diff --git a/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml b/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml
index 2a285669efeb..a95b1dd66b96 100644
--- a/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml
@@ -459,6 +459,16 @@
         </itemizedlist>
       </listitem>
     </itemizedlist>
+    <itemizedlist spacing="compact">
+      <listitem>
+        <para>
+          <literal>yggdrasil</literal> was upgraded to a new major
+          release with breaking changes, see
+          <link xlink:href="https://github.com/yggdrasil-network/yggdrasil-go/releases/tag/v0.4.0">upstream
+          changelog</link>.
+        </para>
+      </listitem>
+    </itemizedlist>
   </section>
   <section xml:id="sec-release-21.11-notable-changes">
     <title>Other Notable Changes</title>
diff --git a/nixos/doc/manual/release-notes/rl-2111.section.md b/nixos/doc/manual/release-notes/rl-2111.section.md
index 0de63a46199e..be46591dfa16 100644
--- a/nixos/doc/manual/release-notes/rl-2111.section.md
+++ b/nixos/doc/manual/release-notes/rl-2111.section.md
@@ -113,6 +113,8 @@ In addition to numerous new and upgraded packages, this release has the followin
 
   * The data directory remains located at `/var/lib/bitwarden_rs`, for backwards compatibility.
 
+- `yggdrasil` was upgraded to a new major release with breaking changes, see [upstream changelog](https://github.com/yggdrasil-network/yggdrasil-go/releases/tag/v0.4.0).
+
 ## Other Notable Changes {#sec-release-21.11-notable-changes}
 
 - The setting [`services.openssh.logLevel`](options.html#opt-services.openssh.logLevel) `"VERBOSE"` `"INFO"`. This brings NixOS in line with upstream and other Linux distributions, and reduces log spam on servers due to bruteforcing botnets.
diff --git a/nixos/modules/programs/hamster.nix b/nixos/modules/programs/hamster.nix
index b2f4a82b260e..0bb56ad7ff36 100644
--- a/nixos/modules/programs/hamster.nix
+++ b/nixos/modules/programs/hamster.nix
@@ -6,7 +6,7 @@ with lib;
   meta.maintainers = pkgs.hamster.meta.maintainers;
 
   options.programs.hamster.enable =
-    mkEnableOption "Whether to enable hamster time tracking.";
+    mkEnableOption "hamster, a time tracking program";
 
   config = lib.mkIf config.programs.hamster.enable {
     environment.systemPackages = [ pkgs.hamster ];
diff --git a/nixos/tests/yggdrasil.nix b/nixos/tests/yggdrasil.nix
index 0e75ed54db28..b409d9ed7853 100644
--- a/nixos/tests/yggdrasil.nix
+++ b/nixos/tests/yggdrasil.nix
@@ -1,23 +1,19 @@
 let
-  aliceIp6 = "200:3b91:b2d8:e708:fbf3:f06:fdd5:90d0";
+  aliceIp6 = "202:b70:9b0b:cf34:f93c:8f18:bbfd:7034";
   aliceKeys = {
-    EncryptionPublicKey = "13e23986fe76bc3966b42453f479bc563348b7ff76633b7efcb76e185ec7652f";
-    EncryptionPrivateKey = "9f86947b15e86f9badac095517a1982e39a2db37ca726357f95987b898d82208";
-    SigningPublicKey = "e2c43349083bc1e998e4ec4535b4c6a8f44ca9a5a8e07336561267253b2be5f4";
-    SigningPrivateKey = "fe3add8da35316c05f6d90d3ca79bd2801e6ccab6d37e5339fef4152589398abe2c43349083bc1e998e4ec4535b4c6a8f44ca9a5a8e07336561267253b2be5f4";
+    PublicKey = "3e91ec9e861960d86e1ce88051f97c435bdf2859640ab681dfa906eb45ad5182";
+    PrivateKey = "a867f9e078e4ce58d310cf5acd4622d759e2a21df07e1d6fc380a2a26489480d3e91ec9e861960d86e1ce88051f97c435bdf2859640ab681dfa906eb45ad5182";
   };
-  bobIp6 = "201:ebbd:bde9:f138:c302:4afa:1fb6:a19a";
-  bobPrefix = "301:ebbd:bde9:f138";
+  bobIp6 = "202:a483:73a4:9f2d:a559:4a19:bc9:8458";
+  bobPrefix = "302:a483:73a4:9f2d";
   bobConfig = {
     InterfacePeers = {
       eth1 = [ "tcp://192.168.1.200:12345" ];
     };
     MulticastInterfaces = [ "eth1" ];
     LinkLocalTCPPort = 54321;
-    EncryptionPublicKey = "c99d6830111e12d1b004c52fe9e5a2eef0f6aefca167aca14589a370b7373279";
-    EncryptionPrivateKey = "2e698a53d3fdce5962d2ff37de0fe77742a5c8b56cd8259f5da6aa792f6e8ba3";
-    SigningPublicKey = "de111da0ec781e45bf6c63ecb45a78c24d7d4655abfaeea83b26c36eb5c0fd5b";
-    SigningPrivateKey = "2a6c21550f3fca0331df50668ffab66b6dce8237bcd5728e571e8033b363e247de111da0ec781e45bf6c63ecb45a78c24d7d4655abfaeea83b26c36eb5c0fd5b";
+    PublicKey = "2b6f918b6c1a4b54d6bcde86cf74e074fb32ead4ee439b7930df2aa60c825186";
+    PrivateKey = "0c4a24acd3402722ce9277ed179f4a04b895b49586493c25fbaed60653d857d62b6f918b6c1a4b54d6bcde86cf74e074fb32ead4ee439b7930df2aa60c825186";
   };
   danIp6 = bobPrefix + "::2";
 
diff --git a/pkgs/applications/networking/instant-messengers/kdeltachat/default.nix b/pkgs/applications/networking/instant-messengers/kdeltachat/default.nix
index 89154ad939ea..f2a26eb7340b 100644
--- a/pkgs/applications/networking/instant-messengers/kdeltachat/default.nix
+++ b/pkgs/applications/networking/instant-messengers/kdeltachat/default.nix
@@ -13,13 +13,13 @@
 
 mkDerivation rec {
   pname = "kdeltachat";
-  version = "unstable-2021-06-14";
+  version = "unstable-2021-06-27";
 
   src = fetchFromSourcehut {
     owner = "~link2xt";
     repo = "kdeltachat";
-    rev = "25da4228768e260ea9f67d5aa10558e7cf9cf7ee";
-    sha256 = "17igh34cbd0w5mzra4k779nxc5s8hk6sj25h308w079y0b21lf7w";
+    rev = "76b844bd6461d90f91a42fc02002accb694ec56d";
+    sha256 = "0kjpmh1zxfi3rglkd5sla49p6yd3kaljnmmg7j9alh3854yc5k1n";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/data/fonts/sudo/default.nix b/pkgs/data/fonts/sudo/default.nix
index 322dcfd68c95..bc8396a7a214 100644
--- a/pkgs/data/fonts/sudo/default.nix
+++ b/pkgs/data/fonts/sudo/default.nix
@@ -1,11 +1,11 @@
 { lib, fetchzip }:
 
 let
-  version = "0.55.1";
+  version = "0.55.2";
 in fetchzip {
   name = "sudo-font-${version}";
   url = "https://github.com/jenskutilek/sudo-font/releases/download/v${version}/sudo.zip";
-  sha256 = "17vmcdz73mvy5m5zblgm2fi98v520hsl4lglww8gkhzl5zc6wb9y";
+  sha256 = "0r7w58r80yblyzlh6qb57pmafxb3frg1iny644bfr3p64j4cbzzb";
 
   postFetch = ''
     mkdir -p $out/share/fonts/
diff --git a/pkgs/development/interpreters/janet/default.nix b/pkgs/development/interpreters/janet/default.nix
index c0438d1e0076..35631174e260 100644
--- a/pkgs/development/interpreters/janet/default.nix
+++ b/pkgs/development/interpreters/janet/default.nix
@@ -11,7 +11,20 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-TzJbHmHIySlf3asQ02HOdehMR+s0KkPifBiaQ4FvFCg=";
   };
 
+  # we don't have /usr/bin/env in the sandbox, so substitute for a proper,
+  # absolute path to janet
+  postPatch = ''
+    substituteInPlace jpm \
+      --replace '/usr/bin/env janet' $out/bin/janet \
+      --replace /usr/local/lib/janet $out/lib \
+      --replace /usr/local           $out
+
+    substituteInPlace janet.1 \
+      --replace /usr/local/lib/janet $out/lib
+  '';
+
   nativeBuildInputs = [ meson ninja ];
+
   mesonFlags = [ "-Dgit_hash=release" ];
 
   doCheck = true;
@@ -20,7 +33,7 @@ stdenv.mkDerivation rec {
     description = "Janet programming language";
     homepage = "https://janet-lang.org/";
     license = licenses.mit;
+    maintainers = with maintainers; [ andrewchambers peterhoeg ];
     platforms = platforms.all;
-    maintainers = with maintainers; [ andrewchambers ];
   };
 }
diff --git a/pkgs/development/python-modules/pytile/default.nix b/pkgs/development/python-modules/pytile/default.nix
index 0d269522e1a0..cf445fd96815 100644
--- a/pkgs/development/python-modules/pytile/default.nix
+++ b/pkgs/development/python-modules/pytile/default.nix
@@ -8,23 +8,25 @@
 , pytest-aiohttp
 , pytest-asyncio
 , pytestCheckHook
-, pythonAtLeast
+, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "pytile";
-  version = "5.2.1";
+  version = "5.2.2";
+  format = "pyproject";
+  disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "bachya";
     repo = pname;
     rev = version;
-    sha256 = "0d63xga4gjlfl9fzv3i4j605rrx2qgbzam6cl609ny96s8q8h1px";
+    sha256 = "sha256-oVtTR5zucYvnaPO0i4sEBBU4nafq7GUfx3kPdSvptDo=";
   };
 
-  format = "pyproject";
-
-  nativeBuildInputs = [ poetry-core ];
+  nativeBuildInputs = [
+    poetry-core
+  ];
 
   propagatedBuildInputs = [
     aiohttp
@@ -38,8 +40,11 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
-  # Ignore the examples as they are prefixed with test_
-  pytestFlagsArray = [ "--ignore examples/" ];
+  disabledTestPaths = [
+    # Ignore the examples as they are prefixed with test_
+    "examples/"
+  ];
+
   pythonImportsCheck = [ "pytile" ];
 
   __darwinAllowLocalNetworking = true;
diff --git a/pkgs/development/python-modules/tvnamer/default.nix b/pkgs/development/python-modules/tvnamer/default.nix
deleted file mode 100644
index a9439d3e8878..000000000000
--- a/pkgs/development/python-modules/tvnamer/default.nix
+++ /dev/null
@@ -1,30 +0,0 @@
-{ lib
-, buildPythonPackage
-, fetchPypi
-, pytest
-, tvdb_api
-}:
-
-buildPythonPackage rec {
-  pname = "tvnamer";
-  version = "3.0.4";
-
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "dc2ea8188df6ac56439343630466b874c57756dd0b2538dd8e7905048f425f04";
-  };
-
-  checkInputs = [ pytest ];
-  propagatedBuildInputs = [ tvdb_api ];
-
-  # a ton of tests fail with: IOError: tvnamer/main.py could not be found in . or ..
-  doCheck = false;
-
-  meta = with lib; {
-    description = "Automatic TV episode file renamer, uses data from thetvdb.com via tvdb_api.";
-    homepage = "https://github.com/dbr/tvnamer";
-    license = licenses.unlicense;
-    maintainers = with maintainers; [ peterhoeg ];
-  };
-
-}
diff --git a/pkgs/os-specific/darwin/apple-sdk-11.0/private-frameworks.nix b/pkgs/os-specific/darwin/apple-sdk-11.0/private-frameworks.nix
index bb4300d623a4..b8786ec92f6d 100644
--- a/pkgs/os-specific/darwin/apple-sdk-11.0/private-frameworks.nix
+++ b/pkgs/os-specific/darwin/apple-sdk-11.0/private-frameworks.nix
@@ -15,4 +15,7 @@
   SignpostMetrics = {};
   PassKitCore = {};
   SkyLight = {};
+
+  # Also expose CoreSymbolication; used by `root` package.
+  CoreSymbolication = {};
 }
diff --git a/pkgs/os-specific/linux/kernel/linux-xanmod.nix b/pkgs/os-specific/linux/kernel/linux-xanmod.nix
index b389532c01a4..fbb9bf93ed55 100644
--- a/pkgs/os-specific/linux/kernel/linux-xanmod.nix
+++ b/pkgs/os-specific/linux/kernel/linux-xanmod.nix
@@ -1,8 +1,8 @@
 { lib, stdenv, buildLinux, fetchFromGitHub, ... } @ args:
 
 let
-  version = "5.12.13";
-  suffix = "xanmod1-cacule";
+  version = "5.13.0";
+  suffix = "xanmod2-cacule";
 in
 buildLinux (args // rec {
   inherit version;
@@ -12,11 +12,10 @@ buildLinux (args // rec {
     owner = "xanmod";
     repo = "linux";
     rev = modDirVersion;
-    sha256 = "sha256-eFIWlguU1hnkAgTbRxSMTStq0X7XW4IT1/9XlQSgdMQ=";
+    sha256 = "sha256-q+m1Ys/Gfr56cihoX8LS/w7icNcM3oefcXRtvzgx3cM=";
   };
 
   structuredExtraConfig = with lib.kernel; {
-
     # Preemptive Full Tickless Kernel at 500Hz
     PREEMPT_VOLUNTARY = lib.mkForce no;
     PREEMPT = lib.mkForce yes;
@@ -47,7 +46,7 @@ buildLinux (args // rec {
   };
 
   extraMeta = {
-    branch = "5.12-cacule";
+    branch = "5.13-cacule";
     maintainers = with lib.maintainers; [ fortuneteller2k ];
     description = "Built with custom settings and new features built to provide a stable, responsive and smooth desktop experience";
     broken = stdenv.isAarch64;
diff --git a/pkgs/servers/computing/slurm/default.nix b/pkgs/servers/computing/slurm/default.nix
index 843b7c340086..49beef53fe67 100644
--- a/pkgs/servers/computing/slurm/default.nix
+++ b/pkgs/servers/computing/slurm/default.nix
@@ -9,7 +9,7 @@
 
 stdenv.mkDerivation rec {
   pname = "slurm";
-  version = "20.11.7.1";
+  version = "20.11.8.1";
 
   # N.B. We use github release tags instead of https://www.schedmd.com/downloads.php
   # because the latter does not keep older releases.
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
     repo = "slurm";
     # The release tags use - instead of .
     rev = "${pname}-${builtins.replaceStrings ["."] ["-"] version}";
-    sha256 = "0ril6k4dj96qhx5x7r4nc2ghp7n9700808731v4qn9yvcslqzg9a";
+    sha256 = "0id2b01rvq81zd2p34il0gg880f94g9ip4gn1pyh20zz5bxlnbjc";
   };
 
   outputs = [ "out" "dev" ];
diff --git a/pkgs/tools/misc/tvnamer/default.nix b/pkgs/tools/misc/tvnamer/default.nix
new file mode 100644
index 000000000000..204914c280c6
--- /dev/null
+++ b/pkgs/tools/misc/tvnamer/default.nix
@@ -0,0 +1,47 @@
+{ lib
+, python3
+}:
+
+let
+  python' = python3.override {
+    packageOverrides = self: super: rec {
+      # tvdb_api v3.1.0 has a hard requirement on requests-cache < 0.6
+      requests-cache = super.requests-cache.overridePythonAttrs (super: rec {
+        version = "0.5.2";
+        src = self.fetchPypi {
+          inherit (super) pname;
+          inherit version;
+          sha256 = "sha256-gTAjJpaGBF+OAeIonMHn6a5asi3dHihJqQk6s6tycOs=";
+        };
+
+        # too many changes have been made to requests-cache based on version 0.6 so
+        # simply disable tests
+        doCheck = false;
+      });
+    };
+  };
+
+  pypkgs = python'.pkgs;
+
+in
+pypkgs.buildPythonApplication rec {
+  pname = "tvnamer";
+  version = "3.0.4";
+
+  src = pypkgs.fetchPypi {
+    inherit pname version;
+    sha256 = "dc2ea8188df6ac56439343630466b874c57756dd0b2538dd8e7905048f425f04";
+  };
+
+  propagatedBuildInputs = with pypkgs; [ tvdb_api ];
+
+  # no tests from pypi
+  doCheck = false;
+
+  meta = with lib; {
+    description = "Automatic TV episode file renamer, uses data from thetvdb.com via tvdb_api.";
+    homepage = "https://github.com/dbr/tvnamer";
+    license = licenses.unlicense;
+    maintainers = with maintainers; [ peterhoeg ];
+  };
+}
diff --git a/pkgs/tools/networking/yggdrasil/default.nix b/pkgs/tools/networking/yggdrasil/default.nix
index 8228132b5c84..506869238e57 100644
--- a/pkgs/tools/networking/yggdrasil/default.nix
+++ b/pkgs/tools/networking/yggdrasil/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "yggdrasil";
-  version = "0.3.16";
+  version = "0.4.0";
 
   src = fetchFromGitHub {
     owner = "yggdrasil-network";
     repo = "yggdrasil-go";
     rev = "v${version}";
-    sha256 = "sha256-uUF0zkgtzdMZB/GKOtawjn7AQBkRoiAEj9nUUmpQSVQ=";
+    sha256 = "sha256-sMcbOTLdmAXp3U2XeNM0hrwOTjzr+9B6IvAaVbjhuFY=";
   };
 
-  vendorSha256 = "sha256-619PSqd7pl3Akj/kzLQhDIp1adumBGhLrzQsZvMzC7w=";
+  vendorSha256 = "sha256-QQN8ePOQ7DT9KeuY4ohFuPtocuinh3Y3us6QMnCQ4gc=";
 
   doCheck = false;
 
diff --git a/pkgs/tools/package-management/cargo-audit/default.nix b/pkgs/tools/package-management/cargo-audit/default.nix
index 6fa0dd38127c..00b3a65be0d4 100644
--- a/pkgs/tools/package-management/cargo-audit/default.nix
+++ b/pkgs/tools/package-management/cargo-audit/default.nix
@@ -1,19 +1,36 @@
-{ stdenv, lib, rustPlatform, fetchFromGitHub, openssl, pkg-config, Security, libiconv }:
+{ lib
+, stdenv
+, rustPlatform
+, fetchFromGitHub
+, openssl
+, pkg-config
+, Security
+, libiconv
+}:
+
 rustPlatform.buildRustPackage rec {
   pname = "cargo-audit";
-  version = "0.14.1";
+  version = "0.15.0";
 
   src = fetchFromGitHub {
     owner = "RustSec";
-    repo = "cargo-audit";
-    rev = "v${version}";
-    sha256 = "sha256-apIhTgS7xzDGq2OE1o46bEQxGwkV7bTmzSxy85wHwyo=";
+    repo = "rustsec";
+    rev = "cargo-audit%2Fv${version}";
+    sha256 = "0pvb1m9277ysjzydjvx7viybi6bd23ch7sbjyx1wnz45ahrmia1j";
   };
 
-  cargoSha256 = "sha256-b4x5IxoT5KZnY6Pw3VEs/DuCPen6MlgQ2lSIxRDU+5U=";
+  cargoSha256 = "0cf8kg8vhfqbrkm227rzyl3394n7fsqhqgq13qks7374h5d04haw";
 
-  buildInputs = [ openssl libiconv ] ++ lib.optionals stdenv.isDarwin [ Security ];
-  nativeBuildInputs = [ pkg-config ];
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
+  buildInputs = [
+    openssl
+    libiconv
+  ] ++ lib.optionals stdenv.isDarwin [
+    Security
+  ];
 
   # enables `cargo audit fix`
   cargoBuildFlags = [ "--features fix" ];
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 103a95d921be..fe5670ffc4d1 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -1021,6 +1021,8 @@ in
 
   timedoctor = callPackage ../applications/office/timedoctor { };
 
+  tvnamer = callPackage ../tools/misc/tvnamer { };
+
   twine = with python3Packages; toPythonApplication twine;
 
   wayst = callPackage ../applications/terminal-emulators/wayst { };
diff --git a/pkgs/top-level/python-aliases.nix b/pkgs/top-level/python-aliases.nix
index 887ae8a149a2..22dd7abe2eb7 100644
--- a/pkgs/top-level/python-aliases.nix
+++ b/pkgs/top-level/python-aliases.nix
@@ -60,5 +60,6 @@ mapAliases ({
   smart_open = smart-open; # added 2021-03-14
   smmap2 = throw "smmap2 has been deprecated, use smmap instead."; # added 2020-03-14
   topydo = throw "python3Packages.topydo was moved to topydo"; # 2017-09-22
+  tvnamer = throw "python3Packages.tvnamer was moved to tvnamer"; # 2021-07-05
   websocket_client = websocket-client;
 })
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 0e804a541330..ed43c69c3736 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -8733,8 +8733,6 @@ in {
 
   tvdb_api = callPackage ../development/python-modules/tvdb_api { };
 
-  tvnamer = callPackage ../development/python-modules/tvnamer { };
-
   tweedledum = callPackage ../development/python-modules/tweedledum { };
 
   tweepy = callPackage ../development/python-modules/tweepy { };