diff --git a/nixos/modules/services/web-servers/nginx/default.nix b/nixos/modules/services/web-servers/nginx/default.nix
index f3175793ebef..6c8341c1115f 100644
--- a/nixos/modules/services/web-servers/nginx/default.nix
+++ b/nixos/modules/services/web-servers/nginx/default.nix
@@ -804,7 +804,7 @@ in
         ProtectControlGroups = true;
         RestrictAddressFamilies = [ "AF_UNIX" "AF_INET" "AF_INET6" ];
         LockPersonality = true;
-        MemoryDenyWriteExecute = !(builtins.any (mod: (mod.allowMemoryWriteExecute or false)) cfg.package.modules);
+        MemoryDenyWriteExecute = !(builtins.any (mod: (mod.allowMemoryWriteExecute or false)) (optionals (cfg.package ? modules) cfg.package.modules));
         RestrictRealtime = true;
         RestrictSUIDSGID = true;
         PrivateMounts = true;
diff --git a/pkgs/applications/accessibility/squeekboard/default.nix b/pkgs/applications/accessibility/squeekboard/default.nix
new file mode 100644
index 000000000000..08042a7701b9
--- /dev/null
+++ b/pkgs/applications/accessibility/squeekboard/default.nix
@@ -0,0 +1,70 @@
+{ lib
+, stdenv
+, fetchFromGitLab
+, meson
+, ninja
+, pkg-config
+, gnome3
+, glib
+, gtk3
+, wayland
+, wayland-protocols
+, libxml2
+, libxkbcommon
+, rustPlatform
+, feedbackd
+, wrapGAppsHook
+}:
+
+stdenv.mkDerivation rec {
+  pname = "squeekboard";
+  version = "unstable-2021-03-09";
+
+  src = fetchFromGitLab {
+    domain = "source.puri.sm";
+    owner = "Librem5";
+    repo = pname;
+    rev = "bffd212e102bf71a94c599aac0359a8d30d19008";
+    sha256 = "1j10zhyb8wyrcbryfj6f3drn9b0l9x0l7hnhy2imnjbfbnwwm4w7";
+  };
+
+  cargoDeps = rustPlatform.fetchCargoTarball {
+    inherit src;
+    cargoUpdateHook = ''
+      cat Cargo.toml.in Cargo.deps > Cargo.toml
+    '';
+    name = "${pname}-${version}";
+    sha256 = "1qaqiaxqc4x2x5bd31na4c49vbjwrmz5clmgli7733dv55rxxias";
+  };
+
+  nativeBuildInputs = [
+    meson
+    ninja
+    pkg-config
+    glib
+    wayland
+    wrapGAppsHook
+  ] ++ (with rustPlatform; [
+    cargoSetupHook
+    rust.cargo
+    rust.rustc
+  ]);
+
+  buildInputs = [
+    gtk3
+    gnome3.gnome-desktop
+    wayland
+    wayland-protocols
+    libxml2
+    libxkbcommon
+    feedbackd
+  ];
+
+  meta = with lib; {
+    description = "A virtual keyboard supporting Wayland";
+    homepage = "https://source.puri.sm/Librem5/squeekboard";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ artturin ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/applications/office/skrooge/default.nix b/pkgs/applications/office/skrooge/default.nix
index 067b06747d77..8f5beee38451 100644
--- a/pkgs/applications/office/skrooge/default.nix
+++ b/pkgs/applications/office/skrooge/default.nix
@@ -7,11 +7,11 @@
 
 mkDerivation rec {
   pname = "skrooge";
-  version = "2.23.0";
+  version = "2.24.6";
 
   src = fetchurl {
     url = "http://download.kde.org/stable/skrooge/${pname}-${version}.tar.xz";
-    sha256 = "10k3j67x5xm5whsvb84k9p70bkn4jbbbvdfan7q49dh2mmpair5a";
+    sha256 = "sha256-DReIm9lcq0j761wWTpJu7HnfEWz9QsRGgUtyVaXFs6A=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/libdeflate/default.nix b/pkgs/development/libraries/libdeflate/default.nix
index f0bf60cdfb88..d7a4aa91fb54 100644
--- a/pkgs/development/libraries/libdeflate/default.nix
+++ b/pkgs/development/libraries/libdeflate/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchFromGitHub }:
+{ stdenv, lib, fetchFromGitHub, fixDarwinDylibNames }:
 
 stdenv.mkDerivation rec {
   pname = "libdeflate";
@@ -15,6 +15,8 @@ stdenv.mkDerivation rec {
     substituteInPlace Makefile --replace /usr/local $out
   '';
 
+  nativeBuildInputs = lib.optional stdenv.hostPlatform.isDarwin fixDarwinDylibNames;
+
   configurePhase = ''
     make programs/config.h
   '';
diff --git a/pkgs/development/ocaml-modules/cohttp/default.nix b/pkgs/development/ocaml-modules/cohttp/default.nix
index e664d17f215e..1cbc43bc2804 100644
--- a/pkgs/development/ocaml-modules/cohttp/default.nix
+++ b/pkgs/development/ocaml-modules/cohttp/default.nix
@@ -1,11 +1,12 @@
 { lib, fetchurl, buildDunePackage
 , ppx_fields_conv, ppx_sexp_conv, stdlib-shims
 , base64, fieldslib, jsonm, re, stringext, uri-sexp
+, ocaml, fmt, alcotest
 }:
 
 buildDunePackage rec {
   pname = "cohttp";
-  version = "2.5.4";
+  version = "2.5.5";
 
   useDune2 = true;
 
@@ -13,13 +14,16 @@ buildDunePackage rec {
 
   src = fetchurl {
     url = "https://github.com/mirage/ocaml-cohttp/releases/download/v${version}/cohttp-v${version}.tbz";
-    sha256 = "1q04spmki5zis5p5m1vs77i3k7ijm134j62g61071vblwx25z17a";
+    sha256 = "0ywmql4lp6ps2gd064ixbjzsdnnn5vk3pipm005sswl553qqwaim";
   };
 
   buildInputs = [ jsonm ppx_fields_conv ppx_sexp_conv ];
 
   propagatedBuildInputs = [ base64 fieldslib re stringext uri-sexp stdlib-shims ];
 
+  doCheck = lib.versionAtLeast ocaml.version "4.05";
+  checkInputs = [ fmt alcotest ];
+
   meta = {
     description = "HTTP(S) library for Lwt, Async and Mirage";
     license = lib.licenses.isc;
diff --git a/pkgs/development/ocaml-modules/extlib/default.nix b/pkgs/development/ocaml-modules/extlib/default.nix
index a8b1810e51f1..2a437cd29d34 100644
--- a/pkgs/development/ocaml-modules/extlib/default.nix
+++ b/pkgs/development/ocaml-modules/extlib/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchurl, ocaml, findlib, cppo, minimal ? true }:
+{ stdenv, lib, fetchurl, fetchpatch, ocaml, findlib, cppo, minimal ? true }:
 
 assert lib.versionAtLeast (lib.getVersion ocaml) "3.11";
 
@@ -10,6 +10,13 @@ stdenv.mkDerivation {
     sha256 = "1sxmzc1mx3kg62j8kbk0dxkx8mkf1rn70h542cjzrziflznap0s1";
   };
 
+  patches = [
+    (fetchpatch {
+      url = "https://github.com/ygrek/ocaml-extlib/pull/55.patch";
+      sha256 = "0mj3xii56rh8j8brdyv5d06rbs6jjjcy4ib9chafkq3f3sbq795p";
+    })
+  ];
+
   buildInputs = [ ocaml findlib cppo ];
 
   createFindlibDestdir = true;
diff --git a/pkgs/development/python-modules/aioesphomeapi/default.nix b/pkgs/development/python-modules/aioesphomeapi/default.nix
index 503a5336ee23..425575442592 100644
--- a/pkgs/development/python-modules/aioesphomeapi/default.nix
+++ b/pkgs/development/python-modules/aioesphomeapi/default.nix
@@ -2,13 +2,13 @@
 
 buildPythonPackage rec {
   pname = "aioesphomeapi";
-  version = "2.6.5";
+  version = "2.6.6";
 
   disabled = !isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-inktluPKefrFQCF2yadvHwT9Rw+pJLw8pjdUc35IJoc=";
+    sha256 = "sha256-LdBUtU5rNoixh7DPIFkHxLMvBeI6MZH57sO0IjuOQAw=";
   };
 
   propagatedBuildInputs = [ attrs protobuf zeroconf ];
diff --git a/pkgs/development/python-modules/boto3/default.nix b/pkgs/development/python-modules/boto3/default.nix
index b8d184a05815..7c412836ad0a 100644
--- a/pkgs/development/python-modules/boto3/default.nix
+++ b/pkgs/development/python-modules/boto3/default.nix
@@ -13,11 +13,11 @@
 
 buildPythonPackage rec {
   pname = "boto3";
-  version = "1.17.25"; # N.B: if you change this, change botocore and awscli to a matching version
+  version = "1.17.27"; # N.B: if you change this, change botocore and awscli to a matching version
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-Jz6WriuVpgNqTDVH52onCxerdhzHYFOCPJ42HSaCE+8=";
+    sha256 = "sha256-+kGYf59xNoATdnMG2VIrYnlGoBtIQ5OKJvsZzIrbBsA=";
   };
 
   propagatedBuildInputs = [ botocore jmespath s3transfer ] ++ lib.optionals (!isPy3k) [ futures ];
diff --git a/pkgs/development/python-modules/botocore/default.nix b/pkgs/development/python-modules/botocore/default.nix
index d6069e14a9be..bdb15199e36c 100644
--- a/pkgs/development/python-modules/botocore/default.nix
+++ b/pkgs/development/python-modules/botocore/default.nix
@@ -12,11 +12,11 @@
 
 buildPythonPackage rec {
   pname = "botocore";
-  version = "1.20.25"; # N.B: if you change this, change boto3 and awscli to a matching version
+  version = "1.20.27"; # N.B: if you change this, change boto3 and awscli to a matching version
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-uAtO/l+vsp8ko2V9H3eqFwUlyHa1/ZOE1eWFnQQFIG4=";
+    sha256 = "sha256-RHeAPwdkn02AsX0FSCDnoJuyyweS0N7MKBIQi8N1nEo=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/brother/default.nix b/pkgs/development/python-modules/brother/default.nix
index 3e86aac02f1f..e4f9d63bd6b1 100644
--- a/pkgs/development/python-modules/brother/default.nix
+++ b/pkgs/development/python-modules/brother/default.nix
@@ -1,25 +1,33 @@
-{ lib, buildPythonPackage, fetchFromGitHub, pythonOlder
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
 , pysnmp
-, asynctest, pytestcov, pytestrunner, pytest-asyncio, pytest-trio, pytest-tornasync }:
+, pytest-asyncio
+, pytest-error-for-skips
+, pytest-runner
+, pytest-tornasync
+, pytest-trio
+, pytestCheckHook
+, pythonOlder
+}:
 
 buildPythonPackage rec {
   pname = "brother";
-  version = "0.2.1";
+  version = "0.2.2";
   disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "bieniu";
     repo = pname;
     rev = version;
-    sha256 = "sha256-yOloGkOVhXcTt0PAjf3yWUItN1okO94DndRFsImiuz4=";
+    sha256 = "sha256-vIefcL3K3ZbAUxMFM7gbbTFdrnmufWZHcq4OA19SYXE=";
   };
 
-  # pytest-error-for-skips is not packaged
   postPatch = ''
     substituteInPlace pytest.ini \
-      --replace " --error-for-skips" ""
-    substituteInPlace setup.py \
-      --replace "\"pytest-error-for-skips\"" ""
+      --replace "--cov --cov-report term-missing " ""
+    substituteInPlace requirements-test.txt \
+      --replace "pytest-cov" ""
   '';
 
   propagatedBuildInputs = [
@@ -27,16 +35,18 @@ buildPythonPackage rec {
   ];
 
   checkInputs = [
-    asynctest
-    pytestcov
-    pytestrunner
     pytest-asyncio
-    pytest-trio
+    pytest-error-for-skips
+    pytest-runner
     pytest-tornasync
+    pytest-trio
+    pytestCheckHook
   ];
 
+  pythonImportsCheck = [ "brother" ];
+
   meta = with lib; {
-    description = "Python wrapper for getting data from Brother laser and inkjet printers via SNMP.";
+    description = "Python wrapper for getting data from Brother laser and inkjet printers via SNMP";
     homepage = "https://github.com/bieniu/brother";
     license = licenses.asl20;
     maintainers = with maintainers; [ hexa ];
diff --git a/pkgs/development/python-modules/pytest-error-for-skips/default.nix b/pkgs/development/python-modules/pytest-error-for-skips/default.nix
new file mode 100644
index 000000000000..60d3f16a1c97
--- /dev/null
+++ b/pkgs/development/python-modules/pytest-error-for-skips/default.nix
@@ -0,0 +1,31 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, pytest
+, pytestCheckHook
+}:
+
+buildPythonPackage rec {
+  pname = "pytest-error-for-skips";
+  version = "2.0.2";
+
+  src = fetchFromGitHub {
+    owner = "jankatins";
+    repo = pname;
+    rev = version;
+    sha256 = "04i4jd3bg4lgn2jfh0a0dzg3ml9b2bjv2ndia6b64w96r3r4p3qr";
+  };
+
+  buildInputs = [ pytest ];
+
+  checkInputs = [ pytestCheckHook ];
+
+  pythonImportsCheck = [ "pytest_error_for_skips" ];
+
+  meta = with lib; {
+    description = "Pytest plugin to treat skipped tests a test failures";
+    homepage = "https://github.com/jankatins/pytest-error-for-skips";
+    license = licenses.mit;
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/development/tools/lazygit/default.nix b/pkgs/development/tools/lazygit/default.nix
index f741ca3382a7..1d8e4115309e 100644
--- a/pkgs/development/tools/lazygit/default.nix
+++ b/pkgs/development/tools/lazygit/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "lazygit";
-  version = "0.26";
+  version = "0.26.1";
 
   src = fetchFromGitHub {
     owner = "jesseduffield";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-9CiXbMYb+EoxBrVFiPuWAlRJvYAq8hpxVDFcymk7Ud0=";
+    sha256 = "sha256-naTO5cckUfs32z7bm5jGGEuo8db11fnTnQdUDKK2W/I=";
   };
 
   vendorSha256 = null;
diff --git a/pkgs/development/tools/poetry2nix/poetry2nix/default.nix b/pkgs/development/tools/poetry2nix/poetry2nix/default.nix
index 3b622c20559e..62063ff09947 100644
--- a/pkgs/development/tools/poetry2nix/poetry2nix/default.nix
+++ b/pkgs/development/tools/poetry2nix/poetry2nix/default.nix
@@ -5,7 +5,7 @@
 }:
 let
   # Poetry2nix version
-  version = "1.16.0";
+  version = "1.16.1";
 
   inherit (poetryLib) isCompatible readTOML moduleName;
 
diff --git a/pkgs/development/tools/poetry2nix/poetry2nix/overrides.nix b/pkgs/development/tools/poetry2nix/poetry2nix/overrides.nix
index 2106708a28f6..88783e4f380f 100644
--- a/pkgs/development/tools/poetry2nix/poetry2nix/overrides.nix
+++ b/pkgs/development/tools/poetry2nix/poetry2nix/overrides.nix
@@ -250,6 +250,15 @@ self: super:
     }
   );
 
+  fiona = super.fiona.overridePythonAttrs (
+    old: {
+      buildInputs = (old.buildInputs or [ ]) ++ [ pkgs.gdal_2 ];
+      nativeBuildInputs = [
+        pkgs.gdal_2 # for gdal-config
+      ];
+    }
+  );
+
   gdal = super.gdal.overridePythonAttrs (
     old: {
       preBuild = (old.preBuild or "") + ''
@@ -266,6 +275,23 @@ self: super:
     }
   );
 
+  grpcio = super.grpcio.overridePythonAttrs (old: {
+    nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [ self.cython pkgs.pkg-config ];
+    buildInputs = (old.buildInputs or [ ]) ++ [ pkgs.c-ares pkgs.openssl pkgs.zlib ];
+
+    outputs = [ "out" "dev" ];
+
+    GRPC_BUILD_WITH_BORING_SSL_ASM = "";
+    GRPC_PYTHON_BUILD_SYSTEM_OPENSSL = 1;
+    GRPC_PYTHON_BUILD_SYSTEM_ZLIB = 1;
+    GRPC_PYTHON_BUILD_SYSTEM_CARES = 1;
+    DISABLE_LIBC_COMPATIBILITY = 1;
+  });
+
+  grpcio-tools = super.grpcio-tools.overridePythonAttrs (old: {
+    outputs = [ "out" "dev" ];
+  });
+
   h3 = super.h3.overridePythonAttrs (
     old: {
       preBuild = (old.preBuild or "") + ''
@@ -277,14 +303,34 @@ self: super:
 
   h5py = super.h5py.overridePythonAttrs (
     old:
-    if old.format != "wheel" then rec {
-      nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [ pkgs.pkg-config ];
-      buildInputs = (old.buildInputs or [ ]) ++ [ pkgs.hdf5 self.pkgconfig self.cython ];
-      configure_flags = "--hdf5=${pkgs.hdf5}";
-      postConfigure = ''
-        ${self.python.executable} setup.py configure ${configure_flags}
-      '';
-    } else old
+    if old.format != "wheel" then
+      (
+        let
+          mpi = pkgs.hdf5.mpi;
+          mpiSupport = pkgs.hdf5.mpiSupport;
+        in
+        {
+          nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [ pkgs.pkg-config ];
+          buildInputs =
+            (old.buildInputs or [ ])
+            ++ [ pkgs.hdf5 self.pkgconfig self.cython ]
+            ++ lib.optional mpiSupport mpi
+          ;
+          propagatedBuildInputs =
+            old.propagatedBuildInputs
+            ++ lib.optionals mpiSupport [ self.mpi4py self.openssh ]
+          ;
+          preBuild = if mpiSupport then "export CC=${mpi}/bin/mpicc" else "";
+          HDF5_DIR = "${pkgs.hdf5}";
+          HDF5_MPI = if mpiSupport then "ON" else "OFF";
+          # avoid strict pinning of numpy
+          postPatch = ''
+            substituteInPlace setup.py \
+              --replace "numpy ==" "numpy >="
+          '';
+          pythonImportsCheck = [ "h5py" ];
+        }
+      ) else old
   );
 
   horovod = super.horovod.overridePythonAttrs (
@@ -618,6 +664,12 @@ self: super:
     }
   );
 
+  munch = super.munch.overridePythonAttrs (
+    old: {
+      buildInputs = (old.buildInputs or [ ]) ++ [ self.pbr ];
+    }
+  );
+
   mysqlclient = super.mysqlclient.overridePythonAttrs (
     old: {
       buildInputs = (old.buildInputs or [ ]) ++ [ pkgs.libmysqlclient ];
@@ -939,6 +991,13 @@ self: super:
     }
   );
 
+  pygeos = super.pygeos.overridePythonAttrs (
+    old: {
+      buildInputs = (old.buildInputs or [ ]) ++ [ pkgs.geos ];
+      nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [ pkgs.geos ];
+    }
+  );
+
   pygobject = super.pygobject.overridePythonAttrs (
     old: {
       nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [ pkgs.pkg-config ];
@@ -1226,6 +1285,15 @@ self: super:
     propagatedBuildInputs = (old.propagatedBuildInputs or [ ]) ++ [ self.setuptools ];
   });
 
+  rtree = super.rtree.overridePythonAttrs (old: {
+    propagatedNativeBuildInputs = (old.propagatedNativeBuildInputs or [ ]) ++ [ pkgs.libspatialindex ];
+    postPatch = ''
+      substituteInPlace rtree/finder.py --replace \
+        "find_library('spatialindex_c')" \
+        "'${pkgs.libspatialindex}/lib/libspatialindex_c${pkgs.stdenv.hostPlatform.extensions.sharedLibrary}'"
+    '';
+  });
+
   scipy = super.scipy.overridePythonAttrs (
     old:
     if old.format != "wheel" then {
diff --git a/pkgs/servers/http/nginx/mainline.nix b/pkgs/servers/http/nginx/mainline.nix
index aad46be30b21..0c33ab431de0 100644
--- a/pkgs/servers/http/nginx/mainline.nix
+++ b/pkgs/servers/http/nginx/mainline.nix
@@ -1,6 +1,6 @@
 { callPackage, ... }@args:
 
 callPackage ./generic.nix args {
-  version = "1.19.7";
-  sha256 = "03mmfnkhayn8vm2yhs3ngvif6275c368ymx8wvhsbls11h1dvr3s";
+  version = "1.19.8";
+  sha256 = "01cb6hsaik1sfjihbrldmwrcn54gk4plfy350sl1b4rml6qik29h";
 }
diff --git a/pkgs/servers/sozu/default.nix b/pkgs/servers/sozu/default.nix
index 8d3e4e1388b2..057bce2e4b03 100644
--- a/pkgs/servers/sozu/default.nix
+++ b/pkgs/servers/sozu/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "sozu";
-  version = "0.11.50";
+  version = "0.11.56";
 
   src = fetchFromGitHub {
     owner = "sozu-proxy";
     repo = pname;
     rev = version;
-    sha256 = "1srg2b8vwc4vp07kg4fizqj1rbm9hvf6hj1mjdh6yvb9cpbw3jz7";
+    sha256 = "sha256-/XyBzhZCsX9sGk+iTFlDnblWfDCZdI4b9yfo4Z+Wp1U=";
   };
 
-  cargoSha256 = "5WOigCiQZQ5DaTd15vV8pUh8Xl3UIe9yLG1ptUtY+iA=";
+  cargoSha256 = "sha256-F5EjBWHBNaQipxCi9Kiz5UTPMU0DuRf15NIVVvhiRxY=";
 
   buildInputs =
     lib.optional stdenv.isDarwin darwin.apple_sdk.frameworks.Security;
diff --git a/pkgs/tools/admin/awscli/default.nix b/pkgs/tools/admin/awscli/default.nix
index c5e792d6bcd8..2a7d50ec6ffe 100644
--- a/pkgs/tools/admin/awscli/default.nix
+++ b/pkgs/tools/admin/awscli/default.nix
@@ -28,11 +28,11 @@ let
 in
 with py.pkgs; buildPythonApplication rec {
   pname = "awscli";
-  version = "1.19.25"; # N.B: if you change this, change botocore and boto3 to a matching version too
+  version = "1.19.27"; # N.B: if you change this, change botocore and boto3 to a matching version too
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-YL5MnlN+DODGgpi2qtpr6wwC0nuebl/VoBzXRk4l4R8=";
+    sha256 = "sha256-xScwrjQaqPqssuFTUrTrLVRIUnnFp1OkHAjAA1MpcJU=";
   };
 
   # https://github.com/aws/aws-cli/issues/4837
diff --git a/pkgs/tools/compression/lrzip/default.nix b/pkgs/tools/compression/lrzip/default.nix
index 78ce2d39f092..9f4f66521f66 100644
--- a/pkgs/tools/compression/lrzip/default.nix
+++ b/pkgs/tools/compression/lrzip/default.nix
@@ -1,12 +1,12 @@
 {lib, stdenv, fetchurl, zlib, lzo, bzip2, lz4, nasm, perl}:
 
 stdenv.mkDerivation rec {
-  version = "0.640";
+  version = "0.641";
   pname = "lrzip";
 
   src = fetchurl {
     url = "http://ck.kolivas.org/apps/lrzip/${pname}-${version}.tar.xz";
-    sha256 = "175466drfpz8rsfr0pzfn5rqrj3wmcmcs3i2sfmw366w2kbjm4j9";
+    sha256 = "0ziyanspd96dc3lp2qdcylc7aq8dhb511jhqrhxvlp502fjqjqrc";
   };
 
   buildInputs = [ zlib lzo bzip2 lz4 nasm perl ];
diff --git a/pkgs/tools/package-management/emplace/default.nix b/pkgs/tools/package-management/emplace/default.nix
index 5a8ca2d9a8a7..2d901103374f 100644
--- a/pkgs/tools/package-management/emplace/default.nix
+++ b/pkgs/tools/package-management/emplace/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "emplace";
-  version = "1.2.1";
+  version = "1.2.2";
 
   src = fetchFromGitHub {
     owner = "tversteeg";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-5t47QrYWbm8A4E1GhqZwME7rmSfU1SYVniRGSrcRpvk=";
+    sha256 = "sha256-68fOJlDuuVFqGHXojN/y0h8kcPwrg7F480UOr5zrjFg=";
   };
 
-  cargoSha256 = "sha256-/GFpjovPGEgkfJ53+wR8CBDXiQQPDCiIaRG2Ka71dhQ=";
+  cargoSha256 = "sha256-KZEtkD/6ygyvkeebdX70vB8n+B7JODWT2h63dUd5CoQ=";
 
   meta = with lib; {
     description = "Mirror installed software on multiple machines";
diff --git a/pkgs/tools/security/sudo/default.nix b/pkgs/tools/security/sudo/default.nix
index 0f969288a24a..cf4ccd9bcdfa 100644
--- a/pkgs/tools/security/sudo/default.nix
+++ b/pkgs/tools/security/sudo/default.nix
@@ -1,4 +1,11 @@
-{ lib, stdenv, fetchurl, coreutils, pam, groff, sssd, nixosTests
+{ lib
+, stdenv
+, fetchurl
+, coreutils
+, pam
+, groff
+, sssd
+, nixosTests
 , sendmailPath ? "/run/wrappers/bin/sendmail"
 , withInsults ? false
 , withSssd ? false
@@ -6,11 +13,11 @@
 
 stdenv.mkDerivation rec {
   pname = "sudo";
-  version = "1.9.5p2";
+  version = "1.9.6";
 
   src = fetchurl {
     url = "https://www.sudo.ws/dist/${pname}-${version}.tar.gz";
-    sha256 = "0y093z4f3822rc88g9asdch12nljdamp817vjxk04mca7ks2x7jk";
+    sha256 = "sha256-YslYBJLNLn3WJztc/hl1YPLFCKg2SdHOT2HI7gL/OlU=";
   };
 
   prePatch = ''
@@ -36,17 +43,17 @@ stdenv.mkDerivation rec {
   ];
 
   configureFlagsArray = [
-    "--with-passprompt=[sudo] password for %p: "  # intentional trailing space
+    "--with-passprompt=[sudo] password for %p: " # intentional trailing space
   ];
 
   postConfigure =
     ''
-    cat >> pathnames.h <<'EOF'
-      #undef _PATH_MV
-      #define _PATH_MV "${coreutils}/bin/mv"
-    EOF
-    makeFlags="install_uid=$(id -u) install_gid=$(id -g)"
-    installFlags="sudoers_uid=$(id -u) sudoers_gid=$(id -g) sysconfdir=$out/etc rundir=$TMPDIR/dummy vardir=$TMPDIR/dummy DESTDIR=/"
+      cat >> pathnames.h <<'EOF'
+        #undef _PATH_MV
+        #define _PATH_MV "${coreutils}/bin/mv"
+      EOF
+      makeFlags="install_uid=$(id -u) install_gid=$(id -g)"
+      installFlags="sudoers_uid=$(id -u) sudoers_gid=$(id -g) sysconfdir=$out/etc rundir=$TMPDIR/dummy vardir=$TMPDIR/dummy DESTDIR=/"
     '';
 
   nativeBuildInputs = [ groff ];
@@ -56,10 +63,9 @@ stdenv.mkDerivation rec {
 
   doCheck = false; # needs root
 
-  postInstall =
-    ''
-    rm -f $out/share/doc/sudo/ChangeLog
-    '';
+  postInstall = ''
+    rm $out/share/doc/sudo/ChangeLog
+  '';
 
   passthru.tests = { inherit (nixosTests) sudo; };
 
@@ -68,10 +74,10 @@ stdenv.mkDerivation rec {
 
     longDescription =
       ''
-      Sudo (su "do") allows a system administrator to delegate
-      authority to give certain users (or groups of users) the ability
-      to run some (or all) commands as root or another user while
-      providing an audit trail of the commands and their arguments.
+        Sudo (su "do") allows a system administrator to delegate
+        authority to give certain users (or groups of users) the ability
+        to run some (or all) commands as root or another user while
+        providing an audit trail of the commands and their arguments.
       '';
 
     homepage = "https://www.sudo.ws/";
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 9b3905ad59cd..7cbfb6a9016e 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -8347,6 +8347,8 @@ in
 
   swiften = callPackage ../development/libraries/swiften { };
 
+  squeekboard = callPackage ../applications/accessibility/squeekboard { };
+
   t = callPackage ../tools/misc/t { };
 
   tabnine = callPackage ../development/tools/tabnine { };
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 706fa235042a..273eb56aba02 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -6438,6 +6438,8 @@ in {
 
   pytest-env = callPackage ../development/python-modules/pytest-env { };
 
+  pytest-error-for-skips = callPackage ../development/python-modules/pytest-error-for-skips { };
+
   pytest-expect = callPackage ../development/python-modules/pytest-expect { };
 
   pytest-factoryboy = callPackage ../development/python-modules/pytest-factoryboy { };