diff --git a/nixos/modules/services/mail/postfix.nix b/nixos/modules/services/mail/postfix.nix
index 6fc09682e0c0..23d3574ae27c 100644
--- a/nixos/modules/services/mail/postfix.nix
+++ b/nixos/modules/services/mail/postfix.nix
@@ -294,7 +294,7 @@ in
       };
 
       submissionOptions = mkOption {
-        type = types.attrs;
+        type = with types; attrsOf str;
         default = {
           smtpd_tls_security_level = "encrypt";
           smtpd_sasl_auth_enable = "yes";
@@ -312,7 +312,7 @@ in
       };
 
       submissionsOptions = mkOption {
-        type = types.attrs;
+        type = with types; attrsOf str;
         default = {
           smtpd_sasl_auth_enable = "yes";
           smtpd_client_restrictions = "permit_sasl_authenticated,reject";
diff --git a/pkgs/applications/misc/pass-secret-service/default.nix b/pkgs/applications/misc/pass-secret-service/default.nix
index 932fa588d271..12f8935797c8 100644
--- a/pkgs/applications/misc/pass-secret-service/default.nix
+++ b/pkgs/applications/misc/pass-secret-service/default.nix
@@ -19,9 +19,8 @@ python3.pkgs.buildPythonApplication rec {
   # /etc/ in check phase.
   postPatch = ''
     substituteInPlace Makefile \
-      --replace \
-        "dbus-run-session" \
-        "dbus-run-session --config-file=${dbus}/share/dbus-1/session.conf"
+      --replace "dbus-run-session" "dbus-run-session --config-file=${dbus}/share/dbus-1/session.conf" \
+      --replace '-p $(relpassstore)' '-p $(PASSWORD_STORE_DIR)'
   '';
 
   propagatedBuildInputs = with python3.pkgs; [
diff --git a/pkgs/data/fonts/noto-fonts/tools.nix b/pkgs/data/fonts/noto-fonts/tools.nix
index 791aa6534d28..7d850ef71667 100644
--- a/pkgs/data/fonts/noto-fonts/tools.nix
+++ b/pkgs/data/fonts/noto-fonts/tools.nix
@@ -7,7 +7,7 @@
 
 buildPythonPackage rec {
   pname = "nototools";
-  version = "0.2.13";
+  version = "0.2.16";
 
   disabled = pythonOlder "3.6";
 
@@ -15,7 +15,7 @@ buildPythonPackage rec {
     owner = "googlefonts";
     repo = "nototools";
     rev = "v${version}";
-    sha256 = "0ggp65xgkf9y7jamncm65lkm84wapsa47abf133pcb702875v8jz";
+    sha256 = "14rrdamkmhrykff8ln07fq9cm8zwj3k113lzwjcy0lgz23g51jyl";
   };
 
   postPatch = ''
diff --git a/pkgs/data/misc/wireless-regdb/default.nix b/pkgs/data/misc/wireless-regdb/default.nix
index d23733fb0312..2a729c7aa2fc 100644
--- a/pkgs/data/misc/wireless-regdb/default.nix
+++ b/pkgs/data/misc/wireless-regdb/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "wireless-regdb";
-  version = "2021.07.14";
+  version = "2021.08.28";
 
   src = fetchurl {
     url = "https://www.kernel.org/pub/software/network/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-Li3SFqXxoxC4SXdK9j5jCdlMIgfDR3GlNMR64YsWJ0I=";
+    sha256 = "sha256-z/NwxBDR5tMWrgp/qKxieP3x78pdPWZKynz9Kq+lREY=";
   };
 
   dontBuild = true;
diff --git a/pkgs/development/libraries/science/math/p4est-sc/default.nix b/pkgs/development/libraries/science/math/p4est-sc/default.nix
index 338101b80b56..eeb1d14b910a 100644
--- a/pkgs/development/libraries/science/math/p4est-sc/default.nix
+++ b/pkgs/development/libraries/science/math/p4est-sc/default.nix
@@ -22,11 +22,12 @@ stdenv.mkDerivation {
     sha256 = "14vm0b162jh8399pgpsikbwq4z5lkrw9vfzy3drqykw09n6nc53z";
   };
 
+  strictDeps = true;
   nativeBuildInputs = [ autoreconfHook pkg-config ];
-  propagatedBuildInputs = [ zlib ]
-    ++ lib.optional mpiSupport mpi
+  propagatedNativeBuildInputs = lib.optional mpiSupport mpi
     ++ lib.optional isOpenmpi openssh
   ;
+  propagatedBuildInputs = [ zlib ];
   inherit debugEnable mpiSupport;
 
   postPatch = ''
diff --git a/pkgs/development/libraries/science/math/p4est/default.nix b/pkgs/development/libraries/science/math/p4est/default.nix
index 68c71ab59be1..c38b0d623bac 100644
--- a/pkgs/development/libraries/science/math/p4est/default.nix
+++ b/pkgs/development/libraries/science/math/p4est/default.nix
@@ -21,6 +21,7 @@ stdenv.mkDerivation {
     sha256 = "0vffnf48rzw6d0as4c3x1f31b4kapmdzr1hfj5rz5ngah72gqrph";
   };
 
+  strictDeps = true;
   nativeBuildInputs = [ autoreconfHook pkg-config ];
   propagatedBuildInputs = [ p4est-sc ];
   buildInputs = lib.optional withMetis metis;
diff --git a/pkgs/development/libraries/science/math/petsc/default.nix b/pkgs/development/libraries/science/math/petsc/default.nix
index cbd5fa879ee7..1bffb41806c5 100644
--- a/pkgs/development/libraries/science/math/petsc/default.nix
+++ b/pkgs/development/libraries/science/math/petsc/default.nix
@@ -28,10 +28,12 @@ stdenv.mkDerivation rec {
   mpiSupport = !withp4est || p4est.mpiSupport;
   withp4est = petsc-withp4est;
 
-  nativeBuildInputs = [ python3 gfortran ];
-  buildInputs = [ blas lapack ]
+  strictDeps = true;
+  nativeBuildInputs = [ python3 gfortran ]
     ++ lib.optional mpiSupport mpi
     ++ lib.optional (mpiSupport && mpi.pname == "openmpi") openssh
+  ;
+  buildInputs = [ blas lapack ]
     ++ lib.optional withp4est p4est
   ;
 
diff --git a/pkgs/development/tools/misc/intel-gpu-tools/default.nix b/pkgs/development/tools/misc/intel-gpu-tools/default.nix
index 62d350593b16..eca59819ba09 100644
--- a/pkgs/development/tools/misc/intel-gpu-tools/default.nix
+++ b/pkgs/development/tools/misc/intel-gpu-tools/default.nix
@@ -1,37 +1,85 @@
-{ lib, stdenv, fetchurl, pkg-config, libdrm, libpciaccess, cairo, xorgproto, udev
-, libX11, libXext, libXv, libXrandr, glib, bison, libunwind, python3, kmod
-, procps, utilmacros, gtk-doc, openssl, peg, elfutils
+{ lib
+, stdenv
+, fetchurl
+, pkg-config
+, libdrm
+, libpciaccess
+, cairo
+, xorgproto
+, udev
+, libX11
+, libXext
+, libXv
+, libXrandr
+, glib
+, bison
+, libunwind
+, python3
+, kmod
+, procps
+, utilmacros
+, gtk-doc
+, docbook_xsl
+, openssl
+, peg
+, elfutils
+, meson
+, ninja
+, valgrind
+, xmlrpc_c
+, gsl
+, alsa-lib
+, curl
+, json_c
+, liboping
+, flex
+, docutils
 }:
 
 stdenv.mkDerivation rec {
   pname = "intel-gpu-tools";
-  version = "1.25";
+  version = "1.26";
 
   src = fetchurl {
     url = "https://xorg.freedesktop.org/archive/individual/app/igt-gpu-tools-${version}.tar.xz";
-    sha256 = "04fx7xclhick3k7fyk9c4mn8mxzf1253j1r0hrvj9sl40j7lsia0";
+    sha256 = "1dwvxh1yplsh1a7h3gpp40g91v12cfxy6yy99s1v9yr2kwxikm1n";
   };
 
-  nativeBuildInputs = [ pkg-config utilmacros ];
-  buildInputs = [ libdrm libpciaccess cairo xorgproto udev libX11 kmod
-    libXext libXv libXrandr glib bison libunwind python3 procps
-    gtk-doc openssl peg elfutils ];
+  nativeBuildInputs = [ pkg-config utilmacros meson ninja flex bison gtk-doc docutils docbook_xsl ];
+  buildInputs = [
+    libdrm
+    libpciaccess
+    cairo
+    xorgproto
+    udev
+    libX11
+    kmod
+    libXext
+    libXv
+    libXrandr
+    glib
+    libunwind
+    python3
+    procps
+    openssl
+    peg
+    elfutils
+    valgrind
+    xmlrpc_c
+    gsl
+    alsa-lib
+    curl
+    json_c
+    liboping
+  ];
 
   NIX_CFLAGS_COMPILE = [ "-Wno-error=array-bounds" ];
 
   preConfigure = ''
-    ./autogen.sh
+    patchShebangs tests man
   '';
 
-  preBuild = ''
-    patchShebangs tests
-
-    patchShebangs debugger/system_routine/pre_cpp.py
-    substituteInPlace tools/Makefile.am --replace '$(CAIRO_CFLAGS)' '$(CAIRO_CFLAGS) $(GLIB_CFLAGS)'
-    substituteInPlace tests/Makefile.am --replace '$(CAIRO_CFLAGS)' '$(CAIRO_CFLAGS) $(GLIB_CFLAGS)'
-  '';
-
-  enableParallelBuilding = true;
+  hardeningDisable = [ "bindnow" ];
 
   meta = with lib; {
     homepage = "https://01.org/linuxgraphics/";
diff --git a/pkgs/servers/hqplayerd/default.nix b/pkgs/servers/hqplayerd/default.nix
index ecd3063e0934..4bd1ea3d63e0 100644
--- a/pkgs/servers/hqplayerd/default.nix
+++ b/pkgs/servers/hqplayerd/default.nix
@@ -45,11 +45,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "hqplayerd";
-  version = "4.27.0-70";
+  version = "4.27.2-72";
 
   src = fetchurl {
     url = "https://www.signalyst.eu/bins/${pname}/fc34/${pname}-${version}sse42.fc34.x86_64.rpm";
-    sha256 = "sha256-12EMKkMMMcQZwgvK0YjuHknv2JLqU3REcJUTPUmYZ6A=";
+    sha256 = "sha256-oCZS68n9R6Hm6lltcL6zQhPaU9FRqtB59DrstRNjnH8=";
   };
 
   unpackPhase = ''
diff --git a/pkgs/servers/mail/mailman/postorius.nix b/pkgs/servers/mail/mailman/postorius.nix
index d807f7f797c0..57df52d0a0a6 100644
--- a/pkgs/servers/mail/mailman/postorius.nix
+++ b/pkgs/servers/mail/mailman/postorius.nix
@@ -6,11 +6,11 @@ buildPythonPackage rec {
   pname = "postorius";
   # Note: Mailman core must be on the latest version before upgrading Postorious.
   # See: https://gitlab.com/mailman/postorius/-/issues/516#note_544571309
-  version = "1.3.4";
+  version = "1.3.5";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-L2ApUGQNvR0UVvodVM+wMzjYLZkegI4fT4yUiU/cibU=";
+    sha256 = "0f23c6542bf0f6e6364d678c094ee5804acfe59ecbcc0e944bc4c13834e24e80";
   };
 
   propagatedBuildInputs = [ django-mailman3 readme_renderer ];
diff --git a/pkgs/servers/roon-server/default.nix b/pkgs/servers/roon-server/default.nix
index edf89b78398d..ffb4bc0c7e82 100644
--- a/pkgs/servers/roon-server/default.nix
+++ b/pkgs/servers/roon-server/default.nix
@@ -14,7 +14,7 @@
 }:
 stdenv.mkDerivation rec {
   pname = "roon-server";
-  version = "1.8-846";
+  version = "1.8-850";
 
   src =
     let
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
     in
     fetchurl {
       url = "http://download.roonlabs.com/builds/RoonServer_linuxx64_${urlVersion}.tar.bz2";
-      sha256 = "sha256-BoHvODaAcK5b4/syOm3vpOTpq9ETovpWKUqG+UGr2e0=";
+      sha256 = "sha256-NSNaL0ERYTSYn9ETjWcQiuI4hY+w/lWVOz3n9lt6O+4=";
     };
 
   buildInputs = [
diff --git a/pkgs/tools/networking/dd-agent/datadog-agent.nix b/pkgs/tools/networking/dd-agent/datadog-agent.nix
index 7f500b2c09fc..e050b68ca2d5 100644
--- a/pkgs/tools/networking/dd-agent/datadog-agent.nix
+++ b/pkgs/tools/networking/dd-agent/datadog-agent.nix
@@ -10,15 +10,15 @@ let
 
 in buildGoModule rec {
   pname = "datadog-agent";
-  version = "7.30.2";
+  version = "7.31.0";
 
   src = fetchFromGitHub {
     inherit owner repo;
     rev = version;
-    sha256 = "17ahrxhb87sj7f04wg44xv4k9wrlvf04j92ac5936a6maygp01rd";
+    sha256 = "sha256-APwR3/bvCHNnJWxRPSLLe4lHYv39wfw3WhGDEkxAku8=";
   };
 
-  vendorSha256 = "06ryy501vibc6n14qwg94394c76l060525y6qg261qb748mbi8qi";
+  vendorSha256 = "sha256-CNQJvnNnB29duALEXPguEJsoRHdieAiPFbwXa89jxUk=";
 
   subPackages = [
     "cmd/agent"