diff --git a/.github/workflows/pending-clear.yml b/.github/workflows/pending-clear.yml
new file mode 100644
index 000000000000..d888a414506c
--- /dev/null
+++ b/.github/workflows/pending-clear.yml
@@ -0,0 +1,30 @@
+name: "clear pending status"
+
+on:
+  check_suite:
+    types: [ completed ]
+
+jobs:
+  action:
+    runs-on: ubuntu-latest
+    steps:
+    - name: clear pending status
+      if: github.repository_owner == 'NixOS' && github.event.check_suite.app.name == 'OfBorg'
+      env:
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        GSU_VERSION: "0.5.0"
+        GSU_URL: "https://github.com/cloudposse/github-status-updater/releases/download"
+      run: |
+        curl -sSf -O -L -C - \
+        "$GSU_URL/$GSU_VERSION/github-status-updater_linux_amd64" && \
+        chmod +x github-status-updater_linux_amd64 && \
+        ./github-status-updater_linux_amd64 \
+          -action update_state \
+          -token "$GITHUB_TOKEN" \
+          -owner NixOS \
+          -repo nixpkgs \
+          -state success \
+          -context "Wait for ofborg" \
+          -description " " \
+          -url " " \
+          -ref "${{ github.event.check_suite.head_sha }}"
diff --git a/.github/workflows/pending-set.yml b/.github/workflows/pending-set.yml
new file mode 100644
index 000000000000..ee1d537295c7
--- /dev/null
+++ b/.github/workflows/pending-set.yml
@@ -0,0 +1,29 @@
+name: "set pending status"
+
+on:
+  pull_request_target:
+
+jobs:
+  action:
+    runs-on: ubuntu-latest
+    steps:
+    - name: set pending status
+      if: github.repository_owner == 'NixOS'
+      env:
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        GSU_VERSION: "0.5.0"
+        GSU_URL: "https://github.com/cloudposse/github-status-updater/releases/download"
+      run: |
+        curl -sSf -O -L -C - \
+        "$GSU_URL/$GSU_VERSION/github-status-updater_linux_amd64" && \
+        chmod +x github-status-updater_linux_amd64 && \
+        ./github-status-updater_linux_amd64 \
+          -action update_state \
+          -token "$GITHUB_TOKEN" \
+          -owner NixOS \
+          -repo nixpkgs \
+          -state failure \
+          -context "Wait for ofborg" \
+          -description "This failed status will be cleared when ofborg finishes eval." \
+          -url " " \
+          -ref "${{ github.event.pull_request.head.sha }}"
diff --git a/lib/tests/release.nix b/lib/tests/release.nix
index eebee1b49bc8..800d8a65c14f 100644
--- a/lib/tests/release.nix
+++ b/lib/tests/release.nix
@@ -17,7 +17,6 @@ pkgs.runCommandNoCC "nixpkgs-lib-tests" {
     export TEST_ROOT=$(pwd)/test-tmp
     export NIX_BUILD_HOOK=
     export NIX_CONF_DIR=$TEST_ROOT/etc
-    export NIX_DB_DIR=$TEST_ROOT/db
     export NIX_LOCALSTATE_DIR=$TEST_ROOT/var
     export NIX_LOG_DIR=$TEST_ROOT/var/log/nix
     export NIX_STATE_DIR=$TEST_ROOT/var/nix
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index efdc0fc7bc73..fe06e428ff05 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -3733,6 +3733,12 @@
     }];
     name = "Jiri Daněk";
   };
+  jdbaldry = {
+    email = "jack.baldry@grafana.com";
+    github = "jdbaldry";
+    githubId = 4599384;
+    name = "Jack Baldry";
+  };
   jdehaas = {
     email = "qqlq@nullptr.club";
     github = "jeroendehaas";
diff --git a/nixos/doc/manual/release-notes/rl-2009.xml b/nixos/doc/manual/release-notes/rl-2009.xml
index b958aab07c56..166aec25512b 100644
--- a/nixos/doc/manual/release-notes/rl-2009.xml
+++ b/nixos/doc/manual/release-notes/rl-2009.xml
@@ -970,6 +970,8 @@ services.transmission.settings.rpc-bind-address = "0.0.0.0";
    </listitem>
    <listitem>
     <para>
+     Nginx module <literal>nginxModules.fastcgi-cache-purge</literal> renamed to official name <literal>nginxModules.cache-purge</literal>.
+     Nginx module <literal>nginxModules.ngx_aws_auth</literal> renamed to official name <literal>nginxModules.aws-auth</literal>.
       The packages <package>perl</package>, <package>rsync</package> and <package>strace</package> were removed from <option>systemPackages</option>. If you need them, install them again with <code><xref linkend="opt-environment.systemPackages"/> = with pkgs; [ perl rsync strace ];</code> in your <filename>configuration.nix</filename>.
     </para>
    </listitem>
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index aee1fdb368d3..df68b8ceb04c 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -300,6 +300,7 @@
   ./services/desktops/dleyna-renderer.nix
   ./services/desktops/dleyna-server.nix
   ./services/desktops/pantheon/files.nix
+  ./services/desktops/espanso.nix
   ./services/desktops/flatpak.nix
   ./services/desktops/geoclue2.nix
   ./services/desktops/gsignond.nix
diff --git a/nixos/modules/services/desktops/espanso.nix b/nixos/modules/services/desktops/espanso.nix
new file mode 100644
index 000000000000..cd2eadf88168
--- /dev/null
+++ b/nixos/modules/services/desktops/espanso.nix
@@ -0,0 +1,25 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+let cfg = config.services.espanso;
+in {
+  meta = { maintainers = with lib.maintainers; [ numkem ]; };
+
+  options = {
+    services.espanso = { enable = options.mkEnableOption "Espanso"; };
+  };
+
+  config = mkIf cfg.enable {
+    systemd.user.services.espanso = {
+      description = "Espanso daemon";
+      path = with pkgs; [ espanso libnotify xclip ];
+      serviceConfig = {
+        ExecStart = "${pkgs.espanso}/bin/espanso daemon";
+        Restart = "on-failure";
+      };
+      wantedBy = [ "default.target" ];
+    };
+
+    environment.systemPackages = [ pkgs.espanso ];
+  };
+}
diff --git a/nixos/modules/services/development/jupyterhub/default.nix b/nixos/modules/services/development/jupyterhub/default.nix
index be6aaed93ac6..f1dcab68b000 100644
--- a/nixos/modules/services/development/jupyterhub/default.nix
+++ b/nixos/modules/services/development/jupyterhub/default.nix
@@ -15,7 +15,7 @@ let
   jupyterhubConfig = pkgs.writeText "jupyterhub_config.py" ''
     c.JupyterHub.bind_url = "http://${cfg.host}:${toString cfg.port}"
 
-    c.JupyterHub.authentication_class = "${cfg.authentication}"
+    c.JupyterHub.authenticator_class = "${cfg.authentication}"
     c.JupyterHub.spawner_class = "${cfg.spawner}"
 
     c.SystemdSpawner.default_url = '/lab'
diff --git a/nixos/modules/services/misc/octoprint.nix b/nixos/modules/services/misc/octoprint.nix
index 7a71d2c8c6aa..e2fbd3b401cc 100644
--- a/nixos/modules/services/misc/octoprint.nix
+++ b/nixos/modules/services/misc/octoprint.nix
@@ -68,8 +68,8 @@ in
       plugins = mkOption {
         default = plugins: [];
         defaultText = "plugins: []";
-        example = literalExample "plugins: [ m3d-fio ]";
-        description = "Additional plugins.";
+        example = literalExample "plugins: with plugins; [ m33-fio stlviewer ]";
+        description = "Additional plugins to be used. Available plugins are passed through the plugins input.";
       };
 
       extraConfig = mkOption {
diff --git a/nixos/modules/system/boot/stage-1.nix b/nixos/modules/system/boot/stage-1.nix
index a04660fb56e7..eee510d2c951 100644
--- a/nixos/modules/system/boot/stage-1.nix
+++ b/nixos/modules/system/boot/stage-1.nix
@@ -36,7 +36,7 @@ let
     set -euo pipefail
 
     declare -A seen
-    declare -a left
+    left=()
 
     patchelf="${pkgs.buildPackages.patchelf}/bin/patchelf"
 
@@ -48,7 +48,7 @@ let
       done
     }
 
-    add_needed $1
+    add_needed "$1"
 
     while [ ''${#left[@]} -ne 0 ]; do
       next=''${left[0]}
diff --git a/nixos/modules/tasks/network-interfaces.nix b/nixos/modules/tasks/network-interfaces.nix
index 565868724ad5..af98123d4774 100644
--- a/nixos/modules/tasks/network-interfaces.nix
+++ b/nixos/modules/tasks/network-interfaces.nix
@@ -1129,7 +1129,6 @@ in
       ++ optionals config.networking.wireless.enable [
         pkgs.wirelesstools # FIXME: obsolete?
         pkgs.iw
-        pkgs.rfkill
       ]
       ++ bridgeStp;
 
diff --git a/nixos/tests/os-prober.nix b/nixos/tests/os-prober.nix
index 6a38f5ca531c..be0235a41753 100644
--- a/nixos/tests/os-prober.nix
+++ b/nixos/tests/os-prober.nix
@@ -1,4 +1,4 @@
-import ./make-test.nix ({pkgs, lib, ...}:
+import ./make-test-python.nix ({pkgs, lib, ...}:
 let
   # A filesystem image with a (presumably) bootable debian
   debianImage = pkgs.vmTools.diskImageFuns.debian9i386 {
@@ -34,9 +34,6 @@ let
     '';
   };
 
-  # options to add the disk to the test vm
-  QEMU_OPTS = "-drive index=2,file=${debianImage}/disk-image.qcow2,read-only,if=virtio";
-
   # a part of the configuration of the test vm
   simpleConfig = {
     boot.loader.grub = {
@@ -71,7 +68,7 @@ in {
   machine = { config, pkgs, ... }: (simpleConfig // {
       imports = [ ../modules/profiles/installation-device.nix
                   ../modules/profiles/base.nix ];
-      virtualisation.memorySize = 1024;
+      virtualisation.memorySize = 1300;
       # The test cannot access the network, so any packages
       # nixos-rebuild needs must be included in the VM.
       system.extraDependencies = with pkgs;
@@ -99,22 +96,28 @@ in {
 
   testScript = ''
     # hack to add the secondary disk
-    $machine->{startCommand} = "QEMU_OPTS=\"\$QEMU_OPTS \"${lib.escapeShellArg QEMU_OPTS} ".$machine->{startCommand};
+    os.environ[
+        "QEMU_OPTS"
+    ] = "-drive index=2,file=${debianImage}/disk-image.qcow2,read-only,if=virtio"
 
-    $machine->start;
-    $machine->succeed("udevadm settle");
-    $machine->waitForUnit("multi-user.target");
+    machine.start()
+    machine.succeed("udevadm settle")
+    machine.wait_for_unit("multi-user.target")
+    print(machine.succeed("lsblk"))
 
     # check that os-prober works standalone
-    $machine->succeed("${pkgs.os-prober}/bin/os-prober | grep /dev/vdb1");
+    machine.succeed(
+        "${pkgs.os-prober}/bin/os-prober | grep /dev/vdb1"
+    )
 
     # rebuild and test that debian is available in the grub menu
-    $machine->succeed("nixos-generate-config");
-    $machine->copyFileFromHost(
+    machine.succeed("nixos-generate-config")
+    machine.copy_from_host(
         "${configFile}",
-        "/etc/nixos/configuration.nix");
-    $machine->succeed("nixos-rebuild boot >&2");
+        "/etc/nixos/configuration.nix",
+    )
+    machine.succeed("nixos-rebuild boot >&2")
 
-    $machine->succeed("egrep 'menuentry.*debian' /boot/grub/grub.cfg");
+    machine.succeed("egrep 'menuentry.*debian' /boot/grub/grub.cfg")
   '';
 })
diff --git a/pkgs/applications/audio/picard/default.nix b/pkgs/applications/audio/picard/default.nix
index 276fe75dd9ff..2aeae1f18901 100644
--- a/pkgs/applications/audio/picard/default.nix
+++ b/pkgs/applications/audio/picard/default.nix
@@ -12,13 +12,13 @@ let
   ;
 in pythonPackages.buildPythonApplication rec {
   pname = "picard";
-  version = "2.4.1";
+  version = "2.4.2";
 
   src = fetchFromGitHub {
     owner = "metabrainz";
     repo = pname;
     rev = "release-${version}";
-    sha256 = "0s4jmcg1n6ayxf7x0amq67rgn6y127h98s2k4fcna6n9477krrwf";
+    sha256 = "0sbccsisk9w0gnblvhg7wk1c5ydppldjbvaa0zhl3yrid5a363ah";
   };
 
   nativeBuildInputs = [ gettext qt5.wrapQtAppsHook qt5.qtbase ]
diff --git a/pkgs/applications/editors/android-studio/default.nix b/pkgs/applications/editors/android-studio/default.nix
index c622a1fcead6..3a0bef24ab73 100644
--- a/pkgs/applications/editors/android-studio/default.nix
+++ b/pkgs/applications/editors/android-studio/default.nix
@@ -19,9 +19,9 @@ let
     sha256Hash = "11lkwcbzdl86cyz4lci65cx9z5jjhrc4z40maqx2r5hw1xka9290";
   };
   latestVersion = { # canary & dev
-    version = "4.2.0.5"; # "Android Studio 4.2 Canary 5"
-    build = "201.6682321";
-    sha256Hash = "076q6d7kmi0wcsqak7n6ggp1qns4xj1134xcpdzb92qk3dmg3wrh";
+    version = "4.2.0.7"; # "Android Studio 4.2 Canary 7"
+    build = "201.6720134";
+    sha256Hash = "1c9s6rd0z596qr7hbil5rl3fqby7c8h7ma52d1qj5rxra73k77nz";
   };
 in {
   # Attributes are named by their corresponding release channels
diff --git a/pkgs/applications/editors/nano/default.nix b/pkgs/applications/editors/nano/default.nix
index 13a0e797adc2..244649f8663e 100644
--- a/pkgs/applications/editors/nano/default.nix
+++ b/pkgs/applications/editors/nano/default.nix
@@ -20,11 +20,11 @@ let
 
 in stdenv.mkDerivation rec {
   pname = "nano";
-  version = "5.0";
+  version = "5.2";
 
   src = fetchurl {
     url = "mirror://gnu/nano/${pname}-${version}.tar.xz";
-    sha256 = "0dmagj4p1llb1a2w0iwdrqbd9cgp0bda4s18vwh6y1ndd6z983bw";
+    sha256 = "1qd7pn9g5dgzbfg4fb3nqxqgi2iqq0g6x33x8d1mx6mfw51xmhij";
   };
 
   nativeBuildInputs = [ texinfo ] ++ optional enableNls gettext;
diff --git a/pkgs/applications/editors/setzer/default.nix b/pkgs/applications/editors/setzer/default.nix
index 5a0ef754db16..0b1dd8fcb9f6 100644
--- a/pkgs/applications/editors/setzer/default.nix
+++ b/pkgs/applications/editors/setzer/default.nix
@@ -17,13 +17,13 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "setzer";
-  version = "0.2.8";
+  version = "0.3.0";
 
   src = fetchFromGitHub {
     owner = "cvfosammmm";
     repo = "Setzer";
     rev = "v${version}";
-    sha256 = "1llxxjj038nd2p857bjdyyhzskn56826qi259v47vaqlv9hkifil";
+    sha256 = "0gx5fnyi932lswkhdvxfqs0wxx7hz690cbnpv4m3ysydi96mxwiv";
   };
 
   format = "other";
diff --git a/pkgs/applications/misc/bemenu/default.nix b/pkgs/applications/misc/bemenu/default.nix
index 8b17ecea3cbb..43362b0394eb 100644
--- a/pkgs/applications/misc/bemenu/default.nix
+++ b/pkgs/applications/misc/bemenu/default.nix
@@ -11,13 +11,13 @@ assert x11Support -> xlibs != null && xorg != null;
 
 stdenv.mkDerivation rec {
   pname = "bemenu";
-  version = "0.4.1";
+  version = "0.5.0";
 
   src = fetchFromGitHub {
     owner = "Cloudef";
     repo = pname;
     rev = version;
-    sha256 = "1fjcs9d3533ay3nz79cx3c0lmy2chgragr2lhsy0xl2ckr0iins0";
+    sha256 = "1ifq5bk7782b9m6bl111x33fn38rpppdrww7hfavqia9a9gi2sl5";
   };
 
   nativeBuildInputs = [ pkgconfig pcre ];
diff --git a/pkgs/applications/misc/blender/default.nix b/pkgs/applications/misc/blender/default.nix
index 2e6981490ce3..2190307fbb56 100644
--- a/pkgs/applications/misc/blender/default.nix
+++ b/pkgs/applications/misc/blender/default.nix
@@ -17,11 +17,11 @@ let python = python3Packages.python; in
 
 stdenv.mkDerivation rec {
   pname = "blender";
-  version = "2.83.4";
+  version = "2.83.5";
 
   src = fetchurl {
     url = "https://download.blender.org/source/${pname}-${version}.tar.xz";
-    sha256 = "1y4phkzrxy17kpjbg0jbz1236nw8w8p006x1crbqmvwz8wd3dm46";
+    sha256 = "0xyawly00a59hfdb6b7va84k5fhcv2mxnzd77vs22bzi9y7sap43";
   };
 
   patches = lib.optional stdenv.isDarwin ./darwin.patch;
diff --git a/pkgs/applications/misc/cheat/default.nix b/pkgs/applications/misc/cheat/default.nix
index 6fa8e0cf7bd8..e3ffdef44d0c 100644
--- a/pkgs/applications/misc/cheat/default.nix
+++ b/pkgs/applications/misc/cheat/default.nix
@@ -3,13 +3,13 @@
 
 buildGoModule rec {
   pname = "cheat";
-  version = "4.0.3";
+  version = "4.0.4";
 
   src = fetchFromGitHub {
     owner = "cheat";
     repo = "cheat";
     rev = version;
-    sha256 = "1bzlbd8lvagpipyv553icv17bafhaydscrrlly8jz7kfi4d9xvkk";
+    sha256 = "0cracw6pja3d7z6ip6lbmpvfxlxcnh3fbgh5ba8c87bhfz99idqn";
   };
 
   subPackages = [ "cmd/cheat" ];
diff --git a/pkgs/applications/misc/simplenote/default.nix b/pkgs/applications/misc/simplenote/default.nix
index 6c66987ddb51..d763bd6d6b08 100644
--- a/pkgs/applications/misc/simplenote/default.nix
+++ b/pkgs/applications/misc/simplenote/default.nix
@@ -16,10 +16,10 @@ let
 
   pname = "simplenote";
 
-  version = "1.21.0";
+  version = "1.21.1";
 
   sha256 = {
-    x86_64-linux = "073dg4agqgimsgs3ia7g0pjv4vxkh24bj7vpmssiysdxhm4li1j1";
+    x86_64-linux = "00qx82d17yrrg2mxwhm40av0mpf5hy14j338i5ijhwp79yc8fk8x";
   }.${system} or throwSystem;
 
   meta = with stdenv.lib; {
diff --git a/pkgs/applications/misc/systembus-notify/default.nix b/pkgs/applications/misc/systembus-notify/default.nix
index 28c1be4219d6..374adc6c89bf 100644
--- a/pkgs/applications/misc/systembus-notify/default.nix
+++ b/pkgs/applications/misc/systembus-notify/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "systembus-notify";
-  version = "1.0";
+  version = "1.1";
 
   src = fetchFromGitHub {
     owner = "rfjakob";
     repo = "systembus-notify";
     rev = "v${version}";
-    sha256 = "11zq84qfmbyl51d3r6294l2bjhlgwa9bx7d263g9fkqrwsg0si0y";
+    sha256 = "1pdn45rfpwhrf20hs87qmk2j8sr7ab8161f81019wnypnb1q2fsv";
   };
 
   buildInputs = [ systemd ];
diff --git a/pkgs/applications/networking/browsers/firefox/common.nix b/pkgs/applications/networking/browsers/firefox/common.nix
index 4ecdec77ddbb..2fc15a42a8bf 100644
--- a/pkgs/applications/networking/browsers/firefox/common.nix
+++ b/pkgs/applications/networking/browsers/firefox/common.nix
@@ -108,7 +108,7 @@ stdenv.mkDerivation ({
     dbus dbus-glib pango freetype fontconfig xorg.libXi xorg.libXcursor
     xorg.libX11 xorg.libXrender xorg.libXft xorg.libXt file
     libnotify xorg.pixman yasm libGLU libGL
-    xorg.libXScrnSaver xorg.xorgproto
+    xorg.xorgproto
     xorg.libXext unzip makeWrapper
     libevent libstartup_notification /* cairo */
     libpng jemalloc glib
@@ -277,6 +277,7 @@ stdenv.mkDerivation ({
     patchelf --set-rpath "${lib.getLib libnotify
       }/lib:$(patchelf --print-rpath "$out"/lib/${binaryName}*/libxul.so)" \
         "$out"/lib/${binaryName}*/libxul.so
+    patchelf --add-needed ${xorg.libXScrnSaver.out}/lib/libXss.so $out/lib/${binaryName}/${binaryName}
   '';
 
   doInstallCheck = true;
diff --git a/pkgs/applications/networking/cluster/terragrunt/default.nix b/pkgs/applications/networking/cluster/terragrunt/default.nix
index be5d47eb0e00..14744f188b0b 100644
--- a/pkgs/applications/networking/cluster/terragrunt/default.nix
+++ b/pkgs/applications/networking/cluster/terragrunt/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "terragrunt";
-  version = "0.23.32";
+  version = "0.23.33";
 
    src = fetchFromGitHub {
     owner = "gruntwork-io";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1pa3k0hjdb5bj0bp4aj3lfcgz98l3wd9kfa12rn9zzbcmp087kih";
+    sha256 = "0fsyvmdg2llnzy0yzmiihnb865ccq2sn6d3i935dflppnjyp01p4";
   };
 
-  vendorSha256 = "1xn7c6y32vpanqvf1sfpw6bs73dbjniavjbf00j0vx83bfyklsr4";
+  vendorSha256 = "05p72l724qqf61dn0frahf4awvkkcw8cpl6nhwlacd1jw8c14fjl";
 
   doCheck = false;
 
diff --git a/pkgs/applications/networking/irc/weechat/scripts/default.nix b/pkgs/applications/networking/irc/weechat/scripts/default.nix
index 0880a32af92f..6d228688607a 100644
--- a/pkgs/applications/networking/irc/weechat/scripts/default.nix
+++ b/pkgs/applications/networking/irc/weechat/scripts/default.nix
@@ -7,6 +7,8 @@
 
   weechat-matrix = python3Packages.callPackage ./weechat-matrix { };
 
+  weechat-notify-send = python3Packages.callPackage ./weechat-notify-send { };
+
   wee-slack = callPackage ./wee-slack { };
 
   weechat-autosort = callPackage ./weechat-autosort { };
diff --git a/pkgs/applications/networking/irc/weechat/scripts/weechat-notify-send/default.nix b/pkgs/applications/networking/irc/weechat/scripts/weechat-notify-send/default.nix
new file mode 100644
index 000000000000..d219aa481cdb
--- /dev/null
+++ b/pkgs/applications/networking/irc/weechat/scripts/weechat-notify-send/default.nix
@@ -0,0 +1,31 @@
+{ stdenv, fetchFromGitHub, libnotify }:
+
+stdenv.mkDerivation rec {
+  pname = "weechat-notify-send";
+  version = "0.9";
+
+  src = fetchFromGitHub {
+    owner = "s3rvac";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "1693b7axm9ls5p7hm6kq6avddsisi491khr5irvswr5lpizvys6a";
+  };
+
+  passthru.scripts = [ "notify_send.py" ];
+
+  dontBuild = true;
+  doCheck = false;
+
+  installPhase = ''
+    install -D notify_send.py $out/share/notify_send.py
+    substituteInPlace $out/share/notify_send.py \
+      --replace "'notify-send'" "'${libnotify}/bin/notify-send'"
+  '';
+
+  meta = with stdenv.lib; {
+    description = "A WeeChat script that sends highlight and message notifications through notify-send";
+    homepage = "https://github.com/s3rvac/weechat-notify-srnd";
+    license = licenses.mit;
+    maintainers = with maintainers; [ tobim ];
+  };
+}
diff --git a/pkgs/applications/networking/mailreaders/notmuch-bower/default.nix b/pkgs/applications/networking/mailreaders/notmuch-bower/default.nix
index 0b2a76cc00f8..214f4311e691 100644
--- a/pkgs/applications/networking/mailreaders/notmuch-bower/default.nix
+++ b/pkgs/applications/networking/mailreaders/notmuch-bower/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "notmuch-bower";
-  version = "0.11";
+  version = "0.12";
 
   src = fetchFromGitHub {
     owner = "wangp";
     repo = "bower";
     rev = version;
-    sha256 = "0vhac8yjnhb1gz60jfzg27spyn96c1rr849gc6vjym5xamw7zp0v";
+    sha256 = "0hvvlbvad6h73iiyn9xshlj073p2ddchgh0pyizh9gi8niir4fn5";
   };
 
   nativeBuildInputs = [ gawk mercury pandoc ];
diff --git a/pkgs/applications/office/softmaker/freeoffice.nix b/pkgs/applications/office/softmaker/freeoffice.nix
index d9f901ff4635..634a696a73e2 100644
--- a/pkgs/applications/office/softmaker/freeoffice.nix
+++ b/pkgs/applications/office/softmaker/freeoffice.nix
@@ -1,14 +1,26 @@
-{ callPackage, fetchurl, ... } @ args:
+{ callPackage
+, fetchurl
 
-callPackage ./generic.nix (args // rec {
-  pname = "freeoffice";
+  # This is a bit unusual, but makes version and hash easily
+  # overridable. This is useful when the upstream archive was replaced
+  # and nixpkgs is not in sync yet.
+, officeVersion ? {
   version = "976";
   edition = "2018";
+  sha256 = "13yh4lyqakbdqf4r8vw8imy5gwpfva697iqfd85qmp3wimqvzskl";
+}
+
+, ... } @ args:
+
+callPackage ./generic.nix (args // rec {
+  inherit (officeVersion) version edition;
+
+  pname = "freeoffice";
   suiteName = "FreeOffice";
 
   src = fetchurl {
+    inherit (officeVersion) sha256;
     url = "https://www.softmaker.net/down/softmaker-freeoffice-${version}-amd64.tgz";
-    sha256 = "13yh4lyqakbdqf4r8vw8imy5gwpfva697iqfd85qmp3wimqvzskl";
   };
 
   archive = "freeoffice${edition}.tar.lzma";
diff --git a/pkgs/applications/office/softmaker/softmaker_office.nix b/pkgs/applications/office/softmaker/softmaker_office.nix
index 39a6c9288b43..6aaa8c6745a7 100644
--- a/pkgs/applications/office/softmaker/softmaker_office.nix
+++ b/pkgs/applications/office/softmaker/softmaker_office.nix
@@ -1,14 +1,27 @@
-{ callPackage, fetchurl, ... } @ args:
+{ callPackage
+, fetchurl
+
+  # This is a bit unusual, but makes version and hash easily
+  # overridable. This is useful when people have an older version of
+  # Softmaker Office or when the upstream archive was replaced and
+  # nixpkgs is not in sync yet.
+, officeVersion ? {
+  version = "1018";
+  edition = "2021";
+  sha256 = "1g9mcn0z7s3xw7d5bcjxbnamh6knzndcysahydskfcds6czdxg0c";
+}
+
+, ... } @ args:
 
 callPackage ./generic.nix (args // rec {
+  inherit (officeVersion) version edition;
+
   pname = "softmaker-office";
-  version = "1016";
-  edition = "2021";
   suiteName = "SoftMaker Office";
 
   src = fetchurl {
+    inherit (officeVersion) sha256;
     url = "https://www.softmaker.net/down/softmaker-office-${edition}-${version}-amd64.tgz";
-    sha256 = "0s8kzpc6w2cjkfqmhb2p1pkmkiq9vk9gnc7z2992kijaf9bwk3qz";
   };
 
   archive = "office${edition}.tar.lzma";
diff --git a/pkgs/applications/radio/inspectrum/default.nix b/pkgs/applications/radio/inspectrum/default.nix
index a205cec714d8..f55c78ea26b5 100644
--- a/pkgs/applications/radio/inspectrum/default.nix
+++ b/pkgs/applications/radio/inspectrum/default.nix
@@ -8,20 +8,21 @@
 , gnuradio
 , liquid-dsp
 , qtbase
+, wrapQtAppsHook
 }:
 
-mkDerivation {
+mkDerivation rec {
   pname = "inspectrum";
-  version = "unstable-2017-05-31";
+  version = "0.2.2";
 
   src = fetchFromGitHub {
     owner = "miek";
     repo = "inspectrum";
-    rev = "a89d1337efb31673ccb6a6681bb89c21894c76f7";
-    sha256 = "1fvnr8gca25i6s9mg9b2hyqs0zzr4jicw13mimc9dhrgxklrr1yv";
+    rev = "v${version}";
+    sha256 = "1a517y7s1xi66y5kjrpjay450pad9nc228pa8801mxq1c7m1lamm";
   };
 
-  nativeBuildInputs = [ cmake pkgconfig ];
+  nativeBuildInputs = [ cmake pkgconfig wrapQtAppsHook ];
   buildInputs = [
     fftwFloat
     boost
diff --git a/pkgs/applications/science/math/mathematica/l10ns.nix b/pkgs/applications/science/math/mathematica/l10ns.nix
index c75c91be059c..8ec6ac5048d5 100644
--- a/pkgs/applications/science/math/mathematica/l10ns.nix
+++ b/pkgs/applications/science/math/mathematica/l10ns.nix
@@ -7,6 +7,12 @@
 let allVersions = with lib; flip map
   # N.B. Versions in this list should be ordered from newest to oldest.
   [
+    {
+      version = "12.1.1";
+      lang = "en";
+      language = "English";
+      sha256 = "02mk8gmv8idnakva1nc7r7mx8ld02lk7jgsj1zbn962aps3bhixd";
+    }
     {
       version = "12.1.0";
       lang = "en";
diff --git a/pkgs/applications/virtualization/docker-slim/default.nix b/pkgs/applications/virtualization/docker-slim/default.nix
index c68c0d47e39c..058f6fd8ccca 100644
--- a/pkgs/applications/virtualization/docker-slim/default.nix
+++ b/pkgs/applications/virtualization/docker-slim/default.nix
@@ -6,7 +6,7 @@
 
 buildGoPackage rec {
   pname = "docker-slim";
-  version = "1.31.0";
+  version = "1.32.0";
 
   goPackagePath = "github.com/docker-slim/docker-slim";
 
@@ -14,7 +14,7 @@ buildGoPackage rec {
     owner = "docker-slim";
     repo = "docker-slim";
     rev = version;
-    sha256 = "0kj97kwyjs9hksaas0zic4m7w8b17c1d7c8vhiq2862w97ngxrsk";
+    sha256 = "0pd2v7df176ca923c4nw9ns5gz442jkb0jhzqjl53rwfwz1vxy9h";
   };
 
   subPackages = [ "cmd/docker-slim" "cmd/docker-slim-sensor" ];
diff --git a/pkgs/applications/window-managers/i3/lock-fancy-rapid.nix b/pkgs/applications/window-managers/i3/lock-fancy-rapid.nix
new file mode 100644
index 000000000000..f6e24d979a45
--- /dev/null
+++ b/pkgs/applications/window-managers/i3/lock-fancy-rapid.nix
@@ -0,0 +1,32 @@
+{ stdenv, fetchFromGitHub, xorg, i3lock }:
+
+stdenv.mkDerivation rec {
+  pname = "i3lock-fancy-rapid";
+  version = "2019-10-09";
+  src = fetchFromGitHub {
+    owner = "yvbbrjdr";
+    repo = "i3lock-fancy-rapid";
+    rev = "c67f09bc8a48798c7c820d7d4749240b10865ce0";
+    sha256 = "0jhvlj6v6wx70239pgkjxd42z1s2bzfg886ra6n1rzsdclf4rkc6";
+  };
+
+  buildInputs = [ xorg.libX11 ];
+  propagatedBuildInputs = [ i3lock ];
+
+  postPatch = ''
+    substituteInPlace i3lock-fancy-rapid.c \
+      --replace '"i3lock"' '"${i3lock}/bin/i3lock"'
+  '';
+
+  installPhase = ''
+    install -D i3lock-fancy-rapid $out/bin/i3lock-fancy-rapid
+  '';
+
+  meta = with stdenv.lib; {
+    description = "A faster implementation of i3lock-fancy";
+    homepage = "https://github.com/yvbbrjdr/i3lock-fancy-rapid";
+    maintainers = with maintainers; [ nickhu ];
+    license = licenses.bsd3;
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/desktops/deepin/dde-api/default.nix b/pkgs/desktops/deepin/dde-api/default.nix
index 95e38a86416c..a84fc9c2e021 100644
--- a/pkgs/desktops/deepin/dde-api/default.nix
+++ b/pkgs/desktops/deepin/dde-api/default.nix
@@ -20,7 +20,7 @@
 , librsvg
 , poppler
 , pulseaudio
-, rfkill
+, utillinux
 , xcur2png
 }:
 
@@ -49,7 +49,7 @@ buildGoPackage rec {
     blur-effect # run (is it really needed?)
     coreutils   # run (is it really needed?)
     fontconfig  # run (is it really needed?)
-    rfkill      # run
+    utillinux   # run
     xcur2png    # run
     grub2       # run (is it really needed?)
   ];
diff --git a/pkgs/development/compilers/aspectj/default.nix b/pkgs/development/compilers/aspectj/default.nix
index 94dc813d78a2..8fd47e937c80 100644
--- a/pkgs/development/compilers/aspectj/default.nix
+++ b/pkgs/development/compilers/aspectj/default.nix
@@ -1,12 +1,15 @@
 {stdenv, fetchurl, jre}:
 
 stdenv.mkDerivation rec {
-  name = "aspectj-1.5.2";
+  pname = "aspectj";
+  version = "1.9.6";
   builder = ./builder.sh;
 
-  src = fetchurl {
-    url = "http://archive.eclipse.org/tools/aspectj/${name}.jar";
-    sha256 = "1b3mx248dc1xka1vgsl0jj4sm0nfjsqdcj9r9036mvixj1zj3nmh";
+  src = let
+    versionSnakeCase = builtins.replaceStrings ["."] ["_"] version;
+  in fetchurl {
+    url = "https://github.com/eclipse/org.aspectj/releases/download/V${versionSnakeCase}/aspectj-${version}.jar";
+    sha256 = "02jh66l3vw57k9a4dxlga3qh3487r36gyi6k2z2mmqxbpqajslja";
   };
 
   inherit jre;
diff --git a/pkgs/development/compilers/copper/default.nix b/pkgs/development/compilers/copper/default.nix
new file mode 100644
index 000000000000..4d24c78f25f4
--- /dev/null
+++ b/pkgs/development/compilers/copper/default.nix
@@ -0,0 +1,32 @@
+{ stdenv
+, fetchurl
+, libffi
+}:
+stdenv.mkDerivation rec {
+  pname = "copper";
+  version = "4.4";
+  src = fetchurl {
+    url = "https://tibleiz.net/download/copper-${version}-src.tar.gz";
+    sha256 = "1nf0bw143rjhd019yms3k6k531rahl8anidwh6bif0gm7cngfwfw";
+  };
+  buildInputs = [
+    libffi
+  ];
+  postPatch = ''
+    substituteInPlace Makefile --replace "-s scripts/" "scripts/"
+    patchShebangs .
+  '';
+  buildPhase = ''
+    make BACKEND=elf64 boot-elf64
+    make BACKEND=elf64 COPPER=stage3/copper-elf64 copper-elf64
+  '';
+  installPhase = ''
+    make BACKEND=elf64 install prefix=$out
+  '';
+  meta = with stdenv.lib; {
+    description = "Simple imperative language, statically typed with type inference and genericity.";
+    homepage = "https://tibleiz.net/copper/";
+    license = licenses.bsd2;
+    platforms = platforms.x86_64;
+  };
+}
diff --git a/pkgs/development/compilers/kotlin/default.nix b/pkgs/development/compilers/kotlin/default.nix
index 4e2810fa893c..88c07fb07cab 100644
--- a/pkgs/development/compilers/kotlin/default.nix
+++ b/pkgs/development/compilers/kotlin/default.nix
@@ -1,14 +1,14 @@
 { stdenv, fetchurl, makeWrapper, jre, unzip }:
 
 let
-  version = "1.3.72";
+  version = "1.4.0";
 in stdenv.mkDerivation {
   inherit version;
   pname = "kotlin";
 
   src = fetchurl {
     url = "https://github.com/JetBrains/kotlin/releases/download/v${version}/kotlin-compiler-${version}.zip";
-    sha256 = "0v6c4vjiflwbjjc1lmiyzrilxwbqcz5ll6ls40zhw70zk23xpl6c";
+    sha256 = "0qgiabpkisqjm9iryidrynqy452vzmpgaw54rd9blr9w7g8r20sr";
   };
 
   propagatedBuildInputs = [ jre ] ;
diff --git a/pkgs/development/haskell-modules/configuration-common.nix b/pkgs/development/haskell-modules/configuration-common.nix
index 54c4e7c5465b..131ad6ede3eb 100644
--- a/pkgs/development/haskell-modules/configuration-common.nix
+++ b/pkgs/development/haskell-modules/configuration-common.nix
@@ -972,6 +972,9 @@ self: super: {
     # Generate shell completions
     generateOptparseApplicativeCompletion "purs" dontHaddockPurescript;
 
+  # Generate shell completion for spago
+  spago = generateOptparseApplicativeCompletion "spago" super.spago;
+
   # 2020-06-05: HACK: Package can not pass test suite,
   # Upstream Report: https://github.com/kcsongor/generic-lens/issues/83
   generic-lens = dontCheck super.generic-lens;
diff --git a/pkgs/development/interpreters/chibi/default.nix b/pkgs/development/interpreters/chibi/default.nix
index 08db1b077a3d..7bf4c0fd52d0 100644
--- a/pkgs/development/interpreters/chibi/default.nix
+++ b/pkgs/development/interpreters/chibi/default.nix
@@ -1,6 +1,6 @@
 { stdenv, fetchFromGitHub, makeWrapper }:
 let
-  version = "0.9";
+  version = "0.9.1";
   name = "chibi-scheme-${version}";
 in
 stdenv.mkDerivation {
@@ -18,7 +18,7 @@ stdenv.mkDerivation {
     owner = "ashinn";
     repo = "chibi-scheme";
     rev = version;
-    sha256 = "1lnap41gl9vg82h557f4rlr69jgmd2gh0iqs6cxm77d39kv1scb8";
+    sha256 = "0nd63i924ifh39cba1hd4sbi6vh1cb73v97nrn4bf8rrjh3k8pdi";
   };
 
   buildInputs = [ makeWrapper ];
diff --git a/pkgs/development/interpreters/perl/default.nix b/pkgs/development/interpreters/perl/default.nix
index 27ccb6f22c69..8f539d233925 100644
--- a/pkgs/development/interpreters/perl/default.nix
+++ b/pkgs/development/interpreters/perl/default.nix
@@ -28,7 +28,7 @@ let
 
     # TODO: Add a "dev" output containing the header files.
     outputs = [ "out" "man" "devdoc" ] ++
-      optional crossCompiling "dev";
+      optional crossCompiling "mini";
     setOutputFlags = false;
 
     disallowedReferences = [ stdenv.cc ];
@@ -144,13 +144,13 @@ let
           --replace "$man" /no-such-path
       '' + optionalString crossCompiling
       ''
-        mkdir -p $dev/lib/perl5/cross_perl/${version}
+        mkdir -p $mini/lib/perl5/cross_perl/${version}
         for dir in cnf/{stub,cpan}; do
-          cp -r $dir/* $dev/lib/perl5/cross_perl/${version}
+          cp -r $dir/* $mini/lib/perl5/cross_perl/${version}
         done
 
-        mkdir -p $dev/bin
-        install -m755 miniperl $dev/bin/perl
+        mkdir -p $mini/bin
+        install -m755 miniperl $mini/bin/perl
 
         export runtimeArch="$(ls $out/lib/perl5/site_perl/${version})"
         # wrapProgram should use a runtime-native SHELL by default, but
@@ -161,9 +161,9 @@ let
         # miniperl can't load the native modules there. However, it can
         # (and sometimes needs to) load and run some of the pure perl
         # code there, so we add it anyway. When needed, stubs can be put
-        # into $dev/lib/perl5/cross_perl/${version}.
-        wrapProgram $dev/bin/perl --prefix PERL5LIB : \
-          "$dev/lib/perl5/cross_perl/${version}:$out/lib/perl5/${version}:$out/lib/perl5/${version}/$runtimeArch"
+        # into $mini/lib/perl5/cross_perl/${version}.
+        wrapProgram $mini/bin/perl --prefix PERL5LIB : \
+          "$mini/lib/perl5/cross_perl/${version}:$out/lib/perl5/${version}:$out/lib/perl5/${version}/$runtimeArch"
       ''; # */
 
     meta = {
diff --git a/pkgs/development/interpreters/perl/setup-hook-cross.sh b/pkgs/development/interpreters/perl/setup-hook-cross.sh
index 95aae0b2670f..a7aad6f2453e 100644
--- a/pkgs/development/interpreters/perl/setup-hook-cross.sh
+++ b/pkgs/development/interpreters/perl/setup-hook-cross.sh
@@ -9,4 +9,4 @@ addPerlLibPath () {
     addToSearchPath PERL5LIB $1/lib/perl5/site_perl/@version@/@runtimeArch@
 }
 
-addEnvHooks "$targetOffset" addPerlLibPath
+addEnvHooks "$hostOffset" addPerlLibPath
diff --git a/pkgs/development/interpreters/rakudo/default.nix b/pkgs/development/interpreters/rakudo/default.nix
index a1185fcae37c..fb33743dc9ac 100644
--- a/pkgs/development/interpreters/rakudo/default.nix
+++ b/pkgs/development/interpreters/rakudo/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "rakudo";
-  version = "2020.07";
+  version = "2020.08.1";
 
   src = fetchurl {
     url    = "https://www.rakudo.org/dl/rakudo/rakudo-${version}.tar.gz";
-    sha256 = "1f6ay09k4n7dbcvvla45yg1lfb7vk2ssymmll2xiagjb77hlsqir";
+    sha256 = "1jwlqppm2g6ivzpipkcyihsxzsii3qyx1f35n7wj5dsf99b3hkfm";
   };
 
   buildInputs = [ icu zlib gmp perl ];
diff --git a/pkgs/development/interpreters/rakudo/moarvm.nix b/pkgs/development/interpreters/rakudo/moarvm.nix
index f0a800764b7d..702fccd7b6bd 100644
--- a/pkgs/development/interpreters/rakudo/moarvm.nix
+++ b/pkgs/development/interpreters/rakudo/moarvm.nix
@@ -3,11 +3,11 @@
 
 stdenv.mkDerivation rec {
   pname = "moarvm";
-  version = "2020.07";
+  version = "2020.08";
 
   src = fetchurl {
     url = "https://www.moarvm.org/releases/MoarVM-${version}.tar.gz";
-    sha256 = "1kzp76vqvny8gpp0b4xg1hg4vih4gmic4w1lddc9gqz03dx8hj6s";
+    sha256 = "1gq7z4z5lnkai01721waawkkal82sdmyra05nnbfb1986mq5xpiy";
    };
 
   buildInputs = [ perl ] ++ stdenv.lib.optionals stdenv.isDarwin [ CoreServices ApplicationServices ];
diff --git a/pkgs/development/interpreters/rakudo/nqp.nix b/pkgs/development/interpreters/rakudo/nqp.nix
index bf6a9ccc61bf..93b42d2b8e1d 100644
--- a/pkgs/development/interpreters/rakudo/nqp.nix
+++ b/pkgs/development/interpreters/rakudo/nqp.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "nqp";
-  version = "2020.07";
+  version = "2020.08.1";
 
   src = fetchurl {
     url    = "https://github.com/perl6/nqp/releases/download/${version}/nqp-${version}.tar.gz";
-    sha256 = "0kian8xsyj51m120nh68c9q359l7iipkddph3r8yzvn41zql3y8v";
+    sha256 = "0pxmg22dx6rhfgrxq4gbwqf6d2nahw6iprjvrg8brkbcbyj3ryhd";
   };
 
   buildInputs = [ perl ];
diff --git a/pkgs/development/interpreters/red/default.nix b/pkgs/development/interpreters/red/default.nix
index e1460ec51a22..554dc81bffb9 100644
--- a/pkgs/development/interpreters/red/default.nix
+++ b/pkgs/development/interpreters/red/default.nix
@@ -2,12 +2,12 @@
 
 stdenv.mkDerivation rec {
   pname = "red";
-  version = "0.6.3";
+  version = "0.6.4";
   src = fetchFromGitHub {
-    rev = "6a43c767fa2e85d668b83f749158a18e62c30f70";
+    rev = "755eb943ccea9e78c2cab0f20b313a52404355cb";
     owner = "red";
     repo = "red";
-    sha256 = "1zh6xc728bs7r4v5jz1jjrdk0xd838xsxmvy9gfg75a3zffm0slr";
+    sha256 = "sha256:045rrg9666zczgrwyyyglivzdzja103s52b0fzj7hqmr1fz68q37";
   };
 
   rebol = fetchurl {
@@ -36,7 +36,7 @@ stdenv.mkDerivation rec {
     ${r2} -qw red.r tests/hello.red
 
     # Compiling the Red console...
-    ${r2} -qw red.r -r environment/console/console.red
+    ${r2} -qw red.r -r environment/console/CLI/console.red
 
     # Generating docs...
     cd docs
diff --git a/pkgs/development/libraries/assimp/default.nix b/pkgs/development/libraries/assimp/default.nix
index a6f27f4476b8..c1972aa1ca81 100644
--- a/pkgs/development/libraries/assimp/default.nix
+++ b/pkgs/development/libraries/assimp/default.nix
@@ -18,6 +18,6 @@ stdenv.mkDerivation rec {
     homepage = "http://assimp.sourceforge.net/";
     license = licenses.bsd3;
     maintainers = with maintainers; [ ehmry ];
-    platforms = platforms.linux;
+    platforms = platforms.linux ++ platforms.darwin;
   };
 }
diff --git a/pkgs/development/libraries/libgdiplus/default.nix b/pkgs/development/libraries/libgdiplus/default.nix
index 1ff02a8709d4..70043d1132d0 100644
--- a/pkgs/development/libraries/libgdiplus/default.nix
+++ b/pkgs/development/libraries/libgdiplus/default.nix
@@ -23,6 +23,8 @@ stdenv.mkDerivation rec {
 
   configureFlags = stdenv.lib.optional stdenv.cc.isClang "--host=${stdenv.hostPlatform.system}";
 
+  enableParallelBuilding = true;
+
   buildInputs =
     [ glib cairo fontconfig libtiff giflib
       libjpeg libpng libXrender libexif
diff --git a/pkgs/development/libraries/librseq/default.nix b/pkgs/development/libraries/librseq/default.nix
index d4619ba4320e..4fd8bb7e33a4 100644
--- a/pkgs/development/libraries/librseq/default.nix
+++ b/pkgs/development/libraries/librseq/default.nix
@@ -4,22 +4,29 @@
 
 stdenv.mkDerivation rec {
   pname = "librseq";
-  version = "0.1.0pre54_${builtins.substring 0 7 src.rev}";
+  version = "0.1.0pre70_${builtins.substring 0 7 src.rev}";
 
   src = fetchFromGitHub {
     owner  = "compudj";
     repo   = "librseq";
-    rev    = "152600188dd214a0b2c6a8c66380e50c6ad27154";
-    sha256 = "0mivjmgdkgrr6z2gz3k6q6wgnvyvw9xzy65f6ipvqva68sxhk0mx";
+    rev    = "d1cdec98d476b16ca5e2d9d7eabcf9f1c97e6111";
+    sha256 = "0vgillrxc1knq591gjj99x2ws6q1xpm5dmfrhsxisngfpcnjr10v";
   };
 
-  outputs = [ "out" "dev" ];
+  outputs = [ "out" "dev" "man" ];
   nativeBuildInputs = [ autoreconfHook ];
   buildInputs = [ linuxHeaders ];
 
+  installTargets = [ "install" "install-man" ];
+
+  doCheck = true;
   separateDebugInfo = true;
   enableParallelBuilding = true;
 
+  patchPhase = ''
+    patchShebangs tests
+  '';
+
   # The share/ subdir only contains a doc/ with a README.md that just describes
   # how to compile the library, which clearly isn't very useful! So just get
   # rid of it anyway.
diff --git a/pkgs/development/libraries/libvmaf/default.nix b/pkgs/development/libraries/libvmaf/default.nix
index 6c2b61cf113c..9f7e84558f7d 100644
--- a/pkgs/development/libraries/libvmaf/default.nix
+++ b/pkgs/development/libraries/libvmaf/default.nix
@@ -1,19 +1,19 @@
-{ stdenv, fetchFromGitHub, meson, ninja }:
+{ stdenv, fetchFromGitHub, meson, ninja, nasm }:
 
 stdenv.mkDerivation rec {
   pname = "libvmaf";
-  version = "1.5.2";
+  version = "1.5.3";
 
   src = fetchFromGitHub {
     owner = "netflix";
     repo = "vmaf";
     rev = "v${version}";
-    sha256 = "18w0z3w90fdbzsqaa4diwvq0xmvg0aiw4hi3aaa4pq0zgnb8g3mk";
+    sha256 = "0x3l3g0hgrrjh3ygmxr1pd3rd5589s07c7id35nvj76ch5b7gy63";
   };
 
   sourceRoot = "source/libvmaf";
 
-  nativeBuildInputs = [ meson ninja ];
+  nativeBuildInputs = [ meson ninja nasm ];
   outputs = [ "out" "dev" ];
   doCheck = true;
 
diff --git a/pkgs/development/libraries/qt-5/modules/qtdeclarative.nix b/pkgs/development/libraries/qt-5/modules/qtdeclarative.nix
index c22857a6dc6e..b611282294c6 100644
--- a/pkgs/development/libraries/qt-5/modules/qtdeclarative.nix
+++ b/pkgs/development/libraries/qt-5/modules/qtdeclarative.nix
@@ -1,4 +1,4 @@
-{ qtModule, lib, fetchpatch, python3, qtbase, qtsvg }:
+{ qtModule, lib, python3, qtbase, qtsvg }:
 
 with lib;
 
@@ -23,12 +23,4 @@ qtModule {
     "bin/qmlscene"
     "bin/qmltestrunner"
   ];
-  patches =
-    # https://mail.kde.org/pipermail/kde-distro-packagers/2020-June/000419.html
-    lib.optional (lib.versionAtLeast qtbase.version "5.14.2")
-      (fetchpatch {
-        url = "https://codereview.qt-project.org/gitweb?p=qt/qtdeclarative.git;a=patch;h=3e47ac319b0f53c43cc02a8356c2dec4f0daeef4";
-        sha256 = "0wvncg7047q73nm0svc6kb14sigwk7sc53r4778kn033aj0qqszj";
-        name = "qtdeclarative-QQuickItemView-fix-max-extent.patch";
-      });
 }
diff --git a/pkgs/development/libraries/wxsqlite3/default.nix b/pkgs/development/libraries/wxsqlite3/default.nix
index 9bea7f5e848b..9d80e5de4497 100644
--- a/pkgs/development/libraries/wxsqlite3/default.nix
+++ b/pkgs/development/libraries/wxsqlite3/default.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "wxsqlite3";
-  version = "4.5.1";
+  version = "4.6.0";
 
   src = fetchFromGitHub {
     owner = "utelle";
     repo = "wxsqlite3";
     rev = "v${version}";
-    sha256 = "0090f7r3blks18vifkna4l890fwaya58ajh9qblbw9065zj5hrm3";
+    sha256 = "0snsysfrr5h66mybls8r8k781v732dlfn4jdnmk348jgvny275fj";
   };
 
   nativeBuildInputs = [ autoreconfHook ];
diff --git a/pkgs/development/libraries/yder/default.nix b/pkgs/development/libraries/yder/default.nix
index 11eda01a76a8..b6f60ede98c2 100644
--- a/pkgs/development/libraries/yder/default.nix
+++ b/pkgs/development/libraries/yder/default.nix
@@ -4,13 +4,13 @@
 assert withSystemd -> systemd != null;
 stdenv.mkDerivation rec {
   pname = "yder";
-  version = "1.4.10";
+  version = "1.4.11";
 
   src = fetchFromGitHub {
     owner = "babelouest";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1m1aw4im1vvddkl7mknq0h0nj0x2zpql3r17lxhw4mmib05zbdgj";
+    sha256 = "0gm6l9y4jkxbq6vskdv1ivlq795ic28nhiyq21mzk3mx6j8klwip";
   };
 
   patches = [
diff --git a/pkgs/development/ocaml-modules/mirage-crypto/default.nix b/pkgs/development/ocaml-modules/mirage-crypto/default.nix
index e85fa5bef241..71c044a8cc12 100644
--- a/pkgs/development/ocaml-modules/mirage-crypto/default.nix
+++ b/pkgs/development/ocaml-modules/mirage-crypto/default.nix
@@ -4,11 +4,11 @@ buildDunePackage rec {
   minimumOCamlVersion = "4.08";
 
   pname = "mirage-crypto";
-  version = "0.8.3";
+  version = "0.8.4";
 
   src = fetchurl {
     url = "https://github.com/mirage/mirage-crypto/releases/download/v${version}/mirage-crypto-v${version}.tbz";
-    sha256 = "08rmhjrk046nnhbdk16vg7w7ink4bj6yq9dsjcky5psn982aqiwi";
+    sha256 = "1w09wllls4rp1abq0awffxf69dn0xciy6hsqz413ing5r151wjxr";
   };
 
   useDune2 = true;
diff --git a/pkgs/development/perl-modules/generic/default.nix b/pkgs/development/perl-modules/generic/default.nix
index 79c7919a3541..c7b57eae9067 100644
--- a/pkgs/development/perl-modules/generic/default.nix
+++ b/pkgs/development/perl-modules/generic/default.nix
@@ -42,7 +42,7 @@ toPerlModule(stdenv.mkDerivation (
     version = lib.getVersion attrs;                     # TODO: phase-out `attrs.name`
     builder = ./builder.sh;
     buildInputs = buildInputs ++ [ perl ];
-    nativeBuildInputs = nativeBuildInputs ++ [ (perl.dev or perl) ];
+    nativeBuildInputs = nativeBuildInputs ++ [ (perl.mini or perl) ];
     fullperl = buildPerl;
   }
 ))
diff --git a/pkgs/development/python-modules/urwid/default.nix b/pkgs/development/python-modules/urwid/default.nix
index 236b3a2e16f5..36fe4b51495d 100644
--- a/pkgs/development/python-modules/urwid/default.nix
+++ b/pkgs/development/python-modules/urwid/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildPythonPackage, fetchPypi, isPy27, glibcLocales }:
+{ stdenv, buildPythonPackage, fetchPypi, isPy3k, isPy27, glibcLocales }:
 
 buildPythonPackage rec {
   pname = "urwid";
@@ -14,6 +14,11 @@ buildPythonPackage rec {
   LC_ALL = "en_US.UTF-8";
   checkInputs = [ glibcLocales ];
 
+  # tests which assert on strings don't decode results correctly
+  doCheck = isPy3k;
+
+  pythonImportsCheck = [ "urwid" ];
+
   meta = with stdenv.lib; {
     description = "A full-featured console (xterm et al.) user interface library";
     homepage = "http://excess.org/urwid";
diff --git a/pkgs/development/tools/continuous-integration/fly/default.nix b/pkgs/development/tools/continuous-integration/fly/default.nix
index 55a4434658f8..34d30e08c500 100644
--- a/pkgs/development/tools/continuous-integration/fly/default.nix
+++ b/pkgs/development/tools/continuous-integration/fly/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "fly";
-  version = "6.4.1";
+  version = "6.5.0";
 
   src = fetchFromGitHub {
     owner = "concourse";
     repo = "concourse";
     rev = "v${version}";
-    sha256 = "16si1qm835yyvk2f0kwn9wnk8vpy5q4whgws1s2p6jr7dswg43h8";
+    sha256 = "0x8q1l56h24mmq01j3hib2qg0g44z82mxhmmljy8yv5s2iir0sfh";
   };
 
-  vendorSha256 = "0nv9q3j9cja8c6d7ac8fzb8zf82zz1z77f8cxvn3vxjki7fhlavm";
+  vendorSha256 = "1fxbxkg7disndlmb065abnfn7sn79qclkcbizmrq49f064w1ijr4";
 
   doCheck = false;
 
diff --git a/pkgs/development/tools/ginkgo/default.nix b/pkgs/development/tools/ginkgo/default.nix
new file mode 100644
index 000000000000..d3907718e9d4
--- /dev/null
+++ b/pkgs/development/tools/ginkgo/default.nix
@@ -0,0 +1,22 @@
+{ stdenv, buildGoModule, fetchFromGitHub }:
+
+buildGoModule rec {
+  pname = "ginkgo";
+  version = "1.14.0";
+
+  src = fetchFromGitHub {
+    owner = "onsi";
+    repo = "ginkgo";
+    rev = "v${version}";
+    sha256 = "0nwvz0pqk2jqscq88fhppad4flrr8avkxfgbci4xklbar4g8i32v";
+  };
+  vendorSha256 = "072amyw1ir18v9vk268j2y7dhw3lfwvxzvzsdqhnp50rxsa911bx";
+  doCheck = false;
+
+  meta = with stdenv.lib; {
+    description = "BDD Testing Framework for Go";
+    homepage = "https://github.com/onsi/ginkgo";
+    license = licenses.mit;
+    maintainers = with maintainers; [ saschagrunert ];
+  };
+}
diff --git a/pkgs/development/tools/gopls/default.nix b/pkgs/development/tools/gopls/default.nix
index 85aab26e415d..4ce65518a856 100644
--- a/pkgs/development/tools/gopls/default.nix
+++ b/pkgs/development/tools/gopls/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, go, buildGoModule, fetchgit }:
+{ stdenv, buildGoModule, fetchgit }:
 
 buildGoModule rec {
   pname = "gopls";
diff --git a/pkgs/development/tools/misc/terraform-ls/default.nix b/pkgs/development/tools/misc/terraform-ls/default.nix
index fe928bd3933c..714416f9685b 100644
--- a/pkgs/development/tools/misc/terraform-ls/default.nix
+++ b/pkgs/development/tools/misc/terraform-ls/default.nix
@@ -2,13 +2,13 @@
 
 buildGoPackage rec {
   pname = "terraform-ls";
-  version = "0.6.0";
+  version = "0.6.1";
 
   src = fetchFromGitHub {
     owner = "hashicorp";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0bb6bpdjp9yzbxvc6mz22lawn41ay0frdpgbd7zrm8nkvspc0rl7";
+    sha256 = "0yhpxb9dkwi6rlabr0sd5rk15q0bin6yhww171jrzlnfl036l0sl";
   };
 
   goPackagePath = "github.com/hashicorp/terraform-ls";
diff --git a/pkgs/development/tools/misc/terraformer/default.nix b/pkgs/development/tools/misc/terraformer/default.nix
new file mode 100644
index 000000000000..6ff0dd77aae2
--- /dev/null
+++ b/pkgs/development/tools/misc/terraformer/default.nix
@@ -0,0 +1,24 @@
+{ lib, buildGoModule, fetchFromGitHub }:
+
+buildGoModule rec {
+  pname = "terraformer";
+  version = "0.8.8";
+
+  src = fetchFromGitHub {
+    owner = "GoogleCloudPlatform";
+    repo = pname;
+    rev = version;
+    sha256 = "1lzf30vpa0blbkz4ngnhrn3hpbqflqd4sni4bly9yqh4fnc44nvi";
+  };
+
+  vendorSha256 = "087448wkaw6jxv9d26hck4w3vdh06vcgywna6ydkqvxr0hp011b6";
+
+  subPackages = [ "." ];
+
+  meta = with lib; {
+    description = "CLI tool to generate terraform files from existing infrastructure (reverse Terraform). Infrastructure to Code";
+    homepage = "https://github.com/GoogleCloudPlatform/terraformer";
+    license = licenses.asl20;
+    maintainers = [ maintainers.marsam ];
+  };
+}
diff --git a/pkgs/development/tools/rust/rust-analyzer/default.nix b/pkgs/development/tools/rust/rust-analyzer/default.nix
index 515ff94ac7a4..c9c87991a8ac 100644
--- a/pkgs/development/tools/rust/rust-analyzer/default.nix
+++ b/pkgs/development/tools/rust/rust-analyzer/default.nix
@@ -2,10 +2,10 @@
 
 {
   rust-analyzer-unwrapped = callPackage ./generic.nix rec {
-    rev = "2020-08-17";
+    rev = "2020-08-24";
     version = "unstable-${rev}";
-    sha256 = "1lkqhaygl6wak3hypmn3zb2h0v4n082xbpaywmzqr53vhw678sp0";
-    cargoSha256 = "00a2fxq1kwybng3gp33lkad4c7wrz0gypigxkalqkyy4nbg3qil4";
+    sha256 = "11q5shrq55krgpj7rjfqw84131j5g55zyrwww3cxcbr8ndi3xdnf";
+    cargoSha256 = "15kjcgxmigm0lwbp8p0kdxax86ldjqq9q8ysj6khfhqd0173184n";
   };
 
   rust-analyzer = callPackage ./wrapper.nix {} {
diff --git a/pkgs/development/tools/skaffold/default.nix b/pkgs/development/tools/skaffold/default.nix
index 032f64bc3481..a100988aead2 100644
--- a/pkgs/development/tools/skaffold/default.nix
+++ b/pkgs/development/tools/skaffold/default.nix
@@ -2,7 +2,7 @@
 
 buildGoPackage rec {
   pname = "skaffold";
-  version = "1.13.1";
+  version = "1.13.2";
 
   goPackagePath = "github.com/GoogleContainerTools/skaffold";
   subPackages = ["cmd/skaffold"];
@@ -19,7 +19,7 @@ buildGoPackage rec {
     owner = "GoogleContainerTools";
     repo = "skaffold";
     rev = "v${version}";
-    sha256 = "1v6napcpx8k45s8w55lbxahfc1p0qlvl597zgb4dzyg9w67fwnqk";
+    sha256 = "0xicf4bf52fnnwaimxrxv16x15lcmw12a5rrl0xjm4p059jnvy54";
   };
 
   nativeBuildInputs = [ installShellFiles ];
diff --git a/pkgs/games/osu-lazer/default.nix b/pkgs/games/osu-lazer/default.nix
index 59e044b482bb..074c24389a17 100644
--- a/pkgs/games/osu-lazer/default.nix
+++ b/pkgs/games/osu-lazer/default.nix
@@ -13,13 +13,13 @@ let
 
 in stdenv.mkDerivation rec {
   pname = "osu-lazer";
-  version = "2020.806.0";
+  version = "2020.820.0";
 
   src = fetchFromGitHub {
     owner = "ppy";
     repo = "osu";
     rev = version;
-    sha256 = "BelmqcDnrGH84fTs6M0krwWz6SHn2hOm7y+PNEOOOZM=";
+    sha256 = "0vszw0f5x0syshn8bnsbskxvknwpgbnm31kxwh1mfdr7pnxvw922";
   };
 
   patches = [ ./bypass-tamper-detection.patch ];
diff --git a/pkgs/games/osu-lazer/deps.nix b/pkgs/games/osu-lazer/deps.nix
index c29035e5724c..53f933d143bb 100644
--- a/pkgs/games/osu-lazer/deps.nix
+++ b/pkgs/games/osu-lazer/deps.nix
@@ -281,8 +281,8 @@
   })
   (fetchNuGet {
     name = "Markdig";
-    version = "0.20.0";
-    sha256 = "19qhvyj59i8zcxblpl4vqabb55y5xrk3iipmb656mid1b1m4jfkn";
+    version = "0.21.1";
+    sha256 = "119v22rvg51ifg54r1ndf2bw7hv1lf5wn3cd04ccg8d7r8c0yhbk";
   })
   (fetchNuGet {
     name = "Microsoft.Bcl.AsyncInterfaces";
@@ -306,23 +306,23 @@
   })
   (fetchNuGet {
     name = "Microsoft.CodeAnalysis.BannedApiAnalyzers";
-    version = "3.0.0";
-    sha256 = "19zfz84c1860na8qpkzv6va6d7dh1md9wkrb7c6x3brhjnj859hk";
+    version = "3.3.0";
+    sha256 = "04z03ir9sal5h9ha97isbh660jijslb8zfiaa48w2r2l6pabz5kd";
   })
   (fetchNuGet {
     name = "Microsoft.CodeAnalysis.Common";
-    version = "3.6.0";
-    sha256 = "0i8x90700jr30j580mpawj6d90fngrb2zpkjjbn7f8r2p1mz75y7";
+    version = "3.7.0";
+    sha256 = "0882492nx6x68b0pkh3q5xaawz0b2l5x35r40722ignyjnvjydph";
   })
   (fetchNuGet {
     name = "Microsoft.CodeAnalysis.CSharp";
-    version = "3.6.0";
-    sha256 = "0c44qp7lfpja6cq5nk7851qrswm2z1k2pnvsw43j9ybf10a27jrn";
+    version = "3.7.0";
+    sha256 = "0adw6rcag8wxydzyiyhls2mxaqkay5qlz25z1fxrlv5qnchqn0n5";
   })
   (fetchNuGet {
     name = "Microsoft.CodeAnalysis.CSharp.Workspaces";
-    version = "3.6.0";
-    sha256 = "1zc9328invqqpisdljw5vpm1kk416prfczakakw1vwkv9r54sd73";
+    version = "3.7.0";
+    sha256 = "15rlz65wbky0yq7b9s8xwk68dgrhgsk4rj88q9pyjxbm5938vrav";
   })
   (fetchNuGet {
     name = "Microsoft.CodeAnalysis.FxCopAnalyzers";
@@ -336,13 +336,13 @@
   })
   (fetchNuGet {
     name = "Microsoft.CodeAnalysis.Workspaces.Common";
-    version = "3.6.0";
-    sha256 = "176faadh1k9xcc8cc2qpkka9j1n426fdff1ax5ikmz2hbrspmigz";
+    version = "3.7.0";
+    sha256 = "00nm453w4n6kjsicmz5izvkf1ki9rp3xnc9n3y7a9b1g5sxg36fs";
   })
   (fetchNuGet {
     name = "Microsoft.CodeAnalysis.Workspaces.MSBuild";
-    version = "3.6.0";
-    sha256 = "0hxs9x5gpi7yvqf46bxh9niipb0jif7ak5baxw5l920787vysdhc";
+    version = "3.7.0";
+    sha256 = "1sh8s7b16j06p3gmzsgwd8690vagah4908bpa3gyz2fxgfnj46ax";
   })
   (fetchNuGet {
     name = "Microsoft.CodeQuality.Analyzers";
@@ -586,8 +586,8 @@
   })
   (fetchNuGet {
     name = "ppy.osu.Framework";
-    version = "2020.806.0";
-    sha256 = "1d4aprz81xbhk5addl1n7jwj8xxny51s6nvpn37alld0x6n7k8nv";
+    version = "2020.819.0";
+    sha256 = "1ghbbwpjjl0dp6gs1638v880hr7wwrn2jklqwbbckpx8g57bnq2m";
   })
   (fetchNuGet {
     name = "ppy.osu.Framework.NativeLibs";
@@ -596,8 +596,8 @@
   })
   (fetchNuGet {
     name = "ppy.osu.Game.Resources";
-    version = "2020.731.0";
-    sha256 = "1q58c627p0yz6b2y4c1hrrr4l9hii418y1vk6hv24x1csdsf3x8p";
+    version = "2020.812.0";
+    sha256 = "0fsg47bsffvk16clwwwav4yly1ykn09pyap46dvdmsxhjrzkvzb7";
   })
   (fetchNuGet {
     name = "ppy.osuTK.NS20";
diff --git a/pkgs/games/papermc/default.nix b/pkgs/games/papermc/default.nix
index 9695a3500586..c0446c4fa5b7 100644
--- a/pkgs/games/papermc/default.nix
+++ b/pkgs/games/papermc/default.nix
@@ -1,10 +1,10 @@
 { stdenv, fetchurl, jre }:
 let
-  mcVersion = "1.15.2";
-  buildNum = "161";
+  mcVersion = "1.16.2";
+  buildNum = "141";
   jar = fetchurl {
     url = "https://papermc.io/api/v1/paper/${mcVersion}/${buildNum}/download";
-    sha256 = "1jngj5djs1fjdj25wg9iszw0dsp56f386j8ydms7x4ky8s8kxyms";
+    sha256 = "1qhhnaysw9r73fpvj9qcmjah722a6a4s6g4cblna56n1hpz4lw1s";
   };
 in stdenv.mkDerivation {
   pname = "papermc";
diff --git a/pkgs/games/shattered-pixel-dungeon/default.nix b/pkgs/games/shattered-pixel-dungeon/default.nix
index 76f6ecfb81ae..6626e4df8a2f 100644
--- a/pkgs/games/shattered-pixel-dungeon/default.nix
+++ b/pkgs/games/shattered-pixel-dungeon/default.nix
@@ -10,13 +10,13 @@
 
 let
   pname = "shattered-pixel-dungeon";
-  version = "0.8.2";
+  version = "0.8.2b";
 
   src = fetchFromGitHub {
     owner = "00-Evan";
     repo = "shattered-pixel-dungeon";
     rev = "v${version}";
-    sha256 = "1ra697237vnpx8nsy7dzk958vlyf6jpx1k5dpbr8ybg6vgc3kqx3";
+    sha256 = "02ksxm7iknxfc7l8dl2pr1kyhfmi7vkchz0lh46w3p5mqf82psfb";
   };
 
   postPatch = ''
diff --git a/pkgs/misc/ghostscript/default.nix b/pkgs/misc/ghostscript/default.nix
index eca15faf1ad6..d3d06d98cb13 100644
--- a/pkgs/misc/ghostscript/default.nix
+++ b/pkgs/misc/ghostscript/default.nix
@@ -45,6 +45,11 @@ stdenv.mkDerivation rec {
   };
 
   patches = [
+    (fetchpatch {
+      name = "CVE-2020-15900.patch";
+      url = "https://github.com/ArtifexSoftware/ghostpdl/commit/5d499272b95a6b890a1397e11d20937de000d31b.patch";
+      sha256 = "1nnnrn8q33x7nc8227ygc60f3mj4bjzrhj40sxp6dah58rb5x5jz";
+    })
     ./urw-font-files.patch
     ./doc-no-ref.diff
     # rebased version of upstream http://git.ghostscript.com/?p=ghostpdl.git;a=patch;h=1b4c3669a20c,
diff --git a/pkgs/os-specific/linux/kernel/hardened/patches.json b/pkgs/os-specific/linux/kernel/hardened/patches.json
index 36277dd74cda..824eb1a69668 100644
--- a/pkgs/os-specific/linux/kernel/hardened/patches.json
+++ b/pkgs/os-specific/linux/kernel/hardened/patches.json
@@ -1,22 +1,22 @@
 {
     "4.14": {
-        "name": "linux-hardened-4.14.193.a.patch",
-        "sha256": "0hxr4v6ph29p0916dh894aknna5qxszcpz5xrci81xla3i50vy9v",
-        "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.14.193.a/linux-hardened-4.14.193.a.patch"
+        "name": "linux-hardened-4.14.194.a.patch",
+        "sha256": "07z3lr3mbm6c95d7fra2qp071n1c45f9241cl19zs63g00avi11p",
+        "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.14.194.a/linux-hardened-4.14.194.a.patch"
     },
     "4.19": {
-        "name": "linux-hardened-4.19.140.a.patch",
-        "sha256": "03y0kp89wka9bjw44y2jqralnwi7rjxbgm7wym1ad5yqd4q29l4d",
-        "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.19.140.a/linux-hardened-4.19.140.a.patch"
+        "name": "linux-hardened-4.19.141.a.patch",
+        "sha256": "0yiqkkp17pf9r6nakpnqhvmf8awpzp5n27cmh15ril7vn1y71sxw",
+        "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.19.141.a/linux-hardened-4.19.141.a.patch"
     },
     "5.4": {
-        "name": "linux-hardened-5.4.59.a.patch",
+        "name": "linux-hardened-5.4.60.a.patch",
         "sha256": "138kms73rlj5zmsb2ivjzz1jr5aa8y8pmwzx02c7j1qk08v82823",
-        "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.4.59.a/linux-hardened-5.4.59.a.patch"
+        "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.4.60.a/linux-hardened-5.4.60.a.patch"
     },
     "5.7": {
-        "name": "linux-hardened-5.7.16.a.patch",
-        "sha256": "1fiyd6qsf8r84p05cxhwma7zwi81xyn9pl6yci93n583z8n1k2sw",
-        "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.7.16.a/linux-hardened-5.7.16.a.patch"
+        "name": "linux-hardened-5.7.17.a.patch",
+        "sha256": "181b473y0hkw076hsndw6nfynr2yhcaypj48iqnk25hzcj40nnaz",
+        "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.7.17.a/linux-hardened-5.7.17.a.patch"
     }
 }
diff --git a/pkgs/os-specific/linux/kernel/linux-5.8.nix b/pkgs/os-specific/linux/kernel/linux-5.8.nix
index a7b929740d27..44ce98ce65ed 100644
--- a/pkgs/os-specific/linux/kernel/linux-5.8.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.8.nix
@@ -3,7 +3,7 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "5.8";
+  version = "5.8.3";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "1xgibkwb1yfl6qdlbxyagai0qc1pk5ark7giz1512hh6ma353xz7";
+    sha256 = "0y8prifvkywqsx5lk80bh31m505vinmicpvdrirgg0c9scg7x8lf";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-testing.nix b/pkgs/os-specific/linux/kernel/linux-testing.nix
index 6cd63e0be6be..cf2ca99f6f59 100644
--- a/pkgs/os-specific/linux/kernel/linux-testing.nix
+++ b/pkgs/os-specific/linux/kernel/linux-testing.nix
@@ -3,7 +3,7 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "5.9-rc1";
+  version = "5.9-rc2";
   extraMeta.branch = "5.9";
 
   # modDirVersion needs to be x.y.z, will always add .0
@@ -11,7 +11,7 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "https://git.kernel.org/torvalds/t/linux-${version}.tar.gz";
-    sha256 = "08x6s4wydbrr4rqq3zfxq6qmnha4ikn7m9rmdqd42hmxl2ynqxla";
+    sha256 = "0mdh6gsd305kcgfqzyfgl5m886asjm5030ahg63gyias3ywzn5wd";
   };
 
   # Should the testing kernels ever be built on Hydra?
diff --git a/pkgs/os-specific/linux/rfkill/default.nix b/pkgs/os-specific/linux/rfkill/default.nix
deleted file mode 100644
index 10d46a84821f..000000000000
--- a/pkgs/os-specific/linux/rfkill/default.nix
+++ /dev/null
@@ -1,20 +0,0 @@
-{ stdenv, fetchurl }:
-
-stdenv.mkDerivation rec {
-  name = "rfkill-0.5";
-
-  src = fetchurl {
-    url = "mirror://kernel/software/network/rfkill/${name}.tar.bz2";
-    sha256 = "01zs7p9kd92pxgcgwl5w46h3iyx4acfg6m1j5fgnflsaa350q5iy";
-  };
-
-  makeFlags = [ "PREFIX=$(out)" ];
-
-  meta = with stdenv.lib; {
-    homepage = "http://wireless.kernel.org/en/users/Documentation/rfkill";
-    description = "A tool to query, enable and disable wireless devices";
-    platforms = platforms.linux;
-    maintainers = [ maintainers.eelco ];
-    license = licenses.isc;
-  };
-}
diff --git a/pkgs/servers/etcd/3.4.nix b/pkgs/servers/etcd/3.4.nix
index db7bb5c939bd..be52b1bf1a58 100644
--- a/pkgs/servers/etcd/3.4.nix
+++ b/pkgs/servers/etcd/3.4.nix
@@ -2,21 +2,18 @@
 
 buildGoModule rec {
   pname = "etcd";
-  version = "3.4.10";
-
-  #vendorSha256 = null; revert to `null` for > 3.4.10
-
-  vendorSha256 = "1fhrycl8m8ddb7mwasbyfiwrl4d9lfdk7zd3mxb7ahkipdp2c94z";
-
-  doCheck = false;
+  version = "3.4.13";
 
   deleteVendor = true;
+  vendorSha256 = "0jlnh4789xa2dhbyp33k9r278kc588ykggamnnfqivb27s2646bc";
+
+  doCheck = false;
 
   src = fetchFromGitHub {
     owner = "etcd-io";
     repo = "etcd";
     rev = "v${version}";
-    sha256 = "07kzgh2rm7kzprlpnay6fq8lziiyhiqyikf1qjx8gjjsdsjy180f";
+    sha256 = "0bvky593241i60qf6793sxzsxwfl3f56cgscnva9f2jfhk157wmy";
   };
 
   buildPhase = ''
diff --git a/pkgs/servers/http/nginx/mainline.nix b/pkgs/servers/http/nginx/mainline.nix
index c67606785e5b..de74a72e7880 100644
--- a/pkgs/servers/http/nginx/mainline.nix
+++ b/pkgs/servers/http/nginx/mainline.nix
@@ -1,6 +1,6 @@
 { callPackage, ... }@args:
 
 callPackage ./generic.nix args {
-  version = "1.19.0";
-  sha256 = "1j1n3rlvan6l9j3vw8axbbdm96w7s0x6ygmgqvbplzfd3wbid9j4";
+  version = "1.19.2";
+  sha256 = "0wr4ss4gld7x717m4j3a6l6f7ijblrrd55y563lkwhvr7sqpn7vw";
 }
diff --git a/pkgs/servers/http/nginx/modules.nix b/pkgs/servers/http/nginx/modules.nix
index 9fcb3305f0ac..983e0f41ee91 100644
--- a/pkgs/servers/http/nginx/modules.nix
+++ b/pkgs/servers/http/nginx/modules.nix
@@ -4,10 +4,11 @@ let
 
   http_proxy_connect_module_generic = patchName: rec {
     src = fetchFromGitHub {
+      name = "http_proxy_connect_module_generic";
       owner = "chobits";
       repo = "ngx_http_proxy_connect_module";
-      rev = "002f8f9ef15562dc3691b977134518ad216d7a90";
-      sha256 = "163wg0xb7w5mwh6wrfarzcgaf6c7gb5qydgpi2wk35k551f7286s";
+      rev = "96ae4e06381f821218f368ad0ba964f87cbe0266";
+      sha256 = "1nc7z31i7x9dzp67kzgvs34hs6ps749y26wcpi3wf5mm63i803rh";
     };
 
     patches = [
@@ -18,12 +19,26 @@ let
 in
 
 {
+  fastcgi-cache-purge = throw "fastcgi-cache-purge was renamed to cache-purge";
+  ngx_aws_auth = throw "fastcgi-cache-purge was renamed to aws-auth";
+
+  aws-auth = {
+    src = fetchFromGitHub {
+      name = "aws-auth";
+      owner = "anomalizer";
+      repo = "ngx_aws_auth";
+      rev = "2.1.1";
+      sha256 = "10z67g40w7wpd13fwxyknkbg3p6hn61i4v8xw6lh27br29v1y6h9";
+    };
+  };
+
   brotli = {
     src = let gitsrc = pkgs.fetchFromGitHub {
+      name = "brotli";
       owner = "google";
       repo = "ngx_brotli";
-      rev = "e505dce68acc190cc5a1e780a3b0275e39f160ca";
-      sha256 = "00j48lffki62y1nmjyy81iklw5nlyzvrjy3z04qch4fp3p57hwla";
+      rev = "25f86f0bac1101b6512135eac5f93c49c63609e3";
+      sha256 = "02hfvfa6milj40qc2ikpb9f95sxqvxk4hly3x74kqhysbdi06hhv";
     }; in pkgs.runCommandNoCC "ngx_brotli-src" {} ''
       cp -a ${gitsrc} $out
       substituteInPlace $out/filter/config \
@@ -32,8 +47,19 @@ in
     inputs = [ pkgs.brotli ];
   };
 
+  cache-purge = {
+    src = fetchFromGitHub {
+      name = "cache-purge";
+      owner  = "nginx-modules";
+      repo   = "ngx_cache_purge";
+      rev    = "2.5.1";
+      sha256 = "0va4jz36mxj76nmq05n3fgnpdad30cslg7c10vnlhdmmic9vqncd";
+    };
+  };
+
   coolkit = {
     src = fetchFromGitHub {
+      name = "coolkit";
       owner  = "FRiCKLE";
       repo   = "ngx_coolkit";
       rev    = "0.2";
@@ -43,6 +69,7 @@ in
 
   dav = {
     src = fetchFromGitHub {
+      name = "dav";
       owner = "arut";
       repo = "nginx-dav-ext-module";
       rev = "v3.0.0";
@@ -53,24 +80,27 @@ in
 
   develkit = {
     src = fetchFromGitHub {
-      owner = "simpl";
+      name = "develkit";
+      owner = "vision5";
       repo = "ngx_devel_kit";
-      rev = "v0.3.1rc1";
-      sha256 = "00vqvpx67qra2hr85hkvj1dha4h7x7v9sblw7w1df11nq1gzsdbb";
+      rev = "v0.3.1";
+      sha256 = "1c5zfpvm0hrd9lp8rasmw79dnr2aabh0i6y11wzb783bp8m3p2sq";
     };
   };
 
   echo = {
     src = fetchFromGitHub {
+      name = "echo";
       owner = "openresty";
       repo = "echo-nginx-module";
-      rev = "v0.61";
-      sha256 = "0brjhhphi94ms4gia7za0mfx0png4jbhvq6j0nzjwp537iyiy23k";
+      rev = "v0.62";
+      sha256 = "0kr1y094yw1a9fyrf4w73ikq18w5ys463wza9n7yfl77xdwirnvl";
     };
   };
 
   fancyindex = {
     src = fetchFromGitHub {
+      name = "fancyindex";
       owner = "aperezdc";
       repo = "ngx-fancyindex";
       rev = "v0.4.4";
@@ -78,17 +108,9 @@ in
     };
   };
 
-  fastcgi-cache-purge = {
-    src = fetchFromGitHub {
-      owner  = "nginx-modules";
-      repo   = "ngx_cache_purge";
-      rev    = "2.5";
-      sha256 = "1f4kxagzvz10vqbcjwi57wink6xw3s1h7wlrrlrlpkmhfbf9704y";
-    };
-  };
-
   fluentd = {
     src = fetchFromGitHub {
+      name = "fluentd";
       owner = "fluent";
       repo = "nginx-fluentd-module";
       rev = "8af234043059c857be27879bc547c141eafd5c13";
@@ -96,12 +118,17 @@ in
     };
   };
 
-  http_proxy_connect_module_v16 = http_proxy_connect_module_generic "proxy_connect_rewrite_101504" // {
-    supports = with lib.versions; version: major version == "1" && minor version == "16";
+  http_proxy_connect_module_v18 = http_proxy_connect_module_generic "proxy_connect_rewrite_1018" // {
+    supports = with lib.versions; version: major version == "1" && minor version == "18";
+  };
+
+  http_proxy_connect_module_v19 = http_proxy_connect_module_generic "proxy_connect_rewrite_1018" // {
+    supports = with lib.versions; version: major version == "1" && minor version == "19";
   };
 
   ipscrub = {
     src = fetchFromGitHub {
+      name = "ipscrub";
       owner = "masonicboom";
       repo = "ipscrub";
       rev = "v1.0.1";
@@ -112,6 +139,7 @@ in
 
   limit-speed = {
     src = fetchFromGitHub {
+      name = "limit-speed";
       owner = "yaoweibin";
       repo = "nginx_limit_speed_module";
       rev = "f77ad4a56fbb134878e75827b40cf801990ed936";
@@ -121,6 +149,7 @@ in
 
   live ={
     src = fetchFromGitHub {
+      name = "live";
       owner = "arut";
       repo = "nginx-live-module";
       rev = "5e4a1e3a718e65e5206c24eba00d42b0d1c4b7dd";
@@ -130,6 +159,7 @@ in
 
   lua = {
     src = fetchFromGitHub {
+      name = "lua";
       owner = "openresty";
       repo = "lua-nginx-module";
       rev = "v0.10.15";
@@ -145,6 +175,7 @@ in
 
   lua-upstream = {
     src = fetchFromGitHub {
+      name = "lua-upstream";
       owner = "openresty";
       repo = "lua-upstream-nginx-module";
       rev = "v0.07";
@@ -164,16 +195,18 @@ in
 
   modsecurity-nginx = {
     src = fetchFromGitHub {
+      name = "modsecurity-nginx";
       owner = "SpiderLabs";
       repo = "ModSecurity-nginx";
-      rev = "v1.0.0";
-      sha256 = "0zzpdqhbdqqy8kjkszv0mrq6136ah9v3zwr1jbh312j8izmzdyi7";
+      rev = "v1.0.1";
+      sha256 = "0cbb3g3g4v6q5zc6an212ia5kjjad62bidnkm8b70i4qv1615pzf";
     };
     inputs = [ pkgs.curl pkgs.geoip pkgs.libmodsecurity pkgs.libxml2 pkgs.lmdb pkgs.yajl ];
   };
 
   moreheaders = {
     src = fetchFromGitHub {
+      name = "moreheaders";
       owner = "openresty";
       repo = "headers-more-nginx-module";
       rev = "v0.33";
@@ -183,6 +216,7 @@ in
 
   mpeg-ts ={
     src = fetchFromGitHub {
+      name = "mpeg-ts";
       owner = "arut";
       repo = "nginx-ts-module";
       rev = "v0.1.1";
@@ -192,29 +226,22 @@ in
 
   naxsi ={
     src = fetchFromGitHub {
+      name = "naxsi";
       owner = "nbs-system";
       repo = "naxsi";
-      rev = "0.56";
-      sha256 = "12kn6wbl8xqc19fi05ffprqps4pplg4a6i1cf01xc0d6brx1fg8v";
+      rev = "07a056ccd36bc3c5c40dc17991db226cb8cf6241";
+      sha256 = "1kdqy7by6ha2pl9lkkjxh4qrwcsrj2alm8fl129831h5y5xy8qx2";
     } + "/naxsi_src";
   };
 
-  ngx_aws_auth = {
-    src = fetchFromGitHub {
-      owner = "anomalizer";
-      repo = "ngx_aws_auth";
-      rev = "2.1.1";
-      sha256 = "10z67g40w7wpd13fwxyknkbg3p6hn61i4v8xw6lh27br29v1y6h9";
-    };
-  };
-
   opentracing = {
     src =
       let src' = fetchFromGitHub {
+        name = "opentracing";
         owner = "opentracing-contrib";
         repo = "nginx-opentracing";
-        rev = "v0.7.0";
-        sha256 = "16jzxhhsyfjaxb50jy5py9ppscidfx1shvc29ihldp0zs6d8khma";
+        rev = "v0.9.0";
+        sha256 = "02rf1909grbhvs9mjxrv7pwgbf7b8rpjw7j8rpwxag2rgvlsic3g";
       };
       in "${src'}/opentracing";
     inputs = [ pkgs.opentracing-cpp ];
@@ -225,6 +252,7 @@ in
       version = pkgs.psol.version;
 
       moduleSrc = fetchFromGitHub {
+        name   = "pagespeed";
         owner  = "pagespeed";
         repo   = "ngx_pagespeed";
         rev    = "v${version}-stable";
@@ -253,16 +281,18 @@ in
 
   pam = {
     src = fetchFromGitHub {
+      name = "pam";
       owner = "stogh";
       repo = "ngx_http_auth_pam_module";
-      rev = "v1.5.1";
-      sha256 = "031q006bcv10dzxi3mzamqiyg14p48v0bzd5mrwz073pbf0ba2fl";
+      rev = "v1.5.2";
+      sha256 = "06nydxk82rc9yrw4408nakb197flxh4z1yv935crg65fn9706rl7";
     };
     inputs = [ pkgs.pam ];
   };
 
   pinba = {
     src = fetchFromGitHub {
+      name = "pinba";
       owner = "tony2001";
       repo = "ngx_http_pinba_module";
       rev = "28131255d4797a7e2f82a6a35cf9fc03c4678fe6";
@@ -272,15 +302,17 @@ in
 
   push-stream ={
     src = fetchFromGitHub {
+      name = "push-stream";
       owner = "wandenberg";
       repo = "nginx-push-stream-module";
-      rev = "0.5.4";
-      sha256 = "0izn7lqrp2zfl738aqa9i8c5lba97wkhcnqg8qbw3ipp5cysb2hr";
+      rev = "1cdc01521ed44dc614ebb5c0d19141cf047e1f90";
+      sha256 = "0ijka32b37dl07k2jl48db5a32ix43jaczrpjih84cvq8yph0jjr";
     };
   };
 
   rtmp ={
     src = fetchFromGitHub {
+      name = "rtmp";
       owner = "arut";
       repo = "nginx-rtmp-module";
       rev = "v1.2.1";
@@ -290,6 +322,7 @@ in
 
   set-misc = {
     src = fetchFromGitHub {
+      name = "set-misc";
       owner = "openresty";
       repo = "set-misc-nginx-module";
       rev = "v0.32";
@@ -299,15 +332,17 @@ in
 
   shibboleth = {
     src = fetchFromGitHub {
+      name = "shibboleth";
       owner = "nginx-shib";
       repo = "nginx-http-shibboleth";
-      rev = "48b70d87bf7796d7813813a837e52b3a86e6f6f4";
-      sha256 = "0k8xcln5sf0m4r0m550dkhl07zhncp285dpysk6r4v6vqzqmhzdc";
+      rev = "5eadab80b2f5940d8873398bca000d93d3f0cf27";
+      sha256 = "1l0h3ic9mfsci89d0k5q3igkfpzq052ia25xj5hc8fq388yrhpap";
     };
   };
 
   sla = {
     src = fetchFromGitHub {
+      name = "sla";
       owner = "goldenclone";
       repo = "nginx-sla";
       rev = "7778f0125974befbc83751d0e1cadb2dcea57601";
@@ -317,6 +352,7 @@ in
 
   slowfs-cache = {
     src = fetchFromGitHub {
+      name = "slowfs-cache";
       owner  = "FRiCKLE";
       repo   = "ngx_slowfs_cache";
       rev    = "1.10";
@@ -326,6 +362,7 @@ in
 
   sorted-querystring = {
     src = fetchFromGitHub {
+      name = "sorted-querystring";
       owner = "wandenberg";
       repo = "nginx-sorted-querystring-module";
       rev = "0.3";
@@ -335,7 +372,8 @@ in
 
   statsd = {
     src = fetchFromGitHub {
-      owner = "apcera";
+      name = "statsd";
+      owner = "harvesthq";
       repo = "nginx-statsd";
       rev = "b970e40467a624ba710c9a5106879a0554413d15";
       sha256 = "1x8j4i1i2ahrr7qvz03vkldgdjdxi6mx75mzkfizfcc8smr4salr";
@@ -344,6 +382,7 @@ in
 
   stream-sts = {
     src = fetchFromGitHub {
+      name = "stream-sts";
       owner = "vozlt";
       repo = "nginx-module-stream-sts";
       rev = "v0.1.1";
@@ -353,6 +392,7 @@ in
 
   sts = {
     src = fetchFromGitHub {
+      name = "sts";
       owner = "vozlt";
       repo = "nginx-module-sts";
       rev = "v0.1.1";
@@ -362,15 +402,17 @@ in
 
   subsFilter = {
     src = fetchFromGitHub {
+      name = "subsFilter";
       owner = "yaoweibin";
       repo = "ngx_http_substitutions_filter_module";
-      rev = "bc58cb11844bc42735bbaef7085ea86ace46d05b";
-      sha256 = "1q5hr3sqys4f365gzjci549rn9ylhgj4xb29ril04zr5vkhzlnar";
+      rev = "b8a71eacc7f986ba091282ab8b1bbbc6ae1807e0";
+      sha256 = "027jxzx66q9a6ycn47imjh40xmnqr0z423lz0ds3w4rf1c2x130f";
     };
   };
 
   sysguard = {
     src = fetchFromGitHub {
+      name = "sysguard";
       owner = "vozlt";
       repo = "nginx-module-sysguard";
       rev = "e512897f5aba4f79ccaeeebb51138f1704a58608";
@@ -380,15 +422,17 @@ in
 
   upstream-check = {
     src = fetchFromGitHub {
+      name = "upstream-check";
       owner = "yaoweibin";
       repo = "nginx_upstream_check_module";
-      rev = "007f76f7adbcbd6abd9352502af1a4ae463def85";
-      sha256 = "1qcg7c9rcl70wr1qf188shnn9s2f7cxnlw05s6scbvlgnf6ik6in";
+      rev = "e538034b6ad7992080d2403d6d3da56e4f7ac01e";
+      sha256 = "06y7k04072xzqyqyb08m0vaaizkp4rfwm0q7i735imbzw2rxb74l";
     };
   };
 
   upstream-tarantool = {
     src = fetchFromGitHub {
+      name = "upstream-tarantool";
       owner = "tarantool";
       repo = "nginx_upstream_module";
       rev = "v2.7.1";
@@ -399,6 +443,7 @@ in
 
   url = {
     src = fetchFromGitHub {
+      name = "url";
       owner = "vozlt";
       repo = "nginx-module-url";
       rev = "9299816ca6bc395625c3683fbd2aa7b916bfe91e";
@@ -408,6 +453,7 @@ in
 
   video-thumbextractor = {
     src = fetchFromGitHub {
+      name = "video-thumbextractor";
       owner = "wandenberg";
       repo = "nginx-video-thumbextractor-module";
       rev = "0.9.0";
@@ -418,6 +464,7 @@ in
 
   vts = {
     src = fetchFromGitHub {
+      name = "vts";
       owner = "vozlt";
       repo = "nginx-module-vts";
       rev = "v0.1.18";
diff --git a/pkgs/shells/rssh/default.nix b/pkgs/shells/rssh/default.nix
deleted file mode 100644
index b2bec51a95ed..000000000000
--- a/pkgs/shells/rssh/default.nix
+++ /dev/null
@@ -1,97 +0,0 @@
-# CAVEATS:
-# - Have only tested this with rsync, scp, and sftp. cvs support should work, but chroot integration is unlikely to function without further work
-# - It is compiled without rdist support because rdist is ludicrously ancient (and not already in nixpkgs)
-
-{ stdenv, fetchurl, openssh, rsync, cvs }:
-
-stdenv.mkDerivation rec {
-  pname = "rssh";
-  version = "2.3.4";
-
-  src = fetchurl {
-    url = "mirror://sourceforge/rssh/rssh/${version}/${pname}-${version}.tar.gz";
-    sha256 = "f30c6a760918a0ed39cf9e49a49a76cb309d7ef1c25a66e77a41e2b1d0b40cd9";
-  };
-
-  patches = [
-    ./fix-config-path.patch
-
-    # Patches from AUR
-    (fetchurl {
-      url = "https://aur.archlinux.org/cgit/aur.git/plain/0001-fail-logging.patch?h=rssh";
-      name = "0001-fail-logging.patch";
-      sha256 = "d30f2f4fdb1b57f94773f5b0968a4da3356b14a040efe69ec1e976c615035c65";
-    })
-    (fetchurl {
-      url = "https://aur.archlinux.org/cgit/aur.git/plain/0002-info-to-debug.patch?h=rssh";
-      name = "0002-info-to-debug.patch";
-      sha256 = "86f6ecf34f62415b0d6204d4cbebc47322dc2ec71732d06aa27758e35d688fcd";
-    })
-    (fetchurl {
-      url = "https://aur.archlinux.org/cgit/aur.git/plain/0003-man-page-spelling.patch?h=rssh";
-      name = "0003-man-page-spelling.patch";
-      sha256 = "455b3bbccddf1493999d00c2cd46e62930ef4fd8211e0b7d3a89d8010d6a5431";
-    })
-    (fetchurl {
-      url = "https://aur.archlinux.org/cgit/aur.git/plain/0004-mkchroot.patch?h=rssh";
-      name = "0004-mkchroot.patch";
-      sha256 = "f7fd8723d2aa94e64e037c13c2f263a52104af680ab52bfcaea73dfa836457c2";
-    })
-    (fetchurl {
-      url = "https://aur.archlinux.org/cgit/aur.git/plain/0005-mkchroot-arch.patch?h=rssh";
-      name = "0005-mkchroot-arch.patch";
-      sha256 = "ac8894c4087a063ae8267d2fdfcde69c2fe6b67a8ff5917e4518b8f73f08ba3f";
-    })
-    (fetchurl {
-      url = "https://aur.archlinux.org/cgit/aur.git/plain/0006-mkchroot-symlink.patch?h=rssh";
-      name = "0006-mkchroot-symlink.patch";
-      sha256 = "bce98728cb9b55c92182d4901c5f9adf49376a07c5603514b0004e3d1c85e9c7";
-    })
-    (fetchurl {
-      url = "https://aur.archlinux.org/cgit/aur.git/plain/0007-destdir.patch?h=rssh";
-      name = "0007-destdir.patch";
-      sha256 = "7fa03644f81dc37d77cc7e2cad994f17f91b2b8a49b1a74e41030a4ac764385e";
-    })
-    (fetchurl {
-      url = "https://aur.archlinux.org/cgit/aur.git/plain/0008-rsync-protocol.patch?h=rssh";
-      name = "0008-rsync-protocol.patch";
-      sha256 = "0c772afe9088eeded129ead86775ef18e58c318bbc58fc3e2585e7ff09cc5e91";
-    })
-  ];
-
-  # Run this after to avoid conflict with patches above
-  postPatch = ''
-    sed -i '/chmod u+s/d' Makefile.in
-  '';
-
-
-  buildInputs = [ openssh rsync cvs ];
-
-  configureFlags = [
-    "--with-sftp-server=${openssh}/libexec/sftp-server"
-    "--with-scp=${openssh}/bin/scp"
-    "--with-rsync=${rsync}/bin/rsync"
-    "--with-cvs=${cvs}/bin/cvs"
-  ];
-
-
-  meta = with stdenv.lib; {
-    description = "A restricted shell for use with OpenSSH, allowing only scp and/or sftp";
-    longDescription = ''
-      rssh also includes support for rsync and cvs. For example, if you have a server which you only want to allow users to copy files off of via scp, without providing shell access, you can use rssh to do that.
-    '';
-    homepage = "http://www.pizzashack.org/rssh/";
-    license = licenses.bsd2;
-    platforms = platforms.linux;
-    maintainers = with maintainers; [ arobyn ];
-    knownVulnerabilities = [
-      "CVE-2019-1000018"
-      "CVE-2019-3463"
-      "CVE-2019-3464"
-    ];
-  };
-
-  passthru = {
-    shellPath = "/bin/rssh";
-  };
-}
diff --git a/pkgs/shells/rssh/fix-config-path.patch b/pkgs/shells/rssh/fix-config-path.patch
deleted file mode 100644
index eecffb376ab3..000000000000
--- a/pkgs/shells/rssh/fix-config-path.patch
+++ /dev/null
@@ -1,12 +0,0 @@
-diff -Naur rssh-2.3.4/Makefile.in rssh-2.3.4-fixed/Makefile.in
---- rssh-2.3.4/Makefile.in	2012-11-27 11:19:34.000000000 +1100
-+++ rssh-2.3.4-fixed/Makefile.in	2015-11-11 21:13:58.516651742 +1100
-@@ -186,7 +186,7 @@
- sysconfdir = @sysconfdir@
- target_alias = @target_alias@
- AUTOMAKE_OPTIONS = nostdinc
--ourdefs = -DPATH_RSSH_CONFIG=\"@sysconfdir@/rssh.conf\" -DPATH_CHROOT_HELPER=\"@libexecdir@/rssh_chroot_helper\"
-+ourdefs = -DPATH_RSSH_CONFIG=\"/etc/rssh.conf\" -DPATH_CHROOT_HELPER=\"@libexecdir@/rssh_chroot_helper\"
- ourflags = @defcflags@ @static@ 
- AM_CFLAGS = $(ourflags)
- nodist_rssh_SOURCES = main.c pathnames.h config.h
diff --git a/pkgs/shells/zsh/oh-my-zsh/default.nix b/pkgs/shells/zsh/oh-my-zsh/default.nix
index 8fc189fbf157..2fce32e018e5 100644
--- a/pkgs/shells/zsh/oh-my-zsh/default.nix
+++ b/pkgs/shells/zsh/oh-my-zsh/default.nix
@@ -4,13 +4,13 @@
 { stdenv, fetchgit }:
 
 stdenv.mkDerivation rec {
-  version = "2020-08-20";
+  version = "2020-08-24";
   pname = "oh-my-zsh";
-  rev = "03b6a72576cb0f0b53abde25d409e8026d5c4ee9";
+  rev = "cfb86cd08d3b24fd4b59d0d35b3af1f589c891fa";
 
   src = fetchgit { inherit rev;
     url = "https://github.com/ohmyzsh/ohmyzsh";
-    sha256 = "0bm043r3pffbv74drrv2xa66rsadrrsayscwwnfgp24svdmx7a6z";
+    sha256 = "0af37smv0bqw37bng2halzgszf8y3m2sxahdff54m16asm0py2cr";
   };
 
   pathsToLink = [ "/share/oh-my-zsh" ];
diff --git a/pkgs/tools/admin/eksctl/default.nix b/pkgs/tools/admin/eksctl/default.nix
index 27ea33b60358..7c240aa41319 100644
--- a/pkgs/tools/admin/eksctl/default.nix
+++ b/pkgs/tools/admin/eksctl/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "eksctl";
-  version = "0.25.0";
+  version = "0.26.0";
 
   src = fetchFromGitHub {
     owner = "weaveworks";
     repo = pname;
     rev = version;
-    sha256 = "1p3dzzbf840csqlgxyykmyg13z0nkzy4nkqq9y8jlpdm745vcryv";
+    sha256 = "1av5w32ia68j2xrw4m16mzm9jn6xlap93kwi8iqw0s6wgihzadds";
   };
 
-  vendorSha256 = "1msid4857wsh4qp1f7nyrmpzjv3sklh49cl7a9c1a3qr9m99w4yb";
+  vendorSha256 = "13sc4yrzgx2sm98whibfy2kjia3yy9cdvibvhbvg2lz2spprjb9v";
 
   doCheck = false;
 
diff --git a/pkgs/tools/backup/bup/default.nix b/pkgs/tools/backup/bup/default.nix
index 57ab854a33cb..ee6ae0a29342 100644
--- a/pkgs/tools/backup/bup/default.nix
+++ b/pkgs/tools/backup/bup/default.nix
@@ -5,7 +5,7 @@
 
 assert par2Support -> par2cmdline != null;
 
-let version = "0.30.1"; in
+let version = "0.31"; in
 
 with stdenv.lib;
 
@@ -17,7 +17,7 @@ stdenv.mkDerivation {
     repo = "bup";
     owner = "bup";
     rev = version;
-    sha256 = "0z9rpmmi6mbm48ynd6izr0f8l3cklfyar6gjy0c8z9zal1ac9r55";
+    sha256 = "03kmmdlgg0p5z39bhckkf91mmq55wghb93ghqvv9f9gaby1diw4z";
   };
 
   buildInputs = [
diff --git a/pkgs/tools/bluetooth/blueberry/default.nix b/pkgs/tools/bluetooth/blueberry/default.nix
index 4b7692d49d6a..16563c380998 100644
--- a/pkgs/tools/bluetooth/blueberry/default.nix
+++ b/pkgs/tools/bluetooth/blueberry/default.nix
@@ -8,7 +8,7 @@
 , intltool
 , pavucontrol
 , python3Packages
-, rfkill
+, utillinux
 , wrapGAppsHook
 }:
 
@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
     cinnamon.xapps
     gnome3.gnome-bluetooth
     python3Packages.python
-    rfkill
+    utillinux
   ];
 
   pythonPath = with python3Packages; [
@@ -68,8 +68,8 @@ stdenv.mkDerivation rec {
       --replace /usr/lib/blueberry $out/lib/blueberry \
       --replace /usr/share $out/share
     substituteInPlace $out/lib/blueberry/rfkillMagic.py \
-      --replace /usr/bin/rfkill ${rfkill}/bin/rfkill \
-      --replace /usr/sbin/rfkill ${rfkill}/bin/rfkill \
+      --replace /usr/bin/rfkill ${utillinux}/bin/rfkill \
+      --replace /usr/sbin/rfkill ${utillinux}/bin/rfkill \
       --replace /usr/lib/blueberry $out/lib/blueberry
     substituteInPlace $out/share/applications/blueberry.desktop \
       --replace Exec=blueberry Exec=$out/bin/blueberry
diff --git a/pkgs/tools/filesystems/avfs/default.nix b/pkgs/tools/filesystems/avfs/default.nix
index eaf9ac634a17..edfcaa0d8f81 100644
--- a/pkgs/tools/filesystems/avfs/default.nix
+++ b/pkgs/tools/filesystems/avfs/default.nix
@@ -2,10 +2,10 @@
 
 stdenv.mkDerivation rec {
   pname = "avfs";
-  version = "1.1.2";
+  version = "1.1.3";
   src = fetchurl {
     url = "mirror://sourceforge/avf/${version}/${pname}-${version}.tar.bz2";
-    sha256 = "035b6y49nzgswf5n70aph8pm48sbv9nqwlnp3wwbq892c39kk4xn";
+    sha256 = "1psh8k7g7rb0gn7aygbjv86kxyi9xq07barxksa99nnmq3lc2kjg";
   };
 
   nativeBuildInputs = [ pkgconfig ];
diff --git a/pkgs/tools/filesystems/bashmount/default.nix b/pkgs/tools/filesystems/bashmount/default.nix
index 206e68ce1c29..70a4c1419c83 100644
--- a/pkgs/tools/filesystems/bashmount/default.nix
+++ b/pkgs/tools/filesystems/bashmount/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "bashmount";
-  version = "4.3.0";
+  version = "4.3.1";
 
   src = fetchFromGitHub {
     owner = "jamielinux";
     repo = "bashmount";
     rev = version;
-    sha256 = "1idjyl5dr8a72w3lg15qx03wgc5mj2ga2v2jkyb8v9gi5ahl03mn";
+    sha256 = "0pqjaib0qiwjq0ral5yjz4iq8hpaj9mqkhlihgfz0xigcn9lxwpf";
   };
 
   installPhase = ''
diff --git a/pkgs/tools/misc/chezmoi/default.nix b/pkgs/tools/misc/chezmoi/default.nix
index a87aa33ab116..d7b7646afec3 100644
--- a/pkgs/tools/misc/chezmoi/default.nix
+++ b/pkgs/tools/misc/chezmoi/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "chezmoi";
-  version = "1.8.4";
+  version = "1.8.5";
 
   src = fetchFromGitHub {
     owner = "twpayne";
     repo = "chezmoi";
     rev = "v${version}";
-    sha256 = "0m8ik01y1lag3mgg3g4rxvzndh86b972hv2702dqs28l5zy5h3mv";
+    sha256 = "16sv1kbd66rllnnl851y3x54wkl0p7g0qsblprvfr9715svk1835";
   };
 
-  vendorSha256 = "18s60k7y64z12lx9lgj13fl1jh0aiqinwxrsz751d2iqhgdi2jja";
+  vendorSha256 = "1i9d672mzmb97s26n0v01m70g4viyl9pdk25haxr6ny4rab2wbi7";
 
   doCheck = false;
 
diff --git a/pkgs/tools/misc/colorpicker/default.nix b/pkgs/tools/misc/colorpicker/default.nix
new file mode 100644
index 000000000000..3de5d33617c7
--- /dev/null
+++ b/pkgs/tools/misc/colorpicker/default.nix
@@ -0,0 +1,27 @@
+{ stdenv, fetchFromGitHub, pkg-config, gtk2 }:
+
+stdenv.mkDerivation rec {
+  pname = "colorpicker";
+  version = "git-2018-01-14";
+
+  src = fetchFromGitHub {
+    owner = "Ancurio";
+    repo  = "colorpicker";
+    rev   = "287676947e6e3b5b0cee784aeb1638cf22f0ce17";
+    sha256 = "1kj1dpb79llrfpszraaz6r7ci114zqi5rmqxwsvq2dnnpjxyi29r";
+  };
+
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [ gtk2 ];
+
+  installPhase = ''
+    install -Dt $out/bin colorpicker
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Click on a pixel on your screen and print its color value in RGB";
+    homepage = "https://github.com/Ancurio/colorpicker";
+    maintainers = with maintainers; [ jb55 ];
+    license = licenses.mit;
+  };
+}
diff --git a/pkgs/tools/networking/chrony/default.nix b/pkgs/tools/networking/chrony/default.nix
index 0a8ae10eb134..6c8254c797b7 100644
--- a/pkgs/tools/networking/chrony/default.nix
+++ b/pkgs/tools/networking/chrony/default.nix
@@ -5,11 +5,11 @@ assert stdenv.isLinux -> libcap != null;
 
 stdenv.mkDerivation rec {
   pname = "chrony";
-  version = "3.5";
+  version = "3.5.1";
 
   src = fetchurl {
     url = "https://download.tuxfamily.org/chrony/${pname}-${version}.tar.gz";
-    sha256 = "1d9r2dhslll4kzdmxrj0qfgwq1b30d4l3s5cwr8yr93029dpj0jf";
+    sha256 = "19ywl8a3lb2id7lcna5hp2g4pjnfwdc9ihr0fk6i9m45vdq2za0v";
   };
 
   patches = [
diff --git a/pkgs/tools/networking/oneshot/default.nix b/pkgs/tools/networking/oneshot/default.nix
index e9772b193d32..f02370ab69d5 100644
--- a/pkgs/tools/networking/oneshot/default.nix
+++ b/pkgs/tools/networking/oneshot/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "oneshot";
-  version = "1.1.3";
+  version = "1.2.0";
 
   src = fetchFromGitHub {
     owner = "raphaelreyna";
     repo = "oneshot";
     rev = "v${version}";
-    sha256 = "14s5cl1g0rgqj7fj699xgz2kmkzym1zpckhv3h33ypsn4dq7gjh2";
+    sha256 = "11xmvqj7md970rjhkg1zj2w6yqpw6cj83aw37a82sfdn90kyhg9d";
   };
 
-  vendorSha256 = "0v53dsj0w959pmvk6v1i7rwlfd2y0vrghxlwkgidw0sf775qpgvy";
+  vendorSha256 = "1cxr96yrrmz37r542mc5376jll9lqjqm18k8761h9jqfbzmh9rkp";
 
   doCheck = false;
 
diff --git a/pkgs/tools/networking/vpn-slice/default.nix b/pkgs/tools/networking/vpn-slice/default.nix
new file mode 100644
index 000000000000..9511c214c08c
--- /dev/null
+++ b/pkgs/tools/networking/vpn-slice/default.nix
@@ -0,0 +1,25 @@
+{ lib, buildPythonApplication, python3Packages, fetchFromGitHub }:
+
+buildPythonApplication rec {
+  pname = "vpn-slice";
+  version = "0.14";
+
+  src = fetchFromGitHub {
+    owner = "dlenski";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "1z2mdl3arzl95zrj4ir57f762gcimmmq5nk91j679cshxz4snxyr";
+  };
+
+  propagatedBuildInputs = with python3Packages; [ setproctitle dnspython ];
+
+  doCheck = false;
+
+  meta = with lib; {
+    homepage = "https://github.com/dlenski/vpn-slice";
+    description =
+      "vpnc-script replacement for easy and secure split-tunnel VPN setup";
+    license = licenses.gpl3;
+    maintainers = with maintainers; [ jdbaldry ];
+  };
+}
diff --git a/pkgs/tools/system/bpytop/default.nix b/pkgs/tools/system/bpytop/default.nix
index 2751689209ba..a408f44ec10c 100644
--- a/pkgs/tools/system/bpytop/default.nix
+++ b/pkgs/tools/system/bpytop/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "bpytop";
-  version = "1.0.13";
+  version = "1.0.21";
 
   src = fetchFromGitHub {
     owner = "aristocratos";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1mrzl5ry5janifykp58gf5g7xw7522wvpp8hgq2hpfx52z6my1bj";
+    sha256 = "10cygn4srmzk1b279hrlp4rjbldkzq7354fhm0jbmd3rp15b454p";
   };
 
   buildInputs = [ makeWrapper ];
diff --git a/pkgs/tools/text/ugrep/default.nix b/pkgs/tools/text/ugrep/default.nix
index 3f3cbd8efcdb..3e225ec3567c 100644
--- a/pkgs/tools/text/ugrep/default.nix
+++ b/pkgs/tools/text/ugrep/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "ugrep";
-  version = "2.5.1";
+  version = "2.5.3";
 
   src = fetchFromGitHub {
     owner = "Genivia";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0z62rqcvcz8iy6ig7y05gn90m0pn99jc0ll9b82kdbr257kz91r1";
+    sha256 = "16ly1dz8wxnjk6kc88dl2x0ijmzw5v87fhai9fnardwfmycn7ivc";
   };
 
   buildInputs = [ boost bzip2 lz4 pcre2 xz zlib ];
diff --git a/pkgs/tools/text/vale/default.nix b/pkgs/tools/text/vale/default.nix
index 65b2678dfc09..69390b4d3d37 100644
--- a/pkgs/tools/text/vale/default.nix
+++ b/pkgs/tools/text/vale/default.nix
@@ -2,7 +2,7 @@
 
 buildGoModule rec {
   pname = "vale";
-  version = "2.3.2";
+  version = "2.3.3";
 
   subPackages = [ "." ];
   outputs = [ "out" "data" ];
@@ -11,7 +11,7 @@ buildGoModule rec {
     owner  = "errata-ai";
     repo   = "vale";
     rev    = "v${version}";
-    sha256 = "0accs8ygg2h5hk8n4d5hs1fpxp9mlbzic6f4dwrygi463z7c3icc";
+    sha256 = "13b565l87nm3gpxxhw1bpjx7yqcgf5124k3wh7r149z38xyqc3wk";
   };
 
   vendorSha256 = null;
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 54c8948f4a58..b020d6fac559 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -467,9 +467,11 @@ mapAliases ({
   robomongo = robo3t; #added 2017-09-28
   rocm-runtime-ext = throw "rocm-runtime-ext has been removed, since its functionality was added to rocm-runtime"; #added 2020-08-21
   rssglx = rss-glx; #added 2015-03-25
+  rssh = throw "rssh has been removed from nixpkgs: no upstream releases since 2012, several known CVEs"; # added 2020-08-25
   recordmydesktop = throw "recordmydesktop has been removed from nixpkgs, as it's unmaintained and uses deprecated libraries"; # added 2019-12-10
   gtk-recordmydesktop = throw "gtk-recordmydesktop has been removed from nixpkgs, as it's unmaintained and uses deprecated libraries"; # added 2019-12-10
   qt-recordmydesktop = throw "qt-recordmydesktop has been removed from nixpkgs, as it's abandoned and uses deprecated libraries"; # added 2019-12-10
+  rfkill = throw "rfkill has been removed, as it's included in util-linux"; # added 2020-08-23
   rkt = throw "rkt was archived by upstream"; # added 2020-05-16
   ruby_2_0_0 = throw "deprecated 2018-0213: use a newer version of ruby";
   ruby_2_1_0 = throw "deprecated 2018-0213: use a newer version of ruby";
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 9e0b4f239976..7fd37a1718d9 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -180,6 +180,8 @@ in
 
   colorz = callPackage ../tools/misc/colorz { };
 
+  colorpicker = callPackage ../tools/misc/colorpicker { };
+
   comedilib = callPackage ../development/libraries/comedilib {  };
 
   cpu-x = callPackage ../applications/misc/cpu-x { };
@@ -3984,7 +3986,7 @@ in
   gocryptfs = callPackage ../tools/filesystems/gocryptfs { };
 
   godot = callPackage ../development/tools/godot {};
-  
+
   godot-headless = callPackage ../development/tools/godot/headless.nix { };
 
   godot-server = callPackage ../development/tools/godot/server.nix { };
@@ -7629,6 +7631,8 @@ in
 
   vpnc = callPackage ../tools/networking/vpnc { };
 
+  vpn-slice = python3Packages.callPackage ../tools/networking/vpn-slice { };
+
   vp = callPackage ../applications/misc/vp {
     # Enable next line for console graphics. Note that
     # it requires `sixel` enabled terminals such as mlterm
@@ -8257,8 +8261,6 @@ in
 
   tcsh = callPackage ../shells/tcsh { };
 
-  rssh = callPackage ../shells/rssh { };
-
   rush = callPackage ../shells/rush { };
 
   xonsh = callPackage ../shells/xonsh { };
@@ -8468,6 +8470,8 @@ in
     '';
   };
 
+  copper = callPackage ../development/compilers/copper {};
+
   inherit (callPackages ../development/compilers/crystal {
     inherit (llvmPackages_10) stdenv clang llvm;
   })
@@ -11450,6 +11454,8 @@ in
   terraform-lsp = callPackage ../development/tools/misc/terraform-lsp { };
   terraform-ls = callPackage ../development/tools/misc/terraform-ls { };
 
+  terraformer = callPackage ../development/tools/misc/terraformer { };
+
   texinfo413 = callPackage ../development/tools/misc/texinfo/4.13a.nix { };
   texinfo4 = texinfo413;
   texinfo5 = callPackage ../development/tools/misc/texinfo/5.2.nix { };
@@ -16833,7 +16839,7 @@ in
     enableMDNS = true;
     enableDomainController = true;
     enableRegedit = true;
-    enableCephFS = true;
+    enableCephFS = !pkgs.stdenv.hostPlatform.isAarch64;
     enableGlusterFS = true;
   });
 
@@ -17991,6 +17997,8 @@ in
 
   iferr = callPackage ../development/tools/iferr { };
 
+  ginkgo = callPackage ../development/tools/ginkgo { };
+
   go-bindata = callPackage ../development/tools/go-bindata { };
 
   go-bindata-assetfs = callPackage ../development/tools/go-bindata-assetfs { };
@@ -18174,8 +18182,6 @@ in
 
   regionset = callPackage ../os-specific/linux/regionset { };
 
-  rfkill = callPackage ../os-specific/linux/rfkill { };
-
   rfkill_udev = callPackage ../os-specific/linux/rfkill/udev.nix { };
 
   riscv-pk = callPackage ../misc/riscv-pk { };
@@ -20902,6 +20908,8 @@ in
 
   i3lock-fancy = callPackage ../applications/window-managers/i3/lock-fancy.nix { };
 
+  i3lock-fancy-rapid = callPackage ../applications/window-managers/i3/lock-fancy-rapid.nix { };
+
   i3lock-pixeled = callPackage ../misc/screensavers/i3lock-pixeled { };
 
   betterlockscreen = callPackage ../misc/screensavers/betterlockscreen {
diff --git a/pkgs/top-level/make-tarball.nix b/pkgs/top-level/make-tarball.nix
index 5e307305af58..f65829e29cab 100644
--- a/pkgs/top-level/make-tarball.nix
+++ b/pkgs/top-level/make-tarball.nix
@@ -40,7 +40,6 @@ releaseTools.sourceTarball {
   checkPhase = ''
     set -o pipefail
 
-    export NIX_DB_DIR=$TMPDIR
     export NIX_STATE_DIR=$TMPDIR
     export NIX_PATH=nixpkgs=$TMPDIR/barf.nix
     opts=(--option build-users-group "")
diff --git a/pkgs/top-level/metrics.nix b/pkgs/top-level/metrics.nix
index 244b0ce7a664..2bfcb9d5d80a 100644
--- a/pkgs/top-level/metrics.nix
+++ b/pkgs/top-level/metrics.nix
@@ -7,7 +7,6 @@ runCommand "nixpkgs-metrics"
     requiredSystemFeatures = [ "benchmark" ];
   }
   ''
-    export NIX_DB_DIR=$TMPDIR
     export NIX_STATE_DIR=$TMPDIR
     nix-store --init
 
diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index d845fbde0d98..2f5fffe5f9c4 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -4039,6 +4039,23 @@ let
     };
   };
 
+  CryptSodium = buildPerlPackage {
+    pname = "Crypt-Sodium";
+    version = "0.11";
+    src = fetchurl {
+      url = "mirror://cpan/authors/id/M/MG/MGREGORO/Crypt-Sodium-0.11.tar.gz";
+      sha256 = "0y3c24zv4iwnvlf9zwxambk8ddram54fm6l1m5yhbskc0nhp6z4h";
+    };
+    NIX_CFLAGS_COMPILE = "-I${pkgs.libsodium.dev}/include";
+    NIX_CFLAGS_LINK = "-L${pkgs.libsodium.out}/lib -lsodium";
+    meta = {
+      homepage = "https://metacpan.org/release/Crypt-Sodium";
+      description = "Perl bindings for libsodium (NaCL)";
+      license = with stdenv.lib.licenses; [ artistic1 gpl1Plus ];
+      maintainers = [ maintainers.sgo ];
+    };
+  };
+
   CryptTwofish = buildPerlPackage {
     pname = "Crypt-Twofish";
     version = "2.17";