diff --git a/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml b/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml
index 2be2c66080d1..3c7f9a274b3d 100644
--- a/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml
@@ -207,6 +207,13 @@
           <link linkend="opt-services.postfixadmin.enable">postfixadmin</link>.
         </para>
       </listitem>
+      <listitem>
+        <para>
+          <link xlink:href="https://sr.ht/~emersion/soju">soju</link>, a
+          user-friendly IRC bouncer. Available as
+          <link xlink:href="options.html#opt-services.soju.enable">services.soju</link>.
+        </para>
+      </listitem>
     </itemizedlist>
   </section>
   <section xml:id="sec-release-21.11-incompatibilities">
@@ -1088,6 +1095,15 @@ Superuser created successfully.
           but instead use more of the YAML-specific syntax.
         </para>
       </listitem>
+      <listitem>
+        <para>
+          GNOME desktop environment now enables
+          <literal>QGnomePlatform</literal> as the Qt platform theme,
+          which should avoid crashes when opening file chooser dialogs
+          in Qt apps by using XDG desktop portal. Additionally, it will
+          make the apps fit better visually.
+        </para>
+      </listitem>
     </itemizedlist>
   </section>
 </section>
diff --git a/nixos/doc/manual/release-notes/rl-2111.section.md b/nixos/doc/manual/release-notes/rl-2111.section.md
index 6db546caba33..c5a4b5bd98c0 100644
--- a/nixos/doc/manual/release-notes/rl-2111.section.md
+++ b/nixos/doc/manual/release-notes/rl-2111.section.md
@@ -63,6 +63,8 @@ subsonic-compatible api. Available as [navidrome](#opt-services.navidrome.enable
 
 - [postfixadmin](https://postfixadmin.sourceforge.io/), a web based virtual user administration interface for Postfix mail servers. Available as [postfixadmin](#opt-services.postfixadmin.enable).
 
+- [soju](https://sr.ht/~emersion/soju), a user-friendly IRC bouncer. Available as [services.soju](options.html#opt-services.soju.enable).
+
 ## Backward Incompatibilities {#sec-release-21.11-incompatibilities}
 
 
@@ -312,3 +314,5 @@ To be able to access the web UI this port needs to be opened in the firewall.
 - Nginx will use the value of `sslTrustedCertificate` if provided for a virtual host, even if `enableACME` is set. This is useful for providers not using the same certificate to sign OCSP responses and server certificates.
 
 - `lib.formats.yaml`'s `generate` will not generate JSON anymore, but instead use more of the YAML-specific syntax.
+
+- GNOME desktop environment now enables `QGnomePlatform` as the Qt platform theme, which should avoid crashes when opening file chooser dialogs in Qt apps by using XDG desktop portal. Additionally, it will make the apps fit better visually.
diff --git a/nixos/modules/misc/ids.nix b/nixos/modules/misc/ids.nix
index c7ab3f313a6e..02ae1390ce80 100644
--- a/nixos/modules/misc/ids.nix
+++ b/nixos/modules/misc/ids.nix
@@ -350,6 +350,7 @@ in
       # shadow = 318; # unused
       hqplayer = 319;
       moonraker = 320;
+      distcc = 321;
 
       # When adding a uid, make sure it doesn't match an existing gid. And don't use uids above 399!
 
@@ -654,6 +655,7 @@ in
       shadow = 318;
       hqplayer = 319;
       moonraker = 320;
+      distcc = 321;
 
       # When adding a gid, make sure it doesn't match an existing
       # uid. Users and groups with the same name should have equal
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 71a1118fd38e..1998a309035b 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -374,6 +374,7 @@
   ./services/desktops/zeitgeist.nix
   ./services/development/bloop.nix
   ./services/development/blackfire.nix
+  ./services/development/distccd.nix
   ./services/development/hoogle.nix
   ./services/development/jupyter/default.nix
   ./services/development/jupyterhub/default.nix
@@ -833,6 +834,7 @@
   ./services/networking/smokeping.nix
   ./services/networking/softether.nix
   ./services/networking/solanum.nix
+  ./services/networking/soju.nix
   ./services/networking/spacecookie.nix
   ./services/networking/spiped.nix
   ./services/networking/squid.nix
diff --git a/nixos/modules/services/development/distccd.nix b/nixos/modules/services/development/distccd.nix
new file mode 100644
index 000000000000..8790ea08d0c1
--- /dev/null
+++ b/nixos/modules/services/development/distccd.nix
@@ -0,0 +1,155 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.services.distccd;
+in
+{
+  options = {
+    services.distccd = {
+      enable = mkEnableOption "distccd";
+
+      allowedClients = mkOption {
+        type = types.listOf types.str;
+        default = [ "127.0.0.1" ];
+        example = [ "127.0.0.1" "192.168.0.0/24" "10.0.0.0/24" ];
+        description = ''
+          Client IPs which are allowed to connect to distccd in CIDR notation.
+
+          Anyone who can connect to the distccd server can run arbitrary
+          commands on that system as the distcc user, therefore you should use
+          this judiciously.
+        '';
+      };
+
+      jobTimeout = mkOption {
+        type = types.nullOr types.int;
+        default = null;
+        description = ''
+          Maximum duration, in seconds, of a single compilation request.
+        '';
+      };
+
+      logLevel = mkOption {
+        type = types.nullOr (types.enum [ "critical" "error" "warning" "notice" "info" "debug" ]);
+        default = "warning";
+        description = ''
+          Set the minimum severity of error that will be included in the log
+          file. Useful if you only want to see error messages rather than an
+          entry for each connection.
+        '';
+      };
+
+      maxJobs = mkOption {
+        type = types.nullOr types.int;
+        default = null;
+        description = ''
+          Maximum number of tasks distccd should execute at any time.
+        '';
+      };
+
+
+      nice = mkOption {
+        type = types.nullOr types.int;
+        default = null;
+        description = ''
+          Niceness of the compilation tasks.
+        '';
+      };
+
+      openFirewall = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          Opens the specified TCP port for distcc.
+        '';
+      };
+
+      package = mkOption {
+        type = types.package;
+        default = pkgs.distcc;
+        example = "pkgs.distcc";
+        description = ''
+          The distcc package to use.
+        '';
+      };
+
+      port = mkOption {
+        type = types.port;
+        default = 3632;
+        description = ''
+          The TCP port which distccd will listen on.
+        '';
+      };
+
+      stats = {
+        enable = mkEnableOption "statistics reporting via HTTP server";
+        port = mkOption {
+          type = types.port;
+          default = 3633;
+          description = ''
+            The TCP port which the distccd statistics HTTP server will listen
+            on.
+          '';
+        };
+      };
+
+      zeroconf = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          Whether to register via mDNS/DNS-SD
+        '';
+      };
+    };
+  };
+
+  config = mkIf cfg.enable {
+    networking.firewall = mkIf cfg.openFirewall {
+      allowedTCPPorts = [ cfg.port ]
+        ++ optionals cfg.stats.enable [ cfg.stats.port ];
+    };
+
+    systemd.services.distccd = {
+      after = [ "network.target" ];
+      wantedBy = [ "multi-user.target" ];
+
+      description = "Distributed C, C++ and Objective-C compiler";
+      documentation = [ "man:distccd(1)" ];
+
+      serviceConfig = {
+        User = "distcc";
+        Group = "distcc";
+        # FIXME: I'd love to get rid of `--enable-tcp-insecure` here, but I'm
+        # not sure how I'm supposed to get distccd to "accept" running a binary
+        # (the compiler) that's outside of /usr/lib.
+        ExecStart = pkgs.writeShellScript "start-distccd" ''
+          export PATH="${pkgs.distccMasquerade}/bin"
+          ${cfg.package}/bin/distccd \
+            --no-detach \
+            --daemon \
+            --enable-tcp-insecure \
+            --port ${toString cfg.port} \
+            ${optionalString (cfg.jobTimeout != null) "--job-lifetime ${toString cfg.jobTimeout}"} \
+            ${optionalString (cfg.logLevel != null) "--log-level ${cfg.logLevel}"} \
+            ${optionalString (cfg.maxJobs != null) "--jobs ${toString cfg.maxJobs}"} \
+            ${optionalString (cfg.nice != null) "--nice ${toString cfg.nice}"} \
+            ${optionalString cfg.stats.enable "--stats"} \
+            ${optionalString cfg.stats.enable "--stats-port ${toString cfg.stats.port}"} \
+            ${optionalString cfg.zeroconf "--zeroconf"} \
+            ${concatMapStrings (c: "--allow ${c} ") cfg.allowedClients}
+        '';
+      };
+    };
+
+    users = {
+      groups.distcc.gid = config.ids.gids.distcc;
+      users.distcc = {
+        description = "distccd user";
+        group = "distcc";
+        uid = config.ids.uids.distcc;
+      };
+    };
+  };
+}
diff --git a/nixos/modules/services/networking/soju.nix b/nixos/modules/services/networking/soju.nix
new file mode 100644
index 000000000000..68a33e9dccba
--- /dev/null
+++ b/nixos/modules/services/networking/soju.nix
@@ -0,0 +1,113 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.services.soju;
+  stateDir = "/var/lib/soju";
+  listenCfg = concatMapStringsSep "\n" (l: "listen ${l}") cfg.listen;
+  tlsCfg = optionalString (cfg.tlsCertificate != null)
+    "tls ${cfg.tlsCertificate} ${cfg.tlsCertificateKey}";
+  logCfg = optionalString cfg.enableMessageLogging
+    "log fs ${stateDir}/logs";
+
+  configFile = pkgs.writeText "soju.conf" ''
+    ${listenCfg}
+    hostname ${cfg.hostName}
+    ${tlsCfg}
+    db sqlite3 ${stateDir}/soju.db
+    ${logCfg}
+    http-origin ${concatStringsSep " " cfg.httpOrigins}
+    accept-proxy-ip ${concatStringsSep " " cfg.acceptProxyIP}
+
+    ${cfg.extraConfig}
+  '';
+in
+{
+  ###### interface
+
+  options.services.soju = {
+    enable = mkEnableOption "soju";
+
+    listen = mkOption {
+      type = types.listOf types.str;
+      default = [ ":6697" ];
+      description = ''
+        Where soju should listen for incoming connections. See the
+        <literal>listen</literal> directive in
+        <citerefentry><refentrytitle>soju</refentrytitle>
+        <manvolnum>1</manvolnum></citerefentry>.
+      '';
+    };
+
+    hostName = mkOption {
+      type = types.str;
+      default = config.networking.hostName;
+      description = "Server hostname.";
+    };
+
+    tlsCertificate = mkOption {
+      type = types.nullOr types.path;
+      example = "/var/host.cert";
+      description = "Path to server TLS certificate.";
+    };
+
+    tlsCertificateKey = mkOption {
+      type = types.nullOr types.path;
+      example = "/var/host.key";
+      description = "Path to server TLS certificate key.";
+    };
+
+    enableMessageLogging = mkOption {
+      type = types.bool;
+      default = true;
+      description = "Whether to enable message logging.";
+    };
+
+    httpOrigins = mkOption {
+      type = types.listOf types.str;
+      default = [];
+      description = ''
+        List of allowed HTTP origins for WebSocket listeners. The parameters are
+        interpreted as shell patterns, see
+        <citerefentry><refentrytitle>glob</refentrytitle>
+        <manvolnum>7</manvolnum></citerefentry>.
+      '';
+    };
+
+    acceptProxyIP = mkOption {
+      type = types.listOf types.str;
+      default = [];
+      description = ''
+        Allow the specified IPs to act as a proxy. Proxys have the ability to
+        overwrite the remote and local connection addresses (via the X-Forwarded-\*
+        HTTP header fields). The special name "localhost" accepts the loopback
+        addresses 127.0.0.0/8 and ::1/128. By default, all IPs are rejected.
+      '';
+    };
+
+    extraConfig = mkOption {
+      type = types.lines;
+      default = "";
+      description = "Lines added verbatim to the configuration file.";
+    };
+  };
+
+  ###### implementation
+
+  config = mkIf cfg.enable {
+    systemd.services.soju = {
+      description = "soju IRC bouncer";
+      wantedBy = [ "multi-user.target" ];
+      after = [ "network-online.target" ];
+      serviceConfig = {
+        DynamicUser = true;
+        Restart = "always";
+        ExecStart = "${pkgs.soju}/bin/soju -config ${configFile}";
+        StateDirectory = "soju";
+      };
+    };
+  };
+
+  meta.maintainers = with maintainers; [ malvo ];
+}
diff --git a/nixos/modules/services/search/elasticsearch.nix b/nixos/modules/services/search/elasticsearch.nix
index 91d8f544e16b..440f34b3dc5c 100644
--- a/nixos/modules/services/search/elasticsearch.nix
+++ b/nixos/modules/services/search/elasticsearch.nix
@@ -5,8 +5,6 @@ with lib;
 let
   cfg = config.services.elasticsearch;
 
-  es6 = builtins.compareVersions cfg.package.version "6" >= 0;
-
   esConfig = ''
     network.host: ${cfg.listenAddress}
     cluster.name: ${cfg.cluster_name}
@@ -36,7 +34,8 @@ let
     postBuild = "${pkgs.coreutils}/bin/mkdir -p $out/plugins";
   };
 
-in {
+in
+{
 
   ###### interface
 
@@ -116,20 +115,20 @@ in {
 
     extraCmdLineOptions = mkOption {
       description = "Extra command line options for the elasticsearch launcher.";
-      default = [];
+      default = [ ];
       type = types.listOf types.str;
     };
 
     extraJavaOptions = mkOption {
       description = "Extra command line options for Java.";
-      default = [];
+      default = [ ];
       type = types.listOf types.str;
       example = [ "-Djava.net.preferIPv4Stack=true" ];
     };
 
     plugins = mkOption {
       description = "Extra elasticsearch plugins";
-      default = [];
+      default = [ ];
       type = types.listOf types.package;
       example = lib.literalExample "[ pkgs.elasticsearchPlugins.discovery-ec2 ]";
     };
@@ -146,9 +145,7 @@ in {
       path = [ pkgs.inetutils ];
       environment = {
         ES_HOME = cfg.dataDir;
-        ES_JAVA_OPTS = toString ( optional (!es6) [ "-Des.path.conf=${configDir}" ]
-                                  ++ cfg.extraJavaOptions);
-      } // optionalAttrs es6 {
+        ES_JAVA_OPTS = toString cfg.extraJavaOptions;
         ES_PATH_CONF = configDir;
       };
       serviceConfig = {
@@ -187,7 +184,10 @@ in {
         rm -f "${configDir}/logging.yml"
         cp ${loggingConfigFile} ${configDir}/${loggingConfigFilename}
         mkdir -p ${configDir}/scripts
-        ${optionalString es6 "cp ${cfg.package}/config/jvm.options ${configDir}/jvm.options"}
+        cp ${cfg.package}/config/jvm.options ${configDir}/jvm.options
+        # redirect jvm logs to the data directory
+        mkdir -m 0700 -p ${cfg.dataDir}/logs
+        ${pkgs.sd}/bin/sd 'logs/gc.log' '${cfg.dataDir}/logs/gc.log' ${configDir}/jvm.options \
 
         if [ "$(id -u)" = 0 ]; then chown -R elasticsearch:elasticsearch ${cfg.dataDir}; fi
       '';
diff --git a/nixos/modules/services/x11/desktop-managers/gnome.nix b/nixos/modules/services/x11/desktop-managers/gnome.nix
index b0859321a525..4bc42525906c 100644
--- a/nixos/modules/services/x11/desktop-managers/gnome.nix
+++ b/nixos/modules/services/x11/desktop-managers/gnome.nix
@@ -372,6 +372,13 @@ in
       xdg.portal.enable = true;
       xdg.portal.extraPortals = [ pkgs.xdg-desktop-portal-gtk ];
 
+      # Harmonize Qt5 application style and also make them use the portal for file chooser dialog.
+      qt5 = {
+        enable = mkDefault true;
+        platformTheme = mkDefault "gnome";
+        style = mkDefault "adwaita";
+      };
+
       networking.networkmanager.enable = mkDefault true;
 
       services.xserver.updateDbusEnvironment = true;
diff --git a/nixos/modules/system/etc/etc.nix b/nixos/modules/system/etc/etc.nix
index 6971ab42d99f..84468ea31f74 100644
--- a/nixos/modules/system/etc/etc.nix
+++ b/nixos/modules/system/etc/etc.nix
@@ -6,7 +6,9 @@ with lib;
 
 let
 
-  etc' = filter (f: f.enable) (attrValues config.environment.etc);
+  # if the source is a local file, it should be imported to the store
+  localToStore = mapAttrs (name: value: if name == "source" then "${value}" else value);
+  etc' = map localToStore (filter (f: f.enable) (attrValues config.environment.etc));
 
   etc = pkgs.runCommandLocal "etc" {
     # This is needed for the systemd module
diff --git a/nixos/modules/tasks/network-interfaces.nix b/nixos/modules/tasks/network-interfaces.nix
index 879f077332e3..8f9c66b01572 100644
--- a/nixos/modules/tasks/network-interfaces.nix
+++ b/nixos/modules/tasks/network-interfaces.nix
@@ -1296,14 +1296,14 @@ in
             '';
 
             # Udev script to execute for a new WLAN interface. The script configures the new WLAN interface.
-            newInterfaceScript = device: new: pkgs.writeScript "udev-run-script-wlan-interfaces-${new._iName}.sh" ''
+            newInterfaceScript = new: pkgs.writeScript "udev-run-script-wlan-interfaces-${new._iName}.sh" ''
               #!${pkgs.runtimeShell}
               # Configure the new interface
               ${pkgs.iw}/bin/iw dev ${new._iName} set type ${new.type}
-              ${optionalString (new.type == "mesh" && new.meshID!=null) "${pkgs.iw}/bin/iw dev ${device} set meshid ${new.meshID}"}
-              ${optionalString (new.type == "monitor" && new.flags!=null) "${pkgs.iw}/bin/iw dev ${device} set monitor ${new.flags}"}
-              ${optionalString (new.type == "managed" && new.fourAddr!=null) "${pkgs.iw}/bin/iw dev ${device} set 4addr ${if new.fourAddr then "on" else "off"}"}
-              ${optionalString (new.mac != null) "${pkgs.iproute2}/bin/ip link set dev ${device} address ${new.mac}"}
+              ${optionalString (new.type == "mesh" && new.meshID!=null) "${pkgs.iw}/bin/iw dev ${new._iName} set meshid ${new.meshID}"}
+              ${optionalString (new.type == "monitor" && new.flags!=null) "${pkgs.iw}/bin/iw dev ${new._iName} set monitor ${new.flags}"}
+              ${optionalString (new.type == "managed" && new.fourAddr!=null) "${pkgs.iw}/bin/iw dev ${new._iName} set 4addr ${if new.fourAddr then "on" else "off"}"}
+              ${optionalString (new.mac != null) "${pkgs.iproute2}/bin/ip link set dev ${new._iName} address ${new.mac}"}
             '';
 
             # Udev attributes for systemd to name the device and to create a .device target.
@@ -1318,7 +1318,7 @@ in
             # It is important to have that rule first as overwriting the NAME attribute also prevents the
             # next rules from matching.
             ${flip (concatMapStringsSep "\n") (wlanListDeviceFirst device wlanDeviceInterfaces.${device}) (interface:
-            ''ACTION=="add", SUBSYSTEM=="net", ENV{DEVTYPE}=="wlan", ENV{INTERFACE}=="${interface._iName}", ${systemdAttrs interface._iName}, RUN+="${newInterfaceScript device interface}"'')}
+            ''ACTION=="add", SUBSYSTEM=="net", ENV{DEVTYPE}=="wlan", ENV{INTERFACE}=="${interface._iName}", ${systemdAttrs interface._iName}, RUN+="${newInterfaceScript interface}"'')}
 
             # Add the required, new WLAN interfaces to the default WLAN interface with the
             # persistent, default name as assigned by udev.
diff --git a/nixos/tests/networking.nix b/nixos/tests/networking.nix
index c8756207f27b..22f7ca5a9b82 100644
--- a/nixos/tests/networking.nix
+++ b/nixos/tests/networking.nix
@@ -721,6 +721,24 @@ let
         assert "mtu 1442" in client.succeed("ip l show dummy0")
       '';
     };
+    wlanInterface = let
+      testMac = "06:00:00:00:02:00";
+    in {
+      name = "WlanInterface";
+      machine = { pkgs, ... }: {
+        boot.kernelModules = [ "mac80211_hwsim" ];
+        networking.wlanInterfaces = {
+          wlan0 = { device = "wlan0"; };
+          wap0 = { device = "wlan0"; mac = testMac; };
+        };
+      };
+      testScript = ''
+        machine.start()
+        machine.wait_for_unit("network.target")
+        machine.wait_until_succeeds("ip address show wap0 | grep -q ${testMac}")
+        machine.fail("ip address show wlan0 | grep -q ${testMac}")
+      '';
+    };
   };
 
 in mapAttrs (const (attrs: makeTest (attrs // {
diff --git a/pkgs/applications/graphics/gthumb/default.nix b/pkgs/applications/graphics/gthumb/default.nix
index cd3a6f368e9c..50e1babda2ac 100644
--- a/pkgs/applications/graphics/gthumb/default.nix
+++ b/pkgs/applications/graphics/gthumb/default.nix
@@ -5,6 +5,7 @@
 , meson
 , ninja
 , exiv2
+, libheif
 , libjpeg
 , libtiff
 , gst_all_1
@@ -32,11 +33,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gthumb";
-  version = "3.11.3";
+  version = "3.11.4";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "11bvcimamdcksgqj1ymh54yzhpwc5j8glda8brqqhwq3h2wj0j9d";
+    sha256 = "sha256-3ZsPiUXX34Ev/a3OyMO94dyXZyMy4AVt5Cp/ELZLIGw=";
   };
 
   nativeBuildInputs = [
@@ -66,6 +67,7 @@ stdenv.mkDerivation rec {
     json-glib
     lcms2
     libchamplain
+    libheif
     libjpeg
     libraw
     librsvg
diff --git a/pkgs/applications/networking/browsers/chromium/upstream-info.json b/pkgs/applications/networking/browsers/chromium/upstream-info.json
index 5d8d4afeece8..93511c8febae 100644
--- a/pkgs/applications/networking/browsers/chromium/upstream-info.json
+++ b/pkgs/applications/networking/browsers/chromium/upstream-info.json
@@ -18,9 +18,9 @@
     }
   },
   "beta": {
-    "version": "94.0.4606.20",
-    "sha256": "0wp9fdw7jkrzhaz8dils7k1ssd6v7kkiz4y9l81s37xxi3xj1drg",
-    "sha256bin64": "0ahc09qv78vmx72kqhjj2lwcniqn9q73vkc1b9lyv184ai3269sq",
+    "version": "94.0.4606.31",
+    "sha256": "1f5hk2acd9lj88m2acz8ik85fh5h3giz65p19dpfg92zsyly54nf",
+    "sha256bin64": "1ypf9j51a4kmx27x3s9izzbd2r094idz194gwhbdly75l1x8hk4z",
     "deps": {
       "gn": {
         "version": "2021-08-11",
diff --git a/pkgs/applications/networking/instant-messengers/jitsi-meet-electron/default.nix b/pkgs/applications/networking/instant-messengers/jitsi-meet-electron/default.nix
index 6a98df12583d..149be3686e85 100644
--- a/pkgs/applications/networking/instant-messengers/jitsi-meet-electron/default.nix
+++ b/pkgs/applications/networking/instant-messengers/jitsi-meet-electron/default.nix
@@ -8,11 +8,11 @@
 
 stdenv.mkDerivation rec {
   pname = "jitsi-meet-electron";
-  version = "2.8.10";
+  version = "2.8.11";
 
   src = fetchurl {
     url = "https://github.com/jitsi/jitsi-meet-electron/releases/download/v${version}/jitsi-meet-x86_64.AppImage";
-    sha256 = "sha256-k++vumbhcMl9i4s8f04zOUAfYlA1g477FjrGuEGSD1U=";
+    sha256 = "sha256-DznbSwA1UISw3EkIfM5hGgmIToeXsH1b1HB7UOgDTKU=";
     name = "${pname}-${version}.AppImage";
   };
 
diff --git a/pkgs/applications/networking/ipfs-cluster/default.nix b/pkgs/applications/networking/ipfs-cluster/default.nix
index 9a63f90b3936..a7627feb94d1 100644
--- a/pkgs/applications/networking/ipfs-cluster/default.nix
+++ b/pkgs/applications/networking/ipfs-cluster/default.nix
@@ -2,15 +2,15 @@
 
 buildGoModule rec {
   pname = "ipfs-cluster";
-  version = "0.14.0";
+  version = "0.14.1";
 
-  vendorSha256 = "sha256-I8UJxqzbcOE6pHsKkktrEXVHurxwe0D20GZZmASdWH4=";
+  vendorSha256 = "sha256-vDNWYgWlM3kJqlHW/6Bj6P+t6M61TvOVRJwDN2p0mi4=";
 
   src = fetchFromGitHub {
     owner = "ipfs";
     repo = "ipfs-cluster";
     rev = "v${version}";
-    sha256 = "sha256-lB0sYsbZfUJgQVNEFLoXNFszWYxlXNEQbRQWA7fRT2A=";
+    sha256 = "sha256-GELCd12LhA4CBe9DRRBu4r+AwCksaRVIWcSAJScvnbk=";
   };
 
   meta = with lib; {
diff --git a/pkgs/applications/networking/mailreaders/mutt/default.nix b/pkgs/applications/networking/mailreaders/mutt/default.nix
index 0c2ffdc7fffc..a7b90c284acf 100644
--- a/pkgs/applications/networking/mailreaders/mutt/default.nix
+++ b/pkgs/applications/networking/mailreaders/mutt/default.nix
@@ -27,11 +27,11 @@ with lib;
 
 stdenv.mkDerivation rec {
   pname = "mutt";
-  version = "2.1.1";
+  version = "2.1.2";
 
   src = fetchurl {
     url = "http://ftp.mutt.org/pub/mutt/${pname}-${version}.tar.gz";
-    sha256 = "0jjjvqkqmpj55v111p1a1i2ry7mpd1bpphn1bhvlr18rgw7xdrja";
+    sha256 = "0s9wkygjd7xhvd1zdaidbvszq4abb0iv5830ir65glcfzbdbfak9";
   };
 
   patches = optional smimeSupport (fetchpatch {
diff --git a/pkgs/applications/networking/mailreaders/notmuch/default.nix b/pkgs/applications/networking/mailreaders/notmuch/default.nix
index 624d3240c470..4e28d93e8926 100644
--- a/pkgs/applications/networking/mailreaders/notmuch/default.nix
+++ b/pkgs/applications/networking/mailreaders/notmuch/default.nix
@@ -11,11 +11,11 @@
 
 stdenv.mkDerivation rec {
   pname = "notmuch";
-  version = "0.32.2";
+  version = "0.32.3";
 
   src = fetchurl {
     url = "https://notmuchmail.org/releases/notmuch-${version}.tar.xz";
-    sha256 = "1myylb19hj5nb1vriqng252vfjwwkgbi3gxj93pi2q1fzyw7w2lf";
+    sha256 = "114bbyjl2ppmy4pw0b5zwmi7lxiz6xd1k6zq0qcgdv7ahkwgybxy";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/build-support/build-fhs-userenv/chrootenv/chrootenv.c b/pkgs/build-support/build-fhs-userenv/chrootenv/chrootenv.c
index 27e70e3fe5c4..324c9d24ba04 100644
--- a/pkgs/build-support/build-fhs-userenv/chrootenv/chrootenv.c
+++ b/pkgs/build-support/build-fhs-userenv/chrootenv/chrootenv.c
@@ -122,7 +122,7 @@ int main(gint argc, gchar **argv) {
     }
 
     // hide all mounts we do from the parent
-    fail_if(mount(0, "/", 0, MS_PRIVATE | MS_REC, 0));
+    fail_if(mount(0, "/", 0, MS_SLAVE | MS_REC, 0));
 
     if (uid != 0) {
       spit("/proc/self/setgroups", "deny");
diff --git a/pkgs/development/beam-modules/default.nix b/pkgs/development/beam-modules/default.nix
index b6be8c3e7fbd..1c9d5099b44f 100644
--- a/pkgs/development/beam-modules/default.nix
+++ b/pkgs/development/beam-modules/default.nix
@@ -76,7 +76,7 @@ let
         debugInfo = true;
       };
 
-      elixir_ls = callPackage ./elixir_ls.nix { inherit elixir fetchMixDeps mixRelease; };
+      elixir_ls = callPackage ./elixir-ls { inherit elixir fetchMixDeps mixRelease; };
 
       lfe = lfe_1_3;
       lfe_1_3 = lib'.callLFE ../interpreters/lfe/1.3.nix { inherit erlang buildRebar3 buildHex; };
diff --git a/pkgs/development/beam-modules/elixir_ls.nix b/pkgs/development/beam-modules/elixir-ls/default.nix
similarity index 92%
rename from pkgs/development/beam-modules/elixir_ls.nix
rename to pkgs/development/beam-modules/elixir-ls/default.nix
index 2b6cc4f56810..1385b40fc1f5 100644
--- a/pkgs/development/beam-modules/elixir_ls.nix
+++ b/pkgs/development/beam-modules/elixir-ls/default.nix
@@ -4,20 +4,20 @@
 
 mixRelease rec {
   pname = "elixir-ls";
-  version = "0.8.0";
+  version = "0.8.1";
 
   src = fetchFromGitHub {
     owner = "elixir-lsp";
     repo = "elixir-ls";
     rev = "v${version}";
-    sha256 = "sha256-pUvONMTYH8atF/p2Ep/K3bwJUDxTzCsxLPbpjP0tQpM=";
+    sha256 = "sha256-KlZq12RCor9GrwA8QMP3R+jUQ/xFHRjkLwwkvthiMU0=";
     fetchSubmodules = true;
   };
 
   mixFodDeps = fetchMixDeps {
     pname = "mix-deps-${pname}";
     inherit src version;
-    sha256 = "sha256-YRzPASpg1K2kZUga5/aQf4Q33d8aHCwhw7KJxSY56k4=";
+    sha256 = "sha256-OzjToAg+q/ybCyqzNFk28OBsItjFTbdPi416EPh2qX0=";
   };
 
   # elixir_ls is an umbrella app
@@ -68,4 +68,5 @@ mixRelease rec {
     platforms = platforms.unix;
     maintainers = teams.beam.members;
   };
+  passthru.updateScript = ./update.sh;
 }
diff --git a/pkgs/development/beam-modules/elixir-ls/update.sh b/pkgs/development/beam-modules/elixir-ls/update.sh
new file mode 100755
index 000000000000..8bc1c2b6e966
--- /dev/null
+++ b/pkgs/development/beam-modules/elixir-ls/update.sh
@@ -0,0 +1,32 @@
+#!/usr/bin/env nix-shell
+#! nix-shell -i oil -p jq sd nix-prefetch-github ripgrep
+
+# TODO set to `verbose` or `extdebug` once implemented in oil
+shopt --set xtrace
+
+var directory = $(dirname $0 | xargs realpath)
+var owner = "elixir-lsp"
+var repo = "elixir-ls"
+var latest_rev = $(curl -q https://api.github.com/repos/${owner}/${repo}/releases/latest | \
+  jq -r '.tag_name')
+var latest_version = $(echo $latest_rev | sd 'v' '')
+var current_version = $(nix-instantiate -A elixir_ls.version --eval --json | jq -r)
+if ("$latest_version" == "$current_version") {
+  echo "elixir-ls is already up-to-date"
+  return 0
+} else {
+  var tarball_meta = $(nix-prefetch-github $owner $repo --rev "$latest_rev")
+  var tarball_hash = "sha256-$(echo $tarball_meta | jq -r '.sha256')"
+  var sha256s = $(rg '"sha256-.+"' $directory/default.nix | sd '.+"(.+)";' '$1' )
+  echo $sha256s | read --line :github_sha256
+  echo $sha256s | tail -n 1 | read --line :old_mix_sha256
+  sd 'version = ".+"' "version = \"$latest_version\"" "$directory/default.nix"
+  sd "sha256 = \"$github_sha256\"" "sha256 = \"$tarball_hash\"" "$directory/default.nix"
+  sd "sha256 = \"$old_mix_sha256\"" "sha256 = \"\"" "$directory/default.nix"
+
+  var new_mix_hash = $(nix-build -A elixir_ls.mixFodDeps 2>&1 | \
+    tail -n 1 | \
+    sd '\s+got:\s+' '')
+
+  sd "sha256 = \"\"" "sha256 = \"$new_mix_hash\"" "$directory/default.nix"
+}
diff --git a/pkgs/development/interpreters/clojure/babashka.nix b/pkgs/development/interpreters/clojure/babashka.nix
index 850a5f3d772e..e8a1bfeb1909 100644
--- a/pkgs/development/interpreters/clojure/babashka.nix
+++ b/pkgs/development/interpreters/clojure/babashka.nix
@@ -2,17 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "babashka";
-  version = "0.5.1";
-
-  reflectionJson = fetchurl {
-    name = "reflection.json";
-    url = "https://github.com/babashka/${pname}/releases/download/v${version}/${pname}-${version}-reflection.json";
-    sha256 = "1mx89rrkxyn7s8nfif0564gjrpc299wzl0wfq9qx8blc6a1438a9";
-  };
+  version = "0.6.0";
 
   src = fetchurl {
     url = "https://github.com/babashka/${pname}/releases/download/v${version}/${pname}-${version}-standalone.jar";
-    sha256 = "0rp6lam3psnk12j69z8qp1ixyp7zvvjahn18mvkmc38naml0p514";
+    sha256 = "sha256-W7zcTs0nTw1ed04ev7WKAMyBd/2n4Mezo5kh0sHFyyc=";
   };
 
   dontUnpack = true;
@@ -27,43 +21,18 @@ stdenv.mkDerivation rec {
   buildPhase = ''
     runHook preBuild
 
-    # https://github.com/babashka/babashka/blob/77daea7362d8e2562c89c315b1fbcefde6fa56a5/script/compile
+    # https://github.com/babashka/babashka/blob/v0.6.0/script/compile#L41-L52
     args=("-jar" "$BABASHKA_JAR"
           "-H:Name=$BABASHKA_BINARY"
-          "${lib.optionalString stdenv.isDarwin ''-H:-CheckToolchain''}"
           "-H:+ReportExceptionStackTraces"
-          "-J-Dclojure.spec.skip-macros=true"
-          "-J-Dclojure.compiler.direct-linking=true"
-          "-H:IncludeResources=BABASHKA_VERSION"
-          "-H:IncludeResources=META-INF/babashka/.*"
-          "-H:IncludeResources=SCI_VERSION"
-          "-H:ReflectionConfigurationFiles=${reflectionJson}"
-          "--initialize-at-build-time"
           # "-H:+PrintAnalysisCallTree"
           # "-H:+DashboardAll"
           # "-H:DashboardDump=reports/dump"
           # "-H:+DashboardPretty"
           # "-H:+DashboardJson"
-          "-H:Log=registerResource:"
-          "-H:EnableURLProtocols=http,https,jar"
-          "--enable-all-security-services"
-          "-H:+JNI"
           "--verbose"
           "--no-fallback"
-          "--no-server"
-          "--report-unsupported-elements-at-runtime"
-          "--initialize-at-run-time=org.postgresql.sspi.SSPIClient"
-          "--initialize-at-run-time=org.httpkit.client.ClientSslEngineFactory\$SSLHolder"
           "--native-image-info"
-          "--verbose"
-          "-H:ServiceLoaderFeatureExcludeServices=javax.sound.sampled.spi.AudioFileReader"
-          "-H:ServiceLoaderFeatureExcludeServices=javax.sound.midi.spi.MidiFileReader"
-          "-H:ServiceLoaderFeatureExcludeServices=javax.sound.sampled.spi.MixerProvider"
-          "-H:ServiceLoaderFeatureExcludeServices=javax.sound.sampled.spi.FormatConversionProvider"
-          "-H:ServiceLoaderFeatureExcludeServices=javax.sound.sampled.spi.AudioFileWriter"
-          "-H:ServiceLoaderFeatureExcludeServices=javax.sound.midi.spi.MidiDeviceProvider"
-          "-H:ServiceLoaderFeatureExcludeServices=javax.sound.midi.spi.SoundbankReader"
-          "-H:ServiceLoaderFeatureExcludeServices=javax.sound.midi.spi.MidiFileWriter"
           "$BABASHKA_XMX")
 
      native-image ''${args[@]}
@@ -113,6 +82,7 @@ stdenv.mkDerivation rec {
     - Library support via popular tools like the clojure CLI
     '';
     homepage = "https://github.com/babashka/babashka";
+    changelog = "https://github.com/babashka/babashka/blob/v${version}/CHANGELOG.md";
     license = licenses.epl10;
     platforms = graalvm11-ce.meta.platforms;
     maintainers = with maintainers; [
diff --git a/pkgs/development/interpreters/perl/default.nix b/pkgs/development/interpreters/perl/default.nix
index 3b39974c16b1..54b7e9afefd4 100644
--- a/pkgs/development/interpreters/perl/default.nix
+++ b/pkgs/development/interpreters/perl/default.nix
@@ -168,14 +168,14 @@ let
       priority = 6; # in `buildEnv' (including the one inside `perl.withPackages') the library files will have priority over files in `perl`
     };
   } // optionalAttrs (stdenv.buildPlatform != stdenv.hostPlatform) rec {
-    crossVersion = "1.3.6";
+    crossVersion = "01c176ac0f57d40cc3b6f8e441062780f073d952"; # Aug 22, 2021
 
     perl-cross-src = fetchFromGitHub {
       name = "perl-cross-${crossVersion}";
       owner = "arsv";
       repo = "perl-cross";
       rev = crossVersion;
-      sha256 = "0k5vyj40czbkfl7r3dcwxpc7dvdlp2xliaav358bviq3dq9vq9bb";
+      sha256 = "19mwr1snwl4156rlhn74kmpl1wyc7ahhlrjfpnfcj3n63ic0c56y";
     };
 
     depsBuildBuild = [ buildPackages.stdenv.cc makeWrapper ];
@@ -212,7 +212,7 @@ in {
   perldevel = common {
     perl = pkgs.perldevel;
     buildPerl = buildPackages.perldevel;
-    version = "5.35.0";
-    sha256 = "0217nbswhkjhw60kng2p64611xna7za681kk30fkriyicd3yph6n";
+    version = "5.35.3";
+    sha256 = "06442zc5rvisl120f58jpy95bkf8f1cc4n577nzihdavlbfmnyyn";
   };
 }
diff --git a/pkgs/development/libraries/arpa2common/default.nix b/pkgs/development/libraries/arpa2common/default.nix
new file mode 100644
index 000000000000..7fcb2a945e8f
--- /dev/null
+++ b/pkgs/development/libraries/arpa2common/default.nix
@@ -0,0 +1,58 @@
+{ lib
+, stdenv
+, fetchFromGitLab
+, cmake
+
+, arpa2cm
+, doxygen
+, e2fsprogs
+, lmdb
+, openssl
+, pkg-config
+, ragel
+}:
+
+stdenv.mkDerivation rec {
+  pname = "arpa2common";
+  version = "2.2.14";
+
+  src = fetchFromGitLab {
+    owner = "arpa2";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "sha256-LWsWoHRdLWRSF9JaEwrw+CXm5Azgh7zNeq0a8Z/hijQ=";
+  };
+
+  nativeBuildInputs = [
+    cmake
+    arpa2cm
+    doxygen
+    pkg-config
+  ];
+
+  propagatedBuildInputs = [
+    e2fsprogs
+    lmdb
+    openssl
+    ragel
+  ];
+
+  # the project uses single argument `printf` throughout the program
+  hardeningDisable = [ "format" ];
+
+  meta = {
+    description =
+      "ARPA2 ID and ACL libraries and other core data structures for ARPA2";
+    longDescription = ''
+      The ARPA2 Common Library package offers elementary services that can
+      benefit many software packages.  They are designed to be easy to
+      include, with a minimum of dependencies.  At the same time, they were
+      designed with the InternetWide Architecture in mind, thus helping to
+      liberate users.
+    '';
+    homepage = "https://gitlab.com/arpa2/arpa2common";
+    license = with lib.licenses; [ bsd2 cc-by-sa-40 cc0 isc ];
+    maintainers = with lib.maintainers; [ fufexan ];
+    platforms = lib.platforms.linux;
+  };
+}
diff --git a/pkgs/development/libraries/intel-media-driver/default.nix b/pkgs/development/libraries/intel-media-driver/default.nix
index b8f4d592b627..44ef637c9858 100644
--- a/pkgs/development/libraries/intel-media-driver/default.nix
+++ b/pkgs/development/libraries/intel-media-driver/default.nix
@@ -1,13 +1,15 @@
 { lib, stdenv, fetchFromGitHub
 , cmake, pkg-config
 , libva, libpciaccess, intel-gmmlib
-, enableX11 ? true, libX11
+, enableX11 ? stdenv.isLinux, libX11
 }:
 
 stdenv.mkDerivation rec {
   pname = "intel-media-driver";
   version = "21.3.2";
 
+  outputs = [ "out" "dev" ];
+
   src = fetchFromGitHub {
     owner  = "intel";
     repo   = "media-driver";
@@ -27,6 +29,11 @@ stdenv.mkDerivation rec {
   buildInputs = [ libva libpciaccess intel-gmmlib ]
     ++ lib.optional enableX11 libX11;
 
+  postFixup = lib.optionalString enableX11 ''
+    patchelf --set-rpath "$(patchelf --print-rpath $out/lib/dri/iHD_drv_video.so):${lib.makeLibraryPath [ libX11 ]}" \
+      $out/lib/dri/iHD_drv_video.so
+  '';
+
   meta = with lib; {
     description = "Intel Media Driver for VAAPI — Broadwell+ iGPUs";
     longDescription = ''
@@ -40,9 +47,4 @@ stdenv.mkDerivation rec {
     platforms = platforms.linux;
     maintainers = with maintainers; [ primeos jfrankenau ];
   };
-
-  postFixup = lib.optionalString enableX11 ''
-    patchelf --set-rpath "$(patchelf --print-rpath $out/lib/dri/iHD_drv_video.so):${lib.makeLibraryPath [ libX11  ]}" \
-      $out/lib/dri/iHD_drv_video.so
-  '';
 }
diff --git a/pkgs/development/libraries/qgnomeplatform/default.nix b/pkgs/development/libraries/qgnomeplatform/default.nix
index e3bb938f5f8f..bfb1859ba655 100644
--- a/pkgs/development/libraries/qgnomeplatform/default.nix
+++ b/pkgs/development/libraries/qgnomeplatform/default.nix
@@ -2,12 +2,12 @@
 , lib
 , fetchFromGitHub
 , nix-update-script
+, cmake
 , pkg-config
-, gtk3
+, adwaita-qt
 , glib
+, gtk3
 , qtbase
-, qmake
-, qtx11extras
 , pantheon
 , substituteAll
 , gsettings-desktop-schemas
@@ -15,13 +15,13 @@
 
 mkDerivation rec {
   pname = "qgnomeplatform";
-  version = "0.6.1";
+  version = "0.8.0";
 
   src = fetchFromGitHub {
     owner = "FedoraQt";
     repo = "QGnomePlatform";
     rev = version;
-    sha256 = "1mwqg2zk0sfjq54vz2jjahbgi5sxw8rb71h6mgg459wp99mhlqi0";
+    sha256 = "C/n8i5j0UWfxhP10c4j89U+LrpPozXnam4fIPYMXZAA=";
   };
 
   patches = [
@@ -33,24 +33,21 @@ mkDerivation rec {
   ];
 
   nativeBuildInputs = [
+    cmake
     pkg-config
-    qmake
   ];
 
   buildInputs = [
+    adwaita-qt
     glib
     gtk3
     qtbase
-    qtx11extras
   ];
 
-  postPatch = ''
-    # Fix plugin dir
-    substituteInPlace decoration/decoration.pro \
-      --replace "\$\$[QT_INSTALL_PLUGINS]" "$out/$qtPluginPrefix"
-    substituteInPlace theme/theme.pro \
-      --replace "\$\$[QT_INSTALL_PLUGINS]" "$out/$qtPluginPrefix"
-  '';
+  cmakeFlags = [
+    "-DGLIB_SCHEMAS_DIR=${glib.getSchemaPath gsettings-desktop-schemas}"
+    "-DQT_PLUGINS_DIR=${placeholder "out"}/${qtbase.qtPluginPrefix}"
+  ];
 
   passthru = {
     updateScript = nix-update-script {
diff --git a/pkgs/development/libraries/qgnomeplatform/hardcode-gsettings.patch b/pkgs/development/libraries/qgnomeplatform/hardcode-gsettings.patch
index 9b342d7cf832..40f7f98f25c7 100644
--- a/pkgs/development/libraries/qgnomeplatform/hardcode-gsettings.patch
+++ b/pkgs/development/libraries/qgnomeplatform/hardcode-gsettings.patch
@@ -1,13 +1,14 @@
-diff --git a/common/gnomehintssettings.cpp b/common/gnomehintssettings.cpp
-index 9860e57..40fa6ec 100644
---- a/common/gnomehintssettings.cpp
-+++ b/common/gnomehintssettings.cpp
-@@ -80,9 +80,17 @@ void gtkMessageHandler(const gchar *log_domain,
- GnomeHintsSettings::GnomeHintsSettings()
-     : QObject(0)
+diff --git a/src/common/gnomesettings.cpp b/src/common/gnomesettings.cpp
+index 717cc9b..ee255ea 100644
+--- a/src/common/gnomesettings.cpp
++++ b/src/common/gnomesettings.cpp
+@@ -150,10 +150,18 @@ GnomeSettingsPrivate::GnomeSettingsPrivate(QObject *parent)
+     : GnomeSettings(parent)
      , m_usePortal(checkUsePortalSupport())
+     , m_canUseFileChooserPortal(!m_usePortal)
 -    , m_gnomeDesktopSettings(g_settings_new("org.gnome.desktop.wm.preferences"))
 -    , m_settings(g_settings_new("org.gnome.desktop.interface"))
+     , m_fallbackFont(new QFont(QLatin1String("Sans"), 10))
  {
 +    g_autoptr(GSettingsSchemaSource) schemaSource = nullptr;
 +    g_autoptr(GSettingsSchema) gnomeDesktopSchema = nullptr;
diff --git a/pkgs/development/python-modules/ailment/default.nix b/pkgs/development/python-modules/ailment/default.nix
index c9412428a9c4..e7e057b5a8c3 100644
--- a/pkgs/development/python-modules/ailment/default.nix
+++ b/pkgs/development/python-modules/ailment/default.nix
@@ -7,14 +7,14 @@
 
 buildPythonPackage rec {
   pname = "ailment";
-  version = "9.0.9572";
+  version = "9.0.9684";
   disabled = pythonOlder "3.6";
 
   src = fetchFromGitHub {
     owner = "angr";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-cjVKIlvGu1SCiVkegJ36GevZ9bihYF7n3P/xNqtAapw=";
+    sha256 = "sha256-dWHioxNpNuvUTC8FkkKTsoRs4x+eHUfDb4rpgeIGaIA=";
   };
 
   propagatedBuildInputs = [ pyvex ];
diff --git a/pkgs/development/python-modules/angr/default.nix b/pkgs/development/python-modules/angr/default.nix
index 20c658909bec..ed7bb44349d2 100644
--- a/pkgs/development/python-modules/angr/default.nix
+++ b/pkgs/development/python-modules/angr/default.nix
@@ -43,14 +43,14 @@ in
 
 buildPythonPackage rec {
   pname = "angr";
-  version = "9.0.9572";
+  version = "9.0.9684";
   disabled = pythonOlder "3.6";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-ZA2PKyJVXrSs2IvpjMyHGrtAPUpUZFhUzlKURLEWm5o=";
+    sha256 = "sha256-37WCiH0uYRRh8yxNwz9OW0LcyNS9Kr2l1J662JYaPhg=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/angrop/default.nix b/pkgs/development/python-modules/angrop/default.nix
index f0e0f4e1658b..9605539a9cb6 100644
--- a/pkgs/development/python-modules/angrop/default.nix
+++ b/pkgs/development/python-modules/angrop/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "angrop";
-  version = "9.0.9572";
+  version = "9.0.9684";
   disabled = pythonOlder "3.6";
 
   src = fetchFromGitHub {
     owner = "angr";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-R4i7hQGwc74/szehcWBjkC6b9DsblluHKWxEk0iSFRI=";
+    sha256 = "sha256-rl7ZELiLAVuCOkR6NVCUB5c6AtW/rFniDxB3E9ZPnK8=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/archinfo/default.nix b/pkgs/development/python-modules/archinfo/default.nix
index 5c8f04f4b948..66f9444f0edf 100644
--- a/pkgs/development/python-modules/archinfo/default.nix
+++ b/pkgs/development/python-modules/archinfo/default.nix
@@ -7,13 +7,13 @@
 
 buildPythonPackage rec {
   pname = "archinfo";
-  version = "9.0.9572";
+  version = "9.0.9684";
 
   src = fetchFromGitHub {
     owner = "angr";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-OzgLGjEVOVRnQvWVcci8EGn6gtO8D8QoDnC9dfXGHZU=";
+    sha256 = "sha256-uRwNvYrea3oexJ3Rcoa9oUMXa+gSnha2K0NM8e/A09k=";
   };
 
   checkInputs = [
diff --git a/pkgs/development/python-modules/claripy/default.nix b/pkgs/development/python-modules/claripy/default.nix
index 26aa06466600..30400fcdaf56 100644
--- a/pkgs/development/python-modules/claripy/default.nix
+++ b/pkgs/development/python-modules/claripy/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "claripy";
-  version = "9.0.9572";
+  version = "9.0.9684";
   disabled = pythonOlder "3.6";
 
   src = fetchFromGitHub {
     owner = "angr";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-YC605gIM+l9Tnx6lu0ayrnYPE6Xx+aTgDXPziFY/lDA=";
+    sha256 = "sha256-tGRnCsuOLqZmWBcITF0TzgQ7kW6e7wZyhtObyU5Pasw=";
   };
 
   # Use upstream z3 implementation
diff --git a/pkgs/development/python-modules/cle/default.nix b/pkgs/development/python-modules/cle/default.nix
index e2f0a7feed07..be8106f97f43 100644
--- a/pkgs/development/python-modules/cle/default.nix
+++ b/pkgs/development/python-modules/cle/default.nix
@@ -15,7 +15,7 @@
 
 let
   # The binaries are following the argr projects release cycle
-  version = "9.0.9572";
+  version = "9.0.9684";
 
   # Binary files from https://github.com/angr/binaries (only used for testing and only here)
   binaries = fetchFromGitHub {
@@ -35,7 +35,7 @@ buildPythonPackage rec {
     owner = "angr";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-b1LMHeaQqz0fNleRlME0kgSYZGGXBhFKCp0iRr/2A7c=";
+    sha256 = "sha256-yza6Q0kxDXHOXxZcDFt43I621dSGI+bzTUrxWAQkGFQ=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/flexmock/default.nix b/pkgs/development/python-modules/flexmock/default.nix
index 48a2f931f6b4..a5382c04b006 100644
--- a/pkgs/development/python-modules/flexmock/default.nix
+++ b/pkgs/development/python-modules/flexmock/default.nix
@@ -6,11 +6,11 @@
 
 buildPythonPackage rec {
   pname = "flexmock";
-  version = "0.10.5";
+  version = "0.10.8";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "003422fdbcf5d6570e60a0eafeb54c0af624c6cddab5fc3bfe026e52dd0f9c5a";
+    sha256 = "6820031c39b298646194a3f0b2b693322bb7f44b39dbaf1c54b0ae68b3d768fa";
   };
 
   checkInputs = [ pytest ];
diff --git a/pkgs/development/python-modules/pex/default.nix b/pkgs/development/python-modules/pex/default.nix
index 5145bec925a9..b4238e6594f0 100644
--- a/pkgs/development/python-modules/pex/default.nix
+++ b/pkgs/development/python-modules/pex/default.nix
@@ -6,11 +6,11 @@
 
 buildPythonPackage rec {
   pname = "pex";
-  version = "2.1.46";
+  version = "2.1.47";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "28958292ab6a149ef7dd7998939a6e899b2f1ba811407ea1edac9d2d84417dfd";
+    sha256 = "0928d0316caac840db528030fc741930e8be22a3fa6a8635308fb8443a0a0c6a";
   };
 
   nativeBuildInputs = [ setuptools ];
diff --git a/pkgs/development/python-modules/pglast/default.nix b/pkgs/development/python-modules/pglast/default.nix
index d4a07857e3af..019acbd65679 100644
--- a/pkgs/development/python-modules/pglast/default.nix
+++ b/pkgs/development/python-modules/pglast/default.nix
@@ -1,6 +1,6 @@
 { lib
 , buildPythonPackage
-, fetchFromGitHub
+, fetchPypi
 , isPy3k
 , setuptools
 , pytest-cov
@@ -9,15 +9,11 @@
 
 buildPythonPackage rec {
   pname = "pglast";
-  version = "3.3";
+  version = "3.4";
 
-  # PyPI tarball does not include all the required files
-  src = fetchFromGitHub {
-    owner = "lelit";
-    repo = pname;
-    rev = "v${version}";
-    fetchSubmodules = true;
-    sha256 = "0l7nvbs1x1qil6mc0rxk7925i5xr3nbqnv0vakx3yv911kj3yhgv";
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "d2288d9607097a08529d9165970261c1be956934e8a8f6d9ed2a96d9b8f03fc6";
   };
 
   disabled = !isPy3k;
diff --git a/pkgs/development/python-modules/pubnub/default.nix b/pkgs/development/python-modules/pubnub/default.nix
index 478782b488c8..a6af74b3e4e9 100644
--- a/pkgs/development/python-modules/pubnub/default.nix
+++ b/pkgs/development/python-modules/pubnub/default.nix
@@ -13,13 +13,13 @@
 
 buildPythonPackage rec {
   pname = "pubnub";
-  version = "5.1.4";
+  version = "5.2.0";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = "python";
     rev = "v${version}";
-    sha256 = "sha256-aDmmF3T5v6NX3kut7cydEJNRw4mkrGt4X0+WOm/ZCVo=";
+    sha256 = "1jd3rr8dydfaxz5g8idpwacp4bnbmhg74dwz7qwmzn34336s4ji6";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pyvex/default.nix b/pkgs/development/python-modules/pyvex/default.nix
index 2b8bdb171560..c07199b741e8 100644
--- a/pkgs/development/python-modules/pyvex/default.nix
+++ b/pkgs/development/python-modules/pyvex/default.nix
@@ -11,11 +11,11 @@
 
 buildPythonPackage rec {
   pname = "pyvex";
-  version = "9.0.9572";
+  version = "9.0.9684";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-ish37nO+r1VJY9XS83K8tu60Snhd547n965TFqdBgzs=";
+    sha256 = "sha256-pf+LUFatC16a8EScoNYZKCXiaCINPRRn+6R1Op4GMRE=";
   };
 
   postPatch = lib.optionalString stdenv.isDarwin ''
diff --git a/pkgs/development/python-modules/qcelemental/default.nix b/pkgs/development/python-modules/qcelemental/default.nix
index b6e0684a2d48..57b50f820f7d 100644
--- a/pkgs/development/python-modules/qcelemental/default.nix
+++ b/pkgs/development/python-modules/qcelemental/default.nix
@@ -4,14 +4,14 @@
 
 buildPythonPackage rec {
   pname = "qcelemental";
-  version = "0.21.0";
+  version = "0.22.0";
 
   checkInputs = [ pytest-runner pytest-cov pytest ];
   propagatedBuildInputs = [ numpy pydantic pint networkx ];
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1b3c78fxbpnddrm1fnbvv4x2840jcfjg2l5cb5w4p38vzksiv238";
+    sha256 = "1d7fc613fbe30189cfa970a863a5955865b1116ff651d20325c721b6f0ef1f52";
   };
 
   doCheck = true;
diff --git a/pkgs/development/python-modules/sparse/default.nix b/pkgs/development/python-modules/sparse/default.nix
index d958fd2ed703..c081ab5e3a1e 100644
--- a/pkgs/development/python-modules/sparse/default.nix
+++ b/pkgs/development/python-modules/sparse/default.nix
@@ -12,13 +12,13 @@
 
 buildPythonPackage rec {
   pname = "sparse";
-  version = "0.12.0";
+  version = "0.13.0";
 
   disabled = !isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "2c95c3b8ee00211a5aa4ef5e46006d25bf35009a66e406b7ea9b25b327fb9516";
+    sha256 = "685dc994aa770ee1b23f2d5392819c8429f27958771f8dceb2c4fb80210d5915";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/tldextract/default.nix b/pkgs/development/python-modules/tldextract/default.nix
index 09f35a4c64f8..d39b4fa82c81 100644
--- a/pkgs/development/python-modules/tldextract/default.nix
+++ b/pkgs/development/python-modules/tldextract/default.nix
@@ -14,12 +14,12 @@
 
 buildPythonPackage rec {
   pname   = "tldextract";
-  version = "3.1.1";
+  version = "3.1.2";
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-HViDxJbaOoqnHR9NpIYs43TcfM9F5Ltn3rIBbsNPjTM=";
+    sha256 = "sha256-0gNMNVhlH32P2t6oP7aBBQstZi3GegDZUDJtyQIClEQ=";
   };
 
   nativeBuildInputs = [ setuptools-scm ];
diff --git a/pkgs/development/tools/krankerl/default.nix b/pkgs/development/tools/krankerl/default.nix
index 8697f81a9da6..c44677235d95 100644
--- a/pkgs/development/tools/krankerl/default.nix
+++ b/pkgs/development/tools/krankerl/default.nix
@@ -12,16 +12,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "krankerl";
-  version = "0.13.1";
+  version = "0.13.2";
 
   src = fetchFromGitHub {
     owner = "ChristophWurst";
     repo = "krankerl";
     rev = "v${version}";
-    sha256 = "sha256-uIFcWHdW8887CDkFxZznh9akYs+vxsE9Bc9g1hKi7Kc=";
+    sha256 = "sha256-Kol39AtM5m6FC+s5SDbQhWuASkGbeXPlmSGb7axEuK8=";
   };
 
-  cargoSha256 = "sha256-6joHwz0HIVbta8ALvsJLMvmeDh9IFPR4Cx36H63MliI=";
+  cargoSha256 = "sha256-bPcKe3vE3VIjLJ4iYdF3Gt0sID09gRpxG5TpTGWhnPs=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/development/tools/misc/strace/default.nix b/pkgs/development/tools/misc/strace/default.nix
index b3722965fdcd..785331fb50be 100644
--- a/pkgs/development/tools/misc/strace/default.nix
+++ b/pkgs/development/tools/misc/strace/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "strace";
-  version = "5.13";
+  version = "5.14";
 
   src = fetchurl {
     url = "https://strace.io/files/${version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-Wsw0iIudUQrWrJFdSo3wj1HPGukg6iRkn2pLuYTQtlY=";
+    sha256 = "sha256-kBvubbXhfeutRTDdn/tNyalsSmVu2+HDFBt8swexHnM=";
   };
 
   depsBuildBuild = [ buildPackages.stdenv.cc ];
diff --git a/pkgs/development/tools/misc/yodl/default.nix b/pkgs/development/tools/misc/yodl/default.nix
index 4f4dddbc9453..2eee78c1c19c 100644
--- a/pkgs/development/tools/misc/yodl/default.nix
+++ b/pkgs/development/tools/misc/yodl/default.nix
@@ -2,14 +2,14 @@
 
 stdenv.mkDerivation rec {
   pname = "yodl";
-  version = "4.03.02";
+  version = "4.03.03";
 
   nativeBuildInputs = [ icmake ];
 
   buildInputs = [ perl ];
 
   src = fetchFromGitLab {
-    sha256 = "sha256-ZxiF9He0JgqhbnQS2pE7Y85sED8avbdwGuVmFN8/XgE=";
+    sha256 = "sha256-MeD/jjhwoiWTb/G8pHrnEEX22h+entPr9MhJ6WHO3DM=";
     rev = version;
     repo = "yodl";
     owner = "fbb-git";
diff --git a/pkgs/development/web/nodejs/v12.nix b/pkgs/development/web/nodejs/v12.nix
index e59b79594203..7717dfa6c9cf 100644
--- a/pkgs/development/web/nodejs/v12.nix
+++ b/pkgs/development/web/nodejs/v12.nix
@@ -8,7 +8,7 @@ let
 in
   buildNodejs {
     inherit enableNpm;
-    version = "12.22.5";
-    sha256 = "057xhxk440pxlgqpblsh4vfwmfzy0fx1h6q3jr2j79y559ngy9zr";
+    version = "12.22.6";
+    sha256 = "0yhgkcp7lx5nglxsrybbjymx1fys3wkbbhkj6h6652gnp0b2y0n2";
     patches = lib.optional stdenv.isDarwin ./bypass-xcodebuild.diff;
   }
diff --git a/pkgs/development/web/nodejs/v14.nix b/pkgs/development/web/nodejs/v14.nix
index bad8ebfa5aed..1ec04407f899 100644
--- a/pkgs/development/web/nodejs/v14.nix
+++ b/pkgs/development/web/nodejs/v14.nix
@@ -7,7 +7,7 @@ let
 in
   buildNodejs {
     inherit enableNpm;
-    version = "14.17.5";
-    sha256 = "1a0zj505nhpfcj19qvjy2hvc5a7gadykv51y0rc6032qhzzsgca2";
+    version = "14.17.6";
+    sha256 = "0pmd0haav2ychhcsw44klx6wfn8c7j1rsw08rc8hcm5i3h5wsn7l";
     patches = lib.optional stdenv.isDarwin ./bypass-xcodebuild.diff;
   }
diff --git a/pkgs/games/wesnoth/default.nix b/pkgs/games/wesnoth/default.nix
index 6eedc446f53f..ae23cc799ceb 100644
--- a/pkgs/games/wesnoth/default.nix
+++ b/pkgs/games/wesnoth/default.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "wesnoth";
-  version = "1.14.16";
+  version = "1.14.17";
 
   src = fetchFromGitHub {
     rev = version;
     owner = "wesnoth";
     repo = "wesnoth";
-    sha256 = "sha256-QMz7atxol18r//UNb6+H6xAAEQdR4hAN8UW0KeGSH1g=";
+    sha256 = "RZ38MbUaUjfajo9wXSfDt8NHBySC+ODlgZAPf2NPblc=";
   };
 
   nativeBuildInputs = [ cmake pkg-config ];
@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
     '';
 
     homepage = "https://www.wesnoth.org/";
-    license = licenses.gpl2;
+    license = licenses.gpl2Plus;
     maintainers = with maintainers; [ abbradar ];
     platforms = platforms.unix;
   };
diff --git a/pkgs/games/xonotic/default.nix b/pkgs/games/xonotic/default.nix
index 6d7327714768..d5374c5446d1 100644
--- a/pkgs/games/xonotic/default.nix
+++ b/pkgs/games/xonotic/default.nix
@@ -6,6 +6,8 @@
   libX11, libGLU, libGL, libXpm, libXext, libXxf86vm, alsa-lib
 , # sdl
   SDL2
+, # blind
+  gmp
 
 , withSDL ? true
 , withGLX ? false
@@ -63,7 +65,7 @@ let
     };
 
     nativeBuildInputs = [ unzip ];
-    buildInputs = [ libjpeg zlib libvorbis curl ]
+    buildInputs = [ libjpeg zlib libvorbis curl gmp ]
       ++ lib.optional withGLX [ libX11.dev libGLU.dev libGL.dev libXpm.dev libXext.dev libXxf86vm.dev alsa-lib.dev ]
       ++ lib.optional withSDL [ SDL2.dev ];
 
@@ -74,17 +76,27 @@ let
 
     dontStrip = target != "release";
 
-    buildPhase = lib.optionalString withDedicated ''
+    postConfigure = ''
+      pushd ../d0_blind_id
+      ./configure $configureFlags
+      popd
+    '';
+
+    buildPhase = (lib.optionalString withDedicated ''
       make -j $NIX_BUILD_CORES -l $NIX_BUILD_CORES sv-${target}
     '' + lib.optionalString withGLX ''
       make -j $NIX_BUILD_CORES -l $NIX_BUILD_CORES cl-${target}
     '' + lib.optionalString withSDL ''
       make -j $NIX_BUILD_CORES -l $NIX_BUILD_CORES sdl-${target}
+    '') + ''
+      pushd ../d0_blind_id
+      make -j $NIX_BUILD_CORES -l $NIX_BUILD_CORES
+      popd
     '';
 
     enableParallelBuilding = true;
 
-    installPhase = ''
+    installPhase = (''
       for size in 16x16 24x24 32x32 48x48 64x64 72x72 96x96 128x128 192x192 256x256 512x512 1024x1024 scalable; do
         install -Dm644 ../../misc/logos/xonotic_icon.svg \
           $out/share/icons/hicolor/$size/xonotic.svg
@@ -95,6 +107,10 @@ let
       install -Dm755 darkplaces-glx "$out/bin/xonotic-glx"
     '' + lib.optionalString withSDL ''
       install -Dm755 darkplaces-sdl "$out/bin/xonotic-sdl"
+    '') + ''
+      pushd ../d0_blind_id
+      make install
+      popd
     '';
 
     # Xonotic needs to find libcurl.so at runtime for map downloads
@@ -121,10 +137,10 @@ in rec {
   xonotic-data = fetchzip {
     name = "xonotic-data";
     url = "https://dl.xonotic.org/xonotic-${version}.zip";
-    sha256 = "1ygkh0v68y4sd1w5vpk8dgb65h5jm599hwszdfgjp3ax4d3ml81x";
+    sha256 = "15caj11v9hhr7w55w3rs1rspblzr9lg1crqivbn9pyyq0rif8cpl";
     extraPostFetch = ''
       cd $out
-      rm -rf $(ls | grep -v "^data$")
+      rm -rf $(ls | grep -v "^data$" | grep -v "^key_0.d0pk$")
     '';
     meta.hydraPlatforms = [];
     passthru.version = version;
@@ -156,7 +172,7 @@ in rec {
     copyDesktopItems
   '' + ''
     for binary in $out/bin/xonotic-*; do
-      wrapProgram $binary --add-flags "-basedir ${xonotic-data}"
+      wrapProgram $binary --add-flags "-basedir ${xonotic-data}" --prefix LD_LIBRARY_PATH : "${xonotic-unwrapped}/lib"
     done
   '');
 }
diff --git a/pkgs/os-specific/linux/zfs/default.nix b/pkgs/os-specific/linux/zfs/default.nix
index 78cced512a48..bf45a5037616 100644
--- a/pkgs/os-specific/linux/zfs/default.nix
+++ b/pkgs/os-specific/linux/zfs/default.nix
@@ -26,6 +26,14 @@ let
   buildKernel = any (n: n == configFile) [ "kernel" "all" ];
   buildUser = any (n: n == configFile) [ "user" "all" ];
 
+  # XXX: You always want to build kernel modules with the same stdenv as the
+  # kernel was built with. However, since zfs can also be built for userspace we
+  # need to correctly pick between the provided/default stdenv, and the one used
+  # by the kernel.
+  # If you don't do this your ZFS builds will fail on any non-standard (e.g.
+  # clang-built) kernels.
+  stdenv' = if kernel == null then stdenv else kernel.stdenv;
+
   common = { version
     , sha256
     , extraPatches ? []
@@ -34,7 +42,7 @@ let
     , latestCompatibleLinuxPackages
     , kernelCompatible ? null }:
 
-    stdenv.mkDerivation {
+    stdenv'.mkDerivation {
       name = "zfs-${configFile}-${version}${optionalString buildKernel "-${kernel.version}"}";
 
       src = fetchFromGitHub {
@@ -47,11 +55,6 @@ let
 
       postPatch = optionalString buildKernel ''
         patchShebangs scripts
-
-        # https://github.com/openzfs/zfs/issues/10107
-        substituteInPlace ./config/kernel.m4 \
-          --replace "make modules" "make CC=$CC modules"
-
         # The arrays must remain the same length, so we repeat a flag that is
         # already part of the command and therefore has no effect.
         substituteInPlace ./module/os/linux/zfs/zfs_ctldir.c \
diff --git a/pkgs/servers/nats-server/default.nix b/pkgs/servers/nats-server/default.nix
index 0d7904d69ccc..339c847898c3 100644
--- a/pkgs/servers/nats-server/default.nix
+++ b/pkgs/servers/nats-server/default.nix
@@ -4,7 +4,7 @@ with lib;
 
 buildGoPackage rec {
   pname   = "nats-server";
-  version = "2.3.4";
+  version = "2.4.0";
 
   goPackagePath = "github.com/nats-io/${pname}";
 
@@ -12,7 +12,7 @@ buildGoPackage rec {
     rev    = "v${version}";
     owner  = "nats-io";
     repo   = pname;
-    sha256 = "sha256-VNnL1v7R8cko9C/494XJh4aMRZv459tAHys9nmrA9QE=";
+    sha256 = "sha256-v758qj1dy8zh3zfZxKkKALxZqNAxc1XdtTW4dxU4l5A=";
   };
 
   meta = {
diff --git a/pkgs/servers/search/elasticsearch/7.x.nix b/pkgs/servers/search/elasticsearch/7.x.nix
index b0114ad17055..de194bcc7d29 100644
--- a/pkgs/servers/search/elasticsearch/7.x.nix
+++ b/pkgs/servers/search/elasticsearch/7.x.nix
@@ -59,6 +59,9 @@ stdenv.mkDerivation (rec {
 
     chmod +x $out/bin/*
 
+    substituteInPlace $out/bin/elasticsearch \
+      --replace 'bin/elasticsearch-keystore' "$out/bin/elasticsearch-keystore"
+
     wrapProgram $out/bin/elasticsearch \
       --prefix PATH : "${makeBinPath [ util-linux coreutils gnugrep ]}" \
       --set JAVA_HOME "${jre_headless}"
diff --git a/pkgs/tools/misc/cope/default.nix b/pkgs/tools/misc/cope/default.nix
new file mode 100644
index 000000000000..ffa25ba9530b
--- /dev/null
+++ b/pkgs/tools/misc/cope/default.nix
@@ -0,0 +1,28 @@
+{ lib, fetchFromGitHub, perl, perlPackages, makeWrapper, }:
+
+perlPackages.buildPerlPackage rec {
+  pname = "cope";
+  version = "unstable-2015-01-29";
+
+  src = fetchFromGitHub {
+    owner = "lotrfan";
+    repo = pname;
+    rev = "0dc82a939a9498ff80caf472841c279dfe03efae";
+    sha256 = "sha256-Tkv26M6YnaUB0nudjKGG482fvUkCobPk0VF1manBCoY=";
+  };
+
+  buildInputs = with perlPackages; [ EnvPath FileShareDir IOPty IOStty ListMoreUtils RegexpCommon RegexpIPv6 ];
+
+  postInstall = ''
+    mkdir -p $out/bin
+    mv $out/lib/perl5/site_perl/${perl.version}/auto/share/dist/Cope/* $out/bin/
+    rm -r $out/lib/perl5/site_perl/${perl.version}/auto
+  '';
+
+  meta = with lib; {
+    description = "A colourful wrapper for terminal programs";
+    homepage = "https://github.com/lotrfan/cope";
+    license = with licenses; [ artistic1 gpl1Plus ];
+    maintainers = with maintainers; [ SuperSandro2000 ];
+  };
+}
diff --git a/pkgs/tools/misc/tealdeer/default.nix b/pkgs/tools/misc/tealdeer/default.nix
index 985f2dccd682..e6b53e3c7583 100644
--- a/pkgs/tools/misc/tealdeer/default.nix
+++ b/pkgs/tools/misc/tealdeer/default.nix
@@ -40,5 +40,6 @@ rustPlatform.buildRustPackage rec {
     homepage = "https://github.com/dbrgn/tealdeer";
     maintainers = with maintainers; [ davidak ];
     license = with licenses; [ asl20 mit ];
+    mainProgram = "tldr";
   };
 }
diff --git a/pkgs/tools/misc/yt-dlp/default.nix b/pkgs/tools/misc/yt-dlp/default.nix
index ac6d841c725b..9cb2d1dea0da 100644
--- a/pkgs/tools/misc/yt-dlp/default.nix
+++ b/pkgs/tools/misc/yt-dlp/default.nix
@@ -1,6 +1,13 @@
-{ lib, buildPythonPackage, fetchPypi
-, ffmpeg, rtmpdump, phantomjs2, atomicparsley, pycryptodome
-, websockets, mutagen
+{ lib
+, buildPythonPackage
+, fetchPypi
+, ffmpeg
+, rtmpdump
+, phantomjs2
+, atomicparsley
+, pycryptodome
+, websockets
+, mutagen
 , ffmpegSupport ? true
 , rtmpSupport ? true
 , phantomjsSupport ? false
@@ -12,12 +19,12 @@ buildPythonPackage rec {
   # The websites yt-dlp deals with are a very moving target. That means that
   # downloads break constantly. Because of that, updates should always be backported
   # to the latest stable release.
-  version = "2021.08.10";
+  version = "2021.9.2";
 
   src = fetchPypi {
     inherit pname;
     version = builtins.replaceStrings [ ".0" ] [ "." ] version;
-    sha256 = "8da1bf4dc4641d37d137443c4783109ee8393caad5e0d270d9d1d534e8f25240";
+    sha256 = "sha256-yn53zbBVuiaD31sIB6qxweEgy+AsjzXZ0yk9lNva6mM=";
   };
 
   # build_lazy_extractors assumes this directory exists but it is not present in
@@ -33,12 +40,14 @@ buildPythonPackage rec {
   # - ffmpeg: post-processing & transcoding support
   # - rtmpdump: download files over RTMP
   # - atomicparsley: embedding thumbnails
-  makeWrapperArgs = let
+  makeWrapperArgs =
+    let
       packagesToBinPath = [ atomicparsley ]
         ++ lib.optional ffmpegSupport ffmpeg
         ++ lib.optional rtmpSupport rtmpdump
         ++ lib.optional phantomjsSupport phantomjs2;
-    in [ ''--prefix PATH : "${lib.makeBinPath packagesToBinPath}"'' ];
+    in
+    [ ''--prefix PATH : "${lib.makeBinPath packagesToBinPath}"'' ];
 
   setupPyBuildFlags = [
     "build_lazy_extractors"
diff --git a/pkgs/tools/package-management/cargo-release/default.nix b/pkgs/tools/package-management/cargo-release/default.nix
index 5cec6589c11d..9b7f78fa3b51 100644
--- a/pkgs/tools/package-management/cargo-release/default.nix
+++ b/pkgs/tools/package-management/cargo-release/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-release";
-  version = "0.17.0";
+  version = "0.17.1";
 
   src = fetchFromGitHub {
     owner = "crate-ci";
     repo = "cargo-release";
     rev = "v${version}";
-    sha256 = "04vp2w07da9b4cfrdp8jj5fp5v7xzdx2946v7195n2krhrdhq957";
+    sha256 = "sha256-zQwgnZFYXYG1NWzC9ZultTUlU+o/Sr2u3CnRXzr+Lk8=";
   };
 
-  cargoSha256 = "0ch22aysbpp38xny3sfbzrbsflfva57dlslkdqsmf4a7bckpbkhs";
+  cargoSha256 = "sha256-ORv5O7DhZhmmOM5RnRIIe/WBU77iyROPIRGMJikUCgo=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/tools/security/nuclei/default.nix b/pkgs/tools/security/nuclei/default.nix
index 04a0df6c7db6..cae010c5a19f 100644
--- a/pkgs/tools/security/nuclei/default.nix
+++ b/pkgs/tools/security/nuclei/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "nuclei";
-  version = "2.4.3";
+  version = "2.5.0";
 
   src = fetchFromGitHub {
     owner = "projectdiscovery";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1wg9kqwc2h2689xqb2m9fgxc4rhi3pnml08q3hg4fq6l31damaj5";
+    sha256 = "sha256-6mZ8XstophadNk/3zJe2n3WL4u34jjnWh9m2qrt06hw=";
   };
 
-  vendorSha256 = "0pcxadyhppaf7iarl2y6f2crjzg85x4hrg1m1pg3mydqm4gvg5vx";
+  vendorSha256 = "sha256-tJ9cdZloTSXoytmMJ+6S5XAKHYs16SZmbUwZdmVnDzc=";
 
   modRoot = "./v2";
   subPackages = [
diff --git a/pkgs/tools/system/monit/default.nix b/pkgs/tools/system/monit/default.nix
index 9e176677c761..93cdbe6d546e 100644
--- a/pkgs/tools/system/monit/default.nix
+++ b/pkgs/tools/system/monit/default.nix
@@ -1,17 +1,22 @@
-{ lib, stdenv
-, fetchurl, bison, flex
+{ lib
+, stdenv
+, fetchurl
+, bison
+, flex
 , zlib
-, usePAM ? stdenv.hostPlatform.isLinux, pam
-, useSSL ? true, openssl
+, usePAM ? stdenv.hostPlatform.isLinux
+, pam
+, useSSL ? true
+, openssl
 }:
 
 stdenv.mkDerivation rec {
   pname = "monit";
-  version = "5.27.2";
+  version = "5.29.0";
 
   src = fetchurl {
     url = "${meta.homepage}dist/monit-${version}.tar.gz";
-    sha256 = "sha256-2ICceNXcHtenujKlpVxRFIVRMsxNpIBfjTqvjPRuqkw=";
+    sha256 = "sha256-9mXm3R8mp0tWgomah3k0Fn3islguBIZS7PA2MYR3iF8=";
   };
 
   nativeBuildInputs = [ bison flex ];
@@ -22,10 +27,10 @@ stdenv.mkDerivation rec {
   configureFlags = [
     (lib.withFeature usePAM "pam")
   ] ++ (if useSSL then [
-      "--with-ssl-incl-dir=${openssl.dev}/include"
-      "--with-ssl-lib-dir=${openssl.out}/lib"
-    ] else [
-      "--without-ssl"
+    "--with-ssl-incl-dir=${openssl.dev}/include"
+    "--with-ssl-lib-dir=${openssl.out}/lib"
+  ] else [
+    "--without-ssl"
   ]) ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
     # will need to check both these are true for musl
     "libmonit_cv_setjmp_available=yes"
@@ -33,7 +38,7 @@ stdenv.mkDerivation rec {
   ];
 
   meta = {
-    homepage = "http://mmonit.com/monit/";
+    homepage = "https://mmonit.com/monit/";
     description = "Monitoring system";
     license = lib.licenses.agpl3;
     maintainers = with lib.maintainers; [ raskin wmertens ryantm ];
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index ad35771fd331..a19ce08c8db8 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -877,6 +877,8 @@ with pkgs;
 
   amidst = callPackage ../tools/games/minecraft/amidst { };
 
+  cope = callPackage ../tools/misc/cope { };
+
   gamemode = callPackage ../tools/games/gamemode {
     libgamemode32 = pkgsi686Linux.gamemode.lib;
   };
@@ -13238,6 +13240,8 @@ with pkgs;
 
   arpa2cm = callPackage ../development/tools/build-managers/arpa2cm { };
 
+  arpa2common = callPackage ../development/libraries/arpa2common { };
+
   asn2quickder = python2Packages.callPackage ../development/tools/asn2quickder {};
 
   astyle = callPackage ../development/tools/misc/astyle { };
@@ -18510,7 +18514,7 @@ with pkgs;
 
   qrupdate = callPackage ../development/libraries/qrupdate { };
 
-  qgnomeplatform =  libsForQt514.callPackage ../development/libraries/qgnomeplatform { };
+  qgnomeplatform = libsForQt5.callPackage ../development/libraries/qgnomeplatform { };
 
   randomx = callPackage ../development/libraries/randomx { };
 
diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index dfcbd7042c5c..e4331bc9bc4c 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -10643,6 +10643,23 @@ let
     propagatedBuildInputs = [ pkgs.more FileWhich TermReadKey ]; # `more` used in tests
   };
 
+  IOPty = buildPerlModule {
+    pname = "IO-Pty";
+    version = "1.16";
+    src = fetchurl {
+      url = "mirror://cpan/authors/id/T/TO/TODDR/IO-Tty-1.16.tar.gz";
+      sha256 = "sha256-jxoJwHBzitxpXfkD8uf3QwjdjZkbkUwLw5Cg5gISlN0=";
+    };
+    buildPhase = "make";
+    checkPhase = "make test";
+    installPhase = "make install";
+    meta = {
+      homepage = "https://github.com/toddr/IO-Tty";
+      description = "Pseudo TTY object class";
+      license = with lib.licenses; [ artistic1 gpl1Plus ];
+    };
+  };
+
   IOPrompt = buildPerlModule {
     pname = "IO-Prompt";
     version = "0.997004";
@@ -10735,6 +10752,23 @@ let
     };
   };
 
+  IOStty = buildPerlModule {
+    pname = "IO-Stty";
+    version = "0.04";
+    src = fetchurl {
+      url = "mirror://cpan/authors/id/T/TO/TODDR/IO-Stty-0.04.tar.gz";
+      sha256 = "sha256-XJUJ8ahpPYKH+gE97wv4eqZM2ScThGHvjetVUDxmUcI=";
+    };
+    buildPhase = "make";
+    checkPhase = "make test";
+    installPhase = "make install";
+    meta = {
+      homepage = "http://wiki.github.com/toddr/IO-Stty";
+      description = "Change and print terminal line settings";
+      license = with lib.licenses; [ artistic1 gpl1Plus ];
+    };
+  };
+
   IOTee = buildPerlPackage {
     pname = "IO-Tee";
     version = "0.66";
@@ -19799,6 +19833,22 @@ let
     };
   };
 
+  SyntaxKeywordTry = buildPerlModule {
+    pname = "Syntax-Keyword-Try";
+    version = "0.25";
+    src = fetchurl {
+      url = "mirror://cpan/authors/id/P/PE/PEVANS/Syntax-Keyword-Try-0.25.tar.gz";
+      sha256 = "0xd82gcpcrnmwxsbk7x0ainmyybdc087g6j69hrpy80j0asnq2f5";
+    };
+    propagatedBuildInputs = [ XSParseKeyword ];
+    perlPreHook = lib.optionalString stdenv.isDarwin "export LD=$CC";
+    meta = {
+      description = "A try/catch/finally syntax for perl";
+      license = with lib.licenses; [ artistic1 gpl1Plus ];
+      maintainers = [ maintainers.zakame ];
+    };
+  };
+
   SysMmap = buildPerlPackage {
     pname = "Sys-Mmap";
     version = "0.20";
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 19ca4df0d28d..de99651cca6a 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -2564,7 +2564,9 @@ in {
 
   fints = callPackage ../development/python-modules/fints { };
 
-  fiona = callPackage ../development/python-modules/fiona { };
+  fiona = callPackage ../development/python-modules/fiona {
+    gdal = pkgs.gdal_2;
+  };
 
   fipy = callPackage ../development/python-modules/fipy { };