diff --git a/nixos/modules/services/networking/cjdns.nix b/nixos/modules/services/networking/cjdns.nix
index f116d6392ea7..e9a0e5af1a47 100644
--- a/nixos/modules/services/networking/cjdns.nix
+++ b/nixos/modules/services/networking/cjdns.nix
@@ -245,7 +245,7 @@ in
         fi
 
         if [ -z "$CJDNS_ADMIN_PASSWORD" ]; then
-            echo "CJDNS_ADMIN_PASSWORD=$(tr -dc A-Za-z0-9 </dev/urandom | head -c 96)" \
+            echo "CJDNS_ADMIN_PASSWORD=$(tr -dc A-Za-z0-9 </dev/urandom | head -c 32)" \
                 >> /etc/cjdns.keys
         fi
       '';
diff --git a/nixos/tests/docker-tools.nix b/nixos/tests/docker-tools.nix
index dd287883c982..a0e81b613ce8 100644
--- a/nixos/tests/docker-tools.nix
+++ b/nixos/tests/docker-tools.nix
@@ -221,6 +221,21 @@ import ./make-test-python.nix ({ pkgs, ... }: {
         assert "FROM_CHILD=true" in env, "envvars from the child should be preserved"
         assert "LAST_LAYER=child" in env, "envvars from the child should take priority"
 
+    with subtest(
+        "Ensure inherited environment variables of layered images are correctly resolved"
+    ):
+        # Read environment variables as stored in image config
+        config = docker.succeed(
+            "tar -xOf ${examples.environmentVariablesLayered} manifest.json | ${pkgs.jq}/bin/jq -r .[].Config"
+        ).strip()
+        out = docker.succeed(
+            f"tar -xOf ${examples.environmentVariablesLayered} {config} | ${pkgs.jq}/bin/jq -r '.config.Env | .[]'"
+        )
+        env = out.splitlines()
+        assert (
+            sum(entry.startswith("LAST_LAYER") for entry in env) == 1
+        ), "envvars overridden by child should be unique"
+
     with subtest("Ensure image with only 2 layers can be loaded"):
         docker.succeed(
             "docker load --input='${examples.two-layered-image}'"
diff --git a/pkgs/applications/editors/neovim/neovim-qt.nix b/pkgs/applications/editors/neovim/neovim-qt.nix
index 505fd41f797c..d925ddd2a528 100644
--- a/pkgs/applications/editors/neovim/neovim-qt.nix
+++ b/pkgs/applications/editors/neovim/neovim-qt.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, mkDerivation, fetchFromGitHub, cmake, doxygen, makeWrapper
+{ lib, mkDerivation, fetchFromGitHub, cmake, doxygen, makeWrapper
 , msgpack, neovim, pythonPackages, qtbase }:
 
 mkDerivation rec {
diff --git a/pkgs/applications/editors/textadept/11/default.nix b/pkgs/applications/editors/textadept/11/default.nix
index ec310639c364..3050599ba580 100644
--- a/pkgs/applications/editors/textadept/11/default.nix
+++ b/pkgs/applications/editors/textadept/11/default.nix
@@ -1,20 +1,20 @@
-{ lib, stdenv, fetchhg, fetchFromGitHub, fetchurl, gtk2, glib, pkg-config, unzip, ncurses, zip }:
+{ lib, stdenv, fetchFromGitHub, fetchurl, gtk2, glib, pkg-config, unzip, ncurses, zip }:
 
 stdenv.mkDerivation rec {
-  version = "11.0_beta";
+  version = "11.1";
   pname = "textadept11";
 
-  nativeBuildInputs = [ pkg-config unzip ];
+  nativeBuildInputs = [ pkg-config unzip zip ];
   buildInputs = [
-    gtk2 ncurses glib zip
+    gtk2 ncurses glib
   ];
 
   src = fetchFromGitHub {
     name = "textadept11";
     owner = "orbitalquark";
     repo = "textadept";
-    rev = "8da5f6b4a13f14b9dd3cb9dc23ad4f7bf41e91c1";
-    sha256 = "0v11v3x8g6v696m3l1bm52zy2g9xzz7hlmn912sn30nhcag3raxs";
+    rev = "1df99d561dd2055a01efa9183bb9e1b2ad43babc";
+    sha256 = "0g4bh5dp391vi32aa796vszpbxyl2dm5231v9dwc8l9v0b2786qn";
   };
 
   preConfigure =
@@ -40,7 +40,9 @@ stdenv.mkDerivation rec {
   '';
 
   makeFlags = [
-    "PREFIX=$(out) WGET=true PIXMAPS_DIR=$(out)/share/pixmaps"
+    "PREFIX=$(out)"
+    "WGET=true"
+    "PIXMAPS_DIR=$(out)/share/pixmaps"
   ];
 
   meta = with lib; {
diff --git a/pkgs/applications/editors/textadept/11/deps.nix b/pkgs/applications/editors/textadept/11/deps.nix
index 2ab72574bbd0..b9c7e94ee3bc 100644
--- a/pkgs/applications/editors/textadept/11/deps.nix
+++ b/pkgs/applications/editors/textadept/11/deps.nix
@@ -3,13 +3,13 @@
       url = "https://www.scintilla.org/scintilla445.tgz";
       sha256 = "1v1kyxj7rv5rxadbg8gl8wh1jafpy7zj0wr6dcyxq9209dl6h8ag";
     };
-    "9e2ffa159299899c9345aea15c17ba1941953871.zip" = {
-      url = "https://github.com/orbitalquark/scinterm/archive/9e2ffa159299899c9345aea15c17ba1941953871.zip";
-      sha256 = "12h7prgp689w45p4scxd8vvsyw8fkv27g6gvgis55xr44daa6122";
+    "6a774158d8a3c7bc7ea120bc01cdb016fa351a7e.zip" = {
+      url = "https://github.com/orbitalquark/scinterm/archive/6a774158d8a3c7bc7ea120bc01cdb016fa351a7e.zip";
+      sha256 = "083xvpw14dxbyrv4i48q76bmr44hs637qv363n6ibfs8xv1kq7iv";
     };
-    "scintillua_4.4.5-1.zip" = {
-      url = "https://github.com/orbitalquark/scintillua/archive/scintillua_4.4.5-1.zip";
-      sha256 = "095wpbid2kvr5xgkhd5bd4sd7ljgk6gd9palrjkmdcwfgsf1lp04";
+    "scintillua_4.4.5-2.zip" = {
+      url = "https://github.com/orbitalquark/scintillua/archive/scintillua_4.4.5-2.zip";
+      sha256 = "1061y2gg78zb2mml8msyarxgdwbf7g8g2v08fr1qqsqi2pbb7mfc";
     };
     "lua-5.3.5.tar.gz" = {
       url = "http://www.lua.org/ftp/lua-5.3.5.tar.gz";
@@ -19,17 +19,17 @@
       url = "http://www.inf.puc-rio.br/~roberto/lpeg/lpeg-1.0.2.tar.gz";
       sha256 = "1zjzl7acvcdavmcg5l7wi12jd4rh95q9pl5aiww7hv0v0mv6bmj8";
     };
-    "v1_7_0_2.zip" = {
-      url = "https://github.com/keplerproject/luafilesystem/archive/v1_7_0_2.zip";
-      sha256 = "0y44ymc7higz5dd2w3c6ib7mwmpr6yvszcl7lm12nf8x3y4snx4i";
+    "v1_8_0.zip" = {
+      url = "https://github.com/keplerproject/luafilesystem/archive/v1_8_0.zip";
+      sha256 = "12p1p5qpdql44y3cc035h8rs8rgdqp6nrnrixlp5544agb5bx9p3";
     };
     "64587546482a1a6324706d75c80b77d2f87118a4.zip" = {
       url = "https://github.com/orbitalquark/gtdialog/archive/64587546482a1a6324706d75c80b77d2f87118a4.zip";
       sha256 = "10mglbnn8r1cakqn9h285pwfnh7kfa98v7j8qh83c24n66blyfh9";
     };
-    "cdk-5.0-20150928.tgz" = {
-      url = "http://invisible-mirror.net/archives/cdk/cdk-5.0-20150928.tgz";
-      sha256 = "0j74l874y33i26y5kjg3pf1vswyjif8k93pqhi0iqykpbxfsg382";
+    "cdk-5.0-20200923.tgz" = {
+      url = "http://invisible-mirror.net/archives/cdk/cdk-5.0-20200923.tgz";
+      sha256 = "1vdakz119a13d7p7w53hk56fdmbkhv6y9xvdapcfnbnbh3l5szq0";
     };
     "libtermkey-0.20.tar.gz" = {
       url = "http://www.leonerd.org.uk/code/libtermkey/libtermkey-0.20.tar.gz";
diff --git a/pkgs/applications/editors/vscode/update-vscode.sh b/pkgs/applications/editors/vscode/update-vscode.sh
index d1ae71cd11e2..68249c20d132 100755
--- a/pkgs/applications/editors/vscode/update-vscode.sh
+++ b/pkgs/applications/editors/vscode/update-vscode.sh
@@ -19,18 +19,18 @@ fi
 VSCODE_VER=$(curl --fail --silent https://api.github.com/repos/Microsoft/vscode/releases/latest | jq --raw-output .tag_name)
 sed -i "s/version = \".*\"/version = \"${VSCODE_VER}\"/" "$ROOT/vscode.nix"
 
-VSCODE_LINUX_URL="https://vscode-update.azurewebsites.net/${VSCODE_VER}/linux-x64/stable"
+VSCODE_LINUX_URL="https://update.code.visualstudio.com/${VSCODE_VER}/linux-x64/stable"
 VSCODE_LINUX_SHA256=$(nix-prefetch-url ${VSCODE_LINUX_URL})
 sed -i "s/x86_64-linux = \".\{52\}\"/x86_64-linux = \"${VSCODE_LINUX_SHA256}\"/" "$ROOT/vscode.nix"
 
-VSCODE_DARWIN_URL="https://vscode-update.azurewebsites.net/${VSCODE_VER}/darwin/stable"
+VSCODE_DARWIN_URL="https://update.code.visualstudio.com/${VSCODE_VER}/darwin/stable"
 VSCODE_DARWIN_SHA256=$(nix-prefetch-url ${VSCODE_DARWIN_URL})
 sed -i "s/x86_64-darwin = \".\{52\}\"/x86_64-darwin = \"${VSCODE_DARWIN_SHA256}\"/" "$ROOT/vscode.nix"
 
-VSCODE_LINUX_AARCH64_URL="https://vscode-update.azurewebsites.net/${VSCODE_VER}/linux-arm64/stable"
+VSCODE_LINUX_AARCH64_URL="https://update.code.visualstudio.com/${VSCODE_VER}/linux-arm64/stable"
 VSCODE_LINUX_AARCH64_SHA256=$(nix-prefetch-url ${VSCODE_LINUX_AARCH64_URL})
 sed -i "s/aarch64-linux = \".\{52\}\"/aarch64-linux = \"${VSCODE_LINUX_AARCH64_SHA256}\"/" "$ROOT/vscode.nix"
 
-VSCODE_LINUX_ARMV7L_URL="https://vscode-update.azurewebsites.net/${VSCODE_VER}/linux-armhf/stable"
+VSCODE_LINUX_ARMV7L_URL="https://update.code.visualstudio.com/${VSCODE_VER}/linux-armhf/stable"
 VSCODE_LINUX_ARMV7L_SHA256=$(nix-prefetch-url ${VSCODE_LINUX_ARMV7L_URL})
 sed -i "s/armv7l-linux = \".\{52\}\"/armv7l-linux = \"${VSCODE_LINUX_ARMV7L_SHA256}\"/" "$ROOT/vscode.nix"
diff --git a/pkgs/applications/misc/wtf/default.nix b/pkgs/applications/misc/wtf/default.nix
index 4a7b7ad63b75..962059600a4c 100644
--- a/pkgs/applications/misc/wtf/default.nix
+++ b/pkgs/applications/misc/wtf/default.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "wtf";
-  version = "0.35.0";
+  version = "0.36.0";
 
   src = fetchFromGitHub {
     owner = "wtfutil";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-xzMXbF0M7asZtyo8DmM5yyNoHKy0H6amRDhu6hjHgq4=";
+    sha256 = "sha256-JVHcunpS+2/0d7XaUZ95m9QpVHCG1Tq8LJ9KNURSRy8=";
    };
 
-  vendorSha256 = "sha256-6ij0NQMjDnZJhuqkUR7MdBLAMS5Xa2HKIgQjegKJyvc=";
+  vendorSha256 = "sha256-4uRhbRPfCRYwFlfucXOYhLruj7hkV4G9Sxjh9yQkDEQ=";
 
   doCheck = false;
 
diff --git a/pkgs/applications/networking/cluster/helm/wrapper.nix b/pkgs/applications/networking/cluster/helm/wrapper.nix
index edad7fa1bc99..21a29e31243b 100644
--- a/pkgs/applications/networking/cluster/helm/wrapper.nix
+++ b/pkgs/applications/networking/cluster/helm/wrapper.nix
@@ -1,6 +1,4 @@
-{ stdenv, symlinkJoin, lib, makeWrapper
-, writeText
-}:
+{ symlinkJoin, lib, makeWrapper, writeText }:
 
 helm:
 
diff --git a/pkgs/applications/networking/cluster/k3s/default.nix b/pkgs/applications/networking/cluster/k3s/default.nix
index 739992e6bc0b..7c79c4896bc0 100644
--- a/pkgs/applications/networking/cluster/k3s/default.nix
+++ b/pkgs/applications/networking/cluster/k3s/default.nix
@@ -19,6 +19,7 @@
 , fetchurl
 , fetchzip
 , fetchgit
+, zstd
 }:
 
 with lib;
@@ -43,9 +44,9 @@ with lib;
 # Those pieces of software we entirely ignore upstream's handling of, and just
 # make sure they're in the path if desired.
 let
-  k3sVersion = "1.19.4+k3s2";     # k3s git tag
+  k3sVersion = "1.20.4+k3s1";     # k3s git tag
   traefikChartVersion = "1.81.0"; # taken from ./scripts/download at the above k3s tag
-  k3sRootVersion = "0.7.1";       # taken from ./scripts/download at the above k3s tag
+  k3sRootVersion = "0.8.1";       # taken from ./scripts/download at the above k3s tag
   k3sCNIVersion = "0.8.6-k3s1";   # taken from ./scripts/version.sh at the above k3s tag
   # bundled into the k3s binary
   traefikChart = fetchurl {
@@ -64,7 +65,7 @@ let
   k3sRoot = fetchzip {
     # Note: marked as apache 2.0 license
     url = "https://github.com/k3s-io/k3s-root/releases/download/v${k3sRootVersion}/k3s-root-amd64.tar";
-    sha256 = "1wjg54816plbdwgv0dibq6dzmcakcmx0wiqijvr4f3gsxgk59zwf";
+    sha256 = "sha256-r3Nkzl9ccry7cgD3YWlHvEWOsWnnFGIkyRH9sx12gks=";
     stripRoot = false;
   };
   k3sPlugins = buildGoPackage rec {
@@ -95,7 +96,7 @@ let
     url = "https://github.com/k3s-io/k3s";
     rev = "v${k3sVersion}";
     leaveDotGit = true; # ./scripts/version.sh depends on git
-    sha256 = "1qxjdgnq8mf54760f0vngcqa2y3b048pcmfsf1g593b2ij1kg1zi";
+    sha256 = "0rmn3nh8a94axv6lb2xjnn3gpq0scnvj69bvcs74azvw62fvq016";
   };
   # Stage 1 of the k3s build:
   # Let's talk about how k3s is structured.
@@ -126,7 +127,12 @@ let
 
     src = k3sRepo;
 
-    patches = [ ./patches/0001-Use-rm-from-path-in-go-generate.patch ./patches/0002-Add-nixpkgs-patches.patch ];
+    # Patch build scripts so that we can use them.
+    # This makes things more dynamically linked (because nix can deal with
+    # dynamically linked dependencies just fine), removes the upload at the
+    # end, and skips building runc + cni, since we have our own derivations for
+    # those.
+    patches = [ ./patches/0002-Add-nixpkgs-patches.patch ];
 
     nativeBuildInputs = [ git pkg-config ];
     buildInputs = [ libseccomp ];
@@ -166,9 +172,10 @@ let
 
     src = k3sRepo;
 
-    patches = [ ./patches/0001-Use-rm-from-path-in-go-generate.patch ./patches/0002-Add-nixpkgs-patches.patch ];
+    # See the above comment in k3sBuildStage1
+    patches = [ ./patches/0002-Add-nixpkgs-patches.patch ];
 
-    nativeBuildInputs = [ git pkg-config ];
+    nativeBuildInputs = [ git pkg-config zstd ];
     # These dependencies are embedded as compressed files in k3s at runtime.
     # Propagate them to avoid broken runtime references to libraries.
     propagatedBuildInputs = [ k3sPlugins k3sBuildStage1 runc ];
@@ -255,10 +262,12 @@ stdenv.mkDerivation rec {
   # Use a wrapper script to reference all the binaries that k3s tries to
   # execute, but that we didn't bundle with it.
   installPhase = ''
+    runHook preInstall
     mkdir -p "$out/bin"
     makeWrapper ${k3sBin}/bin/k3s "$out/bin/k3s" \
       --prefix PATH : ${lib.makeBinPath k3sRuntimeDeps} \
       --prefix PATH : "$out/bin"
+    runHook postInstall
   '';
 
   meta = {
diff --git a/pkgs/applications/networking/cluster/k3s/patches/0001-Use-rm-from-path-in-go-generate.patch b/pkgs/applications/networking/cluster/k3s/patches/0001-Use-rm-from-path-in-go-generate.patch
deleted file mode 100644
index c439241e8558..000000000000
--- a/pkgs/applications/networking/cluster/k3s/patches/0001-Use-rm-from-path-in-go-generate.patch
+++ /dev/null
@@ -1,25 +0,0 @@
-From e79ddef65d08599ae3fe8ff39d202ea2416650b8 Mon Sep 17 00:00:00 2001
-From: Euan Kemp <euank@euank.com>
-Date: Sun, 31 May 2020 17:27:05 -0700
-Subject: [PATCH 1/2] Use 'rm' from path in go generate
-
-/bin/rm is less portable. On some distros, like nixos, it doesn't exist
-at all.
----
- main.go | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/main.go b/main.go
-index 62908bb7bb..0527222887 100644
---- a/main.go
-+++ b/main.go
-@@ -1,5 +1,5 @@
- //go:generate go run pkg/codegen/cleanup/main.go
--//go:generate /bin/rm -rf pkg/generated
-+//go:generate rm -rf pkg/generated
- //go:generate go run pkg/codegen/main.go
- //go:generate go fmt pkg/deploy/zz_generated_bindata.go
- //go:generate go fmt pkg/static/zz_generated_bindata.go
--- 
-2.25.4
-
diff --git a/pkgs/applications/networking/cluster/kubeconform/default.nix b/pkgs/applications/networking/cluster/kubeconform/default.nix
new file mode 100644
index 000000000000..ca5e30154da4
--- /dev/null
+++ b/pkgs/applications/networking/cluster/kubeconform/default.nix
@@ -0,0 +1,22 @@
+{ lib, buildGoModule, fetchFromGitHub }:
+
+buildGoModule rec {
+  pname = "kubeconform";
+  version = "0.4.6";
+
+  src = fetchFromGitHub {
+    owner = "yannh";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "sha256-lduHYYskEPUimEX54ymOyo5jY7GGBB42YTefDMNS4qo=";
+  };
+
+  vendorSha256 = null;
+
+  meta = with lib; {
+    description = "A FAST Kubernetes manifests validator, with support for Custom Resources!";
+    homepage    = "https://github.com/yannh/kubeconform/";
+    license     = licenses.asl20;
+    maintainers = [ maintainers.j4m3s ];
+  };
+}
diff --git a/pkgs/applications/networking/cluster/octant/default.nix b/pkgs/applications/networking/cluster/octant/default.nix
index 453c1406fd20..0e97b541a5dc 100644
--- a/pkgs/applications/networking/cluster/octant/default.nix
+++ b/pkgs/applications/networking/cluster/octant/default.nix
@@ -15,12 +15,12 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "octant";
-  version = "0.17.0";
+  version = "0.18.0";
 
   src = fetchsrc version {
-    x86_64-linux = "sha256-kYS8o97HBjNgwmrG4fjsqFWxZy6ATFOhxt6j3KMZbEc=";
-    aarch64-linux = "sha256-/Tpna2Y8+PQt+SeOJ9NDweRWGiQXU/sN+Wh/vLYQPwM=";
-    x86_64-darwin = "sha256-aOUmnD+l/Cc5qTiHxFLBjCatszmPdUc4YYZ6Oy5DT3U=";
+    x86_64-linux = "sha256-D/pHOXR7XQoJCGqUep1lBAY4239HH35m+evFd21pcK0=";
+    aarch64-linux = "sha256-aL1axz3ebqrKQ3xK2UgDMQ+o6ZKgIvwy6Phici7WT2c=";
+    x86_64-darwin = "sha256-MFxOAAEnLur0LJJNU0SSlO+bH4f18zOfZNA49fKEQEw=";
   };
 
   dontConfigure = true;
diff --git a/pkgs/applications/networking/mpop/default.nix b/pkgs/applications/networking/mpop/default.nix
index a488817a0cfe..613226a2dc18 100644
--- a/pkgs/applications/networking/mpop/default.nix
+++ b/pkgs/applications/networking/mpop/default.nix
@@ -4,11 +4,11 @@ with lib;
 
 stdenv.mkDerivation rec {
   pname = "mpop";
-  version = "1.4.12";
+  version = "1.4.13";
 
   src = fetchurl {
     url = "https://marlam.de/${pname}/releases/${pname}-${version}.tar.xz";
-    sha256 = "sha256-X2NVtS2cNgYZYjpAxmwaVXHjk7Q/5YN1wN41QprDSAo=";
+    sha256 = "sha256-s0mEZsZbZQrdGm55IJsnuoY3VnOkXJalknvtaFoyfcE=";
   };
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/applications/networking/sync/rsync/base.nix b/pkgs/applications/networking/sync/rsync/base.nix
index 7c7d3a1f418e..3479458088ed 100644
--- a/pkgs/applications/networking/sync/rsync/base.nix
+++ b/pkgs/applications/networking/sync/rsync/base.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl }:
+{ lib, fetchurl }:
 
 rec {
   version = "3.2.3";
diff --git a/pkgs/applications/networking/sync/rsync/default.nix b/pkgs/applications/networking/sync/rsync/default.nix
index c50ea08510af..a38352a328aa 100644
--- a/pkgs/applications/networking/sync/rsync/default.nix
+++ b/pkgs/applications/networking/sync/rsync/default.nix
@@ -15,7 +15,7 @@ assert enableXXHash -> xxHash != null;
 assert enableZstd -> zstd != null;
 
 let
-  base = import ./base.nix { inherit lib stdenv fetchurl; };
+  base = import ./base.nix { inherit lib fetchurl; };
 in
 stdenv.mkDerivation rec {
   name = "rsync-${base.version}";
diff --git a/pkgs/applications/networking/sync/rsync/rrsync.nix b/pkgs/applications/networking/sync/rsync/rrsync.nix
index 5a4c2600569e..83eb4658d2f3 100644
--- a/pkgs/applications/networking/sync/rsync/rrsync.nix
+++ b/pkgs/applications/networking/sync/rsync/rrsync.nix
@@ -1,7 +1,7 @@
 { lib, stdenv, fetchurl, perl, rsync }:
 
 let
-  base = import ./base.nix { inherit stdenv lib fetchurl; };
+  base = import ./base.nix { inherit lib fetchurl; };
 in
 stdenv.mkDerivation {
   name = "rrsync-${base.version}";
diff --git a/pkgs/applications/networking/umurmur/default.nix b/pkgs/applications/networking/umurmur/default.nix
index bf45db92098a..d1378598876d 100644
--- a/pkgs/applications/networking/umurmur/default.nix
+++ b/pkgs/applications/networking/umurmur/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "umurmur";
-  version = "0.2.19";
+  version = "0.2.20";
 
   src = fetchFromGitHub {
     owner = "umurmur";
     repo = "umurmur";
     rev = version;
-    sha256 = "sha256-86wveYlM493RIuU8aKac6XTOMPv0JxlZL4qH2N2AqRU=";
+    sha256 = "sha256-jp5+NbGmT90ksffvpLYIX2q5cPeVidDCYMPvLHCiP68=";
   };
 
   nativeBuildInputs = [ autoreconfHook ];
diff --git a/pkgs/applications/video/jellyfin-mpv-shim/default.nix b/pkgs/applications/video/jellyfin-mpv-shim/default.nix
index f90421cab914..3d080c00555b 100644
--- a/pkgs/applications/video/jellyfin-mpv-shim/default.nix
+++ b/pkgs/applications/video/jellyfin-mpv-shim/default.nix
@@ -20,11 +20,11 @@
 
 buildPythonApplication rec {
   pname = "jellyfin-mpv-shim";
-  version = "1.10.1";
+  version = "1.10.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-bcTCp2K1zRgobBAi7A62VPogM6km+DixRERWEOm9Yu4=";
+    sha256 = "sha256-ivNkVpC+uQfbcAyQZ0xIG1k1MLIgpkiqTMVnkoYlJyY=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/build-support/docker/stream_layered_image.py b/pkgs/build-support/docker/stream_layered_image.py
index 3e5781ba1c80..d7c63eb43a78 100644
--- a/pkgs/build-support/docker/stream_layered_image.py
+++ b/pkgs/build-support/docker/stream_layered_image.py
@@ -202,7 +202,9 @@ def overlay_base_config(from_image, final_config):
     # Preserve environment from base image
     final_env = base_config.get("Env", []) + final_config.get("Env", [])
     if final_env:
-        final_config["Env"] = final_env
+        # Resolve duplicates (last one wins) and format back as list
+        resolved_env = {entry.split("=", 1)[0]: entry for entry in final_env}
+        final_config["Env"] = list(resolved_env.values())
     return final_config
 
 
diff --git a/pkgs/data/fonts/spleen/default.nix b/pkgs/data/fonts/spleen/default.nix
index 726f60938bb2..4dea9253c02d 100644
--- a/pkgs/data/fonts/spleen/default.nix
+++ b/pkgs/data/fonts/spleen/default.nix
@@ -2,7 +2,7 @@
 
 let
   pname = "spleen";
-  version = "1.8.2";
+  version = "1.9.0";
 in fetchurl {
   name = "${pname}-${version}";
   url = "https://github.com/fcambus/spleen/releases/download/${version}/spleen-${version}.tar.gz";
@@ -19,7 +19,7 @@ in fetchurl {
     # create fonts.dir so NixOS xorg module adds to fp
     ${mkfontscale}/bin/mkfontdir "$d"
   '';
-  sha256 = "0195d8ssmd8hc0q941z6zwnccffxajv4vylypsndxf28f3ikawby";
+  sha256 = "sha256-hNPbYiU+v7kCYKVyOn+uc5cSlu9bWsC4CwFvfH6StWM=";
 
   meta = with lib; {
     description = "Monospaced bitmap fonts";
diff --git a/pkgs/data/fonts/vollkorn/default.nix b/pkgs/data/fonts/vollkorn/default.nix
new file mode 100644
index 000000000000..571a88b89e0d
--- /dev/null
+++ b/pkgs/data/fonts/vollkorn/default.nix
@@ -0,0 +1,29 @@
+{ lib, stdenv, fetchzip }:
+let
+  pname = "vollkorn";
+  version = "4.105";
+in
+fetchzip {
+  name = "${pname}-${version}";
+  url = "http://vollkorn-typeface.com/download/vollkorn-4-105.zip";
+  sha256 = "0srff2nqs7353mqcpmvaq156lamfh621py4h1771n0l9ix2c8mss";
+  stripRoot = false;
+
+  postFetch = ''
+    mkdir -pv $out/share/{doc/${pname}-${version},fonts/{opentype,truetype,WOFF,WOFF2}}
+    unzip $downloadedFile
+    cp -v {Fontlog,OFL-FAQ,OFL}.txt $out/share/doc/${pname}-${version}/
+    cp -v PS-OTF/*.otf $out/share/fonts/opentype
+    cp -v TTF/*.ttf $out/share/fonts/truetype
+    cp -v WOFF/*.woff $out/share/fonts/WOFF
+    cp -v WOFF2/*.woff2 $out/share/fonts/WOFF2
+  '';
+
+  meta = with lib; {
+    homepage = "http://vollkorn-typeface.com/";
+    description = "The free and healthy typeface for bread and butter use";
+    license = licenses.ofl;
+    platforms = platforms.all;
+    maintainers = [ maintainers.schmittlauch ];
+  };
+}
diff --git a/pkgs/development/compilers/gambit/build.nix b/pkgs/development/compilers/gambit/build.nix
index 84d51a2bc3f6..d67e0053bbac 100644
--- a/pkgs/development/compilers/gambit/build.nix
+++ b/pkgs/development/compilers/gambit/build.nix
@@ -63,11 +63,11 @@ gccStdenv.mkDerivation rec {
     lib.optional (!gccStdenv.isDarwin) "--enable-poll";
 
   configurePhase = ''
-    export CC=${gccStdenv.cc.targetPrefix}gcc \
-           CXX=${gccStdenv.cc.targetPrefix}g++ \
-           CPP=${gccStdenv.cc.targetPrefix}cpp \
-           CXXCPP=${gccStdenv.cc.targetPrefix}cpp \
-           LD=${gccStdenv.cc.targetPrefix}ld \
+    export CC=${gccStdenv.cc}/bin/${gccStdenv.cc.targetPrefix}gcc \
+           CXX=${gccStdenv.cc}/bin/${gccStdenv.cc.targetPrefix}g++ \
+           CPP=${gccStdenv.cc}/bin/${gccStdenv.cc.targetPrefix}cpp \
+           CXXCPP=${gccStdenv.cc}/bin/${gccStdenv.cc.targetPrefix}cpp \
+           LD=${gccStdenv.cc}/bin/${gccStdenv.cc.targetPrefix}ld \
            XMKMF=${coreutils}/bin/false
     unset CFLAGS LDFLAGS LIBS CPPFLAGS CXXFLAGS
 
diff --git a/pkgs/development/compilers/nim/default.nix b/pkgs/development/compilers/nim/default.nix
index 75b1a0f00203..676e35b06bb4 100644
--- a/pkgs/development/compilers/nim/default.nix
+++ b/pkgs/development/compilers/nim/default.nix
@@ -1,22 +1,10 @@
 # https://nim-lang.github.io/Nim/packaging.html
+# https://nim-lang.org/docs/nimc.html
 
-{ stdenv, lib, fetchurl, fetchgit, fetchFromGitHub, makeWrapper, gdb, openssl
-, pcre, readline, boehmgc, sqlite, nim-unwrapped, nimble-unwrapped }:
+{ lib, buildPackages, stdenv, fetchurl, fetchgit, fetchFromGitHub, makeWrapper
+, openssl, pcre, readline, boehmgc, sqlite, nim-unwrapped }:
 
 let
-  version = "1.4.4";
-  src = fetchurl {
-    url = "https://nim-lang.org/download/nim-${version}.tar.xz";
-    sha256 = "03k642nnjca0s6jlbn1v4jld51mbkix97jli4ky74gqlxyfp4wvd";
-  };
-
-  meta = with lib; {
-    description = "Statically typed, imperative programming language";
-    homepage = "https://nim-lang.org/";
-    license = licenses.mit;
-    maintainers = with maintainers; [ ehmry ];
-  };
-
   parseCpu = platform:
     with platform;
     # Derive a Nim CPU identifier
@@ -83,197 +71,251 @@ let
   nimHost = parsePlatform stdenv.hostPlatform;
   nimTarget = parsePlatform stdenv.targetPlatform;
 
-  wrapperInputs = rec {
+  bootstrapCompiler = stdenv.mkDerivation rec {
+    pname = "nim-bootstrap";
+    version = "0.20.0";
 
-    bootstrap = stdenv.mkDerivation rec {
-      pname = "nim-bootstrap";
-      version = "0.20.0";
-
-      src = fetchgit {
-        # A Git checkout is much smaller than a GitHub tarball.
-        url = "https://github.com/nim-lang/csources.git";
-        rev = "v" + version;
-        sha256 = "0i6vsfy1sgapx43n226q8m0pvn159sw2mhp50zm3hhb9zfijanis";
-      };
-
-      enableParallelBuilding = true;
-
-      installPhase = ''
-        runHook preInstall
-        install -Dt $out/bin bin/nim
-        runHook postInstall
-      '';
+    src = fetchgit {
+      # A Git checkout is much smaller than a GitHub tarball.
+      url = "https://github.com/nim-lang/csources.git";
+      rev = "v${version}";
+      sha256 = "0i6vsfy1sgapx43n226q8m0pvn159sw2mhp50zm3hhb9zfijanis";
     };
 
-    unwrapped = stdenv.mkDerivation {
-      pname = "nim-unwrapped";
-      inherit version src;
-
-      buildInputs = [ boehmgc openssl pcre readline sqlite ];
-
-      patches = [
-        ./NIM_CONFIG_DIR.patch
-        # Override compiler configuration via an environmental variable
-
-        ./nixbuild.patch
-        # Load libraries at runtime by absolute path
-      ];
-
-      configurePhase = ''
-        runHook preConfigure
-        cp ${bootstrap}/bin/nim bin/
-        echo 'define:nixbuild' >> config/nim.cfg
-        runHook postConfigure
-      '';
-
-      kochArgs = [
-        "--cpu:${nimHost.cpu}"
-        "--os:${nimHost.os}"
-        "-d:release"
-        "-d:useGnuReadline"
-      ] ++ lib.optional (stdenv.isDarwin || stdenv.isLinux)
-        "-d:nativeStacktrace";
-
-      buildPhase = ''
-        runHook preBuild
-        local HOME=$TMPDIR
-        ./bin/nim c koch
-        ./koch boot $kochArgs --parallelBuild:$NIX_BUILD_CORES
-        ./koch toolsNoExternal $kochArgs --parallelBuild:$NIX_BUILD_CORES
-        runHook postBuild
-      '';
-
-      installPhase = ''
-        runHook preInstall
-        install -Dt $out/bin bin/*
-        ln -sf $out/nim/bin/nim $out/bin/nim
-        ./install.sh $out
-        runHook postInstall
-      '';
-
-      inherit meta;
-    };
-
-    nimble-unwrapped = stdenv.mkDerivation rec {
-      pname = "nimble-unwrapped";
-      version = "0.13.1";
-
-      src = fetchFromGitHub {
-        owner = "nim-lang";
-        repo = "nimble";
-        rev = "v" + version;
-        sha256 = "1idb4r0kjbqv16r6bgmxlr13w2vgq5332hmnc8pjbxiyfwm075x8";
-      };
-
-      nativeBuildInputs = [ nim-unwrapped ];
-      buildInputs = [ openssl ];
-
-      nimFlags = [ "--cpu:${nimHost.cpu}" "--os:${nimHost.os}" "-d:release" ];
-
-      buildPhase = ''
-        runHook preBuild
-        HOME=$NIX_BUILD_TOP nim c $nimFlags src/nimble
-        runHook postBuild
-      '';
-
-      installPhase = ''
-        runHook preBuild
-        install -Dt $out/bin src/nimble
-        runHook postBuild
-      '';
-    };
+    enableParallelBuilding = true;
 
+    installPhase = ''
+      runHook preInstall
+      install -Dt $out/bin bin/nim
+      runHook postInstall
+    '';
   };
 
-  wrapped = let
-    nim' = nim-unwrapped;
-    nimble' = nimble-unwrapped;
+in {
+
+  nim-unwrapped = stdenv.mkDerivation rec {
+    pname = "nim-unwrapped";
+    version = "1.4.4";
+    strictDeps = true;
+
+    src = fetchurl {
+      url = "https://nim-lang.org/download/nim-${version}.tar.xz";
+      sha256 = "03k642nnjca0s6jlbn1v4jld51mbkix97jli4ky74gqlxyfp4wvd";
+    };
+
+    buildInputs = [ boehmgc openssl pcre readline sqlite ];
+
+    patches = [
+      ./NIM_CONFIG_DIR.patch
+      # Override compiler configuration via an environmental variable
+
+      ./nixbuild.patch
+      # Load libraries at runtime by absolute path
+    ];
+
+    configurePhase = ''
+      runHook preConfigure
+      cp ${bootstrapCompiler}/bin/nim bin/
+      echo 'define:nixbuild' >> config/nim.cfg
+      runHook postConfigure
+    '';
+
+    kochArgs = [
+      "--cpu:${nimHost.cpu}"
+      "--os:${nimHost.os}"
+      "-d:release"
+      "-d:useGnuReadline"
+    ] ++ lib.optional (stdenv.isDarwin || stdenv.isLinux) "-d:nativeStacktrace";
+
+    buildPhase = ''
+      runHook preBuild
+      local HOME=$TMPDIR
+      ./bin/nim c koch
+      ./koch boot $kochArgs --parallelBuild:$NIX_BUILD_CORES
+      ./koch toolsNoExternal $kochArgs --parallelBuild:$NIX_BUILD_CORES
+      runHook postBuild
+    '';
+
+    installPhase = ''
+      runHook preInstall
+      install -Dt $out/bin bin/*
+      ln -sf $out/nim/bin/nim $out/bin/nim
+      ./install.sh $out
+      runHook postInstall
+    '';
+
+    meta = with lib; {
+      description = "Statically typed, imperative programming language";
+      homepage = "https://nim-lang.org/";
+      license = licenses.mit;
+      maintainers = with maintainers; [ ehmry ];
+    };
+  };
+
+  nimble-unwrapped = stdenv.mkDerivation rec {
+    pname = "nimble-unwrapped";
+    version = "0.13.1";
+    strictDeps = true;
+
+    src = fetchFromGitHub {
+      owner = "nim-lang";
+      repo = "nimble";
+      rev = "v${version}";
+      sha256 = "1idb4r0kjbqv16r6bgmxlr13w2vgq5332hmnc8pjbxiyfwm075x8";
+    };
+
+    depsBuildBuild = [ nim-unwrapped ];
+    buildInputs = [ openssl ];
+
+    nimFlags = [ "--cpu:${nimHost.cpu}" "--os:${nimHost.os}" "-d:release" ];
+
+    buildPhase = ''
+      runHook preBuild
+      HOME=$NIX_BUILD_TOP nim c $nimFlags src/nimble
+      runHook postBuild
+    '';
+
+    installPhase = ''
+      runHook preBuild
+      install -Dt $out/bin src/nimble
+      runHook postBuild
+    '';
+  };
+
+  nim = let
+    nim' = buildPackages.nim-unwrapped;
+    nimble' = buildPackages.nimble-unwrapped;
     inherit (stdenv) targetPlatform;
   in stdenv.mkDerivation {
     name = "${targetPlatform.config}-nim-wrapper-${nim'.version}";
     inherit (nim') version;
     preferLocalBuild = true;
+    strictDeps = true;
 
     nativeBuildInputs = [ makeWrapper ];
 
+    patches = [
+      ./nim.cfg.patch
+      # Remove configurations that clash with ours
+    ];
+
     unpackPhase = ''
       runHook preUnpack
-      tar xf ${nim'.src} nim-$version/config/nim.cfg
+      tar xf ${nim'.src} nim-$version/config
       cd nim-$version
       runHook postUnpack
     '';
 
     dontConfigure = true;
 
-    wrapperArgs = [
-      "--prefix PATH : ${lib.makeBinPath [ stdenv.cc gdb ]}:${
-        placeholder "out"
-      }/bin"
-      "--prefix LD_LIBRARY_PATH : ${
-        lib.makeLibraryPath [ stdenv.cc.libc openssl ]
-      }"
-      "--set NIM_CONFIG_PATH ${placeholder "out"}/etc/nim"
-      ''--set NIX_HARDENING_ENABLE "''${NIX_HARDENING_ENABLE/fortify}"''
-      # Fortify hardening appends -O2 to gcc flags which is unwanted for unoptimized nim builds.
-    ];
-
-    buildPhase = with stdenv;
-      let
-        ccType = if cc.isGNU then
-          "gcc"
-        else if cc.isClang then
-          "clang"
-        else
-          abort "no Nim configuration available for ${cc.name}";
-      in ''
+    buildPhase =
+      # Configure the Nim compiler to use $CC and $CXX as backends
+      # The compiler is configured by two configuration files, each with
+      # a different DSL. The order of evaluation matters and that order
+      # is not documented, so duplicate the configuration across both files.
+      ''
         runHook preBuild
-        cat >> config/nim.cfg << EOF
+        cat >> config/config.nims << WTF
 
-        define:nixbuild
-        os = ${nimTarget.os}
-        cpu = ${nimTarget.cpu}
-        cc = ${ccType}
-        EOF
+        switch("os", "${nimTarget.os}")
+        switch("cpu", "${nimTarget.cpu}")
+        switch("define", "nixbuild")
 
-        mkdir -p $out/bin $out/etc/nim
-        export cc=$CC
-        export cxx=$CXX
-        substituteAll config/nim.cfg $out/etc/nim/nim.cfg \
-          --replace "cc = gcc" ""
+        # Configure the compiler using the $CC set by Nix at build time
+        import strutils
+        let cc = getEnv"CC"
+        if cc.contains("gcc"):
+          switch("cc", "gcc")
+        elif cc.contains("clang"):
+          switch("cc", "clang")
+        WTF
 
-        for binpath in ${nim'}/bin/nim?*; do
-          local binname=`basename $binpath`
-          makeWrapper \
-            $binpath $out/bin/${targetPlatform.config}-$binname \
-            $wrapperArgs
-          ln -s $out/bin/${targetPlatform.config}-$binname $out/bin/$binname
-        done
+        mv config/nim.cfg config/nim.cfg.old
+        cat > config/nim.cfg << WTF
+        os = "${nimTarget.os}"
+        cpu =  "${nimTarget.cpu}"
+        define:"nixbuild"
+        WTF
 
-        makeWrapper \
-          ${nim'}/nim/bin/nim $out/bin/${targetPlatform.config}-nim \
-          $wrapperArgs
-        ln -s $out/bin/${targetPlatform.config}-nim $out/bin/nim
+        cat >> config/nim.cfg < config/nim.cfg.old
+        rm config/nim.cfg.old
 
-        makeWrapper \
-          ${nim'}/bin/testament $out/bin/${targetPlatform.config}-testament \
-          $wrapperArgs
-        ln -s $out/bin/${targetPlatform.config}-testament $out/bin/testament
+        cat >> config/nim.cfg << WTF
 
-        makeWrapper \
-          ${nimble'}/bin/nimble $out/bin/${targetPlatform.config}-nimble \
-          --suffix PATH : $out/bin
-        ln -s $out/bin/${targetPlatform.config}-nimble $out/bin/nimble
+        clang.cpp.exe %= "\$CXX"
+        clang.cpp.linkerexe %= "\$CXX"
+        clang.exe %= "\$CC"
+        clang.linkerexe %= "\$CC"
+        gcc.cpp.exe %= "\$CXX"
+        gcc.cpp.linkerexe %= "\$CXX"
+        gcc.exe %= "\$CC"
+        gcc.linkerexe %= "\$CC"
+        WTF
 
         runHook postBuild
       '';
 
-    dontInstall = true;
+    wrapperArgs = [
+      "--prefix PATH : ${lib.makeBinPath [ buildPackages.gdb ]}:${
+        placeholder "out"
+      }/bin"
+      # Used by nim-gdb
 
-    meta = meta // {
+      "--prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ openssl pcre ]}"
+      # These libraries may be referred to by the standard library.
+      # This is broken for cross-compilation because the package
+      # set will be shifted back by nativeBuildInputs.
+
+      "--set NIM_CONFIG_PATH ${placeholder "out"}/etc/nim"
+      # Use the custom configuration
+
+      ''--set NIX_HARDENING_ENABLE "''${NIX_HARDENING_ENABLE/fortify}"''
+      # Fortify hardening appends -O2 to gcc flags which is unwanted for unoptimized nim builds.
+    ];
+
+    installPhase = ''
+      runHook preInstall
+
+      mkdir -p $out/bin $out/etc
+
+      cp -r config $out/etc/nim
+
+      for binpath in ${nim'}/bin/nim?*; do
+        local binname=`basename $binpath`
+        makeWrapper \
+          $binpath $out/bin/${targetPlatform.config}-$binname \
+          $wrapperArgs
+        ln -s $out/bin/${targetPlatform.config}-$binname $out/bin/$binname
+      done
+
+      makeWrapper \
+        ${nim'}/nim/bin/nim $out/bin/${targetPlatform.config}-nim \
+        $wrapperArgs
+      ln -s $out/bin/${targetPlatform.config}-nim $out/bin/nim
+
+      makeWrapper \
+        ${nim'}/bin/testament $out/bin/${targetPlatform.config}-testament \
+        $wrapperArgs
+      ln -s $out/bin/${targetPlatform.config}-testament $out/bin/testament
+
+      makeWrapper \
+        ${nimble'}/bin/nimble $out/bin/${targetPlatform.config}-nimble \
+        --suffix PATH : $out/bin
+      ln -s $out/bin/${targetPlatform.config}-nimble $out/bin/nimble
+
+      runHook postInstall
+    '';
+
+    passthru = {
+      nim = nim';
+      nimble = nimble';
+    };
+
+    meta = nim'.meta // {
       description = nim'.meta.description
         + " (${targetPlatform.config} wrapper)";
-      platforms = lib.platforms.unix;
+      platforms = with lib.platforms; unix ++ genode;
     };
   };
 
-in wrapped // wrapperInputs
+}
diff --git a/pkgs/development/compilers/nim/nim.cfg.patch b/pkgs/development/compilers/nim/nim.cfg.patch
new file mode 100644
index 000000000000..a95b672d1c1d
--- /dev/null
+++ b/pkgs/development/compilers/nim/nim.cfg.patch
@@ -0,0 +1,70 @@
+diff --git a/config/nim.cfg b/config/nim.cfg
+index a33a2f0a9..e069193ff 100644
+--- a/config/nim.cfg
++++ b/config/nim.cfg
+@@ -8,26 +8,12 @@
+ # Environment variables can be accessed like so:
+ #  gcc.path %= "$CC_PATH"
+ 
+-cc = gcc
+-
+ # additional options always passed to the compiler:
+ --parallel_build: "0" # 0 to auto-detect number of processors
+ 
+ hint[LineTooLong]=off
+ #hint[XDeclaredButNotUsed]=off
+ 
+-# Examples of how to setup a cross-compiler:
+-
+-# Cross-compiling for Raspberry Pi.
+-# (This compiler is available in gcc-arm-linux-gnueabihf package on Ubuntu)
+-arm.linux.gcc.exe = "arm-linux-gnueabihf-gcc"
+-arm.linux.gcc.linkerexe = "arm-linux-gnueabihf-gcc"
+-
+-# For OpenWRT, you will also need to adjust PATH to point to your toolchain.
+-mips.linux.gcc.exe = "mips-openwrt-linux-gcc"
+-mips.linux.gcc.linkerexe = "mips-openwrt-linux-gcc"
+-
+-
+ path="$lib/deprecated/core"
+ path="$lib/deprecated/pure"
+ path="$lib/pure/collections"
+@@ -111,7 +97,7 @@ path="$lib/pure"
+ @end
+ 
+ @if unix:
+-  @if not bsd or haiku:
++  @if not bsd or genode or haiku:
+     # -fopenmp
+     gcc.options.linker = "-ldl"
+     gcc.cpp.options.linker = "-ldl"
+@@ -295,29 +281,6 @@ vcc.cpp.options.size = "/O1"
+ # Configuration for the Tiny C Compiler:
+ tcc.options.always = "-w"
+ 
+-# Configuration for the Genode toolchain
+-@if genode:
+-  noCppExceptions # avoid std C++
+-  tlsEmulation:on # no TLS segment register magic
+-  @if i386 or amd64:
+-    gcc.exe = "genode-x86-gcc"
+-    gcc.cpp.exe = "genode-x86-g++"
+-    gcc.cpp.linkerexe = "genode-x86-ld"
+-  @elif arm:
+-    gcc.exe = "genode-arm-gcc"
+-    gcc.cpp.exe = "genode-arm-g++"
+-    gcc.cpp.linkerexe = "genode-arm-ld"
+-  @elif arm64:
+-    gcc.exe = "genode-aarch64-gcc"
+-    gcc.cpp.exe = "genode-aarch64-g++"
+-    gcc.cpp.linkerexe = "genode-aarch64-ld"
+-  @elif riscv64:
+-    gcc.exe = "genode-riscv-gcc"
+-    gcc.cpp.exe = "genode-riscv-g++"
+-    gcc.cpp.linkerexe = "genode-riscv-ld"
+-  @end
+-@end
+-
+ @if arm or arm64:
+   --define:nimEmulateOverflowChecks
+ @end
diff --git a/pkgs/development/coq-modules/fourcolor/default.nix b/pkgs/development/coq-modules/fourcolor/default.nix
new file mode 100644
index 000000000000..4de6e2da8b51
--- /dev/null
+++ b/pkgs/development/coq-modules/fourcolor/default.nix
@@ -0,0 +1,24 @@
+{ lib, mkCoqDerivation, coq, mathcomp, version ? null }:
+with lib;
+
+mkCoqDerivation {
+  pname = "fourcolor";
+  owner = "math-comp";
+
+  release."1.2.3".rev    = "v1.2.3";
+  release."1.2.3".sha256 = "sha256-gwKfUa74fIP7j+2eQgnLD7AswjCtOFGHGaIWb4qI0n4=";
+
+  inherit version;
+  defaultVersion = with versions; switch mathcomp.version [
+    { case = pred.inter (isGe "1.11.0") (isLt "1.13"); out = "1.2.3"; }
+  ] null;
+
+  propagatedBuildInputs = [ mathcomp.algebra ];
+
+  meta = {
+    description = "Formal proof of the Four Color Theorem ";
+    maintainers = with maintainers; [ siraben ];
+    license = licenses.cecill-b;
+    platforms = platforms.unix;
+  };
+}
diff --git a/pkgs/development/gnuradio-modules/ais/default.nix b/pkgs/development/gnuradio-modules/ais/default.nix
index 0770d83f21d9..5ff4ffd75653 100644
--- a/pkgs/development/gnuradio-modules/ais/default.nix
+++ b/pkgs/development/gnuradio-modules/ais/default.nix
@@ -1,5 +1,4 @@
 { lib
-, stdenv
 , mkDerivation
 , fetchFromGitHub
 , cmake
diff --git a/pkgs/development/libraries/allegro/5.nix b/pkgs/development/libraries/allegro/5.nix
index ca1446dd9352..314347411261 100644
--- a/pkgs/development/libraries/allegro/5.nix
+++ b/pkgs/development/libraries/allegro/5.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "allegro";
-  version = "5.2.6.0";
+  version = "5.2.7.0";
 
   src = fetchFromGitHub {
     owner = "liballeg";
     repo = "allegro5";
     rev = version;
-    sha256 = "1xbhvriyh10ka2j7jgjkpa6mlzp6av909hhr9sk317vjvf0z0mqz";
+    sha256 = "sha256-JdnzEW+qAhAljR+WfmgE3P9xeR2HvjS64tFgCC0tNA0=";
   };
 
   buildInputs = [
diff --git a/pkgs/development/ocaml-modules/eliom/default.nix b/pkgs/development/ocaml-modules/eliom/default.nix
index b8d90d0d2b74..92d89afe398d 100644
--- a/pkgs/development/ocaml-modules/eliom/default.nix
+++ b/pkgs/development/ocaml-modules/eliom/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchzip, which, ocsigen_server, ocaml,
+{ stdenv, lib, fetchzip, fetchpatch, which, ocsigen_server, ocaml,
   lwt_react,
   opaline, ppx_deriving, findlib
 , ocaml-migrate-parsetree
@@ -23,6 +23,14 @@ stdenv.mkDerivation rec
     sha256 = "00m6v2k4mg8705dy41934lznl6gj91i6dk7p1nkaccm51nna25kz";
   };
 
+  patches = [
+    # Compatibility with js_of_ocaml >= 3.9.0, remove at next release
+    (fetchpatch {
+      url = "https://github.com/ocsigen/eliom/commit/4106a4217956f7b74a8ef3f73a1e1f55e02ade45.patch";
+      sha256 = "1cgbvpljn9x6zxirxf3rdjrsdwy319ykz3qq03c36cc40hy2w13p";
+    })
+  ];
+
   buildInputs = [ ocaml which findlib js_of_ocaml-ocamlbuild
     ocaml-migrate-parsetree
     js_of_ocaml-ppx_deriving_json opaline
diff --git a/pkgs/development/ocaml-modules/ocaml-freestanding/configurable-binding.patch b/pkgs/development/ocaml-modules/ocaml-freestanding/configurable-binding.patch
new file mode 100644
index 000000000000..25a7b92f01fc
--- /dev/null
+++ b/pkgs/development/ocaml-modules/ocaml-freestanding/configurable-binding.patch
@@ -0,0 +1,49 @@
+commit b273c9f7ab10475787db4d6e09bd4b71b374d0ec
+Author: sternenseemann <0rpkxez4ksa01gb3typccl0i@systemli.org>
+Date:   Thu Mar 18 01:28:46 2021 +0100
+
+    Let user specify solo5-binding to use
+    
+    This is a little feature for the configure script I wanted to have for
+    the NixOS package: It allows the user to set PKG_CONFIG_DEPS before
+    running configure.sh to disable the autodetection mechanism. This is
+    useful for NixOS as we have all bindings bundled in the solo5 package,
+    so the result would also be solo5-bindings-xen. Additionally, it allows
+    us to do the binding selection declaratively and minimize the risk of
+    accidentally switching backend.
+    
+    PKG_CONFIG_DEPS seems like a bit of an unappropriate variable name for a
+    user “interface”, let me know if you want a dedicated environment
+    variable for this in case there will be more PKG_CONFIG_DEPS.
+
+diff --git a/configure.sh b/configure.sh
+index c254f7b..c675a02 100755
+--- a/configure.sh
++++ b/configure.sh
+@@ -11,13 +11,19 @@ if pkg_exists solo5-bindings-hvt solo5-bindings-spt solo5-bindings-virtio solo5-
+     echo "ERROR: Only one of solo5-bindings-hvt, solo5-bindings-spt, solo5-bindings-virtio, solo5-bindings-muen, solo5-bindings-genode, solo5-bindings-xen can be installed." 1>&2
+     exit 1
+ fi
+-PKG_CONFIG_DEPS=
+-pkg_exists solo5-bindings-hvt && PKG_CONFIG_DEPS=solo5-bindings-hvt
+-pkg_exists solo5-bindings-spt && PKG_CONFIG_DEPS=solo5-bindings-spt
+-pkg_exists solo5-bindings-muen && PKG_CONFIG_DEPS=solo5-bindings-muen
+-pkg_exists solo5-bindings-virtio && PKG_CONFIG_DEPS=solo5-bindings-virtio
+-pkg_exists solo5-bindings-genode && PKG_CONFIG_DEPS=solo5-bindings-genode
+-pkg_exists solo5-bindings-xen && PKG_CONFIG_DEPS=solo5-bindings-xen
++if [ -z "${PKG_CONFIG_DEPS}" ]; then
++    PKG_CONFIG_DEPS=
++    pkg_exists solo5-bindings-hvt && PKG_CONFIG_DEPS=solo5-bindings-hvt
++    pkg_exists solo5-bindings-spt && PKG_CONFIG_DEPS=solo5-bindings-spt
++    pkg_exists solo5-bindings-muen && PKG_CONFIG_DEPS=solo5-bindings-muen
++    pkg_exists solo5-bindings-virtio && PKG_CONFIG_DEPS=solo5-bindings-virtio
++    pkg_exists solo5-bindings-genode && PKG_CONFIG_DEPS=solo5-bindings-genode
++    pkg_exists solo5-bindings-xen && PKG_CONFIG_DEPS=solo5-bindings-xen
++else
++    pkg_exists "${PKG_CONFIG_DEPS}" \
++        || (echo "ERROR: ${PKG_CONFIG_DEPS} is not installed" 1>&2; exit 1) \
++        || exit 1
++fi
+ if [ -z "${PKG_CONFIG_DEPS}" ]; then
+     echo "ERROR: No supported Solo5 bindings package found." 1>&2
+     echo "ERROR: solo5-bindings-hvt, solo5-bindings-spt, solo5-bindings-virtio, solo5-bindings-muen, solo5-bindings-genode or solo5-bindings-xen must be installed." 1>&2
diff --git a/pkgs/development/ocaml-modules/ocaml-freestanding/default.nix b/pkgs/development/ocaml-modules/ocaml-freestanding/default.nix
new file mode 100644
index 000000000000..a777b7b22b93
--- /dev/null
+++ b/pkgs/development/ocaml-modules/ocaml-freestanding/default.nix
@@ -0,0 +1,87 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, ocaml
+, pkg-config
+, solo5
+, target ? "xen"
+}:
+
+# note: this is not technically an ocaml-module,
+# but can be built with different compilers, so
+# the ocamlPackages set is very useful.
+
+let
+  pname = "ocaml-freestanding";
+in
+
+if lib.versionOlder ocaml.version "4.08"
+then builtins.throw "${pname} is not available for OCaml ${ocaml.version}"
+else
+
+stdenv.mkDerivation rec {
+  name = "ocaml${ocaml.version}-${pname}-${version}";
+  inherit pname;
+  version = "0.6.4";
+
+  src = fetchFromGitHub {
+    owner = "mirage";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "0w3x2wfd04qr6mci4cp1gfqw33yysp8gamgkpgbgwslr0skryiq5";
+  };
+
+  postUnpack = ''
+    # get ocaml-src from the ocaml drv instead of via ocamlfind
+    mkdir -p "${src.name}/ocaml"
+    tar --strip-components=1 -xf ${ocaml.src} -C "${src.name}/ocaml"
+  '';
+
+  patches = [
+    ./no-opam.patch
+    ./configurable-binding.patch
+  ];
+
+  nativeBuildInputs = [
+    ocaml
+    pkg-config
+  ];
+
+  buildInputs = [ solo5 ];
+
+  configurePhase = ''
+    runHook preConfigure
+    env PKG_CONFIG_DEPS=solo5-bindings-${target} sh configure.sh
+    runHook postConfigure
+  '';
+
+  preBuild = ''
+    # perform substitutions, so opam isn't needed
+    for flags in flags/cflags.tmp flags/libs.tmp; do
+      substitute "$flags.in" "$flags" \
+        --replace "%{prefix}%" "$out" \
+        --replace "%{ocaml-freestanding:lib}%" "$out/lib"
+    done
+  '';
+
+  installPhase = ''
+    runHook preInstall
+    ./install.sh "$out"
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "Freestanding OCaml runtime";
+    license = licenses.mit;
+    maintainers = [ maintainers.sternenseemann ];
+    homepage = "https://github.com/mirage/ocaml-freestanding";
+    platforms = builtins.map ({ arch, os }: "${arch}-${os}")
+      (cartesianProductOfSets {
+          arch = [ "aarch64" "x86_64" ];
+          os = [ "linux" ];
+      } ++ [
+        { arch = "x86_64"; os = "freebsd"; }
+        { arch = "x86_64"; os = "openbsd"; }
+      ]);
+  };
+}
diff --git a/pkgs/development/ocaml-modules/ocaml-freestanding/no-opam.patch b/pkgs/development/ocaml-modules/ocaml-freestanding/no-opam.patch
new file mode 100644
index 000000000000..43141b1472a9
--- /dev/null
+++ b/pkgs/development/ocaml-modules/ocaml-freestanding/no-opam.patch
@@ -0,0 +1,84 @@
+commit 637b7ce639d54e617170433aa9596176b167d085
+Author: sternenseemann <0rpkxez4ksa01gb3typccl0i@systemli.org>
+Date:   Thu Mar 18 01:07:49 2021 +0100
+
+    Allow building without ocamlfind and opam
+    
+    This change is the result of my first go at packaging ocaml-freestanding
+    for NixOS. Our build infrastructure for ocaml there is completely
+    independent of opam at the moment, so depending on opam for the build
+    time is not an option, especially in this case where the information it
+    would give us would be garbage.
+    
+    Fortunately the build environment plays nicely with pkg-config which is
+    already heavily used by ocaml-freestanding. This patch leaves pkg-config
+    to its own devices if opam is not present (it can be assisted by a
+    manually set PKG_CONFIG_PATH environment variable).
+    
+    Additionally, in configure.sh we check if the target ocaml source
+    directory already exists. This allows for building ocaml-freestanding
+    without the ocaml-src package (which would be unnecessarily cumbersome
+    to package for NixOS) and ocamlfind (one less dependency is always a
+    nice bonus). The Makefile needs no fix since the target ocaml/Makefile
+    won't be built if it's already present.
+
+diff --git a/Makefile b/Makefile
+index b07b8c6..a68b31d 100644
+--- a/Makefile
++++ b/Makefile
+@@ -2,6 +2,12 @@
+ 
+ include Makeconf
+ 
++ifneq ($(shell command -v opam),)
++	# only set if opam is available and PKG_CONFIG_PATH isn't
++	# already set in the environment or on the command line
++	PKG_CONFIG_PATH ?= $(shell opam config var prefix)/lib/pkgconfig
++endif
++
+ FREESTANDING_LIBS=openlibm/libopenlibm.a \
+ 		  ocaml/runtime/libasmrun.a \
+ 		  nolibc/libnolibc.a
+@@ -73,8 +79,7 @@ flags/libs.tmp: flags/libs.tmp.in
+ 	opam config subst $@
+ 
+ flags/libs: flags/libs.tmp Makeconf
+-	env PKG_CONFIG_PATH="$(shell opam config var prefix)/lib/pkgconfig" \
+-	    pkg-config $(PKG_CONFIG_DEPS) --libs >> $<
++	pkg-config $(PKG_CONFIG_DEPS) --libs >> $<
+ 	awk -v RS= -- '{ \
+ 	    sub("@@PKG_CONFIG_EXTRA_LIBS@@", "$(PKG_CONFIG_EXTRA_LIBS)", $$0); \
+ 	    print "(", $$0, ")" \
+@@ -84,8 +89,7 @@ flags/cflags.tmp: flags/cflags.tmp.in
+ 	opam config subst $@
+ 
+ flags/cflags: flags/cflags.tmp Makeconf
+-	env PKG_CONFIG_PATH="$(shell opam config var prefix)/lib/pkgconfig" \
+-	    pkg-config $(PKG_CONFIG_DEPS) --cflags >> $<
++	pkg-config $(PKG_CONFIG_DEPS) --cflags >> $<
+ 	awk -v RS= -- '{ \
+ 	    print "(", $$0, ")" \
+ 	    }' $< >$@
+diff --git a/configure.sh b/configure.sh
+index 4d154ed..c254f7b 100755
+--- a/configure.sh
++++ b/configure.sh
+@@ -1,6 +1,8 @@
+ #!/bin/sh
+ 
+-export PKG_CONFIG_PATH=$(opam config var prefix)/lib/pkgconfig
++if command -v opam &> /dev/null; then
++    export PKG_CONFIG_PATH=$(opam config var prefix)/lib/pkgconfig
++fi
+ pkg_exists() {
+     pkg-config --exists "$@"
+ }
+@@ -21,7 +23,7 @@ if [ -z "${PKG_CONFIG_DEPS}" ]; then
+     echo "ERROR: solo5-bindings-hvt, solo5-bindings-spt, solo5-bindings-virtio, solo5-bindings-muen, solo5-bindings-genode or solo5-bindings-xen must be installed." 1>&2
+     exit 1
+ fi
+-ocamlfind query ocaml-src >/dev/null || exit 1
++[ -e "$(dirname "$0")/ocaml" ] || ocamlfind query ocaml-src >/dev/null || exit 1
+ 
+ FREESTANDING_CFLAGS="$(pkg-config --cflags ${PKG_CONFIG_DEPS})"
+ BUILD_ARCH="$(uname -m)"
diff --git a/pkgs/development/php-packages/php-cs-fixer/default.nix b/pkgs/development/php-packages/php-cs-fixer/default.nix
index 9f1ce65db0ae..c2e6a1292c7b 100644
--- a/pkgs/development/php-packages/php-cs-fixer/default.nix
+++ b/pkgs/development/php-packages/php-cs-fixer/default.nix
@@ -1,14 +1,14 @@
 { mkDerivation, fetchurl, makeWrapper, lib, php }:
 let
   pname = "php-cs-fixer";
-  version = "2.18.3";
+  version = "2.18.4";
 in
 mkDerivation {
   inherit pname version;
 
   src = fetchurl {
     url = "https://github.com/FriendsOfPHP/PHP-CS-Fixer/releases/download/v${version}/php-cs-fixer.phar";
-    sha256 = "sha256-Bdk1+X+SKcVS/zxEqlgnR3zjq/l0ht7icE4sQ1hjn8g=";
+    sha256 = "sha256-ZgnWv7Xd+0XgZ/IPdjVpAEraNNJq2KHB3aUUIG1SirU=";
   };
 
   phases = [ "installPhase" ];
diff --git a/pkgs/development/php-packages/phpstan/default.nix b/pkgs/development/php-packages/phpstan/default.nix
index 0e536d571325..902529806a3b 100644
--- a/pkgs/development/php-packages/phpstan/default.nix
+++ b/pkgs/development/php-packages/phpstan/default.nix
@@ -1,14 +1,14 @@
 { mkDerivation, fetchurl, makeWrapper, lib, php }:
 let
   pname = "phpstan";
-  version = "0.12.81";
+  version = "0.12.82";
 in
 mkDerivation {
   inherit pname version;
 
   src = fetchurl {
     url = "https://github.com/phpstan/phpstan/releases/download/${version}/phpstan.phar";
-    sha256 = "sha256-mdqVrTrxWE2AuLVqgumA7V+JjzGW9ukkFM7klJSLeDE=";
+    sha256 = "sha256-fX7YK4z6xUhSJ2jTCy7bRK13TxXSn/qo7E5DeZlv2Nw=";
   };
 
   phases = [ "installPhase" ];
diff --git a/pkgs/development/python-modules/adafruit-platformdetect/default.nix b/pkgs/development/python-modules/adafruit-platformdetect/default.nix
index 3879aed84dee..8f1b9d2ffce6 100644
--- a/pkgs/development/python-modules/adafruit-platformdetect/default.nix
+++ b/pkgs/development/python-modules/adafruit-platformdetect/default.nix
@@ -5,12 +5,13 @@
 }:
 
 buildPythonPackage rec {
-  pname = "Adafruit-PlatformDetect";
-  version = "3.4.0";
+  pname = "adafruit-platformdetect";
+  version = "3.4.1";
 
   src = fetchPypi {
-    inherit pname version;
-    sha256 = "sha256-+rZUIZA2P7NZ4jbJsenGlD0OZi5fXFQ/Y5vJo4bmvMo=";
+    pname = "Adafruit-PlatformDetect";
+    inherit version;
+    sha256 = "31275dcf949c8b00598aaf2b0da65d970a0cba28e7cb45691d5f354b8e82fe85";
   };
 
   nativeBuildInputs = [ setuptools-scm ];
diff --git a/pkgs/development/python-modules/apispec/default.nix b/pkgs/development/python-modules/apispec/default.nix
index ac6eb0957778..13fb71d7f2f2 100644
--- a/pkgs/development/python-modules/apispec/default.nix
+++ b/pkgs/development/python-modules/apispec/default.nix
@@ -11,11 +11,11 @@
 
 buildPythonPackage rec {
   pname = "apispec";
-  version = "4.2.0";
+  version = "4.3.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "fbbd069caa22c0270bc71a5330b46b5a4e1984d8345b9236ca02fbca23094647";
+    sha256 = "5ec0fe72f1422a1198973fcbb48d0eb5c7390f4b0fbe55474fce999ad6826a9b";
   };
 
   checkInputs = [
diff --git a/pkgs/development/python-modules/elementpath/default.nix b/pkgs/development/python-modules/elementpath/default.nix
index 745b7a7b105f..c98937804a31 100644
--- a/pkgs/development/python-modules/elementpath/default.nix
+++ b/pkgs/development/python-modules/elementpath/default.nix
@@ -1,7 +1,7 @@
 { lib, buildPythonPackage, fetchFromGitHub, isPy27 }:
 
 buildPythonPackage rec {
-  version = "2.2.0";
+  version = "2.2.1";
   pname = "elementpath";
   disabled = isPy27; # uses incompatible class syntax
 
@@ -9,7 +9,7 @@ buildPythonPackage rec {
     owner = "sissaschool";
     repo = "elementpath";
     rev = "v${version}";
-    sha256 = "1xfn5yasi849vs06ffxq6phapm6gc3p8yvdyvqmb47gbnji5mpb5";
+    sha256 = "15yjl18n81zddd27789mcy12gnja3cqycjdykybwgd9i0ysj96gl";
   };
 
   # avoid circular dependency with xmlschema which directly depends on this
diff --git a/pkgs/development/python-modules/executing/default.nix b/pkgs/development/python-modules/executing/default.nix
index 84026d7374c4..f0c67f3ae591 100644
--- a/pkgs/development/python-modules/executing/default.nix
+++ b/pkgs/development/python-modules/executing/default.nix
@@ -1,15 +1,27 @@
-{ lib, buildPythonPackage, fetchzip, pytest, asttokens }:
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, asttokens
+}:
 
 buildPythonPackage rec {
   pname = "executing";
-  version = "0.4.3";
+  version = "0.5.4";
 
-  src = fetchzip {
-    url = "https://github.com/alexmojaki/executing/archive/v${version}.tar.gz";
-    sha256 = "1fqfc26nl703nsx2flzf7x4mgr3rpbd8pnn9c195rca648zhi3nh";
+  src = fetchFromGitHub {
+    owner = "alexmojaki";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "1hqx94h6l2wg9sljiaajfay2nr62sqa819w3bxrz8cdki1abdygv";
   };
 
-  checkInputs = [ pytest asttokens ];
+  preBuild = ''
+    export SETUPTOOLS_SCM_PRETEND_VERSION="${version}"
+  '';
+
+  # Tests appear to run fine (Ran 22 tests in 4.076s) with setuptoolsCheckPhase
+  # but crash with pytestCheckHook
+  checkInputs = [ asttokens ];
 
   meta = with lib; {
     description = "Get information about what a frame is currently doing, particularly the AST node being executed";
diff --git a/pkgs/development/python-modules/fakeredis/default.nix b/pkgs/development/python-modules/fakeredis/default.nix
index 8513c168cfd6..b0cf3b546fd7 100644
--- a/pkgs/development/python-modules/fakeredis/default.nix
+++ b/pkgs/development/python-modules/fakeredis/default.nix
@@ -16,12 +16,12 @@
 
 buildPythonPackage rec {
   pname = "fakeredis";
-  version = "1.4.5";
+  version = "1.5.0";
   disabled = pythonOlder "3.5";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0slb23zxn47a4z8b7jq7gq40g4zsn52y9h29zdqs29b85394gjq1";
+    sha256 = "1ac0cef767c37f51718874a33afb5413e69d132988cb6a80c6e6dbeddf8c7623";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/google-cloud-speech/default.nix b/pkgs/development/python-modules/google-cloud-speech/default.nix
index 65ad31af2eb2..be9359350411 100644
--- a/pkgs/development/python-modules/google-cloud-speech/default.nix
+++ b/pkgs/development/python-modules/google-cloud-speech/default.nix
@@ -11,11 +11,11 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-speech";
-  version = "2.1.0";
+  version = "2.2.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "4a77a79e990004af96e789565b174f9b971f00afa23142f6673722dae0910b0c";
+    sha256 = "013279a411644545ee0d67a5c077d0f19db58b846d758f36a8cc759f9c9e0a19";
   };
 
   propagatedBuildInputs = [ libcst google-api-core proto-plus ];
diff --git a/pkgs/development/python-modules/urllib3/2.nix b/pkgs/development/python-modules/urllib3/2.nix
index b44993c71b26..a67ebd62f7e3 100644
--- a/pkgs/development/python-modules/urllib3/2.nix
+++ b/pkgs/development/python-modules/urllib3/2.nix
@@ -1,5 +1,4 @@
 { lib
-, stdenv
 , brotli
 , buildPythonPackage
 , certifi
diff --git a/pkgs/development/python-modules/urllib3/default.nix b/pkgs/development/python-modules/urllib3/default.nix
index 7ee5eefb5e1a..b7a3f81c723f 100644
--- a/pkgs/development/python-modules/urllib3/default.nix
+++ b/pkgs/development/python-modules/urllib3/default.nix
@@ -1,5 +1,4 @@
 { lib
-, stdenv
 , brotli
 , buildPythonPackage
 , cryptography
diff --git a/pkgs/development/tools/buildah/default.nix b/pkgs/development/tools/buildah/default.nix
index e5763e6aa918..4ca0343d8fa1 100644
--- a/pkgs/development/tools/buildah/default.nix
+++ b/pkgs/development/tools/buildah/default.nix
@@ -14,13 +14,13 @@
 
 buildGoModule rec {
   pname = "buildah";
-  version = "1.19.8";
+  version = "1.20.0";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = "buildah";
     rev = "v${version}";
-    sha256 = "sha256-xhnhc4vhKw5T93076vS+pszIOpj22KzaPyzCvuHMaPE=";
+    sha256 = "12gmn61mfrr58071x3cdsksad6swn1b23ghih128hjdpdzk1zxs3";
   };
 
   outputs = [ "out" "man" ];
diff --git a/pkgs/development/tools/misc/blackfire/php-probe.nix b/pkgs/development/tools/misc/blackfire/php-probe.nix
index 780b2a8906f7..e9bc52874018 100644
--- a/pkgs/development/tools/misc/blackfire/php-probe.nix
+++ b/pkgs/development/tools/misc/blackfire/php-probe.nix
@@ -18,11 +18,11 @@ let
   }.${lib.versions.majorMinor php.version} or (throw "Unsupported PHP version.");
 in stdenv.mkDerivation rec {
   pname = "php-blackfire";
-  version = "1.49.1";
+  version = "1.53.0";
 
   src = fetchurl {
     url = "https://packages.blackfire.io/debian/pool/any/main/b/blackfire-php/blackfire-php_${version}_amd64.deb";
-    sha256 = "5Z6CUj/HfSj+pC9iDEmU/OKCYePSAazU9q9M3glnOZU=";
+    sha256 = "ApKj5gulTCzWh7oSAM+JWQnWviHCnHV3OJHegpXJL54=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/tools/misc/nimlsp/default.nix b/pkgs/development/tools/misc/nimlsp/default.nix
index 1919e26ddec4..7f73fb9a1bc3 100644
--- a/pkgs/development/tools/misc/nimlsp/default.nix
+++ b/pkgs/development/tools/misc/nimlsp/default.nix
@@ -31,7 +31,7 @@ stdenv.mkDerivation rec {
     export HOME=$TMPDIR
     nim -d:release -p:${astpatternmatching}/src -p:${jsonschema}/src \
       c --threads:on -d:nimcore -d:nimsuggest -d:debugCommunication \
-      -d:debugLogging -d:explicitSourcePath=${srcOnly nim.unwrapped} -d:tempDir=/tmp src/nimlsp
+      -d:debugLogging -d:explicitSourcePath=${srcOnly nim.passthru.nim} -d:tempDir=/tmp src/nimlsp
   '';
 
   installPhase = ''
diff --git a/pkgs/development/tools/ocaml/js_of_ocaml/compiler.nix b/pkgs/development/tools/ocaml/js_of_ocaml/compiler.nix
index f1398c2f7c7d..12306d2a305a 100644
--- a/pkgs/development/tools/ocaml/js_of_ocaml/compiler.nix
+++ b/pkgs/development/tools/ocaml/js_of_ocaml/compiler.nix
@@ -1,16 +1,16 @@
 { lib, fetchurl, buildDunePackage
-, cmdliner, cppo, yojson, ppxlib
+, ocaml, cmdliner, cppo, yojson, ppxlib
 , menhir
 }:
 
 buildDunePackage rec {
   pname = "js_of_ocaml-compiler";
-  version = "3.8.0";
+  version = "3.9.1";
   useDune2 = true;
 
   src = fetchurl {
     url = "https://github.com/ocsigen/js_of_ocaml/releases/download/${version}/js_of_ocaml-${version}.tbz";
-    sha256 = "069jyiayxcgwnips3adxb3d53mzd4rrq2783b9fgmsiyzm545lcy";
+    sha256 = "0ib551kfsjlp9vr3fk36hrbq7xxyl8bj6vcn3ccr0s370bsmgpm6";
   };
 
   nativeBuildInputs = [ cppo menhir ];
diff --git a/pkgs/games/crispy-doom/default.nix b/pkgs/games/crispy-doom/default.nix
index 3d46de725c76..04c0868510fe 100644
--- a/pkgs/games/crispy-doom/default.nix
+++ b/pkgs/games/crispy-doom/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "crispy-doom";
-  version = "5.10.0";
+  version = "5.10.1";
 
   src = fetchFromGitHub {
     owner = "fabiangreffrath";
     repo = pname;
     rev = "${pname}-${version}";
-    sha256 = "sha256-hRdd5ZrcVBU7tn1juvrLdbenULzu6OsXefG0oLjjFIg=";
+    sha256 = "sha256-5doytVxemqaXWXiqDSQUEAe71xmY0pOLASj/NJNyM5g=";
   };
 
   postPatch = ''
diff --git a/pkgs/games/gimx/default.nix b/pkgs/games/gimx/default.nix
index 727945ff2b46..ab208dfa003c 100644
--- a/pkgs/games/gimx/default.nix
+++ b/pkgs/games/gimx/default.nix
@@ -5,8 +5,8 @@ let
   gimx-config = fetchFromGitHub {
     owner = "matlo";
     repo = "GIMX-configurations";
-    rev = "f31bba7d3be57519540be290cd69ba6a8dc4e4d4";
-    sha256 = "0wpxx2qxyiiblz2qrl5swg00ls1aq7i5vzlk0qlnqdq8ss8jssax";
+    rev = "c20300f24d32651d369e2b27614b62f4b856e4a0";
+    sha256 = "02wcjk8da188x7y0jf3p0arjdh9zbb0lla3fxdb28b1xyybfvx5p";
   };
 
 in stdenv.mkDerivation rec {
@@ -51,15 +51,15 @@ in stdenv.mkDerivation rec {
     mkdir -p $out/share
     cp -r ./loader/firmware $out/share/firmware
     cp -r ${gimx-config}/Linux $out/share/config
-    patch ${gimx-config}/Linux/Dualshock4.xml ${./ds4.patch} -o $out/share/DS4_noff.xml
+    patch ${gimx-config}/Linux/Dualshock4.xml ${./noff.patch} -o $out/share/ds4.xml
 
     makeWrapper $out/bin/gimx $out/bin/gimx-with-confs \
-      --set GIMXCONF $out/share
+      --set GIMXCONF $out/share/config
 
     makeWrapper $out/bin/gimx $out/bin/gimx-test-ds4 \
       --set GIMXCONF $out/share \
       --add-flags "--nograb" --add-flags "--curses" \
-      --add-flags "-p /dev/ttyUSB0" --add-flags "-c DS4_noff.xml"
+      --add-flags "-p /dev/ttyUSB0" --add-flags "-c ds4.xml"
   '';
 
   meta = with lib; {
diff --git a/pkgs/games/gimx/ds4.patch b/pkgs/games/gimx/noff.patch
similarity index 100%
rename from pkgs/games/gimx/ds4.patch
rename to pkgs/games/gimx/noff.patch
diff --git a/pkgs/misc/seafile-shared/default.nix b/pkgs/misc/seafile-shared/default.nix
index 21e2d4516cbe..15a129246e18 100644
--- a/pkgs/misc/seafile-shared/default.nix
+++ b/pkgs/misc/seafile-shared/default.nix
@@ -1,11 +1,7 @@
 { lib, stdenv
 , fetchFromGitHub
 , autoreconfHook
-, ccnet
 , curl
-, fuse
-, glib
-, intltool
 , libevent
 , libsearpc
 , libuuid
@@ -13,7 +9,6 @@
 , python3
 , sqlite
 , vala
-, which
 }:
 
 stdenv.mkDerivation rec {
diff --git a/pkgs/os-specific/solo5/default.nix b/pkgs/os-specific/solo5/default.nix
index baba0ecdf0ab..71584aff7760 100644
--- a/pkgs/os-specific/solo5/default.nix
+++ b/pkgs/os-specific/solo5/default.nix
@@ -1,6 +1,16 @@
 { lib, stdenv, fetchurl, pkg-config, libseccomp, util-linux, qemu }:
 
-let version = "0.6.8";
+let
+  version = "0.6.8";
+  # list of all theoretically available targets
+  targets = [
+    "genode"
+    "hvt"
+    "muen"
+    "spt"
+    "virtio"
+    "xen"
+  ];
 in stdenv.mkDerivation {
   pname = "solo5";
   inherit version;
@@ -29,21 +39,26 @@ in stdenv.mkDerivation {
     export DESTDIR=$out
     export PREFIX=$out
     make install-tools
-    ${lib.optionalString stdenv.hostPlatform.isLinux "make ${
-      (lib.concatMapStringsSep " " (x: "install-opam-${x}") [ "hvt" "spt" ])
-    }"}
+
+    # get CONFIG_* vars from Makeconf which also parse in sh
+    grep '^CONFIG_' Makeconf > nix_tmp_targetconf
+    source nix_tmp_targetconf
+    # install opam / pkg-config files for all enabled targets
+    ${lib.concatMapStrings (bind: ''
+      [ -n "$CONFIG_${lib.toUpper bind}" ] && make install-opam-${bind}
+    '') targets}
+
     runHook postInstall
   '';
 
-  doCheck = true;
+  doCheck = stdenv.hostPlatform.isLinux;
   checkInputs = [ util-linux qemu ];
-  checkPhase = if stdenv.hostPlatform.isLinux then
-    ''
+  checkPhase = ''
+    runHook preCheck
     patchShebangs tests
     ./tests/bats-core/bats ./tests/tests.bats
-    ''
-  else
-    null;
+    runHook postCheck
+  '';
 
   meta = with lib; {
     description = "Sandboxed execution environment";
diff --git a/pkgs/tools/X11/xkeysnail/default.nix b/pkgs/tools/X11/xkeysnail/default.nix
index fa52a714c7a7..2d66405904f6 100644
--- a/pkgs/tools/X11/xkeysnail/default.nix
+++ b/pkgs/tools/X11/xkeysnail/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchFromGitHub, makeWrapper, python3Packages }:
+{ lib, fetchFromGitHub, makeWrapper, python3Packages }:
 
 python3Packages.buildPythonApplication rec {
   pname = "xkeysnail";
diff --git a/pkgs/tools/audio/beets/default.nix b/pkgs/tools/audio/beets/default.nix
index a3eedf3ea47e..ef47578ac578 100644
--- a/pkgs/tools/audio/beets/default.nix
+++ b/pkgs/tools/audio/beets/default.nix
@@ -73,7 +73,7 @@ let
   };
 
   pluginsWithoutDeps = [
-    "bench" "bpd" "bpm" "bucket" "cue" "duplicates" "edit" "embedart"
+    "bareasc" "bench" "bpd" "bpm" "bucket" "duplicates" "edit" "embedart"
     "export" "filefilter" "fish" "freedesktop" "fromfilename" "ftintitle" "fuzzy"
     "hook" "ihate" "importadded" "importfeeds" "info" "inline" "ipfs"
     "mbcollection" "mbsubmit" "mbsync" "metasync" "missing" "parentwork" "permissions" "play"
@@ -105,13 +105,13 @@ in pythonPackages.buildPythonApplication rec {
   # unstable does not require bs1770gain[2].
   # [1]: https://discourse.beets.io/t/forming-a-beets-core-team/639
   # [2]: https://github.com/NixOS/nixpkgs/pull/90504
-  version = "unstable-2021-03-08";
+  version = "unstable-2021-03-24";
 
   src = fetchFromGitHub {
     owner = "beetbox";
     repo = "beets";
-    rev = "debd382837ef1d30574c2234710d536bb299f979";
-    sha256 = "sha256-I6ejW3f72fdzWoz7g4n8pDYz2NiHGrorLegUQhQOSiI=";
+    rev = "854b4ab48324afe8884fcd11fa47bd6258d2f4f7";
+    sha256 = "sha256-y5EWVNF4bd9fNvU6VkucMpenyFZuqdPkrqQDgG9ZPJY=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/tools/misc/remind/default.nix b/pkgs/tools/misc/remind/default.nix
index ef684aebe3cb..bbe96bf6c290 100644
--- a/pkgs/tools/misc/remind/default.nix
+++ b/pkgs/tools/misc/remind/default.nix
@@ -16,11 +16,11 @@ let
   '';
 in stdenv.mkDerivation rec {
   pname = "remind";
-  version = "03.03.01";
+  version = "03.03.05";
 
   src = fetchurl {
     url = "https://dianne.skoll.ca/projects/remind/download/remind-${version}.tar.gz";
-    sha256 = "0y4l960529sl3sn4r4g36qpy3jk5h1x4algjy7an7sfiqb8n98fi";
+    sha256 = "sha256-Ye0X2Gvek/pyaNVxGKL773OWJvC4I6F5nEsRQgzWbsE=";
   };
 
   nativeBuildInputs = optional tkremind makeWrapper;
diff --git a/pkgs/tools/networking/ccnet/default.nix b/pkgs/tools/networking/ccnet/default.nix
deleted file mode 100644
index 3293ebe25c83..000000000000
--- a/pkgs/tools/networking/ccnet/default.nix
+++ /dev/null
@@ -1,27 +0,0 @@
-{lib, stdenv, fetchurl, which, autoreconfHook, pkg-config, vala, python3, libsearpc, libzdb, libuuid, libevent, sqlite, openssl}:
-
-stdenv.mkDerivation rec {
-  version = "6.1.8";
-  seafileVersion = "6.1.8";
-  pname = "ccnet";
-
-  src = fetchurl {
-    url = "https://github.com/haiwen/ccnet/archive/v${version}.tar.gz";
-    sha256 = "0qlpnrz30ldrqnvbj59d54qdghxpxc5lsq6kf3dw2b93jnzkcmmm";
-  };
-
-  nativeBuildInputs = [ pkg-config which autoreconfHook vala python3 libsearpc ];
-  propagatedBuildInputs = [ libsearpc libzdb libuuid libevent sqlite openssl ];
-
-  configureFlags = [ "--enable-server" ];
-
-  strictDeps = true;
-
-  meta = with lib; {
-    homepage = "https://github.com/haiwen/ccnet";
-    description = "A framework for writing networked applications in C";
-    license = licenses.gpl3Plus;
-    platforms = platforms.linux;
-    maintainers = [ ];
-  };
-}
diff --git a/pkgs/tools/networking/s6-networking/default.nix b/pkgs/tools/networking/s6-networking/default.nix
index 3d72b61431a7..be19656f1c2d 100644
--- a/pkgs/tools/networking/s6-networking/default.nix
+++ b/pkgs/tools/networking/s6-networking/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, skawarePackages
+{ lib, skawarePackages
 
 # Whether to build the TLS/SSL tools and what library to use
 # acceptable values: "bearssl", "libressl", false
diff --git a/pkgs/tools/security/metasploit/Gemfile b/pkgs/tools/security/metasploit/Gemfile
index 8389f798bd52..7c2f230266e0 100644
--- a/pkgs/tools/security/metasploit/Gemfile
+++ b/pkgs/tools/security/metasploit/Gemfile
@@ -1,4 +1,4 @@
 # frozen_string_literal: true
 source "https://rubygems.org"
 
-gem "metasploit-framework", git: "https://github.com/rapid7/metasploit-framework", ref: "refs/tags/6.0.36"
+gem "metasploit-framework", git: "https://github.com/rapid7/metasploit-framework", ref: "refs/tags/6.0.37"
diff --git a/pkgs/tools/security/metasploit/Gemfile.lock b/pkgs/tools/security/metasploit/Gemfile.lock
index 4e00f206c41d..85d41fba9f95 100644
--- a/pkgs/tools/security/metasploit/Gemfile.lock
+++ b/pkgs/tools/security/metasploit/Gemfile.lock
@@ -1,9 +1,9 @@
 GIT
   remote: https://github.com/rapid7/metasploit-framework
-  revision: 49e599f499bd466af4d47d2d60a4dc80e158a52d
-  ref: refs/tags/6.0.36
+  revision: eae71004c4a1720d9af1513ca750cfe116d99a7b
+  ref: refs/tags/6.0.37
   specs:
-    metasploit-framework (6.0.36)
+    metasploit-framework (6.0.37)
       actionpack (~> 5.2.2)
       activerecord (~> 5.2.2)
       activesupport (~> 5.2.2)
@@ -30,9 +30,9 @@ GIT
       metasploit-concern
       metasploit-credential
       metasploit-model
-      metasploit-payloads (= 2.0.37)
+      metasploit-payloads (= 2.0.39)
       metasploit_data_models
-      metasploit_payloads-mettle (= 1.0.6)
+      metasploit_payloads-mettle (= 1.0.7)
       mqtt
       msgpack
       nessus_rest
@@ -123,22 +123,22 @@ GEM
     arel-helpers (2.12.0)
       activerecord (>= 3.1.0, < 7)
     aws-eventstream (1.1.1)
-    aws-partitions (1.434.0)
+    aws-partitions (1.435.0)
     aws-sdk-core (3.113.0)
       aws-eventstream (~> 1, >= 1.0.2)
       aws-partitions (~> 1, >= 1.239.0)
       aws-sigv4 (~> 1.1)
       jmespath (~> 1.0)
-    aws-sdk-ec2 (1.229.0)
+    aws-sdk-ec2 (1.230.0)
       aws-sdk-core (~> 3, >= 3.112.0)
       aws-sigv4 (~> 1.1)
-    aws-sdk-iam (1.50.0)
+    aws-sdk-iam (1.51.0)
       aws-sdk-core (~> 3, >= 3.112.0)
       aws-sigv4 (~> 1.1)
     aws-sdk-kms (1.43.0)
       aws-sdk-core (~> 3, >= 3.112.0)
       aws-sigv4 (~> 1.1)
-    aws-sdk-s3 (1.92.0)
+    aws-sdk-s3 (1.93.0)
       aws-sdk-core (~> 3, >= 3.112.0)
       aws-sdk-kms (~> 1)
       aws-sigv4 (~> 1.1)
@@ -212,7 +212,7 @@ GEM
       activemodel (~> 5.2.2)
       activesupport (~> 5.2.2)
       railties (~> 5.2.2)
-    metasploit-payloads (2.0.37)
+    metasploit-payloads (2.0.39)
     metasploit_data_models (4.1.2)
       activerecord (~> 5.2.2)
       activesupport (~> 5.2.2)
@@ -223,7 +223,7 @@ GEM
       railties (~> 5.2.2)
       recog (~> 2.0)
       webrick
-    metasploit_payloads-mettle (1.0.6)
+    metasploit_payloads-mettle (1.0.7)
     method_source (1.0.0)
     mini_portile2 (2.5.0)
     minitest (5.14.4)
@@ -323,7 +323,7 @@ GEM
       metasm
       rex-core
       rex-text
-    rex-socket (0.1.26)
+    rex-socket (0.1.29)
       rex-core
     rex-sslscan (0.1.6)
       rex-core
diff --git a/pkgs/tools/security/metasploit/default.nix b/pkgs/tools/security/metasploit/default.nix
index ed9180b67e62..4a3da7d7f3f1 100644
--- a/pkgs/tools/security/metasploit/default.nix
+++ b/pkgs/tools/security/metasploit/default.nix
@@ -8,13 +8,13 @@ let
   };
 in stdenv.mkDerivation rec {
   pname = "metasploit-framework";
-  version = "6.0.36";
+  version = "6.0.37";
 
   src = fetchFromGitHub {
     owner = "rapid7";
     repo = "metasploit-framework";
     rev = version;
-    sha256 = "sha256-c0OlZkTFgyfh4DVm93CRbFYPLeGTD/8QZo4p0luVbQ0=";
+    sha256 = "sha256-q6/1GW02C1z5nQwAKXU7xbVVviwXwS+XS7ZfNjJryiA=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/tools/security/metasploit/gemset.nix b/pkgs/tools/security/metasploit/gemset.nix
index d3f7efba9dfd..0be20b687690 100644
--- a/pkgs/tools/security/metasploit/gemset.nix
+++ b/pkgs/tools/security/metasploit/gemset.nix
@@ -114,10 +114,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1ia9b013blnwzz46hbnrqgkzf77vj60i93hbmf7a51jy2fvrcjl1";
+      sha256 = "13hy3xhff1cqlzv5hi3lz7vb11wh10m6221hq471d8m94chmmkjs";
       type = "gem";
     };
-    version = "1.434.0";
+    version = "1.435.0";
   };
   aws-sdk-core = {
     groups = ["default"];
@@ -134,20 +134,20 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0xi63wz30zch7wnimb2l1qi85a5gdrp8qb7jl5ildygswjbwqcvj";
+      sha256 = "1c7qqly2f94db3643xwjj9mcb34vilx11awbv40v2f8z7xisvvz3";
       type = "gem";
     };
-    version = "1.229.0";
+    version = "1.230.0";
   };
   aws-sdk-iam = {
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "046c7p26q63q33w9w5x4kgx75xq02v5g5isax2bp2hs05ix8wnql";
+      sha256 = "0x2768blsy8lpib9pi2f2d67flabar3bq6chmbj07iqzpwvpz569";
       type = "gem";
     };
-    version = "1.50.0";
+    version = "1.51.0";
   };
   aws-sdk-kms = {
     groups = ["default"];
@@ -164,10 +164,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1zs7sa7sh6zqkqlmjr9xjpjgcn9iqlpnilnj7vvlmh057f2mjhgy";
+      sha256 = "0iy2f9z43pc6fgwmga2cz8nf9gy2pwcw4jib141vp8z8dhylqj94";
       type = "gem";
     };
-    version = "1.92.0";
+    version = "1.93.0";
   };
   aws-sigv4 = {
     groups = ["default"];
@@ -514,12 +514,12 @@
     platforms = [];
     source = {
       fetchSubmodules = false;
-      rev = "49e599f499bd466af4d47d2d60a4dc80e158a52d";
-      sha256 = "03bdjmdx4acfcq8gy3wkw4nhymkcj5qgfrimw3hjg0y58ikaahvk";
+      rev = "eae71004c4a1720d9af1513ca750cfe116d99a7b";
+      sha256 = "086adcr3cpxn9fbjzh8p5jz5bdf57dsjj00ckpwmq2rndlczbbxb";
       type = "git";
       url = "https://github.com/rapid7/metasploit-framework";
     };
-    version = "6.0.36";
+    version = "6.0.37";
   };
   metasploit-model = {
     groups = ["default"];
@@ -536,10 +536,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1mf1c50j2gszxspnn9f2d356z8aaiv9s9x8lpdi05cf6syvhsa2k";
+      sha256 = "1ibvh45sbmzdn6gsd3dgj1a67mhgy6p3hvjbh9b2qb7ijc14gv49";
       type = "gem";
     };
-    version = "2.0.37";
+    version = "2.0.39";
   };
   metasploit_data_models = {
     groups = ["default"];
@@ -556,10 +556,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1mxhybic6myh993fs4jmp0hz998ryf362y0b33wqanff1n8aj75k";
+      sha256 = "1ivxz2wl9k0j7ba7xas0bfm44c1iczfvlgyxhsgqbpqkqwc374vg";
       type = "gem";
     };
-    version = "1.0.6";
+    version = "1.0.7";
   };
   method_source = {
     groups = ["default"];
@@ -1066,10 +1066,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0mgk44f55w2g536nkxbg62qq5cfr05qxldglfr3yf94qkkanl2gg";
+      sha256 = "0ar9vm8pwjz7c11kr3pjnxbgk68f2i5k1r9j3r34pfq9n26s79gr";
       type = "gem";
     };
-    version = "0.1.26";
+    version = "0.1.29";
   };
   rex-sslscan = {
     groups = ["default"];
diff --git a/pkgs/tools/system/gptfdisk/default.nix b/pkgs/tools/system/gptfdisk/default.nix
index b3b084fbe71c..bf6589eb66b2 100644
--- a/pkgs/tools/system/gptfdisk/default.nix
+++ b/pkgs/tools/system/gptfdisk/default.nix
@@ -1,14 +1,14 @@
-{ fetchurl, lib, stdenv, libuuid, popt, icu, ncurses }:
+{ fetchurl, lib, stdenv, libuuid, popt, icu, ncurses, nixosTests }:
 
 stdenv.mkDerivation rec {
   pname = "gptfdisk";
-  version = "1.0.6";
+  version = "1.0.7";
 
   src = fetchurl {
     # https://www.rodsbooks.com/gdisk/${name}.tar.gz also works, but the home
     # page clearly implies a preference for using SourceForge's bandwidth:
     url = "mirror://sourceforge/gptfdisk/${pname}-${version}.tar.gz";
-    sha256 = "sha256-3cVR1kOlPwvURANF064yxJsEp5fpwBA26kYLa7QWjKg=";
+    sha256 = "sha256-dUAEt/hbJ5KHx6w8BGmx1+Dq4EOpei5YewVgyl84KMA=";
   };
 
   postPatch = ''
@@ -37,10 +37,15 @@ stdenv.mkDerivation rec {
     done
   '';
 
+  passthru.tests = lib.optionalAttrs stdenv.hostPlatform.isx86 {
+    installer-simpleLabels = nixosTests.installer.simpleLabels;
+  };
+
   meta = with lib; {
     description = "Set of text-mode partitioning tools for Globally Unique Identifier (GUID) Partition Table (GPT) disks";
     license = licenses.gpl2;
     homepage = "https://www.rodsbooks.com/gdisk/";
     platforms = platforms.all;
+    maintainers = [ maintainers.ehmry ];
   };
 }
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 5fa99d5f9a88..442ccf15185d 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -92,6 +92,7 @@ mapAliases ({
   cargo-tree = throw "cargo-tree has been removed, use the builtin `cargo tree` command instead."; # added 2020-08-20
   casperjs = throw "casperjs has been removed, it was abandoned by upstream and broken.";
   catfish = xfce.catfish; # added 2019-12-22
+  ccnet = throw "ccnet has been removed because seafile does not depend on it anymore"; # added 2021-03-25
   cgmanager = throw "cgmanager was deprecated by lxc and therefore removed from nixpkgs."; # added 2020-06-05
   checkbashism = checkbashisms; # added 2016-08-16
   chronos = throw "chronos has been removed from nixpkgs, as it was unmaintained"; # added 2020-08-15
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index c2919f63a787..960b672c96ff 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -1938,8 +1938,6 @@ in
 
   cbor-diag = callPackage ../development/tools/cbor-diag { };
 
-  ccnet = callPackage ../tools/networking/ccnet { };
-
   cassowary = callPackage ../tools/networking/cassowary { };
 
   croc = callPackage ../tools/networking/croc { };
@@ -10904,9 +10902,8 @@ in
 
   muon = callPackage ../development/compilers/muon { };
 
-  nim = callPackage ../development/compilers/nim { };
-  nim-unwrapped = nim.unwrapped;
-  nimble-unwrapped = nim.nimble-unwrapped;
+  inherit (callPackages ../development/compilers/nim { })
+    nim-unwrapped nimble-unwrapped nim;
 
   nrpl = callPackage ../development/tools/nrpl { };
 
@@ -21462,6 +21459,8 @@ in
 
   vistafonts-chs = callPackage ../data/fonts/vista-fonts-chs { };
 
+  vollkorn = callPackage ../data/fonts/vollkorn { };
+
   weather-icons = callPackage ../data/fonts/weather-icons { };
 
   wireless-regdb = callPackage ../data/misc/wireless-regdb { };
@@ -23687,6 +23686,8 @@ in
 
   kubernix = callPackage ../applications/networking/cluster/kubernix { };
 
+  kubeconform = callPackage ../applications/networking/cluster/kubeconform { };
+
   kubectl = callPackage ../applications/networking/cluster/kubectl { };
 
   kubectl-doctor = callPackage ../applications/networking/cluster/kubectl-doctor { };
diff --git a/pkgs/top-level/coq-packages.nix b/pkgs/top-level/coq-packages.nix
index 1ded50ce7632..0da4fea8f422 100644
--- a/pkgs/top-level/coq-packages.nix
+++ b/pkgs/top-level/coq-packages.nix
@@ -33,6 +33,7 @@ let
       equations = callPackage ../development/coq-modules/equations { };
       fiat_HEAD = callPackage ../development/coq-modules/fiat/HEAD.nix {};
       flocq = callPackage ../development/coq-modules/flocq {};
+      fourcolor = callPackage ../development/coq-modules/fourcolor {};
       gappalib = callPackage ../development/coq-modules/gappalib {};
       heq = callPackage ../development/coq-modules/heq {};
       hierarchy-builder = callPackage ../development/coq-modules/hierarchy-builder {};
diff --git a/pkgs/top-level/ocaml-packages.nix b/pkgs/top-level/ocaml-packages.nix
index f319d678e132..14dddf0490fb 100644
--- a/pkgs/top-level/ocaml-packages.nix
+++ b/pkgs/top-level/ocaml-packages.nix
@@ -785,6 +785,8 @@ let
 
     ocamlfuse = callPackage ../development/ocaml-modules/ocamlfuse { };
 
+    ocaml-freestanding = callPackage ../development/ocaml-modules/ocaml-freestanding { };
+
     ocaml_gettext = callPackage ../development/ocaml-modules/ocaml-gettext { };
 
     gettext-stub = callPackage ../development/ocaml-modules/ocaml-gettext/stub.nix { };