diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md
index 168d40f16a91..f7d16df87249 100644
--- a/.github/PULL_REQUEST_TEMPLATE.md
+++ b/.github/PULL_REQUEST_TEMPLATE.md
@@ -26,7 +26,7 @@ Reviewing guidelines: https://nixos.org/manual/nixpkgs/unstable/#chap-reviewing-
   - and/or [package tests](https://nixos.org/manual/nixpkgs/unstable/#sec-package-tests)
   - or, for functions and "core" functionality, tests in [lib/tests](https://github.com/NixOS/nixpkgs/blob/master/lib/tests) or [pkgs/test](https://github.com/NixOS/nixpkgs/blob/master/pkgs/test)
   - made sure NixOS tests are [linked](https://nixos.org/manual/nixpkgs/unstable/#ssec-nixos-tests-linking) to the relevant packages
-- [ ] Tested compilation of all packages that depend on this change using `nix-shell -p nixpkgs-review --run "nixpkgs-review wip"`
+- [ ] Tested compilation of all packages that depend on this change using `nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD"`. Note: all changes have to be committed, also see [nixpkgs-review usage](https://github.com/Mic92/nixpkgs-review#usage)
 - [ ] Tested basic functionality of all binary files (usually in `./result/bin/`)
 - [21.11 Release Notes (or backporting 21.05 Release notes)](https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md#generating-2111-release-notes)
   - [ ] (Package updates) Added a release notes entry if the change is major or breaking
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index e4b21699d1e9..883d4edfeca6 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -2810,6 +2810,12 @@
     githubId = 2439413;
     name = "Derek Gonyeo";
   };
+  dguenther = {
+    email = "dguenther9@gmail.com";
+    github = "dguenther";
+    githubId = 767083;
+    name = "Derek Guenther";
+  };
   dhkl = {
     email = "david@davidslab.com";
     github = "dhl";
diff --git a/pkgs/applications/editors/leo-editor/default.nix b/pkgs/applications/editors/leo-editor/default.nix
index cf4a752b1bd0..ee22c591ad77 100644
--- a/pkgs/applications/editors/leo-editor/default.nix
+++ b/pkgs/applications/editors/leo-editor/default.nix
@@ -2,13 +2,13 @@
 
 mkDerivation rec {
   pname = "leo-editor";
-  version = "6.2.1";
+  version = "6.5";
 
   src = fetchFromGitHub {
     owner = "leo-editor";
     repo = "leo-editor";
     rev = version;
-    sha256 = "1s9jvxwzsl32clp78g92nq9p2byf08libr5widl1jnkv1cpkbvh9";
+    sha256 = "sha256-f237oXhnu6OtGVhIFDswFwfjcLgYWvLNRtVW4SChFzU=";
   };
 
   dontBuild = true;
diff --git a/pkgs/applications/networking/cluster/fluxcd/default.nix b/pkgs/applications/networking/cluster/fluxcd/default.nix
index 0fe3ac021232..3ff2621e29f3 100644
--- a/pkgs/applications/networking/cluster/fluxcd/default.nix
+++ b/pkgs/applications/networking/cluster/fluxcd/default.nix
@@ -1,9 +1,9 @@
 { lib, buildGoModule, fetchFromGitHub, fetchzip, installShellFiles }:
 
 let
-  version = "0.21.1";
-  sha256 = "1sb3912h28z097n7mn3hlh33hnxr9978h04py2m7gh27hmygscj3";
-  manifestsSha256 = "1rrnz50jfn3zgaz5hn7ghmgc31ahm4q49f0rxfagfygvks1h4910";
+  version = "0.23.0";
+  sha256 = "15j4r43hy3slyahx4am7lj7jns4x3axrcbr9qwiznmk8qbvrzrdy";
+  manifestsSha256 = "10rh0q1la5dq6n9y1yvw9ilj5lhzx8vh1zi2lznfjsvc5niwx7wf";
 
   manifests = fetchzip {
     url = "https://github.com/fluxcd/flux2/releases/download/v${version}/manifests.tar.gz";
@@ -23,7 +23,7 @@ buildGoModule rec {
     inherit sha256;
   };
 
-  vendorSha256 = "sha256-m0uVatnV4GIyllZTOkLxXGEiAWXGloFfxSJn51y0AQo=";
+  vendorSha256 = "sha256-vFm9ai+VWOPLRckKJ7gfD/0iQ8b4o5HNQE4cekb0vA0=";
 
   postUnpack = ''
     cp -r ${manifests} source/cmd/flux/manifests
diff --git a/pkgs/applications/networking/cluster/popeye/default.nix b/pkgs/applications/networking/cluster/popeye/default.nix
index 910317bd9673..e70856ef9d90 100644
--- a/pkgs/applications/networking/cluster/popeye/default.nix
+++ b/pkgs/applications/networking/cluster/popeye/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "popeye";
-  version = "0.9.7";
+  version = "0.9.8";
 
   src = fetchFromGitHub {
     rev = "v${version}";
     owner = "derailed";
     repo = "popeye";
-    sha256 = "sha256-oft1zLLd5TP8S9GMjp5kYaoPoOYnbhJwL2wBerkhp+c=";
+    sha256 = "sha256-uGy2BbZS4SGT0w9ICYPUIfFawSvIVMsEezPfPAPQU/Q=";
   };
 
   ldflags = [
@@ -21,6 +21,11 @@ buildGoModule rec {
 
   doCheck = true;
 
+  doInstallCheck = true;
+  installCheckPhase = ''
+    $out/bin/popeye version | grep ${version} > /dev/null
+  '';
+
   meta = with lib; {
     description = "A Kubernetes cluster resource sanitizer";
     homepage = "https://github.com/derailed/popeye";
diff --git a/pkgs/applications/science/logic/boolector/default.nix b/pkgs/applications/science/logic/boolector/default.nix
index 7d90dca46f59..74927dd434d0 100644
--- a/pkgs/applications/science/logic/boolector/default.nix
+++ b/pkgs/applications/science/logic/boolector/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, lib, python3
+{ stdenv, fetchFromGitHub, lib, python3, fetchpatch
 , cmake, lingeling, btor2tools, gtest, gmp
 }:
 
@@ -13,6 +13,15 @@ stdenv.mkDerivation rec {
     sha256 = "1smcy6yp8wvnw2brgnv5bf40v87k4v4fbdbrhi7987vja632k50z";
   };
 
+  patches = [
+    # present in master - remove after 3.2.2
+    (fetchpatch {
+      name = "fix-parser-getc-char-casts.patch";
+      url = "https://github.com/Boolector/boolector/commit/cc3a70918538c1e71ea5e7273fa1ac098da37c1b.patch";
+      sha256 = "0pjvagcy74vxa2q75zbshcz8j7rvhl98549xfcf5y8yyxf5h8hyq";
+    })
+  ];
+
   postPatch = ''
     sed s@REPLACEME@file://${gtest.src}@ ${./cmake-gtest.patch} | patch -p1
   '';
diff --git a/pkgs/applications/science/logic/lingeling/default.nix b/pkgs/applications/science/logic/lingeling/default.nix
index 08bd0e4d6375..1abf38b49cf8 100644
--- a/pkgs/applications/science/logic/lingeling/default.nix
+++ b/pkgs/applications/science/logic/lingeling/default.nix
@@ -4,15 +4,14 @@
 
 stdenv.mkDerivation {
   pname = "lingeling";
-  # This is the version used in satcomp2018, which was
-  # relicensed, and also known as version 'bcj'
-  version = "pre1_03b4860d";
+  # This is the version used in satcomp2020
+  version = "pre1_708beb26";
 
   src = fetchFromGitHub {
     owner  = "arminbiere";
     repo   = "lingeling";
-    rev    = "03b4860d14016f42213ea271014f2f13d181f504";
-    sha256 = "1lw1yfy219p7rrk88sbq4zl24b70040zapbjdrpv5a6i0jsblksx";
+    rev    = "708beb26a7d5b5d5e7abd88d6f552fb1946b07c1";
+    sha256 = "1lb2g37nd8qq5hw5g6l691nx5095336yb2zlbaw43mg56hkj8357";
   };
 
   configurePhase = ''
diff --git a/pkgs/applications/version-management/git-and-tools/git-machete/default.nix b/pkgs/applications/version-management/git-and-tools/git-machete/default.nix
index 97b96f7461f6..f08a74bd3401 100644
--- a/pkgs/applications/version-management/git-and-tools/git-machete/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git-machete/default.nix
@@ -11,13 +11,13 @@
 
 buildPythonApplication rec {
   pname = "git-machete";
-  version = "3.4.1";
+  version = "3.5.0";
 
   src = fetchFromGitHub {
     owner = "virtuslab";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-drfMD9tQe1dc61MH3Cxu9oin137f4FsZJY3X2kDHdh4=";
+    sha256 = "sha256-kR37TClFMkoe4e46g/omfwZCrQFr7gukW7I70WI9+dw=";
   };
 
   nativeBuildInputs = [ installShellFiles ];
diff --git a/pkgs/applications/version-management/git-and-tools/glitter/default.nix b/pkgs/applications/version-management/git-and-tools/glitter/default.nix
index 4b1b4c2f0b4a..7b19d754a720 100644
--- a/pkgs/applications/version-management/git-and-tools/glitter/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/glitter/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "glitter";
-  version = "1.5.3";
+  version = "1.5.4";
 
   src = fetchFromGitHub {
     owner = "milo123459";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-esrN6VH+ayc9DIhOLGR5oOaMjSBAc7u7fr8L1kSh4Gk=";
+    sha256 = "sha256-SJp/iRF5os0f+WsHnLtcqmj0uD7fe8iODJ4F+gpWtJo=";
   };
 
-  cargoSha256 = "sha256-0ugr9HcJLsV34kKJs1E+n10tdOv09wkaYmkIodLhyLk=";
+  cargoSha256 = "sha256-CVqLwXgoHQjJ6NMyiZkxVaTO6qgzBQz8mH/6dsyhhYY=";
 
   # tests require it to be in a git repository
   preCheck = ''
diff --git a/pkgs/applications/video/dvd-slideshow/default.nix b/pkgs/applications/video/dvd-slideshow/default.nix
index 95f3169718d9..165cb4ab4d63 100644
--- a/pkgs/applications/video/dvd-slideshow/default.nix
+++ b/pkgs/applications/video/dvd-slideshow/default.nix
@@ -1,7 +1,7 @@
-{ stdenv, lib, fetchurl, writeScript, cdrtools, dvdauthor, ffmpeg_3, imagemagick, lame, mjpegtools, sox, transcode, vorbis-tools, runtimeShell }:
+{ stdenv, lib, fetchurl, writeScript, cdrtools, dvdauthor, ffmpeg, imagemagick, lame, mjpegtools, sox, transcode, vorbis-tools, runtimeShell }:
 
 let
-  binPath = lib.makeBinPath [ cdrtools dvdauthor ffmpeg_3 imagemagick lame mjpegtools sox transcode vorbis-tools ];
+  binPath = lib.makeBinPath [ cdrtools dvdauthor ffmpeg imagemagick lame mjpegtools sox transcode vorbis-tools ];
 
   wrapper = writeScript "dvd-slideshow.sh" ''
       #!${runtimeShell}
diff --git a/pkgs/applications/video/vdr/plugins.nix b/pkgs/applications/video/vdr/plugins.nix
index d694ad8004e0..96b3733b02d6 100644
--- a/pkgs/applications/video/vdr/plugins.nix
+++ b/pkgs/applications/video/vdr/plugins.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchurl, fetchgit, vdr, alsa-lib, fetchFromGitHub
-, libvdpau, libxcb, xcbutilwm, graphicsmagick, libav, pcre, xorgserver, ffmpeg_3
+, libvdpau, libxcb, xcbutilwm, graphicsmagick, libav, pcre, xorgserver, ffmpeg
 , libiconv, boost, libgcrypt, perl, util-linux, groff, libva, xorg, ncurses
 , callPackage
 }: let
@@ -52,7 +52,7 @@ in {
     version = "20190525";
 
     buildInputs = [
-      vdr libxcb xcbutilwm ffmpeg_3
+      vdr libxcb xcbutilwm ffmpeg
       alsa-lib
       libvdpau # vdpau
       libva # va-api
diff --git a/pkgs/development/libraries/freeimage/default.nix b/pkgs/development/libraries/freeimage/default.nix
index 87997cead43f..2b4b174ca31b 100644
--- a/pkgs/development/libraries/freeimage/default.nix
+++ b/pkgs/development/libraries/freeimage/default.nix
@@ -24,6 +24,9 @@ stdenv.mkDerivation {
       --replace "pkg-config" "$PKG_CONFIG"
     substituteInPlace Makefile.gnu \
       --replace "pkg-config" "$PKG_CONFIG"
+  '' + lib.optionalString (stdenv.isDarwin && stdenv.isAarch64) ''
+    # Upstream Makefile hardcodes i386 and x86_64 architectures only
+    substituteInPlace Makefile.osx --replace "x86_64" "arm64"
   '';
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/isl/0.14.1.nix b/pkgs/development/libraries/isl/0.14.1.nix
index 8936d6c5f3be..87243def1796 100644
--- a/pkgs/development/libraries/isl/0.14.1.nix
+++ b/pkgs/development/libraries/isl/0.14.1.nix
@@ -4,7 +4,10 @@ stdenv.mkDerivation rec {
   name = "isl-0.14.1";
 
   src = fetchurl {
-    url = "http://isl.gforge.inria.fr/${name}.tar.xz";
+    urls = [
+      "mirror://sourceforge/libisl/${name}.tar.xz"
+      "https://libisl.sourceforge.io/${name}.tar.xz"
+    ];
     sha256 = "0xa6xagah5rywkywn19rzvbvhfvkmylhcxr6z9z7bz29cpiwk0l8";
   };
 
diff --git a/pkgs/development/libraries/isl/0.17.1.nix b/pkgs/development/libraries/isl/0.17.1.nix
index a823b69fa27b..a066655d4a05 100644
--- a/pkgs/development/libraries/isl/0.17.1.nix
+++ b/pkgs/development/libraries/isl/0.17.1.nix
@@ -4,7 +4,10 @@ stdenv.mkDerivation rec {
   name = "isl-0.17.1";
 
   src = fetchurl {
-    url = "http://isl.gforge.inria.fr/${name}.tar.xz";
+    urls = [
+      "mirror://sourceforge/libisl/${name}.tar.xz"
+      "https://libisl.sourceforge.io/${name}.tar.xz"
+    ];
     sha256 = "be152e5c816b477594f4c6194b5666d8129f3a27702756ae9ff60346a8731647";
   };
 
diff --git a/pkgs/development/libraries/isl/0.20.0.nix b/pkgs/development/libraries/isl/0.20.0.nix
index c40b3d7be0b4..d68637ddbcde 100644
--- a/pkgs/development/libraries/isl/0.20.0.nix
+++ b/pkgs/development/libraries/isl/0.20.0.nix
@@ -4,7 +4,11 @@ stdenv.mkDerivation rec {
   name = "isl-0.20";
 
   src = fetchurl {
-    url = "http://isl.gforge.inria.fr/${name}.tar.xz";
+    urls = [
+      "mirror://sourceforge/libisl/${name}.tar.xz"
+      "https://libisl.sourceforge.io/${name}.tar.xz"
+    ];
+
     sha256 = "1akpgq0rbqbah5517blg2zlnfvjxfcl9cjrfc75nbcx5p2gnlnd5";
   };
 
diff --git a/pkgs/development/libraries/libsbsms/common.nix b/pkgs/development/libraries/libsbsms/common.nix
new file mode 100644
index 000000000000..f206f68de42a
--- /dev/null
+++ b/pkgs/development/libraries/libsbsms/common.nix
@@ -0,0 +1,36 @@
+{ lib
+, stdenv
+, fetchurl
+, substituteAll
+, pname
+, version
+, url
+, sha256
+, homepage
+}:
+
+stdenv.mkDerivation rec {
+  inherit pname version;
+
+  src = fetchurl {
+    inherit url sha256;
+  };
+
+  patches = [
+    # Fix buidling on platforms other than x86
+    (substituteAll {
+      src = ./configure.patch;
+      msse = lib.optionalString stdenv.isx86_64 "-msse";
+    })
+  ];
+
+  doCheck = true;
+
+  meta = {
+    inherit homepage;
+    description = "Subband sinusoidal modeling library for time stretching and pitch scaling audio";
+    maintainers =  with lib.maintainers; [ yuu ];
+    license = lib.licenses.gpl2;
+    platforms = lib.platforms.all;
+  };
+}
diff --git a/pkgs/development/libraries/libsbsms/configure.patch b/pkgs/development/libraries/libsbsms/configure.patch
new file mode 100644
index 000000000000..cfb9d2d08e6b
--- /dev/null
+++ b/pkgs/development/libraries/libsbsms/configure.patch
@@ -0,0 +1,22 @@
+diff --git a/configure b/configure
+index 3d40335..faa3ac6 100755
+--- a/configure
++++ b/configure
+@@ -14722,7 +14722,7 @@ if ${ax_cv_cxx_flags__msse+:} false; then :
+ else
+ 
+       ax_save_FLAGS=$CXXFLAGS
+-      CXXFLAGS="-msse"
++      CXXFLAGS="@msse@"
+       cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ /* end confdefs.h.  */
+ 
+@@ -14747,7 +14747,7 @@ eval ax_check_compiler_flags=$ax_cv_cxx_flags__msse
+ { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ax_check_compiler_flags" >&5
+ $as_echo "$ax_check_compiler_flags" >&6; }
+ if test "x$ax_check_compiler_flags" = xyes; then
+-	SBSMS_CFLAGS="$SBSMS_CFLAGS -msse"
++	SBSMS_CFLAGS="$SBSMS_CFLAGS @msse@"
+ else
+ 	as_fn_error $? "Need a version of gcc with -msse" "$LINENO" 5
+ fi
diff --git a/pkgs/development/libraries/libsbsms/default.nix b/pkgs/development/libraries/libsbsms/default.nix
new file mode 100644
index 000000000000..6c014ea6223c
--- /dev/null
+++ b/pkgs/development/libraries/libsbsms/default.nix
@@ -0,0 +1,22 @@
+let
+  pname = "libsbsms";
+in
+pkgs: rec {
+  libsbsms_2_0_2 = pkgs.callPackage ./common.nix rec {
+    inherit pname;
+    version = "2.0.2";
+    url = "mirror://sourceforge/sbsms/${pname}-${version}.tar.gz";
+    sha256 = "sha256-zqs9lwZkszcFe0a89VKD1Q0ynaY2v4PQ7nw24iNBru4=";
+    homepage = "https://sourceforge.net/projects/sbsms/files/sbsms";
+  };
+
+  libsbsms_2_3_0 = pkgs.callPackage ./common.nix rec {
+    inherit pname;
+    version = "2.3.0";
+    url = "https://github.com/claytonotey/${pname}/archive/refs/tags/${version}.tar.gz";
+    sha256 = "sha256-T4jRUrwG/tvanV1lUX1AJUpzEMkFBgGpMSIwnUWv0sk=";
+    homepage = "https://github.com/claytonotey/libsbsms";
+  };
+
+  libsbsms = libsbsms_2_0_2;
+}
diff --git a/pkgs/development/libraries/qt-5/modules/qtwebengine.nix b/pkgs/development/libraries/qt-5/modules/qtwebengine.nix
index 03247487749a..b49efa600fa5 100644
--- a/pkgs/development/libraries/qt-5/modules/qtwebengine.nix
+++ b/pkgs/development/libraries/qt-5/modules/qtwebengine.nix
@@ -239,5 +239,6 @@ qtModule {
     platforms = platforms.unix;
     # This build takes a long time; particularly on slow architectures
     timeout = 24 * 3600;
+    broken = stdenv.isDarwin && (lib.versionAtLeast qtCompatVersion "5.14"); # requires a newer SDK
   };
 }
diff --git a/pkgs/development/tools/ammonite/default.nix b/pkgs/development/tools/ammonite/default.nix
index 7f189e83e195..a31a6478a761 100644
--- a/pkgs/development/tools/ammonite/default.nix
+++ b/pkgs/development/tools/ammonite/default.nix
@@ -1,16 +1,5 @@
-{ lib
-, stdenv
-, fetchurl
-, jre
-, writeScript
-, common-updater-scripts
-, git
-, nixfmt
-, nix
-, coreutils
-, gnused
-, disableRemoteLogging ? true
-}:
+{ lib, stdenv, fetchurl, jre, writeScript, common-updater-scripts, git, nixfmt
+, nix, coreutils, gnused, disableRemoteLogging ? true }:
 
 with lib;
 
@@ -20,7 +9,7 @@ let
   common = { scalaVersion, sha256 }:
     stdenv.mkDerivation rec {
       pname = "ammonite";
-      version = "2.4.0";
+      version = "2.4.1";
 
       src = fetchurl {
         url =
@@ -91,14 +80,13 @@ let
         maintainers = [ maintainers.nequissimus ];
       };
     };
-in
-{
+in {
   ammonite_2_12 = common {
     scalaVersion = "2.12";
-    sha256 = "K8JII6SAmnBjMWQ9a3NqSLLuP1OLcbwobj3G+OCiLdA=";
+    sha256 = "5n9q/7d/PwDJfBPITYyDua24+fci6bi1oG5dSw8A244=";
   };
   ammonite_2_13 = common {
     scalaVersion = "2.13";
-    sha256 = "2F35qhWI6hNb+Eh9ZTDznqo116yN7MZIGVchaAIM36A=";
+    sha256 = "RIuNyWvwNM39/rczUH328K5ky5hePflokW/VP603j+I=";
   };
 }
diff --git a/pkgs/development/tools/cargo-flamegraph/default.nix b/pkgs/development/tools/cargo-flamegraph/default.nix
index 65a49551035d..33c3a20e2d86 100644
--- a/pkgs/development/tools/cargo-flamegraph/default.nix
+++ b/pkgs/development/tools/cargo-flamegraph/default.nix
@@ -4,16 +4,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-flamegraph";
-  version = "0.4.0";
+  version = "0.5.0";
 
   src = fetchFromGitHub {
     owner = "flamegraph-rs";
     repo = "flamegraph";
     rev = "v${version}";
-    sha256 = "sha256-IpmvFUWNaFQ1ls7u625vvj1TnRYXR+X1mAGdBcwRFLk=";
+    sha256 = "sha256-qxUYqqz6dlpkw6MGHH8iPfZcbc3/ZF1E+C8arISSTdY=";
   };
 
-  cargoSha256 = "sha256-ccy5ZFS2Gp4Dwo8gsS6vzHHO1siicOp7uZTsCh6SKsM=";
+  cargoSha256 = "sha256-qJEhcqa78QW9X5ZD3Jy2BfRh/SkOhqBLzTT00u4DM0Q=";
 
   nativeBuildInputs = lib.optionals stdenv.isLinux [ makeWrapper ];
   buildInputs = lib.optionals stdenv.isDarwin [
diff --git a/pkgs/games/openrw/default.nix b/pkgs/games/openrw/default.nix
index 4064023fafd3..f1bcab2895fb 100644
--- a/pkgs/games/openrw/default.nix
+++ b/pkgs/games/openrw/default.nix
@@ -1,21 +1,37 @@
-{ lib, stdenv, fetchgit, cmake, sfml, libGLU, libGL, bullet, glm, libmad, xlibsWrapper, openal
-, SDL2, boost, ffmpeg_3, Cocoa, OpenAL }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, cmake
+, sfml
+, libGLU
+, libGL
+, bullet
+, glm
+, libmad
+, xlibsWrapper
+, openal
+, SDL2
+, boost
+, ffmpeg
+, Cocoa
+, OpenAL }:
 
 stdenv.mkDerivation {
-  version = "2019-10-26";
+  version = "unstable-2021-10-14";
   pname = "openrw";
 
-  src = fetchgit {
-    url = "https://github.com/rwengine/openrw";
-    rev = "51b7264744d1aaa20de3b86a7a4e92a9930881ba";
-    sha256 = "04s088wfxkfmb4dxdvad611yxj8smxlnxdm5xy81zldfzybvx8dg";
+  src = fetchFromGitHub {
+    owner = "rwengine";
+    repo = "openrw";
+    rev = "0f83c16f6518c427a4f156497c3edc843610c402";
+    sha256 = "0i6nx9g0xb8sziak5swi8636fszcjjx8n2jwgz570izw2fl698ff";
     fetchSubmodules = true;
   };
 
   nativeBuildInputs = [ cmake ];
 
   buildInputs = [
-    sfml libGLU libGL bullet glm libmad xlibsWrapper openal SDL2 boost ffmpeg_3
+    sfml libGLU libGL bullet glm libmad xlibsWrapper openal SDL2 boost ffmpeg
   ] ++ lib.optionals stdenv.isDarwin [ OpenAL Cocoa ];
 
   meta = with lib; {
diff --git a/pkgs/misc/emulators/retroarch/cores.nix b/pkgs/misc/emulators/retroarch/cores.nix
index 9b3db346e049..715f33421210 100644
--- a/pkgs/misc/emulators/retroarch/cores.nix
+++ b/pkgs/misc/emulators/retroarch/cores.nix
@@ -8,11 +8,11 @@ let
 
   d2u = lib.replaceChars ["-"] ["_"];
 
-  mkLibRetroCore = { core, src, description, license, broken ? false, ... }@a:
+  mkLibRetroCore = { core, src, description, license, broken ? false, version ? "2020-03-06", ... }@a:
   lib.makeOverridable stdenv.mkDerivation ((rec {
 
     name = "libretro-${a.core}-${version}";
-    version = "2020-03-06";
+    inherit version;
     inherit (a) src;
 
     buildInputs = [ zlib ] ++ a.extraBuildInputs or [];
@@ -334,10 +334,11 @@ in with lib.licenses;
 
   dolphin = mkLibRetroCore {
     core = "dolphin";
+    version = "2021-11-01";
     src = fetchRetro {
       repo = "dolphin";
-      rev = "1fbd59911d1b718c142d6448dee3ede98152e395";
-      sha256 = "1rymsvs034l1hbxc3w8zi9lhmgka2qaj3jynjy152dccd480nnd4";
+      rev = "3370f7693be95c23ac779e5172ff52b7eb2861a7";
+      sha256 = "0ylxi25kbv0h2p24aid7z4i0w6drf7h92q02hjdl3h3gni98lk9i";
     };
     description = "Port of Dolphin to libretro";
     license = gpl2Plus;
diff --git a/pkgs/servers/http/nginx/modules.nix b/pkgs/servers/http/nginx/modules.nix
index 2919438d1e4b..de65e75ab9da 100644
--- a/pkgs/servers/http/nginx/modules.nix
+++ b/pkgs/servers/http/nginx/modules.nix
@@ -498,10 +498,10 @@ in
       name = "video-thumbextractor";
       owner = "wandenberg";
       repo = "nginx-video-thumbextractor-module";
-      rev = "0.9.0";
-      sha256 = "1b0v471mzbcys73pzr7gpvzzhff0cva0l5ff32cv7z1v9c0ypji7";
+      rev = "92b80642538eec4cfc98114dec5917b8d820e912";
+      sha256 = "0a8d9ifryhhnll7k7jcsf9frshk5yhpsgz7zgxdmw81wbz5hxklc";
     };
-    inputs = [ pkgs.ffmpeg_3 ];
+    inputs = [ pkgs.ffmpeg ];
   };
 
   vod = {
diff --git a/pkgs/servers/openvscode-server/default.nix b/pkgs/servers/openvscode-server/default.nix
new file mode 100644
index 000000000000..e6ada50152a4
--- /dev/null
+++ b/pkgs/servers/openvscode-server/default.nix
@@ -0,0 +1,173 @@
+{ lib, stdenv, fetchFromGitHub, makeWrapper, runCommand
+, cacert, moreutils, jq, git, pkg-config, yarn, python3
+, esbuild, nodejs-14_x, libsecret, xorg, ripgrep
+, AppKit, Cocoa, Security, cctools }:
+
+let
+  system = stdenv.hostPlatform.system;
+
+  nodejs = nodejs-14_x;
+  yarn' = yarn.override { inherit nodejs; };
+  defaultYarnOpts = [ "frozen-lockfile" "non-interactive" "no-progress"];
+
+  vsBuildTarget = {
+    x86_64-linux = "linux-x64";
+    aarch64-linux = "linux-arm64";
+    x86_64-darwin = "darwin";
+  }.${system} or (throw "Unsupported system ${system}");
+
+  # replaces esbuild's download script with a binary from nixpkgs
+  patchEsbuild = path : version : ''
+    mkdir -p ${path}/node_modules/esbuild/bin
+    jq "del(.scripts.postinstall)" ${path}/node_modules/esbuild/package.json | sponge ${path}/node_modules/esbuild/package.json
+    sed -i 's/${version}/${esbuild.version}/g' ${path}/node_modules/esbuild/lib/main.js
+    ln -s -f ${esbuild}/bin/esbuild ${path}/node_modules/esbuild/bin/esbuild
+  '';
+
+in stdenv.mkDerivation rec {
+  pname = "openvscode-server";
+  version = "1.62.0";
+
+  src = fetchFromGitHub {
+    owner = "gitpod-io";
+    repo = "openvscode-server";
+    rev = "openvscode-server-v${version}";
+    sha256 = "0lmka1hgf1703h70s7i2lx07535n2l867kmnc5h89c4vaswy6649";
+  };
+
+  yarnCache = stdenv.mkDerivation {
+    name = "${pname}-${version}-${system}-yarn-cache";
+    inherit src;
+    nativeBuildInputs = [ cacert yarn git ];
+    buildPhase = ''
+      export HOME=$PWD
+
+      yarn config set yarn-offline-mirror $out
+      find "$PWD" -name "yarn.lock" -printf "%h\n" | \
+        xargs -I {} yarn --cwd {} \
+          --frozen-lockfile --ignore-scripts --ignore-platform \
+          --ignore-engines --no-progress --non-interactive
+    '';
+
+    installPhase = ''
+      echo yarnCache
+    '';
+
+    outputHashMode = "recursive";
+    outputHashAlgo = "sha256";
+    outputHash = "142m0vkddzv09rbbqw7y7x19q7akkn00dn6az5ppr86k6bmhyk6p";
+  };
+
+  # Extract the Node.js source code which is used to compile packages with
+  # native bindings
+  nodeSources = runCommand "node-sources" {} ''
+    tar --no-same-owner --no-same-permissions -xf ${nodejs.src}
+    mv node-* $out
+  '';
+
+  nativeBuildInputs = [
+    nodejs yarn' python3 pkg-config makeWrapper git jq moreutils
+  ];
+  buildInputs = lib.optionals (!stdenv.isDarwin) [ libsecret ]
+    ++ (with xorg; [ libX11 libxkbfile ])
+    ++ lib.optionals stdenv.isDarwin [
+      AppKit Cocoa Security cctools
+    ];
+
+  patches = [
+    # Patch out remote download of nodejs from build script
+    ./remove-node-download.patch
+  ];
+
+  postPatch = ''
+    export HOME=$PWD
+
+    # remove all built-in extensions, as these are 3rd party extensions that
+    # get downloaded from vscode marketplace
+    jq --slurp '.[0] * .[1]' "product.json" <(
+      cat << EOF
+    {
+      "builtInExtensions": []
+    }
+    EOF
+    ) | sponge product.json
+  '';
+
+  configurePhase = ''
+    # set default yarn opts
+    ${lib.concatMapStrings (option: ''
+      yarn --offline config set ${option}
+    '') defaultYarnOpts}
+
+    # set offline mirror to yarn cache we created in previous steps
+    yarn --offline config set yarn-offline-mirror "${yarnCache}"
+  '' + lib.optionalString stdenv.isLinux ''
+    # set nodedir, so we can build binaries later
+    npm config set nodedir "${nodeSources}"
+  '';
+
+  buildPhase = ''
+    # install dependencies
+    yarn --offline --ignore-scripts
+
+    # run yarn install everywhere, skipping postinstall so we can patch esbuild
+    find . -path "*node_modules" -prune -o \
+      -path "./*/*" -name "yarn.lock" -printf "%h\n" | \
+        xargs -I {} yarn --cwd {} \
+          --frozen-lockfile --offline --ignore-scripts --ignore-engines
+
+    ${patchEsbuild "./build" "0.12.6"}
+    ${patchEsbuild "./extensions" "0.11.23"}
+
+    # patch shebangs of node_modules to allow binary packages to build
+    patchShebangs ./remote/node_modules
+
+    # put ripgrep binary into bin so postinstall does not try to download it
+    find -name vscode-ripgrep -type d \
+      -execdir mkdir -p {}/bin \; \
+      -execdir ln -s ${ripgrep}/bin/rg {}/bin/rg \;
+  '' + lib.optionalString stdenv.isDarwin ''
+    # use prebuilt binary for @parcel/watcher, which requires macOS SDK 10.13+
+    # (see issue #101229)
+    pushd ./remote/node_modules/@parcel/watcher
+    mkdir -p ./build/Release
+    mv ./prebuilds/darwin-x64/node.napi.glibc.node ./build/Release/watcher.node
+    jq "del(.scripts) | .gypfile = false" ./package.json | sponge ./package.json
+    popd
+  '' + ''
+    # rebuild binaries, we use npm here, as yarn does not provide an alternative
+    # that would not attempt to try to reinstall everything and break our
+    # patching attempts
+    npm --prefix ./remote rebuild --build-from-source
+
+    # run postinstall scripts after patching
+    find . -path "*node_modules" -prune -o \
+      -path "./*/*" -name "yarn.lock" -printf "%h\n" | \
+        xargs -I {} sh -c 'jq -e ".scripts.postinstall" {}/package.json >/dev/null && yarn --cwd {} postinstall --frozen-lockfile --offline || true'
+
+    # build and minify
+    yarn --offline gulp vscode-reh-web-${vsBuildTarget}-min
+  '';
+
+  installPhase = ''
+    mkdir -p $out/libexec
+
+    cp -R -T ../vscode-reh-web-${vsBuildTarget} "$out/libexec"
+
+    ln -s ${nodejs}/bin/node $out/libexec
+
+    makeWrapper "$out/libexec/server.sh" "$out/bin/openvscode-server"
+  '';
+
+  meta = with lib; {
+    description = "Run VS Code on a remote machine";
+    longDescription = ''
+      Run upstream VS Code on a remote machine with access through a modern web
+      browser from any device, anywhere.
+    '';
+    homepage = "https://github.com/gitpod-io/openvscode-server";
+    license = licenses.mit;
+    maintainers = with maintainers; [ dguenther ghuntley ];
+    platforms = [ "x86_64-linux" "aarch64-linux" "x86_64-darwin" ];
+  };
+}
diff --git a/pkgs/servers/openvscode-server/remove-node-download.patch b/pkgs/servers/openvscode-server/remove-node-download.patch
new file mode 100644
index 000000000000..9262be5b293d
--- /dev/null
+++ b/pkgs/servers/openvscode-server/remove-node-download.patch
@@ -0,0 +1,27 @@
+--- ./build/gulpfile.reh.js
++++ ./build/gulpfile.reh.js
+@@ -277,8 +277,6 @@
+ 			.pipe(util.stripSourceMappingURL())
+ 			.pipe(jsFilter.restore);
+ 
+-		const nodePath = `.build/node/v${nodeVersion}/${platform}-${platform === 'darwin' ? 'x64' : arch}`;
+-		const node = gulp.src(`${nodePath}/**`, { base: nodePath, dot: true });
+ 
+ 		let web = [];
+ 		if (type === 'reh-web') {
+@@ -296,7 +294,6 @@
+ 			license,
+ 			sources,
+ 			deps,
+-			node,
+ 			...web
+ 		);
+ 
+@@ -376,7 +373,6 @@
+ 			const destinationFolderName = `vscode-${type}${dashed(platform)}${dashed(arch)}`;
+ 
+ 			const serverTaskCI = task.define(`vscode-${type}${dashed(platform)}${dashed(arch)}${dashed(minified)}-ci`, task.series(
+-				gulp.task(`node-${platform}-${platform === 'darwin' ? 'x64' : arch}`),
+ 				util.rimraf(path.join(BUILD_ROOT, destinationFolderName)),
+ 				packageTask(type, platform, arch, sourceFolderName, destinationFolderName)
+ 			));
diff --git a/pkgs/tools/misc/cht.sh/default.nix b/pkgs/tools/misc/cht.sh/default.nix
index d9fcd8b29bc2..bff4b5310bd1 100644
--- a/pkgs/tools/misc/cht.sh/default.nix
+++ b/pkgs/tools/misc/cht.sh/default.nix
@@ -10,15 +10,15 @@
 
 stdenv.mkDerivation {
   pname = "cht.sh";
-  version = "unstable-2021-10-20";
+  version = "unstable-2021-11-13";
 
   nativeBuildInputs = [ makeWrapper ];
 
   src = fetchFromGitHub {
     owner = "chubin";
     repo = "cheat.sh";
-    rev = "5a79c76c9b8ef337cffb9537a3d8a47c9ffc8b04";
-    sha256 = "zDkYp2YPEur26qEwG8DQQzv8/T288HG/9mzzkN4SEtU=";
+    rev = "4bb7b14843c302695b7d47d4d814f38998da1a68";
+    sha256 = "NbB+UGydk0zSkqTPYw5KOHR0mv1UHH2pXLYdMRdG8UE=";
   };
 
   # Fix ".cht.sh-wrapped" in the help message
diff --git a/pkgs/tools/misc/ytree/default.nix b/pkgs/tools/misc/ytree/default.nix
index 9121b1289f24..fcfbdbd10da1 100644
--- a/pkgs/tools/misc/ytree/default.nix
+++ b/pkgs/tools/misc/ytree/default.nix
@@ -6,11 +6,11 @@
 
 stdenv.mkDerivation rec {
   pname = "ytree";
-  version = "2.03";
+  version = "2.04";
 
   src = fetchurl {
     url = "https://han.de/~werner/${pname}-${version}.tar.gz";
-    sha256 = "sha256-WDqnFVLRNH4Oq+OaI2+loXS/Z93piHGFO5/iojO8rvE=";
+    sha256 = "sha256-bnqLf2jv5tNlq+M6HQbXOa2F8io9VN3QrsJKNHjWZkI=";
   };
 
   buildInputs = [
diff --git a/pkgs/tools/networking/chrony/default.nix b/pkgs/tools/networking/chrony/default.nix
index 24968c64a093..1fc5e84fddef 100644
--- a/pkgs/tools/networking/chrony/default.nix
+++ b/pkgs/tools/networking/chrony/default.nix
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
 
   hardeningEnable = [ "pie" ];
 
-  configureFlags = [ "--chronyvardir=$(out)/var/lib/chrony" ]
+  configureFlags = [ "--chronyvardir=$(out)/var/lib/chrony" "--enable-ntp-signd" ]
     ++ lib.optional stdenv.isLinux "--enable-scfilter";
 
   meta = with lib; {
diff --git a/pkgs/tools/networking/offlineimap/default.nix b/pkgs/tools/networking/offlineimap/default.nix
index 5dc789e0dc58..98aabadf6da3 100644
--- a/pkgs/tools/networking/offlineimap/default.nix
+++ b/pkgs/tools/networking/offlineimap/default.nix
@@ -1,6 +1,6 @@
 { lib
 , fetchFromGitHub
-, python2Packages
+, python3
 , asciidoc
 , cacert
 , docbook_xsl
@@ -9,15 +9,15 @@
 , libxslt
 }:
 
-python2Packages.buildPythonApplication rec {
-  version = "7.3.4";
+python3.pkgs.buildPythonApplication rec {
   pname = "offlineimap";
+  version = "8.0.0";
 
   src = fetchFromGitHub {
     owner = "OfflineIMAP";
-    repo = "offlineimap";
+    repo = "offlineimap3";
     rev = "v${version}";
-    sha256 = "sha256-sra2H0+5+LAIU3+uJnii+AYA05nuDyKVMW97rbaFOfI=";
+    sha256 = "0y3giaz9i8vvczlxkbwymfkn3vi9fv599dy4pc2pn2afxsl4mg2w";
   };
 
   nativeBuildInputs = [
@@ -28,11 +28,14 @@ python2Packages.buildPythonApplication rec {
     libxslt
   ];
 
-  propagatedBuildInputs = with python2Packages; [
-    six
+  propagatedBuildInputs = with python3.pkgs; [
+    certifi
+    distro
+    imaplib2
     kerberos
-    rfc6555
     pysocks
+    rfc6555
+    urllib3
   ];
 
   postPatch = ''
@@ -40,7 +43,7 @@ python2Packages.buildPythonApplication rec {
     sed -i docs/Makefile -e "s|a2x -v -d |a2x -L -v -d |"
 
     # Provide CA certificates (Used when "sslcacertfile = OS-DEFAULT" is configured")
-    sed -i offlineimap/utils/distro.py -e '/def get_os_sslcertfile():/a\ \ \ \ return "${cacert}/etc/ssl/certs/ca-bundle.crt"'
+    sed -i offlineimap/utils/distro_utils.py -e '/def get_os_sslcertfile():/a\ \ \ \ return "${cacert}/etc/ssl/certs/ca-bundle.crt"'
   '';
 
   postInstall = ''
@@ -52,6 +55,10 @@ python2Packages.buildPythonApplication rec {
   # Test requires credentials
   doCheck = false;
 
+  pythonImportsCheck = [
+    "offlineimap"
+  ];
+
   meta = with lib; {
     description = "Synchronize emails between two repositories, so that you can read the same mailbox from multiple computers";
     homepage = "http://offlineimap.org";
diff --git a/pkgs/tools/nix/info/info.sh b/pkgs/tools/nix/info/info.sh
index f108962b3bad..6708a541f3d9 100755
--- a/pkgs/tools/nix/info/info.sh
+++ b/pkgs/tools/nix/info/info.sh
@@ -70,7 +70,7 @@ nixev() {
 }
 
 desc_system() {
-    nixev '(import <nixpkgs> {}).system'
+    nixev '(import <nixpkgs> {}).stdenv.hostPlatform.system'
 }
 
 desc_host_os() {
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 627ac26a283f..f63c2a003851 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -4074,6 +4074,12 @@ with pkgs;
 
   libpinyin = callPackage ../development/libraries/libpinyin { };
 
+  inherit (import ../development/libraries/libsbsms pkgs)
+    libsbsms
+    libsbsms_2_0_2
+    libsbsms_2_3_0
+  ;
+
   libskk = callPackage ../development/libraries/libskk {
     inherit (gnome) gnome-common;
   };
@@ -28825,6 +28831,11 @@ with pkgs;
   vscodium-fhs = vscodium.fhs;
   vscodium-fhsWithPackages = vscodium.fhsWithPackages;
 
+  openvscode-server = callPackage ../servers/openvscode-server {
+    inherit (darwin.apple_sdk.frameworks) AppKit Cocoa Security;
+    inherit (darwin) cctools;
+  };
+
   code-server = callPackage ../servers/code-server {
     inherit (darwin.apple_sdk.frameworks) AppKit Cocoa Security;
     inherit (darwin) cctools;