From 51e09efdfc5ded20f30237abb07868a9414a684d Mon Sep 17 00:00:00 2001
From: Default email <noreply+nixpkgs@lukegb.com>
Date: Thu, 3 Dec 2020 09:41:04 +0100
Subject: [PATCH] Project import generated by Copybara.

GitOrigin-RevId: 296793637b22bdb4d23b479879eba0a71c132a66
---
 third_party/nixpkgs/.github/CODEOWNERS        |    1 +
 .../.github/workflows/merge-staging.yml       |   39 +
 .../doc/builders/packages/emacs.section.md    |  119 ++
 .../nixpkgs/doc/builders/packages/emacs.xml   |  131 --
 .../doc/builders/packages/firefox.section.md  |   40 +
 .../nixpkgs/doc/builders/packages/index.xml   |   13 +-
 .../doc/builders/packages/linux.section.md    |   41 +
 .../nixpkgs/doc/builders/packages/linux.xml   |   85 --
 .../doc/builders/packages/nginx.section.md    |   11 +
 .../nixpkgs/doc/builders/packages/nginx.xml   |   25 -
 .../doc/builders/packages/opengl.section.md   |   15 +
 .../nixpkgs/doc/builders/packages/opengl.xml  |    9 -
 .../doc/builders/packages/weechat.section.md  |   85 ++
 .../nixpkgs/doc/builders/packages/weechat.xml |   85 --
 .../doc/builders/packages/xorg.section.md     |   34 +
 .../nixpkgs/doc/builders/packages/xorg.xml    |   34 -
 .../contributing/reviewing-contributions.xml  |   10 +-
 .../doc/languages-frameworks/coq.section.md   |   40 +
 .../nixpkgs/doc/languages-frameworks/coq.xml  |   52 -
 .../doc/languages-frameworks/index.xml        |    6 +-
 .../doc/languages-frameworks/java.section.md  |   91 ++
 .../nixpkgs/doc/languages-frameworks/java.xml |   77 --
 .../languages-frameworks/texlive.section.md   |  128 ++
 .../doc/languages-frameworks/texlive.xml      |  152 ---
 third_party/nixpkgs/doc/using/overlays.xml    |    1 +
 third_party/nixpkgs/lib/modules.nix           |    4 +-
 third_party/nixpkgs/lib/systems/default.nix   |    2 +-
 third_party/nixpkgs/lib/systems/examples.nix  |   11 +-
 third_party/nixpkgs/lib/systems/platforms.nix |   49 +-
 .../nixpkgs/maintainers/maintainer-list.nix   |   38 +
 .../doc/manual/installation/installing.xml    |    9 +-
 .../doc/manual/release-notes/rl-2103.xml      |   26 +
 .../modules/installer/cd-dvd/sd-image.nix     |    3 +-
 .../nixpkgs/nixos/modules/module-list.nix     |    1 +
 .../nixpkgs/nixos/modules/security/doas.nix   |   11 +
 .../nixos/modules/security/hidepid.nix        |    4 +
 .../modules/services/cluster/k3s/default.nix  |    4 +
 .../modules/services/development/hoogle.nix   |    4 +-
 .../nixos/modules/services/hardware/sane.nix  |    2 +-
 .../nixos/modules/services/logging/vector.nix |   61 +
 .../nixos/modules/services/mail/rspamd.nix    |   48 +-
 .../nixos/modules/services/networking/nat.nix |  120 +-
 .../modules/services/networking/tailscale.nix |   11 +-
 .../nixos/modules/system/boot/systemd.nix     |    9 +
 .../nixos/modules/virtualisation/docker.nix   |    3 +
 third_party/nixpkgs/nixos/tests/all-tests.nix |   44 +-
 .../nixpkgs/nixos/tests/docker-tools.nix      |    3 +-
 third_party/nixpkgs/nixos/tests/gitea.nix     |    1 +
 third_party/nixpkgs/nixos/tests/misc.nix      |    4 +-
 third_party/nixpkgs/nixos/tests/podman.nix    |   33 +-
 third_party/nixpkgs/nixos/tests/rspamd.nix    |   58 +-
 third_party/nixpkgs/nixos/tests/systemd.nix   |   35 +-
 third_party/nixpkgs/nixos/tests/ucg.nix       |   18 +
 third_party/nixpkgs/nixos/tests/vector.nix    |   37 +
 .../applications/audio/cadence/default.nix    |    2 +
 .../audio/littlegptracker/default.nix         |    3 +
 .../applications/audio/openmpt123/default.nix |    4 +-
 .../applications/backup/deja-dup/default.nix  |    4 +-
 .../blockchains/btcpayserver/default.nix      |   26 +-
 .../blockchains/btcpayserver/deps.nix         |   29 +-
 .../blockchains/exodus/default.nix            |    4 +-
 .../blockchains/nbxplorer/default.nix         |    4 +-
 .../blockchains/nbxplorer/deps.nix            |   37 +-
 .../editors/jetbrains/default.nix             |   28 +-
 .../editors/kakoune/plugins/default.nix       |    1 +
 .../editors/kakoune/plugins/openscad.kak.nix  |   25 +
 .../applications/editors/nano/default.nix     |    4 +-
 .../pkgs/applications/gis/qgis/unwrapped.nix  |    3 +
 .../applications/graphics/avocode/default.nix |    4 +-
 .../applications/graphics/feh/default.nix     |    4 +-
 .../applications/graphics/fondo/default.nix   |    4 +-
 .../graphics/imgbrd-grabber/default.nix       |    9 +-
 .../applications/graphics/imgp/default.nix    |    4 +-
 .../applications/graphics/meme/default.nix    |   12 +-
 .../applications/graphics/pqiv/default.nix    |    4 +-
 .../graphics/renderdoc/default.nix            |    4 +-
 .../applications/misc/archivy/default.nix     |   57 +
 .../misc/cpp-ethereum/default.nix             |   85 --
 .../pkgs/applications/misc/dasel/default.nix  |    4 +-
 .../applications/misc/dbeaver/default.nix     |    4 +-
 .../applications/misc/gollum/Gemfile.lock     |    6 +-
 .../pkgs/applications/misc/gollum/gemset.nix  |    8 +-
 .../pkgs/applications/misc/gpx/default.nix    |    4 +-
 .../pkgs/applications/misc/hugo/default.nix   |    6 +-
 .../applications/misc/ideamaker/default.nix   |   77 ++
 .../pkgs/applications/misc/keeweb/default.nix |    6 +-
 .../pkgs/applications/misc/lyx/default.nix    |    4 +-
 .../pkgs/applications/misc/navi/default.nix   |    6 +-
 .../applications/misc/obsidian/default.nix    |    4 +-
 .../pkgs/applications/misc/pueue/default.nix  |    6 +-
 .../networking/browsers/brave/default.nix     |    2 +-
 .../browsers/chromium/upstream-info.json      |    6 +-
 .../networking/browsers/firefox/common.nix    |    1 +
 .../networking/browsers/firefox/packages.nix  |   15 +-
 .../networking/browsers/firefox/wrapper.nix   |  170 ++-
 .../networking/browsers/palemoon/default.nix  |    4 +-
 .../networking/cluster/istioctl/default.nix   |    6 +-
 .../terraform-providers/update-provider       |  187 ++-
 .../feedreaders/rssguard/default.nix          |    4 +-
 .../instant-messengers/toxic/default.nix      |    4 +-
 .../instant-messengers/zulip/default.nix      |    6 +-
 .../mailreaders/inboxer/default.nix           |    4 +-
 .../networking/p2p/magnetico/default.nix      |    6 +-
 .../networking/seaweedfs/default.nix          |    4 +-
 .../networking/syncthing/default.nix          |    6 +-
 .../applications/networking/twtxt/default.nix |   24 +
 .../pkgs/applications/office/fava/default.nix |    4 +-
 .../science/biology/ants/default.nix          |    4 +-
 .../science/biology/bwa/default.nix           |    8 +-
 .../science/biology/hmmer/default.nix         |    4 +-
 .../science/chemistry/openmolcas/default.nix  |    2 +-
 .../science/logic/abc/default.nix             |    8 +-
 .../science/logic/boolector/default.nix       |   54 +-
 .../science/logic/btor2tools/default.nix      |    4 +-
 .../science/math/gmsh/default.nix             |    4 +-
 .../science/math/gretl/default.nix            |    4 +-
 .../version-management/bumpver/default.nix    |   29 +
 .../git-and-tools/git-secret/default.nix      |    4 +-
 .../version-management/git-repo/default.nix   |    4 +-
 .../version-management/gitea/default.nix      |    4 +-
 .../version-management/gitkraken/default.nix  |    4 +-
 .../version-management/pijul/default.nix      |    6 +-
 .../sparkleshare/default.nix                  |    4 +-
 .../applications/video/clipgrab/default.nix   |    4 +-
 .../video/openshot-qt/default.nix             |    3 +
 .../applications/video/qmplay2/default.nix    |   74 ++
 .../applications/video/shotcut/default.nix    |    4 +-
 .../virtualization/containerd/default.nix     |    6 +-
 .../virtualization/docker/default.nix         |    8 +-
 .../virtualization/podman/default.nix         |    4 +-
 .../virtualization/qemu/default.nix           |   15 +
 .../bintools-wrapper/default.nix              |    3 +-
 .../pkgs/build-support/docker/default.nix     |   31 +-
 .../pkgs/build-support/docker/examples.nix    |   17 +-
 .../build-support/docker/nix-prefetch-docker  |   14 +-
 .../fetchfirefoxaddon/default.nix             |   37 +
 .../setup-hooks/reproducible-builds.sh        |    4 +
 .../nixpkgs/pkgs/data/fonts/iosevka/bin.nix   |    2 +-
 .../pkgs/data/fonts/iosevka/variants.nix      |   42 +-
 .../pkgs/data/fonts/unifont_upper/default.nix |    4 +-
 .../misc/spdx-license-list-data/default.nix   |    4 +-
 .../pkgs/data/themes/mojave/default.nix       |    4 +-
 .../pkgs/data/themes/vimix/default.nix        |    4 +-
 .../cinnamon/cinnamon-desktop/default.nix     |    4 +-
 .../cinnamon/cinnamon-menus/default.nix       |    4 +-
 .../cinnamon/cinnamon-session/default.nix     |    4 +-
 .../cinnamon-translations/default.nix         |    4 +-
 .../gnome-3/apps/gnome-boxes/default.nix      |    4 +-
 .../gnome-3/extensions/gsconnect/default.nix  |   20 +-
 .../gnome-3/misc/gnome-tweaks/default.nix     |   69 +-
 .../arduino/arduino-mk/default.nix            |   14 +-
 .../adoptopenjdk-bin/generate-sources.py      |    2 +-
 .../adoptopenjdk-bin/jdk-linux-base.nix       |    2 +-
 .../adoptopenjdk-bin/jdk14-darwin.nix         |    9 +
 .../adoptopenjdk-bin/jdk14-linux.nix          |    9 +
 .../adoptopenjdk-bin/jdk15-darwin.nix         |    9 +
 .../adoptopenjdk-bin/jdk15-linux.nix          |    9 +
 .../compilers/adoptopenjdk-bin/sources.json   |  508 ++++++--
 .../development/compilers/edk2/default.nix    |    4 +-
 .../pkgs/development/compilers/ghc/8.6.5.nix  |    6 +-
 .../compilers/llvm/rocm/default.nix           |    4 +-
 .../development/compilers/lobster/default.nix |    7 +-
 .../development/compilers/nextpnr/default.nix |    6 +-
 .../development/compilers/qbe/default.nix     |    1 -
 .../compilers/rust/{1_47.nix => 1_48.nix}     |   22 +-
 .../pkgs/development/compilers/rust/rustc.nix |    7 +-
 .../development/compilers/unison/default.nix  |    5 +-
 .../development/compilers/yosys/default.nix   |    6 +-
 .../coq-modules/coq-ext-lib/default.nix       |   48 +-
 .../guile-modules/guile-cairo/default.nix     |    4 +-
 .../dhall/build-dhall-directory-package.nix   |   13 +-
 .../dhall/build-dhall-github-package.nix      |   47 +-
 .../dhall/build-dhall-package.nix             |   18 +-
 .../interpreters/icon-lang/default.nix        |   41 +-
 .../interpreters/octave/default.nix           |    4 +-
 .../pkgs/development/interpreters/php/8.0.nix |   17 +
 .../php/fix-opcache-configure.patch           |   81 ++
 .../development/interpreters/php/generic.nix  |    3 +-
 .../interpreters/python/default.nix           |    2 +-
 .../interpreters/python/hooks/default.nix     |    3 +-
 .../python/hooks/pip-install-hook.sh          |    2 +-
 .../python/hooks/python-namespaces-hook.sh    |   13 +-
 .../python/mk-python-derivation.nix           |    4 +-
 .../development/interpreters/python/tests.nix |    5 +-
 .../development/libraries/aml/default.nix     |    1 +
 .../libraries/appstream/default.nix           |    4 +-
 .../development/libraries/avahi/default.nix   |   19 +-
 .../libraries/bctoolbox/default.nix           |    4 +-
 .../pkgs/development/libraries/botan/2.0.nix  |    4 +-
 .../development/libraries/c-ares/default.nix  |    7 +-
 .../development/libraries/c-blosc/default.nix |    2 +-
 .../libraries/cyrus-sasl/default.nix          |    3 +-
 .../libraries/gdk-pixbuf/default.nix          |   19 +-
 .../development/libraries/glib/default.nix    |    4 +-
 .../development/libraries/glibc/common.nix    |    4 +
 .../pkgs/development/libraries/gmp/6.x.nix    |    4 +-
 .../libraries/gstreamer/bad/default.nix       |   14 +-
 .../libraries/gstreamer/base/default.nix      |    4 +-
 .../libraries/gstreamer/core/default.nix      |    4 +-
 .../libraries/gstreamer/devtools/default.nix  |    4 +-
 .../libraries/gstreamer/ges/default.nix       |    4 +-
 .../libraries/gstreamer/good/default.nix      |    4 +-
 .../libraries/gstreamer/libav/default.nix     |    4 +-
 .../gstreamer/rtsp-server/default.nix         |    4 +-
 .../libraries/gstreamer/ugly/default.nix      |    4 +-
 .../libraries/gstreamer/vaapi/default.nix     |    4 +-
 .../libraries/gtk-layer-shell/default.nix     |    4 +-
 .../libraries/intel-media-driver/default.nix  |    4 +-
 .../libraries/libamqpcpp/default.nix          |    4 +-
 .../development/libraries/libcork/default.nix |   45 +
 .../libraries/libdevil/default.nix            |    2 +-
 .../development/libraries/libdrm/default.nix  |    4 +-
 .../libraries/libfprint/default.nix           |    4 +-
 .../libraries/libimobiledevice/default.nix    |    2 +-
 .../libraries/libirecovery/default.nix        |    2 +-
 .../libraries/libmanette/default.nix          |   18 +-
 .../libraries/libplist/default.nix            |    2 +-
 .../libraries/libproxy/default.nix            |   11 +
 .../libraries/libseccomp/default.nix          |    9 +-
 .../libraries/libsecret/default.nix           |    4 +-
 .../libraries/libslirp/default.nix            |   10 +
 .../libraries/libusbmuxd/default.nix          |    2 +-
 .../development/libraries/nco/default.nix     |    4 +-
 .../libraries/oniguruma/default.nix           |    4 +-
 .../libraries/openxr-loader/default.nix       |    4 +-
 .../development/libraries/rocclr/default.nix  |    4 +-
 .../libraries/rocm-comgr/default.nix          |    4 +-
 .../libraries/rocm-device-libs/default.nix    |    4 +-
 .../libraries/rocm-opencl-runtime/default.nix |    4 +-
 .../libraries/rocm-runtime/default.nix        |    4 +-
 .../libraries/rocm-thunk/default.nix          |    4 +-
 .../development/libraries/spdlog/default.nix  |   10 +-
 .../development/libraries/sqlite/analyzer.nix |   31 -
 .../development/libraries/talloc/default.nix  |   14 +-
 .../development/libraries/tdlib/default.nix   |   10 +-
 .../libraries/tinyobjloader/default.nix       |   26 +
 .../development/node-packages/default.nix     |    4 +
 .../node-packages/node-packages.json          |    1 +
 .../node-packages/node-packages.nix           | 1073 +++++++++--------
 .../ocaml-modules/angstrom-async/default.nix  |    2 +-
 .../angstrom-lwt-unix/default.nix             |    2 +-
 .../ocaml-modules/angstrom-unix/default.nix   |    2 +-
 .../ocaml-modules/angstrom/default.nix        |    4 +-
 .../ocaml-modules/astring/default.nix         |   23 +-
 .../ocaml-modules/bigstringaf/default.nix     |    6 +-
 .../ocaml-modules/ctypes/default.nix          |    4 +-
 .../ocaml-modules/earlybird/default.nix       |    2 +
 .../ocaml-modules/functoria/default.nix       |   10 +-
 .../ocaml-modules/functoria/runtime.nix       |    2 +-
 .../ocaml-modules/integers/default.nix        |    4 +-
 .../development/ocaml-modules/ke/default.nix  |    4 +-
 .../ocaml-modules/mirage/runtime.nix          |    4 +-
 .../ocaml-modules/mirage/types-lwt.nix        |   13 +
 .../ocaml-modules/mirage/types.nix            |   19 +
 .../php-packages/couchbase/default.nix        |    3 +-
 .../php-packages/imagick/default.nix          |   10 +-
 .../php-packages/phpstan/default.nix          |    4 +-
 .../php-packages/redis/default.nix            |    3 +-
 .../development/php-packages/yaml/default.nix |    4 +-
 .../python-modules/Wand/default.nix           |    4 +-
 .../python-modules/bitstruct/default.nix      |    4 +-
 .../python-modules/blessed/default.nix        |    4 +-
 .../python-modules/blis/default.nix           |    5 +-
 .../python-modules/bme680/default.nix         |    1 +
 .../python-modules/bsddb3/default.nix         |    4 +-
 .../python-modules/bumps/default.nix          |    4 +-
 .../python-modules/cftime/default.nix         |   25 +-
 .../python-modules/colander/default.nix       |    4 +-
 .../colanderalchemy/default.nix               |   20 +-
 .../python-modules/cryptography/default.nix   |   11 +-
 .../python-modules/docplex/default.nix        |    4 +-
 .../python-modules/fastjsonschema/default.nix |    4 +-
 .../flake8-debugger/default.nix               |   19 +-
 .../python-modules/goobook/default.nix        |    8 +-
 .../google_cloud_container/default.nix        |    4 +-
 .../google_cloud_secret_manager/default.nix   |    8 +-
 .../python-modules/grpcio-tools/default.nix   |    2 +
 .../python-modules/grpcio/default.nix         |    2 +
 .../python-modules/ircrobots/default.nix      |    7 +-
 .../python-modules/ircstates/default.nix      |    4 +-
 .../python-modules/jaraco_classes/default.nix |    2 +
 .../jaraco_collections/default.nix            |    2 +
 .../jaraco_functools/default.nix              |    2 +
 .../jaraco_itertools/default.nix              |    2 +
 .../python-modules/jaraco_logging/default.nix |    2 +
 .../python-modules/jaraco_stream/default.nix  |    4 +
 .../python-modules/jaraco_text/default.nix    |    2 +
 .../python-modules/lexid/default.nix          |   22 +
 .../python-modules/mac_alias/default.nix      |    4 +-
 .../python-modules/memcached/default.nix      |    5 +-
 .../python-modules/nipype/default.nix         |    4 +-
 .../python-modules/numexpr/default.nix        |   10 +-
 .../python-modules/openrazer/common.nix       |    4 +-
 .../python-modules/pip-tools/default.nix      |    4 +-
 .../python-modules/pproxy/default.nix         |    6 +-
 .../python-modules/pybind11/default.nix       |    4 +-
 .../python-modules/pybullet/default.nix       |    4 +-
 .../python-modules/pyflakes/default.nix       |    5 +-
 .../python-modules/pylatexenc/default.nix     |    6 +-
 .../python-modules/pymavlink/default.nix      |    4 +-
 .../python-modules/pyosf/default.nix          |   34 +
 .../python-modules/pysbd/default.nix          |   31 +
 .../python-modules/pyserial/default.nix       |    4 +-
 .../python-modules/pytest-testmon/default.nix |    4 +-
 .../python-frontmatter/default.nix            |   30 +
 .../python-modules/qiskit-aer/default.nix     |   56 +-
 .../python-modules/qiskit-aqua/default.nix    |   49 +-
 .../qiskit-ibmq-provider/default.nix          |   49 +-
 .../python-modules/qiskit-ignis/default.nix   |   25 +-
 .../python-modules/qiskit-terra/default.nix   |   76 +-
 .../python-modules/qiskit/default.nix         |   10 +-
 .../python-modules/retworkx/default.nix       |   23 +-
 .../python-modules/seccomp/default.nix        |   29 +
 .../python-modules/smart_open/default.nix     |    4 +-
 .../python-modules/sphinx/default.nix         |    4 +-
 .../python-modules/tensorflow/1/bin.nix       |    5 +-
 .../python-modules/tensorflow/2/bin.nix       |    4 +-
 .../tinyobjloader-py/default.nix              |   21 +
 .../python-modules/transformers/default.nix   |   11 +-
 .../python-modules/vispy/default.nix          |    4 +-
 .../python-modules/zstd/default.nix           |    3 +-
 .../development/ruby-modules/gem/default.nix  |    7 +-
 .../ruby-modules/rbenv/default.nix            |   41 +
 .../tools/analysis/checkstyle/default.nix     |    4 +-
 .../tools/analysis/codeql/default.nix         |    4 +-
 .../build-managers/rocm-cmake/default.nix     |    4 +-
 .../continuous-integration/fly/default.nix    |    4 +-
 .../development/tools/errcheck/default.nix    |   16 +-
 .../pkgs/development/tools/errcheck/deps.nix  |   20 -
 .../pkgs/development/tools/flyway/default.nix |    4 +-
 .../development/tools/go-migrate/default.nix  |    6 +-
 .../pkgs/development/tools/kubie/default.nix  |    6 +-
 .../tools/misc/blackfire/php-probe.nix        |    5 +-
 .../tools/misc/gengetopt/default.nix          |    4 +
 .../tools/misc/macdylibbundler/default.nix    |    9 +-
 .../tools/ocaml/obelisk/default.nix           |   26 +-
 .../poetry2nix/poetry2nix/bin/poetry2nix      |  166 ++-
 .../tools/poetry2nix/poetry2nix/default.nix   |    2 +-
 .../poetry2nix/poetry2nix/hooks/default.nix   |    6 +-
 .../poetry2nix/poetry2nix/mk-poetry-dep.nix   |   27 +-
 .../tools/poetry2nix/poetry2nix/overrides.nix |  134 +-
 .../tools/poetry2nix/poetry2nix/pep425.nix    |    2 +-
 .../poetry2nix/pkgs/poetry/default.nix        |    4 +-
 .../poetry2nix/pkgs/poetry/pyproject.toml     |    2 +-
 .../poetry2nix/pkgs/poetry/src.json           |    4 +-
 .../tools/poetry2nix/poetry2nix/plugins.nix   |    1 +
 .../development/tools/the-way/default.nix     |    6 +-
 .../development/tools/trellis/default.nix     |   13 +-
 .../pkgs/development/web/flyctl/default.nix   |    4 +-
 .../pkgs/development/web/insomnia/default.nix |    6 +-
 .../nixpkgs/pkgs/games/factorio/versions.json |   16 +-
 .../nixpkgs/pkgs/games/freeciv/default.nix    |    4 +-
 .../nixpkgs/pkgs/games/mindustry/default.nix  |   24 +-
 .../nixpkgs/pkgs/games/osu-lazer/default.nix  |    4 +-
 .../nixpkgs/pkgs/games/osu-lazer/deps.nix     |   60 +-
 .../pkgs/misc/emulators/hatari/default.nix    |    7 +-
 .../misc/emulators/lambda-delta/default.nix   |   26 +
 .../pkgs/misc/emulators/ruffle/default.nix    |   49 +
 .../pkgs/misc/tmux-plugins/default.nix        |   53 +
 .../nixpkgs/pkgs/misc/tpm2-pkcs11/default.nix |    4 +-
 .../pkgs/misc/vscode-extensions/default.nix   |   17 +-
 .../pkgs/os-specific/linux/ell/default.nix    |    4 +-
 .../linux/firmware/sof-firmware/default.nix   |   14 +-
 .../pkgs/os-specific/linux/iwd/default.nix    |    4 +-
 .../linux/kernel-headers/default.nix          |    4 +-
 .../os-specific/linux/kernel/linux-4.14.nix   |    4 +-
 .../os-specific/linux/kernel/linux-4.19.nix   |    4 +-
 .../os-specific/linux/kernel/linux-4.4.nix    |    4 +-
 .../os-specific/linux/kernel/linux-4.9.nix    |    4 +-
 .../os-specific/linux/kernel/linux-5.4.nix    |    4 +-
 .../os-specific/linux/kernel/linux-5.9.nix    |    4 +-
 .../linux/kernel/linux-testing.nix            |    4 +-
 .../os-specific/linux/libselinux/default.nix  |   20 +-
 .../os-specific/linux/libsepol/default.nix    |    6 +-
 .../pkgs/os-specific/linux/musl/default.nix   |    6 +
 .../os-specific/linux/nvidia-x11/default.nix  |    8 +-
 .../pkgs/os-specific/linux/pcm/default.nix    |    4 +-
 .../os-specific/linux/systemd/default.nix     |    6 +-
 .../pkgs/os-specific/linux/zfs/default.nix    |   25 +-
 .../nixpkgs/pkgs/servers/consul/default.nix   |    6 +-
 .../servers/documize-community/default.nix    |    6 +-
 .../nixpkgs/pkgs/servers/gotify/default.nix   |    6 +
 .../servers/http/gitlab-pages/default.nix     |    6 +-
 .../pkgs/servers/http/lighttpd/default.nix    |    4 +-
 .../pkgs/servers/http/openresty/default.nix   |   18 +-
 .../nixpkgs/pkgs/servers/jackett/default.nix  |    4 +-
 .../pkgs/servers/mail/postsrsd/default.nix    |    4 +-
 .../servers/monitoring/thanos/default.nix     |    4 +-
 .../servers/nats-streaming-server/default.nix |    4 +-
 .../pkgs/servers/nosql/cassandra/generic.nix  |    2 +-
 .../nixpkgs/pkgs/servers/peach/default.nix    |   22 +
 .../nixpkgs/pkgs/servers/pinnwand/default.nix |    2 +-
 third_party/nixpkgs/pkgs/servers/plex/raw.nix |   31 +-
 .../nixpkgs/pkgs/servers/pounce/default.nix   |    4 +-
 .../pkgs/servers/routinator/default.nix       |    6 +-
 .../servers/rtsp-simple-server/default.nix    |    6 +-
 .../nixpkgs/pkgs/servers/sabnzbd/default.nix  |    4 +-
 .../pkgs/servers/sql/postgresql/default.nix   |   25 +-
 .../patches/stabilize-timetz-dst.patch        |  117 --
 .../nixpkgs/pkgs/servers/tarssh/default.nix   |    6 +-
 .../nixpkgs/pkgs/servers/unifi/default.nix    |    4 +-
 .../nixpkgs/pkgs/servers/x11/xorg/default.nix |   17 +-
 .../x11/xorg/generate-expr-from-tarballs.pl   |    4 +-
 .../pkgs/servers/x11/xorg/overrides.nix       |   14 +-
 .../pkgs/servers/x11/xorg/tarballs.list       |    2 +-
 .../nixpkgs/pkgs/shells/oil/default.nix       |    4 +-
 .../nixpkgs/pkgs/stdenv/generic/default.nix   |    1 +
 .../stdenv/linux/make-bootstrap-tools.nix     |   12 +
 .../pkgs/tools/admin/awscli2/default.nix      |    2 +-
 .../pkgs/tools/admin/procs/default.nix        |    6 +-
 .../pkgs/tools/admin/trivy/default.nix        |    7 +-
 .../pkgs/tools/audio/abcmidi/default.nix      |    4 +-
 .../nixpkgs/pkgs/tools/audio/tts/default.nix  |  123 ++
 .../pkgs/tools/backup/wal-g/default.nix       |    6 +-
 .../pkgs/tools/filesystems/ceph/default.nix   |    5 +-
 .../tools/filesystems/mergerfs/default.nix    |    4 +-
 .../ibus-engines/ibus-rime/default.nix        |   44 +
 .../nixpkgs/pkgs/tools/misc/archi/default.nix |   61 +
 .../nixpkgs/pkgs/tools/misc/broot/default.nix |    6 +-
 .../pkgs/tools/misc/cht.sh/default.nix        |    4 +-
 .../nixpkgs/pkgs/tools/misc/fend/default.nix  |    6 +-
 .../pkgs/tools/misc/fluent-bit/default.nix    |    4 +-
 .../pkgs/tools/misc/geekbench/default.nix     |    4 +-
 .../pkgs/tools/misc/goreleaser/default.nix    |    6 +-
 .../pkgs/tools/misc/hdl-dump/default.nix      |   35 +
 .../tools/misc/idevicerestore/default.nix     |    7 +-
 .../pkgs/tools/misc/rmtrash/default.nix       |    4 +-
 .../pkgs/tools/misc/spigot/default.nix        |    6 +-
 .../pkgs/tools/misc/toybox/default.nix        |    6 +-
 .../pkgs/tools/misc/vector/default.nix        |    2 +-
 .../pkgs/tools/misc/youtube-dl/default.nix    |    4 +-
 .../tools/networking/gnirehtet/default.nix    |   25 +-
 .../tools/networking/gnirehtet/paths.patch    |   48 -
 .../pkgs/tools/networking/gping/default.nix   |    6 +-
 .../pkgs/tools/networking/haproxy/default.nix |    4 +-
 .../pkgs/tools/networking/i2pd/default.nix    |    4 +-
 .../tools/networking/minio-client/default.nix |    6 +-
 .../networking/modem-manager/default.nix      |    4 +-
 .../pkgs/tools/networking/openssh/default.nix |    3 +
 .../openssh/ssh-copy-id-fix-eof.patch         |   21 +
 .../networking/tridactyl-native/default.nix   |    4 +-
 .../tools/package-management/nfpm/default.nix |    6 +-
 .../tools/package-management/nix/default.nix  |    6 +-
 .../tools/security/1password-gui/default.nix  |   13 +-
 .../security/bash-supergenpass/default.nix    |   15 +-
 .../pkgs/tools/security/doas/default.nix      |    6 +-
 .../tools/security/volatility/default.nix     |   12 +-
 .../pkgs/tools/system/daemon/default.nix      |   21 +-
 .../pkgs/tools/system/rocm-smi/default.nix    |    4 +-
 .../pkgs/tools/text/gnugrep/default.nix       |    4 +-
 .../pkgs/tools/text/miller/default.nix        |    4 +-
 .../pkgs/tools/text/pbgopy/default.nix        |   22 +
 .../pkgs/tools/text/rst2html5/default.nix     |   21 +-
 .../nixpkgs/pkgs/tools/text/shfmt/default.nix |    4 +-
 .../nixpkgs/pkgs/tools/text/ucg/default.nix   |   40 +
 .../nixpkgs/pkgs/tools/text/vale/default.nix  |    4 +-
 .../pkgs/tools/typesetting/pdftk/default.nix  |   25 +-
 .../pkgs/tools/typesetting/pdftk/legacy.nix   |    1 +
 .../tools/typesetting/skribilo/default.nix    |   31 +-
 .../tools/typesetting/tex/texlive/bin.nix     |   22 +-
 .../pkgs/tools/typesetting/xmlto/default.nix  |    5 +-
 .../nixpkgs/pkgs/top-level/aliases.nix        |    2 +
 .../nixpkgs/pkgs/top-level/all-packages.nix   |  164 ++-
 .../nixpkgs/pkgs/top-level/ocaml-packages.nix |    4 +
 .../nixpkgs/pkgs/top-level/perl-packages.nix  |   16 +-
 .../nixpkgs/pkgs/top-level/php-packages.nix   |   16 +-
 .../pkgs/top-level/python-packages.nix        |   16 +-
 .../nixpkgs/pkgs/top-level/release-lib.nix    |    4 +-
 third_party/nixpkgs/pkgs/top-level/stage.nix  |    3 +
 469 files changed, 5841 insertions(+), 3111 deletions(-)
 create mode 100644 third_party/nixpkgs/.github/workflows/merge-staging.yml
 create mode 100644 third_party/nixpkgs/doc/builders/packages/emacs.section.md
 delete mode 100644 third_party/nixpkgs/doc/builders/packages/emacs.xml
 create mode 100644 third_party/nixpkgs/doc/builders/packages/firefox.section.md
 create mode 100644 third_party/nixpkgs/doc/builders/packages/linux.section.md
 delete mode 100644 third_party/nixpkgs/doc/builders/packages/linux.xml
 create mode 100644 third_party/nixpkgs/doc/builders/packages/nginx.section.md
 delete mode 100644 third_party/nixpkgs/doc/builders/packages/nginx.xml
 create mode 100644 third_party/nixpkgs/doc/builders/packages/opengl.section.md
 delete mode 100644 third_party/nixpkgs/doc/builders/packages/opengl.xml
 create mode 100644 third_party/nixpkgs/doc/builders/packages/weechat.section.md
 delete mode 100644 third_party/nixpkgs/doc/builders/packages/weechat.xml
 create mode 100644 third_party/nixpkgs/doc/builders/packages/xorg.section.md
 delete mode 100644 third_party/nixpkgs/doc/builders/packages/xorg.xml
 create mode 100644 third_party/nixpkgs/doc/languages-frameworks/coq.section.md
 delete mode 100644 third_party/nixpkgs/doc/languages-frameworks/coq.xml
 create mode 100644 third_party/nixpkgs/doc/languages-frameworks/java.section.md
 delete mode 100644 third_party/nixpkgs/doc/languages-frameworks/java.xml
 create mode 100644 third_party/nixpkgs/doc/languages-frameworks/texlive.section.md
 delete mode 100644 third_party/nixpkgs/doc/languages-frameworks/texlive.xml
 create mode 100644 third_party/nixpkgs/nixos/modules/services/logging/vector.nix
 create mode 100644 third_party/nixpkgs/nixos/tests/ucg.nix
 create mode 100644 third_party/nixpkgs/nixos/tests/vector.nix
 create mode 100644 third_party/nixpkgs/pkgs/applications/editors/kakoune/plugins/openscad.kak.nix
 create mode 100644 third_party/nixpkgs/pkgs/applications/misc/archivy/default.nix
 delete mode 100644 third_party/nixpkgs/pkgs/applications/misc/cpp-ethereum/default.nix
 create mode 100644 third_party/nixpkgs/pkgs/applications/misc/ideamaker/default.nix
 create mode 100644 third_party/nixpkgs/pkgs/applications/networking/twtxt/default.nix
 create mode 100644 third_party/nixpkgs/pkgs/applications/version-management/bumpver/default.nix
 create mode 100644 third_party/nixpkgs/pkgs/applications/video/qmplay2/default.nix
 create mode 100644 third_party/nixpkgs/pkgs/build-support/fetchfirefoxaddon/default.nix
 create mode 100644 third_party/nixpkgs/pkgs/build-support/setup-hooks/reproducible-builds.sh
 create mode 100644 third_party/nixpkgs/pkgs/development/compilers/adoptopenjdk-bin/jdk14-darwin.nix
 create mode 100644 third_party/nixpkgs/pkgs/development/compilers/adoptopenjdk-bin/jdk14-linux.nix
 create mode 100644 third_party/nixpkgs/pkgs/development/compilers/adoptopenjdk-bin/jdk15-darwin.nix
 create mode 100644 third_party/nixpkgs/pkgs/development/compilers/adoptopenjdk-bin/jdk15-linux.nix
 rename third_party/nixpkgs/pkgs/development/compilers/rust/{1_47.nix => 1_48.nix} (55%)
 create mode 100644 third_party/nixpkgs/pkgs/development/interpreters/php/8.0.nix
 create mode 100644 third_party/nixpkgs/pkgs/development/interpreters/php/fix-opcache-configure.patch
 create mode 100644 third_party/nixpkgs/pkgs/development/libraries/libcork/default.nix
 delete mode 100644 third_party/nixpkgs/pkgs/development/libraries/sqlite/analyzer.nix
 create mode 100644 third_party/nixpkgs/pkgs/development/libraries/tinyobjloader/default.nix
 create mode 100644 third_party/nixpkgs/pkgs/development/ocaml-modules/mirage/types-lwt.nix
 create mode 100644 third_party/nixpkgs/pkgs/development/ocaml-modules/mirage/types.nix
 create mode 100644 third_party/nixpkgs/pkgs/development/python-modules/lexid/default.nix
 create mode 100644 third_party/nixpkgs/pkgs/development/python-modules/pyosf/default.nix
 create mode 100644 third_party/nixpkgs/pkgs/development/python-modules/pysbd/default.nix
 create mode 100644 third_party/nixpkgs/pkgs/development/python-modules/python-frontmatter/default.nix
 create mode 100644 third_party/nixpkgs/pkgs/development/python-modules/seccomp/default.nix
 create mode 100644 third_party/nixpkgs/pkgs/development/python-modules/tinyobjloader-py/default.nix
 create mode 100644 third_party/nixpkgs/pkgs/development/ruby-modules/rbenv/default.nix
 delete mode 100644 third_party/nixpkgs/pkgs/development/tools/errcheck/deps.nix
 create mode 100644 third_party/nixpkgs/pkgs/misc/emulators/lambda-delta/default.nix
 create mode 100644 third_party/nixpkgs/pkgs/misc/emulators/ruffle/default.nix
 create mode 100644 third_party/nixpkgs/pkgs/servers/peach/default.nix
 delete mode 100644 third_party/nixpkgs/pkgs/servers/sql/postgresql/patches/stabilize-timetz-dst.patch
 create mode 100644 third_party/nixpkgs/pkgs/tools/audio/tts/default.nix
 create mode 100644 third_party/nixpkgs/pkgs/tools/inputmethods/ibus-engines/ibus-rime/default.nix
 create mode 100644 third_party/nixpkgs/pkgs/tools/misc/archi/default.nix
 create mode 100644 third_party/nixpkgs/pkgs/tools/misc/hdl-dump/default.nix
 delete mode 100644 third_party/nixpkgs/pkgs/tools/networking/gnirehtet/paths.patch
 create mode 100644 third_party/nixpkgs/pkgs/tools/networking/openssh/ssh-copy-id-fix-eof.patch
 create mode 100644 third_party/nixpkgs/pkgs/tools/text/pbgopy/default.nix
 create mode 100644 third_party/nixpkgs/pkgs/tools/text/ucg/default.nix

diff --git a/third_party/nixpkgs/.github/CODEOWNERS b/third_party/nixpkgs/.github/CODEOWNERS
index 20668760d2..9835b76546 100644
--- a/third_party/nixpkgs/.github/CODEOWNERS
+++ b/third_party/nixpkgs/.github/CODEOWNERS
@@ -12,6 +12,7 @@
 
 # GitHub actions
 /.github/workflows @Mic92 @zowoq
+/.github/workflows/merge-staging @FRidh
 
 # EditorConfig
 /.editorconfig @Mic92 @zowoq
diff --git a/third_party/nixpkgs/.github/workflows/merge-staging.yml b/third_party/nixpkgs/.github/workflows/merge-staging.yml
new file mode 100644
index 0000000000..1aadef1632
--- /dev/null
+++ b/third_party/nixpkgs/.github/workflows/merge-staging.yml
@@ -0,0 +1,39 @@
+name: "merge staging(-next)"
+
+on:
+  schedule:
+    # * is a special character in YAML so you have to quote this string
+    # Merge every 6 hours
+    - cron:  '0 */6 * * *'
+
+jobs:
+  sync-branch:
+    if: github.repository == 'NixOS/nixpkgs'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+
+      - name: Merge master into staging-next
+        uses: devmasx/merge-branch@v1.3.1
+        with:
+          type: now
+          from_branch: master
+          target_branch: staging-next
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Merge staging-next into staging
+        uses: devmasx/merge-branch@v1.3.1
+        with:
+          type: now
+          from_branch: staging-next
+          target_branch: staging
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Comment on failure
+        uses: peter-evans/create-or-update-comment@v1
+        if: ${{ failure() }}
+        with:
+          issue-number: 105153
+          body: |
+            An automatic merge [failed](https://github.com/NixOS/nixpkgs/actions/runs/${{ github.run_id }}).
+
diff --git a/third_party/nixpkgs/doc/builders/packages/emacs.section.md b/third_party/nixpkgs/doc/builders/packages/emacs.section.md
new file mode 100644
index 0000000000..3829b3575b
--- /dev/null
+++ b/third_party/nixpkgs/doc/builders/packages/emacs.section.md
@@ -0,0 +1,119 @@
+# Emacs {#sec-emacs}
+
+## Configuring Emacs
+
+The Emacs package comes with some extra helpers to make it easier to configure. `emacsWithPackages` allows you to manage packages from ELPA. This means that you will not have to install that packages from within Emacs. For instance, if you wanted to use `company` `counsel`, `flycheck`, `ivy`, `magit`, `projectile`, and `use-package` you could use this as a `~/.config/nixpkgs/config.nix` override:
+
+```nix
+{
+  packageOverrides = pkgs: with pkgs; {
+    myEmacs = emacsWithPackages (epkgs: (with epkgs.melpaStablePackages; [
+      company
+      counsel
+      flycheck
+      ivy
+      magit
+      projectile
+      use-package
+    ]));
+  }
+}
+```
+
+You can install it like any other packages via `nix-env -iA myEmacs`. However, this will only install those packages. It will not `configure` them for us. To do this, we need to provide a configuration file. Luckily, it is possible to do this from within Nix! By modifying the above example, we can make Emacs load a custom config file. The key is to create a package that provide a `default.el` file in `/share/emacs/site-start/`. Emacs knows to load this file automatically when it starts.
+
+```nix
+{
+  packageOverrides = pkgs: with pkgs; rec {
+    myEmacsConfig = writeText "default.el" ''
+      ;; initialize package
+
+      (require 'package)
+      (package-initialize 'noactivate)
+      (eval-when-compile
+        (require 'use-package))
+
+      ;; load some packages
+
+      (use-package company
+        :bind ("&lt;C-tab&gt;" . company-complete)
+        :diminish company-mode
+        :commands (company-mode global-company-mode)
+        :defer 1
+        :config
+        (global-company-mode))
+
+      (use-package counsel
+        :commands (counsel-descbinds)
+        :bind (([remap execute-extended-command] . counsel-M-x)
+               ("C-x C-f" . counsel-find-file)
+               ("C-c g" . counsel-git)
+               ("C-c j" . counsel-git-grep)
+               ("C-c k" . counsel-ag)
+               ("C-x l" . counsel-locate)
+               ("M-y" . counsel-yank-pop)))
+
+      (use-package flycheck
+        :defer 2
+        :config (global-flycheck-mode))
+
+      (use-package ivy
+        :defer 1
+        :bind (("C-c C-r" . ivy-resume)
+               ("C-x C-b" . ivy-switch-buffer)
+               :map ivy-minibuffer-map
+               ("C-j" . ivy-call))
+        :diminish ivy-mode
+        :commands ivy-mode
+        :config
+        (ivy-mode 1))
+
+      (use-package magit
+        :defer
+        :if (executable-find "git")
+        :bind (("C-x g" . magit-status)
+               ("C-x G" . magit-dispatch-popup))
+        :init
+        (setq magit-completing-read-function 'ivy-completing-read))
+
+      (use-package projectile
+        :commands projectile-mode
+        :bind-keymap ("C-c p" . projectile-command-map)
+        :defer 5
+        :config
+        (projectile-global-mode))
+    '';
+
+    myEmacs = emacsWithPackages (epkgs: (with epkgs.melpaStablePackages; [
+      (runCommand "default.el" {} ''
+         mkdir -p $out/share/emacs/site-lisp
+         cp ${myEmacsConfig} $out/share/emacs/site-lisp/default.el
+       '')
+      company
+      counsel
+      flycheck
+      ivy
+      magit
+      projectile
+      use-package
+    ]));
+  };
+}
+```
+
+This provides a fairly full Emacs start file. It will load in addition to the user's presonal config. You can always disable it by passing `-q` to the Emacs command.
+
+Sometimes `emacsWithPackages` is not enough, as this package set has some priorities imposed on packages (with the lowest priority assigned to Melpa Unstable, and the highest for packages manually defined in `pkgs/top-level/emacs-packages.nix`). But you can't control this priorities when some package is installed as a dependency. You can override it on per-package-basis, providing all the required dependencies manually - but it's tedious and there is always a possibility that an unwanted dependency will sneak in through some other package. To completely override such a package you can use `overrideScope'`.
+
+```nix
+overrides = self: super: rec {
+  haskell-mode = self.melpaPackages.haskell-mode;
+  ...
+};
+((emacsPackagesGen emacs).overrideScope' overrides).emacsWithPackages
+  (p: with p; [
+    # here both these package will use haskell-mode of our own choice
+    ghc-mod
+    dante
+  ])
+```
diff --git a/third_party/nixpkgs/doc/builders/packages/emacs.xml b/third_party/nixpkgs/doc/builders/packages/emacs.xml
deleted file mode 100644
index 9cce7c4086..0000000000
--- a/third_party/nixpkgs/doc/builders/packages/emacs.xml
+++ /dev/null
@@ -1,131 +0,0 @@
-<section xmlns="http://docbook.org/ns/docbook"
-         xmlns:xlink="http://www.w3.org/1999/xlink"
-         xml:id="sec-emacs">
- <title>Emacs</title>
-
- <section xml:id="sec-emacs-config">
-  <title>Configuring Emacs</title>
-
-  <para>
-   The Emacs package comes with some extra helpers to make it easier to configure. <varname>emacsWithPackages</varname> allows you to manage packages from ELPA. This means that you will not have to install that packages from within Emacs. For instance, if you wanted to use <literal>company</literal>, <literal>counsel</literal>, <literal>flycheck</literal>, <literal>ivy</literal>, <literal>magit</literal>, <literal>projectile</literal>, and <literal>use-package</literal> you could use this as a <filename>~/.config/nixpkgs/config.nix</filename> override:
-  </para>
-
-<screen>
-{
-  packageOverrides = pkgs: with pkgs; {
-    myEmacs = emacsWithPackages (epkgs: (with epkgs.melpaStablePackages; [
-      company
-      counsel
-      flycheck
-      ivy
-      magit
-      projectile
-      use-package
-    ]));
-  }
-}
-</screen>
-
-  <para>
-   You can install it like any other packages via <command>nix-env -iA myEmacs</command>. However, this will only install those packages. It will not <literal>configure</literal> them for us. To do this, we need to provide a configuration file. Luckily, it is possible to do this from within Nix! By modifying the above example, we can make Emacs load a custom config file. The key is to create a package that provide a <filename>default.el</filename> file in <filename>/share/emacs/site-start/</filename>. Emacs knows to load this file automatically when it starts.
-  </para>
-
-<screen>
-{
-  packageOverrides = pkgs: with pkgs; rec {
-    myEmacsConfig = writeText "default.el" ''
-;; initialize package
-
-(require 'package)
-(package-initialize 'noactivate)
-(eval-when-compile
-  (require 'use-package))
-
-;; load some packages
-
-(use-package company
-  :bind ("&lt;C-tab&gt;" . company-complete)
-  :diminish company-mode
-  :commands (company-mode global-company-mode)
-  :defer 1
-  :config
-  (global-company-mode))
-
-(use-package counsel
-  :commands (counsel-descbinds)
-  :bind (([remap execute-extended-command] . counsel-M-x)
-         ("C-x C-f" . counsel-find-file)
-         ("C-c g" . counsel-git)
-         ("C-c j" . counsel-git-grep)
-         ("C-c k" . counsel-ag)
-         ("C-x l" . counsel-locate)
-         ("M-y" . counsel-yank-pop)))
-
-(use-package flycheck
-  :defer 2
-  :config (global-flycheck-mode))
-
-(use-package ivy
-  :defer 1
-  :bind (("C-c C-r" . ivy-resume)
-         ("C-x C-b" . ivy-switch-buffer)
-         :map ivy-minibuffer-map
-         ("C-j" . ivy-call))
-  :diminish ivy-mode
-  :commands ivy-mode
-  :config
-  (ivy-mode 1))
-
-(use-package magit
-  :defer
-  :if (executable-find "git")
-  :bind (("C-x g" . magit-status)
-         ("C-x G" . magit-dispatch-popup))
-  :init
-  (setq magit-completing-read-function 'ivy-completing-read))
-
-(use-package projectile
-  :commands projectile-mode
-  :bind-keymap ("C-c p" . projectile-command-map)
-  :defer 5
-  :config
-  (projectile-global-mode))
-    '';
-    myEmacs = emacsWithPackages (epkgs: (with epkgs.melpaStablePackages; [
-      (runCommand "default.el" {} ''
-mkdir -p $out/share/emacs/site-lisp
-cp ${myEmacsConfig} $out/share/emacs/site-lisp/default.el
-'')
-      company
-      counsel
-      flycheck
-      ivy
-      magit
-      projectile
-      use-package
-    ]));
-  };
-}
-</screen>
-
-  <para>
-   This provides a fairly full Emacs start file. It will load in addition to the user's presonal config. You can always disable it by passing <command>-q</command> to the Emacs command.
-  </para>
-
-  <para>
-   Sometimes <varname>emacsWithPackages</varname> is not enough, as this package set has some priorities imposed on packages (with the lowest priority assigned to Melpa Unstable, and the highest for packages manually defined in <filename>pkgs/top-level/emacs-packages.nix</filename>). But you can't control this priorities when some package is installed as a dependency. You can override it on per-package-basis, providing all the required dependencies manually - but it's tedious and there is always a possibility that an unwanted dependency will sneak in through some other package. To completely override such a package you can use <varname>overrideScope'</varname>.
-  </para>
-
-<screen>
-overrides = self: super: rec {
-  haskell-mode = self.melpaPackages.haskell-mode;
-  ...
-};
-((emacsPackagesGen emacs).overrideScope' overrides).emacsWithPackages (p: with p; [
-  # here both these package will use haskell-mode of our own choice
-  ghc-mod
-  dante
-])
-</screen>
- </section>
-</section>
diff --git a/third_party/nixpkgs/doc/builders/packages/firefox.section.md b/third_party/nixpkgs/doc/builders/packages/firefox.section.md
new file mode 100644
index 0000000000..2f89da2d45
--- /dev/null
+++ b/third_party/nixpkgs/doc/builders/packages/firefox.section.md
@@ -0,0 +1,40 @@
+# Firefox
+
+## Build wrapped Firefox with extensions and policies
+
+The `wrapFirefox` function allows to pass policies, preferences and extension that are available to firefox. With the help of `fetchFirefoxAddon` this allows build a firefox version that already comes with addons pre-installed:
+
+```nix
+{
+  myFirefox = wrapFirefox firefox-unwrapped {
+    extraExtensions = [
+      (fetchFirefoxAddon {
+        name = "ublock";
+        url = "https://addons.mozilla.org/firefox/downloads/file/3679754/ublock_origin-1.31.0-an+fx.xpi";
+        sha256 = "1h768ljlh3pi23l27qp961v1hd0nbj2vasgy11bmcrlqp40zgvnr";
+      })
+    ];
+
+    extraPolicies = {
+      CaptivePortal = false;
+      DisableFirefoxStudies = true;
+      DisablePocket = true;
+      DisableTelemetry = true;
+      DisableFirefoxAccounts = true;
+      FirefoxHome = {
+        Pocket = false;
+        Snippets = false;
+      };
+       UserMessaging = {
+         ExtensionRecommendations = false;
+         SkipOnboarding = true;
+       };
+    };
+
+    extraPrefs = ''
+      // Show more ssl cert infos
+      lockPref("security.identityblock.show_extended_validation", true);
+    '';
+  };
+}
+```
diff --git a/third_party/nixpkgs/doc/builders/packages/index.xml b/third_party/nixpkgs/doc/builders/packages/index.xml
index 3c9a56a81b..c2e7ef9bf6 100644
--- a/third_party/nixpkgs/doc/builders/packages/index.xml
+++ b/third_party/nixpkgs/doc/builders/packages/index.xml
@@ -9,17 +9,18 @@
  <xi:include href="dlib.xml" />
  <xi:include href="eclipse.xml" />
  <xi:include href="elm.xml" />
- <xi:include href="emacs.xml" />
+ <xi:include href="emacs.section.xml" />
+ <xi:include href="firefox.section.xml" />
  <xi:include href="ibus.xml" />
  <xi:include href="kakoune.section.xml" />
- <xi:include href="linux.xml" />
+ <xi:include href="linux.section.xml" />
  <xi:include href="locales.xml" />
- <xi:include href="nginx.xml" />
- <xi:include href="opengl.xml" />
+ <xi:include href="nginx.section.xml" />
+ <xi:include href="opengl.section.xml" />
  <xi:include href="shell-helpers.xml" />
  <xi:include href="steam.xml" />
  <xi:include href="cataclysm-dda.section.xml" />
  <xi:include href="urxvt.xml" />
- <xi:include href="weechat.xml" />
- <xi:include href="xorg.xml" />
+ <xi:include href="weechat.section.xml" />
+ <xi:include href="xorg.section.xml" />
 </chapter>
diff --git a/third_party/nixpkgs/doc/builders/packages/linux.section.md b/third_party/nixpkgs/doc/builders/packages/linux.section.md
new file mode 100644
index 0000000000..1b8d6eda74
--- /dev/null
+++ b/third_party/nixpkgs/doc/builders/packages/linux.section.md
@@ -0,0 +1,41 @@
+# Linux kernel {#sec-linux-kernel}
+
+The Nix expressions to build the Linux kernel are in [`pkgs/os-specific/linux/kernel`](https://github.com/NixOS/nixpkgs/blob/master/pkgs/os-specific/linux/kernel).
+
+The function that builds the kernel has an argument `kernelPatches` which should be a list of `{name, patch, extraConfig}` attribute sets, where `name` is the name of the patch (which is included in the kernel’s `meta.description` attribute), `patch` is the patch itself (possibly compressed), and `extraConfig` (optional) is a string specifying extra options to be concatenated to the kernel configuration file (`.config`).
+
+The kernel derivation exports an attribute `features` specifying whether optional functionality is or isn’t enabled. This is used in NixOS to implement kernel-specific behaviour. For instance, if the kernel has the `iwlwifi` feature (i.e. has built-in support for Intel wireless chipsets), then NixOS doesn’t have to build the external `iwlwifi` package:
+
+```nix
+modulesTree = [kernel]
+  ++ pkgs.lib.optional (!kernel.features ? iwlwifi) kernelPackages.iwlwifi
+  ++ ...;
+```
+
+How to add a new (major) version of the Linux kernel to Nixpkgs:
+
+1.  Copy the old Nix expression (e.g. `linux-2.6.21.nix`) to the new one (e.g. `linux-2.6.22.nix`) and update it.
+
+2.  Add the new kernel to `all-packages.nix` (e.g., create an attribute `kernel_2_6_22`).
+
+3.  Now we’re going to update the kernel configuration. First unpack the kernel. Then for each supported platform (`i686`, `x86_64`, `uml`) do the following:
+
+    1.  Make an copy from the old config (e.g. `config-2.6.21-i686-smp`) to the new one (e.g. `config-2.6.22-i686-smp`).
+
+    2.  Copy the config file for this platform (e.g. `config-2.6.22-i686-smp`) to `.config` in the kernel source tree.
+
+    3.  Run `make oldconfig ARCH={i386,x86_64,um}` and answer all questions. (For the uml configuration, also add `SHELL=bash`.) Make sure to keep the configuration consistent between platforms (i.e. don’t enable some feature on `i686` and disable it on `x86_64`).
+
+    4.  If needed you can also run `make menuconfig`:
+
+        ```ShellSession
+        $ nix-env -i ncurses
+        $ export NIX_CFLAGS_LINK=-lncurses
+        $ make menuconfig ARCH=arch
+        ```
+
+    5.  Copy `.config` over the new config file (e.g. `config-2.6.22-i686-smp`).
+
+4.  Test building the kernel: `nix-build -A kernel_2_6_22`. If it compiles, ship it! For extra credit, try booting NixOS with it.
+
+5.  It may be that the new kernel requires updating the external kernel modules and kernel-dependent packages listed in the `linuxPackagesFor` function in `all-packages.nix` (such as the NVIDIA drivers, AUFS, etc.). If the updated packages aren’t backwards compatible with older kernels, you may need to keep the older versions around.
diff --git a/third_party/nixpkgs/doc/builders/packages/linux.xml b/third_party/nixpkgs/doc/builders/packages/linux.xml
deleted file mode 100644
index 72d0e21493..0000000000
--- a/third_party/nixpkgs/doc/builders/packages/linux.xml
+++ /dev/null
@@ -1,85 +0,0 @@
-<section xmlns="http://docbook.org/ns/docbook"
-         xmlns:xlink="http://www.w3.org/1999/xlink"
-         xml:id="sec-linux-kernel">
- <title>Linux kernel</title>
-
- <para>
-  The Nix expressions to build the Linux kernel are in <link
-xlink:href="https://github.com/NixOS/nixpkgs/blob/master/pkgs/os-specific/linux/kernel"><filename>pkgs/os-specific/linux/kernel</filename></link>.
- </para>
-
- <para>
-  The function that builds the kernel has an argument <varname>kernelPatches</varname> which should be a list of <literal>{name, patch, extraConfig}</literal> attribute sets, where <varname>name</varname> is the name of the patch (which is included in the kernel’s <varname>meta.description</varname> attribute), <varname>patch</varname> is the patch itself (possibly compressed), and <varname>extraConfig</varname> (optional) is a string specifying extra options to be concatenated to the kernel configuration file (<filename>.config</filename>).
- </para>
-
- <para>
-  The kernel derivation exports an attribute <varname>features</varname> specifying whether optional functionality is or isn’t enabled. This is used in NixOS to implement kernel-specific behaviour. For instance, if the kernel has the <varname>iwlwifi</varname> feature (i.e. has built-in support for Intel wireless chipsets), then NixOS doesn’t have to build the external <varname>iwlwifi</varname> package:
-<programlisting>
-modulesTree = [kernel]
-  ++ pkgs.lib.optional (!kernel.features ? iwlwifi) kernelPackages.iwlwifi
-  ++ ...;
-</programlisting>
- </para>
-
- <para>
-  How to add a new (major) version of the Linux kernel to Nixpkgs:
-  <orderedlist>
-   <listitem>
-    <para>
-     Copy the old Nix expression (e.g. <filename>linux-2.6.21.nix</filename>) to the new one (e.g. <filename>linux-2.6.22.nix</filename>) and update it.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     Add the new kernel to <filename>all-packages.nix</filename> (e.g., create an attribute <varname>kernel_2_6_22</varname>).
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     Now we’re going to update the kernel configuration. First unpack the kernel. Then for each supported platform (<literal>i686</literal>, <literal>x86_64</literal>, <literal>uml</literal>) do the following:
-     <orderedlist>
-      <listitem>
-       <para>
-        Make an copy from the old config (e.g. <filename>config-2.6.21-i686-smp</filename>) to the new one (e.g. <filename>config-2.6.22-i686-smp</filename>).
-       </para>
-      </listitem>
-      <listitem>
-       <para>
-        Copy the config file for this platform (e.g. <filename>config-2.6.22-i686-smp</filename>) to <filename>.config</filename> in the kernel source tree.
-       </para>
-      </listitem>
-      <listitem>
-       <para>
-        Run <literal>make oldconfig ARCH=<replaceable>{i386,x86_64,um}</replaceable></literal> and answer all questions. (For the uml configuration, also add <literal>SHELL=bash</literal>.) Make sure to keep the configuration consistent between platforms (i.e. don’t enable some feature on <literal>i686</literal> and disable it on <literal>x86_64</literal>).
-       </para>
-      </listitem>
-      <listitem>
-       <para>
-        If needed you can also run <literal>make menuconfig</literal>:
-<screen>
-<prompt>$ </prompt>nix-env -i ncurses
-<prompt>$ </prompt>export NIX_CFLAGS_LINK=-lncurses
-<prompt>$ </prompt>make menuconfig ARCH=<replaceable>arch</replaceable></screen>
-       </para>
-      </listitem>
-      <listitem>
-       <para>
-        Copy <filename>.config</filename> over the new config file (e.g. <filename>config-2.6.22-i686-smp</filename>).
-       </para>
-      </listitem>
-     </orderedlist>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     Test building the kernel: <literal>nix-build -A kernel_2_6_22</literal>. If it compiles, ship it! For extra credit, try booting NixOS with it.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     It may be that the new kernel requires updating the external kernel modules and kernel-dependent packages listed in the <varname>linuxPackagesFor</varname> function in <filename>all-packages.nix</filename> (such as the NVIDIA drivers, AUFS, etc.). If the updated packages aren’t backwards compatible with older kernels, you may need to keep the older versions around.
-    </para>
-   </listitem>
-  </orderedlist>
- </para>
-</section>
diff --git a/third_party/nixpkgs/doc/builders/packages/nginx.section.md b/third_party/nixpkgs/doc/builders/packages/nginx.section.md
new file mode 100644
index 0000000000..154c21f9b3
--- /dev/null
+++ b/third_party/nixpkgs/doc/builders/packages/nginx.section.md
@@ -0,0 +1,11 @@
+# Nginx {#sec-nginx}
+
+[Nginx](https://nginx.org) is a reverse proxy and lightweight webserver.
+
+## ETags on static files served from the Nix store {#sec-nginx-etag}
+
+HTTP has a couple different mechanisms for caching to prevent clients from having to download the same content repeatedly if a resource has not changed since the last time it was requested. When nginx is used as a server for static files, it implements the caching mechanism based on the [`Last-Modified`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Last-Modified) response header automatically; unfortunately, it works by using filesystem timestamps to determine the value of the `Last-Modified` header. This doesn't give the desired behavior when the file is in the Nix store, because all file timestamps are set to 0 (for reasons related to build reproducibility).
+
+Fortunately, HTTP supports an alternative (and more effective) caching mechanism: the [`ETag`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/ETag) response header. The value of the `ETag` header specifies some identifier for the particular content that the server is sending (e.g. a hash). When a client makes a second request for the same resource, it sends that value back in an `If-None-Match` header. If the ETag value is unchanged, then the server does not need to resend the content.
+
+As of NixOS 19.09, the nginx package in Nixpkgs is patched such that when nginx serves a file out of `/nix/store`, the hash in the store path is used as the `ETag` header in the HTTP response, thus providing proper caching functionality. This happens automatically; you do not need to do modify any configuration to get this behavior.
diff --git a/third_party/nixpkgs/doc/builders/packages/nginx.xml b/third_party/nixpkgs/doc/builders/packages/nginx.xml
deleted file mode 100644
index 65854ba023..0000000000
--- a/third_party/nixpkgs/doc/builders/packages/nginx.xml
+++ /dev/null
@@ -1,25 +0,0 @@
-<section xmlns="http://docbook.org/ns/docbook"
-         xmlns:xlink="http://www.w3.org/1999/xlink"
-         xml:id="sec-nginx">
- <title>Nginx</title>
-
- <para>
-  <link xlink:href="https://nginx.org/">Nginx</link> is a reverse proxy and lightweight webserver.
- </para>
-
- <section xml:id="sec-nginx-etag">
-  <title>ETags on static files served from the Nix store</title>
-
-  <para>
-   HTTP has a couple different mechanisms for caching to prevent clients from having to download the same content repeatedly if a resource has not changed since the last time it was requested. When nginx is used as a server for static files, it implements the caching mechanism based on the <link xlink:href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Last-Modified"><literal>Last-Modified</literal></link> response header automatically; unfortunately, it works by using filesystem timestamps to determine the value of the <literal>Last-Modified</literal> header. This doesn't give the desired behavior when the file is in the Nix store, because all file timestamps are set to 0 (for reasons related to build reproducibility).
-  </para>
-
-  <para>
-   Fortunately, HTTP supports an alternative (and more effective) caching mechanism: the <link xlink:href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/ETag"><literal>ETag</literal></link> response header. The value of the <literal>ETag</literal> header specifies some identifier for the particular content that the server is sending (e.g. a hash). When a client makes a second request for the same resource, it sends that value back in an <literal>If-None-Match</literal> header. If the ETag value is unchanged, then the server does not need to resend the content.
-  </para>
-
-  <para>
-   As of NixOS 19.09, the nginx package in Nixpkgs is patched such that when nginx serves a file out of <filename>/nix/store</filename>, the hash in the store path is used as the <literal>ETag</literal> header in the HTTP response, thus providing proper caching functionality. This happens automatically; you do not need to do modify any configuration to get this behavior.
-  </para>
- </section>
-</section>
diff --git a/third_party/nixpkgs/doc/builders/packages/opengl.section.md b/third_party/nixpkgs/doc/builders/packages/opengl.section.md
new file mode 100644
index 0000000000..6866bf8922
--- /dev/null
+++ b/third_party/nixpkgs/doc/builders/packages/opengl.section.md
@@ -0,0 +1,15 @@
+# OpenGL {#sec-opengl}
+
+OpenGL support varies depending on which hardware is used and which drivers are available and loaded.
+
+Broadly, we support both GL vendors: Mesa and NVIDIA.
+
+## NixOS Desktop
+
+The NixOS desktop or other non-headless configurations are the primary target for OpenGL libraries and applications. The current solution for discovering which drivers are available is based on [libglvnd](https://gitlab.freedesktop.org/glvnd/libglvnd). `libglvnd` performs "vendor-neutral dispatch", trying a variety of techniques to find the system's GL implementation. In practice, this will be either via standard GLX for X11 users or EGL for Wayland users, and supporting either NVIDIA or Mesa extensions.
+
+## Nix on GNU/Linux
+
+If you are using a non-NixOS GNU/Linux/X11 desktop with free software video drivers, consider launching OpenGL-dependent programs from Nixpkgs with Nixpkgs versions of `libglvnd` and `mesa.drivers` in `LD_LIBRARY_PATH`. For Mesa drivers, the Linux kernel version doesn't have to match nixpkgs.
+
+For proprietary video drivers you might have luck with also adding the corresponding video driver package.
diff --git a/third_party/nixpkgs/doc/builders/packages/opengl.xml b/third_party/nixpkgs/doc/builders/packages/opengl.xml
deleted file mode 100644
index dfd64b1885..0000000000
--- a/third_party/nixpkgs/doc/builders/packages/opengl.xml
+++ /dev/null
@@ -1,9 +0,0 @@
-<section xmlns="http://docbook.org/ns/docbook"
-         xmlns:xlink="http://www.w3.org/1999/xlink"
-         xml:id="sec-opengl">
- <title>OpenGL</title>
-
- <para>
-  Packages that use OpenGL have NixOS desktop as their primary target. The current solution for loading the GPU-specific drivers is based on <literal>libglvnd</literal> and looks for the driver implementation in <literal>LD_LIBRARY_PATH</literal>. If you are using a non-NixOS GNU/Linux/X11 desktop with free software video drivers, consider launching OpenGL-dependent programs from Nixpkgs with Nixpkgs versions of <literal>libglvnd</literal> and <literal>mesa.drivers</literal> in <literal>LD_LIBRARY_PATH</literal>. For proprietary video drivers you might have luck with also adding the corresponding video driver package.
- </para>
-</section>
diff --git a/third_party/nixpkgs/doc/builders/packages/weechat.section.md b/third_party/nixpkgs/doc/builders/packages/weechat.section.md
new file mode 100644
index 0000000000..1d99b00e63
--- /dev/null
+++ b/third_party/nixpkgs/doc/builders/packages/weechat.section.md
@@ -0,0 +1,85 @@
+# Weechat {#sec-weechat}
+
+Weechat can be configured to include your choice of plugins, reducing its closure size from the default configuration which includes all available plugins. To make use of this functionality, install an expression that overrides its configuration such as
+
+```nix
+weechat.override {configure = {availablePlugins, ...}: {
+    plugins = with availablePlugins; [ python perl ];
+  }
+}
+```
+
+If the `configure` function returns an attrset without the `plugins` attribute, `availablePlugins` will be used automatically.
+
+The plugins currently available are `python`, `perl`, `ruby`, `guile`, `tcl` and `lua`.
+
+The python and perl plugins allows the addition of extra libraries. For instance, the `inotify.py` script in `weechat-scripts` requires D-Bus or libnotify, and the `fish.py` script requires `pycrypto`. To use these scripts, use the plugin's `withPackages` attribute:
+
+```nix
+weechat.override { configure = {availablePlugins, ...}: {
+    plugins = with availablePlugins; [
+            (python.withPackages (ps: with ps; [ pycrypto python-dbus ]))
+        ];
+    };
+}
+```
+
+In order to also keep all default plugins installed, it is possible to use the following method:
+
+```nix
+weechat.override { configure = { availablePlugins, ... }: {
+  plugins = builtins.attrValues (availablePlugins // {
+    python = availablePlugins.python.withPackages (ps: with ps; [ pycrypto python-dbus ]);
+  });
+}; }
+```
+
+WeeChat allows to set defaults on startup using the `--run-command`. The `configure` method can be used to pass commands to the program:
+
+```nix
+weechat.override {
+  configure = { availablePlugins, ... }: {
+    init = ''
+      /set foo bar
+      /server add freenode chat.freenode.org
+    '';
+  };
+}
+```
+
+Further values can be added to the list of commands when running `weechat --run-command "your-commands"`.
+
+Additionally it's possible to specify scripts to be loaded when starting `weechat`. These will be loaded before the commands from `init`:
+
+```nix
+weechat.override {
+  configure = { availablePlugins, ... }: {
+    scripts = with pkgs.weechatScripts; [
+      weechat-xmpp weechat-matrix-bridge wee-slack
+    ];
+    init = ''
+      /set plugins.var.python.jabber.key "val"
+    '':
+  };
+}
+```
+
+In `nixpkgs` there's a subpackage which contains derivations for WeeChat scripts. Such derivations expect a `passthru.scripts` attribute which contains a list of all scripts inside the store path. Furthermore all scripts have to live in `$out/share`. An exemplary derivation looks like this:
+
+```nix
+{ stdenv, fetchurl }:
+
+stdenv.mkDerivation {
+  name = "exemplary-weechat-script";
+  src = fetchurl {
+    url = "https://scripts.tld/your-scripts.tar.gz";
+    sha256 = "...";
+  };
+  passthru.scripts = [ "foo.py" "bar.lua" ];
+  installPhase = ''
+    mkdir $out/share
+    cp foo.py $out/share
+    cp bar.lua $out/share
+  '';
+}
+```
diff --git a/third_party/nixpkgs/doc/builders/packages/weechat.xml b/third_party/nixpkgs/doc/builders/packages/weechat.xml
deleted file mode 100644
index a110d3f491..0000000000
--- a/third_party/nixpkgs/doc/builders/packages/weechat.xml
+++ /dev/null
@@ -1,85 +0,0 @@
-<section xmlns="http://docbook.org/ns/docbook"
-         xmlns:xlink="http://www.w3.org/1999/xlink"
-         xml:id="sec-weechat">
- <title>Weechat</title>
-
- <para>
-  Weechat can be configured to include your choice of plugins, reducing its closure size from the default configuration which includes all available plugins. To make use of this functionality, install an expression that overrides its configuration such as
-<programlisting>weechat.override {configure = {availablePlugins, ...}: {
-    plugins = with availablePlugins; [ python perl ];
-  }
-}</programlisting>
-  If the <literal>configure</literal> function returns an attrset without the <literal>plugins</literal> attribute, <literal>availablePlugins</literal> will be used automatically.
- </para>
-
- <para>
-  The plugins currently available are <literal>python</literal>, <literal>perl</literal>, <literal>ruby</literal>, <literal>guile</literal>, <literal>tcl</literal> and <literal>lua</literal>.
- </para>
-
- <para>
-  The python and perl plugins allows the addition of extra libraries. For instance, the <literal>inotify.py</literal> script in weechat-scripts requires D-Bus or libnotify, and the <literal>fish.py</literal> script requires pycrypto. To use these scripts, use the plugin's <literal>withPackages</literal> attribute:
-<programlisting>weechat.override { configure = {availablePlugins, ...}: {
-    plugins = with availablePlugins; [
-            (python.withPackages (ps: with ps; [ pycrypto python-dbus ]))
-        ];
-    };
-}
-</programlisting>
- </para>
-
- <para>
-  In order to also keep all default plugins installed, it is possible to use the following method:
-<programlisting>weechat.override { configure = { availablePlugins, ... }: {
-  plugins = builtins.attrValues (availablePlugins // {
-    python = availablePlugins.python.withPackages (ps: with ps; [ pycrypto python-dbus ]);
-  });
-}; }
-</programlisting>
- </para>
-
- <para>
-  WeeChat allows to set defaults on startup using the <literal>--run-command</literal>. The <literal>configure</literal> method can be used to pass commands to the program:
-<programlisting>weechat.override {
-  configure = { availablePlugins, ... }: {
-    init = ''
-      /set foo bar
-      /server add freenode chat.freenode.org
-    '';
-  };
-}</programlisting>
-  Further values can be added to the list of commands when running <literal>weechat --run-command "your-commands"</literal>.
- </para>
-
- <para>
-  Additionally it's possible to specify scripts to be loaded when starting <literal>weechat</literal>. These will be loaded before the commands from <literal>init</literal>:
-<programlisting>weechat.override {
-  configure = { availablePlugins, ... }: {
-    scripts = with pkgs.weechatScripts; [
-      weechat-xmpp weechat-matrix-bridge wee-slack
-    ];
-    init = ''
-      /set plugins.var.python.jabber.key "val"
-    '':
-  };
-}</programlisting>
- </para>
-
- <para>
-  In <literal>nixpkgs</literal> there's a subpackage which contains derivations for WeeChat scripts. Such derivations expect a <literal>passthru.scripts</literal> attribute which contains a list of all scripts inside the store path. Furthermore all scripts have to live in <literal>$out/share</literal>. An exemplary derivation looks like this:
-<programlisting>{ stdenv, fetchurl }:
-
-stdenv.mkDerivation {
-  name = "exemplary-weechat-script";
-  src = fetchurl {
-    url = "https://scripts.tld/your-scripts.tar.gz";
-    sha256 = "...";
-  };
-  passthru.scripts = [ "foo.py" "bar.lua" ];
-  installPhase = ''
-    mkdir $out/share
-    cp foo.py $out/share
-    cp bar.lua $out/share
-  '';
-}</programlisting>
- </para>
-</section>
diff --git a/third_party/nixpkgs/doc/builders/packages/xorg.section.md b/third_party/nixpkgs/doc/builders/packages/xorg.section.md
new file mode 100644
index 0000000000..be220a2540
--- /dev/null
+++ b/third_party/nixpkgs/doc/builders/packages/xorg.section.md
@@ -0,0 +1,34 @@
+# X.org {#sec-xorg}
+
+The Nix expressions for the X.org packages reside in `pkgs/servers/x11/xorg/default.nix`. This file is automatically generated from lists of tarballs in an X.org release. As such it should not be modified directly; rather, you should modify the lists, the generator script or the file `pkgs/servers/x11/xorg/overrides.nix`, in which you can override or add to the derivations produced by the generator.
+
+## Katamari Tarballs
+
+X.org upstream releases used to include [katamari](https://en.wiktionary.org/wiki/%E3%81%8B%E3%81%9F%E3%81%BE%E3%82%8A) releases, which included a holistic recommended version for each tarball, up until 7.7. To create a list of tarballs in a katamari release:
+
+```ShellSession
+export release="X11R7.7"
+export url="mirror://xorg/$release/src/everything/"
+cat $(PRINT_PATH=1 nix-prefetch-url $url | tail -n 1) \
+  | perl -e 'while (<>) { if (/(href|HREF)="([^"]*.bz2)"/) { print "$ENV{'url'}$2\n"; }; }' \
+  | sort > "tarballs-$release.list"
+```
+
+## Individual Tarballs
+
+The upstream release process for [X11R7.8](https://x.org/wiki/Releases/7.8/) does not include a planned katamari. Instead, each component of X.org is released as its own tarball. We maintain `pkgs/servers/x11/xorg/tarballs.list` as a list of tarballs for each individual package. This list includes X.org core libraries and protocol descriptions, extra newer X11 interface libraries, like `xorg.libxcb`, and classic utilities which are largely unused but still available if needed, like `xorg.imake`.
+
+## Generating Nix Expressions
+
+The generator is invoked as follows:
+
+```ShellSession
+cd pkgs/servers/x11/xorg
+<tarballs.list perl ./generate-expr-from-tarballs.pl
+```
+
+For each of the tarballs in the `.list` files, the script downloads it, unpacks it, and searches its `configure.ac` and `*.pc.in` files for dependencies. This information is used to generate `default.nix`. The generator caches downloaded tarballs between runs. Pay close attention to the `NOT FOUND: $NAME` messages at the end of the run, since they may indicate missing dependencies. (Some might be optional dependencies, however.)
+
+## Overriding the Generator
+
+If the expression for a package requires derivation attributes that the generator cannot figure out automatically (say, `patches` or a `postInstall` hook), you should modify `pkgs/servers/x11/xorg/overrides.nix`.
diff --git a/third_party/nixpkgs/doc/builders/packages/xorg.xml b/third_party/nixpkgs/doc/builders/packages/xorg.xml
deleted file mode 100644
index ebf4930cc0..0000000000
--- a/third_party/nixpkgs/doc/builders/packages/xorg.xml
+++ /dev/null
@@ -1,34 +0,0 @@
-<section xmlns="http://docbook.org/ns/docbook"
-         xmlns:xlink="http://www.w3.org/1999/xlink"
-         xml:id="sec-xorg">
- <title>X.org</title>
-
- <para>
-  The Nix expressions for the X.org packages reside in <filename>pkgs/servers/x11/xorg/default.nix</filename>. This file is automatically generated from lists of tarballs in an X.org release. As such it should not be modified directly; rather, you should modify the lists, the generator script or the file <filename>pkgs/servers/x11/xorg/overrides.nix</filename>, in which you can override or add to the derivations produced by the generator.
- </para>
-
- <para>
-  The generator is invoked as follows:
-<screen>
-<prompt>$ </prompt>cd pkgs/servers/x11/xorg
-<prompt>$ </prompt>cat tarballs-7.5.list extra.list old.list \
-  | perl ./generate-expr-from-tarballs.pl
-</screen>
-  For each of the tarballs in the <filename>.list</filename> files, the script downloads it, unpacks it, and searches its <filename>configure.ac</filename> and <filename>*.pc.in</filename> files for dependencies. This information is used to generate <filename>default.nix</filename>. The generator caches downloaded tarballs between runs. Pay close attention to the <literal>NOT FOUND: <replaceable>name</replaceable></literal> messages at the end of the run, since they may indicate missing dependencies. (Some might be optional dependencies, however.)
- </para>
-
- <para>
-  A file like <filename>tarballs-7.5.list</filename> contains all tarballs in a X.org release. It can be generated like this:
-<screen>
-<prompt>$ </prompt>export i="mirror://xorg/X11R7.4/src/everything/"
-<prompt>$ </prompt>cat $(PRINT_PATH=1 nix-prefetch-url $i | tail -n 1) \
-  | perl -e 'while (&lt;>) { if (/(href|HREF)="([^"]*.bz2)"/) { print "$ENV{'i'}$2\n"; }; }' \
-  | sort > tarballs-7.4.list
-</screen>
-  <filename>extra.list</filename> contains libraries that aren’t part of X.org proper, but are closely related to it, such as <literal>libxcb</literal>. <filename>old.list</filename> contains some packages that were removed from X.org, but are still needed by some people or by other packages (such as <varname>imake</varname>).
- </para>
-
- <para>
-  If the expression for a package requires derivation attributes that the generator cannot figure out automatically (say, <varname>patches</varname> or a <varname>postInstall</varname> hook), you should modify <filename>pkgs/servers/x11/xorg/overrides.nix</filename>.
- </para>
-</section>
diff --git a/third_party/nixpkgs/doc/contributing/reviewing-contributions.xml b/third_party/nixpkgs/doc/contributing/reviewing-contributions.xml
index 96bf44da97..991db77bc5 100644
--- a/third_party/nixpkgs/doc/contributing/reviewing-contributions.xml
+++ b/third_party/nixpkgs/doc/contributing/reviewing-contributions.xml
@@ -467,12 +467,8 @@
    It is possible for community members that have enough knowledge and experience on a special topic to contribute by merging pull requests.
   </para>
 
-  <para>
-   TODO: add the procedure to request merging rights.
-  </para>
-
 <!--
-The following paragraph about how to deal with unactive contributors is just a
+The following paragraphs about how to deal with unactive contributors is just a
 proposition and should be modified to what the community agrees to be the right
 policy.
 
@@ -480,6 +476,10 @@ policy.
   three months will have their commit rights revoked.</para>
 -->
 
+  <para>
+   Please see the discussion in <link xlink:href="https://github.com/NixOS/nixpkgs/issues/50105">GitHub nixpkgs issue #50105</link> for information on how to proceed to be granted this level of access.
+  </para>
+
   <para>
    In a case a contributor definitively leaves the Nix community, they should create an issue or post on <link
    xlink:href="https://discourse.nixos.org">Discourse</link> with references of packages and modules they maintain so the maintainership can be taken over by other contributors.
diff --git a/third_party/nixpkgs/doc/languages-frameworks/coq.section.md b/third_party/nixpkgs/doc/languages-frameworks/coq.section.md
new file mode 100644
index 0000000000..714e84efc8
--- /dev/null
+++ b/third_party/nixpkgs/doc/languages-frameworks/coq.section.md
@@ -0,0 +1,40 @@
+# Coq {#sec-language-coq}
+
+Coq libraries should be installed in `$(out)/lib/coq/${coq.coq-version}/user-contrib/`. Such directories are automatically added to the `$COQPATH` environment variable by the hook defined in the Coq derivation.
+
+Some extensions (plugins) might require OCaml and sometimes other OCaml packages. The `coq.ocamlPackages` attribute can be used to depend on the same package set Coq was built against.
+
+Coq libraries may be compatible with some specific versions of Coq only. The `compatibleCoqVersions` attribute is used to precisely select those versions of Coq that are compatible with this derivation.
+
+Here is a simple package example. It is a pure Coq library, thus it depends on Coq. It builds on the Mathematical Components library, thus it also takes `mathcomp` as `buildInputs`. Its `Makefile` has been generated using `coq_makefile` so we only have to set the `$COQLIB` variable at install time.
+
+```nix
+{ stdenv, fetchFromGitHub, coq, mathcomp }:
+
+stdenv.mkDerivation rec {
+  name = "coq${coq.coq-version}-multinomials-${version}";
+  version = "1.0";
+  src = fetchFromGitHub {
+    owner = "math-comp";
+    repo = "multinomials";
+    rev = version;
+    sha256 = "1qmbxp1h81cy3imh627pznmng0kvv37k4hrwi2faa101s6bcx55m";
+  };
+
+  buildInputs = [ coq ];
+  propagatedBuildInputs = [ mathcomp ];
+
+  installFlags = "COQLIB=$(out)/lib/coq/${coq.coq-version}/";
+
+  meta = {
+    description = "A Coq/SSReflect Library for Monoidal Rings and Multinomials";
+    inherit (src.meta) homepage;
+    license = stdenv.lib.licenses.cecill-b;
+    inherit (coq.meta) platforms;
+  };
+
+  passthru = {
+    compatibleCoqVersions = v: builtins.elem v [ "8.5" "8.6" "8.7" ];
+  };
+}
+```
diff --git a/third_party/nixpkgs/doc/languages-frameworks/coq.xml b/third_party/nixpkgs/doc/languages-frameworks/coq.xml
deleted file mode 100644
index 86d9226166..0000000000
--- a/third_party/nixpkgs/doc/languages-frameworks/coq.xml
+++ /dev/null
@@ -1,52 +0,0 @@
-<section xmlns="http://docbook.org/ns/docbook"
-         xmlns:xlink="http://www.w3.org/1999/xlink"
-         xml:id="sec-language-coq">
- <title>Coq</title>
-
- <para>
-  Coq libraries should be installed in <literal>$(out)/lib/coq/${coq.coq-version}/user-contrib/</literal>. Such directories are automatically added to the <literal>$COQPATH</literal> environment variable by the hook defined in the Coq derivation.
- </para>
-
- <para>
-  Some extensions (plugins) might require OCaml and sometimes other OCaml packages. The <literal>coq.ocamlPackages</literal> attribute can be used to depend on the same package set Coq was built against.
- </para>
-
- <para>
-  Coq libraries may be compatible with some specific versions of Coq only. The <literal>compatibleCoqVersions</literal> attribute is used to precisely select those versions of Coq that are compatible with this derivation.
- </para>
-
- <para>
-  Here is a simple package example. It is a pure Coq library, thus it depends on Coq. It builds on the Mathematical Components library, thus it also takes <literal>mathcomp</literal> as <literal>buildInputs</literal>. Its <literal>Makefile</literal> has been generated using <literal>coq_makefile</literal> so we only have to set the <literal>$COQLIB</literal> variable at install time.
- </para>
-
-<programlisting>
-{ stdenv, fetchFromGitHub, coq, mathcomp }:
-
-stdenv.mkDerivation rec {
-  name = "coq${coq.coq-version}-multinomials-${version}";
-  version = "1.0";
-  src = fetchFromGitHub {
-    owner = "math-comp";
-    repo = "multinomials";
-    rev = version;
-    sha256 = "1qmbxp1h81cy3imh627pznmng0kvv37k4hrwi2faa101s6bcx55m";
-  };
-
-  buildInputs = [ coq ];
-  propagatedBuildInputs = [ mathcomp ];
-
-  installFlags = "COQLIB=$(out)/lib/coq/${coq.coq-version}/";
-
-  meta = {
-    description = "A Coq/SSReflect Library for Monoidal Rings and Multinomials";
-    inherit (src.meta) homepage;
-    license = stdenv.lib.licenses.cecill-b;
-    inherit (coq.meta) platforms;
-  };
-
-  passthru = {
-    compatibleCoqVersions = v: builtins.elem v [ "8.5" "8.6" "8.7" ];
-  };
-}
-</programlisting>
-</section>
diff --git a/third_party/nixpkgs/doc/languages-frameworks/index.xml b/third_party/nixpkgs/doc/languages-frameworks/index.xml
index 22bc6e1baa..5046ce00b9 100644
--- a/third_party/nixpkgs/doc/languages-frameworks/index.xml
+++ b/third_party/nixpkgs/doc/languages-frameworks/index.xml
@@ -9,7 +9,7 @@
  <xi:include href="android.section.xml" />
  <xi:include href="beam.section.xml" />
  <xi:include href="bower.xml" />
- <xi:include href="coq.xml" />
+ <xi:include href="coq.section.xml" />
  <xi:include href="crystal.section.xml" />
  <xi:include href="emscripten.section.xml" />
  <xi:include href="gnome.xml" />
@@ -17,7 +17,7 @@
  <xi:include href="haskell.section.xml" />
  <xi:include href="idris.section.xml" />
  <xi:include href="ios.section.xml" />
- <xi:include href="java.xml" />
+ <xi:include href="java.section.xml" />
  <xi:include href="lua.section.xml" />
  <xi:include href="maven.section.xml" />
  <xi:include href="node.section.xml" />
@@ -29,7 +29,7 @@
  <xi:include href="r.section.xml" />
  <xi:include href="ruby.section.xml" />
  <xi:include href="rust.section.xml" />
- <xi:include href="texlive.xml" />
+ <xi:include href="texlive.section.xml" />
  <xi:include href="titanium.section.xml" />
  <xi:include href="vim.section.xml" />
 </chapter>
diff --git a/third_party/nixpkgs/doc/languages-frameworks/java.section.md b/third_party/nixpkgs/doc/languages-frameworks/java.section.md
new file mode 100644
index 0000000000..77919d43f7
--- /dev/null
+++ b/third_party/nixpkgs/doc/languages-frameworks/java.section.md
@@ -0,0 +1,91 @@
+# Java {#sec-language-java}
+
+Ant-based Java packages are typically built from source as follows:
+
+```nix
+stdenv.mkDerivation {
+  name = "...";
+  src = fetchurl { ... };
+
+  nativeBuildInputs = [ jdk ant ];
+
+  buildPhase = "ant";
+}
+```
+
+Note that `jdk` is an alias for the OpenJDK (self-built where available,
+or pre-built via Zulu). Platforms with OpenJDK not (yet) in Nixpkgs
+(`Aarch32`, `Aarch64`) point to the (unfree) `oraclejdk`.
+
+JAR files that are intended to be used by other packages should be
+installed in `$out/share/java`. JDKs have a stdenv setup hook that add
+any JARs in the `share/java` directories of the build inputs to the
+`CLASSPATH` environment variable. For instance, if the package `libfoo`
+installs a JAR named `foo.jar` in its `share/java` directory, and
+another package declares the attribute
+
+```nix
+buildInputs = [ libfoo ];
+nativeBuildInputs = [ jdk ];
+```
+
+then `CLASSPATH` will be set to
+`/nix/store/...-libfoo/share/java/foo.jar`.
+
+Private JARs should be installed in a location like
+`$out/share/package-name`.
+
+If your Java package provides a program, you need to generate a wrapper
+script to run it using a JRE. You can use `makeWrapper` for this:
+
+```nix
+nativeBuildInputs = [ makeWrapper ];
+
+installPhase = ''
+  mkdir -p $out/bin
+  makeWrapper ${jre}/bin/java $out/bin/foo \
+    --add-flags "-cp $out/share/java/foo.jar org.foo.Main"
+'';
+```
+
+Since the introduction of the Java Platform Module System in Java 9,
+Java distributions typically no longer ship with a general-purpose JRE:
+instead, they allow generating a JRE with only the modules required for
+your application(s). Because we can't predict what modules will be
+needed on a general-purpose system, the default jre package is the full
+JDK. When building a minimal system/image, you can override the
+`modules` parameter on `jre_minimal` to build a JRE with only the
+modules relevant for you:
+
+```nix
+let
+  my_jre = pkgs.jre_minimal.override {
+    modules = [
+      # The modules used by 'something' and 'other' combined:
+      "java.base"
+      "java.logging"
+    ];
+  };
+  something = (pkgs.something.override { jre = my_jre; });
+  other = (pkgs.other.override { jre = my_jre; });
+in
+  ...
+```
+
+Note all JDKs passthru `home`, so if your application requires
+environment variables like `JAVA_HOME` being set, that can be done in a
+generic fashion with the `--set` argument of `makeWrapper`:
+
+```bash
+--set JAVA_HOME ${jdk.home}
+```
+
+It is possible to use a different Java compiler than `javac` from the
+OpenJDK. For instance, to use the GNU Java Compiler:
+
+```nix
+nativeBuildInputs = [ gcj ant ];
+```
+
+Here, Ant will automatically use `gij` (the GNU Java Runtime) instead of
+the OpenJRE.
diff --git a/third_party/nixpkgs/doc/languages-frameworks/java.xml b/third_party/nixpkgs/doc/languages-frameworks/java.xml
deleted file mode 100644
index 881d492b5b..0000000000
--- a/third_party/nixpkgs/doc/languages-frameworks/java.xml
+++ /dev/null
@@ -1,77 +0,0 @@
-<section xmlns="http://docbook.org/ns/docbook"
-         xmlns:xlink="http://www.w3.org/1999/xlink"
-         xml:id="sec-language-java">
- <title>Java</title>
-
- <para>
-  Ant-based Java packages are typically built from source as follows:
-<programlisting>
-stdenv.mkDerivation {
-  name = "...";
-  src = fetchurl { ... };
-
-  nativeBuildInputs = [ jdk ant ];
-
-  buildPhase = "ant";
-}
-</programlisting>
-  Note that <varname>jdk</varname> is an alias for the OpenJDK (self-built where available, or pre-built via Zulu). Platforms with OpenJDK not (yet) in Nixpkgs (<literal>Aarch32</literal>, <literal>Aarch64</literal>) point to the (unfree) <literal>oraclejdk</literal>.
- </para>
-
- <para>
-  JAR files that are intended to be used by other packages should be installed in <filename>$out/share/java</filename>. JDKs have a stdenv setup hook that add any JARs in the <filename>share/java</filename> directories of the build inputs to the <envar>CLASSPATH</envar> environment variable. For instance, if the package <literal>libfoo</literal> installs a JAR named <filename>foo.jar</filename> in its <filename>share/java</filename> directory, and another package declares the attribute
-<programlisting>
-buildInputs = [ libfoo ];
-nativeBuildInputs = [ jdk ];
-</programlisting>
-  then <envar>CLASSPATH</envar> will be set to <filename>/nix/store/...-libfoo/share/java/foo.jar</filename>.
- </para>
-
- <para>
-  Private JARs should be installed in a location like <filename>$out/share/<replaceable>package-name</replaceable></filename>.
- </para>
-
- <para>
-  If your Java package provides a program, you need to generate a wrapper script to run it using a JRE. You can use <literal>makeWrapper</literal> for this:
-<programlisting>
-nativeBuildInputs = [ makeWrapper ];
-
-installPhase =
-  ''
-    mkdir -p $out/bin
-    makeWrapper ${jre}/bin/java $out/bin/foo \
-      --add-flags "-cp $out/share/java/foo.jar org.foo.Main"
-  '';
-</programlisting>
-Since the introduction of the Java Platform Module System in Java 9, Java distributions typically no longer ship with a general-purpose JRE: instead, they allow generating a JRE with only the modules required for your application(s). Because we can't predict what modules will be needed on a general-purpose system, the default <package>jre</package> package is the full JDK. When building a minimal system/image, you can override the <literal>modules</literal> parameter on <literal>jre_minimal</literal> to build a JRE with only the modules relevant for you:
-<programlisting>
-let
-  my_jre = pkgs.jre_minimal.override {
-    modules = [
-      # The modules used by 'something' and 'other' combined:
-      "java.base"
-      "java.logging"
-    ];
-  };
-  something = (pkgs.something.override { jre = my_jre; });
-  other = (pkgs.other.override { jre = my_jre; });
-in
-  ...
-</programlisting>
- </para>
-
- <para>
-  Note all JDKs passthru <literal>home</literal>, so if your application requires environment variables like <envar>JAVA_HOME</envar> being set, that can be done in a generic fashion with the <literal>--set</literal> argument of <literal>makeWrapper</literal>:
-<programlisting>
---set JAVA_HOME ${jdk.home}
-</programlisting>
- </para>
-
- <para>
-  It is possible to use a different Java compiler than <command>javac</command> from the OpenJDK. For instance, to use the GNU Java Compiler:
-<programlisting>
-nativeBuildInputs = [ gcj ant ];
-</programlisting>
-  Here, Ant will automatically use <command>gij</command> (the GNU Java Runtime) instead of the OpenJRE.
- </para>
-</section>
diff --git a/third_party/nixpkgs/doc/languages-frameworks/texlive.section.md b/third_party/nixpkgs/doc/languages-frameworks/texlive.section.md
new file mode 100644
index 0000000000..9584c56bb5
--- /dev/null
+++ b/third_party/nixpkgs/doc/languages-frameworks/texlive.section.md
@@ -0,0 +1,128 @@
+
+# TeX Live {#sec-language-texlive}
+
+Since release 15.09 there is a new TeX Live packaging that lives entirely under attribute `texlive`.
+
+## User's guide {#sec-language-texlive-user-guide}
+
+- For basic usage just pull `texlive.combined.scheme-basic` for an environment with basic LaTeX support.
+- It typically won't work to use separately installed packages together. Instead, you can build a custom set of packages like this:
+
+  ```nix
+  texlive.combine {
+    inherit (texlive) scheme-small collection-langkorean algorithms cm-super;
+  }
+  ```
+
+- There are all the schemes, collections and a few thousand packages, as defined upstream (perhaps with tiny differences).
+- By default you only get executables and files needed during runtime, and a little documentation for the core packages. To change that, you need to add `pkgFilter` function to `combine`.
+
+  ```nix
+  texlive.combine {
+    # inherit (texlive) whatever-you-want;
+    pkgFilter = pkg:
+      pkg.tlType == "run" || pkg.tlType == "bin" || pkg.pname == "cm-super";
+    # elem tlType [ "run" "bin" "doc" "source" ]
+    # there are also other attributes: version, name
+  }
+  ```
+
+- You can list packages e.g. by `nix repl`.
+
+  ```ShellSession
+  $ nix repl
+  nix-repl> :l <nixpkgs>
+  nix-repl> texlive.collection-[TAB]
+  ```
+
+- Note that the wrapper assumes that the result has a chance to be useful. For example, the core executables should be present, as well as some core data files. The supported way of ensuring this is by including some scheme, for example `scheme-basic`, into the combination.
+
+## Custom packages {#sec-language-texlive-custom-packages}
+
+
+You may find that you need to use an external TeX package. A derivation for such package has to provide contents of the "texmf" directory in its output and provide the `tlType` attribute. Here is a (very verbose) example:
+
+```nix
+with import <nixpkgs> {};
+
+let
+  foiltex_run = stdenvNoCC.mkDerivation {
+    pname = "latex-foiltex";
+    version = "2.1.4b";
+    passthru.tlType = "run";
+
+    srcs = [
+      (fetchurl {
+        url = "http://mirrors.ctan.org/macros/latex/contrib/foiltex/foiltex.dtx";
+        sha256 = "07frz0krpz7kkcwlayrwrj2a2pixmv0icbngyw92srp9fp23cqpz";
+      })
+      (fetchurl {
+        url = "http://mirrors.ctan.org/macros/latex/contrib/foiltex/foiltex.ins";
+        sha256 = "09wkyidxk3n3zvqxfs61wlypmbhi1pxmjdi1kns9n2ky8ykbff99";
+      })
+    ];
+
+    unpackPhase = ''
+      runHook preUnpack
+
+      for _src in $srcs; do
+        cp "$_src" $(stripHash "$_src")
+      done
+
+      runHook postUnpack
+    '';
+
+    nativeBuildInputs = [ texlive.combined.scheme-small ];
+
+    dontConfigure = true;
+
+    buildPhase = ''
+      runHook preBuild
+
+      # Generate the style files
+      latex foiltex.ins
+
+      runHook postBuild
+    '';
+
+    installPhase = ''
+      runHook preInstall
+
+      path="$out/tex/latex/foiltex"
+      mkdir -p "$path"
+      cp *.{cls,def,clo} "$path/"
+
+      runHook postInstall
+    '';
+
+    meta = with lib; {
+      description = "A LaTeX2e class for overhead transparencies";
+      license = licenses.unfreeRedistributable;
+      maintainers = with maintainers; [ veprbl ];
+      platforms = platforms.all;
+    };
+  };
+  foiltex = { pkgs = [ foiltex_run ]; };
+
+  latex_with_foiltex = texlive.combine {
+    inherit (texlive) scheme-small;
+    inherit foiltex;
+  };
+in
+  runCommand "test.pdf" {
+    nativeBuildInputs = [ latex_with_foiltex ];
+  } ''
+cat >test.tex <<EOF
+\documentclass{foils}
+
+\title{Presentation title}
+\date{}
+
+\begin{document}
+\maketitle
+\end{document}
+EOF
+  pdflatex test.tex
+  cp test.pdf $out
+''
+```
diff --git a/third_party/nixpkgs/doc/languages-frameworks/texlive.xml b/third_party/nixpkgs/doc/languages-frameworks/texlive.xml
deleted file mode 100644
index 141c46e5a6..0000000000
--- a/third_party/nixpkgs/doc/languages-frameworks/texlive.xml
+++ /dev/null
@@ -1,152 +0,0 @@
-<section xmlns="http://docbook.org/ns/docbook"
-         xmlns:xlink="http://www.w3.org/1999/xlink"
-         xml:id="sec-language-texlive">
- <title>TeX Live</title>
-
- <para>
-  Since release 15.09 there is a new TeX Live packaging that lives entirely under attribute <varname>texlive</varname>.
- </para>
-
- <section xml:id="sec-language-texlive-users-guide">
-  <title>User's guide</title>
-
-  <itemizedlist>
-   <listitem>
-    <para>
-     For basic usage just pull <varname>texlive.combined.scheme-basic</varname> for an environment with basic LaTeX support.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     It typically won't work to use separately installed packages together. Instead, you can build a custom set of packages like this:
-<programlisting>
-texlive.combine {
-  inherit (texlive) scheme-small collection-langkorean algorithms cm-super;
-}
-</programlisting>
-     There are all the schemes, collections and a few thousand packages, as defined upstream (perhaps with tiny differences).
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     By default you only get executables and files needed during runtime, and a little documentation for the core packages. To change that, you need to add <varname>pkgFilter</varname> function to <varname>combine</varname>.
-<programlisting>
-texlive.combine {
-  # inherit (texlive) whatever-you-want;
-  pkgFilter = pkg:
-    pkg.tlType == "run" || pkg.tlType == "bin" || pkg.pname == "cm-super";
-  # elem tlType [ "run" "bin" "doc" "source" ]
-  # there are also other attributes: version, name
-}
-</programlisting>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     You can list packages e.g. by <command>nix repl</command>.
-<programlisting>
-<prompt>$ </prompt>nix repl
-<prompt>nix-repl> </prompt>:l &lt;nixpkgs>
-<prompt>nix-repl> </prompt>texlive.collection-<keycap function="tab" />
-</programlisting>
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     Note that the wrapper assumes that the result has a chance to be useful. For example, the core executables should be present, as well as some core data files. The supported way of ensuring this is by including some scheme, for example <varname>scheme-basic</varname>, into the combination.
-    </para>
-   </listitem>
-  </itemizedlist>
- </section>
-
- <section xml:id="sec-language-texlive-custom-packages">
-  <title>Custom packages</title>
-  <para>
-    You may find that you need to use an external TeX package. A derivation for such package has to provide contents of the "texmf" directory in its output and provide the <varname>tlType</varname> attribute. Here is a (very verbose) example:
-<programlisting><![CDATA[
-with import <nixpkgs> {};
-
-let
-  foiltex_run = stdenvNoCC.mkDerivation {
-    pname = "latex-foiltex";
-    version = "2.1.4b";
-    passthru.tlType = "run";
-
-    srcs = [
-      (fetchurl {
-        url = "http://mirrors.ctan.org/macros/latex/contrib/foiltex/foiltex.dtx";
-        sha256 = "07frz0krpz7kkcwlayrwrj2a2pixmv0icbngyw92srp9fp23cqpz";
-      })
-      (fetchurl {
-        url = "http://mirrors.ctan.org/macros/latex/contrib/foiltex/foiltex.ins";
-        sha256 = "09wkyidxk3n3zvqxfs61wlypmbhi1pxmjdi1kns9n2ky8ykbff99";
-      })
-    ];
-
-    unpackPhase = ''
-      runHook preUnpack
-
-      for _src in $srcs; do
-        cp "$_src" $(stripHash "$_src")
-      done
-
-      runHook postUnpack
-    '';
-
-    nativeBuildInputs = [ texlive.combined.scheme-small ];
-
-    dontConfigure = true;
-
-    buildPhase = ''
-      runHook preBuild
-
-      # Generate the style files
-      latex foiltex.ins
-
-      runHook postBuild
-    '';
-
-    installPhase = ''
-      runHook preInstall
-
-      path="$out/tex/latex/foiltex"
-      mkdir -p "$path"
-      cp *.{cls,def,clo} "$path/"
-
-      runHook postInstall
-    '';
-
-    meta = with lib; {
-      description = "A LaTeX2e class for overhead transparencies";
-      license = licenses.unfreeRedistributable;
-      maintainers = with maintainers; [ veprbl ];
-      platforms = platforms.all;
-    };
-  };
-  foiltex = { pkgs = [ foiltex_run ]; };
-
-  latex_with_foiltex = texlive.combine {
-    inherit (texlive) scheme-small;
-    inherit foiltex;
-  };
-in
-  runCommand "test.pdf" {
-    nativeBuildInputs = [ latex_with_foiltex ];
-  } ''
-cat >test.tex <<EOF
-\documentclass{foils}
-
-\title{Presentation title}
-\date{}
-
-\begin{document}
-\maketitle
-\end{document}
-EOF
-  pdflatex test.tex
-  cp test.pdf $out
-''
-]]></programlisting>
-  </para>
- </section>
-</section>
diff --git a/third_party/nixpkgs/doc/using/overlays.xml b/third_party/nixpkgs/doc/using/overlays.xml
index 4937e95088..caacb0a046 100644
--- a/third_party/nixpkgs/doc/using/overlays.xml
+++ b/third_party/nixpkgs/doc/using/overlays.xml
@@ -28,6 +28,7 @@
    </para>
 
    <para>
+    NOTE: DO NOT USE THIS in nixpkgs.
     Further overlays can be added by calling the <literal>pkgs.extend</literal> or <literal>pkgs.appendOverlays</literal>, although it is often preferable to avoid these functions, because they recompute the Nixpkgs fixpoint, which is somewhat expensive to do.
    </para>
   </section>
diff --git a/third_party/nixpkgs/lib/modules.nix b/third_party/nixpkgs/lib/modules.nix
index d2d35dbaae..3f2bfd478b 100644
--- a/third_party/nixpkgs/lib/modules.nix
+++ b/third_party/nixpkgs/lib/modules.nix
@@ -265,7 +265,7 @@ rec {
       if badAttrs != {} then
         throw "Module `${key}' has an unsupported attribute `${head (attrNames badAttrs)}'. This is caused by introducing a top-level `config' or `options' attribute. Add configuration attributes immediately on the top level instead, or move all of them (namely: ${toString (attrNames badAttrs)}) into the explicit `config' attribute."
       else
-        { _file = m._file or file;
+        { _file = toString m._file or file;
           key = toString m.key or key;
           disabledModules = m.disabledModules or [];
           imports = m.imports or [];
@@ -273,7 +273,7 @@ rec {
           config = addFreeformType (addMeta (m.config or {}));
         }
     else
-      { _file = m._file or file;
+      { _file = toString m._file or file;
         key = toString m.key or key;
         disabledModules = m.disabledModules or [];
         imports = m.require or [] ++ m.imports or [];
diff --git a/third_party/nixpkgs/lib/systems/default.nix b/third_party/nixpkgs/lib/systems/default.nix
index 9939743157..f6832945a2 100644
--- a/third_party/nixpkgs/lib/systems/default.nix
+++ b/third_party/nixpkgs/lib/systems/default.nix
@@ -25,7 +25,7 @@ rec {
       system = parse.doubleFromSystem final.parsed;
       config = parse.tripleFromSystem final.parsed;
       # Just a guess, based on `system`
-      platform = platforms.selectBySystem final.system;
+      platform = platforms.select final;
       # Determine whether we are compatible with the provided CPU
       isCompatible = platform: parse.isCompatible final.parsed.cpu platform.parsed.cpu;
       # Derived meta-data
diff --git a/third_party/nixpkgs/lib/systems/examples.nix b/third_party/nixpkgs/lib/systems/examples.nix
index 3bbe61ed33..16002450f2 100644
--- a/third_party/nixpkgs/lib/systems/examples.nix
+++ b/third_party/nixpkgs/lib/systems/examples.nix
@@ -7,7 +7,7 @@ let
 
   riscv = bits: {
     config = "riscv${bits}-unknown-linux-gnu";
-    platform = platforms.riscv-multiplatform bits;
+    platform = platforms.riscv-multiplatform;
   };
 in
 
@@ -39,6 +39,11 @@ rec {
     platform = platforms.zero-gravitas;
   };
 
+  remarkable2 = {
+    config = "armv7l-unknown-linux-gnueabihf";
+    platform = platforms.zero-sugar;
+  };
+
   armv7l-hf-multiplatform = {
     config = "armv7l-unknown-linux-gnueabihf";
     platform = platforms.armv7l-hf-multiplatform;
@@ -105,13 +110,13 @@ rec {
   riscv64-embedded = {
     config = "riscv64-none-elf";
     libc = "newlib";
-    platform = platforms.riscv-multiplatform "64";
+    platform = platforms.riscv-multiplatform;
   };
 
   riscv32-embedded = {
     config = "riscv32-none-elf";
     libc = "newlib";
-    platform = platforms.riscv-multiplatform "32";
+    platform = platforms.riscv-multiplatform;
   };
 
   mmix = {
diff --git a/third_party/nixpkgs/lib/systems/platforms.nix b/third_party/nixpkgs/lib/systems/platforms.nix
index 42d9809fd7..a0dccc8598 100644
--- a/third_party/nixpkgs/lib/systems/platforms.nix
+++ b/third_party/nixpkgs/lib/systems/platforms.nix
@@ -217,6 +217,21 @@ rec {
     };
   };
 
+  zero-sugar = {
+    name = "zero-sugar";
+    kernelBaseConfig = "zero-sugar_defconfig";
+    kernelArch = "arm";
+    kernelDTB = true;
+    kernelAutoModules = false;
+    kernelPreferBuiltin = true;
+    kernelTarget = "zImage";
+    gcc = {
+      cpu = "cortex-a7";
+      fpu = "neon-vfpv4";
+      float-abi = "hard";
+    };
+  };
+
   scaleway-c1 = armv7l-hf-multiplatform // {
     gcc = {
       cpu = "cortex-a9";
@@ -456,10 +471,9 @@ rec {
   ## Other
   ##
 
-  riscv-multiplatform = bits: {
+  riscv-multiplatform = {
     name = "riscv-multiplatform";
     kernelArch = "riscv";
-    bfdEmulation = "elf${bits}lriscv";
     kernelTarget = "vmlinux";
     kernelAutoModules = true;
     kernelBaseConfig = "defconfig";
@@ -469,17 +483,22 @@ rec {
     '';
   };
 
-  selectBySystem = system: {
-      i486-linux = pc32;
-      i586-linux = pc32;
-      i686-linux = pc32;
-      x86_64-linux = pc64;
-      armv5tel-linux = sheevaplug;
-      armv6l-linux = raspberrypi;
-      armv7a-linux = armv7l-hf-multiplatform;
-      armv7l-linux = armv7l-hf-multiplatform;
-      aarch64-linux = aarch64-multiplatform;
-      mipsel-linux = fuloong2f_n32;
-      powerpc64le-linux = powernv;
-    }.${system} or pcBase;
+  select = platform:
+    # x86
+    /**/ if platform.isx86_32 then pc32
+    else if platform.isx86_64 then pc64
+
+    # ARM
+    else if platform.isAarch32 then let
+      version = platform.parsed.cpu.version or "";
+      in     if lib.versionOlder version "6" then sheevaplug
+        else if lib.versionOlder version "7" then raspberrypi
+        else armv7l-hf-multiplatform
+    else if platform.isAarch64 then aarch64-multiplatform
+
+    else if platform.parsed.cpu == lib.systems.parse.cpuTypes.mipsel then fuloong2f_n32
+
+    else if platform.parsed.cpu == lib.systems.parse.cpuTypes.powerpc64le then powernv
+
+    else pcBase;
 }
diff --git a/third_party/nixpkgs/maintainers/maintainer-list.nix b/third_party/nixpkgs/maintainers/maintainer-list.nix
index 1967e7bee8..54a97f2b7a 100644
--- a/third_party/nixpkgs/maintainers/maintainer-list.nix
+++ b/third_party/nixpkgs/maintainers/maintainer-list.nix
@@ -2755,6 +2755,16 @@
     email = "adam.copp@gmail.com";
     name = "Adam Copp";
   };
+  ethancedwards8 = {
+    email = "ethancarteredwards@gmail.com";
+    github = "ethancedwards8";
+    githubId = 60861925;
+    name = "Ethan Carter Edwards";
+    keys = [{
+      longkeyid = "rsa4096/0xF93DDAFA26EF2458";
+      fingerprint = "0E69 0F46 3457 D812 3387  C978 F93D DAFA 26EF 2458";
+    }];
+  };
   ethercrow = {
     email = "ethercrow@gmail.com";
     github = "ethercrow";
@@ -3437,6 +3447,12 @@
       fingerprint = "74B1 F67D 8E43 A94A 7554  0768 9CCC E364 02CB 49A6";
     }];
   };
+  happysalada = {
+    email = "raphael@megzari.com";
+    github = "happysalada";
+    githubId = 5317234;
+    name = "Raphael Megzari";
+  };
   haslersn = {
     email = "haslersn@fius.informatik.uni-stuttgart.de";
     github = "haslersn";
@@ -4807,6 +4823,12 @@
     githubId = 2422454;
     name = "Kai Wohlfahrt";
   };
+  kyleondy = {
+    email = "kyle@ondy.org";
+    github = "kyleondy";
+    githubId = 1640900;
+    name = "Kyle Ondy";
+  };
   kylesferrazza = {
     name = "Kyle Sferrazza";
     email = "kyle.sferrazza@gmail.com";
@@ -6213,6 +6235,16 @@
     githubId = 1916245;
     name = "Fernando Jose Pando";
   };
+  nasirhm = {
+    email = "nasirhussainm14@gmail.com";
+    github = "nasirhm";
+    githubId = 35005234;
+    name = "Nasir Hussain";
+    keys = [{
+      longkeyid = "rsa4096/0xD8126E559CE7C35D";
+      fingerprint = "7A10 AB8E 0BEC 566B 090C  9BE3 D812 6E55 9CE7 C35D";
+    }];
+  };
   Nate-Devv = {
     email = "natedevv@gmail.com";
     name = "Nathan Moore";
@@ -6759,6 +6791,12 @@
     githubId = 8641;
     name = "Pierre Carrier";
   };
+  pengmeiyu = {
+    email = "pengmyu@gmail.com";
+    github = "pmeiyu";
+    githubId = 8529551;
+    name = "Peng Mei Yu";
+  };
   penguwin = {
     email = "penguwin@penguwin.eu";
     github = "penguwin";
diff --git a/third_party/nixpkgs/nixos/doc/manual/installation/installing.xml b/third_party/nixpkgs/nixos/doc/manual/installation/installing.xml
index 6df1d83034..bedeb7ccfa 100644
--- a/third_party/nixpkgs/nixos/doc/manual/installation/installing.xml
+++ b/third_party/nixpkgs/nixos/doc/manual/installation/installing.xml
@@ -480,13 +480,8 @@ Retype new UNIX password: ***</screen>
 <prompt>$ </prompt>passwd eelco</screen>
     </para>
     <para>
-     You may also want to install some software. For instance,
-<screen>
-<prompt>$ </prompt>nix-env -qaP \*</screen>
-     shows what packages are available, and
-<screen>
-<prompt>$ </prompt>nix-env -f '&lt;nixpkgs&gt;' -iA w3m</screen>
-     installs the <literal>w3m</literal> browser.
+     You may also want to install some software. This will be covered
+     in <xref linkend="sec-package-management" />.
     </para>
    </listitem>
   </orderedlist>
diff --git a/third_party/nixpkgs/nixos/doc/manual/release-notes/rl-2103.xml b/third_party/nixpkgs/nixos/doc/manual/release-notes/rl-2103.xml
index 3186eb7449..96061e9ca5 100644
--- a/third_party/nixpkgs/nixos/doc/manual/release-notes/rl-2103.xml
+++ b/third_party/nixpkgs/nixos/doc/manual/release-notes/rl-2103.xml
@@ -160,6 +160,11 @@
     <package>btc1</package> has been abandoned upstream, and removed.
     </para>
    </listitem>
+   <listitem>
+    <para>
+    <package>cpp_ethereum</package> (aleth) has been abandoned upstream, and removed.
+    </para>
+   </listitem>
    <listitem>
     <para>
     <package>riak-cs</package> package removed along with <varname>services.riak-cs</varname> module.
@@ -239,6 +244,14 @@
        </para>
      </warning>
    </listitem>
+   <listitem>
+    <para>
+      The <literal>rspamd</literal> services is now sandboxed. It is run as
+      a dynamic user instead of root, so secrets and other files may have to
+      be moved or their permissions may have to be fixed. The sockets are now
+      located in <literal>/run/rspamd</literal> instead of <literal>/run</literal>.
+    </para>
+   </listitem>
   </itemizedlist>
  </section>
 
@@ -331,6 +344,19 @@
      <literal>unbound-control</literal> without passing a custom configuration location.
     </para>
    </listitem>
+   <listitem>
+    <para>
+     NixOS now defaults to the unified cgroup hierarchy (cgroupsv2).
+     See the <link xlink:href="https://www.redhat.com/sysadmin/fedora-31-control-group-v2">Fedora Article for 31</link>
+     for details on why this is desirable, and how it impacts containers.
+    </para>
+    <para>
+     If you want to run containers with a runtime that does not yet support cgroupsv2,
+     you can switch back to the old behaviour by setting
+     <xref linkend="opt-systemd.enableUnifiedCgroupHierarchy"/> = <literal>false</literal>;
+     and rebooting.
+    </para>
+   </listitem>
   </itemizedlist>
  </section>
 </section>
diff --git a/third_party/nixpkgs/nixos/modules/installer/cd-dvd/sd-image.nix b/third_party/nixpkgs/nixos/modules/installer/cd-dvd/sd-image.nix
index d9799aa69c..c8c5a46dfb 100644
--- a/third_party/nixpkgs/nixos/modules/installer/cd-dvd/sd-image.nix
+++ b/third_party/nixpkgs/nixos/modules/installer/cd-dvd/sd-image.nix
@@ -223,9 +223,10 @@ in
         # Figure out device names for the boot device and root filesystem.
         rootPart=$(${pkgs.util-linux}/bin/findmnt -n -o SOURCE /)
         bootDevice=$(lsblk -npo PKNAME $rootPart)
+        partNum=$(lsblk -npo MAJ:MIN $rootPart | awk -F: '{print $2}')
 
         # Resize the root partition and the filesystem to fit the disk
-        echo ",+," | sfdisk -N2 --no-reread $bootDevice
+        echo ",+," | sfdisk -N$partNum --no-reread $bootDevice
         ${pkgs.parted}/bin/partprobe
         ${pkgs.e2fsprogs}/bin/resize2fs $rootPart
 
diff --git a/third_party/nixpkgs/nixos/modules/module-list.nix b/third_party/nixpkgs/nixos/modules/module-list.nix
index f5e6c5f4d6..df8e5e1dd6 100644
--- a/third_party/nixpkgs/nixos/modules/module-list.nix
+++ b/third_party/nixpkgs/nixos/modules/module-list.nix
@@ -397,6 +397,7 @@
   ./services/logging/rsyslogd.nix
   ./services/logging/syslog-ng.nix
   ./services/logging/syslogd.nix
+  ./services/logging/vector.nix
   ./services/mail/clamsmtp.nix
   ./services/mail/davmail.nix
   ./services/mail/dkimproxy-out.nix
diff --git a/third_party/nixpkgs/nixos/modules/security/doas.nix b/third_party/nixpkgs/nixos/modules/security/doas.nix
index b81f2d0c2d..27f6870aaf 100644
--- a/third_party/nixpkgs/nixos/modules/security/doas.nix
+++ b/third_party/nixpkgs/nixos/modules/security/doas.nix
@@ -12,6 +12,7 @@ let
 
   mkOpts = rule: concatStringsSep " " [
     (optionalString rule.noPass "nopass")
+    (optionalString rule.noLog "nolog")
     (optionalString rule.persist "persist")
     (optionalString rule.keepEnv "keepenv")
     "setenv { SSH_AUTH_SOCK ${concatStringsSep " " rule.setEnv} }"
@@ -118,6 +119,16 @@ in
               '';
             };
 
+            noLog = mkOption {
+              type = with types; bool;
+              default = false;
+              description = ''
+                If <code>true</code>, successful executions will not be logged
+                to
+                <citerefentry><refentrytitle>syslogd</refentrytitle><manvolnum>8</manvolnum></citerefentry>.
+              '';
+            };
+
             persist = mkOption {
               type = with types; bool;
               default = false;
diff --git a/third_party/nixpkgs/nixos/modules/security/hidepid.nix b/third_party/nixpkgs/nixos/modules/security/hidepid.nix
index 55a48ea3c9..4953f517e9 100644
--- a/third_party/nixpkgs/nixos/modules/security/hidepid.nix
+++ b/third_party/nixpkgs/nixos/modules/security/hidepid.nix
@@ -23,5 +23,9 @@ with lib;
 
     boot.specialFileSystems."/proc".options = [ "hidepid=2" "gid=${toString config.ids.gids.proc}" ];
     systemd.services.systemd-logind.serviceConfig.SupplementaryGroups = [ "proc" ];
+
+    # Disable cgroupsv2, which doesn't work with hidepid.
+    # https://github.com/NixOS/nixpkgs/pull/104094#issuecomment-729996203
+    systemd.enableUnifiedCgroupHierarchy = false;
   };
 }
diff --git a/third_party/nixpkgs/nixos/modules/services/cluster/k3s/default.nix b/third_party/nixpkgs/nixos/modules/services/cluster/k3s/default.nix
index 2e8bf20a68..f0317fdbd1 100644
--- a/third_party/nixpkgs/nixos/modules/services/cluster/k3s/default.nix
+++ b/third_party/nixpkgs/nixos/modules/services/cluster/k3s/default.nix
@@ -76,6 +76,10 @@ in
       enable = mkDefault true;
     };
 
+    # TODO: disable this once k3s supports cgroupsv2, either by docker
+    # supporting it, or their bundled containerd
+    systemd.enableUnifiedCgroupHierarchy = false;
+
     systemd.services.k3s = {
       description = "k3s service";
       after = mkIf cfg.docker [ "docker.service" ];
diff --git a/third_party/nixpkgs/nixos/modules/services/development/hoogle.nix b/third_party/nixpkgs/nixos/modules/services/development/hoogle.nix
index 1a98f00560..cbf13f027d 100644
--- a/third_party/nixpkgs/nixos/modules/services/development/hoogle.nix
+++ b/third_party/nixpkgs/nixos/modules/services/development/hoogle.nix
@@ -61,10 +61,8 @@ in {
         Restart = "always";
         ExecStart = ''${hoogleEnv}/bin/hoogle server --local --port ${toString cfg.port} --home ${cfg.home}'';
 
-        User = "nobody";
-        Group = "nogroup";
+        DynamicUser = true;
 
-        PrivateTmp = true;
         ProtectHome = true;
 
         RuntimeDirectory = "hoogle";
diff --git a/third_party/nixpkgs/nixos/modules/services/hardware/sane.nix b/third_party/nixpkgs/nixos/modules/services/hardware/sane.nix
index b344dfc206..03070a8f9e 100644
--- a/third_party/nixpkgs/nixos/modules/services/hardware/sane.nix
+++ b/third_party/nixpkgs/nixos/modules/services/hardware/sane.nix
@@ -148,7 +148,7 @@ in
           # saned needs to distinguish between IPv4 and IPv6 to open matching data sockets.
           BindIPv6Only = "ipv6-only";
           Accept = true;
-          MaxConnections = 1;
+          MaxConnections = 64;
         };
       };
 
diff --git a/third_party/nixpkgs/nixos/modules/services/logging/vector.nix b/third_party/nixpkgs/nixos/modules/services/logging/vector.nix
new file mode 100644
index 0000000000..a7c54ad75f
--- /dev/null
+++ b/third_party/nixpkgs/nixos/modules/services/logging/vector.nix
@@ -0,0 +1,61 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+let cfg = config.services.vector;
+
+in {
+  options.services.vector = {
+    enable = mkEnableOption "Vector";
+
+    journaldAccess = mkOption {
+      type = types.bool;
+      default = false;
+      description = ''
+        Enable Vector to access journald.
+      '';
+    };
+
+    settings = mkOption {
+      type = (pkgs.formats.json { }).type;
+      default = { };
+      description = ''
+        Specify the configuration for Vector in Nix.
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable {
+
+    users.groups.vector = { };
+    users.users.vector = {
+      description = "Vector service user";
+      group = "vector";
+      isSystemUser = true;
+    };
+    systemd.services.vector = {
+      description = "Vector event and log aggregator";
+      wantedBy = [ "multi-user.target" ];
+      after = [ "network-online.target" ];
+      requires = [ "network-online.target" ];
+      serviceConfig = let
+        format = pkgs.formats.toml { };
+        conf = format.generate "vector.toml" cfg.settings;
+        validateConfig = file:
+          pkgs.runCommand "validate-vector-conf" { } ''
+            ${pkgs.vector}/bin/vector validate --no-topology --no-environment "${file}"
+            ln -s "${file}" "$out"
+          '';
+      in {
+        ExecStart = "${pkgs.vector}/bin/vector --config ${validateConfig conf}";
+        User = "vector";
+        Group = "vector";
+        Restart = "no";
+        StateDirectory = "vector";
+        ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
+        AmbientCapabilities = "CAP_NET_BIND_SERVICE";
+        # This group is required for accessing journald.
+        SupplementaryGroups = mkIf cfg.journaldAccess "systemd-journal";
+      };
+    };
+  };
+}
diff --git a/third_party/nixpkgs/nixos/modules/services/mail/rspamd.nix b/third_party/nixpkgs/nixos/modules/services/mail/rspamd.nix
index a6c19a2af7..2f9d28195b 100644
--- a/third_party/nixpkgs/nixos/modules/services/mail/rspamd.nix
+++ b/third_party/nixpkgs/nixos/modules/services/mail/rspamd.nix
@@ -371,6 +371,9 @@ in
     };
     services.postfix.config = mkIf cfg.postfix.enable cfg.postfix.config;
 
+    systemd.services.postfix.serviceConfig.SupplementaryGroups =
+      mkIf cfg.postfix.enable [ postfixCfg.group ];
+
     # Allow users to run 'rspamc' and 'rspamadm'.
     environment.systemPackages = [ pkgs.rspamd ];
 
@@ -394,16 +397,45 @@ in
       restartTriggers = [ rspamdDir ];
 
       serviceConfig = {
-        ExecStart = "${pkgs.rspamd}/bin/rspamd ${optionalString cfg.debug "-d"} --user=${cfg.user} --group=${cfg.group} --pid=/run/rspamd.pid -c /etc/rspamd/rspamd.conf -f";
+        ExecStart = "${pkgs.rspamd}/bin/rspamd ${optionalString cfg.debug "-d"} -c /etc/rspamd/rspamd.conf -f";
         Restart = "always";
-        RuntimeDirectory = "rspamd";
-        PrivateTmp = true;
-      };
 
-      preStart = ''
-        ${pkgs.coreutils}/bin/mkdir -p /var/lib/rspamd
-        ${pkgs.coreutils}/bin/chown ${cfg.user}:${cfg.group} /var/lib/rspamd
-      '';
+        User = "${cfg.user}";
+        Group = "${cfg.group}";
+        SupplementaryGroups = mkIf cfg.postfix.enable [ postfixCfg.group ];
+
+        RuntimeDirectory = "rspamd";
+        RuntimeDirectoryMode = "0755";
+        StateDirectory = "rspamd";
+        StateDirectoryMode = "0700";
+
+        AmbientCapabilities = [];
+        CapabilityBoundingSet = [];
+        DevicePolicy = "closed";
+        LockPersonality = true;
+        NoNewPrivileges = true;
+        PrivateDevices = true;
+        PrivateMounts = true;
+        PrivateTmp = true;
+        # we need to chown socket to rspamd-milter
+        PrivateUsers = !cfg.postfix.enable;
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectSystem = "strict";
+        RemoveIPC = true;
+        RestrictAddressFamilies = [ "AF_INET" "AF_INET6" "AF_UNIX" ];
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        SystemCallArchitectures = "native";
+        SystemCallFilter = "@system-service";
+        UMask = "0077";
+      };
     };
   };
   imports = [
diff --git a/third_party/nixpkgs/nixos/modules/services/networking/nat.nix b/third_party/nixpkgs/nixos/modules/services/networking/nat.nix
index 21ae9eb8b6..45eb500fe8 100644
--- a/third_party/nixpkgs/nixos/modules/services/networking/nat.nix
+++ b/third_party/nixpkgs/nixos/modules/services/networking/nat.nix
@@ -9,7 +9,14 @@ with lib;
 let
   cfg = config.networking.nat;
 
-  dest = if cfg.externalIP == null then "-j MASQUERADE" else "-j SNAT --to-source ${cfg.externalIP}";
+  mkDest = externalIP: if externalIP == null
+                       then "-j MASQUERADE"
+                       else "-j SNAT --to-source ${externalIP}";
+  dest = mkDest cfg.externalIP;
+  destIPv6 = mkDest cfg.externalIPv6;
+
+  # Whether given IP (plus optional port) is an IPv6.
+  isIPv6 = ip: builtins.length (lib.splitString ":" ip) > 2;
 
   helpers = import ./helpers.nix { inherit config lib; };
 
@@ -28,63 +35,80 @@ let
     ${cfg.extraStopCommands}
   '';
 
-  setupNat = ''
-    ${helpers}
-    # Create subchain where we store rules
-    ip46tables -w -t nat -N nixos-nat-pre
-    ip46tables -w -t nat -N nixos-nat-post
-    ip46tables -w -t nat -N nixos-nat-out
-
+  mkSetupNat = { iptables, dest, internalIPs, forwardPorts }: ''
     # We can't match on incoming interface in POSTROUTING, so
     # mark packets coming from the internal interfaces.
     ${concatMapStrings (iface: ''
-      iptables -w -t nat -A nixos-nat-pre \
+      ${iptables} -w -t nat -A nixos-nat-pre \
         -i '${iface}' -j MARK --set-mark 1
     '') cfg.internalInterfaces}
 
     # NAT the marked packets.
     ${optionalString (cfg.internalInterfaces != []) ''
-      iptables -w -t nat -A nixos-nat-post -m mark --mark 1 \
+      ${iptables} -w -t nat -A nixos-nat-post -m mark --mark 1 \
         ${optionalString (cfg.externalInterface != null) "-o ${cfg.externalInterface}"} ${dest}
     ''}
 
     # NAT packets coming from the internal IPs.
     ${concatMapStrings (range: ''
-      iptables -w -t nat -A nixos-nat-post \
+      ${iptables} -w -t nat -A nixos-nat-post \
         -s '${range}' ${optionalString (cfg.externalInterface != null) "-o ${cfg.externalInterface}"} ${dest}
-    '') cfg.internalIPs}
+    '') internalIPs}
 
     # NAT from external ports to internal ports.
     ${concatMapStrings (fwd: ''
-      iptables -w -t nat -A nixos-nat-pre \
+      ${iptables} -w -t nat -A nixos-nat-pre \
         -i ${toString cfg.externalInterface} -p ${fwd.proto} \
         --dport ${builtins.toString fwd.sourcePort} \
         -j DNAT --to-destination ${fwd.destination}
 
       ${concatMapStrings (loopbackip:
         let
-          m                = builtins.match "([0-9.]+):([0-9-]+)" fwd.destination;
-          destinationIP    = if (m == null) then throw "bad ip:ports `${fwd.destination}'" else elemAt m 0;
-          destinationPorts = if (m == null) then throw "bad ip:ports `${fwd.destination}'" else builtins.replaceStrings ["-"] [":"] (elemAt m 1);
+          matchIP          = if isIPv6 fwd.destination then "[[]([0-9a-fA-F:]+)[]]" else "([0-9.]+)";
+          m                = builtins.match "${matchIP}:([0-9-]+)" fwd.destination;
+          destinationIP    = if m == null then throw "bad ip:ports `${fwd.destination}'" else elemAt m 0;
+          destinationPorts = if m == null then throw "bad ip:ports `${fwd.destination}'" else builtins.replaceStrings ["-"] [":"] (elemAt m 1);
         in ''
           # Allow connections to ${loopbackip}:${toString fwd.sourcePort} from the host itself
-          iptables -w -t nat -A nixos-nat-out \
+          ${iptables} -w -t nat -A nixos-nat-out \
             -d ${loopbackip} -p ${fwd.proto} \
             --dport ${builtins.toString fwd.sourcePort} \
             -j DNAT --to-destination ${fwd.destination}
 
           # Allow connections to ${loopbackip}:${toString fwd.sourcePort} from other hosts behind NAT
-          iptables -w -t nat -A nixos-nat-pre \
+          ${iptables} -w -t nat -A nixos-nat-pre \
             -d ${loopbackip} -p ${fwd.proto} \
             --dport ${builtins.toString fwd.sourcePort} \
             -j DNAT --to-destination ${fwd.destination}
 
-          iptables -w -t nat -A nixos-nat-post \
+          ${iptables} -w -t nat -A nixos-nat-post \
             -d ${destinationIP} -p ${fwd.proto} \
             --dport ${destinationPorts} \
             -j SNAT --to-source ${loopbackip}
         '') fwd.loopbackIPs}
-    '') cfg.forwardPorts}
+    '') forwardPorts}
+  '';
+
+  setupNat = ''
+    ${helpers}
+    # Create subchains where we store rules
+    ip46tables -w -t nat -N nixos-nat-pre
+    ip46tables -w -t nat -N nixos-nat-post
+    ip46tables -w -t nat -N nixos-nat-out
+
+    ${mkSetupNat {
+      iptables = "iptables";
+      inherit dest;
+      inherit (cfg) internalIPs;
+      forwardPorts = filter (x: !(isIPv6 x.destination)) cfg.forwardPorts;
+    }}
+
+    ${optionalString cfg.enableIPv6 (mkSetupNat {
+      iptables = "ip6tables";
+      dest = destIPv6;
+      internalIPs = cfg.internalIPv6s;
+      forwardPorts = filter (x: isIPv6 x.destination) cfg.forwardPorts;
+    })}
 
     ${optionalString (cfg.dmzHost != null) ''
       iptables -w -t nat -A nixos-nat-pre \
@@ -117,6 +141,15 @@ in
         '';
     };
 
+    networking.nat.enableIPv6 = mkOption {
+      type = types.bool;
+      default = false;
+      description =
+        ''
+          Whether to enable IPv6 NAT.
+        '';
+    };
+
     networking.nat.internalInterfaces = mkOption {
       type = types.listOf types.str;
       default = [];
@@ -141,6 +174,18 @@ in
         '';
     };
 
+    networking.nat.internalIPv6s = mkOption {
+      type = types.listOf types.str;
+      default = [];
+      example = [ "fc00::/64" ];
+      description =
+        ''
+          The IPv6 address ranges for which to perform NAT.  Packets
+          coming from these addresses (on any interface) and destined
+          for the external interface will be rewritten.
+        '';
+    };
+
     networking.nat.externalInterface = mkOption {
       type = types.nullOr types.str;
       default = null;
@@ -164,6 +209,19 @@ in
         '';
     };
 
+    networking.nat.externalIPv6 = mkOption {
+      type = types.nullOr types.str;
+      default = null;
+      example = "2001:dc0:2001:11::175";
+      description =
+        ''
+          The public IPv6 address to which packets from the local
+          network are to be rewritten.  If this is left empty, the
+          IP address associated with the external interface will be
+          used.
+        '';
+    };
+
     networking.nat.forwardPorts = mkOption {
       type = with types; listOf (submodule {
         options = {
@@ -176,7 +234,7 @@ in
           destination = mkOption {
             type = types.str;
             example = "10.0.0.1:80";
-            description = "Forward connection to destination ip:port; to specify a port range, use ip:start-end";
+            description = "Forward connection to destination ip:port (or [ipv6]:port); to specify a port range, use ip:start-end";
           };
 
           proto = mkOption {
@@ -195,11 +253,15 @@ in
         };
       });
       default = [];
-      example = [ { sourcePort = 8080; destination = "10.0.0.1:80"; proto = "tcp"; } ];
+      example = [
+        { sourcePort = 8080; destination = "10.0.0.1:80"; proto = "tcp"; }
+        { sourcePort = 8080; destination = "[fc00::2]:80"; proto = "tcp"; }
+      ];
       description =
         ''
           List of forwarded ports from the external interface to
-          internal destinations by using DNAT.
+          internal destinations by using DNAT. Destination can be
+          IPv6 if IPv6 NAT is enabled.
         '';
     };
 
@@ -246,6 +308,9 @@ in
     (mkIf config.networking.nat.enable {
 
       assertions = [
+        { assertion = cfg.enableIPv6           -> config.networking.enableIPv6;
+          message = "networking.nat.enableIPv6 requires networking.enableIPv6";
+        }
         { assertion = (cfg.dmzHost != null)    -> (cfg.externalInterface != null);
           message = "networking.nat.dmzHost requires networking.nat.externalInterface";
         }
@@ -261,6 +326,15 @@ in
         kernel.sysctl = {
           "net.ipv4.conf.all.forwarding" = mkOverride 99 true;
           "net.ipv4.conf.default.forwarding" = mkOverride 99 true;
+        } // optionalAttrs cfg.enableIPv6 {
+          # Do not prevent IPv6 autoconfiguration.
+          # See <http://strugglers.net/~andy/blog/2011/09/04/linux-ipv6-router-advertisements-and-forwarding/>.
+          "net.ipv6.conf.all.accept_ra" = mkOverride 99 2;
+          "net.ipv6.conf.default.accept_ra" = mkOverride 99 2;
+
+          # Forward IPv6 packets.
+          "net.ipv6.conf.all.forwarding" = mkOverride 99 true;
+          "net.ipv6.conf.default.forwarding" = mkOverride 99 true;
         };
       };
 
diff --git a/third_party/nixpkgs/nixos/modules/services/networking/tailscale.nix b/third_party/nixpkgs/nixos/modules/services/networking/tailscale.nix
index d6684d69e6..1a1474595b 100644
--- a/third_party/nixpkgs/nixos/modules/services/networking/tailscale.nix
+++ b/third_party/nixpkgs/nixos/modules/services/networking/tailscale.nix
@@ -14,11 +14,18 @@ in {
       default = 41641;
       description = "The port to listen on for tunnel traffic (0=autoselect).";
     };
+
+    package = mkOption {
+      type = types.package;
+      default = pkgs.tailscale;
+      defaultText = "pkgs.tailscale";
+      description = "The package to use for tailscale";
+    };
   };
 
   config = mkIf cfg.enable {
-    environment.systemPackages = [ pkgs.tailscale ]; # for the CLI
-    systemd.packages = [ pkgs.tailscale ];
+    environment.systemPackages = [ cfg.package ]; # for the CLI
+    systemd.packages = [ cfg.package ];
     systemd.services.tailscaled = {
       wantedBy = [ "multi-user.target" ];
       serviceConfig.Environment = "PORT=${toString cfg.port}";
diff --git a/third_party/nixpkgs/nixos/modules/system/boot/systemd.nix b/third_party/nixpkgs/nixos/modules/system/boot/systemd.nix
index c22264b3e9..cbf9e7b49d 100644
--- a/third_party/nixpkgs/nixos/modules/system/boot/systemd.nix
+++ b/third_party/nixpkgs/nixos/modules/system/boot/systemd.nix
@@ -550,6 +550,14 @@ in
       '';
     };
 
+    systemd.enableUnifiedCgroupHierarchy = mkOption {
+      default = true;
+      type = types.bool;
+      description = ''
+        Whether to enable the unified cgroup hierarchy (cgroupsv2).
+      '';
+    };
+
     systemd.coredump.enable = mkOption {
       default = true;
       type = types.bool;
@@ -1178,6 +1186,7 @@ in
     boot.kernel.sysctl = mkIf (!cfg.coredump.enable) {
       "kernel.core_pattern" = "core";
     };
+    boot.kernelParams = optional (!cfg.enableUnifiedCgroupHierarchy) "systemd.unified_cgroup_hierarchy=0";
   };
 
   # FIXME: Remove these eventually.
diff --git a/third_party/nixpkgs/nixos/modules/virtualisation/docker.nix b/third_party/nixpkgs/nixos/modules/virtualisation/docker.nix
index d87ada35a0..ec257801b3 100644
--- a/third_party/nixpkgs/nixos/modules/virtualisation/docker.nix
+++ b/third_party/nixpkgs/nixos/modules/virtualisation/docker.nix
@@ -155,6 +155,9 @@ in
       users.groups.docker.gid = config.ids.gids.docker;
       systemd.packages = [ cfg.package ];
 
+      # TODO: remove once docker 20.10 is released
+      systemd.enableUnifiedCgroupHierarchy = false;
+
       systemd.services.docker = {
         wantedBy = optional cfg.enableOnBoot "multi-user.target";
         environment = proxy_env;
diff --git a/third_party/nixpkgs/nixos/tests/all-tests.nix b/third_party/nixpkgs/nixos/tests/all-tests.nix
index d746105ea6..2e79a21456 100644
--- a/third_party/nixpkgs/nixos/tests/all-tests.nix
+++ b/third_party/nixpkgs/nixos/tests/all-tests.nix
@@ -40,18 +40,18 @@ in
   bittorrent = handleTest ./bittorrent.nix {};
   bitwarden = handleTest ./bitwarden.nix {};
   blockbook-frontend = handleTest ./blockbook-frontend.nix {};
-  buildkite-agents = handleTest ./buildkite-agents.nix {};
   boot = handleTestOn ["x86_64-linux"] ./boot.nix {}; # syslinux is unsupported on aarch64
   boot-stage1 = handleTest ./boot-stage1.nix {};
   borgbackup = handleTest ./borgbackup.nix {};
   buildbot = handleTest ./buildbot.nix {};
+  buildkite-agents = handleTest ./buildkite-agents.nix {};
   caddy = handleTest ./caddy.nix {};
   cadvisor = handleTestOn ["x86_64-linux"] ./cadvisor.nix {};
   cage = handleTest ./cage.nix {};
   cagebreak = handleTest ./cagebreak.nix {};
   cassandra = handleTest ./cassandra.nix {};
-  ceph-single-node = handleTestOn ["x86_64-linux"] ./ceph-single-node.nix {};
   ceph-multi-node = handleTestOn ["x86_64-linux"] ./ceph-multi-node.nix {};
+  ceph-single-node = handleTestOn ["x86_64-linux"] ./ceph-single-node.nix {};
   certmgr = handleTest ./certmgr.nix {};
   cfssl = handleTestOn ["x86_64-linux"] ./cfssl.nix {};
   charliecloud = handleTest ./charliecloud.nix {};
@@ -59,9 +59,9 @@ in
   cjdns = handleTest ./cjdns.nix {};
   clickhouse = handleTest ./clickhouse.nix {};
   cloud-init = handleTest ./cloud-init.nix {};
+  cockroachdb = handleTestOn ["x86_64-linux"] ./cockroachdb.nix {};
   codimd = handleTest ./codimd.nix {};
   consul = handleTest ./consul.nix {};
-  cockroachdb = handleTestOn ["x86_64-linux"] ./cockroachdb.nix {};
   containers-bridge = handleTest ./containers-bridge.nix {};
   containers-custom-pkgs.nix = handleTest ./containers-custom-pkgs.nix {};
   containers-ephemeral = handleTest ./containers-ephemeral.nix {};
@@ -85,7 +85,6 @@ in
   dnscrypt-wrapper = handleTestOn ["x86_64-linux"] ./dnscrypt-wrapper {};
   doas = handleTest ./doas.nix {};
   docker = handleTestOn ["x86_64-linux"] ./docker.nix {};
-  oci-containers = handleTestOn ["x86_64-linux"] ./oci-containers.nix {};
   docker-edge = handleTestOn ["x86_64-linux"] ./docker-edge.nix {};
   docker-registry = handleTest ./docker-registry.nix {};
   docker-tools = handleTestOn ["x86_64-linux"] ./docker-tools.nix {};
@@ -119,24 +118,23 @@ in
   fsck = handleTest ./fsck.nix {};
   ft2-clone = handleTest ./ft2-clone.nix {};
   gerrit = handleTest ./gerrit.nix {};
-  gotify-server = handleTest ./gotify-server.nix {};
-  grocy = handleTest ./grocy.nix {};
   gitdaemon = handleTest ./gitdaemon.nix {};
   gitea = handleTest ./gitea.nix {};
   gitlab = handleTest ./gitlab.nix {};
   gitolite = handleTest ./gitolite.nix {};
   gitolite-fcgiwrap = handleTest ./gitolite-fcgiwrap.nix {};
   glusterfs = handleTest ./glusterfs.nix {};
-  gnome3-xorg = handleTest ./gnome3-xorg.nix {};
   gnome3 = handleTest ./gnome3.nix {};
-  installed-tests = pkgs.recurseIntoAttrs (handleTest ./installed-tests {});
+  gnome3-xorg = handleTest ./gnome3-xorg.nix {};
+  go-neb = handleTest ./go-neb.nix {};
   gocd-agent = handleTest ./gocd-agent.nix {};
   gocd-server = handleTest ./gocd-server.nix {};
-  go-neb = handleTest ./go-neb.nix {};
   google-oslogin = handleTest ./google-oslogin {};
+  gotify-server = handleTest ./gotify-server.nix {};
   grafana = handleTest ./grafana.nix {};
   graphite = handleTest ./graphite.nix {};
   graylog = handleTest ./graylog.nix {};
+  grocy = handleTest ./grocy.nix {};
   grub = handleTest ./grub.nix {};
   gvisor = handleTest ./gvisor.nix {};
   hadoop.hdfs = handleTestOn [ "x86_64-linux" ] ./hadoop/hdfs.nix {};
@@ -144,6 +142,8 @@ in
   handbrake = handleTestOn ["x86_64-linux"] ./handbrake.nix {};
   haproxy = handleTest ./haproxy.nix {};
   hardened = handleTest ./hardened.nix {};
+  installed-tests = pkgs.recurseIntoAttrs (handleTest ./installed-tests {});
+  oci-containers = handleTestOn ["x86_64-linux"] ./oci-containers.nix {};
   # 9pnet_virtio used to mount /nix partition doesn't support
   # hibernation. This test happens to work on x86_64-linux but
   # not on other platforms.
@@ -160,8 +160,8 @@ in
   ihatemoney = handleTest ./ihatemoney.nix {};
   incron = handleTest ./incron.nix {};
   influxdb = handleTest ./influxdb.nix {};
-  initrd-network-ssh = handleTest ./initrd-network-ssh {};
   initrd-network-openvpn = handleTest ./initrd-network-openvpn {};
+  initrd-network-ssh = handleTest ./initrd-network-ssh {};
   initrdNetwork = handleTest ./initrd-network.nix {};
   installer = handleTest ./installer.nix {};
   iodine = handleTest ./iodine.nix {};
@@ -201,8 +201,8 @@ in
   lxd-nftables = handleTest ./lxd-nftables.nix {};
   #logstash = handleTest ./logstash.nix {};
   lorri = handleTest ./lorri/default.nix {};
-  magnetico = handleTest ./magnetico.nix {};
   magic-wormhole-mailbox-server = handleTest ./magic-wormhole-mailbox-server.nix {};
+  magnetico = handleTest ./magnetico.nix {};
   mailcatcher = handleTest ./mailcatcher.nix {};
   mariadb-galera-mariabackup = handleTest ./mysql/mariadb-galera-mariabackup.nix {};
   mariadb-galera-rsync = handleTest ./mysql/mariadb-galera-rsync.nix {};
@@ -213,9 +213,9 @@ in
   metabase = handleTest ./metabase.nix {};
   minecraft = handleTest ./minecraft.nix {};
   minecraft-server = handleTest ./minecraft-server.nix {};
+  minidlna = handleTest ./minidlna.nix {};
   miniflux = handleTest ./miniflux.nix {};
   minio = handleTest ./minio.nix {};
-  minidlna = handleTest ./minidlna.nix {};
   misc = handleTest ./misc.nix {};
   moinmoin = handleTest ./moinmoin.nix {};
   mongodb = handleTest ./mongodb.nix {};
@@ -240,10 +240,10 @@ in
   ncdns = handleTest ./ncdns.nix {};
   ndppd = handleTest ./ndppd.nix {};
   neo4j = handleTest ./neo4j.nix {};
-  specialisation = handleTest ./specialisation.nix {};
   netdata = handleTest ./netdata.nix {};
   networking.networkd = handleTest ./networking.nix { networkd = true; };
   networking.scripted = handleTest ./networking.nix { networkd = false; };
+  specialisation = handleTest ./specialisation.nix {};
   # TODO: put in networking.nix after the test becomes more complete
   networkingProxy = handleTest ./networking-proxy.nix {};
   nextcloud = handleTest ./nextcloud {};
@@ -269,8 +269,8 @@ in
   openldap = handleTest ./openldap.nix {};
   opensmtpd = handleTest ./opensmtpd.nix {};
   openssh = handleTest ./openssh.nix {};
-  openstack-image-userdata = (handleTestOn ["x86_64-linux"] ./openstack-image.nix {}).userdata or {};
   openstack-image-metadata = (handleTestOn ["x86_64-linux"] ./openstack-image.nix {}).metadata or {};
+  openstack-image-userdata = (handleTestOn ["x86_64-linux"] ./openstack-image.nix {}).userdata or {};
   orangefs = handleTest ./orangefs.nix {};
   os-prober = handleTestOn ["x86_64-linux"] ./os-prober.nix {};
   osrm-backend = handleTest ./osrm-backend.nix {};
@@ -280,6 +280,7 @@ in
   pam-u2f = handleTest ./pam-u2f.nix {};
   pantheon = handleTest ./pantheon.nix {};
   paperless = handleTest ./paperless.nix {};
+  pdns-recursor = handleTest ./pdns-recursor.nix {};
   peerflix = handleTest ./peerflix.nix {};
   pgjwt = handleTest ./pgjwt.nix {};
   pgmanage = handleTest ./pgmanage.nix {};
@@ -339,9 +340,9 @@ in
   snapper = handleTest ./snapper.nix {};
   sogo = handleTest ./sogo.nix {};
   solr = handleTest ./solr.nix {};
+  sonarr = handleTest ./sonarr.nix {};
   spacecookie = handleTest ./spacecookie.nix {};
   spike = handleTest ./spike.nix {};
-  sonarr = handleTest ./sonarr.nix {};
   sslh = handleTest ./sslh.nix {};
   sssd = handleTestOn ["x86_64-linux"] ./sssd.nix {};
   sssd-ldap = handleTestOn ["x86_64-linux"] ./sssd-ldap.nix {};
@@ -358,13 +359,12 @@ in
   systemd-boot = handleTest ./systemd-boot.nix {};
   systemd-confinement = handleTest ./systemd-confinement.nix {};
   systemd-journal = handleTest ./systemd-journal.nix {};
-  systemd-timesyncd = handleTest ./systemd-timesyncd.nix {};
-  systemd-networkd-vrf = handleTest ./systemd-networkd-vrf.nix {};
   systemd-networkd = handleTest ./systemd-networkd.nix {};
   systemd-networkd-dhcpserver = handleTest ./systemd-networkd-dhcpserver.nix {};
   systemd-networkd-ipv6-prefix-delegation = handleTest ./systemd-networkd-ipv6-prefix-delegation.nix {};
+  systemd-networkd-vrf = handleTest ./systemd-networkd-vrf.nix {};
   systemd-nspawn = handleTest ./systemd-nspawn.nix {};
-  pdns-recursor = handleTest ./pdns-recursor.nix {};
+  systemd-timesyncd = handleTest ./systemd-timesyncd.nix {};
   taskserver = handleTest ./taskserver.nix {};
   telegraf = handleTest ./telegraf.nix {};
   tiddlywiki = handleTest ./tiddlywiki.nix {};
@@ -372,20 +372,22 @@ in
   tinydns = handleTest ./tinydns.nix {};
   tor = handleTest ./tor.nix {};
   # traefik test relies on docker-containers
+  trac = handleTest ./trac.nix {};
   traefik = handleTestOn ["x86_64-linux"] ./traefik.nix {};
   transmission = handleTest ./transmission.nix {};
-  trac = handleTest ./trac.nix {};
-  trilium-server = handleTestOn ["x86_64-linux"] ./trilium-server.nix {};
   trezord = handleTest ./trezord.nix {};
   trickster = handleTest ./trickster.nix {};
+  trilium-server = handleTestOn ["x86_64-linux"] ./trilium-server.nix {};
   tuptime = handleTest ./tuptime.nix {};
-  unbound = handleTest ./unbound.nix {};
+  ucg = handleTest ./ucg.nix {};
   udisks2 = handleTest ./udisks2.nix {};
+  unbound = handleTest ./unbound.nix {};
   unit-php = handleTest ./web-servers/unit-php.nix {};
   upnp = handleTest ./upnp.nix {};
   uwsgi = handleTest ./uwsgi.nix {};
   v2ray = handleTest ./v2ray.nix {};
   vault = handleTest ./vault.nix {};
+  vector = handleTest ./vector.nix {};
   victoriametrics = handleTest ./victoriametrics.nix {};
   virtualbox = handleTestOn ["x86_64-linux"] ./virtualbox.nix {};
   wasabibackend = handleTest ./wasabibackend.nix {};
diff --git a/third_party/nixpkgs/nixos/tests/docker-tools.nix b/third_party/nixpkgs/nixos/tests/docker-tools.nix
index 8e0e82d64c..3d1e39a379 100644
--- a/third_party/nixpkgs/nixos/tests/docker-tools.nix
+++ b/third_party/nixpkgs/nixos/tests/docker-tools.nix
@@ -117,7 +117,8 @@ import ./make-test-python.nix ({ pkgs, ... }: {
         )
         docker.wait_until_succeeds("curl -f http://localhost:8000/")
         docker.succeed(
-            "docker rm --force nginx", "docker rmi '${examples.nginx.imageName}'",
+            "docker rm --force nginx",
+            "docker rmi '${examples.nginx.imageName}'",
         )
 
     with subtest("A pulled image can be used as base image"):
diff --git a/third_party/nixpkgs/nixos/tests/gitea.nix b/third_party/nixpkgs/nixos/tests/gitea.nix
index aaed248642..1fb27593f0 100644
--- a/third_party/nixpkgs/nixos/tests/gitea.nix
+++ b/third_party/nixpkgs/nixos/tests/gitea.nix
@@ -14,6 +14,7 @@ let
 
     nodes = {
       server = { config, pkgs, ... }: {
+        virtualisation.memorySize = 2048;
         services.gitea = {
           enable = true;
           database = { inherit type; };
diff --git a/third_party/nixpkgs/nixos/tests/misc.nix b/third_party/nixpkgs/nixos/tests/misc.nix
index ae15055327..40661cdca0 100644
--- a/third_party/nixpkgs/nixos/tests/misc.nix
+++ b/third_party/nixpkgs/nixos/tests/misc.nix
@@ -88,8 +88,8 @@ import ./make-test-python.nix ({ pkgs, ...} : rec {
       with subtest("whether kernel.poweroff_cmd is set"):
           machine.succeed('[ -x "$(cat /proc/sys/kernel/poweroff_cmd)" ]')
 
-      with subtest("whether the blkio controller is properly enabled"):
-          machine.succeed("[ -e /sys/fs/cgroup/blkio/blkio.reset_stats ]")
+      with subtest("whether the io cgroupv2 controller is properly enabled"):
+          machine.succeed("grep -q '\\bio\\b' /sys/fs/cgroup/cgroup.controllers")
 
       with subtest("whether we have a reboot record in wtmp"):
           machine.shutdown
diff --git a/third_party/nixpkgs/nixos/tests/podman.nix b/third_party/nixpkgs/nixos/tests/podman.nix
index cd8c2b4308..dd28563dc4 100644
--- a/third_party/nixpkgs/nixos/tests/podman.nix
+++ b/third_party/nixpkgs/nixos/tests/podman.nix
@@ -34,7 +34,6 @@ import ./make-test-python.nix (
       podman.wait_for_unit("sockets.target")
       start_all()
 
-
       with subtest("Run container as root with runc"):
           podman.succeed("tar cv --files-from /dev/null | podman import - scratchimg")
           podman.succeed(
@@ -53,16 +52,20 @@ import ./make-test-python.nix (
           podman.succeed("podman stop sleeping")
           podman.succeed("podman rm sleeping")
 
-      with subtest("Run container rootless with runc"):
-          podman.succeed(su_cmd("tar cv --files-from /dev/null | podman import - scratchimg"))
+      with subtest("Run container as root with the default backend"):
+          podman.succeed("tar cv --files-from /dev/null | podman import - scratchimg")
           podman.succeed(
-              su_cmd(
-                  "podman run --runtime=runc -d --name=sleeping -v /nix/store:/nix/store -v /run/current-system/sw/bin:/bin scratchimg /bin/sleep 10"
-              )
+              "podman run -d --name=sleeping -v /nix/store:/nix/store -v /run/current-system/sw/bin:/bin scratchimg /bin/sleep 10"
           )
-          podman.succeed(su_cmd("podman ps | grep sleeping"))
-          podman.succeed(su_cmd("podman stop sleeping"))
-          podman.succeed(su_cmd("podman rm sleeping"))
+          podman.succeed("podman ps | grep sleeping")
+          podman.succeed("podman stop sleeping")
+          podman.succeed("podman rm sleeping")
+
+
+      podman.succeed(
+          "mkdir -p /tmp/podman-run-1000/libpod && chown alice -R /tmp/podman-run-1000"
+      )
+
 
       with subtest("Run container rootless with crun"):
           podman.succeed(su_cmd("tar cv --files-from /dev/null | podman import - scratchimg"))
@@ -74,6 +77,18 @@ import ./make-test-python.nix (
           podman.succeed(su_cmd("podman ps | grep sleeping"))
           podman.succeed(su_cmd("podman stop sleeping"))
           podman.succeed(su_cmd("podman rm sleeping"))
+      # As of 2020-11-20, the runc backend doesn't work with cgroupsv2 yet, so we don't run that test.
+
+      with subtest("Run container rootless with the default backend"):
+          podman.succeed(su_cmd("tar cv --files-from /dev/null | podman import - scratchimg"))
+          podman.succeed(
+              su_cmd(
+                  "podman run -d --name=sleeping -v /nix/store:/nix/store -v /run/current-system/sw/bin:/bin scratchimg /bin/sleep 10"
+              )
+          )
+          podman.succeed(su_cmd("podman ps | grep sleeping"))
+          podman.succeed(su_cmd("podman stop sleeping"))
+          podman.succeed(su_cmd("podman rm sleeping"))
     '';
   }
 )
diff --git a/third_party/nixpkgs/nixos/tests/rspamd.nix b/third_party/nixpkgs/nixos/tests/rspamd.nix
index 6eaa02ef42..7f41e1a795 100644
--- a/third_party/nixpkgs/nixos/tests/rspamd.nix
+++ b/third_party/nixpkgs/nixos/tests/rspamd.nix
@@ -13,10 +13,12 @@ let
     machine.succeed("id rspamd >/dev/null")
   '';
   checkSocket = socket: user: group: mode: ''
-    machine.succeed("ls ${socket} >/dev/null")
-    machine.succeed('[[ "$(stat -c %U ${socket})" == "${user}" ]]')
-    machine.succeed('[[ "$(stat -c %G ${socket})" == "${group}" ]]')
-    machine.succeed('[[ "$(stat -c %a ${socket})" == "${mode}" ]]')
+    machine.succeed(
+        "ls ${socket} >/dev/null",
+        '[[ "$(stat -c %U ${socket})" == "${user}" ]]',
+        '[[ "$(stat -c %G ${socket})" == "${group}" ]]',
+        '[[ "$(stat -c %a ${socket})" == "${mode}" ]]',
+    )
   '';
   simple = name: enableIPv6: makeTest {
     name = "rspamd-${name}";
@@ -54,33 +56,35 @@ in
       services.rspamd = {
         enable = true;
         workers.normal.bindSockets = [{
-          socket = "/run/rspamd.sock";
+          socket = "/run/rspamd/rspamd.sock";
           mode = "0600";
-          owner = "root";
-          group = "root";
+          owner = "rspamd";
+          group = "rspamd";
         }];
         workers.controller.bindSockets = [{
-          socket = "/run/rspamd-worker.sock";
+          socket = "/run/rspamd/rspamd-worker.sock";
           mode = "0666";
-          owner = "root";
-          group = "root";
+          owner = "rspamd";
+          group = "rspamd";
         }];
       };
     };
 
     testScript = ''
       ${initMachine}
-      machine.wait_for_file("/run/rspamd.sock")
-      ${checkSocket "/run/rspamd.sock" "root" "root" "600" }
-      ${checkSocket "/run/rspamd-worker.sock" "root" "root" "666" }
+      machine.wait_for_file("/run/rspamd/rspamd.sock")
+      ${checkSocket "/run/rspamd/rspamd.sock" "rspamd" "rspamd" "600" }
+      ${checkSocket "/run/rspamd/rspamd-worker.sock" "rspamd" "rspamd" "666" }
       machine.log(machine.succeed("cat /etc/rspamd/rspamd.conf"))
       machine.log(
           machine.succeed("grep 'CONFDIR/worker-controller.inc' /etc/rspamd/rspamd.conf")
       )
       machine.log(machine.succeed("grep 'CONFDIR/worker-normal.inc' /etc/rspamd/rspamd.conf"))
-      machine.log(machine.succeed("rspamc -h /run/rspamd-worker.sock stat"))
+      machine.log(machine.succeed("rspamc -h /run/rspamd/rspamd-worker.sock stat"))
       machine.log(
-          machine.succeed("curl --unix-socket /run/rspamd-worker.sock http://localhost/ping")
+          machine.succeed(
+              "curl --unix-socket /run/rspamd/rspamd-worker.sock http://localhost/ping"
+          )
       )
     '';
   };
@@ -91,16 +95,16 @@ in
       services.rspamd = {
         enable = true;
         workers.normal.bindSockets = [{
-          socket = "/run/rspamd.sock";
+          socket = "/run/rspamd/rspamd.sock";
           mode = "0600";
-          owner = "root";
-          group = "root";
+          owner = "rspamd";
+          group = "rspamd";
         }];
         workers.controller.bindSockets = [{
-          socket = "/run/rspamd-worker.sock";
+          socket = "/run/rspamd/rspamd-worker.sock";
           mode = "0666";
-          owner = "root";
-          group = "root";
+          owner = "rspamd";
+          group = "rspamd";
         }];
         workers.controller2 = {
           type = "controller";
@@ -116,9 +120,9 @@ in
 
     testScript = ''
       ${initMachine}
-      machine.wait_for_file("/run/rspamd.sock")
-      ${checkSocket "/run/rspamd.sock" "root" "root" "600" }
-      ${checkSocket "/run/rspamd-worker.sock" "root" "root" "666" }
+      machine.wait_for_file("/run/rspamd/rspamd.sock")
+      ${checkSocket "/run/rspamd/rspamd.sock" "rspamd" "rspamd" "600" }
+      ${checkSocket "/run/rspamd/rspamd-worker.sock" "rspamd" "rspamd" "666" }
       machine.log(machine.succeed("cat /etc/rspamd/rspamd.conf"))
       machine.log(
           machine.succeed("grep 'CONFDIR/worker-controller.inc' /etc/rspamd/rspamd.conf")
@@ -137,9 +141,11 @@ in
       machine.wait_until_succeeds(
           "journalctl -u rspamd | grep -i 'starting controller process' >&2"
       )
-      machine.log(machine.succeed("rspamc -h /run/rspamd-worker.sock stat"))
+      machine.log(machine.succeed("rspamc -h /run/rspamd/rspamd-worker.sock stat"))
       machine.log(
-          machine.succeed("curl --unix-socket /run/rspamd-worker.sock http://localhost/ping")
+          machine.succeed(
+              "curl --unix-socket /run/rspamd/rspamd-worker.sock http://localhost/ping"
+          )
       )
       machine.log(machine.succeed("curl http://localhost:11335/ping"))
     '';
diff --git a/third_party/nixpkgs/nixos/tests/systemd.nix b/third_party/nixpkgs/nixos/tests/systemd.nix
index 0fc788f860..f7c13a587c 100644
--- a/third_party/nixpkgs/nixos/tests/systemd.nix
+++ b/third_party/nixpkgs/nixos/tests/systemd.nix
@@ -82,6 +82,10 @@ import ./make-test-python.nix ({ pkgs, ... }: {
             "systemd-run --pty --property=Type=oneshot --property=DynamicUser=yes --property=User=iamatest whoami"
         )
 
+    with subtest("regression test for https://bugs.freedesktop.org/show_bug.cgi?id=77507"):
+        retcode, output = machine.execute("systemctl status testservice1.service")
+        assert retcode in [0, 3]  # https://bugs.freedesktop.org/show_bug.cgi?id=77507
+
     # Regression test for https://github.com/NixOS/nixpkgs/issues/35268
     with subtest("file system with x-initrd.mount is not unmounted"):
         machine.succeed("mountpoint -q /test-x-initrd-mount")
@@ -122,17 +126,6 @@ import ./make-test-python.nix ({ pkgs, ... }: {
         machine.wait_for_unit("multi-user.target")
         assert "fq_codel" in machine.succeed("sysctl net.core.default_qdisc")
 
-    # Test cgroup accounting is enabled
-    with subtest("systemd cgroup accounting is enabled"):
-        machine.wait_for_unit("multi-user.target")
-        assert "yes" in machine.succeed(
-            "systemctl show testservice1.service -p IOAccounting"
-        )
-
-        retcode, output = machine.execute("systemctl status testservice1.service")
-        assert retcode in [0, 3]  # https://bugs.freedesktop.org/show_bug.cgi?id=77507
-        assert "CPU:" in output
-
     # Test systemd is configured to manage a watchdog
     with subtest("systemd manages hardware watchdog"):
         machine.wait_for_unit("multi-user.target")
@@ -168,5 +161,25 @@ import ./make-test-python.nix ({ pkgs, ... }: {
         machine.succeed("systemctl status systemd-cryptsetup@luks1.service")
         machine.succeed("mkdir -p /tmp/luks1")
         machine.succeed("mount /dev/mapper/luks1 /tmp/luks1")
+
+    # Do some IP traffic
+    output_ping = machine.succeed(
+        "systemd-run --wait -- /run/wrappers/bin/ping -c 1 127.0.0.1 2>&1"
+    )
+
+    with subtest("systemd reports accounting data on system.slice"):
+        output = machine.succeed("systemctl status system.slice")
+        assert "CPU:" in output
+        assert "Memory:" in output
+
+        assert "IP:" in output
+        assert "0B in, 0B out" not in output
+
+        assert "IO:" in output
+        assert "0B read, 0B written" not in output
+
+    with subtest("systemd per-unit accounting works"):
+        assert "IP traffic received: 84B" in output_ping
+        assert "IP traffic sent: 84B" in output_ping
   '';
 })
diff --git a/third_party/nixpkgs/nixos/tests/ucg.nix b/third_party/nixpkgs/nixos/tests/ucg.nix
new file mode 100644
index 0000000000..47507aee07
--- /dev/null
+++ b/third_party/nixpkgs/nixos/tests/ucg.nix
@@ -0,0 +1,18 @@
+import ./make-test-python.nix ({ pkgs, ... }: {
+  name = "ucg";
+  meta = with pkgs.stdenv.lib.maintainers; {
+    maintainers = [ AndersonTorres ];
+  };
+
+  machine = { pkgs, ... }: {
+    environment.systemPackages = [ pkgs.ucg ];
+  };
+
+  testScript = ''
+    machine.succeed("echo 'Lorem ipsum dolor sit amet\n2.7182818284590' > /tmp/foo")
+    assert "dolor" in machine.succeed("ucg 'dolor' /tmp/foo")
+    assert "Lorem" in machine.succeed("ucg --ignore-case 'lorem' /tmp/foo")
+    machine.fail("ucg --word-regexp '2718' /tmp/foo")
+    machine.fail("ucg 'pisum' /tmp/foo")
+  '';
+})
diff --git a/third_party/nixpkgs/nixos/tests/vector.nix b/third_party/nixpkgs/nixos/tests/vector.nix
new file mode 100644
index 0000000000..e96c3ad152
--- /dev/null
+++ b/third_party/nixpkgs/nixos/tests/vector.nix
@@ -0,0 +1,37 @@
+{ system ? builtins.currentSystem, config ? { }
+, pkgs ? import ../.. { inherit system config; } }:
+
+with import ../lib/testing-python.nix { inherit system pkgs; };
+with pkgs.lib;
+
+{
+  test1 = makeTest {
+    name = "vector-test1";
+    meta.maintainers = [ pkgs.stdenv.lib.maintainers.happysalada ];
+
+    machine = { config, pkgs, ... }: {
+      services.vector = {
+        enable = true;
+        journaldAccess = true;
+        settings = {
+          sources.journald.type = "journald";
+
+          sinks = {
+            file = {
+              type = "file";
+              inputs = [ "journald" ];
+              path = "/var/lib/vector/logs.log";
+              encoding = { codec = "ndjson"; };
+            };
+          };
+        };
+      };
+    };
+
+    # ensure vector is forwarding the messages appropriately
+    testScript = ''
+      machine.wait_for_unit("vector.service")
+      machine.succeed("test -f /var/lib/vector/logs.log")
+    '';
+  };
+}
diff --git a/third_party/nixpkgs/pkgs/applications/audio/cadence/default.nix b/third_party/nixpkgs/pkgs/applications/audio/cadence/default.nix
index 53adb3f146..ea8a526962 100644
--- a/third_party/nixpkgs/pkgs/applications/audio/cadence/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/audio/cadence/default.nix
@@ -96,5 +96,7 @@ mkDerivation rec {
     license = stdenv.lib.licenses.gpl2Plus;
     maintainers = with stdenv.lib.maintainers; [ worldofpeace ];
     platforms = [ "x86_64-linux" ];
+    # Needs QT 5.14
+    broken = true;
   };
 }
diff --git a/third_party/nixpkgs/pkgs/applications/audio/littlegptracker/default.nix b/third_party/nixpkgs/pkgs/applications/audio/littlegptracker/default.nix
index 9b1a1869c2..2fb453cf19 100644
--- a/third_party/nixpkgs/pkgs/applications/audio/littlegptracker/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/audio/littlegptracker/default.nix
@@ -1,5 +1,6 @@
 { stdenv
 , fetchFromGitHub
+, unstableGitUpdater
 , SDL
 , jack2
 , Foundation
@@ -42,6 +43,8 @@ stdenv.mkDerivation rec {
   installPhase = let extension = if stdenv.isDarwin then "app" else "deb-exe";
     in "install -Dm555 lgpt.${extension} $out/bin/lgpt";
 
+  passthru.updateScript = unstableGitUpdater { };
+
   meta = with stdenv.lib; {
     description = "A music tracker similar to lsdj optimised to run on portable game consoles";
     longDescription = ''
diff --git a/third_party/nixpkgs/pkgs/applications/audio/openmpt123/default.nix b/third_party/nixpkgs/pkgs/applications/audio/openmpt123/default.nix
index 91bf47dddd..4d1387bf63 100644
--- a/third_party/nixpkgs/pkgs/applications/audio/openmpt123/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/audio/openmpt123/default.nix
@@ -2,14 +2,14 @@
 , usePulseAudio ? config.pulseaudio or false, libpulseaudio }:
 
 let
-  version = "0.5.3";
+  version = "0.5.4";
 in stdenv.mkDerivation {
   pname = "openmpt123";
   inherit version;
 
   src = fetchurl {
     url = "https://lib.openmpt.org/files/libopenmpt/src/libopenmpt-${version}+release.autotools.tar.gz";
-    sha256 = "1f155yf5v57dwhzb7z0kh67lckr3yq4x8040dm54qgbxw582la77";
+    sha256 = "0h7gpjx1221jwsq3k91p8zhf1h77qaxyasakc88s3g57vawhckgk";
   };
 
   enableParallelBuilding = true;
diff --git a/third_party/nixpkgs/pkgs/applications/backup/deja-dup/default.nix b/third_party/nixpkgs/pkgs/applications/backup/deja-dup/default.nix
index e4898baca5..d6ce864d65 100644
--- a/third_party/nixpkgs/pkgs/applications/backup/deja-dup/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/backup/deja-dup/default.nix
@@ -21,14 +21,14 @@
 
 stdenv.mkDerivation rec {
   pname = "deja-dup";
-  version = "42.5";
+  version = "42.6";
 
   src = fetchFromGitLab {
     domain = "gitlab.gnome.org";
     owner = "World";
     repo = pname;
     rev = version;
-    sha256 = "1xgsd9a9y36lv6f2vjw2nxi9zj2zl1gv6rcyzkqajf91vgmxwf8k";
+    sha256 = "0grwlfakrnr9ij7h8lsfazlws6qix8pl50dr94cpxnnbjga9xn9z";
   };
 
   patches = [
diff --git a/third_party/nixpkgs/pkgs/applications/blockchains/btcpayserver/default.nix b/third_party/nixpkgs/pkgs/applications/blockchains/btcpayserver/default.nix
index eec39e691a..3958a44cda 100644
--- a/third_party/nixpkgs/pkgs/applications/blockchains/btcpayserver/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/blockchains/btcpayserver/default.nix
@@ -15,19 +15,17 @@ in
 
 stdenv.mkDerivation rec {
   pname = "btcpayserver";
-  version = "1.0.5.5";
+  version = "1.0.5.9";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    sha256 = "11h1nrmb7f44msbhhiz9ddqh5ss2kz6d8ysnvd070x3xj5krgnxz";
+    sha256 = "011pp94i49fx587ng16m6ml63vwiysjvpkijihrk6xamz78zddgx";
   };
 
-  nativeBuildInputs = [ dotnetSdk dotnetPackages.Nuget ];
+  nativeBuildInputs = [ dotnetSdk dotnetPackages.Nuget makeWrapper ];
 
-  # Due to a bug in btcpayserver, we can't just `dotnet publish` to create a binary.
-  # Build with `dotnet build` instead and add a custom `dotnet run` script.
   buildPhase = ''
     export HOME=$TMP/home
     export DOTNET_CLI_TELEMETRY_OPTOUT=1
@@ -37,21 +35,15 @@ stdenv.mkDerivation rec {
     nuget init ${linkFarmFromDrvs "deps" deps} $TMP/nuget
 
     dotnet restore --source $TMP/nuget BTCPayServer/BTCPayServer.csproj
-    dotnet build -c Release BTCPayServer/BTCPayServer.csproj
-  '';
-
-  runScript =  ''
-    #!${bash}/bin/bash
-    DOTNET_CLI_TELEMETRY_OPTOUT=1 exec ${dotnetSdk}/bin/dotnet run --no-launch-profile --no-build \
-      -c Release -p @@SHARE@@/BTCPayServer/BTCPayServer.csproj -- "$@"
+    dotnet publish --no-restore --output $out/share/$pname -c Release BTCPayServer/BTCPayServer.csproj
   '';
 
+  # btcpayserver requires the publish directory as its working dir
+  # https://github.com/btcpayserver/btcpayserver/issues/1894
   installPhase = ''
-    cd ..
-    share=$out/share/$pname
-    mkdir -p $share
-    mv -T source $share
-    install -D -m500 <(echo "$runScript" | sed "s|@@SHARE@@|$share|") $out/bin/$pname
+    makeWrapper $out/share/$pname/BTCPayServer $out/bin/$pname \
+      --set DOTNET_ROOT "${dotnetSdk}" \
+      --run "cd $out/share/$pname"
   '';
 
   dontStrip = true;
diff --git a/third_party/nixpkgs/pkgs/applications/blockchains/btcpayserver/deps.nix b/third_party/nixpkgs/pkgs/applications/blockchains/btcpayserver/deps.nix
index cb0641b8c8..5ee5e26121 100644
--- a/third_party/nixpkgs/pkgs/applications/blockchains/btcpayserver/deps.nix
+++ b/third_party/nixpkgs/pkgs/applications/blockchains/btcpayserver/deps.nix
@@ -21,8 +21,8 @@
   })
   (fetchNuGet {
     name = "BTCPayServer.Lightning.All";
-    version = "1.2.3";
-    sha256 = "1vx47rb505904pz30n5jzc9x42pcfln695l31q4dv5p4fbf10g4q";
+    version = "1.2.4";
+    sha256 = "1f4wgs8ijk1wmppz5lmas7l6m83szz57jyk6ak0dxhccdld9rdaj";
   })
   (fetchNuGet {
     name = "BTCPayServer.Lightning.Charge";
@@ -31,8 +31,8 @@
   })
   (fetchNuGet {
     name = "BTCPayServer.Lightning.CLightning";
-    version = "1.2.0";
-    sha256 = "0a47fz20ngcz90h2y01isi2h940jljcmnfy6wyknj029sii7i1zs";
+    version = "1.2.1";
+    sha256 = "14km69jzmnyqg19w27g6znml4z0xkm8l4j7rj0x36bw67cjmgahv";
   })
   (fetchNuGet {
     name = "BTCPayServer.Lightning.Common";
@@ -706,8 +706,8 @@
   })
   (fetchNuGet {
     name = "NBitcoin.Altcoins";
-    version = "2.0.16";
-    sha256 = "0fsdb96k5lwyq4d7h7yg91qghima08yk0bsw5cvr4h2jsfphk423";
+    version = "2.0.21";
+    sha256 = "0xmygiwjlia7fbxy63893jb15g6fxggxxr9bbm8znd9bs3jzp2g1";
   })
   (fetchNuGet {
     name = "NBitcoin";
@@ -726,13 +726,8 @@
   })
   (fetchNuGet {
     name = "NBitcoin";
-    version = "5.0.45";
-    sha256 = "102vwxwkg367yxv26hycnc7hjxlv2zvsgr8g6adw8dmzsxck5fwk";
-  })
-  (fetchNuGet {
-    name = "NBitcoin";
-    version = "5.0.51";
-    sha256 = "0rg014sl7rqscnranwyfk41xfr5ccjqyx7aidfl5mh0znz44db2g";
+    version = "5.0.60";
+    sha256 = "0pin4ldfz5lfxyd47mj1ypyp8lmj0v5nq5zvygdjna956vphd39v";
   })
   (fetchNuGet {
     name = "NBitpayClient";
@@ -741,8 +736,8 @@
   })
   (fetchNuGet {
     name = "NBXplorer.Client";
-    version = "3.0.17";
-    sha256 = "0xx2xshgpci9l9883zpqnmgchpizygy0hcq2wp2ch6yf3hbrj9qq";
+    version = "3.0.19";
+    sha256 = "0nahfxdsryf5snjy87770m51v2jcry02lmb10ilsg4h2ig4pjdk4";
   })
   (fetchNuGet {
     name = "NETStandard.Library";
@@ -956,8 +951,8 @@
   })
   (fetchNuGet {
     name = "Selenium.WebDriver.ChromeDriver";
-    version = "83.0.4103.3900";
-    sha256 = "17j9b637209nm5cs5sgr3vflphkhaxpm8bcjizhgj65r52gn17as";
+    version = "85.0.4183.8700";
+    sha256 = "0klyqmwa6yc0ibbmci51mzb2vl6n13qlk06chc9w78i0a43fs382";
   })
   (fetchNuGet {
     name = "Selenium.WebDriver";
diff --git a/third_party/nixpkgs/pkgs/applications/blockchains/exodus/default.nix b/third_party/nixpkgs/pkgs/applications/blockchains/exodus/default.nix
index 13543114d6..2e6419fd13 100644
--- a/third_party/nixpkgs/pkgs/applications/blockchains/exodus/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/blockchains/exodus/default.nix
@@ -4,11 +4,11 @@ cups, vivaldi-ffmpeg-codecs, libpulseaudio, at-spi2-core }:
 
 stdenv.mkDerivation rec {
   pname = "exodus";
-  version = "20.11.21";
+  version = "20.11.23";
 
   src = fetchurl {
     url = "https://downloads.exodus.io/releases/${pname}-linux-x64-${version}.zip";
-    sha256 = "1q6sh2jhngvihkxjprkcd1php6r7m6qkxsijx8d3azzlgj9nbf2n";
+    sha256 = "0hcvgph2m4nbrarhw2cggc8q5jxwnibiz2mbkypgizphk5svdj9l";
   };
 
   sourceRoot = ".";
diff --git a/third_party/nixpkgs/pkgs/applications/blockchains/nbxplorer/default.nix b/third_party/nixpkgs/pkgs/applications/blockchains/nbxplorer/default.nix
index 76ca21ef9a..45143a797e 100644
--- a/third_party/nixpkgs/pkgs/applications/blockchains/nbxplorer/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/blockchains/nbxplorer/default.nix
@@ -15,13 +15,13 @@ in
 
 stdenv.mkDerivation rec {
   pname = "nbxplorer";
-  version = "2.1.42";
+  version = "2.1.46";
 
   src = fetchFromGitHub {
     owner = "dgarage";
     repo = "NBXplorer";
     rev = "v${version}";
-    sha256 = "01q6n7095rrha00xs3l7igzfb9rd743z8crxa2dcz4q5srapfzpi";
+    sha256 = "1aph7yiwmch7s7x1qkzqv1shs3v6kg8i2s7266la0yp9ksf3w35p";
   };
 
   nativeBuildInputs = [ dotnetSdk dotnetPackages.Nuget makeWrapper ];
diff --git a/third_party/nixpkgs/pkgs/applications/blockchains/nbxplorer/deps.nix b/third_party/nixpkgs/pkgs/applications/blockchains/nbxplorer/deps.nix
index 65afa6b72c..85d395089d 100644
--- a/third_party/nixpkgs/pkgs/applications/blockchains/nbxplorer/deps.nix
+++ b/third_party/nixpkgs/pkgs/applications/blockchains/nbxplorer/deps.nix
@@ -31,8 +31,8 @@
   })
   (fetchNuGet {
     name = "Microsoft.CodeCoverage";
-    version = "16.6.1";
-    sha256 = "01ffm4nflqdb93vq4xl0j3377x360fgx6c6h12mpkcy85ixbv3rl";
+    version = "16.7.1";
+    sha256 = "1farw63445cdyciplfs6l9j1gayxw16rkzmrwsiswfyjhqz70xd4";
   })
   (fetchNuGet {
     name = "Microsoft.CSharp";
@@ -126,8 +126,8 @@
   })
   (fetchNuGet {
     name = "Microsoft.NET.Test.Sdk";
-    version = "16.6.1";
-    sha256 = "0jjdg468jc6pv2z764f3xc19lcr772nzjm9cjfqq3bqw8vkpzmhv";
+    version = "16.7.1";
+    sha256 = "0yqxipj74ax2n76w9ccydppx78ym8m5fda88qnvj4670qjvl0kf8";
   })
   (fetchNuGet {
     name = "Microsoft.NETCore.Platforms";
@@ -156,13 +156,13 @@
   })
   (fetchNuGet {
     name = "Microsoft.TestPlatform.ObjectModel";
-    version = "16.6.1";
-    sha256 = "0q98q1nw6jl4bajm66z4a9vvh928w8ffsd3k6fpsps23ykpsky7h";
+    version = "16.7.1";
+    sha256 = "0s9dyh99gzdpk1i5v468i2r9m6i3jrr41r394pwdwiajsz99kay0";
   })
   (fetchNuGet {
     name = "Microsoft.TestPlatform.TestHost";
-    version = "16.6.1";
-    sha256 = "0anzvb2mda548swb2ll1hv65knb8gwjm01hwbl0pzzr607my3lix";
+    version = "16.7.1";
+    sha256 = "1xik06rxn9ps83in0zn9vcl2ibv3acmdqvrx07qq89lxj1sgqlhs";
   })
   (fetchNuGet {
     name = "Microsoft.Win32.Primitives";
@@ -181,18 +181,23 @@
   })
   (fetchNuGet {
     name = "NBitcoin.Altcoins";
-    version = "2.0.19";
-    sha256 = "12a3bf1pi6sq78z6h3clyczvycx7cjry8fby4fyi748wjwljjizz";
+    version = "2.0.21";
+    sha256 = "0xmygiwjlia7fbxy63893jb15g6fxggxxr9bbm8znd9bs3jzp2g1";
   })
   (fetchNuGet {
     name = "NBitcoin.TestFramework";
-    version = "2.0.11";
-    sha256 = "09jrbq9p5k67kdic2038s7q299y2nc8ij6m55m3m8hys7jdrrv05";
+    version = "2.0.12";
+    sha256 = "1d6lmymc9x3p74c8hc2x3m61ncnkqqgrddw9cw2m0zkvilkncsns";
   })
   (fetchNuGet {
     name = "NBitcoin";
-    version = "5.0.54";
-    sha256 = "0mx2gr8j8bc4mf1vi1fvqj3672qalxvzvincc61if79p46cik24b";
+    version = "5.0.58";
+    sha256 = "0qim9xbbj380254iyi1jsh2gnr90ddwd2593jw9a8bjwnlk7qr2c";
+  })
+  (fetchNuGet {
+    name = "NBitcoin";
+    version = "5.0.60";
+    sha256 = "0pin4ldfz5lfxyd47mj1ypyp8lmj0v5nq5zvygdjna956vphd39v";
   })
   (fetchNuGet {
     name = "NETStandard.Library";
@@ -1061,8 +1066,8 @@
   })
   (fetchNuGet {
     name = "xunit.runner.visualstudio";
-    version = "2.4.2";
-    sha256 = "0fi85h43nyrhfc5jzg07znh01r7cpb7bpjdc6mzb9z1pm14ppfm6";
+    version = "2.4.3";
+    sha256 = "0j1d0rbcm7pp6dypi61sjxp8l22sv261252z55b243l39jgv2rp3";
   })
   (fetchNuGet {
     name = "xunit";
diff --git a/third_party/nixpkgs/pkgs/applications/editors/jetbrains/default.nix b/third_party/nixpkgs/pkgs/applications/editors/jetbrains/default.nix
index 136b0c2686..78e6ad30b7 100644
--- a/third_party/nixpkgs/pkgs/applications/editors/jetbrains/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/editors/jetbrains/default.nix
@@ -307,12 +307,12 @@ in
 
   idea-community = buildIdea rec {
     name = "idea-community-${version}";
-    version = "2020.2.4"; /* updated by script */
+    version = "2020.3"; /* updated by script */
     description = "Integrated Development Environment (IDE) by Jetbrains, community edition";
     license = stdenv.lib.licenses.asl20;
     src = fetchurl {
       url = "https://download.jetbrains.com/idea/ideaIC-${version}.tar.gz";
-      sha256 = "1rlw01aq6ci46xv4d4877k30309jjws29kwhriy98xf804msyzyb"; /* updated by script */
+      sha256 = "0x1nsjw1m03iq7sd9i2qqlyribrzgi8yh6k5hnb630kvrxr8pxy6"; /* updated by script */
     };
     wmClass = "jetbrains-idea-ce";
     update-channel = "IntelliJ IDEA RELEASE";
@@ -320,12 +320,12 @@ in
 
   idea-ultimate = buildIdea rec {
     name = "idea-ultimate-${version}";
-    version = "2020.2.4"; /* updated by script */
+    version = "2020.3"; /* updated by script */
     description = "Integrated Development Environment (IDE) by Jetbrains, requires paid license";
     license = stdenv.lib.licenses.unfree;
     src = fetchurl {
       url = "https://download.jetbrains.com/idea/ideaIU-${version}-no-jbr.tar.gz";
-      sha256 = "05qr8jiasqxmkgi9v52g7hgpdf7pkkjcp42bbkh1f4zgvq81p5py"; /* updated by script */
+      sha256 = "1l6bvfgzp27113rjy1y3jvp09cqx8gpnbgpwp83vsph7x0dhx8a3"; /* updated by script */
     };
     wmClass = "jetbrains-idea";
     update-channel = "IntelliJ IDEA RELEASE";
@@ -333,12 +333,12 @@ in
 
   mps = buildMps rec {
     name = "mps-${version}";
-    version = "2020.2.2"; /* updated by script */
+    version = "2020.2.3"; /* updated by script */
     description = "Create your own domain-specific language";
     license = stdenv.lib.licenses.unfree;
     src = fetchurl {
       url = "https://download.jetbrains.com/mps/2020.2/MPS-${version}.tar.gz";
-      sha256 = "1a09yahky8ii2dypj69m89c3yh7akn7sa74n0j0mff7r46ad421y"; /* updated by script */
+      sha256 = "1wd3d8pc155m54y5p2056p0x93v2nv9457i7la53ibbs7rj1j7kw"; /* updated by script */
     };
     wmClass = "jetbrains-mps";
     update-channel = "MPS RELEASE";
@@ -359,12 +359,12 @@ in
 
   pycharm-community = buildPycharm rec {
     name = "pycharm-community-${version}";
-    version = "2020.2.4"; /* updated by script */
+    version = "2020.2.5"; /* updated by script */
     description = "PyCharm Community Edition";
     license = stdenv.lib.licenses.asl20;
     src = fetchurl {
       url = "https://download.jetbrains.com/python/${name}.tar.gz";
-      sha256 = "196hhb4n52a50w50awx01ksyl5dkrbdmnz8sb9di5ihni7043p97"; /* updated by script */
+      sha256 = "0jkc26y3v94jj8q7dxq1py59is2whh45b890iac5adg6x670z3s6"; /* updated by script */
     };
     wmClass = "jetbrains-pycharm-ce";
     update-channel = "PyCharm RELEASE";
@@ -372,12 +372,12 @@ in
 
   pycharm-professional = buildPycharm rec {
     name = "pycharm-professional-${version}";
-    version = "2020.2.4"; /* updated by script */
+    version = "2020.2.5"; /* updated by script */
     description = "PyCharm Professional Edition";
     license = stdenv.lib.licenses.unfree;
     src = fetchurl {
       url = "https://download.jetbrains.com/python/${name}.tar.gz";
-      sha256 = "0dwd9gvi8n3igza95pil3mf7azxn131830rvfzdvnvrzj9yb2q8l"; /* updated by script */
+      sha256 = "04imfgr45gvicjjgqzdcdmbnbiszjma3s40k2pgqs5nn6wbrw3dd"; /* updated by script */
     };
     wmClass = "jetbrains-pycharm";
     update-channel = "PyCharm RELEASE";
@@ -398,12 +398,12 @@ in
 
   ruby-mine = buildRubyMine rec {
     name = "ruby-mine-${version}";
-    version = "2020.2.4"; /* updated by script */
+    version = "2020.3"; /* updated by script */
     description = "The Most Intelligent Ruby and Rails IDE";
     license = stdenv.lib.licenses.unfree;
     src = fetchurl {
       url = "https://download.jetbrains.com/ruby/RubyMine-${version}.tar.gz";
-      sha256 = "0bpkl8phc16yjm7qjfbg42rm7sbfwbrjva7w0qiwiw9ibwvs90id"; /* updated by script */
+      sha256 = "0ij6j9bxfqzj8gnrhhdgai22s1n5swd4waxd5zjvmv7q9j9cb2l5"; /* updated by script */
     };
     wmClass = "jetbrains-rubymine";
     update-channel = "RubyMine RELEASE";
@@ -411,12 +411,12 @@ in
 
   webstorm = buildWebStorm rec {
     name = "webstorm-${version}";
-    version = "2020.2.4"; /* updated by script */
+    version = "2020.3"; /* updated by script */
     description = "Professional IDE for Web and JavaScript development";
     license = stdenv.lib.licenses.unfree;
     src = fetchurl {
       url = "https://download.jetbrains.com/webstorm/WebStorm-${version}.tar.gz";
-      sha256 = "0l97nk9psb8g0sxm148fcz0x2v9mwqblffigrz2rmac3gd275s7f"; /* updated by script */
+      sha256 = "0sk7slwfr9jasid09hxw81sik5srn35vif3pbzpybig3yszbv6ld"; /* updated by script */
     };
     wmClass = "jetbrains-webstorm";
     update-channel = "WebStorm RELEASE";
diff --git a/third_party/nixpkgs/pkgs/applications/editors/kakoune/plugins/default.nix b/third_party/nixpkgs/pkgs/applications/editors/kakoune/plugins/default.nix
index 93241b93b0..168c1d06b3 100644
--- a/third_party/nixpkgs/pkgs/applications/editors/kakoune/plugins/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/editors/kakoune/plugins/default.nix
@@ -12,4 +12,5 @@
   kak-powerline = pkgs.callPackage ./kak-powerline.nix { };
   kak-prelude = pkgs.callPackage ./kak-prelude.nix { };
   kak-vertical-selection = pkgs.callPackage ./kak-vertical-selection.nix { };
+  openscad-kak = pkgs.callPackage ./openscad.kak.nix { };
 }
diff --git a/third_party/nixpkgs/pkgs/applications/editors/kakoune/plugins/openscad.kak.nix b/third_party/nixpkgs/pkgs/applications/editors/kakoune/plugins/openscad.kak.nix
new file mode 100644
index 0000000000..21c8b7a60c
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/applications/editors/kakoune/plugins/openscad.kak.nix
@@ -0,0 +1,25 @@
+{ stdenv, fetchFromGitHub }:
+
+stdenv.mkDerivation {
+  pname = "openscad.kak";
+  version = "unstable-2019-11-08";
+
+  src = fetchFromGitHub {
+    owner = "mayjs";
+    repo = "openscad.kak";
+    rev = "d9143d5e7834e3356b49720664d5647cab9db7cc";
+    sha256 = "0j4dqhrn56z77hdalfdxagwz8h6nwr8s9i4w0bs2644k72lsm2ix";
+  };
+
+  installPhase = ''
+    install -Dm644 rc/openscad.kak -t $out/share/kak/autoload/plugins/
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Syntax highlighting for OpenSCAD files";
+    homepage = "https://github.com/mayjs/openscad.kak";
+    license = licenses.unlicense;
+    maintainers = with maintainers; [ eraserhd ];
+    platforms = platforms.all;
+  };
+}
diff --git a/third_party/nixpkgs/pkgs/applications/editors/nano/default.nix b/third_party/nixpkgs/pkgs/applications/editors/nano/default.nix
index 04bd6c7b4b..bd8ad4b3d2 100644
--- a/third_party/nixpkgs/pkgs/applications/editors/nano/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/editors/nano/default.nix
@@ -16,11 +16,11 @@ let
 
 in stdenv.mkDerivation rec {
   pname = "nano";
-  version = "5.3";
+  version = "5.4";
 
   src = fetchurl {
     url = "mirror://gnu/nano/${pname}-${version}.tar.xz";
-    sha256 = "0lj3fcfzprmv9raydx8yq25lw81bs6g40rhd0fv9d6idcb7wphf5";
+    sha256 = "1sc6xl9935k9s9clkv83hapijka4qknfnj6f15c3b1i2n84396gy";
   };
 
   nativeBuildInputs = [ texinfo ] ++ optional enableNls gettext;
diff --git a/third_party/nixpkgs/pkgs/applications/gis/qgis/unwrapped.nix b/third_party/nixpkgs/pkgs/applications/gis/qgis/unwrapped.nix
index 13990c3387..54d3d59875 100644
--- a/third_party/nixpkgs/pkgs/applications/gis/qgis/unwrapped.nix
+++ b/third_party/nixpkgs/pkgs/applications/gis/qgis/unwrapped.nix
@@ -53,5 +53,8 @@ in mkDerivation rec {
     license = lib.licenses.gpl2Plus;
     platforms = with lib.platforms; linux;
     maintainers = with lib.maintainers; [ lsix ];
+    # Our 3.10 LTS cannot use a newer Qt (5.15) version because it requires qtwebkit
+    # and our qtwebkit fails to build with 5.15. 01bcfd3579219d60e5d07df309a000f96b2b658b
+    broken = true;
   };
 }
diff --git a/third_party/nixpkgs/pkgs/applications/graphics/avocode/default.nix b/third_party/nixpkgs/pkgs/applications/graphics/avocode/default.nix
index fd94b4e26c..6d4fa50171 100644
--- a/third_party/nixpkgs/pkgs/applications/graphics/avocode/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/graphics/avocode/default.nix
@@ -5,11 +5,11 @@
 
 stdenv.mkDerivation rec {
   pname = "avocode";
-  version = "4.10.3";
+  version = "4.10.4";
 
   src = fetchurl {
     url = "https://media.avocode.com/download/avocode-app/${version}/avocode-${version}-linux.zip";
-    sha256 = "1ngyd3sfnhf8hpi015pgbms5bspc30lzrpfpw3jp992i4mzcjq0z";
+    sha256 = "06xf5y2mljk3pd74ap9n90bhhidbzpg5c6wws361ygd4f3x86c46";
   };
 
   libPath = stdenv.lib.makeLibraryPath (with xorg; [
diff --git a/third_party/nixpkgs/pkgs/applications/graphics/feh/default.nix b/third_party/nixpkgs/pkgs/applications/graphics/feh/default.nix
index 467e593025..0c7f3e8fe1 100644
--- a/third_party/nixpkgs/pkgs/applications/graphics/feh/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/graphics/feh/default.nix
@@ -7,11 +7,11 @@ with stdenv.lib;
 
 stdenv.mkDerivation rec {
   pname = "feh";
-  version = "3.5";
+  version = "3.6";
 
   src = fetchurl {
     url = "https://feh.finalrewind.org/${pname}-${version}.tar.bz2";
-    sha256 = "07jklibpi4ig9pbdrwhllsfffxn2h8xf4ma36qii00w4hb69v3rq";
+    sha256 = "1n6gbyzlc3kx2cq9wfz7azn7mrjmcc9pq436k1n4mrh0lik5sxw7";
   };
 
   outputs = [ "out" "man" "doc" ];
diff --git a/third_party/nixpkgs/pkgs/applications/graphics/fondo/default.nix b/third_party/nixpkgs/pkgs/applications/graphics/fondo/default.nix
index edfe5ca2de..a4d925da3d 100644
--- a/third_party/nixpkgs/pkgs/applications/graphics/fondo/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/graphics/fondo/default.nix
@@ -21,13 +21,13 @@
 
 stdenv.mkDerivation rec {
   pname = "fondo";
-  version = "1.3.10";
+  version = "1.4.0";
 
   src = fetchFromGitHub {
     owner = "calo001";
     repo = pname;
     rev = version;
-    sha256 = "0yrbcngmwhn5gl5if9w2cx8shh33zk5fd6iqwnapsq8y0lzq6ppr";
+    sha256 = "0cdcn4qmdryk2x327f1z3pq8pg4cb0q1jr779gh8s6nqajyk8nqm";
   };
 
   nativeBuildInputs = [
diff --git a/third_party/nixpkgs/pkgs/applications/graphics/imgbrd-grabber/default.nix b/third_party/nixpkgs/pkgs/applications/graphics/imgbrd-grabber/default.nix
index f07db4c5c4..22a35b3a4c 100644
--- a/third_party/nixpkgs/pkgs/applications/graphics/imgbrd-grabber/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/graphics/imgbrd-grabber/default.nix
@@ -18,7 +18,7 @@
 , typescript
 }:
 stdenv.mkDerivation rec {
-  name = "imgbrd-grabber";
+  pname = "imgbrd-grabber";
 
   version = "7.3.2";
   src = fetchFromGitHub {
@@ -84,4 +84,11 @@ stdenv.mkDerivation rec {
   '';
 
   sourceRoot = "source/src";
+
+  meta = with stdenv.lib; {
+    description = "Very customizable imageboard/booru downloader with powerful filenaming features";
+    license = licenses.asl20;
+    homepage = "https://bionus.github.io/imgbrd-grabber/";
+    maintainers = [ maintainers.evanjs ];
+  };
 }
diff --git a/third_party/nixpkgs/pkgs/applications/graphics/imgp/default.nix b/third_party/nixpkgs/pkgs/applications/graphics/imgp/default.nix
index 80420202c0..1f6e20f465 100644
--- a/third_party/nixpkgs/pkgs/applications/graphics/imgp/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/graphics/imgp/default.nix
@@ -2,13 +2,13 @@
 
 buildPythonApplication rec {
   pname = "imgp";
-  version = "2.7";
+  version = "2.8";
 
   src = fetchFromGitHub {
     owner = "jarun";
     repo = pname;
     rev = "v${version}";
-    sha256 = "13r4fn3dd0nyidfhrr7zzpls5ifbyqdwxhyvpkqr8ahchws7wfc6";
+    sha256 = "1miabaxd5pwxn0va4drzj1d4ppxvyqsrrd4xw1j6qr52yci0lms8";
   };
 
   propagatedBuildInputs = [ pillow ];
diff --git a/third_party/nixpkgs/pkgs/applications/graphics/meme/default.nix b/third_party/nixpkgs/pkgs/applications/graphics/meme/default.nix
index 5f8a0bb6ee..8cbc776132 100644
--- a/third_party/nixpkgs/pkgs/applications/graphics/meme/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/graphics/meme/default.nix
@@ -1,8 +1,12 @@
-{ stdenv, buildGoPackage, fetchFromGitHub }:
+{ stdenv
+, buildGoPackage
+, unstableGitUpdater
+, fetchFromGitHub
+}:
 
 buildGoPackage rec {
-  pname = "meme-unstable";
-  version = "2017-09-10";
+  pname = "meme";
+  version = "unstable-2017-09-10";
 
   owner = "nomad-software";
   repo = "meme";
@@ -14,6 +18,8 @@ buildGoPackage rec {
     sha256 = "1gbsv1d58ck6mj89q31s5b0ppw51ab76yqgz39jgwqnkidvzdfly";
   };
 
+  passthru.updateScript = unstableGitUpdater { };
+
   meta = with stdenv.lib; {
     description = "A command line utility for creating image macro style memes";
     homepage = "https://github.com/nomad-software/meme";
diff --git a/third_party/nixpkgs/pkgs/applications/graphics/pqiv/default.nix b/third_party/nixpkgs/pkgs/applications/graphics/pqiv/default.nix
index bb29101b4c..96efc091ef 100644
--- a/third_party/nixpkgs/pkgs/applications/graphics/pqiv/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/graphics/pqiv/default.nix
@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation (rec {
   pname = "pqiv";
-  version = "2.11";
+  version = "2.12";
 
   src = fetchFromGitHub {
     owner = "phillipberndt";
     repo = "pqiv";
     rev = version;
-    sha256 = "06cwm28b7j1skwp21s5snmj1pqh3xh6y2i5v4w3pz0b8k3053h9i";
+    sha256 = "18nvrqmlifh4m8nfs0d19sb9d1l3a95xc89qxqdr881jcxdsgflw";
   };
 
   nativeBuildInputs = [ pkgconfig ];
diff --git a/third_party/nixpkgs/pkgs/applications/graphics/renderdoc/default.nix b/third_party/nixpkgs/pkgs/applications/graphics/renderdoc/default.nix
index 11b4971769..c1255c016f 100644
--- a/third_party/nixpkgs/pkgs/applications/graphics/renderdoc/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/graphics/renderdoc/default.nix
@@ -13,14 +13,14 @@ let
   pythonPackages = python3Packages;
 in
 mkDerivation rec {
-  version = "1.10";
+  version = "1.11";
   pname = "renderdoc";
 
   src = fetchFromGitHub {
     owner = "baldurk";
     repo = "renderdoc";
     rev = "v${version}";
-    sha256 = "1ibf2lv3q69fkzv1nsva2mbdjlayrpxicrd96d9nfcw64f2mv6ds";
+    sha256 = "01r4fq03fpyhwvn47wx3dw29vcadcd0qml00h36q38cq3pi9x42j";
   };
 
   buildInputs = [
diff --git a/third_party/nixpkgs/pkgs/applications/misc/archivy/default.nix b/third_party/nixpkgs/pkgs/applications/misc/archivy/default.nix
new file mode 100644
index 0000000000..d2fa48cd23
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/applications/misc/archivy/default.nix
@@ -0,0 +1,57 @@
+{ stdenv, lib, python3, fetchPypi, appdirs, attrs, requests,
+beautifulsoup4, click-plugins, elasticsearch, flask_login, flask_wtf,
+pypandoc, python-dotenv, python-frontmatter, tinydb, validators,
+watchdog, wtforms }:
+
+python3.pkgs.buildPythonApplication rec {
+  pname = "archivy";
+  version = "0.8.5";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "144ckgxjaw29yp5flyxd1rnkm7hlim4zgy6xng7x0a9j54h527iq";
+  };
+
+  # Relax some dependencies
+  postPatch = ''
+    substituteInPlace requirements.txt \
+      --replace 'validators ==' 'validators >=' \
+      --replace 'elasticsearch ==' 'elasticsearch >=' \
+      --replace 'python-dotenv ==' 'python-dotenv >=' \
+      --replace 'beautifulsoup4 ==' 'beautifulsoup4 >=' \
+      --replace 'WTForms ==' 'WTForms >=' \
+      --replace 'python_dotenv ==' 'python_dotenv >=' \
+      --replace 'attrs == 20.2.0' 'attrs' \
+      --replace 'python_frontmatter == 0.5.0' 'python_frontmatter' \
+      --replace 'requests ==' 'requests >='
+  '';
+
+  propagatedBuildInputs = [
+    appdirs
+    attrs
+    beautifulsoup4
+    click-plugins
+    elasticsearch
+    flask_login
+    flask_wtf
+    pypandoc
+    python-dotenv
+    python-frontmatter
+    tinydb
+    requests
+    validators
+    watchdog
+    wtforms
+  ];
+
+  # __init__.py attempts to mkdir in read-only file system
+  doCheck = false;
+
+  meta = with stdenv.lib; {
+    description = "Self-hosted knowledge repository";
+    homepage = "https://archivy.github.io";
+    license = licenses.mit;
+    maintainers = with maintainers; [ siraben ];
+    platforms = platforms.unix;
+  };
+}
diff --git a/third_party/nixpkgs/pkgs/applications/misc/cpp-ethereum/default.nix b/third_party/nixpkgs/pkgs/applications/misc/cpp-ethereum/default.nix
deleted file mode 100644
index aed44d1213..0000000000
--- a/third_party/nixpkgs/pkgs/applications/misc/cpp-ethereum/default.nix
+++ /dev/null
@@ -1,85 +0,0 @@
-{ stdenv
-, fetchFromGitHub
-, cmake
-, jsoncpp
-, libjson-rpc-cpp
-, curl
-, boost
-, leveldb
-, cryptopp
-, libcpuid
-, opencl-headers
-, ocl-icd
-, miniupnpc
-, libmicrohttpd
-, gmp
-, libGLU, libGL
-, extraCmakeFlags ? []
-}:
-stdenv.mkDerivation rec {
-  pname = "cpp-ethereum";
-  version = "1.3.0";
-
-  src = fetchFromGitHub {
-    owner = "ethereum";
-    repo = "cpp-ethereum";
-    rev = "62ab9522e58df9f28d2168ea27999a214b16ea96";
-    sha256 = "1fxgpqhmjhpv0zzs1m3yf9h8mh25dqpa7pmcfy7f9qiqpfdr4zq9";
-  };
-
-  cmakeFlags = [ "-DCMAKE_BUILD_TYPE=Release" extraCmakeFlags ];
-
-  configurePhase = ''
-    export BOOST_INCLUDEDIR=${boost.dev}/include
-    export BOOST_LIBRARYDIR=${boost.out}/lib
-
-    mkdir -p Build/Install
-    pushd Build
-
-    cmake .. -DCMAKE_INSTALL_PREFIX=$(pwd)/Install $cmakeFlags
-  '';
-
-  enableParallelBuilding = true;
-
-  runPath = with stdenv.lib; makeLibraryPath ([ stdenv.cc.cc ] ++ buildInputs);
-
-  installPhase = ''
-    make install
-
-    mkdir -p $out
-
-    for f in Install/lib/*.so* $(find Install/bin -executable -type f); do
-      patchelf --set-rpath $runPath:$out/lib $f
-    done
-
-    cp -r Install/* $out
-  '';
-
-  buildInputs = [
-    cmake
-    jsoncpp
-    libjson-rpc-cpp
-    curl
-    boost
-    leveldb
-    cryptopp
-    libcpuid
-    opencl-headers
-    ocl-icd
-    miniupnpc
-    libmicrohttpd
-    gmp
-    libGLU libGL
-  ];
-
-  dontStrip = true;
-
-  meta = with stdenv.lib; {
-    description = "Ethereum C++ client";
-    homepage = "https://github.com/ethereum/cpp-ethereum";
-    license = licenses.gpl3;
-    maintainers = with maintainers; [ artuuge ];
-    platforms = platforms.linux;
-    broken = true; # 2018-04-10
-  };
-}
diff --git a/third_party/nixpkgs/pkgs/applications/misc/dasel/default.nix b/third_party/nixpkgs/pkgs/applications/misc/dasel/default.nix
index d3aff8e6b1..ca1a87dd2d 100644
--- a/third_party/nixpkgs/pkgs/applications/misc/dasel/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/misc/dasel/default.nix
@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "dasel";
-  version = "1.6.2";
+  version = "1.8.0";
 
   src = fetchFromGitHub {
     owner = "TomWright";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-LGrFs9JNb0gjXg6IRkUfUOWS+sr1nukzOEWK4XUfkfw=";
+    sha256 = "sha256-N27XmrbZTLeNkNvGDsChqKZrAagkQoGFaJeeZ1/Qnkw=";
   };
 
   vendorSha256 = "1552k85z4s6gv7sss7dccv3h8x22j2sr12icp6s7s0a3i4iwyksw";
diff --git a/third_party/nixpkgs/pkgs/applications/misc/dbeaver/default.nix b/third_party/nixpkgs/pkgs/applications/misc/dbeaver/default.nix
index 4f1d439118..4e928ff34f 100644
--- a/third_party/nixpkgs/pkgs/applications/misc/dbeaver/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/misc/dbeaver/default.nix
@@ -7,7 +7,7 @@
 
 stdenv.mkDerivation rec {
   pname = "dbeaver-ce";
-  version = "7.2.5";
+  version = "7.3.0";
 
   desktopItem = makeDesktopItem {
     name = "dbeaver";
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://dbeaver.io/files/${version}/dbeaver-ce-${version}-linux.gtk.x86_64.tar.gz";
-    sha256 = "sha256-CRyAeizhaSDmVFGRhrYIW0Ofli9HnkgItiAGRJAETQM=";
+    sha256 = "sha256-JhEF2/97vo2FgzpCFkuc31aLl9qjKHV8RYXO5oBU1no=";
   };
 
   installPhase = ''
diff --git a/third_party/nixpkgs/pkgs/applications/misc/gollum/Gemfile.lock b/third_party/nixpkgs/pkgs/applications/misc/gollum/Gemfile.lock
index 7b1b20a1b7..eed618a5cb 100644
--- a/third_party/nixpkgs/pkgs/applications/misc/gollum/Gemfile.lock
+++ b/third_party/nixpkgs/pkgs/applications/misc/gollum/Gemfile.lock
@@ -8,11 +8,11 @@ GEM
     gemojione (4.3.3)
       json
     github-markup (3.0.5)
-    gollum (5.1.1)
+    gollum (5.1.2)
       gemojione (~> 4.1)
       gollum-lib (~> 5.0)
       kramdown (~> 2.3)
-      kramdown-parser-gfm (~> 1.0.0)
+      kramdown-parser-gfm (~> 1.1.0)
       mustache (>= 0.99.5, < 1.0.0)
       octicons (~> 8.5)
       rss (~> 0.2.9)
@@ -39,7 +39,7 @@ GEM
     json (2.3.1)
     kramdown (2.3.0)
       rexml
-    kramdown-parser-gfm (1.0.1)
+    kramdown-parser-gfm (1.1.0)
       kramdown (~> 2.0)
     loofah (2.8.0)
       crass (~> 1.0.2)
diff --git a/third_party/nixpkgs/pkgs/applications/misc/gollum/gemset.nix b/third_party/nixpkgs/pkgs/applications/misc/gollum/gemset.nix
index 7d7c0ef3d5..75ee9d05ab 100644
--- a/third_party/nixpkgs/pkgs/applications/misc/gollum/gemset.nix
+++ b/third_party/nixpkgs/pkgs/applications/misc/gollum/gemset.nix
@@ -66,10 +66,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "14i6y3ilv9l7cqvkawl75js26cfj1pd8cphhmq9lic95ajvdf371";
+      sha256 = "0pmvxj7pka7pjpw060a9pfxsci1hmx45hk9hbp5m49xkkiiqf1gx";
       type = "gem";
     };
-    version = "5.1.1";
+    version = "5.1.2";
   };
   gollum-lib = {
     dependencies = ["gemojione" "github-markup" "gollum-rugged_adapter" "loofah" "nokogiri" "octicons" "rouge" "twitter-text"];
@@ -120,10 +120,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0ykna2apphld9llmjnz0210fipp4fkmj2ja18l7iz9xikg0h0ihi";
+      sha256 = "0a8pb3v951f4x7h968rqfsa19c8arz21zw1vaj42jza22rap8fgv";
       type = "gem";
     };
-    version = "1.0.1";
+    version = "1.1.0";
   };
   loofah = {
     dependencies = ["crass" "nokogiri"];
diff --git a/third_party/nixpkgs/pkgs/applications/misc/gpx/default.nix b/third_party/nixpkgs/pkgs/applications/misc/gpx/default.nix
index 70ff26784a..c052b1ddb0 100644
--- a/third_party/nixpkgs/pkgs/applications/misc/gpx/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/misc/gpx/default.nix
@@ -2,7 +2,7 @@
 
 stdenv.mkDerivation rec {
   pname = "gpx";
-  version = "2.6.7";
+  version = "2.6.8";
 
   nativeBuildInputs = [ autoreconfHook ];
 
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
     owner = "markwal";
     repo = "GPX";
     rev = version;
-    sha256 = "1dl5vlsx05ipy10h18xigicb3k7m33sa9hfyd46hkpr2glx7jh4p";
+    sha256 = "1izs8s5npkbfrsyk17429hyl1vyrbj9dp6vmdlbb2vh6mfgl54h8";
   };
 
   meta = {
diff --git a/third_party/nixpkgs/pkgs/applications/misc/hugo/default.nix b/third_party/nixpkgs/pkgs/applications/misc/hugo/default.nix
index 5bad48edca..3ded9f013f 100644
--- a/third_party/nixpkgs/pkgs/applications/misc/hugo/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/misc/hugo/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "hugo";
-  version = "0.78.2";
+  version = "0.79.0";
 
   src = fetchFromGitHub {
     owner = "gohugoio";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1xjxyx520wa6sgvighjp82qqfi0ykfskp0za5j95167c56ss8lm4";
+    sha256 = "0i9c12w0jlfrqb5gygfn20rn41m7qy6ab03n779wbzwfqqz85mj6";
   };
 
-  vendorSha256 = "00jjcw76l12ppx3q1xhly7q10jfi2kx62a8z3r1k7m2593k8c4vq";
+  vendorSha256 = "0jb6aqdv9yx7fxbkgd73rx6kvxagxscrin5b5bal3ig7ys1ghpsp";
 
   doCheck = false;
 
diff --git a/third_party/nixpkgs/pkgs/applications/misc/ideamaker/default.nix b/third_party/nixpkgs/pkgs/applications/misc/ideamaker/default.nix
new file mode 100644
index 0000000000..7b2eeec292
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/applications/misc/ideamaker/default.nix
@@ -0,0 +1,77 @@
+{ stdenv
+, autoPatchelfHook
+, curl
+, dpkg
+, fetchurl
+, gcc
+, lib
+, libGLU
+, libcork
+, makeDesktopItem
+, qt5
+, quazip_qt4
+, zlib
+}:
+stdenv.mkDerivation rec {
+  pname = "ideamaker";
+  version = "4.0.1";
+
+  src = fetchurl {
+    # N.B. Unfortunately ideamaker adds a number after the patch number in
+    # their release scheme which is not referenced anywhere other than in
+    # the download URL. Because of this, I have chosen to not use ${version}
+    # and just handwrite the correct values in the following URL, hopefully
+    # avoiding surprises for the next person that comes to update this
+    # package.
+    url = "https://download.raise3d.com/ideamaker/release/4.0.1/ideaMaker_4.0.1.4802-ubuntu_amd64.deb";
+    sha256 = "0a1jcakdglcr4kz0kyq692dbjk6aq2yqcp3i6gzni91k791h49hp";
+  };
+
+  nativeBuildInputs = [ autoPatchelfHook dpkg qt5.wrapQtAppsHook ];
+  buildInputs = [
+    curl
+    gcc.cc.lib
+    libGLU
+    libcork
+    qt5.qtbase
+    qt5.qtserialport
+    quazip_qt4
+    zlib
+  ];
+
+  unpackPhase = ''
+    runHook preUnpack
+    dpkg-deb -x $src .
+    runHook postUnpack
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/{bin,share/pixmaps}
+
+    cp usr/lib/x86_64-linux-gnu/ideamaker/ideamaker $out/bin
+    ln -s "${desktopItem}/share/applications" $out/share/
+    cp usr/share/ideamaker/icons/ideamaker-icon.png $out/share/pixmaps/${pname}.png
+
+    runHook postInstall
+  '';
+
+  desktopItem = makeDesktopItem {
+    name = pname;
+    exec = pname;
+    icon = pname;
+    desktopName = "Ideamaker";
+    genericName = meta.description;
+    categories = "Utility;Viewer;Engineering;";
+    mimeType = "application/sla";
+  };
+
+  meta = with lib; {
+    homepage = "https://www.raise3d.com/ideamaker/";
+    description = "Raise3D's 3D slicer software";
+    license = licenses.unfree;
+    platforms = [ "x86_64-linux" ];
+    maintainers = with maintainers; [ lovesegfault ];
+  };
+}
diff --git a/third_party/nixpkgs/pkgs/applications/misc/keeweb/default.nix b/third_party/nixpkgs/pkgs/applications/misc/keeweb/default.nix
index 159f034b85..8c1c56dacd 100644
--- a/third_party/nixpkgs/pkgs/applications/misc/keeweb/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/misc/keeweb/default.nix
@@ -4,7 +4,7 @@ let
   throwSystem = throw "Unsupported system: ${system}";
 
   pname = "keeweb";
-  version = "1.15.7";
+  version = "1.16.0";
   name = "${pname}-${version}";
 
   suffix = {
@@ -15,8 +15,8 @@ let
   src = fetchurl {
     url = "https://github.com/keeweb/keeweb/releases/download/v${version}/KeeWeb-${version}.${suffix}";
     sha256 = {
-      x86_64-linux = "0cy0avl0m07xs523xm0rzsmifl28sv4rjb2jj3x492qmr2v64ckk";
-      x86_64-darwin = "0r8c3zi0ibj0bb0gfc1axfn0y4qpjqfr0xpcxf810d65kaz6wic4";
+      x86_64-linux = "1pivic7n5nv00s8bb51i2jz2mxgjn92hkc8n0p8662ai1cdng47g";
+      x86_64-darwin = "0q6k0qgkgzid9yjbfsfpp8l9dr0n8xp25a4jf2bxwickm4irs9mz";
     }.${system} or throwSystem;
   };
 
diff --git a/third_party/nixpkgs/pkgs/applications/misc/lyx/default.nix b/third_party/nixpkgs/pkgs/applications/misc/lyx/default.nix
index 34e7e145e7..3c91587509 100644
--- a/third_party/nixpkgs/pkgs/applications/misc/lyx/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/misc/lyx/default.nix
@@ -3,12 +3,12 @@
 }:
 
 mkDerivation rec {
-  version = "2.3.5.2";
+  version = "2.3.6";
   pname = "lyx";
 
   src = fetchurl {
     url = "ftp://ftp.lyx.org/pub/lyx/stable/2.3.x/${pname}-${version}.tar.xz";
-    sha256 = "1pwdh0ljd7lm5a83vsqmp4695irhig07wxa90jc23ng5gap589na";
+    sha256 = "160whjwwrmxizdakjlkf9xc86bhqfnslw47fixgqq4qhbapcxxkg";
   };
 
   # LaTeX is used from $PATH, as people often want to have it with extra pkgs
diff --git a/third_party/nixpkgs/pkgs/applications/misc/navi/default.nix b/third_party/nixpkgs/pkgs/applications/misc/navi/default.nix
index 7553b078ef..46d463645e 100644
--- a/third_party/nixpkgs/pkgs/applications/misc/navi/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/misc/navi/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "navi";
-  version = "2.12.1";
+  version = "2.13.0";
 
   src = fetchFromGitHub {
     owner = "denisidoro";
     repo = "navi";
     rev = "v${version}";
-    sha256 = "1vrj8ad004h6jgmcb56f3f19s4xk6gvcpwysj78bxzgpa1998r3r";
+    sha256 = "04ks38s6d3nkdj0arhxw8f3sfw796l97fbqxsm7b9g5d2953a6cs";
   };
 
-  cargoSha256 = "0yifgcf2pfszzny523ax7pb9a5r3012nynbnhdqg0j1ia1pdymf3";
+  cargoSha256 = "1zwar1l793809bsgqnwrgi50y76bd78qd4s8lw6d64f4z72dh80g";
 
   nativeBuildInputs = [ makeWrapper ];
 
diff --git a/third_party/nixpkgs/pkgs/applications/misc/obsidian/default.nix b/third_party/nixpkgs/pkgs/applications/misc/obsidian/default.nix
index ac28694c45..5618a8df91 100644
--- a/third_party/nixpkgs/pkgs/applications/misc/obsidian/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/misc/obsidian/default.nix
@@ -30,12 +30,12 @@ let
 
 in stdenv.mkDerivation rec {
   pname = "obsidian";
-  version = "0.9.15";
+  version = "0.9.17";
 
   src = fetchurl {
     url =
       "https://github.com/obsidianmd/obsidian-releases/releases/download/v${version}/obsidian-${version}.asar.gz";
-    sha256 = "0cfzci2l1bbjc5mqs3hjyy3grz5jk3qbna57vfcvxz36kcd5djv5";
+    sha256 = "0spa5zsipd456dcsp7ww24ab5vk4vmwyvrdmraw3hcsbnj9vcnwa";
   };
 
   nativeBuildInputs = [ makeWrapper graphicsmagick ];
diff --git a/third_party/nixpkgs/pkgs/applications/misc/pueue/default.nix b/third_party/nixpkgs/pkgs/applications/misc/pueue/default.nix
index 3cd9d5db00..d0459cb426 100644
--- a/third_party/nixpkgs/pkgs/applications/misc/pueue/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/misc/pueue/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "pueue";
-  version = "0.8.1";
+  version = "0.8.2";
 
   src = fetchFromGitHub {
     owner = "Nukesor";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0rqnbils0r98qglhm2jafw5d119fqdzszmk825yc0bma4icm7xzp";
+    sha256 = "1vdlsfnqnyri0ny2g695lhivs9m25v9lsqf1valwbjv9l9vjxfqa";
   };
 
-  cargoSha256 = "1f3g5i0yh82qll1hyihrvv08pbd4h9vzs6jy6bf94bzabyjsgnzv";
+  cargoSha256 = "0qziwb69qpbziz772np8dcb1dvxg6m506k5kl63m75z4zicgykcv";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/third_party/nixpkgs/pkgs/applications/networking/browsers/brave/default.nix b/third_party/nixpkgs/pkgs/applications/networking/browsers/brave/default.nix
index 4987988eb3..d76dd8b9da 100644
--- a/third_party/nixpkgs/pkgs/applications/networking/browsers/brave/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/networking/browsers/brave/default.nix
@@ -158,7 +158,7 @@ stdenv.mkDerivation rec {
       contribute to your favorite creators automatically.
     '';
     license = licenses.mpl20;
-    maintainers = with maintainers; [ uskudnik rht jefflabonte ];
+    maintainers = with maintainers; [ uskudnik rht jefflabonte nasirhm ];
     platforms = [ "x86_64-linux" ];
   };
 }
diff --git a/third_party/nixpkgs/pkgs/applications/networking/browsers/chromium/upstream-info.json b/third_party/nixpkgs/pkgs/applications/networking/browsers/chromium/upstream-info.json
index 6281013a68..c106838b35 100644
--- a/third_party/nixpkgs/pkgs/applications/networking/browsers/chromium/upstream-info.json
+++ b/third_party/nixpkgs/pkgs/applications/networking/browsers/chromium/upstream-info.json
@@ -31,9 +31,9 @@
     }
   },
   "dev": {
-    "version": "88.0.4324.11",
-    "sha256": "123gqbxrn508wxdj3is0kzccml5zwnf8pfl90xdizvzcm3wy5315",
-    "sha256bin64": "11bswhxpnw7qi6lagfpgxh4yh56w7l0bc3rqwf975cbq2cnzpjby",
+    "version": "88.0.4324.27",
+    "sha256": "0mciiyh3sn2zrl8g6znylc2pm9sb0wzsclgavf7mmlknri5sjblc",
+    "sha256bin64": "0ax27j42167yyx90h5k6ra898kn626w5cvgmafm3al9kyfsx36m4",
     "deps": {
       "gn": {
         "version": "2020-11-05",
diff --git a/third_party/nixpkgs/pkgs/applications/networking/browsers/firefox/common.nix b/third_party/nixpkgs/pkgs/applications/networking/browsers/firefox/common.nix
index 988f47f3bf..1fbfdc2a7d 100644
--- a/third_party/nixpkgs/pkgs/applications/networking/browsers/firefox/common.nix
+++ b/third_party/nixpkgs/pkgs/applications/networking/browsers/firefox/common.nix
@@ -118,6 +118,7 @@ buildStdenv.mkDerivation ({
 
   patches = [
     ./env_var_for_system_dir.patch
+    ./no-buildconfig-ffx76.patch
   ] ++
 
   # there are two flavors of pipewire support
diff --git a/third_party/nixpkgs/pkgs/applications/networking/browsers/firefox/packages.nix b/third_party/nixpkgs/pkgs/applications/networking/browsers/firefox/packages.nix
index 352e7bac5e..d31a1a0e54 100644
--- a/third_party/nixpkgs/pkgs/applications/networking/browsers/firefox/packages.nix
+++ b/third_party/nixpkgs/pkgs/applications/networking/browsers/firefox/packages.nix
@@ -1,4 +1,4 @@
-{ config, stdenv, lib, callPackage, fetchurl, nss_3_44 }:
+{ stdenv, lib, callPackage, fetchurl, fetchpatch }:
 
 let
   common = opts: callPackage (import ./common.nix opts) {};
@@ -14,7 +14,14 @@ rec {
     };
 
     patches = [
-      ./no-buildconfig-ffx76.patch
+      # Fix compilation on aarch64 with newer rust version
+      # See https://bugzilla.mozilla.org/show_bug.cgi?id=1677690
+      # and https://bugzilla.redhat.com/show_bug.cgi?id=1897675
+      (fetchpatch {
+        name = "aarch64-simd-bgz-1677690.patch";
+        url = "https://github.com/mozilla/gecko-dev/commit/71597faac0fde4f608a60dd610d0cefac4972cc3.patch";
+        sha256 = "1f61nsgbv2c2ylgjs7wdahxrrlgc19gjy5nzs870zr1g832ybwin";
+      })
     ];
 
     meta = {
@@ -41,10 +48,6 @@ rec {
       sha512 = "20h53cn7p4dds1yfm166iwbjdmw4fkv5pfk4z0pni6x8ddjvg19imzs6ggmpnfhaji8mnlknm7xp5j7x9vi24awvdxdds5n88rh25hd";
     };
 
-    patches = [
-      ./no-buildconfig-ffx76.patch
-    ];
-
     meta = {
       description = "A web browser built from Firefox Extended Support Release source tree";
       homepage = "http://www.mozilla.com/en-US/firefox/";
diff --git a/third_party/nixpkgs/pkgs/applications/networking/browsers/firefox/wrapper.nix b/third_party/nixpkgs/pkgs/applications/networking/browsers/firefox/wrapper.nix
index cc6cc72e27..f9b7f2bb8a 100644
--- a/third_party/nixpkgs/pkgs/applications/networking/browsers/firefox/wrapper.nix
+++ b/third_party/nixpkgs/pkgs/applications/networking/browsers/firefox/wrapper.nix
@@ -1,4 +1,5 @@
 { stdenv, lib, makeDesktopItem, makeWrapper, lndir, config
+, replace, fetchurl, zip, unzip, jq
 
 ## various stuff that can be plugged in
 , flashplayer, hal-flash
@@ -31,6 +32,16 @@ let
     , forceWayland ? false
     , useGlvnd ? true
     , cfg ? config.${browserName} or {}
+
+    ## Following options are needed for extra prefs & policies
+    # For more information about anti tracking (german website)
+    # visit https://wiki.kairaven.de/open/app/firefox
+    , extraPrefs ? ""
+    # For more information about policies visit
+    # https://github.com/mozilla/policy-templates#enterprisepoliciesenabled
+    , extraPolicies ? {}
+    , firefoxLibName ? "firefox" # Important for tor package or the like
+    , extraExtensions ? [ ]
     }:
 
     assert forceWayland -> (browser ? gtk3); # Can only use the wayland backend if gtk3 is being used
@@ -81,6 +92,61 @@ let
             ++ pkcs11Modules;
       gtk_modules = [ libcanberra-gtk2 ];
 
+      #########################
+      #                       #
+      #   EXTRA PREF CHANGES  #
+      #                       #
+      #########################
+      policiesJson = builtins.toFile "policies.json"
+        (builtins.toJSON enterprisePolicies);
+
+      extensions = builtins.map (a:
+        if ! (builtins.hasAttr "extid" a) then
+        throw "extraExtensions has an invalid entry. Missing extid attribute. Please use fetchfirefoxaddon"
+        else
+        a
+      ) extraExtensions;
+
+      enterprisePolicies =
+      {
+        policies = {
+          DisableAppUpdate = true;
+        } //
+        {
+          ExtensionSettings = {
+            "*" = {
+                blocked_install_message = "You can't have manual extension mixed with nix extensions";
+                installation_mode = "blocked";
+              };
+
+          } // lib.foldr (e: ret:
+              ret // {
+                "${e.extid}" = {
+                  installation_mode = "allowed";
+                };
+              }
+            ) {} extensions;
+        }
+        // extraPolicies;
+      };
+
+      mozillaCfg = builtins.toFile "mozilla.cfg" ''
+// First line must be a comment
+
+        // Disables addon signature checking
+        // to be able to install addons that do not have an extid
+        // Security is maintained because only user whitelisted addons
+        // with a checksum can be installed
+        lockPref("xpinstall.signatures.required", false);
+        ${extraPrefs}
+      '';
+
+      #############################
+      #                           #
+      #   END EXTRA PREF CHANGES  #
+      #                           #
+      #############################
+
     in stdenv.mkDerivation {
       inherit pname version;
 
@@ -106,6 +172,7 @@ let
       nativeBuildInputs = [ makeWrapper lndir ];
       buildInputs = lib.optional (browser ? gtk3) browser.gtk3;
 
+
       buildCommand = lib.optionalString stdenv.isDarwin ''
         mkdir -p $out/Applications
         cp -R --no-preserve=mode,ownership ${browser}/Applications/${browserName}.app $out/Applications
@@ -117,7 +184,66 @@ let
             exit 1
         fi
 
-        makeWrapper "$(readlink -v --canonicalize-existing "${browser}${browser.execdir or "/bin"}/${browserName}")" \
+        #########################
+        #                       #
+        #   EXTRA PREF CHANGES  #
+        #                       #
+        #########################
+        # Link the runtime. The executable itself has to be copied,
+        # because it will resolve paths relative to its true location.
+        # Any symbolic links have to be replicated as well.
+        cd "${browser}"
+        find . -type d -exec mkdir -p "$out"/{} \;
+
+        find . -type f \( -not -name "${browserName}" \) -exec ln -sT "${browser}"/{} "$out"/{} \;
+
+        find . -type f -name "${browserName}" -print0 | while read -d $'\0' f; do
+          cp -P --no-preserve=mode,ownership "${browser}/$f" "$out/$f"
+          chmod a+rwx "$out/$f"
+        done
+
+        # fix links and absolute references
+        cd "${browser}"
+
+        find . -type l -print0 | while read -d $'\0' l; do
+          target="$(readlink "$l" | ${replace}/bin/replace-literal -es -- "${browser}" "$out")"
+          ln -sfT "$target" "$out/$l"
+        done
+
+        # This will not patch binaries, only "text" files.
+        # Its there for the wrapper mostly.
+        cd "$out"
+        ${replace}/bin/replace-literal -esfR -- "${browser}" "$out"
+
+        # create the wrapper
+
+        executablePrefix="$out${browser.execdir or "/bin"}"
+        executablePath="$executablePrefix/${browserName}"
+
+        if [ ! -x "$executablePath" ]
+        then
+            echo "cannot find executable file \`${browser}${browser.execdir or "/bin"}/${browserName}'"
+            exit 1
+        fi
+
+        if [ ! -L "$executablePath" ]
+        then
+          # Careful here, the file at executablePath may already be
+          # a wrapper. That is why we postfix it with -old instead
+          # of -wrapped.
+          oldExe="$executablePrefix"/".${browserName}"-old
+          mv "$executablePath" "$oldExe"
+        else
+          oldExe="$(readlink -v --canonicalize-existing "$executablePath")"
+        fi
+
+        if [ ! -x "${browser}${browser.execdir or "/bin"}/${browserName}" ]
+        then
+            echo "cannot find executable file \`${browser}${browser.execdir or "/bin"}/${browserName}'"
+            exit 1
+        fi
+
+        makeWrapper "$oldExe" \
           "$out${browser.execdir or "/bin"}/${browserName}${nameSuffix}" \
             --suffix-each MOZ_PLUGIN_PATH ':' "$plugins" \
             --suffix LD_LIBRARY_PATH ':' "$libs" \
@@ -137,6 +263,11 @@ let
                   --suffix XDG_DATA_DIRS : '${gnome3.adwaita-icon-theme}/share'
                 ''
             }
+        #############################
+        #                           #
+        #   END EXTRA PREF CHANGES  #
+        #                           #
+        #############################
 
         if [ -e "${browser}/share/icons" ]; then
             mkdir -p "$out/share"
@@ -166,6 +297,43 @@ let
         # For manpages, in case the program supplies them
         mkdir -p $out/nix-support
         echo ${browser} > $out/nix-support/propagated-user-env-packages
+
+
+        #########################
+        #                       #
+        #   EXTRA PREF CHANGES  #
+        #                       #
+        #########################
+        # user customization
+        mkdir -p $out/lib/${firefoxLibName}
+
+        # creating policies.json
+        mkdir -p "$out/lib/${firefoxLibName}/distribution"
+
+        POL_PATH="$out/lib/${firefoxLibName}/distribution/policies.json"
+        rm -f "$POL_PATH"
+        cat ${policiesJson} >> "$POL_PATH"
+
+        # preparing for autoconfig
+        mkdir -p "$out/lib/${firefoxLibName}/defaults/pref"
+
+        cat > "$out/lib/${firefoxLibName}/defaults/pref/autoconfig.js" <<EOF
+          pref("general.config.filename", "mozilla.cfg");
+          pref("general.config.obscure_value", 0);
+        EOF
+
+        cat > "$out/lib/${firefoxLibName}/mozilla.cfg" < ${mozillaCfg}
+
+        mkdir -p $out/lib/${firefoxLibName}/distribution/extensions
+
+        for i in ${toString extensions}; do
+          ln -s -t $out/lib/${firefoxLibName}/distribution/extensions $i/*
+        done
+        #############################
+        #                           #
+        #   END EXTRA PREF CHANGES  #
+        #                           #
+        #############################
       '';
 
       preferLocalBuild = true;
diff --git a/third_party/nixpkgs/pkgs/applications/networking/browsers/palemoon/default.nix b/third_party/nixpkgs/pkgs/applications/networking/browsers/palemoon/default.nix
index 542d432948..5d299f3349 100644
--- a/third_party/nixpkgs/pkgs/applications/networking/browsers/palemoon/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/networking/browsers/palemoon/default.nix
@@ -16,14 +16,14 @@ let
 
 in stdenv.mkDerivation rec {
   pname = "palemoon";
-  version = "28.15.0";
+  version = "28.16.0";
 
   src = fetchFromGitHub {
     githubBase = "repo.palemoon.org";
     owner = "MoonchildProductions";
     repo = "Pale-Moon";
     rev = "${version}_Release";
-    sha256 = "1sbs3gcwfx58mxc0x1g6jklmvpa9dw2bq3i8y9645gfa1s12p8wy";
+    sha256 = "1svwbiar7c38c8xfw249mwnvayqq5868nkks7cbv9nyf2m9yap56";
     fetchSubmodules = true;
   };
 
diff --git a/third_party/nixpkgs/pkgs/applications/networking/cluster/istioctl/default.nix b/third_party/nixpkgs/pkgs/applications/networking/cluster/istioctl/default.nix
index 19fc90ca9e..ffe79381a2 100644
--- a/third_party/nixpkgs/pkgs/applications/networking/cluster/istioctl/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/networking/cluster/istioctl/default.nix
@@ -2,15 +2,15 @@
 
 buildGoModule rec {
   pname = "istioctl";
-  version = "1.7.5";
+  version = "1.8.0";
 
   src = fetchFromGitHub {
     owner = "istio";
     repo = "istio";
     rev = version;
-    sha256 = "10h2ak3s74xb1rjvc6bc5yiyq2k8qbv07wxnshiqp5cnd6pjni0w";
+    sha256 = "0fwc56797gmcg9pcy0jpv5lb0b6wwiqh242xn1chd4a4hp8in7h9";
   };
-  vendorSha256 = "1xj77w2h7qg808v6ll8hm5nvnb2lwky789aikgxli2k6m0cy0c5k";
+  vendorSha256 = "0ing5pih2rz974dcianlb05fpgrj3y7h32awf3cp41gh448gxd24";
 
   doCheck = false;
 
diff --git a/third_party/nixpkgs/pkgs/applications/networking/cluster/terraform-providers/update-provider b/third_party/nixpkgs/pkgs/applications/networking/cluster/terraform-providers/update-provider
index c7094e1c77..e1f1a0ef38 100755
--- a/third_party/nixpkgs/pkgs/applications/networking/cluster/terraform-providers/update-provider
+++ b/third_party/nixpkgs/pkgs/applications/networking/cluster/terraform-providers/update-provider
@@ -1,42 +1,94 @@
 #!/usr/bin/env nix-shell
-#! nix-shell -i bash -p coreutils curl jq
+#! nix-shell -i bash -p coreutils curl jq moreutils
 # shellcheck shell=bash
+# vim: ft=sh
+#
+# Update a terraform provider to the latest version advertised at the
+# provider source address.
 #
-# Update a terraform provider to the latest version advertised at
-# the provider source address.
 set -euo pipefail
 
-USAGE=$(cat<<DOC
-Specify the terraform provider name to update.
+show_usage() {
+  cat <<DOC
+Usage: ./update-provider [--force] [--vendor] [<owner>/]<provider>
 
-Example:
-To update nixpkgs.terraform-providers.aws run:
-./update-provider aws
+Update a single provider in the providers.json inventory file.
+
+For example to update 'terraform-providers.aws' run:
+
+    ./update-provider aws
+
+If the provider is not in the list already, use the form '<owner>/<provider>'
+to add the provider to the list:
+
+    ./update-provider hetznercloud/hcloud
+
+Options:
+
+  * --force: Force the update even if the version matches.
+  * --vendor: Switch from go package to go modules with vendor.
+  * --vendor-sha256 <sha256>: Override the SHA256 or "null".
 DOC
-)
+}
 
-provider_name="${1:-}"
-if [ -z "$provider_name" ]; then
-  echo "No providers specified!"
+force=
+provider=
+vendor=
+vendorSha256=
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+  -h | --help)
+    show_usage
+    exit
+    ;;
+  --force)
+    force=1
+    shift
+    ;;
+  --vendor)
+    force=1
+    vendor=1
+    shift
+    ;;
+  --vendor-sha256)
+    force=1
+    vendorSha256=$2
+    shift 2
+    ;;
+  *)
+    if [[ -n "$provider" ]]; then
+      echo "ERROR: provider name was passed two times: '$provider' and '$1'"
+      echo "Use --help for more info"
+      exit 1
+    fi
+    provider=$1
+    shift
+  esac
+done
+
+if [[ -z "$provider" ]]; then
+  echo "ERROR: No providers specified!"
   echo
-  echo "$USAGE"
+  show_usage
   exit 1
 fi
 
-provider_source_address="$(jq -r ".$provider_name.\"provider-source-address\"" providers.json)"
+provider_name=$(basename "$provider")
 
-if [ "$provider_source_address" == "null" ]; then
-  echo "No provider source address specified with provider: $provider_name"
-  exit 1
-fi
+# Usage: read_attr <key>
+read_attr() {
+  jq -r ".\"$provider_name\".\"$1\"" providers.json
+}
 
-# The provider source address (used inside Terraform `required_providers` block) is
-# used to compute the registry API endpoint
-#
-# registry.terraform.io/hashicorp/aws (provider source address)
-# registry.terraform.io/providers/hashicorp/aws (provider URL for the website)
-# registry.terraform.io/v1/providers/hashicorp/aws (provider URL for the JSON API)
-registry_response=$(curl -s https://"${provider_source_address/\///v1/providers/}")
+# Usage: update_attr <key> <value>
+update_attr() {
+  if [[ "$2" == "null" ]]; then
+    jq -S ".\"$provider_name\".\"$1\" = null" providers.json | sponge providers.json
+  else
+    jq -S ".\"$provider_name\".\"$1\" = \"$2\"" providers.json | sponge providers.json
+  fi
+}
 
 prefetch_github() {
   # of a given owner, repo and rev, fetch the tarball and return the output of
@@ -47,31 +99,80 @@ prefetch_github() {
   nix-prefetch-url --unpack "https://github.com/$owner/$repo/archive/$rev.tar.gz"
 }
 
+old_source_address="$(read_attr provider-source-address)"
+old_vendor_sha256=$(read_attr vendorSha256)
+old_version=$(read_attr version)
+
+if [[ $provider =~ ^[^/]+/[^/]+$ ]]; then
+  source_address=registry.terraform.io/$provider
+else
+  source_address=$old_source_address
+fi
+if [[ "$source_address" == "null" ]]; then
+  echo "Could not find the source address for provider: $provider"
+  exit 1
+fi
+update_attr "provider-source-address" "$source_address"
+
+# The provider source address (used inside Terraform `required_providers` block) is
+# used to compute the registry API endpoint
+#
+# registry.terraform.io/hashicorp/aws (provider source address)
+# registry.terraform.io/providers/hashicorp/aws (provider URL for the website)
+# registry.terraform.io/v1/providers/hashicorp/aws (provider URL for the JSON API)
+registry_response=$(curl -s https://"${source_address/\///v1/providers/}")
+
+version="$(jq -r '.version' <<< "$registry_response")"
+if [[ "$old_version" = "$version" && "$force" != 1 && -z "$vendorSha256" && "$old_vendor_sha256" != "$vendorSha256" ]]; then
+  echo "$provider_name is already at version $version"
+  exit
+fi
+update_attr version "$version"
+
 provider_source_url="$(jq -r '.source' <<< "$registry_response")"
 
 org="$(echo "$provider_source_url" | cut -d '/' -f 4)"
+update_attr owner "$org"
 repo="$(echo "$provider_source_url" | cut -d '/' -f 5)"
+update_attr repo "$repo"
 rev="$(jq -r '.tag' <<< "$registry_response")"
-
+update_attr rev "$rev"
 sha256=$(prefetch_github "$org" "$repo" "$rev")
+update_attr sha256 "$sha256"
 
-version="$(jq -r '.version' <<< "$registry_response")"
+repo_root=$(git rev-parse --show-toplevel)
 
-updated_provider="$(mktemp)"
-cat <<EOF >> "$updated_provider"
-{
-  "$provider_name": {
-    "owner": "$org",
-    "repo": "$repo",
-    "rev": "$rev",
-    "sha256": "$sha256",
-    "version": "$version",
-    "provider-source-address": "$provider_source_address"
-  }
-}
-EOF
+if [[ -z "$vendorSha256" ]]; then
+  if [[ "$old_vendor_sha256" == null ]]; then
+    vendorSha256=null
+  elif [[ -n "$old_vendor_sha256" || "$vendor" = 1 ]]; then
+    echo "=== Calculating vendorSha256 ==="
+    update_attr vendorSha256 "0000000000000000000000000000000000000000000000000000000000000000"
+    # Hackish way to find out the desired sha256. First build, then extract the
+    # error message from the logs.
+    set +e
+    nix-build --no-out-link "$repo_root" -A "terraform-providers.$provider_name.go-modules" 2>vendor_log.txt
+    set -e
+    logs=$(< vendor_log.txt)
+    if ! [[ $logs =~ got:\ +([^\ ]+) ]]; then
+      echo "ERROR: could not find new hash in output:"
+      cat vendor_log.txt
+      rm -f vendor_log.txt
+      exit 1
+    fi
+    rm -f vendor_log.txt
+    vendorSha256=${BASH_REMATCH[1]}
+    # Deal with nix unstable
+    if [[ $vendorSha256 = sha256-* ]]; then
+      vendorSha256=$(nix to-base32 "$vendorSha256")
+    fi
+  fi
+fi
 
-original_provider_list="$(mktemp)"
-cat providers.json > "$original_provider_list"
+if [[ -n "$vendorSha256" ]]; then
+  update_attr vendorSha256 "$vendorSha256"
+fi
 
-jq --sort-keys --slurp '.[0] * .[1]' "$original_provider_list" "$updated_provider" > providers.json
+# Check that the provider builds
+echo "=== Building terraform-providers.$provider_name ==="
+nix-build "$repo_root" -A "terraform-providers.$provider_name"
diff --git a/third_party/nixpkgs/pkgs/applications/networking/feedreaders/rssguard/default.nix b/third_party/nixpkgs/pkgs/applications/networking/feedreaders/rssguard/default.nix
index f9abd3fef3..13dc38aaba 100644
--- a/third_party/nixpkgs/pkgs/applications/networking/feedreaders/rssguard/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/networking/feedreaders/rssguard/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "rssguard";
-  version = "3.8.2";
+  version = "3.8.3";
 
   src = fetchFromGitHub {
     owner = "martinrotter";
     repo = pname;
     rev = version;
-    sha256 = "0vy89ih586s89s29dzzggk7bkaz70mzrc9islirk01s1jal1jn0v";
+    sha256 = "1704nj77h6s88l4by3wxl5l770gaig90mv3ix80r00nh8mhzq44q";
   };
 
   buildInputs =  [ qtwebengine qttools ];
diff --git a/third_party/nixpkgs/pkgs/applications/networking/instant-messengers/toxic/default.nix b/third_party/nixpkgs/pkgs/applications/networking/instant-messengers/toxic/default.nix
index c9dd22f183..6b511d1a1a 100644
--- a/third_party/nixpkgs/pkgs/applications/networking/instant-messengers/toxic/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/networking/instant-messengers/toxic/default.nix
@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   pname = "toxic";
-  version = "0.9.0";
+  version = "0.9.1";
 
   src = fetchFromGitHub {
     owner  = "Tox";
     repo   = "toxic";
     rev    = "v${version}";
-    sha256 = "1y0k9vfb4818b3s313jlxbpjwdxd62cc4kc1vpxdjvs8mx543vrv";
+    sha256 = "1j0yd33sm824dy4mhwfxqkywa46yhqy5hd5wq4lp7lgl6m6mypar";
   };
 
   makeFlags = [ "PREFIX=$(out)"];
diff --git a/third_party/nixpkgs/pkgs/applications/networking/instant-messengers/zulip/default.nix b/third_party/nixpkgs/pkgs/applications/networking/instant-messengers/zulip/default.nix
index dbf6cf46e9..a177499154 100644
--- a/third_party/nixpkgs/pkgs/applications/networking/instant-messengers/zulip/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/networking/instant-messengers/zulip/default.nix
@@ -5,12 +5,12 @@
 
 let
   pname = "zulip";
-  version = "5.4.3";
+  version = "5.5.0";
   name = "${pname}-${version}";
 
   src = fetchurl {
     url = "https://github.com/zulip/zulip-desktop/releases/download/v${version}/Zulip-${version}-x86_64.AppImage";
-    sha256 = "0yd4g87kcwiy1arx3y2nyb7lq1nlh4cn87762k2sd8n4s9i52c7r";
+    sha256 = "059zfcvaq8wnsz2lfd4gdb17b6nngqk3vgisy2kb29ifqf3lpzqi";
     name="${pname}-${version}.AppImage";
   };
 
@@ -32,7 +32,7 @@ in appimageTools.wrapType2 {
 
   meta = with lib; {
     description = "Desktop client for Zulip Chat";
-    homepage = "https://zulipchat.com";
+    homepage = "https://zulip.com";
     license = licenses.asl20;
     maintainers = with maintainers; [ jonafato ];
     platforms = [ "x86_64-linux" ];
diff --git a/third_party/nixpkgs/pkgs/applications/networking/mailreaders/inboxer/default.nix b/third_party/nixpkgs/pkgs/applications/networking/mailreaders/inboxer/default.nix
index a11e576369..30ca6d6c7e 100644
--- a/third_party/nixpkgs/pkgs/applications/networking/mailreaders/inboxer/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/networking/mailreaders/inboxer/default.nix
@@ -4,7 +4,7 @@
 
 stdenv.mkDerivation rec {
   pname = "inboxer";
-  version = "1.2.1";
+  version = "1.2.3";
 
   meta = with stdenv.lib; {
     description = "Unofficial, free and open-source Google Inbox Desktop App";
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://github.com/denysdovhan/inboxer/releases/download/v${version}/inboxer_${version}_amd64.deb";
-    sha256 = "0nyxas07d6ckgjazxapmc6iyakd2cddla6wflr5rhfp78d7kax3a";
+    sha256 = "1ak8sr9sc0fkbrmfynxivbn9csrbyly4fhjlk7kx10aq8hk893a7";
   };
 
   unpackPhase = ''
diff --git a/third_party/nixpkgs/pkgs/applications/networking/p2p/magnetico/default.nix b/third_party/nixpkgs/pkgs/applications/networking/p2p/magnetico/default.nix
index 44084daf9c..124e3492c8 100644
--- a/third_party/nixpkgs/pkgs/applications/networking/p2p/magnetico/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/networking/p2p/magnetico/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "magnetico";
-  version = "0.11.0";
+  version = "0.12.0";
 
   src = fetchFromGitHub {
     owner  = "boramalper";
     repo   = "magnetico";
     rev    = "v${version}";
-    sha256 = "1622xcl5v67lrnkjwbg7g5b5ikrawx7p91jxbj3ixc1za2f3a3fn";
+    sha256 = "1avqnfn4llmc9xmpsjfc9ivki0cfvd8sljfzd9yac94xcj581s83";
   };
 
-  vendorSha256 = "0g4m0jnpy0q64xnflphyc0lmhni0q9448h7grbbr7f1s9lpqsjml";
+  vendorSha256 = "087kikj6sjhjxqymnj7bpxawfmwckihi6mbmi39w0bn2040aflx5";
 
   nativeBuildInputs = [ go-bindata ];
   buildPhase = ''
diff --git a/third_party/nixpkgs/pkgs/applications/networking/seaweedfs/default.nix b/third_party/nixpkgs/pkgs/applications/networking/seaweedfs/default.nix
index 3fe3b66507..d0a396d6a9 100644
--- a/third_party/nixpkgs/pkgs/applications/networking/seaweedfs/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/networking/seaweedfs/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "seaweedfs";
-  version = "2.12";
+  version = "2.13";
 
   src = fetchFromGitHub {
     owner = "chrislusf";
     repo = "seaweedfs";
     rev = version;
-    sha256 = "08jv8dbvdygcm6wzvncx89p8cn9mbjn4lj8rf5svq8lr7zk1rvpw";
+    sha256 = "0w41p2fm26ml5dvdg2cnxcw0xzsbjq26chpa3bkn1adpazlpivp4";
   };
 
   vendorSha256 = "0g344dj325d35i0myrzhg5chspqnly40qp910ml6zrmp7iszc1mw";
diff --git a/third_party/nixpkgs/pkgs/applications/networking/syncthing/default.nix b/third_party/nixpkgs/pkgs/applications/networking/syncthing/default.nix
index febb1e6998..84b571a20f 100644
--- a/third_party/nixpkgs/pkgs/applications/networking/syncthing/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/networking/syncthing/default.nix
@@ -3,17 +3,17 @@
 let
   common = { stname, target, postInstall ? "" }:
     buildGoModule rec {
-      version = "1.11.1";
+      version = "1.12.0";
       name = "${stname}-${version}";
 
       src = fetchFromGitHub {
         owner  = "syncthing";
         repo   = "syncthing";
         rev    = "v${version}";
-        sha256 = "0x5a24r74i9am6a8k32qkb2vck28d2jiy4yhpb4g774m4krjqxd2";
+        sha256 = "09kqc66pnklhmlcn66c5zydnvy2mfs2hqzd1465ydww8bbgcncss";
       };
 
-      vendorSha256 = "0ap287996ix119hkdyssn2q2bqjbgdshi9a67hf8msfp7k9warm7";
+      vendorSha256 = "1jw0k1wm9mfsa2yr2fi2j8mrlykrlcwfnii07rafv9dnnwabs022";
 
       doCheck = false;
 
diff --git a/third_party/nixpkgs/pkgs/applications/networking/twtxt/default.nix b/third_party/nixpkgs/pkgs/applications/networking/twtxt/default.nix
new file mode 100644
index 0000000000..9887788025
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/applications/networking/twtxt/default.nix
@@ -0,0 +1,24 @@
+{ stdenv, lib, fetchFromGitHub, buildGoModule }:
+
+buildGoModule rec {
+  pname = "twtxt";
+  version = "0.1.0";
+
+  src = fetchFromGitHub {
+    owner = "jointwt";
+    repo = pname;
+    rev = version;
+    sha256 = "15jhfnhpk34nmad04f7xz1w041dba8cn17hq46p9n5sarjgkjiiw";
+  };
+
+  vendorSha256 = "1lnf8wd2rv9d292rp8jndfdg0rjs6gfw0yg49l9spw4yzifnd7f7";
+
+  subPackages = [ "cmd/twt" "cmd/twtd" ];
+
+  meta = with lib; {
+    description = "Self-hosted, Twitter-like decentralised microblogging platform";
+    homepage = "https://github.com/jointwt/twtxt";
+    license = licenses.mit;
+    maintainers = with maintainers; [ siraben ];
+  };
+}
diff --git a/third_party/nixpkgs/pkgs/applications/office/fava/default.nix b/third_party/nixpkgs/pkgs/applications/office/fava/default.nix
index d6b404f9db..cee8098f45 100644
--- a/third_party/nixpkgs/pkgs/applications/office/fava/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/office/fava/default.nix
@@ -5,11 +5,11 @@ let
 in
 buildPythonApplication rec {
   pname = "fava";
-  version = "1.16";
+  version = "1.17";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "436b6f9441a638f8028729c2a39c28433f7878c2af6ddb9bfccaeea9ea3086e1";
+    sha256 = "efad3a4b5697b9d7ee29eff5dc0c8367fc1df37b1abacc8d0b2071602e94a6cd";
   };
 
   checkInputs = [ python3.pkgs.pytest ];
diff --git a/third_party/nixpkgs/pkgs/applications/science/biology/ants/default.nix b/third_party/nixpkgs/pkgs/applications/science/biology/ants/default.nix
index cb88e92fe1..ece218eea3 100644
--- a/third_party/nixpkgs/pkgs/applications/science/biology/ants/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/science/biology/ants/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, fetchpatch, cmake, makeWrapper, itk4, vtk_7 }:
+{ stdenv, fetchFromGitHub, fetchpatch, cmake, makeWrapper, itk4, vtk_7, Cocoa }:
 
 stdenv.mkDerivation rec {
   pname    = "ANTs";
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
   ];
 
   nativeBuildInputs = [ cmake makeWrapper ];
-  buildInputs = [ itk4 vtk_7 ];
+  buildInputs = [ itk4 vtk_7 ] ++ stdenv.lib.optional stdenv.isDarwin [ Cocoa ];
 
   cmakeFlags = [ "-DANTS_SUPERBUILD=FALSE" "-DUSE_VTK=TRUE" ];
 
diff --git a/third_party/nixpkgs/pkgs/applications/science/biology/bwa/default.nix b/third_party/nixpkgs/pkgs/applications/science/biology/bwa/default.nix
index 7212b42198..10859d9e8c 100644
--- a/third_party/nixpkgs/pkgs/applications/science/biology/bwa/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/science/biology/bwa/default.nix
@@ -11,6 +11,12 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ zlib ];
 
+  # Avoid hardcoding gcc to allow environments with a different
+  # C compiler to build
+  preConfigure = ''
+    sed -i '/^CC/d' Makefile
+  '';
+
   # it's unclear which headers are intended to be part of the public interface
   # so we may find ourselves having to add more here over time
   installPhase = ''
@@ -27,6 +33,6 @@ stdenv.mkDerivation rec {
     license     = licenses.gpl3;
     homepage    = "http://bio-bwa.sourceforge.net/";
     maintainers = with maintainers; [ luispedro ];
-    platforms = [ "x86_64-linux" ];
+    platforms = platforms.x86_64;
   };
 }
diff --git a/third_party/nixpkgs/pkgs/applications/science/biology/hmmer/default.nix b/third_party/nixpkgs/pkgs/applications/science/biology/hmmer/default.nix
index 6ee7cd609c..3b1420a188 100644
--- a/third_party/nixpkgs/pkgs/applications/science/biology/hmmer/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/science/biology/hmmer/default.nix
@@ -1,12 +1,12 @@
 { stdenv, fetchurl }:
 
 stdenv.mkDerivation rec {
-  version = "3.3.1";
+  version = "3.3.2";
   pname = "hmmer";
 
   src = fetchurl {
     url = "http://eddylab.org/software/hmmer/${pname}-${version}.tar.gz";
-    sha256 = "1mcvr74w6ffd5z0p8v3jss473mbgard9lz5whjnk95c661lnmrlc";
+    sha256 = "0s9wf6n0qanbx8qs6igfl3vyjikwbrvh4d9d6mv54yp3xysykzlj";
   };
 
   meta = with stdenv.lib; {
diff --git a/third_party/nixpkgs/pkgs/applications/science/chemistry/openmolcas/default.nix b/third_party/nixpkgs/pkgs/applications/science/chemistry/openmolcas/default.nix
index 8bc62da3a3..d432e66a19 100644
--- a/third_party/nixpkgs/pkgs/applications/science/chemistry/openmolcas/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/science/chemistry/openmolcas/default.nix
@@ -20,7 +20,7 @@ in stdenv.mkDerivation {
     owner = "Molcas";
     repo = "OpenMolcas";
     rev = gitLabRev;
-    sha256 = "1w8av44dx5r9yp2xhf9ypdrhappvk984wrd5pa1ww0qv6j2446ic";
+    sha256 = "0xr9plgb0cfmxxqmd3wrhvl0hv2jqqfqzxwzs1jysq2m9cxl314v";
   };
 
   patches = [
diff --git a/third_party/nixpkgs/pkgs/applications/science/logic/abc/default.nix b/third_party/nixpkgs/pkgs/applications/science/logic/abc/default.nix
index 29d727d988..426c5a9df3 100644
--- a/third_party/nixpkgs/pkgs/applications/science/logic/abc/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/science/logic/abc/default.nix
@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   pname   = "abc-verifier";
-  version = "2020.06.22";
+  version = "2020.11.24";
 
   src = fetchFromGitHub {
-    owner  = "berkeley-abc";
+    owner  = "yosyshq";
     repo   = "abc";
-    rev    = "341db25668f3054c87aa3372c794e180f629af5d";
-    sha256 = "14cgv34vz5ljkcms6nrv19vqws2hs8bgjgffk5q03cbxnm2jxv5s";
+    rev    = "4f5f73d18b137930fb3048c0b385c82fa078db38";
+    sha256 = "0z1kp223kix7i4r7mbj2bzawkdzc55nsgc41m85dmbajl9fsj1m0";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/third_party/nixpkgs/pkgs/applications/science/logic/boolector/default.nix b/third_party/nixpkgs/pkgs/applications/science/logic/boolector/default.nix
index aedc8e3484..0364a76639 100644
--- a/third_party/nixpkgs/pkgs/applications/science/logic/boolector/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/science/logic/boolector/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, lib, python3
+{ stdenv, fetchFromGitHub, fetchpatch, lib, python3
 , cmake, lingeling, btor2tools, gtest, gmp
 }:
 
@@ -13,6 +13,14 @@ stdenv.mkDerivation rec {
     sha256 = "0jkmaw678njqgkflzj9g374yk1mci8yqvsxkrqzlifn6bwhwb7ci";
   };
 
+  # excludes development artifacts from install, will be included in next release
+  patches = [
+    (fetchpatch {
+      url = "https://github.com/Boolector/boolector/commit/4d240436e34e65096671099766344dd9126145b1.patch";
+      sha256 = "1girsbvlhkkl1hldl2gsjynwc3m92jskn798qhx0ydg6whrfgcgw";
+    })
+  ];
+
   postPatch = ''
     sed s@REPLACEME@file://${gtest.src}@ ${./cmake-gtest.patch} | patch -p1
   '';
@@ -23,39 +31,39 @@ stdenv.mkDerivation rec {
   cmakeFlags =
     [ "-DBUILD_SHARED_LIBS=ON"
       "-DUSE_LINGELING=YES"
-      "-DBtor2Tools_INCLUDE_DIR=${btor2tools.dev}/include"
-      "-DBtor2Tools_LIBRARIES=${btor2tools.lib}/lib/libbtor2parser.so"
     ] ++ (lib.optional (gmp != null) "-DUSE_GMP=YES");
 
-  installPhase = ''
-    mkdir -p $out/bin $lib/lib $dev/include
-
-    cp -vr bin/* $out/bin
-    cp -vr lib/* $lib/lib
-
-    rm -rf $out/bin/{examples,tests}
-    # we don't care about gtest related libs
-    rm -rf $lib/lib/libg*
-
-    cd ../src
-    find . -iname '*.h' -exec cp --parents '{}' $dev/include \;
-    rm -rf $dev/include/tests
-  '';
-
   checkInputs = [ python3 ];
   doCheck = true;
-  preCheck = ''
-    export LD_LIBRARY_PATH=$(readlink -f lib)
-    patchShebangs ..
+  preCheck =
+    let var = if stdenv.isDarwin then "DYLD_LIBRARY_PATH" else "LD_LIBRARY_PATH";
+    in
+      # tests modelgen and modelgensmt2 spawn boolector in another processes and
+      # macOS strips DYLD_LIBRARY_PATH, hardcode it for testing
+      stdenv.lib.optionalString stdenv.isDarwin ''
+        cp -r bin bin.back
+        install_name_tool -change libboolector.dylib $(pwd)/lib/libboolector.dylib bin/boolector
+      '' + ''
+        export ${var}=$(readlink -f lib)
+        patchShebangs ..
+      '';
+
+  postCheck = stdenv.lib.optionalString stdenv.isDarwin ''
+    rm -rf bin
+    mv bin.back bin
   '';
 
-  outputs = [ "out" "dev" "lib" ];
+  # this is what haskellPackages.boolector expects
+  postInstall = ''
+    cp $out/include/boolector/boolector.h $out/include/boolector.h
+    cp $out/include/boolector/btortypes.h $out/include/btortypes.h
+  '';
 
   meta = with stdenv.lib; {
     description = "An extremely fast SMT solver for bit-vectors and arrays";
     homepage    = "https://boolector.github.io";
     license     = licenses.mit;
-    platforms   = platforms.linux;
+    platforms   = with platforms; linux ++ darwin;
     maintainers = with maintainers; [ thoughtpolice ];
   };
 }
diff --git a/third_party/nixpkgs/pkgs/applications/science/logic/btor2tools/default.nix b/third_party/nixpkgs/pkgs/applications/science/logic/btor2tools/default.nix
index 34c0dac2a1..7d2aed7596 100644
--- a/third_party/nixpkgs/pkgs/applications/science/logic/btor2tools/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/science/logic/btor2tools/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, cmake, fetchFromGitHub }:
+{ stdenv, cmake, fetchFromGitHub, fixDarwinDylibNames }:
 
 stdenv.mkDerivation rec {
   pname = "btor2tools";
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     sha256 = "0mfqmkgvyw8fa2c09kww107dmk180ch1hp98r5kv41vnc04iqb0s";
   };
 
-  nativeBuildInputs = [ cmake ];
+  nativeBuildInputs = [ cmake ] ++ stdenv.lib.optional stdenv.isDarwin fixDarwinDylibNames;
 
   installPhase = ''
     mkdir -p $out $dev/include/btor2parser/ $lib/lib
diff --git a/third_party/nixpkgs/pkgs/applications/science/math/gmsh/default.nix b/third_party/nixpkgs/pkgs/applications/science/math/gmsh/default.nix
index 41c9846b23..1b6dc2ae00 100644
--- a/third_party/nixpkgs/pkgs/applications/science/math/gmsh/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/science/math/gmsh/default.nix
@@ -5,11 +5,11 @@ assert (!blas.isILP64) && (!lapack.isILP64);
 
 stdenv.mkDerivation rec {
   pname = "gmsh";
-  version = "4.7.0";
+  version = "4.7.1";
 
   src = fetchurl {
     url = "http://gmsh.info/src/gmsh-${version}-source.tgz";
-    sha256 = "03ij2hnh393gw59hgrz3qrmgc4qw82bc9nd98sks4jrp5gwk4zz2";
+    sha256 = "0shwi41van3k0z6rnpl3sz5nh46xbyyljwfpcp8pwxbc26aw5169";
   };
 
   buildInputs = [ blas lapack gmm fltk libjpeg zlib libGLU libGL
diff --git a/third_party/nixpkgs/pkgs/applications/science/math/gretl/default.nix b/third_party/nixpkgs/pkgs/applications/science/math/gretl/default.nix
index e1cf5a0f08..7d77453cba 100644
--- a/third_party/nixpkgs/pkgs/applications/science/math/gretl/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/science/math/gretl/default.nix
@@ -3,11 +3,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gretl";
-  version = "2020b";
+  version = "2020e";
 
   src = fetchurl {
     url = "mirror://sourceforge/gretl/${pname}-${version}.tar.xz";
-    sha256 = "0mpb8gc0mcfql8lzwknpkf1sg7mj9ikzd8r1x5xniabd9mmdhplm";
+    sha256 = "105y5hkzgyvad6wc3y7nn327bvrsch6jp03ckkn0w0hpnhiywzx7";
   };
 
   buildInputs = [
diff --git a/third_party/nixpkgs/pkgs/applications/version-management/bumpver/default.nix b/third_party/nixpkgs/pkgs/applications/version-management/bumpver/default.nix
new file mode 100644
index 0000000000..6aa4bcc52b
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/applications/version-management/bumpver/default.nix
@@ -0,0 +1,29 @@
+{ lib, python3, git, mercurial}:
+
+python3.pkgs.buildPythonApplication rec {
+  pname = "bumpver";
+  version = "2020.1107";
+
+  src = python3.pkgs.fetchPypi {
+    inherit pname version;
+    sha256 = "75704333a8d1699e2cadcf1fcd3027a2cab6837ae343af10a61c6eef4e0313d7";
+  };
+
+  prePatch = ''
+    substituteInPlace setup.py \
+      --replace "if any(arg.startswith(\"bdist\") for arg in sys.argv):" ""\
+      --replace "import lib3to6" ""\
+      --replace "package_dir = lib3to6.fix(package_dir)" ""
+  '';
+
+  propagatedBuildInputs = with python3.pkgs; [ pathlib2 click toml lexid colorama setuptools ];
+
+  checkInputs = [ python3.pkgs.pytestCheckHook git mercurial];
+
+  meta = with lib; {
+    description = "Bump version numbers in project files";
+    homepage = "https://pypi.org/project/bumpver/";
+    license = licenses.mit;
+    maintainers = with maintainers; [ kfollesdal ];
+  };
+}
diff --git a/third_party/nixpkgs/pkgs/applications/version-management/git-and-tools/git-secret/default.nix b/third_party/nixpkgs/pkgs/applications/version-management/git-and-tools/git-secret/default.nix
index 140c2647be..fe67aca55d 100644
--- a/third_party/nixpkgs/pkgs/applications/version-management/git-and-tools/git-secret/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/version-management/git-and-tools/git-secret/default.nix
@@ -1,7 +1,7 @@
 { stdenv, lib, fetchFromGitHub, makeWrapper, git, gnupg, gawk }:
 
 let
-  version = "0.3.2";
+  version = "0.3.3";
   repo = "git-secret";
 
 in stdenv.mkDerivation {
@@ -11,7 +11,7 @@ in stdenv.mkDerivation {
     inherit repo;
     owner = "sobolevn";
     rev = "v${version}";
-    sha256 = "0n268xlsd9p5f083sqwzpvsqg99fdk876mf8gihkydakrismc45b";
+    sha256 = "0hc7yavcp8jmn6b7wngjqhy8kl7f4191sfpik8ycvqghkvvimxj4";
   };
 
   buildInputs = [ makeWrapper ];
diff --git a/third_party/nixpkgs/pkgs/applications/version-management/git-repo/default.nix b/third_party/nixpkgs/pkgs/applications/version-management/git-repo/default.nix
index b4e7138482..db18e765b0 100644
--- a/third_party/nixpkgs/pkgs/applications/version-management/git-repo/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/version-management/git-repo/default.nix
@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   pname = "git-repo";
-  version = "2.9";
+  version = "2.10";
 
   src = fetchFromGitHub {
     owner = "android";
     repo = "tools_repo";
     rev = "v${version}";
-    sha256 = "1ii6vjgs5nd2hhp475mqa48165garc7ac2w9fyspajaanc7zhnik";
+    sha256 = "0jd28281wys2iy7pbyyrzkzrkzq9ms7p9pbj6j2fha6bg1bh7rkz";
   };
 
   patches = [ ./import-ssl-module.patch ];
diff --git a/third_party/nixpkgs/pkgs/applications/version-management/gitea/default.nix b/third_party/nixpkgs/pkgs/applications/version-management/gitea/default.nix
index 29c8fac962..340ab283bf 100644
--- a/third_party/nixpkgs/pkgs/applications/version-management/gitea/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/version-management/gitea/default.nix
@@ -8,11 +8,11 @@ with stdenv.lib;
 
 buildGoPackage rec {
   pname = "gitea";
-  version = "1.12.6";
+  version = "1.13.0";
 
   src = fetchurl {
     url = "https://github.com/go-gitea/gitea/releases/download/v${version}/gitea-src-${version}.tar.gz";
-    sha256 = "sha256-mEhtFcWLUhd+WK8wDhrGr6RvL4X2G42W6su/c8zxGR4=";
+    sha256 = "090i4hk9mb66ia14kyp7rqymhc897yi1ifb0skvknylx0sw8vhk9";
   };
 
   unpackPhase = ''
diff --git a/third_party/nixpkgs/pkgs/applications/version-management/gitkraken/default.nix b/third_party/nixpkgs/pkgs/applications/version-management/gitkraken/default.nix
index 8b93bf2176..4fc84767cd 100644
--- a/third_party/nixpkgs/pkgs/applications/version-management/gitkraken/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/version-management/gitkraken/default.nix
@@ -13,11 +13,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "gitkraken";
-  version = "7.4.0";
+  version = "7.4.1";
 
   src = fetchzip {
     url = "https://release.axocdn.com/linux/GitKraken-v${version}.tar.gz";
-    sha256 = "0ih0jxdm74vr4dgslhnl3llvi31zin0g2xjw6a4pdji2y2kajkzk";
+    sha256 = "1c9cyxx5sqvnilf6xp3ildq3lwl6mj8v1vl0wzyjpaiqky99lj9p";
   };
 
   dontBuild = true;
diff --git a/third_party/nixpkgs/pkgs/applications/version-management/pijul/default.nix b/third_party/nixpkgs/pkgs/applications/version-management/pijul/default.nix
index e90f47e51f..bb720df3f2 100644
--- a/third_party/nixpkgs/pkgs/applications/version-management/pijul/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/version-management/pijul/default.nix
@@ -15,14 +15,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "pijul";
-  version = "1.0.0-alpha.8";
+  version = "1.0.0-alpha.11";
 
   src = fetchCrate {
     inherit version pname;
-    sha256 = "01wag3ckqsa7r6zc7cla428w8hr49n2ybp31s42dqmsbak3xbc14";
+    sha256 = "1y2xgbzclmk0i98iydmqgvf6acx0v326dmj9j2hiwrld193fc4dx";
   };
 
-  cargoSha256 = "1hh4xmkhbbbkag3v25vh6zpn0r4fmipxmkcr8ahgrxf71dvyxj8x";
+  cargoSha256 = "0i1rr8jg34g4b8i2lvh9gy2rpfa01ma9jpcpyp5zklrzk5f1ksvf";
 
   cargoBuildFlags = stdenv.lib.optional gitImportSupport "--features=git";
   LIBCLANG_PATH = "${libclang}/lib";
diff --git a/third_party/nixpkgs/pkgs/applications/version-management/sparkleshare/default.nix b/third_party/nixpkgs/pkgs/applications/version-management/sparkleshare/default.nix
index 8f77fdbe54..6f639ecd77 100644
--- a/third_party/nixpkgs/pkgs/applications/version-management/sparkleshare/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/version-management/sparkleshare/default.nix
@@ -23,13 +23,13 @@
 
 stdenv.mkDerivation rec {
   pname = "sparkleshare";
-  version = "3.28";
+  version = "3.38";
 
   src = fetchFromGitHub {
     owner = "hbons";
     repo = "SparkleShare";
     rev = version;
-    sha256 = "sha256:1x5nv2f3mrsr4a336bz5kc2lzkzilfh43bxy2yqhhjp2dgb20497";
+    sha256 = "1a9csflmj96iyr1l0mdm3ziv1bljfcjnzm9xb2y4qqk7ha2p6fbq";
   };
 
   nativeBuildInputs = [
diff --git a/third_party/nixpkgs/pkgs/applications/video/clipgrab/default.nix b/third_party/nixpkgs/pkgs/applications/video/clipgrab/default.nix
index d979a25d2d..fa6cf88440 100644
--- a/third_party/nixpkgs/pkgs/applications/video/clipgrab/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/video/clipgrab/default.nix
@@ -5,10 +5,10 @@
 
 mkDerivation rec {
   pname = "clipgrab";
-  version = "3.9.2";
+  version = "3.9.5";
 
   src = fetchurl {
-    sha256 = "1ckcprqck96ns752vk9bzlc3gm6b5f0piff2d3m55zrvdh7wpgy5";
+    sha256 = "1p8pqa5s70basdm2zpmahc54shsxrr0fr7chvv425n5a9sqba4dh";
     # The .tar.bz2 "Download" link is a binary blob, the source is the .tar.gz!
     url = "https://download.clipgrab.org/${pname}-${version}.tar.gz";
   };
diff --git a/third_party/nixpkgs/pkgs/applications/video/openshot-qt/default.nix b/third_party/nixpkgs/pkgs/applications/video/openshot-qt/default.nix
index ede47ad061..9245bdf03e 100644
--- a/third_party/nixpkgs/pkgs/applications/video/openshot-qt/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/video/openshot-qt/default.nix
@@ -55,5 +55,8 @@ mkDerivationWith python3Packages.buildPythonApplication rec {
     license = with licenses; gpl3Plus;
     maintainers = with maintainers; [ AndersonTorres ];
     platforms = with platforms; unix;
+    # Cannot use a newer Qt (5.15) version because it requires qtwebkit
+    # and our qtwebkit fails to build with 5.15. 01bcfd3579219d60e5d07df309a000f96b2b658b
+    broken = true;
   };
 }
diff --git a/third_party/nixpkgs/pkgs/applications/video/qmplay2/default.nix b/third_party/nixpkgs/pkgs/applications/video/qmplay2/default.nix
new file mode 100644
index 0000000000..b7f7f8c530
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/applications/video/qmplay2/default.nix
@@ -0,0 +1,74 @@
+{ stdenv
+, fetchFromGitHub
+, pkg-config
+, cmake
+, alsaLib
+, ffmpeg
+, libass
+, libcddb
+, libcdio
+, libgme
+, libpulseaudio
+, libsidplayfp
+, libva
+, libXv
+, taglib
+, qtbase
+, qttools
+, vulkan-headers
+, vulkan-tools
+, wrapQtAppsHook
+}:
+
+let
+  pname = "qmplay2";
+  version = "20.07.04";
+in stdenv.mkDerivation {
+  inherit pname version;
+
+  src = fetchFromGitHub {
+    owner = "zaps166";
+    repo = "QMPlay2";
+    rev = version;
+    sha256 = "sha256-sUDucxSvsdD2C2FSVrrXeHdNdrjECtJSXVr106OdHzA=";
+    fetchSubmodules = true;
+  };
+
+  nativeBuildInputs = [ cmake pkg-config wrapQtAppsHook ];
+  buildInputs = [
+    alsaLib
+    ffmpeg
+    libass
+    libcddb
+    libcdio
+    libgme
+    libpulseaudio
+    libsidplayfp
+    libva
+    libXv
+    qtbase
+    qttools
+    taglib
+    vulkan-headers
+    vulkan-tools
+  ];
+
+  postInstall = ''
+    # Because we think it is better to use only lowercase letters!
+    ln -s $out/bin/QMPlay2 $out/bin/qmplay2
+  '';
+
+  meta = with stdenv.lib; {
+    homepage = "https://github.com/zaps166/QMPlay2/";
+    description = "Qt-based Multimedia player";
+    longDescription = ''
+      QMPlay2 is a video and audio player. It can play all formats supported by
+      FFmpeg, libmodplug (including J2B and SFX). It also supports Audio CD, raw
+      files, Rayman 2 music and chiptunes. It contains YouTube and MyFreeMP3
+      browser.
+    '';
+    license = licenses.lgpl3Plus;
+    maintainers = with maintainers; [ AndersonTorres ];
+    platforms = with platforms; linux;
+  };
+}
diff --git a/third_party/nixpkgs/pkgs/applications/video/shotcut/default.nix b/third_party/nixpkgs/pkgs/applications/video/shotcut/default.nix
index b1db8cc57d..1b3ca28504 100644
--- a/third_party/nixpkgs/pkgs/applications/video/shotcut/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/video/shotcut/default.nix
@@ -25,13 +25,13 @@ assert stdenv.lib.versionAtLeast mlt.version "6.22.1";
 
 mkDerivation rec {
   pname = "shotcut";
-  version = "20.11.25";
+  version = "20.11.28";
 
   src = fetchFromGitHub {
     owner = "mltframework";
     repo = "shotcut";
     rev = "v${version}";
-    sha256 = "1nm71gnjd082m7bxlmrkngn079m3fdrb059f7wy23qj7khgpi3iz";
+    sha256 = "1yr71ihml9wnm7y5pv0gz41l1k6ybd16dk78zxf96kn9b838mzhq";
   };
 
   enableParallelBuilding = true;
diff --git a/third_party/nixpkgs/pkgs/applications/virtualization/containerd/default.nix b/third_party/nixpkgs/pkgs/applications/virtualization/containerd/default.nix
index 50b9b8f36a..cece3cc6b6 100644
--- a/third_party/nixpkgs/pkgs/applications/virtualization/containerd/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/virtualization/containerd/default.nix
@@ -4,15 +4,15 @@ with lib;
 
 buildGoPackage rec {
   pname = "containerd";
-  version = "1.4.2";
+  version = "1.4.3";
   # git commit for the above version's tag
-  commit = "7ad184331fa3e55e52b890ea95e65ba581ae3429";
+  commit = "269548fa27e0089a8b8278fc4fc781d7f65a939b";
 
   src = fetchFromGitHub {
     owner = "containerd";
     repo = "containerd";
     rev = "v${version}";
-    sha256 = "17ciyvqz0j1q2vyzwkz6bkvxpz2d7y1kk99fv68ar7l4mr8pyp78";
+    sha256 = "09xvhjg5f8h90w1y94kqqnqzhbhd62dcdd9wb9sdqakisjk6zrl0";
   };
 
   goPackagePath = "github.com/containerd/containerd";
diff --git a/third_party/nixpkgs/pkgs/applications/virtualization/docker/default.nix b/third_party/nixpkgs/pkgs/applications/virtualization/docker/default.nix
index 5df0ae39a2..1d55744efb 100644
--- a/third_party/nixpkgs/pkgs/applications/virtualization/docker/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/virtualization/docker/default.nix
@@ -212,14 +212,14 @@ rec {
   };
 
   docker_19_03 = makeOverridable dockerGen rec {
-    version = "19.03.13";
+    version = "19.03.14";
     rev = "v${version}";
-    sha256 = "139qqy8jiz1phnngknpa7c1nk9iqwd3hcc9as8x50p1vnycwzr3f";
+    sha256 = "0szr5dgfrypb5kyj5l1rf7rw4iqj0d0cyx6skdqlbgf4dqwa6g9y";
     runcRev = "dc9208a3303feef5b3839f4323d9beb36df0a9dd"; # v1.0.0-rc10
     runcSha256 = "0pi3rvj585997m4z9ljkxz2z9yxf9p2jr0pmqbqrc7bc95f5hagk";
     # Note: Once all packaged Docker versions use containerd <=1.2 or >=1.4 remove the libseccomp and pkgconfig inputs above
-    containerdRev = "8fba4e9a7d01810a393d5d25a3621dc101981175"; # v1.3.7
-    containerdSha256 = "10zy507ajslizicagb64dvbs7wmw0j4x3hdhygbdh4g2nv3mgjb7";
+    containerdRev = "ea765aba0d05254012b0b9e595e995c09186427f"; # v1.3.9
+    containerdSha256 = "1isi1wgq61b4l0lxy1d8n6dnmcb8s5ihn2yqjb6525y3dj5c5i1j";
     tiniRev = "fec3683b971d9c3ef73f284f176672c44b448662"; # v0.18.0
     tiniSha256 = "1h20i3wwlbd8x4jr2gz68hgklh0lb0jj7y5xk1wvr8y58fip1rdn";
   };
diff --git a/third_party/nixpkgs/pkgs/applications/virtualization/podman/default.nix b/third_party/nixpkgs/pkgs/applications/virtualization/podman/default.nix
index b05149fd15..dd56efe60f 100644
--- a/third_party/nixpkgs/pkgs/applications/virtualization/podman/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/virtualization/podman/default.nix
@@ -16,13 +16,13 @@
 
 buildGoModule rec {
   pname = "podman";
-  version = "2.1.1";
+  version = "2.2.0";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = "podman";
     rev = "v${version}";
-    sha256 = "0cy842wlyasxlxnwxkwhwgj148s30kfxnhgxa6ar26fly432aa68";
+    sha256 = "13na6ms0dapcmfb4pg8z3sds9nprr1lyyjs0v2izqifcyb1r1c00";
   };
 
   vendorSha256 = null;
diff --git a/third_party/nixpkgs/pkgs/applications/virtualization/qemu/default.nix b/third_party/nixpkgs/pkgs/applications/virtualization/qemu/default.nix
index 2bace4f258..5d4b891ad5 100644
--- a/third_party/nixpkgs/pkgs/applications/virtualization/qemu/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/virtualization/qemu/default.nix
@@ -83,6 +83,12 @@ stdenv.mkDerivation rec {
     ./fix-qemu-ga.patch
     ./9p-ignore-noatime.patch
     ./CVE-2020-27617.patch
+    (fetchpatch {
+      # e1000e: infinite loop scenario in case of null packet descriptor, remove for QEMU >= 5.2.0-rc3
+      name = "CVE-2020-28916.patch";
+      url = "https://git.qemu.org/?p=qemu.git;a=patch;h=c2cb511634012344e3d0fe49a037a33b12d8a98a";
+      sha256 = "1kvm6wl4vry0npiisxsn76h8nf1iv5fmqsyjvb46203f1yyg5pis";
+    })
   ] ++ optional nixosTestRunner ./force-uid0-on-9p.patch
     ++ optionals stdenv.hostPlatform.isMusl [
     (fetchpatch {
@@ -100,6 +106,15 @@ stdenv.mkDerivation rec {
     })
   ];
 
+  # Remove CVE-2020-{29129,29130} for QEMU >5.1.0
+  postPatch = ''
+    (cd slirp && patch -p1 < ${fetchpatch {
+      name = "CVE-2020-29129_CVE-2020-29130.patch";
+      url = "https://gitlab.freedesktop.org/slirp/libslirp/-/commit/2e1dcbc0c2af64fcb17009eaf2ceedd81be2b27f.patch";
+      sha256 = "01vbjqgnc0kp881l5p6b31cyyirhwhavm6x36hlgkymswvl3wh9w";
+    }})
+  '';
+
   hardeningDisable = [ "stackprotector" ];
 
   preConfigure = ''
diff --git a/third_party/nixpkgs/pkgs/build-support/bintools-wrapper/default.nix b/third_party/nixpkgs/pkgs/build-support/bintools-wrapper/default.nix
index 3b1b8ff570..6da0e58436 100644
--- a/third_party/nixpkgs/pkgs/build-support/bintools-wrapper/default.nix
+++ b/third_party/nixpkgs/pkgs/build-support/bintools-wrapper/default.nix
@@ -167,7 +167,7 @@ stdenv.mkDerivation {
       else if targetPlatform.isWindows then "pe"
       else "elf" + toString targetPlatform.parsed.cpu.bits;
     endianPrefix = if targetPlatform.isBigEndian then "big" else "little";
-    sep = optionalString (!targetPlatform.isMips && !targetPlatform.isPower) "-";
+    sep = optionalString (!targetPlatform.isMips && !targetPlatform.isPower && !targetPlatform.isRiscV) "-";
     arch =
       /**/ if targetPlatform.isAarch64 then endianPrefix + "aarch64"
       else if targetPlatform.isAarch32     then endianPrefix + "arm"
@@ -187,6 +187,7 @@ stdenv.mkDerivation {
       else if targetPlatform.isAlpha then "alpha"
       else if targetPlatform.isVc4 then "vc4"
       else if targetPlatform.isOr1k then "or1k"
+      else if targetPlatform.isRiscV then "lriscv"
       else throw "unknown emulation for platform: ${targetPlatform.config}";
     in if targetPlatform.useLLVM or false then ""
        else targetPlatform.platform.bfdEmulation or (fmt + sep + arch);
diff --git a/third_party/nixpkgs/pkgs/build-support/docker/default.nix b/third_party/nixpkgs/pkgs/build-support/docker/default.nix
index db1062e1b5..b30ac5c776 100644
--- a/third_party/nixpkgs/pkgs/build-support/docker/default.nix
+++ b/third_party/nixpkgs/pkgs/build-support/docker/default.nix
@@ -1,4 +1,5 @@
 {
+  bashInteractive,
   buildPackages,
   cacert,
   callPackage,
@@ -29,6 +30,7 @@
   writeReferencesToFile,
   writeScript,
   writeText,
+  writeTextDir,
   writePython3,
   system,  # Note: This is the cross system we're compiling for
 }:
@@ -70,7 +72,7 @@ in
 rec {
 
   examples = callPackage ./examples.nix {
-    inherit buildImage pullImage shadowSetup buildImageWithNixDb;
+    inherit buildImage buildLayeredImage fakeNss pullImage shadowSetup buildImageWithNixDb;
   };
 
   pullImage = let
@@ -684,6 +686,33 @@ rec {
     in
     result;
 
+  # Provide a /etc/passwd and /etc/group that contain root and nobody.
+  # Useful when packaging binaries that insist on using nss to look up
+  # username/groups (like nginx).
+  # /bin/sh is fine to not exist, and provided by another shim.
+  fakeNss = symlinkJoin {
+    name = "fake-nss";
+    paths = [
+      (writeTextDir "etc/passwd" ''
+        root:x:0:0:root user:/var/empty:/bin/sh
+        nobody:x:65534:65534:nobody:/var/empty:/bin/sh
+      '')
+      (writeTextDir "etc/group" ''
+        root:x:0:
+        nobody:x:65534:
+      '')
+      (runCommand "var-empty" {} ''
+        mkdir -p $out/var/empty
+      '')
+    ];
+  };
+
+  # This provides /bin/sh, pointing to bashInteractive.
+  binSh = runCommand "bin-sh" {} ''
+    mkdir -p $out/bin
+    ln -s ${bashInteractive}/bin/bash $out/bin/sh
+  '';
+
   # Build an image and populate its nix database with the provided
   # contents. The main purpose is to be able to use nix commands in
   # the container.
diff --git a/third_party/nixpkgs/pkgs/build-support/docker/examples.nix b/third_party/nixpkgs/pkgs/build-support/docker/examples.nix
index 3f30f1a2ad..85ddeb2574 100644
--- a/third_party/nixpkgs/pkgs/build-support/docker/examples.nix
+++ b/third_party/nixpkgs/pkgs/build-support/docker/examples.nix
@@ -7,7 +7,7 @@
 #  $ nix-build '<nixpkgs>' -A dockerTools.examples.redis
 #  $ docker load < result
 
-{ pkgs, buildImage, pullImage, shadowSetup, buildImageWithNixDb, pkgsCross }:
+{ pkgs, buildImage, buildLayeredImage, fakeNss, pullImage, shadowSetup, buildImageWithNixDb, pkgsCross }:
 
 rec {
   # 1. basic example
@@ -44,7 +44,7 @@ rec {
   nginx = let
     nginxPort = "80";
     nginxConf = pkgs.writeText "nginx.conf" ''
-      user nginx nginx;
+      user nobody nobody;
       daemon off;
       error_log /dev/stdout info;
       pid /dev/null;
@@ -64,10 +64,13 @@ rec {
       <html><body><h1>Hello from NGINX</h1></body></html>
     '';
   in
-  buildImage {
+  buildLayeredImage {
     name = "nginx-container";
     tag = "latest";
-    contents = pkgs.nginx;
+    contents = [
+      fakeNss
+      pkgs.nginx
+    ];
 
     extraCommands = ''
       # nginx still tries to read this directory even if error_log
@@ -75,12 +78,6 @@ rec {
       mkdir -p var/log/nginx
       mkdir -p var/cache/nginx
     '';
-    runAsRoot = ''
-      #!${pkgs.stdenv.shell}
-      ${shadowSetup}
-      groupadd --system nginx
-      useradd --system --gid nginx nginx
-    '';
 
     config = {
       Cmd = [ "nginx" "-c" nginxConf ];
diff --git a/third_party/nixpkgs/pkgs/build-support/docker/nix-prefetch-docker b/third_party/nixpkgs/pkgs/build-support/docker/nix-prefetch-docker
index 1b6785189c..5798ab5984 100755
--- a/third_party/nixpkgs/pkgs/build-support/docker/nix-prefetch-docker
+++ b/third_party/nixpkgs/pkgs/build-support/docker/nix-prefetch-docker
@@ -127,7 +127,7 @@ trap "rm -rf \"$tmpPath\"" EXIT
 tmpFile="$tmpPath/$(get_name $finalImageName $finalImageTag)"
 
 if test -z "$QUIET"; then
-    skopeo --insecure-policy --tmpdir=$TMPDIR --override-os ${os} --override-arch ${arch} copy "$sourceUrl" "docker-archive://$tmpFile:$finalImageName:$finalImageTag"
+    skopeo --insecure-policy --tmpdir=$TMPDIR --override-os ${os} --override-arch ${arch} copy "$sourceUrl" "docker-archive://$tmpFile:$finalImageName:$finalImageTag" >&2
 else
     skopeo --insecure-policy --tmpdir=$TMPDIR --override-os ${os} --override-arch ${arch} copy "$sourceUrl" "docker-archive://$tmpFile:$finalImageName:$finalImageTag" > /dev/null
 fi
@@ -139,12 +139,12 @@ imageHash=$(nix-hash --flat --type $hashType --base32 "$tmpFile")
 finalPath=$(nix-store --add-fixed "$hashType" "$tmpFile")
 
 if test -z "$QUIET"; then
-    echo "-> ImageName: $imageName"
-    echo "-> ImageDigest: $imageDigest"
-    echo "-> FinalImageName: $finalImageName"
-    echo "-> FinalImageTag: $finalImageTag"
-    echo "-> ImagePath: $finalPath"
-    echo "-> ImageHash: $imageHash"
+    echo "-> ImageName: $imageName" >&2
+    echo "-> ImageDigest: $imageDigest" >&2
+    echo "-> FinalImageName: $finalImageName" >&2
+    echo "-> FinalImageTag: $finalImageTag" >&2
+    echo "-> ImagePath: $finalPath" >&2
+    echo "-> ImageHash: $imageHash" >&2
 fi
 
 if [ "$format" == "nix" ]; then
diff --git a/third_party/nixpkgs/pkgs/build-support/fetchfirefoxaddon/default.nix b/third_party/nixpkgs/pkgs/build-support/fetchfirefoxaddon/default.nix
new file mode 100644
index 0000000000..3426743b2c
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/build-support/fetchfirefoxaddon/default.nix
@@ -0,0 +1,37 @@
+{stdenv, lib, coreutils, unzip, jq, zip, fetchurl,writeScript,  ...}:
+{ name
+, url
+, md5 ? ""
+, sha1 ? ""
+, sha256 ? ""
+, sha512 ? ""
+}:
+stdenv.mkDerivation rec {
+
+  inherit name;
+  extid = "${src.outputHash}@${name}";
+  passthru = {
+    exitd=extid;
+  };
+
+  builder = writeScript "xpibuilder" ''
+    source $stdenv/setup
+
+    header "firefox addon $name into $out"
+
+    UUID="${extid}"
+    mkdir -p "$out/$UUID"
+    unzip -q ${src} -d "$out/$UUID"
+    NEW_MANIFEST=$(jq '. + {"applications": { "gecko": { "id": "${extid}" }}, "browser_specific_settings":{"gecko":{"id": "${extid}"}}}' "$out/$UUID/manifest.json")
+    echo "$NEW_MANIFEST" > "$out/$UUID/manifest.json"
+    cd "$out/$UUID"
+    zip -r -q -FS "$out/$UUID.xpi" *
+    rm -r "$out/$UUID"
+  '';
+  src = fetchurl {
+    url = url;
+    inherit md5 sha1 sha256 sha512;
+  };
+  nativeBuildInputs = [ coreutils unzip zip jq  ];
+}
+
diff --git a/third_party/nixpkgs/pkgs/build-support/setup-hooks/reproducible-builds.sh b/third_party/nixpkgs/pkgs/build-support/setup-hooks/reproducible-builds.sh
new file mode 100644
index 0000000000..2d8db6ff7d
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/build-support/setup-hooks/reproducible-builds.sh
@@ -0,0 +1,4 @@
+# Use the last part of the out path as hash input for the build.
+# This should ensure that it is deterministic across rebuilds of the same
+# derivation and not easily collide with other builds.
+export NIX_CFLAGS_COMPILE+=" -frandom-seed=${out##*/}"
diff --git a/third_party/nixpkgs/pkgs/data/fonts/iosevka/bin.nix b/third_party/nixpkgs/pkgs/data/fonts/iosevka/bin.nix
index 8188c569ff..90b64c5f15 100644
--- a/third_party/nixpkgs/pkgs/data/fonts/iosevka/bin.nix
+++ b/third_party/nixpkgs/pkgs/data/fonts/iosevka/bin.nix
@@ -10,7 +10,7 @@ let
     (builtins.attrNames (builtins.removeAttrs variantHashes [ "iosevka" ]));
 in stdenv.mkDerivation rec {
   pname = "${name}-bin";
-  version = "3.7.1";
+  version = "4.0.0";
 
   src = fetchurl {
     url = "https://github.com/be5invis/Iosevka/releases/download/v${version}/ttc-${name}-${version}.zip";
diff --git a/third_party/nixpkgs/pkgs/data/fonts/iosevka/variants.nix b/third_party/nixpkgs/pkgs/data/fonts/iosevka/variants.nix
index b3fd986c4c..e3157db6c9 100644
--- a/third_party/nixpkgs/pkgs/data/fonts/iosevka/variants.nix
+++ b/third_party/nixpkgs/pkgs/data/fonts/iosevka/variants.nix
@@ -1,24 +1,24 @@
 # This file was autogenerated. DO NOT EDIT!
 {
-  iosevka = "0h226f32nwlqnsdc86bwk2wcdl2hsq5q1s2ln6dsf9m7w8ajn0nr";
-  iosevka-aile = "05k3h7n7mkpdsjcxha27vjj503b4129jd90wj8qyk5h0nrgy1rc6";
-  iosevka-curly = "0fxcc99n9ghkdjmfxba9mg4fc0dwlvnnxlmc618jv6s3k2xn7sza";
-  iosevka-curly-slab = "1qgxyw5v91l4cw3mvqzagk9amyy63iqh72bnsz63daxgss3fpsab";
-  iosevka-etoile = "184rjidnjayv5wsrxxxf39mvdcjafdwcvp0h4rfniy9s0ifrwjvf";
-  iosevka-slab = "1cbrv5pyhnvwrdaj8r011igw2yjgzzigd82g1r10d348lk64wja1";
-  iosevka-sparkle = "124jnjzffnfw58b78svw8rzgal10z5nspwc267pvq7q0f2ak1wpp";
-  iosevka-ss01 = "18ckb0ch4za4vgwqz8azx8vhg9v9a922ffbckrbmy8n5bi03dl7w";
-  iosevka-ss02 = "0cwm2jdni5m9z0xagpmq9vvjp3yvin7c7bnavsj15yfvpq8b8qsp";
-  iosevka-ss03 = "1yzbvkr726f8mm024qzy2hdd7nz4kymgjm0cj5208c57bln0byr2";
-  iosevka-ss04 = "1kpz84a1cb39rxc87whw0fh0k9ak2qbcq59hm425da2acf27a648";
-  iosevka-ss05 = "1xnnm96jnw90mhwylsw1ad6m8pr4r1bd02l7g82m5hmr7bc4b7dd";
-  iosevka-ss06 = "1raw01ijiawaqxfmj0m8z8jrb2ns7vzy68lak63mss8j35xzg1l5";
-  iosevka-ss07 = "0bjhjwjif7qw6wyyrzfg2pdvy1b070k053ndmjard6sh1rcln02d";
-  iosevka-ss08 = "1qwgk8riff57np4hlmd0kcl9bx511x9zmnlrjq3ilfn6abdwgm7i";
-  iosevka-ss09 = "0sfnhmcrsv1v7l756hx70y1mrp35fbs6wrsczw4vxfbbaigs767r";
-  iosevka-ss10 = "10n70z7588h8y2z274vjn6hvzc7lg87znibcmkk2brmx2g5bw2wl";
-  iosevka-ss11 = "0mnyd04vdqr8jm3syv6ddrn61f27k91kxkdy86pp34xaac2ipmm0";
-  iosevka-ss12 = "1f8pn2220s6r566b40ncnqrfmfdhnlr0nkvzj9swgvx66jr8mlhj";
-  iosevka-ss13 = "1py5qgfqm9wp9pzcxg83mydvf3r6nhrqi21d0fvmnk04ghk1psd6";
-  iosevka-ss14 = "0z47kqicd26x5v94zy97xyl277v0s6856pbllfn1gv92ax2dg5cy";
+  iosevka = "05wlap8r7kfg5zyj8gf7i1cypgs6lwpkh51g4cyj01zjkkv9g7k8";
+  iosevka-aile = "18qa6q1djjr34aj340ab47ajkkcq4wfv7m36f303kabgwfif247r";
+  iosevka-curly = "138hl95n3c2cfblzgh8adi1aljwn1xljjbffd0nrb12hipmgddql";
+  iosevka-curly-slab = "0x18zzphri1fx4lql51n8bam0pq2xb61p1gx50km3wlvkrbmbj23";
+  iosevka-etoile = "0byv8x3nqjka4ivpa8h6hq2k18cjnf69qmcc06dy4ym45a34qqsw";
+  iosevka-slab = "0a2h1g69r9nmp5cskgciywsiq07rxn0cskhvwbwaq64rsqbr1l58";
+  iosevka-sparkle = "13kwdgziylicwkl9s9v9bx9zbbrsrys6n7gx2jzgkdlsj8wkd73i";
+  iosevka-ss01 = "0achcgfcya6sl15wknlyyghpz3d7q62wa0fikl74wr5xyl7h7f1f";
+  iosevka-ss02 = "09gsawl61acykpd2429g1mz0l7i4gl0j1fl0lzc1giy6kbvrkggb";
+  iosevka-ss03 = "07fdxmlpqv6z5hbly8l344x96m80jbz8rq5h9qkfz63xlq0376sj";
+  iosevka-ss04 = "0q3v6spylhaxsf6spv6q5kh87mxbkh9x04s3h1g3rjv6gdlxi9n4";
+  iosevka-ss05 = "1zzdx4d6zrc1qbhsp0bfg91v63h1y943pylfxns09bzk9wjppvba";
+  iosevka-ss06 = "1a3ar8xhn9rf5isxvwqvifczl20ddgs4dw9ypjflmdbyhr3n0yw5";
+  iosevka-ss07 = "01x33sx5d54mdph7csnk6mhkhyc879rwp9spxwyrajghzd0ql8w6";
+  iosevka-ss08 = "0a1kmyr5q2w7qky0ya0gaqmg0lhdafyag8c8idacl7gnra944hi0";
+  iosevka-ss09 = "0m7cm8c3795a8kfy19d9wjmii6ycimcclg5pn9g91kg49q8y9gi2";
+  iosevka-ss10 = "1gfdjz6yifbyb9gl19q3q69as3fnmih17ghhrzzhc7qll68r6k6z";
+  iosevka-ss11 = "119ivw6kcqvzbj46xv8avpg56w3nqdkhhl176gj3bpk1jbjip1wh";
+  iosevka-ss12 = "1vx8rc328whsjjj87fa29kpp9ibk6x52r1brjp37cywjd5ix6l78";
+  iosevka-ss13 = "1gmmm2jlvrl6pzcsc2bhy3qvmzmsns8hlc52ddrwdbw0wi28zhs3";
+  iosevka-ss14 = "0mwg2bvkpxzpsdhky9k6fn81061pk0f23whj1hj4mn191xpw41fy";
 }
diff --git a/third_party/nixpkgs/pkgs/data/fonts/unifont_upper/default.nix b/third_party/nixpkgs/pkgs/data/fonts/unifont_upper/default.nix
index 153c6272ca..2daf66e751 100644
--- a/third_party/nixpkgs/pkgs/data/fonts/unifont_upper/default.nix
+++ b/third_party/nixpkgs/pkgs/data/fonts/unifont_upper/default.nix
@@ -1,7 +1,7 @@
 { lib, fetchzip }:
 
 let
-  version = "12.1.03";
+  version = "13.0.04";
 in fetchzip rec {
   name = "unifont_upper-${version}";
 
@@ -9,7 +9,7 @@ in fetchzip rec {
 
   postFetch = "install -Dm644 $downloadedFile $out/share/fonts/truetype/unifont_upper.ttf";
 
-  sha256 = "1w0bg276cyv6xs6clld8gv4w88rj9fw9rc8zs9ahc6y9hv677knj";
+  sha256 = "0bji0crx84nbjf1m1lzql7icrb02zbs3l66dn21pvr9czsry870f";
 
   meta = with lib; {
     description = "Unicode font for glyphs above the Unicode Basic Multilingual Plane";
diff --git a/third_party/nixpkgs/pkgs/data/misc/spdx-license-list-data/default.nix b/third_party/nixpkgs/pkgs/data/misc/spdx-license-list-data/default.nix
index 6d2c58afdb..19f02a16f4 100644
--- a/third_party/nixpkgs/pkgs/data/misc/spdx-license-list-data/default.nix
+++ b/third_party/nixpkgs/pkgs/data/misc/spdx-license-list-data/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "spdx-license-list-data";
-  version = "3.10";
+  version = "3.11";
 
   src = fetchFromGitHub {
     owner = "spdx";
     repo = "license-list-data";
     rev = "v${version}";
-    sha256 = "1zza0jrs82112dcjqgkyck2b7hv4kg9s10pmlripi6c1rs37av14";
+    sha256 = "1iwyqhh6lh51a47mhfy98zvjan8yjsvlym8qz0isx2i1zzxlj47a";
   };
 
   phases = [ "unpackPhase" "installPhase" ];
diff --git a/third_party/nixpkgs/pkgs/data/themes/mojave/default.nix b/third_party/nixpkgs/pkgs/data/themes/mojave/default.nix
index 751dd690d1..3d14f782c6 100644
--- a/third_party/nixpkgs/pkgs/data/themes/mojave/default.nix
+++ b/third_party/nixpkgs/pkgs/data/themes/mojave/default.nix
@@ -2,14 +2,14 @@
 
 stdenv.mkDerivation rec {
   pname = "mojave-gtk-theme";
-  version = "2020-03-19";
+  version = "2020-11-29";
 
   srcs = [
     (fetchFromGitHub {
       owner = "vinceliuice";
       repo = pname;
       rev = version;
-      sha256 = "1f120sx092i56q4dx2b8d3nnn9pdw67656446nw702rix7zc5jpx";
+      sha256 = "07lcg28y0scpii29j85343kmcga4wyaayjpx9a118z838mnvb757";
     })
     (fetchurl {
       url = "https://github.com/vinceliuice/Mojave-gtk-theme/raw/11741a99d96953daf9c27e44c94ae50a7247c0ed/macOS_Mojave_Wallpapers.tar.xz";
diff --git a/third_party/nixpkgs/pkgs/data/themes/vimix/default.nix b/third_party/nixpkgs/pkgs/data/themes/vimix/default.nix
index 1b3d2005f0..43636b584d 100644
--- a/third_party/nixpkgs/pkgs/data/themes/vimix/default.nix
+++ b/third_party/nixpkgs/pkgs/data/themes/vimix/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "vimix-gtk-themes";
-  version = "2020-02-24";
+  version = "2020-11-28";
 
   src = fetchFromGitHub {
     owner = "vinceliuice";
     repo = pname;
     rev = version;
-    sha256 = "18v7yhwzachjgy276rdhj5cg353f0qysa2kxk9gyc6s71q2gjzcv";
+    sha256 = "1m84p4cs9dfwc27zfjnwgkfdnfmlzbimq3g5z4mhz23cijm178rf";
   };
 
   buildInputs = [ gtk_engines ];
diff --git a/third_party/nixpkgs/pkgs/desktops/cinnamon/cinnamon-desktop/default.nix b/third_party/nixpkgs/pkgs/desktops/cinnamon/cinnamon-desktop/default.nix
index 71eb54ea20..00ea002f74 100644
--- a/third_party/nixpkgs/pkgs/desktops/cinnamon/cinnamon-desktop/default.nix
+++ b/third_party/nixpkgs/pkgs/desktops/cinnamon/cinnamon-desktop/default.nix
@@ -17,13 +17,13 @@
 
 stdenv.mkDerivation rec {
   pname = "cinnamon-desktop";
-  version = "4.6.4";
+  version = "4.8.0";
 
   src = fetchFromGitHub {
     owner = "linuxmint";
     repo = pname;
     rev = version;
-    sha256 = "08z5hgc6dwdp9fczm75axwh8q9665iz4y2lxp92xp62r3k0v9fvd";
+    sha256 = "1369iig7w0x45sr9yd4a5xxqrwsfwq90hlnknarhz62h5hpykjwi";
   };
 
   outputs = [ "out" "dev" ];
diff --git a/third_party/nixpkgs/pkgs/desktops/cinnamon/cinnamon-menus/default.nix b/third_party/nixpkgs/pkgs/desktops/cinnamon/cinnamon-menus/default.nix
index 9edc136870..0e84302f6c 100644
--- a/third_party/nixpkgs/pkgs/desktops/cinnamon/cinnamon-menus/default.nix
+++ b/third_party/nixpkgs/pkgs/desktops/cinnamon/cinnamon-menus/default.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation rec {
   pname = "cinnamon-menus";
-  version = "4.6.1";
+  version = "4.8.1";
 
   src = fetchFromGitHub {
     owner = "linuxmint";
     repo = pname;
     rev = version;
-    sha256 = "1qdaql4mknhzvl2qi1pyw4c820lqb7lg07gblh0wzfk4f7h8hddx";
+    sha256 = "1fsiq8q8b65skxbg1bsishygnw2zg8kr0d09rassqjdimd4yfi1y";
   };
 
   buildInputs = [
diff --git a/third_party/nixpkgs/pkgs/desktops/cinnamon/cinnamon-session/default.nix b/third_party/nixpkgs/pkgs/desktops/cinnamon/cinnamon-session/default.nix
index 4e9c09f4d7..02082f64ed 100644
--- a/third_party/nixpkgs/pkgs/desktops/cinnamon/cinnamon-session/default.nix
+++ b/third_party/nixpkgs/pkgs/desktops/cinnamon/cinnamon-session/default.nix
@@ -27,13 +27,13 @@
 
 stdenv.mkDerivation rec {
   pname = "cinnamon-session";
-  version = "4.6.2";
+  version = "4.8.0";
 
   src = fetchFromGitHub {
     owner = "linuxmint";
     repo = pname;
     rev = version;
-    sha256 = "133vpgs0dqr16pvx5wyxhfcargn9wl14z0q99m2pn93hf6zycmsv";
+    sha256 = "0sbfd1d4kjiccaq9s36r2cvdcmvd1x2087nkfgl32gwxakqi3g4n";
   };
 
   patches = [
diff --git a/third_party/nixpkgs/pkgs/desktops/cinnamon/cinnamon-translations/default.nix b/third_party/nixpkgs/pkgs/desktops/cinnamon/cinnamon-translations/default.nix
index 142c586d8d..8e29aa9fcc 100644
--- a/third_party/nixpkgs/pkgs/desktops/cinnamon/cinnamon-translations/default.nix
+++ b/third_party/nixpkgs/pkgs/desktops/cinnamon/cinnamon-translations/default.nix
@@ -5,13 +5,13 @@
 
 stdenv.mkDerivation rec {
   pname = "cinnamon-translations";
-  version = "4.6.2";
+  version = "4.8.0";
 
   src = fetchFromGitHub {
     owner = "linuxmint";
     repo = pname;
     rev = version;
-    sha256 = "0zaghha62ibhg3rir6mrfy1z3v7p7v83b6glhmj9s51nxd86fyv6";
+    sha256 = "1j3azjwin89z5v6nphx0wsa35p224h2gps50kcq9gwankkfcf3q1";
   };
 
   nativeBuildInputs = [
diff --git a/third_party/nixpkgs/pkgs/desktops/gnome-3/apps/gnome-boxes/default.nix b/third_party/nixpkgs/pkgs/desktops/gnome-3/apps/gnome-boxes/default.nix
index 014ad123b4..7f0c7c4f62 100644
--- a/third_party/nixpkgs/pkgs/desktops/gnome-3/apps/gnome-boxes/default.nix
+++ b/third_party/nixpkgs/pkgs/desktops/gnome-3/apps/gnome-boxes/default.nix
@@ -54,11 +54,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-boxes";
-  version = "3.38.1";
+  version = "3.38.2";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "0zrm4mihkx5i42h3pvk9lmsqf983dqz4rnfcbccwhx4ml2s4w3qv";
+    sha256 = "1zjvng0izbws3506998l3dwsxjbm7wnhqipb8nmqzvi096czvajl";
   };
 
   doCheck = true;
diff --git a/third_party/nixpkgs/pkgs/desktops/gnome-3/extensions/gsconnect/default.nix b/third_party/nixpkgs/pkgs/desktops/gnome-3/extensions/gsconnect/default.nix
index 3d969f5c0b..d85efd0a4d 100644
--- a/third_party/nixpkgs/pkgs/desktops/gnome-3/extensions/gsconnect/default.nix
+++ b/third_party/nixpkgs/pkgs/desktops/gnome-3/extensions/gsconnect/default.nix
@@ -9,15 +9,12 @@
 , gobject-introspection
 , wrapGAppsHook
 , glib
+, glib-networking
 , gtk3
 , openssh
 , gnome3
 , gjs
 , nixosTests
-, atk
-, harfbuzz
-, pango
-, gdk-pixbuf
 , gsettings-desktop-schemas
 }:
 
@@ -55,6 +52,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [
     glib # libgobject
+    glib-networking
     gtk3
     gsound
     gjs # for running daemon
@@ -87,20 +85,18 @@ stdenv.mkDerivation rec {
     done
   '';
 
-  postFixup = let
-    testDeps = [
-      gtk3 harfbuzz atk pango.out gdk-pixbuf
-    ];
-  in ''
+  postFixup = ''
     # Let’s wrap the daemons
     for file in $out/share/gnome-shell/extensions/gsconnect@andyholmes.github.io/service/{daemon,nativeMessagingHost}.js; do
       echo "Wrapping program $file"
       wrapGApp "$file"
     done
 
-    wrapProgram "$installedTests/libexec/installed-tests/gsconnect/minijasmine" \
-      --prefix XDG_DATA_DIRS : "${gsettings-desktop-schemas}/share/gsettings-schemas/${gsettings-desktop-schemas.name}" \
-      --prefix GI_TYPELIB_PATH : "${stdenv.lib.makeSearchPath "lib/girepository-1.0" testDeps}"
+    # Wrap jasmine runner for tests
+    for file in $installedTests/libexec/installed-tests/gsconnect/minijasmine; do
+      echo "Wrapping program $file"
+      wrapGApp "$file"
+    done
   '';
 
   uuid = "gsconnect@andyholmes.github.io";
diff --git a/third_party/nixpkgs/pkgs/desktops/gnome-3/misc/gnome-tweaks/default.nix b/third_party/nixpkgs/pkgs/desktops/gnome-3/misc/gnome-tweaks/default.nix
index a51eb854e7..a042ce134a 100644
--- a/third_party/nixpkgs/pkgs/desktops/gnome-3/misc/gnome-tweaks/default.nix
+++ b/third_party/nixpkgs/pkgs/desktops/gnome-3/misc/gnome-tweaks/default.nix
@@ -1,42 +1,69 @@
-{ stdenv, meson, ninja, gettext, fetchurl
-, pkgconfig, gtk3, glib, libsoup, gsettings-desktop-schemas
-, itstool, libxml2, python3Packages, libhandy_0
-, gnome3, gdk-pixbuf, libnotify, gobject-introspection, wrapGAppsHook }:
+{ lib
+, meson
+, ninja
+, fetchurl
+, gdk-pixbuf
+, gettext
+, glib
+, gnome3
+, gobject-introspection
+, gsettings-desktop-schemas
+, gtk3
+, itstool
+, libhandy_0
+, libnotify
+, libsoup
+, libxml2
+, pkg-config
+, python3Packages
+, wrapGAppsHook }:
 
-let
+python3Packages.buildPythonApplication rec {
   pname = "gnome-tweaks";
   version = "3.34.0";
-in stdenv.mkDerivation rec {
-  name = "${pname}-${version}";
+  format = "other";
+  strictDeps = false; # https://github.com/NixOS/nixpkgs/issues/56943
 
   src = fetchurl {
-    url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${name}.tar.xz";
+    url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
     sha256 = "0l2j42ba7v866iknygamnkiq7igh0fjvq92r93cslvvfnkx2ccq0";
   };
 
   nativeBuildInputs = [
-    meson ninja pkgconfig gettext itstool libxml2 wrapGAppsHook python3Packages.python
+    gettext
+    gobject-introspection
+    itstool
+    libxml2
+    meson
+    ninja
+    pkg-config
+    wrapGAppsHook
   ];
+
   buildInputs = [
-    gtk3 glib gsettings-desktop-schemas
-    gdk-pixbuf gnome3.adwaita-icon-theme
-    libnotify gnome3.gnome-shell python3Packages.pygobject3
-    libsoup gnome3.gnome-settings-daemon gnome3.nautilus
-    gnome3.mutter gnome3.gnome-desktop gobject-introspection
-    gnome3.nautilus libhandy_0
+    gdk-pixbuf
+    glib
+    gnome3.gnome-desktop
+    gnome3.gnome-settings-daemon
+    gnome3.gnome-shell
     # Makes it possible to select user themes through the `user-theme` extension
     gnome3.gnome-shell-extensions
+    gnome3.mutter
+    gsettings-desktop-schemas
+    gtk3
+    libhandy_0
+    libnotify
+    libsoup
+  ];
+
+  propagatedBuildInputs = with python3Packages; [
+    pygobject3
   ];
 
   postPatch = ''
     patchShebangs meson-postinstall.py
   '';
 
-  preFixup = ''
-    gappsWrapperArgs+=(
-      --prefix PYTHONPATH : "$out/${python3Packages.python.sitePackages}:$PYTHONPATH")
-  '';
-
   passthru = {
     updateScript = gnome3.updateScript {
       packageName = pname;
@@ -44,7 +71,7 @@ in stdenv.mkDerivation rec {
     };
   };
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = "https://wiki.gnome.org/action/show/Apps/GnomeTweakTool";
     description = "A tool to customize advanced GNOME 3 options";
     maintainers = teams.gnome.members;
diff --git a/third_party/nixpkgs/pkgs/development/arduino/arduino-mk/default.nix b/third_party/nixpkgs/pkgs/development/arduino/arduino-mk/default.nix
index ff7b7274ca..cd3dd32f38 100644
--- a/third_party/nixpkgs/pkgs/development/arduino/arduino-mk/default.nix
+++ b/third_party/nixpkgs/pkgs/development/arduino/arduino-mk/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub }:
+{ stdenv, fetchFromGitHub, python3Packages, installShellFiles }:
 
 stdenv.mkDerivation rec {
   version = "1.6.0";
@@ -11,8 +11,16 @@ stdenv.mkDerivation rec {
     sha256 = "0flpl97d2231gp51n3y4qvf3y1l8xzafi1sgpwc305vwc2h4dl2x";
   };
 
-  phases = ["installPhase"];
-  installPhase = "ln -s $src $out";
+  nativeBuildInputs = [ python3Packages.wrapPython installShellFiles ];
+  propagatedBuildInputs = with python3Packages; [ pyserial ];
+  installPhase = ''
+    mkdir $out
+    cp -rT $src $out
+    installManPage *.1
+  '';
+  postFixupPhase = ''
+    wrapPythonPrograms
+  '';
 
   meta = {
     description = "Makefile for Arduino sketches";
diff --git a/third_party/nixpkgs/pkgs/development/compilers/adoptopenjdk-bin/generate-sources.py b/third_party/nixpkgs/pkgs/development/compilers/adoptopenjdk-bin/generate-sources.py
index a7782610af..63b807bd80 100755
--- a/third_party/nixpkgs/pkgs/development/compilers/adoptopenjdk-bin/generate-sources.py
+++ b/third_party/nixpkgs/pkgs/development/compilers/adoptopenjdk-bin/generate-sources.py
@@ -6,7 +6,7 @@ import re
 import requests
 import sys
 
-releases = ("openjdk8", "openjdk11", "openjdk13")
+releases = ("openjdk8", "openjdk11", "openjdk13", "openjdk14", "openjdk15")
 oses = ("mac", "linux")
 types = ("jre", "jdk")
 impls = ("hotspot", "openj9")
diff --git a/third_party/nixpkgs/pkgs/development/compilers/adoptopenjdk-bin/jdk-linux-base.nix b/third_party/nixpkgs/pkgs/development/compilers/adoptopenjdk-bin/jdk-linux-base.nix
index d62224d518..00945e3253 100644
--- a/third_party/nixpkgs/pkgs/development/compilers/adoptopenjdk-bin/jdk-linux-base.nix
+++ b/third_party/nixpkgs/pkgs/development/compilers/adoptopenjdk-bin/jdk-linux-base.nix
@@ -29,7 +29,7 @@ let result = stdenv.mkDerivation rec {
 
   buildInputs = [
     alsaLib freetype fontconfig zlib xorg.libX11 xorg.libXext xorg.libXtst
-    xorg.libXi xorg.libXrender
+    xorg.libXi xorg.libXrender stdenv.cc.cc.lib
   ] ++ lib.optional stdenv.isAarch32 libffi;
 
   nativeBuildInputs = [ autoPatchelfHook ];
diff --git a/third_party/nixpkgs/pkgs/development/compilers/adoptopenjdk-bin/jdk14-darwin.nix b/third_party/nixpkgs/pkgs/development/compilers/adoptopenjdk-bin/jdk14-darwin.nix
new file mode 100644
index 0000000000..e440903ad5
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/development/compilers/adoptopenjdk-bin/jdk14-darwin.nix
@@ -0,0 +1,9 @@
+let
+  sources = builtins.fromJSON (builtins.readFile ./sources.json);
+in
+{
+  jdk-hotspot = import ./jdk-darwin-base.nix sources.openjdk14.mac.jdk.hotspot;
+  jre-hotspot = import ./jdk-darwin-base.nix sources.openjdk14.mac.jre.hotspot;
+  jdk-openj9 = import ./jdk-darwin-base.nix sources.openjdk14.mac.jdk.openj9;
+  jre-openj9 = import ./jdk-darwin-base.nix sources.openjdk14.mac.jre.openj9;
+}
diff --git a/third_party/nixpkgs/pkgs/development/compilers/adoptopenjdk-bin/jdk14-linux.nix b/third_party/nixpkgs/pkgs/development/compilers/adoptopenjdk-bin/jdk14-linux.nix
new file mode 100644
index 0000000000..90ae65ba97
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/development/compilers/adoptopenjdk-bin/jdk14-linux.nix
@@ -0,0 +1,9 @@
+let
+  sources = builtins.fromJSON (builtins.readFile ./sources.json);
+in
+{
+  jdk-hotspot = import ./jdk-linux-base.nix sources.openjdk14.linux.jdk.hotspot;
+  jre-hotspot = import ./jdk-linux-base.nix sources.openjdk14.linux.jre.hotspot;
+  jdk-openj9 = import ./jdk-linux-base.nix sources.openjdk14.linux.jdk.openj9;
+  jre-openj9 = import ./jdk-linux-base.nix sources.openjdk14.linux.jre.openj9;
+}
diff --git a/third_party/nixpkgs/pkgs/development/compilers/adoptopenjdk-bin/jdk15-darwin.nix b/third_party/nixpkgs/pkgs/development/compilers/adoptopenjdk-bin/jdk15-darwin.nix
new file mode 100644
index 0000000000..b9b67f271a
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/development/compilers/adoptopenjdk-bin/jdk15-darwin.nix
@@ -0,0 +1,9 @@
+let
+  sources = builtins.fromJSON (builtins.readFile ./sources.json);
+in
+{
+  jdk-hotspot = import ./jdk-darwin-base.nix sources.openjdk15.mac.jdk.hotspot;
+  jre-hotspot = import ./jdk-darwin-base.nix sources.openjdk15.mac.jre.hotspot;
+  jdk-openj9 = import ./jdk-darwin-base.nix sources.openjdk15.mac.jdk.openj9;
+  jre-openj9 = import ./jdk-darwin-base.nix sources.openjdk15.mac.jre.openj9;
+}
diff --git a/third_party/nixpkgs/pkgs/development/compilers/adoptopenjdk-bin/jdk15-linux.nix b/third_party/nixpkgs/pkgs/development/compilers/adoptopenjdk-bin/jdk15-linux.nix
new file mode 100644
index 0000000000..d48f9312dd
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/development/compilers/adoptopenjdk-bin/jdk15-linux.nix
@@ -0,0 +1,9 @@
+let
+  sources = builtins.fromJSON (builtins.readFile ./sources.json);
+in
+{
+  jdk-hotspot = import ./jdk-linux-base.nix sources.openjdk15.linux.jdk.hotspot;
+  jre-hotspot = import ./jdk-linux-base.nix sources.openjdk15.linux.jre.hotspot;
+  jdk-openj9 = import ./jdk-linux-base.nix sources.openjdk15.linux.jdk.openj9;
+  jre-openj9 = import ./jdk-linux-base.nix sources.openjdk15.linux.jre.openj9;
+}
diff --git a/third_party/nixpkgs/pkgs/development/compilers/adoptopenjdk-bin/sources.json b/third_party/nixpkgs/pkgs/development/compilers/adoptopenjdk-bin/sources.json
index 41e7a8eac7..14c887554f 100644
--- a/third_party/nixpkgs/pkgs/development/compilers/adoptopenjdk-bin/sources.json
+++ b/third_party/nixpkgs/pkgs/development/compilers/adoptopenjdk-bin/sources.json
@@ -4,92 +4,92 @@
       "jdk": {
         "hotspot": {
           "aarch64": {
-            "build": "10",
-            "sha256": "3b8b8bba6a0472ec7de5271cbf67f11e6ab525de6dd5d4729300375f1d56b7a1",
-            "url": "https://github.com/AdoptOpenJDK/openjdk11-binaries/releases/download/jdk-11.0.7%2B10/OpenJDK11U-jdk_aarch64_linux_hotspot_11.0.7_10.tar.gz",
-            "version": "11.0.7"
+            "build": "11",
+            "sha256": "f90c6f941a95e20e305870700328804e5b48acb69d4928dc9c4627b3c755ae8a",
+            "url": "https://github.com/AdoptOpenJDK/openjdk11-binaries/releases/download/jdk-11.0.9%2B11.1/OpenJDK11U-jdk_aarch64_linux_hotspot_11.0.9_11.tar.gz",
+            "version": "11.0.9"
           },
           "armv6l": {
-            "build": "10",
-            "sha256": "45c235af67498f87e3dc99642771e57547cf226335eaee8a55d195173e66a2e9",
-            "url": "https://github.com/AdoptOpenJDK/openjdk11-binaries/releases/download/jdk-11.0.7%2B10/OpenJDK11U-jdk_arm_linux_hotspot_11.0.7_10.tar.gz",
-            "version": "11.0.7"
+            "build": "11",
+            "sha256": "082a13a9a5fbcf7ca45e67ab39e9682a9ef9e3779395e37aa0bf235e42a8eaf5",
+            "url": "https://github.com/AdoptOpenJDK/openjdk11-binaries/releases/download/jdk-11.0.9%2B11/OpenJDK11U-jdk_arm_linux_hotspot_11.0.9_11.tar.gz",
+            "version": "11.0.9"
           },
           "armv7l": {
-            "build": "10",
-            "sha256": "45c235af67498f87e3dc99642771e57547cf226335eaee8a55d195173e66a2e9",
-            "url": "https://github.com/AdoptOpenJDK/openjdk11-binaries/releases/download/jdk-11.0.7%2B10/OpenJDK11U-jdk_arm_linux_hotspot_11.0.7_10.tar.gz",
-            "version": "11.0.7"
+            "build": "11",
+            "sha256": "082a13a9a5fbcf7ca45e67ab39e9682a9ef9e3779395e37aa0bf235e42a8eaf5",
+            "url": "https://github.com/AdoptOpenJDK/openjdk11-binaries/releases/download/jdk-11.0.9%2B11/OpenJDK11U-jdk_arm_linux_hotspot_11.0.9_11.tar.gz",
+            "version": "11.0.9"
           },
           "packageType": "jdk",
           "vmType": "hotspot",
           "x86_64": {
-            "build": "10",
-            "sha256": "ee60304d782c9d5654bf1a6b3f38c683921c1711045e1db94525a51b7024a2ca",
-            "url": "https://github.com/AdoptOpenJDK/openjdk11-binaries/releases/download/jdk-11.0.7%2B10/OpenJDK11U-jdk_x64_linux_hotspot_11.0.7_10.tar.gz",
-            "version": "11.0.7"
+            "build": "11",
+            "sha256": "a3c52b73a76bed0f113604165eb4f2020b767e188704d8cc0bfc8bc4eb596712",
+            "url": "https://github.com/AdoptOpenJDK/openjdk11-binaries/releases/download/jdk-11.0.9%2B11.1/OpenJDK11U-jdk_x64_linux_hotspot_11.0.9_11.tar.gz",
+            "version": "11.0.9"
           }
         },
         "openj9": {
           "aarch64": {
-            "build": "10",
-            "sha256": "0be01fdcae330e26c489d8d0d0c98c535a2af8cbd0cdcda211776ab9fcd05086",
-            "url": "https://github.com/AdoptOpenJDK/openjdk11-binaries/releases/download/jdk-11.0.7%2B10_openj9-0.20.0/OpenJDK11U-jdk_aarch64_linux_openj9_11.0.7_10_openj9-0.20.0.tar.gz",
-            "version": "11.0.7"
+            "build": "11",
+            "sha256": "f0426b6d37085d471a7f577ce6f28af7cc8fe35b9b0b09a5111eccaed80a0447",
+            "url": "https://github.com/AdoptOpenJDK/openjdk11-binaries/releases/download/jdk-11.0.9%2B11_openj9-0.23.0/OpenJDK11U-jdk_aarch64_linux_openj9_11.0.9_11_openj9-0.23.0.tar.gz",
+            "version": "11.0.9"
           },
           "packageType": "jdk",
           "vmType": "openj9",
           "x86_64": {
-            "build": "10",
-            "sha256": "526e89f3014fec473b24c10c2464c1343e23703114983fd171b68b1599bba561",
-            "url": "https://github.com/AdoptOpenJDK/openjdk11-binaries/releases/download/jdk-11.0.7%2B10_openj9-0.20.0/OpenJDK11U-jdk_x64_linux_openj9_11.0.7_10_openj9-0.20.0.tar.gz",
-            "version": "11.0.7"
+            "build": "11",
+            "sha256": "812d58fac39465802039291a1bc530b4feaaa61b58664d9c458a075921ae8091",
+            "url": "https://github.com/AdoptOpenJDK/openjdk11-binaries/releases/download/jdk-11.0.9%2B11_openj9-0.23.0/OpenJDK11U-jdk_x64_linux_openj9_11.0.9_11_openj9-0.23.0.tar.gz",
+            "version": "11.0.9"
           }
         }
       },
       "jre": {
         "hotspot": {
           "aarch64": {
-            "build": "10",
-            "sha256": "cfe504e9e9621b831a5cfd800a2005dafe90a1d11aa14ee35d7b674d68685698",
-            "url": "https://github.com/AdoptOpenJDK/openjdk11-binaries/releases/download/jdk-11.0.7%2B10/OpenJDK11U-jre_aarch64_linux_hotspot_11.0.7_10.tar.gz",
-            "version": "11.0.7"
+            "build": "11",
+            "sha256": "89b9b3108afda968a97961c5602a896bae31fea7c95195b54be5ad68b3af9e45",
+            "url": "https://github.com/AdoptOpenJDK/openjdk11-binaries/releases/download/jdk-11.0.9%2B11.1/OpenJDK11U-jre_aarch64_linux_hotspot_11.0.9_11.tar.gz",
+            "version": "11.0.9"
           },
           "armv6l": {
-            "build": "10",
-            "sha256": "581bae8efcaa40e209a780baa6f96b7c8c9397965bc6d54533f4fd8599d5c742",
-            "url": "https://github.com/AdoptOpenJDK/openjdk11-binaries/releases/download/jdk-11.0.7%2B10/OpenJDK11U-jre_arm_linux_hotspot_11.0.7_10.tar.gz",
-            "version": "11.0.7"
+            "build": "11",
+            "sha256": "8e52de3c7a24edb74e423631fa90a09f7af3193aa9e6e4837b337192669530b0",
+            "url": "https://github.com/AdoptOpenJDK/openjdk11-binaries/releases/download/jdk-11.0.9%2B11/OpenJDK11U-jre_arm_linux_hotspot_11.0.9_11.tar.gz",
+            "version": "11.0.9"
           },
           "armv7l": {
-            "build": "10",
-            "sha256": "581bae8efcaa40e209a780baa6f96b7c8c9397965bc6d54533f4fd8599d5c742",
-            "url": "https://github.com/AdoptOpenJDK/openjdk11-binaries/releases/download/jdk-11.0.7%2B10/OpenJDK11U-jre_arm_linux_hotspot_11.0.7_10.tar.gz",
-            "version": "11.0.7"
+            "build": "11",
+            "sha256": "8e52de3c7a24edb74e423631fa90a09f7af3193aa9e6e4837b337192669530b0",
+            "url": "https://github.com/AdoptOpenJDK/openjdk11-binaries/releases/download/jdk-11.0.9%2B11/OpenJDK11U-jre_arm_linux_hotspot_11.0.9_11.tar.gz",
+            "version": "11.0.9"
           },
           "packageType": "jre",
           "vmType": "hotspot",
           "x86_64": {
-            "build": "10",
-            "sha256": "74b493dd8a884dcbee29682ead51b182d9d3e52b40c3d4cbb3167c2fd0063503",
-            "url": "https://github.com/AdoptOpenJDK/openjdk11-binaries/releases/download/jdk-11.0.7%2B10/OpenJDK11U-jre_x64_linux_hotspot_11.0.7_10.tar.gz",
-            "version": "11.0.7"
+            "build": "11",
+            "sha256": "2ed263b662afb8b5d2964d1c9941d20031d07e5af68679ebefdca35d40bb91b1",
+            "url": "https://github.com/AdoptOpenJDK/openjdk11-binaries/releases/download/jdk-11.0.9%2B11.1/OpenJDK11U-jre_x64_linux_hotspot_11.0.9_11.tar.gz",
+            "version": "11.0.9"
           }
         },
         "openj9": {
           "aarch64": {
-            "build": "10",
-            "sha256": "37ae26443abb02d2ab041eced9be948f0d20db03183aaf3c159ef682eeeabf9b",
-            "url": "https://github.com/AdoptOpenJDK/openjdk11-binaries/releases/download/jdk-11.0.7%2B10_openj9-0.20.0/OpenJDK11U-jre_aarch64_linux_openj9_11.0.7_10_openj9-0.20.0.tar.gz",
-            "version": "11.0.7"
+            "build": "11",
+            "sha256": "b73f406dba1560dc194ac891452a1aacc2ba3b3e5e7b55e91a64559f8c2d9539",
+            "url": "https://github.com/AdoptOpenJDK/openjdk11-binaries/releases/download/jdk-11.0.9%2B11_openj9-0.23.0/OpenJDK11U-jre_aarch64_linux_openj9_11.0.9_11_openj9-0.23.0.tar.gz",
+            "version": "11.0.9"
           },
           "packageType": "jre",
           "vmType": "openj9",
           "x86_64": {
-            "build": "10",
-            "sha256": "08258a767a6953bde21d15ef3c08e776d83257afa4acc52b55c70e1ac02f0489",
-            "url": "https://github.com/AdoptOpenJDK/openjdk11-binaries/releases/download/jdk-11.0.7%2B10_openj9-0.20.0/OpenJDK11U-jre_x64_linux_openj9_11.0.7_10_openj9-0.20.0.tar.gz",
-            "version": "11.0.7"
+            "build": "11",
+            "sha256": "54c845c167c197ba789eb6c3508faa5b1c95c9abe2ac26878123b6eecc87a111",
+            "url": "https://github.com/AdoptOpenJDK/openjdk11-binaries/releases/download/jdk-11.0.9%2B11_openj9-0.23.0/OpenJDK11U-jre_x64_linux_openj9_11.0.9_11_openj9-0.23.0.tar.gz",
+            "version": "11.0.9"
           }
         }
       }
@@ -100,20 +100,20 @@
           "packageType": "jdk",
           "vmType": "hotspot",
           "x86_64": {
-            "build": "10",
-            "sha256": "0ab1e15e8bd1916423960e91b932d2b17f4c15b02dbdf9fa30e9423280d9e5cc",
-            "url": "https://github.com/AdoptOpenJDK/openjdk11-binaries/releases/download/jdk-11.0.7%2B10/OpenJDK11U-jdk_x64_mac_hotspot_11.0.7_10.tar.gz",
-            "version": "11.0.7"
+            "build": "11",
+            "sha256": "7b21961ffb2649e572721a0dfad64169b490e987937b661cb4e13a594c21e764",
+            "url": "https://github.com/AdoptOpenJDK/openjdk11-binaries/releases/download/jdk-11.0.9%2B11.1/OpenJDK11U-jdk_x64_mac_hotspot_11.0.9_11.tar.gz",
+            "version": "11.0.9"
           }
         },
         "openj9": {
           "packageType": "jdk",
           "vmType": "openj9",
           "x86_64": {
-            "build": "10",
-            "sha256": "a0de749c37802cc233ac58ffde68191a4dc985c71b626e7c0ff53944f743427f",
-            "url": "https://github.com/AdoptOpenJDK/openjdk11-binaries/releases/download/jdk-11.0.7%2B10.2_openj9-0.20.0/OpenJDK11U-jdk_x64_mac_openj9_11.0.7_10_openj9-0.20.0.tar.gz",
-            "version": "11.0.7"
+            "build": "11",
+            "sha256": "382238443d4495d976f9e1a66b0f6e3bc250d3d009b64d2c29d44022afd7e418",
+            "url": "https://github.com/AdoptOpenJDK/openjdk11-binaries/releases/download/jdk-11.0.9%2B11.1_openj9-0.23.0/OpenJDK11U-jdk_x64_mac_openj9_11.0.9_11_openj9-0.23.0.tar.gz",
+            "version": "11.0.9"
           }
         }
       },
@@ -122,20 +122,20 @@
           "packageType": "jre",
           "vmType": "hotspot",
           "x86_64": {
-            "build": "10",
-            "sha256": "931a81f4bed38c48b364db57d4ebdd6e4b4ea1466e9bd0eaf8e0f1e47c4569e9",
-            "url": "https://github.com/AdoptOpenJDK/openjdk11-binaries/releases/download/jdk-11.0.7%2B10/OpenJDK11U-jre_x64_mac_hotspot_11.0.7_10.tar.gz",
-            "version": "11.0.7"
+            "build": "11",
+            "sha256": "cd8965dc8dbd0b5b3b25b6a336857d9bb622965e039b77e3048bc825e5512e95",
+            "url": "https://github.com/AdoptOpenJDK/openjdk11-binaries/releases/download/jdk-11.0.9%2B11.1/OpenJDK11U-jre_x64_mac_hotspot_11.0.9_11.tar.gz",
+            "version": "11.0.9"
           }
         },
         "openj9": {
           "packageType": "jre",
           "vmType": "openj9",
           "x86_64": {
-            "build": "10",
-            "sha256": "0941d739e3230d1d83dc1ee54cff6d17d90331e4f275d00739cb78fba41c5b96",
-            "url": "https://github.com/AdoptOpenJDK/openjdk11-binaries/releases/download/jdk-11.0.7%2B10.2_openj9-0.20.0/OpenJDK11U-jre_x64_mac_openj9_11.0.7_10_openj9-0.20.0.tar.gz",
-            "version": "11.0.7"
+            "build": "11",
+            "sha256": "33a868f12bbe9326f658e60abe48dac658df33578b3719f551355855a87d1911",
+            "url": "https://github.com/AdoptOpenJDK/openjdk11-binaries/releases/download/jdk-11.0.9%2B11.1_openj9-0.23.0/OpenJDK11U-jre_x64_mac_openj9_11.0.9_11_openj9-0.23.0.tar.gz",
+            "version": "11.0.9"
           }
         }
       }
@@ -259,45 +259,181 @@
       }
     }
   },
-  "openjdk8": {
+  "openjdk14": {
     "linux": {
       "jdk": {
         "hotspot": {
           "aarch64": {
-            "build": "9",
-            "sha256": "536bf397d98174b376da9ed49d2f659d65c7310318d8211444f4b7ba7c15e453",
-            "url": "https://github.com/AdoptOpenJDK/openjdk8-binaries/releases/download/jdk8u252-b09/OpenJDK8U-jdk_aarch64_linux_hotspot_8u252b09.tar.gz",
-            "version": "8.0.252"
+            "build": "12",
+            "sha256": "ee87e9f03b1fbe6f328429b78fe1a9f44900026d220c90dfd747fe0bcd62d904",
+            "url": "https://github.com/AdoptOpenJDK/openjdk14-binaries/releases/download/jdk-14.0.2%2B12/OpenJDK14U-jdk_aarch64_linux_hotspot_14.0.2_12.tar.gz",
+            "version": "14.0.2"
           },
           "armv6l": {
-            "build": "9",
-            "sha256": "5b401ad3c9b246281bd6df34b1abaf75e10e5cad9c6b26b55232b016e90e411a",
-            "url": "https://github.com/AdoptOpenJDK/openjdk8-binaries/releases/download/jdk8u252-b09/OpenJDK8U-jdk_arm_linux_hotspot_8u252b09.tar.gz",
-            "version": "8.0.252"
+            "build": "12",
+            "sha256": "65f193496c6977ba7aed1563edc4b5be091b5ff03e3d790074bb4e389a034b36",
+            "url": "https://github.com/AdoptOpenJDK/openjdk14-binaries/releases/download/jdk-14.0.2%2B12/OpenJDK14U-jdk_arm_linux_hotspot_14.0.2_12.tar.gz",
+            "version": "14.0.2"
           },
           "armv7l": {
-            "build": "9",
-            "sha256": "5b401ad3c9b246281bd6df34b1abaf75e10e5cad9c6b26b55232b016e90e411a",
-            "url": "https://github.com/AdoptOpenJDK/openjdk8-binaries/releases/download/jdk8u252-b09/OpenJDK8U-jdk_arm_linux_hotspot_8u252b09.tar.gz",
-            "version": "8.0.252"
+            "build": "12",
+            "sha256": "65f193496c6977ba7aed1563edc4b5be091b5ff03e3d790074bb4e389a034b36",
+            "url": "https://github.com/AdoptOpenJDK/openjdk14-binaries/releases/download/jdk-14.0.2%2B12/OpenJDK14U-jdk_arm_linux_hotspot_14.0.2_12.tar.gz",
+            "version": "14.0.2"
           },
           "packageType": "jdk",
           "vmType": "hotspot",
           "x86_64": {
-            "build": "9",
-            "sha256": "2b59b5282ff32bce7abba8ad6b9fde34c15a98f949ad8ae43e789bbd78fc8862",
-            "url": "https://github.com/AdoptOpenJDK/openjdk8-binaries/releases/download/jdk8u252-b09/OpenJDK8U-jdk_x64_linux_hotspot_8u252b09.tar.gz",
-            "version": "8.0.252"
+            "build": "12",
+            "sha256": "7d5ee7e06909b8a99c0d029f512f67b092597aa5b0e78c109bd59405bbfa74fe",
+            "url": "https://github.com/AdoptOpenJDK/openjdk14-binaries/releases/download/jdk-14.0.2%2B12/OpenJDK14U-jdk_x64_linux_hotspot_14.0.2_12.tar.gz",
+            "version": "14.0.2"
           }
         },
         "openj9": {
           "packageType": "jdk",
           "vmType": "openj9",
           "x86_64": {
+            "build": "12",
+            "sha256": "306f7138cdb65daaf2596ec36cafbde72088144c83b2e964f0193662e6caf3be",
+            "url": "https://github.com/AdoptOpenJDK/openjdk14-binaries/releases/download/jdk-14.0.2%2B12_openj9-0.21.0/OpenJDK14U-jdk_x64_linux_openj9_14.0.2_12_openj9-0.21.0.tar.gz",
+            "version": "14.0.2"
+          }
+        }
+      },
+      "jre": {
+        "hotspot": {
+          "aarch64": {
+            "build": "12",
+            "sha256": "2b749ceead19d68dd7e3c28b143dc4f94bb0916378a98b7346e851318ea4da84",
+            "url": "https://github.com/AdoptOpenJDK/openjdk14-binaries/releases/download/jdk-14.0.2%2B12/OpenJDK14U-jre_aarch64_linux_hotspot_14.0.2_12.tar.gz",
+            "version": "14.0.2"
+          },
+          "armv6l": {
+            "build": "12",
+            "sha256": "4468ecf74956783ae41a46e8ba023c003c69e4d111622944aad1af764a1bc4af",
+            "url": "https://github.com/AdoptOpenJDK/openjdk14-binaries/releases/download/jdk-14.0.2%2B12/OpenJDK14U-jre_arm_linux_hotspot_14.0.2_12.tar.gz",
+            "version": "14.0.2"
+          },
+          "armv7l": {
+            "build": "12",
+            "sha256": "4468ecf74956783ae41a46e8ba023c003c69e4d111622944aad1af764a1bc4af",
+            "url": "https://github.com/AdoptOpenJDK/openjdk14-binaries/releases/download/jdk-14.0.2%2B12/OpenJDK14U-jre_arm_linux_hotspot_14.0.2_12.tar.gz",
+            "version": "14.0.2"
+          },
+          "packageType": "jre",
+          "vmType": "hotspot",
+          "x86_64": {
+            "build": "12",
+            "sha256": "1107845947da56e6bdad0da0b79210a079a74ec5c806f815ec5db9d09e1a9236",
+            "url": "https://github.com/AdoptOpenJDK/openjdk14-binaries/releases/download/jdk-14.0.2%2B12/OpenJDK14U-jre_x64_linux_hotspot_14.0.2_12.tar.gz",
+            "version": "14.0.2"
+          }
+        },
+        "openj9": {
+          "packageType": "jre",
+          "vmType": "openj9",
+          "x86_64": {
+            "build": "12",
+            "sha256": "3a137146a7b0bd8b029e72beb37c5fbb09dcfb9e33a10125076fff1555227cfd",
+            "url": "https://github.com/AdoptOpenJDK/openjdk14-binaries/releases/download/jdk-14.0.2%2B12_openj9-0.21.0/OpenJDK14U-jre_x64_linux_openj9_14.0.2_12_openj9-0.21.0.tar.gz",
+            "version": "14.0.2"
+          }
+        }
+      }
+    },
+    "mac": {
+      "jdk": {
+        "hotspot": {
+          "packageType": "jdk",
+          "vmType": "hotspot",
+          "x86_64": {
+            "build": "12",
+            "sha256": "09b7e6ab5d5eb4b73813f4caa793a0b616d33794a17988fa6a6b7c972e8f3dd3",
+            "url": "https://github.com/AdoptOpenJDK/openjdk14-binaries/releases/download/jdk-14.0.2%2B12/OpenJDK14U-jdk_x64_mac_hotspot_14.0.2_12.tar.gz",
+            "version": "14.0.2"
+          }
+        },
+        "openj9": {
+          "packageType": "jdk",
+          "vmType": "openj9",
+          "x86_64": {
+            "build": "12",
+            "sha256": "95e6abcc12dde676ccd5ba65ab86f06ddaa22749dde00e31f4c6d3ea95277359",
+            "url": "https://github.com/AdoptOpenJDK/openjdk14-binaries/releases/download/jdk-14.0.2%2B12_openj9-0.21.0/OpenJDK14U-jdk_x64_mac_openj9_14.0.2_12_openj9-0.21.0.tar.gz",
+            "version": "14.0.2"
+          }
+        }
+      },
+      "jre": {
+        "hotspot": {
+          "packageType": "jre",
+          "vmType": "hotspot",
+          "x86_64": {
+            "build": "12",
+            "sha256": "e8b5196de8ecb2b136a28494c2888784b9d9e22e29d2c38528892fb7d0c95260",
+            "url": "https://github.com/AdoptOpenJDK/openjdk14-binaries/releases/download/jdk-14.0.2%2B12/OpenJDK14U-jre_x64_mac_hotspot_14.0.2_12.tar.gz",
+            "version": "14.0.2"
+          }
+        },
+        "openj9": {
+          "packageType": "jre",
+          "vmType": "openj9",
+          "x86_64": {
+            "build": "12",
+            "sha256": "2562a442d7278409358f474071db34df4ba9c555925f28d0270139f97133c8d5",
+            "url": "https://github.com/AdoptOpenJDK/openjdk14-binaries/releases/download/jdk-14.0.2%2B12_openj9-0.21.0/OpenJDK14U-jre_x64_mac_openj9_14.0.2_12_openj9-0.21.0.tar.gz",
+            "version": "14.0.2"
+          }
+        }
+      }
+    }
+  },
+  "openjdk15": {
+    "linux": {
+      "jdk": {
+        "hotspot": {
+          "aarch64": {
             "build": "9",
-            "sha256": "910ae847109a6dd1b6cf69baa7615ea2cce8cff787e5a9349a5331ce7604f3a5",
-            "url": "https://github.com/AdoptOpenJDK/openjdk8-binaries/releases/download/jdk8u252-b09_openj9-0.20.0/OpenJDK8U-jdk_x64_linux_openj9_8u252b09_openj9-0.20.0.tar.gz",
-            "version": "8.0.252"
+            "sha256": "84398a1566d66ee5a88f3326fb7f0b70504eb510190f8f798bdb386481a3900e",
+            "url": "https://github.com/AdoptOpenJDK/openjdk15-binaries/releases/download/jdk-15.0.1%2B9/OpenJDK15U-jdk_aarch64_linux_hotspot_15.0.1_9.tar.gz",
+            "version": "15.0.1"
+          },
+          "armv6l": {
+            "build": "9",
+            "sha256": "bef5e9f4ab8a87645fa2b3d0ffb9f2b97374caa03cd1296597e8c86e8360d5a2",
+            "url": "https://github.com/AdoptOpenJDK/openjdk15-binaries/releases/download/jdk-15.0.1%2B9/OpenJDK15U-jdk_arm_linux_hotspot_15.0.1_9.tar.gz",
+            "version": "15.0.1"
+          },
+          "armv7l": {
+            "build": "9",
+            "sha256": "bef5e9f4ab8a87645fa2b3d0ffb9f2b97374caa03cd1296597e8c86e8360d5a2",
+            "url": "https://github.com/AdoptOpenJDK/openjdk15-binaries/releases/download/jdk-15.0.1%2B9/OpenJDK15U-jdk_arm_linux_hotspot_15.0.1_9.tar.gz",
+            "version": "15.0.1"
+          },
+          "packageType": "jdk",
+          "vmType": "hotspot",
+          "x86_64": {
+            "build": "9",
+            "sha256": "61045ecb9434e3320dbc2c597715f9884586b7a18a56d29851b4d4a4d48a2a5e",
+            "url": "https://github.com/AdoptOpenJDK/openjdk15-binaries/releases/download/jdk-15.0.1%2B9/OpenJDK15U-jdk_x64_linux_hotspot_15.0.1_9.tar.gz",
+            "version": "15.0.1"
+          }
+        },
+        "openj9": {
+          "aarch64": {
+            "build": "9",
+            "sha256": "6206643ec4a57597f73880423b72fc06c1018d92cc6b02972ec3ea3fe4d853a2",
+            "url": "https://github.com/AdoptOpenJDK/openjdk15-binaries/releases/download/jdk-15.0.1%2B9_openj9-0.23.0/OpenJDK15U-jdk_aarch64_linux_openj9_15.0.1_9_openj9-0.23.0.tar.gz",
+            "version": "15.0.1"
+          },
+          "packageType": "jdk",
+          "vmType": "openj9",
+          "x86_64": {
+            "build": "9",
+            "sha256": "b1561f7a69c977bfc9991e61e96dcb200c39300dd9ad423254af117c189e4a8d",
+            "url": "https://github.com/AdoptOpenJDK/openjdk15-binaries/releases/download/jdk-15.0.1%2B9_openj9-0.23.0/OpenJDK15U-jdk_x64_linux_openj9_15.0.1_9_openj9-0.23.0.tar.gz",
+            "version": "15.0.1"
           }
         }
       },
@@ -305,39 +441,45 @@
         "hotspot": {
           "aarch64": {
             "build": "9",
-            "sha256": "30bba4425497f5b4aabcba7b45db69d582d278fb17357d64c22c9dc6b2d29ca1",
-            "url": "https://github.com/AdoptOpenJDK/openjdk8-binaries/releases/download/jdk8u252-b09/OpenJDK8U-jre_aarch64_linux_hotspot_8u252b09.tar.gz",
-            "version": "8.0.252"
+            "sha256": "9eecdd39239545b922878abf51015030ba9aed4dda5c4574ddbc669a71ddab31",
+            "url": "https://github.com/AdoptOpenJDK/openjdk15-binaries/releases/download/jdk-15.0.1%2B9/OpenJDK15U-jre_aarch64_linux_hotspot_15.0.1_9.tar.gz",
+            "version": "15.0.1"
           },
           "armv6l": {
             "build": "9",
-            "sha256": "107699a88f611e0c2d57816be25821ef9b17db860b14402c4e9e5bf0b9cf16fd",
-            "url": "https://github.com/AdoptOpenJDK/openjdk8-binaries/releases/download/jdk8u252-b09/OpenJDK8U-jre_arm_linux_hotspot_8u252b09.tar.gz",
-            "version": "8.0.252"
+            "sha256": "f289d1b9fc05099889eaa9a52d352275d44698f3448153cc2ef05f2fa1c04cca",
+            "url": "https://github.com/AdoptOpenJDK/openjdk15-binaries/releases/download/jdk-15.0.1%2B9/OpenJDK15U-jre_arm_linux_hotspot_15.0.1_9.tar.gz",
+            "version": "15.0.1"
           },
           "armv7l": {
             "build": "9",
-            "sha256": "107699a88f611e0c2d57816be25821ef9b17db860b14402c4e9e5bf0b9cf16fd",
-            "url": "https://github.com/AdoptOpenJDK/openjdk8-binaries/releases/download/jdk8u252-b09/OpenJDK8U-jre_arm_linux_hotspot_8u252b09.tar.gz",
-            "version": "8.0.252"
+            "sha256": "f289d1b9fc05099889eaa9a52d352275d44698f3448153cc2ef05f2fa1c04cca",
+            "url": "https://github.com/AdoptOpenJDK/openjdk15-binaries/releases/download/jdk-15.0.1%2B9/OpenJDK15U-jre_arm_linux_hotspot_15.0.1_9.tar.gz",
+            "version": "15.0.1"
           },
           "packageType": "jre",
           "vmType": "hotspot",
           "x86_64": {
             "build": "9",
-            "sha256": "a93be303ed62398dba9acb0376fb3caf8f488fcde80dc62d0a8e46256b3adfb1",
-            "url": "https://github.com/AdoptOpenJDK/openjdk8-binaries/releases/download/jdk8u252-b09/OpenJDK8U-jre_x64_linux_hotspot_8u252b09.tar.gz",
-            "version": "8.0.252"
+            "sha256": "e619197c7a5757631f6ea9c912ab47528ebf64c27cf788cdad22bc9245779411",
+            "url": "https://github.com/AdoptOpenJDK/openjdk15-binaries/releases/download/jdk-15.0.1%2B9/OpenJDK15U-jre_x64_linux_hotspot_15.0.1_9.tar.gz",
+            "version": "15.0.1"
           }
         },
         "openj9": {
+          "aarch64": {
+            "build": "9",
+            "sha256": "1db3c28e8c423d005fcf3b0c8a081061e56c51966273e32e3930d4c57c21bf49",
+            "url": "https://github.com/AdoptOpenJDK/openjdk15-binaries/releases/download/jdk-15.0.1%2B9_openj9-0.23.0/OpenJDK15U-jre_aarch64_linux_openj9_15.0.1_9_openj9-0.23.0.tar.gz",
+            "version": "15.0.1"
+          },
           "packageType": "jre",
           "vmType": "openj9",
           "x86_64": {
             "build": "9",
-            "sha256": "5c0ab4691ff5f8e69bb14462f2afb8d73d751b01048eacf4b426ed6d6646dc63",
-            "url": "https://github.com/AdoptOpenJDK/openjdk8-binaries/releases/download/jdk8u252-b09_openj9-0.20.0/OpenJDK8U-jre_x64_linux_openj9_8u252b09_openj9-0.20.0.tar.gz",
-            "version": "8.0.252"
+            "sha256": "e47fdadfe91f554f3e343b24e678b6862673f9b1dce3703efd1447950188357b",
+            "url": "https://github.com/AdoptOpenJDK/openjdk15-binaries/releases/download/jdk-15.0.1%2B9_openj9-0.23.0/OpenJDK15U-jre_x64_linux_openj9_15.0.1_9_openj9-0.23.0.tar.gz",
+            "version": "15.0.1"
           }
         }
       }
@@ -349,9 +491,9 @@
           "vmType": "hotspot",
           "x86_64": {
             "build": "9",
-            "sha256": "2caed3ec07d108bda613f9b4614b22a8bdd196ccf2a432a126161cd4077f07a5",
-            "url": "https://github.com/AdoptOpenJDK/openjdk8-binaries/releases/download/jdk8u252-b09.1/OpenJDK8U-jdk_x64_mac_hotspot_8u252b09.tar.gz",
-            "version": "8.0.252"
+            "sha256": "d32f9429c4992cef7be559a15c542011503d6bc38c89379800cd209a9d7ec539",
+            "url": "https://github.com/AdoptOpenJDK/openjdk15-binaries/releases/download/jdk-15.0.1%2B9/OpenJDK15U-jdk_x64_mac_hotspot_15.0.1_9.tar.gz",
+            "version": "15.0.1"
           }
         },
         "openj9": {
@@ -359,9 +501,9 @@
           "vmType": "openj9",
           "x86_64": {
             "build": "9",
-            "sha256": "f522061a23290bce3423e49025a95b6e78d6f30e2741817e83c8fdba4c0c4ae7",
-            "url": "https://github.com/AdoptOpenJDK/openjdk8-binaries/releases/download/jdk8u252-b09.2_openj9-0.20.0/OpenJDK8U-jdk_x64_mac_openj9_8u252b09_openj9-0.20.0.tar.gz",
-            "version": "8.0.252"
+            "sha256": "c9b19fd1fda9c581aa0bcddbf5f821204c351a1de29da1c5aa51cb680ee99517",
+            "url": "https://github.com/AdoptOpenJDK/openjdk15-binaries/releases/download/jdk-15.0.1%2B9.1_openj9-0.23.0/OpenJDK15U-jdk_x64_mac_openj9_15.0.1_9_openj9-0.23.0.tar.gz",
+            "version": "15.0.1"
           }
         }
       },
@@ -371,9 +513,9 @@
           "vmType": "hotspot",
           "x86_64": {
             "build": "9",
-            "sha256": "f8206f0fef194c598de6b206a4773b2e517154913ea0e26c5726091562a034c8",
-            "url": "https://github.com/AdoptOpenJDK/openjdk8-binaries/releases/download/jdk8u252-b09.1/OpenJDK8U-jre_x64_mac_hotspot_8u252b09.tar.gz",
-            "version": "8.0.252"
+            "sha256": "fde1713fc51e824a08f8eeb5e2b8a2acf21424d5f9a0e70cfd2e85a77c827bc4",
+            "url": "https://github.com/AdoptOpenJDK/openjdk15-binaries/releases/download/jdk-15.0.1%2B9/OpenJDK15U-jre_x64_mac_hotspot_15.0.1_9.tar.gz",
+            "version": "15.0.1"
           }
         },
         "openj9": {
@@ -381,12 +523,154 @@
           "vmType": "openj9",
           "x86_64": {
             "build": "9",
-            "sha256": "55cce54a39c5748360e2e3fe8edf04469b75a0783514853a5745463979b43c80",
-            "url": "https://github.com/AdoptOpenJDK/openjdk8-binaries/releases/download/jdk8u252-b09.2_openj9-0.20.0/OpenJDK8U-jre_x64_mac_openj9_8u252b09_openj9-0.20.0.tar.gz",
-            "version": "8.0.252"
+            "sha256": "e7c3710d6cc23480ac66eba79b48d9e2bebec34ba688f3053bb5eba406a2c315",
+            "url": "https://github.com/AdoptOpenJDK/openjdk15-binaries/releases/download/jdk-15.0.1%2B9.1_openj9-0.23.0/OpenJDK15U-jre_x64_mac_openj9_15.0.1_9_openj9-0.23.0.tar.gz",
+            "version": "15.0.1"
+          }
+        }
+      }
+    }
+  },
+  "openjdk8": {
+    "linux": {
+      "jdk": {
+        "hotspot": {
+          "aarch64": {
+            "build": "10",
+            "sha256": "cfbde5191027c6d25af44af8a3d64625c6e22422dea8c4af6fe9240e7e249baa",
+            "url": "https://github.com/AdoptOpenJDK/openjdk8-binaries/releases/download/jdk8u272-b10/OpenJDK8U-jdk_aarch64_linux_hotspot_8u272b10.tar.gz",
+            "version": "8.0.272"
+          },
+          "armv6l": {
+            "build": "10",
+            "sha256": "b005e9e8a912aa6605debdea3685a223c077d5a4ba7c90bca02d804c5f39d0b9",
+            "url": "https://github.com/AdoptOpenJDK/openjdk8-binaries/releases/download/jdk8u272-b10/OpenJDK8U-jdk_arm_linux_hotspot_8u272b10.tar.gz",
+            "version": "8.0.272"
+          },
+          "armv7l": {
+            "build": "10",
+            "sha256": "b005e9e8a912aa6605debdea3685a223c077d5a4ba7c90bca02d804c5f39d0b9",
+            "url": "https://github.com/AdoptOpenJDK/openjdk8-binaries/releases/download/jdk8u272-b10/OpenJDK8U-jdk_arm_linux_hotspot_8u272b10.tar.gz",
+            "version": "8.0.272"
+          },
+          "packageType": "jdk",
+          "vmType": "hotspot",
+          "x86_64": {
+            "build": "10",
+            "sha256": "6f124b69d07d8d3edf39b9aa5c58473f63a380b686ddb73a5495e01d25c2939a",
+            "url": "https://github.com/AdoptOpenJDK/openjdk8-binaries/releases/download/jdk8u272-b10/OpenJDK8U-jdk_x64_linux_hotspot_8u272b10.tar.gz",
+            "version": "8.0.272"
+          }
+        },
+        "openj9": {
+          "aarch64": {
+            "build": "10",
+            "sha256": "bbc78dc8caf25372578a95287bcf672c4bf62af23939d4a988634b2a1356cd89",
+            "url": "https://github.com/AdoptOpenJDK/openjdk8-binaries/releases/download/jdk8u272-b10_openj9-0.23.0/OpenJDK8U-jdk_aarch64_linux_openj9_8u272b10_openj9-0.23.0.tar.gz",
+            "version": "8.0.272"
+          },
+          "packageType": "jdk",
+          "vmType": "openj9",
+          "x86_64": {
+            "build": "10",
+            "sha256": "ca852f976e5b27ccd9b73a527a517496bda865b2ae2a85517ca74486fb8de7da",
+            "url": "https://github.com/AdoptOpenJDK/openjdk8-binaries/releases/download/jdk8u272-b10_openj9-0.23.0/OpenJDK8U-jdk_x64_linux_openj9_8u272b10_openj9-0.23.0.tar.gz",
+            "version": "8.0.272"
+          }
+        }
+      },
+      "jre": {
+        "hotspot": {
+          "aarch64": {
+            "build": "10",
+            "sha256": "ed3a862d83dd1f19037fc6ccf73500f2ecf453eb245af8b70bec3fb80d084289",
+            "url": "https://github.com/AdoptOpenJDK/openjdk8-binaries/releases/download/jdk8u272-b10/OpenJDK8U-jre_aarch64_linux_hotspot_8u272b10.tar.gz",
+            "version": "8.0.272"
+          },
+          "armv6l": {
+            "build": "10",
+            "sha256": "906113d909d81b930c4eb519512d1cc9f9be9789dfd349128d6e7efaeeb36e1c",
+            "url": "https://github.com/AdoptOpenJDK/openjdk8-binaries/releases/download/jdk8u272-b10/OpenJDK8U-jre_arm_linux_hotspot_8u272b10.tar.gz",
+            "version": "8.0.272"
+          },
+          "armv7l": {
+            "build": "10",
+            "sha256": "906113d909d81b930c4eb519512d1cc9f9be9789dfd349128d6e7efaeeb36e1c",
+            "url": "https://github.com/AdoptOpenJDK/openjdk8-binaries/releases/download/jdk8u272-b10/OpenJDK8U-jre_arm_linux_hotspot_8u272b10.tar.gz",
+            "version": "8.0.272"
+          },
+          "packageType": "jre",
+          "vmType": "hotspot",
+          "x86_64": {
+            "build": "10",
+            "sha256": "e6894601a559c5226c6dc337308df263444d356a6430f4aabb66e02607c82956",
+            "url": "https://github.com/AdoptOpenJDK/openjdk8-binaries/releases/download/jdk8u272-b10/OpenJDK8U-jre_x64_linux_hotspot_8u272b10.tar.gz",
+            "version": "8.0.272"
+          }
+        },
+        "openj9": {
+          "aarch64": {
+            "build": "10",
+            "sha256": "b0891c3493a9fc6135700d065a826fc67223d54e9d0da3c41b57e6cb6897b726",
+            "url": "https://github.com/AdoptOpenJDK/openjdk8-binaries/releases/download/jdk8u272-b10_openj9-0.23.0/OpenJDK8U-jre_aarch64_linux_openj9_8u272b10_openj9-0.23.0.tar.gz",
+            "version": "8.0.272"
+          },
+          "packageType": "jre",
+          "vmType": "openj9",
+          "x86_64": {
+            "build": "10",
+            "sha256": "a4e58f3c15ca3bc15cb3aaa9f116de972809ca52ae81e0726f84c059442174d5",
+            "url": "https://github.com/AdoptOpenJDK/openjdk8-binaries/releases/download/jdk8u272-b10_openj9-0.23.0/OpenJDK8U-jre_x64_linux_openj9_8u272b10_openj9-0.23.0.tar.gz",
+            "version": "8.0.272"
+          }
+        }
+      }
+    },
+    "mac": {
+      "jdk": {
+        "hotspot": {
+          "packageType": "jdk",
+          "vmType": "hotspot",
+          "x86_64": {
+            "build": "10",
+            "sha256": "091f9ee39b0bdbc8af8ec19f51aaa0f73e416c2e93a8fb2c79b82f4caac83ab6",
+            "url": "https://github.com/AdoptOpenJDK/openjdk8-binaries/releases/download/jdk8u272-b10/OpenJDK8U-jdk_x64_mac_hotspot_8u272b10.tar.gz",
+            "version": "8.0.272"
+          }
+        },
+        "openj9": {
+          "packageType": "jdk",
+          "vmType": "openj9",
+          "x86_64": {
+            "build": "10",
+            "sha256": "bbd66ec27a4ea9b0b0952f501e1837e69c24262f64b316dab0408d1a8633a527",
+            "url": "https://github.com/AdoptOpenJDK/openjdk8-binaries/releases/download/jdk8u272-b10.1_openj9-0.23.0/OpenJDK8U-jdk_x64_mac_openj9_8u272b10_openj9-0.23.0.tar.gz",
+            "version": "8.0.272"
+          }
+        }
+      },
+      "jre": {
+        "hotspot": {
+          "packageType": "jre",
+          "vmType": "hotspot",
+          "x86_64": {
+            "build": "10",
+            "sha256": "afb9c08cb8b93d8e7d4f1e48ced3d43cfb3082491595a2eaf1f00c48abd25428",
+            "url": "https://github.com/AdoptOpenJDK/openjdk8-binaries/releases/download/jdk8u272-b10/OpenJDK8U-jre_x64_mac_hotspot_8u272b10.tar.gz",
+            "version": "8.0.272"
+          }
+        },
+        "openj9": {
+          "packageType": "jre",
+          "vmType": "openj9",
+          "x86_64": {
+            "build": "10",
+            "sha256": "4d90e85240113189d897a86731e672b37a6e345c056f35c7719cb27f3d08385b",
+            "url": "https://github.com/AdoptOpenJDK/openjdk8-binaries/releases/download/jdk8u272-b10.1_openj9-0.23.0/OpenJDK8U-jre_x64_mac_openj9_8u272b10_openj9-0.23.0.tar.gz",
+            "version": "8.0.272"
           }
         }
       }
     }
   }
-}
\ No newline at end of file
+}
diff --git a/third_party/nixpkgs/pkgs/development/compilers/edk2/default.nix b/third_party/nixpkgs/pkgs/development/compilers/edk2/default.nix
index 8a18b6306c..51e0842d4b 100644
--- a/third_party/nixpkgs/pkgs/development/compilers/edk2/default.nix
+++ b/third_party/nixpkgs/pkgs/development/compilers/edk2/default.nix
@@ -37,13 +37,13 @@ buildType = if stdenv.isDarwin then
 
 edk2 = buildStdenv.mkDerivation {
   pname = "edk2";
-  version = "201911";
+  version = "202011";
 
   # submodules
   src = fetchgit {
     url = "https://github.com/tianocore/edk2";
     rev = "edk2-stable${edk2.version}";
-    sha256 = "1rmvb4w043v25cppsqxqrpzqqcay3yrzsrhhzm2q9bncrj56vm8q";
+    sha256 = "1fvlz1z075jr6smq9qa0asy6fxga1gljcfd0764ypzy1mw963c9s";
   };
 
   buildInputs = [ libuuid pythonEnv ];
diff --git a/third_party/nixpkgs/pkgs/development/compilers/ghc/8.6.5.nix b/third_party/nixpkgs/pkgs/development/compilers/ghc/8.6.5.nix
index 3d660dd952..7adacff597 100644
--- a/third_party/nixpkgs/pkgs/development/compilers/ghc/8.6.5.nix
+++ b/third_party/nixpkgs/pkgs/development/compilers/ghc/8.6.5.nix
@@ -110,10 +110,10 @@ stdenv.mkDerivation (rec {
   outputs = [ "out" "doc" ];
 
   patches = [
-    (fetchpatch rec { # https://phabricator.haskell.org/D5123
-     url = "http://tarballs.nixos.org/sha256/${sha256}";
+    (fetchpatch { # https://phabricator.haskell.org/D5123
+     url = "https://gitlab.haskell.org/ghc/ghc/-/commit/13ff0b7ced097286e0d7b054f050871effe07f86.diff";
      name = "D5123.diff";
-     sha256 = "0nhqwdamf2y4gbwqxcgjxs0kqx23w9gv5kj0zv6450dq19rji82n";
+     sha256 = "140lmnqxra7xkwy370c5pyf8dgdwgmbpcrs1dapnwr2dh8bavn8c";
     })
     (fetchpatch { # https://github.com/haskell/haddock/issues/900
      url = "https://patch-diff.githubusercontent.com/raw/haskell/haddock/pull/983.diff";
diff --git a/third_party/nixpkgs/pkgs/development/compilers/llvm/rocm/default.nix b/third_party/nixpkgs/pkgs/development/compilers/llvm/rocm/default.nix
index aae6f16828..c67b011721 100644
--- a/third_party/nixpkgs/pkgs/development/compilers/llvm/rocm/default.nix
+++ b/third_party/nixpkgs/pkgs/development/compilers/llvm/rocm/default.nix
@@ -1,12 +1,12 @@
 { stdenv, fetchFromGitHub, callPackage, wrapCCWith }:
 
 let
-  version = "3.9.0";
+  version = "3.10.0";
   src = fetchFromGitHub {
     owner = "RadeonOpenCompute";
     repo = "llvm-project";
     rev = "rocm-${version}";
-    sha256 = "01ljx6mhix3z2pgddgn0ymhrsbigs1nqlz3kkwkr6p2igprrly9f";
+    hash = "sha256-Lnma831RXJMnn3N8im3QLy6dYfXAvtbeFX/0CKvpkgY=";
   };
 in rec {
   clang = wrapCCWith rec {
diff --git a/third_party/nixpkgs/pkgs/development/compilers/lobster/default.nix b/third_party/nixpkgs/pkgs/development/compilers/lobster/default.nix
index 62867f296d..b87bec7ea2 100644
--- a/third_party/nixpkgs/pkgs/development/compilers/lobster/default.nix
+++ b/third_party/nixpkgs/pkgs/development/compilers/lobster/default.nix
@@ -1,5 +1,6 @@
 { stdenv
 , fetchFromGitHub
+, unstableGitUpdater
 , cmake
 , callPackage
 
@@ -46,8 +47,9 @@ stdenv.mkDerivation rec {
   preConfigure = "cd dev";
   enableParallelBuilding = true;
 
-  passthru.tests = {
-    can-run-hello-world = callPackage ./test-can-run-hello-world.nix {};
+  passthru = {
+    tests.can-run-hello-world = callPackage ./test-can-run-hello-world.nix {};
+    updateScript = unstableGitUpdater { };
   };
 
   meta = with stdenv.lib; {
@@ -63,4 +65,3 @@ stdenv.mkDerivation rec {
     platforms = platforms.all;
   };
 }
-
diff --git a/third_party/nixpkgs/pkgs/development/compilers/nextpnr/default.nix b/third_party/nixpkgs/pkgs/development/compilers/nextpnr/default.nix
index 1f5c6a3d4c..664ceb7963 100644
--- a/third_party/nixpkgs/pkgs/development/compilers/nextpnr/default.nix
+++ b/third_party/nixpkgs/pkgs/development/compilers/nextpnr/default.nix
@@ -14,14 +14,14 @@ let
 in
 with stdenv; mkDerivation rec {
   pname = "nextpnr";
-  version = "2020.11.10";
+  version = "2020.12.01";
 
   srcs = [
     (fetchFromGitHub {
       owner  = "YosysHQ";
       repo   = "nextpnr";
-      rev    = "cf331ca2a7fa92d3414fabf003ce6fc7b515f76b";
-      sha256 = "0ka8ncfq3v8v70m3gwb3nd2rb39sy4vz0lx9hi277cbdsprmf55j";
+      rev    = "868902fbdf0b476bdccf4d25cbb80ba602d2cc11";
+      sha256 = "1kb5lhixb7f4q800gjyw9xm9ff1yaq3pgna17f5f0bw6b4ds56zc";
       name   = "nextpnr";
     })
     (fetchFromGitHub {
diff --git a/third_party/nixpkgs/pkgs/development/compilers/qbe/default.nix b/third_party/nixpkgs/pkgs/development/compilers/qbe/default.nix
index 8717074965..436b03e499 100644
--- a/third_party/nixpkgs/pkgs/development/compilers/qbe/default.nix
+++ b/third_party/nixpkgs/pkgs/development/compilers/qbe/default.nix
@@ -25,4 +25,3 @@ stdenv.mkDerivation rec {
     platforms = platforms.all;
   };
 }
-
diff --git a/third_party/nixpkgs/pkgs/development/compilers/rust/1_47.nix b/third_party/nixpkgs/pkgs/development/compilers/rust/1_48.nix
similarity index 55%
rename from third_party/nixpkgs/pkgs/development/compilers/rust/1_47.nix
rename to third_party/nixpkgs/pkgs/development/compilers/rust/1_48.nix
index 8298a5d956..b3a512e58b 100644
--- a/third_party/nixpkgs/pkgs/development/compilers/rust/1_47.nix
+++ b/third_party/nixpkgs/pkgs/development/compilers/rust/1_48.nix
@@ -19,25 +19,25 @@
 } @ args:
 
 import ./default.nix {
-  rustcVersion = "1.47.0";
-  rustcSha256 = "sha256-MYXfBkxHR/LIubuMRGjt1Y/0rW0HiAyHmsGxc7do2B0=";
+  rustcVersion = "1.48.0";
+  rustcSha256 = "0fz4gbb5hp5qalrl9lcl8yw4kk7ai7wx511jb28nypbxninkwxhf";
 
   # Note: the version MUST be one version prior to the version we're
   # building
-  bootstrapVersion = "1.46.0";
+  bootstrapVersion = "1.47.0";
 
   # fetch hashes by running `print-hashes.sh 1.45.2`
   bootstrapHashes = {
-    i686-unknown-linux-gnu = "6ebd7e04dc18a36d08b9731cdb42d5caf8460e1eb41b75f3a8596c39f5e71206";
-    x86_64-unknown-linux-gnu = "e3b98bc3440fe92817881933f9564389eccb396f5f431f33d48b979fa2fbdcf5";
-    arm-unknown-linux-gnueabihf = "bb8af68565321f54608e918597083eb016ed0f9f4f3cc23f7cc5f467b934ce7f";
-    armv7-unknown-linux-gnueabihf = "7c0640879d7f2c38db60352e3c0f09e3fc6fa3bac6ca8f22cbccb1eb5e950121";
-    aarch64-unknown-linux-gnu = "f0c6d630f3dedb3db69d69ed9f833aa6b472363096f5164f1068c7001ca42aeb";
-    x86_64-apple-darwin = "82d61582a3772932432a99789c3b3bd4abe6baca339e355048ca9efb9ea5b4db";
-    powerpc64le-unknown-linux-gnu = "89e2f4761d257f017a4b6aa427f36ac0603195546fa2cfded8c899789832941c";
+    i686-unknown-linux-gnu = "84bf092130ea5216fc701871e633563fc1c01b6528f60cb0767e96cd8eec30bf";
+    x86_64-unknown-linux-gnu = "d0e11e1756a072e8e246b05d54593402813d047d12e44df281fbabda91035d96";
+    arm-unknown-linux-gnueabihf = "82e12affb47596b68d0ca64045f4eb698c10ff15406afca604e12cdd07e17b26";
+    armv7-unknown-linux-gnueabihf = "19d0fe3892a8e98f99c5aa84f4d6f260853147650cb71f2bae985c91de6c29af";
+    aarch64-unknown-linux-gnu = "753c905e89a714ab9bce6fe1397b721f29c0760c32f09d2f328af3d39919c8e6";
+    x86_64-apple-darwin = "84e5be6c5c78734deba911dcf80316be1e4c7da2c59413124d039ad96620612f";
+    powerpc64le-unknown-linux-gnu = "5760c3b1897ea70791320c2565f3eef700a3d54059027b84bbe6b8d6157f81c8";
   };
 
-  selectRustPackage = pkgs: pkgs.rust_1_47;
+  selectRustPackage = pkgs: pkgs.rust_1_48;
 
   rustcPatches = [
   ];
diff --git a/third_party/nixpkgs/pkgs/development/compilers/rust/rustc.nix b/third_party/nixpkgs/pkgs/development/compilers/rust/rustc.nix
index 1fd3bbaba9..dab1f2a6bd 100644
--- a/third_party/nixpkgs/pkgs/development/compilers/rust/rustc.nix
+++ b/third_party/nixpkgs/pkgs/development/compilers/rust/rustc.nix
@@ -1,5 +1,4 @@
 { stdenv, removeReferencesTo, pkgsBuildBuild, pkgsBuildHost, pkgsBuildTarget
-, targetPackages
 , fetchurl, file, python3
 , llvm_10, darwin, cmake, rust, rustPlatform
 , pkgconfig, openssl
@@ -93,8 +92,12 @@ in stdenv.mkDerivation rec {
     "${setTarget}.llvm-config=${llvmSharedForTarget}/bin/llvm-config"
   ] ++ optionals (stdenv.isLinux && !stdenv.targetPlatform.isRedox) [
     "--enable-profiler" # build libprofiler_builtins
+  ] ++ optionals stdenv.buildPlatform.isMusl [
+    "${setBuild}.musl-root=${pkgsBuildBuild.targetPackages.stdenv.cc.libc}"
+  ] ++ optionals stdenv.hostPlatform.isMusl [
+    "${setHost}.musl-root=${pkgsBuildHost.targetPackages.stdenv.cc.libc}"
   ] ++ optionals stdenv.targetPlatform.isMusl [
-    "${setTarget}.musl-root=${targetPackages.stdenv.cc.libc}"
+    "${setTarget}.musl-root=${pkgsBuildTarget.targetPackages.stdenv.cc.libc}"
   ];
 
   # The bootstrap.py will generated a Makefile that then executes the build.
diff --git a/third_party/nixpkgs/pkgs/development/compilers/unison/default.nix b/third_party/nixpkgs/pkgs/development/compilers/unison/default.nix
index c7266614e4..7ae16a77a2 100644
--- a/third_party/nixpkgs/pkgs/development/compilers/unison/default.nix
+++ b/third_party/nixpkgs/pkgs/development/compilers/unison/default.nix
@@ -1,5 +1,7 @@
 { stdenv, fetchurl, autoPatchelfHook
 , ncurses5, zlib, gmp
+, makeWrapper
+, less
 }:
 
 stdenv.mkDerivation rec {
@@ -23,12 +25,13 @@ stdenv.mkDerivation rec {
   dontBuild = true;
   dontConfigure = true;
 
-  nativeBuildInputs = stdenv.lib.optional (!stdenv.isDarwin) autoPatchelfHook;
+  nativeBuildInputs = [ makeWrapper ] ++ (stdenv.lib.optional (!stdenv.isDarwin) autoPatchelfHook);
   buildInputs = stdenv.lib.optionals (!stdenv.isDarwin) [ ncurses5 zlib gmp ];
 
   installPhase = ''
     mkdir -p $out/bin
     mv ucm $out/bin
+    wrapProgram $out/bin/ucm --prefix PATH ":" "${stdenv.lib.makeBinPath [ less ]}";
   '';
 
   meta = with stdenv.lib; {
diff --git a/third_party/nixpkgs/pkgs/development/compilers/yosys/default.nix b/third_party/nixpkgs/pkgs/development/compilers/yosys/default.nix
index f34c4fb7fe..b16d76304e 100644
--- a/third_party/nixpkgs/pkgs/development/compilers/yosys/default.nix
+++ b/third_party/nixpkgs/pkgs/development/compilers/yosys/default.nix
@@ -33,13 +33,13 @@
 
 stdenv.mkDerivation rec {
   pname   = "yosys";
-  version = "0.9+3675";
+  version = "0.9+3715";
 
   src = fetchFromGitHub {
     owner  = "YosysHQ";
     repo   = "yosys";
-    rev    = "71ca9a825309635511b64b3ec40e5e5e9b6ad49b";
-    sha256 = "03jlhfvm5rxx8yybf94nqd3ld2y6brp8r0k6gfi56chv3iqqavy3";
+    rev    = "d021f4b4003bb7a374038134c65edd3f67473a92";
+    sha256 = "0dgdpigqg8mwkry4233p6z6myjnrb1rq32873yhdfwvwqq230x51";
   };
 
   enableParallelBuilding = true;
diff --git a/third_party/nixpkgs/pkgs/development/coq-modules/coq-ext-lib/default.nix b/third_party/nixpkgs/pkgs/development/coq-modules/coq-ext-lib/default.nix
index f24ccaf427..e0ca520862 100644
--- a/third_party/nixpkgs/pkgs/development/coq-modules/coq-ext-lib/default.nix
+++ b/third_party/nixpkgs/pkgs/development/coq-modules/coq-ext-lib/default.nix
@@ -1,17 +1,35 @@
-{ stdenv, fetchFromGitHub, coq }:
+{ stdenv, fetchFromGitHub, coq, ...}@args:
 
-let params =
-  {
-    "8.5"  = { version = "0.9.4";  sha256 = "1y66pamgsdxlq2w1338lj626ln70cwj7k53hxcp933g8fdsa4hp0"; };
-    "8.6"  = { version = "0.9.5";  sha256 = "1b4cvz3llxin130g13calw5n1zmvi6wdd5yb8a41q7yyn2hd3msg"; };
-    "8.7"  = { version = "0.9.7";  sha256 = "00v4bm4glv1hy08c8xsm467az6d1ashrznn8p2bmbmmp52lfg7ag"; };
-    "8.8" = { version = "0.11.2"; sha256 = "0iyka81g26x5n99xic7kqn8vxqjw8rz7vw9rs27iw04lf137vzv6"; };
-    "8.9" = { version = "0.11.2"; sha256 = "0iyka81g26x5n99xic7kqn8vxqjw8rz7vw9rs27iw04lf137vzv6"; };
-    "8.10" = { version = "0.11.2"; sha256 = "0iyka81g26x5n99xic7kqn8vxqjw8rz7vw9rs27iw04lf137vzv6"; };
-    "8.11" = { version = "0.11.2"; sha256 = "0iyka81g26x5n99xic7kqn8vxqjw8rz7vw9rs27iw04lf137vzv6"; };
-    "8.12" = { version = "0.11.2"; sha256 = "0iyka81g26x5n99xic7kqn8vxqjw8rz7vw9rs27iw04lf137vzv6"; };
+let
+  hashes = {
+    "0.9.4" = "1y66pamgsdxlq2w1338lj626ln70cwj7k53hxcp933g8fdsa4hp0";
+    "0.9.5" = "1b4cvz3llxin130g13calw5n1zmvi6wdd5yb8a41q7yyn2hd3msg";
+    "0.9.7" = "00v4bm4glv1hy08c8xsm467az6d1ashrznn8p2bmbmmp52lfg7ag";
+    "0.10.0" = "1kxi5bmjwi5zqlqgkyzhhxwgcih7wf60cyw9398k2qjkmi186r4a";
+    "0.10.1" = "0r1vspad8fb8bry3zliiz4hfj4w1iib1l2gm115a94m6zbiksd95";
+    "0.10.2" = "1b150rc5bmz9l518r4m3vwcrcnnkkn9q5lrwygkh0a7mckgg2k9f";
+    "0.10.3" = "0795gs2dlr663z826mp63c8h2zfadn541dr8q0fvnvi2z7kfyslb";
+    "0.11.1" = "0dmf1p9j8lm0hwaq0af18jxdwg869xi2jm8447zng7krrq3kvkg5";
+    "0.11.2" = "0iyka81g26x5n99xic7kqn8vxqjw8rz7vw9rs27iw04lf137vzv6";
+    "0.11.3" = "1w99nzpk72lffxis97k235axss5lmzhy5z3lga2i0si95mbpil42";
   };
-  param = params.${coq.coq-version};
+
+  default-versions = {
+    "8.5" = "0.9.4";
+    "8.6" = "0.9.5";
+    "8.7" = "0.9.7";
+    "8.8" = "0.11.3";
+    "8.9" = "0.11.3";
+    "8.10" = "0.11.3";
+    "8.11" = "0.11.3";
+    "8.12" = "0.11.3";
+  };
+
+  param = rec {
+    version = args.version or default-versions.${coq.coq-version};
+    sha256 = hashes.${version};
+  };
+
 in
 
 stdenv.mkDerivation rec {
@@ -20,9 +38,9 @@ stdenv.mkDerivation rec {
   inherit (param) version;
 
   src = fetchFromGitHub {
-    owner = "coq-ext-lib";
+    owner = "coq-community";
     repo = "coq-ext-lib";
-    rev = "v${param.version}";
+    rev = "v${version}";
     inherit (param) sha256;
   };
 
@@ -40,6 +58,6 @@ stdenv.mkDerivation rec {
   };
 
   passthru = {
-    compatibleCoqVersions = v: builtins.hasAttr v params;
+    compatibleCoqVersions = v: builtins.hasAttr v default-versions;
   };
 }
diff --git a/third_party/nixpkgs/pkgs/development/guile-modules/guile-cairo/default.nix b/third_party/nixpkgs/pkgs/development/guile-modules/guile-cairo/default.nix
index 000932cc01..8864e014c6 100644
--- a/third_party/nixpkgs/pkgs/development/guile-modules/guile-cairo/default.nix
+++ b/third_party/nixpkgs/pkgs/development/guile-modules/guile-cairo/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "guile-cairo";
-  version = "1.11.1";
+  version = "1.11.2";
 
   src = fetchurl {
     url = "mirror://savannah/guile-cairo/${pname}-${version}.tar.gz";
-    sha256 = "1gc642r9ndsjhhmh9bl5cbd3dwvy4dpxwhr0zpsw43y9nmz37xpl";
+    sha256 = "0yx0844p61ljd4d3d63qrawiygiw6ks02fwv2cqx7nav5kfd8ck2";
   };
 
   nativeBuildInputs = [ pkgconfig ];
diff --git a/third_party/nixpkgs/pkgs/development/interpreters/dhall/build-dhall-directory-package.nix b/third_party/nixpkgs/pkgs/development/interpreters/dhall/build-dhall-directory-package.nix
index 0c182b25d5..7fe1b46e3a 100644
--- a/third_party/nixpkgs/pkgs/development/interpreters/dhall/build-dhall-directory-package.nix
+++ b/third_party/nixpkgs/pkgs/development/interpreters/dhall/build-dhall-directory-package.nix
@@ -14,12 +14,17 @@ lib.makePackageOverridable
     , src
     , # The file to import, relative to the root directory
       file ? "package.dhall"
+      # Set to `true` to generate documentation for the package
+    , document ? false
     }:
 
-    buildDhallPackage {
-      inherit name dependencies source;
+    buildDhallPackage
+      ( { inherit name dependencies source;
 
-      code = "${src}/${file}";
-    }
+          code = "${src}/${file}";
+
+        }
+      // lib.optionalAttrs document { documentationRoot = src; }
+      )
   )
 
diff --git a/third_party/nixpkgs/pkgs/development/interpreters/dhall/build-dhall-github-package.nix b/third_party/nixpkgs/pkgs/development/interpreters/dhall/build-dhall-github-package.nix
index bdb958fb8b..0978e47754 100644
--- a/third_party/nixpkgs/pkgs/development/interpreters/dhall/build-dhall-github-package.nix
+++ b/third_party/nixpkgs/pkgs/development/interpreters/dhall/build-dhall-github-package.nix
@@ -12,6 +12,8 @@ lib.makePackageOverridable
       directory ? ""
     , # The file to import, relative to the above directory
       file ? "package.dhall"
+      # Set to `true` to generate documentation for the package
+    , document ? false
 
       # Arguments passed through to `fetchFromGitHub`
     , owner
@@ -22,29 +24,32 @@ lib.makePackageOverridable
     , ...
     }@args:
 
-    buildDhallPackage {
-      inherit name dependencies source;
+    let
+      src = fetchFromGitHub ({
+        name = "${name}-source";
 
-      code =
-        let
-          src = fetchFromGitHub ({
-            name = "${name}-source";
+        inherit owner repo rev;
+      } // removeAttrs args [
+        "name"
+        "dependencies"
+        "document"
+        "source"
+        "directory"
+        "file"
+        "owner"
+        "repo"
+        "rev"
+      ]);
 
-            inherit owner repo rev;
-          } // removeAttrs args [
-            "name"
-            "dependencies"
-            "source"
-            "directory"
-            "file"
-            "owner"
-            "repo"
-            "rev"
-          ]);
+      prefix = lib.optionalString (directory != "") "${directory}/";
 
-          prefix = lib.optionalString (directory != "") "${directory}/";
+    in
+      buildDhallPackage
+        ( { inherit name dependencies source;
 
-        in
-          "${src}/${prefix}${file}";
-    }
+            code = "${src}/${prefix}${file}";
+          }
+        // lib.optionalAttrs document
+          { documentationRoot = "${src}/${prefix}"; }
+        )
   )
diff --git a/third_party/nixpkgs/pkgs/development/interpreters/dhall/build-dhall-package.nix b/third_party/nixpkgs/pkgs/development/interpreters/dhall/build-dhall-package.nix
index 9303244eb8..039c50f069 100644
--- a/third_party/nixpkgs/pkgs/development/interpreters/dhall/build-dhall-package.nix
+++ b/third_party/nixpkgs/pkgs/development/interpreters/dhall/build-dhall-package.nix
@@ -1,4 +1,4 @@
-{ dhall, haskell, lib, lndir, runCommand, writeText }:
+{ dhall, dhall-docs, haskell, lib, lndir, runCommand, writeText }:
 
 { name
 
@@ -31,6 +31,12 @@
   # space within the Nix store, but if you set the following `source` option to
   # `true` then the package will also include `source.dhall`.
 , source ? false
+
+  # Directory to generate documentation for (i.e. as the `--input` option to the
+  # `dhall-docs` command.)
+  #
+  # If `null`, then no documentation is generated.
+, documentationRoot ? null
 }:
 
 let
@@ -42,8 +48,12 @@ let
 
   cache = ".cache";
 
+  data = ".local/share";
+
   cacheDhall = "${cache}/dhall";
 
+  dataDhall = "${data}/dhall";
+
   sourceFile = "source.dhall";
 
 in
@@ -71,4 +81,10 @@ in
     echo "missing $SHA_HASH" > $out/binary.dhall
 
     ${lib.optionalString (!source) "rm $out/${sourceFile}"}
+
+    ${lib.optionalString (documentationRoot != null) ''
+    mkdir -p $out/${dataDhall}
+
+    XDG_DATA_HOME=$out/${data} ${dhall-docs}/bin/dhall-docs --input '${documentationRoot}' --output-link $out/docs
+    ''}
   ''
diff --git a/third_party/nixpkgs/pkgs/development/interpreters/icon-lang/default.nix b/third_party/nixpkgs/pkgs/development/interpreters/icon-lang/default.nix
index 8190dc0f29..02992e7187 100644
--- a/third_party/nixpkgs/pkgs/development/interpreters/icon-lang/default.nix
+++ b/third_party/nixpkgs/pkgs/development/interpreters/icon-lang/default.nix
@@ -1,32 +1,41 @@
-{ stdenv, fetchFromGitHub
-, libX11, libXt
+{ stdenv
+, fetchFromGitHub
+, libX11
+, libXt
 , withGraphics ? true
 }:
 
 stdenv.mkDerivation rec {
   pname = "icon-lang";
-  version = "9.5.20i";
-
+  version = "unstable-2020-02-05";
   src = fetchFromGitHub {
     owner = "gtownsend";
     repo = "icon";
-    rev = "v${version}";
-    sha256 = "0072b3jk8mc94w818z8bklhjdf9rf0d9a7lkvw40pz3niy7zv84s";
+    rev = "829cff33de4a21546fb269de3ef5acd7b4f0c0c7";
+    sha256 = "1lj2f13pbaajcy4v3744bz46rghhw5sv4dwwfnzhsllbj5gnjsv2";
   };
 
   buildInputs = stdenv.lib.optionals withGraphics [ libX11 libXt ];
 
-  configurePhase = let
-    target = if withGraphics then "X-Configure" else "Configure";
-    platform = if stdenv.isLinux  then "linux"
-          else if stdenv.isDarwin then "macintosh"
-          else if stdenv.isBSD    then "bsd"
-          else if stdenv.isCygwin then "cygwin"
-          else if stdenv.isSunOS  then "solaris"
-          else throw "unsupported system";
-  in "make ${target} name=${platform}";
+  configurePhase =
+    let
+      target = if withGraphics then "X-Configure" else "Configure";
+      platform =
+        if stdenv.isLinux then "linux"
+        else if stdenv.isDarwin then "macintosh"
+        else if stdenv.isBSD then "bsd"
+        else if stdenv.isCygwin then "cygwin"
+        else if stdenv.isSunOS then "solaris"
+        else throw "unsupported system";
+    in
+    "make ${target} name=${platform}";
 
-  installPhase = "make Install dest=$out";
+  installPhase = ''
+    make Install dest=$out
+    rm $out/README
+    mkdir -p $out/share/doc
+    mv $out/doc $out/share/doc/icon
+  '';
 
   meta = with stdenv.lib; {
     description = ''A very high level general-purpose programming language'';
diff --git a/third_party/nixpkgs/pkgs/development/interpreters/octave/default.nix b/third_party/nixpkgs/pkgs/development/interpreters/octave/default.nix
index d976610859..841f89b97f 100644
--- a/third_party/nixpkgs/pkgs/development/interpreters/octave/default.nix
+++ b/third_party/nixpkgs/pkgs/development/interpreters/octave/default.nix
@@ -59,12 +59,12 @@
 assert (!blas.isILP64) && (!lapack.isILP64);
 
 mkDerivation rec {
-  version = "5.2.0";
+  version = "6.1.0";
   pname = "octave";
 
   src = fetchurl {
     url = "mirror://gnu/octave/${pname}-${version}.tar.gz";
-    sha256 = "1qcmcpsq1lfka19fxzvxjwjhg113c39a9a0x8plkhvwdqyrn5sig";
+    sha256 = "0mqa1g3fq0q45mqc0didr8vl6bk7jzj6gjsf1522qqjq2r04xwvg";
   };
 
   buildInputs = [
diff --git a/third_party/nixpkgs/pkgs/development/interpreters/php/8.0.nix b/third_party/nixpkgs/pkgs/development/interpreters/php/8.0.nix
new file mode 100644
index 0000000000..ded661e558
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/development/interpreters/php/8.0.nix
@@ -0,0 +1,17 @@
+{ callPackage, lib, stdenv, nixosTests, ... }@_args:
+
+let
+  generic = (import ./generic.nix) _args;
+
+  base = callPackage generic (_args // {
+    version = "8.0.0";
+    sha256 = "02cx3gvxqvkllp54jfvs83kl8bmpcqyzp9jf1d0l9x5bgv1jv0sy";
+  });
+
+in base.withExtensions ({ all, ... }: with all; ([
+  bcmath calendar curl ctype dom exif fileinfo filter ftp gd
+  gettext gmp iconv intl ldap mbstring mysqli mysqlnd opcache
+  openssl pcntl pdo pdo_mysql pdo_odbc pdo_pgsql pdo_sqlite pgsql
+  posix readline session simplexml sockets soap sodium sqlite3
+  tokenizer xmlreader xmlwriter zip zlib
+] ++ lib.optionals (!stdenv.isDarwin) [ imap ]))
diff --git a/third_party/nixpkgs/pkgs/development/interpreters/php/fix-opcache-configure.patch b/third_party/nixpkgs/pkgs/development/interpreters/php/fix-opcache-configure.patch
new file mode 100644
index 0000000000..e67d2cc7bc
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/development/interpreters/php/fix-opcache-configure.patch
@@ -0,0 +1,81 @@
+diff --git a/Zend/Zend.m4 b/Zend/Zend.m4
+index 726188597496..781e51d3e44c 100644
+--- a/Zend/Zend.m4
++++ b/Zend/Zend.m4
+@@ -190,12 +190,6 @@ dnl LIBZEND_OTHER_CHECKS
+ dnl
+ AC_DEFUN([LIBZEND_OTHER_CHECKS],[
+ 
+-AC_ARG_ENABLE([zts],
+-  [AS_HELP_STRING([--enable-zts],
+-    [Enable thread safety])],
+-  [ZEND_ZTS=$enableval],
+-  [ZEND_ZTS=no])
+-
+ AC_MSG_CHECKING(whether to enable thread-safety)
+ AC_MSG_RESULT($ZEND_ZTS)
+ 
+diff --git a/configure.ac b/configure.ac
+index 8d6e922fa9bf..e07a75d19ac7 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -797,6 +797,19 @@ if test "$PHP_DEBUG_ASSERTIONS" = "yes"; then
+   ZEND_DEBUG=yes
+ fi
+ 
++AC_ARG_ENABLE([zts],
++  [AS_HELP_STRING([--enable-zts],
++    [Enable thread safety])],
++  [ZEND_ZTS=$enableval],
++  [ZEND_ZTS=no])
++
++if test "$ZEND_ZTS" = "yes"; then
++  AC_DEFINE(ZTS, 1,[ ])
++  PHP_THREAD_SAFETY=yes
++else
++  PHP_THREAD_SAFETY=no
++fi
++
+ PHP_ARG_ENABLE([rtld-now],
+   [whether to dlopen extensions with RTLD_NOW instead of RTLD_LAZY],
+   [AS_HELP_STRING([--enable-rtld-now],
+@@ -1136,13 +1149,6 @@ LIBZEND_BASIC_CHECKS
+ LIBZEND_DLSYM_CHECK
+ LIBZEND_OTHER_CHECKS
+ 
+-if test "$ZEND_ZTS" = "yes"; then
+-  AC_DEFINE(ZTS,1,[ ])
+-  PHP_THREAD_SAFETY=yes
+-else
+-  PHP_THREAD_SAFETY=no
+-fi
+-
+ INCLUDES="$INCLUDES -I\$(top_builddir)/TSRM"
+ INCLUDES="$INCLUDES -I\$(top_builddir)/Zend"
+ 
+diff --git a/ext/opcache/config.m4 b/ext/opcache/config.m4
+index 054cd28c0247..93d72fb73d19 100644
+--- a/ext/opcache/config.m4
++++ b/ext/opcache/config.m4
+@@ -66,7 +66,7 @@ if test "$PHP_OPCACHE" != "no"; then
+       esac
+     fi
+ 
+-    if test "$enable_zts" = "yes"; then
++    if test "$PHP_THREAD_SAFETY" = "yes"; then
+       DASM_FLAGS="$DASM_FLAGS -D ZTS=1"
+     fi
+ 
+diff --git a/ext/session/config.m4 b/ext/session/config.m4
+index 7abc8813b72a..da31bbde86cc 100644
+--- a/ext/session/config.m4
++++ b/ext/session/config.m4
+@@ -31,7 +31,7 @@ if test "$PHP_MM" != "no"; then
+     AC_MSG_ERROR(cannot find mm library)
+   fi
+ 
+-  if test "$enable_zts" = "yes"; then
++  if test "$PHP_THREAD_SAFETY" = "yes"; then
+     dnl The mm library is not thread-safe, and mod_mm.c refuses to compile.
+     AC_MSG_ERROR(--with-mm cannot be combined with --enable-zts)
+   fi
\ No newline at end of file
diff --git a/third_party/nixpkgs/pkgs/development/interpreters/php/generic.nix b/third_party/nixpkgs/pkgs/development/interpreters/php/generic.nix
index 6f0f5c4012..4a96abcf9b 100644
--- a/third_party/nixpkgs/pkgs/development/interpreters/php/generic.nix
+++ b/third_party/nixpkgs/pkgs/development/interpreters/php/generic.nix
@@ -198,7 +198,8 @@ let
             ++ lib.optional (!ipv6Support) "--disable-ipv6"
             ++ lib.optional systemdSupport "--with-fpm-systemd"
             ++ lib.optional valgrindSupport "--with-valgrind=${valgrind.dev}"
-            ++ lib.optional ztsSupport "--enable-maintainer-zts"
+            ++ lib.optional (ztsSupport && (lib.versionOlder version "8.0")) "--enable-maintainer-zts"
+            ++ lib.optional (ztsSupport && (lib.versionAtLeast version "8.0")) "--enable-zts"
 
 
             # Sendmail
diff --git a/third_party/nixpkgs/pkgs/development/interpreters/python/default.nix b/third_party/nixpkgs/pkgs/development/interpreters/python/default.nix
index 2f35073823..7c3f94dcd1 100644
--- a/third_party/nixpkgs/pkgs/development/interpreters/python/default.nix
+++ b/third_party/nixpkgs/pkgs/development/interpreters/python/default.nix
@@ -102,7 +102,7 @@ with pkgs;
         inherit hasDistutilsCxxPatch;
         # TODO: rename to pythonOnBuild
         # Not done immediately because its likely used outside Nixpkgs.
-        pythonForBuild = pythonOnBuildForHost;
+        pythonForBuild = pythonOnBuildForHost.override { inherit packageOverrides; self = pythonForBuild; };
 
         tests = callPackage ./tests.nix {
           python = self;
diff --git a/third_party/nixpkgs/pkgs/development/interpreters/python/hooks/default.nix b/third_party/nixpkgs/pkgs/development/interpreters/python/hooks/default.nix
index 456aea4c5d..1a64c79232 100644
--- a/third_party/nixpkgs/pkgs/development/interpreters/python/hooks/default.nix
+++ b/third_party/nixpkgs/pkgs/development/interpreters/python/hooks/default.nix
@@ -5,6 +5,7 @@
 , disabledIf
 , isPy3k
 , ensureNewerSourcesForZipFilesHook
+, findutils
 }:
 
 let
@@ -94,7 +95,7 @@ in rec {
     makeSetupHook {
       name = "python-namespaces-hook.sh";
       substitutions = {
-        inherit pythonSitePackages;
+        inherit pythonSitePackages findutils;
       };
     } ./python-namespaces-hook.sh) {};
 
diff --git a/third_party/nixpkgs/pkgs/development/interpreters/python/hooks/pip-install-hook.sh b/third_party/nixpkgs/pkgs/development/interpreters/python/hooks/pip-install-hook.sh
index 4eefe22d3f..c15b99adef 100644
--- a/third_party/nixpkgs/pkgs/development/interpreters/python/hooks/pip-install-hook.sh
+++ b/third_party/nixpkgs/pkgs/development/interpreters/python/hooks/pip-install-hook.sh
@@ -11,7 +11,7 @@ pipInstallPhase() {
     export PYTHONPATH="$out/@pythonSitePackages@:$PYTHONPATH"
 
     pushd dist || return 1
-    @pythonInterpreter@ -m pip install ./*.whl --no-index --prefix="$out" --no-cache $pipInstallFlags --build tmpbuild
+    @pythonInterpreter@ -m pip install ./*.whl --no-index --no-warn-script-location --prefix="$out" --no-cache $pipInstallFlags --build tmpbuild
     popd || return 1
 
     runHook postInstall
diff --git a/third_party/nixpkgs/pkgs/development/interpreters/python/hooks/python-namespaces-hook.sh b/third_party/nixpkgs/pkgs/development/interpreters/python/hooks/python-namespaces-hook.sh
index 50f21819d1..15d2bd0eb3 100644
--- a/third_party/nixpkgs/pkgs/development/interpreters/python/hooks/python-namespaces-hook.sh
+++ b/third_party/nixpkgs/pkgs/development/interpreters/python/hooks/python-namespaces-hook.sh
@@ -17,16 +17,17 @@ pythonNamespacesHook() {
         for pathSegment in ${pathSegments[@]}; do
             constructedPath=${constructedPath}/${pathSegment}
             pathToRemove=${constructedPath}/__init__.py
-            pycachePath=${constructedPath}/__pycache__/__init__*
+            pycachePath=${constructedPath}/__pycache__/
 
+            # remove __init__.py
             if [ -f "$pathToRemove" ]; then
-                echo "Removing $pathToRemove"
-                rm "$pathToRemove"
+                rm -v "$pathToRemove"
             fi
 
-            if [ -f "$pycachePath" ]; then
-                echo "Removing $pycachePath"
-                rm "$pycachePath"
+            # remove __pycache__/ entry, can be interpreter specific. E.g. __init__.cpython-38.pyc
+            # use null characters to perserve potential whitespace in filepath
+            if [ -d "$pycachePath" ]; then
+                @findutils@/bin/find "$pycachePath" -name '__init__*' -exec rm -v "{}" +
             fi
         done
     done
diff --git a/third_party/nixpkgs/pkgs/development/interpreters/python/mk-python-derivation.nix b/third_party/nixpkgs/pkgs/development/interpreters/python/mk-python-derivation.nix
index c85a593905..670c870f10 100644
--- a/third_party/nixpkgs/pkgs/development/interpreters/python/mk-python-derivation.nix
+++ b/third_party/nixpkgs/pkgs/development/interpreters/python/mk-python-derivation.nix
@@ -53,7 +53,9 @@
 , disabled ? false
 
 # Raise an error if two packages are installed with the same name
-, catchConflicts ? true
+# TODO: For cross we probably need a different PYTHONPATH, or not
+# add the runtime deps until after buildPhase.
+, catchConflicts ? (python.stdenv.hostPlatform == python.stdenv.buildPlatform)
 
 # Additional arguments to pass to the makeWrapper function, which wraps
 # generated binaries.
diff --git a/third_party/nixpkgs/pkgs/development/interpreters/python/tests.nix b/third_party/nixpkgs/pkgs/development/interpreters/python/tests.nix
index dcfa41cc30..a291919b32 100644
--- a/third_party/nixpkgs/pkgs/development/interpreters/python/tests.nix
+++ b/third_party/nixpkgs/pkgs/development/interpreters/python/tests.nix
@@ -1,4 +1,5 @@
-{ python
+{ stdenv
+, python
 , runCommand
 , substituteAll
 , lib
@@ -92,4 +93,4 @@ let
 
 
 
-in environmentTests // integrationTests
+in stdenv.lib.optionalAttrs (stdenv.hostPlatform == stdenv.buildPlatform ) (environmentTests // integrationTests)
diff --git a/third_party/nixpkgs/pkgs/development/libraries/aml/default.nix b/third_party/nixpkgs/pkgs/development/libraries/aml/default.nix
index 0b753618ba..37d8859ba5 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/aml/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/aml/default.nix
@@ -19,5 +19,6 @@ stdenv.mkDerivation rec {
     license = licenses.isc;
     platforms = platforms.unix;
     maintainers = with maintainers; [ primeos ];
+    broken = stdenv.isDarwin;
   };
 }
diff --git a/third_party/nixpkgs/pkgs/development/libraries/appstream/default.nix b/third_party/nixpkgs/pkgs/development/libraries/appstream/default.nix
index 45f27b38a6..820e738324 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/appstream/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/appstream/default.nix
@@ -6,7 +6,7 @@
 
 stdenv.mkDerivation rec {
   pname = "appstream";
-  version = "0.12.11";
+  version = "0.13.1";
 
   outputs = [ "out" "dev" ];
 
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
     owner  = "ximion";
     repo   = "appstream";
     rev    = "v${version}";
-    sha256 = "sha256-bCDyMwQdn9Csxs2hy4dm+LjtxK4+YBK6yDkAdhu1QVU=";
+    sha256 = "16nxaw4fx78maldi3kvr8fiwzhmy5276wd4x2fxny16zzf01098j";
   };
 
   nativeBuildInputs = [
diff --git a/third_party/nixpkgs/pkgs/development/libraries/avahi/default.nix b/third_party/nixpkgs/pkgs/development/libraries/avahi/default.nix
index 3f36b87af7..a560cc39d1 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/avahi/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/avahi/default.nix
@@ -1,8 +1,10 @@
 { fetchurl, fetchpatch, stdenv, pkgconfig, libdaemon, dbus, perlPackages
-, expat, gettext, intltool, glib, libiconv, writeShellScriptBin
+, expat, gettext, intltool, glib, libiconv, writeShellScriptBin, libevent
 , gtk3Support ? false, gtk3 ? null
 , qt4 ? null
 , qt4Support ? false
+, qt5 ? null
+, qt5Support ? false
 , withLibdnssdCompat ? false
 , python ? null
 , withPython ? false }:
@@ -16,11 +18,11 @@ in
 
 stdenv.mkDerivation rec {
   name = "avahi${stdenv.lib.optionalString withLibdnssdCompat "-compat"}-${version}";
-  version = "0.7";
+  version = "0.8";
 
   src = fetchurl {
     url = "https://github.com/lathiat/avahi/releases/download/v${version}/avahi-${version}.tar.gz";
-    sha256 = "0128n7jlshw4bpx0vg8lwj8qwdisjxi7mvniwfafgnkzzrfrpaap";
+    sha256 = "1npdixwxxn3s9q1f365x9n9rc5xgfz39hxf23faqvlrklgbhj0q6";
   };
 
   prePatch = ''
@@ -30,17 +32,13 @@ stdenv.mkDerivation rec {
 
   patches = [
     ./no-mkdir-localstatedir.patch
-    (fetchpatch {
-      name ="CVE-2017-6519-CVE-2018-100084.patch";
-      url = "https://github.com/lathiat/avahi/commit/e111def44a7df4624a4aa3f85fe98054bffb6b4f.patch";
-      sha256 = "06n7b7kz6xcc35c7xjfc1kj3k2llyjgi09nhy0ci32l1bhacjw0q";
-    })
   ];
 
-  buildInputs = [ libdaemon dbus glib expat libiconv ]
+  buildInputs = [ libdaemon dbus glib expat libiconv libevent ]
     ++ (with perlPackages; [ perl XMLParser ])
     ++ (stdenv.lib.optional gtk3Support gtk3)
-    ++ (stdenv.lib.optional qt4Support qt4);
+    ++ (stdenv.lib.optional qt4Support qt4)
+    ++ (stdenv.lib.optional qt5Support qt5);
 
   propagatedBuildInputs =
     stdenv.lib.optionals withPython (with python.pkgs; [ python pygobject3 dbus-python ]);
@@ -52,6 +50,7 @@ stdenv.mkDerivation rec {
       "--disable-gtk" "--with-dbus-sys=${placeholder "out"}/share/dbus-1/system.d"
       (stdenv.lib.enableFeature gtk3Support "gtk3")
       "--${if qt4Support then "enable" else "disable"}-qt4"
+      "--${if qt5Support then "enable" else "disable"}-qt5"
       (stdenv.lib.enableFeature withPython "python")
       "--localstatedir=/var" "--with-distro=none"
       # A systemd unit is provided by the avahi-daemon NixOS module
diff --git a/third_party/nixpkgs/pkgs/development/libraries/bctoolbox/default.nix b/third_party/nixpkgs/pkgs/development/libraries/bctoolbox/default.nix
index 0b20474664..0f99484f5a 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/bctoolbox/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/bctoolbox/default.nix
@@ -7,7 +7,7 @@
 
 stdenv.mkDerivation rec {
   pname = "bctoolbox";
-  version = "4.4.6";
+  version = "4.4.13";
 
   nativeBuildInputs = [ cmake bcunit ];
   buildInputs = [ mbedtls ];
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
     group = "BC";
     repo = pname;
     rev = version;
-    sha256 = "1vlvnpkks5mm6ppdmp88mdn39f3ynig6qas83nkjn7x47z2zr6x0";
+    sha256 = "0bfswwvvdshaahg4jd2j10f0sci8809s4khajd0m6b059zwc7y25";
   };
 
   # Do not build static libraries
diff --git a/third_party/nixpkgs/pkgs/development/libraries/botan/2.0.nix b/third_party/nixpkgs/pkgs/development/libraries/botan/2.0.nix
index 91f7f66473..22ddb76b29 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/botan/2.0.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/botan/2.0.nix
@@ -1,9 +1,9 @@
 { callPackage, ... } @ args:
 
 callPackage ./generic.nix (args // {
-  baseVersion = "2.7";
+  baseVersion = "2.9";
   revision = "0";
-  sha256 = "142aqabwc266jxn8wrp0f1ffrmcvdxwvyh8frb38hx9iaqazjbg4";
+  sha256 = "06fiyalvc68p11qqh953azx2vrbav5vr00yvcfp67p9l4csn8m9h";
   postPatch = ''
     sed -e 's@lang_flags "@&--std=c++11 @' -i src/build-data/cc/{gcc,clang}.txt
   '';
diff --git a/third_party/nixpkgs/pkgs/development/libraries/c-ares/default.nix b/third_party/nixpkgs/pkgs/development/libraries/c-ares/default.nix
index 2751565670..ac0dc43c67 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/c-ares/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/c-ares/default.nix
@@ -7,11 +7,12 @@
 
 let self =
 stdenv.mkDerivation rec {
-  name = "c-ares-1.15.0";
+  pname = "c-ares";
+  version = "1.17.1";
 
   src = fetchurl {
-    url = "https://c-ares.haxx.se/download/${name}.tar.gz";
-    sha256 = "0lk8knip4xk6qzksdkn7085mmgm4ixfczdyyjw656c193y3rgnvc";
+    url = "https://c-ares.haxx.se/download/${pname}-${version}.tar.gz";
+    sha256 = "0h7wjfnk2092glqcp9mqaax7xx0s13m501z1gi0gsjl2vvvd0gfp";
   };
 
   meta = with stdenv.lib; {
diff --git a/third_party/nixpkgs/pkgs/development/libraries/c-blosc/default.nix b/third_party/nixpkgs/pkgs/development/libraries/c-blosc/default.nix
index 8f7cee75e9..20b82df616 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/c-blosc/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/c-blosc/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     sha256 = "0a3yrig78plzjbazfqcfrzqhnw17xd0dcayvp4z4kp415kgs2a3s";
   };
 
-  buildInputs = [ cmake ];
+  nativeBuildInputs = [ cmake ];
 
   enableParallelBuilding = true;
 
diff --git a/third_party/nixpkgs/pkgs/development/libraries/cyrus-sasl/default.nix b/third_party/nixpkgs/pkgs/development/libraries/cyrus-sasl/default.nix
index cd3fa3bb7f..96778e8960 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/cyrus-sasl/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/cyrus-sasl/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     urls =
-      [ "http://www.cyrusimap.org/releases/${pname}-${version}.tar.gz"
+      [ "https://github.com/cyrusimap/${pname}/releases/download/${pname}-${version}/${pname}-${version}.tar.gz"
+        "http://www.cyrusimap.org/releases/${pname}-${version}.tar.gz"
         "http://www.cyrusimap.org/releases/old/${pname}-${version}.tar.gz"
       ];
     sha256 = "1m85zcpgfdhm43cavpdkhb1s2zq1b31472hq1w1gs3xh94anp1i6";
diff --git a/third_party/nixpkgs/pkgs/development/libraries/gdk-pixbuf/default.nix b/third_party/nixpkgs/pkgs/development/libraries/gdk-pixbuf/default.nix
index 9b2fd0b778..2d6fae915f 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/gdk-pixbuf/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/gdk-pixbuf/default.nix
@@ -20,31 +20,23 @@
 , gobject-introspection
 , doCheck ? false
 , makeWrapper
-, fetchpatch
 , lib
 }:
 
 stdenv.mkDerivation rec {
   pname = "gdk-pixbuf";
-  version = "2.40.0";
+  version = "2.42.0";
 
   outputs = [ "out" "dev" "man" "devdoc" "installedTests" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "1rnlx9yfw970maxi2x6niaxmih5la11q1ilr7gzshz2kk585k0hm";
+    sha256 = "1ixfmmamgv67is7snzighfr7c9y2maq3q4a075xdq0d9s4w16i3k";
   };
 
   patches = [
     # Move installed tests to a separate output
     ./installed-tests-path.patch
-
-    # Temporary until the fix is released.
-    (fetchpatch {
-      name = "tests-circular-table.patch";
-      url = "https://gitlab.gnome.org/GNOME/gdk-pixbuf/merge_requests/59.diff";
-      sha256 = "0kaflac3mrh6031hwxk7j9fhli775hc503818h8zfl6b28zyn93f";
-    })
   ];
 
   nativeBuildInputs = [
@@ -71,9 +63,8 @@ stdenv.mkDerivation rec {
   ];
 
   mesonFlags = [
-    "-Ddocs=true"
-    "-Dx11=false" # use gdk-pixbuf-xlib
-    "-Dgir=${lib.boolToString (gobject-introspection != null)}"
+    "-Dgtk_doc=true"
+    "-Dintrospection=${if gobject-introspection != null then "enabled" else "disabled"}"
     "-Dgio_sniffing=false"
   ];
 
@@ -135,7 +126,7 @@ stdenv.mkDerivation rec {
     description = "A library for image loading and manipulation";
     homepage = "https://gitlab.gnome.org/GNOME/gdk-pixbuf";
     maintainers = [ maintainers.eelco ] ++ teams.gnome.members;
-    license = licenses.lgpl21;
+    license = licenses.lgpl21Plus;
     platforms = platforms.unix;
   };
 }
diff --git a/third_party/nixpkgs/pkgs/development/libraries/glib/default.nix b/third_party/nixpkgs/pkgs/development/libraries/glib/default.nix
index 072a12410f..3382af17c3 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/glib/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/glib/default.nix
@@ -45,11 +45,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "glib";
-  version = "2.66.2";
+  version = "2.66.3";
 
   src = fetchurl {
     url = "mirror://gnome/sources/glib/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "1i0pd8y6xz64qlzfj73wxyqp0x7x9j6mwf4gj6ggil4d9vnhnfgc";
+    sha256 = "1cdmyyycw2mf5s0f5sfd59q91223s4smcqi8n2fwrccwm5ji7wvr";
   };
 
   patches = optionals stdenv.isDarwin [
diff --git a/third_party/nixpkgs/pkgs/development/libraries/glibc/common.nix b/third_party/nixpkgs/pkgs/development/libraries/glibc/common.nix
index 3de840d4e3..630b6b8244 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/glibc/common.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/glibc/common.nix
@@ -160,6 +160,10 @@ stdenv.mkDerivation ({
       "libc_cv_as_needed=no"
     ] ++ lib.optional withGd "--with-gd";
 
+  makeFlags = [
+    "OBJCOPY=${stdenv.cc.targetPrefix}objcopy"
+  ];
+
   installFlags = [ "sysconfdir=$(out)/etc" ];
 
   outputs = [ "out" "bin" "dev" "static" ];
diff --git a/third_party/nixpkgs/pkgs/development/libraries/gmp/6.x.nix b/third_party/nixpkgs/pkgs/development/libraries/gmp/6.x.nix
index f4432cfc5b..10e63f733a 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/gmp/6.x.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/gmp/6.x.nix
@@ -11,11 +11,11 @@
 let inherit (stdenv.lib) optional; in
 
 let self = stdenv.mkDerivation rec {
-  name = "gmp-6.2.0";
+  name = "gmp-6.2.1";
 
   src = fetchurl { # we need to use bz2, others aren't in bootstrapping stdenv
     urls = [ "mirror://gnu/gmp/${name}.tar.bz2" "ftp://ftp.gmplib.org/pub/${name}/${name}.tar.bz2" ];
-    sha256 = "1sji8i9yjzfv5l2fsadpgjfyn452q6ab9zvm02k23ssd275rj77m";
+    sha256 = "0z2ddfiwgi0xbf65z4fg4hqqzlhv0cc6hdcswf3c6n21xdmk5sga";
   };
 
   #outputs TODO: split $cxx due to libstdc++ dependency
diff --git a/third_party/nixpkgs/pkgs/development/libraries/gstreamer/bad/default.nix b/third_party/nixpkgs/pkgs/development/libraries/gstreamer/bad/default.nix
index 0863d7d1a3..c5edeb2021 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/gstreamer/bad/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/gstreamer/bad/default.nix
@@ -89,27 +89,17 @@ let
   inherit (stdenv.lib) optional optionals;
 in stdenv.mkDerivation rec {
   pname = "gst-plugins-bad";
-  version = "1.18.0";
+  version = "1.18.1";
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
     url = "${meta.homepage}/src/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "0pqqq5bs9fjwcmbwgsgxs2dx6gznhxs7ii5pmjkslr6xmlfap0pk";
+    sha256 = "1cn18cbqyysrxnrk5bpxdzd5xcws9g2kmm5rbv00cx6rhn69g5f1";
   };
 
   patches = [
     ./fix_pkgconfig_includedir.patch
-    # Fixes srt usage failing with
-    #     Failed to open SRT: failed to set SRTO_LINGER (reason: Operation not supported: Bad parameters)
-    # see https://github.com/Haivision/srt/issues/1374
-    # Remove when https://gitlab.freedesktop.org/gstreamer/gst-plugins-bad/-/commit/84f8dbd932029220ee86154dd85b241911ea3891
-    # is shown as being in a release tag that nixpkgs uses.
-    (fetchpatch {
-      name = "gstreamer-srtobject-typecast-SRTO_LINGER-to-linger.patch";
-      url = "https://gitlab.freedesktop.org/gstreamer/gst-plugins-bad/-/commit/84f8dbd932029220ee86154dd85b241911ea3891.patch";
-      sha256 = "0596lvgi93sj3yn98grgmsrhnqhhq7fnjk91qi4xc6618fpqmp9x";
-    })
   ];
 
   nativeBuildInputs = [
diff --git a/third_party/nixpkgs/pkgs/development/libraries/gstreamer/base/default.nix b/third_party/nixpkgs/pkgs/development/libraries/gstreamer/base/default.nix
index db964c5c43..da3434a77c 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/gstreamer/base/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/gstreamer/base/default.nix
@@ -40,13 +40,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gst-plugins-base";
-  version = "1.18.0";
+  version = "1.18.1";
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
     url = "${meta.homepage}/src/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "15vqvcy842vhbic3w7l4yvannzazdgwggzv2x8f9m02hm78vsakn";
+    sha256 = "0hf66sh8d4x2ksfnvaq2rqrrfq0vi0pv6wbh9i5jixrhvvbm99hv";
   };
 
   patches = [
diff --git a/third_party/nixpkgs/pkgs/development/libraries/gstreamer/core/default.nix b/third_party/nixpkgs/pkgs/development/libraries/gstreamer/core/default.nix
index be4d19f8d0..3ea0bd8903 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/gstreamer/core/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/gstreamer/core/default.nix
@@ -21,7 +21,7 @@
 
 stdenv.mkDerivation rec {
   pname = "gstreamer";
-  version = "1.18.0";
+  version = "1.18.1";
 
   outputs = [
     "out"
@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "${meta.homepage}/src/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "01bq1k0gj603zyhq975zl09q4zla12mxqvhmk9fyn2kcn12r5w0g";
+    sha256 = "1fpcpsw740svvdxvvwn0hly5i72miizm4s0mbid10ji83zi8vpvr";
   };
 
   patches = [
diff --git a/third_party/nixpkgs/pkgs/development/libraries/gstreamer/devtools/default.nix b/third_party/nixpkgs/pkgs/development/libraries/gstreamer/devtools/default.nix
index f865b3adf2..fe4c7005f6 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/gstreamer/devtools/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/gstreamer/devtools/default.nix
@@ -12,11 +12,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gst-devtools";
-  version = "1.18.0";
+  version = "1.18.1";
 
   src = fetchurl {
     url = "${meta.homepage}/src/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "05jzjkkdr5hg01mjihlqdcxqnjfrm4mqk0zp83212kv5nm0p2cw2";
+    sha256 = "1pxhg8n5nl34baq6mb07i27b33gaw47zrv5yalyj6f12pnx148ki";
   };
 
   patches = [
diff --git a/third_party/nixpkgs/pkgs/development/libraries/gstreamer/ges/default.nix b/third_party/nixpkgs/pkgs/development/libraries/gstreamer/ges/default.nix
index ae217c4282..075b2059db 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/gstreamer/ges/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/gstreamer/ges/default.nix
@@ -16,7 +16,7 @@
 
 stdenv.mkDerivation rec {
   pname = "gst-editing-services";
-  version = "1.18.0";
+  version = "1.18.1";
 
   outputs = [
     "out"
@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "${meta.homepage}/src/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "1a00f07v0yjqz1hydhgkjjarm4rk99yjicbz5wkfl5alhzag1bjd";
+    sha256 = "09rr5a198p1r9wcbsjl01xg6idkfkgj5h9x7xxywarb5i7qv6g79";
   };
 
   patches = [
diff --git a/third_party/nixpkgs/pkgs/development/libraries/gstreamer/good/default.nix b/third_party/nixpkgs/pkgs/development/libraries/gstreamer/good/default.nix
index e8c885411b..bcae19217e 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/gstreamer/good/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/gstreamer/good/default.nix
@@ -49,13 +49,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "gst-plugins-good";
-  version = "1.18.0";
+  version = "1.18.1";
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
     url = "${meta.homepage}/src/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "1b4b3a6fm2wyqpnx300pg1sz01m9qhfajadk3b7sbzisg8vvqab3";
+    sha256 = "0v329xi4qhlfh9aksfyviryqk9lclm4wj1lxrjnbdv4haldfj472";
   };
 
   nativeBuildInputs = [
diff --git a/third_party/nixpkgs/pkgs/development/libraries/gstreamer/libav/default.nix b/third_party/nixpkgs/pkgs/development/libraries/gstreamer/libav/default.nix
index 648ee8bab3..2763524739 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/gstreamer/libav/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/gstreamer/libav/default.nix
@@ -15,11 +15,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gst-libav";
-  version = "1.18.0";
+  version = "1.18.1";
 
   src = fetchurl {
     url = "${meta.homepage}/src/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "0sm0sfdlalimpkf7a7rk7whvyvmmfi2kly2z3q2j5z53x5f3zya2";
+    sha256 = "1n1fkkbxxsndblnbm0c2ziqp967hrz5gag6z36xbpvqk4sy1g9rr";
   };
 
   outputs = [ "out" "dev" ];
diff --git a/third_party/nixpkgs/pkgs/development/libraries/gstreamer/rtsp-server/default.nix b/third_party/nixpkgs/pkgs/development/libraries/gstreamer/rtsp-server/default.nix
index e1ee9222cc..87aca8a7cf 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/gstreamer/rtsp-server/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/gstreamer/rtsp-server/default.nix
@@ -12,11 +12,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gst-rtsp-server";
-  version = "1.18.0";
+  version = "1.18.1";
 
   src = fetchurl {
     url = "${meta.homepage}/src/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "03y7nyjaagis7mmg8vbhxmnc1v9xf2y3cab2s3q2vgsc0l8r7l9a";
+    sha256 = "0m7p7sarvi6n9pz0rrl9k3gp3l5s42qs8z0165kyd6fiqdjjia0h";
   };
 
   outputs = [
diff --git a/third_party/nixpkgs/pkgs/development/libraries/gstreamer/ugly/default.nix b/third_party/nixpkgs/pkgs/development/libraries/gstreamer/ugly/default.nix
index ae1e2dd1b3..ab922f9880 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/gstreamer/ugly/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/gstreamer/ugly/default.nix
@@ -21,13 +21,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gst-plugins-ugly";
-  version = "1.18.0";
+  version = "1.18.1";
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
     url = "${meta.homepage}/src/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "10p0nyzighvkciaspxnhlr7d7n4acrv96lf483i8l988bvj48rk8";
+    sha256 = "09gpbykjchw3lb51ipxj53fy238gr9mg9jybcg5135pb56w6rk8q";
   };
 
   nativeBuildInputs = [
diff --git a/third_party/nixpkgs/pkgs/development/libraries/gstreamer/vaapi/default.nix b/third_party/nixpkgs/pkgs/development/libraries/gstreamer/vaapi/default.nix
index 1b2efa630b..a1a6223798 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/gstreamer/vaapi/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/gstreamer/vaapi/default.nix
@@ -21,11 +21,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gstreamer-vaapi";
-  version = "1.18.0";
+  version = "1.18.1";
 
   src = fetchurl {
     url = "${meta.homepage}/src/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "0ccyzv15jzf0pi0ndrmfww016cn4c0y4265bacdvnxbgff6fpvy6";
+    sha256 = "1sm6x2qa7ng78w0w8q4mjs7pbpbbk8qkfgzhdmbb8l0bh513q3a0";
   };
 
   outputs = [
diff --git a/third_party/nixpkgs/pkgs/development/libraries/gtk-layer-shell/default.nix b/third_party/nixpkgs/pkgs/development/libraries/gtk-layer-shell/default.nix
index 086f6472ee..87f9698bec 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/gtk-layer-shell/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/gtk-layer-shell/default.nix
@@ -13,7 +13,7 @@
 
 stdenv.mkDerivation rec {
   pname = "gtk-layer-shell";
-  version = "0.3.0";
+  version = "0.5.1";
 
   outputs = [ "out" "dev" "devdoc" ];
 
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
     owner = "wmww";
     repo = "gtk-layer-shell";
     rev = "v${version}";
-    sha256 = "1f7hfwik7a9kzw0q1k3xc1yisrgg8lbp5pjr337phc9hm38lhq3c";
+    sha256 = "1yfqfv3hn92cy9y5zgvz7qhq2ypill2z5857ki5snjimhjdz0cnw";
   };
 
   nativeBuildInputs = [
diff --git a/third_party/nixpkgs/pkgs/development/libraries/intel-media-driver/default.nix b/third_party/nixpkgs/pkgs/development/libraries/intel-media-driver/default.nix
index 4130d8cf8b..43dbe67656 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/intel-media-driver/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/intel-media-driver/default.nix
@@ -5,13 +5,13 @@
 
 stdenv.mkDerivation rec {
   pname = "intel-media-driver";
-  version = "20.4.1";
+  version = "20.4.2";
 
   src = fetchFromGitHub {
     owner  = "intel";
     repo   = "media-driver";
     rev    = "intel-media-${version}";
-    sha256 = "1axklxzv85flhv41s8nmp7m4kswnav6qpg8w9przac9ji07rknwl";
+    sha256 = "1nz0f2chfm3rr8aggb7md0cmikwpd9159ql1rc59208nvl2fshrb";
   };
 
   cmakeFlags = [
diff --git a/third_party/nixpkgs/pkgs/development/libraries/libamqpcpp/default.nix b/third_party/nixpkgs/pkgs/development/libraries/libamqpcpp/default.nix
index b074cba5c8..eca7170bff 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/libamqpcpp/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/libamqpcpp/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libamqpcpp";
-  version = "4.3.8";
+  version = "4.3.10";
 
   src = fetchFromGitHub {
     owner = "CopernicaMarketingSoftware";
     repo = "AMQP-CPP";
     rev = "v${version}";
-    sha256 = "1cgpk1v8wgsdyl2gx1bk1nrqflc17ciy0wdg3rgzgy0avl4yghww";
+    sha256 = "0yy6sq4rvv9c0f09vljnqx92zvr39bn1spl735hzn6253d7fm3a5";
   };
 
   buildInputs = [ openssl ];
diff --git a/third_party/nixpkgs/pkgs/development/libraries/libcork/default.nix b/third_party/nixpkgs/pkgs/development/libraries/libcork/default.nix
new file mode 100644
index 0000000000..3875ff9118
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/development/libraries/libcork/default.nix
@@ -0,0 +1,45 @@
+{ stdenv
+, fetchFromGitHub
+, cmake
+, lib
+, pkg-config
+, check
+}:
+stdenv.mkDerivation rec {
+  pname = "libcork";
+  version = "1.0.0--rc3";
+
+  src = fetchFromGitHub {
+    owner = "dcreager";
+    repo = pname;
+    rev = version;
+    sha256 = "152gqnmr6wfmflf5l6447am4clmg3p69pvy3iw7yhaawjqa797sk";
+  };
+
+  # N.B. We need to create this file, otherwise it tries to use git to
+  # determine the package version, which we do not want.
+  #
+  # N.B. We disable tests by force, since their build is broken.
+  postPatch = ''
+    echo "${version}" > .version-stamp
+    echo "${version}" > .commit-stamp
+    sed -i '/add_subdirectory(tests)/d' ./CMakeLists.txt
+  '';
+
+  nativeBuildInputs = [ cmake pkg-config ];
+  buildInputs = [ check ];
+
+  doCheck = false;
+
+  postInstall = ''
+    ln -s $out/lib/libcork.so $out/lib/libcork.so.1
+  '';
+
+  meta = with lib; {
+    homepage = "https://github.com/dcreager/libcork";
+    description = "A simple, easily embeddable cross-platform C library";
+    license = licenses.bsd3;
+    platforms = platforms.unix;
+    maintainers = with maintainers; [ lovesegfault ];
+  };
+}
diff --git a/third_party/nixpkgs/pkgs/development/libraries/libdevil/default.nix b/third_party/nixpkgs/pkgs/development/libraries/libdevil/default.nix
index 132e1d1dbf..5d00d6b01f 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/libdevil/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/libdevil/default.nix
@@ -33,7 +33,7 @@ stdenv.mkDerivation rec {
 
   patches =
     [ ( fetchurl {
-        url = "http://patch-tracker.debian.org/patch/series/dl/devil/1.7.8-6.1/03_CVE-2009-3994.diff";
+        url = "https://sources.debian.org/data/main/d/devil/1.7.8-10/debian/patches/03_CVE-2009-3994.diff";
         sha256 = "0qkx2qfv02igbrmsn6z5a3lbrbwjfh3rb0c2sj54wy0j1f775hbc";
       } )
       ./ftbfs-libpng15.patch
diff --git a/third_party/nixpkgs/pkgs/development/libraries/libdrm/default.nix b/third_party/nixpkgs/pkgs/development/libraries/libdrm/default.nix
index 328c85830f..b9825d9cfd 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/libdrm/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/libdrm/default.nix
@@ -4,11 +4,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libdrm";
-  version = "2.4.102";
+  version = "2.4.103";
 
   src = fetchurl {
     url = "https://dri.freedesktop.org/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "0nx0bd9dhymdsd99v4ifib77yjirkvkxf5hzdkbr7qr8dhrzkjwb";
+    sha256 = "08h2nnf4w96b4ql7485mvjgbbsb8rwc0qa93fdm1cq34pbyszq1z";
   };
 
   outputs = [ "out" "dev" "bin" ];
diff --git a/third_party/nixpkgs/pkgs/development/libraries/libfprint/default.nix b/third_party/nixpkgs/pkgs/development/libraries/libfprint/default.nix
index cc4e7dfefe..469633afb1 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/libfprint/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/libfprint/default.nix
@@ -16,7 +16,7 @@
 
 stdenv.mkDerivation rec {
   pname = "libfprint";
-  version = "1.90.3";
+  version = "1.90.4";
   outputs = [ "out" "devdoc" ];
 
   src = fetchFromGitLab {
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
     owner = "libfprint";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1fs0qrfrqnvc6kcsg81l5p89n8jnsx9dr1pzxpb8ghwas8c9v52i";
+    sha256 = "0grhck0h29i7hm7npvby7pn7wdc446kv0r4mkpbssp46lqbjb96b";
   };
 
   nativeBuildInputs = [
diff --git a/third_party/nixpkgs/pkgs/development/libraries/libimobiledevice/default.nix b/third_party/nixpkgs/pkgs/development/libraries/libimobiledevice/default.nix
index 47408f8cb6..dcbb71c7c3 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/libimobiledevice/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/libimobiledevice/default.nix
@@ -52,7 +52,7 @@ stdenv.mkDerivation rec {
       devices to the Linux Desktop.
     '';
     license = licenses.lgpl21Plus;
-    platforms = platforms.linux;
+    platforms = platforms.linux ++ platforms.darwin;
     maintainers = with maintainers; [ infinisil ];
   };
 }
diff --git a/third_party/nixpkgs/pkgs/development/libraries/libirecovery/default.nix b/third_party/nixpkgs/pkgs/development/libraries/libirecovery/default.nix
index 59f09c8d25..5b0b60b16b 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/libirecovery/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/libirecovery/default.nix
@@ -48,7 +48,7 @@ stdenv.mkDerivation rec {
     '';
     license = licenses.lgpl21;
     # Upstream description says it works on more platforms, but packager hasn't tried that yet
-    platforms = platforms.linux;
+    platforms = platforms.linux ++ platforms.darwin;
     maintainers = with maintainers; [ nh2 ];
   };
 }
diff --git a/third_party/nixpkgs/pkgs/development/libraries/libmanette/default.nix b/third_party/nixpkgs/pkgs/development/libraries/libmanette/default.nix
index 83ee19075d..0cb233ad27 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/libmanette/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/libmanette/default.nix
@@ -5,6 +5,9 @@
 , pkgconfig
 , vala
 , gobject-introspection
+, gtk-doc
+, docbook-xsl-nons
+, docbook_xml_dtd_43
 , glib
 , libgudev
 , libevdev
@@ -13,13 +16,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libmanette";
-  version = "0.2.5";
+  version = "0.2.6";
 
-  outputs = [ "out" "dev" ];
+  outputs = [ "out" "dev" "devdoc" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "gAbghIDAy9T3SewVWCfRAER88jkD+tgkCnxMMhqgmis=";
+    sha256 = "1b3bcdkk5xd5asq797cch9id8692grsjxrc1ss87vv11m1ck4rb3";
   };
 
   nativeBuildInputs = [
@@ -28,6 +31,9 @@ stdenv.mkDerivation rec {
     pkgconfig
     vala
     gobject-introspection
+    gtk-doc
+    docbook-xsl-nons
+    docbook_xml_dtd_43
   ];
 
   buildInputs = [
@@ -36,6 +42,10 @@ stdenv.mkDerivation rec {
     libevdev
   ];
 
+  mesonFlags = [
+    "-Ddoc=true"
+  ];
+
   doCheck = true;
 
   passthru = {
@@ -46,7 +56,7 @@ stdenv.mkDerivation rec {
 
   meta = with stdenv.lib; {
     description = "A simple GObject game controller library";
-    homepage = "https://gitlab.gnome.org/aplazas/libmanette";
+    homepage = "https://gnome.pages.gitlab.gnome.org/libmanette/";
     license = licenses.lgpl21Plus;
     maintainers = teams.gnome.members;
     platforms = platforms.unix;
diff --git a/third_party/nixpkgs/pkgs/development/libraries/libplist/default.nix b/third_party/nixpkgs/pkgs/development/libraries/libplist/default.nix
index 6608ccd1ab..a626e7a537 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/libplist/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/libplist/default.nix
@@ -36,6 +36,6 @@ stdenv.mkDerivation rec {
     homepage = "https://github.com/libimobiledevice/libplist";
     license = licenses.lgpl21Plus;
     maintainers = with maintainers; [ infinisil ];
-    platforms = platforms.linux;
+    platforms = platforms.linux ++ platforms.darwin;
   };
 }
diff --git a/third_party/nixpkgs/pkgs/development/libraries/libproxy/default.nix b/third_party/nixpkgs/pkgs/development/libraries/libproxy/default.nix
index 61c25e183b..7fcc8c58c1 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/libproxy/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/libproxy/default.nix
@@ -71,6 +71,17 @@ stdenv.mkDerivation rec {
       url = "https://github.com/libproxy/libproxy/pull/95.patch";
       sha256 = "18vyr6wlis9zfwml86606jpgb9mss01l9aj31iiciml8p857aixi";
     })
+    (fetchpatch {
+      name = "CVE-2020-25219.patch";
+      url = "https://github.com/libproxy/libproxy/commit/a83dae404feac517695c23ff43ce1e116e2bfbe0.patch";
+      sha256 = "0wdh9qjq99aw0jnf2840237i3hagqzy42s09hz9chfgrw8pyr72k";
+    })
+    (fetchpatch {
+      name = "CVE-2020-26154.patch";
+      url = "https://github.com/libproxy/libproxy/commit/4411b523545b22022b4be7d0cac25aa170ae1d3e.patch";
+      sha256 = "0pdy9sw49lxpaiwq073cisk0npir5bkch70nimdmpszxwp3fv1d8";
+    })
+
   ] ++ stdenv.lib.optionals stdenv.isDarwin [
     (fetchpatch {
       url = "https://github.com/libproxy/libproxy/commit/44158f03f8522116758d335688ed840dfcb50ac8.patch";
diff --git a/third_party/nixpkgs/pkgs/development/libraries/libseccomp/default.nix b/third_party/nixpkgs/pkgs/development/libraries/libseccomp/default.nix
index d3d73e46ac..84f89dec29 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/libseccomp/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/libseccomp/default.nix
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
     sha256 = "1wql62cg8f95cwpy057cl764nni9g4sdn5lqj68x22kjs8w71yhz";
   };
 
-  outputs = [ "out" "lib" "dev" "man" ];
+  outputs = [ "out" "lib" "dev" "man" "pythonsrc" ];
 
   nativeBuildInputs = [ gperf ];
   buildInputs = [ getopt ];
@@ -24,6 +24,13 @@ stdenv.mkDerivation rec {
   # Hack to ensure that patchelf --shrink-rpath get rids of a $TMPDIR reference.
   preFixup = "rm -rfv src";
 
+  # Copy the python module code into a tarball that we can export and use as the
+  # src input for buildPythonPackage calls
+  postInstall = ''
+    cp -R ./src/python/ tmp-pythonsrc/
+    tar -zcf $pythonsrc --transform s/tmp-pythonsrc/python-foundationdb/ ./tmp-pythonsrc/
+  '';
+
   meta = with stdenv.lib; {
     description = "High level library for the Linux Kernel seccomp filter";
     homepage = "https://github.com/seccomp/libseccomp";
diff --git a/third_party/nixpkgs/pkgs/development/libraries/libsecret/default.nix b/third_party/nixpkgs/pkgs/development/libraries/libsecret/default.nix
index 010a74eab3..d614ab0129 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/libsecret/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/libsecret/default.nix
@@ -4,11 +4,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libsecret";
-  version = "0.20.3";
+  version = "0.20.4";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "1r4habxdzmn02id324m0m4mg5isf22q1z436bg3vjjmcz1b3rjsg";
+    sha256 = "0a4xnfmraxchd9cq5ai66j12jv2vrgjmaaxz25kl031jvda4qnij";
   };
 
   postPatch = ''
diff --git a/third_party/nixpkgs/pkgs/development/libraries/libslirp/default.nix b/third_party/nixpkgs/pkgs/development/libraries/libslirp/default.nix
index 0413d8a8ab..2f3abbaff5 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/libslirp/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/libslirp/default.nix
@@ -1,5 +1,6 @@
 { stdenv
 , fetchFromGitLab
+, fetchpatch
 , meson
 , ninja
 , pkg-config
@@ -18,6 +19,15 @@ stdenv.mkDerivation rec {
     sha256 = "0pzgjj2x2vrjshrzrl2x39xp5lgwg4b4y9vs8xvadh1ycl10v3fv";
   };
 
+  patches = [
+    # remove >4.3.1
+    (fetchpatch {
+      name = "CVE-2020-29129_CVE-2020-29130.patch";
+      url = "https://gitlab.freedesktop.org/slirp/libslirp/-/commit/2e1dcbc0c2af64fcb17009eaf2ceedd81be2b27f.patch";
+      sha256 = "01vbjqgnc0kp881l5p6b31cyyirhwhavm6x36hlgkymswvl3wh9w";
+    })
+  ];
+
   nativeBuildInputs = [ meson ninja pkg-config ];
 
   buildInputs = [ glib ];
diff --git a/third_party/nixpkgs/pkgs/development/libraries/libusbmuxd/default.nix b/third_party/nixpkgs/pkgs/development/libraries/libusbmuxd/default.nix
index f4c4dbfcf7..9d81c5d0fb 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/libusbmuxd/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/libusbmuxd/default.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
     description = "A client library to multiplex connections from and to iOS devices";
     homepage    = "https://github.com/libimobiledevice/libusbmuxd";
     license     = licenses.lgpl21Plus;
-    platforms   = platforms.linux;
+    platforms   = platforms.linux ++ platforms.darwin;
     maintainers = with maintainers; [ infinisil ];
   };
 }
diff --git a/third_party/nixpkgs/pkgs/development/libraries/nco/default.nix b/third_party/nixpkgs/pkgs/development/libraries/nco/default.nix
index 0d98142a07..5f6c85411b 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/nco/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/nco/default.nix
@@ -1,7 +1,7 @@
 { stdenv, fetchzip, netcdf, netcdfcxx4, gsl, udunits, antlr, which, curl, flex, coreutils }:
 
 stdenv.mkDerivation rec {
-  version = "4.9.5";
+  version = "4.9.6";
   pname = "nco";
 
   nativeBuildInputs = [ flex which ];
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
 
   src = fetchzip {
     url = "https://github.com/nco/nco/archive/${version}.tar.gz";
-    sha256 = "0xp377rsamn2hwhzaf0ih70wd5274flpz74grys1b7rpbvbyf1bw";
+    sha256 = "0f8vf66700dcr48jqd371bbldc61xkrilby13xp8j5l9q4xal808";
   };
 
   prePatch = ''
diff --git a/third_party/nixpkgs/pkgs/development/libraries/oniguruma/default.nix b/third_party/nixpkgs/pkgs/development/libraries/oniguruma/default.nix
index 54b725c995..44420c85cf 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/oniguruma/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/oniguruma/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "onig";
-  version = "6.9.5_rev1";
+  version = "6.9.6";
 
   src = fetchFromGitHub {
     owner = "kkos";
     repo = "oniguruma";
     rev = "v${version}";
-    sha256 = "1sx683hbb58gbjvla69n5vxdzwqhjqisqbfkf9xi95wr7p9ycjhl";
+    sha256 = "0y0dv6axvjjzi9367xc4q2nvvx58919iyzy25d5022lpz9z569kj";
   };
 
   nativeBuildInputs = [ autoreconfHook ];
diff --git a/third_party/nixpkgs/pkgs/development/libraries/openxr-loader/default.nix b/third_party/nixpkgs/pkgs/development/libraries/openxr-loader/default.nix
index 9e38f1e828..f0c4c47db0 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/openxr-loader/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/openxr-loader/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "openxr-loader";
-  version = "1.0.12";
+  version = "1.0.13";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "OpenXR-SDK-Source";
     rev = "release-${version}";
-    sha256 = "0xcra2hcsm88rfd7zf52hccx3nvg9j65a595z7c0lrzv6jz04676";
+    sha256 = "0znhv7x81bvqijk5xhc5w760d5yy6vr5c2y271wpk9lkmxbbcpl1";
   };
 
   nativeBuildInputs = [ cmake python3 ];
diff --git a/third_party/nixpkgs/pkgs/development/libraries/rocclr/default.nix b/third_party/nixpkgs/pkgs/development/libraries/rocclr/default.nix
index 9b7d80a224..55b2f0ff18 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/rocclr/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/rocclr/default.nix
@@ -15,13 +15,13 @@
 
 stdenv.mkDerivation rec {
   pname = "rocclr";
-  version = "3.9.0";
+  version = "3.10.0";
 
   src = fetchFromGitHub {
     owner = "ROCm-Developer-Tools";
     repo = "ROCclr";
     rev = "rocm-${version}";
-    sha256 = "193pd6lbnfjrmqsrlvkpadxxi908a9r0c41y8x1bkbbaviad39q0";
+    hash = "sha256-P36JKFgXSZagWzHB6WB2WlDu7jkVvfYVo1BaV0b8iEk=";
   };
 
   nativeBuildInputs = [ cmake rocm-cmake ];
diff --git a/third_party/nixpkgs/pkgs/development/libraries/rocm-comgr/default.nix b/third_party/nixpkgs/pkgs/development/libraries/rocm-comgr/default.nix
index 7a122fae39..e6546e0d33 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/rocm-comgr/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/rocm-comgr/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "rocm-comgr";
-  version = "3.9.0";
+  version = "3.10.0";
 
   src = fetchFromGitHub {
     owner = "RadeonOpenCompute";
     repo = "ROCm-CompilerSupport";
     rev = "rocm-${version}";
-    sha256 = "1lwgr6x2b6jisc2nxvr9m24zrc7f2vcgrbkj9sf2blpha61xgk14";
+    hash = "sha256-JMzXg1Hw0iWcTnKu/NgW7rD8iagp724F01GaJbrJj9M=";
   };
 
   sourceRoot = "source/lib/comgr";
diff --git a/third_party/nixpkgs/pkgs/development/libraries/rocm-device-libs/default.nix b/third_party/nixpkgs/pkgs/development/libraries/rocm-device-libs/default.nix
index 4dd96c2c7d..54c7cb9a10 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/rocm-device-libs/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/rocm-device-libs/default.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "rocm-device-libs";
-  version = "3.9.0";
+  version = "3.10.0";
 
   src = fetchFromGitHub {
     owner = "RadeonOpenCompute";
     repo = "ROCm-Device-Libs";
     rev = "rocm-${version}";
-    sha256 = "1nil0nhlkszslgvqhim5vmcp3flfafydviq0zk7db8i6z17kq090";
+    hash = "sha256-IAE8T/gmotXO/ADH3bxTjrpxWd2lRoj3o/rrSaEFNNo=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/third_party/nixpkgs/pkgs/development/libraries/rocm-opencl-runtime/default.nix b/third_party/nixpkgs/pkgs/development/libraries/rocm-opencl-runtime/default.nix
index 69ca18318a..4681267da1 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/rocm-opencl-runtime/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/rocm-opencl-runtime/default.nix
@@ -21,13 +21,13 @@
 
 stdenv.mkDerivation rec {
   pname = "rocm-opencl-runtime";
-  version = "3.9.0";
+  version = "3.10.0";
 
   src = fetchFromGitHub {
     owner = "RadeonOpenCompute";
     repo = "ROCm-OpenCL-Runtime";
     rev = "rocm-${version}";
-    sha256 = "1qsgswm1wl2wknhgy6c9l6dnj0z1kwddimdzjmvjcpyxq987y2gv";
+    hash = "sha256-kW5jTDlQtXQ0i4ADJEnmESxjcLCt4QZCYJ1ouIsk4YE=";
   };
 
   nativeBuildInputs = [ cmake rocm-cmake ];
diff --git a/third_party/nixpkgs/pkgs/development/libraries/rocm-runtime/default.nix b/third_party/nixpkgs/pkgs/development/libraries/rocm-runtime/default.nix
index d3e113b8de..4df954f4b2 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/rocm-runtime/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/rocm-runtime/default.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation rec {
   pname = "rocm-runtime";
-  version = "3.9.0";
+  version = "3.10.0";
 
   src = fetchFromGitHub {
     owner = "RadeonOpenCompute";
     repo = "ROCR-Runtime";
     rev = "rocm-${version}";
-    sha256 = "034qbqznfligg4lwd95zmqa7lwcda720zbfv066nqvarlcml0kr6";
+    hash = "sha256-8hNb0Yo9ApedOG7xrUr5rwiA/YsqDTcyr6dBRg8lXro=";
   };
 
   sourceRoot = "source/src";
diff --git a/third_party/nixpkgs/pkgs/development/libraries/rocm-thunk/default.nix b/third_party/nixpkgs/pkgs/development/libraries/rocm-thunk/default.nix
index 63e66f35f8..bf0a05fe73 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/rocm-thunk/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/rocm-thunk/default.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "rocm-thunk";
-  version = "3.9.0";
+  version = "3.10.0";
 
   src = fetchFromGitHub {
     owner = "RadeonOpenCompute";
     repo = "ROCT-Thunk-Interface";
     rev = "rocm-${version}";
-    sha256 = "0xkp50ik7miz9whywnmiiqiamc7g8flfr9g8c02kxr0cay1in6cj";
+    hash = "sha256-FLH+GHXA0zepbR1wPPSez/hx1hiG2kkCTneDKhJJRjU=";
   };
 
   preConfigure = ''
diff --git a/third_party/nixpkgs/pkgs/development/libraries/spdlog/default.nix b/third_party/nixpkgs/pkgs/development/libraries/spdlog/default.nix
index 9787c7e92d..2022ec7caa 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/spdlog/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/spdlog/default.nix
@@ -15,7 +15,12 @@ let
 
       nativeBuildInputs = [ cmake ];
 
-      cmakeFlags = [ "-DSPDLOG_BUILD_EXAMPLE=OFF" "-DSPDLOG_BUILD_BENCH=OFF" ];
+      cmakeFlags = [
+        "-DSPDLOG_BUILD_SHARED=ON"
+        "-DSPDLOG_BUILD_EXAMPLE=OFF"
+        "-DSPDLOG_BUILD_BENCH=OFF"
+        "-DSPDLOG_BUILD_TESTS=ON"
+      ];
 
       outputs = [ "out" "doc" ];
 
@@ -24,6 +29,9 @@ let
         cp -rv ../example $out/share/doc/spdlog
       '';
 
+      doCheck = true;
+      preCheck = "export LD_LIBRARY_PATH=$(pwd):$LD_LIBRARY_PATH";
+
       meta = with stdenv.lib; {
         description    = "Very fast, header only, C++ logging library";
         homepage       = "https://github.com/gabime/spdlog";
diff --git a/third_party/nixpkgs/pkgs/development/libraries/sqlite/analyzer.nix b/third_party/nixpkgs/pkgs/development/libraries/sqlite/analyzer.nix
deleted file mode 100644
index d0100edd34..0000000000
--- a/third_party/nixpkgs/pkgs/development/libraries/sqlite/analyzer.nix
+++ /dev/null
@@ -1,31 +0,0 @@
-{ stdenv, fetchurl, unzip, sqlite, tcl }:
-
-let
-  archiveVersion = import ./archive-version.nix stdenv.lib;
-in
-
-stdenv.mkDerivation rec {
-  pname = "sqlite-analyzer";
-  version = "3.33.0";
-
-  src = assert version == sqlite.version; fetchurl {
-    url = "https://sqlite.org/2020/sqlite-src-${archiveVersion version}.zip";
-    sha256 = "1f09srlrmcab1sf8j2d89s2kvknlbxk7mbsiwpndw9mall27dgwh";
-  };
-
-  nativeBuildInputs = [ unzip ];
-  buildInputs = [ tcl ];
-
-  makeFlags = [ "sqlite3_analyzer" ];
-
-  installPhase = "install -Dt $out/bin sqlite3_analyzer";
-
-  meta = with stdenv.lib; {
-    description = "A tool that shows statistics about SQLite databases";
-    downloadPage = "http://sqlite.org/download.html";
-    homepage = "https://www.sqlite.org";
-    license = licenses.publicDomain;
-    maintainers = with maintainers; [ pesterhazy ];
-    platforms = platforms.unix;
-  };
-}
diff --git a/third_party/nixpkgs/pkgs/development/libraries/talloc/default.nix b/third_party/nixpkgs/pkgs/development/libraries/talloc/default.nix
index f464364e8a..fa920d037a 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/talloc/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/talloc/default.nix
@@ -1,6 +1,6 @@
 { stdenv
 , fetchurl
-, python
+, python3
 , pkg-config
 , readline
 , libxslt
@@ -10,7 +10,7 @@
 , wafHook
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (rec {
   pname = "talloc";
   version = "2.3.1";
 
@@ -22,13 +22,14 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [
     pkg-config
     fixDarwinDylibNames
-    python
+    python3
     wafHook
     docbook-xsl-nons
     docbook_xml_dtd_42
   ];
 
   buildInputs = [
+    python3
     readline
     libxslt
   ];
@@ -56,4 +57,9 @@ stdenv.mkDerivation rec {
     license = licenses.gpl3;
     platforms = platforms.all;
   };
-}
+} // stdenv.lib.optionalAttrs (stdenv.hostPlatform != stdenv.buildPlatform) {
+  # python-config from build Python gives incorrect values when cross-compiling.
+  # If python-config is not found, the build falls back to using the sysconfig
+  # module, which works correctly when cross-compiling.
+  PYTHON_CONFIG = "/invalid";
+})
diff --git a/third_party/nixpkgs/pkgs/development/libraries/tdlib/default.nix b/third_party/nixpkgs/pkgs/development/libraries/tdlib/default.nix
index 165506f964..1a36a68a33 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/tdlib/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/tdlib/default.nix
@@ -1,20 +1,16 @@
 { fetchFromGitHub, gperf, openssl, readline, zlib, cmake, stdenv }:
 
 stdenv.mkDerivation rec {
-  version = "unstable-2020-10-25";
+  version = "1.7.0";
   pname = "tdlib";
 
   src = fetchFromGitHub {
     owner = "tdlib";
     repo = "td";
 
-    # At version 1.6.0, this line was `rev = "v${version}". Version 1.6.9 (here called `unstable-2020-10-25`) uses an
-    # explicit revision because 1.6.9 is not a tdlib GitHub release, and is therefore not hosted at
-    # `https://github.com/tdlib/td/releases/tag/v1.6.9`. Please return to the `rev = "v${version}"` style on the next
-    # version bump if you can, since that will allow `nixpkgs-update` to update the package automatically.
-    rev = "32f2338bd199dd06a1b4b5f1ad14f2d4f2868f01";
+    rev = "v${version}";
 
-    sha256 = "0wv03hlgzrsc04kcwnwz6dsmkdzvhb0i1wjs08gzivwxw06pkq4n";
+    sha256 = "sha256-sZzp9k7KDnqftcSGSgXkIy0siCksGPBmRckySU/J0TU=";
   };
 
   buildInputs = [ gperf openssl readline zlib ];
diff --git a/third_party/nixpkgs/pkgs/development/libraries/tinyobjloader/default.nix b/third_party/nixpkgs/pkgs/development/libraries/tinyobjloader/default.nix
new file mode 100644
index 0000000000..92eb5b3d8f
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/development/libraries/tinyobjloader/default.nix
@@ -0,0 +1,26 @@
+{ stdenv
+, fetchFromGitHub
+, cmake
+}:
+
+stdenv.mkDerivation rec {
+  pname = "tinyobjloader";
+  version = "1.0.6";
+
+  src = fetchFromGitHub {
+    owner = "tinyobjloader";
+    repo = "tinyobjloader";
+    rev = "v${version}";
+    sha256 = "162168995f4xch7hm3iy6m57r8iqkpzi5x9qh1gsghlxwdxxqbis";
+  };
+
+  nativeBuildInputs = [ cmake ];
+
+  meta = with stdenv.lib; {
+    homepage = "https://github.com/tinyobjloader/tinyobjloader";
+    description = "Tiny but powerful single file wavefront obj loader";
+    license = licenses.mit;
+    maintainers = [ maintainers.ivar ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/third_party/nixpkgs/pkgs/development/node-packages/default.nix b/third_party/nixpkgs/pkgs/development/node-packages/default.nix
index 908b489684..c8694a46bd 100644
--- a/third_party/nixpkgs/pkgs/development/node-packages/default.nix
+++ b/third_party/nixpkgs/pkgs/development/node-packages/default.nix
@@ -59,6 +59,10 @@ let
       buildInputs = [ pkgs.phantomjs2 ];
     };
 
+    flood = super.flood.override {
+      buildInputs = [ self.node-pre-gyp ];
+    };
+
     expo-cli = super."expo-cli".override (attrs: {
       # The traveling-fastlane-darwin optional dependency aborts build on Linux.
       dependencies = builtins.filter (d: d.packageName != "@expo/traveling-fastlane-${if stdenv.isLinux then "darwin" else "linux"}") attrs.dependencies;
diff --git a/third_party/nixpkgs/pkgs/development/node-packages/node-packages.json b/third_party/nixpkgs/pkgs/development/node-packages/node-packages.json
index 8604015d88..e2a2110fa6 100644
--- a/third_party/nixpkgs/pkgs/development/node-packages/node-packages.json
+++ b/third_party/nixpkgs/pkgs/development/node-packages/node-packages.json
@@ -80,6 +80,7 @@
 , {"fast-cli": "1.x"}
 , "fauna-shell"
 , "fkill-cli"
+, "flood"
 , "forever"
 , "fx"
 , "get-graphql-schema"
diff --git a/third_party/nixpkgs/pkgs/development/node-packages/node-packages.nix b/third_party/nixpkgs/pkgs/development/node-packages/node-packages.nix
index 1c88382c29..d1ead03f59 100644
--- a/third_party/nixpkgs/pkgs/development/node-packages/node-packages.nix
+++ b/third_party/nixpkgs/pkgs/development/node-packages/node-packages.nix
@@ -1381,22 +1381,22 @@ let
         sha512 = "GcIY79elgB+azP74j8vqkiXz8xLFfIzbQJdlwOPisgbKT00tviJQuEghOXSMVxJ00HoYJbGswr4kcllUc4xCcg==";
       };
     };
-    "@bugsnag/browser-7.5.1" = {
+    "@bugsnag/browser-7.5.3" = {
       name = "_at_bugsnag_slash_browser";
       packageName = "@bugsnag/browser";
-      version = "7.5.1";
+      version = "7.5.3";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@bugsnag/browser/-/browser-7.5.1.tgz";
-        sha512 = "NLWgSj3elYGSkdth666UxQ6r5Y/zAMidnQZRnOW2ZsW+4W/q+hr7zoN4v5IUnZuoSTQ9QxVYY99wA4hqlDyoJg==";
+        url = "https://registry.npmjs.org/@bugsnag/browser/-/browser-7.5.3.tgz";
+        sha512 = "iGmKFtHz91hNovWW8rb/qLD9X5TMVEc7OUEfwE5s1M8ElReEmUAVbgTfQjkahG8aHvjGQ+M+zyM0gHfk+tTczg==";
       };
     };
-    "@bugsnag/core-7.3.5" = {
+    "@bugsnag/core-7.5.3" = {
       name = "_at_bugsnag_slash_core";
       packageName = "@bugsnag/core";
-      version = "7.3.5";
+      version = "7.5.3";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@bugsnag/core/-/core-7.3.5.tgz";
-        sha512 = "7zKFLcA6m9aaQ1p1AQx2iRaT3gE/MJqy0vGa/RhlKNdgMdMKYRGECWxJE66firvJT5ZwL7Bu11IkK6sLWHCBaw==";
+        url = "https://registry.npmjs.org/@bugsnag/core/-/core-7.5.3.tgz";
+        sha512 = "HaAPWN+z3ZlEjwF2JeuAx83eKoVd6osgx2Hyn8dlmGsRfUvpi+7rG9DI483PGexEM0O6i/ORvD6Qx92/E9zW7w==";
       };
     };
     "@bugsnag/cuid-3.0.0" = {
@@ -1408,22 +1408,22 @@ let
         sha512 = "LOt8aaBI+KvOQGneBtpuCz3YqzyEAehd1f3nC5yr9TIYW1+IzYKa2xWS4EiMz5pPOnRPHkyyS5t/wmSmN51Gjg==";
       };
     };
-    "@bugsnag/js-7.5.1" = {
+    "@bugsnag/js-7.5.3" = {
       name = "_at_bugsnag_slash_js";
       packageName = "@bugsnag/js";
-      version = "7.5.1";
+      version = "7.5.3";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@bugsnag/js/-/js-7.5.1.tgz";
-        sha512 = "acbq392QYjZNtUHa5tTp+MLTBhNZhI4s6EBrEFqN1TdxrVVGEFfnQqrPISfKtOJ+FW1dZEZiQ0oEGJ127htqIQ==";
+        url = "https://registry.npmjs.org/@bugsnag/js/-/js-7.5.3.tgz";
+        sha512 = "xdwfq+bQPWZFwc02IIFk7rVsxoEsAMOLiZLJpjnRK/HtzwWPUciMTRIIlUzb/uZaAmd05UieVQ/TxuwQYdMgEA==";
       };
     };
-    "@bugsnag/node-7.3.5" = {
+    "@bugsnag/node-7.5.3" = {
       name = "_at_bugsnag_slash_node";
       packageName = "@bugsnag/node";
-      version = "7.3.5";
+      version = "7.5.3";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@bugsnag/node/-/node-7.3.5.tgz";
-        sha512 = "eN06NgphKYikBq/AXpiLO9tNx1H7cz8C78oQnR5fj2POulj+Zm9njr9dM6DEzGIvBDt952SwwcOA73jAiOmztQ==";
+        url = "https://registry.npmjs.org/@bugsnag/node/-/node-7.5.3.tgz";
+        sha512 = "irNGOTcxi7u8lUziLfv7rKzWGg2Yd+ZXZnwD0r6ZDhdlOwA3UnGq6Fud3SOTJNKPcUk/16Sv0mcuKkcLdHTodg==";
       };
     };
     "@bugsnag/safe-json-stringify-6.0.0" = {
@@ -1705,22 +1705,22 @@ let
         sha512 = "Ydf4LidRB/EBI+YrB+cVLqIseiRfjUI/AeHBgjGMtq3GroraDu81OV7zqophRgupngoL3iS3JUMDMnxO7g39qA==";
       };
     };
-    "@expo/config-3.3.16" = {
+    "@expo/config-3.3.18" = {
       name = "_at_expo_slash_config";
       packageName = "@expo/config";
-      version = "3.3.16";
+      version = "3.3.18";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@expo/config/-/config-3.3.16.tgz";
-        sha512 = "iEjyV8OfaA0fPPsKYkkcod6wCd6sAtWOxAAT+7xriGqJV5aYnpL1hcBxPkPKavYzWMJUEEOwajmqoJy1uVP6ig==";
+        url = "https://registry.npmjs.org/@expo/config/-/config-3.3.18.tgz";
+        sha512 = "R78HOWnLcxdip3FBrfbxti+85jdoRNpXV0Eihb6dl+sBRNo4+uzBNEQQ1P7ICoTzrehdkhdXkQYflvQFuQXyAA==";
       };
     };
-    "@expo/config-plugins-1.0.3" = {
+    "@expo/config-plugins-1.0.5" = {
       name = "_at_expo_slash_config-plugins";
       packageName = "@expo/config-plugins";
-      version = "1.0.3";
+      version = "1.0.5";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@expo/config-plugins/-/config-plugins-1.0.3.tgz";
-        sha512 = "Tc17MLfNIHl7h+YmE4cEvIK4WZq5fFShdrXJGNoNmubJ6xPeqDTLL7qCVNSzckkU4+XgfV1qt5uU+qezZLvbCw==";
+        url = "https://registry.npmjs.org/@expo/config-plugins/-/config-plugins-1.0.5.tgz";
+        sha512 = "ykEHIZu7Xjnq7wgauXw0cSbo9C2SVvDmCRwyAJoReJ88R0xXOt+4GQJ6BYdmGv9Gmdt6DTrWqwMQOJK6GmoMew==";
       };
     };
     "@expo/config-types-40.0.0-beta.1" = {
@@ -1741,22 +1741,22 @@ let
         sha512 = "6n7ji1WKDCdLe2Mto4u4W72kTLhAbhXhC7ydVk1HxDYCcbewNLfgiwhchPtPGyUMnSDizVWph5aDoiKxqVHqNQ==";
       };
     };
-    "@expo/dev-server-0.1.41" = {
+    "@expo/dev-server-0.1.43" = {
       name = "_at_expo_slash_dev-server";
       packageName = "@expo/dev-server";
-      version = "0.1.41";
+      version = "0.1.43";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@expo/dev-server/-/dev-server-0.1.41.tgz";
-        sha512 = "Mgqm79SE01bXiOG5DsJyuP/FAszkGKC22rfvjGb0tCVHbcvuVLjxm2fnnylBj9FRcTW6Rz3hAB1RaC5RayqNcg==";
+        url = "https://registry.npmjs.org/@expo/dev-server/-/dev-server-0.1.43.tgz";
+        sha512 = "FYLMoI7c1Myw5vCyx7nMEW6Oos40wx28TuHcticKPU+zZiYrzyIa4aJzEv4bWnw1if6417lKXjncYvQEZRyxFw==";
       };
     };
-    "@expo/dev-tools-0.13.62" = {
+    "@expo/dev-tools-0.13.65" = {
       name = "_at_expo_slash_dev-tools";
       packageName = "@expo/dev-tools";
-      version = "0.13.62";
+      version = "0.13.65";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@expo/dev-tools/-/dev-tools-0.13.62.tgz";
-        sha512 = "6DeV6VxdJFPz7xYwNgIvb5GGRweHC9dS/XkkKic7Nm0c8FV+BPEm0Z/JThJ76fliTFiUPB6L7hNNCLbzObW9Zw==";
+        url = "https://registry.npmjs.org/@expo/dev-tools/-/dev-tools-0.13.65.tgz";
+        sha512 = "LhfxPzJuKPi3WlK5C5o9ejJOkscU6pCqHKRWI97zN8Xh6XJ6FMNfqgh+hJ94vqWAMmDpEBjY3e7MxZXqQaNaAQ==";
       };
     };
     "@expo/eas-build-job-0.1.2" = {
@@ -1786,13 +1786,13 @@ let
         sha512 = "KFX6grWVzttaDskq/NK8ByqFPgpDZGFnyeZVeecGoKx5kU61zuR7/xQM04OvN6BNXq3jTUst1TyS8fXEfJuscA==";
       };
     };
-    "@expo/metro-config-0.1.41" = {
+    "@expo/metro-config-0.1.43" = {
       name = "_at_expo_slash_metro-config";
       packageName = "@expo/metro-config";
-      version = "0.1.41";
+      version = "0.1.43";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@expo/metro-config/-/metro-config-0.1.41.tgz";
-        sha512 = "eq2FT7/KCwQSW5R5iMLu2a8amwZ7Oz3tUIKWZtbpj6LCPbRyrF+htnjsO1eIQJ02QDE1HIs2cxFeUHjoWJSh7g==";
+        url = "https://registry.npmjs.org/@expo/metro-config/-/metro-config-0.1.43.tgz";
+        sha512 = "ZkZXu2dVjZ88tiH51gqM3DUAmey18tM9MlDh91r1iLF6hHT6UeZD0lBDN7IJTQv/SJuAPQHoylXmAx6cuIGU9A==";
       };
     };
     "@expo/ngrok-2.4.3" = {
@@ -1993,22 +1993,22 @@ let
         sha512 = "YaFAYYOOxImYNx9s6X3tY6fC1y6rka0KXstrs2zrS+vHyyBD8IOhNtIUvybHScM3jUL+qukgKElAb+7gzlF6Eg==";
       };
     };
-    "@expo/webpack-config-0.12.46" = {
+    "@expo/webpack-config-0.12.48" = {
       name = "_at_expo_slash_webpack-config";
       packageName = "@expo/webpack-config";
-      version = "0.12.46";
+      version = "0.12.48";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@expo/webpack-config/-/webpack-config-0.12.46.tgz";
-        sha512 = "lVOmaBAKrw2PO1TsEOkeCFLLxGuWcoHpAeN/SgVKcQCKZuSAYqTG5qf4Rino7TdVjbCOu+Apec4AIyg2oW6Y8w==";
+        url = "https://registry.npmjs.org/@expo/webpack-config/-/webpack-config-0.12.48.tgz";
+        sha512 = "uUmr+z9gpMNw6yUGinQkkN/GDPypLvySs/0pwUBF9w7xfaGeRKoEGYhNS8JaIXgmR3621eKi3F2pBlSoSFfiew==";
       };
     };
-    "@expo/xdl-59.0.2" = {
+    "@expo/xdl-59.0.5" = {
       name = "_at_expo_slash_xdl";
       packageName = "@expo/xdl";
-      version = "59.0.2";
+      version = "59.0.5";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@expo/xdl/-/xdl-59.0.2.tgz";
-        sha512 = "hTwJkac/+y5arWDZnQCb3lbOsgiz5tyY+ikr1LHcO8emiPpctY98H9v7MKwsxu6GsXfmwrztqgtkVBRviKh56A==";
+        url = "https://registry.npmjs.org/@expo/xdl/-/xdl-59.0.5.tgz";
+        sha512 = "JWQDKG+Eymgwm3xd2OAkTSpb3fgNetQFJHGZt4/2GUfqjQuyFWZMtmtKwJ2ZDaW+V8tNW0hgR5czWI/lsZSZnA==";
       };
     };
     "@fast-csv/format-4.3.5" = {
@@ -2146,13 +2146,13 @@ let
         sha512 = "+ywPfK6N2Ddna6oOa5Qb1Mv7EA8LOwRNOAPP9dL37FEhksJM9pYqPSceUcqMqg7S9b0+Cgr78s408rgvurV3/Q==";
       };
     };
-    "@graphql-tools/delegate-7.0.5" = {
+    "@graphql-tools/delegate-7.0.7" = {
       name = "_at_graphql-tools_slash_delegate";
       packageName = "@graphql-tools/delegate";
-      version = "7.0.5";
+      version = "7.0.7";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@graphql-tools/delegate/-/delegate-7.0.5.tgz";
-        sha512 = "wkB/L9cRxlPB4m9k9WQJZYPbnRxfEu2bkxvI9pVGHMsmoQxMZiM2GkhCBHDTBYJb7cxCS6Wv3LJb1w0iEqw24w==";
+        url = "https://registry.npmjs.org/@graphql-tools/delegate/-/delegate-7.0.7.tgz";
+        sha512 = "2sze+CJxu37b4jcQ4fyj6ap9TMnx8+NBtApSs1nWIVENzPE2510aNTsBHgSdTwSeV/tVIFkAtZZAlMEGYGXzQA==";
       };
     };
     "@graphql-tools/graphql-file-loader-6.2.6" = {
@@ -2191,22 +2191,22 @@ let
         sha512 = "FlQC50VELwRxoWUbJMMMs5gG0Dl8BaQYMrXUHTsxwqR7UmksUYnysC21rdousvs6jVZ7pf4unZfZFtBjz+8Edg==";
       };
     };
-    "@graphql-tools/merge-6.2.5" = {
+    "@graphql-tools/merge-6.2.6" = {
       name = "_at_graphql-tools_slash_merge";
       packageName = "@graphql-tools/merge";
-      version = "6.2.5";
+      version = "6.2.6";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@graphql-tools/merge/-/merge-6.2.5.tgz";
-        sha512 = "T2UEm7L5MeS1ggbGKBkdV9kTqLqSHQM13RrjPzIAYzkFL/mK837sf+oq8h2+R8B+senuHX8akUhMTcU85kcMvw==";
+        url = "https://registry.npmjs.org/@graphql-tools/merge/-/merge-6.2.6.tgz";
+        sha512 = "G6x0QlIzFHoJ3dyF9a4gxmBtaEYJ+EoAAGqXHsE/drRr58K1jscQdfKZdF1wZWZgxkgakHqgt1+oFMeQg/O6ug==";
       };
     };
-    "@graphql-tools/schema-7.1.0" = {
+    "@graphql-tools/schema-7.1.2" = {
       name = "_at_graphql-tools_slash_schema";
       packageName = "@graphql-tools/schema";
-      version = "7.1.0";
+      version = "7.1.2";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@graphql-tools/schema/-/schema-7.1.0.tgz";
-        sha512 = "1TwaRfWOfxtTqk8ckBrLi3283Sl0tQmUleAnelID1mql4YgYyArrKRkHfWZs9DbydngTxj/uV10aLYioJMR6tQ==";
+        url = "https://registry.npmjs.org/@graphql-tools/schema/-/schema-7.1.2.tgz";
+        sha512 = "GabNT51ErVHE2riDH4EQdRusUsI+nMElT8LdFHyuP53v8gwtleAj+LePQ9jif4NYUe/JQVqO8V28vPcHrA7gfQ==";
       };
     };
     "@graphql-tools/url-loader-6.4.0" = {
@@ -2227,22 +2227,22 @@ let
         sha512 = "ybgZ9EIJE3JMOtTrTd2VcIpTXtDrn2q6eiYkeYMKRVh3K41+LZa6YnR2zKERTXqTWqhobROwLt4BZbw2O3Aeeg==";
       };
     };
-    "@graphql-tools/utils-7.1.0" = {
+    "@graphql-tools/utils-7.1.2" = {
       name = "_at_graphql-tools_slash_utils";
       packageName = "@graphql-tools/utils";
-      version = "7.1.0";
+      version = "7.1.2";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@graphql-tools/utils/-/utils-7.1.0.tgz";
-        sha512 = "lMTgy08BdqQ31zyyCRrxcKZ6gAKQB9amGKJGg0mb3b4I3iJQKeaw9a7T96yGe1frGak1UK9y7OoYqx8RG7KitA==";
+        url = "https://registry.npmjs.org/@graphql-tools/utils/-/utils-7.1.2.tgz";
+        sha512 = "xFuhDyGMhaXTQpq48vjjCLA1VWc3fEo4n+zBcvQnbBSqhVPwAVa0ANcpb0NHmU9c3ypch26kK85TmC/HoK3YRg==";
       };
     };
-    "@graphql-tools/wrap-7.0.1" = {
+    "@graphql-tools/wrap-7.0.3" = {
       name = "_at_graphql-tools_slash_wrap";
       packageName = "@graphql-tools/wrap";
-      version = "7.0.1";
+      version = "7.0.3";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@graphql-tools/wrap/-/wrap-7.0.1.tgz";
-        sha512 = "0feqjgEJSRLm2V0kEUaV2dw7ukVPjRujYMqNdcqHsIyXmf0VO8PGF5hcva/+5U/9Yfbf3Fck+P5JTJ5MlXPlsQ==";
+        url = "https://registry.npmjs.org/@graphql-tools/wrap/-/wrap-7.0.3.tgz";
+        sha512 = "co+ELAwZwMut7qGZow8ATMQlYOU2G3/gsEqz/SUAt7XizXWOOguSFjQKk1/OwHzgCFBbEjvwfoERcv6QC1EUxA==";
       };
     };
     "@gulp-sourcemaps/identity-map-1.0.2" = {
@@ -3406,13 +3406,13 @@ let
         sha512 = "/NdX1Ql8hKNM0vHFJnEr/bcw6BG0ULHD3HhInpniZw5ixpl+n/QIRfMEEmLCn7acedbM1zGdZvU5ZMbn9kcF5Q==";
       };
     };
-    "@microsoft/load-themed-styles-1.10.136" = {
+    "@microsoft/load-themed-styles-1.10.138" = {
       name = "_at_microsoft_slash_load-themed-styles";
       packageName = "@microsoft/load-themed-styles";
-      version = "1.10.136";
+      version = "1.10.138";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@microsoft/load-themed-styles/-/load-themed-styles-1.10.136.tgz";
-        sha512 = "D8wWUiW7HQKFp4Qgy5GsDvEymKew/4uK+4dSWSO/+6LfSI15kqDNS7g4Nf/VxL5FBmjwXqQV1d59ucgWiKUjJg==";
+        url = "https://registry.npmjs.org/@microsoft/load-themed-styles/-/load-themed-styles-1.10.138.tgz";
+        sha512 = "TDY8c3CnIbysFIQ8Lj/ZujLkvDB/jrnVOx6FDJICFfo1Jbcyia+nIbUkOJtXtTGK/sx/zfyYJxgFgKQEAtKLHQ==";
       };
     };
     "@mozilla/readability-0.3.0" = {
@@ -3460,13 +3460,13 @@ let
         sha512 = "b+MGNyP9/LXkapreJzNUzcvuzZslj/RGgdVVJ16P2wSlYatfLycPObImqVJSmNAdyeShvNeM/pl3sVZsObFueg==";
       };
     };
-    "@netlify/build-5.3.3" = {
+    "@netlify/build-5.5.2" = {
       name = "_at_netlify_slash_build";
       packageName = "@netlify/build";
-      version = "5.3.3";
+      version = "5.5.2";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@netlify/build/-/build-5.3.3.tgz";
-        sha512 = "PgAPLFZeHeR45mM2km/UHXfg/3K9NtrGKAaoG7vwU36XYEaVaB/psBp0PzrfJbRiBER+vqnxrDTOyHJc4Z0w1g==";
+        url = "https://registry.npmjs.org/@netlify/build/-/build-5.5.2.tgz";
+        sha512 = "599fcS/FVJUMjnF5NS0QGwZ6B8uw7ROL50z6VfrHbdgpcHgoSCo3HNHeeIA6bfA4pO/IdnmRFOX4fDJgKPsbLw==";
       };
     };
     "@netlify/cache-utils-1.0.6" = {
@@ -3487,13 +3487,13 @@ let
         sha512 = "Z7yzbx5qCX2I5RLlNyo0MMQ6GKJc8o5Nej9yspCavjqgYlUS7VJfbeE67WNxC26FXwDUqq00zJ0MrCS0Un1YOw==";
       };
     };
-    "@netlify/config-2.4.0" = {
+    "@netlify/config-2.4.1" = {
       name = "_at_netlify_slash_config";
       packageName = "@netlify/config";
-      version = "2.4.0";
+      version = "2.4.1";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@netlify/config/-/config-2.4.0.tgz";
-        sha512 = "MDp7A7AMHVOHpvX+o69t+c8nZjVtkxNcepxsSqE+9wuPVlSHWCqzkHVxKQU0ozuk74z/xHBRUpp/OMCXkiEugg==";
+        url = "https://registry.npmjs.org/@netlify/config/-/config-2.4.1.tgz";
+        sha512 = "fSRSN3+c5kcyaCEd7XVlPRz820y/CRS8ryuE2fZAT/sgXiGBPGGKHwSKMNlso7s0qtJOmFyjeehU6nEzvfNKrg==";
       };
     };
     "@netlify/functions-utils-1.3.2" = {
@@ -3532,6 +3532,15 @@ let
         sha512 = "ZgabL4Q+DfB5lqq36QYvGIhLifoiVz5oDfqLp1w7hRsJYwUhUPqeJx/0zph17ZaJB4CvHRadFOeyJeDSkzrERg==";
       };
     };
+    "@netlify/plugins-list-2.0.0" = {
+      name = "_at_netlify_slash_plugins-list";
+      packageName = "@netlify/plugins-list";
+      version = "2.0.0";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/@netlify/plugins-list/-/plugins-list-2.0.0.tgz";
+        sha512 = "GU0u0fnVqNTU32hVr7ig7bGG3/851a0SNjC9nl+iu4Eadax/hfCVSRoSffU0+d05UtXlLhkcgmuYnLySkTR8DA==";
+      };
+    };
     "@netlify/run-utils-1.0.5" = {
       name = "_at_netlify_slash_run-utils";
       packageName = "@netlify/run-utils";
@@ -3577,13 +3586,13 @@ let
         sha512 = "u6Beazs0KWRcEx9q2n417Sj7+WGrDTtDGmmKPTE6WexFt6uY1oiq3AR+ohCtu1lIIsmAfAYd8O5dSOnyAT8dFg==";
       };
     };
-    "@netlify/zip-it-and-ship-it-1.4.2" = {
+    "@netlify/zip-it-and-ship-it-1.5.0" = {
       name = "_at_netlify_slash_zip-it-and-ship-it";
       packageName = "@netlify/zip-it-and-ship-it";
-      version = "1.4.2";
+      version = "1.5.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@netlify/zip-it-and-ship-it/-/zip-it-and-ship-it-1.4.2.tgz";
-        sha512 = "iwwKQrBnLONYm1x7g6GZvHmjeZ03/L2NUYL/2NcpNYtE4sWB+M5OTDdnlVsu8u65dR7wtH4hKjOO2ID6vS7rQQ==";
+        url = "https://registry.npmjs.org/@netlify/zip-it-and-ship-it/-/zip-it-and-ship-it-1.5.0.tgz";
+        sha512 = "hTUVtCdjrWso28Lwi+A9GO+WZhVJcJWvXO0YuYlBcGY67Lv61TQQl7nNvzgGYG7UNnzvsnTafe1pL2v+4u4vmg==";
       };
     };
     "@node-red/editor-api-1.2.6" = {
@@ -3892,22 +3901,31 @@ let
         sha512 = "60CHpq+eqnTxLZQ4PGHYNwUX572hgpMHGPtTWMjdTMsAvlm69lZV/4ly6O3sAYkomo4NggGcomrDpBe34rxUqw==";
       };
     };
-    "@octokit/auth-token-2.4.3" = {
+    "@octokit/auth-token-2.4.4" = {
       name = "_at_octokit_slash_auth-token";
       packageName = "@octokit/auth-token";
-      version = "2.4.3";
+      version = "2.4.4";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@octokit/auth-token/-/auth-token-2.4.3.tgz";
-        sha512 = "fdGoOQ3kQJh+hrilc0Plg50xSfaCKOeYN9t6dpJKXN9BxhhfquL0OzoQXg3spLYymL5rm29uPeI3KEXRaZQ9zg==";
+        url = "https://registry.npmjs.org/@octokit/auth-token/-/auth-token-2.4.4.tgz";
+        sha512 = "LNfGu3Ro9uFAYh10MUZVaT7X2CnNm2C8IDQmabx+3DygYIQjs9FwzFAHN/0t6mu5HEPhxcb1XOuxdpY82vCg2Q==";
       };
     };
-    "@octokit/endpoint-6.0.9" = {
+    "@octokit/endpoint-6.0.10" = {
       name = "_at_octokit_slash_endpoint";
       packageName = "@octokit/endpoint";
-      version = "6.0.9";
+      version = "6.0.10";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@octokit/endpoint/-/endpoint-6.0.9.tgz";
-        sha512 = "3VPLbcCuqji4IFTclNUtGdp9v7g+nspWdiCUbK3+iPMjJCZ6LEhn1ts626bWLOn0GiDb6j+uqGvPpqLnY7pBgw==";
+        url = "https://registry.npmjs.org/@octokit/endpoint/-/endpoint-6.0.10.tgz";
+        sha512 = "9+Xef8nT7OKZglfkOMm7IL6VwxXUQyR7DUSU0LH/F7VNqs8vyd7es5pTfz9E7DwUIx7R3pGscxu1EBhYljyu7Q==";
+      };
+    };
+    "@octokit/openapi-types-1.2.2" = {
+      name = "_at_octokit_slash_openapi-types";
+      packageName = "@octokit/openapi-types";
+      version = "1.2.2";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-1.2.2.tgz";
+        sha512 = "vrKDLd/Rq4IE16oT+jJkDBx0r29NFkdkU8GwqVSP4RajsAvP23CMGtFhVK0pedUhAiMvG1bGnFcTC/xCKaKgmw==";
       };
     };
     "@octokit/plugin-enterprise-rest-6.0.1" = {
@@ -3946,13 +3964,13 @@ let
         sha512 = "EZi/AWhtkdfAYi01obpX0DF7U6b1VRr30QNQ5xSFPITMdLSfhcBqjamE3F+sKcxPbD7eZuMHu3Qkk2V+JGxBDQ==";
       };
     };
-    "@octokit/request-5.4.10" = {
+    "@octokit/request-5.4.11" = {
       name = "_at_octokit_slash_request";
       packageName = "@octokit/request";
-      version = "5.4.10";
+      version = "5.4.11";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@octokit/request/-/request-5.4.10.tgz";
-        sha512 = "egA49HkqEORVGDZGav1mh+VD+7uLgOxtn5oODj6guJk0HCy+YBSYapFkSLFgeYj3Fr18ZULKGURkjyhkAChylw==";
+        url = "https://registry.npmjs.org/@octokit/request/-/request-5.4.11.tgz";
+        sha512 = "vskebNjuz4oTdPIv+9cQjHvjk8vjrMv2fOmSo6zr7IIaFHeVsJlG/C07MXiSS/+g/qU1GHjkPG1XW3faz57EoQ==";
       };
     };
     "@octokit/request-error-1.2.1" = {
@@ -3964,13 +3982,13 @@ let
         sha512 = "+6yDyk1EES6WK+l3viRDElw96MvwfJxCt45GvmjDUKWjYIb3PJZQkq3i46TwGwoPD4h8NmTrENmtyA1FwbmhRA==";
       };
     };
-    "@octokit/request-error-2.0.3" = {
+    "@octokit/request-error-2.0.4" = {
       name = "_at_octokit_slash_request-error";
       packageName = "@octokit/request-error";
-      version = "2.0.3";
+      version = "2.0.4";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@octokit/request-error/-/request-error-2.0.3.tgz";
-        sha512 = "GgD5z8Btm301i2zfvJLk/mkhvGCdjQ7wT8xF9ov5noQY8WbKZDH9cOBqXzoeKd1mLr1xH2FwbtGso135zGBgTA==";
+        url = "https://registry.npmjs.org/@octokit/request-error/-/request-error-2.0.4.tgz";
+        sha512 = "LjkSiTbsxIErBiRh5wSZvpZqT4t0/c9+4dOe0PII+6jXR+oj/h66s7E4a/MghV7iT8W9ffoQ5Skoxzs96+gBPA==";
       };
     };
     "@octokit/rest-16.43.2" = {
@@ -3991,13 +4009,13 @@ let
         sha512 = "O75k56TYvJ8WpAakWwYRN8Bgu60KrmX0z1KqFp1kNiFNkgW+JW+9EBKZ+S33PU6SLvbihqd+3drvPxKK68Ee8Q==";
       };
     };
-    "@octokit/types-5.5.0" = {
+    "@octokit/types-6.0.1" = {
       name = "_at_octokit_slash_types";
       packageName = "@octokit/types";
-      version = "5.5.0";
+      version = "6.0.1";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@octokit/types/-/types-5.5.0.tgz";
-        sha512 = "UZ1pErDue6bZNjYOotCNveTXArOMZQFG6hKJfOnGnulVCMcVVi7YIIuuR4WfBhjo7zgpmzn/BkPDnUXtNx+PcQ==";
+        url = "https://registry.npmjs.org/@octokit/types/-/types-6.0.1.tgz";
+        sha512 = "H/DnTKC+U09en2GFLH/MfAPNDaYb1isieD4Hx4NLpEt/I1PgtZP/8a+Ehc/j9GHuVF/UvGtOVD8AF9XXvws53w==";
       };
     };
     "@opencensus/core-0.0.8" = {
@@ -4585,13 +4603,13 @@ let
         sha512 = "rmuSC2JFFl4DkPDdGVrmffT9KcbG2AB5jvhxPIrOc1dO9mHRMUUftQY35KZlvWqqSSqVn+AM+J9dhiTo1ZqR8A==";
       };
     };
-    "@rollup/plugin-babel-5.2.1" = {
+    "@rollup/plugin-babel-5.2.2" = {
       name = "_at_rollup_slash_plugin-babel";
       packageName = "@rollup/plugin-babel";
-      version = "5.2.1";
+      version = "5.2.2";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@rollup/plugin-babel/-/plugin-babel-5.2.1.tgz";
-        sha512 = "Jd7oqFR2dzZJ3NWANDyBjwTtX/lYbZpVcmkHrfQcpvawHs9E4c0nYk5U2mfZ6I/DZcIvy506KZJi54XK/jxH7A==";
+        url = "https://registry.npmjs.org/@rollup/plugin-babel/-/plugin-babel-5.2.2.tgz";
+        sha512 = "MjmH7GvFT4TW8xFdIeFS3wqIX646y5tACdxkTO+khbHvS3ZcVJL6vkAHLw2wqPmkhwCfWHoNsp15VYNwW6JEJA==";
       };
     };
     "@rollup/plugin-commonjs-13.0.2" = {
@@ -4900,6 +4918,15 @@ let
         sha512 = "CWr7a3rTVrN5Vs8GYReRAvTourbXHOqB1zglcskj05ICH4GZL5BOAza2ARai+qc3Nz0nY08Bozi1x0014KOqlg==";
       };
     };
+    "@snyk/cli-interface-2.11.0" = {
+      name = "_at_snyk_slash_cli-interface";
+      packageName = "@snyk/cli-interface";
+      version = "2.11.0";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/@snyk/cli-interface/-/cli-interface-2.11.0.tgz";
+        sha512 = "T3xfDqrEFKclHGdJx4/5+D5F7e76/99f33guE4RTlVITBhy7VVnjz4t/NDr3UYqcC0MgAmiC4bSVYHnlshuwJw==";
+      };
+    };
     "@snyk/cli-interface-2.9.1" = {
       name = "_at_snyk_slash_cli-interface";
       packageName = "@snyk/cli-interface";
@@ -4909,15 +4936,6 @@ let
         sha512 = "2zHRvEt4S0DO+hPRX3hp5ssELouJqgb/JUTmPDMr/32r//qooSTxojwSvAK2A6VYgYOHuo1S3VTpsSP/ywkPXA==";
       };
     };
-    "@snyk/cli-interface-2.9.2" = {
-      name = "_at_snyk_slash_cli-interface";
-      packageName = "@snyk/cli-interface";
-      version = "2.9.2";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/@snyk/cli-interface/-/cli-interface-2.9.2.tgz";
-        sha512 = "C64bGtcQbh7941l7qgXFJ+FJIZdQtBHkPhKfGtUlCCMbC0FK0oaUmp6d7YPQxT4dEnkQdtlBT/eA2F6qIKbEng==";
-      };
-    };
     "@snyk/cocoapods-lockfile-parser-3.5.2" = {
       name = "_at_snyk_slash_cocoapods-lockfile-parser";
       packageName = "@snyk/cocoapods-lockfile-parser";
@@ -5143,13 +5161,13 @@ let
         sha512 = "PyRA9sm1Yayuj5OIoJ1hGt2YISX45w9WcFbh6ddT0Z/0yaFxOtGLInr4jUfU1EAFVs0Yfyfev4RNwBlUaHdlDQ==";
       };
     };
-    "@tencent-sdk/capi-1.1.6" = {
+    "@tencent-sdk/capi-1.1.8" = {
       name = "_at_tencent-sdk_slash_capi";
       packageName = "@tencent-sdk/capi";
-      version = "1.1.6";
+      version = "1.1.8";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@tencent-sdk/capi/-/capi-1.1.6.tgz";
-        sha512 = "3Ietq/r8B/CQu94qXr4YrNE79p5emhtMI6szHh/cD9xz1/6OOUwW/agcCO1748v94jjxOFEspAvva6jGVriuGA==";
+        url = "https://registry.npmjs.org/@tencent-sdk/capi/-/capi-1.1.8.tgz";
+        sha512 = "AmyMQndtxMsM59eDeA0gGiw8T2LzNvDhx/xl+ygFXXrsw+yb/mit73ndHkiHKcRA1EpNHTyD1PN9ATxghzplfg==";
       };
     };
     "@textlint/ast-node-types-4.3.4" = {
@@ -5872,13 +5890,13 @@ let
         sha512 = "JCcp6J0GV66Y4ZMDAQCXot4xprYB+Zfd3meK9+INSJeVZwJmHAW30BBEEkPzXswMXuiyReUGOP3GxrADc9wPww==";
       };
     };
-    "@types/jscodeshift-0.7.1" = {
+    "@types/jscodeshift-0.7.2" = {
       name = "_at_types_slash_jscodeshift";
       packageName = "@types/jscodeshift";
-      version = "0.7.1";
+      version = "0.7.2";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@types/jscodeshift/-/jscodeshift-0.7.1.tgz";
-        sha512 = "4jkASx74qGl2OUK8NNFEq10QP0MXriOIqeBeNb1IdevHP8k8VDqS5Uv6nIixAA6ZUjjF6/SwOvecrjXkbcaFzw==";
+        url = "https://registry.npmjs.org/@types/jscodeshift/-/jscodeshift-0.7.2.tgz";
+        sha512 = "k4ih8ayQ65e26vhCxeMTKtZ808DzC0RFQ4unBvPEy9bcFhS4aPm3oXgWWZNmZ4u+H2WzHQDCNrRC5iNX+afiZw==";
       };
     };
     "@types/json-schema-7.0.6" = {
@@ -6088,13 +6106,13 @@ let
         sha512 = "fh+pAqt4xRzPfqA6eh3Z2y6fyZavRIumvjhaCL753+TVkGKGhpPeyrJG2JftD0T9q4GF00KjefsQ+PQNDdWQaQ==";
       };
     };
-    "@types/node-10.17.47" = {
+    "@types/node-10.17.48" = {
       name = "_at_types_slash_node";
       packageName = "@types/node";
-      version = "10.17.47";
+      version = "10.17.48";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@types/node/-/node-10.17.47.tgz";
-        sha512 = "YZ1mMAdUPouBZCdeugjV8y1tqqr28OyL8DYbH5ePCfe9zcXtvbh1wDBy7uzlHkXo3Qi07kpzXfvycvrkby/jXw==";
+        url = "https://registry.npmjs.org/@types/node/-/node-10.17.48.tgz";
+        sha512 = "Agl6xbYP6FOMDeAsr3QVZ+g7Yzg0uhPHWx0j5g4LFdUBHVtqtU+gH660k/lCEe506jJLOGbEzsnqPDTZGJQLag==";
       };
     };
     "@types/node-12.7.12" = {
@@ -6106,13 +6124,13 @@ let
         sha512 = "KPYGmfD0/b1eXurQ59fXD1GBzhSQfz6/lKBxkaHX9dKTzjXbK68Zt7yGUxUsCS1jeTy/8aL+d9JEr+S54mpkWQ==";
       };
     };
-    "@types/node-13.13.33" = {
+    "@types/node-13.13.34" = {
       name = "_at_types_slash_node";
       packageName = "@types/node";
-      version = "13.13.33";
+      version = "13.13.34";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@types/node/-/node-13.13.33.tgz";
-        sha512 = "1B3GM1yuYsFyEvBb+ljBqWBOylsWDYioZ5wpu8AhXdIhq20neXS7eaSC8GkwHE0yQYGiOIV43lMsgRYTgKZefQ==";
+        url = "https://registry.npmjs.org/@types/node/-/node-13.13.34.tgz";
+        sha512 = "g8D1HF2dMDKYSDl5+79izRwRgNPsSynmWMbj50mj7GZ0b7Lv4p8EmZjbo3h0h+6iLr6YmVz9VnF6XVZ3O6V1Ug==";
       };
     };
     "@types/node-14.11.1" = {
@@ -10030,13 +10048,13 @@ let
         sha512 = "+KBkqH7t/XE91Fqn8eyJeNIWsnhSWL8bSUqFD7TfE3FN07MTlC0nprGYp+2WfcYNz5i8Bus1vY2DHNVhtTImnw==";
       };
     };
-    "aws-sdk-2.799.0" = {
+    "aws-sdk-2.800.0" = {
       name = "aws-sdk";
       packageName = "aws-sdk";
-      version = "2.799.0";
+      version = "2.800.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/aws-sdk/-/aws-sdk-2.799.0.tgz";
-        sha512 = "NYAoiNU+bJXhlJsC0rFqrmD5t5ho7/VxldmziP6HLPYHfOCI9Uvk6UVjfPmhLWPm0mHnIxhsHqmsNGyjhHNYmw==";
+        url = "https://registry.npmjs.org/aws-sdk/-/aws-sdk-2.800.0.tgz";
+        sha512 = "1vxT8h2iFFaxfn+onMIdL/L+OcIG6G4BUzRt4wuvQzwbKArRy0fUN2d6E7aoM74wl8VlNIMTxBLCqxDnfVeVxQ==";
       };
     };
     "aws-sign2-0.6.0" = {
@@ -13099,13 +13117,13 @@ let
         sha512 = "bsTwuIg/BZZK/vreVTYYbSWoe2F+71P7K5QGEX+pT250DZbfU1MQ5prOKpPR+LL6uWKK3KMwMCAS74QB3Um1uw==";
       };
     };
-    "caniuse-lite-1.0.30001161" = {
+    "caniuse-lite-1.0.30001164" = {
       name = "caniuse-lite";
       packageName = "caniuse-lite";
-      version = "1.0.30001161";
+      version = "1.0.30001164";
       src = fetchurl {
-        url = "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001161.tgz";
-        sha512 = "JharrCDxOqPLBULF9/SPa6yMcBRTjZARJ6sc3cuKrPfyIk64JN6kuMINWqA99Xc8uElMFcROliwtz0n9pYej+g==";
+        url = "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001164.tgz";
+        sha512 = "G+A/tkf4bu0dSp9+duNiXc7bGds35DioCyC6vgK2m/rjA4Krpy5WeZgZyfH2f0wj2kI6yAWWucyap6oOwmY1mg==";
       };
     };
     "canvas-2.6.1" = {
@@ -19877,13 +19895,13 @@ let
         sha512 = "dldq3ZfFtgVTJMLjOe+/3sROTzALlL9E34V4/sDtUd/KlBSS0s6U1/+WPE1B4sj9CXHJpL1M6rhNJnc9Wbal9w==";
       };
     };
-    "electron-to-chromium-1.3.610" = {
+    "electron-to-chromium-1.3.612" = {
       name = "electron-to-chromium";
       packageName = "electron-to-chromium";
-      version = "1.3.610";
+      version = "1.3.612";
       src = fetchurl {
-        url = "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.3.610.tgz";
-        sha512 = "eFDC+yVQpEhtlapk4CYDPfV9ajF9cEof5TBcO49L1ETO+aYogrKWDmYpZyxBScMNe8Bo/gJamH4amQ4yyvXg4g==";
+        url = "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.3.612.tgz";
+        sha512 = "CdrdX1B6mQqxfw+51MPWB5qA6TKWjza9f5voBtUlRfEZEwZiFaxJLrhFI8zHE9SBAuGt4h84rQU6Ho9Bauo1LA==";
       };
     };
     "electrum-client-git://github.com/janoside/electrum-client" = {
@@ -19923,13 +19941,13 @@ let
         sha1 = "9ac91be6e52fb6e6244c4e54a4ac3ed8ae8e29c0";
       };
     };
-    "elf-tools-1.1.2" = {
-      name = "elf-tools";
-      packageName = "elf-tools";
-      version = "1.1.2";
+    "elf-cam-0.1.1" = {
+      name = "elf-cam";
+      packageName = "elf-cam";
+      version = "0.1.1";
       src = fetchurl {
-        url = "https://registry.npmjs.org/elf-tools/-/elf-tools-1.1.2.tgz";
-        sha512 = "x+p+XNxLk8ittsYN7294mCnQ2i48udu3UGdHBv2gw1u1MVigXctcfbp5H9ebqTJnDxkbs6PdOSBOAdYGGDN7uA==";
+        url = "https://registry.npmjs.org/elf-cam/-/elf-cam-0.1.1.tgz";
+        sha512 = "tKSFTWOp5OwJSp6MKyQDX7umYDkvUuI8rxHXw8BuUQ63d9Trj9xLeo6SHyoTGSoZNNZVitFa+RuHHXuoAzN3Rw==";
       };
     };
     "elfy-1.0.0" = {
@@ -21670,13 +21688,13 @@ let
         sha1 = "a793d3ac0cad4c6ab571e9968fbbab6cb2532929";
       };
     };
-    "expo-pwa-0.0.52" = {
+    "expo-pwa-0.0.54" = {
       name = "expo-pwa";
       packageName = "expo-pwa";
-      version = "0.0.52";
+      version = "0.0.54";
       src = fetchurl {
-        url = "https://registry.npmjs.org/expo-pwa/-/expo-pwa-0.0.52.tgz";
-        sha512 = "LzpcL/nzFrBJqCCEaDOmWx4BfvmQFhAetUSG8/WcyMcTvqTC/WlboK+mlSj0mN5vw1/H/UCMqj6GoT07QIaUWQ==";
+        url = "https://registry.npmjs.org/expo-pwa/-/expo-pwa-0.0.54.tgz";
+        sha512 = "UQtnB/CrjkUfQrRyHmUi3jg/1++fkM2KHTy5DBrexTC0XoXzbJCLMrUTgH2VBtjIVQO9KyApInE53BRcz3ei+Q==";
       };
     };
     "express-2.5.11" = {
@@ -24074,6 +24092,15 @@ let
         sha512 = "3hN7NaskYvMDLQY55gnW3NQ+mesEAepTqlg+VEbj7zzqEMBVNhzcGYYeqFo/TlYz6eQiFcp1HcsCZO+nGgS8zg==";
       };
     };
+    "geoip-country-4.0.44" = {
+      name = "geoip-country";
+      packageName = "geoip-country";
+      version = "4.0.44";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/geoip-country/-/geoip-country-4.0.44.tgz";
+        sha512 = "nC8TqPY7k6ig956peHrNJdjc5bWcIlURKQJKUwq1HdSlgxa4UvGTbbI+9NqxsUZ5Ozgp6NPa5qSU5GMa502kmg==";
+      };
+    };
     "get-amd-module-type-3.0.0" = {
       name = "get-amd-module-type";
       packageName = "get-amd-module-type";
@@ -24713,13 +24740,13 @@ let
         sha512 = "zOZgGGEHPklZNjZQaZ9f41i7F2YwE+tS5ZHrDhbBCk3stwahn5vQxnFmBJZHoYdusR6R1bLSXeGUy/BhctwKzw==";
       };
     };
-    "global-4.3.2" = {
+    "global-4.4.0" = {
       name = "global";
       packageName = "global";
-      version = "4.3.2";
+      version = "4.4.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/global/-/global-4.3.2.tgz";
-        sha1 = "e76989268a6c74c38908b1305b10fc0e394e9d0f";
+        url = "https://registry.npmjs.org/global/-/global-4.4.0.tgz";
+        sha512 = "wv/LAoHdRE3BeTGz53FAamhGlPLhlssK45usmGFThIi4XqnBmjKQ16u+RNbP7WvigRZDxUsM0J3gcQ5yicaL0w==";
       };
     };
     "global-agent-2.1.12" = {
@@ -26992,6 +27019,15 @@ let
         sha1 = "c6019a7595f2cefca702eab694a010bcd9298d20";
       };
     };
+    "iconv-lite-0.5.2" = {
+      name = "iconv-lite";
+      packageName = "iconv-lite";
+      version = "0.5.2";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.5.2.tgz";
+        sha512 = "kERHXvpSaB4aU3eANwidg79K8FlrN77m8G9V+0vOR3HYaRifrlwMEpT7ZBJqLSEIHnEgJTHcWK82wwLwwKwtag==";
+      };
+    };
     "iconv-lite-0.6.2" = {
       name = "iconv-lite";
       packageName = "iconv-lite";
@@ -27865,6 +27901,15 @@ let
         sha512 = "u9YYtb1p2fWSbzpKmZ/b3QXWA+diRYPxc2c4y5lFB/MMk5WZ7wNZv8S3CFcIGVJ5XtlaCAl/FQy/D3eQ2XtdOA==";
       };
     };
+    "ip-address-6.4.0" = {
+      name = "ip-address";
+      packageName = "ip-address";
+      version = "6.4.0";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/ip-address/-/ip-address-6.4.0.tgz";
+        sha512 = "c5uxc2WUTuRBVHT/6r4m7HIr/DfV0bF6DvLH3iZGSK8wp8iMwwZSgIq2do0asFf8q9ECug0SE+6+1ACMe4sorA==";
+      };
+    };
     "ip-regex-2.1.0" = {
       name = "ip-regex";
       packageName = "ip-regex";
@@ -28099,13 +28144,13 @@ let
         sha1 = "f02ad0259a0921cd199ff21ce1b09e0f6b4e3929";
       };
     };
-    "is-bigint-1.0.0" = {
+    "is-bigint-1.0.1" = {
       name = "is-bigint";
       packageName = "is-bigint";
-      version = "1.0.0";
+      version = "1.0.1";
       src = fetchurl {
-        url = "https://registry.npmjs.org/is-bigint/-/is-bigint-1.0.0.tgz";
-        sha512 = "t5mGUXC/xRheCK431ylNiSkGGpBp8bHENBcENTkDT6ppwPzEVxNGZRvgvmOEfbWkFhA7D2GEuE2mmQTr78sl2g==";
+        url = "https://registry.npmjs.org/is-bigint/-/is-bigint-1.0.1.tgz";
+        sha512 = "J0ELF4yHFxHy0cmSxZuheDOz2luOdVvqjwmEcj8H/L1JHeuEDSDbeRP+Dk9kFVk5RTFzbucJ2Kb9F7ixY2QaCg==";
       };
     };
     "is-binary-path-1.0.1" = {
@@ -29809,13 +29854,13 @@ let
         sha1 = "bcb4045c8dd0539c134bc1488cdd3e768a7a9e51";
       };
     };
-    "jquery.terminal-2.20.0" = {
+    "jquery.terminal-2.20.1" = {
       name = "jquery.terminal";
       packageName = "jquery.terminal";
-      version = "2.20.0";
+      version = "2.20.1";
       src = fetchurl {
-        url = "https://registry.npmjs.org/jquery.terminal/-/jquery.terminal-2.20.0.tgz";
-        sha512 = "8Wq9i5mwj8MnkFHEFZebn+l4K4HEsRXSanrQwq/u6lEP39/44b1vJzmYsqJLq57JALrY6Cp9b5fC4hMlWhi1Zw==";
+        url = "https://registry.npmjs.org/jquery.terminal/-/jquery.terminal-2.20.1.tgz";
+        sha512 = "XDXH/psm0BquAmQEwomn1g9lYBGS/P6laRgWC/gADi6eJjEBWeyuiP9F5nzoEVhEa2VDnEYbvfm/MBA5DcrvdA==";
       };
     };
     "js-base64-2.6.4" = {
@@ -30367,6 +30412,15 @@ let
         sha512 = "H8jvkz1O50L3dMZCsLqiuB2tA7muqbSg1AtGEkN0leAqGjsUzDJir3Zwr02BhqdcITPg3ei3mZ+HjMocAknhhg==";
       };
     };
+    "jsonc-parser-3.0.0" = {
+      name = "jsonc-parser";
+      packageName = "jsonc-parser";
+      version = "3.0.0";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/jsonc-parser/-/jsonc-parser-3.0.0.tgz";
+        sha512 = "fQzRfAbIBnR0IQvftw9FJveWiHp72Fg20giDrHz6TdfB12UH/uue0D3hm57UB5KgAVuniLMCaS8P1IMj9NR7cA==";
+      };
+    };
     "jsonfile-1.0.1" = {
       name = "jsonfile";
       packageName = "jsonfile";
@@ -32501,6 +32555,15 @@ let
         sha1 = "668b1d4981603ae1cc5a6fa760143e480b4c4ace";
       };
     };
+    "lodash.find-4.6.0" = {
+      name = "lodash.find";
+      packageName = "lodash.find";
+      version = "4.6.0";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/lodash.find/-/lodash.find-4.6.0.tgz";
+        sha1 = "cb0704d47ab71789ffa0de8b97dd926fb88b13b1";
+      };
+    };
     "lodash.findkey-4.6.0" = {
       name = "lodash.findkey";
       packageName = "lodash.findkey";
@@ -32843,6 +32906,15 @@ let
         sha1 = "771ec7839e3473d9c4cde28b19394c3562f4f6d3";
       };
     };
+    "lodash.max-4.0.1" = {
+      name = "lodash.max";
+      packageName = "lodash.max";
+      version = "4.0.1";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/lodash.max/-/lodash.max-4.0.1.tgz";
+        sha1 = "8735566c618b35a9f760520b487ae79658af136a";
+      };
+    };
     "lodash.memoize-3.0.4" = {
       name = "lodash.memoize";
       packageName = "lodash.memoize";
@@ -36461,13 +36533,13 @@ let
         sha512 = "1qstj9z5+x491jfiC4Nelk+f8XBad7LN20PmyWINJEMRSf3wcAjAWysw1qaA8z6NSKe2sjq1hRSDpBH5paCb6A==";
       };
     };
-    "nanoid-3.1.18" = {
+    "nanoid-3.1.20" = {
       name = "nanoid";
       packageName = "nanoid";
-      version = "3.1.18";
+      version = "3.1.20";
       src = fetchurl {
-        url = "https://registry.npmjs.org/nanoid/-/nanoid-3.1.18.tgz";
-        sha512 = "rndlDjbbHbcV3xi+R2fpJ+PbGMdfBxz5v1fATIQFq0DP64FsicQdwnKLy47K4kZHdRpmQXtz24eGsxQqamzYTA==";
+        url = "https://registry.npmjs.org/nanoid/-/nanoid-3.1.20.tgz";
+        sha512 = "a1cQNyczgKbLX9jwbS/+d7W8fX/RfgYR7lVWwWOGIPNgK2m0MWvrGF6/m4kk6U3QcFMnZf3RIhL0v2Jgh/0Uxw==";
       };
     };
     "nanolru-1.0.0" = {
@@ -36668,13 +36740,13 @@ let
         sha1 = "ae603b36b134bcec347b452422b0bf98d5832ec8";
       };
     };
-    "nearley-2.19.8" = {
+    "nearley-2.19.9" = {
       name = "nearley";
       packageName = "nearley";
-      version = "2.19.8";
+      version = "2.19.9";
       src = fetchurl {
-        url = "https://registry.npmjs.org/nearley/-/nearley-2.19.8.tgz";
-        sha512 = "te4JCrxbzLvVqUWfVOASgsbkWaFvJ6JlHTRQzfnU862bnyHGHEGX2s5OYvLAS4NDPmQvRtC2tBdV6THy6xHFyQ==";
+        url = "https://registry.npmjs.org/nearley/-/nearley-2.19.9.tgz";
+        sha512 = "KpCXvcVWPmZrEs95tIkqWi+CgL48O8CJDVDgY/AQGWXR1O8KQPHt5iQrTLior0k0v3PGKIV2xPi879wR1sawwg==";
       };
     };
     "neat-csv-2.1.0" = {
@@ -38327,13 +38399,13 @@ let
         sha512 = "a7pEHdh1xKIAgTySUGgLMx/xwDZskN1Ud6egYYN3EdRW4ZMPNEDUTF+hwy2LUC+Bl+SyLXANnwz/jyh/qutKUw==";
       };
     };
-    "object-inspect-1.8.0" = {
+    "object-inspect-1.9.0" = {
       name = "object-inspect";
       packageName = "object-inspect";
-      version = "1.8.0";
+      version = "1.9.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/object-inspect/-/object-inspect-1.8.0.tgz";
-        sha512 = "jLdtEOB112fORuypAyl/50VRVIBIdVQOSUUGQHzJ4xBSbit81zRarz7GThkEFZy1RceYrWYcPcBFPQwHyAc1gA==";
+        url = "https://registry.npmjs.org/object-inspect/-/object-inspect-1.9.0.tgz";
+        sha512 = "i3Bp9iTqwhaLZBxGkRfo5ZbE07BQRT7MGu8+nNgwW9ItGp1TzCTw2DLEoWwjClxBjOFI/hWljTAmYGCEwmtnOw==";
       };
     };
     "object-is-1.1.4" = {
@@ -42018,13 +42090,13 @@ let
         sha512 = "rBkDbaHAu5uywbCR2XE8a25tats3xSOsGNx6mppK6Q9kSFGKc/FyAzfci+fWM2l+K402p1D0pNcfDGxeje5IKg==";
       };
     };
-    "postcss-reporter-7.0.1" = {
+    "postcss-reporter-7.0.2" = {
       name = "postcss-reporter";
       packageName = "postcss-reporter";
-      version = "7.0.1";
+      version = "7.0.2";
       src = fetchurl {
-        url = "https://registry.npmjs.org/postcss-reporter/-/postcss-reporter-7.0.1.tgz";
-        sha512 = "R9AK80KIqqMb+lwGRBcRkXS7r96VCTxrZvvrfibyA/dWjqctwx7leHMCC05A9HbW8PnChwOWwrmISwp5HQu5wg==";
+        url = "https://registry.npmjs.org/postcss-reporter/-/postcss-reporter-7.0.2.tgz";
+        sha512 = "JyQ96NTQQsso42y6L1H1RqHfWH1C3Jr0pt91mVv5IdYddZAE9DUZxuferNgk6q0o6vBVOrfVJb10X1FgDzjmDw==";
       };
     };
     "postcss-resolve-nested-selector-0.1.1" = {
@@ -42351,13 +42423,13 @@ let
         sha512 = "s7PoyDv/II1ObgQunCbB9PdLmUcBZcnWOcxDh7O0N/UwDEsHyqkW+Qh28jW+mVuCdx7gLB0BotYI1Y6uI9iyew==";
       };
     };
-    "prettier-2.2.0" = {
+    "prettier-2.2.1" = {
       name = "prettier";
       packageName = "prettier";
-      version = "2.2.0";
+      version = "2.2.1";
       src = fetchurl {
-        url = "https://registry.npmjs.org/prettier/-/prettier-2.2.0.tgz";
-        sha512 = "yYerpkvseM4iKD/BXLYUkQV5aKt4tQPqaGW6EsZjzyu0r7sVZZNPJW4Y8MyKmicp6t42XUPcBVA+H6sB3gqndw==";
+        url = "https://registry.npmjs.org/prettier/-/prettier-2.2.1.tgz";
+        sha512 = "PqyhM2yCjg/oKkFPtTGUojv7gnZAoG80ttl45O6x2Ug/rMJw4wcc9k6aaf2hibP7BGVCCM33gZoGjyvt9mm16Q==";
       };
     };
     "prettier-bytes-1.0.4" = {
@@ -42621,15 +42693,6 @@ let
         sha1 = "7332300e840161bda3e69a1d1d91a7d4bc16f182";
       };
     };
-    "process-0.5.2" = {
-      name = "process";
-      packageName = "process";
-      version = "0.5.2";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/process/-/process-0.5.2.tgz";
-        sha1 = "1638d8a8e34c2f440a91db95ab9aeb677fc185cf";
-      };
-    };
     "process-es6-0.11.6" = {
       name = "process-es6";
       packageName = "process-es6";
@@ -45006,13 +45069,13 @@ let
         sha1 = "52ed09dacac108f1a631c07e9b69941e7a19504b";
       };
     };
-    "redoc-2.0.0-rc.47" = {
+    "redoc-2.0.0-rc.48" = {
       name = "redoc";
       packageName = "redoc";
-      version = "2.0.0-rc.47";
+      version = "2.0.0-rc.48";
       src = fetchurl {
-        url = "https://registry.npmjs.org/redoc/-/redoc-2.0.0-rc.47.tgz";
-        sha512 = "weoRsJngABqWOuign5wXqVHLE0WRpODNQqwsZqtdKqCQ/paLxJRMBqSklAQdUnx4x5SEYvLxXatUGnw1mp2o4g==";
+        url = "https://registry.npmjs.org/redoc/-/redoc-2.0.0-rc.48.tgz";
+        sha512 = "shArJWhNG2gQ0XKxW8WcfG8peNOtxbZ86CqxgrR9P7MnE5ESAo559CH/PSlezePeVLpcC0C9tcimOfSN5MaAvA==";
       };
     };
     "reduce-component-1.0.1" = {
@@ -46365,13 +46428,13 @@ let
         sha512 = "/2HA0Ec70TvQnXdzynFffkjA6XN+1e2pEv/uKS5Ulca40g2L7KuOE3riasHoNVHOsFD5KKZgDsMk1CP3Tw9s+A==";
       };
     };
-    "rollup-2.33.3" = {
+    "rollup-2.34.0" = {
       name = "rollup";
       packageName = "rollup";
-      version = "2.33.3";
+      version = "2.34.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/rollup/-/rollup-2.33.3.tgz";
-        sha512 = "RpayhPTe4Gu/uFGCmk7Gp5Z9Qic2VsqZ040G+KZZvsZYdcuWaJg678JeDJJvJeEQXminu24a2au+y92CUWVd+w==";
+        url = "https://registry.npmjs.org/rollup/-/rollup-2.34.0.tgz";
+        sha512 = "dW5iLvttZzdVehjEuNJ1bWvuMEJjOWGmnuFS82WeKHTGXDkRHQeq/ExdifkSyJv9dLcR86ysKRmrIDyR6O0X8g==";
       };
     };
     "rollup-plugin-babel-4.4.0" = {
@@ -48381,13 +48444,13 @@ let
         sha512 = "FAM56z3bl1iuxeqkCEA/jyZ2hpwkQK8xQxQbhR+QppEK5lole7w1PQyWYgZAJ9oRY/BU32zdRAJwGuZbhk7G2Q==";
       };
     };
-    "snyk-gradle-plugin-3.10.2" = {
+    "snyk-gradle-plugin-3.10.3" = {
       name = "snyk-gradle-plugin";
       packageName = "snyk-gradle-plugin";
-      version = "3.10.2";
+      version = "3.10.3";
       src = fetchurl {
-        url = "https://registry.npmjs.org/snyk-gradle-plugin/-/snyk-gradle-plugin-3.10.2.tgz";
-        sha512 = "gTFKL0BLUN54asUQ4OIoa4lATGn27VZwWDJGQ0VuqSaaoy8I5W16Cbn/KN95oIKa7tgwrmasPLd5uviFWzo/Qw==";
+        url = "https://registry.npmjs.org/snyk-gradle-plugin/-/snyk-gradle-plugin-3.10.3.tgz";
+        sha512 = "aFAqQu0vvgndxQtXxNfLzL9wamOwyRceRkSb+BXVp6E+Tpz4awksyUTfV0Yc5WjR0+hYB2rtBYKHXaK+GHficg==";
       };
     };
     "snyk-module-1.9.1" = {
@@ -49101,13 +49164,13 @@ let
         sha512 = "cbqHunsQWnJNE6KhVSMsMeH5H/L9EpymbzqTQ3uLwNCLZ1Q481oWaofqH7nO6V07xlXwY6PhQdQ2IedWx/ZK4Q==";
       };
     };
-    "spdx-license-ids-3.0.6" = {
+    "spdx-license-ids-3.0.7" = {
       name = "spdx-license-ids";
       packageName = "spdx-license-ids";
-      version = "3.0.6";
+      version = "3.0.7";
       src = fetchurl {
-        url = "https://registry.npmjs.org/spdx-license-ids/-/spdx-license-ids-3.0.6.tgz";
-        sha512 = "+orQK83kyMva3WyPf59k1+Y525csj5JejicWut55zeTWANuN17qSiSLUXWtzHeNWORSvT7GLDJ/E/XiIWoXBTw==";
+        url = "https://registry.npmjs.org/spdx-license-ids/-/spdx-license-ids-3.0.7.tgz";
+        sha512 = "U+MTEOO0AiDzxwFvoa4JVnMV6mZlJKk2sBLt90s7G0Gd0Mlknc7kxEn3nuDPNZRta7O2uy8oLcZLVT+4sqNZHQ==";
       };
     };
     "spdy-1.32.5" = {
@@ -51477,13 +51540,13 @@ let
         sha512 = "YPPlu67mdnHGTup2A8ff7BC2Pjq0e0Yp/IyTFN03zWO0RcK07uLcbi7C2KpGR2FvWbaB0+bfE27a+sBKebSo7w==";
       };
     };
-    "systeminformation-4.30.6" = {
+    "systeminformation-4.30.10" = {
       name = "systeminformation";
       packageName = "systeminformation";
-      version = "4.30.6";
+      version = "4.30.10";
       src = fetchurl {
-        url = "https://registry.npmjs.org/systeminformation/-/systeminformation-4.30.6.tgz";
-        sha512 = "NV7zo9NU7fWSuiCORZmMLe90cFrrTS6jfalrQ0/5B7JGQ2ei15c2gmfICBwWdmviyv/FXAFVReySxOtDDkppqw==";
+        url = "https://registry.npmjs.org/systeminformation/-/systeminformation-4.30.10.tgz";
+        sha512 = "BndDV7hjRomUGkHK6MO661KUUWcDRbr5SlepDvREidYnR2QJIyHln0iSysH9GPOT7YJgwtswdyg/up/ZFYxHrQ==";
       };
     };
     "syswide-cas-5.3.0" = {
@@ -53899,13 +53962,13 @@ let
         sha512 = "oASI1FOJ7BBFkSCNDZ446EgkSuHkOZBuqRFrwXIKWCoXw8ZXQETooTQjkAcBS03Acab7ubCKsXnwuV2svy061g==";
       };
     };
-    "uglify-js-3.12.0" = {
+    "uglify-js-3.12.1" = {
       name = "uglify-js";
       packageName = "uglify-js";
-      version = "3.12.0";
+      version = "3.12.1";
       src = fetchurl {
-        url = "https://registry.npmjs.org/uglify-js/-/uglify-js-3.12.0.tgz";
-        sha512 = "8lBMSkFZuAK7gGF8LswsXmir8eX8d2AAMOnxSDWjKBx/fBR6MypQjs78m6ML9zQVp1/hD4TBdfeMZMC7nW1TAA==";
+        url = "https://registry.npmjs.org/uglify-js/-/uglify-js-3.12.1.tgz";
+        sha512 = "o8lHP20KjIiQe5b/67Rh68xEGRrc2SRsCuuoYclXXoC74AfSRGblU1HKzJWH3HxPZ+Ort85fWHpSX7KwBUC9CQ==";
       };
     };
     "uglify-js-3.4.10" = {
@@ -54493,13 +54556,13 @@ let
         sha512 = "sVZZX3+kspVNmLWBPAB6r+7D9ZgAFPNWm66f7YNb420RlQSbn+n8rG8dGZSkrER7ZIXGQYNm5pqC3v3HopH24A==";
       };
     };
-    "unist-util-is-4.0.3" = {
+    "unist-util-is-4.0.4" = {
       name = "unist-util-is";
       packageName = "unist-util-is";
-      version = "4.0.3";
+      version = "4.0.4";
       src = fetchurl {
-        url = "https://registry.npmjs.org/unist-util-is/-/unist-util-is-4.0.3.tgz";
-        sha512 = "bTofCFVx0iQM8Jqb1TBDVRIQW03YkD3p66JOd/aCWuqzlLyUtx1ZAGw/u+Zw+SttKvSVcvTiKYbfrtLoLefykw==";
+        url = "https://registry.npmjs.org/unist-util-is/-/unist-util-is-4.0.4.tgz";
+        sha512 = "3dF39j/u423v4BBQrk1AQ2Ve1FxY5W3JKwXxVFzBODQ6WEvccguhgp802qQLKSnxPODE6WuRZtV+ohlUg4meBA==";
       };
     };
     "unist-util-map-1.0.5" = {
@@ -56375,13 +56438,13 @@ let
         sha512 = "RWkO/c/A7iXhHEy3OuEqkCqavDjpD4NF2Ca8vjai+ZtEYNeHrm1ybTnBYLP4Ft1uXvvaaVtYA9HrDjD6+CUONg==";
       };
     };
-    "vscode-css-languageservice-4.3.5" = {
+    "vscode-css-languageservice-4.4.0" = {
       name = "vscode-css-languageservice";
       packageName = "vscode-css-languageservice";
-      version = "4.3.5";
+      version = "4.4.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/vscode-css-languageservice/-/vscode-css-languageservice-4.3.5.tgz";
-        sha512 = "g9Pjxt9T32jhY0nTOo7WRFm0As27IfdaAxcFa8c7Rml1ZqBn3XXbkExjzxY7sBWYm7I1Tp4dK6UHXHoUQHGwig==";
+        url = "https://registry.npmjs.org/vscode-css-languageservice/-/vscode-css-languageservice-4.4.0.tgz";
+        sha512 = "jWi+297PJUUWTHwlcrZz0zIuEXuHOBJIQMapXmEzbosWGv/gMnNSAMV4hTKnl5wzxvZKZzV6j+WFdrSlKQ5qnw==";
       };
     };
     "vscode-debugadapter-testsupport-1.42.0" = {
@@ -56420,13 +56483,13 @@ let
         sha512 = "mIb5VMXM5jI97HzCk2eadI1K//rCEZXte0wBqA7PGXsyJH4KTyJUaYk9MR+mbfpUl2vMi3HZw9GUOLGYLc6l5w==";
       };
     };
-    "vscode-json-languageservice-3.10.0" = {
+    "vscode-json-languageservice-3.11.0" = {
       name = "vscode-json-languageservice";
       packageName = "vscode-json-languageservice";
-      version = "3.10.0";
+      version = "3.11.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/vscode-json-languageservice/-/vscode-json-languageservice-3.10.0.tgz";
-        sha512 = "8IvuRSQnjznu+obqy6Dy4S4H68Ke7a3Kb+A0FcdctyAMAWEnrORpCpMOMqEYiPLm/OTYLVWJ7ql3qToDTozu4w==";
+        url = "https://registry.npmjs.org/vscode-json-languageservice/-/vscode-json-languageservice-3.11.0.tgz";
+        sha512 = "QxI+qV97uD7HHOCjh3MrM1TfbdwmTXrMckri5Tus1/FQiG3baDZb2C9Y0y8QThs7PwHYBIQXcAc59ZveCRZKPA==";
       };
     };
     "vscode-json-languageservice-3.8.4" = {
@@ -58301,13 +58364,13 @@ let
         sha1 = "f82d2fedee63af76687b70115ce6274dc71310e9";
       };
     };
-    "xhr-2.5.0" = {
+    "xhr-2.6.0" = {
       name = "xhr";
       packageName = "xhr";
-      version = "2.5.0";
+      version = "2.6.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/xhr/-/xhr-2.5.0.tgz";
-        sha512 = "4nlO/14t3BNUZRXIXfXe+3N6w3s1KoxcJUUURctd64BLRe67E4gRwp4PjywtDY72fXpZ1y6Ch0VZQRY/gMPzzQ==";
+        url = "https://registry.npmjs.org/xhr/-/xhr-2.6.0.tgz";
+        sha512 = "/eCGLb5rxjx5e3mF1A7s+pLlR6CGyqWN91fv1JgER5mVWg1MZmlhBvy9kjcsOdRk8RrIujotWyJamfyrp+WIcA==";
       };
     };
     "xml-1.0.1" = {
@@ -58725,13 +58788,13 @@ let
         sha1 = "6d15fba884c08679c0d77e88e7759e811e07fa41";
       };
     };
-    "y18n-4.0.0" = {
+    "y18n-4.0.1" = {
       name = "y18n";
       packageName = "y18n";
-      version = "4.0.0";
+      version = "4.0.1";
       src = fetchurl {
-        url = "https://registry.npmjs.org/y18n/-/y18n-4.0.0.tgz";
-        sha512 = "r9S/ZyXu/Xu9q1tYlpsLIsa3EeLXXk0VwlxqTcFRfg9EhMW+17kbt9G0NrgCmhGb5vT2hyhJZLfDGx+7+5Uj/w==";
+        url = "https://registry.npmjs.org/y18n/-/y18n-4.0.1.tgz";
+        sha512 = "wNcy4NvjMYL8gogWWYAO7ZFWFfHcbdbE57tZO8e4cbpj8tfUcwrwqSl3ad8HxpYWCdXcJUCeKKZS62Av1affwQ==";
       };
     };
     "y18n-5.0.5" = {
@@ -59593,7 +59656,7 @@ in
       sources."spdx-correct-3.1.1"
       sources."spdx-exceptions-2.3.0"
       sources."spdx-expression-parse-3.0.1"
-      sources."spdx-license-ids-3.0.6"
+      sources."spdx-license-ids-3.0.7"
       sources."sshpk-1.16.1"
       sources."ssri-6.0.1"
       sources."stream-each-1.2.3"
@@ -59638,7 +59701,7 @@ in
       sources."which-1.3.1"
       sources."wrappy-1.0.2"
       sources."xtend-4.0.2"
-      sources."y18n-4.0.0"
+      sources."y18n-4.0.1"
       sources."yallist-4.0.0"
     ];
     buildInputs = globalBuildInputs;
@@ -59967,7 +60030,7 @@ in
         ];
       })
       sources."to-utf8-0.0.1"
-      sources."uglify-js-3.12.0"
+      sources."uglify-js-3.12.1"
       sources."unc-path-regex-0.1.2"
       sources."unique-stream-2.3.1"
       sources."universalify-0.1.2"
@@ -60258,7 +60321,7 @@ in
       sources."browserslist-4.14.7"
       sources."buffer-from-1.1.1"
       sources."callsites-3.1.0"
-      sources."caniuse-lite-1.0.30001161"
+      sources."caniuse-lite-1.0.30001164"
       sources."chalk-3.0.0"
       sources."chardet-0.7.0"
       sources."chokidar-3.4.3"
@@ -60279,7 +60342,7 @@ in
       sources."cross-spawn-7.0.3"
       sources."deepmerge-4.2.2"
       sources."defaults-1.0.3"
-      sources."electron-to-chromium-1.3.610"
+      sources."electron-to-chromium-1.3.612"
       sources."emoji-regex-8.0.0"
       sources."end-of-stream-1.4.4"
       sources."enhanced-resolve-4.3.0"
@@ -60523,7 +60586,7 @@ in
       sources."@apollo/federation-0.20.4"
       (sources."@apollo/protobufjs-1.0.5" // {
         dependencies = [
-          sources."@types/node-10.17.47"
+          sources."@types/node-10.17.48"
         ];
       })
       sources."@apollographql/apollo-tools-0.4.8"
@@ -60834,7 +60897,7 @@ in
       sources."@types/http-assert-1.5.1"
       sources."@types/http-errors-1.8.0"
       sources."@types/inquirer-6.5.0"
-      (sources."@types/jscodeshift-0.7.1" // {
+      (sources."@types/jscodeshift-0.7.2" // {
         dependencies = [
           sources."ast-types-0.12.1"
           sources."recast-0.17.2"
@@ -61088,7 +61151,7 @@ in
       sources."callsites-2.0.0"
       sources."camel-case-4.1.1"
       sources."camelcase-4.1.0"
-      sources."caniuse-lite-1.0.30001161"
+      sources."caniuse-lite-1.0.30001164"
       sources."capital-case-1.0.3"
       sources."capture-stack-trace-1.0.1"
       sources."cardinal-2.1.1"
@@ -61297,7 +61360,7 @@ in
       sources."ecc-jsbn-0.1.2"
       sources."ee-first-1.1.1"
       sources."ejs-2.7.4"
-      sources."electron-to-chromium-1.3.610"
+      sources."electron-to-chromium-1.3.612"
       sources."elegant-spinner-1.0.1"
       sources."emoji-regex-8.0.0"
       sources."emojis-list-3.0.0"
@@ -61817,7 +61880,7 @@ in
           sources."kind-of-3.2.2"
         ];
       })
-      sources."object-inspect-1.8.0"
+      sources."object-inspect-1.9.0"
       sources."object-keys-1.1.1"
       sources."object-path-0.11.5"
       sources."object-treeify-1.1.30"
@@ -62089,7 +62152,7 @@ in
       sources."spdx-correct-3.1.1"
       sources."spdx-exceptions-2.3.0"
       sources."spdx-expression-parse-3.0.1"
-      sources."spdx-license-ids-3.0.6"
+      sources."spdx-license-ids-3.0.7"
       (sources."split-string-3.1.0" // {
         dependencies = [
           sources."extend-shallow-3.0.2"
@@ -62333,7 +62396,7 @@ in
       sources."xmlbuilder-11.0.1"
       sources."xss-1.0.8"
       sources."xtend-4.0.2"
-      sources."y18n-4.0.0"
+      sources."y18n-4.0.1"
       sources."yallist-2.1.2"
       (sources."yaml-front-matter-3.4.1" // {
         dependencies = [
@@ -63004,7 +63067,7 @@ in
       sources."spdx-correct-3.1.1"
       sources."spdx-exceptions-2.3.0"
       sources."spdx-expression-parse-3.0.1"
-      sources."spdx-license-ids-3.0.6"
+      sources."spdx-license-ids-3.0.7"
       sources."sprintf-js-1.0.3"
       sources."strip-bom-2.0.0"
       sources."strip-indent-1.0.1"
@@ -63163,7 +63226,7 @@ in
       sources."mkdirp-classic-0.5.3"
       sources."module-deps-6.2.3"
       sources."object-assign-4.1.1"
-      sources."object-inspect-1.8.0"
+      sources."object-inspect-1.9.0"
       sources."object-keys-1.1.1"
       sources."object.assign-4.1.2"
       sources."once-1.4.0"
@@ -63626,7 +63689,7 @@ in
       sources."spdx-correct-3.1.1"
       sources."spdx-exceptions-2.3.0"
       sources."spdx-expression-parse-3.0.1"
-      sources."spdx-license-ids-3.0.6"
+      sources."spdx-license-ids-3.0.7"
       sources."sprintf-js-1.0.3"
       sources."sshpk-1.16.1"
       sources."standard-error-1.1.0"
@@ -63676,7 +63739,7 @@ in
       sources."wordwrap-0.0.2"
       sources."wrap-ansi-5.1.0"
       sources."wrappy-1.0.2"
-      sources."y18n-4.0.0"
+      sources."y18n-4.0.1"
       sources."yallist-3.1.1"
       (sources."yargs-3.10.0" // {
         dependencies = [
@@ -63715,7 +63778,7 @@ in
       sources."@protobufjs/pool-1.1.0"
       sources."@protobufjs/utf8-1.1.0"
       sources."@types/long-4.0.1"
-      sources."@types/node-13.13.33"
+      sources."@types/node-13.13.34"
       sources."addr-to-ip-port-1.5.1"
       sources."airplay-js-0.2.16"
       sources."ajv-6.12.6"
@@ -64040,7 +64103,7 @@ in
       sources."spdx-correct-3.1.1"
       sources."spdx-exceptions-2.3.0"
       sources."spdx-expression-parse-3.0.1"
-      sources."spdx-license-ids-3.0.6"
+      sources."spdx-license-ids-3.0.7"
       sources."speedometer-0.1.4"
       sources."srt2vtt-1.3.1"
       sources."sshpk-1.16.1"
@@ -64465,10 +64528,10 @@ in
   coc-lists = nodeEnv.buildNodePackage {
     name = "coc-lists";
     packageName = "coc-lists";
-    version = "1.3.14";
+    version = "1.3.16";
     src = fetchurl {
-      url = "https://registry.npmjs.org/coc-lists/-/coc-lists-1.3.14.tgz";
-      sha512 = "vFv90gkUJr9xICYCT4NXFd1EQDGWjJfpcnHqTcgd8A8og5yKfL5cqoSxuwcT15nP4nx06sKBCmnkjMB2DPKn9g==";
+      url = "https://registry.npmjs.org/coc-lists/-/coc-lists-1.3.16.tgz";
+      sha512 = "6m/LCFHcnFdbJoFnrkzj8OhBvcFl491eYG0247Gti/u2iQCVj2X8RRxdxcGbDh4tR5OEPZdQPcd6YMDbtphPSg==";
     };
     buildInputs = globalBuildInputs;
     meta = {
@@ -64483,10 +64546,10 @@ in
   coc-markdownlint = nodeEnv.buildNodePackage {
     name = "coc-markdownlint";
     packageName = "coc-markdownlint";
-    version = "1.8.0";
+    version = "1.9.0";
     src = fetchurl {
-      url = "https://registry.npmjs.org/coc-markdownlint/-/coc-markdownlint-1.8.0.tgz";
-      sha512 = "HgdVA3F61GPN4sPxVNyeVWQd0p8oykchGgpovcX5QAVveAcWpUpxYXquX1y2B+EhBFZYNEOQVsr5zdVPzrko6w==";
+      url = "https://registry.npmjs.org/coc-markdownlint/-/coc-markdownlint-1.9.0.tgz";
+      sha512 = "cTIR4IXs6CC06iDwylxzS0Sq4HhiWofTBqgedtbAckkaoJYOZdM+uMKKdkSO2nt93bHtE4MsEoQ91sxHgKqNfg==";
     };
     buildInputs = globalBuildInputs;
     meta = {
@@ -64615,7 +64678,7 @@ in
       sources."node-fetch-2.6.1"
       sources."node-int64-0.4.0"
       sources."npm-run-path-2.0.2"
-      sources."object-inspect-1.8.0"
+      sources."object-inspect-1.9.0"
       sources."object-keys-1.1.1"
       sources."object.assign-4.1.2"
       sources."once-1.4.0"
@@ -64694,10 +64757,10 @@ in
   coc-prettier = nodeEnv.buildNodePackage {
     name = "coc-prettier";
     packageName = "coc-prettier";
-    version = "1.1.19";
+    version = "1.1.20";
     src = fetchurl {
-      url = "https://registry.npmjs.org/coc-prettier/-/coc-prettier-1.1.19.tgz";
-      sha512 = "449bRHSru5ESxrWjgnizpI2OIXmzXN1/nEoPIkawJIsM4RvWAZJsMmsrgqweBRrQmyHy1sih7eIV3AkeZWbg7g==";
+      url = "https://registry.npmjs.org/coc-prettier/-/coc-prettier-1.1.20.tgz";
+      sha512 = "3p4AwJnsjtLJM53wLsMtcVUzWPMnnYI6pkwQraHH6Tp7/ZuXwIVhjUvDgMcAvhmIkVePyvJF5xZHN4ghLLP02A==";
     };
     dependencies = [
       sources."@babel/code-frame-7.10.4"
@@ -64774,7 +64837,7 @@ in
       sources."callsites-3.1.0"
       sources."camelcase-2.1.1"
       sources."camelcase-keys-2.1.0"
-      sources."caniuse-lite-1.0.30001161"
+      sources."caniuse-lite-1.0.30001164"
       sources."capture-stack-trace-1.0.1"
       sources."ccount-1.1.0"
       sources."chalk-2.4.2"
@@ -64871,7 +64934,7 @@ in
       sources."domutils-1.7.0"
       sources."dot-prop-5.3.0"
       sources."duplexer3-0.1.4"
-      sources."electron-to-chromium-1.3.610"
+      sources."electron-to-chromium-1.3.612"
       sources."emoji-regex-8.0.0"
       sources."end-of-stream-1.4.4"
       sources."entities-1.1.2"
@@ -65310,7 +65373,7 @@ in
       sources."prelude-ls-1.1.2"
       sources."prepend-http-1.0.4"
       sources."preserve-0.2.0"
-      sources."prettier-2.2.0"
+      sources."prettier-2.2.1"
       sources."prettier-eslint-11.0.0"
       (sources."prettier-stylelint-0.4.2" // {
         dependencies = [
@@ -65449,7 +65512,7 @@ in
       sources."spdx-correct-3.1.1"
       sources."spdx-exceptions-2.3.0"
       sources."spdx-expression-parse-3.0.1"
-      sources."spdx-license-ids-3.0.6"
+      sources."spdx-license-ids-3.0.7"
       sources."specificity-0.3.2"
       sources."split-string-3.1.0"
       sources."sprintf-js-1.0.3"
@@ -65710,10 +65773,10 @@ in
   coc-rust-analyzer = nodeEnv.buildNodePackage {
     name = "coc-rust-analyzer";
     packageName = "coc-rust-analyzer";
-    version = "0.17.0";
+    version = "0.18.0";
     src = fetchurl {
-      url = "https://registry.npmjs.org/coc-rust-analyzer/-/coc-rust-analyzer-0.17.0.tgz";
-      sha512 = "fL8O5Is3mvXiWPckw0vrGTldP8oMiNB8pjN/YGiDd/o5M8gQPc0N8a6urSByEHzEoFaV9hf7Lm0ZjK7muS0hjg==";
+      url = "https://registry.npmjs.org/coc-rust-analyzer/-/coc-rust-analyzer-0.18.0.tgz";
+      sha512 = "26wqJFlLsKj2BWaFUfjuu7pIBob36HeUH131IPlxAvluxcd/uhIZZEm22DzBJFhiX6alP+6nHfKsjpI+ntyAtA==";
     };
     buildInputs = globalBuildInputs;
     meta = {
@@ -65834,7 +65897,7 @@ in
       sources."callsites-3.1.0"
       sources."camelcase-5.3.1"
       sources."camelcase-keys-6.2.2"
-      sources."caniuse-lite-1.0.30001161"
+      sources."caniuse-lite-1.0.30001164"
       (sources."chalk-4.1.0" // {
         dependencies = [
           sources."ansi-styles-4.3.0"
@@ -65872,7 +65935,7 @@ in
       sources."domelementtype-1.3.1"
       sources."domhandler-2.4.2"
       sources."domutils-1.7.0"
-      sources."electron-to-chromium-1.3.610"
+      sources."electron-to-chromium-1.3.612"
       sources."emoji-regex-8.0.0"
       sources."entities-1.1.2"
       sources."error-ex-1.3.2"
@@ -66056,7 +66119,7 @@ in
       sources."spdx-correct-3.1.1"
       sources."spdx-exceptions-2.3.0"
       sources."spdx-expression-parse-3.0.1"
-      sources."spdx-license-ids-3.0.6"
+      sources."spdx-license-ids-3.0.7"
       sources."specificity-0.4.1"
       sources."string-width-4.2.0"
       (sources."string_decoder-1.3.0" // {
@@ -66081,7 +66144,7 @@ in
       sources."unified-9.2.0"
       sources."uniq-1.0.1"
       sources."unist-util-find-all-after-3.0.2"
-      sources."unist-util-is-4.0.3"
+      sources."unist-util-is-4.0.4"
       sources."unist-util-stringify-position-2.0.3"
       sources."uri-js-4.4.0"
       sources."util-deprecate-1.0.2"
@@ -66119,10 +66182,10 @@ in
   coc-tabnine = nodeEnv.buildNodePackage {
     name = "coc-tabnine";
     packageName = "coc-tabnine";
-    version = "1.2.2";
+    version = "1.2.3";
     src = fetchurl {
-      url = "https://registry.npmjs.org/coc-tabnine/-/coc-tabnine-1.2.2.tgz";
-      sha512 = "uxhcuQyjCmXse9ERkvyKpo7mEqC8wKGwREzbyFW92KAb+fB4YRBzmhrs7ws50cxSsYb6NPkfPrGsWqP4i0yEjg==";
+      url = "https://registry.npmjs.org/coc-tabnine/-/coc-tabnine-1.2.3.tgz";
+      sha512 = "1FVW4hj7eK8PAUS0fzeme/23iBBP9Q3nfoMVzpBGchJiziL2qOhXaFrU0QgliIhiRSMmLnagTx/lWuI8BuO96g==";
     };
     buildInputs = globalBuildInputs;
     meta = {
@@ -66367,7 +66430,7 @@ in
       sources."path-key-3.1.1"
       sources."path-parse-1.0.6"
       sources."prelude-ls-1.2.1"
-      sources."prettier-2.2.0"
+      sources."prettier-2.2.1"
       sources."progress-2.0.3"
       sources."punycode-2.1.1"
       sources."regexpp-3.1.0"
@@ -66497,7 +66560,7 @@ in
       sources."js-yaml-3.14.0"
       sources."jsonc-parser-2.3.1"
       sources."ms-2.0.0"
-      sources."prettier-2.2.0"
+      sources."prettier-2.2.1"
       (sources."request-light-0.2.5" // {
         dependencies = [
           sources."vscode-nls-4.1.2"
@@ -67101,7 +67164,7 @@ in
       sources."spdx-correct-3.1.1"
       sources."spdx-exceptions-2.3.0"
       sources."spdx-expression-parse-3.0.1"
-      sources."spdx-license-ids-3.0.6"
+      sources."spdx-license-ids-3.0.7"
       sources."sshpk-1.16.1"
       sources."statuses-1.5.0"
       (sources."string-width-2.1.1" // {
@@ -67120,7 +67183,7 @@ in
       sources."strip-final-newline-2.0.0"
       sources."strip-json-comments-2.0.1"
       sources."supports-color-7.2.0"
-      sources."systeminformation-4.30.6"
+      sources."systeminformation-4.30.10"
       sources."term-size-2.2.1"
       sources."through-2.3.8"
       sources."tmp-0.2.1"
@@ -67502,7 +67565,7 @@ in
       sources."spdx-correct-3.1.1"
       sources."spdx-exceptions-2.3.0"
       sources."spdx-expression-parse-3.0.1"
-      sources."spdx-license-ids-3.0.6"
+      sources."spdx-license-ids-3.0.7"
       sources."split-string-3.1.0"
       (sources."static-extend-0.1.2" // {
         dependencies = [
@@ -68097,7 +68160,7 @@ in
       sources."get-value-2.0.6"
       sources."getpass-0.1.7"
       sources."glob-7.1.6"
-      sources."global-4.3.2"
+      sources."global-4.4.0"
       sources."global-dirs-0.1.1"
       sources."got-6.7.1"
       sources."graceful-fs-4.2.4"
@@ -68272,7 +68335,7 @@ in
       sources."prepend-http-1.0.4"
       sources."prettier-bytes-1.0.4"
       sources."pretty-hash-1.0.1"
-      sources."process-0.5.2"
+      sources."process-0.11.10"
       sources."process-nextick-args-2.0.1"
       sources."progress-string-1.2.2"
       sources."prompt-1.0.0"
@@ -68497,7 +68560,7 @@ in
       sources."wrappy-1.0.2"
       sources."write-file-atomic-2.4.3"
       sources."xdg-basedir-3.0.0"
-      sources."xhr-2.5.0"
+      sources."xhr-2.6.0"
       sources."xsalsa20-1.1.0"
       sources."xtend-4.0.2"
       sources."yallist-2.1.2"
@@ -69097,7 +69160,7 @@ in
       sources."spdx-correct-3.1.1"
       sources."spdx-exceptions-2.3.0"
       sources."spdx-expression-parse-3.0.1"
-      sources."spdx-license-ids-3.0.6"
+      sources."spdx-license-ids-3.0.7"
       (sources."stack-utils-2.0.3" // {
         dependencies = [
           sources."escape-string-regexp-2.0.0"
@@ -69197,7 +69260,7 @@ in
           sources."normalize-path-2.1.1"
         ];
       })
-      sources."@microsoft/load-themed-styles-1.10.136"
+      sources."@microsoft/load-themed-styles-1.10.138"
       sources."@nodelib/fs.scandir-2.1.3"
       sources."@nodelib/fs.stat-2.0.3"
       sources."@nodelib/fs.walk-1.2.4"
@@ -70503,7 +70566,7 @@ in
       sources."spdx-correct-3.1.1"
       sources."spdx-exceptions-2.3.0"
       sources."spdx-expression-parse-3.0.1"
-      sources."spdx-license-ids-3.0.6"
+      sources."spdx-license-ids-3.0.7"
       sources."split-string-3.1.0"
       sources."split2-3.2.2"
       sources."sprintf-js-1.0.3"
@@ -70750,7 +70813,7 @@ in
           sources."terser-4.8.0"
           sources."terser-webpack-plugin-1.4.5"
           sources."to-regex-range-2.1.1"
-          sources."y18n-4.0.0"
+          sources."y18n-4.0.1"
         ];
       })
       sources."webpack-sources-1.4.3"
@@ -71120,10 +71183,10 @@ in
   expo-cli = nodeEnv.buildNodePackage {
     name = "expo-cli";
     packageName = "expo-cli";
-    version = "4.0.3";
+    version = "4.0.6";
     src = fetchurl {
-      url = "https://registry.npmjs.org/expo-cli/-/expo-cli-4.0.3.tgz";
-      sha512 = "yoPZo7QCrjJY08r0YQtNQ+FzfTI0+PCoDf6Uqk/cLxLfTVc/LwXAn2RNXdjmz6+MnCtowjciYYrcuqaizDPOdg==";
+      url = "https://registry.npmjs.org/expo-cli/-/expo-cli-4.0.6.tgz";
+      sha512 = "dpNpZMddzA3WUQQyT7VVUOg9UlQiRSjlFWOqXIqZyDSSc/XPWwC1DNrtOCMYvVwDm4sfIUnmiSA7LSM5MJWnGw==";
     };
     dependencies = [
       sources."@babel/code-frame-7.10.4"
@@ -71260,12 +71323,12 @@ in
       })
       sources."@expo/babel-preset-cli-0.2.18"
       sources."@expo/bunyan-4.0.0"
-      (sources."@expo/config-3.3.16" // {
+      (sources."@expo/config-3.3.18" // {
         dependencies = [
           sources."semver-7.3.2"
         ];
       })
-      (sources."@expo/config-plugins-1.0.3" // {
+      (sources."@expo/config-plugins-1.0.5" // {
         dependencies = [
           sources."slash-3.0.0"
           sources."uuid-3.4.0"
@@ -71279,7 +71342,7 @@ in
           sources."pngjs-5.0.0"
         ];
       })
-      (sources."@expo/dev-server-0.1.41" // {
+      (sources."@expo/dev-server-0.1.43" // {
         dependencies = [
           sources."body-parser-1.19.0"
           sources."bytes-3.1.0"
@@ -71296,7 +71359,7 @@ in
           sources."type-fest-0.12.0"
         ];
       })
-      sources."@expo/dev-tools-0.13.62"
+      sources."@expo/dev-tools-0.13.65"
       sources."@expo/eas-build-job-0.1.2"
       (sources."@expo/image-utils-0.3.9" // {
         dependencies = [
@@ -71309,7 +71372,7 @@ in
           sources."json5-1.0.1"
         ];
       })
-      sources."@expo/metro-config-0.1.41"
+      sources."@expo/metro-config-0.1.43"
       (sources."@expo/ngrok-2.4.3" // {
         dependencies = [
           sources."uuid-3.4.0"
@@ -71356,14 +71419,14 @@ in
       sources."@expo/spawn-async-1.5.0"
       sources."@expo/traveling-fastlane-darwin-1.15.1"
       sources."@expo/traveling-fastlane-linux-1.15.1"
-      (sources."@expo/webpack-config-0.12.46" // {
+      (sources."@expo/webpack-config-0.12.48" // {
         dependencies = [
           sources."@babel/runtime-7.9.0"
           sources."is-wsl-2.2.0"
           sources."react-refresh-0.8.3"
         ];
       })
-      (sources."@expo/xdl-59.0.2" // {
+      (sources."@expo/xdl-59.0.5" // {
         dependencies = [
           sources."chownr-1.1.4"
           (sources."fs-minipass-1.2.7" // {
@@ -71788,7 +71851,7 @@ in
       })
       sources."camelcase-5.3.1"
       sources."caniuse-api-3.0.0"
-      sources."caniuse-lite-1.0.30001161"
+      sources."caniuse-lite-1.0.30001164"
       sources."capture-stack-trace-1.0.1"
       sources."caseless-0.12.0"
       (sources."chalk-4.1.0" // {
@@ -72047,7 +72110,7 @@ in
       sources."duplexify-3.7.1"
       sources."ecc-jsbn-0.1.2"
       sources."ee-first-1.1.1"
-      sources."electron-to-chromium-1.3.610"
+      sources."electron-to-chromium-1.3.612"
       (sources."elliptic-6.5.3" // {
         dependencies = [
           sources."bn.js-4.11.9"
@@ -72124,7 +72187,7 @@ in
           sources."ms-2.0.0"
         ];
       })
-      (sources."expo-pwa-0.0.52" // {
+      (sources."expo-pwa-0.0.54" // {
         dependencies = [
           sources."commander-2.20.0"
         ];
@@ -72239,7 +72302,7 @@ in
       sources."getpass-0.1.7"
       sources."glob-7.1.6"
       sources."glob-parent-5.1.1"
-      sources."global-4.3.2"
+      sources."global-4.4.0"
       sources."global-modules-2.0.0"
       sources."global-prefix-3.0.0"
       sources."globals-11.12.0"
@@ -72385,7 +72448,7 @@ in
       sources."is-accessor-descriptor-1.0.0"
       sources."is-arguments-1.0.4"
       sources."is-arrayish-0.3.2"
-      sources."is-bigint-1.0.0"
+      sources."is-bigint-1.0.1"
       sources."is-binary-path-2.1.0"
       sources."is-boolean-object-1.0.1"
       sources."is-buffer-1.1.6"
@@ -72670,7 +72733,6 @@ in
         dependencies = [
           sources."buffer-4.9.2"
           sources."isarray-1.0.0"
-          sources."process-0.11.10"
           sources."punycode-1.4.1"
         ];
       })
@@ -72724,7 +72786,7 @@ in
           sources."kind-of-3.2.2"
         ];
       })
-      sources."object-inspect-1.8.0"
+      sources."object-inspect-1.9.0"
       sources."object-is-1.1.4"
       sources."object-keys-1.1.1"
       sources."object-visit-1.0.1"
@@ -73002,7 +73064,7 @@ in
           sources."deepmerge-2.2.1"
         ];
       })
-      sources."process-0.5.2"
+      sources."process-0.11.10"
       sources."process-nextick-args-2.0.1"
       sources."progress-2.0.3"
       sources."promise-inflight-1.0.1"
@@ -73749,7 +73811,7 @@ in
           sources."uuid-7.0.3"
         ];
       })
-      sources."xhr-2.5.0"
+      sources."xhr-2.6.0"
       sources."xml-js-1.6.11"
       sources."xml-parse-from-string-1.0.1"
       (sources."xml2js-0.4.23" // {
@@ -73761,7 +73823,7 @@ in
       sources."xmldoc-1.1.2"
       sources."xmldom-0.1.31"
       sources."xtend-4.0.2"
-      sources."y18n-4.0.0"
+      sources."y18n-4.0.1"
       sources."yallist-4.0.0"
       sources."yargs-15.4.1"
       sources."yargs-parser-18.1.3"
@@ -73931,7 +73993,7 @@ in
       sources."spdx-correct-3.1.1"
       sources."spdx-exceptions-2.3.0"
       sources."spdx-expression-parse-3.0.1"
-      sources."spdx-license-ids-3.0.6"
+      sources."spdx-license-ids-3.0.7"
       sources."sshpk-1.16.1"
       sources."string_decoder-1.1.1"
       sources."strip-ansi-3.0.1"
@@ -74688,7 +74750,7 @@ in
       sources."spdx-correct-3.1.1"
       sources."spdx-exceptions-2.3.0"
       sources."spdx-expression-parse-3.0.1"
-      sources."spdx-license-ids-3.0.6"
+      sources."spdx-license-ids-3.0.7"
       sources."string-width-4.2.0"
       sources."strip-ansi-6.0.0"
       sources."strip-eof-1.0.0"
@@ -74721,6 +74783,57 @@ in
     bypassCache = true;
     reconstructLock = true;
   };
+  flood = nodeEnv.buildNodePackage {
+    name = "flood";
+    packageName = "flood";
+    version = "4.2.0";
+    src = fetchurl {
+      url = "https://registry.npmjs.org/flood/-/flood-4.2.0.tgz";
+      sha512 = "xdfiYucaiUEmaScEDZr24vq5qkBe7cC51YeFG9gSFZF0ccGtoVG1RMw55vA06VyMxLUlYVqR9uYxyKVmk/xDBg==";
+    };
+    dependencies = [
+      sources."async-2.6.3"
+      sources."balanced-match-1.0.0"
+      sources."brace-expansion-1.1.11"
+      sources."buffer-crc32-0.2.13"
+      sources."colors-1.4.0"
+      sources."concat-map-0.0.1"
+      sources."fd-slicer-1.1.0"
+      sources."fs.realpath-1.0.0"
+      sources."geoip-country-4.0.44"
+      sources."glob-7.1.6"
+      sources."iconv-lite-0.5.2"
+      sources."inflight-1.0.6"
+      sources."inherits-2.0.4"
+      sources."ip-address-6.4.0"
+      sources."jsbn-1.1.0"
+      sources."lazy-1.0.11"
+      sources."lodash-4.17.20"
+      sources."lodash.find-4.6.0"
+      sources."lodash.max-4.0.1"
+      sources."lodash.merge-4.6.2"
+      sources."lodash.padstart-4.6.1"
+      sources."lodash.repeat-4.1.0"
+      sources."minimatch-3.0.4"
+      sources."once-1.4.0"
+      sources."path-is-absolute-1.0.1"
+      sources."pend-1.2.0"
+      sources."rimraf-2.7.1"
+      sources."safer-buffer-2.1.2"
+      sources."sprintf-js-1.1.2"
+      sources."wrappy-1.0.2"
+      sources."yauzl-2.10.0"
+    ];
+    buildInputs = globalBuildInputs;
+    meta = {
+      description = "A modern Web UI for various torrent clients with multi-user and multi-client support";
+      homepage = "https://github.com/jesec/flood#readme";
+      license = "GPL-3.0-only";
+    };
+    production = true;
+    bypassCache = true;
+    reconstructLock = true;
+  };
   forever = nodeEnv.buildNodePackage {
     name = "forever";
     packageName = "forever";
@@ -74950,7 +75063,7 @@ in
           sources."kind-of-3.2.2"
         ];
       })
-      sources."object-inspect-1.8.0"
+      sources."object-inspect-1.9.0"
       sources."object-is-1.1.4"
       sources."object-keys-1.1.1"
       sources."object-visit-1.0.1"
@@ -75267,7 +75380,7 @@ in
       sources."multiserver-address-1.0.1"
       sources."multiserver-scopes-1.0.0"
       sources."muxrpc-6.5.1"
-      sources."nearley-2.19.8"
+      sources."nearley-2.19.9"
       sources."node-gyp-build-4.2.3"
       sources."node-polyglot-1.0.0"
       sources."non-private-ip-1.4.4"
@@ -75648,7 +75761,7 @@ in
       sources."spdx-correct-3.1.1"
       sources."spdx-exceptions-2.3.0"
       sources."spdx-expression-parse-3.0.1"
-      sources."spdx-license-ids-3.0.6"
+      sources."spdx-license-ids-3.0.7"
       sources."string-width-4.2.0"
       sources."strip-ansi-6.0.0"
       sources."strip-final-newline-2.0.0"
@@ -75717,45 +75830,45 @@ in
       sources."@graphql-cli/init-4.1.0"
       (sources."@graphql-tools/batch-execute-7.0.0" // {
         dependencies = [
-          sources."@graphql-tools/utils-7.1.0"
+          sources."@graphql-tools/utils-7.1.2"
         ];
       })
-      (sources."@graphql-tools/delegate-7.0.5" // {
+      (sources."@graphql-tools/delegate-7.0.7" // {
         dependencies = [
-          sources."@graphql-tools/utils-7.1.0"
+          sources."@graphql-tools/utils-7.1.2"
         ];
       })
       (sources."@graphql-tools/graphql-file-loader-6.2.6" // {
         dependencies = [
-          sources."@graphql-tools/utils-7.1.0"
+          sources."@graphql-tools/utils-7.1.2"
         ];
       })
       sources."@graphql-tools/import-6.2.5"
       (sources."@graphql-tools/json-file-loader-6.2.6" // {
         dependencies = [
-          sources."@graphql-tools/utils-7.1.0"
+          sources."@graphql-tools/utils-7.1.2"
         ];
       })
       sources."@graphql-tools/load-6.2.4"
-      (sources."@graphql-tools/merge-6.2.5" // {
+      (sources."@graphql-tools/merge-6.2.6" // {
         dependencies = [
-          sources."@graphql-tools/utils-7.1.0"
+          sources."@graphql-tools/utils-7.1.2"
         ];
       })
-      (sources."@graphql-tools/schema-7.1.0" // {
+      (sources."@graphql-tools/schema-7.1.2" // {
         dependencies = [
-          sources."@graphql-tools/utils-7.1.0"
+          sources."@graphql-tools/utils-7.1.2"
         ];
       })
       (sources."@graphql-tools/url-loader-6.4.0" // {
         dependencies = [
-          sources."@graphql-tools/utils-7.1.0"
+          sources."@graphql-tools/utils-7.1.2"
         ];
       })
       sources."@graphql-tools/utils-6.2.4"
-      (sources."@graphql-tools/wrap-7.0.1" // {
+      (sources."@graphql-tools/wrap-7.0.3" // {
         dependencies = [
-          sources."@graphql-tools/utils-7.1.0"
+          sources."@graphql-tools/utils-7.1.2"
         ];
       })
       sources."@kwsites/file-exists-1.1.1"
@@ -75958,7 +76071,7 @@ in
       })
       sources."is-arguments-1.0.4"
       sources."is-arrayish-0.2.1"
-      sources."is-bigint-1.0.0"
+      sources."is-bigint-1.0.1"
       sources."is-boolean-object-1.0.1"
       sources."is-callable-1.2.2"
       sources."is-date-object-1.0.2"
@@ -76071,7 +76184,7 @@ in
       sources."oas-schema-walker-1.1.5"
       sources."oas-validator-5.0.4"
       sources."oauth-sign-0.9.0"
-      sources."object-inspect-1.8.0"
+      sources."object-inspect-1.9.0"
       sources."object-is-1.1.4"
       sources."object-keys-1.1.1"
       sources."object.assign-4.1.2"
@@ -76649,7 +76762,7 @@ in
           sources."supports-color-7.2.0"
         ];
       })
-      sources."systeminformation-4.30.6"
+      sources."systeminformation-4.30.10"
       sources."term-canvas-0.0.5"
       sources."type-fest-0.11.0"
       sources."wordwrap-0.0.3"
@@ -77047,7 +77160,7 @@ in
       sources."spdx-correct-3.1.1"
       sources."spdx-exceptions-2.3.0"
       sources."spdx-expression-parse-3.0.1"
-      sources."spdx-license-ids-3.0.6"
+      sources."spdx-license-ids-3.0.7"
       sources."split-string-3.1.0"
       sources."stack-trace-0.0.10"
       (sources."static-extend-0.1.2" // {
@@ -77429,7 +77542,7 @@ in
       sources."spdx-correct-3.1.1"
       sources."spdx-exceptions-2.3.0"
       sources."spdx-expression-parse-3.0.1"
-      sources."spdx-license-ids-3.0.6"
+      sources."spdx-license-ids-3.0.7"
       sources."split-string-3.1.0"
       sources."stack-trace-0.0.10"
       (sources."static-extend-0.1.2" // {
@@ -77526,7 +77639,7 @@ in
       sources."param-case-2.1.1"
       sources."relateurl-0.2.7"
       sources."source-map-0.6.1"
-      sources."uglify-js-3.12.0"
+      sources."uglify-js-3.12.1"
       sources."upper-case-1.1.3"
     ];
     buildInputs = globalBuildInputs;
@@ -78181,7 +78294,7 @@ in
       sources."is-wsl-2.2.0"
       sources."isexe-2.0.0"
       sources."jquery-3.5.1"
-      sources."jquery.terminal-2.20.0"
+      sources."jquery.terminal-2.20.1"
       sources."jsonfile-2.4.0"
       sources."keyboardevent-key-polyfill-1.1.0"
       sources."line-reader-0.4.0"
@@ -78817,7 +78930,7 @@ in
       sources."spdx-correct-3.1.1"
       sources."spdx-exceptions-2.3.0"
       sources."spdx-expression-parse-3.0.1"
-      sources."spdx-license-ids-3.0.6"
+      sources."spdx-license-ids-3.0.7"
       (sources."spiro-2.0.0" // {
         dependencies = [
           sources."tslib-1.14.1"
@@ -78882,7 +78995,7 @@ in
           sources."supports-color-7.2.0"
           sources."which-module-2.0.0"
           sources."wrap-ansi-6.2.0"
-          sources."y18n-4.0.0"
+          sources."y18n-4.0.1"
           sources."yargs-15.4.1"
           sources."yargs-parser-18.1.3"
         ];
@@ -79106,7 +79219,7 @@ in
       sources."async-mutex-0.1.4"
       sources."asynckit-0.4.0"
       sources."atob-2.1.2"
-      (sources."aws-sdk-2.799.0" // {
+      (sources."aws-sdk-2.800.0" // {
         dependencies = [
           sources."sax-1.2.1"
           sources."uuid-3.3.2"
@@ -79473,7 +79586,7 @@ in
           sources."commander-2.20.3"
           sources."debug-4.3.1"
           sources."html-minifier-4.0.0"
-          sources."uglify-js-3.12.0"
+          sources."uglify-js-3.12.1"
         ];
       })
       sources."minimatch-3.0.4"
@@ -79488,7 +79601,7 @@ in
       sources."multiparty-4.2.2"
       sources."mustache-4.0.1"
       sources."nan-2.14.2"
-      sources."nanoid-3.1.18"
+      sources."nanoid-3.1.20"
       sources."napi-build-utils-1.0.2"
       sources."ndarray-1.0.19"
       sources."ndarray-pack-1.2.1"
@@ -80174,7 +80287,7 @@ in
         ];
       })
       sources."ms-2.0.0"
-      sources."nanoid-3.1.18"
+      sources."nanoid-3.1.20"
       sources."negotiator-0.6.2"
       sources."normalize-url-4.5.0"
       sources."object-assign-4.1.1"
@@ -80490,7 +80603,7 @@ in
       sources."wrappy-1.0.2"
       sources."ws-7.4.0"
       sources."xmlhttprequest-ssl-1.5.5"
-      sources."y18n-4.0.0"
+      sources."y18n-4.0.1"
       sources."yargs-15.4.1"
       sources."yargs-parser-18.1.3"
       sources."yeast-0.1.2"
@@ -80965,13 +81078,14 @@ in
       sources."@lerna/write-log-file-3.13.0"
       sources."@mrmlnc/readdir-enhanced-2.2.1"
       sources."@nodelib/fs.stat-1.1.3"
-      sources."@octokit/auth-token-2.4.3"
-      (sources."@octokit/endpoint-6.0.9" // {
+      sources."@octokit/auth-token-2.4.4"
+      (sources."@octokit/endpoint-6.0.10" // {
         dependencies = [
           sources."is-plain-object-5.0.0"
           sources."universal-user-agent-6.0.0"
         ];
       })
+      sources."@octokit/openapi-types-1.2.2"
       sources."@octokit/plugin-enterprise-rest-6.0.1"
       (sources."@octokit/plugin-paginate-rest-1.1.2" // {
         dependencies = [
@@ -80984,9 +81098,9 @@ in
           sources."@octokit/types-2.16.2"
         ];
       })
-      (sources."@octokit/request-5.4.10" // {
+      (sources."@octokit/request-5.4.11" // {
         dependencies = [
-          sources."@octokit/request-error-2.0.3"
+          sources."@octokit/request-error-2.0.4"
           sources."is-plain-object-5.0.0"
           sources."universal-user-agent-6.0.0"
         ];
@@ -80997,7 +81111,7 @@ in
         ];
       })
       sources."@octokit/rest-16.43.2"
-      sources."@octokit/types-5.5.0"
+      sources."@octokit/types-6.0.1"
       sources."@types/glob-7.1.3"
       sources."@types/minimatch-3.0.3"
       sources."@types/minimist-1.2.1"
@@ -81582,7 +81696,7 @@ in
           sources."kind-of-3.2.2"
         ];
       })
-      sources."object-inspect-1.8.0"
+      sources."object-inspect-1.9.0"
       sources."object-keys-1.1.1"
       sources."object-visit-1.0.1"
       sources."object.assign-4.1.2"
@@ -81748,7 +81862,7 @@ in
       sources."spdx-correct-3.1.1"
       sources."spdx-exceptions-2.3.0"
       sources."spdx-expression-parse-3.0.1"
-      sources."spdx-license-ids-3.0.6"
+      sources."spdx-license-ids-3.0.7"
       sources."split-1.0.1"
       sources."split-string-3.1.0"
       sources."split2-2.2.0"
@@ -81818,7 +81932,7 @@ in
       sources."tweetnacl-0.14.5"
       sources."type-fest-0.3.1"
       sources."typedarray-0.0.6"
-      sources."uglify-js-3.12.0"
+      sources."uglify-js-3.12.1"
       sources."uid-number-0.0.6"
       sources."umask-1.1.0"
       sources."union-value-1.0.1"
@@ -81876,7 +81990,7 @@ in
         ];
       })
       sources."xtend-4.0.2"
-      sources."y18n-4.0.0"
+      sources."y18n-4.0.1"
       sources."yallist-3.1.1"
       (sources."yargs-14.2.3" // {
         dependencies = [
@@ -83094,7 +83208,7 @@ in
       sources."cached-path-relative-1.0.2"
       sources."call-bind-1.0.0"
       sources."camelcase-5.3.1"
-      sources."caniuse-lite-1.0.30001161"
+      sources."caniuse-lite-1.0.30001164"
       sources."capture-exit-2.0.0"
       sources."caseless-0.12.0"
       (sources."chalk-3.0.0" // {
@@ -83218,7 +83332,7 @@ in
       sources."duplexer2-0.1.4"
       sources."duplexify-3.7.1"
       sources."ecc-jsbn-0.1.2"
-      sources."electron-to-chromium-1.3.610"
+      sources."electron-to-chromium-1.3.612"
       (sources."elliptic-6.5.3" // {
         dependencies = [
           sources."bn.js-4.11.9"
@@ -83733,7 +83847,7 @@ in
       sources."spdx-correct-3.1.1"
       sources."spdx-exceptions-2.3.0"
       sources."spdx-expression-parse-3.0.1"
-      sources."spdx-license-ids-3.0.6"
+      sources."spdx-license-ids-3.0.7"
       sources."split-string-3.1.0"
       sources."sprintf-js-1.0.3"
       sources."sshpk-1.16.1"
@@ -83920,7 +84034,7 @@ in
       sources."wrappy-1.0.2"
       sources."write-file-atomic-3.0.3"
       sources."xtend-4.0.2"
-      sources."y18n-4.0.0"
+      sources."y18n-4.0.1"
       sources."yallist-3.1.1"
       (sources."yargs-13.3.2" // {
         dependencies = [
@@ -84507,7 +84621,7 @@ in
       sources."@fluentui/react-theme-provider-0.18.0"
       sources."@fluentui/react-window-provider-1.0.1"
       sources."@fluentui/theme-1.7.0"
-      sources."@microsoft/load-themed-styles-1.10.136"
+      sources."@microsoft/load-themed-styles-1.10.138"
       sources."@sindresorhus/is-0.14.0"
       sources."@szmarczak/http-timer-1.1.2"
       sources."@types/classnames-2.2.11"
@@ -84872,7 +84986,7 @@ in
         ];
       })
       sources."wrappy-1.0.2"
-      sources."y18n-4.0.0"
+      sources."y18n-4.0.1"
       (sources."yargs-13.3.2" // {
         dependencies = [
           sources."ansi-regex-4.1.0"
@@ -85142,23 +85256,23 @@ in
       sources."@babel/template-7.12.7"
       sources."@babel/traverse-7.12.9"
       sources."@babel/types-7.12.7"
-      sources."@bugsnag/browser-7.5.1"
-      sources."@bugsnag/core-7.3.5"
+      sources."@bugsnag/browser-7.5.3"
+      sources."@bugsnag/core-7.5.3"
       sources."@bugsnag/cuid-3.0.0"
-      sources."@bugsnag/js-7.5.1"
-      sources."@bugsnag/node-7.3.5"
+      sources."@bugsnag/js-7.5.3"
+      sources."@bugsnag/node-7.5.3"
       sources."@bugsnag/safe-json-stringify-6.0.0"
       sources."@dabh/diagnostics-2.0.2"
       sources."@jest/types-24.9.0"
       sources."@mrmlnc/readdir-enhanced-2.2.1"
-      (sources."@netlify/build-5.3.3" // {
+      (sources."@netlify/build-5.5.2" // {
         dependencies = [
           sources."chalk-3.0.0"
           sources."resolve-2.0.0-next.2"
         ];
       })
       sources."@netlify/cache-utils-1.0.6"
-      (sources."@netlify/config-2.4.0" // {
+      (sources."@netlify/config-2.4.1" // {
         dependencies = [
           sources."chalk-3.0.0"
         ];
@@ -85175,12 +85289,13 @@ in
       })
       sources."@netlify/open-api-0.18.1"
       sources."@netlify/plugin-edge-handlers-1.10.0"
+      sources."@netlify/plugins-list-2.0.0"
       sources."@netlify/run-utils-1.0.5"
       sources."@netlify/traffic-mesh-agent-0.27.0"
       sources."@netlify/traffic-mesh-agent-darwin-x64-0.27.0"
       sources."@netlify/traffic-mesh-agent-linux-x64-0.27.0"
       sources."@netlify/traffic-mesh-agent-win32-x64-0.27.0"
-      (sources."@netlify/zip-it-and-ship-it-1.4.2" // {
+      (sources."@netlify/zip-it-and-ship-it-1.5.0" // {
         dependencies = [
           sources."resolve-2.0.0-next.2"
         ];
@@ -85288,13 +85403,14 @@ in
         ];
       })
       sources."@oclif/screen-1.0.4"
-      sources."@octokit/auth-token-2.4.3"
-      (sources."@octokit/endpoint-6.0.9" // {
+      sources."@octokit/auth-token-2.4.4"
+      (sources."@octokit/endpoint-6.0.10" // {
         dependencies = [
           sources."is-plain-object-5.0.0"
           sources."universal-user-agent-6.0.0"
         ];
       })
+      sources."@octokit/openapi-types-1.2.2"
       (sources."@octokit/plugin-paginate-rest-1.1.2" // {
         dependencies = [
           sources."@octokit/types-2.16.2"
@@ -85306,9 +85422,9 @@ in
           sources."@octokit/types-2.16.2"
         ];
       })
-      (sources."@octokit/request-5.4.10" // {
+      (sources."@octokit/request-5.4.11" // {
         dependencies = [
-          sources."@octokit/request-error-2.0.3"
+          sources."@octokit/request-error-2.0.4"
           sources."is-plain-object-5.0.0"
           sources."universal-user-agent-6.0.0"
         ];
@@ -85319,8 +85435,8 @@ in
         ];
       })
       sources."@octokit/rest-16.43.2"
-      sources."@octokit/types-5.5.0"
-      sources."@rollup/plugin-babel-5.2.1"
+      sources."@octokit/types-6.0.1"
+      sources."@rollup/plugin-babel-5.2.2"
       (sources."@rollup/plugin-commonjs-15.1.0" // {
         dependencies = [
           sources."estree-walker-2.0.1"
@@ -85420,7 +85536,7 @@ in
       sources."asynckit-0.4.0"
       sources."atob-2.1.2"
       sources."atob-lite-2.0.0"
-      (sources."aws-sdk-2.799.0" // {
+      (sources."aws-sdk-2.800.0" // {
         dependencies = [
           sources."buffer-4.9.2"
           sources."ieee754-1.1.13"
@@ -85499,7 +85615,7 @@ in
       sources."call-bind-1.0.0"
       sources."call-me-maybe-1.0.1"
       sources."camelcase-5.3.1"
-      sources."caniuse-lite-1.0.30001161"
+      sources."caniuse-lite-1.0.30001164"
       sources."cardinal-2.1.1"
       sources."caw-2.0.1"
       sources."ccount-1.1.0"
@@ -85749,8 +85865,8 @@ in
       })
       sources."duplexer3-0.1.4"
       sources."ee-first-1.1.1"
-      sources."electron-to-chromium-1.3.610"
-      sources."elf-tools-1.1.2"
+      sources."electron-to-chromium-1.3.612"
+      sources."elf-cam-0.1.1"
       (sources."elliptic-6.5.3" // {
         dependencies = [
           sources."bn.js-4.11.9"
@@ -86338,7 +86454,7 @@ in
           sources."kind-of-3.2.2"
         ];
       })
-      sources."object-inspect-1.8.0"
+      sources."object-inspect-1.9.0"
       sources."object-keys-1.1.1"
       sources."object-treeify-1.1.30"
       sources."object-visit-1.0.1"
@@ -86528,7 +86644,7 @@ in
       sources."reusify-1.0.4"
       sources."rimraf-3.0.2"
       sources."ripemd160-2.0.2"
-      sources."rollup-2.33.3"
+      sources."rollup-2.34.0"
       sources."rollup-plugin-node-builtins-2.1.2"
       sources."rollup-plugin-terser-7.0.2"
       sources."run-async-2.4.1"
@@ -86624,7 +86740,7 @@ in
       sources."spdx-correct-3.1.1"
       sources."spdx-exceptions-2.3.0"
       sources."spdx-expression-parse-3.0.1"
-      sources."spdx-license-ids-3.0.6"
+      sources."spdx-license-ids-3.0.7"
       sources."split-string-3.1.0"
       sources."split2-1.1.1"
       sources."sprintf-js-1.0.3"
@@ -86771,7 +86887,7 @@ in
       sources."union-value-1.0.1"
       sources."uniq-1.0.1"
       sources."unique-string-2.0.0"
-      sources."unist-util-is-4.0.3"
+      sources."unist-util-is-4.0.4"
       sources."unist-util-stringify-position-2.0.3"
       sources."unist-util-visit-2.0.3"
       sources."unist-util-visit-parents-3.1.1"
@@ -86853,7 +86969,7 @@ in
       sources."xml2js-0.4.19"
       sources."xmlbuilder-9.0.7"
       sources."xtend-4.0.2"
-      sources."y18n-4.0.0"
+      sources."y18n-4.0.1"
       sources."yargs-15.4.1"
       sources."yargs-parser-18.1.3"
       sources."yarn-1.22.10"
@@ -87250,7 +87366,7 @@ in
       sources."spdx-correct-3.1.1"
       sources."spdx-exceptions-2.3.0"
       sources."spdx-expression-parse-3.0.1"
-      sources."spdx-license-ids-3.0.6"
+      sources."spdx-license-ids-3.0.7"
       (sources."sshpk-1.16.1" // {
         dependencies = [
           sources."assert-plus-1.0.0"
@@ -88053,7 +88169,7 @@ in
       sources."spdx-correct-3.1.1"
       sources."spdx-exceptions-2.3.0"
       sources."spdx-expression-parse-3.0.1"
-      sources."spdx-license-ids-3.0.6"
+      sources."spdx-license-ids-3.0.7"
       sources."sshpk-1.16.1"
       sources."ssri-5.3.0"
       sources."string-width-1.0.2"
@@ -89053,7 +89169,7 @@ in
       sources."caller-path-2.0.0"
       sources."callsites-2.0.0"
       sources."caniuse-api-3.0.0"
-      sources."caniuse-lite-1.0.30001161"
+      sources."caniuse-lite-1.0.30001164"
       sources."caseless-0.12.0"
       sources."chalk-2.4.2"
       sources."chokidar-2.1.8"
@@ -89188,7 +89304,7 @@ in
       sources."duplexer2-0.1.4"
       sources."ecc-jsbn-0.1.2"
       sources."ee-first-1.1.1"
-      sources."electron-to-chromium-1.3.610"
+      sources."electron-to-chromium-1.3.612"
       (sources."elliptic-6.5.3" // {
         dependencies = [
           sources."bn.js-4.11.9"
@@ -89200,7 +89316,7 @@ in
       sources."error-ex-1.3.2"
       (sources."es-abstract-1.18.0-next.1" // {
         dependencies = [
-          sources."object-inspect-1.8.0"
+          sources."object-inspect-1.9.0"
         ];
       })
       sources."es-to-primitive-1.2.1"
@@ -89764,7 +89880,7 @@ in
       (sources."util.promisify-1.0.1" // {
         dependencies = [
           sources."es-abstract-1.17.7"
-          sources."object-inspect-1.8.0"
+          sources."object-inspect-1.9.0"
         ];
       })
       sources."uuid-3.4.0"
@@ -90047,7 +90163,7 @@ in
       sources."tunnel-agent-0.6.0"
       sources."tweetnacl-0.14.5"
       sources."type-is-1.6.18"
-      sources."uglify-js-3.12.0"
+      sources."uglify-js-3.12.1"
       sources."unix-dgram-2.0.4"
       sources."unpipe-1.0.0"
       sources."uri-js-4.4.0"
@@ -90063,7 +90179,7 @@ in
       sources."worker-farm-1.7.0"
       sources."wrap-ansi-5.1.0"
       sources."wrappy-1.0.2"
-      sources."y18n-4.0.0"
+      sources."y18n-4.0.1"
       (sources."yargs-13.3.2" // {
         dependencies = [
           sources."yargs-parser-13.1.2"
@@ -90526,7 +90642,7 @@ in
       sources."number-is-nan-1.0.1"
       sources."numeral-2.0.6"
       sources."object-assign-4.1.1"
-      sources."object-inspect-1.8.0"
+      sources."object-inspect-1.9.0"
       sources."object-is-1.1.4"
       sources."object-keys-1.1.1"
       sources."object.assign-4.1.2"
@@ -90611,7 +90727,7 @@ in
       sources."spdx-correct-3.1.1"
       sources."spdx-exceptions-2.3.0"
       sources."spdx-expression-parse-3.0.1"
-      sources."spdx-license-ids-3.0.6"
+      sources."spdx-license-ids-3.0.7"
       sources."speedometer-0.1.4"
       sources."stream-buffers-2.2.0"
       sources."string-width-1.0.2"
@@ -91304,7 +91420,7 @@ in
       sources."statuses-1.5.0"
       sources."string_decoder-0.10.31"
       sources."supports-color-7.2.0"
-      sources."systeminformation-4.30.6"
+      sources."systeminformation-4.30.10"
       sources."thunkify-2.1.2"
       sources."to-regex-range-5.0.1"
       sources."toidentifier-1.0.0"
@@ -91339,10 +91455,10 @@ in
   pnpm = nodeEnv.buildNodePackage {
     name = "pnpm";
     packageName = "pnpm";
-    version = "5.13.4";
+    version = "5.13.5";
     src = fetchurl {
-      url = "https://registry.npmjs.org/pnpm/-/pnpm-5.13.4.tgz";
-      sha512 = "Q/1SlzLitcrggjTJN7Ooiu2y5ty+yTaxJYb7xGt6QpNijsIhxkGK58pP8IZYh04C7+8aI9MxNgppOTOyQG7k5g==";
+      url = "https://registry.npmjs.org/pnpm/-/pnpm-5.13.5.tgz";
+      sha512 = "EJO8eYZyNpOvW+JhjBnLtxD2xcC6YlrzH8jxjETj8bevLATFa9vnGq614ada6o1XOIMq31JWtj1WyPJNogAzLA==";
     };
     buildInputs = globalBuildInputs;
     meta = {
@@ -91466,7 +91582,6 @@ in
       sources."lodash.get-4.4.2"
       sources."lodash.groupby-4.6.0"
       sources."lodash.sortby-4.7.0"
-      sources."log-symbols-4.0.0"
       sources."merge2-1.4.1"
       sources."micromatch-4.0.2"
       sources."normalize-path-3.0.0"
@@ -91476,7 +91591,7 @@ in
       sources."picomatch-2.2.2"
       sources."pify-2.3.0"
       sources."postcss-load-config-3.0.0"
-      sources."postcss-reporter-7.0.1"
+      sources."postcss-reporter-7.0.2"
       sources."pretty-hrtime-1.0.3"
       sources."read-cache-1.0.0"
       sources."readdirp-3.5.0"
@@ -91895,10 +92010,10 @@ in
   pyright = nodeEnv.buildNodePackage {
     name = "pyright";
     packageName = "pyright";
-    version = "1.1.88";
+    version = "1.1.90";
     src = fetchurl {
-      url = "https://registry.npmjs.org/pyright/-/pyright-1.1.88.tgz";
-      sha512 = "1bjnvqNd5xlqTzlwr1W0/WLj+fKItMpQuBr2fvI3OPnWz5iRNcIdj30pR5yCP5ddThSW8xHjQmutf/aked2I8w==";
+      url = "https://registry.npmjs.org/pyright/-/pyright-1.1.90.tgz";
+      sha512 = "CNrTDpxd4vWcGpjxCPLg2fvKYlEhU8ksi7Fkdb+bFNfOb/1ENvZ8QoDYebtLFceoBlgWU9X+MluuFKudwHKKkw==";
     };
     buildInputs = globalBuildInputs;
     meta = {
@@ -91950,7 +92065,7 @@ in
       sources."inflight-1.0.6"
       sources."inherits-2.0.4"
       sources."is-arguments-1.0.4"
-      sources."is-bigint-1.0.0"
+      sources."is-bigint-1.0.1"
       sources."is-boolean-object-1.0.1"
       sources."is-callable-1.2.2"
       sources."is-date-object-1.0.2"
@@ -91975,7 +92090,7 @@ in
       sources."mkdirp-0.5.5"
       sources."mute-stream-0.0.8"
       sources."ncp-0.4.2"
-      sources."object-inspect-1.8.0"
+      sources."object-inspect-1.9.0"
       sources."object-is-1.1.4"
       sources."object-keys-1.1.1"
       sources."object.assign-4.1.2"
@@ -92211,10 +92326,10 @@ in
   redoc-cli = nodeEnv.buildNodePackage {
     name = "redoc-cli";
     packageName = "redoc-cli";
-    version = "0.10.1";
+    version = "0.10.2";
     src = fetchurl {
-      url = "https://registry.npmjs.org/redoc-cli/-/redoc-cli-0.10.1.tgz";
-      sha512 = "RZqE1dFdIB3hBvxpBc+CRTjD10xDdPIUk3xA4moHzQMP5Gp2MeGCiRWyt747+4CV42s7oUQbxSMeeY1IMz0vAQ==";
+      url = "https://registry.npmjs.org/redoc-cli/-/redoc-cli-0.10.2.tgz";
+      sha512 = "AQHx67+fJ+7PZUGf0Vl24XO02isSLHU7fh/OXu6wreFm6B1+xrVhcehV9um2nk63Zq9GFenjnv2GoXEyMSGc7Q==";
     };
     dependencies = [
       sources."@babel/code-frame-7.10.4"
@@ -92241,7 +92356,7 @@ in
       sources."@emotion/unitless-0.7.5"
       sources."@exodus/schemasafe-1.0.0-rc.3"
       sources."@redocly/react-dropdown-aria-2.0.11"
-      sources."@types/node-13.13.33"
+      sources."@types/node-13.13.34"
       sources."ajv-5.5.2"
       sources."ansi-regex-5.0.0"
       sources."ansi-styles-3.2.1"
@@ -92461,7 +92576,7 @@ in
         ];
       })
       sources."readdirp-3.5.0"
-      sources."redoc-2.0.0-rc.47"
+      sources."redoc-2.0.0-rc.48"
       sources."reftools-1.1.7"
       sources."regenerator-runtime-0.13.7"
       sources."require-directory-2.1.1"
@@ -92500,7 +92615,7 @@ in
       sources."to-regex-range-5.0.1"
       sources."tslib-2.0.3"
       sources."tty-browserify-0.0.0"
-      sources."uglify-js-3.12.0"
+      sources."uglify-js-3.12.1"
       (sources."url-0.11.0" // {
         dependencies = [
           sources."punycode-1.3.2"
@@ -92533,7 +92648,7 @@ in
           sources."color-convert-2.0.1"
           sources."color-name-1.1.4"
           sources."wrap-ansi-6.2.0"
-          sources."y18n-4.0.0"
+          sources."y18n-4.0.1"
           sources."yargs-parser-18.1.3"
         ];
       })
@@ -92570,10 +92685,10 @@ in
   rollup = nodeEnv.buildNodePackage {
     name = "rollup";
     packageName = "rollup";
-    version = "2.33.3";
+    version = "2.34.0";
     src = fetchurl {
-      url = "https://registry.npmjs.org/rollup/-/rollup-2.33.3.tgz";
-      sha512 = "RpayhPTe4Gu/uFGCmk7Gp5Z9Qic2VsqZ040G+KZZvsZYdcuWaJg678JeDJJvJeEQXminu24a2au+y92CUWVd+w==";
+      url = "https://registry.npmjs.org/rollup/-/rollup-2.34.0.tgz";
+      sha512 = "dW5iLvttZzdVehjEuNJ1bWvuMEJjOWGmnuFS82WeKHTGXDkRHQeq/ExdifkSyJv9dLcR86ysKRmrIDyR6O0X8g==";
     };
     dependencies = [
       sources."fsevents-2.1.3"
@@ -92852,7 +92967,7 @@ in
       sources."resolve-1.19.0"
       sources."resolve-from-4.0.0"
       sources."rimraf-2.6.3"
-      sources."rollup-2.33.3"
+      sources."rollup-2.34.0"
       sources."safe-buffer-5.2.1"
       sources."semver-6.3.0"
       sources."serialize-javascript-5.0.1"
@@ -92926,7 +93041,7 @@ in
       })
       sources."wrappy-1.0.2"
       sources."write-1.0.3"
-      sources."y18n-4.0.0"
+      sources."y18n-4.0.1"
       sources."yallist-2.1.2"
       (sources."yargs-13.3.2" // {
         dependencies = [
@@ -93249,10 +93364,10 @@ in
   serverless = nodeEnv.buildNodePackage {
     name = "serverless";
     packageName = "serverless";
-    version = "2.13.0";
+    version = "2.14.0";
     src = fetchurl {
-      url = "https://registry.npmjs.org/serverless/-/serverless-2.13.0.tgz";
-      sha512 = "MOz0JYlPrWGwuyVUIncyaNRSlwOzVUFj5T/ITRjtO5PYXUWr+BB+yhZ97KoOhuL/hVnQ7ZjsmYgOvzo8hHwv9w==";
+      url = "https://registry.npmjs.org/serverless/-/serverless-2.14.0.tgz";
+      sha512 = "c3PRJPQqRmg2NRIcv3c0iD0XZbrJsEczWdSLXwi8AGdcokIbvjTM6fXOsq7i0nhL/BYyaib1O9WazEgmvpDGDw==";
     };
     dependencies = [
       sources."2-thenable-1.0.0"
@@ -93322,7 +93437,7 @@ in
       sources."@serverless/utils-china-1.0.11"
       sources."@sindresorhus/is-0.14.0"
       sources."@szmarczak/http-timer-1.1.2"
-      sources."@tencent-sdk/capi-1.1.6"
+      sources."@tencent-sdk/capi-1.1.8"
       sources."@types/cacheable-request-6.0.1"
       sources."@types/caseless-0.12.2"
       sources."@types/http-cache-semantics-4.0.0"
@@ -93386,7 +93501,7 @@ in
       sources."async-limiter-1.0.1"
       sources."asynckit-0.4.0"
       sources."at-least-node-1.0.0"
-      (sources."aws-sdk-2.799.0" // {
+      (sources."aws-sdk-2.800.0" // {
         dependencies = [
           sources."buffer-4.9.2"
           sources."ieee754-1.1.13"
@@ -93900,7 +94015,7 @@ in
       sources."promise-queue-2.2.5"
       (sources."protobufjs-6.10.2" // {
         dependencies = [
-          sources."@types/node-13.13.33"
+          sources."@types/node-13.13.34"
           sources."long-4.0.0"
         ];
       })
@@ -94744,17 +94859,21 @@ in
   snyk = nodeEnv.buildNodePackage {
     name = "snyk";
     packageName = "snyk";
-    version = "1.431.2";
+    version = "1.432.1";
     src = fetchurl {
-      url = "https://registry.npmjs.org/snyk/-/snyk-1.431.2.tgz";
-      sha512 = "DGm/bxtCSI/ReGK0vMphicQyZtVXiLgLvWkdDbRmsMb4Q7VRylAq9z+5lursLriED7eTjxlkgFMjOdGOuIoxpg==";
+      url = "https://registry.npmjs.org/snyk/-/snyk-1.432.1.tgz";
+      sha512 = "fyrxd921tgEkLx8XVUaWXu+0hqImQPQm9+EOWvVXcYUnw19TNUgAQsY02SY3f6AO35E9+JZbra1Okd56CrqYBg==";
     };
     dependencies = [
       sources."@sindresorhus/is-2.1.1"
-      sources."@snyk/cli-interface-2.9.2"
-      sources."@snyk/cocoapods-lockfile-parser-3.5.2"
+      sources."@snyk/cli-interface-2.11.0"
+      (sources."@snyk/cocoapods-lockfile-parser-3.5.2" // {
+        dependencies = [
+          sources."@snyk/dep-graph-1.19.4"
+        ];
+      })
       sources."@snyk/composer-lockfile-parser-1.4.1"
-      sources."@snyk/dep-graph-1.19.4"
+      sources."@snyk/dep-graph-1.21.0"
       sources."@snyk/docker-registry-v2-client-1.13.9"
       sources."@snyk/gemfile-1.2.0"
       sources."@snyk/java-call-graph-builder-1.16.2"
@@ -95139,14 +95258,16 @@ in
       sources."snyk-go-parser-1.4.1"
       (sources."snyk-go-plugin-1.16.2" // {
         dependencies = [
+          sources."@snyk/dep-graph-1.19.4"
           sources."rimraf-3.0.2"
           sources."tmp-0.2.1"
         ];
       })
-      (sources."snyk-gradle-plugin-3.10.2" // {
+      (sources."snyk-gradle-plugin-3.10.3" // {
         dependencies = [
           (sources."@snyk/cli-interface-2.9.1" // {
             dependencies = [
+              sources."@snyk/dep-graph-1.19.4"
               sources."tslib-1.14.1"
             ];
           })
@@ -95165,6 +95286,11 @@ in
       (sources."snyk-mvn-plugin-2.23.4" // {
         dependencies = [
           sources."@snyk/cli-interface-2.9.1"
+          (sources."@snyk/dep-graph-1.19.4" // {
+            dependencies = [
+              sources."tslib-1.14.1"
+            ];
+          })
           (sources."@snyk/java-call-graph-builder-1.16.5" // {
             dependencies = [
               sources."tmp-0.2.1"
@@ -95198,11 +95324,6 @@ in
       })
       (sources."snyk-poetry-lockfile-parser-1.1.1" // {
         dependencies = [
-          (sources."@snyk/dep-graph-1.21.0" // {
-            dependencies = [
-              sources."tslib-1.14.1"
-            ];
-          })
           sources."tslib-2.0.3"
         ];
       })
@@ -95538,7 +95659,7 @@ in
       sources."spdx-correct-3.1.1"
       sources."spdx-exceptions-2.3.0"
       sources."spdx-expression-parse-3.0.1"
-      sources."spdx-license-ids-3.0.6"
+      sources."spdx-license-ids-3.0.7"
       sources."speedtest-net-1.6.2"
       sources."string-width-2.1.1"
       sources."strip-ansi-4.0.0"
@@ -95838,7 +95959,7 @@ in
       sources."is-alphabetical-1.0.4"
       sources."is-alphanumerical-1.0.4"
       sources."is-arguments-1.0.4"
-      sources."is-bigint-1.0.0"
+      sources."is-bigint-1.0.1"
       sources."is-binary-path-1.0.1"
       sources."is-boolean-object-1.0.1"
       sources."is-buffer-1.1.6"
@@ -95966,7 +96087,7 @@ in
       })
       sources."napi-macros-2.0.0"
       sources."ncp-2.0.0"
-      sources."nearley-2.19.8"
+      sources."nearley-2.19.9"
       sources."nice-try-1.0.5"
       sources."node-gyp-build-4.2.3"
       sources."non-private-ip-1.4.4"
@@ -95987,7 +96108,7 @@ in
           })
         ];
       })
-      sources."object-inspect-1.8.0"
+      sources."object-inspect-1.9.0"
       sources."object-is-1.1.4"
       sources."object-keys-1.1.1"
       (sources."object-visit-1.0.1" // {
@@ -96480,7 +96601,7 @@ in
       sources."async-1.5.2"
       sources."async-limiter-1.0.1"
       sources."asynckit-0.4.0"
-      (sources."aws-sdk-2.799.0" // {
+      (sources."aws-sdk-2.800.0" // {
         dependencies = [
           sources."uuid-3.3.2"
         ];
@@ -97042,7 +97163,7 @@ in
       sources."spdx-correct-3.1.1"
       sources."spdx-exceptions-2.3.0"
       sources."spdx-expression-parse-3.0.1"
-      sources."spdx-license-ids-3.0.6"
+      sources."spdx-license-ids-3.0.7"
       sources."split-1.0.1"
       sources."sprintf-js-1.0.3"
       (sources."sshpk-1.16.1" // {
@@ -97211,7 +97332,7 @@ in
       sources."xpath-0.0.5"
       sources."xpath.js-1.1.0"
       sources."xtend-4.0.2"
-      sources."y18n-4.0.0"
+      sources."y18n-4.0.1"
       sources."yallist-2.1.2"
       (sources."yargs-6.6.0" // {
         dependencies = [
@@ -97311,7 +97432,7 @@ in
       sources."callsites-3.1.0"
       sources."camelcase-5.3.1"
       sources."camelcase-keys-6.2.2"
-      sources."caniuse-lite-1.0.30001161"
+      sources."caniuse-lite-1.0.30001164"
       (sources."chalk-4.1.0" // {
         dependencies = [
           sources."ansi-styles-4.3.0"
@@ -97349,7 +97470,7 @@ in
       sources."domelementtype-1.3.1"
       sources."domhandler-2.4.2"
       sources."domutils-1.7.0"
-      sources."electron-to-chromium-1.3.610"
+      sources."electron-to-chromium-1.3.612"
       sources."emoji-regex-8.0.0"
       sources."entities-1.1.2"
       sources."error-ex-1.3.2"
@@ -97531,7 +97652,7 @@ in
       sources."spdx-correct-3.1.1"
       sources."spdx-exceptions-2.3.0"
       sources."spdx-expression-parse-3.0.1"
-      sources."spdx-license-ids-3.0.6"
+      sources."spdx-license-ids-3.0.7"
       sources."specificity-0.4.1"
       sources."string-width-4.2.0"
       (sources."string_decoder-1.3.0" // {
@@ -97555,7 +97676,7 @@ in
       sources."unified-9.2.0"
       sources."uniq-1.0.1"
       sources."unist-util-find-all-after-3.0.2"
-      sources."unist-util-is-4.0.3"
+      sources."unist-util-is-4.0.4"
       sources."unist-util-stringify-position-2.0.3"
       sources."uri-js-4.4.0"
       sources."util-deprecate-1.0.2"
@@ -97637,7 +97758,7 @@ in
       sources."minimist-1.2.5"
       sources."mkdirp-0.5.5"
       sources."nth-check-1.0.2"
-      sources."object-inspect-1.8.0"
+      sources."object-inspect-1.9.0"
       sources."object-keys-1.1.1"
       sources."object.assign-4.1.2"
       sources."object.getownpropertydescriptors-2.1.1"
@@ -98239,7 +98360,7 @@ in
       sources."truncate-utf8-bytes-1.0.2"
       sources."type-is-1.6.18"
       sources."typedarray-0.0.6"
-      sources."uglify-js-3.12.0"
+      sources."uglify-js-3.12.1"
       sources."undefsafe-2.0.3"
       (sources."union-value-1.0.1" // {
         dependencies = [
@@ -98406,7 +98527,7 @@ in
       sources."which-module-2.0.0"
       sources."wrap-ansi-5.1.0"
       sources."ws-6.2.1"
-      sources."y18n-4.0.0"
+      sources."y18n-4.0.1"
       sources."yargs-13.3.2"
       sources."yargs-parser-13.1.2"
     ];
@@ -98588,7 +98709,7 @@ in
       sources."ms-2.1.2"
       sources."normalize-package-data-2.5.0"
       sources."number-is-nan-1.0.1"
-      sources."object-inspect-1.8.0"
+      sources."object-inspect-1.9.0"
       sources."object-is-1.1.4"
       sources."object-keys-1.1.1"
       sources."object.assign-4.1.2"
@@ -98637,7 +98758,7 @@ in
       sources."spdx-correct-3.1.1"
       sources."spdx-exceptions-2.3.0"
       sources."spdx-expression-parse-3.0.1"
-      sources."spdx-license-ids-3.0.6"
+      sources."spdx-license-ids-3.0.7"
       sources."sprintf-js-1.0.3"
       sources."state-toggle-1.0.3"
       (sources."string-width-1.0.2" // {
@@ -98746,7 +98867,7 @@ in
       sources."is-regex-1.1.1"
       sources."is-symbol-1.0.3"
       sources."match-index-1.0.3"
-      sources."object-inspect-1.8.0"
+      sources."object-inspect-1.9.0"
       sources."object-keys-1.1.1"
       sources."object.assign-4.1.2"
       sources."regexp.prototype.flags-1.3.0"
@@ -99058,7 +99179,7 @@ in
       sources."spdx-correct-3.1.1"
       sources."spdx-exceptions-2.3.0"
       sources."spdx-expression-parse-3.0.1"
-      sources."spdx-license-ids-3.0.6"
+      sources."spdx-license-ids-3.0.7"
       sources."split-0.2.10"
       (sources."split-transform-stream-0.1.1" // {
         dependencies = [
@@ -99125,7 +99246,7 @@ in
       sources."unified-message-control-3.0.1"
       sources."unique-string-2.0.0"
       sources."unist-util-inspect-5.0.1"
-      sources."unist-util-is-4.0.3"
+      sources."unist-util-is-4.0.4"
       sources."unist-util-modify-children-2.0.0"
       sources."unist-util-position-3.1.0"
       sources."unist-util-remove-position-2.0.1"
@@ -99325,7 +99446,7 @@ in
       sources."is-regex-1.1.1"
       sources."is-symbol-1.0.3"
       sources."object-assign-4.1.1"
-      sources."object-inspect-1.8.0"
+      sources."object-inspect-1.9.0"
       sources."object-keys-1.1.1"
       sources."object.assign-4.1.2"
       sources."object.values-1.1.2"
@@ -99378,7 +99499,7 @@ in
       sources."is-date-object-1.0.2"
       sources."is-regex-1.1.1"
       sources."is-symbol-1.0.3"
-      sources."object-inspect-1.8.0"
+      sources."object-inspect-1.9.0"
       sources."object-keys-1.1.1"
       sources."object.assign-4.1.2"
       sources."string.prototype.trimend-1.0.3"
@@ -99479,7 +99600,7 @@ in
       sources."is-regex-1.1.1"
       sources."is-string-1.0.5"
       sources."is-symbol-1.0.3"
-      sources."object-inspect-1.8.0"
+      sources."object-inspect-1.9.0"
       sources."object-keys-1.1.1"
       sources."object.assign-4.1.2"
       sources."string.prototype.trimend-1.0.3"
@@ -100472,10 +100593,10 @@ in
   uglify-js = nodeEnv.buildNodePackage {
     name = "uglify-js";
     packageName = "uglify-js";
-    version = "3.12.0";
+    version = "3.12.1";
     src = fetchurl {
-      url = "https://registry.npmjs.org/uglify-js/-/uglify-js-3.12.0.tgz";
-      sha512 = "8lBMSkFZuAK7gGF8LswsXmir8eX8d2AAMOnxSDWjKBx/fBR6MypQjs78m6ML9zQVp1/hD4TBdfeMZMC7nW1TAA==";
+      url = "https://registry.npmjs.org/uglify-js/-/uglify-js-3.12.1.tgz";
+      sha512 = "o8lHP20KjIiQe5b/67Rh68xEGRrc2SRsCuuoYclXXoC74AfSRGblU1HKzJWH3HxPZ+Ort85fWHpSX7KwBUC9CQ==";
     };
     buildInputs = globalBuildInputs;
     meta = {
@@ -101156,8 +101277,9 @@ in
       sources."jsonc-parser-2.3.1"
       sources."ms-2.0.0"
       sources."request-light-0.3.0"
-      (sources."vscode-json-languageservice-3.10.0" // {
+      (sources."vscode-json-languageservice-3.11.0" // {
         dependencies = [
+          sources."jsonc-parser-3.0.0"
           sources."vscode-nls-5.0.0"
         ];
       })
@@ -101200,9 +101322,9 @@ in
           sources."vscode-nls-4.1.2"
         ];
       })
-      (sources."vscode-json-languageservice-3.10.0" // {
+      (sources."vscode-json-languageservice-3.11.0" // {
         dependencies = [
-          sources."jsonc-parser-2.3.1"
+          sources."jsonc-parser-3.0.0"
           sources."vscode-nls-5.0.0"
           sources."vscode-uri-2.1.2"
         ];
@@ -101698,7 +101820,7 @@ in
           sources."kind-of-3.2.2"
         ];
       })
-      sources."object-inspect-1.8.0"
+      sources."object-inspect-1.9.0"
       sources."object-keys-1.1.1"
       sources."object-visit-1.0.1"
       sources."object.assign-4.1.0"
@@ -102025,7 +102147,7 @@ in
       })
       sources."wrappy-1.0.2"
       sources."xtend-4.0.2"
-      sources."y18n-4.0.0"
+      sources."y18n-4.0.1"
       sources."yallist-3.1.1"
       (sources."yargs-13.3.2" // {
         dependencies = [
@@ -102299,7 +102421,7 @@ in
       sources."tslib-1.14.1"
       sources."tunnel-agent-0.6.0"
       sources."tweetnacl-0.14.5"
-      sources."uglify-js-3.12.0"
+      sources."uglify-js-3.12.1"
       sources."uid-0.0.2"
       sources."unbzip2-stream-1.4.3"
       sources."unyield-0.0.1"
@@ -103030,7 +103152,7 @@ in
       sources."spdx-correct-3.1.1"
       sources."spdx-exceptions-2.3.0"
       sources."spdx-expression-parse-3.0.1"
-      sources."spdx-license-ids-3.0.6"
+      sources."spdx-license-ids-3.0.7"
       sources."split-string-3.1.0"
       sources."sprintf-js-1.0.3"
       sources."stampit-1.2.0"
@@ -103202,7 +103324,7 @@ in
       })
       sources."vfile-sort-2.2.2"
       sources."vfile-statistics-1.1.4"
-      (sources."vscode-css-languageservice-4.3.5" // {
+      (sources."vscode-css-languageservice-4.4.0" // {
         dependencies = [
           sources."vscode-languageserver-types-3.16.0-next.2"
           sources."vscode-uri-2.1.2"
@@ -103947,7 +104069,7 @@ in
       })
       sources."mz-2.7.0"
       sources."nan-2.14.2"
-      sources."nanoid-3.1.18"
+      sources."nanoid-3.1.20"
       sources."nanomatch-1.2.13"
       sources."natural-compare-1.4.0"
       sources."natural-compare-lite-1.4.0"
@@ -103984,7 +104106,7 @@ in
           sources."kind-of-3.2.2"
         ];
       })
-      sources."object-inspect-1.8.0"
+      sources."object-inspect-1.9.0"
       sources."object-is-1.1.4"
       sources."object-keys-1.1.1"
       (sources."object-visit-1.0.1" // {
@@ -104361,7 +104483,7 @@ in
           sources."decamelize-1.2.0"
           sources."strip-ansi-6.0.0"
           sources."wrap-ansi-6.2.0"
-          sources."y18n-4.0.0"
+          sources."y18n-4.0.1"
           sources."yargs-parser-18.1.3"
         ];
       })
@@ -104391,10 +104513,10 @@ in
   webpack = nodeEnv.buildNodePackage {
     name = "webpack";
     packageName = "webpack";
-    version = "5.8.0";
+    version = "5.9.0";
     src = fetchurl {
-      url = "https://registry.npmjs.org/webpack/-/webpack-5.8.0.tgz";
-      sha512 = "X2yosPiHip3L0TE+ylruzrOqSgEgsdGyBOGFWKYChcwlKChaw9VodZIUovG1oo7s0ss6e3ZxBMn9tXR+nkPThA==";
+      url = "https://registry.npmjs.org/webpack/-/webpack-5.9.0.tgz";
+      sha512 = "YnnqIV/uAS5ZrNpctSv378qV7HmbJ74DL+XfvMxzbX1bV9e7eeT6eEWU4wuUw33CNr/HspBh7R/xQlVjTEyAeA==";
     };
     dependencies = [
       sources."@types/eslint-7.2.5"
@@ -104427,11 +104549,11 @@ in
       sources."ajv-keywords-3.5.2"
       sources."browserslist-4.14.7"
       sources."buffer-from-1.1.1"
-      sources."caniuse-lite-1.0.30001161"
+      sources."caniuse-lite-1.0.30001164"
       sources."chrome-trace-event-1.0.2"
       sources."colorette-1.2.1"
       sources."commander-2.20.3"
-      sources."electron-to-chromium-1.3.610"
+      sources."electron-to-chromium-1.3.612"
       sources."enhanced-resolve-5.3.2"
       sources."escalade-3.1.1"
       sources."eslint-scope-5.1.1"
@@ -104907,7 +105029,7 @@ in
           sources."kind-of-3.2.2"
         ];
       })
-      sources."object-inspect-1.8.0"
+      sources."object-inspect-1.9.0"
       sources."object-is-1.1.4"
       sources."object-keys-1.1.1"
       sources."object-visit-1.0.1"
@@ -105156,7 +105278,7 @@ in
       })
       sources."wrappy-1.0.2"
       sources."ws-6.2.1"
-      sources."y18n-4.0.0"
+      sources."y18n-4.0.1"
       sources."yargs-13.3.2"
       sources."yargs-parser-13.1.2"
     ];
@@ -105305,7 +105427,7 @@ in
       sources."@protobufjs/pool-1.1.0"
       sources."@protobufjs/utf8-1.1.0"
       sources."@types/long-4.0.1"
-      sources."@types/node-13.13.33"
+      sources."@types/node-13.13.34"
       sources."addr-to-ip-port-1.5.1"
       sources."airplay-js-0.3.0"
       sources."balanced-match-1.0.0"
@@ -105669,8 +105791,9 @@ in
       sources."ms-2.0.0"
       sources."request-light-0.2.5"
       sources."sprintf-js-1.0.3"
-      (sources."vscode-json-languageservice-3.10.0" // {
+      (sources."vscode-json-languageservice-3.11.0" // {
         dependencies = [
+          sources."jsonc-parser-3.0.0"
           sources."vscode-languageserver-types-3.16.0-next.2"
           sources."vscode-nls-5.0.0"
         ];
@@ -106403,7 +106526,7 @@ in
       sources."spdx-correct-3.1.1"
       sources."spdx-exceptions-2.3.0"
       sources."spdx-expression-parse-3.0.1"
-      sources."spdx-license-ids-3.0.6"
+      sources."spdx-license-ids-3.0.7"
       sources."split-string-3.1.0"
       sources."sprintf-js-1.1.2"
       sources."sshpk-1.16.1"
diff --git a/third_party/nixpkgs/pkgs/development/ocaml-modules/angstrom-async/default.nix b/third_party/nixpkgs/pkgs/development/ocaml-modules/angstrom-async/default.nix
index ac900a8dd1..60e774918d 100644
--- a/third_party/nixpkgs/pkgs/development/ocaml-modules/angstrom-async/default.nix
+++ b/third_party/nixpkgs/pkgs/development/ocaml-modules/angstrom-async/default.nix
@@ -3,7 +3,7 @@
 buildDunePackage rec {
   pname = "angstrom-async";
 
-  inherit (angstrom) version src;
+  inherit (angstrom) version useDune2 src;
 
   minimumOCamlVersion = "4.04.1";
 
diff --git a/third_party/nixpkgs/pkgs/development/ocaml-modules/angstrom-lwt-unix/default.nix b/third_party/nixpkgs/pkgs/development/ocaml-modules/angstrom-lwt-unix/default.nix
index d249c45129..eb4de44d7a 100644
--- a/third_party/nixpkgs/pkgs/development/ocaml-modules/angstrom-lwt-unix/default.nix
+++ b/third_party/nixpkgs/pkgs/development/ocaml-modules/angstrom-lwt-unix/default.nix
@@ -3,7 +3,7 @@
 buildDunePackage rec {
   pname = "angstrom-lwt-unix";
 
-  inherit (angstrom) version src;
+  inherit (angstrom) version useDune2 src;
 
   minimumOCamlVersion = "4.03";
 
diff --git a/third_party/nixpkgs/pkgs/development/ocaml-modules/angstrom-unix/default.nix b/third_party/nixpkgs/pkgs/development/ocaml-modules/angstrom-unix/default.nix
index 0d4ab400dd..134c161d26 100644
--- a/third_party/nixpkgs/pkgs/development/ocaml-modules/angstrom-unix/default.nix
+++ b/third_party/nixpkgs/pkgs/development/ocaml-modules/angstrom-unix/default.nix
@@ -3,7 +3,7 @@
 buildDunePackage rec {
   pname = "angstrom-unix";
 
-  inherit (angstrom) version src;
+  inherit (angstrom) version useDune2 src;
 
   minimumOCamlVersion = "4.03";
 
diff --git a/third_party/nixpkgs/pkgs/development/ocaml-modules/angstrom/default.nix b/third_party/nixpkgs/pkgs/development/ocaml-modules/angstrom/default.nix
index 75eb2255ee..749a043e73 100644
--- a/third_party/nixpkgs/pkgs/development/ocaml-modules/angstrom/default.nix
+++ b/third_party/nixpkgs/pkgs/development/ocaml-modules/angstrom/default.nix
@@ -1,8 +1,9 @@
-{ lib, fetchFromGitHub, buildDunePackage, ocaml, alcotest, result, bigstringaf, ppx_let }:
+{ lib, fetchFromGitHub, buildDunePackage, ocaml, ocaml-syntax-shims, alcotest, result, bigstringaf, ppx_let }:
 
 buildDunePackage rec {
   pname = "angstrom";
   version = "0.15.0";
+  useDune2 = true;
 
   minimumOCamlVersion = "4.04";
 
@@ -14,6 +15,7 @@ buildDunePackage rec {
   };
 
   checkInputs = [ alcotest ppx_let ];
+  buildInputs = [ ocaml-syntax-shims ];
   propagatedBuildInputs = [ bigstringaf result ];
   doCheck = lib.versionAtLeast ocaml.version "4.05";
 
diff --git a/third_party/nixpkgs/pkgs/development/ocaml-modules/astring/default.nix b/third_party/nixpkgs/pkgs/development/ocaml-modules/astring/default.nix
index b636016089..f790a87e22 100644
--- a/third_party/nixpkgs/pkgs/development/ocaml-modules/astring/default.nix
+++ b/third_party/nixpkgs/pkgs/development/ocaml-modules/astring/default.nix
@@ -1,12 +1,25 @@
 { stdenv, fetchurl, ocaml, findlib, ocamlbuild, topkg }:
 
-stdenv.mkDerivation rec {
-  version = "0.8.3";
-  name = "ocaml${ocaml.version}-astring-${version}";
+let
+  # Use astring 0.8.3 for OCaml < 4.05
+  param =
+    if stdenv.lib.versionAtLeast ocaml.version "4.05"
+    then {
+      version = "0.8.5";
+      sha256 = "1ykhg9gd3iy7zsgyiy2p9b1wkpqg9irw5pvcqs3sphq71iir4ml6";
+    } else {
+      version = "0.8.3";
+      sha256 = "0ixjwc3plrljvj24za3l9gy0w30lsbggp8yh02lwrzw61ls4cri0";
+    };
+in
+
+stdenv.mkDerivation {
+  name = "ocaml${ocaml.version}-astring-${param.version}";
+  inherit (param) version;
 
   src = fetchurl {
-    url = "https://erratique.ch/software/astring/releases/astring-${version}.tbz";
-    sha256 = "0ixjwc3plrljvj24za3l9gy0w30lsbggp8yh02lwrzw61ls4cri0";
+    url = "https://erratique.ch/software/astring/releases/astring-${param.version}.tbz";
+    inherit (param) sha256;
   };
 
   buildInputs = [ ocaml findlib ocamlbuild topkg ];
diff --git a/third_party/nixpkgs/pkgs/development/ocaml-modules/bigstringaf/default.nix b/third_party/nixpkgs/pkgs/development/ocaml-modules/bigstringaf/default.nix
index 9f6810379a..852459c2ba 100644
--- a/third_party/nixpkgs/pkgs/development/ocaml-modules/bigstringaf/default.nix
+++ b/third_party/nixpkgs/pkgs/development/ocaml-modules/bigstringaf/default.nix
@@ -2,7 +2,9 @@
 
 buildDunePackage rec {
   pname = "bigstringaf";
-  version = "0.6.0";
+  version = "0.7.0";
+
+  useDune2 = true;
 
   minimumOCamlVersion = "4.03";
 
@@ -10,7 +12,7 @@ buildDunePackage rec {
     owner = "inhabitedtype";
     repo = pname;
     rev = version;
-    sha256 = "04b088vrqzmxsyan9f9nr8721bxip4b930cgvb5zkbbmrw3ylmwc";
+    sha256 = "1q1sqxzdnlrpl95ccrhl7lwy3zswgd9rbn19ildclh0lyi2vazbj";
   };
 
   checkInputs = [ alcotest ];
diff --git a/third_party/nixpkgs/pkgs/development/ocaml-modules/ctypes/default.nix b/third_party/nixpkgs/pkgs/development/ocaml-modules/ctypes/default.nix
index e541f0741a..8a16dcec34 100644
--- a/third_party/nixpkgs/pkgs/development/ocaml-modules/ctypes/default.nix
+++ b/third_party/nixpkgs/pkgs/development/ocaml-modules/ctypes/default.nix
@@ -6,11 +6,11 @@ else
 
 stdenv.mkDerivation rec {
   name = "ocaml${ocaml.version}-ctypes-${version}";
-  version = "0.16.0";
+  version = "0.17.1";
 
   src = fetchzip {
     url = "https://github.com/ocamllabs/ocaml-ctypes/archive/${version}.tar.gz";
-    sha256 = "0qh2gfx5682wkk2nm1ybspzz9c2xvlnnf6iv08a89kbwa1hvdqrg";
+    sha256 = "16brmdnz7wi2z25qqhd5s5blyq4app6jbv6g9pa4vyg6h0nzbcys";
   };
 
   nativeBuildInputs = [ pkgconfig ];
diff --git a/third_party/nixpkgs/pkgs/development/ocaml-modules/earlybird/default.nix b/third_party/nixpkgs/pkgs/development/ocaml-modules/earlybird/default.nix
index decbb41176..b36874d49d 100644
--- a/third_party/nixpkgs/pkgs/development/ocaml-modules/earlybird/default.nix
+++ b/third_party/nixpkgs/pkgs/development/ocaml-modules/earlybird/default.nix
@@ -10,6 +10,8 @@ buildDunePackage rec {
   pname = "earlybird";
   version = "0.1.5";
 
+  useDune2 = true;
+
   minimumOCamlVersion = "4.04";
 
   src = fetchurl {
diff --git a/third_party/nixpkgs/pkgs/development/ocaml-modules/functoria/default.nix b/third_party/nixpkgs/pkgs/development/ocaml-modules/functoria/default.nix
index 330ab26e8e..4f10832039 100644
--- a/third_party/nixpkgs/pkgs/development/ocaml-modules/functoria/default.nix
+++ b/third_party/nixpkgs/pkgs/development/ocaml-modules/functoria/default.nix
@@ -1,16 +1,18 @@
-{ stdenv, fetchurl, buildDunePackage, alcotest, cmdliner
+{ lib, fetchurl, buildDunePackage, alcotest, cmdliner
 , rresult, astring, fmt, ocamlgraph, logs, bos, fpath, ptime
 }:
 
 buildDunePackage rec {
   pname   = "functoria";
-  version = "3.1.0";
+  version = "3.1.1";
+
+  useDune2 = true;
 
   minimumOCamlVersion = "4.04";
 
   src = fetchurl {
     url = "https://github.com/mirage/${pname}/releases/download/v${version}/${pname}-v${version}.tbz";
-    sha256 = "15jdqdj1vfi0x9gjydrrnbwzwbzw34w1iir032jrji820xlblky2";
+    sha256 = "0bihxbq16zwsi7frk4b8wz8993mvy2ym3n6288jhv0n0gb7c2f7m";
   };
 
   propagatedBuildInputs = [ cmdliner rresult astring fmt ocamlgraph logs bos fpath ptime ];
@@ -18,7 +20,7 @@ buildDunePackage rec {
 
   doCheck = true;
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "A DSL to organize functor applications";
     homepage    = "https://github.com/mirage/functoria";
     license     = licenses.isc;
diff --git a/third_party/nixpkgs/pkgs/development/ocaml-modules/functoria/runtime.nix b/third_party/nixpkgs/pkgs/development/ocaml-modules/functoria/runtime.nix
index 806ae82b6e..2ba13ce873 100644
--- a/third_party/nixpkgs/pkgs/development/ocaml-modules/functoria/runtime.nix
+++ b/third_party/nixpkgs/pkgs/development/ocaml-modules/functoria/runtime.nix
@@ -3,7 +3,7 @@
 buildDunePackage {
   pname = "functoria-runtime";
 
-  inherit (functoria) version src;
+  inherit (functoria) version useDune2 src;
 
   propagatedBuildInputs = [ cmdliner fmt ];
   checkInputs = [ alcotest functoria];
diff --git a/third_party/nixpkgs/pkgs/development/ocaml-modules/integers/default.nix b/third_party/nixpkgs/pkgs/development/ocaml-modules/integers/default.nix
index a949b339c7..ca14c3ca87 100644
--- a/third_party/nixpkgs/pkgs/development/ocaml-modules/integers/default.nix
+++ b/third_party/nixpkgs/pkgs/development/ocaml-modules/integers/default.nix
@@ -2,11 +2,11 @@
 
 buildDunePackage rec {
 	pname = "integers";
-	version = "0.3.0";
+	version = "0.4.0";
 
 	src = fetchzip {
 		url = "https://github.com/ocamllabs/ocaml-integers/archive/${version}.tar.gz";
-		sha256 = "1yhif5zh4srh63mhimfx3p5ljpb3lixjdd3i9pjnbj2qgpzlqj8p";
+		sha256 = "0yp3ab0ph7mp5741g7333x4nx8djjvxzpnv3zvsndyzcycspn9dd";
 	};
 
 	meta = {
diff --git a/third_party/nixpkgs/pkgs/development/ocaml-modules/ke/default.nix b/third_party/nixpkgs/pkgs/development/ocaml-modules/ke/default.nix
index e1b68a1d2d..f14383207e 100644
--- a/third_party/nixpkgs/pkgs/development/ocaml-modules/ke/default.nix
+++ b/third_party/nixpkgs/pkgs/development/ocaml-modules/ke/default.nix
@@ -7,6 +7,8 @@ buildDunePackage rec {
   pname = "ke";
   version = "0.4";
 
+  useDune2 = true;
+
   src = fetchurl {
     url = "https://github.com/mirage/ke/releases/download/v${version}/ke-v${version}.tbz";
     sha256 = "13c9xy60vmq29mnwpg3h3zgl6gjbjfwbx1s0crfc6xwvark0zxnx";
@@ -14,7 +16,7 @@ buildDunePackage rec {
 
   propagatedBuildInputs = [ bigarray-compat fmt ];
 
-  checkInputs = lib.optionals doCheck [ alcotest bigstringaf ];
+  checkInputs = [ alcotest bigstringaf ];
   doCheck = true;
 
   minimumOCamlVersion = "4.03";
diff --git a/third_party/nixpkgs/pkgs/development/ocaml-modules/mirage/runtime.nix b/third_party/nixpkgs/pkgs/development/ocaml-modules/mirage/runtime.nix
index 9c9a479d52..700065ba8e 100644
--- a/third_party/nixpkgs/pkgs/development/ocaml-modules/mirage/runtime.nix
+++ b/third_party/nixpkgs/pkgs/development/ocaml-modules/mirage/runtime.nix
@@ -3,7 +3,7 @@
 
 buildDunePackage rec {
   pname = "mirage-runtime";
-  version = "3.9.0";
+  version = "3.10.0";
 
   useDune2 = true;
 
@@ -11,7 +11,7 @@ buildDunePackage rec {
 
   src = fetchurl {
     url = "https://github.com/mirage/mirage/releases/download/v${version}/mirage-v${version}.tbz";
-    sha256 = "1hznh49v1jlkwww6xi9f2f4yjzlh9qfvdrrdzvddnwsh3g00flla";
+    sha256 = "01nq358bilsvvwrvyavc5gik1csjljn4rb3k8yx94gxvbj5vx4h2";
   };
 
   propagatedBuildInputs = [ ipaddr functoria-runtime fmt logs ocaml_lwt ];
diff --git a/third_party/nixpkgs/pkgs/development/ocaml-modules/mirage/types-lwt.nix b/third_party/nixpkgs/pkgs/development/ocaml-modules/mirage/types-lwt.nix
new file mode 100644
index 0000000000..ac232b0be6
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/development/ocaml-modules/mirage/types-lwt.nix
@@ -0,0 +1,13 @@
+{ lib, buildDunePackage, mirage-types
+}:
+
+buildDunePackage {
+  pname = "mirage-types-lwt";
+  inherit (mirage-types) version src useDune2;
+
+  propagatedBuildInputs = [ mirage-types ];
+
+  meta = mirage-types.meta // {
+    description = "Lwt module type definitions for MirageOS applications";
+  };
+}
diff --git a/third_party/nixpkgs/pkgs/development/ocaml-modules/mirage/types.nix b/third_party/nixpkgs/pkgs/development/ocaml-modules/mirage/types.nix
new file mode 100644
index 0000000000..f30a9e263b
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/development/ocaml-modules/mirage/types.nix
@@ -0,0 +1,19 @@
+{ lib, buildDunePackage, mirage
+, mirage-block, mirage-channel, mirage-clock, mirage-console, mirage-device
+, mirage-flow, mirage-fs, mirage-kv, mirage-net, mirage-protocols, mirage-random
+, mirage-stack, mirage-time
+}:
+
+buildDunePackage {
+  pname = "mirage-types";
+  inherit (mirage) src version useDune2;
+
+  propagatedBuildInputs = [ mirage-block mirage-channel mirage-clock
+    mirage-console mirage-device mirage-flow mirage-fs mirage-kv mirage-net
+    mirage-protocols mirage-random mirage-stack mirage-time
+  ];
+
+  meta = mirage.meta // {
+    description = "Module type definitions for MirageOS applications";
+  };
+}
diff --git a/third_party/nixpkgs/pkgs/development/php-packages/couchbase/default.nix b/third_party/nixpkgs/pkgs/development/php-packages/couchbase/default.nix
index abe4b7efde..4ec7184691 100644
--- a/third_party/nixpkgs/pkgs/development/php-packages/couchbase/default.nix
+++ b/third_party/nixpkgs/pkgs/development/php-packages/couchbase/default.nix
@@ -14,9 +14,10 @@ buildPecl {
   };
 
   configureFlags = [ "--with-couchbase" ];
+  broken = lib.versionAtLeast php.version "8.0";
 
   buildInputs = with pkgs; [ libcouchbase zlib ];
-  internalDeps = [ php.extensions.json ];
+  internalDeps = [] ++ lib.optionals (lib.versionOlder php.version "8.0") [ php.extensions.json ];
   peclDeps = [ php.extensions.igbinary ];
 
   patches = [
diff --git a/third_party/nixpkgs/pkgs/development/php-packages/imagick/default.nix b/third_party/nixpkgs/pkgs/development/php-packages/imagick/default.nix
index 63524fb2d0..504e15ae16 100644
--- a/third_party/nixpkgs/pkgs/development/php-packages/imagick/default.nix
+++ b/third_party/nixpkgs/pkgs/development/php-packages/imagick/default.nix
@@ -1,4 +1,4 @@
-{ buildPecl, lib, pkgs, pcre' }:
+{ buildPecl, fetchpatch, lib, pkgs, pcre' }:
 
 buildPecl {
   pname = "imagick";
@@ -6,6 +6,14 @@ buildPecl {
   version = "3.4.4";
   sha256 = "0xvhaqny1v796ywx83w7jyjyd0nrxkxf34w9zi8qc8aw8qbammcd";
 
+  patches = [
+    # Fix compatibility with PHP 8.
+    (fetchpatch {
+      url = "https://github.com/Imagick/imagick/pull/336.patch";
+      sha256 = "nuRdh02qaMx0s/5OzlfWjyYgZG1zgrYnAjsZ/UVIrUM=";
+    })
+  ];
+
   configureFlags = [ "--with-imagick=${pkgs.imagemagick.dev}" ];
   nativeBuildInputs = [ pkgs.pkgconfig ];
   buildInputs = [ pcre' ];
diff --git a/third_party/nixpkgs/pkgs/development/php-packages/phpstan/default.nix b/third_party/nixpkgs/pkgs/development/php-packages/phpstan/default.nix
index 1cbcdb9a73..7ac33ab3c1 100644
--- a/third_party/nixpkgs/pkgs/development/php-packages/phpstan/default.nix
+++ b/third_party/nixpkgs/pkgs/development/php-packages/phpstan/default.nix
@@ -1,14 +1,14 @@
 { mkDerivation, fetchurl, pkgs, lib, php }:
 let
   pname = "phpstan";
-  version = "0.12.57";
+  version = "0.12.58";
 in
 mkDerivation {
   inherit pname version;
 
   src = pkgs.fetchurl {
     url = "https://github.com/phpstan/phpstan/releases/download/${version}/phpstan.phar";
-    sha256 = "0i1ycfmi638myl9840k4rl0z9klk0q25l8ykkkfg20kx5mdidvgc";
+    sha256 = "1509z783rhrnlx32a3yg58sy81971dv1sf8nzs8am2m9qnpmdcll";
   };
 
   phases = [ "installPhase" ];
diff --git a/third_party/nixpkgs/pkgs/development/php-packages/redis/default.nix b/third_party/nixpkgs/pkgs/development/php-packages/redis/default.nix
index 41ff8f3868..a61ae1194f 100644
--- a/third_party/nixpkgs/pkgs/development/php-packages/redis/default.nix
+++ b/third_party/nixpkgs/pkgs/development/php-packages/redis/default.nix
@@ -7,8 +7,9 @@ buildPecl {
   sha256 = "1cfsbxf3q3im0cmalgk76jpz581zr92z03c1viy93jxb53k2vsgl";
 
   internalDeps = with php.extensions; [
-    json
     session
+  ] ++ lib.optionals (lib.versionOlder php.version "8.0") [
+    json
   ] ++ lib.optionals (lib.versionOlder php.version "7.4") [
     hash
   ];
diff --git a/third_party/nixpkgs/pkgs/development/php-packages/yaml/default.nix b/third_party/nixpkgs/pkgs/development/php-packages/yaml/default.nix
index 603fd3ddd5..6ad3b778f8 100644
--- a/third_party/nixpkgs/pkgs/development/php-packages/yaml/default.nix
+++ b/third_party/nixpkgs/pkgs/development/php-packages/yaml/default.nix
@@ -3,8 +3,8 @@
 buildPecl {
   pname = "yaml";
 
-  version = "2.1.0";
-  sha256 = "0rmn2irzny24ivzc09ss46s2s48i0zy2cww7ikphljqbfx6zdjss";
+  version = "2.2.0";
+  sha256 = "1d65cf5vnr7brhxmy1pi2axjiyvdhmpcnq0qlx5spwlgkv6hnyml";
 
   configureFlags = [ "--with-yaml=${pkgs.libyaml}" ];
 
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/Wand/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/Wand/default.nix
index e82fd1d139..c897b04e88 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/Wand/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/Wand/default.nix
@@ -6,11 +6,11 @@
 
 buildPythonPackage rec {
   pname = "Wand";
-  version = "0.6.4";
+  version = "0.6.5";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "6aeb0183d94762b37a8cdee97174f38ae21e626d44f62f1e2f0ab48a35026e98";
+    sha256 = "ec981b4f07f7582fc564aba8b57763a549392e9ef8b6a338e9da54cdd229cf95";
   };
 
   postPatch = ''
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/bitstruct/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/bitstruct/default.nix
index 6134d92622..43edd16f66 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/bitstruct/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/bitstruct/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "bitstruct";
-  version = "8.11.0";
+  version = "8.11.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0p9d5242pkzag7ac5b5zdjyfqwxvj2jisyjghp6yhjbbwz1z44rb";
+    sha256 = "4e7b8769c0f09fee403d0a5f637f8b575b191a79a92e140811aa109ce7461f0c";
   };
 
   meta = with lib; {
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/blessed/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/blessed/default.nix
index b55e293998..7f1a24b485 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/blessed/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/blessed/default.nix
@@ -4,11 +4,11 @@
 
 buildPythonPackage rec {
   pname = "blessed";
-  version = "1.17.11";
+  version = "1.17.12";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "7d4914079a6e8e14fbe080dcaf14dee596a088057cdc598561080e3266123b48";
+    sha256 = "580429e7e0c6f6a42ea81b0ae5a4993b6205c6ccbb635d034b4277af8175753e";
   };
 
   checkInputs = [ pytest mock glibcLocales ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/blis/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/blis/default.nix
index 1d6d7806b9..8174ef240d 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/blis/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/blis/default.nix
@@ -9,11 +9,11 @@
 
 buildPythonPackage rec {
   pname = "blis";
-  version = "0.7.2";
+  version = "0.7.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "c14fb9ec3f5ed7c4940c132c7691469ac5d3e302891d95e935623bf1d4e17fbb";
+    sha256 = "19557b14763253ca3d4f6cfc9c9fe2eed3d65db14fa273ced8b0c17ce2bfda4a";
   };
 
   nativeBuildInputs = [
@@ -34,6 +34,7 @@ buildPythonPackage rec {
     description = "BLAS-like linear algebra library";
     homepage = "https://github.com/explosion/cython-blis";
     license = licenses.bsd3;
+    platforms = platforms.x86_64;
     maintainers = with maintainers; [ danieldk ];
   };
 }
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/bme680/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/bme680/default.nix
index 0fd2870181..cdae502e7e 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/bme680/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/bme680/default.nix
@@ -32,6 +32,7 @@ buildPythonPackage rec {
     description = "Python library for driving the Pimoroni BME680 Breakout";
     homepage = "https://github.com/pimoroni/bme680-python";
     license = licenses.mit;
+    platforms = platforms.linux;
     maintainers = with maintainers; [ mic92 ];
   };
 }
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/bsddb3/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/bsddb3/default.nix
index 39ffaae653..0989b61b6c 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/bsddb3/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/bsddb3/default.nix
@@ -7,11 +7,11 @@
 
 buildPythonPackage rec {
   pname = "bsddb3";
-  version = "6.2.7";
+  version = "6.2.9";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "17yw0by4lycwpvnx06cnzbbchz4zvzbx3j89b20xa314xdizmxxh";
+    sha256 = "70d05ec8dc568f42e70fc919a442e0daadc2a905a1cfb7ca77f549d49d6e7801";
   };
 
   buildInputs = [ pkgs.db ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/bumps/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/bumps/default.nix
index 2551aebcea..37ddae1503 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/bumps/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/bumps/default.nix
@@ -2,7 +2,7 @@
 
 buildPythonPackage rec {
   pname = "bumps";
-  version = "0.7.16";
+  version = "0.7.18";
 
   propagatedBuildInputs = [six];
 
@@ -12,7 +12,7 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "3594452487b8404f1efaace9b70aefaeb345fa44dd74349f7829a61161d2f69a";
+    sha256 = "3217d4fd3ec767448d742f3b6ff527cc3817f2421b9a9a8456e1d8ee4a9b1087";
   };
 
   meta = with stdenv.lib; {
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/cftime/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/cftime/default.nix
index 0fe692c902..0235c611c6 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/cftime/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/cftime/default.nix
@@ -1,10 +1,11 @@
 { buildPythonPackage
 , fetchPypi
-, pytest
+, pytestCheckHook
 , coveralls
 , pytestcov
 , cython
 , numpy
+, python
 }:
 
 buildPythonPackage rec {
@@ -16,13 +17,23 @@ buildPythonPackage rec {
     sha256 = "8d6a1144f43b9d7a180d7ceb3aa8015b7133c615fbac231bed184a91129f0207";
   };
 
-  checkInputs = [ pytest coveralls pytestcov ];
-  buildInputs = [ cython ];
-  propagatedBuildInputs = [ numpy ];
+  checkInputs = [
+    pytestCheckHook
+    coveralls
+    pytestcov
+  ];
 
-  checkPhase = ''
-    py.test
-  '';
+  nativeBuildInputs = [
+    cython
+    numpy
+  ];
+
+  propagatedBuildInputs = [
+    numpy
+  ];
+
+  # ERROR test/test_cftime.py - ModuleNotFoundError: No module named 'cftime._cft...
+  doCheck = false;
 
   meta = {
     description = "Time-handling functionality from netcdf4-python";
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/colander/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/colander/default.nix
index 0492e27174..8a4933d195 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/colander/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/colander/default.nix
@@ -3,11 +3,11 @@
 
 buildPythonPackage rec {
   pname = "colander";
-  version = "1.8.2";
+  version = "1.8.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "54878d2ffd1afb020daca6cd5c6cfe6c0e44d0069fc825d57fe59aa6e4f6a499";
+    sha256 = "259592a0d6a89cbe63c0c5771f9c0c2522387415af8d715f599583eac659f7d4";
   };
 
   propagatedBuildInputs = [ translationstring iso8601 enum34 ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/colanderalchemy/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/colanderalchemy/default.nix
index 34e58e0927..aba5ebf609 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/colanderalchemy/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/colanderalchemy/default.nix
@@ -1,6 +1,5 @@
 { stdenv
 , buildPythonPackage
-, fetchpatch
 , fetchPypi
 , unittest2
 , colander
@@ -9,30 +8,21 @@
 
 buildPythonPackage rec {
   pname = "ColanderAlchemy";
-  version = "0.3.3";
+  version = "0.3.4";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "11wcni2xmfmy001rj62q2pwf305vvngkrfm5c4zlwvgbvlsrvnnw";
+    sha256 = "006wcfch2skwvma9bq3l06dyjnz309pa75h1rviq7i4pd9g463bl";
   };
 
-  patches = [
-    (fetchpatch {
-        url = "https://github.com/stefanofontanelli/ColanderAlchemy/commit/b45fe35f2936a5ccb705e9344075191e550af6c9.patch";
-        sha256 = "1kf278wjq49zd6fhpp55vdcawzdd107767shzfck522sv8gr6qvx";
-    })
-  ];
-
-  buildInputs = [ unittest2 ];
   propagatedBuildInputs = [ colander sqlalchemy ];
 
+  # Tests are not included in Pypi
+  doCheck = false;
+
   meta = with stdenv.lib; {
     description = "Autogenerate Colander schemas based on SQLAlchemy models";
     homepage = "https://github.com/stefanofontanelli/ColanderAlchemy";
     license = licenses.mit;
-    # ColanderAlchemy's tests currently fail with colander >1.6.0
-    # (see https://github.com/stefanofontanelli/ColanderAlchemy/issues/107)
-    broken = versionOlder "1.6.0" colander.version;
   };
-
 }
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/cryptography/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/cryptography/default.nix
index 8774b181fc..41802f0d06 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/cryptography/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/cryptography/default.nix
@@ -31,13 +31,20 @@ buildPythonPackage rec {
 
   outputs = [ "out" "dev" ];
 
+  nativeBuildInputs = stdenv.lib.optionals (!isPyPy) [
+    cffi
+  ];
+
   buildInputs = [ openssl ]
              ++ stdenv.lib.optional stdenv.isDarwin darwin.apple_sdk.frameworks.Security;
   propagatedBuildInputs = [
     packaging
     six
-  ] ++ stdenv.lib.optional (!isPyPy) cffi
-  ++ stdenv.lib.optionals isPy27 [ ipaddress enum34 ];
+  ] ++ stdenv.lib.optionals (!isPyPy) [
+    cffi
+  ] ++ stdenv.lib.optionals isPy27 [
+    ipaddress enum34
+  ];
 
   checkInputs = [
     cryptography_vectors
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/docplex/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/docplex/default.nix
index 74ac3bbfdf..362f2b11b1 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/docplex/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/docplex/default.nix
@@ -9,12 +9,12 @@
 
 buildPythonPackage rec {
   pname = "docplex";
-  version = "2.15.194";
+  version = "2.16.196";
 
   # No source available from official repo
   src = fetchPypi {
     inherit pname version;
-    sha256 = "976e9b4e18bccbabae04149c33247a795edb1f00110f1b511c5517ac6ac353bb";
+    sha256 = "8fd96e3586444e577b356c0ac62511414e76027ff159ebe0d0b3e44b881406d1";
   };
 
   propagatedBuildInputs = [
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/fastjsonschema/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/fastjsonschema/default.nix
index b49f31e402..34eb0a158d 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/fastjsonschema/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/fastjsonschema/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "fastjsonschema";
-  version = "2.14.4";
+  version = "2.14.5";
 
   disabled = pythonOlder "3.3";
 
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     repo = "python-fastjsonschema";
     rev = "v${version}";
     fetchSubmodules = true;
-    sha256 = "0c3q31lqzrc52gacnqc271k5952qbyl0z4kagsqvl7fiwk84hqlz";
+    sha256 = "1hgzafswdw5zqrd8qhdxa43crzfy7lrlifdn90133a0h3psr7qs1";
   };
 
   checkInputs = [ pytestCheckHook ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/flake8-debugger/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/flake8-debugger/default.nix
index 81b903621b..46c63ec000 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/flake8-debugger/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/flake8-debugger/default.nix
@@ -1,26 +1,23 @@
-{ lib, fetchPypi, buildPythonPackage, pythonOlder
+{ lib, fetchPypi, buildPythonPackage, pythonOlder, pythonAtLeast, isPy27
 , flake8
-, importlib-metadata
 , pycodestyle
-, pytestrunner
-, pytest
+, six
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "flake8-debugger";
-  version = "3.2.1";
+  version = "4.0.0";
+  disabled = isPy27;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "712d7c1ff69ddf3f0130e94cc88c2519e720760bce45e8c330bfdcb61ab4090d";
+    sha256 = "e43dc777f7db1481db473210101ec2df2bd39a45b149d7218a618e954177eda6";
   };
 
-  nativeBuildInputs = [ pytestrunner ];
+  propagatedBuildInputs = [ flake8 pycodestyle six ];
 
-  propagatedBuildInputs = [ flake8 pycodestyle ]
-    ++ lib.optionals (pythonOlder "3.8") [ importlib-metadata ];
-
-  checkInputs = [ pytest ];
+  checkInputs = [ pytestCheckHook ];
 
   # Tests not included in PyPI tarball
   # FIXME: Remove when https://github.com/JBKahn/flake8-debugger/pull/15 is merged
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/goobook/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/goobook/default.nix
index e183e79f57..a3d3272751 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/goobook/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/goobook/default.nix
@@ -5,12 +5,12 @@
 
 buildPythonPackage rec {
   pname = "goobook";
-  version = "3.5";
+  version = "3.5.1";
   disabled = !isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1rmfyma3gwdf5mrw4l3j66y86fy8hgdbd0z4a5kck0kcm3hy34j9";
+    sha256 = "6e69aeaf69112d116302f0c42ca1904f3b6efd17f15cefc12c866206160293be";
   };
 
   nativeBuildInputs = [ docutils installShellFiles ];
@@ -23,6 +23,10 @@ buildPythonPackage rec {
     installManPage goobook.1
   '';
 
+  doCheck = false;
+
+  pythonImportsCheck = [ "goobook" ];
+
   meta = with stdenv.lib; {
     description = "Access your Google contacts from the command line";
     longDescription = ''
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/google_cloud_container/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/google_cloud_container/default.nix
index e155a545a1..4d170d1c8b 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/google_cloud_container/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/google_cloud_container/default.nix
@@ -3,11 +3,11 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-container";
-  version = "2.1.0";
+  version = "2.2.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "07rcq4c49zfaacyn5df62bs7qjf5hpmdm9mpb6nx510lylq0507x";
+    sha256 = "ce641b3ffaef407d5fe9b798955c6c6f2d1bfb58d6e11b4f87eb6fbb745a2711";
   };
 
   disabled = pythonOlder "3.6";
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/google_cloud_secret_manager/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/google_cloud_secret_manager/default.nix
index 513b76bafa..5bc568f879 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/google_cloud_secret_manager/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/google_cloud_secret_manager/default.nix
@@ -1,20 +1,22 @@
 { lib, buildPythonPackage, fetchPypi
-, grpc_google_iam_v1, google_api_core
+, grpc_google_iam_v1, google_api_core, libcst, proto-plus
 , pytest, mock
 }:
 
 buildPythonPackage rec {
   pname = "google-cloud-secret-manager";
-  version = "1.0.0";
+  version = "2.0.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1cm3xqacxnbpv2706bd2jl86mvcsphpjlvhzngz2k2p48a0jjx8r";
+    sha256 = "1w2q602ww8s3n714l2gnaklqzbczshrspxvmvjr6wfwwalxwkc62";
   };
 
   propagatedBuildInputs = [
     google_api_core
     grpc_google_iam_v1
+    libcst
+    proto-plus
   ];
 
   checkInputs = [
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/grpcio-tools/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/grpcio-tools/default.nix
index fe0fc9d3f8..a68eb704f6 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/grpcio-tools/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/grpcio-tools/default.nix
@@ -9,6 +9,8 @@ buildPythonPackage rec {
     sha256 = "af40774c0275f5465f49fd92bfcd9831b19b013de4cc77b8fb38aea76fa6dce3";
   };
 
+  outputs = [ "out" "dev" ];
+
   enableParallelBuilding = true;
 
   propagatedBuildInputs = [ protobuf grpcio setuptools ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/grpcio/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/grpcio/default.nix
index 9311838627..55d569c905 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/grpcio/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/grpcio/default.nix
@@ -6,6 +6,8 @@ buildPythonPackage rec {
   inherit (grpc) src version;
   pname = "grpcio";
 
+  outputs = [ "out" "dev" ];
+
   nativeBuildInputs = [ cython pkgconfig ]
                     ++ stdenv.lib.optional stdenv.isDarwin darwin.cctools;
 
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/ircrobots/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/ircrobots/default.nix
index 74496e4022..41973e8058 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/ircrobots/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/ircrobots/default.nix
@@ -13,20 +13,19 @@
 
 buildPythonPackage rec {
   pname = "ircrobots";
-  version = "0.3.5";
+  version = "0.3.6";
   disabled = pythonOlder "3.6";
 
   src = fetchFromGitHub {
     owner = "jesopo";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1w04gif227fhzalrds9rscqmckv5h0x2p8600s876i19w41swi32";
+    sha256 = "1c8h8b78gmnfipppr9dxp7sl6wd9lx4l3pdwykaib1f49dqwavys";
   };
 
   postPatch = ''
     # too specific pins https://github.com/jesopo/ircrobots/issues/3
-    sed -iE 's/==.*//' requirements.txt
-    sed -iE 's/dataclasses.*/dataclasses; python_version < "3.7"/' requirements.txt
+    sed -iE 's/anyio.*/anyio/' requirements.txt
   '';
 
   propagatedBuildInputs = [
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/ircstates/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/ircstates/default.nix
index 3cd4fb09f9..3e54451eb3 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/ircstates/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/ircstates/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "ircstates";
-  version = "0.11.5";
+  version = "0.11.6";
   disabled = pythonOlder "3.6";  # f-strings
 
   src = fetchFromGitHub {
     owner = "jesopo";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1b1py1q02wbp4fmkjvchvazklfqibqd6pb28gdq7dg1bwwwd7vda";
+    sha256 = "0yhrd1nmf9fjwknbga8wspy3bab40lgp4qqnr7w75x9wq5ivmqhg";
   };
 
   propagatedBuildInputs = [
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/jaraco_classes/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/jaraco_classes/default.nix
index c9ce6915d2..a3d19df765 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/jaraco_classes/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/jaraco_classes/default.nix
@@ -10,6 +10,8 @@ buildPythonPackage rec {
     sha256 = "1avsxzm5mwylmy2zbxq3xvn48z5djb0qy3hwv4ryncprivzri1n3";
   };
 
+  pythonNamespaces = [ "jaraco" ];
+
   nativeBuildInputs = [ setuptools_scm ];
   propagatedBuildInputs = [ six more-itertools ];
 
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/jaraco_collections/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/jaraco_collections/default.nix
index 9f6e6e2aa7..3c37755366 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/jaraco_collections/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/jaraco_collections/default.nix
@@ -10,6 +10,8 @@ buildPythonPackage rec {
     sha256 = "be570ef4f2e7290b757449395238fa63d70a9255574624e73c5ff9f1ee554721";
   };
 
+  pythonNamespaces = [ "jaraco" ];
+
   doCheck = false;
   buildInputs = [ setuptools_scm ];
   propagatedBuildInputs = [ six jaraco_classes jaraco_text ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/jaraco_functools/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/jaraco_functools/default.nix
index 6ee4c24171..eb176d0d85 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/jaraco_functools/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/jaraco_functools/default.nix
@@ -17,6 +17,8 @@ buildPythonPackage rec {
 
   doCheck = false;
 
+  pythonNamespaces = [ "jaraco" ];
+
   meta = with lib; {
     description = "Additional functools in the spirit of stdlib's functools";
     homepage = "https://github.com/jaraco/jaraco.functools";
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/jaraco_itertools/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/jaraco_itertools/default.nix
index 5df70b6da9..f5d0b0538b 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/jaraco_itertools/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/jaraco_itertools/default.nix
@@ -11,6 +11,8 @@ buildPythonPackage rec {
     sha256 = "6447d567f57efe5efea386265c7864652e9530830a1b80f43e60b4f222b9ab84";
   };
 
+  pythonNamespaces = [ "jaraco" ];
+
   nativeBuildInputs = [ setuptools_scm ];
 
   patches = [
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/jaraco_logging/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/jaraco_logging/default.nix
index 3f9fa4d67c..4a6391fbc4 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/jaraco_logging/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/jaraco_logging/default.nix
@@ -11,6 +11,8 @@ buildPythonPackage rec {
     sha256 = "31716fe84d3d5df39d95572942513bd4bf8ae0a478f64031eff4c2ea9e83434e";
   };
 
+  pythonNamespaces = [ "jaraco" ];
+
   nativeBuildInputs = [ setuptools_scm ];
   propagatedBuildInputs = [ tempora six ];
 
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/jaraco_stream/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/jaraco_stream/default.nix
index 324eb62501..9a4f6d9724 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/jaraco_stream/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/jaraco_stream/default.nix
@@ -3,10 +3,14 @@
 buildPythonPackage rec {
   pname = "jaraco.stream";
   version = "3.0.0";
+
   src = fetchPypi {
     inherit pname version;
     sha256 = "287e1cba9f278e0146fdded6bc40518930813a5584579769aeaa1d0bfd178a73";
   };
+
+  pythonNamespaces = [ "jaraco" ];
+
   doCheck = false;
   buildInputs = [ setuptools_scm ];
   propagatedBuildInputs = [ six ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/jaraco_text/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/jaraco_text/default.nix
index 9b3821edd7..c61c8f689d 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/jaraco_text/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/jaraco_text/default.nix
@@ -13,6 +13,8 @@ buildPythonPackage rec {
     sha256 = "1v0hz3h74m31jlbc5bxwkvrx1h2n7887bajrg1n1c3yc4q8qn1z5";
   };
 
+  pythonNamespaces = [ "jaraco" ];
+
   nativeBuildInputs =[ setuptools_scm ];
   propagatedBuildInputs = [
     jaraco_functools
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/lexid/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/lexid/default.nix
new file mode 100644
index 0000000000..4307d52d89
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/development/python-modules/lexid/default.nix
@@ -0,0 +1,22 @@
+{ lib, python, pythonOlder, buildPythonPackage, fetchPypi, pytestCheckHook, click }:
+
+buildPythonPackage rec {
+  pname = "lexid";
+  version = "2020.1005";
+  disabled = pythonOlder "3.6";
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "52333a2b9ebd14aa0dfeb33de72bd159c2dc31adb9c59cddfc486e2b69bfdcd1";
+  };
+
+  propagatedBuildInputs = [ click ];
+
+  checkInputs = [ pytestCheckHook ];
+
+  meta = with lib; {
+    description = "micro library to increment lexically ordered numerical ids";
+    homepage = "https://pypi.org/project/lexid/";
+    license = licenses.mit;
+    maintainers = with maintainers; [ kfollesdal ];
+  };
+}
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/mac_alias/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/mac_alias/default.nix
index 79fd0796c2..cb9a103379 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/mac_alias/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/mac_alias/default.nix
@@ -2,12 +2,12 @@
 }:
 
 buildPythonPackage rec {
-  version = "2.1.0";
+  version = "2.1.1";
   pname = "mac_alias";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "9f07926e9befcc4ab35212d19541fe0e4e4abd67a7641aa75252a3ffd8deae94";
+    sha256 = "55468c84a87c8b3929a3dc98f753194f7fe93fd8621abbfea1a4019448058a14";
   };
 
   # pypi package does not include tests;
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/memcached/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/memcached/default.nix
index 6547316048..0e1ec2a276 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/memcached/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/memcached/default.nix
@@ -6,11 +6,12 @@
 }:
 
 buildPythonPackage rec {
-  pname = "memcached-1.51";
+  pname = "memcached";
   version = "1.51";
 
   src = if isPy3k then fetchPypi {
-    inherit pname version;
+    inherit version;
+    pname = "python3-${pname}";
     sha256 = "0na8b369q8fivh3y0nvzbvhh3lgvxiyyv9xp93cnkvwfsr8mkgkw";
   } else fetchurl {
     url = "http://ftp.tummy.com/pub/python-memcached/old-releases/python-${pname}-${version}.tar.gz";
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/nipype/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/nipype/default.nix
index 2d8eaecf77..f152287d25 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/nipype/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/nipype/default.nix
@@ -49,12 +49,12 @@ in
 
 buildPythonPackage rec {
   pname = "nipype";
-  version = "1.5.1";
+  version = "1.6.0";
   disabled = isPy27;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "3d6aa37186e1d2f90917dfdf1faf5aeff469912554990e5d182ffe8435f250d5";
+    sha256 = "bc56ce63f74c9a9a23c6edeaf77631377e8ad2bea928c898cc89527a47f101cf";
   };
 
   postPatch = ''
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/numexpr/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/numexpr/default.nix
index 3e3316788e..046f0a5bd5 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/numexpr/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/numexpr/default.nix
@@ -19,12 +19,18 @@ buildPythonPackage rec {
     ln -s ${numpy.cfg} site.cfg
   '';
 
-  propagatedBuildInputs = [ numpy ];
+  nativeBuildInputs = [
+    numpy
+  ];
+
+  propagatedBuildInputs = [
+    numpy
+  ];
 
   checkPhase = ''
     runtest="$(pwd)/numexpr/tests/test_numexpr.py"
     pushd "$out"
-    ${python}/bin/${python.executable} "$runtest"
+    ${python.interpreter} "$runtest"
     popd
   '';
 
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/openrazer/common.nix b/third_party/nixpkgs/pkgs/development/python-modules/openrazer/common.nix
index 8dddf105d1..67896c362f 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/openrazer/common.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/openrazer/common.nix
@@ -1,12 +1,12 @@
 { stdenv
 , fetchFromGitHub
 }: rec {
-  version = "2.8.0";
+  version = "2.9.0";
   src = fetchFromGitHub {
     owner = "openrazer";
     repo = "openrazer";
     rev = "v${version}";
-    sha256 = "0mwg6b2y3wfpvgxb9lznwblb3bnrayn858nc4fbbg76zdp5bk5ky";
+    sha256 = "1js7hq7zx5kj99brffrfaaah283ydkffmmrzsxv4mkd3nnd6rykk";
   };
   meta = with stdenv.lib; {
     homepage = "https://openrazer.github.io/";
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/pip-tools/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/pip-tools/default.nix
index 104619711a..4eded1a621 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/pip-tools/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/pip-tools/default.nix
@@ -3,11 +3,11 @@
 
 buildPythonPackage rec {
   pname = "pip-tools";
-  version = "5.3.1";
+  version = "5.4.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "5672c2b6ca0f1fd803f3b45568c2cf7fadf135b4971e7d665232b2075544c0ef";
+    sha256 = "084z41f8mh9g7pnmbqd2cn5dq3v05qjcrnj1ifpn2nfny86rklx4";
   };
 
   LC_ALL = "en_US.UTF-8";
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/pproxy/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/pproxy/default.nix
index 9f97d7df13..0673a3f8db 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/pproxy/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/pproxy/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "pproxy";
-  version = "2.3.2";
+  version = "2.3.7";
 
   disabled = isPy27;
 
@@ -16,8 +16,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "qwj";
     repo = "python-proxy";
-    rev = "818ab9cc10565789fe429a7be50ddefb9c583781";
-    sha256 = "0g3cyi5lzakhs5p3fpwywbl8jpapnr8890zw9w45dqg8k0svc1fi";
+    rev = "7fccf8dd62204f34b0aa3a70fc568fd6ddff7728";
+    sha256 = "1sl2i0kymnbsk49ina81yjnkxjy09541f7pmic8r6rwsv1s87skc";
   };
 
   propagatedBuildInputs = [
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/pybind11/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/pybind11/default.nix
index 079c93db45..3fd9349386 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/pybind11/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/pybind11/default.nix
@@ -14,13 +14,13 @@
 
 buildPythonPackage rec {
   pname = "pybind11";
-  version = "2.5.0";
+  version = "2.6.1";
 
   src = fetchFromGitHub {
     owner = "pybind";
     repo = pname;
     rev = "v${version}";
-    sha256 = "13hcj6g7k7yvj7nry2ar6f5mg58ln7frrvq1cg5f8mczxh1ch6zl";
+    sha256 = "TXljeRFonQwEmlIGMnTHwdfPsd9cMOVn5/1zb3tYBfI=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/pybullet/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/pybullet/default.nix
index 8cc9d173e0..aaf703f539 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/pybullet/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/pybullet/default.nix
@@ -8,11 +8,11 @@
 
 buildPythonPackage rec {
   pname = "pybullet";
-  version = "3.0.6";
+  version = "3.0.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "db4eea782c4d4808ef73b305a729d94f89035f7ad1b84032432e9dd101f689e4";
+    sha256 = "47e55d2b0c565a968406f314faad7c002be6d8b0afc8ad2c437d07b7b7d2f590";
   };
 
   buildInputs = [
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/pyflakes/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/pyflakes/default.nix
index d8cc451194..04bc56df12 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/pyflakes/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/pyflakes/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildPythonPackage, fetchPypi, unittest2 }:
+{ stdenv, buildPythonPackage, fetchPypi, pythonOlder, unittest2 }:
 
 buildPythonPackage rec {
   pname = "pyflakes";
@@ -11,6 +11,9 @@ buildPythonPackage rec {
 
   checkInputs = [ unittest2 ];
 
+  # some tests are output dependent, which have changed slightly
+  doCheck = pythonOlder "3.9";
+
   meta = with stdenv.lib; {
     homepage = "https://launchpad.net/pyflakes";
     description = "A simple program which checks Python source files for errors";
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/pylatexenc/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/pylatexenc/default.nix
index 6b56a42246..e53472c6ea 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/pylatexenc/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/pylatexenc/default.nix
@@ -6,23 +6,23 @@
 
 buildPythonPackage rec {
   pname = "pylatexenc";
-  version = "2.7";
+  version = "2.8";
 
   src = fetchFromGitHub {
     owner = "phfaist";
     repo = "pylatexenc";
     rev = "v${version}";
-    sha256 = "1hpcwbknfah3mky2m4asw15b9qdvv4k5ni0js764n1jpi83m1zgk";
+    sha256 = "0m9vrbh1gmbgq6dqm7xzklar3accadw0pn896rqsdi5jbgd3w0mh";
   };
 
   pythonImportsCheck = [ "pylatexenc" ];
-  dontUseSetuptoolsCheck = true;
   checkInputs = [ pytestCheckHook ];
 
   meta = with lib; {
     description = "Simple LaTeX parser providing latex-to-unicode and unicode-to-latex conversion";
     homepage = "https://pylatexenc.readthedocs.io";
     downloadPage = "https://www.github.com/phfaist/pylatexenc/releases";
+    changelog = "https://pylatexenc.readthedocs.io/en/latest/changes/";
     license = licenses.mit;
     maintainers = with maintainers; [ drewrisinger ];
   };
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/pymavlink/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/pymavlink/default.nix
index f0a5b222c2..123c9ca4df 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/pymavlink/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/pymavlink/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "pymavlink";
-  version = "2.4.12";
+  version = "2.4.13";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "2954bb071ff67fc5ab29ed2dabe3b5355c4063fb8b014477d9bfbceb87358bc6";
+    sha256 = "c09e285d049590fd76ef72bc19b4597bef80712e942b3a507ef1521b432d84cd";
   };
 
   propagatedBuildInputs = [ future lxml ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/pyosf/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/pyosf/default.nix
new file mode 100644
index 0000000000..c25b1b1143
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/development/python-modules/pyosf/default.nix
@@ -0,0 +1,34 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, isPy27
+, pytestrunner
+, requests
+}:
+
+buildPythonPackage rec {
+  pname = "pyosf";
+  version = "1.0.5";
+  disabled = isPy27;
+
+  src = fetchFromGitHub {
+    owner = "psychopy";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "1fkpmylpcbqa9ky111mz4qr1n8pik49gs7pblbb5qx6b54fzl5k2";
+  };
+
+  preBuild = "export HOME=$TMP";
+  buildInputs = [ pytestrunner ];  # required via `setup_requires`
+  propagatedBuildInputs = [ requests ];
+
+  doCheck = false;  # requires network access
+  pythonImportsCheck = [ "pyosf" ];
+
+  meta = with lib; {
+    homepage = "https://github.com/psychopy/pyosf";
+    description = "Pure Python library for simple sync with Open Science Framework";
+    license = licenses.mit;
+    maintainers = with maintainers; [ bcdarwin ];
+  };
+}
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/pysbd/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/pysbd/default.nix
new file mode 100644
index 0000000000..e1e0578c83
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/development/python-modules/pysbd/default.nix
@@ -0,0 +1,31 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, pythonOlder
+, tqdm
+, spacy
+}:
+
+buildPythonPackage rec {
+  pname = "pysbd";
+  version = "0.3.3";
+  disabled = pythonOlder "3.5";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "56ab48a28a8470f0042a4cb7c9da8a6dde8621ecf87a86d75f201cbf1837e77f";
+  };
+
+  checkInputs = [ tqdm spacy ];
+
+  doCheck = false; # requires pyconll and blingfire
+
+  pythonImportsCheck = [ "pysbd" ];
+
+  meta = with lib; {
+    description = "Pysbd (Python Sentence Boundary Disambiguation) is a rule-based sentence boundary detection that works out-of-the-box across many languages";
+    homepage = "https://github.com/nipunsadvilkar/pySBD";
+    license = licenses.mit;
+    maintainers = [ maintainers.mic92 ];
+  };
+}
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/pyserial/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/pyserial/default.nix
index 98ffbe5ad9..239568f64b 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/pyserial/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/pyserial/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "pyserial";
-  version="3.4";
+  version="3.5";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "09y68bczw324a4jb9a1cfwrbjhq179vnfkkkrybbksp0vqgl0bbf";
+    sha256 = "1nyd4m4mnrz8scbfqn4zpq8gnbl4x42w5zz62vcgpzqd2waf0xrw";
   };
 
   checkPhase = "python -m unittest discover -s test";
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/pytest-testmon/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/pytest-testmon/default.nix
index b86947f5f7..9d9add1678 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/pytest-testmon/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/pytest-testmon/default.nix
@@ -8,12 +8,12 @@
 
 buildPythonPackage rec {
   pname = "pytest-testmon";
-  version = "1.0.3";
+  version = "1.0.2";
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "927a73dd510b90a2e4a48ea4d37e82c4490b56caa745663262024ea0cd278169";
+    sha256 = "fdb016d953036051d1ef0e36569b7168cefa4914014789a65a4ffefc87f85ac5";
   };
 
   propagatedBuildInputs = [ coverage ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/python-frontmatter/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/python-frontmatter/default.nix
new file mode 100644
index 0000000000..8edd875566
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/development/python-modules/python-frontmatter/default.nix
@@ -0,0 +1,30 @@
+{ stdenv, lib, fetchFromGitHub, python3Packages }:
+
+python3Packages.buildPythonPackage rec {
+  pname = "python-frontmatter";
+  version = "0.5.0";
+
+  src = fetchFromGitHub {
+    owner = "eyeseast";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "1iki3rcbg7zs93m3mgqzncybqgdcch25qpwy84iz96qq8pipfs6g";
+  };
+
+  propagatedBuildInputs = with python3Packages; [
+    pyyaml
+    six
+  ];
+
+  checkInputs = with python3Packages; [
+    pytest
+  ];
+
+  meta = with stdenv.lib; {
+    homepage = "https://github.com/eyeseast/python-frontmatter";
+    description = "Parse and manage posts with YAML (or other) frontmatter";
+    license = licenses.mit;
+    maintainers = with maintainers; [ siraben ];
+    platforms = lib.platforms.unix;
+  };
+}
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/qiskit-aer/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/qiskit-aer/default.nix
index 8e73e942be..57d89b5571 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/qiskit-aer/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/qiskit-aer/default.nix
@@ -3,34 +3,39 @@
 , buildPythonPackage
 , fetchFromGitHub
 , fetchpatch
+  # C Inputs
+, blas
+, catch2
 , cmake
-, cvxpy
 , cython
 , muparserx
 , ninja
 , nlohmann_json
+, spdlog
+  # Python Inputs
+, cvxpy
 , numpy
-, openblas
 , pybind11
 , scikit-build
-, spdlog
   # Check Inputs
-, qiskit-terra
 , pytestCheckHook
-, python
+, ddt
+, fixtures
+, pytest-timeout
+, qiskit-terra
 }:
 
 buildPythonPackage rec {
   pname = "qiskit-aer";
-  version = "0.6.1";
+  version = "0.7.1";
 
-  disabled = pythonOlder "3.5";
+  disabled = pythonOlder "3.6";
 
   src = fetchFromGitHub {
     owner = "Qiskit";
     repo = "qiskit-aer";
     rev = version;
-    sha256 = "1fnv11diis0as8zcc57mamz0gbjd6vj7nw3arxzvwa77ja803sr4";
+    sha256 = "07l0wavdknx0y4vy0hwgw24365sg4nb6ygl3lpa098np85qgyn4y";
   };
 
   nativeBuildInputs = [
@@ -40,10 +45,11 @@ buildPythonPackage rec {
   ];
 
   buildInputs = [
-    openblas
-    spdlog
-    nlohmann_json
+    blas
+    catch2
     muparserx
+    nlohmann_json
+    spdlog
   ];
 
   propagatedBuildInputs = [
@@ -60,11 +66,6 @@ buildPythonPackage rec {
 
   dontUseCmakeConfigure = true;
 
-  cmakeFlags = [
-    "-DBUILD_TESTS=True"
-    "-DAER_THRUST_BACKEND=OMP"
-  ];
-
   # *** Testing ***
 
   pythonImportsCheck = [
@@ -72,11 +73,22 @@ buildPythonPackage rec {
     "qiskit.providers.aer.backends.qasm_simulator"
     "qiskit.providers.aer.backends.controller_wrappers" # Checks C++ files built correctly. Only exists if built & moved to output
   ];
-  checkInputs = [
-    qiskit-terra
-    pytestCheckHook
+  # Slow tests
+  disabledTests = [
+    "test_paulis_1_and_2_qubits"
+    "test_3d_oscillator"
+  ];
+  checkInputs = [
+    pytestCheckHook
+    ddt
+    fixtures
+    pytest-timeout
+    qiskit-terra
+  ];
+  pytestFlagsArray = [
+    "--timeout=30"
+    "--durations=10"
   ];
-  dontUseSetuptoolsCheck = true;  # Otherwise runs tests twice
 
   preCheck = ''
     # Tests include a compiled "circuit" which is auto-built in $HOME
@@ -87,9 +99,7 @@ buildPythonPackage rec {
     # Add qiskit-aer compiled files to cython include search
     pushd $HOME
   '';
-  postCheck = ''
-    popd
-  '';
+  postCheck = "popd";
 
   meta = with lib; {
     description = "High performance simulators for Qiskit";
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/qiskit-aqua/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/qiskit-aqua/default.nix
index c90f9ddf2e..11274c525f 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/qiskit-aqua/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/qiskit-aqua/default.nix
@@ -2,8 +2,6 @@
 , pythonOlder
 , buildPythonPackage
 , fetchFromGitHub
-, fetchpatch
-# , cplex
 , cvxpy
 , dlx
 , docplex
@@ -18,38 +16,38 @@
 , quandl
 , scikitlearn
 , yfinance
+  # Optional inputs
+, withTorch ? false
+, pytorch
+, withPyscf ? false
+, pyscf ? null
+, withScikitQuant ? false
+, scikit-quant ? null
+, withCplex ? false
+, cplex ? null
   # Check Inputs
 , ddt
 , pytestCheckHook
+, pytest-timeout
 , qiskit-aer
 }:
 
 buildPythonPackage rec {
   pname = "qiskit-aqua";
-  version = "0.7.5";
+  version = "0.8.1";
 
-  disabled = pythonOlder "3.5";
+  disabled = pythonOlder "3.6";
 
   # Pypi's tarball doesn't contain tests
   src = fetchFromGitHub {
     owner = "Qiskit";
     repo = "qiskit-aqua";
     rev = version;
-    sha256 = "19sdv7lnc4b1c86rd1dv7pjpi8cmrpzbv7nav0fb899ki8ldqdwq";
+    sha256 = "11qyya3vyq50wpzrzzl8v46yx5p72rhpqhybwn47qgazxgg82r1b";
   };
 
-  # TODO: remove in next release
-  patches = [
-    (fetchpatch {
-      name = "qiskit-aqua-fix-test-issue-1214.patch";
-      url = "https://github.com/Qiskit/qiskit-aqua/commit/284a4323192ac85787b22cbe5f344996fae16f7d.patch";
-      sha256 = "0zl8hqa2fq9ng793x4dhh0ny67nnbjcd8l1cdsaaab4ca1y0xcfr";
-    })
-  ];
-
   # Optional packages: pyscf (see below NOTE) & pytorch. Can install via pip/nix if needed.
   propagatedBuildInputs = [
-    # cplex
     cvxpy
     docplex
     dlx # Python Dancing Links package
@@ -63,7 +61,10 @@ buildPythonPackage rec {
     quandl
     scikitlearn
     yfinance
-  ];
+  ] ++ lib.optionals (withTorch) [ pytorch ]
+  ++ lib.optionals (withPyscf) [ pyscf ]
+  ++ lib.optionals (withScikitQuant) [ scikit-quant ]
+  ++ lib.optionals (withCplex) [ cplex ];
 
   # *** NOTE ***
   # We make pyscf optional in this package, due to difficulties packaging it in Nix (test failures, complicated flags, etc).
@@ -97,8 +98,12 @@ buildPythonPackage rec {
 
   postInstall = "rm -rf $out/${python.sitePackages}/docs";  # Remove docs dir b/c it can cause conflicts.
 
-  checkInputs = [ ddt qiskit-aer pytestCheckHook ];
-  dontUseSetuptoolsCheck = true;
+  checkInputs = [
+    pytestCheckHook
+    ddt
+    pytest-timeout
+    qiskit-aer
+  ];
   pythonImportsCheck = [
     "qiskit.aqua"
     "qiskit.aqua.algorithms"
@@ -108,10 +113,13 @@ buildPythonPackage rec {
     "qiskit.optimization"
   ];
   pytestFlagsArray = [
-    # Disabled b/c missing pyscf
+    "--timeout=30"
+    "--durations=10"
+  ] ++ lib.optionals (!withPyscf) [
     "--ignore=test/chemistry/test_qeom_ee.py"
     "--ignore=test/chemistry/test_qeom_vqe.py"
     "--ignore=test/chemistry/test_vqe_uccsd_adapt.py"
+    "--ignore=test/chemistry/test_bopes_sampler.py"
   ];
   disabledTests = [
     # Disabled due to missing pyscf
@@ -123,8 +131,10 @@ buildPythonPackage rec {
 
     # Disabling slow tests > 10 seconds
     "TestVQE"
+    "TestOOVQE"
     "TestVQC"
     "TestQSVM"
+    "TestOptimizerAQGD"
     "test_graph_partition_vqe"
     "TestLookupRotation"
     "_vqe"
@@ -151,6 +161,7 @@ buildPythonPackage rec {
     "test_confidence_intervals_00001"
     "test_eoh"
     "test_qasm_5"
+    "test_uccsd_hf"
   ];
 
   meta = with lib; {
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/qiskit-ibmq-provider/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/qiskit-ibmq-provider/default.nix
index eaf10fd608..7374d7ce01 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/qiskit-ibmq-provider/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/qiskit-ibmq-provider/default.nix
@@ -9,24 +9,36 @@
 , requests_ntlm
 , websockets
   # Visualization inputs
-, ipykernel
+, withVisualization ? false
+, ipython
 , ipyvuetify
 , ipywidgets
 , matplotlib
-, nbconvert
-, nbformat
 , plotly
 , pyperclip
 , seaborn
   # check inputs
 , pytestCheckHook
+, nbconvert
+, nbformat
 , pproxy
 , vcrpy
 }:
 
+let
+  visualizationPackages = [
+    ipython
+    ipyvuetify
+    ipywidgets
+    matplotlib
+    plotly
+    pyperclip
+    seaborn
+  ];
+in
 buildPythonPackage rec {
   pname = "qiskit-ibmq-provider";
-  version = "0.8.0";
+  version = "0.11.1";
 
   disabled = pythonOlder "3.6";
 
@@ -34,7 +46,7 @@ buildPythonPackage rec {
     owner = "Qiskit";
     repo = pname;
     rev = version;
-    sha256 = "0rrpwr4a82j69j5ibl2g0nw8wbpg201cfz6f234k2v6pj500x9nl";
+    sha256 = "0b5mnq8f5844idnsmp84lpkvlpszfwwi998yvggcgaayw1dbk53h";
   };
 
   propagatedBuildInputs = [
@@ -44,31 +56,16 @@ buildPythonPackage rec {
     requests
     requests_ntlm
     websockets
-    # Visualization/Jupyter inputs
-    ipykernel
-    ipyvuetify
-    ipywidgets
-    matplotlib
-    nbconvert
-    nbformat
-    plotly
-    pyperclip
-    seaborn
-  ];
-
-  # websockets seems to be pinned b/c in v8+ it drops py3.5 support. Not an issue here (usually py3.7+, and disabled for older py3.6)
-  postPatch = ''
-    substituteInPlace requirements.txt --replace "websockets>=7,<8" "websockets"
-    substituteInPlace setup.py --replace "websockets>=7,<8" "websockets"
-  '';
+  ] ++ lib.optionals withVisualization visualizationPackages;
 
   # Most tests require credentials to run on IBMQ
   checkInputs = [
     pytestCheckHook
+    nbconvert
+    nbformat
     pproxy
     vcrpy
-  ];
-  dontUseSetuptoolsCheck = true;
+  ] ++ lib.optionals (!withVisualization) visualizationPackages;
 
   pythonImportsCheck = [ "qiskit.providers.ibmq" ];
   # These disabled tests require internet connection, aren't skipped elsewhere
@@ -76,6 +73,10 @@ buildPythonPackage rec {
     "test_old_api_url"
     "test_non_auth_url"
     "test_non_auth_url_with_hub"
+
+    # slow tests
+    "test_websocket_retry_failure"
+    "test_invalid_url"
   ];
 
   # Skip tests that rely on internet access (mostly to IBM Quantum Experience cloud).
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/qiskit-ignis/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/qiskit-ignis/default.nix
index d40afe43f9..b5295dbd04 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/qiskit-ignis/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/qiskit-ignis/default.nix
@@ -8,6 +8,13 @@
 , qiskit-terra
 , scikitlearn
 , scipy
+  # Optional package inputs
+, withVisualization ? false
+, matplotlib
+, withCvx ? false
+, cvxpy
+, withJit ? false
+, numba
   # Check Inputs
 , pytestCheckHook
 , ddt
@@ -17,7 +24,7 @@
 
 buildPythonPackage rec {
   pname = "qiskit-ignis";
-  version = "0.4.0";
+  version = "0.5.1";
 
   disabled = pythonOlder "3.6";
 
@@ -26,16 +33,24 @@ buildPythonPackage rec {
     owner = "Qiskit";
     repo = "qiskit-ignis";
     rev = version;
-    sha256 = "07mxhaknkp121xm6mgrpcrbj9qw6j924ra3k0s6vr8qgvfcxvh0y";
+    sha256 = "17kplmi17axcbbgw35dzfr3d5bzfymxfni9sf6v14223c5674p4y";
   };
 
+  # hacky, fix https://github.com/Qiskit/qiskit-ignis/issues/532.
+  # TODO: remove on qiskit-ignis v0.5.1
+  postPatch = ''
+    substituteInPlace qiskit/ignis/mitigation/expval/base_meas_mitigator.py --replace "plt.axes" "'plt.axes'"
+  '';
+
   propagatedBuildInputs = [
     numpy
     qiskit-terra
     scikitlearn
     scipy
-  ];
-  postInstall = "rm -rf $out/${python.sitePackages}/docs";  # this dir can create conflicts
+  ] ++ lib.optionals (withCvx) [ cvxpy ]
+  ++ lib.optionals (withVisualization) [ matplotlib ]
+  ++ lib.optionals (withJit) [ numba ];
+  postInstall = "rm -rf $out/${python.sitePackages}/docs"; # this dir can create conflicts
 
   # Tests
   pythonImportsCheck = [ "qiskit.ignis" ];
@@ -49,7 +64,7 @@ buildPythonPackage rec {
   ];
   disabledTests = [
     "test_tensored_meas_cal_on_circuit" # Flaky test, occasionally returns result outside bounds
-    "test_qv_fitter"  # execution hangs, ran for several minutes
+    "test_qv_fitter" # execution hangs, ran for several minutes
   ];
 
   meta = with lib; {
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/qiskit-terra/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/qiskit-terra/default.nix
index aad0370c3d..89d39b718c 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/qiskit-terra/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/qiskit-terra/default.nix
@@ -16,7 +16,8 @@
 , retworkx
 , scipy
 , sympy
-  # Python visualization requirements, semi-optional
+, withVisualization ? false
+  # Python visualization requirements, optional
 , ipywidgets
 , matplotlib
 , pillow
@@ -24,6 +25,12 @@
 , pygments
 , pylatexenc
 , seaborn
+  # Crosstalk-adaptive layout pass
+, withCrosstalkPass ? false
+, z3
+  # Classical function -> Quantum Circuit compiler
+, withClassicalFunctionCompiler ? false
+, tweedledum ? null
   # test requirements
 , ddt
 , hypothesis
@@ -33,17 +40,31 @@
 , python
 }:
 
+let
+  visualizationPackages = [
+    ipywidgets
+    matplotlib
+    pillow
+    pydot
+    pygments
+    pylatexenc
+    seaborn
+  ];
+  crosstalkPackages = [ z3 ];
+  classicalCompilerPackages = [ tweedledum ];
+in
+
 buildPythonPackage rec {
   pname = "qiskit-terra";
-  version = "0.15.1";
+  version = "0.16.1";
 
-  disabled = pythonOlder "3.5";
+  disabled = pythonOlder "3.6";
 
   src = fetchFromGitHub {
     owner = "Qiskit";
     repo = pname;
     rev = version;
-    sha256 = "1p7y36gj3675dmp05nwi0m9nc7h0bwyimir3ncf9wbkx3crrh99c";
+    sha256 = "0007glsbrvq9swamvz8r76z9nzh46b388y0ds1dypczxpwlp9xcq";
   };
 
   nativeBuildInputs = [ cython ];
@@ -53,7 +74,6 @@ buildPythonPackage rec {
     fastjsonschema
     jsonschema
     numpy
-    matplotlib
     networkx
     ply
     psutil
@@ -62,26 +82,18 @@ buildPythonPackage rec {
     retworkx
     scipy
     sympy
-    # Optional/visualization inputs
-    ipywidgets
-    matplotlib
-    pillow
-    pydot
-    pygments
-    pylatexenc
-    seaborn
-  ];
-
+  ] ++ lib.optionals withVisualization visualizationPackages
+  ++ lib.optionals withCrosstalkPass crosstalkPackages
+  ++ lib.optionals withClassicalFunctionCompiler classicalCompilerPackages;
 
   # *** Tests ***
   checkInputs = [
+    pytestCheckHook
     ddt
     hypothesis
     nbformat
     nbconvert
-    pytestCheckHook
-  ];
-  dontUseSetuptoolsCheck = true;  # can't find setup.py, so fails. tested by pytest
+  ] ++ lib.optionals (!withVisualization) visualizationPackages;
 
   pythonImportsCheck = [
     "qiskit"
@@ -90,6 +102,34 @@ buildPythonPackage rec {
 
   pytestFlagsArray = [
     "--ignore=test/randomized/test_transpiler_equivalence.py" # collection requires qiskit-aer, which would cause circular dependency
+  ] ++ lib.optionals (!withClassicalFunctionCompiler ) [
+    "--ignore=test/python/classical_function_compiler/"
+  ];
+  disabledTests = [
+    # Flaky tests
+    "test_cx_equivalence"
+    "test_pulse_limits"
+  ]
+  # Disabling slow tests for build constraints
+  ++ [
+    "test_all_examples"
+    "test_controlled_random_unitary"
+    "test_controlled_standard_gates_1"
+    "test_jupyter_jobs_pbars"
+    "test_lookahead_swap_higher_depth_width_is_better"
+    "test_move_measurements"
+    "test_job_monitor"
+    "test_wait_for_final_state"
+    "test_multi_controlled_y_rotation_matrix_basic_mode"
+    "test_two_qubit_weyl_decomposition_abc"
+    "test_isometry"
+    "test_parallel"
+    "test_random_state"
+    "test_random_clifford_valid"
+    "test_to_matrix"
+    "test_block_collection_reduces_1q_gate"
+    "test_multi_controlled_rotation_gate_matrices"
+    "test_block_collection_runs_for_non_cx_bases"
   ];
 
   # Moves tests to $PACKAGEDIR/test. They can't be run from /build because of finding
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/qiskit/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/qiskit/default.nix
index 46fcf49859..7c79d517ce 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/qiskit/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/qiskit/default.nix
@@ -15,15 +15,15 @@
 buildPythonPackage rec {
   pname = "qiskit";
   # NOTE: This version denotes a specific set of subpackages. See https://qiskit.org/documentation/release_notes.html#version-history
-  version = "0.20.0";
+  version = "0.23.1";
 
-  disabled = pythonOlder "3.5";
+  disabled = pythonOlder "3.6";
 
   src = fetchFromGitHub {
-    owner = "Qiskit";
+    owner = "qiskit";
     repo = "qiskit";
     rev = version;
-    sha256 = "1r23pjnql49gczf4k4m6ir5rr95gqdxjrks60p8a93d243mxx3c9";
+    sha256 = "0x4cqx1wqqj7h5g3vdag694qjzsmvhpw25yrlcs70mh5ywdp28x1";
   };
 
   propagatedBuildInputs = [
@@ -35,7 +35,6 @@ buildPythonPackage rec {
   ];
 
   checkInputs = [ pytestCheckHook ];
-  dontUseSetuptoolsCheck = true;
 
   pythonImportsCheck = [
     "qiskit"
@@ -43,6 +42,7 @@ buildPythonPackage rec {
     "qiskit.circuit"
     "qiskit.ignis"
     "qiskit.providers.aer"
+    "qiskit.providers.ibmq"
   ];
 
   meta = with lib; {
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/retworkx/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/retworkx/default.nix
index 49e4b1c2fc..02a3ef64c5 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/retworkx/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/retworkx/default.nix
@@ -1,7 +1,6 @@
 { lib
 , rustPlatform
 , python
-, fetchpatch
 , fetchFromGitHub
 , pipInstallHook
 , maturin
@@ -13,35 +12,30 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "retworkx";
-  version = "0.4.0";
+  version = "0.6.0";
 
   src = fetchFromGitHub {
     owner = "Qiskit";
     repo = "retworkx";
     rev = version;
-    sha256 = "1xqp6d39apkjvd0ad9vw81cp2iqzhpagfa4p171xqm3bwfn2imdc";
+    sha256 = "11n30ldg3y3y6qxg3hbj837pnbwjkqw3nxq6frds647mmmprrd20";
   };
 
-  cargoSha256 = "0bma0l14jv5qhcsxck7vw3ak1w3c8v84cq4hii86i4iqk523zns5";
-  cargoPatches = [
-      ( fetchpatch {
-        name = "retworkx-cargo-lock.patch";
-        url = "https://github.com/Qiskit/retworkx/commit/a02fd33d357a92dbe9530696a6d85aa59fe8a5b9.patch";
-        sha256 = "0gvxr1nqp9ll4skfks4p4d964pshal25kb1nbfzhpyipnzddizr5";
-      } )
-  ];
+  cargoSha256 = "1vg4yf0k6yypqf9z46zz818mz7fdrgxj7zl6zjf7pnm2r8mq3qw5";
 
   propagatedBuildInputs = [ python ];
 
   nativeBuildInputs = [ pipInstallHook maturin pip ];
 
-  # Need to check AFTER python wheel is installed (b/c using Rust Build, not buildPythonPackage)
+  # Needed b/c need to check AFTER python wheel is installed (using Rust Build, not buildPythonPackage)
   doCheck = false;
   doInstallCheck = true;
 
+  installCheckInputs = [ pytestCheckHook numpy ];
+
   buildPhase = ''
     runHook preBuild
-    maturin build --release --manylinux off --strip --interpreter ${python.interpreter}
+    maturin build --release --manylinux off --strip
     runHook postBuild
   '';
 
@@ -50,10 +44,9 @@ rustPlatform.buildRustPackage rec {
     pipInstallPhase
   '';
 
-  installCheckInputs = [ pytestCheckHook numpy ];
   preCheck = ''
     export TESTDIR=$(mktemp -d)
-    cp -r $TMP/$sourceRoot/tests $TESTDIR
+    cp -r tests/ $TESTDIR
     pushd $TESTDIR
   '';
   postCheck = "popd";
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/seccomp/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/seccomp/default.nix
new file mode 100644
index 0000000000..3257722b17
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/development/python-modules/seccomp/default.nix
@@ -0,0 +1,29 @@
+{ buildPythonPackage, lib
+, cython, libseccomp
+}:
+
+buildPythonPackage rec {
+  pname   = "libseccomp";
+  version = libseccomp.version;
+  src     = libseccomp.pythonsrc;
+
+  VERSION_RELEASE = version; # used by build system
+
+  nativeBuildInputs = [ cython ];
+  buildInputs = [ libseccomp ];
+
+  unpackCmd = "tar xf $curSrc";
+  doInstallCheck = true;
+
+  postPatch = ''
+    substituteInPlace ./setup.py \
+      --replace 'extra_objects=["../.libs/libseccomp.a"]' \
+                'libraries=["seccomp"]'
+  '';
+
+  meta = with lib; {
+    description = "Python bindings for libseccomp";
+    license     = with licenses; [ lgpl21 ];
+    maintainers = with maintainers; [ thoughtpolice ];
+  };
+}
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/smart_open/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/smart_open/default.nix
index 5486fb4195..ba57d08165 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/smart_open/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/smart_open/default.nix
@@ -13,12 +13,12 @@
 
 buildPythonPackage rec {
   pname = "smart_open";
-  version = "4.0.0";
+  version = "4.0.1";
   disabled = pythonOlder "3.5";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "2ce157700821e285bbacd8d01ec7a4f2582765460e541f55b216cb135db8be24";
+    sha256 = "49396d86de8e0d609ec40422c59f837dd944dcdf727feed6f2ff8cbdc0e3bc8e";
   };
 
   # nixpkgs version of moto is >=1.2.0, remove version pin to fix build
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/sphinx/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/sphinx/default.nix
index b4cbd3bff9..e4a3c94711 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/sphinx/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/sphinx/default.nix
@@ -32,11 +32,11 @@
 
 buildPythonPackage rec {
   pname = "sphinx";
-  version = "3.0.3";
+  version = "3.3.1";
   src = fetchPypi {
     pname = "Sphinx";
     inherit version;
-    sha256 = "0wpmqfx4mxv5kv9xxd6wyfsm8vcnp8p99h14q7b6if2mv69gvvb2";
+    sha256 = "1e8d592225447104d1172be415bc2972bd1357e3e12fdc76edf2261105db4300";
   };
   LC_ALL = "en_US.UTF-8";
 
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/tensorflow/1/bin.nix b/third_party/nixpkgs/pkgs/development/python-modules/tensorflow/1/bin.nix
index 9bd2bc7843..5c93e957f7 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/tensorflow/1/bin.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/tensorflow/1/bin.nix
@@ -2,7 +2,7 @@
 , lib
 , fetchurl
 , buildPythonPackage
-, isPy3k, pythonOlder, isPy38
+, isPy3k, pythonOlder, pythonAtLeast
 , astor
 , gast
 , google-pasta
@@ -50,8 +50,7 @@ in buildPythonPackage {
   inherit pname;
   inherit (packages) version;
   format = "wheel";
-
-  disabled = isPy38;
+  disabled = pythonAtLeast "3.8";
 
   src = let
     pyVerNoDot = lib.strings.stringAsChars (x: if x == "." then "" else x) python.pythonVersion;
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/tensorflow/2/bin.nix b/third_party/nixpkgs/pkgs/development/python-modules/tensorflow/2/bin.nix
index acb5f473ec..8dd282666a 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/tensorflow/2/bin.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/tensorflow/2/bin.nix
@@ -2,7 +2,7 @@
 , lib
 , fetchurl
 , buildPythonPackage
-, isPy3k, pythonOlder, isPy38
+, isPy3k, pythonOlder, pythonAtLeast, isPy38
 , astor
 , gast
 , google-pasta
@@ -54,7 +54,7 @@ in buildPythonPackage {
   inherit (packages) version;
   format = "wheel";
 
-  disabled = isPy38;
+  disabled = pythonAtLeast "3.8";
 
   src = let
     pyVerNoDot = lib.strings.stringAsChars (x: if x == "." then "" else x) python.pythonVersion;
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/tinyobjloader-py/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/tinyobjloader-py/default.nix
new file mode 100644
index 0000000000..3c36dded5e
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/development/python-modules/tinyobjloader-py/default.nix
@@ -0,0 +1,21 @@
+{ lib, buildPythonPackage, pybind11, tinyobjloader }:
+
+buildPythonPackage rec {
+  pname = "tinyobjloader-py";
+  inherit (tinyobjloader) version src;
+
+  # Build needs headers from ${src}, setting sourceRoot or fetching from pypi won't work.
+  preConfigure = ''
+    cd python
+  '';
+
+  buildInputs = [ pybind11 ];
+
+  # No tests are included upstream
+  doCheck = false;
+  pythonImportsCheck = [ "tinyobjloader" ];
+
+  meta = with lib; tinyobjloader.meta // {
+    description = "Python wrapper for the C++ wavefront .obj loader tinyobjloader";
+  };
+}
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/transformers/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/transformers/default.nix
index d3559d3190..39fd7a11d0 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/transformers/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/transformers/default.nix
@@ -2,6 +2,7 @@
 , stdenv
 , fetchFromGitHub
 , boto3
+, cookiecutter
 , filelock
 , regex
 , requests
@@ -9,7 +10,6 @@
 , parameterized
 , protobuf
 , sacremoses
-, sentencepiece
 , timeout-decorator
 , tokenizers
 , tqdm
@@ -18,23 +18,23 @@
 
 buildPythonPackage rec {
   pname = "transformers";
-  version = "3.5.1";
+  version = "4.0.0";
 
   src = fetchFromGitHub {
     owner = "huggingface";
     repo = pname;
     rev = "v${version}";
-    sha256 = "02z5zz0rq7mbgdmsm2ccfdbca57qy7iqp0vc7jspsmdfif4acwia";
+    sha256 = "17djq32pq8d6vqip7i9pda0ldigmzckbbcd278llmpxdriqd4llg";
   };
 
   propagatedBuildInputs = [
+    cookiecutter
     filelock
     numpy
     protobuf
     regex
     requests
     sacremoses
-    sentencepiece
     tokenizers
     tqdm
   ];
@@ -47,8 +47,7 @@ buildPythonPackage rec {
 
   postPatch = ''
     substituteInPlace setup.py \
-      --replace "tokenizers == 0.9.3" "tokenizers" \
-      --replace "sentencepiece == 0.1.91" "sentencepiece"
+      --replace "tokenizers == 0.9.4" "tokenizers"
   '';
 
   preCheck = ''
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/vispy/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/vispy/default.nix
index efe444fa8d..6dd32508be 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/vispy/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/vispy/default.nix
@@ -5,11 +5,11 @@
 
 buildPythonPackage rec {
   pname = "vispy";
-  version = "0.6.5";
+  version = "0.6.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "90cc76e79ee16c839bca05753e0c5f9f1c1c57963f2d3b248e4afac0fd75df75";
+    sha256 = "6f3c4d00be9e6761c046d520a86693d78a0925d47eeb2fc095e95dac776f74ee";
   };
 
   patches = [
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/zstd/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/zstd/default.nix
index 8f61f2ffc6..d57416ac18 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/zstd/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/zstd/default.nix
@@ -1,4 +1,5 @@
 { stdenv, pkgconfig, fetchPypi, buildPythonPackage
+, buildPackages
 , zstd, pytest }:
 
 buildPythonPackage rec {
@@ -12,7 +13,7 @@ buildPythonPackage rec {
 
   postPatch = ''
     substituteInPlace setup.py \
-      --replace "/usr/bin/pkg-config" "${pkgconfig}/bin/${pkgconfig.targetPrefix}pkg-config"
+      --replace "/usr/bin/pkg-config" "${buildPackages.pkgconfig}/bin/${buildPackages.pkgconfig.targetPrefix}pkg-config"
   '';
 
   nativeBuildInputs = [ pkgconfig ];
diff --git a/third_party/nixpkgs/pkgs/development/ruby-modules/gem/default.nix b/third_party/nixpkgs/pkgs/development/ruby-modules/gem/default.nix
index 910949d847..9e64b120af 100644
--- a/third_party/nixpkgs/pkgs/development/ruby-modules/gem/default.nix
+++ b/third_party/nixpkgs/pkgs/development/ruby-modules/gem/default.nix
@@ -49,6 +49,11 @@ lib.makeOverridable (
 , propagatedUserEnvPkgs ? []
 , buildFlags ? []
 , passthru ? {}
+# bundler expects gems to be stored in the cache directory for certain actions
+# such as `bundler install --redownload`.
+# At the cost of increasing the store size, you can keep the gems to have closer
+# alignment with what Bundler expects.
+, keepGemCache ? false
 , ...} @ attrs:
 
 let
@@ -208,7 +213,7 @@ stdenv.mkDerivation ((builtins.removeAttrs attrs ["source"]) // {
     pushd $out/${ruby.gemPath}
     rm -fv doc/*/*/created.rid || true
     rm -fv {gems/*/ext/*,extensions/*/*/*}/{Makefile,mkmf.log,gem_make.out} || true
-    rm -fvr cache
+    ${if keepGemCache then "" else "rm -fvr cache"}
     popd
 
     # write out metadata and binstubs
diff --git a/third_party/nixpkgs/pkgs/development/ruby-modules/rbenv/default.nix b/third_party/nixpkgs/pkgs/development/ruby-modules/rbenv/default.nix
new file mode 100644
index 0000000000..dd6b1d95b4
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/development/ruby-modules/rbenv/default.nix
@@ -0,0 +1,41 @@
+{ stdenv, fetchFromGitHub, bash, installShellFiles }:
+
+stdenv.mkDerivation rec {
+  pname = "rbenv";
+  version = "1.1.2";
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  src = fetchFromGitHub {
+    owner = "rbenv";
+    repo = "rbenv";
+    rev = "v${version}";
+    sha256 = "12i050vs35iiblxga43zrj7xwbaisv3mq55y9ikagkr8pj1vmq53";
+  };
+
+  postPatch = ''
+     patchShebangs src/configure
+     pushd src
+  '';
+
+  installPhase = ''
+    popd
+    mkdir -p $out/bin
+    mv libexec $out
+    ln -s $out/libexec/rbenv $out/bin/rbenv
+
+    installShellCompletion completions/rbenv.{bash,zsh}
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Groom your app’s Ruby environment";
+    longDescription = ''
+      Use rbenv to pick a Ruby version for your application and guarantee that your development environment matches production.
+      Put rbenv to work with Bundler for painless Ruby upgrades and bulletproof deployments.
+    '';
+    homepage = "https://github.com/rbenv/rbenv";
+    license = licenses.mit;
+    maintainers = with maintainers; [ fzakaria ];
+    platforms = platforms.all;
+  };
+}
diff --git a/third_party/nixpkgs/pkgs/development/tools/analysis/checkstyle/default.nix b/third_party/nixpkgs/pkgs/development/tools/analysis/checkstyle/default.nix
index 1e2b435fd0..786ed360ef 100644
--- a/third_party/nixpkgs/pkgs/development/tools/analysis/checkstyle/default.nix
+++ b/third_party/nixpkgs/pkgs/development/tools/analysis/checkstyle/default.nix
@@ -1,12 +1,12 @@
 { stdenv, fetchurl, makeWrapper, jre }:
 
 stdenv.mkDerivation rec {
-  version = "8.37";
+  version = "8.38";
   pname = "checkstyle";
 
   src = fetchurl {
     url = "https://github.com/checkstyle/checkstyle/releases/download/checkstyle-${version}/checkstyle-${version}-all.jar";
-    sha256 = "1xhindlq46d5878mkbxc3f6fx6i00kqbj2aymlg0022v9h6r1p9p";
+    sha256 = "1j4k75iv32fsp40ajdfm99zady5c0h0f39xvmv70frp8p58kq3rl";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/third_party/nixpkgs/pkgs/development/tools/analysis/codeql/default.nix b/third_party/nixpkgs/pkgs/development/tools/analysis/codeql/default.nix
index 5e1e93951c..fc37324bc9 100644
--- a/third_party/nixpkgs/pkgs/development/tools/analysis/codeql/default.nix
+++ b/third_party/nixpkgs/pkgs/development/tools/analysis/codeql/default.nix
@@ -12,7 +12,7 @@
 
 stdenv.mkDerivation rec {
   pname = "codeql";
-  version = "2.3.3";
+  version = "2.4.0";
 
   dontConfigure = true;
   dontBuild = true;
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
 
   src = fetchzip {
     url = "https://github.com/github/codeql-cli-binaries/releases/download/v${version}/codeql.zip";
-    sha256 = "17a574g92jfff2059mhaw2x31npglp9rfcwwk73adbajpiyf4g8q";
+    sha256 = "1mplya2dyqqmm6gj4if2k4h2fra15rxf2yfnhphqhz40kz75sxk8";
   };
 
   nativeBuildInputs = [
diff --git a/third_party/nixpkgs/pkgs/development/tools/build-managers/rocm-cmake/default.nix b/third_party/nixpkgs/pkgs/development/tools/build-managers/rocm-cmake/default.nix
index 77a424ae16..8f01b9aca3 100644
--- a/third_party/nixpkgs/pkgs/development/tools/build-managers/rocm-cmake/default.nix
+++ b/third_party/nixpkgs/pkgs/development/tools/build-managers/rocm-cmake/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "rocm-cmake";
-  version = "3.9.0";
+  version = "3.10.0";
 
   src = fetchFromGitHub {
     owner = "RadeonOpenCompute";
     repo = "rocm-cmake";
     rev = "rocm-${version}";
-    sha256 = "13j7gmcy1j6qsydgccmgiacg6sj38l5mlwn4ck8qizl0cpc14gfm";
+    hash = "sha256-1T0S2GWA/ojRZMRyWgtFQ2rzmIqvMvaa19jI4Fl9R44=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/third_party/nixpkgs/pkgs/development/tools/continuous-integration/fly/default.nix b/third_party/nixpkgs/pkgs/development/tools/continuous-integration/fly/default.nix
index 405ac1e26b..f993faf544 100644
--- a/third_party/nixpkgs/pkgs/development/tools/continuous-integration/fly/default.nix
+++ b/third_party/nixpkgs/pkgs/development/tools/continuous-integration/fly/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "fly";
-  version = "6.7.0";
+  version = "6.7.2";
 
   src = fetchFromGitHub {
     owner = "concourse";
     repo = "concourse";
     rev = "v${version}";
-    sha256 = "0jc0hr0h1xya7avzxdwmvhnsm5cr3g21pig52draz5vjaya7bg55";
+    sha256 = "0c5alf2a0088i25mglla9dl4m3wr5y8pnl5cczgn06sz8qp9a0s0";
   };
 
   vendorSha256 = "1fxbxkg7disndlmb065abnfn7sn79qclkcbizmrq49f064w1ijr4";
diff --git a/third_party/nixpkgs/pkgs/development/tools/errcheck/default.nix b/third_party/nixpkgs/pkgs/development/tools/errcheck/default.nix
index 2df473ac59..3c42c1437a 100644
--- a/third_party/nixpkgs/pkgs/development/tools/errcheck/default.nix
+++ b/third_party/nixpkgs/pkgs/development/tools/errcheck/default.nix
@@ -1,23 +1,17 @@
-{ buildGoPackage
-, lib
-, fetchFromGitHub
-}:
+{ lib, fetchFromGitHub, buildGoModule }:
 
-buildGoPackage rec {
+buildGoModule rec {
   pname = "errcheck";
-  version = "1.1.0";
-
-  goPackagePath = "github.com/kisielk/errcheck";
-  excludedPackages = "\\(testdata\\)";
+  version = "1.4.0";
 
   src = fetchFromGitHub {
     owner = "kisielk";
     repo = "errcheck";
     rev = "v${version}";
-    sha256 = "19vd4rxmqbk5lpiav3pf7df3yjlz0l0dwx9mn0gjq5f998iyhy6y";
+    sha256 = "00skyvy31yliw0f395j5h3gichi5n2q1m24izjidxvyc2av7pjn6";
   };
 
-  goDeps = ./deps.nix;
+  vendorSha256 = "0mx506qb5sy6p4zqjs1n0w7dg8pz2wf982qi9v7nrhxysl2rlnxf";
 
   meta = with lib; {
     description = "Program for checking for unchecked errors in go programs";
diff --git a/third_party/nixpkgs/pkgs/development/tools/errcheck/deps.nix b/third_party/nixpkgs/pkgs/development/tools/errcheck/deps.nix
deleted file mode 100644
index 8470c9e12a..0000000000
--- a/third_party/nixpkgs/pkgs/development/tools/errcheck/deps.nix
+++ /dev/null
@@ -1,20 +0,0 @@
-[
-  {
-    goPackagePath = "github.com/kisielk/gotool";
-    fetch = {
-      type = "git";
-      url = "https://github.com/kisielk/gotool";
-      rev = "80517062f582ea3340cd4baf70e86d539ae7d84d";
-      sha256 = "14af2pa0ssyp8bp2mvdw184s5wcysk6akil3wzxmr05wwy951iwn";
-    };
-  }
-  {
-    goPackagePath = "golang.org/x/tools";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/tools";
-      rev = "3a10b9bf0a52df7e992a8c3eb712a86d3c896c75";
-      sha256 = "19f3dijcc54jnd7458jab2dgpd0gzccmv2qympd9wi8cc8jpnhws";
-    };
-  }
-]
diff --git a/third_party/nixpkgs/pkgs/development/tools/flyway/default.nix b/third_party/nixpkgs/pkgs/development/tools/flyway/default.nix
index f6c7bef1dc..1913e3d66f 100644
--- a/third_party/nixpkgs/pkgs/development/tools/flyway/default.nix
+++ b/third_party/nixpkgs/pkgs/development/tools/flyway/default.nix
@@ -1,13 +1,13 @@
 { stdenv, fetchurl, jre_headless, makeWrapper }:
   let
-    version = "7.2.1";
+    version = "7.3.0";
   in
     stdenv.mkDerivation {
       pname = "flyway";
       inherit version;
       src = fetchurl {
         url = "https://repo1.maven.org/maven2/org/flywaydb/flyway-commandline/${version}/flyway-commandline-${version}.tar.gz";
-        sha256 = "0b9pyy5avgr2wh3amnpwfc21i69mbw9a0xdxwg5wlrw83f5rx17w";
+        sha256 = "0d5v0g28myqiac0a5qy0sbpf0mjzzi3agyks9cdzsgg3ka1i18q9";
       };
       nativeBuildInputs = [ makeWrapper ];
       dontBuild = true;
diff --git a/third_party/nixpkgs/pkgs/development/tools/go-migrate/default.nix b/third_party/nixpkgs/pkgs/development/tools/go-migrate/default.nix
index 7cb95b326d..3a424014ec 100644
--- a/third_party/nixpkgs/pkgs/development/tools/go-migrate/default.nix
+++ b/third_party/nixpkgs/pkgs/development/tools/go-migrate/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "go-migrate";
-  version = "4.13.0";
+  version = "4.14.1";
 
   src = fetchFromGitHub {
     owner = "golang-migrate";
     repo = "migrate";
     rev = "v${version}";
-    sha256 = "0rzx974cxsipbnggl3n4q6zsvm313svrg718gscydygk41m9nql9";
+    sha256 = "1mgs3bngghmirmn0pw351m54darv8d5iymlxcjqw3vr0cyn5aqj0";
   };
 
-  vendorSha256 = "1107syipynlfibzljyfgz81v1avi8axvsjpmrpj990pm83r9svc6";
+  vendorSha256 = "071gfyx6iqla8ir7ianw1z62rdsds9shakzqs9wn34ll1kdbd4rv";
 
   subPackages = [ "cmd/migrate" ];
 
diff --git a/third_party/nixpkgs/pkgs/development/tools/kubie/default.nix b/third_party/nixpkgs/pkgs/development/tools/kubie/default.nix
index 1895cd0786..316be0b2fc 100644
--- a/third_party/nixpkgs/pkgs/development/tools/kubie/default.nix
+++ b/third_party/nixpkgs/pkgs/development/tools/kubie/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "kubie";
-  version = "0.9.1";
+  version = "0.11.0";
 
   src = fetchFromGitHub {
     rev = "v${version}";
     owner = "sbstp";
     repo = "kubie";
-    sha256 = "0q1dxry10iaf7zx6vyr0da4ihqx7l8dlyhlqm8qqfz913h2wam8c";
+    sha256 = "0862f582i08h80pm6igmi00qsacl5b9jaahh50l2i3905k7rxf5s";
   };
 
-  cargoSha256 = "13zs2xz3s4732zxsimg7b22d9707ln4gpscznxi13cjkf5as9gbz";
+  cargoSha256 = "1b0nl4nwjza52madrfsmwivxxvz18b53kynv2fbsbh3zzbrm5fj1";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/third_party/nixpkgs/pkgs/development/tools/misc/blackfire/php-probe.nix b/third_party/nixpkgs/pkgs/development/tools/misc/blackfire/php-probe.nix
index 8a02f61573..97b5f9ed82 100644
--- a/third_party/nixpkgs/pkgs/development/tools/misc/blackfire/php-probe.nix
+++ b/third_party/nixpkgs/pkgs/development/tools/misc/blackfire/php-probe.nix
@@ -14,14 +14,15 @@ let
   soFile = {
     "7.3" = "blackfire-20180731";
     "7.4" = "blackfire-20190902";
+    "8.0" = "blackfire-20200930";
   }.${lib.versions.majorMinor php.version} or (throw "Unsupported PHP version.");
 in stdenv.mkDerivation rec {
   pname = "php-blackfire";
-  version = "1.44.0";
+  version = "1.46.4";
 
   src = fetchurl {
     url = "https://packages.blackfire.io/debian/pool/any/main/b/blackfire-php/blackfire-php_${version}_amd64.deb";
-    sha256 = "15y1244bbs07i7rg6cy8kynp1may4mbkmmwbxgq8q5zma3ldc8ci";
+    sha256 = "1p46zi1hh9calkcfgqz60c6rdi9i7i16ylj84iibi6k0pc690fjy";
   };
 
   nativeBuildInputs = [
diff --git a/third_party/nixpkgs/pkgs/development/tools/misc/gengetopt/default.nix b/third_party/nixpkgs/pkgs/development/tools/misc/gengetopt/default.nix
index 114a7530f2..0a3b0b1c75 100644
--- a/third_party/nixpkgs/pkgs/development/tools/misc/gengetopt/default.nix
+++ b/third_party/nixpkgs/pkgs/development/tools/misc/gengetopt/default.nix
@@ -10,6 +10,10 @@ stdenv.mkDerivation rec {
   };
 
   doCheck = true;
+  # attempts to open non-existent file
+  preCheck = ''
+    rm tests/test_conf_parser_save.sh
+  '';
 
   enableParallelBuilding = true;
 
diff --git a/third_party/nixpkgs/pkgs/development/tools/misc/macdylibbundler/default.nix b/third_party/nixpkgs/pkgs/development/tools/misc/macdylibbundler/default.nix
index 103c534dfa..5008175363 100644
--- a/third_party/nixpkgs/pkgs/development/tools/misc/macdylibbundler/default.nix
+++ b/third_party/nixpkgs/pkgs/development/tools/misc/macdylibbundler/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub }:
+{ stdenv, makeWrapper, fetchFromGitHub, cctools }:
 
 stdenv.mkDerivation {
   pname = "macdylibbundler";
@@ -11,8 +11,15 @@ stdenv.mkDerivation {
     sha256 = "149p3dcnap4hs3nhq5rfvr3m70rrb5hbr5xkj1h0gsfp0d7gvxnj";
   };
 
+  buildInputs = [ makeWrapper ];
+
   makeFlags = [ "PREFIX=$(out)" ];
 
+  postInstall = ''
+    wrapProgram $out/bin/dylibbundler \
+      --prefix PATH ":" "${cctools}/bin"
+  '';
+
   meta = with stdenv.lib; {
     description = "Utility to ease bundling libraries into executables for OSX";
     longDescription = ''
diff --git a/third_party/nixpkgs/pkgs/development/tools/ocaml/obelisk/default.nix b/third_party/nixpkgs/pkgs/development/tools/ocaml/obelisk/default.nix
index e7528d4f77..483e9c45df 100644
--- a/third_party/nixpkgs/pkgs/development/tools/ocaml/obelisk/default.nix
+++ b/third_party/nixpkgs/pkgs/development/tools/ocaml/obelisk/default.nix
@@ -1,24 +1,20 @@
-{ stdenv, fetchFromGitHub, ocamlPackages }:
+{ lib, fetchurl, ocamlPackages }:
 
-stdenv.mkDerivation rec {
+ocamlPackages.buildDunePackage rec {
 	pname = "obelisk";
-	version = "0.4.0";
-	src = fetchFromGitHub {
-		owner = "lelio-brun";
-		repo = "obelisk";
-		rev = "v${version}";
-		sha256 = "0rw85knbwqj2rys1hh5qy8sfdqb4mb1wsriy38n7zcpbwim47vb8";
+	version = "0.5.2";
+	useDune2 = true;
+	src = fetchurl {
+		url = "https://github.com/Lelio-Brun/Obelisk/releases/download/v${version}/obelisk-v${version}.tbz";
+		sha256 = "0s86gkypyrkrp83xnay258ijri3yjwj3marsjnjf8mz58z0zd9g6";
 	};
 
-	buildInputs = with ocamlPackages; [ ocaml findlib ocamlbuild menhir ];
-
-	installFlags = [ "BINDIR=$(out)/bin" ];
+	buildInputs = with ocamlPackages; [ menhir re ];
 
 	meta = {
 		description = "A simple tool which produces pretty-printed output from a Menhir parser file (.mly)";
-		license = stdenv.lib.licenses.mit;
-		maintainers = [ stdenv.lib.maintainers.vbgl ];
-		inherit (src.meta) homepage;
-		inherit (ocamlPackages.ocaml.meta) platforms;
+		license = lib.licenses.mit;
+		maintainers = [ lib.maintainers.vbgl ];
+		homepage = "https://github.com/Lelio-Brun/Obelisk";
 	};
 }
diff --git a/third_party/nixpkgs/pkgs/development/tools/poetry2nix/poetry2nix/bin/poetry2nix b/third_party/nixpkgs/pkgs/development/tools/poetry2nix/poetry2nix/bin/poetry2nix
index 355cebfd50..559025f3ec 100755
--- a/third_party/nixpkgs/pkgs/development/tools/poetry2nix/poetry2nix/bin/poetry2nix
+++ b/third_party/nixpkgs/pkgs/development/tools/poetry2nix/poetry2nix/bin/poetry2nix
@@ -7,60 +7,127 @@ import toml
 import json
 import sys
 
-
-argparser = argparse.ArgumentParser(description="Poetry2nix CLI")
-
-subparsers = argparser.add_subparsers(dest="subcommand")
-subparsers.required = True
-
-parser_lock = subparsers.add_parser("lock", help="Generate overrides for git hashes",)
-parser_lock.add_argument(
-    "--lock", default="poetry.lock", help="Path to input poetry.lock",
-)
-parser_lock.add_argument(
-    "--out", default="poetry-git-overlay.nix", help="Output file",
-)
+from typing import Dict, Any, Tuple, List
 
 
-def fetch_git(pkg):
-    return (
-        pkg["name"],
-        subprocess.run(
-            [
-                "nix-prefetch-git",
-                "--fetch-submodules",
-                "--url",
-                pkg["source"]["url"],
-                "--rev",
-                pkg["source"]["reference"],
-            ],
-            stdout=subprocess.PIPE,
-            stderr=subprocess.PIPE,
-        ),
+class Package:
+    def __init__(self, attrs: Dict[str, Any]) -> None:
+        self.attrs = attrs
+        self.name = attrs["name"]
+        self.source = self.attrs["source"]
+
+    def fetch(self) -> Tuple["Package", subprocess.CompletedProcess]:
+        raise NotImplementedError()
+
+    def expression(self, output: str) -> str:
+        raise NotImplementedError()
+
+
+class UrlPackage(Package):
+    def fetch(self) -> Tuple[Package, subprocess.CompletedProcess]:
+        return (
+            self,
+            subprocess.run(
+                [
+                    "nix-prefetch-url",
+                    "--unpack",
+                    self.source["url"],
+                ],
+                stdout=subprocess.PIPE,
+                stderr=subprocess.PIPE,
+                text=True
+            ),
+        )
+
+    def expression(self, output: str) -> str:
+        sha256 = output.rstrip()
+        return textwrap.dedent("""
+            %s = super.%s.overridePythonAttrs (
+              _: {
+                src = pkgs.fetchzip {
+                  url = "%s";
+                  sha256 = "%s";
+                };
+              }
+            );""" % (self.name, self.name, self.source["url"], sha256))
+
+
+class GitPackage(Package):
+    def fetch(self) -> Tuple[Package, subprocess.CompletedProcess]:
+        reference = self.source.get("resolved_reference", self.source["reference"])
+
+        return (
+            self,
+            subprocess.run(
+                [
+                    "nix-prefetch-git",
+                    "--fetch-submodules",
+                    "--url",
+                    self.source["url"],
+                    "--rev",
+                    reference,
+                ],
+                stdout=subprocess.PIPE,
+                stderr=subprocess.PIPE,
+                text=True
+            ),
+        )
+
+    def expression(self, output: str) -> str:
+        meta = json.loads(output)
+        return textwrap.dedent("""
+            %s = super.%s.overridePythonAttrs (
+              _: {
+                src = pkgs.fetchgit {
+                  url = "%s";
+                  rev = "%s";
+                  sha256 = "%s";
+                };
+              }
+            );""" % (self.name, self.name, meta["url"], meta["rev"], meta["sha256"]))
+
+
+def parse_args() -> argparse.Namespace:
+    argparser = argparse.ArgumentParser(description="Poetry2nix CLI")
+
+    subparsers = argparser.add_subparsers(dest="subcommand")
+    subparsers.required = True
+
+    parser_lock = subparsers.add_parser("lock", help="Generate overrides for git hashes",)
+    parser_lock.add_argument(
+        "--lock", default="poetry.lock", help="Path to input poetry.lock",
     )
+    parser_lock.add_argument(
+        "--out", default="poetry-git-overlay.nix", help="Output file",
+    )
+    return argparser.parse_args()
 
 
-def indent(expr, spaces=2):
+def indent(expr: str, spaces: int = 2) -> str:
     i = " " * spaces
     return "\n".join([(i if l != "" else "") + l for l in expr.split("\n")])
 
 
-if __name__ == "__main__":
-    args = argparser.parse_args()
+def main() -> None:
+    args = parse_args()
 
     with open(args.lock) as lockf:
         lock = toml.load(lockf)
 
-    pkgs = []
+    pkgs: List[Package] = []
     for pkg in lock["package"]:
         if "source" in pkg:
-            pkgs.append(pkg)
+            source_type = pkg["source"]["type"]
+            if source_type == "git":
+                pkgs.append(GitPackage(pkg))
+            elif source_type == "url":
+                pkgs.append(UrlPackage(pkg))
 
     with ThreadPoolExecutor() as e:
         futures = []
 
         for pkg in pkgs:
-            futures.append(e.submit(fetch_git, pkg))
+            futures.append(e.submit(pkg.fetch))
 
         lines = [
             "{ pkgs }:",
@@ -68,30 +135,13 @@ if __name__ == "__main__":
         ]
 
         for f in futures:
-            drv_name, p = f.result()
+            package, p = f.result()
             if p.returncode != 0:
-                sys.stderr.buffer.write(p.stderr)
-                sys.stderr.buffer.flush()
+                sys.stderr.write(p.stderr)
+                sys.stderr.flush()
                 exit(p.returncode)
-
-            meta = json.loads(p.stdout.decode())
-            lines.append(
-                indent(
-                    textwrap.dedent(
-                        """
-              %s = super.%s.overridePythonAttrs (
-                _: {
-                  src = pkgs.fetchgit {
-                    url = "%s";
-                    rev = "%s";
-                    sha256 = "%s";
-                  };
-                }
-              );"""
-                        % (drv_name, drv_name, meta["url"], meta["rev"], meta["sha256"])
-                    )
-                )
-            )
+            expr = package.expression(p.stdout)
+            lines.append(indent(expr))
 
         lines.extend(["", "}", ""])
 
@@ -101,3 +151,7 @@ if __name__ == "__main__":
         fout.write(expr)
 
     print(f"Wrote {args.out}")
+
+
+if __name__ == "__main__":
+    main()
diff --git a/third_party/nixpkgs/pkgs/development/tools/poetry2nix/poetry2nix/default.nix b/third_party/nixpkgs/pkgs/development/tools/poetry2nix/poetry2nix/default.nix
index e47dbc99f2..b0e65ed85a 100644
--- a/third_party/nixpkgs/pkgs/development/tools/poetry2nix/poetry2nix/default.nix
+++ b/third_party/nixpkgs/pkgs/development/tools/poetry2nix/poetry2nix/default.nix
@@ -71,7 +71,7 @@ in
 lib.makeScope pkgs.newScope (self: {
 
   # Poetry2nix version
-  version = "1.13.0";
+  version = "1.14.0";
 
   /*
      Returns an attrset { python, poetryPackages, pyProject, poetryLock } for the given pyproject/lockfile.
diff --git a/third_party/nixpkgs/pkgs/development/tools/poetry2nix/poetry2nix/hooks/default.nix b/third_party/nixpkgs/pkgs/development/tools/poetry2nix/poetry2nix/hooks/default.nix
index 6d60df2847..a66989f70e 100644
--- a/third_party/nixpkgs/pkgs/development/tools/poetry2nix/poetry2nix/hooks/default.nix
+++ b/third_party/nixpkgs/pkgs/development/tools/poetry2nix/poetry2nix/hooks/default.nix
@@ -1,11 +1,11 @@
 { python
-, callPackage
+, buildPackages
 , makeSetupHook
-, yj
 , wheel
 , pip
 }:
 let
+  callPackage = python.pythonForBuild.pkgs.callPackage;
   pythonInterpreter = python.pythonForBuild.interpreter;
   pythonSitePackages = python.sitePackages;
 in
@@ -20,7 +20,7 @@ in
           deps = [ ];
           substitutions = {
             inherit pythonInterpreter;
-            yj = "${yj}/bin/yj";
+            yj = "${buildPackages.yj}/bin/yj";
             pyprojectPatchScript = "${./pyproject-without-path.py}";
           };
         } ./remove-path-dependencies.sh
diff --git a/third_party/nixpkgs/pkgs/development/tools/poetry2nix/poetry2nix/mk-poetry-dep.nix b/third_party/nixpkgs/pkgs/development/tools/poetry2nix/poetry2nix/mk-poetry-dep.nix
index 9619e36493..c01f99c01d 100644
--- a/third_party/nixpkgs/pkgs/development/tools/poetry2nix/poetry2nix/mk-poetry-dep.nix
+++ b/third_party/nixpkgs/pkgs/development/tools/poetry2nix/poetry2nix/mk-poetry-dep.nix
@@ -27,6 +27,7 @@ pythonPackages.callPackage
     , ...
     }@args:
     let
+      inherit (pkgs) stdenv;
       inherit (poetryLib) isCompatible getManyLinuxDeps fetchFromPypi moduleName;
 
       inherit (import ./pep425.nix {
@@ -45,6 +46,7 @@ pythonPackages.callPackage
       toPath = s: pwd + "/${s}";
       isSource = source != null;
       isGit = isSource && source.type == "git";
+      isUrl = isSource && source.type == "url";
       isLocal = isSource && source.type == "directory";
       localDepPath = toPath source.url;
 
@@ -91,7 +93,7 @@ pythonPackages.callPackage
         "toml" # Toml is an extra for setuptools-scm
       ];
       baseBuildInputs = lib.optional (! lib.elem name skipSetupToolsSCM) pythonPackages.setuptools-scm;
-      format = if isLocal then "pyproject" else if isGit then "pyproject" else fileInfo.format;
+      format = if isLocal || isGit || isUrl then "pyproject" else fileInfo.format;
     in
     buildPythonPackage {
       pname = moduleName name;
@@ -113,9 +115,10 @@ pythonPackages.callPackage
 
       buildInputs = (
         baseBuildInputs
+        ++ lib.optional (stdenv.buildPlatform != stdenv.hostPlatform) pythonPackages.setuptools
         ++ lib.optional (!isSource) (getManyLinuxDeps fileInfo.name).pkg
         ++ lib.optional isLocal buildSystemPkgs
-        ++ lib.optional (!__isBootstrap) [ pythonPackages.poetry ]
+        ++ lib.optional (!__isBootstrap) pythonPackages.poetry
       );
 
       propagatedBuildInputs =
@@ -157,14 +160,22 @@ pythonPackages.callPackage
           (
             builtins.fetchGit {
               inherit (source) url;
-              rev = source.reference;
+              rev = source.resolved_reference or source.reference;
               ref = sourceSpec.branch or sourceSpec.rev or sourceSpec.tag or "HEAD";
             }
-          ) else if isLocal then (poetryLib.cleanPythonSources { src = localDepPath; }) else
-        fetchFromPypi {
-          pname = name;
-          inherit (fileInfo) file hash kind;
-        };
+          )
+        else if isUrl then
+          builtins.fetchTarball
+            {
+              inherit (source) url;
+            }
+        else if isLocal then
+          (poetryLib.cleanPythonSources { src = localDepPath; })
+        else
+          fetchFromPypi {
+            pname = name;
+            inherit (fileInfo) file hash kind;
+          };
     }
   )
 { }
diff --git a/third_party/nixpkgs/pkgs/development/tools/poetry2nix/poetry2nix/overrides.nix b/third_party/nixpkgs/pkgs/development/tools/poetry2nix/poetry2nix/overrides.nix
index ca6c0c7cc4..16d66c48af 100644
--- a/third_party/nixpkgs/pkgs/development/tools/poetry2nix/poetry2nix/overrides.nix
+++ b/third_party/nixpkgs/pkgs/development/tools/poetry2nix/poetry2nix/overrides.nix
@@ -93,7 +93,7 @@ self: super:
     (
       super.cffi.overridePythonAttrs (
         old: {
-          buildInputs = old.buildInputs ++ [ pkgs.libffi ];
+          buildInputs = old.buildInputs or [ ] ++ [ pkgs.libffi ];
         }
       )
     );
@@ -106,6 +106,12 @@ self: super:
     }
   );
 
+  colour = super.colour.overridePythonAttrs (
+    old: {
+      buildInputs = old.buildInputs ++ [ self.d2to1 ];
+    }
+  );
+
   configparser = super.configparser.overridePythonAttrs (
     old: {
       buildInputs = old.buildInputs ++ [
@@ -120,6 +126,8 @@ self: super:
 
   cryptography = super.cryptography.overridePythonAttrs (
     old: {
+      nativeBuildInputs = old.nativeBuildInputs or [ ]
+        ++ stdenv.lib.optional (stdenv.buildPlatform != stdenv.hostPlatform) self.python.pythonForBuild.pkgs.cffi;
       buildInputs = old.buildInputs ++ [ pkgs.openssl ];
     }
   );
@@ -324,6 +332,17 @@ self: super:
     }
   );
 
+  jira = super.jira.overridePythonAttrs (
+    old: {
+      inherit (pkgs.python3Packages.jira) patches;
+      buildInputs = old.buildInputs ++ [
+        self.pytestrunner
+        self.cryptography
+        self.pyjwt
+      ];
+    }
+  );
+
   jsonpickle = super.jsonpickle.overridePythonAttrs (
     old: {
       dontPreferSetupPy = true;
@@ -499,6 +518,31 @@ self: super:
     buildInputs = oa.buildInputs ++ [ self.pbr ];
   });
 
+  mpi4py = super.mpi4py.overridePythonAttrs (
+    old:
+    let
+      cfg = pkgs.writeTextFile {
+        name = "mpi.cfg";
+        text = (
+          lib.generators.toINI
+            { }
+            {
+              mpi = {
+                mpicc = "${pkgs.openmpi.outPath}/bin/mpicc";
+              };
+            }
+        );
+      };
+    in
+    {
+      propagatedBuildInputs = old.propagatedBuildInputs ++ [ pkgs.openmpi ];
+      enableParallelBuilding = true;
+      preBuild = ''
+        ln -sf ${cfg} mpi.cfg
+      '';
+    }
+  );
+
   multiaddr = super.multiaddr.overridePythonAttrs (
     old: {
       buildInputs = old.buildInputs ++ [ self.pytest-runner ];
@@ -584,8 +628,8 @@ self: super:
       withMysql = old.passthru.withMysql or false;
     in
     {
-      buildInputs = old.buildInputs ++ [ self.cython pkgs.sqlite ];
-      propagatedBuildInputs = old.propagatedBuildInputs
+      buildInputs = old.buildInputs or [ ] ++ [ pkgs.sqlite ];
+      propagatedBuildInputs = old.propagatedBuildInputs or [ ]
         ++ lib.optional withPostgres self.psycopg2
         ++ lib.optional withMysql self.mysql-connector;
     }
@@ -602,8 +646,8 @@ self: super:
     # "Vendor" dependencies (for build-system support)
     postPatch = ''
       echo "import sys" >> poetry/__init__.py
-      for path in ''${PYTHONPATH//:/ }; do echo $path; done | uniq | while read path; do
-        echo "sys.path.insert(0, \"$path\")" >> poetry/__init__.py
+      for path in $propagatedBuildInputs; do
+          echo "sys.path.insert(0, \"$path\")" >> poetry/__init__.py
       done
     '';
 
@@ -796,6 +840,14 @@ self: super:
     }
   );
 
+  python-bugzilla = super.python-bugzilla.overridePythonAttrs (
+    old: {
+      nativeBuildInputs = old.nativeBuildInputs ++ [
+        self.docutils
+      ];
+    }
+  );
+
   python-ldap = super.python-ldap.overridePythonAttrs (
     old: {
       buildInputs = old.buildInputs ++ [ pkgs.openldap pkgs.cyrus_sasl ];
@@ -924,6 +976,15 @@ self: super:
     }
   );
 
+  pytest-django = super.pytest-django.overridePythonAttrs (
+    old: {
+      postPatch = ''
+        substituteInPlace setup.py --replace "'pytest>=3.6'," ""
+        substituteInPlace setup.py --replace "'pytest>=3.6'" ""
+      '';
+    }
+  );
+
   pytest-runner = super.pytest-runner or super.pytestrunner;
 
   python-jose = super.python-jose.overridePythonAttrs (
@@ -1090,6 +1151,43 @@ self: super:
     }
   );
 
+  torch = lib.makeOverridable
+    ({ enableCuda ? false
+     , cudatoolkit ? pkgs.cudatoolkit_10_1
+     , pkg ? super.torch
+     }: pkg.overrideAttrs (old:
+      {
+        preConfigure =
+          if (!enableCuda) then ''
+            export USE_CUDA=0
+          '' else ''
+            export LD_LIBRARY_PATH="$LD_LIBRARY_PATH:${cudatoolkit}/targets/x86_64-linux/lib"
+          '';
+        preFixup = lib.optionalString (!enableCuda) ''
+          # For some reason pytorch retains a reference to libcuda even if it
+          # is explicitly disabled with USE_CUDA=0.
+          find $out -name "*.so" -exec ${pkgs.patchelf}/bin/patchelf --remove-needed libcuda.so.1 {} \;
+        '';
+        buildInputs = old.buildInputs ++ lib.optionals enableCuda [
+          pkgs.linuxPackages.nvidia_x11
+          pkgs.nccl.dev
+          pkgs.nccl.out
+        ];
+        propagatedBuildInputs = [
+          super.numpy
+          super.future
+        ];
+      })
+    )
+    { };
+
+  typeguard = super.typeguard.overridePythonAttrs (old: {
+    postPatch = ''
+      substituteInPlace setup.py \
+        --replace 'setup()' 'setup(version="${old.version}")'
+    '';
+  });
+
   # nix uses a dash, poetry uses an underscore
   typing_extensions = super.typing_extensions or self.typing-extensions;
 
@@ -1193,4 +1291,30 @@ self: super:
     }
   );
 
+  credis = super.credis.overridePythonAttrs (
+    old: {
+      buildInputs = old.buildInputs ++ [ self.cython ];
+    }
+  );
+
+  hashids = super.hashids.overridePythonAttrs (
+    old: {
+      buildInputs = old.buildInputs ++ [ self.flit-core ];
+    }
+  );
+
+  supervisor = super.supervisor.overridePythonAttrs (
+    old: {
+      propagatedBuildInputs = old.propagatedBuildInputs ++ [
+        self.meld3
+        self.setuptools
+      ];
+    }
+  );
+
+  cytoolz = super.cytoolz.overridePythonAttrs (
+    old: {
+      propagatedBuildInputs = old.propagatedBuildInputs ++ [ self.toolz ];
+    }
+  );
 }
diff --git a/third_party/nixpkgs/pkgs/development/tools/poetry2nix/poetry2nix/pep425.nix b/third_party/nixpkgs/pkgs/development/tools/poetry2nix/poetry2nix/pep425.nix
index d32e3aacce..e333bd4971 100644
--- a/third_party/nixpkgs/pkgs/development/tools/poetry2nix/poetry2nix/pep425.nix
+++ b/third_party/nixpkgs/pkgs/development/tools/poetry2nix/poetry2nix/pep425.nix
@@ -87,7 +87,7 @@ let
       filtered = builtins.filter filterWheel filesWithoutSources;
       choose = files:
         let
-          osxMatches = [ "10_12" "10_11" "10_10" "10_9" "any" ];
+          osxMatches = [ "10_12" "10_11" "10_10" "10_9" "10_8" "10_7" "any" ];
           linuxMatches = [ "manylinux1_" "manylinux2010_" "manylinux2014_" "any" ];
           chooseLinux = x: lib.take 1 (findBestMatches linuxMatches x);
           chooseOSX = x: lib.take 1 (findBestMatches osxMatches x);
diff --git a/third_party/nixpkgs/pkgs/development/tools/poetry2nix/poetry2nix/pkgs/poetry/default.nix b/third_party/nixpkgs/pkgs/development/tools/poetry2nix/poetry2nix/pkgs/poetry/default.nix
index f93eb119b2..70470ba172 100644
--- a/third_party/nixpkgs/pkgs/development/tools/poetry2nix/poetry2nix/pkgs/poetry/default.nix
+++ b/third_party/nixpkgs/pkgs/development/tools/poetry2nix/poetry2nix/pkgs/poetry/default.nix
@@ -15,8 +15,8 @@ poetry2nix.mkPoetryApplication {
   # "Vendor" dependencies (for build-system support)
   postPatch = ''
     echo "import sys" >> poetry/__init__.py
-    for path in ''${PYTHONPATH//:/ }; do echo $path; done | uniq | while read path; do
-      echo "sys.path.insert(0, \"$path\")" >> poetry/__init__.py
+    for path in $propagatedBuildInputs; do
+        echo "sys.path.insert(0, \"$path\")" >> poetry/__init__.py
     done
   '';
 
diff --git a/third_party/nixpkgs/pkgs/development/tools/poetry2nix/poetry2nix/pkgs/poetry/pyproject.toml b/third_party/nixpkgs/pkgs/development/tools/poetry2nix/poetry2nix/pkgs/poetry/pyproject.toml
index f099a4cac8..0868175ea4 100644
--- a/third_party/nixpkgs/pkgs/development/tools/poetry2nix/poetry2nix/pkgs/poetry/pyproject.toml
+++ b/third_party/nixpkgs/pkgs/development/tools/poetry2nix/poetry2nix/pkgs/poetry/pyproject.toml
@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "poetry"
-version = "1.1.0"
+version = "1.1.4"
 description = "Python dependency management and packaging made easy."
 authors = [
     "Sébastien Eustace <sebastien@eustace.io>"
diff --git a/third_party/nixpkgs/pkgs/development/tools/poetry2nix/poetry2nix/pkgs/poetry/src.json b/third_party/nixpkgs/pkgs/development/tools/poetry2nix/poetry2nix/pkgs/poetry/src.json
index 51894768c1..4a1e8890c2 100644
--- a/third_party/nixpkgs/pkgs/development/tools/poetry2nix/poetry2nix/pkgs/poetry/src.json
+++ b/third_party/nixpkgs/pkgs/development/tools/poetry2nix/poetry2nix/pkgs/poetry/src.json
@@ -1,7 +1,7 @@
 {
     "owner": "python-poetry",
     "repo": "poetry",
-    "rev": "539d7f732c34c821258a9853cd3078cbda34a717",
-    "sha256": "0kl23dkq9n112z1pqjg6f1wv3qk77ij6q5glg15lwrj7yrl9k65c",
+    "rev": "8312e3f2dbfa126cd311c666fea30656941e1bd3",
+    "sha256": "0lx3qpz5dad0is7ki5a4vxphvc8cm8fnv4bmrx226a6nvvaj6ahs",
     "fetchSubmodules": true
 }
diff --git a/third_party/nixpkgs/pkgs/development/tools/poetry2nix/poetry2nix/plugins.nix b/third_party/nixpkgs/pkgs/development/tools/poetry2nix/poetry2nix/plugins.nix
index e7125c2ff5..b5e807c6e2 100644
--- a/third_party/nixpkgs/pkgs/development/tools/poetry2nix/poetry2nix/plugins.nix
+++ b/third_party/nixpkgs/pkgs/development/tools/poetry2nix/poetry2nix/plugins.nix
@@ -23,6 +23,7 @@ let
 
       dontConfigure = true;
       dontBuild = true;
+      dontUsePythonRecompileBytecode = true;
 
       passthru = {
         inherit (drv.passthru) withPlugins;
diff --git a/third_party/nixpkgs/pkgs/development/tools/the-way/default.nix b/third_party/nixpkgs/pkgs/development/tools/the-way/default.nix
index 6042f5f891..5506201b74 100644
--- a/third_party/nixpkgs/pkgs/development/tools/the-way/default.nix
+++ b/third_party/nixpkgs/pkgs/development/tools/the-way/default.nix
@@ -2,20 +2,20 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "the-way";
-  version = "0.7.0";
+  version = "0.12.1";
 
   src = fetchFromGitHub {
     owner = "out-of-cheese-error";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1whmvzpqm8x1q45mzrp4p40nj251drcryj9z4qjxgjlfsd5d1fxq";
+    sha256 = "0lvkrfszmn594n9qkf518c38c0fwzm32y997wlf28l3hpj6yqddq";
   };
 
   nativeBuildInputs = [ installShellFiles ];
 
   buildInputs = stdenv.lib.optionals stdenv.isDarwin  [ AppKit Security ];
 
-  cargoSha256 = "0adhgp6blwx7s1hlwqzzsgkzc43q9avxx8a9ykvvv2s1w7m9ql78";
+  cargoSha256 = "1aiyfsvmrqcmlw0z1944i9s5g3yxc39na5mf16pb9a4bhw8zcwjr";
   checkFlagsArray = stdenv.lib.optionals stdenv.isDarwin [ "--skip=copy" ];
   cargoParallelTestThreads = false;
 
diff --git a/third_party/nixpkgs/pkgs/development/tools/trellis/default.nix b/third_party/nixpkgs/pkgs/development/tools/trellis/default.nix
index 89287b2ac4..c9884a8eac 100644
--- a/third_party/nixpkgs/pkgs/development/tools/trellis/default.nix
+++ b/third_party/nixpkgs/pkgs/development/tools/trellis/default.nix
@@ -3,23 +3,20 @@
 , cmake
 }:
 
-let
-  boostWithPython3 = boost.override { python = python3; enablePython = true; };
-in
 stdenv.mkDerivation rec {
   pname = "trellis";
-  version = "2020.11.07";
+  version = "2020.11.25";
 
   # git describe --tags
   realVersion = with stdenv.lib; with builtins;
-    "1.0-469-g${substring 0 7 (elemAt srcs 0).rev}";
+    "1.0-476-g${substring 0 7 (elemAt srcs 0).rev}";
 
   srcs = [
     (fetchFromGitHub {
        owner  = "SymbiFlow";
        repo   = "prjtrellis";
-       rev    = "b013a135a9b95c18ece559e19aa73ad6c84446c9";
-       sha256 = "09bx30jm9bgdxmbxf49a27spg4yd1nk5r5mympq7xi28hq1xwjnf";
+       rev    = "a441cd9d0390648e96bf27096626eb2c904096de";
+       sha256 = "1rsck44n4mf9v3vfac51ksrhcs84s7q297nq1kjkzzvmsx09gd9k";
        name   = "trellis";
      })
 
@@ -33,7 +30,7 @@ stdenv.mkDerivation rec {
   ];
   sourceRoot = "trellis";
 
-  buildInputs = [ boostWithPython3 ];
+  buildInputs = [ boost ];
   nativeBuildInputs = [ cmake python3 ];
   cmakeFlags = [
     "-DCURRENT_GIT_VERSION=${realVersion}"
diff --git a/third_party/nixpkgs/pkgs/development/web/flyctl/default.nix b/third_party/nixpkgs/pkgs/development/web/flyctl/default.nix
index 9ac8a2cc2a..0aa8c65e3c 100644
--- a/third_party/nixpkgs/pkgs/development/web/flyctl/default.nix
+++ b/third_party/nixpkgs/pkgs/development/web/flyctl/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "flyctl";
-  version = "0.0.150";
+  version = "0.0.151";
 
   src = fetchFromGitHub {
     owner = "superfly";
     repo = "flyctl";
     rev = "v${version}";
-    sha256 = "1wj3l32f9xpmqq91nzlxy8zgh1zkx4ckhc9r487agmv80bfjnzj2";
+    sha256 = "0gd0cgzhikwa11mfpmvk0dp198vhlh09kjgk67xjj4gg9g61nkg9";
   };
 
   preBuild = ''
diff --git a/third_party/nixpkgs/pkgs/development/web/insomnia/default.nix b/third_party/nixpkgs/pkgs/development/web/insomnia/default.nix
index 0640e09934..ce6f469c44 100644
--- a/third_party/nixpkgs/pkgs/development/web/insomnia/default.nix
+++ b/third_party/nixpkgs/pkgs/development/web/insomnia/default.nix
@@ -16,12 +16,12 @@ let
   ];
 in stdenv.mkDerivation rec {
   pname = "insomnia";
-  version = "7.1.1";
+  version = "2020.4.2";
 
   src = fetchurl {
     url =
-      "https://github.com/getinsomnia/insomnia/releases/download/v${version}/insomnia_${version}_amd64.deb";
-    sha256 = "0lg3j5pr2bkjq5rq035fwh4mgpqsja3ndp11zpcz85ni3nvhn657";
+      "https://github.com/Kong/insomnia/releases/download/core%40${version}/Insomnia.Core-${version}.deb";
+    sha256 = "0pxf6nphb6k2szgapqkhjavdzq1blg34v1zj47l76r0iqxrpm3va";
   };
 
   nativeBuildInputs =
diff --git a/third_party/nixpkgs/pkgs/games/factorio/versions.json b/third_party/nixpkgs/pkgs/games/factorio/versions.json
index b82652d21c..b4c9054503 100644
--- a/third_party/nixpkgs/pkgs/games/factorio/versions.json
+++ b/third_party/nixpkgs/pkgs/games/factorio/versions.json
@@ -2,12 +2,12 @@
   "x86_64-linux": {
     "alpha": {
       "experimental": {
-        "name": "factorio_alpha_x64-1.1.4.tar.xz",
+        "name": "factorio_alpha_x64-1.1.5.tar.xz",
         "needsAuth": true,
-        "sha256": "0gg10pk0qb44iizwvlzndjr2xkygqzaxmhp9bam7gz86b5cxs0cl",
+        "sha256": "17hm62mhldms41wv0vv2bzg8zg1mg7ga61h3yzw9dfvic661khmp",
         "tarDirectory": "x64",
-        "url": "https://factorio.com/get-download/1.1.4/alpha/linux64",
-        "version": "1.1.4"
+        "url": "https://factorio.com/get-download/1.1.5/alpha/linux64",
+        "version": "1.1.5"
       },
       "stable": {
         "name": "factorio_alpha_x64-1.0.0.tar.xz",
@@ -38,12 +38,12 @@
     },
     "headless": {
       "experimental": {
-        "name": "factorio_headless_x64-1.1.4.tar.xz",
+        "name": "factorio_headless_x64-1.1.5.tar.xz",
         "needsAuth": false,
-        "sha256": "085lpblysh126y38z01f358xcpwmx1a6hcjlc66aw5ff6bp36yq8",
+        "sha256": "1s4ajj8kkz1q5rivv2q6c8ii73nxa11g4fs6hic3r43l52n89ml1",
         "tarDirectory": "x64",
-        "url": "https://factorio.com/get-download/1.1.4/headless/linux64",
-        "version": "1.1.4"
+        "url": "https://factorio.com/get-download/1.1.5/headless/linux64",
+        "version": "1.1.5"
       },
       "stable": {
         "name": "factorio_headless_x64-1.0.0.tar.xz",
diff --git a/third_party/nixpkgs/pkgs/games/freeciv/default.nix b/third_party/nixpkgs/pkgs/games/freeciv/default.nix
index 3f64d92f07..c8f9c79084 100644
--- a/third_party/nixpkgs/pkgs/games/freeciv/default.nix
+++ b/third_party/nixpkgs/pkgs/games/freeciv/default.nix
@@ -12,13 +12,13 @@ let
 
 in stdenv.mkDerivation rec {
   pname = "freeciv";
-  version = "2.6.2";
+  version = "2.6.2.1";
 
   src = fetchFromGitHub {
     owner = "freeciv";
     repo = "freeciv";
     rev = "R${builtins.replaceStrings [ "." ] [ "_" ] version}";
-    sha256 = "023slffi06j52amrnmd8n12rmf778cngxx6xg4hbsgckj2nyfmg9";
+    sha256 = "1nra6b6sk2gciaw1fpwx7qa20hky8cwcdwlshcl1zsikg577hyg5";
   };
 
   postPatch = ''
diff --git a/third_party/nixpkgs/pkgs/games/mindustry/default.nix b/third_party/nixpkgs/pkgs/games/mindustry/default.nix
index c0c8663868..89ff37458a 100644
--- a/third_party/nixpkgs/pkgs/games/mindustry/default.nix
+++ b/third_party/nixpkgs/pkgs/games/mindustry/default.nix
@@ -2,10 +2,11 @@
 , makeWrapper
 , makeDesktopItem
 , fetchFromGitHub
-, gradle_5
+, gradleGen
+, jdk14
 , perl
 , jre
-, libpulseaudio
+, alsaLib
 
 # Make the build version easily overridable.
 # Server and client build versions must match, and an empty build version means
@@ -21,14 +22,14 @@ let
   # Note: when raising the version, ensure that all SNAPSHOT versions in
   # build.gradle are replaced by a fixed version
   # (the current one at the time of release) (see postPatch).
-  version = "104.6";
+  version = "120.2";
   buildVersion = makeBuildVersion version;
 
   src = fetchFromGitHub {
     owner = "Anuken";
     repo = "Mindustry";
     rev = "v${version}";
-    sha256 = "1crdfiymaz57gnma6bmdcsnbl635nhjdndrjv467c4xfq9vvap2i";
+    sha256 = "01a7qpwfr1n540fk0k65kl03biix0gmg66z7qn22mb2703laq1xc";
   };
 
   desktopItem = makeDesktopItem {
@@ -49,11 +50,14 @@ let
     sed -i 's/com.github.anuken:packr:-SNAPSHOT/com.github.anuken:packr:034efe51781d2d8faa90370492133241bfb0283c/' build.gradle
   '';
 
+  # The default one still uses jdk8 (#89731)
+  gradle_6 = (gradleGen.override (old: { java = jdk14; })).gradle_6_7;
+
   # fake build to pre-download deps into fixed-output derivation
   deps = stdenv.mkDerivation {
     pname = "${pname}-deps";
     inherit version src postPatch;
-    nativeBuildInputs = [ gradle_5 perl ];
+    nativeBuildInputs = [ gradle_6 perl ];
     # Here we build both the server and the client so we only have to specify
     # one hash for 'deps'. Deps can be garbage collected after the build,
     # so this is not really an issue.
@@ -70,7 +74,7 @@ let
     '';
     outputHashAlgo = "sha256";
     outputHashMode = "recursive";
-    outputHash = "08yrczz1qn78qy3x67gs7d0xvihbfbb8ggiczq2nj812745zcizw";
+    outputHash = "1yv9l8zdml6drmvlgv45w3qas9qmb654x4kja3an4d16k020khr7";
   };
 
   # Separate commands for building and installing the server and the client
@@ -84,7 +88,7 @@ let
     install -Dm644 desktop/build/libs/Mindustry.jar $out/share/mindustry.jar
     mkdir -p $out/bin
     makeWrapper ${jre}/bin/java $out/bin/mindustry \
-      --prefix LD_LIBRARY_PATH : ${libpulseaudio}/lib \
+      ${stdenv.lib.optionalString stdenv.isLinux "--prefix LD_LIBRARY_PATH : ${alsaLib}/lib"} \
       --add-flags "-jar $out/share/mindustry.jar"
     install -Dm644 core/assets/icons/icon_64.png $out/share/icons/hicolor/64x64/apps/mindustry.png
     install -Dm644 ${desktopItem}/share/applications/Mindustry.desktop $out/share/applications/Mindustry.desktop
@@ -102,7 +106,7 @@ assert stdenv.lib.assertMsg (enableClient || enableServer)
 stdenv.mkDerivation rec {
   inherit pname version src postPatch;
 
-  nativeBuildInputs = [ gradle_5 makeWrapper ];
+  nativeBuildInputs = [ gradle_6 makeWrapper ];
 
   buildPhase = with stdenv.lib; ''
     export GRADLE_USER_HOME=$(mktemp -d)
@@ -124,6 +128,8 @@ stdenv.mkDerivation rec {
     license = licenses.gpl3;
     maintainers = with maintainers; [ fgaz ];
     platforms = platforms.all;
+    # Hash mismatch on darwin:
+    # https://github.com/NixOS/nixpkgs/pull/105590#issuecomment-737120293
+    broken = stdenv.isDarwin;
   };
 }
-
diff --git a/third_party/nixpkgs/pkgs/games/osu-lazer/default.nix b/third_party/nixpkgs/pkgs/games/osu-lazer/default.nix
index 88f0c6abfc..f41d684d83 100644
--- a/third_party/nixpkgs/pkgs/games/osu-lazer/default.nix
+++ b/third_party/nixpkgs/pkgs/games/osu-lazer/default.nix
@@ -13,13 +13,13 @@ let
 
 in stdenv.mkDerivation rec {
   pname = "osu-lazer";
-  version = "2020.1121.0";
+  version = "2020.1128.0";
 
   src = fetchFromGitHub {
     owner = "ppy";
     repo = "osu";
     rev = version;
-    sha256 = "54AP3NZv5Nov3CAJoxn5E5tO9HhtlEY36x8OHAV8YVE=";
+    sha256 = "0qf1lvzd668zd405ll3bdbk91xdyr2l9qg42ph93vjcnmrs2jqic";
   };
 
   patches = [ ./bypass-tamper-detection.patch ];
diff --git a/third_party/nixpkgs/pkgs/games/osu-lazer/deps.nix b/third_party/nixpkgs/pkgs/games/osu-lazer/deps.nix
index 42e5969dfc..4272a816a5 100644
--- a/third_party/nixpkgs/pkgs/games/osu-lazer/deps.nix
+++ b/third_party/nixpkgs/pkgs/games/osu-lazer/deps.nix
@@ -334,6 +334,11 @@
     version = "1.1.0";
     sha256 = "1dq5yw7cy6s42193yl4iqscfw5vzkjkgv0zyy32scr4jza6ni1a1";
   })
+  (fetchNuGet {
+    name = "Microsoft.Bcl.AsyncInterfaces";
+    version = "1.1.1";
+    sha256 = "0a1ahssqds2ympr7s4xcxv5y8jgxs7ahd6ah6fbgglj4rki1f1vw";
+  })
   (fetchNuGet {
     name = "Microsoft.Build.Framework";
     version = "15.3.409";
@@ -356,18 +361,18 @@
   })
   (fetchNuGet {
     name = "Microsoft.CodeAnalysis.Common";
-    version = "3.7.0";
-    sha256 = "0882492nx6x68b0pkh3q5xaawz0b2l5x35r40722ignyjnvjydph";
+    version = "3.8.0";
+    sha256 = "12n7rvr39bzkf2maw7zplw8rwpxpxss4ich3bb2pw770rx4nyvyw";
   })
   (fetchNuGet {
     name = "Microsoft.CodeAnalysis.CSharp";
-    version = "3.7.0";
-    sha256 = "0adw6rcag8wxydzyiyhls2mxaqkay5qlz25z1fxrlv5qnchqn0n5";
+    version = "3.8.0";
+    sha256 = "1kmry65csvfn72zzc16vj1nfbfwam28wcmlrk3m5rzb8ydbzgylb";
   })
   (fetchNuGet {
     name = "Microsoft.CodeAnalysis.CSharp.Workspaces";
-    version = "3.7.0";
-    sha256 = "15rlz65wbky0yq7b9s8xwk68dgrhgsk4rj88q9pyjxbm5938vrav";
+    version = "3.8.0";
+    sha256 = "1jfbqfngwwjx3x1cyqaamf26s7j6wag86ig1n7bh99ny85gd78wb";
   })
   (fetchNuGet {
     name = "Microsoft.CodeAnalysis.FxCopAnalyzers";
@@ -381,13 +386,13 @@
   })
   (fetchNuGet {
     name = "Microsoft.CodeAnalysis.Workspaces.Common";
-    version = "3.7.0";
-    sha256 = "00nm453w4n6kjsicmz5izvkf1ki9rp3xnc9n3y7a9b1g5sxg36fs";
+    version = "3.8.0";
+    sha256 = "0qbirv7wxllzw5120pfa42wailfgzvl10373yhacankmfmbz2gnw";
   })
   (fetchNuGet {
     name = "Microsoft.CodeAnalysis.Workspaces.MSBuild";
-    version = "3.7.0";
-    sha256 = "1sh8s7b16j06p3gmzsgwd8690vagah4908bpa3gyz2fxgfnj46ax";
+    version = "3.8.0";
+    sha256 = "1ag78ls51s88znv4v004sbklrx3qnbphpdngjq196188a3vljww7";
   })
   (fetchNuGet {
     name = "Microsoft.CodeQuality.Analyzers";
@@ -416,8 +421,8 @@
   })
   (fetchNuGet {
     name = "Microsoft.Diagnostics.Runtime";
-    version = "2.0.151903";
-    sha256 = "1y7hsgzjs6b3323fcq5km515knykfgvdx4x8l1g03sy5h3lwwhak";
+    version = "2.0.156101";
+    sha256 = "1k9f6x95mscq484f4sywpb84016v9yb9bz6ha77wsjbsarl96my0";
   })
   (fetchNuGet {
     name = "Microsoft.DotNet.PlatformAbstractions";
@@ -546,8 +551,8 @@
   })
   (fetchNuGet {
     name = "Microsoft.Extensions.ObjectPool";
-    version = "3.1.9";
-    sha256 = "1gq1i7rb50dzj9hp07q0w9siyqy3hl0zqpk8na37s4jq6ikb5q82";
+    version = "5.0.0";
+    sha256 = "0m0r7avz4ygxa1pyj5sai25y0n42y7kz9iznl7m3146csxi1paf0";
   })
   (fetchNuGet {
     name = "Microsoft.Extensions.Options";
@@ -676,8 +681,8 @@
   })
   (fetchNuGet {
     name = "ppy.osu.Framework";
-    version = "2020.1120.0";
-    sha256 = "13vm6qly09f9b9bnf8r4wkypbxz673x852fjllj33sz55qh6957m";
+    version = "2020.1127.0";
+    sha256 = "05vxdkw5z7bylj8dyw52lxf3g12mmvdifwvwlgz00v6ybkxr455j";
   })
   (fetchNuGet {
     name = "ppy.osu.Framework.NativeLibs";
@@ -954,6 +959,11 @@
     version = "1.7.1";
     sha256 = "1nh4nlxfc7lbnbl86wwk1a3jwl6myz5j6hvgh5sp4krim9901hsq";
   })
+  (fetchNuGet {
+    name = "System.Collections.Immutable";
+    version = "5.0.0";
+    sha256 = "1kvcllagxz2q92g81zkz81djkn2lid25ayjfgjalncyc68i15p0r";
+  })
   (fetchNuGet {
     name = "System.ComponentModel.Annotations";
     version = "4.5.0";
@@ -1301,13 +1311,13 @@
   })
   (fetchNuGet {
     name = "System.Reflection.Metadata";
-    version = "1.6.0";
-    sha256 = "1wdbavrrkajy7qbdblpbpbalbdl48q3h34cchz24gvdgyrlf15r4";
+    version = "1.8.1";
+    sha256 = "17xxl3m99wa4hcpqy42vl8qb1jk2jfq32rj3sfjc1a46hi2si5jj";
   })
   (fetchNuGet {
     name = "System.Reflection.Metadata";
-    version = "1.8.1";
-    sha256 = "17xxl3m99wa4hcpqy42vl8qb1jk2jfq32rj3sfjc1a46hi2si5jj";
+    version = "5.0.0";
+    sha256 = "17qsl5nanlqk9iz0l5wijdn6ka632fs1m1fvx18dfgswm258r3ss";
   })
   (fetchNuGet {
     name = "System.Reflection.Primitives";
@@ -1364,11 +1374,6 @@
     version = "4.5.3";
     sha256 = "1afi6s2r1mh1kygbjmfba6l4f87pi5sg13p4a48idqafli94qxln";
   })
-  (fetchNuGet {
-    name = "System.Runtime.CompilerServices.Unsafe";
-    version = "4.7.0";
-    sha256 = "16r6sn4czfjk8qhnz7bnqlyiaaszr0ihinb7mq9zzr1wba257r54";
-  })
   (fetchNuGet {
     name = "System.Runtime.CompilerServices.Unsafe";
     version = "4.7.1";
@@ -1594,11 +1599,6 @@
     version = "4.3.0";
     sha256 = "1xxcx2xh8jin360yjwm4x4cf5y3a2bwpn2ygkfkwkicz7zk50s2z";
   })
-  (fetchNuGet {
-    name = "System.Threading.Tasks.Extensions";
-    version = "4.5.3";
-    sha256 = "0g7r6hm572ax8v28axrdxz1gnsblg6kszq17g51pj14a5rn2af7i";
-  })
   (fetchNuGet {
     name = "System.Threading.Tasks.Extensions";
     version = "4.5.4";
diff --git a/third_party/nixpkgs/pkgs/misc/emulators/hatari/default.nix b/third_party/nixpkgs/pkgs/misc/emulators/hatari/default.nix
index db1a6664c5..03397bd244 100644
--- a/third_party/nixpkgs/pkgs/misc/emulators/hatari/default.nix
+++ b/third_party/nixpkgs/pkgs/misc/emulators/hatari/default.nix
@@ -1,11 +1,12 @@
 { stdenv, fetchurl, zlib, SDL, cmake }:
 
 stdenv.mkDerivation rec {
-  name = "hatari-2.2.1";
+  pname = "hatari";
+  version = "2.3.0";
 
   src = fetchurl {
-    url = "https://download.tuxfamily.org/hatari/2.2.1/${name}.tar.bz2";
-    sha256 = "0q3g23vnx58w666723v76ilh9j353md3sn48cmlq9gkll8qfzbqi";
+    url = "https://download.tuxfamily.org/hatari/${version}/${pname}-${version}.tar.bz2";
+    sha256 = "19dqadi32hgi78hyxxcm8v2vh28vyn9w5nd1xiq683wk0ccicj5z";
   };
 
   # For pthread_cancel
diff --git a/third_party/nixpkgs/pkgs/misc/emulators/lambda-delta/default.nix b/third_party/nixpkgs/pkgs/misc/emulators/lambda-delta/default.nix
new file mode 100644
index 0000000000..0668d2db90
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/misc/emulators/lambda-delta/default.nix
@@ -0,0 +1,26 @@
+{ stdenv, fetchFromGitHub, autoreconfHook, pkg-config, SDL2 }:
+
+stdenv.mkDerivation rec {
+  pname = "lambda-delta";
+  version = "0.98.3";
+
+  src = fetchFromGitHub {
+    owner = "dseagrav";
+    repo = "ld";
+    rev = version;
+    sha256 = "02m43fj9dzc1i1jl01qwnhjiq1rh03jw1xq59sx2h3bhn7dk941x";
+  };
+
+  nativeBuildInputs = [ autoreconfHook pkg-config ];
+  buildInputs = [ SDL2 ];
+
+  configureFlags = [ "--without-SDL1" ];
+
+  meta = with stdenv.lib; {
+    description = "LMI (Lambda Lisp Machine) emulator";
+    homepage = "https://github.com/dseagrav/ld";
+    license = licenses.gpl2;
+    maintainers = with maintainers; [ siraben ];
+    platforms = platforms.unix;
+  };
+}
diff --git a/third_party/nixpkgs/pkgs/misc/emulators/ruffle/default.nix b/third_party/nixpkgs/pkgs/misc/emulators/ruffle/default.nix
new file mode 100644
index 0000000000..f3518a647f
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/misc/emulators/ruffle/default.nix
@@ -0,0 +1,49 @@
+{ alsaLib
+, fetchFromGitHub
+, openssl
+, pkg-config
+, python3
+, rustPlatform
+, stdenv
+, wayland
+, xorg
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "ruffle";
+  version = "nightly-2020-11-30";
+
+  src = fetchFromGitHub {
+    owner = "ruffle-rs";
+    repo = pname;
+    rev = version;
+    sha256 = "0z54swzy47laq3smficd3dyrs2zdi3cj2kb0b4hppjxpkkhiw4x0";
+  };
+
+  nativeBuildInputs = [
+    pkg-config
+    python3
+  ];
+
+  buildInputs = [
+    alsaLib
+    openssl
+    wayland
+    xorg.libX11
+    xorg.libXcursor
+    xorg.libXrandr
+    xorg.libXi
+    xorg.libxcb
+    xorg.libXrender
+  ];
+
+  cargoSha256 = "05kwfcbzjyyfhiqklhhlv06pinzw9bry4j8l9lk3k04c1q30gzkw";
+
+  meta = with stdenv.lib; {
+    description = "An Adobe Flash Player emulator written in the Rust programming language.";
+    homepage = "https://ruffle.rs/";
+    license = with licenses; [ mit asl20 ];
+    maintainers = with maintainers; [ govanify ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/third_party/nixpkgs/pkgs/misc/tmux-plugins/default.nix b/third_party/nixpkgs/pkgs/misc/tmux-plugins/default.nix
index de3c78cc52..28ac5e6f91 100644
--- a/third_party/nixpkgs/pkgs/misc/tmux-plugins/default.nix
+++ b/third_party/nixpkgs/pkgs/misc/tmux-plugins/default.nix
@@ -127,6 +127,24 @@ in rec {
     };
   };
 
+  dracula = mkDerivation rec {
+    pluginName = "dracula";
+    version = "unstable-2020-12-2";
+    src = fetchFromGitHub {
+      owner = "dracula";
+      repo = "tmux";
+      rev = "cc310e585acbeaf3304eda662476f7f657010b01";
+      sha256 = "003nbv2rz2ihyqf3ryvdwn43ly0gi5z2r0pnqr9s9vw8dmwx0r3x";
+    };
+    meta = with stdenv.lib; {
+      homepage = "https://draculatheme.com/tmux";
+      description = "A feature packed Dracula theme for tmux!";
+      license = licenses.mit;
+      platforms = platforms.unix;
+      maintainers = with maintainers; [ ethancedwards8 ];
+    };
+  };
+
   fingers = mkDerivation rec {
     pluginName = "fingers";
     rtpFilePath = "tmux-fingers.tmux";
@@ -427,6 +445,41 @@ in rec {
     };
   };
 
+  tmux-fzf = mkDerivation {
+    pluginName = "tmux-fzf";
+    version = "unstable-2020-11-23";
+    src = fetchFromGitHub {
+      owner = "sainnhe";
+      repo = "tmux-fzf";
+      rev = "312685b2a7747b61f1f4a96bd807819f1450479d";
+      sha256 = "1z0zmsf8asxs9wbwvkiyd81h93wb2ikl8nxxc26sdpi6l333q5s9";
+    };
+    postInstall = ''
+      find $target -type f -print0 | xargs -0 sed -i -e 's|fzf |${pkgs.fzf}/bin/fzf |g'
+      find $target -type f -print0 | xargs -0 sed -i -e 's|sed |${pkgs.gnused}/bin/sed |g'
+      find $target -type f -print0 | xargs -0 sed -i -e 's|tput |${pkgs.ncurses}/bin/tput |g'
+    '';
+     meta = {
+      homepage = "https://github.com/sainnhe/tmux-fzf";
+      description = "Use fzf to manage your tmux work environment! ";
+      longDescription =
+        ''
+        Features:
+        * Manage sessions (attach, detach*, rename, kill*).
+        * Manage windows (switch, link, move, swap, rename, kill*).
+        * Manage panes (switch, break, join*, swap, layout, kill*, resize).
+        * Multiple selection (support for actions marked by *).
+        * Search commands and append to command prompt.
+        * Search key bindings and execute.
+        * User menu.
+        * Popup window support.
+      '';
+      license = stdenv.lib.licenses.mit;
+      platforms = stdenv.lib.platforms.unix;
+      maintainers = with stdenv.lib.maintainers; [ kyleondy ];
+    };
+  };
+
   urlview = mkDerivation {
     pluginName = "urlview";
     version = "unstable-2016-01-06";
diff --git a/third_party/nixpkgs/pkgs/misc/tpm2-pkcs11/default.nix b/third_party/nixpkgs/pkgs/misc/tpm2-pkcs11/default.nix
index 7533707ccf..610a8e0638 100644
--- a/third_party/nixpkgs/pkgs/misc/tpm2-pkcs11/default.nix
+++ b/third_party/nixpkgs/pkgs/misc/tpm2-pkcs11/default.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "tpm2-pkcs11";
-  version = "1.3.0";
+  version = "1.5.0";
 
   src = fetchFromGitHub {
     owner = "tpm2-software";
     repo = pname;
     rev = version;
-    sha256 = "12zj8jfm8jrwbqm3cnay8gx28ladmpyv5d29lp8qlfjqgflvhkwh";
+    sha256 = "0sm73a762c7qd6x3f052m00d7daprifimsfa17dfdf4jvy9fqy56";
   };
 
   patches = lib.singleton (
diff --git a/third_party/nixpkgs/pkgs/misc/vscode-extensions/default.nix b/third_party/nixpkgs/pkgs/misc/vscode-extensions/default.nix
index bc00f82f19..b80fcb25a8 100644
--- a/third_party/nixpkgs/pkgs/misc/vscode-extensions/default.nix
+++ b/third_party/nixpkgs/pkgs/misc/vscode-extensions/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, config, lib, callPackage, vscode-utils, llvmPackages_8, llvmPackages_latest }:
+{ stdenv, config, lib, callPackage, vscode-utils, nodePackages,llvmPackages_8, llvmPackages_latest }:
 
 let
   inherit (vscode-utils) buildVscodeMarketplaceExtension;
@@ -25,6 +25,21 @@ let
         };
       };
 
+      ms-python.vscode-pylance = buildVscodeMarketplaceExtension {
+        mktplcRef = {
+          name = "vscode-pylance";
+          publisher = "MS-python";
+          version = "2020.11.2";
+          sha256 = "0n2dm21vgzir3hx1m3pmx7jq4zy3hdxfsandd2wv5da4fs9b5g50";
+        };
+
+        buildInputs = [ nodePackages.pyright ];
+
+        meta = {
+          license = stdenv.lib.licenses.unfree;
+        };
+      };
+
       bbenoist.Nix = buildVscodeMarketplaceExtension {
         mktplcRef = {
           name = "Nix";
diff --git a/third_party/nixpkgs/pkgs/os-specific/linux/ell/default.nix b/third_party/nixpkgs/pkgs/os-specific/linux/ell/default.nix
index 9faeb831b4..21f98889ca 100644
--- a/third_party/nixpkgs/pkgs/os-specific/linux/ell/default.nix
+++ b/third_party/nixpkgs/pkgs/os-specific/linux/ell/default.nix
@@ -7,14 +7,14 @@
 
 stdenv.mkDerivation rec {
   pname = "ell";
-  version = "0.33";
+  version = "0.35";
 
   outputs = [ "out" "dev" ];
 
   src = fetchgit {
      url = "https://git.kernel.org/pub/scm/libs/${pname}/${pname}.git";
      rev = version;
-     sha256 = "0li788l57m2ic1i33fag4nnblqghbwqjyqkgppi8s2sifcvswfbw";
+     sha256 = "16z7xwlrpx1bsr2y1rgxxxixzwc84cwn2g557iqxhwsxfzy6q3dk";
   };
 
   patches = [
diff --git a/third_party/nixpkgs/pkgs/os-specific/linux/firmware/sof-firmware/default.nix b/third_party/nixpkgs/pkgs/os-specific/linux/firmware/sof-firmware/default.nix
index a9fc44e48c..684d638ce2 100644
--- a/third_party/nixpkgs/pkgs/os-specific/linux/firmware/sof-firmware/default.nix
+++ b/third_party/nixpkgs/pkgs/os-specific/linux/firmware/sof-firmware/default.nix
@@ -3,24 +3,22 @@
 with stdenv.lib;
 stdenv.mkDerivation rec {
   pname = "sof-firmware";
-  version = "1.5.1";
+  version = "1.6";
 
   src = fetchFromGitHub {
     owner = "thesofproject";
     repo = "sof-bin";
-    rev = "ae61d2778b0a0f47461a52da0d1f191f651e0763";
-    sha256 = "0j6bpwz49skvdvian46valjw4anwlrnkq703n0snkbngmq78prba";
+    rev = "cbdec6963b2c2d58b0080955d3c11b96ff4c92f0";
+    sha256 = "0la2pw1zpv50cywiqcfb00cxqvjc73drxwjchyzi54l508817nxh";
   };
 
   phases = [ "unpackPhase" "installPhase" ];
 
   installPhase = ''
-    mkdir -p $out/lib/firmware/intel
+    mkdir -p $out/lib/firmware
 
-    sed -i 's/ROOT=.*$/ROOT=$out/g' go.sh
-    sed -i 's/VERSION=.*$/VERSION=v${version}/g' go.sh
-
-    ./go.sh
+    patchShebangs go.sh
+    ROOT=$out SOF_VERSION=v${version} ./go.sh
   '';
 
   meta = with stdenv.lib; {
diff --git a/third_party/nixpkgs/pkgs/os-specific/linux/iwd/default.nix b/third_party/nixpkgs/pkgs/os-specific/linux/iwd/default.nix
index adf37a1b71..8ae600e310 100644
--- a/third_party/nixpkgs/pkgs/os-specific/linux/iwd/default.nix
+++ b/third_party/nixpkgs/pkgs/os-specific/linux/iwd/default.nix
@@ -13,12 +13,12 @@
 
 stdenv.mkDerivation rec {
   pname = "iwd";
-  version = "1.9";
+  version = "1.10";
 
   src = fetchgit {
     url = "https://git.kernel.org/pub/scm/network/wireless/iwd.git";
     rev = version;
-    sha256 = "193wa13i2prfz1zr7nvwbgrxgacms57zj1n7x28yy5hmm3nnwbrd";
+    sha256 = "0gzpdgfwzlqj2n3amf2zhi2hlpa412878yphgx79y6b5gn1y1lm2";
   };
 
   outputs = [ "out" "man" ];
diff --git a/third_party/nixpkgs/pkgs/os-specific/linux/kernel-headers/default.nix b/third_party/nixpkgs/pkgs/os-specific/linux/kernel-headers/default.nix
index 59656f54db..284ef472d0 100644
--- a/third_party/nixpkgs/pkgs/os-specific/linux/kernel-headers/default.nix
+++ b/third_party/nixpkgs/pkgs/os-specific/linux/kernel-headers/default.nix
@@ -69,12 +69,12 @@ let
 in {
   inherit makeLinuxHeaders;
 
-  linuxHeaders = let version = "5.5"; in
+  linuxHeaders = let version = "5.9.8"; in
     makeLinuxHeaders {
       inherit version;
       src = fetchurl {
         url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-        sha256 = "0c131fi6s7vgvka1c0597vnvcmwn1pp968rci5kq64iwj3pd9yx6";
+        sha256 = "19l67gzk97higd2cbggipcb0wi21pv0ag0mc4qh6cqk564xp6mkn";
       };
       patches = [
          ./no-relocs.patch # for building x86 kernel headers on non-ELF platforms
diff --git a/third_party/nixpkgs/pkgs/os-specific/linux/kernel/linux-4.14.nix b/third_party/nixpkgs/pkgs/os-specific/linux/kernel/linux-4.14.nix
index 5a19e8d3cc..26694d965e 100644
--- a/third_party/nixpkgs/pkgs/os-specific/linux/kernel/linux-4.14.nix
+++ b/third_party/nixpkgs/pkgs/os-specific/linux/kernel/linux-4.14.nix
@@ -3,7 +3,7 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "4.14.209";
+  version = "4.14.210";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "171b31c4rz9sn95s4s4yqchd4s46kivmvch78z0jr5zir1f4c0nb";
+    sha256 = "067xqi6sgf50p7s3n6y77cgf5bj5062s3bz3kqpp6f9wnk85267r";
   };
 } // (args.argsOverride or {}))
diff --git a/third_party/nixpkgs/pkgs/os-specific/linux/kernel/linux-4.19.nix b/third_party/nixpkgs/pkgs/os-specific/linux/kernel/linux-4.19.nix
index 7b01bdd8c6..15a5e1972a 100644
--- a/third_party/nixpkgs/pkgs/os-specific/linux/kernel/linux-4.19.nix
+++ b/third_party/nixpkgs/pkgs/os-specific/linux/kernel/linux-4.19.nix
@@ -3,7 +3,7 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "4.19.160";
+  version = "4.19.161";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "118maapizgqgrgawnw7xmbcz26c61g5d012jzbd8l7n6z4354d0q";
+    sha256 = "0h9wskmz9wridwnicnjlcmj1112qnlvqk01bhjkxv6b8jsajjh87";
   };
 } // (args.argsOverride or {}))
diff --git a/third_party/nixpkgs/pkgs/os-specific/linux/kernel/linux-4.4.nix b/third_party/nixpkgs/pkgs/os-specific/linux/kernel/linux-4.4.nix
index d679969d58..599d686362 100644
--- a/third_party/nixpkgs/pkgs/os-specific/linux/kernel/linux-4.4.nix
+++ b/third_party/nixpkgs/pkgs/os-specific/linux/kernel/linux-4.4.nix
@@ -1,11 +1,11 @@
 { stdenv, buildPackages, fetchurl, perl, buildLinux, ... } @ args:
 
 buildLinux (args // rec {
-  version = "4.4.246";
+  version = "4.4.247";
   extraMeta.branch = "4.4";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "15xd1dqw53kwqvsa71nr1ymp0jp22pkl4h2yks4hqbd132zxw2wy";
+    sha256 = "1jh7vmyx55krk6y2r9v48liifs5wwkgns3gp8rs5sm4klfm36r2a";
   };
 } // (args.argsOverride or {}))
diff --git a/third_party/nixpkgs/pkgs/os-specific/linux/kernel/linux-4.9.nix b/third_party/nixpkgs/pkgs/os-specific/linux/kernel/linux-4.9.nix
index c5216f2c80..9169506536 100644
--- a/third_party/nixpkgs/pkgs/os-specific/linux/kernel/linux-4.9.nix
+++ b/third_party/nixpkgs/pkgs/os-specific/linux/kernel/linux-4.9.nix
@@ -1,11 +1,11 @@
 { stdenv, buildPackages, fetchurl, perl, buildLinux, ... } @ args:
 
 buildLinux (args // rec {
-  version = "4.9.246";
+  version = "4.9.247";
   extraMeta.branch = "4.9";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "1xd9vgc4yj2vrr5r76cy3fp9a1fc3086lj5aws68wf1dsz3ndqj9";
+    sha256 = "1mngdbsq8pdzd0x9hif4715cc7wzc3ahgp1yrknnqk598q0fnfpp";
   };
 } // (args.argsOverride or {}))
diff --git a/third_party/nixpkgs/pkgs/os-specific/linux/kernel/linux-5.4.nix b/third_party/nixpkgs/pkgs/os-specific/linux/kernel/linux-5.4.nix
index 0b19291a76..8453ec0c6c 100644
--- a/third_party/nixpkgs/pkgs/os-specific/linux/kernel/linux-5.4.nix
+++ b/third_party/nixpkgs/pkgs/os-specific/linux/kernel/linux-5.4.nix
@@ -3,7 +3,7 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "5.4.80";
+  version = "5.4.81";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "1iv4rsc9mr13xqzayzwz8mpdrdpnc425mn1izz9hylrw3xf45nj9";
+    sha256 = "09w4bpr3v9rzcvxics5wddabplwbpk1mynl45lh9csbjfpjbsw4l";
   };
 } // (args.argsOverride or {}))
diff --git a/third_party/nixpkgs/pkgs/os-specific/linux/kernel/linux-5.9.nix b/third_party/nixpkgs/pkgs/os-specific/linux/kernel/linux-5.9.nix
index c32ee2844f..e71044b0d9 100644
--- a/third_party/nixpkgs/pkgs/os-specific/linux/kernel/linux-5.9.nix
+++ b/third_party/nixpkgs/pkgs/os-specific/linux/kernel/linux-5.9.nix
@@ -3,7 +3,7 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "5.9.11";
+  version = "5.9.12";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "0q6jlnigyjjnnxw6l724zv8acgs95s3pafabz4l9jrhhlijhmcjy";
+    sha256 = "1gfrn3sz3h4cbsf3r8f9jxja400qsmbrk8sclk4cjx1l5qcmczyr";
   };
 } // (args.argsOverride or {}))
diff --git a/third_party/nixpkgs/pkgs/os-specific/linux/kernel/linux-testing.nix b/third_party/nixpkgs/pkgs/os-specific/linux/kernel/linux-testing.nix
index 50c69deeb0..5bf74ffd37 100644
--- a/third_party/nixpkgs/pkgs/os-specific/linux/kernel/linux-testing.nix
+++ b/third_party/nixpkgs/pkgs/os-specific/linux/kernel/linux-testing.nix
@@ -3,7 +3,7 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "5.10-rc5";
+  version = "5.10-rc6";
   extraMeta.branch = "5.10";
 
   # modDirVersion needs to be x.y.z, will always add .0
@@ -11,7 +11,7 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "https://git.kernel.org/torvalds/t/linux-${version}.tar.gz";
-    sha256 = "117yvvzdbf8garx484zdp75qgldj8xhr2sqk6mza6lgv4h7v3f4g";
+    sha256 = "14ykzs98r918sqv7lddlps4r7hza1zgw0x67mmj77cmqiv6d8ffi";
   };
 
   # Should the testing kernels ever be built on Hydra?
diff --git a/third_party/nixpkgs/pkgs/os-specific/linux/libselinux/default.nix b/third_party/nixpkgs/pkgs/os-specific/linux/libselinux/default.nix
index 741c51e223..4dfd6a3f2c 100644
--- a/third_party/nixpkgs/pkgs/os-specific/linux/libselinux/default.nix
+++ b/third_party/nixpkgs/pkgs/os-specific/linux/libselinux/default.nix
@@ -1,26 +1,26 @@
 { stdenv, fetchurl, pcre, pkgconfig, libsepol
-, enablePython ? true, swig ? null, python ? null
+, enablePython ? true, swig ? null, python3 ? null
 , fts
 }:
 
-assert enablePython -> swig != null && python != null;
+assert enablePython -> swig != null && python3 != null;
 
 with stdenv.lib;
 
 stdenv.mkDerivation rec {
   pname = "libselinux";
-  version = "2.9";
+  version = "3.0";
   inherit (libsepol) se_release se_url;
 
   outputs = [ "bin" "out" "dev" "man" ] ++ optional enablePython "py";
 
   src = fetchurl {
     url = "${se_url}/${se_release}/libselinux-${version}.tar.gz";
-    sha256 = "14r69mgmz7najf9wbizvp68q56mqx4yjbkxjlbcqg5a47s3wik0v";
+    sha256 = "0cr4p0qkr4qd5z1x677vwhz6mlz55kxyijwi2dmrvbhxcw7v78if";
   };
 
-  nativeBuildInputs = [ pkgconfig ] ++ optionals enablePython [ swig python ];
-  buildInputs = [ libsepol pcre fts ] ++ optionals enablePython [ python ];
+  nativeBuildInputs = [ pkgconfig ] ++ optionals enablePython [ swig python3 ];
+  buildInputs = [ libsepol pcre fts ] ++ optionals enablePython [ python3 ];
 
   # drop fortify here since package uses it by default, leading to compile error:
   # command-line>:0:0: error: "_FORTIFY_SOURCE" redefined [-Werror]
@@ -35,14 +35,18 @@ stdenv.mkDerivation rec {
     "MAN3DIR=$(man)/share/man/man3"
     "MAN5DIR=$(man)/share/man/man5"
     "MAN8DIR=$(man)/share/man/man8"
-    "PYTHON=${python.pythonForBuild}/bin/python"
-    "PYTHONLIBDIR=$(py)/${python.sitePackages}"
+    "PYTHON=${python3.pythonForBuild}/bin/python"
+    "PYTHONLIBDIR=$(py)/${python3.sitePackages}"
     "SBINDIR=$(bin)/sbin"
     "SHLIBDIR=$(out)/lib"
 
     "LIBSEPOLA=${stdenv.lib.getLib libsepol}/lib/libsepol.a"
   ];
 
+  preInstall = ''
+    mkdir -p $py/${python3.sitePackages}/selinux
+  '';
+
   installTargets = [ "install" ] ++ optional enablePython "install-pywrap";
 
   meta = removeAttrs libsepol.meta ["outputsToInstall"] // {
diff --git a/third_party/nixpkgs/pkgs/os-specific/linux/libsepol/default.nix b/third_party/nixpkgs/pkgs/os-specific/linux/libsepol/default.nix
index 497961af11..3592ba1637 100644
--- a/third_party/nixpkgs/pkgs/os-specific/linux/libsepol/default.nix
+++ b/third_party/nixpkgs/pkgs/os-specific/linux/libsepol/default.nix
@@ -2,15 +2,15 @@
 
 stdenv.mkDerivation rec {
   pname = "libsepol";
-  version = "2.9";
-  se_release = "20190315";
+  version = "3.0";
+  se_release = "20191204";
   se_url = "https://github.com/SELinuxProject/selinux/releases/download";
 
   outputs = [ "bin" "out" "dev" "man" ];
 
   src = fetchurl {
     url = "${se_url}/${se_release}/libsepol-${version}.tar.gz";
-    sha256 = "0p8x7w73jn1nysx1d7416wqrhbi0r6isrjxib7jf68fi72q14jx3";
+    sha256 = "0ygb6dh5lng91xs6xiqf5v0nxa68qmjc787p0s5h9w89364f2yjv";
   };
 
   nativeBuildInputs = [ flex ];
diff --git a/third_party/nixpkgs/pkgs/os-specific/linux/musl/default.nix b/third_party/nixpkgs/pkgs/os-specific/linux/musl/default.nix
index 67d08454a8..acc9fff5b4 100644
--- a/third_party/nixpkgs/pkgs/os-specific/linux/musl/default.nix
+++ b/third_party/nixpkgs/pkgs/os-specific/linux/musl/default.nix
@@ -62,6 +62,12 @@ stdenv.mkDerivation rec {
       url = "https://raw.githubusercontent.com/openwrt/openwrt/87606e25afac6776d1bbc67ed284434ec5a832b4/toolchain/musl/patches/300-relative.patch";
       sha256 = "0hfadrycb60sm6hb6by4ycgaqc9sgrhh42k39v8xpmcvdzxrsq2n";
     })
+    # wcsnrtombs destination buffer overflow, remove >= 1.2.2
+    (fetchurl {
+      name = "CVE-2020-28928.patch";
+      url = "https://www.openwall.com/lists/oss-security/2020/11/20/4/1";
+      sha256 = "077n2p165504nz9di6n8y5421591r3lsbcxgih8z26l6mvkhcs2h";
+    })
   ];
   CFLAGS = [ "-fstack-protector-strong" ]
     ++ lib.optional stdenv.hostPlatform.isPower "-mlong-double-64";
diff --git a/third_party/nixpkgs/pkgs/os-specific/linux/nvidia-x11/default.nix b/third_party/nixpkgs/pkgs/os-specific/linux/nvidia-x11/default.nix
index 5fc60b404d..b16dd3997f 100644
--- a/third_party/nixpkgs/pkgs/os-specific/linux/nvidia-x11/default.nix
+++ b/third_party/nixpkgs/pkgs/os-specific/linux/nvidia-x11/default.nix
@@ -22,10 +22,10 @@ rec {
   # Policy: use the highest stable version as the default (on our master).
   stable = if stdenv.hostPlatform.system == "x86_64-linux"
     then generic {
-      version = "455.38";
-      sha256_64bit = "0x6w2kcjm5q9z9l6rkxqabway4qq4h3ynngn36i8ky2dpxc1wzfq";
-      settingsSha256 = "1hk4yvbb7xhfwm8jiwq6fj5m7vg3w7yvgglhfyhq7bbrlklfb4hm";
-      persistencedSha256 = "00mmazv8sy93jvp60v7p954n250f4q3kxc13l4f8fmi28lgv0844";
+      version = "455.45.01";
+      sha256_64bit = "6tyMfggvZVQPp/aiSdgwn7VG/mIGb0lUcnAdyMEDoVM=";
+      settingsSha256 = "70ABqnO/heCp/5IztpU0Lo7eZd4n4wUoTlp1xIQ3aCc=";
+      persistencedSha256 = "36sM+djZvm77Gle7dcZ5tppgzQkD4IA0FJgCGsdZRI8=";
     }
     else legacy_390;
 
diff --git a/third_party/nixpkgs/pkgs/os-specific/linux/pcm/default.nix b/third_party/nixpkgs/pkgs/os-specific/linux/pcm/default.nix
index 74042cf702..66f5dcf338 100644
--- a/third_party/nixpkgs/pkgs/os-specific/linux/pcm/default.nix
+++ b/third_party/nixpkgs/pkgs/os-specific/linux/pcm/default.nix
@@ -1,14 +1,14 @@
 { stdenv, fetchFromGitHub }:
 
 stdenv.mkDerivation rec {
-  version = "202010";
+  version = "202011";
   pname = "pcm";
 
   src = fetchFromGitHub {
     owner = "opcm";
     repo = "pcm";
     rev = version;
-    sha256 = "00i7bp7hqwnphh7qyjydvz5s14ydj8rwivz995bdnd37582dyij9";
+    sha256 = "09p8drp9xvvs5bahgnr9xx6987fryz27xs2zaf1mr7a9wsh5j912";
   };
 
   installPhase = ''
diff --git a/third_party/nixpkgs/pkgs/os-specific/linux/systemd/default.nix b/third_party/nixpkgs/pkgs/os-specific/linux/systemd/default.nix
index 478791bded..f7a51ff9a0 100644
--- a/third_party/nixpkgs/pkgs/os-specific/linux/systemd/default.nix
+++ b/third_party/nixpkgs/pkgs/os-specific/linux/systemd/default.nix
@@ -282,9 +282,9 @@ stdenv.mkDerivation {
     "-Dmount-path=${util-linux}/bin/mount"
     "-Dumount-path=${util-linux}/bin/umount"
     "-Dcreate-log-dirs=false"
-    # Upstream uses cgroupsv2 by default. To support docker and other
-    # container managers we still need v1.
-    "-Ddefault-hierarchy=hybrid"
+
+    # Use cgroupsv2. This is already the upstream default, but better be explicit.
+    "-Ddefault-hierarchy=unified"
     # Upstream defaulted to disable manpages since they optimize for the much
     # more frequent development builds
     "-Dman=true"
diff --git a/third_party/nixpkgs/pkgs/os-specific/linux/zfs/default.nix b/third_party/nixpkgs/pkgs/os-specific/linux/zfs/default.nix
index 5406dcf77e..a83e554b6f 100644
--- a/third_party/nixpkgs/pkgs/os-specific/linux/zfs/default.nix
+++ b/third_party/nixpkgs/pkgs/os-specific/linux/zfs/default.nix
@@ -49,13 +49,11 @@ let
         patchShebangs scripts
         # The arrays must remain the same length, so we repeat a flag that is
         # already part of the command and therefore has no effect.
-        substituteInPlace ./module/${optionalString isUnstable "os/linux/"}zfs/zfs_ctldir.c \
+        substituteInPlace ./module/os/linux/zfs/zfs_ctldir.c \
           --replace '"/usr/bin/env", "umount"' '"${util-linux}/bin/umount", "-n"' \
           --replace '"/usr/bin/env", "mount"'  '"${util-linux}/bin/mount", "-n"'
       '' + optionalString buildUser ''
-        substituteInPlace ./lib/libzfs/libzfs_mount.c --replace "/bin/umount"             "${util-linux}/bin/umount" \
-                                                      --replace "/bin/mount"              "${util-linux}/bin/mount"
-        substituteInPlace ./lib/libshare/${optionalString isUnstable "os/linux/"}nfs.c --replace "/usr/sbin/exportfs" "${
+        substituteInPlace ./lib/libshare/os/linux/nfs.c --replace "/usr/sbin/exportfs" "${
           # We don't *need* python support, but we set it like this to minimize closure size:
           # If it's disabled by default, no need to enable it, even if we have python enabled
           # And if it's enabled by default, only change that if we explicitly disable python to remove python from the closure
@@ -65,7 +63,6 @@ let
         substituteInPlace ./config/zfs-build.m4       --replace "\$sysconfdir/init.d"     "$out/etc/init.d" \
                                                       --replace "/etc/default"            "$out/etc/default"
         substituteInPlace ./etc/zfs/Makefile.am       --replace "\$(sysconfdir)"          "$out/etc"
-        substituteInPlace ./cmd/zed/Makefile.am       --replace "\$(sysconfdir)"          "$out/etc"
 
         substituteInPlace ./contrib/initramfs/hooks/Makefile.am \
           --replace "/usr/share/initramfs-tools/hooks" "$out/usr/share/initramfs-tools/hooks"
@@ -82,15 +79,10 @@ let
         substituteInPlace ./etc/systemd/system/Makefile.am \
           --replace '$(DESTDIR)$(systemdunitdir)' "$out"'$(DESTDIR)$(systemdunitdir)'
 
-        ${optionalString isUnstable ''
         substituteInPlace ./contrib/initramfs/conf.d/Makefile.am \
           --replace "/usr/share/initramfs-tools/conf.d" "$out/usr/share/initramfs-tools/conf.d"
         substituteInPlace ./contrib/initramfs/conf-hooks.d/Makefile.am \
           --replace "/usr/share/initramfs-tools/conf-hooks.d" "$out/usr/share/initramfs-tools/conf-hooks.d"
-        ''}
-
-        substituteInPlace ./etc/systemd/system/zfs-share.service.in \
-          --replace "/bin/rm " "${coreutils}/bin/rm "
 
         substituteInPlace ./cmd/vdev_id/vdev_id \
           --replace "PATH=/bin:/sbin:/usr/bin:/usr/sbin" \
@@ -178,10 +170,10 @@ let
           Copy-On-Write filesystem with data integrity detection and repair,
           snapshotting, cloning, block devices, deduplication, and more.
         '';
-        homepage = "https://zfsonlinux.org/";
+        homepage = "https://github.com/openzfs/zfs";
         license = licenses.cddl;
         platforms = platforms.linux;
-        maintainers = with maintainers; [ jcumming wizeman fpletz globin ];
+        maintainers = with maintainers; [ hmenke jcumming jonringer wizeman fpletz globin mic92 ];
       };
     };
 in {
@@ -193,9 +185,9 @@ in {
     # incompatibleKernelVersion = "4.20";
 
     # this package should point to the latest release.
-    version = "0.8.5";
+    version = "2.0.0";
 
-    sha256 = "0vhd3zs2i83pd59nk0llml4vyk4fc178j6nhg00p6k3f6r0l655b";
+    sha256 = "1kriz6pg8wj98izvjc60wp23lgcp4k3mzhpkgj74np73rzgy6v8r";
   };
 
   zfsUnstable = common {
@@ -203,9 +195,8 @@ in {
     # incompatibleKernelVersion = "4.19";
 
     # this package should point to a version / git revision compatible with the latest kernel release
-    version = "2.0.0-rc6";
+    version = "2.0.0";
 
-    sha256 = "0p027x9hsawniwa9h3yayfbcx010anwcfy45rqgkg2r91zr2nfvw";
-    isUnstable = true;
+    sha256 = "1kriz6pg8wj98izvjc60wp23lgcp4k3mzhpkgj74np73rzgy6v8r";
   };
 }
diff --git a/third_party/nixpkgs/pkgs/servers/consul/default.nix b/third_party/nixpkgs/pkgs/servers/consul/default.nix
index eef9054ae7..81cd2db7bd 100644
--- a/third_party/nixpkgs/pkgs/servers/consul/default.nix
+++ b/third_party/nixpkgs/pkgs/servers/consul/default.nix
@@ -2,7 +2,7 @@
 
 buildGoModule rec {
   pname = "consul";
-  version = "1.8.6";
+  version = "1.9.0";
   rev = "v${version}";
 
   # Note: Currently only release tags are supported, because they have the Consul UI
@@ -17,7 +17,7 @@ buildGoModule rec {
     owner = "hashicorp";
     repo = pname;
     inherit rev;
-    sha256 = "1jrvh4khxr12dzmsyfn8ch26rlk4cd65fqafsr7prjjbbjnpmgck";
+    sha256 = "06brmzj3h6my0pvi5n261180bfwgfn923702837jmkz7snpsdr9q";
   };
 
   passthru.tests.consul = nixosTests.consul;
@@ -26,7 +26,7 @@ buildGoModule rec {
   # has a split module structure in one repo
   subPackages = ["." "connect/certgen"];
 
-  vendorSha256 = "1zz3hhngvx7989m73cp5a9j6spg42hgqd9vs8v332fvcr277lyxj";
+  vendorSha256 = "1mc567zgymfz8iy6bg603f857c05xfna1npk2hh490dsnskkfag0";
 
   doCheck = false;
 
diff --git a/third_party/nixpkgs/pkgs/servers/documize-community/default.nix b/third_party/nixpkgs/pkgs/servers/documize-community/default.nix
index 29ad2ef917..5c6b6b1070 100644
--- a/third_party/nixpkgs/pkgs/servers/documize-community/default.nix
+++ b/third_party/nixpkgs/pkgs/servers/documize-community/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "documize-community";
-  version = "3.8.1";
+  version = "3.8.2";
 
   src = fetchFromGitHub {
     owner = "documize";
     repo = "community";
-    rev = "30d12ba756101a3d360e874cc8fad2a53ec558ed";
-    sha256 = "sha256-URQtOXwMavPD9/9n2YO1Z9Rg/i26gYb53OC8WEpbelk=";
+    rev = "v${version}";
+    sha256 = "sha256-6DOvInfD32/mEILGXdXUeflmHoyn0eiYyQN/aI23FJ0=";
   };
 
   vendorSha256 = null;
diff --git a/third_party/nixpkgs/pkgs/servers/gotify/default.nix b/third_party/nixpkgs/pkgs/servers/gotify/default.nix
index 924625ebd7..a7fb1d0e7e 100644
--- a/third_party/nixpkgs/pkgs/servers/gotify/default.nix
+++ b/third_party/nixpkgs/pkgs/servers/gotify/default.nix
@@ -20,6 +20,12 @@ buildGoModule rec {
     sha256 = import ./source-sha.nix;
   };
 
+  # With `allowGoReference = true;`, `buildGoModule` adds the `-trimpath`
+  # argument for Go builds which apparently breaks the UI like this:
+  #
+  #   server[780]: stat /var/lib/private/ui/build/index.html: no such file or directory
+  allowGoReference = true;
+
   vendorSha256 = import ./vendor-sha.nix;
 
   doCheck = false;
diff --git a/third_party/nixpkgs/pkgs/servers/http/gitlab-pages/default.nix b/third_party/nixpkgs/pkgs/servers/http/gitlab-pages/default.nix
index bef6744d13..0174f8af43 100644
--- a/third_party/nixpkgs/pkgs/servers/http/gitlab-pages/default.nix
+++ b/third_party/nixpkgs/pkgs/servers/http/gitlab-pages/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "gitlab-pages";
-  version = "1.28.0";
+  version = "1.30.0";
 
   src = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "gitlab-pages";
     rev = "v${version}";
-    sha256 = "15q32blkhmc5w1b2xh45y7cag8f6bw9bgiwin5ykrzj5d305wd16";
+    sha256 = "0gn5lwn1lk1ghv6lw0fvax0m829w09mmq8flbmcxvszfyv7x0rix";
   };
 
-  vendorSha256 = "1gzkb2j2hl6ln8i5wjk2n9g8agpdzy1pzghb4sy1r8pdfp0i28r3";
+  vendorSha256 = "08zma4b58b9132h41m6frbdi502yima9lkpab87fi0q5r6qwhf1z";
   subPackages = [ "." ];
   doCheck = false; # Broken
 
diff --git a/third_party/nixpkgs/pkgs/servers/http/lighttpd/default.nix b/third_party/nixpkgs/pkgs/servers/http/lighttpd/default.nix
index 01a07a9f50..d90357044f 100644
--- a/third_party/nixpkgs/pkgs/servers/http/lighttpd/default.nix
+++ b/third_party/nixpkgs/pkgs/servers/http/lighttpd/default.nix
@@ -15,11 +15,11 @@ assert enableWebDAV -> libuuid != null;
 assert enableExtendedAttrs -> attr != null;
 
 stdenv.mkDerivation rec {
-  name = "lighttpd-1.4.55";
+  name = "lighttpd-1.4.56";
 
   src = fetchurl {
     url = "https://download.lighttpd.net/lighttpd/releases-1.4.x/${name}.tar.xz";
-    sha256 = "09z947730yjh438wrqb3z1c5hr1dbb11a8sr92g3vk6mr7lm02va";
+    sha256 = "0xyzahrkmldwskwgjgj4dc3rmfmgqiwwr9y7jfhqpbp8g76q9kp4";
   };
 
   postPatch = ''
diff --git a/third_party/nixpkgs/pkgs/servers/http/openresty/default.nix b/third_party/nixpkgs/pkgs/servers/http/openresty/default.nix
index 734dfb0414..9645176499 100644
--- a/third_party/nixpkgs/pkgs/servers/http/openresty/default.nix
+++ b/third_party/nixpkgs/pkgs/servers/http/openresty/default.nix
@@ -8,15 +8,19 @@
 
 callPackage ../nginx/generic.nix args rec {
   pname = "openresty";
-  nginxVersion = "1.17.8";
-  version = "${nginxVersion}.2";
+  nginxVersion = "1.19.3";
+  version = "${nginxVersion}.1";
 
   src = fetchurl {
     url = "https://openresty.org/download/openresty-${version}.tar.gz";
-    sha256 = "1813w33hjm1hcqvl3b3f67qgi5zfjiqg6s01hiy12a5j3jqilcig";
+    sha256 = "0p9xn0xgbk6nmjfb25a3d6bwxm8q23igkixqma5fpygla6fcsvzk";
   };
 
-  fixPatch = patch: let name = patch.name or (builtins.baseNameOf patch); in
+  # generic.nix applies fixPatch on top of every patch defined there.  This
+  # allows updating the patch destination, as openresty has nginx source code
+  # in a different folder.
+  fixPatch = patch:
+    let name = patch.name or (builtins.baseNameOf patch); in
     runCommand "openresty-${name}" { src = patch; } ''
       substitute $src $out \
         --replace "a/" "a/bundle/nginx-${nginxVersion}/" \
@@ -40,9 +44,9 @@ callPackage ../nginx/generic.nix args rec {
 
   meta = {
     description = "A fast web application server built on Nginx";
-    homepage    = "http://openresty.org";
-    license     = lib.licenses.bsd2;
-    platforms   = lib.platforms.all;
+    homepage = "http://openresty.org";
+    license = lib.licenses.bsd2;
+    platforms = lib.platforms.all;
     maintainers = with lib.maintainers; [ thoughtpolice lblasc emily ];
   };
 }
diff --git a/third_party/nixpkgs/pkgs/servers/jackett/default.nix b/third_party/nixpkgs/pkgs/servers/jackett/default.nix
index baa1e6c1c6..3c1b9ff2da 100644
--- a/third_party/nixpkgs/pkgs/servers/jackett/default.nix
+++ b/third_party/nixpkgs/pkgs/servers/jackett/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "jackett";
-  version = "0.16.2236";
+  version = "0.16.2269";
 
   src = fetchurl {
     url = "https://github.com/Jackett/Jackett/releases/download/v${version}/Jackett.Binaries.Mono.tar.gz";
-    sha256 = "1qra5qcm7bwplkrmy6haf1kk3gpj9jjvgl0y7rs81jn15cjp6fmq";
+    sha256 = "0bzyp2jjbfjh1xr2ga8vl6vyjhwks824sa8r1g5iydn9y36am7pf";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/third_party/nixpkgs/pkgs/servers/mail/postsrsd/default.nix b/third_party/nixpkgs/pkgs/servers/mail/postsrsd/default.nix
index 845c423743..5a543ed8ba 100644
--- a/third_party/nixpkgs/pkgs/servers/mail/postsrsd/default.nix
+++ b/third_party/nixpkgs/pkgs/servers/mail/postsrsd/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "postsrsd";
-  version = "1.6";
+  version = "1.7";
 
   src = fetchFromGitHub {
     owner = "roehling";
     repo = "postsrsd";
     rev = version;
-    sha256 = "1dza22f0zlzsvr2dpnmsg8m8mj9rgdk0pzm1wvxrcfwyi8899ggm";
+    sha256 = "11yr557m60a62m4wxi20lr8kmagjrgndmnwlxzr241bwb20ba96x";
   };
 
   cmakeFlags = [ "-DGENERATE_SRS_SECRET=OFF" "-DINIT_FLAVOR=systemd" ];
diff --git a/third_party/nixpkgs/pkgs/servers/monitoring/thanos/default.nix b/third_party/nixpkgs/pkgs/servers/monitoring/thanos/default.nix
index 7c2ac16399..8d14414897 100644
--- a/third_party/nixpkgs/pkgs/servers/monitoring/thanos/default.nix
+++ b/third_party/nixpkgs/pkgs/servers/monitoring/thanos/default.nix
@@ -1,13 +1,13 @@
 { stdenv, buildGoModule, fetchFromGitHub }:
 buildGoModule rec {
   pname = "thanos";
-  version = "0.17.0";
+  version = "0.17.1";
 
   src = fetchFromGitHub {
     rev = "v${version}";
     owner = "thanos-io";
     repo = "thanos";
-    sha256 = "06pr9zqfd7nq13pgg02px2d9rp7phxlmnirpkdfgbw799zrfvpag";
+    sha256 = "07814hk6nmvvkf7xklrin24vp17wm6nby358gk20ri4man822q8c";
   };
 
   vendorSha256 = "1j3gnzas0hpb5dljf5m97nw2v4r1bp3l99z36gbqkm6lqzr6hqk8";
diff --git a/third_party/nixpkgs/pkgs/servers/nats-streaming-server/default.nix b/third_party/nixpkgs/pkgs/servers/nats-streaming-server/default.nix
index 0245f087c9..e6a9f95a1b 100644
--- a/third_party/nixpkgs/pkgs/servers/nats-streaming-server/default.nix
+++ b/third_party/nixpkgs/pkgs/servers/nats-streaming-server/default.nix
@@ -4,14 +4,14 @@ with lib;
 
 buildGoPackage rec {
   pname   = "nats-streaming-server";
-  version = "0.17.0";
+  version = "0.19.0";
   goPackagePath = "github.com/nats-io/${pname}";
 
   src = fetchFromGitHub {
     rev    = "v${version}";
     owner  = "nats-io";
     repo   = pname;
-    sha256 = "1dla70k6rxg34qzspq0j12zcjk654jrf3gm7gd45w4qdg8h2fyyg";
+    sha256 = "1wa2xby7v45f9idnhbkglknipm24wqx7mxmkyqz3amq17j4xfy7c";
   };
 
   meta = {
diff --git a/third_party/nixpkgs/pkgs/servers/nosql/cassandra/generic.nix b/third_party/nixpkgs/pkgs/servers/nosql/cassandra/generic.nix
index 6ccd2e1c8d..97c7341c76 100644
--- a/third_party/nixpkgs/pkgs/servers/nosql/cassandra/generic.nix
+++ b/third_party/nixpkgs/pkgs/servers/nosql/cassandra/generic.nix
@@ -88,6 +88,6 @@ stdenv.mkDerivation rec {
     description = "A massively scalable open source NoSQL database";
     platforms = platforms.unix;
     license = licenses.asl20;
-    maintainers = with maintainers; [ cransom ];
+    maintainers = [];
   };
 }
diff --git a/third_party/nixpkgs/pkgs/servers/peach/default.nix b/third_party/nixpkgs/pkgs/servers/peach/default.nix
new file mode 100644
index 0000000000..59d5a6c2f6
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/servers/peach/default.nix
@@ -0,0 +1,22 @@
+{ lib, buildGoModule, fetchFromGitHub }:
+
+buildGoModule rec {
+  pname = "peach";
+  version = "0.9.8";
+
+  src = fetchFromGitHub {
+    owner = "peachdocs";
+    repo = "peach";
+    rev = "v${version}";
+    sha256 = "1pzk3sah39hz8n1kswxl35djh6wm0qcfcwrbfi50nd4k3bdgz7xl";
+  };
+
+  vendorSha256 = "0f215hd5a9d4fyvdirp2j14ghap5vwv12i28jmzm6wxjihj8nn1g";
+
+  meta = with lib; {
+    description = "Web server for multi-language, real-time synchronization and searchable documentation";
+    homepage = "https://peachdocs.org/";
+    license = licenses.asl20;
+    maintainers = [ maintainers.ivar ];
+  };
+}
diff --git a/third_party/nixpkgs/pkgs/servers/pinnwand/default.nix b/third_party/nixpkgs/pkgs/servers/pinnwand/default.nix
index 16fa6a7196..fd02fc7708 100644
--- a/third_party/nixpkgs/pkgs/servers/pinnwand/default.nix
+++ b/third_party/nixpkgs/pkgs/servers/pinnwand/default.nix
@@ -1,4 +1,4 @@
-{ lib, python3, fetchFromGitHub, poetry, nixosTests }:
+{ lib, python3, fetchFromGitHub, nixosTests }:
 
 let
   python = python3.override {
diff --git a/third_party/nixpkgs/pkgs/servers/plex/raw.nix b/third_party/nixpkgs/pkgs/servers/plex/raw.nix
index 7ed3bf8bfe..e27048b272 100644
--- a/third_party/nixpkgs/pkgs/servers/plex/raw.nix
+++ b/third_party/nixpkgs/pkgs/servers/plex/raw.nix
@@ -1,6 +1,10 @@
 { stdenv
 , fetchurl
 , dpkg
+, writeScript
+, curl
+, jq
+, common-updater-scripts
 }:
 
 # The raw package that fetches and extracts the Plex RPM. Override the source
@@ -8,16 +12,16 @@
 # server, and the FHS userenv and corresponding NixOS module should
 # automatically pick up the changes.
 stdenv.mkDerivation rec {
-  version = "1.20.5.3600-47c0d9038";
+  version = "1.21.0.3711-b509cc236";
   pname = "plexmediaserver";
 
   # Fetch the source
   src = if stdenv.hostPlatform.system == "aarch64-linux" then fetchurl {
     url = "https://downloads.plex.tv/plex-media-server-new/${version}/debian/plexmediaserver_${version}_arm64.deb";
-    sha256 = "18zj4baa085gbgc0y5gx7gnwzl131xyk34m5xcipfvfb434y98cp";
+    sha256 = "0nhxxfcds3byhbz8gsd9107diy182m33xbcc8jgi78hwfadyjj7h";
   } else fetchurl {
     url = "https://downloads.plex.tv/plex-media-server-new/${version}/debian/plexmediaserver_${version}_amd64.deb";
-    sha256 = "01rq2q6avjsvnns7jsd2a9vnmd4584fwdkp833gjgrrrqkf6h45y";
+    sha256 = "0izsmcc337paakz1nqfsr78s097sxyxy3kbs43qpzpx7w5wshynb";
   };
 
   outputs = [ "out" "basedb" ];
@@ -52,6 +56,27 @@ stdenv.mkDerivation rec {
   dontPatchELF = true;
   dontAutoPatchelf = true;
 
+  passthru.updateScript = writeScript "${pname}-updater" ''
+    #!${stdenv.shell}
+    set -eu -o pipefail
+    PATH=${stdenv.lib.makeBinPath [curl jq common-updater-scripts]}:$PATH
+
+    plexApiJson=$(curl -sS https://plex.tv/api/downloads/5.json)
+    latestVersion="$(echo $plexApiJson | jq .computer.Linux.version | tr -d '"\n')"
+
+    for platform in ${stdenv.lib.concatStringsSep " " meta.platforms}; do
+      arch=$(echo $platform | cut -d '-' -f1)
+      dlUrl="$(echo $plexApiJson | jq --arg arch "$arch" -c '.computer.Linux.releases[] | select(.distro == "debian") | select(.build | contains($arch)) .url' | tr -d '"\n')"
+
+      latestSha="$(nix-prefetch-url $dlUrl)"
+
+      # The script will not perform an update when the version attribute is up to date from previous platform run
+      # We need to clear it before each run
+      update-source-version plexRaw 0 $(yes 0 | head -64 | tr -d "\n") --system=$platform
+      update-source-version plexRaw "$latestVersion" "$latestSha" --system=$platform
+    done
+  '';
+
   meta = with stdenv.lib; {
     homepage = "https://plex.tv/";
     license = licenses.unfree;
diff --git a/third_party/nixpkgs/pkgs/servers/pounce/default.nix b/third_party/nixpkgs/pkgs/servers/pounce/default.nix
index 62d576ffc6..4a55a2c656 100644
--- a/third_party/nixpkgs/pkgs/servers/pounce/default.nix
+++ b/third_party/nixpkgs/pkgs/servers/pounce/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "pounce";
-  version = "2.0";
+  version = "2.1p1";
 
   src = fetchzip {
     url = "https://git.causal.agency/pounce/snapshot/pounce-${version}.tar.gz";
-    sha256 = "0vr42s8l617k6893zq7qn9wz7kcdchmr99ivbkrmvd38qrhsa02l";
+    sha256 = "1gphia45swj4ws6nrklqg1hvjrc6yw921v0pf29cvjhwrfl6dl0h";
   };
 
   buildInputs = [ libressl ];
diff --git a/third_party/nixpkgs/pkgs/servers/routinator/default.nix b/third_party/nixpkgs/pkgs/servers/routinator/default.nix
index e80e27d7a8..a1de033af4 100644
--- a/third_party/nixpkgs/pkgs/servers/routinator/default.nix
+++ b/third_party/nixpkgs/pkgs/servers/routinator/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "routinator";
-  version = "0.8.0";
+  version = "0.8.1";
 
   src = fetchFromGitHub {
     owner = "NLnetLabs";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1lldrb469vc7l6bkwgxz38n7lyxh74cb88xak5r0sjm1ip5q0glp";
+    sha256 = "sha256-yH43FPeMohN6zpzEcLpbFBvO8Wz4IjuWRmsE19C7NIA=";
   };
 
-  cargoSha256 = "sha256:19yzx9h02cx5dldliaq814n84f8w0s3nbyjk3pgia2siim5mdv94";
+  cargoSha256 = "14cbkvcvbjgc308lh1yj0715rnl035r5qwvfsip17xk5j3y8w1xr";
 
   meta = with stdenv.lib; {
     description = "An RPKI Validator written in Rust";
diff --git a/third_party/nixpkgs/pkgs/servers/rtsp-simple-server/default.nix b/third_party/nixpkgs/pkgs/servers/rtsp-simple-server/default.nix
index 254c24754c..94a15d3548 100644
--- a/third_party/nixpkgs/pkgs/servers/rtsp-simple-server/default.nix
+++ b/third_party/nixpkgs/pkgs/servers/rtsp-simple-server/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "rtsp-simple-server";
-  version = "0.12.1";
+  version = "0.12.2";
 
   src = fetchFromGitHub {
     owner = "aler9";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0x8di6zkbn7v77awlybp3m722a27kw20vrpjgalifv8p87238x24";
+    sha256 = "094brxiiapm7402q0ysaha2xk3wymc2kz8vqisjyiswz7wf4wsx0";
   };
 
-  vendorSha256 = "0p7d0c6zgbzj7wd2qdz578cgamydl6mp5sc8jmvnwb50h10n45af";
+  vendorSha256 = "007dyw825jsfma7sq5llxllhrzbkhqxr985s1nhg5cdd803gz42p";
 
   # Tests need docker
   doCheck = false;
diff --git a/third_party/nixpkgs/pkgs/servers/sabnzbd/default.nix b/third_party/nixpkgs/pkgs/servers/sabnzbd/default.nix
index f6b0574fa5..f2cbb2f820 100644
--- a/third_party/nixpkgs/pkgs/servers/sabnzbd/default.nix
+++ b/third_party/nixpkgs/pkgs/servers/sabnzbd/default.nix
@@ -20,14 +20,14 @@ let
   ]);
   path = stdenv.lib.makeBinPath [ par2cmdline unrar unzip p7zip ];
 in stdenv.mkDerivation rec {
-  version = "3.0.1";
+  version = "3.1.1";
   pname = "sabnzbd";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = version;
-    sha256 = "1zp8cxz56qmai1z6xcscnq85gxhv64dv1s5zqsqdn0zpbxyqqdlr";
+    sha256 = "0m39r2il7d014kf2p6v28lw2hzshm6bhhdchqa8wzyvvmygqmwf2";
   };
 
   buildInputs = [ pythonEnv makeWrapper ];
diff --git a/third_party/nixpkgs/pkgs/servers/sql/postgresql/default.nix b/third_party/nixpkgs/pkgs/servers/sql/postgresql/default.nix
index 9bfc4e7dca..7ec59c6873 100644
--- a/third_party/nixpkgs/pkgs/servers/sql/postgresql/default.nix
+++ b/third_party/nixpkgs/pkgs/servers/sql/postgresql/default.nix
@@ -68,7 +68,6 @@ let
         ./patches/specify_pkglibdir_at_runtime.patch
         ./patches/findstring.patch
       ]
-      ++ lib.optional (atLeast "10") ./patches/stabilize-timetz-dst.patch
       ++ lib.optional stdenv.isLinux (if atLeast "13" then ./patches/socketdir-in-run-13.patch else ./patches/socketdir-in-run.patch);
 
     installTargets = [ "install-world" ];
@@ -188,49 +187,49 @@ let
 in self: {
 
   postgresql_9_5 = self.callPackage generic {
-    version = "9.5.23";
+    version = "9.5.24";
     psqlSchema = "9.5";
-    sha256 = "0rl31jc3kg2wq6hazyd297gnmx3cibjvivllbsivii2m6dzgl573";
+    sha256 = "0an2k4m1da96897hyxlff8p4p63wg4dffwsfg57aib7mp4yzsp06";
     this = self.postgresql_9_5;
     inherit self;
   };
 
   postgresql_9_6 = self.callPackage generic {
-    version = "9.6.19";
+    version = "9.6.20";
     psqlSchema = "9.6";
-    sha256 = "1c2wnl5bbpjs1s1rpzvlnzsqlpb0p823zw7s38nhpgnxrja3myb1";
+    sha256 = "1dkv916y7vrfbygrfbfvs6y3fxaysnh32i5j88nvcnnl16jcn21x";
     this = self.postgresql_9_6;
     inherit self;
   };
 
   postgresql_10 = self.callPackage generic {
-    version = "10.14";
+    version = "10.15";
     psqlSchema = "10.0"; # should be 10, but changing it is invasive
-    sha256 = "0fxj30jvwq5pqpbj97vhlxgmn2ah59a78s9jyjr7vxyqj7sdh71q";
+    sha256 = "0zhzj9skag1pgqas2rnd217vj41ilaalqna17j47gyngpvhbqmjr";
     this = self.postgresql_10;
     inherit self;
   };
 
   postgresql_11 = self.callPackage generic {
-    version = "11.9";
+    version = "11.10";
     psqlSchema = "11.1"; # should be 11, but changing it is invasive
-    sha256 = "0db6pfphc5rp12abnkvv2l9pbl7bdyf3hhiwj8ghjwh35skqlq9m";
+    sha256 = "16bqp6ds37kbwqx7mk5gg3y6gv59wq6xz33iqwxldzk20vwd5rhk";
     this = self.postgresql_11;
     inherit self;
   };
 
   postgresql_12 = self.callPackage generic {
-    version = "12.4";
+    version = "12.5";
     psqlSchema = "12";
-    sha256 = "1k06wryy8p4s1fim9qafcjlak3f58l0wqaqnrccr9x9j5jz3zsdy";
+    sha256 = "15gzg778da23sbfmy7sqg443f9ny480301lm7i3vay4m3ls2a3dx";
     this = self.postgresql_12;
     inherit self;
   };
 
   postgresql_13 = self.callPackage generic {
-    version = "13.0";
+    version = "13.1";
     psqlSchema = "13";
-    sha256 = "15i2b7m9a9430idqdgvrcyx66cpxz0v2d81nfqcm8ss3inz51rw0";
+    sha256 = "07z6zwr58dckaa97yl9ml240z83d1lhgaxw9aq49i8lsp21mqd0j";
     this = self.postgresql_13;
     inherit self;
   };
diff --git a/third_party/nixpkgs/pkgs/servers/sql/postgresql/patches/stabilize-timetz-dst.patch b/third_party/nixpkgs/pkgs/servers/sql/postgresql/patches/stabilize-timetz-dst.patch
deleted file mode 100644
index b6c633cb73..0000000000
--- a/third_party/nixpkgs/pkgs/servers/sql/postgresql/patches/stabilize-timetz-dst.patch
+++ /dev/null
@@ -1,117 +0,0 @@
-From 4a071afbd056282746a5bc9362e87f579a56402d Mon Sep 17 00:00:00 2001
-From: Tom Lane <tgl@sss.pgh.pa.us>
-Date: Thu, 29 Oct 2020 15:28:14 -0400
-Subject: [PATCH 1/1] Stabilize timetz test across DST transitions.
-
-The timetz test cases I added in commit a9632830b were unintentionally
-sensitive to whether or not DST is active in the PST8PDT time zone.
-Thus, they'll start failing this coming weekend, as reported by
-Bernhard M. Wiedemann in bug #16689.  Fortunately, DST-awareness is
-not significant to the purpose of these test cases, so we can just
-force them all to PDT (DST hours) to preserve stability of the
-results.
-
-Back-patch to v10, as the prior patch was.
-
-Discussion: https://postgr.es/m/16689-57701daa23b377bf@postgresql.org
-Git viewer: https://git.postgresql.org/gitweb/?p=postgresql.git;a=commitdiff;h=4a071afbd056282746a5bc9362e87f579a56402d;hp=f90149e6285aaae6b48559afce1bd638ee26c33e
----
- src/test/regress/expected/timetz.out | 32 ++++++++++++++--------------
- src/test/regress/sql/timetz.sql      | 16 +++++++-------
- 2 files changed, 24 insertions(+), 24 deletions(-)
-
-diff --git a/src/test/regress/expected/timetz.out b/src/test/regress/expected/timetz.out
-index 038bb5fa09..1ab5ed5105 100644
---- a/src/test/regress/expected/timetz.out
-+++ b/src/test/regress/expected/timetz.out
-@@ -91,45 +91,45 @@ SELECT f1 AS "Ten" FROM TIMETZ_TBL WHERE f1 >= '00:00-07';
- (12 rows)
- 
- -- Check edge cases
--SELECT '23:59:59.999999'::timetz;
-+SELECT '23:59:59.999999 PDT'::timetz;
-        timetz       
- --------------------
-  23:59:59.999999-07
- (1 row)
- 
--SELECT '23:59:59.9999999'::timetz;  -- rounds up
-+SELECT '23:59:59.9999999 PDT'::timetz;  -- rounds up
-    timetz    
- -------------
-  24:00:00-07
- (1 row)
- 
--SELECT '23:59:60'::timetz;  -- rounds up
-+SELECT '23:59:60 PDT'::timetz;  -- rounds up
-    timetz    
- -------------
-  24:00:00-07
- (1 row)
- 
--SELECT '24:00:00'::timetz;  -- allowed
-+SELECT '24:00:00 PDT'::timetz;  -- allowed
-    timetz    
- -------------
-  24:00:00-07
- (1 row)
- 
--SELECT '24:00:00.01'::timetz;  -- not allowed
--ERROR:  date/time field value out of range: "24:00:00.01"
--LINE 1: SELECT '24:00:00.01'::timetz;
-+SELECT '24:00:00.01 PDT'::timetz;  -- not allowed
-+ERROR:  date/time field value out of range: "24:00:00.01 PDT"
-+LINE 1: SELECT '24:00:00.01 PDT'::timetz;
-                ^
--SELECT '23:59:60.01'::timetz;  -- not allowed
--ERROR:  date/time field value out of range: "23:59:60.01"
--LINE 1: SELECT '23:59:60.01'::timetz;
-+SELECT '23:59:60.01 PDT'::timetz;  -- not allowed
-+ERROR:  date/time field value out of range: "23:59:60.01 PDT"
-+LINE 1: SELECT '23:59:60.01 PDT'::timetz;
-                ^
--SELECT '24:01:00'::timetz;  -- not allowed
--ERROR:  date/time field value out of range: "24:01:00"
--LINE 1: SELECT '24:01:00'::timetz;
-+SELECT '24:01:00 PDT'::timetz;  -- not allowed
-+ERROR:  date/time field value out of range: "24:01:00 PDT"
-+LINE 1: SELECT '24:01:00 PDT'::timetz;
-                ^
--SELECT '25:00:00'::timetz;  -- not allowed
--ERROR:  date/time field value out of range: "25:00:00"
--LINE 1: SELECT '25:00:00'::timetz;
-+SELECT '25:00:00 PDT'::timetz;  -- not allowed
-+ERROR:  date/time field value out of range: "25:00:00 PDT"
-+LINE 1: SELECT '25:00:00 PDT'::timetz;
-                ^
- --
- -- TIME simple math
-diff --git a/src/test/regress/sql/timetz.sql b/src/test/regress/sql/timetz.sql
-index b699e4b03c..ce763d89e8 100644
---- a/src/test/regress/sql/timetz.sql
-+++ b/src/test/regress/sql/timetz.sql
-@@ -36,14 +36,14 @@ SELECT f1 AS "None" FROM TIMETZ_TBL WHERE f1 < '00:00-07';
- SELECT f1 AS "Ten" FROM TIMETZ_TBL WHERE f1 >= '00:00-07';
- 
- -- Check edge cases
--SELECT '23:59:59.999999'::timetz;
--SELECT '23:59:59.9999999'::timetz;  -- rounds up
--SELECT '23:59:60'::timetz;  -- rounds up
--SELECT '24:00:00'::timetz;  -- allowed
--SELECT '24:00:00.01'::timetz;  -- not allowed
--SELECT '23:59:60.01'::timetz;  -- not allowed
--SELECT '24:01:00'::timetz;  -- not allowed
--SELECT '25:00:00'::timetz;  -- not allowed
-+SELECT '23:59:59.999999 PDT'::timetz;
-+SELECT '23:59:59.9999999 PDT'::timetz;  -- rounds up
-+SELECT '23:59:60 PDT'::timetz;  -- rounds up
-+SELECT '24:00:00 PDT'::timetz;  -- allowed
-+SELECT '24:00:00.01 PDT'::timetz;  -- not allowed
-+SELECT '23:59:60.01 PDT'::timetz;  -- not allowed
-+SELECT '24:01:00 PDT'::timetz;  -- not allowed
-+SELECT '25:00:00 PDT'::timetz;  -- not allowed
- 
- --
- -- TIME simple math
--- 
-2.20.1
diff --git a/third_party/nixpkgs/pkgs/servers/tarssh/default.nix b/third_party/nixpkgs/pkgs/servers/tarssh/default.nix
index 72e636b303..4e9ef3e0b5 100644
--- a/third_party/nixpkgs/pkgs/servers/tarssh/default.nix
+++ b/third_party/nixpkgs/pkgs/servers/tarssh/default.nix
@@ -4,16 +4,16 @@ with rustPlatform;
 
 buildRustPackage rec {
   pname = "tarssh";
-  version = "0.4.0";
+  version = "0.5.0";
 
   src = fetchFromGitHub {
     rev = "v${version}";
     owner = "Freaky";
     repo = pname;
-    sha256 = "0fm0rwknhm39nhd6g0pnxby34i5gpmi5ri795d9ylsw0pqwz6kd0";
+    sha256 = "1waxfbw9lqbqv8igb291pjqg22324lzv4p7fsdfrkvxf95jd2i03";
   };
 
-  cargoSha256 = "108xdpgfgfd4z455snif0mzbla0rv8gjqxci5qgwjzfyshwkprgv";
+  cargoSha256 = "1f3anrh2y8yg7l4nilwk0a7c7kq5yvg07cqh75igjdb5a7p9di0j";
 
   meta = with stdenv.lib; {
     description = "A simple SSH tarpit inspired by endlessh";
diff --git a/third_party/nixpkgs/pkgs/servers/unifi/default.nix b/third_party/nixpkgs/pkgs/servers/unifi/default.nix
index 3cdd331f3b..3072b44e4a 100644
--- a/third_party/nixpkgs/pkgs/servers/unifi/default.nix
+++ b/third_party/nixpkgs/pkgs/servers/unifi/default.nix
@@ -54,7 +54,7 @@ in {
   };
 
   unifiBeta = generic {
-    version = "6.0.28";
-    sha256 = "14q8r4mcqx0v3sh8zwqg4cc3iszqn5201q5r4c20cwqdd4ivf97q";
+    version = "6.0.36";
+    sha256 = "1sjf4jd8jkf6194ahwqjxd2ip0r70bdk15gci1qrdw88agab143j";
   };
 }
diff --git a/third_party/nixpkgs/pkgs/servers/x11/xorg/default.nix b/third_party/nixpkgs/pkgs/servers/x11/xorg/default.nix
index bd0d5bd6d8..92b6df3ef4 100644
--- a/third_party/nixpkgs/pkgs/servers/x11/xorg/default.nix
+++ b/third_party/nixpkgs/pkgs/servers/x11/xorg/default.nix
@@ -1157,7 +1157,7 @@ lib.makeScope newScope (self: with self; {
     meta.platforms = stdenv.lib.platforms.unix;
   }) {};
 
-  libxcb = callPackage ({ stdenv, pkgconfig, fetchurl, libxslt, libpthreadstubs, libXau, xcbproto, libXdmcp, python }: stdenv.mkDerivation {
+  libxcb = callPackage ({ stdenv, pkgconfig, fetchurl, libxslt, libpthreadstubs, libXau, xcbproto, libXdmcp, python3 }: stdenv.mkDerivation {
     name = "libxcb-1.14";
     builder = ./builder.sh;
     src = fetchurl {
@@ -1165,7 +1165,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "0d2chjgyn5lr9sfhacfvqgnj9l9faz11vn322a06jd6lk3dxcpm5";
     };
     hardeningDisable = [ "bindnow" "relro" ];
-    nativeBuildInputs = [ pkgconfig python ];
+    nativeBuildInputs = [ pkgconfig python3 ];
     buildInputs = [ libxslt libpthreadstubs libXau xcbproto libXdmcp ];
     meta.platforms = stdenv.lib.platforms.unix;
   }) {};
@@ -1430,7 +1430,7 @@ lib.makeScope newScope (self: with self; {
     meta.platforms = stdenv.lib.platforms.unix;
   }) {};
 
-  xcbproto = callPackage ({ stdenv, pkgconfig, fetchurl, python }: stdenv.mkDerivation {
+  xcbproto = callPackage ({ stdenv, pkgconfig, fetchurl, python3 }: stdenv.mkDerivation {
     name = "xcb-proto-1.14.1";
     builder = ./builder.sh;
     src = fetchurl {
@@ -1438,7 +1438,7 @@ lib.makeScope newScope (self: with self; {
       sha256 = "1hzwazgyywd9mz4mjj1yv8ski27qqx7ypmyr27m39hrajyddsjph";
     };
     hardeningDisable = [ "bindnow" "relro" ];
-    nativeBuildInputs = [ pkgconfig python ];
+    nativeBuildInputs = [ pkgconfig python3 ];
     buildInputs = [ ];
     meta.platforms = stdenv.lib.platforms.unix;
   }) {};
@@ -1963,7 +1963,7 @@ lib.makeScope newScope (self: with self; {
     meta.platforms = stdenv.lib.platforms.unix;
   }) {};
 
-  xf86videointel = callPackage ({ stdenv, pkgconfig, fetchurl, cairo, xorgproto, libdrm, libpng, udev, libpciaccess, libX11, xcbutil, libxcb, libXcursor, libXdamage, libXext, libXfixes, xorgserver, libXrandr, libXrender, libxshmfence, libXtst, libXvMC, libXv }: stdenv.mkDerivation {
+  xf86videointel = callPackage ({ stdenv, pkgconfig, fetchurl, cairo, xorgproto, libdrm, libpng, udev, libpciaccess, libX11, xcbutil, libxcb, libXcursor, libXdamage, libXext, libXfixes, xorgserver, libXrandr, libXrender, libxshmfence, libXtst, libXvMC }: stdenv.mkDerivation {
     name = "xf86-video-intel-2.99.917";
     builder = ./builder.sh;
     src = fetchurl {
@@ -1972,7 +1972,7 @@ lib.makeScope newScope (self: with self; {
     };
     hardeningDisable = [ "bindnow" "relro" ];
     nativeBuildInputs = [ pkgconfig ];
-    buildInputs = [ cairo xorgproto libdrm libpng udev libpciaccess libX11 xcbutil libxcb libXcursor libXdamage libXext libXfixes xorgserver libXrandr libXrender libxshmfence libXtst libXvMC libXv ];
+    buildInputs = [ cairo xorgproto libdrm libpng udev libpciaccess libX11 xcbutil libxcb libXcursor libXdamage libXext libXfixes xorgserver libXrandr libXrender libxshmfence libXtst libXvMC ];
     meta.platforms = stdenv.lib.platforms.unix;
   }) {};
 
@@ -2522,7 +2522,7 @@ lib.makeScope newScope (self: with self; {
     meta.platforms = stdenv.lib.platforms.unix;
   }) {};
 
-  xkeyboardconfig = callPackage ({ stdenv, python3, pkgconfig, fetchurl, libX11, xorgproto }: stdenv.mkDerivation {
+  xkeyboardconfig = callPackage ({ stdenv, pkgconfig, fetchurl, libX11, xorgproto, python3 }: stdenv.mkDerivation {
     name = "xkeyboard-config-2.31";
     builder = ./builder.sh;
     src = fetchurl {
@@ -2532,9 +2532,6 @@ lib.makeScope newScope (self: with self; {
     hardeningDisable = [ "bindnow" "relro" ];
     nativeBuildInputs = [ pkgconfig python3 ];
     buildInputs = [ libX11 xorgproto ];
-    prePatch = ''
-      patchShebangs rules/merge.py
-    '';
     meta.platforms = stdenv.lib.platforms.unix;
   }) {};
 
diff --git a/third_party/nixpkgs/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl b/third_party/nixpkgs/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
index ba33623b49..b0cab5fb88 100755
--- a/third_party/nixpkgs/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
+++ b/third_party/nixpkgs/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
@@ -25,7 +25,7 @@ my %pcMap;
 my %extraAttrs;
 
 
-my @missingPCs = ("fontconfig", "libdrm", "libXaw", "zlib", "perl", "python", "mkfontscale", "bdftopcf", "libxslt", "openssl", "gperf", "m4", "libinput", "libevdev", "mtdev", "xorgproto", "cairo", "gettext" );
+my @missingPCs = ("fontconfig", "libdrm", "libXaw", "zlib", "perl", "python3", "mkfontscale", "bdftopcf", "libxslt", "openssl", "gperf", "m4", "libinput", "libevdev", "mtdev", "xorgproto", "cairo", "gettext" );
 $pcMap{$_} = $_ foreach @missingPCs;
 $pcMap{"freetype2"} = "freetype";
 $pcMap{"libpng12"} = "libpng";
@@ -161,7 +161,7 @@ while (<>) {
     }
 
     if ($file =~ /AM_PATH_PYTHON/) {
-        push @nativeRequires, "python";
+        push @nativeRequires, "python3";
     }
 
     if ($file =~ /AC_PATH_PROG\(FCCACHE/) {
diff --git a/third_party/nixpkgs/pkgs/servers/x11/xorg/overrides.nix b/third_party/nixpkgs/pkgs/servers/x11/xorg/overrides.nix
index 14ef7a95c4..c9d48c9de9 100644
--- a/third_party/nixpkgs/pkgs/servers/x11/xorg/overrides.nix
+++ b/third_party/nixpkgs/pkgs/servers/x11/xorg/overrides.nix
@@ -4,7 +4,7 @@
   freetype, tradcpp, fontconfig, meson, ninja, ed, fontforge,
   libGL, spice-protocol, zlib, libGLU, dbus, libunwind, libdrm,
   mesa, udev, bootstrap_cmds, bison, flex, clangStdenv, autoreconfHook,
-  mcpp, epoxy, openssl, pkgconfig, llvm_6, python3, libxslt,
+  mcpp, epoxy, openssl, pkgconfig, llvm_6, libxslt,
   ApplicationServices, Carbon, Cocoa, Xplugin
 }:
 
@@ -73,9 +73,7 @@ self: super:
 
   mkfontdir = self.mkfontscale;
 
-  libxcb = (super.libxcb.override {
-    python = python3;
-  }).overrideAttrs (attrs: {
+  libxcb = super.libxcb.overrideAttrs (attrs: {
     configureFlags = [ "--enable-xkb" "--enable-xinput" ];
     outputs = [ "out" "dev" "man" "doc" ];
   });
@@ -332,10 +330,6 @@ self: super:
     buildInputs = attrs.buildInputs ++ [ freetype fontconfig ];
   });
 
-  xcbproto = super.xcbproto.override {
-    python = python3;
-  };
-
   xcbutil = super.xcbutil.overrideAttrs (attrs: {
     outputs = [ "out" "dev" ];
   });
@@ -463,8 +457,8 @@ self: super:
   });
 
   xkeyboardconfig = super.xkeyboardconfig.overrideAttrs (attrs: {
+    prePatch = "patchShebangs rules/merge.py";
     nativeBuildInputs = attrs.nativeBuildInputs ++ [ intltool libxslt ];
-
     configureFlags = [ "--with-xkb-rules-symlink=xorg" ];
 
     # 1: compatibility for X11/xkb location
@@ -790,7 +784,7 @@ self: super:
       rev = "f66d39544bb8339130c96d282a80f87ca1606caf";
       sha256 = "14rwbbn06l8qpx7s5crxghn80vgcx8jmfc7qvivh72d81r0kvywl";
     };
-    buildInputs = attrs.buildInputs ++ [self.libXfixes self.libXScrnSaver self.pixman];
+    buildInputs = attrs.buildInputs ++ [ self.libXScrnSaver self.libXfixes self.libXv self.pixman ];
     nativeBuildInputs = attrs.nativeBuildInputs ++ [autoreconfHook self.utilmacros];
     configureFlags = [ "--with-default-dri=3" "--enable-tools" ];
 
diff --git a/third_party/nixpkgs/pkgs/servers/x11/xorg/tarballs.list b/third_party/nixpkgs/pkgs/servers/x11/xorg/tarballs.list
index cd29460488..70b76c7a6a 100644
--- a/third_party/nixpkgs/pkgs/servers/x11/xorg/tarballs.list
+++ b/third_party/nixpkgs/pkgs/servers/x11/xorg/tarballs.list
@@ -75,7 +75,7 @@ mirror://xorg/individual/app/xwininfo-1.1.4.tar.bz2
 mirror://xorg/individual/app/xwud-1.0.5.tar.bz2
 mirror://xorg/individual/data/xbitmaps-1.1.2.tar.bz2
 mirror://xorg/individual/data/xcursor-themes-1.0.6.tar.bz2
-mirror://xorg/individual/data/xkeyboard-config/xkeyboard-config-2.27.tar.bz2
+mirror://xorg/individual/data/xkeyboard-config/xkeyboard-config-2.31.tar.bz2
 mirror://xorg/individual/doc/xorg-docs-1.7.1.tar.bz2
 mirror://xorg/individual/doc/xorg-sgml-doctools-1.11.tar.bz2
 mirror://xorg/individual/driver/xf86-input-evdev-2.10.6.tar.bz2
diff --git a/third_party/nixpkgs/pkgs/shells/oil/default.nix b/third_party/nixpkgs/pkgs/shells/oil/default.nix
index 3dbe95f35b..0896b8a504 100644
--- a/third_party/nixpkgs/pkgs/shells/oil/default.nix
+++ b/third_party/nixpkgs/pkgs/shells/oil/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "oil";
-  version = "0.8.4";
+  version = "0.8.5";
 
   src = fetchurl {
     url = "https://www.oilshell.org/download/oil-${version}.tar.xz";
-    sha256 = "0ydqwyghnkgbpsdi49vnrx2khs3y0d0bzdzcvjjr999ycmnirz88";
+    sha256 = "1z0p08q4808h78bp6nwdszpfavhr4y7n313bp0gg5qdbssnciq1v";
   };
 
   postPatch = ''
diff --git a/third_party/nixpkgs/pkgs/stdenv/generic/default.nix b/third_party/nixpkgs/pkgs/stdenv/generic/default.nix
index eeddb584a3..c7c3bb9f3f 100644
--- a/third_party/nixpkgs/pkgs/stdenv/generic/default.nix
+++ b/third_party/nixpkgs/pkgs/stdenv/generic/default.nix
@@ -70,6 +70,7 @@ let
       ../../build-support/setup-hooks/move-sbin.sh
       ../../build-support/setup-hooks/move-lib64.sh
       ../../build-support/setup-hooks/set-source-date-epoch-to-latest.sh
+      ../../build-support/setup-hooks/reproducible-builds.sh
       # TODO use lib.optional instead
       (if hasCC then cc else null)
     ];
diff --git a/third_party/nixpkgs/pkgs/stdenv/linux/make-bootstrap-tools.nix b/third_party/nixpkgs/pkgs/stdenv/linux/make-bootstrap-tools.nix
index 421bb8502a..25cde589a9 100644
--- a/third_party/nixpkgs/pkgs/stdenv/linux/make-bootstrap-tools.nix
+++ b/third_party/nixpkgs/pkgs/stdenv/linux/make-bootstrap-tools.nix
@@ -47,6 +47,12 @@ in with pkgs; rec {
     stdenv.mkDerivation {
       name = "stdenv-bootstrap-tools";
 
+      meta = {
+        # Increase priority to unblock nixpkgs-unstable
+        # https://github.com/NixOS/nixpkgs/pull/104679#issuecomment-732267288
+        schedulingPriority = 200;
+      };
+
       nativeBuildInputs = [ buildPackages.nukeReferences buildPackages.cpio ];
 
       buildCommand = ''
@@ -199,6 +205,12 @@ in with pkgs; rec {
   dist = stdenv.mkDerivation {
     name = "stdenv-bootstrap-tools";
 
+    meta = {
+      # Increase priority to unblock nixpkgs-unstable
+      # https://github.com/NixOS/nixpkgs/pull/104679#issuecomment-732267288
+      schedulingPriority = 200;
+    };
+
     buildCommand = ''
       mkdir -p $out/nix-support
       echo "file tarball ${build}/on-server/bootstrap-tools.tar.xz" >> $out/nix-support/hydra-build-products
diff --git a/third_party/nixpkgs/pkgs/tools/admin/awscli2/default.nix b/third_party/nixpkgs/pkgs/tools/admin/awscli2/default.nix
index 06e1487cfe..0a5a5a92af 100644
--- a/third_party/nixpkgs/pkgs/tools/admin/awscli2/default.nix
+++ b/third_party/nixpkgs/pkgs/tools/admin/awscli2/default.nix
@@ -73,7 +73,7 @@ with py.pkgs; buildPythonApplication rec {
     ${python3.interpreter} scripts/gen-ac-index --index-location $out/${python3.sitePackages}/awscli/data/ac.index
 
     mkdir -p $out/share/bash-completion/completions
-    echo "complete -C $out/bin/aws_completer aws" > $out/share/bash-completion/completions/awscli
+    echo "complete -C $out/bin/aws_completer aws" > $out/share/bash-completion/completions/aws
 
     mkdir -p $out/share/zsh/site-functions
     mv $out/bin/aws_zsh_completer.sh $out/share/zsh/site-functions
diff --git a/third_party/nixpkgs/pkgs/tools/admin/procs/default.nix b/third_party/nixpkgs/pkgs/tools/admin/procs/default.nix
index c8e8528cff..2c11b6f452 100644
--- a/third_party/nixpkgs/pkgs/tools/admin/procs/default.nix
+++ b/third_party/nixpkgs/pkgs/tools/admin/procs/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "procs";
-  version = "0.10.9";
+  version = "0.10.10";
 
   src = fetchFromGitHub {
     owner = "dalance";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1bxzwcj7jxv1hkbq84wigshni1ivdga7g77k3h9fxzn7c223yccd";
+    sha256 = "12p95nybsisqpji01qgkp5wfg7fwk814xdsz338q9wac8nvqw9w3";
   };
 
-  cargoSha256 = "1bf0r9kymc1w1rxpc0bjgj5faagmad9vh404n9860rpganrdjvkx";
+  cargoSha256 = "13wfz0ig9dsl0h085rzlrx0dg9la957c50xyzjfxq1ybw2qr266b";
 
   buildInputs = stdenv.lib.optional stdenv.isDarwin Security;
 
diff --git a/third_party/nixpkgs/pkgs/tools/admin/trivy/default.nix b/third_party/nixpkgs/pkgs/tools/admin/trivy/default.nix
index df3aa7bd94..ffe5d25bd9 100644
--- a/third_party/nixpkgs/pkgs/tools/admin/trivy/default.nix
+++ b/third_party/nixpkgs/pkgs/tools/admin/trivy/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "trivy";
-  version = "0.13.0";
+  version = "0.14.0";
 
   src = fetchFromGitHub {
     owner = "aquasecurity";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0d9lb1wzvxywg88fy85bicixd8wipvbhnwfckwl3p8shh0s9sr22";
+    sha256 = "1ylk6n062n9w2c8179mj0z5acz98b30w6dkpz8gslachsz9sb5ij";
   };
 
-  vendorSha256 = "0sashi3x3hccqm27dg6hjlvpgvx42jdxpgzigzm81md58zhk509x";
+  vendorSha256 = "0kljvy61n72dg99jyc47fzhc8ihyfjk30a1a031gczk3q3z2l7kj";
 
   subPackages = [ "cmd/trivy" ];
 
@@ -32,6 +32,7 @@ buildGoModule rec {
       application dependencies (Bundler, Composer, npm, yarn, etc.).
     '';
     homepage = src.meta.homepage;
+    changelog = "${src.meta.homepage}/releases/tag/v${version}";
     license = licenses.asl20;
     maintainers = with maintainers; [ jk ];
   };
diff --git a/third_party/nixpkgs/pkgs/tools/audio/abcmidi/default.nix b/third_party/nixpkgs/pkgs/tools/audio/abcmidi/default.nix
index 4ab394516a..e33ff98587 100644
--- a/third_party/nixpkgs/pkgs/tools/audio/abcmidi/default.nix
+++ b/third_party/nixpkgs/pkgs/tools/audio/abcmidi/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "abcMIDI";
-  version = "2020.08.09";
+  version = "2020.11.07";
 
   src = fetchzip {
     url = "https://ifdo.ca/~seymour/runabc/${pname}-${version}.zip";
-    sha256 = "1j7jkv2fdrhyyjavffb5nrs8p9mfp8zqqravcad1ayv1z2wxr8vl";
+    sha256 = "0zwzgqy1wa7yd2cm6spq11lw21mdn92lx8qzrxpk9kxcl03mv5jd";
   };
 
   # There is also a file called "makefile" which seems to be preferred by the standard build phase
diff --git a/third_party/nixpkgs/pkgs/tools/audio/tts/default.nix b/third_party/nixpkgs/pkgs/tools/audio/tts/default.nix
new file mode 100644
index 0000000000..770e898f2e
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/tools/audio/tts/default.nix
@@ -0,0 +1,123 @@
+{ lib
+, python3Packages
+, fetchFromGitHub
+, fetchpatch
+, python3
+}:
+
+#
+# Tested in the following setup:
+#
+# TTS model:
+#   Tacotron2 DDC
+#   https://drive.google.com/drive/folders/1Y_0PcB7W6apQChXtbt6v3fAiNwVf4ER5
+# Vocoder model:
+#   Multi-Band MelGAN
+#   https://drive.google.com/drive/folders/1XeRT0q4zm5gjERJqwmX5w84pMrD00cKD
+#
+# Arrange /tmp/tts like this:
+#   scale_stats.npy
+#   tts
+#   tts/checkpoint_130000.pth.tar
+#   tts/checkpoint_130000_tf.pkl
+#   tts/checkpoint_130000_tf_2.3rc0.tflite
+#   tts/config.json
+#   tts/scale_stats.npy
+#   vocoder
+#   vocoder/checkpoint_1450000.pth.tar
+#   vocoder/checkpoint_2750000_tf.pkl
+#   vocoder/checkpoint_2750000_tf_v2.3rc.tflite
+#   vocoder/config.json
+#   vocoder/scale_stats.npy
+#
+# Start like this:
+#   cd /tmp/tts
+#   tts-server \
+#     --vocoder_config ./tts/vocoder/config.json \
+#     --vocoder_checkpoint ./tts/vocoder/checkpoint_1450000.pth.tar \
+#     --tts_config ./tts/config.json \
+#     --tts_checkpoint ./tts/checkpoint_130000.pth.tar
+#
+# For now, for deployment check the systemd unit in the pull request:
+#   https://github.com/NixOS/nixpkgs/pull/103851#issue-521121136
+#
+
+python3Packages.buildPythonApplication rec {
+  pname = "tts";
+  # until https://github.com/mozilla/TTS/issues/424 is resolved
+  # we treat released models as released versions:
+  # https://github.com/mozilla/TTS/wiki/Released-Models
+  version = "unstable-2020-06-17";
+
+  src = fetchFromGitHub {
+    owner = "mozilla";
+    repo = "TTS";
+    rev = "72a6ac54c8cfaa407fc64b660248c6a788bdd381";
+    sha256 = "1wvs264if9n5xzwi7ryxvwj1j513szp6sfj6n587xk1fphi0921f";
+  };
+
+  patches = [
+    (fetchpatch {
+      url = "https://github.com/mozilla/TTS/commit/36fee428b9f3f4ec1914b090a2ec9d785314d9aa.patch";
+      sha256 = "sha256-pP0NxiyrsvQ0A7GEleTdT87XO08o7WxPEpb6Bmj66dc=";
+    })
+  ];
+
+  preBuild = ''
+    # numba jit tries to write to its cache directory
+    export HOME=$TMPDIR
+    sed -i -e 's!tensorflow==.*!tensorflow!' requirements.txt
+    sed -i -e 's!librosa==[^"]*!librosa!' requirements.txt setup.py
+    sed -i -e 's!unidecode==[^"]*!unidecode!' requirements.txt setup.py
+    sed -i -e 's!bokeh==[^"]*!bokeh!' requirements.txt setup.py
+    sed -i -e 's!numba==[^"]*!numba!' requirements.txt setup.py
+    # Not required for building/installation but for their development/ci workflow
+    sed -i -e '/pylint/d' requirements.txt setup.py
+    sed -i -e '/cardboardlint/d' requirements.txt setup.py
+  '';
+
+
+  propagatedBuildInputs = with python3Packages; [
+    matplotlib
+    scipy
+    pytorch
+    flask
+    attrdict
+    bokeh
+    soundfile
+    tqdm
+    librosa
+    unidecode
+    phonemizer
+    tensorboardx
+    fuzzywuzzy
+    tensorflow_2
+    inflect
+    gdown
+    pysbd
+  ];
+
+  postInstall = ''
+    cp -r TTS/server/templates/ $out/${python3.sitePackages}/TTS/server
+  '';
+
+  checkInputs = with python3Packages; [ pytestCheckHook ];
+
+  disabledTests = [
+    # RuntimeError: fft: ATen not compiled with MKL support
+    "test_torch_stft"
+    "test_stft_loss"
+    "test_multiscale_stft_loss"
+    # AssertionErrors that I feel incapable of debugging
+    "test_phoneme_to_sequence"
+    "test_text2phone"
+    "test_parametrized_gan_dataset"
+  ];
+
+  meta = with lib; {
+    homepage = "https://github.com/mozilla/TTS";
+    description = "Deep learning for Text to Speech";
+    license = licenses.mpl20;
+    maintainers = with maintainers; [ hexa mic92 ];
+  };
+}
diff --git a/third_party/nixpkgs/pkgs/tools/backup/wal-g/default.nix b/third_party/nixpkgs/pkgs/tools/backup/wal-g/default.nix
index 278ee3ad25..a2702f993a 100644
--- a/third_party/nixpkgs/pkgs/tools/backup/wal-g/default.nix
+++ b/third_party/nixpkgs/pkgs/tools/backup/wal-g/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "wal-g";
-  version = "0.2.18";
+  version = "0.2.19";
 
   src = fetchFromGitHub {
     owner = "wal-g";
     repo = "wal-g";
     rev = "v${version}";
-    sha256 = "1clsh42sgfrzyg3vr215wrpi93cb8y8ky3cb1v2l6cs4psh3py1q";
+    sha256 = "030c949cs13x4gnby6apy1adis8d4dlg3gzhhhs991117dxb0i3v";
   };
 
-  vendorSha256 = "1ax8niw4zfwvh5ikxnkbsjc9fdz1lziqlwig9nwrhzfp45ysbakh";
+  vendorSha256 = "186cqn10fljzjc876byaj1affd8xmi8zvmkfxp9dbzsfxdir4nf7";
 
   buildInputs = [ brotli ];
 
diff --git a/third_party/nixpkgs/pkgs/tools/filesystems/ceph/default.nix b/third_party/nixpkgs/pkgs/tools/filesystems/ceph/default.nix
index 07420bf222..b75a902681 100644
--- a/third_party/nixpkgs/pkgs/tools/filesystems/ceph/default.nix
+++ b/third_party/nixpkgs/pkgs/tools/filesystems/ceph/default.nix
@@ -1,4 +1,5 @@
 { stdenv, runCommand, fetchurl
+, fetchpatch
 , ensureNewerSourcesHook
 , cmake, pkgconfig
 , which, git
@@ -121,10 +122,10 @@ let
   ]);
   sitePackages = ceph-python-env.python.sitePackages;
 
-  version = "15.2.5";
+  version = "15.2.6";
   src = fetchurl {
     url = "http://download.ceph.com/tarballs/ceph-${version}.tar.gz";
-    sha256 = "05p7ssbfypf5x8bry361rrnyaihf89xzbqzhygdyrg7w1rxpna8d";
+    sha256 = "093pphgqrkrbv3484ayl0vac6a6s53zxa01yad0cbvnx0kyj55hh";
   };
 in rec {
   ceph = stdenv.mkDerivation {
diff --git a/third_party/nixpkgs/pkgs/tools/filesystems/mergerfs/default.nix b/third_party/nixpkgs/pkgs/tools/filesystems/mergerfs/default.nix
index ba7d5456d8..60670708f4 100644
--- a/third_party/nixpkgs/pkgs/tools/filesystems/mergerfs/default.nix
+++ b/third_party/nixpkgs/pkgs/tools/filesystems/mergerfs/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "mergerfs";
-  version = "2.31.0";
+  version = "2.32.0";
 
   src = fetchFromGitHub {
     owner = "trapexit";
     repo = pname;
     rev = version;
-    sha256 = "0j7nbxzv85as76glzk4cf7j6ggfihcjaihp06s0zcar4i7zaiy9z";
+    sha256 = "1qmhwkl2ws0hwd7s1mzrdiw4h7jpilzcr0w8dgx465mdzb5d2jad";
   };
 
   nativeBuildInputs = [
diff --git a/third_party/nixpkgs/pkgs/tools/inputmethods/ibus-engines/ibus-rime/default.nix b/third_party/nixpkgs/pkgs/tools/inputmethods/ibus-engines/ibus-rime/default.nix
new file mode 100644
index 0000000000..03a801abbe
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/tools/inputmethods/ibus-engines/ibus-rime/default.nix
@@ -0,0 +1,44 @@
+{ stdenv, fetchFromGitHub, cmake, pkg-config, gdk-pixbuf, glib, ibus, libnotify
+, librime, brise }:
+
+stdenv.mkDerivation rec {
+  pname = "ibus-rime";
+  version = "1.4.0";
+
+  src = fetchFromGitHub {
+    owner = "rime";
+    repo = "ibus-rime";
+    rev = version;
+    sha256 = "0zbajz7i18vrqwdyclzywvsjg6qzaih64jhi3pkxp7mbw8jc5vhy";
+  };
+
+  buildInputs = [ gdk-pixbuf glib ibus libnotify librime brise ];
+  nativeBuildInputs = [ cmake pkg-config ];
+
+  makeFlags = [ "PREFIX=$(out)" ];
+  dontUseCmakeConfigure = true;
+
+  prePatch = ''
+    substituteInPlace Makefile \
+       --replace 'cmake' 'cmake -DRIME_DATA_DIR=${brise}/share/rime-data'
+
+    substituteInPlace rime_config.h \
+       --replace '/usr' $out
+
+    substituteInPlace rime_config.h \
+       --replace 'IBUS_RIME_SHARED_DATA_DIR IBUS_RIME_INSTALL_PREFIX' \
+                 'IBUS_RIME_SHARED_DATA_DIR "${brise}"'
+
+    substituteInPlace rime.xml \
+       --replace '/usr' $out
+  '';
+
+  meta = with stdenv.lib; {
+    isIbusEngine = true;
+    description = "Rime input method engine for IBus";
+    homepage = "https://rime.im/";
+    license = licenses.gpl3Plus;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ pengmeiyu ];
+  };
+}
diff --git a/third_party/nixpkgs/pkgs/tools/misc/archi/default.nix b/third_party/nixpkgs/pkgs/tools/misc/archi/default.nix
new file mode 100644
index 0000000000..41562ccbf7
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/tools/misc/archi/default.nix
@@ -0,0 +1,61 @@
+{ stdenv
+, fetchurl
+, fetchzip
+, autoPatchelfHook
+, libsecret
+}:
+
+stdenv.mkDerivation rec {
+  pname = "Archi";
+  version = "4.7.1";
+
+  src =
+    if stdenv.hostPlatform.system == "x86_64-linux" then
+      fetchurl {
+        url = "https://www.archimatetool.com/downloads/archi/Archi-Linux64-${version}.tgz";
+        sha256 = "0sd57cfnh5q2p17sd86c8wgmqyipg29rz6iaa5brq8mwn8ps2fdw";
+      }
+    else if stdenv.hostPlatform.system == "x86_64-darwin" then
+      fetchzip {
+        url = "https://www.archimatetool.com/downloads/archi/Archi-Mac-${version}.zip";
+        sha256 = "1h05lal5jnjwm30dbqvd6gisgrmf1an8xf34f01gs9pwqvqfvmxc";
+      }
+    else
+      throw "Unsupported system";
+
+  buildInputs = [
+    libsecret
+  ];
+
+  nativeBuildInputs = [
+    autoPatchelfHook
+  ];
+
+  installPhase =
+    if stdenv.hostPlatform.system == "x86_64-linux" then
+      ''
+      mkdir -p $out/bin
+        for f in configuration features p2 plugins Archi.ini Archi; do
+          cp $f $out/bin/
+        done
+
+        install -D -m755 Archi $out/bin/Archi
+      ''
+    else
+      ''
+        mkdir -p "$out/Applications"
+        mv Archi.app "$out/Applications/"
+      '';
+
+  meta = with stdenv.lib; {
+    description = "ArchiMate modelling toolkit";
+    longDescription = ''
+      Archi is an open source modelling toolkit to create ArchiMate
+      models and sketches.
+    '';
+    homepage = "https://www.archimatetool.com/";
+    license = licenses.mit;
+    platforms = platforms.linux ++ platforms.darwin;
+    maintainers = with maintainers; [ earldouglas SuperSandro2000 ];
+  };
+}
diff --git a/third_party/nixpkgs/pkgs/tools/misc/broot/default.nix b/third_party/nixpkgs/pkgs/tools/misc/broot/default.nix
index e5c528596b..53b89a0722 100644
--- a/third_party/nixpkgs/pkgs/tools/misc/broot/default.nix
+++ b/third_party/nixpkgs/pkgs/tools/misc/broot/default.nix
@@ -11,14 +11,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "broot";
-  version = "1.0.6";
+  version = "1.0.7";
 
   src = fetchCrate {
     inherit pname version;
-    sha256 = "1yzj1k09yd3q2dff6a6m0xv2v6z681x25g0x5ak41lm5rn3hj8vl";
+    sha256 = "0rxk6dsbn960ikmp6f8a98g3dlibzfy9gcbdina37403kxv8bs6v";
   };
 
-  cargoSha256 = "1axcnr7bzplchpz4cdy5872fmrnzrs1p665c0vmxzs9bgnml5sl8";
+  cargoSha256 = "14fc53xl8f19z8cjrgn6qafiymgirmsin2nzh4i3qprmcc52all8";
 
   nativeBuildInputs = [
     makeWrapper
diff --git a/third_party/nixpkgs/pkgs/tools/misc/cht.sh/default.nix b/third_party/nixpkgs/pkgs/tools/misc/cht.sh/default.nix
index 1c38e7c3b8..ceef26b577 100644
--- a/third_party/nixpkgs/pkgs/tools/misc/cht.sh/default.nix
+++ b/third_party/nixpkgs/pkgs/tools/misc/cht.sh/default.nix
@@ -1,5 +1,6 @@
 { stdenv
 , fetchFromGitHub
+, unstableGitUpdater
 , makeWrapper
 , curl
 , ncurses
@@ -35,6 +36,8 @@ stdenv.mkDerivation {
       --prefix PATH : "${stdenv.lib.makeBinPath [ curl rlwrap ncurses xsel ]}"
   '';
 
+  passthru.updateScript = unstableGitUpdater { };
+
   meta = with stdenv.lib; {
     description = "CLI client for cheat.sh, a community driven cheat sheet";
     license = licenses.mit;
@@ -42,4 +45,3 @@ stdenv.mkDerivation {
     homepage = "https://github.com/chubin/cheat.sh";
   };
 }
-
diff --git a/third_party/nixpkgs/pkgs/tools/misc/fend/default.nix b/third_party/nixpkgs/pkgs/tools/misc/fend/default.nix
index 9d5fbcba23..8813ec5a14 100644
--- a/third_party/nixpkgs/pkgs/tools/misc/fend/default.nix
+++ b/third_party/nixpkgs/pkgs/tools/misc/fend/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "fend";
-  version = "0.1.10";
+  version = "0.1.11";
 
   src = fetchFromGitHub {
     owner = "printfn";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1gs9hmkc25013nk8b7d7pcxcp4jmk4pa4gcki3wgvlrzjl1av7w4";
+    sha256 = "0g9zr2afi103cwv6ikpmmyh5v055dh47l3wj9a1kbxgms0953iwh";
   };
 
-  cargoSha256 = "13lw7isg9lfn6dfngq15qbq619c644ixa5bvb1ja0l3hm3akrs5g";
+  cargoSha256 = "0hydlaibanw2vjyxymfbzgwwk2qjv7jsz15gn66ga5vknsqihcrx";
 
   meta = with lib; {
     description = "Arbitrary-precision unit-aware calculator";
diff --git a/third_party/nixpkgs/pkgs/tools/misc/fluent-bit/default.nix b/third_party/nixpkgs/pkgs/tools/misc/fluent-bit/default.nix
index 486bdfdaa8..2f736a63d9 100644
--- a/third_party/nixpkgs/pkgs/tools/misc/fluent-bit/default.nix
+++ b/third_party/nixpkgs/pkgs/tools/misc/fluent-bit/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "fluent-bit";
-  version = "1.6.5";
+  version = "1.6.6";
 
   src = fetchFromGitHub {
     owner = "fluent";
     repo = "fluent-bit";
     rev = "v${version}";
-    sha256 = "0318fw04fman20hjdjsgix6fg4fp85mrsm3bb629kxn30xi6wsh3";
+    sha256 = "0hkl0wb1xsq7z7gbmblq4fj42llw58lxgvm41z7bliq8a2qg3hv9";
   };
 
   nativeBuildInputs = [ cmake flex bison ];
diff --git a/third_party/nixpkgs/pkgs/tools/misc/geekbench/default.nix b/third_party/nixpkgs/pkgs/tools/misc/geekbench/default.nix
index b2aa0a16f9..a33ae0ed33 100644
--- a/third_party/nixpkgs/pkgs/tools/misc/geekbench/default.nix
+++ b/third_party/nixpkgs/pkgs/tools/misc/geekbench/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "geekbench";
-  version = "5.3.0";
+  version = "5.3.1";
 
   src = fetchurl {
     url = "https://cdn.geekbench.com/Geekbench-${version}-Linux.tar.gz";
-    sha256 = "0g7yj2a3cddaaa0n38zjqq79w5xs3sqa9zwqn2ffr2wr6y80754i";
+    sha256 = "0hil3mvrwpwy60x9s16bf8vgvfv11sdarcbk45zjlgjzfhh8h2qr";
   };
 
   dontConfigure = true;
diff --git a/third_party/nixpkgs/pkgs/tools/misc/goreleaser/default.nix b/third_party/nixpkgs/pkgs/tools/misc/goreleaser/default.nix
index 95944d566d..31e925af6c 100644
--- a/third_party/nixpkgs/pkgs/tools/misc/goreleaser/default.nix
+++ b/third_party/nixpkgs/pkgs/tools/misc/goreleaser/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "goreleaser";
-  version = "0.147.2";
+  version = "0.148.0";
 
   src = fetchFromGitHub {
     owner = "goreleaser";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1pzbwjqnb2l1845dqmx5s2xyxv7088yz2888bjwm0qs8pm1l6spi";
+    sha256 = "11dzh5scfwf8lm0rw5f3z0plix5p4mmvgigzav2g59p0wdw3v3jy";
   };
 
-  vendorSha256 = "1qwggbgfvgx1anh55jx2lj0x59h5j3wixb8r2ylaynrrxx1b167w";
+  vendorSha256 = "17l15z2wyxzh7h7hvb1fysdnyg8wr8ww827vvmki73s1plfgr80d";
 
   buildFlagsArray = [
     "-ldflags="
diff --git a/third_party/nixpkgs/pkgs/tools/misc/hdl-dump/default.nix b/third_party/nixpkgs/pkgs/tools/misc/hdl-dump/default.nix
new file mode 100644
index 0000000000..96e81fe8bd
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/tools/misc/hdl-dump/default.nix
@@ -0,0 +1,35 @@
+{ stdenv
+, fetchFromGitHub
+, upx
+}:
+
+let
+  version = "20202807";
+  pname = "hdl-dump";
+in stdenv.mkDerivation {
+  inherit pname version;
+
+  # Using AkuHAK's repo because playstation2's repo is outdated
+  src = fetchFromGitHub {
+    owner = "AKuHAK";
+    repo = pname;
+    rev = "be37e112a44772a1341c867dc3dfee7381ce9e59";
+    sha256 = "0akxak6hm11h8z6jczxgr795s4a8czspwnhl3swqxp803dvjdx41";
+  };
+
+  buildInputs = [ upx ];
+
+  makeFlags = [ "RELEASE=yes" ];
+
+  installPhase = ''
+    install -Dm755 hdl_dump -t $out/bin
+  '';
+
+  meta = with stdenv.lib; {
+    homepage = "https://github.com/AKuHAK/hdl-dump";
+    description = "PlayStation 2 HDLoader image dump/install utility";
+    platforms = platforms.linux;
+    license = licenses.gpl2Only;
+    maintainers = with maintainers; [ makefu ];
+  };
+}
diff --git a/third_party/nixpkgs/pkgs/tools/misc/idevicerestore/default.nix b/third_party/nixpkgs/pkgs/tools/misc/idevicerestore/default.nix
index 5a60641144..ab22e413b0 100644
--- a/third_party/nixpkgs/pkgs/tools/misc/idevicerestore/default.nix
+++ b/third_party/nixpkgs/pkgs/tools/misc/idevicerestore/default.nix
@@ -4,6 +4,7 @@
 , libirecovery
 , libzip
 , libusbmuxd
+, IOKit
 }:
 
 stdenv.mkDerivation rec {
@@ -31,7 +32,7 @@ stdenv.mkDerivation rec {
     # Not listing other dependencies specified in
     # https://github.com/libimobiledevice/idevicerestore/blob/8a882038b2b1e022fbd19eaf8bea51006a373c06/README#L20
     # because they are inherited `libimobiledevice`.
-  ];
+  ] ++ stdenv.lib.optionals stdenv.isDarwin [ IOKit ];
 
   meta = with stdenv.lib; {
     homepage = "https://github.com/libimobiledevice/idevicerestore";
@@ -51,8 +52,8 @@ stdenv.mkDerivation rec {
       This will download and restore a device to the latest firmware available.
     '';
     license = licenses.lgpl21Plus;
-    # configure.ac suggests it should work for darwin and mingw as well but not tried yet
-    platforms = platforms.linux;
+    # configure.ac suggests it should work for mingw as well but not tried yet
+    platforms = platforms.linux ++ platforms.darwin;
     maintainers = with maintainers; [ nh2 ];
   };
 }
diff --git a/third_party/nixpkgs/pkgs/tools/misc/rmtrash/default.nix b/third_party/nixpkgs/pkgs/tools/misc/rmtrash/default.nix
index 073871b0f4..d50079f82c 100644
--- a/third_party/nixpkgs/pkgs/tools/misc/rmtrash/default.nix
+++ b/third_party/nixpkgs/pkgs/tools/misc/rmtrash/default.nix
@@ -3,13 +3,13 @@
 
 stdenv.mkDerivation rec {
   pname = "rmtrash";
-  version = "1.13";
+  version = "1.14";
 
   src = fetchFromGitHub {
     owner = "PhrozenByte";
     repo = pname;
     rev = "v${version}";
-    sha256 = "04a9c65wnkq1fj8qhdsdbps88xjbp7rn6p27y25v47kaysvrw01j";
+    sha256 = "0wfb2ykzlsxyqn9krfsis9jxhaxy3pxl71a4f15an1ngfndai694";
   };
 
   dontConfigure = true;
diff --git a/third_party/nixpkgs/pkgs/tools/misc/spigot/default.nix b/third_party/nixpkgs/pkgs/tools/misc/spigot/default.nix
index fbed27a244..8321d03a48 100644
--- a/third_party/nixpkgs/pkgs/tools/misc/spigot/default.nix
+++ b/third_party/nixpkgs/pkgs/tools/misc/spigot/default.nix
@@ -11,11 +11,11 @@
 
 stdenv.mkDerivation rec {
   pname = "spigot";
-  version = "20200101";
+  version = "20200901";
   src = fetchgit {
     url = "https://git.tartarus.org/simon/spigot.git";
-    rev = "b1b0b202b3523b72f0638fb31fd49c47f4abb39c";
-    sha256 = "0lh5v42aia1hvhsqzs515q0anrjc6c2s9bjklfaap5gz0cg59wbv";
+    rev = "9910e5bdc203bae6b7bbe1ed4a93f13755c1cae";
+    sha256 = "1az6v9gk0g2k197lr288nmr9jv20bvgc508vn9ic3v7mav7hf5bf";
   };
 
   nativeBuildInputs = [ autoreconfHook halibut perl ];
diff --git a/third_party/nixpkgs/pkgs/tools/misc/toybox/default.nix b/third_party/nixpkgs/pkgs/tools/misc/toybox/default.nix
index 23fdc2f713..9b38db5a72 100644
--- a/third_party/nixpkgs/pkgs/tools/misc/toybox/default.nix
+++ b/third_party/nixpkgs/pkgs/tools/misc/toybox/default.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "toybox";
-  version = "0.8.3";
+  version = "0.8.4";
 
   src = fetchFromGitHub {
     owner = "landley";
     repo = pname;
     rev = version;
-    sha256 = "0cb1n0skanwwkwgzlswwhvfb4iji1bw9iqskmczlhakpw3j1yaqa";
+    sha256 = "0cgbmv6qk1haj709hjx5q4sl7wgh91i459gzs1203adwc7rvk6jv";
   };
 
   buildInputs = lib.optionals enableStatic [ stdenv.cc.libc stdenv.cc.libc.static ];
@@ -60,6 +60,8 @@ stdenv.mkDerivation rec {
     homepage = "https://landley.net/toybox/";
     license = licenses.bsd0;
     platforms = with platforms; linux ++ darwin ++ freebsd;
+    # https://github.com/NixOS/nixpkgs/issues/101229
+    broken = stdenv.isDarwin;
     maintainers = with maintainers; [ hhm ];
     priority = 10;
   };
diff --git a/third_party/nixpkgs/pkgs/tools/misc/vector/default.nix b/third_party/nixpkgs/pkgs/tools/misc/vector/default.nix
index 1525d3a229..d7b141153f 100644
--- a/third_party/nixpkgs/pkgs/tools/misc/vector/default.nix
+++ b/third_party/nixpkgs/pkgs/tools/misc/vector/default.nix
@@ -62,6 +62,6 @@ rustPlatform.buildRustPackage rec {
     description = "A high-performance logs, metrics, and events router";
     homepage    = "https://github.com/timberio/vector";
     license     = with licenses; [ asl20 ];
-    maintainers = with maintainers; [ thoughtpolice ];
+    maintainers = with maintainers; [ thoughtpolice happysalada ];
   };
 }
diff --git a/third_party/nixpkgs/pkgs/tools/misc/youtube-dl/default.nix b/third_party/nixpkgs/pkgs/tools/misc/youtube-dl/default.nix
index 8fa46a7869..a7b4247149 100644
--- a/third_party/nixpkgs/pkgs/tools/misc/youtube-dl/default.nix
+++ b/third_party/nixpkgs/pkgs/tools/misc/youtube-dl/default.nix
@@ -18,11 +18,11 @@ buildPythonPackage rec {
   # The websites youtube-dl deals with are a very moving target. That means that
   # downloads break constantly. Because of that, updates should always be backported
   # to the latest stable release.
-  version = "2020.11.29";
+  version = "2020.12.02";
 
   src = fetchurl {
     url = "https://yt-dl.org/downloads/${version}/${pname}-${version}.tar.gz";
-    sha256 = "10px5wnsjw4lzdh75810q4sjbhnd7cjxwpa3crapd3yj0f3bwa76";
+    sha256 = "0wkslmqiydlzrla4wx67757b18r4l9h42fkfzdcxx6n0ygiv4qbi";
   };
 
   nativeBuildInputs = [ installShellFiles makeWrapper ];
diff --git a/third_party/nixpkgs/pkgs/tools/networking/gnirehtet/default.nix b/third_party/nixpkgs/pkgs/tools/networking/gnirehtet/default.nix
index f739e80be1..8d7d2392df 100644
--- a/third_party/nixpkgs/pkgs/tools/networking/gnirehtet/default.nix
+++ b/third_party/nixpkgs/pkgs/tools/networking/gnirehtet/default.nix
@@ -1,12 +1,12 @@
-{stdenv, rustPlatform, fetchFromGitHub, fetchzip, androidenv, substituteAll}:
+{ stdenv, rustPlatform, fetchFromGitHub, fetchzip, androidenv, makeWrapper }:
 let
-version = "2.4";
+version = "2.5";
 apk = stdenv.mkDerivation {
   pname = "gnirehtet.apk";
   inherit version;
   src = fetchzip {
     url = "https://github.com/Genymobile/gnirehtet/releases/download/v${version}/gnirehtet-rust-linux64-v${version}.zip";
-    sha256 = "13gsh5982v961j86j5y71pgas94g2d1v1fgnbslbqw4h69fbf48g";
+    sha256 = "1db0gkg5z8lighhkyqfsr9jiacrck89zmfnmp74vj865hhxgjzgq";
   };
   installPhase = ''
     mkdir $out
@@ -22,19 +22,18 @@ rustPlatform.buildRustPackage {
       owner = "Genymobile";
       repo = "gnirehtet";
       rev = "v${version}";
-      sha256 = "1c99d6zpjxa8xlrg0n1825am20d2pjiicfcjwv8iay9ylfdnvygl";
+      sha256 = "0wk6n082gnj9xk46n542h1012h8gyhldca23bs7vl73g0534g878";
   };
   sourceRoot = "source/relay-rust";
-  cargoSha256 = "0rb5xcqg5ikgrxpmzrql5n298j50aqgkkp45znbfv2x2n40dywad";
+  cargoSha256 = "0i7f52r697gjw30m8k60hd3y6wsn5lpz419r083a1rhpbinzd26q";
 
-  patchFlags = [ "-p2" ];
-  patches = [
-    (substituteAll {
-      src = ./paths.patch;
-      adb = "${androidenv.androidPkgs_9_0.platform-tools}/bin/adb";
-      inherit apk;
-    })
-  ];
+  nativeBuildInputs = [ makeWrapper ];
+
+  postInstall = ''
+    wrapProgram $out/bin/gnirehtet \
+    --set GNIREHTET_APK ${apk}/gnirehtet.apk \
+    --set ADB ${androidenv.androidPkgs_9_0.platform-tools}/bin/adb
+  '';
 
   meta = with stdenv.lib; {
     description = "Reverse tethering over adb for Android";
diff --git a/third_party/nixpkgs/pkgs/tools/networking/gnirehtet/paths.patch b/third_party/nixpkgs/pkgs/tools/networking/gnirehtet/paths.patch
deleted file mode 100644
index e5df4b8e4f..0000000000
--- a/third_party/nixpkgs/pkgs/tools/networking/gnirehtet/paths.patch
+++ /dev/null
@@ -1,48 +0,0 @@
-Index: gnirehtet/relay-rust/src/main.rs
-===================================================================
---- gnirehtet.orig/relay-rust/src/main.rs
-+++ gnirehtet/relay-rust/src/main.rs
-@@ -299,7 +299,7 @@ impl Command for RelayCommand {
- 
- fn cmd_install(serial: Option<&String>) -> Result<(), CommandExecutionError> {
-     info!(target: TAG, "Installing gnirehtet client...");
--    exec_adb(serial, vec!["install", "-r", "gnirehtet.apk"])
-+    exec_adb(serial, vec!["install", "-r", "@apk@/gnirehtet.apk"])
- }
- 
- fn cmd_uninstall(serial: Option<&String>) -> Result<(), CommandExecutionError> {
-@@ -464,8 +464,8 @@ fn exec_adb<S: Into<String>>(
-     args: Vec<S>,
- ) -> Result<(), CommandExecutionError> {
-     let adb_args = create_adb_args(serial, args);
--    debug!(target: TAG, "Execute: adb {:?}", adb_args);
--    match process::Command::new("adb").args(&adb_args[..]).status() {
-+    debug!(target: TAG, "Execute: @adb@ {:?}", adb_args);
-+    match process::Command::new("@adb@").args(&adb_args[..]).status() {
-         Ok(exit_status) => {
-             if exit_status.success() {
-                 Ok(())
-@@ -487,8 +487,8 @@ fn must_install_client(serial: Option<&S
-         serial,
-         vec!["shell", "dumpsys", "package", "com.genymobile.gnirehtet"],
-     );
--    debug!(target: TAG, "Execute: adb {:?}", args);
--    match process::Command::new("adb").args(&args[..]).output() {
-+    debug!(target: TAG, "Execute: @adb@ {:?}", args);
-+    match process::Command::new("@adb@").args(&args[..]).output() {
-         Ok(output) => {
-             if output.status.success() {
-                 // the "regex" crate makes the binary far bigger, so just parse the versionCode
-Index: gnirehtet/relay-rust/src/adb_monitor.rs
-===================================================================
---- gnirehtet.orig/relay-rust/src/adb_monitor.rs
-+++ gnirehtet/relay-rust/src/adb_monitor.rs
-@@ -206,7 +206,7 @@ impl AdbMonitor {
-
-     fn start_adb_daemon() -> bool {
-         info!(target: TAG, "Restarting adb daemon");
--        match process::Command::new("adb")
-+        match process::Command::new("@adb@")
-             .args(&["start-server"])
-             .status() {
-             Ok(exit_status) => {
diff --git a/third_party/nixpkgs/pkgs/tools/networking/gping/default.nix b/third_party/nixpkgs/pkgs/tools/networking/gping/default.nix
index 56fe9b1468..ece9c47ae6 100644
--- a/third_party/nixpkgs/pkgs/tools/networking/gping/default.nix
+++ b/third_party/nixpkgs/pkgs/tools/networking/gping/default.nix
@@ -5,16 +5,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "gping";
-  version = "0.1.7";
+  version = "1.0.1-post2";
 
   src = fetchFromGitHub {
     owner = "orf";
     repo = "gping";
     rev = "v${version}";
-    sha256 = "0sdv6mf7mrgsdinv94mhai5jaw04s6r9cq0wxkph9b4hhywi0lys";
+    sha256 = "0cvbwxvq1cj9xcjc3hnxrpq9yrmfkapy533cbjzsjmvgiqk11hps";
   };
 
-  cargoSha256 = "0rrqjlyn7k8f7ndzra16a9k4l6mjfim84lfi886q3irbn234b1va";
+  cargoSha256 = "0vdhincvfassj7gbiplwbi43yyic3l6wlc32s6ci68b2wjmff8pn";
 
   meta = with lib; {
     description = "Ping, but with a graph";
diff --git a/third_party/nixpkgs/pkgs/tools/networking/haproxy/default.nix b/third_party/nixpkgs/pkgs/tools/networking/haproxy/default.nix
index 2c1732007b..9f01962250 100644
--- a/third_party/nixpkgs/pkgs/tools/networking/haproxy/default.nix
+++ b/third_party/nixpkgs/pkgs/tools/networking/haproxy/default.nix
@@ -11,11 +11,11 @@ assert usePcre -> pcre != null;
 
 stdenv.mkDerivation rec {
   pname = "haproxy";
-  version = "2.3.1";
+  version = "2.3.2";
 
   src = fetchurl {
     url = "https://www.haproxy.org/download/${stdenv.lib.versions.majorMinor version}/src/${pname}-${version}.tar.gz";
-    sha256 = "0jyaxwgghvgd599acxr91hr2v4wyv3bd1j45k0gb4q2v58jz2fwd";
+    sha256 = "1mcg0d6qiwl3xps65ir2sv5sc868zla5wnfhk24d2b0sg6xp7jwr";
   };
 
   buildInputs = [ openssl zlib ]
diff --git a/third_party/nixpkgs/pkgs/tools/networking/i2pd/default.nix b/third_party/nixpkgs/pkgs/tools/networking/i2pd/default.nix
index 1439b62bc9..8bf90293a8 100644
--- a/third_party/nixpkgs/pkgs/tools/networking/i2pd/default.nix
+++ b/third_party/nixpkgs/pkgs/tools/networking/i2pd/default.nix
@@ -9,13 +9,13 @@ assert upnpSupport -> miniupnpc != null;
 
 stdenv.mkDerivation rec {
   pname = "i2pd";
-  version = "2.34.0";
+  version = "2.35.0";
 
   src = fetchFromGitHub {
     owner = "PurpleI2P";
     repo = pname;
     rev = version;
-    sha256 = "0ibk222fwgjaxrmhrk5avcmmbj52ibcsydm2m02xnlpr8kcqsjnc";
+    sha256 = "0bpkgq7srwpjmadsz3nsd14jpr19b1zfrpc074lzjaq15icxxgxc";
   };
 
   buildInputs = with stdenv.lib; [ boost zlib openssl ]
diff --git a/third_party/nixpkgs/pkgs/tools/networking/minio-client/default.nix b/third_party/nixpkgs/pkgs/tools/networking/minio-client/default.nix
index 2c626e81cd..e452719a49 100644
--- a/third_party/nixpkgs/pkgs/tools/networking/minio-client/default.nix
+++ b/third_party/nixpkgs/pkgs/tools/networking/minio-client/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "minio-client";
-  version = "2020-11-17T00-39-14Z";
+  version = "2020-11-25T23-04-07Z";
 
   src = fetchFromGitHub {
     owner = "minio";
     repo = "mc";
     rev = "RELEASE.${version}";
-    sha256 = "122fb9ghxwjifhvwiw07pm3szqfj3pc55m4bhq3v8nshzwrbcjf4";
+    sha256 = "0r4za7jnwmh2wna5l4iv5pz6s5c62f7v4hmbv7misff9qbk4p4k7";
   };
 
-  vendorSha256 = "148fb86v059skcf8dgcrqibwkl1h4lbwi60qnwmdi03q6rvaw33m";
+  vendorSha256 = "0zracgqwhqs3gabrqqm8fm3hyicaadcinsjp5qgprjwd9a3c1zfv";
 
   doCheck = false;
 
diff --git a/third_party/nixpkgs/pkgs/tools/networking/modem-manager/default.nix b/third_party/nixpkgs/pkgs/tools/networking/modem-manager/default.nix
index c3981b902f..7bad593e4d 100644
--- a/third_party/nixpkgs/pkgs/tools/networking/modem-manager/default.nix
+++ b/third_party/nixpkgs/pkgs/tools/networking/modem-manager/default.nix
@@ -3,12 +3,12 @@
 
 stdenv.mkDerivation rec {
   pname = "modem-manager";
-  version = "1.12.10";
+  version = "1.14.8";
 
   package = "ModemManager";
   src = fetchurl {
     url = "https://www.freedesktop.org/software/${package}/${package}-${version}.tar.xz";
-    sha256 = "1apq9camys2gaw6y6ic1ld20cncfwpmxnzvh4j5zkbbjpf5hbcxj";
+    sha256 = "15cjy7zzsxagx649vz0990avin47vpgdmm4ss2msggdla6x2c6py";
   };
 
   nativeBuildInputs = [ vala gobject-introspection gettext pkgconfig ];
diff --git a/third_party/nixpkgs/pkgs/tools/networking/openssh/default.nix b/third_party/nixpkgs/pkgs/tools/networking/openssh/default.nix
index a8199273c7..f8a518ca4d 100644
--- a/third_party/nixpkgs/pkgs/tools/networking/openssh/default.nix
+++ b/third_party/nixpkgs/pkgs/tools/networking/openssh/default.nix
@@ -53,6 +53,9 @@ stdenv.mkDerivation rec {
       ./dont_create_privsep_path.patch
 
       ./ssh-keysign.patch
+
+      # See https://github.com/openssh/openssh-portable/pull/206
+      ./ssh-copy-id-fix-eof.patch
     ]
     ++ optional withGssapiPatches (assert withKerberos; gssapiPatch);
 
diff --git a/third_party/nixpkgs/pkgs/tools/networking/openssh/ssh-copy-id-fix-eof.patch b/third_party/nixpkgs/pkgs/tools/networking/openssh/ssh-copy-id-fix-eof.patch
new file mode 100644
index 0000000000..4ba2b562f5
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/tools/networking/openssh/ssh-copy-id-fix-eof.patch
@@ -0,0 +1,21 @@
+diff --git a/contrib/ssh-copy-id b/contrib/ssh-copy-id
+index 392f64f..a769077 100644
+--- a/contrib/ssh-copy-id
++++ b/contrib/ssh-copy-id
+@@ -247,7 +247,7 @@ installkeys_sh() {
+   #    the -z `tail ...` checks for a trailing newline. The echo adds one if was missing
+   #    the cat adds the keys we're getting via STDIN
+   #    and if available restorecon is used to restore the SELinux context
+-  INSTALLKEYS_SH=$(tr '\t\n' ' ' <<-EOF)
++  INSTALLKEYS_SH=$(tr '\t\n' ' ' <<-EOF
+ 	cd;
+ 	umask 077;
+ 	mkdir -p $(dirname "${AUTH_KEY_FILE}") &&
+@@ -258,6 +258,7 @@ installkeys_sh() {
+ 	  restorecon -F .ssh ${AUTH_KEY_FILE};
+ 	fi
+ EOF
++  )
+ 
+   # to defend against quirky remote shells: use 'exec sh -c' to get POSIX;
+   printf "exec sh -c '%s'" "${INSTALLKEYS_SH}"
diff --git a/third_party/nixpkgs/pkgs/tools/networking/tridactyl-native/default.nix b/third_party/nixpkgs/pkgs/tools/networking/tridactyl-native/default.nix
index c0a132b481..1ebd8d8be6 100644
--- a/third_party/nixpkgs/pkgs/tools/networking/tridactyl-native/default.nix
+++ b/third_party/nixpkgs/pkgs/tools/networking/tridactyl-native/default.nix
@@ -7,13 +7,13 @@ stdenv.mkDerivation rec {
   pname = "tridactyl-native";
   # this is actually the version of tridactyl itself; the native messenger will
   # probably not change with every tridactyl version
-  version = "1.20.2";
+  version = "1.20.3";
 
   src = fetchFromGitHub {
     owner = "tridactyl";
     repo = "tridactyl";
     rev = version;
-    sha256 = "0yz1vbqa3sppkjmny5ipnspsdi5gnix7wb6hzvdkm9h1rj2kb8ci";
+    sha256 = "064cl9m4hdv69q1af0xjcf2rf30n3pvz6ym2l53w90aq3217amps";
   };
   sourceRoot = "source/native";
 
diff --git a/third_party/nixpkgs/pkgs/tools/package-management/nfpm/default.nix b/third_party/nixpkgs/pkgs/tools/package-management/nfpm/default.nix
index 66ea91a56d..f10b90d017 100644
--- a/third_party/nixpkgs/pkgs/tools/package-management/nfpm/default.nix
+++ b/third_party/nixpkgs/pkgs/tools/package-management/nfpm/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "nfpm";
-  version = "1.10.1";
+  version = "1.10.2";
 
   src = fetchFromGitHub {
     owner = "goreleaser";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1j9b6kkhlw2sx6qwnxkhsk7bj9vm2vr0z1hj1jf257fxw9m2q6mz";
+    sha256 = "08qz9zfk19iwf8qfv7vmzvbl8w1vpjrry25w3pxsg93gyjw8v7mi";
   };
 
-  vendorSha256 = "0x7r7qn4852q57fx5mcrw3aqdydmidk9g0hvj6apj81q77k5svqs";
+  vendorSha256 = "0qnfd47ykb6g28d3mnfncgmkvqd1myx47x563sxx4lcsq542q83n";
 
   doCheck = false;
 
diff --git a/third_party/nixpkgs/pkgs/tools/package-management/nix/default.nix b/third_party/nixpkgs/pkgs/tools/package-management/nix/default.nix
index 42eae8d9ff..c17a1a82d9 100644
--- a/third_party/nixpkgs/pkgs/tools/package-management/nix/default.nix
+++ b/third_party/nixpkgs/pkgs/tools/package-management/nix/default.nix
@@ -199,13 +199,13 @@ in rec {
 
   nixUnstable = lib.lowPrio (callPackage common rec {
     name = "nix-2.4${suffix}";
-    suffix = "pre20201118_79aa7d9";
+    suffix = "pre20201201_5a6ddb3";
 
     src = fetchFromGitHub {
       owner = "NixOS";
       repo = "nix";
-      rev = "79aa7d95183cbe6c0d786965f0dbff414fd1aa67";
-      sha256 = "0aa0xggrczylwp3da3q9m4ad9j6gzi7wpa3ph4i8a1ng36kl91c7";
+      rev = "5a6ddb3de14a1684af6c793d663764d093fa7846";
+      sha256 = "0qhd3nxvqzszzsfvh89xhd239ycqb0kq2n0bzh9br78pcb60vj3g";
     };
 
     inherit storeDir stateDir confDir boehmgc;
diff --git a/third_party/nixpkgs/pkgs/tools/security/1password-gui/default.nix b/third_party/nixpkgs/pkgs/tools/security/1password-gui/default.nix
index 9761bf112b..777e7292fd 100644
--- a/third_party/nixpkgs/pkgs/tools/security/1password-gui/default.nix
+++ b/third_party/nixpkgs/pkgs/tools/security/1password-gui/default.nix
@@ -2,22 +2,17 @@
 , fetchurl
 , appimageTools
 , makeWrapper
-, electron_9
+, electron_11
 , openssl
 }:
 
-let
-  electron = electron_9;
-
-in
-
 stdenv.mkDerivation rec {
   pname = "1password";
-  version = "0.9.5-2";
+  version = "0.9.6";
 
   src = fetchurl {
     url = "https://onepassword.s3.amazonaws.com/linux/appimage/${pname}-${version}.AppImage";
-    sha256 = "1fj8gab5frxnzx6cafkcxmic9z1wvfqi4v511wsg9dy4mn5dc6qw";
+    sha256 = "0464a5d39g20hif3dz3qr78dqb0cmxbazy0q48j9gkawhxm30c1h";
   };
 
   nativeBuildInputs = [ makeWrapper ];
@@ -51,7 +46,7 @@ stdenv.mkDerivation rec {
     cp -a ${appimageContents}/usr/share/icons $out/share
 
     # Wrap the application with Electron.
-    makeWrapper "${electron}/bin/electron" "$out/bin/${pname}" \
+    makeWrapper "${electron_11}/bin/electron" "$out/bin/${pname}" \
       --add-flags "$out/share/${pname}/resources/app.asar" \
       --prefix LD_LIBRARY_PATH : "${stdenv.lib.makeLibraryPath runtimeLibs}"
   '';
diff --git a/third_party/nixpkgs/pkgs/tools/security/bash-supergenpass/default.nix b/third_party/nixpkgs/pkgs/tools/security/bash-supergenpass/default.nix
index f72c916acf..53bc45acf8 100644
--- a/third_party/nixpkgs/pkgs/tools/security/bash-supergenpass/default.nix
+++ b/third_party/nixpkgs/pkgs/tools/security/bash-supergenpass/default.nix
@@ -1,8 +1,14 @@
-{ stdenv, fetchFromGitHub, makeWrapper, openssl, coreutils, gnugrep }:
+{ stdenv
+, fetchFromGitHub
+, unstableGitUpdater
+, makeWrapper
+, openssl
+, coreutils
+, gnugrep }:
 
 stdenv.mkDerivation {
-  pname = "bash-supergenpass-unstable";
-  version = "2018-04-18";
+  pname = "bash-supergenpass";
+  version = "unstable-2018-04-18";
 
   nativeBuildInputs = [ makeWrapper ];
 
@@ -18,6 +24,8 @@ stdenv.mkDerivation {
     wrapProgram "$out/bin/supergenpass" --prefix PATH : "${stdenv.lib.makeBinPath [ openssl coreutils gnugrep ]}"
   '';
 
+  passthru.updateScript = unstableGitUpdater { };
+
   meta = with stdenv.lib; {
     description = "Bash shell-script implementation of SuperGenPass password generation";
     longDescription = ''
@@ -36,4 +44,3 @@ stdenv.mkDerivation {
     homepage = "https://github.com/lanzz/bash-supergenpass";
   };
 }
-
diff --git a/third_party/nixpkgs/pkgs/tools/security/doas/default.nix b/third_party/nixpkgs/pkgs/tools/security/doas/default.nix
index 6aa9759aff..6867256ea9 100644
--- a/third_party/nixpkgs/pkgs/tools/security/doas/default.nix
+++ b/third_party/nixpkgs/pkgs/tools/security/doas/default.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation rec {
   pname = "doas";
-  version = "6.6.1";
+  version = "6.8";
 
   src = fetchFromGitHub {
     owner = "Duncaen";
     repo = "OpenDoas";
     rev = "v${version}";
-    sha256 = "07kkc5729p654jrgfsc8zyhiwicgmq38yacmwfvay2b3gmy728zn";
+    sha256 = "1dlwnvy8r6slxcy260gfkximp1ms510wdslpfq9y6xvd2qi5izcb";
   };
 
   # otherwise confuses ./configure
@@ -35,7 +35,7 @@ stdenv.mkDerivation rec {
   ];
 
   postPatch = ''
-    sed -i '/\(chown\|chmod\)/d' bsd.prog.mk
+    sed -i '/\(chown\|chmod\)/d' GNUmakefile
   '';
 
   buildInputs = [ bison pam ];
diff --git a/third_party/nixpkgs/pkgs/tools/security/volatility/default.nix b/third_party/nixpkgs/pkgs/tools/security/volatility/default.nix
index 8cf904c39c..4f1e90eb91 100644
--- a/third_party/nixpkgs/pkgs/tools/security/volatility/default.nix
+++ b/third_party/nixpkgs/pkgs/tools/security/volatility/default.nix
@@ -1,12 +1,14 @@
-{ stdenv, fetchurl, pythonPackages }:
+{ stdenv, fetchFromGitHub, pythonPackages }:
 
 pythonPackages.buildPythonApplication rec {
-  version = "2.6";
   pname = "volatility";
+  version = "2.6.1";
 
-  src = fetchurl {
-    url = "https://downloads.volatilityfoundation.org/releases/${version}/${pname}-${version}.zip";
-    sha256 = "15cjrx31nnqa3bpjkv0x05j7f2sb7pq46a72zh7qg55zf86hawsv";
+  src = fetchFromGitHub {
+    owner = "volatilityfoundation";
+    repo = pname;
+    rev = version;
+    sha256 = "1v92allp3cv3akk71kljcwxr27h1k067dsq7j9h8jnlwk9jxh6rf";
   };
 
   doCheck = false;
diff --git a/third_party/nixpkgs/pkgs/tools/system/daemon/default.nix b/third_party/nixpkgs/pkgs/tools/system/daemon/default.nix
index 6763b476f3..29f976998d 100644
--- a/third_party/nixpkgs/pkgs/tools/system/daemon/default.nix
+++ b/third_party/nixpkgs/pkgs/tools/system/daemon/default.nix
@@ -1,15 +1,18 @@
-{stdenv, fetchurl, perl}:
+{ stdenv, fetchurl, perl }:
+
+stdenv.mkDerivation rec {
+  pname = "daemon";
+  version = "0.7";
 
-stdenv.mkDerivation {
-  name = "daemon-0.6.4";
   src = fetchurl {
-    url = "http://libslack.org/daemon/download/daemon-0.6.4.tar.gz";
-    sha256 = "18aw0f8k3j30xqwv4z03962kdpqd10nf1w9liihylmadlx5fmff4";
+    url = "http://libslack.org/daemon/download/daemon-${version}.tar.gz";
+    sha256 = "0b17zzl7bqnkn7a4pr3l6fxqfmxfld7izphrab5nvhc4wzng4spn";
   };
+
   makeFlags = [ "PREFIX=$(out)" ];
   buildInputs = [ perl ];
 
-  meta = {
+  meta = with stdenv.lib; {
     description = "Turns other processes into daemons";
     longDescription = ''
       Daemon turns other process into daemons. There are many tasks that need
@@ -18,8 +21,8 @@ stdenv.mkDerivation {
       writing daemons in languages other than C, C++ or Perl (e.g. /bin/sh,
       Java).
     '';
-    license = stdenv.lib.licenses.gpl2Plus;
-    maintainers = [ stdenv.lib.maintainers.sander ];
-    platforms = stdenv.lib.platforms.unix;
+    license = licenses.gpl2Plus;
+    maintainers = [ maintainers.sander ];
+    platforms = platforms.unix;
   };
 }
diff --git a/third_party/nixpkgs/pkgs/tools/system/rocm-smi/default.nix b/third_party/nixpkgs/pkgs/tools/system/rocm-smi/default.nix
index 1ef25fd082..1ed1d91351 100644
--- a/third_party/nixpkgs/pkgs/tools/system/rocm-smi/default.nix
+++ b/third_party/nixpkgs/pkgs/tools/system/rocm-smi/default.nix
@@ -2,13 +2,13 @@
 
 buildPythonApplication rec {
   pname = "rocm-smi";
-  version = "3.9.0";
+  version = "3.10.0";
 
   src = fetchFromGitHub {
     owner = "RadeonOpenCompute";
     repo = "ROC-smi";
     rev = "rocm-${version}";
-    sha256 = "190x31s7mjpyp7hr6cgdnvn2s20qj3sqcxywycjm2i9ar429l2ni";
+    hash = "sha256-0QqaBMkqRVEl89x3hvWQGAgt7LbtMZPhuf7KenQYHaQ=";
   };
 
   format = "other";
diff --git a/third_party/nixpkgs/pkgs/tools/text/gnugrep/default.nix b/third_party/nixpkgs/pkgs/tools/text/gnugrep/default.nix
index 19ef3aacc6..08b588691e 100644
--- a/third_party/nixpkgs/pkgs/tools/text/gnugrep/default.nix
+++ b/third_party/nixpkgs/pkgs/tools/text/gnugrep/default.nix
@@ -5,7 +5,7 @@
 # cgit) that are needed here should be included directly in Nixpkgs as
 # files.
 
-let version = "3.5"; in
+let version = "3.6"; in
 
 stdenv.mkDerivation {
   pname = "gnugrep";
@@ -13,7 +13,7 @@ stdenv.mkDerivation {
 
   src = fetchurl {
     url = "mirror://gnu/grep/grep-${version}.tar.xz";
-    sha256 = "0jm4hynsqf32rw1j3kv239wzg47qm6glqh6841ar9ay20xvwfamq";
+    sha256 = "0gipv6bzkm1aihj0ncqpyh164xrzgcxcv9r1kwzyk2g1mzl1azk6";
   };
 
   # Perl is needed for testing
diff --git a/third_party/nixpkgs/pkgs/tools/text/miller/default.nix b/third_party/nixpkgs/pkgs/tools/text/miller/default.nix
index 3bacd53c71..ca71c3a1b3 100644
--- a/third_party/nixpkgs/pkgs/tools/text/miller/default.nix
+++ b/third_party/nixpkgs/pkgs/tools/text/miller/default.nix
@@ -3,13 +3,13 @@
 stdenv.mkDerivation rec {
   pname = "miller";
 
-  version = "5.9.1";
+  version = "5.10.0";
 
   src = fetchFromGitHub {
     owner = "johnkerl";
     repo = "miller";
     rev = "v${version}";
-    sha256 = "1i9bcpfjnl2yjnfmf0ar1l62zwq01ph0yylz0dby8k2l7cvq5ci6";
+    sha256 = "02jqbxnchljyqnmlbxjaf5zpdi03gxapfy38dfikl5j4f7yyxvjs";
   };
 
   nativeBuildInputs = [ autoreconfHook flex libtool ];
diff --git a/third_party/nixpkgs/pkgs/tools/text/pbgopy/default.nix b/third_party/nixpkgs/pkgs/tools/text/pbgopy/default.nix
new file mode 100644
index 0000000000..3972d3dc9b
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/tools/text/pbgopy/default.nix
@@ -0,0 +1,22 @@
+{ stdenv, buildGoModule, fetchFromGitHub }:
+
+buildGoModule rec {
+  pname = "pbgopy";
+  version = "0.1.1";
+
+  src = fetchFromGitHub {
+    owner = "nakabonne";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "17rk15hs7kg9m1vphh1gjny7sqnk80qw61jn8qyxcmw2n55rkmfp";
+  };
+
+  vendorSha256 = "1ak3hd979395grbns9p5sw5f45plcqq6vg7j7v8n7xqc20s2l8m9";
+
+  meta = with stdenv.lib; {
+    description = "Copy and paste between devices";
+    homepage = "https://github.com/nakabonne/pbgopy";
+    license = licenses.mit;
+    maintainers = [ maintainers.ivar ];
+  };
+}
diff --git a/third_party/nixpkgs/pkgs/tools/text/rst2html5/default.nix b/third_party/nixpkgs/pkgs/tools/text/rst2html5/default.nix
index d20ce99dd7..6f484bed8b 100644
--- a/third_party/nixpkgs/pkgs/tools/text/rst2html5/default.nix
+++ b/third_party/nixpkgs/pkgs/tools/text/rst2html5/default.nix
@@ -1,19 +1,22 @@
-{ stdenv, fetchurl, pythonPackages }:
+{ lib, python3Packages }:
 
-pythonPackages.buildPythonPackage rec {
+let
   pname = "rst2html5";
-  version = "1.9.4";
+  version = "1.10.6";
+in python3Packages.buildPythonPackage {
+  inherit pname version;
+  format = "wheel";
 
-  src = fetchurl {
-    url = "mirror://pypi/${builtins.substring 0 1 pname}/${pname}/${pname}-${version}.tar.gz";
-    sha256 = "d044589d30eeaf7336986078b7bd175510fd649a212b01a457d7806b279e6c73";
+  src = python3Packages.fetchPypi {
+    inherit pname version;
+    sha256 = "sha256-jmToDFLQODqgTycBp2J8LyoJ1Zxho9w1VdhFMzvDFkg=";
   };
 
-  propagatedBuildInputs = with pythonPackages;
+  propagatedBuildInputs = with python3Packages;
   [ docutils genshi pygments beautifulsoup4 ];
 
-  meta = with stdenv.lib;{
-    homepage = "https://bitbucket.org/andre_felipe_dias/rst2html5";
+  meta = with lib;{
+    homepage = "https://pypi.org/project/rst2html5/";
     description = "Converts ReSTructuredText to (X)HTML5";
     license = licenses.mit;
     maintainers = with maintainers; [ AndersonTorres ];
diff --git a/third_party/nixpkgs/pkgs/tools/text/shfmt/default.nix b/third_party/nixpkgs/pkgs/tools/text/shfmt/default.nix
index 1d1def4317..7059996390 100644
--- a/third_party/nixpkgs/pkgs/tools/text/shfmt/default.nix
+++ b/third_party/nixpkgs/pkgs/tools/text/shfmt/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "shfmt";
-  version = "3.2.0";
+  version = "3.2.1";
 
   src = fetchFromGitHub {
     owner = "mvdan";
     repo = "sh";
     rev = "v${version}";
-    sha256 = "1ybrx82c4djp7izyqhvzk0rcf9ac7nv5g5ahxr0k0jhm752ba5z2";
+    sha256 = "1kp4ib0a64cc9qylny48ff5q9ciklzx93yhv7fgqhl1v2c7fm1jp";
   };
 
   vendorSha256 = "1ma7nvyn6ylbi8bd7x900i94pzs877kfy9xh0nf1bbify1vcpd29";
diff --git a/third_party/nixpkgs/pkgs/tools/text/ucg/default.nix b/third_party/nixpkgs/pkgs/tools/text/ucg/default.nix
new file mode 100644
index 0000000000..db89845368
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/tools/text/ucg/default.nix
@@ -0,0 +1,40 @@
+{ stdenv
+, fetchFromGitHub
+, pkg-config
+, autoreconfHook
+, pcre
+, nixosTests
+}:
+
+let
+  pname = "ucg";
+  version = "20190225";
+in stdenv.mkDerivation {
+  inherit pname version;
+
+  src = fetchFromGitHub {
+    owner = "gvansickle";
+    repo = pname;
+    rev = "c3a67632f1e3f332bfb102f0db167f34a2e42da7";
+    sha256 = "sha256-/wU1PmI4ejlv7gZzZNasgROYXFiDiIxE9BFoCo6+G5Y=";
+  };
+
+  nativeBuildInputs = [ autoreconfHook pkg-config ];
+  buildInputs = [ pcre ];
+
+  meta = with stdenv.lib; {
+    homepage = "https://github.com/gvansickle/ucg/";
+    description = "Grep-like tool for searching large bodies of source code";
+    longDescription = ''
+      UniversalCodeGrep (ucg) is an extremely fast grep-like tool specialized
+      for searching large bodies of source code. It is intended to be largely
+      command-line compatible with Ack, to some extent with ag, and where
+      appropriate with grep. Search patterns are specified as PCRE regexes.
+    '';
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ AndersonTorres ];
+    platforms = with platforms; unix;
+  };
+
+  passthru.tests = { inherit (nixosTests) ucg; };
+}
diff --git a/third_party/nixpkgs/pkgs/tools/text/vale/default.nix b/third_party/nixpkgs/pkgs/tools/text/vale/default.nix
index 0a9ec734e3..893f54eedc 100644
--- a/third_party/nixpkgs/pkgs/tools/text/vale/default.nix
+++ b/third_party/nixpkgs/pkgs/tools/text/vale/default.nix
@@ -2,7 +2,7 @@
 
 buildGoModule rec {
   pname = "vale";
-  version = "2.6.3";
+  version = "2.6.4";
 
   subPackages = [ "." ];
   outputs = [ "out" "data" ];
@@ -11,7 +11,7 @@ buildGoModule rec {
     owner  = "errata-ai";
     repo   = "vale";
     rev    = "v${version}";
-    sha256 = "1svzsm40jm694s5gxg807k0jib8pl5vk2rb2ih8qr9bb23a4h95x";
+    sha256 = "192w98ghfldxamkx717wqa4v3lsr2imlf8xd6ygjpgx78b5zvvcx";
   };
 
   vendorSha256 = null;
diff --git a/third_party/nixpkgs/pkgs/tools/typesetting/pdftk/default.nix b/third_party/nixpkgs/pkgs/tools/typesetting/pdftk/default.nix
index b30d6269c3..25fc794b05 100644
--- a/third_party/nixpkgs/pkgs/tools/typesetting/pdftk/default.nix
+++ b/third_party/nixpkgs/pkgs/tools/typesetting/pdftk/default.nix
@@ -1,21 +1,21 @@
-{ stdenv, fetchFromGitLab, gradle_5, jre, perl, writeText, runtimeShell }:
+{ stdenv, fetchFromGitLab, gradle, jre, perl, writeText, runtimeShell }:
 
 let
   pname = "pdftk";
-  version = "3.0.8";
+  version = "3.2.1";
 
   src = fetchFromGitLab {
     owner = "pdftk-java";
     repo = "pdftk";
     rev = "v${version}";
-    sha256 = "1bj4a9g5mbxd859mmawzs0mpm0jw7ap4n1imcwkwz142r9x1g6rk";
+    sha256 = "056db8rjczdfkq7fm3bv5g15y042rc9hb4zh5qccjrdw630vk9y4";
   };
 
   deps = stdenv.mkDerivation {
     pname = "${pname}-deps";
     inherit src version;
 
-    nativeBuildInputs = [ gradle_5 perl ];
+    nativeBuildInputs = [ gradle perl ];
 
     buildPhase = ''
       export GRADLE_USER_HOME=$(mktemp -d)
@@ -32,7 +32,7 @@ let
 
     outputHashAlgo = "sha256";
     outputHashMode = "recursive";
-    outputHash = "12b7lw1zpj69pv4bpbrm6pi0ip02ay3dfj3vcy2jyikfbwdb3qcz";
+    outputHash = "0p59myc5m3ds7fh0zdz3n7l7hx6dj8bpyqxzlhdrqybsyxwpw4w3";
   };
 
   # Point to our local deps repo
@@ -65,7 +65,7 @@ let
 in stdenv.mkDerivation rec {
   inherit pname version src;
 
-  nativeBuildInputs = [ gradle_5 ];
+  nativeBuildInputs = [ gradle ];
 
   buildPhase = ''
     export GRADLE_USER_HOME=$(mktemp -d)
@@ -74,22 +74,23 @@ in stdenv.mkDerivation rec {
 
   installPhase = ''
     mkdir -p $out/{bin,share/pdftk,share/man/man1}
-    cp build/libs/pdftk.jar $out/share/pdftk
+    cp build/libs/pdftk-all.jar $out/share/pdftk
 
     cat  << EOF > $out/bin/pdftk
     #!${runtimeShell}
-    exec ${jre}/bin/java -jar "$out/share/pdftk/pdftk.jar" "\$@"
+    exec ${jre}/bin/java -jar "$out/share/pdftk/pdftk-all.jar" "\$@"
     EOF
     chmod a+x "$out/bin/pdftk"
 
     cp ${src}/pdftk.1 $out/share/man/man1
   '';
 
-  meta = {
+  meta = with stdenv.lib; {
     description = "Command-line tool for working with PDFs";
     homepage = "https://gitlab.com/pdftk-java/pdftk";
-    license = stdenv.lib.licenses.gpl2;
-    maintainers = with stdenv.lib.maintainers; [ raskin averelld ];
-    platforms = stdenv.lib.platforms.unix;
+    license = licenses.gpl2Plus;
+    maintainers = with maintainers; [ raskin averelld ];
+    platforms = platforms.unix;
+    broken = stdenv.isDarwin;
   };
 }
diff --git a/third_party/nixpkgs/pkgs/tools/typesetting/pdftk/legacy.nix b/third_party/nixpkgs/pkgs/tools/typesetting/pdftk/legacy.nix
index b3edd7d545..5caafa054c 100644
--- a/third_party/nixpkgs/pkgs/tools/typesetting/pdftk/legacy.nix
+++ b/third_party/nixpkgs/pkgs/tools/typesetting/pdftk/legacy.nix
@@ -38,5 +38,6 @@ stdenv.mkDerivation {
     license = stdenv.lib.licenses.gpl2;
     maintainers = with stdenv.lib.maintainers; [raskin];
     platforms = with stdenv.lib.platforms; linux;
+    broken = true; # Broken on Hydra since 2020-08-24
   };
 }
diff --git a/third_party/nixpkgs/pkgs/tools/typesetting/skribilo/default.nix b/third_party/nixpkgs/pkgs/tools/typesetting/skribilo/default.nix
index 813a464b77..0e90e1cf61 100644
--- a/third_party/nixpkgs/pkgs/tools/typesetting/skribilo/default.nix
+++ b/third_party/nixpkgs/pkgs/tools/typesetting/skribilo/default.nix
@@ -1,21 +1,30 @@
-{ stdenv, fetchurl, pkgconfig, gettext
-, guile, guile-reader, guile-lib
-, ploticus, imagemagick
-, ghostscript, transfig
+{ stdenv
+, fetchurl
+, pkgconfig
+, gettext
+, guile
+, guile-reader
+, guile-lib
+, ploticus
+, imagemagick
+, ghostscript
+, transfig
 , enableEmacs ? false, emacs ? null
 , enableLout ? true, lout ? null
 , enableTex ? true, tex ? null
-, makeWrapper }:
-
-with stdenv.lib;
-stdenv.mkDerivation rec {
+, makeWrapper
+}:
 
+let
   pname = "skribilo";
-  version = "0.9.4";
+  version = "0.9.5";
+  inherit (stdenv.lib) optional;
+in stdenv.mkDerivation {
+  inherit pname version;
 
   src = fetchurl {
     url = "http://download.savannah.nongnu.org/releases/skribilo/${pname}-${version}.tar.gz";
-    sha256 = "06ywnfjfa9sxrzdszb5sryzg266380g519cm64kq62sskzl7zmnf";
+    sha256 = "sha256-AIJqIcRjT7C0EO6J60gGjERdgAglh0ZU49U9XKPwvwk=";
   };
 
   nativeBuildInputs = [ pkgconfig makeWrapper ];
@@ -33,7 +42,7 @@ stdenv.mkDerivation rec {
       --prefix GUILE_LOAD_COMPILED_PATH : "$out/share/guile/site:${guile-lib}/share/guile/site:${guile-reader}/share/guile/site"
   '';
 
-  meta = {
+  meta = with stdenv.lib;{
     description = "The Ultimate Document Programming Framework";
     longDescription = ''
       Skribilo is a free document production tool that takes a
diff --git a/third_party/nixpkgs/pkgs/tools/typesetting/tex/texlive/bin.nix b/third_party/nixpkgs/pkgs/tools/typesetting/tex/texlive/bin.nix
index 672d5af68c..030ac1b43a 100644
--- a/third_party/nixpkgs/pkgs/tools/typesetting/tex/texlive/bin.nix
+++ b/third_party/nixpkgs/pkgs/tools/typesetting/tex/texlive/bin.nix
@@ -4,7 +4,7 @@
 , freetype, gd, libXaw, icu, ghostscript, libXpm, libXmu, libXext
 , perl, perlPackages, python2Packages, pkgconfig
 , poppler, libpaper, graphite2, zziplib, harfbuzz, potrace, gmp, mpfr
-, cairo, pixman, xorg, clisp, biber, xxHash
+, brotli, cairo, pixman, xorg, clisp, biber, woff2, xxHash
 , makeWrapper, shortenPerlShebang
 }:
 
@@ -245,20 +245,20 @@ chktex = stdenv.mkDerivation {
 };
 
 
-dvisvgm = stdenv.mkDerivation {
+dvisvgm = stdenv.mkDerivation rec {
   pname = "texlive-dvisvgm.bin";
-  inherit version;
+  version = "2.11";
+  # TODO: dvisvgm was switched to build from upstream sources
+  # to address https://github.com/NixOS/nixpkgs/issues/104847
+  # We might want to consider reverting that change in the future.
 
-  inherit (common) src;
+  src = fetchurl {
+    url = "https://github.com/mgieseki/dvisvgm/releases/download/${version}/dvisvgm-${version}.tar.gz";
+    sha256 = "12b6h0h8rc487yjh3sq9zsdabm9cs2vqcrb0znnfi8277f87zf3j";
+  };
 
   nativeBuildInputs = [ pkgconfig ];
-  # TODO: dvisvgm still uses vendored dependencies
-  buildInputs = [ core/*kpathsea*/ ghostscript zlib freetype /*potrace xxHash*/ ];
-
-  preConfigure = "cd texk/dvisvgm";
-
-  configureFlags = common.configureFlags
-    ++ [ "--with-system-kpathsea" ];
+  buildInputs = [ core/*kpathsea*/ brotli ghostscript zlib freetype woff2 potrace xxHash ];
 
   enableParallelBuilding = true;
 };
diff --git a/third_party/nixpkgs/pkgs/tools/typesetting/xmlto/default.nix b/third_party/nixpkgs/pkgs/tools/typesetting/xmlto/default.nix
index f37bfb7c13..31b260d846 100644
--- a/third_party/nixpkgs/pkgs/tools/typesetting/xmlto/default.nix
+++ b/third_party/nixpkgs/pkgs/tools/typesetting/xmlto/default.nix
@@ -3,9 +3,10 @@
 , bash, getopt, makeWrapper }:
 
 stdenv.mkDerivation rec {
-  name = "xmlto-0.0.28";
+  pname = "xmlto";
+  version = "0.0.28";
   src = fetchurl {
-    url = "http://fedorahosted.org/releases/x/m/xmlto/${name}.tar.bz2";
+    url = "https://releases.pagure.org/${pname}/${pname}-${version}.tar.bz2";
     sha256 = "0xhj8b2pwp4vhl9y16v3dpxpsakkflfamr191mprzsspg4xdyc0i";
   };
 
diff --git a/third_party/nixpkgs/pkgs/top-level/aliases.nix b/third_party/nixpkgs/pkgs/top-level/aliases.nix
index b7cc306776..28b5614a80 100644
--- a/third_party/nixpkgs/pkgs/top-level/aliases.nix
+++ b/third_party/nixpkgs/pkgs/top-level/aliases.nix
@@ -41,6 +41,7 @@ mapAliases ({
   ag = silver-searcher; # added 2018-04-25
   aircrackng = aircrack-ng; # added 2016-01-14
   alienfx = throw "alienfx has been removed."; # added 2019-12-08
+  aleth = throw "aleth (previously packaged as cpp_ethereum) has been removed; abandoned upstream."; # added 2020-11-30
   amazon-glacier-cmd-interface = throw "amazon-glacier-cmd-interface has been removed due to it being unmaintained."; # added 2020-10-30
   ammonite-repl = ammonite; # added 2017-05-02
   antimicro = throw "antimicro has been removed as it was broken, see antimicroX instead."; # added 2020-08-06
@@ -92,6 +93,7 @@ mapAliases ({
   coprthr = throw "coprthr has been removed."; # added 2019-12-08
   corebird = throw "corebird was deprecated 2019-10-02: See https://www.patreon.com/posts/corebirds-future-18921328. Please use Cawbird as replacement.";
   coredumper = throw "coredumper has been removed: abandoned by upstream."; # added 2019-11-16
+  cpp_ethereum = throw "cpp_ethereum has been removed; abandoned upstream."; # added 2020-11-30
   cryptol = throw "cryptol was removed due to prolonged broken build"; # added 2020-08-21
   cpp-gsl = microsoft_gsl; # added 2019-05-24
   cupsBjnp = cups-bjnp; # added 2016-01-02
diff --git a/third_party/nixpkgs/pkgs/top-level/all-packages.nix b/third_party/nixpkgs/pkgs/top-level/all-packages.nix
index 3fc30afcfb..a3c3330ae3 100644
--- a/third_party/nixpkgs/pkgs/top-level/all-packages.nix
+++ b/third_party/nixpkgs/pkgs/top-level/all-packages.nix
@@ -365,6 +365,8 @@ in
 
   fetchhg = callPackage ../build-support/fetchhg { };
 
+  fetchFirefoxAddon = callPackage ../build-support/fetchfirefoxaddon {};
+
   # `fetchurl' downloads a file from the network.
   fetchurl = if stdenv.buildPlatform != stdenv.hostPlatform
    then buildPackages.fetchurl # No need to do special overrides twice,
@@ -701,6 +703,8 @@ in
     inherit (darwin.apple_sdk.frameworks) Carbon Cocoa Kernel;
   };
 
+  archi = callPackage ../tools/misc/archi { };
+
   cool-retro-term = libsForQt5.callPackage ../applications/terminal-emulators/cool-retro-term { };
 
   eterm = callPackage ../applications/terminal-emulators/eterm { };
@@ -853,6 +857,8 @@ in
 
   archivemount = callPackage ../tools/filesystems/archivemount { };
 
+  archivy = python3Packages.callPackage ../applications/misc/archivy { };
+
   arandr = callPackage ../tools/X11/arandr { };
 
   inherit (callPackages ../servers/nosql/arangodb {
@@ -1170,6 +1176,8 @@ in
 
   fitnesstrax = callPackage ../applications/misc/fitnesstrax/default.nix { };
 
+  flood = nodePackages.flood;
+
   fxlinuxprintutil = callPackage ../tools/misc/fxlinuxprintutil { };
 
   genpass = callPackage ../tools/security/genpass {
@@ -2488,6 +2496,8 @@ in
 
   patool = with python3Packages; toPythonApplication patool;
 
+  pbgopy = callPackage ../tools/text/pbgopy { };
+
   pbpst = callPackage ../applications/misc/pbpst { };
 
   pbzx = callPackage ../tools/compression/pbzx { };
@@ -2780,6 +2790,8 @@ in
     inherit (pythonPackages) gyp;
   };
 
+  bumpver = callPackage ../applications/version-management/bumpver { };
+
   bup = callPackage ../tools/backup/bup { };
 
   burp = callPackage ../tools/backup/burp { };
@@ -3033,6 +3045,8 @@ in
       protobuf = pkgs.protobuf3_8.overrideDerivation (oldAttrs: { stdenv = clangStdenv; });
     };
 
+    rime = callPackage ../tools/inputmethods/ibus-engines/ibus-rime { };
+
     table = callPackage ../tools/inputmethods/ibus-engines/ibus-table { };
 
     table-chinese = callPackage ../tools/inputmethods/ibus-engines/ibus-table-chinese {
@@ -4383,6 +4397,8 @@ in
     inherit (darwin.apple_sdk.frameworks) Security;
   };
 
+  ucg = callPackage ../tools/text/ucg { };
+
   grive2 = callPackage ../tools/filesystems/grive2 { };
 
   groff = callPackage ../tools/text/groff {
@@ -4738,7 +4754,9 @@ in
 
   ifuse = callPackage ../tools/filesystems/ifuse { };
   ideviceinstaller = callPackage ../tools/misc/ideviceinstaller { };
-  idevicerestore = callPackage ../tools/misc/idevicerestore { };
+  idevicerestore = callPackage ../tools/misc/idevicerestore {
+    inherit (darwin) IOKit;
+  };
 
   inherit (callPackages ../tools/filesystems/irods rec {
             stdenv = llvmPackages.libcxxStdenv;
@@ -5356,6 +5374,8 @@ in
 
   libck = callPackage ../development/libraries/libck { };
 
+  libcork = callPackage ../development/libraries/libcork { };
+
   libconfig = callPackage ../development/libraries/libconfig { };
 
   libcmis = callPackage ../development/libraries/libcmis { };
@@ -6995,6 +7015,8 @@ in
 
   rubocop = callPackage ../development/tools/rubocop { };
 
+  ruffle = callPackage ../misc/emulators/ruffle { };
+
   runelite = callPackage ../games/runelite { };
 
   runningx = callPackage ../tools/X11/runningx { };
@@ -7667,6 +7689,8 @@ in
 
   tinyfecvpn = callPackage ../tools/networking/tinyfecvpn {};
 
+  tinyobjloader = callPackage ../development/libraries/tinyobjloader { };
+
   tinyprog = callPackage ../development/tools/misc/tinyprog { };
 
   tinyproxy = callPackage ../tools/networking/tinyproxy {};
@@ -7829,6 +7853,8 @@ in
 
   twitterBootstrap = callPackage ../development/web/twitter-bootstrap {};
 
+  twtxt = callPackage ../applications/networking/twtxt { };
+
   txr = callPackage ../tools/misc/txr { stdenv = clangStdenv; };
 
   txt2man = callPackage ../tools/misc/txt2man { };
@@ -8663,6 +8689,42 @@ in
     jdk = jdk8; # TODO: remove override https://github.com/NixOS/nixpkgs/pull/89731
   };
 
+  adoptopenjdk-bin-15-packages-linux = import ../development/compilers/adoptopenjdk-bin/jdk15-linux.nix;
+  adoptopenjdk-bin-15-packages-darwin = import ../development/compilers/adoptopenjdk-bin/jdk15-darwin.nix;
+
+  adoptopenjdk-hotspot-bin-15 = if stdenv.isLinux
+    then callPackage adoptopenjdk-bin-15-packages-linux.jdk-hotspot {}
+    else callPackage adoptopenjdk-bin-15-packages-darwin.jdk-hotspot {};
+  adoptopenjdk-jre-hotspot-bin-15 = if stdenv.isLinux
+    then callPackage adoptopenjdk-bin-15-packages-linux.jre-hotspot {}
+    else callPackage adoptopenjdk-bin-15-packages-darwin.jre-hotspot {};
+
+  adoptopenjdk-openj9-bin-15 = if stdenv.isLinux
+    then callPackage adoptopenjdk-bin-15-packages-linux.jdk-openj9 {}
+    else callPackage adoptopenjdk-bin-15-packages-darwin.jdk-openj9 {};
+
+  adoptopenjdk-jre-openj9-bin-15 = if stdenv.isLinux
+    then callPackage adoptopenjdk-bin-15-packages-linux.jre-openj9 {}
+    else callPackage adoptopenjdk-bin-15-packages-darwin.jre-openj9 {};
+
+  adoptopenjdk-bin-14-packages-linux = import ../development/compilers/adoptopenjdk-bin/jdk14-linux.nix;
+  adoptopenjdk-bin-14-packages-darwin = import ../development/compilers/adoptopenjdk-bin/jdk14-darwin.nix;
+
+  adoptopenjdk-hotspot-bin-14 = if stdenv.isLinux
+    then callPackage adoptopenjdk-bin-14-packages-linux.jdk-hotspot {}
+    else callPackage adoptopenjdk-bin-14-packages-darwin.jdk-hotspot {};
+  adoptopenjdk-jre-hotspot-bin-14 = if stdenv.isLinux
+    then callPackage adoptopenjdk-bin-14-packages-linux.jre-hotspot {}
+    else callPackage adoptopenjdk-bin-14-packages-darwin.jre-hotspot {};
+
+  adoptopenjdk-openj9-bin-14 = if stdenv.isLinux
+    then callPackage adoptopenjdk-bin-14-packages-linux.jdk-openj9 {}
+    else callPackage adoptopenjdk-bin-14-packages-darwin.jdk-openj9 {};
+
+  adoptopenjdk-jre-openj9-bin-14 = if stdenv.isLinux
+    then callPackage adoptopenjdk-bin-14-packages-linux.jre-openj9 {}
+    else callPackage adoptopenjdk-bin-14-packages-darwin.jre-openj9 {};
+
   adoptopenjdk-bin-13-packages-linux = import ../development/compilers/adoptopenjdk-bin/jdk13-linux.nix;
   adoptopenjdk-bin-13-packages-darwin = import ../development/compilers/adoptopenjdk-bin/jdk13-darwin.nix;
 
@@ -9543,15 +9605,7 @@ in
     graalvm8-ee
     graalvm11-ee;
 
-  # Cannot use a newer Qt (5.15) version because it requires qtwebkit
-  # and our qtwebkit fails to build with 5.15. 01bcfd3579219d60e5d07df309a000f96b2b658b
-  openshot-qt = (pkgs.extend (final: prev: rec {
-    qt5 = if stdenv.isDarwin then prev.qt5 else prev.qt514;
-    libsForQt5 = if stdenv.isDarwin then prev.libsForQt5 else prev.libsForQt514;
-    pythonInterpreters = prev.pythonInterpreters.override {
-      pkgs = final;
-    };
-  })).libsForQt5.callPackage ../applications/video/openshot-qt { };
+  openshot-qt = libsForQt5.callPackage ../applications/video/openshot-qt { };
 
   openspin = callPackage ../development/compilers/openspin { };
 
@@ -9933,15 +9987,15 @@ in
     inherit (darwin.apple_sdk.frameworks) CoreFoundation Security;
     llvmPackages = if stdenv.cc.isClang then llvmPackages_5 else llvmPackages_10;
   };
-  rust_1_47 = callPackage ../development/compilers/rust/1_47.nix {
+  rust_1_48 = callPackage ../development/compilers/rust/1_48.nix {
     inherit (darwin.apple_sdk.frameworks) CoreFoundation Security;
     llvmPackages = if stdenv.cc.isClang then llvmPackages_5 else llvmPackages_11;
   };
-  rust = rust_1_47;
+  rust = rust_1_48;
 
   rustPackages_1_45 = rust_1_45.packages.stable;
-  rustPackages_1_47 = rust_1_47.packages.stable;
-  rustPackages = rustPackages_1_47;
+  rustPackages_1_48 = rust_1_48.packages.stable;
+  rustPackages = rustPackages_1_48;
 
   inherit (rustPackages) cargo clippy rustc rustPlatform;
 
@@ -10276,13 +10330,15 @@ in
 
   dhall = haskell.lib.justStaticExecutables haskellPackages.dhall;
 
-  dhall-nix = haskell.lib.justStaticExecutables haskellPackages.dhall-nix;
-
   dhall-bash = haskell.lib.justStaticExecutables haskellPackages.dhall-bash;
 
+  dhall-docs = haskell.lib.justStaticExecutables haskellPackages.dhall-docs;
+
+  dhall-lsp-server = haskell.lib.justStaticExecutables haskellPackages.dhall-lsp-server;
+
   dhall-json = haskell.lib.justStaticExecutables haskellPackages.dhall-json;
 
-  dhall-lsp-server = haskell.lib.justStaticExecutables haskellPackages.dhall-lsp-server;
+  dhall-nix = haskell.lib.justStaticExecutables haskellPackages.dhall-nix;
 
   dhall-text = haskell.lib.justStaticExecutables haskellPackages.dhall-text;
 
@@ -10458,6 +10514,12 @@ in
   phpExtensions = php74Extensions;
   phpPackages = php74Packages;
 
+  php80 = callPackage ../development/interpreters/php/8.0.nix {
+    stdenv = if stdenv.cc.isClang then llvmPackages_6.stdenv else stdenv;
+  };
+  php80Extensions = recurseIntoAttrs php80.extensions;
+  php80Packages = recurseIntoAttrs php80.packages;
+
   # Import PHP74 interpreter, extensions and packages
   php74 = callPackage ../development/interpreters/php/7.4.nix {
     stdenv = if stdenv.cc.isClang then llvmPackages_6.stdenv else stdenv;
@@ -10541,20 +10603,15 @@ in
   python2Packages = python2.pkgs;
   python3Packages = python3.pkgs;
 
-  pythonInterpreters = callPackage ./../development/interpreters/python {
-    # Overrides that apply to all Python interpreters and their packages
-    # Generally, this should be avoided.
-    pkgs = pkgs.extend (final: _: {
-    });
-  };
+  pythonInterpreters = callPackage ./../development/interpreters/python { };
   inherit (pythonInterpreters) python27 python36 python37 python38 python39 python310 python3Minimal pypy27 pypy36;
 
   # Python package sets.
-  python27Packages = lib.hiPrioSet (recurseIntoAttrs python27.pkgs);
+  python27Packages = python27.pkgs;
   python36Packages = python36.pkgs;
   python37Packages = recurseIntoAttrs python37.pkgs;
   python38Packages = recurseIntoAttrs python38.pkgs;
-  python39Packages = python39.pkgs;
+  python39Packages = recurseIntoAttrs python39.pkgs;
   python310Packages = python310.pkgs;
   pypyPackages = pypy.pkgs;
   pypy2Packages = pypy2.pkgs;
@@ -10648,6 +10705,8 @@ in
 
   solargraph = callPackage ../development/ruby-modules/solargraph { };
 
+  rbenv = callPackage ../development/ruby-modules/rbenv { };
+
   inherit (callPackage ../development/interpreters/ruby {
     inherit (darwin) libiconv libobjc libunwind;
     inherit (darwin.apple_sdk.frameworks) Foundation;
@@ -16055,9 +16114,7 @@ in
 
   taglib-sharp = callPackage ../development/libraries/taglib-sharp { };
 
-  talloc = callPackage ../development/libraries/talloc {
-    python = buildPackages.python3;
-  };
+  talloc = callPackage ../development/libraries/talloc { };
 
   tclap = callPackage ../development/libraries/tclap {};
 
@@ -18617,9 +18674,7 @@ in
 
   keyutils = callPackage ../os-specific/linux/keyutils { };
 
-  libselinux = callPackage ../os-specific/linux/libselinux {
-    python = python37;
-  };
+  libselinux = callPackage ../os-specific/linux/libselinux { };
 
   libsemanage = callPackage ../os-specific/linux/libsemanage {
     python = python3;
@@ -20227,17 +20282,7 @@ in
 
   bambootracker = libsForQt5.callPackage ../applications/audio/bambootracker { };
 
-  cadence = let
-    # Use Qt 5.14 consistently
-    pkgs_ = pkgs.extend(_: prev: {
-      pythonInterpreters = prev.pythonInterpreters.override(oldAttrs: {
-        pkgs = oldAttrs.pkgs.extend(_: _: {
-          qt5 = pkgs.qt514;
-          libsForQt5 = pkgs.libsForQt514;
-        });
-      });
-    });
-  in pkgs_.libsForQt514.callPackage ../applications/audio/cadence { };
+  cadence = libsForQt5.callPackage ../applications/audio/cadence { };
 
   cheesecutter = callPackage ../applications/audio/cheesecutter { };
 
@@ -20617,8 +20662,6 @@ in
     python3Packages = python37Packages;
   };
 
-  cpp_ethereum = callPackage ../applications/misc/cpp-ethereum { };
-
   crun = callPackage ../applications/virtualization/crun {};
 
   csdp = callPackage ../applications/science/math/csdp { };
@@ -21651,6 +21694,8 @@ in
 
   howl = callPackage ../applications/editors/howl { };
 
+  hdl-dump = callPackage ../tools/misc/hdl-dump { };
+
   hpcg = callPackage ../tools/misc/hpcg/default.nix { };
 
   hpl = callPackage ../tools/misc/hpl { mpi = openmpi; };
@@ -21824,6 +21869,8 @@ in
 
   id3v2 = callPackage ../applications/audio/id3v2 { };
 
+  ideamaker = callPackage ../applications/misc/ideamaker { };
+
   ifenslave = callPackage ../os-specific/linux/ifenslave { };
 
   ii = callPackage ../applications/networking/irc/ii {
@@ -22166,6 +22213,8 @@ in
 
   kvirc = libsForQt514.callPackage ../applications/networking/irc/kvirc { };
 
+  lambda-delta = callPackage ../misc/emulators/lambda-delta { };
+
   lame = callPackage ../development/libraries/lame { };
 
   larswm = callPackage ../applications/window-managers/larswm { };
@@ -22363,7 +22412,7 @@ in
 
   mac = callPackage ../development/libraries/mac { };
 
-  macdylibbundler = callPackage ../development/tools/misc/macdylibbundler { };
+  macdylibbundler = callPackage ../development/tools/misc/macdylibbundler { inherit (darwin) cctools; };
 
   magic-wormhole = with python3Packages; toPythonApplication magic-wormhole;
 
@@ -23148,6 +23197,8 @@ in
     inherit (gst_all_1) gstreamer gst-plugins-base gst-plugins-good gst-libav;
   };
 
+  peach = callPackage ../servers/peach { };
+
   peaclock = callPackage ../applications/misc/peaclock {
     stdenv = gccStdenv;
   };
@@ -23357,19 +23408,8 @@ in
 
   qemu-utils = callPackage ../applications/virtualization/qemu/utils.nix {};
 
-  # Our 3.10 LTS cannot use a newer Qt (5.15) version because it requires qtwebkit
-  # and our qtwebkit fails to build with 5.15. 01bcfd3579219d60e5d07df309a000f96b2b658b
-  qgis-unwrapped = let
-    pkgs_ = pkgs.extend(_: prev: {
-      pythonInterpreters = prev.pythonInterpreters.override(oldAttrs: {
-        pkgs = oldAttrs.pkgs.extend(_: _: {
-          qt5 = pkgs.qt514;
-          libsForQt5 = pkgs.libsForQt514;
-        });
-      });
-    });
-  in pkgs_.libsForQt514.callPackage ../applications/gis/qgis/unwrapped.nix {
-      withGrass = false;
+  qgis-unwrapped = libsForQt5.callPackage ../applications/gis/qgis/unwrapped.nix {
+    withGrass = false;
   };
 
   qgis = callPackage ../applications/gis/qgis { };
@@ -23390,6 +23430,8 @@ in
     boost = boost17x;
   };
 
+  qmplay2 = libsForQt5.callPackage ../applications/video/qmplay2 { };
+
   qmetro = callPackage ../applications/misc/qmetro { };
 
   qmidiarp = callPackage ../applications/audio/qmidiarp {};
@@ -25976,6 +26018,8 @@ in
 
   tremulous = callPackage ../games/tremulous { };
 
+  tts = callPackage ../tools/audio/tts { };
+
   tuxpaint = callPackage ../games/tuxpaint { };
 
   tuxtype = callPackage ../games/tuxtype { };
@@ -26324,7 +26368,9 @@ in
 
   alliance = callPackage ../applications/science/electronics/alliance { };
 
-  ants = callPackage ../applications/science/biology/ants { };
+  ants = callPackage ../applications/science/biology/ants {
+    inherit (darwin.apple_sdk.frameworks) Cocoa;
+  };
 
   aragorn = callPackage ../applications/science/biology/aragorn { };
 
diff --git a/third_party/nixpkgs/pkgs/top-level/ocaml-packages.nix b/third_party/nixpkgs/pkgs/top-level/ocaml-packages.nix
index c7d805d4c7..793b7b78b0 100644
--- a/third_party/nixpkgs/pkgs/top-level/ocaml-packages.nix
+++ b/third_party/nixpkgs/pkgs/top-level/ocaml-packages.nix
@@ -599,6 +599,10 @@ let
 
     mirage-time-unix = callPackage ../development/ocaml-modules/mirage-time/unix.nix { };
 
+    mirage-types = callPackage ../development/ocaml-modules/mirage/types.nix { };
+
+    mirage-types-lwt = callPackage ../development/ocaml-modules/mirage/types-lwt.nix { };
+
     mirage-unix = callPackage ../development/ocaml-modules/mirage-unix { };
 
     mlgmp =  callPackage ../development/ocaml-modules/mlgmp { };
diff --git a/third_party/nixpkgs/pkgs/top-level/perl-packages.nix b/third_party/nixpkgs/pkgs/top-level/perl-packages.nix
index 1863ae0b36..5202aa013e 100644
--- a/third_party/nixpkgs/pkgs/top-level/perl-packages.nix
+++ b/third_party/nixpkgs/pkgs/top-level/perl-packages.nix
@@ -598,10 +598,10 @@ let
 
   Appcpm = buildPerlModule {
     pname = "App-cpm";
-    version = "0.994";
+    version = "0.995";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/S/SK/SKAJI/App-cpm-0.994.tar.gz";
-      sha256 = "4242ecb64aaae09034eddb1b338e005567ace29f2ac2d1bca4d4bcf4e15d21c4";
+      url = "mirror://cpan/authors/id/S/SK/SKAJI/App-cpm-0.995.tar.gz";
+      sha256 = "b17fb0b7f97eb86430952bf387b6f08b5252413cb97474d1bf26e3376a4cc496";
     };
     buildInputs = [ ModuleBuildTiny ];
     propagatedBuildInputs = [ CPANCommonIndex CPANDistnameInfo ClassTiny CommandRunner ExtUtilsInstallPaths FileCopyRecursive Filepushd HTTPTinyish MenloLegacy ModuleCPANfile ParallelPipes locallib ];
@@ -8429,10 +8429,10 @@ let
 
   FutureAsyncAwait = buildPerlModule rec {
     pname = "Future-AsyncAwait";
-    version = "0.46";
+    version = "0.47";
     src = fetchurl {
       url = "mirror://cpan/authors/id/P/PE/PEVANS/Future-AsyncAwait-${version}.tar.gz";
-      sha256 = "1iqbs7n8923xjkai51hiczn5an8cskddl7qrfi30axjl1d56h6r0";
+      sha256 = "1ja85hzzl36sjikcyavjqy4m41f2yyrsr1ipypzi5mlw7clhmdi3";
     };
     buildInputs = [ TestRefcount ];
     propagatedBuildInputs = [ Future XSParseSublike ];
@@ -21230,10 +21230,10 @@ let
 
   TextFormat = buildPerlModule {
     pname = "Text-Format";
-    version = "0.61";
+    version = "0.62";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/S/SH/SHLOMIF/Text-Format-0.61.tar.gz";
-      sha256 = "bb8a3b8ff515c85101baf553a769337f944a05cde81f111ae78aff416bf4ae2b";
+      url = "mirror://cpan/authors/id/S/SH/SHLOMIF/Text-Format-0.62.tar.gz";
+      sha256 = "0104z7jjv46kqh77rnx8kvmsbr5dy0s56xm01dckq4ly65br0hkx";
     };
     meta = {
       homepage = "https://metacpan.org/release/Text-Format";
diff --git a/third_party/nixpkgs/pkgs/top-level/php-packages.nix b/third_party/nixpkgs/pkgs/top-level/php-packages.nix
index d4518b60d2..d5bebb9bd8 100644
--- a/third_party/nixpkgs/pkgs/top-level/php-packages.nix
+++ b/third_party/nixpkgs/pkgs/top-level/php-packages.nix
@@ -3,7 +3,7 @@
 , html-tidy, libzip, zlib, pcre, pcre2, libxslt, aspell, openldap, cyrus_sasl
 , uwimap, pam, libiconv, enchant1, libXpm, gd, libwebp, libjpeg, libpng
 , freetype, libffi, freetds, postgresql, sqlite, net-snmp, unixODBC, libedit
-, readline, rsync, fetchpatch
+, readline, rsync, fetchpatch, valgrind
 }:
 
 let
@@ -331,7 +331,7 @@ in
           sha256 = "055l40lpyhb0rbjn6y23qkzdhvpp7inbnn6x13cpn4inmhjqfpg4";
         });
       }
-      { name = "json"; }
+      { name = "json"; enable = lib.versionOlder php.version "8.0"; }
       { name = "ldap";
         buildInputs = [ openldap cyrus_sasl ];
         configureFlags = [
@@ -341,7 +341,9 @@ in
           "LDAP_LIBDIR=${openldap.out}/lib"
         ] ++ lib.optional stdenv.isLinux "--with-ldap-sasl=${cyrus_sasl.dev}";
         doCheck = false; }
-      { name = "mbstring"; buildInputs = [ oniguruma ]; doCheck = false; }
+      { name = "mbstring"; buildInputs = [ oniguruma ] ++ lib.optionals (lib.versionAtLeast php.version "8.0") [
+          pcre'
+        ]; doCheck = false; }
       { name = "mysqli";
         internalDeps = [ php.extensions.mysqlnd ];
         configureFlags = [ "--with-mysqli=mysqlnd" "--with-mysql-sock=/run/mysqld/mysqld.sock" ];
@@ -388,11 +390,13 @@ in
       # oci8 (7.4, 7.3, 7.2)
       # odbc (7.4, 7.3, 7.2)
       { name = "opcache";
-        buildInputs = [ pcre' ];
+        buildInputs = [ pcre' ] ++ lib.optionals (lib.versionAtLeast php.version "8.0") [
+          valgrind.dev
+        ];
         # HAVE_OPCACHE_FILE_CACHE is defined in config.h, which is
         # included from ZendAccelerator.h, but ZendAccelerator.h is
         # included after the ifdef...
-        patches = lib.optional (lib.versionOlder php.version "7.4") [
+        patches = [] ++ lib.optional (lib.versionAtLeast php.version "8.0") [ ../development/interpreters/php/fix-opcache-configure.patch ] ++lib.optional (lib.versionOlder php.version "7.4") [
           (pkgs.writeText "zend_file_cache_config.patch" ''
             --- a/ext/opcache/zend_file_cache.c
             +++ b/ext/opcache/zend_file_cache.c
@@ -456,7 +460,7 @@ in
         doCheck = false;
       }
       # recode (7.3, 7.2)
-      { name = "session"; }
+      { name = "session"; doCheck = !(lib.versionAtLeast php.version "8.0"); }
       { name = "shmop"; }
       { name = "simplexml";
         buildInputs = [ libxml2 pcre' ];
diff --git a/third_party/nixpkgs/pkgs/top-level/python-packages.nix b/third_party/nixpkgs/pkgs/top-level/python-packages.nix
index 30c845e2ef..75d4245abe 100644
--- a/third_party/nixpkgs/pkgs/top-level/python-packages.nix
+++ b/third_party/nixpkgs/pkgs/top-level/python-packages.nix
@@ -3371,6 +3371,8 @@ in {
 
   leveldb = callPackage ../development/python-modules/leveldb { };
 
+  lexid = callPackage ../development/python-modules/lexid { };
+
   libagent = callPackage ../development/python-modules/libagent { };
 
   pa-ringbuffer = callPackage ../development/python-modules/pa-ringbuffer { };
@@ -3465,13 +3467,13 @@ in {
       p.overrideAttrs (super: {
         meta = super.meta // {
           outputsToInstall = [ "py" ];
-          broken = (super.meta.broken or false) || pythonAtLeast "3.8";
+          broken = super.meta.broken or isPy27;
         };
       }))
     (p:
       p.override {
         enablePython = true;
-        inherit python;
+        python3 = python;
       })
     (p: p.py)
   ];
@@ -4611,6 +4613,8 @@ in {
 
   pkuseg = callPackage ../development/python-modules/pkuseg { };
 
+  pysbd = callPackage ../development/python-modules/pysbd { };
+
   python-csxcad = callPackage ../development/python-modules/python-csxcad { };
 
   python-openems = callPackage ../development/python-modules/python-openems { };
@@ -5351,6 +5355,8 @@ in {
 
   pyopenssl = callPackage ../development/python-modules/pyopenssl { };
 
+  pyosf = callPackage ../development/python-modules/pyosf { };
+
   pyosmium = callPackage ../development/python-modules/pyosmium { };
 
   pyotp = callPackage ../development/python-modules/pyotp { };
@@ -5856,6 +5862,8 @@ in {
 
   python-forecastio = callPackage ../development/python-modules/python-forecastio { };
 
+  python-frontmatter = callPackage ../development/python-modules/python-frontmatter { };
+
   python-gitlab = callPackage ../development/python-modules/python-gitlab { };
 
   python-gnupg = callPackage ../development/python-modules/python-gnupg { };
@@ -6570,6 +6578,8 @@ in {
 
   seabreeze = callPackage ../development/python-modules/seabreeze { };
 
+  seccomp = callPackage ../development/python-modules/seccomp { };
+
   secp256k1 = callPackage ../development/python-modules/secp256k1 { inherit (pkgs) secp256k1 pkgconfig; };
 
   secretstorage = if isPy3k then
@@ -7272,6 +7282,8 @@ in {
 
   tinydb = callPackage ../development/python-modules/tinydb { };
 
+  tinyobjloader-py = callPackage ../development/python-modules/tinyobjloader-py { };
+
   tiros = callPackage ../development/python-modules/tiros { };
 
   tissue = callPackage ../development/python-modules/tissue { };
diff --git a/third_party/nixpkgs/pkgs/top-level/release-lib.nix b/third_party/nixpkgs/pkgs/top-level/release-lib.nix
index 1e33c7b058..411093186a 100644
--- a/third_party/nixpkgs/pkgs/top-level/release-lib.nix
+++ b/third_party/nixpkgs/pkgs/top-level/release-lib.nix
@@ -142,15 +142,13 @@ rec {
   /* Recursively map a (nested) set of derivations to an isomorphic
      set of meta.platforms values. */
   packagePlatforms = mapAttrs (name: value:
-    let res = builtins.tryEval (
       if isDerivation value then
         value.meta.hydraPlatforms
           or (value.meta.platforms or [ "x86_64-linux" ])
       else if value.recurseForDerivations or false || value.recurseForRelease or false then
         packagePlatforms value
       else
-        []);
-    in if res.success then res.value else []
+        []
     );
 
 
diff --git a/third_party/nixpkgs/pkgs/top-level/stage.nix b/third_party/nixpkgs/pkgs/top-level/stage.nix
index 58b0300cc7..8fc460ca52 100644
--- a/third_party/nixpkgs/pkgs/top-level/stage.nix
+++ b/third_party/nixpkgs/pkgs/top-level/stage.nix
@@ -200,6 +200,9 @@ let
       then self
       else import ./stage.nix (args // { overlays = args.overlays ++ extraOverlays; });
 
+    # NOTE: each call to extend causes a full nixpkgs rebuild, adding ~130MB
+    #       of allocations. DO NOT USE THIS IN NIXPKGS.
+    #
     # Extend the package set with a single overlay. This preserves
     # preexisting overlays. Prefer to initialize with the right overlays
     # in one go when calling Nixpkgs, for performance and simplicity.