerivation rec {
-  name = "automake-1.15";
+  name = "automake-1.15.1";
 
   src = fetchurl {
     url = "mirror://gnu/automake/${name}.tar.xz";
-    sha256 = "0dl6vfi2lzz8alnklwxzfz624b95hb1ipjvd3mk177flmddcf24r";
+    sha256 = "1bzd9g32dfm4rsbw93ld9x7b5nc1y6i4m6zp032qf1i28a8s6sxg";
   };
 
   nativeBuildInputs = [ autoconf perl ];
diff --git a/pkgs/development/tools/misc/help2man/default.nix b/pkgs/development/tools/misc/help2man/default.nix
index e23ccf27323c..74ba7f55093d 100644
--- a/pkgs/development/tools/misc/help2man/default.nix
+++ b/pkgs/development/tools/misc/help2man/default.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl, perlPackages, gettext }:
 
 stdenv.mkDerivation rec {
-  name = "help2man-1.47.15";
+  name = "help2man-1.47.16";
 
   src = fetchurl {
     url = "mirror://gnu/help2man/${name}.tar.xz";
-    sha256 = "076dvc0z0qp73rpmg0c8bkpfh969h4gzzc442hv1bcyf1srkann2";
+    sha256 = "1x586h7wvripcay35kdh2kvydx84y8yy93ffjah2rqw6bc65iy1y";
   };
 
   nativeBuildInputs = [ gettext perlPackages.LocaleGettext ];
diff --git a/pkgs/development/tools/nsis/default.nix b/pkgs/development/tools/nsis/default.nix
index 5b9e7434a8de..bb29bcfdc0fa 100644
--- a/pkgs/development/tools/nsis/default.nix
+++ b/pkgs/development/tools/nsis/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, fetchzip, scons, zlib }:
+{ stdenv, fetchurl, fetchzip, sconsPackages, zlib }:
 
 stdenv.mkDerivation rec {
   pname = "nsis";
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
     chmod -R u+w $out/share/nsis
   '';
 
-  nativeBuildInputs = [ scons.py2 ];
+  nativeBuildInputs = [ sconsPackages.scons_3_1_2 ];
   buildInputs = [ zlib ];
 
   sconsFlags = [
diff --git a/pkgs/development/tools/parsing/bison/default.nix b/pkgs/development/tools/parsing/bison/default.nix
index 0b6476998bf1..ba2caac96c90 100644
--- a/pkgs/development/tools/parsing/bison/default.nix
+++ b/pkgs/development/tools/parsing/bison/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "bison";
-  version = "3.6.3";
+  version = "3.6.4";
 
   src = fetchurl {
     url = "mirror://gnu/${pname}/${pname}-${version}.tar.gz";
-    sha256 = "0qry9ar16dpg9nzrq7jh3fqh4ah2xvcf6v00fc81z08yjd1ljk2b";
+    sha256 = "1s8kmfhg7a58vm65fc977ckp8zspy8diayrcjhs3cgrqnmjdx0w1";
   };
 
   nativeBuildInputs = [ m4 perl ] ++ stdenv.lib.optional stdenv.isSunOS help2man;
diff --git a/pkgs/development/tools/rust/rustup/default.nix b/pkgs/development/tools/rust/rustup/default.nix
index fd772ff40b29..bdd916ccdda7 100644
--- a/pkgs/development/tools/rust/rustup/default.nix
+++ b/pkgs/development/tools/rust/rustup/default.nix
@@ -39,9 +39,7 @@ rustPlatform.buildRustPackage rec {
     )
   ];
 
-  # Disable tests until they can be run with --features no-self-update
-  doCheck = false;
-  #doCheck = !stdenv.isAarch64 && !stdenv.isDarwin;
+  doCheck = !stdenv.isAarch64 && !stdenv.isDarwin;
 
   postInstall = ''
     pushd $out/bin
diff --git a/pkgs/games/tdm/default.nix b/pkgs/games/tdm/default.nix
index e935dab2b8f3..d0133df59ddf 100644
--- a/pkgs/games/tdm/default.nix
+++ b/pkgs/games/tdm/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, binutils-unwrapped, scons, gnum4, p7zip, glibc_multi, mesa
+{ stdenv, fetchurl, binutils-unwrapped, sconsPackages, gnum4, p7zip, glibc_multi, mesa
 , xorg, libGLU, libGL, openal
 , lib, makeWrapper, makeDesktopItem }:
 
@@ -24,7 +24,7 @@ in stdenv.mkDerivation {
     sha256 = "17wdpip8zvm2njz0xrf7xcxl73hnsc6i83zj18kn8rnjkpy50dd6";
   };
   nativeBuildInputs = [
-    p7zip scons.py2 gnum4 makeWrapper
+    p7zip sconsPackages.scons_3_1_2 gnum4 makeWrapper
   ];
   buildInputs = [
     glibc_multi mesa.dev xorg.libX11.dev openal
diff --git a/pkgs/games/vdrift/default.nix b/pkgs/games/vdrift/default.nix
index 99475af49e1f..ea8b3941f8b4 100644
--- a/pkgs/games/vdrift/default.nix
+++ b/pkgs/games/vdrift/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, fetchsvn, pkgconfig, scons, libGLU, libGL, SDL2, SDL2_image
+{ stdenv, fetchFromGitHub, fetchsvn, pkgconfig, sconsPackages, libGLU, libGL, SDL2, SDL2_image
 , libvorbis, bullet, curl, gettext, writeTextFile
 
 , data ? fetchsvn {
@@ -20,7 +20,7 @@ let
       sha256 = "001wq3c4n9wzxqfpq40b1jcl16sxbqv2zbkpy9rq2wf9h417q6hg";
     };
 
-    nativeBuildInputs = [ pkgconfig scons.py2 ];
+    nativeBuildInputs = [ pkgconfig sconsPackages.scons_3_1_2 ];
     buildInputs = [ libGLU libGL SDL2 SDL2_image libvorbis bullet curl gettext ];
 
     patches = [ ./0001-Ignore-missing-data-for-installation.patch ];
diff --git a/pkgs/misc/drivers/xboxdrv/default.nix b/pkgs/misc/drivers/xboxdrv/default.nix
index eb0511b0c4ec..f7fd59fd9fd1 100644
--- a/pkgs/misc/drivers/xboxdrv/default.nix
+++ b/pkgs/misc/drivers/xboxdrv/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, scons, libX11, pkgconfig
+{ stdenv, fetchurl, sconsPackages, libX11, pkgconfig
 , libusb1, boost, glib, dbus-glib }:
 
 let
@@ -13,7 +13,7 @@ in stdenv.mkDerivation {
   };
 
   makeFlags = [ "PREFIX=$(out)" ];
-  nativeBuildInputs = [ pkgconfig scons.py2 ];
+  nativeBuildInputs = [ pkgconfig sconsPackages.scons_3_1_2 ];
   buildInputs = [ libX11 libusb1 boost glib dbus-glib ];
   dontUseSconsInstall = true;
 
diff --git a/pkgs/os-specific/linux/apparmor/default.nix b/pkgs/os-specific/linux/apparmor/default.nix
index 66c2582603c1..807ab4fa44be 100644
--- a/pkgs/os-specific/linux/apparmor/default.nix
+++ b/pkgs/os-specific/linux/apparmor/default.nix
@@ -39,6 +39,9 @@ let
   };
 
   prePatchCommon = ''
+    patch -p1 < ${gnumake43Patch}
+    chmod a+x ./common/list_capabilities.sh ./common/list_af_names.sh
+    patchShebangs ./common/list_capabilities.sh ./common/list_af_names.sh
     substituteInPlace ./common/Make.rules --replace "/usr/bin/pod2man" "${buildPackages.perl}/bin/pod2man"
     substituteInPlace ./common/Make.rules --replace "/usr/bin/pod2html" "${buildPackages.perl}/bin/pod2html"
     substituteInPlace ./common/Make.rules --replace "/usr/include/linux/capability.h" "${linuxHeaders}/include/linux/capability.h"
@@ -184,11 +187,7 @@ let
 
     buildInputs = [ libapparmor ];
 
-    prePatch = ''
-      patch -p1 < ${gnumake43Patch}
-      chmod a+x ./common/list_capabilities.sh ./common/list_af_names.sh
-      patchShebangs ./common/list_capabilities.sh ./common/list_af_names.sh
-    '' + prePatchCommon + ''
+    prePatch = prePatchCommon + ''
       substituteInPlace ./parser/Makefile --replace "/usr/bin/bison" "${bison}/bin/bison"
       substituteInPlace ./parser/Makefile --replace "/usr/bin/flex" "${flex}/bin/flex"
       substituteInPlace ./parser/Makefile --replace "/usr/include/linux/capability.h" "${linuxHeaders}/include/linux/capability.h"
diff --git a/pkgs/os-specific/linux/cryptsetup/default.nix b/pkgs/os-specific/linux/cryptsetup/default.nix
index 06be9f3432e7..caa22b4df3ec 100644
--- a/pkgs/os-specific/linux/cryptsetup/default.nix
+++ b/pkgs/os-specific/linux/cryptsetup/default.nix
@@ -1,17 +1,15 @@
 { stdenv, fetchurl, lvm2, json_c
-, openssl, libuuid, pkgconfig, popt
-, enablePython ? false, python2 ? null }:
-
-assert enablePython -> python2 != null;
+, openssl, libuuid, pkgconfig, popt }:
 
 stdenv.mkDerivation rec {
-  name = "cryptsetup-2.1.0";
+  pname = "cryptsetup";
+  version = "2.3.3";
 
   outputs = [ "out" "dev" "man" ];
 
   src = fetchurl {
-    url = "mirror://kernel/linux/utils/cryptsetup/v2.1/${name}.tar.xz";
-    sha256 = "15y8n547garz0x5kqv09gscdsrz0c0y1y6c5cp8pccwg3xsb5vm3";
+    url = "mirror://kernel/linux/utils/cryptsetup/v2.3/${pname}-${version}.tar.xz";
+    sha256 = "1pw2bq4nv2z3xyycckxkbp7dp9kkp2n6bspna3plryg277z4zjiv";
   };
 
   # Disable 4 test cases that fail in a sandbox
@@ -19,9 +17,6 @@ stdenv.mkDerivation rec {
 
   postPatch = ''
     patchShebangs tests
-    ${stdenv.lib.optionalString enablePython ''
-      patchShebangs ./python/pycryptsetup-test.py
-    ''}
 
     # O_DIRECT is filesystem dependent and fails in a sandbox (on tmpfs)
     # and on several filesystem types (btrfs, zfs) without sandboxing.
@@ -34,11 +29,10 @@ stdenv.mkDerivation rec {
   configureFlags = [
     "--enable-cryptsetup-reencrypt"
     "--with-crypto_backend=openssl"
-  ] ++ stdenv.lib.optional enablePython "--enable-python";
+  ];
 
   nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [ lvm2 json_c openssl libuuid popt ]
-    ++ stdenv.lib.optional enablePython python2;
+  buildInputs = [ lvm2 json_c openssl libuuid popt ];
 
   doCheck = true;
 
diff --git a/pkgs/os-specific/linux/ffado/default.nix b/pkgs/os-specific/linux/ffado/default.nix
index e814091d59e2..b93caccc7574 100644
--- a/pkgs/os-specific/linux/ffado/default.nix
+++ b/pkgs/os-specific/linux/ffado/default.nix
@@ -13,7 +13,7 @@
 , libxmlxx3
 , pkgconfig
 , python3
-, scons
+, sconsPackages
 , which
 , wrapQtAppsHook
 }:
@@ -45,7 +45,7 @@ mkDerivation rec {
 
   nativeBuildInputs = [
     desktop-file-utils
-    scons.py2
+    sconsPackages.scons_3_1_2
     pkgconfig
     which
     python
diff --git a/pkgs/os-specific/linux/lvm2/default.nix b/pkgs/os-specific/linux/lvm2/default.nix
index 8db4be94e4ed..8bfdb37360dc 100644
--- a/pkgs/os-specific/linux/lvm2/default.nix
+++ b/pkgs/os-specific/linux/lvm2/default.nix
@@ -1,48 +1,72 @@
-{ stdenv, fetchgit, fetchpatch, pkgconfig, systemd, udev, utillinux, libuuid
+{ stdenv
+, fetchpatch
+, fetchurl
+, pkgconfig
+, utillinux
+, libuuid
 , thin-provisioning-tools, libaio
-, enable_dmeventd ? false }:
+, enableCmdlib ? false
+, enableDmeventd ? false
+, udev ? null
+, nixosTests
+}:
 
-let
-  version = "2.03.01";
-in
+# configure: error: --enable-dmeventd requires --enable-cmdlib to be used as well
+assert enableDmeventd -> enableCmdlib;
 
-stdenv.mkDerivation {
-  pname = "lvm2";
-  inherit version;
+stdenv.mkDerivation rec {
+  pname = "lvm2" + stdenv.lib.optionalString enableDmeventd "with-dmeventd";
+  version = "2.03.09";
 
-  src = fetchgit {
-    url = "git://sourceware.org/git/lvm2.git";
-    rev = "v${builtins.replaceStrings [ "." ] [ "_" ] version}";
-    sha256 = "0jlaswf1srdxiqpgpp97j950ddjds8z0kr4pbwmal2za2blrgvbl";
+  src = fetchurl {
+    url = "https://mirrors.kernel.org/sourceware/lvm2/LVM2.${version}.tgz";
+    sha256 = "0xdr9qbqw6kja267wmx6ajnfv1nhw056gpxx9v2qmfh3bj6qnfn0";
   };
 
-  configureFlags = [
-    "--disable-readline"
-    "--enable-udev_rules"
-    "--enable-udev_sync"
-    "--enable-pkgconfig"
-    "--enable-cmdlib"
-  ] ++ stdenv.lib.optional enable_dmeventd " --enable-dmeventd"
-  ++ stdenv.lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
-    "ac_cv_func_malloc_0_nonnull=yes"
-    "ac_cv_func_realloc_0_nonnull=yes"
-  ];
-
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ udev libuuid thin-provisioning-tools libaio ];
 
-  preConfigure =
-    ''
-      sed -i /DEFAULT_SYS_DIR/d Makefile.in
-      sed -i /DEFAULT_PROFILE_DIR/d conf/Makefile.in
-    '' + stdenv.lib.optionalString (systemd != null) ''
-      substituteInPlace scripts/lvm2_activation_generator_systemd_red_hat.c \
-        --replace /usr/bin/udevadm ${systemd}/bin/udevadm
-    '';
+  configureFlags = [
+    "--disable-readline"
+    "--enable-pkgconfig"
+    "--with-default-locking-dir=/run/lock/lvm"
+    "--with-default-run-dir=/run/lvm"
+    "--with-systemdsystemunitdir=${placeholder "out"}/lib/systemd/system"
+  ] ++ stdenv.lib.optionals (!enableCmdlib) [
+    "--bindir=${placeholder "bin"}/bin"
+    "--sbindir=${placeholder "bin"}/bin"
+    "--libdir=${placeholder "lib"}/lib"
+  ] ++ stdenv.lib.optional enableCmdlib "--enable-cmdlib"
+  ++ stdenv.lib.optionals enableDmeventd [
+    "--enable-dmeventd"
+    "--with-dmeventd-pidfile=/run/dmeventd/pid"
+    "--with-default-dm-run-dir=/run/dmeventd"
+  ] ++ stdenv.lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
+    "ac_cv_func_malloc_0_nonnull=yes"
+    "ac_cv_func_realloc_0_nonnull=yes"
+  ] ++
+  stdenv.lib.optionals (udev != null) [
+    "--enable-udev_rules"
+    "--enable-udev_sync"
+  ];
+
+  preConfigure = ''
+    sed -i /DEFAULT_SYS_DIR/d Makefile.in
+    sed -i /DEFAULT_PROFILE_DIR/d conf/Makefile.in
+    substituteInPlace scripts/lvm2_activation_generator_systemd_red_hat.c \
+      --replace /usr/bin/udevadm /run/current-system/systemd/bin/udevadm
+    # https://github.com/lvmteam/lvm2/issues/36
+    substituteInPlace udev/69-dm-lvm-metad.rules.in \
+      --replace "(BINDIR)/systemd-run" /run/current-system/systemd/bin/systemd-run
+
+    substituteInPlace make.tmpl.in --replace "@systemdsystemunitdir@" "$out/lib/systemd/system"
+    substituteInPlace libdm/make.tmpl.in --replace "@systemdsystemunitdir@" "$out/lib/systemd/system"
+  '';
+
+  postConfigure = ''
+    sed -i 's|^#define LVM_CONFIGURE_LINE.*$|#define LVM_CONFIGURE_LINE "<removed>"|g' ./include/configure.h
+  '';
 
-  # https://github.com/NixOS/nixpkgs/pull/52597
-  # gcc: error: ../../device_mapper/libdevice-mapper.a: No such file or directory
-  enableParallelBuilding = false;
 
   patches = stdenv.lib.optionals stdenv.hostPlatform.isMusl [
     (fetchpatch {
@@ -64,30 +88,41 @@ stdenv.mkDerivation {
 
   doCheck = false; # requires root
 
+  makeFlags = stdenv.lib.optionals (udev != null) [
+    "SYSTEMD_GENERATOR_DIR=$(out)/lib/systemd/system-generators"
+  ];
+
   # To prevent make install from failing.
   installFlags = [ "OWNER=" "GROUP=" "confdir=$(out)/etc" ];
 
   # Install systemd stuff.
-  #installTargets = "install install_systemd_generators install_systemd_units install_tmpfiles_configuration";
+  installTargets = [ "install" ] ++ stdenv.lib.optionals (udev != null) [
+    "install_systemd_generators"
+    "install_systemd_units"
+    "install_tmpfiles_configuration"
+  ];
 
-  postInstall =
-    ''
-      substituteInPlace $out/lib/udev/rules.d/13-dm-disk.rules \
-        --replace $out/sbin/blkid ${utillinux}/sbin/blkid
-    '' + stdenv.lib.optionalString (systemd != null) ''
-      # Systemd stuff
-      mkdir -p $out/etc/systemd/system $out/lib/systemd/system-generators
-      cp scripts/blk_availability_systemd_red_hat.service $out/etc/systemd/system
-      cp scripts/lvm2_activation_generator_systemd_red_hat $out/lib/systemd/system-generators
-    '';
+  # only split bin and lib out from out if cmdlib isn't enabled
+  outputs = [
+    "out"
+    "dev"
+    "man"
+  ] ++ stdenv.lib.optionals (enableCmdlib != true) [
+    "bin"
+    "lib"
+  ];
+
+  postInstall = stdenv.lib.optionalString (enableCmdlib != true) ''
+    moveToOutput lib/libdevmapper.so $lib
+  '';
+
+  passthru.tests.installer = nixosTests.installer.lvm;
 
   meta = with stdenv.lib; {
     homepage = "http://sourceware.org/lvm2/";
     description = "Tools to support Logical Volume Management (LVM) on Linux";
     platforms = platforms.linux;
     license = with licenses; [ gpl2 bsd2 lgpl21 ];
-    maintainers = with maintainers; [raskin];
-    inherit version;
-    downloadPage = "ftp://sources.redhat.com/pub/lvm2/";
+    maintainers = with maintainers; [ raskin ajs124 ];
   };
 }
diff --git a/pkgs/os-specific/linux/lvm2/default.upstream b/pkgs/os-specific/linux/lvm2/default.upstream
deleted file mode 100644
index 1e5aaf5ab5cf..000000000000
--- a/pkgs/os-specific/linux/lvm2/default.upstream
+++ /dev/null
@@ -1,4 +0,0 @@
-url ftp://sources.redhat.com/pub/lvm2/
-version_link '[.]tgz$'
-version '.*[^0-9.][^.]*[.]([0-9.]+)[.].*' '\1'
-do_overwrite () { do_overwrite_just_version; }
diff --git a/pkgs/os-specific/linux/multipath-tools/default.nix b/pkgs/os-specific/linux/multipath-tools/default.nix
index d60b4a9a549d..1c00ed9887df 100644
--- a/pkgs/os-specific/linux/multipath-tools/default.nix
+++ b/pkgs/os-specific/linux/multipath-tools/default.nix
@@ -10,6 +10,11 @@ stdenv.mkDerivation rec {
     sha256 = "1mgjylklh1cx8px8ffgl12kyc0ln3445vbabd2sy8chq31rpiiq8";
   };
 
+  patches = [
+    # fix build with json-c 0.14 https://www.redhat.com/archives/dm-devel/2020-May/msg00261.html
+    ./json-c-0.14.patch
+  ];
+
   postPatch = ''
     substituteInPlace libmultipath/Makefile --replace /usr/include/libdevmapper.h ${lvm2}/include/libdevmapper.h
     sed -i -re '
diff --git a/pkgs/os-specific/linux/multipath-tools/json-c-0.14.patch b/pkgs/os-specific/linux/multipath-tools/json-c-0.14.patch
new file mode 100644
index 000000000000..d5fee4248830
--- /dev/null
+++ b/pkgs/os-specific/linux/multipath-tools/json-c-0.14.patch
@@ -0,0 +1,21 @@
+diff --git a/libdmmp/libdmmp_private.h b/libdmmp/libdmmp_private.h
+index ac85b63f..b1a6ddea 100644
+--- a/libdmmp/libdmmp_private.h
++++ b/libdmmp/libdmmp_private.h
+@@ -30,6 +30,7 @@
+ #include <stdint.h>
+ #include <string.h>
+ #include <assert.h>
++#include <stdbool.h>
+ #include <json.h>
+ 
+ #include "libdmmp/libdmmp.h"
+@@ -82,7 +83,7 @@ static out_type func_name(struct dmmp_context *ctx, const char *var_name) { \
+ do { \
+ 	json_type j_type = json_type_null; \
+ 	json_object *j_obj_tmp = NULL; \
+-	if (json_object_object_get_ex(j_obj, key, &j_obj_tmp) != TRUE) { \
++	if (json_object_object_get_ex(j_obj, key, &j_obj_tmp) != true) { \
+ 		_error(ctx, "Invalid JSON output from multipathd IPC: " \
+ 		       "key '%s' not found", key); \
+ 		rc = DMMP_ERR_IPC_ERROR; \
diff --git a/pkgs/os-specific/linux/systemd/0007-hostnamed-localed-timedated-disable-methods-that-cha.patch b/pkgs/os-specific/linux/systemd/0007-hostnamed-localed-timedated-disable-methods-that-cha.patch
index 70fc147232b7..cef3280aba81 100644
--- a/pkgs/os-specific/linux/systemd/0007-hostnamed-localed-timedated-disable-methods-that-cha.patch
+++ b/pkgs/os-specific/linux/systemd/0007-hostnamed-localed-timedated-disable-methods-that-cha.patch
@@ -14,16 +14,6 @@ diff --git a/src/hostname/hostnamed.c b/src/hostname/hostnamed.c
 index 21f6471495..8c5af7619f 100644
 --- a/src/hostname/hostnamed.c
 +++ b/src/hostname/hostnamed.c
-@@ -422,6 +422,9 @@ static int method_set_hostname(sd_bus_message *m, void *userdata, sd_bus_error *
-         if (r < 0)
-                 return r;
- 
-+        return sd_bus_error_setf(error, SD_BUS_ERROR_NOT_SUPPORTED,
-+            "Changing system settings via systemd is not supported on NixOS.");
-+
-         if (isempty(name))
-                 name = c->data[PROP_STATIC_HOSTNAME];
- 
 @@ -478,6 +481,9 @@ static int method_set_static_hostname(sd_bus_message *m, void *userdata, sd_bus_
          if (r < 0)
                  return r;
diff --git a/pkgs/servers/gpsd/default.nix b/pkgs/servers/gpsd/default.nix
index 4e0d08324a0a..5f9beb4b8348 100644
--- a/pkgs/servers/gpsd/default.nix
+++ b/pkgs/servers/gpsd/default.nix
@@ -1,4 +1,4 @@
-{ fetchurl, stdenv, scons, pkgconfig, dbus, dbus-glib
+{ fetchurl, stdenv, sconsPackages, pkgconfig, dbus, dbus-glib
 , ncurses, libX11, libXt, libXpm, libXaw, libXext
 , libusb1, docbook_xml_dtd_412, docbook_xsl, bc
 , libxslt, xmlto, gpsdUser ? "gpsd", gpsdGroup ? "dialout"
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [
-    scons.py2 pkgconfig docbook_xml_dtd_412 docbook_xsl xmlto bc
+    sconsPackages.scons_3_1_2 pkgconfig docbook_xml_dtd_412 docbook_xsl xmlto bc
     python2Packages.python
     python2Packages.wrapPython
   ];
diff --git a/pkgs/servers/nosql/mongodb/mongodb.nix b/pkgs/servers/nosql/mongodb/mongodb.nix
index 1a0ede0ed6df..f57ff7461989 100644
--- a/pkgs/servers/nosql/mongodb/mongodb.nix
+++ b/pkgs/servers/nosql/mongodb/mongodb.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, scons, boost, gperftools, pcre-cpp, snappy, zlib, libyamlcpp
+{ stdenv, fetchurl, sconsPackages, boost, gperftools, pcre-cpp, snappy, zlib, libyamlcpp
 , sasl, openssl, libpcap, python27, python38, curl, Security, CoreFoundation, cctools }:
 
 # Note:
@@ -13,12 +13,12 @@ with stdenv.lib;
 let
   variants = if versionAtLeast version "4.2"
     then { python = python38.withPackages (ps: with ps; [ pyyaml cheetah3 psutil setuptools ]);
-            scons = scons;
+            scons = sconsPackages.scons_latest;
             mozjsVersion = "60";
             mozjsReplace = "defined(HAVE___SINCOS)";
           }
     else { python = python27.withPackages (ps: with ps; [ pyyaml typing cheetah ]);
-            scons = scons.py2;
+            scons = sconsPackages.scons_3_1_2;
             mozjsVersion = "45";
             mozjsReplace = "defined(HAVE_SINCOS)";
           };
diff --git a/pkgs/tools/compression/zstd/default.nix b/pkgs/tools/compression/zstd/default.nix
index f919fb92ed1d..9c9f91f9c19f 100644
--- a/pkgs/tools/compression/zstd/default.nix
+++ b/pkgs/tools/compression/zstd/default.nix
@@ -2,7 +2,8 @@
 , fixDarwinDylibNames
 , file
 , legacySupport ? false
-, enableShared ? true }:
+, static ? false
+}:
 
 stdenv.mkDerivation rec {
   pname = "zstd";
@@ -28,9 +29,24 @@ stdenv.mkDerivation rec {
     # work fine, and I'm not sure how to write the condition.
     ++ stdenv.lib.optional stdenv.hostPlatform.isWindows ./mcfgthreads-no-pthread.patch;
 
+  postPatch =
+  # Patch shebangs for playTests
+  ''
+    patchShebangs programs/zstdgrep
+  '' + stdenv.lib.optionalString (!static) ''
+    substituteInPlace build/cmake/CMakeLists.txt \
+      --replace 'message(SEND_ERROR "You need to build static library to build tests")' ""
+    substituteInPlace build/cmake/tests/CMakeLists.txt \
+      --replace 'libzstd_static' 'libzstd_shared'
+    sed -i \
+      "1aexport ${stdenv.lib.optionalString stdenv.isDarwin "DY"}LD_LIBRARY_PATH=$PWD/build_/lib" \
+      tests/playTests.sh
+  '';
+
   cmakeFlags = [
-    "-DZSTD_BUILD_SHARED:BOOL=${if enableShared then "ON" else "OFF"}"
-    # They require STATIC for bin/zstd and tests.
+    "-DZSTD_BUILD_SHARED:BOOL=${if (!static) then "ON" else "OFF"}"
+    "-DZSTD_BUILD_STATIC:BOOL=${if static then "ON" else "OFF"}"
+    "-DZSTD_PROGRAMS_LINK_SHARED:BOOL=${if (!static) then "ON" else "OFF"}"
     "-DZSTD_LEGACY_SUPPORT:BOOL=${if legacySupport then "ON" else "OFF"}"
     "-DZSTD_BUILD_TESTS:BOOL=ON"
   ];
@@ -56,8 +72,6 @@ stdenv.mkDerivation rec {
     substituteInPlace ../programs/zstdless \
       --replace "zstdcat" "$bin/bin/zstdcat"
   '';
-  # Don't duplicate the library code in runtime closures.
-  postInstall = stdenv.lib.optionalString enableShared ''rm "$out"/lib/libzstd.a'';
 
   outputs = [ "bin" "dev" "man" "out" ];
 
diff --git a/pkgs/tools/filesystems/btrfs-progs/default.nix b/pkgs/tools/filesystems/btrfs-progs/default.nix
index f79dc2396658..8ff72421a598 100644
--- a/pkgs/tools/filesystems/btrfs-progs/default.nix
+++ b/pkgs/tools/filesystems/btrfs-progs/default.nix
@@ -4,11 +4,11 @@
 
 stdenv.mkDerivation rec {
   pname = "btrfs-progs";
-  version = "5.6.1";
+  version = "5.7";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/people/kdave/btrfs-progs/btrfs-progs-v${version}.tar.xz";
-    sha256 = "1nwnvjdnr9fjj2q2p2vpjabfdhcrwykgj9knjcsqy0c7p1bgbk2h";
+    sha256 = "0p6ycbr8sw5bq3mj84gh9rvh5sk8sjr2l9hb9dhm4j41ij5h8bsw";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/misc/fluent-bit/default.nix b/pkgs/tools/misc/fluent-bit/default.nix
index d882c6efb5e8..cc40c89bc6f4 100644
--- a/pkgs/tools/misc/fluent-bit/default.nix
+++ b/pkgs/tools/misc/fluent-bit/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "fluent-bit";
-  version = "1.4.6";
+  version = "1.5.0";
 
   src = fetchFromGitHub {
     owner = "fluent";
     repo = "fluent-bit";
     rev = "v${version}";
-    sha256 = "0qxyjmgl85q7xk629l548bpzizma5n4j1r6nqbwh9j15ajvq7mq8";
+    sha256 = "15nfzs1p6na0n98hpzh4lnzcj4g83dg2nfhd4f9lay32qj12cqgj";
   };
 
   nativeBuildInputs = [ cmake flex bison ];
diff --git a/pkgs/tools/misc/gringo/default.nix b/pkgs/tools/misc/gringo/default.nix
index 92f1eb895855..05e5e9b64cf0 100644
--- a/pkgs/tools/misc/gringo/default.nix
+++ b/pkgs/tools/misc/gringo/default.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchurl,
-  bison, re2c, scons,
+  bison, re2c, sconsPackages,
   libcxx
 }:
 
@@ -16,7 +16,7 @@ stdenv.mkDerivation {
     sha256 = "16k4pkwyr2mh5w8j91vhxh9aff7f4y31npwf09w6f8q63fxvpy41";
   };
 
-  buildInputs = [ bison re2c scons.py2 ];
+  buildInputs = [ bison re2c sconsPackages.scons_3_1_2 ];
 
   patches = [
     ./gringo-4.5.4-cmath.patch
diff --git a/pkgs/tools/misc/man-db/default.nix b/pkgs/tools/misc/man-db/default.nix
index f5cbef8b0226..68e1aaa4d613 100644
--- a/pkgs/tools/misc/man-db/default.nix
+++ b/pkgs/tools/misc/man-db/default.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl, pkgconfig, libpipeline, db, groff, libiconv, makeWrapper, buildPackages }:
 
 stdenv.mkDerivation rec {
-  name = "man-db-2.9.2";
+  name = "man-db-2.9.3";
 
   src = fetchurl {
     url = "mirror://savannah/man-db/${name}.tar.xz";
-    sha256 = "0z04kwv5ymmd0pzadpaag696jfckg6rbz8x4jrgj09bmqqk3yf3v";
+    sha256 = "1f4palf5bdyf3f8sa0981cqxn9cjcr2pz53ngrrsybb9n0da2nps";
   };
 
   outputs = [ "out" "doc" ];
diff --git a/pkgs/tools/misc/yubikey-personalization/default.nix b/pkgs/tools/misc/yubikey-personalization/default.nix
index 5ef828762f64..69e3d5886537 100644
--- a/pkgs/tools/misc/yubikey-personalization/default.nix
+++ b/pkgs/tools/misc/yubikey-personalization/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, pkgconfig, libusb1, libyubikey, json_c }:
+{ stdenv, fetchurl, fetchpatch, pkgconfig, libusb1, libyubikey, json_c }:
 
 stdenv.mkDerivation rec {
   pname = "yubikey-personalization";
@@ -9,6 +9,15 @@ stdenv.mkDerivation rec {
     sha256 = "14wvlwqnwj0gllkpvfqiy8ns938bwvjsz8x1hmymmx32m074vj0f";
   };
 
+  patches = [
+    # remove after updating to next release
+    (fetchpatch {
+      name = "json-c-0.14-support.patch";
+      url = "https://github.com/Yubico/yubikey-personalization/commit/0aa2e2cae2e1777863993a10c809bb50f4cde7f8.patch";
+      sha256 = "1wnigf3hbq59i15kgxpq3pwrl1drpbj134x81mmv9xm1r44cjva8";
+    })
+  ];
+
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ libusb1 libyubikey json_c ];
 
diff --git a/pkgs/tools/networking/connman/connman-ncurses/default.nix b/pkgs/tools/networking/connman/connman-ncurses/default.nix
index 7bfb4571e107..1e7f54f9ddbe 100644
--- a/pkgs/tools/networking/connman/connman-ncurses/default.nix
+++ b/pkgs/tools/networking/connman/connman-ncurses/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, autoreconfHook, pkgconfig, dbus, json_c, ncurses, connman }:
+{ stdenv, fetchpatch, fetchFromGitHub, autoreconfHook, pkgconfig, dbus, json_c, ncurses, connman }:
 
 stdenv.mkDerivation {
   pname = "connman-ncurses";
@@ -11,12 +11,21 @@ stdenv.mkDerivation {
     sha256 = "1831r0776fv481g8kgy1dkl750pzv47835dw11sslq2k6mm6i9p1";
   };
 
+  patches = [
+    # Fix build with json-c 0.14
+    (fetchpatch {
+      url = "https://github.com/void-linux/void-packages/raw/5830ce60e922b7dced8157ededda8c995adb3bb9/srcpkgs/connman-ncurses/patches/lowercase-boolean.patch";
+      extraPrefix = "";
+      sha256 = "uK83DeRyXS2Y0ZZpTYvYNh/1ZM2QQ7QpajiBztaEuSM=";
+    })
+  ];
+
   nativeBuildInputs = [ autoreconfHook pkgconfig ];
 
   buildInputs = [ dbus ncurses json_c connman ];
 
   NIX_CFLAGS_COMPILE = "-Wno-error";
-  
+
   installPhase = ''
     mkdir -p "$out/bin"
     cp -va connman_ncurses "$out/bin/"
diff --git a/pkgs/tools/networking/curl/default.nix b/pkgs/tools/networking/curl/default.nix
index 68de06610721..ce24854d04d9 100644
--- a/pkgs/tools/networking/curl/default.nix
+++ b/pkgs/tools/networking/curl/default.nix
@@ -29,14 +29,14 @@ assert gssSupport -> libkrb5 != null;
 
 stdenv.mkDerivation rec {
   pname = "curl";
-  version = "7.71.0";
+  version = "7.71.1";
 
   src = fetchurl {
     urls = [
       "https://curl.haxx.se/download/${pname}-${version}.tar.bz2"
       "https://github.com/curl/curl/releases/download/${lib.replaceStrings ["."] ["_"] pname}-${version}/${pname}-${version}.tar.bz2"
     ];
-    sha256 = "0hfkbp51vj51s28sq2wnw5jn2f6r7ycdy78lli49ba414jn003v0";
+    sha256 = "097jnkbayscifgzgl7v8kwd7m2crpvbyaazac3ab1yal0pca8llx";
   };
 
   outputs = [ "bin" "dev" "out" "man" "devdoc" ];
diff --git a/pkgs/tools/networking/network-manager/default.nix b/pkgs/tools/networking/network-manager/default.nix
index baf2128153aa..f5b12a6cf373 100644
--- a/pkgs/tools/networking/network-manager/default.nix
+++ b/pkgs/tools/networking/network-manager/default.nix
@@ -10,11 +10,11 @@ let
   pythonForDocs = python3.withPackages (pkgs: with pkgs; [ pygobject3 ]);
 in stdenv.mkDerivation rec {
   pname = "network-manager";
-  version = "1.22.10";
+  version = "1.26.0";
 
   src = fetchurl {
     url = "mirror://gnome/sources/NetworkManager/${stdenv.lib.versions.majorMinor version}/NetworkManager-${version}.tar.xz";
-    sha256 = "0xyaizyp3yz6x3pladw3nvl3hf4n5g140zx9jnxfp9qvag0wqa9b";
+    sha256 = "0isdqwp58d7r92sqsk7l2vlqwy518n8b7c7z94jk9gc1bdmjf8sj";
   };
 
   outputs = [ "out" "dev" "devdoc" "man" "doc" ];
@@ -41,7 +41,6 @@ in stdenv.mkDerivation rec {
     "-Dcrypto=gnutls"
     "-Dsession_tracking=systemd"
     "-Dmodem_manager=true"
-    "-Dpolkit_agent=true"
     "-Dnmtui=true"
     "-Ddocs=true"
     "-Dtests=no"
@@ -49,12 +48,14 @@ in stdenv.mkDerivation rec {
     # Allow using iwd when configured to do so
     "-Diwd=true"
     "-Dlibaudit=yes-disabled-by-default"
+    # We don't use firewalld in NixOS
+    "-Dfirewalld_zone=false"
   ];
 
   patches = [
     (substituteAll {
       src = ./fix-paths.patch;
-      inherit iputils kmod openconnect ethtool gnused systemd;
+      inherit iputils kmod openconnect ethtool gnused systemd polkit;
       inherit runtimeShell;
     })
 
diff --git a/pkgs/tools/networking/network-manager/fix-install-paths.patch b/pkgs/tools/networking/network-manager/fix-install-paths.patch
index 02a006c1c3db..4e80247cf144 100644
--- a/pkgs/tools/networking/network-manager/fix-install-paths.patch
+++ b/pkgs/tools/networking/network-manager/fix-install-paths.patch
@@ -1,8 +1,8 @@
 diff --git a/meson.build b/meson.build
-index 0af69f35d..9ab239c8a 100644
+index a2d925a7e..5a65cd2fe 100644
 --- a/meson.build
 +++ b/meson.build
-@@ -912,9 +912,9 @@ meson.add_install_script(
+@@ -959,9 +959,9 @@ meson.add_install_script(
    join_paths('tools', 'meson-post-install.sh'),
    nm_datadir,
    nm_bindir,
diff --git a/pkgs/tools/networking/network-manager/fix-paths.patch b/pkgs/tools/networking/network-manager/fix-paths.patch
index af35fc0a36bf..60ee437f6f4a 100644
--- a/pkgs/tools/networking/network-manager/fix-paths.patch
+++ b/pkgs/tools/networking/network-manager/fix-paths.patch
@@ -1,8 +1,21 @@
+diff --git a/clients/common/nm-polkit-listener.c b/clients/common/nm-polkit-listener.c
+index ace205e80..f19c1dea0 100644
+--- a/clients/common/nm-polkit-listener.c
++++ b/clients/common/nm-polkit-listener.c
+@@ -552,7 +552,7 @@ begin_authentication (AuthRequest *request)
+ {
+ 	int fd_flags;
+ 	const char *helper_argv[] = {
+-		POLKIT_PACKAGE_PREFIX "/lib/polkit-1/polkit-agent-helper-1",
++		"/run/wrappers/bin/polkit-agent-helper-1",
+ 		request->username,
+ 		NULL,
+ 	};
 diff --git a/clients/common/nm-vpn-helpers.c b/clients/common/nm-vpn-helpers.c
-index ffae5f553..ba1093e4d 100644
+index 74ff52bb2..638857df4 100644
 --- a/clients/common/nm-vpn-helpers.c
 +++ b/clients/common/nm-vpn-helpers.c
-@@ -203,10 +203,7 @@ nm_vpn_openconnect_authenticate_helper (const char *host,
+@@ -213,10 +213,7 @@ nm_vpn_openconnect_authenticate_helper (const char *host,
  		NULL,
  	};
  
@@ -40,35 +53,25 @@ index 91ebd9a36..5201a56c3 100644
  ExecStart=@sbindir@/NetworkManager --no-daemon
  Restart=on-failure
 diff --git a/libnm/meson.build b/libnm/meson.build
-index 51ca46d2b..0c04cc216 100644
+index d3991ab19..58f01c666 100644
 --- a/libnm/meson.build
 +++ b/libnm/meson.build
-@@ -261,7 +261,7 @@ if enable_introspection
-     name,
-     input: libnm_gir[0],
-     output: name,
--    command: [generate_setting_docs_env, python.path(), generate_setting_docs, '--lib-path', meson.current_build_dir(), '--gir', '@INPUT@', '--output', '@OUTPUT@'],
-+    command: [generate_setting_docs_env, generate_setting_docs, '--lib-path', meson.current_build_dir(), '--gir', '@INPUT@', '--output', '@OUTPUT@'],
-     depends: libnm_gir,
-   )
- 
-@@ -270,7 +270,7 @@ if enable_introspection
-     name,
-     input: [libnm_gir[0], nm_settings_docs_overrides],
-     output: name,
--    command: [generate_setting_docs_env, python.path(), generate_setting_docs, '--lib-path', meson.current_build_dir(), '--gir', '@INPUT0@', '--overrides', '@INPUT1@', '--output', '@OUTPUT@'],
-+    command: [generate_setting_docs_env, generate_setting_docs, '--lib-path', meson.current_build_dir(), '--gir', '@INPUT0@', '--overrides', '@INPUT1@', '--output', '@OUTPUT@'],
-     depends: libnm_gir,
-   )
- endif
+@@ -283,7 +283,6 @@ if enable_introspection
+     output: 'nm-settings-docs-gir.xml',
+     command: [
+       generate_setting_docs_env,
+-      python.path(),
+       join_paths(meson.source_root(), 'tools', 'generate-docs-nm-settings-docs-gir.py'),
+       '--lib-path', meson.current_build_dir(),
+       '--gir', '@INPUT@',
 diff --git a/src/devices/nm-device.c b/src/devices/nm-device.c
-index e7a4a059a..0a8f8b7c6 100644
+index de09e4807..2755db165 100644
 --- a/src/devices/nm-device.c
 +++ b/src/devices/nm-device.c
-@@ -13179,14 +13179,14 @@ nm_device_start_ip_check (NMDevice *self)
+@@ -13705,14 +13705,14 @@ nm_device_start_ip_check (NMDevice *self)
  			gw = nm_ip4_config_best_default_route_get (priv->ip_config_4);
  			if (gw) {
- 				nm_utils_inet4_ntop (NMP_OBJECT_CAST_IP4_ROUTE (gw)->gateway, buf);
+ 				_nm_utils_inet4_ntop (NMP_OBJECT_CAST_IP4_ROUTE (gw)->gateway, buf);
 -				ping_binary = nm_utils_find_helper ("ping", "/usr/bin/ping", NULL);
 +				ping_binary = "@iputils@/bin/ping";
  				log_domain = LOGD_IP4;
@@ -76,14 +79,14 @@ index e7a4a059a..0a8f8b7c6 100644
  		} else if (priv->ip_config_6 && priv->ip_state_6 == NM_DEVICE_IP_STATE_DONE) {
  			gw = nm_ip6_config_best_default_route_get (priv->ip_config_6);
  			if (gw) {
- 				nm_utils_inet6_ntop (&NMP_OBJECT_CAST_IP6_ROUTE (gw)->gateway, buf);
+ 				_nm_utils_inet6_ntop (&NMP_OBJECT_CAST_IP6_ROUTE (gw)->gateway, buf);
 -				ping_binary = nm_utils_find_helper ("ping6", "/usr/bin/ping6", NULL);
 +				ping_binary = "@iputils@/bin/ping";
  				log_domain = LOGD_IP6;
  			}
  		}
 diff --git a/src/nm-core-utils.c b/src/nm-core-utils.c
-index fb92289f0..c91b27b09 100644
+index 3950c3c3a..a9436d75a 100644
 --- a/src/nm-core-utils.c
 +++ b/src/nm-core-utils.c
 @@ -336,7 +336,7 @@ nm_utils_modprobe (GError **error, gboolean suppress_error_logging, const char *
diff --git a/pkgs/tools/security/zmap/cmake-json-0.14-fix.patch b/pkgs/tools/security/zmap/cmake-json-0.14-fix.patch
new file mode 100644
index 000000000000..1c132948af6a
--- /dev/null
+++ b/pkgs/tools/security/zmap/cmake-json-0.14-fix.patch
@@ -0,0 +1,13 @@
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index 8bd825f..694d9b2 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -72,6 +72,8 @@ if(WITH_JSON)
+     endif()
+ 
+     add_definitions("-DJSON")
++    # JSON_CFLAGS is a list, i.e. semicolon-separated, convert it to space-separated
++    string(REPLACE ";" " " JSON_CFLAGS "${JSON_CFLAGS}")
+     set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} ${JSON_CFLAGS}")
+ endif()
+ 
diff --git a/pkgs/tools/security/zmap/default.nix b/pkgs/tools/security/zmap/default.nix
index ef36b21641bc..e2350b67c7d7 100644
--- a/pkgs/tools/security/zmap/default.nix
+++ b/pkgs/tools/security/zmap/default.nix
@@ -13,6 +13,11 @@ stdenv.mkDerivation rec {
     sha256 = "0yaahaiawkjk020hvsb8pndbrk8k10wxkfba1irp12a4sj6rywcs";
   };
 
+  patches = [
+    # fix build with json-c 0.14 https://github.com/zmap/zmap/pull/609
+    ./cmake-json-0.14-fix.patch
+  ];
+
   cmakeFlags = [ "-DRESPECT_INSTALL_PREFIX_CONFIG=ON" ];
   dontUseCmakeBuildDir = true;
 
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index c9c101da1a06..42fc91f375f8 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -548,6 +548,7 @@ mapAliases ({
   surf-webkit2 = surf; # added 2017-04-02
   sup = throw "deprecated in 2019-09-10: abandoned by upstream";
   system_config_printer = system-config-printer;  # added 2016-01-03
+  systemd_with_lvm2 = throw "obsolete, enabled by default via the lvm module"; # added 2020-07-12
   systool = sysfsutils; # added 2018-04-25
   tahoelafs = tahoe-lafs; # added 2018-03-26
   tangogps = foxtrotgps; # added 2020-01-26
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index f067bfd5fb0c..5bbdcb86a382 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -9318,10 +9318,14 @@ in
   rust_1_44 = callPackage ../development/compilers/rust/1_44.nix {
     inherit (darwin.apple_sdk.frameworks) CoreFoundation Security;
   };
-  rust = rust_1_44;
+  rust_1_45 = callPackage ../development/compilers/rust/1_45.nix {
+    inherit (darwin.apple_sdk.frameworks) CoreFoundation Security;
+  };
+  rust = rust_1_45;
 
   rustPackages_1_44 = rust_1_44.packages.stable;
-  rustPackages = rustPackages_1_44;
+  rustPackages_1_45 = rust_1_45.packages.stable;
+  rustPackages = rustPackages_1_45;
 
   inherit (rustPackages) cargo clippy rustc rustPlatform;
   inherit (rust) makeRustPlatform;
@@ -11453,8 +11457,6 @@ in
   arrayfire = callPackage ../development/libraries/arrayfire {};
 
   arrow-cpp = callPackage ../development/libraries/arrow-cpp ({
-    # Workaround until #91984 is in, this will need to be removed later.
-    zstd = zstd.override { enableShared = false; };
   } // stdenv.lib.optionalAttrs (stdenv.hostPlatform.isi686 && stdenv.cc.isGNU) {
     stdenv = overrideCC stdenv buildPackages.gcc6; # hidden symbol `__divmoddi4'
   });
@@ -12073,6 +12075,7 @@ in
   gf2x = callPackage ../development/libraries/gf2x {};
 
   gd = callPackage ../development/libraries/gd {
+    automake = automake115x;
     libtiff = null;
     libXpm = null;
   };
@@ -14148,6 +14151,7 @@ in
   };
 
   nss = lowPrio (callPackage ../development/libraries/nss { });
+  nss_3_44 = lowPrio (callPackage ../development/libraries/nss/3.44.nix { });
   nssTools = nss.tools;
 
   nss_wrapper = callPackage ../development/libraries/nss_wrapper { };
@@ -16919,9 +16923,7 @@ in
 
   directvnc = callPackage ../os-specific/linux/directvnc { };
 
-  dmraid = callPackage ../os-specific/linux/dmraid {
-    lvm2 = lvm2.override {enable_dmeventd = true;};
-  };
+  dmraid = callPackage ../os-specific/linux/dmraid { lvm2 = lvm2_dmeventd; };
 
   drbd = callPackage ../os-specific/linux/drbd { };
 
@@ -17630,6 +17632,10 @@ in
   lsscsi = callPackage ../os-specific/linux/lsscsi { };
 
   lvm2 = callPackage ../os-specific/linux/lvm2 { };
+  lvm2_dmeventd = callPackage ../os-specific/linux/lvm2 {
+    enableDmeventd = true;
+    enableCmdlib = true;
+  };
 
   mbelib = callPackage ../development/libraries/audio/mbelib { };
 
@@ -17952,14 +17958,6 @@ in
   # standalone cryptsetup generator for systemd
   systemd-cryptsetup-generator = callPackage ../os-specific/linux/systemd/cryptsetup-generator.nix { };
 
-  # In nixos, you can set systemd.package = pkgs.systemd_with_lvm2 to get
-  # LVM2 working in systemd.
-  systemd_with_lvm2 = pkgs.appendToName "with-lvm2" (pkgs.lib.overrideDerivation pkgs.systemd (p: {
-      postInstall = p.postInstall + ''
-        cp "${pkgs.lvm2}/lib/systemd/system-generators/"* $out/lib/systemd/system-generators
-      '';
-  }));
-
   systemd-wait = callPackage ../os-specific/linux/systemd-wait { };
 
   sysvinit = callPackage ../os-specific/linux/sysvinit { };
@@ -20036,6 +20034,7 @@ in
 
   firefoxPackages = recurseIntoAttrs (callPackage ../applications/networking/browsers/firefox/packages.nix {
     callPackage = pkgs.newScope {
+      inherit (rustPackages_1_44) cargo rustc;
       libpng = libpng_apng;
       python = python2;
       gnused = gnused_422;
@@ -20990,6 +20989,7 @@ in
     harfbuzz = harfbuzz.override {
       withIcu = true; withGraphite2 = true;
     };
+    nss = nss_3_44;
   };
 
   libreoffice-qt = lowPrio (callPackage ../applications/office/libreoffice/wrapper.nix {
@@ -22776,8 +22776,10 @@ in
   thonny = callPackage ../applications/editors/thonny { };
 
   thunderbird = callPackage ../applications/networking/mailreaders/thunderbird {
+    inherit (rustPackages_1_44) cargo rustc;
     libpng = libpng_apng;
     gtk3Support = true;
+    nss = nss_3_44; # 68.x won't build with newest nss anymore (like firefox-esr-68)
   };
 
   thunderbolt = callPackage ../os-specific/linux/thunderbolt {};
diff --git a/pkgs/top-level/static.nix b/pkgs/top-level/static.nix
index fcfe856398ef..b4c1ee9ab3de 100644
--- a/pkgs/top-level/static.nix
+++ b/pkgs/top-level/static.nix
@@ -242,7 +242,7 @@ in {
   };
 
   zstd = super.zstd.override {
-    enableShared = false;
+    static = true;
   };
 
   llvmPackages_8 = super.llvmPackages_8 // {