diff --git a/nixos/modules/config/fonts/fonts.nix b/nixos/modules/config/fonts/fonts.nix
index 60a0885103d2..f87e61e3ef9f 100644
--- a/nixos/modules/config/fonts/fonts.nix
+++ b/nixos/modules/config/fonts/fonts.nix
@@ -8,7 +8,7 @@ let
   # If not running a fancy desktop environment, the cursor is likely set to
   # the default `cursor.pcf` bitmap font. This is 17px wide, so it's very
   # small and almost invisible on 4K displays.
-  fontcursormisc_hidpi = pkgs.xorg.fontcursormisc.overrideAttrs (old:
+  fontcursormisc_hidpi = pkgs.xorg.fontxfree86type1.overrideAttrs (old:
     let
       # The scaling constant is 230/96: the scalable `left_ptr` glyph at
       # about 23 points is rendered as 17px, on a 96dpi display.
diff --git a/nixos/modules/services/misc/nzbget.nix b/nixos/modules/services/misc/nzbget.nix
index 715ec891cd68..27c5f2e395f6 100644
--- a/nixos/modules/services/misc/nzbget.nix
+++ b/nixos/modules/services/misc/nzbget.nix
@@ -7,24 +7,12 @@ let
   pkg = pkgs.nzbget;
   stateDir = "/var/lib/nzbget";
   configFile = "${stateDir}/nzbget.conf";
-  configOpts = concatStringsSep " " (mapAttrsToList (name: value: "-o ${name}=${value}") nixosOpts);
-
-  nixosOpts = {
-    # allows nzbget to run as a "simple" service
-    OutputMode = "loggable";
-    # use journald for logging
-    WriteLog = "none";
-    ErrorTarget = "screen";
-    WarningTarget = "screen";
-    InfoTarget = "screen";
-    DetailTarget = "screen";
-    # required paths
-    ConfigTemplate = "${pkg}/share/nzbget/nzbget.conf";
-    WebDir = "${pkg}/share/nzbget/webui";
-    # nixos handles package updates
-    UpdateCheck = "none";
-  };
-
+  configOpts = concatStringsSep " " (mapAttrsToList (name: value: "-o ${name}=${escapeShellArg (toStr value)}") cfg.settings);
+  toStr = v:
+    if v == true then "yes"
+    else if v == false then "no"
+    else if isInt v then toString v
+    else v;
 in
 {
   imports = [
@@ -50,12 +38,41 @@ in
         default = "nzbget";
         description = "Group under which NZBGet runs";
       };
+
+      settings = mkOption {
+        type = with types; attrsOf (oneOf [ bool int str ]);
+        default = {};
+        description = ''
+          NZBGet configuration, passed via command line using switch -o. Refer to
+          <link xlink:href="https://github.com/nzbget/nzbget/blob/master/nzbget.conf"/>
+          for details on supported values.
+        '';
+        example = {
+          MainDir = "/data";
+        };
+      };
     };
   };
 
   # implementation
 
   config = mkIf cfg.enable {
+    services.nzbget.settings = {
+      # allows nzbget to run as a "simple" service
+      OutputMode = "loggable";
+      # use journald for logging
+      WriteLog = "none";
+      ErrorTarget = "screen";
+      WarningTarget = "screen";
+      InfoTarget = "screen";
+      DetailTarget = "screen";
+      # required paths
+      ConfigTemplate = "${pkg}/share/nzbget/nzbget.conf";
+      WebDir = "${pkg}/share/nzbget/webui";
+      # nixos handles package updates
+      UpdateCheck = "none";
+    };
+
     systemd.services.nzbget = {
       description = "NZBGet Daemon";
       after = [ "network.target" ];
@@ -64,6 +81,7 @@ in
         unrar
         p7zip
       ];
+
       preStart = ''
         if [ ! -f ${configFile} ]; then
           ${pkgs.coreutils}/bin/install -m 0700 ${pkg}/share/nzbget/nzbget.conf ${configFile}
diff --git a/nixos/modules/services/networking/syncthing.nix b/nixos/modules/services/networking/syncthing.nix
index 2e92fe51e90a..d77562701492 100644
--- a/nixos/modules/services/networking/syncthing.nix
+++ b/nixos/modules/services/networking/syncthing.nix
@@ -9,7 +9,7 @@ let
 
   devices = mapAttrsToList (name: device: {
     deviceID = device.id;
-    inherit (device) name addresses introducer;
+    inherit (device) name addresses introducer autoAcceptFolders;
   }) cfg.devices;
 
   folders = mapAttrsToList ( _: folder: {
@@ -149,6 +149,15 @@ in {
               '';
             };
 
+            autoAcceptFolders = mkOption {
+              type = types.bool;
+              default = false;
+              description = ''
+                Automatically create or share folders that this device advertises at the default path.
+                See <link xlink:href="https://docs.syncthing.net/users/config.html?highlight=autoaccept#config-file-format"/>.
+              '';
+            };
+
           };
         }));
       };
@@ -425,6 +434,15 @@ in {
         defaultText = literalExample "dataDir${optionalString cond " + \"/.config/syncthing\""}";
       };
 
+      extraFlags = mkOption {
+        type = types.listOf types.str;
+        default = [];
+        example = [ "--reset-deltas" ];
+        description = ''
+          Extra flags passed to the syncthing command in the service definition.
+        '';
+      };
+
       openDefaultPorts = mkOption {
         type = types.bool;
         default = false;
@@ -517,7 +535,7 @@ in {
             ${cfg.package}/bin/syncthing \
               -no-browser \
               -gui-address=${cfg.guiAddress} \
-              -home=${cfg.configDir}
+              -home=${cfg.configDir} ${escapeShellArgs cfg.extraFlags}
           '';
           MemoryDenyWriteExecute = true;
           NoNewPrivileges = true;
diff --git a/nixos/modules/services/web-apps/tt-rss.nix b/nixos/modules/services/web-apps/tt-rss.nix
index ed13845915c4..bc18c824f394 100644
--- a/nixos/modules/services/web-apps/tt-rss.nix
+++ b/nixos/modules/services/web-apps/tt-rss.nix
@@ -6,10 +6,6 @@ let
 
   configVersion = 26;
 
-  cacheDir = "cache";
-  lockDir = "lock";
-  feedIconsDir = "feed-icons";
-
   dbPort = if cfg.database.port == null
     then (if cfg.database.type == "pgsql" then 5432 else 3306)
     else cfg.database.port;
@@ -32,10 +28,10 @@ let
     <?php
       putenv('TTRSS_PHP_EXECUTABLE=${pkgs.php}/bin/php');
 
-      putenv('TTRSS_LOCK_DIRECTORY=${lockDir}');
-      putenv('TTRSS_CACHE_DIR=${cacheDir}');
-      putenv('TTRSS_ICONS_DIR=${feedIconsDir}');
-      putenv('TTRSS_ICONS_URL=${feedIconsDir}');
+      putenv('TTRSS_LOCK_DIRECTORY=${cfg.root}/lock');
+      putenv('TTRSS_CACHE_DIR=${cfg.root}/cache');
+      putenv('TTRSS_ICONS_DIR=${cfg.root}/feed-icons');
+      putenv('TTRSS_ICONS_URL=feed-icons');
       putenv('TTRSS_SELF_URL_PATH=${cfg.selfUrlPath}');
 
       putenv('TTRSS_MYSQL_CHARSET=UTF8');
@@ -101,6 +97,22 @@ let
       ${cfg.extraConfig}
   '';
 
+  # tt-rss and plugins and themes and config.php
+  servedRoot = pkgs.runCommand "tt-rss-served-root" {} ''
+    cp --no-preserve=mode -r ${pkgs.tt-rss} $out
+    cp ${tt-rss-config} $out/config.php
+    ${optionalString (cfg.pluginPackages != []) ''
+    for plugin in ${concatStringsSep " " cfg.pluginPackages}; do
+    cp -r "$plugin"/* "$out/plugins.local/"
+    done
+    ''}
+    ${optionalString (cfg.themePackages != []) ''
+    for theme in ${concatStringsSep " " cfg.themePackages}; do
+    cp -r "$theme"/* "$out/themes.local/"
+    done
+    ''}
+  '';
+
  in {
 
   ###### interface
@@ -544,12 +556,16 @@ let
       enable = true;
       virtualHosts = {
         ${cfg.virtualHost} = {
-          root = "${cfg.root}";
+          root = "${cfg.root}/www";
 
           locations."/" = {
             index = "index.php";
           };
 
+          locations."^~ /feed-icons" = {
+            root = "${cfg.root}";
+          };
+
           locations."~ \\.php$" = {
             extraConfig = ''
               fastcgi_split_path_info ^(.+\.php)(/.+)$;
@@ -562,13 +578,19 @@ let
     };
 
     systemd.tmpfiles.rules = [
-      "d '${cfg.root}' 0755 ${cfg.user} tt_rss - -"
-      "Z '${cfg.root}' 0755 ${cfg.user} tt_rss - -"
+      "d '${cfg.root}' 0555 ${cfg.user} tt_rss - -"
+      "d '${cfg.root}/lock' 0755 ${cfg.user} tt_rss - -"
+      "d '${cfg.root}/cache' 0755 ${cfg.user} tt_rss - -"
+      "d '${cfg.root}/cache/upload' 0755 ${cfg.user} tt_rss - -"
+      "d '${cfg.root}/cache/images' 0755 ${cfg.user} tt_rss - -"
+      "d '${cfg.root}/cache/export' 0755 ${cfg.user} tt_rss - -"
+      "d '${cfg.root}/feed-icons' 0755 ${cfg.user} tt_rss - -"
+      "L+ '${cfg.root}/www' - - - - ${servedRoot}"
     ];
 
     systemd.services = {
       phpfpm-tt-rss = mkIf (cfg.pool == "${poolName}") {
-        restartTriggers = [ tt-rss-config pkgs.tt-rss ];
+        restartTriggers = [ servedRoot ];
       };
 
       tt-rss = {
@@ -594,27 +616,7 @@ let
 
               else "";
 
-        in ''
-          rm -rf "${cfg.root}/*"
-          cp -r "${pkgs.tt-rss}/"* "${cfg.root}"
-          ${optionalString (cfg.pluginPackages != []) ''
-            for plugin in ${concatStringsSep " " cfg.pluginPackages}; do
-              cp -r "$plugin"/* "${cfg.root}/plugins.local/"
-            done
-          ''}
-          ${optionalString (cfg.themePackages != []) ''
-            for theme in ${concatStringsSep " " cfg.themePackages}; do
-              cp -r "$theme"/* "${cfg.root}/themes.local/"
-            done
-          ''}
-          ln -sf "${tt-rss-config}" "${cfg.root}/config.php"
-          chmod -R 755 "${cfg.root}"
-          chmod -R ug+rwX "${cfg.root}/${lockDir}"
-          chmod -R ug+rwX "${cfg.root}/${cacheDir}"
-          chmod -R ug+rwX "${cfg.root}/${feedIconsDir}"
-        ''
-
-        + (optionalString (cfg.database.type == "pgsql") ''
+        in (optionalString (cfg.database.type == "pgsql") ''
           exists=$(${callSql "select count(*) > 0 from pg_tables where tableowner = user"} \
           | tail -n+3 | head -n-2 | sed -e 's/[ \n\t]*//')
 
@@ -639,7 +641,7 @@ let
         serviceConfig = {
           User = "${cfg.user}";
           Group = "tt_rss";
-          ExecStart = "${pkgs.php}/bin/php ${cfg.root}/update.php --daemon --quiet";
+          ExecStart = "${pkgs.php}/bin/php ${cfg.root}/www/update.php --daemon --quiet";
           Restart = "on-failure";
           RestartSec = "60";
           SyslogIdentifier = "tt-rss";
diff --git a/nixos/tests/nzbget.nix b/nixos/tests/nzbget.nix
index d6111ba079c8..fe5a4bc3df91 100644
--- a/nixos/tests/nzbget.nix
+++ b/nixos/tests/nzbget.nix
@@ -8,13 +8,21 @@ import ./make-test-python.nix ({ pkgs, ...} : {
     server = { ... }: {
       services.nzbget.enable = true;
 
+      # provide some test settings
+      services.nzbget.settings = {
+        "MainDir" = "/var/lib/nzbget";
+        "DirectRename" = true;
+        "DiskSpace" = 0;
+        "Server1.Name" = "this is a test";
+      };
+
       # hack, don't add (unfree) unrar to nzbget's path,
       # so we can run this test in CI
       systemd.services.nzbget.path = pkgs.lib.mkForce [ pkgs.p7zip ];
     };
   };
 
-  testScript = ''
+  testScript = { nodes, ... }: ''
     start_all()
 
     server.wait_for_unit("nzbget.service")
@@ -26,5 +34,13 @@ import ./make-test-python.nix ({ pkgs, ...} : {
     server.succeed(
         "${pkgs.nzbget}/bin/nzbget -n -o Control_iP=127.0.0.1 -o Control_port=6789 -o Control_password=tegbzn6789 -V"
     )
+
+    config = server.succeed("${nodes.server.config.systemd.services.nzbget.serviceConfig.ExecStart} --printconfig")
+
+    # confirm the test settings are applied
+    assert 'MainDir = "/var/lib/nzbget"' in config
+    assert 'DirectRename = "yes"' in config
+    assert 'DiskSpace = "0"' in config
+    assert 'Server1.Name = "this is a test"' in config
   '';
 })
diff --git a/pkgs/applications/audio/ncspot/default.nix b/pkgs/applications/audio/ncspot/default.nix
index a2209368518d..012315a7d723 100644
--- a/pkgs/applications/audio/ncspot/default.nix
+++ b/pkgs/applications/audio/ncspot/default.nix
@@ -14,16 +14,16 @@ let
 in
 rustPlatform.buildRustPackage rec {
   pname = "ncspot";
-  version = "0.8.1";
+  version = "0.8.2";
 
   src = fetchFromGitHub {
     owner = "hrkfdn";
     repo = "ncspot";
     rev = "v${version}";
-    sha256 = "0sgnd6n8j8lygmb9qvv6i2ir28fdsrpmzlviz7d0gbx684qj0zkc";
+    sha256 = "1rs1jy7zzfgqzr64ld8whn0wlw8n7rk1svxx0xfxm3ynmgc7sd68";
   };
 
-  cargoSha256 = "0piipqf5y5bczbwkaplv6niqh3rp2di1gn7wwpd0gaa2cw7ylbb1";
+  cargoSha256 = "10g7gdi1iz751wa60vr4fs0cvfsgs3pfcp8pnywicl0vsdp25fmc";
 
   cargoBuildFlags = [ "--no-default-features" "--features" "${lib.concatStringsSep "," features}" ];
 
diff --git a/pkgs/applications/misc/genact/default.nix b/pkgs/applications/misc/genact/default.nix
new file mode 100644
index 000000000000..44e4bd2a0b38
--- /dev/null
+++ b/pkgs/applications/misc/genact/default.nix
@@ -0,0 +1,22 @@
+{ fetchFromGitHub, lib, rustPlatform }:
+
+rustPlatform.buildRustPackage rec {
+  pname = "genact";
+  version = "0.11.0";
+
+  src = fetchFromGitHub {
+    owner = "svenstaro";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "1hc4jwk5rr1yw3pfvriash7b03j181k8c9y7m3sglkk8xnff219c";
+  };
+
+  cargoSha256 = "0a5ic6c7fvmg2kh3qprzffnpw40cmrgbscrlhxxs3m7nxfjdh7bc";
+
+  meta = with lib; {
+    description = "A nonsense activity generator";
+    homepage = "https://github.com/svenstaro/genact";
+    license = licenses.mit;
+    maintainers = with maintainers; [ figsoda ];
+  };
+}
diff --git a/pkgs/applications/misc/keepass/default.nix b/pkgs/applications/misc/keepass/default.nix
index 336bd5a7f64d..f2846de37d3f 100644
--- a/pkgs/applications/misc/keepass/default.nix
+++ b/pkgs/applications/misc/keepass/default.nix
@@ -84,7 +84,7 @@ with builtins; buildDotnetPackage rec {
   # after loading. It is brought into plugins bin/ directory using
   # buildEnv in the plugin derivation. Wrapper below makes sure it
   # is found and does not pollute output path.
-  binPaths = lib.concatStrings (lib.intersperse ":" (map (x: x + "/bin") plugins));
+  binPaths = lib.concatStringsSep ":" (map (x: x + "/bin") plugins);
 
   dynlibPath = lib.makeLibraryPath [ gtk2 ];
 
diff --git a/pkgs/applications/misc/merkaartor/default.nix b/pkgs/applications/misc/merkaartor/default.nix
index 010d28eef591..bb28be72deb7 100644
--- a/pkgs/applications/misc/merkaartor/default.nix
+++ b/pkgs/applications/misc/merkaartor/default.nix
@@ -2,14 +2,13 @@
 , lib
 , stdenv
 , fetchFromGitHub
-, fetchpatch
 , qmake
 , qttools
 , qttranslations
 , gdal
 , proj
 , qtsvg
-, qtwebkit
+, qtwebengine
 , withGeoimage ? true, exiv2
 , withGpsdlib ? (!stdenv.isDarwin), gpsd
 , withLibproxy ? false, libproxy
@@ -18,31 +17,18 @@
 
 mkDerivation rec {
   pname = "merkaartor";
-  version = "0.18.4";
+  version = "0.19.0";
 
   src = fetchFromGitHub {
     owner = "openstreetmap";
     repo = "merkaartor";
     rev = version;
-    sha256 = "vwO4/a7YF9KbpxcFGTFCdG6SfwEyhISlEtcA+rMebUA=";
+    sha256 = "sha256-Gx+gnVbSY8JnG03kO5vVQNlSZRl/hrKTdDbh7lyIMbA=";
   };
 
-  patches = [
-    # Fix build with Qt 5.15 (missing QPainterPath include)
-    (fetchpatch {
-      url = "https://github.com/openstreetmap/merkaartor/commit/e72553a7ea2c7ba0634cc3afcd27a9f7cfef089c.patch";
-      sha256 = "NAisplnS3xHSlRpX+fH15NpbaD+uM57OCsTYGKlIR7U=";
-    })
-    # Added a condition to use the new timespec_t on gpsd APIs >= 9
-    (fetchpatch {
-      url = "https://github.com/openstreetmap/merkaartor/commit/13b358fa7899bb34e277b32a4c0d92833050f2c6.patch";
-      sha256 = "129fpjm7illz7ngx3shps5ivrxwf14apw55842xhskwwb0rf5szb";
-    })
-  ];
-
   nativeBuildInputs = [ qmake qttools ];
 
-  buildInputs = [ gdal proj qtsvg qtwebkit ]
+  buildInputs = [ gdal proj qtsvg qtwebengine ]
     ++ lib.optional withGeoimage exiv2
     ++ lib.optional withGpsdlib gpsd
     ++ lib.optional withLibproxy libproxy
@@ -52,8 +38,10 @@ mkDerivation rec {
     lrelease src/src.pro
   '';
 
-  qmakeFlags = [ "TRANSDIR_SYSTEM=${qttranslations}/translations" ]
-    ++ lib.optional withGeoimage "GEOIMAGE=1"
+  qmakeFlags = [
+    "TRANSDIR_SYSTEM=${qttranslations}/translations"
+    "USEWEBENGINE=1"
+  ] ++ lib.optional withGeoimage "GEOIMAGE=1"
     ++ lib.optional withGpsdlib "GPSDLIB=1"
     ++ lib.optional withLibproxy "LIBPROXY=1"
     ++ lib.optional withZbar "ZBAR=1";
diff --git a/pkgs/applications/networking/cloudflared/default.nix b/pkgs/applications/networking/cloudflared/default.nix
index 617d84e43db6..ffdd8b7ed040 100644
--- a/pkgs/applications/networking/cloudflared/default.nix
+++ b/pkgs/applications/networking/cloudflared/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "cloudflared";
-  version = "2021.8.3";
+  version = "2021.8.6";
 
   src = fetchFromGitHub {
     owner  = "cloudflare";
     repo   = "cloudflared";
     rev    = version;
-    sha256 = "sha256-gipLjABvJ1QK98uX7Gl6feHXUei95yHlSNkqlQ7pVg4=";
+    sha256 = "sha256-dMZu4IRdchPeoYylz1XDZeJsAW+V8HZApNndpeu+RbA=";
   };
 
   vendorSha256 = null;
diff --git a/pkgs/applications/networking/instant-messengers/deltachat-cursed/default.nix b/pkgs/applications/networking/instant-messengers/deltachat-cursed/default.nix
index e7263b1d1617..8a04d75f5a63 100644
--- a/pkgs/applications/networking/instant-messengers/deltachat-cursed/default.nix
+++ b/pkgs/applications/networking/instant-messengers/deltachat-cursed/default.nix
@@ -8,19 +8,22 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "deltachat-cursed";
-  version = "0.2.0";
+  version = "0.3.0";
 
   src = fetchFromGitHub {
     owner = "adbenitez";
     repo = "deltachat-cursed";
     rev = "v${version}";
-    sha256 = "0kbb7lh17dbkd85mcqf438qwk5masz2fxsy8ljdh23kis55nksh8";
+    sha256 = "0zzzrzc8yxw6ffwfirbrr5ahbidbvlwdvgdg82zjsdjjbarxph8c";
   };
 
   nativeBuildInputs = [
+    python3.pkgs.setuptools-scm
     wrapGAppsHook
   ];
 
+  SETUPTOOLS_SCM_PRETEND_VERSION = version;
+
   buildInputs = [
     gobject-introspection
     libnotify
@@ -28,6 +31,7 @@ python3.pkgs.buildPythonApplication rec {
 
   propagatedBuildInputs = with python3.pkgs; [
     deltachat
+    notify-py
     pygobject3
     urwid-readline
   ];
diff --git a/pkgs/applications/networking/instant-messengers/deltachat-desktop/default.nix b/pkgs/applications/networking/instant-messengers/deltachat-desktop/default.nix
index a4f3a2212432..41c7470a26d9 100644
--- a/pkgs/applications/networking/instant-messengers/deltachat-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/deltachat-desktop/default.nix
@@ -8,11 +8,26 @@
 , makeWrapper
 , nodePackages
 , pkg-config
+, rustPlatform
 , stdenv
 , CoreServices
 }:
 
 let
+  libdeltachat' = libdeltachat.overrideAttrs (old: rec {
+    version = "1.56.0";
+    src = fetchFromGitHub {
+      owner = "deltachat";
+      repo = "deltachat-core-rust";
+      rev = version;
+      sha256 = "07vcwbvpzcnvpls0hmpapi7v1npca8ydbx2i235k26xym8il89b7";
+    };
+    cargoDeps = rustPlatform.fetchCargoTarball {
+      inherit src;
+      name = "${old.pname}-${version}";
+      sha256 = "0pb1rcv45xa95ziqap94yy52fy02vh401iqsgi18nm1j6iyyngc8";
+    };
+  });
   electronExec = if stdenv.isDarwin then
     "${electron}/Applications/Electron.app/Contents/MacOS/Electron"
   else
@@ -37,7 +52,7 @@ in nodePackages.deltachat-desktop.override rec {
   ];
 
   buildInputs = [
-    libdeltachat
+    libdeltachat'
   ] ++ lib.optionals stdenv.isDarwin [
     CoreServices
   ];
diff --git a/pkgs/applications/networking/instant-messengers/kdeltachat/default.nix b/pkgs/applications/networking/instant-messengers/kdeltachat/default.nix
index dabec65b3cd4..eda47b56b796 100644
--- a/pkgs/applications/networking/instant-messengers/kdeltachat/default.nix
+++ b/pkgs/applications/networking/instant-messengers/kdeltachat/default.nix
@@ -11,34 +11,17 @@
 , qtimageformats
 , qtmultimedia
 , qtwebengine
-, rustPlatform
 }:
 
-let
-  libdeltachat' = libdeltachat.overrideAttrs (old: rec {
-    inherit (old) pname;
-    version = "1.58.0";
-    src = fetchFromGitHub {
-      owner = "deltachat";
-      repo = "deltachat-core-rust";
-      rev = version;
-      sha256 = "03xc0jlfmvmdcipmzavbzkq010qlxzf3mj1zi7wcix7kpl8gwmy7";
-    };
-    cargoDeps = rustPlatform.fetchCargoTarball {
-      inherit src;
-      name = "${pname}-${version}";
-      sha256 = "1zijxyc1xjlbyh1gh2lyw44xjcrhz1msykrlqgfkw5w1w0yh78hd";
-    };
-  });
-in mkDerivation rec {
+mkDerivation rec {
   pname = "kdeltachat";
-  version = "unstable-2021-08-02";
+  version = "unstable-2021-08-28";
 
   src = fetchFromSourcehut {
     owner = "~link2xt";
     repo = "kdeltachat";
-    rev = "950f4f22c01ab75f613479ef831bdf38f395d1dd";
-    sha256 = "007gazqkzcc0w0rq2i8ysa9f50ldj7n9f5gp1mh8bi86bdvdkzsy";
+    rev = "4d051bc35611fa5b75865769df7a512d90a13c65";
+    sha256 = "1p8pb3pwgvxy5bvr6by54f1f62imdlddy2mk52qxcvrx8f833bml";
   };
 
   nativeBuildInputs = [
@@ -49,7 +32,7 @@ in mkDerivation rec {
 
   buildInputs = [
     kirigami2
-    libdeltachat'
+    libdeltachat
     qtimageformats
     qtmultimedia
     qtwebengine
diff --git a/pkgs/applications/office/gnucash/default.nix b/pkgs/applications/office/gnucash/default.nix
index 22c9eef5d095..d4dad44d7da8 100644
--- a/pkgs/applications/office/gnucash/default.nix
+++ b/pkgs/applications/office/gnucash/default.nix
@@ -33,6 +33,15 @@ stdenv.mkDerivation rec {
     sha256 = "0csp8iddhc901vv09gl5lj970g6ili696vwj4vdpkiprp7gh26r5";
   };
 
+  patches = [
+    # Fixes a warning about an initialized variable that kills enableDebugging gnucash builds on nix.
+    # This will most likely be part of the 4.7 release, it will be safe to remove then.
+    (fetchpatch {
+      url = "https://github.com/Gnucash/gnucash/commit/b42052464ba9701a3d1834fc58fa0deb32ab9afe.patch";
+      sha256 = "092957c8jqj4v70fv0ia1wpgl6x34hbwjrichxfbk5ja8l6535gc";
+    })
+  ];
+
   nativeBuildInputs = [ pkg-config makeWrapper cmake gtest swig ];
 
   buildInputs = [
diff --git a/pkgs/applications/science/misc/snakemake/default.nix b/pkgs/applications/science/misc/snakemake/default.nix
index 419323cfa31f..4ff751ff8d18 100644
--- a/pkgs/applications/science/misc/snakemake/default.nix
+++ b/pkgs/applications/science/misc/snakemake/default.nix
@@ -2,7 +2,7 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "snakemake";
-  version = "6.6.1";
+  version = "6.7.0";
 
   propagatedBuildInputs = with python3Packages; [
     appdirs
@@ -31,7 +31,7 @@ python3Packages.buildPythonApplication rec {
 
   src = python3Packages.fetchPypi {
     inherit pname version;
-    sha256 = "91637a801342f3bc349c033b284fef7c0201b4e5e29d5650cb6c7f69096d4184";
+    sha256 = "6f53d54044c5d1718c7858f45286beeffb220c794fe5f602a5c20bf0caf8ec07";
   };
 
   doCheck = false; # Tests depend on Google Cloud credentials at ${HOME}/gcloud-service-key.json
diff --git a/pkgs/applications/video/vdr/wrapper.nix b/pkgs/applications/video/vdr/wrapper.nix
index 50d3b9d65a8d..04984212b249 100644
--- a/pkgs/applications/video/vdr/wrapper.nix
+++ b/pkgs/applications/video/vdr/wrapper.nix
@@ -24,7 +24,7 @@ in symlinkJoin {
     inherit license homepage;
     description = description
     + " (with plugins: "
-    + lib.concatStrings (lib.intersperse ", " (map (x: ""+x.name) plugins))
+    + lib.concatStringsSep ", " (map (x: ""+x.name) plugins)
     + ")";
   };
 }
diff --git a/pkgs/desktops/xfce/core/thunar/wrapper.nix b/pkgs/desktops/xfce/core/thunar/wrapper.nix
index 4e9732ce1c4a..5381dceae4a4 100644
--- a/pkgs/desktops/xfce/core/thunar/wrapper.nix
+++ b/pkgs/desktops/xfce/core/thunar/wrapper.nix
@@ -36,6 +36,6 @@ symlinkJoin {
 
     description = thunar.meta.description + optionalString
       (0 != length thunarPlugins)
-      " (with plugins: ${concatStrings (intersperse ", " (map (x: x.name) thunarPlugins))})";
+      " (with plugins: ${concatStringsSep  ", " (map (x: x.name) thunarPlugins)})";
   };
 }
diff --git a/pkgs/development/compilers/gcc/common/configure-flags.nix b/pkgs/development/compilers/gcc/common/configure-flags.nix
index 4686a387712f..6744ad8b0bfe 100644
--- a/pkgs/development/compilers/gcc/common/configure-flags.nix
+++ b/pkgs/development/compilers/gcc/common/configure-flags.nix
@@ -133,7 +133,7 @@ let
       "--with-system-zlib"
       "--enable-static"
       "--enable-languages=${
-        lib.concatStrings (lib.intersperse ","
+        lib.concatStringsSep ","
           (  lib.optional langC        "c"
           ++ lib.optional langCC       "c++"
           ++ lib.optional langD        "d"
@@ -146,7 +146,6 @@ let
           ++ lib.optionals crossDarwin [ "objc" "obj-c++" ]
           ++ lib.optional langJit      "jit"
           )
-        )
       }"
     ]
 
diff --git a/pkgs/development/compilers/llvm/11/compiler-rt/default.nix b/pkgs/development/compilers/llvm/11/compiler-rt/default.nix
index 89b47df405fe..e5b79692ae24 100644
--- a/pkgs/development/compilers/llvm/11/compiler-rt/default.nix
+++ b/pkgs/development/compilers/llvm/11/compiler-rt/default.nix
@@ -112,5 +112,8 @@ stdenv.mkDerivation {
     # "All of the code in the compiler-rt project is dual licensed under the MIT
     # license and the UIUC License (a BSD-like license)":
     license = with lib.licenses; [ mit ncsa ];
+    # compiler-rt requires a Clang stdenv on 32-bit RISC-V:
+    # https://reviews.llvm.org/D43106#1019077
+    broken = stdenv.hostPlatform.isRiscV && stdenv.hostPlatform.is32bit && !stdenv.cc.isClang;
   };
 }
diff --git a/pkgs/development/compilers/llvm/11/default.nix b/pkgs/development/compilers/llvm/11/default.nix
index 661e60e24b18..9834ce30cdd2 100644
--- a/pkgs/development/compilers/llvm/11/default.nix
+++ b/pkgs/development/compilers/llvm/11/default.nix
@@ -227,7 +227,7 @@ let
 
     compiler-rt-libc = callPackage ./compiler-rt {
       inherit llvm_meta;
-      stdenv = if (stdenv.hostPlatform.useLLVM or false) || (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64)
+      stdenv = if (stdenv.hostPlatform.useLLVM or false) || (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64) || (stdenv.hostPlatform.isRiscV && stdenv.hostPlatform.is32bit)
                then overrideCC stdenv buildLlvmTools.clangNoCompilerRtWithLibc
                else stdenv;
     };
@@ -240,7 +240,7 @@ let
     };
 
     # N.B. condition is safe because without useLLVM both are the same.
-    compiler-rt = if stdenv.hostPlatform.isAndroid || (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64)
+    compiler-rt = if stdenv.hostPlatform.isAndroid || (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64) || (stdenv.hostPlatform.libc == "newlib")
       then libraries.compiler-rt-libc
       else libraries.compiler-rt-no-libc;
 
diff --git a/pkgs/development/compilers/vyper/default.nix b/pkgs/development/compilers/vyper/default.nix
index 6d1f7a374dae..431afe5ec205 100644
--- a/pkgs/development/compilers/vyper/default.nix
+++ b/pkgs/development/compilers/vyper/default.nix
@@ -14,11 +14,11 @@ in
 
 buildPythonPackage rec {
   pname = "vyper";
-  version = "0.2.15";
+  version = "0.2.16";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-cNnKHVKwIx0miC2VhGYBzcSckTnyWYmjNzW0bEzP4bU=";
+    sha256 = "6cf347440716964012d46686faefc9c689f01872f19736287a63aa8652ac3ddd";
   };
 
   nativeBuildInputs = [ pytest-runner ];
diff --git a/pkgs/development/interpreters/joker/default.nix b/pkgs/development/interpreters/joker/default.nix
index 8a2130050bfa..652e828eb5f4 100644
--- a/pkgs/development/interpreters/joker/default.nix
+++ b/pkgs/development/interpreters/joker/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "joker";
-  version = "0.17.1";
+  version = "0.17.2";
 
   src = fetchFromGitHub {
     rev = "v${version}";
     owner = "candid82";
     repo = "joker";
-    sha256 = "sha256-3OimYXcQ3KPav44sClbC60220/YK4Jhq+l5UfRFYoJI=";
+    sha256 = "sha256-rboyRancRTyrSY+13Blrz7OsIzclDS4X4hkHGD6cpyk=";
   };
 
   vendorSha256 = "sha256-AYoespfzFLP/jIIxbw5K653wc7sSfLY8K7di8GZ64wA=";
diff --git a/pkgs/development/libraries/cjson/default.nix b/pkgs/development/libraries/cjson/default.nix
index b75b91508cbe..ccf3311317aa 100644
--- a/pkgs/development/libraries/cjson/default.nix
+++ b/pkgs/development/libraries/cjson/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "cjson";
-  version = "1.7.14";
+  version = "1.7.15";
 
   src = fetchFromGitHub {
     owner = "DaveGamble";
     repo = "cJSON";
     rev = "v${version}";
-    sha256 = "1a3i9ydl65dgwgmlg79n5q8qilmjkaakq56sam1w25zcrd8jy11q";
+    sha256 = "sha256-PpUVsLklcs5hCCsQcsXw0oEVIWecKnQO16Hy0Ba8ov8=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/drogon/default.nix b/pkgs/development/libraries/drogon/default.nix
index 2b418ee4c6a9..f669d663379e 100644
--- a/pkgs/development/libraries/drogon/default.nix
+++ b/pkgs/development/libraries/drogon/default.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "drogon";
-  version = "1.7.1";
+  version = "1.7.2";
 
   src = fetchFromGitHub {
     owner = "drogonframework";
     repo = "drogon";
     rev = "v${version}";
-    sha256 = "0rhwbz3m5x3vy5zllfs8r347wqprg29pff5q7i53f25bh8y0n49i";
+    sha256 = "0g2fm8xb2gi7qaib6mxvg6k6y4g2d0a2jg4k5qvsjbd0n7j8746j";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/development/libraries/libdeltachat/default.nix b/pkgs/development/libraries/libdeltachat/default.nix
index 6a0a6ae5c874..c61636bfb95f 100644
--- a/pkgs/development/libraries/libdeltachat/default.nix
+++ b/pkgs/development/libraries/libdeltachat/default.nix
@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libdeltachat";
-  version = "1.56.0";
+  version = "1.59.0";
 
   src = fetchFromGitHub {
     owner = "deltachat";
     repo = "deltachat-core-rust";
     rev = version;
-    sha256 = "sha256-ZyVEI6q+GzHLEFH01TxS7NqwT7zqVgg0vduyf/fibB8=";
+    sha256 = "1lwck5gb2kys7wxg08q3pnb8cqhzwwqy6nxcf2yc030gmnwm4sya";
   };
 
   patches = [
@@ -37,7 +37,7 @@ stdenv.mkDerivation rec {
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src;
     name = "${pname}-${version}";
-    sha256 = "0pb1rcv45xa95ziqap94yy52fy02vh401iqsgi18nm1j6iyyngc8";
+    sha256 = "13zzc8c50cy6fknrxzw5gf6rcclsn5bcb2bi3z9mmzsl29ga32gx";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/libquotient/default.nix b/pkgs/development/libraries/libquotient/default.nix
index 7c89e98576af..6264a9de3691 100644
--- a/pkgs/development/libraries/libquotient/default.nix
+++ b/pkgs/development/libraries/libquotient/default.nix
@@ -2,13 +2,13 @@
 
 mkDerivation rec {
   pname = "libquotient";
-  version = "0.6.7";
+  version = "0.6.8";
 
   src = fetchFromGitHub {
     owner = "quotient-im";
     repo = "libQuotient";
     rev = version;
-    sha256 = "sha256-fAzYv9OsanXqocEvbSB3OA9OVicwcZ0xT9uYbrFPEHc=";
+    sha256 = "sha256-CrAK0yq1upB1+C2z6mqKkSArCmzI+TDEEHTIBWB29Go=";
   };
 
   buildInputs = [ qtbase qtmultimedia ];
diff --git a/pkgs/development/libraries/openssl/1.1/macos-yosemite-compat.patch b/pkgs/development/libraries/openssl/1.1/macos-yosemite-compat.patch
new file mode 100644
index 000000000000..b0e37e325611
--- /dev/null
+++ b/pkgs/development/libraries/openssl/1.1/macos-yosemite-compat.patch
@@ -0,0 +1,56 @@
+From cef404f1e7a598166cbc2fd2e0048f7e2d752ad5 Mon Sep 17 00:00:00 2001
+From: David Carlier <devnexen@gmail.com>
+Date: Tue, 24 Aug 2021 22:40:14 +0100
+Subject: [PATCH] Darwin platform allows to build on releases before
+ Yosemite/ios 8.
+
+issue #16407 #16408
+---
+ crypto/rand/rand_unix.c |  5 +----
+ include/crypto/rand.h   | 10 ++++++++++
+ 2 files changed, 11 insertions(+), 4 deletions(-)
+
+diff --git a/crypto/rand/rand_unix.c b/crypto/rand/rand_unix.c
+index 43f1069d151d..0f4525106af7 100644
+--- a/crypto/rand/rand_unix.c
++++ b/crypto/rand/rand_unix.c
+@@ -34,9 +34,6 @@
+ #if defined(__OpenBSD__)
+ # include <sys/param.h>
+ #endif
+-#if defined(__APPLE__)
+-# include <CommonCrypto/CommonRandom.h>
+-#endif
+ 
+ #if defined(OPENSSL_SYS_UNIX) || defined(__DJGPP__)
+ # include <sys/types.h>
+@@ -381,7 +378,7 @@ static ssize_t syscall_random(void *buf, size_t buflen)
+         if (errno != ENOSYS)
+             return -1;
+     }
+-#  elif defined(__APPLE__)
++#  elif defined(OPENSSL_APPLE_CRYPTO_RANDOM)
+     if (CCRandomGenerateBytes(buf, buflen) == kCCSuccess)
+ 	    return (ssize_t)buflen;
+ 
+diff --git a/include/crypto/rand.h b/include/crypto/rand.h
+index 5350d3a93119..674f840fd13c 100644
+--- a/include/crypto/rand.h
++++ b/include/crypto/rand.h
+@@ -20,6 +20,16 @@
+ 
+ # include <openssl/rand.h>
+ 
++# if defined(__APPLE__) && !defined(OPENSSL_NO_APPLE_CRYPTO_RANDOM)
++#  include <Availability.h>
++#  if (defined(__MAC_OS_X_VERSION_MIN_REQUIRED) && __MAC_OS_X_VERSION_MIN_REQUIRED >= 101000) || \
++     (defined(__IPHONE_OS_VERSION_MIN_REQUIRED) && __IPHONE_OS_VERSION_MIN_REQUIRED >= 80000)
++#   define OPENSSL_APPLE_CRYPTO_RANDOM 1
++#   include <CommonCrypto/CommonCryptoError.h>
++#   include <CommonCrypto/CommonRandom.h>
++#  endif
++# endif
++
+ /* forward declaration */
+ typedef struct rand_pool_st RAND_POOL;
+ 
diff --git a/pkgs/development/libraries/openssl/default.nix b/pkgs/development/libraries/openssl/default.nix
index fc2c2fad1959..2d3f1c313caa 100644
--- a/pkgs/development/libraries/openssl/default.nix
+++ b/pkgs/development/libraries/openssl/default.nix
@@ -192,14 +192,16 @@ in {
   };
 
   openssl_1_1 = common {
-    version = "1.1.1k";
-    sha256 = "1rdfzcrxy9y38wqdw5942vmdax9hjhgrprzxm42csal7p5shhal9";
+    version = "1.1.1l";
+    sha256 = "sha256-C3o+XlnDSCf+DDp0t+yLrvMCuY+oAIjX+RU6oW+na9E=";
     patches = [
       ./1.1/nix-ssl-cert-file.patch
 
       (if stdenv.hostPlatform.isDarwin
        then ./1.1/use-etc-ssl-certs-darwin.patch
        else ./1.1/use-etc-ssl-certs.patch)
+    ] ++ lib.optionals (stdenv.isDarwin) [
+      ./1.1/macos-yosemite-compat.patch
     ];
     withDocs = true;
   };
diff --git a/pkgs/development/libraries/simgear/default.nix b/pkgs/development/libraries/simgear/default.nix
index b5df83a0b90c..6167d63544f4 100644
--- a/pkgs/development/libraries/simgear/default.nix
+++ b/pkgs/development/libraries/simgear/default.nix
@@ -4,7 +4,7 @@
 , curl
 }:
 let
-  version = "2020.3.8";
+  version = "2020.3.11";
   shortVersion = builtins.substring 0 6 version;
 in
 stdenv.mkDerivation rec {
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://sourceforge/flightgear/release-${shortVersion}/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-UXcWV9MPu7c+QlFjrhxtQ6ruAcxuKtewwphu4tt5dWc=";
+    sha256 = "sha256-u438vCo7AUPR/88B0alh5WbvId0z2cx2jW2apYcdTzw=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/python-modules/django-haystack/default.nix b/pkgs/development/python-modules/django-haystack/default.nix
index 14e66a159c18..c207a37ebf15 100644
--- a/pkgs/development/python-modules/django-haystack/default.nix
+++ b/pkgs/development/python-modules/django-haystack/default.nix
@@ -4,11 +4,11 @@
 
 buildPythonPackage rec {
   pname = "django-haystack";
-  version = "3.0";
+  version = "3.1.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "d490f920afa85471dd1fa5000bc8eff4b704daacbe09aee1a64e75cbc426f3be";
+    sha256 = "6d05756b95d7d5ec1dbd4668eb999ced1504b47f588e2e54be53b1404c516a82";
   };
 
   checkInputs = [ pysolr whoosh python-dateutil geopy coverage nose mock coverage requests ];
diff --git a/pkgs/development/python-modules/dropbox/default.nix b/pkgs/development/python-modules/dropbox/default.nix
index 73b0b87b0108..7406e6dc21b3 100644
--- a/pkgs/development/python-modules/dropbox/default.nix
+++ b/pkgs/development/python-modules/dropbox/default.nix
@@ -3,11 +3,11 @@
 
 buildPythonPackage rec {
   pname = "dropbox";
-  version = "11.16.0";
+  version = "11.18.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "99e84367d5b983815a3680eea2c7e67bff14637c4702010c5c58611eb714dfe2";
+    sha256 = "fa512c87521809e93502fc6a27b1d57ffbcef2281468c8f93575eab6a9ad5f05";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/elasticsearch-dsl/default.nix b/pkgs/development/python-modules/elasticsearch-dsl/default.nix
index a2f2ff038db0..5f55a3ac4733 100644
--- a/pkgs/development/python-modules/elasticsearch-dsl/default.nix
+++ b/pkgs/development/python-modules/elasticsearch-dsl/default.nix
@@ -10,11 +10,11 @@
 
 buildPythonPackage rec {
   pname = "elasticsearch-dsl";
-  version = "7.3.0";
+  version = "7.4.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0ed75f6ff037e36b2397a8e92cae0ddde79b83adc70a154b8946064cb62f7301";
+    sha256 = "c4a7b93882918a413b63bed54018a1685d7410ffd8facbc860ee7fd57f214a6d";
   };
 
   propagatedBuildInputs = [ elasticsearch python-dateutil six ]
diff --git a/pkgs/development/python-modules/portalocker/default.nix b/pkgs/development/python-modules/portalocker/default.nix
index 11016043ce11..abe7ce698208 100644
--- a/pkgs/development/python-modules/portalocker/default.nix
+++ b/pkgs/development/python-modules/portalocker/default.nix
@@ -5,12 +5,12 @@
 }:
 
 buildPythonPackage rec {
-  version = "2.3.1";
+  version = "2.3.2";
   pname = "portalocker";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "5ff2e494eccd3ff1cbaba8e4defd45bc7edb8eea3908c74f6de5d40641a1ed92";
+    sha256 = "75cfe02f702737f1726d83e04eedfa0bda2cc5b974b1ceafb8d6b42377efbd5f";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/tools/electron/default.nix b/pkgs/development/tools/electron/default.nix
index 7bef2cb4ef7f..1262819fbc2d 100644
--- a/pkgs/development/tools/electron/default.nix
+++ b/pkgs/development/tools/electron/default.nix
@@ -105,23 +105,23 @@ rec {
     headers = "0gb56pxdkn8970z141l3p30lkizqca6kqj1cvgbp685xmb231hzq";
   };
 
-  electron_12 = mkElectron "12.0.17" {
-    x86_64-linux = "00c05d20372a14b84984f1c30e4c6f293480ef0c35c63949468e9d1ab4918db7";
-    x86_64-darwin = "3600d64945474c7a7f7ef5ac9cbc7241432bf778096004d13fe05603a43407c2";
-    i686-linux = "3ee6c565f74492b658b5fd4c648dbd0b5d556c8a193125e5f7ee840b088823d7";
-    armv7l-linux = "fa1cde8a59c1118baf0f98c1a22b9c99ffac51fd40c65a9fef490c938106ad96";
-    aarch64-linux = "92c129b50c17f8a7977c2c61eb721f0c8b831201d3fa1bdcc7d93f63df705ee0";
-    aarch64-darwin = "58cdcefa89d4d3d8e669290fd8caced636f969e327d6c772444fda2482df3244";
-    headers = "0sg8ybnrmx11xm7yc0lj8yy0g57ln48gvqhrr9g725zimzza9v3l";
+  electron_12 = mkElectron "12.0.18" {
+    x86_64-linux = "09a7908b98a1783bd3840fa289f0ce8d2badada698ddc9daff4398a969292ef2";
+    x86_64-darwin = "ab5071568614998adc3b12c93966f82b27da2f13a7317433a32252dd83593d08";
+    i686-linux = "0fbf1cb8cd3e5581ee80f49453c86673b4e91c7f599fdcb53af040c6d1992cb8";
+    armv7l-linux = "da064a1b86f42a5091ee1162fcad55b1a1f8a8168534a86e37dabd056b54ecbd";
+    aarch64-linux = "7197e1ae54af3cc20f312b01a200c75f6a6e0a1b38d0ca48492ead178a607edc";
+    aarch64-darwin = "aed2fbafb955f879c65099aebef504fd8076a452d25ccd1cd38d4d1b8758770e";
+    headers = "1m1ycv1ysr3aram1d3rj7b4w5dy63irq67x3ff355h33n6dhi4cf";
   };
 
-  electron_13 = mkElectron "13.2.2" {
-    x86_64-linux = "3d64bc0eab8dc1fd162693a5492ad694bb65b110fc846293faa3e8ed5c7b6a4b";
-    x86_64-darwin = "276916b97960d9e49944b9c6dcd35746feb3b55e86747b4ed0e0eb569c47ec0f";
-    i686-linux = "b4bcb41473d240d2078b9ca1d71fd879f5e89a8e6cafd13fa8bdcc615b77fe68";
-    armv7l-linux = "fd5fab50764f50dcf4b77c7617fe69895ea177d787fe58a54cc0adb5de026801";
-    aarch64-linux = "c4f112945d41304c796a7460018721df4598114cc087c1114c72f1e41d985d11";
-    aarch64-darwin = "1bc30f12cf6ff3cedde5f90e138b604cd610176be63bb87a9f023146c2f7c81d";
-    headers = "1992ss04078drjybh7pn0lmfmk2kcg9y2jdq9z24caf2xlabfb2d";
+  electron_13 = mkElectron "13.2.3" {
+    x86_64-linux = "495b0c96427c63f6f4d08c5b58d6379f9ee3c6c81148fbbe8a7a6a872127df6d";
+    x86_64-darwin = "c02f116484a5e1495d9f7451638bc0d3dea8fa2fde2e4c9c88a17cff98192ddc";
+    i686-linux = "03fb8cad91fcbb578027b814119b09cd1ddd414f159c9012850655f9171847c1";
+    armv7l-linux = "d8aaf2b49b9ab0a46caa31ed7d4358a3223efeaf90941d3d5e272532718ed754";
+    aarch64-linux = "cbbf9f98b1cfbee3fcd0869632a03542408dfd35f2e4d5b72cd823ce9448f659";
+    aarch64-darwin = "ef375063e30bc51bbcbe16fb7e5d85933eb60888ccc159c391aefc4f6d616faa";
+    headers = "0ayiklr84x7xhh5nz2dfzq2fkqivb9y9axfy7q9n4ps08xbqycyr";
   };
 }
diff --git a/pkgs/development/tools/go-tools/default.nix b/pkgs/development/tools/go-tools/default.nix
index 69059578e273..38ed470cbe90 100644
--- a/pkgs/development/tools/go-tools/default.nix
+++ b/pkgs/development/tools/go-tools/default.nix
@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "go-tools";
-  version = "2021.1";
+  version = "2021.1.1";
 
   src = fetchFromGitHub {
     owner = "dominikh";
     repo = "go-tools";
     rev = version;
-    sha256 = "sha256-QhTjzrERhbhCSkPzyLQwFyxrktNoGL9ris+XfE7n5nQ=";
+    sha256 = "sha256-Vj5C+PIzZUSD16U4KFO3jR/Gq11P8v3my5eODWb//4c=";
   };
 
   vendorSha256 = "sha256-EjCOMdeJ0whp2pHZvm4VV2K78UNKzl98Z/cQvGhWSyY=";
diff --git a/pkgs/development/tools/sentry-cli/default.nix b/pkgs/development/tools/sentry-cli/default.nix
index 884c0edfb735..32f362a834b8 100644
--- a/pkgs/development/tools/sentry-cli/default.nix
+++ b/pkgs/development/tools/sentry-cli/default.nix
@@ -2,39 +2,36 @@
 , fetchFromGitHub
 , lib
 , openssl
-, file
-, rpm
 , pkg-config
 , stdenv
-, curl
 , Security
-, runCommand
+, SystemConfiguration
 }:
 rustPlatform.buildRustPackage rec {
   pname = "sentry-cli";
-  version = "1.66.0";
+  version = "1.68.0";
 
   src = fetchFromGitHub {
     owner = "getsentry";
     repo = "sentry-cli";
     rev = version;
-    sha256 = "sha256-ivQBn5GGb64Jq0gpywAg20309QQMpasg/Bu5sHKj02Y=";
+    sha256 = "sha256-JhKRfeAaSs4KwfcI88UbqIXNw0aZytPkIxkwrg1d2xM=";
   };
   doCheck = false;
 
   # Needed to get openssl-sys to use pkgconfig.
   OPENSSL_NO_VENDOR = 1;
 
-  buildInputs = [ openssl file rpm ] ++ lib.optionals stdenv.isDarwin [ Security curl ];
+  buildInputs = [ openssl ] ++ lib.optionals stdenv.isDarwin [ Security SystemConfiguration ];
   nativeBuildInputs = [ pkg-config ];
 
-  cargoSha256 = "sha256-xS88KZWYkg3v8TJZUVVgQhR++CrZGD0DQnLPktSUJQk=";
+  cargoSha256 = "sha256-iV3D4ka8Sg1FMRne3A6npmZm3hFP9Qi/NdmT62BtO+8=";
 
   meta = with lib; {
     homepage = "https://docs.sentry.io/cli/";
     license = licenses.bsd3;
-    description = "A command line utility to work with Sentry.";
+    description = "A command line utility to work with Sentry";
+    changelog = "https://github.com/getsentry/sentry-cli/raw/${version}/CHANGELOG.md";
     maintainers = with maintainers; [ rizary ];
-    platforms = platforms.unix;
   };
 }
diff --git a/pkgs/misc/emulators/retroarch/wrapper.nix b/pkgs/misc/emulators/retroarch/wrapper.nix
index 40d9f07846b7..4cc7ad404be0 100644
--- a/pkgs/misc/emulators/retroarch/wrapper.nix
+++ b/pkgs/misc/emulators/retroarch/wrapper.nix
@@ -31,7 +31,7 @@ stdenv.mkDerivation {
     inherit license homepage platforms maintainers;
     description = description
                   + " (with cores: "
-                  + lib.concatStrings (lib.intersperse ", " (map (x: ""+x.name) cores))
+                  + lib.concatStringsSep ", " (map (x: ""+x.name) cores)
                   + ")";
   };
 }
diff --git a/pkgs/os-specific/linux/tuxedo-keyboard/default.nix b/pkgs/os-specific/linux/tuxedo-keyboard/default.nix
index 17f8b3a28c4e..563e1333b87f 100644
--- a/pkgs/os-specific/linux/tuxedo-keyboard/default.nix
+++ b/pkgs/os-specific/linux/tuxedo-keyboard/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "tuxedo-keyboard-${kernel.version}";
-  version = "3.0.7";
+  version = "3.0.8";
 
   src = fetchFromGitHub {
     owner = "tuxedocomputers";
     repo = "tuxedo-keyboard";
     rev = "v${version}";
-    sha256 = "sha256-JloLwfJfDdVowx1hOehjxPbnaKBCAMn7SZe09SE03HU=";
+    sha256 = "1rv3ns4n61v18cpnp36zi47jpnqhj410yzi8b307ghiyriapbijv";
   };
 
   buildInputs = [ linuxHeaders ];
@@ -17,7 +17,10 @@ stdenv.mkDerivation rec {
 
   installPhase = ''
     mkdir -p "$out/lib/modules/${kernel.modDirVersion}"
-    mv src/tuxedo_keyboard.ko $out/lib/modules/${kernel.modDirVersion}
+
+    for module in clevo_acpi.ko clevo_wmi.ko tuxedo_keyboard.ko tuxedo_io/tuxedo_io.ko; do
+        mv src/$module $out/lib/modules/${kernel.modDirVersion}
+    done
   '';
 
   meta = with lib; {
diff --git a/pkgs/shells/elvish/default.nix b/pkgs/shells/elvish/default.nix
index 0916c9b25b59..961f765dd872 100644
--- a/pkgs/shells/elvish/default.nix
+++ b/pkgs/shells/elvish/default.nix
@@ -2,7 +2,7 @@
 
 buildGoModule rec {
   pname = "elvish";
-  version = "0.16.1";
+  version = "0.16.3";
 
   excludedPackages = [ "website" ];
 
@@ -12,10 +12,10 @@ buildGoModule rec {
     owner = "elves";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-i7RJiR1Mta2TrWBSUk0WM3InMV2cwbdlp3KHUdZgQ8I=";
+    sha256 = "1na2fswqp4rbgvlagz9nj3cmlxavlhi2gj6k6jpjq05mcbkxr3bd";
   };
 
-  vendorSha256 = "sha256-5tZwGrp/L9L+pf/yp8zlbb0voe60+if+NNf8ua2MujI=";
+  vendorSha256 = "06rx09vs08d9arim53al73z22hb40xj2101kbvafz6wbyp6pqws1";
 
   doCheck = false;
 
@@ -29,7 +29,6 @@ buildGoModule rec {
     homepage = "https://elv.sh/";
     license = licenses.bsd2;
     maintainers = with maintainers; [ vrthra AndersonTorres ];
-    platforms = with platforms; linux ++ darwin;
   };
 
   passthru = {
diff --git a/pkgs/tools/admin/stripe-cli/default.nix b/pkgs/tools/admin/stripe-cli/default.nix
index 13620d164e67..d812cd4b294f 100644
--- a/pkgs/tools/admin/stripe-cli/default.nix
+++ b/pkgs/tools/admin/stripe-cli/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "stripe-cli";
-  version = "1.5.12";
+  version = "1.7.0";
 
   src = fetchFromGitHub {
     owner = "stripe";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-eMxukwaJqsXL0+Euvk5mM+pcAsT3GsF9filuyRL4tXg=";
+    sha256 = "sha256-CO+2BpMIUSaOhdia75zDGR4RZQSaxY05Z6TOKxBlKIw=";
   };
 
-  vendorSha256 = "sha256-e7EZ5o30vDpS904/R1y7/Mds7HxQNmsIftrnc1Bj2bc=";
+  vendorSha256 = "sha256-LOSHoEP0YRjfHav3MXSYPPrrjX6/ItxeVMOihRx0DTQ=";
 
   subPackages = [
     "cmd/stripe"
diff --git a/pkgs/tools/graphics/diagrams-builder/default.nix b/pkgs/tools/graphics/diagrams-builder/default.nix
index 9337d5cca23b..85f4fdc83efa 100644
--- a/pkgs/tools/graphics/diagrams-builder/default.nix
+++ b/pkgs/tools/graphics/diagrams-builder/default.nix
@@ -36,7 +36,7 @@ stdenv.mkDerivation {
   nativeBuildInputs = [ makeWrapper ];
 
   buildCommand = with lib;
-    concatStrings (intersperse "\n" (map exeWrapper backends));
+    concatStringsSep "\n" (map exeWrapper backends);
 
   # Will be faster to build the wrapper locally then to fetch it from a binary cache.
   preferLocalBuild = true;
diff --git a/pkgs/tools/misc/wlc/default.nix b/pkgs/tools/misc/wlc/default.nix
index 874e31ca6ef1..dd7c5f7942f8 100644
--- a/pkgs/tools/misc/wlc/default.nix
+++ b/pkgs/tools/misc/wlc/default.nix
@@ -6,11 +6,11 @@ with python3.pkgs;
 
 buildPythonPackage rec {
   pname = "wlc";
-  version = "1.11";
+  version = "1.12";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256:0ysx250v2qycy1m3jj0wxmyf2f5n8fxf6br69vcbyq2cnqw609nx";
+    sha256 = "sha256:01c1qxq6dxvpn8rgpbqs4iw5daa0rmlgygb3xhhfj7xpqv1v84ir";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/tools/networking/dnsproxy/default.nix b/pkgs/tools/networking/dnsproxy/default.nix
index 3debf67f81a9..77f1bf694459 100644
--- a/pkgs/tools/networking/dnsproxy/default.nix
+++ b/pkgs/tools/networking/dnsproxy/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "dnsproxy";
-  version = "0.39.2";
+  version = "0.39.4";
 
   src = fetchFromGitHub {
     owner = "AdguardTeam";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-FuPNWoLsqPvz4J+ymfEKBjPmLlxwDUp/196REDnGPmQ=";
+    sha256 = "sha256-dF3xyyOqWzjHW8cFdGlb3BCCGVy+eWW5OesKEK7pEjw=";
   };
 
   vendorSha256 = null;
diff --git a/pkgs/tools/networking/goimapnotify/default.nix b/pkgs/tools/networking/goimapnotify/default.nix
index 619e364c884f..968d5774b5b5 100644
--- a/pkgs/tools/networking/goimapnotify/default.nix
+++ b/pkgs/tools/networking/goimapnotify/default.nix
@@ -1,23 +1,23 @@
-{ buildGoPackage, fetchFromGitLab, lib, runtimeShell }:
+{ buildGoModule, fetchFromGitLab, lib, runtimeShell }:
 
-buildGoPackage rec {
+buildGoModule rec {
   pname = "goimapnotify";
-  version = "2.0";
-
-  goPackagePath = "gitlab.com/shackra/goimapnotify";
+  version = "2.3.2";
 
   src = fetchFromGitLab {
     owner = "shackra";
     repo = "goimapnotify";
     rev = version;
-    sha256 = "1d42gd3m2rkvy985d181dbcm5i3f7xsg2z8z6s4bpvw24pfnzs42";
+    sha256 = "sha256-pkpdIkabxz9bu0LnyU1/wu1qqPc/pQqCn8tePc2fIfg=";
   };
 
-  postPatch = ''
-    substituteInPlace command.go --replace '"sh"' '"${runtimeShell}"'
-  '';
+  vendorSha256 = "sha256-4+2p/7BAEk+1V0TII9Q2O2YNX0rvBiw2Ss7k1dsvUbk=";
 
-  goDeps = ./deps.nix;
+  postPatch = ''
+    for f in command.go command_test.go; do
+      substituteInPlace $f --replace '"sh"' '"${runtimeShell}"'
+    done
+  '';
 
   meta = with lib; {
     description =
diff --git a/pkgs/tools/networking/iperf/3.nix b/pkgs/tools/networking/iperf/3.nix
index 5ab3f7f30fbd..f32a4249c006 100644
--- a/pkgs/tools/networking/iperf/3.nix
+++ b/pkgs/tools/networking/iperf/3.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "iperf";
-  version = "3.9";
+  version = "3.10.1";
 
   src = fetchurl {
     url = "https://downloads.es.net/pub/iperf/iperf-${version}.tar.gz";
-    sha256 = "0f601avdmzpwsa3lbi0ppjhkrdipm5wifhhxy5czf99370k3mdi4";
+    sha256 = "0nkisr2215w68ivadg3sx3q50iwamznwigs63lclb8jlrih9gg03";
   };
 
   buildInputs = [ openssl ];
diff --git a/pkgs/tools/networking/nzbget/default.nix b/pkgs/tools/networking/nzbget/default.nix
index 4934cb1296cc..fc44c193b069 100644
--- a/pkgs/tools/networking/nzbget/default.nix
+++ b/pkgs/tools/networking/nzbget/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchurl, pkg-config, libxml2, ncurses, libsigcxx, libpar2
-, gnutls, libgcrypt, zlib, openssl }:
+, gnutls, libgcrypt, zlib, openssl, nixosTests }:
 
 stdenv.mkDerivation rec {
   pname = "nzbget";
@@ -17,6 +17,8 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
+  passthru.tests = { inherit (nixosTests) nzbget; };
+
   meta = with lib; {
     homepage = "https://nzbget.net";
     license = licenses.gpl2Plus;
diff --git a/pkgs/tools/networking/proxychains/default.nix b/pkgs/tools/networking/proxychains/default.nix
index 56a553c0c803..b93c6ae12cfb 100644
--- a/pkgs/tools/networking/proxychains/default.nix
+++ b/pkgs/tools/networking/proxychains/default.nix
@@ -19,10 +19,6 @@ stdenv.mkDerivation rec {
     substituteInPlace Makefile --replace "-Werror" "-Werror -Wno-stringop-truncation"
   '';
 
-  postInstall = ''
-    cp src/proxychains.conf $out/etc
-  '';
-
   meta = with lib; {
     description = "Proxifier for SOCKS proxies";
     homepage = "http://proxychains.sourceforge.net";
diff --git a/pkgs/tools/security/gopass/default.nix b/pkgs/tools/security/gopass/default.nix
index 9e56b4c1a4bb..6a099299e905 100644
--- a/pkgs/tools/security/gopass/default.nix
+++ b/pkgs/tools/security/gopass/default.nix
@@ -13,7 +13,7 @@
 
 buildGoModule rec {
   pname = "gopass";
-  version = "1.12.7";
+  version = "1.12.8";
 
   nativeBuildInputs = [ installShellFiles makeWrapper ];
 
@@ -21,10 +21,10 @@ buildGoModule rec {
     owner = "gopasspw";
     repo = pname;
     rev = "v${version}";
-    sha256 = "08mzm03vhc8pqyl17y8dkrcpgy3ckmb84x84b6ap3cja3y8gmj5x";
+    sha256 = "0f3nnhipx2p8w04rxva0pcf7g1nhr4f5bz5dbvr2m76lkiaz5q3v";
   };
 
-  vendorSha256 = "0ym6f1h51bj3qlzxs936fz3p47l63nad4xckl16m13iy0k7z5flg";
+  vendorSha256 = "14khs15k9d5m5dms3l4a5bi0s3zl1irm0i4s9pf86gpyz7b55l6a";
 
   subPackages = [ "." ];
 
@@ -60,7 +60,7 @@ buildGoModule rec {
     homepage = "https://www.gopass.pw/";
     license = licenses.mit;
     maintainers = with maintainers; [ andir rvolosatovs ];
-    changelog = "https://github.com/gopasspw/gopass/blob/v${version}/CHANGELOG.md";
+    changelog = "https://github.com/gopasspw/gopass/raw/v${version}/CHANGELOG.md";
 
     longDescription = ''
       gopass is a rewrite of the pass password manager in Go with the aim of
diff --git a/pkgs/tools/text/silver-searcher/default.nix b/pkgs/tools/text/silver-searcher/default.nix
index 8cd67b99263c..757c65eed848 100644
--- a/pkgs/tools/text/silver-searcher/default.nix
+++ b/pkgs/tools/text/silver-searcher/default.nix
@@ -22,6 +22,7 @@ stdenv.mkDerivation rec {
     homepage = "https://github.com/ggreer/the_silver_searcher/";
     description = "A code-searching tool similar to ack, but faster";
     maintainers = with maintainers; [ madjar ];
+    mainProgram = "ag";
     platforms = platforms.all;
     license = licenses.asl20;
   };
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 7743a36b79e3..c211e30174da 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -9930,7 +9930,7 @@ with pkgs;
   };
 
   sentry-cli = callPackage ../development/tools/sentry-cli {
-    inherit (darwin.apple_sdk.frameworks) Security;
+    inherit (darwin.apple_sdk.frameworks) Security SystemConfiguration;
   };
 
   sentry-native = callPackage ../development/libraries/sentry-native { };
@@ -24344,6 +24344,8 @@ with pkgs;
   geany = callPackage ../applications/editors/geany { };
   geany-with-vte = callPackage ../applications/editors/geany/with-vte.nix { };
 
+  genact = callPackage ../applications/misc/genact { };
+
   genxword = callPackage ../applications/misc/genxword { };
 
   geoipupdate = callPackage ../applications/misc/geoipupdate/default.nix { };