diff --git a/doc/languages-frameworks/python.section.md b/doc/languages-frameworks/python.section.md
index 2639039657a4..9f9ace513c30 100644
--- a/doc/languages-frameworks/python.section.md
+++ b/doc/languages-frameworks/python.section.md
@@ -764,7 +764,7 @@ and in this case the `python38` interpreter is automatically used.
 
 ### Interpreters {#interpreters}
 
-Versions 2.7, 3.6, 3.7, 3.8 and 3.9 of the CPython interpreter are available as
+Versions 2.7, 3.7, 3.8 and 3.9 of the CPython interpreter are available as
 respectively `python27`, `python37`, `python38` and `python39`. The
 aliases `python2` and `python3` correspond to respectively `python27` and
 `python39`. The attribute `python` maps to `python2`. The PyPy interpreters
diff --git a/pkgs/applications/misc/charm/default.nix b/pkgs/applications/misc/charm/default.nix
index 581c86b6ade1..204a090136de 100644
--- a/pkgs/applications/misc/charm/default.nix
+++ b/pkgs/applications/misc/charm/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "charm";
-  version = "0.9.0";
+  version = "0.9.2";
 
   src = fetchFromGitHub {
     owner = "charmbracelet";
     repo = "charm";
     rev = "v${version}";
-    sha256 = "1q5c2qka4srqj82f50iwmcj2j0yw2msz5dmrx2avqppp3fyi9jz3";
+    sha256 = "sha256-5WNkD+YfmQHGAWWfD9/ZEHnHPT0Ejm9Nz+/mn8xvU4U=";
   };
 
-  vendorSha256 = "1xycgzx706kyz37z3517p98129iy7py7zdizz34k38fvfpila5q5";
+  vendorSha256 = "sha256-TncVMDeZ8+Wuv1o0Cjks3Ve1OsO+WXH9mClC6GNaSas=";
 
   doCheck = false;
 
diff --git a/pkgs/applications/misc/neo/default.nix b/pkgs/applications/misc/neo/default.nix
new file mode 100644
index 000000000000..fda086c49d57
--- /dev/null
+++ b/pkgs/applications/misc/neo/default.nix
@@ -0,0 +1,25 @@
+{ lib, stdenv, fetchurl, ncurses }:
+
+stdenv.mkDerivation rec {
+  pname = "neo";
+  version = "0.6";
+
+  src = fetchurl {
+    url = "https://github.com/st3w/neo/releases/download/v${version}/neo-${version}.tar.gz";
+    sha256 = "sha256-skXLT1td4dGdsu+wbX44Z2u5sDEOKXYVVys4Q6RayIk=";
+  };
+
+  buildInputs = [ ncurses ];
+
+  meta = with lib; {
+    description = ''Simulates the digital rain from "The Matrix"'';
+    license = licenses.gpl3Plus;
+    longDescription = ''
+      neo recreates the digital rain effect from "The Matrix". Streams of random
+      characters will endlessly scroll down your terminal screen.
+    '';
+    homepage = "https://github.com/st3w/neo";
+    platforms = ncurses.meta.platforms;
+    maintainers = [ maintainers.abbe ];
+  };
+}
diff --git a/pkgs/applications/networking/instant-messengers/rocketchat-desktop/default.nix b/pkgs/applications/networking/instant-messengers/rocketchat-desktop/default.nix
index 46b2e0f46ece..2edaf6bd33d5 100644
--- a/pkgs/applications/networking/instant-messengers/rocketchat-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/rocketchat-desktop/default.nix
@@ -4,11 +4,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "rocketchat-desktop";
-  version = "3.7.1";
+  version = "3.7.2";
 
   src = fetchurl {
     url = "https://github.com/RocketChat/Rocket.Chat.Electron/releases/download/${version}/rocketchat_${version}_amd64.deb";
-    sha256 = "1l4g0y7kb569w1i3c1bq6m0p9wykrf7k6a59j5cvnkl1b9h8mj4p";
+    sha256 = "sha256-sSSi8L5WXFAc9yRDZ2usWmh6F06/1RMbJInQ4/OORnI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/networking/irc/convos/default.nix b/pkgs/applications/networking/irc/convos/default.nix
index 762fdf78ce3f..275cf4c726e7 100644
--- a/pkgs/applications/networking/irc/convos/default.nix
+++ b/pkgs/applications/networking/irc/convos/default.nix
@@ -6,23 +6,24 @@ with lib;
 
 perlPackages.buildPerlPackage rec {
   pname = "convos";
-  version = "6.26";
+  version = "6.42";
 
   src = fetchFromGitHub {
     owner = "convos-chat";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1wh3ryhd4b7nanh0yp2nycmhky5afw8lpfx34858p6wfimsv9794";
+    sha256 = "sha256-W7ZVZUCNllpFIQpNz2m/8VFOXDZfuppB+g3qibY6wt8=";
   };
 
   nativeBuildInputs = [ makeWrapper ]
     ++ optional stdenv.isDarwin [ shortenPerlShebang ];
 
   buildInputs = with perlPackages; [
-    CryptEksblowfish FileHomeDir FileReadBackwards HTTPAcceptLanguage
+    CryptPassphrase CryptPassphraseArgon2 CryptPassphraseBcrypt
+    FileHomeDir FileReadBackwards HTTPAcceptLanguage
     IOSocketSSL IRCUtils JSONValidator LinkEmbedder ModuleInstall
-    Mojolicious MojoliciousPluginOpenAPI MojoliciousPluginWebpack
-    ParseIRC TextMarkdown TimePiece UnicodeUTF8
+    Mojolicious MojoliciousPluginOpenAPI MojoliciousPluginSyslog MojoliciousPluginWebpack
+    ParseIRC TextMarkdownHoedown TimePiece UnicodeUTF8
     CpanelJSONXS EV
   ];
 
diff --git a/pkgs/data/themes/matcha/default.nix b/pkgs/data/themes/matcha/default.nix
index 886a173b2d89..4d59a03313a4 100644
--- a/pkgs/data/themes/matcha/default.nix
+++ b/pkgs/data/themes/matcha/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "matcha-gtk-theme";
-  version = "2021-11-29";
+  version = "2021-12-25";
 
   src = fetchFromGitHub {
     owner = "vinceliuice";
     repo = pname;
     rev = version;
-    sha256 = "10fgz09h25cmnvz0bzx5qadv7cqnl1bdd6hj7w0rcbsws4c2j17q";
+    sha256 = "1wgq1aypm4cjv7yavlfmqcwahlddvh2gbg2f5ca0djgnpy9vha1g";
   };
 
   buildInputs = [ gdk-pixbuf librsvg ];
diff --git a/pkgs/data/themes/obsidian2/default.nix b/pkgs/data/themes/obsidian2/default.nix
index 8d431a0d061c..251dde481fd2 100644
--- a/pkgs/data/themes/obsidian2/default.nix
+++ b/pkgs/data/themes/obsidian2/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "theme-obsidian2";
-  version = "2.19";
+  version = "2.20";
 
   src = fetchurl {
     url = "https://github.com/madmaxms/theme-obsidian-2/releases/download/v${version}/obsidian-2-theme.tar.xz";
-    sha256 = "sha256-GGnrix8utJ34pszuoxcMY5Yr0stwL17Y812FIiRZOUk=";
+    sha256 = "0bbw8far4fjz7fiy205wnzp9ibnvqspfcjkinhjj8l0s272h7wjp";
   };
 
   sourceRoot = ".";
diff --git a/pkgs/data/themes/qogir/default.nix b/pkgs/data/themes/qogir/default.nix
index 57d664415da8..e3e3b6e485b8 100644
--- a/pkgs/data/themes/qogir/default.nix
+++ b/pkgs/data/themes/qogir/default.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation rec {
   pname = "qogir-theme";
-  version = "2021-11-17";
+  version = "2021-12-25";
 
   src = fetchFromGitHub {
     owner = "vinceliuice";
     repo = pname;
     rev = version;
-    sha256 = "1ri2dh34vw2pfv0lxzk9f4755v0d4ilnr6fzj3raw9b5fp5zzi91";
+    sha256 = "1h10yqz3i59bxhkk2r2p8as8g9ibx38bbpdxi7jgg2pxr581mn4f";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/data/themes/whitesur/default.nix b/pkgs/data/themes/whitesur/default.nix
index cbf08acce5c0..6833f473664f 100644
--- a/pkgs/data/themes/whitesur/default.nix
+++ b/pkgs/data/themes/whitesur/default.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation rec {
   pname = "whitesur-gtk-theme";
-  version = "2021-12-04";
+  version = "2021-12-28";
 
   src = fetchFromGitHub {
     owner = "vinceliuice";
     repo = pname;
     rev = version;
-    sha256 = "0fpq6xw2xq0fkmpg1la9q26nfbqhf0212s95v25256miz55p67ha";
+    sha256 = "0i81aickccfp8fffilhi335hj5ijz2n38yj3zw2fnbwgm667i0fc";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/compilers/graalvm/community-edition/mkGraal.nix b/pkgs/development/compilers/graalvm/community-edition/mkGraal.nix
index 2b1aa6b64694..ee016e71d312 100644
--- a/pkgs/development/compilers/graalvm/community-edition/mkGraal.nix
+++ b/pkgs/development/compilers/graalvm/community-edition/mkGraal.nix
@@ -1,13 +1,41 @@
-{ version, javaVersion, platforms, hashes ? import ./hashes.nix }:
+{ version
+, javaVersion
+, platforms
+, hashes ? import ./hashes.nix
+, useMusl ? false
+}:
 
-{ stdenv, lib, fetchurl, autoPatchelfHook, setJavaClassPath, makeWrapper
-# minimum dependencies
-, Foundation, alsa-lib, fontconfig, freetype, glibc, openssl, perl, unzip, xorg
+{ stdenv
+, lib
+, autoPatchelfHook
+, fetchurl
+, makeWrapper
+, setJavaClassPath
+, writeShellScriptBin
+  # minimum dependencies
+, alsa-lib
+, fontconfig
+, Foundation
+, freetype
+, glibc
+, openssl
+, perl
+, unzip
+, xorg
 , zlib
-# runtime dependencies
+  # runtime dependencies
+, binutils
 , cups
-# runtime dependencies for GTK+ Look and Feel
-, gtkSupport ? true, cairo, glib, gtk3 }:
+, gcc
+, musl
+  # runtime dependencies for GTK+ Look and Feel
+, gtkSupport ? stdenv.isLinux
+, cairo
+, glib
+, gtk3
+}:
+
+assert useMusl -> stdenv.isLinux;
 
 let
   platform = {
@@ -16,10 +44,17 @@ let
     x86_64-darwin = "darwin-amd64";
   }.${stdenv.system} or (throw "Unsupported system: ${stdenv.system}");
 
-  runtimeDependencies = [ cups ]
-    ++ lib.optionals gtkSupport [ cairo glib gtk3 ];
+  runtimeLibraryPath = lib.makeLibraryPath
+    ([ cups ] ++ lib.optionals gtkSupport [ cairo glib gtk3 ]);
 
-  runtimeLibraryPath = lib.makeLibraryPath runtimeDependencies;
+  runtimeDependencies = lib.makeBinPath ([
+    binutils
+    stdenv.cc
+  ] ++ lib.optionals useMusl [
+    (lib.getDev musl)
+    # GraalVM 21.3.0+ expects musl-gcc as <system>-musl-gcc
+    (writeShellScriptBin "${stdenv.system}-musl-gcc" ''${lib.getDev musl}/bin/musl-gcc "$@"'')
+  ]);
 
   javaVersionPlatform = "${javaVersion}-${platform}";
 
@@ -51,10 +86,6 @@ let
       zlib
     ];
 
-    # Workaround for libssl.so.10 wanted by TruffleRuby
-    # Resulting TruffleRuby cannot use `openssl` library.
-    autoPatchelfIgnoreMissingDeps = true;
-
     nativeBuildInputs = [ unzip perl autoPatchelfHook makeWrapper ];
 
     unpackPhase = ''
@@ -108,55 +139,73 @@ let
 
     outputs = [ "out" "lib" ];
 
-    installPhase = let
-      copyClibrariesToOut = basepath: ''
-        # provide libraries needed for static compilation
-        for f in ${glibc}/lib/* ${glibc.static}/lib/* ${zlib.static}/lib/*; do
-          ln -s $f ${basepath}/${platform}/$(basename $f)
-        done
-      '';
-      copyClibrariesToLib = ''
-        # add those libraries to $lib output too, so we can use them with
-        # `native-image -H:CLibraryPath=''${graalvm11-ce.lib}/lib ...` and reduce
-        # closure size by not depending on GraalVM $out (that is much bigger)
+    installPhase =
+      let
+        copyClibrariesToOut = basepath: ''
+          # provide libraries needed for static compilation
+          ${
+            if useMusl then
+              "for f in ${musl.stdenv.cc.cc}/lib/* ${musl}/lib/* ${zlib.static}/lib/*; do"
+            else
+              "for f in ${glibc}/lib/* ${glibc.static}/lib/* ${zlib.static}/lib/*; do"
+          }
+            ln -s $f ${basepath}/${platform}/$(basename $f)
+          done
+        '';
+        copyClibrariesToLib = ''
+          # add those libraries to $lib output too, so we can use them with
+          # `native-image -H:CLibraryPath=''${lib.getLib graalvm11-ce}/lib ...` and reduce
+          # closure size by not depending on GraalVM $out (that is much bigger)
+          mkdir -p $lib/lib
+          for f in ${glibc}/lib/*; do
+            ln -s $f $lib/lib/$(basename $f)
+          done
+        '';
+      in
+      {
+        "11-linux-amd64" = ''
+          ${copyClibrariesToOut "$out/lib/svm/clibraries"}
+
+          ${copyClibrariesToLib}
+        '';
+        "17-linux-amd64" = ''
+          ${copyClibrariesToOut "$out/lib/svm/clibraries"}
+
+          ${copyClibrariesToLib}
+        '';
+        "11-linux-aarch64" = ''
+          ${copyClibrariesToOut "$out/lib/svm/clibraries"}
+
+          ${copyClibrariesToLib}
+        '';
+        "17-linux-aarch64" = ''
+          ${copyClibrariesToOut "$out/lib/svm/clibraries"}
+
+          ${copyClibrariesToLib}
+        '';
+        "11-darwin-amd64" = "";
+        "17-darwin-amd64" = "";
+      }.${javaVersionPlatform} + ''
+        # ensure that $lib/lib exists to avoid breaking builds
         mkdir -p $lib/lib
-        for f in ${glibc}/lib/*; do
-          ln -s $f $lib/lib/$(basename $f)
-        done
-      '';
-    in {
-      "11-linux-amd64" = ''
-        ${copyClibrariesToOut "$out/lib/svm/clibraries"}
+        # jni.h expects jni_md.h to be in the header search path.
+        ln -s $out/include/linux/*_md.h $out/include/
 
-        ${copyClibrariesToLib}
+        # copy-paste openjdk's preFixup
+        # Set JAVA_HOME automatically.
+        mkdir -p $out/nix-support
+        cat <<EOF > $out/nix-support/setup-hook
+          if [ -z "\''${JAVA_HOME-}" ]; then export JAVA_HOME=$out; fi
+        EOF
       '';
-      "17-linux-amd64" = ''
-        ${copyClibrariesToOut "$out/lib/svm/clibraries"}
-
-        ${copyClibrariesToLib}
-      '';
-      "11-linux-aarch64" = ''
-        ${copyClibrariesToOut "$out/lib/svm/clibraries"}
-
-        ${copyClibrariesToLib}
-      '';
-      "17-linux-aarch64" = ''
-        ${copyClibrariesToOut "$out/lib/svm/clibraries"}
-
-        ${copyClibrariesToLib}
-      '';
-      "11-darwin-amd64" = "";
-      "17-darwin-amd64" = "";
-    }.${javaVersionPlatform} + ''
-      # ensure that $lib/lib exists to avoid breaking builds
-      mkdir -p $lib/lib
-      # jni.h expects jni_md.h to be in the header search path.
-      ln -s $out/include/linux/*_md.h $out/include/
-    '';
 
     dontStrip = true;
 
-    preFixup = ''
+    # Workaround for libssl.so.10 wanted by TruffleRuby
+    # Resulting TruffleRuby cannot use `openssl` library.
+    autoPatchelfIgnoreMissingDeps = stdenv.isDarwin;
+
+    preFixup = lib.optionalString (stdenv.isLinux) ''
       # We cannot use -exec since wrapProgram is a function but not a
       # command.
       #
@@ -165,19 +214,18 @@ let
       for bin in $( find "$out" -executable -type f -not -path '*/languages/ruby/lib/gems/*' -not -name jspawnhelper ); do
         if patchelf --print-interpreter "$bin" &> /dev/null || head -n 1 "$bin" | grep '^#!' -q; then
           wrapProgram "$bin" \
-            --prefix LD_LIBRARY_PATH : "${runtimeLibraryPath}"
+            --prefix LD_LIBRARY_PATH : "${runtimeLibraryPath}" \
+            --prefix PATH : "${runtimeDependencies}"
         fi
       done
 
-      # copy-paste openjdk's preFixup
-      # Set JAVA_HOME automatically.
-      mkdir -p $out/nix-support
-      cat <<EOF > $out/nix-support/setup-hook
-        if [ -z "\''${JAVA_HOME-}" ]; then export JAVA_HOME=$out; fi
-      EOF
-
       find "$out" -name libfontmanager.so -exec \
         patchelf --add-needed libfontconfig.so {} \;
+
+      # Workaround for libssl.so.10/libcrypto.so.10 wanted by TruffleRuby
+      patchelf $out/languages/ruby/lib/mri/openssl.so \
+        --replace-needed libssl.so.10 libssl.so \
+        --replace-needed libcrypto.so.10 libcrypto.so
     '';
 
     # $out/bin/native-image needs zlib to build native executables.
@@ -204,19 +252,26 @@ let
       # run on JVM with Graal Compiler
       $out/bin/java -XX:+UnlockExperimentalVMOptions -XX:+EnableJVMCI -XX:+UseJVMCICompiler HelloWorld | fgrep 'Hello World'
 
-      # Ahead-Of-Time compilation
-      $out/bin/native-image -H:-CheckToolchain -H:+ReportExceptionStackTraces --no-server HelloWorld
-      ./helloworld | fgrep 'Hello World'
+      ${# --static flag doesn't work for darwin
+        lib.optionalString (stdenv.isLinux && !useMusl) ''
+          echo "Ahead-Of-Time compilation"
+          $out/bin/native-image -H:-CheckToolchain -H:+ReportExceptionStackTraces --no-server HelloWorld
+          ./helloworld | fgrep 'Hello World'
 
-      ${
-        lib.optionalString stdenv.isLinux ''
-          # Ahead-Of-Time compilation with --static
-          # --static flag doesn't work for darwin
+          echo "Ahead-Of-Time compilation with --static"
           $out/bin/native-image --no-server --static HelloWorld
           ./helloworld | fgrep 'Hello World'
         ''
       }
 
+      ${# --static flag doesn't work for darwin
+        lib.optionalString (stdenv.isLinux && useMusl) ''
+          echo "Ahead-Of-Time compilation with --static and --libc=musl"
+          $out/bin/native-image --no-server --libc=musl --static HelloWorld
+          ./helloworld | fgrep 'Hello World'
+        ''
+      }
+
       ${# TODO: Doesn't work on MacOS, we have this error:
         # "Launching JShell execution engine threw: Operation not permitted (Bind failed)"
         lib.optionalString (stdenv.isLinux) ''
@@ -275,4 +330,5 @@ let
       ];
     };
   };
-in graalvmXXX-ce
+in
+graalvmXXX-ce
diff --git a/pkgs/development/interpreters/mujs/default.nix b/pkgs/development/interpreters/mujs/default.nix
index d4f61781c80e..062647416b15 100644
--- a/pkgs/development/interpreters/mujs/default.nix
+++ b/pkgs/development/interpreters/mujs/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "mujs";
-  version = "1.1.3";
+  version = "1.2.0";
 
   src = fetchurl {
     url = "https://mujs.com/downloads/mujs-${version}.tar.xz";
-    sha256 = "sha256-TSTpUJqea9I9fKFh0Kggvml+fmFD2aVx+tdUGyIcIKY=";
+    sha256 = "sha256-ZpdtHgajUnVKI0Kvc9Guy7U8x82uK2jNoBO33c+SMjM=";
   };
 
   buildInputs = [ readline ];
diff --git a/pkgs/development/libraries/freetds/default.nix b/pkgs/development/libraries/freetds/default.nix
index b79fb2fd06dc..ed455c534b2a 100644
--- a/pkgs/development/libraries/freetds/default.nix
+++ b/pkgs/development/libraries/freetds/default.nix
@@ -8,11 +8,11 @@ assert odbcSupport -> unixODBC != null;
 
 stdenv.mkDerivation rec {
   pname = "freetds";
-  version = "1.3";
+  version = "1.3.3";
 
   src = fetchurl {
     url    = "https://www.freetds.org/files/stable/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-j5ecrU2DUJBubDZF9wRxr0eNCHWe2TzToxQn8HkrX5c=";
+    sha256 = "sha256-26AufwZh/0LcKJ/EHXzefgMIn9Mm8I7ijIcqyf9KHIQ=";
   };
 
   buildInputs = [
diff --git a/pkgs/development/libraries/libcacard/default.nix b/pkgs/development/libraries/libcacard/default.nix
index c484a49b1a2b..3585daefbf58 100644
--- a/pkgs/development/libraries/libcacard/default.nix
+++ b/pkgs/development/libraries/libcacard/default.nix
@@ -2,13 +2,18 @@
 
 stdenv.mkDerivation rec {
   pname = "libcacard";
-  version = "2.7.0";
+  version = "2.8.1";
 
   src = fetchurl {
     url = "https://www.spice-space.org/download/libcacard/${pname}-${version}.tar.xz";
-    sha256 = "0vyvkk4b6xjwq1ccggql13c1x7g4y90clpkqw28257azgn2a1c8n";
+    sha256 = "sha256-+79N6Mt9tb3/XstnL/Db5pOfufNEuQDVG6YpUymjMuc=";
   };
 
+  postPatch = lib.optionalString stdenv.isDarwin ''
+    sed -i '/--version-script/d' Makefile.in
+    sed -i 's/^vflag = .*$/vflag = ""/' meson.build
+  '';
+
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ glib nss ];
 
diff --git a/pkgs/development/libraries/libfilezilla/default.nix b/pkgs/development/libraries/libfilezilla/default.nix
index c83a0f70b6b2..95e00cdd7329 100644
--- a/pkgs/development/libraries/libfilezilla/default.nix
+++ b/pkgs/development/libraries/libfilezilla/default.nix
@@ -11,11 +11,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libfilezilla";
-  version = "0.34.2";
+  version = "0.35.0";
 
   src = fetchurl {
     url = "https://download.filezilla-project.org/${pname}/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-IKKLd+whs4CtAgLbAWbtHHycItRQSN1oBtXsn+J/7Uo=";
+    sha256 = "sha256-7uJRDc49BpHqc9wdoQ+sfbEhWwup7vphbfMFNosJKug=";
   };
 
   nativeBuildInputs = [ autoreconfHook pkg-config ];
diff --git a/pkgs/development/libraries/liblouis/default.nix b/pkgs/development/libraries/liblouis/default.nix
index dba0b3956616..f61fb775fbda 100644
--- a/pkgs/development/libraries/liblouis/default.nix
+++ b/pkgs/development/libraries/liblouis/default.nix
@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation rec {
   pname = "liblouis";
-  version = "3.19.0";
+  version = "3.20.0";
 
   src = fetchFromGitHub {
     owner = "liblouis";
     repo = "liblouis";
     rev = "v${version}";
-    sha256 = "sha256-vuD+afTOzldhfCRG5ghnWulNhip7BaTE7GfPhxXSMFw=";
+    sha256 = "sha256-DuMVs9cC0VnZg3E9GtZB8LYkp3Ybfzlv8vd4d1Muwyc=";
   };
 
   outputs = [ "out" "dev" "man" "info" "doc" ];
diff --git a/pkgs/development/libraries/pipewire/0.2.nix b/pkgs/development/libraries/pipewire/0.2.nix
index 276ad6b8c492..d21ceafbcf9d 100644
--- a/pkgs/development/libraries/pipewire/0.2.nix
+++ b/pkgs/development/libraries/pipewire/0.2.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, meson, ninja, pkg-config, doxygen, graphviz, valgrind
+{ lib, stdenv, fetchFromGitHub, meson, ninja, pkg-config, doxygen, graphviz
 , glib, dbus, gst_all_1, alsa-lib, ffmpeg_4, libjack2, udev, libva, xorg
 , sbc, SDL2, makeFontsConf
 }:
@@ -21,7 +21,7 @@ in stdenv.mkDerivation rec {
   outputs = [ "out" "lib" "dev" "doc" ];
 
   nativeBuildInputs = [
-    meson ninja pkg-config doxygen graphviz valgrind
+    meson ninja pkg-config doxygen graphviz
   ];
   buildInputs = [
     glib dbus gst_all_1.gst-plugins-base gst_all_1.gstreamer
diff --git a/pkgs/development/python-modules/aioftp/default.nix b/pkgs/development/python-modules/aioftp/default.nix
index 76335c7af2d3..e9988249e270 100644
--- a/pkgs/development/python-modules/aioftp/default.nix
+++ b/pkgs/development/python-modules/aioftp/default.nix
@@ -1,43 +1,47 @@
 { lib
+, async-timeout
 , buildPythonPackage
 , fetchPypi
-, isPy27
-, pytest
 , pytest-asyncio
 , pytest-cov
+, pytestCheckHook
+, pythonOlder
+, siosocks
 , trustme
-, async-timeout
 }:
 
 buildPythonPackage rec {
   pname = "aioftp";
-  version = "0.19.0";
-  disabled = isPy27;
+  version = "0.20.0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "d1c2571764c48e6de1b02952022c3c3b3da1f10806cb342ec7b1fa9b109e9902";
+    sha256 = "sha256-N8qiKsWPaFT/t5p1eSHS0BydoXv4AL6y8gP4z4P9fsE=";
   };
 
-  checkInputs = [
-    pytest
-    pytest-asyncio
-    pytest-cov
-    trustme
-    async-timeout
+  propagatedBuildInputs = [
+    siosocks
   ];
 
-  doCheck = false; # requires siosocks, not packaged yet
-  checkPhase = ''
-    pytest
-  '';
+  checkInputs = [
+    async-timeout
+    pytest-asyncio
+    pytest-cov
+    pytestCheckHook
+    trustme
+  ];
 
-  pythonImportsCheck = [ "aioftp" ];
+  pythonImportsCheck = [
+    "aioftp"
+  ];
 
   meta = with lib; {
-    description = "Ftp client/server for asyncio";
+    description = "Python FTP client/server for asyncio";
     homepage = "https://github.com/aio-libs/aioftp";
     license = licenses.asl20;
-    maintainers = [ maintainers.costrouc ];
+    maintainers = with maintainers; [ costrouc ];
   };
 }
diff --git a/pkgs/development/python-modules/deepmerge/default.nix b/pkgs/development/python-modules/deepmerge/default.nix
index da4b72d2ff49..148599fe1666 100644
--- a/pkgs/development/python-modules/deepmerge/default.nix
+++ b/pkgs/development/python-modules/deepmerge/default.nix
@@ -9,17 +9,17 @@
 
 buildPythonPackage rec {
   pname = "deepmerge";
-  version = "0.3.0";
+  version = "1.0.1";
   disabled = isPy27;
+  format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1zfl8rkw98vj7jdpb29ably50x46pq6pazhrkrczndf5jc97zzgn";
+    sha256 = "sha256-S0R3ntPS+3kbsYH8JoNCNJb+pCirt683/rIyht5/Cho=";
   };
 
   nativeBuildInputs = [
     setuptools-scm
-    vcver
   ];
 
   checkInputs = [
diff --git a/pkgs/development/python-modules/jax/cache-fix.patch b/pkgs/development/python-modules/jax/cache-fix.patch
new file mode 100644
index 000000000000..5db5319485f8
--- /dev/null
+++ b/pkgs/development/python-modules/jax/cache-fix.patch
@@ -0,0 +1,12 @@
+diff --git a/jax/experimental/compilation_cache/file_system_cache.py b/jax/experimental/compilation_cache/file_system_cache.py
+index b85969de..92acd523 100644
+--- a/jax/experimental/compilation_cache/file_system_cache.py
++++ b/jax/experimental/compilation_cache/file_system_cache.py
+@@ -33,6 +33,7 @@ class FileSystemCache(CacheInterface):
+     path_to_key = os.path.join(self._path, key)
+     if os.path.exists(path_to_key):
+       with open(path_to_key, "rb") as file:
++        os.utime(file.fileno())
+         return file.read()
+     else:
+       return None
diff --git a/pkgs/development/python-modules/jax/default.nix b/pkgs/development/python-modules/jax/default.nix
index dd9680abcc0d..574341f216ab 100644
--- a/pkgs/development/python-modules/jax/default.nix
+++ b/pkgs/development/python-modules/jax/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "jax";
-  version = "0.2.25";
+  version = "0.2.26";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -21,10 +21,15 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "google";
     repo = pname;
-    rev = "jax-v${version}";
-    sha256 = "0f32is9896g4shfhjipj3rlgpjxci5y607lp8gxlgsdzdqfpckm2";
+    rev = "${pname}-v${version}";
+    sha256 = "155hhwgq6axdrj4x4hw72322qv1wc068n4cv4z2vf5jpl05fg93g";
   };
 
+  patches = [
+    # See https://github.com/google/jax/issues/7944
+    ./cache-fix.patch
+  ];
+
   # jaxlib is _not_ included in propagatedBuildInputs because there are
   # different versions of jaxlib depending on the desired target hardware. The
   # JAX project ships separate wheels for CPU, GPU, and TPU. Currently only the
diff --git a/pkgs/development/python-modules/jaxlib/bin.nix b/pkgs/development/python-modules/jaxlib/bin.nix
new file mode 100644
index 000000000000..f597eeacfced
--- /dev/null
+++ b/pkgs/development/python-modules/jaxlib/bin.nix
@@ -0,0 +1,90 @@
+# For the moment we only support the CPU and GPU backends of jaxlib. The TPU
+# backend will require some additional work. Those wheels are located here:
+# https://storage.googleapis.com/jax-releases/libtpu_releases.html.
+
+# For future reference, the easiest way to test the GPU backend is to run
+#   NIX_PATH=.. nix-shell -p python3 python3Packages.jax "python3Packages.jaxlib.override { cudaSupport = true; }"
+#   export XLA_FLAGS=--xla_gpu_force_compilation_parallelism=1
+#   python -c "from jax.lib import xla_bridge; assert xla_bridge.get_backend().platform == 'gpu'"
+#   python -c "from jax import random; random.PRNGKey(0)"
+#   python -c "from jax import random; x = random.normal(random.PRNGKey(0), (100, 100)); x @ x"
+# There's no convenient way to test the GPU backend in the derivation since the
+# nix build environment blocks access to the GPU. See also:
+#   * https://github.com/google/jax/issues/971#issuecomment-508216439
+#   * https://github.com/google/jax/issues/5723#issuecomment-913038780
+
+{ addOpenGLRunpath, autoPatchelfHook, buildPythonPackage, config
+, fetchurl, isPy39, lib, stdenv
+# propagatedBuildInputs
+, absl-py, flatbuffers, scipy, cudatoolkit_11
+# Options:
+, cudaSupport ? config.cudaSupport or false
+}:
+
+assert cudaSupport -> lib.versionAtLeast cudatoolkit_11.version "11.1";
+
+let
+  device = if cudaSupport then "gpu" else "cpu";
+in
+buildPythonPackage rec {
+  pname = "jaxlib";
+  version = "0.1.71";
+  format = "wheel";
+
+  # At the time of writing (8/19/21), there are releases for 3.7-3.9. Supporting
+  # all of them is a pain, so we focus on 3.9, the current nixpkgs python3
+  # version.
+  disabled = !isPy39;
+
+  src = {
+    cpu = fetchurl {
+      url = "https://storage.googleapis.com/jax-releases/nocuda/jaxlib-${version}-cp39-none-manylinux2010_x86_64.whl";
+      sha256 = "sha256:0rqhs6qabydizlv5d3rb20dbv6612rr7dqfniy9r6h4kazdinsn6";
+    };
+    gpu = fetchurl {
+      url = "https://storage.googleapis.com/jax-releases/cuda111/jaxlib-${version}+cuda111-cp39-none-manylinux2010_x86_64.whl";
+      sha256 = "sha256:065kyzjsk9m84d138p99iymdiiicm1qz8a3iwxz8rspl43rwrw89";
+    };
+  }.${device};
+
+  # Prebuilt wheels are dynamically linked against things that nix can't find.
+  # Run `autoPatchelfHook` to automagically fix them.
+  nativeBuildInputs = [ autoPatchelfHook ] ++ lib.optional cudaSupport addOpenGLRunpath;
+  # Dynamic link dependencies
+  buildInputs = [ stdenv.cc.cc ];
+
+  # jaxlib contains shared libraries that open other shared libraries via dlopen
+  # and these implicit dependencies are not recognized by ldd or
+  # autoPatchelfHook. That means we need to sneak them into rpath. This step
+  # must be done after autoPatchelfHook and the automatic stripping of
+  # artifacts. autoPatchelfHook runs in postFixup and auto-stripping runs in the
+  # patchPhase. Dependencies:
+  #   * libcudart.so.11.0 -> cudatoolkit_11.lib
+  #   * libcublas.so.11   -> cudatoolkit_11
+  #   * libcuda.so.1      -> opengl driver in /run/opengl-driver/lib
+  preInstallCheck = lib.optional cudaSupport ''
+    shopt -s globstar
+
+    addOpenGLRunpath $out/**/*.so
+
+    for file in $out/**/*.so; do
+      rpath=$(patchelf --print-rpath $file)
+      # For some reason `makeLibraryPath` on `cudatoolkit_11` maps to
+      # <cudatoolkit_11.lib>/lib which is different from <cudatoolkit_11>/lib.
+      patchelf --set-rpath "$rpath:${cudatoolkit_11}/lib:${lib.makeLibraryPath [ cudatoolkit_11.lib ]}" $file
+    done
+  '';
+
+  # pip dependencies and optionally cudatoolkit.
+  propagatedBuildInputs = [ absl-py flatbuffers scipy ] ++ lib.optional cudaSupport cudatoolkit_11;
+
+  pythonImportsCheck = [ "jaxlib" ];
+
+  meta = with lib; {
+    description = "XLA library for JAX";
+    homepage    = "https://github.com/google/jax";
+    license     = licenses.asl20;
+    maintainers = with maintainers; [ samuela ];
+    platforms = [ "x86_64-linux" ];
+  };
+}
diff --git a/pkgs/development/python-modules/jaxlib/default.nix b/pkgs/development/python-modules/jaxlib/default.nix
index f597eeacfced..bfb7f494ce1a 100644
--- a/pkgs/development/python-modules/jaxlib/default.nix
+++ b/pkgs/development/python-modules/jaxlib/default.nix
@@ -1,90 +1,285 @@
-# For the moment we only support the CPU and GPU backends of jaxlib. The TPU
-# backend will require some additional work. Those wheels are located here:
-# https://storage.googleapis.com/jax-releases/libtpu_releases.html.
+{ lib
+, pkgs
+, stdenv
 
-# For future reference, the easiest way to test the GPU backend is to run
-#   NIX_PATH=.. nix-shell -p python3 python3Packages.jax "python3Packages.jaxlib.override { cudaSupport = true; }"
-#   export XLA_FLAGS=--xla_gpu_force_compilation_parallelism=1
-#   python -c "from jax.lib import xla_bridge; assert xla_bridge.get_backend().platform == 'gpu'"
-#   python -c "from jax import random; random.PRNGKey(0)"
-#   python -c "from jax import random; x = random.normal(random.PRNGKey(0), (100, 100)); x @ x"
-# There's no convenient way to test the GPU backend in the derivation since the
-# nix build environment blocks access to the GPU. See also:
-#   * https://github.com/google/jax/issues/971#issuecomment-508216439
-#   * https://github.com/google/jax/issues/5723#issuecomment-913038780
+  # Build-time dependencies:
+, addOpenGLRunpath
+, bazel_4
+, binutils
+, buildBazelPackage
+, buildPythonPackage
+, cython
+, fetchFromGitHub
+, git
+, jsoncpp
+, pybind11
+, setuptools
+, symlinkJoin
+, wheel
+, which
 
-{ addOpenGLRunpath, autoPatchelfHook, buildPythonPackage, config
-, fetchurl, isPy39, lib, stdenv
-# propagatedBuildInputs
-, absl-py, flatbuffers, scipy, cudatoolkit_11
-# Options:
-, cudaSupport ? config.cudaSupport or false
+  # Build-time and runtime CUDA dependencies:
+, cudatoolkit ? null
+, cudnn ? null
+, nccl ? null
+
+  # Python dependencies:
+, absl-py
+, flatbuffers
+, numpy
+, scipy
+, six
+
+  # Runtime dependencies:
+, double-conversion
+, giflib
+, grpc
+, libjpeg_turbo
+, python
+, snappy
+, zlib
+
+  # CUDA flags:
+, cudaCapabilities ? [ "sm_35" "sm_50" "sm_60" "sm_70" "sm_75" "compute_80" ]
+, cudaSupport ? false
+
+  # MKL:
+, mklSupport ? true
 }:
 
-assert cudaSupport -> lib.versionAtLeast cudatoolkit_11.version "11.1";
-
 let
-  device = if cudaSupport then "gpu" else "cpu";
-in
-buildPythonPackage rec {
+
   pname = "jaxlib";
-  version = "0.1.71";
+  version = "0.1.75";
+
+  meta = with lib; {
+    description = "JAX is Autograd and XLA, brought together for high-performance machine learning research.";
+    homepage = "https://github.com/google/jax";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ ndl ];
+  };
+
+  cudatoolkit_joined = symlinkJoin {
+    name = "${cudatoolkit.name}-merged";
+    paths = [
+      cudatoolkit.lib
+      cudatoolkit.out
+    ] ++ lib.optionals (lib.versionOlder cudatoolkit.version "11") [
+      # for some reason some of the required libs are in the targets/x86_64-linux
+      # directory; not sure why but this works around it
+      "${cudatoolkit}/targets/${stdenv.system}"
+    ];
+  };
+
+  cudatoolkit_cc_joined = symlinkJoin {
+    name = "${cudatoolkit.cc.name}-merged";
+    paths = [
+      cudatoolkit.cc
+      binutils.bintools # for ar, dwp, nm, objcopy, objdump, strip
+    ];
+  };
+
+  bazel-build = buildBazelPackage {
+    name = "bazel-build-${pname}-${version}";
+
+    bazel = bazel_4;
+
+    src = fetchFromGitHub {
+      owner = "google";
+      repo = "jax";
+      rev = "${pname}-v${version}";
+      sha256 = "01ks4djbpjsxjy2zwdwv3h00sgwi4ps3jz75swddrw2f56zjdmw4";
+    };
+
+    nativeBuildInputs = [
+      cython
+      pkgs.flatbuffers
+      git
+      setuptools
+      wheel
+      which
+    ];
+
+    buildInputs = [
+      double-conversion
+      giflib
+      grpc
+      jsoncpp
+      libjpeg_turbo
+      numpy
+      pkgs.flatbuffers
+      pkgs.protobuf
+      pybind11
+      scipy
+      six
+      snappy
+      zlib
+    ] ++ lib.optionals cudaSupport [
+      cudatoolkit
+      cudnn
+    ];
+
+    postPatch = ''
+      rm -f .bazelversion
+    '';
+
+    bazelTarget = "//build:build_wheel";
+
+    removeRulesCC = false;
+
+    GCC_HOST_COMPILER_PREFIX = lib.optionalString cudaSupport "${cudatoolkit_cc_joined}/bin";
+    GCC_HOST_COMPILER_PATH = lib.optionalString cudaSupport "${cudatoolkit_cc_joined}/bin/gcc";
+
+    preConfigure = ''
+      # dummy ldconfig
+      mkdir dummy-ldconfig
+      echo "#!${stdenv.shell}" > dummy-ldconfig/ldconfig
+      chmod +x dummy-ldconfig/ldconfig
+      export PATH="$PWD/dummy-ldconfig:$PATH"
+      cat <<CFG > ./.jax_configure.bazelrc
+      build --strategy=Genrule=standalone
+      build --repo_env PYTHON_BIN_PATH="${python}/bin/python"
+      build --action_env=PYENV_ROOT
+      build --python_path="${python}/bin/python"
+      build --distinct_host_configuration=false
+    '' + lib.optionalString cudaSupport ''
+      build --action_env CUDA_TOOLKIT_PATH="${cudatoolkit_joined}"
+      build --action_env CUDNN_INSTALL_PATH="${cudnn}"
+      build --action_env TF_CUDA_PATHS="${cudatoolkit_joined},${cudnn},${nccl}"
+      build --action_env TF_CUDA_VERSION="${lib.versions.majorMinor cudatoolkit.version}"
+      build --action_env TF_CUDNN_VERSION="${lib.versions.major cudnn.version}"
+      build:cuda --action_env TF_CUDA_COMPUTE_CAPABILITIES="${lib.concatStringsSep "," cudaCapabilities}"
+    '' + ''
+      CFG
+    '';
+
+    # Copy-paste from TF derivation.
+    # Most of these are not really used in jaxlib compilation but it's simpler to keep it
+    # 'as is' so that it's more compatible with TF derivation.
+    TF_SYSTEM_LIBS = lib.concatStringsSep "," [
+      "absl_py"
+      "astor_archive"
+      "astunparse_archive"
+      "boringssl"
+      # Not packaged in nixpkgs
+      # "com_github_googleapis_googleapis"
+      # "com_github_googlecloudplatform_google_cloud_cpp"
+      "com_github_grpc_grpc"
+      "com_google_protobuf"
+      # Fails with the error: external/org_tensorflow/tensorflow/core/profiler/utils/tf_op_utils.cc:46:49: error: no matching function for call to 're2::RE2::FullMatch(absl::lts_2020_02_25::string_view&, re2::RE2&)'
+      # "com_googlesource_code_re2"
+      "curl"
+      "cython"
+      "dill_archive"
+      "double_conversion"
+      "enum34_archive"
+      "flatbuffers"
+      "functools32_archive"
+      "gast_archive"
+      "gif"
+      "hwloc"
+      "icu"
+      "jsoncpp_git"
+      "libjpeg_turbo"
+      "lmdb"
+      "nasm"
+      # "nsync" # not packaged in nixpkgs
+      "opt_einsum_archive"
+      "org_sqlite"
+      "pasta"
+      "pcre"
+      "png"
+      "pybind11"
+      "six_archive"
+      "snappy"
+      "tblib_archive"
+      "termcolor_archive"
+      "typing_extensions_archive"
+      "wrapt"
+      "zlib"
+    ];
+
+    # Make sure Bazel knows about our configuration flags during fetching so that the
+    # relevant dependencies can be downloaded.
+    bazelFetchFlags = bazel-build.bazelBuildFlags;
+
+    bazelBuildFlags = [
+      "-c opt"
+    ] ++ lib.optional (stdenv.targetPlatform.isx86_64 && stdenv.targetPlatform.isUnix) [
+      "--config=avx_posix"
+    ] ++ lib.optional cudaSupport [
+      "--config=cuda"
+    ] ++ lib.optional mklSupport [
+      "--config=mkl_open_source_only"
+    ];
+
+    fetchAttrs = {
+      sha256 =
+        if cudaSupport then
+          "1lyipbflqd1y5cdj4hdml5h1inbr0wwfgp6xw5p5623qv3im16lh"
+        else
+          "09kapzpfwnlr6ghmgwac232bqf2a57mm1brz4cvfx8mlg8bbaw63";
+    };
+
+    buildAttrs = {
+      outputs = [ "out" ];
+
+      # Note: we cannot do most of this patching at `patch` phase as the deps are not available yet.
+      # 1) Fix pybind11 include paths.
+      # 2) Force static protobuf linkage to prevent crashes on loading multiple extensions
+      #    in the same python program due to duplicate protobuf DBs.
+      # 3) Patch python path in the compiler driver.
+      preBuild = ''
+        for src in ./jaxlib/*.{cc,h}; do
+          sed -i 's@include/pybind11@pybind11@g' $src
+        done
+        sed -i 's@-lprotobuf@-l:libprotobuf.a@' ../output/external/org_tensorflow/third_party/systemlibs/protobuf.BUILD
+        sed -i 's@-lprotoc@-l:libprotoc.a@' ../output/external/org_tensorflow/third_party/systemlibs/protobuf.BUILD
+      '' + lib.optionalString cudaSupport ''
+        patchShebangs ../output/external/org_tensorflow/third_party/gpus/crosstool/clang/bin/crosstool_wrapper_driver_is_not_gcc.tpl
+      '';
+
+      installPhase = ''
+        ./bazel-bin/build/build_wheel --output_path=$out --cpu=${stdenv.targetPlatform.linuxArch}
+      '';
+    };
+
+    inherit meta;
+  };
+
+in
+buildPythonPackage {
+  inherit meta pname version;
   format = "wheel";
 
-  # At the time of writing (8/19/21), there are releases for 3.7-3.9. Supporting
-  # all of them is a pain, so we focus on 3.9, the current nixpkgs python3
-  # version.
-  disabled = !isPy39;
+  src = "${bazel-build}/jaxlib-${version}-cp${builtins.replaceStrings ["."] [""] python.pythonVersion}-none-manylinux2010_${stdenv.targetPlatform.linuxArch}.whl";
 
-  src = {
-    cpu = fetchurl {
-      url = "https://storage.googleapis.com/jax-releases/nocuda/jaxlib-${version}-cp39-none-manylinux2010_x86_64.whl";
-      sha256 = "sha256:0rqhs6qabydizlv5d3rb20dbv6612rr7dqfniy9r6h4kazdinsn6";
-    };
-    gpu = fetchurl {
-      url = "https://storage.googleapis.com/jax-releases/cuda111/jaxlib-${version}+cuda111-cp39-none-manylinux2010_x86_64.whl";
-      sha256 = "sha256:065kyzjsk9m84d138p99iymdiiicm1qz8a3iwxz8rspl43rwrw89";
-    };
-  }.${device};
-
-  # Prebuilt wheels are dynamically linked against things that nix can't find.
-  # Run `autoPatchelfHook` to automagically fix them.
-  nativeBuildInputs = [ autoPatchelfHook ] ++ lib.optional cudaSupport addOpenGLRunpath;
-  # Dynamic link dependencies
-  buildInputs = [ stdenv.cc.cc ];
-
-  # jaxlib contains shared libraries that open other shared libraries via dlopen
-  # and these implicit dependencies are not recognized by ldd or
-  # autoPatchelfHook. That means we need to sneak them into rpath. This step
-  # must be done after autoPatchelfHook and the automatic stripping of
-  # artifacts. autoPatchelfHook runs in postFixup and auto-stripping runs in the
-  # patchPhase. Dependencies:
-  #   * libcudart.so.11.0 -> cudatoolkit_11.lib
-  #   * libcublas.so.11   -> cudatoolkit_11
-  #   * libcuda.so.1      -> opengl driver in /run/opengl-driver/lib
-  preInstallCheck = lib.optional cudaSupport ''
-    shopt -s globstar
-
-    addOpenGLRunpath $out/**/*.so
-
-    for file in $out/**/*.so; do
-      rpath=$(patchelf --print-rpath $file)
-      # For some reason `makeLibraryPath` on `cudatoolkit_11` maps to
-      # <cudatoolkit_11.lib>/lib which is different from <cudatoolkit_11>/lib.
-      patchelf --set-rpath "$rpath:${cudatoolkit_11}/lib:${lib.makeLibraryPath [ cudatoolkit_11.lib ]}" $file
+  postInstall = lib.optionalString cudaSupport ''
+    find $out -type f \( -name '*.so' -or -name '*.so.*' \) | while read lib; do
+      addOpenGLRunpath "$lib"
+      patchelf --set-rpath "${cudatoolkit}/lib:${cudatoolkit.lib}/lib:${cudnn}/lib:${nccl}/lib:$(patchelf --print-rpath "$lib")" "$lib"
     done
   '';
 
-  # pip dependencies and optionally cudatoolkit.
-  propagatedBuildInputs = [ absl-py flatbuffers scipy ] ++ lib.optional cudaSupport cudatoolkit_11;
+  nativeBuildInputs = lib.optional cudaSupport addOpenGLRunpath;
+
+  propagatedBuildInputs = [
+    absl-py
+    double-conversion
+    flatbuffers
+    giflib
+    grpc
+    jsoncpp
+    libjpeg_turbo
+    numpy
+    scipy
+    six
+    snappy
+  ];
 
   pythonImportsCheck = [ "jaxlib" ];
 
-  meta = with lib; {
-    description = "XLA library for JAX";
-    homepage    = "https://github.com/google/jax";
-    license     = licenses.asl20;
-    maintainers = with maintainers; [ samuela ];
-    platforms = [ "x86_64-linux" ];
-  };
+  # Without it there are complaints about libcudart.so.11.0 not being found
+  # because RPATH path entries added above are stripped.
+  dontPatchELF = cudaSupport;
 }
diff --git a/pkgs/development/python-modules/livelossplot/default.nix b/pkgs/development/python-modules/livelossplot/default.nix
index 2951ab7a427b..467d239857af 100644
--- a/pkgs/development/python-modules/livelossplot/default.nix
+++ b/pkgs/development/python-modules/livelossplot/default.nix
@@ -1,8 +1,8 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
-, isPy27
-, pytest
+, pythonOlder
+, pytestCheckHook
 , bokeh
 , ipython
 , matplotlib
@@ -13,23 +13,23 @@
 
 buildPythonPackage rec {
   pname = "livelossplot";
-  version = "0.5.0";
+  version = "0.5.4";
 
-  disabled = isPy27;
+  disabled = pythonOlder "3.6";
+
+  # version number in source is wrong in this release
+  postPatch = ''substituteInPlace ${pname}/version.py --replace "0.5.3" "0.5.4"'';
 
   src = fetchFromGitHub {
     owner  = "stared";
     repo   = pname;
     rev    = "v${version}";
-    sha256 = "164v65qglgyg38q9ajnas99rp14mvrk5hn8x76b8iy81vszmx1c0";
+    sha256 = "IV6YAidoqVoKvpy+LNNHTPpobiDoGX59bHqJcBtaydk=";
   };
 
   propagatedBuildInputs = [ bokeh ipython matplotlib numpy ];
 
-  checkInputs = [ pytest nbconvert nbformat ];
-  checkPhase = ''
-    pytest tests tests/external_test_examples.py
-  '';
+  checkInputs = [ nbconvert nbformat pytestCheckHook ];
 
   meta = with lib; {
     description = "Live training loss plot in Jupyter for Keras, PyTorch, and others";
diff --git a/pkgs/development/python-modules/mcstatus/default.nix b/pkgs/development/python-modules/mcstatus/default.nix
index 45e0c2d00aa6..f5c6c276867f 100644
--- a/pkgs/development/python-modules/mcstatus/default.nix
+++ b/pkgs/development/python-modules/mcstatus/default.nix
@@ -5,6 +5,7 @@
 , dnspython
 , fetchFromGitHub
 , mock
+, poetry-core
 , pytest-asyncio
 , pytestCheckHook
 , pythonOlder
@@ -13,16 +14,22 @@
 
 buildPythonPackage rec {
   pname = "mcstatus";
-  version = "6.5.0";
+  version = "7.0.0";
+  format = "pyproject";
+
   disabled = pythonOlder "3.6";
 
   src = fetchFromGitHub {
     owner = "Dinnerbone";
     repo = pname;
     rev = "v${version}";
-    sha256 = "00xi3452lap4zx38msx89vvhrzkzb2dvwis1fcmx24qngj9g3yfr";
+    sha256 = "sha256-/EoVM3wEiA2suJHxMu2zZktQhO6T9grWcvWuzmUe6V0=";
   };
 
+  nativeBuildInputs = [
+    poetry-core
+  ];
+
   propagatedBuildInputs = [
     asyncio-dgram
     click
@@ -36,7 +43,16 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
-  pythonImportsCheck = [ "mcstatus" ];
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace 'asyncio-dgram = "1.2.0"' 'asyncio-dgram = ">=1.2.0"' \
+      --replace 'six = "1.14.0"' 'six = ">=1.14.0"' \
+      --replace 'click = "7.1.2"' 'click = ">=7.1.2"'
+  '';
+
+  pythonImportsCheck = [
+    "mcstatus"
+  ];
 
   meta = with lib; {
     description = "Python library for checking the status of Minecraft servers";
diff --git a/pkgs/development/python-modules/pycarwings2/default.nix b/pkgs/development/python-modules/pycarwings2/default.nix
index c4f23f74d614..e404475e93ba 100644
--- a/pkgs/development/python-modules/pycarwings2/default.nix
+++ b/pkgs/development/python-modules/pycarwings2/default.nix
@@ -19,7 +19,6 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "filcole";
     repo = pname;
-    # release not tagged: https://github.com/filcole/pycarwings2/issues/33
     rev = "v${version}";
     sha256 = "04k1la7wix6sp668nqpwdhd3057b2bzcz7h2b9a57cxlifl8pjxf";
   };
diff --git a/pkgs/development/python-modules/siosocks/default.nix b/pkgs/development/python-modules/siosocks/default.nix
new file mode 100644
index 000000000000..2a4803ef8bd2
--- /dev/null
+++ b/pkgs/development/python-modules/siosocks/default.nix
@@ -0,0 +1,43 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, pytest-asyncio
+, pytest-trio
+, pytestCheckHook
+, pythonOlder
+, trio
+}:
+
+buildPythonPackage rec {
+  pname = "siosocks";
+  version = "0.2.0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.6";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "sha256-k2+qTtxkF0rT5LLPW8icePbf9jNopdo9uDp3NPA9SRo=";
+  };
+
+  propagatedBuildInputs = [
+    trio
+  ];
+
+  checkInputs = [
+    pytest-asyncio
+    pytestCheckHook
+    pytest-trio
+  ];
+
+  pythonImportsCheck = [
+    "siosocks"
+  ];
+
+  meta = with lib; {
+    description = "Python socks 4/5 client/server library/framework";
+    homepage = "https://github.com/pohmelie/siosocks";
+    license = licenses.mit;
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/development/tools/analysis/checkov/default.nix b/pkgs/development/tools/analysis/checkov/default.nix
index 3fe047a124cd..932ac92d8b92 100644
--- a/pkgs/development/tools/analysis/checkov/default.nix
+++ b/pkgs/development/tools/analysis/checkov/default.nix
@@ -46,13 +46,13 @@ with py.pkgs;
 
 buildPythonApplication rec {
   pname = "checkov";
-  version = "2.0.692";
+  version = "2.0.693";
 
   src = fetchFromGitHub {
     owner = "bridgecrewio";
     repo = pname;
     rev = version;
-    sha256 = "sha256-mzqSnddcZAVwgm8SJSkgcU8bYvEy2Rw+5vDl1uPTjbA=";
+    sha256 = "sha256-xteBVQ+OXxLc2BOlhajGX+1wTc7BHGjPtpgU3IjA7g0=";
   };
 
   nativeBuildInputs = with py.pkgs; [
diff --git a/pkgs/development/tools/poetry2nix/poetry2nix/default.nix b/pkgs/development/tools/poetry2nix/poetry2nix/default.nix
index 9c580a47e102..07e0063d6c5b 100644
--- a/pkgs/development/tools/poetry2nix/poetry2nix/default.nix
+++ b/pkgs/development/tools/poetry2nix/poetry2nix/default.nix
@@ -5,7 +5,7 @@
 }:
 let
   # Poetry2nix version
-  version = "1.23.0";
+  version = "1.24.1";
 
   inherit (poetryLib) isCompatible readTOML moduleName;
 
@@ -261,6 +261,7 @@ lib.makeScope pkgs.newScope (self: {
     , python ? pkgs.python3
     , preferWheels ? false
     , editablePackageSources ? { }
+    , extraPackages ? ps: [ ]
     }:
     let
       poetryPython = self.mkPoetryPackages {
@@ -270,7 +271,7 @@ lib.makeScope pkgs.newScope (self: {
       inherit (poetryPython) poetryPackages;
 
     in
-    poetryPython.python.withPackages (_: poetryPackages);
+    poetryPython.python.withPackages (ps: poetryPackages ++ (extraPackages ps));
 
   /* Creates a Python application from pyproject.toml and poetry.lock
 
diff --git a/pkgs/development/tools/poetry2nix/poetry2nix/overrides.nix b/pkgs/development/tools/poetry2nix/poetry2nix/overrides.nix
index a97475c6ca9d..6039e50d04eb 100644
--- a/pkgs/development/tools/poetry2nix/poetry2nix/overrides.nix
+++ b/pkgs/development/tools/poetry2nix/poetry2nix/overrides.nix
@@ -202,14 +202,14 @@ self: super:
       buildInputs = (old.buildInputs or [ ]) ++ [ pkgs.openssl ];
     } // lib.optionalAttrs (lib.versionAtLeast old.version "3.4" && lib.versionOlder old.version "3.5") {
       CRYPTOGRAPHY_DONT_BUILD_RUST = "1";
-    } // lib.optionalAttrs (lib.versionAtLeast old.version "3.5") rec {
+    } // lib.optionalAttrs (lib.versionAtLeast old.version "35") rec {
       cargoDeps =
         let
           getCargoHash = version:
-            if lib.versionOlder version "3.6.0" then "sha256-tQoQfo+TAoqAea86YFxyj/LNQCiViu5ij/3wj7ZnYLI="
-            else if lib.versionOlder version "3.6.1" then "sha256-Y6TuW7AryVgSvZ6G8WNoDIvi+0tvx8ZlEYF5qB0jfNk="
+            if lib.versionOlder version "36.0.0" then "sha256-tQoQfo+TAoqAea86YFxyj/LNQCiViu5ij/3wj7ZnYLI="
+            else if lib.versionOlder version "36.0.1" then "sha256-Y6TuW7AryVgSvZ6G8WNoDIvi+0tvx8ZlEYF5qB0jfNk="
             # This hash could no longer be valid for cryptography versions
-            # different from 3.6.1
+            # different from 36.0.1
             else "sha256-kozYXkqt1Wpqyo9GYCwN08J+zV92ZWFJY/f+rulxmeQ=";
         in
         pkgs.rustPlatform.fetchCargoTarball {
diff --git a/pkgs/development/tools/rust/cargo-msrv/default.nix b/pkgs/development/tools/rust/cargo-msrv/default.nix
index 33e9fca441fb..aec27c588a90 100644
--- a/pkgs/development/tools/rust/cargo-msrv/default.nix
+++ b/pkgs/development/tools/rust/cargo-msrv/default.nix
@@ -13,16 +13,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-msrv";
-  version = "0.12.0";
+  version = "0.13.0";
 
   src = fetchFromGitHub {
     owner = "foresterre";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-zc6jJqG7OGqfsPnb3VeKmEnz8AL2p1wHqgDvHQC5OX8=";
+    sha256 = "sha256-zIUbPmSlobSC3iJ0ddto40Sa/1xzCYG6eaTjMuUnXNU=";
   };
 
-  cargoSha256 = "sha256-SjgYkDDe11SVN6rRZTi/fYB8CgYhu2kfSXrIyimlhkk=";
+  cargoSha256 = "sha256-GKU0ootG4fXUGErPplERMVjEBop/0+sfQCYpQwPPcXA=";
 
   passthru = {
     updateScript = nix-update-script {
diff --git a/pkgs/os-specific/linux/kernel/linux-testing-bcachefs.nix b/pkgs/os-specific/linux/kernel/linux-testing-bcachefs.nix
index 37b03bc28ff9..e417ee6d389b 100644
--- a/pkgs/os-specific/linux/kernel/linux-testing-bcachefs.nix
+++ b/pkgs/os-specific/linux/kernel/linux-testing-bcachefs.nix
@@ -1,9 +1,9 @@
 { lib
 , fetchpatch
 , kernel
-, date ? "2021-11-06"
-, commit ? "10669a2c540de3276c8d2fc0e43be62f2886f377"
-, diffHash ? "1rn72wd8jg919j74x8banl70b2bdd6r9fgvnw693j20dq96j5cnw"
+, date ? "2021-12-26"
+, commit ? "b034dfb24fece43a7677b9a29781495aeb62767f"
+, diffHash ? "0m7qrnfrcx3dki9lmsq3jk3mcrfm99djh83gwwjh401ql0cycx5p"
 , kernelPatches # must always be defined in bcachefs' all-packages.nix entry because it's also a top-level attribute supplied by callPackage
 , argsOverride ? {}
 , ...
@@ -13,6 +13,7 @@
 (kernel.override ( args // {
   argsOverride = {
     version = "${kernel.version}-bcachefs-unstable-${date}";
+
     extraMeta = {
       branch = "master";
       maintainers = with lib.maintainers; [ davidak chiiruno ];
@@ -21,12 +22,13 @@
 
   kernelPatches = [ {
       name = "bcachefs-${commit}";
+
       patch = fetchpatch {
         name = "bcachefs-${commit}.diff";
         url = "https://evilpiepirate.org/git/bcachefs.git/rawdiff/?id=${commit}&id2=v${lib.versions.majorMinor kernel.version}";
         sha256 = diffHash;
       };
+
       extraConfig = "BCACHEFS_FS m";
     } ] ++ kernelPatches;
-
 }))
diff --git a/pkgs/tools/cd-dvd/cdrtools/default.nix b/pkgs/tools/cd-dvd/cdrtools/default.nix
index bca1a1c689c3..f49826b99bfa 100644
--- a/pkgs/tools/cd-dvd/cdrtools/default.nix
+++ b/pkgs/tools/cd-dvd/cdrtools/default.nix
@@ -16,6 +16,10 @@ stdenv.mkDerivation rec {
     sed "/\.mk3/d" -i libschily/Targets.man
     substituteInPlace man/Makefile --replace "man4" ""
     substituteInPlace RULES/rules.prg --replace "/bin/" ""
+  '' + lib.optionalString (stdenv.isDarwin && stdenv.isAarch64) ''
+    ln -sv i386-darwin-clang64.rul RULES/arm64-darwin-cc.rul
+    ln -sv i386-darwin-clang64.rul RULES/arm64-darwin-clang.rul
+    ln -sv i386-darwin-clang64.rul RULES/arm64-darwin-clang64.rul
   '';
 
   dontConfigure = true;
diff --git a/pkgs/tools/filesystems/bcachefs-tools/default.nix b/pkgs/tools/filesystems/bcachefs-tools/default.nix
index b8742075dd84..cb8d74aa1618 100644
--- a/pkgs/tools/filesystems/bcachefs-tools/default.nix
+++ b/pkgs/tools/filesystems/bcachefs-tools/default.nix
@@ -22,13 +22,13 @@
 
 stdenv.mkDerivation {
   pname = "bcachefs-tools";
-  version = "unstable-2021-11-06";
+  version = "unstable-2021-12-25";
 
   src = fetchFromGitHub {
     owner = "koverstreet";
     repo = "bcachefs-tools";
-    rev = "5b84952401146fec9a181a40877352f7faf9ee7b";
-    sha256 = "09zs2h3vzqn163v4i9lrvgy9gcjlw24lld7715j3kyyxnc5vav32";
+    rev = "07b18011cc885f0ef5cadc299d0321322f442388";
+    sha256 = "0yvdbjasl05w1afiszygrfv7hn39fxx7kcy42vk39rb6fb3xpvzy";
   };
 
   postPatch = ''
diff --git a/pkgs/tools/graphics/agi/default.nix b/pkgs/tools/graphics/agi/default.nix
index 7aaf28764d2b..f1fcf458e63d 100644
--- a/pkgs/tools/graphics/agi/default.nix
+++ b/pkgs/tools/graphics/agi/default.nix
@@ -14,11 +14,11 @@
 
 stdenv.mkDerivation rec {
   pname = "agi";
-  version = "2.1.0-dev-20210820";
+  version = "2.1.0-dev-20210924";
 
   src = fetchzip {
     url = "https://github.com/google/agi-dev-releases/releases/download/v${version}/agi-${version}-linux.zip";
-    sha256 = "sha256-XsjWrih+8D3z1I41N5ZoLar/+5FV9mPN9aMbyZK2m/0=";
+    sha256 = "sha256-OX26qoyJMG54BA/62GbGRjqdYA7n56SUVVOcdyVAGmM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/networking/stunnel/default.nix b/pkgs/tools/networking/stunnel/default.nix
index 68c2fc935fcd..5b73e7d3fb48 100644
--- a/pkgs/tools/networking/stunnel/default.nix
+++ b/pkgs/tools/networking/stunnel/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "stunnel";
-  version = "5.60";
+  version = "5.61";
 
   src = fetchurl {
     url    = "https://www.stunnel.org/downloads/${pname}-${version}.tar.gz";
-    sha256 = "sha256-xF12WxUhhh/qmwO0JbndfUizBVEowK7Gc7ul75uPeH0=";
+    sha256 = "sha256-keoMpkgtj359lx7mSrT4aigX0DijcvCJPigxXvIBXXo=";
     # please use the contents of "https://www.stunnel.org/downloads/${name}.tar.gz.sha256",
     # not the output of `nix-prefetch-url`
   };
diff --git a/pkgs/tools/security/lmp/default.nix b/pkgs/tools/security/lmp/default.nix
index 5d4488e07e8b..6fd544df20a4 100644
--- a/pkgs/tools/security/lmp/default.nix
+++ b/pkgs/tools/security/lmp/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "lmp";
-  version = "1.1";
+  version = "2.0";
 
   src = fetchFromGitHub {
     owner = "0xInfection";
     repo = "LogMePwn";
     rev = "v${version}";
-    sha256 = "sha256-3kxMtkHkqo5Gwk864Bb8MqRtuC8HP38Xl22ktiTgr5k=";
+    sha256 = "sha256-VL/Hp7YaXNcV9JPb3kgRHcdhJJ5p3KHUf3hHbT3gKVk=";
   };
 
-  vendorSha256 = "sha256-X7Djcp4reOXL6SX4jiSLicolENu7Uo5webSePYrPKug=";
+  vendorSha256 = "sha256-K3jD+r/JFQH5QeLHatCzTdgiABbmKOd/jR3Di10w6mo=";
 
   meta = with lib; {
     description = "Scanning and validation toolkit for the Log4J vulnerability";
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 6b646f08b362..2df6a19cf90d 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -28640,6 +28640,7 @@ with pkgs;
     jdk = jdk8;
     pythonPackages = python3Packages;
     inherit llvmPackages;
+    boost = boost16x; # Filesystem tests in the checkPhase fail with Boost 1.77
   };
 
   spotifywm = callPackage ../applications/audio/spotifywm { };
@@ -32833,6 +32834,8 @@ with pkgs;
 
   nar-serve = callPackage ../tools/nix/nar-serve { };
 
+  neo = callPackage ../applications/misc/neo { };
+
   inherit (callPackage ../tools/package-management/nix {
       storeDir = config.nix.storeDir or "/nix/store";
       stateDir = config.nix.stateDir or "/nix/var";
diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 83207868d1dc..f24f8defb954 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -4422,10 +4422,10 @@ let
 
   CryptPassphraseArgon2 = buildPerlPackage {
     pname = "Crypt-Passphrase-Argon2";
-    version = "0.002";
+    version = "0.003";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/L/LE/LEONT/Crypt-Passphrase-Argon2-0.002.tar.gz";
-      sha256 = "3906ff81697d13804ee21bd5ab78ffb1c4408b4822ce020e92ecf4737ba1f3a8";
+      url = "mirror://cpan/authors/id/L/LE/LEONT/Crypt-Passphrase-Argon2-0.003.tar.gz";
+      sha256 = "sha256-cCkLtb3GfBcBKN8+UWexfQS7eTkzqubAWnWGfao/OTg=";
     };
     propagatedBuildInputs = with perlPackages; [ CryptArgon2 CryptPassphrase ];
     meta = {
@@ -4434,6 +4434,21 @@ let
     };
   };
 
+  CryptPassphraseBcrypt = buildPerlPackage {
+    pname = "Crypt-Passphrase-Bcrypt";
+    version = "0.001";
+    src = fetchurl {
+      url = "mirror://cpan/authors/id/L/LE/LEONT/Crypt-Passphrase-Bcrypt-0.001.tar.gz";
+      sha256 = "sha256-M44nA4RH/eAjznyaC1dPR+4zeQRKDAgxrJRx8UMNxMU=";
+    };
+    propagatedBuildInputs = [ CryptEksblowfish CryptPassphrase ];
+    meta = {
+      homepage = "https://github.com/Leont/crypt-passphrase-bcrypt";
+      description = "A bcrypt encoder for Crypt::Passphrase";
+      license = with lib.licenses; [ artistic1 gpl1Plus ];
+    };
+  };
+
   CryptPasswdMD5 = buildPerlModule {
     pname = "Crypt-PasswdMD5";
     version = "1.40";
@@ -14543,10 +14558,10 @@ let
 
   MojoliciousPluginSyslog = buildPerlPackage {
     pname = "Mojolicious-Plugin-Syslog";
-    version = "0.04";
+    version = "0.05";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/J/JH/JHTHORSEN/Mojolicious-Plugin-Syslog-0.04.tar.gz";
-      sha256 = "807d06b88304675a2bb9181bab123a0e16d3cf2f6a5753a168090ed88085a492";
+      url = "mirror://cpan/authors/id/J/JH/JHTHORSEN/Mojolicious-Plugin-Syslog-0.05.tar.gz";
+      sha256 = "sha256-G5Ur6EJ00gAeawLkqw93Et8O4wiPk2qFRlQofh0BPp8=";
     };
     propagatedBuildInputs = [ Mojolicious ];
     meta = {
@@ -23142,6 +23157,22 @@ let
     buildInputs = [ ListMoreUtils TestDifferences TestException ];
   };
 
+  TextMarkdownHoedown = buildPerlModule {
+    pname = "Text-Markdown-Hoedown";
+    version = "1.03";
+    src = fetchurl {
+      url = "mirror://cpan/authors/id/T/TO/TOKUHIROM/Text-Markdown-Hoedown-1.03.tar.gz";
+      sha256 = "sha256-U6cw/29IgrmavYVW8mqRH1gvZ1tZ8OFnJe0ey8CE7lA=";
+    };
+    buildInputs = [ Filepushd ];
+    perlPreHook = lib.optionalString stdenv.isDarwin "export LD=$CC";
+    meta = {
+      homepage = "https://github.com/tokuhirom/Text-Markdown-Hoedown";
+      description = "hoedown for Perl5";
+      license = with lib.licenses; [ artistic1 gpl1Plus ];
+    };
+  };
+
   TestMinimumVersion = buildPerlPackage {
     pname = "Test-MinimumVersion";
     version = "0.101082";
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index cdfea4676708..a53f2c0826b6 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -100,6 +100,12 @@ let
 
   disabledIf = x: drv: if x then disabled drv else drv;
 
+  # CUDA-related packages that are compatible with the currently packaged version
+  # of TensorFlow, used to keep these versions in sync in related packages like `jaxlib`.
+  tensorflow_compat_cudatoolkit = pkgs.cudatoolkit_11_2;
+  tensorflow_compat_cudnn = pkgs.cudnn_cudatoolkit_11_2;
+  tensorflow_compat_nccl = pkgs.nccl_cudatoolkit_11;
+
 in {
 
   inherit pkgs stdenv;
@@ -4053,7 +4059,17 @@ in {
 
   jax = callPackage ../development/python-modules/jax { };
 
-  jaxlib = callPackage ../development/python-modules/jaxlib { };
+  jaxlib-bin = callPackage ../development/python-modules/jaxlib/bin.nix { };
+
+  jaxlib-build = callPackage ../development/python-modules/jaxlib {
+    # Some platforms don't have `cudaSupport` defined, hence the need for 'or false'.
+    cudaSupport = pkgs.config.cudaSupport or false;
+    cudatoolkit = tensorflow_compat_cudatoolkit;
+    cudnn = tensorflow_compat_cudnn;
+    nccl = tensorflow_compat_nccl;
+  };
+
+  jaxlib = self.jaxlib-build;
 
   JayDeBeApi = callPackage ../development/python-modules/JayDeBeApi { };
 
@@ -8879,6 +8895,8 @@ in {
 
   signify = callPackage ../development/python-modules/signify { };
 
+  siosocks = callPackage ../development/python-modules/siosocks { };
+
   sip = callPackage ../development/python-modules/sip { };
 
   sip_4 = callPackage ../development/python-modules/sip/4.x.nix { };
@@ -9455,16 +9473,16 @@ in {
 
   tensorflow-bin = callPackage ../development/python-modules/tensorflow/bin.nix {
     cudaSupport = pkgs.config.cudaSupport or false;
-    cudatoolkit = pkgs.cudatoolkit_11_2;
-    cudnn = pkgs.cudnn_cudatoolkit_11_2;
+    cudatoolkit = tensorflow_compat_cudatoolkit;
+    cudnn = tensorflow_compat_cudnn;
   };
 
   tensorflow-build = callPackage ../development/python-modules/tensorflow {
     inherit (pkgs.darwin) cctools;
     cudaSupport = pkgs.config.cudaSupport or false;
-    cudatoolkit = pkgs.cudatoolkit_11_2;
-    cudnn = pkgs.cudnn_cudatoolkit_11_2;
-    nccl = pkgs.nccl_cudatoolkit_11;
+    cudatoolkit = tensorflow_compat_cudatoolkit;
+    cudnn = tensorflow_compat_cudnn;
+    nccl = tensorflow_compat_nccl;
     inherit (pkgs.darwin.apple_sdk.frameworks) Foundation Security;
     flatbuffers-core = pkgs.flatbuffers;
     flatbuffers-python = self.flatbuffers;