diff --git a/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml b/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml
index b6e69da6d89c..0688de77af68 100644
--- a/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml
@@ -1059,6 +1059,16 @@ Superuser created successfully.
           changelog</link>.
         </para>
       </listitem>
+      <listitem>
+        <para>
+          <literal>opencv2</literal> no longer includes the non-free
+          libraries by default, and consequently
+          <literal>pfstools</literal> no longer includes OpenCV support
+          by default. Both packages now support an
+          <literal>enableUnfree</literal> option to re-enable this
+          functionality.
+        </para>
+      </listitem>
     </itemizedlist>
   </section>
   <section xml:id="sec-release-21.11-notable-changes">
diff --git a/nixos/doc/manual/release-notes/rl-2111.section.md b/nixos/doc/manual/release-notes/rl-2111.section.md
index ebc200c4ad52..56babf8ac006 100644
--- a/nixos/doc/manual/release-notes/rl-2111.section.md
+++ b/nixos/doc/manual/release-notes/rl-2111.section.md
@@ -331,6 +331,8 @@ In addition to numerous new and upgraded packages, this release has the followin
   respectively. As a result `services.datadog-agent` has had breaking changes to the
   configuration file. For details, see the [upstream changelog](https://github.com/DataDog/datadog-agent/blob/main/CHANGELOG.rst).
 
+- `opencv2` no longer includes the non-free libraries by default, and consequently `pfstools` no longer includes OpenCV support by default.  Both packages now support an `enableUnfree` option to re-enable this functionality.
+
 ## Other Notable Changes {#sec-release-21.11-notable-changes}
 
 
diff --git a/nixos/modules/services/misc/n8n.nix b/nixos/modules/services/misc/n8n.nix
index 516d0f70ef0b..27616e5f8226 100644
--- a/nixos/modules/services/misc/n8n.nix
+++ b/nixos/modules/services/misc/n8n.nix
@@ -66,7 +66,7 @@ in
         RestrictNamespaces = "yes";
         RestrictRealtime = "yes";
         RestrictSUIDSGID = "yes";
-        MemoryDenyWriteExecute = "yes";
+        MemoryDenyWriteExecute = "no"; # v8 JIT requires memory segments to be Writable-Executable.
         LockPersonality = "yes";
       };
     };
diff --git a/nixos/tests/boot.nix b/nixos/tests/boot.nix
index bdae6341ec91..e8440598a822 100644
--- a/nixos/tests/boot.nix
+++ b/nixos/tests/boot.nix
@@ -4,10 +4,10 @@
 }:
 
 with import ../lib/testing-python.nix { inherit system pkgs; };
-with import ../lib/qemu-flags.nix { inherit pkgs; };
 with pkgs.lib;
 
 let
+  qemu-common = import ../lib/qemu-common.nix { inherit (pkgs) lib pkgs; };
 
   iso =
     (import ../lib/eval-config.nix {
@@ -23,7 +23,7 @@ let
   makeBootTest = name: extraConfig:
     let
       machineConfig = pythonDict ({
-        qemuBinary = qemuBinary pkgs.qemu_test;
+        qemuBinary = qemu-common.qemuBinary pkgs.qemu_test;
         qemuFlags = "-m 768";
       } // extraConfig);
     in
@@ -65,7 +65,7 @@ let
         ];
       };
       machineConfig = pythonDict ({
-        qemuBinary = qemuBinary pkgs.qemu_test;
+        qemuBinary = qemu-common.qemuBinary pkgs.qemu_test;
         qemuFlags = "-boot order=n -m 2000";
         netBackendArgs = "tftp=${ipxeBootDir},bootfile=netboot.ipxe";
       } // extraConfig);
diff --git a/nixos/tests/custom-ca.nix b/nixos/tests/custom-ca.nix
index 26f29a3e68fe..05cfbbb2fdf2 100644
--- a/nixos/tests/custom-ca.nix
+++ b/nixos/tests/custom-ca.nix
@@ -82,7 +82,7 @@ in
       # chromium-based browsers refuse to run as root
       test-support.displayManager.auto.user = "alice";
       # browsers may hang with the default memory
-      virtualisation.memorySize = "500";
+      virtualisation.memorySize = 500;
 
       networking.hosts."127.0.0.1" = [ "good.example.com" "bad.example.com" ];
       security.pki.certificateFiles = [ "${example-good-cert}/ca.crt" ];
@@ -113,7 +113,7 @@ in
         # which is why it will not use the system certificate store for the time being.
         # firefox
         chromium
-        falkon
+        qutebrowser
         midori
       ];
     };
@@ -152,21 +152,21 @@ in
     with subtest("Unknown CA is untrusted in curl"):
         machine.fail("curl -fv https://bad.example.com")
 
-    browsers = [
+    browsers = {
       # Firefox was disabled here, because we needed to disable p11-kit support in nss,
       # which is why it will not use the system certificate store for the time being.
-      # "firefox",
-      "chromium",
-      "falkon",
-      "midori"
-    ]
-    errors = ["Security Risk", "not private", "Certificate Error", "Security"]
+      #"firefox": "Security Risk",
+      "chromium": "not private",
+      "qutebrowser -T": "Certificate error",
+      "midori": "Security"
+    }
 
     machine.wait_for_x()
-    for browser, error in zip(browsers, errors):
+    for command, error in browsers.items():
+        browser = command.split()[0]
         with subtest("Good certificate is trusted in " + browser):
             execute_as(
-                "alice", f"env P11_KIT_DEBUG=trust {browser} https://good.example.com & >&2"
+                "alice", f"env P11_KIT_DEBUG=trust {command} https://good.example.com & >&2"
             )
             wait_for_window_as("alice", browser)
             machine.wait_for_text("It works!")
@@ -174,7 +174,7 @@ in
             execute_as("alice", "xdotool key ctrl+w")  # close tab
 
         with subtest("Unknown CA is untrusted in " + browser):
-            execute_as("alice", f"{browser} https://bad.example.com & >&2")
+            execute_as("alice", f"{command} https://bad.example.com & >&2")
             machine.wait_for_text(error)
             machine.screenshot("bad" + browser)
             machine.succeed("pkill " + browser)
diff --git a/nixos/tests/docker-tools.nix b/nixos/tests/docker-tools.nix
index a3ab5826960e..e482223436fa 100644
--- a/nixos/tests/docker-tools.nix
+++ b/nixos/tests/docker-tools.nix
@@ -119,7 +119,7 @@ import ./make-test-python.nix ({ pkgs, ... }: {
 
     with subtest("The pullImage tool works"):
         docker.succeed(
-            "docker load --input='${examples.nixFromDockerHub}'",
+            "docker load --input='${examples.testNixFromDockerHub}'",
             "docker run --rm nix:2.2.1 nix-store --version",
             "docker rmi nix:2.2.1",
         )
diff --git a/nixos/tests/firefox.nix b/nixos/tests/firefox.nix
index 4ad45c022407..dcaf369b62bd 100644
--- a/nixos/tests/firefox.nix
+++ b/nixos/tests/firefox.nix
@@ -14,7 +14,7 @@ import ./make-test-python.nix ({ pkgs, firefoxPackage, ... }: {
       ];
 
       # Need some more memory to record audio.
-      virtualisation.memorySize = "500";
+      virtualisation.memorySize = 500;
 
       # Create a virtual sound device, with mixing
       # and all, for recording audio.
diff --git a/pkgs/applications/editors/nano/nanorc/default.nix b/pkgs/applications/editors/nano/nanorc/default.nix
index fcec55871aa8..0675ceaba962 100644
--- a/pkgs/applications/editors/nano/nanorc/default.nix
+++ b/pkgs/applications/editors/nano/nanorc/default.nix
@@ -32,7 +32,6 @@ in stdenv.mkDerivation rec {
         git
         gnused
         nix
-        nixfmt
       ]
     }
     oldVersion="$(nix-instantiate --eval -E "with import ./. {}; lib.getVersion ${pname}" | tr -d '"' | sed 's|\\.|-|g')"
@@ -42,7 +41,6 @@ in stdenv.mkDerivation rec {
       default_nix="$nixpkgs/pkgs/applications/editors/nano/nanorc/default.nix"
       newTag=$(echo $latestTag | sed 's|\.|-|g')
       update-source-version ${pname} "$newTag" --version-key=version --print-changes
-      nixfmt "$default_nix"
     else
       echo "${pname} is already up-to-date"
     fi
diff --git a/pkgs/applications/graphics/qimgv/default.nix b/pkgs/applications/graphics/qimgv/default.nix
index 886a753ee2c3..d3a46482be52 100644
--- a/pkgs/applications/graphics/qimgv/default.nix
+++ b/pkgs/applications/graphics/qimgv/default.nix
@@ -16,13 +16,13 @@
 
 mkDerivation rec {
   pname = "qimgv";
-  version = "0.9.1";
+  version = "1.0.1";
 
   src = fetchFromGitHub {
     owner = "easymodo";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0b2hddps969gjim2r9a22zaxmnzp600av2zz6icq66ksfrx1rpac";
+    sha256 = "1wybpmqvj7vj7cl6r4gif7mkrcdr6zpb939mmz46xsil5vb4pirh";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/misc/dasel/default.nix b/pkgs/applications/misc/dasel/default.nix
index ba2e8819517a..a362481e974d 100644
--- a/pkgs/applications/misc/dasel/default.nix
+++ b/pkgs/applications/misc/dasel/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "dasel";
-  version = "1.20.0";
+  version = "1.21.0";
 
   src = fetchFromGitHub {
     owner = "TomWright";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-SJWIjizPf0bRwanpnLpuqsWKjaCwc1wBV2sCPSqGiOs=";
+    sha256 = "sha256-XomB//VX4ovE2AWh6wQxuGoLSSIxoXnxy4Agbip6PYw=";
   };
 
-  vendorSha256 = "sha256-u3KsMi63wOi1fCSLpGxATZNmbhoIAGeVpwcKh+nmi3k=";
+  vendorSha256 = "sha256-yP4iF3403WWgWAmBHiuOpDsIAUx4+KR8uKPfjy3qXt8=";
 
   ldflags = [
     "-s" "-w" "-X github.com/tomwright/dasel/internal.Version=${version}"
diff --git a/pkgs/applications/networking/cluster/kube3d/default.nix b/pkgs/applications/networking/cluster/kube3d/default.nix
index 3652405194f5..e37ba9e73fb8 100644
--- a/pkgs/applications/networking/cluster/kube3d/default.nix
+++ b/pkgs/applications/networking/cluster/kube3d/default.nix
@@ -1,14 +1,14 @@
-{ lib, buildGoModule, fetchFromGitHub, installShellFiles, k3sVersion ? "1.20.6-k3s1" }:
+{ lib, buildGoModule, fetchFromGitHub, installShellFiles, k3sVersion ? "1.21.3-k3s1" }:
 
 buildGoModule rec {
   pname = "kube3d";
-  version = "4.4.7";
+  version = "4.4.8";
 
   src = fetchFromGitHub {
     owner = "rancher";
     repo = "k3d";
     rev = "v${version}";
-    sha256 = "sha256-S1vHmXUCP1ayPo3vvHAbNCqNm1ueJ0jE4NUBvg5P3MU=";
+    sha256 = "sha256-PdbAkiua9AdcNDCpu4UILsmAz0nb4nLjahYomGSHqnc=";
   };
 
   vendorSha256 = null;
@@ -17,10 +17,9 @@ buildGoModule rec {
 
   excludedPackages = "\\(tools\\|docgen\\)";
 
-  ldflags = let t = "github.com/rancher/k3d/v4/version"; in
-    [
-      "-s" "-w" "-X ${t}.Version=v${version}" "-X ${t}.K3sVersion=v${k3sVersion}"
-    ];
+  ldflags =
+    let t = "github.com/rancher/k3d/v4/version"; in
+    [ "-s" "-w" "-X ${t}.Version=v${version}" "-X ${t}.K3sVersion=v${k3sVersion}" ];
 
   doCheck = false;
 
diff --git a/pkgs/applications/networking/cluster/terragrunt/default.nix b/pkgs/applications/networking/cluster/terragrunt/default.nix
index b238e5a4b71b..1c52f56437cc 100644
--- a/pkgs/applications/networking/cluster/terragrunt/default.nix
+++ b/pkgs/applications/networking/cluster/terragrunt/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "terragrunt";
-  version = "0.32.2";
+  version = "0.33.0";
 
   src = fetchFromGitHub {
     owner = "gruntwork-io";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-1s6/Xn/NsClG7YvRyzpvzMy8HmDITNCQUJxHaA84470=";
+    sha256 = "sha256-FvgB0jG6PEvhrT9Au/Uv9XSgKx+zNw8zETpg2dJ6QX4=";
   };
 
   vendorSha256 = "sha256-y84EFmoJS4SeA5YFIVFU0iWa5NnjU5yvOj7OFE+jGN0=";
diff --git a/pkgs/applications/networking/mpop/default.nix b/pkgs/applications/networking/mpop/default.nix
index 613226a2dc18..75f620ead9cf 100644
--- a/pkgs/applications/networking/mpop/default.nix
+++ b/pkgs/applications/networking/mpop/default.nix
@@ -4,11 +4,11 @@ with lib;
 
 stdenv.mkDerivation rec {
   pname = "mpop";
-  version = "1.4.13";
+  version = "1.4.14";
 
   src = fetchurl {
     url = "https://marlam.de/${pname}/releases/${pname}-${version}.tar.xz";
-    sha256 = "sha256-s0mEZsZbZQrdGm55IJsnuoY3VnOkXJalknvtaFoyfcE=";
+    sha256 = "046wbglvry54id9wik6c020fs09piv3gig3z0nh5nmyhsxjw4i18";
   };
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/applications/networking/onionshare/default.nix b/pkgs/applications/networking/onionshare/default.nix
index f80fb3a73953..074fb770b533 100644
--- a/pkgs/applications/networking/onionshare/default.nix
+++ b/pkgs/applications/networking/onionshare/default.nix
@@ -1,52 +1,52 @@
-{
-  lib,
-  buildPythonApplication,
-  substituteAll,
-  fetchFromGitHub,
-  isPy3k,
-  colorama,
-  flask,
-  flask-httpauth,
-  flask-socketio,
-  stem,
-  psutil,
-  pyqt5,
-  pycrypto,
-  pyside2,
-  pytestCheckHook,
-  qrcode,
-  qt5,
-  requests,
-  unidecode,
-  tor,
-  obfs4,
+{ lib
+, buildPythonApplication
+, substituteAll
+, fetchFromGitHub
+, isPy3k
+, colorama
+, flask
+, flask-httpauth
+, flask-socketio
+, stem
+, psutil
+, pyqt5
+, pycrypto
+, pynacl
+, pyside2
+, pytestCheckHook
+, qrcode
+, qt5
+, requests
+, unidecode
+, tor
+, obfs4
 }:
 
 let
-  version = "2.3.3";
+  version = "2.4";
   src = fetchFromGitHub {
-    owner = "micahflee";
+    owner = "onionshare";
     repo = "onionshare";
     rev = "v${version}";
-    sha256 = "sha256-wU2020RNXlwJ2y9uzcLxIX4EECev1Z9YvNyiBalLj/Y=";
+    sha256 = "sha256-Lclm7mIkaAkQpWcNILTRJtLA43dpiyHtWAeHS2r3+ZQ=";
   };
   meta = with lib; {
     description = "Securely and anonymously send and receive files";
     longDescription = ''
-    OnionShare is an open source tool for securely and anonymously sending
-    and receiving files using Tor onion services. It works by starting a web
-    server directly on your computer and making it accessible as an
-    unguessable Tor web address that others can load in Tor Browser to
-    download files from you, or upload files to you. It doesn't require
-    setting up a separate server, using a third party file-sharing service,
-    or even logging into an account.
+      OnionShare is an open source tool for securely and anonymously sending
+      and receiving files using Tor onion services. It works by starting a web
+      server directly on your computer and making it accessible as an
+      unguessable Tor web address that others can load in Tor Browser to
+      download files from you, or upload files to you. It doesn't require
+      setting up a separate server, using a third party file-sharing service,
+      or even logging into an account.
 
-    Unlike services like email, Google Drive, DropBox, WeTransfer, or nearly
-    any other way people typically send files to each other, when you use
-    OnionShare you don't give any companies access to the files that you're
-    sharing. So long as you share the unguessable web address in a secure way
-    (like pasting it in an encrypted messaging app), no one but you and the
-    person you're sharing with can access the files.
+      Unlike services like email, Google Drive, DropBox, WeTransfer, or nearly
+      any other way people typically send files to each other, when you use
+      OnionShare you don't give any companies access to the files that you're
+      sharing. So long as you share the unguessable web address in a secure way
+      (like pasting it in an encrypted messaging app), no one but you and the
+      person you're sharing with can access the files.
     '';
 
     homepage = "https://onionshare.org/";
@@ -54,8 +54,19 @@ let
     license = licenses.gpl3Plus;
     maintainers = with maintainers; [ lourkeur ];
   };
+  stem' = stem.overrideAttrs (_: rec {
+    version = "1.8.1";
 
-in rec {
+    src = fetchFromGitHub {
+      owner = "onionshare";
+      repo = "stem";
+      rev = version;
+      sha256 = "Dzpvx7CgAr5OtGmfubWAYDLqq5LkGqcwjr3bxpfL/3A=";
+    };
+  });
+
+in
+rec {
   onionshare = buildPythonApplication {
     pname = "onionshare-cli";
     inherit version meta;
@@ -74,9 +85,10 @@ in rec {
       flask
       flask-httpauth
       flask-socketio
-      stem
+      stem'
       psutil
       pycrypto
+      pynacl
       requests
       unidecode
     ];
@@ -98,6 +110,7 @@ in rec {
     disabledTests = [
       "test_firefox_like_behavior"
       "test_if_unmodified_since"
+      "test_get_tor_paths_linux"  # expects /usr instead of /nix/store
     ];
   };
 
diff --git a/pkgs/applications/science/logic/z3/default.nix b/pkgs/applications/science/logic/z3/default.nix
index e482a071bb43..4153ba5f66fc 100644
--- a/pkgs/applications/science/logic/z3/default.nix
+++ b/pkgs/applications/science/logic/z3/default.nix
@@ -19,13 +19,13 @@ with lib;
 
 stdenv.mkDerivation rec {
   pname = "z3";
-  version = "4.8.10";
+  version = "4.8.12";
 
   src = fetchFromGitHub {
     owner = "Z3Prover";
     repo = pname;
     rev = "z3-${version}";
-    sha256 = "1w1ym2l0gipvjx322npw7lhclv8rslq58gnj0d9i96masi3gbycf";
+    sha256 = "1wbcdc7h3mag8infspvxxja2hiz4igjwxzvss2kqar1rjj4ivfx0";
   };
 
   nativeBuildInputs = optional stdenv.hostPlatform.isDarwin fixDarwinDylibNames;
diff --git a/pkgs/applications/version-management/github-desktop/default.nix b/pkgs/applications/version-management/github-desktop/default.nix
index 650ec73619a6..5e8061c157c8 100644
--- a/pkgs/applications/version-management/github-desktop/default.nix
+++ b/pkgs/applications/version-management/github-desktop/default.nix
@@ -19,11 +19,11 @@
 
 stdenv.mkDerivation rec {
   pname = "github-desktop";
-  version = "2.9.0";
+  version = "2.9.3";
 
   src = fetchurl {
-    url = "https://github.com/shiftkey/desktop/releases/download/release-${version}-linux4/GitHubDesktop-linux-${version}-linux4.deb";
-    sha256 = "sha256-kyzvvzSCfo6uaTA0Z1yqAUjr4A5p3OuIpaVQv64WW7M";
+    url = "https://github.com/shiftkey/desktop/releases/download/release-${version}-linux1/GitHubDesktop-linux-${version}-linux1.deb";
+    sha256 = "sha256-e3XDjVQ5VcsS/MGxNsDs2h77joZAz8mNn+SwrqiUAR0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/video/obs-studio/plugins/obs-multi-rtmp.nix b/pkgs/applications/video/obs-studio/plugins/obs-multi-rtmp.nix
index 9985b7fd0f15..c78a8236bf25 100644
--- a/pkgs/applications/video/obs-studio/plugins/obs-multi-rtmp.nix
+++ b/pkgs/applications/video/obs-studio/plugins/obs-multi-rtmp.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "obs-multi-rtmp";
-  version = "0.2.6.1";
+  version = "0.2.7.1";
 
   src = fetchFromGitHub {
     owner = "sorayuki";
     repo = "obs-multi-rtmp";
     rev = version;
-    sha256 = "sha256-ZcvmiE9gbDUHAO36QAIaUdjV14ZfPabD9CW7Ogeqdro=";
+    sha256 = "sha256-pnSIbAWGufcWIARXpX/zwA/Ff35lrinFaMIdFY00c4Y=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/applications/virtualization/qemu/default.nix b/pkgs/applications/virtualization/qemu/default.nix
index c333510a63f0..a00d87f04473 100644
--- a/pkgs/applications/virtualization/qemu/default.nix
+++ b/pkgs/applications/virtualization/qemu/default.nix
@@ -50,7 +50,7 @@ stdenv.mkDerivation rec {
     sha256 = "15iw7982g6vc4jy1l9kk1z9sl5bm1bdbwr74y7nvwjs1nffhig7f";
   };
 
-  nativeBuildInputs = [ python python.pkgs.sphinx python.pkgs.sphinx_rtd_theme pkg-config flex bison meson ninja ]
+  nativeBuildInputs = [ makeWrapper python python.pkgs.sphinx python.pkgs.sphinx_rtd_theme pkg-config flex bison meson ninja ]
     ++ lib.optionals gtkSupport [ wrapGAppsHook ]
     ++ lib.optionals stdenv.isLinux [ autoPatchelfHook ]
     ++ lib.optionals stdenv.isDarwin [ sigtool ];
diff --git a/pkgs/build-support/docker/examples.nix b/pkgs/build-support/docker/examples.nix
index 6ec25711dd18..9f6823a58789 100644
--- a/pkgs/build-support/docker/examples.nix
+++ b/pkgs/build-support/docker/examples.nix
@@ -95,6 +95,15 @@ rec {
     finalImageTag = "2.2.1";
     finalImageName = "nix";
   };
+  # Same example, but re-fetches every time the fetcher implementation changes.
+  # NOTE: Only use this for testing, or you'd be wasting a lot of time, network and space.
+  testNixFromDockerHub = pkgs.invalidateFetcherByDrvHash pullImage {
+    imageName = "nixos/nix";
+    imageDigest = "sha256:85299d86263a3059cf19f419f9d286cc9f06d3c13146a8ebbb21b3437f598357";
+    sha256 = "19fw0n3wmddahzr20mhdqv6jkjn1kanh6n2mrr08ai53dr8ph5n7";
+    finalImageTag = "2.2.1";
+    finalImageName = "nix";
+  };
 
   # 5. example of multiple contents, emacs and vi happily coexisting
   editors = buildImage {
diff --git a/pkgs/development/interpreters/perl/default.nix b/pkgs/development/interpreters/perl/default.nix
index 98de7c71abca..7bc067c92c73 100644
--- a/pkgs/development/interpreters/perl/default.nix
+++ b/pkgs/development/interpreters/perl/default.nix
@@ -170,14 +170,14 @@ let
       priority = 6; # in `buildEnv' (including the one inside `perl.withPackages') the library files will have priority over files in `perl`
     };
   } // optionalAttrs (stdenv.buildPlatform != stdenv.hostPlatform) rec {
-    crossVersion = "01c176ac0f57d40cc3b6f8e441062780f073d952"; # Aug 22, 2021
+    crossVersion = "393821c7cf53774233aaf130ff2c8ccec701b0a9"; # Sep 22, 2021
 
     perl-cross-src = fetchFromGitHub {
       name = "perl-cross-${crossVersion}";
       owner = "arsv";
       repo = "perl-cross";
       rev = crossVersion;
-      sha256 = "19mwr1snwl4156rlhn74kmpl1wyc7ahhlrjfpnfcj3n63ic0c56y";
+      sha256 = "1fn35b1773aibi2z54m0mar7114737mvfyp81wkdwhakrmzr5nv1";
     };
 
     depsBuildBuild = [ buildPackages.stdenv.cc makeWrapper ];
@@ -214,7 +214,7 @@ in {
   perldevel = common {
     perl = pkgs.perldevel;
     buildPerl = buildPackages.perldevel;
-    version = "5.35.3";
-    sha256 = "06442zc5rvisl120f58jpy95bkf8f1cc4n577nzihdavlbfmnyyn";
+    version = "5.35.4";
+    sha256 = "1ss2r0qq5li6d2qghfv1iah5nl6nraymd7b7ib1iy1395rwyhl4q";
   };
 }
diff --git a/pkgs/development/libraries/libcyaml/default.nix b/pkgs/development/libraries/libcyaml/default.nix
index 0fabdb49ca11..26ac159646f1 100644
--- a/pkgs/development/libraries/libcyaml/default.nix
+++ b/pkgs/development/libraries/libcyaml/default.nix
@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libcyaml";
-  version = "1.2.0";
+  version = "1.2.1";
 
   src = fetchFromGitHub {
     owner = "tlsa";
     repo = "libcyaml";
     rev = "v${version}";
-    sha256 = "sha256-LtU1r95YoLuQ2JCphxbMojxKyXnt50XEARGUPftLgsU=";
+    sha256 = "sha256-u5yLrAXaavALNArj6yw+v5Yn4eqXWTHmUxHe+pVCbXM=";
   };
 
   buildInputs = [ libyaml ];
diff --git a/pkgs/development/libraries/opencv/default.nix b/pkgs/development/libraries/opencv/default.nix
index 005257780e40..ed2f700dc82e 100644
--- a/pkgs/development/libraries/opencv/default.nix
+++ b/pkgs/development/libraries/opencv/default.nix
@@ -9,6 +9,7 @@
 , enableFfmpeg ? false, ffmpeg
 , enableGStreamer ? false, gst_all_1
 , enableEigen ? true, eigen
+, enableUnfree ? false
 , Cocoa, QTKit
 }:
 
@@ -67,7 +68,7 @@ stdenv.mkDerivation rec {
     (opencvFlag "PNG" enablePNG)
     (opencvFlag "OPENEXR" enableEXR)
     (opencvFlag "GSTREAMER" enableGStreamer)
-  ];
+  ] ++ lib.optional (!enableUnfree) "-DBUILD_opencv_nonfree=OFF";
 
   hardeningDisable = [ "bindnow" "relro" ];
 
@@ -82,7 +83,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Open Computer Vision Library with more than 500 algorithms";
     homepage = "https://opencv.org/";
-    license = licenses.bsd3;
+    license = if enableUnfree then licenses.unfree else licenses.bsd3;
     maintainers = with maintainers; [ ];
     platforms = platforms.linux;
   };
diff --git a/pkgs/development/python-modules/class-registry/default.nix b/pkgs/development/python-modules/class-registry/default.nix
index 3faf07966d09..1accefe5f1e5 100644
--- a/pkgs/development/python-modules/class-registry/default.nix
+++ b/pkgs/development/python-modules/class-registry/default.nix
@@ -1,32 +1,32 @@
-{
-  buildPythonPackage,
-  fetchPypi,
-  lib,
-  nose,
-  six,
-  typing ? null,
-  isPy27,
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, nose
+, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "class-registry";
-  version = "2.1.2";
+  version = "3.0.5";
+  disabled = pythonOlder "3.5";
 
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "0zjf9nczl1ifzj07bgs6mwxsfd5xck9l0lchv2j0fv2n481xp2v7";
+  src = fetchFromGitHub {
+    owner = "todofixthis";
+    repo = pname;
+    rev = version;
+    sha256 = "0gpvq4a6qrr2iki6b4vxarjr1jrsw560m2qzm5bb43ix8c8b7y3q";
   };
 
-  propagatedBuildInputs = [ six ] ++ lib.optional isPy27 typing;
-  checkInputs = [ nose ];
+  checkInputs = [
+    nose
+  ];
 
-  # Tests currently failing.
-  doCheck = false;
+  pythonImportsCheck = [ "class_registry" ];
 
-  meta = {
-    description = "Factory+Registry pattern for Python classes.";
+  meta = with lib; {
+    description = "Factory and registry pattern for Python classes";
     homepage = "https://class-registry.readthedocs.io/en/latest/";
-    license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ kevincox ];
+    license = licenses.mit;
+    maintainers = with maintainers; [ kevincox ];
   };
 }
diff --git a/pkgs/development/python-modules/jsonrpclib-pelix/default.nix b/pkgs/development/python-modules/jsonrpclib-pelix/default.nix
index 570fb0a1d1a1..0ad388db3292 100644
--- a/pkgs/development/python-modules/jsonrpclib-pelix/default.nix
+++ b/pkgs/development/python-modules/jsonrpclib-pelix/default.nix
@@ -5,11 +5,11 @@
 
 buildPythonPackage rec {
   pname = "jsonrpclib-pelix";
-  version = "0.4.2";
+  version = "0.4.3.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "340915c17ebef7451948341542bf4789fc8d8c9fe604e86f00b722b6074a89f0";
+    sha256 = "f6f376c72ec1c0dfd69fcc2721d711f6ca1fe22bf71f99e6884c5e43e9b58c95";
   };
 
   doCheck = false; # test_suite="tests" in setup.py but no tests in pypi.
diff --git a/pkgs/development/python-modules/mitmproxy/default.nix b/pkgs/development/python-modules/mitmproxy/default.nix
index bd6ada6ecd10..4f31c512197d 100644
--- a/pkgs/development/python-modules/mitmproxy/default.nix
+++ b/pkgs/development/python-modules/mitmproxy/default.nix
@@ -45,14 +45,14 @@
 
 buildPythonPackage rec {
   pname = "mitmproxy";
-  version = "7.0.3";
+  version = "7.0.4";
   disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-j1lipshccPUpMR+o28hDyaJbrVgj6AHijFqOgVmrBkg=";
+    sha256 = "sha256-424WNG9Yj+Zfo1UTh7emknZ7xTtpFPz7Ph+FpE149FM=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/mypy-boto3-s3/default.nix b/pkgs/development/python-modules/mypy-boto3-s3/default.nix
index 645606ffc09d..e7544f44ea60 100644
--- a/pkgs/development/python-modules/mypy-boto3-s3/default.nix
+++ b/pkgs/development/python-modules/mypy-boto3-s3/default.nix
@@ -8,12 +8,12 @@
 
 buildPythonPackage rec {
   pname = "mypy-boto3-s3";
-  version = "1.18.48";
+  version = "1.18.50";
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "a14917021aac10432887b2acb634be8d66401ffb87cdb0fc271aff867929538c";
+    sha256 = "338052d36825c3ecb7575de16374b3c60f49129544120f463398545835af9cd0";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pglast/default.nix b/pkgs/development/python-modules/pglast/default.nix
index 019acbd65679..38acf736b74f 100644
--- a/pkgs/development/python-modules/pglast/default.nix
+++ b/pkgs/development/python-modules/pglast/default.nix
@@ -9,11 +9,11 @@
 
 buildPythonPackage rec {
   pname = "pglast";
-  version = "3.4";
+  version = "3.5";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "d2288d9607097a08529d9165970261c1be956934e8a8f6d9ed2a96d9b8f03fc6";
+    sha256 = "3bb74df084b149e8bf969380d88b1980fbd1aeda7f7057f4dee6751d854d6ae6";
   };
 
   disabled = !isPy3k;
diff --git a/pkgs/development/python-modules/pytest-console-scripts/default.nix b/pkgs/development/python-modules/pytest-console-scripts/default.nix
index aaecd191e93a..3005c26f77b5 100644
--- a/pkgs/development/python-modules/pytest-console-scripts/default.nix
+++ b/pkgs/development/python-modules/pytest-console-scripts/default.nix
@@ -9,11 +9,11 @@
 
 buildPythonPackage rec {
   pname = "pytest-console-scripts";
-  version = "1.2.0";
+  version = "1.2.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "4a2138d7d567bc581fe081b6a5975849a2a36b3925cb0f066d2380103e13741c";
+    sha256 = "c7f258025110f1337c23499c2f6674b873d4adba2438be55895edf01451c5ce3";
   };
   postPatch = ''
     # setuptools-scm is pinned to <6 because it dropped Python 3.5
diff --git a/pkgs/development/python-modules/python-engineio/default.nix b/pkgs/development/python-modules/python-engineio/default.nix
index 1b35f64bd7c0..7f51ccac6a72 100644
--- a/pkgs/development/python-modules/python-engineio/default.nix
+++ b/pkgs/development/python-modules/python-engineio/default.nix
@@ -16,13 +16,13 @@
 
 buildPythonPackage rec {
   pname = "python-engineio";
-  version = "4.2.0";
+  version = "4.2.1";
 
   src = fetchFromGitHub {
     owner = "miguelgrinberg";
     repo = "python-engineio";
     rev = "v${version}";
-    sha256 = "sha256-QfX8Volz5nabGVhQLXfSD/QooxLsU6DvCq1WRkRZ6hU=";
+    sha256 = "sha256-aAoTeQZCtxddVBPwlyv2j4aACMO9p0vQ/ESkkv4E3VE=";
   };
 
   checkInputs = [
diff --git a/pkgs/development/python-modules/python-socketio/default.nix b/pkgs/development/python-modules/python-socketio/default.nix
index 2b5c9c84a849..5a672b2dec64 100644
--- a/pkgs/development/python-modules/python-socketio/default.nix
+++ b/pkgs/development/python-modules/python-socketio/default.nix
@@ -3,19 +3,20 @@
 , buildPythonPackage
 , fetchFromGitHub
 , mock
+, msgpack
 , pytestCheckHook
 , python-engineio
 }:
 
 buildPythonPackage rec {
   pname = "python-socketio";
-  version = "5.3.0";
+  version = "5.4.0";
 
   src = fetchFromGitHub {
     owner = "miguelgrinberg";
     repo = "python-socketio";
     rev = "v${version}";
-    sha256 = "sha256-jyTTWxShLDDnbT+MYIJIjwpn3xfIB04je78doIOG+FQ=";
+    sha256 = "sha256-0Q1R8XPciU5AEkj7Exlc906eyA5juYKzzA/Ygnzx7XU=";
   };
 
   propagatedBuildInputs = [
@@ -25,6 +26,7 @@ buildPythonPackage rec {
 
   checkInputs = [
     mock
+    msgpack
     pytestCheckHook
   ];
 
diff --git a/pkgs/development/python-modules/pyupgrade/default.nix b/pkgs/development/python-modules/pyupgrade/default.nix
index 2b7b56a340d1..8e355699258d 100644
--- a/pkgs/development/python-modules/pyupgrade/default.nix
+++ b/pkgs/development/python-modules/pyupgrade/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "pyupgrade";
-  version = "2.27.0";
+  version = "2.29.0";
   disabled = pythonOlder "3.6";
 
   src = fetchFromGitHub {
     owner = "asottile";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1j14m4mdvpq740bxz3mhs5k02jfp425xig4yb13drx37p4yyl9zn";
+    sha256 = "sha256-Hq58DJe8ZLZSJdhqSxfTaZPnWae2aQFCe7lH+6Y6ABg=";
   };
 
   checkInputs = [ pytestCheckHook ];
diff --git a/pkgs/development/python-modules/sense-energy/default.nix b/pkgs/development/python-modules/sense-energy/default.nix
index a3cd63d485ea..d3b027924c52 100644
--- a/pkgs/development/python-modules/sense-energy/default.nix
+++ b/pkgs/development/python-modules/sense-energy/default.nix
@@ -9,13 +9,13 @@
 
 buildPythonPackage rec {
   pname = "sense-energy";
-  version = "0.9.0";
+  version = "0.9.2";
 
   src = fetchFromGitHub {
     owner = "scottbonline";
     repo = "sense";
     rev = version;
-    sha256 = "1lbarsa9wpm7hnhgf2g253w0gs80cn989dnj4aqmic57x5isikhz";
+    sha256 = "sha256-XZvx/GWpz49dsiY9pgMfX+6gUfWA8q6IpnzmCRPFHus=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/vt-py/default.nix b/pkgs/development/python-modules/vt-py/default.nix
new file mode 100644
index 000000000000..e208e3a76822
--- /dev/null
+++ b/pkgs/development/python-modules/vt-py/default.nix
@@ -0,0 +1,47 @@
+{ lib
+, aiohttp
+, buildPythonPackage
+, fetchFromGitHub
+, pytest-asyncio
+, pytest-httpserver
+, pytestCheckHook
+, pythonOlder
+}:
+
+buildPythonPackage rec {
+  pname = "vt-py";
+  version = "0.7.4";
+
+  disabled = pythonOlder "3.6";
+
+  src = fetchFromGitHub {
+    owner = "VirusTotal";
+    repo = pname;
+    rev = version;
+    sha256 = "149fgrqnwf8nyv3msj6p614zbdi7m7s785y3fvh8fm8k7lmgqk8w";
+  };
+
+  propagatedBuildInputs = [
+    aiohttp
+  ];
+
+  checkInputs = [
+    pytest-asyncio
+    pytest-httpserver
+    pytestCheckHook
+  ];
+
+  postPatch = ''
+    substituteInPlace setup.py \
+      --replace "'pytest-runner'" ""
+  '';
+
+  pythonImportsCheck = [ "vt" ];
+
+  meta = with lib; {
+    description = "Python client library for VirusTotal";
+    homepage = "https://virustotal.github.io/vt-py/";
+    license = with licenses; [ asl20 ];
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/development/python-modules/youtube-search-python/default.nix b/pkgs/development/python-modules/youtube-search-python/default.nix
index 8f31c892d0d8..8c1010552206 100644
--- a/pkgs/development/python-modules/youtube-search-python/default.nix
+++ b/pkgs/development/python-modules/youtube-search-python/default.nix
@@ -2,13 +2,13 @@
 
 buildPythonPackage rec {
   pname = "youtube-search-python";
-  version = "1.4.8";
+  version = "1.4.9";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "aafa940d77ecd37bb7af802da53caed9be8861c6abe3004abb04315155b4a3ad";
+    sha256 = "9c75540d41f6dcfd19f2f70fbe8346406e026a016aae56b87c207a0b4ff571e0";
   };
 
   propagatedBuildInputs = [ httpx ];
diff --git a/pkgs/development/tools/just/default.nix b/pkgs/development/tools/just/default.nix
index 9e852793ab7a..8306092c5318 100644
--- a/pkgs/development/tools/just/default.nix
+++ b/pkgs/development/tools/just/default.nix
@@ -2,15 +2,15 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "just";
-  version = "0.10.1";
+  version = "0.10.2";
 
   src = fetchFromGitHub {
     owner = "casey";
     repo = pname;
     rev = version;
-    sha256 = "sha256-KC/m+I4uOBS0bJb5yvxSkj+1Jlq+bekLTqHlz4vqv8I=";
+    sha256 = "sha256-AR1bNsyex+kfXdiSF3QgeqK8qwIssLfaaY0qNhnp7ak=";
   };
-  cargoSha256 = "sha256-et7V7orw2msv30nJ9sntzEQoeN1YqhHMnHOUt4a6e2I=";
+  cargoSha256 = "sha256-Ukhp8mPXD/dDolfSugOCVwRMgkjmDRCoNzthgqrN6p0=";
 
   nativeBuildInputs = [ installShellFiles ];
   buildInputs = lib.optionals stdenv.isDarwin [ libiconv ];
diff --git a/pkgs/development/tools/protoc-gen-doc/default.nix b/pkgs/development/tools/protoc-gen-doc/default.nix
index 1a1991be9499..4774d1a11d5c 100644
--- a/pkgs/development/tools/protoc-gen-doc/default.nix
+++ b/pkgs/development/tools/protoc-gen-doc/default.nix
@@ -1,17 +1,17 @@
 { buildGoModule, fetchFromGitHub, lib }:
 
-buildGoModule {
+buildGoModule rec {
   pname = "protoc-gen-doc-unstable";
-  version = "2019-04-22";
+  version = "1.5.0";
 
   src = fetchFromGitHub {
     owner = "pseudomuto";
     repo = "protoc-gen-doc";
-    rev = "f824a8908ce33f213b2dba1bf7be83384c5c51e8";
-    sha256 = "004axh2gqc4f115mdxxg59d19hph3rr0bq9d08n3nyl315f590kj";
+    rev = "v${version}";
+    sha256 = "1bpb5wv76p0sjffh5d1frbygp3q1p07sdh5c8pznl5bdh5pd7zxq";
   };
 
-  vendorSha256 = "17qdpsff8jk7ks5v6ix1rb966x3yvq03vk5bs2zbnxfdra7bv3n6";
+  vendorSha256 = "08pk9nxsl28dw3qmrlb7vsm8xbdzmx98qwkxgg93ykrhzx235k1b";
 
   doCheck = false;
 
diff --git a/pkgs/development/tools/rust/roogle/default.nix b/pkgs/development/tools/rust/roogle/default.nix
new file mode 100644
index 000000000000..7def38d19913
--- /dev/null
+++ b/pkgs/development/tools/rust/roogle/default.nix
@@ -0,0 +1,27 @@
+{ lib, rustPlatform, fetchFromGitHub }:
+
+rustPlatform.buildRustPackage rec {
+  pname = "roogle";
+  version = "0.1.4";
+
+  src = fetchFromGitHub {
+    owner = "hkmatsumoto";
+    repo = pname;
+    rev = version;
+    sha256 = "1h0agialbvhhiijkdnr47y7babq432limdl6ag2rmjfs7yishn4r";
+  };
+
+  cargoSha256 = "sha256-CzFfFKTmBUAafk8PkkWmUkRIyO+yEhmCfN1zsLRq4Iw=";
+
+  postInstall = ''
+    mkdir -p $out/share/roogle
+    cp -r assets $out/share/roogle
+  '';
+
+  meta = with lib; {
+    description = "A Rust API search engine which allows you to search functions by names and type signatures";
+    homepage = "https://github.com/hkmatsumoto/roogle";
+    license = with licenses; [ mit /* or */ asl20 ];
+    maintainers = with maintainers; [ figsoda ];
+  };
+}
diff --git a/pkgs/development/web/nodejs/v14.nix b/pkgs/development/web/nodejs/v14.nix
index 1ec04407f899..cb8d8aac3632 100644
--- a/pkgs/development/web/nodejs/v14.nix
+++ b/pkgs/development/web/nodejs/v14.nix
@@ -7,7 +7,7 @@ let
 in
   buildNodejs {
     inherit enableNpm;
-    version = "14.17.6";
-    sha256 = "0pmd0haav2ychhcsw44klx6wfn8c7j1rsw08rc8hcm5i3h5wsn7l";
+    version = "14.18.0";
+    sha256 = "0naqv0aglsqy51pyiz42xz7wx5pfsbyscpdl8rir6kmfl1c52j3b";
     patches = lib.optional stdenv.isDarwin ./bypass-xcodebuild.diff;
   }
diff --git a/pkgs/os-specific/linux/kernel/linux-zen.nix b/pkgs/os-specific/linux/kernel/linux-zen.nix
index 1c064059047e..df740845b6ff 100644
--- a/pkgs/os-specific/linux/kernel/linux-zen.nix
+++ b/pkgs/os-specific/linux/kernel/linux-zen.nix
@@ -2,7 +2,7 @@
 
 let
   # having the full version string here makes it easier to update
-  modDirVersion = "5.14.3-zen1";
+  modDirVersion = "5.14.8-zen1";
   parts = lib.splitString "-" modDirVersion;
   version = lib.elemAt parts 0;
   suffix = lib.elemAt parts 1;
@@ -19,7 +19,7 @@ buildLinux (args // {
     owner = "zen-kernel";
     repo = "zen-kernel";
     rev = "v${modDirVersion}";
-    sha256 = "sha256-ByewBT+1z83jCuEMmNvtmhHaEk4qjHa2Kgue8wVfPIY=";
+    sha256 = "sha256-hquMBDjP4fBMNdjxxnJJKx/oVNd2DwBPmVpZQeEQvHQ=";
   };
 
   structuredExtraConfig = with lib.kernel; {
diff --git a/pkgs/servers/sql/postgresql/ext/pgroonga.nix b/pkgs/servers/sql/postgresql/ext/pgroonga.nix
index f93a15f6b4c2..02a5f4fe1353 100644
--- a/pkgs/servers/sql/postgresql/ext/pgroonga.nix
+++ b/pkgs/servers/sql/postgresql/ext/pgroonga.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "pgroonga";
-  version = "2.3.0";
+  version = "2.3.1";
 
   src = fetchurl {
     url = "https://packages.groonga.org/source/${pname}/${pname}-${version}.tar.gz";
-    sha256 = "1wdm4wwwv7n73fi330szcnyf25zhvj6dgy839aawh84ik118yg2v";
+    sha256 = "0v102hbszq52jvydj2qrysfs1g46wv4vmgwaa9zj0pvknh58lb43";
   };
 
   nativeBuildInputs = [ pkg-config ];
@@ -16,7 +16,8 @@ stdenv.mkDerivation rec {
 
   installPhase = ''
     install -D pgroonga.so -t $out/lib/
-    install -D ./{pgroonga-*.sql,pgroonga.control} -t $out/share/postgresql/extension
+    install -D pgroonga.control -t $out/share/postgresql/extension
+    install -D data/pgroonga-*.sql -t $out/share/postgresql/extension
   '';
 
   meta = with lib; {
diff --git a/pkgs/tools/filesystems/ceph/default.nix b/pkgs/tools/filesystems/ceph/default.nix
index 426aff81f069..0f28ad144169 100644
--- a/pkgs/tools/filesystems/ceph/default.nix
+++ b/pkgs/tools/filesystems/ceph/default.nix
@@ -146,10 +146,10 @@ let
   ]);
   sitePackages = ceph-python-env.python.sitePackages;
 
-  version = "16.2.5";
+  version = "16.2.6";
   src = fetchurl {
     url = "http://download.ceph.com/tarballs/ceph-${version}.tar.gz";
-    sha256 = "sha256-uCBpFvp5k+A5SgwxoJVkuGb9E69paKrs3qda5RpsRt4=";
+    sha256 = "sha256-TXGyZnyVTYAf7G7BcTv3dAfK/54JfOKObcyTRhCrnYA=";
   };
 in rec {
   ceph = stdenv.mkDerivation {
diff --git a/pkgs/tools/graphics/pfstools/default.nix b/pkgs/tools/graphics/pfstools/default.nix
index 99b9e3e0e487..a81321204757 100644
--- a/pkgs/tools/graphics/pfstools/default.nix
+++ b/pkgs/tools/graphics/pfstools/default.nix
@@ -1,6 +1,7 @@
 { lib, stdenv, mkDerivation, fetchurl, cmake, pkg-config, darwin
 , openexr, zlib, imagemagick6, libGLU, libGL, freeglut, fftwFloat
-, fftw, gsl, libexif, perl, opencv2, qtbase, netpbm
+, fftw, gsl, libexif, perl, qtbase, netpbm
+, enableUnfree ? false, opencv2
 }:
 
 mkDerivation rec {
@@ -28,12 +29,12 @@ mkDerivation rec {
   nativeBuildInputs = [ cmake pkg-config ];
   buildInputs = [
     openexr zlib imagemagick6 fftwFloat
-    fftw gsl libexif perl opencv2 qtbase netpbm
+    fftw gsl libexif perl qtbase netpbm
   ] ++ (if stdenv.isDarwin then (with darwin.apple_sdk.frameworks; [
     OpenGL GLUT
   ]) else [
     libGLU libGL freeglut
-  ]);
+  ]) ++ lib.optional enableUnfree (opencv2.override { enableUnfree = true; });
 
   patches = [ ./threads.patch ./pfstools.patch ./pfsalign.patch ];
 
diff --git a/pkgs/tools/graphics/pngquant/default.nix b/pkgs/tools/graphics/pngquant/default.nix
index 7463e2a45e03..b2b0691718a9 100644
--- a/pkgs/tools/graphics/pngquant/default.nix
+++ b/pkgs/tools/graphics/pngquant/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "pngquant";
-  version = "2.14.1";
+  version = "2.16.0";
 
   src = fetchFromGitHub {
     owner = "kornelski";
     repo = "pngquant";
     rev = version;
-    sha256 = "054hi33qp3jc7hv0141wi8drwdg24v5zfp8znwjmz4mcdls8vxbb";
+    sha256 = "0ny6h3fwf6gvzkqkc3zb5mrkqxm6s7xzb6bvzn6vlamklncqgl78";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/tools/inputmethods/lisgd/default.nix b/pkgs/tools/inputmethods/lisgd/default.nix
index 8b26e35c0541..368f1efa7593 100644
--- a/pkgs/tools/inputmethods/lisgd/default.nix
+++ b/pkgs/tools/inputmethods/lisgd/default.nix
@@ -4,19 +4,20 @@
 , writeText
 , libinput
 , libX11
+, wayland
 , conf ? null
 , patches ? [ ]
 }:
 
 stdenv.mkDerivation rec {
   pname = "lisgd";
-  version = "0.3.1";
+  version = "0.3.2";
 
   src = fetchFromSourcehut {
     owner = "~mil";
     repo = "lisgd";
     rev = version;
-    sha256 = "sha256-A8SsF5k4GwfVCj8JtodNWoLdPzaA9YsoP5EHHakUguc=";
+    sha256 = "sha256-yE2CUv1XDvo8fW0bLS1O2oxgDUu4drCO3jFpxPgAYKU=";
   };
 
   inherit patches;
@@ -33,6 +34,7 @@ stdenv.mkDerivation rec {
   buildInputs = [
     libinput
     libX11
+    wayland
   ];
 
   makeFlags = [
diff --git a/pkgs/tools/misc/neofetch/default.nix b/pkgs/tools/misc/neofetch/default.nix
index 3d4bf8500ba2..77af8d5d788b 100644
--- a/pkgs/tools/misc/neofetch/default.nix
+++ b/pkgs/tools/misc/neofetch/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenvNoCC, fetchFromGitHub, bash, makeWrapper, pciutils
-, x11Support ? true, ueberzug
+, x11Support ? true, ueberzug, fetchpatch
 }:
 
 stdenvNoCC.mkDerivation rec {
@@ -13,6 +13,14 @@ stdenvNoCC.mkDerivation rec {
     sha256 = "sha256-PZjFF/K7bvPIjGVoGqaoR8pWE6Di/qJVKFNcIz7G8xE=";
   };
 
+  patches = [
+    (fetchpatch {
+      url = "https://github.com/dylanaraps/neofetch/commit/413c32e55dc16f0360f8e84af2b59fe45505f81b.patch";
+      sha256 = "1fapdg9z79f0j3vw7fgi72b54aw4brn42bjsj48brbvg3ixsciph";
+      name = "avoid_overwriting_gio_extra_modules_env_var.patch";
+    })
+  ];
+
   strictDeps = true;
   buildInputs = [ bash ];
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/tools/security/ioccheck/default.nix b/pkgs/tools/security/ioccheck/default.nix
new file mode 100644
index 000000000000..1ad7bfd85fe2
--- /dev/null
+++ b/pkgs/tools/security/ioccheck/default.nix
@@ -0,0 +1,57 @@
+{ lib
+, fetchFromGitHub
+, python3
+}:
+
+python3.pkgs.buildPythonApplication rec {
+  pname = "ioccheck";
+  version = "unstable-2021-09-29";
+  format = "pyproject";
+
+  disabled = python3.pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "ranguli";
+    repo = pname;
+    rev = "db02d921e2519b77523a200ca2d78417802463db";
+    sha256 = "0lgqypcd5lzb2yqd5lr02pba24m26ghly4immxgz13svi8f6vzm9";
+  };
+
+  nativeBuildInputs = with python3.pkgs; [
+    poetry-core
+  ];
+
+  propagatedBuildInputs = with python3.pkgs; [
+    backoff
+    click
+    emoji
+    jinja2
+    pyfiglet
+    ratelimit
+    requests
+    shodan
+    tabulate
+    termcolor
+    tweepy
+    vt-py
+  ];
+
+  checkInputs = with python3.pkgs; [
+    pytestCheckHook
+  ];
+
+  postPatch = ''
+    # Can be removed with the next release
+    substituteInPlace pyproject.toml \
+      --replace '"hurry.filesize" = "^0.9"' ""
+  '';
+
+  pythonImportsCheck = [ "ioccheck" ];
+
+  meta = with lib; {
+    description = "Tool for researching IOCs";
+    homepage = "https://github.com/ranguli/ioccheck";
+    license = with licenses; [ mit ];
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 44f3a57d738c..e8e0b07f89e5 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -618,7 +618,15 @@ with pkgs;
       drvPath = (f args).drvPath;
       # It's safe to discard the context, because we don't access the path.
       salt = builtins.unsafeDiscardStringContext (lib.substring 0 12 (baseNameOf drvPath));
-    in f (args // { name = "${args.name or "source"}-salted-${salt}"; });
+      # New derivation incorporating the original drv hash in the name
+      salted = f (args // { name = "${args.name or "source"}-salted-${salt}"; });
+      # Make sure we did change the derivation. If the fetcher ignores `name`,
+      # `invalidateFetcherByDrvHash` doesn't work.
+      checked =
+        if salted.drvPath == drvPath
+        then throw "invalidateFetcherByDrvHash: Adding the derivation hash to the fixed-output derivation name had no effect. Make sure the fetcher's name argument ends up in the derivation name. Otherwise, the fetcher will not be re-run when its implementation changes. This is important for testing."
+        else salted;
+    in checked;
 
   lazydocker = callPackage ../tools/misc/lazydocker { };
 
@@ -6233,6 +6241,8 @@ with pkgs;
 
   iodine = callPackage ../tools/networking/iodine { };
 
+  ioccheck = callPackage ../tools/security/ioccheck { };
+
   ioping = callPackage ../tools/system/ioping { };
 
   iops = callPackage ../tools/system/iops { };
@@ -12544,6 +12554,7 @@ with pkgs;
 
   rhack = callPackage ../development/tools/rust/rhack { };
   inherit (rustPackages) rls;
+  roogle = callPackage ../development/tools/rust/roogle { };
   rustfmt = rustPackages.rustfmt;
   rustracer = callPackage ../development/tools/rust/racer {
     inherit (darwin.apple_sdk.frameworks) Security;
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 9e2d3710b76b..d5ad5cfc9ebd 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -9488,6 +9488,8 @@ in {
 
   vsure = callPackage ../development/python-modules/vsure { };
 
+  vt-py = callPackage ../development/python-modules/vt-py { };
+
   vtk = toPythonModule (pkgs.vtk.override {
     pythonInterpreter = python;
     enablePython = true;