diff --git a/nixos/modules/services/web-servers/apache-httpd/default.nix b/nixos/modules/services/web-servers/apache-httpd/default.nix
index 17cfdfb24462..ceb199870975 100644
--- a/nixos/modules/services/web-servers/apache-httpd/default.nix
+++ b/nixos/modules/services/web-servers/apache-httpd/default.nix
@@ -463,7 +463,7 @@ in
         default = "common";
         example = "combined";
         description = ''
-          Log format for log files. Possible values are: combined, common, referer, agent.
+          Log format for log files. Possible values are: combined, common, referer, agent, none.
           See <link xlink:href="https://httpd.apache.org/docs/2.4/logs.html"/> for more details.
         '';
       };
diff --git a/pkgs/applications/editors/tiled/default.nix b/pkgs/applications/editors/tiled/default.nix
index 4fdb4a44b24a..4a53d585feae 100644
--- a/pkgs/applications/editors/tiled/default.nix
+++ b/pkgs/applications/editors/tiled/default.nix
@@ -3,13 +3,13 @@
 
 mkDerivation rec {
   pname = "tiled";
-  version = "1.7.0";
+  version = "1.7.2";
 
   src = fetchFromGitHub {
     owner = "bjorn";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-XVIkyf9cQZXjFuGGCliCSY22X8EkoPEl1EpGCrMTsgY=";
+    sha256 = "sha256-yQWe27zLWOnRQk+MEpuWs8CFP/le3PQ+yziB0ikNang=";
   };
 
   nativeBuildInputs = [ pkg-config qmake ];
diff --git a/pkgs/applications/misc/notejot/default.nix b/pkgs/applications/misc/notejot/default.nix
index c0c68ac88ab3..213bb9a76b3a 100644
--- a/pkgs/applications/misc/notejot/default.nix
+++ b/pkgs/applications/misc/notejot/default.nix
@@ -18,13 +18,13 @@
 
 stdenv.mkDerivation rec {
   pname = "notejot";
-  version = "3.1.0";
+  version = "3.1.1";
 
   src = fetchFromGitHub {
     owner = "lainsce";
     repo = pname;
     rev = version;
-    hash = "sha256-jR1zOmVkFGgA5bzMDHQ8HMToi18Y3n2aJDx7pwsZEhM=";
+    hash = "sha256-OmzEwShIpzIbonqwQmpdutd3tztm7Gmmo3qdt+DApWo=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/networking/bee/bee.nix b/pkgs/applications/networking/bee/bee.nix
index b0d05d928c05..0e269bf9ab3f 100644
--- a/pkgs/applications/networking/bee/bee.nix
+++ b/pkgs/applications/networking/bee/bee.nix
@@ -44,8 +44,8 @@ buildGoModule {
   subPackages = [ "cmd/bee" ];
 
   # no symbol table, no debug info, and pass the commit for the version string
-  buildFlags = lib.optionalString ( lib.hasAttr "goVersionString" versionSpec)
-    "-ldflags -s -ldflags -w -ldflags -X=github.com/ethersphere/bee.commit=${versionSpec.goVersionString}";
+  ldflags = lib.optionals ( lib.hasAttr "goVersionString" versionSpec)
+    [ "-s" "-w" "-X=github.com/ethersphere/bee.commit=${versionSpec.goVersionString}" ];
 
   # Mimic the bee Makefile: without disabling CGO, two (transitive and
   # unused) dependencies would fail to compile.
diff --git a/pkgs/applications/networking/flexget/default.nix b/pkgs/applications/networking/flexget/default.nix
index 3d726eba9808..edf467d51208 100644
--- a/pkgs/applications/networking/flexget/default.nix
+++ b/pkgs/applications/networking/flexget/default.nix
@@ -1,16 +1,22 @@
-{ lib, python3Packages }:
+{ lib, python3Packages, fetchFromGitHub }:
 
 python3Packages.buildPythonApplication rec {
   pname = "flexget";
-  version = "3.1.133";
+  version = "3.1.135";
 
-  src = python3Packages.fetchPypi {
-    pname = "FlexGet";
-    inherit version;
-    sha256 = "1mfmy2nbxx9k6hnhwxpf2062rwspigfhbvkpr161grd5amcs2cr6";
+  # Fetch from GitHub in order to use `requirements.in`
+  src = fetchFromGitHub {
+    owner = "flexget";
+    repo = "flexget";
+    rev = "v${version}";
+    sha256 = "01qj9pp3b7qxpv1yzak4ql1d95dq6611crpp4y5z44mg5gmbql7g";
   };
 
   postPatch = ''
+    # Symlink requirements.in because upstream uses `pip-compile` which yields
+    # python-version dependent requirements
+    ln -sf requirements.in requirements.txt
+
     # remove dependency constraints
     sed 's/==\([0-9]\.\?\)\+//' -i requirements.txt
 
diff --git a/pkgs/applications/networking/instant-messengers/pond/default.nix b/pkgs/applications/networking/instant-messengers/pond/default.nix
index 4c059cb20d83..f26cd0109444 100644
--- a/pkgs/applications/networking/instant-messengers/pond/default.nix
+++ b/pkgs/applications/networking/instant-messengers/pond/default.nix
@@ -23,11 +23,14 @@ buildGoPackage rec {
   buildInputs = [ trousers gtk3 gtkspell3 ]
     ++ lib.optional stdenv.hostPlatform.isx86_64 dclxvi
     ++ lib.optionals gui [ wrapGAppsHook ];
-  buildFlags = lib.optionals (!gui) [ "-tags" "nogui" ];
+  tags = lib.optionals (!gui) [ "nogui" ];
   excludedPackages = "\\(appengine\\|bn256cgo\\)";
   postPatch = lib.optionalString stdenv.hostPlatform.isx86_64 ''
     grep -r 'bn256' | awk -F: '{print $1}' | xargs sed -i \
       -e "s,golang.org/x/crypto/bn256,github.com/agl/pond/bn256cgo,g" \
       -e "s,bn256\.,bn256cgo.,g"
   '';
+
+  # https://hydra.nixos.org/build/150102618/nixlog/2
+  meta.broken = stdenv.isAarch64;
 }
diff --git a/pkgs/applications/science/logic/opensmt/default.nix b/pkgs/applications/science/logic/opensmt/default.nix
index 1681d4545904..fd22b7b1add8 100644
--- a/pkgs/applications/science/logic/opensmt/default.nix
+++ b/pkgs/applications/science/logic/opensmt/default.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "opensmt";
-  version = "2.0.1";
+  version = "2.1.0";
 
   src = fetchFromGitHub {
     owner = "usi-verification-and-security";
     repo = "opensmt";
     rev = "v${version}";
-    sha256 = "uoIcXWsxxRsIuFsou3RcN9e48lc7cWMgRPVJLFVslDE=";
+    sha256 = "sha256-m8TpMBY1r0h8GJTHM4FLBuZtX+WK/Q7RTXUnNmUWV+o=";
   };
 
   nativeBuildInputs = [ cmake bison flex ];
diff --git a/pkgs/applications/virtualization/containerd/1.4.nix b/pkgs/applications/virtualization/containerd/1.4.nix
index e4f743013b27..9e62f86a3477 100644
--- a/pkgs/applications/virtualization/containerd/1.4.nix
+++ b/pkgs/applications/virtualization/containerd/1.4.nix
@@ -26,12 +26,10 @@ buildGoPackage rec {
 
   buildInputs = [ btrfs-progs ];
 
-  buildFlags = [ "VERSION=v${version}" "REVISION=${src.rev}" ];
-
   buildPhase = ''
     cd go/src/${goPackagePath}
     patchShebangs .
-    make binaries man $buildFlags
+    make binaries man "VERSION=v${version}" "REVISION=${src.rev}"
   '';
 
   installPhase = ''
diff --git a/pkgs/applications/virtualization/containerd/default.nix b/pkgs/applications/virtualization/containerd/default.nix
index c86f4280e821..cce72e2a745f 100644
--- a/pkgs/applications/virtualization/containerd/default.nix
+++ b/pkgs/applications/virtualization/containerd/default.nix
@@ -27,14 +27,12 @@ buildGoModule rec {
 
   buildInputs = [ btrfs-progs ];
 
-  buildFlags = [ "VERSION=v${version}" "REVISION=${src.rev}" ];
-
   BUILDTAGS = lib.optionals (btrfs-progs == null) [ "no_btrfs" ];
 
   buildPhase = ''
     runHook preBuild
     patchShebangs .
-    make binaries man $buildFlags
+    make binaries man "VERSION=v${version}" "REVISION=${src.rev}"
     runHook postBuild
   '';
 
diff --git a/pkgs/desktops/gnome-2/desktop/mail-notification/default.nix b/pkgs/desktops/gnome-2/desktop/mail-notification/default.nix
deleted file mode 100644
index 1e0064a8fadf..000000000000
--- a/pkgs/desktops/gnome-2/desktop/mail-notification/default.nix
+++ /dev/null
@@ -1,54 +0,0 @@
-{ lib, stdenv, fetchFromGitHub, pkg-config, glib, gnome2, dbus-glib, gmime, gnome-icon-theme, libnotify, libgnome-keyring, openssl, cyrus_sasl, sylpheed, gob2, gettext, intltool, libxml2, hicolor-icon-theme, tango-icon-theme }:
-
-stdenv.mkDerivation rec {
-  rev = "9ae8768";
-  version = "5.4";
-  pname = "mail-notification";
-
-  src = fetchFromGitHub {
-    inherit rev;
-    owner = "epienbroek";
-    repo = "mail-notification";
-    sha256 = "1slb7gajn30vdaq0hf5rikwdly1npmg1cf83hpjs82xd98knl13d";
-  };
-
-  nativeBuildInputs = [ pkg-config ];
-   buildInputs = [ glib dbus-glib gmime libnotify libgnome-keyring openssl cyrus_sasl sylpheed gob2 gettext intltool gnome2.GConf gnome2.libgnomeui dbus-glib gmime libnotify gnome2.scrollkeeper libxml2 gnome-icon-theme hicolor-icon-theme tango-icon-theme ];
-
-  prePatch = ''
-    sed -i  -e '/jb_rule_set_install_message/d' -e '/jb_rule_add_install_command/d' jbsrc/jb.c
-
-    # currently disable the check for missing sheme until a better solution
-    # is found; needed, because otherwise the application doesn't even start
-    # and fails saying it unable to find gconf scheme values.
-    sed -i -e 's/(schema_missing)/(!schema_missing)/g' src/mn-conf.c
-  '';
-
-  patches = [
-    ./patches/mail-notification-dont-link-against-bsd-compat.patch
-  ];
-
-  patchFlags = [ "-p0" ];
-  NIX_CFLAGS_COMPILE = "-Wno-error";
-
-  preConfigure = "./jb configure prefix=$out";
-
-  postConfigure = ''
-    substituteInPlace build/config \
-      --replace "omf-dir|string|1|${gnome2.scrollkeeper}/share/omf" "omf-dir|string|1|$out/share/omf" \
-      --replace "scrollkeeper-dir|string|1|${gnome2.scrollkeeper}/var/lib/scrollkeeper" "omf-dir|string|1|$out/var/lib/scrollkeeper" \
-  '';
-
-  buildPhase = "./jb build";
-  installPhase = "./jb install";
-
-  enableParallelBuilding = true;
-
-  meta = with lib; {
-    description = "Tray status icon, which notifies us when new email arrives";
-    homepage = "https://www.nongnu.org/mailnotify/";
-    license = with licenses; [ gpl3 ];
-    platforms = platforms.unix;
-    maintainers = [ maintainers.eleanor ];
-  };
-}
diff --git a/pkgs/development/compilers/mlkit/default.nix b/pkgs/development/compilers/mlkit/default.nix
index 1769b31b5a5c..77d2fe6cac9d 100644
--- a/pkgs/development/compilers/mlkit/default.nix
+++ b/pkgs/development/compilers/mlkit/default.nix
@@ -18,7 +18,9 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Standard ML Compiler and Toolkit";
     homepage = "https://elsman.com/mlkit/";
+    changelog = "https://github.com/melsman/mlkit/blob/v${version}/NEWS.md";
     license = licenses.gpl2Plus;
+    platforms = platforms.unix;
     maintainers = with maintainers; [ athas ];
   };
 }
diff --git a/pkgs/development/libraries/ucx/default.nix b/pkgs/development/libraries/ucx/default.nix
index 872e7fbc4f21..7e1f36f0f96e 100644
--- a/pkgs/development/libraries/ucx/default.nix
+++ b/pkgs/development/libraries/ucx/default.nix
@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   pname = "ucx";
-  version = "1.10.1";
+  version = "1.11.0";
 
   src = fetchFromGitHub {
     owner = "openucx";
     repo = "ucx";
     rev = "v${version}";
-    sha256 = "1jl7wrmcpf6lakpi1gvjcs18cy0mmwgsv5wdd80zyl41cpd8gm8d";
+    sha256 = "1ww5a9m1jbjjhsjlvjvlcvcv0sv388irfx8xdh0pd9w03xv754d0";
   };
 
   nativeBuildInputs = [ autoreconfHook doxygen ];
diff --git a/pkgs/development/python-modules/aioconsole/default.nix b/pkgs/development/python-modules/aioconsole/default.nix
index c198676e3eb0..f56d31b034dd 100644
--- a/pkgs/development/python-modules/aioconsole/default.nix
+++ b/pkgs/development/python-modules/aioconsole/default.nix
@@ -1,4 +1,10 @@
-{ lib, buildPythonPackage, fetchPypi, pythonOlder }:
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, pytest-asyncio
+, pytestCheckHook
+, pythonOlder
+}:
 
 # This package provides a binary "apython" which sometimes invokes
 # [sys.executable, '-m', 'aioconsole'] as a subprocess. If apython is
@@ -10,21 +16,32 @@
 # wrapped to be able to find aioconsole and any other packages.
 buildPythonPackage rec {
   pname = "aioconsole";
-  version = "0.3.1";
+  version = "0.3.2";
   disabled = pythonOlder "3.6";
 
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "7c038bb40b7690bf5be6b17154830b7bff25e7be1c02d8420a346c3efbd5d8e5";
+  src = fetchFromGitHub {
+    owner = "vxgmichel";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "0bximaalakw1dxan1lxar33l8hnmxqn0fg62hmdmprmra72z4bm8";
   };
 
-  # hardcodes a test dependency on an old version of pytest-asyncio
-  doCheck = false;
+  checkInputs = [
+    pytest-asyncio
+    pytestCheckHook
+  ];
 
-  meta = {
+  postPatch = ''
+    substituteInPlace setup.cfg \
+      --replace "--cov aioconsole --count 2" ""
+  '';
+
+  pythonImportsCheck = [ "aioconsole" ];
+
+  meta = with lib; {
     description = "Asynchronous console and interfaces for asyncio";
     homepage = "https://github.com/vxgmichel/aioconsole";
-    license = lib.licenses.gpl3;
-    maintainers = [ lib.maintainers.catern ];
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ catern ];
   };
 }
diff --git a/pkgs/development/python-modules/aiohttp-jinja2/default.nix b/pkgs/development/python-modules/aiohttp-jinja2/default.nix
index 589aa14509e2..890a37e24dd3 100644
--- a/pkgs/development/python-modules/aiohttp-jinja2/default.nix
+++ b/pkgs/development/python-modules/aiohttp-jinja2/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "aiohttp-jinja2";
-  version = "1.4.2";
+  version = "1.5";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "9c22a0e48e3b277fc145c67dd8c3b8f609dab36bce9eb337f70dfe716663c9a0";
+    sha256 = "7c3ba5eac060b691f4e50534af2d79fca2a75712ebd2b25e6fcb1295859f910b";
   };
 
   propagatedBuildInputs = [ aiohttp jinja2 ];
diff --git a/pkgs/development/python-modules/async-upnp-client/default.nix b/pkgs/development/python-modules/async-upnp-client/default.nix
index 4b89204ca5e6..04e21ac9a68e 100644
--- a/pkgs/development/python-modules/async-upnp-client/default.nix
+++ b/pkgs/development/python-modules/async-upnp-client/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage rec {
   pname = "async-upnp-client";
-  version = "0.19.2";
+  version = "0.20.0";
   disabled = pythonOlder "3.6";
 
   src = fetchFromGitHub {
     owner = "StevenLooman";
     repo = "async_upnp_client";
     rev = version;
-    sha256 = "1v8d2lvxihqasn7866zssys16s0lgxkk6ri2dp4rr7wr8g9ixvdr";
+    sha256 = "sha256-jxYGOljV7tcsiAgpOhbXj7g7AwyP1kDDC83PiHG6ZFg=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/azure-identity/default.nix b/pkgs/development/python-modules/azure-identity/default.nix
index 10c455ce072d..bad63d287be3 100644
--- a/pkgs/development/python-modules/azure-identity/default.nix
+++ b/pkgs/development/python-modules/azure-identity/default.nix
@@ -17,12 +17,12 @@
 
 buildPythonPackage rec {
   pname = "azure-identity";
-  version = "1.6.0";
+  version = "1.6.1";
 
   src = fetchPypi {
     inherit pname version;
     extension = "zip";
-    sha256 = "2e70b00874e4f288e37804bc06bfaf216de8565c759594bf79cccfbf9ca2c78a";
+    sha256 = "69035c81f280fac5fa9c55f87be3a359b264853727486e3568818bb43988080e";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/google-cloud-pubsub/default.nix b/pkgs/development/python-modules/google-cloud-pubsub/default.nix
index 47af89d4be27..6b3f6079124b 100644
--- a/pkgs/development/python-modules/google-cloud-pubsub/default.nix
+++ b/pkgs/development/python-modules/google-cloud-pubsub/default.nix
@@ -13,11 +13,11 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-pubsub";
-  version = "2.7.0";
+  version = "2.7.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-F4itJadl6oNJnY9EENTIugJll8uC20bS9yF/HCUlrWU=";
+    sha256 = "d52d386617c110c35043f6ff37ccb50d9f37c75b1e5586409ed64a3e8ae61038";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/ntc-templates/default.nix b/pkgs/development/python-modules/ntc-templates/default.nix
index 2d1b08c5b981..33921406fe1d 100644
--- a/pkgs/development/python-modules/ntc-templates/default.nix
+++ b/pkgs/development/python-modules/ntc-templates/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "ntc-templates";
-  version = "2.2.0";
+  version = "2.2.2";
   format = "pyproject";
   disabled = isPy27;
 
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "networktocode";
     repo = pname;
     rev = "v${version}";
-    sha256 = "18v47sd301y6zdl5yria0z8s9cx7f9rvj3gq27fd7p7h9lkll984";
+    sha256 = "1f2hmayj95j3fzkyh9qvl58z0l9j9mlsi8b2r9aa2fy753y5a73b";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/pytest-socket/default.nix b/pkgs/development/python-modules/pytest-socket/default.nix
index 05f632d39ba3..0371b7cac5a4 100644
--- a/pkgs/development/python-modules/pytest-socket/default.nix
+++ b/pkgs/development/python-modules/pytest-socket/default.nix
@@ -1,20 +1,29 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+, fetchpatch
+, poetry-core
 , pytest
+, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "pytest-socket";
-  version = "0.3.3";
+  version = "0.4.0";
+  disabled = pythonOlder "3.6";
+  format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "miketheman";
     repo = pname;
     rev = version;
-    sha256 = "1jbzkyp4xki81h01yl4vg3nrg9b6shsk1ryrmkaslffyhrqnj8zh";
+    sha256 = "sha256-cFYtJqZ/RjFbn9XlEy6ffxZ2djisajQAwjV/YR2f59Q=";
   };
 
+  nativeBuildInputs = [
+    poetry-core
+  ];
+
   buildInputs = [
     pytest
   ];
@@ -23,18 +32,24 @@ buildPythonPackage rec {
     pytest
   ];
 
-  checkPhase = ''
-    pytest
-  '';
+  patches = [
+    # Switch to poetry-core, https://github.com/miketheman/pytest-socket/pull/74
+    (fetchpatch {
+      name = "switch-to-poetry-core.patch";
+      url = "https://github.com/miketheman/pytest-socket/commit/32519170e656e731d24b81770a170333d3efa6a8.patch";
+      sha256 = "19ksgx77rsa6ijcbml74alwc5052mdqr4rmvqhlzvfcvv3676ig2";
+    })
+  ];
 
-  # unsurprisingly pytest-socket require network for majority of tests
-  # to pass...
+  # pytest-socket require network for majority of tests
   doCheck = false;
 
+  pythonImportsCheck = [ "pytest_socket" ];
+
   meta = with lib; {
     description = "Pytest Plugin to disable socket calls during tests";
     homepage = "https://github.com/miketheman/pytest-socket";
     license = licenses.mit;
-    maintainers = [ maintainers.costrouc ];
+    maintainers = with maintainers; [ costrouc ];
   };
 }
diff --git a/pkgs/development/python-modules/pytest-testmon/default.nix b/pkgs/development/python-modules/pytest-testmon/default.nix
index fa63cc035ad8..d7b0b660be98 100644
--- a/pkgs/development/python-modules/pytest-testmon/default.nix
+++ b/pkgs/development/python-modules/pytest-testmon/default.nix
@@ -8,12 +8,12 @@
 
 buildPythonPackage rec {
   pname = "pytest-testmon";
-  version = "1.1.1";
+  version = "1.1.2";
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "c8810f991545e352f646fb382e5962ff54b8aa52b09d62d35ae04f0d7a9c58d9";
+    sha256 = "91f4513f7e5a1cf4f1eda25ab7f310497abe30e5f19b612fd80ba7d5f60b58a6";
   };
 
   propagatedBuildInputs = [ coverage ];
diff --git a/pkgs/development/python-modules/unidiff/default.nix b/pkgs/development/python-modules/unidiff/default.nix
index d1e18111db31..7dfd5c9d276a 100644
--- a/pkgs/development/python-modules/unidiff/default.nix
+++ b/pkgs/development/python-modules/unidiff/default.nix
@@ -1,20 +1,20 @@
-{ lib, buildPythonPackage, fetchFromGitHub }:
+{ lib, buildPythonPackage, fetchPypi }:
 
 buildPythonPackage rec {
   pname = "unidiff";
-  version = "0.6.0";
+  version = "0.7.0";
 
-  # PyPI tarball doesn't ship tests
-  src = fetchFromGitHub {
-    owner = "matiasb";
-    repo = "python-unidiff";
-    rev = "v${version}";
-    sha256 = "0farwkw0nbb5h4369pq3i6pp4047hav0h88ba55rzz5k7mr25rgi";
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "91bb13b4969514a400679d9ae5e29a6ffad85346087677f8b5e2e036af817447";
   };
 
+  pythonImportsCheck = [ "unidiff" ];
+
   meta = with lib; {
     description = "Unified diff python parsing/metadata extraction library";
     homepage = "https://github.com/matiasb/python-unidiff";
+    changelog = "https://github.com/matiasb/python-unidiff/raw/v${version}/HISTORY";
     license = licenses.mit;
     maintainers = [ maintainers.marsam ];
   };
diff --git a/pkgs/development/python-modules/yamale/default.nix b/pkgs/development/python-modules/yamale/default.nix
index 9b2c7b116c6d..5d292644139f 100644
--- a/pkgs/development/python-modules/yamale/default.nix
+++ b/pkgs/development/python-modules/yamale/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "yamale";
-  version = "3.0.4";
+  version = "3.0.8";
 
   disabled = !isPy3k;
 
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "23andMe";
     repo = pname;
     rev = version;
-    sha256 = "1xjvah4r3gpwk4zxql3c9jpllb34k175fm6iq1zvsd2vv2fwf8s2";
+    sha256 = "0bn0himn5fwndaxn205s55bdc4np7lhd940i0lkv0m7ybhbw7dap";
   };
 
   propagatedBuildInputs = [
@@ -28,6 +28,7 @@ buildPythonPackage rec {
   checkInputs = [
     pytest
   ];
+  pythonImportsCheck = [ "yamale" ];
 
   meta = with lib; {
     description = "A schema and validator for YAML";
diff --git a/pkgs/development/tools/analysis/flow/default.nix b/pkgs/development/tools/analysis/flow/default.nix
index 4fd0276f7f4d..78df8883cf9b 100644
--- a/pkgs/development/tools/analysis/flow/default.nix
+++ b/pkgs/development/tools/analysis/flow/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "flow";
-  version = "0.157.0";
+  version = "0.158.0";
 
   src = fetchFromGitHub {
     owner = "facebook";
     repo = "flow";
     rev = "v${version}";
-    sha256 = "sha256-16DDlVCBZ8Rtd5OM9tJUxekzYDAirX1zJ36cyPOv/SU=";
+    sha256 = "sha256-Wl+Jux20gtl+upaKcFF3ub5TetNUf2GwfenH+Ddvqfw=";
   };
 
   installPhase = ''
diff --git a/pkgs/development/tools/database/timescaledb-tune/default.nix b/pkgs/development/tools/database/timescaledb-tune/default.nix
index e4132dd73451..9c24d35cbf88 100644
--- a/pkgs/development/tools/database/timescaledb-tune/default.nix
+++ b/pkgs/development/tools/database/timescaledb-tune/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "timescaledb-tune";
-  version = "0.11.0";
+  version = "0.11.2";
 
   src = fetchFromGitHub {
     owner = "timescale";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-orCnw+NM9jTrg0oeHg0CQvIXzbSkeCwwDUI1t/+k31o=";
+    sha256 = "sha256-6xMdOqLfD3NQksmcD7rlTW3xoW2Fi6OmwbpjIj9A/tw=";
   };
 
   vendorSha256 = "sha256-n2jrg9FiR/gSrbds/QVV8Duf7BTEs36yYi4F3Ve+d0E=";
diff --git a/pkgs/development/tools/lazygit/default.nix b/pkgs/development/tools/lazygit/default.nix
index af33938c1a6f..c7e3a1fabdc9 100644
--- a/pkgs/development/tools/lazygit/default.nix
+++ b/pkgs/development/tools/lazygit/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "lazygit";
-  version = "0.28.2";
+  version = "0.29";
 
   src = fetchFromGitHub {
     owner = "jesseduffield";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-s5Ou0FhL9+2/xm7lKMG/3ya5P8idI0cgtJ28cV37pJQ=";
+    sha256 = "sha256-rw03K21Ay/+XKs06cUBybXLp8Rxrlz8T8YKrSGroyDU=";
   };
 
   vendorSha256 = null;
diff --git a/pkgs/development/tools/misc/terraformer/default.nix b/pkgs/development/tools/misc/terraformer/default.nix
index 60124ef44c93..ac20ca26f808 100644
--- a/pkgs/development/tools/misc/terraformer/default.nix
+++ b/pkgs/development/tools/misc/terraformer/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "terraformer";
-  version = "0.8.11";
+  version = "0.8.15";
 
   src = fetchFromGitHub {
     owner = "GoogleCloudPlatform";
     repo = pname;
     rev = version;
-    sha256 = "sha256-y6cgBYiqy+M8dfcNS6iDohqyip6xAs222MJHJFhloiI=";
+    sha256 = "sha256-d8DOUvUj5hdc1kcd0vgMufVIOJqV0eG4sXQIX597L/w=";
   };
 
-  vendorSha256 = "sha256-PQj3+qcmN/raDrAbufAcVT+vSumGuOY47i7ZYfvx3yk=";
+  vendorSha256 = "sha256-VQ3yZQqpq9KbAkBDnQAfOE+axlT0GhvUpMIjb59PYT0=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/development/tools/yarn2nix-moretea/yarn2nix/default.nix b/pkgs/development/tools/yarn2nix-moretea/yarn2nix/default.nix
index 0822e1ee6398..cba0227fd1fa 100644
--- a/pkgs/development/tools/yarn2nix-moretea/yarn2nix/default.nix
+++ b/pkgs/development/tools/yarn2nix-moretea/yarn2nix/default.nix
@@ -4,7 +4,7 @@
 }:
 
 let
-  inherit (pkgs) stdenv lib fetchurl linkFarm callPackage git rsync makeWrapper;
+  inherit (pkgs) stdenv lib fetchurl linkFarm callPackage git rsync makeWrapper runCommandLocal;
 
   compose = f: g: x: f (g x);
   id = x: x;
@@ -414,21 +414,16 @@ in rec {
     '';
   };
 
-  fixup_yarn_lock = stdenv.mkDerivation {
-    name = "fixup_yarn_lock";
+  fixup_yarn_lock = runCommandLocal "fixup_yarn_lock"
+    {
+      buildInputs = [ nodejs ];
+    } ''
+    mkdir -p $out/lib
+    mkdir -p $out/bin
 
-    buildInputs = [ nodejs ];
+    cp ${./lib/urlToName.js} $out/lib/urlToName.js
+    cp ${./internal/fixup_yarn_lock.js} $out/bin/fixup_yarn_lock
 
-    phases = [ "installPhase" ];
-
-    installPhase = ''
-      mkdir -p $out/lib
-      mkdir -p $out/bin
-
-      cp ${./lib/urlToName.js} $out/lib/urlToName.js
-      cp ${./internal/fixup_yarn_lock.js} $out/bin/fixup_yarn_lock
-
-      patchShebangs $out
-    '';
-  };
+    patchShebangs $out
+  '';
 }
diff --git a/pkgs/misc/screensavers/betterlockscreen/default.nix b/pkgs/misc/screensavers/betterlockscreen/default.nix
index e449de9ca255..8d228890d054 100644
--- a/pkgs/misc/screensavers/betterlockscreen/default.nix
+++ b/pkgs/misc/screensavers/betterlockscreen/default.nix
@@ -19,13 +19,13 @@
 
 stdenv.mkDerivation rec {
   pname = "betterlockscreen";
-  version = "4.0.1";
+  version = "4.0.3";
 
   src = fetchFromGitHub {
     owner = "pavanjadhaw";
     repo = "betterlockscreen";
     rev = "v${version}";
-    sha256 = "sha256-eteuNEGc1BOlYgV7/hwe7z4zqqs/6EJzB88126U1jiU=";
+    sha256 = "sha256-d4uI/S7Kr8yvzc4/L0BX8+TBXb4AVNMJp4gb8uXgBwA=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/os-specific/linux/kernel/hardened/patches.json b/pkgs/os-specific/linux/kernel/hardened/patches.json
index c3f0aa742574..5625cb6e0eb7 100644
--- a/pkgs/os-specific/linux/kernel/hardened/patches.json
+++ b/pkgs/os-specific/linux/kernel/hardened/patches.json
@@ -1,26 +1,26 @@
 {
     "4.14": {
         "extra": "-hardened1",
-        "name": "linux-hardened-4.14.243-hardened1.patch",
-        "sha256": "0ngz1ywkxjqyv92wirj9m6l99p4caj6n75h2mv0a6rhk9r4di6p6",
-        "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.14.243-hardened1/linux-hardened-4.14.243-hardened1.patch"
+        "name": "linux-hardened-4.14.244-hardened1.patch",
+        "sha256": "0cm5ylwxz2lzjx8c7z90h443sw7mjbr33cbrgfhaczvdzm6wxx0b",
+        "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.14.244-hardened1/linux-hardened-4.14.244-hardened1.patch"
     },
     "4.19": {
         "extra": "-hardened1",
-        "name": "linux-hardened-4.19.202-hardened1.patch",
-        "sha256": "0bylyc7k5azs8335mmzrgsx42cg8l3vm4izzikc8kchs2grb1q5v",
-        "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.19.202-hardened1/linux-hardened-4.19.202-hardened1.patch"
+        "name": "linux-hardened-4.19.204-hardened1.patch",
+        "sha256": "08i7985aqiiyi6h42rgf4hc09di3iy5p3i7iajzyfrzxfmgkdgdz",
+        "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.19.204-hardened1/linux-hardened-4.19.204-hardened1.patch"
     },
     "5.10": {
         "extra": "-hardened1",
-        "name": "linux-hardened-5.10.57-hardened1.patch",
-        "sha256": "0zqv77k0i4q5w4qhgiknvrh4fav1jc4a2i9cdracwqlrk8fgmiih",
-        "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.10.57-hardened1/linux-hardened-5.10.57-hardened1.patch"
+        "name": "linux-hardened-5.10.60-hardened1.patch",
+        "sha256": "0hnc12ypggwln4b5i1zqd9mmhdkcky24xj4jxqp23dwzp03pwfh8",
+        "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.10.60-hardened1/linux-hardened-5.10.60-hardened1.patch"
     },
     "5.4": {
         "extra": "-hardened1",
-        "name": "linux-hardened-5.4.139-hardened1.patch",
-        "sha256": "0lznmwy8yqc8rq5pr0akxclpnwz98pgai6ib5a3d77ncfham6fnl",
-        "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.4.139-hardened1/linux-hardened-5.4.139-hardened1.patch"
+        "name": "linux-hardened-5.4.142-hardened1.patch",
+        "sha256": "05195sxrs99gfwbb8icg8rzvqljhf1gpyhxr8da3qg6b4rvvnf0p",
+        "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.4.142-hardened1/linux-hardened-5.4.142-hardened1.patch"
     }
 }
diff --git a/pkgs/os-specific/linux/kernel/hardened/update.py b/pkgs/os-specific/linux/kernel/hardened/update.py
index e96ac9ca8554..8ff65107926f 100755
--- a/pkgs/os-specific/linux/kernel/hardened/update.py
+++ b/pkgs/os-specific/linux/kernel/hardened/update.py
@@ -226,7 +226,7 @@ for release in repo.get_releases():
     else:
         # Fall back to the latest patch for this major kernel version,
         # skipping patches for kernels newer than the packaged one.
-        if kernel_version > packaged_kernel_version:
+        if '.'.join(str(x) for x in kernel_version) > '.'.join(str(x) for x in packaged_kernel_version):
             continue
         elif (
             kernel_key not in releases or releases[kernel_key].version < version
diff --git a/pkgs/tools/filesystems/gocryptfs/default.nix b/pkgs/tools/filesystems/gocryptfs/default.nix
index c2e022ca4bde..4d901d688908 100644
--- a/pkgs/tools/filesystems/gocryptfs/default.nix
+++ b/pkgs/tools/filesystems/gocryptfs/default.nix
@@ -16,16 +16,16 @@ in
 
 buildGoModule rec {
   pname = "gocryptfs";
-  version = "2.0.1";
+  version = "2.1";
 
   src = fetchFromGitHub {
     owner = "rfjakob";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0wiagmym8mwi0vpvrs5ryn3zjwha8ilh7xkavvkd1gqd5laln0kp";
+    sha256 = "sha256-nACBEOL/vnqxdAGI37k9bxgQKgpi35/tsuCxsQ9I2sw=";
   };
 
-  vendorSha256 = "10az8n7z4rhsk1af2x6v3pmxg4zp7c9cal35ily8bdzzcb9cpgs0";
+  vendorSha256 = "sha256-Q/oBT5xdLpgQCIk7KES6c8+BaCQVUIwCwVufl4oTFRs=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/tools/misc/macchina/default.nix b/pkgs/tools/misc/macchina/default.nix
index 053240e21190..8b4b897526da 100644
--- a/pkgs/tools/misc/macchina/default.nix
+++ b/pkgs/tools/misc/macchina/default.nix
@@ -3,16 +3,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "macchina";
-  version = "0.9.2";
+  version = "1.0.0";
 
   src = fetchFromGitHub {
     owner = "Macchina-CLI";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256:0d6nqjn2828kk91430yjl6xlwx1j10xhp2i0vv2slm3wv0a4w24x";
+    sha256 = "sha256-ZuQ0FZM77ENAQ57B0oFqFmGqQnFblCP2wJETb47yo1E=";
   };
 
-  cargoSha256 = "sha256:0mjqqd43jj6hxicgjkvmdf966vj5xf0ndibszzwp38zdb5kzshqi";
+  cargoSha256 = "sha256-YwhhOHiQcN8VS1DFTtZGvD2QvNAfPngPm/ZeOxzuDnw=";
 
   nativeBuildInputs = [ installShellFiles ];
   buildInputs = lib.optionals stdenv.isDarwin [ libiconv Foundation ];
diff --git a/pkgs/tools/misc/teleconsole/default.nix b/pkgs/tools/misc/teleconsole/default.nix
index 63277c90d47a..3bf1f5cd34b6 100644
--- a/pkgs/tools/misc/teleconsole/default.nix
+++ b/pkgs/tools/misc/teleconsole/default.nix
@@ -25,7 +25,6 @@ buildGoPackage rec {
   '';
 
   CGO_ENABLED = 1;
-  buildFlags = [ "-ldflags" ];
 
   meta = with lib; {
     homepage = "https://www.teleconsole.com/";
diff --git a/pkgs/tools/misc/you-get/default.nix b/pkgs/tools/misc/you-get/default.nix
index 8bd618d5a9dd..dd2115f99bff 100644
--- a/pkgs/tools/misc/you-get/default.nix
+++ b/pkgs/tools/misc/you-get/default.nix
@@ -2,7 +2,7 @@
 
 buildPythonApplication rec {
   pname = "you-get";
-  version = "0.4.1536";
+  version = "0.4.1545";
 
   # Tests aren't packaged, but they all hit the real network so
   # probably aren't suitable for a build environment anyway.
@@ -10,7 +10,7 @@ buildPythonApplication rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "78c9a113950344e06d18940bd11fe9a2f78b9d0bc8963cde300017ac1ffcef09";
+    sha256 = "63e9b0527424c565303fe3d8ede1cd35d48a4ecf4afe72e1c12b0e90b9fdcd39";
   };
 
   meta = with lib; {
diff --git a/pkgs/tools/security/grype/default.nix b/pkgs/tools/security/grype/default.nix
index 571bf03d1b06..e27526289aa0 100644
--- a/pkgs/tools/security/grype/default.nix
+++ b/pkgs/tools/security/grype/default.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "grype";
-  version = "0.15.0";
+  version = "0.16.0";
 
   src = fetchFromGitHub {
     owner = "anchore";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-xiUDyuVNVkVT+kxOEFOq4RKxMc5nNjsom/ZTKzfkOhU=";
+    sha256 = "sha256-Xk+AyCcPQDDKKLT/tkZ2znXbBSBEgmqVqmgGBP/3Oos=";
   };
 
-  vendorSha256 = "sha256-mW3e4WFa9pKSpyTZYmPA2j8nZz+94G2PqdqI0BDo3wc=";
+  vendorSha256 = "sha256-OAzuL1pHLLKgkKjPjupPg7LEz8sY7ehq2PONnjhvzHE=";
 
   propagatedBuildInputs = [ docker ];
 
diff --git a/pkgs/tools/security/hakrawler/default.nix b/pkgs/tools/security/hakrawler/default.nix
index fc5ee32bcbab..0e2174e50ae5 100644
--- a/pkgs/tools/security/hakrawler/default.nix
+++ b/pkgs/tools/security/hakrawler/default.nix
@@ -5,17 +5,16 @@
 
 buildGoModule rec {
   pname = "hakrawler";
-  version = "20201224-${lib.strings.substring 0 7 rev}";
-  rev = "e39a514d0e179d33362ee244c017fb65cc2c12a5";
+  version = "2.0";
 
   src = fetchFromGitHub {
     owner = "hakluke";
     repo = "hakrawler";
-    inherit rev;
-    sha256 = "0wpqfbpgnr94q5n7i4zh806k8n0phyg0ncnz43hqh4bbdh7l1y8a";
+    rev = version;
+    sha256 = "sha256-g0hJGRPLgnWAeB25iIw/JRANrYowfRtAniDD/yAQWYk=";
   };
 
-  vendorSha256 = "18zs2l77ds0a3wxfqcd91h269g0agnwhginrx3j6gj30dbfls8a1";
+  vendorSha256 = "sha256-VmMNUNThRP1jEAjZeJC4q1IvnQEDqoOM+7a0AnABQnU=";
 
   meta = with lib; {
     description = "Web crawler for the discovery of endpoints and assets";
diff --git a/pkgs/tools/security/tor/default.nix b/pkgs/tools/security/tor/default.nix
index b3c98ac013e4..a472b502b612 100644
--- a/pkgs/tools/security/tor/default.nix
+++ b/pkgs/tools/security/tor/default.nix
@@ -30,11 +30,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "tor";
-  version = "0.4.6.6";
+  version = "0.4.6.7";
 
   src = fetchurl {
     url = "https://dist.torproject.org/${pname}-${version}.tar.gz";
-    sha256 = "04ifi18cj4cw5lhfzgfrrc42j7qqdmbvxq24xlhj0dsmljdih8rl";
+    sha256 = "16hga7195va8v0x062dc05nbz4sm3dscifcqpl8235dj47hmqrpz";
   };
 
   outputs = [ "out" "geoip" ];
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 50c2a23bb4b5..565f760b8856 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -482,6 +482,7 @@ mapAliases ({
   lxappearance-gtk3 = throw "lxappearance-gtk3 has been removed. Use lxappearance instead, which now defaults to Gtk3";  # added 2020-06-03
   lzma = xz; # moved from top-level 2021-03-14
   m3d-linux = m33-linux; # added 2016-08-13
+  mail-notification = throw "mail-notification has been removed from nixpkgs, as it's unmaintained and has dependencies on old gnome libraries we want to remove"; # added 2021-08-21
   man_db = man-db; # added 2016-05
   manpages = man-pages; # added 2015-12-06
   marathon = throw "marathon has been removed from nixpkgs, as it's unmaintained"; # added 2020-08-15
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 30db04579be1..33a51b7f67a0 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -25832,8 +25832,6 @@ with pkgs;
 
   magic-wormhole = with python3Packages; toPythonApplication magic-wormhole;
 
-  mail-notification = callPackage ../desktops/gnome-2/desktop/mail-notification {};
-
   magnetophonDSP = lib.recurseIntoAttrs {
     CharacterCompressor = callPackage ../applications/audio/magnetophonDSP/CharacterCompressor { };
     CompBus = callPackage ../applications/audio/magnetophonDSP/CompBus { };