diff --git a/nixos/modules/config/swap.nix b/nixos/modules/config/swap.nix
index d0fc0d4a3ea4..adb4e2294213 100644
--- a/nixos/modules/config/swap.nix
+++ b/nixos/modules/config/swap.nix
@@ -185,6 +185,8 @@ in
           { description = "Initialisation of swap device ${sw.device}";
             wantedBy = [ "${realDevice'}.swap" ];
             before = [ "${realDevice'}.swap" ];
+            # If swap is encrypted, depending on rngd resolves a possible entropy starvation during boot
+            after = mkIf (config.security.rngd.enable && sw.randomEncryption.enable) [ "rngd.service" ];
             path = [ pkgs.utillinux ] ++ optional sw.randomEncryption.enable pkgs.cryptsetup;
 
             script =
diff --git a/nixos/modules/security/rngd.nix b/nixos/modules/security/rngd.nix
index d9d6d9c9f253..5566c53897dc 100644
--- a/nixos/modules/security/rngd.nix
+++ b/nixos/modules/security/rngd.nix
@@ -39,12 +39,15 @@ in
 
       description = "Hardware RNG Entropy Gatherer Daemon";
 
+      # rngd may have to start early to avoid entropy starvation during boot with encrypted swap
+      unitConfig.DefaultDependencies = false;
       serviceConfig = {
         ExecStart = "${pkgs.rng-tools}/sbin/rngd -f"
           + optionalString cfg.debug " -d";
+        # PrivateTmp would introduce a circular dependency if /tmp is on tmpfs and swap is encrypted,
+        # thus depending on rngd before swap, while swap depends on rngd to avoid entropy starvation.
         NoNewPrivileges = true;
         PrivateNetwork = true;
-        PrivateTmp = true;
         ProtectSystem = "full";
         ProtectHome = true;
       };
diff --git a/pkgs/applications/audio/ncspot/default.nix b/pkgs/applications/audio/ncspot/default.nix
index 136f6fc1427d..5bf091adbdf9 100644
--- a/pkgs/applications/audio/ncspot/default.nix
+++ b/pkgs/applications/audio/ncspot/default.nix
@@ -12,16 +12,16 @@ let
 in
 rustPlatform.buildRustPackage rec {
   pname = "ncspot";
-  version = "0.1.1";
+  version = "0.1.2";
 
   src = fetchFromGitHub {
     owner = "hrkfdn";
     repo = "ncspot";
     rev = "v${version}";
-    sha256 = "0ldisr45w6ys1j62qv99ssqfg5q9dwrrzxh2maggyrx1zqdlsk6m";
+    sha256 = "10jp2yh8jlvdwh297658q9fi3i62vwsbd9fbwjsir7s1c9bgdy8k";
   };
 
-  cargoSha256 = "0k765hinqxfm30li1z66m1chsv69v6hiz109q2zlkxzg937qbnjh";
+  cargoSha256 = "1gw8wvms1ry2shvm3c79wp5nkpc39409af4qfm5hd4wgz2grh8d2";
 
   cargoBuildFlags = [ "--no-default-features" "--features" "${lib.concatStringsSep "," features}" ];
 
diff --git a/pkgs/applications/editors/android-studio/default.nix b/pkgs/applications/editors/android-studio/default.nix
index 60d00b7fbc7a..414e205b9a95 100644
--- a/pkgs/applications/editors/android-studio/default.nix
+++ b/pkgs/applications/editors/android-studio/default.nix
@@ -13,9 +13,9 @@ let
     sha256Hash = "1nsm4d3vdx90szqd78a8mjq65xc9m5ipd35cqrlx3c3ny900sqxg";
   };
   betaVersion = {
-    version = "3.6.0.19"; # "Android Studio 3.6 RC 2"
-    build = "192.6165589";
-    sha256Hash = "1d47nfhzb0apfzin4bg5bck4jjid3jipm5s4n36r7fh20lpx93z5";
+    version = "3.6.0.20"; # "Android Studio 3.6 RC 3"
+    build = "192.6186006";
+    sha256Hash = "153piq67yps5jwqrbciam4kpxziavml29d8ya5bi2rvfhipdd7da";
   };
   latestVersion = { # canary & dev
     version = "4.0.0.9"; # "Android Studio 4.0 Canary 9"
diff --git a/pkgs/applications/misc/hugo/default.nix b/pkgs/applications/misc/hugo/default.nix
index 6ab297c69700..18f7153b1eb9 100644
--- a/pkgs/applications/misc/hugo/default.nix
+++ b/pkgs/applications/misc/hugo/default.nix
@@ -2,7 +2,7 @@
 
 buildGoModule rec {
   pname = "hugo";
-  version = "0.64.0";
+  version = "0.64.1";
 
   goPackagePath = "github.com/gohugoio/hugo";
 
@@ -10,7 +10,7 @@ buildGoModule rec {
     owner = "gohugoio";
     repo = pname;
     rev = "v${version}";
-    sha256 = "10zbi2414c9grqhi9vcj3sczjh7hf20dihvcsirj551fmiqxrvpy";
+    sha256 = "1h5n5d7g3l2lp25sjrcmavbkqqm1csgv2q5z7afwbb57j0m1nkn8";
   };
 
   modSha256 = "18wfsp3ypfxj5qljmb19kzyc5byf413nkabz5mfvq8srjhcq1ifl";
diff --git a/pkgs/applications/misc/tipp10/default.nix b/pkgs/applications/misc/tipp10/default.nix
new file mode 100644
index 000000000000..8316fd918ab1
--- /dev/null
+++ b/pkgs/applications/misc/tipp10/default.nix
@@ -0,0 +1,25 @@
+{ cmake, stdenv, mkDerivation, fetchFromGitLab,
+  qtmultimedia, qttools, ... }:
+
+mkDerivation rec {
+  pname = "tipp10";
+  version = "3.1.0";
+
+  src = fetchFromGitLab {
+    owner = "a_a";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "1mksga1zyqz1y2s524nkw86irg36zpjwz7ff87n2ygrlysczvnx1";
+  };
+
+  nativeBuildInputs = [ cmake qttools ];
+  buildInputs = [ qtmultimedia ];
+
+  meta = with stdenv.lib; {
+    description = "Learn and train typing with the ten-finger system";
+    homepage = "https://gitlab.com/a_a/tipp10";
+    license = licenses.gpl2;
+    maintainers = with maintainers; [ petabyteboy ];
+    platforms = platforms.all;
+  };
+}
diff --git a/pkgs/applications/networking/cluster/kops/default.nix b/pkgs/applications/networking/cluster/kops/default.nix
index e3b82152e6fa..595cfae2e697 100644
--- a/pkgs/applications/networking/cluster/kops/default.nix
+++ b/pkgs/applications/networking/cluster/kops/default.nix
@@ -67,7 +67,7 @@ in rec {
   };
 
   kops_1_15 = mkKops {
-    version = "1.15.1";
-    sha256 = "0iq2bqq6zv6sk2psar33c3smnz79rk5v623qx4kr5h47wnqvrfvj";
+    version = "1.15.2";
+    sha256 = "1sjfd7pfi81ccq1dkgkh9xx6y94bqzlp727pvyf7l01x3d14z2b3";
   };
 }
diff --git a/pkgs/applications/science/biology/delly/default.nix b/pkgs/applications/science/biology/delly/default.nix
index bfdf5a1bb17e..a6c45f8aa44e 100644
--- a/pkgs/applications/science/biology/delly/default.nix
+++ b/pkgs/applications/science/biology/delly/default.nix
@@ -1,16 +1,25 @@
-{ stdenv, fetchFromGitHub, htslib, zlib, bzip2, lzma, ncurses, boost }:
+{ stdenv, fetchpatch, fetchFromGitHub, htslib, zlib, bzip2, lzma, ncurses, boost }:
 
-stdenv.mkDerivation rec {
+let
+  htslibPatch = fetchpatch {
+    url = "https://github.com/dellytools/delly/commit/0e5c710b0c5ea790bb39699d4cbd49cf4fb86f14.diff";
+    sha256 = "09bz1qqvzhdzm99hf9zgrv80kq9jlr1m2mdvx96p2hk5lpnbdl7y";
+    excludes = [ "src/htslib" ];
+  };
+
+in stdenv.mkDerivation rec {
   pname = "delly";
-  version = "0.8.1";
+  version = "0.8.2";
 
   src = fetchFromGitHub {
       owner = "dellytools";
       repo = pname;
       rev = "v${version}";
-      sha256 = "18gm86j1g1k4z1cjv2m5v9rsl1xqs2w3dhwcsnzx2mhkrvmlc4i1";
+      sha256 = "14bkmixz7737xj192ww96s3a20zc7xs7r04db8avw3ggi3i1s1cs";
   };
 
+  patches = [ htslibPatch ];
+
   buildInputs = [ zlib htslib bzip2 lzma ncurses boost ];
 
   EBROOTHTSLIB = htslib;
diff --git a/pkgs/applications/version-management/git-repo/default.nix b/pkgs/applications/version-management/git-repo/default.nix
index dc4ee00b0033..6db612f46a2a 100644
--- a/pkgs/applications/version-management/git-repo/default.nix
+++ b/pkgs/applications/version-management/git-repo/default.nix
@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   pname = "git-repo";
-  version = "2.0";
+  version = "2.1.1";
 
   src = fetchFromGitHub {
     owner = "android";
     repo = "tools_repo";
     rev = "v${version}";
-    sha256 = "077fsg2mh47c7qvqwpivkw474rpnw5xs36j23rxj2k5m700bz3hq";
+    sha256 = "0p09yak0vrdg8apk76kbx5gy7z57mzis9702rbw8mfx9p0ag6fy7";
   };
 
   patches = [ ./import-ssl-module.patch ];
diff --git a/pkgs/build-support/rust/build-rust-crate/build-crate.nix b/pkgs/build-support/rust/build-rust-crate/build-crate.nix
index dec49d24f524..2dcca75e299b 100644
--- a/pkgs/build-support/rust/build-rust-crate/build-crate.nix
+++ b/pkgs/build-support/rust/build-rust-crate/build-crate.nix
@@ -11,6 +11,7 @@
     baseRustcOpts =
       [(if release then "-C opt-level=3" else "-C debuginfo=2")]
       ++ ["-C codegen-units=$NIX_BUILD_CORES"]
+      ++ ["--remap-path-prefix=$NIX_BUILD_TOP=/" ]
       ++ [(mkRustcDepArgs dependencies crateRenames)]
       ++ [crateFeatures]
       ++ extraRustcOpts
diff --git a/pkgs/data/fonts/spleen/default.nix b/pkgs/data/fonts/spleen/default.nix
index 3e843e30f5ee..42645fda664d 100644
--- a/pkgs/data/fonts/spleen/default.nix
+++ b/pkgs/data/fonts/spleen/default.nix
@@ -1,4 +1,4 @@
-{ lib, fetchurl, mkfontdir }:
+{ lib, fetchurl, mkfontscale }:
 
 let
   pname = "spleen";
@@ -11,14 +11,15 @@ in fetchurl {
   recursiveHash = true;
   postFetch = ''
     tar xvf $downloadedFile --strip=1
-    d="$out/share/fonts/X11/misc/spleen"
-    install -Dm644 *.{pcf.gz,psfu,bdf} -t $d
+    d="$out/share/fonts/misc"
+    install -D -m 644 *.{pcf,bdf,otf} -t "$d"
+    install -D -m 644 *.psfu -t "$out/share/consolefonts"
     install -m644 fonts.alias-spleen $d/fonts.alias
 
     # create fonts.dir so NixOS xorg module adds to fp
-    ${mkfontdir}/bin/mkfontdir $d
+    ${mkfontscale}/bin/mkfontdir "$d"
   '';
-  sha256 = "0h9gj7syn87hl5rhwckih92r228zac6b1dvh3034caml8ad3fyla";
+  sha256 = "0x1xiw4gyfkyvwqg0f47rl92zq76d0c6jfncdnq8m2wwpxz9697b";
 
   meta = with lib; {
     description = "Monospaced bitmap fonts";
diff --git a/pkgs/data/misc/spdx-license-list-data/default.nix b/pkgs/data/misc/spdx-license-list-data/default.nix
index 6be0ab73641e..1c68569a29aa 100644
--- a/pkgs/data/misc/spdx-license-list-data/default.nix
+++ b/pkgs/data/misc/spdx-license-list-data/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "spdx-license-list-data";
-  version = "3.7";
+  version = "3.8";
 
   src = fetchFromGitHub {
     owner = "spdx";
     repo = "license-list-data";
     rev = "v${version}";
-    sha256 = "1zll1d4apqh762iplzcm90v3yp3b36whc3vqx1vlmjgdrfss9jhn";
+    sha256 = "1pfy0vbs7sk7m670mclmlkpcanizdmgsm1qgwzrw28w3hxfq7gdb";
   };
 
   phases = [ "unpackPhase" "installPhase" ];
@@ -21,5 +21,6 @@ stdenv.mkDerivation rec {
     description = "Various data formats for the SPDX License List";
     homepage = "https://github.com/spdx/license-list-data";
     license = lib.licenses.cc0;
+    platforms = lib.platforms.all;
   };
 }
diff --git a/pkgs/desktops/gnome-3/extensions/gsconnect/default.nix b/pkgs/desktops/gnome-3/extensions/gsconnect/default.nix
index 08011ab5c722..26d7f157240e 100644
--- a/pkgs/desktops/gnome-3/extensions/gsconnect/default.nix
+++ b/pkgs/desktops/gnome-3/extensions/gsconnect/default.nix
@@ -49,6 +49,7 @@ stdenv.mkDerivation rec {
     "-Dopenssl_path=${openssl}/bin/openssl"
     "-Dsshadd_path=${openssh}/bin/ssh-add"
     "-Dsshkeygen_path=${openssh}/bin/ssh-keygen"
+    "-Dsession_bus_services_dir=${placeholder "out"}/share/dbus-1/services"
     "-Dpost_install=true"
   ];
 
diff --git a/pkgs/desktops/plasma-5/kwin/scripts/krohnkite.nix b/pkgs/desktops/plasma-5/kwin/scripts/krohnkite.nix
index c568aa8b8705..569ba1571f80 100644
--- a/pkgs/desktops/plasma-5/kwin/scripts/krohnkite.nix
+++ b/pkgs/desktops/plasma-5/kwin/scripts/krohnkite.nix
@@ -3,13 +3,13 @@
 
 mkDerivation rec {
   pname = "krohnkite";
-  version = "0.6";
+  version = "0.6.1";
 
   src = fetchFromGitHub {
     owner = "esjeon";
     repo = "krohnkite";
     rev = "v${version}";
-    sha256 = "0gib39vvnpdynyfqfrkzri67dhr4lf3zpk3njw4zzkz97c8k6psq";
+    sha256 = "1rjmpnd5fc5dmxwq9pr0l858185h4580fhicgaywx9l3nppam72a";
   };
 
   buildInputs = [
diff --git a/pkgs/development/compilers/glslang/default.nix b/pkgs/development/compilers/glslang/default.nix
index 161e57b54792..b9d6866cc432 100644
--- a/pkgs/development/compilers/glslang/default.nix
+++ b/pkgs/development/compilers/glslang/default.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "glslang";
-  version = "7.11.3214";
+  version = "8.13.3559";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "glslang";
     rev = version;
-    sha256 = "0dqjga0lcza006fhac26zp2plbq4gx8a6nsmrwkqlzji6lw1jins";
+    sha256 = "0waamlh2vqh1k40m169294xdlm0iqjkx2vis4qyxfki0r0cnsmnk";
   };
 
   # These get set at all-packages, keep onto them for child drvs
diff --git a/pkgs/development/compilers/purescript/psc-package/default.nix b/pkgs/development/compilers/purescript/psc-package/default.nix
index c2f8765a131c..908a8e943e78 100644
--- a/pkgs/development/compilers/purescript/psc-package/default.nix
+++ b/pkgs/development/compilers/purescript/psc-package/default.nix
@@ -4,13 +4,13 @@ with lib;
 
 mkDerivation rec {
   pname = "psc-package";
-  version = "0.6.0";
+  version = "0.6.2";
 
   src = fetchFromGitHub {
     owner = "purescript";
     repo = pname;
     rev = "v${version}";
-    sha256 = "165yax131rj1mdlqd28g6wcy1ps3k4w50z8gj9yc3nfs09dy0lab";
+    sha256 = "0536mijma61khldnpbdviq2vvpfzzz7w8bxr59mvr19i10njdq0y";
   };
 
   isLibrary = false;
diff --git a/pkgs/development/compilers/shaderc/default.nix b/pkgs/development/compilers/shaderc/default.nix
index 82cccc3befc3..e7308973d5c6 100644
--- a/pkgs/development/compilers/shaderc/default.nix
+++ b/pkgs/development/compilers/shaderc/default.nix
@@ -8,24 +8,24 @@ let
   glslang = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "glslang";
-    rev = "d3692c701b1265955221aa0d6ebc656bc4442b2a";
-    sha256 = "11cvwbzlpr4zrcmmyd9h0kbfhmhr6r696ydmn0yp1jrixby4bmji";
+    rev = "3ed344dd784ecbbc5855e613786f3a1238823e56";
+    sha256 = "00s2arfvw78d9k9fmangqlkvkmkpqzrin3g91vfab4wr8srb09dx";
   };
   spirv-tools = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "SPIRV-Tools";
-    rev = "08cc49ec59c3ff4d6bd4bb4f2097ede35e802158";
-    sha256 = "1xhgcppx02fp3nr7654mr3qrgy1fxlxdyl87jhmn3k9jf24gmmmz";
+    rev = "323a81fc5e30e43a04e5e22af4cba98ca2a161e6";
+    sha256 = "1kwyh95l02w3v1ra55c836wayzw8d0m14ab7wf0ynhhyp3k2p9hv";
   };
   spirv-headers = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "SPIRV-Headers";
-    rev = "8b911bd2ba37677037b38c9bd286c7c05701bcda";
-    sha256 = "0qdnj34bkagszyvci6ifpqd7iqvybhmqzvc9lvqnls44qg90aqh2";
+    rev = "204cd131c42b90d129073719f2766293ce35c081";
+    sha256 = "1gp0mlbfccqnalaix97jxsa5i337xyzyr55wgssapy56p0q04wv2";
   };
 in stdenv.mkDerivation rec {
   pname = "shaderc";
-  version = "2019.0";
+  version = "2019.1";
 
   outputs = [ "out" "lib" "bin" "dev" "static" ];
 
@@ -33,7 +33,7 @@ in stdenv.mkDerivation rec {
     owner = "google";
     repo = "shaderc";
     rev = "v${version}";
-    sha256 = "1l5mmyxhzsbp0a6y2d86i8jmf46c6bjgjkdgkr5l8hmhflmm7gi2";
+    sha256 = "0x514rpignnb4vvl7wmijfakqc59986knjw3dh1zx0ah42xa7x37";
   };
 
   patchPhase = ''
diff --git a/pkgs/development/libraries/gegl/4.0.nix b/pkgs/development/libraries/gegl/4.0.nix
index 45f2c96dffe5..639ad8d0e51a 100644
--- a/pkgs/development/libraries/gegl/4.0.nix
+++ b/pkgs/development/libraries/gegl/4.0.nix
@@ -29,6 +29,7 @@
 , luajit
 , openexr
 , OpenCL
+, suitesparse
 }:
 
 stdenv.mkDerivation rec {
@@ -76,6 +77,7 @@ stdenv.mkDerivation rec {
     gexiv2
     luajit
     openexr
+    suitesparse
   ] ++ stdenv.lib.optional stdenv.isDarwin OpenCL;
 
   # for gegl-4.0.pc
@@ -93,7 +95,6 @@ stdenv.mkDerivation rec {
     "-Dlibav=disabled"
     "-Dlibv4l=disabled"
     "-Dlibv4l2=disabled"
-    "-Dumfpack=disabled"
     # Disabled due to multiple vulnerabilities, see
     # https://github.com/NixOS/nixpkgs/pull/73586
     "-Djasper=disabled"
diff --git a/pkgs/development/libraries/tdlib/default.nix b/pkgs/development/libraries/tdlib/default.nix
index 96ae5c1ec9ad..5224744c6a2c 100644
--- a/pkgs/development/libraries/tdlib/default.nix
+++ b/pkgs/development/libraries/tdlib/default.nix
@@ -1,14 +1,14 @@
 { fetchFromGitHub, gperf, openssl, readline, zlib, cmake, stdenv }:
 
 stdenv.mkDerivation rec {
-  version = "1.5.0";
+  version = "1.6.0";
   pname = "tdlib";
 
   src = fetchFromGitHub {
     owner = "tdlib";
     repo = "td";
     rev = "v${version}";
-    sha256 = "1rqxdvzlryqln5jzj35cwz1fjwy4s8xq97p0wdnpzbfjpcalvrm5";
+    sha256 = "0zlzpl6fgszg18kwycyyyrnkm255dvc6fkq0b0y32m5wvwwl36cv";
   };
 
   buildInputs = [ gperf openssl readline zlib ];
diff --git a/pkgs/development/libraries/vulkan-headers/default.nix b/pkgs/development/libraries/vulkan-headers/default.nix
index 4ea8d69a498b..ee6e58fab287 100644
--- a/pkgs/development/libraries/vulkan-headers/default.nix
+++ b/pkgs/development/libraries/vulkan-headers/default.nix
@@ -1,7 +1,7 @@
 { stdenv, fetchFromGitHub, cmake }:
 stdenv.mkDerivation rec {
   pname = "vulkan-headers";
-  version = "1.1.114.0";
+  version = "1.2.131.1";
 
   nativeBuildInputs = [ cmake ];
 
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
     owner = "KhronosGroup";
     repo = "Vulkan-Headers";
     rev = "sdk-${version}";
-    sha256 = "0fdvh26nxibylh32lj8b62d9nf9j25xa0il9zg362wmr2zgm8gka";
+    sha256 = "1yf42c2cnhx1y4wkxsdl6g653xl2vvamhpkldz6jb4ca5wk03gxf";
   };
 
   meta = with stdenv.lib; {
diff --git a/pkgs/development/libraries/vulkan-loader/default.nix b/pkgs/development/libraries/vulkan-loader/default.nix
index 3cdf8f08651f..c12c3ca640ba 100644
--- a/pkgs/development/libraries/vulkan-loader/default.nix
+++ b/pkgs/development/libraries/vulkan-loader/default.nix
@@ -1,20 +1,15 @@
 { stdenv, fetchFromGitHub, cmake, python3, vulkan-headers, pkgconfig
 , xlibsWrapper, libxcb, libXrandr, libXext, wayland, addOpenGLRunpath }:
 
-let
-  version = "1.1.114.0";
-in
-
-assert version == vulkan-headers.version;
-stdenv.mkDerivation {
+stdenv.mkDerivation rec {
   pname = "vulkan-loader";
-  inherit version;
+  version = "1.2.131.2";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "Vulkan-Loader";
     rev = "sdk-${version}";
-    sha256 = "08nibkbjf3g32qyp5bpdvj7i0zdv5ds1n5y52z8pvyzkpiz7s6ww";
+    sha256 = "12n4mxc6db89258k8i47ql1zna7k94lkwv7lpxg39nm8ypa1ywrv";
   };
 
   nativeBuildInputs = [ pkgconfig ];
diff --git a/pkgs/development/python-modules/credstash/default.nix b/pkgs/development/python-modules/credstash/default.nix
index 495311c09724..585bc0106067 100644
--- a/pkgs/development/python-modules/credstash/default.nix
+++ b/pkgs/development/python-modules/credstash/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "credstash";
-  version = "1.16.1";
+  version = "1.16.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "019wviz3hx0pkh3mgqr3prg55njyhzvhjqcpndgrfmkykjkcj435";
+    sha256 = "1l3g76dm9csmx0z8s7zd75wfzw9dcyvrq0a81gfzwxk0c0w8c79r";
   };
 
   # The install phase puts an executable and a copy of the library it imports in
diff --git a/pkgs/development/python-modules/pysaml2/default.nix b/pkgs/development/python-modules/pysaml2/default.nix
index 81324920c431..b4552b264d5a 100644
--- a/pkgs/development/python-modules/pysaml2/default.nix
+++ b/pkgs/development/python-modules/pysaml2/default.nix
@@ -2,6 +2,7 @@
 , buildPythonPackage
 , isPy3k
 , fetchFromGitHub
+, fetchpatch
 , substituteAll
 , xmlsec
 , cryptography, defusedxml, future, pyopenssl, dateutil, pytz, requests, six
@@ -27,6 +28,12 @@ buildPythonPackage rec {
       src = ./hardcode-xmlsec1-path.patch;
       inherit xmlsec;
     })
+    # remove on next release
+    (fetchpatch {
+      name = "fix-test-dates.patch";
+      url = "https://github.com/IdentityPython/pysaml2/commit/1d97d2d26f63e42611558fdd0e439bb8a7496a27.patch";
+      sha256 = "0r6d6hkk6z9yw7aqnsnylii516ysmdsc8dghwmgnwvw6cm7l388p";
+    })
   ];
 
   propagatedBuildInputs = [ cryptography defusedxml future pyopenssl dateutil pytz requests six ];
diff --git a/pkgs/development/tools/grabserial/default.nix b/pkgs/development/tools/grabserial/default.nix
index 5e06e9f771d9..ce336241b65d 100644
--- a/pkgs/development/tools/grabserial/default.nix
+++ b/pkgs/development/tools/grabserial/default.nix
@@ -2,13 +2,13 @@
 
 pythonPackages.buildPythonApplication rec {
   pname = "grabserial";
-  version = "1.9.9";
+  version = "2.0.2";
 
   src = fetchFromGitHub {
     owner = "tbird20d";
     repo = "grabserial";
     rev = "v${version}";
-    sha256 = "0cwrajkh605gfhshrlpbc32gmx86a8kv3pq7cv713k60sgqrgpqx";
+    sha256 = "0ryk4w8q6zfmia71nwnk5b7xaxw0sf45dw9q50xp7k76i3k5f9f3";
   };
 
   propagatedBuildInputs = [ pythonPackages.pyserial ];
diff --git a/pkgs/development/tools/vulkan-validation-layers/default.nix b/pkgs/development/tools/vulkan-validation-layers/default.nix
index 36d018682df9..5d807d13a9ea 100644
--- a/pkgs/development/tools/vulkan-validation-layers/default.nix
+++ b/pkgs/development/tools/vulkan-validation-layers/default.nix
@@ -1,16 +1,16 @@
 { stdenv, fetchFromGitHub, cmake, writeText, python3
 , vulkan-headers, vulkan-loader, glslang
-, pkgconfig, xlibsWrapper, libxcb, libXrandr, wayland, spirv-headers }:
+, pkgconfig, xlibsWrapper, libxcb, libXrandr, wayland }:
 
 stdenv.mkDerivation rec {
   pname = "vulkan-validation-layers";
-  version = "1.1.114.0";
+  version = "1.2.131.2";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "Vulkan-ValidationLayers";
     rev = "sdk-${version}";
-    sha256 = "0f8dlrjw1nz2adhzi4sbvljys4h0dyiwafdihsdyrg3xncgffks4";
+    sha256 = "1sz0388cr018ldx6ziplvk4v3zbg44pww77kv6kv5wxl69plwfcn";
   };
 
   nativeBuildInputs = [ pkgconfig cmake python3  ];
diff --git a/pkgs/development/web/cypress/default.nix b/pkgs/development/web/cypress/default.nix
index 796060de0b0a..86f6b129accd 100644
--- a/pkgs/development/web/cypress/default.nix
+++ b/pkgs/development/web/cypress/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec{
   pname = "cypress";
-  version = "3.6.1";
+  version = "3.8.3";
 
   src = fetchzip {
     url = "https://cdn.cypress.io/desktop/${version}/linux-x64/cypress.zip";
-    sha256 = "0vlfmhsz7zkp3bjsgqmp9n716d5znicl42hm0m9hl7ndvgm9z9z0";
+    sha256 = "1ncq64s5y5dsx0lrz950vab2yzwihl2wd7yapp12305bjjsihj3z";
   };
 
   # don't remove runtime deps
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec{
     mkdir -p $out/bin/resources/app
     printf '{"version":"%b"}' $version > $out/bin/resources/app/package.json
     # Cypress now looks for binary_state.json in bin
-    echo '{"verified": true}' > $out/bin/binary_state.json
+    echo '{"verified": true}' > $out/binary_state.json
     ln -s $out/opt/cypress/Cypress $out/bin/Cypress
   '';
 
diff --git a/pkgs/misc/screensavers/xlockmore/default.nix b/pkgs/misc/screensavers/xlockmore/default.nix
index c43a8acf8850..f18099d3840e 100644
--- a/pkgs/misc/screensavers/xlockmore/default.nix
+++ b/pkgs/misc/screensavers/xlockmore/default.nix
@@ -2,11 +2,11 @@
 , libXdmcp, libXt }:
 
 stdenv.mkDerivation rec {
-  name = "xlockmore-5.61";
+  name = "xlockmore-5.62";
 
   src = fetchurl {
     url = "http://sillycycle.com/xlock/${name}.tar.xz";
-    sha256 = "012wsfcphahwwylyfk9c848nwj1v08hpnja2yfs0j8pnq7milnva";
+    sha256 = "0b05wgj4mpssy4hd7km5c48i454dfg45p11mfmsr7xjd2gnz5gqi";
     curlOpts = "--user-agent 'Mozilla/5.0'";
   };
 
diff --git a/pkgs/os-specific/linux/kernel/linux-4.19.nix b/pkgs/os-specific/linux/kernel/linux-4.19.nix
index f4c3ac52c9c7..a5ca2e24ac44 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.19.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.19.nix
@@ -3,7 +3,7 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "4.19.102";
+  version = "4.19.103";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "05g0gkwvlwfx1wlinnwm3ryq7fblmxjzhp12g6vx2jbvvn486bih";
+    sha256 = "0hxvqkjy63370sr9j4j0a1kzqwxxdn3i8i6wwc5c2gbzpmqlay5l";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-5.4.nix b/pkgs/os-specific/linux/kernel/linux-5.4.nix
index 883def31b7fb..69996e6c1efb 100644
--- a/pkgs/os-specific/linux/kernel/linux-5.4.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.4.nix
@@ -3,7 +3,7 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "5.4.18";
+  version = "5.4.19";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "12ad4fnxag16ar2afiljv4nnv15i4f493sz6m7i9qgjld7yz3scj";
+    sha256 = "1f3pzg8vai5qz19gy9gf3rxs2z4dsw78zjkkfnha8iiy2mqvk14m";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-5.5.nix b/pkgs/os-specific/linux/kernel/linux-5.5.nix
index 52d1f6abca56..87192ba3b92f 100644
--- a/pkgs/os-specific/linux/kernel/linux-5.5.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.5.nix
@@ -3,7 +3,7 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "5.5.2";
+  version = "5.5.3";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "17pr9v04g3lrar585l1zpnsmrivryqxwyfvjc3qp8wrkn21z7x94";
+    sha256 = "1cnaa64i72cfxmspi0lw6598rq8k42dq0jjz0j1n6x2cykf3xvrb";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/servers/radarr/default.nix b/pkgs/servers/radarr/default.nix
index 854f73be1871..61fee03a7a18 100644
--- a/pkgs/servers/radarr/default.nix
+++ b/pkgs/servers/radarr/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "radarr";
-  version = "0.2.0.1358";
+  version = "0.2.0.1450";
 
   src = fetchurl {
     url = "https://github.com/Radarr/Radarr/releases/download/v${version}/Radarr.develop.${version}.linux.tar.gz";
-    sha256 = "0lyd9gcrfdp7nc4myg22ardsig30lgkvma03zzdjrwvsngqclmv7";
+    sha256 = "1sknq6fifpmgzryr07dnriaw2x425v2zxdcqzm65viw5p5j9xh00";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/servers/trezord/default.nix b/pkgs/servers/trezord/default.nix
index 134d36258a56..e6427e5970fa 100644
--- a/pkgs/servers/trezord/default.nix
+++ b/pkgs/servers/trezord/default.nix
@@ -2,7 +2,7 @@
 
 buildGoPackage rec {
   pname = "trezord-go";
-  version = "2.0.27";
+  version = "2.0.28";
 
   goPackagePath = "github.com/trezor/trezord-go";
 
@@ -10,7 +10,7 @@ buildGoPackage rec {
     owner  = "trezor";
     repo   = "trezord-go";
     rev    = "v${version}";
-    sha256 = "00d90qmmk1pays78a2jm8gb7dncvlsjjn4033q1yd1ii3fxc6nh8";
+    sha256 = "02c1mvn01gcfls37sa0c7v2lwffg14x54np8z7d4hjzxxzwg4gpw";
   };
 
   propagatedBuildInputs = [ trezor-udev-rules ];
diff --git a/pkgs/servers/web-apps/matomo/default.nix b/pkgs/servers/web-apps/matomo/default.nix
index d5f0b7057f07..09a8d21c4ce9 100644
--- a/pkgs/servers/web-apps/matomo/default.nix
+++ b/pkgs/servers/web-apps/matomo/default.nix
@@ -3,103 +3,107 @@
 let
   versions = {
     matomo = {
-      version = "3.13.1";
-      sha256 = "071m3sw3rrhlccbwdyklcn8rwp4mcnii5m2a7zmgx3rv87i9n2ni";
+      version = "3.13.2";
+      sha256 = "1psysdz60h5rvgbsflkfprygxnh3kq60snqamyss07rk0ahbcb16";
     };
 
     matomo-beta = {
-      version = "3.12.0";
-      beta = 3;
-      sha256 = "1n7b8cag7rpi6y4145cll2irz3in4668jkiicy06wm5nq6lb4bdf";
+      version = "3.13.2";
+      # `beta` examples: "b1", "rc1", null
+      # TOOD when updating: use null if stable version is >= latest beta or release candidate
+      beta = null;
+      sha256 = "1psysdz60h5rvgbsflkfprygxnh3kq60snqamyss07rk0ahbcb16";
     };
   };
-  common = pname: {version, sha256, beta ? null}:
-    let fullVersion = version + stdenv.lib.optionalString (beta != null) "-b${toString beta}";
-  name = "${pname}-${fullVersion}";
+  common = pname: { version, sha256, beta ? null }:
+    let
+      fullVersion = version + stdenv.lib.optionalString (beta != null) "-${toString beta}";
+      name = "${pname}-${fullVersion}";
+    in
+
+      stdenv.mkDerivation rec {
+        inherit name;
+        version = fullVersion;
+
+        src = fetchurl {
+          url = "https://builds.matomo.org/matomo-${version}.tar.gz";
+          inherit sha256;
+        };
+
+        nativeBuildInputs = [ makeWrapper ];
+
+        # make-localhost-default-database-server.patch:
+        #   This changes the default value of the database server field
+        #   from 127.0.0.1 to localhost.
+        #   unix socket authentication only works with localhost,
+        #   but password-based SQL authentication works with both.
+        # TODO: is upstream interested in this?
+        # -> discussion at https://github.com/matomo-org/matomo/issues/12646
+        patches = [ ./make-localhost-default-database-host.patch ];
+
+        # this bootstrap.php adds support for getting PIWIK_USER_PATH
+        # from an environment variable. Point it to a mutable location
+        # to be able to use matomo read-only from the nix store
+        postPatch = ''
+          cp ${./bootstrap.php} bootstrap.php
+        '';
+
+        # TODO: future versions might rename the PIWIK_… variables to MATOMO_…
+        # TODO: Move more unnecessary files from share/, especially using PIWIK_INCLUDE_PATH.
+        #       See https://forum.matomo.org/t/bootstrap-php/5926/10 and
+        #       https://github.com/matomo-org/matomo/issues/11654#issuecomment-297730843
+        installPhase = ''
+          runHook preInstall
+
+          # copy everything to share/, used as webroot folder, and then remove what's known to be not needed
+          mkdir -p $out/share
+          cp -ra * $out/share/
+          # tmp/ is created by matomo in PIWIK_USER_PATH
+          rmdir $out/share/tmp
+          # config/ needs to be accessed by PIWIK_USER_PATH anyway
+          ln -s $out/share/config $out/
+
+          makeWrapper ${php}/bin/php $out/bin/matomo-console \
+            --add-flags "$out/share/console"
+
+          runHook postInstall
+        '';
+
+        filesToFix = [
+          "misc/composer/build-xhprof.sh"
+          "misc/composer/clean-xhprof.sh"
+          "misc/cron/archive.sh"
+          "plugins/Installation/FormDatabaseSetup.php"
+          "vendor/leafo/lessphp/package.sh"
+          "vendor/pear/archive_tar/sync-php4"
+          "vendor/szymach/c-pchart/coverage.sh"
+          # drupal_test.sh does not exist in 3.12.0-b3; added for 3.13.0
+          "vendor/twig/twig/drupal_test.sh"
+        ];
+
+        # This fixes the consistency check in the admin interface
+        #
+        # The filesToFix list may contain files that are exclusive to only one of the versions we build
+        # make sure to test for existence to avoid erroring on an incompatible version and failing
+        postFixup = ''
+          pushd $out/share > /dev/null
+          for f in $filesToFix; do
+            if [ -f "$f" ]; then
+              length="$(wc -c "$f" | cut -d' ' -f1)"
+              hash="$(md5sum "$f" | cut -d' ' -f1)"
+              sed -i "s:\\(\"$f\"[^(]*(\\).*:\\1\"$length\", \"$hash\"),:g" config/manifest.inc.php
+            fi
+          done
+          popd > /dev/null
+        '';
+
+        meta = with stdenv.lib; {
+          description = "A real-time web analytics application";
+          license = licenses.gpl3Plus;
+          homepage = https://matomo.org/;
+          platforms = platforms.all;
+          maintainers = with maintainers; [ florianjacob kiwi ];
+        };
+      };
 in
-
-stdenv.mkDerivation rec {
-  inherit name;
-  version = fullVersion;
-
-  src = fetchurl {
-    url = "https://builds.matomo.org/matomo-${version}.tar.gz";
-    inherit sha256;
-  };
-
-  nativeBuildInputs = [ makeWrapper ];
-
-  # make-localhost-default-database-server.patch:
-  #   This changes the default value of the database server field
-  #   from 127.0.0.1 to localhost.
-  #   unix socket authentication only works with localhost,
-  #   but password-based SQL authentication works with both.
-  # TODO: is upstream interested in this?
-  # -> discussion at https://github.com/matomo-org/matomo/issues/12646
-  patches = [ ./make-localhost-default-database-host.patch ];
-
-  # this bootstrap.php adds support for getting PIWIK_USER_PATH
-  # from an environment variable. Point it to a mutable location
-  # to be able to use matomo read-only from the nix store
-  postPatch = ''
-    cp ${./bootstrap.php} bootstrap.php
-  '';
-
-  # TODO: future versions might rename the PIWIK_… variables to MATOMO_…
-  # TODO: Move more unnecessary files from share/, especially using PIWIK_INCLUDE_PATH.
-  #       See https://forum.matomo.org/t/bootstrap-php/5926/10 and
-  #       https://github.com/matomo-org/matomo/issues/11654#issuecomment-297730843
-  installPhase = ''
-    runHook preInstall
-
-    # copy everything to share/, used as webroot folder, and then remove what's known to be not needed
-    mkdir -p $out/share
-    cp -ra * $out/share/
-    # tmp/ is created by matomo in PIWIK_USER_PATH
-    rmdir $out/share/tmp
-    # config/ needs to be accessed by PIWIK_USER_PATH anyway
-    ln -s $out/share/config $out/
-
-    makeWrapper ${php}/bin/php $out/bin/matomo-console \
-      --add-flags "$out/share/console"
-
-    runHook postInstall
-  '';
-
-  filesToFix = [
-    "misc/composer/build-xhprof.sh"
-    "misc/composer/clean-xhprof.sh"
-    "misc/cron/archive.sh"
-    "plugins/Installation/FormDatabaseSetup.php"
-    "vendor/leafo/lessphp/package.sh"
-    "vendor/pear/archive_tar/sync-php4"
-    "vendor/szymach/c-pchart/coverage.sh"
-    # drupal_test.sh does not exist in 3.12.0-b3; added for 3.13.0
-    "vendor/twig/twig/drupal_test.sh"
-  ];
-
-  # This fixes the consistency check in the admin interface
-  #
-  # The filesToFix list may contain files that are exclusive to only one of the versions we build
-  # make sure to test for existence to avoid erroring on an incompatible version and failing
-  postFixup = ''
-    pushd $out/share > /dev/null
-    for f in $filesToFix; do
-      if [ -f "$f" ]; then
-        length="$(wc -c "$f" | cut -d' ' -f1)"
-        hash="$(md5sum "$f" | cut -d' ' -f1)"
-        sed -i "s:\\(\"$f\"[^(]*(\\).*:\\1\"$length\", \"$hash\"),:g" config/manifest.inc.php
-      fi
-    done
-    popd > /dev/null
-  '';
-
-  meta = with stdenv.lib; {
-    description = "A real-time web analytics application";
-    license = licenses.gpl3Plus;
-    homepage = https://matomo.org/;
-    platforms = platforms.all;
-    maintainers = with maintainers; [ florianjacob kiwi ];
-  };
-};
-in stdenv.lib.mapAttrs common versions
+stdenv.lib.mapAttrs common versions
diff --git a/pkgs/shells/zsh/bracketed-paste-magic.patch b/pkgs/shells/zsh/bracketed-paste-magic.patch
new file mode 100644
index 000000000000..f22f6489ce7a
--- /dev/null
+++ b/pkgs/shells/zsh/bracketed-paste-magic.patch
@@ -0,0 +1,22 @@
+diff --git a/Functions/Zle/bracketed-paste-magic b/Functions/Zle/bracketed-paste-magic
+index 4baae82..840091b 100644
+--- a/Functions/Zle/bracketed-paste-magic
++++ b/Functions/Zle/bracketed-paste-magic
+@@ -162,7 +162,7 @@ bracketed-paste-magic() {
+ 
+ 	# There are active widgets.  Reprocess $PASTED as keystrokes.
+ 	NUMERIC=1
+-	zle -U - $PASTED
++	zle -U - "$PASTED"
+ 
+ 	# Just in case there are active undo widgets
+ 
+@@ -212,7 +212,7 @@ bracketed-paste-magic() {
+     # Arrange to display highlighting if necessary
+     if [[ -z $zle_highlight || -n ${(M)zle_highlight:#paste:*} ]]; then
+ 	zle -R
+-	zle .read-command && zle -U - $KEYS
++	zle .read-command && zle -U - "$KEYS"
+     fi
+ }
+ 
diff --git a/pkgs/shells/zsh/default.nix b/pkgs/shells/zsh/default.nix
index 0a26b8a78210..52bd3c71858e 100644
--- a/pkgs/shells/zsh/default.nix
+++ b/pkgs/shells/zsh/default.nix
@@ -18,6 +18,13 @@ stdenv.mkDerivation {
     sha256 = "1s3yww0mzgvpc48kp0x868mm3gbna42sbgzya0nknj0x5hn2jq3j";
   };
 
+  patches = [
+    # Bracketed-paste-magic error in Putty due to empty $PASTED variable
+    # http://www.zsh.org/mla/workers/2019/msg00808.html
+    # This patch included in the next version
+    ./bracketed-paste-magic.patch
+  ];
+
   buildInputs = [ ncurses pcre ];
 
   configureFlags = [
diff --git a/pkgs/shells/zsh/oh-my-zsh/default.nix b/pkgs/shells/zsh/oh-my-zsh/default.nix
index 23df4fc8a81f..3b67d2a2280d 100644
--- a/pkgs/shells/zsh/oh-my-zsh/default.nix
+++ b/pkgs/shells/zsh/oh-my-zsh/default.nix
@@ -4,13 +4,13 @@
 { stdenv, fetchgit }:
 
 stdenv.mkDerivation rec {
-  version = "2020-02-07";
+  version = "2020-02-11";
   pname = "oh-my-zsh";
-  rev = "e81782ac3faf24cac2384a99366f748040b3f20a";
+  rev = "17428f3c9a99c8d81e57bcf565d39011669e65ed";
 
   src = fetchgit { inherit rev;
     url = "https://github.com/ohmyzsh/ohmyzsh";
-    sha256 = "0mry8a43kfmb1wap85ss4dvmy5x3sil14z98fd15l9cgkqxpjnlb";
+    sha256 = "1i2f5gvr8gdvwx4x135j949x4q1q721jq2936p33c1zk9wq4kzwc";
   };
 
   pathsToLink = [ "/share/oh-my-zsh" ];
diff --git a/pkgs/tools/admin/tigervnc/default.nix b/pkgs/tools/admin/tigervnc/default.nix
index 1c2243d04f11..9f105a7d5d55 100644
--- a/pkgs/tools/admin/tigervnc/default.nix
+++ b/pkgs/tools/admin/tigervnc/default.nix
@@ -23,6 +23,8 @@ stdenv.mkDerivation rec {
 
   inherit fontDirectories;
 
+  patches = [ ./u_xorg-server-1.20.7-ddxInputThreadInit.patch ];
+
   postPatch = ''
     sed -i -e '/^\$cmd \.= " -pn";/a$cmd .= " -xkbdir ${xkeyboard_config}/etc/X11/xkb";' unix/vncserver
     fontPath=
diff --git a/pkgs/tools/admin/tigervnc/u_xorg-server-1.20.7-ddxInputThreadInit.patch b/pkgs/tools/admin/tigervnc/u_xorg-server-1.20.7-ddxInputThreadInit.patch
new file mode 100644
index 000000000000..c18f4bf213f2
--- /dev/null
+++ b/pkgs/tools/admin/tigervnc/u_xorg-server-1.20.7-ddxInputThreadInit.patch
@@ -0,0 +1,21 @@
+Origin: https://build.opensuse.org/package/view_file/X11:XOrg/tigervnc/u_xorg-server-1.20.7-ddxInputThreadInit.patch
+diff -u -p -r tigervnc-1.10.0.old/unix/xserver/hw/vnc/xvnc.c tigervnc-1.10.0/unix/xserver/hw/vnc/xvnc.c
+--- tigervnc-1.10.0.old/unix/xserver/hw/vnc/xvnc.c	2020-01-15 11:19:19.486731848 +0000
++++ tigervnc-1.10.0/unix/xserver/hw/vnc/xvnc.c	2020-01-15 11:37:33.275445409 +0000
+@@ -295,6 +295,15 @@ void ddxBeforeReset(void)
+ }
+ #endif
+ 
++#if INPUTTHREAD
++/** This function is called in Xserver/os/inputthread.c when starting
++    the input thread. */
++void
++ddxInputThreadInit(void)
++{
++}
++#endif
++
+ void ddxUseMsg(void)
+ {
+     vncPrintBanner();
+
diff --git a/pkgs/tools/graphics/vulkan-tools/default.nix b/pkgs/tools/graphics/vulkan-tools/default.nix
index 5851e4a2d46a..f61835ac81f8 100644
--- a/pkgs/tools/graphics/vulkan-tools/default.nix
+++ b/pkgs/tools/graphics/vulkan-tools/default.nix
@@ -3,13 +3,13 @@
 
 stdenv.mkDerivation rec {
   pname = "vulkan-tools";
-  version = "1.1.114.0";
+  version = "1.2.131.1";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "Vulkan-Tools";
     rev = "sdk-${version}";
-    sha256 = "1d4fcy11gk21x7r7vywdcc1dy9j1d2j78hvd5vfh3vy9fnahx107";
+    sha256 = "0ws47ansrr8cq4qjf6k4q0ygm9wwd3w7mhwqcl1qxms8lh5vmhfq";
   };
 
   nativeBuildInputs = [ cmake pkgconfig ];
diff --git a/pkgs/tools/misc/brotab/default.nix b/pkgs/tools/misc/brotab/default.nix
new file mode 100644
index 000000000000..2b6274c631da
--- /dev/null
+++ b/pkgs/tools/misc/brotab/default.nix
@@ -0,0 +1,33 @@
+{ lib, fetchFromGitHub, glibcLocales, python }:
+
+python.pkgs.buildPythonApplication rec {
+  version = "1.1.0";
+  pname = "brotab";
+
+  src = fetchFromGitHub {
+    owner = "balta2ar";
+    repo = pname;
+    rev = version;
+    sha256 = "17yj5i8p28a7zmixdfa1i4gfc7c2fmdkxlymazasar58dz8m68mw";
+  };
+
+  propagatedBuildInputs = with python.pkgs; [
+    requests
+    flask
+    requests
+    pytest
+    psutil
+  ];
+
+  # test_integration.py requires Chrome browser session
+  checkPhase = ''
+    ${python.interpreter} -m unittest brotab/tests/test_{brotab,utils}.py
+  '';
+  
+  meta = with lib; {
+    homepage = "https://github.com/balta2ar/brotab";
+    description = "Control your browser's tabs from the command line";
+    license = licenses.mit;
+    maintainers = with maintainers; [ doronbehar ];
+  };
+}
diff --git a/pkgs/tools/misc/clipman/default.nix b/pkgs/tools/misc/clipman/default.nix
index 861d384f1f82..b8873e2bcac2 100644
--- a/pkgs/tools/misc/clipman/default.nix
+++ b/pkgs/tools/misc/clipman/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "clipman";
-  version = "1.2.0";
+  version = "unstable-2019-12-10";
 
   src = fetchFromGitHub {
     owner = "yory8";
     repo = pname;
-    rev = "v${version}";
-    sha256 = "0266qb8p5l8j25nn51ajsbiij8bh5r7ywphf2x1l7wfhbzgxz12d";
+    rev = "c57453be90bb4496f67275db8c0beb2116a6ce14";
+    sha256 = "0zvqk3gcpx67dsn7qr0p9bgjp0sljl3yrlsfbqzrbrmj2lwr98ys";
   };
 
   modSha256 = "0aw0ng8pk8qzn1iv79iw0v9zr8xdc8p9xnigr3ij86038f7aqdhv";
diff --git a/pkgs/tools/misc/fluent-bit/default.nix b/pkgs/tools/misc/fluent-bit/default.nix
index 4e1a18efde4d..042ed2b03341 100644
--- a/pkgs/tools/misc/fluent-bit/default.nix
+++ b/pkgs/tools/misc/fluent-bit/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "fluent-bit";
-  version = "1.3.6";
+  version = "1.3.7";
 
   src = fetchFromGitHub {
     owner = "fluent";
     repo = "fluent-bit";
     rev = "v${version}";
-    sha256 = "0gkn5axjxaa52f3w2qxwwab4m46xrxymbkcpw1v1jihil34pxw7a";
+    sha256 = "1j0fzhakk4kpfpq4p4c0byw99adxd9w7irfn83rlvw8bw32j2lrj";
   };
 
   nativeBuildInputs = [ cmake flex bison ];
diff --git a/pkgs/tools/misc/ncdu/default.nix b/pkgs/tools/misc/ncdu/default.nix
index d29626c99d18..f47a43ab5d24 100644
--- a/pkgs/tools/misc/ncdu/default.nix
+++ b/pkgs/tools/misc/ncdu/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "ncdu";
-  version = "1.14.1";
+  version = "1.14.2";
 
   src = fetchurl {
     url = "https://dev.yorhel.nl/download/${pname}-${version}.tar.gz";
-    sha256 = "0gp1aszzrh8b6fhv8fspvkmr0qwc55z6z4w6l7r8j09sq7lf0cdy";
+    sha256 = "1cf6a9qw7ljaw09b0g7c5i252dl7wb2mnkrbwwwf7m0c3mf7yyll";
   };
 
   buildInputs = [ ncurses ];
diff --git a/pkgs/tools/package-management/nix/default.nix b/pkgs/tools/package-management/nix/default.nix
index 28413971c004..a51a4cab4f08 100644
--- a/pkgs/tools/package-management/nix/default.nix
+++ b/pkgs/tools/package-management/nix/default.nix
@@ -1,4 +1,4 @@
-{ lib, fetchurl, fetchFromGitHub, callPackage
+{ lib, fetchurl, callPackage
 , storeDir ? "/nix/store"
 , stateDir ? "/nix/var"
 , confDir ? "/etc"
@@ -11,7 +11,7 @@ let
 common =
   { lib, stdenv, fetchpatch, perl, curl, bzip2, sqlite, openssl ? null, xz
   , pkgconfig, boehmgc, perlPackages, libsodium, brotli, boost, editline, nlohmann_json
-  , autoreconfHook, autoconf-archive, bison, flex, libxml2, libxslt, docbook5, docbook_xsl_ns, jq
+  , jq, libarchive, rustc, cargo
   , busybox-sandbox-shell
   , storeDir
   , stateDir
@@ -19,7 +19,7 @@ common =
   , withLibseccomp ? lib.any (lib.meta.platformMatch stdenv.hostPlatform) libseccomp.meta.platforms, libseccomp
   , withAWS ? stdenv.isLinux || stdenv.isDarwin, aws-sdk-cpp
 
-  , name, suffix ? "", src, includesPerl ? false, fromGit ? false
+  , name, suffix ? "", src, includesPerl ? false
 
   }:
   let
@@ -29,19 +29,21 @@ common =
       version = lib.getVersion name;
 
       is20 = lib.versionAtLeast version "2.0pre";
+      is24 = lib.versionAtLeast version "2.4pre";
 
-      VERSION_SUFFIX = lib.optionalString fromGit suffix;
+      VERSION_SUFFIX = suffix;
 
       outputs = [ "out" "dev" "man" "doc" ];
 
       nativeBuildInputs =
         [ pkgconfig ]
         ++ lib.optionals (!is20) [ curl perl ]
-        ++ lib.optionals fromGit [ autoreconfHook autoconf-archive bison flex libxml2 libxslt docbook5 docbook_xsl_ns jq ];
+        ++ lib.optionals is24 [ jq ];
 
       buildInputs = [ curl openssl sqlite xz bzip2 nlohmann_json ]
         ++ lib.optional (stdenv.isLinux || stdenv.isDarwin) libsodium
         ++ lib.optionals is20 [ brotli boost editline ]
+        ++ lib.optionals is24 [ libarchive rustc cargo ]
         ++ lib.optional withLibseccomp libseccomp
         ++ lib.optional (withAWS && is20)
             ((aws-sdk-cpp.override {
@@ -126,8 +128,6 @@ common =
       };
 
       passthru = {
-        inherit fromGit;
-
         perl-bindings = if includesPerl then nix else stdenv.mkDerivation {
           pname = "nix-perl";
           inherit version;
@@ -140,7 +140,6 @@ common =
           # but noting for future travellers.
           nativeBuildInputs =
             [ perl pkgconfig curl nix libsodium ]
-            ++ lib.optionals fromGit [ autoreconfHook autoconf-archive ]
             ++ lib.optional is20 boost;
 
           configureFlags =
@@ -186,29 +185,23 @@ in rec {
   });
 
   nixUnstable = lib.lowPrio (callPackage common rec {
-    name = "nix-2.3${suffix}";
-    suffix = "pre6895_84de821";
-    src = fetchFromGitHub {
-      owner = "NixOS";
-      repo = "nix";
-      rev = "84de8210040580ce7189332b43038d52c56a9689";
-      sha256 = "062pdly0m2hk8ly8li5psvpbj1mi7m1a15k8wyzf79q7294l5li3";
+    name = "nix-2.4${suffix}";
+    suffix = "pre7250_94c93437";
+    src = fetchurl {
+      url = "https://hydra.nixos.org/build/112193977/download/3/nix-2.4${suffix}.tar.xz";
+      sha256 = "f9baf241c9449c1e3e5c9610adbcd2ce9e5fbcab16aff3ba3030d2fad7b34d7b";
     };
-    fromGit = true;
 
     inherit storeDir stateDir confDir boehmgc;
   });
 
   nixFlakes = lib.lowPrio (callPackage common rec {
     name = "nix-2.4${suffix}";
-    suffix = "pre20191022_9cac895";
-    src = fetchFromGitHub {
-      owner = "NixOS";
-      repo = "nix";
-      rev = "9cac895406724e0304dff140379783c4d786e855";
-      hash = "sha256-Y1cdnCNoJmjqyC/a+Nt2N+5L3Ttg7K7zOD7gmtg1QzA=";
+    suffix = "pre20200207_d2032ed";
+    src = fetchurl {
+      url = "https://hydra.nixos.org/build/111815420/download/3/nix-2.4${suffix}.tar.xz";
+      sha256 = "e72a20efeee4ccc704cca3a06de9185fb8742bc7ef1a62af5896ec0f379b9ceb";
     };
-    fromGit = true;
 
     inherit storeDir stateDir confDir boehmgc;
   });
diff --git a/pkgs/tools/security/safe/default.nix b/pkgs/tools/security/safe/default.nix
new file mode 100644
index 000000000000..43d791e19dbe
--- /dev/null
+++ b/pkgs/tools/security/safe/default.nix
@@ -0,0 +1,31 @@
+{ stdenv
+, buildGoPackage
+, fetchFromGitHub
+}:
+
+with builtins;
+
+buildGoPackage rec {
+  pname = "safe";
+  version = "1.5.1";
+
+  src = fetchFromGitHub {
+    owner = "starkandwayne";
+    repo = "safe";
+    rev = "v${version}";
+    sha256 = "12gzxrnyl890h79z9yx23m1wwgy8ahm74q4qwi8n2nh7ydq6mn2d";
+  };
+
+  goPackagePath = "github.com/starkandwayne/safe";
+
+  preBuild = ''
+    buildFlagsArray+=("-ldflags" "-X main.Version=${version}")
+  '';
+
+  meta = with stdenv.lib; {
+    description = "A Vault CLI";
+    homepage = "https://github.com/starkandwayne/safe";
+    license = licenses.mit;
+    maintainers = with maintainers; [ eonpatapon ];
+  };
+}
diff --git a/pkgs/tools/text/gist/default.nix b/pkgs/tools/text/gist/default.nix
index 7091031d28f0..ebefae06c8ca 100644
--- a/pkgs/tools/text/gist/default.nix
+++ b/pkgs/tools/text/gist/default.nix
@@ -4,8 +4,8 @@ buildRubyGem rec {
   inherit ruby;
   name = "${gemName}-${version}";
   gemName = "gist";
-  version = "5.0.0";
-  source.sha256 = "1i0a73mzcjv4mj5vjqwkrx815ydsppx3v812lxxd9mk2s7cj1vyd";
+  version = "5.1.0";
+  source.sha256 = "0s69y6hi5iq5k6317j1kjmhi3mk586j1543q8wa608grwcmbq3fw";
 
   meta = with lib; {
     description = "Upload code to https://gist.github.com (or github enterprise)";
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 8c7a728654ae..4b4991cf9791 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -347,6 +347,7 @@ mapAliases ({
   pinentry_gtk2 = pinentry-gtk2; # added 2019-10-14
   pinentry_qt = pinentry-qt; # added 2019-10-14
   pinentry_gnome = pinentry-gnome; # added 2019-10-14
+  pinentry_qt5 = pinentry-qt; # added 2020-02-11
   postgis = postgresqlPackages.postgis;
   # end
   ppl-address-book = throw "deprecated in 2019-05-02: abandoned by upstream.";
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index ed414d1bb360..88ce26c91e85 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -6269,6 +6269,8 @@ in
 
   safecopy = callPackage ../tools/system/safecopy { };
 
+  safe = callPackage ../tools/security/safe { };
+
   safe-rm = callPackage ../tools/system/safe-rm { };
 
   safeeyes = callPackage ../applications/misc/safeeyes { };
@@ -8300,16 +8302,16 @@ in
       src = fetchFromGitHub {
         owner = "KhronosGroup";
         repo = "SPIRV-Tools";
-        rev = "26c1b8878315a7a5c188df45e0bc236bb222b698";
-        sha256 = "1q76vaqwxf4q2l4rd7j2p2jqgcqpys0m235drzx0drkn2qd50n1b";
+        rev = "5c019b5923c1f6bf00a3ac28114ec4a7b1faa0e2";
+        sha256 = "17a0kiyb7zjsg7ws12diip84vds1ajl98ni9c2wria6ymcvbvsvz";
       };
     });
     spirv-headers = spirv-headers.overrideAttrs (_: {
       src = fetchFromGitHub {
         owner = "KhronosGroup";
         repo = "SPIRV-Headers";
-        rev = "2434b89345a50c018c84f42a310b0fad4f3fd94f";
-        sha256 = "1m902q1alm0rbh69zlskkx4n453xijijp9mf3wzwphi2j36gygwm";
+        rev = "204cd131c42b90d129073719f2766293ce35c081";
+        sha256 = "1gp0mlbfccqnalaix97jxsa5i337xyzyr55wgssapy56p0q04wv2";
       };
     });
   };
@@ -14593,24 +14595,24 @@ in
         src = fetchFromGitHub {
           owner = "KhronosGroup";
           repo = "SPIRV-Tools";
-          rev = "aa9e8f538041db3055ea443080e0ccc315fa114f";
-          sha256 = "1nbii0xa5zgs36dmpvzpli1jbzb9ijr7bkgvzmlpcjrjsl02cnbk";
+          rev = "323a81fc5e30e43a04e5e22af4cba98ca2a161e6";
+          sha256 = "1kwyh95l02w3v1ra55c836wayzw8d0m14ab7wf0ynhhyp3k2p9hv";
         };
       });
       spirv-headers = spirv-tools.overrideAttrs (_: {
         src = fetchFromGitHub {
           owner = "KhronosGroup";
           repo = "SPIRV-Headers";
-          rev = "45c2cc37276d69e5b257507d97fd90d2a5684ccc";
-          sha256 = "1jrzazv5j8nsn8hz5vc43vz4msps05d65wdy9spfg2hg36r1s2pm";
+          rev = "204cd131c42b90d129073719f2766293ce35c081";
+          sha256 = "1gp0mlbfccqnalaix97jxsa5i337xyzyr55wgssapy56p0q04wv2";
         };
       });
     }).overrideAttrs (_: {
       src = fetchFromGitHub {
         owner = "KhronosGroup";
         repo = "glslang";
-        rev = "333d1c95792692205472c457d7bec915a94c8000";
-        sha256 = "04srq1zcilhs7p1xz7wcnrncjxqskhfnqggisvxw5f774gk01ks6";
+        rev = "4fc7a33910fb8e40b970d160e1b38ab3f67fe0f3";
+        sha256 = "1dghz8zl774dx2xpa4dv8xhxirbylgyn6kx18ib4qirna1njp0zg";
       };
     });
   };
@@ -17920,7 +17922,7 @@ in
   source-han-serif-simplified-chinese = sourceHanSerifPackages.simplified-chinese;
   source-han-serif-traditional-chinese = sourceHanSerifPackages.traditional-chinese;
 
-  spleen = callPackage ../data/fonts/spleen { inherit (xorg) mkfontdir; };
+  spleen = callPackage ../data/fonts/spleen { inherit (buildPackages.xorg) mkfontscale; };
 
   stilo-themes = callPackage ../data/themes/stilo { };
 
@@ -18431,6 +18433,10 @@ in
 
   browsh = callPackage ../applications/networking/browsers/browsh { };
 
+  brotab = callPackage ../tools/misc/brotab {
+    python = python3;
+  };
+
   bookworm = callPackage ../applications/office/bookworm { };
 
   chromium = callPackage ../applications/networking/browsers/chromium (config.chromium or {});
@@ -21721,6 +21727,8 @@ in
 
   tiny = callPackage ../applications/networking/irc/tiny { };
 
+  tipp10 = qt5.callPackage ../applications/misc/tipp10 { };
+
   tixati = callPackage ../applications/networking/p2p/tixati { };
 
   tkcvs = callPackage ../applications/version-management/tkcvs { };