diff --git a/third_party/nixpkgs/doc/contributing/submitting-changes.chapter.md b/third_party/nixpkgs/doc/contributing/submitting-changes.chapter.md
index 8a98128415..e360dba5ab 100644
--- a/third_party/nixpkgs/doc/contributing/submitting-changes.chapter.md
+++ b/third_party/nixpkgs/doc/contributing/submitting-changes.chapter.md
@@ -161,7 +161,7 @@ Many Nix packages are designed to run on multiple platforms. As such, it’s imp
 
 ### Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests) {#submitting-changes-nixos-tests}
 
-Packages with automated tests are much more likely to be merged in a timely fashion because it doesn’t require as much manual testing by the maintainer to verify the functionality of the package. If there are existing tests for the package, they should be run to verify your changes do not break the tests. Tests only apply to packages with NixOS modules defined and can only be run on Linux. For more details on writing and running tests, see the [section in the NixOS manual](https://nixos.org/nixos/manual/index.html#sec-nixos-tests).
+Packages with automated tests are much more likely to be merged in a timely fashion because it doesn’t require as much manual testing by the maintainer to verify the functionality of the package. If there are existing tests for the package, they should be run to verify your changes do not break the tests. Tests can only be run on Linux. For more details on writing and running tests, see the [section in the NixOS manual](https://nixos.org/nixos/manual/index.html#sec-nixos-tests).
 
 ### Tested compilation of all pkgs that depend on this change using `nixpkgs-review` {#submitting-changes-tested-compilation}
 
diff --git a/third_party/nixpkgs/doc/languages-frameworks/android.section.md b/third_party/nixpkgs/doc/languages-frameworks/android.section.md
index 416073df07..e7dbbf6f8e 100644
--- a/third_party/nixpkgs/doc/languages-frameworks/android.section.md
+++ b/third_party/nixpkgs/doc/languages-frameworks/android.section.md
@@ -25,7 +25,7 @@ let
     abiVersions = [ "armeabi-v7a" "arm64-v8a" ];
     cmakeVersions = [ "3.10.2" ];
     includeNDK = true;
-    ndkVersion = "22.0.7026061";
+    ndkVersions = ["22.0.7026061"];
     useGoogleAPIs = false;
     useGoogleTVAddOns = false;
     includeExtras = [
@@ -52,7 +52,11 @@ The following parameters are supported:
 * `cmakeVersions` specifies which CMake versions should be deployed.
 * `includeNDK` specifies that the Android NDK bundle should be included.
   Defaults to: `false`.
-* `ndkVersion` specifies the NDK version that we want to use.
+* `ndkVersions` specifies the NDK versions that we want to use. These are linked
+  under the `ndk` directory of the SDK root, and the first is linked under the
+  `ndk-bundle` directory.
+* `ndkVersion` is equivalent to specifying one entry in `ndkVersions`, and
+  `ndkVersions` overrides this parameter if provided.
 * `includeExtras` is an array of identifier strings referring to arbitrary
   add-on packages that should be installed.
 * `platformVersions` specifies which platform SDK versions should be included.
diff --git a/third_party/nixpkgs/doc/stdenv/cross-compilation.chapter.md b/third_party/nixpkgs/doc/stdenv/cross-compilation.chapter.md
index 9664142662..3755c13fac 100644
--- a/third_party/nixpkgs/doc/stdenv/cross-compilation.chapter.md
+++ b/third_party/nixpkgs/doc/stdenv/cross-compilation.chapter.md
@@ -123,7 +123,7 @@ depsBuildBuild = [ buildPackages.stdenv.cc ];
 
 Add the following to your `mkDerivation` invocation.
 ```nix
-doCheck = stdenv.hostPlatform == stdenv.buildPlatfrom;
+doCheck = stdenv.hostPlatform == stdenv.buildPlatform;
 ```
 
 ## Cross-building packages {#sec-cross-usage}
diff --git a/third_party/nixpkgs/lib/licenses.nix b/third_party/nixpkgs/lib/licenses.nix
index 46ac0443a0..88d598d920 100644
--- a/third_party/nixpkgs/lib/licenses.nix
+++ b/third_party/nixpkgs/lib/licenses.nix
@@ -125,6 +125,11 @@ lib.mapAttrs (n: v: v // { shortName = n; }) ({
     fullName = ''BSD 4-clause "Original" or "Old" License'';
   };
 
+  bsdOriginalUC = spdx {
+    spdxId = "BSD-4-Clause-UC";
+    fullName = "BSD 4-Clause University of California-Specific";
+  };
+
   bsdProtection = spdx {
     spdxId = "BSD-Protection";
     fullName = "BSD Protection License";
diff --git a/third_party/nixpkgs/lib/systems/default.nix b/third_party/nixpkgs/lib/systems/default.nix
index 1e38dbf531..21b00374da 100644
--- a/third_party/nixpkgs/lib/systems/default.nix
+++ b/third_party/nixpkgs/lib/systems/default.nix
@@ -112,6 +112,19 @@ rec {
         aarch64 = "arm64";
       }.${final.parsed.cpu.name} or final.parsed.cpu.name;
 
+      darwinPlatform =
+        if final.isMacOS then "macos"
+        else if final.isiOS then "ios"
+        else null;
+      # The canonical name for this attribute is darwinSdkVersion, but some
+      # platforms define the old name "sdkVer".
+      darwinSdkVersion = final.sdkVer or "10.12";
+      darwinMinVersion = final.darwinSdkVersion;
+      darwinMinVersionVariable =
+        if final.isMacOS then "MACOSX_DEPLOYMENT_TARGET"
+        else if final.isiOS then "IPHONEOS_DEPLOYMENT_TARGET"
+        else null;
+
       emulator = pkgs: let
         qemu-user = pkgs.qemu.override {
           smartcardSupport = false;
diff --git a/third_party/nixpkgs/lib/systems/examples.nix b/third_party/nixpkgs/lib/systems/examples.nix
index f5cba8bcd6..9c0013c397 100644
--- a/third_party/nixpkgs/lib/systems/examples.nix
+++ b/third_party/nixpkgs/lib/systems/examples.nix
@@ -217,6 +217,7 @@ rec {
     sdkVer = "14.3";
     xcodeVer = "12.3";
     xcodePlatform = "iPhoneSimulator";
+    darwinPlatform = "ios-simulator";
     useiOSPrebuilt = true;
   };
 
@@ -226,6 +227,7 @@ rec {
     sdkVer = "14.3";
     xcodeVer = "12.3";
     xcodePlatform = "iPhoneSimulator";
+    darwinPlatform = "ios-simulator";
     useiOSPrebuilt = true;
   };
 
diff --git a/third_party/nixpkgs/maintainers/maintainer-list.nix b/third_party/nixpkgs/maintainers/maintainer-list.nix
index 1cdd23872a..ee12b1a24d 100644
--- a/third_party/nixpkgs/maintainers/maintainer-list.nix
+++ b/third_party/nixpkgs/maintainers/maintainer-list.nix
@@ -492,12 +492,24 @@
       fingerprint = "B422 CFB1 C9EF 73F7 E1E2 698D F53E 3233 42F7 A6D3A";
     }];
   };
+  amanjeev = {
+    email = "aj@amanjeev.com";
+    github = "amanjeev";
+    githubId = 160476;
+    name = "Amanjeev Sethi";
+  };
   amar1729 = {
     email = "amar.paul16@gmail.com";
     github = "amar1729";
     githubId = 15623522;
     name = "Amar Paul";
   };
+  ambroisie = {
+    email = "bruno.nixpkgs@belanyi.fr";
+    github = "ambroisie";
+    githubId = 12465195;
+    name = "Bruno BELANYI";
+  };
   ambrop72 = {
     email = "ambrop7@gmail.com";
     github = "ambrop72";
@@ -8839,6 +8851,12 @@
     githubId = 15379000;
     name = "schneefux";
   };
+  schnusch = {
+    email = "schnusch@users.noreply.github.com";
+    github = "schnusch";
+    githubId = 5104601;
+    name = "schnusch";
+  };
   schristo = {
     email = "schristopher@konputa.com";
     name = "Scott Christopher";
@@ -9849,6 +9867,12 @@
     githubId = 3105057;
     name = "Jan Beinke";
   };
+  therealansh = {
+    email = "tyagiansh23@gmail.com";
+    github = "therealansh";
+    githubId = 57180880;
+    name = "Ansh Tyagi";
+  };
   thesola10 = {
     email = "me@thesola.io";
     github = "thesola10";
diff --git a/third_party/nixpkgs/nixos/doc/manual/configuration/x-windows.xml b/third_party/nixpkgs/nixos/doc/manual/configuration/x-windows.xml
index a499f0080d..757174c526 100644
--- a/third_party/nixpkgs/nixos/doc/manual/configuration/x-windows.xml
+++ b/third_party/nixpkgs/nixos/doc/manual/configuration/x-windows.xml
@@ -204,18 +204,18 @@
     XKB
    </link>
    keyboard layouts using the option
-   <option>
-    <link linkend="opt-services.xserver.extraLayouts">
-     services.xserver.extraLayouts
-    </link>
-   </option>.
+   <option><link linkend="opt-services.xserver.extraLayouts">
+     services.xserver.extraLayouts</link></option>.
+  </para>
+  <para>
    As a first example, we are going to create a layout based on the basic US
    layout, with an additional layer to type some greek symbols by pressing the
    right-alt key.
   </para>
   <para>
-   To do this we are going to create a <literal>us-greek</literal> file
-   with a <literal>xkb_symbols</literal> section.
+   Create a file called <literal>us-greek</literal> with the following
+   content (under a directory called <literal>symbols</literal>; it's
+   an XKB peculiarity that will help with testing):
   </para>
 <programlisting>
 xkb_symbols &quot;us-greek&quot;
@@ -231,14 +231,13 @@ xkb_symbols &quot;us-greek&quot;
 };
 </programlisting>
   <para>
-   To install the layout, the filepath, a description and the list of
-   languages must be given:
+   A minimal layout specification must include the following:
   </para>
 <programlisting>
 <xref linkend="opt-services.xserver.extraLayouts"/>.us-greek = {
   description = "US layout with alt-gr greek";
   languages   = [ "eng" ];
-  symbolsFile = /path/to/us-greek;
+  symbolsFile = /yourpath/symbols/us-greek;
 }
 </programlisting>
   <note>
@@ -248,9 +247,27 @@ xkb_symbols &quot;us-greek&quot;
   </para>
   </note>
   <para>
-   The layout should now be installed and ready to use: try it by
-   running <literal>setxkbmap us-greek</literal> and type
-   <literal>&lt;alt&gt;+a</literal>. To change the default the usual
+   Applying this customization requires rebuilding several packages,
+   and a broken XKB file can lead to the X session crashing at login.
+   Therefore, you're strongly advised to <emphasis role="strong">test
+   your layout before applying it</emphasis>:
+<screen>
+<prompt>$ </prompt>nix-shell -p xorg.xkbcomp
+<prompt>$ </prompt>setxkbmap -I/yourpath us-greek -print | xkbcomp -I/yourpath - $DISPLAY
+</screen>
+  </para>
+  <para>
+   You can inspect the predefined XKB files for examples:
+<screen>
+<prompt>$ </prompt>echo "$(nix-build --no-out-link '&lt;nixpkgs&gt;' -A xorg.xkeyboardconfig)/etc/X11/xkb/"
+</screen>
+  </para>
+  <para>
+   Once the configuration is applied, and you did a logout/login
+   cycle, the layout should be ready to use. You can try it by e.g.
+   running <literal>setxkbmap us-greek</literal> and then type
+   <literal>&lt;alt&gt;+a</literal> (it may not get applied in your
+   terminal straight away). To change the default, the usual
    <option>
     <link linkend="opt-services.xserver.layout">
      services.xserver.layout
diff --git a/third_party/nixpkgs/nixos/lib/make-disk-image.nix b/third_party/nixpkgs/nixos/lib/make-disk-image.nix
index 023d0791a5..7d40d3b554 100644
--- a/third_party/nixpkgs/nixos/lib/make-disk-image.nix
+++ b/third_party/nixpkgs/nixos/lib/make-disk-image.nix
@@ -15,6 +15,8 @@
 
 , # size of the boot partition, is only used if partitionTableType is
   # either "efi" or "hybrid"
+  # This will be undersized slightly, as this is actually the offset of
+  # the end of the partition. Generally it will be 1MiB smaller.
   bootSize ? "256M"
 
 , # The files and directories to be placed in the target file system.
@@ -163,6 +165,8 @@ let format' = format; in let
 
   closureInfo = pkgs.closureInfo { rootPaths = [ config.system.build.toplevel channelSources ]; };
 
+  blockSize = toString (4 * 1024); # ext4fs block size (not block device sector size)
+
   prepareImage = ''
     export PATH=${binPath}
 
@@ -175,6 +179,24 @@ let format' = format; in let
       echo $(( "$1" * 512  ))
     }
 
+    # Given lines of numbers, adds them together
+    sum_lines() {
+      local acc=0
+      while read -r number; do
+        acc=$((acc+number))
+      done
+      echo "$acc"
+    }
+
+    mebibyte=$(( 1024 * 1024 ))
+
+    # Approximative percentage of reserved space in an ext4 fs over 512MiB.
+    # 0.05208587646484375
+    #  × 1000, integer part: 52
+    compute_fudge() {
+      echo $(( $1 * 52 / 1000 ))
+    }
+
     mkdir $out
 
     root="$PWD/root"
@@ -235,12 +257,53 @@ let format' = format; in let
 
     ${if diskSize == "auto" then ''
       ${if partitionTableType == "efi" || partitionTableType == "hybrid" then ''
-        additionalSpace=$(( ($(numfmt --from=iec '${additionalSpace}') + $(numfmt --from=iec '${bootSize}')) / 1000 ))
+        # Add the GPT at the end
+        gptSpace=$(( 512 * 34 * 1 ))
+        # Normally we'd need to account for alignment and things, if bootSize
+        # represented the actual size of the boot partition. But it instead
+        # represents the offset at which it ends.
+        # So we know bootSize is the reserved space in front of the partition.
+        reservedSpace=$(( gptSpace + $(numfmt --from=iec '${bootSize}') ))
+      '' else if partitionTableType == "legacy+gpt" then ''
+        # Add the GPT at the end
+        gptSpace=$(( 512 * 34 * 1 ))
+        # And include the bios_grub partition; the ext4 partition starts at 2MB exactly.
+        reservedSpace=$(( gptSpace + 2 * mebibyte ))
+      '' else if partitionTableType == "legacy" then ''
+        # Add the 1MiB aligned reserved space (includes MBR)
+        reservedSpace=$(( mebibyte ))
       '' else ''
-        additionalSpace=$(( $(numfmt --from=iec '${additionalSpace}') / 1000 ))
+        reservedSpace=0
       ''}
-      diskSize=$(( $(set -- $(du -d0 $root); echo "$1") + $additionalSpace ))
-      truncate -s "$diskSize"K $diskImage
+      additionalSpace=$(( $(numfmt --from=iec '${additionalSpace}') + reservedSpace ))
+
+      # Compute required space in filesystem blocks
+      diskUsage=$(find . ! -type d -exec 'du' '--apparent-size' '--block-size' "${blockSize}" '{}' ';' | cut -f1 | sum_lines)
+      # Each inode takes space!
+      numInodes=$(find . | wc -l)
+      # Convert to bytes, inodes take two blocks each!
+      diskUsage=$(( (diskUsage + 2 * numInodes) * ${blockSize} ))
+      # Then increase the required space to account for the reserved blocks.
+      fudge=$(compute_fudge $diskUsage)
+      requiredFilesystemSpace=$(( diskUsage + fudge ))
+
+      diskSize=$(( requiredFilesystemSpace  + additionalSpace ))
+
+      # Round up to the nearest mebibyte.
+      # This ensures whole 512 bytes sector sizes in the disk image
+      # and helps towards aligning partitions optimally.
+      if (( diskSize % mebibyte )); then
+        diskSize=$(( ( diskSize / mebibyte + 1) * mebibyte ))
+      fi
+
+      truncate -s "$diskSize" $diskImage
+
+      printf "Automatic disk size...\n"
+      printf "  Closure space use: %d bytes\n" $diskUsage
+      printf "  fudge: %d bytes\n" $fudge
+      printf "  Filesystem size needed: %d bytes\n" $requiredFilesystemSpace
+      printf "  Additional space: %d bytes\n" $additionalSpace
+      printf "  Disk image size: %d bytes\n" $diskSize
     '' else ''
       truncate -s ${toString diskSize}M $diskImage
     ''}
@@ -251,9 +314,9 @@ let format' = format; in let
       # Get start & length of the root partition in sectors to $START and $SECTORS.
       eval $(partx $diskImage -o START,SECTORS --nr ${rootPartition} --pairs)
 
-      mkfs.${fsType} -F -L ${label} $diskImage -E offset=$(sectorsToBytes $START) $(sectorsToKilobytes $SECTORS)K
+      mkfs.${fsType} -b ${blockSize} -F -L ${label} $diskImage -E offset=$(sectorsToBytes $START) $(sectorsToKilobytes $SECTORS)K
     '' else ''
-      mkfs.${fsType} -F -L ${label} $diskImage
+      mkfs.${fsType} -b ${blockSize} -F -L ${label} $diskImage
     ''}
 
     echo "copying staging root to image..."
@@ -283,6 +346,9 @@ in pkgs.vmTools.runInLinuxVM (
       # Some tools assume these exist
       ln -s vda /dev/xvda
       ln -s vda /dev/sda
+      # make systemd-boot find ESP without udev
+      mkdir /dev/block
+      ln -s /dev/vda1 /dev/block/254:1
 
       mountPoint=/mnt
       mkdir $mountPoint
diff --git a/third_party/nixpkgs/nixos/maintainers/scripts/cloudstack/cloudstack-image.nix b/third_party/nixpkgs/nixos/maintainers/scripts/cloudstack/cloudstack-image.nix
index 37b46db059..005f75476e 100644
--- a/third_party/nixpkgs/nixos/maintainers/scripts/cloudstack/cloudstack-image.nix
+++ b/third_party/nixpkgs/nixos/maintainers/scripts/cloudstack/cloudstack-image.nix
@@ -10,7 +10,6 @@ with lib;
 
   system.build.cloudstackImage = import ../../../lib/make-disk-image.nix {
     inherit lib config pkgs;
-    diskSize = 8192;
     format = "qcow2";
     configFile = pkgs.writeText "configuration.nix"
       ''
diff --git a/third_party/nixpkgs/nixos/maintainers/scripts/ec2/amazon-image.nix b/third_party/nixpkgs/nixos/maintainers/scripts/ec2/amazon-image.nix
index 0ecf07669a..653744986d 100644
--- a/third_party/nixpkgs/nixos/maintainers/scripts/ec2/amazon-image.nix
+++ b/third_party/nixpkgs/nixos/maintainers/scripts/ec2/amazon-image.nix
@@ -40,8 +40,9 @@ in {
     };
 
     sizeMB = mkOption {
-      type = types.int;
-      default = if config.ec2.hvm then 2048 else 8192;
+      type = with types; either (enum [ "auto" ]) int;
+      default = "auto";
+      example = 8192;
       description = "The size in MB of the image";
     };
 
diff --git a/third_party/nixpkgs/nixos/maintainers/scripts/openstack/openstack-image.nix b/third_party/nixpkgs/nixos/maintainers/scripts/openstack/openstack-image.nix
index 4c464f43f6..3255e7f3d4 100644
--- a/third_party/nixpkgs/nixos/maintainers/scripts/openstack/openstack-image.nix
+++ b/third_party/nixpkgs/nixos/maintainers/scripts/openstack/openstack-image.nix
@@ -12,8 +12,8 @@ with lib;
 
   system.build.openstackImage = import ../../../lib/make-disk-image.nix {
     inherit lib config;
+    additionalSpace = "1024M";
     pkgs = import ../../../.. { inherit (pkgs) system; }; # ensure we use the regular qemu-kvm package
-    diskSize = 8192;
     format = "qcow2";
     configFile = pkgs.writeText "configuration.nix"
       ''
diff --git a/third_party/nixpkgs/nixos/modules/installer/tools/nixos-install.sh b/third_party/nixpkgs/nixos/modules/installer/tools/nixos-install.sh
index 9d49d4055e..ea9667995e 100644
--- a/third_party/nixpkgs/nixos/modules/installer/tools/nixos-install.sh
+++ b/third_party/nixpkgs/nixos/modules/installer/tools/nixos-install.sh
@@ -125,7 +125,7 @@ fi
 
 # Resolve the flake.
 if [[ -n $flake ]]; then
-    flake=$(nix "${flakeFlags[@]}" flake info --json "${extraBuildFlags[@]}" "${lockFlags[@]}" -- "$flake" | jq -r .url)
+    flake=$(nix "${flakeFlags[@]}" flake metadata --json "${extraBuildFlags[@]}" "${lockFlags[@]}" -- "$flake" | jq -r .url)
 fi
 
 if [[ ! -e $NIXOS_CONFIG && -z $system && -z $flake ]]; then
diff --git a/third_party/nixpkgs/nixos/modules/module-list.nix b/third_party/nixpkgs/nixos/modules/module-list.nix
index 98ba5ba48b..3720b24f39 100644
--- a/third_party/nixpkgs/nixos/modules/module-list.nix
+++ b/third_party/nixpkgs/nixos/modules/module-list.nix
@@ -530,6 +530,7 @@
   ./services/misc/parsoid.nix
   ./services/misc/plex.nix
   ./services/misc/plikd.nix
+  ./services/misc/podgrab.nix
   ./services/misc/tautulli.nix
   ./services/misc/pinnwand.nix
   ./services/misc/pykms.nix
@@ -701,6 +702,9 @@
   ./services/networking/iodine.nix
   ./services/networking/iperf3.nix
   ./services/networking/ircd-hybrid/default.nix
+  ./services/networking/iscsi/initiator.nix
+  ./services/networking/iscsi/root-initiator.nix
+  ./services/networking/iscsi/target.nix
   ./services/networking/iwd.nix
   ./services/networking/jicofo.nix
   ./services/networking/jitsi-videobridge.nix
diff --git a/third_party/nixpkgs/nixos/modules/services/hardware/pcscd.nix b/third_party/nixpkgs/nixos/modules/services/hardware/pcscd.nix
index f3fc4c3cc7..54b6693f85 100644
--- a/third_party/nixpkgs/nixos/modules/services/hardware/pcscd.nix
+++ b/third_party/nixpkgs/nixos/modules/services/hardware/pcscd.nix
@@ -10,39 +10,37 @@ let
     paths = map (p: "${p}/pcsc/drivers") config.services.pcscd.plugins;
   };
 
-in {
+in
+{
 
   ###### interface
 
-  options = {
+  options.services.pcscd = {
+    enable = mkEnableOption "PCSC-Lite daemon";
 
-    services.pcscd = {
-      enable = mkEnableOption "PCSC-Lite daemon";
+    plugins = mkOption {
+      type = types.listOf types.package;
+      default = [ pkgs.ccid ];
+      defaultText = "[ pkgs.ccid ]";
+      example = literalExample "[ pkgs.pcsc-cyberjack ]";
+      description = "Plugin packages to be used for PCSC-Lite.";
+    };
 
-      plugins = mkOption {
-        type = types.listOf types.package;
-        default = [ pkgs.ccid ];
-        defaultText = "[ pkgs.ccid ]";
-        example = literalExample "[ pkgs.pcsc-cyberjack ]";
-        description = "Plugin packages to be used for PCSC-Lite.";
-      };
+    readerConfig = mkOption {
+      type = types.lines;
+      default = "";
+      example = ''
+        FRIENDLYNAME      "Some serial reader"
+        DEVICENAME        /dev/ttyS0
+        LIBPATH           /path/to/serial_reader.so
+        CHANNELID         1
+      '';
+      description = ''
+        Configuration for devices that aren't hotpluggable.
 
-      readerConfig = mkOption {
-        type = types.lines;
-        default = "";
-        example = ''
-          FRIENDLYNAME      "Some serial reader"
-          DEVICENAME        /dev/ttyS0
-          LIBPATH           /path/to/serial_reader.so
-          CHANNELID         1
-        '';
-        description = ''
-          Configuration for devices that aren't hotpluggable.
-
-          See <citerefentry><refentrytitle>reader.conf</refentrytitle>
-          <manvolnum>5</manvolnum></citerefentry> for valid options.
-        '';
-      };
+        See <citerefentry><refentrytitle>reader.conf</refentrytitle>
+        <manvolnum>5</manvolnum></citerefentry> for valid options.
+      '';
     };
   };
 
@@ -50,20 +48,15 @@ in {
 
   config = mkIf config.services.pcscd.enable {
 
-    systemd.sockets.pcscd = {
-      description = "PCSC-Lite Socket";
-      wantedBy = [ "sockets.target" ];
-      before = [ "multi-user.target" ];
-      socketConfig.ListenStream = "/run/pcscd/pcscd.comm";
-    };
+    environment.etc."reader.conf".source = cfgFile;
+
+    systemd.packages = [ (getBin pkgs.pcsclite) ];
+
+    systemd.sockets.pcscd.wantedBy = [ "sockets.target" ];
 
     systemd.services.pcscd = {
-      description = "PCSC-Lite daemon";
       environment.PCSCLITE_HP_DROPDIR = pluginEnv;
-      serviceConfig = {
-        ExecStart = "${getBin pkgs.pcsclite}/sbin/pcscd -f -x -c ${cfgFile}";
-        ExecReload = "${getBin pkgs.pcsclite}/sbin/pcscd -H";
-      };
+      restartTriggers = [ "/etc/reader.conf" ];
     };
   };
 }
diff --git a/third_party/nixpkgs/nixos/modules/services/mail/exim.nix b/third_party/nixpkgs/nixos/modules/services/mail/exim.nix
index 892fbd3321..8927d84b47 100644
--- a/third_party/nixpkgs/nixos/modules/services/mail/exim.nix
+++ b/third_party/nixpkgs/nixos/modules/services/mail/exim.nix
@@ -67,6 +67,13 @@ in
         '';
       };
 
+      queueRunnerInterval = mkOption {
+        type = types.str;
+        default = "5m";
+        description = ''
+          How often to spawn a new queue runner.
+        '';
+      };
     };
 
   };
@@ -104,7 +111,7 @@ in
       wantedBy = [ "multi-user.target" ];
       restartTriggers = [ config.environment.etc."exim.conf".source ];
       serviceConfig = {
-        ExecStart   = "${cfg.package}/bin/exim -bdf -q30m";
+        ExecStart   = "${cfg.package}/bin/exim -bdf -q${cfg.queueRunnerInterval}";
         ExecReload  = "${coreutils}/bin/kill -HUP $MAINPID";
       };
       preStart = ''
diff --git a/third_party/nixpkgs/nixos/modules/services/mail/spamassassin.nix b/third_party/nixpkgs/nixos/modules/services/mail/spamassassin.nix
index 4e642542ec..ac878222b2 100644
--- a/third_party/nixpkgs/nixos/modules/services/mail/spamassassin.nix
+++ b/third_party/nixpkgs/nixos/modules/services/mail/spamassassin.nix
@@ -126,19 +126,36 @@ in
     };
 
     systemd.services.sa-update = {
+      # Needs to be able to contact the update server.
+      wants = [ "network-online.target" ];
+      after = [ "network-online.target" ];
+
+      serviceConfig = {
+        Type = "oneshot";
+        User = "spamd";
+        Group = "spamd";
+        StateDirectory = "spamassassin";
+        ExecStartPost = "+${pkgs.systemd}/bin/systemctl -q --no-block try-reload-or-restart spamd.service";
+      };
+
       script = ''
         set +e
-        ${pkgs.su}/bin/su -s "${pkgs.bash}/bin/bash" -c "${pkgs.spamassassin}/bin/sa-update --gpghomedir=/var/lib/spamassassin/sa-update-keys/" spamd
-
-        v=$?
+        ${pkgs.spamassassin}/bin/sa-update --verbose --gpghomedir=/var/lib/spamassassin/sa-update-keys/
+        rc=$?
         set -e
-        if [ $v -gt 1 ]; then
-          echo "sa-update execution error"
-          exit $v
+
+        if [[ $rc -gt 1 ]]; then
+          # sa-update failed.
+          exit $rc
         fi
-        if [ $v -eq 0 ]; then
-          systemctl reload spamd.service
+
+        if [[ $rc -eq 1 ]]; then
+          # No update was available, exit successfully.
+          exit 0
         fi
+
+        # An update was available and installed. Compile the rules.
+        ${pkgs.spamassassin}/bin/sa-compile
       '';
     };
 
@@ -153,32 +170,22 @@ in
     };
 
     systemd.services.spamd = {
-      description = "Spam Assassin Server";
+      description = "SpamAssassin Server";
 
       wantedBy = [ "multi-user.target" ];
-      after = [ "network.target" ];
+      wants = [ "sa-update.service" ];
+      after = [
+        "network.target"
+        "sa-update.service"
+      ];
 
       serviceConfig = {
-        ExecStart = "${pkgs.spamassassin}/bin/spamd ${optionalString cfg.debug "-D"} --username=spamd --groupname=spamd --virtual-config-dir=/var/lib/spamassassin/user-%u --allow-tell --pidfile=/run/spamd.pid";
-        ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
+        User = "spamd";
+        Group = "spamd";
+        ExecStart = "+${pkgs.spamassassin}/bin/spamd ${optionalString cfg.debug "-D"} --username=spamd --groupname=spamd --virtual-config-dir=%S/spamassassin/user-%u --allow-tell --pidfile=/run/spamd.pid";
+        ExecReload = "+${pkgs.coreutils}/bin/kill -HUP $MAINPID";
+        StateDirectory = "spamassassin";
       };
-
-      # 0 and 1 no error, exitcode > 1 means error:
-      # https://spamassassin.apache.org/full/3.1.x/doc/sa-update.html#exit_codes
-      preStart = ''
-        echo "Recreating '/var/lib/spamasassin' with creating '3.004001' (or similar) and 'sa-update-keys'"
-        mkdir -p /var/lib/spamassassin
-        chown spamd:spamd /var/lib/spamassassin -R
-        set +e
-        ${pkgs.su}/bin/su -s "${pkgs.bash}/bin/bash" -c "${pkgs.spamassassin}/bin/sa-update --gpghomedir=/var/lib/spamassassin/sa-update-keys/" spamd
-        v=$?
-        set -e
-        if [ $v -gt 1 ]; then
-          echo "sa-update execution error"
-          exit $v
-        fi
-        chown spamd:spamd /var/lib/spamassassin -R
-      '';
     };
   };
 }
diff --git a/third_party/nixpkgs/nixos/modules/services/misc/jellyfin.nix b/third_party/nixpkgs/nixos/modules/services/misc/jellyfin.nix
index 64b774a220..c1b4586404 100644
--- a/third_party/nixpkgs/nixos/modules/services/misc/jellyfin.nix
+++ b/third_party/nixpkgs/nixos/modules/services/misc/jellyfin.nix
@@ -18,6 +18,7 @@ in
 
       package = mkOption {
         type = types.package;
+        default = pkgs.jellyfin;
         example = literalExample "pkgs.jellyfin";
         description = ''
           Jellyfin package to use.
@@ -98,11 +99,6 @@ in
       };
     };
 
-    services.jellyfin.package = mkDefault (
-      if versionAtLeast config.system.stateVersion "20.09" then pkgs.jellyfin
-        else pkgs.jellyfin_10_5
-    );
-
     users.users = mkIf (cfg.user == "jellyfin") {
       jellyfin = {
         group = cfg.group;
diff --git a/third_party/nixpkgs/nixos/modules/services/misc/podgrab.nix b/third_party/nixpkgs/nixos/modules/services/misc/podgrab.nix
new file mode 100644
index 0000000000..7077408b79
--- /dev/null
+++ b/third_party/nixpkgs/nixos/modules/services/misc/podgrab.nix
@@ -0,0 +1,50 @@
+{ config, lib, pkgs, ... }:
+let
+  cfg = config.services.podgrab;
+in
+{
+  options.services.podgrab = with lib; {
+    enable = mkEnableOption "Podgrab, a self-hosted podcast manager";
+
+    passwordFile = mkOption {
+      type = with types; nullOr str;
+      default = null;
+      example = "/run/secrets/password.env";
+      description = ''
+        The path to a file containing the PASSWORD environment variable
+        definition for Podgrab's authentification.
+      '';
+    };
+
+    port = mkOption {
+      type = types.port;
+      default = 8080;
+      example = 4242;
+      description = "The port on which Podgrab will listen for incoming HTTP traffic.";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    systemd.services.podgrab = {
+      description = "Podgrab podcast manager";
+      wantedBy = [ "multi-user.target" ];
+      environment = {
+        CONFIG = "/var/lib/podgrab/config";
+        DATA = "/var/lib/podgrab/data";
+        GIN_MODE = "release";
+        PORT = toString cfg.port;
+      };
+      serviceConfig = {
+        DynamicUser = true;
+        EnvironmentFile = lib.optional (cfg.passwordFile != null) [
+          cfg.passwordFile
+        ];
+        ExecStart = "${pkgs.podgrab}/bin/podgrab";
+        WorkingDirectory = "${pkgs.podgrab}/share";
+        StateDirectory = [ "podgrab/config" "podgrab/data" ];
+      };
+    };
+  };
+
+  meta.maintainers = with lib.maintainers; [ ambroisie ];
+}
diff --git a/third_party/nixpkgs/nixos/modules/services/networking/iscsi/initiator.nix b/third_party/nixpkgs/nixos/modules/services/networking/iscsi/initiator.nix
new file mode 100644
index 0000000000..cbc919a2f7
--- /dev/null
+++ b/third_party/nixpkgs/nixos/modules/services/networking/iscsi/initiator.nix
@@ -0,0 +1,84 @@
+{ config, lib, pkgs, ... }: with lib;
+let
+  cfg = config.services.openiscsi;
+in
+{
+  options.services.openiscsi = with types; {
+    enable = mkEnableOption "the openiscsi iscsi daemon";
+    enableAutoLoginOut = mkEnableOption ''
+      automatic login and logout of all automatic targets.
+      You probably do not want this.
+    '';
+    discoverPortal = mkOption {
+      type = nullOr str;
+      default = null;
+      description = "Portal to discover targets on";
+    };
+    name = mkOption {
+      type = str;
+      description = "Name of this iscsi initiator";
+      example = "iqn.2020-08.org.linux-iscsi.initiatorhost:example";
+    };
+    package = mkOption {
+      type = package;
+      description = "openiscsi package to use";
+      default = pkgs.openiscsi;
+      defaultText = "pkgs.openiscsi";
+    };
+
+    extraConfig = mkOption {
+      type = str;
+      default = "";
+      description = "Lines to append to default iscsid.conf";
+    };
+
+    extraConfigFile = mkOption {
+      description = ''
+        Append an additional file's contents to /etc/iscsid.conf. Use a non-store path
+        and store passwords in this file.
+      '';
+      default = null;
+      type = nullOr str;
+    };
+  };
+
+  config = mkIf cfg.enable {
+    environment.etc."iscsi/iscsid.conf.fragment".source = pkgs.runCommand "iscsid.conf" {} ''
+      cat "${cfg.package}/etc/iscsi/iscsid.conf" > $out
+      cat << 'EOF' >> $out
+      ${cfg.extraConfig}
+      ${optionalString cfg.enableAutoLoginOut "node.startup = automatic"}
+      EOF
+    '';
+    environment.etc."iscsi/initiatorname.iscsi".text = "InitiatorName=${cfg.name}";
+
+    system.activationScripts.iscsid = let
+      extraCfgDumper = optionalString (cfg.extraConfigFile != null) ''
+        if [ -f "${cfg.extraConfigFile}" ]; then
+          printf "\n# The following is from ${cfg.extraConfigFile}:\n"
+          cat "${cfg.extraConfigFile}"
+        else
+          echo "Warning: services.openiscsi.extraConfigFile ${cfg.extraConfigFile} does not exist!" >&2
+        fi
+      '';
+    in ''
+      (
+        cat ${config.environment.etc."iscsi/iscsid.conf.fragment".source}
+        ${extraCfgDumper}
+      ) > /etc/iscsi/iscsid.conf
+    '';
+
+    systemd.packages = [ cfg.package ];
+
+    systemd.services."iscsid".wantedBy = [ "multi-user.target" ];
+    systemd.sockets."iscsid".wantedBy = [ "sockets.target" ];
+
+    systemd.services."iscsi" = mkIf cfg.enableAutoLoginOut {
+      wantedBy = [ "remote-fs.target" ];
+      serviceConfig.ExecStartPre = mkIf (cfg.discoverPortal != null) "${cfg.package}/bin/iscsiadm --mode discoverydb --type sendtargets --portal ${escapeShellArg cfg.discoverPortal} --discover";
+    };
+
+    environment.systemPackages = [ cfg.package ];
+    boot.kernelModules = [ "iscsi_tcp" ];
+  };
+}
diff --git a/third_party/nixpkgs/nixos/modules/services/networking/iscsi/root-initiator.nix b/third_party/nixpkgs/nixos/modules/services/networking/iscsi/root-initiator.nix
new file mode 100644
index 0000000000..3274878c4f
--- /dev/null
+++ b/third_party/nixpkgs/nixos/modules/services/networking/iscsi/root-initiator.nix
@@ -0,0 +1,181 @@
+{ config, lib, pkgs, ... }: with lib;
+let
+  cfg = config.boot.iscsi-initiator;
+in
+{
+  # If you're booting entirely off another machine you may want to add
+  # this snippet to always boot the latest "system" version. It is not
+  # enabled by default in case you have an initrd on a local disk:
+  #
+  #     boot.initrd.postMountCommands = ''
+  #       ln -sfn /nix/var/nix/profiles/system/init /mnt-root/init
+  #       stage2Init=/init
+  #     '';
+  #
+  # Note: Theoretically you might want to connect to multiple portals and
+  # log in to multiple targets, however the authors of this module so far
+  # don't have the need or expertise to reasonably implement it. Also,
+  # consider carefully before making your boot chain depend on multiple
+  # machines to be up.
+  options.boot.iscsi-initiator = with types; {
+    name = mkOption {
+      description = ''
+        Name of the iSCSI initiator to boot from. Note, booting from iscsi
+        requires networkd based networking.
+      '';
+      default = null;
+      example = "iqn.2020-08.org.linux-iscsi.initiatorhost:example";
+      type = nullOr str;
+    };
+
+    discoverPortal = mkOption {
+      description = ''
+        iSCSI portal to boot from.
+      '';
+      default = null;
+      example = "192.168.1.1:3260";
+      type = nullOr str;
+    };
+
+    target = mkOption {
+      description = ''
+        Name of the iSCSI target to boot from.
+      '';
+      default = null;
+      example = "iqn.2020-08.org.linux-iscsi.targethost:example";
+      type = nullOr str;
+    };
+
+    logLevel = mkOption {
+      description = ''
+        Higher numbers elicits more logs.
+      '';
+      default = 1;
+      example = 8;
+      type = int;
+    };
+
+    loginAll = mkOption {
+      description = ''
+        Do not log into a specific target on the portal, but to all that we discover.
+        This overrides setting target.
+      '';
+      type = bool;
+      default = false;
+    };
+
+    extraConfig = mkOption {
+      description = "Extra lines to append to /etc/iscsid.conf";
+      default = null;
+      type = nullOr lines;
+    };
+
+    extraConfigFile = mkOption {
+      description = ''
+        Append an additional file's contents to `/etc/iscsid.conf`. Use a non-store path
+        and store passwords in this file. Note: the file specified here must be available
+        in the initrd, see: `boot.initrd.secrets`.
+      '';
+      default = null;
+      type = nullOr str;
+    };
+  };
+
+  config = mkIf (cfg.name != null) {
+    # The "scripted" networking configuration (ie: non-networkd)
+    # doesn't properly order the start and stop of the interfaces, and the
+    # network interfaces are torn down before unmounting disks. Since this
+    # module is specifically for very-early-boot network mounts, we need
+    # the network to stay on.
+    #
+    # We could probably fix the scripted options to properly order, but I'm
+    # not inclined to invest that time today. Hopefully this gets users far
+    # enough along and they can just use networkd.
+    networking.useNetworkd = true;
+    networking.useDHCP = false; # Required to set useNetworkd = true
+
+    boot.initrd = {
+      network.enable = true;
+
+      # By default, the stage-1 disables the network and resets the interfaces
+      # on startup. Since our startup disks are on the network, we can't let
+      # the network not work.
+      network.flushBeforeStage2 = false;
+
+      kernelModules = [ "iscsi_tcp" ];
+
+      extraUtilsCommands = ''
+        copy_bin_and_libs ${pkgs.openiscsi}/bin/iscsid
+        copy_bin_and_libs ${pkgs.openiscsi}/bin/iscsiadm
+        ${optionalString (!config.boot.initrd.network.ssh.enable) "cp -pv ${pkgs.glibc.out}/lib/libnss_files.so.* $out/lib"}
+
+        mkdir -p $out/etc/iscsi
+        cp ${config.environment.etc.hosts.source} $out/etc/hosts
+        cp ${pkgs.openiscsi}/etc/iscsi/iscsid.conf $out/etc/iscsi/iscsid.fragment.conf
+        chmod +w $out/etc/iscsi/iscsid.fragment.conf
+        cat << 'EOF' >> $out/etc/iscsi/iscsid.fragment.conf
+        ${optionalString (cfg.extraConfig != null) cfg.extraConfig}
+        EOF
+      '';
+
+      extraUtilsCommandsTest = ''
+        $out/bin/iscsiadm --version
+      '';
+
+      preLVMCommands = let
+        extraCfgDumper = optionalString (cfg.extraConfigFile != null) ''
+          if [ -f "${cfg.extraConfigFile}" ]; then
+            printf "\n# The following is from ${cfg.extraConfigFile}:\n"
+            cat "${cfg.extraConfigFile}"
+          else
+            echo "Warning: boot.iscsi-initiator.extraConfigFile ${cfg.extraConfigFile} does not exist!" >&2
+          fi
+        '';
+      in ''
+        ${optionalString (!config.boot.initrd.network.ssh.enable) ''
+        # stolen from initrd-ssh.nix
+        echo 'root:x:0:0:root:/root:/bin/ash' > /etc/passwd
+        echo 'passwd: files' > /etc/nsswitch.conf
+      ''}
+
+        cp -f $extraUtils/etc/hosts /etc/hosts
+
+        mkdir -p /etc/iscsi /run/lock/iscsi
+        echo "InitiatorName=${cfg.name}" > /etc/iscsi/initiatorname.iscsi
+
+        (
+          cat "$extraUtils/etc/iscsi/iscsid.fragment.conf"
+          printf "\n"
+          ${optionalString cfg.loginAll ''echo "node.startup = automatic"''}
+          ${extraCfgDumper}
+        ) > /etc/iscsi/iscsid.conf
+
+        iscsid --foreground --no-pid-file --debug ${toString cfg.logLevel} &
+        iscsiadm --mode discoverydb \
+          --type sendtargets \
+          --discover \
+          --portal ${escapeShellArg cfg.discoverPortal} \
+          --debug ${toString cfg.logLevel}
+
+        ${if cfg.loginAll then ''
+        iscsiadm --mode node --loginall all
+      '' else ''
+        iscsiadm --mode node --targetname ${escapeShellArg cfg.target} --login
+      ''}
+        pkill -9 iscsid
+      '';
+    };
+
+    services.openiscsi = {
+      enable = true;
+      inherit (cfg) name;
+    };
+
+    assertions = [
+      {
+        assertion = cfg.loginAll -> cfg.target == null;
+        message = "iSCSI target name is set while login on all portals is enabled.";
+      }
+    ];
+  };
+}
diff --git a/third_party/nixpkgs/nixos/modules/services/networking/iscsi/target.nix b/third_party/nixpkgs/nixos/modules/services/networking/iscsi/target.nix
new file mode 100644
index 0000000000..8a10e7d346
--- /dev/null
+++ b/third_party/nixpkgs/nixos/modules/services/networking/iscsi/target.nix
@@ -0,0 +1,53 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.services.target;
+in
+{
+  ###### interface
+  options = {
+    services.target = with types; {
+      enable = mkEnableOption "the kernel's LIO iscsi target";
+
+      config = mkOption {
+        type = attrs;
+        default = {};
+        description = ''
+          Content of /etc/target/saveconfig.json
+          This file is normally read and written by targetcli
+        '';
+      };
+    };
+  };
+
+  ###### implementation
+  config = mkIf cfg.enable {
+    environment.etc."target/saveconfig.json" = {
+      text = builtins.toJSON cfg.config;
+      mode = "0600";
+    };
+
+    environment.systemPackages = with pkgs; [ targetcli ];
+
+    boot.kernelModules = [ "configfs" "target_core_mod" "iscsi_target_mod" ];
+
+    systemd.services.iscsi-target = {
+      enable = true;
+      after = [ "network.target" "local-fs.target" ];
+      requires = [ "sys-kernel-config.mount" ];
+      wantedBy = [ "multi-user.target" ];
+      serviceConfig = {
+        Type = "oneshot";
+        ExecStart = "${pkgs.python3.pkgs.rtslib}/bin/targetctl restore";
+        ExecStop = "${pkgs.python3.pkgs.rtslib}/bin/targetctl clear";
+        RemainAfterExit = "yes";
+      };
+    };
+
+    systemd.tmpfiles.rules = [
+      "d /etc/target 0700 root root - -"
+    ];
+  };
+}
diff --git a/third_party/nixpkgs/nixos/modules/system/boot/loader/systemd-boot/systemd-boot-builder.py b/third_party/nixpkgs/nixos/modules/system/boot/loader/systemd-boot/systemd-boot-builder.py
index 2ea191426c..63e01dd054 100644
--- a/third_party/nixpkgs/nixos/modules/system/boot/loader/systemd-boot/systemd-boot-builder.py
+++ b/third_party/nixpkgs/nixos/modules/system/boot/loader/systemd-boot/systemd-boot-builder.py
@@ -236,9 +236,12 @@ def main() -> None:
         gens += get_generations(profile)
     remove_old_entries(gens)
     for gen in gens:
-        write_entry(*gen, machine_id)
-        if os.readlink(system_dir(*gen)) == args.default_config:
-            write_loader_conf(*gen)
+        try:
+            write_entry(*gen, machine_id)
+            if os.readlink(system_dir(*gen)) == args.default_config:
+                write_loader_conf(*gen)
+        except OSError as e:
+            print("ignoring profile '{}' in the list of boot entries because of the following error:\n{}".format(profile, e), file=sys.stderr)
 
     memtest_entry_file = "@efiSysMountPoint@/loader/entries/memtest86.conf"
     if os.path.exists(memtest_entry_file):
diff --git a/third_party/nixpkgs/nixos/modules/virtualisation/azure-image.nix b/third_party/nixpkgs/nixos/modules/virtualisation/azure-image.nix
index 60fed3222e..03dd3c0513 100644
--- a/third_party/nixpkgs/nixos/modules/virtualisation/azure-image.nix
+++ b/third_party/nixpkgs/nixos/modules/virtualisation/azure-image.nix
@@ -9,8 +9,9 @@ in
 
   options = {
     virtualisation.azureImage.diskSize = mkOption {
-      type = with types; int;
-      default = 2048;
+      type = with types; either (enum [ "auto" ]) int;
+      default = "auto";
+      example = 2048;
       description = ''
         Size of disk image. Unit is MB.
       '';
diff --git a/third_party/nixpkgs/nixos/modules/virtualisation/digital-ocean-image.nix b/third_party/nixpkgs/nixos/modules/virtualisation/digital-ocean-image.nix
index b582e235d4..0ff2ee591f 100644
--- a/third_party/nixpkgs/nixos/modules/virtualisation/digital-ocean-image.nix
+++ b/third_party/nixpkgs/nixos/modules/virtualisation/digital-ocean-image.nix
@@ -10,8 +10,9 @@ in
 
   options = {
     virtualisation.digitalOceanImage.diskSize = mkOption {
-      type = with types; int;
-      default = 4096;
+      type = with types; either (enum [ "auto" ]) int;
+      default = "auto";
+      example = 4096;
       description = ''
         Size of disk image. Unit is MB.
       '';
diff --git a/third_party/nixpkgs/nixos/modules/virtualisation/google-compute-image.nix b/third_party/nixpkgs/nixos/modules/virtualisation/google-compute-image.nix
index e2332df611..79c3921669 100644
--- a/third_party/nixpkgs/nixos/modules/virtualisation/google-compute-image.nix
+++ b/third_party/nixpkgs/nixos/modules/virtualisation/google-compute-image.nix
@@ -18,8 +18,9 @@ in
 
   options = {
     virtualisation.googleComputeImage.diskSize = mkOption {
-      type = with types; int;
-      default = 1536;
+      type = with types; either (enum [ "auto" ]) int;
+      default = "auto";
+      example = 1536;
       description = ''
         Size of disk image. Unit is MB.
       '';
diff --git a/third_party/nixpkgs/nixos/modules/virtualisation/hyperv-image.nix b/third_party/nixpkgs/nixos/modules/virtualisation/hyperv-image.nix
index fabc9113df..6845d67500 100644
--- a/third_party/nixpkgs/nixos/modules/virtualisation/hyperv-image.nix
+++ b/third_party/nixpkgs/nixos/modules/virtualisation/hyperv-image.nix
@@ -9,8 +9,9 @@ in {
   options = {
     hyperv = {
       baseImageSize = mkOption {
-        type = types.int;
-        default = 2048;
+        type = with types; either (enum [ "auto" ]) int;
+        default = "auto";
+        example = 2048;
         description = ''
           The size of the hyper-v base image in MiB.
         '';
diff --git a/third_party/nixpkgs/nixos/modules/virtualisation/nixos-containers.nix b/third_party/nixpkgs/nixos/modules/virtualisation/nixos-containers.nix
index f15d587584..7a1f11ce40 100644
--- a/third_party/nixpkgs/nixos/modules/virtualisation/nixos-containers.nix
+++ b/third_party/nixpkgs/nixos/modules/virtualisation/nixos-containers.nix
@@ -439,21 +439,16 @@ in
       default = false;
       description = ''
         Whether this NixOS machine is a lightweight container running
-        in another NixOS system. If set to true, support for nested
-        containers is disabled by default, but can be reenabled by
-        setting <option>boot.enableContainers</option> to true.
+        in another NixOS system.
       '';
     };
 
     boot.enableContainers = mkOption {
       type = types.bool;
-      default = !config.boot.isContainer;
+      default = true;
       description = ''
         Whether to enable support for NixOS containers. Defaults to true
-        (at no cost if containers are not actually used), but only if the
-        system is not itself a lightweight container of a host.
-        To enable support for nested containers, this option has to be
-        explicitly set to true (in the outer container).
+        (at no cost if containers are not actually used).
       '';
     };
 
diff --git a/third_party/nixpkgs/nixos/modules/virtualisation/virtualbox-image.nix b/third_party/nixpkgs/nixos/modules/virtualisation/virtualbox-image.nix
index fa580e8b42..071edda826 100644
--- a/third_party/nixpkgs/nixos/modules/virtualisation/virtualbox-image.nix
+++ b/third_party/nixpkgs/nixos/modules/virtualisation/virtualbox-image.nix
@@ -11,8 +11,9 @@ in {
   options = {
     virtualbox = {
       baseImageSize = mkOption {
-        type = types.int;
-        default = 50 * 1024;
+        type = with types; either (enum [ "auto" ]) int;
+        default = "auto";
+        example = 50 * 1024;
         description = ''
           The size of the VirtualBox base image in MiB.
         '';
diff --git a/third_party/nixpkgs/nixos/modules/virtualisation/vmware-image.nix b/third_party/nixpkgs/nixos/modules/virtualisation/vmware-image.nix
index 9da9e145f7..f6cd12e2bb 100644
--- a/third_party/nixpkgs/nixos/modules/virtualisation/vmware-image.nix
+++ b/third_party/nixpkgs/nixos/modules/virtualisation/vmware-image.nix
@@ -18,8 +18,9 @@ in {
   options = {
     vmware = {
       baseImageSize = mkOption {
-        type = types.int;
-        default = 2048;
+        type = with types; either (enum [ "auto" ]) int;
+        default = "auto";
+        example = 2048;
         description = ''
           The size of the VMWare base image in MiB.
         '';
diff --git a/third_party/nixpkgs/nixos/modules/virtualisation/xen-dom0.nix b/third_party/nixpkgs/nixos/modules/virtualisation/xen-dom0.nix
index 24df1b6ad7..fea43727f2 100644
--- a/third_party/nixpkgs/nixos/modules/virtualisation/xen-dom0.nix
+++ b/third_party/nixpkgs/nixos/modules/virtualisation/xen-dom0.nix
@@ -161,9 +161,6 @@ in
 
     environment.systemPackages = [ cfg.package ];
 
-    # Make sure Domain 0 gets the required configuration
-    #boot.kernelPackages = pkgs.boot.kernelPackages.override { features={xen_dom0=true;}; };
-
     boot.kernelModules =
       [ "xen-evtchn" "xen-gntdev" "xen-gntalloc" "xen-blkback" "xen-netback"
         "xen-pciback" "evtchn" "gntdev" "netbk" "blkbk" "xen-scsibk"
diff --git a/third_party/nixpkgs/nixos/tests/all-tests.nix b/third_party/nixpkgs/nixos/tests/all-tests.nix
index a6a1c5619b..3aefa82301 100644
--- a/third_party/nixpkgs/nixos/tests/all-tests.nix
+++ b/third_party/nixpkgs/nixos/tests/all-tests.nix
@@ -75,6 +75,7 @@ in
   containers-ip = handleTest ./containers-ip.nix {};
   containers-macvlans = handleTest ./containers-macvlans.nix {};
   containers-names = handleTest ./containers-names.nix {};
+  containers-nested = handleTest ./containers-nested.nix {};
   containers-physical_interfaces = handleTest ./containers-physical_interfaces.nix {};
   containers-portforward = handleTest ./containers-portforward.nix {};
   containers-reloadable = handleTest ./containers-reloadable.nix {};
@@ -185,6 +186,7 @@ in
   iodine = handleTest ./iodine.nix {};
   ipfs = handleTest ./ipfs.nix {};
   ipv6 = handleTest ./ipv6.nix {};
+  iscsi-root = handleTest ./iscsi-root.nix {};
   jackett = handleTest ./jackett.nix {};
   jellyfin = handleTest ./jellyfin.nix {};
   jenkins = handleTest ./jenkins.nix {};
@@ -322,6 +324,7 @@ in
   pleroma = handleTestOn [ "x86_64-linux" "aarch64-linux" ] ./pleroma.nix {};
   plikd = handleTest ./plikd.nix {};
   plotinus = handleTest ./plotinus.nix {};
+  podgrab = handleTest ./podgrab.nix {};
   podman = handleTestOn ["x86_64-linux"] ./podman.nix {};
   pomerium = handleTestOn ["x86_64-linux"] ./pomerium.nix {};
   postfix = handleTest ./postfix.nix {};
diff --git a/third_party/nixpkgs/nixos/tests/containers-nested.nix b/third_party/nixpkgs/nixos/tests/containers-nested.nix
new file mode 100644
index 0000000000..a653361494
--- /dev/null
+++ b/third_party/nixpkgs/nixos/tests/containers-nested.nix
@@ -0,0 +1,30 @@
+# Test for NixOS' container nesting.
+
+import ./make-test-python.nix ({ pkgs, ... }: {
+  name = "nested";
+
+  meta = with pkgs.lib.maintainers; { maintainers = [ sorki ]; };
+
+  machine = { lib, ... }:
+    let
+      makeNested = subConf: {
+        containers.nested = {
+          autoStart = true;
+          privateNetwork = true;
+          config = subConf;
+        };
+      };
+    in makeNested (makeNested { });
+
+  testScript = ''
+    machine.start()
+    machine.wait_for_unit("container@nested.service")
+    machine.succeed("systemd-run --pty --machine=nested -- machinectl list | grep nested")
+    print(
+        machine.succeed(
+            "systemd-run --pty --machine=nested -- systemd-run --pty --machine=nested -- systemctl status"
+        )
+    )
+  '';
+})
+
diff --git a/third_party/nixpkgs/nixos/tests/hibernate.nix b/third_party/nixpkgs/nixos/tests/hibernate.nix
index 8251c6e7ef..ae506c8542 100644
--- a/third_party/nixpkgs/nixos/tests/hibernate.nix
+++ b/third_party/nixpkgs/nixos/tests/hibernate.nix
@@ -1,44 +1,120 @@
 # Test whether hibernation from partition works.
 
-import ./make-test-python.nix (pkgs: {
+{ system ? builtins.currentSystem
+, config ? {}
+, pkgs ? import ../.. { inherit system config; }
+}:
+
+with import ../lib/testing-python.nix { inherit system pkgs; };
+
+let
+  # System configuration of the installed system, which is used for the actual
+  # hibernate testing.
+  installedConfig = with pkgs.lib; {
+    imports = [
+      ../modules/testing/test-instrumentation.nix
+      ../modules/profiles/qemu-guest.nix
+      ../modules/profiles/minimal.nix
+    ];
+
+    hardware.enableAllFirmware = mkForce false;
+    documentation.nixos.enable = false;
+    boot.loader.grub.device = "/dev/vda";
+
+    systemd.services.backdoor.conflicts = [ "sleep.target" ];
+
+    powerManagement.resumeCommands = "systemctl --no-block restart backdoor.service";
+
+    fileSystems = {
+      "/".device = "/dev/vda2";
+    };
+    swapDevices = mkOverride 0 [ { device = "/dev/vda1"; } ];
+  };
+  installedSystem = (import ../lib/eval-config.nix {
+    inherit system;
+    modules = [ installedConfig ];
+  }).config.system.build.toplevel;
+in makeTest {
   name = "hibernate";
 
   nodes = {
+    # System configuration used for installing the installedConfig from above.
     machine = { config, lib, pkgs, ... }: with lib; {
-      virtualisation.emptyDiskImages = [ config.virtualisation.memorySize ];
+      imports = [
+        ../modules/profiles/installation-device.nix
+        ../modules/profiles/base.nix
+      ];
 
-      systemd.services.backdoor.conflicts = [ "sleep.target" ];
+      nix.binaryCaches = mkForce [ ];
+      nix.extraOptions = ''
+        hashed-mirrors =
+        connect-timeout = 1
+      '';
 
-      swapDevices = mkOverride 0 [ { device = "/dev/vdb"; } ];
-
-      networking.firewall.allowedTCPPorts = [ 4444 ];
-
-      systemd.services.listener.serviceConfig.ExecStart = "${pkgs.netcat}/bin/nc -l 4444 -k";
-    };
-
-    probe = { pkgs, ...}: {
-      environment.systemPackages = [ pkgs.netcat ];
+      virtualisation.diskSize = 8 * 1024;
+      virtualisation.emptyDiskImages = [
+        # Small root disk for installer
+        512
+      ];
+      virtualisation.bootDevice = "/dev/vdb";
     };
   };
 
   # 9P doesn't support reconnection to virtio transport after a hibernation.
   # Therefore, machine just hangs on any Nix store access.
-  # To work around it we run a daemon which listens to a TCP connection and
-  # try to connect to it as a test.
+  # To avoid this, we install NixOS onto a temporary disk with everything we need
+  # included into the store.
 
   testScript =
     ''
+      def create_named_machine(name):
+          return create_machine(
+              {
+                  "qemuFlags": "-cpu max ${
+                    if system == "x86_64-linux" then "-m 1024"
+                    else "-m 768 -enable-kvm -machine virt,gic-version=host"}",
+                  "hdaInterface": "virtio",
+                  "hda": "vm-state-machine/machine.qcow2",
+                  "name": name,
+              }
+          )
+
+
+      # Install NixOS
       machine.start()
-      machine.wait_for_unit("multi-user.target")
-      machine.succeed("mkswap /dev/vdb")
-      machine.succeed("swapon -a")
-      machine.start_job("listener")
-      machine.wait_for_open_port(4444)
-      machine.succeed("systemctl hibernate &")
-      machine.wait_for_shutdown()
-      probe.wait_for_unit("multi-user.target")
-      machine.start()
-      probe.wait_until_succeeds("echo test | nc machine 4444 -N")
+      machine.succeed(
+          # Partition /dev/vda
+          "flock /dev/vda parted --script /dev/vda -- mklabel msdos"
+          + " mkpart primary linux-swap 1M 1024M"
+          + " mkpart primary ext2 1024M -1s",
+          "udevadm settle",
+          "mkfs.ext3 -L nixos /dev/vda2",
+          "mount LABEL=nixos /mnt",
+          "mkswap /dev/vda1 -L swap",
+          # Install onto /mnt
+          "nix-store --load-db < ${pkgs.closureInfo {rootPaths = [installedSystem];}}/registration",
+          "nixos-install --root /mnt --system ${installedSystem} --no-root-passwd",
+      )
+      machine.shutdown()
+
+      # Start up
+      hibernate = create_named_machine("hibernate")
+
+      # Drop in file that checks if we un-hibernated properly (and not booted fresh)
+      hibernate.succeed(
+          "mkdir /run/test",
+          "mount -t ramfs -o size=1m ramfs /run/test",
+          "echo not persisted to disk > /run/test/suspended",
+      )
+
+      # Hibernate machine
+      hibernate.succeed("systemctl hibernate &")
+      hibernate.wait_for_shutdown()
+
+      # Restore machine from hibernation, validate our ramfs file is there.
+      resume = create_named_machine("resume")
+      resume.start()
+      resume.succeed("grep 'not persisted to disk' /run/test/suspended")
     '';
 
-})
+}
diff --git a/third_party/nixpkgs/nixos/tests/iscsi-root.nix b/third_party/nixpkgs/nixos/tests/iscsi-root.nix
new file mode 100644
index 0000000000..bda51d2c2e
--- /dev/null
+++ b/third_party/nixpkgs/nixos/tests/iscsi-root.nix
@@ -0,0 +1,161 @@
+import ./make-test-python.nix (
+  { pkgs, lib, ... }:
+    let
+      initiatorName = "iqn.2020-08.org.linux-iscsi.initiatorhost:example";
+      targetName = "iqn.2003-01.org.linux-iscsi.target.x8664:sn.acf8fd9c23af";
+    in
+      {
+        name = "iscsi";
+        meta = {
+          maintainers = pkgs.lib.teams.deshaw.members
+          ++ (with pkgs.lib.maintainers; [ ajs124 ]);
+        };
+
+        nodes = {
+          target = { config, pkgs, lib, ... }: {
+            services.target = {
+              enable = true;
+              config = {
+                fabric_modules = [];
+                storage_objects = [
+                  {
+                    dev = "/dev/vdb";
+                    name = "test";
+                    plugin = "block";
+                    write_back = true;
+                    wwn = "92b17c3f-6b40-4168-b082-ceeb7b495522";
+                  }
+                ];
+                targets = [
+                  {
+                    fabric = "iscsi";
+                    tpgs = [
+                      {
+                        enable = true;
+                        attributes = {
+                          authentication = 0;
+                          generate_node_acls = 1;
+                        };
+                        luns = [
+                          {
+                            alias = "94dfe06967";
+                            alua_tg_pt_gp_name = "default_tg_pt_gp";
+                            index = 0;
+                            storage_object = "/backstores/block/test";
+                          }
+                        ];
+                        node_acls = [
+                          {
+                            mapped_luns = [
+                              {
+                                alias = "d42f5bdf8a";
+                                index = 0;
+                                tpg_lun = 0;
+                                write_protect = false;
+                              }
+                            ];
+                            node_wwn = initiatorName;
+                          }
+                        ];
+                        portals = [
+                          {
+                            ip_address = "0.0.0.0";
+                            iser = false;
+                            offload = false;
+                            port = 3260;
+                          }
+                        ];
+                        tag = 1;
+                      }
+                    ];
+                    wwn = targetName;
+                  }
+                ];
+              };
+            };
+
+            networking.firewall.allowedTCPPorts = [ 3260 ];
+            networking.firewall.allowedUDPPorts = [ 3260 ];
+
+            virtualisation.memorySize = 2048;
+            virtualisation.emptyDiskImages = [ 2048 ];
+          };
+
+          initiatorAuto = { nodes, config, pkgs, ... }: {
+            services.openiscsi = {
+              enable = true;
+              enableAutoLoginOut = true;
+              discoverPortal = "target";
+              name = initiatorName;
+            };
+
+            environment.systemPackages = with pkgs; [
+              xfsprogs
+            ];
+
+            system.extraDependencies = [ nodes.initiatorRootDisk.config.system.build.toplevel ];
+
+            nix.binaryCaches = lib.mkForce [];
+            nix.extraOptions = ''
+              hashed-mirrors =
+              connect-timeout = 1
+            '';
+          };
+
+          initiatorRootDisk = { config, pkgs, modulesPath, lib, ... }: {
+            boot.loader.grub.enable = false;
+            boot.kernelParams = lib.mkOverride 5 (
+              [
+                "boot.shell_on_fail"
+                "console=tty1"
+                "ip=${config.networking.primaryIPAddress}:::255.255.255.0::ens9:none"
+              ]
+            );
+
+            # defaults to true, puts some code in the initrd that tries to mount an overlayfs on /nix/store
+            virtualisation.writableStore = false;
+
+            fileSystems = lib.mkOverride 5 {
+              "/" = {
+                fsType = "xfs";
+                device = "/dev/sda";
+                options = [ "_netdev" ];
+              };
+            };
+
+            boot.iscsi-initiator = {
+              discoverPortal = "target";
+              name = initiatorName;
+              target = targetName;
+            };
+          };
+        };
+
+        testScript = { nodes, ... }: ''
+          target.start()
+          target.wait_for_unit("iscsi-target.service")
+
+          initiatorAuto.start()
+
+          initiatorAuto.wait_for_unit("iscsid.service")
+          initiatorAuto.wait_for_unit("iscsi.service")
+          initiatorAuto.get_unit_info("iscsi")
+
+          initiatorAuto.succeed("set -x; while ! test -e /dev/sda; do sleep 1; done")
+
+          initiatorAuto.succeed("mkfs.xfs /dev/sda")
+          initiatorAuto.succeed("mkdir /mnt && mount /dev/sda /mnt")
+          initiatorAuto.succeed(
+              "nixos-install --no-bootloader --no-root-passwd --system ${nodes.initiatorRootDisk.config.system.build.toplevel}"
+          )
+          initiatorAuto.succeed("umount /mnt && rmdir /mnt")
+          initiatorAuto.shutdown()
+
+          initiatorRootDisk.start()
+          initiatorRootDisk.wait_for_unit("multi-user.target")
+          initiatorRootDisk.wait_for_unit("iscsid")
+          initiatorRootDisk.succeed("touch test")
+          initiatorRootDisk.shutdown()
+        '';
+      }
+)
diff --git a/third_party/nixpkgs/nixos/tests/podgrab.nix b/third_party/nixpkgs/nixos/tests/podgrab.nix
new file mode 100644
index 0000000000..e927e25fea
--- /dev/null
+++ b/third_party/nixpkgs/nixos/tests/podgrab.nix
@@ -0,0 +1,34 @@
+let
+  defaultPort = 8080;
+  customPort = 4242;
+in
+import ./make-test-python.nix ({ pkgs, ... }: {
+  name = "podgrab";
+
+  nodes = {
+    default = { ... }: {
+      services.podgrab.enable = true;
+    };
+
+    customized = { ... }: {
+      services.podgrab = {
+        enable = true;
+        port = customPort;
+      };
+    };
+  };
+
+  testScript = ''
+    start_all()
+
+    default.wait_for_unit("podgrab")
+    default.wait_for_open_port("${toString defaultPort}")
+    default.succeed("curl --fail http://localhost:${toString defaultPort}")
+
+    customized.wait_for_unit("podgrab")
+    customized.wait_for_open_port("${toString customPort}")
+    customized.succeed("curl --fail http://localhost:${toString customPort}")
+  '';
+
+  meta.maintainers = with pkgs.lib.maintainers; [ ambroisie ];
+})
diff --git a/third_party/nixpkgs/pkgs/applications/audio/flacon/default.nix b/third_party/nixpkgs/pkgs/applications/audio/flacon/default.nix
index a9dc7308ac..83d9c5da83 100644
--- a/third_party/nixpkgs/pkgs/applications/audio/flacon/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/audio/flacon/default.nix
@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   pname = "flacon";
-  version = "6.1.0";
+  version = "7.0.1";
 
   src = fetchFromGitHub {
     owner = "flacon";
     repo = "flacon";
     rev = "v${version}";
-    sha256 = "04yp3aym7h70xjni9ancqv5lc4zds5a8dgw3fzgqs8k5nmh074gv";
+    sha256 = "sha256-35tARJkyhC8EisIyDCwuT/UUruzLjJRUuZysuqeNssM=";
   };
 
   nativeBuildInputs = [ cmake pkg-config wrapQtAppsHook ];
diff --git a/third_party/nixpkgs/pkgs/applications/audio/mousai/default.nix b/third_party/nixpkgs/pkgs/applications/audio/mousai/default.nix
new file mode 100644
index 0000000000..502842c7aa
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/applications/audio/mousai/default.nix
@@ -0,0 +1,69 @@
+{ lib
+, python3
+, fetchFromGitHub
+, appstream-glib
+, desktop-file-utils
+, gettext
+, glib
+, gobject-introspection
+, gst_all_1
+, gtk3
+, libhandy
+, librsvg
+, meson
+, ninja
+, pkg-config
+, wrapGAppsHook
+}:
+
+python3.pkgs.buildPythonApplication rec {
+  pname = "mousai";
+  version = "0.3.1";
+
+  format = "other";
+
+  src = fetchFromGitHub {
+    owner = "SeaDve";
+    repo = "Mousai";
+    rev = "v${version}";
+    sha256 = "0x57dci0prhlj79h74yh79cazn48rn0bckz5j3z4njk4fwc3fvfx";
+  };
+
+  postPatch = ''
+    patchShebangs build-aux/meson
+  '';
+
+  nativeBuildInputs = [
+    appstream-glib
+    desktop-file-utils
+    gettext
+    glib
+    gtk3
+    meson
+    ninja
+    pkg-config
+    wrapGAppsHook
+  ];
+
+  buildInputs = [
+    gobject-introspection
+    gst_all_1.gstreamer
+    gst_all_1.gst-plugins-base
+    gst_all_1.gst-plugins-good
+    gtk3
+    libhandy
+    librsvg
+  ];
+
+  propagatedBuildInputs = with python3.pkgs; [
+    pygobject3
+    requests
+  ];
+
+  meta = with lib; {
+    description = "Identify any songs in seconds";
+    homepage = "https://github.com/SeaDve/Mousai";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ dotlambda ];
+  };
+}
diff --git a/third_party/nixpkgs/pkgs/applications/audio/quodlibet/default.nix b/third_party/nixpkgs/pkgs/applications/audio/quodlibet/default.nix
index 571097ad47..2110a0deb2 100644
--- a/third_party/nixpkgs/pkgs/applications/audio/quodlibet/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/audio/quodlibet/default.nix
@@ -30,7 +30,6 @@ python3.pkgs.buildPythonApplication rec {
       ++ optionals withDbusPython [ dbus-python ]
       ++ optionals withPyInotify [ pyinotify ]
       ++ optionals withMusicBrainzNgs [ musicbrainzngs ]
-      ++ optionals stdenv.isDarwin [ pyobjc ]
       ++ optionals withPahoMqtt [ paho-mqtt ];
 
   LC_ALL = "en_US.UTF-8";
diff --git a/third_party/nixpkgs/pkgs/applications/editors/atom/env.nix b/third_party/nixpkgs/pkgs/applications/editors/atom/env.nix
index 3c0f348ebd..53150e0ad6 100644
--- a/third_party/nixpkgs/pkgs/applications/editors/atom/env.nix
+++ b/third_party/nixpkgs/pkgs/applications/editors/atom/env.nix
@@ -1,7 +1,7 @@
 { stdenv, lib, zlib, glib, alsaLib, dbus, gtk3, atk, pango, freetype, fontconfig
 , libgnome-keyring3, gdk-pixbuf, cairo, cups, expat, libgpgerror, nspr
 , gconf, nss, xorg, libcap, systemd, libnotify, libsecret, libuuid, at-spi2-atk
-, at-spi2-core, libdbusmenu
+, at-spi2-core, libdbusmenu, mesa
 }:
 
 let
@@ -12,6 +12,7 @@ let
     xorg.libXcomposite xorg.libXi xorg.libXfixes xorg.libXrandr
     xorg.libXcursor xorg.libxkbfile xorg.libXScrnSaver libcap systemd libnotify
     xorg.libxcb libsecret libuuid at-spi2-atk at-spi2-core libdbusmenu
+    mesa # required for libgbm
   ];
 
   libPathNative = lib.makeLibraryPath packages;
diff --git a/third_party/nixpkgs/pkgs/applications/editors/eclipse/default.nix b/third_party/nixpkgs/pkgs/applications/editors/eclipse/default.nix
index 2c06725030..000726dd81 100644
--- a/third_party/nixpkgs/pkgs/applications/editors/eclipse/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/editors/eclipse/default.nix
@@ -12,14 +12,14 @@ assert stdenv ? glibc;
 # find the downloads needed for new versions
 #
 # to test:
-# $ for e in cpp modeling platform sdk java committers rcp rust; do nix build -f default.nix pkgs.eclipses.eclipse-${e} -o eclipse-${e}; done
+# $ for e in cpp modeling platform sdk java jee committers rcp; do nix build -f default.nix pkgs.eclipses.eclipse-${e} -o eclipse-${e}; done
 
 let
   platform_major = "4";
-  platform_minor = "18";
-  year = "2020";
-  month = "12";
-  timestamp = "${year}${month}021800";
+  platform_minor = "19";
+  year = "2021";
+  month = "03";
+  timestamp = "${year}${month}031800";
   gtk = gtk3;
 in rec {
 
@@ -37,7 +37,7 @@ in rec {
     src =
       fetchurl {
         url = "https://www.eclipse.org/downloads/download.php?r=1&nf=1&file=/technology/epp/downloads/release/${year}-${month}/R/eclipse-cpp-${year}-${month}-R-linux-gtk-x86_64.tar.gz";
-        sha512 = "MR6ddNmBKyXCyVGlGPfq6K2zJRywy4I5QDXji3rh81eJQ6zkEguo+VvD75i/szg/+FbCVA09vDVV06JgL4SHwQ==";
+        sha512 = "3j0lmll0glcr9p0hf49jiaq9xr8hadsy0y58wbbkdpldj3rclxr056dkswmiw2bkypfiwrjygbli5qxyp6mz380562hc2kjwijqq476";
       };
   };
 
@@ -49,7 +49,7 @@ in rec {
     src =
       fetchurl {
         url = "https://www.eclipse.org/downloads/download.php?r=1&nf=1&file=/technology/epp/downloads/release/${year}-${month}/R/eclipse-modeling-${year}-${month}-R-linux-gtk-x86_64.tar.gz";
-        sha512 = "hSi3IL+fWhlUfEJYv4LFO7WNbZpiofAgNGZbEOIBS0VpeHfJ5Y6UKMKMLfQlG3hlkAL5jg/cEJKb/ad4DxHbjQ==";
+        sha512 = "0iqz9a3ixcbmaci6lnspdnzwd2h1fcygi54hmsl89pq3d1k5scyhcl123ixi24csi782w847bn0lq00n0zwras9akmnhsflra4mw5pz";
       };
   };
 
@@ -61,7 +61,7 @@ in rec {
     src =
       fetchurl {
         url = "https://www.eclipse.org/downloads/download.php?r=1&nf=1&file=/eclipse/downloads/drops${platform_major}/R-${platform_major}.${platform_minor}-${timestamp}/eclipse-platform-${platform_major}.${platform_minor}-linux-gtk-x86_64.tar.gz";
-        sha512 = "cPRa7ICogpcuwzOlzSSCEcWpwpUhQuIv6lGBKuAu9mOwj7Nz0TPaWVWNqN1541uVRXVTzcWX+mwc2UBPzWUPxg==";
+        sha512 = "03v1ly7j9d9qnl3d9rl5a9kp483dz8i8v3cfnh55ksm9fk8iy2fzg6wq178ggnx2z5x9k88a4wk6n647yilh2hgc2l7926imkh2j1ly";
       };
   };
 
@@ -86,7 +86,7 @@ in rec {
     src =
       fetchurl {
         url = "https://www.eclipse.org/downloads/download.php?r=1&nf=1&file=/eclipse/downloads/drops${platform_major}/R-${platform_major}.${platform_minor}-${timestamp}/eclipse-SDK-${platform_major}.${platform_minor}-linux-gtk-x86_64.tar.gz";
-        sha512 = "iN6z5iSJ2bhE1IH3uJj7aiaF/nSIgIAqadvaTBpE4gkgLAXgtfraFAzgcw0zJr5m2u5mULfW45hLkmIXselniQ==";
+        sha512 = "37m91my121pch12bwpwk5svfqkm7vl07wjx4fkhpy947v5kjf36hm6x0i45swdg7f0hk72y2qz5ka15ki5jv890qy5psj6z7ax9sys7";
       };
   };
 
@@ -98,7 +98,19 @@ in rec {
     src =
       fetchurl {
         url = "https://www.eclipse.org/downloads/download.php?r=1&nf=1&file=/technology/epp/downloads/release/${year}-${month}/R/eclipse-java-${year}-${month}-R-linux-gtk-x86_64.tar.gz";
-        sha512 = "HVqsWUVNNRdcaziGdNI96R9F2VMUE4nYK1VX1G3pK+srFDlkJ7+rj2sZjtWL7WcJR1XSbT03nJJzPyp01RsCvQ==";
+        sha512 = "3qrnj6krhrqc9rfwlim3v7kshwfhsi050pszw6xdfbj56mzr9whr7l76isbpxd5j0zipgfw3qrzrx379pdp899d35fv284ilvllzl4k";
+      };
+  };
+
+  ### Eclipse Java EE
+
+  eclipse-jee = buildEclipse {
+    name = "eclipse-jee-${platform_major}.${platform_minor}";
+    description = "Eclipse IDE for Enterprise Java and Web Developers";
+    src =
+      fetchurl {
+        url = "https://www.eclipse.org/downloads/download.php?r=1&nf=1&file=/technology/epp/downloads/release/${year}-${month}/R/eclipse-jee-${year}-${month}-R-linux-gtk-x86_64.tar.gz";
+        sha512 = "04k4x9imabxddqlrgajn33ak8i58wcap40ll09xz23d1sxn9a8prh01s06ymgwg6ldg939srphvbz4112p8p0b1hl7m25a02qll91zv";
       };
   };
 
@@ -110,7 +122,7 @@ in rec {
     src =
       fetchurl {
         url = "https://www.eclipse.org/downloads/download.php?r=1&nf=1&file=/technology/epp/downloads/release/${year}-${month}/R/eclipse-committers-${year}-${month}-R-linux-gtk-x86_64.tar.gz";
-        sha512 = "UtI4piLNRM3TsM9PzbGgsPqTkiurJ+7Q7jVra45an4YJHtfWcGTxxwUNnRzay6cHT49AjrWtVf1bovWSDXMiQA==";
+        sha512 = "2yksl3w7yr1a3h4zdpa9zf394r5c185zqxhigdv858ldg46kmr9h0l2c7shbgb16kkybcnrk4x44dhjvh60x8xw6ma05klp4lp9v5va";
       };
   };
 
@@ -122,19 +134,7 @@ in rec {
     src =
       fetchurl {
         url = "https://www.eclipse.org/downloads/download.php?r=1&nf=1&file=/technology/epp/downloads/release/${year}-${month}/R/eclipse-rcp-${year}-${month}-R-linux-gtk-x86_64.tar.gz";
-        sha512 = "9DqNjSx1Ypdzpt1jIOJ9KFx8y+cG55K6bqkWTqnGjjDr4h4mWSzvGjHGUtFrKl92WRzQZKjNPxzVreDMcUkc/g==";
-      };
-  };
-
-  ### Eclipse IDE for Rust Developers
-
-  eclipse-rust = buildEclipse {
-    name = "eclipse-rust-${platform_major}.${platform_minor}";
-    description = "Eclipse IDE for Rust Developers";
-    src =
-      fetchurl {
-        url = "https://www.eclipse.org/downloads/download.php?r=1&nf=1&file=/technology/epp/downloads/release/${year}-${month}/R/eclipse-rust-${year}-${month}-R-linux-gtk-x86_64.tar.gz";
-        sha512 = "QbaG1knCMFnVQkPeApcIamJMXPyL8zUQa0ZsTJOuTgU/fD1RiHN7/WS6ax5azzIJhpjEtj2LMU4XV+MwkzResw==";
+        sha512 = "3fhrhwbyqcys56c93s1vl9rbvn269nn5y3cb9f3n1qwgw6i97mim2zy98jl3r8cksf97jwsmqmsqclsgz9v799wcckv81dj1l628382";
       };
   };
 
diff --git a/third_party/nixpkgs/pkgs/applications/editors/eclipse/plugins.nix b/third_party/nixpkgs/pkgs/applications/editors/eclipse/plugins.nix
index dc86ebca21..5937311b5c 100644
--- a/third_party/nixpkgs/pkgs/applications/editors/eclipse/plugins.nix
+++ b/third_party/nixpkgs/pkgs/applications/editors/eclipse/plugins.nix
@@ -248,12 +248,12 @@ rec {
   cdt = buildEclipseUpdateSite rec {
     name = "cdt-${version}";
     # find current version at https://www.eclipse.org/cdt/downloads.php
-    version = "10.1.0";
+    version = "10.2.0";
 
     src = fetchzip {
       stripRoot = false;
-      url = "https://www.eclipse.org/downloads/download.php?r=1&nf=1&file=/tools/cdt/releases/10.1/${name}/${name}.zip";
-      sha256 = "1hbswcar3a5cw20mwrj82w9pvpkvvj6jrvqqf1lincva0r5sl7h8";
+      url = "https://www.eclipse.org/downloads/download.php?r=1&nf=1&file=/tools/cdt/releases/10.2/${name}/${name}.zip";
+      sha256 = "1r30cbpbzw3dfcsn54p6sqip86dqhydhsppjgaz60b6z138vzx49";
     };
 
     meta = with lib; {
@@ -474,24 +474,6 @@ rec {
     };
   };
 
-  jdt = buildEclipseUpdateSite rec {
-    name = "jdt-${version}";
-    version = "4.18";
-
-    src = fetchzip {
-      stripRoot = false;
-      url = "https://www.eclipse.org/downloads/download.php?r=1&nf=1&file=/eclipse/downloads/drops4/R-${version}-202012021800/org.eclipse.jdt-${version}.zip";
-      sha256 = "q0O6OE2u0bdz1+nOkzXDrrOOzoEbVaXnejx4lX7uZgk=";
-    };
-
-    meta = with lib; {
-      homepage = "https://www.eclipse.org/jdt/";
-      description = "Eclipse Java development tools";
-      license = licenses.epl10;
-      platforms = platforms.all;
-    };
-  };
-
   jdt-codemining = buildEclipsePlugin rec {
     name = "jdt-codemining-${version}";
     version = "1.0.0.201806221018";
diff --git a/third_party/nixpkgs/pkgs/applications/editors/neovim/wrapper.nix b/third_party/nixpkgs/pkgs/applications/editors/neovim/wrapper.nix
index 8b42191bde..66127980bf 100644
--- a/third_party/nixpkgs/pkgs/applications/editors/neovim/wrapper.nix
+++ b/third_party/nixpkgs/pkgs/applications/editors/neovim/wrapper.nix
@@ -113,6 +113,7 @@ let
       hydraPlatforms = [];
       # prefer wrapper over the package
       priority = (neovim.meta.priority or 0) - 1;
+      mainProgram = "nvim";
     };
   };
 in
diff --git a/third_party/nixpkgs/pkgs/applications/graphics/drawio/default.nix b/third_party/nixpkgs/pkgs/applications/graphics/drawio/default.nix
index 4155767a36..e8ef97f949 100644
--- a/third_party/nixpkgs/pkgs/applications/graphics/drawio/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/graphics/drawio/default.nix
@@ -4,7 +4,7 @@
 , alsaLib, atk, at-spi2-atk, at-spi2-core, cairo, dbus, cups, expat
 , gdk-pixbuf, glib, gtk3, libX11, libXScrnSaver, libXcomposite, libXcursor
 , libXdamage, libXext, libXfixes, libXi, libXrandr, libXrender, libXtst
-, libxcb, libuuid, libxshmfence, nspr, nss, pango
+, libxcb, libuuid, libxshmfence, nspr, nss, pango, mesa
 
 , systemd
 }:
@@ -50,6 +50,7 @@ stdenv.mkDerivation rec {
     libXtst
     libxcb
     libuuid
+    mesa # for libgbm
     nspr
     nss
     pango
diff --git a/third_party/nixpkgs/pkgs/applications/graphics/hydrus/default.nix b/third_party/nixpkgs/pkgs/applications/graphics/hydrus/default.nix
index e42666beb1..56ebbeb372 100644
--- a/third_party/nixpkgs/pkgs/applications/graphics/hydrus/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/graphics/hydrus/default.nix
@@ -1,7 +1,6 @@
 { lib
 , fetchFromGitHub
 , xz
-, qt5
 , wrapQtAppsHook
 , miniupnpc_2
 , swftools
@@ -10,14 +9,14 @@
 
 pythonPackages.buildPythonPackage rec {
   pname = "hydrus";
-  version = "434";
+  version = "436";
   format = "other";
 
   src = fetchFromGitHub {
     owner = "hydrusnetwork";
     repo = "hydrus";
     rev = "v${version}";
-    sha256 = "sha256-7Allc9zawja8DO2idv+MAYZ/cBRTCMd0mbgBLfEVii8=";
+    sha256 = "sha256-FXm8VUEY0OZ6/dc/qNwOXekhv5H2C9jjg/eNDoMvMn0==";
   };
 
   nativeBuildInputs = [
diff --git a/third_party/nixpkgs/pkgs/applications/graphics/openboard/default.nix b/third_party/nixpkgs/pkgs/applications/graphics/openboard/default.nix
new file mode 100644
index 0000000000..859c221921
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/applications/graphics/openboard/default.nix
@@ -0,0 +1,115 @@
+{ mkDerivation, lib, fetchFromGitHub, copyDesktopItems, makeDesktopItem, qmake
+, qtbase, qtxmlpatterns, qttools, qtwebkit, libGL, fontconfig, openssl, poppler
+, ffmpeg, libva, alsaLib, SDL, x264, libvpx, libvorbis, libtheora, libogg
+, libopus, lame, fdk_aac, libass, quazip, libXext, libXfixes }:
+
+let
+  importer = mkDerivation rec {
+    pname = "openboard-importer";
+    version = "unstable-2016-10-08";
+
+    src = fetchFromGitHub {
+      owner = "OpenBoard-org";
+      repo = "OpenBoard-Importer";
+      rev = "47927bda021b4f7f1540b794825fb0d601875e79";
+      sha256 = "19zhgsimy0f070caikc4vrrqyc8kv2h6rl37sy3iggks8z0g98gf";
+    };
+
+    nativeBuildInputs = [ qmake ];
+
+    installPhase = ''
+      install -Dm755 OpenBoardImporter $out/bin/OpenBoardImporter
+    '';
+  };
+in mkDerivation rec {
+  pname = "openboard";
+  version = "1.6.1";
+
+  src = fetchFromGitHub {
+    owner = "OpenBoard-org";
+    repo = "OpenBoard";
+    rev = "v${version}";
+    sha256 = "sha256-OlGXGIMghil/GG6eso20+CWo/hCjarXGs6edXX9pc/M=";
+  };
+
+  postPatch = ''
+    substituteInPlace OpenBoard.pro \
+      --replace '/usr/include/quazip' '${quazip}/include/quazip5' \
+      --replace '/usr/include/poppler' '${poppler.dev}/include/poppler'
+  '';
+
+  nativeBuildInputs = [ qmake copyDesktopItems ];
+
+  buildInputs = [
+    qtbase
+    qtxmlpatterns
+    qttools
+    qtwebkit
+    libGL
+    fontconfig
+    openssl
+    poppler
+    ffmpeg
+    libva
+    alsaLib
+    SDL
+    x264
+    libvpx
+    libvorbis
+    libtheora
+    libogg
+    libopus
+    lame
+    fdk_aac
+    libass
+    quazip
+    libXext
+    libXfixes
+  ];
+
+  propagatedBuildInputs = [ importer ];
+
+  makeFlags = [ "release-install" ];
+
+  desktopItems = [
+    (makeDesktopItem {
+      name = "OpenBoard";
+      exec = "OpenBoard %f";
+      icon = "OpenBoard";
+      comment = "OpenBoard, an interactive white board application";
+      desktopName = "OpenBoard";
+      mimeType = "application/ubz";
+      categories = "Education;";
+      startupNotify = true;
+    })
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    lrelease OpenBoard.pro
+
+    # Replicated release_scripts/linux/package.sh
+    mkdir -p $out/opt/openboard/i18n
+    cp -R resources/customizations build/linux/release/product/* $out/opt/openboard/
+    cp resources/i18n/*.qm $out/opt/openboard/i18n/
+    install -m644 resources/linux/openboard-ubz.xml $out/opt/openboard/etc/
+    install -Dm644 resources/images/OpenBoard.png $out/share/icons/hicolor/64x64/apps/OpenBoard.png
+
+    runHook postInstall
+  '';
+
+  dontWrapQtApps = true;
+
+  postFixup = ''
+    makeWrapper $out/opt/openboard/OpenBoard $out/bin/OpenBoard \
+      "''${qtWrapperArgs[@]}"
+  '';
+
+  meta = with lib; {
+    description = "Interactive whiteboard application";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ fufexan ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/third_party/nixpkgs/pkgs/applications/kde/fetch.sh b/third_party/nixpkgs/pkgs/applications/kde/fetch.sh
index 861cd5f835..5b61590003 100644
--- a/third_party/nixpkgs/pkgs/applications/kde/fetch.sh
+++ b/third_party/nixpkgs/pkgs/applications/kde/fetch.sh
@@ -1 +1 @@
-WGET_ARGS=( http://download.kde.org/stable/release-service/20.12.2/src -A '*.tar.xz' )
+WGET_ARGS=( http://download.kde.org/stable/release-service/20.12.3/src -A '*.tar.xz' )
diff --git a/third_party/nixpkgs/pkgs/applications/kde/srcs.nix b/third_party/nixpkgs/pkgs/applications/kde/srcs.nix
index c1def1bd61..fc179789df 100644
--- a/third_party/nixpkgs/pkgs/applications/kde/srcs.nix
+++ b/third_party/nixpkgs/pkgs/applications/kde/srcs.nix
@@ -4,1795 +4,1795 @@
 
 {
   akonadi = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/akonadi-20.12.2.tar.xz";
-      sha256 = "0659vgj8y77i0axdwwajaw6kxfa48j6s56nl6xhnv8686ss8plkw";
-      name = "akonadi-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/akonadi-20.12.3.tar.xz";
+      sha256 = "0bcjyh1w8aaq7bp0df8zla7zvddig5ziz9avj82c6d453hfsq6dr";
+      name = "akonadi-20.12.3.tar.xz";
     };
   };
   akonadi-calendar = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/akonadi-calendar-20.12.2.tar.xz";
-      sha256 = "0vzv4yycb2nnz5ifsydv0k080wgnhjzim6lfd6qrh38mgxpb2hzw";
-      name = "akonadi-calendar-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/akonadi-calendar-20.12.3.tar.xz";
+      sha256 = "057iz29y8dvxa26kf995akgy427c20d27i59gdfnl183wikmw9wk";
+      name = "akonadi-calendar-20.12.3.tar.xz";
     };
   };
   akonadi-calendar-tools = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/akonadi-calendar-tools-20.12.2.tar.xz";
-      sha256 = "06bzha5h14x6m4xzbbz2h3s00v4pc2a8d716dav9bqi0pvvq3cj0";
-      name = "akonadi-calendar-tools-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/akonadi-calendar-tools-20.12.3.tar.xz";
+      sha256 = "1fdcf6s1ij2l44zg7rha9hhha1k3m4xh0mgkyc836jkqy02jx3j6";
+      name = "akonadi-calendar-tools-20.12.3.tar.xz";
     };
   };
   akonadiconsole = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/akonadiconsole-20.12.2.tar.xz";
-      sha256 = "12fslhpxah99fzvg3a1g67n69mi4xvgz9ra787pdvzrs0lca9xa0";
-      name = "akonadiconsole-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/akonadiconsole-20.12.3.tar.xz";
+      sha256 = "0skam7yl9m28m51yj0inzcxa5rbz5r4hz104b0ncg9hjjqi7qyfl";
+      name = "akonadiconsole-20.12.3.tar.xz";
     };
   };
   akonadi-contacts = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/akonadi-contacts-20.12.2.tar.xz";
-      sha256 = "05y1rpvq1shiqlgql56k052glsslawy742q4n2hs301xhg0izavz";
-      name = "akonadi-contacts-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/akonadi-contacts-20.12.3.tar.xz";
+      sha256 = "1ql7rx3fj12iddsvjip17w3gqm4slcmy3id3b892xwlx4izz2dr4";
+      name = "akonadi-contacts-20.12.3.tar.xz";
     };
   };
   akonadi-import-wizard = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/akonadi-import-wizard-20.12.2.tar.xz";
-      sha256 = "1gqjr5k6kkxi77vq0f6mc5mr31qvjsiicj6sxwpbm0c34vydfzym";
-      name = "akonadi-import-wizard-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/akonadi-import-wizard-20.12.3.tar.xz";
+      sha256 = "080dyygqwc4m38vqkd4yvpy1xa4302a20gcbl5vi06as750qswgn";
+      name = "akonadi-import-wizard-20.12.3.tar.xz";
     };
   };
   akonadi-mime = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/akonadi-mime-20.12.2.tar.xz";
-      sha256 = "0zdgkny32zwa2r2yhi285f56jkj0ini6p3sv5hi7f43mi7r5m994";
-      name = "akonadi-mime-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/akonadi-mime-20.12.3.tar.xz";
+      sha256 = "1dnxswwvgm3vj5l12xnv5c7jpmrx3180xpdpgj4xp4nmzvfrfpgl";
+      name = "akonadi-mime-20.12.3.tar.xz";
     };
   };
   akonadi-notes = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/akonadi-notes-20.12.2.tar.xz";
-      sha256 = "0rbg2vwk0a1zbfw5cmz0jx3yzap7j6yi7c0igq1fgg3an7sw4j2v";
-      name = "akonadi-notes-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/akonadi-notes-20.12.3.tar.xz";
+      sha256 = "1fp5mif6w14snrndw2w4y66hsi14x7qyr9p343hdma4lmd65lic7";
+      name = "akonadi-notes-20.12.3.tar.xz";
     };
   };
   akonadi-search = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/akonadi-search-20.12.2.tar.xz";
-      sha256 = "0m7l7f26gj018d5pipbgmmxiqky98avpypxbydrms6afdglvi5ja";
-      name = "akonadi-search-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/akonadi-search-20.12.3.tar.xz";
+      sha256 = "0bac20n5mbfvl5p5qyiy1dygv1lz0spvm37ah3bp4iz9k4maqp7q";
+      name = "akonadi-search-20.12.3.tar.xz";
     };
   };
   akregator = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/akregator-20.12.2.tar.xz";
-      sha256 = "11y2mmf2svbxvqb1bjwzrivkq8w508fwg7513bzl62pbjqa8g3gk";
-      name = "akregator-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/akregator-20.12.3.tar.xz";
+      sha256 = "10friff769kq83b9nxx2wj16bgzjh9gblc9r20gvm1qw5vm4l58b";
+      name = "akregator-20.12.3.tar.xz";
     };
   };
   analitza = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/analitza-20.12.2.tar.xz";
-      sha256 = "09qpqjyps9h8wc8dvbnj8iz2xc4naxjdicqxsbfwfly5wbf8xq6x";
-      name = "analitza-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/analitza-20.12.3.tar.xz";
+      sha256 = "187mnzdclqmn6d7yxxvy7xhcaasmgjz6mgk43dxn7rpn20lbx800";
+      name = "analitza-20.12.3.tar.xz";
     };
   };
   ark = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/ark-20.12.2.tar.xz";
-      sha256 = "1p8ylvk4g1x2mmfdprz911iivcvr4mciam427b6ygdrhqc7rbbqb";
-      name = "ark-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/ark-20.12.3.tar.xz";
+      sha256 = "0fsv808a554cpka4pvhk829kldm2asnk8dyvr1wiidgpjpjxzwp4";
+      name = "ark-20.12.3.tar.xz";
     };
   };
   artikulate = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/artikulate-20.12.2.tar.xz";
-      sha256 = "0s6vjhipb4i6bv9ff7nzm9gza8jghih9kf7f7ynq10109fk8gy6i";
-      name = "artikulate-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/artikulate-20.12.3.tar.xz";
+      sha256 = "1gnnfa0mwafh5msfy41n8fib1mfp713hdyfcqsmfpb04p5251grm";
+      name = "artikulate-20.12.3.tar.xz";
     };
   };
   audiocd-kio = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/audiocd-kio-20.12.2.tar.xz";
-      sha256 = "0kd7yxl571pwrijwn78pigdclwqpmd50b5cj4lna481q78f91zsa";
-      name = "audiocd-kio-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/audiocd-kio-20.12.3.tar.xz";
+      sha256 = "06jg3q73hnr7wswqhffj5mncnpvrlmhh4c4k5302jp0c61i5pbv0";
+      name = "audiocd-kio-20.12.3.tar.xz";
     };
   };
   baloo-widgets = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/baloo-widgets-20.12.2.tar.xz";
-      sha256 = "0w9jrx2mz1kyn2az6jx4kympl6zd950waz4zj97cjrcq2dg5a85g";
-      name = "baloo-widgets-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/baloo-widgets-20.12.3.tar.xz";
+      sha256 = "0cznzgzn8x9kgn9pjq3fybici88y4al18n0c5vv1h31vz59fqfqi";
+      name = "baloo-widgets-20.12.3.tar.xz";
     };
   };
   blinken = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/blinken-20.12.2.tar.xz";
-      sha256 = "0a0nkmbx1bkqjs7cf5qqm877wqvzdx9cxm9395jfxcycn5pyfps9";
-      name = "blinken-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/blinken-20.12.3.tar.xz";
+      sha256 = "0vfvlrdan60dx1prd1m4vhakvz5ddi70gzagfjb5c0py9802qqgl";
+      name = "blinken-20.12.3.tar.xz";
     };
   };
   bomber = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/bomber-20.12.2.tar.xz";
-      sha256 = "08lyj6rn9jhhwzpwh2c14v8jiwishi1wk19nm5wazy2iajbd88jv";
-      name = "bomber-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/bomber-20.12.3.tar.xz";
+      sha256 = "03d08j8wh989fsxb632fpbjg3zwqyv70jd8msjy4ajxl4039q9sp";
+      name = "bomber-20.12.3.tar.xz";
     };
   };
   bovo = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/bovo-20.12.2.tar.xz";
-      sha256 = "05xx11rqqsxm084hfxnx1wzmr2wdpny3w608h8g5vby2jgdj47b7";
-      name = "bovo-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/bovo-20.12.3.tar.xz";
+      sha256 = "114rq2a7jr9f9957zfn2fgiylf4ymgx5534i8qw7h78gxnb5915v";
+      name = "bovo-20.12.3.tar.xz";
     };
   };
   calendarsupport = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/calendarsupport-20.12.2.tar.xz";
-      sha256 = "0gz3p4az49430zwgmlqjcfzjlgnaf7cl1x0qaaxyl8il14ambrbd";
-      name = "calendarsupport-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/calendarsupport-20.12.3.tar.xz";
+      sha256 = "044d9aarq5agh42h88l5bjc6nfsrb5797zlq0wfyx6laxnw8yhdb";
+      name = "calendarsupport-20.12.3.tar.xz";
     };
   };
   cantor = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/cantor-20.12.2.tar.xz";
-      sha256 = "1w513a06xshdw4fcn6wmliygpjsyvqcbmfjg2bdibpsnznmk4y4p";
-      name = "cantor-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/cantor-20.12.3.tar.xz";
+      sha256 = "0f6ad4mzn54bjc1q9yxana6j5hfdgr2d7gra27x5jfcn079qjijb";
+      name = "cantor-20.12.3.tar.xz";
     };
   };
   cervisia = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/cervisia-20.12.2.tar.xz";
-      sha256 = "08m962r6wkvih1yfj22z3nyfx6r3ac9pcc7i7dxxdkfcxhqpprhb";
-      name = "cervisia-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/cervisia-20.12.3.tar.xz";
+      sha256 = "0802rws42a1ipw2m5r9k7plr7yhyicws8ryx75vivn41v4qanq15";
+      name = "cervisia-20.12.3.tar.xz";
     };
   };
   dolphin = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/dolphin-20.12.2.tar.xz";
-      sha256 = "19mss2vs074xv5qc644y87f8v99mdndhhd7hclqgq6gckxcjzy2r";
-      name = "dolphin-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/dolphin-20.12.3.tar.xz";
+      sha256 = "1wx1z2bfcd8irhfbh2j4bhdl72afjwfbrh1ps8xzah14vqjvi54p";
+      name = "dolphin-20.12.3.tar.xz";
     };
   };
   dolphin-plugins = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/dolphin-plugins-20.12.2.tar.xz";
-      sha256 = "0zjy429cqb6nspmiharvszjhpn662y23s9wbdqs04h2p6pi8raxn";
-      name = "dolphin-plugins-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/dolphin-plugins-20.12.3.tar.xz";
+      sha256 = "102ykanh4a0pdm0j6wns5jaq76f71y96dgymm2mbgwrfrydcmcpw";
+      name = "dolphin-plugins-20.12.3.tar.xz";
     };
   };
   dragon = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/dragon-20.12.2.tar.xz";
-      sha256 = "0yssqbfgm92bls5cfy0xcqnqfqx00ns2i6rlwdlx38kfh0r47cag";
-      name = "dragon-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/dragon-20.12.3.tar.xz";
+      sha256 = "0aipkxyks1b7jdbxcb6i7l2kb6gahla07h4mls8fsmal4ha808ga";
+      name = "dragon-20.12.3.tar.xz";
     };
   };
   elisa = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/elisa-20.12.2.tar.xz";
-      sha256 = "1sl55kynkwxaypdm6zjdk85yxxq9754xm6ybxm7qdafq691g9zjr";
-      name = "elisa-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/elisa-20.12.3.tar.xz";
+      sha256 = "0rcqwx68hb8cipbd9nd3sl922i63qaaphf6fnryhg7rinh2x75vs";
+      name = "elisa-20.12.3.tar.xz";
     };
   };
   eventviews = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/eventviews-20.12.2.tar.xz";
-      sha256 = "1g4aqhh2b5s45m0qqp46wazcc7rzcp3mmds4q9x3isckqpijzp39";
-      name = "eventviews-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/eventviews-20.12.3.tar.xz";
+      sha256 = "0pkfhvrf423irvijqjk7a2px23zi053c57lqkp3cjag9z994wqkv";
+      name = "eventviews-20.12.3.tar.xz";
     };
   };
   ffmpegthumbs = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/ffmpegthumbs-20.12.2.tar.xz";
-      sha256 = "0iw1g7x31jkbmniawvjwy8wk573rv05idk08q1vavxa5vixxqsbg";
-      name = "ffmpegthumbs-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/ffmpegthumbs-20.12.3.tar.xz";
+      sha256 = "1cwn3rjqghbd2ivb268g68zibqyvvn1a07hcwa8bfjxw8y5cx890";
+      name = "ffmpegthumbs-20.12.3.tar.xz";
     };
   };
   filelight = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/filelight-20.12.2.tar.xz";
-      sha256 = "0m38il0rz7zip9rxing4j5fppwyrjgv1d7n3vrp3x4wnmd08j46q";
-      name = "filelight-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/filelight-20.12.3.tar.xz";
+      sha256 = "0njapqiv2201bk57wl96ky8n78a31234vf2srcjs0nrdmbcp0si0";
+      name = "filelight-20.12.3.tar.xz";
     };
   };
   granatier = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/granatier-20.12.2.tar.xz";
-      sha256 = "0gssfcqq1czh5l1dwi5lpj0f9bgv2jf0wma9i5j0aqrf9b086g7f";
-      name = "granatier-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/granatier-20.12.3.tar.xz";
+      sha256 = "1x2l9f9xwrqf06r2qcrlf8941k6kfqb69442cy1ss9jfl9axy3vl";
+      name = "granatier-20.12.3.tar.xz";
     };
   };
   grantlee-editor = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/grantlee-editor-20.12.2.tar.xz";
-      sha256 = "0fbb9zia4kjc7rw4s27vsy6isvkx56k50gn6y1cyfl0gqy70v4cw";
-      name = "grantlee-editor-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/grantlee-editor-20.12.3.tar.xz";
+      sha256 = "1n6qi2pvhrhnzpq45757s75rslpzjgl60x7g5fv9cpfjk5knqzkc";
+      name = "grantlee-editor-20.12.3.tar.xz";
     };
   };
   grantleetheme = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/grantleetheme-20.12.2.tar.xz";
-      sha256 = "1cv23ias36mp4zm84fk21f3f7nx3jz7xpiyz0nvz6xcsiww77762";
-      name = "grantleetheme-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/grantleetheme-20.12.3.tar.xz";
+      sha256 = "0z9s5bmy89k3gzczim2prvb5mnylzin93d4h4nz6j7p5sk8aqgg3";
+      name = "grantleetheme-20.12.3.tar.xz";
     };
   };
   gwenview = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/gwenview-20.12.2.tar.xz";
-      sha256 = "0cr6jjnvin8jv6hnajxg6zlph5syg2zjrcwd784dlzv23hna9v5n";
-      name = "gwenview-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/gwenview-20.12.3.tar.xz";
+      sha256 = "18j13db432hhgz3kdrfcs555wy1fyjap8jha0aaw4w08bx8ll8v8";
+      name = "gwenview-20.12.3.tar.xz";
     };
   };
   incidenceeditor = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/incidenceeditor-20.12.2.tar.xz";
-      sha256 = "1q48ydma2rcpn3dnf9p08mqfs481n5fhc9m5wl2cvm6as54sfmp8";
-      name = "incidenceeditor-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/incidenceeditor-20.12.3.tar.xz";
+      sha256 = "04yf0z6wsmb7zibfvv0pgyjzfacqa3drqqbc35d0hnvjzh39q1a4";
+      name = "incidenceeditor-20.12.3.tar.xz";
     };
   };
   itinerary = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/itinerary-20.12.2.tar.xz";
-      sha256 = "1dkgsiqww9z6k0xbvn15w630jdhmxr1kkz5dcv1n9yl7bgj32s35";
-      name = "itinerary-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/itinerary-20.12.3.tar.xz";
+      sha256 = "0jpk9f11r563inbm7yrx0lwpb937b1ilgshc9i50fhaqqgii39rp";
+      name = "itinerary-20.12.3.tar.xz";
     };
   };
   juk = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/juk-20.12.2.tar.xz";
-      sha256 = "1dc6n07hkd8as2q1i2l3jzqcijw3qd4ihx1205nzn7z256bby58n";
-      name = "juk-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/juk-20.12.3.tar.xz";
+      sha256 = "01sz8qnp71z34yyvgwhami5rybnlqy3r81ki21r45lvmlbd2i9l7";
+      name = "juk-20.12.3.tar.xz";
     };
   };
   k3b = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/k3b-20.12.2.tar.xz";
-      sha256 = "0gqg8r2p6nksbdg4c8wqz57dj8d1cw7cmrgzc1l2pin4v3qdx94g";
-      name = "k3b-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/k3b-20.12.3.tar.xz";
+      sha256 = "132v5jcn7dmrbb69sllyv72d2d7vg9bpnpjzfmvirqa80x0x7s48";
+      name = "k3b-20.12.3.tar.xz";
     };
   };
   kaccounts-integration = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/kaccounts-integration-20.12.2.tar.xz";
-      sha256 = "15py7fp6sajvx0c7zi7zhfx16sqn8kkkvglkvcq0b9kglswpvkfj";
-      name = "kaccounts-integration-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/kaccounts-integration-20.12.3.tar.xz";
+      sha256 = "0md6jwi0295n2s8mkvc793a4sxfzf6fidwpnjal2dsxkzdr0nfcq";
+      name = "kaccounts-integration-20.12.3.tar.xz";
     };
   };
   kaccounts-providers = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/kaccounts-providers-20.12.2.tar.xz";
-      sha256 = "0205l3k3nzx6cnar90zrbgmabapyry4a991lqflkpxgdrkh0ajc0";
-      name = "kaccounts-providers-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/kaccounts-providers-20.12.3.tar.xz";
+      sha256 = "05q6wzdbr1vm8g8qjssk0hnzrqkpq5qrrjwgqj8nkqgipzgclwdf";
+      name = "kaccounts-providers-20.12.3.tar.xz";
     };
   };
   kaddressbook = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/kaddressbook-20.12.2.tar.xz";
-      sha256 = "0xqsl7fav1vqq4iqy2m02s92rnr28pi1ak3sv0ra7q1gb89rhi0y";
-      name = "kaddressbook-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/kaddressbook-20.12.3.tar.xz";
+      sha256 = "15fpcxlnf42wc2z942rrgydb21v30ml3633cvsscrbjc3vys9vc3";
+      name = "kaddressbook-20.12.3.tar.xz";
     };
   };
   kajongg = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/kajongg-20.12.2.tar.xz";
-      sha256 = "0vh6qb3d54nnxrxacq9fn7jq1hshhhnvw9ff0wgh214jlr0gnbqk";
-      name = "kajongg-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/kajongg-20.12.3.tar.xz";
+      sha256 = "0h3kdvrp6y6ydhbmvwc8h1l0zh16jy519k5ragwkd9039cvyryxi";
+      name = "kajongg-20.12.3.tar.xz";
     };
   };
   kalarm = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/kalarm-20.12.2.tar.xz";
-      sha256 = "1lpg1viwn868hw0dd8zs11iafkhzlr3cydfplnh4ss6visga50kb";
-      name = "kalarm-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/kalarm-20.12.3.tar.xz";
+      sha256 = "0pkr9vm5hvdwyqb2mpi1qq5cxv0fd8czlq2hq8kb4ghskwd2nm6z";
+      name = "kalarm-20.12.3.tar.xz";
     };
   };
   kalarmcal = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/kalarmcal-20.12.2.tar.xz";
-      sha256 = "17lll9671318dxhxpnjaih31xz5b971gw6kmrgz2ljq5nz1l027b";
-      name = "kalarmcal-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/kalarmcal-20.12.3.tar.xz";
+      sha256 = "184qdpwwqnwlny0iil2vrw6x1al575mm6fx9iqbpg6hwz131nzhg";
+      name = "kalarmcal-20.12.3.tar.xz";
     };
   };
   kalgebra = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/kalgebra-20.12.2.tar.xz";
-      sha256 = "0dwvm4b0wpkd3i79q3xs2v3majwa56hgq8r4vv071a8ci8fn27bz";
-      name = "kalgebra-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/kalgebra-20.12.3.tar.xz";
+      sha256 = "0bx7v28qgpyjxka3kxjas6n1r5rq88vq064qscgjrn25536bg6p9";
+      name = "kalgebra-20.12.3.tar.xz";
     };
   };
   kalzium = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/kalzium-20.12.2.tar.xz";
-      sha256 = "0jdg0akxmylbvh80cz31cycrdqvyafsv9j7hfpdhrizdy7vvqywg";
-      name = "kalzium-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/kalzium-20.12.3.tar.xz";
+      sha256 = "1r7zvknc8kkx5kcs111ij6k6byj93xbg47bpi8wfh17i2fdrccw2";
+      name = "kalzium-20.12.3.tar.xz";
     };
   };
   kamera = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/kamera-20.12.2.tar.xz";
-      sha256 = "1licmi05g1qpfh88annqd89av77jsmhxnsidgkvf4ffczwd097l6";
-      name = "kamera-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/kamera-20.12.3.tar.xz";
+      sha256 = "0g6i4a975n9sxcjvpihz3wmldivk65i6p175vq2nik46jq6kxnj6";
+      name = "kamera-20.12.3.tar.xz";
     };
   };
   kamoso = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/kamoso-20.12.2.tar.xz";
-      sha256 = "0ar19nlw2bxrbn4wky8ky3x5m70rf7fb0fviniblqcrggyymgmb9";
-      name = "kamoso-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/kamoso-20.12.3.tar.xz";
+      sha256 = "0zmhfcdihb5gd0gvnx3gmsn85dl4h1a42672592qrv7mv9yfl8x4";
+      name = "kamoso-20.12.3.tar.xz";
     };
   };
   kanagram = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/kanagram-20.12.2.tar.xz";
-      sha256 = "00p2mpprbq9zi1zzscb4d0fdj2knnfkjxclf3q982jz4laxyqalf";
-      name = "kanagram-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/kanagram-20.12.3.tar.xz";
+      sha256 = "0yzz8apm76vhfgbx72jjfrc8z090xp9l6lr318wla809bvk92kn5";
+      name = "kanagram-20.12.3.tar.xz";
     };
   };
   kapman = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/kapman-20.12.2.tar.xz";
-      sha256 = "1fs33p9g52k5nywpih7nns3mh0apfhnn174k9711vwnamr73ph6k";
-      name = "kapman-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/kapman-20.12.3.tar.xz";
+      sha256 = "1734r0i37w8cbsmhmv6553l2prcg6l960j2j387x3lm6ynm8szl5";
+      name = "kapman-20.12.3.tar.xz";
     };
   };
   kapptemplate = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/kapptemplate-20.12.2.tar.xz";
-      sha256 = "19rnxw0q8w890ns237vpaapipm3zjz7n0rn9yzxa5cqaf30l7jv5";
-      name = "kapptemplate-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/kapptemplate-20.12.3.tar.xz";
+      sha256 = "0587cwsjh9776zwb9dlqsn75bin5cv80yyixd9hqx86kqkxabw4c";
+      name = "kapptemplate-20.12.3.tar.xz";
     };
   };
   kate = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/kate-20.12.2.tar.xz";
-      sha256 = "1kdznizqh28parijpsi67jmb8mlx4gn7z4szlh5kjd1mv9rikvm7";
-      name = "kate-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/kate-20.12.3.tar.xz";
+      sha256 = "1zfl53b3166ijr41bymlv0mvavjxv9sv5cf8xrpihn0rzs52vg41";
+      name = "kate-20.12.3.tar.xz";
     };
   };
   katomic = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/katomic-20.12.2.tar.xz";
-      sha256 = "1sxh6x09is33b3zdgj3d6zn9z19qc25v4hskffmw5xivnwz9vzfl";
-      name = "katomic-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/katomic-20.12.3.tar.xz";
+      sha256 = "1qmby2cp1sz31hraxybcb60a6smaf8ksy3m8nzkk7kpr11mzss0q";
+      name = "katomic-20.12.3.tar.xz";
     };
   };
   kbackup = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/kbackup-20.12.2.tar.xz";
-      sha256 = "138x20p27a0yx4n6xamc660nk0zzrap7zhkkwpy9ayh07rgh1222";
-      name = "kbackup-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/kbackup-20.12.3.tar.xz";
+      sha256 = "04qj9645r427ki2jbj5ij243y6svw24ilwz5pz2qp0dp95wndfql";
+      name = "kbackup-20.12.3.tar.xz";
     };
   };
   kblackbox = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/kblackbox-20.12.2.tar.xz";
-      sha256 = "1c6by0hi9bzs6j1y0qxrvz6ahdxhzivnw9hg4jndmhgbsqqix4q5";
-      name = "kblackbox-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/kblackbox-20.12.3.tar.xz";
+      sha256 = "0z4w3f22d8dmvmv4jmbgk91ga0qbw54xmawkikks5b0xgqkwkls7";
+      name = "kblackbox-20.12.3.tar.xz";
     };
   };
   kblocks = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/kblocks-20.12.2.tar.xz";
-      sha256 = "06slcac3hvdmb5lymyqb1z8mn3r756xz2ghwdqz1d2mn3n2jd0bw";
-      name = "kblocks-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/kblocks-20.12.3.tar.xz";
+      sha256 = "0rsxyyaz6gs4a8qz5gsl865ky8a25hl282m293zsyd66wsc0f3hv";
+      name = "kblocks-20.12.3.tar.xz";
     };
   };
   kbounce = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/kbounce-20.12.2.tar.xz";
-      sha256 = "19xvvxmbwpwkwsm0mxjnh92m352lkshsjgi8yrax1hdblymr60v1";
-      name = "kbounce-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/kbounce-20.12.3.tar.xz";
+      sha256 = "0yyzr0zmsvfafrvy23vd4grdzpgc1w5ava0fb90x174mv0k2v55s";
+      name = "kbounce-20.12.3.tar.xz";
     };
   };
   kbreakout = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/kbreakout-20.12.2.tar.xz";
-      sha256 = "1n1vrj08j1drc1apikhgwdbmb5daypgnkw6yxhqc3xi2a3wglkqz";
-      name = "kbreakout-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/kbreakout-20.12.3.tar.xz";
+      sha256 = "1djiixrwda25p2d8bvhkwn07v2gib35kwm94i1j5yxn0v68m86q1";
+      name = "kbreakout-20.12.3.tar.xz";
     };
   };
   kbruch = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/kbruch-20.12.2.tar.xz";
-      sha256 = "0hjwmzsdlpg8przlmpp0xsa19v7376bpjk5kwyajywhayzzw99xp";
-      name = "kbruch-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/kbruch-20.12.3.tar.xz";
+      sha256 = "1g2ihgxx6fj98cibfla9rig1mpgivs0l0ipkg5v8ax9wy7cmrx82";
+      name = "kbruch-20.12.3.tar.xz";
     };
   };
   kcachegrind = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/kcachegrind-20.12.2.tar.xz";
-      sha256 = "0ich4hxfmq909zkn06p8pgxpf7sg9ndq51b533h2clbq3m9qwy2w";
-      name = "kcachegrind-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/kcachegrind-20.12.3.tar.xz";
+      sha256 = "1sk9bxz6lx3kadfv862d52pm69fcvg160y84y3qj59b9ms2qpqcm";
+      name = "kcachegrind-20.12.3.tar.xz";
     };
   };
   kcalc = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/kcalc-20.12.2.tar.xz";
-      sha256 = "0dv8519wnlfdp2d2ml2r5qx3gjh8g6im742vqqk7m1660ijgc8zx";
-      name = "kcalc-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/kcalc-20.12.3.tar.xz";
+      sha256 = "1plq0xfaq2wwhsqddiq5wssn3k3i9dxrr5p80zanzngqcwbql1jl";
+      name = "kcalc-20.12.3.tar.xz";
     };
   };
   kcalutils = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/kcalutils-20.12.2.tar.xz";
-      sha256 = "1k4cr1iq945zs6c35f3s1w8kfm3kh7aybmk5py3lsz0zmlab36hc";
-      name = "kcalutils-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/kcalutils-20.12.3.tar.xz";
+      sha256 = "0as3900mcsdngrszd19928dfacm3qa7y1y2v65vf9mn0alz367qx";
+      name = "kcalutils-20.12.3.tar.xz";
     };
   };
   kcharselect = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/kcharselect-20.12.2.tar.xz";
-      sha256 = "0fqf6bw98l499a144xk7hslxm6zdlpa0lcq0bgwnfsd0fs03wlp3";
-      name = "kcharselect-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/kcharselect-20.12.3.tar.xz";
+      sha256 = "1qz96clyh7wl7sb3hkpkij96a0s9zx9saxhvbwrkqjqdhnqai8c3";
+      name = "kcharselect-20.12.3.tar.xz";
     };
   };
   kcolorchooser = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/kcolorchooser-20.12.2.tar.xz";
-      sha256 = "08y4qzr43nikgzli14yzj7w8vqzl905f0rwx0ri5247259jna3rk";
-      name = "kcolorchooser-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/kcolorchooser-20.12.3.tar.xz";
+      sha256 = "0aamaml734mcbja9j4m9grp0zsxvy8ivzia49l2pmq27ci23ygad";
+      name = "kcolorchooser-20.12.3.tar.xz";
     };
   };
   kcron = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/kcron-20.12.2.tar.xz";
-      sha256 = "025a647zl125568l8vqnljir110jbnkxd4921a892ip7pnhp0v95";
-      name = "kcron-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/kcron-20.12.3.tar.xz";
+      sha256 = "0jn5mymzbifblg1sl4h9micql8baxmbpjclmlxp9r59m3vlpd0pf";
+      name = "kcron-20.12.3.tar.xz";
     };
   };
   kdebugsettings = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/kdebugsettings-20.12.2.tar.xz";
-      sha256 = "1dzdvscklgbcfjalcc1mfh3vgiai2dvbsz00b4c96r8jxpm7bvcn";
-      name = "kdebugsettings-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/kdebugsettings-20.12.3.tar.xz";
+      sha256 = "1nsinb3psnvab0gc88hl374fr8f3iwxzi5ly9fg41f0z5a4hp9qv";
+      name = "kdebugsettings-20.12.3.tar.xz";
     };
   };
   kdeconnect-kde = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/kdeconnect-kde-20.12.2.tar.xz";
-      sha256 = "0wcx1bn121b62pwdkf7k24sa03kgixvrbp5y5iy11im7kj5i3ji1";
-      name = "kdeconnect-kde-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/kdeconnect-kde-20.12.3.tar.xz";
+      sha256 = "1a08js0nrjzkfs46wydyz2ipivvgyc0hyyz4cxglhs5i97gab601";
+      name = "kdeconnect-kde-20.12.3.tar.xz";
     };
   };
   kde-dev-scripts = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/kde-dev-scripts-20.12.2.tar.xz";
-      sha256 = "03kqd01yhii2b6g4gsjg09vwmzv53vr5d7y3d4db13kgg0f1z352";
-      name = "kde-dev-scripts-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/kde-dev-scripts-20.12.3.tar.xz";
+      sha256 = "1qng0232gzfzqlx5ri7lkkhri6wj9gci14xc62qqhklkmfdfx3nh";
+      name = "kde-dev-scripts-20.12.3.tar.xz";
     };
   };
   kde-dev-utils = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/kde-dev-utils-20.12.2.tar.xz";
-      sha256 = "105pp4yhgynn3gq0bi7q1vyy1qn8pcd0hgx17v674hf8afy4627r";
-      name = "kde-dev-utils-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/kde-dev-utils-20.12.3.tar.xz";
+      sha256 = "09k9c0dk6gq3372zarmq7kfid7kn2s1vfdcrzal6wg57axfqs8d7";
+      name = "kde-dev-utils-20.12.3.tar.xz";
     };
   };
   kdeedu-data = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/kdeedu-data-20.12.2.tar.xz";
-      sha256 = "04x8papz62m5kanrqpjddzijda761i4j8y4cmqpnxkg2jrwfqqls";
-      name = "kdeedu-data-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/kdeedu-data-20.12.3.tar.xz";
+      sha256 = "0cg62yvv39zgshqmfwl5p007b4za6x1nimfmn0hk8j9paas4ykkr";
+      name = "kdeedu-data-20.12.3.tar.xz";
     };
   };
   kdegraphics-mobipocket = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/kdegraphics-mobipocket-20.12.2.tar.xz";
-      sha256 = "02a4ivpvfziaa464l8c9ivydagcb912ld95isgvc5jl4g85lm166";
-      name = "kdegraphics-mobipocket-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/kdegraphics-mobipocket-20.12.3.tar.xz";
+      sha256 = "1zbizlk84idqxk0mr6zi86f3z4wrcc0k75s2s0xwfavjp5wvjj4l";
+      name = "kdegraphics-mobipocket-20.12.3.tar.xz";
     };
   };
   kdegraphics-thumbnailers = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/kdegraphics-thumbnailers-20.12.2.tar.xz";
-      sha256 = "1p47fvb6mdk23rx9jhm9x60sny9z6plgdjih5lzy9k3hvl0sl8zk";
-      name = "kdegraphics-thumbnailers-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/kdegraphics-thumbnailers-20.12.3.tar.xz";
+      sha256 = "0g3z6jai2v7pin23vk8xh66r9y8bw2768aykqhh5s507q0k8cnfx";
+      name = "kdegraphics-thumbnailers-20.12.3.tar.xz";
     };
   };
   kdenetwork-filesharing = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/kdenetwork-filesharing-20.12.2.tar.xz";
-      sha256 = "0y60az09hkhd1hvwa7h7c834dc0mfnd89f78v8m31il8g2xniziz";
-      name = "kdenetwork-filesharing-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/kdenetwork-filesharing-20.12.3.tar.xz";
+      sha256 = "1lg3431wgrswam1mgck1p2kfgrwk0pk02nzh7xxgvh78104npbb2";
+      name = "kdenetwork-filesharing-20.12.3.tar.xz";
     };
   };
   kdenlive = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/kdenlive-20.12.2.tar.xz";
-      sha256 = "0gh1cjhakdl7hx236rsxiv62mafd2vvvpg5ndwlp0zfpsx7kzjrz";
-      name = "kdenlive-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/kdenlive-20.12.3.tar.xz";
+      sha256 = "11l5m19vbkjgvxcxh64ccwk33ws5sjpxr68d8459piggkdlr97wd";
+      name = "kdenlive-20.12.3.tar.xz";
     };
   };
   kdepim-addons = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/kdepim-addons-20.12.2.tar.xz";
-      sha256 = "0zj22ggn98sqz3nnvzffhbv2cq672j885f2p8qla6swhyw91cq8n";
-      name = "kdepim-addons-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/kdepim-addons-20.12.3.tar.xz";
+      sha256 = "0wd64aby2yrg937m9sfyzby3gxhwp2n1h6ijxxz7h2wi5mw3aqdp";
+      name = "kdepim-addons-20.12.3.tar.xz";
     };
   };
   kdepim-runtime = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/kdepim-runtime-20.12.2.tar.xz";
-      sha256 = "0p5c4l4xixcvpzx7mri2jxa3nwk4824lp5sy93sspf2nlgdv3zsn";
-      name = "kdepim-runtime-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/kdepim-runtime-20.12.3.tar.xz";
+      sha256 = "0lp3cvkbfqd0zn7gh0as1ksknzqwxpz70zbks70wzdf4i59k2sxv";
+      name = "kdepim-runtime-20.12.3.tar.xz";
     };
   };
   kdesdk-kioslaves = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/kdesdk-kioslaves-20.12.2.tar.xz";
-      sha256 = "1xgp3fi6nnygjw2p832ylmhsj70dm33c4rf3h79sc2dp7aihnapy";
-      name = "kdesdk-kioslaves-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/kdesdk-kioslaves-20.12.3.tar.xz";
+      sha256 = "0x48xzqg85rc639rrd7y43y1bvzyw189vydra13wbg063acx79n8";
+      name = "kdesdk-kioslaves-20.12.3.tar.xz";
     };
   };
   kdesdk-thumbnailers = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/kdesdk-thumbnailers-20.12.2.tar.xz";
-      sha256 = "0jk2x2b8qwhfbf9hy8j0yslggn3zwp18q21ip299b4cpx1w72bgq";
-      name = "kdesdk-thumbnailers-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/kdesdk-thumbnailers-20.12.3.tar.xz";
+      sha256 = "1n49psav0528dzg7b8h79pwngzjh1if7n47y7y8f5dj3smnyi6mv";
+      name = "kdesdk-thumbnailers-20.12.3.tar.xz";
     };
   };
   kdf = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/kdf-20.12.2.tar.xz";
-      sha256 = "0fx9b5njsmvzznrgz2r9xz8yh977v865zvsih60hdrz6gaflg1rx";
-      name = "kdf-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/kdf-20.12.3.tar.xz";
+      sha256 = "1qvjkfnagcyplkpx5v7vwfhs0xjll7g5jc0fvmkxqf38v2m5wb77";
+      name = "kdf-20.12.3.tar.xz";
     };
   };
   kdialog = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/kdialog-20.12.2.tar.xz";
-      sha256 = "1v2yflxpqg2h2jgxql1mnk8c1v1n4ljard5bgh1dw898r7b8g2xd";
-      name = "kdialog-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/kdialog-20.12.3.tar.xz";
+      sha256 = "1ph26rks7yfjr28gvgyq77d8mnxxj0dxldd83lw94plhwlsnf7r3";
+      name = "kdialog-20.12.3.tar.xz";
     };
   };
   kdiamond = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/kdiamond-20.12.2.tar.xz";
-      sha256 = "17z1g2jxz26pqx5xjc5h7w5s2xy72p00ydnfhsv1bi1kfd79ry8k";
-      name = "kdiamond-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/kdiamond-20.12.3.tar.xz";
+      sha256 = "1wljkv0hacahc6n1x40diycvd32qlw363yzf3qm2l3h55g1ynca7";
+      name = "kdiamond-20.12.3.tar.xz";
     };
   };
   keditbookmarks = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/keditbookmarks-20.12.2.tar.xz";
-      sha256 = "0slma1vrm0cmr2v970ingbckqa3viw6jgfss0z7fpx4bilw65bd7";
-      name = "keditbookmarks-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/keditbookmarks-20.12.3.tar.xz";
+      sha256 = "0nfpdm672vs5h5ivxj6aaicj1b8nqcp7gw81jvjnq3nqk1k488v8";
+      name = "keditbookmarks-20.12.3.tar.xz";
     };
   };
   kfind = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/kfind-20.12.2.tar.xz";
-      sha256 = "0vfi5ipwncq7d4z1gbilw6kyyrn5d986wr3f2zhsyhpwmsh9ycnb";
-      name = "kfind-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/kfind-20.12.3.tar.xz";
+      sha256 = "0rzilsw9y8cd4vmksl3jpddc0qc3y60yz7f6yk11n0hpszy0ixp6";
+      name = "kfind-20.12.3.tar.xz";
     };
   };
   kfloppy = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/kfloppy-20.12.2.tar.xz";
-      sha256 = "1sz6bgw54w8s4bdyyajy0zgxw5kcm45p0gizf7ghw33x5vxryg4g";
-      name = "kfloppy-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/kfloppy-20.12.3.tar.xz";
+      sha256 = "00ff15fcgp1bgl4qin6md18p93wbpg3p230kgjk76qp8rmnwamg8";
+      name = "kfloppy-20.12.3.tar.xz";
     };
   };
   kfourinline = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/kfourinline-20.12.2.tar.xz";
-      sha256 = "1ld2srgmriab70j08nvqbaswjp2miljwd8rbpy2dyvzfprmci3xk";
-      name = "kfourinline-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/kfourinline-20.12.3.tar.xz";
+      sha256 = "0rj1b60g7dng8yqw92lv9kk8fbnc7wwc9gbikkkjsrmw20hsl4jj";
+      name = "kfourinline-20.12.3.tar.xz";
     };
   };
   kgeography = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/kgeography-20.12.2.tar.xz";
-      sha256 = "0v1355y3fwzq63hq0wz9rskzncnlfdybmqcx23pk57jazsmv6ndi";
-      name = "kgeography-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/kgeography-20.12.3.tar.xz";
+      sha256 = "0i9sg203rbkcjl5si8fprmz31m90i5gq7ckv6vrsnmf3y0f6324m";
+      name = "kgeography-20.12.3.tar.xz";
     };
   };
   kget = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/kget-20.12.2.tar.xz";
-      sha256 = "1xya4raai9jqqzb3kga3mrm7jznkaa0fr4sq8j28qd45bgx2385p";
-      name = "kget-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/kget-20.12.3.tar.xz";
+      sha256 = "0kh2yv3fq6mdfqfiqiqd01l8rmr36pmcmjdqqaagsb16jprxivnl";
+      name = "kget-20.12.3.tar.xz";
     };
   };
   kgoldrunner = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/kgoldrunner-20.12.2.tar.xz";
-      sha256 = "1ai5hfhwlsiw6ywpmwg9q85hsn3ih44v7n3wj70fsrldh87cn9ps";
-      name = "kgoldrunner-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/kgoldrunner-20.12.3.tar.xz";
+      sha256 = "01c2ia8hs8i92ayah3jlsrqb62mcfa0phmm8rjbpnv8ybkjba720";
+      name = "kgoldrunner-20.12.3.tar.xz";
     };
   };
   kgpg = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/kgpg-20.12.2.tar.xz";
-      sha256 = "1szg6fmmnxi94s5r2gxn4mlsiqahharyh05bisy5w7cl9w9c70xg";
-      name = "kgpg-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/kgpg-20.12.3.tar.xz";
+      sha256 = "0z4xlgdhdagniabbzsvrpgzm2k3vwmk6li2wp9y719yj1jm23iyz";
+      name = "kgpg-20.12.3.tar.xz";
     };
   };
   khangman = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/khangman-20.12.2.tar.xz";
-      sha256 = "1bhcdr2v6zgawn819vbqnvgrm52xymgjyr396qbx5mc0srz88bzk";
-      name = "khangman-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/khangman-20.12.3.tar.xz";
+      sha256 = "0alk18a95m5cl3zxf4y69i6vs1v027s5zwkbgrczznnxx2isv82r";
+      name = "khangman-20.12.3.tar.xz";
     };
   };
   khelpcenter = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/khelpcenter-20.12.2.tar.xz";
-      sha256 = "1mxs0imw64av8dybh91xxy4mmdcikjkqv6apsw29pp3s29irxpdx";
-      name = "khelpcenter-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/khelpcenter-20.12.3.tar.xz";
+      sha256 = "0mixgxi4a56x1xgan4rz3f6bifm21rwnm193klsd15bkd29yfa8f";
+      name = "khelpcenter-20.12.3.tar.xz";
     };
   };
   kidentitymanagement = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/kidentitymanagement-20.12.2.tar.xz";
-      sha256 = "1vcpfcriinx0ywz3jz26810h2cqmlfvyyxd0mzh3jp7rl0kkasgj";
-      name = "kidentitymanagement-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/kidentitymanagement-20.12.3.tar.xz";
+      sha256 = "161dj154r43gmw7768llanvmismf5fa141xblji6q40ss5aknsh3";
+      name = "kidentitymanagement-20.12.3.tar.xz";
     };
   };
   kig = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/kig-20.12.2.tar.xz";
-      sha256 = "08wvgykrhzf2j4qb0fz4irbyaxjp5ka7jmmjn8y27srz0x4zgkrz";
-      name = "kig-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/kig-20.12.3.tar.xz";
+      sha256 = "1ncy071wlyinkzhalnhg23x6n01031m2sx5kzh8gllp023mn2cnf";
+      name = "kig-20.12.3.tar.xz";
     };
   };
   kigo = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/kigo-20.12.2.tar.xz";
-      sha256 = "1a4hv5g2wdpvf56zrr0rna6hdvm2cy6sz1jlhj7hf1lcx3lgfj9g";
-      name = "kigo-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/kigo-20.12.3.tar.xz";
+      sha256 = "1s4ykxlr47gk6n44fnv390m619i0jnxbxs4vd3vv7f9hfl65k598";
+      name = "kigo-20.12.3.tar.xz";
     };
   };
   killbots = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/killbots-20.12.2.tar.xz";
-      sha256 = "01lmkflndqmrzyrabmh5jqrk2zywcn5s82aag3m0wdqbyrqc5pas";
-      name = "killbots-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/killbots-20.12.3.tar.xz";
+      sha256 = "056slp4d9gk40i75gk42cvaq300zr228srqly2gap4879vqs04pa";
+      name = "killbots-20.12.3.tar.xz";
     };
   };
   kimagemapeditor = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/kimagemapeditor-20.12.2.tar.xz";
-      sha256 = "06awvhcjg8nd0wjcqqzccnlpci6cd35flvfs3k05czk70sgqzysq";
-      name = "kimagemapeditor-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/kimagemapeditor-20.12.3.tar.xz";
+      sha256 = "15z2mygfhk4bq212f76x60zzia1339hw1jg5vf24q2xs26gppprr";
+      name = "kimagemapeditor-20.12.3.tar.xz";
     };
   };
   kimap = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/kimap-20.12.2.tar.xz";
-      sha256 = "14kjgn6b1qnfr3zsr3r73wf15n47qqx9vw5z11yv161andrr105d";
-      name = "kimap-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/kimap-20.12.3.tar.xz";
+      sha256 = "080k4zyl7rlgzyfz6hsygv4wpw1hf08qnv4sbakpy3j8h6cbn79j";
+      name = "kimap-20.12.3.tar.xz";
     };
   };
   kio-extras = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/kio-extras-20.12.2.tar.xz";
-      sha256 = "1r2sw8i7lf0zyb5bvz4002vdi2bf9jv01735caiw9smxr1lgcz93";
-      name = "kio-extras-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/kio-extras-20.12.3.tar.xz";
+      sha256 = "1qj1cxzlpwh47vx7n3lm86556a53i6x3nvj5xc51mkh8pkdr0nxs";
+      name = "kio-extras-20.12.3.tar.xz";
     };
   };
   kio-gdrive = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/kio-gdrive-20.12.2.tar.xz";
-      sha256 = "0rwwakhsn9bnmxxnr0620jyp00x7iqqsaz5nd2lmhyjkc4mqv2km";
-      name = "kio-gdrive-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/kio-gdrive-20.12.3.tar.xz";
+      sha256 = "0w3vizdrjrikpgq137l5g0anvk0nb5wkr4m7pn0qma0sd03wqsa5";
+      name = "kio-gdrive-20.12.3.tar.xz";
     };
   };
   kipi-plugins = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/kipi-plugins-20.12.2.tar.xz";
-      sha256 = "120yi7kfqv74368c78s4gfg7fp2h32v1c3jic2lnsy5y3iad22l8";
-      name = "kipi-plugins-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/kipi-plugins-20.12.3.tar.xz";
+      sha256 = "0wf0f6n1kpbcrlrfnmhkvcva4n86nav3lwfka29xwmk0brq35ghn";
+      name = "kipi-plugins-20.12.3.tar.xz";
     };
   };
   kirigami-gallery = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/kirigami-gallery-20.12.2.tar.xz";
-      sha256 = "039ddgrvw1l4jvc3yjs0c6fi8kss5ma8hs6cbs8xvw0cyi9604qw";
-      name = "kirigami-gallery-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/kirigami-gallery-20.12.3.tar.xz";
+      sha256 = "0925n23wa69v69f0i3fafkaqsvn3sv41ili7c62110zx5n92qd3v";
+      name = "kirigami-gallery-20.12.3.tar.xz";
     };
   };
   kiriki = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/kiriki-20.12.2.tar.xz";
-      sha256 = "0bslysqnnxkjfyxv8vkfmvwjhlw2zdlghbngg21k1ljvgr2jfx6j";
-      name = "kiriki-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/kiriki-20.12.3.tar.xz";
+      sha256 = "0xnwdvnblz8qpgngjmmn218nrjxhy6f6z6ispszirr39mxvqgdhd";
+      name = "kiriki-20.12.3.tar.xz";
     };
   };
   kiten = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/kiten-20.12.2.tar.xz";
-      sha256 = "18p4g9cqn25s2zjygwvi9s81ma0b8rhfj9z0i2kd415b2sxalk3y";
-      name = "kiten-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/kiten-20.12.3.tar.xz";
+      sha256 = "0yjfdbrm5kijf5rh45ih8x3hxcj9y9d5bivpi2xqdnl8w6dq0hnq";
+      name = "kiten-20.12.3.tar.xz";
     };
   };
   kitinerary = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/kitinerary-20.12.2.tar.xz";
-      sha256 = "0z9jyj9wlda44qdncjnp6cyp7dwk89dl9nj68j5birmn83ykaawp";
-      name = "kitinerary-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/kitinerary-20.12.3.tar.xz";
+      sha256 = "1p8s27clnvn87kmlvv00j9s50n82awb19cvh4kwm7h77f3aai7jm";
+      name = "kitinerary-20.12.3.tar.xz";
     };
   };
   kjumpingcube = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/kjumpingcube-20.12.2.tar.xz";
-      sha256 = "04qry2b82yk2k4v1pj8pvqi27my42k5ssmc5rpzkh0vq8pzwgkjh";
-      name = "kjumpingcube-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/kjumpingcube-20.12.3.tar.xz";
+      sha256 = "0rr0972scdr0x5ba3gqdprhg0ipm75577bx79m1jhkbqrcsr9kvg";
+      name = "kjumpingcube-20.12.3.tar.xz";
     };
   };
   kldap = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/kldap-20.12.2.tar.xz";
-      sha256 = "1njgsxbqgz0grqagf695qv285x8slgnp4rg377jz1cnz597nzl6b";
-      name = "kldap-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/kldap-20.12.3.tar.xz";
+      sha256 = "0lynv6101wqyi88rm34kwl4a4rdb59q69x918y4ggc4jzvgvq32c";
+      name = "kldap-20.12.3.tar.xz";
     };
   };
   kleopatra = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/kleopatra-20.12.2.tar.xz";
-      sha256 = "12ayl3gar9bi06v418sflr6fr5k86m8x2ls4laig1ymansbvnwlz";
-      name = "kleopatra-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/kleopatra-20.12.3.tar.xz";
+      sha256 = "187agxw1s441qpskv8s74nvmsqmgh5z3mid85i8lvm5bqsdzjc5z";
+      name = "kleopatra-20.12.3.tar.xz";
     };
   };
   klettres = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/klettres-20.12.2.tar.xz";
-      sha256 = "0ixykb36a7hgz89zxc8x7fp0di67vmalvpa9rivdff3lp7il87n3";
-      name = "klettres-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/klettres-20.12.3.tar.xz";
+      sha256 = "1zfbcciki2gz14b0mq7nv7pq90n2kf6dn33nkrwy086rmfm245dw";
+      name = "klettres-20.12.3.tar.xz";
     };
   };
   klickety = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/klickety-20.12.2.tar.xz";
-      sha256 = "0dgv6bnz7aw95nxjqkhcanl06hpdx4g8qwkrvnfsiphjbldhfig7";
-      name = "klickety-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/klickety-20.12.3.tar.xz";
+      sha256 = "155qhsgslx9nw4fzm5x5c09i3vwkqbl5xxa1arcxjpwsashfri2q";
+      name = "klickety-20.12.3.tar.xz";
     };
   };
   klines = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/klines-20.12.2.tar.xz";
-      sha256 = "14mrqfw7y5xcq237a6prfqy8pj34iz5mnfqs373p0jbvdqkc5843";
-      name = "klines-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/klines-20.12.3.tar.xz";
+      sha256 = "06syv5wxf2d9wqh5l7lwwjd0i3q8jqhimgb2ndyv2sp3p6zyx28n";
+      name = "klines-20.12.3.tar.xz";
     };
   };
   kmag = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/kmag-20.12.2.tar.xz";
-      sha256 = "1vwn5n3c8kq3d3d7sssqpq8iz9g0af4xnvcvjqh4s7fcxmsr3ryv";
-      name = "kmag-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/kmag-20.12.3.tar.xz";
+      sha256 = "1p31i6hnhmmmx97bi1zb6c71zi1428gzf11sx66yhvfpj6vjx4rj";
+      name = "kmag-20.12.3.tar.xz";
     };
   };
   kmahjongg = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/kmahjongg-20.12.2.tar.xz";
-      sha256 = "055nihkvfij6a71qn6lw3sbb74zz5r7cp2dghlkai9405ri4gdyc";
-      name = "kmahjongg-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/kmahjongg-20.12.3.tar.xz";
+      sha256 = "1kx6l03x68cvr78iqjc7byraw714pbynavzm4vr8spadqr1scmj2";
+      name = "kmahjongg-20.12.3.tar.xz";
     };
   };
   kmail = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/kmail-20.12.2.tar.xz";
-      sha256 = "09idfdh04687jzh125jw2244ymaqhx6j3563m2cbf2spph0r1vqj";
-      name = "kmail-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/kmail-20.12.3.tar.xz";
+      sha256 = "192wqkvq062xaq42bwl9f1rn7bc60slb3c0ika3mn446mr04s7j1";
+      name = "kmail-20.12.3.tar.xz";
     };
   };
   kmail-account-wizard = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/kmail-account-wizard-20.12.2.tar.xz";
-      sha256 = "0a9pz1m3jabi21nrlcj0fqrj1hsgmarw91sxx5qvs74fp2b59368";
-      name = "kmail-account-wizard-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/kmail-account-wizard-20.12.3.tar.xz";
+      sha256 = "1djc4fl5nyvnz26kbpqav5qy6azcrl0vmfaphmh4msx01823w50n";
+      name = "kmail-account-wizard-20.12.3.tar.xz";
     };
   };
   kmailtransport = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/kmailtransport-20.12.2.tar.xz";
-      sha256 = "11knn52fc5r637s1w3fzbkapjx6xs1n9v9933ji17zhry7c5rlzv";
-      name = "kmailtransport-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/kmailtransport-20.12.3.tar.xz";
+      sha256 = "1m2r30rlmfb41m6hqmbrrw6lf7im4xlsxpfqf2h8qiss9avxf66p";
+      name = "kmailtransport-20.12.3.tar.xz";
     };
   };
   kmbox = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/kmbox-20.12.2.tar.xz";
-      sha256 = "0r76s03g4da2sds6y632gvg228gwsl7gs8ml9rf0fdjb8ymql1hl";
-      name = "kmbox-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/kmbox-20.12.3.tar.xz";
+      sha256 = "0cwhzppckk3lv5p8nwba1vw57hkpbpgk69wnax6ad5x6nkynri8f";
+      name = "kmbox-20.12.3.tar.xz";
     };
   };
   kmime = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/kmime-20.12.2.tar.xz";
-      sha256 = "1jpfhsac2pji80cad0yab59lq7q7c1han0gajvwys1j15jyj11gi";
-      name = "kmime-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/kmime-20.12.3.tar.xz";
+      sha256 = "0va7xxr9bk27nalpr1959g7kbsbn4q974qhsnfvyac7qv0wnh7iq";
+      name = "kmime-20.12.3.tar.xz";
     };
   };
   kmines = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/kmines-20.12.2.tar.xz";
-      sha256 = "0378cd1zh6w8slap4wry8m69l27nvi7j2dwz2vwkl76zh31q4pwi";
-      name = "kmines-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/kmines-20.12.3.tar.xz";
+      sha256 = "11g98f8q77a1zivpv46bahqzkxna15mxm9abc5nmbhhrfl3n2ljr";
+      name = "kmines-20.12.3.tar.xz";
     };
   };
   kmix = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/kmix-20.12.2.tar.xz";
-      sha256 = "12kij1y2lbyx71bg32pwb9s9p928pyw44flz9bv2jrzkkf4zwfxk";
-      name = "kmix-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/kmix-20.12.3.tar.xz";
+      sha256 = "05za6km6lgkc79rk6iksbvfbc62110j6dlvsas2ld67cisar5y38";
+      name = "kmix-20.12.3.tar.xz";
     };
   };
   kmousetool = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/kmousetool-20.12.2.tar.xz";
-      sha256 = "0ybrczxsmfrj43nr931ylbdgpqmcfx47ifbv2qjn72i8iggrv0cl";
-      name = "kmousetool-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/kmousetool-20.12.3.tar.xz";
+      sha256 = "0xsjwjm517j2pqc04fvam181yrhb6qsi4nyxzc9c7xwwqm1pw03a";
+      name = "kmousetool-20.12.3.tar.xz";
     };
   };
   kmouth = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/kmouth-20.12.2.tar.xz";
-      sha256 = "1vq41r1vhr5iaxlb5dzpq3vwqk1rn1zxw3k4j7g2xq5xxmibj944";
-      name = "kmouth-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/kmouth-20.12.3.tar.xz";
+      sha256 = "152xgpq8mlwpaq82cff0llwpkw2jylwbpwfbish7glqghryzrgwh";
+      name = "kmouth-20.12.3.tar.xz";
     };
   };
   kmplot = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/kmplot-20.12.2.tar.xz";
-      sha256 = "0l6j68zg9xdrgglw7gnji0spjf7pcggym90cccw67jdn2wxc8g6q";
-      name = "kmplot-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/kmplot-20.12.3.tar.xz";
+      sha256 = "1b70kfjp83dnslpb9732dsci3yq0iglr6ikbm6lsbf2qbxxshjl3";
+      name = "kmplot-20.12.3.tar.xz";
     };
   };
   knavalbattle = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/knavalbattle-20.12.2.tar.xz";
-      sha256 = "0x47rzs7afqygcy45crc10ix4dsivnpmxis9r0w4lpzbq3qzd585";
-      name = "knavalbattle-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/knavalbattle-20.12.3.tar.xz";
+      sha256 = "1a7rja1zb06aa9brjlsd0jx3vxn3gmdq1fg0gzmmfg77mdmb3l6g";
+      name = "knavalbattle-20.12.3.tar.xz";
     };
   };
   knetwalk = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/knetwalk-20.12.2.tar.xz";
-      sha256 = "11h7b5amm4bcng0h8hfcn1r1nkd82h0rl47wvnqczsgjqp2r9h6a";
-      name = "knetwalk-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/knetwalk-20.12.3.tar.xz";
+      sha256 = "1bnm1lfp0igav57ys5yqim2wky8xpkk52zy50k5l5p32sd7g2x59";
+      name = "knetwalk-20.12.3.tar.xz";
     };
   };
   knights = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/knights-20.12.2.tar.xz";
-      sha256 = "1p5w61x4ldb5sp77l1c0v7aczi62xpvf1084316byhb5cqmxsqm9";
-      name = "knights-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/knights-20.12.3.tar.xz";
+      sha256 = "0z85xw91fqgrhz8kl1gshqy6n4ah14b5z1ajr0m0x817xy2ifys9";
+      name = "knights-20.12.3.tar.xz";
     };
   };
   knotes = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/knotes-20.12.2.tar.xz";
-      sha256 = "11dvczl04lmzlhbmqp508bqrsrqqmmprp3nsvakmmidpgnvcm26l";
-      name = "knotes-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/knotes-20.12.3.tar.xz";
+      sha256 = "1n642jqwlg8nrmlm9xllbcdffwq3gy32pr6fp3k076x28kjg7mh6";
+      name = "knotes-20.12.3.tar.xz";
     };
   };
   kolf = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/kolf-20.12.2.tar.xz";
-      sha256 = "1jw22m7a2jdw9zmssiihwm35zpq7bg8zk0a68fh5nxbyv43q8fj5";
-      name = "kolf-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/kolf-20.12.3.tar.xz";
+      sha256 = "1xxmw85gxs96djanx5q0vzz0h5ilckyz644vvxqillng6f54skbp";
+      name = "kolf-20.12.3.tar.xz";
     };
   };
   kollision = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/kollision-20.12.2.tar.xz";
-      sha256 = "0g0mf9p1pz9wahc92k9iw1vb8v64y1kj7zgiyzmil6qr1pjyzlgm";
-      name = "kollision-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/kollision-20.12.3.tar.xz";
+      sha256 = "16bfbhb7dlfkwbald1vsbfffphpvzc3pglcjdc3wval8kqh9f7i0";
+      name = "kollision-20.12.3.tar.xz";
     };
   };
   kolourpaint = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/kolourpaint-20.12.2.tar.xz";
-      sha256 = "13pb09r9qrgwaii9x3a6qk3qgk288a821p4xgiwaiv9lcbjz56fn";
-      name = "kolourpaint-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/kolourpaint-20.12.3.tar.xz";
+      sha256 = "0gp9pnagajhzy2f4cmvimvwr3sfk87w6zjwi264nk0cgd41pi51g";
+      name = "kolourpaint-20.12.3.tar.xz";
     };
   };
   kompare = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/kompare-20.12.2.tar.xz";
-      sha256 = "18n5sw52kwwmbgyb2q5lizpa57by8gmx665bj68wi2hvzdihmxmv";
-      name = "kompare-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/kompare-20.12.3.tar.xz";
+      sha256 = "0zzvcxwr2vb48i8dj1r7m9841177zdci762f5ljk5wn8lbgysmvv";
+      name = "kompare-20.12.3.tar.xz";
     };
   };
   konqueror = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/konqueror-20.12.2.tar.xz";
-      sha256 = "0zvr71yz2053y341b12zw92v0yk5whgivcr0iyz488lfw9wq0n4d";
-      name = "konqueror-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/konqueror-20.12.3.tar.xz";
+      sha256 = "1y6jpq1v5yxdhanyll3kgg9m5p0ri66cvsbg3vhiay377s992927";
+      name = "konqueror-20.12.3.tar.xz";
     };
   };
   konquest = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/konquest-20.12.2.tar.xz";
-      sha256 = "0p4y7s37a3vchplpidlv4bc94gwnsm4k7sl4s2ra0prqga83yxbj";
-      name = "konquest-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/konquest-20.12.3.tar.xz";
+      sha256 = "11ygcif5z7nn8x599m4dk0a8kdriiqg177f7v05pf0fhd7x72968";
+      name = "konquest-20.12.3.tar.xz";
     };
   };
   konsole = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/konsole-20.12.2.tar.xz";
-      sha256 = "0wq8xbppg4fla8x669rvkz4mrpbpaplr0ysdvnc4djbwnzabs6zw";
-      name = "konsole-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/konsole-20.12.3.tar.xz";
+      sha256 = "138kvndy7xjjmac2wy2lsqi5pckba6nwbfgsdd91fbmfqkyl5k94";
+      name = "konsole-20.12.3.tar.xz";
     };
   };
   kontact = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/kontact-20.12.2.tar.xz";
-      sha256 = "05pvrbsbrz39znim2jrcslnji8n4imig8f717jv89nlmllp5sk2i";
-      name = "kontact-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/kontact-20.12.3.tar.xz";
+      sha256 = "0vysa621chslz8l0xhnxs8bymkgjwqg24bhp2kw5lllz4f46iidl";
+      name = "kontact-20.12.3.tar.xz";
     };
   };
   kontactinterface = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/kontactinterface-20.12.2.tar.xz";
-      sha256 = "0i3kxim4rc4mvqlq06g0a8h106gb93v4s0kymysd4a4yw3pq4fas";
-      name = "kontactinterface-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/kontactinterface-20.12.3.tar.xz";
+      sha256 = "1nqxk2x0bzndfv35g1l8yhafknyb0s68vrmcwf4kd15g5rf3k7rw";
+      name = "kontactinterface-20.12.3.tar.xz";
     };
   };
   kontrast = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/kontrast-20.12.2.tar.xz";
-      sha256 = "0cqqclyqm0z59n296jh6pnb2zdzligmvsd2icb1qzxn2r69inipa";
-      name = "kontrast-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/kontrast-20.12.3.tar.xz";
+      sha256 = "12q21d6fj29akvy6yk769pfwwhw24y13bhhbwrpnyv2ih96j9s8d";
+      name = "kontrast-20.12.3.tar.xz";
     };
   };
   konversation = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/konversation-20.12.2.tar.xz";
-      sha256 = "0m13qpvzxm5arawsqh2hygs266jv9915lhc3xhs0b1wbhjb3ii8l";
-      name = "konversation-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/konversation-20.12.3.tar.xz";
+      sha256 = "0cwnlihdidr5pxcbz4l68w1q6a9g3y1997gk7xqqnh4kz2fkc37q";
+      name = "konversation-20.12.3.tar.xz";
     };
   };
   kopete = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/kopete-20.12.2.tar.xz";
-      sha256 = "0ahcxkvi5ibdl3krm3aw5gamcyfi4s4af2wl6r3sk73l7q4kpxvi";
-      name = "kopete-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/kopete-20.12.3.tar.xz";
+      sha256 = "0jl498q59dfwkazf7iqzlvia9jr6hhmkhy0hprbvww4av2si7x6w";
+      name = "kopete-20.12.3.tar.xz";
     };
   };
   korganizer = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/korganizer-20.12.2.tar.xz";
-      sha256 = "1f2j60gdx3hxz64lhx9cyi7sa75s2qr8zghhk8h1wgdwaz9hvjz8";
-      name = "korganizer-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/korganizer-20.12.3.tar.xz";
+      sha256 = "16mz7rmh65xljlf1jq719nkihr23wh840lf5cxzcx3vpk4gcc87w";
+      name = "korganizer-20.12.3.tar.xz";
     };
   };
   kosmindoormap = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/kosmindoormap-20.12.2.tar.xz";
-      sha256 = "0rr6lgfbjdvnxipx0dnzp4hlrvq61ha015mz7qkly88ckwp6m05q";
-      name = "kosmindoormap-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/kosmindoormap-20.12.3.tar.xz";
+      sha256 = "02dgnwand9sbas4v4c12xn8szgc3a7crmh8dd4q7rpcrzm2x1m9k";
+      name = "kosmindoormap-20.12.3.tar.xz";
     };
   };
   kpat = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/kpat-20.12.2.tar.xz";
-      sha256 = "1gcv343aabwcgx3kb9khkvilnxipq200pz14d8qdj41lsa71cynx";
-      name = "kpat-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/kpat-20.12.3.tar.xz";
+      sha256 = "1v1lzvl0xb5h4vma78ln400a81wilx16m987aijxg4c8gq4h5n11";
+      name = "kpat-20.12.3.tar.xz";
     };
   };
   kpimtextedit = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/kpimtextedit-20.12.2.tar.xz";
-      sha256 = "1ccvzwbxbsbb4b5hfjvf30fv44b1byjzb08x4vagbrqb47ck763y";
-      name = "kpimtextedit-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/kpimtextedit-20.12.3.tar.xz";
+      sha256 = "07lkc5zgsgvjz9544ckp17sii5bm06fynb0s046rks6z8fcncxrk";
+      name = "kpimtextedit-20.12.3.tar.xz";
     };
   };
   kpkpass = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/kpkpass-20.12.2.tar.xz";
-      sha256 = "1m0cqlrpjmfam0lyjjzpd8wgsv9v0x6fr76qr5ndyrfbfcv0qin3";
-      name = "kpkpass-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/kpkpass-20.12.3.tar.xz";
+      sha256 = "0lcgalcyfd5ggznwifwvvybj6z080gx12y4gx4mdh7jjjx0j4ng9";
+      name = "kpkpass-20.12.3.tar.xz";
     };
   };
   kpmcore = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/kpmcore-20.12.2.tar.xz";
-      sha256 = "1z8fln51jsgar69m2x8rb95zxbq6r28cycpa7y52gaiywahbsin4";
-      name = "kpmcore-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/kpmcore-20.12.3.tar.xz";
+      sha256 = "02jaz24wvw4jqi0k41067wwwy5yi6z80a1ah36ypxawzah9y94ik";
+      name = "kpmcore-20.12.3.tar.xz";
     };
   };
   kpublictransport = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/kpublictransport-20.12.2.tar.xz";
-      sha256 = "1n7gy9pnykxd39ralfxrrvbsgxn68f1jzvbmkyvj759xrl2na1kq";
-      name = "kpublictransport-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/kpublictransport-20.12.3.tar.xz";
+      sha256 = "15y6h44wdl78rfs40b71ijmvs2qb2ylnq72r8v6rn3fdnfhx2l4r";
+      name = "kpublictransport-20.12.3.tar.xz";
     };
   };
   kqtquickcharts = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/kqtquickcharts-20.12.2.tar.xz";
-      sha256 = "06lrvckmddyxl11kyic99dhfn8il88hs1vsnr89y3m8543ij885n";
-      name = "kqtquickcharts-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/kqtquickcharts-20.12.3.tar.xz";
+      sha256 = "1icc28acp7n8f5hiiq9rvmyv21f1ayghcr8d97lwm29aagsblx5j";
+      name = "kqtquickcharts-20.12.3.tar.xz";
     };
   };
   krdc = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/krdc-20.12.2.tar.xz";
-      sha256 = "0wzv25pdalwgcb74dav4jkxpvak0nix46njn04w2vhy3rdlgplzr";
-      name = "krdc-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/krdc-20.12.3.tar.xz";
+      sha256 = "0s7wp11zcgp5z1drywm636wx5lkbalym4xxpmrb28xbdcgy9wgi2";
+      name = "krdc-20.12.3.tar.xz";
     };
   };
   kreversi = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/kreversi-20.12.2.tar.xz";
-      sha256 = "1c0xisbbq6p6ghl5rvhiddpgsa91m4bq8hmrpdw8s02j4g8aix39";
-      name = "kreversi-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/kreversi-20.12.3.tar.xz";
+      sha256 = "0v6nhrzxd7pwc7wyj1wv7spbc437vb14pwdd731w8s02223kkkzf";
+      name = "kreversi-20.12.3.tar.xz";
     };
   };
   krfb = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/krfb-20.12.2.tar.xz";
-      sha256 = "0js84sc9s8h7b1zkdg2k83qhh2q3dz5yfk17am480b3889pyjyd8";
-      name = "krfb-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/krfb-20.12.3.tar.xz";
+      sha256 = "0675smz307zwb4sdnhdlcgi7v38pxj0frr4c3cbhcpcmkjnbayc4";
+      name = "krfb-20.12.3.tar.xz";
     };
   };
   kross-interpreters = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/kross-interpreters-20.12.2.tar.xz";
-      sha256 = "04g8fqcr88k7b8sivkqasj8d5fywhmm69g4spv1rpm4m89gr70jn";
-      name = "kross-interpreters-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/kross-interpreters-20.12.3.tar.xz";
+      sha256 = "1rq3gl0mndx3qhd0zk532z4m95zb4gwgahx208n6l5xh4rwgn7ck";
+      name = "kross-interpreters-20.12.3.tar.xz";
     };
   };
   kruler = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/kruler-20.12.2.tar.xz";
-      sha256 = "0xayhfav4723m5z5bgv4zxa95zvsfgvfh0wf80y8c7wwfgsyn9ja";
-      name = "kruler-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/kruler-20.12.3.tar.xz";
+      sha256 = "1nvghf3gdn06nkk070zfbjmmh4z1anxxj15mwmdk3xriiwwm4w9z";
+      name = "kruler-20.12.3.tar.xz";
     };
   };
   kshisen = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/kshisen-20.12.2.tar.xz";
-      sha256 = "079sr9k8zg01imy2c54wx371fcxlzsm122ng0zl4cn69dndczjkf";
-      name = "kshisen-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/kshisen-20.12.3.tar.xz";
+      sha256 = "19grx2zs26il2jplff4nb5sakvbkgsf9a91269gfjzsxzijf166q";
+      name = "kshisen-20.12.3.tar.xz";
     };
   };
   ksirk = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/ksirk-20.12.2.tar.xz";
-      sha256 = "10ksb77ljwfm25m8jrxh4cbss0lrjdmiigjbmyppxcls1rz8a6cn";
-      name = "ksirk-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/ksirk-20.12.3.tar.xz";
+      sha256 = "1rq4r5d1mhdkpfxv71s6pyaac8yaf03z4ayfhjh1azf3zvv9i8a5";
+      name = "ksirk-20.12.3.tar.xz";
     };
   };
   ksmtp = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/ksmtp-20.12.2.tar.xz";
-      sha256 = "0rcs5zcrj8sscr0h0vx4ndbj3ziyxns5glk5bzpj1092b11pwllw";
-      name = "ksmtp-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/ksmtp-20.12.3.tar.xz";
+      sha256 = "0qmriih43q1lp4bq68hzlnwzab0vcjyjddyhs44gv9r83icw6rw6";
+      name = "ksmtp-20.12.3.tar.xz";
     };
   };
   ksnakeduel = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/ksnakeduel-20.12.2.tar.xz";
-      sha256 = "1cd1nldrmhimc1f059hqjkb8g8yjri7gf9cyxz7j0p48dxg93ns4";
-      name = "ksnakeduel-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/ksnakeduel-20.12.3.tar.xz";
+      sha256 = "132pdhfi9jy55y0ys785pz5xjw9f6fxx061ppvfy11giz9cbphsc";
+      name = "ksnakeduel-20.12.3.tar.xz";
     };
   };
   kspaceduel = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/kspaceduel-20.12.2.tar.xz";
-      sha256 = "0mz3s5q8fyl76ck8b9s65w2q90a5cz2p4clnbxam8f72fk2g0g1v";
-      name = "kspaceduel-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/kspaceduel-20.12.3.tar.xz";
+      sha256 = "0ff1dpj01szzgg6yb774lzpimlf7japkv4ns0xb3a6vp5ghfayxw";
+      name = "kspaceduel-20.12.3.tar.xz";
     };
   };
   ksquares = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/ksquares-20.12.2.tar.xz";
-      sha256 = "11mfyyjrdlh8dzpzwvyr48rfg758hr14sb0cw1zvd7d7cz86dr31";
-      name = "ksquares-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/ksquares-20.12.3.tar.xz";
+      sha256 = "0qp2j4abjjvazcqv9zyclvb425587dcwrsnlfrv7ami64ndr7xkb";
+      name = "ksquares-20.12.3.tar.xz";
     };
   };
   ksudoku = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/ksudoku-20.12.2.tar.xz";
-      sha256 = "01i4niy1nlikbw1j7qlwldcaniwb1pl4hr4p6icgsvfzr8pjl09z";
-      name = "ksudoku-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/ksudoku-20.12.3.tar.xz";
+      sha256 = "0ykippr4d9s7mkmnqpbb3wa2l9cbhrmhvqaargm0553iqnwh6w4r";
+      name = "ksudoku-20.12.3.tar.xz";
     };
   };
   ksystemlog = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/ksystemlog-20.12.2.tar.xz";
-      sha256 = "1fyrpkk5ipp5q8sairmyx9bayndbbr9srrwdhp7grhbiw8kbjlc7";
-      name = "ksystemlog-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/ksystemlog-20.12.3.tar.xz";
+      sha256 = "1szh1iqriynpsbcrilia46vpsj52ifk8q0paib79byf9wals4gqy";
+      name = "ksystemlog-20.12.3.tar.xz";
     };
   };
   kteatime = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/kteatime-20.12.2.tar.xz";
-      sha256 = "18rpnvagrcmd62qss31rkv81kkjcz9kcisj9q0j41p770jvan8id";
-      name = "kteatime-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/kteatime-20.12.3.tar.xz";
+      sha256 = "1y9cc8xjfn3pqmqh34lrnq2slj8y09k3njwkxkxzk20ni676j5ph";
+      name = "kteatime-20.12.3.tar.xz";
     };
   };
   ktimer = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/ktimer-20.12.2.tar.xz";
-      sha256 = "17sw7wl9844sg180h0x2skaj4bnkv6qin6cwklsp058wyf06w5wy";
-      name = "ktimer-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/ktimer-20.12.3.tar.xz";
+      sha256 = "1yypwzrqkl09hbc8d24m51pjz8lzj80xi6f86xb0jazdl7d83flw";
+      name = "ktimer-20.12.3.tar.xz";
     };
   };
   ktnef = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/ktnef-20.12.2.tar.xz";
-      sha256 = "147dxalzgqfmacr0f44pbxg0ks5p7ck607gkbzf5asxgn4dlvgxq";
-      name = "ktnef-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/ktnef-20.12.3.tar.xz";
+      sha256 = "0wvqi09kz49m9lbxnk8070ikp4syhrxb90dgyiz1vax12baz7mvq";
+      name = "ktnef-20.12.3.tar.xz";
     };
   };
   ktorrent = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/ktorrent-20.12.2.tar.xz";
-      sha256 = "1fvbg3700my5algzif4dyy7zsc74qrby7ldfbj7snlxa4scws042";
-      name = "ktorrent-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/ktorrent-20.12.3.tar.xz";
+      sha256 = "12gj8bmbgvplc6r8ic104q18hq4dwiajhj0dwm1yjwmnslzdplr8";
+      name = "ktorrent-20.12.3.tar.xz";
     };
   };
   ktouch = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/ktouch-20.12.2.tar.xz";
-      sha256 = "0j3xzm5ghnfvqb98xwrjzkrdm991af8rgnay38s081ykvj2hxj3n";
-      name = "ktouch-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/ktouch-20.12.3.tar.xz";
+      sha256 = "1yv81mfavbvvlzc41ydfs1yjynza12n1cj8w36dgbgm6dwcldwfw";
+      name = "ktouch-20.12.3.tar.xz";
     };
   };
   ktp-accounts-kcm = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/ktp-accounts-kcm-20.12.2.tar.xz";
-      sha256 = "0dyr3600yrd2hjs2s54210h1kj95w5mz9pl2fpwzcqgkmmd9vss5";
-      name = "ktp-accounts-kcm-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/ktp-accounts-kcm-20.12.3.tar.xz";
+      sha256 = "0jj6cspzmbn1fnkq5dfc7vzylbsq8vglcgwx4a2x8j5g7s8vm9y2";
+      name = "ktp-accounts-kcm-20.12.3.tar.xz";
     };
   };
   ktp-approver = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/ktp-approver-20.12.2.tar.xz";
-      sha256 = "1h3fi19qqmik6f7h12manb8yval0qqj7jdhrpp07ck67m7mibwzr";
-      name = "ktp-approver-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/ktp-approver-20.12.3.tar.xz";
+      sha256 = "1brzpm50d4nqkva34h9va15xm4l7g0hvq1b610qnn9mvhikrzy43";
+      name = "ktp-approver-20.12.3.tar.xz";
     };
   };
   ktp-auth-handler = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/ktp-auth-handler-20.12.2.tar.xz";
-      sha256 = "158n88pcxj7hdmsmhcqbfpqc4lhrpzighxgb4wdrzizi9dwpxb3h";
-      name = "ktp-auth-handler-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/ktp-auth-handler-20.12.3.tar.xz";
+      sha256 = "1i8jcxl828kany2668aid5vmhrla5rv6frb36xy7wdxv6y2q2gcc";
+      name = "ktp-auth-handler-20.12.3.tar.xz";
     };
   };
   ktp-call-ui = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/ktp-call-ui-20.12.2.tar.xz";
-      sha256 = "0xhf79gqr6b8hiscv6jnmjnl8nb7c6vsvxn7hzvri9nm7hfmldya";
-      name = "ktp-call-ui-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/ktp-call-ui-20.12.3.tar.xz";
+      sha256 = "079jlq7zs3zb37bnb48q68rcfjg3b263qplgcpgs1f77k9g449ql";
+      name = "ktp-call-ui-20.12.3.tar.xz";
     };
   };
   ktp-common-internals = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/ktp-common-internals-20.12.2.tar.xz";
-      sha256 = "06m8g80lj2cnx5cnfi6m1fy6pg6rm78kxg7v1493xcsfzizlc276";
-      name = "ktp-common-internals-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/ktp-common-internals-20.12.3.tar.xz";
+      sha256 = "0c9hcyfsjhd2ydm5ldgxh9j5wbckavn4nj2n8l4zkyxk7knxf5w4";
+      name = "ktp-common-internals-20.12.3.tar.xz";
     };
   };
   ktp-contact-list = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/ktp-contact-list-20.12.2.tar.xz";
-      sha256 = "037si47l8nc18d7yzh6d7i3gy710y5npxv4wcal6yg8mlr2qzjli";
-      name = "ktp-contact-list-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/ktp-contact-list-20.12.3.tar.xz";
+      sha256 = "03gqm2pjf2i6f0gvifd7bqclkfjbpabnlavadxf71qlnf7fki3rf";
+      name = "ktp-contact-list-20.12.3.tar.xz";
     };
   };
   ktp-contact-runner = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/ktp-contact-runner-20.12.2.tar.xz";
-      sha256 = "1pv7smf5mld5rgld2nsqjwgl7vwsf99f3z4hamlbq6bpdg02w936";
-      name = "ktp-contact-runner-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/ktp-contact-runner-20.12.3.tar.xz";
+      sha256 = "047bzbb02y17yq973bzxf1h1c41f25njrsxc5qa7igvwwcid7hbc";
+      name = "ktp-contact-runner-20.12.3.tar.xz";
     };
   };
   ktp-desktop-applets = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/ktp-desktop-applets-20.12.2.tar.xz";
-      sha256 = "1mx1q1gk756pkbpwghsvkspj3npgfzp2lf4jqldkyygvyqn3gxx4";
-      name = "ktp-desktop-applets-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/ktp-desktop-applets-20.12.3.tar.xz";
+      sha256 = "1m4nizagb7i45ys8k60kw1m5jfflxy1iy3qp1i17d0fy4xk81i6h";
+      name = "ktp-desktop-applets-20.12.3.tar.xz";
     };
   };
   ktp-filetransfer-handler = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/ktp-filetransfer-handler-20.12.2.tar.xz";
-      sha256 = "16ys5cyx1pzcv0affy8agp0sbci9rkvpknfffldrvlgqppxza5rd";
-      name = "ktp-filetransfer-handler-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/ktp-filetransfer-handler-20.12.3.tar.xz";
+      sha256 = "0wq9n5q8xgv70ikxavmmq7jnj24w9m3k7xaxl8qs7aas14jlcg29";
+      name = "ktp-filetransfer-handler-20.12.3.tar.xz";
     };
   };
   ktp-kded-module = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/ktp-kded-module-20.12.2.tar.xz";
-      sha256 = "1wkvi5l9fvq24c3vdflg0azjxykid61i6mi59cnrnr866a1rbgrg";
-      name = "ktp-kded-module-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/ktp-kded-module-20.12.3.tar.xz";
+      sha256 = "0j28hdikn5713ngl3hf1gjr7syzba92irffhfrj6ia582gm7j2nz";
+      name = "ktp-kded-module-20.12.3.tar.xz";
     };
   };
   ktp-send-file = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/ktp-send-file-20.12.2.tar.xz";
-      sha256 = "0j32c81rabbxh3m0jnnahny01qz2h7yc7l90w39r2jkv9r5f3yvf";
-      name = "ktp-send-file-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/ktp-send-file-20.12.3.tar.xz";
+      sha256 = "0lmyxvq49ibbvgg69cy1iayfgd4g777xbqdgzx0jgvvmd6ryrrqq";
+      name = "ktp-send-file-20.12.3.tar.xz";
     };
   };
   ktp-text-ui = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/ktp-text-ui-20.12.2.tar.xz";
-      sha256 = "09wkpyadf3dvnrbxrasr66yw4hqnb3kbk6va9bs836fvcaiwagwd";
-      name = "ktp-text-ui-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/ktp-text-ui-20.12.3.tar.xz";
+      sha256 = "0gqgqjv0wamzcfzicvgc8n3jl4xizpzdjsq92bsbg1yk51ihn6iq";
+      name = "ktp-text-ui-20.12.3.tar.xz";
     };
   };
   ktuberling = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/ktuberling-20.12.2.tar.xz";
-      sha256 = "0yndqhgw9s2hydfsz2x3lr1m22ii2whc4kcp2jbkj9ssiymp8s68";
-      name = "ktuberling-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/ktuberling-20.12.3.tar.xz";
+      sha256 = "0d4z9kk0vdljaf6damyjxnplmg6s1g6caw1ffd1dnyxhkszlka86";
+      name = "ktuberling-20.12.3.tar.xz";
     };
   };
   kturtle = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/kturtle-20.12.2.tar.xz";
-      sha256 = "1a46c6j7jng9l789wdpp7qj639872dfj268hj8nq63n27f82whr0";
-      name = "kturtle-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/kturtle-20.12.3.tar.xz";
+      sha256 = "17mqi9kb57bva2rzqnmkiilr114zqqlh5f6sn9c13x7s8npdpgp6";
+      name = "kturtle-20.12.3.tar.xz";
     };
   };
   kubrick = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/kubrick-20.12.2.tar.xz";
-      sha256 = "0g3zxdbj5l28msvs8gpn15g739pwwids7wxmky6w3b4qyn427j8m";
-      name = "kubrick-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/kubrick-20.12.3.tar.xz";
+      sha256 = "0a581gajl9k3864q3y99kcxqfh8adbwpyrc1rakgzwbwd342wgrj";
+      name = "kubrick-20.12.3.tar.xz";
     };
   };
   kwalletmanager = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/kwalletmanager-20.12.2.tar.xz";
-      sha256 = "02lx3p7860pigslx6s3bjg54sjjv1q93f9aknv5d32iblv2gaxiw";
-      name = "kwalletmanager-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/kwalletmanager-20.12.3.tar.xz";
+      sha256 = "16lx0nblxlzmlydblysrbf92dxf0biqxrzwvy7nhsnkk2yh18m4r";
+      name = "kwalletmanager-20.12.3.tar.xz";
     };
   };
   kwave = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/kwave-20.12.2.tar.xz";
-      sha256 = "0nankggamy1jxllnsv642kav57kwkbxpkd2mz6rarjinfnnqi7kd";
-      name = "kwave-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/kwave-20.12.3.tar.xz";
+      sha256 = "1bd193wszlzra1xg6ahijmswmpkm8ra05pzbk6zvc67j71kzdmzs";
+      name = "kwave-20.12.3.tar.xz";
     };
   };
   kwordquiz = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/kwordquiz-20.12.2.tar.xz";
-      sha256 = "1iik5khnsarxjipmd8znbiqs20bd65hanhmdmp7awqs7p0k4a0sq";
-      name = "kwordquiz-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/kwordquiz-20.12.3.tar.xz";
+      sha256 = "0vqkj7zmp8v0iydll8gn7ybwha19sxpqd608wj6c7clwcr0y39yp";
+      name = "kwordquiz-20.12.3.tar.xz";
     };
   };
   libgravatar = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/libgravatar-20.12.2.tar.xz";
-      sha256 = "07pnj708wrvfmmy7j2vsx9j1sl9wx3hd7vfnpqa4zd24ci7x7y3d";
-      name = "libgravatar-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/libgravatar-20.12.3.tar.xz";
+      sha256 = "130wk6v40rz0rsc1z8yyl5zf4s6rbhlwgqdjijp1k6xnsp7xm8n4";
+      name = "libgravatar-20.12.3.tar.xz";
     };
   };
   libkcddb = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/libkcddb-20.12.2.tar.xz";
-      sha256 = "1px7cgc75ypxaqknamqgxps4796388j99ycrbgrlyrhzws1mva8k";
-      name = "libkcddb-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/libkcddb-20.12.3.tar.xz";
+      sha256 = "0m7fj11lp6i7fal0ckbpshyp5rw1pn3vxirnrg8ydp8ggs22jqi0";
+      name = "libkcddb-20.12.3.tar.xz";
     };
   };
   libkcompactdisc = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/libkcompactdisc-20.12.2.tar.xz";
-      sha256 = "0yj2gkl1d76mf2lp02apxh4lmb9rnzvp0c8y0992ssnfsrivalp4";
-      name = "libkcompactdisc-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/libkcompactdisc-20.12.3.tar.xz";
+      sha256 = "192la7rlknjwlqw69yyqxcg2yar7p8fklykah5i3l5r6rcvx2h1w";
+      name = "libkcompactdisc-20.12.3.tar.xz";
     };
   };
   libkdcraw = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/libkdcraw-20.12.2.tar.xz";
-      sha256 = "1hgw087frq9yzzwp2mkl3xqz2gd4v82kyiym2316i1xpmbkgcqfm";
-      name = "libkdcraw-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/libkdcraw-20.12.3.tar.xz";
+      sha256 = "1vwdr04z31aq37mx83vbgimkrpxq67dmlb68sl1wyivmllp084jg";
+      name = "libkdcraw-20.12.3.tar.xz";
     };
   };
   libkdegames = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/libkdegames-20.12.2.tar.xz";
-      sha256 = "0fcl06z5zl1hycj8f8q9dz6fc9lb0dqd5ciha4yig98ybzi3zn8r";
-      name = "libkdegames-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/libkdegames-20.12.3.tar.xz";
+      sha256 = "1l8nwbjkgsnqxqjc94wqq6phyxdj9n8y075bzv45xagf82b926s0";
+      name = "libkdegames-20.12.3.tar.xz";
     };
   };
   libkdepim = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/libkdepim-20.12.2.tar.xz";
-      sha256 = "0f9c96w7ijlvfg9dr0w9wwaf05fn0z32zx8nn8jp42pzcbn6yr56";
-      name = "libkdepim-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/libkdepim-20.12.3.tar.xz";
+      sha256 = "1armxkai841ki9hgfwb4q53c8rlp55zgz1416dhrr97jrn03ckfa";
+      name = "libkdepim-20.12.3.tar.xz";
     };
   };
   libkeduvocdocument = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/libkeduvocdocument-20.12.2.tar.xz";
-      sha256 = "0lki60mv82ygss2bxgwg178xabvfn85zlg0pwk2gj30zg0jiaw66";
-      name = "libkeduvocdocument-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/libkeduvocdocument-20.12.3.tar.xz";
+      sha256 = "1x5w40avw73kjryiss71x10635l012jv5criaqlwyn3jfaf2idg0";
+      name = "libkeduvocdocument-20.12.3.tar.xz";
     };
   };
   libkexiv2 = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/libkexiv2-20.12.2.tar.xz";
-      sha256 = "10j82xk7y7vf9y9ss83hc9fd9c1dbd55nwjf28bj7myqaji4wdpb";
-      name = "libkexiv2-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/libkexiv2-20.12.3.tar.xz";
+      sha256 = "1r11j2j0ymxg4dbhrznyr34cwdqcgh124lk9fmhdpjgq2q276qmp";
+      name = "libkexiv2-20.12.3.tar.xz";
     };
   };
   libkgapi = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/libkgapi-20.12.2.tar.xz";
-      sha256 = "1yaas07ixxjnb5a37dq93skqs0vk08rdr9ll30jr7kdll311s5ni";
-      name = "libkgapi-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/libkgapi-20.12.3.tar.xz";
+      sha256 = "0h9rcn03jgw3rxxm3ylh1ap7ryswzm78hpfi6x9gdsfiqc8q8rpx";
+      name = "libkgapi-20.12.3.tar.xz";
     };
   };
   libkipi = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/libkipi-20.12.2.tar.xz";
-      sha256 = "1axjvkrmjszxyh0fdm9k25g4gpzmn4hsw222k2qj3smvnhdj37zk";
-      name = "libkipi-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/libkipi-20.12.3.tar.xz";
+      sha256 = "1a0lpp3qkirsv8r6hpmndkn2f895jad5x7xlnxyf2x1s9qhzyvxv";
+      name = "libkipi-20.12.3.tar.xz";
     };
   };
   libkleo = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/libkleo-20.12.2.tar.xz";
-      sha256 = "0xsljfiqqggdp31c7irjn6lgacdds5kb7sr3khg24bsgip9488k1";
-      name = "libkleo-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/libkleo-20.12.3.tar.xz";
+      sha256 = "034m92af08g5769kr9xs91mgkl3ribcafsmm96isjbngj9acqjcr";
+      name = "libkleo-20.12.3.tar.xz";
     };
   };
   libkmahjongg = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/libkmahjongg-20.12.2.tar.xz";
-      sha256 = "1yl2smx0ybr164pl8nv5a7jibq3pmpf0v4ijvardp53j51bs2c2q";
-      name = "libkmahjongg-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/libkmahjongg-20.12.3.tar.xz";
+      sha256 = "16wb744gbi4rgz9k9zr4dm7ilhjhjyaszawjmm626p4k145rcg4v";
+      name = "libkmahjongg-20.12.3.tar.xz";
     };
   };
   libkomparediff2 = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/libkomparediff2-20.12.2.tar.xz";
-      sha256 = "03fn3l1qhzivck7jzfp7fwpgix701paj03rzvc46rs4f1bfmb1d9";
-      name = "libkomparediff2-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/libkomparediff2-20.12.3.tar.xz";
+      sha256 = "0py3k5mn9kf82qcy89r1lkrhn702dgrjbgcd9ddslqfpiw8cb1l3";
+      name = "libkomparediff2-20.12.3.tar.xz";
     };
   };
   libksane = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/libksane-20.12.2.tar.xz";
-      sha256 = "1bhwfsyfd2z4hagfggz3ckxbyqrifcbwyn79h59qpng7nkzsgw4b";
-      name = "libksane-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/libksane-20.12.3.tar.xz";
+      sha256 = "02sbizfw2a819l5f7di3k7x7cc4n19pipv68dfhsrh1hk6c5iia6";
+      name = "libksane-20.12.3.tar.xz";
     };
   };
   libksieve = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/libksieve-20.12.2.tar.xz";
-      sha256 = "0rjchcpc4sx53siv3b9hq6s12qh96rrb4xmnk3gjhsvqq9gmyq3j";
-      name = "libksieve-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/libksieve-20.12.3.tar.xz";
+      sha256 = "0j149jszdslnyia09fn6xsbkxa2p0xmxz05pf3byxl9albxq17q0";
+      name = "libksieve-20.12.3.tar.xz";
     };
   };
   libktorrent = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/libktorrent-20.12.2.tar.xz";
-      sha256 = "15ywv00vklvqw7x6id4vycf4rmi4j3s6z70c68h1b6v8n9j3rz3b";
-      name = "libktorrent-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/libktorrent-20.12.3.tar.xz";
+      sha256 = "1ykyfvr7w3h058gls7pnh9qwc6b4v9lp85s10qdbbsaiyly0h7n3";
+      name = "libktorrent-20.12.3.tar.xz";
     };
   };
   lokalize = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/lokalize-20.12.2.tar.xz";
-      sha256 = "1ms7x5aw5z63q2xy6f3x8dl1k39yjqbabzh8qznaqs172bwmwzz7";
-      name = "lokalize-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/lokalize-20.12.3.tar.xz";
+      sha256 = "1a1dzg6qwd3dxcvln7nkpc5r6v6agqnzja6s09w9jb0gflrql372";
+      name = "lokalize-20.12.3.tar.xz";
     };
   };
   lskat = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/lskat-20.12.2.tar.xz";
-      sha256 = "087zrwy5pabyy7zpkplxn9is2msr9kpa8r7bpc6kxylx85sd4nsr";
-      name = "lskat-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/lskat-20.12.3.tar.xz";
+      sha256 = "1fmyskr5i08gfjaghih2gihj6sgm8v5mn0m4wjmr9plg1vi6flcv";
+      name = "lskat-20.12.3.tar.xz";
     };
   };
   mailcommon = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/mailcommon-20.12.2.tar.xz";
-      sha256 = "0qbbr5m5glcp7rh3aljkrfs27ypdcb5b72q602irivhbgv56c6v5";
-      name = "mailcommon-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/mailcommon-20.12.3.tar.xz";
+      sha256 = "0z0ppv6yi5n54hi6x5s5nagciqpdbxyl0z5sa3whl7d6ikga0s4m";
+      name = "mailcommon-20.12.3.tar.xz";
     };
   };
   mailimporter = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/mailimporter-20.12.2.tar.xz";
-      sha256 = "16alrfyvgwih9i7fzvmfhbmlsp0l942qml43w2rwkg974g8188yv";
-      name = "mailimporter-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/mailimporter-20.12.3.tar.xz";
+      sha256 = "1lkkvriq69v0lpmk38my8k0vnw2yq182g6139i5r7krcyvrz4ynn";
+      name = "mailimporter-20.12.3.tar.xz";
     };
   };
   marble = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/marble-20.12.2.tar.xz";
-      sha256 = "0kgiwsx58yhng92v5c90bz02vsn70p6y7gf6qr5fvljbldrxq3a2";
-      name = "marble-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/marble-20.12.3.tar.xz";
+      sha256 = "1hkvp97mjg6gqs0b39j2rpgwwi70vzwhm4szmcjc2083vllv3cap";
+      name = "marble-20.12.3.tar.xz";
     };
   };
   markdownpart = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/markdownpart-20.12.2.tar.xz";
-      sha256 = "08fifhw40q2xhi3lp76a3b7jgipq3v1gvp1f5id83jvv9bg5m85k";
-      name = "markdownpart-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/markdownpart-20.12.3.tar.xz";
+      sha256 = "1g3r07fj4azpjbp6p6brcnd5dv7hi34w6z6a8bsg8cckmvhrirbl";
+      name = "markdownpart-20.12.3.tar.xz";
     };
   };
   mbox-importer = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/mbox-importer-20.12.2.tar.xz";
-      sha256 = "1jiapp7pblanra83p720nj1rzqd566ij28za9jrkn3nj3xv2zm62";
-      name = "mbox-importer-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/mbox-importer-20.12.3.tar.xz";
+      sha256 = "0rjk9blsbgjpd6l6ghrlzj04llaibjs8ngcfddxgixg8dxvsp0k9";
+      name = "mbox-importer-20.12.3.tar.xz";
     };
   };
   messagelib = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/messagelib-20.12.2.tar.xz";
-      sha256 = "07mzwsn0bmfsrsn6wlmz7kwrix4d33b007jvx37nckmarr6xcx54";
-      name = "messagelib-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/messagelib-20.12.3.tar.xz";
+      sha256 = "08rcw7y69xkrv0pwfz44hrbzkx9li2nabfjpgc9sc6i8klikgbis";
+      name = "messagelib-20.12.3.tar.xz";
     };
   };
   minuet = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/minuet-20.12.2.tar.xz";
-      sha256 = "00d08qwfa4pvlcysp1af3n91bwb8idkl6gjwxrin3kliwns0ivfj";
-      name = "minuet-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/minuet-20.12.3.tar.xz";
+      sha256 = "0jidbfqsnk3dyd5f459p2jsyxs2jjpx3j356sg6c3hbs4imz5nm6";
+      name = "minuet-20.12.3.tar.xz";
     };
   };
   okular = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/okular-20.12.2.tar.xz";
-      sha256 = "1959flll9rrwsgb3gpifvsciyvl70j46xb0acfx9zrvsddvbpabq";
-      name = "okular-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/okular-20.12.3.tar.xz";
+      sha256 = "1p3kdc0awgpihf10m3fxypq5hqr5vvwbcm8w3h39rk1m5g6hymxf";
+      name = "okular-20.12.3.tar.xz";
     };
   };
   palapeli = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/palapeli-20.12.2.tar.xz";
-      sha256 = "1z80892gp6hg75vl6aicfvf5013412b5xglrpsp86lbx2r7d6ikw";
-      name = "palapeli-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/palapeli-20.12.3.tar.xz";
+      sha256 = "14hqifg18ngqsafp1k78wi2k7jpxglvcjdw55f0fi0iqjnsrk6xa";
+      name = "palapeli-20.12.3.tar.xz";
     };
   };
   parley = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/parley-20.12.2.tar.xz";
-      sha256 = "16lymvvwglzvrfl74p7w9l2vahhrkm58fn6iicn5w1751bavjiq7";
-      name = "parley-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/parley-20.12.3.tar.xz";
+      sha256 = "0j4bbqlh0rix0wkfwp0jsf07akbysxnasbr1f2zwj75487mcwajn";
+      name = "parley-20.12.3.tar.xz";
     };
   };
   partitionmanager = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/partitionmanager-20.12.2.tar.xz";
-      sha256 = "1f0nmz99fhp6c48sg92fwssxdvmwx2bj4l7phb0gqfnfqk4sw1xd";
-      name = "partitionmanager-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/partitionmanager-20.12.3.tar.xz";
+      sha256 = "06kk64gynlxf7njdgaklrx8b4jlbqpk6bbx0nk4lzbyw191dfr0m";
+      name = "partitionmanager-20.12.3.tar.xz";
     };
   };
   picmi = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/picmi-20.12.2.tar.xz";
-      sha256 = "024afpylfb6n6dd0g1iif257a0mgzmmmjl24h2riz4cyfvd26mkc";
-      name = "picmi-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/picmi-20.12.3.tar.xz";
+      sha256 = "1xwkdrs6wmhhz6vrs17d7vj6sdlwl60mh8cb7yxx03pw5g6gkdd2";
+      name = "picmi-20.12.3.tar.xz";
     };
   };
   pimcommon = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/pimcommon-20.12.2.tar.xz";
-      sha256 = "0fbmahp9m1jzi626rggmp09j3338z8f86hszvwfnk7ydn16hy5rs";
-      name = "pimcommon-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/pimcommon-20.12.3.tar.xz";
+      sha256 = "18gy521g0i806bjjdkszgajac733inrakhkdw1fslhcg2b90m6hb";
+      name = "pimcommon-20.12.3.tar.xz";
     };
   };
   pim-data-exporter = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/pim-data-exporter-20.12.2.tar.xz";
-      sha256 = "13z8r2rq1453zprvpjnf5y5v3x1828l8gyvbivf0dmfhb3hi1bih";
-      name = "pim-data-exporter-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/pim-data-exporter-20.12.3.tar.xz";
+      sha256 = "17zc56420ndqfk8aw1mn1vwf34icgf03bbvvvg4s3m6cibnj0x4q";
+      name = "pim-data-exporter-20.12.3.tar.xz";
     };
   };
   pim-sieve-editor = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/pim-sieve-editor-20.12.2.tar.xz";
-      sha256 = "11ji1033yq4lwpi2b331i4f5kpak66h6zyviv344wyab05ljkyhd";
-      name = "pim-sieve-editor-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/pim-sieve-editor-20.12.3.tar.xz";
+      sha256 = "1d1z4i3g5n6rfs48phb700a68na75yg7cr4f3q2wzlnyyvpd1m51";
+      name = "pim-sieve-editor-20.12.3.tar.xz";
     };
   };
   poxml = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/poxml-20.12.2.tar.xz";
-      sha256 = "1hnm13x102fq7g4pginhdpq473dw9y52kw497773b72my94yj2zz";
-      name = "poxml-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/poxml-20.12.3.tar.xz";
+      sha256 = "1z7py6qjrx0j0mya5cmxc0gm1fmjwbkrm0g8916vdlyc4m5vpg9l";
+      name = "poxml-20.12.3.tar.xz";
     };
   };
   print-manager = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/print-manager-20.12.2.tar.xz";
-      sha256 = "1r19fsgnqdlmrpgbby13nj4v97nqlxlx8c0f7yv3izgncpavr0id";
-      name = "print-manager-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/print-manager-20.12.3.tar.xz";
+      sha256 = "19kwrl95p56zm5g11sws8h4vdc59w694ghhnmrwpyj2qra350dwa";
+      name = "print-manager-20.12.3.tar.xz";
     };
   };
   rocs = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/rocs-20.12.2.tar.xz";
-      sha256 = "06sy6g32cigls1znvh5wvs7gw9h492d8zjqm6b50wsw0hbx61kvz";
-      name = "rocs-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/rocs-20.12.3.tar.xz";
+      sha256 = "0709qyixnhsrdhkqqkwigmbfnr21rz2yapvmfylmaipdfm0i72wv";
+      name = "rocs-20.12.3.tar.xz";
     };
   };
   signon-kwallet-extension = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/signon-kwallet-extension-20.12.2.tar.xz";
-      sha256 = "0ycr0dn8bp51dc510gqxik0rm0wk5728px7cps9csy33izfjpx9p";
-      name = "signon-kwallet-extension-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/signon-kwallet-extension-20.12.3.tar.xz";
+      sha256 = "1a7hvkga6sj3sr4qv75n7p9gq44agncs0c7c9k6wni84h3y0icyp";
+      name = "signon-kwallet-extension-20.12.3.tar.xz";
     };
   };
   spectacle = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/spectacle-20.12.2.tar.xz";
-      sha256 = "0v0vzspr0vwqi7m7yhnhavxzkfqdnz1g06ispfl1lmpjg1xh90by";
-      name = "spectacle-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/spectacle-20.12.3.tar.xz";
+      sha256 = "1h29w4ajmgfksdmxanfmb1gdjk4h7hpc2zwiqf0yrq8vm2hhxqjc";
+      name = "spectacle-20.12.3.tar.xz";
     };
   };
   step = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/step-20.12.2.tar.xz";
-      sha256 = "1drdv95rimdsgarcc00jlfm3jmcan2ln32yq0q2nbbxsj0c502k7";
-      name = "step-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/step-20.12.3.tar.xz";
+      sha256 = "08z2zh8qq46288pddz9p5w10plpd26wgwil92maj6z765dqcxwqn";
+      name = "step-20.12.3.tar.xz";
     };
   };
   svgpart = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/svgpart-20.12.2.tar.xz";
-      sha256 = "1v1qd5sgb89gkvb62jad8ava2y599a4acb6hkqyh758y798ylgwj";
-      name = "svgpart-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/svgpart-20.12.3.tar.xz";
+      sha256 = "1ldkyd7kb8m6zw7siw2rryxzk6v26xc00arwlq1zsy4inbs8idgl";
+      name = "svgpart-20.12.3.tar.xz";
     };
   };
   sweeper = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/sweeper-20.12.2.tar.xz";
-      sha256 = "0yh6dqw37v8l54635k7g27dnsrl319kfxrkiiy09cx6pjzf87k1h";
-      name = "sweeper-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/sweeper-20.12.3.tar.xz";
+      sha256 = "12lp9m4sxblwp16dbb6gi1pf0yvav8gh5as1fpfx9kazava3xkhp";
+      name = "sweeper-20.12.3.tar.xz";
     };
   };
   umbrello = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/umbrello-20.12.2.tar.xz";
-      sha256 = "0zzic469brh0w41w4ni66mfrj0p44xm1h32iwbb7imgnpw6dqksf";
-      name = "umbrello-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/umbrello-20.12.3.tar.xz";
+      sha256 = "0y6kyir86k9cjpmhm4giqfn7g651hfsbl1zq2j2y2nqiisc7vysp";
+      name = "umbrello-20.12.3.tar.xz";
     };
   };
   yakuake = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/yakuake-20.12.2.tar.xz";
-      sha256 = "16irzxl6xfyanr7lrvap0ng911lml10bbjr0axk2a7m0gc1llrn4";
-      name = "yakuake-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/yakuake-20.12.3.tar.xz";
+      sha256 = "1y151cp5ygkxfd9ar4c38h2c1xwpx8mihh5f2sz6gbykzm3impbx";
+      name = "yakuake-20.12.3.tar.xz";
     };
   };
   zeroconf-ioslave = {
-    version = "20.12.2";
+    version = "20.12.3";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/20.12.2/src/zeroconf-ioslave-20.12.2.tar.xz";
-      sha256 = "0yqni8vwwwya3cv006cf5svs1jhn6369clvrl6m79iacy0iirynk";
-      name = "zeroconf-ioslave-20.12.2.tar.xz";
+      url = "${mirror}/stable/release-service/20.12.3/src/zeroconf-ioslave-20.12.3.tar.xz";
+      sha256 = "1zx7xmj7vj9d39cnnsgb15lbkr8yc81mcqilhq3jfhd3zgp8lrlv";
+      name = "zeroconf-ioslave-20.12.3.tar.xz";
     };
   };
 }
diff --git a/third_party/nixpkgs/pkgs/applications/misc/bleachbit/default.nix b/third_party/nixpkgs/pkgs/applications/misc/bleachbit/default.nix
index 952d1fe16d..4b78cda356 100644
--- a/third_party/nixpkgs/pkgs/applications/misc/bleachbit/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/misc/bleachbit/default.nix
@@ -7,6 +7,7 @@
 , glib
 , gtk3
 , libnotify
+, scandir ? null
 }:
 
 python3Packages.buildPythonApplication rec {
diff --git a/third_party/nixpkgs/pkgs/applications/misc/cura/default.nix b/third_party/nixpkgs/pkgs/applications/misc/cura/default.nix
index 46143747f6..a33cb7b2ce 100644
--- a/third_party/nixpkgs/pkgs/applications/misc/cura/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/misc/cura/default.nix
@@ -3,13 +3,13 @@
 
 mkDerivation rec {
   pname = "cura";
-  version = "4.8.0";
+  version = "4.9.0";
 
   src = fetchFromGitHub {
     owner = "Ultimaker";
     repo = "Cura";
     rev = version;
-    sha256 = "060fqzspipm93ks0inrj7yrj5wmvkdfv8xaxrv22590yb9f95s9m";
+    sha256 = "1q515qwrzla3ikbsjmk91y0nrbwih11jycgmd50lkrmnkh7qj0r2";
   };
 
   materials = fetchFromGitHub {
@@ -22,7 +22,7 @@ mkDerivation rec {
   buildInputs = [ qtbase qtquickcontrols2 qtgraphicaleffects ];
   propagatedBuildInputs = with python3.pkgs; [
     libsavitar numpy-stl pyserial requests uranium zeroconf pynest2d
-    sentry-sdk trimesh
+    sentry-sdk trimesh keyring
   ] ++ plugins;
   nativeBuildInputs = [ cmake python3.pkgs.wrapPython ];
 
diff --git a/third_party/nixpkgs/pkgs/applications/misc/cura/plugins.nix b/third_party/nixpkgs/pkgs/applications/misc/cura/plugins.nix
index 4bf7ba8d85..76a5808963 100644
--- a/third_party/nixpkgs/pkgs/applications/misc/cura/plugins.nix
+++ b/third_party/nixpkgs/pkgs/applications/misc/cura/plugins.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, fetchpatch, python3Packages, libspnav }:
+{ lib, stdenv, fetchFromGitHub, fetchpatch, python3Packages, libspnav, jq }:
 
 let
 
@@ -34,18 +34,28 @@ let
 
     rawmouse = stdenv.mkDerivation rec {
       pname = "RawMouse";
-      version = "1.0.13";
+      version = "1.1.0";
 
       src = fetchFromGitHub {
         owner = "smartavionics";
         repo = pname;
         rev = version;
-        sha256 = "1cj40pgsfcwliz47mkiqjbslkwcm34qb1pajc2mcljgflcnickly";
+        sha256 = "0hvi7qwd4xfnqnhbj9dgfjmvv9df7s42asf3fdfxv43n6nx74scw";
       };
 
+      nativeBuildInputs = [ jq ];
+
+      propagatedBuildInputs = with python3Packages; [
+        hidapi
+      ];
+
       buildPhase = ''
-        substituteInPlace RawMouse/config.json --replace \
-          /usr/local/lib/libspnav.so ${libspnav}/lib/libspnav.so
+        jq 'del(.devices) | .libspnav="${libspnav}/lib/libspnav.so"' \
+          <RawMouse/config.json >RawMouse/config.json.new
+        mv RawMouse/config.json.new RawMouse/config.json
+
+        # remove prebuilt binaries
+        rm -r RawMouse/hidapi
       '';
 
       installPhase = ''
diff --git a/third_party/nixpkgs/pkgs/applications/misc/curaengine/default.nix b/third_party/nixpkgs/pkgs/applications/misc/curaengine/default.nix
index 4a4558ba28..76947c1ed9 100644
--- a/third_party/nixpkgs/pkgs/applications/misc/curaengine/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/misc/curaengine/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "curaengine";
-  version = "4.8.0";
+  version = "4.9.0";
 
   src = fetchFromGitHub {
     owner = "Ultimaker";
     repo = "CuraEngine";
     rev = version;
-    sha256 = "083l327ry6hv3yaa1p8dx1hx7fm12b0lh5nlbshxjyym0vi15rw2";
+    sha256 = "0b82hwn7pb73h1azaandq93bkzlzskhgk71pwf4yws0j9bm6z084";
   };
 
   nativeBuildInputs = [ cmake ];
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "A powerful, fast and robust engine for processing 3D models into 3D printing instruction";
     homepage = "https://github.com/Ultimaker/CuraEngine";
-    license = licenses.agpl3;
+    license = licenses.agpl3Only;
     platforms = platforms.linux;
     maintainers = with maintainers; [ abbradar gebner ];
   };
diff --git a/third_party/nixpkgs/pkgs/applications/misc/electrum/default.nix b/third_party/nixpkgs/pkgs/applications/misc/electrum/default.nix
index 44f35e503c..676efb2aa0 100644
--- a/third_party/nixpkgs/pkgs/applications/misc/electrum/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/misc/electrum/default.nix
@@ -20,7 +20,7 @@
 }:
 
 let
-  version = "4.1.1";
+  version = "4.1.2";
 
   libsecp256k1_name =
     if stdenv.isLinux then "libsecp256k1.so.0"
@@ -51,7 +51,7 @@ python3.pkgs.buildPythonApplication {
 
   src = fetchurl {
     url = "https://download.electrum.org/${version}/Electrum-${version}.tar.gz";
-    sha256 = "0yg6ld92a4xgn7y8i51hmr3kmgmrbrjwniikkmyq9q141h2drb80";
+    sha256 = "05m6vbd4sfjk536kwa5wa3kv21jxxqnglx0ddvnmxfhf98371bhk";
   };
 
   postUnpack = ''
@@ -59,6 +59,11 @@ python3.pkgs.buildPythonApplication {
     cp -ar ${tests} $sourceRoot/electrum/tests
   '';
 
+  prePatch = ''
+    substituteInPlace contrib/requirements/requirements.txt \
+      --replace "dnspython>=2.0,<2.1" "dnspython>=2.0"
+  '';
+
   nativeBuildInputs = lib.optionals enableQt [ wrapQtAppsHook ];
 
   propagatedBuildInputs = with python3.pkgs; [
diff --git a/third_party/nixpkgs/pkgs/applications/misc/fme/default.nix b/third_party/nixpkgs/pkgs/applications/misc/fme/default.nix
index 52ba2927fd..6f6a143ae8 100644
--- a/third_party/nixpkgs/pkgs/applications/misc/fme/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/misc/fme/default.nix
@@ -1,33 +1,56 @@
-{ lib, stdenv, fetchurl, pkg-config, autoconf, automake, gettext
-, fluxbox, bc, gtkmm2, glibmm, libglademm, libsigcxx }:
+{ lib
+, stdenv
+, fetchurl
+, autoconf
+, automake
+, bc
+, fluxbox
+, gettext
+, glibmm
+, gtkmm2
+, libglademm
+, libsigcxx
+, pkg-config
+}:
 
 stdenv.mkDerivation rec {
-
   pname = "fme";
   version = "1.1.3";
 
   src = fetchurl {
     url = "https://github.com/rdehouss/fme/archive/v${version}.tar.gz";
-    sha256 = "d1c81a6a38c0faad02943ad65d6d0314bd205c6de841669a2efe43e4c503e63d";
+    hash = "sha256-0cgaajjA+q0ClDrWXW0DFL0gXG3oQWaaLv5D5MUD5j0=";
   };
 
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ autoconf automake gettext fluxbox bc gtkmm2 glibmm libglademm libsigcxx ];
+  nativeBuildInputs = [
+    autoconf
+    automake
+    gettext
+    pkg-config
+  ];
+  buildInputs = [
+    bc
+    fluxbox
+    glibmm
+    gtkmm2
+    libglademm
+    libsigcxx
+  ];
 
   preConfigure = ''
     ./autogen.sh
   '';
 
   meta = with lib; {
+    homepage = "https://github.com/rdehouss/fme/";
     description = "Editor for Fluxbox menus";
     longDescription = ''
-      Fluxbox Menu Editor is a menu editor for the Window Manager Fluxbox written in C++
-      with the libraries Gtkmm, Glibmm, libglademm and gettext for internationalization.
-      Its user-friendly interface will help you to edit, delete, move (Drag and Drop)
-      a row, a submenu, etc very easily.
+      Fluxbox Menu Editor is a menu editor for the Window Manager Fluxbox
+      written in C++ with the libraries Gtkmm, Glibmm, libglademm and gettext
+      for internationalization.  Its user-friendly interface will help you to
+      edit, delete, move (Drag and Drop) a row, a submenu, etc very easily.
     '';
-    homepage = "https://github.com/rdehouss/fme/";
-    license = licenses.gpl2;
+    license = licenses.gpl2Plus;
     maintainers = [ maintainers.AndersonTorres ];
     platforms = platforms.linux;
   };
diff --git a/third_party/nixpkgs/pkgs/applications/misc/gcalcli/default.nix b/third_party/nixpkgs/pkgs/applications/misc/gcalcli/default.nix
index e19e89ec6c..392e2c312f 100644
--- a/third_party/nixpkgs/pkgs/applications/misc/gcalcli/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/misc/gcalcli/default.nix
@@ -23,7 +23,7 @@ buildPythonApplication rec {
     dateutil gflags httplib2 parsedatetime six vobject
     google-api-python-client oauth2client uritemplate
     libnotify
-  ] ++ lib.optional (!isPy3k) futures;
+  ];
 
   # There are no tests as of 4.0.0a4
   doCheck = false;
diff --git a/third_party/nixpkgs/pkgs/applications/misc/heimer/default.nix b/third_party/nixpkgs/pkgs/applications/misc/heimer/default.nix
index 9d8dc1eaa0..5d9fb0f30d 100644
--- a/third_party/nixpkgs/pkgs/applications/misc/heimer/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/misc/heimer/default.nix
@@ -2,13 +2,13 @@
 
 mkDerivation rec {
   pname = "heimer";
-  version = "2.2.0";
+  version = "2.4.0";
 
   src = fetchFromGitHub {
     owner = "juzzlin";
     repo = pname;
     rev = version;
-    sha256 = "sha256-upsOmf46bCO8sVp5dBHPLUBZYZP3JyXa7H5KXbd76qo=";
+    sha256 = "sha256-5cepT9Tfr/3nYbxRAMqKSUDB+suEyojnexWxZ0i7GBw=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/third_party/nixpkgs/pkgs/applications/misc/sigal/default.nix b/third_party/nixpkgs/pkgs/applications/misc/sigal/default.nix
index f2333aa994..860e8f8adb 100644
--- a/third_party/nixpkgs/pkgs/applications/misc/sigal/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/misc/sigal/default.nix
@@ -1,33 +1,40 @@
-{ lib, python3Packages, ffmpeg_3 }:
+{ lib, python3Packages, ffmpeg }:
 
 python3Packages.buildPythonApplication rec {
-  version = "2.1.1";
+  version = "2.2";
   pname   = "sigal";
 
   src = python3Packages.fetchPypi {
     inherit version pname;
-    sha256 = "0l07p457svznirz7qllgyl3qbhiisv7klhz7cbdw6417hxf9bih8";
+    sha256 = "sha256-49XsNdZuicsiYJZuF1UdqMA4q33Ly/Ug/Hc4ybJKmPo=";
   };
 
   disabled = !(python3Packages.pythonAtLeast "3.6");
 
-  checkInputs = with python3Packages; [ pytest ];
   propagatedBuildInputs = with python3Packages; [
+    # install_requires
     jinja2
     markdown
     pillow
     pilkit
-    clint
     click
     blinker
     natsort
-    setuptools_scm
+    # extras_require
+    boto
+    brotli
+    feedgenerator
+    zopfli
+    cryptography
   ];
 
-  makeWrapperArgs = [ "--prefix PATH : ${ffmpeg_3}/bin" ];
+  checkInputs = [
+    ffmpeg
+  ] ++ (with python3Packages; [
+    pytestCheckHook
+  ]);
 
-  # No tests included
-  doCheck = false;
+  makeWrapperArgs = [ "--prefix PATH : ${ffmpeg}/bin" ];
 
   meta = with lib; {
     description = "Yet another simple static gallery generator";
diff --git a/third_party/nixpkgs/pkgs/applications/misc/xplr/default.nix b/third_party/nixpkgs/pkgs/applications/misc/xplr/default.nix
index ddbd837a6d..46dfe713de 100644
--- a/third_party/nixpkgs/pkgs/applications/misc/xplr/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/misc/xplr/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   name = "xplr";
-  version = "0.5.6";
+  version = "0.5.7";
 
   src = fetchFromGitHub {
     owner = "sayanarijit";
     repo = name;
     rev = "v${version}";
-    sha256 = "070jyii2p7qk6gij47n5i9a8bal5iijgn8cv79mrija3pgddniaz";
+    sha256 = "1j417g0isy3cpxdb2wrvrvypnx99qffi83s4a98791wyi8yqiw6b";
   };
 
-  cargoSha256 = "113f0hbgy8c9gxl70b6frr0klfc8rm5klgwls7fgbb643rdh03b9";
+  cargoSha256 = "0kpwhk2f4czhilcnfqkw5hw2vxvldxqg491xkkgxjkph3w4qv3ji";
 
   meta = with lib; {
     description = "A hackable, minimal, fast TUI file explorer";
diff --git a/third_party/nixpkgs/pkgs/applications/networking/browsers/chromium/common.nix b/third_party/nixpkgs/pkgs/applications/networking/browsers/chromium/common.nix
index 2b480bc55d..b08ff1ac7c 100644
--- a/third_party/nixpkgs/pkgs/applications/networking/browsers/chromium/common.nix
+++ b/third_party/nixpkgs/pkgs/applications/networking/browsers/chromium/common.nix
@@ -151,6 +151,7 @@ let
       bison gperf libkrb5
       glib gtk3 dbus-glib
       libXScrnSaver libXcursor libXtst libxshmfence libGLU libGL
+      mesa # required for libgbm
       pciutils protobuf speechd libXdamage at-spi2-core
       jre
       pipewire
diff --git a/third_party/nixpkgs/pkgs/applications/networking/browsers/firefox/common.nix b/third_party/nixpkgs/pkgs/applications/networking/browsers/firefox/common.nix
index 3a8fec2c6e..24195e578b 100644
--- a/third_party/nixpkgs/pkgs/applications/networking/browsers/firefox/common.nix
+++ b/third_party/nixpkgs/pkgs/applications/networking/browsers/firefox/common.nix
@@ -6,7 +6,7 @@
 , libjpeg, zlib, dbus, dbus-glib, bzip2, xorg
 , freetype, fontconfig, file, nspr, nss, nss_3_53
 , yasm, libGLU, libGL, sqlite, unzip, makeWrapper
-, hunspell, libXdamage, libevent, libstartup_notification
+, hunspell, libevent, libstartup_notification
 , libvpx_1_8
 , icu67, libpng, jemalloc, glib, pciutils
 , autoconf213, which, gnused, rustPackages, rustPackages_1_45
@@ -22,7 +22,7 @@
 , pulseaudioSupport ? stdenv.isLinux, libpulseaudio
 , ffmpegSupport ? true
 , gtk3Support ? true, gtk2, gtk3, wrapGAppsHook
-, waylandSupport ? true, libxkbcommon
+, waylandSupport ? true, libxkbcommon, libdrm
 , ltoSupport ? (stdenv.isLinux && stdenv.is64bit), overrideCC, buildPackages
 , gssSupport ? true, libkrb5
 , pipewireSupport ? waylandSupport && webrtcSupport, pipewire
@@ -161,6 +161,7 @@ buildStdenv.mkDerivation ({
     xorg.libX11 xorg.libXrender xorg.libXft xorg.libXt file
     xorg.pixman yasm libGLU libGL
     xorg.xorgproto
+    xorg.libXdamage
     xorg.libXext makeWrapper
     libevent libstartup_notification /* cairo */
     libpng jemalloc glib
@@ -175,7 +176,7 @@ buildStdenv.mkDerivation ({
   ++ lib.optional  pulseaudioSupport libpulseaudio # only headers are needed
   ++ lib.optional  gtk3Support gtk3
   ++ lib.optional  gssSupport libkrb5
-  ++ lib.optional  waylandSupport libxkbcommon
+  ++ lib.optionals waylandSupport [ libxkbcommon libdrm ]
   ++ lib.optional  pipewireSupport pipewire
   ++ lib.optional  (lib.versionAtLeast ffversion "82") gnum4
   ++ lib.optionals buildStdenv.isDarwin [ CoreMedia ExceptionHandling Kerberos
diff --git a/third_party/nixpkgs/pkgs/applications/networking/cluster/fluxctl/default.nix b/third_party/nixpkgs/pkgs/applications/networking/cluster/fluxctl/default.nix
index 1d02e675f9..fadaa94995 100644
--- a/third_party/nixpkgs/pkgs/applications/networking/cluster/fluxctl/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/networking/cluster/fluxctl/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "fluxctl";
-  version = "1.22.1";
+  version = "1.22.2";
 
   src = fetchFromGitHub {
     owner = "weaveworks";
     repo = "flux";
     rev = version;
-    sha256 = "sha256-SaDO3a50CLhgLafCdgKEfHpuHdIweSy5L/TUgEUv5CM=";
+    sha256 = "sha256-qYdVplNHyD31m4IbIeL3x3nauZLl1XquslS3WrtUXBk=";
   };
 
   vendorSha256 = "sha256-4uSw/9lI/rdDqy78jNC9eHYW/v/sMFb+sQvwYG6GZks=";
diff --git a/third_party/nixpkgs/pkgs/applications/networking/cluster/kubeconform/default.nix b/third_party/nixpkgs/pkgs/applications/networking/cluster/kubeconform/default.nix
index ca5e30154d..c62cbb2a67 100644
--- a/third_party/nixpkgs/pkgs/applications/networking/cluster/kubeconform/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/networking/cluster/kubeconform/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "kubeconform";
-  version = "0.4.6";
+  version = "0.4.7";
 
   src = fetchFromGitHub {
     owner = "yannh";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-lduHYYskEPUimEX54ymOyo5jY7GGBB42YTefDMNS4qo=";
+    sha256 = "sha256-ahVdKMx3u2KnJ30wi9rV8JCVg9wPmbgdrtG8IpWWlCs=";
   };
 
   vendorSha256 = null;
diff --git a/third_party/nixpkgs/pkgs/applications/networking/instant-messengers/chatterino2/default.nix b/third_party/nixpkgs/pkgs/applications/networking/instant-messengers/chatterino2/default.nix
index f9789cfda4..075fd5b3a2 100644
--- a/third_party/nixpkgs/pkgs/applications/networking/instant-messengers/chatterino2/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/networking/instant-messengers/chatterino2/default.nix
@@ -2,12 +2,12 @@
 
 mkDerivation rec {
   pname = "chatterino2";
-  version = "2.2.2";
+  version = "2.3.0";
   src = fetchFromGitHub {
     owner = "Chatterino";
     repo = pname;
     rev = "v${version}";
-    sha256 = "026cs48hmqkv7k4akbm205avj2pn3x1g7q46chwa707k9km325dz";
+    sha256 = "0x12zcrbkxn2nn0hqkj1amrxv4q032id282cajzsx7by970r1shd";
     fetchSubmodules = true;
   };
   nativeBuildInputs = [ qmake pkg-config wrapQtAppsHook ];
diff --git a/third_party/nixpkgs/pkgs/applications/networking/instant-messengers/discord/base.nix b/third_party/nixpkgs/pkgs/applications/networking/instant-messengers/discord/base.nix
index e4c588e6c1..b649fd20d5 100644
--- a/third_party/nixpkgs/pkgs/applications/networking/instant-messengers/discord/base.nix
+++ b/third_party/nixpkgs/pkgs/applications/networking/instant-messengers/discord/base.nix
@@ -1,5 +1,5 @@
 { pname, version, src, binaryName, desktopName
-, autoPatchelfHook, fetchurl, makeDesktopItem, lib, stdenv, wrapGAppsHook
+, autoPatchelfHook, makeDesktopItem, lib, stdenv, wrapGAppsHook
 , alsaLib, at-spi2-atk, at-spi2-core, atk, cairo, cups, dbus, expat, fontconfig
 , freetype, gdk-pixbuf, glib, gtk3, libcxx, libdrm, libnotify, libpulseaudio, libuuid
 , libX11, libXScrnSaver, libXcomposite, libXcursor, libXdamage, libXext
@@ -18,6 +18,7 @@ in stdenv.mkDerivation rec {
     cups
     libdrm
     libuuid
+    libXdamage
     libX11
     libXScrnSaver
     libXtst
diff --git a/third_party/nixpkgs/pkgs/applications/networking/instant-messengers/element/element-desktop-package.json b/third_party/nixpkgs/pkgs/applications/networking/instant-messengers/element/element-desktop-package.json
index aa240b48e8..e1f070eaa9 100644
--- a/third_party/nixpkgs/pkgs/applications/networking/instant-messengers/element/element-desktop-package.json
+++ b/third_party/nixpkgs/pkgs/applications/networking/instant-messengers/element/element-desktop-package.json
@@ -2,7 +2,7 @@
   "name": "element-desktop",
   "productName": "Element",
   "main": "src/electron-main.js",
-  "version": "1.7.25",
+  "version": "1.7.26",
   "description": "A feature-rich client for Matrix.org",
   "author": "Element",
   "repository": {
diff --git a/third_party/nixpkgs/pkgs/applications/networking/instant-messengers/element/element-desktop.nix b/third_party/nixpkgs/pkgs/applications/networking/instant-messengers/element/element-desktop.nix
index 75252bb74b..2a7e01e529 100644
--- a/third_party/nixpkgs/pkgs/applications/networking/instant-messengers/element/element-desktop.nix
+++ b/third_party/nixpkgs/pkgs/applications/networking/instant-messengers/element/element-desktop.nix
@@ -8,12 +8,12 @@
 
 let
   executableName = "element-desktop";
-  version = "1.7.25";
+  version = "1.7.26";
   src = fetchFromGitHub {
     owner = "vector-im";
     repo = "element-desktop";
     rev = "v${version}";
-    sha256 = "sha256-q8hVmTLt/GdLc6NSldLggogObQcPFp+lAeS3wmO0qPo=";
+    sha256 = "1iflsvzn36mywpzags55kjmyq71c3i7f1hgcdcp2ijmnrjk8fy3n";
   };
 in mkYarnPackage rec {
   name = "element-desktop-${version}";
@@ -73,6 +73,7 @@ in mkYarnPackage rec {
   meta = with lib; {
     description = "A feature-rich client for Matrix.org";
     homepage = "https://element.io/";
+    changelog = "https://github.com/vector-im/element-desktop/blob/v${version}/CHANGELOG.md";
     license = licenses.asl20;
     maintainers = teams.matrix.members;
     inherit (electron.meta) platforms;
diff --git a/third_party/nixpkgs/pkgs/applications/networking/instant-messengers/element/element-web.nix b/third_party/nixpkgs/pkgs/applications/networking/instant-messengers/element/element-web.nix
index 624ba46b8e..9f077c8337 100644
--- a/third_party/nixpkgs/pkgs/applications/networking/instant-messengers/element/element-web.nix
+++ b/third_party/nixpkgs/pkgs/applications/networking/instant-messengers/element/element-web.nix
@@ -12,11 +12,11 @@ let
 
 in stdenv.mkDerivation rec {
   pname = "element-web";
-  version = "1.7.25";
+  version = "1.7.26";
 
   src = fetchurl {
     url = "https://github.com/vector-im/element-web/releases/download/v${version}/element-v${version}.tar.gz";
-    sha256 = "sha256-T4lsGVSUHkw4R7tSeTKPifbhwaTf/YF2vVAakFSrt9k=";
+    sha256 = "17y6wq6w1yk7r1rfply549kpilfraizahf67p00ra7cws66iqkwg";
   };
 
   installPhase = ''
@@ -32,6 +32,7 @@ in stdenv.mkDerivation rec {
   meta = {
     description = "A glossy Matrix collaboration client for the web";
     homepage = "https://element.io/";
+    changelog = "https://github.com/vector-im/element-web/blob/v${version}/CHANGELOG.md";
     maintainers = lib.teams.matrix.members;
     license = lib.licenses.asl20;
     platforms = lib.platforms.all;
diff --git a/third_party/nixpkgs/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix b/third_party/nixpkgs/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
index 98ede215e0..d4a72e657c 100644
--- a/third_party/nixpkgs/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
@@ -2,7 +2,7 @@
 , gnome2, gtk3, atk, at-spi2-atk, cairo, pango, gdk-pixbuf, glib, freetype, fontconfig
 , dbus, libX11, xorg, libXi, libXcursor, libXdamage, libXrandr, libXcomposite
 , libXext, libXfixes, libXrender, libXtst, libXScrnSaver, nss, nspr, alsaLib
-, cups, expat, libuuid, at-spi2-core, libappindicator-gtk3
+, cups, expat, libuuid, at-spi2-core, libappindicator-gtk3, mesa
 # Runtime dependencies:
 , systemd, libnotify, libdbusmenu, libpulseaudio
 # Unfortunately this also overwrites the UI language (not just the spell
@@ -73,6 +73,7 @@ in stdenv.mkDerivation rec {
     libappindicator-gtk3
     libnotify
     libuuid
+    mesa # for libgbm
     nspr
     nss
     pango
diff --git a/third_party/nixpkgs/pkgs/applications/networking/mailreaders/thunderbird/default.nix b/third_party/nixpkgs/pkgs/applications/networking/mailreaders/thunderbird/default.nix
index 0e09633ea0..8e176638da 100644
--- a/third_party/nixpkgs/pkgs/applications/networking/mailreaders/thunderbird/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/networking/mailreaders/thunderbird/default.nix
@@ -61,7 +61,7 @@
 , alsaSupport ? stdenv.isLinux, alsaLib
 , pulseaudioSupport ? stdenv.isLinux, libpulseaudio
 , gtk3Support ? true, gtk2, gtk3, wrapGAppsHook
-, waylandSupport ? true
+, waylandSupport ? true, libdrm
 , libxkbcommon, calendarSupport ? true
 
 # Use official trademarked branding.  Permission obtained at:
@@ -137,12 +137,13 @@ stdenv.mkDerivation rec {
     xorg.libXt
     xorg.pixman
     xorg.xorgproto
+    xorg.libXdamage
     zip
     zlib
   ] ++ lib.optional alsaSupport alsaLib
     ++ lib.optional gtk3Support gtk3
     ++ lib.optional pulseaudioSupport libpulseaudio
-    ++ lib.optional waylandSupport libxkbcommon;
+    ++ lib.optionals waylandSupport [ libxkbcommon libdrm ];
 
   NIX_CFLAGS_COMPILE =[
     "-I${glib.dev}/include/gio-unix-2.0"
diff --git a/third_party/nixpkgs/pkgs/applications/networking/mullvad-vpn/default.nix b/third_party/nixpkgs/pkgs/applications/networking/mullvad-vpn/default.nix
index 9267d8d231..b27598c40e 100644
--- a/third_party/nixpkgs/pkgs/applications/networking/mullvad-vpn/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/networking/mullvad-vpn/default.nix
@@ -1,6 +1,6 @@
 { stdenv, lib, fetchurl, dpkg
 , alsaLib, atk, cairo, cups, dbus, expat, fontconfig, freetype
-, gdk-pixbuf, glib, gnome2, pango, nspr, nss, gtk3
+, gdk-pixbuf, glib, gnome2, pango, nspr, nss, gtk3, mesa
 , xorg, autoPatchelfHook, systemd, libnotify, libappindicator
 }:
 
@@ -20,6 +20,7 @@ let deps = [
     gtk3
     libappindicator
     libnotify
+    mesa
     xorg.libX11
     xorg.libXScrnSaver
     xorg.libXcomposite
diff --git a/third_party/nixpkgs/pkgs/applications/networking/remote/remmina/default.nix b/third_party/nixpkgs/pkgs/applications/networking/remote/remmina/default.nix
index 3421050d1e..5d0195b62f 100644
--- a/third_party/nixpkgs/pkgs/applications/networking/remote/remmina/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/networking/remote/remmina/default.nix
@@ -13,13 +13,13 @@ with lib;
 
 stdenv.mkDerivation rec {
   pname = "remmina";
-  version = "1.4.12";
+  version = "1.4.13";
 
   src = fetchFromGitLab {
     owner  = "Remmina";
     repo   = "Remmina";
     rev    = "v${version}";
-    sha256 = "sha256-CjlNEmca4Kob5rdpZa+YfvdOIDDDYfhNsGYqGDxSGKY=";
+    sha256 = "sha256-R+RfczAnt5R0YmXt5SmH8gOuWOH0LZ/70pOMDAXJgsE=";
   };
 
   nativeBuildInputs = [ cmake ninja pkg-config wrapGAppsHook ];
@@ -51,7 +51,7 @@ stdenv.mkDerivation rec {
   '';
 
   meta = {
-    license = licenses.gpl2;
+    license = licenses.gpl2Plus;
     homepage = "https://gitlab.com/Remmina/Remmina";
     description = "Remote desktop client written in GTK";
     maintainers = with maintainers; [ melsigl ryantm ];
diff --git a/third_party/nixpkgs/pkgs/applications/networking/sniffers/wireshark/default.nix b/third_party/nixpkgs/pkgs/applications/networking/sniffers/wireshark/default.nix
index 249d58ceb6..230bb2d4fe 100644
--- a/third_party/nixpkgs/pkgs/applications/networking/sniffers/wireshark/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/networking/sniffers/wireshark/default.nix
@@ -10,7 +10,7 @@ assert withQt  -> qt5  != null;
 with lib;
 
 let
-  version = "3.4.4";
+  version = "3.4.5";
   variant = if withQt then "qt" else "cli";
 
 in stdenv.mkDerivation {
@@ -20,7 +20,7 @@ in stdenv.mkDerivation {
 
   src = fetchurl {
     url = "https://www.wireshark.org/download/src/all-versions/wireshark-${version}.tar.xz";
-    sha256 = "0aad3m8nh4i75dgjs68217135bzqmhmlgjklmpjh1ihmjwgd373j";
+    sha256 = "sha256-3hqv0QCh4SB8hQ0YDpfdkauNoPXra+7FRfclzbFF0zM=";
   };
 
   cmakeFlags = [
diff --git a/third_party/nixpkgs/pkgs/applications/office/onlyoffice-bin/default.nix b/third_party/nixpkgs/pkgs/applications/office/onlyoffice-bin/default.nix
index bfd3c3529e..987c2c3cb2 100644
--- a/third_party/nixpkgs/pkgs/applications/office/onlyoffice-bin/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/office/onlyoffice-bin/default.nix
@@ -21,6 +21,7 @@
 , gtk3
 , libpulseaudio
 , libudev0-shim
+, libdrm
 , makeWrapper
 , nspr
 , nss
@@ -101,6 +102,7 @@ in stdenv.mkDerivation rec {
     gtk2
     gtk3
     libpulseaudio
+    libdrm
     nspr
     nss
     qt5.qtbase
diff --git a/third_party/nixpkgs/pkgs/applications/radio/wsjtx/default.nix b/third_party/nixpkgs/pkgs/applications/radio/wsjtx/default.nix
index 697a28e4be..ae378b5710 100644
--- a/third_party/nixpkgs/pkgs/applications/radio/wsjtx/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/radio/wsjtx/default.nix
@@ -1,15 +1,15 @@
 { lib, stdenv, fetchurl, asciidoc, asciidoctor, autoconf, automake, cmake,
   docbook_xsl, fftw, fftwFloat, gfortran, libtool, libusb1, qtbase,
-  qtmultimedia, qtserialport, qttools, texinfo, wrapQtAppsHook }:
+  qtmultimedia, qtserialport, qttools, boost, texinfo, wrapQtAppsHook }:
 
 stdenv.mkDerivation rec {
   pname = "wsjtx";
-  version = "2.2.2";
+  version = "2.3.1";
 
   # This is a "superbuild" tarball containing both wsjtx and a hamlib fork
   src = fetchurl {
     url = "http://physics.princeton.edu/pulsar/k1jt/wsjtx-${version}.tgz";
-    sha256 = "17agyrhclqyahgdwba8vi9sl7vq03sm00jlyrmjgv34a4czidg0w";
+    sha256 = "11wzh4bxp9277kbqkyrc063akkk09czgxnkpk8k07vl4s3dan3hh";
   };
 
   # Hamlib builds with autotools, wsjtx builds with cmake
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
     asciidoc asciidoctor autoconf automake cmake docbook_xsl gfortran libtool
     qttools texinfo wrapQtAppsHook
   ];
-  buildInputs = [ fftw fftwFloat libusb1 qtbase qtmultimedia qtserialport ];
+  buildInputs = [ fftw fftwFloat libusb1 qtbase qtmultimedia qtserialport boost ];
 
   # Remove Git dependency from superbuild since sources are included
   patches = [ ./super.patch ];
@@ -36,6 +36,6 @@ stdenv.mkDerivation rec {
     # Older licenses are for the statically-linked hamlib
     license = with licenses; [ gpl3Plus gpl2Plus lgpl21Plus ];
     platforms = platforms.linux;
-    maintainers = with maintainers; [ lasandell ];
+    maintainers = with maintainers; [ lasandell numinit ];
   };
 }
diff --git a/third_party/nixpkgs/pkgs/applications/science/geometry/tetgen/default.nix b/third_party/nixpkgs/pkgs/applications/science/geometry/tetgen/default.nix
index c921c05c58..75eaa089ec 100644
--- a/third_party/nixpkgs/pkgs/applications/science/geometry/tetgen/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/science/geometry/tetgen/default.nix
@@ -1,13 +1,13 @@
 {lib, stdenv, fetchurl}:
 
-let version = "1.5.1"; in
+let version = "1.6.0"; in
 stdenv.mkDerivation {
   pname = "tetgen";
   inherit version;
 
   src = fetchurl {
     url = "http://wias-berlin.de/software/tetgen/1.5/src/tetgen${version}.tar.gz";
-    sha256 = "0l5q066crs4cjj7qr0r2gnz8ajkgighngwglr1201h77lcs48sp4";
+    sha256 = "sha256-h7XmHr06Rx/E8s3XEkwrEd1mOfT+sflBpdL1EQ0Fzjk=";
   };
 
   installPhase = ''
diff --git a/third_party/nixpkgs/pkgs/applications/science/logic/alt-ergo/default.nix b/third_party/nixpkgs/pkgs/applications/science/logic/alt-ergo/default.nix
index dd72d148e2..963015b11d 100644
--- a/third_party/nixpkgs/pkgs/applications/science/logic/alt-ergo/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/science/logic/alt-ergo/default.nix
@@ -1,12 +1,14 @@
-{ fetchurl, lib, which, ocamlPackages }:
+{ fetchFromGitHub, lib, which, ocamlPackages }:
 
 let
   pname = "alt-ergo";
-  version = "2.3.3";
+  version = "2.4.0";
 
-  src = fetchurl {
-    url = "https://alt-ergo.ocamlpro.com/http/alt-ergo-${version}/alt-ergo-${version}.tar.gz";
-    sha256 = "124k2a4ikk4wdpmvgjpgl97x9skvr9qznk8m68dzsynzpv6yksaj";
+  src = fetchFromGitHub {
+    owner = "OCamlPro";
+    repo = pname;
+    rev = version;
+    sha256 = "1jm1yrvsg8iyfp9bb728zdx2i7yb6z7minjrfs27k5ncjqkjm65g";
   };
 
   useDune2 = true;
@@ -19,6 +21,7 @@ let alt-ergo-lib = ocamlPackages.buildDunePackage rec {
   pname = "alt-ergo-lib";
   inherit version src useDune2 nativeBuildInputs;
   configureFlags = pname;
+  buildInputs = with ocamlPackages; [ dune-configurator ];
   propagatedBuildInputs = with ocamlPackages; [ num ocplib-simplex stdlib-shims zarith ];
 }; in
 
@@ -36,7 +39,9 @@ ocamlPackages.buildDunePackage {
 
   configureFlags = pname;
 
-  buildInputs = [ alt-ergo-parsers ocamlPackages.menhir ];
+  buildInputs = [ alt-ergo-parsers ] ++ (with ocamlPackages; [
+    cmdliner menhir ])
+  ;
 
   meta = {
     description = "High-performance theorem prover and SMT solver";
diff --git a/third_party/nixpkgs/pkgs/applications/science/math/gap/default.nix b/third_party/nixpkgs/pkgs/applications/science/math/gap/default.nix
index ce93c14b33..3b3d8a58b5 100644
--- a/third_party/nixpkgs/pkgs/applications/science/math/gap/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/science/math/gap/default.nix
@@ -5,6 +5,7 @@
 , makeWrapper
 , readline
 , gmp
+, zlib
 # one of
 # - "minimal" (~400M):
 #     Install the bare minimum of packages required by gap to start.
@@ -61,11 +62,11 @@ in
 stdenv.mkDerivation rec {
   pname = "gap";
   # https://www.gap-system.org/Releases/
-  version = "4.10.2";
+  version = "4.11.0";
 
   src = fetchurl {
     url = "https://files.gap-system.org/gap-${lib.versions.major version}.${lib.versions.minor version}/tar.bz2/gap-${version}.tar.bz2";
-    sha256 = "0cp6ddk0469zzv1m1vair6gm27ic6c5m77ri8rn0znq3gaps6x94";
+    sha256 = "sha256-vwcKENwqxgWT/mXfD4c9ctTWdQHobrJipva9SPyGhgI=";
   };
 
   # remove all non-essential packages (which take up a lot of space)
@@ -76,6 +77,7 @@ stdenv.mkDerivation rec {
   buildInputs = [
     readline
     gmp
+    zlib
   ];
 
   nativeBuildInputs = [
@@ -83,34 +85,22 @@ stdenv.mkDerivation rec {
   ];
 
   patches = [
-    # https://github.com/gap-system/gap/pull/3294
-    (fetchpatch {
-      name = "add-make-install-targets.patch";
-      url = "https://github.com/gap-system/gap/commit/3361c172e6c5ff3bb3f01ba9d6f1dd4ad42cea80.patch";
-      sha256 = "1kwp9qnfvmlbpf1c3rs6j5m2jz22rj7a4hb5x1gj9vkpiyn5pdyj";
-    })
-
     # Fix for locale specific tests causing issues. Already upstream.
     # Backport of https://github.com/gap-system/gap/pull/4022
-    # WHEN REMOVING: also remove the`rm tst/testinstall/strings.tst` line in
-    # `postPatch` below. That line is necessary since the patch is not intended
-    # for gap 4.10.
     (fetchpatch {
       name = "remove-locale-specific-tests.patch";
       url = "https://github.com/gap-system/gap/commit/c18b0c4215b5212a2cc4f305e2d5b94ba716bee8.patch";
-      excludes = ["tst/testinstall/stringobj.tst"];
-      sha256 = "1mz5b4mbw2jdd1ypp5s0dy6pp0jsvwsxr2dm4kbkls20r1r192sc";
+      sha256 = "sha256-De+T9Y7ewRT6plJrj2VR8axRvD/JCTYKOBWB7Bw0oq0=";
     })
 
     # fixes aarch64 gc crashes: https://github.com/gap-system/gap/pull/3965
-    ./mark-genstackfuncbags-as-noinline.patch
+    (fetchpatch {
+      name = "mark-genstackfuncbags-as-noinline.patch";
+      url = "https://github.com/gap-system/gap/commit/f0a8f49ff8dad0a5fa77253d45457c6f40f96778.patch";
+      sha256 = "sha256-GU9tOP1stX2vn8m8kXOBupEpxIYArA76ibKL8eLn0MY=";
+    })
   ];
 
-  postPatch = ''
-    # File not covered by the remove-locale-specific-tests.patch patch above.
-    rm tst/testinstall/strings.tst
-  '';
-
   # "teststandard" is a superset of testinstall. It takes ~1h instead of ~1min.
   # tests are run twice, once with all packages loaded and once without
   # checkTarget = "teststandard";
@@ -155,7 +145,6 @@ stdenv.mkDerivation rec {
 
     mkdir -p "$out/bin" "$out/share/gap/"
 
-    mkdir -p "$out/share/gap"
     echo "Copying files to target directory"
     cp -ar . "$out/share/gap/build-dir"
 
diff --git a/third_party/nixpkgs/pkgs/applications/science/math/pynac/default.nix b/third_party/nixpkgs/pkgs/applications/science/math/pynac/default.nix
index 00d35b491d..9cdcd2b9ea 100644
--- a/third_party/nixpkgs/pkgs/applications/science/math/pynac/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/science/math/pynac/default.nix
@@ -1,6 +1,6 @@
 { lib, stdenv
 , fetchFromGitHub
-, fetchurl
+, fetchpatch
 , autoreconfHook
 , pkg-config
 , flint
@@ -11,16 +11,36 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "0.7.26";
+  version = "0.7.27";
   pname = "pynac";
 
   src = fetchFromGitHub {
     owner = "pynac";
     repo = "pynac";
     rev = "pynac-${version}";
-    sha256 = "09d2p74x1arkydlxy6pw4p4byi7r8q7f29w373h4d8a215kadc6d";
+    sha256 = "sha256-1HHCIeaNE2UsJNX92UlDGLJS8I4nC/8FnwX7Y4F9HpU=";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "handle_factor.patch";
+      url = "https://git.sagemath.org/sage.git/plain/build/pkgs/pynac/patches/handle_factor.patch?h=9.3.rc3";
+      sha256 = "sha256-U1lb5qwBqZZgklfDMhBX4K5u8bz5x42O4w7hyNy2YVw=";
+    })
+
+    (fetchpatch {
+      name = "power_inf_loop.patch";
+      url = "https://git.sagemath.org/sage.git/plain/build/pkgs/pynac/patches/power_inf_loop.patch?h=9.3.rc3";
+      sha256 = "sha256-VYeaJl8u2wl7FQ/6xnpZv1KpdNYEmJoPhuMrBADyTRs=";
+    })
+
+    (fetchpatch {
+      name = "too_much_sub.patch";
+      url = "https://git.sagemath.org/sage.git/plain/build/pkgs/pynac/patches/too_much_sub.patch?h=9.3.rc3";
+      sha256 = "sha256-lw7xSQ/l+rzPu+ghWF4omYF0mKksGGPuuHJTktvbdis=";
+    })
+  ];
+
   buildInputs = [
     flint
     gmp
@@ -34,14 +54,6 @@ stdenv.mkDerivation rec {
     pkg-config
   ];
 
-  patches = [
-    (fetchurl {
-      name = "py_ssize_t_clean.patch";
-      url = "https://git.sagemath.org/sage.git/plain/build/pkgs/pynac/patches/py_ssize_t_clean.patch?h=9.2";
-      sha256 = "0l3gbg9hc4v671zf4w376krnk3wh8hj3649610nlvzzxckcryzab";
-    })
-  ];
-
   meta = with lib; {
     description = "Python is Not a CAS -- modified version of Ginac";
     longDescription = ''
diff --git a/third_party/nixpkgs/pkgs/applications/science/math/qalculate-gtk/default.nix b/third_party/nixpkgs/pkgs/applications/science/math/qalculate-gtk/default.nix
index 7ee8679308..56b6df94e8 100644
--- a/third_party/nixpkgs/pkgs/applications/science/math/qalculate-gtk/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/science/math/qalculate-gtk/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "qalculate-gtk";
-  version = "3.17.0";
+  version = "3.18.0";
 
   src = fetchFromGitHub {
     owner = "qalculate";
     repo = "qalculate-gtk";
     rev = "v${version}";
-    sha256 = "sha256-Nxe1DZL8mh9aBWXQdlp5wC1l5b9mchlrRyE+LKC+yLI=";
+    sha256 = "sha256-hE0di7B6dCnMmMBLgFkb6vPS4hS/7zD6BbviIucrn1I=";
   };
 
   hardeningDisable = [ "format" ];
diff --git a/third_party/nixpkgs/pkgs/applications/science/math/sage/default.nix b/third_party/nixpkgs/pkgs/applications/science/math/sage/default.nix
index 8ef1f5189e..e39db4b1ac 100644
--- a/third_party/nixpkgs/pkgs/applications/science/math/sage/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/science/math/sage/default.nix
@@ -19,6 +19,10 @@ let
         linbox = pkgs.linbox.override { withSage = true; };
         pkg-config = pkgs.pkg-config; # not to confuse with pythonPackages.pkg-config
       };
+
+      sage_docbuild = self.callPackage ./sage_docbuild.nix {
+        inherit sage-src;
+      };
     };
   };
 
@@ -38,14 +42,16 @@ let
     logo64 = "${sage-src}/doc/common/themes/sage/static/sageicon.png";
   };
 
+  three = callPackage ./threejs-sage.nix { };
+
   # A bash script setting various environment variables to tell sage where
   # the files its looking fore are located. Also see `sage-env`.
   env-locations = callPackage ./env-locations.nix {
     inherit pari_data;
     inherit singular maxima-ecl;
+    inherit three;
     ecl = maxima-ecl.ecl;
     cysignals = python3.pkgs.cysignals;
-    three = nodePackages.three;
     mathjax = nodePackages.mathjax;
   };
 
@@ -53,6 +59,7 @@ let
   # the env-locations file.
   sage-env = callPackage ./sage-env.nix {
     sagelib = python3.pkgs.sagelib;
+    sage_docbuild = python3.pkgs.sage_docbuild;
     inherit env-locations;
     inherit python3 singular palp flint pynac pythonEnv maxima-ecl;
     ecl = maxima-ecl.ecl;
@@ -70,8 +77,8 @@ let
     inherit python3 pythonEnv;
     inherit sage-env;
     inherit pynac singular maxima-ecl;
+    inherit three;
     pkg-config = pkgs.pkg-config; # not to confuse with pythonPackages.pkg-config
-    three = nodePackages.three;
   };
 
   # Doesn't actually build anything, just runs sages testsuite. This is a
@@ -86,6 +93,7 @@ let
 
   pythonRuntimeDeps = with python3.pkgs; [
     sagelib
+    sage_docbuild
     cvxopt
     networkx
     service-identity
diff --git a/third_party/nixpkgs/pkgs/applications/science/math/sage/patches/do-not-test-find-library.patch b/third_party/nixpkgs/pkgs/applications/science/math/sage/patches/do-not-test-find-library.patch
index 9817592023..0dbfba642e 100644
--- a/third_party/nixpkgs/pkgs/applications/science/math/sage/patches/do-not-test-find-library.patch
+++ b/third_party/nixpkgs/pkgs/applications/science/math/sage/patches/do-not-test-find-library.patch
@@ -1,13 +1,13 @@
 diff --git a/src/sage/env.py b/src/sage/env.py
-index 1ddfc7cfb9..45033d6328 100644
+index 2908f5d04f..81dfd75c0d 100644
 --- a/src/sage/env.py
 +++ b/src/sage/env.py
-@@ -203,97 +203,13 @@ var('ARB_LIBRARY',                   'arb')
- var('SAGE_BANNER', '')
- var('SAGE_IMPORTALL', 'yes')
+@@ -218,93 +218,12 @@ NTL_LIBDIR = var("NTL_LIBDIR")
+ SAGE_BANNER = var("SAGE_BANNER", "")
+ SAGE_IMPORTALL = var("SAGE_IMPORTALL", "yes")
  
 -
--def _get_shared_lib_filename(libname, *additional_libnames):
+-def _get_shared_lib_path(*libnames: str) -> Optional[str]:
 -    """
 -    Return the full path to a shared library file installed in
 -    ``$SAGE_LOCAL/lib`` or the directories associated with the
@@ -25,80 +25,76 @@ index 1ddfc7cfb9..45033d6328 100644
 -    For distributions like Debian that use a multiarch layout, we also try the
 -    multiarch lib paths (i.e. ``/usr/lib/<arch>/``).
 -
--    This returns ``None`` if the file does not exist.
+-    This returns ``None`` if no matching library file could be found.
 -
 -    EXAMPLES::
 -
 -        sage: import sys
 -        sage: from fnmatch import fnmatch
--        sage: from sage.env import _get_shared_lib_filename
--        sage: lib_filename = _get_shared_lib_filename("Singular",
--        ....:                                         "singular-Singular")
+-        sage: from sage.env import _get_shared_lib_path
+-        sage: lib_filename = _get_shared_lib_path("Singular", "singular-Singular")
 -        sage: if sys.platform == 'cygwin':
 -        ....:     pattern = "*/cygSingular-*.dll"
 -        ....: elif sys.platform == 'darwin':
--        ....:     pattern = "*/libSingular.dylib"
+-        ....:     pattern = "*/libSingular-*.dylib"
 -        ....: else:
--        ....:     pattern = "*/lib*Singular.so"
--        sage: fnmatch(lib_filename, pattern)
+-        ....:     pattern = "*/lib*Singular-*.so"
+-        sage: fnmatch(str(lib_filename), pattern)
 -        True
--        sage: _get_shared_lib_filename("an_absurd_lib") is None
+-        sage: _get_shared_lib_path("an_absurd_lib") is None
 -        True
 -    """
 -
--    for libname in (libname,) + additional_libnames:
+-    for libname in libnames:
+-        search_directories: List[Path] = []
+-        patterns: List[str] = []
 -        if sys.platform == 'cygwin':
--            # Later down we take the last matching DLL found, so search
--            # SAGE_LOCAL second so that it takes precedence
--            bindirs = [
--                sysconfig.get_config_var('BINDIR'),
--                os.path.join(SAGE_LOCAL, 'bin')
+-            # Later down we take the first matching DLL found, so search
+-            # SAGE_LOCAL first so that it takes precedence
+-            search_directories = [
+-                Path(SAGE_LOCAL) / 'bin',
+-                Path(sysconfig.get_config_var('BINDIR')),
 -            ]
--            pats = ['cyg{}.dll'.format(libname), 'cyg{}-*.dll'.format(libname)]
--            filenames = []
--            for bindir in bindirs:
--                for pat in pats:
--                    filenames += glob.glob(os.path.join(bindir, pat))
--
--            # Note: This is not very robust, since if there are multi DLL
+-            # Note: The following is not very robust, since if there are multible
 -            # versions for the same library this just selects one more or less
--            # at arbitrary.  However, practically speaking, on Cygwin, there
+-            # at arbitrary. However, practically speaking, on Cygwin, there
 -            # will only ever be one version
--            if filenames:
--                return filenames[-1]
+-            patterns = [f'cyg{libname}.dll', f'cyg{libname}-*.dll']
 -        else:
 -            if sys.platform == 'darwin':
 -                ext = 'dylib'
 -            else:
 -                ext = 'so'
 -
--            libdirs = [
--                os.path.join(SAGE_LOCAL, 'lib'),
--                sysconfig.get_config_var('LIBDIR')
--            ]
--            multilib = sysconfig.get_config_var('MULTILIB')
--            if multilib:
--                libdirs.insert(1, os.path.join(libdirs[0], multilib))
+-            search_directories = [Path(SAGE_LOCAL) / 'lib']
+-            libdir = sysconfig.get_config_var('LIBDIR')
+-            if libdir is not None:
+-                libdir = Path(libdir)
+-                search_directories.append(libdir)
 -
--            for libdir in libdirs:
--                basename = 'lib{}.{}'.format(libname, ext)
--                filename = os.path.join(libdir, basename)
--                if os.path.exists(filename):
--                    return filename
+-                multiarchlib = sysconfig.get_config_var('MULTIARCH')
+-                if multiarchlib is not None: 
+-                    search_directories.append(libdir / multiarchlib),
+-
+-            patterns = [f'lib{libname}.{ext}']
+-
+-        for directory in search_directories:
+-            for pattern in patterns:
+-                path = next(directory.glob(pattern), None)
+-                if path is not None:
+-                    return str(path.resolve())
 -
 -    # Just return None if no files were found
 -    return None
--
 -
  # locate singular shared object
  # On Debian it's libsingular-Singular so try that as well
--SINGULAR_SO = _get_shared_lib_filename('Singular', 'singular-Singular')
-+SINGULAR_SO = '/default'
- var('SINGULAR_SO', SINGULAR_SO)
+-SINGULAR_SO = var("SINGULAR_SO", _get_shared_lib_path("Singular", "singular-Singular"))
++SINGULAR_SO = var("SINGULAR_SO", '/default')
  
  # locate libgap shared object
--GAP_SO= _get_shared_lib_filename('gap','')
-+GAP_SO = '/default'
- var('GAP_SO', GAP_SO)
+-GAP_SO = var("GAP_SO", _get_shared_lib_path("gap", ""))
++GAP_SO = var("GAP_SO", '/default')
  
  # post process
+ if ' ' in DOT_SAGE:
diff --git a/third_party/nixpkgs/pkgs/applications/science/math/sage/patches/dont-grep-threejs-version-from-minified-js.patch b/third_party/nixpkgs/pkgs/applications/science/math/sage/patches/dont-grep-threejs-version-from-minified-js.patch
deleted file mode 100644
index 88cb66506b..0000000000
--- a/third_party/nixpkgs/pkgs/applications/science/math/sage/patches/dont-grep-threejs-version-from-minified-js.patch
+++ /dev/null
@@ -1,16 +0,0 @@
-diff --git a/src/sage/repl/rich_output/display_manager.py b/src/sage/repl/rich_output/display_manager.py
-index fb21f7a9c9..f39470777d 100644
---- a/src/sage/repl/rich_output/display_manager.py
-+++ b/src/sage/repl/rich_output/display_manager.py
-@@ -749,9 +749,9 @@ class DisplayManager(SageObject):
-             import sage.env
-             import re
-             import os
--            with open(os.path.join(sage.env.THREEJS_DIR, 'build', 'three.min.js')) as f:
-+            with open(os.path.join(sage.env.THREEJS_DIR, 'build', 'three.js')) as f:
-                 text = f.read().replace('\n','')
--            version = re.search(r'REVISION="(\d+)"', text).group(1)
-+            version = re.search(r"REVISION = '(\d+)'", text).group(1)
-             return """
- <script src="https://cdn.jsdelivr.net/gh/mrdoob/three.js@r{0}/build/three.min.js"></script>
- <script src="https://cdn.jsdelivr.net/gh/mrdoob/three.js@r{0}/examples/js/controls/OrbitControls.js"></script>
diff --git a/third_party/nixpkgs/pkgs/applications/science/math/sage/patches/eclib-20210223-test-formatting.patch b/third_party/nixpkgs/pkgs/applications/science/math/sage/patches/eclib-20210223-test-formatting.patch
deleted file mode 100644
index 3fdb8f768e..0000000000
--- a/third_party/nixpkgs/pkgs/applications/science/math/sage/patches/eclib-20210223-test-formatting.patch
+++ /dev/null
@@ -1,131 +0,0 @@
-diff --git a/src/sage/libs/eclib/interface.py b/src/sage/libs/eclib/interface.py
-index e898456720..6b98c12328 100644
---- a/src/sage/libs/eclib/interface.py
-+++ b/src/sage/libs/eclib/interface.py
-@@ -758,78 +758,78 @@ class mwrank_MordellWeil(SageObject):
- 
-         sage: EQ = mwrank_MordellWeil(E, verbose=True)
-         sage: EQ.search(1)
--        P1 = [0:1:0]     is torsion point, order 1
--        P1 = [-3:0:1]     is generator number 1
--        saturating up to 20...Checking 2-saturation
-+        P1 = [0:1:0]         is torsion point, order 1
-+        P1 = [-3:0:1]         is generator number 1
-+        saturating up to 20...Checking 2-saturation...
-         Points have successfully been 2-saturated (max q used = 7)
--        Checking 3-saturation
-+        Checking 3-saturation...
-         Points have successfully been 3-saturated (max q used = 7)
--        Checking 5-saturation
-+        Checking 5-saturation...
-         Points have successfully been 5-saturated (max q used = 23)
--        Checking 7-saturation
-+        Checking 7-saturation...
-         Points have successfully been 7-saturated (max q used = 41)
--        Checking 11-saturation
-+        Checking 11-saturation...
-         Points have successfully been 11-saturated (max q used = 17)
--        Checking 13-saturation
-+        Checking 13-saturation...
-         Points have successfully been 13-saturated (max q used = 43)
--        Checking 17-saturation
-+        Checking 17-saturation...
-         Points have successfully been 17-saturated (max q used = 31)
--        Checking 19-saturation
-+        Checking 19-saturation...
-         Points have successfully been 19-saturated (max q used = 37)
-         done
--        P2 = [-2:3:1]     is generator number 2
--        saturating up to 20...Checking 2-saturation
-+        P2 = [-2:3:1]         is generator number 2
-+        saturating up to 20...Checking 2-saturation...
-         possible kernel vector = [1,1]
-         This point may be in 2E(Q): [14:-52:1]
-         ...and it is!
-         Replacing old generator #1 with new generator [1:-1:1]
-         Points have successfully been 2-saturated (max q used = 7)
-         Index gain = 2^1
--        Checking 3-saturation
-+        Checking 3-saturation...
-         Points have successfully been 3-saturated (max q used = 13)
--        Checking 5-saturation
-+        Checking 5-saturation...
-         Points have successfully been 5-saturated (max q used = 67)
--        Checking 7-saturation
-+        Checking 7-saturation...
-         Points have successfully been 7-saturated (max q used = 53)
--        Checking 11-saturation
-+        Checking 11-saturation...
-         Points have successfully been 11-saturated (max q used = 73)
--        Checking 13-saturation
-+        Checking 13-saturation...
-         Points have successfully been 13-saturated (max q used = 103)
--        Checking 17-saturation
-+        Checking 17-saturation...
-         Points have successfully been 17-saturated (max q used = 113)
--        Checking 19-saturation
-+        Checking 19-saturation...
-         Points have successfully been 19-saturated (max q used = 47)
-         done (index = 2).
-         Gained index 2, new generators = [ [1:-1:1] [-2:3:1] ]
--        P3 = [-14:25:8]   is generator number 3
--        saturating up to 20...Checking 2-saturation
-+        P3 = [-14:25:8]       is generator number 3
-+        saturating up to 20...Checking 2-saturation...
-         Points have successfully been 2-saturated (max q used = 11)
--        Checking 3-saturation
-+        Checking 3-saturation...
-         Points have successfully been 3-saturated (max q used = 13)
--        Checking 5-saturation
-+        Checking 5-saturation...
-         Points have successfully been 5-saturated (max q used = 71)
--        Checking 7-saturation
-+        Checking 7-saturation...
-         Points have successfully been 7-saturated (max q used = 101)
--        Checking 11-saturation
-+        Checking 11-saturation...
-         Points have successfully been 11-saturated (max q used = 127)
--        Checking 13-saturation
-+        Checking 13-saturation...
-         Points have successfully been 13-saturated (max q used = 151)
--        Checking 17-saturation
-+        Checking 17-saturation...
-         Points have successfully been 17-saturated (max q used = 139)
--        Checking 19-saturation
-+        Checking 19-saturation...
-         Points have successfully been 19-saturated (max q used = 179)
-         done (index = 1).
--        P4 = [-1:3:1]    = -1*P1 + -1*P2 + -1*P3 (mod torsion)
--        P4 = [0:2:1]     = 2*P1 + 0*P2 + 1*P3 (mod torsion)
--        P4 = [2:13:8]    = -3*P1 + 1*P2 + -1*P3 (mod torsion)
--        P4 = [1:0:1]     = -1*P1 + 0*P2 + 0*P3 (mod torsion)
--        P4 = [2:0:1]     = -1*P1 + 1*P2 + 0*P3 (mod torsion)
--        P4 = [18:7:8]    = -2*P1 + -1*P2 + -1*P3 (mod torsion)
--        P4 = [3:3:1]     = 1*P1 + 0*P2 + 1*P3 (mod torsion)
--        P4 = [4:6:1]     = 0*P1 + -1*P2 + -1*P3 (mod torsion)
--        P4 = [36:69:64]  = 1*P1 + -2*P2 + 0*P3 (mod torsion)
--        P4 = [68:-25:64]         = -2*P1 + -1*P2 + -2*P3 (mod torsion)
--        P4 = [12:35:27]  = 1*P1 + -1*P2 + -1*P3 (mod torsion)
-+        P4 = [-1:3:1]        = -1*P1 + -1*P2 + -1*P3 (mod torsion)
-+        P4 = [0:2:1]         = 2*P1 + 0*P2 + 1*P3 (mod torsion)
-+        P4 = [2:13:8]        = -3*P1 + 1*P2 + -1*P3 (mod torsion)
-+        P4 = [1:0:1]         = -1*P1 + 0*P2 + 0*P3 (mod torsion)
-+        P4 = [2:0:1]         = -1*P1 + 1*P2 + 0*P3 (mod torsion)
-+        P4 = [18:7:8]        = -2*P1 + -1*P2 + -1*P3 (mod torsion)
-+        P4 = [3:3:1]         = 1*P1 + 0*P2 + 1*P3 (mod torsion)
-+        P4 = [4:6:1]         = 0*P1 + -1*P2 + -1*P3 (mod torsion)
-+        P4 = [36:69:64]      = 1*P1 + -2*P2 + 0*P3 (mod torsion)
-+        P4 = [68:-25:64]     = -2*P1 + -1*P2 + -2*P3 (mod torsion)
-+        P4 = [12:35:27]      = 1*P1 + -1*P2 + -1*P3 (mod torsion)
-         sage: EQ
-         Subgroup of Mordell-Weil group: [[1:-1:1], [-2:3:1], [-14:25:8]]
- 
-@@ -1076,7 +1076,7 @@ class mwrank_MordellWeil(SageObject):
-             sage: EQ.search(1)
-             P1 = [0:1:0]         is torsion point, order 1
-             P1 = [-3:0:1]         is generator number 1
--            saturating up to 20...Checking 2-saturation
-+            saturating up to 20...Checking 2-saturation...
-             ...
-             P4 = [12:35:27]      = 1*P1 + -1*P2 + -1*P3 (mod torsion)
-             sage: EQ
diff --git a/third_party/nixpkgs/pkgs/applications/science/math/sage/patches/sphinx-docbuild-subprocesses.patch b/third_party/nixpkgs/pkgs/applications/science/math/sage/patches/sphinx-docbuild-subprocesses.patch
index 661077cfa8..3c64be100d 100644
--- a/third_party/nixpkgs/pkgs/applications/science/math/sage/patches/sphinx-docbuild-subprocesses.patch
+++ b/third_party/nixpkgs/pkgs/applications/science/math/sage/patches/sphinx-docbuild-subprocesses.patch
@@ -1,8 +1,8 @@
-diff --git a/src/sage_setup/docbuild/__init__.py b/src/sage_setup/docbuild/__init__.py
-index 73a078e619..059125c59f 100644
---- a/src/sage_setup/docbuild/__init__.py
-+++ b/src/sage_setup/docbuild/__init__.py
-@@ -86,27 +86,6 @@ def builder_helper(type):
+diff --git a/src/sage_docbuild/__init__.py b/src/sage_docbuild/__init__.py
+index 79005b903a..fbe6fe2595 100644
+--- a/src/sage_docbuild/__init__.py
++++ b/src/sage_docbuild/__init__.py
+@@ -85,27 +85,6 @@ def builder_helper(type):
      """
      Returns a function which builds the documentation for
      output type ``type``.
@@ -11,16 +11,16 @@ index 73a078e619..059125c59f 100644
 -
 -    Check that :trac:`25161` has been resolved::
 -
--        sage: from sage_setup.docbuild import DocBuilder, setup_parser
+-        sage: from sage_docbuild import DocBuilder, setup_parser
 -        sage: DocBuilder._options = setup_parser().parse_args([])[0] # builder_helper needs _options to be set
 -
--        sage: import sage_setup.docbuild.sphinxbuild
+-        sage: import sage_docbuild.sphinxbuild
 -        sage: def raiseBaseException():
 -        ....:     raise BaseException("abort pool operation")
--        sage: original_runsphinx, sage_setup.docbuild.sphinxbuild.runsphinx = sage_setup.docbuild.sphinxbuild.runsphinx, raiseBaseException
+-        sage: original_runsphinx, sage_docbuild.sphinxbuild.runsphinx = sage_docbuild.sphinxbuild.runsphinx, raiseBaseException
 -
--        sage: from sage_setup.docbuild import builder_helper, build_ref_doc
--        sage: from sage_setup.docbuild import _build_many as build_many
+-        sage: from sage_docbuild import builder_helper, build_ref_doc
+-        sage: from sage_docbuild import _build_many as build_many
 -        sage: helper = builder_helper("html")
 -        sage: try:
 -        ....:     build_many(build_ref_doc, [("docname", "en", "html", {})])
@@ -30,24 +30,24 @@ index 73a078e619..059125c59f 100644
      """
      def f(self, *args, **kwds):
          output_dir = self._output_dir(type)
-@@ -128,10 +107,9 @@ def builder_helper(type):
+@@ -127,10 +106,9 @@ def builder_helper(type):
          logger.debug(build_command)
  
          # Run Sphinx with Sage's special logger
 -        sys.argv = ["sphinx-build"] + build_command.split()
 -        from .sphinxbuild import runsphinx
-+        args = "python3 -um sage_setup.docbuild.sphinxbuild -N".split() + build_command.split()
++        args = "python3 -um sage_docbuild.sphinxbuild -N".split() + build_command.split()
          try:
 -            runsphinx()
 +            subprocess.check_call(args)
          except Exception:
              if ABORT_ON_ERROR:
                  raise
-diff --git a/src/sage_setup/docbuild/sphinxbuild.py b/src/sage_setup/docbuild/sphinxbuild.py
-index fe7eba43b2..463790965c 100644
---- a/src/sage_setup/docbuild/sphinxbuild.py
-+++ b/src/sage_setup/docbuild/sphinxbuild.py
-@@ -321,3 +321,8 @@ def runsphinx():
+diff --git a/src/sage_docbuild/sphinxbuild.py b/src/sage_docbuild/sphinxbuild.py
+index f58f6c61d7..ef51a55411 100644
+--- a/src/sage_docbuild/sphinxbuild.py
++++ b/src/sage_docbuild/sphinxbuild.py
+@@ -326,3 +326,8 @@ def runsphinx():
          sys.stderr = saved_stderr
          sys.stdout.flush()
          sys.stderr.flush()
diff --git a/third_party/nixpkgs/pkgs/applications/science/math/sage/patches/sympy-1.7-update.patch b/third_party/nixpkgs/pkgs/applications/science/math/sage/patches/sympy-1.7-update.patch
deleted file mode 100644
index 1d21622a23..0000000000
--- a/third_party/nixpkgs/pkgs/applications/science/math/sage/patches/sympy-1.7-update.patch
+++ /dev/null
@@ -1,25 +0,0 @@
-diff --git a/src/sage/interfaces/sympy.py b/src/sage/interfaces/sympy.py
-index cc35a42a9f..6e577d5d8d 100644
---- a/src/sage/interfaces/sympy.py
-+++ b/src/sage/interfaces/sympy.py
-@@ -397,7 +397,7 @@ def _sympysage_rf(self):
-         sage: from sympy import Symbol, rf
-         sage: _ = var('x, y')
-         sage: rfxy = rf(Symbol('x'), Symbol('y'))
--        sage: assert rising_factorial(x,y)._sympy_() == rfxy.rewrite('gamma')
-+        sage: assert rising_factorial(x,y)._sympy_() == rfxy.rewrite('gamma', piecewise=False)
-         sage: assert rising_factorial(x,y) == rfxy._sage_()
-     """
-     from sage.arith.all import rising_factorial
-diff --git a/src/sage/symbolic/expression.pyx b/src/sage/symbolic/expression.pyx
-index 7c18ec1efa..c2619ac42d 100644
---- a/src/sage/symbolic/expression.pyx
-+++ b/src/sage/symbolic/expression.pyx
-@@ -955,6 +955,6 @@ cdef class Expression(CommutativeRingElement):
-             sage: unicode_art(13 - I)
-             13 - ⅈ
-             sage: unicode_art(1.3 - I)
--            1.3 - 1.0⋅ⅈ
-+            1.3 - ⅈ
-             sage: unicode_art(cos(I))
-             cosh(1)
diff --git a/third_party/nixpkgs/pkgs/applications/science/math/sage/sage-env.nix b/third_party/nixpkgs/pkgs/applications/science/math/sage/sage-env.nix
index 568a4a39f3..fd67076c97 100644
--- a/third_party/nixpkgs/pkgs/applications/science/math/sage/sage-env.nix
+++ b/third_party/nixpkgs/pkgs/applications/science/math/sage/sage-env.nix
@@ -2,6 +2,7 @@
 , lib
 , writeTextFile
 , sagelib
+, sage_docbuild
 , env-locations
 , gfortran
 , bash
@@ -191,6 +192,7 @@ writeTextFile rec {
   # for find_library
     export DYLD_LIBRARY_PATH="${lib.makeLibraryPath [stdenv.cc.libc singular]}''${DYLD_LIBRARY_PATH:+:}$DYLD_LIBRARY_PATH"
   '';
-} // {
-  lib = sagelib; # equivalent of `passthru`, which `writeTextFile` doesn't support
+} // { # equivalent of `passthru`, which `writeTextFile` doesn't support
+  lib = sagelib;
+  docbuild = sage_docbuild;
 }
diff --git a/third_party/nixpkgs/pkgs/applications/science/math/sage/sage-src.nix b/third_party/nixpkgs/pkgs/applications/science/math/sage/sage-src.nix
index 1fb605b359..91e855777f 100644
--- a/third_party/nixpkgs/pkgs/applications/science/math/sage/sage-src.nix
+++ b/third_party/nixpkgs/pkgs/applications/science/math/sage/sage-src.nix
@@ -24,14 +24,14 @@ let
   );
 in
 stdenv.mkDerivation rec {
-  version = "9.2";
+  version = "9.3.rc4";
   pname = "sage-src";
 
   src = fetchFromGitHub {
     owner = "sagemath";
     repo = "sage";
     rev = version;
-    sha256 = "103j8d5x6szl9fxaz0dvdi4y47q1af9h9y5hmjh2xayi62qmp5ql";
+    sha256 = "sha256-LDY07By2j6JagkgT9zeDJ93+m2/oXXEnDRTDzmR8ftk=";
   };
 
   # Patches needed because of particularities of nix or the way this is packaged.
@@ -53,14 +53,6 @@ stdenv.mkDerivation rec {
     # Parallelize docubuild using subprocesses, fixing an isolation issue. See
     # https://groups.google.com/forum/#!topic/sage-packaging/YGOm8tkADrE
     ./patches/sphinx-docbuild-subprocesses.patch
-
-    # Register sorted dict pprinter earlier (https://trac.sagemath.org/ticket/31053)
-    (fetchSageDiff {
-      base = "9.3.beta4";
-      name = "register-pretty-printer-earlier.patch";
-      rev = "d658230ce06ca19f4a3b3a4576297ee82f2d2151";
-      sha256 = "sha256-9mPUV7K5PoLDH2vVaYaOfvDLDpmxU0Aj7m/eaXYotDs=";
-    })
   ];
 
   # Since sage unfortunately does not release bugfix releases, packagers must
@@ -70,31 +62,6 @@ stdenv.mkDerivation rec {
     # To help debug the transient error in
     # https://trac.sagemath.org/ticket/23087 when it next occurs.
     ./patches/configurationpy-error-verbose.patch
-
-    # fix intermittent errors in Sage 9.2's psage.py (this patch is
-    # already included in Sage 9.3): https://trac.sagemath.org/ticket/30730
-    (fetchSageDiff {
-      base = "9.2.rc2";
-      name = "fix-psage-is-locked.patch";
-      rev = "75df605f216ddc7b6ca719be942d666b241520e9";
-      sha256 = "0g9pl1wbb3sgs26d3bvv70cpa77sfskylv4kd255y1794f1fgk4q";
-    })
-
-    # fix intermittent errors in sagespawn.pyx: https://trac.sagemath.org/ticket/31052
-    (fetchSageDiff {
-      base = "9.2";
-      name = "sagespawn-implicit-casting.patch";
-      rev = "2959ac792ebd6107fe87c9af1541083de5ba02d6";
-      sha256 = "sha256-bWIpEGir9Kawak5CJegBMNcHm/CqhWmdru+emeSsvO0=";
-    })
-
-    # fix intermittent errors in doctest/test.py: https://trac.sagemath.org/ticket/26912
-    (fetchSageDiff {
-      base = "9.3.beta8";
-      name = "set-cysignals-crash-ndebug.patch";
-      rev = "ca5257a5d0f32efc9f8f07e126020856270b1a18";
-      sha256 = "sha256-KViw63xE3O0eUiOYzoxNrr4NL+csql9GPJLDJCf/EZs=";
-    })
   ];
 
   # Patches needed because of package updates. We could just pin the versions of
@@ -111,120 +78,29 @@ stdenv.mkDerivation rec {
 
     # ignore a deprecation warning for usage of `cmp` in the attrs library in the doctests
     ./patches/ignore-cmp-deprecation.patch
-
-    # adapt sage's Image class to pillow 8.0.1 (https://trac.sagemath.org/ticket/30971)
-    (fetchSageDiff {
-      base = "9.3.beta2";
-      name = "pillow-8.0.1-update.patch";
-      rev = "f05f2d0aac9c4b5abe68105cee2cc7f2c8461847";
-      sha256 = "sha256-uY2UlgSd5hhOUUukB4Xc3Gjy0/e7p/qyq9jdvz10IOs=";
-    })
-
-    # don't use deprecated numpy type aliases (https://trac.sagemath.org/ticket/31364)
-    (fetchSageDiff {
-      base = "9.3.beta7";
-      name = "dont-use-deprecated-numpy-type-aliases.patch";
-      rev = "dfdef60515d4a4269e82d91280f76a7fdf10bf97";
-      sha256 = "sha256-77/3LkT5J7DQN8IPlGJKB6ZcJPaF7xwje06JNns+0AE=";
-    })
-
-    # fix test output with sympy 1.7 (https://trac.sagemath.org/ticket/30985)
-    ./patches/sympy-1.7-update.patch
-
-    # workaround until we use sage's fork of threejs, which contains a "version" file
-    ./patches/dont-grep-threejs-version-from-minified-js.patch
-
-    # updated eclib output has punctuation changes and tidier whitespace
-    ./patches/eclib-20210223-test-formatting.patch
-
-    # upgrade arb to 2.18.1 (https://trac.sagemath.org/ticket/28623)
-    (fetchSageDiff {
-      base = "9.3.beta3";
-      name = "arb-2.18.1-update.patch";
-      rev = "0c9c4ed35c2eaf34ae0d19387c07b7f460e4abce";
-      sha256 = "sha256-CjOJIsyyVCziAfvE6pWSihPO35IZMcY2/taXAsqhPLY=";
-    })
-
-    # giac 1.6.0-47 update (https://trac.sagemath.org/ticket/30537)
-    (fetchSageDiff {
-      base = "9.3.beta7";
-      name = "giac-1.6.0-47-update.patch";
-      rev = "f05720bf63dfaf33a4e3b6d3ed2c2c0ec46b5d31";
-      sha256 = "sha256-gDUq+84eXd5GxLBWUSI61GMJpBF2KX4LBVOt3mS1NF8=";
-    })
-
-    # Make gcd/lcm interact better with pari and gmpy2 (https://trac.sagemath.org/ticket/30849)
-    # needed for pari 2.13.1 update, which we will do in the future
-    (fetchSageDiff {
-      base = "9.3.beta0";
-      name = "make-gcd-lcm-interact-better-with-pari-and-gmpy2.patch";
-      rev = "75c1516f0abb9e6f8c335e38e4031f6ef674ed30";
-      sha256 = "sha256-RukkieIZcXNrju904H2oyGKdtpdE+9vNzvyjN2IBNg0=";
-    })
-
-    # cypari 2.1.2 update (https://trac.sagemath.org/ticket/31029)
-    (fetchSageDiff {
-      base = "9.3.beta3";
-      name = "cypari-2.1.2-update.patch";
-      rev = "b9aadfd08e81d74ca7c229bb80eb853b592887d0";
-      sha256 = "sha256-eKaMy7kpu+YKdL8bPStgocxBCTfc2Z/10RrGy2LENFw=";
-    })
   ];
 
   patches = nixPatches ++ bugfixPatches ++ packageUpgradePatches;
 
   postPatch = ''
-    # make sure shebangs etc are fixed, but sage-python23 still works
-    find . -type f -exec sed \
-      -e 's/sage-python23/python3/g' \
-      -i {} \;
-
-    echo '#!${runtimeShell}
-    python3 "$@"' > build/bin/sage-python23
-
     # Make sure sage can at least be imported without setting any environment
     # variables. It won't be close to feature complete though.
     sed -i \
-      "s|var('SAGE_ROOT'.*|var('SAGE_ROOT', '$out')|" \
+      "s|var(\"SAGE_ROOT\".*|var(\"SAGE_ROOT\", \"$out\")|" \
       src/sage/env.py
 
-    # Do not use sage-env-config (generated by ./configure).
-    # Instead variables are set manually.
-    echo '# do nothing' >  src/bin/sage-env-config
-  '';
+    # src/doc/en/reference/spkg/conf.py expects index.rst in its directory,
+    # a list of external packages in the sage distribution (build/pkgs)
+    # generated by the bootstrap script (which we don't run).  this is not
+    # relevant for other distributions, so remove it.
+    rm src/doc/en/reference/spkg/conf.py
+    sed -i "/spkg/d" src/doc/en/reference/index.rst
 
-  # Test src/doc/en/reference/spkg/conf.py will fail if
-  # src/doc/en/reference/spkg/index.rst is not generated.  It is
-  # generated by src/doc/bootstrap, so I've copied the relevant part
-  # here. An alternative would be to create an empty
-  # src/doc/en/reference/spkg/index.rst file.
-  configurePhase = ''
-    OUTPUT_DIR="src/doc/en/reference/spkg"
-    mkdir -p "$OUTPUT_DIR"
-    OUTPUT_INDEX="$OUTPUT_DIR"/index.rst
-    cat > "$OUTPUT_INDEX" <<EOF
-
-    External Packages
-    =================
-
-    .. toctree::
-       :maxdepth: 1
-
-    EOF
-    for PKG_SCRIPTS in build/pkgs/*; do
-        if [ -d "$PKG_SCRIPTS" ]; then
-            PKG_BASE=$(basename "$PKG_SCRIPTS")
-            if [ -f "$PKG_SCRIPTS"/SPKG.rst ]; then
-                # Instead of just copying, we may want to call
-                # a version of sage-spkg-info to format extra information.
-                cp "$PKG_SCRIPTS"/SPKG.rst "$OUTPUT_DIR"/$PKG_BASE.rst
-                echo >> "$OUTPUT_INDEX" "   $PKG_BASE"
-            fi
-        fi
-    done
-    cat >> "$OUTPUT_INDEX" <<EOF
-    .. include:: ../footer.txt
-    EOF
+    # the bootstrap script also generates installation instructions for
+    # arch, debian, fedora, cygwin and homebrew using data from build/pkgs.
+    # we don't run the bootstrap script, so disable including the generated
+    # files. docbuilding fails otherwise.
+    sed -i "/literalinclude/d" src/doc/en/installation/source.rst
   '';
 
   buildPhase = "# do nothing";
diff --git a/third_party/nixpkgs/pkgs/applications/science/math/sage/sage_docbuild.nix b/third_party/nixpkgs/pkgs/applications/science/math/sage/sage_docbuild.nix
new file mode 100644
index 0000000000..ed78d46b44
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/applications/science/math/sage/sage_docbuild.nix
@@ -0,0 +1,20 @@
+{ buildPythonPackage
+, sage-src
+, sphinx
+}:
+
+buildPythonPackage rec {
+  version = src.version;
+  pname = "sage_docbuild";
+  src = sage-src;
+
+  propagatedBuildInputs = [
+    sphinx
+  ];
+
+  preBuild = ''
+    cd build/pkgs/sage_docbuild/src
+  '';
+
+  doCheck = false; # we will run tests in sagedoc.nix
+}
diff --git a/third_party/nixpkgs/pkgs/applications/science/math/sage/sagedoc.nix b/third_party/nixpkgs/pkgs/applications/science/math/sage/sagedoc.nix
index a10672f3a0..603c1a585c 100644
--- a/third_party/nixpkgs/pkgs/applications/science/math/sage/sagedoc.nix
+++ b/third_party/nixpkgs/pkgs/applications/science/math/sage/sagedoc.nix
@@ -23,6 +23,7 @@ stdenv.mkDerivation rec {
     jmol
     cddlib
   ] ++ (with python3.pkgs; [
+    sage_docbuild
     psutil
     future
     sphinx
@@ -44,13 +45,6 @@ stdenv.mkDerivation rec {
     chmod -R 755 "$SAGE_DOC_SRC_OVERRIDE"
   '';
 
-  postPatch = ''
-    # src/doc/bootstrap generates installation instructions for
-    # arch, debian, fedora, cygwin and homebrew. as a hack, disable
-    # including the generated files.
-    sed -i "/literalinclude/d" $SAGE_DOC_SRC_OVERRIDE/en/installation/source.rst
-  '';
-
   buildPhase = ''
     export SAGE_NUM_THREADS="$NIX_BUILD_CORES"
     export HOME="$TMPDIR/sage_home"
@@ -59,13 +53,13 @@ stdenv.mkDerivation rec {
     # needed to link them in the sage docs using intersphinx
     export PPLPY_DOCS=${python3.pkgs.pplpy.doc}/share/doc/pplpy
 
-    # adapted from src/doc/bootstrap
+    # adapted from src/doc/bootstrap (which we don't run)
     OUTPUT_DIR="$SAGE_DOC_SRC_OVERRIDE/en/reference/repl"
     mkdir -p "$OUTPUT_DIR"
     OUTPUT="$OUTPUT_DIR/options.txt"
     ${sage-with-env}/bin/sage -advanced > "$OUTPUT"
 
-    ${sage-with-env}/bin/sage -python -m sage_setup.docbuild \
+    ${sage-with-env}/bin/sage --docbuild \
       --mathjax \
       --no-pdf-links \
       all html
diff --git a/third_party/nixpkgs/pkgs/applications/science/math/sage/sagelib.nix b/third_party/nixpkgs/pkgs/applications/science/math/sage/sagelib.nix
index 245ddcedee..f60cb64d2e 100644
--- a/third_party/nixpkgs/pkgs/applications/science/math/sage/sagelib.nix
+++ b/third_party/nixpkgs/pkgs/applications/science/math/sage/sagelib.nix
@@ -63,7 +63,6 @@ assert (!blas.isILP64) && (!lapack.isILP64);
 # `sage-tests` and will not have html docs without `sagedoc`.
 
 buildPythonPackage rec {
-  format = "other";
   version = src.version;
   pname = "sagelib";
   src = sage-src;
@@ -74,6 +73,7 @@ buildPythonPackage rec {
     jupyter_core
     pkg-config
     pip # needed to query installed packages
+    ecl
   ];
 
   buildInputs = [
@@ -130,7 +130,7 @@ buildPythonPackage rec {
     sqlite
   ];
 
-  buildPhase = ''
+  preBuild = ''
     export SAGE_ROOT="$PWD"
     export SAGE_LOCAL="$SAGE_ROOT"
     export SAGE_SHARE="$SAGE_LOCAL/share"
@@ -146,15 +146,13 @@ buildPythonPackage rec {
     mkdir -p "$SAGE_SHARE/sage/ext/notebook-ipython"
     mkdir -p "var/lib/sage/installed"
 
-    source build/bin/sage-dist-helpers
-    cd src
-
-    ${python.interpreter} -u setup.py --no-user-cfg build
+    # src/setup.py should not be used, see https://trac.sagemath.org/ticket/31377#comment:124
+    cd build/pkgs/sagelib/src
   '';
 
-  installPhase = ''
-    ${python.interpreter} -u setup.py --no-user-cfg install --prefix=$out
-
+  postInstall = ''
     rm -r "$out/${python.sitePackages}/sage/cython_debug"
   '';
+
+  doCheck = false; # we will run tests in sage-tests.nix
 }
diff --git a/third_party/nixpkgs/pkgs/applications/science/math/sage/threejs-sage.nix b/third_party/nixpkgs/pkgs/applications/science/math/sage/threejs-sage.nix
new file mode 100644
index 0000000000..0e4ad4dee9
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/applications/science/math/sage/threejs-sage.nix
@@ -0,0 +1,18 @@
+{ stdenv, fetchFromGitHub }:
+
+stdenv.mkDerivation rec {
+  pname = "threejs-sage";
+  version = "r122";
+
+  src = fetchFromGitHub {
+    owner = "sagemath";
+    repo = "threejs-sage";
+    rev = version;
+    sha256 = "sha256-xPAPt36Fon3hYQq6SOmGkIyUzAII2LMl10nqYG4UPI0=";
+  };
+
+  installPhase = ''
+    mkdir -p $out/lib/node_modules/three
+    cp -r build version $out/lib/node_modules/three
+  '';
+}
diff --git a/third_party/nixpkgs/pkgs/applications/science/math/singular/default.nix b/third_party/nixpkgs/pkgs/applications/science/math/singular/default.nix
index fad05099a7..695af3d174 100644
--- a/third_party/nixpkgs/pkgs/applications/science/math/singular/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/science/math/singular/default.nix
@@ -1,57 +1,96 @@
-{ stdenv, fetchurl, gmp, bison, perl, ncurses, readline, coreutils, pkg-config
+{ stdenv, fetchFromGitHub, gmp, bison, perl, ncurses, readline, coreutils, pkg-config
 , lib
 , fetchpatch
 , autoreconfHook
+, sharutils
 , file
 , flint
 , ntl
 , cddlib
-, enableFactory ? true
+, gfan
+, lrcalc
+, doxygen
+, graphviz
+# upstream generates docs with texinfo 4. later versions of texinfo
+# use letters instead of numbers for post-appendix chapters, and we
+# want it to match the upstream format because sage depends on it.
+, texinfo4
+, texlive
+, enableDocs ? true
 , enableGfanlib ? true
 }:
 
 stdenv.mkDerivation rec {
   pname = "singular";
-  version = "4.1.1p2";
+  version = "4.2.0p2";
 
-  src = let
-    # singular sorts its tarballs in directories by base release (without patch version)
-    # for example 4.1.1p1 will be in the directory 4-1-1
-    baseVersion = builtins.head (lib.splitString "p" version);
-    urlVersion = builtins.replaceStrings [ "." ] [ "-" ] baseVersion;
-  in
-  fetchurl {
-    url = "http://www.mathematik.uni-kl.de/ftp/pub/Math/Singular/SOURCES/${urlVersion}/singular-${version}.tar.gz";
-    sha256 = "07x9kri8vl4galik7lr6pscq3c51n8570pyw64i7gbj0m706f7wf";
+  # since the tarball does not contain tests or documentation (and
+  # there is no separate tests tarball for 4.2.0), we fetch from
+  # GitHub.
+  src = fetchFromGitHub {
+    owner = "Singular";
+    repo = "Singular";
+
+    # 4.2.0p2 is not tagged, but the tarball matches commit
+    # 6f68939ddf612d96e3caaaaa8275f77613ac1da8. the commit below has
+    # two extra fixes.
+    rev = "3cda50c00a849455efa2502e56596955491a353a";
+    sha256 = "sha256-OizPhGE6L2LTOrKfeDdDB6BSdvYkDVXvbbYjV14hnHM=";
+
+    # if a release is tagged it will be in the format below.
+    # rev = "Release${lib.replaceStrings ["."] ["-"] version}";
+
+    # the repository's .gitattributes file contains the lines "/Tst/
+    # export-ignore" and "/doc/ export-ignore" so some directories are
+    # not included in the tarball downloaded by fetchzip. setting
+    # fetchSubmodules works around this by using fetchgit instead of
+    # fetchzip.
+    fetchSubmodules = true;
   };
 
+  patches = [
+    # add aarch64 support to cpu-check.m4. copied from redhat.
+    ./redhat-aarch64.patch
+
+    # vspace causes hangs in modstd and other libraries on aarch64
+    ./disable-vspace-on-aarch64.patch
+
+    # the newest version of ax-prog-cc-for-build.m4 seems to trigger
+    # linker errors. see
+    # https://github.com/alsa-project/alsa-firmware/issues/3 for a
+    # related issue.
+    ./use-older-ax-prog-cc-for-build.patch
+  ] ++ lib.optionals enableDocs [
+    # singular supports building without 4ti2, bertini, normaliz or
+    # topcom just fine, but the docbuilding does not skip manual pages
+    # tagged as depending on those binaries (probably a bug in
+    # doc2tex.pl::HandleLib, since it seems to ignore "-exclude"
+    # argumens). skip them manually.
+    ./disable-docs-for-optional-unpackaged-deps.patch
+  ];
+
   configureFlags = [
     "--with-ntl=${ntl}"
-  ] ++ lib.optionals enableFactory [
-    "--enable-factory"
+    "--disable-pyobject-module"
+  ] ++ lib.optionals enableDocs [
+    "--enable-doc-build"
   ] ++ lib.optionals enableGfanlib [
     "--enable-gfanlib"
   ];
 
-  postUnpack = ''
+  prePatch = ''
+    # don't let the tests depend on `hostname`
+    substituteInPlace Tst/regress.cmd --replace 'mysystem_catch("hostname")' 'nix_test_runner'
+
     patchShebangs .
+  '' + lib.optionalString enableDocs ''
+    # work around encoding problem
+    sed -i -e 's/\xb7/@cdot{}/g' doc/decodegb.doc
   '';
 
-  patches = [
-    # NTL error handler was introduced in the library part, preventing users of
-    # the library from implementing their own error handling
-    # https://www.singular.uni-kl.de/forum/viewtopic.php?t=2769
-    (fetchpatch {
-      name = "move_error_handler_out_of_libsingular.patch";
-      # rebased version of https://github.com/Singular/Sources/commit/502cf86d0bb2a96715be6764774b64a69c1ca34c.patch
-      url = "https://git.sagemath.org/sage.git/plain/build/pkgs/singular/patches/singular-ntl-error-handler.patch?h=50b9ae2fd233c30860e1cbb3e63a26f2cc10560a";
-      sha256 = "0vgh4m9zn1kjl0br68n04j4nmn5i1igfn28cph0chnwf7dvr9194";
-    })
-  ];
-
   # For reference (last checked on commit 75f460d):
-  # https://github.com/Singular/Sources/blob/spielwiese/doc/Building-Singular-from-source.md
-  # https://github.com/Singular/Sources/blob/spielwiese/doc/external-packages-dynamic-modules.md
+  # https://github.com/Singular/Singular/blob/spielwiese/doc/Building-Singular-from-source.md
+  # https://github.com/Singular/Singular/blob/spielwiese/doc/external-packages-dynamic-modules.md
   buildInputs = [
     # necessary
     gmp
@@ -60,6 +99,8 @@ stdenv.mkDerivation rec {
     readline
     ntl
     flint
+    lrcalc
+    gfan
   ] ++ lib.optionals enableGfanlib [
     cddlib
   ];
@@ -68,6 +109,12 @@ stdenv.mkDerivation rec {
     perl
     pkg-config
     autoreconfHook
+    sharutils # needed for regress.cmd install checks
+  ] ++ lib.optionals enableDocs [
+    doxygen
+    graphviz
+    texinfo4
+    texlive.combined.scheme-small
   ];
 
   preAutoreconf = ''
@@ -85,23 +132,62 @@ stdenv.mkDerivation rec {
     # do nothing
   '';
 
+  doCheck = true; # very basic checks, does not test any libraries
+
   installPhase = ''
     mkdir -p "$out"
     cp -r Singular/LIB "$out/lib"
     make install
-
+  '' + lib.optionalString enableDocs ''
+    # Sage uses singular.hlp (which is not in the tarball)
+    mkdir -p $out/share/info
+    cp doc/singular.hlp $out/share/info
+  '' + ''
     # Make sure patchelf picks up the right libraries
     rm -rf libpolys factory resources omalloc Singular
   '';
 
+  # singular tests are a bit complicated, see
+  # https://github.com/Singular/Singular/tree/spielwiese/Tst
+  # https://www.singular.uni-kl.de/forum/viewtopic.php&t=2773
+  testsToRun = [
+    "Old/universal.lst"
+    "Buch/buch.lst"
+    "Plural/short.lst"
+    "Old/factor.tst"
+  ] ++ lib.optionals enableGfanlib [
+    # tests that require gfanlib
+    "Short/ok_s.lst"
+  ];
+
   # simple test to make sure singular starts and finds its libraries
   doInstallCheck = true;
   installCheckPhase = ''
+    # Very basic sanity check to make sure singular starts and finds its libraries.
+    # This is redundant with the below tests. It is only kept because the singular test
+    # runner is a bit complicated. In case we decide to give up those tests in the future,
+    # this will still be useful. It takes barely any time.
     "$out/bin/Singular" -c 'LIB "freegb.lib"; exit;'
     if [ $? -ne 0 ]; then
         echo >&2 "Error loading the freegb library in Singular."
         exit 1
     fi
+
+    # Run the test suite
+    cd Tst
+    perl ./regress.cmd \
+      -s "$out/bin/Singular" \
+      ${lib.concatStringsSep " " (map lib.escapeShellArg testsToRun)} \
+      2>"$TMPDIR/out-err.log"
+
+    # unfortunately regress.cmd always returns exit code 0, so check stderr
+    # https://www.singular.uni-kl.de/forum/viewtopic.php&t=2773
+    if [[ -s "$TMPDIR/out-err.log" ]]; then
+      cat "$TMPDIR/out-err.log"
+      exit 1
+    fi
+
+    echo "Exit status $?"
   '';
 
   enableParallelBuilding = true;
@@ -110,6 +196,7 @@ stdenv.mkDerivation rec {
     description = "A CAS for polynomial computations";
     maintainers = teams.sage.members;
     # 32 bit x86 fails with some link error: `undefined reference to `__divmoddi4@GCC_7.0.0'`
+    # https://www.singular.uni-kl.de:8002/trac/ticket/837
     platforms = subtractLists platforms.i686 platforms.unix;
     license = licenses.gpl3; # Or GPLv2 at your option - but not GPLv4
     homepage = "http://www.singular.uni-kl.de";
diff --git a/third_party/nixpkgs/pkgs/applications/science/math/singular/disable-docs-for-optional-unpackaged-deps.patch b/third_party/nixpkgs/pkgs/applications/science/math/singular/disable-docs-for-optional-unpackaged-deps.patch
new file mode 100644
index 0000000000..46d92922f3
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/applications/science/math/singular/disable-docs-for-optional-unpackaged-deps.patch
@@ -0,0 +1,112 @@
+commit 9e8b044d982e132cf35a106a1cc0cf7e77b27f7c
+Author: Mauricio Collares <mauricio@collares.org>
+Date:   Thu Apr 15 20:33:21 2021 -0300
+
+    Disable manual sections using optional packages not yet in Nixpkgs
+
+        * normaliz.lib depends on normaliz.
+        * polymake.lib depends on topcom.
+        * recover.lib depends on bertini.
+        * sing4ti2.lib depends on 4ti2.
+        * tateProdCplxNegGrad.lib uses multigrading.lib, which depends on 4ti2.
+
+diff --git a/doc/singular.doc b/doc/singular.doc
+index 64b969d39..e704f95f0 100644
+--- a/doc/singular.doc
++++ b/doc/singular.doc
+@@ -407,7 +407,6 @@ LIB "all.lib";
+ * nfmodsyz_lib:: Syzygy modules of submodules of free modules over algebraic number fields
+ * noether_lib:: Noether normalization of an ideal
+ * normal_lib:: procedure for normalization
+-* normaliz_lib:: integral closure, normalization for monomial ideals, toric ideals
+ * pointid_lib:: factorized lex GB of the vanishing ideal of a set of points
+ * primdec_lib:: procedures for primary decomposition
+ * primdecint_lib:: primary decomposition over the integers
+@@ -416,7 +415,6 @@ LIB "all.lib";
+ * reesclos_lib:: Rees Algebra and integral closure of an ideal
+ * rstandard_lib:: Janet bases and border bases for ideals
+ * sagbi_lib:: Subalgebras bases Analogous to Groebner bases for ideals
+-* sing4ti2_lib:: interface to program 4ti2
+ * symodstd_lib:: Groebner bases for symmetric ideals
+ * toric_lib:: toric ideals
+ @end menu
+@@ -521,10 +519,6 @@ LIB "all.lib";
+ @node normal_lib
+ @subsection normal_lib
+ @c lib normal.lib
+-@c ---------------------------------------------------------
+-@node normaliz_lib
+-@subsection normaliz_lib
+-@c lib normaliz.lib tag:normaliz
+ @c ----------------------------------------------------------
+ @node pointid_lib
+ @subsection pointid_lib
+@@ -558,10 +552,6 @@ LIB "all.lib";
+ @subsection sagbi_lib
+ @c lib sagbi.lib
+ @c ---------------------------------------------------------
+-@node sing4ti2_lib
+-@subsection sing4ti2_lib
+-@c lib sing4ti2.lib tag:sing4ti2
+-@c ----------------------------------------------------------
+ @node symodstd_lib
+ @subsection symodstd_lib
+ @c lib symodstd.lib
+@@ -873,7 +863,6 @@ iniD, reslist, sumlist, dividelist, createlist
+ * solve_lib:: procedures to solve polynomial systems
+ * triang_lib:: procedures for decomposing zero-dimensional ideals
+ * ntsolve_lib:: one real solution of polynomial systems (Newton iteration)
+-* recover_lib:: Hybrid numerical/symbolical algorithms
+ * rootisolation_lib:: real root isolation with intervals
+ * signcond_lib:: computing realizable sign conditions
+ * zeroset_lib:: procedures for roots and factorization
+@@ -904,10 +893,6 @@ iniD, reslist, sumlist, dividelist, createlist
+ @subsection ntsolve_lib
+ @c lib ntsolve.lib
+ @c ---------------------------------------------------------
+-@node recover_lib
+-@subsection recover_lib
+-@c lib recover.lib tag:bertini
+-@c ----------------------------------------------------------
+ @node rootisolation_lib
+ @subsection rootisolation_lib
+ @c lib rootisolation.lib
+@@ -1108,7 +1093,6 @@ but not for serious computations.
+ * cimonom_lib:: complete intersection for toric ideals
+ * gfan_lib:: A gfanlib interface for Singular
+ * gitfan_lib:: Compute GIT-fans
+-* polymake_lib:: interface to TOPCOM
+ * realizationMatroids_lib:: Realizability for Tropical Fan Curves
+ * tropical_lib:: interface to gfan
+ * tropicalNewton_lib:: Newton polygons in tropical geometry
+@@ -1125,10 +1109,7 @@ but not for serious computations.
+ @node gitfan_lib
+ @subsection gitfan_lib
+ @c lib gitfan.lib
+-@c ----------------------------------------------------------
+-@node polymake_lib
+-@subsection polymake_lib
+-@c lib polymake.lib tag:topcom
++
+ @c ----------------------------------------------------------
+ @node realizationMatroids_lib
+ @subsection realizationMatroids_lib
+@@ -1219,7 +1200,6 @@ Comments should be send to the author of the library directly.
+ * stanleyreisner_lib:: T1 and T2 for a general Stanley-Reiser ring
+ * swalk_lib:: Sagbi Walk Conversion Algorithm
+ * systhreads_lib:: multi-threaded objects
+-* tateProdCplxNegGrad_lib:: sheaf cohomology on product of projective spaces
+ * VecField_lib:: vector fields
+ @end menu
+ @c ----------------------------------------------------------
+@@ -1310,10 +1290,6 @@ Todos/Issues:
+ @subsection systhreads_lib
+ @c lib systhreads.lib
+ @c ---------------------------------------------------------
+-@node tateProdCplxNegGrad_lib
+-@subsection tateProdCplxNegGrad_lib
+-@c lib tateProdCplxNegGrad.lib
+-@c ---------------------------------------------------------
+ @node VecField_lib
+ @subsection VecField_lib
+ @c lib VecField.lib
diff --git a/third_party/nixpkgs/pkgs/applications/science/math/singular/disable-vspace-on-aarch64.patch b/third_party/nixpkgs/pkgs/applications/science/math/singular/disable-vspace-on-aarch64.patch
new file mode 100644
index 0000000000..3e51b7fb2c
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/applications/science/math/singular/disable-vspace-on-aarch64.patch
@@ -0,0 +1,15 @@
+diff --git a/kernel/mod2.h b/kernel/mod2.h
+index 867fcae47..2abd84f23 100644
+--- a/kernel/mod2.h
++++ b/kernel/mod2.h
+@@ -60,8 +60,10 @@
+ 
+ /* define for parallel processes with shared memory */
+ #ifndef __CCYGWIN__
++#ifndef SI_CPU_AARCH64
+ #define HAVE_VSPACE 1
+ #endif
++#endif
+ 
+ /*#define PROFILING*/
+ #ifdef PROFILING
diff --git a/third_party/nixpkgs/pkgs/applications/science/math/singular/redhat-aarch64.patch b/third_party/nixpkgs/pkgs/applications/science/math/singular/redhat-aarch64.patch
new file mode 100644
index 0000000000..e0db6e87f9
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/applications/science/math/singular/redhat-aarch64.patch
@@ -0,0 +1,38 @@
+diff --git a/m4/cpu-check.m4 b/m4/cpu-check.m4
+index 3cf0a7f08..12bb926ac 100644
+--- a/m4/cpu-check.m4
++++ b/m4/cpu-check.m4
+@@ -37,6 +37,18 @@ if test "$ac_cv_singcpuname" = ppc; then
+   AC_DEFINE(SI_CPU_PPC,1,"PPC")
+   AC_SUBST(SI_CPU_PPC)
+ fi
++if test "$ac_cv_singcpuname" = arm -o "$ac_cv_singcpuname" = armel; then
++  AC_DEFINE(SI_CPU_ARM,1,"ARM")
++  AC_SUBST(SI_CPU_ARM)
++fi
++if test "$ac_cv_singcpuname" = aarch64; then
++  AC_DEFINE(SI_CPU_AARCH64,1,"AARCH64")
++  AC_SUBST(SI_CPU_AARCH64)
++fi
++if test "$ac_cv_singcpuname" = s390; then
++  AC_DEFINE(SI_CPU_S390,1,"S390")
++  AC_SUBST(SI_CPU_S390)
++fi
+ 
+ # UNAME and PATH
+ AC_MSG_CHECKING(uname for Singular)
+@@ -65,6 +77,14 @@ dnl testet on: ppc_Linux, 740/750 PowerMac G3, 512k L2 cache
+   [powerpc*|ppc*], [AC_DEFINE(HAVE_GENERIC_MULT,1,multiplication is fast on the cpu: a*b is with mod otherwise using tables of logartihms)],
+ dnl the following settings seems to be better on arm processors
+   [arm*], [],
++dnl FIXME: need to run some tests
++  [aarch64*], [
++            AC_DEFINE(HAVE_MULT_MOD,1,multiplication is fast on the cpu: a*b is with mod otherwise using tables of logartihms)
++            AC_DEFINE(HAVE_GENERIC_ADD,1,use branch for addition in Z/p otherwise it uses a generic add)
++            AC_DEFINE(HAVE_DIV_MOD,1,division using extend euclidian algorithm otherwise using tables of logartihms)
++            ],
++dnl FIXME: need to run some tests
++  [s390*], [AC_DEFINE(HAVE_GENERIC_ADD,1,use branch for addition in Z/p otherwise it uses a generic add)],
+   []
+ )
+ 
diff --git a/third_party/nixpkgs/pkgs/applications/science/math/singular/use-older-ax-prog-cc-for-build.patch b/third_party/nixpkgs/pkgs/applications/science/math/singular/use-older-ax-prog-cc-for-build.patch
new file mode 100644
index 0000000000..f664378617
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/applications/science/math/singular/use-older-ax-prog-cc-for-build.patch
@@ -0,0 +1,194 @@
+diff --git a/m4/ax_prog_cc_for_build.m4 b/m4/ax_prog_cc_for_build.m4
+index f7410d74b..12cb005a5 100644
+--- a/m4/ax_prog_cc_for_build.m4
++++ b/m4/ax_prog_cc_for_build.m4
+@@ -32,35 +32,31 @@
+ #   and this notice are preserved. This file is offered as-is, without any
+ #   warranty.
+ 
+-#serial 18
++#serial 9
+ 
+ AU_ALIAS([AC_PROG_CC_FOR_BUILD], [AX_PROG_CC_FOR_BUILD])
+ AC_DEFUN([AX_PROG_CC_FOR_BUILD], [dnl
+ AC_REQUIRE([AC_PROG_CC])dnl
+ AC_REQUIRE([AC_PROG_CPP])dnl
+-AC_REQUIRE([AC_CANONICAL_BUILD])dnl
++AC_REQUIRE([AC_EXEEXT])dnl
++AC_REQUIRE([AC_CANONICAL_HOST])dnl
+ 
+ dnl Use the standard macros, but make them use other variable names
+ dnl
+ pushdef([ac_cv_prog_CPP], ac_cv_build_prog_CPP)dnl
+-pushdef([ac_cv_prog_cc_c89], ac_cv_build_prog_cc_c89)dnl
+ pushdef([ac_cv_prog_gcc], ac_cv_build_prog_gcc)dnl
+ pushdef([ac_cv_prog_cc_works], ac_cv_build_prog_cc_works)dnl
+ pushdef([ac_cv_prog_cc_cross], ac_cv_build_prog_cc_cross)dnl
+ pushdef([ac_cv_prog_cc_g], ac_cv_build_prog_cc_g)dnl
+-pushdef([ac_cv_c_compiler_gnu], ac_cv_build_c_compiler_gnu)dnl
+ pushdef([ac_cv_exeext], ac_cv_build_exeext)dnl
+ pushdef([ac_cv_objext], ac_cv_build_objext)dnl
+ pushdef([ac_exeext], ac_build_exeext)dnl
+ pushdef([ac_objext], ac_build_objext)dnl
+ pushdef([CC], CC_FOR_BUILD)dnl
+ pushdef([CPP], CPP_FOR_BUILD)dnl
+-pushdef([GCC], GCC_FOR_BUILD)dnl
+ pushdef([CFLAGS], CFLAGS_FOR_BUILD)dnl
+ pushdef([CPPFLAGS], CPPFLAGS_FOR_BUILD)dnl
+-pushdef([EXEEXT], BUILD_EXEEXT)dnl
+ pushdef([LDFLAGS], LDFLAGS_FOR_BUILD)dnl
+-pushdef([OBJEXT], BUILD_OBJEXT)dnl
+ pushdef([host], build)dnl
+ pushdef([host_alias], build_alias)dnl
+ pushdef([host_cpu], build_cpu)dnl
+@@ -71,29 +67,27 @@ pushdef([ac_cv_host_alias], ac_cv_build_alias)dnl
+ pushdef([ac_cv_host_cpu], ac_cv_build_cpu)dnl
+ pushdef([ac_cv_host_vendor], ac_cv_build_vendor)dnl
+ pushdef([ac_cv_host_os], ac_cv_build_os)dnl
+-pushdef([ac_tool_prefix], ac_build_tool_prefix)dnl
+-pushdef([am_cv_CC_dependencies_compiler_type], am_cv_build_CC_dependencies_compiler_type)dnl
+-pushdef([am_cv_prog_cc_c_o], am_cv_build_prog_cc_c_o)dnl
+-pushdef([cross_compiling], cross_compiling_build)dnl
++pushdef([ac_cpp], ac_build_cpp)dnl
++pushdef([ac_compile], ac_build_compile)dnl
++pushdef([ac_link], ac_build_link)dnl
+ 
+-cross_compiling_build=no
++save_cross_compiling=$cross_compiling
++save_ac_tool_prefix=$ac_tool_prefix
++cross_compiling=no
++ac_tool_prefix=
+ 
+-ac_build_tool_prefix=
+-AS_IF([test -n "$build"],      [ac_build_tool_prefix="$build-"],
+-      [test -n "$build_alias"],[ac_build_tool_prefix="$build_alias-"])
+-
+-AC_LANG_PUSH([C])
+ AC_PROG_CC
+-_AC_COMPILER_EXEEXT
+-_AC_COMPILER_OBJEXT
+ AC_PROG_CPP
++AC_EXEEXT
++
++ac_tool_prefix=$save_ac_tool_prefix
++cross_compiling=$save_cross_compiling
+ 
+ dnl Restore the old definitions
+ dnl
+-popdef([cross_compiling])dnl
+-popdef([am_cv_prog_cc_c_o])dnl
+-popdef([am_cv_CC_dependencies_compiler_type])dnl
+-popdef([ac_tool_prefix])dnl
++popdef([ac_link])dnl
++popdef([ac_compile])dnl
++popdef([ac_cpp])dnl
+ popdef([ac_cv_host_os])dnl
+ popdef([ac_cv_host_vendor])dnl
+ popdef([ac_cv_host_cpu])dnl
+@@ -104,33 +98,25 @@ popdef([host_vendor])dnl
+ popdef([host_cpu])dnl
+ popdef([host_alias])dnl
+ popdef([host])dnl
+-popdef([OBJEXT])dnl
+ popdef([LDFLAGS])dnl
+-popdef([EXEEXT])dnl
+ popdef([CPPFLAGS])dnl
+ popdef([CFLAGS])dnl
+-popdef([GCC])dnl
+ popdef([CPP])dnl
+ popdef([CC])dnl
+ popdef([ac_objext])dnl
+ popdef([ac_exeext])dnl
+ popdef([ac_cv_objext])dnl
+ popdef([ac_cv_exeext])dnl
+-popdef([ac_cv_c_compiler_gnu])dnl
+ popdef([ac_cv_prog_cc_g])dnl
+ popdef([ac_cv_prog_cc_cross])dnl
+ popdef([ac_cv_prog_cc_works])dnl
+-popdef([ac_cv_prog_cc_c89])dnl
+ popdef([ac_cv_prog_gcc])dnl
+ popdef([ac_cv_prog_CPP])dnl
+ 
+-dnl restore global variables ac_ext, ac_cpp, ac_compile,
+-dnl ac_link, ac_compiler_gnu (dependant on the current
+-dnl language after popping):
+-AC_LANG_POP([C])
+-
+ dnl Finally, set Makefile variables
+ dnl
++BUILD_EXEEXT=$ac_build_exeext
++BUILD_OBJEXT=$ac_build_objext
+ AC_SUBST(BUILD_EXEEXT)dnl
+ AC_SUBST(BUILD_OBJEXT)dnl
+ AC_SUBST([CFLAGS_FOR_BUILD])dnl
+diff --git a/m4/ax_prog_cxx_for_build.m4 b/m4/ax_prog_cxx_for_build.m4
+index 4d976769f..17c19a89f 100644
+--- a/m4/ax_prog_cxx_for_build.m4
++++ b/m4/ax_prog_cxx_for_build.m4
+@@ -31,7 +31,7 @@
+ #   and this notice are preserved. This file is offered as-is, without any
+ #   warranty.
+ 
+-#serial 4
++#serial 3
+ 
+ AU_ALIAS([AC_PROG_CXX_FOR_BUILD], [AX_PROG_CXX_FOR_BUILD])
+ AC_DEFUN([AX_PROG_CXX_FOR_BUILD], [dnl
+@@ -49,7 +49,6 @@ pushdef([ac_cv_prog_cxx_cross], ac_cv_build_prog_cxx_cross)dnl
+ pushdef([ac_cv_prog_cxx_g], ac_cv_build_prog_cxx_g)dnl
+ pushdef([CXX], CXX_FOR_BUILD)dnl
+ pushdef([CXXCPP], CXXCPP_FOR_BUILD)dnl
+-pushdef([GXX], GXX_FOR_BUILD)dnl
+ pushdef([CXXFLAGS], CXXFLAGS_FOR_BUILD)dnl
+ pushdef([CPPFLAGS], CPPFLAGS_FOR_BUILD)dnl
+ pushdef([CXXCPPFLAGS], CXXCPPFLAGS_FOR_BUILD)dnl
+@@ -63,25 +62,26 @@ pushdef([ac_cv_host_alias], ac_cv_build_alias)dnl
+ pushdef([ac_cv_host_cpu], ac_cv_build_cpu)dnl
+ pushdef([ac_cv_host_vendor], ac_cv_build_vendor)dnl
+ pushdef([ac_cv_host_os], ac_cv_build_os)dnl
+-pushdef([ac_tool_prefix], ac_build_tool_prefix)dnl
+-pushdef([am_cv_CXX_dependencies_compiler_type], am_cv_build_CXX_dependencies_compiler_type)dnl
+-pushdef([cross_compiling], cross_compiling_build)dnl
++pushdef([ac_cxxcpp], ac_build_cxxcpp)dnl
++pushdef([ac_compile], ac_build_compile)dnl
++pushdef([ac_link], ac_build_link)dnl
+ 
+-cross_compiling_build=no
++save_cross_compiling=$cross_compiling
++save_ac_tool_prefix=$ac_tool_prefix
++cross_compiling=no
++ac_tool_prefix=
+ 
+-ac_build_tool_prefix=
+-AS_IF([test -n "$build"],      [ac_build_tool_prefix="$build-"],
+-      [test -n "$build_alias"],[ac_build_tool_prefix="$build_alias-"])
+-
+-AC_LANG_PUSH([C++])
+ AC_PROG_CXX
+ AC_PROG_CXXCPP
+ 
++ac_tool_prefix=$save_ac_tool_prefix
++cross_compiling=$save_cross_compiling
++
+ dnl Restore the old definitions
+ dnl
+-popdef([cross_compiling])dnl
+-popdef([am_cv_CXX_dependencies_compiler_type])dnl
+-popdef([ac_tool_prefix])dnl
++popdef([ac_link])dnl
++popdef([ac_compile])dnl
++popdef([ac_cxxcpp])dnl
+ popdef([ac_cv_host_os])dnl
+ popdef([ac_cv_host_vendor])dnl
+ popdef([ac_cv_host_cpu])dnl
+@@ -103,10 +103,6 @@ popdef([ac_cv_prog_cxx_works])dnl
+ popdef([ac_cv_prog_gxx])dnl
+ popdef([ac_cv_prog_CXXCPP])dnl
+ 
+-dnl restore global variables (dependant on the current
+-dnl language after popping):
+-AC_LANG_POP([C++])
+-
+ dnl Finally, set Makefile variables
+ dnl
+ AC_SUBST([CXXFLAGS_FOR_BUILD])dnl
diff --git a/third_party/nixpkgs/pkgs/applications/version-management/git-review/default.nix b/third_party/nixpkgs/pkgs/applications/version-management/git-review/default.nix
index 042bdc2a19..38eed2dd5a 100644
--- a/third_party/nixpkgs/pkgs/applications/version-management/git-review/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/version-management/git-review/default.nix
@@ -1,8 +1,14 @@
-{ lib, fetchurl, buildPythonApplication, pbr, requests, setuptools }:
+{ lib
+, fetchurl
+, buildPythonApplication
+, pbr
+, requests
+, setuptools
+}:
 
 buildPythonApplication rec {
   pname = "git-review";
-  version = "2.0.0";
+  version = "2.1.0";
 
   # Manually set version because prb wants to get it from the git
   # upstream repository (and we are installing from tarball instead)
@@ -10,17 +16,28 @@ buildPythonApplication rec {
 
   src = fetchurl {
     url = "https://opendev.org/opendev/${pname}/archive/${version}.tar.gz";
-    sha256 = "0dkyd5g2xmvsa114is3cd9qmki3hi6c06wjnra0f4xq3aqm0ajnj";
+    hash = "sha256-3A1T+/iXhNeMS2Aww5jISoiNExdv9N9/kwyATSuwVTE=";
   };
 
-  propagatedBuildInputs = [ pbr requests setuptools ];
+  nativeBuildInputs = [
+    pbr
+  ];
 
-  # Don't do tests because they require gerrit which is not packaged
+  propagatedBuildInputs = [
+    requests
+    setuptools # implicit dependency, used to get package version through pkg_resources
+  ];
+
+  # Don't run tests because they pull in external dependencies
+  # (a specific build of gerrit + maven plugins), and I haven't figured
+  # out how to work around this yet.
   doCheck = false;
 
+  pythonImportsCheck = [ "git_review" ];
+
   meta = with lib; {
-    homepage = "https://opendev.org/opendev/git-review";
     description = "Tool to submit code to Gerrit";
+    homepage = "https://opendev.org/opendev/git-review";
     license = licenses.asl20;
     maintainers = with maintainers; [ metadark ];
   };
diff --git a/third_party/nixpkgs/pkgs/applications/version-management/subversion/CVE-2020-17525.patch b/third_party/nixpkgs/pkgs/applications/version-management/subversion/CVE-2020-17525.patch
new file mode 100644
index 0000000000..c844c3773e
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/applications/version-management/subversion/CVE-2020-17525.patch
@@ -0,0 +1,15 @@
+Patch included in advisory @ https://subversion.apache.org/security/CVE-2020-17525-advisory.txt
+
+--- a/subversion/libsvn_repos/config_file.c
++++ b/subversion/libsvn_repos/config_file.c
+@@ -237,6 +237,10 @@ get_repos_config(svn_stream_t **stream,
+     {
+       /* Search for a repository in the full path. */
+       repos_root_dirent = svn_repos_find_root_path(dirent, scratch_pool);
++      if (repos_root_dirent == NULL)
++        return svn_error_trace(handle_missing_file(stream, checksum, access,
++                                                   url, must_exist,
++                                                   svn_node_none));
+ 
+       /* Attempt to open a repository at repos_root_dirent. */
+       SVN_ERR(svn_repos_open3(&access->repos, repos_root_dirent, NULL,
diff --git a/third_party/nixpkgs/pkgs/applications/version-management/subversion/default.nix b/third_party/nixpkgs/pkgs/applications/version-management/subversion/default.nix
index 1f604c44d7..9f780de748 100644
--- a/third_party/nixpkgs/pkgs/applications/version-management/subversion/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/version-management/subversion/default.nix
@@ -17,7 +17,7 @@ assert javahlBindings -> jdk != null && perl != null;
 
 let
 
-  common = { version, sha256 }: stdenv.mkDerivation (rec {
+  common = { version, sha256, extraPatches ? [ ] }: stdenv.mkDerivation (rec {
     inherit version;
     pname = "subversion";
 
@@ -35,7 +35,7 @@ let
       ++ lib.optional perlBindings perl
       ++ lib.optional saslSupport sasl;
 
-    patches = [ ./apr-1.patch ];
+    patches = [ ./apr-1.patch ] ++ extraPatches;
 
     # We are hitting the following issue even with APR 1.6.x
     # -> https://issues.apache.org/jira/browse/SVN-4813
@@ -118,5 +118,6 @@ in {
   subversion = common {
     version = "1.12.2";
     sha256 = "0wgpw3kzsiawzqk4y0xgh1z93kllxydgv4lsviim45y5wk4bbl1v";
+    extraPatches = [ ./CVE-2020-17525.patch ];
   };
 }
diff --git a/third_party/nixpkgs/pkgs/applications/video/byzanz/default.nix b/third_party/nixpkgs/pkgs/applications/video/byzanz/default.nix
index 69d27c3a2c..80e1c1260b 100644
--- a/third_party/nixpkgs/pkgs/applications/video/byzanz/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/video/byzanz/default.nix
@@ -19,7 +19,7 @@ stdenv.mkDerivation {
   NIX_CFLAGS_COMPILE = "-Wno-error=deprecated-declarations";
 
   nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ which gnome3.gnome-common glib intltool libtool cairo gtk3 xorg.xwininfo ]
+  buildInputs = [ which gnome3.gnome-common glib intltool libtool cairo gtk3 xorg.xwininfo xorg.libXdamage ]
   ++ (with gst_all_1; [ gstreamer gst-plugins-base gst-plugins-bad gst-plugins-good gst-plugins-ugly gst-libav wrapGAppsHook ]);
 
   meta = with lib; {
diff --git a/third_party/nixpkgs/pkgs/applications/video/jellyfin-media-player/default.nix b/third_party/nixpkgs/pkgs/applications/video/jellyfin-media-player/default.nix
index 10a3a8cc17..829cc4835e 100644
--- a/third_party/nixpkgs/pkgs/applications/video/jellyfin-media-player/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/video/jellyfin-media-player/default.nix
@@ -26,18 +26,18 @@
 
 mkDerivation rec {
   pname = "jellyfin-media-player";
-  version = "1.4.1";
+  version = "1.5.0";
 
   src = fetchFromGitHub {
     owner = "jellyfin";
     repo = "jellyfin-media-player";
     rev = "v${version}";
-    sha256 = "sha256-500Qlxpqkf+9D/jrzkrYkkFwxs0soLG/I5mgFV1UOc8=";
+    sha256 = "sha256-A3vo6678XFUV2RN1lcGYbIjCbBjR1oeORcidKZVnImg=";
   };
 
   jmpDist = fetchzip {
-    url = "https://github.com/iwalton3/jellyfin-web-jmp/releases/download/jwc-10.7.2-2/dist.zip";
-    sha256 = "sha256-9oxOcSCV1Gm8WLpwVLanyUlhPx5PWUrkkWvKmwND94g=";
+    url = "https://github.com/iwalton3/jellyfin-web-jmp/releases/download/jwc-10.7.2-3/dist.zip";
+    sha256 = "sha256-Rb0q3NFmnYkueq0JkIWkX0C/oL+gFrNOELCNfh9X/P4=";
   };
 
   patches = [
diff --git a/third_party/nixpkgs/pkgs/applications/video/kodi/unwrapped.nix b/third_party/nixpkgs/pkgs/applications/video/kodi/unwrapped.nix
index 6f926176ea..3e6b3dc51d 100644
--- a/third_party/nixpkgs/pkgs/applications/video/kodi/unwrapped.nix
+++ b/third_party/nixpkgs/pkgs/applications/video/kodi/unwrapped.nix
@@ -127,6 +127,7 @@ in stdenv.mkDerivation {
       bluez giflib glib harfbuzz lcms2 libpthreadstubs
       ffmpeg flatbuffers fmt fstrcmp rapidjson
       lirc
+      mesa # for libEGL
     ]
     ++ lib.optional x11Support [
       libX11 xorgproto libXt libXmu libXext.dev libXdmcp
diff --git a/third_party/nixpkgs/pkgs/applications/video/simplescreenrecorder/default.nix b/third_party/nixpkgs/pkgs/applications/video/simplescreenrecorder/default.nix
index 939ae7c444..14575a88dc 100644
--- a/third_party/nixpkgs/pkgs/applications/video/simplescreenrecorder/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/video/simplescreenrecorder/default.nix
@@ -1,14 +1,16 @@
-{ lib, stdenv, mkDerivation, fetchurl, alsaLib, ffmpeg_3, libjack2, libX11, libXext, qtx11extras
-, libXfixes, libGLU, libGL, pkg-config, libpulseaudio, qtbase, cmake, ninja
+{ lib, stdenv, mkDerivation, fetchFromGitHub, alsaLib, ffmpeg, libjack2, libX11, libXext, libXinerama, qtx11extras
+, libXfixes, libGLU, libGL, pkg-config, libpulseaudio, libv4l, qtbase, qttools, cmake, ninja
 }:
 
 mkDerivation rec {
   pname = "simplescreenrecorder";
-  version = "0.3.11";
+  version = "0.4.3";
 
-  src = fetchurl {
-    url = "https://github.com/MaartenBaert/ssr/archive/${version}.tar.gz";
-    sha256 = "0l6irdadqpajvv0dj3ngs1231n559l0y1pykhs2h7526qm4w7xal";
+  src = fetchFromGitHub {
+    owner = "MaartenBaert";
+    repo = "ssr";
+    rev = version;
+    sha256 = "0mrx8wprs8bi42fwwvk6rh634ic9jnn0gkfpd6q9pcawnnbz3vq8";
   };
 
   cmakeFlags = [ "-DWITH_QT5=TRUE" ];
@@ -25,14 +27,14 @@ mkDerivation rec {
 
   nativeBuildInputs = [ pkg-config cmake ninja ];
   buildInputs = [
-    alsaLib ffmpeg_3 libjack2 libX11 libXext libXfixes libGLU libGL
-    libpulseaudio qtbase qtx11extras
+    alsaLib ffmpeg libjack2 libX11 libXext libXfixes libXinerama libGLU libGL
+    libpulseaudio libv4l qtbase qttools qtx11extras
   ];
 
   meta = with lib; {
     description = "A screen recorder for Linux";
     homepage = "https://www.maartenbaert.be/simplescreenrecorder";
-    license = licenses.gpl3;
+    license = licenses.gpl3Plus;
     platforms = [ "x86_64-linux" ];
     maintainers = [ maintainers.goibhniu ];
   };
diff --git a/third_party/nixpkgs/pkgs/applications/video/simplescreenrecorder/fix-paths.patch b/third_party/nixpkgs/pkgs/applications/video/simplescreenrecorder/fix-paths.patch
index ba02240ce1..9cf634285f 100644
--- a/third_party/nixpkgs/pkgs/applications/video/simplescreenrecorder/fix-paths.patch
+++ b/third_party/nixpkgs/pkgs/applications/video/simplescreenrecorder/fix-paths.patch
@@ -12,10 +12,19 @@ index 48be48d..5038d4c 100755
 -LD_PRELOAD="$LD_PRELOAD:libssr-glinject.so" "$@"
 +LD_PRELOAD="$LD_PRELOAD:@out@/lib/libssr-glinject.so" "$@"
 diff --git a/src/AV/Input/GLInjectInput.cpp b/src/AV/Input/GLInjectInput.cpp
-index 6b378f8..cbcf82b 100644
+index fc98f31..18f5196 100644
 --- a/src/AV/Input/GLInjectInput.cpp
 +++ b/src/AV/Input/GLInjectInput.cpp
-@@ -96,7 +96,7 @@ void GLInjectInput::SetCapturing(bool capturing) {
+@@ -113,7 +113,7 @@ bool ExecuteDetached(const char* command, const char* working_directory) {
+ 
+ 			// try to execute command
+ 			do {
+-				res = execl("/bin/sh", "/bin/sh", "-c", command, (char*) NULL);
++				res = execl("@sh@", "@sh@", "-c", command, (char*) NULL);
+ 			} while(res == -1 and errno == EINTR);
+ 
+ 			// failed, send feedback
+@@ -207,7 +207,7 @@ void GLInjectInput::SetCapturing(bool capturing) {
  bool GLInjectInput::LaunchApplication(const QString& channel, bool relax_permissions, const QString& command, const QString& working_directory) {
  
  	// prepare command
@@ -24,12 +33,3 @@ index 6b378f8..cbcf82b 100644
  	full_command += "SSR_CHANNEL=\"" + ShellEscape(channel) + "\" ";
  	if(relax_permissions)
  		full_command += "SSR_STREAM_RELAX_PERMISSIONS=1 ";
-@@ -106,7 +106,7 @@ bool GLInjectInput::LaunchApplication(const QString& channel, bool relax_permiss
- 	QStringList args;
- 	args.push_back("-c");
- 	args.push_back(full_command);
--	return QProcess::startDetached("/bin/sh", args, working_directory);
-+	return QProcess::startDetached("@sh@", args, working_directory);
- 
- }
- 
diff --git a/third_party/nixpkgs/pkgs/applications/video/streamlink-twitch-gui/bin.nix b/third_party/nixpkgs/pkgs/applications/video/streamlink-twitch-gui/bin.nix
index bc265d3e78..4d90e6327b 100644
--- a/third_party/nixpkgs/pkgs/applications/video/streamlink-twitch-gui/bin.nix
+++ b/third_party/nixpkgs/pkgs/applications/video/streamlink-twitch-gui/bin.nix
@@ -19,6 +19,7 @@
 , gtk3-x11
 , libudev0-shim
 , libuuid
+, mesa
 , nss
 , nspr
 , xorg
@@ -63,6 +64,7 @@ stdenv.mkDerivation rec {
     glib
     pango
     gtk3-x11
+    mesa
     nss
     nspr
     libuuid
diff --git a/third_party/nixpkgs/pkgs/applications/video/streamlink/default.nix b/third_party/nixpkgs/pkgs/applications/video/streamlink/default.nix
index 97607f939f..94bd0877a7 100644
--- a/third_party/nixpkgs/pkgs/applications/video/streamlink/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/video/streamlink/default.nix
@@ -1,30 +1,29 @@
 { lib
-, pythonPackages
+, python3
 , fetchFromGitHub
 , rtmpdump
-, ffmpeg_3
+, ffmpeg
 }:
 
-pythonPackages.buildPythonApplication rec {
+python3.pkgs.buildPythonApplication rec {
   pname = "streamlink";
-  version = "2.0.0";
-  disabled = pythonPackages.pythonOlder "3.5.0";
+  version = "2.1.1";
 
   src = fetchFromGitHub {
     owner = "streamlink";
     repo = "streamlink";
     rev = version;
-    sha256 = "+W9Nu5Ze08r7IlUZOkkVOz582E1Bbj0a3qIQHwxSmj8=";
+    sha256 = "14vqh4pck3q766qln7c57n9bz8zrlgfqrpkdn8x0ac9zhlhfn1zm";
   };
 
-  checkInputs = with pythonPackages; [
-    pytest
+  checkInputs = with python3.pkgs; [
+    pytestCheckHook
     mock
     requests-mock
     freezegun
   ];
 
-  propagatedBuildInputs = (with pythonPackages; [
+  propagatedBuildInputs = (with python3.pkgs; [
     pycryptodome
     requests
     iso-639
@@ -33,7 +32,11 @@ pythonPackages.buildPythonApplication rec {
     isodate
   ]) ++ [
     rtmpdump
-    ffmpeg_3
+    ffmpeg
+  ];
+
+  disabledTests = [
+    "test_plugin_not_in_removed_list"
   ];
 
   meta = with lib; {
diff --git a/third_party/nixpkgs/pkgs/applications/virtualization/docker/default.nix b/third_party/nixpkgs/pkgs/applications/virtualization/docker/default.nix
index f3d5572750..954404e526 100644
--- a/third_party/nixpkgs/pkgs/applications/virtualization/docker/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/virtualization/docker/default.nix
@@ -105,6 +105,8 @@ rec {
 
         # systemd
         install -Dm644 ./contrib/init/systemd/docker.service $out/etc/systemd/system/docker.service
+        substituteInPlace $out/etc/systemd/system/docker.service --replace /usr/bin/dockerd $out/bin/dockerd
+        install -Dm644 ./contrib/init/systemd/docker.socket $out/etc/systemd/system/docker.socket
       '';
 
       DOCKER_BUILDTAGS = []
@@ -178,6 +180,11 @@ rec {
     '' + optionalString (stdenv.isLinux) ''
       # symlink docker daemon to docker cli derivation
       ln -s ${moby}/bin/dockerd $out/bin/dockerd
+
+      # systemd
+      mkdir -p $out/etc/systemd/system
+      ln -s ${moby}/etc/systemd/system/docker.service $out/etc/systemd/system/docker.service
+      ln -s ${moby}/etc/systemd/system/docker.socket $out/etc/systemd/system/docker.socket
     '' + ''
       # completion (cli)
       installShellCompletion --bash ./contrib/completion/bash/docker
diff --git a/third_party/nixpkgs/pkgs/applications/virtualization/qemu/default.nix b/third_party/nixpkgs/pkgs/applications/virtualization/qemu/default.nix
index c04d3b3394..74c3f0e729 100644
--- a/third_party/nixpkgs/pkgs/applications/virtualization/qemu/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/virtualization/qemu/default.nix
@@ -84,6 +84,126 @@ stdenv.mkDerivation rec {
   patches = [
     ./fix-qemu-ga.patch
     ./9p-ignore-noatime.patch
+    (fetchpatch {
+      name = "CVE-2020-27821.patch";
+      url = "https://sources.debian.org/data/main/q/qemu/1:5.2+dfsg-10/debian/patches/memory-clamp-cached-translation-if-points-to-MMIO-region-CVE-2020-27821.patch";
+      sha256 = "0sj0kr0g6jalygr5mb9i17fgr491jzaxvk3dvala0268940s01x9";
+    })
+    (fetchpatch {
+      name = "CVE-2020-20221.patch";
+      url = "https://sources.debian.org/data/main/q/qemu/1:5.2+dfsg-10/debian/patches/arm_gic-fix-interrupt-ID-in-GICD_SGIR-CVE-2021-20221.patch";
+      sha256 = "1iyvcw87hzlc57fg5l87vddqmch8iw2yghk0s125hk5shn1bygjq";
+    })
+    (fetchpatch {
+      name = "CVE-2020-20181.patch";
+      url = "https://sources.debian.org/data/main/q/qemu/1:5.2+dfsg-10/debian/patches/9pfs-Fully-restart-unreclaim-loop-CVE-2021-20181.patch";
+      sha256 = "149ifiazj6rn4d4mv2c7lcayq744fijsv5abxlb8bhbkj99wd64f";
+    })
+    (fetchpatch {
+      name = "CVE-2020-35517.part-1.patch";
+      url = "https://sources.debian.org/data/main/q/qemu/1:5.2+dfsg-10/debian/patches/virtiofsd-extract-lo_do_open-from-lo_open.patch";
+      sha256 = "0j4waaz6q54by4a7vd5m8s2n8y0an9hqf0ndycxsy03g4ksm669d";
+    })
+    (fetchpatch {
+      name = "CVE-2020-35517.part-2.patch";
+      url = "https://sources.debian.org/data/main/q/qemu/1:5.2+dfsg-10/debian/patches/virtiofsd-optionally-return-inode-pointer-from-lo_do_lookup.patch";
+      sha256 = "08bag890r6dx2rhnq58gyvsxvzwqgvn83pjlg95b5ic0z6gyjnsg";
+    })
+    (fetchpatch {
+      name = "CVE-2020-35517.part-3.patch";
+      url = "https://sources.debian.org/data/main/q/qemu/1:5.2+dfsg-10/debian/patches/virtiofsd-prevent-opening-of-special-files-CVE-2020-35517.patch";
+      sha256 = "0ziy6638zbkn037l29ywirvgymbqq66l5rngg8iwyky67acilv94";
+    })
+    (fetchpatch {
+      name = "CVE-2021-20263.part-1.patch";
+      url = "https://sources.debian.org/data/main/q/qemu/1:5.2+dfsg-10/debian/patches/virtiofsd-save-error-code-early-at-the-failure-callsite.patch";
+      sha256 = "15rwb15yjpclrqaxkhx76npr8zlfm9mj4jb19czg093is2cn4rys";
+    })
+    (fetchpatch {
+      name = "CVE-2021-20263.part-2.patch";
+      url = "https://sources.debian.org/data/main/q/qemu/1:5.2+dfsg-10/debian/patches/virtiofsd-drop-remapped-security.capability-xattr-as-needed-CVE-2021-20263.patch";
+      sha256 = "06ylz80ilg30wlskd4dsjx677fp5qr8cranwlakvjhr88b630xw0";
+    })
+    (fetchpatch {
+      name = "CVE-2021-3416.part-1.patch";
+      url = "https://sources.debian.org/data/main/q/qemu/1:5.2+dfsg-10/debian/patches/net-qemu_receive_packet-for-loopback-introduce.patch";
+      sha256 = "0hcpf00vqpg9rc0wl8cry905w04614843aqifybyv15wbv190gpz";
+    })
+    (fetchpatch {
+      name = "CVE-2021-3416.part-2.patch";
+      url = "https://sources.debian.org/data/main/q/qemu/1:5.2+dfsg-10/debian/patches/net-qemu_receive_packet-for-loopback-cadence_gem.patch";
+      sha256 = "12mjnrvs6p4g5frzqb08k4h86hphdqlka91fcma2a3m4ap98nrxy";
+    })
+    (fetchpatch {
+      name = "CVE-2021-3416.part-3.patch";
+      url = "https://sources.debian.org/data/main/q/qemu/1:5.2+dfsg-10/debian/patches/net-qemu_receive_packet-for-loopback-dp8393x.patch";
+      sha256 = "02z6q0578fj55phjlg2larrsx3psch2ixzy470yf57jl3jq1dy6k";
+    })
+    (fetchpatch {
+      name = "CVE-2021-3416.part-4.patch";
+      url = "https://sources.debian.org/data/main/q/qemu/1:5.2+dfsg-10/debian/patches/net-qemu_receive_packet-for-loopback-e1000.patch";
+      sha256 = "0zzbiz8i9js524mcdi739c7hrsmn82gnafrygi0xrd5sqf1hp08z";
+    })
+    (fetchpatch {
+      name = "CVE-2021-3416.part-5.patch";
+      url = "https://sources.debian.org/data/main/q/qemu/1:5.2+dfsg-10/debian/patches/net-qemu_receive_packet-for-loopback-lan9118.patch";
+      sha256 = "1f44v5znd9s7l7wgc71nbg8jw1bjqiga4wkz7d7cpnkv3l7b9kjj";
+    })
+    (fetchpatch {
+      name = "CVE-2021-3416.part-6.patch";
+      url = "https://sources.debian.org/data/main/q/qemu/1:5.2+dfsg-10/debian/patches/net-qemu_receive_packet-for-loopback-msf2.patch";
+      sha256 = "04n1rzn6gfxdalp34903ysdhlvxqkfndnqayjj3iv1k27i5pcidn";
+    })
+    (fetchpatch {
+      name = "CVE-2021-3416.part-7.patch";
+      url = "https://sources.debian.org/data/main/q/qemu/1:5.2+dfsg-10/debian/patches/net-qemu_receive_packet-for-loopback-pcnet.patch";
+      sha256 = "1p9ls6f8r6hxprj8ha6278fydcxj3av29p1hvszxmabazml2g7l2";
+    })
+    (fetchpatch {
+      name = "CVE-2021-3416.part-8.patch";
+      url = "https://sources.debian.org/data/main/q/qemu/1:5.2+dfsg-10/debian/patches/net-qemu_receive_packet-for-loopback-rtl8139.patch";
+      sha256 = "0lms1zn49kpwblkp54widjjy7fwyhdh1x832l1jvds79l2nm6i04";
+    })
+    (fetchpatch {
+      name = "CVE-2021-3416.part-9.patch";
+      url = "https://sources.debian.org/data/main/q/qemu/1:5.2+dfsg-10/debian/patches/net-qemu_receive_packet-for-loopback-sungem.patch";
+      sha256 = "1mkzyrgsp9ml9yqzjxdfqnwjr7n0fd8vxby4yp4ksrskyni8y0p4";
+    })
+    (fetchpatch {
+      name = "CVE-2021-3416.part-10.patch";
+      url = "https://sources.debian.org/data/main/q/qemu/1:5.2+dfsg-10/debian/patches/net-qemu_receive_packet-for-loopback-tx_pkt-iov.patch";
+      sha256 = "1pwqq8yw06y3p6hah3dgjhsqzk802wbn7zyajla1zwdfpic63jss";
+    })
+    (fetchpatch {
+      name = "CVE-2021-3409.part-1.patch";
+      url = "https://sources.debian.org/data/main/q/qemu/1:5.2+dfsg-10/debian/patches/sdhci/dont-transfer-any-data-when-command-time-out.patch";
+      sha256 = "0wf1yhb9mqpfgh9rv0hff0v1sw3zl2vsfgjrby4r8jvxdfjrxj8s";
+    })
+    (fetchpatch {
+      name = "CVE-2021-3409.part-2.patch";
+      url = "https://sources.debian.org/data/main/q/qemu/1:5.2+dfsg-10/debian/patches/sdhci/dont-write-to-SDHC_SYSAD-register-when-transfer-is-in-progress.patch";
+      sha256 = "1dd405dsdc7fbp68yf6f32js1azsv3n595c6nbxh28kfh9lspx4v";
+    })
+    (fetchpatch {
+      name = "CVE-2021-3409.part-3.patch";
+      url = "https://sources.debian.org/data/main/q/qemu/1:5.2+dfsg-10/debian/patches/sdhci/correctly-set-the-controller-status-for-ADMA.patch";
+      sha256 = "08jk51pfrbn1zfymahgllrzivajh2v2qx0868rv9zmgi0jldbky6";
+    })
+    (fetchpatch {
+      name = "CVE-2021-3409.part-4.patch";
+      url = "https://sources.debian.org/data/main/q/qemu/1:5.2+dfsg-10/debian/patches/sdhci/limit-block-size-only-when-SDHC_BLKSIZE-register-is-writable.patch";
+      sha256 = "1valfhw3l83br1cny6n4kmrv0f416hl625mggayqfz4prsknyhh7";
+    })
+    (fetchpatch {
+      name = "CVE-2021-3409.part-5.patch";
+      url = "https://sources.debian.org/data/main/q/qemu/1:5.2+dfsg-10/debian/patches/sdhci/reset-the-data-pointer-of-s-fifo_buffer-when-a-different-block-size-is-programmed.patch";
+      sha256 = "01p5qrr00rh3mlwrp3qq56h7yhqv0w7pw2cw035nxw3mnap03v31";
+    })
+    (fetchpatch {
+      name = "CVE-2021-3392.patch";
+      url = "https://sources.debian.org/data/main/q/qemu/1:5.2+dfsg-10/debian/patches/mptsas-remove-unused-MPTSASState.pending-CVE-2021-3392.patch";
+      sha256 = "0n7dn2p102c21mf3ncqrnks0wl5kas6yspafbn8jd03ignjgc4hd";
+    })
   ] ++ optional nixosTestRunner ./force-uid0-on-9p.patch
     ++ optionals stdenv.hostPlatform.isMusl [
     (fetchpatch {
@@ -177,6 +297,9 @@ stdenv.mkDerivation rec {
     qemu-system-i386 = "bin/qemu-system-i386";
   };
 
+  # Builds in ~3h with 2 cores, and ~20m with a big-parallel builder.
+  requiredSystemFeatures = [ "big-parallel" ];
+
   meta = with lib; {
     homepage = "http://www.qemu.org/";
     description = "A generic and open source machine emulator and virtualizer";
diff --git a/third_party/nixpkgs/pkgs/applications/window-managers/cage/default.nix b/third_party/nixpkgs/pkgs/applications/window-managers/cage/default.nix
index f7083212e7..103be0e53d 100644
--- a/third_party/nixpkgs/pkgs/applications/window-managers/cage/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/window-managers/cage/default.nix
@@ -1,7 +1,7 @@
 { lib, stdenv, fetchFromGitHub
 , meson, ninja, pkg-config, wayland, scdoc, makeWrapper
 , wlroots, wayland-protocols, pixman, libxkbcommon
-, systemd, libGL, libX11
+, systemd, libGL, libX11, mesa
 , xwayland ? null
 , nixosTests
 }:
@@ -26,6 +26,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [
     wlroots wayland wayland-protocols pixman libxkbcommon
+    mesa # for libEGL headers
     systemd libGL libX11
   ];
 
diff --git a/third_party/nixpkgs/pkgs/applications/window-managers/cagebreak/default.nix b/third_party/nixpkgs/pkgs/applications/window-managers/cagebreak/default.nix
index 93ac815346..505d1cb152 100644
--- a/third_party/nixpkgs/pkgs/applications/window-managers/cagebreak/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/window-managers/cagebreak/default.nix
@@ -1,7 +1,7 @@
 { lib, stdenv, fetchFromGitHub
 , meson, ninja, pkg-config, wayland, scdoc, makeWrapper
 , wlroots, wayland-protocols, pixman, libxkbcommon
-, cairo , pango, fontconfig, pandoc, systemd
+, cairo , pango, fontconfig, pandoc, systemd, mesa
 , withXwayland ? true, xwayland
 , nixosTests
 }:
@@ -22,6 +22,7 @@ stdenv.mkDerivation rec {
   buildInputs = [
     wlroots wayland wayland-protocols pixman libxkbcommon cairo
     pango fontconfig pandoc systemd
+    mesa # for libEGL headers
   ];
 
   outputs = [ "out" "contrib" ];
diff --git a/third_party/nixpkgs/pkgs/applications/window-managers/hikari/default.nix b/third_party/nixpkgs/pkgs/applications/window-managers/hikari/default.nix
index 614012c471..34016b0d75 100644
--- a/third_party/nixpkgs/pkgs/applications/window-managers/hikari/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/window-managers/hikari/default.nix
@@ -1,7 +1,7 @@
 { lib, stdenv, fetchzip,
   pkg-config, bmake,
   cairo, glib, libevdev, libinput, libxkbcommon, linux-pam, pango, pixman,
-  libucl, wayland, wayland-protocols, wlroots,
+  libucl, wayland, wayland-protocols, wlroots, mesa,
   features ? {
     gammacontrol = true;
     layershell   = true;
@@ -35,6 +35,7 @@ stdenv.mkDerivation {
     pango
     pixman
     libucl
+    mesa # for libEGL
     wayland
     wayland-protocols
     wlroots
diff --git a/third_party/nixpkgs/pkgs/applications/window-managers/waybox/default.nix b/third_party/nixpkgs/pkgs/applications/window-managers/waybox/default.nix
index 666b2406d5..007e4dcc56 100644
--- a/third_party/nixpkgs/pkgs/applications/window-managers/waybox/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/window-managers/waybox/default.nix
@@ -11,6 +11,7 @@
 , pixman
 , udev
 , libGL
+, mesa
 }:
 
 stdenv.mkDerivation rec {
@@ -33,6 +34,7 @@ stdenv.mkDerivation rec {
     pixman
     udev
     libGL
+    mesa # for libEGL
   ];
 
   meta = with lib; {
diff --git a/third_party/nixpkgs/pkgs/applications/window-managers/wayfire/default.nix b/third_party/nixpkgs/pkgs/applications/window-managers/wayfire/default.nix
index cb9f2fe85a..303ffc35fc 100644
--- a/third_party/nixpkgs/pkgs/applications/window-managers/wayfire/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/window-managers/wayfire/default.nix
@@ -1,6 +1,6 @@
 { stdenv, lib, fetchurl, meson, ninja, pkg-config, git
 , cairo, libdrm, libexecinfo, libinput, libjpeg, libxkbcommon, wayland
-, wayland-protocols, wf-config, wlroots
+, wayland-protocols, wf-config, wlroots, mesa
 }:
 
 stdenv.mkDerivation rec {
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ meson ninja pkg-config wayland ];
   buildInputs = [
     cairo libdrm libexecinfo libinput libjpeg libxkbcommon wayland
-    wayland-protocols wf-config wlroots
+    wayland-protocols wf-config wlroots mesa
   ];
 
   mesonFlags = [ "--sysconfdir" "/etc" ];
diff --git a/third_party/nixpkgs/pkgs/applications/window-managers/wio/default.nix b/third_party/nixpkgs/pkgs/applications/window-managers/wio/default.nix
index 301b0184e9..c330bbe0e0 100644
--- a/third_party/nixpkgs/pkgs/applications/window-managers/wio/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/window-managers/wio/default.nix
@@ -10,6 +10,7 @@
 , wayland
 , wayland-protocols
 , wlroots
+, mesa
 , xwayland
 , makeWrapper
 }:
@@ -32,6 +33,7 @@ stdenv.mkDerivation rec {
     wayland
     wayland-protocols
     wlroots
+    mesa # for libEGL
     xwayland
   ];
 
diff --git a/third_party/nixpkgs/pkgs/build-support/bintools-wrapper/add-darwin-ldflags-before.sh b/third_party/nixpkgs/pkgs/build-support/bintools-wrapper/add-darwin-ldflags-before.sh
new file mode 100644
index 0000000000..75d9484846
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/build-support/bintools-wrapper/add-darwin-ldflags-before.sh
@@ -0,0 +1,81 @@
+# Unconditionally adding in platform version flags will result in warnings that
+# will be treated as errors by some packages. Add any missing flags here.
+
+# There are two things to be configured: the "platform version" (oldest
+# supported version of macos, ios, etc), and the "sdk version".
+#
+# The modern way of configuring these is to use:
+#    -platform_version $platform $platform_version $sdk_version"
+#
+# The old way is still supported, and uses flags like:
+#    -${platform}_version_min $platform_version
+#    -sdk_version $sdk_version
+#
+# If both styles are specified ld will combine them. If multiple versions are
+# specified for the same platform, ld will emit an error.
+#
+# The following adds flags for whichever properties have not already been
+# provided.
+
+havePlatformVersionFlag=
+haveDarwinSDKVersion=
+haveDarwinPlatformVersion=
+
+# Roles will set by add-flags.sh, but add-flags.sh can be skipped when the
+# cc-wrapper has added the linker flags. Both the cc-wrapper and the binutils
+# wrapper mangle the same variable (MACOSX_DEPLOYMENT_TARGET), so if roles are
+# empty due to being run through the cc-wrapper then the mangle here is a no-op
+# and we still do the right thing.
+#
+# To be robust, make sure we always have the correct set of roles.
+accumulateRoles
+
+mangleVarSingle @darwinMinVersionVariable@ ${role_suffixes[@]+"${role_suffixes[@]}"}
+
+n=0
+nParams=${#params[@]}
+while (( n < nParams )); do
+    p=${params[n]}
+    case "$p" in
+        # the current platform
+        -@darwinPlatform@_version_min)
+            haveDarwinPlatformVersion=1
+            ;;
+
+        # legacy aliases
+        -macosx_version_min|-iphoneos_version_min|-iosmac_version_min|-uikitformac_version_min)
+            haveDarwinPlatformVersion=1
+            ;;
+
+        -sdk_version)
+            haveDarwinSDKVersion=1
+            ;;
+
+        -platform_version)
+            havePlatformVersionFlag=1
+
+            # If clang can't determine the sdk version it will pass 0.0.0. This
+            # has runtime effects so we override this to use the known sdk
+            # version.
+            if [ "${params[n+3]-}" = 0.0.0 ]; then
+                params[n+3]=@darwinSdkVersion@
+            fi
+            ;;
+    esac
+    n=$((n + 1))
+done
+
+# If the caller has set -platform_version, trust they're doing the right thing.
+# This will be the typical case for clang in nixpkgs.
+if [ ! "$havePlatformVersionFlag" ]; then
+    if [ ! "$haveDarwinSDKVersion" ] && [ ! "$haveDarwinPlatformVersion" ]; then
+        # Nothing provided. Use the modern "-platform_version" to set both.
+        extraBefore+=(-platform_version @darwinPlatform@ "${@darwinMinVersionVariable@_@suffixSalt@:-@darwinMinVersion@}" @darwinSdkVersion@)
+    elif [ ! "$haveDarwinSDKVersion" ]; then
+        # Add missing sdk version
+        extraBefore+=(-sdk_version @darwinSdkVersion@)
+    elif [ ! "$haveDarwinPlatformVersion" ]; then
+        # Add missing platform version
+        extraBefore+=(-@darwinPlatform@_version_min "${@darwinMinVersionVariable@_@suffixSalt@:-@darwinMinVersion@}")
+    fi
+fi
diff --git a/third_party/nixpkgs/pkgs/build-support/bintools-wrapper/default.nix b/third_party/nixpkgs/pkgs/build-support/bintools-wrapper/default.nix
index dac1f3bd7c..859e379059 100644
--- a/third_party/nixpkgs/pkgs/build-support/bintools-wrapper/default.nix
+++ b/third_party/nixpkgs/pkgs/build-support/bintools-wrapper/default.nix
@@ -252,11 +252,6 @@ stdenv.mkDerivation {
       fi
     '')
 
-    # Ensure consistent LC_VERSION_MIN_MACOSX and remove LC_UUID.
-    + optionalString stdenv.targetPlatform.isMacOS ''
-      echo "-sdk_version 10.12 -no_uuid" >> $out/nix-support/libc-ldflags-before
-    ''
-
     ##
     ## User env support
     ##
@@ -310,6 +305,13 @@ stdenv.mkDerivation {
       echo "-arch ${targetPlatform.darwinArch}" >> $out/nix-support/libc-ldflags
     ''
 
+    ###
+    ### Remove LC_UUID
+    ###
+    + optionalString (stdenv.targetPlatform.isDarwin && !(stdenv.cc.bintools.bintools.isGNU or false)) ''
+      echo "-no_uuid" >> $out/nix-support/libc-ldflags-before
+    ''
+
     + ''
       for flags in "$out/nix-support"/*flags*; do
         substituteInPlace "$flags" --replace $'\n' ' '
@@ -320,6 +322,23 @@ stdenv.mkDerivation {
       substituteAll ${../wrapper-common/utils.bash} $out/nix-support/utils.bash
     ''
 
+    ###
+    ### Ensure consistent LC_VERSION_MIN_MACOSX
+    ###
+    + optionalString stdenv.targetPlatform.isDarwin (
+      let
+        inherit (stdenv.targetPlatform)
+          darwinPlatform darwinSdkVersion
+          darwinMinVersion darwinMinVersionVariable;
+      in ''
+        export darwinPlatform=${darwinPlatform}
+        export darwinMinVersion=${darwinMinVersion}
+        export darwinSdkVersion=${darwinSdkVersion}
+        export darwinMinVersionVariable=${darwinMinVersionVariable}
+        substituteAll ${./add-darwin-ldflags-before.sh} $out/nix-support/add-local-ldflags-before.sh
+      ''
+    )
+
     ##
     ## Extra custom steps
     ##
diff --git a/third_party/nixpkgs/pkgs/build-support/bintools-wrapper/ld-wrapper.sh b/third_party/nixpkgs/pkgs/build-support/bintools-wrapper/ld-wrapper.sh
index 9d02f99851..7ccf5510c8 100644
--- a/third_party/nixpkgs/pkgs/build-support/bintools-wrapper/ld-wrapper.sh
+++ b/third_party/nixpkgs/pkgs/build-support/bintools-wrapper/ld-wrapper.sh
@@ -78,6 +78,14 @@ fi
 
 extraAfter+=($NIX_LDFLAGS_AFTER_@suffixSalt@)
 
+# These flags *must not* be pulled up to -Wl, flags, so they can't go in
+# add-flags.sh. They must always be set, so must not be disabled by
+# NIX_LDFLAGS_SET.
+if [ -e @out@/nix-support/add-local-ldflags-before.sh ]; then
+    source @out@/nix-support/add-local-ldflags-before.sh
+fi
+
+
 # Specify the target emulation if nothing is passed in ("-m" overrides this
 # environment variable). Ensures we never blindly fallback on targeting the host
 # platform.
diff --git a/third_party/nixpkgs/pkgs/build-support/cc-wrapper/add-flags.sh b/third_party/nixpkgs/pkgs/build-support/cc-wrapper/add-flags.sh
index 94589131b7..a6e991914e 100644
--- a/third_party/nixpkgs/pkgs/build-support/cc-wrapper/add-flags.sh
+++ b/third_party/nixpkgs/pkgs/build-support/cc-wrapper/add-flags.sh
@@ -65,5 +65,13 @@ if [ -e @out@/nix-support/cc-cflags-before ]; then
     NIX_CFLAGS_COMPILE_BEFORE_@suffixSalt@="$(< @out@/nix-support/cc-cflags-before) $NIX_CFLAGS_COMPILE_BEFORE_@suffixSalt@"
 fi
 
+# Only add darwin min version flag if a default darwin min version is set,
+# which is a signal that we're targetting darwin.
+if [ "@darwinMinVersion@" ]; then
+    mangleVarSingle @darwinMinVersionVariable@ ${role_suffixes[@]+"${role_suffixes[@]}"}
+
+    NIX_CFLAGS_COMPILE_BEFORE_@suffixSalt@="-m@darwinPlatformForCC@-version-min=${@darwinMinVersionVariable@_@suffixSalt@:-@darwinMinVersion@} $NIX_CFLAGS_COMPILE_BEFORE_@suffixSalt@"
+fi
+
 # That way forked processes will not extend these environment variables again.
 export NIX_CC_WRAPPER_FLAGS_SET_@suffixSalt@=1
diff --git a/third_party/nixpkgs/pkgs/build-support/cc-wrapper/default.nix b/third_party/nixpkgs/pkgs/build-support/cc-wrapper/default.nix
index 60915d6645..14317cbe4c 100644
--- a/third_party/nixpkgs/pkgs/build-support/cc-wrapper/default.nix
+++ b/third_party/nixpkgs/pkgs/build-support/cc-wrapper/default.nix
@@ -100,6 +100,18 @@ let
     else
       false;
 
+
+  darwinPlatformForCC = optionalString stdenv.targetPlatform.isDarwin (
+    if (targetPlatform.darwinPlatform == "macos" && isGNU) then "macosx"
+    else targetPlatform.darwinPlatform
+  );
+
+  darwinMinVersion = optionalString stdenv.targetPlatform.isDarwin (
+    stdenv.targetPlatform.darwinMinVersion
+  );
+
+  darwinMinVersionVariable = optionalString stdenv.targetPlatform.isDarwin
+    stdenv.targetPlatform.darwinMinVersionVariable;
 in
 
 # Ensure bintools matches
@@ -122,6 +134,7 @@ stdenv.mkDerivation {
   gnugrep_bin = if nativeTools then "" else gnugrep;
 
   inherit targetPrefix suffixSalt;
+  inherit darwinPlatformForCC darwinMinVersion darwinMinVersionVariable;
 
   outputs = [ "out" ] ++ optionals propagateDoc [ "man" "info" ];
 
@@ -474,6 +487,10 @@ stdenv.mkDerivation {
       done
     ''
 
+    + optionalString stdenv.targetPlatform.isDarwin ''
+        echo "-arch ${targetPlatform.darwinArch}" >> $out/nix-support/cc-cflags
+    ''
+
     # There are a few tools (to name one libstdcxx5) which do not work
     # well with multi line flags, so make the flags single line again
     + ''
@@ -486,10 +503,6 @@ stdenv.mkDerivation {
       substituteAll ${../wrapper-common/utils.bash} $out/nix-support/utils.bash
     ''
 
-    + optionalString stdenv.targetPlatform.isDarwin ''
-      echo "-arch ${targetPlatform.darwinArch}" >> $out/nix-support/cc-cflags
-    ''
-
     ##
     ## Extra custom steps
     ##
diff --git a/third_party/nixpkgs/pkgs/build-support/wrapper-common/utils.bash b/third_party/nixpkgs/pkgs/build-support/wrapper-common/utils.bash
index d164982b43..66b7c3f3e8 100644
--- a/third_party/nixpkgs/pkgs/build-support/wrapper-common/utils.bash
+++ b/third_party/nixpkgs/pkgs/build-support/wrapper-common/utils.bash
@@ -49,6 +49,35 @@ mangleVarBool() {
     done
 }
 
+# Combine a singular value from all roles. If multiple roles are being served,
+# and the value differs in these roles then the request is impossible to
+# satisfy and we abort immediately.
+mangleVarSingle() {
+    local var="$1"
+    shift
+    local -a role_suffixes=("$@")
+
+    local outputVar="${var}_@suffixSalt@"
+    for suffix in "${role_suffixes[@]}"; do
+        local inputVar="${var}${suffix}"
+        if [ -v "$inputVar" ]; then
+            if [ -v "$outputVar" ]; then
+                if [ "${!outputVar}" != "${!inputVar}" ]; then
+                    {
+                        echo "Multiple conflicting values defined for $outputVar"
+                        echo "Existing value is ${!outputVar}"
+                        echo "Attempting to set to ${!inputVar} via $inputVar"
+                    } >&2
+
+                    exit 1
+                fi
+            else
+                declare -gx ${outputVar}="${!inputVar}"
+            fi
+        fi
+    done
+}
+
 skip () {
     if (( "${NIX_DEBUG:-0}" >= 1 )); then
         echo "skipping impure path $1" >&2
diff --git a/third_party/nixpkgs/pkgs/data/fonts/termsyn/default.nix b/third_party/nixpkgs/pkgs/data/fonts/termsyn/default.nix
new file mode 100644
index 0000000000..50450a04e2
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/data/fonts/termsyn/default.nix
@@ -0,0 +1,26 @@
+{ lib, stdenv, fetchurl, mkfontscale }:
+
+stdenv.mkDerivation rec {
+  pname = "termsyn";
+  version = "1.8.7";
+
+  src = fetchurl {
+    url = "mirror://sourceforge/termsyn/termsyn-${version}.tar.gz";
+    sha256 = "15vsmc3nmzl0pkgdpr2993da7p38fiw2rvcg01pwldzmpqrmkpn6";
+  };
+
+  nativeBuildInputs = [ mkfontscale ];
+
+  installPhase = ''
+    install -m 644 -D *.pcf -t "$out/share/fonts"
+    install -m 644 -D *.psfu -t "$out/share/kbd/consolefonts"
+    mkfontdir "$out/share/fonts"
+  '';
+
+  meta = with lib; {
+    description = "Monospaced font based on terminus and tamsyn";
+    homepage = "https://sourceforge.net/projects/termsyn/";
+    license = licenses.gpl2Only;
+    maintainers = with maintainers; [ sophrosyne ];
+  };
+}
diff --git a/third_party/nixpkgs/pkgs/data/misc/graphs/default.nix b/third_party/nixpkgs/pkgs/data/misc/graphs/default.nix
index 54b6c16613..19438d8356 100644
--- a/third_party/nixpkgs/pkgs/data/misc/graphs/default.nix
+++ b/third_party/nixpkgs/pkgs/data/misc/graphs/default.nix
@@ -4,11 +4,13 @@
 
 stdenv.mkDerivation rec {
   pname = "graphs";
-  version = "20161026";
+  version = "20210214";
 
   src = fetchurl {
-    url = "mirror://sageupstream/${pname}/${pname}-${version}.tar.bz2";
-    sha256 = "0a2b5lly9nifphvknz88rrhfbbc8vqnlqcv19zdpfq8h8nnyjbb2";
+    url = "https://mirrors.mit.edu/sage/spkg/upstream/${pname}/${pname}-${version}.tar.bz2";
+    # TODO: switch to the url below once Sage 9.3 is released
+    # url = "mirror://sageupstream/${pname}/${pname}-${version}.tar.bz2";
+    sha256 = "sha256-ByN8DZhTYRUFw4n9e7klAMh0P1YxurtND0Xf2DMvN0E=";
   };
 
   installPhase = ''
diff --git a/third_party/nixpkgs/pkgs/data/misc/mailcap/default.nix b/third_party/nixpkgs/pkgs/data/misc/mailcap/default.nix
index 725d4ded0e..56d10e5b35 100644
--- a/third_party/nixpkgs/pkgs/data/misc/mailcap/default.nix
+++ b/third_party/nixpkgs/pkgs/data/misc/mailcap/default.nix
@@ -1,23 +1,23 @@
 { lib, fetchzip }:
 
 let
-  version = "2.1.48";
+  version = "2.1.52";
 
 in fetchzip {
   name = "mailcap-${version}";
 
   url = "https://releases.pagure.org/mailcap/mailcap-${version}.tar.xz";
-  sha256 = "08d0avz8971hkggd60dk9yyd14izz24yag3prpfafbvm670jlmqg";
+  sha256 = "sha256-2GRNg3zoMPMaOk2zoAx5sVIzjbQhnYJuaO8nrzWujVc=";
 
   postFetch = ''
     tar -xavf $downloadedFile --strip-components=1
     substituteInPlace mailcap --replace "/usr/bin/" ""
-    gzip mailcap.4
+    gzip mailcap.5
     sh generate-nginx-mimetypes.sh < mime.types > nginx-mime.types
 
     install -D -m0644 nginx-mime.types $out/etc/nginx/mime.types
     install -D -m0644 -t $out/etc mailcap mime.types
-    install -D -m0644 -t $out/share/man/man4 mailcap.4.gz
+    install -D -m0644 -t $out/share/man/man5 mailcap.5.gz
   '';
 
   meta = with lib; {
diff --git a/third_party/nixpkgs/pkgs/data/themes/qogir/default.nix b/third_party/nixpkgs/pkgs/data/themes/qogir/default.nix
index 3f87473a4a..a1011fa0a1 100644
--- a/third_party/nixpkgs/pkgs/data/themes/qogir/default.nix
+++ b/third_party/nixpkgs/pkgs/data/themes/qogir/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "qogir-theme";
-  version = "2021-02-09";
+  version = "2021-04-20";
 
   src = fetchFromGitHub {
     owner = "vinceliuice";
     repo = pname;
     rev = version;
-    sha256 = "1pilq939bqzxysw4ixd279c49bp7l74bykpprrhgc5f2klpjg1zn";
+    sha256 = "17ajrg5safnb6b1jbwvnysc4rvl6gkpnqdf89bammlrpkj6fr3ip";
   };
 
   buildInputs = [ gdk-pixbuf librsvg ];
diff --git a/third_party/nixpkgs/pkgs/desktops/cinnamon/cinnamon-common/default.nix b/third_party/nixpkgs/pkgs/desktops/cinnamon/cinnamon-common/default.nix
index 127516e58c..65eede2583 100644
--- a/third_party/nixpkgs/pkgs/desktops/cinnamon/cinnamon-common/default.nix
+++ b/third_party/nixpkgs/pkgs/desktops/cinnamon/cinnamon-common/default.nix
@@ -19,6 +19,7 @@
 , libsoup
 , libstartup_notification
 , libXtst
+, libXdamage
 , muffin
 , networkmanager
 , pkg-config
@@ -79,6 +80,7 @@ stdenv.mkDerivation rec {
     libsoup
     libstartup_notification
     libXtst
+    libXdamage
     muffin
     networkmanager
     pkg-config
diff --git a/third_party/nixpkgs/pkgs/desktops/gnome-3/core/gnome-shell/default.nix b/third_party/nixpkgs/pkgs/desktops/gnome-3/core/gnome-shell/default.nix
index 2cd22e3cea..97a72e379a 100644
--- a/third_party/nixpkgs/pkgs/desktops/gnome-3/core/gnome-shell/default.nix
+++ b/third_party/nixpkgs/pkgs/desktops/gnome-3/core/gnome-shell/default.nix
@@ -57,6 +57,7 @@
 , gnome-autoar
 , asciidoc-full
 , bash-completion
+, mesa
 }:
 
 # http://sources.gentoo.org/cgi-bin/viewvc.cgi/gentoo-x86/gnome-base/gnome-shell/gnome-shell-3.10.2.1.ebuild?revision=1.3&view=markup
@@ -147,6 +148,7 @@ stdenv.mkDerivation rec {
     gnome-desktop
     gnome-settings-daemon
     gobject-introspection
+    mesa
 
     # recording
     pipewire
diff --git a/third_party/nixpkgs/pkgs/desktops/gnome-3/core/mutter/default.nix b/third_party/nixpkgs/pkgs/desktops/gnome-3/core/mutter/default.nix
index 07e3b536a4..03c20e1ef6 100644
--- a/third_party/nixpkgs/pkgs/desktops/gnome-3/core/mutter/default.nix
+++ b/third_party/nixpkgs/pkgs/desktops/gnome-3/core/mutter/default.nix
@@ -16,9 +16,11 @@
 , ninja
 , xkeyboard_config
 , libxkbfile
+, libXdamage
 , libxkbcommon
 , libXtst
 , libinput
+, libdrm
 , gsettings-desktop-schemas
 , glib
 , gtk3
@@ -27,6 +29,7 @@
 , libgudev
 , libwacom
 , xwayland
+, mesa
 , meson
 , gnome-settings-daemon
 , xorgserver
@@ -84,6 +87,7 @@ let self = stdenv.mkDerivation rec {
   nativeBuildInputs = [
     desktop-file-utils
     gettext
+    mesa # needed for gbm
     meson
     ninja
     pkg-config
@@ -102,12 +106,14 @@ let self = stdenv.mkDerivation rec {
     gsettings-desktop-schemas
     gtk3
     libcanberra
+    libdrm
     libgudev
     libinput
     libstartup_notification
     libwacom
     libxkbcommon
     libxkbfile
+    libXdamage
     pango
     pipewire
     sysprof
diff --git a/third_party/nixpkgs/pkgs/desktops/gnome-3/misc/gnome-flashback/default.nix b/third_party/nixpkgs/pkgs/desktops/gnome-3/misc/gnome-flashback/default.nix
index b65d27bb75..935778aa64 100644
--- a/third_party/nixpkgs/pkgs/desktops/gnome-3/misc/gnome-flashback/default.nix
+++ b/third_party/nixpkgs/pkgs/desktops/gnome-3/misc/gnome-flashback/default.nix
@@ -25,6 +25,7 @@
 , writeTextFile
 , writeShellScriptBin
 , xkeyboard_config
+, xorg
 , runCommand
 }:
 let
@@ -101,6 +102,7 @@ let
       libcanberra-gtk3
       libpulseaudio
       libxkbfile
+      xorg.libXxf86vm
       polkit
       gdm
       gnome-panel
diff --git a/third_party/nixpkgs/pkgs/desktops/gnome-3/misc/metacity/default.nix b/third_party/nixpkgs/pkgs/desktops/gnome-3/misc/metacity/default.nix
index d1b1aeec4c..c74d57d9f4 100644
--- a/third_party/nixpkgs/pkgs/desktops/gnome-3/misc/metacity/default.nix
+++ b/third_party/nixpkgs/pkgs/desktops/gnome-3/misc/metacity/default.nix
@@ -42,6 +42,7 @@ stdenv.mkDerivation rec {
   buildInputs = [
     xorg.libXres
     xorg.libXpresent
+    xorg.libXdamage
     glib
     gsettings-desktop-schemas
     gtk3
diff --git a/third_party/nixpkgs/pkgs/desktops/mate/marco/default.nix b/third_party/nixpkgs/pkgs/desktops/mate/marco/default.nix
index b652be0f71..6ac9c3864a 100644
--- a/third_party/nixpkgs/pkgs/desktops/mate/marco/default.nix
+++ b/third_party/nixpkgs/pkgs/desktops/mate/marco/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchurl, pkg-config, gettext, itstool, libxml2, libcanberra-gtk3, libgtop
-, libstartup_notification, gnome3, gtk3, mate-settings-daemon, wrapGAppsHook, mateUpdateScript }:
+, libXdamage, libXpresent, libstartup_notification, gnome3, gtk3, mate-settings-daemon, wrapGAppsHook, mateUpdateScript }:
 
 stdenv.mkDerivation rec {
   pname = "marco";
@@ -21,6 +21,8 @@ stdenv.mkDerivation rec {
     libxml2
     libcanberra-gtk3
     libgtop
+    libXdamage
+    libXpresent
     libstartup_notification
     gtk3
     gnome3.zenity
diff --git a/third_party/nixpkgs/pkgs/desktops/pantheon/desktop/wingpanel/default.nix b/third_party/nixpkgs/pkgs/desktops/pantheon/desktop/wingpanel/default.nix
index 8e314d3d84..97c2d0c884 100644
--- a/third_party/nixpkgs/pkgs/desktops/pantheon/desktop/wingpanel/default.nix
+++ b/third_party/nixpkgs/pkgs/desktops/pantheon/desktop/wingpanel/default.nix
@@ -13,6 +13,7 @@
 , granite
 , gettext
 , mutter
+, mesa
 , json-glib
 , python3
 , elementary-gtk-theme
@@ -55,6 +56,7 @@ stdenv.mkDerivation rec {
     json-glib
     libgee
     mutter
+    mesa # for libEGL
   ];
 
   patches = [
diff --git a/third_party/nixpkgs/pkgs/desktops/plasma-5/bluedevil.nix b/third_party/nixpkgs/pkgs/desktops/plasma-5/bluedevil.nix
index 7500dda7e3..db1e46f6d4 100644
--- a/third_party/nixpkgs/pkgs/desktops/plasma-5/bluedevil.nix
+++ b/third_party/nixpkgs/pkgs/desktops/plasma-5/bluedevil.nix
@@ -13,5 +13,4 @@ mkDerivation {
     ki18n kio kwindowsystem plasma-framework kcoreaddons kdbusaddons kded
     kiconthemes knotifications kwidgetsaddons
   ];
-  meta.broken = lib.versionOlder qtbase.version "5.15.0";
 }
diff --git a/third_party/nixpkgs/pkgs/desktops/plasma-5/default.nix b/third_party/nixpkgs/pkgs/desktops/plasma-5/default.nix
index 98bf4b025f..ea2e199e93 100644
--- a/third_party/nixpkgs/pkgs/desktops/plasma-5/default.nix
+++ b/third_party/nixpkgs/pkgs/desktops/plasma-5/default.nix
@@ -30,6 +30,13 @@ existing packages here and modify it as necessary.
 }:
 
 let
+  minQtVersion = "5.15";
+  broken = lib.versionOlder libsForQt5.qtbase.version minQtVersion;
+  maintainers = with lib.maintainers; [ ttuegel nyanloutre ];
+  license = with lib.licenses; [
+    lgpl21Plus lgpl3Plus bsd2 mit gpl2Plus gpl3Plus fdl12
+  ];
+
   srcs = import ./srcs.nix {
     inherit fetchurl;
     mirror = "mirror://kde";
@@ -81,14 +88,15 @@ let
             defaultSetupHook = if hasBin && hasDev then propagateBin else null;
             setupHook = args.setupHook or defaultSetupHook;
 
-            meta = {
-              license = with lib.licenses; [
-                lgpl21Plus lgpl3Plus bsd2 mit gpl2Plus gpl3Plus fdl12
-              ];
-              platforms = lib.platforms.linux;
-              maintainers = with lib.maintainers; [ ttuegel nyanloutre ];
-              homepage = "http://www.kde.org";
-            } // (args.meta or {});
+            meta =
+              let meta = args.meta or {}; in
+              meta // {
+                homepage = meta.homepage or "http://www.kde.org";
+                license = meta.license or license;
+                maintainers = (meta.maintainers or []) ++ maintainers;
+                platforms = meta.platforms or lib.platforms.linux;
+                broken = meta.broken or broken;
+              };
           in
           mkDerivation (args // {
             name = "${name}-${version}";
diff --git a/third_party/nixpkgs/pkgs/desktops/plasma-5/discover.nix b/third_party/nixpkgs/pkgs/desktops/plasma-5/discover.nix
index 75e0fd6917..e065837cd2 100644
--- a/third_party/nixpkgs/pkgs/desktops/plasma-5/discover.nix
+++ b/third_party/nixpkgs/pkgs/desktops/plasma-5/discover.nix
@@ -33,7 +33,6 @@
 
 mkDerivation {
   name = "discover";
-  meta.broken = lib.versionOlder qtbase.version "5.15.0";
   nativeBuildInputs = [ extra-cmake-modules gettext kdoctools python3 ];
   buildInputs = [
     # discount is needed for libmarkdown
diff --git a/third_party/nixpkgs/pkgs/desktops/plasma-5/kactivitymanagerd.nix b/third_party/nixpkgs/pkgs/desktops/plasma-5/kactivitymanagerd.nix
index 5c856b9d39..47543da111 100644
--- a/third_party/nixpkgs/pkgs/desktops/plasma-5/kactivitymanagerd.nix
+++ b/third_party/nixpkgs/pkgs/desktops/plasma-5/kactivitymanagerd.nix
@@ -7,7 +7,6 @@
 
 mkDerivation {
   name = "kactivitymanagerd";
-  meta.broken = lib.versionOlder qtbase.version "5.15.0";
   nativeBuildInputs = [ extra-cmake-modules ];
   buildInputs = [
     boost kconfig kcoreaddons kdbusaddons kglobalaccel ki18n kio kwindowsystem
diff --git a/third_party/nixpkgs/pkgs/desktops/plasma-5/kdecoration.nix b/third_party/nixpkgs/pkgs/desktops/plasma-5/kdecoration.nix
index 9a09ce30f4..9b67d7bc52 100644
--- a/third_party/nixpkgs/pkgs/desktops/plasma-5/kdecoration.nix
+++ b/third_party/nixpkgs/pkgs/desktops/plasma-5/kdecoration.nix
@@ -5,5 +5,4 @@ mkDerivation {
   nativeBuildInputs = [ extra-cmake-modules ];
   buildInputs = [ qtbase ki18n ];
   outputs = [ "out" "dev" ];
-  meta.broken = lib.versionOlder qtbase.version "5.15.0";
 }
diff --git a/third_party/nixpkgs/pkgs/desktops/plasma-5/kgamma5.nix b/third_party/nixpkgs/pkgs/desktops/plasma-5/kgamma5.nix
index e7cc42e77c..d371ce8151 100644
--- a/third_party/nixpkgs/pkgs/desktops/plasma-5/kgamma5.nix
+++ b/third_party/nixpkgs/pkgs/desktops/plasma-5/kgamma5.nix
@@ -8,5 +8,4 @@ mkDerivation {
   name = "kgamma5";
   nativeBuildInputs = [ extra-cmake-modules kdoctools ];
   buildInputs = [ kconfig kconfigwidgets ki18n qtx11extras libXxf86vm ];
-  meta.broken = lib.versionOlder qtbase.version "5.15";
 }
diff --git a/third_party/nixpkgs/pkgs/desktops/plasma-5/khotkeys.nix b/third_party/nixpkgs/pkgs/desktops/plasma-5/khotkeys.nix
index ad78d602de..fd36644386 100644
--- a/third_party/nixpkgs/pkgs/desktops/plasma-5/khotkeys.nix
+++ b/third_party/nixpkgs/pkgs/desktops/plasma-5/khotkeys.nix
@@ -14,5 +14,4 @@ mkDerivation {
     plasma-framework plasma-workspace qtx11extras
   ];
   outputs = [ "bin" "dev" "out" ];
-  meta.broken = lib.versionOlder qtbase.version "5.14";
 }
diff --git a/third_party/nixpkgs/pkgs/desktops/plasma-5/kinfocenter.nix b/third_party/nixpkgs/pkgs/desktops/plasma-5/kinfocenter.nix
index 23e225bd74..f7f50dc3b5 100644
--- a/third_party/nixpkgs/pkgs/desktops/plasma-5/kinfocenter.nix
+++ b/third_party/nixpkgs/pkgs/desktops/plasma-5/kinfocenter.nix
@@ -10,7 +10,6 @@
 
 mkDerivation {
   name = "kinfocenter";
-  meta.broken = lib.versionOlder qtbase.version "5.15.0";
   nativeBuildInputs = [ extra-cmake-modules kdoctools ];
   buildInputs = [
     kcmutils kcompletion kconfig kconfigwidgets kcoreaddons kdbusaddons
diff --git a/third_party/nixpkgs/pkgs/desktops/plasma-5/kscreenlocker.nix b/third_party/nixpkgs/pkgs/desktops/plasma-5/kscreenlocker.nix
index ace14b385e..2fc26216bf 100644
--- a/third_party/nixpkgs/pkgs/desktops/plasma-5/kscreenlocker.nix
+++ b/third_party/nixpkgs/pkgs/desktops/plasma-5/kscreenlocker.nix
@@ -8,7 +8,6 @@
 
 mkDerivation {
   name = "kscreenlocker";
-  meta.broken = lib.versionOlder qtbase.version "5.15.0";
   nativeBuildInputs = [ extra-cmake-modules kdoctools ];
   buildInputs = [
     kcmutils kcrash kdeclarative kdelibs4support kglobalaccel kidletime kwayland
diff --git a/third_party/nixpkgs/pkgs/desktops/plasma-5/ksshaskpass.nix b/third_party/nixpkgs/pkgs/desktops/plasma-5/ksshaskpass.nix
index c4dabd7134..bc6702ed6d 100644
--- a/third_party/nixpkgs/pkgs/desktops/plasma-5/ksshaskpass.nix
+++ b/third_party/nixpkgs/pkgs/desktops/plasma-5/ksshaskpass.nix
@@ -8,5 +8,4 @@ mkDerivation {
   name = "ksshaskpass";
   nativeBuildInputs = [ extra-cmake-modules kdoctools ];
   buildInputs = [ kcoreaddons ki18n kwallet kwidgetsaddons qtbase ];
-  meta.broken = lib.versionOlder qtbase.version "5.15.0";
 }
diff --git a/third_party/nixpkgs/pkgs/desktops/plasma-5/ksysguard.nix b/third_party/nixpkgs/pkgs/desktops/plasma-5/ksysguard.nix
index 27d0ab8a0f..fe904bb97a 100644
--- a/third_party/nixpkgs/pkgs/desktops/plasma-5/ksysguard.nix
+++ b/third_party/nixpkgs/pkgs/desktops/plasma-5/ksysguard.nix
@@ -9,7 +9,6 @@
 
 mkDerivation {
   name = "ksysguard";
-  meta.broken = lib.versionOlder qtbase.version "5.15.0";
   nativeBuildInputs = [ extra-cmake-modules kdoctools ];
   buildInputs = [
     kconfig kcoreaddons kitemviews knewstuff kiconthemes libksysguard
diff --git a/third_party/nixpkgs/pkgs/desktops/plasma-5/kwayland-integration.nix b/third_party/nixpkgs/pkgs/desktops/plasma-5/kwayland-integration.nix
index 2e923094dc..f886a87feb 100644
--- a/third_party/nixpkgs/pkgs/desktops/plasma-5/kwayland-integration.nix
+++ b/third_party/nixpkgs/pkgs/desktops/plasma-5/kwayland-integration.nix
@@ -8,5 +8,4 @@ mkDerivation {
   name = "kwayland-integration";
   nativeBuildInputs = [ extra-cmake-modules ];
   buildInputs = [ kguiaddons kidletime kwindowsystem kwayland qtbase ];
-  meta.broken = lib.versionOlder qtbase.version "5.15.0";
 }
diff --git a/third_party/nixpkgs/pkgs/desktops/plasma-5/kwayland-server/default.nix b/third_party/nixpkgs/pkgs/desktops/plasma-5/kwayland-server/default.nix
index 6d2a3fabff..f24e0e6d6a 100644
--- a/third_party/nixpkgs/pkgs/desktops/plasma-5/kwayland-server/default.nix
+++ b/third_party/nixpkgs/pkgs/desktops/plasma-5/kwayland-server/default.nix
@@ -15,5 +15,4 @@ mkDerivation {
     kwayland plasma-wayland-protocols wayland wayland-protocols
   ];
   patches = [ ./0001-Use-KDE_INSTALL_TARGETS_DEFAULT_ARGS-when-installing.patch ];
-  meta.broken = lib.versionOlder qtbase.version "5.15.0";
 }
diff --git a/third_party/nixpkgs/pkgs/desktops/plasma-5/kwrited.nix b/third_party/nixpkgs/pkgs/desktops/plasma-5/kwrited.nix
index e6ee4829bc..bb8798d2d0 100644
--- a/third_party/nixpkgs/pkgs/desktops/plasma-5/kwrited.nix
+++ b/third_party/nixpkgs/pkgs/desktops/plasma-5/kwrited.nix
@@ -8,5 +8,4 @@ mkDerivation {
   name = "kwrited";
   nativeBuildInputs = [ extra-cmake-modules ];
   buildInputs = [ kcoreaddons kdbusaddons ki18n knotifications kpty qtbase ];
-  meta.broken = lib.versionOlder qtbase.version "5.15.0";
 }
diff --git a/third_party/nixpkgs/pkgs/desktops/plasma-5/libkscreen/default.nix b/third_party/nixpkgs/pkgs/desktops/plasma-5/libkscreen/default.nix
index 08a9e6f4f2..5cd9ae9430 100644
--- a/third_party/nixpkgs/pkgs/desktops/plasma-5/libkscreen/default.nix
+++ b/third_party/nixpkgs/pkgs/desktops/plasma-5/libkscreen/default.nix
@@ -6,9 +6,6 @@
 
 mkDerivation {
   name = "libkscreen";
-  meta = {
-    broken = lib.versionOlder qtbase.version "5.15.0";
-  };
   nativeBuildInputs = [ extra-cmake-modules ];
   buildInputs = [ kwayland libXrandr qtx11extras ];
   outputs = [ "out" "dev" ];
diff --git a/third_party/nixpkgs/pkgs/desktops/plasma-5/libksysguard/default.nix b/third_party/nixpkgs/pkgs/desktops/plasma-5/libksysguard/default.nix
index 8178d40795..e291bc5c4c 100644
--- a/third_party/nixpkgs/pkgs/desktops/plasma-5/libksysguard/default.nix
+++ b/third_party/nixpkgs/pkgs/desktops/plasma-5/libksysguard/default.nix
@@ -8,7 +8,6 @@
 
 mkDerivation {
   name = "libksysguard";
-  meta.broken = lib.versionOlder qtbase.version "5.14.0";
   patches = [
     ./0001-qdiriterator-follow-symlinks.patch
   ];
diff --git a/third_party/nixpkgs/pkgs/desktops/plasma-5/milou.nix b/third_party/nixpkgs/pkgs/desktops/plasma-5/milou.nix
index ab23703a47..0e7169abf6 100644
--- a/third_party/nixpkgs/pkgs/desktops/plasma-5/milou.nix
+++ b/third_party/nixpkgs/pkgs/desktops/plasma-5/milou.nix
@@ -7,7 +7,6 @@
 
 mkDerivation {
   name = "milou";
-  meta.broken = lib.versionOlder qtbase.version "5.15.0";
   nativeBuildInputs = [ extra-cmake-modules ];
   buildInputs = [
     kcoreaddons kdeclarative ki18n kitemmodels krunner kservice plasma-framework
diff --git a/third_party/nixpkgs/pkgs/desktops/plasma-5/plasma-nm/default.nix b/third_party/nixpkgs/pkgs/desktops/plasma-5/plasma-nm/default.nix
index 31fd355895..585f7462c9 100644
--- a/third_party/nixpkgs/pkgs/desktops/plasma-5/plasma-nm/default.nix
+++ b/third_party/nixpkgs/pkgs/desktops/plasma-5/plasma-nm/default.nix
@@ -11,7 +11,6 @@
 
 mkDerivation {
   name = "plasma-nm";
-  meta.broken = lib.versionOlder qtbase.version "5.15.0";
   nativeBuildInputs = [ extra-cmake-modules kdoctools qttools ];
   buildInputs = [
     kdeclarative kdelibs4support ki18n kio kwindowsystem plasma-framework
diff --git a/third_party/nixpkgs/pkgs/desktops/plasma-5/plasma-pa.nix b/third_party/nixpkgs/pkgs/desktops/plasma-5/plasma-pa.nix
index 00f5fefdc4..bc39e520f8 100644
--- a/third_party/nixpkgs/pkgs/desktops/plasma-5/plasma-pa.nix
+++ b/third_party/nixpkgs/pkgs/desktops/plasma-5/plasma-pa.nix
@@ -17,5 +17,4 @@ mkDerivation {
 
     qtbase qtdeclarative
   ];
-  meta.broken = lib.versionOlder qtbase.version "5.15.0";
 }
diff --git a/third_party/nixpkgs/pkgs/desktops/plasma-5/plasma-systemmonitor.nix b/third_party/nixpkgs/pkgs/desktops/plasma-5/plasma-systemmonitor.nix
index 6b875745d2..f69808bf45 100644
--- a/third_party/nixpkgs/pkgs/desktops/plasma-5/plasma-systemmonitor.nix
+++ b/third_party/nixpkgs/pkgs/desktops/plasma-5/plasma-systemmonitor.nix
@@ -16,7 +16,6 @@
 
 mkDerivation {
   name = "plasma-systemmonitor";
-  meta.broken = lib.versionOlder qtbase.version "5.15.0";
   nativeBuildInputs = [ extra-cmake-modules kdoctools ];
   buildInputs = [
     qtquickcontrols2
diff --git a/third_party/nixpkgs/pkgs/desktops/plasma-5/polkit-kde-agent.nix b/third_party/nixpkgs/pkgs/desktops/plasma-5/polkit-kde-agent.nix
index 27f03e2d93..72217204b3 100644
--- a/third_party/nixpkgs/pkgs/desktops/plasma-5/polkit-kde-agent.nix
+++ b/third_party/nixpkgs/pkgs/desktops/plasma-5/polkit-kde-agent.nix
@@ -12,5 +12,4 @@ mkDerivation {
     knotifications kwindowsystem polkit-qt
   ];
   outputs = [ "out" "dev" ];
-  meta.broken = lib.versionOlder qtbase.version "5.15.0";
 }
diff --git a/third_party/nixpkgs/pkgs/desktops/plasma-5/sddm-kcm.nix b/third_party/nixpkgs/pkgs/desktops/plasma-5/sddm-kcm.nix
index 9e3776e8e2..7c44e0f140 100644
--- a/third_party/nixpkgs/pkgs/desktops/plasma-5/sddm-kcm.nix
+++ b/third_party/nixpkgs/pkgs/desktops/plasma-5/sddm-kcm.nix
@@ -18,7 +18,6 @@
 
 mkDerivation {
   name = "sddm-kcm";
-  meta.broken = lib.versionOlder qtbase.version "5.15.0";
   nativeBuildInputs = [ extra-cmake-modules shared-mime-info ];
   buildInputs = [
     libpthreadstubs
diff --git a/third_party/nixpkgs/pkgs/desktops/plasma-5/xdg-desktop-portal-kde.nix b/third_party/nixpkgs/pkgs/desktops/plasma-5/xdg-desktop-portal-kde.nix
index aade506483..f754bc5a46 100644
--- a/third_party/nixpkgs/pkgs/desktops/plasma-5/xdg-desktop-portal-kde.nix
+++ b/third_party/nixpkgs/pkgs/desktops/plasma-5/xdg-desktop-portal-kde.nix
@@ -9,7 +9,6 @@
 
 mkDerivation {
   name = "xdg-desktop-portal-kde";
-  meta.broken = lib.versionOlder qtbase.version "5.15.0";
   nativeBuildInputs = [ extra-cmake-modules gettext kdoctools ];
   buildInputs = [
     cups epoxy mesa pcre pipewire wayland wayland-protocols
diff --git a/third_party/nixpkgs/pkgs/development/compilers/koka/default.nix b/third_party/nixpkgs/pkgs/development/compilers/koka/default.nix
index 087b0ad115..6523dcca2f 100644
--- a/third_party/nixpkgs/pkgs/development/compilers/koka/default.nix
+++ b/third_party/nixpkgs/pkgs/development/compilers/koka/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildPackages, cmake, gnumake, makeWrapper, mkDerivation, fetchFromGitHub
+{ stdenv, pkgsHostTarget, cmake, makeWrapper, mkDerivation, fetchFromGitHub
 , alex, array, base, bytestring, cond, containers, directory, extra
 , filepath, haskeline, hpack, hspec, hspec-core, json, lib, mtl
 , parsec, process, regex-compat, text, time }:
@@ -18,11 +18,12 @@ let
     src = "${src}/kklib";
     nativeBuildInputs = [ cmake ];
   };
+  inherit (pkgsHostTarget.targetPackages.stdenv) cc;
   runtimeDeps = [
-    buildPackages.stdenv.cc
-    buildPackages.stdenv.cc.bintools.bintools
-    gnumake
-    cmake
+    cc
+    cc.bintools.bintools
+    pkgsHostTarget.gnumake
+    pkgsHostTarget.cmake
   ];
 in
 mkDerivation rec {
@@ -42,7 +43,7 @@ mkDerivation rec {
     cp -a contrib $out/share/koka/v${version}
     cp -a kklib $out/share/koka/v${version}
     wrapProgram "$out/bin/koka" \
-      --set CC "${lib.getBin buildPackages.stdenv.cc}/bin/${buildPackages.stdenv.cc.targetPrefix}cc" \
+      --set CC "${lib.getBin cc}/bin/${cc.targetPrefix}cc" \
       --prefix PATH : "${lib.makeSearchPath "bin" runtimeDeps}"
   '';
   doCheck = false;
diff --git a/third_party/nixpkgs/pkgs/development/compilers/rust/1_51.nix b/third_party/nixpkgs/pkgs/development/compilers/rust/1_51.nix
index bbdf8111e1..a489df471a 100644
--- a/third_party/nixpkgs/pkgs/development/compilers/rust/1_51.nix
+++ b/third_party/nixpkgs/pkgs/development/compilers/rust/1_51.nix
@@ -45,6 +45,7 @@ import ./default.nix {
     aarch64-unknown-linux-gnu = "1db7a4fbddc68cd29eb9bca9fa7d0d2d9e3d59ede7ddaad66222fb4336a6bacf";
     aarch64-unknown-linux-musl = "adcc6c76a8967bacb6687b565d3cf739e35fde066b03edb745b05b52fa8b5b36";
     x86_64-apple-darwin = "1bf5a7ecf6468ce1bf9fe49c8083b3f648b40c16fbfb7539d106fe28eb0e792e";
+    aarch64-apple-darwin = "1ed91a867e7b86cc4bc84c0838240f1c25acd007100ec9f7a14c4873e4b56561";
     powerpc64le-unknown-linux-gnu = "e0472589d3f9ba7ebf27f033af320e0d5cfb70222955bd8ed73ce2c9a70ae535";
   };
 
diff --git a/third_party/nixpkgs/pkgs/development/compilers/rust/print-hashes.sh b/third_party/nixpkgs/pkgs/development/compilers/rust/print-hashes.sh
index 0639726f48..c24052fcc0 100755
--- a/third_party/nixpkgs/pkgs/development/compilers/rust/print-hashes.sh
+++ b/third_party/nixpkgs/pkgs/development/compilers/rust/print-hashes.sh
@@ -16,6 +16,7 @@ PLATFORMS=(
   aarch64-unknown-linux-gnu
   aarch64-unknown-linux-musl
   x86_64-apple-darwin
+  aarch64-apple-darwin
   powerpc64le-unknown-linux-gnu
 )
 BASEURL=https://static.rust-lang.org/dist
diff --git a/third_party/nixpkgs/pkgs/development/coq-modules/coqhammer/default.nix b/third_party/nixpkgs/pkgs/development/coq-modules/coqhammer/default.nix
index 89aa8d74e8..9358274556 100644
--- a/third_party/nixpkgs/pkgs/development/coq-modules/coqhammer/default.nix
+++ b/third_party/nixpkgs/pkgs/development/coq-modules/coqhammer/default.nix
@@ -5,18 +5,27 @@ with lib; mkCoqDerivation {
   pname = "coqhammer";
   owner = "lukaszcz";
   defaultVersion = with versions; switch coq.coq-version [
-    { case = "8.12"; out = "1.3-coq8.12"; }
-    { case = "8.11"; out = "1.3-coq8.11"; }
-    { case = "8.10"; out = "1.3-coq8.10"; }
+    { case = "8.13"; out = "1.3.1-coq8.13"; }
+    { case = "8.12"; out = "1.3.1-coq8.12"; }
+    { case = "8.11"; out = "1.3.1-coq8.11"; }
+    { case = "8.10"; out = "1.3.1-coq8.10"; }
     { case = "8.9";  out = "1.1.1-coq8.9"; }
     { case = "8.8";  out = "1.1-coq8.8"; }
   ] null;
+  release."1.3.1-coq8.13".sha256 = "033j6saw24anb1lqbgsg1zynxi2rnxq7pgqwh11k8r8y3xisz78w";
+  release."1.3.1-coq8.12".sha256 = "0xy3vy4rv8w5ydwb9nq8y4dcimd91yr0hak2j4kn02svssg1kv1y";
+  release."1.3.1-coq8.11".sha256 = "0i9nlcayq0ac95vc09d1w8sd221gdjs0g215n086qscqjwimnz8j";
+  release."1.3.1-coq8.10".sha256 = "0aq9qwqx680lkidhb77fmyq403rvfcdxch849x1pzy6a48rz5yra";
   release."1.3-coq8.12".sha256   = "1q1y3cwhd98pkm98g71fsdjz85bfwgcz2xn7s7wwmiraifv5l6z8";
   release."1.3-coq8.11".sha256   = "08zf8qfna7b9p2myfaz4g7bas3a1q1156x78n5isqivlnqfrjc1b";
   release."1.3-coq8.10".sha256   = "1fj8497ir4m79hyrmmmmrag01001wrby0h24wv6525vz0w5py3cd";
   release."1.1.1-coq8.9".sha256  = "1knjmz4hr8vlp103j8n4fyb2lfxysnm512gh3m2kp85n6as6fvb9";
   release."1.1-coq8.8".sha256    = "0ms086wp4jmrzyglb8wymchzyflflk01nsfsk4r6qv8rrx81nx9h";
 
+  release."1.3.1-coq8.13".version  = "1.3.1";
+  release."1.3.1-coq8.12".version  = "1.3.1";
+  release."1.3.1-coq8.11".version  = "1.3.1";
+  release."1.3.1-coq8.10".version  = "1.3.1";
   release."1.3-coq8.12".version  = "1.3";
   release."1.3-coq8.11".version  = "1.3";
   release."1.3-coq8.10".version  = "1.3";
diff --git a/third_party/nixpkgs/pkgs/development/coq-modules/tlc/default.nix b/third_party/nixpkgs/pkgs/development/coq-modules/tlc/default.nix
index 6bbad1c6c2..1e212b44e7 100644
--- a/third_party/nixpkgs/pkgs/development/coq-modules/tlc/default.nix
+++ b/third_party/nixpkgs/pkgs/development/coq-modules/tlc/default.nix
@@ -1,23 +1,29 @@
 { lib, mkCoqDerivation, coq, version ? null }:
 
-with lib; mkCoqDerivation {
+with lib; (mkCoqDerivation {
   pname = "tlc";
   owner = "charguer";
   inherit version;
   displayVersion = { tlc = false; };
   defaultVersion = with versions; switch coq.coq-version [
+    { case = range "8.12" "8.13"; out = "20210316"; }
     { case = range "8.10" "8.12"; out = "20200328"; }
     { case = range "8.6"  "8.12"; out = "20181116"; }
   ] null;
+  release."20210316".sha256 = "1hlavnx20lxpf2iydbbxqmim9p8wdwv4phzp9ypij93yivih0g4a";
   release."20200328".sha256 = "16vzild9gni8zhgb3qhmka47f8zagdh03k6nssif7drpim8233lx";
   release."20181116".sha256 = "032lrbkxqm9d3fhf6nv1kq2z0mqd3czv3ijlbsjwnfh12xck4vpl";
 
-  installFlags = [ "CONTRIB=$(out)/lib/coq/${coq.coq-version}/user-contrib" ];
-
   meta = {
     homepage = "http://www.chargueraud.org/softs/tlc/";
     description = "A non-constructive library for Coq";
     license = licenses.free;
     maintainers = [ maintainers.vbgl ];
   };
-}
+}).overrideAttrs (x:
+  if versionAtLeast x.version "20210316"
+  then {}
+  else {
+    installFlags = [ "CONTRIB=$(out)/lib/coq/${coq.coq-version}/user-contrib" ];
+  }
+)
diff --git a/third_party/nixpkgs/pkgs/development/interpreters/python/cpython/2.7/CVE-2021-23336.patch b/third_party/nixpkgs/pkgs/development/interpreters/python/cpython/2.7/CVE-2021-23336.patch
new file mode 100644
index 0000000000..760d0e7eed
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/development/interpreters/python/cpython/2.7/CVE-2021-23336.patch
@@ -0,0 +1,390 @@
+From e7b005c05dbdbce967a409abd71641281a8604bf Mon Sep 17 00:00:00 2001
+From: Senthil Kumaran <senthil@uthcode.com>
+Date: Mon, 15 Feb 2021 11:16:43 -0800
+Subject: [PATCH 24/26] [3.6] bpo-42967: only use '&' as a query string
+ separator (GH-24297)  (GH-24532)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+bpo-42967: [security] Address a web cache-poisoning issue reported in
+urllib.parse.parse_qsl().
+
+urllib.parse will only us "&" as query string separator by default
+instead of both ";" and "&" as allowed in earlier versions. An optional
+argument seperator with default value "&" is added to specify the
+separator.
+
+Co-authored-by: Éric Araujo <merwok@netwok.org>
+Co-authored-by: Ken Jin <28750310+Fidget-Spinner@users.noreply.github.com>
+Co-authored-by: Adam Goldschmidt <adamgold7@gmail.com>
+
+Rebased for Python 2.7 by Michał Górny
+---
+ Doc/library/cgi.rst                           |  7 +++-
+ Doc/library/urlparse.rst                      | 23 ++++++++++-
+ Lib/cgi.py                                    | 20 +++++++---
+ Lib/test/test_cgi.py                          | 29 +++++++++++---
+ Lib/test/test_urlparse.py                     | 38 +++++++++----------
+ Lib/urlparse.py                               | 22 ++++++++---
+ .../2021-02-14-15-59-16.bpo-42967.YApqDS.rst  |  1 +
+ 7 files changed, 100 insertions(+), 40 deletions(-)
+ create mode 100644 Misc/NEWS.d/next/Security/2021-02-14-15-59-16.bpo-42967.YApqDS.rst
+
+diff --git a/Doc/library/cgi.rst b/Doc/library/cgi.rst
+index ecd62c8c01..b85cdd8b61 100644
+--- a/Doc/library/cgi.rst
++++ b/Doc/library/cgi.rst
+@@ -285,10 +285,10 @@ These are useful if you want more control, or if you want to employ some of the
+ algorithms implemented in this module in other circumstances.
+ 
+ 
+-.. function:: parse(fp[, environ[, keep_blank_values[, strict_parsing]]])
++.. function:: parse(fp[, environ[, keep_blank_values[, strict_parsing]]], separator="&")
+ 
+    Parse a query in the environment or from a file (the file defaults to
+-   ``sys.stdin`` and environment defaults to ``os.environ``).  The *keep_blank_values* and *strict_parsing* parameters are
++   ``sys.stdin`` and environment defaults to ``os.environ``).  The *keep_blank_values*, *strict_parsing* and *separator* parameters are
+    passed to :func:`urlparse.parse_qs` unchanged.
+ 
+ 
+@@ -316,6 +316,9 @@ algorithms implemented in this module in other circumstances.
+    Note that this does not parse nested multipart parts --- use
+    :class:`FieldStorage` for that.
+ 
++   .. versionchanged:: 3.6.13
++      Added the *separator* parameter.
++
+ 
+ .. function:: parse_header(string)
+ 
+diff --git a/Doc/library/urlparse.rst b/Doc/library/urlparse.rst
+index 0989c88c30..2f8e4c5a44 100644
+--- a/Doc/library/urlparse.rst
++++ b/Doc/library/urlparse.rst
+@@ -136,7 +136,7 @@ The :mod:`urlparse` module defines the following functions:
+       now raise :exc:`ValueError`.
+ 
+ 
+-.. function:: parse_qs(qs[, keep_blank_values[, strict_parsing[, max_num_fields]]])
++.. function:: parse_qs(qs[, keep_blank_values[, strict_parsing[, max_num_fields]]], separator='&')
+ 
+    Parse a query string given as a string argument (data of type
+    :mimetype:`application/x-www-form-urlencoded`).  Data are returned as a
+@@ -157,6 +157,9 @@ The :mod:`urlparse` module defines the following functions:
+    read. If set, then throws a :exc:`ValueError` if there are more than
+    *max_num_fields* fields read.
+ 
++   The optional argument *separator* is the symbol to use for separating the
++   query arguments. It defaults to ``&``.
++
+    Use the :func:`urllib.urlencode` function to convert such dictionaries into
+    query strings.
+ 
+@@ -166,7 +169,14 @@ The :mod:`urlparse` module defines the following functions:
+    .. versionchanged:: 2.7.16
+       Added *max_num_fields* parameter.
+ 
+-.. function:: parse_qsl(qs[, keep_blank_values[, strict_parsing[, max_num_fields]]])
++   .. versionchanged:: 2.7.18-gentoo
++      Added *separator* parameter with the default value of ``&``. Earlier
++      Python versions allowed using both ``;`` and ``&`` as query parameter
++      separator. This has been changed to allow only a single separator key,
++      with ``&`` as the default separator.
++
++
++.. function:: parse_qsl(qs[, keep_blank_values[, strict_parsing[, max_num_fields]]], separator='&')
+ 
+    Parse a query string given as a string argument (data of type
+    :mimetype:`application/x-www-form-urlencoded`).  Data are returned as a list of
+@@ -186,6 +196,9 @@ The :mod:`urlparse` module defines the following functions:
+    read. If set, then throws a :exc:`ValueError` if there are more than
+    *max_num_fields* fields read.
+ 
++   The optional argument *separator* is the symbol to use for separating the
++   query arguments. It defaults to ``&``.
++
+    Use the :func:`urllib.urlencode` function to convert such lists of pairs into
+    query strings.
+ 
+@@ -195,6 +208,12 @@ The :mod:`urlparse` module defines the following functions:
+    .. versionchanged:: 2.7.16
+       Added *max_num_fields* parameter.
+ 
++   .. versionchanged:: 2.7.18-gentoo
++      Added *separator* parameter with the default value of ``&``. Earlier
++      Python versions allowed using both ``;`` and ``&`` as query parameter
++      separator. This has been changed to allow only a single separator key,
++      with ``&`` as the default separator.
++
+ .. function:: urlunparse(parts)
+ 
+    Construct a URL from a tuple as returned by ``urlparse()``. The *parts* argument
+diff --git a/Lib/cgi.py b/Lib/cgi.py
+index 5b903e0347..9d0848b6b1 100755
+--- a/Lib/cgi.py
++++ b/Lib/cgi.py
+@@ -121,7 +121,8 @@ log = initlog           # The current logging function
+ # 0 ==> unlimited input
+ maxlen = 0
+ 
+-def parse(fp=None, environ=os.environ, keep_blank_values=0, strict_parsing=0):
++def parse(fp=None, environ=os.environ, keep_blank_values=0,
++          strict_parsing=0, separator='&'):
+     """Parse a query in the environment or from a file (default stdin)
+ 
+         Arguments, all optional:
+@@ -140,6 +141,9 @@ def parse(fp=None, environ=os.environ, keep_blank_values=0, strict_parsing=0):
+         strict_parsing: flag indicating what to do with parsing errors.
+             If false (the default), errors are silently ignored.
+             If true, errors raise a ValueError exception.
++
++        separator: str. The symbol to use for separating the query arguments.
++            Defaults to &.
+     """
+     if fp is None:
+         fp = sys.stdin
+@@ -171,7 +175,8 @@ def parse(fp=None, environ=os.environ, keep_blank_values=0, strict_parsing=0):
+         else:
+             qs = ""
+         environ['QUERY_STRING'] = qs    # XXX Shouldn't, really
+-    return urlparse.parse_qs(qs, keep_blank_values, strict_parsing)
++    return urlparse.parse_qs(qs, keep_blank_values, strict_parsing,
++                             separator=separator)
+ 
+ 
+ # parse query string function called from urlparse,
+@@ -395,7 +400,7 @@ class FieldStorage:
+ 
+     def __init__(self, fp=None, headers=None, outerboundary="",
+                  environ=os.environ, keep_blank_values=0, strict_parsing=0,
+-                 max_num_fields=None):
++                 max_num_fields=None, separator='&'):
+         """Constructor.  Read multipart/* until last part.
+ 
+         Arguments, all optional:
+@@ -430,6 +435,7 @@ class FieldStorage:
+         self.keep_blank_values = keep_blank_values
+         self.strict_parsing = strict_parsing
+         self.max_num_fields = max_num_fields
++        self.separator = separator
+         if 'REQUEST_METHOD' in environ:
+             method = environ['REQUEST_METHOD'].upper()
+         self.qs_on_post = None
+@@ -613,7 +619,8 @@ class FieldStorage:
+         if self.qs_on_post:
+             qs += '&' + self.qs_on_post
+         query = urlparse.parse_qsl(qs, self.keep_blank_values,
+-                                   self.strict_parsing, self.max_num_fields)
++                                   self.strict_parsing, self.max_num_fields,
++                                   separator=self.separator)
+         self.list = [MiniFieldStorage(key, value) for key, value in query]
+         self.skip_lines()
+ 
+@@ -629,7 +636,8 @@ class FieldStorage:
+             query = urlparse.parse_qsl(self.qs_on_post,
+                                        self.keep_blank_values,
+                                        self.strict_parsing,
+-                                       self.max_num_fields)
++                                       self.max_num_fields,
++                                       separator=self.separator)
+             self.list.extend(MiniFieldStorage(key, value)
+                              for key, value in query)
+             FieldStorageClass = None
+@@ -649,7 +657,7 @@ class FieldStorage:
+             headers = rfc822.Message(self.fp)
+             part = klass(self.fp, headers, ib,
+                          environ, keep_blank_values, strict_parsing,
+-                         max_num_fields)
++                         max_num_fields, separator=self.separator)
+ 
+             if max_num_fields is not None:
+                 max_num_fields -= 1
+diff --git a/Lib/test/test_cgi.py b/Lib/test/test_cgi.py
+index 743c2afbd4..f414faa23b 100644
+--- a/Lib/test/test_cgi.py
++++ b/Lib/test/test_cgi.py
+@@ -61,12 +61,9 @@ parse_strict_test_cases = [
+     ("", ValueError("bad query field: ''")),
+     ("&", ValueError("bad query field: ''")),
+     ("&&", ValueError("bad query field: ''")),
+-    (";", ValueError("bad query field: ''")),
+-    (";&;", ValueError("bad query field: ''")),
+     # Should the next few really be valid?
+     ("=", {}),
+     ("=&=", {}),
+-    ("=;=", {}),
+     # This rest seem to make sense
+     ("=a", {'': ['a']}),
+     ("&=a", ValueError("bad query field: ''")),
+@@ -81,8 +78,6 @@ parse_strict_test_cases = [
+     ("a=a+b&b=b+c", {'a': ['a b'], 'b': ['b c']}),
+     ("a=a+b&a=b+a", {'a': ['a b', 'b a']}),
+     ("x=1&y=2.0&z=2-3.%2b0", {'x': ['1'], 'y': ['2.0'], 'z': ['2-3.+0']}),
+-    ("x=1;y=2.0&z=2-3.%2b0", {'x': ['1'], 'y': ['2.0'], 'z': ['2-3.+0']}),
+-    ("x=1;y=2.0;z=2-3.%2b0", {'x': ['1'], 'y': ['2.0'], 'z': ['2-3.+0']}),
+     ("Hbc5161168c542333633315dee1182227:key_store_seqid=400006&cuyer=r&view=bustomer&order_id=0bb2e248638833d48cb7fed300000f1b&expire=964546263&lobale=en-US&kid=130003.300038&ss=env",
+      {'Hbc5161168c542333633315dee1182227:key_store_seqid': ['400006'],
+       'cuyer': ['r'],
+@@ -188,6 +183,30 @@ class CgiTests(unittest.TestCase):
+             self.assertEqual(expect[k], v)
+         self.assertItemsEqual(expect.values(), d.values())
+ 
++    def test_separator(self):
++        parse_semicolon = [
++            ("x=1;y=2.0", {'x': ['1'], 'y': ['2.0']}),
++            ("x=1;y=2.0;z=2-3.%2b0", {'x': ['1'], 'y': ['2.0'], 'z': ['2-3.+0']}),
++            (";", ValueError("bad query field: ''")),
++            (";;", ValueError("bad query field: ''")),
++            ("=;a", ValueError("bad query field: 'a'")),
++            (";b=a", ValueError("bad query field: ''")),
++            ("b;=a", ValueError("bad query field: 'b'")),
++            ("a=a+b;b=b+c", {'a': ['a b'], 'b': ['b c']}),
++            ("a=a+b;a=b+a", {'a': ['a b', 'b a']}),
++        ]
++        for orig, expect in parse_semicolon:
++            env = {'QUERY_STRING': orig}
++            fs = cgi.FieldStorage(separator=';', environ=env)
++            if isinstance(expect, dict):
++                for key in expect.keys():
++                    expect_val = expect[key]
++                    self.assertIn(key, fs)
++                    if len(expect_val) > 1:
++                        self.assertEqual(fs.getvalue(key), expect_val)
++                    else:
++                        self.assertEqual(fs.getvalue(key), expect_val[0])
++
+     def test_log(self):
+         cgi.log("Testing")
+ 
+diff --git a/Lib/test/test_urlparse.py b/Lib/test/test_urlparse.py
+index 86c4a0595c..0b2107339a 100644
+--- a/Lib/test/test_urlparse.py
++++ b/Lib/test/test_urlparse.py
+@@ -24,16 +24,20 @@ parse_qsl_test_cases = [
+     ("&a=b", [('a', 'b')]),
+     ("a=a+b&b=b+c", [('a', 'a b'), ('b', 'b c')]),
+     ("a=1&a=2", [('a', '1'), ('a', '2')]),
+-    (";", []),
+-    (";;", []),
+-    (";a=b", [('a', 'b')]),
+-    ("a=a+b;b=b+c", [('a', 'a b'), ('b', 'b c')]),
+-    ("a=1;a=2", [('a', '1'), ('a', '2')]),
+-    (b";", []),
+-    (b";;", []),
+-    (b";a=b", [(b'a', b'b')]),
+-    (b"a=a+b;b=b+c", [(b'a', b'a b'), (b'b', b'b c')]),
+-    (b"a=1;a=2", [(b'a', b'1'), (b'a', b'2')]),
++    (b"", []),
++    (b"&", []),
++    (b"&&", []),
++    (b"=", [(b'', b'')]),
++    (b"=a", [(b'', b'a')]),
++    (b"a", [(b'a', b'')]),
++    (b"a=", [(b'a', b'')]),
++    (b"&a=b", [(b'a', b'b')]),
++    (b"a=a+b&b=b+c", [(b'a', b'a b'), (b'b', b'b c')]),
++    (b"a=1&a=2", [(b'a', b'1'), (b'a', b'2')]),
++    (";a=b", [(';a', 'b')]),
++    ("a=a+b;b=b+c", [('a', 'a b;b=b c')]),
++    (b";a=b", [(b';a', b'b')]),
++    (b"a=a+b;b=b+c", [(b'a', b'a b;b=b c')]),
+ ]
+ 
+ parse_qs_test_cases = [
+@@ -57,16 +61,10 @@ parse_qs_test_cases = [
+     (b"&a=b", {b'a': [b'b']}),
+     (b"a=a+b&b=b+c", {b'a': [b'a b'], b'b': [b'b c']}),
+     (b"a=1&a=2", {b'a': [b'1', b'2']}),
+-    (";", {}),
+-    (";;", {}),
+-    (";a=b", {'a': ['b']}),
+-    ("a=a+b;b=b+c", {'a': ['a b'], 'b': ['b c']}),
+-    ("a=1;a=2", {'a': ['1', '2']}),
+-    (b";", {}),
+-    (b";;", {}),
+-    (b";a=b", {b'a': [b'b']}),
+-    (b"a=a+b;b=b+c", {b'a': [b'a b'], b'b': [b'b c']}),
+-    (b"a=1;a=2", {b'a': [b'1', b'2']}),
++    (";a=b", {';a': ['b']}),
++    ("a=a+b;b=b+c", {'a': ['a b;b=b c']}),
++    (b";a=b", {b';a': [b'b']}),
++    (b"a=a+b;b=b+c", {b'a':[ b'a b;b=b c']}),
+ ]
+ 
+ class UrlParseTestCase(unittest.TestCase):
+diff --git a/Lib/urlparse.py b/Lib/urlparse.py
+index 798b467b60..6c32727fce 100644
+--- a/Lib/urlparse.py
++++ b/Lib/urlparse.py
+@@ -382,7 +382,8 @@ def unquote(s):
+             append(item)
+     return ''.join(res)
+ 
+-def parse_qs(qs, keep_blank_values=0, strict_parsing=0, max_num_fields=None):
++def parse_qs(qs, keep_blank_values=0, strict_parsing=0, max_num_fields=None,
++             separator='&'):
+     """Parse a query given as a string argument.
+ 
+         Arguments:
+@@ -402,17 +403,22 @@ def parse_qs(qs, keep_blank_values=0, strict_parsing=0, max_num_fields=None):
+ 
+         max_num_fields: int. If set, then throws a ValueError if there
+             are more than n fields read by parse_qsl().
++
++        separator: str. The symbol to use for separating the query arguments.
++            Defaults to &.
++
+     """
+     dict = {}
+     for name, value in parse_qsl(qs, keep_blank_values, strict_parsing,
+-                                 max_num_fields):
++                                 max_num_fields, separator=separator):
+         if name in dict:
+             dict[name].append(value)
+         else:
+             dict[name] = [value]
+     return dict
+ 
+-def parse_qsl(qs, keep_blank_values=0, strict_parsing=0, max_num_fields=None):
++def parse_qsl(qs, keep_blank_values=0, strict_parsing=0, max_num_fields=None,
++              separator='&'):
+     """Parse a query given as a string argument.
+ 
+     Arguments:
+@@ -432,17 +438,23 @@ def parse_qsl(qs, keep_blank_values=0, strict_parsing=0, max_num_fields=None):
+     max_num_fields: int. If set, then throws a ValueError if there
+         are more than n fields read by parse_qsl().
+ 
++        separator: str. The symbol to use for separating the query arguments.
++            Defaults to &.
++
+     Returns a list, as G-d intended.
+     """
++    if not separator or (not isinstance(separator, (str, bytes))):
++        raise ValueError("Separator must be of type string or bytes.")
++
+     # If max_num_fields is defined then check that the number of fields
+     # is less than max_num_fields. This prevents a memory exhaustion DOS
+     # attack via post bodies with many fields.
+     if max_num_fields is not None:
+-        num_fields = 1 + qs.count('&') + qs.count(';')
++        num_fields = 1 + qs.count(separator)
+         if max_num_fields < num_fields:
+             raise ValueError('Max number of fields exceeded')
+ 
+-    pairs = [s2 for s1 in qs.split('&') for s2 in s1.split(';')]
++    pairs = [s1 for s1 in qs.split(separator)]
+     r = []
+     for name_value in pairs:
+         if not name_value and not strict_parsing:
+diff --git a/Misc/NEWS.d/next/Security/2021-02-14-15-59-16.bpo-42967.YApqDS.rst b/Misc/NEWS.d/next/Security/2021-02-14-15-59-16.bpo-42967.YApqDS.rst
+new file mode 100644
+index 0000000000..f08489b414
+--- /dev/null
++++ b/Misc/NEWS.d/next/Security/2021-02-14-15-59-16.bpo-42967.YApqDS.rst
+@@ -0,0 +1 @@
++Fix web cache poisoning vulnerability by defaulting the query args separator to ``&``, and allowing the user to choose a custom separator.
+-- 
+2.31.1
+
diff --git a/third_party/nixpkgs/pkgs/development/interpreters/python/cpython/2.7/default.nix b/third_party/nixpkgs/pkgs/development/interpreters/python/cpython/2.7/default.nix
index f905612d02..d6ba795d20 100644
--- a/third_party/nixpkgs/pkgs/development/interpreters/python/cpython/2.7/default.nix
+++ b/third_party/nixpkgs/pkgs/development/interpreters/python/cpython/2.7/default.nix
@@ -123,6 +123,8 @@ let
 
       ./CVE-2021-3177.patch
 
+      ./CVE-2021-23336.patch
+
       # The workaround is for unittests on Win64, which we don't support.
       # It does break aarch64-darwin, which we do support. See:
       # * https://bugs.python.org/issue35523
diff --git a/third_party/nixpkgs/pkgs/development/interpreters/python/default.nix b/third_party/nixpkgs/pkgs/development/interpreters/python/default.nix
index 39e27ec994..d74e017d83 100644
--- a/third_party/nixpkgs/pkgs/development/interpreters/python/default.nix
+++ b/third_party/nixpkgs/pkgs/development/interpreters/python/default.nix
@@ -69,12 +69,15 @@ with pkgs;
               recursivePthLoader
             ;
           };
+          optionalExtensions = cond: as: if cond then as else [];
+          python2Extension = import ../../../top-level/python2-packages.nix;
+          extensions = lib.composeManyExtensions ((optionalExtensions (!self.isPy3k) [python2Extension]) ++ [ overrides ]);
         in lib.makeScopeWithSplicing
           pkgs.splicePackages
           pkgs.newScope
           otherSplices
           keep
-          (lib.extends overrides pythonPackagesFun))
+          (lib.extends extensions pythonPackagesFun))
         {
           overrides = packageOverrides;
         };
@@ -114,10 +117,10 @@ with pkgs;
       sourceVersion = {
         major = "3";
         minor = "8";
-        patch = "8";
+        patch = "9";
         suffix = "";
       };
-      sha256 = "fGZCSf935EPW6g5M8OWH6ukYyjxI0IHRkV/iofG8xcw=";
+      sha256 = "XjkfPsRdopVEGcqwvq79i+OIlepc4zV3w+wUlAxLlXI=";
     };
   };
 
@@ -173,10 +176,10 @@ in {
     sourceVersion = {
       major = "3";
       minor = "9";
-      patch = "2";
+      patch = "4";
       suffix = "";
     };
-    sha256 = "PCA0xU+BFEj1FmaNzgnSQAigcWw6eU3YY5tTiMveJH0=";
+    sha256 = "Sw5mRKdvjfhkriSsUApRu/aL0Jj2oXPifTthzcqaoTQ=";
     inherit (darwin) configd;
     inherit passthruFun;
   };
diff --git a/third_party/nixpkgs/pkgs/development/interpreters/python/mk-python-derivation.nix b/third_party/nixpkgs/pkgs/development/interpreters/python/mk-python-derivation.nix
index 175454ea05..e9c769821d 100644
--- a/third_party/nixpkgs/pkgs/development/interpreters/python/mk-python-derivation.nix
+++ b/third_party/nixpkgs/pkgs/development/interpreters/python/mk-python-derivation.nix
@@ -104,11 +104,13 @@ else
 let
   inherit (python) stdenv;
 
+  name_ = name;
+
   self = toPythonModule (stdenv.mkDerivation ((builtins.removeAttrs attrs [
     "disabled" "checkPhase" "checkInputs" "doCheck" "doInstallCheck" "dontWrapPythonPrograms" "catchConflicts" "format"
   ]) // {
 
-    name = namePrefix + name;
+    name = namePrefix + name_;
 
     nativeBuildInputs = [
       python
diff --git a/third_party/nixpkgs/pkgs/development/interpreters/ruby/default.nix b/third_party/nixpkgs/pkgs/development/interpreters/ruby/default.nix
index 0522f6f397..4b185f038a 100644
--- a/third_party/nixpkgs/pkgs/development/interpreters/ruby/default.nix
+++ b/third_party/nixpkgs/pkgs/development/interpreters/ruby/default.nix
@@ -249,18 +249,18 @@ let
 
 in {
   ruby_2_6 = generic {
-    version = rubyVersion "2" "6" "6" "";
+    version = rubyVersion "2" "6" "7" "";
     sha256 = {
-      src = "1492x795qzgp3zhpl580kd1sdp50n5hfsmpbfhdsq2rnxwyi8jrn";
-      git = "1jr9v99a7awssqmw7531afbx4a8i9x5yfqyffha545g7r4s7kj50";
+      src = "17m9qxalwhk95dw1qhgxbvr3kkcxs3h86yirfg5mwj35gy5pw8p4";
+      git = "08gvknanwdfsaj3lmcv1bdqjf9lldphzi7gmlv3cfa8ligx2vbap";
     };
   };
 
   ruby_2_7 = generic {
-    version = rubyVersion "2" "7" "2" "";
+    version = rubyVersion "2" "7" "3" "";
     sha256 = {
-      src = "1m63461mxi3fg4y3bspbgmb0ckbbb1ldgf9xi0piwkpfsk80cmvf";
-      git = "0kbgznf1yprfp9645k31ra5f4757b7fichzi0hdg6nxkj90853s0";
+      src = "0f2kwn98n9h9hy1fd547s7d0a7ga8jjm4nh294bwiwnq65gaj9c9";
+      git = "0vxg9w4dgpw2ig5snxmkahvzdp2yh71w8qm49g35d5hqdsql7yrx";
     };
   };
 
diff --git a/third_party/nixpkgs/pkgs/development/interpreters/ruby/patchsets.nix b/third_party/nixpkgs/pkgs/development/interpreters/ruby/patchsets.nix
index dcd0a65383..964e0a4e28 100644
--- a/third_party/nixpkgs/pkgs/development/interpreters/ruby/patchsets.nix
+++ b/third_party/nixpkgs/pkgs/development/interpreters/ruby/patchsets.nix
@@ -1,12 +1,12 @@
 { patchSet, useRailsExpress, ops, patchLevel, fetchpatch }:
 
 {
-  "2.6.6" = ops useRailsExpress [
+  "2.6.7" = ops useRailsExpress [
     "${patchSet}/patches/ruby/2.6/head/railsexpress/01-fix-broken-tests-caused-by-ad.patch"
     "${patchSet}/patches/ruby/2.6/head/railsexpress/02-improve-gc-stats.patch"
     "${patchSet}/patches/ruby/2.6/head/railsexpress/03-more-detailed-stacktrace.patch"
   ];
-  "2.7.2" = ops useRailsExpress [
+  "2.7.3" = ops useRailsExpress [
     "${patchSet}/patches/ruby/2.7/head/railsexpress/01-fix-broken-tests-caused-by-ad.patch"
     "${patchSet}/patches/ruby/2.7/head/railsexpress/02-improve-gc-stats.patch"
     "${patchSet}/patches/ruby/2.7/head/railsexpress/03-more-detailed-stacktrace.patch"
diff --git a/third_party/nixpkgs/pkgs/development/libraries/aws-sdk-cpp/default.nix b/third_party/nixpkgs/pkgs/development/libraries/aws-sdk-cpp/default.nix
index d6fbb97014..7fd7b2fbbd 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/aws-sdk-cpp/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/aws-sdk-cpp/default.nix
@@ -63,6 +63,9 @@ stdenv.mkDerivation rec {
     ./cmake-dirs.patch
   ];
 
+  # Builds in 2+h with 2 cores, and ~10m with a big-parallel builder.
+  requiredSystemFeatures = [ "big-parallel" ];
+
   meta = with lib; {
     description = "A C++ interface for Amazon Web Services";
     homepage = "https://github.com/awslabs/aws-sdk-cpp";
diff --git a/third_party/nixpkgs/pkgs/development/libraries/cimg/default.nix b/third_party/nixpkgs/pkgs/development/libraries/cimg/default.nix
index 9c89279cd5..f70513e0cd 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/cimg/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/cimg/default.nix
@@ -1,28 +1,33 @@
-{ lib, stdenv, fetchFromGitHub }:
+{ lib
+, stdenv
+, fetchFromGitHub
+}:
 
 stdenv.mkDerivation rec {
   pname = "cimg";
-  version = "2.9.6";
+  version = "2.9.7";
 
   src = fetchFromGitHub {
     owner = "dtschump";
     repo = "CImg";
     rev = "v.${version}";
-    sha256 = "sha256-RdOfog5FOw5XESyDFX68Lb2MUyCeUuPaq/0UVNTjNKo=";
+    sha256 = "sha256-cR2wvGtomT1cZh8wKMCfYDNuP3d1gKhHJavVnvuQ8Mc=";
   };
 
   installPhase = ''
+    runHook preInstall
     install -dm 755 $out/include/CImg/plugins $doc/share/doc/cimg/examples
-
     install -m 644 CImg.h $out/include/
     cp -dr --no-preserve=ownership examples/* $doc/share/doc/cimg/examples/
     cp -dr --no-preserve=ownership plugins/* $out/include/CImg/plugins/
     cp README.txt $doc/share/doc/cimg/
+    runHook postInstall
   '';
 
   outputs = [ "out" "doc" ];
 
   meta = with lib; {
+    homepage = "http://cimg.eu/";
     description = "A small, open source, C++ toolkit for image processing";
     longDescription = ''
       CImg stands for Cool Image. It is easy to use, efficient and is intended
@@ -30,7 +35,6 @@ stdenv.mkDerivation rec {
       C++. Due to its generic conception, it can cover a wide range of image
       processing applications.
     '';
-    homepage = "http://cimg.eu/";
     license = licenses.cecill-c;
     maintainers = [ maintainers.AndersonTorres ];
     platforms = platforms.unix;
diff --git a/third_party/nixpkgs/pkgs/development/libraries/eclib/default.nix b/third_party/nixpkgs/pkgs/development/libraries/eclib/default.nix
index a8697207ed..4709441a10 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/eclib/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/eclib/default.nix
@@ -14,7 +14,7 @@ assert withFlint -> flint != null;
 
 stdenv.mkDerivation rec {
   pname = "eclib";
-  version = "20210223"; # upgrade might break the sage interface
+  version = "20190909"; # upgrade might break the sage interface
   # sage tests to run:
   # src/sage/interfaces/mwrank.py
   # src/sage/libs/eclib
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
     owner = "JohnCremona";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-xnSw5cdg4PLa0GT/blCYDz/IG5aj+HG2NHSlyCiH9g0=";
+    sha256 = "0y1vdi4120gdw56gg2dn3wh625yr9wpyk3wpbsd25w4lv83qq5da";
   };
   buildInputs = [
     pari
diff --git a/third_party/nixpkgs/pkgs/development/libraries/ffmpegthumbnailer/default.nix b/third_party/nixpkgs/pkgs/development/libraries/ffmpegthumbnailer/default.nix
index 2e68dbb1d1..dfdbf8eb2f 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/ffmpegthumbnailer/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/ffmpegthumbnailer/default.nix
@@ -1,4 +1,4 @@
-{ fetchFromGitHub, lib, stdenv, ffmpeg_3, cmake, libpng, pkg-config, libjpeg
+{ fetchFromGitHub, lib, stdenv, ffmpeg, cmake, libpng, pkg-config, libjpeg
 }:
 
 stdenv.mkDerivation rec {
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ cmake pkg-config ];
-  buildInputs = [ ffmpeg_3 libpng libjpeg ];
+  buildInputs = [ ffmpeg libpng libjpeg ];
   cmakeFlags = [ "-DENABLE_THUMBNAILER=ON" ];
 
   meta = with lib;  {
diff --git a/third_party/nixpkgs/pkgs/development/libraries/flint/default.nix b/third_party/nixpkgs/pkgs/development/libraries/flint/default.nix
index 2c540d1300..0adaa2fe5e 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/flint/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/flint/default.nix
@@ -45,7 +45,7 @@ stdenv.mkDerivation rec {
     inherit version;
     description = "Fast Library for Number Theory";
     license = lib.licenses.gpl2Plus;
-    maintainers = [lib.maintainers.raskin];
+    maintainers = lib.teams.sage.members;
     platforms = lib.platforms.unix;
     homepage = "http://www.flintlib.org/";
     downloadPage = "http://www.flintlib.org/downloads.html";
diff --git a/third_party/nixpkgs/pkgs/development/libraries/ftgl/default.nix b/third_party/nixpkgs/pkgs/development/libraries/ftgl/default.nix
index 5588e27356..466ffcbb73 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/ftgl/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/ftgl/default.nix
@@ -1,28 +1,42 @@
 { lib
 , stdenv
-, fetchurl
+, fetchFromGitHub
+, autoreconfHook
+, doxygen
+, freeglut
 , freetype
+, GLUT
 , libGL
 , libGLU
 , OpenGL
+, pkg-config
 }:
 
 stdenv.mkDerivation rec {
   pname = "ftgl";
-  version = "2.1.3-rc5";
+  version = "2.4.0";
 
-  src = fetchurl {
-    url = "mirror://sourceforge/${pname}-${version}.tar.gz";
-    hash = "sha256-VFjWISJFSGlXLTn4qoV0X8BdVRgAG876Y71su40mVls=";
+  src = fetchFromGitHub {
+    owner = "frankheckenbach";
+    repo = "ftgl";
+    rev = "v${version}";
+    hash = "sha256-6TDNGoMeBLnucmHRgEDIVWcjlJb7N0sTluqBwRMMWn4=";
   };
 
+  nativeBuildInputs = [
+    autoreconfHook
+    doxygen
+    pkg-config
+  ];
   buildInputs = [
     freetype
   ] ++ (if stdenv.isDarwin then [
     OpenGL
+    GLUT
   ] else [
     libGL
     libGLU
+    freeglut
   ]);
 
   configureFlags = [
@@ -31,8 +45,13 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
+  postInstall = ''
+    install -Dm644 src/FTSize.h -t ${placeholder "out"}/include/FTGL
+    install -Dm644 src/FTFace.h -t ${placeholder "out"}/include/FTGL
+  '';
+
   meta = with lib; {
-    homepage = "https://sourceforge.net/apps/mediawiki/ftgl/";
+    homepage = "https://github.com/frankheckenbach/ftgl";
     description = "Font rendering library for OpenGL applications";
     longDescription = ''
       FTGL is a free cross-platform Open Source C++ library that uses Freetype2
@@ -40,7 +59,7 @@ stdenv.mkDerivation rec {
       pixmaps, texture maps, outlines, polygon mesh, and extruded polygon
       rendering modes.
     '';
-    license = licenses.gpl3Plus;
+    license = licenses.mit;
     maintainers = with maintainers; [ AndersonTorres ];
     platforms = platforms.unix;
   };
diff --git a/third_party/nixpkgs/pkgs/development/libraries/gtk/3.x.nix b/third_party/nixpkgs/pkgs/development/libraries/gtk/3.x.nix
index d1e478ded2..0d4bec5f34 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/gtk/3.x.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/gtk/3.x.nix
@@ -36,7 +36,7 @@
 , tracker
 , x11Support ? stdenv.isLinux
 , waylandSupport ? stdenv.isLinux
-, mesa
+, libGL
 , wayland
 , wayland-protocols
 , xineramaSupport ? stdenv.isLinux
@@ -143,7 +143,7 @@ stdenv.mkDerivation rec {
     # explicitly propagated, always needed
     Cocoa
   ] ++ lib.optionals waylandSupport [
-    mesa
+    libGL
     wayland
     wayland-protocols
   ] ++ lib.optionals xineramaSupport [
diff --git a/third_party/nixpkgs/pkgs/development/libraries/gtk/4.x.nix b/third_party/nixpkgs/pkgs/development/libraries/gtk/4.x.nix
index 28247d6c97..b64b8bc36f 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/gtk/4.x.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/gtk/4.x.nix
@@ -38,7 +38,7 @@
 , tracker
 , x11Support ? stdenv.isLinux
 , waylandSupport ? stdenv.isLinux
-, mesa
+, libGL
 , vulkan-loader
 , vulkan-headers
 , wayland
@@ -124,7 +124,7 @@ stdenv.mkDerivation rec {
   ] ++ lib.optionals trackerSupport [
     tracker
   ] ++ lib.optionals waylandSupport [
-    mesa
+    libGL
     wayland
     wayland-protocols
   ] ++ lib.optionals xineramaSupport [
diff --git a/third_party/nixpkgs/pkgs/development/libraries/intel-media-driver/default.nix b/third_party/nixpkgs/pkgs/development/libraries/intel-media-driver/default.nix
index c60b00552b..b983e01aa0 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/intel-media-driver/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/intel-media-driver/default.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "intel-media-driver";
-  version = "21.1.3";
+  version = "21.2.0";
 
   src = fetchFromGitHub {
     owner  = "intel";
     repo   = "media-driver";
     rev    = "intel-media-${version}";
-    sha256 = "1y6y6dia2y3b798f668q26pzwb1xai5d5jpmllpcxs9qikhkkx8p";
+    sha256 = "101wbg5j00amdbfz4p6mpg90wi549dl78jd34mac5g6zhcpwqbh9";
   };
 
   cmakeFlags = [
diff --git a/third_party/nixpkgs/pkgs/development/libraries/isl/0.20.0.nix b/third_party/nixpkgs/pkgs/development/libraries/isl/0.20.0.nix
index c35588555a..c40b3d7be0 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/isl/0.20.0.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/isl/0.20.0.nix
@@ -10,6 +10,10 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ gmp ];
 
+  configureFlags = [
+    "--with-gcc-arch=generic" # don't guess -march=/mtune=
+  ];
+
   enableParallelBuilding = true;
 
   meta = {
diff --git a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/attica.nix b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/attica.nix
index 4cb2e8e958..8c71afd5dc 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/attica.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/attica.nix
@@ -1,11 +1,7 @@
-{ mkDerivation, lib, extra-cmake-modules, qtbase }:
+{ mkDerivation, extra-cmake-modules, qtbase }:
 
 mkDerivation {
   name = "attica";
-  meta = {
-    maintainers = [ lib.maintainers.ttuegel ];
-    broken = builtins.compareVersions qtbase.version "5.14.0" < 0;
-  };
   nativeBuildInputs = [ extra-cmake-modules ];
   buildInputs = [ qtbase ];
   outputs = [ "out" "dev" ];
diff --git a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/baloo.nix b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/baloo.nix
index d5da9f5af1..8497ec73a3 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/baloo.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/baloo.nix
@@ -1,5 +1,5 @@
 {
-  mkDerivation, lib,
+  mkDerivation,
   extra-cmake-modules,
   kauth, kconfig, kcoreaddons, kcrash, kdbusaddons, kfilemetadata, ki18n,
   kidletime, kio, lmdb, qtbase, qtdeclarative, solid,
@@ -7,7 +7,6 @@
 
 mkDerivation {
   name = "baloo";
-  meta = { maintainers = [ lib.maintainers.ttuegel ]; };
   nativeBuildInputs = [ extra-cmake-modules ];
   buildInputs = [
     kauth kconfig kcrash kdbusaddons ki18n kio kidletime lmdb qtdeclarative
diff --git a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/bluez-qt.nix b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/bluez-qt.nix
index 9717e770ed..c5764b4915 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/bluez-qt.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/bluez-qt.nix
@@ -1,14 +1,10 @@
-{ mkDerivation, lib
+{ mkDerivation
 , extra-cmake-modules
 , qtbase, qtdeclarative
 }:
 
 mkDerivation {
   name = "bluez-qt";
-  meta = {
-    maintainers = [ lib.maintainers.ttuegel ];
-    broken = builtins.compareVersions qtbase.version "5.7.0" < 0;
-  };
   nativeBuildInputs = [ extra-cmake-modules ];
   buildInputs = [ qtdeclarative ];
   propagatedBuildInputs = [ qtbase ];
diff --git a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/breeze-icons.nix b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/breeze-icons.nix
index d9192b9403..6e79a45ea9 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/breeze-icons.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/breeze-icons.nix
@@ -1,8 +1,7 @@
-{ mkDerivation, lib, extra-cmake-modules, gtk3, qtsvg, hicolor-icon-theme }:
+{ mkDerivation, extra-cmake-modules, gtk3, qtsvg, hicolor-icon-theme }:
 
 mkDerivation {
   name = "breeze-icons";
-  meta = { maintainers = [ lib.maintainers.ttuegel ]; };
   nativeBuildInputs = [ extra-cmake-modules gtk3 ];
   buildInputs = [ qtsvg ];
   propagatedBuildInputs = [
diff --git a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/default.nix b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/default.nix
index 02e25692ef..94d403b9e3 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/default.nix
@@ -28,6 +28,13 @@ existing packages here and modify it as necessary.
 
 let
 
+  minQtVersion = "5.14";
+  broken = lib.versionOlder libsForQt5.qtbase.version minQtVersion;
+  maintainers = with lib.maintainers; [ ttuegel nyanloutre ];
+  license = with lib.licenses; [
+    lgpl21Plus lgpl3Plus bsd2 mit gpl2Plus gpl3Plus fdl12
+  ];
+
   srcs = import ./srcs.nix {
     inherit fetchurl;
     mirror = "mirror://kde";
@@ -72,14 +79,15 @@ let
             defaultSetupHook = if hasSeparateDev then propagateBin else null;
             setupHook = args.setupHook or defaultSetupHook;
 
-            meta = {
-              homepage = "http://www.kde.org";
-              license = with lib.licenses; [
-                lgpl21Plus lgpl3Plus bsd2 mit gpl2Plus gpl3Plus fdl12
-              ];
-              maintainers = with lib.maintainers; [ ttuegel nyanloutre ];
-              platforms = lib.platforms.linux;
-            } // (args.meta or {});
+            meta =
+              let meta = args.meta or {}; in
+              meta // {
+                homepage = meta.homepage or "http://www.kde.org";
+                license = meta.license or license;
+                maintainers = (meta.maintainers or []) ++ maintainers;
+                platforms = meta.platforms or lib.platforms.linux;
+                broken = meta.broken or broken;
+              };
 
           in mkDerivation (args // {
             name = "${name}-${version}";
@@ -158,7 +166,7 @@ let
       kiconthemes = callPackage ./kiconthemes {};
       kinit = callPackage ./kinit {};
       kio = callPackage ./kio {};
-      knewstuff = callPackage ./knewstuff.nix {};
+      knewstuff = callPackage ./knewstuff {};
       knotifyconfig = callPackage ./knotifyconfig.nix {};
       kparts = callPackage ./kparts.nix {};
       kpeople = callPackage ./kpeople.nix {};
diff --git a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/extra-cmake-modules/default.nix b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/extra-cmake-modules/default.nix
index 0aa400c644..b74fb29e5f 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/extra-cmake-modules/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/extra-cmake-modules/default.nix
@@ -17,6 +17,5 @@ mkDerivation {
     platforms = platforms.linux ++ platforms.darwin;
     homepage = "http://www.kde.org";
     license = licenses.bsd2;
-    maintainers = [ maintainers.ttuegel ];
   };
 }
diff --git a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/fetch.sh b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/fetch.sh
index 3ce0ca063c..05506b1938 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/fetch.sh
+++ b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/fetch.sh
@@ -1 +1 @@
-WGET_ARGS=( https://download.kde.org/stable/frameworks/5.79/ -A '*.tar.xz' )
+WGET_ARGS=( https://download.kde.org/stable/frameworks/5.80/ -A '*.tar.xz' )
diff --git a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/frameworkintegration.nix b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/frameworkintegration.nix
index 58b064806e..c49eab2763 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/frameworkintegration.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/frameworkintegration.nix
@@ -1,5 +1,5 @@
 {
-  mkDerivation, lib,
+  mkDerivation,
   extra-cmake-modules,
   kbookmarks, kcompletion, kconfig, kconfigwidgets, ki18n, kiconthemes, kio,
   knewstuff, knotifications, kpackage, kwidgetsaddons, libXcursor, qtx11extras
@@ -7,7 +7,6 @@
 
 mkDerivation {
   name = "frameworkintegration";
-  meta = { maintainers = [ lib.maintainers.ttuegel ]; };
   nativeBuildInputs = [ extra-cmake-modules ];
   buildInputs = [
     kbookmarks kcompletion kconfig ki18n kio knewstuff knotifications kpackage
diff --git a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kactivities-stats.nix b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kactivities-stats.nix
index b558306248..88fde8c5fd 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kactivities-stats.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kactivities-stats.nix
@@ -1,12 +1,11 @@
 {
-  mkDerivation, lib,
+  mkDerivation,
   extra-cmake-modules,
   boost, kactivities, kconfig, qtbase,
 }:
 
 mkDerivation {
   name = "kactivities-stats";
-  meta = { maintainers = [ lib.maintainers.ttuegel ]; };
   nativeBuildInputs = [ extra-cmake-modules ];
   buildInputs = [ boost kactivities kconfig ];
   propagatedBuildInputs = [ qtbase ];
diff --git a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kactivities.nix b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kactivities.nix
index eabac6aadd..b53de41455 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kactivities.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kactivities.nix
@@ -1,12 +1,11 @@
 {
-  mkDerivation, lib,
+  mkDerivation,
   extra-cmake-modules,
   boost, kconfig, kcoreaddons, kio, kwindowsystem, qtbase, qtdeclarative,
 }:
 
 mkDerivation {
   name = "kactivities";
-  meta = { maintainers = [ lib.maintainers.ttuegel ]; };
   nativeBuildInputs = [ extra-cmake-modules ];
   buildInputs = [
     boost kconfig kcoreaddons kio kwindowsystem qtdeclarative
diff --git a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kapidox.nix b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kapidox.nix
index 4395f3cd0d..381dacaf49 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kapidox.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kapidox.nix
@@ -2,7 +2,6 @@
 
 mkDerivation {
   name = "kapidox";
-  meta = { maintainers = [ lib.maintainers.ttuegel ]; };
   nativeBuildInputs = [ extra-cmake-modules python3 python3.pkgs.setuptools ];
   postFixup = ''
     moveToOutput bin $bin
diff --git a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/karchive.nix b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/karchive.nix
index 7a9ea86bbb..3602cb7b06 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/karchive.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/karchive.nix
@@ -1,15 +1,11 @@
 {
-  mkDerivation, lib,
+  mkDerivation,
   extra-cmake-modules,
   bzip2, xz, qtbase, zlib,
 }:
 
 mkDerivation {
   name = "karchive";
-  meta = {
-    maintainers = [ lib.maintainers.ttuegel ];
-    broken = builtins.compareVersions qtbase.version "5.14.0" < 0;
-  };
   nativeBuildInputs = [ extra-cmake-modules ];
   buildInputs = [ bzip2 xz zlib ];
   propagatedBuildInputs = [ qtbase ];
diff --git a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kauth/default.nix b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kauth/default.nix
index 0a513d6eed..630b51bf46 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kauth/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kauth/default.nix
@@ -1,11 +1,10 @@
 {
-  mkDerivation, lib, propagate,
+  mkDerivation, propagate,
   extra-cmake-modules, kcoreaddons, polkit-qt, qttools
 }:
 
 mkDerivation {
   name = "kauth";
-  meta = { maintainers = [ lib.maintainers.ttuegel ]; };
   nativeBuildInputs = [ extra-cmake-modules ];
   buildInputs = [ polkit-qt qttools ];
   propagatedBuildInputs = [ kcoreaddons ];
diff --git a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kbookmarks.nix b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kbookmarks.nix
index dc2339632e..4d68c3694b 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kbookmarks.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kbookmarks.nix
@@ -1,5 +1,5 @@
 {
-  mkDerivation, lib,
+  mkDerivation,
   extra-cmake-modules, qttools,
   kcodecs, kconfig, kconfigwidgets, kcoreaddons, kiconthemes, kwidgetsaddons,
   kxmlgui, qtbase,
@@ -7,7 +7,6 @@
 
 mkDerivation {
   name = "kbookmarks";
-  meta = { maintainers = [ lib.maintainers.ttuegel ]; };
   nativeBuildInputs = [ extra-cmake-modules qttools ];
   buildInputs = [
     kcodecs kconfig kconfigwidgets kcoreaddons kiconthemes kxmlgui
diff --git a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kcalendarcore.nix b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kcalendarcore.nix
index e0b6c5313b..f4f2b05ad7 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kcalendarcore.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kcalendarcore.nix
@@ -1,15 +1,12 @@
 {
   mkDerivation,
-  lib,
   extra-cmake-modules,
-  libical
+  libical,
+  qtbase
 }:
 
 mkDerivation {
   name = "kcalendarcore";
-  meta = {
-    maintainers = [ lib.maintainers.nyanloutre ];
-  };
   nativeBuildInputs = [ extra-cmake-modules ];
   propagatedBuildInputs = [ libical ];
   outputs = [ "out" "dev" ];
diff --git a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kcmutils/default.nix b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kcmutils/default.nix
index ab14529be0..22e2929ae0 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kcmutils/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kcmutils/default.nix
@@ -1,5 +1,5 @@
 {
-  mkDerivation, lib,
+  mkDerivation,
   extra-cmake-modules,
   kconfigwidgets, kcoreaddons, kdeclarative, ki18n, kiconthemes, kitemviews,
   kpackage, kservice, kxmlgui, qtdeclarative,
@@ -7,7 +7,6 @@
 
 mkDerivation {
   name = "kcmutils";
-  meta = { maintainers = [ lib.maintainers.ttuegel ]; };
   nativeBuildInputs = [ extra-cmake-modules ];
   buildInputs = [
     kcoreaddons kdeclarative ki18n kiconthemes kitemviews kpackage kxmlgui
diff --git a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kcodecs.nix b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kcodecs.nix
index 357c0e1d11..a62135150a 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kcodecs.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kcodecs.nix
@@ -1,11 +1,7 @@
-{ mkDerivation, lib, extra-cmake-modules, qtbase, qttools, gperf }:
+{ mkDerivation, extra-cmake-modules, qtbase, qttools, gperf }:
 
 mkDerivation {
   name = "kcodecs";
-  meta = {
-    maintainers = [ lib.maintainers.ttuegel ];
-    broken = builtins.compareVersions qtbase.version "5.14.0" < 0;
-  };
   nativeBuildInputs = [ extra-cmake-modules ];
   buildInputs = [ qttools gperf ];
   propagatedBuildInputs = [ qtbase ];
diff --git a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kcompletion.nix b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kcompletion.nix
index fdfe28db6c..ffa612ffaa 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kcompletion.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kcompletion.nix
@@ -1,12 +1,11 @@
 {
-  mkDerivation, lib,
+  mkDerivation,
   extra-cmake-modules,
   kconfig, kwidgetsaddons, qtbase, qttools
 }:
 
 mkDerivation {
   name = "kcompletion";
-  meta = { maintainers = [ lib.maintainers.ttuegel ]; };
   nativeBuildInputs = [ extra-cmake-modules ];
   buildInputs = [ kconfig kwidgetsaddons qttools ];
   propagatedBuildInputs = [ qtbase ];
diff --git a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kconfig.nix b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kconfig.nix
index 94f4cb0480..ba16e97ef3 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kconfig.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kconfig.nix
@@ -1,11 +1,7 @@
-{ mkDerivation, lib, extra-cmake-modules, qtbase, qttools }:
+{ mkDerivation, extra-cmake-modules, qtbase, qttools }:
 
 mkDerivation {
   name = "kconfig";
-  meta = {
-    maintainers = [ lib.maintainers.ttuegel ];
-    broken = builtins.compareVersions qtbase.version "5.14.0" < 0;
-  };
   nativeBuildInputs = [ extra-cmake-modules ];
   buildInputs = [ qttools ];
   propagatedBuildInputs = [ qtbase ];
diff --git a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kconfigwidgets/0001-qdiriterator-follow-symlinks.patch b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kconfigwidgets/0001-QDirIterator-follow-symlinks.patch
similarity index 65%
rename from third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kconfigwidgets/0001-qdiriterator-follow-symlinks.patch
rename to third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kconfigwidgets/0001-QDirIterator-follow-symlinks.patch
index 3b6ea27d41..30cfafafab 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kconfigwidgets/0001-qdiriterator-follow-symlinks.patch
+++ b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kconfigwidgets/0001-QDirIterator-follow-symlinks.patch
@@ -1,8 +1,17 @@
+From 05c0eb5d803ac52c0dd97a98f6d2821650c3c14c Mon Sep 17 00:00:00 2001
+From: Thomas Tuegel <ttuegel@mailbox.org>
+Date: Sun, 28 Mar 2021 06:09:47 -0500
+Subject: [PATCH] QDirIterator follow symlinks
+
+---
+ src/khelpclient.cpp | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
 diff --git a/src/khelpclient.cpp b/src/khelpclient.cpp
-index fbbc0fa..cb78741 100644
+index a053cd7..787d375 100644
 --- a/src/khelpclient.cpp
 +++ b/src/khelpclient.cpp
-@@ -48,7 +48,7 @@ void KHelpClient::invokeHelp(const QString &anchor, const QString &_appname)
+@@ -34,7 +34,7 @@ void KHelpClient::invokeHelp(const QString &anchor, const QString &_appname)
      QString docPath;
      const QStringList desktopDirs = QStandardPaths::standardLocations(QStandardPaths::ApplicationsLocation);
      for (const QString &dir : desktopDirs) {
@@ -11,8 +20,6 @@ index fbbc0fa..cb78741 100644
          while (it.hasNext()) {
              const QString desktopPath(it.next());
              KDesktopFile desktopFile(desktopPath);
-@@ -75,4 +75,3 @@ void KHelpClient::invokeHelp(const QString &anchor, const QString &_appname)
-     // launch khelpcenter, or a browser for URIs not handled by khelpcenter
-     QDesktopServices::openUrl(url);
- }
--
+-- 
+2.30.1
+
diff --git a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kconfigwidgets/default.nix b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kconfigwidgets/default.nix
index dcbdf6eb5f..fc10f3070b 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kconfigwidgets/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kconfigwidgets/default.nix
@@ -1,15 +1,14 @@
 {
-  mkDerivation, lib, extra-cmake-modules,
+  mkDerivation, extra-cmake-modules,
   kauth, kcodecs, kconfig, kdoctools, kguiaddons, ki18n, kwidgetsaddons, qttools, qtbase,
 }:
 
 mkDerivation {
   name = "kconfigwidgets";
-  meta = { maintainers = [ lib.maintainers.ttuegel ]; };
   nativeBuildInputs = [ extra-cmake-modules kdoctools ];
   buildInputs = [ kguiaddons ki18n qtbase qttools ];
   propagatedBuildInputs = [ kauth kcodecs kconfig kwidgetsaddons ];
-  patches = [ ./0001-qdiriterator-follow-symlinks.patch ];
+  patches = [ ./0001-QDirIterator-follow-symlinks.patch ];
   outputs = [ "out" "dev" ];
   outputBin = "dev";
   postInstall = ''
diff --git a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kcoreaddons.nix b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kcoreaddons.nix
index 6f2e3f9238..a2102c7d73 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kcoreaddons.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kcoreaddons.nix
@@ -1,15 +1,11 @@
 {
-  mkDerivation, lib,
+  mkDerivation,
   extra-cmake-modules,
   qtbase, qttools, shared-mime-info
 }:
 
 mkDerivation {
   name = "kcoreaddons";
-  meta = {
-    maintainers = [ lib.maintainers.ttuegel ];
-    broken = builtins.compareVersions qtbase.version "5.14.0" < 0;
-  };
   nativeBuildInputs = [ extra-cmake-modules ];
   buildInputs = [ qttools shared-mime-info ];
   propagatedBuildInputs = [ qtbase ];
diff --git a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kcrash.nix b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kcrash.nix
index d45d73d33e..27dc6d65ed 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kcrash.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kcrash.nix
@@ -1,12 +1,11 @@
 {
-  mkDerivation, lib,
+  mkDerivation,
   extra-cmake-modules,
   kcoreaddons, kwindowsystem, qtbase, qtx11extras,
 }:
 
 mkDerivation {
   name = "kcrash";
-  meta = { maintainers = [ lib.maintainers.ttuegel ]; };
   nativeBuildInputs = [ extra-cmake-modules ];
   buildInputs = [ kcoreaddons kwindowsystem qtx11extras ];
   propagatedBuildInputs = [ qtbase ];
diff --git a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kdbusaddons.nix b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kdbusaddons.nix
index b497ebe1c8..5c435b4454 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kdbusaddons.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kdbusaddons.nix
@@ -1,15 +1,11 @@
 {
-  mkDerivation, lib,
+  mkDerivation,
   extra-cmake-modules,
   qtbase, qttools, qtx11extras
 }:
 
 mkDerivation {
   name = "kdbusaddons";
-  meta = {
-    maintainers = [ lib.maintainers.ttuegel ];
-    broken = builtins.compareVersions qtbase.version "5.14.0" < 0;
-  };
   nativeBuildInputs = [ extra-cmake-modules ];
   buildInputs = [ qttools qtx11extras ];
   propagatedBuildInputs = [ qtbase ];
diff --git a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kdeclarative.nix b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kdeclarative.nix
index 34e01b4c1b..cc4e269982 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kdeclarative.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kdeclarative.nix
@@ -1,12 +1,11 @@
 {
-  mkDerivation, lib, extra-cmake-modules,
+  mkDerivation, extra-cmake-modules,
   epoxy, kconfig, kglobalaccel, kguiaddons, ki18n, kiconthemes, kio, kpackage,
   kwidgetsaddons, kwindowsystem, qtdeclarative
 }:
 
 mkDerivation {
   name = "kdeclarative";
-  meta = { maintainers = [ lib.maintainers.ttuegel ]; };
   nativeBuildInputs = [ extra-cmake-modules ];
   buildInputs = [
     epoxy kglobalaccel kguiaddons ki18n kiconthemes kio kwidgetsaddons
diff --git a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kded.nix b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kded.nix
index 1b326e51de..936119ab7f 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kded.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kded.nix
@@ -1,5 +1,5 @@
 {
-  mkDerivation, lib, propagate, wrapGAppsHook,
+  mkDerivation, propagate, wrapGAppsHook,
   extra-cmake-modules, kdoctools,
   gsettings-desktop-schemas, kconfig, kcoreaddons, kcrash, kdbusaddons, kinit,
   kservice, qtbase,
@@ -7,7 +7,6 @@
 
 mkDerivation {
   name = "kded";
-  meta = { maintainers = [ lib.maintainers.ttuegel ]; };
   nativeBuildInputs = [ extra-cmake-modules kdoctools wrapGAppsHook ];
   buildInputs = [
     gsettings-desktop-schemas kconfig kcoreaddons kcrash kdbusaddons kinit
diff --git a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kdelibs4support/default.nix b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kdelibs4support/default.nix
index 5eced88328..392aa9ea90 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kdelibs4support/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kdelibs4support/default.nix
@@ -1,5 +1,5 @@
 {
-  mkDerivation, lib,
+  mkDerivation,
   docbook_xml_dtd_45, extra-cmake-modules, kdoctools,
   kauth, karchive, kcompletion, kconfig, kconfigwidgets, kcoreaddons, kcrash,
   kdbusaddons, kded, kdesignerplugin, kemoticons, kglobalaccel, kguiaddons,
@@ -10,7 +10,6 @@
 
 mkDerivation {
   name = "kdelibs4support";
-  meta = { maintainers = [ lib.maintainers.ttuegel ]; };
   patches = [
     ./nix-kde-include-dir.patch
   ];
diff --git a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kdesignerplugin.nix b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kdesignerplugin.nix
index 8418863eab..f130527407 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kdesignerplugin.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kdesignerplugin.nix
@@ -1,5 +1,5 @@
 {
-  mkDerivation, lib,
+  mkDerivation,
   extra-cmake-modules, kdoctools,
   kcompletion, kconfig, kconfigwidgets, kcoreaddons, kiconthemes, kio,
   kitemviews, kplotting, ktextwidgets, kwidgetsaddons, kxmlgui, qttools, sonnet,
@@ -7,7 +7,6 @@
 
 mkDerivation {
   name = "kdesignerplugin";
-  meta = { maintainers = [ lib.maintainers.ttuegel ]; };
   nativeBuildInputs = [ extra-cmake-modules kdoctools ];
   buildInputs = [
     kcompletion kconfig kconfigwidgets kcoreaddons kiconthemes kio kitemviews
diff --git a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kdesu/default.nix b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kdesu/default.nix
index cd7055c4ea..9a5f5a6942 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kdesu/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kdesu/default.nix
@@ -1,12 +1,11 @@
 {
-  mkDerivation, lib,
+  mkDerivation,
   extra-cmake-modules,
   kcoreaddons, ki18n, kpty, kservice, qtbase,
 }:
 
 mkDerivation {
   name = "kdesu";
-  meta = { maintainers = [ lib.maintainers.ttuegel ]; };
   nativeBuildInputs = [ extra-cmake-modules ];
   buildInputs = [ kcoreaddons ki18n kpty kservice qtbase ];
   propagatedBuildInputs = [ kpty ];
diff --git a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kdnssd.nix b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kdnssd.nix
index b4dabba624..8bb59bb36d 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kdnssd.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kdnssd.nix
@@ -1,15 +1,11 @@
 {
-  mkDerivation, lib,
+  mkDerivation,
   extra-cmake-modules,
   avahi, qtbase, qttools,
 }:
 
 mkDerivation {
   name = "kdnssd";
-  meta = {
-    maintainers = [ lib.maintainers.ttuegel ];
-    broken = builtins.compareVersions qtbase.version "5.14.0" < 0;
-  };
   nativeBuildInputs = [ extra-cmake-modules ];
   buildInputs = [ avahi qttools ];
   propagatedBuildInputs = [ qtbase ];
diff --git a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kdoctools/default.nix b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kdoctools/default.nix
index 68b5c08aa0..a87bef40b1 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kdoctools/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kdoctools/default.nix
@@ -1,5 +1,5 @@
 {
-  mkDerivation, lib,
+  mkDerivation,
   extra-cmake-modules, docbook_xml_dtd_45, docbook_xsl_ns,
   karchive, ki18n, qtbase,
   perl, perlPackages
@@ -7,7 +7,6 @@
 
 mkDerivation {
   name = "kdoctools";
-  meta = { maintainers = [ lib.maintainers.ttuegel ]; };
   nativeBuildInputs = [
     extra-cmake-modules
     # The build system insists on having native Perl.
diff --git a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kemoticons.nix b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kemoticons.nix
index b7f4f036db..66a0889b13 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kemoticons.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kemoticons.nix
@@ -1,12 +1,11 @@
 {
-  mkDerivation, lib,
+  mkDerivation,
   extra-cmake-modules,
   karchive, kcoreaddons, kservice, qtbase,
 }:
 
 mkDerivation {
   name = "kemoticons";
-  meta = { maintainers = [ lib.maintainers.ttuegel ]; };
   nativeBuildInputs = [ extra-cmake-modules ];
   buildInputs = [ karchive kcoreaddons ];
   propagatedBuildInputs = [ kservice qtbase ];
diff --git a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kfilemetadata/default.nix b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kfilemetadata/default.nix
index 47831f0f5d..c4bee741d2 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kfilemetadata/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kfilemetadata/default.nix
@@ -1,12 +1,11 @@
 {
-  mkDerivation, lib,
+  mkDerivation,
   extra-cmake-modules,
   attr, ebook_tools, exiv2, ffmpeg_3, karchive, kcoreaddons, ki18n, poppler, qtbase, qtmultimedia, taglib
 }:
 
 mkDerivation {
   name = "kfilemetadata";
-  meta = { maintainers = [ lib.maintainers.ttuegel ]; };
   nativeBuildInputs = [ extra-cmake-modules ];
   buildInputs = [
     attr ebook_tools exiv2 ffmpeg_3 karchive kcoreaddons ki18n poppler qtbase qtmultimedia
diff --git a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kglobalaccel.nix b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kglobalaccel.nix
index 483ab16dcc..7001c98ee0 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kglobalaccel.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kglobalaccel.nix
@@ -1,5 +1,5 @@
 {
-  mkDerivation, lib,
+  mkDerivation,
   extra-cmake-modules,
   kconfig, kcoreaddons, kcrash, kdbusaddons, kservice, kwindowsystem,
   qtbase, qttools, qtx11extras, libXdmcp,
@@ -7,7 +7,6 @@
 
 mkDerivation {
   name = "kglobalaccel";
-  meta = { maintainers = [ lib.maintainers.ttuegel ]; };
   nativeBuildInputs = [ extra-cmake-modules ];
   buildInputs = [
     kconfig kcoreaddons kcrash kdbusaddons kservice kwindowsystem qttools
diff --git a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kguiaddons.nix b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kguiaddons.nix
index 6c7365fd27..bcd18ab614 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kguiaddons.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kguiaddons.nix
@@ -1,4 +1,4 @@
-{ mkDerivation, lib
+{ mkDerivation
 , extra-cmake-modules
 , qtbase, qtx11extras, wayland
 }:
@@ -11,9 +11,4 @@ mkDerivation {
   propagatedBuildInputs = [ qtbase ];
 
   outputs = [ "out" "dev" ];
-
-  meta = with lib; {
-    maintainers = [ maintainers.ttuegel ];
-    broken = versionOlder qtbase.version "5.14.0";
-  };
 }
diff --git a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/khtml.nix b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/khtml.nix
index 5bb3078ea8..3ef3a043c4 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/khtml.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/khtml.nix
@@ -1,5 +1,5 @@
 {
-  mkDerivation, lib,
+  mkDerivation,
   extra-cmake-modules, perl,
   giflib, karchive, kcodecs, kglobalaccel, ki18n, kiconthemes, kio, kjs,
   knotifications, kparts, ktextwidgets, kwallet, kwidgetsaddons, kwindowsystem,
@@ -8,7 +8,6 @@
 
 mkDerivation {
   name = "khtml";
-  meta = { maintainers = [ lib.maintainers.ttuegel ]; };
   nativeBuildInputs = [ extra-cmake-modules perl ];
   buildInputs = [
     giflib karchive kcodecs kglobalaccel ki18n kiconthemes kio knotifications
diff --git a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/ki18n.nix b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/ki18n.nix
index 0733abc869..46f502d06b 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/ki18n.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/ki18n.nix
@@ -1,15 +1,11 @@
 {
-  mkDerivation, lib,
+  mkDerivation,
   extra-cmake-modules, gettext, python3,
   qtbase, qtdeclarative, qtscript,
 }:
 
 mkDerivation {
   name = "ki18n";
-  meta = {
-    maintainers = [ lib.maintainers.ttuegel ];
-    broken = builtins.compareVersions qtbase.version "5.14.0" < 0;
-  };
   nativeBuildInputs = [ extra-cmake-modules ];
   propagatedNativeBuildInputs = [ gettext python3 ];
   buildInputs = [ qtdeclarative qtscript ];
diff --git a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kiconthemes/default.nix b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kiconthemes/default.nix
index 76bf0fd053..122f3108da 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kiconthemes/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kiconthemes/default.nix
@@ -1,5 +1,5 @@
 {
-  mkDerivation, lib,
+  mkDerivation,
   extra-cmake-modules,
   breeze-icons, karchive, kcoreaddons, kconfigwidgets, ki18n, kitemviews,
   qtbase, qtsvg, qttools,
@@ -7,7 +7,6 @@
 
 mkDerivation {
   name = "kiconthemes";
-  meta = { maintainers = [ lib.maintainers.ttuegel ]; };
   patches = [
     ./default-theme-breeze.patch
   ];
diff --git a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kidletime.nix b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kidletime.nix
index 883ef2862e..2678cf0804 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kidletime.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kidletime.nix
@@ -1,15 +1,11 @@
 {
-  mkDerivation, lib,
+  mkDerivation,
   extra-cmake-modules,
   qtbase, qtx11extras
 }:
 
 mkDerivation {
   name = "kidletime";
-  meta = {
-    maintainers = [ lib.maintainers.ttuegel ];
-    broken = builtins.compareVersions qtbase.version "5.14.0" < 0;
-  };
   nativeBuildInputs = [ extra-cmake-modules ];
   buildInputs = [ qtx11extras ];
   propagatedBuildInputs = [ qtbase ];
diff --git a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kimageformats.nix b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kimageformats.nix
index 29748a5f7f..3d9c5851f2 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kimageformats.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kimageformats.nix
@@ -8,7 +8,6 @@ let inherit (lib) getDev; in
 
 mkDerivation {
   name = "kimageformats";
-  meta = { maintainers = [ lib.maintainers.ttuegel ]; };
   nativeBuildInputs = [ extra-cmake-modules ];
   buildInputs = [ karchive openexr qtbase ];
   outputs = [ "out" ]; # plugins only
diff --git a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kinit/default.nix b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kinit/default.nix
index 654f6e2060..2a3a3dd5d1 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kinit/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kinit/default.nix
@@ -8,7 +8,6 @@ let inherit (lib) getLib; in
 
 mkDerivation {
   name = "kinit";
-  meta = { maintainers = [ lib.maintainers.ttuegel ]; };
   outputs = [ "out" "dev" ];
   nativeBuildInputs = [ extra-cmake-modules kdoctools ];
   buildInputs = [
diff --git a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kio/0001-Remove-impure-smbd-search-path.patch b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kio/0001-Remove-impure-smbd-search-path.patch
new file mode 100644
index 0000000000..e541f7a05e
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kio/0001-Remove-impure-smbd-search-path.patch
@@ -0,0 +1,25 @@
+From af54a2a37655df26a33bc6783cb472c38f65322f Mon Sep 17 00:00:00 2001
+From: Thomas Tuegel <ttuegel@mailbox.org>
+Date: Sun, 28 Mar 2021 10:31:12 -0500
+Subject: [PATCH 1/2] Remove impure smbd search path
+
+---
+ src/core/ksambashare.cpp | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/core/ksambashare.cpp b/src/core/ksambashare.cpp
+index e810ce4..7cfb4e6 100644
+--- a/src/core/ksambashare.cpp
++++ b/src/core/ksambashare.cpp
+@@ -61,7 +61,7 @@ KSambaSharePrivate::~KSambaSharePrivate()
+ bool KSambaSharePrivate::isSambaInstalled()
+ {
+     const bool daemonExists =
+-        !QStandardPaths::findExecutable(QStringLiteral("smbd"), {QStringLiteral("/usr/sbin/"), QStringLiteral("/usr/local/sbin/")}).isEmpty();
++        !QStandardPaths::findExecutable(QStringLiteral("smbd")).isEmpty();
+     if (!daemonExists) {
+         qCDebug(KIO_CORE_SAMBASHARE) << "KSambaShare: Could not find smbd";
+     }
+-- 
+2.30.1
+
diff --git a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kio/0002-Debug-module-loader.patch b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kio/0002-Debug-module-loader.patch
new file mode 100644
index 0000000000..d0bad0caf4
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kio/0002-Debug-module-loader.patch
@@ -0,0 +1,25 @@
+From 59d26b68704373d405b70806f890ddd545cc976a Mon Sep 17 00:00:00 2001
+From: Thomas Tuegel <ttuegel@mailbox.org>
+Date: Sun, 28 Mar 2021 10:31:48 -0500
+Subject: [PATCH 2/2] Debug module loader
+
+---
+ src/kiod/kiod_main.cpp | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/kiod/kiod_main.cpp b/src/kiod/kiod_main.cpp
+index 1976ee1..eb402bf 100644
+--- a/src/kiod/kiod_main.cpp
++++ b/src/kiod/kiod_main.cpp
+@@ -50,7 +50,7 @@ void KIOD::loadModule(const QString &name)
+         module = factory->create<KDEDModule>();
+     }
+     if (!module) {
+-        qCWarning(KIOD_CATEGORY) << "Error loading plugin:" << loader.errorString();
++        qCWarning(KIOD_CATEGORY) << "Error loading plugin" << name << loader.errorString();
+         return;
+     }
+     module->setModuleName(name); // makes it register to DBus
+-- 
+2.30.1
+
diff --git a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kio/default.nix b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kio/default.nix
index f4d771ab75..47b958ea0b 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kio/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kio/default.nix
@@ -1,5 +1,5 @@
 {
-  mkDerivation, lib, fetchpatch,
+  mkDerivation, fetchpatch,
   extra-cmake-modules, kdoctools, qttools,
   karchive, kbookmarks, kcompletion, kconfig, kconfigwidgets, kcoreaddons,
   kdbusaddons, ki18n, kiconthemes, kitemviews, kjobwidgets, knotifications,
@@ -9,7 +9,6 @@
 
 mkDerivation {
   name = "kio";
-  meta = { maintainers = [ lib.maintainers.ttuegel ]; };
   nativeBuildInputs = [ extra-cmake-modules kdoctools ];
   buildInputs = [
     karchive kconfigwidgets kdbusaddons ki18n kiconthemes knotifications
@@ -22,7 +21,7 @@ mkDerivation {
   ];
   outputs = [ "out" "dev" ];
   patches = [
-    ./samba-search-path.patch
-    ./kio-debug-module-loader.patch
+    ./0001-Remove-impure-smbd-search-path.patch
+    ./0002-Debug-module-loader.patch
  ];
 }
diff --git a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kio/kio-debug-module-loader.patch b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kio/kio-debug-module-loader.patch
deleted file mode 100644
index d26af49e5e..0000000000
--- a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kio/kio-debug-module-loader.patch
+++ /dev/null
@@ -1,13 +0,0 @@
-Index: kio-5.33.0/src/kiod/kiod_main.cpp
-===================================================================
---- kio-5.33.0.orig/src/kiod/kiod_main.cpp
-+++ kio-5.33.0/src/kiod/kiod_main.cpp
-@@ -60,7 +60,7 @@ void KIOD::loadModule(const QString &nam
-         module = factory->create<KDEDModule>();
-     }
-     if (!module) {
--        qCWarning(KIOD_CATEGORY) << "Error loading plugin:" << loader.errorString();
-+        qCWarning(KIOD_CATEGORY) << "Error loading plugin" << name << loader.errorString();
-         return;
-     }
-     module->setModuleName(name); // makes it register to DBus
diff --git a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kio/samba-search-path.patch b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kio/samba-search-path.patch
deleted file mode 100644
index d39ffbfde6..0000000000
--- a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kio/samba-search-path.patch
+++ /dev/null
@@ -1,14 +0,0 @@
-diff --git a/src/core/ksambashare.cpp b/src/core/ksambashare.cpp
-index 1895783..9fe7286 100644
---- a/src/core/ksambashare.cpp
-+++ b/src/core/ksambashare.cpp
-@@ -73,8 +73,7 @@ KSambaSharePrivate::~KSambaSharePrivate()
- bool KSambaSharePrivate::isSambaInstalled()
- {
-     const bool daemonExists =
--        !QStandardPaths::findExecutable(QStringLiteral("smbd"),
--                                       {QStringLiteral("/usr/sbin/"), QStringLiteral("/usr/local/sbin/")}).isEmpty();
-+        !QStandardPaths::findExecutable(QStringLiteral("smbd")).isEmpty();
-     if (!daemonExists) {
-         qCDebug(KIO_CORE_SAMBASHARE) << "KSambaShare: Could not find smbd";
-     }
diff --git a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kirigami2.nix b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kirigami2.nix
index 60cef70486..bb5a5a3fc8 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kirigami2.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kirigami2.nix
@@ -2,9 +2,6 @@
 
 mkDerivation {
   name = "kirigami2";
-  meta = {
-    broken = builtins.compareVersions qtbase.version "5.14.0" < 0;
-  };
   nativeBuildInputs = [ extra-cmake-modules ];
   buildInputs = [ qtbase qtquickcontrols2 qttranslations qtgraphicaleffects ];
   outputs = [ "out" "dev" ];
diff --git a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kitemmodels.nix b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kitemmodels.nix
index c3266a21c0..0f398b0f57 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kitemmodels.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kitemmodels.nix
@@ -1,15 +1,11 @@
 {
-  mkDerivation, lib,
+  mkDerivation,
   extra-cmake-modules,
   qtbase
 }:
 
 mkDerivation {
   name = "kitemmodels";
-  meta = {
-    maintainers = [ lib.maintainers.ttuegel ];
-    broken = builtins.compareVersions qtbase.version "5.14.0" < 0;
-  };
   nativeBuildInputs = [ extra-cmake-modules ];
   propagatedBuildInputs = [ qtbase ];
   outputs = [ "out" "dev" ];
diff --git a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kitemviews.nix b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kitemviews.nix
index eeed5c703a..0e772978e1 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kitemviews.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kitemviews.nix
@@ -6,10 +6,6 @@
 
 mkDerivation {
   name = "kitemviews";
-  meta = {
-    maintainers = [ lib.maintainers.ttuegel ];
-    broken = builtins.compareVersions qtbase.version "5.14.0" < 0;
-  };
   nativeBuildInputs = [ extra-cmake-modules ];
   buildInputs = [ qttools ];
   propagatedBuildInputs = [ qtbase ];
diff --git a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kjobwidgets.nix b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kjobwidgets.nix
index 810e2bf8c8..2e116b7bb7 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kjobwidgets.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kjobwidgets.nix
@@ -1,12 +1,11 @@
 {
-  mkDerivation, lib,
+  mkDerivation,
   extra-cmake-modules, qttools,
   kcoreaddons, kwidgetsaddons, qtx11extras
 }:
 
 mkDerivation {
   name = "kjobwidgets";
-  meta = { maintainers = [ lib.maintainers.ttuegel ]; };
   nativeBuildInputs = [ extra-cmake-modules qttools ];
   buildInputs = [ kcoreaddons kwidgetsaddons qtx11extras ];
 }
diff --git a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kjs.nix b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kjs.nix
index 311f07241d..33aeb284e1 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kjs.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kjs.nix
@@ -1,12 +1,11 @@
 {
-  mkDerivation, lib,
+  mkDerivation,
   extra-cmake-modules, kdoctools,
   pcre, qtbase,
 }:
 
 mkDerivation {
   name = "kjs";
-  meta = { maintainers = [ lib.maintainers.ttuegel ]; };
   nativeBuildInputs = [ extra-cmake-modules kdoctools ];
   buildInputs = [ pcre qtbase ];
 }
diff --git a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kjsembed.nix b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kjsembed.nix
index e8cd5070ae..f552f96351 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kjsembed.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kjsembed.nix
@@ -1,12 +1,11 @@
 {
-  mkDerivation, lib,
+  mkDerivation,
   extra-cmake-modules, kdoctools, qttools,
   ki18n, kjs, qtsvg,
 }:
 
 mkDerivation {
   name = "kjsembed";
-  meta = { maintainers = [ lib.maintainers.ttuegel ]; };
   nativeBuildInputs = [ extra-cmake-modules kdoctools qttools ];
   buildInputs = [ ki18n qtsvg ];
   propagatedBuildInputs = [ kjs ];
diff --git a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kmediaplayer.nix b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kmediaplayer.nix
index a4714c9e4a..5de26e0c8d 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kmediaplayer.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kmediaplayer.nix
@@ -1,4 +1,4 @@
-{ mkDerivation, lib
+{ mkDerivation
 , extra-cmake-modules
 , kparts
 , kxmlgui
@@ -6,7 +6,6 @@
 
 mkDerivation {
   name = "kmediaplayer";
-  meta = { maintainers = [ lib.maintainers.ttuegel ]; };
   nativeBuildInputs = [ extra-cmake-modules ];
   buildInputs = [ kparts kxmlgui ];
 }
diff --git a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/knewstuff/0001-Delay-resolving-knsrcdir.patch b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/knewstuff/0001-Delay-resolving-knsrcdir.patch
new file mode 100644
index 0000000000..b42e75267f
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/knewstuff/0001-Delay-resolving-knsrcdir.patch
@@ -0,0 +1,25 @@
+From 09b5063e115c36b75e291230175b449a0f6d0c29 Mon Sep 17 00:00:00 2001
+From: Thomas Tuegel <ttuegel@mailbox.org>
+Date: Sun, 28 Mar 2021 13:34:33 -0500
+Subject: [PATCH] Delay resolving knsrcdir
+
+---
+ KF5NewStuffCoreConfig.cmake.in | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/KF5NewStuffCoreConfig.cmake.in b/KF5NewStuffCoreConfig.cmake.in
+index c65c7c4..3275627 100644
+--- a/KF5NewStuffCoreConfig.cmake.in
++++ b/KF5NewStuffCoreConfig.cmake.in
+@@ -3,7 +3,7 @@
+ include(CMakeFindDependencyMacro)
+ find_dependency(KF5Attica "@KF_DEP_VERSION@")
+ 
+-set(KDE_INSTALL_KNSRCDIR "@KDE_INSTALL_DATADIR@/knsrcfiles")
++set(KDE_INSTALL_KNSRCDIR "${KDE_INSTALL_DATADIR}/knsrcfiles")
+ 
+ include("${CMAKE_CURRENT_LIST_DIR}/KF5NewStuffCoreTargets.cmake")
+ @PACKAGE_INCLUDE_CORE_QCHTARGETS@
+-- 
+2.30.1
+
diff --git a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/knewstuff.nix b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/knewstuff/default.nix
similarity index 62%
rename from third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/knewstuff.nix
rename to third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/knewstuff/default.nix
index a6b811c0ad..b775fcbef8 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/knewstuff.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/knewstuff/default.nix
@@ -1,5 +1,5 @@
 {
-  mkDerivation, lib, fetchpatch,
+  mkDerivation, fetchpatch,
   extra-cmake-modules,
   attica, karchive, kcompletion, kconfig, kcoreaddons, ki18n, kiconthemes,
   kio, kitemviews, kpackage, kservice, ktextwidgets, kwidgetsaddons, kxmlgui, qtbase,
@@ -8,7 +8,6 @@
 
 mkDerivation {
   name = "knewstuff";
-  meta = { maintainers = [ lib.maintainers.ttuegel ]; };
   nativeBuildInputs = [ extra-cmake-modules ];
   buildInputs = [
     karchive kcompletion kconfig kcoreaddons ki18n kiconthemes kio kitemviews
@@ -16,10 +15,7 @@ mkDerivation {
     ktextwidgets kwidgetsaddons qtbase qtdeclarative kirigami2
   ];
   propagatedBuildInputs = [ attica kservice kxmlgui ];
-
-  patches = [ (fetchpatch {
-    url = "https://github.com/KDE/knewstuff/commit/dbf788c10130eaa3f5ea37a7f22eb4569471aa04.patch";
-    sha256 = "1225rgqg1j120nvhgsahvsq2xlkg91lr37zp14x19krixxgx521j";
-    revert = true;
-  }) ];
+  patches = [
+    ./0001-Delay-resolving-knsrcdir.patch
+  ];
 }
diff --git a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/knotifications.nix b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/knotifications.nix
index 964e1b4411..d1a809d9f5 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/knotifications.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/knotifications.nix
@@ -1,4 +1,4 @@
-{ mkDerivation, lib
+{ mkDerivation
 , extra-cmake-modules
 , kcodecs, kconfig, kcoreaddons, kwindowsystem
 , libdbusmenu
@@ -8,7 +8,6 @@
 
 mkDerivation {
   name = "knotifications";
-  meta = { maintainers = [ lib.maintainers.ttuegel ]; };
   nativeBuildInputs = [ extra-cmake-modules qttools ];
   buildInputs = [
     kcodecs kconfig kcoreaddons kwindowsystem libdbusmenu phonon qtx11extras
diff --git a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/knotifyconfig.nix b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/knotifyconfig.nix
index 6739f96183..1971e3e803 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/knotifyconfig.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/knotifyconfig.nix
@@ -1,12 +1,11 @@
 {
-  mkDerivation, lib,
+  mkDerivation,
   extra-cmake-modules,
   kcompletion, kconfig, ki18n, kio, phonon, qtbase,
 }:
 
 mkDerivation {
   name = "knotifyconfig";
-  meta = { maintainers = [ lib.maintainers.ttuegel ]; };
   nativeBuildInputs = [ extra-cmake-modules ];
   buildInputs = [ kcompletion kconfig ki18n kio phonon ];
   propagatedBuildInputs = [ qtbase ];
diff --git a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kpackage/0001-Allow-external-paths-default.patch b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kpackage/0001-Allow-external-paths-default.patch
new file mode 100644
index 0000000000..dbcdac463c
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kpackage/0001-Allow-external-paths-default.patch
@@ -0,0 +1,25 @@
+From c134a83d226fc6b92412ee714bb6c7ab7e3a800f Mon Sep 17 00:00:00 2001
+From: Thomas Tuegel <ttuegel@mailbox.org>
+Date: Sun, 28 Mar 2021 10:25:18 -0500
+Subject: [PATCH 1/2] Allow external paths default
+
+---
+ src/kpackage/package.cpp | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/kpackage/package.cpp b/src/kpackage/package.cpp
+index 36f5600..881f176 100644
+--- a/src/kpackage/package.cpp
++++ b/src/kpackage/package.cpp
+@@ -858,7 +858,7 @@ PackagePrivate::PackagePrivate()
+     : QSharedData()
+     , fallbackPackage(nullptr)
+     , metadata(nullptr)
+-    , externalPaths(false)
++    , externalPaths(true)
+     , valid(false)
+     , checkedValid(false)
+ {
+-- 
+2.30.1
+
diff --git a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kpackage/0002-QDirIterator-follow-symlinks.patch b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kpackage/0002-QDirIterator-follow-symlinks.patch
new file mode 100644
index 0000000000..5967bdaccf
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kpackage/0002-QDirIterator-follow-symlinks.patch
@@ -0,0 +1,39 @@
+From b1c0d2542234247a5051df015d70347597dfe8d8 Mon Sep 17 00:00:00 2001
+From: Thomas Tuegel <ttuegel@mailbox.org>
+Date: Sun, 28 Mar 2021 10:26:40 -0500
+Subject: [PATCH 2/2] QDirIterator follow symlinks
+
+---
+ src/kpackage/packageloader.cpp            | 2 +-
+ src/kpackage/private/packagejobthread.cpp | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/src/kpackage/packageloader.cpp b/src/kpackage/packageloader.cpp
+index f03d882..d5aee56 100644
+--- a/src/kpackage/packageloader.cpp
++++ b/src/kpackage/packageloader.cpp
+@@ -234,7 +234,7 @@ QList<KPluginMetaData> PackageLoader::listPackages(const QString &packageFormat,
+         } else {
+             qCDebug(KPACKAGE_LOG) << "kpluginindex: Not cached" << plugindir;
+             // If there's no cache file, fall back to listing the directory
+-            const QDirIterator::IteratorFlags flags = QDirIterator::Subdirectories;
++            const QDirIterator::IteratorFlags flags = QDirIterator::Subdirectories | QDirIterator::FollowSymlinks;
+             const QStringList nameFilters = {QStringLiteral("metadata.json"), QStringLiteral("metadata.desktop")};
+ 
+             QDirIterator it(plugindir, nameFilters, QDir::Files, flags);
+diff --git a/src/kpackage/private/packagejobthread.cpp b/src/kpackage/private/packagejobthread.cpp
+index 3eed307..dd6ca6e 100644
+--- a/src/kpackage/private/packagejobthread.cpp
++++ b/src/kpackage/private/packagejobthread.cpp
+@@ -108,7 +108,7 @@ bool indexDirectory(const QString &dir, const QString &dest)
+ 
+     QJsonArray plugins;
+ 
+-    QDirIterator it(dir, *metaDataFiles, QDir::Files, QDirIterator::Subdirectories);
++    QDirIterator it(dir, *metaDataFiles, QDir::Files, QDirIterator::Subdirectories | QDirIterator::FollowSymlinks);
+     while (it.hasNext()) {
+         it.next();
+         const QString path = it.fileInfo().absoluteFilePath();
+-- 
+2.30.1
+
diff --git a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kpackage/allow-external-paths.patch b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kpackage/allow-external-paths.patch
deleted file mode 100644
index c1c9efde7f..0000000000
--- a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kpackage/allow-external-paths.patch
+++ /dev/null
@@ -1,13 +0,0 @@
-diff --git a/src/kpackage/package.cpp b/src/kpackage/package.cpp
-index 5aec9fd..b15c933 100644
---- a/src/kpackage/package.cpp
-+++ b/src/kpackage/package.cpp
-@@ -820,7 +820,7 @@ PackagePrivate::PackagePrivate()
-     : QSharedData(),
-       fallbackPackage(nullptr),
-       metadata(nullptr),
--      externalPaths(false),
-+      externalPaths(true),
-       valid(false),
-       checkedValid(false)
- {
diff --git a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kpackage/default.nix b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kpackage/default.nix
index 6bd42420b8..d4edc09b2f 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kpackage/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kpackage/default.nix
@@ -1,16 +1,15 @@
 {
-  mkDerivation, lib,
+  mkDerivation,
   extra-cmake-modules, kdoctools,
   karchive, kconfig, kcoreaddons, ki18n, qtbase,
 }:
 
 mkDerivation {
   name = "kpackage";
-  meta = { maintainers = [ lib.maintainers.ttuegel ]; };
   nativeBuildInputs = [ extra-cmake-modules kdoctools ];
   buildInputs = [ karchive kconfig kcoreaddons ki18n qtbase ];
   patches = [
-    ./allow-external-paths.patch
-    ./qdiriterator-follow-symlinks.patch
+    ./0001-Allow-external-paths-default.patch
+    ./0002-QDirIterator-follow-symlinks.patch
   ];
 }
diff --git a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kpackage/qdiriterator-follow-symlinks.patch b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kpackage/qdiriterator-follow-symlinks.patch
deleted file mode 100644
index cab334838e..0000000000
--- a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kpackage/qdiriterator-follow-symlinks.patch
+++ /dev/null
@@ -1,26 +0,0 @@
-Index: kpackage-5.30.0/src/kpackage/packageloader.cpp
-===================================================================
---- kpackage-5.30.0.orig/src/kpackage/packageloader.cpp
-+++ kpackage-5.30.0/src/kpackage/packageloader.cpp
-@@ -238,7 +238,7 @@ QList<KPluginMetaData> PackageLoader::li
-         } else {
-             //qDebug() << "Not cached";
-             // If there's no cache file, fall back to listing the directory
--            const QDirIterator::IteratorFlags flags = QDirIterator::Subdirectories;
-+            const QDirIterator::IteratorFlags flags = QDirIterator::Subdirectories | QDirIterator::FollowSymlinks;
-             const QStringList nameFilters = { QStringLiteral("metadata.json"), QStringLiteral("metadata.desktop") };
- 
-             QDirIterator it(plugindir, nameFilters, QDir::Files, flags);
-Index: kpackage-5.30.0/src/kpackage/private/packagejobthread.cpp
-===================================================================
---- kpackage-5.30.0.orig/src/kpackage/private/packagejobthread.cpp
-+++ kpackage-5.30.0/src/kpackage/private/packagejobthread.cpp
-@@ -121,7 +121,7 @@ bool indexDirectory(const QString& dir,
- 
-     QJsonArray plugins;
- 
--    QDirIterator it(dir, *metaDataFiles, QDir::Files, QDirIterator::Subdirectories);
-+    QDirIterator it(dir, *metaDataFiles, QDir::Files, QDirIterator::Subdirectories | QDirIterator::FollowSymlinks);
-     while (it.hasNext()) {
-         it.next();
-         const QString path = it.fileInfo().absoluteFilePath();
diff --git a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kparts.nix b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kparts.nix
index f657569277..e1d2a15616 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kparts.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kparts.nix
@@ -1,5 +1,5 @@
 {
-  mkDerivation, lib,
+  mkDerivation,
   extra-cmake-modules,
   kconfig, kcoreaddons, ki18n, kiconthemes, kio, kjobwidgets, knotifications,
   kservice, ktextwidgets, kwidgetsaddons, kxmlgui
@@ -7,7 +7,6 @@
 
 mkDerivation {
   name = "kparts";
-  meta = { maintainers = [ lib.maintainers.ttuegel ]; };
   nativeBuildInputs = [ extra-cmake-modules ];
   buildInputs = [
     kconfig kcoreaddons ki18n kiconthemes kjobwidgets knotifications kservice
diff --git a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kpeople.nix b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kpeople.nix
index 04181fd3e1..52c16ea2b9 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kpeople.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kpeople.nix
@@ -1,5 +1,5 @@
 {
-  mkDerivation, lib,
+  mkDerivation,
   extra-cmake-modules,
   kcoreaddons, ki18n, kitemviews, kservice, kwidgetsaddons, qtbase,
   qtdeclarative,
@@ -7,7 +7,6 @@
 
 mkDerivation {
   name = "kpeople";
-  meta = { maintainers = [ lib.maintainers.ttuegel ]; };
   nativeBuildInputs = [ extra-cmake-modules ];
   buildInputs = [
     kcoreaddons ki18n kitemviews kservice kwidgetsaddons qtdeclarative
diff --git a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kplotting.nix b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kplotting.nix
index f1c99e0c93..68df24d008 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kplotting.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kplotting.nix
@@ -1,13 +1,9 @@
-{ mkDerivation, lib
+{ mkDerivation
 , extra-cmake-modules, qttools, qtbase
 }:
 
 mkDerivation {
   name = "kplotting";
-  meta = {
-    maintainers = [ lib.maintainers.ttuegel ];
-    broken = builtins.compareVersions qtbase.version "5.14.0" < 0;
-  };
   nativeBuildInputs = [ extra-cmake-modules ];
   propagatedBuildInputs = [ qtbase qttools ];
   outputs = [ "out" "dev" ];
diff --git a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kpty.nix b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kpty.nix
index 150c5b3d2b..2456f4e22f 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kpty.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kpty.nix
@@ -1,8 +1,7 @@
-{ mkDerivation, lib, extra-cmake-modules, kcoreaddons, ki18n, qtbase, }:
+{ mkDerivation, extra-cmake-modules, kcoreaddons, ki18n, qtbase, }:
 
 mkDerivation {
   name = "kpty";
-  meta = { maintainers = [ lib.maintainers.ttuegel ]; };
   nativeBuildInputs = [ extra-cmake-modules ];
   buildInputs = [ kcoreaddons ki18n qtbase ];
   outputs = [ "out" "dev" ];
diff --git a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kquickcharts.nix b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kquickcharts.nix
index 5a06d4c1ca..0ae30be653 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kquickcharts.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kquickcharts.nix
@@ -1,14 +1,11 @@
 {
-  mkDerivation, lib,
+  mkDerivation,
   extra-cmake-modules,
-  qtquickcontrols2,
+  qtquickcontrols2, qtbase,
 }:
 
 mkDerivation {
   name = "kquickcharts";
-  meta = {
-    maintainers = [ lib.maintainers.ttuegel ];
-  };
   nativeBuildInputs = [ extra-cmake-modules ];
   propagatedBuildInputs = [ qtquickcontrols2 ];
   outputs = [ "out" "dev" ];
diff --git a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kross.nix b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kross.nix
index f45fb5ecd1..189e100aa7 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kross.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kross.nix
@@ -1,11 +1,10 @@
-{ mkDerivation, lib, extra-cmake-modules, kcompletion, kcoreaddons
+{ mkDerivation, extra-cmake-modules, kcompletion, kcoreaddons
 , kdoctools, ki18n, kiconthemes, kio, kparts, kwidgetsaddons
 , kxmlgui, qtbase, qtscript, qtxmlpatterns,
 }:
 
 mkDerivation {
   name = "kross";
-  meta = { maintainers = [ lib.maintainers.ttuegel ]; };
   nativeBuildInputs = [ extra-cmake-modules kdoctools ];
   buildInputs = [ kcompletion kcoreaddons kxmlgui ];
   propagatedBuildInputs = [
diff --git a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/krunner.nix b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/krunner.nix
index 990c3c4fdf..7db7c61db4 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/krunner.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/krunner.nix
@@ -1,5 +1,5 @@
 {
-  mkDerivation, lib, fetchpatch,
+  mkDerivation, fetchpatch,
   extra-cmake-modules,
   kconfig, kcoreaddons, ki18n, kio, kservice, plasma-framework, qtbase,
   qtdeclarative, solid, threadweaver, kwindowsystem
@@ -8,7 +8,6 @@
 let
   self = mkDerivation {
     name = "krunner";
-    meta = { maintainers = [ lib.maintainers.ttuegel ]; };
     nativeBuildInputs = [ extra-cmake-modules ];
     buildInputs = [
       kconfig kcoreaddons ki18n kio kservice qtdeclarative solid
diff --git a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kservice/default.nix b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kservice/default.nix
index 630582ecf7..c1488f728d 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kservice/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kservice/default.nix
@@ -1,5 +1,5 @@
 {
-  mkDerivation, lib,
+  mkDerivation,
   bison, extra-cmake-modules, flex,
   kconfig, kcoreaddons, kcrash, kdbusaddons, kdoctools, ki18n, kwindowsystem,
   qtbase, shared-mime-info,
@@ -7,7 +7,6 @@
 
 mkDerivation {
   name = "kservice";
-  meta = { maintainers = [ lib.maintainers.ttuegel ]; };
   nativeBuildInputs = [ extra-cmake-modules kdoctools ];
   propagatedNativeBuildInputs = [ bison flex ];
   buildInputs = [
diff --git a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/ktexteditor.nix b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/ktexteditor.nix
index 98f9b3f82c..6a74dca7b4 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/ktexteditor.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/ktexteditor.nix
@@ -1,5 +1,5 @@
 {
-  mkDerivation, lib,
+  mkDerivation,
   extra-cmake-modules, perl,
   karchive, kconfig, kguiaddons, ki18n, kiconthemes, kio, kparts, libgit2,
   qtscript, qtxmlpatterns, sonnet, syntax-highlighting, qtquickcontrols,
@@ -8,7 +8,6 @@
 
 mkDerivation {
   name = "ktexteditor";
-  meta = { maintainers = [ lib.maintainers.ttuegel ]; };
   nativeBuildInputs = [ extra-cmake-modules perl ];
   buildInputs = [
     karchive kconfig kguiaddons ki18n kiconthemes kio libgit2 qtscript
diff --git a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/ktextwidgets.nix b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/ktextwidgets.nix
index 604066b963..653d0ac889 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/ktextwidgets.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/ktextwidgets.nix
@@ -1,5 +1,5 @@
 {
-  mkDerivation, lib,
+  mkDerivation,
   extra-cmake-modules, qttools,
   kcompletion, kconfig, kconfigwidgets, ki18n, kiconthemes, kservice,
   kwindowsystem, qtbase, sonnet,
@@ -7,7 +7,6 @@
 
 mkDerivation {
   name = "ktextwidgets";
-  meta = { maintainers = [ lib.maintainers.ttuegel ]; };
   nativeBuildInputs = [ extra-cmake-modules ];
   buildInputs = [
     kcompletion kconfig kconfigwidgets kiconthemes kservice kwindowsystem
diff --git a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kunitconversion.nix b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kunitconversion.nix
index d6c079fd83..de0d9aab92 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kunitconversion.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kunitconversion.nix
@@ -1,8 +1,7 @@
-{ mkDerivation, lib, extra-cmake-modules, ki18n, qtbase, }:
+{ mkDerivation, extra-cmake-modules, ki18n, qtbase, }:
 
 mkDerivation {
   name = "kunitconversion";
-  meta = { maintainers = [ lib.maintainers.ttuegel ]; };
   nativeBuildInputs = [ extra-cmake-modules ];
   buildInputs = [ ki18n qtbase ];
   outputs = [ "out" "dev" ];
diff --git a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kwallet.nix b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kwallet.nix
index fca0dedd08..f93f0437db 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kwallet.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kwallet.nix
@@ -1,5 +1,5 @@
 {
-  mkDerivation, lib,
+  mkDerivation,
   extra-cmake-modules, kdoctools,
   kconfig, kconfigwidgets, kcoreaddons , kdbusaddons, ki18n,
   kiconthemes, knotifications, kservice, kwidgetsaddons, kwindowsystem,
@@ -8,7 +8,6 @@
 
 mkDerivation {
   name = "kwallet";
-  meta = { maintainers = [ lib.maintainers.ttuegel ]; };
   nativeBuildInputs = [ extra-cmake-modules kdoctools ];
   buildInputs = [
     kconfig kconfigwidgets kcoreaddons kdbusaddons ki18n kiconthemes
diff --git a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kwayland.nix b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kwayland.nix
index 5b73cc7fce..749735c4ad 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kwayland.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kwayland.nix
@@ -1,15 +1,11 @@
 {
-  mkDerivation, lib, propagateBin,
+  mkDerivation, propagateBin,
   extra-cmake-modules,
   plasma-wayland-protocols, qtbase, wayland, wayland-protocols
 }:
 
 mkDerivation {
   name = "kwayland";
-  meta = {
-    maintainers = [ lib.maintainers.ttuegel ];
-    broken = builtins.compareVersions qtbase.version "5.14.0" < 0;
-  };
   nativeBuildInputs = [ extra-cmake-modules ];
   buildInputs = [ plasma-wayland-protocols wayland wayland-protocols ];
   propagatedBuildInputs = [ qtbase ];
diff --git a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kwidgetsaddons.nix b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kwidgetsaddons.nix
index 821c703a58..ee347df18a 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kwidgetsaddons.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kwidgetsaddons.nix
@@ -1,15 +1,11 @@
 {
-  mkDerivation, lib,
+  mkDerivation,
   extra-cmake-modules,
   qtbase, qttools
 }:
 
 mkDerivation {
   name = "kwidgetsaddons";
-  meta = {
-    maintainers = [ lib.maintainers.ttuegel ];
-    broken = builtins.compareVersions qtbase.version "5.14.0" < 0;
-  };
   nativeBuildInputs = [ extra-cmake-modules ];
   buildInputs = [ qttools ];
   propagatedBuildInputs = [ qtbase ];
diff --git a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kwindowsystem/default.nix b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kwindowsystem/default.nix
index c418ca3943..4092930933 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kwindowsystem/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kwindowsystem/default.nix
@@ -1,5 +1,5 @@
 {
-  mkDerivation, lib,
+  mkDerivation,
   extra-cmake-modules,
   libpthreadstubs, libXdmcp,
   qtbase, qttools, qtx11extras
@@ -7,10 +7,6 @@
 
 mkDerivation {
   name = "kwindowsystem";
-  meta = {
-    maintainers = [ lib.maintainers.ttuegel ];
-    broken = lib.versionOlder qtbase.version "5.14.0";
-  };
   nativeBuildInputs = [ extra-cmake-modules ];
   buildInputs = [ libpthreadstubs libXdmcp qttools qtx11extras ];
   propagatedBuildInputs = [ qtbase ];
diff --git a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kxmlgui.nix b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kxmlgui.nix
index 5adcf281e6..0b29158e4b 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kxmlgui.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kxmlgui.nix
@@ -1,5 +1,5 @@
 {
-  mkDerivation, lib,
+  mkDerivation,
   extra-cmake-modules, qttools,
   attica, kconfig, kconfigwidgets, kglobalaccel, ki18n, kiconthemes, kitemviews,
   ktextwidgets, kwindowsystem, qtbase, sonnet,
@@ -7,7 +7,6 @@
 
 mkDerivation {
   name = "kxmlgui";
-  meta = { maintainers = [ lib.maintainers.ttuegel ]; };
   nativeBuildInputs = [ extra-cmake-modules ];
   buildInputs = [
     attica kglobalaccel ki18n kiconthemes kitemviews ktextwidgets kwindowsystem
diff --git a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kxmlrpcclient.nix b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kxmlrpcclient.nix
index acffde6a7c..aa334d69ef 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kxmlrpcclient.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/kxmlrpcclient.nix
@@ -1,8 +1,7 @@
-{ mkDerivation, lib, extra-cmake-modules, ki18n, kio }:
+{ mkDerivation, extra-cmake-modules, ki18n, kio }:
 
 mkDerivation {
   name = "kxmlrpcclient";
-  meta = { maintainers = [ lib.maintainers.ttuegel ]; };
   nativeBuildInputs = [ extra-cmake-modules ];
   buildInputs = [ ki18n ];
   propagatedBuildInputs = [ kio ];
diff --git a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/modemmanager-qt.nix b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/modemmanager-qt.nix
index 195e90feef..5ecb5317cf 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/modemmanager-qt.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/modemmanager-qt.nix
@@ -1,15 +1,11 @@
 {
-  mkDerivation, lib,
+  mkDerivation,
   extra-cmake-modules,
   modemmanager, qtbase
 }:
 
 mkDerivation {
   name = "modemmanager-qt";
-  meta = {
-    maintainers = [ lib.maintainers.ttuegel ];
-    broken = builtins.compareVersions qtbase.version "5.7.0" < 0;
-  };
   nativeBuildInputs = [ extra-cmake-modules ];
   propagatedBuildInputs = [ modemmanager qtbase ];
   outputs = [ "out" "dev" ];
diff --git a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/networkmanager-qt.nix b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/networkmanager-qt.nix
index 4ded321674..2ff4b2c2b4 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/networkmanager-qt.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/networkmanager-qt.nix
@@ -1,15 +1,11 @@
 {
-  mkDerivation, lib,
+  mkDerivation,
   extra-cmake-modules,
   networkmanager, qtbase,
 }:
 
 mkDerivation {
   name = "networkmanager-qt";
-  meta = {
-    maintainers = [ lib.maintainers.ttuegel ];
-    broken = builtins.compareVersions qtbase.version "5.7.0" < 0;
-  };
   nativeBuildInputs = [ extra-cmake-modules ];
   propagatedBuildInputs = [ networkmanager qtbase ];
   outputs = [ "out" "dev" ];
diff --git a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/oxygen-icons5.nix b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/oxygen-icons5.nix
index 2d795bfc50..32b219ab7e 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/oxygen-icons5.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/oxygen-icons5.nix
@@ -1,14 +1,12 @@
 { mkDerivation
 , lib
-, extra-cmake-modules, qtbase
+, extra-cmake-modules
+, qtbase
 }:
 
 mkDerivation {
   name = "oxygen-icons5";
-  meta = {
-    license = lib.licenses.lgpl3Plus;
-    maintainers = [ lib.maintainers.ttuegel ];
-  };
+  meta.license = lib.licenses.lgpl3Plus;
   nativeBuildInputs = [ extra-cmake-modules ];
   buildInputs = [ qtbase ];
   outputs = [ "out" ]; # only runtime outputs
diff --git a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/plasma-framework.nix b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/plasma-framework.nix
index 44005ec7d2..12540b0700 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/plasma-framework.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/plasma-framework.nix
@@ -1,5 +1,5 @@
 {
-  mkDerivation, lib,
+  mkDerivation,
   extra-cmake-modules, kdoctools,
   kactivities, karchive, kconfig, kconfigwidgets, kcoreaddons, kdbusaddons,
   kdeclarative, kglobalaccel, kguiaddons, ki18n, kiconthemes, kio,
@@ -9,7 +9,6 @@
 
 mkDerivation {
   name = "plasma-framework";
-  meta = { maintainers = [ lib.maintainers.ttuegel ]; };
   nativeBuildInputs = [ extra-cmake-modules kdoctools ];
   buildInputs = [
     kactivities karchive kconfig kconfigwidgets kcoreaddons kdbusaddons
diff --git a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/prison.nix b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/prison.nix
index cf74ee20c2..670fd02d61 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/prison.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/prison.nix
@@ -1,15 +1,11 @@
 {
-  mkDerivation, lib,
+  mkDerivation,
   extra-cmake-modules,
   libdmtx, qrencode, qtbase,
 }:
 
 mkDerivation {
   name = "prison";
-  meta = {
-    maintainers = [ lib.maintainers.ttuegel ];
-    broken = builtins.compareVersions qtbase.version "5.7.0" < 0;
-  };
   nativeBuildInputs = [ extra-cmake-modules ];
   buildInputs = [ libdmtx qrencode ];
   propagatedBuildInputs = [ qtbase ];
diff --git a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/purpose.nix b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/purpose.nix
index 6f1527da77..7e4d002e2a 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/purpose.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/purpose.nix
@@ -1,12 +1,11 @@
 {
-  mkDerivation, lib, extra-cmake-modules, qtbase
+  mkDerivation, extra-cmake-modules, qtbase
 , qtdeclarative, kconfig, kcoreaddons, ki18n, kio, kirigami2
 , fetchpatch
 }:
 
 mkDerivation {
   name = "purpose";
-  meta = { maintainers = [ lib.maintainers.bkchr ]; };
   nativeBuildInputs = [ extra-cmake-modules ];
   buildInputs = [
     qtbase qtdeclarative kconfig kcoreaddons
diff --git a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/qqc2-desktop-style.nix b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/qqc2-desktop-style.nix
index ed372e01ae..e400967407 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/qqc2-desktop-style.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/qqc2-desktop-style.nix
@@ -1,4 +1,4 @@
-{ mkDerivation, lib
+{ mkDerivation
 , extra-cmake-modules
 , qtquickcontrols2
 , qtx11extras
@@ -9,7 +9,6 @@
 
 mkDerivation {
   name = "qqc2-desktop-style";
-  meta = { maintainers = with lib.maintainers; [ ttuegel ]; };
   nativeBuildInputs = [ extra-cmake-modules ];
   buildInputs = [ qtx11extras qtquickcontrols2 kconfig kiconthemes kirigami2 ];
 }
diff --git a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/solid.nix b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/solid.nix
index f769f76854..aa1b1ebe34 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/solid.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/solid.nix
@@ -1,15 +1,11 @@
 {
-  mkDerivation, lib,
+  mkDerivation,
   bison, extra-cmake-modules, flex,
   media-player-info, qtbase, qtdeclarative, qttools
 }:
 
 mkDerivation {
   name = "solid";
-  meta = {
-    maintainers = [ lib.maintainers.ttuegel ];
-    broken = builtins.compareVersions qtbase.version "5.14.0" < 0;
-  };
   nativeBuildInputs = [ bison extra-cmake-modules flex media-player-info ];
   buildInputs = [ qtdeclarative qttools ];
   propagatedBuildInputs = [ qtbase ];
diff --git a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/sonnet.nix b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/sonnet.nix
index 431e4b8105..2eff7bad24 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/sonnet.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/sonnet.nix
@@ -1,14 +1,10 @@
-{ mkDerivation, lib
+{ mkDerivation
 , extra-cmake-modules
 , aspell, qtbase, qttools
 }:
 
 mkDerivation {
   name = "sonnet";
-  meta = {
-    maintainers = [ lib.maintainers.ttuegel ];
-    broken = builtins.compareVersions qtbase.version "5.14.0" < 0;
-  };
   nativeBuildInputs = [ extra-cmake-modules ];
   buildInputs = [ aspell qttools ];
   propagatedBuildInputs = [ qtbase ];
diff --git a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/srcs.nix b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/srcs.nix
index 871c15d6c1..91d53f4df8 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/srcs.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/srcs.nix
@@ -4,667 +4,667 @@
 
 {
   attica = {
-    version = "5.79.0";
+    version = "5.80.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.79/attica-5.79.0.tar.xz";
-      sha256 = "1p6rcpfq3ifz8c8ws5k085mzg7fya2dpv7ryd6iqwi083ys49wla";
-      name = "attica-5.79.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.80/attica-5.80.0.tar.xz";
+      sha256 = "0wffjjrk6rka25kgfq05j9fzxawysimpzi8jj3sw3kfz05mqdap3";
+      name = "attica-5.80.0.tar.xz";
     };
   };
   baloo = {
-    version = "5.79.0";
+    version = "5.80.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.79/baloo-5.79.0.tar.xz";
-      sha256 = "0l7z7260pjw6gmcnzp0v57dsypl2yxnm8dxfcdiln8gw2fisryc0";
-      name = "baloo-5.79.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.80/baloo-5.80.0.tar.xz";
+      sha256 = "0wdm03x1zm31nivf04qxih6gg18c97diff7ddaqqbz8c7jlhppzc";
+      name = "baloo-5.80.0.tar.xz";
     };
   };
   bluez-qt = {
-    version = "5.79.0";
+    version = "5.80.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.79/bluez-qt-5.79.0.tar.xz";
-      sha256 = "0snips4ak77zpz6x9bzr5lmal712lz64xns1bwlz80svzcikznpj";
-      name = "bluez-qt-5.79.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.80/bluez-qt-5.80.0.tar.xz";
+      sha256 = "08g56gnh0gkh7n92wqama9lbqk6pfdby9xbh8f2vgmnkzy07zrwn";
+      name = "bluez-qt-5.80.0.tar.xz";
     };
   };
   breeze-icons = {
-    version = "5.79.0";
+    version = "5.80.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.79/breeze-icons-5.79.0.tar.xz";
-      sha256 = "06sd7grh7r6wnx8p8mhp7vfhsg3bnyafy94fj6jz6gg9m0308cn6";
-      name = "breeze-icons-5.79.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.80/breeze-icons-5.80.0.tar.xz";
+      sha256 = "11353lgy2fh1d2fgbhg20fapsjzrpsxlf5zilrfkw8y0my690rm2";
+      name = "breeze-icons-5.80.0.tar.xz";
     };
   };
   extra-cmake-modules = {
-    version = "5.79.0";
+    version = "5.80.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.79/extra-cmake-modules-5.79.0.tar.xz";
-      sha256 = "1n5yd3ggz5pq4qs7f86aqvzvfmxx2khsn1i1m67xhrn5k7dh55mj";
-      name = "extra-cmake-modules-5.79.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.80/extra-cmake-modules-5.80.0.tar.xz";
+      sha256 = "0r3gr6qrgljiq7bsks54xc68x9pf7i2gm9pgjq5kslw5ys0gsw13";
+      name = "extra-cmake-modules-5.80.0.tar.xz";
     };
   };
   frameworkintegration = {
-    version = "5.79.0";
+    version = "5.80.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.79/frameworkintegration-5.79.0.tar.xz";
-      sha256 = "0c0i8hqqvi65bh1ghb6ql1a8vqihxck6xhpki4g0ryipilvqmj21";
-      name = "frameworkintegration-5.79.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.80/frameworkintegration-5.80.0.tar.xz";
+      sha256 = "0sk9p4wk4hsr5sg0z24rc7fxrsdbxcpm5fw66v30lhncrlf9c7c7";
+      name = "frameworkintegration-5.80.0.tar.xz";
     };
   };
   kactivities = {
-    version = "5.79.0";
+    version = "5.80.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.79/kactivities-5.79.0.tar.xz";
-      sha256 = "0d3ds43iqqlbii9xwp7f20nz338xqmq70a4v84zb5ks1mnhkz47l";
-      name = "kactivities-5.79.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.80/kactivities-5.80.0.tar.xz";
+      sha256 = "14im60ig074axryhgz3qw1zjqhfai1gg0hq88spabvz22r5f340s";
+      name = "kactivities-5.80.0.tar.xz";
     };
   };
   kactivities-stats = {
-    version = "5.79.0";
+    version = "5.80.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.79/kactivities-stats-5.79.0.tar.xz";
-      sha256 = "0s5r8891flkmrwga15ihqrmj4i12khxwp97kaa84j4mqva6zdx93";
-      name = "kactivities-stats-5.79.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.80/kactivities-stats-5.80.0.tar.xz";
+      sha256 = "1w3khp8p2a1v85s5hay3s0nznjsajaavrjx4iw2cxssxnzlvg2fn";
+      name = "kactivities-stats-5.80.0.tar.xz";
     };
   };
   kapidox = {
-    version = "5.79.0";
+    version = "5.80.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.79/kapidox-5.79.0.tar.xz";
-      sha256 = "0qk4ksxdaiphlpd51mgwdddxq5vq8n55dd80s2a5q93jkcywhli7";
-      name = "kapidox-5.79.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.80/kapidox-5.80.0.tar.xz";
+      sha256 = "010jigqkw3rs04irf942cwgd9wvi7j9b5lisdcrc3w65a19q053z";
+      name = "kapidox-5.80.0.tar.xz";
     };
   };
   karchive = {
-    version = "5.79.0";
+    version = "5.80.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.79/karchive-5.79.0.tar.xz";
-      sha256 = "01qf46k7gp11fh53afcpmbfx0w5bi0k8jflb2db8nss7ri3bzlhc";
-      name = "karchive-5.79.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.80/karchive-5.80.0.tar.xz";
+      sha256 = "1xaxbhbx562ybd9rqna1bh3bpbyxh02c9x9xyisw84akiibqvq7w";
+      name = "karchive-5.80.0.tar.xz";
     };
   };
   kauth = {
-    version = "5.79.0";
+    version = "5.80.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.79/kauth-5.79.0.tar.xz";
-      sha256 = "18bqfn47iyhf1zfkw3mgdxz154f9gqbkn41c3ca94qjm91mb40da";
-      name = "kauth-5.79.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.80/kauth-5.80.0.tar.xz";
+      sha256 = "1pcnk34b912hhhpx606ajvz9hcz6xr37g7bl002zkar9fzh7vw16";
+      name = "kauth-5.80.0.tar.xz";
     };
   };
   kbookmarks = {
-    version = "5.79.0";
+    version = "5.80.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.79/kbookmarks-5.79.0.tar.xz";
-      sha256 = "109rjikqxv7mbhv22p41rbfz43510y6k7p0ahggynv0x5y5xzkqd";
-      name = "kbookmarks-5.79.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.80/kbookmarks-5.80.0.tar.xz";
+      sha256 = "11imylvhw3pc46qiqz72q8rwa9igvgvd9gdchiivcrg4494k502q";
+      name = "kbookmarks-5.80.0.tar.xz";
     };
   };
   kcalendarcore = {
-    version = "5.79.0";
+    version = "5.80.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.79/kcalendarcore-5.79.0.tar.xz";
-      sha256 = "19vc1ji0jlk899rmr6i53l51diadn67mh6z6j787bp29jlcmnciv";
-      name = "kcalendarcore-5.79.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.80/kcalendarcore-5.80.0.tar.xz";
+      sha256 = "1z8js2b5zb862ngwsdd2hwi6wqhkvkhsx5akbn7f1gmjs0pfrkg5";
+      name = "kcalendarcore-5.80.0.tar.xz";
     };
   };
   kcmutils = {
-    version = "5.79.0";
+    version = "5.80.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.79/kcmutils-5.79.0.tar.xz";
-      sha256 = "1wry88rikj7mz460m3c7gr6fwcdpdlx9jrxna2ikybnk9aw8dlkk";
-      name = "kcmutils-5.79.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.80/kcmutils-5.80.0.tar.xz";
+      sha256 = "0ncyffl60wv5awbfazknqpysaji11xxrpicabfl0mzmwcnlb34wc";
+      name = "kcmutils-5.80.0.tar.xz";
     };
   };
   kcodecs = {
-    version = "5.79.0";
+    version = "5.80.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.79/kcodecs-5.79.0.tar.xz";
-      sha256 = "1ab4dz6nvmd6fzsl7wbrvjlz0c0fk0bjb0jcklrj205pkhiaf7y8";
-      name = "kcodecs-5.79.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.80/kcodecs-5.80.0.tar.xz";
+      sha256 = "06l8c3jwx5z43cyv7vl6yfs91a7zmy0j089x826nn2a7jr678mjg";
+      name = "kcodecs-5.80.0.tar.xz";
     };
   };
   kcompletion = {
-    version = "5.79.0";
+    version = "5.80.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.79/kcompletion-5.79.0.tar.xz";
-      sha256 = "1znp6h4pggkl1hcbbw47vjkgmpc1rj6mx01p05x0ad143mwqpzwv";
-      name = "kcompletion-5.79.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.80/kcompletion-5.80.0.tar.xz";
+      sha256 = "14v0d1w01lric532vks9akh7v7z7nf9hgpf866qyhmb236k52hpg";
+      name = "kcompletion-5.80.0.tar.xz";
     };
   };
   kconfig = {
-    version = "5.79.0";
+    version = "5.80.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.79/kconfig-5.79.0.tar.xz";
-      sha256 = "02jirbphrg6dyxd444ghzhy053s85pq4lgpppca3nmvzr2572j7r";
-      name = "kconfig-5.79.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.80/kconfig-5.80.0.tar.xz";
+      sha256 = "1chrvpfr72bdgv6fdgrkbfbiz76jgvzsncxsc6gjvkvcdag48016";
+      name = "kconfig-5.80.0.tar.xz";
     };
   };
   kconfigwidgets = {
-    version = "5.79.0";
+    version = "5.80.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.79/kconfigwidgets-5.79.0.tar.xz";
-      sha256 = "1lrh2dis3invj9vclpa1mca8hrks1b82c5hkf0g0lilg69lir83y";
-      name = "kconfigwidgets-5.79.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.80/kconfigwidgets-5.80.0.tar.xz";
+      sha256 = "12rc3l91h2snkxni70brdp8f21g19c0gabpxy7ssv614ci0fz7j7";
+      name = "kconfigwidgets-5.80.0.tar.xz";
     };
   };
   kcontacts = {
-    version = "5.79.0";
+    version = "5.80.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.79/kcontacts-5.79.0.tar.xz";
-      sha256 = "0jflvfkyd7llv54dxyd1a4h1l4xgrqggxadiqv0c6ijn4dvlsmy9";
-      name = "kcontacts-5.79.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.80/kcontacts-5.80.0.tar.xz";
+      sha256 = "173vpxncdr9mwpksizflvipsf18pnwn500b2xzpkaaz5w84vk1yk";
+      name = "kcontacts-5.80.0.tar.xz";
     };
   };
   kcoreaddons = {
-    version = "5.79.0";
+    version = "5.80.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.79/kcoreaddons-5.79.0.tar.xz";
-      sha256 = "0n9nh4vkk19crp30dac3x9mzgzl4kv38jw6dcg4fwfp77gcin8kg";
-      name = "kcoreaddons-5.79.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.80/kcoreaddons-5.80.0.tar.xz";
+      sha256 = "1l9ydyvbmn2ih07jsy12snxavss7cyxyig0n65sz6gwbcxqr5qzc";
+      name = "kcoreaddons-5.80.0.tar.xz";
     };
   };
   kcrash = {
-    version = "5.79.0";
+    version = "5.80.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.79/kcrash-5.79.0.tar.xz";
-      sha256 = "0w74d0j1ckbcd8q8lc57g3y7g50v222mgsvli77ql29imzx79apc";
-      name = "kcrash-5.79.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.80/kcrash-5.80.0.tar.xz";
+      sha256 = "1c2b8i9qay0mdr0i16jp2167vb18r792dd88nz0in77lzccfk8v4";
+      name = "kcrash-5.80.0.tar.xz";
     };
   };
   kdav = {
-    version = "5.79.0";
+    version = "5.80.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.79/kdav-5.79.0.tar.xz";
-      sha256 = "1573qan4xz8k33zfghwdmlr7pgbd4sfj0pshwv6bkx78kprd3xfl";
-      name = "kdav-5.79.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.80/kdav-5.80.0.tar.xz";
+      sha256 = "1cab4pppqyfqm53dhp5lm4ghijbhym77ndb0pr6crvi70kz4s101";
+      name = "kdav-5.80.0.tar.xz";
     };
   };
   kdbusaddons = {
-    version = "5.79.0";
+    version = "5.80.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.79/kdbusaddons-5.79.0.tar.xz";
-      sha256 = "17sklakn9nsrjajb3nwg8ibhx64c4m86pr6ln567rdr6cahcaw90";
-      name = "kdbusaddons-5.79.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.80/kdbusaddons-5.80.0.tar.xz";
+      sha256 = "1w0vpjzi37z8jaq97p9bxjdl8x4288idm4vvpzxs8lc9hwcl74hl";
+      name = "kdbusaddons-5.80.0.tar.xz";
     };
   };
   kdeclarative = {
-    version = "5.79.0";
+    version = "5.80.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.79/kdeclarative-5.79.0.tar.xz";
-      sha256 = "05b1apviqy3dn2isqxf0bxj86r9q40pjlcqq8y15s36d6ykijyzh";
-      name = "kdeclarative-5.79.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.80/kdeclarative-5.80.0.tar.xz";
+      sha256 = "0gcx6pqyc0izw2cdvdcscxxl4wvksb74kjiq5zimjd2z8wrblmdz";
+      name = "kdeclarative-5.80.0.tar.xz";
     };
   };
   kded = {
-    version = "5.79.0";
+    version = "5.80.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.79/kded-5.79.0.tar.xz";
-      sha256 = "1gyb864rqbdi64mjc165fhcvnsw06z2zi8dg728428nzmw0dysbm";
-      name = "kded-5.79.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.80/kded-5.80.0.tar.xz";
+      sha256 = "0skk3zf3b6rlbvdq0fyd8swfrx3fqmppqxrglh6n5imcv5jxwms1";
+      name = "kded-5.80.0.tar.xz";
     };
   };
   kdelibs4support = {
-    version = "5.79.0";
+    version = "5.80.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.79/portingAids/kdelibs4support-5.79.0.tar.xz";
-      sha256 = "049l0mlf71xan8ls4hkp8s6lrnhn2i22jcnki1d5wci01dgffhm5";
-      name = "kdelibs4support-5.79.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.80/portingAids/kdelibs4support-5.80.0.tar.xz";
+      sha256 = "01bd188iss14qmzm55dmsgdcs9wnwbdj0kh371achp9zqg55iqj3";
+      name = "kdelibs4support-5.80.0.tar.xz";
     };
   };
   kdesignerplugin = {
-    version = "5.79.0";
+    version = "5.80.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.79/portingAids/kdesignerplugin-5.79.0.tar.xz";
-      sha256 = "1jgqr76sx6d3jmqc350k49lqym5jkixnl3dq66430pvlrfv47w2n";
-      name = "kdesignerplugin-5.79.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.80/portingAids/kdesignerplugin-5.80.0.tar.xz";
+      sha256 = "1d79qg3y7ndrh6yd9sygyz5yd5ig6gp8k71mw96xijdhlf5nxqs3";
+      name = "kdesignerplugin-5.80.0.tar.xz";
     };
   };
   kdesu = {
-    version = "5.79.0";
+    version = "5.80.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.79/kdesu-5.79.0.tar.xz";
-      sha256 = "1hlz5pr72qk64gwp30qx92jhlszri5qjsisvl4cxs01ylnrqy0c1";
-      name = "kdesu-5.79.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.80/kdesu-5.80.0.tar.xz";
+      sha256 = "1ksad8wcnjcrb8h73klrs2601482a32x3ycpr17k9fsi8mkylicd";
+      name = "kdesu-5.80.0.tar.xz";
     };
   };
   kdewebkit = {
-    version = "5.79.0";
+    version = "5.80.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.79/portingAids/kdewebkit-5.79.0.tar.xz";
-      sha256 = "0d81p49n2ryig9xp5id1dx4rpjjd2spl78m0xlq6rczyk7yf73pz";
-      name = "kdewebkit-5.79.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.80/portingAids/kdewebkit-5.80.0.tar.xz";
+      sha256 = "11q6x9w2majzh6wva4b824dxrpz53xpb3vfsi65pwh199fhfyzci";
+      name = "kdewebkit-5.80.0.tar.xz";
     };
   };
   kdnssd = {
-    version = "5.79.1";
+    version = "5.80.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.79/kdnssd-5.79.1.tar.xz";
-      sha256 = "160qyll887wblrw0lhax749lzwhlp92sckj4g259955p8gnsw5lp";
-      name = "kdnssd-5.79.1.tar.xz";
+      url = "${mirror}/stable/frameworks/5.80/kdnssd-5.80.0.tar.xz";
+      sha256 = "0k8lk3h65ar07l54cmxhpakz1why9vbm5wg58nh16x69dkdhr8dg";
+      name = "kdnssd-5.80.0.tar.xz";
     };
   };
   kdoctools = {
-    version = "5.79.0";
+    version = "5.80.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.79/kdoctools-5.79.0.tar.xz";
-      sha256 = "03bvj3grjw6a56shdy8c3mdp11pwmc72ccp3ia00bz310ahpphzb";
-      name = "kdoctools-5.79.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.80/kdoctools-5.80.0.tar.xz";
+      sha256 = "10xcq0pk1sqw293f2kw52sjj6dgphv17fdax4w0yy1hjch711bhy";
+      name = "kdoctools-5.80.0.tar.xz";
     };
   };
   kemoticons = {
-    version = "5.79.0";
+    version = "5.80.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.79/kemoticons-5.79.0.tar.xz";
-      sha256 = "04x1yfdcyvx3x4aqha69rsaa78j4iw6qam3hp5a4di0yf653mphp";
-      name = "kemoticons-5.79.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.80/kemoticons-5.80.0.tar.xz";
+      sha256 = "0jg5z6dbfprkypj35prlixgc93x65nn7zcw2fmxcqvshrnqzz2hb";
+      name = "kemoticons-5.80.0.tar.xz";
     };
   };
   kfilemetadata = {
-    version = "5.79.0";
+    version = "5.80.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.79/kfilemetadata-5.79.0.tar.xz";
-      sha256 = "0yxjapq88pfcma82mc9gz03x1bb81xl6xzrinr6jgz09206ra395";
-      name = "kfilemetadata-5.79.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.80/kfilemetadata-5.80.0.tar.xz";
+      sha256 = "02k0yyksyl5nn373l25m6ybxhpdyrz8g0mr16zmk12pdxh24vkbm";
+      name = "kfilemetadata-5.80.0.tar.xz";
     };
   };
   kglobalaccel = {
-    version = "5.79.0";
+    version = "5.80.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.79/kglobalaccel-5.79.0.tar.xz";
-      sha256 = "0qqxvv3m7b44makgdcsxdhzamm4ahm1pn94rn6cpsrqsyci8axy8";
-      name = "kglobalaccel-5.79.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.80/kglobalaccel-5.80.0.tar.xz";
+      sha256 = "015x173b57vdd16mmd4asz6l6bxw94k1hbkxr09v5cb463cspw1n";
+      name = "kglobalaccel-5.80.0.tar.xz";
     };
   };
   kguiaddons = {
-    version = "5.79.0";
+    version = "5.80.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.79/kguiaddons-5.79.0.tar.xz";
-      sha256 = "118wiy3pbmbazfivmh0w2g5l10qcp10b34r3d02pj7rs2a74h05w";
-      name = "kguiaddons-5.79.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.80/kguiaddons-5.80.0.tar.xz";
+      sha256 = "1iadzp794q9qhs1kcvfp2g2w6rv2ifqcb3n8sv460fhv4qrg4qz5";
+      name = "kguiaddons-5.80.0.tar.xz";
     };
   };
   kholidays = {
-    version = "5.79.0";
+    version = "5.80.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.79/kholidays-5.79.0.tar.xz";
-      sha256 = "1lbbq6y1xkffh9qma7hr5hi712kl85kv51gij0mj69ssv1iq2a8n";
-      name = "kholidays-5.79.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.80/kholidays-5.80.0.tar.xz";
+      sha256 = "1knmsz1rzhz5a56q9s0i4747633dq9bhs4j8j6rnk49ccl5hz72z";
+      name = "kholidays-5.80.0.tar.xz";
     };
   };
   khtml = {
-    version = "5.79.0";
+    version = "5.80.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.79/portingAids/khtml-5.79.0.tar.xz";
-      sha256 = "1916kpb3kr0d7lbf0b65lrwkxnlgickm7vrmlc3qwlmf3fyqvkhy";
-      name = "khtml-5.79.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.80/portingAids/khtml-5.80.0.tar.xz";
+      sha256 = "188j1ssw9qlylqgj06iy2r2jbibzshxcxh9qbn1bgz6d2dq2c6mx";
+      name = "khtml-5.80.0.tar.xz";
     };
   };
   ki18n = {
-    version = "5.79.0";
+    version = "5.80.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.79/ki18n-5.79.0.tar.xz";
-      sha256 = "12sa7ycxc7m7nrsm6x7f822c8p586hy0syny5ya8vpmhwk1j3gik";
-      name = "ki18n-5.79.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.80/ki18n-5.80.0.tar.xz";
+      sha256 = "0yksjrcq5zip17kq1r97z2145qzzz6k48vz71y6195f7wvbpjfl8";
+      name = "ki18n-5.80.0.tar.xz";
     };
   };
   kiconthemes = {
-    version = "5.79.0";
+    version = "5.80.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.79/kiconthemes-5.79.0.tar.xz";
-      sha256 = "0bbs8q0dpz4qyxsd1qk5jxazn600m5j2axzccxyrr21r9plbs4nx";
-      name = "kiconthemes-5.79.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.80/kiconthemes-5.80.0.tar.xz";
+      sha256 = "133nv4zgqg6pkkvh1nyqcra847vgn3ai6w0xvynbgrmq7wvdrwlj";
+      name = "kiconthemes-5.80.0.tar.xz";
     };
   };
   kidletime = {
-    version = "5.79.0";
+    version = "5.80.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.79/kidletime-5.79.0.tar.xz";
-      sha256 = "0pp2ii4cvxygz40ai0b3rpqdjgpq4nya2hrms9c3yxb5hizrrrak";
-      name = "kidletime-5.79.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.80/kidletime-5.80.0.tar.xz";
+      sha256 = "1yjjhpkql8s7b4ddzirpyq5p0yicpsbkgbq15257k60xs66qgf83";
+      name = "kidletime-5.80.0.tar.xz";
     };
   };
   kimageformats = {
-    version = "5.79.0";
+    version = "5.80.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.79/kimageformats-5.79.0.tar.xz";
-      sha256 = "09ffc44vzcin2ikyhm0awba7ag7pbnam4cilvfr3lwnj022y7j7c";
-      name = "kimageformats-5.79.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.80/kimageformats-5.80.0.tar.xz";
+      sha256 = "0q3i6jkx6kahgdzfycygki50f22zjbspx3f9ibg2ak74hcan8r8x";
+      name = "kimageformats-5.80.0.tar.xz";
     };
   };
   kinit = {
-    version = "5.79.0";
+    version = "5.80.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.79/kinit-5.79.0.tar.xz";
-      sha256 = "0ppri3gaiwawydjfw8ji6accrpwc8ms0sb1s5pn59wqiyv52f5rv";
-      name = "kinit-5.79.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.80/kinit-5.80.0.tar.xz";
+      sha256 = "101lvky2j6bxk3q36040kczchc21d5rb664ddxd89pl2n0f6s9fz";
+      name = "kinit-5.80.0.tar.xz";
     };
   };
   kio = {
-    version = "5.79.0";
+    version = "5.80.1";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.79/kio-5.79.0.tar.xz";
-      sha256 = "1ri5dv8lc4ywc7jknlszri812y91mgggjx5z5qfkv971njm6fz3n";
-      name = "kio-5.79.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.80/kio-5.80.1.tar.xz";
+      sha256 = "0a2srmj8w80f2m8s359747xx0wg2gf8nd75ysv9f9y92l1hwwwfr";
+      name = "kio-5.80.1.tar.xz";
     };
   };
   kirigami2 = {
-    version = "5.79.0";
+    version = "5.80.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.79/kirigami2-5.79.0.tar.xz";
-      sha256 = "01rb678qz1avzi7393wylwnc13ndzx2pgqnz3bd0zki0pjfrrlzp";
-      name = "kirigami2-5.79.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.80/kirigami2-5.80.0.tar.xz";
+      sha256 = "0wljcyr0g4i5nsc6szy9yd976l180lxfjjzhz24py7czlrpzg3i2";
+      name = "kirigami2-5.80.0.tar.xz";
     };
   };
   kitemmodels = {
-    version = "5.79.0";
+    version = "5.80.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.79/kitemmodels-5.79.0.tar.xz";
-      sha256 = "1g9xa0h3kq0m5v1yvwgr8f6lrq8n2x1qzqqjbbbbyg8ayavv4abs";
-      name = "kitemmodels-5.79.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.80/kitemmodels-5.80.0.tar.xz";
+      sha256 = "1bvghm4accgf273aacjng86rxiazmk05pbrnqkldda9958dqv54k";
+      name = "kitemmodels-5.80.0.tar.xz";
     };
   };
   kitemviews = {
-    version = "5.79.0";
+    version = "5.80.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.79/kitemviews-5.79.0.tar.xz";
-      sha256 = "0p21hyxhain2mr19lzfml23ilpgqwr2i27p1qg39jnwyb74jw0nl";
-      name = "kitemviews-5.79.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.80/kitemviews-5.80.0.tar.xz";
+      sha256 = "1j9m4qcmy83dj3k3v4y4skl5lgb8n3z4x9pa1f0rjpwwg4qsa0lp";
+      name = "kitemviews-5.80.0.tar.xz";
     };
   };
   kjobwidgets = {
-    version = "5.79.0";
+    version = "5.80.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.79/kjobwidgets-5.79.0.tar.xz";
-      sha256 = "059a58hp0npip07w7idjrl5sjjgl4i3bdqzv1k22hlvzdsyibggr";
-      name = "kjobwidgets-5.79.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.80/kjobwidgets-5.80.0.tar.xz";
+      sha256 = "1yy5n9jnj1sdh51n3n1bqzmaml44799kiqdpp3b7mq55fmj9najp";
+      name = "kjobwidgets-5.80.0.tar.xz";
     };
   };
   kjs = {
-    version = "5.79.0";
+    version = "5.80.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.79/portingAids/kjs-5.79.0.tar.xz";
-      sha256 = "1v51xjmwxi1x85b4hlj8m12zxl5w0d160kjjbrrxqfn64i4302ga";
-      name = "kjs-5.79.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.80/portingAids/kjs-5.80.0.tar.xz";
+      sha256 = "1v3jiywzzi20c0pd67pgnwwnz0vg209a0wzzdhrpiz5v7qgji1ij";
+      name = "kjs-5.80.0.tar.xz";
     };
   };
   kjsembed = {
-    version = "5.79.0";
+    version = "5.80.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.79/portingAids/kjsembed-5.79.0.tar.xz";
-      sha256 = "18kjq5mim7b1a5mlhkwpwvnszjqxilhi4laqladh97wkmvsr85py";
-      name = "kjsembed-5.79.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.80/portingAids/kjsembed-5.80.0.tar.xz";
+      sha256 = "083gp9ks7yha90vnk0z4bkb9i4rphz90di8m8z19xgn575a6li57";
+      name = "kjsembed-5.80.0.tar.xz";
     };
   };
   kmediaplayer = {
-    version = "5.79.0";
+    version = "5.80.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.79/portingAids/kmediaplayer-5.79.0.tar.xz";
-      sha256 = "1lgrcib9acbzgs1kv44bqfisrayiir2r1iygrrncp117fj9cqx8b";
-      name = "kmediaplayer-5.79.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.80/portingAids/kmediaplayer-5.80.0.tar.xz";
+      sha256 = "0a16rzyjy7j5pn66ahpj3kxpp5c2zmjxg3cmrm14gcm6gzysv56b";
+      name = "kmediaplayer-5.80.0.tar.xz";
     };
   };
   knewstuff = {
-    version = "5.79.0";
+    version = "5.80.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.79/knewstuff-5.79.0.tar.xz";
-      sha256 = "0bsg0r0s12ck2cafkvnmjldr32ykivcpqjs1zfzqqbvy5w05a81y";
-      name = "knewstuff-5.79.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.80/knewstuff-5.80.0.tar.xz";
+      sha256 = "0pbk4j823zs2xikgdhaxqilb5b6f0a8k8hylq1vyhkwlzvvp9s6z";
+      name = "knewstuff-5.80.0.tar.xz";
     };
   };
   knotifications = {
-    version = "5.79.0";
+    version = "5.80.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.79/knotifications-5.79.0.tar.xz";
-      sha256 = "11g4xsa0z9680k4blxb1axn874p6s2vd5p9h376ln3blhjmy17hj";
-      name = "knotifications-5.79.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.80/knotifications-5.80.0.tar.xz";
+      sha256 = "1sfn61vhdqg3mxfvb802wx0l0k59b312fbh6w9bqv0b8z0a9jz2s";
+      name = "knotifications-5.80.0.tar.xz";
     };
   };
   knotifyconfig = {
-    version = "5.79.0";
+    version = "5.80.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.79/knotifyconfig-5.79.0.tar.xz";
-      sha256 = "0c6d95bf8876czjd39cla7pd3li8sm684h04f77czf6sh1mil49d";
-      name = "knotifyconfig-5.79.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.80/knotifyconfig-5.80.0.tar.xz";
+      sha256 = "0b41ppif2qp7lkqmb7nv1r68hvavdl1lcgs4w50v2c0k4fflwizx";
+      name = "knotifyconfig-5.80.0.tar.xz";
     };
   };
   kpackage = {
-    version = "5.79.0";
+    version = "5.80.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.79/kpackage-5.79.0.tar.xz";
-      sha256 = "1xkkw4lk9hx2irni5d2k7873bffgd2w41qvvp25d786dz612fy27";
-      name = "kpackage-5.79.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.80/kpackage-5.80.0.tar.xz";
+      sha256 = "104qwyai3ivdw0jqgn6m59bajy07snas51rp75xgvb65hpllv2ch";
+      name = "kpackage-5.80.0.tar.xz";
     };
   };
   kparts = {
-    version = "5.79.0";
+    version = "5.80.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.79/kparts-5.79.0.tar.xz";
-      sha256 = "0d9dsgf6q44gqril6h9w5jfsavk0m5gclbmjdxjkcvrz3xfbjhd9";
-      name = "kparts-5.79.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.80/kparts-5.80.0.tar.xz";
+      sha256 = "1fkfjazr7bwh5nniylh403qp0g4bgiv01ckv4djf46gjf7qn9d4y";
+      name = "kparts-5.80.0.tar.xz";
     };
   };
   kpeople = {
-    version = "5.79.0";
+    version = "5.80.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.79/kpeople-5.79.0.tar.xz";
-      sha256 = "0dj8hcjl0r673j7m2k83mxy2787jfi9pz6cvmfqfczbzpw20ycf4";
-      name = "kpeople-5.79.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.80/kpeople-5.80.0.tar.xz";
+      sha256 = "1cn9jqiah3j0qi7sg1j9c10yq97pcisvxhm9jjzzzxna39zz16cw";
+      name = "kpeople-5.80.0.tar.xz";
     };
   };
   kplotting = {
-    version = "5.79.0";
+    version = "5.80.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.79/kplotting-5.79.0.tar.xz";
-      sha256 = "0lawpg7i36wppm95jxhhc7ghc88kb1s34px6w8p7n6cm2gxkhwn6";
-      name = "kplotting-5.79.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.80/kplotting-5.80.0.tar.xz";
+      sha256 = "073icgz0cgg7wis3rf1hlsmxklp9vk8swgihfdlks1jds90s4nxw";
+      name = "kplotting-5.80.0.tar.xz";
     };
   };
   kpty = {
-    version = "5.79.0";
+    version = "5.80.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.79/kpty-5.79.0.tar.xz";
-      sha256 = "1qd09r17nmsnqxggmsdw0j6l0620f11ya6mx7bc9zs2y08mgvjka";
-      name = "kpty-5.79.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.80/kpty-5.80.0.tar.xz";
+      sha256 = "13blnrzni3n9p3xnn2kyd6g2hlpvvg0aqagknk64kchbvdkd5l4k";
+      name = "kpty-5.80.0.tar.xz";
     };
   };
   kquickcharts = {
-    version = "5.79.0";
+    version = "5.80.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.79/kquickcharts-5.79.0.tar.xz";
-      sha256 = "1p9a3mq7xxyavzmgjmz47vrv0hm1h9g8fsligi3r3n5az7klra6f";
-      name = "kquickcharts-5.79.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.80/kquickcharts-5.80.0.tar.xz";
+      sha256 = "0kf72i9pkifcwg9njn296fw4d9gy3rc43g17128axj6a5jrd4bln";
+      name = "kquickcharts-5.80.0.tar.xz";
     };
   };
   kross = {
-    version = "5.79.0";
+    version = "5.80.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.79/portingAids/kross-5.79.0.tar.xz";
-      sha256 = "00hpyxcn2fwaz32gggqjcmx4blbcdxj3yvhldnmmkmi3k0r68dfc";
-      name = "kross-5.79.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.80/portingAids/kross-5.80.0.tar.xz";
+      sha256 = "06dyqmhxbr9ykca1bskkgxmsd86jpxnk4adygcw1j84xsl6jiki9";
+      name = "kross-5.80.0.tar.xz";
     };
   };
   krunner = {
-    version = "5.79.0";
+    version = "5.80.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.79/krunner-5.79.0.tar.xz";
-      sha256 = "0v7faai6ar06cw7gikhccsa92aii085dk81g4xpyskmxlpvrraci";
-      name = "krunner-5.79.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.80/krunner-5.80.0.tar.xz";
+      sha256 = "0bid6h0wmvmxfz664hmfhs4zp35mlk3n1p553rspfs55wh2f9xpw";
+      name = "krunner-5.80.0.tar.xz";
     };
   };
   kservice = {
-    version = "5.79.0";
+    version = "5.80.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.79/kservice-5.79.0.tar.xz";
-      sha256 = "1drzj4s1zbh5pffnh3r1wjsk7g1vr0np2h28mlfm4hy3bywxzrnp";
-      name = "kservice-5.79.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.80/kservice-5.80.0.tar.xz";
+      sha256 = "06bk46l3qg7dh57zsg9vwx8vq31ikjmbmy4nqn65mq786yiz4s78";
+      name = "kservice-5.80.0.tar.xz";
     };
   };
   ktexteditor = {
-    version = "5.79.0";
+    version = "5.80.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.79/ktexteditor-5.79.0.tar.xz";
-      sha256 = "1csms6cl8pp9slzwzdgsxhah1b218maakkxmiqk0ngx2sf4lbfc3";
-      name = "ktexteditor-5.79.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.80/ktexteditor-5.80.0.tar.xz";
+      sha256 = "0g073m18bpzhxdwzhqcyclsclwi91cqsjqq3fjz1hy56ird6b0d0";
+      name = "ktexteditor-5.80.0.tar.xz";
     };
   };
   ktextwidgets = {
-    version = "5.79.0";
+    version = "5.80.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.79/ktextwidgets-5.79.0.tar.xz";
-      sha256 = "1bnhq4jpybckdlw5518n2hbfilbpadafvchnxigg9p7671pkp85l";
-      name = "ktextwidgets-5.79.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.80/ktextwidgets-5.80.0.tar.xz";
+      sha256 = "1292knr3wblbk5j3qfzr1lqyiaa09pkhvkmh3jnlb0jvhc8xvmg8";
+      name = "ktextwidgets-5.80.0.tar.xz";
     };
   };
   kunitconversion = {
-    version = "5.79.0";
+    version = "5.80.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.79/kunitconversion-5.79.0.tar.xz";
-      sha256 = "19snm2mvvbs2aqpq7k9b3g1fbg40kpmbjmqn38g6m065mpw3372l";
-      name = "kunitconversion-5.79.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.80/kunitconversion-5.80.0.tar.xz";
+      sha256 = "1hckj3k3jjsc4y89zvi5l9h6px6ns9kdqjrfkxbax459wha55b4l";
+      name = "kunitconversion-5.80.0.tar.xz";
     };
   };
   kwallet = {
-    version = "5.79.0";
+    version = "5.80.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.79/kwallet-5.79.0.tar.xz";
-      sha256 = "1qickn20ry8qccirdc7rvdf40dxgb13y4n0wi80qz87xzmps3f3p";
-      name = "kwallet-5.79.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.80/kwallet-5.80.0.tar.xz";
+      sha256 = "1pwrxhjxxdx7hl4456dk4x8z36ddw932cv08010fmz9m4w0yvjg1";
+      name = "kwallet-5.80.0.tar.xz";
     };
   };
   kwayland = {
-    version = "5.79.0";
+    version = "5.80.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.79/kwayland-5.79.0.tar.xz";
-      sha256 = "14grhcav772zfdjmwnjms819by2djm8dnv71cj4ps45iq0gba6ck";
-      name = "kwayland-5.79.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.80/kwayland-5.80.0.tar.xz";
+      sha256 = "1avr7ckyhw158wi5mlknzkcphn8vlf8dpb96gyizvsvg8b4gffs0";
+      name = "kwayland-5.80.0.tar.xz";
     };
   };
   kwidgetsaddons = {
-    version = "5.79.0";
+    version = "5.80.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.79/kwidgetsaddons-5.79.0.tar.xz";
-      sha256 = "0jpfwxa397cvqr1q92b2nva7wy2ngv08kz5l94xrz0wzkagxfixc";
-      name = "kwidgetsaddons-5.79.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.80/kwidgetsaddons-5.80.0.tar.xz";
+      sha256 = "1wgwl08cxwzcd0nikvp2ph2dbj5fij6a5l65p9amvi6ladbgv6qs";
+      name = "kwidgetsaddons-5.80.0.tar.xz";
     };
   };
   kwindowsystem = {
-    version = "5.79.0";
+    version = "5.80.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.79/kwindowsystem-5.79.0.tar.xz";
-      sha256 = "15pi2vnvdchj9f3yp1p7hqxmnwd606a6fwq4h7li4pvb4w3gibmq";
-      name = "kwindowsystem-5.79.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.80/kwindowsystem-5.80.0.tar.xz";
+      sha256 = "1ch44w27ilh994if3icskyqg6nhnbd5j430jxfj6fzfia9vvclmk";
+      name = "kwindowsystem-5.80.0.tar.xz";
     };
   };
   kxmlgui = {
-    version = "5.79.0";
+    version = "5.80.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.79/kxmlgui-5.79.0.tar.xz";
-      sha256 = "1j8fb5i1v7pqs5as1h43nc0s2pm3i9cwks2h5388yld325ysx0v9";
-      name = "kxmlgui-5.79.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.80/kxmlgui-5.80.0.tar.xz";
+      sha256 = "17dpcv2igkg1pk238bd396mn83nqp325sscx7qsf8cbj15dp7bw1";
+      name = "kxmlgui-5.80.0.tar.xz";
     };
   };
   kxmlrpcclient = {
-    version = "5.79.0";
+    version = "5.80.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.79/portingAids/kxmlrpcclient-5.79.0.tar.xz";
-      sha256 = "1cwvglsfv5m3mb5bjl7rfas1samyw703qjfiz1pf6vxgmpxdcr4a";
-      name = "kxmlrpcclient-5.79.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.80/portingAids/kxmlrpcclient-5.80.0.tar.xz";
+      sha256 = "0aas26kjxsbgrrrazjvsvjqdr9993v2hyxci62mfpi7xsp5js4h4";
+      name = "kxmlrpcclient-5.80.0.tar.xz";
     };
   };
   modemmanager-qt = {
-    version = "5.79.0";
+    version = "5.80.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.79/modemmanager-qt-5.79.0.tar.xz";
-      sha256 = "0xfbchyaaqxjj66zb19k4vxi9azijf0llbql6fzxln687s3z65wd";
-      name = "modemmanager-qt-5.79.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.80/modemmanager-qt-5.80.0.tar.xz";
+      sha256 = "1q14hx2228xhlggw14r9mhmnn2q3qvy3nc9hq5ynb9mwldns6nl6";
+      name = "modemmanager-qt-5.80.0.tar.xz";
     };
   };
   networkmanager-qt = {
-    version = "5.79.0";
+    version = "5.80.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.79/networkmanager-qt-5.79.0.tar.xz";
-      sha256 = "04iaqa2q73zvscx300bah6mnl79dai9yrmq11d1vyil99af36m6s";
-      name = "networkmanager-qt-5.79.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.80/networkmanager-qt-5.80.0.tar.xz";
+      sha256 = "1wdzn2n4m7nz6skjc37p70zaq42ighk5f1wg1hjx3yf3rlpprnp0";
+      name = "networkmanager-qt-5.80.0.tar.xz";
     };
   };
   oxygen-icons5 = {
-    version = "5.79.0";
+    version = "5.80.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.79/oxygen-icons5-5.79.0.tar.xz";
-      sha256 = "1j6l9r4l82gp5qcpn3xw4dzfbhsawbpk8mypnfckk73x1bjcaqss";
-      name = "oxygen-icons5-5.79.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.80/oxygen-icons5-5.80.0.tar.xz";
+      sha256 = "0kmq993vd6011qny949z13lli4qymprk616kl1628dazniapka9m";
+      name = "oxygen-icons5-5.80.0.tar.xz";
     };
   };
   plasma-framework = {
-    version = "5.79.0";
+    version = "5.80.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.79/plasma-framework-5.79.0.tar.xz";
-      sha256 = "15hbfqdyas27kj6rd24n6d80r1dcsiiv0zgjkp12x8dnjyd3vz4x";
-      name = "plasma-framework-5.79.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.80/plasma-framework-5.80.0.tar.xz";
+      sha256 = "1nckb1801fy64hvm127r5fz14vgw81szw7w7miilqh6651v0zbyk";
+      name = "plasma-framework-5.80.0.tar.xz";
     };
   };
   prison = {
-    version = "5.79.0";
+    version = "5.80.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.79/prison-5.79.0.tar.xz";
-      sha256 = "1rn66n67g914w1klgsirqff62qv4p2l64ahzsxnbixfwy1dwlpa2";
-      name = "prison-5.79.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.80/prison-5.80.0.tar.xz";
+      sha256 = "1fcsvww08f7ihxq6x84jd2klp29m8hrbzp7rxqi7x9ghxxgysbpz";
+      name = "prison-5.80.0.tar.xz";
     };
   };
   purpose = {
-    version = "5.79.0";
+    version = "5.80.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.79/purpose-5.79.0.tar.xz";
-      sha256 = "1mlph5mzwfqwlkvm3df3in3r3airnx4hxhy0p56ri3k3m9k2rqpz";
-      name = "purpose-5.79.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.80/purpose-5.80.0.tar.xz";
+      sha256 = "107xmhbjcw5mk068484gwqrzl2gkgy495737f4vj5q22m9rpal5d";
+      name = "purpose-5.80.0.tar.xz";
     };
   };
   qqc2-desktop-style = {
-    version = "5.79.0";
+    version = "5.80.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.79/qqc2-desktop-style-5.79.0.tar.xz";
-      sha256 = "1cykbdbzxkblwp0dmgc4r3csml9l81zhfsqcjamfai6srl10vbij";
-      name = "qqc2-desktop-style-5.79.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.80/qqc2-desktop-style-5.80.0.tar.xz";
+      sha256 = "14dy7n6m9vdq6v7h3r0w71vw86yxyza40wyxp0hhj44nb63fvczg";
+      name = "qqc2-desktop-style-5.80.0.tar.xz";
     };
   };
   solid = {
-    version = "5.79.0";
+    version = "5.80.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.79/solid-5.79.0.tar.xz";
-      sha256 = "033ss326q450phf918a5py3z6ajnjj6f1nws8ngp05zi028nkhrl";
-      name = "solid-5.79.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.80/solid-5.80.0.tar.xz";
+      sha256 = "023zk7la6ycd7h2j62z7b409w94sq2r9k0c020ywry6psjydqkx5";
+      name = "solid-5.80.0.tar.xz";
     };
   };
   sonnet = {
-    version = "5.79.0";
+    version = "5.80.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.79/sonnet-5.79.0.tar.xz";
-      sha256 = "09b1rb88ck50g67nmki06ixxsfnz3x3jd0f334qaz147h2jklvyq";
-      name = "sonnet-5.79.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.80/sonnet-5.80.0.tar.xz";
+      sha256 = "13kqdfy6bgmqjfw82d2zh0bq4r53awa1f1cbshci6inwdslyvlmh";
+      name = "sonnet-5.80.0.tar.xz";
     };
   };
   syndication = {
-    version = "5.79.0";
+    version = "5.80.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.79/syndication-5.79.0.tar.xz";
-      sha256 = "1jyz0c67zscgspvisn43wrdgk4pxs4i3r9pyknm8nvxwiff2p1ji";
-      name = "syndication-5.79.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.80/syndication-5.80.0.tar.xz";
+      sha256 = "1j22yx2i2qxck6gy4jypjvmar4y93j5nmrmf7fkjx7z8hwxjgwhh";
+      name = "syndication-5.80.0.tar.xz";
     };
   };
   syntax-highlighting = {
-    version = "5.79.1";
+    version = "5.80.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.79/syntax-highlighting-5.79.1.tar.xz";
-      sha256 = "143ra8j0x1biijclnjhp6b69v04m65avp2nic9jzj9y5wjz5x0mj";
-      name = "syntax-highlighting-5.79.1.tar.xz";
+      url = "${mirror}/stable/frameworks/5.80/syntax-highlighting-5.80.0.tar.xz";
+      sha256 = "060jnfri24rzkryyvxadpr3yn5xn0856j01ba5l38w0khs8mix4i";
+      name = "syntax-highlighting-5.80.0.tar.xz";
     };
   };
   threadweaver = {
-    version = "5.79.0";
+    version = "5.80.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.79/threadweaver-5.79.0.tar.xz";
-      sha256 = "062r9nhggw3dlvgpb2l6fqyyzqv35a9lgvikh2pjdicx9r2s8z19";
-      name = "threadweaver-5.79.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.80/threadweaver-5.80.0.tar.xz";
+      sha256 = "1j5m8gfjpi9cajhja77lhkrl3shq618wpza1k27azvi7r6jj4dva";
+      name = "threadweaver-5.80.0.tar.xz";
     };
   };
 }
diff --git a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/syndication.nix b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/syndication.nix
index 71ee520995..fd5a9b9db8 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/syndication.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/syndication.nix
@@ -5,9 +5,7 @@
 
 mkDerivation {
   name = "syndication";
-  meta = {
-    maintainers = [ lib.maintainers.bkchr ];
-  };
+  meta.maintainers = [ lib.maintainers.bkchr ];
   nativeBuildInputs = [ extra-cmake-modules ];
   buildInputs = [ kcodecs ];
 }
diff --git a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/syntax-highlighting.nix b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/syntax-highlighting.nix
index 4b3f8440c5..a295b23f32 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/syntax-highlighting.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/syntax-highlighting.nix
@@ -1,13 +1,9 @@
-{ mkDerivation, lib
+{ mkDerivation
 , extra-cmake-modules, perl, qtbase, qttools
 }:
 
 mkDerivation {
   name = "syntax-highlighting";
-  meta = {
-    maintainers = [ lib.maintainers.ttuegel ];
-    broken = builtins.compareVersions qtbase.version "5.14.0" < 0;
-  };
   nativeBuildInputs = [ extra-cmake-modules perl ];
   buildInputs = [ qttools ];
   propagatedBuildInputs = [ qtbase ];
diff --git a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/threadweaver.nix b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/threadweaver.nix
index 70e948afda..bfa529c926 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/threadweaver.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/kde-frameworks/threadweaver.nix
@@ -1,15 +1,11 @@
 {
-  mkDerivation, lib,
+  mkDerivation,
   extra-cmake-modules,
   qtbase
 }:
 
 mkDerivation {
   name = "threadweaver";
-  meta = {
-    maintainers = [ lib.maintainers.ttuegel ];
-    broken = builtins.compareVersions qtbase.version "5.14.0" < 0;
-  };
   nativeBuildInputs = [ extra-cmake-modules ];
   propagatedBuildInputs = [ qtbase ];
   outputs = [ "out" "dev" ];
diff --git a/third_party/nixpkgs/pkgs/development/libraries/libchewing/default.nix b/third_party/nixpkgs/pkgs/development/libraries/libchewing/default.nix
index 1436d4bd59..c6b7841ca4 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/libchewing/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/libchewing/default.nix
@@ -1,20 +1,24 @@
-{ lib, stdenv, fetchurl, sqlite }:
+{ lib, stdenv, fetchFromGitHub, sqlite, cmake }:
 
 stdenv.mkDerivation rec {
   pname = "libchewing";
-  version = "0.5.1";
+  version = "unstable-2020-06-27";
 
-  src = fetchurl {
-    url = "https://github.com/chewing/libchewing/releases/download/v${version}/libchewing-${version}.tar.bz2";
-    sha256 = "0aqp2vqgxczydpn7pxi7r6xf3l1hgl710f0gbi1k8q7s2lscc24p";
+  src = fetchFromGitHub {
+    owner = "chewing";
+    repo = "libchewing";
+    rev = "452f6221fbad90c0706a3963b17e226216e40dd7";
+    sha256 = "sha256-w3/K2O/CU+XVzqzVCYJyq1vLgToN6iIUhJ9J7ia4p9E=";
   };
 
   buildInputs = [ sqlite ];
 
+  nativeBuildInputs = [ cmake ];
+
   meta = with lib; {
     description = "Intelligent Chinese phonetic input method";
     homepage = "http://chewing.im/";
-    license = licenses.lgpl21;
+    license = licenses.lgpl21Only;
     maintainers = [ maintainers.ericsagnes ];
     platforms = platforms.linux;
   };
diff --git a/third_party/nixpkgs/pkgs/development/libraries/libdrm/default.nix b/third_party/nixpkgs/pkgs/development/libraries/libdrm/default.nix
index b4ba311165..b7fd94f9f1 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/libdrm/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/libdrm/default.nix
@@ -5,11 +5,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libdrm";
-  version = "2.4.104";
+  version = "2.4.105";
 
   src = fetchurl {
     url = "https://dri.freedesktop.org/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "1jqvx9c23hgwhq109zqj6vg3ng40pcvh3r1k2fn1a424qasxhsnn";
+    sha256 = "0iiamypwdfiz250ki120nh598r48yyacmnndb4mkximdgi5h478x";
   };
 
   outputs = [ "out" "dev" "bin" ];
@@ -20,12 +20,6 @@ stdenv.mkDerivation rec {
 
   patches = [ ./cross-build-nm-path.patch ];
 
-  postPatch = ''
-    for a in */*-symbol-check ; do
-      patchShebangs $a
-    done
-  '';
-
   mesonFlags = [
     "-Dnm-path=${stdenv.cc.targetPrefix}nm"
     "-Dinstall-test-programs=true"
diff --git a/third_party/nixpkgs/pkgs/development/libraries/libquotient/default.nix b/third_party/nixpkgs/pkgs/development/libraries/libquotient/default.nix
index 5405391a1e..f4fe894eaf 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/libquotient/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/libquotient/default.nix
@@ -16,7 +16,7 @@ mkDerivation rec {
   nativeBuildInputs = [ cmake ];
 
   meta = with lib; {
-    description = "A Qt5 library to write cross-platfrom clients for Matrix";
+    description = "A Qt5 library to write cross-platform clients for Matrix";
     homepage = "https://matrix.org/docs/projects/sdk/quotient";
     license = licenses.lgpl21;
     maintainers = with maintainers; [ colemickens ];
diff --git a/third_party/nixpkgs/pkgs/development/libraries/libvpx/default.nix b/third_party/nixpkgs/pkgs/development/libraries/libvpx/default.nix
index 5aa8cf7049..f191839661 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/libvpx/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/libvpx/default.nix
@@ -56,13 +56,13 @@ assert isCygwin -> unitTestsSupport && webmIOSupport && libyuvSupport;
 
 stdenv.mkDerivation rec {
   pname = "libvpx";
-  version = "1.9.0";
+  version = "1.10.0";
 
   src = fetchFromGitHub {
     owner = "webmproject";
     repo = pname;
     rev = "v${version}";
-    sha256 = "16xv6ambc82g14h1y0q1vyy57wp6j9fbp0nk0wd5csnrw407rhry";
+    sha256 = "sha256-EZP33U10fchyqy7Jr26vHgUUfWR6xtG3fcMWUII0m9w=";
   };
 
   postPatch = "patchShebangs .";
diff --git a/third_party/nixpkgs/pkgs/development/libraries/libxkbcommon/default.nix b/third_party/nixpkgs/pkgs/development/libraries/libxkbcommon/default.nix
index d6e8b3958e..8c37bb0c17 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/libxkbcommon/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/libxkbcommon/default.nix
@@ -8,19 +8,16 @@
 
 stdenv.mkDerivation rec {
   pname = "libxkbcommon";
-  version = "1.1.0";
+  version = "1.2.1";
 
   src = fetchurl {
     url = "https://xkbcommon.org/download/${pname}-${version}.tar.xz";
-    sha256 = "0in2fq2x4yhyjmcn9n5n43zsawsdh12d4sm6l57934kgb75gqb21";
+    sha256 = "1cqzd4vd5jw3ghibmdqvy90mb1h8vvazc81bxgavk6sc0b9sfcz8";
   };
 
-  patches = [
-    ./fix-cross-compilation.patch
-  ];
-
   outputs = [ "out" "dev" "doc" ];
 
+  depsBuildBuild = [ pkg-config ];
   nativeBuildInputs = [ meson ninja pkg-config bison doxygen ]
     ++ lib.optional withWaylandSupport wayland;
   buildInputs = [ xkeyboard_config libxcb libxml2 ]
diff --git a/third_party/nixpkgs/pkgs/development/libraries/libxkbcommon/fix-cross-compilation.patch b/third_party/nixpkgs/pkgs/development/libraries/libxkbcommon/fix-cross-compilation.patch
deleted file mode 100644
index 55730554a9..0000000000
--- a/third_party/nixpkgs/pkgs/development/libraries/libxkbcommon/fix-cross-compilation.patch
+++ /dev/null
@@ -1,20 +0,0 @@
-diff --git a/meson.build b/meson.build
-index 47c436f..536c60b 100644
---- a/meson.build
-+++ b/meson.build
-@@ -440,13 +440,12 @@ if build_tools
-     if get_option('enable-wayland')
-         wayland_client_dep = dependency('wayland-client', version: '>=1.2.0', required: false)
-         wayland_protocols_dep = dependency('wayland-protocols', version: '>=1.12', required: false)
--        wayland_scanner_dep = dependency('wayland-scanner', required: false, native: true)
--        if not wayland_client_dep.found() or not wayland_protocols_dep.found() or not wayland_scanner_dep.found()
-+        if not wayland_client_dep.found() or not wayland_protocols_dep.found()
-             error('''The Wayland xkbcli programs require wayland-client >= 1.2.0, wayland-protocols >= 1.7 which were not found.
- You can disable the Wayland xkbcli programs with -Denable-wayland=false.''')
-         endif
- 
--        wayland_scanner = find_program(wayland_scanner_dep.get_pkgconfig_variable('wayland_scanner'))
-+        wayland_scanner = find_program('wayland-scanner', native: true)
-         wayland_scanner_code_gen = generator(
-             wayland_scanner,
-             output: '@BASENAME@-protocol.c',
diff --git a/third_party/nixpkgs/pkgs/development/libraries/libzip/default.nix b/third_party/nixpkgs/pkgs/development/libraries/libzip/default.nix
index ddefa16c2c..a3f7f3ef5f 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/libzip/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/libzip/default.nix
@@ -4,6 +4,13 @@
 , fetchurl
 , perl
 , zlib
+, groff
+, withBzip2 ? false
+, bzip2
+, withLZMA ? false
+, xz
+, withOpenssl ? false
+, openssl
 }:
 
 stdenv.mkDerivation rec {
@@ -11,7 +18,7 @@ stdenv.mkDerivation rec {
   version = "1.7.3";
 
   src = fetchurl {
-    url = "https://www.nih.at/libzip/${pname}-${version}.tar.gz";
+    url = "https://libzip.org/download/${pname}-${version}.tar.gz";
     sha256 = "1k5rihiz7m1ahhjzcbq759hb9crzqkgw78pkxga118y5a32pc8hf";
   };
 
@@ -23,10 +30,13 @@ stdenv.mkDerivation rec {
     })
   ];
 
-  outputs = [ "out" "dev" ];
+  outputs = [ "out" "dev" "man" ];
 
-  nativeBuildInputs = [ cmake perl ];
+  nativeBuildInputs = [ cmake perl groff ];
   propagatedBuildInputs = [ zlib ];
+  buildInputs = lib.optionals withLZMA [ xz ]
+    ++ lib.optionals withBzip2 [ bzip2 ]
+    ++ lib.optionals withOpenssl [ openssl ];
 
   preCheck = ''
     # regress/runtest is a generated file
@@ -34,9 +44,10 @@ stdenv.mkDerivation rec {
   '';
 
   meta = with lib; {
-    homepage = "https://www.nih.at/libzip";
+    homepage = "https://libzip.org/";
     description = "A C library for reading, creating and modifying zip archives";
     license = licenses.bsd3;
     platforms = platforms.unix;
+    changelog = "https://github.com/nih-at/libzip/blob/v${version}/NEWS.md";
   };
 }
diff --git a/third_party/nixpkgs/pkgs/development/libraries/mesa/default.nix b/third_party/nixpkgs/pkgs/development/libraries/mesa/default.nix
index 397ae4227f..1186882aa8 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/mesa/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/mesa/default.nix
@@ -34,9 +34,8 @@ let
   # Release frequency: https://www.mesa3d.org/releasing.html#schedule
   version = "21.0.1";
   branch  = versions.major version;
-in
 
-stdenv.mkDerivation {
+self = stdenv.mkDerivation {
   pname = "mesa";
   inherit version;
 
@@ -88,7 +87,9 @@ stdenv.mkDerivation {
       "find_program('${stdenv.cc.targetPrefix}nm')"
   '';
 
-  outputs = [ "out" "dev" "drivers" ] ++ lib.optional enableOSMesa "osmesa";
+  outputs = [ "out" "dev" "drivers" ]
+    ++ lib.optional enableOSMesa "osmesa"
+    ++ lib.optional stdenv.isLinux "driversdev";
 
   # TODO: Figure out how to enable opencl without having a runtime dependency on clang
   mesonFlags = [
@@ -181,20 +182,22 @@ stdenv.mkDerivation {
     mv -t $osmesa/lib/ $out/lib/libOSMesa*
   '';
 
-  # TODO:
-  #  check $out doesn't depend on llvm: builder failures are ignored
-  #  for some reason grep -qv '${llvmPackages.llvm}' -R "$out";
   postFixup = optionalString stdenv.isLinux ''
     # set the default search path for DRI drivers; used e.g. by X server
     substituteInPlace "$dev/lib/pkgconfig/dri.pc" --replace "$drivers" "${libglvnd.driverLink}"
+    substituteInPlace "$dev/lib/pkgconfig/d3d.pc" --replace "$drivers" "${libglvnd.driverLink}"
 
     # remove pkgconfig files for GL/EGL; they are provided by libGL.
     rm -f $dev/lib/pkgconfig/{gl,egl}.pc
 
-    # Update search path used by pkg-config
-    for pc in $dev/lib/pkgconfig/{d3d,dri,xatracker}.pc; do
-      if [ -f "$pc" ]; then
-        substituteInPlace "$pc" --replace $out $drivers
+    # Move development files for libraries in $drivers to $driversdev
+    mkdir -p $driversdev/include
+    mv $dev/include/xa_* $dev/include/d3d* $driversdev/include
+    mkdir -p $driversdev/lib/pkgconfig
+    for pc in lib/pkgconfig/{xatracker,d3d}.pc; do
+      if [ -f "$dev/$pc" ]; then
+        substituteInPlace "$dev/$pc" --replace $out $drivers
+        mv $dev/$pc $driversdev/$pc
       fi
     done
 
@@ -212,6 +215,14 @@ stdenv.mkDerivation {
   passthru = {
     inherit libdrm;
     inherit (libglvnd) driverLink;
+
+    tests.devDoesNotDependOnLLVM = stdenv.mkDerivation {
+      name = "mesa-dev-does-not-depend-on-llvm";
+      buildCommand = ''
+        echo ${self.dev} >>$out
+      '';
+      disallowedRequisites = [ llvmPackages.llvm self.drivers ];
+    };
   };
 
   meta = {
@@ -231,4 +242,6 @@ stdenv.mkDerivation {
     platforms = platforms.mesaPlatforms;
     maintainers = with maintainers; [ primeos vcunat ]; # Help is welcome :)
   };
-}
+};
+
+in self
diff --git a/third_party/nixpkgs/pkgs/development/libraries/mesa/stubs.nix b/third_party/nixpkgs/pkgs/development/libraries/mesa/stubs.nix
index a53f2dc28e..753ad1b919 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/mesa/stubs.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/mesa/stubs.nix
@@ -52,7 +52,7 @@ stdenv.mkDerivation {
 
     mkdir -p $dev/{,lib/pkgconfig,nix-support}
     echo "$out ${libglvnd} ${libglvnd.dev}" > $dev/nix-support/propagated-build-inputs
-    ln -s ${mesa.dev}/include $dev/include
+    ln -s ${libglvnd.dev}/include $dev/include
 
     genPkgConfig() {
       local name="$1"
@@ -61,9 +61,9 @@ stdenv.mkDerivation {
       cat <<EOF >$dev/lib/pkgconfig/$name.pc
     Name: $name
     Description: $lib library
-    Version: ${mesa.version}
+    Version: ${libglvnd.version}
     Libs: -L${libglvnd.out}/lib -l$lib
-    Cflags: -I${mesa.dev}/include -I${libglvnd.dev}/include
+    Cflags: -I${libglvnd.dev}/include
     EOF
     }
 
diff --git a/third_party/nixpkgs/pkgs/development/libraries/mpfi/default.nix b/third_party/nixpkgs/pkgs/development/libraries/mpfi/default.nix
index 399c5416d7..db36ed38a9 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/mpfi/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/mpfi/default.nix
@@ -1,16 +1,24 @@
-{lib, stdenv, fetchurl, mpfr}:
+{lib, stdenv, fetchurl, autoconf, automake, libtool, texinfo, mpfr}:
 stdenv.mkDerivation rec {
   pname = "mpfi";
   version = "1.5.4";
-  file_nr = "37331";
+  file_nr = "38111";
+
   src = fetchurl {
     # NOTE: the file_nr is whats important here. The actual package name (including the version)
     # is ignored. To find out the correct file_nr, go to https://gforge.inria.fr/projects/mpfi/
     # and click on Download in the section "Latest File Releases".
-    url = "https://gforge.inria.fr/frs/download.php/file/${file_nr}/mpfi-${version}.tar.bz2";
-    sha256 = "sha256-I4PUV7IIxs088uZracTOR0d7Kg2zH77AzUseuqJHGS8=";
+    url = "https://gforge.inria.fr/frs/download.php/file/${file_nr}/mpfi-${version}.tgz";
+    sha256 = "sha256-Ozk4WV1yCvF5c96vcnz8DdQcixbCCtwQOpcPSkOuOlY=";
   };
-  buildInputs = [mpfr];
+
+  nativeBuildInputs = [ autoconf automake libtool texinfo ];
+  buildInputs = [ mpfr ];
+
+  preConfigure = ''
+    ./autogen.sh
+  '';
+
   meta = {
     inherit version;
     description = "A multiple precision interval arithmetic library based on MPFR";
diff --git a/third_party/nixpkgs/pkgs/development/libraries/nghttp2/default.nix b/third_party/nixpkgs/pkgs/development/libraries/nghttp2/default.nix
index 6464679b94..86edacc616 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/nghttp2/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/nghttp2/default.nix
@@ -27,11 +27,11 @@ let inherit (lib) optional optionals optionalString; in
 
 stdenv.mkDerivation rec {
   pname = "nghttp2";
-  version = "1.41.0";
+  version = "1.43.0";
 
   src = fetchurl {
     url = "https://github.com/${pname}/${pname}/releases/download/v${version}/${pname}-${version}.tar.bz2";
-    sha256 = "0h12wz72paxnj8l9vv2qfgfbmj20c6pz6xbilb7ns9zcwxwa0p34";
+    sha256 = "0qhgyphzdv72dgdfxin2xbk9623za3jwbcvhhaxixiwp6djj8vsm";
   };
 
   outputs = [ "bin" "out" "dev" "lib" ]
diff --git a/third_party/nixpkgs/pkgs/development/libraries/protobuf/3.15.nix b/third_party/nixpkgs/pkgs/development/libraries/protobuf/3.15.nix
index 63e175d980..661a552882 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/protobuf/3.15.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/protobuf/3.15.nix
@@ -1,6 +1,6 @@
 { callPackage, ... }:
 
 callPackage ./generic-v3.nix {
-  version = "3.15.5";
-  sha256 = "1znxzy4illsr4a08642h6s83jawzrq40m6pzkp05q0cpm8hcpvda";
+  version = "3.15.7";
+  sha256 = "03fx96rwxfbmr47f1nrflvaq5kk5p3a9wms4688nbnmymyghyml0";
 }
diff --git a/third_party/nixpkgs/pkgs/development/libraries/qhull/default.nix b/third_party/nixpkgs/pkgs/development/libraries/qhull/default.nix
index 78e1113531..0a6f39e672 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/qhull/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/qhull/default.nix
@@ -1,13 +1,14 @@
 { lib, stdenv, fetchFromGitHub, cmake }:
 
-stdenv.mkDerivation {
-  name = "qhull-2016.1";
+stdenv.mkDerivation rec {
+  pname = "qhull";
+  version = "2020.2";
 
   src = fetchFromGitHub {
     owner = "qhull";
     repo = "qhull";
-    rev = "5bbc75608c817b50383a0c24c3977cc09d0bbfde";
-    sha256 = "0wrgqc2mih7h8fs9v5jcn9dr56afqi9bgh2w9dcvzvzvxizr9kjj";
+    rev = version;
+    sha256 = "sha256-djUO3qzY8ch29AuhY3Bn1ajxWZ4/W70icWVrxWRAxRc=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/third_party/nixpkgs/pkgs/development/libraries/qt-5/5.14/default.nix b/third_party/nixpkgs/pkgs/development/libraries/qt-5/5.14/default.nix
index 45cf6209ea..3e3790ed1a 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/qt-5/5.14/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/qt-5/5.14/default.nix
@@ -118,6 +118,7 @@ let
       ./qtwebkit-darwin-no-qos-classes.patch
     ];
     qttools = [ ./qttools.patch ];
+    qtwayland = [ ./qtwayland-libdrm-build.patch ];
   };
 
   qtModule =
diff --git a/third_party/nixpkgs/pkgs/development/libraries/qt-5/5.14/qtwayland-libdrm-build.patch b/third_party/nixpkgs/pkgs/development/libraries/qt-5/5.14/qtwayland-libdrm-build.patch
new file mode 100644
index 0000000000..fb3d6327e4
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/development/libraries/qt-5/5.14/qtwayland-libdrm-build.patch
@@ -0,0 +1,56 @@
+commit 7217ea9cf297e664be876eb82b66a1b4f157ca80
+Author: Peter Seiderer <ps.report@gmx.net>
+Date:   Fri Apr 3 21:52:30 2020 +0200
+
+    fix libdrm related configure test failure
+    
+    Fixes:
+    
+      Project ERROR: Test config.qtwayland_client.tests.dmabuf-server-buffer tries to use undeclared library 'drm'
+      Project ERROR: Test config.qtwayland_compositor.tests.dmabuf-server-buffer tries to use undeclared library 'drm'
+      Project ERROR: Test config.qtwayland_compositor.tests.dmabuf-client-buffer tries to use undeclared library 'drm'
+    
+    Task-number: QTBUG-83303
+    Change-Id: I3970f4e3855fcfa760493631a14adb6a16950aa9
+    Reviewed-by: Ville Voutilainen <ville.voutilainen@qt.io>
+    Reviewed-by: Heikki Halmet <heikki.halmet@qt.io>
+    Reviewed-by: Eskil Abrahamsen Blomfeldt <eskil.abrahamsen-blomfeldt@qt.io>
+    (cherry picked from commit ca63fe81df8ac910f43539719566ed6745700c2b)
+    (cherry picked from commit 1344ca6b5a8fbc1b28727feea6d856af8bf3bc93)
+
+diff --git a/src/client/configure.json b/src/client/configure.json
+index 06213968..27c73f89 100644
+--- a/src/client/configure.json
++++ b/src/client/configure.json
+@@ -74,7 +74,8 @@
+             "label": "Linux dma-buf Buffer Sharing",
+             "type": "compile",
+             "test": "dmabuf_server_buffer",
+-            "use": "egl drm"
++            "libs": "-ldrm",
++            "use": "egl"
+         },
+         "vulkan-server-buffer": {
+             "label": "Vulkan Buffer Sharing",
+diff --git a/src/compositor/configure.json b/src/compositor/configure.json
+index 0dbb3364..73e4c1a8 100644
+--- a/src/compositor/configure.json
++++ b/src/compositor/configure.json
+@@ -80,13 +80,15 @@
+             "label": "Linux dma-buf Buffer Sharing",
+             "type": "compile",
+             "test": "dmabuf_server_buffer",
+-            "use": "egl drm"
++            "libs": "-ldrm",
++            "use": "egl"
+         },
+         "dmabuf-client-buffer": {
+             "label": "Linux Client dma-buf Buffer Sharing",
+             "type": "compile",
+             "test": "dmabuf_client_buffer",
+-            "use": "egl drm"
++            "libs": "-ldrm",
++            "use": "egl"
+         },
+         "vulkan-server-buffer": {
+             "label": "Vulkan Buffer Sharing",
diff --git a/third_party/nixpkgs/pkgs/development/libraries/qt-5/modules/qtwebengine.nix b/third_party/nixpkgs/pkgs/development/libraries/qt-5/modules/qtwebengine.nix
index cd3fa58330..e2ca47f45f 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/qt-5/modules/qtwebengine.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/qt-5/modules/qtwebengine.nix
@@ -236,6 +236,8 @@ qtModule {
     sed 's/${lib.head (lib.splitString "-" version)} /${qtCompatVersion} /' -i "$out"/lib/cmake/*/*Config.cmake
   '';
 
+  requiredSystemFeatures = [ "big-parallel" ];
+
   meta = with lib; {
     description = "A web engine based on the Chromium web browser";
     maintainers = with maintainers; [ matthewbauer ];
diff --git a/third_party/nixpkgs/pkgs/development/libraries/tracker/default.nix b/third_party/nixpkgs/pkgs/development/libraries/tracker/default.nix
index fbc6cce51f..ad2cf2acbd 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/tracker/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/tracker/default.nix
@@ -134,7 +134,7 @@ stdenv.mkDerivation (rec {
     platforms = platforms.linux;
   };
 }
-  // lib.optionalAttrs stdenv.isi686 {
+  // {
     # TMP: fatal error: libtracker-sparql/tracker-sparql-enum-types.h: No such file or directory
     enableParallelBuilding = false;
   }
diff --git a/third_party/nixpkgs/pkgs/development/libraries/wayland/default.nix b/third_party/nixpkgs/pkgs/development/libraries/wayland/default.nix
index fb7d1972c0..07671ddebd 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/wayland/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/wayland/default.nix
@@ -1,16 +1,16 @@
 { lib
 , stdenv
 , fetchurl
-, fetchpatch
+, substituteAll
 , meson
 , pkg-config
-, substituteAll
 , ninja
-, libffi
-, libxml2
 , wayland
-, expat ? null # Build wayland-scanner (currently cannot be disabled as of 1.7.0)
-, withDocumentation ? stdenv.hostPlatform == stdenv.buildPlatform
+, expat
+, libxml2
+, withLibraries ? stdenv.isLinux
+, libffi
+, withDocumentation ? withLibraries && stdenv.hostPlatform == stdenv.buildPlatform
 , graphviz-nox
 , doxygen
 , libxslt
@@ -21,8 +21,9 @@
 , docbook_xml_dtd_42
 }:
 
-# Require the optional to be enabled until upstream fixes or removes the configure flag
-assert expat != null;
+# Documentation is only built when building libraries.
+assert withDocumentation -> withLibraries;
+
 let
   isCross = stdenv.buildPlatform != stdenv.hostPlatform;
 in
@@ -42,15 +43,18 @@ stdenv.mkDerivation rec {
     })
   ];
 
-  outputs = [ "out" ] ++ lib.optionals withDocumentation [ "doc" "man" ];
-  separateDebugInfo = true;
-
-  mesonFlags = [ "-Ddocumentation=${lib.boolToString withDocumentation}" ];
-
   postPatch = lib.optionalString withDocumentation ''
     patchShebangs doc/doxygen/gen-doxygen.py
   '';
 
+  outputs = [ "out" "bin" "dev" ] ++ lib.optionals withDocumentation [ "doc" "man" ];
+  separateDebugInfo = true;
+
+  mesonFlags = [
+    "-Dlibraries=${lib.boolToString withLibraries}"
+    "-Ddocumentation=${lib.boolToString withDocumentation}"
+  ];
+
   depsBuildBuild = [
     pkg-config
   ];
@@ -71,16 +75,17 @@ stdenv.mkDerivation rec {
   ];
 
   buildInputs = [
-    libffi
     expat
     libxml2
+  ] ++ lib.optionals withLibraries [
+    libffi
   ] ++ lib.optionals withDocumentation [
     docbook_xsl
     docbook_xml_dtd_45
     docbook_xml_dtd_42
   ];
 
-  meta = {
+  meta = with lib; {
     description = "Core Wayland window system code and protocol";
     longDescription = ''
       Wayland is a project to define a protocol for a compositor to talk to its
@@ -91,9 +96,9 @@ stdenv.mkDerivation rec {
       rendering).
     '';
     homepage = "https://wayland.freedesktop.org/";
-    license = lib.licenses.mit; # Expat version
-    platforms = lib.platforms.linux;
-    maintainers = with lib.maintainers; [ primeos codyopel ];
+    license = licenses.mit; # Expat version
+    platforms = if withLibraries then platforms.linux else platforms.unix;
+    maintainers = with maintainers; [ primeos codyopel qyliss ];
   };
 
   passthru.version = version;
diff --git a/third_party/nixpkgs/pkgs/development/libraries/webkitgtk/default.nix b/third_party/nixpkgs/pkgs/development/libraries/webkitgtk/default.nix
index 84cf8d4833..84a9e2a1db 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/webkitgtk/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/webkitgtk/default.nix
@@ -36,6 +36,7 @@
 , readline
 , libGL
 , libGLU
+, mesa
 , libintl
 , libmanette
 , openjpeg
@@ -113,6 +114,7 @@ stdenv.mkDerivation rec {
     harfbuzz
     libGL
     libGLU
+    mesa # for libEGL headers
     libgcrypt
     libidn
     libintl
@@ -175,6 +177,8 @@ stdenv.mkDerivation rec {
     patchShebangs .
   '';
 
+  requiredSystemFeatures = [ "big-parallel" ];
+
   meta = {
     description = "Web content rendering engine, GTK port";
     homepage = "https://webkitgtk.org/";
diff --git a/third_party/nixpkgs/pkgs/development/libraries/wlroots/default.nix b/third_party/nixpkgs/pkgs/development/libraries/wlroots/default.nix
index a51de90d19..f2343e73c5 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/wlroots/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/wlroots/default.nix
@@ -1,5 +1,5 @@
-{ lib, stdenv, fetchFromGitHub, meson, ninja, pkg-config, wayland
-, libGL, wayland-protocols, libinput, libxkbcommon, pixman
+{ lib, stdenv, fetchFromGitHub, meson, ninja, pkg-config, wayland-scanner
+, libGL, wayland, wayland-protocols, libinput, libxkbcommon, pixman
 , xcbutilwm, libX11, libcap, xcbutilimage, xcbutilerrors, mesa
 , libpng, ffmpeg, libuuid, xcbutilrenderutil, xwayland
 }:
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
   # $out for the library and $examples for the example programs (in examples):
   outputs = [ "out" "examples" ];
 
-  nativeBuildInputs = [ meson ninja pkg-config wayland ];
+  nativeBuildInputs = [ meson ninja pkg-config wayland-scanner ];
 
   buildInputs = [
     libGL wayland wayland-protocols libinput libxkbcommon pixman
diff --git a/third_party/nixpkgs/pkgs/development/libraries/zookeeper_mt/default.nix b/third_party/nixpkgs/pkgs/development/libraries/zookeeper_mt/default.nix
index 978321f96e..8b9f6b70cf 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/zookeeper_mt/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/zookeeper_mt/default.nix
@@ -14,19 +14,19 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://apache/zookeeper/${zookeeper.pname}-${version}/apache-${zookeeper.pname}-${version}.tar.gz";
-    sha512 = "16994067d460a1b6af6a71f3458c64ee32629e876a1ff6646d57be62f1a5adab57462af84074ecaded4186dd3fde035ee24cd9d578b8e5044073eb05f4ab9c3e";
+    sha512 = "90643aa0ae1b9bf1f5e137dfbcee7e3c53db15e5038d7e406e4a1c345d6a0531bf7afa2b03f99d419ebd0fe892f127a7abfe582f786034ba823e53a0a9246bfb";
   };
 
   sourceRoot = "apache-${zookeeper.pname}-${version}/zookeeper-client/zookeeper-client-c";
 
   nativeBuildInputs = [
     autoreconfHook
+    pkg-config
     jre
   ];
 
   buildInputs = [
     openssl
-    pkg-config
     zookeeper
   ];
 
diff --git a/third_party/nixpkgs/pkgs/development/mobile/androidenv/compose-android-packages.nix b/third_party/nixpkgs/pkgs/development/mobile/androidenv/compose-android-packages.nix
index 5db3538563..f528fcd855 100644
--- a/third_party/nixpkgs/pkgs/development/mobile/androidenv/compose-android-packages.nix
+++ b/third_party/nixpkgs/pkgs/development/mobile/androidenv/compose-android-packages.nix
@@ -3,10 +3,10 @@
 }:
 
 { toolsVersion ? "26.1.1"
-, platformToolsVersion ? "30.0.5"
+, platformToolsVersion ? "31.0.2"
 , buildToolsVersions ? [ "30.0.3" ]
 , includeEmulator ? false
-, emulatorVersion ? "30.3.4"
+, emulatorVersion ? "30.6.3"
 , platformVersions ? []
 , includeSources ? false
 , includeSystemImages ? false
@@ -14,7 +14,8 @@
 , abiVersions ? [ "armeabi-v7a" ]
 , cmakeVersions ? [ ]
 , includeNDK ? false
-, ndkVersion ? "22.0.7026061"
+, ndkVersion ? "22.1.7171670"
+, ndkVersions ? [ndkVersion]
 , useGoogleAPIs ? false
 , useGoogleTVAddOns ? false
 , includeExtras ? []
@@ -175,10 +176,18 @@ rec {
     }
   ) cmakeVersions;
 
-  ndk-bundle = import ./ndk-bundle {
-    inherit deployAndroidPackage os autoPatchelfHook makeWrapper pkgs pkgsHostHost lib platform-tools;
-    package = packages.ndk-bundle.${ndkVersion};
-  };
+  # Creates a NDK bundle.
+  makeNdkBundle = ndkVersion:
+    import ./ndk-bundle {
+      inherit deployAndroidPackage os autoPatchelfHook makeWrapper pkgs pkgsHostHost lib platform-tools;
+      package = packages.ndk-bundle.${ndkVersion};
+    };
+
+  # All NDK bundles.
+  ndk-bundles = if includeNDK then map makeNdkBundle ndkVersions else [];
+
+  # The "default" NDK bundle.
+  ndk-bundle = if includeNDK then lib.findFirst (x: x != null) null ndk-bundles else null;
 
   google-apis = map (version:
     deployAndroidPackage {
@@ -203,6 +212,15 @@ rec {
       '') plugins}
     '';
 
+  # Function that automatically links all NDK plugins.
+  linkNdkPlugins = {name, plugins, rootName ? name}:
+    lib.optionalString (plugins != []) ''
+      mkdir -p ${rootName}
+      ${lib.concatMapStrings (plugin: ''
+        ln -s ${plugin}/libexec/android-sdk/${name} ${rootName}/${plugin.version}
+      '') plugins}
+    '';
+
   # Function that automatically links a plugin for which only one version exists
   linkPlugin = {name, plugin, check ? true}:
     lib.optionalString check ''
@@ -233,13 +251,13 @@ rec {
 
     postInstall = ''
       # Symlink all requested plugins
-
       ${linkPlugin { name = "platform-tools"; plugin = platform-tools; }}
       ${linkPlugins { name = "build-tools"; plugins = build-tools; }}
       ${linkPlugin { name = "emulator"; plugin = emulator; check = includeEmulator; }}
       ${linkPlugins { name = "platforms"; plugins = platforms; }}
       ${linkPlatformPlugins { name = "sources"; plugins = sources; check = includeSources; }}
       ${linkPlugins { name = "cmake"; plugins = cmake; }}
+      ${linkNdkPlugins { name = "ndk-bundle"; rootName = "ndk"; plugins = ndk-bundles; }}
       ${linkPlugin { name = "ndk-bundle"; plugin = ndk-bundle; check = includeNDK; }}
 
       ${lib.optionalString includeSystemImages ''
diff --git a/third_party/nixpkgs/pkgs/development/mobile/androidenv/examples/shell.nix b/third_party/nixpkgs/pkgs/development/mobile/androidenv/examples/shell.nix
index aa5337c929..95f6a3bdbb 100644
--- a/third_party/nixpkgs/pkgs/development/mobile/androidenv/examples/shell.nix
+++ b/third_party/nixpkgs/pkgs/development/mobile/androidenv/examples/shell.nix
@@ -23,14 +23,14 @@ let
   android = {
     versions = {
       tools = "26.1.1";
-      platformTools = "30.0.5";
+      platformTools = "31.0.2";
       buildTools = "30.0.3";
-      ndk = "22.0.7026061";
-
-      # or the LTS NDK:
-      # ndk = "21.3.6528147";
-      cmake = "3.10.2";
-      emulator = "30.3.4";
+      ndk = [
+        "22.1.7171670"
+        "21.3.6528147" # LTS NDK
+      ];
+      cmake = "3.18.1";
+      emulator = "30.6.3";
     };
 
     platforms = ["23" "24" "25" "26" "27" "28" "29" "30"];
@@ -69,7 +69,7 @@ let
     emulatorVersion = android.versions.emulator;
 
     includeNDK = true;
-    ndkVersion = android.versions.ndk;
+    ndkVersions = android.versions.ndk;
     cmakeVersions = [android.versions.cmake];
 
     useGoogleAPIs = true;
@@ -130,7 +130,7 @@ pkgs.mkShell rec {
 
   shellHook = ''
     # Add cmake to the path.
-    cmake_root="$(echo "$ANDROID_SDK_ROOT/cmake/${android.versions.cmake}".*/)"
+    cmake_root="$(echo "$ANDROID_SDK_ROOT/cmake/${android.versions.cmake}"*/)"
     export PATH="$cmake_root/bin:$PATH"
 
     # Write out local.properties for Android Studio.
diff --git a/third_party/nixpkgs/pkgs/development/mobile/androidenv/repo.json b/third_party/nixpkgs/pkgs/development/mobile/androidenv/repo.json
index f3606279c5..e8e0bf080f 100644
--- a/third_party/nixpkgs/pkgs/development/mobile/androidenv/repo.json
+++ b/third_party/nixpkgs/pkgs/development/mobile/androidenv/repo.json
@@ -425,16 +425,16 @@
       "archives": [
         {
           "os": "windows",
-          "sha1": "9b3479ce8f42fdcbd487aa843a2453d5950f5fc9",
-          "size": 164505,
-          "url": "https://dl.google.com/android/repository/gvm-windows_v1_6_0.zip"
+          "sha1": "1d35ead3cdfaf6e51001455f66a2db102dd647b7",
+          "size": 167191,
+          "url": "https://dl.google.com/android/repository/gvm-windows_v1_7_0.zip"
         }
       ],
       "displayName": "Android Emulator Hypervisor Driver for AMD Processors (installer)",
       "license": "android-sdk-license",
       "name": "extras-google-Android_Emulator_Hypervisor_Driver",
       "path": "extras/google/Android_Emulator_Hypervisor_Driver",
-      "revision": "1.6.0"
+      "revision": "1.7.0"
     },
     "extras;google;admob_ads_sdk": {
       "archives": [
@@ -466,33 +466,6 @@
       "path": "extras/google/analytics_sdk_v2",
       "revision": "3"
     },
-    "extras;google;auto": {
-      "archives": [
-        {
-          "os": "linux",
-          "sha1": "202a6e1b3009a0eb815f8c672d2d5b3717de6169",
-          "size": 1346009,
-          "url": "https://dl.google.com/android/repository/desktop-head-unit-linux_r01.1.zip"
-        },
-        {
-          "os": "macosx",
-          "sha1": "8179cbb3914493ebc5eb65b731cba061582f2e84",
-          "size": 2375533,
-          "url": "https://dl.google.com/android/repository/desktop-head-unit-macosx_r01.1.zip"
-        },
-        {
-          "os": "windows",
-          "sha1": "99c4a7172d73673552119347bc24c58b47da177b",
-          "size": 2691901,
-          "url": "https://dl.google.com/android/repository/desktop-head-unit-windows_r01.1.zip"
-        }
-      ],
-      "displayName": "Android Auto Desktop Head Unit emulator",
-      "license": "android-sdk-license",
-      "name": "extras-google-auto",
-      "path": "extras/google/auto",
-      "revision": "1.1"
-    },
     "extras;google;gcm": {
       "archives": [
         {
@@ -1537,21 +1510,21 @@
           "archives": [
             {
               "os": "windows",
-              "sha1": "ef4661e49abeb64c173636012526e41ff6f39dc1",
-              "size": 1404149582,
-              "url": "https://dl.google.com/android/repository/sys-img/google_apis_playstore/x86_64-30_r09-windows.zip"
+              "sha1": "ead1babced6bdfaa8e641faeb6ed115ca603c4a9",
+              "size": 1404405641,
+              "url": "https://dl.google.com/android/repository/sys-img/google_apis_playstore/x86_64-30_r10-windows.zip"
             },
             {
               "os": "macosx",
-              "sha1": "ef4661e49abeb64c173636012526e41ff6f39dc1",
-              "size": 1404149582,
-              "url": "https://dl.google.com/android/repository/sys-img/google_apis_playstore/x86_64-30_r09-darwin.zip"
+              "sha1": "ead1babced6bdfaa8e641faeb6ed115ca603c4a9",
+              "size": 1404405641,
+              "url": "https://dl.google.com/android/repository/sys-img/google_apis_playstore/x86_64-30_r10-darwin.zip"
             },
             {
               "os": "linux",
-              "sha1": "ef4661e49abeb64c173636012526e41ff6f39dc1",
-              "size": 1404149582,
-              "url": "https://dl.google.com/android/repository/sys-img/google_apis_playstore/x86_64-30_r09-linux.zip"
+              "sha1": "ead1babced6bdfaa8e641faeb6ed115ca603c4a9",
+              "size": 1404405641,
+              "url": "https://dl.google.com/android/repository/sys-img/google_apis_playstore/x86_64-30_r10-linux.zip"
             }
           ],
           "displayName": "Google Play Intel x86 Atom_64 System Image",
@@ -1561,6 +1534,58 @@
           "revision": "30-google_apis_playstore-x86_64"
         }
       }
+    },
+    "S": {
+      "google_apis_playstore": {
+        "arm64-v8a": {
+          "archives": [
+            {
+              "os": "macosx",
+              "sha1": "528e302e9966e8320d1c2bdc8235762fe4a9e733",
+              "size": 1333046412,
+              "url": "https://dl.google.com/android/repository/sys-img/google_apis_playstore/arm64-v8a-S_r03-darwin.zip"
+            },
+            {
+              "os": "linux",
+              "sha1": "528e302e9966e8320d1c2bdc8235762fe4a9e733",
+              "size": 1333046412,
+              "url": "https://dl.google.com/android/repository/sys-img/google_apis_playstore/arm64-v8a-S_r03-linux.zip"
+            }
+          ],
+          "displayName": "Google Play ARM 64 v8a System Image",
+          "license": "android-sdk-arm-dbt-license",
+          "name": "system-image-S-google_apis_playstore-arm64-v8a",
+          "path": "system-images/android-S/google_apis_playstore/arm64-v8a",
+          "revision": "S-google_apis_playstore-arm64-v8a"
+        },
+        "x86_64": {
+          "archives": [
+            {
+              "os": "windows",
+              "sha1": "093e0537cb18b25d8399a1af3ec955d2085f15ff",
+              "size": 1384401947,
+              "url": "https://dl.google.com/android/repository/sys-img/google_apis_playstore/x86_64-S_r03-windows.zip"
+            },
+            {
+              "os": "macosx",
+              "sha1": "093e0537cb18b25d8399a1af3ec955d2085f15ff",
+              "size": 1384401947,
+              "url": "https://dl.google.com/android/repository/sys-img/google_apis_playstore/x86_64-S_r03-darwin.zip"
+            },
+            {
+              "os": "linux",
+              "sha1": "093e0537cb18b25d8399a1af3ec955d2085f15ff",
+              "size": 1384401947,
+              "url": "https://dl.google.com/android/repository/sys-img/google_apis_playstore/x86_64-S_r03-linux.zip"
+            }
+          ],
+          "displayName": "Google Play Intel x86 Atom_64 System Image",
+          "license": "android-sdk-preview-license",
+          "name": "system-image-S-google_apis_playstore-x86_64",
+          "path": "system-images/android-S/google_apis_playstore/x86_64",
+          "revision": "S-google_apis_playstore-x86_64"
+        }
+      }
     }
   },
   "licenses": {
@@ -3075,6 +3100,33 @@
         "name": "build-tools",
         "path": "build-tools/30.0.3",
         "revision": "30.0.3"
+      },
+      "31.0.0-rc3": {
+        "archives": [
+          {
+            "os": "macosx",
+            "sha1": "e75dfb7a975809ba0ca0d25c2b82f7fd56444a4b",
+            "size": 53224980,
+            "url": "https://dl.google.com/android/repository/012061446cfd98341585d0d07401d0bd1a4c30f6.build-tools_r31-rc3-macosx.zip"
+          },
+          {
+            "os": "windows",
+            "sha1": "9d9ce209353c9046abe16285d58ef893c4b42221",
+            "size": 57592553,
+            "url": "https://dl.google.com/android/repository/41966dc138d44a3e3797b92fb68bf70552011d5d.build-tools_r31-rc3-windows.zip"
+          },
+          {
+            "os": "linux",
+            "sha1": "6859f11348d3984afbfcc74984802bd2e31cc0e2",
+            "size": 54724181,
+            "url": "https://dl.google.com/android/repository/build-tools_r31-rc3-linux.zip"
+          }
+        ],
+        "displayName": "Android SDK Build-Tools 31-rc3",
+        "license": "android-sdk-preview-license",
+        "name": "build-tools",
+        "path": "build-tools/31.0.0-rc3",
+        "revision": "31.0.0-rc3"
       }
     },
     "cmake": {
@@ -3109,14 +3161,14 @@
         "archives": [
           {
             "os": "windows",
-            "sha1": "80916762df6955f431743066e3568ae65b1b2b2f",
-            "size": 14677038,
+            "sha1": "63723e9657a3ce1fc3ae078229c6199af80b76bd",
+            "size": 14676950,
             "url": "https://dl.google.com/android/repository/7c386a739f915f5bd60051f2572c24782388e807.cmake-3.18.1-windows.zip"
           },
           {
             "os": "macosx",
-            "sha1": "1580deb8fb5d705aefb028413dad1a3a129891fe",
-            "size": 18505815,
+            "sha1": "809fdc8e14c745c6df4e506cc2157910f50b9cd9",
+            "size": 18505220,
             "url": "https://dl.google.com/android/repository/ba34c321f92f6e6fd696c8354c262c122f56abf8.cmake-3.18.1-darwin.zip"
           },
           {
@@ -3127,7 +3179,7 @@
           }
         ],
         "displayName": "CMake 3.18.1",
-        "license": "android-sdk-preview-license",
+        "license": "android-sdk-license",
         "name": "cmake",
         "path": "cmake/3.18.1",
         "revision": "3.18.1"
@@ -3198,8 +3250,8 @@
           },
           {
             "os": "macosx",
-            "sha1": "a69c4493c4c919698989484bf0ea684550ec5217",
-            "size": 86522172,
+            "sha1": "d45816955198c4dfd652584f4c0f1b0e86efb1b7",
+            "size": 86521848,
             "url": "https://dl.google.com/android/repository/commandlinetools-mac-6514223_latest.zip"
           },
           {
@@ -3325,74 +3377,59 @@
       }
     },
     "emulator": {
-      "28.0.25": {
+      "30.5.5": {
         "archives": [
+          {
+            "os": "macosx",
+            "sha1": "90f8a9942253db75ab4d13f791377e9739a88617",
+            "size": 300476485,
+            "url": "https://dl.google.com/android/repository/emulator-darwin_x64-7285888.zip"
+          },
+          {
+            "os": "linux",
+            "sha1": "ccdee1aa99e4ec39f5a762d6912682ac248b92f0",
+            "size": 272500365,
+            "url": "https://dl.google.com/android/repository/emulator-linux_x64-7285888.zip"
+          },
           {
             "os": "windows",
-            "sha1": "6004fd05db29f8088ec89ba85c273c0bf86ef0be",
-            "size": 372563893,
-            "url": "https://dl.google.com/android/repository/emulator-windows-5395263.zip"
+            "sha1": "84c3105ba1a3a94963e1f99b3f706d0231948fc9",
+            "size": 324371999,
+            "url": "https://dl.google.com/android/repository/emulator-windows_x64-7285888.zip"
           }
         ],
         "displayName": "Android Emulator",
         "license": "android-sdk-license",
         "name": "emulator",
         "path": "emulator",
-        "revision": "28.0.25"
+        "revision": "30.5.5"
       },
-      "30.2.6": {
+      "30.6.3": {
         "archives": [
           {
             "os": "macosx",
-            "sha1": "60cc4cfe372b3189679e1e08c929ff2fb793f3f6",
-            "size": 292634405,
-            "url": "https://dl.google.com/android/repository/emulator-darwin-6962233.zip"
+            "sha1": "66c9b788de49548d0faab052274f97b042f7241d",
+            "size": 308984491,
+            "url": "https://dl.google.com/android/repository/emulator-darwin_x64-7266284.zip"
           },
           {
             "os": "linux",
-            "sha1": "751044f953541b70a656d77343f6b0aac1153e24",
-            "size": 262303903,
-            "url": "https://dl.google.com/android/repository/emulator-linux-6962233.zip"
+            "sha1": "ecd9b55fe4784b6c8683faa4b1d2c951b8929154",
+            "size": 272243636,
+            "url": "https://dl.google.com/android/repository/emulator-linux_x64-7266284.zip"
           },
           {
             "os": "windows",
-            "sha1": "daa448bc56199b6beeaecf5f796d26c65e5a5fb8",
-            "size": 258566662,
-            "url": "https://dl.google.com/android/repository/emulator-windows-6962233.zip"
-          }
-        ],
-        "displayName": "Android Emulator",
-        "license": "android-sdk-license",
-        "name": "emulator",
-        "path": "emulator",
-        "revision": "30.2.6"
-      },
-      "30.3.4": {
-        "archives": [
-          {
-            "os": "macosx",
-            "sha1": "7c456b3946a89d8543a070d9f643f3fe87283d68",
-            "size": 295125219,
-            "url": "https://dl.google.com/android/repository/emulator-darwin-7020230.zip"
-          },
-          {
-            "os": "linux",
-            "sha1": "5285e71825453c83ad951b55a7a7d917a667221a",
-            "size": 265877671,
-            "url": "https://dl.google.com/android/repository/emulator-linux-7020230.zip"
-          },
-          {
-            "os": "windows",
-            "sha1": "918b6236a57d425b7a95495cd76a2cf1aaa98560",
-            "size": 320221036,
-            "url": "https://dl.google.com/android/repository/emulator-windows-7020230.zip"
+            "sha1": "5736749dc46ad950ec84e8275dfde2606d3e8a80",
+            "size": 324657514,
+            "url": "https://dl.google.com/android/repository/emulator-windows_x64-7266284.zip"
           }
         ],
         "displayName": "Android Emulator",
         "license": "android-sdk-preview-license",
         "name": "emulator",
         "path": "emulator",
-        "revision": "30.3.4"
+        "revision": "30.6.3"
       }
     },
     "extras": {
@@ -3911,6 +3948,33 @@
         "path": "ndk/21.3.6528147",
         "revision": "21.3.6528147"
       },
+      "21.4.7075529": {
+        "archives": [
+          {
+            "os": "macosx",
+            "sha1": "3f15c23a1c247ad17c7c271806848dbd40434738",
+            "size": 1042617180,
+            "url": "https://dl.google.com/android/repository/android-ndk-r21e-darwin-x86_64.zip"
+          },
+          {
+            "os": "linux",
+            "sha1": "c3ebc83c96a4d7f539bd72c241b2be9dcd29bda9",
+            "size": 1190670072,
+            "url": "https://dl.google.com/android/repository/android-ndk-r21e-linux-x86_64.zip"
+          },
+          {
+            "os": "windows",
+            "sha1": "fc44fea8bb3f5a6789821f40f41dce2d2cd5dc30",
+            "size": 1109665123,
+            "url": "https://dl.google.com/android/repository/android-ndk-r21e-windows-x86_64.zip"
+          }
+        ],
+        "displayName": "NDK (Side by side) 21.4.7075529",
+        "license": "android-sdk-license",
+        "name": "ndk",
+        "path": "ndk/21.4.7075529",
+        "revision": "21.4.7075529"
+      },
       "22.0.6917172-rc1": {
         "archives": [
           {
@@ -3964,6 +4028,114 @@
         "name": "ndk",
         "path": "ndk/22.0.7026061",
         "revision": "22.0.7026061"
+      },
+      "22.1.7171670": {
+        "archives": [
+          {
+            "os": "macosx",
+            "sha1": "dc80e8a2cfcb28db74c1931d42c652e9d17ff2c3",
+            "size": 1049337733,
+            "url": "https://dl.google.com/android/repository/android-ndk-r22b-darwin-x86_64.zip"
+          },
+          {
+            "os": "linux",
+            "sha1": "9ece64c7f19763dd67320d512794969930fce9dc",
+            "size": 1148198368,
+            "url": "https://dl.google.com/android/repository/android-ndk-r22b-linux-x86_64.zip"
+          },
+          {
+            "os": "windows",
+            "sha1": "96ba1a049303cf6bf3ee84cfd64d6bcd43486a50",
+            "size": 1082301775,
+            "url": "https://dl.google.com/android/repository/android-ndk-r22b-windows-x86_64.zip"
+          }
+        ],
+        "displayName": "NDK (Side by side) 22.1.7171670",
+        "license": "android-sdk-license",
+        "name": "ndk",
+        "path": "ndk/22.1.7171670",
+        "revision": "22.1.7171670"
+      },
+      "23.0.7123448-rc1": {
+        "archives": [
+          {
+            "os": "macosx",
+            "sha1": "708ebbceb719c43a3165503ea82fb107d823ad54",
+            "size": 721278316,
+            "url": "https://dl.google.com/android/repository/android-ndk-r23-beta1-darwin-x86_64.zip"
+          },
+          {
+            "os": "linux",
+            "sha1": "1340ed20f27fcb184ea814ae63e0f3cd75890342",
+            "size": 804392699,
+            "url": "https://dl.google.com/android/repository/android-ndk-r23-beta1-linux-x86_64.zip"
+          },
+          {
+            "os": "windows",
+            "sha1": "c056900896129d3dd4eb953a53a8961d9853aa20",
+            "size": 749304589,
+            "url": "https://dl.google.com/android/repository/android-ndk-r23-beta1-windows-x86_64.zip"
+          }
+        ],
+        "displayName": "NDK (Side by side) 23.0.7123448",
+        "license": "android-sdk-preview-license",
+        "name": "ndk",
+        "path": "ndk/23.0.7123448",
+        "revision": "23.0.7123448-rc1"
+      },
+      "23.0.7196353-rc2": {
+        "archives": [
+          {
+            "os": "macosx",
+            "sha1": "454fd0c1e8385896ad465d7cfd653e28fbf3523f",
+            "size": 674507658,
+            "url": "https://dl.google.com/android/repository/android-ndk-r23-beta2-darwin-x86_64.zip"
+          },
+          {
+            "os": "linux",
+            "sha1": "290e8c39bb9732ac8784855e1f22342eb488228e",
+            "size": 705747711,
+            "url": "https://dl.google.com/android/repository/android-ndk-r23-beta2-linux-x86_64.zip"
+          },
+          {
+            "os": "windows",
+            "sha1": "00194ae44ce90f2052ab8e42f1a11a0db8d50c2a",
+            "size": 747953762,
+            "url": "https://dl.google.com/android/repository/android-ndk-r23-beta2-windows-x86_64.zip"
+          }
+        ],
+        "displayName": "NDK (Side by side) 23.0.7196353",
+        "license": "android-sdk-preview-license",
+        "name": "ndk",
+        "path": "ndk/23.0.7196353",
+        "revision": "23.0.7196353-rc2"
+      },
+      "23.0.7272597-rc3": {
+        "archives": [
+          {
+            "os": "macosx",
+            "sha1": "3b977f0f8e0fa2d6777fae6b1d37aebfc075ab56",
+            "size": 695243724,
+            "url": "https://dl.google.com/android/repository/android-ndk-r23-beta3-darwin-x86_64.zip"
+          },
+          {
+            "os": "linux",
+            "sha1": "2298465ef13dab0c527b9cf6ef892b1ec6461fb4",
+            "size": 724828157,
+            "url": "https://dl.google.com/android/repository/android-ndk-r23-beta3-linux-x86_64.zip"
+          },
+          {
+            "os": "windows",
+            "sha1": "8c10a51f50f4f12ccc839dcb4bd8107133024c2f",
+            "size": 785932724,
+            "url": "https://dl.google.com/android/repository/android-ndk-r23-beta3-windows-x86_64.zip"
+          }
+        ],
+        "displayName": "NDK (Side by side) 23.0.7272597",
+        "license": "android-sdk-preview-license",
+        "name": "ndk",
+        "path": "ndk/23.0.7272597",
+        "revision": "23.0.7272597-rc3"
       }
     },
     "ndk-bundle": {
@@ -4426,6 +4598,33 @@
         "path": "ndk-bundle",
         "revision": "21.3.6528147"
       },
+      "21.4.7075529": {
+        "archives": [
+          {
+            "os": "macosx",
+            "sha1": "3f15c23a1c247ad17c7c271806848dbd40434738",
+            "size": 1042617180,
+            "url": "https://dl.google.com/android/repository/android-ndk-r21e-darwin-x86_64.zip"
+          },
+          {
+            "os": "linux",
+            "sha1": "c3ebc83c96a4d7f539bd72c241b2be9dcd29bda9",
+            "size": 1190670072,
+            "url": "https://dl.google.com/android/repository/android-ndk-r21e-linux-x86_64.zip"
+          },
+          {
+            "os": "windows",
+            "sha1": "fc44fea8bb3f5a6789821f40f41dce2d2cd5dc30",
+            "size": 1109665123,
+            "url": "https://dl.google.com/android/repository/android-ndk-r21e-windows-x86_64.zip"
+          }
+        ],
+        "displayName": "NDK",
+        "license": "android-sdk-license",
+        "name": "ndk-bundle",
+        "path": "ndk-bundle",
+        "revision": "21.4.7075529"
+      },
       "22.0.6917172-rc1": {
         "archives": [
           {
@@ -4479,6 +4678,114 @@
         "name": "ndk-bundle",
         "path": "ndk-bundle",
         "revision": "22.0.7026061"
+      },
+      "22.1.7171670": {
+        "archives": [
+          {
+            "os": "macosx",
+            "sha1": "dc80e8a2cfcb28db74c1931d42c652e9d17ff2c3",
+            "size": 1049337733,
+            "url": "https://dl.google.com/android/repository/android-ndk-r22b-darwin-x86_64.zip"
+          },
+          {
+            "os": "linux",
+            "sha1": "9ece64c7f19763dd67320d512794969930fce9dc",
+            "size": 1148198368,
+            "url": "https://dl.google.com/android/repository/android-ndk-r22b-linux-x86_64.zip"
+          },
+          {
+            "os": "windows",
+            "sha1": "96ba1a049303cf6bf3ee84cfd64d6bcd43486a50",
+            "size": 1082301775,
+            "url": "https://dl.google.com/android/repository/android-ndk-r22b-windows-x86_64.zip"
+          }
+        ],
+        "displayName": "NDK",
+        "license": "android-sdk-license",
+        "name": "ndk-bundle",
+        "path": "ndk-bundle",
+        "revision": "22.1.7171670"
+      },
+      "23.0.7123448-rc1": {
+        "archives": [
+          {
+            "os": "macosx",
+            "sha1": "708ebbceb719c43a3165503ea82fb107d823ad54",
+            "size": 721278316,
+            "url": "https://dl.google.com/android/repository/android-ndk-r23-beta1-darwin-x86_64.zip"
+          },
+          {
+            "os": "linux",
+            "sha1": "1340ed20f27fcb184ea814ae63e0f3cd75890342",
+            "size": 804392699,
+            "url": "https://dl.google.com/android/repository/android-ndk-r23-beta1-linux-x86_64.zip"
+          },
+          {
+            "os": "windows",
+            "sha1": "c056900896129d3dd4eb953a53a8961d9853aa20",
+            "size": 749304589,
+            "url": "https://dl.google.com/android/repository/android-ndk-r23-beta1-windows-x86_64.zip"
+          }
+        ],
+        "displayName": "NDK",
+        "license": "android-sdk-preview-license",
+        "name": "ndk-bundle",
+        "path": "ndk-bundle",
+        "revision": "23.0.7123448-rc1"
+      },
+      "23.0.7196353-rc2": {
+        "archives": [
+          {
+            "os": "macosx",
+            "sha1": "454fd0c1e8385896ad465d7cfd653e28fbf3523f",
+            "size": 674507658,
+            "url": "https://dl.google.com/android/repository/android-ndk-r23-beta2-darwin-x86_64.zip"
+          },
+          {
+            "os": "linux",
+            "sha1": "290e8c39bb9732ac8784855e1f22342eb488228e",
+            "size": 705747711,
+            "url": "https://dl.google.com/android/repository/android-ndk-r23-beta2-linux-x86_64.zip"
+          },
+          {
+            "os": "windows",
+            "sha1": "00194ae44ce90f2052ab8e42f1a11a0db8d50c2a",
+            "size": 747953762,
+            "url": "https://dl.google.com/android/repository/android-ndk-r23-beta2-windows-x86_64.zip"
+          }
+        ],
+        "displayName": "NDK",
+        "license": "android-sdk-preview-license",
+        "name": "ndk-bundle",
+        "path": "ndk-bundle",
+        "revision": "23.0.7196353-rc2"
+      },
+      "23.0.7272597-rc3": {
+        "archives": [
+          {
+            "os": "macosx",
+            "sha1": "3b977f0f8e0fa2d6777fae6b1d37aebfc075ab56",
+            "size": 695243724,
+            "url": "https://dl.google.com/android/repository/android-ndk-r23-beta3-darwin-x86_64.zip"
+          },
+          {
+            "os": "linux",
+            "sha1": "2298465ef13dab0c527b9cf6ef892b1ec6461fb4",
+            "size": 724828157,
+            "url": "https://dl.google.com/android/repository/android-ndk-r23-beta3-linux-x86_64.zip"
+          },
+          {
+            "os": "windows",
+            "sha1": "8c10a51f50f4f12ccc839dcb4bd8107133024c2f",
+            "size": 785932724,
+            "url": "https://dl.google.com/android/repository/android-ndk-r23-beta3-windows-x86_64.zip"
+          }
+        ],
+        "displayName": "NDK",
+        "license": "android-sdk-preview-license",
+        "name": "ndk-bundle",
+        "path": "ndk-bundle",
+        "revision": "23.0.7272597-rc3"
       }
     },
     "patcher": {
@@ -4499,32 +4806,32 @@
       }
     },
     "platform-tools": {
-      "30.0.5": {
+      "31.0.2": {
         "archives": [
           {
             "os": "macosx",
-            "sha1": "6f77800c35f27dc8e014a214e656aae17c7ea2d0",
-            "size": 13311295,
-            "url": "https://dl.google.com/android/repository/eabcd8b4b7ab518c6af9c941af8494072f17ec4b.platform-tools_r30.0.5-darwin.zip"
+            "sha1": "78937049851e1db90317612c6b831759f56fc86d",
+            "size": 13829393,
+            "url": "https://dl.google.com/android/repository/42b081e1e068bb936179551684cdcb30315e245c.platform-tools_r31.0.2-darwin.zip"
           },
           {
             "os": "linux",
-            "sha1": "ba07433b8e34c2a51c250033abcd1442a28d0863",
-            "size": 13338136,
-            "url": "https://dl.google.com/android/repository/platform-tools_r30.0.5-linux.zip"
+            "sha1": "ff02a9d8c6fa9687e1207fc0c4b84033925d452d",
+            "size": 13876419,
+            "url": "https://dl.google.com/android/repository/platform-tools_r31.0.2-linux.zip"
           },
           {
             "os": "windows",
-            "sha1": "e66c951841f78f225e36cfae74e81712a704a37a",
-            "size": 12328924,
-            "url": "https://dl.google.com/android/repository/platform-tools_r30.0.5-windows.zip"
+            "sha1": "9cc0f642a66706a978214395b85c8e8228c24f2f",
+            "size": 12537668,
+            "url": "https://dl.google.com/android/repository/platform-tools_r31.0.2-windows.zip"
           }
         ],
         "displayName": "Android SDK Platform-Tools",
         "license": "android-sdk-license",
         "name": "platform-tools",
         "path": "platform-tools",
-        "revision": "30.0.5"
+        "revision": "31.0.2"
       }
     },
     "platforms": {
@@ -5022,35 +5329,77 @@
         "name": "platforms",
         "path": "platforms/android-9",
         "revision": "9"
+      },
+      "S": {
+        "archives": [
+          {
+            "os": "all",
+            "sha1": "3aee3ad760dc7becf657d6421629fe360215f92e",
+            "size": 56206479,
+            "url": "https://dl.google.com/android/repository/platform-S_r03.zip"
+          }
+        ],
+        "displayName": "Android SDK Platform S",
+        "license": "android-sdk-license",
+        "name": "platforms",
+        "path": "platforms/android-S",
+        "revision": "S"
       }
     },
     "skiaparser": {
-      "5": {
+      "2": {
         "archives": [
           {
             "os": "linux",
-            "sha1": "b4ac0f553c2b582fd4e1896f46e2021b9da9d19b",
-            "size": 6234850,
-            "url": "https://dl.google.com/android/repository/skiaparser-6923996-linux.zip"
+            "sha1": "2703a570224a5ced1f73eb3efbdb3192a1ecec81",
+            "size": 6681896,
+            "url": "https://dl.google.com/android/repository/skiaparser-7248848-linux.zip"
           },
           {
             "os": "macosx",
-            "sha1": "6d4bafe363b8536c9c3da51fac6f4b16c5685359",
-            "size": 6297430,
-            "url": "https://dl.google.com/android/repository/skiaparser-6923996-mac.zip"
+            "sha1": "ecf8794beccf578d4130bb9f7f2c7fa0c40c62c2",
+            "size": 7340904,
+            "url": "https://dl.google.com/android/repository/skiaparser-7248848-mac.zip"
           },
           {
             "os": "windows",
-            "sha1": "2aafef23d600d05467e645cd1420e8c7e5a5dad3",
-            "size": 6008442,
-            "url": "https://dl.google.com/android/repository/skiaparser-6923996-win.zip"
+            "sha1": "84c28480ca057e48e8d2fed0ae8f52fc21aa7e61",
+            "size": 6450856,
+            "url": "https://dl.google.com/android/repository/skiaparser-7248848-win.zip"
+          }
+        ],
+        "displayName": "Layout Inspector image server for API S",
+        "license": "android-sdk-license",
+        "name": "skiaparser",
+        "path": "skiaparser/2",
+        "revision": "2"
+      },
+      "6": {
+        "archives": [
+          {
+            "os": "linux",
+            "sha1": "78af2cd3e4168af80c16d7686536baa318e10cc4",
+            "size": 6323164,
+            "url": "https://dl.google.com/android/repository/skiaparser-7083912-linux.zip"
+          },
+          {
+            "os": "macosx",
+            "sha1": "73aa4e3b52177cf7d4cf956a74311e0097987bb4",
+            "size": 6561072,
+            "url": "https://dl.google.com/android/repository/skiaparser-7083912-mac.zip"
+          },
+          {
+            "os": "windows",
+            "sha1": "28dde025a70a0f4819cf195c1cb6e0e2b4bf4514",
+            "size": 6059180,
+            "url": "https://dl.google.com/android/repository/skiaparser-7083912-win.zip"
           }
         ],
         "displayName": "Layout Inspector image server for API 29-30",
         "license": "android-sdk-license",
         "name": "skiaparser",
         "path": "skiaparser/1",
-        "revision": "5"
+        "revision": "6"
       }
     },
     "sources": {
diff --git a/third_party/nixpkgs/pkgs/development/ocaml-modules/dtoa/default.nix b/third_party/nixpkgs/pkgs/development/ocaml-modules/dtoa/default.nix
index da075f5c79..44bc5d7498 100644
--- a/third_party/nixpkgs/pkgs/development/ocaml-modules/dtoa/default.nix
+++ b/third_party/nixpkgs/pkgs/development/ocaml-modules/dtoa/default.nix
@@ -13,7 +13,7 @@ buildDunePackage rec {
     sha256 = "0zkhn0rdq82g6gamsv6nkx6i44s8104nh6jg5xydazl9jl1704xn";
   };
 
-  hardeningDisable = lib.optional stdenv.isDarwin "strictoverflow";
+  hardeningDisable = lib.optional stdenv.cc.isClang "strictoverflow";
 
   meta = with lib; {
     homepage = "https://github.com/flowtype/ocaml-dtoa";
diff --git a/third_party/nixpkgs/pkgs/development/ocaml-modules/h2/default.nix b/third_party/nixpkgs/pkgs/development/ocaml-modules/h2/default.nix
new file mode 100644
index 0000000000..dd96e0ecc4
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/development/ocaml-modules/h2/default.nix
@@ -0,0 +1,59 @@
+{ buildDunePackage
+, lib
+, fetchFromGitHub
+, ocaml
+, hpack
+, angstrom
+, faraday
+, base64
+, psq
+, httpaf
+, alcotest
+, yojson
+, hex
+}:
+
+let
+  http2-frame-test-case = fetchFromGitHub {
+    owner = "http2jp";
+    repo = "http2-frame-test-case";
+    rev = "5c67db0d4d68e1fb7d3a241d6e01fc04d981f465";
+    sha256 = "16yyb37f8mk9saw7ndjs5is67yq7qa6b6y7k0c75ibxi4n9aw1r3";
+  };
+in
+
+buildDunePackage rec {
+  pname = "h2";
+
+  inherit (hpack)
+    version
+    src
+    useDune2
+    ;
+
+  minimumOCamlVersion = "4.06";
+
+  propagatedBuildInputs = [
+    angstrom
+    faraday
+    base64
+    psq
+    hpack
+    httpaf
+  ];
+
+  # Tests fail with 4.06
+  doCheck = lib.versionAtLeast ocaml.version "4.07";
+  preCheck = ''
+    ln -s "${http2-frame-test-case}" lib_test/http2-frame-test-case
+  '';
+  checkInputs = [
+    alcotest
+    yojson
+    hex
+  ];
+
+  meta = hpack.meta // {
+    description = "A high-performance, memory-efficient, and scalable HTTP/2 library for OCaml";
+  };
+}
diff --git a/third_party/nixpkgs/pkgs/development/ocaml-modules/hpack/default.nix b/third_party/nixpkgs/pkgs/development/ocaml-modules/hpack/default.nix
new file mode 100644
index 0000000000..ec967312b8
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/development/ocaml-modules/hpack/default.nix
@@ -0,0 +1,37 @@
+{ buildDunePackage
+, lib
+, fetchurl
+, angstrom
+, faraday
+}:
+
+buildDunePackage rec {
+  pname = "hpack";
+  version = "0.8.0";
+
+  src = fetchurl {
+    url = "https://github.com/anmonteiro/ocaml-h2/releases/download/${version}/h2-${version}.tbz";
+    sha256 = "0qcn3yvyz0h419fjg9nb20csfmwmh3ihz0zb0jfzdycf5w4mlry6";
+  };
+
+  useDune2 = true;
+  minimumOCamlVersion = "4.04";
+
+  propagatedBuildInputs = [
+    angstrom
+    faraday
+  ];
+
+  # circular dependency
+  doCheck = false;
+
+  meta = {
+    license = lib.licenses.bsd3;
+    description = "An HPACK (Header Compression for HTTP/2) implementation in OCaml";
+    homepage = "https://github.com/anmonteiro/ocaml-h2";
+    maintainers = with lib.maintainers; [
+      sternenseemann
+      anmonteiro
+    ];
+  };
+}
diff --git a/third_party/nixpkgs/pkgs/development/ocaml-modules/letsencrypt/default.nix b/third_party/nixpkgs/pkgs/development/ocaml-modules/letsencrypt/default.nix
new file mode 100644
index 0000000000..b3c0d4f894
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/development/ocaml-modules/letsencrypt/default.nix
@@ -0,0 +1,84 @@
+{ buildDunePackage
+, lib
+, fetchurl
+, astring
+, asn1-combinators
+, uri
+, rresult
+, base64
+, cmdliner
+, cohttp
+, cohttp-lwt
+, cohttp-lwt-unix
+, zarith
+, logs
+, fmt
+, lwt
+, mirage-crypto
+, mirage-crypto-pk
+, mirage-crypto-rng
+, x509
+, yojson
+, ounit
+, dns
+, dns-tsig
+, ptime
+, bos
+, fpath
+, randomconv
+, domain-name
+}:
+
+buildDunePackage rec {
+  pname = "letsencrypt";
+  version = "0.2.4";
+
+  src = fetchurl {
+    url = "https://github.com/mmaker/ocaml-letsencrypt/releases/download/v${version}/letsencrypt-v${version}.tbz";
+    sha256 = "91c79828a50243804da29c17563c54d2d528a79207e5b874dce6a3e7fedf7567";
+  };
+
+  minimumOCamlVersion = "4.08";
+  useDune2 = true;
+
+  buildInputs = [
+    cmdliner
+    cohttp
+    cohttp-lwt-unix
+    zarith
+    fmt
+    mirage-crypto-rng
+    ptime
+    bos
+    fpath
+    randomconv
+    domain-name
+  ];
+
+  propagatedBuildInputs = [
+    logs
+    yojson
+    lwt
+    base64
+    mirage-crypto
+    mirage-crypto-pk
+    asn1-combinators
+    x509
+    uri
+    dns
+    dns-tsig
+    rresult
+    astring
+    cohttp-lwt
+  ];
+
+  doCheck = true;
+  checkInputs = [ ounit ];
+
+  meta = {
+    description = "ACME implementation in OCaml";
+    license = lib.licenses.bsd2;
+    maintainers = [ lib.maintainers.sternenseemann ];
+    homepage = "https://github.com/mmaker/ocaml-letsencrypt";
+  };
+}
diff --git a/third_party/nixpkgs/pkgs/development/ocaml-modules/mirage-bootvar-xen/default.nix b/third_party/nixpkgs/pkgs/development/ocaml-modules/mirage-bootvar-xen/default.nix
new file mode 100644
index 0000000000..c280853488
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/development/ocaml-modules/mirage-bootvar-xen/default.nix
@@ -0,0 +1,34 @@
+{ lib
+, buildDunePackage
+, fetchurl
+, mirage-xen
+, parse-argv
+, lwt
+}:
+
+buildDunePackage rec {
+  pname = "mirage-bootvar-xen";
+  version = "0.8.0";
+
+  minimumOCamlVersion = "4.08";
+
+  useDune2 = true;
+
+  src = fetchurl {
+    url = "https://github.com/mirage/mirage-bootvar-xen/releases/download/v${version}/mirage-bootvar-xen-v${version}.tbz";
+    sha256 = "0nk80giq9ng3svbnm68fjby2f1dnarddm3lk7mw7w59av71q0rcv";
+  };
+
+  propagatedBuildInputs = [
+    mirage-xen
+    lwt
+    parse-argv
+  ];
+
+  meta = with lib; {
+    description = "Handle boot-time arguments for Xen platform";
+    license = licenses.isc;
+    maintainers = [ maintainers.sternenseemann ];
+    homepage = "https://github.com/mirage/mirage-bootvar-xen";
+  };
+}
diff --git a/third_party/nixpkgs/pkgs/development/ocaml-modules/mirage-crypto/default.nix b/third_party/nixpkgs/pkgs/development/ocaml-modules/mirage-crypto/default.nix
index 2eda6d5f55..549838db39 100644
--- a/third_party/nixpkgs/pkgs/development/ocaml-modules/mirage-crypto/default.nix
+++ b/third_party/nixpkgs/pkgs/development/ocaml-modules/mirage-crypto/default.nix
@@ -7,11 +7,11 @@ buildDunePackage rec {
   minimumOCamlVersion = "4.08";
 
   pname = "mirage-crypto";
-  version = "0.10.0";
+  version = "0.10.1";
 
   src = fetchurl {
     url = "https://github.com/mirage/mirage-crypto/releases/download/v${version}/mirage-crypto-v${version}.tbz";
-    sha256 = "20915c53ddb658c53f588c414f13676bc8ad3cd734d9ed909225ea080dd8144d";
+    sha256 = "028e2fc1f0a3e9b06603c6a253ecd043100099bc1c12c0567d8bc46d3781499c";
   };
 
   useDune2 = true;
diff --git a/third_party/nixpkgs/pkgs/development/ocaml-modules/mirage-net-xen/default.nix b/third_party/nixpkgs/pkgs/development/ocaml-modules/mirage-net-xen/default.nix
new file mode 100644
index 0000000000..0d7a7e53fb
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/development/ocaml-modules/mirage-net-xen/default.nix
@@ -0,0 +1,39 @@
+{ lib
+, buildDunePackage
+, netchannel
+, ppx_sexp_conv
+, lwt
+, cstruct
+, mirage-net
+, mirage-xen
+, io-page
+, lwt-dllist
+, logs
+}:
+
+buildDunePackage {
+  pname = "mirage-net-xen";
+
+  inherit (netchannel)
+    src
+    version
+    useDune2
+    minimumOCamlVersion
+    meta
+    ;
+
+  nativeBuildInputs = [
+    ppx_sexp_conv
+  ];
+
+  propagatedBuildInputs = [
+    lwt
+    cstruct
+    netchannel
+    mirage-net
+    mirage-xen
+    io-page
+    lwt-dllist
+    logs
+  ];
+}
diff --git a/third_party/nixpkgs/pkgs/development/ocaml-modules/mirage-xen/default.nix b/third_party/nixpkgs/pkgs/development/ocaml-modules/mirage-xen/default.nix
new file mode 100644
index 0000000000..0d53d0f9c3
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/development/ocaml-modules/mirage-xen/default.nix
@@ -0,0 +1,78 @@
+{ lib
+, buildDunePackage
+, fetchurl
+, pkg-config
+, cstruct
+, lwt
+, shared-memory-ring-lwt
+, xenstore
+, lwt-dllist
+, mirage-profile
+, mirage-runtime
+, logs
+, fmt
+, ocaml-freestanding
+, bheap
+, duration
+, io-page
+}:
+
+buildDunePackage rec {
+  pname = "mirage-xen";
+  version = "6.0.0";
+
+  useDune2 = true;
+
+  src = fetchurl {
+    url = "https://github.com/mirage/mirage-xen/releases/download/v${version}/mirage-xen-v${version}.tbz";
+    sha256 = "f991e972059b27993c287ad010d9281fee061efaa1dd475d0955179f93710fbd";
+  };
+
+  patches = [
+    ./makefile-no-opam.patch
+    ./pkg-config.patch
+  ];
+
+  # can't handle OCAMLFIND_DESTDIR with substituteAll
+  postPatch = ''
+    substituteInPlace lib/bindings/mirage-xen.pc \
+      --replace "@out@" "$out" \
+      --replace "@OCAMLFIND_DESTDIR@" "$OCAMLFIND_DESTDIR"
+  '';
+
+  minimumOCamlVersion = "4.08";
+
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
+  propagatedBuildInputs = [
+    cstruct
+    lwt
+    shared-memory-ring-lwt
+    xenstore
+    lwt-dllist
+    mirage-profile
+    mirage-runtime
+    io-page
+    logs
+    fmt
+    bheap
+    duration
+    (ocaml-freestanding.override { target = "xen"; })
+  ];
+
+  # Move pkg-config files into their well-known location.
+  # This saves us an extra setup hook and causes no issues
+  # since we patch all relative paths out of the .pc file.
+  postInstall = ''
+    mv $OCAMLFIND_DESTDIR/pkgconfig $out/lib/pkgconfig
+  '';
+
+  meta = with lib; {
+    description = "Xen core platform libraries for MirageOS";
+    license = licenses.isc;
+    maintainers = [ maintainers.sternenseemann ];
+    homepage = "https://github.com/mirage/mirage-xen";
+  };
+}
diff --git a/third_party/nixpkgs/pkgs/development/ocaml-modules/mirage-xen/makefile-no-opam.patch b/third_party/nixpkgs/pkgs/development/ocaml-modules/mirage-xen/makefile-no-opam.patch
new file mode 100644
index 0000000000..905e6efc3f
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/development/ocaml-modules/mirage-xen/makefile-no-opam.patch
@@ -0,0 +1,12 @@
+diff --git a/lib/bindings/Makefile b/lib/bindings/Makefile
+index 4e413c0..67c7bdc 100644
+--- a/lib/bindings/Makefile
++++ b/lib/bindings/Makefile
+@@ -1,4 +1,6 @@
+-PKG_CONFIG_PATH := $(shell opam config var prefix)/lib/pkgconfig
++ifneq (, $(shell command -v opam))
++	PKG_CONFIG_PATH ?= $(shell opam config var prefix)/lib/pkgconfig
++endif
+ 
+ CC ?= cc
+ FREESTANDING_CFLAGS := $(shell PKG_CONFIG_PATH=$(PKG_CONFIG_PATH) pkg-config --cflags ocaml-freestanding)
diff --git a/third_party/nixpkgs/pkgs/development/ocaml-modules/mirage-xen/pkg-config.patch b/third_party/nixpkgs/pkgs/development/ocaml-modules/mirage-xen/pkg-config.patch
new file mode 100644
index 0000000000..19205cf7ee
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/development/ocaml-modules/mirage-xen/pkg-config.patch
@@ -0,0 +1,13 @@
+diff --git a/lib/bindings/mirage-xen.pc b/lib/bindings/mirage-xen.pc
+index a03a217..8499aa4 100644
+--- a/lib/bindings/mirage-xen.pc
++++ b/lib/bindings/mirage-xen.pc
+@@ -1,6 +1,6 @@
+-prefix=${pcfiledir}/../..
++prefix=@out@
+ exec_prefix=${prefix}
+-libdir=${exec_prefix}/lib
++libdir=@OCAMLFIND_DESTDIR@
+ 
+ Name: mirage-xen
+ Version: 6.0.0
diff --git a/third_party/nixpkgs/pkgs/development/ocaml-modules/netchannel/default.nix b/third_party/nixpkgs/pkgs/development/ocaml-modules/netchannel/default.nix
new file mode 100644
index 0000000000..e7b021d6fb
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/development/ocaml-modules/netchannel/default.nix
@@ -0,0 +1,55 @@
+{ lib
+, buildDunePackage
+, fetchurl
+, ppx_sexp_conv
+, ppx_cstruct
+, lwt
+, mirage-net
+, io-page
+, mirage-xen
+, ipaddr
+, mirage-profile
+, shared-memory-ring
+, sexplib
+, logs
+, rresult
+}:
+
+buildDunePackage rec {
+  pname = "netchannel";
+  version = "2.0.0";
+
+  useDune2 = true;
+
+  minimumOCamlVersion = "4.08";
+
+  src = fetchurl {
+    url = "https://github.com/mirage/mirage-net-xen/releases/download/v${version}/mirage-net-xen-v${version}.tbz";
+    sha256 = "ec3906ef1804ef6a9e36b91f4ae73ce4849e9e0d1d36a80fe66b5f905fab93ad";
+  };
+
+  nativeBuildInputs = [
+    ppx_cstruct
+  ];
+
+  propagatedBuildInputs = [
+    ppx_sexp_conv
+    lwt
+    mirage-net
+    io-page
+    mirage-xen
+    ipaddr
+    mirage-profile
+    shared-memory-ring
+    sexplib
+    logs
+    rresult
+  ];
+
+  meta = with lib; {
+    description = "Network device for reading and writing Ethernet frames via then Xen netfront/netback protocol";
+    license = licenses.isc;
+    maintainers = [ maintainers.sternenseemann ];
+    homepage = "https://github.com/mirage/mirage-net-xen";
+  };
+}
diff --git a/third_party/nixpkgs/pkgs/development/ocaml-modules/paf/default.nix b/third_party/nixpkgs/pkgs/development/ocaml-modules/paf/default.nix
new file mode 100644
index 0000000000..0c91051e24
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/development/ocaml-modules/paf/default.nix
@@ -0,0 +1,82 @@
+{ buildDunePackage
+, lib
+, fetchurl
+, fetchpatch
+, mirage-stack
+, mirage-time
+, httpaf
+, tls-mirage
+, mimic
+, cohttp-lwt
+, letsencrypt
+, emile
+, ke
+, bigstringaf
+, domain-name
+, duration
+, faraday
+, ipaddr
+, tls
+, x509
+, lwt
+, logs
+, fmt
+, mirage-crypto-rng
+, tcpip
+, mirage-time-unix
+, ptime
+, uri
+, alcotest-lwt
+}:
+
+buildDunePackage rec {
+  pname = "paf";
+  version = "0.0.1";
+
+  src = fetchurl {
+    url = "https://github.com/dinosaure/paf-le-chien/releases/download/${version}/paf-${version}.tbz";
+    sha256 = "7a794c21ce458bda302553b0f5ac128c067579fbb3b7b8fba9b410446c43e790";
+  };
+
+  useDune2 = true;
+  minimumOCamlVersion = "4.08";
+
+  propagatedBuildInputs = [
+    mirage-stack
+    mirage-time
+    httpaf
+    tls-mirage
+    mimic
+    cohttp-lwt
+    letsencrypt
+    emile
+    ke
+    bigstringaf
+    domain-name
+    ipaddr
+    duration
+    faraday
+    tls
+    x509
+  ];
+
+  doCheck = true;
+  checkInputs = [
+    lwt
+    logs
+    fmt
+    mirage-crypto-rng
+    tcpip
+    mirage-time-unix
+    ptime
+    uri
+    alcotest-lwt
+  ];
+
+  meta = {
+    description = "HTTP/AF and MirageOS";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.sternenseemann ];
+    homepage = "https://github.com/dinosaure/paf-le-chien";
+  };
+}
diff --git a/third_party/nixpkgs/pkgs/development/ocaml-modules/shared-memory-ring/default.nix b/third_party/nixpkgs/pkgs/development/ocaml-modules/shared-memory-ring/default.nix
new file mode 100644
index 0000000000..3a96d4adee
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/development/ocaml-modules/shared-memory-ring/default.nix
@@ -0,0 +1,41 @@
+{ lib
+, buildDunePackage
+, fetchurl
+, ppx_cstruct
+, mirage-profile
+, cstruct
+, ounit
+}:
+
+buildDunePackage rec {
+  pname = "shared-memory-ring";
+  version = "3.1.0";
+
+  useDune2 = true;
+
+  src = fetchurl {
+    url = "https://github.com/mirage/shared-memory-ring/releases/download/v${version}/shared-memory-ring-v${version}.tbz";
+    sha256 = "06350ph3rdfvybi0cgs3h3rdkmjspk3c4375rxvbdg0kza1w22x1";
+  };
+
+  nativeBuildInputs = [
+    ppx_cstruct
+  ];
+
+  propagatedBuildInputs = [
+    mirage-profile
+    cstruct
+  ];
+
+  doCheck = true;
+  checkInputs = [
+    ounit
+  ];
+
+  meta = with lib; {
+    description = "Shared memory rings for RPC and bytestream communications";
+    license = licenses.isc;
+    homepage = "https://github.com/mirage/shared-memory-ring";
+    maintainers = [ maintainers.sternenseemann ];
+  };
+}
diff --git a/third_party/nixpkgs/pkgs/development/ocaml-modules/shared-memory-ring/lwt.nix b/third_party/nixpkgs/pkgs/development/ocaml-modules/shared-memory-ring/lwt.nix
new file mode 100644
index 0000000000..8f41253bab
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/development/ocaml-modules/shared-memory-ring/lwt.nix
@@ -0,0 +1,37 @@
+{ lib
+, buildDunePackage
+, shared-memory-ring
+, ppx_cstruct
+, cstruct
+, lwt
+, lwt-dllist
+, mirage-profile
+, ounit
+}:
+
+buildDunePackage {
+  pname = "shared-memory-ring-lwt";
+
+  inherit (shared-memory-ring) version src useDune2;
+
+  buildInputs = [
+    ppx_cstruct
+  ];
+
+  propagatedBuildInputs = [
+    shared-memory-ring
+    cstruct
+    lwt
+    lwt-dllist
+    mirage-profile
+  ];
+
+  doCheck = true;
+  checkInputs = [
+    ounit
+  ];
+
+  meta = shared-memory-ring.meta // {
+    description = "Shared memory rings for RPC and bytestream communications using Lwt";
+  };
+}
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/Fabric/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/Fabric/default.nix
index 1025ed6a05..2e70d3aa12 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/Fabric/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/Fabric/default.nix
@@ -9,13 +9,19 @@
 
 buildPythonPackage rec {
   pname = "fabric";
-  version = "2.5.0";
+  version = "2.6.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "19nzdibjfndzcwvby20p59igqwyzw7skrb45v2mxqsjma5yjv114";
+    sha256 = "47f184b070272796fd2f9f0436799e18f2ccba4ee8ee587796fca192acd46cd2";
   };
 
+  # only relevant to python < 3.4
+  postPatch = ''
+    substituteInPlace setup.py \
+        --replace ', "pathlib2"' ' '
+  '';
+
   propagatedBuildInputs = [ invoke paramiko cryptography ];
   checkInputs = [ pytest mock pytest-relaxed ];
 
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/GitPython/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/GitPython/default.nix
index 0081051628..547be5dc4d 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/GitPython/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/GitPython/default.nix
@@ -10,12 +10,12 @@
 
 buildPythonPackage rec {
   pname = "GitPython";
-  version = "3.1.13";
+  version = "3.1.14";
   disabled = isPy27; # no longer supported
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-hiGn53fidqXsg4tZKAulJy3RRKGBacNskD2LOLmfdQo=";
+    sha256 = "be27633e7509e58391f10207cd32b2a6cf5b908f92d9cd30da2e514e1137af61";
   };
 
   patches = [
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/Markups/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/Markups/default.nix
index eb802989a5..012f31c266 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/Markups/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/Markups/default.nix
@@ -9,11 +9,11 @@
 
 buildPythonPackage rec {
   pname = "Markups";
-  version = "3.0.0";
+  version = "3.1.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1ea19458dfca6a4562044e701aa8698089a0c659fc535689ed260f89a04f8d39";
+    sha256 = "e309d79dde0935576ce1def6752f2127a12e2c2ea2ae8b0c69f99ff8bc12181d";
   };
 
   checkInputs = [ markdown docutils pygments ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/Pygments/2_5.nix b/third_party/nixpkgs/pkgs/development/python-modules/Pygments/2_5.nix
index 965e6f0ec3..aa59c370d2 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/Pygments/2_5.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/Pygments/2_5.nix
@@ -3,7 +3,6 @@
 , fetchPypi
 , fetchpatch
 , docutils
-, pytestCheckHook
 }:
 
 buildPythonPackage rec {
@@ -26,7 +25,8 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [ docutils ];
 
-  checkInputs = [ pytestCheckHook ];
+  # Circular dependency with sphinx
+  doCheck = false;
 
   meta = {
     homepage = "https://pygments.org/";
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/Pygments/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/Pygments/default.nix
index 48d74fddd4..1f4795ac38 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/Pygments/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/Pygments/default.nix
@@ -2,23 +2,22 @@
 , buildPythonPackage
 , fetchPypi
 , docutils
-, pytestCheckHook
-, doCheck ? true
 }:
 
 buildPythonPackage rec {
   pname = "Pygments";
-  version = "2.7.4";
+  version = "2.8.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "df49d09b498e83c1a73128295860250b0b7edd4c723a32e9bc0d295c7c2ec337";
+    sha256 = "153zyxigm879sk2n71lfv03y2pgxb7dl0dlsbwkz9aydxnkf2mi6";
   };
 
   propagatedBuildInputs = [ docutils ];
 
-  inherit doCheck;
-  checkInputs = [ pytestCheckHook ];
+  # Circular dependency with sphinx
+  doCheck = false;
+  pythonImportsCheck = [ "pygments" ];
 
   meta = {
     homepage = "https://pygments.org/";
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/absl-py/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/absl-py/default.nix
index e70d830b7b..ddb6ae1c2e 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/absl-py/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/absl-py/default.nix
@@ -8,11 +8,11 @@
 
 buildPythonPackage rec {
   pname = "absl-py";
-  version = "0.11.0";
+  version = "0.12.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "673cccb88d810e5627d0c1c818158485d106f65a583880e2f730c997399bcfa7";
+    sha256 = "b44f68984a5ceb2607d135a615999b93924c771238a63920d17d3387b0d229d5";
   };
 
   propagatedBuildInputs = [
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/aiobotocore/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/aiobotocore/default.nix
index 5d9c3fe166..f75a0d6bb6 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/aiobotocore/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/aiobotocore/default.nix
@@ -10,12 +10,12 @@
 
 buildPythonPackage rec {
   pname = "aiobotocore";
-  version = "1.1.2";
+  version = "1.2.2";
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1fn9hgcg3qr9f7srjxc21bzkiix4al9308531slwlm99r0x3xcjl";
+    sha256 = "37c23166603a3bd134e5f6fc22dbbf8c274d4d24c71418fba292ed2cd7a0bf43";
   };
 
   # relax version constraints: aiobotocore works with newer botocore versions
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/aiodns/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/aiodns/default.nix
index 1adc6f8152..05e17ec12f 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/aiodns/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/aiodns/default.nix
@@ -1,5 +1,7 @@
 { lib, buildPythonPackage, fetchPypi, pythonOlder
-, isPy27, isPyPy, python, pycares, typing, trollius }:
+, isPy27, isPyPy, python, pycares, typing ? null
+, trollius ? null
+}:
 
 buildPythonPackage rec {
   pname = "aiodns";
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/aioeventlet/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/aioeventlet/default.nix
index 0d6796706c..ef0166e5d6 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/aioeventlet/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/aioeventlet/default.nix
@@ -2,7 +2,7 @@
 , buildPythonPackage
 , fetchPypi
 , eventlet
-, trollius
+, trollius ? null
 , mock
 , python
 }:
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/aiohttp-cors/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/aiohttp-cors/default.nix
index 00198cd27c..fc5dc87f4e 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/aiohttp-cors/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/aiohttp-cors/default.nix
@@ -1,5 +1,5 @@
 { lib, buildPythonPackage, fetchPypi, pythonOlder
-, typing, aiohttp
+, typing ? null, aiohttp
 }:
 
 buildPythonPackage rec {
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/alembic/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/alembic/default.nix
index 5a4ef5e0bc..899bea2acb 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/alembic/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/alembic/default.nix
@@ -5,11 +5,11 @@
 
 buildPythonPackage rec {
   pname = "alembic";
-  version = "1.4.3";
+  version = "1.5.8";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "5334f32314fb2a56d86b4c4dd1ae34b08c03cae4cb888bc699942104d66bc245";
+    sha256 = "e27fd67732c97a1c370c33169ef4578cf96436fa0e7dcfaeeef4a917d0737d56";
   };
 
   buildInputs = [ pytest pytestcov mock coverage ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/altair/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/altair/default.nix
index 99ee559da6..6e686d9fc9 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/altair/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/altair/default.nix
@@ -12,7 +12,7 @@
 , six
 , sphinx
 , toolz
-, typing
+, typing ? null
 , vega_datasets
 }:
 
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/aniso8601/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/aniso8601/default.nix
index 90d34951e4..f28668a891 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/aniso8601/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/aniso8601/default.nix
@@ -3,7 +3,7 @@
 
 buildPythonPackage rec {
   pname = "aniso8601";
-  version = "8.1.1";
+  version = "9.0.1";
 
   meta = with lib; {
     description = "Parses ISO 8601 strings.";
@@ -17,6 +17,6 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "be08b19c19ca527af722f2d4ba4dc569db292ec96f7de963746df4bb0bff9250";
+    sha256 = "72e3117667eedf66951bb2d93f4296a56b94b078a8a95905a052611fb3f1b973";
   };
 }
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/arabic-reshaper/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/arabic-reshaper/default.nix
index ad5f64146a..88675337b4 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/arabic-reshaper/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/arabic-reshaper/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "arabic_reshaper";
-  version = "2.1.1";
+  version = "2.1.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "zzGPpdUdLSJPpJv2vbu0aE9r0sBot1z84OYH+JrBmdw=";
+    sha256 = "a236fc6e9dde2a61cc6a5ca962b522e42694e1bb2a2d86894ed7a4eba4ce1890";
   };
 
   propagatedBuildInputs = [ future ]
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/arrow/2.nix b/third_party/nixpkgs/pkgs/development/python-modules/arrow/2.nix
new file mode 100644
index 0000000000..d87f1ede3c
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/development/python-modules/arrow/2.nix
@@ -0,0 +1,40 @@
+{ lib, buildPythonPackage, fetchPypi, isPy27
+, nose, chai, simplejson, backports_functools_lru_cache
+, python-dateutil, pytz, pytest-mock, sphinx, dateparser, pytestcov
+, pytestCheckHook
+}:
+
+buildPythonPackage rec {
+  pname = "arrow";
+  version = "0.17.0";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "ff08d10cda1d36c68657d6ad20d74fbea493d980f8b2d45344e00d6ed2bf6ed4";
+  };
+
+  propagatedBuildInputs = [ python-dateutil ]
+    ++ lib.optionals isPy27 [ backports_functools_lru_cache ];
+
+  checkInputs = [
+    dateparser
+    pytestCheckHook
+    pytestcov
+    pytest-mock
+    pytz
+    simplejson
+    sphinx
+  ];
+
+  # ParserError: Could not parse timezone expression "America/Nuuk"
+  disabledTests = [
+    "test_parse_tz_name_zzz"
+  ];
+
+  meta = with lib; {
+    description = "Python library for date manipulation";
+    homepage = "https://github.com/crsmithdev/arrow";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ thoughtpolice ];
+  };
+}
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/arrow/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/arrow/default.nix
index d87f1ede3c..93347d7a4b 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/arrow/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/arrow/default.nix
@@ -6,11 +6,11 @@
 
 buildPythonPackage rec {
   pname = "arrow";
-  version = "0.17.0";
+  version = "1.0.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "ff08d10cda1d36c68657d6ad20d74fbea493d980f8b2d45344e00d6ed2bf6ed4";
+    sha256 = "399c9c8ae732270e1aa58ead835a79a40d7be8aa109c579898eb41029b5a231d";
   };
 
   propagatedBuildInputs = [ python-dateutil ]
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/arviz/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/arviz/default.nix
index 4005c86681..39a0d38a0e 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/arviz/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/arviz/default.nix
@@ -22,13 +22,13 @@
 
 buildPythonPackage rec {
   pname = "arviz";
-  version = "0.10.0";
+  version = "0.11.2";
 
   src = fetchFromGitHub {
     owner = "arviz-devs";
     repo = "arviz";
     rev = "v${version}";
-    sha256 = "1cnj972knkvi084cfcpc12lv0wxm8xm9clfd55r3hvv42g1ms5d9";
+    sha256 = "0npwrpy262y6zqd0znz4w7ikfdyz4kc4gikmkpj6h1j6vxggrfaa";
   };
 
   propagatedBuildInputs = [
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/asgiref/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/asgiref/default.nix
index ec630c40d0..f1128c0109 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/asgiref/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/asgiref/default.nix
@@ -9,7 +9,7 @@
 }:
 
 buildPythonPackage rec {
-  version = "3.3.1";
+  version = "3.3.4";
   pname = "asgiref";
 
   disabled = pythonOlder "3.5";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "django";
     repo = pname;
     rev = version;
-    sha256 = "00r4l9x425wkbac6b6c2ksm2yjinrvvdf0ajizrzq32h0jg82016";
+    sha256 = "1rr76252l6p12yxc0q4k9wigg1jz8nsqga9c0nixy9q77zhvh9n2";
   };
 
   propagatedBuildInputs = [ async-timeout ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/astroid/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/astroid/default.nix
index 468488ec0c..77ac408076 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/astroid/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/astroid/default.nix
@@ -11,13 +11,13 @@
 
 buildPythonPackage rec {
   pname = "astroid";
-  version = "2.5";
+  version = "2.5.1";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "03dzhjrsc5d2whyjngfrwvxn42058k0cjjr85x2wqzai8psr475k";
+    sha256 = "cfc35498ee64017be059ceffab0a25bedf7548ab76f2bea691c5565896e7128d";
   };
 
   # From astroid/__pkginfo__.py
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/astropy-healpix/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/astropy-healpix/default.nix
index 61f49322d3..e82faba975 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/astropy-healpix/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/astropy-healpix/default.nix
@@ -8,13 +8,13 @@
 
 buildPythonPackage rec {
   pname = "astropy-healpix";
-  version = "0.5";
+  version = "0.6";
 
   doCheck = false; # tests require pytest-astropy
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1bfdq33mj6mwk5fkc6n23f9bc9z8j7kmvql3zchz4h58jskmvqas";
+    sha256 = "409a6621c383641456c074f0f0350a24a4a58e910eaeef14e9bbce3e00ad6690";
   };
 
   propagatedBuildInputs = [ numpy astropy astropy-helpers ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/atlassian-python-api/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/atlassian-python-api/default.nix
index b1f0df0b3b..617d5562b4 100755
--- a/third_party/nixpkgs/pkgs/development/python-modules/atlassian-python-api/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/atlassian-python-api/default.nix
@@ -17,11 +17,11 @@
 
 buildPythonPackage rec {
   pname = "atlassian-python-api";
-  version = "2.1.2";
+  version = "3.8.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "f852bfd293fdcb0ab2d7a9ea907f8303cf14fe6f55e90c103d4de00393ea9555";
+    sha256 = "7ef384a91a790c807336e2bd6b7554284691aadd6d7413d199baf752dd84c53e";
   };
 
   checkInputs = [ pytestrunner pytest ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/autobahn/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/autobahn/default.nix
index 12aa86774d..386d4766bb 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/autobahn/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/autobahn/default.nix
@@ -1,14 +1,15 @@
 { lib, buildPythonPackage, fetchPypi, isPy3k,
-  six, txaio, twisted, zope_interface, cffi, trollius, futures,
+  six, txaio, twisted, zope_interface, cffi,
+  trollius ? null, futures ? null,
   mock, pytest, cryptography, pynacl
 }:
 buildPythonPackage rec {
   pname = "autobahn";
-  version = "20.12.3";
+  version = "21.3.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "15b8zm7jalwisfwc08szxy3bh2bnn0hd41dbsnswi0lqwbh962j1";
+    sha256 = "e126c1f583e872fb59e79d36977cfa1f2d0a8a79f90ae31f406faae7664b8e03";
   };
 
   propagatedBuildInputs = [ six txaio twisted zope_interface cffi cryptography pynacl ] ++
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/autopep8/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/autopep8/default.nix
index fa3482c079..491663b56c 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/autopep8/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/autopep8/default.nix
@@ -4,11 +4,11 @@
 
 buildPythonPackage rec {
   pname = "autopep8";
-  version = "1.5.5";
+  version = "1.5.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "cae4bc0fb616408191af41d062d7ec7ef8679c7f27b068875ca3a9e2878d5443";
+    sha256 = "5454e6e9a3d02aae38f866eec0d9a7de4ab9f93c10a273fb0340f3d6d09f7514";
   };
 
   propagatedBuildInputs = [ pycodestyle toml ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/aws-lambda-builders/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/aws-lambda-builders/default.nix
index 804ad078ac..30059fe5a9 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/aws-lambda-builders/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/aws-lambda-builders/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "aws-lambda-builders";
-  version = "1.1.0";
+  version = "1.3.0";
 
   # No tests available in PyPI tarball
   src = fetchFromGitHub {
     owner = "awslabs";
     repo = "aws-lambda-builders";
     rev = "v${version}";
-    sha256 = "1r4939m5k1nj6l9bv972z4fkmkl0z5f5r29bq7588yk113kkqr0c";
+    sha256 = "1cfacp0a5qsaf3crcybslhbfwm1mqfyafj71dlvnidzx7b9bm60v";
   };
 
   # Package is not compatible with Python 3.5
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/aws-sam-translator/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/aws-sam-translator/default.nix
index 1c067bcec2..d996c34b50 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/aws-sam-translator/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/aws-sam-translator/default.nix
@@ -10,11 +10,11 @@
 
 buildPythonPackage rec {
   pname = "aws-sam-translator";
-  version = "1.32.0";
+  version = "1.35.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "jL+sAlKbeXA1QeJVQbAcgIaPEbD/Ko+QMrI1Ew2dVq4=";
+    sha256 = "5cf7faab3566843f3b44ef1a42a9c106ffb50809da4002faab818076dcc7bff8";
   };
 
   # Tests are not included in the PyPI package
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/aws-xray-sdk/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/aws-xray-sdk/default.nix
index 313dd4241d..0e1c272b3c 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/aws-xray-sdk/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/aws-xray-sdk/default.nix
@@ -12,11 +12,11 @@
 
 buildPythonPackage rec {
   pname = "aws-xray-sdk";
-  version = "2.6.0";
+  version = "2.7.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "abf5b90f740e1f402e23414c9670e59cb9772e235e271fef2bce62b9100cbc77";
+    sha256 = "697c9068e84dd5d2c1456def3fd0865f226046b5db4db56d738050e425960adf";
   };
 
   propagatedBuildInputs = [
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/azure-cosmosdb-table/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/azure-cosmosdb-table/default.nix
index 5c580ccd3e..8d92e1559d 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/azure-cosmosdb-table/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/azure-cosmosdb-table/default.nix
@@ -5,7 +5,7 @@
 , azure-common
 , azure-storage-common
 , azure-cosmosdb-nspkg
-, futures
+, futures ? null
 , isPy3k
 }:
 
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/azure-datalake-store/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/azure-datalake-store/default.nix
index 0e97752ae5..f2c57d7662 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/azure-datalake-store/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/azure-datalake-store/default.nix
@@ -4,7 +4,7 @@
 , requests
 , adal
 , azure-common
-, futures
+, futures ? null
 , pathlib2
 , isPy3k
 }:
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/azure-mgmt-synapse/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/azure-mgmt-synapse/default.nix
index fcde20b9bf..1b26495e9b 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/azure-mgmt-synapse/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/azure-mgmt-synapse/default.nix
@@ -1,22 +1,24 @@
 { lib, buildPythonPackage, fetchPypi, pythonOlder
 , azure-common
+, azure-mgmt-core
 , msrest
 , msrestazure
 }:
 
 buildPythonPackage rec {
   pname = "azure-mgmt-synapse";
-  version = "0.7.0";
+  version = "1.0.0";
   disabled = pythonOlder "3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "3cf37df471f75441b0afe98a0f3a548434e9bc6a6426dca8c089950b5423f63f";
+    sha256 = "d5514dfef93294a2d9b8ff6fdb353b3102abd5750f147d904e6012f24113ff9c";
     extension = "zip";
   };
 
   propagatedBuildInputs = [
     azure-common
+    azure-mgmt-core
     msrest
     msrestazure
   ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/azure-servicebus/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/azure-servicebus/default.nix
index b0c0a9e96c..d885166daa 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/azure-servicebus/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/azure-servicebus/default.nix
@@ -5,7 +5,7 @@
 , azure-common
 , azure-core
 , msrestazure
-, futures
+, futures ? null
 , isPy3k
 }:
 
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/azure-storage-blob/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/azure-storage-blob/default.nix
index 7367e9604b..bbcf84ef6a 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/azure-storage-blob/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/azure-storage-blob/default.nix
@@ -6,7 +6,7 @@
 , azure-storage-common
 , msrest
 , isPy3k
-, futures
+, futures ? null
 }:
 
 buildPythonPackage rec {
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/azure-storage-file-share/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/azure-storage-file-share/default.nix
index c6413f191f..fc98e4207e 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/azure-storage-file-share/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/azure-storage-file-share/default.nix
@@ -7,7 +7,7 @@
 , azure-core
 , cryptography
 , msrest
-, futures
+, futures ? null
 }:
 
 buildPythonPackage rec {
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/azure-storage-file/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/azure-storage-file/default.nix
index 088b5260e6..8ce1d572e8 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/azure-storage-file/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/azure-storage-file/default.nix
@@ -4,7 +4,7 @@
 , azure-common
 , azure-storage-common
 , isPy3k
-, futures
+, futures ? null
 }:
 
 buildPythonPackage rec {
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/azure-storage/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/azure-storage/default.nix
index e2037bb7d2..258a5ebabb 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/azure-storage/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/azure-storage/default.nix
@@ -3,7 +3,7 @@
 , fetchPypi
 , python
 , azure-common
-, futures
+, futures ? null
 , dateutil
 , requests
 , isPy3k
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/b2sdk/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/b2sdk/default.nix
index cd695132d7..b4a3e7acae 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/b2sdk/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/b2sdk/default.nix
@@ -1,20 +1,27 @@
-{ lib, buildPythonPackage, fetchPypi, setuptools_scm, isPy27, pytestCheckHook
+{ lib, buildPythonPackage, fetchPypi, setuptools-scm, isPy27, pytestCheckHook
 , requests, arrow, logfury, tqdm }:
 
 buildPythonPackage rec {
   pname = "b2sdk";
-  version = "1.2.0";
+  version = "1.6.0";
 
   disabled = isPy27;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "8e46ff9d47a9b90d8b9beab1969fcf4920300b02e20e6bf0745be04e09e8a6ff";
+    sha256 = "sha256-6fjreuMUC056ljddfAidfBbJkvEDndB/dIkx1bF7efs=";
   };
 
+  postPatch = ''
+    substituteInPlace setup.py \
+      --replace 'setuptools_scm<6.0' 'setuptools_scm'
+    substituteInPlace requirements.txt \
+      --replace 'arrow>=0.8.0,<1.0.0' 'arrow'
+  '';
+
   pythonImportsCheck = [ "b2sdk" ];
 
-  nativebuildInputs = [ setuptools_scm ];
+  nativeBuildInputs = [ setuptools-scm ];
   propagatedBuildInputs = [ requests arrow logfury tqdm ];
 
   # requires unpackaged dependencies like liccheck
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/backports-entry-points-selectable/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/backports-entry-points-selectable/default.nix
new file mode 100644
index 0000000000..02117f7282
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/development/python-modules/backports-entry-points-selectable/default.nix
@@ -0,0 +1,36 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, pythonOlder
+, importlib-metadata
+, pytestCheckHook
+}:
+
+buildPythonPackage rec {
+  pname = "backports.entry-points-selectable";
+  version = "1.0.4";
+
+  src = fetchPypi {
+    inherit version;
+    # pypi project name and tarball name differ
+    pname = builtins.replaceStrings [ "-" ] [ "_" ] pname;
+    sha256 = "4acda84d96855beece3bf9aad9a1030aceb5f744b8ce9af7d5ee6dd672cdd3bd";
+  };
+
+  format = "pyproject";
+
+  propagatedBuildInputs = lib.optionals (pythonOlder "3.8") [
+    importlib-metadata
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  meta = with lib; {
+    description = "Compatibility shim providing selectable entry points for older implementations";
+    license = licenses.mit;
+    maintainers = [ maintainers.sternenseemann ];
+    homepage = "https://github.com/jaraco/backports.entry_points_selectable";
+  };
+}
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/backports_functools_lru_cache/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/backports_functools_lru_cache/default.nix
index 79e11ecae4..6c0d1df81f 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/backports_functools_lru_cache/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/backports_functools_lru_cache/default.nix
@@ -11,11 +11,11 @@
 
 buildPythonPackage rec {
   pname = "backports.functools_lru_cache";
-  version = "1.6.1";
+  version = "1.6.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "8fde5f188da2d593bd5bc0be98d9abc46c95bb8a9dde93429570192ee6cc2d4a";
+    sha256 = "d84e126e2a29e4fde8931ff8131240bbf30a0e7dbcc3897a8dbd8ea5ac11419c";
   };
 
   nativeBuildInputs = [ setuptools_scm ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/beaker/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/beaker/default.nix
index a429ab682f..60823b4c07 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/beaker/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/beaker/default.nix
@@ -15,8 +15,8 @@
 , cryptography
 , isPy27
 , isPy3k
-, funcsigs
-, pycryptopp
+, funcsigs ? null
+, pycryptopp ? null
 }:
 
 buildPythonPackage rec {
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/bitmath/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/bitmath/default.nix
index 5643ea29bc..66a4285865 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/bitmath/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/bitmath/default.nix
@@ -1,4 +1,4 @@
-{ lib, buildPythonPackage, fetchPypi, isPy3k, progressbar231, progressbar33, mock }:
+{ lib, buildPythonPackage, fetchPypi, isPy3k, progressbar231 ? null, progressbar33, mock }:
 
 buildPythonPackage rec {
   pname = "bitmath";
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/blessed/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/blessed/default.nix
index f0167625cf..6be290f0f7 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/blessed/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/blessed/default.nix
@@ -4,11 +4,11 @@
 
 buildPythonPackage rec {
   pname = "blessed";
-  version = "1.17.12";
+  version = "1.18.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "580429e7e0c6f6a42ea81b0ae5a4993b6205c6ccbb635d034b4277af8175753e";
+    sha256 = "1312879f971330a1b7f2c6341f2ae7e2cbac244bfc9d0ecfbbecd4b0293bc755";
   };
 
   checkInputs = [ pytest mock glibcLocales ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/bokeh/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/bokeh/default.nix
index cbe00ec32f..18fea10366 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/bokeh/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/bokeh/default.nix
@@ -1,6 +1,6 @@
 { buildPythonPackage
 , fetchPypi
-, futures
+, futures ? null
 , isPy27
 , isPyPy
 , jinja2
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/boto3/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/boto3/default.nix
index a85ea39842..afeefbdf55 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/boto3/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/boto3/default.nix
@@ -4,7 +4,7 @@
 , botocore
 , jmespath
 , s3transfer
-, futures
+, futures ? null
 , docutils
 , nose
 , mock
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/bpython/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/bpython/default.nix
index 8a37ed0bd9..55e6654553 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/bpython/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/bpython/default.nix
@@ -12,11 +12,11 @@
 
 buildPythonPackage rec {
   pname = "bpython";
-  version = "0.20.1";
+  version = "0.21";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "6e7738806013b469be57b0117082b9c4557ed7c92c70ceb79f96d674d89c7503";
+    sha256 = "88aa9b89974f6a7726499a2608fa7ded216d84c69e78114ab2ef996a45709487";
   };
 
   patches = [ (substituteAll {
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/brotli/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/brotli/default.nix
index 0da53ab5ca..1edc62317a 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/brotli/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/brotli/default.nix
@@ -2,14 +2,16 @@
 
 buildPythonPackage rec {
   pname = "brotli";
-  version = "1.0.7";
+  version = "1.0.9";
 
   # PyPI doesn't contain tests so let's use GitHub
   src = fetchFromGitHub {
     owner = "google";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1811b55wdfg4kbsjcgh1kc938g118jpvif97ilgrmbls25dfpvvw";
+    sha256 = "1rdp9rx197q467ixp53g4cgc3jbsdaxr62pz0a8ayv2lvm944azh";
+    # for some reason, the test data isn't captured in releases, force a git checkout
+    deepClone = true;
   };
 
   dontConfigure = true;
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/btrfs/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/btrfs/default.nix
index adaf1f610e..ff21d5670d 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/btrfs/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/btrfs/default.nix
@@ -1,17 +1,23 @@
 { lib
 , buildPythonPackage
-, fetchPypi
+, fetchFromGitHub
 }:
 
 buildPythonPackage rec {
   pname = "btrfs";
-  version = "11";
+  version = "12";
 
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "1w92sj47wy53ygz725xr613k32pk5khi0g9lrpp6img871241hrx";
+  src = fetchFromGitHub {
+    owner = "knorrie";
+    repo = "python-btrfs";
+    rev = "v${version}";
+    sha256 = "sha256-ZQSp+pbHABgBTrCwC2YsUUXAf/StP4ny7MEhBgCRqgE=";
   };
 
+  # no tests (in v12)
+  doCheck = false;
+  pythonImportsCheck = [ "btrfs" ];
+
   meta = with lib; {
     description = "Inspect btrfs filesystems";
     homepage = "https://github.com/knorrie/python-btrfs";
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/build/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/build/default.nix
index b5dce09d51..639dc53bab 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/build/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/build/default.nix
@@ -12,7 +12,7 @@
 , pytestCheckHook
 , pythonOlder
 , toml
-, typing
+, typing ? null
 }:
 
 buildPythonPackage rec {
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/can/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/can/default.nix
index ea49c9b4a7..255a100ec6 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/can/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/can/default.nix
@@ -5,7 +5,7 @@
 , isPy27
 , aenum
 , wrapt
-, typing
+, typing ? null
 , pyserial
 , nose
 , mock
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/canmatrix/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/canmatrix/default.nix
index 8ffacc1a99..d36f6805cc 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/canmatrix/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/canmatrix/default.nix
@@ -7,7 +7,7 @@
 , click
 , future
 , pathlib2
-, typing
+, typing ? null
 , lxml
 , xlwt
 , xlrd
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/cassandra-driver/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/cassandra-driver/default.nix
index 55468ba0fd..1647930222 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/cassandra-driver/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/cassandra-driver/default.nix
@@ -1,7 +1,7 @@
 { stdenv, lib, buildPythonPackage, fetchFromGitHub, python, pythonOlder
 , cython
 , eventlet
-, futures
+, futures ? null
 , iana-etc
 , geomet
 , libev
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/cfn-lint/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/cfn-lint/default.nix
index f55042c58d..a5f2290899 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/cfn-lint/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/cfn-lint/default.nix
@@ -21,13 +21,13 @@
 
 buildPythonPackage rec {
   pname = "cfn-lint";
-  version = "0.42.0";
+  version = "0.48.0";
 
   src = fetchFromGitHub {
     owner = "aws-cloudformation";
     repo = "cfn-python-lint";
     rev = "v${version}";
-    sha256 = "0cqpq7pxpslpd7am6mp6nmwhsb2p2a5lq3hjjxi8imv3wv7zql98";
+    sha256 = "03j5w9cyvpbxh634jd2dhkgfs3c2hmgqh77w664855lgy2ph9zll";
   };
 
   postPatch = ''
@@ -67,6 +67,9 @@ buildPythonPackage rec {
     "TestQuickStartTemplates"
     # requires git directory
     "test_update_docs"
+    # Tests depend on network access (fails in getaddrinfo)
+    "test_update_resource_specs_python_2"
+    "test_update_resource_specs_python_3"
   ];
 
   pythonImportsCheck = [
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/chalice/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/chalice/default.nix
index 9115b1d57c..e99f321df3 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/chalice/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/chalice/default.nix
@@ -15,18 +15,18 @@
 , pyyaml
 , setuptools
 , six
-, typing
+, typing ? null
 , watchdog
 , wheel
 }:
 
 buildPythonPackage rec {
   pname = "chalice";
-  version = "1.21.9";
+  version = "1.22.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "312f88838c8ea4b4ac79dce0e5b4ba3125130ca66ea99a4694f535501dca95e3";
+    sha256 = "5a84a73c4a8d8b22bb64e06ff99060d7f222097db4237e58749dcad5165f082d";
   };
 
   checkInputs = [ watchdog pytest hypothesis mock ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/chardet/2.nix b/third_party/nixpkgs/pkgs/development/python-modules/chardet/2.nix
new file mode 100644
index 0000000000..65381d4026
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/development/python-modules/chardet/2.nix
@@ -0,0 +1,29 @@
+{ lib, buildPythonPackage, fetchPypi, fetchpatch
+, pytest, pytestrunner, hypothesis }:
+
+buildPythonPackage rec {
+  pname = "chardet";
+  version = "3.0.4";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "1bpalpia6r5x1kknbk11p1fzph56fmmnp405ds8icksd3knr5aw4";
+  };
+
+  patches = [
+    # Add pytest 4 support. See: https://github.com/chardet/chardet/pull/174
+    (fetchpatch {
+      url = "https://github.com/chardet/chardet/commit/0561ddcedcd12ea1f98b7ddedb93686ed8a5ffa4.patch";
+      sha256 = "1y1xhjf32rdhq9sfz58pghwv794f3w2f2qcn8p6hp4pc8jsdrn2q";
+    })
+  ];
+
+  checkInputs = [ pytest pytestrunner hypothesis ];
+
+  meta = with lib; {
+    homepage = "https://github.com/chardet/chardet";
+    description = "Universal encoding detector";
+    license = licenses.lgpl2;
+    maintainers = with maintainers; [ domenkozar ];
+  };
+}
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/chardet/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/chardet/default.nix
index 65381d4026..7753d6ccfd 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/chardet/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/chardet/default.nix
@@ -1,29 +1,32 @@
-{ lib, buildPythonPackage, fetchPypi, fetchpatch
-, pytest, pytestrunner, hypothesis }:
+{ lib
+, buildPythonPackage
+, fetchPypi
+, hypothesis
+, pythonOlder
+, pytestCheckHook
+}:
 
 buildPythonPackage rec {
   pname = "chardet";
-  version = "3.0.4";
+  version = "4.0.0";
+  disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1bpalpia6r5x1kknbk11p1fzph56fmmnp405ds8icksd3knr5aw4";
+    sha256 = "sha256-DW9ToV20Eg8rCMlPEefZPSyRHuEYtrMKBOw+6DEBefo=";
   };
 
-  patches = [
-    # Add pytest 4 support. See: https://github.com/chardet/chardet/pull/174
-    (fetchpatch {
-      url = "https://github.com/chardet/chardet/commit/0561ddcedcd12ea1f98b7ddedb93686ed8a5ffa4.patch";
-      sha256 = "1y1xhjf32rdhq9sfz58pghwv794f3w2f2qcn8p6hp4pc8jsdrn2q";
-    })
+  checkInputs = [
+    hypothesis
+    pytestCheckHook
   ];
 
-  checkInputs = [ pytest pytestrunner hypothesis ];
+  pythonImportsCheck = [ "chardet" ];
 
   meta = with lib; {
-    homepage = "https://github.com/chardet/chardet";
     description = "Universal encoding detector";
-    license = licenses.lgpl2;
+    homepage = "https://github.com/chardet/chardet";
+    license = licenses.lgpl21Plus;
     maintainers = with maintainers; [ domenkozar ];
   };
 }
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/chart-studio/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/chart-studio/default.nix
index 6679f13b11..e059725cad 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/chart-studio/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/chart-studio/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "chart-studio";
-  version = "1.1.0";
+  version = "4.14.3";
 
   # chart-studio was split from plotly
   src = fetchFromGitHub {
     owner = "plotly";
     repo = "plotly.py";
-    rev = "${pname}-v${version}";
-    sha256 = "1q3j3ih5k0jhr8ilwffkfxp1nifpnjnx7862bzhxfg4d386hfg4i";
+    rev = "v${version}";
+    sha256 = "1yrrcn9032r3l8y2cc1wvpydg4rkqvgkpyv1s7znby5mrxa1rjma";
   };
 
   sourceRoot = "source/packages/python/chart-studio";
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/cheetah3/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/cheetah3/default.nix
index a705bffa81..5efb262908 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/cheetah3/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/cheetah3/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "Cheetah3";
-  version = "3.2.6";
+  version = "3.2.6.post1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "f1c2b693cdcac2ded2823d363f8459ae785261e61c128d68464c8781dba0466b";
+    sha256 = "58b5d84e5fbff6cf8e117414b3ea49ef51654c02ee887d155113c5b91d761967";
   };
 
   doCheck = false; # Circular dependency
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/cheroot/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/cheroot/default.nix
index 4d6c71a7e2..7e79d5c63a 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/cheroot/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/cheroot/default.nix
@@ -22,13 +22,13 @@
 
 buildPythonPackage rec {
   pname = "cheroot";
-  version = "8.4.8";
+  version = "8.5.2";
 
   disabled = !isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0r98qqdp9ww5r5ma6wf1n66r9813rrmfvc54z7yij39jkj5c528h";
+    sha256 = "f137d03fd5155b1364bea557a7c98168665c239f6c8cedd8f80e81cdfac01567";
   };
 
   nativeBuildInputs = [ setuptools_scm setuptools-scm-git-archive ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/cjkwrap/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/cjkwrap/default.nix
new file mode 100644
index 0000000000..43e5909ec4
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/development/python-modules/cjkwrap/default.nix
@@ -0,0 +1,19 @@
+{ lib, buildPythonPackage, fetchPypi }:
+
+buildPythonPackage rec {
+  pname = "CJKwrap";
+  version = "2.2";
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "1b603sg6c2gv9vmlxwr6r1qvhadqk3qp6vifmijris504zjx5ix2";
+  };
+
+  pythonImportsCheck = [ "cjkwrap" ];
+
+  meta = with lib; {
+    description = "A library for wrapping and filling CJK text";
+    homepage = "https://f.gallai.re/cjkwrap";
+    license = licenses.lgpl3Plus;
+    maintainers = [ maintainers.kaction ];
+  };
+}
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/class-registry/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/class-registry/default.nix
index 93c41cadea..3faf07966d 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/class-registry/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/class-registry/default.nix
@@ -4,7 +4,7 @@
   lib,
   nose,
   six,
-  typing,
+  typing ? null,
   isPy27,
 }:
 
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/clevercsv/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/clevercsv/default.nix
new file mode 100644
index 0000000000..36944b5dbe
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/development/python-modules/clevercsv/default.nix
@@ -0,0 +1,60 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, chardet
+, cleo
+, clikit
+, pandas
+, regex
+, tabview
+, python
+}:
+
+buildPythonPackage rec {
+  pname = "clevercsv";
+  version = "0.6.7";
+  format = "setuptools";
+
+  src = fetchFromGitHub {
+    owner = "alan-turing-institute";
+    repo = "CleverCSV";
+    rev = "v${version}";
+    sha256 = "0j3959bji48pkp0vnk7yls5l75ywjl77jdkvzs62n5mi5lky88p9";
+  };
+
+  propagatedBuildInputs = [
+    chardet
+    cleo
+    clikit
+    pandas
+    regex
+    tabview
+  ];
+
+  pythonImportsCheck = [
+    "clevercsv"
+    "clevercsv.cparser"
+  ];
+
+  checkPhase = ''
+    # by linking the installed version the tests also have access to compiled native libraries
+    rm -r clevercsv
+    ln -s $out/${python.sitePackages}/clevercsv/ clevercsv
+    # their ci only runs unit tests, there are also integration and fuzzing tests
+    ${python.interpreter} -m unittest discover -v -f -s ./tests/test_unit
+  '';
+
+  meta = with lib; {
+    description = "CleverCSV is a Python package for handling messy CSV files";
+    longDescription = ''
+       CleverCSV is a Python package for handling messy CSV files. It provides
+       a drop-in replacement for the builtin CSV module with improved dialect
+       detection, and comes with a handy command line application for working
+       with CSV files.
+    '';
+    homepage = "https://github.com/alan-turing-institute/CleverCSV";
+    changelog = "https://github.com/alan-turing-institute/CleverCSV/blob/master/CHANGELOG.md";
+    license = licenses.mit;
+    maintainers = with maintainers; [ hexa ];
+  };
+}
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/click-threading/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/click-threading/default.nix
index 6943a3dcfd..1579a6a6a8 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/click-threading/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/click-threading/default.nix
@@ -4,7 +4,7 @@
 , pytest
 , click
 , isPy3k
-, futures
+, futures ? null
 }:
 
 buildPythonPackage rec {
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/clikit/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/clikit/default.nix
index 7b07b09459..1f6be754be 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/clikit/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/clikit/default.nix
@@ -1,6 +1,6 @@
 { lib, buildPythonPackage, fetchPypi
 , isPy27, pythonAtLeast
-, pylev, pastel, typing, enum34, crashtest }:
+, pylev, pastel, typing ? null, enum34 ? null, crashtest }:
 
 buildPythonPackage rec {
   pname = "clikit";
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/cocotb/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/cocotb/default.nix
index ec5cbe8277..b634323838 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/cocotb/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/cocotb/default.nix
@@ -2,13 +2,13 @@
 
 buildPythonPackage rec {
   pname = "cocotb";
-  version = "1.4.0";
+  version = "1.5.1";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    sha256 = "0fv0mg8zh40ffq0q39s195y6hvjrzihpx0i3f7ba5881syw3x7p4";
+    sha256 = "02bw2i03vd4rcvdk10qdjl2lbvvy81cn9qpr8vzq8cm9h45689mv";
   };
 
   propagatedBuildInputs = [
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/configparser/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/configparser/default.nix
index e8610f053d..47fe88d4e6 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/configparser/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/configparser/default.nix
@@ -4,11 +4,11 @@
 
 buildPythonPackage rec {
   pname = "configparser";
-  version = "5.0.1";
+  version = "5.0.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "005c3b102c96f4be9b8f40dafbd4997db003d07d1caa19f37808be8031475f2a";
+    sha256 = "85d5de102cfe6d14a5172676f09d19c465ce63d6019cf0a4ef13385fc535e828";
   };
 
   # No tests available
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/confluent-kafka/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/confluent-kafka/default.nix
index 589753cd1c..d07930b5e5 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/confluent-kafka/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/confluent-kafka/default.nix
@@ -1,4 +1,4 @@
-{ lib, buildPythonPackage, fetchPypi, isPy3k, rdkafka, requests, avro3k, avro, futures, enum34 }:
+{ lib, buildPythonPackage, fetchPypi, isPy3k, rdkafka, requests, avro3k, avro ? null, futures ? null, enum34 ? null }:
 
 buildPythonPackage rec {
   version = "1.6.0";
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/connexion/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/connexion/default.nix
index 6b212be3bb..25925f5606 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/connexion/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/connexion/default.nix
@@ -26,7 +26,7 @@
 , six
 , swagger-ui-bundle
 , testfixtures
-, typing
+, typing ? null
 , ujson
 }:
 
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/construct/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/construct/default.nix
index 8d0c83ca9e..3a3a3d3271 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/construct/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/construct/default.nix
@@ -1,10 +1,11 @@
 { lib, stdenv, buildPythonPackage, fetchFromGitHub, pythonOlder
 , six, pytestCheckHook, pytest-benchmark, numpy, arrow, ruamel_yaml
+, lz4, cloudpickle
 }:
 
 buildPythonPackage rec {
   pname   = "construct";
-  version = "2.10.56";
+  version = "2.10.63";
 
   disabled = pythonOlder "3.6";
 
@@ -13,10 +14,15 @@ buildPythonPackage rec {
     owner  = pname;
     repo   = pname;
     rev    = "v${version}";
-    sha256 = "1j4mqwyxkbdcsnnk5bbdcljv855w4fglaqc94q1xdzm8kgjxk4mr";
+    sha256 = "0dnj815qdxrn0q6bpwsmkca2jy02gjy6d3amqg4y6gha1kc1mymv";
   };
 
-  checkInputs = [ pytestCheckHook pytest-benchmark numpy arrow ruamel_yaml ];
+  # not an explicit dependency, but it's imported by an entrypoint
+  propagatedBuildInputs = [
+    lz4
+  ];
+
+  checkInputs = [ pytestCheckHook pytest-benchmark numpy arrow ruamel_yaml cloudpickle ];
 
   disabledTests = lib.optionals stdenv.isDarwin [ "test_multiprocessing" ];
 
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/coverage/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/coverage/default.nix
index b7bb3c8113..5a7fe9a534 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/coverage/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/coverage/default.nix
@@ -6,11 +6,11 @@
 
 buildPythonPackage rec {
   pname = "coverage";
-  version = "5.3.1";
+  version = "5.5";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "38f16b1317b8dd82df67ed5daa5f5e7c959e46579840d77a67a4ceb9cef0a50b";
+    sha256 = "ebe78fe9a0e874362175b02371bdfbee64d8edc42a044253ddf4ee7d3c15212c";
   };
 
   # No tests in archive
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/coveralls/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/coveralls/default.nix
index 55032864c3..46002fae4f 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/coveralls/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/coveralls/default.nix
@@ -16,13 +16,13 @@
 
 buildPythonPackage rec {
   pname = "coveralls";
-  version = "2.2.0";
+  version = "3.0.1";
   disabled = isPy27;
 
   # wanted by tests
   src = fetchPypi {
     inherit pname version;
-    sha256 = "b990ba1f7bc4288e63340be0433698c1efe8217f78c689d254c2540af3d38617";
+    sha256 = "cbb942ae5ef3d2b55388cb5b43e93a269544911535f1e750e1c656aef019ce60";
   };
 
   checkInputs = [
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/curtsies/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/curtsies/default.nix
index 62f1435df3..dc32bcdf74 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/curtsies/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/curtsies/default.nix
@@ -1,4 +1,4 @@
-{ lib, buildPythonPackage, fetchPypi, fetchpatch, pythonOlder, blessings, mock, nose, pyte, wcwidth, typing }:
+{ lib, buildPythonPackage, fetchPypi, fetchpatch, pythonOlder, blessings, mock, nose, pyte, wcwidth, typing ? null}:
 
 buildPythonPackage rec {
   pname = "curtsies";
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/cve-bin-tool/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/cve-bin-tool/default.nix
new file mode 100644
index 0000000000..61ae897681
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/development/python-modules/cve-bin-tool/default.nix
@@ -0,0 +1,83 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, jsonschema
+, plotly
+, pytest
+, pytest-xdist
+, pytest-cov
+, pytest-asyncio
+, beautifulsoup4
+, pyyaml
+, isort
+, py
+, jinja2
+, rpmfile
+, reportlab
+, zstandard
+, rich
+, aiohttp
+, toml
+  # aiohttp[speedups]
+, aiodns
+, brotlipy
+, cchardet
+, pillow
+, pytestCheckHook
+}:
+buildPythonPackage {
+  pname = "cve-bin-tool";
+  version = "unstable-2021-04-15";
+
+  src = fetchFromGitHub {
+    owner = "intel";
+    repo = "cve-bin-tool";
+    rev = "10cb6fd0baffe35babfde024bc8c70aa58629237";
+    sha256 = "STf0tJBpadBqsbC+MghBai8zahDkrXfLoFRJ+84wvvY=";
+  };
+
+  # Wants to open a sqlite database, access the internet, etc
+  doCheck = false;
+
+  propagatedBuildInputs = [
+    jsonschema
+    plotly
+    pytest
+    pytest-xdist
+    pytest-cov
+    pytest-asyncio
+    beautifulsoup4
+    pyyaml
+    isort
+    py
+    jinja2
+    rpmfile
+    reportlab
+    zstandard
+    rich
+    aiohttp
+    toml
+
+    # aiohttp[speedups]
+    aiodns
+    brotlipy
+    cchardet
+    # needed by brotlipy
+    pillow
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "cve_bin_tool"
+  ];
+
+  meta = with lib; {
+    description = "CVE Binary Checker Tool";
+    homepage = "https://github.com/intel/cve-bin-tool";
+    license = licenses.gpl3Only;
+    maintainers = teams.determinatesystems.members;
+  };
+}
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/cx_freeze/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/cx_freeze/default.nix
index 53f0ef656e..c3c3618033 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/cx_freeze/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/cx_freeze/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "cx_Freeze";
-  version = "6.4.2";
+  version = "6.5.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "fe0af7c658442402bcd209f993219a6ab98a951459495b4a141eb03b552a1c68";
+    sha256 = "e0d03cabcdf9b9c21354807ed9f06fa9481a8fd5a0838968a830f01a70820ff1";
   };
 
   disabled = pythonOlder "3.5";
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/dask-glm/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/dask-glm/default.nix
index 1cfe643944..ca25e05bb1 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/dask-glm/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/dask-glm/default.nix
@@ -5,10 +5,10 @@
 , dask
 , numpy, toolz # dask[array]
 , multipledispatch
+, setuptools-scm
 , scipy
 , scikitlearn
 , pytest
-, setuptools-scm
 }:
 
 buildPythonPackage rec {
@@ -20,8 +20,8 @@ buildPythonPackage rec {
     sha256 = "58b86cebf04fe5b9e58092e1c467e32e60d01e11b71fdc628baaa9fc6d1adee5";
   };
 
-  checkInputs = [ pytest ];
   nativeBuildInputs = [ setuptools-scm ];
+  checkInputs = [ pytest ];
   propagatedBuildInputs = [ cloudpickle dask numpy toolz multipledispatch scipy scikitlearn ];
 
   checkPhase = ''
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/dask-image/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/dask-image/default.nix
index a68c86538e..a38350f0f6 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/dask-image/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/dask-image/default.nix
@@ -11,12 +11,12 @@
 }:
 
 buildPythonPackage rec {
-  version = "0.4.0";
+  version = "0.5.0";
   pname = "dask-image";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "a6873a39af21b856a4eb7efee6838e6897b1399f21ab9e65403e69eb62f96c2d";
+    sha256 = "0bf7ea8dcd9d795505b498bd632394720c048f50761e23c574d9a6bacfb27cbb";
   };
 
   nativeBuildInputs = [ pytest-flake8 ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/datadog/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/datadog/default.nix
index 3e9f02e2f7..ad3f66b5d6 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/datadog/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/datadog/default.nix
@@ -4,7 +4,7 @@
 , pythonOlder
 , decorator
 , requests
-, typing
+, typing ? null
 , configparser
 , click
 , freezegun
@@ -21,7 +21,7 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-Q4wd3lRi5oxceSt7Sh2HoN3ZcK89sxs88VmA7tDEQxE=";
+    sha256 = "438c1dde5462e68c5c792b7b4a1d87a0ddd970af3db31b3cf15980eed0c44311";
   };
 
   postPatch = ''
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/deepdiff/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/deepdiff/default.nix
index e8d2731eb5..83140ff0bb 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/deepdiff/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/deepdiff/default.nix
@@ -1,34 +1,43 @@
 { lib
 , buildPythonPackage
-, fetchPypi
-, mock
-, jsonpickle
-, mmh3
+, fetchFromGitHub
+, click
 , ordered-set
+, clevercsv
+, jsonpickle
 , numpy
 , pytestCheckHook
+, pyyaml
 }:
 
 buildPythonPackage rec {
   pname = "deepdiff";
-  version = "5.0.2";
+  version = "5.3.0";
+  format = "setuptools";
 
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "e2b74af4da0ef9cd338bb6e8c97242c1ec9d81fcb28298d7bb24acdc19ea79d7";
+  # pypi source does not contain all fixtures required for tests
+  src = fetchFromGitHub {
+    owner = "seperman";
+    repo = "deepdiff";
+    rev = version;
+    sha256 = "1izw2qpd93nj948zakamjn7q7dlmmr7sapg0c65hxvs0nmij8sl4";
   };
 
-  # # Extra packages (may not be necessary)
-  checkInputs = [
-    mock
-    numpy
-    pytestCheckHook
+  propagatedBuildInputs = [
+    click
+    ordered-set
   ];
 
-  propagatedBuildInputs = [
+  pythonImportsCheck = [
+    "deepdiff"
+  ];
+
+  checkInputs = [
+    clevercsv
     jsonpickle
-    mmh3
-    ordered-set
+    numpy
+    pytestCheckHook
+    pyyaml
   ];
 
   meta = with lib; {
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/defusedxml/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/defusedxml/default.nix
index 797fee025b..c39ca96bfe 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/defusedxml/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/defusedxml/default.nix
@@ -7,12 +7,12 @@
 
 buildPythonPackage rec {
   pname = "defusedxml";
-  version = "0.7.0";
+  version = "0.7.1";
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "183fz8xwclhkirwpvpldyypn47r8lgzfz2mk9jgyg7b37jg5vcc6";
+    sha256 = "1bb3032db185915b62d7c6209c5a8792be6a32ab2fedacc84e01b52c51aa3e69";
   };
 
   checkPhase = ''
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/dependency-injector/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/dependency-injector/default.nix
index 5ed5a3eb15..9c977ecc5f 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/dependency-injector/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/dependency-injector/default.nix
@@ -9,11 +9,11 @@ in
 
 buildPythonPackage rec {
   pname = "dependency-injector";
-  version = "4.10.3";
+  version = "4.31.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "93db83fac85bcb861469c0db1af11f4bc874aa2f9380151189a05d38c21afd60";
+    sha256 = "b6b28b9571f44d575367c6005ba8aaa9fd2b70310e1c15410925d6f1ee2769ad";
   };
 
   propagatedBuildInputs = [ six ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/diff_cover/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/diff_cover/default.nix
index 91832bc88f..5c340bf7ac 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/diff_cover/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/diff_cover/default.nix
@@ -1,4 +1,5 @@
 { lib, buildPythonPackage, fetchPypi
+, chardet
 , inflect
 , jinja2
 , jinja2_pluralize
@@ -16,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "diff_cover";
-  version = "4.0.1";
+  version = "5.0.1";
 
   preCheck = ''
     export LC_ALL=en_US.UTF-8;
@@ -24,10 +25,10 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "61a98ec126552d985c0e3e3c33cc72e79d7577f91f6edba99f635411a173d3b9";
+    sha256 = "e80f7a4979b7a9d373903776588279ed2898f17729e608255c4119462c822edb";
   };
 
-  propagatedBuildInputs = [ jinja2 jinja2_pluralize pygments six inflect ];
+  propagatedBuildInputs = [ chardet jinja2 jinja2_pluralize pygments six inflect ];
 
   checkInputs = [ mock coverage pytest nose pylint pyflakes pycodestyle ];
 
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/django-extensions/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/django-extensions/default.nix
index 9bd72965cf..3e7a1163b9 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/django-extensions/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/django-extensions/default.nix
@@ -11,7 +11,7 @@
 , shortuuid
 , six
 , tox
-, typing
+, typing ? null
 , vobject
 , werkzeug
 }:
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/django-pipeline/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/django-pipeline/default.nix
index 3276f7a065..92aefe4a40 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/django-pipeline/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/django-pipeline/default.nix
@@ -1,5 +1,5 @@
 { lib, buildPythonPackage, fetchFromGitHub, isPy3k
-, django, futures, mock, jinja2, jsmin, slimit }:
+, django, futures ? null, mock ? null, jinja2, jsmin, slimit }:
 
 buildPythonPackage rec {
   pname = "django-pipeline";
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/django/2.nix b/third_party/nixpkgs/pkgs/development/python-modules/django/2.nix
index 7d28d30e86..991c353df1 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/django/2.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/django/2.nix
@@ -6,13 +6,13 @@
 
 buildPythonPackage rec {
   pname = "Django";
-  version = "2.2.19";
+  version = "2.2.20";
 
   disabled = !isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0hysjf8bz4g8xrn2cdx6pmawimpyr6ag2fg3jxsnc1byr3g3bhih";
+    sha256 = "0r3a6gbhwngxl172yy6n0sq5knibl2vxc0wbk1g8licfbzfgjs95";
   };
 
   patches = lib.optional withGdal
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/django/3.nix b/third_party/nixpkgs/pkgs/development/python-modules/django/3.nix
index 7f2db712f0..62ca390eac 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/django/3.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/django/3.nix
@@ -13,13 +13,13 @@
 
 buildPythonPackage rec {
   pname = "Django";
-  version = "3.1.7";
+  version = "3.2";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "32ce792ee9b6a0cbbec340123e229ac9f765dff8c2a4ae9247a14b2ba3a365a7";
+    sha256 = "179qdxa438fnycnnf1j5z6359h1kbp2q7djf01v5jrr26xjgkw11";
   };
 
   patches = lib.optional withGdal
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/django_silk/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/django_silk/default.nix
index 653bcdc555..b1d4eaec5c 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/django_silk/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/django_silk/default.nix
@@ -9,6 +9,7 @@
 , simplejson
 , dateutil
 , requests
+, setuptools-scm
 , sqlparse
 , jinja2
 , autopep8
@@ -52,6 +53,7 @@ buildPythonPackage rec {
       --replace 'use_scm_version=True' 'version="${version}"'
   '';
 
+  nativeBuildInputs = [ setuptools-scm ];
   buildInputs = [ mock ];
   propagatedBuildInputs = [
     django pygments simplejson dateutil requests
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/django_treebeard/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/django_treebeard/default.nix
index 88536b210d..be63c1e9e3 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/django_treebeard/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/django_treebeard/default.nix
@@ -7,11 +7,11 @@
 
 buildPythonPackage rec {
   pname = "django-treebeard";
-  version = "4.4";
+  version = "4.5.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "f50e4eea146f7af6702decf7ef198ac1eee1fb9bb4af2c5dba276c3c48f76623";
+    sha256 = "80150017725239702054e5fa64dc66e383dc13ac262c8d47ee5a82cb005969da";
   };
 
   buildInputs = [ pytest ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/dnspython/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/dnspython/default.nix
index 1d224af035..afb85fb61f 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/dnspython/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/dnspython/default.nix
@@ -2,13 +2,13 @@
 
 buildPythonPackage rec {
   pname = "dnspython";
-  version = "2.0.0";
+  version = "2.1.0";
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
     extension = "zip";
-    sha256 = "044af09374469c3a39eeea1a146e8cac27daec951f1f1f157b1962fc7cb9d1b7";
+    sha256 = "e4a87f0b573201a0f3727fa18a516b055fd1107e0e5477cded4a2de497df1dd4";
   };
 
   # needs networking for some tests
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/docplex/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/docplex/default.nix
index 54af81d5d8..0d2b355b38 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/docplex/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/docplex/default.nix
@@ -2,7 +2,7 @@
 , buildPythonPackage
 , fetchPypi
 , isPy27
-, futures
+, futures ? null
 , docloud
 , requests
 }:
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/dropbox/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/dropbox/default.nix
index ca0283b2cb..8fc4ee1358 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/dropbox/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/dropbox/default.nix
@@ -1,20 +1,25 @@
 { lib, buildPythonPackage, fetchPypi
-, pytestrunner, requests, urllib3, mock, setuptools }:
+, pytestrunner, requests, urllib3, mock, setuptools, stone }:
 
 buildPythonPackage rec {
   pname = "dropbox";
-  version = "10.10.0";
+  version = "11.4.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "df43e9e0bdcae6d610dd754a5ec72f2f91a311bbc2c8a28d076df69695b18398";
+    sha256 = "7ba43384029424779a4b3ec8d5832362c5c0f37cd644be2fb87e2b30a569849e";
   };
 
+  postPatch = ''
+    substituteInPlace setup.py \
+      --replace "pytest-runner == 5.2.0" "pytest-runner"
+  '';
+
   # Set DROPBOX_TOKEN environment variable to a valid token.
   doCheck = false;
 
-  buildInputs = [ pytestrunner ];
-  propagatedBuildInputs = [ requests urllib3 mock setuptools ];
+  nativeBuildInputs = [ pytestrunner ];
+  propagatedBuildInputs = [ requests urllib3 mock setuptools stone ];
 
   meta = with lib; {
     description = "A Python library for Dropbox's HTTP-based Core and Datastore APIs";
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/elasticsearch/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/elasticsearch/default.nix
index 465e8f6c77..8fe4686f7a 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/elasticsearch/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/elasticsearch/default.nix
@@ -7,11 +7,11 @@
 
 buildPythonPackage (rec {
   pname = "elasticsearch";
-  version = "7.11.0";
+  version = "7.12.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1e24b33a82bf381b42d3b0d390f76fdb9d6a9d47b310dea8eaeb0a5933c394c0";
+    sha256 = "9a77172be02bc4855210d83f0f1346a1e7d421e3cb2ca47ba81ac0c5a717b3a0";
   };
 
   # Check is disabled because running them destroy the content of the local cluster!
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/eth-hash/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/eth-hash/default.nix
index ad58ee3ae2..da57aa50e0 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/eth-hash/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/eth-hash/default.nix
@@ -1,18 +1,29 @@
-{ lib, fetchPypi, buildPythonPackage, pythonOlder, pytest, pysha3, pycrypto,
-  pycryptodome }:
+{ lib, fetchPypi, buildPythonPackage, pythonOlder, pytest, pysha3, pycrypto
+, pycryptodome
+, eth-utils
+}:
 
 buildPythonPackage rec {
   pname = "eth-hash";
-  version = "0.2.0";
+  version = "0.3.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0xpiz0wrxxj11ki9yapvsibl25qnki90bl3d39nqascg14nw17a9";
+    sha256 = "aee46d9c43b98ac6d4ddf957cf75d4d0a5174ee814cc6b53dd6134dcedb459bf";
   };
 
   checkInputs = [ pytest ];
 
-  propagatedBuildInputs = [ pysha3 pycrypto pycryptodome ];
+  propagatedBuildInputs = [
+    pysha3
+    pycrypto
+    pycryptodome
+  ];
+
+  pipInstallFlags = [
+    # Circular dependency on eth-utils
+    "--no-dependencies"
+  ];
 
   # setuptools-markdown uses pypandoc which is broken at the moment
   preConfigure = ''
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/eth-utils/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/eth-utils/default.nix
index 9c67f0816e..172647f0da 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/eth-utils/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/eth-utils/default.nix
@@ -3,7 +3,7 @@
 
 buildPythonPackage rec {
   pname = "eth-utils";
-  version = "1.9.5";
+  version = "1.10.0";
 
   # Tests are missing from the PyPI source tarball so let's use GitHub
   # https://github.com/ethereum/eth-utils/issues/130
@@ -11,7 +11,7 @@ buildPythonPackage rec {
     owner = "ethereum";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1h3xlw74zdf6cfvqf9193lx05bpdm05pmy9ap1g7q2kx0j2b6352";
+    sha256 = "sha256-sq3H4HmUFUipqVYleZxWLG1gBsQEoNwcZAXiKckacek=";
   };
 
   checkInputs = [ pytestCheckHook hypothesis ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/eventlet/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/eventlet/default.nix
index 9966dd81d2..4eaba48922 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/eventlet/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/eventlet/default.nix
@@ -12,11 +12,11 @@
 
 buildPythonPackage rec {
   pname = "eventlet";
-  version = "0.30.1";
+  version = "0.30.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "d00649a7e17de0bcddff1a96311ed3baf1b295b3223d4b71aceafe7b45e6d6f8";
+    sha256 = "1811b122d9a45eb5bafba092d36911bca825f835cb648a862bbf984030acff9d";
   };
 
   propagatedBuildInputs = [ dnspython greenlet monotonic six ]
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/exchangelib/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/exchangelib/default.nix
index 706e4d8137..0cccedd54a 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/exchangelib/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/exchangelib/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "exchangelib";
-  version = "3.2.1";
+  version = "4.1.0";
   disabled = pythonOlder "3.5";
 
   # tests are not present in the PyPI version
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "ecederstrand";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1sh780q2iwdm3bnlnfdacracf0n7jhbv0g39cdx65v3d510zp4jv";
+    sha256 = "0lkhjiz78x00d5gzn455660f31f8y4fcrqcn6rh0m41r1ar5im17";
   };
 
   checkInputs = [ psutil requests-mock pyyaml
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/faker/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/faker/default.nix
index 990908efe0..8175e1ffb8 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/faker/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/faker/default.nix
@@ -11,11 +11,11 @@
 
 buildPythonPackage rec {
   pname = "Faker";
-  version = "5.5.1";
+  version = "6.6.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1bskhmiir1ajipj7j535j2mxgnp6s3mxbvlag4aryj9zbhgg1c19";
+    sha256 = "f43ac743c34affb1c7fccca8b06450371cd482b6ddcb4110e420acb24356e70b";
   };
 
   propagatedBuildInputs = [
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/fasteners/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/fasteners/default.nix
index 55b9d3b302..1cf4c6b30d 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/fasteners/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/fasteners/default.nix
@@ -3,24 +3,36 @@
 , fetchPypi
 , six
 , monotonic
+, diskcache
+, more-itertools
 , testtools
 , isPy3k
 , nose
-, futures
+, futures ? null
 }:
 
 buildPythonPackage rec {
   pname = "fasteners";
-  version = "0.15";
+  version = "0.16";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "3a176da6b70df9bb88498e1a18a9e4a8579ed5b9141207762368a1017bf8f5ef";
+    sha256 = "c995d8c26b017c5d6a6de9ad29a0f9cdd57de61ae1113d28fac26622b06a0933";
   };
 
-  propagatedBuildInputs = [ six monotonic ];
+  propagatedBuildInputs = [
+    six
+    monotonic
+  ];
 
-  checkInputs = [ testtools nose ] ++ lib.optionals (!isPy3k) [ futures ];
+  checkInputs = [
+    diskcache
+    more-itertools
+    testtools
+    nose
+  ] ++ lib.optionals (!isPy3k) [
+    futures
+  ];
 
   checkPhase = ''
     nosetests
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/fastrlock/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/fastrlock/default.nix
index 0821778d02..3ad45be532 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/fastrlock/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/fastrlock/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "fastrlock";
-  version = "0.5";
+  version = "0.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "9ae1a31f6e069b5f0f28ba63c594d0c952065de0a375f7b491d21ebaccc5166f";
+    sha256 = "9f5d6ec9fe130b7490bb04572134392420b72bd0842185e02d461a797d6bc749";
   };
 
   meta = with lib; {
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/fido2/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/fido2/default.nix
index 1e1af8e959..984a3743f0 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/fido2/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/fido2/default.nix
@@ -13,7 +13,7 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-hoDuJSOOIwdZbrOQCg+MDZzJEYkUbtgDlUTxo6ad/m4=";
+    sha256 = "8680ee25238e2307596eb3900a0f8c0d9cc91189146ed8039544f1a3a69dfe6e";
   };
 
   propagatedBuildInputs = [ six cryptography ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/flake8/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/flake8/default.nix
index 6f1d8181a5..7c81967d07 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/flake8/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/flake8/default.nix
@@ -1,15 +1,15 @@
 { lib, buildPythonPackage, fetchPypi, pythonOlder
 , mock, pytest, pytestrunner
-, configparser, enum34, mccabe, pycodestyle, pyflakes, functools32, typing, importlib-metadata
+, configparser, enum34, mccabe, pycodestyle, pyflakes, functools32, typing ? null, importlib-metadata
 }:
 
 buildPythonPackage rec {
   pname = "flake8";
-  version = "3.8.4";
+  version = "3.9.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "aadae8761ec651813c24be05c6f7b4680857ef6afaae4651a4eccaef97ce6c3b";
+    sha256 = "78873e372b12b093da7b5e5ed302e8ad9e988b38b063b61ad937f26ca58fc5f0";
   };
 
   checkInputs = [ pytest mock pytestrunner ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/flask-caching/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/flask-caching/default.nix
index 57c95cf880..708c5c351e 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/flask-caching/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/flask-caching/default.nix
@@ -1,23 +1,26 @@
-{ lib, buildPythonPackage, fetchPypi, isPy27, flask, pytest, pytestcov, pytest-xprocess, pytestcache }:
+{ lib, buildPythonPackage, fetchPypi, isPy27, flask, pytestCheckHook, pytestcov, pytest-xprocess, pytestcache }:
 
 buildPythonPackage rec {
   pname = "Flask-Caching";
-  version = "1.9.0";
+  version = "1.10.1";
   disabled = isPy27; # invalid python2 syntax
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "a0356ad868b1d8ec2d0e675a6fe891c41303128f8904d5d79e180d8b3f952aff";
+    sha256 = "cf19b722fcebc2ba03e4ae7c55b532ed53f0cbf683ce36fafe5e881789a01c00";
   };
 
   propagatedBuildInputs = [ flask ];
 
-  checkInputs = [ pytest pytestcov pytest-xprocess pytestcache ];
+  checkInputs = [ pytestCheckHook pytestcov pytest-xprocess pytestcache ];
 
-  # backend_cache relies on pytest-cache, which is a stale package from 2013
-  checkPhase = ''
-    pytest -k 'not backend_cache'
-  '';
+  disabledTests = [
+    # backend_cache relies on pytest-cache, which is a stale package from 2013
+    "backend_cache"
+    # optional backends
+    "Redis"
+    "Memcache"
+  ];
 
   meta = with lib; {
     description = "Adds caching support to your Flask application";
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/flask-jwt-extended/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/flask-jwt-extended/default.nix
index dd018d84a6..a49aefd5eb 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/flask-jwt-extended/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/flask-jwt-extended/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "Flask-JWT-Extended";
-  version = "3.25.1";
+  version = "4.1.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "bbf4467f41c56cf1fd8a5870d2556f419c572aad2b4085757581c3f9b4d7767a";
+    sha256 = "77ca23f23e80480ea42b9c1d9b0fca214e08db7192583e782c2421416b4a4655";
   };
 
   propagatedBuildInputs = [ dateutil flask pyjwt werkzeug ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/flask-mongoengine/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/flask-mongoengine/default.nix
index ad43533123..f7cb7224dc 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/flask-mongoengine/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/flask-mongoengine/default.nix
@@ -8,20 +8,22 @@
 , nose
 , rednose
 , coverage
+, email_validator
 }:
 
 buildPythonPackage rec {
   pname = "flask-mongoengine";
-  version = "0.9.5";
+  version = "1.0.0";
 
   src = fetchFromGitHub {
     owner = "MongoEngine";
     repo = pname;
     rev = "v${version}";
-    sha256 = "05hfddf1dm594wnjyqhj0zmjfsf1kpmx1frjwhypgzx4hf62qcmr";
+    sha256 = "10g9b13ls2msnhv8j44gslrfxa2ppqz2y1xjn2a4gg4m9mdjv8b2";
   };
 
   propagatedBuildInputs = [
+    email_validator
     flask
     flask_wtf
     mongoengine
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/flask-sqlalchemy/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/flask-sqlalchemy/default.nix
index 1bac82fb44..421bc95332 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/flask-sqlalchemy/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/flask-sqlalchemy/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "Flask-SQLAlchemy";
-  version = "2.4.4";
+  version = "2.5.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1rgsj49gnx361hnb3vn6c1h17497qh22yc3r70l1r6w0mw71bixz";
+    sha256 = "2bda44b43e7cacb15d4e05ff3cc1f8bc97936cc464623424102bfc2c35e95912";
   };
 
   propagatedBuildInputs = [ flask sqlalchemy ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/flit-core/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/flit-core/default.nix
index 53a1e0651f..a4c6b99b07 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/flit-core/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/flit-core/default.nix
@@ -3,12 +3,13 @@
 , flit
 , isPy3k
 , toml
+, pytestCheckHook
+, testpath
 }:
 
 buildPythonPackage rec {
   pname = "flit-core";
-  version = "2.3.0";
-  disabled = !isPy3k;
+  version = "3.2.0";
   format = "pyproject";
 
   inherit (flit) src patches;
@@ -21,6 +22,11 @@ buildPythonPackage rec {
     toml
   ];
 
+  checkInputs = [
+    pytestCheckHook
+    testpath
+  ];
+
   passthru.tests = {
     inherit flit;
   };
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/flit/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/flit/default.nix
index c63fd1edea..38369dfd4d 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/flit/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/flit/default.nix
@@ -21,30 +21,20 @@
 
 buildPythonPackage rec {
   pname = "flit";
-  version = "3.0.0";
-  disabled = !isPy3k;
+  version = "3.2.0";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "takluyver";
     repo = "flit";
     rev = version;
-    sha256 = "zk6mozS3Q9U43PQe/DxgwwsBRJ6Qwb+rSUVGXHijD+g=";
+    sha256 = "sha256-zN+/oAyXBo6Ho7n/xhOQ2mjtPGKA1anCvl3sVf7t+Do=";
   };
 
   nativeBuildInputs = [
     flit-core
   ];
 
-  # Use toml instead of pytoml
-  # Resolves infinite recursion since packaging started using flit.
-  patches = [
-    (fetchpatch {
-      url = "https://github.com/takluyver/flit/commit/b81b1da55ef0f2768413669725d2874fcb0c29fb.patch";
-      sha256 = "11oNaYsm00/j2046V9C0idpSeG7TpY3JtLuxX3ZL/OI=";
-    })
-  ];
-
   propagatedBuildInputs = [
     docutils
     requests
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/fs/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/fs/default.nix
index aa6831441d..c14b169bea 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/fs/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/fs/default.nix
@@ -4,9 +4,9 @@
 , fetchPypi
 , six
 , appdirs
-, scandir
-, backports_os
-, typing
+, scandir ? null
+, backports_os ? null
+, typing ? null
 , pytz
 , enum34
 , pyftpdlib
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/gentools/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/gentools/default.nix
index 129eaae340..14e1fc1c60 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/gentools/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/gentools/default.nix
@@ -1,5 +1,5 @@
 { buildPythonPackage, lib, fetchFromGitHub, pytest
-, typing, funcsigs, pythonOlder
+, typing ? null, funcsigs ? null, pythonOlder
 }:
 
 buildPythonPackage rec {
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/gidgethub/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/gidgethub/default.nix
index a28bcfb0ec..9d9cc2095e 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/gidgethub/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/gidgethub/default.nix
@@ -16,13 +16,13 @@
 
 buildPythonPackage rec {
   pname = "gidgethub";
-  version = "4.2.0";
+  version = "5.0.0";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "5526cc2a06bfad707d10ec118393e0d33c2aa524605255d96958c22c93e8e7aa";
+    sha256 = "a4a8d8b1ab629757b557d3bcb98a5a77790a3d00b320f5f881a1754cf0e21086";
   };
 
   nativeBuildInputs = [ setuptools pytestrunner ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/gitdb/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/gitdb/default.nix
index 5c3bd4ac43..1ad0b320da 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/gitdb/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/gitdb/default.nix
@@ -17,6 +17,10 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [ smmap ];
 
+  postPatch = ''
+    substituteInPlace setup.py --replace ",<4" ""
+  '';
+
   # Bunch of tests fail because they need an actual git repo
   doCheck = false;
 
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/goocalendar/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/goocalendar/default.nix
index b0eea60038..6c371496ff 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/goocalendar/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/goocalendar/default.nix
@@ -4,7 +4,6 @@
 , pkg-config
 , gtk3
 , gobject-introspection
-, pygtk
 , pygobject3
 , goocanvas2
 , isPy3k
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/google-auth-httplib2/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/google-auth-httplib2/default.nix
index 05ea601330..ceaec71417 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/google-auth-httplib2/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/google-auth-httplib2/default.nix
@@ -16,7 +16,7 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-oHw5/WMr7KzT8HcY39YCG/OWl48DrTzkMh0GABXMMKw=";
+    sha256 = "a07c39fd632becacd3f07718dfd6021bf396978f03ad3ce4321d060015cc30ac";
   };
 
   propagatedBuildInputs = [
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/google-auth/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/google-auth/default.nix
index f106f6efaa..81753d11b3 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/google-auth/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/google-auth/default.nix
@@ -23,7 +23,7 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-m9Q20ZqwRwAaE0ByDStinrlt1QMljFJJIewq8+6IqA4=";
+    sha256 = "9bd436d19ab047001a1340720d2b629eb96dd503258c524921ec2af3ee88a80e";
   };
 
   propagatedBuildInputs = [
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/google-cloud-bigquery-datatransfer/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/google-cloud-bigquery-datatransfer/default.nix
index 3b194dae92..8aff491547 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/google-cloud-bigquery-datatransfer/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/google-cloud-bigquery-datatransfer/default.nix
@@ -15,7 +15,7 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-mAZSVxiTiLbMeXR4xLK9+G6ejNyspdFw3tAnZGREpYY=";
+    sha256 = "98065257189388b6cc797478c4b2bdf86e9e8cdcaca5d170ded027646444a586";
   };
 
   propagatedBuildInputs = [ google-api-core libcst proto-plus ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/google-cloud-core/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/google-cloud-core/default.nix
index 1c70d1dc26..3ac6544c15 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/google-cloud-core/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/google-cloud-core/default.nix
@@ -15,7 +15,7 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-xquxhSdUU3n8gu/E3nXOmjdyzK0vxkWtrOWTugl8uwI=";
+    sha256 = "c6abb18527545379fc82efc4de75ce9a3772ccad2fc645adace593ba097cbb02";
   };
 
   propagatedBuildInputs = [ google-api-core ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/google-cloud-org-policy/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/google-cloud-org-policy/default.nix
index 206e740aa4..7ca698b664 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/google-cloud-org-policy/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/google-cloud-org-policy/default.nix
@@ -6,7 +6,7 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-tGNwSv+rMnwdP6SvKAqFhjW19ZqIRWsqCNtiozajUqo=";
+    sha256 = "b463704affab327c1d3fa4af280a858635b5f59a88456b2a08db62a336a352aa";
   };
 
   propagatedBuildInputs = [ google-api-core proto-plus ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/google-cloud-testutils/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/google-cloud-testutils/default.nix
index 62139b81c2..cf8bb20e61 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/google-cloud-testutils/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/google-cloud-testutils/default.nix
@@ -6,7 +6,7 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-ojvnzCO8yxrm3rt0pH3FtRhYtjIvzwNMqS/npKy4lvM=";
+    sha256 = "a23be7cc23bccb1ae6debb74a47dc5b51858b6322fcf034ca92fe7a4acb896f3";
   };
 
   propagatedBuildInputs = [ click google-auth six ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/googleapis-common-protos/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/googleapis-common-protos/default.nix
index 1b54d64f1a..3a7c0510ad 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/googleapis-common-protos/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/googleapis-common-protos/default.nix
@@ -11,7 +11,7 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-qI7okDqgqB9sPOwtXPYtPIqmfAZDmwSWtJBI+xhU6/Q=";
+    sha256 = "a88ee8903aa0a81f6c3cec2d5cf62d3c8aa67c06439b0496b49048fb1854ebf4";
   };
 
   propagatedBuildInputs = [ grpc protobuf ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/graphite-web/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/graphite-web/default.nix
index 81260110f9..d2d6a78436 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/graphite-web/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/graphite-web/default.nix
@@ -1,4 +1,6 @@
-{ lib, buildPythonPackage, fetchPypi
+{ lib
+, buildPythonPackage
+, fetchPypi
 , django
 , memcached
 , txamqp
@@ -9,7 +11,6 @@
 , cairocffi
 , whisper
 , whitenoise
-, scandir
 , urllib3
 , six
 }:
@@ -38,7 +39,6 @@ buildPythonPackage rec {
     cairocffi
     whisper
     whitenoise
-    scandir
     urllib3
     six
   ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/grpcio/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/grpcio/default.nix
index 0fe6b9343e..dadb9b5276 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/grpcio/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/grpcio/default.nix
@@ -3,8 +3,8 @@
 , grpc
 , six
 , protobuf
-, enum34
-, futures
+, enum34 ? null
+, futures ? null
 , isPy27
 , pkg-config
 , cython
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/gssapi/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/gssapi/default.nix
index 9a1d54e6b5..4a98008f79 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/gssapi/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/gssapi/default.nix
@@ -24,7 +24,7 @@ buildPythonPackage rec {
     owner = "pythongssapi";
     repo = "python-${pname}";
     rev = "v${version}";
-    sha256 = "sha256-x86/KMcXChPLzoCqR9xwemusWktf/seHLQmEKLco3GQ=";
+    sha256 = "0r6w52vji1095n3wgzjz9ddaqsvsf3f4gal0rv5i62hpqwlbzkn7";
   };
 
   # It's used to locate headers
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/guessit/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/guessit/default.nix
index d0c1e74ee2..0450dfd07e 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/guessit/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/guessit/default.nix
@@ -9,11 +9,11 @@
 
 buildPythonPackage rec {
   pname = "guessit";
-  version = "3.1.1";
+  version = "3.3.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1c530pb0h34z0ziym256qps21b8mh533ia1lcnx9wqwx9rnqriki";
+    sha256 = "8305e0086129614a8820a508303f98f56c584811489499bcc54a7ea6f1b0391e";
   };
 
   # Tests require more packages.
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/gym/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/gym/default.nix
index 263bdfa2f4..126606af73 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/gym/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/gym/default.nix
@@ -5,11 +5,11 @@
 
 buildPythonPackage rec {
   pname = "gym";
-  version = "0.17.3";
+  version = "0.18.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "96a7dd4e9cdb39e30c7a79e5773570fd9408f7fdb58c714c293cfbb314818eb6";
+    sha256 = "a0dcd25c1373f3938f4cb4565f74f434fba6faefb73a42d09c9dddd0c08af53e";
   };
 
   propagatedBuildInputs = [
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/habanero/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/habanero/default.nix
index a7ec358ffd..e24f2fc096 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/habanero/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/habanero/default.nix
@@ -1,21 +1,21 @@
 { buildPythonPackage, lib, fetchFromGitHub
-, requests
+, requests, tqdm
 , nose, vcrpy
 }:
 
 buildPythonPackage rec {
   pname = "habanero";
-  version = "0.6.0";
+  version = "0.7.4";
 
   # Install from Pypi is failing because of a missing file (Changelog.rst)
   src = fetchFromGitHub {
     owner = "sckott";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1l2cgl6iiq8jff2w2pib6w8dwaj8344crhwsni2zzq0p44dwi13d";
+    sha256 = "1d8yj9xz5qabcj57rpjzvg0jcscvzrpb0739mll29nijbsaimfr1";
   };
 
-  propagatedBuildInputs = [ requests ];
+  propagatedBuildInputs = [ requests tqdm ];
 
   checkInputs = [ nose vcrpy ];
   checkPhase = "make test";
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/hg-evolve/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/hg-evolve/default.nix
index 4c74621b48..b7bd002c36 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/hg-evolve/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/hg-evolve/default.nix
@@ -6,11 +6,11 @@
 
 buildPythonPackage rec {
   pname = "hg-evolve";
-  version = "10.2.0.post1";
+  version = "10.3.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "391aa877a61ed04c58b8d82d465b3771f632bb9b19f22cbf18f0e5a1f42f8d4e";
+    sha256 = "5d7f73fc1c357134ae9b4a3ed2d844ab8e75a4ca1303679a9e150e87617e7bc7";
   };
 
   doCheck = false;
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/httplib2/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/httplib2/default.nix
index 25c227c614..40bfe4d3e8 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/httplib2/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/httplib2/default.nix
@@ -1,5 +1,5 @@
-{ stdenv
-, lib
+{ lib
+, stdenv
 , buildPythonPackage
 , fetchFromGitHub
 , isPy27
@@ -15,13 +15,13 @@
 
 buildPythonPackage rec {
   pname = "httplib2";
-  version = "0.19.0";
+  version = "0.19.1";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    sha256 = "04y2bc2yv3q84llxnafqrciqxjqpxbrd8glbnvvr16c20fwc3r4q";
+    sha256 = "sha256-e0Mq9AVJEWQ9GEtYFXk2fMIs7GtAUsyJN6XheqAnD3I=";
   };
 
   postPatch = ''
@@ -30,6 +30,11 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [ pyparsing ];
 
+  pythonImportsCheck = [ "httplib2" ];
+
+  # Don't run tests for Python 2.7
+  doCheck = !isPy27;
+
   checkInputs = [
     mock
     pytest-forked
@@ -40,12 +45,12 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
-  # Don't run tests for Python 2.7 or Darwin
-  # Nearly 50% of the test suite requires local network access
-  # which isn't allowed on sandboxed Darwin builds
-  doCheck = !(isPy27 || stdenv.isDarwin);
+  disabledTests = lib.optionals (stdenv.isDarwin) [
+    # fails with HTTP 408 Request Timeout, instead of expected 200 OK
+    "test_timeout_subsequent"
+  ];
+
   pytestFlagsArray = [ "--ignore python2" ];
-  pythonImportsCheck = [ "httplib2" ];
 
   meta = with lib; {
     description = "A comprehensive HTTP client library";
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/humanize/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/humanize/default.nix
index ef66870ddf..5db7d6d025 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/humanize/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/humanize/default.nix
@@ -9,13 +9,13 @@
 }:
 
 buildPythonPackage rec {
-  version = "3.2.0";
+  version = "3.3.0";
   pname = "humanize";
   disabled = isPy27; # setup.py no longer compatible
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "09ph6fd1362xdn2hgwdgh30z0zqjp3bgvr1akyvm36b8jm400sdb";
+    sha256 = "8bf7abd672b867f38b8b04593829b85b9b6199a61ef6586bf3629cc06458ff35";
   };
 
   nativeBuildInputs = [ setuptools_scm ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/hyperlink/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/hyperlink/default.nix
index bab7986eda..ad56de8678 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/hyperlink/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/hyperlink/default.nix
@@ -1,12 +1,12 @@
-{ lib, buildPythonPackage, fetchPypi, isPy27, idna, typing }:
+{ lib, buildPythonPackage, fetchPypi, isPy27, idna, typing ? null }:
 
 buildPythonPackage rec {
   pname = "hyperlink";
-  version = "20.0.1";
+  version = "21.0.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "47fcc7cd339c6cb2444463ec3277bdcfe142c8b1daf2160bdd52248deec815af";
+    sha256 = "427af957daa58bc909471c6c40f74c5450fa123dd093fc53efd2e91d2705a56b";
   };
 
   propagatedBuildInputs = [ idna ]
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/hyppo/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/hyppo/default.nix
index 5b2869e10d..86b43465fb 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/hyppo/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/hyppo/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "hyppo";
-  version = "0.1.3";
+  version = "0.2.1";
 
   disabled = isPy27;
 
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "neurodata";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0qdnb1l4hz4dgwhapz1fp9sb2vxxvr8h2ngsbvyf50h3kapcn19r";
+    sha256 = "0izjc68rb6sr3x55c3zzraakzspgzh80qykfax9zj868zypfm365";
   };
 
   propagatedBuildInputs = [
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/idna/2.nix b/third_party/nixpkgs/pkgs/development/python-modules/idna/2.nix
new file mode 100644
index 0000000000..9a1c1dc271
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/development/python-modules/idna/2.nix
@@ -0,0 +1,23 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, pytestCheckHook
+}:
+
+buildPythonPackage rec {
+  pname = "idna";
+  version = "2.10";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "b307872f855b18632ce0c21c5e45be78c0ea7ae4c15c828c20788b26921eb3f6";
+  };
+
+  checkInputs = [ pytestCheckHook ];
+
+  meta = {
+    homepage = "https://github.com/kjd/idna/";
+    description = "Internationalized Domain Names in Applications (IDNA)";
+    license = lib.licenses.bsd3;
+  };
+}
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/idna/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/idna/default.nix
index 613fde773a..9bb639f95d 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/idna/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/idna/default.nix
@@ -1,17 +1,20 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "idna";
-  version = "2.10";
+  version = "3.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "b307872f855b18632ce0c21c5e45be78c0ea7ae4c15c828c20788b26921eb3f6";
+    sha256 = "c5b02147e01ea9920e6b0a3f1f7bb833612d507592c837a6c49552768f4054e1";
   };
 
+  checkInputs = [ pytestCheckHook ];
+
   meta = {
     homepage = "https://github.com/kjd/idna/";
     description = "Internationalized Domain Names in Applications (IDNA)";
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/ignite/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/ignite/default.nix
index 307c25e724..71bed73f9d 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/ignite/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/ignite/default.nix
@@ -14,13 +14,13 @@
 
 buildPythonPackage rec {
   pname = "ignite";
-  version = "0.4.2";
+  version = "0.4.4.post1";
 
   src = fetchFromGitHub {
     owner = "pytorch";
     repo = pname;
     rev = "v${version}";
-    sha256 = "00vcmhnp14s54g386izgaxzrdr2nqv3pz9nvpyiwrn33zawr308z";
+    sha256 = "1a7vs4dzm5lmyck50ygi3j2d2wd6nxr5x91dpx0rmf97i6lywpyb";
   };
 
   checkInputs = [ pytestCheckHook matplotlib mock pytest_xdist ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/imageio/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/imageio/default.nix
index 67920dc7b7..2b334fd121 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/imageio/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/imageio/default.nix
@@ -10,7 +10,7 @@
 , numpy
 , isPy3k
 , ffmpeg_3
-, futures
+, futures ? null
 , enum34
 }:
 
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/importlib-metadata/2.nix b/third_party/nixpkgs/pkgs/development/python-modules/importlib-metadata/2.nix
new file mode 100644
index 0000000000..71dcd950db
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/development/python-modules/importlib-metadata/2.nix
@@ -0,0 +1,39 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, setuptools-scm
+, zipp
+, pathlib2
+, contextlib2
+, configparser
+, isPy3k
+, importlib-resources
+, packaging
+}:
+
+buildPythonPackage rec {
+  pname = "importlib-metadata";
+  version = "2.1.1";
+
+  src = fetchPypi {
+    pname = "importlib_metadata";
+    inherit version;
+    sha256 = "1pdmsmwagimn0lsl4x7sg3skcr2fvzqpv2pjd1rh7yrm5gzrxpmq";
+  };
+
+  nativeBuildInputs = [ setuptools-scm ];
+
+  propagatedBuildInputs = [ zipp ]
+    ++ lib.optionals (!isPy3k) [ pathlib2 contextlib2 configparser ];
+
+  # Cyclic dependencies
+  doCheck = false;
+
+  pythonImportsCheck = [ "importlib_metadata" ];
+
+  meta = with lib; {
+    description = "Read metadata from Python packages";
+    homepage = "https://importlib-metadata.readthedocs.io/";
+    license = licenses.asl20;
+  };
+}
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/importlib-metadata/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/importlib-metadata/default.nix
index edab68aa18..4149de3f43 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/importlib-metadata/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/importlib-metadata/default.nix
@@ -1,42 +1,41 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, setuptools_scm
+, pythonOlder
+, setuptools-scm
+, typing-extensions
+, toml
 , zipp
-, pathlib2
-, contextlib2
-, configparser
-, isPy3k
-, importlib-resources
-, packaging
 }:
 
 buildPythonPackage rec {
   pname = "importlib-metadata";
-  version = "1.7.0";
+  version = "3.7.3";
+  disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     pname = "importlib_metadata";
     inherit version;
-    sha256 = "10vz0ydrzspdhdbxrzwr9vhs693hzh4ff71lnqsifvdzvf66bfwh";
+    sha256 = "742add720a20d0467df2f444ae41704000f50e1234f46174b51f9c6031a1bd71";
   };
 
-  nativeBuildInputs = [ setuptools_scm ];
+  nativeBuildInputs = [ setuptools-scm ];
 
-  propagatedBuildInputs = [ zipp ]
-    ++ lib.optionals (!isPy3k) [ pathlib2 contextlib2 configparser ];
+  propagatedBuildInputs = [
+    toml
+    zipp
+  ] ++ lib.optionals (pythonOlder "3.8") [
+    typing-extensions
+  ];
 
-  doCheck = false; # Cyclic dependencies.
-
-  # removing test_main.py - it requires 'pyflakefs'
-  # and adding `pyflakefs` to `checkInputs` causes infinite recursion.
-  preCheck = ''
-    rm importlib_metadata/tests/test_main.py
-  '';
+  # Cyclic dependencies due to pyflakefs
+  doCheck = false;
+  pythonImportsCheck = [ "importlib_metadata" ];
 
   meta = with lib; {
     description = "Read metadata from Python packages";
     homepage = "https://importlib-metadata.readthedocs.io/";
     license = licenses.asl20;
+    maintainers = with maintainers; [ fab ];
   };
 }
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/importlib-resources/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/importlib-resources/default.nix
index ccb2190cf0..cd8fec1e54 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/importlib-resources/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/importlib-resources/default.nix
@@ -4,19 +4,19 @@
 , setuptools_scm
 , toml
 , importlib-metadata
-, typing
-, singledispatch
+, typing ? null
+, singledispatch ? null
 , pythonOlder
 , python
 }:
 
 buildPythonPackage rec {
   pname = "importlib_resources";
-  version = "3.3.1";
+  version = "5.1.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0ed250dbd291947d1a298e89f39afcc477d5a6624770503034b72588601bcc05";
+    sha256 = "642586fc4740bd1cad7690f836b3321309402b20b332529f25617ff18e8e1370";
   };
 
   nativeBuildInputs = [ setuptools_scm toml ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/incremental/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/incremental/default.nix
index 6241bc869c..6cbed7221a 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/incremental/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/incremental/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "incremental";
-  version = "17.5.0";
+  version = "21.3.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "7b751696aaf36eebfab537e458929e194460051ccad279c72b755a167eebd4b3";
+    sha256 = "02f5de5aff48f6b9f665d99d48bfc7ec03b6e3943210de7cfc88856d755d6f57";
   };
 
   meta = with lib; {
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/intake/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/intake/default.nix
index 49cf660bf5..41207295a2 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/intake/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/intake/default.nix
@@ -23,12 +23,12 @@
 
 buildPythonPackage rec {
   pname = "intake";
-  version = "0.6.1";
+  version = "0.6.2";
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "f09800203fcaf1512f9234e54dbd07ec2b5217aafd21716385725ec052f5a52e";
+    sha256 = "b0cab1d185a703acb38eecb9cff3edd5cc7004fe18a36d5e42a8f7fffc9cca1c";
   };
 
   propagatedBuildInputs = [
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/invoke/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/invoke/default.nix
index 45f3ee7a04..08d72cec49 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/invoke/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/invoke/default.nix
@@ -6,11 +6,11 @@
 
 buildPythonPackage rec {
   pname = "invoke";
-  version = "1.4.1";
+  version = "1.5.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "de3f23bfe669e3db1085789fd859eb8ca8e0c5d9c20811e2407fa042e8a5e15d";
+    sha256 = "f0c560075b5fb29ba14dad44a7185514e94970d1b9d57dcd3723bec5fed92650";
   };
 
   patchPhase = ''
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/ipdb/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/ipdb/default.nix
index 7b8c877371..fbdfd5b790 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/ipdb/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/ipdb/default.nix
@@ -9,12 +9,12 @@
 
 buildPythonPackage rec {
   pname = "ipdb";
-  version = "0.13.4";
+  version = "0.13.7";
   disabled = isPyPy || isPy27;  # setupterm: could not find terminfo database
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "c85398b5fb82f82399fc38c44fe3532c0dde1754abee727d8f5cfcc74547b334";
+    sha256 = "178c367a61c1039e44e17c56fcc4a6e7dc11b33561261382d419b6ddb4401810";
   };
 
   propagatedBuildInputs = [ ipython ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/ipydatawidgets/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/ipydatawidgets/default.nix
index e6e1e605cc..a0efa9b575 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/ipydatawidgets/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/ipydatawidgets/default.nix
@@ -13,13 +13,13 @@
 
 buildPythonPackage rec {
   pname = "ipydatawidgets";
-  version = "4.1.0";
+  version = "4.2.0";
 
   disabled = isPy27;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "d9f94828c11e3b40350fb14a02e027f42670a7c372bcb30db18d552dcfab7c01";
+    sha256 = "d0e4b58b59b508165e8562b8f5d1dbfcd739855847ec0477bd9185a5e9b7c5bc";
   };
 
   propagatedBuildInputs = [
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/ipympl/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/ipympl/default.nix
index 4efe8b176c..44c8c7bfd0 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/ipympl/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/ipympl/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "ipympl";
-  version = "0.5.8";
+  version = "0.7.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0e2f2e540a2dfea61524b7993fc8552c9236b1aaa3826e1f382c75cb2fa5c382";
+    sha256 = "f0f1f356d8cb9d4fb51bb86dbbf837c190145316cb72f66081872ebc4d6db0a1";
   };
 
   propagatedBuildInputs = [ ipywidgets matplotlib ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/ipyparallel/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/ipyparallel/default.nix
index 297b87d574..2c5692bf26 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/ipyparallel/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/ipyparallel/default.nix
@@ -11,7 +11,7 @@
 , ipykernel
 , tornado
 , isPy3k
-, futures
+, futures ? null
 }:
 
 buildPythonPackage rec {
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/ipyvuetify/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/ipyvuetify/default.nix
index c63cee7912..b581c49d43 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/ipyvuetify/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/ipyvuetify/default.nix
@@ -7,12 +7,12 @@
 
 buildPythonPackage rec {
   pname = "ipyvuetify";
-  version = "1.5.1";
+  version = "1.6.2";
 
   # GitHub version tries to run npm (Node JS)
   src = fetchPypi {
     inherit pname version;
-    sha256 = "593f5d6761e304cbb78bca967030485d8835e8d310ef7d83ac1b0e6a13e4911c";
+    sha256 = "056776d359b55343442f707cb4ccd5607800599a36bee06e1f01ef0277f03ddc";
   };
 
   propagatedBuildInputs = [ ipyvue ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/ipywidgets/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/ipywidgets/default.nix
index 5f2b3299a0..a0087131b1 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/ipywidgets/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/ipywidgets/default.nix
@@ -7,6 +7,7 @@
 , mock
 , ipython
 , ipykernel
+, jupyterlab-widgets
 , traitlets
 , notebook
 , widgetsnbextension
@@ -14,11 +15,11 @@
 
 buildPythonPackage rec {
   pname = "ipywidgets";
-  version = "7.5.1";
+  version = "7.6.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "e945f6e02854a74994c596d9db83444a1850c01648f1574adf144fbbabe05c97";
+    sha256 = "9f1a43e620530f9e570e4a493677d25f08310118d315b00e25a18f12913c41f0";
   };
 
   # Tests are not distributed
@@ -28,6 +29,7 @@ buildPythonPackage rec {
   propagatedBuildInputs = [
     ipython
     ipykernel
+    jupyterlab-widgets
     traitlets
     notebook
     widgetsnbextension
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/iterm2/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/iterm2/default.nix
index a62d5068f7..da44563208 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/iterm2/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/iterm2/default.nix
@@ -5,11 +5,11 @@
 
 buildPythonPackage rec {
   pname = "iterm2";
-  version = "1.18";
+  version = "1.19";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "88ca7dd76242205dc82761bf98932a42e6c1ba338cb065f1cc775413ef4e0dc2";
+    sha256 = "04fad95b2258135814677317529654ab0de92b0a4576e4410689181a6a535805";
   };
 
   propagatedBuildInputs = [ protobuf websockets ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/jaraco_collections/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/jaraco_collections/default.nix
index 3c37755366..eac4e2ca32 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/jaraco_collections/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/jaraco_collections/default.nix
@@ -4,10 +4,10 @@
 
 buildPythonPackage rec {
   pname = "jaraco.collections";
-  version = "3.0.0";
+  version = "3.2.0";
   src = fetchPypi {
     inherit pname version;
-    sha256 = "be570ef4f2e7290b757449395238fa63d70a9255574624e73c5ff9f1ee554721";
+    sha256 = "6d179770493c4f5802395ae5a29e07c66d826dc3cd680ad0b0f0fb9fd6cdf533";
   };
 
   pythonNamespaces = [ "jaraco" ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/jaraco_functools/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/jaraco_functools/default.nix
index eb176d0d85..3fa4de9f3d 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/jaraco_functools/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/jaraco_functools/default.nix
@@ -4,11 +4,11 @@
 
 buildPythonPackage rec {
   pname = "jaraco.functools";
-  version = "3.0.1";
+  version = "3.2.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "9fedc4be3117512ca3e03e1b2ffa7a6a6ffa589bfb7d02bfb324e55d493b94f4";
+    sha256 = "97cf88b46ab544c266e2d81fa17bb183622268722a7dd1a3711ea426e9c26f94";
   };
 
   nativeBuildInputs = [ setuptools_scm toml ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/jaraco_itertools/0001-Don-t-run-flake8-checks-during-the-build.patch b/third_party/nixpkgs/pkgs/development/python-modules/jaraco_itertools/0001-Don-t-run-flake8-checks-during-the-build.patch
deleted file mode 100644
index 2dcf7d6486..0000000000
--- a/third_party/nixpkgs/pkgs/development/python-modules/jaraco_itertools/0001-Don-t-run-flake8-checks-during-the-build.patch
+++ /dev/null
@@ -1,27 +0,0 @@
-From fd56b0d85393d684bd3bf99f33d8638da884282f Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
-Date: Thu, 25 Jun 2020 09:52:11 +0100
-Subject: [PATCH] disable flake8/black8/coverage from tests
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Signed-off-by: Jörg Thalheim <joerg@thalheim.io>
----
- pytest.ini | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/pytest.ini b/pytest.ini
-index 5027d34..4e2a2d2 100644
---- a/pytest.ini
-+++ b/pytest.ini
-@@ -1,5 +1,5 @@
- [pytest]
- norecursedirs=dist build .tox .eggs
--addopts=--doctest-modules --flake8 --black --cov
-+addopts=--doctest-modules
- doctest_optionflags=ALLOW_UNICODE ELLIPSIS ALLOW_BYTES
- filterwarnings=
--- 
-2.27.0
-
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/jaraco_itertools/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/jaraco_itertools/default.nix
index f5d0b0538b..91bb83fdb5 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/jaraco_itertools/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/jaraco_itertools/default.nix
@@ -4,21 +4,17 @@
 
 buildPythonPackage rec {
   pname = "jaraco.itertools";
-  version = "5.0.0";
+  version = "6.0.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "6447d567f57efe5efea386265c7864652e9530830a1b80f43e60b4f222b9ab84";
+    sha256 = "6939e47806a39330a9f9772bf9ea910da39abc159ff2579d454a763358553439";
   };
 
   pythonNamespaces = [ "jaraco" ];
 
   nativeBuildInputs = [ setuptools_scm ];
 
-  patches = [
-    ./0001-Don-t-run-flake8-checks-during-the-build.patch
-  ];
-
   propagatedBuildInputs = [ inflect more-itertools six ];
   checkInputs = [ pytest ];
 
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/jaraco_logging/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/jaraco_logging/default.nix
index 4a6391fbc4..e378240e6c 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/jaraco_logging/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/jaraco_logging/default.nix
@@ -4,11 +4,11 @@
 
 buildPythonPackage rec {
   pname = "jaraco.logging";
-  version = "3.0.0";
+  version = "3.1.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "31716fe84d3d5df39d95572942513bd4bf8ae0a478f64031eff4c2ea9e83434e";
+    sha256 = "150dc8701207b28bc65a16f0e91c07250a8d1b9da324ce674c0e375774944f13";
   };
 
   pythonNamespaces = [ "jaraco" ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/jaraco_stream/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/jaraco_stream/default.nix
index 9a4f6d9724..f62cb1db8b 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/jaraco_stream/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/jaraco_stream/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "jaraco.stream";
-  version = "3.0.0";
+  version = "3.0.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "287e1cba9f278e0146fdded6bc40518930813a5584579769aeaa1d0bfd178a73";
+    sha256 = "86c57fedffd4d5a4b18817f99ddf62ac8ed0a1bc31a1c41b9a88df9c6bb56e0b";
   };
 
   pythonNamespaces = [ "jaraco" ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/jaraco_text/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/jaraco_text/default.nix
index c61c8f689d..fb945d5b3f 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/jaraco_text/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/jaraco_text/default.nix
@@ -6,11 +6,11 @@
 
 buildPythonPackage rec {
   pname = "jaraco.text";
-  version = "3.2.0";
+  version = "3.5.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1v0hz3h74m31jlbc5bxwkvrx1h2n7887bajrg1n1c3yc4q8qn1z5";
+    sha256 = "f07f1076814a17a98eb915948b9a0dc71b1891c833588066ec1feb04ea4389b1";
   };
 
   pythonNamespaces = [ "jaraco" ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/javaproperties/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/javaproperties/default.nix
index a9acf380da..dd3c027bca 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/javaproperties/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/javaproperties/default.nix
@@ -5,14 +5,15 @@
 }:
 
 buildPythonPackage rec {
-  version = "0.7.0";
+  version = "0.8.0";
   pname = "javaproperties";
+  format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "jwodder";
     repo = pname;
     rev = "v${version}";
-    sha256 = "14dlzwr4gxlbgjy012i4pqs2rn2rmp21w8n1k1wwjkf26mcvrq5s";
+    sha256 = "0n6dz6rnpq8wdwqyxqwv0q7vrl26vfmvvysdjvy557fck1q2l0kf";
   };
 
   propagatedBuildInputs = [ six ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/joblib/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/joblib/default.nix
index 9c54418baf..e8d2ced760 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/joblib/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/joblib/default.nix
@@ -13,12 +13,12 @@
 
 buildPythonPackage rec {
   pname = "joblib";
-  version = "1.0.0";
+  version = "1.0.1";
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "092bnvr724cfvka8267z687bf086fvm7i1hwslkyrzf1g836dn3s";
+    sha256 = "9c17567692206d2f3fb9ecf5e991084254fe631665c450b443761c4186a613f7";
   };
 
   checkInputs = [ sphinx numpydoc pytestCheckHook ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/josepy/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/josepy/default.nix
index 3f30da8da9..c46e937194 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/josepy/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/josepy/default.nix
@@ -1,31 +1,31 @@
-{ lib, fetchPypi, buildPythonPackage
-# buildInputs
-, six
-, setuptools
-, pyopenssl
+{ lib
+, fetchPypi
+, buildPythonPackage
 , cryptography
+, pyopenssl
+, setuptools
 , mock
 , pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "josepy";
-  version = "1.7.0";
+  version = "1.8.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "d265414fa16d7a8b7a1d1833b4ebb19a22bd0deae5d44413cf9040fd8491d85a";
+    sha256 = "a5a182eb499665d99e7ec54bb3fe389f9cbc483d429c9651f20384ba29564269";
   };
 
   postPatch = ''
     # remove coverage flags
     sed -i '/addopts/d' pytest.ini
+    sed -i '/flake8-ignore/d' pytest.ini
   '';
 
   propagatedBuildInputs = [
     pyopenssl
     cryptography
-    six
     setuptools
   ];
 
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/jpylyzer/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/jpylyzer/default.nix
index 6f9ceb96e3..442267b52e 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/jpylyzer/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/jpylyzer/default.nix
@@ -2,24 +2,24 @@
 , fetchFromGitHub
 , buildPythonPackage
 , six
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "jpylyzer";
-  version = "1.18.0";
+  version = "2.0.0";
 
   src = fetchFromGitHub {
     owner = "openpreserve";
     repo = pname;
     rev = version;
-    sha256 = "0vhrq15l6jd5fm6vj7mczjzjpl2ph1dk8jp89dw4vlccky8660ll";
+    sha256 = "01wfbb1bgby9b7m6q7483kvpyc1qhj80dg8d5a6smcxvmy8y6x5n";
   };
 
   propagatedBuildInputs = [ six ];
 
-  # there don't appear to be any in-tree tests as such, but the builder's automatic
-  # runner seems to be upset by the project layout
-  doCheck = false;
+  checkInputs = [ pytestCheckHook ];
+  pythonImportsCheck = [ "jpylyzer" ];
 
   meta = with lib; {
     description = "JP2 (JPEG 2000 Part 1) image validator and properties extractor";
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/jsonpatch/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/jsonpatch/default.nix
index 8971bac4b4..f77412e4cc 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/jsonpatch/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/jsonpatch/default.nix
@@ -6,11 +6,11 @@
 
 buildPythonPackage rec {
   pname = "jsonpatch";
-  version = "1.27";
+  version = "1.32";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "4d08af10d71723b5b2924da6ba90f273a4d1a5c6accfb605eb970cb2f9b29cf9";
+    sha256 = "b6ddfe6c3db30d81a96aaeceb6baf916094ffa23d7dd5fa2c13e13f8b6e600c2";
   };
 
   # test files are missing
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/jsonpickle/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/jsonpickle/default.nix
index abf3c27e98..78d2a5f6c8 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/jsonpickle/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/jsonpickle/default.nix
@@ -9,11 +9,11 @@
 
 buildPythonPackage rec {
   pname = "jsonpickle";
-  version = "1.4.2";
+  version = "2.0.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "c9b99b28a9e6a3043ec993552db79f4389da11afcb1d0246d93c79f4b5e64062";
+    sha256 = "0be49cba80ea6f87a168aa8168d717d00c6ca07ba83df3cec32d3b30bfe6fb9a";
   };
 
   checkInputs = [ pytest ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/jsonpointer/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/jsonpointer/default.nix
index e1eaaed6c1..39249c648f 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/jsonpointer/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/jsonpointer/default.nix
@@ -5,11 +5,11 @@
 
 buildPythonPackage rec {
   pname = "jsonpointer";
-  version = "2.0";
+  version = "2.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0qjkjy1qlyc1nl3k95wd03ssxac0a717x8889ypgs1cfcj3bm4n1";
+    sha256 = "5a34b698db1eb79ceac454159d3f7c12a451a91f6334a4f638454327b7a89962";
   };
 
   meta = with lib; {
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/jug/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/jug/default.nix
index 7646c00781..0750744885 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/jug/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/jug/default.nix
@@ -6,7 +6,7 @@
 
 buildPythonPackage rec {
   pname = "Jug";
-  version = "2.0.3";
+  version = "2.1.1";
   buildInputs = [ nose numpy ];
   propagatedBuildInputs = [
     bottle
@@ -19,7 +19,7 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "3656355c1f9cd1731065c9d589f66d33653cbe5e0879cbe5d8447b51e4ddb4ec";
+    sha256 = "8ae7bb45d4495cf3d0dc5dd9df104a35bba2ca83eb4576732cadf8469e7cf1a1";
   };
 
   checkInputs = [ pytestCheckHook ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/jupyter-packaging/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/jupyter-packaging/default.nix
index fdc28f08ef..da45616dfa 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/jupyter-packaging/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/jupyter-packaging/default.nix
@@ -1,22 +1,25 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, deprecation
 , pythonOlder
 , packaging
 , pytestCheckHook
+, tomlkit
 }:
 
 buildPythonPackage rec {
   pname = "jupyter-packaging";
-  version = "0.7.12";
+  version = "0.8.2";
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
-    inherit pname version;
-    sha256 = "sha256-sUAyV3GIGn33t/LRSZe2GQY/51rnVrkCWFLkNGAAu7g=";
+    pname = "jupyter_packaging";
+    inherit version;
+    sha256 = "sha256-ddzJDcFyY5Iida4QvpACh0FRBIy95IQHCEF5HQl5QbI=";
   };
 
-  propagatedBuildInputs = [ packaging ];
+  propagatedBuildInputs = [ deprecation packaging tomlkit ];
 
   checkInputs = [ pytestCheckHook ];
 
@@ -24,8 +27,16 @@ buildPythonPackage rec {
     export HOME=$(mktemp -d)
   '';
 
-  # disable tests depending on network connection
-  disabledTests = [ "test_develop" "test_install" ];
+  disabledTests = [
+    # disable tests depending on network connection
+    "test_develop"
+    "test_install"
+    # Avoid unmainted "mocker" fixture library, and calls to dependent "build" module
+    "test_build"
+    "test_npm_build"
+    "test_create_cmdclass"
+    "test_ensure_with_skip_npm"
+  ];
 
   pythonImportsCheck = [ "jupyter_packaging" ];
 
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/jupyter-repo2docker/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/jupyter-repo2docker/default.nix
index 027ae2e40c..7597df0d76 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/jupyter-repo2docker/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/jupyter-repo2docker/default.nix
@@ -12,13 +12,13 @@
 }:
 
 buildPythonPackage rec {
-  version = "2021.1.0";
+  version = "2021.3.0";
   pname = "jupyter-repo2docker";
   disabled = !(pythonAtLeast "3.4");
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "3e3e671407ef2a7f7695338dc6ce2ca9cc75683ffc7a543829cf119564aca802";
+    sha256 = "42e0cf67181bdd03b54dabde695befec0586ed68a4ec1240104e209997d776c4";
   };
 
   propagatedBuildInputs = [
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/jupyter_client/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/jupyter_client/default.nix
index 456e82e75f..5f534557a9 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/jupyter_client/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/jupyter_client/default.nix
@@ -12,11 +12,11 @@
 
 buildPythonPackage rec {
   pname = "jupyter_client";
-  version = "6.1.11";
+  version = "6.1.12";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "649ca3aca1e28f27d73ef15868a7c7f10d6e70f761514582accec3ca6bb13085";
+    sha256 = "c4bca1d0846186ca8be97f4d2fa6d2bae889cce4892a167ffa1ba6bd1f73e782";
   };
 
   propagatedBuildInputs = [
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/jupyter_console/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/jupyter_console/default.nix
index 712117d501..22e057a565 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/jupyter_console/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/jupyter_console/default.nix
@@ -12,12 +12,12 @@
 
 buildPythonPackage rec {
   pname = "jupyter_console";
-  version = "6.3.0";
+  version = "6.4.0";
   disabled = pythonOlder "3.5";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "947f66bbdeee2221b4fb3a6b78225d337b8f10832f14cecf7932183635abe1d9";
+    sha256 = "242248e1685039cd8bff2c2ecb7ce6c1546eb50ee3b08519729e6e881aec19c7";
   };
 
   propagatedBuildInputs = [
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/jupyter_server/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/jupyter_server/default.nix
index a9f98781b4..50f193c205 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/jupyter_server/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/jupyter_server/default.nix
@@ -4,6 +4,7 @@
 , pythonOlder
 , pytestCheckHook
 , pytest-tornasync
+, argon2_cffi
 , jinja2
 , tornado
 , pyzmq
@@ -22,12 +23,12 @@
 
 buildPythonPackage rec {
   pname = "jupyter_server";
-  version = "1.4.1";
+  version = "1.5.0";
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-sBJvI39nlTPuxGJEz8ZtYeOh+OwPrS1HNS+hnT51Tkc=";
+    sha256 = "ff127713a57ab7aa7b23f7df9b082951cc4b05d8d64cc0949d01ea02ac24c70c";
   };
 
   postPatch = ''
@@ -36,6 +37,7 @@ buildPythonPackage rec {
   '';
 
   propagatedBuildInputs = [
+    argon2_cffi
     jinja2
     tornado
     pyzmq
@@ -64,7 +66,12 @@ buildPythonPackage rec {
   pytestFlagsArray = [ "jupyter_server/tests/" ];
 
   # disabled failing tests
-  disabledTests = [ "test_server_extension_list" "test_list_formats" "test_base_url" ];
+  disabledTests = [
+    "test_server_extension_list"
+    "test_list_formats"
+    "test_base_url"
+    "test_culling"
+  ];
 
   meta = with lib; {
     description = "The backend—i.e. core services, APIs, and REST endpoints—to Jupyter web applications.";
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/jupyterlab-widgets/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/jupyterlab-widgets/default.nix
new file mode 100644
index 0000000000..c4589ce1b9
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/development/python-modules/jupyterlab-widgets/default.nix
@@ -0,0 +1,30 @@
+{ lib, buildPythonPackage, fetchPypi
+, jupyter-packaging
+}:
+
+buildPythonPackage rec {
+  pname = "jupyterlab-widgets";
+  version = "1.0.0";
+
+  src = fetchPypi {
+    pname = "jupyterlab_widgets";
+    inherit version;
+    sha256 = "0y7vhhas3qndiypcpcfnhrj9n92v2w4hdc86nn620s9h9nl2j6jw";
+  };
+
+  nativeBuildInputs = [
+    jupyter-packaging
+  ];
+
+  # has no tests
+  doCheck = false;
+
+  pythonImportsCheck = [ "jupyterlab_widgets" ];
+
+  meta = with lib; {
+    description = "Jupyter Widgets JupyterLab Extension";
+    homepage = "https://github.com/jupyter-widgets/ipywidgets";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ jonringer SuperSandro2000 ];
+  };
+}
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/jupyterlab/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/jupyterlab/default.nix
index 513cce507e..ba2c0ed488 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/jupyterlab/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/jupyterlab/default.nix
@@ -10,12 +10,12 @@
 
 buildPythonPackage rec {
   pname = "jupyterlab";
-  version = "3.0.12";
+  version = "3.0.14";
   disabled = pythonOlder "3.5";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "929c60d7fb4aa704084c02d8ededc209b8b378e0b3adab46158b7fa6acc24230";
+    sha256 = "sha256-cTqEmR38yowLwmCRHxvVSsJaOGqGKFcTuVVaYPeVBZs=";
   };
 
   nativeBuildInputs = [ jupyter-packaging ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/jupytext/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/jupytext/default.nix
index ba627449c1..eedfcfbcb6 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/jupytext/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/jupytext/default.nix
@@ -8,13 +8,13 @@
 
 buildPythonPackage rec {
   pname = "jupytext";
-  version = "1.7.1";
+  version = "1.11.0";
 
   disabled = isPy27;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "23123b90c267c67716fe6a022dfae49b84fd3809370d83211f2920eb3106bf40";
+    sha256 = "9062d001baaa32430fbb94a2c9394ac906db0a58da94e7aa4e414b73fd7d51bc";
   };
 
   propagatedBuildInputs = [
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/karton-mwdb-reporter/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/karton-mwdb-reporter/default.nix
index 9f4c1ee670..68b28bffe6 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/karton-mwdb-reporter/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/karton-mwdb-reporter/default.nix
@@ -1,10 +1,8 @@
 { lib
 , buildPythonPackage
-, chardet
 , fetchFromGitHub
 , karton-core
 , mwdblib
-, python
 }:
 
 buildPythonPackage rec {
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/keepkey/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/keepkey/default.nix
index 6b4568cd74..cd51661bde 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/keepkey/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/keepkey/default.nix
@@ -3,13 +3,13 @@
 
 buildPythonPackage rec {
   pname = "keepkey";
-  version = "6.6.0";
+  version = "6.7.0";
 
   src = fetchFromGitHub {
     owner = "keepkey";
     repo = "python-keepkey";
     rev = "v${version}";
-    sha256 = "1v0ns26ykskn0dpbvz9g6lz4q740qmahvddj3pc3rfbjvg43p3vh";
+    sha256 = "0yi27wzb4q371y4bywi4hz37h4x63wjsyaa2mbx0rgc8xl2wm6yz";
   };
 
   propagatedBuildInputs = [ protobuf hidapi trezor ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/keyring/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/keyring/default.nix
index 3e26079f12..cea38abee3 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/keyring/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/keyring/default.nix
@@ -1,43 +1,64 @@
-{ lib, stdenv, buildPythonPackage, fetchPypi, isPy27, pythonOlder
-, dbus-python
-, entrypoints
+{ lib
+, stdenv
+, buildPythonPackage
+, fetchPypi
+, pythonOlder
+, setuptools-scm
 , importlib-metadata
-, pytest
-, pytest-flake8
+, dbus-python
+, jeepney
 , secretstorage
-, setuptools_scm
-, toml
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "keyring";
-  version = "21.5.0";
-  disabled = isPy27;
+  version = "23.0.1";
+  disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "207bd66f2a9881c835dad653da04e196c678bf104f8252141d2d3c4f31051579";
+    sha256 = "045703609dd3fccfcdb27da201684278823b72af515aedec1a8515719a038cb8";
   };
 
   nativeBuildInputs = [
-    setuptools_scm
-    toml
+    setuptools-scm
   ];
 
-  checkInputs = [ pytest pytest-flake8 ];
+  propagatedBuildInputs = [
+    # this should be optional, however, it has a different API
+    importlib-metadata # see https://github.com/jaraco/keyring/issues/503#issuecomment-798973205
 
-  propagatedBuildInputs = [ dbus-python entrypoints ]
-  ++ lib.optional stdenv.isLinux secretstorage
-  ++ lib.optionals (pythonOlder "3.8") [ importlib-metadata ];
+    dbus-python
+    jeepney
+    secretstorage
+  ];
 
-  # checks try to access a darwin path on linux
-  doCheck = false;
+  pythonImportsCheck = [
+    "keyring"
+    "keyring.backend"
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  # Keychain communications isn't possible in our build environment
+  # keyring.errors.KeyringError: Can't get password from keychain: (-25307, 'Unknown Error')
+  disabledTests = lib.optionals (stdenv.isDarwin) [
+    "test_multiprocess_get"
+    "test_multiprocess_get_after_native_get"
+  ];
+
+  disabledTestPaths = [
+    "tests/backends/test_macOS.py"
+  ];
 
   meta = with lib; {
     description = "Store and access your passwords safely";
-    homepage    = "https://pypi.python.org/pypi/keyring";
-    license     = licenses.psfl;
-    maintainers = with maintainers; [ lovek323 ];
+    homepage    = "https://github.com/jaraco/keyring";
+    license     = licenses.mit;
+    maintainers = with maintainers; [ lovek323 dotlambda ];
     platforms   = platforms.unix;
   };
 }
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/kmapper/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/kmapper/default.nix
index 548896b472..6c17366108 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/kmapper/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/kmapper/default.nix
@@ -15,11 +15,11 @@
 
 buildPythonPackage rec {
   pname = "kmapper";
-  version = "1.4.1";
+  version = "2.0.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "3bb09d016ae0dc3308c2901f0775139a26e7f689afacea564a74e5627de35cd7";
+    sha256 = "3708d889f96f6bbe89c52000dd9378ca4c35638180ff894b64ebbdfcfe62aab2";
   };
 
   propagatedBuildInputs = [
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/labelbox/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/labelbox/default.nix
index 1c29d74736..ce7cff4d79 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/labelbox/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/labelbox/default.nix
@@ -14,11 +14,11 @@
 
 buildPythonPackage rec {
   pname = "labelbox";
-  version = "2.4.11";
+  version = "2.5.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "e5a631a94ac2059648a884bebf39f7ca1e689baef4a2497f9aa5ec598e24deb7";
+    sha256 = "7f2cbc5d4869d8acde865ad519fc1cc85338247cd7cf534334f988a040679219";
   };
 
   propagatedBuildInputs = [
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/langcodes/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/langcodes/default.nix
index f9d90e4268..485bc44ff6 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/langcodes/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/langcodes/default.nix
@@ -8,12 +8,12 @@
 
 buildPythonPackage rec {
   pname = "langcodes";
-  version = "2.1.0";
+  version = "3.1.0";
   disabled = pythonOlder "3.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "75bcaca8825e1a321965b136815dee53083c63314975e024ad0ccff8545e681f";
+    sha256 = "1ccd37e3a68760d29ec3b17f5962cd1d8f242f4d9705ad1601c5cb7fab48199c";
   };
 
   propagatedBuildInputs = [ marisa-trie ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/lazy-object-proxy/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/lazy-object-proxy/default.nix
index 82a784cfe3..9eaae90f46 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/lazy-object-proxy/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/lazy-object-proxy/default.nix
@@ -1,26 +1,32 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, pytest
+, pytestCheckHook
 , setuptools_scm
 }:
 
 buildPythonPackage rec {
   pname = "lazy-object-proxy";
-  version = "1.5.2";
+  version = "1.6.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "5944a9b95e97de1980c65f03b79b356f30a43de48682b8bdd90aa5089f0ec1f4";
+    sha256 = "489000d368377571c6f982fba6497f2aa13c6d1facc40660963da62f5c379726";
   };
 
-  nativeBuildInputs = [ setuptools_scm ];
+  nativeBuildInputs = [
+    setuptools_scm
+  ];
 
-  checkInputs = [ pytest ];
-  checkPhase = ''
-    py.test tests
+  postPatch = ''
+    substituteInPlace pyproject.toml --replace ",<6.0" ""
+    substituteInPlace setup.cfg --replace ",<6.0" ""
   '';
 
+  checkInputs = [
+    pytestCheckHook
+  ];
+
   # Broken tests. Seem to be fixed upstream according to Travis.
   doCheck = false;
 
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/ldap3/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/ldap3/default.nix
index 71af0d294a..3c613d74e2 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/ldap3/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/ldap3/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "ldap3";
-  version = "2.8.1";
+  version = "2.9";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "37d633e20fa360c302b1263c96fe932d40622d0119f1bddcb829b03462eeeeb7";
+    sha256 = "18c3ee656a6775b9b0d60f7c6c5b094d878d1d90fc03d56731039f0a4b546a91";
   };
 
   propagatedBuildInputs = [ pyasn1 ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/libarcus/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/libarcus/default.nix
index 6e5d8f771e..edea85876a 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/libarcus/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/libarcus/default.nix
@@ -3,14 +3,14 @@
 
 buildPythonPackage rec {
   pname = "libarcus";
-  version = "4.8.0";
+  version = "4.9.0";
   format = "other";
 
   src = fetchFromGitHub {
     owner = "Ultimaker";
     repo = "libArcus";
     rev = version;
-    sha256 = "1dvz1rkvm4309yzvj7vy49v1vskr5yfq4nzqdiydp1jb7zpvhqqm";
+    sha256 = "0wq72nf680bwxijjajb4piw563rnvflshmw96kqln4lsny7ydjj2";
   };
 
   disabled = pythonOlder "3.4.0";
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/libgpuarray/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/libgpuarray/default.nix
index 567ad2cf48..d061356490 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/libgpuarray/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/libgpuarray/default.nix
@@ -17,13 +17,13 @@ assert cudaSupport -> nvidia_x11 != null
 
 buildPythonPackage rec {
   pname = "libgpuarray";
-  version = "0.7.5";
+  version = "0.7.6";
 
   src = fetchFromGitHub {
     owner = "Theano";
     repo = "libgpuarray";
     rev = "v${version}";
-    sha256 = "0zkdwjq3k6ciiyf8y5w663fbsnmzhgy27yvpxfhkpxazw9vg3l5v";
+    sha256 = "0ksil18c9ign4xrv5k323flhvdy6wdxh8szdd3nivv31jc3zsdri";
   };
 
   # requires a GPU
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/libsavitar/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/libsavitar/default.nix
index 7ef22e3f6e..f6aa1b378f 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/libsavitar/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/libsavitar/default.nix
@@ -2,14 +2,14 @@
 
 buildPythonPackage rec {
   pname = "libsavitar";
-  version = "4.8.0";
+  version = "4.9.0";
   format = "other";
 
   src = fetchFromGitHub {
     owner = "Ultimaker";
     repo = "libSavitar";
     rev = version;
-    sha256 = "1mxkvnhn8k1a86jlnjnlpf0b8dvrcg3n7pslf60s13cgb7w3sfzh";
+    sha256 = "0434cb19v9phc9xicbmgpbig18ivplcpqhnsjgca4p8n8c715k9h";
   };
 
   postPatch = ''
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/libversion/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/libversion/default.nix
index 4bc2dfa2ff..fb77eeed4c 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/libversion/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/libversion/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "libversion";
-  version = "1.2.2";
+  version = "1.2.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "cf9ef702d0bc750f0ad44a2cffe8ebd83cd356b92cc25f767846509f84ea7e73";
+    sha256 = "e6e903cc6307c3eda90401373eb81bfd0dd2dc93772ddab3d23705bed0c6f6e9";
   };
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/liquidctl/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/liquidctl/default.nix
index 97d80fbbbd..ecf5990e74 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/liquidctl/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/liquidctl/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "liquidctl";
-  version = "1.4.2";
+  version = "1.5.1";
   disabled = pythonOlder "3.6";
 
   src = fetchFromGitHub {
     owner  = pname;
     repo   = pname;
     rev    = "v${version}";
-    sha256 = "1h5kqpvlx7xppd2wli986lkslqkcrlz1wixv7fvrppzjc2nfz5d4";
+    sha256 = "1l6cvm8vs2gkmg4qwg5m5vqjql1gah2vd9vs7pcj2v5hf0cm5v9x";
   };
 
   propagatedBuildInputs = [
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/livestreamer/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/livestreamer/default.nix
index 98878c9064..b77cf43071 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/livestreamer/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/livestreamer/default.nix
@@ -4,8 +4,8 @@
 , isPyPy
 , pycrypto
 , requests
-, singledispatch
-, futures
+, singledispatch ? null
+, futures ? null
 , isPy27
 }:
 
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/llvmlite/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/llvmlite/default.nix
index 609dcb8223..b5e6847a9f 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/llvmlite/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/llvmlite/default.nix
@@ -12,13 +12,13 @@
 
 buildPythonPackage rec {
   pname = "llvmlite";
-  version = "0.35.0";
+  version = "0.36.0";
 
   disabled = isPyPy || !isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "80e51d5aa02ad72da9870e89d21f9b152b0220ca551b4596a6c0614bcde336fc";
+    sha256 = "765128fdf5f149ed0b889ffbe2b05eb1717f8e20a5c87fa2b4018fbcce0fcfc9";
   };
 
   nativeBuildInputs = [ llvm ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/lmdb/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/lmdb/default.nix
index f3e7a86a2a..fc7748765f 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/lmdb/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/lmdb/default.nix
@@ -9,11 +9,11 @@
 
 buildPythonPackage rec {
   pname = "lmdb";
-  version = "1.0.0";
+  version = "1.1.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "4136ffdf0aad61da86d1402808029d002a771b2a9ccc9b39c6bcafa7847c21b6";
+    sha256 = "165cd1669b29b16c2d5cc8902b90fede15a7ee475c54d466f1444877a3f511ac";
   };
 
   buildInputs = [ lmdb ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/logzero/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/logzero/default.nix
index 015d387f27..4e3ffd255e 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/logzero/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/logzero/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "logzero";
-  version = "1.6.3";
+  version = "1.7.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1435284574e409b8ec8b680f276bca04cab41f93d6eff4dc8348b7630cddf560";
+    sha256 = "7f73ddd3ae393457236f081ffebd044a3aa2e423a47ae6ddb5179ab90d0ad082";
   };
 
   checkInputs = [ pytest ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/mail-parser/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/mail-parser/default.nix
index 94b575f3f4..219a9066dc 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/mail-parser/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/mail-parser/default.nix
@@ -2,14 +2,14 @@
 
 buildPythonPackage rec {
   pname = "mail-parser";
-  version = "3.12.0";
+  version = "3.15.0";
 
   # no tests in PyPI tarball
   src = fetchFromGitHub {
     owner = "SpamScope";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0p851jlly6bzcs70kd1lcjwmg4scwh1icymfc0f2y6rkh4kfsdhk";
+    sha256 = "0da2qr4p8jnjw6jdhbagm6slfcjnjyyjkszwfcfqvcywh1zm1sdw";
   };
 
   LC_ALL = "en_US.utf-8";
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/markdown-it-py/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/markdown-it-py/default.nix
index 2d915762fc..c7a8a3e17f 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/markdown-it-py/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/markdown-it-py/default.nix
@@ -7,7 +7,7 @@
 
 buildPythonPackage rec {
   pname = "markdown-it-py";
-  version = "0.5.6";
+  version = "0.6.2";
 
   disabled = pythonOlder "3.7";
 
@@ -15,7 +15,7 @@ buildPythonPackage rec {
     owner = "executablebooks";
     repo = "markdown-it-py";
     rev = "v${version}";
-    sha256 = "1m9g8xvd7jiz80x9hl8bw9x0ppndqq5nlcn5y8bjxnfj5s31vpbi";
+    sha256 = "1g9p8pdnvjya436lii63r5gjajhmbhmyh9ngbjqf9dqny05nagz1";
   };
 
   propagatedBuildInputs = [ attrs ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/markdown/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/markdown/default.nix
index 22b0d5c27f..c0175a2e88 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/markdown/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/markdown/default.nix
@@ -11,11 +11,11 @@
 
 buildPythonPackage rec {
   pname = "Markdown";
-  version = "3.3.3";
+  version = "3.3.4";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "5d9f2b5ca24bc4c7a390d22323ca4bad200368612b5aaa7796babf971d2b2f18";
+    sha256 = "31b5b491868dcc87d6c24b7e3d19a0d730d59d3e46f4eea6430a321bed387a49";
   };
 
   propagatedBuildInputs = [
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/marshmallow/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/marshmallow/default.nix
index afc378d4aa..a7ca14beb9 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/marshmallow/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/marshmallow/default.nix
@@ -4,7 +4,7 @@
 
 buildPythonPackage rec {
   pname = "marshmallow";
-  version = "3.9.1";
+  version = "3.10.0";
   disabled = isPy27;
 
   meta = {
@@ -18,7 +18,7 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "73facc37462dfc0b27f571bdaffbef7709e19f7a616beb3802ea425b07843f4e";
+    sha256 = "4ab2fdb7f36eb61c3665da67a7ce281c8900db08d72ba6bf0e695828253581f7";
   };
 
   propagatedBuildInputs = [ dateutil simplejson ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/md2gemini/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/md2gemini/default.nix
new file mode 100644
index 0000000000..7b4686dcac
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/development/python-modules/md2gemini/default.nix
@@ -0,0 +1,23 @@
+{ lib, buildPythonPackage, fetchPypi, mistune_2_0, cjkwrap, wcwidth
+, pytestCheckHook }:
+
+buildPythonPackage rec {
+  pname = "md2gemini";
+  version = "1.8.1";
+
+  propagatedBuildInputs = [ mistune_2_0 cjkwrap wcwidth ];
+  checkInputs = [ pytestCheckHook ];
+  pythonImportsCheck = [ "md2gemini" ];
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "0mfa0f0m762168fbsxjr1cx9yhj82dr8z1d28jl6hj9bkqnvvwiy";
+  };
+
+  meta = with lib; {
+    description = "Markdown to Gemini text format conversion library";
+    homepage = "https://github.com/makeworld-the-better-one/md2gemini";
+    license = licenses.lgpl3Plus;
+    maintainers = [ maintainers.kaction ];
+  };
+}
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/minio/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/minio/default.nix
index 09389f7cf1..b23d264f72 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/minio/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/minio/default.nix
@@ -13,12 +13,12 @@
 
 buildPythonPackage rec {
   pname = "minio";
-  version = "6.0.2";
+  version = "7.0.2";
   disabled = !isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "acae9bfae0aec1b92025bd63e18135ebb4994c84600716c5323e14cb0c9a0b03";
+    sha256 = "f2f6022cfe4694d946972efef2a752f87d08cc030940faa50a640088772953c8";
   };
 
   propagatedBuildInputs = [
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/mistune/common.nix b/third_party/nixpkgs/pkgs/development/python-modules/mistune/common.nix
new file mode 100644
index 0000000000..7aba4ade41
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/development/python-modules/mistune/common.nix
@@ -0,0 +1,19 @@
+{ lib, buildPythonPackage, fetchPypi, nose, version, sha256 }:
+
+buildPythonPackage rec {
+  inherit version;
+  pname = "mistune";
+
+  src = fetchPypi {
+    inherit pname version sha256;
+  };
+
+  buildInputs = [ nose ];
+  pythonImportsCheck = [ "mistune" ];
+
+  meta = with lib; {
+    description = "The fastest markdown parser in pure Python";
+    homepage = "https://github.com/lepture/mistune";
+    license = licenses.bsd3;
+  };
+}
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/mistune/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/mistune/default.nix
index cde668bd5f..3020eca4ee 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/mistune/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/mistune/default.nix
@@ -1,23 +1,11 @@
-{ lib
-, buildPythonPackage
-, fetchPypi
-, nose
-}:
-
-buildPythonPackage rec {
-  pname = "mistune";
-  version = "0.8.4";
-
-  src = fetchPypi {
-    inherit pname version;
+self: rec {
+  mistune_0_8 = self.callPackage ./common.nix {
+    version = "0.8.4";
     sha256 = "59a3429db53c50b5c6bcc8a07f8848cb00d7dc8bdb431a4ab41920d201d4756e";
   };
-
-  buildInputs = [ nose ];
-
-  meta = with lib; {
-    description = "The fastest markdown parser in pure Python";
-    homepage = "https://github.com/lepture/mistune";
-    license = licenses.bsd3;
+  mistune_2_0 = self.callPackage ./common.nix {
+    version = "2.0.0a4";
+    sha256 = "0i6cblmjl58kdmaa21xm0l1ls0kvjpfy45sf73fw3ws6305f628k";
   };
+  mistune = mistune_0_8;
 }
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/mlflow/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/mlflow/default.nix
index 5ffde39733..13cfc0b63d 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/mlflow/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/mlflow/default.nix
@@ -25,12 +25,12 @@
 
 buildPythonPackage rec {
   pname = "mlflow";
-  version = "1.12.1";
+  version = "1.14.1";
   disabled = isPy27;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "9b8af18d6e779fbbb094edfeb963691e485bba62eeec39fd62dfbe34bc12afeb";
+    sha256 = "e3abff0831564d9a4b5d5a15e5ee76b0f5b4580b362c24a58ee821634c8fb1a3";
   };
 
   # run into https://stackoverflow.com/questions/51203641/attributeerror-module-alembic-context-has-no-attribute-config
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/mne-python/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/mne-python/default.nix
index 84babe1718..bed191c39e 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/mne-python/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/mne-python/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "mne-python";
-  version = "0.21.2";
+  version = "0.22.0";
 
   disabled = isPy27;
 
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     owner = "mne-tools";
     repo = pname;
     rev = "v${version}";
-    sha256 = "18nfdbkffmxzkkbp3d4w8r2kfi0sxip3hy997d3mx6dy74jc7nmg";
+    sha256 = "1s9pshrl40gkcsdwf4qdga3hjfmdbrvbgjcz0cfx3kl796x3im11";
   };
 
   propagatedBuildInputs = [ numpy scipy ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/moderngl/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/moderngl/default.nix
index 48abc30c9f..f32f541573 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/moderngl/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/moderngl/default.nix
@@ -8,11 +8,11 @@
 
 buildPythonPackage rec {
   pname = "moderngl";
-  version = "5.5.4";
+  version = "5.6.4";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "08badabb6a1bbc9aa9e65fae8ecd3275d8342cb45d9c457b19e32b3312a8b663";
+    sha256 = "8c6d04559f5e3bf75a18525cd46d213c0f3a8409363718978e6de691bdb551fb";
   };
 
   disabled = !isPy3k;
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/mongoengine/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/mongoengine/default.nix
index c8969d9e2d..06f2c21041 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/mongoengine/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/mongoengine/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "mongoengine";
-  version = "0.22.0";
+  version = "0.23.0";
   disabled = isPy27;
 
   src = fetchFromGitHub {
     owner = "MongoEngine";
     repo = pname;
     rev = "v${version}";
-    sha256 = "14n9rl8w3i1fq96f3jzsg7gy331d7fmrapva6m38ih53rnf38bdf";
+    sha256 = "0mzh5pv0n81ms046yxb9rzql8bpbsf26jv6dihmhi0ds4yqkw836";
   };
 
   propagatedBuildInputs = [
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/monty/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/monty/default.nix
index 77448d0e15..a2398ce750 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/monty/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/monty/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "monty";
-  version = "3.0.2";
+  version = "2021.3.3";
   disabled = isPy27; # uses type annotations
 
   # No tests in Pypi
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "materialsvirtuallab";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1wxqxp0j7i6czdpr2r1imgmy3qbgn2l7d4za2h1lg3hllvx6jra1";
+    sha256 = "1nbv0ys0fv70rgzskkk8gsfr9dsmm7ykim5wv36li840zsj83b1l";
   };
 
   checkInputs = [ lsof nose numpy msgpack coverage coveralls pymongo];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/moto/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/moto/default.nix
index ddc3896c6a..7f9b7010c5 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/moto/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/moto/default.nix
@@ -37,7 +37,8 @@ buildPythonPackage rec {
 
   postPatch = ''
     substituteInPlace setup.py \
-      --replace "ecdsa<0.15" "ecdsa"
+      --replace "ecdsa<0.15" "ecdsa" \
+      --replace "idna<3,>=2.5" "idna" \
   '';
 
   patches = [
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/mpmath/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/mpmath/default.nix
index 42de3d2da9..59ebfc7091 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/mpmath/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/mpmath/default.nix
@@ -1,17 +1,22 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, setuptools-scm
 }:
 
 buildPythonPackage rec {
   pname = "mpmath";
-  version = "1.1.0";
+  version = "1.2.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "fc17abe05fbab3382b61a123c398508183406fa132e0223874578e20946499f6";
+    sha256 = "79ffb45cf9f4b101a807595bcb3e72e0396202e0b1d25d689134b48c4216a81a";
   };
 
+  nativeBuildInputs = [
+    setuptools-scm
+  ];
+
   # error: invalid command 'test'
   doCheck = false;
 
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/msrest/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/msrest/default.nix
index acdcf69e30..6eb6e49cdd 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/msrest/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/msrest/default.nix
@@ -6,14 +6,14 @@
 , requests_oauthlib
 , isodate
 , certifi
-, enum34
+, enum34 ? null
 , typing
 , aiohttp
 , aiodns
 , pytest
 , httpretty
 , mock
-, futures
+, futures ? null
 , trio
 }:
 
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/nbsphinx/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/nbsphinx/default.nix
index 2622b815f1..c02baa571e 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/nbsphinx/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/nbsphinx/default.nix
@@ -12,11 +12,11 @@
 
 buildPythonPackage rec {
   pname = "nbsphinx";
-  version = "0.8.1";
+  version = "0.8.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "19lf036h0d9ryqasrh91myhn3dq5zcw4rik9jy6sayq7l6irmm94";
+    sha256 = "53352237e2363079f6e38637a8ce90b47e720c8e2eb133a6a6f66fc13ff494cb";
   };
 
   propagatedBuildInputs = [
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/ncclient/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/ncclient/default.nix
index ba3b9e4b08..2e352be412 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/ncclient/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/ncclient/default.nix
@@ -10,11 +10,11 @@
 
 buildPythonPackage rec {
   pname = "ncclient";
-  version = "0.6.9";
+  version = "0.6.10";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0112f2ad41fb658f52446d870853a63691d69299c73c7351c520d38dbd8dc0c4";
+    sha256 = "67b1eba5a6c7c6075746d8c33d4e8f4ded17604034c1fcd1c78996ef52bf66ff";
   };
 
   checkInputs = [ nose rednose ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/nest-asyncio/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/nest-asyncio/default.nix
index 56c6044ba7..33c37d5e98 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/nest-asyncio/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/nest-asyncio/default.nix
@@ -5,13 +5,13 @@
 }:
 
 buildPythonPackage rec {
-  version = "1.4.3";
+  version = "1.5.1";
   pname = "nest_asyncio";
   disabled = !(pythonAtLeast "3.5");
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "eaa09ef1353ebefae19162ad423eef7a12166bcc63866f8bff8f3635353cd9fa";
+    sha256 = "afc5a1c515210a23c461932765691ad39e8eba6551c055ac8d5546e69250d0aa";
   };
 
   # tests not packaged with source dist as of 1.3.2/1.3.2, and
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/nilearn/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/nilearn/default.nix
index e1efdf26de..e3ce770398 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/nilearn/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/nilearn/default.nix
@@ -3,11 +3,11 @@
 
 buildPythonPackage rec {
   pname = "nilearn";
-  version = "0.7.0";
+  version = "0.7.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1rhpy6na7hkhc211ri14zghvmb2fxkh995wi09pkc68klf1dzjg7";
+    sha256 = "8b1409a5e1f0f6d1a1f02555c2f11115a2364f45f1e57bcb5fb3c9ea11f346fa";
   };
 
   checkInputs = [ pytestCheckHook ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/nltk/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/nltk/default.nix
index 298b32ed8b..c87a935a30 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/nltk/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/nltk/default.nix
@@ -1,4 +1,4 @@
-{ fetchPypi, buildPythonPackage, lib, six, singledispatch, isPy3k
+{ fetchPypi, buildPythonPackage, lib, six, singledispatch ? null, isPy3k
 , click
 , joblib
 , regex
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/notebook/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/notebook/default.nix
index bfc5d8c60c..c7dc40d707 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/notebook/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/notebook/default.nix
@@ -27,12 +27,12 @@
 
 buildPythonPackage rec {
   pname = "notebook";
-  version = "6.2.0";
+  version = "6.3.0";
   disabled = !isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0464b28e18e7a06cec37e6177546c2322739be07962dd13bf712bcb88361f013";
+    sha256 = "cbc9398d6c81473e9cdb891d2cae9c0d3718fca289dda6d26df5cb660fcadc7d";
   };
 
   LC_ALL = "en_US.utf8";
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/numba/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/numba/default.nix
index 48ed52499c..211e9d6185 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/numba/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/numba/default.nix
@@ -12,14 +12,14 @@
 }:
 
 buildPythonPackage rec {
-  version = "0.52.0";
+  version = "0.53.0";
   pname = "numba";
   # uses f-strings, python 3.9 is not yet supported
   disabled = pythonOlder "3.6" || pythonAtLeast "3.9";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "44661c5bd85e3d3619be0a40eedee34e397e9ccb3d4c458b70e10bf95d1ce933";
+    sha256 = "55c11d7edbba2ba715f2b56f5294cad55cfd87bff98e2627c3047c2d5cc52d16";
   };
 
   NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isDarwin "-I${libcxx}/include/c++/v1";
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/numexpr/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/numexpr/default.nix
index e5a36fe454..c2630d75eb 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/numexpr/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/numexpr/default.nix
@@ -7,11 +7,11 @@
 
 buildPythonPackage rec {
   pname = "numexpr";
-  version = "2.7.2";
+  version = "2.7.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1ai3i5n07csnzfsxf2dxp8cpdk6ajl5iv8rv0fj6n9ag7qphixac";
+    sha256 = "43616529f9b7d1afc83386f943dc66c4da5e052f00217ba7e3ad8dd1b5f3a825";
   };
 
   # Remove existing site.cfg, use the one we built for numpy.
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/numpy/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/numpy/default.nix
index ed6f80b34a..c5f6053058 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/numpy/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/numpy/default.nix
@@ -40,14 +40,14 @@ let
   };
 in buildPythonPackage rec {
   pname = "numpy";
-  version = "1.20.1";
+  version = "1.20.2";
   format = "pyproject.toml";
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
     extension = "zip";
-    sha256 = "02m6sms6wb4flfg8y4h0msan4y7w7qgfqxhdk21lcabhm2339iiv";
+    sha256 = "1vkc1739lwqx0n9dwxzmy18axlz22za034xa8jh0lmfpbazj52c7";
   };
 
   patches = lib.optionals python.hasDistutilsCxxPatch [
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/onnx/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/onnx/default.nix
index 90683a84f4..cf1d595d90 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/onnx/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/onnx/default.nix
@@ -8,25 +8,21 @@
 , numpy
 , six
 , typing-extensions
-, typing
-, pytestrunner
-, pytest
+, pytestCheckHook
 , nbval
 , tabulate
 }:
 
 buildPythonPackage rec {
   pname = "onnx";
-  version = "1.8.1";
+  version = "1.9.0";
 
-  # Due to Protobuf packaging issues this build of Onnx with Python 2 gives
-  # errors on import.
-  # Also support for Python 2 will be deprecated from Onnx v1.8.
+  # Python 2 is not supported as of Onnx v1.8
   disabled = isPy27;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "9d65c52009a90499f8c25fdfe5acda3ac88efe0788eb1d5f2575a989277145fb";
+    sha256 = "0yjv2axz2vc2ysniwislsp53fsb8f61y1warrr2ppn2d9ijml1d9";
   };
 
   nativeBuildInputs = [ cmake ];
@@ -36,11 +32,10 @@ buildPythonPackage rec {
     numpy
     six
     typing-extensions
-  ] ++ lib.optional (pythonOlder "3.5") [ typing ];
+  ];
 
   checkInputs = [
-    pytestrunner
-    pytest
+    pytestCheckHook
     nbval
     tabulate
   ];
@@ -48,6 +43,9 @@ buildPythonPackage rec {
   postPatch = ''
     chmod +x tools/protoc-gen-mypy.sh.in
     patchShebangs tools/protoc-gen-mypy.sh.in tools/protoc-gen-mypy.py
+
+    substituteInPlace setup.py \
+      --replace "setup_requires.append('pytest-runner')" ""
   '';
 
   preBuild = ''
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/openapi-spec-validator/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/openapi-spec-validator/default.nix
index 02f51bc3e6..1cd95bcd6a 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/openapi-spec-validator/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/openapi-spec-validator/default.nix
@@ -4,11 +4,11 @@
 
 buildPythonPackage rec {
   pname = "openapi-spec-validator";
-  version = "0.2.9";
+  version = "0.3.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1jw59mmd3n1d5zihdqz2a3j2axxf3m34lqp1190fw8rlndlilf3r";
+    sha256 = "53ba3d884e98ff2062d5ada025aa590541dcd665b8f81067dc82dd61c0923759";
   };
 
   propagatedBuildInputs = [ jsonschema pyyaml six setuptools ]
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/openpyxl/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/openpyxl/default.nix
index 48941c8081..317aba6562 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/openpyxl/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/openpyxl/default.nix
@@ -10,12 +10,12 @@
 
 buildPythonPackage rec {
   pname = "openpyxl";
-  version = "3.0.6";
+  version = "3.0.7";
   disabled = isPy27; # 2.6.4 was final python2 release
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "b229112b46e158b910a5d1b270b212c42773d39cab24e8db527f775b82afc041";
+    sha256 = "6456a3b472e1ef0facb1129f3c6ef00713cebf62e736cd7a75bcc3247432f251";
   };
 
   checkInputs = [ pytest ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/openshift/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/openshift/default.nix
new file mode 100644
index 0000000000..052d364982
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/development/python-modules/openshift/default.nix
@@ -0,0 +1,39 @@
+{
+  lib
+  , buildPythonPackage
+  , fetchPypi
+  , jinja2
+  , kubernetes
+  , ruamel-yaml
+  , six
+  , python-string-utils
+}:
+
+buildPythonPackage rec {
+  pname = "openshift";
+  version = "0.12.0";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "sha256-aggRnD4goiZJPp4cngp8AIrJC/V46378cwUSfq8Xml4=";
+  };
+
+  propagatedBuildInputs = [
+    jinja2
+    kubernetes
+    python-string-utils
+    ruamel-yaml
+    six
+  ];
+
+  # tries to connect to the network
+  doCheck = false;
+  pythonImportsCheck = ["openshift"];
+
+  meta = with lib; {
+    description = "Python client for the OpenShift API";
+    homepage = "https://github.com/openshift/openshift-restclient-python";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ teto ];
+  };
+}
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/opentracing/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/opentracing/default.nix
index 8e4ece43fd..381b0d76b1 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/opentracing/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/opentracing/default.nix
@@ -2,7 +2,7 @@
 , buildPythonPackage
 , fetchPypi
 , isPy27
-, futures
+, futures ? null
 , gevent
 , mock
 , pytest
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/optuna/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/optuna/default.nix
index aa61b18291..78694618f7 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/optuna/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/optuna/default.nix
@@ -30,14 +30,14 @@
 
 buildPythonPackage rec {
   pname = "optuna";
-  version = "0.19.0";
+  version = "2.6.0";
   disabled = isPy27;
 
   src = fetchFromGitHub {
     owner = "optuna";
     repo = pname;
     rev = "v${version}";
-    sha256 = "179x2lsckpmkrkkdnvvbzky86g1ba882z677qwbayhsc835wbp0y";
+    sha256 = "11mskhb7i55i04cy0vkxi7kpaifbz8zc2m8x9s5y6yyyjinvly36";
   };
 
   checkInputs = [
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/owslib/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/owslib/default.nix
index 92a78ce0cf..661754d89c 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/owslib/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/owslib/default.nix
@@ -1,11 +1,11 @@
 { lib, buildPythonPackage, fetchPypi, dateutil, requests, pytz, pyproj , pytest, pyyaml } :
 buildPythonPackage rec {
   pname = "OWSLib";
-  version = "0.21.0";
+  version = "0.23.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "408d40b3a6a210bcb3f3609b607960eeedaa63ffd574dde7896906691c354814";
+    sha256 = "0a03a9978673f377df45107024e2aae006f85afe7ef7bf4640ef663167a4386f";
   };
 
   buildInputs = [ pytest ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/panel/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/panel/default.nix
index fa8dbddd04..58ae09af14 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/panel/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/panel/default.nix
@@ -15,7 +15,7 @@ let
   node = callPackage ./node {};
 in buildPythonPackage rec {
   pname = "panel";
-  version = "0.11.1";
+  version = "0.11.3";
 
   # Don't forget to also update the node packages
   # 1. retrieve the package.json file
@@ -23,7 +23,7 @@ in buildPythonPackage rec {
   # 3. node2nix
   src = fetchPypi {
     inherit pname version;
-    sha256 = "ce531e5c0c8a8ae74d523762aeb1666650caebbe1867aba16129d29791e921f9";
+    sha256 = "sha256-HpHYHysPE6MRxR0kek5C7sunHMfBsUGdZfxamz2jcLc=";
   };
 
   # Since 0.10.0 panel attempts to fetch from the web.
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/panel/node/node-packages.nix b/third_party/nixpkgs/pkgs/development/python-modules/panel/node/node-packages.nix
index 7b591b6e46..6e45b64d5c 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/panel/node/node-packages.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/panel/node/node-packages.nix
@@ -4,13 +4,13 @@
 
 let
   sources = {
-    "@bokeh/bokehjs-2.3.0" = {
+    "@bokeh/bokehjs-2.3.1" = {
       name = "_at_bokeh_slash_bokehjs";
       packageName = "@bokeh/bokehjs";
-      version = "2.3.0";
+      version = "2.3.1";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@bokeh/bokehjs/-/bokehjs-2.3.0.tgz";
-        sha512 = "geKBhYUVJ5IaY0UNk9k2P0yiYLCj+DOeNjdDneuTJ8K5R9fs0Rpp4iiaQKUGr1yUyQHGHLU8sk4CFZ+Bd5ZILg==";
+        url = "https://registry.npmjs.org/@bokeh/bokehjs/-/bokehjs-2.3.1.tgz";
+        sha512 = "DlNZaqAJFUw38IuSk2TUOcfyiK8Ya3kDRpYt/RgVUftIDW2CWLbBo47kbug9+ykEF49rcnlxcCXhNXzpg4V7gw==";
       };
     };
     "@bokeh/numbro-1.6.2" = {
@@ -476,10 +476,10 @@ let
   args = {
     name = "_at_holoviz_slash_panel";
     packageName = "@holoviz/panel";
-    version = "0.11.1";
+    version = "0.11.3";
     src = ./.;
     dependencies = [
-      sources."@bokeh/bokehjs-2.3.0"
+      sources."@bokeh/bokehjs-2.3.1"
       sources."@bokeh/numbro-1.6.2"
       (sources."@bokeh/slickgrid-2.4.2702" // {
         dependencies = [
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/papermill/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/papermill/default.nix
index 0311e783d3..9af09d5694 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/papermill/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/papermill/default.nix
@@ -14,7 +14,7 @@
 , requests
 , entrypoints
 , tenacity
-, futures
+, futures ? null
 , black
 , backports_tempfile
 , isPy27
@@ -25,11 +25,11 @@
 
 buildPythonPackage rec {
   pname = "papermill";
-  version = "2.3.2";
+  version = "2.3.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-ptwZXypS9b7Y1CkszqOa8PMzgyS+r9VikPlhbJUDNiM=";
+    sha256 = "349aecd526c15c39f73a08df836467e2fead877c474d82c7df349f27ad272525";
   };
 
   propagatedBuildInputs = [
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/parse/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/parse/default.nix
index c5c0c1d7ae..1ce34bfaab 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/parse/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/parse/default.nix
@@ -3,11 +3,11 @@
 }:
 buildPythonPackage rec {
   pname = "parse";
-  version = "1.18.0";
+  version = "1.19.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "91666032d6723dc5905248417ef0dc9e4c51df9526aaeef271eacad6491f06a4";
+    sha256 = "9ff82852bcb65d139813e2a5197627a94966245c897796760a3a2a8eb66f020b";
   };
 
   checkPhase = ''
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/path.py/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/path.py/default.nix
index 56e856cff9..5a0322edf6 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/path.py/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/path.py/default.nix
@@ -6,9 +6,7 @@
 , pytest-flake8
 , glibcLocales
 , packaging
-, isPy27
 , isPy38
-, backports_os
 , importlib-metadata
 , fetchpatch
 }:
@@ -26,8 +24,7 @@ buildPythonPackage rec {
   buildInputs = [ setuptools_scm ];
   propagatedBuildInputs = [
     importlib-metadata
-  ] ++ lib.optional isPy27 backports_os
-  ;
+  ];
 
   LC_ALL = "en_US.UTF-8";
 
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/pathlib2/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/pathlib2/default.nix
index 6e04f2e7a0..b21536060d 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/pathlib2/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/pathlib2/default.nix
@@ -3,9 +3,9 @@
 , fetchPypi
 , six
 , pythonOlder
-, scandir
+, scandir ? null
 , glibcLocales
-, mock
+, mock ? null
 }:
 
 buildPythonPackage rec {
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/pc-ble-driver-py/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/pc-ble-driver-py/default.nix
index bd6432db53..058fb86388 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/pc-ble-driver-py/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/pc-ble-driver-py/default.nix
@@ -3,14 +3,14 @@
 
 buildPythonPackage rec {
   pname = "pc-ble-driver-py";
-  version = "0.14.2";
+  version = "0.15.0";
   disabled = pythonOlder "3.6" || pythonAtLeast "3.9";
 
   src = fetchFromGitHub {
     owner = "NordicSemiconductor";
     repo = "pc-ble-driver-py";
-    rev = "v${version}";
-    sha256 = "1zbi3v4jmgq1a3ml34dq48y1hinw2008vwqn30l09r5vqvdgnj8m";
+    rev = version;
+    sha256 = "1ckbsq9dwca8hpx9frf9xd80b4z4kn9j7jx94hza9bwzrh26x5ji";
   };
 
   # doCheck tries to write to the global python directory to install things
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/pecan/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/pecan/default.nix
index 50b62503ff..d19fc10113 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/pecan/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/pecan/default.nix
@@ -5,7 +5,7 @@
 # Python deps
 , logutils
 , Mako
-, singledispatch
+, singledispatch ? null
 , six
 , webtest
 # Test Inputs
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/perfplot/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/perfplot/default.nix
index 371eff249c..70af6cc9c8 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/perfplot/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/perfplot/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "perfplot";
-  version = "0.8.4";
+  version = "0.8.10";
   disabled = isPy27;
 
   src = fetchFromGitHub {
     owner = "nschloe";
     repo = "perfplot";
     rev = "v${version}";
-    sha256 = "0avb0inx8qh8ss3j460v3z6mmn863hswa3bl19vkh475ndsjwmp0";
+    sha256 = "17xx33fk95fpkd8h2whblpwfls9vyqbv7anq34kpigjy8zxfi2qk";
   };
   format = "pyproject";
 
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/persim/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/persim/default.nix
index 0979afa92f..d016d1ccea 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/persim/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/persim/default.nix
@@ -11,11 +11,11 @@
 
 buildPythonPackage rec {
   pname = "persim";
-  version = "0.1.3";
+  version = "0.3.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "be4ea4bfc2a0c6fcfc28ebd52e23a351ee00b0ef0ddaf527526bd0f919145348";
+    sha256 = "5db2f7f65b1ad7b2cbfa254afb692ca0a91aeb686e82d6905838c41f516e6a13";
   };
 
   propagatedBuildInputs = [
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/pex/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/pex/default.nix
index 588a27159e..f8374a02a9 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/pex/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/pex/default.nix
@@ -6,11 +6,11 @@
 
 buildPythonPackage rec {
   pname = "pex";
-  version = "2.1.30";
+  version = "2.1.34";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "ac170d656d2083d02048850005415d03d1767087e4f5037bc86defb6b23e712d";
+    sha256 = "988e6a4e12933522e0c647da78c6e30fc42e3a172ba52cfb0332affcfc9ee29e";
   };
 
   nativeBuildInputs = [ setuptools ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/pgpy/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/pgpy/default.nix
index 2c527d87d1..b3fde72bae 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/pgpy/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/pgpy/default.nix
@@ -1,5 +1,5 @@
 { lib, isPy3k, fetchFromGitHub, buildPythonPackage
-, six, enum34, pyasn1, cryptography, singledispatch
+, six, enum34, pyasn1, cryptography, singledispatch ? null
 , fetchPypi, pytestCheckHook }:
 
 buildPythonPackage rec {
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/pgspecial/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/pgspecial/default.nix
index 476921da63..d0cbf5bafe 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/pgspecial/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/pgspecial/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "pgspecial";
-  version = "1.11.10";
+  version = "1.12.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1jrq6bhzwvz6db8ays8zff15hbk1iazs2qxrzvrnlkgxxjkp8p7n";
+    sha256 = "b68feb0005f57861573d3fbb82c5c777950decfbb2d1624af57aec825db02c02";
   };
 
   checkInputs = [ pytest ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/phonenumbers/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/phonenumbers/default.nix
index 72c61e08ce..64884393b7 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/phonenumbers/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/phonenumbers/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "phonenumbers";
-  version = "8.12.18";
+  version = "8.12.20";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0aa0f5e1382d292a7ff2f8bc08673126521461c7f908e0220756449a734d8fef";
+    sha256 = "ee5a8508c4a414262abad92ec33f050347f681973ed0fb36e98b52bfe159f6b8";
   };
 
   meta = with lib; {
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/phonopy/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/phonopy/default.nix
index e68516fb07..1c401b6264 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/phonopy/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/phonopy/default.nix
@@ -11,11 +11,11 @@
 
 buildPythonPackage rec {
   pname = "phonopy";
-  version = "2.9.1";
+  version = "2.9.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1jaizhkb59ixknvc75nrhfq51bh75912q8ay36bxpf4g5hzyhw3a";
+    sha256 = "389dd33f5bfe35733c8346af6cc43bbd015ccf0efa947eb04b38bd5cb9d0b89b";
   };
 
   propagatedBuildInputs = [ numpy pyyaml matplotlib h5py spglib ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/pika/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/pika/default.nix
index c1bfe5297d..ef32507321 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/pika/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/pika/default.nix
@@ -9,11 +9,11 @@
 
 buildPythonPackage rec {
   pname = "pika";
-  version = "1.1.0";
+  version = "1.2.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1gqx9avb9nwgiyw5nz08bf99v9b0hvzr1pmqn9wbhd2hnsj6p9wz";
+    sha256 = "f023d6ac581086b124190cb3dc81dd581a149d216fa4540ac34f9be1e3970b89";
   };
 
   checkInputs = [ nose mock twisted tornado ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/pillow/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/pillow/default.nix
index 5fef39ebef..0f747a8d73 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/pillow/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/pillow/default.nix
@@ -5,13 +5,13 @@
 
 import ./generic.nix (rec {
   pname = "Pillow";
-  version = "8.1.2";
+  version = "8.2.0";
 
   disabled = !isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0i7w0fi24za3naz3k3qav6lrhf034nzdy6m9025djlj80476cz5h";
+    sha256 = "1qf3bz1sfz58ff6hclg8phgqyy210x3aqdk5yzjr8m5vsw8ap1x7";
   };
 
   meta = with lib; {
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/pillowfight/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/pillowfight/default.nix
index c022fdb988..b0a8d6d913 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/pillowfight/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/pillowfight/default.nix
@@ -6,11 +6,11 @@
 
 buildPythonPackage rec {
   pname = "pillowfight";
-  version = "0.3";
+  version = "0.4";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "913869b0563c5982bcf08cb1ea56fb0f87e3573d738e3e3692301bf45dba6252";
+    sha256 = "4923f4d1e78be15f19f03a608fb34ba9cb71bf5205de3c9fe7461c49078167a7";
   };
 
   propagatedBuildInputs = [ pillow ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/pip-tools/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/pip-tools/default.nix
index 4ea6f75932..48f15181ce 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/pip-tools/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/pip-tools/default.nix
@@ -3,11 +3,11 @@
 
 buildPythonPackage rec {
   pname = "pip-tools";
-  version = "5.4.0";
+  version = "6.0.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "a4d3990df2d65961af8b41dacc242e600fdc8a65a2e155ed3d2fc18a5c209f20";
+    sha256 = "3b0c7b95e8d3dfb011bb42cb38f356fcf5d0630480462b59c4d0a112b8d90281";
   };
 
   LC_ALL = "en_US.UTF-8";
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/pkginfo/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/pkginfo/default.nix
index 5216ab1787..1b1834e324 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/pkginfo/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/pkginfo/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "pkginfo";
-  version = "1.6.1";
+  version = "1.7.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "a6a4ac943b496745cec21f14f021bbd869d5e9b4f6ec06918cffea5a2f4b9193";
+    sha256 = "029a70cb45c6171c329dfc890cde0879f8c52d6f3922794796e06f577bb03db4";
   };
 
   doCheck = false; # I don't know why, but with doCheck = true it fails.
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/plac/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/plac/default.nix
index 9261133bc9..bf66f7d01f 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/plac/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/plac/default.nix
@@ -5,11 +5,11 @@
 }:
 buildPythonPackage rec {
   pname = "plac";
-  version = "1.2.0";
+  version = "1.3.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "ca03587234e5bdd2a3fa96f19a04a01ebb5b0cd66d48ecb5a54d42bc9b287320";
+    sha256 = "51e332dabc2aed2cd1f038be637d557d116175101535f53eaa7ae854a00f2a74";
   };
 
   checkPhase = ''
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/plaid-python/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/plaid-python/default.nix
index aa329953a3..040b51b9f6 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/plaid-python/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/plaid-python/default.nix
@@ -1,12 +1,12 @@
 { lib, buildPythonPackage, fetchPypi, requests, pytest }:
 
 buildPythonPackage rec {
-  version = "7.2.0";
+  version = "7.2.1";
   pname = "plaid-python";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "bd599b384f94d8883344925f0ef223e1ab50f218872434aa40ba8c645937699c";
+    sha256 = "af2ad326e8377c8c86d97184f60c0be41cd71f5075201dfdb3331cc85d4de513";
   };
 
   checkInputs = [ pytest ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/plumbum/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/plumbum/default.nix
index e08537ff1a..278caa44b1 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/plumbum/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/plumbum/default.nix
@@ -5,7 +5,7 @@
 
 buildPythonPackage rec {
   pname = "plumbum";
-  version = "1.6.9";
+  version = "1.7.0";
 
   checkInputs = [ pytest ];
 
@@ -14,6 +14,6 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1ps37vamqav6p277dlp51jnacd5q4x4z1x8y0nfjw3y8jsfy3f8n";
+    sha256 = "317744342c755319907c773cc87c3a30adaa3a41b0d34c0ce02d9d1904922dce";
   };
 }
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/poetry-core/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/poetry-core/default.nix
index 80c4b5acfe..4d8c444dcd 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/poetry-core/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/poetry-core/default.nix
@@ -7,22 +7,29 @@
 , pytest-mock
 , pytestCheckHook
 , tomlkit
-, typing
+, typing ? null
 , virtualenv
 }:
 
 buildPythonPackage rec {
   pname = "poetry-core";
-  version = "1.0.2";
+  version = "1.0.3";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "python-poetry";
     repo = pname;
     rev = version;
-    sha256 = "sha256-OE6oc/3HYrMmgPnINxvSZ27m8YeZk5Gnn9ok8GlSIZ0=";
+    sha256 = "07x0zagf9cfr7g3132jjd5byywkbnzpfbxjfjzpzpj70fqw70qrc";
   };
 
+  postPatch = lib.optionalString (pythonOlder "3.8") ''
+    # remove >1.0.3
+    substituteInPlace pyproject.toml \
+      --replace 'importlib-metadata = {version = "^1.7.0", python = "~2.7 || >=3.5, <3.8"}' \
+        'importlib-metadata = {version = ">=1.7.0", python = "~2.7 || >=3.5, <3.8"}'
+  '';
+
   nativeBuildInputs = [
     intreehooks
   ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/poetry/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/poetry/default.nix
index 95e45020d4..51e95efbee 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/poetry/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/poetry/default.nix
@@ -24,7 +24,7 @@
 
 buildPythonPackage rec {
   pname = "poetry";
-  version = "1.1.5";
+  version = "1.1.6";
   format = "pyproject";
   disabled = isPy27;
 
@@ -32,13 +32,14 @@ buildPythonPackage rec {
     owner = "python-poetry";
     repo = pname;
     rev = version;
-    sha256 = "0bv6irpscpak6pldkzrx4j12dqnpfz5h8fy5lliglizv0avh60hf";
+    sha256 = "sha256-3Nx9xuQMIho+oRjqskHL9eQGKDAWntEGZcWe7evnmNU=";
   };
 
   postPatch = ''
     substituteInPlace pyproject.toml \
      --replace 'importlib-metadata = {version = "^1.6.0", python = "<3.8"}' \
-       'importlib-metadata = {version = ">=1.6,<2", python = "<3.8"}'
+       'importlib-metadata = {version = ">=1.6,<2", python = "<3.8"}' \
+     --replace 'version = "^21.2.0"' 'version = ">=21.2"'
   '';
 
   nativeBuildInputs = [ intreehooks ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/pre-commit-hooks/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/pre-commit-hooks/default.nix
index f5fe7ff96b..f664d9c6d2 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/pre-commit-hooks/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/pre-commit-hooks/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "pre-commit-hooks";
-  version = "3.3.0";
+  version = "3.4.0";
   disabled = isPy27;
 
   # fetchPypi does not provide tests
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "pre-commit";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1sppwcqsbr9gv2cpjslngcbggsxvdr84zgrin94yjr40jgkjzdpq";
+    sha256 = "1aqkmprdc2lhds9c59pkkf2js65j63197flanaggk7cm8k0kz7zs";
   };
 
   propagatedBuildInputs = [ toml ruamel_yaml ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/prettytable/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/prettytable/default.nix
index 5463403dec..d349a58960 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/prettytable/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/prettytable/default.nix
@@ -8,11 +8,11 @@
 
 buildPythonPackage rec {
   pname = "prettytable";
-  version = "2.0.0";
+  version = "2.1.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "e37acd91976fe6119172771520e58d1742c8479703489321dc1d9c85e7259922";
+    sha256 = "5882ed9092b391bb8f6e91f59bcdbd748924ff556bb7c634089d5519be87baa0";
   };
 
   nativeBuildInputs = [ setuptools_scm ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/prompt_toolkit/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/prompt_toolkit/default.nix
index e43931d914..ac128c098e 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/prompt_toolkit/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/prompt_toolkit/default.nix
@@ -8,11 +8,11 @@
 
 buildPythonPackage rec {
   pname = "prompt_toolkit";
-  version = "3.0.16";
+  version = "3.0.18";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0fa02fa80363844a4ab4b8d6891f62dd0645ba672723130423ca4037b80c1974";
+    sha256 = "e1b4f11b9336a28fa11810bc623c357420f69dfdb6d2dac41ca2c21a55c033bc";
   };
   checkPhase = ''
     py.test -k 'not test_pathcompleter_can_expanduser'
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/proto-plus/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/proto-plus/default.nix
index 120d5215b2..3fa782cb47 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/proto-plus/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/proto-plus/default.nix
@@ -15,7 +15,7 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-z8RUdMftoP48S57KJUISTyoP9VQyQr7GHo0IvOD1vUg=";
+    sha256 = "cfc45474c7eda0fe3c4b9eca2542124f2a0ff5543242bec61e8d08bce0f5bd48";
   };
 
   propagatedBuildInputs = [ protobuf ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/protobuf/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/protobuf/default.nix
index 60c6f33327..e3e66294a8 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/protobuf/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/protobuf/default.nix
@@ -5,7 +5,7 @@
 , buildPythonPackage
 , isPy37
 , protobuf
-, google-apputils
+, google-apputils ? null
 , six
 , pyext
 , libcxx
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/ptpython/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/ptpython/default.nix
index 51ad2e85ff..65915c8586 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/ptpython/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/ptpython/default.nix
@@ -10,12 +10,12 @@
 
 buildPythonPackage rec {
   pname = "ptpython";
-  version = "3.0.16";
+  version = "3.0.17";
   disabled = !isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "4b0f6e381a8251ec8d6aa94fe12f3400bf6edf789f89c8a6099f8a91d4a5d2e1";
+    sha256 = "911d25cca31a8e4f9b2ecd16dcdad793b8859e94fca1275f3485d8cdf20b13de";
   };
 
   propagatedBuildInputs = [
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/ptyprocess/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/ptyprocess/default.nix
index 233dc6fb31..d969a679a1 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/ptyprocess/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/ptyprocess/default.nix
@@ -1,17 +1,26 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, fetchpatch
 }:
 
 buildPythonPackage rec {
   pname = "ptyprocess";
-  version = "0.6.0";
+  version = "0.7.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "923f299cc5ad920c68f2bc0bc98b75b9f838b93b599941a6b63ddbc2476394c0";
+    sha256 = "5c5d0a3b48ceee0b48485e0c26037c0acd7d29765ca3fbb5cb3831d347423220";
   };
 
+  patches = [
+    # Remove after https://github.com/pexpect/ptyprocess/pull/64 is merged.
+    (fetchpatch {
+      url = "https://github.com/pexpect/ptyprocess/commit/40c1ccf3432a6787be1801ced721540e34c6cd87.patch";
+      sha256 = "sha256-IemngBqBq3QRCmVscWtsuXHiFgvTOJIIB9SyAvsqHd0=";
+    })
+  ];
+
   meta = {
     description = "Run a subprocess in a pseudo terminal";
     homepage = "https://github.com/pexpect/ptyprocess";
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/pudb/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/pudb/default.nix
index db48fbf1e4..af653f260c 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/pudb/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/pudb/default.nix
@@ -8,11 +8,11 @@
 
 buildPythonPackage rec {
   pname = "pudb";
-  version = "2019.2";
+  version = "2020.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1p2qizb35f9lfhklldzrn8g9mwiar3zmpc44463h5n1ln40ymw78";
+    sha256 = "2ef23d3371439f13fffbe7f8b9fc180a19d4183dc9cab204d878d7c7766464bf";
   };
 
   propagatedBuildInputs = [ pygments urwid ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/py-vapid/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/py-vapid/default.nix
index 2f4a60b420..dd8cbdcc5f 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/py-vapid/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/py-vapid/default.nix
@@ -5,11 +5,11 @@
 
 buildPythonPackage rec {
   pname = "py-vapid";
-  version = "1.7.1";
+  version = "1.8.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "f05cecaa9fc009515086d04b6117324f30eedf1a196f67fb1ec360a9dbdad4ee";
+    sha256 = "9e8de790cce397d9bc567a2148c3c5d88740f668342c59aaff9ed004f716a111";
   };
 
   propagatedBuildInputs = [ cryptography ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/py/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/py/default.nix
index 3ccf853d7c..26afa14c1e 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/py/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/py/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "py";
-  version = "1.9.0";
+  version = "1.10.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "9ca6883ce56b4e8da7e79ac18787889fa5206c79dcc67fb065376cd2fe03f342";
+    sha256 = "21b81bda15b66ef5e1a777a21c4dcd9c20ad3efd0b3f817e7a809035269e1bd3";
   };
 
   # Circular dependency on pytest
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/py3exiv2/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/py3exiv2/default.nix
index 0c2ae12882..236a38c7e6 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/py3exiv2/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/py3exiv2/default.nix
@@ -2,12 +2,12 @@
 
 buildPythonPackage rec {
   pname = "py3exiv2";
-  version = "0.8.0";
+  version = "0.9.3";
   disabled = !(isPy3k);
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1v419f1kkqw8hqyc3yhzslnbzk52j8j3wfknfkjg308n5mf5bn09";
+    sha256 = "838836e58ca22557d83d1f0ef918bcce899b4c2666340b924b940dcdebf1d18c";
   };
 
   buildInputs = [ exiv2 boost ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/py3status/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/py3status/default.nix
index bd0f179dc8..9967394d28 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/py3status/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/py3status/default.nix
@@ -24,11 +24,11 @@
 
 buildPythonPackage rec {
   pname = "py3status";
-  version = "3.31";
+  version = "3.35";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "426cff33c1d3a5ee6ae388089fd41dc47c4221800f43bd51779f823c781fb83b";
+    sha256 = "1508fa481a2f1b55b9a9792f0480c7f54cad107c668ffc98a7c73622676e1c23";
   };
 
   doCheck = false;
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/py4j/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/py4j/default.nix
index 8eb1649fcc..6ad9673b97 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/py4j/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/py4j/default.nix
@@ -3,11 +3,11 @@
 buildPythonPackage rec {
   pname = "py4j";
 
-  version = "0.10.9.1";
+  version = "0.10.9.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "7605e512bf9b002245f5a9121a8c2df9bfd1a6004fe6dd3ff29d46f901719d53";
+    sha256 = "624f97c363b8dd84822bc666b12fa7f7d97824632b2ff3d852cc491359ce7615";
   };
 
   # No tests in archive
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/pyaftership/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/pyaftership/default.nix
index 4deee467f8..e65812cb31 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/pyaftership/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/pyaftership/default.nix
@@ -2,13 +2,13 @@
 
 buildPythonPackage rec {
   pname = "pyaftership";
-  version = "0.1.2";
+  version = "21.1.0";
 
   disabled = !isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "057dwzacc0lmsq00ipfbnxkq4rc2by8glmza6s8i6dzi1cc68v98";
+    sha256 = "28b62c323d06492399b60d8135a58d6feaa1d60837eddc14e57ea2b69d356c0a";
   };
 
   propagatedBuildInputs = [ aiohttp async-timeout ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/pybase64/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/pybase64/default.nix
index aa65d7ccad..048d218a9e 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/pybase64/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/pybase64/default.nix
@@ -2,13 +2,13 @@
 
 buildPythonPackage rec {
   pname = "pybase64";
-  version = "1.0.2";
+  version = "1.1.4";
 
   disabled = !isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "c430b36751dd89820c867aadd0130bbe8ce007ee570cbe91bb23012fb6f52e87";
+    sha256 = "f0e0db1dee2a2cbf35e6710ea138594ecc1e0f491ff9103f136de83d8f159315";
   };
 
   propagatedBuildInputs = [ six ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/pybind11/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/pybind11/default.nix
index 3fd9349386..0ae0b26e12 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/pybind11/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/pybind11/default.nix
@@ -14,13 +14,13 @@
 
 buildPythonPackage rec {
   pname = "pybind11";
-  version = "2.6.1";
+  version = "2.6.2";
 
   src = fetchFromGitHub {
     owner = "pybind";
     repo = pname;
     rev = "v${version}";
-    sha256 = "TXljeRFonQwEmlIGMnTHwdfPsd9cMOVn5/1zb3tYBfI=";
+    sha256 = "1lsacpawl2gb5qlh0cawj9swsyfbwhzhwiv6553a7lsigdbadqpy";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/pybtex/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/pybtex/default.nix
index fb6fbf8dd3..0ce28e5749 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/pybtex/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/pybtex/default.nix
@@ -1,7 +1,7 @@
 { lib, buildPythonPackage, fetchPypi, latexcodec, pyyaml }:
 
 buildPythonPackage rec {
-  version = "0.23.0";
+  version = "0.24.0";
   pname = "pybtex";
 
   doCheck = false;
@@ -9,7 +9,7 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit version pname;
-    sha256 = "b92be18ccd5e9a37895949dcf359a1f6890246b73646dddf1129178ee12e4bef";
+    sha256 = "818eae35b61733e5c007c3fcd2cfb75ed1bc8b4173c1f70b56cc4c0802d34755";
   };
 
   meta = with lib; {
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/pybullet/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/pybullet/default.nix
index 554a6ab0b0..195167b243 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/pybullet/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/pybullet/default.nix
@@ -8,11 +8,11 @@
 
 buildPythonPackage rec {
   pname = "pybullet";
-  version = "3.0.8";
+  version = "3.1.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "623061d305bd5513a911abb2cbd0e37670be166a270123b43ca757bf78e4b438";
+    sha256 = "ced62167216c75b58d5550adc74a0d328a166ded8b37b52ce90bc9736f597187";
   };
 
   buildInputs = [
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/pycairo/1.18.nix b/third_party/nixpkgs/pkgs/development/python-modules/pycairo/1.18.nix
new file mode 100644
index 0000000000..0a51c78c58
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/development/python-modules/pycairo/1.18.nix
@@ -0,0 +1,49 @@
+{ lib
+, fetchFromGitHub
+, meson
+, ninja
+, buildPythonPackage
+, pytestCheckHook
+, pkg-config
+, cairo
+, python
+}:
+
+buildPythonPackage rec {
+  pname = "pycairo";
+  version = "1.18.2";
+
+  format = "other";
+
+  src = fetchFromGitHub {
+    owner = "pygobject";
+    repo = "pycairo";
+    rev = "v${version}";
+    sha256 = "142145a2whvlk92jijrbf3i2bqrzmspwpysj0bfypw0krzi0aa6j";
+  };
+
+  nativeBuildInputs = [
+    meson
+    ninja
+    pkg-config
+  ];
+
+  buildInputs = [
+    cairo
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  mesonFlags = [
+    "-Dpython=${python.interpreter}"
+  ];
+
+  meta = with lib; {
+    description = "Python 2 bindings for cairo";
+    homepage = "https://pycairo.readthedocs.io/";
+    license = with licenses; [ lgpl21Only mpl11 ];
+    platforms = lib.platforms.linux ++ lib.platforms.darwin;
+  };
+}
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/pycairo/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/pycairo/default.nix
index 24e0f9792d..c8df65c2b7 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/pycairo/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/pycairo/default.nix
@@ -1,4 +1,5 @@
 { lib
+, pythonOlder
 , fetchFromGitHub
 , meson
 , ninja
@@ -6,12 +7,14 @@
 , pytestCheckHook
 , pkg-config
 , cairo
-, isPy3k
+, python
 }:
 
 buildPythonPackage rec {
   pname = "pycairo";
-  version = "1.18.2";
+  version = "1.20.0";
+
+  disabled = pythonOlder "3.6";
 
   format = "other";
 
@@ -19,7 +22,7 @@ buildPythonPackage rec {
     owner = "pygobject";
     repo = "pycairo";
     rev = "v${version}";
-    sha256 = "142145a2whvlk92jijrbf3i2bqrzmspwpysj0bfypw0krzi0aa6j";
+    sha256 = "0ifw4wjbml512w9kqj80y9gfqa7fkgfa1zkvi478k5krghjgk3lr";
   };
 
   nativeBuildInputs = [
@@ -37,11 +40,11 @@ buildPythonPackage rec {
   ];
 
   mesonFlags = [
-    "-Dpython=${if isPy3k then "python3" else "python"}"
+    "-Dpython=${python.interpreter}"
   ];
 
   meta = with lib; {
-    description = "Python 2/3 bindings for cairo";
+    description = "Python 3 bindings for cairo";
     homepage = "https://pycairo.readthedocs.io/";
     license = with licenses; [ lgpl21Only mpl11 ];
     platforms = lib.platforms.linux ++ lib.platforms.darwin;
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/pycm/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/pycm/default.nix
index 8e0a9e3b15..b750bd30b0 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/pycm/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/pycm/default.nix
@@ -2,7 +2,7 @@
 
 buildPythonPackage rec {
   pname = "pycm";
-  version = "2.5";
+  version = "3.1";
 
   disabled = !isPy3k;
 
@@ -10,7 +10,7 @@ buildPythonPackage rec {
     owner  = "sepandhaghighi";
     repo   = pname;
     rev    = "v${version}";
-    sha256 = "0zfv20hd7zq95sflsivjk47b0sm7q76w7fv2i2mafn83ficzx0p0";
+    sha256 = "1aspd3vkjasb4wxs9czwjw42fmd4027wsmm4vlj09yp7sl57gary";
   };
 
   # remove a trivial dependency on the author's `art` Python ASCII art library
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/pycmarkgfm/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/pycmarkgfm/default.nix
index f1d92a63d4..36b171c22b 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/pycmarkgfm/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/pycmarkgfm/default.nix
@@ -2,12 +2,12 @@
 
 buildPythonPackage rec {
   pname = "pycmarkgfm";
-  version = "1.0.1";
+  version = "1.1.0";
   disabled = isPy27;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0wkbbma214f927ikn3cijxsrzkmm5cqz1x4fimrwx9s2wfphj250";
+    sha256 = "694cb242f4961437c30b5b015dfbce9d1a1fa48305c2e39f902ce7c65b4cbe0e";
   };
 
   propagatedBuildInputs = [ cffi ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/pycodestyle/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/pycodestyle/default.nix
index e1d21a6a2e..0e92196f74 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/pycodestyle/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/pycodestyle/default.nix
@@ -6,11 +6,11 @@
 
 buildPythonPackage rec {
   pname = "pycodestyle";
-  version = "2.6.0";
+  version = "2.7.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "c58a7d2815e0e8d7972bf1803331fb0152f867bd89adf8a01dfd55085434192e";
+    sha256 = "c389c1d06bf7904078ca03399a4816f974a1d590090fecea0c63ec26ebaf1cef";
   };
 
   dontUseSetuptoolsCheck = true;
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/pycryptodome/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/pycryptodome/default.nix
index e88b8529a3..0c57ad9c96 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/pycryptodome/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/pycryptodome/default.nix
@@ -1,12 +1,12 @@
 { lib, fetchPypi, buildPythonPackage }:
 
 buildPythonPackage rec {
-  version = "3.9.9";
+  version = "3.10.1";
   pname = "pycryptodome";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "910e202a557e1131b1c1b3f17a63914d57aac55cf9fb9b51644962841c3995c4";
+    sha256 = "3e2e3a06580c5f190df843cdb90ea28d61099cf4924334d5297a995de68e4673";
   };
 
   meta = with lib; {
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/pydub/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/pydub/default.nix
index 884df63ce0..6b67814a22 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/pydub/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/pydub/default.nix
@@ -2,13 +2,13 @@
 
 buildPythonPackage rec {
   pname = "pydub";
-  version = "0.24.1";
+  version = "0.25.1";
   # pypi version doesn't include required data files for tests
   src = fetchFromGitHub {
     owner = "jiaaro";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1pv4n54kkjpbjlvwh9b6a7zyq1ylg0fjmd2q4ws9nc2a6mrcivhc";
+    sha256 = "0xskllq66wqndjfmvp58k26cv3w480sqsil6ifwp4gghir7hqc8m";
   };
 
 
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/pyee/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/pyee/default.nix
index 7e388b9397..833b83b391 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/pyee/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/pyee/default.nix
@@ -1,4 +1,20 @@
-{ buildPythonPackage, fetchPypi, lib, vcversioner, pytestrunner, mock, pytest, pytest-asyncio, pytest-trio, twisted, zipp, pyparsing, pyhamcrest, futures, attrs, isPy27 }:
+{ buildPythonPackage
+, fetchPypi
+, lib
+, vcversioner
+, pytestrunner
+, mock
+, pytest
+, pytest-asyncio
+, pytest-trio
+, twisted
+, zipp ? null
+, pyparsing ? null
+, pyhamcrest
+, futures ? null
+, attrs ? null
+, isPy27
+}:
 
 buildPythonPackage rec {
   pname = "pyee";
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/pyenchant/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/pyenchant/default.nix
index fe4182fd53..fec3efb9b3 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/pyenchant/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/pyenchant/default.nix
@@ -7,12 +7,12 @@
 
 buildPythonPackage rec {
   pname = "pyenchant";
-  version = "3.1.1";
+  version = "3.2.0";
   disabled = isPy27;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "ce0915d7acd771fde6e8c2dce8ad0cb0e6f7c4fa8430cc96e3e7134e99aeb12f";
+    sha256 = "6b97e9a9f132fa7c9029a6635d821ccad67d4980e68186d02c765b4256b6f152";
   };
 
   propagatedBuildInputs = [ enchant2 ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/pyface/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/pyface/default.nix
index d317ebdf21..7ad1fb4152 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/pyface/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/pyface/default.nix
@@ -4,11 +4,11 @@
 
 buildPythonPackage rec {
   pname = "pyface";
-  version = "7.1.0";
+  version = "7.3.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "a3e22a4d31429f0d5b9ff50aaac3fb47e4f7da678b6b0439a7b91ef40675f88d";
+    sha256 = "a7031ec4cfff034affc822e47ff5e6c1a0272e576d79465cdbbe25f721740322";
   };
 
   propagatedBuildInputs = [ setuptools six traits ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/pyfaidx/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/pyfaidx/default.nix
index 9e21854a7c..13c00d80a6 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/pyfaidx/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/pyfaidx/default.nix
@@ -6,11 +6,11 @@
 
 buildPythonPackage rec {
   pname = "pyfaidx";
-  version = "0.5.9.2";
+  version = "0.5.9.5";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "73e740eaa45c097a09e543450f88d5ed06c0ece4b6936dad7e71077f67797b74";
+    sha256 = "9965644c5bd62bedc0ff7f336cbb2baef6406a36b4ec5c786b199872ce46192b";
   };
 
   propagatedBuildInputs = [ six ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/pyfakefs/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/pyfakefs/default.nix
index 8ba9b3fc46..cc7031db54 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/pyfakefs/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/pyfakefs/default.nix
@@ -7,13 +7,13 @@
 }:
 
 buildPythonPackage rec {
-  version = "4.3.3";
+  version = "4.4.0";
   pname = "pyfakefs";
   disabled = pythonOlder "3.5";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-/7KrJkoLg69Uii2wxQl5jiCDYd85YBuomK5lzs+1nLs=";
+    sha256 = "082d863e0e2a74351f697da404e329a91e18e5055942e59d1b836e8459b2c94c";
   };
 
   postPatch = ''
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/pyflakes/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/pyflakes/default.nix
index cf1b887818..1f098ed781 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/pyflakes/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/pyflakes/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "pyflakes";
-  version = "2.2.0";
+  version = "2.3.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "35b2d75ee967ea93b55750aa9edbbf72813e06a66ba54438df2cfac9e3c27fc8";
+    sha256 = "f5bc8ecabc05bb9d291eb5203d6810b49040f6ff446a756326104746cc00c1db";
   };
 
   checkInputs = [ unittest2 ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/pyflume/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/pyflume/default.nix
index a1d36670a3..36980ddbad 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/pyflume/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/pyflume/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "pyflume";
-  version = "0.6.2";
+  version = "0.6.4";
   disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "ChrisMandich";
     repo = "PyFlume";
     rev = "v${version}";
-    sha256 = "0i181c8722j831bjlcjwv5ccy20hl8zzlv7bfp8w0976gdmv4iz8";
+    sha256 = "1dm560hh6fl1waiwsq8m31apmvvwhc3y95bfdb7449bs8k96dmxq";
   };
 
   propagatedBuildInputs = [
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/pygccxml/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/pygccxml/default.nix
index 7e06b27a23..7d7bc459b6 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/pygccxml/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/pygccxml/default.nix
@@ -2,13 +2,13 @@
 llvmPackages }:
 buildPythonPackage rec {
   pname = "pygccxml";
-  version = "1.9.1";
+  version = "2.1.0";
 
   src = fetchFromGitHub {
     owner  = "gccxml";
     repo   = "pygccxml";
     rev    = "v${version}";
-    sha256 = "02ip03s0vmp7czzflbvf7qnybibfrd0rzqbc5zfmq3zmpnck3hvm";
+    sha256 = "1vsxnfzz6qhiv8ac98qgk6w3s4j1jp661qy48gc9plcg2r952453";
   };
 
   buildInputs = [ castxml llvmPackages.libcxxStdenv];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/pygit2/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/pygit2/default.nix
index 5326a1963a..46117d13f4 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/pygit2/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/pygit2/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "pygit2";
-  version = "1.4.0";
+  version = "1.5.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "cbeb38ab1df9b5d8896548a11e63aae8a064763ab5f1eabe4475e6b8a78ee1c8";
+    sha256 = "9711367bd05f96ad6fc9c91d88fa96126ba2d1f1c3ea6f23c11402c243d66a20";
   };
 
   preConfigure = lib.optionalString stdenv.isDarwin ''
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/pygmt/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/pygmt/default.nix
index 318706edd9..130be6d44c 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/pygmt/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/pygmt/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "pygmt";
-  version = "0.2.0";
+  version = "0.3.1";
 
   disabled = pythonOlder "3.6";
 
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "GenericMappingTools";
     repo = "pygmt";
     rev = "v${version}";
-    sha256 = "1yx1n6mxfmwg69ls5560nm6d3jxyghv27981iplz7m7990bbp468";
+    sha256 = "0v57n3by9dwckjfmrgf1km4y3gwzj2gk0s9ly64hlaf05zihqnvc";
   };
 
   postPatch = ''
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/pyjwt/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/pyjwt/default.nix
index 9255c02ac2..c33f2b0680 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/pyjwt/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/pyjwt/default.nix
@@ -4,11 +4,11 @@
 
 buildPythonPackage rec {
   pname = "PyJWT";
-  version = "1.7.1";
+  version = "2.0.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "8d59a976fb773f3e6a39c85636357c4f0e242707394cadadd9814f5cbaa20e96";
+    sha256 = "a5c70a06e1f33d81ef25eecd50d50bd30e34de1ca8b2b9fa3fe0daaabcf69bf7";
   };
 
   propagatedBuildInputs = [ cryptography ecdsa ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/pykeepass/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/pykeepass/default.nix
index 584c98f6cb..294e47872f 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/pykeepass/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/pykeepass/default.nix
@@ -5,11 +5,11 @@
 
 buildPythonPackage rec {
   pname   = "pykeepass";
-  version = "3.2.1";
+  version = "4.0.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "b3e07eb2dd3aeb1dfa1a2d2d17be77066ee560c1e770f1c72d7ea5608117d284";
+    sha256 = "1b41b3277ea4e044556e1c5a21866ea4dfd36e69a4c0f14272488f098063178f";
   };
 
   postPatch = ''
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/pykmtronic/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/pykmtronic/default.nix
index 50260afab1..7a055c1ed3 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/pykmtronic/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/pykmtronic/default.nix
@@ -7,11 +7,11 @@
 
 buildPythonPackage rec {
   pname = "pykmtronic";
-  version = "0.0.3";
+  version = "0.2.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-8bxn27DU1XUQUxQFJklEge29DHx1DMu7pJG4hVE1jDU=";
+    sha256 = "9d0301882f06a0c4865c89bb6c2a381c4a1ba6fe2a7a07d56351bdf5f96c9fa5";
   };
 
   propagatedBuildInputs = [ aiohttp lxml ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/pylint-django/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/pylint-django/default.nix
index c5dfbd48fe..54b2f65ad9 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/pylint-django/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/pylint-django/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage rec {
   pname = "pylint-django";
-  version = "2.3.0";
+  version = "2.4.2";
   disabled = !isPy3k;
 
   src = fetchFromGitHub {
     owner = "PyCQA";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1088waraiigi2bnlighn7bvnvqmpx5fbw70c8jd8sh25mj38wgly";
+    sha256 = "0535y4sdi521a9s7di8ld0i8aav0afbxmx0956v6sjpyqmqdm6hr";
   };
 
   propagatedBuildInputs = [
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/pylint/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/pylint/default.nix
index 43183482ec..10935d2d88 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/pylint/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/pylint/default.nix
@@ -15,13 +15,13 @@
 
 buildPythonPackage rec {
   pname = "pylint";
-  version = "2.7.1";
+  version = "2.7.2";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "10nrvzk1naf5ryawmi59wp99k31053sz37q3x9li2hj2cf7i1kl1";
+    sha256 = "0e21d3b80b96740909d77206d741aa3ce0b06b41be375d92e1f3244a274c1f8a";
   };
 
   nativeBuildInputs = [
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/pymatgen/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/pymatgen/default.nix
index fdf6b08984..f6f2ebe621 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/pymatgen/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/pymatgen/default.nix
@@ -21,11 +21,11 @@
 
 buildPythonPackage rec {
   pname = "pymatgen";
-  version = "2020.12.31";
+  version = "2022.0.5";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "5002490facd47c55d2dae42c35712e061c1f5d881180485c0543a899589856d6";
+    sha256 = "69c370ebd2ff9aceb15bb6efd364473609ffb23d2b2f02a3eb64fd537df69de0";
   };
 
   nativeBuildInputs = [ glibcLocales ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/pymc3/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/pymc3/default.nix
index dfbfe90d24..e322bb14f7 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/pymc3/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/pymc3/default.nix
@@ -20,12 +20,12 @@
 
 buildPythonPackage rec {
   pname = "pymc3";
-  version = "3.9.3";
+  version = "3.11.2";
   disabled = pythonOlder "3.5";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "abe046f5a5d0e5baee80b7c4bc0a4c218f61b517b62d77be4f89cf4784c27d78";
+    sha256 = "d3b93c8923ae8c8107c5adfd22f7c37fa0849a00a9723e0e0a0ca6afb582d6c3";
   };
 
   # No need for coverage stats in Nix builds
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/pymeeus/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/pymeeus/default.nix
index 047b7d697c..162f3ab559 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/pymeeus/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/pymeeus/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "PyMeeus";
-  version = "0.3.13";
+  version = "0.5.11";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "43b800a2571f3237e558d8d305e97f6ac4027977666e22af98448e0f1f86af86";
+    sha256 = "bb9d670818d8b0594317b48a7dadea02a0594e5344263bf2054e1a011c8fed55";
   };
 
   checkInputs = [ pytest ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/pymetar/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/pymetar/default.nix
index 72a17f27dc..ef5273936c 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/pymetar/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/pymetar/default.nix
@@ -2,13 +2,13 @@
 
 buildPythonPackage rec {
   pname = "pymetar";
-  version = "1.1";
+  version = "1.2";
 
   disabled = !isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0y42l7mmp7jn4pzg66x3k57c6hqpxc22mgzgaqqpblkx2kzh42n9";
+    sha256 = "f9a8caa21eff5367427da55a469ef396293ae4cc93797ab2f1a66a2924fbdc68";
   };
 
   checkPhase = ''
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/pymysql/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/pymysql/default.nix
index c243bf8f95..888b5b9d30 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/pymysql/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/pymysql/default.nix
@@ -6,11 +6,11 @@
 
 buildPythonPackage rec {
   pname = "PyMySQL";
-  version = "0.10.1";
+  version = "1.0.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "263040d2779a3b84930f7ac9da5132be0fefcd6f453a885756656103f8ee1fdd";
+    sha256 = "816927a350f38d56072aeca5dfb10221fe1dc653745853d30a216637f5d7ad36";
   };
 
   propagatedBuildInputs = [ cryptography ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/pynamodb/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/pynamodb/default.nix
index 53df38b583..5237ce9955 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/pynamodb/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/pynamodb/default.nix
@@ -11,11 +11,11 @@
 
 buildPythonPackage rec {
   pname = "pynamodb";
-  version = "4.3.3";
+  version = "5.0.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "ced47c200073dbbfafb10b26931b9c9bf3c6b898f41dffa3676f5c2e2eddc2f0";
+    sha256 = "01741df673abb518d5cf9f00223a227f5d0ab9e0a6b19e444ceb38d497019f31";
   };
 
   propagatedBuildInputs = [ python-dateutil botocore ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/pynetdicom/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/pynetdicom/default.nix
index 192827566d..278508fa37 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/pynetdicom/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/pynetdicom/default.nix
@@ -16,7 +16,7 @@ buildPythonPackage rec {
     owner = "pydicom";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-xYwnv30I0+CAx4QODSeMNhdlM2NuM8v4J3rx99NdYCc=";
+    sha256 = "09v0bp9zgwbs4zwcncvfccrna5rnihkhs3l4qy0f1lq8gnzjg365";
   };
 
   propagatedBuildInputs = [
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/pynisher/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/pynisher/default.nix
index 28e9922e17..a908945fad 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/pynisher/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/pynisher/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "pynisher";
-  version = "0.6.3";
+  version = "0.6.4";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "e4e1d9366fc4ca60b4b2354b6d12e65600600a8c7bf4392c84f2f4ff4abc85ff";
+    sha256 = "111d91aad471375c0509a912415ff90053ef909100facf412511383af107c124";
   };
 
   propagatedBuildInputs = [ psutil docutils ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/pynvim/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/pynvim/default.nix
index 84e7b68698..0910f601dc 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/pynvim/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/pynvim/default.nix
@@ -4,7 +4,7 @@
 , nose
 , msgpack
 , greenlet
-, trollius
+, trollius ? null
 , pythonOlder
 , isPyPy
 , pytestrunner
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/pynx584/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/pynx584/default.nix
new file mode 100644
index 0000000000..0f2fc2e7c0
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/development/python-modules/pynx584/default.nix
@@ -0,0 +1,48 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, flask
+, mock
+, prettytable
+, pyserial
+, pytestCheckHook
+, pythonOlder
+, requests
+, stevedore
+}:
+
+buildPythonPackage rec {
+  pname = "pynx584";
+  version = "0.6";
+  disabled = pythonOlder "3.6";
+
+
+  src = fetchFromGitHub {
+    owner = "kk7ds";
+    repo = pname;
+    rev = version;
+    sha256 = "0if1jq8qiqp4w4zhf2xzzcb8y70hr5pxqzh96i008p6izjha89y6";
+  };
+
+  propagatedBuildInputs = [
+    flask
+    prettytable
+    pyserial
+    requests
+    stevedore
+  ];
+
+  checkInputs = [
+    mock
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [ "nx584" ];
+
+  meta = with lib; {
+    description = "Python package for communicating to NX584/NX8E interfaces";
+    homepage = "https://github.com/kk7ds/pynx584";
+    license = with licenses; [ gpl3Only ];
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/pyobjc/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/pyobjc/default.nix
index 541a733b3f..cd100d005d 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/pyobjc/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/pyobjc/default.nix
@@ -2,7 +2,7 @@
 
 buildPythonPackage rec {
   pname = "pyobjc";
-  version = "7.0.1";
+  version = "7.1";
 
   # Gives "No matching distribution found for
   # pyobjc-framework-Collaboration==4.0b1 (from pyobjc==4.0b1)"
@@ -10,7 +10,7 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "f4fd120683b19a2abeac351784204e6b092cf1fb94f597b6eb22f30c117b2ef0";
+    sha256 = "1dfce78545df1af25d1dcd710309dd243083d90c977a8c84c483f8254967417b";
   };
 
   meta = with lib; {
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/pyopencl/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/pyopencl/default.nix
index cf881a5804..b1e81140a9 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/pyopencl/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/pyopencl/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "pyopencl";
-  version = "2020.3.1";
+  version = "2021.1.4";
 
   checkInputs = [ pytest ];
   buildInputs = [ opencl-headers ocl-icd pybind11 ];
@@ -25,7 +25,7 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "abc689307cf34d3dcc94d43815f64e2265469b50ecce6c903a3180589666fb36";
+    sha256 = "6a9665e89c15e1c684789263bd3a632567e7c7bd25a657092df4b185b3468971";
   };
 
   # py.test is not needed during runtime, so remove it from `install_requires`
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/pyparted/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/pyparted/default.nix
index 16a894546e..ee34f91b57 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/pyparted/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/pyparted/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "pyparted";
-  version = "3.11.4";
+  version = "3.11.7";
   disabled = isPyPy;
 
   src = fetchFromGitHub {
     repo = pname;
     owner = "dcantrell";
     rev = "v${version}";
-    sha256 = "0wd0xhv1y1zw7djzcnimj8irif3mg0shbhgz0jn5yi914is88h6n";
+    sha256 = "01193fmkss9icjvqpw85szpk8ld1pnha7p9kqm7mpwk6rc6gi2m3";
   };
 
   postPatch = ''
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/pyperclip/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/pyperclip/default.nix
index 0df0da0cc5..c04cc9eec3 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/pyperclip/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/pyperclip/default.nix
@@ -1,12 +1,12 @@
 { lib, buildPythonPackage, fetchPypi }:
 
 buildPythonPackage rec {
-  version = "1.8.1";
+  version = "1.8.2";
   pname = "pyperclip";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "9abef1e79ce635eb62309ecae02dfb5a3eb952fa7d6dce09c1aef063f81424d3";
+    sha256 = "105254a8b04934f0bc84e9c24eb360a591aaf6535c9def5f29d92af107a9bf57";
   };
 
   doCheck = false;
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/pyperf/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/pyperf/default.nix
index f17f83bd17..f4239fb922 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/pyperf/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/pyperf/default.nix
@@ -15,11 +15,11 @@
 
 buildPythonPackage rec {
   pname = "pyperf";
-  version = "2.0.0";
+  version = "2.2.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "2189fbc4af08d519f85468e70e32c902eab0f1341b2c41028b94b2832d3169a7";
+    sha256 = "498bb4d1fe21350c2b7c1aa8bb3eae9c9979358d0b66327954bc66839fcba8b6";
   };
 
   checkInputs = [ nose psutil ] ++
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/pyro-ppl/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/pyro-ppl/default.nix
index 1d5608ec77..96f0ba057f 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/pyro-ppl/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/pyro-ppl/default.nix
@@ -2,12 +2,12 @@
 , graphviz, networkx, six, opt-einsum, tqdm, pyro-api }:
 
 buildPythonPackage rec {
-  version = "1.5.2";
+  version = "1.6.0";
   pname = "pyro-ppl";
 
   src = fetchPypi {
     inherit version pname;
-    sha256 = "8a93af3a007ac507a8b50fd1165dbb355182d17df29d3b5bc498b02b479fdb27";
+    sha256 = "ee181852713058f59d600dfa2e05bbc6f7f9b88fcdb4d2f1ccf61b0bf4794088";
   };
 
   propagatedBuildInputs = [
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/pyro5/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/pyro5/default.nix
index 5afce4a37d..97b41b03da 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/pyro5/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/pyro5/default.nix
@@ -8,13 +8,13 @@
 
 buildPythonPackage rec {
   pname = "Pyro5";
-  version = "5.11";
+  version = "5.12";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "867cdd291d85560373e0c468da7fd18754f2568ef60e0bc504af42f391d7a3e5";
+    sha256 = "616e6957c341da0ca26f947805c9c97b42031941f59ca5613537d1420ff4f2e2";
   };
 
   propagatedBuildInputs = [ serpent ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/pyroma/2.nix b/third_party/nixpkgs/pkgs/development/python-modules/pyroma/2.nix
new file mode 100644
index 0000000000..9fee5ec56c
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/development/python-modules/pyroma/2.nix
@@ -0,0 +1,26 @@
+{ lib, buildPythonPackage, fetchPypi
+, docutils, pygments, setuptools
+}:
+
+buildPythonPackage rec {
+  pname = "pyroma";
+  version = "2.6.1";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "2527423e3a24ccd56951f3ce1b0ebbcc4fa0518c82fca882e696c78726ab9c2f";
+  };
+
+  postPatch = ''
+    substituteInPlace setup.py \
+      --replace "pygments < 2.6" "pygments"
+  '';
+
+  propagatedBuildInputs = [ docutils pygments setuptools ];
+
+  meta = with lib; {
+    description = "Test your project's packaging friendliness";
+    homepage = "https://github.com/regebro/pyroma";
+    license = licenses.mit;
+  };
+}
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/pyroma/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/pyroma/default.nix
index 9fee5ec56c..c8fc988b96 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/pyroma/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/pyroma/default.nix
@@ -4,11 +4,11 @@
 
 buildPythonPackage rec {
   pname = "pyroma";
-  version = "2.6.1";
+  version = "3.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "2527423e3a24ccd56951f3ce1b0ebbcc4fa0518c82fca882e696c78726ab9c2f";
+    sha256 = "45ad8201da9a813b5597bb85c80bbece93af9ec89170fc2be5ad85fa9463cef1";
   };
 
   postPatch = ''
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/pysma/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/pysma/default.nix
index 5cc86e909f..39941242f1 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/pysma/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/pysma/default.nix
@@ -9,11 +9,11 @@
 
 buildPythonPackage rec {
   pname = "pysma";
-  version = "0.4";
+  version = "0.4.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-BOVALVFb/p2q3A4NkvgtwmL5fNvwMCk0hb1L5MRWzHY=";
+    sha256 = "da4bed38aba52fa097694bda15c7fd80ca698d9352e71a63bc29092d635de54d";
   };
 
   propagatedBuildInputs = [
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/pyspark/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/pyspark/default.nix
index 2d09a0a0c3..064a8db88e 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/pyspark/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/pyspark/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "pyspark";
-  version = "3.0.2";
+  version = "3.1.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "d4f2ced43394ad773f7b516a4bbcb5821a940462a17b1a25f175c83771b62ebc";
+    sha256 = "104abc146d4ffb72d4c683d25d7af5a6bf955d94590a76f542ee23185670aa7e";
   };
 
   # pypandoc is broken with pandoc2, so we just lose docs.
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/pytest-ansible/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/pytest-ansible/default.nix
index 25d5aa3054..10b9b0ec48 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/pytest-ansible/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/pytest-ansible/default.nix
@@ -8,13 +8,13 @@
 
 buildPythonPackage rec {
   pname = "pytest-ansible";
-  version = "2.1.1";
+  version = "2.2.3";
 
   src = fetchFromGitHub {
     owner = "ansible";
     repo = "pytest-ansible";
     rev = "v${version}";
-    sha256 = "0v97sqk3q2vkmwnjlnncz8ss8086x9jg3cz0g2nzlngs4ql1gdb0";
+    sha256 = "0vh2f34qxs8qfv15hf1q7li2iqjiydjsb4c86i2ma1b7vhi73j57";
   };
 
   patchPhase = ''
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/pytest-cov/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/pytest-cov/default.nix
index 003d7e14ab..a41c26b753 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/pytest-cov/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/pytest-cov/default.nix
@@ -3,11 +3,11 @@
 
 buildPythonPackage rec {
   pname = "pytest-cov";
-  version = "2.10.1";
+  version = "2.11.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "47bd0ce14056fdd79f93e1713f88fad7bdcc583dcd7783da86ef2f085a0bb88e";
+    sha256 = "359952d9d39b9f822d9d29324483e7ba04a3a17dd7d05aa6beb7ea01e359e5f7";
   };
 
   buildInputs = [ pytest ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/pytest-doctestplus/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/pytest-doctestplus/default.nix
index bf8dc9f8df..335846fc34 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/pytest-doctestplus/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/pytest-doctestplus/default.nix
@@ -9,12 +9,12 @@
 
 buildPythonPackage rec {
   pname = "pytest-doctestplus";
-  version = "0.8.0";
+  version = "0.9.0";
   disabled = isPy27; # abandoned upstream
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "fb083925a17ce636f33997c275f61123e63372c1db11fefac1e991ed25a4ca37";
+    sha256 = "6fe747418461d7b202824a3486ba8f4fa17a9bd0b1eddc743ba1d6d87f03391a";
   };
 
   buildInputs = [ pytest ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/pytest-flask/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/pytest-flask/default.nix
index e55d98ce46..f5fd4c5251 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/pytest-flask/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/pytest-flask/default.nix
@@ -2,12 +2,12 @@
 
 buildPythonPackage rec {
   pname = "pytest-flask";
-  version = "1.1.0";
+  version = "1.2.0";
   disabled = isPy27;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "9c136afd6d0fb045b0b8fd2363421b6670bfebd21d9141f79669d9051c9d2d05";
+    sha256 = "46fde652f77777bf02dc91205aec4ce20cdf2acbbbd66a918ab91f5c14693d3d";
   };
 
   doCheck = false;
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/pytest-helpers-namespace/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/pytest-helpers-namespace/default.nix
index c634aa0071..43ef2a1339 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/pytest-helpers-namespace/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/pytest-helpers-namespace/default.nix
@@ -6,13 +6,13 @@
 
 buildPythonPackage rec {
   pname = "pytest-helpers-namespace";
-  version = "2019.1.8";
+  version = "2021.3.24";
 
   src = fetchFromGitHub {
     owner = "saltstack";
     repo = pname;
-    rev = "v${version}";
-    sha256 = "0z9f25d2wpf3lnqzmmnrlvl5b1f7kqwjjf4nzs9x2bpf91s5zny1";
+    rev = version;
+    sha256 = "0ikwiwp9ycgg7px78nxdkqvg7j97krb6vzqlb8fq8fvbwrj4q4v2";
   };
 
   buildInputs = [ pytest ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/pytest-isort/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/pytest-isort/default.nix
index fb65f8acea..fe74f692df 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/pytest-isort/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/pytest-isort/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "pytest-isort";
-  version = "1.2.0";
+  version = "1.3.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "f0fcf9674f3a627b36e07466d335e82b0f7c4f9e0f7ec39f2a1750b0189d5371";
+    sha256 = "46a12331a701e2f21d48548b2828c8b0a7956dbf1cd5347163f537deb24332dd";
   };
 
   propagatedBuildInputs = [ isort ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/pytest-mypy/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/pytest-mypy/default.nix
index 370416c4aa..88b8017e1c 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/pytest-mypy/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/pytest-mypy/default.nix
@@ -9,11 +9,11 @@
 
 buildPythonPackage rec {
   pname = "pytest-mypy";
-  version = "0.8.0";
+  version = "0.8.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "63d418a4fea7d598ac40b659723c00804d16a251d90a5cfbca213eeba5aaf01c";
+    sha256 = "1fa55723a4bf1d054fcba1c3bd694215a2a65cc95ab10164f5808afd893f3b11";
   };
 
   nativeBuildInputs = [ setuptools_scm ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/pytest-order/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/pytest-order/default.nix
index 8e10cd4f58..2d94b26c53 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/pytest-order/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/pytest-order/default.nix
@@ -10,11 +10,11 @@
 
 buildPythonPackage rec {
   pname = "pytest-order";
-  version = "0.9.5";
+  version = "0.10.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "9c9e4f1b060414c642e88ad98ca60f1fd37937debd704bd8f4a2ef8e08b9cb6d";
+    sha256 = "2da32cb95e63fac6972d34f5ddb53997fc66305355425be0f55f4092d666293d";
   };
 
   buildInputs = [ pytest ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/pytest-randomly/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/pytest-randomly/default.nix
index be8d675fc1..f8e240ca57 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/pytest-randomly/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/pytest-randomly/default.nix
@@ -1,26 +1,35 @@
-{ lib, buildPythonPackage, fetchPypi, isPy27
-, factory_boy, faker, numpy
-, pytest, pytest_xdist
+{ lib, buildPythonPackage, fetchFromGitHub, pythonOlder
+, factory_boy, faker, numpy, backports-entry-points-selectable
+, pytestCheckHook, pytest_xdist
 }:
 
 buildPythonPackage rec {
   pname = "pytest-randomly";
-  version = "3.5.0";
+  version = "3.6.0";
 
-  disabled = isPy27;
+  disabled = pythonOlder "3.6";
 
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "440cec143fd9b0adeb072006c71e0294402a2bc2ccd08079c2341087ba4cf2d1";
+  # fetch from GitHub as pypi tarball doesn't include tests
+  src = fetchFromGitHub {
+    repo = pname;
+    owner = "pytest-dev";
+    rev = version;
+    sha256 = "17s7gx8b7sl7mp77f5dxzwbb32qliz9awrp6xz58bhjqp7pcsa5h";
   };
 
-  propagatedBuildInputs = [ numpy factory_boy faker ];
+  propagatedBuildInputs = [
+    backports-entry-points-selectable
+  ];
 
-  checkInputs = [ pytest pytest_xdist ];
-
-  # test warnings are fixed on an unreleased version:
-  # https://github.com/pytest-dev/pytest-randomly/pull/281
-  checkPhase = "pytest -p no:randomly";
+  checkInputs = [
+    pytestCheckHook
+    pytest_xdist
+    numpy
+    factory_boy
+    faker
+  ];
+  # needs special invocation, copied from tox.ini
+  pytestFlagsArray = [ "-p" "no:randomly" ];
 
   meta = with lib; {
     description = "Pytest plugin to randomly order tests and control random.seed";
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/pytest-services/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/pytest-services/default.nix
index 7ab175a893..70caefea89 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/pytest-services/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/pytest-services/default.nix
@@ -6,7 +6,7 @@
 , psutil
 , pytest
 , setuptools_scm
-, subprocess32
+, subprocess32 ? null
 , toml
 , zc_lockfile
 }:
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/pytest-subtesthack/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/pytest-subtesthack/default.nix
index 5006ac5115..d15df7115f 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/pytest-subtesthack/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/pytest-subtesthack/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "pytest-subtesthack";
-  version = "0.1.1";
+  version = "0.1.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "15kzcr5pchf3id4ikdvlv752rc0j4d912n589l4rifp8qsj19l1x";
+    sha256 = "0711e5d04c291ac9ac6c9eff447ec2811b1d23ccdfe1417d16d4f96481efcbe6";
   };
 
   buildInputs = [ pytest ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/pytest-xprocess/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/pytest-xprocess/default.nix
index 6e557a7adc..5949840d1e 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/pytest-xprocess/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/pytest-xprocess/default.nix
@@ -6,11 +6,11 @@
 
 buildPythonPackage rec {
   pname = "pytest-xprocess";
-  version = "0.17.0";
+  version = "0.17.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "2506d637c4f54c65dd195c1d094abdeedacc9bf0689131d847a324ad0fc951c0";
+    sha256 = "59c739edee7f3f2258e7c77989241698e356c552f5efb28bb46b478616888bf6";
   };
 
   nativeBuildInputs = [ setuptools_scm ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/pytest/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/pytest/default.nix
index 579cfe1271..07e4a44ccd 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/pytest/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/pytest/default.nix
@@ -19,12 +19,12 @@
 
 buildPythonPackage rec {
   pname = "pytest";
-  version = "6.2.2";
+  version = "6.2.3";
   disabled = !isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-nR7fnn0LhNcuo9vN/SKzX7VDpejypgCS3VeJNr9j1/k=";
+    sha256 = "0d5nx7xqr9khagbvg6ac2cjjvcxrvvjp0chwim4z7w2ddsj3h4k7";
   };
 
   nativeBuildInputs = [ setuptools-scm ];
@@ -56,9 +56,12 @@ buildPythonPackage rec {
   '';
 
   # Ignored file https://github.com/pytest-dev/pytest/pull/5605#issuecomment-522243929
+  # test_missing_required_plugins will emit deprecation warning which is treated as error
   checkPhase = ''
     runHook preCheck
-    $out/bin/py.test -x testing/ -k "not test_collect_pyargs_with_testpaths" --ignore=testing/test_junitxml.py
+    $out/bin/py.test -x testing/ \
+      --ignore=testing/test_junitxml.py \
+      -k "not test_collect_pyargs_with_testpaths and not test_missing_required_plugins"
 
     # tests leave behind unreproducible pytest binaries in the output directory, remove:
     find $out/lib -name "*-pytest-${version}.pyc" -delete
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/pytestrunner/2.nix b/third_party/nixpkgs/pkgs/development/python-modules/pytestrunner/2.nix
new file mode 100644
index 0000000000..d6203276b8
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/development/python-modules/pytestrunner/2.nix
@@ -0,0 +1,30 @@
+{ lib, buildPythonPackage, fetchPypi, setuptools_scm, pytest }:
+
+buildPythonPackage rec {
+  pname = "pytest-runner";
+  version = "5.2";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "96c7e73ead7b93e388c5d614770d2bae6526efd997757d3543fe17b557a0942b";
+  };
+
+  nativeBuildInputs = [ setuptools_scm pytest ];
+
+  postPatch = ''
+    rm pytest.ini
+  '';
+
+  checkPhase = ''
+    py.test tests
+  '';
+
+  # Fixture not found
+  doCheck = false;
+
+  meta = with lib; {
+    description = "Invoke py.test as distutils command with dependency resolution";
+    homepage = "https://github.com/pytest-dev/pytest-runner";
+    license = licenses.mit;
+  };
+}
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/pytestrunner/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/pytestrunner/default.nix
index d6203276b8..6f68bcd023 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/pytestrunner/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/pytestrunner/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "pytest-runner";
-  version = "5.2";
+  version = "5.3.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "96c7e73ead7b93e388c5d614770d2bae6526efd997757d3543fe17b557a0942b";
+    sha256 = "ca3f58ff4957e8be6c54c55d575b235725cbbcf4dc0d5091c29c6444cfc8a5fe";
   };
 
   nativeBuildInputs = [ setuptools_scm pytest ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/python-daemon/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/python-daemon/default.nix
index d8b501d62e..246e253e19 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/python-daemon/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/python-daemon/default.nix
@@ -9,11 +9,11 @@
 
 buildPythonPackage rec {
   pname = "python-daemon";
-  version = "2.2.4";
+  version = "2.3.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "57c84f50a04d7825515e4dbf3a31c70cc44414394a71608dee6cfde469e81766";
+    sha256 = "bda993f1623b1197699716d68d983bb580043cf2b8a66a01274d9b8297b0aeaf";
   };
 
   nativeBuildInputs = [ twine ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/python-frontmatter/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/python-frontmatter/default.nix
index 6c6806f043..e00ef7d9de 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/python-frontmatter/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/python-frontmatter/default.nix
@@ -1,30 +1,36 @@
-{ lib, fetchFromGitHub, python3Packages }:
+{ lib, fetchFromGitHub, buildPythonPackage, pyyaml, six, pytest, pyaml }:
 
-python3Packages.buildPythonPackage rec {
+buildPythonPackage rec {
   pname = "python-frontmatter";
-  version = "0.5.0";
+  version = "1.0.0";
 
   src = fetchFromGitHub {
     owner = "eyeseast";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1iki3rcbg7zs93m3mgqzncybqgdcch25qpwy84iz96qq8pipfs6g";
+    sha256 = "0flyh2pb0z4lq66dmmsgyakvg11yhkp4dk7qnzanl34z7ikp97bx";
   };
 
-  propagatedBuildInputs = with python3Packages; [
+  propagatedBuildInputs = [
     pyyaml
+    pyaml # yes, it's needed
     six
   ];
 
-  checkInputs = with python3Packages; [
+  # tries to import test.test, which conflicts with module
+  # exported by python interpreter
+  doCheck = false;
+  checkInputs = [
     pytest
   ];
 
+  pythonImportsCheck = [ "frontmatter" ];
+
   meta = with lib; {
     homepage = "https://github.com/eyeseast/python-frontmatter";
     description = "Parse and manage posts with YAML (or other) frontmatter";
     license = licenses.mit;
     maintainers = with maintainers; [ siraben ];
-    platforms = lib.platforms.unix;
+    platforms = platforms.unix;
   };
 }
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/python-gitlab/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/python-gitlab/default.nix
index 1a2e28d57a..4dc3cfb569 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/python-gitlab/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/python-gitlab/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "python-gitlab";
-  version = "2.5.0";
+  version = "2.6.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "68b42aafd4b620ab2534ff78a52584c7f799e4e55d5ac297eab4263066e6f74b";
+    sha256 = "a862c6874524ab585b725a17b2cd2950fc09d6d74205f40a11be2a4e8f2dcaa1";
   };
 
   propagatedBuildInputs = [ requests ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/python-gnupg/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/python-gnupg/default.nix
index fe68676110..7189a235de 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/python-gnupg/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/python-gnupg/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname   = "python-gnupg";
-  version = "0.4.6";
+  version = "0.4.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "3aa0884b3bd414652c2385b9df39e7b87272c2eca1b8fcc3089bc9e58652019a";
+    sha256 = "2061f56b1942c29b92727bf9aecbd3cea3893acc9cccbdc7eb4604285efe4ac7";
   };
 
   # Let's make the library default to our gpg binary
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/python-jsonrpc-server/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/python-jsonrpc-server/default.nix
index 53dab817eb..e641a943f8 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/python-jsonrpc-server/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/python-jsonrpc-server/default.nix
@@ -1,6 +1,6 @@
 { lib, buildPythonPackage, fetchFromGitHub, pythonOlder
 , pytestCheckHook, mock, pytestcov, coverage
-, future, futures, ujson, isPy38
+, future, futures ? null, ujson, isPy38
 }:
 
 buildPythonPackage rec {
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/python-language-server/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/python-language-server/default.nix
index e221f5b1ef..69fbaa7806 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/python-language-server/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/python-language-server/default.nix
@@ -1,5 +1,5 @@
 { lib, buildPythonPackage, fetchFromGitHub, pythonOlder, isPy27
-, backports_functools_lru_cache, configparser, futures, future, jedi, pluggy, python-jsonrpc-server, flake8
+, backports_functools_lru_cache ? null, configparser ? null, futures ? null, future, jedi, pluggy, python-jsonrpc-server, flake8
 , pytestCheckHook, mock, pytestcov, coverage, setuptools, ujson, flaky
 , # Allow building a limited set of providers, e.g. ["pycodestyle"].
   providers ? ["*"]
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/python-lz4/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/python-lz4/default.nix
index e9317d3f7c..b851ed6b82 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/python-lz4/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/python-lz4/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "python-lz4";
-  version = "2.1.10";
+  version = "3.1.3";
 
   # get full repository inorder to run tests
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    sha256 = "02cadqfdmw4vc94px18dh4hcybpsa2lr6jz6j5phwc0jjaavh3wr";
+    sha256 = "009c4rbyj4cjb8fznccfpr5wrzdmi56wq990yjh22n0z2qqylmkf";
   };
 
   nativeBuildInputs = [ setuptools_scm pkgconfig pytestrunner ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/python-periphery/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/python-periphery/default.nix
index e0461dd1ef..b52ad018d5 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/python-periphery/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/python-periphery/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "python-periphery";
-  version = "2.1.1";
+  version = "2.3.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "ed07adc27c8b4df9cd40b2d935f86400a7b495b311df5bfaf9ecaeafc5413fd5";
+    sha256 = "8a8ec019d9b330a6a6f69a7de61d14b4c98b102d76359047c5ce0263e12246a6";
   };
 
   # Some tests require physical probing and additional physical setup
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/python-ptrace/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/python-ptrace/default.nix
index 1af58300c2..0ea759d92d 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/python-ptrace/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/python-ptrace/default.nix
@@ -6,11 +6,11 @@
 
 buildPythonPackage rec {
   pname = "python-ptrace";
-  version = "0.9.7";
+  version = "0.9.8";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "b998e3436cec975b6907552af6e7f3ff8779097e32d2b905696e5a9feb09e070";
+    sha256 = "1e3bc6223f626aaacde8a7979732691c11b13012e702fee9ae16c87f71633eaa";
   };
 
   # requires distorm, which is optionally
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/python-rapidjson/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/python-rapidjson/default.nix
index 4ef3b9f837..63dc4018b2 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/python-rapidjson/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/python-rapidjson/default.nix
@@ -8,13 +8,13 @@
 }:
 
 buildPythonPackage rec {
-  version = "0.9.4";
+  version = "1.0";
   pname = "python-rapidjson";
   disabled = pythonOlder "3.4";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "d79a412d7df30f01d3cb12e0e8863a48cfecd2fd7612719e16bc76eb1b65b332";
+    sha256 = "a61fa61e41b0b85ba9e78444242fddcb3be724de1df79314e6b4766b66e4e11c";
   };
 
   LC_ALL="en_US.utf-8";
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/python-smarttub/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/python-smarttub/default.nix
index ec47b88daa..d9d1d446d1 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/python-smarttub/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/python-smarttub/default.nix
@@ -43,5 +43,6 @@ buildPythonPackage rec {
     homepage = "https://github.com/mdz/python-smarttub";
     license = with licenses; [ mit ];
     maintainers = with maintainers; [ fab ];
+    broken = pyjwt.version != "1.7.1";
   };
 }
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/python-snap7/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/python-snap7/default.nix
index 06e1185e34..05d804bc67 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/python-snap7/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/python-snap7/default.nix
@@ -2,13 +2,13 @@
 
 buildPythonPackage rec {
   pname = "python-snap7";
-  version = "0.11";
+  version = "1.0";
 
   src = fetchFromGitHub {
     owner = "gijzelaerr";
     repo = "python-snap7";
-    rev = "899a94c6eeca76fb9b18afd5056e5003646d7f94";
-    sha256 = "169zd1nxq86nmi6132vxl1f6wxm9w3waihq2wn14kkmld1vkmvfd";
+    rev = version;
+    sha256 = "103drdwf4v3yqvd7sscxx154mmmshb6x19v9yqmkj2lj76m0619s";
   };
 
   propagatedBuildInputs = [ setuptools six ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/python-stdnum/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/python-stdnum/default.nix
index eb912b2bc5..581813fac4 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/python-stdnum/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/python-stdnum/default.nix
@@ -1,11 +1,11 @@
 { lib, fetchPypi, buildPythonPackage, nose }:
 
 buildPythonPackage rec {
-  version = "1.14";
+  version = "1.16";
   pname = "python-stdnum";
   src = fetchPypi {
     inherit pname version;
-    sha256 = "fd3a92b8ec82a159c41dbaa3c5397934d090090c92b04e346412e0fd7e6a1b1c";
+    sha256 = "4248d898042a801fc4eff96fbfe4bf63a43324854efe3b5534718c1c195c6f43";
   };
 
   checkInputs = [ nose ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/python-string-utils/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/python-string-utils/default.nix
new file mode 100644
index 0000000000..d8d1b136fb
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/development/python-modules/python-string-utils/default.nix
@@ -0,0 +1,27 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, pytest
+}:
+
+buildPythonPackage rec {
+  pname = "python-string-utils";
+  version = "1.0.0";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "sha256-3PkGCwPwdkfApgNAjciwP4B/O1SgXG4Z6xRGAlb6wMs=";
+  };
+
+  pythonImportsCheck = ["string_utils"];
+
+  # tests are not available in pypi tarball
+  doCheck = false;
+
+  meta = with lib; {
+    description = "A handy Python library to validate, manipulate and generate strings.";
+    homepage = "https://github.com/daveoncode/python-string-utils";
+    license = licenses.mit;
+    maintainers = with maintainers; [ teto ];
+  };
+}
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/python-utils/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/python-utils/default.nix
index 60160d270b..f11ce745fe 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/python-utils/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/python-utils/default.nix
@@ -1,23 +1,38 @@
-{ lib, buildPythonPackage, fetchPypi, pytestCheckHook, pytestrunner, pytestcov, pytest-flakes, sphinx, six }:
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, pytestCheckHook
+, six
+}:
 
 buildPythonPackage rec {
   pname = "python-utils";
-  version = "2.4.0";
+  version = "2.5.6";
 
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "12c0glzkm81ljgf6pwh0d4rmdm1r7vvgg3ifzp8yp9cfyngw07zj";
+  src = fetchFromGitHub {
+    owner = "WoLpH";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "0gd2jana5w6bn7z58di4a8dwcxvc8rx282jawbw7ws7qm2a5klz3";
   };
 
+  # disable coverage and linting
   postPatch = ''
-    rm -r tests/__pycache__
-    rm tests/*.pyc
-    substituteInPlace pytest.ini --replace "--pep8" ""
+    sed -i '/--cov/d' pytest.ini
+    sed -i '/--flake8/d' pytest.ini
   '';
 
-  checkInputs = [ pytestCheckHook pytestrunner pytestcov pytest-flakes sphinx ];
+  propagatedBuildInputs = [
+    six
+  ];
 
-  propagatedBuildInputs = [ six ];
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  pytestFlagsArray = [
+    "_python_utils_tests"
+  ];
 
   meta = with lib; {
     description = "Module with some convenient utilities";
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/pytools/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/pytools/default.nix
index 5c7faf50ce..83de3cb459 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/pytools/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/pytools/default.nix
@@ -11,12 +11,12 @@
 
 buildPythonPackage rec {
   pname = "pytools";
-  version = "2020.4.4";
+  version = "2021.2.1";
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "3645ed839cf4d79cb4bf030f37ddaeecd7fe5e2d6698438cc36c24a1d5168809";
+    sha256 = "ebbcc38c7a30b1a0ce1a74816c85db9f2556bb4d5b9a71f85f5d88f69ddcb96b";
   };
 
   checkInputs = [ pytest ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/pytorch-metric-learning/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/pytorch-metric-learning/default.nix
index 0430ab37a6..285602bce4 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/pytorch-metric-learning/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/pytorch-metric-learning/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname   = "pytorch-metric-learning";
-  version = "0.9.95";
+  version = "0.9.97";
 
   disabled = isPy27;
 
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "KevinMusgrave";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1msvs1j3n47762ahm21bnkk2qqabxw8diiyi7s420x4zg24mr23g";
+    sha256 = "1hipby54swwpfw50wlxzgbphzqkk1fbs5x44smz4rrngqpsp3g67";
   };
 
   propagatedBuildInputs = [
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/pytorch/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/pytorch/default.nix
index 1436153e1d..59a8c74f70 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/pytorch/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/pytorch/default.nix
@@ -297,6 +297,9 @@ in buildPythonPackage rec {
     install_name_tool -change @rpath/libc10.dylib $lib/lib/libc10.dylib $lib/lib/libshm.dylib
   '';
 
+  # Builds in 2+h with 2 cores, and ~15m with a big-parallel builder.
+  requiredSystemFeatures = [ "big-parallel" ];
+
   meta = with lib; {
     description = "Open source, prototype-to-production deep learning platform";
     homepage    = "https://pytorch.org/";
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/pyviz-comms/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/pyviz-comms/default.nix
index 260311a51a..e9e07de4df 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/pyviz-comms/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/pyviz-comms/default.nix
@@ -2,6 +2,7 @@
 , fetchPypi
 , lib
 , param
+, panel
 }:
 
 buildPythonPackage rec {
@@ -10,7 +11,7 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "cd9649a9ea9dfcb9b34d78f9a64e1870aa8b6b94de546e2c99c6bb53d64ab5d1";
+    sha256 = "sha256-zZZJqeqd/LmzTXj5pk4YcKqLa5TeVG4smca7U9ZKtdE=";
   };
 
   propagatedBuildInputs = [ param ];
@@ -18,6 +19,10 @@ buildPythonPackage rec {
   # there are not tests with the package
   doCheck = false;
 
+  passthru.tests = {
+    inherit panel;
+  };
+
   meta = with lib; {
     description = "Launch jobs, organize the output, and dissect the results";
     homepage = "https://pyviz.org/";
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/pywebpush/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/pywebpush/default.nix
index 5bb8989506..a89e0b3789 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/pywebpush/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/pywebpush/default.nix
@@ -1,22 +1,39 @@
-{ lib, fetchPypi, buildPythonPackage
-, coverage, flake8, mock, nose
-, http-ece, py-vapid, requests }:
+{ lib
+, fetchPypi
+, buildPythonPackage
+, cryptography
+, http-ece
+, py-vapid
+, requests
+, six
+, coverage
+, flake8
+, mock
+, pytestCheckHook
+}:
 
 buildPythonPackage rec {
   pname = "pywebpush";
-  version = "1.11.0";
+  version = "1.13.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "596c74020f9cbabc99f7964127ab0bb6cc045fcfe781b7c73cffb3ea45947820";
+    sha256 = "97ef000a685cd1f63d9d3553568508508904bfe419485df2b83b025d94e9ae54";
   };
 
   propagatedBuildInputs = [
-    http-ece py-vapid requests
+    cryptography
+    http-ece
+    py-vapid
+    requests
+    six
   ];
 
   checkInputs = [
-    coverage flake8 mock nose
+    coverage
+    flake8
+    mock
+    pytestCheckHook
   ];
 
   meta = with lib; {
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/pyzmq/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/pyzmq/default.nix
index c80dfe93ae..953a327d19 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/pyzmq/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/pyzmq/default.nix
@@ -9,11 +9,11 @@
 
 buildPythonPackage rec {
   pname = "pyzmq";
-  version = "20.0.0";
+  version = "22.0.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "824ad5888331aadeac772bce27e1c2fbcab82fade92edbd234542c4e12f0dca9";
+    sha256 = "f7f63ce127980d40f3e6a5fdb87abf17ce1a7c2bd8bf2c7560e1bbce8ab1f92d";
   };
 
   checkInputs = [
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/qds_sdk/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/qds_sdk/default.nix
index 56b3f36c36..af5df9c347 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/qds_sdk/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/qds_sdk/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "qds_sdk";
-  version = "1.15.2";
+  version = "1.16.1";
 
   # pypi does not contain tests, using github sources instead
   src = fetchFromGitHub {
     owner = "qubole";
     repo = "qds-sdk-py";
     rev = "V${version}";
-    sha256 = "0xxg9s0y6fz7vb1kab4q93q7ryi71z8x6q9qspm6s506yr3mc67l";
+    sha256 = "05c7g63rcvvi4fgkcfsxh2a6hwlffbs18dhki222s5rpc49wi8zi";
   };
 
   propagatedBuildInputs = [
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/qtconsole/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/qtconsole/default.nix
index da45b37bee..47c36fcc12 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/qtconsole/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/qtconsole/default.nix
@@ -15,11 +15,11 @@
 
 buildPythonPackage rec {
   pname = "qtconsole";
-  version = "5.0.2";
+  version = "5.0.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "404994edfe33c201d6bd0c4bd501b00c16125071573c938533224992bea0b30f";
+    sha256 = "c091a35607d2a2432e004c4a112d241ce908086570cf68594176dd52ccaa212d";
   };
 
   checkInputs = [ nose ] ++ lib.optionals isPy27 [mock];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/radio_beam/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/radio_beam/default.nix
index 8ed5c720ef..f1f3200bb7 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/radio_beam/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/radio_beam/default.nix
@@ -10,11 +10,11 @@
 
 buildPythonPackage rec {
   pname = "radio_beam";
-  version = "0.3.2";
+  version = "0.3.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0g1nqiikv023ab60gfqrvc13kfjv8m70bpfk264vlliaq6mvxdf2";
+    sha256 = "e34902d91713ccab9f450b9d3e82317e292cf46a30bd42f9ad3c9a0519fcddcd";
   };
 
   propagatedBuildInputs = [ astropy ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/readthedocs-sphinx-ext/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/readthedocs-sphinx-ext/default.nix
index ef6975b29d..74f1c05a20 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/readthedocs-sphinx-ext/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/readthedocs-sphinx-ext/default.nix
@@ -9,11 +9,11 @@
 
 buildPythonPackage rec {
   pname = "readthedocs-sphinx-ext";
-  version = "2.1.3";
+  version = "2.1.4";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "209c4b5ecf233b8bb44fcb8b4548460b0806e347ce50fd8172adcb7d23969a4a";
+    sha256 = "2ba023376057c6ba5d07b4fd016ec1d526f1b4fc5ad7a7ce7f0ed8a91dc54bbe";
   };
 
   propagatedBuildInputs = [ requests ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/rebulk/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/rebulk/default.nix
index 8a4754e7a6..fae0bf08e5 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/rebulk/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/rebulk/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "rebulk";
-  version = "2.0.1";
+  version = "3.0.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "320ded3cc456347d828f95e9aa5f8bab77ac01943cad024c06012069fe19690a";
+    sha256 = "025d191c11abf9174c6aff0006579624047d3371a654333c4bf7a4b421552cdc";
   };
 
   # Some kind of trickery with imports that doesn't work.
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/regex/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/regex/default.nix
index e4d6baeb42..efb299161b 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/regex/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/regex/default.nix
@@ -7,11 +7,11 @@
 
 buildPythonPackage rec {
   pname = "regex";
-  version = "2020.11.13";
+  version = "2021.3.17";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "83d6b356e116ca119db8e7c6fc2983289d87b27b3fac238cfe5dca529d884562";
+    sha256 = "4b8a1fb724904139149a43e172850f35aa6ea97fb0545244dc0b805e0154ed68";
   };
 
   postCheck = ''
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/reportlab/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/reportlab/default.nix
index ace36423c1..7b5cc0a8c2 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/reportlab/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/reportlab/default.nix
@@ -11,11 +11,11 @@ let
   ft = freetype.overrideAttrs (oldArgs: { dontDisableStatic = true; });
 in buildPythonPackage rec {
   pname = "reportlab";
-  version = "3.5.59";
+  version = "3.5.66";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "a755cca2dcf023130b03bb671670301a992157d5c3151d838c0b68ef89894536";
+    sha256 = "63fba51babad0047def4ffaa41d0065248ca39d680e98dc9e3010de5425539b4";
   };
 
   checkInputs = [ glibcLocales ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/requests/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/requests/default.nix
index 5589ec683a..72feafc771 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/requests/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/requests/default.nix
@@ -20,6 +20,11 @@ buildPythonPackage rec {
     sha256 = "sha256-J5c91KkEpPE7JjoZyGbBO5KjntHJZGVfAl8/jT11uAQ=";
   };
 
+  postPatch = ''
+    # Use latest idna
+    substituteInPlace setup.py --replace ",<3" ""
+  '';
+
   propagatedBuildInputs = [
     certifi
     chardet
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/responses/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/responses/default.nix
index 624094e581..6b2bd4ac19 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/responses/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/responses/default.nix
@@ -3,11 +3,11 @@
 
 buildPythonPackage rec {
   pname = "responses";
-  version = "0.12.1";
+  version = "0.13.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "2e5764325c6b624e42b428688f2111fea166af46623cb0127c05f6afb14d3457";
+    sha256 = "cf62ab0f4119b81d485521b2c950d8aa55a885c90126488450b7acb8ee3f77ac";
   };
 
   propagatedBuildInputs = [ cookies mock requests six ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/rich/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/rich/default.nix
index 64739b3c65..52bef42f27 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/rich/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/rich/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage rec {
   pname = "rich";
-  version = "9.10.0";
+  version = "9.13.0";
 
   # tests not included in pypi tarball
   src = fetchFromGitHub {
     owner = "willmcgugan";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1m1rswg16r4pxv7504nk7lpyxrwf16xw4w55rs3jisryx14ccic6";
+    sha256 = "0si3rzhg8wfxw4aakkp8sr6nbzfa54rl0w92macd1338q90ha4ly";
   };
   format = "pyproject";
 
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/robotframework-requests/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/robotframework-requests/default.nix
index f23979f21f..5935c23185 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/robotframework-requests/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/robotframework-requests/default.nix
@@ -8,12 +8,12 @@
 }:
 
 buildPythonPackage rec {
-  version = "0.7.2";
+  version = "0.8.1";
   pname = "robotframework-requests";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "662e0ce5036a55bcb4cb46ff9741f40c78c670f4fb64cd37714cf83d5fd31774";
+    sha256 = "b26f4ae617ff8c4b522fba422b7c8f83545a98aec3e2deb7f1aa53dcd68defe2";
   };
 
   buildInputs = [ unittest2 ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/robotframework-seleniumlibrary/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/robotframework-seleniumlibrary/default.nix
index fbb8cb034a..ed2ba7155c 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/robotframework-seleniumlibrary/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/robotframework-seleniumlibrary/default.nix
@@ -1,7 +1,7 @@
 { lib, buildPythonPackage, fetchFromGitHub, python, robotframework, selenium, mockito, robotstatuschecker, approvaltests }:
 
 buildPythonPackage rec {
-  version = "3.3.1";
+  version = "5.1.3";
   pname = "robotframework-seleniumlibrary";
 
   # no tests included in PyPI tarball
@@ -9,7 +9,7 @@ buildPythonPackage rec {
     owner = "robotframework";
     repo = "SeleniumLibrary";
     rev = "v${version}";
-    sha256 = "0dabc5dwx0pwsyiy74d7wj97k72yl28a17sasjzrdq819pyc3dvq";
+    sha256 = "1djlrbrgd7v15xk5w90xk7iy98cr1p2g57k614gvbd298dmnf2wd";
   };
 
   propagatedBuildInputs = [ robotframework selenium ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/robotframework-sshlibrary/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/robotframework-sshlibrary/default.nix
index 62fb43e026..4d72a2b3b0 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/robotframework-sshlibrary/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/robotframework-sshlibrary/default.nix
@@ -7,12 +7,12 @@
 }:
 
 buildPythonPackage rec {
-  version = "3.5.1";
+  version = "3.6.0";
   pname = "robotframework-sshlibrary";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "843af44722d1d4e39f616e5441d6f49e82202cd1a8cc9d16637a6475a8ecb023";
+    sha256 = "169c343f4db71e1969169fa6f383ca7fff549aa8f83bdd3d9cbd03cea928b688";
   };
 
   # unit tests are impure
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/robotframework/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/robotframework/default.nix
index cc57fa0d02..027d0af303 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/robotframework/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/robotframework/default.nix
@@ -1,15 +1,22 @@
-{ lib, fetchPypi, buildPythonPackage }:
+{ lib, fetchFromGitHub, buildPythonPackage, jsonschema }:
 
 buildPythonPackage rec {
   pname = "robotframework";
-  version = "3.2.2";
+  version = "4.0.1";
 
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "a0786a916d0572bd9d6afe26e95c6021e3df5dcafa0ece6b302e36366e58c24e";
-    extension = "zip";
+  src = fetchFromGitHub {
+    owner = pname;
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "1nkph0slrhss6y52y8jgbdc6m8hbqjilrwp3r00wwyqdifrfa1i6";
   };
 
+  checkInputs = [ jsonschema ];
+
+  checkPhase = ''
+    python3 utest/run.py
+  '';
+
   meta = with lib; {
     description = "Generic test automation framework";
     homepage = "https://robotframework.org/";
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/rpmfile/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/rpmfile/default.nix
new file mode 100644
index 0000000000..e5d656795c
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/development/python-modules/rpmfile/default.nix
@@ -0,0 +1,32 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, setuptools-scm
+}:
+buildPythonPackage rec {
+  pname = "rpmfile";
+  version = "1.0.8";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "e56cfc10e1a7d953b1890d81652a89400c614f4cdd9909464aece434d93c3a3e";
+  };
+
+  # Tests access the internet
+  doCheck = false;
+
+  nativeBuildInputs = [
+    setuptools-scm
+  ];
+
+  pythonImportsCheck = [
+    "rpmfile"
+  ];
+
+  meta = with lib; {
+    description = "Read rpm archive files";
+    homepage = "https://github.com/srossross/rpmfile";
+    license = licenses.mit;
+    maintainers = teams.determinatesystems.members;
+  };
+}
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/rpy2/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/rpy2/default.nix
index c5443a3738..f27bc76cc3 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/rpy2/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/rpy2/default.nix
@@ -24,13 +24,13 @@
 }:
 
 buildPythonPackage rec {
-    version = "3.4.2";
+    version = "3.4.3";
     pname = "rpy2";
 
     disabled = isPyPy;
     src = fetchPypi {
       inherit version pname;
-      sha256 = "8f7d1348b77bc45425b846a0d625f24a51a1c4f32ef2cd1c07a24222aa64e2e0";
+      sha256 = "a39f2d75c24c688d5f48dfb2ef82efc006f2a51591941743026e1182353bf558";
     };
 
     patches = [
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/rq/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/rq/default.nix
index 8ec05aae9d..71381e5cf2 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/rq/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/rq/default.nix
@@ -2,14 +2,14 @@
 
 buildPythonPackage rec {
   pname = "rq";
-  version = "1.5.2";
+  version = "1.7.0";
   disabled = isPy27;
 
   src = fetchFromGitHub {
     owner = "rq";
     repo = "rq";
     rev = "v${version}";
-    sha256 = "0ikqmpq0g1qiqwd7ar1286l4hqjb6aj2wr844gihhb8ijzwhp8va";
+    sha256 = "1i7cbcrzqx52immwy8h5ps7x46sqfk9r2lgwjf01nv9mkc3ab8cj";
   };
 
   # test require a running redis rerver, which is something we can't do yet
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/rsa/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/rsa/default.nix
index 7a990061e0..247fd2a2a7 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/rsa/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/rsa/default.nix
@@ -11,11 +11,11 @@
 
 buildPythonPackage rec {
   pname = "rsa";
-  version = "4.6";
+  version = "4.7.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "109ea5a66744dd859bf16fe904b8d8b627adafb9408753161e766a92e7d681fa";
+    sha256 = "9d689e6ca1b3038bc82bf8d23e944b6b6037bc02301a574935b2dd946e0353b9";
   };
 
   checkInputs = [ unittest2 mock ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/ruamel_yaml/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/ruamel_yaml/default.nix
index 6bda50d24a..1eaf86d69c 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/ruamel_yaml/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/ruamel_yaml/default.nix
@@ -2,19 +2,19 @@
 , buildPythonPackage
 , fetchPypi
 , ruamel_base
-, ruamel_ordereddict
-, ruamel_yaml_clib
+, ruamel_ordereddict ? null
+, ruamel_yaml_clib ? null
 , isPy3k
 , isPyPy
 }:
 
 buildPythonPackage rec {
   pname = "ruamel.yaml";
-  version = "0.16.12";
+  version = "0.16.13";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "076cc0bc34f1966d920a49f18b52b6ad559fbe656a0748e3535cf7b3f29ebf9e";
+    sha256 = "bb48c514222702878759a05af96f4b7ecdba9b33cd4efcf25c86b882cef3a942";
   };
 
   # Tests use relative paths
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/ruamel_yaml_clib/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/ruamel_yaml_clib/default.nix
index 8304f5d7da..c403239d55 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/ruamel_yaml_clib/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/ruamel_yaml_clib/default.nix
@@ -2,7 +2,7 @@
 , buildPythonPackage
 , fetchhg
 , ruamel_base
-, ruamel_ordereddict
+, ruamel_ordereddict ? null
 , isPy3k
 }:
 
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/s3transfer/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/s3transfer/default.nix
index 51d3f3ab14..0ef7378fbf 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/s3transfer/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/s3transfer/default.nix
@@ -9,16 +9,16 @@
 , wheel
 , unittest2
 , botocore
-, futures
+, futures ? null
 }:
 
 buildPythonPackage rec {
   pname = "s3transfer";
-  version = "0.3.4";
+  version = "0.3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "7fdddb4f22275cf1d32129e21f056337fd2a80b6ccef1664528145b72c49e6d2";
+    sha256 = "c5dadf598762899d8cfaecf68eba649cd25b0ce93b6c954b156aaa3eed160547";
   };
 
   propagatedBuildInputs =
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/sacn/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/sacn/default.nix
index 35c7a74432..9b1e935d6e 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/sacn/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/sacn/default.nix
@@ -6,12 +6,12 @@
 
 buildPythonPackage rec {
   pname = "sacn";
-  version = "1.4.6";
+  version = "1.6.2";
   disabled = isPy27;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "015wa9nhqgd0kb60bw19g86ga25s9mpvsbqkahi3kw6df6j0wzss";
+    sha256 = "2fea82a1dd83b0a67dc0be68a53b1fef1c44b12f3f018e47ac736bd15b36c068";
   };
 
   # no tests
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/sagemaker/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/sagemaker/default.nix
index d227b7f8c6..c9bad89d93 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/sagemaker/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/sagemaker/default.nix
@@ -10,16 +10,17 @@
 , protobuf3-to-dict
 , smdebug-rulesconfig
 , pandas
+, pathos
 , packaging
 }:
 
 buildPythonPackage rec {
   pname = "sagemaker";
-  version = "2.37.0";
+  version = "2.38.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-96RDi32NHfhFvPeVRhG32EDQJTiwOXEwtSmFZGVBVk0=";
+    sha256 = "sha256-7cIGr49fKI0zQmX4/9v/gW5yB4kfeQJ3H/Vvgl9CKuY=";
   };
 
   pythonImportsCheck = [
@@ -34,6 +35,7 @@ buildPythonPackage rec {
     importlib-metadata
     numpy
     packaging
+    pathos
     protobuf
     protobuf3-to-dict
     smdebug-rulesconfig
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/sanic/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/sanic/default.nix
index 29b517ee56..e5995ed0b1 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/sanic/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/sanic/default.nix
@@ -6,11 +6,11 @@
 
 buildPythonPackage rec {
   pname = "sanic";
-  version = "20.9.1";
+  version = "21.3.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "06p0lsxqbfbka2yaqlpp0bg5pf7ma44zi6kq7qbb6hhry48dp1w6";
+    sha256 = "84a04c5f12bf321bed3942597787f1854d15c18f157aebd7ced8c851ccc49e08";
   };
 
   postPatch = ''
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/schedule/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/schedule/default.nix
index 2eda0cd6ac..e6028d2c6c 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/schedule/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/schedule/default.nix
@@ -6,11 +6,11 @@
 
 buildPythonPackage rec {
   pname = "schedule";
-  version = "0.6.0";
+  version = "1.0.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "f9fb5181283de4db6e701d476dd01b6a3dd81c38462a54991ddbb9d26db857c9";
+    sha256 = "1654cf70860a6d4d58236c98b0f1bb71521cc2a4bbf031b6cc39c96e77d59a91";
   };
 
   buildInputs = [ mock ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/scikit-fmm/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/scikit-fmm/default.nix
index 8705488ba1..08101bd2d0 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/scikit-fmm/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/scikit-fmm/default.nix
@@ -7,11 +7,11 @@
 
 buildPythonPackage rec {
   pname = "scikit-fmm";
-  version = "2019.1.30";
+  version = "2021.2.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "eb64b6d8e30b8df8f8636d5fc4fd7ca6a9b05938ccd62518c80c1d9e823069dd";
+    sha256 = "809e20016e6341e4de29b6be4befc477b7002cfd5e2a11b80deae16005f35670";
   };
 
   propagatedBuildInputs = [
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/scikit-image/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/scikit-image/default.nix
index 44d2c240ce..f7d3fd63b1 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/scikit-image/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/scikit-image/default.nix
@@ -18,11 +18,11 @@
 
 buildPythonPackage rec {
   pname = "scikit-image";
-  version = "0.17.2";
+  version = "0.18.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "bd954c0588f0f7e81d9763dc95e06950e68247d540476e06cb77bcbcd8c2d8b3";
+    sha256 = "fbb618ca911867bce45574c1639618cdfb5d94e207432b19bc19563d80d2f171";
   };
 
   nativeBuildInputs = [ cython ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/seabreeze/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/seabreeze/default.nix
index f4a4955a73..7580647f5a 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/seabreeze/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/seabreeze/default.nix
@@ -12,13 +12,13 @@
 
 buildPythonPackage rec {
   pname = "seabreeze";
-  version = "0.6.0";
+  version = "1.3.0";
 
   src = fetchFromGitHub {
     owner = "ap--";
     repo = "python-seabreeze";
-    rev = "python-seabreeze-v${version}";
-    sha256 = "0bc2s9ic77gz9m40w89snixphxlzib60xa4f49n4zasjrddfz1l8";
+    rev = "v${version}";
+    sha256 = "1lna3w1vsci35dhyi7qjvbb99gxvzk23k195c7by7kkrps844q1j";
   };
 
   postInstall = ''
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/sentinel/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/sentinel/default.nix
index 6c69ea26b2..0fd10294bb 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/sentinel/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/sentinel/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "sentinel";
-  version = "0.1.2";
+  version = "0.3.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "c7aeee3f57c56a8e52771fc64230345deecd62c48debbbe1f1aca453439741d0";
+    sha256 = "f28143aa4716dbc8f6193f5682176a3c33cd26aaae05d9ecf66c186a9887cc2d";
   };
 
   meta = with lib; {
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/setuptools_scm/2.nix b/third_party/nixpkgs/pkgs/development/python-modules/setuptools_scm/2.nix
new file mode 100644
index 0000000000..4cf6f16fed
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/development/python-modules/setuptools_scm/2.nix
@@ -0,0 +1,24 @@
+{ lib, buildPythonPackage, fetchPypi, toml }:
+
+buildPythonPackage rec {
+  pname = "setuptools_scm";
+  version = "5.0.2";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "sha256-g6DO3TRJ45RjB4EaTHudicS1/UZKL7XuzNCluxWK5cg=";
+  };
+
+  propagatedBuildInputs = [ toml ];
+
+  # Requires pytest, circular dependency
+  doCheck = false;
+  pythonImportsCheck = [ "setuptools_scm" ];
+
+  meta = with lib; {
+    homepage = "https://github.com/pypa/setuptools_scm/";
+    description = "Handles managing your python package versions in scm metadata";
+    license = licenses.mit;
+    maintainers = with maintainers; [ SuperSandro2000 ];
+  };
+}
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/setuptools_scm/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/setuptools_scm/default.nix
index fa3a3de853..a4cff6d056 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/setuptools_scm/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/setuptools_scm/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "setuptools_scm";
-  version = "4.1.2";
+  version = "6.0.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "a8994582e716ec690f33fec70cca0f85bd23ec974e3f783233e4879090a7faa8";
+    sha256 = "d1925a69cb07e9b29416a275b9fadb009a23c148ace905b2fb220649a6c18e92";
   };
 
   propagatedBuildInputs = [ toml ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/shap/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/shap/default.nix
index abc68709ca..5600f4a6aa 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/shap/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/shap/default.nix
@@ -17,14 +17,14 @@
 
 buildPythonPackage rec {
   pname = "shap";
-  version = "0.36.0";
+  version = "0.39.0";
   disabled = isPy27;
 
   src = fetchFromGitHub {
     owner = "slundberg";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1wxnxvbz6avzzfqjfbcqd4v879hvpq4021v31fhdpccr2q317rr9";
+    sha256 = "065c40k6g8sy6ynzk4k8k7iddl18g2b6kb9kg4m6g7npclmn5wvp";
   };
 
   propagatedBuildInputs = [
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/signedjson/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/signedjson/default.nix
index 2f47113408..10de67ba0e 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/signedjson/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/signedjson/default.nix
@@ -9,13 +9,13 @@
 
 buildPythonPackage rec {
   pname = "signedjson";
-  version = "1.1.0";
+  version = "1.1.1";
 
   src = fetchFromGitHub {
     owner = "matrix-org";
     repo = "python-${pname}";
-    rev = "refs/tags/v${version}";
-    sha256 = "18s388hm3babnvakbbgfqk0jzq25nnznvhygywd3azp9b4yzmd5c";
+    rev = "v${version}";
+    sha256 = "0y5c9v4vx9hqpnca892gc9b4xgs4gp5xk6l1wma5ciz8zswp9yfs";
   };
 
   propagatedBuildInputs = [ canonicaljson unpaddedbase64 pynacl typing-extensions ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/simple-salesforce/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/simple-salesforce/default.nix
index 3b6803aa5d..cd89c1c8aa 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/simple-salesforce/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/simple-salesforce/default.nix
@@ -14,13 +14,13 @@
 
 buildPythonPackage rec {
   pname = "simple-salesforce";
-  version = "0.74.3";
+  version = "1.11.0";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    sha256 = "1n960xgrnmv20l31nm0im7pb4nfa83bmx4x4clqrh2jkpzq3ric0";
+    sha256 = "16c34xnqa1xkdfjbxx0q584zb6aqci2z6j4211hmzjqs74ddvysm";
   };
 
   propagatedBuildInputs = [
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/singledispatch/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/singledispatch/default.nix
index 789a24f3e8..0a9b2353bf 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/singledispatch/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/singledispatch/default.nix
@@ -2,17 +2,24 @@
 , buildPythonPackage
 , fetchPypi
 , six
+, setuptools-scm
+, toml
 }:
 
 buildPythonPackage rec {
   pname = "singledispatch";
-  version = "3.4.0.3";
+  version = "3.6.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "5b06af87df13818d14f08a028e42f566640aef80805c3b50c5056b086e3c2b9c";
+    sha256 = "58b46ce1cc4d43af0aac3ac9a047bdb0f44e05f0b2fa2eec755863331700c865";
   };
 
+  nativeBuildInputs = [
+    setuptools-scm
+    toml
+  ];
+
   propagatedBuildInputs = [ six ];
 
   # pypi singledispatch tarbal does not contain tests
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/skein/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/skein/default.nix
index ad7cc02143..56e853f73e 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/skein/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/skein/default.nix
@@ -10,10 +10,10 @@
 
 let
   pname = "skein";
-  version = "0.8.0";
+  version = "0.8.1";
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0nb64p1hzshgi1kfc2jx1v9vn8b0wzs50460wfra3fsxh0ap66ab";
+    sha256 = "04208b4be9df2dc68ac5b3e3ae51fd9b589add95ea1b67222a8de754d17b1efa";
   };
   skeinJar = callPackage ./skeinjar.nix { inherit src version; };
 in
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/skorch/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/skorch/default.nix
index fd161ecd75..3504557b50 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/skorch/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/skorch/default.nix
@@ -16,11 +16,11 @@
 
 buildPythonPackage rec {
   pname = "skorch";
-  version = "0.9.0";
+  version = "0.10.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "bdce9370153fd80c5c4ec499a639f55eef0620e45d4b15fbf7d7ff2a225a3d40";
+    sha256 = "9910f97339e654c8d38e0075d87b735e69e5eb11db59c527fb36705b30c8d0a4";
   };
 
   propagatedBuildInputs = [ numpy pytorch scikitlearn scipy tabulate tqdm ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/smart_open/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/smart_open/default.nix
index 99c9c28a16..4f3423b7df 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/smart_open/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/smart_open/default.nix
@@ -13,12 +13,12 @@
 
 buildPythonPackage rec {
   pname = "smart_open";
-  version = "4.1.2";
+  version = "4.2.0";
   disabled = pythonOlder "3.5";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "4bbb6233364fc1173cc0af6b7a56ed76fce32509514f1978a995a5835f3177f1";
+    sha256 = "d9f5a0f173ccb9bbae528db5a3804f57145815774f77ef755b9b0f3b4b2a9dcb";
   };
 
   # moto>=1.0.0 is backwards-incompatible and some tests fail with it,
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/smartypants/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/smartypants/default.nix
index ec41c8a32a..29a1e3c9a2 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/smartypants/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/smartypants/default.nix
@@ -2,10 +2,13 @@
 , buildPythonPackage
 , fetchFromGitHub
 , isPyPy
+, docutils
+, pygments
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
-  version = "1.8.6";
+  version = "2.0.1";
   pname = "smartypants";
   disabled = isPyPy;
 
@@ -13,19 +16,23 @@ buildPythonPackage rec {
     owner = "leohemsted";
     repo = "smartypants.py";
     rev = "v${version}";
-    sha256 = "1cmzz44d2hm6y8jj2xcq1wfr26760gi7iq92ha8xbhb1axzd7nq6";
-    # remove this file and the name on the next version update
-    extraPostFetch = ''
-      cp ${./hgtags} "$out"/.hgtags
-    '';
-    name = "hg-archive";
+    sha256 = "00p1gnb9pzb3svdq3c5b9b332gsp50wrqqa39gj00m133zadanjp";
   };
 
+  checkInputs = [
+    docutils
+    pygments
+    pytestCheckHook
+  ];
+
+  preCheck = ''
+    patchShebangs smartypants
+  '';
+
   meta = with lib; {
     description = "Python with the SmartyPants";
     homepage = "https://github.com/leohemsted/smartypants.py";
     license = licenses.bsd3;
-    maintainers = with maintainers; [ ];
+    maintainers = with maintainers; [ dotlambda ];
   };
-
 }
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/smartypants/hgtags b/third_party/nixpkgs/pkgs/development/python-modules/smartypants/hgtags
deleted file mode 100644
index 522ca8d2c0..0000000000
--- a/third_party/nixpkgs/pkgs/development/python-modules/smartypants/hgtags
+++ /dev/null
@@ -1,17 +0,0 @@
-47e996532eff9d3bb2c7048aca37d5fd1028e706 v1.5_1.2
-4ff48eba1d3d37d708005e465cf701b63eb68fd3 v1.5_1.1
-6ba7f3a14ff77e4e9bf9918413b1710c33deae4d v1.5_1.3.1
-71006a014216defb21e4db6e03434d289564ea60 v1.5_1.6
-90950ff693122f80710974abc0f2be64d4105e84 v1.5_1.3
-a6ecae6541d64f5b12c7b788c65362b0c012278d v1.5_1.0
-eed4a8a16f116f98e8280dc79128845020bbe766 v1.5_1.5
-f9a62f541f19ead9be4c3be896b64d1caa0b524c v1.5_1.4
-fc0bee49a07daf05f034560cfef81a8a8d034d1f v1.5_1.7
-096ed5f806b6dbc473fae1848643cf45005b9bf1 v1.7.0
-aaeb8099a24ad7db3f36ebe71ef326d6377730aa v1.7.1
-fd8ccc937af7280db4e581b2eb1354245f4672ab v1.8.0
-7839b0eab3e9daf5b346edfa5c54f3cc46fc202a v1.8.1
-6140b78317beabb6e49cd91b35a779ccb0af7327 v1.8.2
-c3b1c83c5ddada685b421b8f82f7e92c794bf2f6 v1.8.3
-460c1add9b9f89831e1ab965f1e1c31325f6e72d v1.8.4
-78165f4976299c37d6e3dd5463adcd61f9cb2b75 v1.8.5
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/smmap/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/smmap/default.nix
index 1b0f310f42..800cf08425 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/smmap/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/smmap/default.nix
@@ -2,10 +2,10 @@
 
 buildPythonPackage rec {
   pname = "smmap";
-  version = "3.0.5";
+  version = "4.0.0";
   src = fetchPypi {
     inherit pname version;
-    sha256 = "84c2751ef3072d4f6b2785ec7ee40244c6f45eb934d9e543e2c51f1bd3d54c50";
+    sha256 = "7e65386bd122d45405ddf795637b7f7d2b532e7e401d46bbe3fb49b9986d5182";
   };
 
   checkInputs = [ nosexcover ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/snowballstemmer/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/snowballstemmer/default.nix
index 84b2bb2e14..5f3029de2a 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/snowballstemmer/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/snowballstemmer/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "snowballstemmer";
-  version = "2.0.0";
+  version = "2.1.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "df3bac3df4c2c01363f3dd2cfa78cce2840a79b9f1c2d2de9ce8d31683992f52";
+    sha256 = "e997baa4f2e9139951b6f4c631bad912dfd3c792467e2f03d7239464af90e914";
   };
 
   # No tests included
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/snowflake-connector-python/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/snowflake-connector-python/default.nix
index 0679b25ad4..fdf984563e 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/snowflake-connector-python/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/snowflake-connector-python/default.nix
@@ -25,12 +25,12 @@
 
 buildPythonPackage rec {
   pname = "snowflake-connector-python";
-  version = "2.3.10";
+  version = "2.4.1";
   disabled = isPy27;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "ad62bfd31e677d39984449d9c68e233da2776b80894a988a2421aad412e4c44f";
+    sha256 = "5c9180e61202a7beb1df83231688423091ca0a04ee559d2a78ff77f9c727baae";
   };
 
   postPatch = ''
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/soupsieve/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/soupsieve/default.nix
index 22d1926d8b..954599ffef 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/soupsieve/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/soupsieve/default.nix
@@ -9,11 +9,11 @@
 
 buildPythonPackage rec {
   pname = "soupsieve";
-  version = "2.0.1";
+  version = "2.2.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "a59dc181727e95d25f781f0eb4fd1825ff45590ec8ff49eadfd7f1a537cc0232";
+    sha256 = "052774848f448cf19c7e959adf5566904d525f33a3f8b6ba6f6f8f26ec7de0cc";
   };
 
   checkPhase = ''
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/spacy/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/spacy/default.nix
index eef7b116b8..077ac0e6a3 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/spacy/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/spacy/default.nix
@@ -22,11 +22,11 @@
 
 buildPythonPackage rec {
   pname = "spacy";
-  version = "2.3.5";
+  version = "3.0.5";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "315278ab60094643baecd866017c7d4cbd966efd2d517ad0e6c888edf7fa5aef";
+    sha256 = "9f7a09fbad53aac2a3cb7696a902de62b94575a15d249dd5e26a98049328060e";
   };
 
   propagatedBuildInputs = [
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/sphinx-autobuild/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/sphinx-autobuild/default.nix
index 94047b359a..7d4629be50 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/sphinx-autobuild/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/sphinx-autobuild/default.nix
@@ -7,11 +7,11 @@
 
 buildPythonPackage rec {
   pname = "sphinx-autobuild";
-  version = "2020.9.1";
+  version = "2021.3.14";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1vbaf4vrxahylyp8zrlw5dx1d2faajp926c3pl5i1wlkp1yll62b";
+    sha256 = "de1ca3b66e271d2b5b5140c35034c89e47f263f2cd5db302c9217065f7443f05";
   };
 
   propagatedBuildInputs = [ sphinx livereload ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/sphinx/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/sphinx/default.nix
index 9ce0015cdf..1c5cc29f41 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/sphinx/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/sphinx/default.nix
@@ -26,7 +26,7 @@
 , sphinxcontrib-qthelp
 , sphinxcontrib-serializinghtml
 , sphinxcontrib-websupport
-, typing
+, typing ? null
 , setuptools
 , packaging
 }:
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/sphinx_rtd_theme/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/sphinx_rtd_theme/default.nix
index 87da413135..06338ec118 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/sphinx_rtd_theme/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/sphinx_rtd_theme/default.nix
@@ -8,16 +8,17 @@
 
 buildPythonPackage rec {
   pname = "sphinx_rtd_theme";
-  version = "0.4.3";
+  version = "0.5.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "728607e34d60456d736cc7991fd236afb828b21b82f956c5ea75f94c8414040a";
+    sha256 = "19c31qhfiqbm6y7mamglrc2mc7l6n4lasb8jry01lc67l3nqk9pd";
   };
 
   propagatedBuildInputs = [ sphinx ];
 
   checkInputs = [ readthedocs-sphinx-ext pytest ];
+  CI=1; # Don't use NPM to fetch assets. Assets are included in sdist.
 
   checkPhase = ''
     py.test
@@ -25,8 +26,8 @@ buildPythonPackage rec {
 
   meta = with lib; {
     description = "ReadTheDocs.org theme for Sphinx";
-    homepage = "https://github.com/snide/sphinx_rtd_theme/";
-    license = licenses.bsd3;
+    homepage = "https://github.com/readthedocs/sphinx_rtd_theme";
+    license = licenses.mit;
     platforms = platforms.unix;
   };
 
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/sphinxcontrib-autoapi/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/sphinxcontrib-autoapi/default.nix
index 068c4d5d2e..c60d99d5e6 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/sphinxcontrib-autoapi/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/sphinxcontrib-autoapi/default.nix
@@ -13,12 +13,12 @@
 
 buildPythonPackage rec {
   pname = "sphinx-autoapi";
-  version = "1.5.1";
+  version = "1.7.0";
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "19m9yvlqwaw3b05lbb1vcla38irn4riw2ij0vjmnc2xq4f1qfl2d";
+    sha256 = "48caa054a99c21156e9a1d26559281dc27f86ab8ef8bb6ef160f8cd9f4a0053d";
   };
 
   propagatedBuildInputs = [ astroid jinja2 pyyaml sphinx unidecode ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/sphinxcontrib-bibtex/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/sphinxcontrib-bibtex/default.nix
index 51d9824f63..b31c79c3f7 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/sphinxcontrib-bibtex/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/sphinxcontrib-bibtex/default.nix
@@ -16,7 +16,7 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-dQCEPhVNdpg8I7ylynOAll4HJcRrj0hMEyLQtYps47I=";
+    sha256 = "7500843e154d76983c23bca5ca7380965e0725c46b8f484c1322d0b58a6ce3b2";
   };
 
   propagatedBuildInputs = [ oset pybtex pybtex-docutils sphinx ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/sphinxcontrib_plantuml/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/sphinxcontrib_plantuml/default.nix
index e028b6eea8..51fd34803d 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/sphinxcontrib_plantuml/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/sphinxcontrib_plantuml/default.nix
@@ -7,11 +7,11 @@
 
 buildPythonPackage rec {
   pname = "sphinxcontrib-plantuml";
-  version = "0.19";
+  version = "0.20";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "98b9f02282907b0c5b7a93a446c4649909aaf5785d2da0dd263c8ad68e00e288";
+    sha256 = "041d8f79599522949eda129146a60955d0b7544963790411106fff6f9f3daab4";
   };
 
   # No tests included.
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/spyder-kernels/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/spyder-kernels/default.nix
index 614f64a0fb..410e1ad061 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/spyder-kernels/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/spyder-kernels/default.nix
@@ -3,11 +3,11 @@
 
 buildPythonPackage rec {
   pname = "spyder-kernels";
-  version = "1.10.1";
+  version = "1.10.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "416534d7504c0f337e6e6e2cbd893d1866ad20d3bec99a94ad617d2fd60699ae";
+    sha256 = "a507397f5ff0426cff50f1b67996b191bdc8148583aa565f5dffd3d0111c0262";
   };
 
   propagatedBuildInputs = [
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/spyder/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/spyder/default.nix
index dd65079e6a..0293699a45 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/spyder/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/spyder/default.nix
@@ -8,13 +8,13 @@
 
 buildPythonPackage rec {
   pname = "spyder";
-  version = "4.2.1";
+  version = "4.2.4";
 
   disabled = isPy27;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "7f93bc5b8b119cc1e195ce3efcc1598386e082c4096334c1fa2b018938ac79b9";
+    sha256 = "ec3a6949a3210f7a35142ddd0e8ec529bdd382ae0cae9d1537f2009f557214c8";
   };
 
   nativeBuildInputs = [ pyqtwebengine.wrapQtAppsHook ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/sqlalchemy-citext/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/sqlalchemy-citext/default.nix
index bf8a9d3bbd..8fc03d788a 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/sqlalchemy-citext/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/sqlalchemy-citext/default.nix
@@ -1,21 +1,25 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, psycopg2
 , sqlalchemy
 , python
 }:
 
 buildPythonPackage rec {
   pname = "sqlalchemy-citext";
-  version = "1.7.0";
+  version = "1.8.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "69ba00f5505f92a1455a94eefc6d3fcf72dda3691ab5398a0b4d0d8d85bd6aab";
+    sha256 = "a1740e693a9a334e7c8f60ae731083fe75ce6c1605bb9ca6644a6f1f63b15b77";
   };
 
   propagatedBuildInputs = [
     sqlalchemy
+
+    # not listed in `install_requires`, but is imported in citext/__init__.py
+    psycopg2
   ];
 
   # tests are not packaged in pypi tarball
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/sqlalchemy/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/sqlalchemy/default.nix
index 6f5fb55786..5964e38208 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/sqlalchemy/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/sqlalchemy/default.nix
@@ -1,6 +1,6 @@
 { stdenv, lib, fetchPypi, buildPythonPackage, isPy3k, isPy35, fetchpatch
 , mock
-, pysqlite
+, pysqlite ? null
 , pytestCheckHook
 , pytest_xdist
 }:
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/sqlobject/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/sqlobject/default.nix
index f3c438342b..2335a0204e 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/sqlobject/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/sqlobject/default.nix
@@ -10,11 +10,11 @@
 
 buildPythonPackage rec {
   pname = "SQLObject";
-  version = "3.8.1";
+  version = "3.9.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "620657105ab5720658222d10ad13c52281fe524137b59ab166eee4427ee2f548";
+    sha256 = "45064184decf7f42d386704e5f47a70dee517d3e449b610506e174025f84d921";
   };
 
   checkInputs = [ pytest ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/sshpubkeys/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/sshpubkeys/default.nix
index 6e250cf85f..955eb905ac 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/sshpubkeys/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/sshpubkeys/default.nix
@@ -4,14 +4,14 @@
 }:
 
 buildPythonPackage rec {
-  version = "3.1.0";
+  version = "3.3.1";
   pname = "sshpubkeys";
 
   src = fetchFromGitHub {
     owner = "ojarva";
     repo = "python-${pname}";
-    rev = "v${version}";
-    sha256 = "1h4gwmcfn84kkqh83km1vfz8sc5kr2g4gzgzmr8gz704jmqiv7nq";
+    rev = version;
+    sha256 = "1qsixmqg97kyvg1naw76blq4314vaw4hl5f9wi0v111mcmdia1r4";
   };
 
   propagatedBuildInputs = [ cryptography ecdsa ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/stevedore/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/stevedore/default.nix
index 06d614feaa..cf1a50c49b 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/stevedore/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/stevedore/default.nix
@@ -10,23 +10,29 @@
 
 buildPythonPackage rec {
   pname = "stevedore";
-  version = "3.2.2";
+  version = "3.3.0";
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "f845868b3a3a77a2489d226568abe7328b5c2d4f6a011cc759dfa99144a521f0";
+    sha256 = "3a5bbd0652bf552748871eaa73a4a8dc2899786bc497a2aa1fcb4dcdb0debeee";
   };
 
-  propagatedBuildInputs = [ pbr setuptools six ]
-    ++ lib.optionals (pythonOlder "3.8") [ importlib-metadata ];
+  propagatedBuildInputs = [
+    pbr
+    setuptools
+    six
+  ] ++ lib.optionals (pythonOlder "3.8") [
+    importlib-metadata
+  ];
 
   doCheck = false;
   pythonImportsCheck = [ "stevedore" ];
 
   meta = with lib; {
     description = "Manage dynamic plugins for Python applications";
-    homepage = "https://pypi.python.org/pypi/stevedore";
+    homepage = "https://docs.openstack.org/stevedore/";
     license = licenses.asl20;
+    maintainers = with maintainers; [ fab ];
   };
 }
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/stone/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/stone/default.nix
new file mode 100644
index 0000000000..21c92fcee7
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/development/python-modules/stone/default.nix
@@ -0,0 +1,51 @@
+{ lib, buildPythonPackage, fetchPypi
+, coverage
+, mock
+, ply
+, pytestrunner
+, pytestCheckHook
+, six
+}:
+
+buildPythonPackage rec {
+  pname = "stone";
+  version = "3.2.1";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "0xby5mpsms7b2rv8j6mvxzmzz5i9ii01brb9ylxz6kiv2i08piwv";
+  };
+
+  postPatch = ''
+    substituteInPlace setup.py \
+      --replace "pytest-runner == 5.2.0" "pytest-runner" \
+      --replace "pytest < 5" "pytest"
+    substituteInPlace test/requirements.txt \
+      --replace "coverage==5.3" "coverage"
+  '';
+
+  nativeBuildInputs = [ pytestrunner ];
+
+  propagatedBuildInputs = [ ply six ];
+
+  checkInputs = [ pytestCheckHook coverage mock ];
+
+  # try to import from `test` directory, which is exported by the python interpreter
+  # and cannot be overriden without removing some py3 to py2 support
+  disabledTestPaths = [
+    "test/test_tsd_types.py"
+    "test/test_js_client.py"
+  ];
+  disabledTests = [
+    "test_type_name_with_module"
+  ];
+
+  pythonImportsCheck = [ "stone" ];
+
+  meta = with lib; {
+    description = "Official Api Spec Language for Dropbox";
+    homepage = "https://github.com/dropbox/stone";
+    license = licenses.mit;
+    maintainers = with maintainers; [ jonringer ];
+  };
+}
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/stripe/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/stripe/default.nix
index 96ac2d208b..4be51c488d 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/stripe/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/stripe/default.nix
@@ -2,7 +2,7 @@
 
 buildPythonPackage rec {
   pname = "stripe";
-  version = "2.55.2";
+  version = "2.56.0";
 
   # Tests require network connectivity and there's no easy way to disable
   # them. ~ C.
@@ -10,7 +10,7 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "e32c68194a47522a10945eb893218e5cb5ee65e3a3c2c4df7efca117a6bf1902";
+    sha256 = "2ff904fb8dee0d25f135059468a876852d24dc8cbe0b45d7aff56a028045777c";
   };
 
   propagatedBuildInputs = [ requests ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/structlog/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/structlog/default.nix
index 8f7e73a454..dc7aea0c3b 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/structlog/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/structlog/default.nix
@@ -14,11 +14,11 @@
 
 buildPythonPackage rec {
   pname = "structlog";
-  version = "20.1.0";
+  version = "21.1.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "7a48375db6274ed1d0ae6123c486472aa1d0890b08d314d2b016f3aa7f35990b";
+    sha256 = "d9d2d890532e8db83c6977a2a676fb1889922ff0c26ad4dc0ecac26f9fafbc57";
   };
 
   checkInputs = [ pytest pytest-asyncio pretend freezegun simplejson twisted ]
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/stumpy/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/stumpy/default.nix
index 3ace2e925c..3be5ffad1c 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/stumpy/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/stumpy/default.nix
@@ -16,13 +16,13 @@
 
 buildPythonPackage rec {
   pname = "stumpy";
-  version = "1.4";
+  version = "1.8.0";
 
   src = fetchFromGitHub {
     owner = "TDAmeritrade";
     repo = "stumpy";
     rev = "v${version}";
-    sha256 = "0s2s3y855jjwdb7p55zx8lknplz58ghpw547yzmqisacr968b67w";
+    sha256 = "0s7pamn39ymm1lp9z28isbdrd6ix98y9i4lfdk3ii95wvd3y50my";
   };
 
   propagatedBuildInputs = [
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/sumo/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/sumo/default.nix
index e1b3d8c705..9ba073df92 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/sumo/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/sumo/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "sumo";
-  version = "1.0.9";
+  version = "2.2.1";
 
   # No tests in Pypi tarball
   src = fetchFromGitHub {
     owner = "SMTG-UCL";
     repo = "sumo";
     rev = "v${version}";
-    sha256 = "1zw86qp9ycw2k0anw6pzvwgd3zds0z2cwy0s663zhiv9mnb5hx1n";
+    sha256 = "0r88f5w33h9b0mv7shlqc4przwvas5ycgndvl91wqjnm3b2s3ix0";
   };
 
   propagatedBuildInputs = [ numpy scipy spglib pymatgen h5py matplotlib seekpath phonopy ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/sunpy/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/sunpy/default.nix
index 48eb36d6e8..65eb6abb04 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/sunpy/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/sunpy/default.nix
@@ -30,12 +30,12 @@
 
 buildPythonPackage rec {
   pname = "sunpy";
-  version = "2.0.7";
+  version = "2.1.2";
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "d13ac67c14ea825652dc3e12c4c627e782e8e843e96a1d54440d39dd2ceb6a5c";
+    sha256 = "8bbc440e606a4f3fcbd1441150d81da6f0208adace9dc06f6afd2c9cb7c08908";
   };
 
   nativeBuildInputs = [
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/supervisor/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/supervisor/default.nix
index 93569fe3da..a7153b0775 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/supervisor/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/supervisor/default.nix
@@ -6,11 +6,11 @@
 
 buildPythonPackage rec {
   pname = "supervisor";
-  version = "4.2.1";
+  version = "4.2.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "c479c875853e9c013d1fa73e529fd2165ff1ecaecc7e82810ba57e7362ae984d";
+    sha256 = "5b2b8882ec8a3c3733cce6965cc098b6d80b417f21229ab90b18fe551d619f90";
   };
 
   # wants to write to /tmp/foo which is likely already owned by another
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/svg-path/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/svg-path/default.nix
index 820d412163..e01909fc93 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/svg-path/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/svg-path/default.nix
@@ -1,11 +1,11 @@
 { lib, buildPythonPackage, fetchPypi }:
 buildPythonPackage rec {
   pname = "svg.path";
-  version = "4.0.2";
+  version = "4.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "4bd627ec6526cd5da14f3c6a51205d930187db2d8992aed626825492c033b195";
+    sha256 = "7e6847ba690ff620e20f152818d52e1685b993aacbc41b321f8fee3d1cb427db";
   };
 
   meta = with lib; {
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/symengine/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/symengine/default.nix
index f225dd431e..831583c132 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/symengine/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/symengine/default.nix
@@ -11,13 +11,13 @@
 
 buildPythonPackage rec {
   pname = "symengine";
-  version = "0.6.1";
+  version = "0.7.0.post3";
 
   src = fetchFromGitHub {
     owner = "symengine";
     repo = "symengine.py";
     rev = "v${version}";
-    sha256 = "13fy25qxn4xwzlr2w35v6jhlpd70lv9r6srv4dizc4brj63hnw50";
+    sha256 = "1hpwnnv6f7f2wj33zaaj3i2r0d0qj0jwm3fd4ayicj0rvqya50rx";
   };
 
   postConfigure = ''
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/sysv_ipc/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/sysv_ipc/default.nix
index 5d9b5a034c..a58b714a4a 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/sysv_ipc/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/sysv_ipc/default.nix
@@ -5,11 +5,11 @@
 
 buildPythonPackage rec {
   pname = "sysv_ipc";
-  version = "1.0.1";
+  version = "1.1.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1p5lx3yz4p40rfb453m80a4hh8341yp4dki2nhhxz7bq2zfi1zwf";
+    sha256 = "0f063cbd36ec232032e425769ebc871f195a7d183b9af32f9901589ea7129ac3";
   };
 
   meta = with lib; {
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/tablib/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/tablib/default.nix
index b1427a8133..5216fc7d0d 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/tablib/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/tablib/default.nix
@@ -12,12 +12,12 @@
 
 buildPythonPackage rec {
   pname = "tablib";
-  version = "2.0.0";
+  version = "3.0.0";
   disabled = isPy27;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1rvvdchdva7j9b29ay0sg8y33pjhpmzynl38wz2rl89pph8gmhlc";
+    sha256 = "f83cac08454f225a34a305daa20e2110d5e6335135d505f93bc66583a5f9c10d";
   };
 
   propagatedBuildInputs = [ xlwt openpyxl pyyaml xlrd odfpy ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/tabulate/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/tabulate/default.nix
index 2d841918f1..621445b2d5 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/tabulate/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/tabulate/default.nix
@@ -5,12 +5,12 @@
 }:
 
 buildPythonPackage rec {
-  version = "0.8.8";
+  version = "0.8.9";
   pname = "tabulate";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "26f2589d80d332fefd2371d396863dedeb806f51b54bdb4b264579270b621e92";
+    sha256 = "eb1d13f25760052e8931f2ef80aaf6045a6cceb47514db8beab24cded16f13a7";
   };
 
   checkInputs = [ nose ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/tabview/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/tabview/default.nix
new file mode 100644
index 0000000000..35a7f7d8a7
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/development/python-modules/tabview/default.nix
@@ -0,0 +1,31 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, python
+}:
+
+buildPythonPackage rec {
+  pname = "tabview";
+  version = "1.4.4";
+  format = "setuptools";
+
+  # newest release only available as wheel on pypi
+  src = fetchFromGitHub {
+    owner = "TabViewer";
+    repo = "tabview";
+    rev = version;
+    sha256 = "1d1l8fhdn3w2zg7wakvlmjmgjh9lh9h5fal1clgyiqmhfix4cn4m";
+  };
+
+  checkPhase = ''
+    ${python.interpreter} -m unittest discover
+  '';
+
+  meta = with lib; {
+    description = "Python curses command line CSV and tabular data viewer";
+    homepage = "https://github.com/TabViewer/tabview";
+    changelog = "https://github.com/TabViewer/tabview/blob/main/CHANGELOG.rst";
+    license = licenses.mit;
+    maintainers = with maintainers; [ hexa ];
+  };
+}
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/taskw/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/taskw/default.nix
index 9e1ae3302c..523d3e303b 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/taskw/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/taskw/default.nix
@@ -11,12 +11,12 @@
 }:
 
 buildPythonPackage rec {
-  version = "1.2.0";
+  version = "1.3.0";
   pname = "taskw";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "fadd8afc12df026c3c2d39b633c55d3337f7dca95602fce2239455a048bc85fe";
+    sha256 = "7673d80b3d5bace5b35eb71f5035e313a92daab6e437694128d8ce7dcdaf66fb";
   };
 
   patches = [ ./use-template-for-taskwarrior-install-path.patch ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/tenacity/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/tenacity/default.nix
index 51f055d066..c1c0abcec2 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/tenacity/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/tenacity/default.nix
@@ -1,15 +1,15 @@
 { lib, buildPythonPackage, fetchPypi, isPy27, isPy3k
-, pbr, six, futures, monotonic, typing, setuptools_scm
+, pbr, six, futures ? null, monotonic ? null, typing ? null, setuptools_scm
 , pytest, sphinx, tornado, typeguard
 }:
 
 buildPythonPackage rec {
   pname = "tenacity";
-  version = "6.3.1";
+  version = "7.0.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0zsdajdpcjd7inrl7r9pwiyh7qpgh9jk7g2bj1iva2d3n0gijkg1";
+    sha256 = "5bd16ef5d3b985647fe28dfa6f695d343aa26479a04e8792b9d3c8f49e361ae1";
   };
 
   nativeBuildInputs = [ pbr setuptools_scm ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/tensorboardx/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/tensorboardx/default.nix
index a95f8e0292..f83467520c 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/tensorboardx/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/tensorboardx/default.nix
@@ -1,31 +1,69 @@
-{ boto3, buildPythonPackage, crc32c, fetchFromGitHub, lib, matplotlib, moto
-, numpy, pillow, pytorch, protobuf, six, pytestCheckHook
-, tensorflow-tensorboard, torchvision }:
+{ boto3
+, buildPythonPackage
+, crc32c
+, fetchFromGitHub
+, lib
+, matplotlib
+, moto
+, numpy
+, pillow
+, protobuf
+, pytestCheckHook
+, pytorch
+, six
+, soundfile
+, tensorflow-tensorboard
+, torchvision
+}:
 
 buildPythonPackage rec {
   pname = "tensorboardx";
-  version = "2.0";
+  version = "2.1";
 
   src = fetchFromGitHub {
     owner = "lanpa";
     repo = "tensorboardX";
     rev = "v${version}";
-    sha256 = "0qqalq0fhbx0wnd8wdwhyhkkv2brvj9qbk3373vk3wjxbribf5c7";
+    sha256 = "1palz91y0b39pcmwg6wdmqfal38hai99dd6r88i3imqxdbmjghih";
   };
 
-  checkInputs = [
-    pytestCheckHook boto3 crc32c matplotlib moto pillow pytorch tensorflow-tensorboard torchvision
-  ];
-
-  propagatedBuildInputs = [ numpy protobuf six ];
-
   # apparently torch API changed a bit at 1.6
   postPatch = ''
-    substituteInPlace tensorboardX/pytorch_graph.py --replace "torch.onnx.set_training(model, False)" "torch.onnx.select_model_mode_for_export(model, torch.onnx.TrainingMode.EVAL)"
+    substituteInPlace tensorboardX/pytorch_graph.py --replace \
+      "torch.onnx.set_training(model, False)" \
+      "torch.onnx.select_model_mode_for_export(model, torch.onnx.TrainingMode.EVAL)"
   '';
 
+  propagatedBuildInputs = [
+    crc32c
+    numpy
+    protobuf
+    six
+    soundfile
+  ];
 
-  disabledTests = [ "test_TorchVis"  "test_onnx_graph" ];
+  checkInputs = [
+    boto3
+    matplotlib
+    moto
+    pillow
+    pytestCheckHook
+    pytorch
+    tensorflow-tensorboard
+    torchvision
+  ];
+
+  disabledTests = [
+    # ImportError: Visdom visualization requires installation of Visdom
+    "test_TorchVis"
+    # Requires network access (FileNotFoundError: [Errno 2] No such file or directory: 'wget')
+    "test_onnx_graph"
+  ];
+
+  disabledTestPaths = [
+    # we are not interested in linting errors
+    "tests/test_lint.py"
+  ];
 
   meta = with lib; {
     description = "Library for writing tensorboard-compatible logs";
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/tensorflow/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/tensorflow/default.nix
index 0e2df1a467..0216c05eea 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/tensorflow/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/tensorflow/default.nix
@@ -325,6 +325,10 @@ let
           addOpenGLRunpath "$lib"
         done
       '';
+
+      requiredSystemFeatures = [
+        "big-parallel"
+      ];
     };
 
     meta = with lib; {
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/terminado/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/terminado/default.nix
index 0f02da4866..846c8157b7 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/terminado/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/terminado/default.nix
@@ -7,11 +7,11 @@
 
 buildPythonPackage rec {
   pname = "terminado";
-  version = "0.9.2";
+  version = "0.9.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "89e6d94b19e4bc9dce0ffd908dfaf55cc78a9bf735934e915a4a96f65ac9704c";
+    sha256 = "261c0b7825fecf629666e1820b484a5380f7e54d6b8bd889fa482e99dcf9bde4";
   };
 
   propagatedBuildInputs = [ ptyprocess tornado ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/testfixtures/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/testfixtures/default.nix
index b9803b1150..cd08fe58dc 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/testfixtures/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/testfixtures/default.nix
@@ -3,11 +3,11 @@
 
 buildPythonPackage rec {
   pname = "testfixtures";
-  version = "6.15.0";
+  version = "6.17.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "409f77cfbdad822d12a8ce5c4aa8fb4d0bb38073f4a5444fede3702716a2cec2";
+    sha256 = "5ec3a0dd6f71cc4c304fbc024a10cc293d3e0b852c868014b9f233203e149bda";
   };
 
   checkInputs = [ pytest mock sybil zope_component twisted ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/thinc/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/thinc/default.nix
index 75e1a029a2..a92d349e99 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/thinc/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/thinc/default.nix
@@ -16,6 +16,7 @@
 , pathlib
 , plac
 , preshed
+, pydantic
 , srsly
 , tqdm
 , wasabi
@@ -23,11 +24,11 @@
 
 buildPythonPackage rec {
   pname = "thinc";
-  version = "7.4.5";
+  version = "8.0.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "5743fde41706252ec6ce4737c68d3505f7e1cc3d4431174a17149838d594f8cb";
+    sha256 = "20f033b3d9fbd02389d8f828cebcd3a42aee3e17ed4c2d56c6d5163af83a9cee";
   };
 
   buildInputs = [ cython ] ++ lib.optionals stdenv.isDarwin (with darwin.apple_sdk.frameworks; [
@@ -47,6 +48,7 @@ buildPythonPackage rec {
     preshed
     srsly
     tqdm
+    pydantic
     wasabi
   ] ++ lib.optional (pythonOlder "3.4") pathlib;
 
@@ -61,11 +63,9 @@ buildPythonPackage rec {
   doCheck = false;
 
   postPatch = ''
-    substituteInPlace setup.py \
+    substituteInPlace setup.cfg \
       --replace "blis>=0.4.0,<0.8.0" "blis>=0.4.0,<1.0" \
-      --replace "catalogue>=0.0.7,<1.1.0" "catalogue>=0.0.7,<3.0" \
-      --replace "plac>=0.9.6,<1.2.0" "plac>=0.9.6,<2.0" \
-      --replace "srsly>=0.0.6,<1.1.0" "srsly>=0.0.6,<3.0"
+      --replace "pydantic>=1.7.1,<1.8.0" "pydantic~=1.7"
   '';
 
   checkPhase = ''
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/tifffile/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/tifffile/default.nix
index 9383cf947c..70b815c4ec 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/tifffile/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/tifffile/default.nix
@@ -5,19 +5,19 @@
 , isPy3k
 , numpy
 , imagecodecs-lite
-, enum34
-, futures
-, pathlib
+, enum34 ? null
+, futures ? null
+, pathlib ? null
 , pytest
 }:
 
 buildPythonPackage rec {
   pname = "tifffile";
-  version = "2020.11.26";
+  version = "2021.3.17";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "c712df6f201385fbd3500e26e45dc20fabcbb0c6c1fbfb4c1e44538a9d0269a8";
+    sha256 = "1b72c92ecd2273e52686c0f8792d1d1c4da4109b241dd1723dfe56ef4d1ad612";
   };
 
   patches = lib.optional isPy27 ./python2-regex-compat.patch;
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/timezonefinder/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/timezonefinder/default.nix
index 0ba9c4c53d..48aff396aa 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/timezonefinder/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/timezonefinder/default.nix
@@ -10,13 +10,13 @@
 
 buildPythonPackage rec {
   pname = "timezonefinder";
-  version = "4.5.0";
+  version = "5.2.0";
 
   disabled = isPy27;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "99b0cea5abf304e8738ecf5cceae0c0e5182534843f19638a26a220fa212fbad";
+    sha256 = "a374570295a8dbd923630ce85f754e52578e288cb0a9cf575834415e84758352";
   };
 
   propagatedBuildInputs = [
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/titlecase/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/titlecase/default.nix
index acc8b9c567..9dc09db98f 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/titlecase/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/titlecase/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "titlecase";
-  version = "1.1.1";
+  version = "2.0.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "16e279edf085293bc9c44a68ce959c7d6cd5c653e6b5669a3a3640015cb63eb6";
+    sha256 = "d6b24c4bfce6b05ee55da48901a1aa39eac20f223160b7872dcf1b8182214bec";
   };
 
   propagatedBuildInputs = [ regex ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/tomlkit/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/tomlkit/default.nix
index 27f952386f..cabe2ebcd5 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/tomlkit/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/tomlkit/default.nix
@@ -1,5 +1,5 @@
 { lib, buildPythonPackage, fetchPypi, isPy27
-, enum34, functools32, typing
+, enum34, functools32, typing ? null
 }:
 
 buildPythonPackage rec {
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/torchvision/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/torchvision/default.nix
index 3575921518..8f3cb085b6 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/torchvision/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/torchvision/default.nix
@@ -14,13 +14,13 @@
 
 buildPythonPackage rec {
   pname = "torchvision";
-  version = "0.8.2";
+  version = "0.9.0";
 
   src = fetchFromGitHub {
     owner = "pytorch";
     repo = "vision";
     rev = "v${version}";
-    sha256 = "0yhpbq7linrk2qp5jxsvlgkmwa5bn38s9kcswy4jzvmx1fjbkpq0";
+    sha256 = "0rw186nki7q8igk481p2mvx4n763i3kpn663yp3dibkimddpnf9k";
   };
 
   nativeBuildInputs = [ libpng ninja which ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/tornado/4.nix b/third_party/nixpkgs/pkgs/development/python-modules/tornado/4.nix
index 6d889a09d2..da86c7037b 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/tornado/4.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/tornado/4.nix
@@ -2,11 +2,11 @@
 , python
 , buildPythonPackage
 , fetchPypi
-, backports_abc
-, backports_ssl_match_hostname
-, certifi
-, singledispatch
-, futures
+, backports_abc ? null
+, backports_ssl_match_hostname ? null
+, certifi ? null
+, singledispatch ? null
+, futures ? null
 , isPy27
 }:
 
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/tornado/5.nix b/third_party/nixpkgs/pkgs/development/python-modules/tornado/5.nix
index da27033197..2905f89dc0 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/tornado/5.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/tornado/5.nix
@@ -2,11 +2,11 @@
 , python
 , buildPythonPackage
 , fetchPypi
-, backports_abc
-, backports_ssl_match_hostname
-, certifi
-, singledispatch
-, futures
+, backports_abc ? null
+, backports_ssl_match_hostname ? null
+, certifi ? null
+, singledispatch ? null
+, futures ? null
 , isPy27
 }:
 
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/tox/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/tox/default.nix
index 9dad7d77ff..0fc0ffbf2e 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/tox/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/tox/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "tox";
-  version = "3.20.1";
+  version = "3.23.0";
 
   buildInputs = [ setuptools_scm ];
   propagatedBuildInputs = [ packaging pluggy py six virtualenv toml filelock ];
@@ -22,7 +22,7 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "4321052bfe28f9d85082341ca8e233e3ea901fdd14dab8a5d3fbd810269fbaf6";
+    sha256 = "05a4dbd5e4d3d8269b72b55600f0b0303e2eb47ad5c6fe76d3576f4c58d93661";
   };
 
   meta = with lib; {
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/traits/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/traits/default.nix
index d9986dd87f..e4e82db9e4 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/traits/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/traits/default.nix
@@ -9,12 +9,12 @@
 
 buildPythonPackage rec {
   pname = "traits";
-  version = "6.1.1";
+  version = "6.2.0";
   disabled = isPy27; # setup.py no longer py3 compat
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "807da52ee0d4fc1241c8f8a04d274a28d4b23d3a5f942152497d19405482d04f";
+    sha256 = "16fa1518b0778fd53bf0547e6a562b1787bf68c8f6b7995a13bd1902529fdb0c";
   };
 
   # Use pytest because its easier to discover tests
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/transmission-rpc/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/transmission-rpc/default.nix
index 235540209e..533b34ca34 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/transmission-rpc/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/transmission-rpc/default.nix
@@ -9,11 +9,11 @@
 
 buildPythonPackage rec {
   pname = "transmission-rpc";
-  version = "3.2.2";
+  version = "3.2.4";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1y5048109j6z4smzwysvdjfn6cj9698dsxfim9i4nqam4nmw2wi7";
+    sha256 = "f852d1afd0f0d4f515fe20f0de94d57b6d2e36cbac45e07da43ea0b6518f535c";
   };
 
   propagatedBuildInputs = [
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/treq/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/treq/default.nix
index 447e2a5b98..ec648281c8 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/treq/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/treq/default.nix
@@ -4,11 +4,11 @@
 
 buildPythonPackage rec {
   pname = "treq";
-  version = "20.9.0";
+  version = "21.1.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "83cd2ca75aef4f1fbdbe144c186426d930c3e8b20385df8cec9e12d442986da2";
+    sha256 = "fdae0c872c444ed96c3cb11be8445d22e4afb731e87fdddae3b00c609e77199f";
   };
 
   propagatedBuildInputs = [
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/trimesh/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/trimesh/default.nix
index d4a021a0e3..aad81957d7 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/trimesh/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/trimesh/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "trimesh";
-  version = "3.9.7";
+  version = "3.9.10";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "63dd76531a4c6ddd53e00209b971e83d3fbfd9b012f4033a1c4b0f04f1f551e3";
+    sha256 = "7ed243bc818f7a9a021d8dd39f69ae7ed366dfd9582b13d686e1b1e8c8326bcf";
   };
 
   propagatedBuildInputs = [ numpy ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/trustme/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/trustme/default.nix
index 4c99c8e937..a959bef168 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/trustme/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/trustme/default.nix
@@ -1,28 +1,29 @@
 { lib
+, stdenv
 , buildPythonPackage
 , fetchPypi
 , isPy3k
 , cryptography
-, futures
-, pytest
+, futures ? null
 , pyopenssl
 , service-identity
+, pytestCheckHook
 , idna
 }:
 
 buildPythonPackage rec {
   pname = "trustme";
-  version = "0.6.0";
+  version = "0.7.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "9dfb18b568729d0219f758cddca1a91bab59f62ca41ee0e8acce5e657ec97b6c";
+    sha256 = "1fde1dd27052ab5e5693e1fbe3ba091a6496daf1125409d73232561145fca369";
   };
 
   checkInputs = [
-    pytest
     pyopenssl
     service-identity
+    pytestCheckHook
   ];
 
   propagatedBuildInputs = [
@@ -32,9 +33,11 @@ buildPythonPackage rec {
     futures
   ];
 
-  checkPhase = ''
-    pytest
-  '';
+  # aarch64-darwin forbids W+X memory, but this tests depends on it:
+  # * https://github.com/pyca/pyopenssl/issues/873
+  disabledTests = lib.optionals (stdenv.isDarwin && stdenv.isAarch64) [
+    "test_pyopenssl_end_to_end"
+  ];
 
   # Some of the tests use localhost networking.
   __darwinAllowLocalNetworking = true;
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/trytond/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/trytond/default.nix
index 20394fb2de..1be8fc18d2 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/trytond/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/trytond/default.nix
@@ -23,12 +23,12 @@
 
 buildPythonApplication rec {
   pname = "trytond";
-  version = "5.8.4";
+  version = "5.8.5";
   disabled = pythonOlder "3.5";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "28e467b51f6dc67b8b4ca60afec82614bba8cf78852c1941cc9071d615ba7972";
+    sha256 = "62753cebdae2d9e2d6bf8a5dde840ef77540414c4df76c8ed202c0c0d0bedb02";
   };
 
   # Tells the tests which database to use
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/tweepy/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/tweepy/default.nix
index 1c5535ec07..dd11e60aff 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/tweepy/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/tweepy/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "tweepy";
-  version = "3.9.0";
+  version = "3.10.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "bfd19a5c11f35f7f199c795f99d9cbf8a52eb33f0ecfb6c91ee10b601180f604";
+    sha256 = "76e6954b806ca470dda877f57db8792fff06a0beba0ed43efc3805771e39f06a";
   };
 
   doCheck = false;
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/twill/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/twill/default.nix
index e234084d31..36a7edcf7d 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/twill/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/twill/default.nix
@@ -5,11 +5,11 @@
 }:
 buildPythonPackage rec {
   pname = "twill";
-  version = "2.0.2";
+  version = "3.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "fc694ac1cb0616cfba2f9db4720e9d354bf656c318e21ef604a7e3caaef83d10";
+    sha256 = "01770eddb34f5fe6ee59992b84619968885d359ad3d6d9191e8ba8eec93482aa";
   };
 
   checkInputs = [ nose ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/twine/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/twine/default.nix
index 47f9fe1a03..9a246faff5 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/twine/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/twine/default.nix
@@ -14,16 +14,17 @@
 
 buildPythonPackage rec {
   pname = "twine";
-  version = "3.2.0";
+  version = "3.4.1";
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "34352fd52ec3b9d29837e6072d5a2a7c6fe4290e97bba46bb8d478b5c598f7ab";
+    sha256 = "a56c985264b991dc8a8f4234eb80c5af87fa8080d0c224ad8f2cd05a2c22e83b";
   };
 
   nativeBuildInputs = [ setuptools_scm ];
   propagatedBuildInputs = [
+    importlib-metadata
     keyring
     pkginfo
     pyblake2
@@ -33,7 +34,7 @@ buildPythonPackage rec {
     tqdm
     colorama
     rfc3986
-  ] ++ lib.optionals (pythonOlder "3.8") [ importlib-metadata ];
+  ];
 
   # Requires network
   doCheck = false;
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/txaio/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/txaio/default.nix
index 814b6234ee..c2f2c9451b 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/txaio/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/txaio/default.nix
@@ -2,12 +2,12 @@
 
 buildPythonPackage rec {
   pname = "txaio";
-  version = "20.4.1";
+  version = "21.2.1";
   disabled = isPy27;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "17938f2bca4a9cabce61346758e482ca4e600160cbc28e861493eac74a19539d";
+    sha256 = "7d6f89745680233f1c4db9ddb748df5e88d2a7a37962be174c0fd04c8dba1dc8";
   };
 
   checkInputs = [ pytest mock ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/typeguard/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/typeguard/default.nix
index 7aced09b33..2ee404cb18 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/typeguard/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/typeguard/default.nix
@@ -2,7 +2,7 @@
 , fetchPypi
 , pythonOlder
 , lib
-, setuptools_scm
+, setuptools-scm
 , pytest
 , typing-extensions
 , glibcLocales
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "typeguard";
-  version = "2.10.0";
+  version = "2.12.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "d830132dcd544d3f8a2a842ea739eaa0d7c099fcebb9dcdf3802f4c9929d8191";
+    sha256 = "sha256-/Kd/1My6Y0ZbQhzburWhqOOZTm1vGLRdortHXAnxR+8=";
   };
 
-  buildInputs = [ setuptools_scm ];
+  buildInputs = [ setuptools-scm ];
   nativeBuildInputs = [ glibcLocales ];
 
   LC_ALL="en_US.utf-8";
@@ -28,8 +28,9 @@ buildPythonPackage rec {
 
   checkInputs = [ pytest typing-extensions ];
 
+  # mypy tests aren't passing with latest mypy
   checkPhase = ''
-    py.test .
+    py.test . --ignore=tests/mypy
   '';
 
   disabled = pythonOlder "3.3";
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/typing/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/typing/default.nix
index 0d5c211992..823ee2af29 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/typing/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/typing/default.nix
@@ -1,4 +1,5 @@
-{ lib, buildPythonPackage, fetchPypi, pythonOlder, isPy3k, isPyPy, python }:
+{ lib, buildPythonPackage, fetchPypi, pythonOlder, isPy3k, isPyPy, python
+, pythonAtLeast }:
 
 let
   testDir = if isPy3k then "src" else "python2";
@@ -12,6 +13,8 @@ in buildPythonPackage rec {
     sha256 = "1187fb9c82fd670d10aa07bbb6cfcfe4bdda42d6fab8d5134f04e8c4d0b71cc9";
   };
 
+  disabled = pythonAtLeast "3.5";
+
   # Error for Python3.6: ImportError: cannot import name 'ann_module'
   # See https://github.com/python/typing/pull/280
   # Also, don't bother on PyPy: AssertionError: TypeError not raised
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/unidecode/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/unidecode/default.nix
index 65cb088238..3ff2e3b981 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/unidecode/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/unidecode/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "Unidecode";
-  version = "1.1.2";
+  version = "1.2.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "a039f89014245e0cad8858976293e23501accc9ff5a7bdbc739a14a2b7b85cdc";
+    sha256 = "8d73a97d387a956922344f6b74243c2c6771594659778744b2dbdaad8f6b727d";
   };
 
   LC_ALL="en_US.UTF-8";
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/uproot3-methods/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/uproot3-methods/default.nix
index 9fb9807d39..f5760b974f 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/uproot3-methods/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/uproot3-methods/default.nix
@@ -11,7 +11,7 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-3Wj5C+HqJ2NguWNpg2hJ3ykEX3/k5TT5rCHqAHmO41g=";
+    sha256 = "dd68f90be1ea276360b96369836849df29045f7fe4e534f9ac21ea00798ee358";
   };
 
   nativeBuildInputs = [ awkward0 ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/uproot3/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/uproot3/default.nix
index c692377342..e5b3903eef 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/uproot3/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/uproot3/default.nix
@@ -1,5 +1,5 @@
 { lib, fetchFromGitHub, buildPythonPackage, isPy27
-, awkward0, backports_lzma, cachetools, lz4, pandas
+, awkward0, backports_lzma ? null, cachetools, lz4, pandas
 , pytestCheckHook, pkgconfig, mock
 , numpy, requests, uproot3-methods, xxhash, zstandard
 }:
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/uranium/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/uranium/default.nix
index 0c068428f6..db8c8c8bd2 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/uranium/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/uranium/default.nix
@@ -2,7 +2,7 @@
 , pyqt5, numpy, scipy, shapely, libarcus, cryptography, doxygen, gettext, pythonOlder }:
 
 buildPythonPackage rec {
-  version = "4.7.1";
+  version = "4.9.0";
   pname = "uranium";
   format = "other";
 
@@ -10,7 +10,7 @@ buildPythonPackage rec {
     owner = "Ultimaker";
     repo = "Uranium";
     rev = version;
-    sha256 = "1h5d3scy3cnbyhh0pbavflpqklhn2lbp7hl193rc5gx8yzr3mqbh";
+    sha256 = "0bqrc4g4pd7b209swlv06bm5sx7df96h9kjpqpra4mfz469km4nn";
   };
 
   disabled = pythonOlder "3.5.0";
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/uritools/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/uritools/default.nix
index 2f4710eea4..d90bf39f33 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/uritools/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/uritools/default.nix
@@ -2,12 +2,12 @@
 
 buildPythonPackage rec {
   pname = "uritools";
-  version = "3.0.0";
+  version = "3.0.1";
   disabled = isPy27;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "405917a31ce58a57c8ccd0e4ea290f38baf2f4823819c3688f5331f1aee4ccb0";
+    sha256 = "a3e9c794d44fdbd54642dcb7d6ef3ba9866d953eb34f65aeca3754b7ad5c1ea0";
   };
 
   meta = with lib; {
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/variants/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/variants/default.nix
index 11c5064670..3a45230720 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/variants/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/variants/default.nix
@@ -3,7 +3,7 @@
 , fetchPypi
 , pytestrunner
 , setuptools_scm
-, singledispatch
+, singledispatch ? null
 , pytest
 , lib
 }:
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/virtual-display/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/virtual-display/default.nix
index 7559ae1ccc..bf47297b1c 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/virtual-display/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/virtual-display/default.nix
@@ -2,13 +2,13 @@
 
 buildPythonPackage rec {
   pname = "PyVirtualDisplay";
-  version = "2.0";
+  version = "2.1";
 
   propagatedBuildInputs = [ EasyProcess ];
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "3cdacd70970a74d163a2417d8581f43a56bb1ac8d31c71a1a6a4348969062d65";
+    sha256 = "9d4c6957ec2c4753b5293fb6a60a90d7c27fc01bc5de9b5aa863f7c1e3fb4efc";
   };
 
   # requires X server
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/virtualenv/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/virtualenv/default.nix
index ec22660830..bcd6726015 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/virtualenv/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/virtualenv/default.nix
@@ -23,11 +23,11 @@
 
 buildPythonPackage rec {
   pname = "virtualenv";
-  version = "20.2.2";
+  version = "20.4.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "b7a8ec323ee02fb2312f098b6b4c9de99559b462775bc8fe3627a73706603c1b";
+    sha256 = "49ec4eb4c224c6f7dd81bb6d0a28a09ecae5894f4e593c89b0db0885f565a107";
   };
 
   nativeBuildInputs = [
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/waitress/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/waitress/default.nix
index 4edd4c6ccf..aa09b0068d 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/waitress/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/waitress/default.nix
@@ -5,11 +5,11 @@
 
 buildPythonPackage rec {
   pname = "waitress";
-  version = "1.4.4";
+  version = "2.0.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1bb436508a7487ac6cb097ae7a7fe5413aefca610550baf58f0940e51ecfb261";
+    sha256 = "69e1f242c7f80273490d3403c3976f3ac3b26e289856936d1f620ed48f321897";
   };
 
   doCheck = false;
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/wcmatch/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/wcmatch/default.nix
index ade529e562..bda48d3ec5 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/wcmatch/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/wcmatch/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "wcmatch";
-  version = "8.1.1";
+  version = "8.1.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-e6CRkflYLoLYZIKb37qwLfRuJqRqME5Xx/5WUvB/KXo=";
+    sha256 = "efda751de15201b395b6d6e64e6ae3b6b03dc502a64c3c908aa5cad14c27eee5";
   };
 
   propagatedBuildInputs = [ bracex ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/weboob/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/weboob/default.nix
index 861cb38389..3ce15a3fdc 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/weboob/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/weboob/default.nix
@@ -3,7 +3,7 @@
 , cssselect
 , dateutil
 , feedparser
-, futures
+, futures ? null
 , gdata
 , gnupg
 , google-api-python-client
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/woob/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/woob/default.nix
index 15f2faa200..4794843a66 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/woob/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/woob/default.nix
@@ -7,7 +7,6 @@
 , cssselect
 , dateutil
 , feedparser
-, futures
 , gdata
 , gnupg
 , google-api-python-client
@@ -30,6 +29,7 @@
 buildPythonPackage rec {
   pname = "woob";
   version = "3.0";
+  disabled = isPy27;
 
   src = fetchPypi {
     inherit pname version;
@@ -67,7 +67,7 @@ buildPythonPackage rec {
     simplejson
     termcolor
     unidecode
-  ] ++ lib.optionals isPy27 [ futures ];
+  ];
 
   checkPhase = ''
     nosetests
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/xarray/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/xarray/default.nix
index 42402c259a..e69e144ccf 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/xarray/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/xarray/default.nix
@@ -11,12 +11,12 @@
 
 buildPythonPackage rec {
   pname = "xarray";
-  version = "0.16.2";
+  version = "0.17.0";
   disabled = !isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-OOhDnWyRvNW3wPyjSdr44GQ6xohQyYcmLVNSbp19AeQ=";
+    sha256 = "9c2edad2a4e588f9117c666a4249920b9717fb75703b96998cf65fcd4f60551f";
   };
 
   nativeBuildInputs = [ setuptools-scm ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/xdis/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/xdis/default.nix
index 3da2574359..59cad86606 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/xdis/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/xdis/default.nix
@@ -6,14 +6,14 @@
 
 buildPythonPackage rec {
   pname = "xdis";
-  version = "5.0.8";
+  version = "5.0.9";
   disabled = isPy27;
 
   src = fetchFromGitHub {
     owner = "rocky";
     repo = "python-xdis";
     rev = version;
-    sha256 = "01g1bk7rscwmvr2i183z0y2bs1iw7bxk7c5rcf9gf25242nppv6a";
+    sha256 = "sha256-joKPTEq0UabXMyld0DHrhC1D/Om2B5st0qa2F9r0muA=";
   };
 
   checkInputs = [ pytest ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/xlrd/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/xlrd/default.nix
index d880fd8339..bc88880f30 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/xlrd/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/xlrd/default.nix
@@ -1,23 +1,24 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, pytest
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "xlrd";
-  version = "1.2.0";
+  version = "2.0.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "546eb36cee8db40c3eaa46c351e67ffee6eeb5fa2650b71bc4c758a29a1b29b2";
+    sha256 = "f72f148f54442c6b056bf931dbc34f986fd0c3b0b6b5a58d013c9aef274d0c88";
   };
 
-  checkInputs = [ pytest ];
+  checkInputs = [
+    pytestCheckHook
+  ];
 
-  checkPhase = ''
-    py.test -k "not test_tilde_path_expansion"
-  '';
+  # No tests in archive
+  doCheck = false;
 
   meta = with lib; {
     homepage = "http://www.python-excel.org/";
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/xml2rfc/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/xml2rfc/default.nix
index fdf042c2ac..5b50716f2f 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/xml2rfc/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/xml2rfc/default.nix
@@ -4,12 +4,12 @@
 
 buildPythonPackage rec {
   pname = "xml2rfc";
-  version = "3.5.0";
+  version = "3.6.0";
   disabled = pythonAtLeast "3.9";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "3ec836a9545f549707a8c8176038160185b9d08c1dd80304a906527da21bff68";
+    sha256 = "a9aa2e7c156a1acb0931086637d31efe9302a771641bc35938383cefbd27ba9d";
   };
 
   propagatedBuildInputs = [
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/xmlschema/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/xmlschema/default.nix
index e31054e74c..58d50d7b6c 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/xmlschema/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/xmlschema/default.nix
@@ -5,14 +5,14 @@
 }:
 
 buildPythonPackage rec {
-  version = "1.4.1";
+  version = "1.5.3";
   pname = "xmlschema";
 
   src = fetchFromGitHub {
     owner = "sissaschool";
     repo = "xmlschema";
     rev = "v${version}";
-    sha256 = "1yd7whf74z8bw99gldxlnrs8bjnjzald29b5cf2ka0i144sxbvad";
+    sha256 = "0pv8zdz03wjnjwrgjr5pc3q69h7zh51h0iwgwxwl65qi1r6ydk54";
   };
 
   propagatedBuildInputs = [ elementpath ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/yamlloader/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/yamlloader/default.nix
index c8b2d5949c..d2b66cb073 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/yamlloader/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/yamlloader/default.nix
@@ -1,14 +1,14 @@
 { lib, buildPythonPackage, fetchPypi
-, pytest, pyyaml
+, pytest, pyyaml, hypothesis
 }:
 
 buildPythonPackage rec {
   pname = "yamlloader";
-  version = "0.5.5";
+  version = "1.0.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "3KtfFrObsD0Q3aTNTzDJQ2dexMd3GAf8Z+fxuzGb9Mg=";
+    sha256 = "e96dc3dc6895d814c330c054c966d993fc81ef1dbf5a30a4bdafeb256359e058";
   };
 
   propagatedBuildInputs = [
@@ -16,6 +16,7 @@ buildPythonPackage rec {
   ];
 
   checkInputs = [
+    hypothesis
     pytest
   ];
 
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/yfinance/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/yfinance/default.nix
index 7ae56cacbb..bceac92d79 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/yfinance/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/yfinance/default.nix
@@ -9,12 +9,12 @@
 
 buildPythonPackage rec {
   pname = "yfinance";
-  version = "0.1.55";
+  version = "0.1.56";
 
   # GitHub source releases aren't tagged
   src = fetchPypi {
     inherit pname version;
-    sha256 = "65d39bccf16bef35f6a08bf0df33650c0515b5ce8ea3c53924601f5fe00590cb";
+    sha256 = "a6d4c7b939fdd48d983556501f5b387e20aaef86afc8e6ba6f91a49a7e22d2dd";
   };
 
   propagatedBuildInputs = [
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/zipp/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/zipp/default.nix
index 1dafe8cbb0..ccb916a147 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/zipp/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/zipp/default.nix
@@ -10,11 +10,11 @@
 
 buildPythonPackage rec {
   pname = "zipp";
-  version = "3.4.0";
+  version = "3.4.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "ed5eee1974372595f9e416cc7bbeeb12335201d8081ca8a0743c954d4446e5cb";
+    sha256 = "3607921face881ba3e026887d8150cca609d517579abe052ac81fc5aeffdbd76";
   };
 
   nativeBuildInputs = [ setuptools_scm toml ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/zope_component/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/zope_component/default.nix
index 65556c9dc4..41c15fcd13 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/zope_component/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/zope_component/default.nix
@@ -12,11 +12,11 @@
 
 buildPythonPackage rec {
   pname = "zope.component";
-  version = "4.6.2";
+  version = "5.0.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "91628918218b3e6f6323de2a7b845e09ddc5cae131c034896c051b084bba3c92";
+    sha256 = "df541a0501c79123f9ac30c6686a9e45c2690c5c3ae4f2b7f4c6fd1a3aaaf614";
   };
 
   propagatedBuildInputs = [
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/zope_interface/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/zope_interface/default.nix
index 7b5d7abf68..15a179c0d6 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/zope_interface/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/zope_interface/default.nix
@@ -6,11 +6,11 @@
 
 buildPythonPackage rec {
   pname = "zope.interface";
-  version = "5.2.0";
+  version = "5.3.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "8251f06a77985a2729a8bdbefbae79ee78567dddc3acbd499b87e705ca59fe24";
+    sha256 = "b18a855f8504743e0a2d8b75d008c7720d44e4c76687e13f959e35d9a13eb397";
   };
 
   propagatedBuildInputs = [ zope_event ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/zope_schema/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/zope_schema/default.nix
index 43fab18dae..00defd1615 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/zope_schema/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/zope_schema/default.nix
@@ -9,11 +9,11 @@
 
 buildPythonPackage rec {
   pname = "zope.schema";
-  version = "6.0.1";
+  version = "6.1.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "9b3fc3ac656099aa9ebf3beb2bbd83d2d6ee6f94b9ac6969d6e3993ec9c4a197";
+    sha256 = "9fa04d95e8e7e9056091eed9819da6e65dde68de39c2b93617d361d1eb8a7c0c";
   };
 
   propagatedBuildInputs = [ zope_location zope_event zope_interface zope_testing ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/zope_testing/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/zope_testing/default.nix
index 2f37f15453..ea2d531f76 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/zope_testing/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/zope_testing/default.nix
@@ -9,11 +9,11 @@
 
 buildPythonPackage rec {
   pname = "zope.testing";
-  version = "4.7";
+  version = "4.9";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "d66be8d1de37e8536ca58a1d9f4d89a68c9cc75cc0e788a175c8a20ae26003ea";
+    sha256 = "475cb847a7af9d547313ee93f5d0b8800bf627e6d0d9a51d11967984083cb54e";
   };
 
   doCheck = !isPyPy;
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/zope_testrunner/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/zope_testrunner/default.nix
index 5ee42c8427..c3bc0d0bff 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/zope_testrunner/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/zope_testrunner/default.nix
@@ -10,11 +10,11 @@
 
 buildPythonPackage rec {
   pname = "zope.testrunner";
-  version = "5.2";
+  version = "5.3.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "873d6017abadc213992a0c38c786ed020341b6e0fe78d14bc2a684cf5a70de4b";
+    sha256 = "39a5ba631830703ea011383447135063db6d182794487dda9b8c1f515bb70b0f";
   };
 
   propagatedBuildInputs = [ zope_interface zope_exceptions zope_testing six ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/zstandard/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/zstandard/default.nix
index fc5f8c3161..724a5d9d67 100755
--- a/third_party/nixpkgs/pkgs/development/python-modules/zstandard/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/zstandard/default.nix
@@ -7,11 +7,11 @@
 
 buildPythonPackage rec {
   pname = "zstandard";
-  version = "0.15.1";
+  version = "0.15.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "cb7c6a6f7d62350b9f5539045da54422975630e34dd9069584cc776b9917115f";
+    sha256 = "52de08355fd5cfb3ef4533891092bb96229d43c2069703d4aff04fdbedf9c92f";
   };
 
   propagatedBuildInputs = [ cffi ];
diff --git a/third_party/nixpkgs/pkgs/development/ruby-modules/gem/default.nix b/third_party/nixpkgs/pkgs/development/ruby-modules/gem/default.nix
index 2066798854..c8dba51420 100644
--- a/third_party/nixpkgs/pkgs/development/ruby-modules/gem/default.nix
+++ b/third_party/nixpkgs/pkgs/development/ruby-modules/gem/default.nix
@@ -217,8 +217,8 @@ stdenv.mkDerivation ((builtins.removeAttrs attrs ["source"]) // {
 
     # looks like useless files which break build repeatability and consume space
     pushd $out/${ruby.gemPath}
-    rm -fv doc/*/*/created.rid || true
-    rm -fv {gems/*/ext/*,extensions/*/*/*}/{Makefile,mkmf.log,gem_make.out} || true
+    find doc/ -iname created.rid -delete -print
+    find gems/*/ext/ extensions/ \( -iname Makefile -o -iname mkmf.log -o -iname gem_make.out \) -delete -print
     ${if keepGemCache then "" else "rm -fvr cache"}
     popd
 
diff --git a/third_party/nixpkgs/pkgs/development/tools/air/default.nix b/third_party/nixpkgs/pkgs/development/tools/air/default.nix
index c058a3fec2..28cb6bf7a4 100644
--- a/third_party/nixpkgs/pkgs/development/tools/air/default.nix
+++ b/third_party/nixpkgs/pkgs/development/tools/air/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "air";
-  version = "1.25";
+  version = "1.27.2";
 
   src = fetchFromGitHub {
     owner = "cosmtrek";
     repo = "air";
     rev = "v${version}";
-    sha256 = "sha256-on9Rb+QGFWx7/k9xD+tcaPu6YNaBBkFBHHMSWJbZpWM=";
+    sha256 = "sha256-VQymiDge42JBQwAHfHMF8imBC90uPout0fZRuQVOP5w=";
   };
 
   vendorSha256 = "sha256-B7AgUFjiW3P1dU88u3kswbCQJ7Qq7rgPlX+b+3Pq1L4=";
diff --git a/third_party/nixpkgs/pkgs/development/tools/analysis/codeql/default.nix b/third_party/nixpkgs/pkgs/development/tools/analysis/codeql/default.nix
index f62b1a2480..abcd947fa3 100644
--- a/third_party/nixpkgs/pkgs/development/tools/analysis/codeql/default.nix
+++ b/third_party/nixpkgs/pkgs/development/tools/analysis/codeql/default.nix
@@ -12,7 +12,7 @@
 
 stdenv.mkDerivation rec {
   pname = "codeql";
-  version = "2.5.0";
+  version = "2.5.2";
 
   dontConfigure = true;
   dontBuild = true;
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
 
   src = fetchzip {
     url = "https://github.com/github/codeql-cli-binaries/releases/download/v${version}/codeql.zip";
-    sha256 = "sha256-teZ/9+oAEqGmy2S8Q89YDe8lqvAjzV6RWJ5AnfgQ6Mc=";
+    sha256 = "sha256-/Pl9qDzFSL67lBEyHPqy3QfNCXzR510SgM0U8f55Dqg=";
   };
 
   nativeBuildInputs = [
diff --git a/third_party/nixpkgs/pkgs/development/tools/analysis/tflint/default.nix b/third_party/nixpkgs/pkgs/development/tools/analysis/tflint/default.nix
index d52ac500e8..9f4efe396c 100644
--- a/third_party/nixpkgs/pkgs/development/tools/analysis/tflint/default.nix
+++ b/third_party/nixpkgs/pkgs/development/tools/analysis/tflint/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "tflint";
-  version = "0.27.0";
+  version = "0.28.0";
 
   src = fetchFromGitHub {
     owner = "terraform-linters";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1s49a3yihfkd8ib336a29ch53mpcyxzicglss7bqmqapv6zi37dg";
+    sha256 = "1d746016iyswb9kw7gprg32vj5rcfa2y9j11r2hsp61hsjfvmg8c";
   };
 
-  vendorSha256 = "1w72n1sprwylaj96aj03h4qq43525q15iwb6vf23gf6913zhvqy3";
+  vendorSha256 = "0whd0b9rll0s42hrr2fqp412d5frzmrnqnynpq75wda5rqzmaf8r";
 
   doCheck = false;
 
diff --git a/third_party/nixpkgs/pkgs/development/tools/bazelisk/default.nix b/third_party/nixpkgs/pkgs/development/tools/bazelisk/default.nix
index f9b4c3ea72..ab73b8cd8f 100644
--- a/third_party/nixpkgs/pkgs/development/tools/bazelisk/default.nix
+++ b/third_party/nixpkgs/pkgs/development/tools/bazelisk/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "bazelisk";
-  version = "1.7.5";
+  version = "1.8.0";
 
   src = fetchFromGitHub {
     owner = "bazelbuild";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-jXRTj/7GJO6rSueOmw8aNg69w43lxiDbSeZR802+kws=";
+    sha256 = "sha256-bD04wqmtBgdNlPGXz7/4kYQ97r9EthFfGExxOjt8u7k=";
   };
 
-  vendorSha256 = "sha256-fW7KHsxhBfz947Tg+O5bdtiH6xMeKmLRHX9FWQSyxVQ=";
+  vendorSha256 = "sha256-IkW13y51NhKflAeHLu8k7DxRqYVnfMHSnfFuT6H/flo=";
 
   doCheck = false;
 
diff --git a/third_party/nixpkgs/pkgs/development/tools/build-managers/sbt/default.nix b/third_party/nixpkgs/pkgs/development/tools/build-managers/sbt/default.nix
index 00e70c46b2..7b9c6bca7e 100644
--- a/third_party/nixpkgs/pkgs/development/tools/build-managers/sbt/default.nix
+++ b/third_party/nixpkgs/pkgs/development/tools/build-managers/sbt/default.nix
@@ -8,11 +8,11 @@
 
 stdenv.mkDerivation rec {
   pname = "sbt";
-  version = "1.5.0";
+  version = "1.5.1";
 
   src = fetchurl {
     url = "https://github.com/sbt/sbt/releases/download/v${version}/sbt-${version}.tgz";
-    sha256 = "1dj241cj3v8kzqnz5s499rijpl7wv4rw171swqnc0xza90513pxa";
+    sha256 = "0dsbqipr549awv584fyl227s1gknlpsf5krp990w7w3bbxl3avb7";
   };
 
   postPatch = ''
diff --git a/third_party/nixpkgs/pkgs/development/tools/documentation/gi-docgen/default.nix b/third_party/nixpkgs/pkgs/development/tools/documentation/gi-docgen/default.nix
index 72b5364eb4..06de11fde5 100644
--- a/third_party/nixpkgs/pkgs/development/tools/documentation/gi-docgen/default.nix
+++ b/third_party/nixpkgs/pkgs/development/tools/documentation/gi-docgen/default.nix
@@ -61,6 +61,13 @@ python3.pkgs.buildPythonApplication rec {
       url = "https://gitlab.gnome.org/jtojnar/gi-docgen/commit/08dcc31f62be1a5af9bd9f8f702f321f4b5cffde.patch";
       sha256 = "vAT8s7zQ9zCoZWK+6PsxcD5/48ZAfIOl4RSNljRCGWQ=";
     })
+    # make DevHelp sections & index.json have stable ordering
+    # already merged upstream, so patch can removed when we update
+    # beyond 2021.2
+    (fetchpatch {
+      url = "https://gitlab.gnome.org/GNOME/gi-docgen/-/commit/cc21241d4386d4f78dbcb087fd9a92899935cb5c.patch";
+      sha256 = "0wna8mzrlbsv7f3bc7ndqll9l105kp8kdmhbbjhbdhzzzyvh6vcw";
+    })
   ];
 
   nativeBuildInputs = [
diff --git a/third_party/nixpkgs/pkgs/development/tools/esbuild/default.nix b/third_party/nixpkgs/pkgs/development/tools/esbuild/default.nix
index 33c47c7aed..47f8b217bc 100644
--- a/third_party/nixpkgs/pkgs/development/tools/esbuild/default.nix
+++ b/third_party/nixpkgs/pkgs/development/tools/esbuild/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "esbuild";
-  version = "0.11.13";
+  version = "0.11.14";
 
   src = fetchFromGitHub {
     owner = "evanw";
     repo = "esbuild";
     rev = "v${version}";
-    sha256 = "0v358n2vpa1l1a699zyq43yzb3lcxjp3k4acppx0ggva05qn9zd1";
+    sha256 = "0qxylzc7lzpsp5hm3dl5jvy9aca8azn8dmbjz9z5n5rkdmm8vd9p";
   };
 
   vendorSha256 = "1n5538yik72x94vzfq31qaqrkpxds5xys1wlibw2gn2am0z5c06q";
diff --git a/third_party/nixpkgs/pkgs/development/tools/go-task/default.nix b/third_party/nixpkgs/pkgs/development/tools/go-task/default.nix
index 2e8988ec78..e97819c434 100644
--- a/third_party/nixpkgs/pkgs/development/tools/go-task/default.nix
+++ b/third_party/nixpkgs/pkgs/development/tools/go-task/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "go-task";
-  version = "3.4.1";
+  version = "3.4.2";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = "task";
     rev = "v${version}";
-    sha256 = "sha256-r0AHGgv2huMaZfsbK7o4KKJirNeOff1M3jgG8ZUJoiA=";
+    sha256 = "sha256-632ISkBIZJBJpybuiuRHOV3CAJg1rSe3hK+W7hmW2cM=";
   };
 
   vendorSha256 = "sha256-qKjCGZnCts4GfBafSRXR7xTvfJdqK8zjpu01eiyITkU=";
diff --git a/third_party/nixpkgs/pkgs/development/tools/lazygit/default.nix b/third_party/nixpkgs/pkgs/development/tools/lazygit/default.nix
index cd0fb4a333..7038b7c1eb 100644
--- a/third_party/nixpkgs/pkgs/development/tools/lazygit/default.nix
+++ b/third_party/nixpkgs/pkgs/development/tools/lazygit/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "lazygit";
-  version = "0.27.3";
+  version = "0.28.1";
 
   src = fetchFromGitHub {
     owner = "jesseduffield";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-giHAeD7hhda9YV+NQuZ6w0eow79egGhUCIX0dPvhrWk=";
+    sha256 = "sha256-tan8ksSyMIeDL7oRAWd3Qtz/sKbhAAfY7IknfwjyvgQ=";
   };
 
   vendorSha256 = null;
diff --git a/third_party/nixpkgs/pkgs/development/tools/misc/binutils/default.nix b/third_party/nixpkgs/pkgs/development/tools/misc/binutils/default.nix
index 37ba3420b1..995f3f7430 100644
--- a/third_party/nixpkgs/pkgs/development/tools/misc/binutils/default.nix
+++ b/third_party/nixpkgs/pkgs/development/tools/misc/binutils/default.nix
@@ -143,6 +143,7 @@ stdenv.mkDerivation {
 
   passthru = {
     inherit targetPrefix;
+    isGNU = true;
   };
 
   meta = with lib; {
diff --git a/third_party/nixpkgs/pkgs/development/tools/misc/clojure-lsp/default.nix b/third_party/nixpkgs/pkgs/development/tools/misc/clojure-lsp/default.nix
index c0d4567fe0..dc342e501e 100644
--- a/third_party/nixpkgs/pkgs/development/tools/misc/clojure-lsp/default.nix
+++ b/third_party/nixpkgs/pkgs/development/tools/misc/clojure-lsp/default.nix
@@ -1,39 +1,29 @@
-{ lib, stdenv, callPackage, fetchFromGitHub, leiningen, openjdk11
-, graalvm11-ce, babashka }:
+{ lib, stdenv, graalvm11-ce, babashka, fetchurl, fetchFromGitHub }:
 
-let
+stdenv.mkDerivation rec {
   pname = "clojure-lsp";
-  version = "2021.02.14-19.46.47";
-  leiningen11 = leiningen.override ({ jdk = openjdk11; });
+  version = "2021.04.13-12.47.33";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = version;
-    sha256 = "sha256-Zj7/8RcuxCy2xdd+5jeOb1GTsQsX0EVW32k32fA6uf4=";
+    sha256 = "1la0d28pvp1fqnxp3scb2vawcblilwyx42djxn379vag403p1i2d";
   };
 
-  repository = callPackage ./repository.nix {
-    inherit src pname version;
-    leiningen = leiningen11;
+  jar = fetchurl {
+    url = "https://github.com/clojure-lsp/clojure-lsp/releases/download/${version}/clojure-lsp.jar";
+    sha256 = "059gz7y2rzwdxpyqy80w4lghzgxi5lb4rxmks1721yq6k7ljjyqy";
   };
-in stdenv.mkDerivation rec {
-  inherit src pname version;
-
-  postPatch = ''
-    # Hack to set maven cache in another directory since MAVEN_OPTS doesn't work
-    substituteInPlace project.clj \
-      --replace ":main" ":local-repo \"${repository}\" :main"
-  '';
 
   GRAALVM_HOME = graalvm11-ce;
+  CLOJURE_LSP_JAR = jar;
 
-  buildInputs = [ graalvm11-ce leiningen11 repository ];
+  buildInputs = [ graalvm11-ce ];
 
   buildPhase = with lib; ''
     runHook preBuild
 
-    export LEIN_HOME="$(mktemp -d)"
     bash ./graalvm/native-unix-compile.sh
 
     runHook postBuild
@@ -51,14 +41,14 @@ in stdenv.mkDerivation rec {
   checkPhase = ''
     runHook preCheck
 
-    ${babashka}/bin/bb ./integration-test/run-all.clj ./clojure-lsp
+    ${babashka}/bin/bb integration-test/run-all.clj ./clojure-lsp
 
     runHook postCheck
   '';
 
   meta = with lib; {
     description = "Language Server Protocol (LSP) for Clojure";
-    homepage = "https://github.com/snoe/clojure-lsp";
+    homepage = "https://github.com/clojure-lsp/clojure-lsp";
     license = licenses.mit;
     maintainers = [ maintainers.ericdallo ];
     platforms = graalvm11-ce.meta.platforms;
diff --git a/third_party/nixpkgs/pkgs/development/tools/misc/clojure-lsp/repository.nix b/third_party/nixpkgs/pkgs/development/tools/misc/clojure-lsp/repository.nix
deleted file mode 100644
index 122096e965..0000000000
--- a/third_party/nixpkgs/pkgs/development/tools/misc/clojure-lsp/repository.nix
+++ /dev/null
@@ -1,40 +0,0 @@
-{ lib, stdenv, src, pname, version, leiningen }:
-
-stdenv.mkDerivation {
-  inherit src;
-
-  name = "${pname}-${version}-repository";
-  buildInputs = [ leiningen ];
-
-  postPatch = ''
-    # Hack to set maven cache in another directory since MAVEN_OPTS doesn't work
-    substituteInPlace project.clj \
-      --replace ":main" ":local-repo \"$out\" :main"
-  '';
-
-  buildPhase = ''
-    runHook preBuild
-
-    export LEIN_HOME="$(mktemp -d)"
-    lein with-profiles +native-image deps
-
-    runHook postBuild
-  '';
-
-  installPhase = ''
-    runHook preInstall
-
-    find $out -type f \
-      -name \*.lastUpdated -or \
-      -name resolver-status.properties -or \
-      -name _remote.repositories \
-      -delete
-
-    runHook postInstall
-  '';
-
-  dontFixup = true;
-  outputHashAlgo = "sha256";
-  outputHashMode = "recursive";
-  outputHash = "sha256-aWZPsJF32ENyYNZCHf5amxVF9pb+5M73JqG/OITZlak=";
-}
diff --git a/third_party/nixpkgs/pkgs/development/tools/misc/luarocks/darwin-3.1.3.patch b/third_party/nixpkgs/pkgs/development/tools/misc/luarocks/darwin-3.1.3.patch
index 4ba883f011..8070af173a 100644
--- a/third_party/nixpkgs/pkgs/development/tools/misc/luarocks/darwin-3.1.3.patch
+++ b/third_party/nixpkgs/pkgs/development/tools/misc/luarocks/darwin-3.1.3.patch
@@ -7,7 +7,7 @@ index c5af5a2..1949fdc 100644
        defaults.arch = "macosx-"..target_cpu
        defaults.variables.LIBFLAG = "-bundle -undefined dynamic_lookup -all_load"
 -      local version = util.popen_read("sw_vers -productVersion")
-+      local version = os.getenv("MACOSX_DEPLOYMENT_TARGET") or "10.12"
++      local version = os.getenv("MACOSX_DEPLOYMENT_TARGET") or "@darwinMinVersion@"
        version = tonumber(version and version:match("^[^.]+%.([^.]+)")) or 3
        if version >= 10 then
           version = 8
diff --git a/third_party/nixpkgs/pkgs/development/tools/misc/luarocks/default.nix b/third_party/nixpkgs/pkgs/development/tools/misc/luarocks/default.nix
index 77f34cca7d..d4f2ec4ded 100644
--- a/third_party/nixpkgs/pkgs/development/tools/misc/luarocks/default.nix
+++ b/third_party/nixpkgs/pkgs/development/tools/misc/luarocks/default.nix
@@ -19,6 +19,11 @@ stdenv.mkDerivation rec {
   };
 
   patches = [ ./darwin-3.1.3.patch ];
+
+  postPatch = lib.optionalString stdenv.targetPlatform.isDarwin ''
+    substituteInPlace src/luarocks/core/cfg.lua --subst-var-by 'darwinMinVersion' '${stdenv.targetPlatform.darwinMinVersion}'
+  '';
+
   preConfigure = ''
     lua -e "" || {
         luajit -e "" && {
diff --git a/third_party/nixpkgs/pkgs/development/tools/misc/stlink/default.nix b/third_party/nixpkgs/pkgs/development/tools/misc/stlink/default.nix
index e67fd9ca7a..5bad6493c4 100644
--- a/third_party/nixpkgs/pkgs/development/tools/misc/stlink/default.nix
+++ b/third_party/nixpkgs/pkgs/development/tools/misc/stlink/default.nix
@@ -9,25 +9,22 @@ let
 
 in stdenv.mkDerivation rec {
   pname = "stlink";
-  version = "1.6.0";
+  version = "1.7.0";
 
   src = fetchFromGitHub {
-    owner = "texane";
+    owner = "stlink-org";
     repo = "stlink";
     rev = "v${version}";
-    sha256 = "1mlkrxjxg538335g59hjb0zc739dx4mhbspb26z5gz3lf7d4xv6x";
+    sha256 = "03xypffpbp4imrczbxmq69vgkr7mbp0ps9dk815br5wwlz6vgygl";
   };
 
   buildInputs = [ libusb1' ];
   nativeBuildInputs = [ cmake ];
-  patchPhase = ''
-    sed -i 's@/etc/udev/rules.d@$ENV{out}/etc/udev/rules.d@' CMakeLists.txt
-    sed -i 's@/etc/modprobe.d@$ENV{out}/etc/modprobe.d@' CMakeLists.txt
-  '';
-  preInstall = ''
-    mkdir -p $out/etc/udev/rules.d
-    mkdir -p $out/etc/modprobe.d
-  '';
+
+  cmakeFlags = [
+    "-DSTLINK_MODPROBED_DIR=${placeholder "out"}/etc/modprobe.d"
+    "-DSTLINK_UDEV_RULES_DIR=${placeholder "out"}/lib/udev/rules.d"
+  ];
 
   meta = with lib; {
     description = "In-circuit debug and programming for ST-Link devices";
diff --git a/third_party/nixpkgs/pkgs/development/tools/protoc-gen-go-grpc/default.nix b/third_party/nixpkgs/pkgs/development/tools/protoc-gen-go-grpc/default.nix
new file mode 100644
index 0000000000..40aa45a300
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/development/tools/protoc-gen-go-grpc/default.nix
@@ -0,0 +1,29 @@
+{ buildGoPackage
+, fetchFromGitHub
+, lib
+}:
+
+buildGoPackage rec {
+  pname = "protoc-gen-go-grpc";
+  version = "1.1.0";
+
+  goPackagePath = "google.golang.org/grpc";
+
+  src = fetchFromGitHub {
+    owner = "grpc";
+    repo = "grpc-go";
+    rev = "cmd/protoc-gen-go-grpc/v${version}";
+    sha256 = "14rjb8j6fm07rnns3dpwgkzf3y6rmia6i9n7ns6cldc5mbf7nwi3";
+  };
+
+  subPackages = [ "cmd/protoc-gen-go-grpc" ];
+
+  goDeps = ./deps.nix;
+
+  meta = with lib; {
+    description = "The Go language implementation of gRPC. HTTP/2 based RPC";
+    license = licenses.asl20;
+    maintainers = [ maintainers.raboof ];
+    platforms = platforms.all;
+  };
+}
diff --git a/third_party/nixpkgs/pkgs/development/tools/protoc-gen-go-grpc/deps.nix b/third_party/nixpkgs/pkgs/development/tools/protoc-gen-go-grpc/deps.nix
new file mode 100644
index 0000000000..d559989244
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/development/tools/protoc-gen-go-grpc/deps.nix
@@ -0,0 +1,333 @@
+# file generated from go.mod using vgo2nix (https://github.com/nix-community/vgo2nix)
+[
+  {
+    goPackagePath = "cloud.google.com/go";
+    fetch = {
+      type = "git";
+      url = "https://github.com/googleapis/google-cloud-go";
+      rev = "v0.26.0";
+      sha256 = "149v3ci17g6wd2pm18mzcncq5qpl9hwdjnz3rlbn5rfidyn46la1";
+      moduleDir = "";
+    };
+  }
+  {
+    goPackagePath = "github.com/BurntSushi/toml";
+    fetch = {
+      type = "git";
+      url = "https://github.com/BurntSushi/toml";
+      rev = "v0.3.1";
+      sha256 = "1fjdwwfzyzllgiwydknf1pwjvy49qxfsczqx5gz3y0izs7as99j6";
+      moduleDir = "";
+    };
+  }
+  {
+    goPackagePath = "github.com/census-instrumentation/opencensus-proto";
+    fetch = {
+      type = "git";
+      url = "https://github.com/census-instrumentation/opencensus-proto";
+      rev = "v0.2.1";
+      sha256 = "19fcx3sc99i5dsklny6r073z5j20vlwn2xqm6di1q3b1xwchzqfj";
+      moduleDir = "";
+    };
+  }
+  {
+    goPackagePath = "github.com/client9/misspell";
+    fetch = {
+      type = "git";
+      url = "https://github.com/client9/misspell";
+      rev = "v0.3.4";
+      sha256 = "1vwf33wsc4la25zk9nylpbp9px3svlmldkm0bha4hp56jws4q9cs";
+      moduleDir = "";
+    };
+  }
+  {
+    goPackagePath = "github.com/cncf/udpa/go";
+    fetch = {
+      type = "git";
+      url = "https://github.com/cncf/udpa";
+      rev = "5459f2c99403";
+      sha256 = "0i3al193dsp91j7iywqrm6fr56y2sz51ci4vf19mb3j4n2x44gsi";
+      moduleDir = "go";
+    };
+  }
+  {
+    goPackagePath = "github.com/davecgh/go-spew";
+    fetch = {
+      type = "git";
+      url = "https://github.com/davecgh/go-spew";
+      rev = "v1.1.0";
+      sha256 = "0d4jfmak5p6lb7n2r6yvf5p1zcw0l8j74kn55ghvr7zr7b7axm6c";
+      moduleDir = "";
+    };
+  }
+  {
+    goPackagePath = "github.com/envoyproxy/go-control-plane";
+    fetch = {
+      type = "git";
+      url = "https://github.com/envoyproxy/go-control-plane";
+      rev = "668b12f5399d";
+      sha256 = "0vmhc8ii081x1k2qw4kji7wjyg6l25zp1y6qxi27wq8m341i4rzb";
+      moduleDir = "";
+    };
+  }
+  {
+    goPackagePath = "github.com/envoyproxy/protoc-gen-validate";
+    fetch = {
+      type = "git";
+      url = "https://github.com/envoyproxy/protoc-gen-validate";
+      rev = "v0.1.0";
+      sha256 = "0kxd3wwh3xwqk0r684hsy281xq4y71cd11d4q2hspcjbnlbwh7cy";
+      moduleDir = "";
+    };
+  }
+  {
+    goPackagePath = "github.com/golang/glog";
+    fetch = {
+      type = "git";
+      url = "https://github.com/golang/glog";
+      rev = "23def4e6c14b";
+      sha256 = "0jb2834rw5sykfr937fxi8hxi2zy80sj2bdn9b3jb4b26ksqng30";
+      moduleDir = "";
+    };
+  }
+  {
+    goPackagePath = "github.com/golang/mock";
+    fetch = {
+      type = "git";
+      url = "https://github.com/golang/mock";
+      rev = "v1.1.1";
+      sha256 = "0ap8wb6pdl6ccmdb43advjll2ly4sz26wsc3axw0hbrjrybybzgy";
+      moduleDir = "";
+    };
+  }
+  {
+    goPackagePath = "github.com/golang/protobuf";
+    fetch = {
+      type = "git";
+      url = "https://github.com/golang/protobuf";
+      rev = "v1.4.2";
+      sha256 = "0m5z81im4nsyfgarjhppayk4hqnrwswr3nix9mj8pff8x9jvcjqw";
+      moduleDir = "";
+    };
+  }
+  {
+    goPackagePath = "github.com/google/go-cmp";
+    fetch = {
+      type = "git";
+      url = "https://github.com/google/go-cmp";
+      rev = "v0.5.0";
+      sha256 = "04pzp583p6b32y34c6jygfxarff9qjs39rarvfh6467z24sdd9k4";
+      moduleDir = "";
+    };
+  }
+  {
+    goPackagePath = "github.com/google/uuid";
+    fetch = {
+      type = "git";
+      url = "https://github.com/google/uuid";
+      rev = "v1.1.2";
+      sha256 = "1rbpfa0v0ly9sdnixcxhf79swki54ikgm1zkwwkj64p1ws66syqd";
+      moduleDir = "";
+    };
+  }
+  {
+    goPackagePath = "github.com/pmezard/go-difflib";
+    fetch = {
+      type = "git";
+      url = "https://github.com/pmezard/go-difflib";
+      rev = "v1.0.0";
+      sha256 = "0c1cn55m4rypmscgf0rrb88pn58j3ysvc2d0432dp3c6fqg6cnzw";
+      moduleDir = "";
+    };
+  }
+  {
+    goPackagePath = "github.com/prometheus/client_model";
+    fetch = {
+      type = "git";
+      url = "https://github.com/prometheus/client_model";
+      rev = "14fe0d1b01d4";
+      sha256 = "0zdmk6rbbx39cvfz0r59v2jg5sg9yd02b4pds5n5llgvivi99550";
+      moduleDir = "";
+    };
+  }
+  {
+    goPackagePath = "github.com/stretchr/objx";
+    fetch = {
+      type = "git";
+      url = "https://github.com/stretchr/objx";
+      rev = "v0.1.0";
+      sha256 = "19ynspzjdynbi85xw06mh8ad5j0qa1vryvxjgvbnyrr8rbm4vd8w";
+      moduleDir = "";
+    };
+  }
+  {
+    goPackagePath = "github.com/stretchr/testify";
+    fetch = {
+      type = "git";
+      url = "https://github.com/stretchr/testify";
+      rev = "v1.5.1";
+      sha256 = "09r89m1wy4cjv2nps1ykp00qjpi0531r07q3s34hr7m6njk4srkl";
+      moduleDir = "";
+    };
+  }
+  {
+    goPackagePath = "golang.org/x/crypto";
+    fetch = {
+      type = "git";
+      url = "https://go.googlesource.com/crypto";
+      rev = "c2843e01d9a2";
+      sha256 = "01xgxbj5r79nmisdvpq48zfy8pzaaj90bn6ngd4nf33j9ar1dp8r";
+      moduleDir = "";
+    };
+  }
+  {
+    goPackagePath = "golang.org/x/exp";
+    fetch = {
+      type = "git";
+      url = "https://go.googlesource.com/exp";
+      rev = "509febef88a4";
+      sha256 = "02isrh39z8znrp5znplzy0dip2gnrl3jm1355raliyvhnhg04j6q";
+      moduleDir = "";
+    };
+  }
+  {
+    goPackagePath = "golang.org/x/lint";
+    fetch = {
+      type = "git";
+      url = "https://go.googlesource.com/lint";
+      rev = "d0100b6bd8b3";
+      sha256 = "0b0amr9x4ji66iv9ayfx7zrfx52k1m5g66qfcxkgj80qrb1y2yn7";
+      moduleDir = "";
+    };
+  }
+  {
+    goPackagePath = "golang.org/x/net";
+    fetch = {
+      type = "git";
+      url = "https://go.googlesource.com/net";
+      rev = "d8887717615a";
+      sha256 = "1wfm6ngxjyj7v5a2dqib6lw8bb2rdnf1kl48diykxjrsddn0s163";
+      moduleDir = "";
+    };
+  }
+  {
+    goPackagePath = "golang.org/x/oauth2";
+    fetch = {
+      type = "git";
+      url = "https://go.googlesource.com/oauth2";
+      rev = "d2e6202438be";
+      sha256 = "0wbn75fd10485nb93bm4kqldqifdim5xqy4v7r5sdvimvf3fyhn7";
+      moduleDir = "";
+    };
+  }
+  {
+    goPackagePath = "golang.org/x/sync";
+    fetch = {
+      type = "git";
+      url = "https://go.googlesource.com/sync";
+      rev = "112230192c58";
+      sha256 = "05i2k43j2d0llq768hg5pf3hb2yhfzp9la1w5wp0rsnnzblr0lfn";
+      moduleDir = "";
+    };
+  }
+  {
+    goPackagePath = "golang.org/x/sys";
+    fetch = {
+      type = "git";
+      url = "https://go.googlesource.com/sys";
+      rev = "d0b11bdaac8a";
+      sha256 = "18yfsmw622l7gc5sqriv5qmck6903vvhivpzp8i3xfy3z33dybdl";
+      moduleDir = "";
+    };
+  }
+  {
+    goPackagePath = "golang.org/x/text";
+    fetch = {
+      type = "git";
+      url = "https://go.googlesource.com/text";
+      rev = "v0.3.0";
+      sha256 = "0r6x6zjzhr8ksqlpiwm5gdd7s209kwk5p4lw54xjvz10cs3qlq19";
+      moduleDir = "";
+    };
+  }
+  {
+    goPackagePath = "golang.org/x/tools";
+    fetch = {
+      type = "git";
+      url = "https://go.googlesource.com/tools";
+      rev = "2c0ae7006135";
+      sha256 = "1lsi2ssxajclj3bciz2a41v1vjv768ja3v6wnbyhxy8xphwkp4fk";
+      moduleDir = "";
+    };
+  }
+  {
+    goPackagePath = "golang.org/x/xerrors";
+    fetch = {
+      type = "git";
+      url = "https://go.googlesource.com/xerrors";
+      rev = "9bdfabe68543";
+      sha256 = "1yjfi1bk9xb81lqn85nnm13zz725wazvrx3b50hx19qmwg7a4b0c";
+      moduleDir = "";
+    };
+  }
+  {
+    goPackagePath = "google.golang.org/appengine";
+    fetch = {
+      type = "git";
+      url = "https://github.com/golang/appengine";
+      rev = "v1.4.0";
+      sha256 = "06zl7w4sxgdq2pl94wy9ncii6h0z3szl4xpqds0sv3b3wbdlhbnn";
+      moduleDir = "";
+    };
+  }
+  {
+    goPackagePath = "google.golang.org/genproto";
+    fetch = {
+      type = "git";
+      url = "https://github.com/googleapis/go-genproto";
+      rev = "cb27e3aa2013";
+      sha256 = "0ml73ghqcwbz7ipfk8fnxb5indcml49b5p7vp1fsyny0abyyrmxf";
+      moduleDir = "";
+    };
+  }
+  {
+    goPackagePath = "google.golang.org/protobuf";
+    fetch = {
+      type = "git";
+      url = "https://go.googlesource.com/protobuf";
+      rev = "v1.25.0";
+      sha256 = "0apfl42x166dh96zfq5kvv4b4ax9xljik6bq1mnvn2240ir3mc23";
+      moduleDir = "";
+    };
+  }
+  {
+    goPackagePath = "gopkg.in/check.v1";
+    fetch = {
+      type = "git";
+      url = "https://gopkg.in/check.v1";
+      rev = "20d25e280405";
+      sha256 = "0k1m83ji9l1a7ng8a7v40psbymxasmssbrrhpdv2wl4rhs0nc3np";
+      moduleDir = "";
+    };
+  }
+  {
+    goPackagePath = "gopkg.in/yaml.v2";
+    fetch = {
+      type = "git";
+      url = "https://gopkg.in/yaml.v2";
+      rev = "v2.2.2";
+      sha256 = "01wj12jzsdqlnidpyjssmj0r4yavlqy7dwrg7adqd8dicjc4ncsa";
+      moduleDir = "";
+    };
+  }
+  {
+    goPackagePath = "honnef.co/go/tools";
+    fetch = {
+      type = "git";
+      url = "https://github.com/dominikh/go-tools";
+      rev = "ea95bdfd59fc";
+      sha256 = "1763nw7pwpzkvzfnm63dgzcgbq9hwmq5l1nffchnhh77vgkaq4ic";
+      moduleDir = "";
+    };
+  }
+]
diff --git a/third_party/nixpkgs/pkgs/development/tools/treefmt/default.nix b/third_party/nixpkgs/pkgs/development/tools/treefmt/default.nix
new file mode 100644
index 0000000000..c90492c6ae
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/development/tools/treefmt/default.nix
@@ -0,0 +1,21 @@
+{ lib, rustPlatform, fetchFromGitHub }:
+rustPlatform.buildRustPackage rec {
+  pname = "treefmt";
+  version = "0.1.1";
+
+  src = fetchFromGitHub {
+    owner = "numtide";
+    repo = "treefmt";
+    rev = "v${version}";
+    sha256 = "0a4yikkqppawii1q0kzsxwfp1aid688wa0lixjwfsl279lr69css";
+  };
+
+  cargoSha256 = "08k60gd23yanfraxpbw9hi7jbqgsxz9mv1ci6q9piis5742zlj9s";
+
+  meta = {
+    description = "one CLI to format the code tree";
+    homepage = "https://github.com/numtide/treefmt";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ zimbatm ];
+  };
+}
diff --git a/third_party/nixpkgs/pkgs/development/tools/xcbuild/default.nix b/third_party/nixpkgs/pkgs/development/tools/xcbuild/default.nix
index 1f38e49dae..af0f546eb8 100644
--- a/third_party/nixpkgs/pkgs/development/tools/xcbuild/default.nix
+++ b/third_party/nixpkgs/pkgs/development/tools/xcbuild/default.nix
@@ -51,6 +51,7 @@ in stdenv.mkDerivation {
   postInstall = ''
     mv $out/usr/* $out
     rmdir $out/usr
+    cp liblinenoise.* $out/lib/
   '';
 
   NIX_CFLAGS_COMPILE = "-Wno-error";
diff --git a/third_party/nixpkgs/pkgs/development/tools/xcbuild/wrapper.nix b/third_party/nixpkgs/pkgs/development/tools/xcbuild/wrapper.nix
index 861ef0fc84..4f74b09371 100644
--- a/third_party/nixpkgs/pkgs/development/tools/xcbuild/wrapper.nix
+++ b/third_party/nixpkgs/pkgs/development/tools/xcbuild/wrapper.nix
@@ -3,7 +3,7 @@
 , runtimeShell, callPackage
 , xcodePlatform ? stdenv.targetPlatform.xcodePlatform or "MacOSX"
 , xcodeVer ? stdenv.targetPlatform.xcodeVer or "9.4.1"
-, sdkVer ? stdenv.targetPlatform.sdkVer or "10.12" }:
+, sdkVer ? stdenv.targetPlatform.darwinSdkVersion or "10.12" }:
 
 let
 
diff --git a/third_party/nixpkgs/pkgs/development/web/cypress/default.nix b/third_party/nixpkgs/pkgs/development/web/cypress/default.nix
index 6dd616fe4f..e05a320f63 100644
--- a/third_party/nixpkgs/pkgs/development/web/cypress/default.nix
+++ b/third_party/nixpkgs/pkgs/development/web/cypress/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchzip, autoPatchelfHook, xorg, gtk2, gnome2, gtk3, nss, alsaLib, udev, unzip, wrapGAppsHook }:
+{ stdenv, lib, fetchzip, autoPatchelfHook, xorg, gtk2, gnome2, gtk3, nss, alsaLib, udev, unzip, wrapGAppsHook, mesa }:
 
 stdenv.mkDerivation rec {
   pname = "cypress";
@@ -18,6 +18,7 @@ stdenv.mkDerivation rec {
     libXScrnSaver libXdamage libXtst libxshmfence
   ] ++ [
     nss gtk2 alsaLib gnome2.GConf gtk3
+    mesa # for libgbm
   ];
 
   runtimeDependencies = [ (lib.getLib udev) ];
diff --git a/third_party/nixpkgs/pkgs/development/web/insomnia/default.nix b/third_party/nixpkgs/pkgs/development/web/insomnia/default.nix
index 345b7c1542..24b65e4e8a 100644
--- a/third_party/nixpkgs/pkgs/development/web/insomnia/default.nix
+++ b/third_party/nixpkgs/pkgs/development/web/insomnia/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, makeWrapper, fetchurl, dpkg, alsaLib, atk, cairo, cups, dbus, expat
-, fontconfig, freetype, gdk-pixbuf, glib, gnome2, pango, nspr, nss, gtk3, gtk2
+, fontconfig, freetype, gdk-pixbuf, glib, gnome2, pango, mesa, nspr, nss, gtk3, gtk2
 , at-spi2-atk, gsettings-desktop-schemas, gobject-introspection, wrapGAppsHook
 , libX11, libXScrnSaver, libXcomposite, libXcursor, libXdamage, libXext
 , libXfixes, libXi, libXrandr, libXrender, libXtst, libxcb, nghttp2
@@ -56,6 +56,7 @@ in stdenv.mkDerivation rec {
     libXrender
     libXtst
     libxcb
+    mesa # for libgbm
     nspr
     nss
     stdenv.cc.cc
diff --git a/third_party/nixpkgs/pkgs/games/gimx/default.nix b/third_party/nixpkgs/pkgs/games/gimx/default.nix
index ab208dfa00..0ae5a79170 100644
--- a/third_party/nixpkgs/pkgs/games/gimx/default.nix
+++ b/third_party/nixpkgs/pkgs/games/gimx/default.nix
@@ -51,15 +51,19 @@ in stdenv.mkDerivation rec {
     mkdir -p $out/share
     cp -r ./loader/firmware $out/share/firmware
     cp -r ${gimx-config}/Linux $out/share/config
-    patch ${gimx-config}/Linux/Dualshock4.xml ${./noff.patch} -o $out/share/ds4.xml
 
     makeWrapper $out/bin/gimx $out/bin/gimx-with-confs \
       --set GIMXCONF $out/share/config
 
     makeWrapper $out/bin/gimx $out/bin/gimx-test-ds4 \
-      --set GIMXCONF $out/share \
+      --set GIMXCONF $out/share/config \
       --add-flags "--nograb" --add-flags "--curses" \
-      --add-flags "-p /dev/ttyUSB0" --add-flags "-c ds4.xml"
+      --add-flags "-p /dev/ttyUSB0" --add-flags "-c Dualshock4.xml"
+
+    makeWrapper $out/bin/gimx $out/bin/gimx-test-xone \
+      --set GIMXCONF $out/share/config \
+      --add-flags "--nograb" --add-flags "--curses" \
+      --add-flags "-p /dev/ttyUSB0" --add-flags "-c XOnePadUsb.xml"
   '';
 
   meta = with lib; {
diff --git a/third_party/nixpkgs/pkgs/games/gimx/noff.patch b/third_party/nixpkgs/pkgs/games/gimx/noff.patch
deleted file mode 100644
index 86b36adda2..0000000000
--- a/third_party/nixpkgs/pkgs/games/gimx/noff.patch
+++ /dev/null
@@ -1,16 +0,0 @@
-diff --git a/Linux/Dualshock4.xml b/Linux/Dualshock4.xml
-index 5e53ed3..45ee5ed 100644
---- a/Linux/Dualshock4.xml
-+++ b/Linux/Dualshock4.xml
-@@ -94,6 +94,11 @@
-         </axis>
-       </axis_map>
-       <joystick_corrections_list/>
-+      <force_feedback>
-+        <device type="joystick" id="0" name="Sony Computer Entertainment Wireless Controller"/>
-+        <inversion enable="no"/>
-+        <gain rumble="0" constant="0" spring="0" damper="0"/>
-+      </force_feedback>
-     </configuration>
-   </controller>
- </root>
diff --git a/third_party/nixpkgs/pkgs/games/soldat-unstable/default.nix b/third_party/nixpkgs/pkgs/games/soldat-unstable/default.nix
index d48cf3048e..19ff4b5c6c 100644
--- a/third_party/nixpkgs/pkgs/games/soldat-unstable/default.nix
+++ b/third_party/nixpkgs/pkgs/games/soldat-unstable/default.nix
@@ -38,15 +38,15 @@ let
 in
 
 stdenv.mkDerivation rec {
-  pname = "soldat-unstable";
-  version = "2020-11-26";
+  pname = "soldat";
+  version = "unstable-2021-02-09";
 
   src = fetchFromGitHub {
     name = "soldat";
     owner = "Soldat";
     repo = "soldat";
-    rev = "2280296ac56883f6a9cad4da48025af8ae7782e7";
-    sha256 = "17i3nlhxm4x4zx00i00aivhxmagbnyizxnpwiqzg57bf23hrvdj3";
+    rev = "c304c3912ca7a88461970a859049d217a44c6375";
+    sha256 = "09sl2zybfcmnl2n3qghp0gylmr71y01534l6nq0y9llbdy0bf306";
   };
 
   nativeBuildInputs = [ fpc makeWrapper autoPatchelfHook ];
@@ -63,14 +63,9 @@ stdenv.mkDerivation rec {
     })
   ];
 
-  postPatch = ''
-    for f in client/Makefile server/Makefile; do
-      # fix unportable uname invocation
-      substituteInPlace "$f" --replace "uname -p" "uname -m"
-    done
-  '';
-
   buildPhase = ''
+    runHook preBuild
+
     mkdir -p client/build server/build
 
     # build .so from stb headers
@@ -87,9 +82,13 @@ stdenv.mkDerivation rec {
     pushd server
     make mode=release
     popd
+
+    runHook postBuild
   '';
 
   installPhase = ''
+    runHook preInstall
+
     install -Dm644 client/libs/stb/libstb.so -t $out/lib
     install -Dm755 client/build/soldat_* $out/bin/soldat
     install -Dm755 server/build/soldatserver_* $out/bin/soldatserver
@@ -107,6 +106,8 @@ stdenv.mkDerivation rec {
         --add-flags "-fs_userpath \"$configDir\"" \
         --add-flags "-fs_basepath \"${base}/share/soldat\""
     done
+
+    runHook postInstall
   '';
 
   meta = with lib; {
diff --git a/third_party/nixpkgs/pkgs/misc/emulators/pcsxr/default.nix b/third_party/nixpkgs/pkgs/misc/emulators/pcsxr/default.nix
index e6f0ec4774..099795c63f 100644
--- a/third_party/nixpkgs/pkgs/misc/emulators/pcsxr/default.nix
+++ b/third_party/nixpkgs/pkgs/misc/emulators/pcsxr/default.nix
@@ -52,6 +52,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ autoreconfHook intltool pkg-config wrapGAppsHook ];
   buildInputs = [
     gtk3 SDL2 xorg.libXv xorg.libXtst libcdio nasm ffmpeg file
+    xorg.libXxf86vm
   ];
 
   dynarecTarget =
diff --git a/third_party/nixpkgs/pkgs/misc/vim-plugins/generated.nix b/third_party/nixpkgs/pkgs/misc/vim-plugins/generated.nix
index 5a5c66c538..651515c315 100644
--- a/third_party/nixpkgs/pkgs/misc/vim-plugins/generated.nix
+++ b/third_party/nixpkgs/pkgs/misc/vim-plugins/generated.nix
@@ -209,12 +209,12 @@ let
 
   auto-session = buildVimPluginFrom2Nix {
     pname = "auto-session";
-    version = "2021-04-18";
+    version = "2021-04-24";
     src = fetchFromGitHub {
       owner = "rmagatti";
       repo = "auto-session";
-      rev = "482329bad5d8e8fbd61ac2041e8a3c88a45dbe20";
-      sha256 = "1yrccyygnz29p9vx1jvyj4imbq3m9rlm37m3cbb9azxmmvdbm0l3";
+      rev = "6e87fa2ed6b6fe7ccd14fe4b30cc00be47afc3c6";
+      sha256 = "00d3ga6rpzwcz2pcdgwrnr2xymh1hizs46zzc8jjmrj58k8sg033";
     };
     meta.homepage = "https://github.com/rmagatti/auto-session/";
   };
@@ -389,12 +389,12 @@ let
 
   chadtree = buildVimPluginFrom2Nix {
     pname = "chadtree";
-    version = "2021-04-23";
+    version = "2021-04-24";
     src = fetchFromGitHub {
       owner = "ms-jpq";
       repo = "chadtree";
-      rev = "5b286768438921cbc77d6cfb4a7046ea45c8adfc";
-      sha256 = "1g5g1yqr78l620vr7vslx15j2f4dfg4bb8wwjgfqx0pw5lc982yc";
+      rev = "e7c2807bf0c029864f346024981f1a7927044393";
+      sha256 = "063jk33l7yz467b0v00s3h5gb3lbwb0x5gh4r5bignlhm518sfa3";
     };
     meta.homepage = "https://github.com/ms-jpq/chadtree/";
   };
@@ -425,14 +425,14 @@ let
 
   ci_dark = buildVimPluginFrom2Nix {
     pname = "ci_dark";
-    version = "2021-03-03";
+    version = "2021-04-24";
     src = fetchFromGitHub {
-      owner = "chuling";
+      owner = "yunlingz";
       repo = "ci_dark";
-      rev = "9063153b05ca47c030a5f656411dbbed33697678";
-      sha256 = "011017ywcgjcflsl21fjcrz7ap68aqvgx5y5z64075qkrk1pqgz1";
+      rev = "4c314000b5a21a1b9f52442a0c80e4b3fd4f0a1f";
+      sha256 = "1wxsgaixdmb8v87kavvyyiyqlkn7ck5g39hkq4j19747jnb6lvqf";
     };
-    meta.homepage = "https://github.com/chuling/ci_dark/";
+    meta.homepage = "https://github.com/yunlingz/ci_dark/";
   };
 
   clang_complete = buildVimPluginFrom2Nix {
@@ -485,12 +485,12 @@ let
 
   coc-fzf = buildVimPluginFrom2Nix {
     pname = "coc-fzf";
-    version = "2021-03-21";
+    version = "2021-04-24";
     src = fetchFromGitHub {
       owner = "antoinemadec";
       repo = "coc-fzf";
-      rev = "8f27377229c5d2dcee9ae9cda8dea0fad4a5ac3b";
-      sha256 = "0ri0rlz4fwxli6ssz69zyifrdwhc8yx4p996rw8d2m76nm7hflv0";
+      rev = "70f0691e14c8e55290e554591c0a2661dea530fa";
+      sha256 = "1m3kwgng7xi8xycc0dcx0wr9i7q0anx9lpax0r4p2a26vaqam539";
     };
     meta.homepage = "https://github.com/antoinemadec/coc-fzf/";
   };
@@ -2170,6 +2170,30 @@ let
     meta.homepage = "https://github.com/latex-box-team/latex-box/";
   };
 
+  lazygit-nvim = buildVimPluginFrom2Nix {
+    pname = "lazygit-nvim";
+    version = "2021-03-25";
+    src = fetchFromGitHub {
+      owner = "kdheepak";
+      repo = "lazygit.nvim";
+      rev = "fb5ab7d26ac414a7e7bfff6b89f69e2dd2fd3884";
+      sha256 = "1nn6zhjqfk88jmavl9y8li4y08v3wb2m2kskq9yf36hadw29im30";
+    };
+    meta.homepage = "https://github.com/kdheepak/lazygit.nvim/";
+  };
+
+  LeaderF = buildVimPluginFrom2Nix {
+    pname = "LeaderF";
+    version = "2021-04-16";
+    src = fetchFromGitHub {
+      owner = "Yggdroot";
+      repo = "LeaderF";
+      rev = "6c49ab524b883495193ff3a4eab5c7846aba4261";
+      sha256 = "19dyd148silyaiprjrcd23y62kcsp6hpvpansmpxri55x53a772w";
+    };
+    meta.homepage = "https://github.com/Yggdroot/LeaderF/";
+  };
+
   lean-vim = buildVimPluginFrom2Nix {
     pname = "lean-vim";
     version = "2021-01-02";
@@ -3144,24 +3168,24 @@ let
 
   nvim-dap = buildVimPluginFrom2Nix {
     pname = "nvim-dap";
-    version = "2021-04-22";
+    version = "2021-04-23";
     src = fetchFromGitHub {
       owner = "mfussenegger";
       repo = "nvim-dap";
-      rev = "41f982b646b29059749bd588ba783cb99d8fc781";
-      sha256 = "0z2kl2iqs8vcb8l4r508ny3h7vl3vm1l6cjsl5bi1s7387pizxbl";
+      rev = "c6cb4fcbc91b0404ae157f1942e305d66073ca1a";
+      sha256 = "07mncx8bzigbh6yy7nbsgjb3g3fm1kx73wb6p7jl6h9ay3fmgrfc";
     };
     meta.homepage = "https://github.com/mfussenegger/nvim-dap/";
   };
 
   nvim-dap-virtual-text = buildVimPluginFrom2Nix {
     pname = "nvim-dap-virtual-text";
-    version = "2021-03-15";
+    version = "2021-04-24";
     src = fetchFromGitHub {
       owner = "theHamsta";
       repo = "nvim-dap-virtual-text";
-      rev = "b26acb69a5a4940f9eb3fd6f4bca8e1cc16fa5ce";
-      sha256 = "16dkgmcfdx1n72khlwrcykwwpcjzz2mdh7dc53vb4j0pbmqmnna2";
+      rev = "f144a3bb6a39ef5c07173fe08e6f3ce8f5f184ba";
+      sha256 = "1zax0vx77fqx7jr1xipfy0dp3l05gzbqdvc1wvq2cnjvqd7s8i2v";
     };
     meta.homepage = "https://github.com/theHamsta/nvim-dap-virtual-text/";
   };
@@ -3336,12 +3360,12 @@ let
 
   nvim-treesitter = buildVimPluginFrom2Nix {
     pname = "nvim-treesitter";
-    version = "2021-04-23";
+    version = "2021-04-24";
     src = fetchFromGitHub {
       owner = "nvim-treesitter";
       repo = "nvim-treesitter";
-      rev = "af3537fbe57a2a37ab2b620c9ecc487e31b4da64";
-      sha256 = "1z4k0a8gyz8ycd6wq8npg056l0axz3vj7pipxcpi1i9xa4kx3j6i";
+      rev = "b68f0cc70022fedec9b9190904d6035393111cdf";
+      sha256 = "07zp1fbah65f7lglfkmdzi6cyfchlaf1ap02wzwixiv5hpy6zji4";
     };
     meta.homepage = "https://github.com/nvim-treesitter/nvim-treesitter/";
   };
@@ -4117,12 +4141,12 @@ let
 
   sonokai = buildVimPluginFrom2Nix {
     pname = "sonokai";
-    version = "2021-04-17";
+    version = "2021-04-24";
     src = fetchFromGitHub {
       owner = "sainnhe";
       repo = "sonokai";
-      rev = "764bd716f08f1441e0020b8ae0c8d1b53970e4a9";
-      sha256 = "1f21mn67cdiyq2pi92agvvzfprvr78kqc89bc3wh2k8ij47szmp6";
+      rev = "784de58d2bcad8b16bce972c1727fb0cb07e43b2";
+      sha256 = "04wlqd902fy474mk7688y2mysy8vsm3pf36d59bxd3jlspgp6zcl";
     };
     meta.homepage = "https://github.com/sainnhe/sonokai/";
   };
@@ -4213,12 +4237,12 @@ let
 
   splitjoin-vim = buildVimPluginFrom2Nix {
     pname = "splitjoin-vim";
-    version = "2021-03-02";
+    version = "2021-04-24";
     src = fetchFromGitHub {
       owner = "AndrewRadev";
       repo = "splitjoin.vim";
-      rev = "f0d785f7607be60c282b5f5a5d32a2e51560c07c";
-      sha256 = "1gbnhl1w0krlf2ppiz4h4fvnrjf8i0552nckhd67gfba2nqha0z4";
+      rev = "f4773c0d2f7453fea23f5f69f433547f3d62ea0a";
+      sha256 = "06fsfsvrq6sqyqpmj693vn810c6zvzn16781mw6bb2912cmyrs5z";
       fetchSubmodules = true;
     };
     meta.homepage = "https://github.com/AndrewRadev/splitjoin.vim/";
@@ -4272,6 +4296,18 @@ let
     meta.homepage = "https://github.com/darfink/starsearch.vim/";
   };
 
+  suda-vim = buildVimPluginFrom2Nix {
+    pname = "suda-vim";
+    version = "2021-02-20";
+    src = fetchFromGitHub {
+      owner = "lambdalisue";
+      repo = "suda.vim";
+      rev = "fbb138f5090c3db4dabeba15326397a09df6b73b";
+      sha256 = "01kys8q3gycxqf760ydq1k8wq20brjvl1gxpl8j87jvnyx87kmnf";
+    };
+    meta.homepage = "https://github.com/lambdalisue/suda.vim/";
+  };
+
   SudoEdit-vim = buildVimPluginFrom2Nix {
     pname = "SudoEdit-vim";
     version = "2020-02-27";
@@ -6290,6 +6326,18 @@ let
     meta.homepage = "https://github.com/bitc/vim-hdevtools/";
   };
 
+  vim-helm = buildVimPluginFrom2Nix {
+    pname = "vim-helm";
+    version = "2020-01-02";
+    src = fetchFromGitHub {
+      owner = "towolf";
+      repo = "vim-helm";
+      rev = "2c2e2e936607ed93f8f75de2066d04feff0e8e81";
+      sha256 = "1vlaqcxxsbys0ybk2x7ri1flyx412ak0dmanqg1cdig6xzhna2kc";
+    };
+    meta.homepage = "https://github.com/towolf/vim-helm/";
+  };
+
   vim-hexokinase = buildVimPluginFrom2Nix {
     pname = "vim-hexokinase";
     version = "2021-03-31";
@@ -8622,6 +8670,18 @@ let
     meta.homepage = "https://github.com/lyokha/vim-xkbswitch/";
   };
 
+  vim-xtabline = buildVimPluginFrom2Nix {
+    pname = "vim-xtabline";
+    version = "2021-01-31";
+    src = fetchFromGitHub {
+      owner = "mg979";
+      repo = "vim-xtabline";
+      rev = "654675222adde47c9d72caa400e35c7e680fe5a1";
+      sha256 = "1f7d4vmr7n5v7h5a1bjcvxaqygrdi33y0vdx4yjfdswi835yd45h";
+    };
+    meta.homepage = "https://github.com/mg979/vim-xtabline/";
+  };
+
   vim-yaml = buildVimPluginFrom2Nix {
     pname = "vim-yaml";
     version = "2021-01-14";
@@ -8805,12 +8865,12 @@ let
 
   vimtex = buildVimPluginFrom2Nix {
     pname = "vimtex";
-    version = "2021-04-15";
+    version = "2021-04-23";
     src = fetchFromGitHub {
       owner = "lervag";
       repo = "vimtex";
-      rev = "0d8a69f9e16a90cfed591264170dea0c5b686b81";
-      sha256 = "014f85wg1c20cysn8qayw71d49qmv1vzzbgikzrd9msfqsp4l5qj";
+      rev = "91c011f6c156f405ed259c9749ea049726ef8912";
+      sha256 = "1pwq5wxyky38nhs8ckcl6x4yxkia5lk5hcd12l1d5iimddjfsx9i";
     };
     meta.homepage = "https://github.com/lervag/vimtex/";
   };
@@ -8899,6 +8959,18 @@ let
     meta.homepage = "https://github.com/mattn/webapi-vim/";
   };
 
+  wildfire-vim = buildVimPluginFrom2Nix {
+    pname = "wildfire-vim";
+    version = "2014-11-16";
+    src = fetchFromGitHub {
+      owner = "gcmt";
+      repo = "wildfire.vim";
+      rev = "e2baded7162260e05d2527f5bca9fca81f0bc8f2";
+      sha256 = "01i12x8brsnqicj5vclg57nv6ha7nz70gilphf6sr14xr741ra1y";
+    };
+    meta.homepage = "https://github.com/gcmt/wildfire.vim/";
+  };
+
   wmgraphviz-vim = buildVimPluginFrom2Nix {
     pname = "wmgraphviz-vim";
     version = "2018-04-26";
diff --git a/third_party/nixpkgs/pkgs/misc/vim-plugins/overrides.nix b/third_party/nixpkgs/pkgs/misc/vim-plugins/overrides.nix
index 3e352977d5..8b7e41ed3b 100644
--- a/third_party/nixpkgs/pkgs/misc/vim-plugins/overrides.nix
+++ b/third_party/nixpkgs/pkgs/misc/vim-plugins/overrides.nix
@@ -128,15 +128,23 @@ self: super: {
     '';
   });
 
-  completion-tabnine = super.completion-tabnine.overrideAttrs (old: {
-    buildInputs = [ tabnine ];
+  completion-buffers = super.completion-buffers.overrideAttrs (old: {
+    dependencies = with self; [ completion-nvim ];
+  });
 
+  completion-tabnine = super.completion-tabnine.overrideAttrs (old: {
+    dependencies = with self; [ completion-nvim ];
+    buildInputs = [ tabnine ];
     postFixup = ''
       mkdir $target/binaries
       ln -s ${tabnine}/bin/TabNine $target/binaries/TabNine_$(uname -s)
     '';
   });
 
+  completion-treesitter = super.completion-treesitter.overrideAttrs (old: {
+    dependencies = with self; [ completion-nvim nvim-treesitter ];
+  });
+
   cpsm = super.cpsm.overrideAttrs (old: {
     buildInputs = [
       python3
@@ -162,11 +170,11 @@ self: super: {
   });
 
   defx-nvim = super.defx-nvim.overrideAttrs (old: {
-    dependencies = with super; [ nvim-yarp ];
+    dependencies = with self; [ nvim-yarp ];
   });
 
   deoplete-fish = super.deoplete-fish.overrideAttrs (old: {
-    dependencies = with super; [ deoplete-nvim vim-fish ];
+    dependencies = with self; [ deoplete-nvim vim-fish ];
   });
 
   deoplete-go = super.deoplete-go.overrideAttrs (old: {
@@ -180,7 +188,7 @@ self: super: {
   });
 
   deoplete-khard = super.deoplete-khard.overrideAttrs (old: {
-    dependencies = [ self.deoplete-nvim ];
+    dependencies = with self; [ deoplete-nvim ];
     passthru.python3Dependencies = ps: [ (ps.toPythonModule khard) ];
     meta = {
       description = "Address-completion for khard via deoplete";
@@ -200,11 +208,11 @@ self: super: {
 
   ensime-vim = super.ensime-vim.overrideAttrs (old: {
     passthru.python3Dependencies = ps: with ps; [ sexpdata websocket_client ];
-    dependencies = with super; [ vimproc-vim vimshell-vim super.self forms ];
+    dependencies = with self; [ vimproc-vim vimshell-vim self.self forms ];
   });
 
   forms = super.forms.overrideAttrs (old: {
-    dependencies = with super; [ super.self ];
+    dependencies = with self; [ self.self ];
   });
 
   fruzzy =
@@ -243,7 +251,7 @@ self: super: {
     });
 
   fzf-vim = super.fzf-vim.overrideAttrs (old: {
-    dependencies = [ self.fzfWrapper ];
+    dependencies = with self; [ fzfWrapper ];
   });
 
   # Mainly used as a dependency for fzf-vim. Wraps the fzf program as a vim
@@ -261,6 +269,10 @@ self: super: {
     configurePhase = "cd plugins/nvim";
   });
 
+  gitsigns-nvim = super.gitsigns-nvim.overrideAttrs (old: {
+    dependencies = with self; [ plenary-nvim ];
+  });
+
   jedi-vim = super.jedi-vim.overrideAttrs (old: {
     # checking for python3 support in vim would be neat, too, but nobody else seems to care
     buildInputs = [ python3.pkgs.jedi ];
@@ -320,7 +332,7 @@ self: super: {
   });
 
   lf-vim = super.lf-vim.overrideAttrs (old: {
-    dependencies = with super; [ vim-floaterm ];
+    dependencies = with self; [ vim-floaterm ];
   });
 
   meson = buildVimPluginFrom2Nix {
@@ -339,32 +351,32 @@ self: super: {
   });
 
   ncm2 = super.ncm2.overrideAttrs (old: {
-    dependencies = with super; [ nvim-yarp ];
+    dependencies = with self; [ nvim-yarp ];
   });
 
   ncm2-jedi = super.ncm2-jedi.overrideAttrs (old: {
-    dependencies = with super; [ nvim-yarp ncm2 ];
+    dependencies = with self; [ nvim-yarp ncm2 ];
     passthru.python3Dependencies = ps: with ps; [ jedi ];
   });
 
   ncm2-neoinclude = super.ncm2-neoinclude.overrideAttrs (old: {
-    dependencies = with super; [ neoinclude-vim ];
+    dependencies = with self; [ neoinclude-vim ];
   });
 
   ncm2-neosnippet = super.ncm2-neosnippet.overrideAttrs (old: {
-    dependencies = with super; [ neosnippet-vim ];
+    dependencies = with self; [ neosnippet-vim ];
   });
 
   ncm2-syntax = super.ncm2-syntax.overrideAttrs (old: {
-    dependencies = with super; [ neco-syntax ];
+    dependencies = with self; [ neco-syntax ];
   });
 
   ncm2-ultisnips = super.ncm2-ultisnips.overrideAttrs (old: {
-    dependencies = with super; [ ultisnips ];
+    dependencies = with self; [ ultisnips ];
   });
 
   nvim-lsputils = super.nvim-lsputils.overrideAttrs (old: {
-    dependencies = with super; [ popfix ];
+    dependencies = with self; [ popfix ];
   });
 
   # Usage:
@@ -396,7 +408,7 @@ self: super: {
   };
 
   skim-vim = super.skim-vim.overrideAttrs (old: {
-    dependencies = [ self.skim ];
+    dependencies = with self; [ skim ];
   });
 
   sql-nvim = super.sql-nvim.overrideAttrs (old: {
@@ -436,10 +448,15 @@ self: super: {
     });
 
   telescope-frecency-nvim = super.telescope-frecency-nvim.overrideAttrs (old: {
-    dependencies = [ self.sql-nvim ];
+    dependencies = with self; [ sql-nvim telescope-nvim ];
+  });
+
+  telescope-fzf-writer-nvim = super.telescope-fzf-writer-nvim.overrideAttrs (old: {
+    dependencies = with self; [ telescope-nvim ];
   });
 
   telescope-fzy-native-nvim = super.telescope-fzy-native-nvim.overrideAttrs (old: {
+    dependencies = with self; [ telescope-nvim ];
     preFixup =
       let
         fzy-lua-native-path = "deps/fzy-lua-native";
@@ -463,6 +480,18 @@ self: super: {
     meta.platforms = lib.platforms.all;
   });
 
+  telescope-nvim = super.telescope-nvim.overrideAttrs (old: {
+    dependencies = with self; [ plenary-nvim popup-nvim ];
+  });
+
+  telescope-symbols-nvim = super.telescope-symbols-nvim.overrideAttrs (old: {
+    dependencies = with self; [ telescope-nvim ];
+  });
+
+  telescope-z-nvim = super.telescope-z-nvim.overrideAttrs (old: {
+    dependencies = with self; [ telescope-nvim ];
+  });
+
   unicode-vim =
     let
       unicode-data = fetchurl {
@@ -490,23 +519,23 @@ self: super: {
   });
 
   vim-addon-actions = super.vim-addon-actions.overrideAttrs (old: {
-    dependencies = with super; [ vim-addon-mw-utils tlib_vim ];
+    dependencies = with self; [ vim-addon-mw-utils tlib_vim ];
   });
 
   vim-addon-async = super.vim-addon-async.overrideAttrs (old: {
-    dependencies = with super; [ vim-addon-signs ];
+    dependencies = with self; [ vim-addon-signs ];
   });
 
   vim-addon-background-cmd = super.vim-addon-background-cmd.overrideAttrs (old: {
-    dependencies = with super; [ vim-addon-mw-utils ];
+    dependencies = with self; [ vim-addon-mw-utils ];
   });
 
   vim-addon-completion = super.vim-addon-completion.overrideAttrs (old: {
-    dependencies = with super; [ tlib_vim ];
+    dependencies = with self; [ tlib_vim ];
   });
 
   vim-addon-goto-thing-at-cursor = super.vim-addon-goto-thing-at-cursor.overrideAttrs (old: {
-    dependencies = with super; [ tlib_vim ];
+    dependencies = with self; [ tlib_vim ];
   });
 
   vim-addon-manager = super.vim-addon-manager.overrideAttrs (old: {
@@ -514,11 +543,11 @@ self: super: {
   });
 
   vim-addon-mru = super.vim-addon-mru.overrideAttrs (old: {
-    dependencies = with super; [ vim-addon-other vim-addon-mw-utils ];
+    dependencies = with self; [ vim-addon-other vim-addon-mw-utils ];
   });
 
   vim-addon-nix = super.vim-addon-nix.overrideAttrs (old: {
-    dependencies = with super; [
+    dependencies = with self; [
       vim-addon-completion
       vim-addon-goto-thing-at-cursor
       vim-addon-errorformats
@@ -529,23 +558,23 @@ self: super: {
   });
 
   vim-addon-sql = super.vim-addon-sql.overrideAttrs (old: {
-    dependencies = with super; [ vim-addon-completion vim-addon-background-cmd tlib_vim ];
+    dependencies = with self; [ vim-addon-completion vim-addon-background-cmd tlib_vim ];
   });
 
   vim-addon-syntax-checker = super.vim-addon-syntax-checker.overrideAttrs (old: {
-    dependencies = with super; [ vim-addon-mw-utils tlib_vim ];
+    dependencies = with self; [ vim-addon-mw-utils tlib_vim ];
   });
 
   vim-addon-toggle-buffer = super.vim-addon-toggle-buffer.overrideAttrs (old: {
-    dependencies = with super; [ vim-addon-mw-utils tlib_vim ];
+    dependencies = with self; [ vim-addon-mw-utils tlib_vim ];
   });
 
   vim-addon-xdebug = super.vim-addon-xdebug.overrideAttrs (old: {
-    dependencies = with super; [ webapi-vim vim-addon-mw-utils vim-addon-signs vim-addon-async ];
+    dependencies = with self; [ webapi-vim vim-addon-mw-utils vim-addon-signs vim-addon-async ];
   });
 
   vim-bazel = super.vim-bazel.overrideAttrs (old: {
-    dependencies = with super; [ vim-maktaba ];
+    dependencies = with self; [ vim-maktaba ];
   });
 
   vim-beancount = super.vim-beancount.overrideAttrs (old: {
@@ -593,7 +622,7 @@ self: super: {
   });
 
   vim-codefmt = super.vim-codefmt.overrideAttrs (old: {
-    dependencies = with super; [ vim-maktaba ];
+    dependencies = with self; [ vim-maktaba ];
   });
 
   vim-dasht = super.vim-dasht.overrideAttrs (old: {
@@ -604,7 +633,7 @@ self: super: {
   });
 
   vim-easytags = super.vim-easytags.overrideAttrs (old: {
-    dependencies = with super; [ vim-misc ];
+    dependencies = with self; [ vim-misc ];
     patches = [
       (fetchpatch {
         # https://github.com/xolox/vim-easytags/pull/170 fix version detection for universal-ctags
@@ -649,7 +678,7 @@ self: super: {
     });
 
   vim-gist = super.vim-gist.overrideAttrs (old: {
-    dependencies = with super; [ webapi-vim ];
+    dependencies = with self; [ webapi-vim ];
   });
 
   vim-grammarous = super.vim-grammarous.overrideAttrs (old: {
@@ -713,7 +742,7 @@ self: super: {
   });
 
   vim-snipmate = super.vim-snipmate.overrideAttrs (old: {
-    dependencies = with super; [ vim-addon-mw-utils tlib_vim ];
+    dependencies = with self; [ vim-addon-mw-utils tlib_vim ];
   });
 
   vim-stylish-haskell = super.vim-stylish-haskell.overrideAttrs (old: {
@@ -751,7 +780,7 @@ self: super: {
     pname = "vim2nix";
     version = "1.0";
     src = ./vim2nix;
-    dependencies = with super; [ vim-addon-manager ];
+    dependencies = with self; [ vim-addon-manager ];
   };
 
   vimacs = super.vimacs.overrideAttrs (old: {
@@ -791,7 +820,7 @@ self: super: {
   });
 
   vimshell-vim = super.vimshell-vim.overrideAttrs (old: {
-    dependencies = with super; [ vimproc-vim ];
+    dependencies = with self; [ vimproc-vim ];
   });
 
   YankRing-vim = super.YankRing-vim.overrideAttrs (old: {
diff --git a/third_party/nixpkgs/pkgs/misc/vim-plugins/vim-plugin-names b/third_party/nixpkgs/pkgs/misc/vim-plugins/vim-plugin-names
index 5421387e95..ecaa316c46 100644
--- a/third_party/nixpkgs/pkgs/misc/vim-plugins/vim-plugin-names
+++ b/third_party/nixpkgs/pkgs/misc/vim-plugins/vim-plugin-names
@@ -62,7 +62,6 @@ chriskempson/base16-vim
 ChristianChiarulli/nvcode-color-schemes.vim
 christoomey/vim-sort-motion
 christoomey/vim-tmux-navigator
-chuling/ci_dark
 ckarnell/antonys-macro-repeater
 clojure-vim/vim-jack-in
 cloudhead/neovim-fuzzy
@@ -140,6 +139,7 @@ fruit-in/vim-nong-theme
 fsharp/vim-fsharp
 fszymanski/deoplete-emoji
 garbas/vim-snipmate
+gcmt/wildfire.vim
 gennaro-tedesco/nvim-peekup
 gentoo/gentoo-syntax
 GEverding/vim-hocon
@@ -269,6 +269,7 @@ kana/vim-textobj-user
 kassio/neoterm
 kbenzie/vim-spirv
 kchmck/vim-coffee-script
+kdheepak/lazygit.nvim
 KeitaNakamura/neodark.vim
 keith/investigate.vim
 keith/rspec.vim
@@ -292,6 +293,7 @@ kyazdani42/nvim-tree.lua
 kyazdani42/nvim-web-devicons
 lambdalisue/fern.vim
 lambdalisue/gina.vim
+lambdalisue/suda.vim
 lambdalisue/vim-gista
 lambdalisue/vim-manpager
 lambdalisue/vim-pager
@@ -366,6 +368,7 @@ mfukar/robotframework-vim
 mfussenegger/nvim-dap
 mfussenegger/nvim-jdtls
 mg979/vim-visual-multi
+mg979/vim-xtabline
 mhartington/oceanic-next
 mhinz/vim-crates
 mhinz/vim-grepper
@@ -624,6 +627,7 @@ tommcdo/vim-ninja-feet
 tomtom/tcomment_vim
 tomtom/tlib_vim
 tools-life/taskwiki
+towolf/vim-helm
 tpope/vim-abolish
 tpope/vim-capslock
 tpope/vim-commentary
@@ -749,7 +753,9 @@ Xuyuanp/nerdtree-git-plugin
 yamatsum/nvim-nonicons@main
 ycm-core/YouCompleteMe
 Yggdroot/indentLine
+Yggdroot/LeaderF
 Yilin-Yang/vim-markbar
 yuki-yano/ncm2-dictionary
+yunlingz/ci_dark
 zah/nim.vim
 ziglang/zig.vim
diff --git a/third_party/nixpkgs/pkgs/os-specific/darwin/xcode/sdk-pkgs.nix b/third_party/nixpkgs/pkgs/os-specific/darwin/xcode/sdk-pkgs.nix
index cabac19ba8..ab934d7eaa 100644
--- a/third_party/nixpkgs/pkgs/os-specific/darwin/xcode/sdk-pkgs.nix
+++ b/third_party/nixpkgs/pkgs/os-specific/darwin/xcode/sdk-pkgs.nix
@@ -29,11 +29,6 @@ rec {
   binutils = wrapBintoolsWith {
     libc = targetIosSdkPkgs.libraries;
     bintools = binutils-unwrapped;
-    extraBuildCommands = lib.optionalString (sdk.platform == "iPhoneSimulator") ''
-      echo "-platform_version ios-sim ${minSdkVersion} ${sdk.version}" >> $out/nix-support/libc-ldflags
-    '' + lib.optionalString (sdk.platform == "iPhoneOS") ''
-      echo "-platform_version ios ${minSdkVersion} ${sdk.version}" >> $out/nix-support/libc-ldflags
-    '';
   };
 
   clang = (wrapCCWith {
@@ -46,10 +41,6 @@ rec {
       mv cc-cflags.tmp $out/nix-support/cc-cflags
       echo "-target ${targetPlatform.config}" >> $out/nix-support/cc-cflags
       echo "-isystem ${sdk}/usr/include${lib.optionalString (lib.versionAtLeast "10" sdk.version) " -isystem ${sdk}/usr/include/c++/4.2.1/ -stdlib=libstdc++"}" >> $out/nix-support/cc-cflags
-    '' + lib.optionalString (sdk.platform == "iPhoneSimulator") ''
-      echo "-mios-simulator-version-min=${minSdkVersion}" >> $out/nix-support/cc-cflags
-    '' + lib.optionalString (sdk.platform == "iPhoneOS") ''
-      echo "-miphoneos-version-min=${minSdkVersion}" >> $out/nix-support/cc-cflags
     '';
   }) // {
     inherit sdk;
diff --git a/third_party/nixpkgs/pkgs/os-specific/linux/anbox/kmod.nix b/third_party/nixpkgs/pkgs/os-specific/linux/anbox/kmod.nix
index f62e6ee6aa..1ed6d9c5f7 100644
--- a/third_party/nixpkgs/pkgs/os-specific/linux/anbox/kmod.nix
+++ b/third_party/nixpkgs/pkgs/os-specific/linux/anbox/kmod.nix
@@ -36,7 +36,7 @@ stdenv.mkDerivation {
     homepage = "https://github.com/anbox/anbox-modules";
     license = licenses.gpl2;
     platforms = platforms.linux;
-    broken = (versionOlder kernel.version "4.4") || (kernel.features.grsecurity or false);
+    broken = (versionOlder kernel.version "4.4");
     maintainers = with maintainers; [ edwtjo ];
   };
 
diff --git a/third_party/nixpkgs/pkgs/os-specific/linux/bluez/default.nix b/third_party/nixpkgs/pkgs/os-specific/linux/bluez/default.nix
index 96f9f23e97..2e342fbc03 100644
--- a/third_party/nixpkgs/pkgs/os-specific/linux/bluez/default.nix
+++ b/third_party/nixpkgs/pkgs/os-specific/linux/bluez/default.nix
@@ -1,6 +1,5 @@
 { stdenv
 , lib
-, fetchpatch
 , fetchurl
 , alsaLib
 , dbus
@@ -20,11 +19,11 @@
   ];
 in stdenv.mkDerivation rec {
   pname = "bluez";
-  version = "5.56";
+  version = "5.58";
 
   src = fetchurl {
     url = "mirror://kernel/linux/bluetooth/${pname}-${version}.tar.xz";
-    sha256 = "sha256-WcTbqfyKripqX48S8ZvBsMLcJzVcfKMSPu0/5r19C50=";
+    sha256 = "1wgiv8cqya6n1w5fz24cb8q401bhn5aa6s7g95l26rzblmsmw1n8";
   };
 
   buildInputs = [
@@ -45,15 +44,6 @@ in stdenv.mkDerivation rec {
 
   outputs = [ "out" "dev" ] ++ lib.optional doCheck "test";
 
-  patches = [
-    # Fixes https://github.com/NixOS/nixpkgs/issues/117663
-    (fetchpatch {
-      name = "disconnect-fix.patch";
-      url = "https://github.com/bluez/bluez/commit/28ddec8d6b829e002fa268c07b71e4c564ba9e16.patch";
-      sha256 = "sha256-vzMf1i44e4JrpL7cXbn9oDr+3B+Glf7dPW3QDstEnEM=";
-    })
-  ];
-
   postPatch = ''
     substituteInPlace tools/hid2hci.rules \
       --replace /sbin/udevadm ${systemd}/bin/udevadm \
diff --git a/third_party/nixpkgs/pkgs/os-specific/linux/fuse/common.nix b/third_party/nixpkgs/pkgs/os-specific/linux/fuse/common.nix
index 053ea34c82..cca1ecf5d2 100644
--- a/third_party/nixpkgs/pkgs/os-specific/linux/fuse/common.nix
+++ b/third_party/nixpkgs/pkgs/os-specific/linux/fuse/common.nix
@@ -96,7 +96,7 @@ in stdenv.mkDerivation rec {
     inherit (src.meta) homepage;
     changelog = "https://github.com/libfuse/libfuse/releases/tag/fuse-${version}";
     platforms = platforms.linux;
-    license = with licenses; [ gpl2 lgpl21 ];
+    license = with licenses; [ gpl2Only lgpl21Only ];
     maintainers = [ maintainers.primeos ];
   };
 }
diff --git a/third_party/nixpkgs/pkgs/os-specific/linux/fuse/default.nix b/third_party/nixpkgs/pkgs/os-specific/linux/fuse/default.nix
index 02c46b9ba7..b7ee8772f4 100644
--- a/third_party/nixpkgs/pkgs/os-specific/linux/fuse/default.nix
+++ b/third_party/nixpkgs/pkgs/os-specific/linux/fuse/default.nix
@@ -11,7 +11,7 @@ in {
   };
 
   fuse_3 = mkFuse {
-    version = "3.10.2";
-    sha256Hash = "0m44hhk6jxkgkvk2jsjcwa3pqgzzqnpm606n3n8wn1ldypkvpsps";
+    version = "3.10.3";
+    sha256Hash = "054g3jqy8lhlj8kkwd16wxaxzynmh8h5iv20cryd0psg0hgmhd7v";
   };
 }
diff --git a/third_party/nixpkgs/pkgs/os-specific/linux/kernel/common-config.nix b/third_party/nixpkgs/pkgs/os-specific/linux/kernel/common-config.nix
index 1e20cf6105..5cece836b7 100644
--- a/third_party/nixpkgs/pkgs/os-specific/linux/kernel/common-config.nix
+++ b/third_party/nixpkgs/pkgs/os-specific/linux/kernel/common-config.nix
@@ -12,7 +12,7 @@
 # Configuration
 { lib, stdenv, version
 
-, features ? { grsecurity = false; xen_dom0 = false; }
+, features ? {}
 }:
 
 with lib;
@@ -42,7 +42,7 @@ let
       TIMER_STATS               = whenOlder "4.11" yes;
       DEBUG_NX_TEST             = whenOlder "4.11" no;
       DEBUG_STACK_USAGE         = no;
-      DEBUG_STACKOVERFLOW       = mkIf (!features.grsecurity) (option no);
+      DEBUG_STACKOVERFLOW       = option no;
       RCU_TORTURE_TEST          = no;
       SCHEDSTATS                = no;
       DETECT_HUNG_TASK          = yes;
@@ -443,7 +443,7 @@ let
       SECURITY_SELINUX_BOOTPARAM_VALUE = whenOlder "5.1" (freeform "0"); # Disable SELinux by default
       # Prevent processes from ptracing non-children processes
       SECURITY_YAMA                    = option yes;
-      DEVKMEM                          = mkIf (!features.grsecurity) no; # Disable /dev/kmem
+      DEVKMEM                          = no; # Disable /dev/kmem
 
       USER_NS                          = yes; # Support for user namespaces
 
@@ -523,7 +523,7 @@ let
     virtualisation = {
       PARAVIRT = option yes;
 
-      HYPERVISOR_GUEST = mkIf (!features.grsecurity) yes;
+      HYPERVISOR_GUEST = yes;
       PARAVIRT_SPINLOCKS  = option yes;
 
       KVM_APIC_ARCHITECTURE             = whenOlder "4.8" yes;
@@ -531,7 +531,7 @@ let
       KVM_COMPAT = { optional = true; tristate = whenBetween "4.0" "4.12" "y"; };
       KVM_DEVICE_ASSIGNMENT  = { optional = true; tristate = whenBetween "3.10" "4.12" "y"; };
       KVM_GENERIC_DIRTYLOG_READ_PROTECT = whenAtLeast "4.0"  yes;
-      KVM_GUEST                         = mkIf (!features.grsecurity) yes;
+      KVM_GUEST                         = yes;
       KVM_MMIO                          = yes;
       KVM_VFIO                          = yes;
       KSM = yes;
@@ -547,13 +547,8 @@ let
       VBOXGUEST = option no;
       DRM_VBOXVIDEO = option no;
 
-    } // optionalAttrs (stdenv.isx86_64 || stdenv.isi686) ({
-      XEN = option yes;
-
-      # XXX: why isn't this in the xen-dom0 conditional section below?
-      XEN_DOM0 = option yes;
-
-    } // optionalAttrs features.xen_dom0 {
+      XEN                         = option yes;
+      XEN_DOM0                    = option yes;
       PCI_XEN                     = option yes;
       HVC_XEN                     = option yes;
       HVC_XEN_FRONTEND            = option yes;
@@ -572,7 +567,7 @@ let
       XEN_SELFBALLOONING          = option yes;
       XEN_STUB                    = option yes;
       XEN_TMEM                    = option yes;
-    });
+    };
 
     media = {
       MEDIA_DIGITAL_TV_SUPPORT = yes;
diff --git a/third_party/nixpkgs/pkgs/os-specific/linux/kernel/generic.nix b/third_party/nixpkgs/pkgs/os-specific/linux/kernel/generic.nix
index 0a9c2d11fe..68a1fcdb0e 100644
--- a/third_party/nixpkgs/pkgs/os-specific/linux/kernel/generic.nix
+++ b/third_party/nixpkgs/pkgs/os-specific/linux/kernel/generic.nix
@@ -46,7 +46,6 @@
                        stdenv.hostPlatform != stdenv.buildPlatform
 , extraMeta ? {}
 
-, isXen      ? features.xen_dom0 or false
 , isZen      ? false
 , isLibre    ? false
 , isHardened ? false
@@ -73,8 +72,6 @@ let
     efiBootStub = true;
     needsCifsUtils = true;
     netfilterRPFilter = true;
-    grsecurity = false;
-    xen_dom0 = false;
     ia32Emulation = true;
   } // features) kernelPatches;
 
@@ -178,7 +175,8 @@ let
 
   passthru = {
     features = kernelFeatures;
-    inherit commonStructuredConfig isXen isZen isHardened isLibre modDirVersion;
+    inherit commonStructuredConfig isZen isHardened isLibre modDirVersion;
+    isXen = lib.warn "The isXen attribute is deprecated. All Nixpkgs kernels that support it now have Xen enabled." true;
     kernelOlder = lib.versionOlder version;
     kernelAtLeast = lib.versionAtLeast version;
     passthru = kernel.passthru // (removeAttrs passthru [ "passthru" ]);
diff --git a/third_party/nixpkgs/pkgs/os-specific/linux/kernel/linux-lqx.nix b/third_party/nixpkgs/pkgs/os-specific/linux/kernel/linux-lqx.nix
index 8662fbbd18..8d0333e8fd 100644
--- a/third_party/nixpkgs/pkgs/os-specific/linux/kernel/linux-lqx.nix
+++ b/third_party/nixpkgs/pkgs/os-specific/linux/kernel/linux-lqx.nix
@@ -1,7 +1,7 @@
 { lib, fetchFromGitHub, buildLinux, linux_zen, ... } @ args:
 
 let
-  version = "5.11.15";
+  version = "5.11.16";
   suffix = "lqx1";
 in
 
@@ -14,7 +14,7 @@ buildLinux (args // {
     owner = "zen-kernel";
     repo = "zen-kernel";
     rev = "v${version}-${suffix}";
-    sha256 = "1dwibknj4q8cd3mim679mrb4j8yi7p4q9qjcb4rwvw0yzgxmz3lv";
+    sha256 = "1j25r45arikjwyhbr72r1935pr7a8g2j6vshggywdiixvizvrx9b";
   };
 
   extraMeta = {
diff --git a/third_party/nixpkgs/pkgs/os-specific/linux/kernel/linux-zen.nix b/third_party/nixpkgs/pkgs/os-specific/linux/kernel/linux-zen.nix
index 92aaa95745..b28400819d 100644
--- a/third_party/nixpkgs/pkgs/os-specific/linux/kernel/linux-zen.nix
+++ b/third_party/nixpkgs/pkgs/os-specific/linux/kernel/linux-zen.nix
@@ -1,7 +1,7 @@
 { lib, fetchFromGitHub, buildLinux, ... } @ args:
 
 let
-  version = "5.11.15";
+  version = "5.11.16";
   suffix = "zen1";
 in
 
@@ -14,7 +14,7 @@ buildLinux (args // {
     owner = "zen-kernel";
     repo = "zen-kernel";
     rev = "v${version}-${suffix}";
-    sha256 = "0n9wm0lpwkqd79112k03lxp4hc898nvs2jjw3hxzggn5wk4i2dz9";
+    sha256 = "0jyicnpqccn194jrm1mc4zq0cil7ls9l57ws3nv783vlk7b0k3gv";
   };
 
   extraMeta = {
diff --git a/third_party/nixpkgs/pkgs/os-specific/linux/kernel/manual-config.nix b/third_party/nixpkgs/pkgs/os-specific/linux/kernel/manual-config.nix
index 2fc63322f5..e45b21ff35 100644
--- a/third_party/nixpkgs/pkgs/os-specific/linux/kernel/manual-config.nix
+++ b/third_party/nixpkgs/pkgs/os-specific/linux/kernel/manual-config.nix
@@ -37,7 +37,6 @@ in {
   extraMeta ? {},
 
   # for module compatibility
-  isXen      ? features.xen_dom0 or false,
   isZen      ? false,
   isLibre    ? false,
   isHardened ? false,
@@ -94,7 +93,8 @@ let
       passthru = {
         inherit version modDirVersion config kernelPatches configfile
           moduleBuildDependencies stdenv;
-        inherit isXen isZen isHardened isLibre;
+        inherit isZen isHardened isLibre;
+        isXen = lib.warn "The isXen attribute is deprecated. All Nixpkgs kernels that support it now have Xen enabled." true;
         kernelOlder = lib.versionOlder version;
         kernelAtLeast = lib.versionAtLeast version;
       };
diff --git a/third_party/nixpkgs/pkgs/os-specific/linux/libcap/default.nix b/third_party/nixpkgs/pkgs/os-specific/linux/libcap/default.nix
index 871e04648e..47fa7c05e7 100644
--- a/third_party/nixpkgs/pkgs/os-specific/linux/libcap/default.nix
+++ b/third_party/nixpkgs/pkgs/os-specific/linux/libcap/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, buildPackages, fetchurl, attr, perl
+{ stdenv, lib, buildPackages, fetchurl, attr, perl, runtimeShell
 , usePam ? !isStatic, pam ? null
 , isStatic ? stdenv.hostPlatform.isStatic
 }:
@@ -33,7 +33,7 @@ stdenv.mkDerivation rec {
 
   prePatch = ''
     # use full path to bash
-    substituteInPlace progs/capsh.c --replace "/bin/bash" "${stdenv.shell}"
+    substituteInPlace progs/capsh.c --replace "/bin/bash" "${runtimeShell}"
 
     # set prefixes
     substituteInPlace Make.Rules \
diff --git a/third_party/nixpkgs/pkgs/os-specific/linux/libfabric/default.nix b/third_party/nixpkgs/pkgs/os-specific/linux/libfabric/default.nix
index 0bc1ed123d..9a1e44f6af 100644
--- a/third_party/nixpkgs/pkgs/os-specific/linux/libfabric/default.nix
+++ b/third_party/nixpkgs/pkgs/os-specific/linux/libfabric/default.nix
@@ -2,7 +2,7 @@
 
 stdenv.mkDerivation rec {
   pname = "libfabric";
-  version = "1.12.0";
+  version = "1.12.1";
 
   enableParallelBuilding = true;
 
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
     owner = "ofiwg";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-OFp6nEW5D8vjglqLRbEgKryb2/KFuJD8Zn6rkpcuPh0=";
+    sha256 = "sha256-J2PoDwjPWYpagX4M2k9E1xitBzgRUZzwX9Gf00H+Tdc=";
   };
 
   nativeBuildInputs = [ pkg-config autoreconfHook ] ;
diff --git a/third_party/nixpkgs/pkgs/os-specific/linux/libselinux/default.nix b/third_party/nixpkgs/pkgs/os-specific/linux/libselinux/default.nix
index 6582c6d8e8..2c9239b2e7 100644
--- a/third_party/nixpkgs/pkgs/os-specific/linux/libselinux/default.nix
+++ b/third_party/nixpkgs/pkgs/os-specific/linux/libselinux/default.nix
@@ -35,15 +35,16 @@ stdenv.mkDerivation rec {
     "MAN3DIR=$(man)/share/man/man3"
     "MAN5DIR=$(man)/share/man/man5"
     "MAN8DIR=$(man)/share/man/man8"
-    "PYTHON=${python3.pythonForBuild}/bin/python"
-    "PYTHONLIBDIR=$(py)/${python3.sitePackages}"
     "SBINDIR=$(bin)/sbin"
     "SHLIBDIR=$(out)/lib"
 
     "LIBSEPOLA=${lib.getLib libsepol}/lib/libsepol.a"
+  ] ++ optionals enablePython [
+    "PYTHON=${python3.pythonForBuild.interpreter}"
+    "PYTHONLIBDIR=$(py)/${python3.sitePackages}"
   ];
 
-  preInstall = ''
+  preInstall = optionalString enablePython ''
     mkdir -p $py/${python3.sitePackages}/selinux
   '';
 
diff --git a/third_party/nixpkgs/pkgs/os-specific/linux/shadow/default.nix b/third_party/nixpkgs/pkgs/os-specific/linux/shadow/default.nix
index 0ff6fa1f34..e20023b2b6 100644
--- a/third_party/nixpkgs/pkgs/os-specific/linux/shadow/default.nix
+++ b/third_party/nixpkgs/pkgs/os-specific/linux/shadow/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, nixosTests, fetchpatch, fetchFromGitHub, autoreconfHook, libxslt
-, libxml2 , docbook_xml_dtd_45, docbook_xsl, itstool, flex, bison
+, libxml2 , docbook_xml_dtd_45, docbook_xsl, itstool, flex, bison, runtimeShell
 , pam ? null, glibcCross ? null
 }:
 
@@ -38,8 +38,11 @@ stdenv.mkDerivation rec {
       # Obtain XML resources from XML catalog (patch adapted from gtk-doc)
       ./respect-xml-catalog-files-var.patch
       dots_in_usernames
+      ./runtime-shell.patch
     ];
 
+  RUNTIME_SHELL = runtimeShell;
+
   # The nix daemon often forbids even creating set[ug]id files.
   postPatch =
     ''sed 's/^\(s[ug]idperms\) = [0-9]755/\1 = 0755/' -i src/Makefile.am
@@ -77,6 +80,8 @@ stdenv.mkDerivation rec {
       mv $out/bin/su $su/bin
     '';
 
+  disallowedReferences = lib.optional (stdenv.buildPlatform != stdenv.hostPlatform) stdenv.shellPackage;
+
   meta = with lib; {
     homepage = "https://github.com/shadow-maint";
     description = "Suite containing authentication-related tools such as passwd and su";
diff --git a/third_party/nixpkgs/pkgs/os-specific/linux/shadow/runtime-shell.patch b/third_party/nixpkgs/pkgs/os-specific/linux/shadow/runtime-shell.patch
new file mode 100644
index 0000000000..0b2e68e330
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/os-specific/linux/shadow/runtime-shell.patch
@@ -0,0 +1,13 @@
+diff --git a/configure.ac b/configure.ac
+index e4c6aaec..03883ad7 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -682,7 +682,7 @@ if test "$enable_utmpx" = "yes"; then
+ 	          [Define if utmpx should be used])
+ fi
+ 
+-AC_DEFINE_UNQUOTED(SHELL, ["$SHELL"], [The default shell.])
++AC_DEFINE_UNQUOTED(SHELL, ["$RUNTIME_SHELL"], [The runtime shell.])
+ 
+ AM_GNU_GETTEXT_VERSION(0.16)
+ AM_GNU_GETTEXT([external], [need-ngettext])
diff --git a/third_party/nixpkgs/pkgs/os-specific/linux/usbip/default.nix b/third_party/nixpkgs/pkgs/os-specific/linux/usbip/default.nix
index d98559c460..43c22a8fd1 100644
--- a/third_party/nixpkgs/pkgs/os-specific/linux/usbip/default.nix
+++ b/third_party/nixpkgs/pkgs/os-specific/linux/usbip/default.nix
@@ -27,7 +27,7 @@ stdenv.mkDerivation {
   meta = with lib; {
     homepage = "https://github.com/torvalds/linux/tree/master/tools/usb/usbip";
     description = "allows to pass USB device from server to client over the network";
-    license = licenses.gpl2;
+    license = with licenses; [ gpl2Only gpl2Plus ];
     platforms = platforms.linux;
     broken = kernelOlder "4.10";
   };
diff --git a/third_party/nixpkgs/pkgs/os-specific/linux/util-linux/default.nix b/third_party/nixpkgs/pkgs/os-specific/linux/util-linux/default.nix
index d7629f0df0..73f321f263 100644
--- a/third_party/nixpkgs/pkgs/os-specific/linux/util-linux/default.nix
+++ b/third_party/nixpkgs/pkgs/os-specific/linux/util-linux/default.nix
@@ -1,22 +1,17 @@
-{ lib, stdenv, fetchurl, fetchpatch, pkg-config, zlib, shadow
+{ lib, stdenv, fetchurl, pkg-config, zlib, shadow, libcap_ng
 , ncurses ? null, perl ? null, pam, systemd ? null, minimal ? false }:
 
 stdenv.mkDerivation rec {
   pname = "util-linux";
-  version = "2.36.1";
+  version = "2.36.2";
 
   src = fetchurl {
     url = "mirror://kernel/linux/utils/util-linux/v${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "1vbyydl1b13lx73di4bhc4br9ih24hcqv7bky0kyrn1c2x1c5yh9";
+    sha256 = "0psc0asjp1rmfx1j7468zfnk9nphlphybw2n8dcl74v8v2lnnlgp";
   };
 
   patches = [
     ./rtcwake-search-PATH-for-shutdown.patch
-    # Remove patch below in 2.36.2, see https://github.com/karelzak/util-linux/issues/1193
-    (fetchpatch {
-      url = "https://github.com/karelzak/util-linux/commit/52f730e47869ce630fafb24fd46f755dc7ffc691.patch";
-      sha256 = "1fz3p9127lfvmrdj1j1s8jds0jjz2dzkvmia66555ihv7hcfajbg";
-    })
   ];
 
   outputs = [ "bin" "dev" "out" "man" ];
@@ -57,7 +52,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs =
-    [ zlib pam ]
+    [ zlib pam libcap_ng ]
     ++ lib.filter (p: p != null) [ ncurses systemd perl ];
 
   doCheck = false; # "For development purpose only. Don't execute on production system!"
@@ -71,7 +66,9 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     homepage = "https://www.kernel.org/pub/linux/utils/util-linux/";
     description = "A set of system utilities for Linux";
-    license = licenses.gpl2; # also contains parts under more permissive licenses
+    changelog = "https://mirrors.edge.kernel.org/pub/linux/utils/util-linux/v${lib.versions.majorMinor version}/v${version}-ReleaseNotes";
+    # https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/tree/README.licensing
+    license = with licenses; [ gpl2Only gpl2Plus gpl3Plus lgpl21Plus bsd3 bsdOriginalUC publicDomain ];
     platforms = platforms.linux;
     priority = 6; # lower priority than coreutils ("kill") and shadow ("login" etc.) packages
   };
diff --git a/third_party/nixpkgs/pkgs/servers/calibre-web/default.nix b/third_party/nixpkgs/pkgs/servers/calibre-web/default.nix
index f24a1f32f8..53db5f7ed0 100644
--- a/third_party/nixpkgs/pkgs/servers/calibre-web/default.nix
+++ b/third_party/nixpkgs/pkgs/servers/calibre-web/default.nix
@@ -53,7 +53,6 @@ python3.pkgs.buildPythonApplication rec {
     iso-639
     pypdf2
     requests
-    singledispatch
     sqlalchemy
     tornado
     unidecode
diff --git a/third_party/nixpkgs/pkgs/servers/clickhouse/default.nix b/third_party/nixpkgs/pkgs/servers/clickhouse/default.nix
index 063964b2f6..02c0b4aa5e 100644
--- a/third_party/nixpkgs/pkgs/servers/clickhouse/default.nix
+++ b/third_party/nixpkgs/pkgs/servers/clickhouse/default.nix
@@ -70,6 +70,9 @@ stdenv.mkDerivation rec {
 
   hardeningDisable = [ "format" ];
 
+  # Builds in 7+h with 2 cores, and ~20m with a big-parallel builder.
+  requiredSystemFeatures = [ "big-parallel" ];
+
   meta = with lib; {
     homepage = "https://clickhouse.tech/";
     description = "Column-oriented database management system";
diff --git a/third_party/nixpkgs/pkgs/servers/home-assistant/component-packages.nix b/third_party/nixpkgs/pkgs/servers/home-assistant/component-packages.nix
index d3270846a5..cf8c0641bc 100644
--- a/third_party/nixpkgs/pkgs/servers/home-assistant/component-packages.nix
+++ b/third_party/nixpkgs/pkgs/servers/home-assistant/component-packages.nix
@@ -573,7 +573,7 @@
     "number" = ps: with ps; [ ];
     "nut" = ps: with ps; [ ]; # missing inputs: pynut2
     "nws" = ps: with ps; [ pynws ];
-    "nx584" = ps: with ps; [ ]; # missing inputs: pynx584
+    "nx584" = ps: with ps; [ pynx584 ];
     "nzbget" = ps: with ps; [ ]; # missing inputs: pynzbgetapi
     "oasa_telematics" = ps: with ps; [ ]; # missing inputs: oasatelematics
     "obihai" = ps: with ps; [ ]; # missing inputs: pyobihai
diff --git a/third_party/nixpkgs/pkgs/servers/home-assistant/default.nix b/third_party/nixpkgs/pkgs/servers/home-assistant/default.nix
index 1953faea95..cb45573808 100644
--- a/third_party/nixpkgs/pkgs/servers/home-assistant/default.nix
+++ b/third_party/nixpkgs/pkgs/servers/home-assistant/default.nix
@@ -55,6 +55,14 @@ let
       });
     })
 
+    # Pinned due to API changes in pyjwt>=2.0
+    (mkOverride "pyjwt" "1.7.1"
+      "15hflax5qkw1v6nssk1r0wkj83jgghskcmn875m3wgvpzdvajncd")
+
+    # Pinned due to API changes in pykmtronic>=0.2.0
+    (mkOverride "pykmtronic" "0.0.3"
+      "sha256-8bxn27DU1XUQUxQFJklEge29DHx1DMu7pJG4hVE1jDU=")
+
     # Pinned due to API changes in pylilterbot>=2021.3.0
     # https://github.com/home-assistant/core/pull/48300; Remove >= 2021.5
     (self: super: {
@@ -324,6 +332,7 @@ in with py.pkgs; buildPythonApplication rec {
     "notify"
     "notion"
     "number"
+    "nx584"
     "omnilogic"
     "ondilo_ico"
     "openerz"
diff --git a/third_party/nixpkgs/pkgs/servers/jellyfin/10.5.x.nix b/third_party/nixpkgs/pkgs/servers/jellyfin/10.5.x.nix
deleted file mode 100644
index 9bece72566..0000000000
--- a/third_party/nixpkgs/pkgs/servers/jellyfin/10.5.x.nix
+++ /dev/null
@@ -1,61 +0,0 @@
-{ stdenv, lib, fetchurl, unzip, sqlite, makeWrapper, dotnetCorePackages, ffmpeg,
-  fontconfig, freetype, nixosTests }:
-
-let
-  os = if stdenv.isDarwin then "osx" else "linux";
-  arch =
-    with stdenv.hostPlatform;
-    if isx86_32 then "x86"
-    else if isx86_64 then "x64"
-    else if isAarch32 then "arm"
-    else if isAarch64 then "arm64"
-    else lib.warn "Unsupported architecture, some image processing features might be unavailable" "unknown";
-  musl = lib.optionalString stdenv.hostPlatform.isMusl
-    (if (arch != "x64")
-      then lib.warn "Some image processing features might be unavailable for non x86-64 with Musl" "musl-"
-      else "musl-");
-  runtimeDir = "${os}-${musl}${arch}";
-
-in stdenv.mkDerivation rec {
-  pname = "jellyfin";
-  version = "10.5.5";
-
-  # Impossible to build anything offline with dotnet
-  src = fetchurl {
-    url = "https://github.com/jellyfin/jellyfin/releases/download/v${version}/jellyfin_${version}_portable.tar.gz";
-    sha256 = "1s3hva1j5w74qc9wyqnmr5clk4smzfi7wvx8qrzrwy81mx7r5w27";
-  };
-
-  nativeBuildInputs = [ unzip ];
-  buildInputs = [
-    makeWrapper
-  ];
-
-  propagatedBuildInputs = [
-    dotnetCorePackages.aspnetcore_3_1
-    sqlite
-  ];
-
-  preferLocalBuild = true;
-
-  installPhase = ''
-    install -dm 755 "$out/opt/jellyfin"
-    cp -r * "$out/opt/jellyfin"
-    makeWrapper "${dotnetCorePackages.aspnetcore_3_1}/bin/dotnet" $out/bin/jellyfin \
-      --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [
-        sqlite fontconfig freetype stdenv.cc.cc.lib
-      ]}:$out/opt/jellyfin/runtimes/${runtimeDir}/native/" \
-      --add-flags "$out/opt/jellyfin/jellyfin.dll --ffmpeg ${ffmpeg}/bin/ffmpeg"
-  '';
-
-  passthru.tests = {
-    smoke-test = nixosTests.jellyfin;
-  };
-
-  meta =  with lib; {
-    description = "The Free Software Media System";
-    homepage = "https://jellyfin.org/";
-    license = licenses.gpl2;
-    maintainers = with maintainers; [ nyanloutre minijackson ];
-  };
-}
diff --git a/third_party/nixpkgs/pkgs/servers/mail/dovecot/plugins/fts_xapian/default.nix b/third_party/nixpkgs/pkgs/servers/mail/dovecot/plugins/fts_xapian/default.nix
index eb3f8bf19c..a20068767e 100644
--- a/third_party/nixpkgs/pkgs/servers/mail/dovecot/plugins/fts_xapian/default.nix
+++ b/third_party/nixpkgs/pkgs/servers/mail/dovecot/plugins/fts_xapian/default.nix
@@ -1,13 +1,13 @@
 { lib, stdenv, fetchFromGitHub, autoconf, automake, pkg-config, dovecot, libtool, xapian, icu64 }:
 stdenv.mkDerivation rec {
   pname = "fts-xapian";
-  version = "1.4.7";
+  version = "1.4.9";
 
   src = fetchFromGitHub {
     owner = "grosjo";
     repo = "fts-xapian";
     rev = version;
-    sha256 = "K2d1FFAilIggNuP0e698s+9bN08x2s/0Jryp7pmeixc=";
+    sha256 = "0p4ps9h24vr9bldrcf9cdx6l4rdz5i8zyc58qp10h7cc3jilwddy";
   };
 
   buildInputs = [ dovecot xapian icu64 ];
@@ -28,8 +28,9 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     homepage = "https://github.com/grosjo/fts-xapian";
     description = "Dovecot FTS plugin based on Xapian";
-    license = licenses.lgpl21;
-    maintainers = with maintainers; [ julm ];
+    changelog = "https://github.com/grosjo/fts-xapian/releases";
+    license = licenses.lgpl21Only;
+    maintainers = with maintainers; [ julm symphorien ];
     platforms = platforms.unix;
   };
 }
diff --git a/third_party/nixpkgs/pkgs/servers/mail/spamassassin/default.nix b/third_party/nixpkgs/pkgs/servers/mail/spamassassin/default.nix
index 03a135d6c7..cc06cc6ee6 100644
--- a/third_party/nixpkgs/pkgs/servers/mail/spamassassin/default.nix
+++ b/third_party/nixpkgs/pkgs/servers/mail/spamassassin/default.nix
@@ -1,4 +1,4 @@
-{ lib, fetchurl, perlPackages, makeWrapper, gnupg }:
+{ lib, fetchurl, perlPackages, makeWrapper, gnupg, re2c, gcc, gnumake }:
 
 perlPackages.buildPerlPackage rec {
   pname = "SpamAssassin";
@@ -29,7 +29,7 @@ perlPackages.buildPerlPackage rec {
     mv "rules/"* $out/share/spamassassin/
 
     for n in "$out/bin/"*; do
-      wrapProgram "$n" --prefix PERL5LIB : "$PERL5LIB" --prefix PATH : "${gnupg}/bin"
+      wrapProgram "$n" --prefix PERL5LIB : "$PERL5LIB" --prefix PATH : ${lib.makeBinPath [ gnupg re2c gcc gnumake ]}
     done
   '';
 
diff --git a/third_party/nixpkgs/pkgs/servers/misc/podgrab/default.nix b/third_party/nixpkgs/pkgs/servers/misc/podgrab/default.nix
new file mode 100644
index 0000000000..a5fd230d48
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/servers/misc/podgrab/default.nix
@@ -0,0 +1,30 @@
+{ lib, fetchFromGitHub, buildGoModule, nixosTests }:
+
+buildGoModule rec {
+  pname = "podgrab";
+  version = "unstable-2021-04-14";
+
+  src = fetchFromGitHub {
+    owner = "akhilrex";
+    repo = pname;
+    rev = "3179a875b8b638fb86d0e829d12a9761c1cd7f90";
+    sha256 = "sha256-vhxIm20ZUi+RusrAsSY54tv/D570/oMO5qLz9dNqgqo=";
+  };
+
+  vendorSha256 = "sha256-xY9xNuJhkWPgtqA/FBVIp7GuWOv+3nrz6l3vaZVLlIE=";
+
+  postInstall = ''
+    mkdir -p $out/share/
+    cp -r $src/client $out/share/
+    cp -r $src/webassets $out/share/
+  '';
+
+  passthru.tests = { inherit (nixosTests) podgrab; };
+
+  meta = with lib; {
+    description = "A self-hosted podcast manager to download episodes as soon as they become live";
+    homepage = "https://github.com/akhilrex/podgrab";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ ambroisie ];
+  };
+}
diff --git a/third_party/nixpkgs/pkgs/servers/monitoring/telegraf/default.nix b/third_party/nixpkgs/pkgs/servers/monitoring/telegraf/default.nix
index 285db02e1c..37a4b3e87d 100644
--- a/third_party/nixpkgs/pkgs/servers/monitoring/telegraf/default.nix
+++ b/third_party/nixpkgs/pkgs/servers/monitoring/telegraf/default.nix
@@ -2,7 +2,7 @@
 
 buildGoModule rec {
   pname = "telegraf";
-  version = "1.18.0";
+  version = "1.18.1";
 
   excludedPackages = "test";
 
@@ -12,7 +12,7 @@ buildGoModule rec {
     owner = "influxdata";
     repo = "telegraf";
     rev = "v${version}";
-    sha256 = "sha256-1sFl+F3g2anssW59eKbjPdVCIyGq8JuoJGXVQZys854=";
+    sha256 = "sha256-iFigbnqUXWQrhDovwQYZsr8llkB9553c5LgcKJ78yZ4=";
   };
 
   vendorSha256 = "sha256-m53S/L71nyioCBbIDDAWEnqStBdqTFGq16y5ozsXq1c=";
diff --git a/third_party/nixpkgs/pkgs/servers/nosql/influxdb/default.nix b/third_party/nixpkgs/pkgs/servers/nosql/influxdb/default.nix
index a178d43d23..98bd45516e 100644
--- a/third_party/nixpkgs/pkgs/servers/nosql/influxdb/default.nix
+++ b/third_party/nixpkgs/pkgs/servers/nosql/influxdb/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "influxdb";
-  version = "1.8.4";
+  version = "1.8.5";
 
   src = fetchFromGitHub {
     owner = "influxdata";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-cL+QaUGMElYd6P+xXkQgRnL8BKo2C95bhCwy59kRnwo=";
+    sha256 = "sha256-qKkCTsSUejqJhMzAgFJYMGalAUepUaP/caocRwnKflg=";
   };
 
-  vendorSha256 = "sha256-v4CEkhQiETeU6i186XIE/8z4T71gdKL+6W7sQ7/2RuI=";
+  vendorSha256 = "sha256-t7uwrsrF4LYdRjOhwdsCouDJXvD9364Ma5gvKezvi5o=";
 
   doCheck = false;
 
diff --git a/third_party/nixpkgs/pkgs/servers/simple-http-server/default.nix b/third_party/nixpkgs/pkgs/servers/simple-http-server/default.nix
new file mode 100644
index 0000000000..d93b466401
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/servers/simple-http-server/default.nix
@@ -0,0 +1,29 @@
+{ lib, rustPlatform, fetchFromGitHub, pkg-config, openssl }:
+
+rustPlatform.buildRustPackage rec {
+  pname = "simple-http-server";
+  version = "0.6.1";
+
+  src = fetchFromGitHub {
+    owner = "TheWaWaR";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "01a129i1ph3m8k6zkdcqnnkqbhlqpk7qvvdsz2i2kas54csbgsww";
+  };
+
+  cargoSha256 = "050avk6wff8v1dlsfvxwvldmmgfakdxmhglv2bhvc2f3q8cf1d5d";
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [ openssl ];
+
+  # Currently no tests are implemented, so we avoid building the package twice
+  doCheck = false;
+
+  meta = with lib; {
+    description = "Simple HTTP server in Rust";
+    homepage = "https://github.com/TheWaWaR/simple-http-server";
+    license = licenses.mit;
+    maintainers = with maintainers; [ mephistophiles ];
+  };
+}
diff --git a/third_party/nixpkgs/pkgs/servers/teleport/default.nix b/third_party/nixpkgs/pkgs/servers/teleport/default.nix
index 2350311b9d..c9ace581c7 100644
--- a/third_party/nixpkgs/pkgs/servers/teleport/default.nix
+++ b/third_party/nixpkgs/pkgs/servers/teleport/default.nix
@@ -1,27 +1,27 @@
 # This file was generated by https://github.com/kamilchm/go2nix v2.0-dev
-{ lib, buildGoPackage, zip, fetchFromGitHub, makeWrapper, xdg-utils }:
+{ lib, buildGoModule, zip, fetchFromGitHub, makeWrapper, xdg-utils }:
 let
   webassets = fetchFromGitHub {
     owner = "gravitational";
     repo = "webassets";
-    rev = "8ace0cfcc6867651bed3fd5b5f35aaa2a80e1106";
-    sha256 = "sha256-mzvYysCFMvWHo8Y4cmhAju62jjpe92j564gc12BSdZA=";
+    rev = "cf396f868aebb8ba654ea2398c25f033181e7114";
+    sha256 = "sha256-12jkpWl/kL0ttRHtxyDnKjYAZNrheEGQF8HEGSXvvAk=";
   };
 in
 
-buildGoPackage rec {
+buildGoModule rec {
   pname = "teleport";
-  version = "5.2.1";
+  version = "6.1.2";
 
   # This repo has a private submodule "e" which fetchgit cannot handle without failing.
   src = fetchFromGitHub {
     owner = "gravitational";
     repo = "teleport";
     rev = "v${version}";
-    sha256 = "sha256-8WEVH+04y1/s9KpBlK/LrgHG7qTpu2LqtanKKdi9N08=";
+    sha256 = "sha256-4ZaebTTgGrGRQbMfDw1PL/qtDKmHbSY6kPmWyFeIcAU=";
   };
 
-  goPackagePath = "github.com/gravitational/teleport";
+  vendorSha256 = null;
 
   subPackages = [ "tool/tctl" "tool/teleport" "tool/tsh" ];
 
@@ -29,7 +29,6 @@ buildGoPackage rec {
 
   postBuild = ''
     pushd .
-    cd $NIX_BUILD_TOP/go/src/github.com/gravitational/teleport
     mkdir -p build
     echo "making webassets"
     cp -r ${webassets}/* webassets/
@@ -41,13 +40,21 @@ buildGoPackage rec {
     popd
   '';
 
+  # Do not strip the embedded web assets
+  dontStrip = true;
+
   # Reduce closure size for client machines
   outputs = [ "out" "client" ];
 
   buildTargets = [ "full" ];
 
+  preCheck = ''
+    export HOME=$(mktemp -d)
+  '';
+
   postInstall = ''
     install -Dm755 -t $client/bin $out/bin/tsh
+    wrapProgram $client/bin/tsh --prefix PATH : ${xdg-utils}/bin
     wrapProgram $out/bin/tsh --prefix PATH : ${xdg-utils}/bin
   '';
 
@@ -62,7 +69,7 @@ buildGoPackage rec {
 
   meta = with lib; {
     description = "A SSH CA management suite";
-    homepage = "https://gravitational.com/teleport/";
+    homepage = "https://goteleport.com/";
     license = licenses.asl20;
     maintainers = with maintainers; [ sigma tomberek freezeboy ];
     platforms = platforms.unix;
diff --git a/third_party/nixpkgs/pkgs/servers/x11/xorg/overrides.nix b/third_party/nixpkgs/pkgs/servers/x11/xorg/overrides.nix
index c25285d13e..6ab9f8ed8d 100644
--- a/third_party/nixpkgs/pkgs/servers/x11/xorg/overrides.nix
+++ b/third_party/nixpkgs/pkgs/servers/x11/xorg/overrides.nix
@@ -433,7 +433,7 @@ self: super:
   });
 
   xf86videovmware = super.xf86videovmware.overrideAttrs (attrs: {
-    buildInputs =  attrs.buildInputs ++ [ mesa llvm ]; # for libxatracker
+    buildInputs =  attrs.buildInputs ++ [ mesa mesa.driversdev llvm ]; # for libxatracker
     meta = attrs.meta // {
       platforms = ["i686-linux" "x86_64-linux"];
     };
diff --git a/third_party/nixpkgs/pkgs/servers/zookeeper/default.nix b/third_party/nixpkgs/pkgs/servers/zookeeper/default.nix
index c2315999b3..d5bf7b9101 100644
--- a/third_party/nixpkgs/pkgs/servers/zookeeper/default.nix
+++ b/third_party/nixpkgs/pkgs/servers/zookeeper/default.nix
@@ -1,12 +1,12 @@
-{ lib, stdenv, fetchurl, jre, makeWrapper, bash, coreutils, runtimeShell }:
+{ lib, stdenv, fetchurl, jre, makeWrapper, bash, coreutils }:
 
 stdenv.mkDerivation rec {
   pname = "zookeeper";
-  version = "3.6.2";
+  version = "3.6.3";
 
   src = fetchurl {
     url = "mirror://apache/zookeeper/${pname}-${version}/apache-${pname}-${version}-bin.tar.gz";
-    sha512 = "caff5111bb6876b7124760bc006e6fa2523efa54b99321a3c9cd8192ea0d5596abc7d70a054b1aac9b20a411407dae7611c7aba870c23bff28eb1643ba499199";
+    sha512 = "3f7b1b7d9cf5647d52ad0076c922e108fa956e986b5624667c493cf6d8ff09d3ca88f623c79a799fe49c72e868cb3c9d0f77cb69608de74a183b2cbad10bc827";
   };
 
   nativeBuildInputs = [ makeWrapper ];
@@ -15,6 +15,7 @@ stdenv.mkDerivation rec {
   phases = ["unpackPhase" "installPhase"];
 
   installPhase = ''
+    runHook preInstall
     mkdir -p $out
     cp -R conf docs lib $out
     # Without this, zkCli.sh tries creating a log file in the Nix store.
@@ -31,6 +32,7 @@ stdenv.mkDerivation rec {
         --prefix PATH : "${bash}/bin"
     done
     chmod -x $out/bin/zkEnv.sh
+    runHook postInstall
   '';
 
   meta = with lib; {
diff --git a/third_party/nixpkgs/pkgs/shells/fish/plugins/default.nix b/third_party/nixpkgs/pkgs/shells/fish/plugins/default.nix
index c886173096..42252ccbe3 100644
--- a/third_party/nixpkgs/pkgs/shells/fish/plugins/default.nix
+++ b/third_party/nixpkgs/pkgs/shells/fish/plugins/default.nix
@@ -15,6 +15,8 @@ lib.makeScope newScope (self: with self; {
 
   foreign-env = callPackage ./foreign-env { };
 
+  forgit-fish = callPackage ./forgit.nix { };
+
   fzf-fish = callPackage ./fzf-fish.nix { };
 
   pure = callPackage ./pure.nix { };
diff --git a/third_party/nixpkgs/pkgs/shells/fish/plugins/forgit.nix b/third_party/nixpkgs/pkgs/shells/fish/plugins/forgit.nix
new file mode 100644
index 0000000000..b905b7a258
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/shells/fish/plugins/forgit.nix
@@ -0,0 +1,22 @@
+{ lib, buildFishPlugin, fetchFromGitHub, git, fzf }:
+
+buildFishPlugin rec {
+  pname = "forgit";
+  version = "unstable-2021-04-09";
+
+  buildInputs = [ git fzf ];
+
+  src = fetchFromGitHub {
+    owner = "wfxr";
+    repo = "forgit";
+    rev = "7806fc3ab37ac479c315eb54b164f67ba9ed17ea";
+    sha256 = "sha256-a7wjuqXe3+y5zlgSLk5J31WoORbieFimvtr0FQHRY5M=";
+  };
+
+  meta = with lib; {
+    description = "A utility tool powered by fzf for using git interactively.";
+    homepage = "https://github.com/wfxr/forgit";
+    license = licenses.mit;
+    maintainers = with maintainers; [ happysalada ];
+  };
+}
diff --git a/third_party/nixpkgs/pkgs/stdenv/darwin/default.nix b/third_party/nixpkgs/pkgs/stdenv/darwin/default.nix
index a7b91a82a9..e8b3ef6c10 100644
--- a/third_party/nixpkgs/pkgs/stdenv/darwin/default.nix
+++ b/third_party/nixpkgs/pkgs/stdenv/darwin/default.nix
@@ -1,7 +1,5 @@
 { lib
 , localSystem, crossSystem, config, overlays, crossOverlays ? []
-# Minimum required macOS version, used both for compatibility as well as reproducability.
-, macosVersionMin ? "10.12"
 # Allow passing in bootstrap files directly so we can test the stdenv bootstrap process when changing the bootstrap tools
 , bootstrapFiles ? let
   fetch = { file, sha256, executable ? true }: import <nix/fetchurl.nix> {
@@ -36,8 +34,6 @@ in rec {
     export NIX_IGNORE_LD_THROUGH_GCC=1
     unset SDKROOT
 
-    export MACOSX_DEPLOYMENT_TARGET=${macosVersionMin}
-
     # Workaround for https://openradar.appspot.com/22671534 on 10.11.
     export gl_cv_func_getcwd_abort_bug=no
 
@@ -147,9 +143,6 @@ in rec {
         __stdenvImpureHostDeps = commonImpureHostDeps;
         __extraImpureHostDeps = commonImpureHostDeps;
 
-        extraAttrs = {
-          inherit macosVersionMin;
-        };
         overrides  = self: super: (overrides self super) // {
           inherit ccNoLibcxx;
           fetchurl = thisStdenv.fetchurlBoot;
@@ -523,7 +516,7 @@ in rec {
     extraAttrs = {
       libc = pkgs.darwin.Libsystem;
       shellPackage = pkgs.bash;
-      inherit macosVersionMin bootstrapTools;
+      inherit bootstrapTools;
     };
 
     allowedRequisites = (with pkgs; [
diff --git a/third_party/nixpkgs/pkgs/stdenv/generic/check-meta.nix b/third_party/nixpkgs/pkgs/stdenv/generic/check-meta.nix
index 7fa7f2305e..ac62ad3082 100644
--- a/third_party/nixpkgs/pkgs/stdenv/generic/check-meta.nix
+++ b/third_party/nixpkgs/pkgs/stdenv/generic/check-meta.nix
@@ -203,6 +203,7 @@ let
   metaTypes = with lib.types; rec {
     # These keys are documented
     description = str;
+    mainProgram = str;
     longDescription = str;
     branch = str;
     homepage = either (listOf str) str;
diff --git a/third_party/nixpkgs/pkgs/stdenv/generic/default.nix b/third_party/nixpkgs/pkgs/stdenv/generic/default.nix
index c3582b1667..cb2b2bc51e 100644
--- a/third_party/nixpkgs/pkgs/stdenv/generic/default.nix
+++ b/third_party/nixpkgs/pkgs/stdenv/generic/default.nix
@@ -106,6 +106,8 @@ let
       '' + lib.optionalString (hostPlatform.isDarwin || (hostPlatform.parsed.kernel.execFormat != lib.systems.parse.execFormats.elf && hostPlatform.parsed.kernel.execFormat != lib.systems.parse.execFormats.macho)) ''
         export NIX_DONT_SET_RPATH=1
         export NIX_NO_SELF_RPATH=1
+      '' + lib.optionalString (hostPlatform.isDarwin && hostPlatform.isMacOS) ''
+        export MACOSX_DEPLOYMENT_TARGET=${hostPlatform.darwinMinVersion}
       ''
       # TODO this should be uncommented, but it causes stupid mass rebuilds. I
       # think the best solution would just be to fixup linux RPATHs so we don't
diff --git a/third_party/nixpkgs/pkgs/stdenv/generic/make-derivation.nix b/third_party/nixpkgs/pkgs/stdenv/generic/make-derivation.nix
index 7460941278..730c90c227 100644
--- a/third_party/nixpkgs/pkgs/stdenv/generic/make-derivation.nix
+++ b/third_party/nixpkgs/pkgs/stdenv/generic/make-derivation.nix
@@ -89,6 +89,10 @@ in rec {
 
     , patches ? []
 
+    , __contentAddressed ?
+      (! attrs ? outputHash) # Fixed-output drvs can't be content addressed too
+      && (config.contentAddressedByDefault or false)
+
     , ... } @ attrs:
 
     let
@@ -196,9 +200,7 @@ in rec {
         // (lib.optionalAttrs (attrs ? name || (attrs ? pname && attrs ? version)) {
           name =
             let
-              staticMarker = lib.optionalString stdenv.hostPlatform.isStatic "-static";
-              name' = attrs.name or
-                "${attrs.pname}${staticMarker}-${attrs.version}";
+              # Indicate the host platform of the derivation if cross compiling.
               # Fixed-output derivations like source tarballs shouldn't get a host
               # suffix. But we have some weird ones with run-time deps that are
               # just used for their side-affects. Those might as well since the
@@ -206,7 +208,16 @@ in rec {
               hostSuffix = lib.optionalString
                 (stdenv.hostPlatform != stdenv.buildPlatform && !dontAddHostSuffix)
                 "-${stdenv.hostPlatform.config}";
-            in name' + hostSuffix;
+              # Disambiguate statically built packages. This was originally
+              # introduce as a means to prevent nix-env to get confused between
+              # nix and nixStatic. This should be also achieved by moving the
+              # hostSuffix before the version, so we could contemplate removing
+              # it again.
+              staticMarker = lib.optionalString stdenv.hostPlatform.isStatic "-static";
+            in
+              if attrs ? name
+              then attrs.name + hostSuffix
+              else "${attrs.pname}${staticMarker}${hostSuffix}-${attrs.version}";
         }) // {
           builder = attrs.realBuilder or stdenv.shell;
           args = attrs.args or ["-e" (attrs.builder or ./default-builder.sh)];
@@ -253,6 +264,12 @@ in rec {
           inherit doCheck doInstallCheck;
 
           inherit outputs;
+        } // lib.optionalAttrs (__contentAddressed) {
+          inherit __contentAddressed;
+          # Provide default values for outputHashMode and outputHashAlgo because
+          # most people won't care about these anyways
+          outputHashAlgo = attrs.outputHashAlgo or "sha256";
+          outputHashMode = attrs.outputHashMode or "recursive";
         } // lib.optionalAttrs (stdenv.hostPlatform != stdenv.buildPlatform) {
           cmakeFlags =
             (/**/ if lib.isString cmakeFlags then [cmakeFlags]
diff --git a/third_party/nixpkgs/pkgs/tools/admin/azure-cli/python-packages.nix b/third_party/nixpkgs/pkgs/tools/admin/azure-cli/python-packages.nix
index e81815b065..5c33823929 100644
--- a/third_party/nixpkgs/pkgs/tools/admin/azure-cli/python-packages.nix
+++ b/third_party/nixpkgs/pkgs/tools/admin/azure-cli/python-packages.nix
@@ -427,6 +427,15 @@ let
         };
       });
 
+      pyjwt = super.pyjwt.overridePythonAttrs(oldAttrs: rec {
+        version = "1.7.1";
+
+        src = super.fetchPypi {
+          inherit (oldAttrs) pname;
+          inherit version;
+          sha256 = "15hflax5qkw1v6nssk1r0wkj83jgghskcmn875m3wgvpzdvajncd";
+        };
+      });
 
       knack = super.knack.overridePythonAttrs(oldAttrs: rec {
         version = "0.8.0rc2";
diff --git a/third_party/nixpkgs/pkgs/tools/compression/zstd/default.nix b/third_party/nixpkgs/pkgs/tools/compression/zstd/default.nix
index 6394ea3338..e890518a45 100644
--- a/third_party/nixpkgs/pkgs/tools/compression/zstd/default.nix
+++ b/third_party/nixpkgs/pkgs/tools/compression/zstd/default.nix
@@ -36,13 +36,15 @@ stdenv.mkDerivation rec {
       tests/playTests.sh
   '';
 
-  cmakeFlags = [
-    "-DZSTD_BUILD_SHARED:BOOL=${if (!static) then "ON" else "OFF"}"
-    "-DZSTD_BUILD_STATIC:BOOL=${if static then "ON" else "OFF"}"
-    "-DZSTD_PROGRAMS_LINK_SHARED:BOOL=${if (!static) then "ON" else "OFF"}"
-    "-DZSTD_LEGACY_SUPPORT:BOOL=${if legacySupport then "ON" else "OFF"}"
-    "-DZSTD_BUILD_TESTS:BOOL=ON"
-  ];
+  cmakeFlags = lib.attrsets.mapAttrsToList
+    (name: value: "-DZSTD_${name}:BOOL=${if value then "ON" else "OFF"}") {
+      BUILD_SHARED = !static;
+      BUILD_STATIC = static;
+      PROGRAMS_LINK_SHARED = !static;
+      LEGACY_SUPPORT = legacySupport;
+      BUILD_TESTS = doCheck;
+    };
+
   cmakeDir = "../build/cmake";
   dontUseCmakeBuildDir = true;
   preConfigure = ''
@@ -50,7 +52,7 @@ stdenv.mkDerivation rec {
   '';
 
   checkInputs = [ file ];
-  doCheck = true;
+  doCheck = stdenv.hostPlatform == stdenv.buildPlatform;
   checkPhase = ''
     runHook preCheck
     # Patch shebangs for playTests
diff --git a/third_party/nixpkgs/pkgs/tools/filesystems/avfs/default.nix b/third_party/nixpkgs/pkgs/tools/filesystems/avfs/default.nix
index 3315085191..b4fc7f1e4f 100644
--- a/third_party/nixpkgs/pkgs/tools/filesystems/avfs/default.nix
+++ b/third_party/nixpkgs/pkgs/tools/filesystems/avfs/default.nix
@@ -2,10 +2,10 @@
 
 stdenv.mkDerivation rec {
   pname = "avfs";
-  version = "1.1.3";
+  version = "1.1.4";
   src = fetchurl {
     url = "mirror://sourceforge/avf/${version}/${pname}-${version}.tar.bz2";
-    sha256 = "1psh8k7g7rb0gn7aygbjv86kxyi9xq07barxksa99nnmq3lc2kjg";
+    sha256 = "0ax1zbw4pmggx1b784bfabdqyn39k7109cnl22p69y2phnpq2y9s";
   };
 
   nativeBuildInputs = [ pkg-config ];
@@ -21,6 +21,6 @@ stdenv.mkDerivation rec {
     homepage = "http://avf.sourceforge.net/";
     description = "Virtual filesystem that allows browsing of compressed files";
     platforms = lib.platforms.unix;
-    license = lib.licenses.gpl2;
+    license = lib.licenses.gpl2Only;
   };
 }
diff --git a/third_party/nixpkgs/pkgs/tools/filesystems/btrfs-heatmap/default.nix b/third_party/nixpkgs/pkgs/tools/filesystems/btrfs-heatmap/default.nix
index 04d74d78cf..9de91738e7 100644
--- a/third_party/nixpkgs/pkgs/tools/filesystems/btrfs-heatmap/default.nix
+++ b/third_party/nixpkgs/pkgs/tools/filesystems/btrfs-heatmap/default.nix
@@ -2,25 +2,17 @@
 , fetchFromGitHub
 , python3
 , installShellFiles
-, fetchurl
 }:
 
 stdenv.mkDerivation rec {
   pname = "btrfs-heatmap";
-  version = "8";
+  version = "9";
 
   src = fetchFromGitHub {
     owner = "knorrie";
     repo = "btrfs-heatmap";
     rev = "v${version}";
-    sha256 = "035frvk3s7g18y81srssvm550nfq7jylr7w60nvixidxvrc0yrnh";
-  };
-
-  # man page is currently only in the debian branch
-  # https://github.com/knorrie/btrfs-heatmap/issues/11
-  msrc = fetchurl {
-    url = "https://raw.githubusercontent.com/knorrie/btrfs-heatmap/45d844e12d7f5842ebb99e65d7b968a5e1a89066/debian/man/btrfs-heatmap.8";
-    sha256 = "1md7xc426sc8lq4w29gjd6gv7vjqhcwrqqcr6z39kihvi04d5f6q";
+    sha256 = "sha256-yCkuZqWwxrs2eS7EXY6pAOVVVSq7dAMxJtf581gX8vg=";
   };
 
   buildInputs = [ python3 ];
@@ -29,11 +21,15 @@ stdenv.mkDerivation rec {
   outputs = [ "out" "man" ];
 
   installPhase = ''
-    install -Dm 0755 heatmap.py $out/sbin/btrfs-heatmap
-    installManPage ${msrc}
+    runHook preInstall
+
+    install -Dm 0755 btrfs-heatmap $out/sbin/btrfs-heatmap
+    installManPage man/btrfs-heatmap.1
 
     buildPythonPath ${python3.pkgs.btrfs}
     patchPythonScript $out/sbin/btrfs-heatmap
+
+    runHook postInstall
   '';
 
   meta = with lib; {
diff --git a/third_party/nixpkgs/pkgs/tools/filesystems/ceph/default.nix b/third_party/nixpkgs/pkgs/tools/filesystems/ceph/default.nix
index f47627b5d2..a7add68b2d 100644
--- a/third_party/nixpkgs/pkgs/tools/filesystems/ceph/default.nix
+++ b/third_party/nixpkgs/pkgs/tools/filesystems/ceph/default.nix
@@ -213,6 +213,9 @@ in rec {
 
     doCheck = false; # uses pip to install things from the internet
 
+    # Takes 7+h to build with 2 cores.
+    requiredSystemFeatures = [ "big-parallel" ];
+
     meta = getMeta "Distributed storage system";
 
     passthru.version = version;
diff --git a/third_party/nixpkgs/pkgs/tools/filesystems/gcsfuse/default.nix b/third_party/nixpkgs/pkgs/tools/filesystems/gcsfuse/default.nix
index e39a3d33da..b145d1802a 100644
--- a/third_party/nixpkgs/pkgs/tools/filesystems/gcsfuse/default.nix
+++ b/third_party/nixpkgs/pkgs/tools/filesystems/gcsfuse/default.nix
@@ -2,13 +2,13 @@
 
 buildGoPackage rec {
   pname = "gcsfuse";
-  version = "0.33.2";
+  version = "0.34.1";
 
   src = fetchFromGitHub {
     owner = "googlecloudplatform";
     repo = "gcsfuse";
     rev = "v${version}";
-    sha256 = "sha256-y40JWfD6selBo2IP7VgASmlNUDhXwOdQIRlRHPi3Nh0=";
+    sha256 = "16ns04g4cvp6lfhkifgib5rxpbcxy8ghhavi3mv1cvxawpmdrxnq";
   };
 
   goPackagePath = "github.com/googlecloudplatform/gcsfuse";
diff --git a/third_party/nixpkgs/pkgs/tools/graphics/agi/default.nix b/third_party/nixpkgs/pkgs/tools/graphics/agi/default.nix
index aca53c2546..5fb1881eff 100644
--- a/third_party/nixpkgs/pkgs/tools/graphics/agi/default.nix
+++ b/third_party/nixpkgs/pkgs/tools/graphics/agi/default.nix
@@ -14,11 +14,11 @@
 
 stdenv.mkDerivation rec {
   pname = "agi";
-  version = "1.1.0-dev-20210421";
+  version = "1.1.0-dev-20210423";
 
   src = fetchzip {
     url = "https://github.com/google/agi-dev-releases/releases/download/v${version}/agi-${version}-linux.zip";
-    sha256 = "sha256-2IgGvQy6omDEwrzQDfa/OLi3f+Q2zarvJVGk6ZhsjSA=";
+    sha256 = "sha256-49ZKqG+CiQkdoBMLdYrN5fMnJH5TtXdUknQLQB2UG04=";
   };
 
   nativeBuildInputs = [
diff --git a/third_party/nixpkgs/pkgs/tools/graphics/exif/default.nix b/third_party/nixpkgs/pkgs/tools/graphics/exif/default.nix
index 59c7481112..130e2d9612 100644
--- a/third_party/nixpkgs/pkgs/tools/graphics/exif/default.nix
+++ b/third_party/nixpkgs/pkgs/tools/graphics/exif/default.nix
@@ -1,20 +1,23 @@
-{ lib, stdenv, fetchurl, pkg-config, libexif, popt, libintl }:
+{ lib, stdenv, fetchFromGitHub, autoreconfHook, pkg-config, libexif, popt, libintl }:
 
 stdenv.mkDerivation rec {
-  name = "exif-0.6.21";
+  pname = "exif";
+  version = "0.6.22";
 
-  src = fetchurl {
-    url = "mirror://sourceforge/libexif/${name}.tar.bz2";
-    sha256 = "1zb9hwdl783d4vd2s2rw642hg8hd6n0mfp6lrbiqmp9jmhlq5rsr";
+  src = fetchFromGitHub {
+    owner = "libexif";
+    repo = pname;
+    rev = "${pname}-${builtins.replaceStrings ["."] ["_"] version}-release";
+    sha256 = "1xlb1gdwxm3rmw7vlrynhvjp9dkwmvw23mxisdbdmma7ah2nda3i";
   };
 
-  nativeBuildInputs = [ pkg-config ];
+  nativeBuildInputs = [ autoreconfHook pkg-config ];
   buildInputs = [ libexif popt libintl ];
 
   meta = with lib; {
     homepage = "https://libexif.github.io";
     description = "A utility to read and manipulate EXIF data in digital photographs";
     platforms = platforms.unix;
-    license = licenses.lgpl21;
+    license = licenses.lgpl21Plus;
   };
 }
diff --git a/third_party/nixpkgs/pkgs/tools/graphics/vips/default.nix b/third_party/nixpkgs/pkgs/tools/graphics/vips/default.nix
index 333c4848db..9319fa9b61 100644
--- a/third_party/nixpkgs/pkgs/tools/graphics/vips/default.nix
+++ b/third_party/nixpkgs/pkgs/tools/graphics/vips/default.nix
@@ -27,7 +27,7 @@
 
 stdenv.mkDerivation rec {
   pname = "vips";
-  version = "8.10.5";
+  version = "8.10.6";
 
   outputs = [ "bin" "out" "man" "dev" ];
 
@@ -35,7 +35,7 @@ stdenv.mkDerivation rec {
     owner = "libvips";
     repo = "libvips";
     rev = "v${version}";
-    sha256 = "sha256-h21Ep6f4/y+m0kdrCA5dcULFeOOyLtMx2etAziG6f9Y=";
+    sha256 = "sha256-hdpkBC76PnPTN+rnNchLVk1CrhcClTtbaWyUcyUtuAk=";
     # Remove unicode file names which leads to different checksums on HFS+
     # vs. other filesystems because of unicode normalisation.
     extraPostFetch = ''
diff --git a/third_party/nixpkgs/pkgs/tools/inputmethods/fcitx5/fcitx5-mozc.nix b/third_party/nixpkgs/pkgs/tools/inputmethods/fcitx5/fcitx5-mozc.nix
index d077b0a25c..57bb0220b3 100644
--- a/third_party/nixpkgs/pkgs/tools/inputmethods/fcitx5/fcitx5-mozc.nix
+++ b/third_party/nixpkgs/pkgs/tools/inputmethods/fcitx5/fcitx5-mozc.nix
@@ -1,5 +1,5 @@
 { lib, clangStdenv, fetchFromGitHub, fetchurl, fetchpatch, fetchgit
-, python3Packages, mesa, ninja, pkg-config, protobuf, zinnia, qt5, fcitx5
+, python3Packages, ninja, pkg-config, protobuf, zinnia, qt5, fcitx5
 , jsoncpp, gtest, which, gtk2, unzip, abseil-cpp, breakpad }:
 let
   inherit (python3Packages) python gyp six;
@@ -31,7 +31,7 @@ in clangStdenv.mkDerivation rec {
     sha256 = "R+w0slVFpqtt7PIr1pyupJjRoQsABVZiMdZ9fKGKAqw=";
   };
 
-  nativeBuildInputs = [ gyp ninja mesa python pkg-config qt5.wrapQtAppsHook six which unzip ];
+  nativeBuildInputs = [ gyp ninja python pkg-config qt5.wrapQtAppsHook six which unzip ];
 
   buildInputs = [ protobuf zinnia qt5.qtbase fcitx5 abseil-cpp jsoncpp gtest gtk2 ];
 
diff --git a/third_party/nixpkgs/pkgs/tools/inputmethods/remote-touchpad/default.nix b/third_party/nixpkgs/pkgs/tools/inputmethods/remote-touchpad/default.nix
new file mode 100644
index 0000000000..0bd2b09aaf
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/tools/inputmethods/remote-touchpad/default.nix
@@ -0,0 +1,33 @@
+{ buildGoModule
+, fetchFromGitHub
+, lib
+, libX11
+, libXi
+, libXt
+, libXtst
+}:
+
+buildGoModule rec {
+  pname = "remote-touchpad";
+  version = "1.0.1";
+
+  src = fetchFromGitHub {
+    owner = "unrud";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "0zmbn4s3yhcgmijc96vja7zj2sh6q0nkybhqy0fwz6sqzk8hq02x";
+  };
+
+  buildInputs = [ libX11 libXi libXt libXtst ];
+  buildFlags = [ "-tags" "portal,x11" ];
+
+  vendorSha256 = "0q1qk5g7kqpcci5fgamvxa8989jglv69kwg5rvkphbnx1bzlivrl";
+
+  meta = with lib; {
+    description = "Control mouse and keyboard from the webbrowser of a smartphone.";
+    homepage = "https://github.com/unrud/remote-touchpad";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ schnusch ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/third_party/nixpkgs/pkgs/tools/misc/castty/default.nix b/third_party/nixpkgs/pkgs/tools/misc/castty/default.nix
new file mode 100644
index 0000000000..ddda737c8b
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/tools/misc/castty/default.nix
@@ -0,0 +1,25 @@
+{ stdenv, lib, fetchFromGitHub, libsoundio, lame }:
+
+stdenv.mkDerivation {
+  pname = "castty";
+  version = "unstable-2020-11-10";
+
+  src = fetchFromGitHub {
+    owner = "dhobsd";
+    repo = "castty";
+    rev = "333a2bafd96d56cd0bb91577ae5ba0f7d81b3d99";
+    sha256 = "0p84ivwsp8ds4drn0hx2ax04gp0xyq6blj1iqfsmrs4slrajdmqs";
+  };
+
+  buildInputs = [ libsoundio lame ];
+
+  makeFlags = [ "PREFIX=$(out)" ];
+
+  meta = with lib; {
+    description = "CLI tool to record audio-enabled screencasts of your terminal, for the web";
+    homepage = "https://github.com/dhobsd/castty";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ iblech ];
+    platforms = platforms.unix;
+  };
+}
diff --git a/third_party/nixpkgs/pkgs/development/tools/misc/dialog/default.nix b/third_party/nixpkgs/pkgs/tools/misc/dialog/default.nix
similarity index 88%
rename from third_party/nixpkgs/pkgs/development/tools/misc/dialog/default.nix
rename to third_party/nixpkgs/pkgs/tools/misc/dialog/default.nix
index dca8d9666a..744f55aed1 100644
--- a/third_party/nixpkgs/pkgs/development/tools/misc/dialog/default.nix
+++ b/third_party/nixpkgs/pkgs/tools/misc/dialog/default.nix
@@ -12,14 +12,16 @@ assert unicodeSupport -> ncurses.unicode && ncurses != null;
 
 stdenv.mkDerivation rec {
   pname = "dialog";
-  version = "1.3-20210306";
+  version = "1.3-20210324";
 
   src = fetchurl {
     url = "ftp://ftp.invisible-island.net/dialog/${pname}-${version}.tgz";
-    hash = "sha256-pz57YHtjX2PAICuzMTEG5wD5H+Sp9NJspwA/brK5yw8=";
+    hash = "sha256-AcLR4umvmwg+ogDKrQhP39pVF41bv05Cyf/0STUVFlM=";
   };
 
-  buildInputs = [ ncurses ];
+  buildInputs = [
+    ncurses
+  ];
 
   configureFlags = [
     "--disable-rpath-hacks"
diff --git a/third_party/nixpkgs/pkgs/tools/misc/dylibbundler/default.nix b/third_party/nixpkgs/pkgs/tools/misc/dylibbundler/default.nix
deleted file mode 100644
index 7bf93bf88e..0000000000
--- a/third_party/nixpkgs/pkgs/tools/misc/dylibbundler/default.nix
+++ /dev/null
@@ -1,22 +0,0 @@
-{ lib, stdenv, fetchFromGitHub }:
-
-stdenv.mkDerivation {
-  name = "dylibbundler";
-
-  src  = fetchFromGitHub {
-    owner  = "auriamg";
-    repo   = "/macdylibbundler";
-    rev    = "27923fbf6d1bc4d18c18e118280c4fe51fc41a80";
-    sha256 = "1mpd43hvpfp7pskfrjnd6vcmfii9v3p97q0ws50krkdvshp0bv2h";
-  };
-
-  makeFlags = [ "PREFIX=$(out)" ];
-
-  meta = with lib; {
-    description = "Small command-line program that aims to make bundling .dylibs as easy as possible";
-    homepage    = "https://github.com/auriamg/macdylibbundler";
-    license     = licenses.mit;
-    maintainers = with maintainers; [ alexfmpe ];
-    platforms   = with platforms; darwin ++ linux;
-  };
-}
diff --git a/third_party/nixpkgs/pkgs/tools/misc/fontforge/default.nix b/third_party/nixpkgs/pkgs/tools/misc/fontforge/default.nix
index ffee232172..89bd0f0491 100644
--- a/third_party/nixpkgs/pkgs/tools/misc/fontforge/default.nix
+++ b/third_party/nixpkgs/pkgs/tools/misc/fontforge/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, lib
+{ stdenv, fetchpatch, fetchFromGitHub, lib
 , cmake, perl, uthash, pkg-config, gettext
 , python, freetype, zlib, glib, libungif, libpng, libjpeg, libtiff, libxml2, cairo, pango
 , readline, woff2, zeromq, libuninameslist
@@ -23,6 +23,15 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-Rl/5lbXaPgIndANaD0IakaDus6T53FjiBb45FIuGrvc=";
   };
 
+  patches = [
+    # Allow installing contrib files (e.g. extras and tools).
+    # Taken from https://salsa.debian.org/fonts-team/fontforge/-/blob/master/debian/patches/0001-add-extra-cmake-install-rules.patch
+    (fetchpatch {
+      url = "https://salsa.debian.org/fonts-team/fontforge/raw/76bffe6ccf8ab20a0c81476a80a87ad245e2fd1c/debian/patches/0001-add-extra-cmake-install-rules.patch";
+      sha256 = "u3D9od2xLECNEHhZ+8dkuv9818tPkdP6y/Tvd9CADJg=";
+    })
+  ];
+
   # use $SOURCE_DATE_EPOCH instead of non-deterministic timestamps
   postPatch = ''
     find . -type f -name '*.c' -exec sed -r -i 's#\btime\(&(.+)\)#if (getenv("SOURCE_DATE_EPOCH")) \1=atol(getenv("SOURCE_DATE_EPOCH")); else &#g' {} \;
diff --git a/third_party/nixpkgs/pkgs/tools/misc/goreleaser/default.nix b/third_party/nixpkgs/pkgs/tools/misc/goreleaser/default.nix
index 6b92ecc5ef..77cb54ce58 100644
--- a/third_party/nixpkgs/pkgs/tools/misc/goreleaser/default.nix
+++ b/third_party/nixpkgs/pkgs/tools/misc/goreleaser/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "goreleaser";
-  version = "0.163.1";
+  version = "0.164.0";
 
   src = fetchFromGitHub {
     owner = "goreleaser";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-2SDy/Mk4TkXkJKF1gFW7/FH4Y31TE2X38I0r/Ng/BjU=";
+    sha256 = "sha256-DGiA9Ww/8sHNRgZ7nOx60YVZaxYBH5GJf6KqilwRKrE=";
   };
 
-  vendorSha256 = "sha256-+Qdxnd+IhBNfZ0R2lCfPGJSjpTw1TA6uPjykCfrYtMk=";
+  vendorSha256 = "sha256-y7GesJU2kDtC5S6rnduDX9gcXakNIR8MdLuPW2m1QWs=";
 
   buildFlagsArray = [
     "-ldflags="
diff --git a/third_party/nixpkgs/pkgs/tools/misc/grub/2.0x.nix b/third_party/nixpkgs/pkgs/tools/misc/grub/2.0x.nix
index ad7a74e813..29ce5b23fa 100644
--- a/third_party/nixpkgs/pkgs/tools/misc/grub/2.0x.nix
+++ b/third_party/nixpkgs/pkgs/tools/misc/grub/2.0x.nix
@@ -154,5 +154,7 @@ stdenv.mkDerivation rec {
     license = licenses.gpl3Plus;
 
     platforms = platforms.gnu ++ platforms.linux;
+
+    maintainers = [ maintainers.samueldr ];
   };
 })
diff --git a/third_party/nixpkgs/pkgs/tools/misc/handlr/default.nix b/third_party/nixpkgs/pkgs/tools/misc/handlr/default.nix
index 978168d367..baa718c1b1 100644
--- a/third_party/nixpkgs/pkgs/tools/misc/handlr/default.nix
+++ b/third_party/nixpkgs/pkgs/tools/misc/handlr/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "handlr";
-  version = "0.6.1";
+  version = "0.6.3";
 
   src = fetchFromGitHub {
     owner = "chmln";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0mxkirsicagvfyihcb06g2bsz5h0zp7xc87vldp4amgddzaxhpbg";
+    sha256 = "sha256-OtU6sL2Bbbec0gHxk3bl5Inn+ZmNYiHgpSF0gjDuRSg=";
   };
 
-  cargoSha256 = "11glh6f0cjrq76212h80na2rgwpzjmk0j78y3i98nv203rkrczid";
+  cargoSha256 = "sha256-bX7QWV1R+pLxvghpaV10LeROv4wBVfZhHyrPCIgqETA=";
 
   nativeBuildInputs = [ shared-mime-info ];
 
diff --git a/third_party/nixpkgs/pkgs/tools/misc/nncp/default.nix b/third_party/nixpkgs/pkgs/tools/misc/nncp/default.nix
index 2c821c3336..dbc709dd41 100644
--- a/third_party/nixpkgs/pkgs/tools/misc/nncp/default.nix
+++ b/third_party/nixpkgs/pkgs/tools/misc/nncp/default.nix
@@ -10,11 +10,11 @@
 
 stdenv.mkDerivation rec {
   pname = "nncp";
-  version = "6.3.0";
+  version = "6.4.0";
 
   src = fetchurl {
     url = "http://www.nncpgo.org/download/${pname}-${version}.tar.xz";
-    sha256 = "0ss6p91r9sr3q8p8f6mjjc2cspx3fq0q4w44gfxl0da2wc8nmhkn";
+    sha256 = "16xrwhr7avss238k83ih1njl0gfca57ghg360ba9ixlssrb1239x";
   };
 
   nativeBuildInputs = [ go redo-apenwarr ];
diff --git a/third_party/nixpkgs/pkgs/tools/misc/semiphemeral/default.nix b/third_party/nixpkgs/pkgs/tools/misc/semiphemeral/default.nix
new file mode 100644
index 0000000000..67f0f62e87
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/tools/misc/semiphemeral/default.nix
@@ -0,0 +1,26 @@
+{ lib
+, python3
+}:
+
+python3.pkgs.buildPythonApplication rec {
+  pname = "semiphemeral";
+  version = "0.6";
+
+  src = python3.pkgs.fetchPypi {
+    inherit pname version;
+    sha256 = "c90d73b14c826f262b1339d1f5926c5abc6431181090ea87177af821c0866fb7";
+  };
+
+  doCheck = false; # upstream has no tests
+
+  pythonImportsCheck = [ "semiphemeral" ];
+
+  propagatedBuildInputs = with python3.pkgs; [ click sqlalchemy flask tweepy colorama ];
+
+  meta = with lib; {
+    description = "Automatically delete your old tweets, except for the ones you want to keep";
+    homepage = "https://github.com/micahflee/semiphemeral";
+    license = licenses.mit;
+    maintainers = with maintainers; [ amanjeev ];
+  };
+}
diff --git a/third_party/nixpkgs/pkgs/tools/misc/xflux/gui.nix b/third_party/nixpkgs/pkgs/tools/misc/xflux/gui.nix
index 1637982065..9acd4c442a 100644
--- a/third_party/nixpkgs/pkgs/tools/misc/xflux/gui.nix
+++ b/third_party/nixpkgs/pkgs/tools/misc/xflux/gui.nix
@@ -1,6 +1,6 @@
 { lib, fetchFromGitHub, buildPythonApplication, python3Packages, wrapGAppsHook
 , xflux, librsvg, gtk3, gobject-introspection, pango, gdk-pixbuf, atk
-, pexpect, pyGtkGlade, pygobject3, pyxdg, libappindicator-gtk3
+, pexpect, pygobject3, pyxdg, libappindicator-gtk3
 }:
 buildPythonApplication rec {
   pname = "xflux-gui";
diff --git a/third_party/nixpkgs/pkgs/tools/misc/youtube-dl/default.nix b/third_party/nixpkgs/pkgs/tools/misc/youtube-dl/default.nix
index fa17bea858..3baad9f939 100644
--- a/third_party/nixpkgs/pkgs/tools/misc/youtube-dl/default.nix
+++ b/third_party/nixpkgs/pkgs/tools/misc/youtube-dl/default.nix
@@ -18,11 +18,11 @@ buildPythonPackage rec {
   # The websites youtube-dl deals with are a very moving target. That means that
   # downloads break constantly. Because of that, updates should always be backported
   # to the latest stable release.
-  version = "2021.04.07";
+  version = "2021.04.26";
 
   src = fetchurl {
     url = "https://yt-dl.org/downloads/${version}/${pname}-${version}.tar.gz";
-    sha256 = "02d51l6gdjr3zhhi7ydf5kzv8dv4jzq0ygja7zb2h9k7hnl0l27m";
+    sha256 = "0jpa65jr5djn9175p6a8j9i1zgarshfwfsgmprc0vvnsl3s23ksc";
   };
 
   nativeBuildInputs = [ installShellFiles makeWrapper ];
diff --git a/third_party/nixpkgs/pkgs/tools/misc/zellij/default.nix b/third_party/nixpkgs/pkgs/tools/misc/zellij/default.nix
new file mode 100644
index 0000000000..2f5f221934
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/tools/misc/zellij/default.nix
@@ -0,0 +1,34 @@
+{ lib, fetchFromGitHub, rustPlatform, stdenv, installShellFiles, libiconv }:
+
+rustPlatform.buildRustPackage rec {
+  pname = "zellij";
+  version = "0.5.1";
+
+  src = fetchFromGitHub {
+    owner = "zellij-org";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "102zw4napzx05rpmx6scl6il55syf3lw1gzmy1y66cg1f70sij4d";
+  };
+
+  cargoSha256 = "121fsch0an6d2hqaq0ws9cm7g5ppzfrycmmhajfacfg6wbiax1m5";
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  buildInputs = lib.optionals stdenv.isDarwin [ libiconv ];
+
+  preCheck = ''
+    HOME=$TMPDIR
+  '';
+
+  postInstall = ''
+    installShellCompletion assets/completions/zellij.{bash,fish} --zsh assets/completions/_zellij
+  '';
+
+  meta = with lib; {
+    description = "A terminal workspace with batteries included";
+    homepage = "https://zellij.dev/";
+    license = with licenses; [ mit ];
+    maintainers = with maintainers; [ therealansh ];
+  };
+}
diff --git a/third_party/nixpkgs/pkgs/tools/networking/curl/7.74.0-CVE-2021-22876.patch b/third_party/nixpkgs/pkgs/tools/networking/curl/7.74.0-CVE-2021-22876.patch
new file mode 100644
index 0000000000..f915f298a4
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/tools/networking/curl/7.74.0-CVE-2021-22876.patch
@@ -0,0 +1,139 @@
+Based on upstream 7214288898f5625a6cc196e22a74232eada7861c, adapted by ris to
+compensate for lack of 95cbcec8f986492766c4be3922af1e7644e1e7c5
+
+---
+ lib/transfer.c          | 25 ++++++++++++++--
+ tests/data/Makefile.inc |  2 +-
+ tests/data/test2081     | 66 +++++++++++++++++++++++++++++++++++++++++
+ 3 files changed, 90 insertions(+), 3 deletions(-)
+ create mode 100644 tests/data/test2081
+
+diff --git a/lib/transfer.c b/lib/transfer.c
+index 1976bc0338bc..a68c021c84d6 100644
+--- a/lib/transfer.c
++++ b/lib/transfer.c
+@@ -1581,6 +1581,9 @@ CURLcode Curl_follow(struct Curl_easy *data,
+       data->set.followlocation++; /* count location-followers */
+ 
+       if(data->set.http_auto_referer) {
++        CURLU *u;
++        char *referer;
++
+         /* We are asked to automatically set the previous URL as the referer
+            when we get the next URL. We pick the ->url field, which may or may
+            not be 100% correct */
+@@ -1590,9 +1593,27 @@ CURLcode Curl_follow(struct Curl_easy *data,
+           data->change.referer_alloc = FALSE;
+         }
+ 
+-        data->change.referer = strdup(data->change.url);
+-        if(!data->change.referer)
++        /* Make a copy of the URL without crenditals and fragment */
++        u = curl_url();
++        if(!u)
++          return CURLE_OUT_OF_MEMORY;
++
++        uc = curl_url_set(u, CURLUPART_URL, data->change.url, 0);
++        if(!uc)
++          uc = curl_url_set(u, CURLUPART_FRAGMENT, NULL, 0);
++        if(!uc)
++          uc = curl_url_set(u, CURLUPART_USER, NULL, 0);
++        if(!uc)
++          uc = curl_url_set(u, CURLUPART_PASSWORD, NULL, 0);
++        if(!uc)
++          uc = curl_url_get(u, CURLUPART_URL, &referer, 0);
++
++        curl_url_cleanup(u);
++
++        if(uc || referer == NULL)
+           return CURLE_OUT_OF_MEMORY;
++
++        data->change.referer = referer;
+         data->change.referer_alloc = TRUE; /* yes, free this later */
+       }
+     }
+diff --git a/tests/data/Makefile.inc b/tests/data/Makefile.inc
+index 2c7a0ca89fd8..ea52683d2254 100644
+--- a/tests/data/Makefile.inc
++++ b/tests/data/Makefile.inc
+@@ -225,7 +225,7 @@ test2064 test2065 test2066 test2067 test2068 test2069 \
+ test2064 test2065 test2066 test2067 test2068 test2069 test2070 \
+          test2071 test2072 test2073 test2074 test2075 test2076 test2077 \
+ test2078 \
+-test2080 \
++test2080 test2081 \
+ test2100 \
+ \
+ test3000 test3001 test3002 test3003 test3004 test3005 test3006 test3007 \
+diff --git a/tests/data/test2081 b/tests/data/test2081
+new file mode 100644
+index 000000000000..a6733e737beb
+--- /dev/null
++++ b/tests/data/test2081
+@@ -0,0 +1,66 @@
++<testcase>
++<info>
++<keywords>
++HTTP
++HTTP GET
++referer
++followlocation
++--write-out
++</keywords>
++</info>
++
++# Server-side
++<reply>
++<data nocheck="yes">
++HTTP/1.1 301 This is a weirdo text message swsclose
++Location: data/%TESTNUMBER0002.txt?coolsite=yes
++Content-Length: 62
++Connection: close
++
++This server reply is for testing a simple Location: following
++</data>
++</reply>
++
++# Client-side
++<client>
++<server>
++http
++</server>
++ <name>
++Automatic referrer credential and anchor stripping check
++ </name>
++ <command>
++http://user:pass@%HOSTIP:%HTTPPORT/we/want/our/%TESTNUMBER#anchor --location --referer ';auto' --write-out '%{referer}\n'
++</command>
++</client>
++
++# Verify data after the test has been "shot"
++<verify>
++<errorcode>
++52
++</errorcode>
++<protocol>
++GET /we/want/our/%TESTNUMBER HTTP/1.1
++Host: %HOSTIP:%HTTPPORT
++Authorization: Basic dXNlcjpwYXNz
++User-Agent: curl/%VERSION
++Accept: */*
++
++GET /we/want/our/data/%TESTNUMBER0002.txt?coolsite=yes HTTP/1.1
++Host: %HOSTIP:%HTTPPORT
++Authorization: Basic dXNlcjpwYXNz
++User-Agent: curl/%VERSION
++Accept: */*
++Referer: http://%HOSTIP:%HTTPPORT/we/want/our/%TESTNUMBER
++
++</protocol>
++<stdout>
++HTTP/1.1 301 This is a weirdo text message swsclose
++Location: data/%TESTNUMBER0002.txt?coolsite=yes
++Content-Length: 62
++Connection: close
++
++http://%HOSTIP:%HTTPPORT/we/want/our/%TESTNUMBER
++</stdout>
++</verify>
++</testcase>
diff --git a/third_party/nixpkgs/pkgs/tools/networking/curl/7.74.0-CVE-2021-22890.patch b/third_party/nixpkgs/pkgs/tools/networking/curl/7.74.0-CVE-2021-22890.patch
new file mode 100644
index 0000000000..06cc3842e3
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/tools/networking/curl/7.74.0-CVE-2021-22890.patch
@@ -0,0 +1,473 @@
+Based on upstream b09c8ee15771c614c4bf3ddac893cdb12187c844, adapted by ris mostly to
+compensate for lack of bbe3aa9f881fa27fe828e3c9a36d6831f254a3ee
+
+diff --git a/lib/vtls/bearssl.c b/lib/vtls/bearssl.c
+index 36c32d8d55be..39fc1a29209c 100644
+--- a/lib/vtls/bearssl.c
++++ b/lib/vtls/bearssl.c
+@@ -375,7 +375,8 @@ static CURLcode bearssl_connect_step1(struct Curl_easy *data,
+     void *session;
+ 
+     Curl_ssl_sessionid_lock(conn);
+-    if(!Curl_ssl_getsessionid(conn, &session, NULL, sockindex)) {
++    if(!Curl_ssl_getsessionid(conn, SSL_IS_PROXY() ? TRUE : FALSE,
++                              &session, NULL, sockindex)) {
+       br_ssl_engine_set_session_parameters(&backend->ctx.eng, session);
+       infof(data, "BearSSL: re-using session ID\n");
+     }
+@@ -571,9 +572,13 @@ static CURLcode bearssl_connect_step3(struct Curl_easy *data,
+     br_ssl_engine_get_session_parameters(&backend->ctx.eng, session);
+     Curl_ssl_sessionid_lock(conn);
+-    incache = !(Curl_ssl_getsessionid(conn, &oldsession, NULL, sockindex));
++    incache = !(Curl_ssl_getsessionid(conn,
++                                      SSL_IS_PROXY() ? TRUE : FALSE,
++                                      &oldsession, NULL, sockindex));
+     if(incache)
+       Curl_ssl_delsessionid(conn, oldsession);
+-    ret = Curl_ssl_addsessionid(conn, session, 0, sockindex);
++    ret = Curl_ssl_addsessionid(conn,
++                                SSL_IS_PROXY() ? TRUE : FALSE,
++                                session, 0, sockindex);
+     Curl_ssl_sessionid_unlock(conn);
+     if(ret) {
+       free(session);
+diff --git a/lib/vtls/gtls.c b/lib/vtls/gtls.c
+index a75937b4646c..3b0d940a60e1 100644
+--- a/lib/vtls/gtls.c
++++ b/lib/vtls/gtls.c
+@@ -727,5 +727,7 @@ gtls_connect_step1(struct Curl_easy *data,
+ 
+     Curl_ssl_sessionid_lock(conn);
+-    if(!Curl_ssl_getsessionid(conn, &ssl_sessionid, &ssl_idsize, sockindex)) {
++    if(!Curl_ssl_getsessionid(conn,
++                              SSL_IS_PROXY() ? TRUE : FALSE,
++                              &ssl_sessionid, &ssl_idsize, sockindex)) {
+       /* we got a session id, use it! */
+       gnutls_session_set_data(session, ssl_sessionid, ssl_idsize);
+@@ -1286,8 +1287,9 @@ gtls_connect_step3(struct Curl_easy *data,
+       gnutls_session_get_data(session, connect_sessionid, &connect_idsize);
+ 
+       Curl_ssl_sessionid_lock(conn);
+-      incache = !(Curl_ssl_getsessionid(conn, &ssl_sessionid, NULL,
+-                                        sockindex));
++      incache = !(Curl_ssl_getsessionid(conn,
++                                        SSL_IS_PROXY() ? TRUE : FALSE,
++                                        &ssl_sessionid, NULL, sockindex));
+       if(incache) {
+         /* there was one before in the cache, so instead of risking that the
+            previous one was rejected, we just kill that and store the new */
+@@ -1295,8 +1297,10 @@ gtls_connect_step3(struct Curl_easy *data,
+       }
+ 
+       /* store this session id */
+-      result = Curl_ssl_addsessionid(conn, connect_sessionid, connect_idsize,
+-                                     sockindex);
++      result = Curl_ssl_addsessionid(conn,
++                                     SSL_IS_PROXY() ? TRUE : FALSE,
++                                     connect_sessionid, connect_idsize,
++                                     sockindex);
+       Curl_ssl_sessionid_unlock(conn);
+       if(result) {
+         free(connect_sessionid);
+diff --git a/lib/vtls/mbedtls.c b/lib/vtls/mbedtls.c
+index 95cd4d99b665..93a7ac1fd87d 100644
+--- a/lib/vtls/mbedtls.c
++++ b/lib/vtls/mbedtls.c
+@@ -463,7 +463,9 @@ mbed_connect_step1(struct Curl_easy *data, struct connectdata *conn,
+     void *old_session = NULL;
+ 
+     Curl_ssl_sessionid_lock(conn);
+-    if(!Curl_ssl_getsessionid(conn, &old_session, NULL, sockindex)) {
++    if(!Curl_ssl_getsessionid(conn,
++                              SSL_IS_PROXY() ? TRUE : FALSE,
++                              &old_session, NULL, sockindex)) {
+       ret = mbedtls_ssl_set_session(&backend->ssl, old_session);
+       if(ret) {
+         Curl_ssl_sessionid_unlock(conn);
+@@ -724,6 +726,7 @@ mbed_connect_step3(struct Curl_easy *data, struct connectdata *conn,
+     int ret;
+     mbedtls_ssl_session *our_ssl_sessionid;
+     void *old_ssl_sessionid = NULL;
++    bool isproxy = SSL_IS_PROXY() ? TRUE : FALSE;
+ 
+     our_ssl_sessionid = malloc(sizeof(mbedtls_ssl_session));
+     if(!our_ssl_sessionid)
+@@ -742,10 +745,12 @@ mbed_connect_step3(struct Curl_easy *data, struct connectdata *conn,
+ 
+     /* If there's already a matching session in the cache, delete it */
+     Curl_ssl_sessionid_lock(conn);
+-    if(!Curl_ssl_getsessionid(conn, &old_ssl_sessionid, NULL, sockindex))
++    if(!Curl_ssl_getsessionid(conn, isproxy, &old_ssl_sessionid, NULL,
++                              sockindex))
+       Curl_ssl_delsessionid(conn, old_ssl_sessionid);
+ 
+-    retcode = Curl_ssl_addsessionid(conn, our_ssl_sessionid, 0, sockindex);
++    retcode = Curl_ssl_addsessionid(conn, isproxy, our_ssl_sessionid,
++                                    0, sockindex);
+     Curl_ssl_sessionid_unlock(conn);
+     if(retcode) {
+       mbedtls_ssl_session_free(our_ssl_sessionid);
+diff --git a/lib/vtls/mesalink.c b/lib/vtls/mesalink.c
+index 4f1ab8627f49..5d6a1495d790 100644
+--- a/lib/vtls/mesalink.c
++++ b/lib/vtls/mesalink.c
+@@ -261,7 +261,9 @@ mesalink_connect_step1(struct Curl_easy *data,
+     void *ssl_sessionid = NULL;
+ 
+     Curl_ssl_sessionid_lock(conn);
+-    if(!Curl_ssl_getsessionid(conn, &ssl_sessionid, NULL, sockindex)) {
++    if(!Curl_ssl_getsessionid(conn,
++                              SSL_IS_PROXY() ? TRUE : FALSE,
++                              &ssl_sessionid, NULL, sockindex)) {
+       /* we got a session id, use it! */
+       if(!SSL_set_session(BACKEND->handle, ssl_sessionid)) {
+         Curl_ssl_sessionid_unlock(conn);
+@@ -345,12 +347,14 @@ mesalink_connect_step3(struct connectdata *conn, int sockindex)
+     bool incache;
+     SSL_SESSION *our_ssl_sessionid;
+     void *old_ssl_sessionid = NULL;
++    bool isproxy = SSL_IS_PROXY() ? TRUE : FALSE;
+ 
+     our_ssl_sessionid = SSL_get_session(BACKEND->handle);
+ 
+     Curl_ssl_sessionid_lock(conn);
+     incache =
+-      !(Curl_ssl_getsessionid(conn, &old_ssl_sessionid, NULL, sockindex));
++      !(Curl_ssl_getsessionid(conn, isproxy, &old_ssl_sessionid, NULL,
++                              sockindex));
+     if(incache) {
+       if(old_ssl_sessionid != our_ssl_sessionid) {
+         infof(data, "old SSL session ID is stale, removing\n");
+@@ -361,8 +364,9 @@ mesalink_connect_step3(struct connectdata *conn, int sockindex)
+     }
+ 
+     if(!incache) {
+-      result = Curl_ssl_addsessionid(
+-        conn, our_ssl_sessionid, 0 /* unknown size */, sockindex);
++      result =
++        Curl_ssl_addsessionid(conn, isproxy, our_ssl_sessionid, 0,
++                              sockindex);
+       if(result) {
+         Curl_ssl_sessionid_unlock(conn);
+         failf(data, "failed to store ssl session");
+diff --git a/lib/vtls/openssl.c b/lib/vtls/openssl.c
+index 498f8b9d1d08..68b98984b460 100644
+--- a/lib/vtls/openssl.c
++++ b/lib/vtls/openssl.c
+@@ -393,12 +393,23 @@ static int ossl_get_ssl_conn_index(void)
+  */
+ static int ossl_get_ssl_sockindex_index(void)
+ {
+-  static int ssl_ex_data_sockindex_index = -1;
+-  if(ssl_ex_data_sockindex_index < 0) {
+-    ssl_ex_data_sockindex_index = SSL_get_ex_new_index(0, NULL, NULL, NULL,
+-        NULL);
++  static int sockindex_index = -1;
++  if(sockindex_index < 0) {
++    sockindex_index = SSL_get_ex_new_index(0, NULL, NULL, NULL, NULL);
+   }
+-  return ssl_ex_data_sockindex_index;
++  return sockindex_index;
++}
++
++/* Return an extra data index for proxy boolean.
++ * This index can be used with SSL_get_ex_data() and SSL_set_ex_data().
++ */
++static int ossl_get_proxy_index(void)
++{
++  static int proxy_index = -1;
++  if(proxy_index < 0) {
++    proxy_index = SSL_get_ex_new_index(0, NULL, NULL, NULL, NULL);
++  }
++  return proxy_index;
+ }
+ 
+ static int passwd_callback(char *buf, int num, int encrypting,
+@@ -1174,6 +1185,7 @@ static int ossl_init(void)
+ 
+   /* Initialize the extra data indexes */
+-  if(ossl_get_ssl_conn_index() < 0 || ossl_get_ssl_sockindex_index() < 0)
++  if(ossl_get_ssl_conn_index() < 0 ||
++     ossl_get_ssl_sockindex_index() < 0 || ossl_get_proxy_index() < 0)
+     return 0;
+ 
+   return 1;
+@@ -2432,8 +2443,10 @@ static int ossl_new_session_cb(SSL *ssl, SSL_SESSION *ssl_sessionid)
+   curl_socket_t *sockindex_ptr;
+   int connectdata_idx = ossl_get_ssl_conn_index();
+   int sockindex_idx = ossl_get_ssl_sockindex_index();
++  int proxy_idx = ossl_get_proxy_index();
++  bool isproxy;
+ 
+-  if(connectdata_idx < 0 || sockindex_idx < 0)
++  if(connectdata_idx < 0 || sockindex_idx < 0 || proxy_idx < 0)
+     return 0;
+ 
+   conn = (struct connectdata*) SSL_get_ex_data(ssl, connectdata_idx);
+@@ -2446,13 +2459,18 @@ static int ossl_new_session_cb(SSL *ssl, SSL_SESSION *ssl_sessionid)
+   sockindex_ptr = (curl_socket_t*) SSL_get_ex_data(ssl, sockindex_idx);
+   sockindex = (int)(sockindex_ptr - conn->sock);
+ 
++  isproxy = SSL_get_ex_data(ssl, proxy_idx) ? TRUE : FALSE;
++
+   if(SSL_SET_OPTION(primary.sessionid)) {
+     bool incache;
+     void *old_ssl_sessionid = NULL;
+ 
+     Curl_ssl_sessionid_lock(conn);
+-    incache = !(Curl_ssl_getsessionid(conn, &old_ssl_sessionid, NULL,
+-                                      sockindex));
++    if(isproxy)
++      incache = FALSE;
++    else
++      incache = !(Curl_ssl_getsessionid(conn, isproxy,
++                                        &old_ssl_sessionid, NULL, sockindex));
+     if(incache) {
+       if(old_ssl_sessionid != ssl_sessionid) {
+         infof(data, "old SSL session ID is stale, removing\n");
+@@ -2462,8 +2480,8 @@ static int ossl_new_session_cb(SSL *ssl, SSL_SESSION *ssl_sessionid)
+     }
+ 
+     if(!incache) {
+-      if(!Curl_ssl_addsessionid(conn, ssl_sessionid,
+-                                      0 /* unknown size */, sockindex)) {
++      if(!Curl_ssl_addsessionid(conn, isproxy, ssl_sessionid,
++                                0 /* unknown size */, sockindex)) {
+         /* the session has been put into the session cache */
+         res = 1;
+       }
+@@ -3193,16 +3211,26 @@ static CURLcode ossl_connect_step1(struct Curl_easy *data,
+     void *ssl_sessionid = NULL;
+     int connectdata_idx = ossl_get_ssl_conn_index();
+     int sockindex_idx = ossl_get_ssl_sockindex_index();
++    int proxy_idx = ossl_get_proxy_index();
+ 
+-    if(connectdata_idx >= 0 && sockindex_idx >= 0) {
++    if(connectdata_idx >= 0 && sockindex_idx >= 0 &&
++       proxy_idx >= 0) {
+       /* Store the data needed for the "new session" callback.
+        * The sockindex is stored as a pointer to an array element. */
+       SSL_set_ex_data(backend->handle, connectdata_idx, conn);
+       SSL_set_ex_data(backend->handle, sockindex_idx, conn->sock + sockindex);
++#ifndef CURL_DISABLE_PROXY
++      SSL_set_ex_data(backend->handle, proxy_idx, SSL_IS_PROXY() ? (void *) 1:
++                      NULL);
++#else
++      SSL_set_ex_data(backend->handle, proxy_idx, NULL);
++#endif
++
+     }
+ 
+     Curl_ssl_sessionid_lock(conn);
+-    if(!Curl_ssl_getsessionid(conn, &ssl_sessionid, NULL, sockindex)) {
++    if(!Curl_ssl_getsessionid(conn, SSL_IS_PROXY() ? TRUE : FALSE,
++                              &ssl_sessionid, NULL, sockindex)) {
+       /* we got a session id, use it! */
+       if(!SSL_set_session(backend->handle, ssl_sessionid)) {
+         Curl_ssl_sessionid_unlock(conn);
+diff --git a/lib/vtls/schannel.c b/lib/vtls/schannel.c
+index d7b89d43f892..931bd853eb8e 100644
+--- a/lib/vtls/schannel.c
++++ b/lib/vtls/schannel.c
+@@ -496,5 +496,7 @@ schannel_connect_step1(struct Curl_easy *data, struct connectdata *conn,
+   if(SSL_SET_OPTION(primary.sessionid)) {
+     Curl_ssl_sessionid_lock(conn);
+-    if(!Curl_ssl_getsessionid(conn, (void **)&old_cred, NULL, sockindex)) {
++    if(!Curl_ssl_getsessionid(conn,
++                              SSL_IS_PROXY() ? TRUE : FALSE,
++                              (void **)&old_cred, NULL, sockindex)) {
+       BACKEND->cred = old_cred;
+       DEBUGF(infof(data, "schannel: re-using existing credential handle\n"));
+@@ -1337,8 +1338,9 @@ schannel_connect_step3(struct Curl_easy *data, struct connectdata *conn,
+   struct ssl_connect_data *connssl = &conn->ssl[sockindex];
+   SECURITY_STATUS sspi_status = SEC_E_OK;
+   CERT_CONTEXT *ccert_context = NULL;
++  bool isproxy = SSL_IS_PROXY();
+ #ifdef DEBUGBUILD
+-  const char * const hostname = SSL_IS_PROXY() ? conn->http_proxy.host.name :
++  const char * const hostname = isproxy ? conn->http_proxy.host.name :
+     conn->host.name;
+ #endif
+ #ifdef HAS_ALPN
+@@ -1414,8 +1416,8 @@ schannel_connect_step3(struct Curl_easy *data, struct connectdata *conn,
+     struct Curl_schannel_cred *old_cred = NULL;
+ 
+     Curl_ssl_sessionid_lock(conn);
+-    incache = !(Curl_ssl_getsessionid(conn, (void **)&old_cred, NULL,
+-                                      sockindex));
++    incache = !(Curl_ssl_getsessionid(conn, isproxy, (void **)&old_cred,
++                                      NULL, sockindex));
+     if(incache) {
+       if(old_cred != BACKEND->cred) {
+         DEBUGF(infof(data,
+@@ -1426,7 +1428,7 @@ schannel_connect_step3(struct Curl_easy *data, struct connectdata *conn,
+       }
+     }
+     if(!incache) {
+-      result = Curl_ssl_addsessionid(conn, (void *)BACKEND->cred,
++      result = Curl_ssl_addsessionid(conn, isproxy, BACKEND->cred,
+                                      sizeof(struct Curl_schannel_cred),
+                                      sockindex);
+       if(result) {
+diff --git a/lib/vtls/sectransp.c b/lib/vtls/sectransp.c
+index 05b57dfaad91..e69b99b72cd6 100644
+--- a/lib/vtls/sectransp.c
++++ b/lib/vtls/sectransp.c
+@@ -1400,10 +1400,12 @@ static CURLcode sectransp_connect_step1(struct Curl_easy *data,
+   char * const ssl_cert = SSL_SET_OPTION(primary.clientcert);
+   const struct curl_blob *ssl_cert_blob = SSL_SET_OPTION(primary.cert_blob);
+ #ifndef CURL_DISABLE_PROXY
+-  const char * const hostname = SSL_IS_PROXY() ? conn->http_proxy.host.name :
++  bool isproxy = SSL_IS_PROXY();
++  const char * const hostname = isproxy ? conn->http_proxy.host.name :
+     conn->host.name;
+   const long int port = SSL_IS_PROXY() ? conn->port : conn->remote_port;
+ #else
++  const isproxy = FALSE;
+   const char * const hostname = conn->host.name;
+   const long int port = conn->remote_port;
+ #endif
+@@ -1613,7 +1615,7 @@ static CURLcode sectransp_connect_step1(struct Curl_easy *data,
+ #ifdef USE_NGHTTP2
+       if(data->state.httpversion >= CURL_HTTP_VERSION_2
+ #ifndef CURL_DISABLE_PROXY
+-         && (!SSL_IS_PROXY() || !conn->bits.tunnel_proxy)
++         && (!isproxy || !conn->bits.tunnel_proxy)
+ #endif
+         ) {
+         CFArrayAppendValue(alpnArr, CFSTR(NGHTTP2_PROTO_VERSION_ID));
+@@ -1953,7 +1955,7 @@ static CURLcode sectransp_connect_step1(struct Curl_easy *data,
+     size_t ssl_sessionid_len;
+ 
+     Curl_ssl_sessionid_lock(conn);
+-    if(!Curl_ssl_getsessionid(conn, (void **)&ssl_sessionid,
++    if(!Curl_ssl_getsessionid(conn, isproxy, (void **)&ssl_sessionid,
+                               &ssl_sessionid_len, sockindex)) {
+       /* we got a session id, use it! */
+       err = SSLSetPeerID(backend->ssl_ctx, ssl_sessionid, ssl_sessionid_len);
+@@ -1981,7 +1983,7 @@ static CURLcode sectransp_connect_step1(struct Curl_easy *data,
+         return CURLE_SSL_CONNECT_ERROR;
+       }
+ 
+-      result = Curl_ssl_addsessionid(conn, ssl_sessionid, ssl_sessionid_len,
++      result = Curl_ssl_addsessionid(conn, isproxy, ssl_sessionid, ssl_sessionid_len,
+                                      sockindex);
+       Curl_ssl_sessionid_unlock(conn);
+       if(result) {
+diff --git a/lib/vtls/vtls.c b/lib/vtls/vtls.c
+index 6a0069237fdb..95fd6356285f 100644
+--- a/lib/vtls/vtls.c
++++ b/lib/vtls/vtls.c
+@@ -367,5 +367,6 @@ void Curl_ssl_sessionid_unlock(struct Curl_easy *data)
+  */
+ bool Curl_ssl_getsessionid(struct connectdata *conn,
++                           const bool isProxy,
+                            void **ssl_sessionid,
+                            size_t *idsize, /* set 0 if unknown */
+                            int sockindex)
+@@ -377,7 +378,6 @@ bool Curl_ssl_getsessionid(struct Curl_easy *data,
+   bool no_match = TRUE;
+ 
+ #ifndef CURL_DISABLE_PROXY
+-  const bool isProxy = CONNECT_PROXY_SSL();
+   struct ssl_primary_config * const ssl_config = isProxy ?
+     &conn->proxy_ssl_config :
+     &conn->ssl_config;
+@@ -389,10 +389,15 @@ bool Curl_ssl_getsessionid(struct Curl_easy *data,
+   struct ssl_primary_config * const ssl_config = &conn->ssl_config;
+   const char * const name = conn->host.name;
+   int port = conn->remote_port;
+-  (void)sockindex;
+ #endif
++  (void)sockindex;
+   *ssl_sessionid = NULL;
+ 
++#ifdef CURL_DISABLE_PROXY
++  if(isProxy)
++    return TRUE;
++#endif
++
+   DEBUGASSERT(SSL_SET_OPTION(primary.sessionid));
+ 
+   if(!SSL_SET_OPTION(primary.sessionid))
+@@ -480,5 +485,6 @@ void Curl_ssl_delsessionid(struct Curl_easy *data, void *ssl_sessionid)
+  */
+ CURLcode Curl_ssl_addsessionid(struct connectdata *conn,
++                               bool isProxy,
+                                void *ssl_sessionid,
+                                size_t idsize,
+                                int sockindex)
+@@ -492,7 +498,6 @@ CURLcode Curl_ssl_addsessionid(struct Curl_easy *data,
+   int conn_to_port;
+   long *general_age;
+ #ifndef CURL_DISABLE_PROXY
+-  const bool isProxy = CONNECT_PROXY_SSL();
+   struct ssl_primary_config * const ssl_config = isProxy ?
+     &conn->proxy_ssl_config :
+     &conn->ssl_config;
+@@ -505,6 +510,7 @@ CURLcode Curl_ssl_addsessionid(struct Curl_easy *data,
+   const char *hostname = conn->host.name;
+   (void)sockindex;
+ #endif
++  (void)sockindex;
+   DEBUGASSERT(SSL_SET_OPTION(primary.sessionid));
+ 
+   clone_host = strdup(hostname);
+diff --git a/lib/vtls/vtls.h b/lib/vtls/vtls.h
+index 273184f1894a..2b43e7744b19 100644
+--- a/lib/vtls/vtls.h
++++ b/lib/vtls/vtls.h
+@@ -235,5 +235,6 @@ void Curl_ssl_sessionid_unlock(struct Curl_easy *data);
+  */
+ bool Curl_ssl_getsessionid(struct connectdata *conn,
++                           const bool isproxy,
+                            void **ssl_sessionid,
+                            size_t *idsize, /* set 0 if unknown */
+                            int sockindex);
+@@ -245,5 +246,6 @@ bool Curl_ssl_getsessionid(struct Curl_easy *data,
+  */
+ CURLcode Curl_ssl_addsessionid(struct connectdata *conn,
++                               const bool isProxy,
+                                void *ssl_sessionid,
+                                size_t idsize,
+                                int sockindex);
+diff --git a/lib/vtls/wolfssl.c b/lib/vtls/wolfssl.c
+index 7159ac9d5e64..8fb2ea7acf31 100644
+--- a/lib/vtls/wolfssl.c
++++ b/lib/vtls/wolfssl.c
+@@ -516,7 +516,9 @@ wolfssl_connect_step1(struct Curl_easy *data, struct connectdata *conn,
+     void *ssl_sessionid = NULL;
+ 
+     Curl_ssl_sessionid_lock(conn);
+-    if(!Curl_ssl_getsessionid(conn, &ssl_sessionid, NULL, sockindex)) {
++    if(!Curl_ssl_getsessionid(conn,
++                              SSL_IS_PROXY() ? TRUE : FALSE,
++                              &ssl_sessionid, NULL, sockindex)) {
+       /* we got a session id, use it! */
+       if(!SSL_set_session(backend->handle, ssl_sessionid)) {
+         char error_buffer[WOLFSSL_MAX_ERROR_SZ];
+@@ -772,10 +774,11 @@ wolfssl_connect_step3(struct Curl_easy *data, struct connectdata *conn,
+     void *old_ssl_sessionid = NULL;
+ 
+     our_ssl_sessionid = SSL_get_session(backend->handle);
++    bool isproxy = SSL_IS_PROXY() ? TRUE : FALSE;
+ 
+     Curl_ssl_sessionid_lock(conn);
+-    incache = !(Curl_ssl_getsessionid(conn, &old_ssl_sessionid, NULL,
+-                                      sockindex));
++    incache = !(Curl_ssl_getsessionid(conn, isproxy,
++                                      &old_ssl_sessionid, NULL, sockindex));
+     if(incache) {
+       if(old_ssl_sessionid != our_ssl_sessionid) {
+         infof(data, "old SSL session ID is stale, removing\n");
+@@ -786,8 +789,8 @@ wolfssl_connect_step3(struct Curl_easy *data, struct connectdata *conn,
+     }
+ 
+     if(!incache) {
+-      result = Curl_ssl_addsessionid(conn, our_ssl_sessionid,
+-                                     0 /* unknown size */, sockindex);
++      result = Curl_ssl_addsessionid(conn, isproxy, our_ssl_sessionid,
++                                     0, sockindex);
+       if(result) {
+         Curl_ssl_sessionid_unlock(conn);
+         failf(data, "failed to store ssl session");
diff --git a/third_party/nixpkgs/pkgs/tools/networking/curl/default.nix b/third_party/nixpkgs/pkgs/tools/networking/curl/default.nix
index 89f44e8bb7..7c24be7aea 100644
--- a/third_party/nixpkgs/pkgs/tools/networking/curl/default.nix
+++ b/third_party/nixpkgs/pkgs/tools/networking/curl/default.nix
@@ -45,6 +45,11 @@ stdenv.mkDerivation rec {
     sha256 = "19bp3d91xq9vqwlbzq261j23mk9lz4lyka4gr2fm6dhnd3k66k8g";
   };
 
+  patches = [
+    ./7.74.0-CVE-2021-22876.patch
+    ./7.74.0-CVE-2021-22890.patch
+  ];
+
   outputs = [ "bin" "dev" "out" "man" "devdoc" ];
   separateDebugInfo = stdenv.isLinux;
 
diff --git a/third_party/nixpkgs/pkgs/tools/networking/innernet/default.nix b/third_party/nixpkgs/pkgs/tools/networking/innernet/default.nix
index a195841ab5..abc7aca61a 100644
--- a/third_party/nixpkgs/pkgs/tools/networking/innernet/default.nix
+++ b/third_party/nixpkgs/pkgs/tools/networking/innernet/default.nix
@@ -2,19 +2,19 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "innernet";
-  version = "1.1.0";
+  version = "1.2.0";
 
   src = fetchFromGitHub {
     owner = "tonarino";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-OomCSA02ypFVzkYMcmkFREWB6x7oxgpt7x2zRANIDMw=";
+    sha256 = "sha256-Z4F5RYPVgFiiDBg6lxILjAh/a/rL7IJBqHIJ/tQyLnE=";
   };
   LIBCLANG_PATH = "${llvmPackages.libclang}/lib";
 
   nativeBuildInputs = with llvmPackages; [ llvm clang ];
   buildInputs = [ sqlite ] ++ lib.optionals stdenv.isDarwin [ Security ];
-  cargoSha256 = "sha256-GYNk3j8fjKSo3Qk6Qy0l6kNINK3FxlSYoEkJSx7kVpk=";
+  cargoSha256 = "sha256-WSkN5aXMgfqZJAV1b3elF7kwf2f5OpcntKSf8620YcY=";
 
   meta = with lib; {
     description = "A private network system that uses WireGuard under the hood";
diff --git a/third_party/nixpkgs/pkgs/tools/networking/zerotierone/default.nix b/third_party/nixpkgs/pkgs/tools/networking/zerotierone/default.nix
index 60da9b3abc..4a44843e94 100644
--- a/third_party/nixpkgs/pkgs/tools/networking/zerotierone/default.nix
+++ b/third_party/nixpkgs/pkgs/tools/networking/zerotierone/default.nix
@@ -2,22 +2,22 @@
 
 stdenv.mkDerivation rec {
   pname = "zerotierone";
-  version = "1.6.4";
+  version = "1.6.5";
 
   src = fetchFromGitHub {
     owner = "zerotier";
     repo = "ZeroTierOne";
     rev = version;
-    sha256 = "06b6k1rzqkd7cdl7n0gz5ky48fs2nhn0q2qxx1rww38vbfc7lpmf";
+    sha256 = "0dlnrb59vnxa3pjkgfqd5jil9kl6axh23v0bffi4kx8jwzpdwas8";
   };
 
   preConfigure = ''
-      patchShebangs ./doc/build.sh
-      substituteInPlace ./doc/build.sh \
-        --replace '/usr/bin/ronn' '${buildPackages.ronn}/bin/ronn' \
+    patchShebangs ./doc/build.sh
+    substituteInPlace ./doc/build.sh \
+      --replace '/usr/bin/ronn' '${buildPackages.ronn}/bin/ronn' \
 
-      substituteInPlace ./make-linux.mk \
-        --replace 'armv5' 'armv6'
+    substituteInPlace ./make-linux.mk \
+      --replace 'armv5' 'armv6'
   '';
 
 
diff --git a/third_party/nixpkgs/pkgs/tools/security/gitleaks/default.nix b/third_party/nixpkgs/pkgs/tools/security/gitleaks/default.nix
index 685280ab4a..c47afcd8e0 100644
--- a/third_party/nixpkgs/pkgs/tools/security/gitleaks/default.nix
+++ b/third_party/nixpkgs/pkgs/tools/security/gitleaks/default.nix
@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "gitleaks";
-  version = "7.4.0";
+  version = "7.4.1";
 
   src = fetchFromGitHub {
     owner = "zricethezav";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-AY9pOARFAqIOimhcwEyau2MwJCFsWu8I36P7Z0xyJH0=";
+    sha256 = "sha256-GoHntsyxrMzLHlyKC3JxCkLoquIjOtidcG7hTNTYGuI=";
   };
 
   vendorSha256 = "sha256-Cc4DJPpOMHxDcH22S7znYo7QHNRXv8jOJhznu09kaE4=";
diff --git a/third_party/nixpkgs/pkgs/tools/security/grype/default.nix b/third_party/nixpkgs/pkgs/tools/security/grype/default.nix
index 5db1f1d20e..7323d09247 100644
--- a/third_party/nixpkgs/pkgs/tools/security/grype/default.nix
+++ b/third_party/nixpkgs/pkgs/tools/security/grype/default.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "grype";
-  version = "0.10.2";
+  version = "0.11.0";
 
   src = fetchFromGitHub {
     owner = "anchore";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-kKzrV2TTO8NmB3x27ZStMZpSIRGwm5Ev+cPGwT50FEU=";
+    sha256 = "sha256-E1tJ9hEJ4GaL+S4dz6aGq3nJPpdtx0/Tfb1RzgJSe8M=";
   };
 
-  vendorSha256 = "sha256-PC2n6+gPDxpG8RTAmCfK4P40yfxqlleYI6Ex4FtPjk4=";
+  vendorSha256 = "sha256-LUyrX/rm01tCPT6Ua6hphhf+4ycNn4tLONRyH3iTrZ4=";
 
   propagatedBuildInputs = [ docker ];
 
diff --git a/third_party/nixpkgs/pkgs/tools/security/keybase/gui.nix b/third_party/nixpkgs/pkgs/tools/security/keybase/gui.nix
index cfc282c303..8894a77a86 100644
--- a/third_party/nixpkgs/pkgs/tools/security/keybase/gui.nix
+++ b/third_party/nixpkgs/pkgs/tools/security/keybase/gui.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchurl, alsaLib, atk, cairo, cups, udev
+{ stdenv, lib, fetchurl, alsaLib, atk, cairo, cups, udev, libdrm, mesa
 , dbus, expat, fontconfig, freetype, gdk-pixbuf, glib, gtk3, libappindicator-gtk3
 , libnotify, nspr, nss, pango, systemd, xorg, autoPatchelfHook, wrapGAppsHook
 , runtimeShell, gsettings-desktop-schemas }:
@@ -53,6 +53,8 @@ stdenv.mkDerivation rec {
     xorg.libXrender
     xorg.libXtst
     xorg.libxcb
+    libdrm
+    mesa.out
   ];
 
   runtimeDependencies = [
diff --git a/third_party/nixpkgs/pkgs/tools/security/nsjail/001-fix-bison-link-error.patch b/third_party/nixpkgs/pkgs/tools/security/nsjail/001-fix-bison-link-error.patch
new file mode 100644
index 0000000000..427cea5b02
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/tools/security/nsjail/001-fix-bison-link-error.patch
@@ -0,0 +1,30 @@
+From 8e309a0af0851ab54ca7c6d51b6f3d19ee42c8ee Mon Sep 17 00:00:00 2001
+From: Evangelos Foutras <evangelos@foutrelis.com>
+Date: Wed, 17 Mar 2021 16:36:40 +0200
+Subject: [PATCH] Replace YYUSE call with void cast in src/parser.y
+
+The YYUSE macro was renamed to YY_USE in bison 3.7.5; we might as well
+avoid using it altogether and cast the unused variable to void instead.
+
+Fixes the following linker error:
+
+/usr/bin/ld: kafel/libkafel.a(libkafel.o): in function `kafel_yyerror':
+arm_syscalls.c:(.text+0x6984): undefined reference to `YYUSE'
+---
+ src/parser.y | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/parser.y b/src/parser.y
+index e0f109c..0e01373 100644
+--- a/kafel/src/parser.y
++++ b/kafel/src/parser.y
+@@ -420,8 +420,8 @@ const_def
+ 
+ void yyerror(YYLTYPE * loc, struct kafel_ctxt* ctxt, yyscan_t scanner,
+              const char *msg) {
++  (void)scanner; /* suppress unused-parameter warning */
+   if (!ctxt->lexical_error) {
+-    YYUSE(scanner);
+     if (loc->filename != NULL) {
+       append_error(ctxt, "%s:%d:%d: %s", loc->filename, loc->first_line, loc->first_column, msg);
+     } else {
diff --git a/third_party/nixpkgs/pkgs/tools/security/nsjail/default.nix b/third_party/nixpkgs/pkgs/tools/security/nsjail/default.nix
index d48564ce95..568113368a 100644
--- a/third_party/nixpkgs/pkgs/tools/security/nsjail/default.nix
+++ b/third_party/nixpkgs/pkgs/tools/security/nsjail/default.nix
@@ -4,7 +4,7 @@
 
 stdenv.mkDerivation rec {
   pname = "nsjail";
-  version = "3.0";
+  version = "3.0"; # Bumping? Remove the bison patch.
 
   src = fetchFromGitHub {
     owner           = "google";
@@ -18,6 +18,11 @@ stdenv.mkDerivation rec {
   buildInputs = [ libnl protobuf protobufc ];
   enableParallelBuilding = true;
 
+  patches = [
+    # To remove after bumping 3.0
+    ./001-fix-bison-link-error.patch
+  ];
+
   preBuild = ''
     makeFlagsArray+=(USER_DEFINES='-DNEWUIDMAP_PATH=${shadow}/bin/newuidmap -DNEWGIDMAP_PATH=${shadow}/bin/newgidmap')
   '';
diff --git a/third_party/nixpkgs/pkgs/tools/security/pcsclite/default.nix b/third_party/nixpkgs/pkgs/tools/security/pcsclite/default.nix
index 2a75c40930..71bd13c4a7 100644
--- a/third_party/nixpkgs/pkgs/tools/security/pcsclite/default.nix
+++ b/third_party/nixpkgs/pkgs/tools/security/pcsclite/default.nix
@@ -1,4 +1,15 @@
-{ lib, stdenv, fetchurl, pkg-config, udev, dbus, perl, python3, IOKit }:
+{ stdenv
+, lib
+, fetchurl
+, autoreconfHook
+, pkg-config
+, perl
+, python3
+, dbus
+, polkit
+, systemd
+, IOKit
+}:
 
 stdenv.mkDerivation rec {
   pname = "pcsclite";
@@ -13,14 +24,23 @@ stdenv.mkDerivation rec {
 
   patches = [ ./no-dropdir-literals.patch ];
 
+  postPatch = ''
+    sed -i configure.ac \
+      -e "s@polkit_policy_dir=.*@polkit_policy_dir=$bin/share/polkit-1/actions@"
+  '';
+
   configureFlags = [
+    "--enable-confdir=/etc"
     # The OS should care on preparing the drivers into this location
     "--enable-usbdropdir=/var/lib/pcsc/drivers"
-    "--enable-confdir=/etc"
-  ] ++ lib.optional stdenv.isLinux
-    "--with-systemdsystemunitdir=\${out}/etc/systemd/system"
-  ++ lib.optional (!stdenv.isLinux)
-    "--disable-libsystemd";
+  ]
+  ++ (if stdenv.isLinux then [
+    "--enable-ipcdir=/run/pcscd"
+    "--enable-polkit"
+    "--with-systemdsystemunitdir=${placeholder "bin"}/lib/systemd/system"
+  ] else [
+    "--disable-libsystemd"
+  ]);
 
   postConfigure = ''
     sed -i -re '/^#define *PCSCLITE_HP_DROPDIR */ {
@@ -33,10 +53,12 @@ stdenv.mkDerivation rec {
     moveToOutput bin/pcsc-spy "$dev"
   '';
 
-  nativeBuildInputs = [ pkg-config perl ];
+  enableParallelBuilding = true;
+
+  nativeBuildInputs = [ autoreconfHook pkg-config perl ];
 
   buildInputs = [ python3 ]
-    ++ lib.optionals stdenv.isLinux [ udev dbus ]
+    ++ lib.optionals stdenv.isLinux [ dbus polkit systemd ]
     ++ lib.optionals stdenv.isDarwin [ IOKit ];
 
   meta = with lib; {
diff --git a/third_party/nixpkgs/pkgs/tools/security/pcsctools/default.nix b/third_party/nixpkgs/pkgs/tools/security/pcsctools/default.nix
index 613388fc6a..51813526de 100644
--- a/third_party/nixpkgs/pkgs/tools/security/pcsctools/default.nix
+++ b/third_party/nixpkgs/pkgs/tools/security/pcsctools/default.nix
@@ -1,18 +1,33 @@
-{ stdenv, lib, fetchurl, makeWrapper, pkg-config, udev, dbus, pcsclite
-, wget, coreutils, perlPackages
+{ stdenv
+, lib
+, fetchurl
+, makeWrapper
+, pkg-config
+, systemd
+, dbus
+, pcsclite
+, wget
+, coreutils
+, perlPackages
 }:
 
-let deps = lib.makeBinPath [ wget coreutils ];
-
-in stdenv.mkDerivation rec {
-  name = "pcsc-tools-1.5.7";
+stdenv.mkDerivation rec {
+  pname = "pcsc-tools";
+  version = "1.5.7";
 
   src = fetchurl {
-    url = "http://ludovic.rousseau.free.fr/softwares/pcsc-tools/${name}.tar.bz2";
+    url = "http://ludovic.rousseau.free.fr/softwares/pcsc-tools/${pname}-${version}.tar.bz2";
     sha256 = "17b9jxvcxmn007lavan20l25v4jvm6dqc4x9dlqzbg6mjs28zsp0";
   };
 
-  buildInputs = [ udev dbus perlPackages.perl pcsclite ];
+  postPatch = ''
+    substituteInPlace ATR_analysis \
+      --replace /usr/local/pcsc /etc/pcsc \
+      --replace /usr/share/pcsc $out/share/pcsc
+  '';
+
+  buildInputs = [ dbus perlPackages.perl pcsclite ]
+    ++ lib.optional stdenv.isLinux systemd;
 
   nativeBuildInputs = [ makeWrapper pkg-config ];
 
@@ -24,14 +39,16 @@ in stdenv.mkDerivation rec {
     wrapProgram $out/bin/ATR_analysis \
       --set PERL5LIB "${with perlPackages; makePerlPath [ pcscperl ]}"
     wrapProgram $out/bin/pcsc_scan \
-      --set PATH "$out/bin:${deps}"
+      --prefix PATH : "$out/bin:${lib.makeBinPath [ coreutils wget ]}"
+
+    install -Dm444 -t $out/share/pcsc smartcard_list.txt
   '';
 
   meta = with lib; {
     description = "Tools used to test a PC/SC driver, card or reader";
     homepage = "http://ludovic.rousseau.free.fr/softwares/pcsc-tools/";
     license = licenses.gpl2Plus;
-    maintainers = with maintainers; [ ];
+    maintainers = with maintainers; [ peterhoeg ];
     platforms = platforms.linux;
   };
 }
diff --git a/third_party/nixpkgs/pkgs/tools/system/gdu/default.nix b/third_party/nixpkgs/pkgs/tools/system/gdu/default.nix
index 3b7ef2c88d..9e522f2320 100644
--- a/third_party/nixpkgs/pkgs/tools/system/gdu/default.nix
+++ b/third_party/nixpkgs/pkgs/tools/system/gdu/default.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "gdu";
-  version = "4.10.1";
+  version = "4.11.0";
 
   src = fetchFromGitHub {
     owner = "dundee";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-zU4aSvfW1ph9PrXsAErCOedPn4oeeSh8tpnUj5LRlUw=";
+    sha256 = "sha256-E+/Ig6+J7pJ98O+YAntBGERml2ELzkji3gworBdcSVY=";
   };
 
   vendorSha256 = "sha256-QiO5p0x8kmIN6f0uYS0IR2MlWtRYTHeZpW6Nmupjias=";
diff --git a/third_party/nixpkgs/pkgs/tools/system/gptman/default.nix b/third_party/nixpkgs/pkgs/tools/system/gptman/default.nix
new file mode 100644
index 0000000000..5209856ede
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/tools/system/gptman/default.nix
@@ -0,0 +1,22 @@
+{ lib, fetchFromGitHub, rustPlatform }:
+
+rustPlatform.buildRustPackage rec {
+  pname = "gptman";
+  version = "0.8.0";
+
+  src = fetchFromGitHub {
+    owner = "cecton";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "11zyjrw4f8gi5s4sd2kl3sdiz0avq7clr8zqnwl04y61b3fpg7y1";
+  };
+
+  cargoSha256 = "1cp8cyrd7ab8r2j28b69c2p3ysix5b9hpsqk07cmzgqwwml0qj12";
+
+  meta = with lib; {
+    description = "A CLI tool for Linux to copy a partition from one disk to another and more.";
+    homepage = "https://github.com/cecton/gptman";
+    license = with licenses; [ asl20 /* or */ mit ];
+    maintainers = with maintainers; [ akshgpt7 ];
+  };
+}
diff --git a/third_party/nixpkgs/pkgs/tools/text/fastmod/default.nix b/third_party/nixpkgs/pkgs/tools/text/fastmod/default.nix
index ba2bedd5ea..e838e2931c 100644
--- a/third_party/nixpkgs/pkgs/tools/text/fastmod/default.nix
+++ b/third_party/nixpkgs/pkgs/tools/text/fastmod/default.nix
@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "fastmod";
-  version = "0.4.1";
+  version = "0.4.2";
 
   src = fetchFromGitHub {
     owner = "facebookincubator";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0nrh6h5imbpl7i0sqqm16x9ggazww5739vng1ay1v6sgbbs0a095";
+    sha256 = "sha256-Lv8hARD/aVWiWpJQmPWPeACpX15+3NogoUl5yh63E7A=";
   };
 
-  cargoSha256 = "18bspi59vfnqijxgipmv2h6h5iy7qynpk1ph46yhjsnndjlxxcba";
+  cargoSha256 = "sha256-L1MKoVacVKcpEG2IfS+eENxFZNiSaTDTxfFbFlvzYl8=";
 
   buildInputs = lib.optional stdenv.isDarwin Security;
 
diff --git a/third_party/nixpkgs/pkgs/tools/text/languagetool/default.nix b/third_party/nixpkgs/pkgs/tools/text/languagetool/default.nix
index 90ddd5b692..810e3feaa2 100644
--- a/third_party/nixpkgs/pkgs/tools/text/languagetool/default.nix
+++ b/third_party/nixpkgs/pkgs/tools/text/languagetool/default.nix
@@ -2,16 +2,18 @@
 
 stdenv.mkDerivation rec {
   pname = "LanguageTool";
-  version = "5.2";
+  version = "5.3";
 
   src = fetchzip {
     url = "https://www.languagetool.org/download/${pname}-${version}.zip";
-    sha256 = "1fz3rxqg5z2jxbalraz8lwkzj0jh69zzfmf3vpwywilvl7xlhdrd";
+    sha256 = "1km20ajqb65vkhkrf94zy5srcss66ix8padp7ng59pa8pj11wmi2";
   };
   nativeBuildInputs = [ makeWrapper ];
   buildInputs = [ jre ];
 
   installPhase = ''
+    runHook preInstall
+
     mkdir -p $out/share
     mv -- * $out/share/
 
@@ -22,6 +24,8 @@ stdenv.mkDerivation rec {
 
     makeWrapper ${jre}/bin/java $out/bin/languagetool-http-server \
       --add-flags "-cp $out/share/languagetool-server.jar org.languagetool.server.HTTPServer"
+
+    runHook postInstall
   '';
 
   meta = with lib; {
diff --git a/third_party/nixpkgs/pkgs/tools/typesetting/pdftk/default.nix b/third_party/nixpkgs/pkgs/tools/typesetting/pdftk/default.nix
index f90d1d4a7e..c1f0461672 100644
--- a/third_party/nixpkgs/pkgs/tools/typesetting/pdftk/default.nix
+++ b/third_party/nixpkgs/pkgs/tools/typesetting/pdftk/default.nix
@@ -91,6 +91,5 @@ in stdenv.mkDerivation rec {
     license = licenses.gpl2Plus;
     maintainers = with maintainers; [ raskin averelld ];
     platforms = platforms.unix;
-    broken = stdenv.isDarwin;
   };
 }
diff --git a/third_party/nixpkgs/pkgs/tools/virtualization/govc/default.nix b/third_party/nixpkgs/pkgs/tools/virtualization/govc/default.nix
index 3727d1ac1d..00330f7d1a 100644
--- a/third_party/nixpkgs/pkgs/tools/virtualization/govc/default.nix
+++ b/third_party/nixpkgs/pkgs/tools/virtualization/govc/default.nix
@@ -2,7 +2,7 @@
 
 buildGoPackage rec {
   pname = "govc";
-  version = "0.24.1";
+  version = "0.25.0";
 
   goPackagePath = "github.com/vmware/govmomi";
 
@@ -12,7 +12,7 @@ buildGoPackage rec {
     rev = "v${version}";
     owner = "vmware";
     repo = "govmomi";
-    sha256 = "sha256-D2UrYdjstOxx9EAdBtAC44khp8hRf6W3+6kzytUVnOo=";
+    sha256 = "sha256-Ri8snbmgcAZmdumKzBl3P6gf/eZgwdgg7V+ijyeZjks=";
   };
 
   meta = {
diff --git a/third_party/nixpkgs/pkgs/tools/wayland/wdomirror/default.nix b/third_party/nixpkgs/pkgs/tools/wayland/wdomirror/default.nix
new file mode 100644
index 0000000000..8fddf51f53
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/tools/wayland/wdomirror/default.nix
@@ -0,0 +1,38 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, meson
+, ninja
+, pkg-config
+, wayland
+, wayland-protocols
+}:
+
+stdenv.mkDerivation {
+  pname = "wdomirror";
+  version = "unstable-2021-01-08";
+
+  src = fetchFromGitHub {
+    owner = "progandy";
+    repo = "wdomirror";
+    rev = "e4a4934e6f739909fbf346cbc001c72690b5c906";
+    sha256 = "1fz0sajhdjqas3l6mpik8w1k15wbv65hgh9r9vdgfqvw5l6cx7jv";
+  };
+
+  nativeBuildInputs = [ meson ninja pkg-config wayland-protocols ];
+
+  buildInputs = [ wayland ];
+
+  installPhase = ''
+    runHook preInstall
+    install -m755 -D wdomirror $out/bin/wdomirror
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "Mirrors an output of a wlroots compositor to a window";
+    license = licenses.mit;
+    platforms = platforms.unix;
+    maintainers = with maintainers; [ jpas ];
+  };
+}
diff --git a/third_party/nixpkgs/pkgs/top-level/aliases.nix b/third_party/nixpkgs/pkgs/top-level/aliases.nix
index 999c26e320..8f2ff5cc4f 100644
--- a/third_party/nixpkgs/pkgs/top-level/aliases.nix
+++ b/third_party/nixpkgs/pkgs/top-level/aliases.nix
@@ -176,6 +176,7 @@ mapAliases ({
   dvb_apps = throw "dvb_apps has been removed."; # added 2020-11-03
   dwarf_fortress = dwarf-fortress; # added 2016-01-23
   dwm-git = throw "dwm-git has been removed from nixpkgs, as it had no updates for 2 years not serving it's purpose."; # added 2021-02-07
+  dylibbundler = macdylibbundler; # added 2021-04-24
   elasticmq = throw "elasticmq has been removed in favour of elasticmq-server-bin"; # added 2021-01-17
   emacsPackagesGen = emacsPackagesFor; # added 2018-08-18
   emacsPackagesNgGen = emacsPackagesFor; # added 2018-08-18
@@ -335,6 +336,7 @@ mapAliases ({
   kodiGBM = kodi-gbm;
   kodiPlain = kodi;
   kodiPlainWayland = kodi-wayland;
+  jellyfin_10_5 = throw "Jellyfin 10.5 is no longer supported and contains a security vulnerability. Please upgrade to a newer version."; # added 2021-04-26
   julia_07 = throw "julia_07 is deprecated in favor of julia_10 LTS"; # added 2020-09-15
   julia_11 = throw "julia_11 is deprecated in favor of latest Julia version"; # added 2020-09-15
   kdeconnect = plasma5Packages.kdeconnect-kde; # added 2020-10-28
@@ -401,6 +403,12 @@ mapAliases ({
   linuxPackages_testing_hardened = throw "linuxPackages_testing_hardened has been removed, please use linuxPackages_latest_hardened";
   linux_testing_hardened = throw "linux_testing_hardened has been removed, please use linux_latest_hardened";
 
+  # added 2021-04-04
+  linuxPackages_xen_dom0 = linuxPackages;
+  linuxPackages_latest_xen_dom0 = linuxPackages_latest;
+  linuxPackages_xen_dom0_hardened = linuxPackages_hardened;
+  linuxPackages_latest_xen_dom0_hardened = linuxPackages_latest_hardened;
+
   linux-steam-integration = throw "linux-steam-integration has been removed, as the upstream project has been abandoned"; # added 2020-05-22
   loadcaffe = throw "loadcaffe has been removed, as the upstream project has been abandoned"; # added 2020-03-28
   lprof = throw "lprof has been removed as it's unmaintained upstream and broken in nixpkgs since a while ago"; # added 2021-02-15
diff --git a/third_party/nixpkgs/pkgs/top-level/all-packages.nix b/third_party/nixpkgs/pkgs/top-level/all-packages.nix
index 92de726825..ca7aa6a547 100644
--- a/third_party/nixpkgs/pkgs/top-level/all-packages.nix
+++ b/third_party/nixpkgs/pkgs/top-level/all-packages.nix
@@ -265,6 +265,8 @@ in
 
   protoc-gen-go = callPackage ../development/tools/protoc-gen-go { };
 
+  protoc-gen-go-grpc = callPackage ../development/tools/protoc-gen-go-grpc { };
+
   protoc-gen-twirp = callPackage ../development/tools/protoc-gen-twirp { };
 
   protoc-gen-twirp_php = callPackage ../development/tools/protoc-gen-twirp_php { };
@@ -912,6 +914,8 @@ in
     inherit (haskellPackages) ghcWithPackages;
   };
 
+  termsyn = callPackage ../data/fonts/termsyn { };
+
   tilda = callPackage ../applications/terminal-emulators/tilda {
     gtk = gtk3;
   };
@@ -1231,6 +1235,8 @@ in
 
   inherit (nodePackages) castnow;
 
+  castty = callPackage ../tools/misc/castty { };
+
   certigo = callPackage ../tools/admin/certigo { };
 
   catcli = python3Packages.callPackage ../tools/filesystems/catcli { };
@@ -2045,6 +2051,8 @@ in
 
   clasp = callPackage ../tools/misc/clasp { };
 
+  clevercsv = with python3Packages; toPythonApplication clevercsv;
+
   clevis = callPackage ../tools/security/clevis {
     asciidoc = asciidoc-full;
   };
@@ -2131,6 +2139,8 @@ in
 
   wev = callPackage ../tools/wayland/wev { };
 
+  wdomirror = callPackage ../tools/wayland/wdomirror { };
+
   wl-clipboard = callPackage ../tools/wayland/wl-clipboard { };
 
   wlogout = callPackage ../tools/wayland/wlogout { };
@@ -2268,7 +2278,7 @@ in
     inherit (haskellPackages) ghcWithPackages diagrams-builder;
   };
 
-  dialog = callPackage ../development/tools/misc/dialog { };
+  dialog = callPackage ../tools/misc/dialog { };
 
   dibbler = callPackage ../tools/networking/dibbler { };
 
@@ -2372,8 +2382,6 @@ in
     enableSSH = true;
   };
 
-  dylibbundler = callPackage ../tools/misc/dylibbundler { };
-
   dynamic-colors = callPackage ../tools/misc/dynamic-colors { };
 
   dyncall = callPackage ../development/libraries/dyncall { };
@@ -2689,8 +2697,6 @@ in
 
   jellyfin = callPackage ../servers/jellyfin { };
 
-  jellyfin_10_5 = callPackage ../servers/jellyfin/10.5.x.nix { };
-
   jellyfin-media-player = libsForQt5.callPackage ../applications/video/jellyfin-media-player {
     inherit (darwin.apple_sdk.frameworks) CoreFoundation Cocoa CoreAudio MediaPlayer;
   };
@@ -4646,7 +4652,7 @@ in
   frostwire-bin = callPackage ../applications/networking/p2p/frostwire/frostwire-bin.nix { };
 
   ftgl = callPackage ../development/libraries/ftgl {
-    inherit (darwin.apple_sdk.frameworks) OpenGL;
+    inherit (darwin.apple_sdk.frameworks) OpenGL GLUT;
   };
 
   ftop = callPackage ../os-specific/linux/ftop { };
@@ -5152,6 +5158,8 @@ in
 
   gpt2tc = callPackage ../tools/text/gpt2tc { };
 
+  gptman = callPackage ../tools/system/gptman { };
+
   ldmtool = callPackage ../tools/misc/ldmtool { };
 
   gphotos-sync = callPackage ../tools/backup/gphotos-sync { };
@@ -6100,6 +6108,8 @@ in
 
   m2r = python3Packages.callPackage ../tools/text/m2r { };
 
+  md2gemini = with python3.pkgs; toPythonApplication md2gemini;
+
   mdbook = callPackage ../tools/text/mdbook {
     inherit (darwin.apple_sdk.frameworks) CoreServices;
   };
@@ -7157,6 +7167,8 @@ in
   openbazaar = callPackage ../applications/networking/openbazaar { };
   openbazaar-client = callPackage ../applications/networking/openbazaar/client.nix { };
 
+  openboard = libsForQt5.callPackage ../applications/graphics/openboard { };
+
   opencc = callPackage ../tools/text/opencc { };
 
   opencl-info = callPackage ../tools/system/opencl-info { };
@@ -7563,6 +7575,8 @@ in
 
   tab = callPackage ../tools/text/tab { };
 
+  tabview = with python3Packages; toPythonApplication tabview;
+
   tautulli = python3Packages.callPackage ../servers/tautulli { };
 
   pleroma-otp = callPackage ../servers/pleroma-otp { };
@@ -7970,6 +7984,8 @@ in
 
   reftools = callPackage ../development/tools/reftools { };
 
+  remote-touchpad = callPackage ../tools/inputmethods/remote-touchpad { };
+
   reposurgeon = callPackage ../applications/version-management/reposurgeon { };
 
   reptyr = callPackage ../os-specific/linux/reptyr {};
@@ -9758,6 +9774,8 @@ in
 
   zdelta = callPackage ../tools/compression/zdelta { };
 
+  zellij = callPackage ../tools/misc/zellij { };
+
   zenith = callPackage ../tools/system/zenith {
     inherit (darwin.apple_sdk.frameworks) IOKit;
   };
@@ -17612,7 +17630,7 @@ in
 
   stlport = callPackage ../development/libraries/stlport { };
 
-  streamlink = callPackage ../applications/video/streamlink { pythonPackages = python3Packages; };
+  streamlink = callPackage ../applications/video/streamlink { };
   streamlink-twitch-gui-bin = callPackage ../applications/video/streamlink-twitch-gui/bin.nix {};
 
   sub-batch = callPackage ../applications/video/sub-batch { };
@@ -17910,6 +17928,7 @@ in
   wavpack = callPackage ../development/libraries/wavpack { };
 
   wayland = callPackage ../development/libraries/wayland { };
+  wayland-scanner = wayland.bin;
 
   wayland-protocols = callPackage ../development/libraries/wayland/protocols.nix { };
 
@@ -18528,6 +18547,8 @@ in
 
   hyp = callPackage ../servers/http/hyp { };
 
+  podgrab = callPackage ../servers/misc/podgrab { };
+
   prosody = callPackage ../servers/xmpp/prosody {
     # _compat can probably be removed on next minor version after 0.10.0
     lua5 = lua5_2_compat;
@@ -20025,7 +20046,7 @@ in
     inherit (kernel) stdenv; # in particular, use the same compiler by default
 
     # to help determine module compatibility
-    inherit (kernel) isXen isZen isHardened isLibre;
+    inherit (kernel) isZen isHardened isLibre;
     inherit (kernel) kernelOlder kernelAtLeast;
 
     # Obsolete aliases (these packages do not depend on the kernel).
@@ -20287,11 +20308,6 @@ in
   # Build a kernel with bcachefs module
   linuxPackages_testing_bcachefs = recurseIntoAttrs (linuxPackagesFor pkgs.linux_testing_bcachefs);
 
-  # Build a kernel for Xen dom0
-  linuxPackages_xen_dom0 = recurseIntoAttrs (linuxPackagesFor (pkgs.linux.override { features.xen_dom0=true; }));
-
-  linuxPackages_latest_xen_dom0 = recurseIntoAttrs (linuxPackagesFor (pkgs.linux_latest.override { features.xen_dom0=true; }));
-
   # Hardened Linux
   hardenedLinuxPackagesFor = kernel': overrides:
     let # Note: We use this hack since the hardened patches can lag behind and we don't want to delay updates:
@@ -20315,10 +20331,6 @@ in
   linuxPackages_latest_hardened = recurseIntoAttrs (hardenedLinuxPackagesFor pkgs.linux_latest { });
   linux_latest_hardened = linuxPackages_latest_hardened.kernel;
 
-  linuxPackages_xen_dom0_hardened = recurseIntoAttrs (hardenedLinuxPackagesFor pkgs.linux { features.xen_dom0=true; });
-
-  linuxPackages_latest_xen_dom0_hardened = recurseIntoAttrs (hardenedLinuxPackagesFor pkgs.linux_latest { features.xen_dom0=true; });
-
   # Hardkernel (Odroid) kernels.
   linuxPackages_hardkernel_4_14 = recurseIntoAttrs (linuxPackagesFor pkgs.linux_hardkernel_4_14);
   linuxPackages_hardkernel_latest = linuxPackages_hardkernel_4_14;
@@ -24648,6 +24660,8 @@ in
 
   motif = callPackage ../development/libraries/motif { };
 
+  mousai = callPackage ../applications/audio/mousai { };
+
   mozjpeg = callPackage ../applications/graphics/mozjpeg { };
 
   easytag = callPackage ../applications/audio/easytag { };
@@ -25790,6 +25804,8 @@ in
 
   secretscanner = callPackage ../tools/security/secretscanner { };
 
+  semiphemeral = callPackage ../tools/misc/semiphemeral { };
+
   sent = callPackage ../applications/misc/sent { };
 
   seq24 = callPackage ../applications/audio/seq24 { };
@@ -28703,6 +28719,8 @@ in
 
   dcm2niix = callPackage ../applications/science/biology/dcm2niix { };
 
+  deepdiff = with python3Packages; toPythonApplication deepdiff;
+
   deepsea = callPackage ../tools/security/deepsea { };
 
   deeptools = callPackage ../applications/science/biology/deeptools { python = python3; };
@@ -31004,6 +31022,8 @@ in
 
   simplehttp2server = callPackage ../servers/simplehttp2server { };
 
+  simple-http-server = callPackage ../servers/simple-http-server { };
+
   diceware = with python3Packages; toPythonApplication diceware;
 
   xml2rfc = with python3Packages; toPythonApplication xml2rfc;
@@ -31144,6 +31164,8 @@ in
 
   fac-build = callPackage ../development/tools/build-managers/fac {};
 
+  treefmt = callPackage ../development/tools/treefmt { };
+
   bottom = callPackage ../tools/system/bottom {};
 
   cagebreak = callPackage ../applications/window-managers/cagebreak/default.nix {
diff --git a/third_party/nixpkgs/pkgs/top-level/ocaml-packages.nix b/third_party/nixpkgs/pkgs/top-level/ocaml-packages.nix
index d8c1f2d3e4..bb45415357 100644
--- a/third_party/nixpkgs/pkgs/top-level/ocaml-packages.nix
+++ b/third_party/nixpkgs/pkgs/top-level/ocaml-packages.nix
@@ -401,6 +401,8 @@ let
       inherit (pkgs) gsl;
     };
 
+    h2 = callPackage ../development/ocaml-modules/h2 { };
+
     hacl_x25519 = callPackage ../development/ocaml-modules/hacl_x25519 { };
 
     herelib = callPackage ../development/ocaml-modules/herelib { };
@@ -413,6 +415,8 @@ let
 
     hmap = callPackage ../development/ocaml-modules/hmap { };
 
+    hpack = callPackage ../development/ocaml-modules/hpack { };
+
     hxd = callPackage ../development/ocaml-modules/hxd { };
 
     imagelib = callPackage ../development/ocaml-modules/imagelib { };
@@ -576,6 +580,8 @@ let
 
     lens = callPackage ../development/ocaml-modules/lens { };
 
+    letsencrypt = callPackage ../development/ocaml-modules/letsencrypt { };
+
     linenoise = callPackage ../development/ocaml-modules/linenoise { };
 
     llvm = callPackage ../development/ocaml-modules/llvm {
@@ -675,6 +681,8 @@ let
 
     mirage-bootvar-unix = callPackage ../development/ocaml-modules/mirage-bootvar-unix { };
 
+    mirage-bootvar-xen = callPackage ../development/ocaml-modules/mirage-bootvar-xen { };
+
     mirage-channel = callPackage ../development/ocaml-modules/mirage-channel { };
 
     mirage-clock = callPackage ../development/ocaml-modules/mirage-clock { };
@@ -717,6 +725,8 @@ let
 
     mirage-net = callPackage ../development/ocaml-modules/mirage-net { };
 
+    mirage-net-xen = callPackage ../development/ocaml-modules/mirage-net-xen { };
+
     mirage-profile = callPackage ../development/ocaml-modules/mirage-profile { };
 
     mirage-protocols = callPackage ../development/ocaml-modules/mirage-protocols { };
@@ -739,6 +749,8 @@ let
 
     mirage-unix = callPackage ../development/ocaml-modules/mirage-unix { };
 
+    mirage-xen = callPackage ../development/ocaml-modules/mirage-xen { };
+
     mirage-vnetif = callPackage ../development/ocaml-modules/mirage-vnetif { };
 
     mlgmp =  callPackage ../development/ocaml-modules/mlgmp { };
@@ -753,6 +765,8 @@ let
 
     mustache =  callPackage ../development/ocaml-modules/mustache { };
 
+    netchannel = callPackage ../development/ocaml-modules/netchannel { };
+
     nocrypto =  callPackage ../development/ocaml-modules/nocrypto { };
 
     nonstd =  callPackage ../development/ocaml-modules/nonstd { };
@@ -930,6 +944,8 @@ let
 
     ounit2 = callPackage ../development/ocaml-modules/ounit2 { };
 
+    paf = callPackage ../development/ocaml-modules/paf { };
+
     parse-argv = callPackage ../development/ocaml-modules/parse-argv { };
 
     path_glob = callPackage ../development/ocaml-modules/path_glob { };
@@ -1138,6 +1154,10 @@ let
 
     sha = callPackage ../development/ocaml-modules/sha { };
 
+    shared-memory-ring = callPackage ../development/ocaml-modules/shared-memory-ring { };
+
+    shared-memory-ring-lwt = callPackage ../development/ocaml-modules/shared-memory-ring/lwt.nix { };
+
     sodium = callPackage ../development/ocaml-modules/sodium { };
 
     spelll = callPackage ../development/ocaml-modules/spelll { };
diff --git a/third_party/nixpkgs/pkgs/top-level/python-packages.nix b/third_party/nixpkgs/pkgs/top-level/python-packages.nix
index fc78e1b143..adb4a4aa40 100644
--- a/third_party/nixpkgs/pkgs/top-level/python-packages.nix
+++ b/third_party/nixpkgs/pkgs/top-level/python-packages.nix
@@ -96,15 +96,18 @@ let
       };
     });
 
-  disabledIf = x: drv:
-    if x then throw "${removePythonPrefix (drv.pname or drv.name)} not supported for interpreter ${python.executable}" else drv;
+  disabled = drv: throw "${removePythonPrefix (drv.pname or drv.name)} not supported for interpreter ${python.executable}";
+
+  disabledIf = x: drv: if x then disabled drv else drv;
 
 in {
 
+  inherit pkgs stdenv;
+
   inherit (python.passthru) isPy27 isPy35 isPy36 isPy37 isPy38 isPy39 isPy3k isPyPy pythonAtLeast pythonOlder;
   inherit python bootstrapped-pip buildPythonPackage buildPythonApplication;
   inherit fetchPypi;
-  inherit hasPythonModule requiredPythonModules makePythonPath disabledIf;
+  inherit hasPythonModule requiredPythonModules makePythonPath disabled disabledIf;
   inherit toPythonModule toPythonApplication;
   inherit buildSetupcfg;
 
@@ -154,10 +157,7 @@ in {
 
   recursivePthLoader = callPackage ../development/python-modules/recursive-pth-loader { };
 
-  setuptools = if isPy27 then
-    callPackage ../development/python-modules/setuptools/44.0.nix { }
-  else
-    callPackage ../development/python-modules/setuptools { };
+  setuptools = callPackage ../development/python-modules/setuptools { };
 
   aadict = callPackage ../development/python-modules/aadict { };
 
@@ -211,8 +211,6 @@ in {
 
   affine = callPackage ../development/python-modules/affine { };
 
-  affinity = callPackage ../development/python-modules/affinity { };
-
   agate = callPackage ../development/python-modules/agate { };
 
   agate-dbf = callPackage ../development/python-modules/agate-dbf { };
@@ -425,10 +423,6 @@ in {
 
   ansiwrap = callPackage ../development/python-modules/ansiwrap { };
 
-  antlr4-python2-runtime = callPackage ../development/python-modules/antlr4-python2-runtime {
-    inherit (pkgs) antlr4;
-  };
-
   antlr4-python3-runtime = callPackage ../development/python-modules/antlr4-python3-runtime {
     inherit (pkgs) antlr4;
   };
@@ -451,10 +445,6 @@ in {
 
   appdirs = callPackage ../development/python-modules/appdirs { };
 
-  appleseed = disabledIf isPy3k (toPythonModule (pkgs.appleseed.override { inherit (self) python; }));
-
-  application = callPackage ../development/python-modules/application { };
-
   applicationinsights = callPackage ../development/python-modules/applicationinsights { };
 
   appnope = callPackage ../development/python-modules/appnope { };
@@ -515,10 +505,7 @@ in {
 
   asdf = callPackage ../development/python-modules/asdf { };
 
-  ase = if isPy27 then
-    callPackage ../development/python-modules/ase/3.17.nix { }
-  else
-    callPackage ../development/python-modules/ase { };
+  ase = callPackage ../development/python-modules/ase { };
 
   asgi-csrf = callPackage ../development/python-modules/asgi-csrf { };
 
@@ -538,10 +525,7 @@ in {
 
   astral = callPackage ../development/python-modules/astral { };
 
-  astroid = if isPy3k then
-    callPackage ../development/python-modules/astroid { }
-  else
-    callPackage ../development/python-modules/astroid/1.6.nix { };
+  astroid = callPackage ../development/python-modules/astroid { };
 
   astropy = callPackage ../development/python-modules/astropy { };
 
@@ -923,12 +907,10 @@ in {
 
   backports-datetime-fromisoformat = callPackage ../development/python-modules/backports-datetime-fromisoformat { };
 
+  backports-entry-points-selectable = callPackage ../development/python-modules/backports-entry-points-selectable { };
+
   backports_functools_lru_cache = callPackage ../development/python-modules/backports_functools_lru_cache { };
 
-  backports_lzma = callPackage ../development/python-modules/backports_lzma { };
-
-  backports_os = callPackage ../development/python-modules/backports_os { };
-
   backports_shutil_get_terminal_size = callPackage ../development/python-modules/backports_shutil_get_terminal_size { };
 
   backports-shutil-which = callPackage ../development/python-modules/backports-shutil-which { };
@@ -983,10 +965,7 @@ in {
 
   bcdoc = callPackage ../development/python-modules/bcdoc { };
 
-  bcrypt = if pythonOlder "3.6" then
-    callPackage ../development/python-modules/bcrypt/3_1.nix { }
-  else
-    callPackage ../development/python-modules/bcrypt { };
+  bcrypt = callPackage ../development/python-modules/bcrypt { };
 
   beaker = callPackage ../development/python-modules/beaker { };
 
@@ -1046,10 +1025,6 @@ in {
 
   bitbox02 = callPackage ../development/python-modules/bitbox02 { };
 
-  bitbucket_api = callPackage ../development/python-modules/bitbucket-api { };
-
-  bitbucket-cli = callPackage ../development/python-modules/bitbucket-cli { };
-
   bitcoinlib = callPackage ../development/python-modules/bitcoinlib { };
 
   bitcoin-price-api = callPackage ../development/python-modules/bitcoin-price-api { };
@@ -1086,8 +1061,6 @@ in {
 
   blist = callPackage ../development/python-modules/blist { };
 
-  blivet = callPackage ../development/python-modules/blivet { };
-
   blockchain = callPackage ../development/python-modules/blockchain { };
 
   blockdiag = callPackage ../development/python-modules/blockdiag { };
@@ -1129,8 +1102,6 @@ in {
 
   bottleneck = callPackage ../development/python-modules/bottleneck { };
 
-  box2d = callPackage ../development/python-modules/box2d { };
-
   bpython = callPackage ../development/python-modules/bpython { };
 
   bracex = callPackage ../development/python-modules/bracex { };
@@ -1159,8 +1130,6 @@ in {
 
   browser-cookie3 = callPackage ../development/python-modules/browser-cookie3 { };
 
-  browsermob-proxy = disabledIf isPy3k (callPackage ../development/python-modules/browsermob-proxy { });
-
   bsddb3 = callPackage ../development/python-modules/bsddb3 { };
 
   bsdiff4 = callPackage ../development/python-modules/bsdiff4 { };
@@ -1230,15 +1199,9 @@ in {
     inherit (self) python numpy boost;
   });
 
-  cairocffi = if isPy3k then
-    callPackage ../development/python-modules/cairocffi { }
-  else
-    callPackage ../development/python-modules/cairocffi/0_9.nix { };
+  cairocffi = callPackage ../development/python-modules/cairocffi { };
 
-  cairosvg = if isPy3k then
-    callPackage ../development/python-modules/cairosvg { }
-  else
-    callPackage ../development/python-modules/cairosvg/1_x.nix { };
+  cairosvg = callPackage ../development/python-modules/cairosvg { };
 
   caldav = callPackage ../development/python-modules/caldav { };
 
@@ -1286,10 +1249,6 @@ in {
 
   cchardet = callPackage ../development/python-modules/cchardet { };
 
-  CDDB = callPackage ../development/python-modules/cddb { };
-
-  cdecimal = callPackage ../development/python-modules/cdecimal { };
-
   celery = callPackage ../development/python-modules/celery { };
 
   cement = callPackage ../development/python-modules/cement { };
@@ -1356,14 +1315,9 @@ in {
 
   cheetah3 = callPackage ../development/python-modules/cheetah3 { };
 
-  cheetah = callPackage ../development/python-modules/cheetah { };
-
   cheroot = callPackage ../development/python-modules/cheroot { };
 
-  cherrypy = if isPy3k then
-    callPackage ../development/python-modules/cherrypy { }
-  else
-    callPackage ../development/python-modules/cherrypy/17.nix { };
+  cherrypy = callPackage ../development/python-modules/cherrypy { };
 
   chevron = callPackage ../development/python-modules/chevron { };
 
@@ -1381,6 +1335,8 @@ in {
 
   citeproc-py = callPackage ../development/python-modules/citeproc-py { };
 
+  cjkwrap = callPackage ../development/python-modules/cjkwrap { };
+
   cjson = callPackage ../development/python-modules/cjson { };
 
   ckcc-protocol = callPackage ../development/python-modules/ckcc-protocol { };
@@ -1395,9 +1351,9 @@ in {
 
   cleo = callPackage ../development/python-modules/cleo { };
 
-  clf = callPackage ../development/python-modules/clf { };
+  clevercsv = callPackage ../development/python-modules/clevercsv { };
 
-  cliapp = callPackage ../development/python-modules/cliapp { };
+  clf = callPackage ../development/python-modules/clf { };
 
   click = callPackage ../development/python-modules/click { };
 
@@ -1445,8 +1401,6 @@ in {
 
   clldutils = callPackage ../development/python-modules/clldutils { };
 
-  closure-linter = callPackage ../development/python-modules/closure-linter { };
-
   cloudflare = callPackage ../development/python-modules/cloudflare { };
 
   cloudpickle = callPackage ../development/python-modules/cloudpickle { };
@@ -1463,8 +1417,6 @@ in {
 
   cmdline = callPackage ../development/python-modules/cmdline { };
 
-  cmdtest = callPackage ../development/python-modules/cmdtest { };
-
   cmigemo = callPackage ../development/python-modules/cmigemo {
     inherit (pkgs) cmigemo;
   };
@@ -1487,8 +1439,6 @@ in {
 
   cogapp = callPackage ../development/python-modules/cogapp { };
 
-  coilmq = callPackage ../development/python-modules/coilmq { };
-
   ColanderAlchemy = callPackage ../development/python-modules/colanderalchemy { };
 
   colander = callPackage ../development/python-modules/colander { };
@@ -1530,10 +1480,7 @@ in {
 
   configobj = callPackage ../development/python-modules/configobj { };
 
-  configparser = if pythonOlder "3.6" then
-    callPackage ../development/python-modules/configparser/4.nix { }
-  else
-    callPackage ../development/python-modules/configparser { };
+  configparser = callPackage ../development/python-modules/configparser { };
 
   configshell = callPackage ../development/python-modules/configshell { };
 
@@ -1547,10 +1494,7 @@ in {
 
   constantly = callPackage ../development/python-modules/constantly { };
 
-  construct = if isPy27 then
-    callPackage ../development/python-modules/construct/2.10.54.nix { }
-  else
-    callPackage ../development/python-modules/construct { };
+  construct = callPackage ../development/python-modules/construct { };
 
   consul = callPackage ../development/python-modules/consul { };
 
@@ -1560,10 +1504,7 @@ in {
 
   contextvars = callPackage ../development/python-modules/contextvars { };
 
-  convertdate = if isPy27 then
-    callPackage ../development/python-modules/convertdate/2.2.x.nix { }
-  else
-    callPackage ../development/python-modules/convertdate { };
+  convertdate = callPackage ../development/python-modules/convertdate { };
 
   cookiecutter = callPackage ../development/python-modules/cookiecutter { };
 
@@ -1619,15 +1560,9 @@ in {
 
   cryptacular = callPackage ../development/python-modules/cryptacular { };
 
-  cryptography = if isPy27 then
-    callPackage ../development/python-modules/cryptography/3.3.nix { }
-  else
-    callPackage ../development/python-modules/cryptography { };
+  cryptography = callPackage ../development/python-modules/cryptography { };
 
-  cryptography_vectors = if isPy27 then
-    callPackage ../development/python-modules/cryptography/vectors-3.3.nix { }
-  else
-    callPackage ../development/python-modules/cryptography/vectors.nix { };
+  cryptography_vectors = callPackage ../development/python-modules/cryptography/vectors.nix { };
 
   crytic-compile = callPackage ../development/python-modules/crytic-compile { };
 
@@ -1668,6 +1603,8 @@ in {
 
   curve25519-donna = callPackage ../development/python-modules/curve25519-donna { };
 
+  cve-bin-tool = callPackage ../development/python-modules/cve-bin-tool { };
+
   cvxopt = callPackage ../development/python-modules/cvxopt { };
 
   cvxpy = callPackage ../development/python-modules/cvxpy { };
@@ -1698,8 +1635,6 @@ in {
 
   daphne = callPackage ../development/python-modules/daphne { };
 
-  darcsver = callPackage ../development/python-modules/darcsver { };
-
   dash = callPackage ../development/python-modules/dash { };
 
   dash-core-components = callPackage ../development/python-modules/dash-core-components { };
@@ -1756,10 +1691,7 @@ in {
 
   datatable = callPackage ../development/python-modules/datatable { };
 
-  dateparser = if isPy27 then
-    callPackage ../development/python-modules/dateparser/0.x.nix { }
-  else
-    callPackage ../development/python-modules/dateparser { };
+  dateparser = callPackage ../development/python-modules/dateparser { };
 
   datrie = callPackage ../development/python-modules/datrie { };
 
@@ -1829,8 +1761,6 @@ in {
 
   descartes = callPackage ../development/python-modules/descartes { };
 
-  deskcon = callPackage ../development/python-modules/deskcon { };
-
   desktop-notifier = callPackage ../development/python-modules/desktop-notifier { };
 
   detox = throw "detox is no longer maintained, and was broken since may 2019"; # added 2020-07-04
@@ -1931,8 +1861,6 @@ in {
 
   django_environ = callPackage ../development/python-modules/django_environ { };
 
-  django_evolution = callPackage ../development/python-modules/django_evolution { };
-
   django_extensions = callPackage ../development/python-modules/django-extensions { };
 
   django-filter = callPackage ../development/python-modules/django-filter { };
@@ -2048,10 +1976,7 @@ in {
 
   dnslib = callPackage ../development/python-modules/dnslib { };
 
-  dnspython = if isPy3k then
-    callPackage ../development/python-modules/dnspython { }
-  else
-    self.dnspython_1;
+  dnspython = callPackage ../development/python-modules/dnspython { };
 
   dnspython_1 = callPackage ../development/python-modules/dnspython/1.nix { };
 
@@ -2067,7 +1992,7 @@ in {
 
   docker_pycreds = callPackage ../development/python-modules/docker-pycreds { };
 
-  docker-py = disabledIf isPy27 (callPackage ../development/python-modules/docker-py { });
+  docker-py = callPackage ../development/python-modules/docker-py { };
 
   dockerspawner = callPackage ../development/python-modules/dockerspawner { };
 
@@ -2127,8 +2052,6 @@ in {
 
   dsmr-parser = callPackage ../development/python-modules/dsmr-parser { };
 
-  dtopt = callPackage ../development/python-modules/dtopt { };
-
   duckdb = callPackage ../development/python-modules/duckdb {
     inherit (pkgs) duckdb;
   };
@@ -2139,10 +2062,7 @@ in {
 
   dugong = callPackage ../development/python-modules/dugong { };
 
-  dulwich = if isPy3k then
-    callPackage ../development/python-modules/dulwich { }
-  else
-    callPackage ../development/python-modules/dulwich/0_19.nix { };
+  dulwich = callPackage ../development/python-modules/dulwich { };
 
   dwdwfsapi = callPackage ../development/python-modules/dwdwfsapi { };
 
@@ -2229,8 +2149,6 @@ in {
 
   enum34 = callPackage ../development/python-modules/enum34 { };
 
-  enum = callPackage ../development/python-modules/enum { };
-
   enum-compat = callPackage ../development/python-modules/enum-compat { };
 
   envisage = callPackage ../development/python-modules/envisage { };
@@ -2273,8 +2191,6 @@ in {
 
   eventlet = callPackage ../development/python-modules/eventlet { };
 
-  eventlib = callPackage ../development/python-modules/eventlib { };
-
   events = callPackage ../development/python-modules/events { };
 
   evernote = callPackage ../development/python-modules/evernote { };
@@ -2385,17 +2301,12 @@ in {
 
   fasttext = callPackage ../development/python-modules/fasttext { };
 
-  faulthandler = if !isPy3k then
-    callPackage ../development/python-modules/faulthandler { }
-  else
-    throw "faulthandler is built into ${python.executable}";
+  faulthandler = throw "faulthandler is built into ${python.executable}";
 
   favicon = callPackage ../development/python-modules/favicon { };
 
   fb-re2 = callPackage ../development/python-modules/fb-re2 { };
 
-  fdint = callPackage ../development/python-modules/fdint { };
-
   fe25519 = callPackage ../development/python-modules/fe25519 { };
 
   feedgen = callPackage ../development/python-modules/feedgen { };
@@ -2404,10 +2315,7 @@ in {
     inherit (pkgs) glibcLocales;
   };
 
-  feedparser = if isPy3k then
-    callPackage ../development/python-modules/feedparser { }
-  else
-    callPackage ../development/python-modules/feedparser/5.nix { };
+  feedparser = callPackage ../development/python-modules/feedparser { };
 
   fenics = callPackage ../development/libraries/science/math/fenics {
     pytest = self.pytest_4;
@@ -2505,8 +2413,6 @@ in {
 
   flask-jwt-extended = callPackage ../development/python-modules/flask-jwt-extended { };
 
-  flask_ldap_login = callPackage ../development/python-modules/flask-ldap-login { };
-
   flask-limiter = callPackage ../development/python-modules/flask-limiter { };
 
   flask_login = callPackage ../development/python-modules/flask-login { };
@@ -2583,8 +2489,6 @@ in {
 
   flufl_lock = callPackage ../development/python-modules/flufl/lock.nix { };
 
-  flup = callPackage ../development/python-modules/flup { };
-
   flux-led = callPackage ../development/python-modules/flux-led { };
 
   fn = callPackage ../development/python-modules/fn { };
@@ -2593,10 +2497,10 @@ in {
 
   folium = callPackage ../development/python-modules/folium { };
 
-  fontforge = disabledIf (!isPy3k) (toPythonModule (pkgs.fontforge.override {
+  fontforge = toPythonModule (pkgs.fontforge.override {
     withPython = true;
     inherit python;
-  }));
+  });
 
   fontmath = callPackage ../development/python-modules/fontmath { };
 
@@ -2631,10 +2535,7 @@ in {
 
   freetype-py = callPackage ../development/python-modules/freetype-py { };
 
-  freezegun = if isPy27 then
-      callPackage ../development/python-modules/freezegun/0.3.nix { }
-    else
-      callPackage ../development/python-modules/freezegun { };
+  freezegun = callPackage ../development/python-modules/freezegun { };
 
   fritzconnection = callPackage ../development/python-modules/fritzconnection { };
 
@@ -2650,8 +2551,6 @@ in {
 
   ftputil = callPackage ../development/python-modules/ftputil { };
 
-  fudge = callPackage ../development/python-modules/fudge { };
-
   funcparserlib = callPackage ../development/python-modules/funcparserlib { };
 
   funcsigs = callPackage ../development/python-modules/funcsigs { };
@@ -2672,19 +2571,12 @@ in {
 
   future-fstrings = callPackage ../development/python-modules/future-fstrings { };
 
-  futures = callPackage ../development/python-modules/futures { };
-
   fuzzyfinder = callPackage ../development/python-modules/fuzzyfinder { };
 
   fuzzywuzzy = callPackage ../development/python-modules/fuzzywuzzy { };
 
   fx2 = callPackage ../development/python-modules/fx2 { };
 
-  gaia = disabledIf (isPyPy || isPy3k) (toPythonModule (pkgs.gaia.override {
-    pythonPackages = self;
-    pythonSupport = true;
-  })); # gaia isn't supported with python3 and it's not available from pypi
-
   galario = toPythonModule (pkgs.galario.override {
     enablePython = true;
     pythonPackages = self;
@@ -2692,8 +2584,6 @@ in {
 
   gast = callPackage ../development/python-modules/gast { };
 
-  gateone = callPackage ../development/python-modules/gateone { };
-
   gcovr = callPackage ../development/python-modules/gcovr { };
 
   gcsfs = callPackage ../development/python-modules/gcsfs { };
@@ -2702,21 +2592,19 @@ in {
 
   gdata = callPackage ../development/python-modules/gdata { };
 
-  gdcm = disabledIf isPy27 (toPythonModule (pkgs.gdcm.override {
+  gdcm = toPythonModule (pkgs.gdcm.override {
     inherit (self) python;
     enablePython = true;
-  }));
+  });
 
   gdown = callPackage ../development/python-modules/gdown { };
 
-  gdrivefs = callPackage ../development/python-modules/gdrivefs { };
-
   ge25519 = callPackage ../development/python-modules/ge25519 { };
 
-  geant4 = disabledIf (!isPy3k) (toPythonModule (pkgs.geant4.override {
+  geant4 = toPythonModule (pkgs.geant4.override {
     enablePython = true;
     python3 = python;
-  }));
+  });
 
   geeknote = callPackage ../development/python-modules/geeknote { };
 
@@ -2752,10 +2640,7 @@ in {
 
   geopandas = callPackage ../development/python-modules/geopandas { };
 
-  geopy = if isPy3k then
-    callPackage ../development/python-modules/geopy { }
-  else
-    callPackage ../development/python-modules/geopy/2.nix { };
+  geopy = callPackage ../development/python-modules/geopy { };
 
   getmac = callPackage ../development/python-modules/getmac { };
 
@@ -2820,31 +2705,16 @@ in {
 
   gnureadline = callPackage ../development/python-modules/gnureadline { };
 
-  gnutls = callPackage ../development/python-modules/gnutls { };
-
   goobook = callPackage ../development/python-modules/goobook { };
 
   goocalendar = callPackage ../development/python-modules/goocalendar { };
 
   google-api-core = callPackage ../development/python-modules/google-api-core { };
 
-  google-api-python-client =
-    let google-api-python-client = callPackage ../development/python-modules/google-api-python-client { };
-    in if isPy3k then
-      google-api-python-client
-    else # Python 2.7 support was deprecated but is still needed by weboob and duplicity
-      google-api-python-client.overridePythonAttrs (old: rec {
-        version = "1.7.6";
-        src = old.src.override {
-          inherit version;
-          sha256 = "14w5sdrp0bk9n0r2lmpqmrbf2zclpfq6q7giyahnskkfzdkb165z";
-        };
-      });
+  google-api-python-client = callPackage ../development/python-modules/google-api-python-client { };
 
   googleapis-common-protos = callPackage ../development/python-modules/googleapis-common-protos { };
 
-  google-apputils = callPackage ../development/python-modules/google-apputils { };
-
   google-auth = callPackage ../development/python-modules/google-auth { };
 
   google-auth-httplib2 = callPackage ../development/python-modules/google-auth-httplib2 { };
@@ -3020,11 +2890,6 @@ in {
 
   gremlinpython = callPackage ../development/python-modules/gremlinpython { };
 
-  grib-api = disabledIf (!isPy27) (toPythonModule (pkgs.grib-api.override {
-    enablePython = true;
-    pythonPackages = self;
-  }));
-
   grip = callPackage ../development/python-modules/grip { };
 
   grpc_google_iam_v1 = callPackage ../development/python-modules/grpc_google_iam_v1 { };
@@ -3035,10 +2900,7 @@ in {
 
   grpcio-tools = callPackage ../development/python-modules/grpcio-tools { };
 
-  gsd = if isPy27 then
-    callPackage ../development/python-modules/gsd/1.7.nix { }
-  else
-    callPackage ../development/python-modules/gsd { };
+  gsd = callPackage ../development/python-modules/gsd { };
 
   gspread = callPackage ../development/python-modules/gspread { };
 
@@ -3064,10 +2926,7 @@ in {
 
   gumath = callPackage ../development/python-modules/gumath { };
 
-  gunicorn = if isPy27 then
-    callPackage ../development/python-modules/gunicorn/19.nix { }
-  else
-    callPackage ../development/python-modules/gunicorn { };
+  gunicorn = callPackage ../development/python-modules/gunicorn { };
 
   guppy3 = callPackage ../development/python-modules/guppy3 { };
 
@@ -3084,11 +2943,6 @@ in {
 
   gviz-api = callPackage ../development/python-modules/gviz-api {};
 
-  gwyddion = disabledIf isPy3k (toPythonModule (pkgs.gwyddion.override {
-    pythonSupport = true;
-    pythonPackages = self;
-  }));
-
   gym = callPackage ../development/python-modules/gym { };
 
   gyp = callPackage ../development/python-modules/gyp { };
@@ -3157,12 +3011,8 @@ in {
 
   hg-evolve = callPackage ../development/python-modules/hg-evolve { };
 
-  hg-git = callPackage ../development/python-modules/hg-git { };
-
   hglib = callPackage ../development/python-modules/hglib { };
 
-  hgsvn = callPackage ../development/python-modules/hgsvn { };
-
   hickle = callPackage ../development/python-modules/hickle { };
 
   hidapi = callPackage ../development/python-modules/hidapi {
@@ -3213,14 +3063,9 @@ in {
 
   hsaudiotag3k = callPackage ../development/python-modules/hsaudiotag3k { };
 
-  hsaudiotag = callPackage ../development/python-modules/hsaudiotag { };
-
   hstspreload = callPackage ../development/python-modules/hstspreload { };
 
-  html2text = if isPy3k then
-    callPackage ../development/python-modules/html2text { }
-  else
-    callPackage ../development/python-modules/html2text/2018.nix { };
+  html2text = callPackage ../development/python-modules/html2text { };
 
   html5lib = callPackage ../development/python-modules/html5lib { };
 
@@ -3248,17 +3093,12 @@ in {
 
   http-parser = callPackage ../development/python-modules/http-parser { };
 
-  httpretty = if isPy3k then
-    callPackage ../development/python-modules/httpretty { }
-  else
-    callPackage ../development/python-modules/httpretty/0.nix { };
+  httpretty = callPackage ../development/python-modules/httpretty { };
 
   httpserver = callPackage ../development/python-modules/httpserver { };
 
   httpsig = callPackage ../development/python-modules/httpsig { };
 
-  http_signature = callPackage ../development/python-modules/http_signature { };
-
   httptools = callPackage ../development/python-modules/httptools { };
 
   httpx = callPackage ../development/python-modules/httpx { };
@@ -3304,7 +3144,7 @@ in {
 
   hypothesis-auto = callPackage ../development/python-modules/hypothesis-auto { };
 
-  hypothesis = if isPy3k then callPackage ../development/python-modules/hypothesis { } else self.hypothesis_4;
+  hypothesis = callPackage ../development/python-modules/hypothesis { };
 
   hypothesmith = callPackage ../development/python-modules/hypothesmith { };
 
@@ -3348,7 +3188,7 @@ in {
 
   ijson = callPackage ../development/python-modules/ijson { };
 
-  imagecodecs-lite = disabledIf (!isPy3k) (callPackage ../development/python-modules/imagecodecs-lite { });
+  imagecodecs-lite = callPackage ../development/python-modules/imagecodecs-lite { };
 
   imagecorruptions = callPackage ../development/python-modules/imagecorruptions { };
 
@@ -3368,10 +3208,7 @@ in {
 
   imap-tools = callPackage ../development/python-modules/imap-tools { };
 
-  imbalanced-learn = if isPy27 then
-    callPackage ../development/python-modules/imbalanced-learn/0.4.nix { }
-  else
-    callPackage ../development/python-modules/imbalanced-learn { };
+  imbalanced-learn = callPackage ../development/python-modules/imbalanced-learn { };
 
   imdbpy = callPackage ../development/python-modules/imdbpy { };
 
@@ -3447,8 +3284,6 @@ in {
 
   iowait = callPackage ../development/python-modules/iowait { };
 
-  ipaddr = callPackage ../development/python-modules/ipaddr { };
-
   ipaddress = callPackage ../development/python-modules/ipaddress { };
 
   ipdb = callPackage ../development/python-modules/ipdb { };
@@ -3463,10 +3298,7 @@ in {
 
   ipydatawidgets = callPackage ../development/python-modules/ipydatawidgets { };
 
-  ipykernel = if pythonOlder "3.4" then
-    callPackage ../development/python-modules/ipykernel/4.nix { }
-  else
-    callPackage ../development/python-modules/ipykernel { };
+  ipykernel = callPackage ../development/python-modules/ipykernel { };
 
   ipympl = callPackage ../development/python-modules/ipympl { };
 
@@ -3474,9 +3306,7 @@ in {
 
   ipython_genutils = callPackage ../development/python-modules/ipython_genutils { };
 
-  ipython = if isPy27 then
-    callPackage ../development/python-modules/ipython/5.nix { }
-  else if isPy36 then
+  ipython = if isPy36 then
     callPackage ../development/python-modules/ipython/7.16.nix { }
   else
     callPackage ../development/python-modules/ipython { };
@@ -3507,11 +3337,7 @@ in {
 
   isodate = callPackage ../development/python-modules/isodate { };
 
-  isort = if isPy3k then
-    callPackage ../development/python-modules/isort { }
-  else
-    callPackage ../development/python-modules/isort/4.nix {
-  };
+  isort = callPackage ../development/python-modules/isort { };
 
   isoweek = callPackage ../development/python-modules/isoweek { };
 
@@ -3535,19 +3361,13 @@ in {
 
   jaraco_collections = callPackage ../development/python-modules/jaraco_collections { };
 
-  jaraco_functools = if pythonOlder "3.6" then
-    callPackage ../development/python-modules/jaraco_functools/2.nix { }
-  else
-    callPackage ../development/python-modules/jaraco_functools { };
+  jaraco_functools = callPackage ../development/python-modules/jaraco_functools { };
 
   jaraco_itertools = callPackage ../development/python-modules/jaraco_itertools { };
 
   jaraco_logging = callPackage ../development/python-modules/jaraco_logging { };
 
-  jaraco_stream = if pythonOlder "3.6" then
-    callPackage ../development/python-modules/jaraco_stream/2.nix { }
-  else
-    callPackage ../development/python-modules/jaraco_stream { };
+  jaraco_stream = callPackage ../development/python-modules/jaraco_stream { };
 
   jaraco_text = callPackage ../development/python-modules/jaraco_text { };
 
@@ -3649,8 +3469,6 @@ in {
 
   jsonrpc-base = callPackage ../development/python-modules/jsonrpc-base { };
 
-  jsonrpclib = callPackage ../development/python-modules/jsonrpclib { };
-
   jsonrpclib-pelix = callPackage ../development/python-modules/jsonrpclib-pelix { };
 
   jsonrpc-websocket = callPackage ../development/python-modules/jsonrpc-websocket { };
@@ -3673,15 +3491,9 @@ in {
 
   jupyter-c-kernel = callPackage ../development/python-modules/jupyter-c-kernel { };
 
-  jupyter_client = if isPy3k then
-    callPackage ../development/python-modules/jupyter_client { }
-  else
-    callPackage ../development/python-modules/jupyter_client/5.nix { };
+  jupyter_client = callPackage ../development/python-modules/jupyter_client { };
 
-  jupyter_console = if pythonOlder "3.5" then
-    callPackage ../development/python-modules/jupyter_console/5.nix { }
-  else
-    callPackage ../development/python-modules/jupyter_console { };
+  jupyter_console = callPackage ../development/python-modules/jupyter_console { };
 
   jupyter_core = callPackage ../development/python-modules/jupyter_core { };
 
@@ -3705,6 +3517,8 @@ in {
 
   jupyterlab_server = callPackage ../development/python-modules/jupyterlab_server { };
 
+  jupyterlab-widgets = callPackage ../development/python-modules/jupyterlab-widgets { };
+
   jupyter-packaging = callPackage ../development/python-modules/jupyter-packaging { };
 
   jupyter-repo2docker = callPackage ../development/python-modules/jupyter-repo2docker {
@@ -3771,10 +3585,7 @@ in {
 
   kerberos = callPackage ../development/python-modules/kerberos { };
 
-  keyring = if isPy3k then
-    callPackage ../development/python-modules/keyring { }
-  else
-    callPackage ../development/python-modules/keyring/2.nix { };
+  keyring = callPackage ../development/python-modules/keyring { };
 
   keyrings-alt = callPackage ../development/python-modules/keyrings-alt { };
 
@@ -3784,9 +3595,9 @@ in {
     inherit (pkgs) keyutils;
   };
 
-  kicad = disabledIf isPy27 (toPythonModule (pkgs.kicad.override {
+  kicad = toPythonModule (pkgs.kicad.override {
     python3 = python;
-  }).src);
+  }).src;
 
   kinparse = callPackage ../development/python-modules/kinparse { };
 
@@ -3798,10 +3609,7 @@ in {
 
   kivy-garden = callPackage ../development/python-modules/kivy-garden { };
 
-  kiwisolver = if isPy3k then
-    callPackage ../development/python-modules/kiwisolver { }
-  else
-    callPackage ../development/python-modules/kiwisolver/1_1.nix { };
+  kiwisolver = callPackage ../development/python-modules/kiwisolver { };
 
   klaus = callPackage ../development/python-modules/klaus { };
 
@@ -3816,12 +3624,8 @@ in {
 
   knack = callPackage ../development/python-modules/knack { };
 
-  koji = callPackage ../development/python-modules/koji { };
-
   kombu = callPackage ../development/python-modules/kombu { };
 
-  konfig = callPackage ../development/python-modules/konfig { };
-
   korean-lunar-calendar = callPackage ../development/python-modules/korean-lunar-calendar { };
 
   kubernetes = callPackage ../development/python-modules/kubernetes { };
@@ -3838,12 +3642,8 @@ in {
 
   langdetect = callPackage ../development/python-modules/langdetect { };
 
-  larch = callPackage ../development/python-modules/larch { };
-
   lark-parser = callPackage ../development/python-modules/lark-parser { };
 
-  Lasagne = callPackage ../development/python-modules/lasagne { };
-
   latexcodec = callPackage ../development/python-modules/latexcodec { };
 
   launchpadlib = callPackage ../development/python-modules/launchpadlib { };
@@ -3876,8 +3676,6 @@ in {
 
   leather = callPackage ../development/python-modules/leather { };
 
-  le = callPackage ../development/python-modules/le { };
-
   ledger_agent = callPackage ../development/python-modules/ledger_agent { };
 
   ledgerblue = callPackage ../development/python-modules/ledgerblue { };
@@ -3910,10 +3708,7 @@ in {
     inherit (pkgs) libasyncns;
   };
 
-  libcloud = if isPy27 then
-    callPackage ../development/python-modules/libcloud/2.nix { }
-  else
-    callPackage ../development/python-modules/libcloud { };
+  libcloud = callPackage ../development/python-modules/libcloud { };
 
   libcst = callPackage ../development/python-modules/libcst { };
 
@@ -3924,10 +3719,10 @@ in {
     pythonSupport = true;
   });
 
-  libgpiod = disabledIf (!isPy3k) (toPythonModule (pkgs.libgpiod.override {
+  libgpiod = toPythonModule (pkgs.libgpiod.override {
     enablePython = true;
     python3 = python;
-  }));
+  });
 
   libgpuarray = callPackage ../development/python-modules/libgpuarray {
     clblas = pkgs.clblas.override { boost = self.boost; };
@@ -3964,16 +3759,6 @@ in {
     inherit (pkgs) libsodium;
   };
 
-  libnl-python = disabledIf isPy3k (toPythonModule (pkgs.libnl.override {
-    pythonSupport = true;
-    inherit python;
-  })).py;
-
-  libplist = disabledIf isPy3k (toPythonModule (pkgs.libplist.override {
-    enablePython = true;
-    inherit python;
-  })).py;
-
   libpurecool = callPackage ../development/python-modules/libpurecool { };
 
   libredwg = toPythonModule (pkgs.libredwg.override {
@@ -4021,10 +3806,7 @@ in {
 
   libtmux = callPackage ../development/python-modules/libtmux { };
 
-  libtorrent-rasterbar = if isPy27 then
-    (toPythonModule (pkgs.libtorrent-rasterbar-1_2_x.override { inherit python; })).python
-  else
-    (toPythonModule (pkgs.libtorrent-rasterbar.override { inherit python; })).python;
+  libtorrent-rasterbar = (toPythonModule (pkgs.libtorrent-rasterbar.override { inherit python; })).python;
 
   libusb1 = callPackage ../development/python-modules/libusb1 {
     inherit (pkgs) libusb1;
@@ -4034,14 +3816,9 @@ in {
     inherit (pkgs) libversion;
   };
 
-  libvirt = if isPy3k then
-    (callPackage ../development/python-modules/libvirt {
+  libvirt = callPackage ../development/python-modules/libvirt {
     inherit (pkgs) libvirt;
-  })
-  else
-    (callPackage ../development/python-modules/libvirt/5.9.0.nix {
-      libvirt = pkgs.libvirt_5_9_0;
-    });
+  };
 
   libxml2 = (toPythonModule (pkgs.libxml2.override {
     pythonSupport = true;
@@ -4060,8 +3837,6 @@ in {
     inherit python;
   })).py;
 
-  lightblue = callPackage ../development/python-modules/lightblue { };
-
   lightgbm = callPackage ../development/python-modules/lightgbm { };
 
   lightning = callPackage ../development/python-modules/lightning { };
@@ -4088,9 +3863,9 @@ in {
 
   liquidctl = callPackage ../development/python-modules/liquidctl { };
 
-  lirc = disabledIf isPy27 (toPythonModule (pkgs.lirc.override {
+  lirc = toPythonModule (pkgs.lirc.override {
     python3 = python;
-  }));
+  });
 
   littleutils = callPackage ../development/python-modules/littleutils { };
 
@@ -4150,10 +3925,6 @@ in {
 
   loo-py = callPackage ../development/python-modules/loo-py { };
 
-  lpod = callPackage ../development/python-modules/lpod { };
-
-  lsi = callPackage ../development/python-modules/lsi { };
-
   lsassy = callPackage ../development/python-modules/lsassy { };
 
   ludios_wpull = callPackage ../development/python-modules/ludios_wpull { };
@@ -4162,8 +3933,6 @@ in {
 
   lupa = callPackage ../development/python-modules/lupa { };
 
-  lxc = callPackage ../development/python-modules/lxc { };
-
   lxml = callPackage ../development/python-modules/lxml {
     inherit (pkgs) libxml2 libxslt zlib;
   };
@@ -4244,24 +4013,11 @@ in {
 
   mapbox = callPackage ../development/python-modules/mapbox { };
 
-  mapsplotlib = callPackage ../development/python-modules/mapsplotlib { };
-
-  marionette_driver = callPackage ../development/python-modules/marionette-harness/marionette_driver.nix { };
-
-  marionette-harness = callPackage ../development/python-modules/marionette-harness { };
-
-  marisa = callPackage ../development/python-modules/marisa {
-    inherit (pkgs) marisa;
-  };
-
   marisa-trie = callPackage ../development/python-modules/marisa-trie { };
 
   markdown2 = callPackage ../development/python-modules/markdown2 { };
 
-  markdown = if isPy3k then
-    callPackage ../development/python-modules/markdown { }
-  else
-    callPackage ../development/python-modules/markdown/3_1.nix { };
+  markdown = callPackage ../development/python-modules/markdown { };
 
   markdown-it-py = callPackage ../development/python-modules/markdown-it-py { };
 
@@ -4291,12 +4047,7 @@ in {
 
   mathlibtools = callPackage ../development/python-modules/mathlibtools { };
 
-  matplotlib = let
-    path = if isPy3k then
-      ../development/python-modules/matplotlib/default.nix
-    else
-      ../development/python-modules/matplotlib/2.nix;
-  in callPackage path {
+  matplotlib = callPackage ../development/python-modules/matplotlib/default.nix {
     stdenv = if stdenv.isDarwin then pkgs.clangStdenv else pkgs.stdenv;
     inherit (pkgs.darwin.apple_sdk.frameworks) Cocoa;
   };
@@ -4322,6 +4073,8 @@ in {
 
   mcstatus = callPackage ../development/python-modules/mcstatus { };
 
+  md2gemini = callPackage ../development/python-modules/md2gemini { };
+
   MDP = callPackage ../development/python-modules/mdp { };
 
   measurement = callPackage ../development/python-modules/measurement { };
@@ -4338,15 +4091,13 @@ in {
 
   meld3 = callPackage ../development/python-modules/meld3 { };
 
-  meliae = callPackage ../development/python-modules/meliae { };
-
   memcached = callPackage ../development/python-modules/memcached { };
 
   memory_profiler = callPackage ../development/python-modules/memory_profiler { };
 
-  mercurial = disabledIf (!isPy3k) (toPythonModule (pkgs.mercurial.override {
+  mercurial = toPythonModule (pkgs.mercurial.override {
     python3Packages = self;
-  }));
+  });
 
   mergedeep = callPackage ../development/python-modules/mergedeep { };
 
@@ -4358,15 +4109,13 @@ in {
 
   meshlabxml = callPackage ../development/python-modules/meshlabxml { };
 
-  meson = disabledIf (pythonOlder "3.5") (toPythonModule ((pkgs.meson.override { python3 = python; }).overrideAttrs
+  meson = toPythonModule ((pkgs.meson.override { python3 = python; }).overrideAttrs
     (oldAttrs: { # We do not want the setup hook in Python packages because the build is performed differently.
       setupHook = null;
-    })));
+    }));
 
   mesonpep517 = callPackage ../development/python-modules/mesonpep517 { };
 
-  metaphone = callPackage ../development/python-modules/metaphone { };
-
   metar = callPackage ../development/python-modules/metar { };
 
   mezzanine = callPackage ../development/python-modules/mezzanine { };
@@ -4401,7 +4150,11 @@ in {
 
   mistletoe = callPackage ../development/python-modules/mistletoe { };
 
-  mistune = callPackage ../development/python-modules/mistune { };
+  inherit (import ../development/python-modules/mistune self)
+    mistune
+    mistune_0_8
+    mistune_2_0
+  ;
 
   mitmproxy = callPackage ../development/python-modules/mitmproxy { };
 
@@ -4427,10 +4180,7 @@ in {
 
   mocket = callPackage ../development/python-modules/mocket { };
 
-  mock = if pythonOlder "3.6" then
-    callPackage ../development/python-modules/mock/2.nix { }
-  else
-    callPackage ../development/python-modules/mock { };
+  mock = callPackage ../development/python-modules/mock { };
 
   mockito = callPackage ../development/python-modules/mockito { };
 
@@ -4446,16 +4196,13 @@ in {
 
   mohawk = callPackage ../development/python-modules/mohawk { };
 
-  # Needed here because moinmoin is loaded as a Python library.
-  moinmoin = callPackage ../development/python-modules/moinmoin { };
-
   mongodict = callPackage ../development/python-modules/mongodict { };
 
   mongoengine = callPackage ../development/python-modules/mongoengine { };
 
   monkeyhex = callPackage ../development/python-modules/monkeyhex { };
 
-  monosat = disabledIf (!isPy3k) (pkgs.monosat.python {
+  monosat = (pkgs.monosat.python {
     inherit buildPythonPackage;
     inherit (self) cython;
   });
@@ -4464,10 +4211,7 @@ in {
 
   monty = callPackage ../development/python-modules/monty { };
 
-  more-itertools = if isPy27 then
-    callPackage ../development/python-modules/more-itertools/2.7.nix { }
-  else
-    callPackage ../development/python-modules/more-itertools { };
+  more-itertools = callPackage ../development/python-modules/more-itertools { };
 
   moretools = callPackage ../development/python-modules/moretools { };
 
@@ -4483,38 +4227,8 @@ in {
 
   mox = callPackage ../development/python-modules/mox { };
 
-  mozcrash = callPackage ../development/python-modules/marionette-harness/mozcrash.nix { };
-
-  mozdevice = callPackage ../development/python-modules/marionette-harness/mozdevice.nix { };
-
-  mozfile = callPackage ../development/python-modules/marionette-harness/mozfile.nix { };
-
-  mozhttpd = callPackage ../development/python-modules/marionette-harness/mozhttpd.nix { };
-
-  mozinfo = callPackage ../development/python-modules/marionette-harness/mozinfo.nix { };
-
-  mozlog = callPackage ../development/python-modules/marionette-harness/mozlog.nix { };
-
-  moznetwork = callPackage ../development/python-modules/marionette-harness/moznetwork.nix { };
-
-  mozprocess = callPackage ../development/python-modules/marionette-harness/mozprocess.nix { };
-
-  mozprofile = callPackage ../development/python-modules/marionette-harness/mozprofile.nix { };
-
-  mozrunner = callPackage ../development/python-modules/marionette-harness/mozrunner.nix { };
-
-  mozsvc = callPackage ../development/python-modules/mozsvc { };
-
-  mozterm = callPackage ../development/python-modules/mozterm { };
-
-  moztest = callPackage ../development/python-modules/marionette-harness/moztest.nix { };
-
-  mozversion = callPackage ../development/python-modules/marionette-harness/mozversion.nix { };
-
   mpd2 = callPackage ../development/python-modules/mpd2 { };
 
-  mpd = callPackage ../development/python-modules/mpd { };
-
   mpi4py = callPackage ../development/python-modules/mpi4py { };
 
   mplfinance = callPackage ../development/python-modules/mplfinance { };
@@ -4529,8 +4243,6 @@ in {
 
   mpyq = callPackage ../development/python-modules/mpyq { };
 
-  mrbob = callPackage ../development/python-modules/mrbob { };
-
   msal = callPackage ../development/python-modules/msal { };
 
   msal-extensions = callPackage ../development/python-modules/msal-extensions { };
@@ -4547,8 +4259,6 @@ in {
 
   msrest = callPackage ../development/python-modules/msrest { };
 
-  msrplib = callPackage ../development/python-modules/msrplib { };
-
   mt-940 = callPackage ../development/python-modules/mt-940 { };
 
   mullvad-api = callPackage ../development/python-modules/mullvad-api { };
@@ -4579,25 +4289,14 @@ in {
 
   mutag = callPackage ../development/python-modules/mutag { };
 
-  mutagen = if isPy27 then
-    callPackage ../development/python-modules/mutagen/1.43.nix { }
-  else
-    callPackage ../development/python-modules/mutagen { };
+  mutagen = callPackage ../development/python-modules/mutagen { };
 
   mutatormath = callPackage ../development/python-modules/mutatormath { };
 
-  muttils = callPackage ../development/python-modules/muttils { };
-
   mwclient = callPackage ../development/python-modules/mwclient { };
 
   mwdblib = callPackage ../development/python-modules/mwdblib { };
 
-  mwlib = callPackage ../development/python-modules/mwlib { };
-
-  mwlib-ext = callPackage ../development/python-modules/mwlib-ext { };
-
-  mwlib-rl = callPackage ../development/python-modules/mwlib-rl { };
-
   mwoauth = callPackage ../development/python-modules/mwoauth { };
 
   mwparserfromhell = callPackage ../development/python-modules/mwparserfromhell { };
@@ -4624,8 +4323,6 @@ in {
 
   nagiosplugin = callPackage ../development/python-modules/nagiosplugin { };
 
-  namebench = callPackage ../development/python-modules/namebench { };
-
   namedlist = callPackage ../development/python-modules/namedlist { };
 
   nameparser = callPackage ../development/python-modules/nameparser { };
@@ -4658,10 +4355,7 @@ in {
 
   nbdime = callPackage ../development/python-modules/nbdime { };
 
-  nbformat = if isPy3k then
-    callPackage ../development/python-modules/nbformat { }
-  else
-    callPackage ../development/python-modules/nbformat/2.nix { };
+  nbformat = callPackage ../development/python-modules/nbformat { };
 
   nbmerge = callPackage ../development/python-modules/nbmerge { };
 
@@ -4699,10 +4393,7 @@ in {
 
   netifaces = callPackage ../development/python-modules/netifaces { };
 
-  networkx = if isPy3k then
-    callPackage ../development/python-modules/networkx { }
-  else
-    callPackage ../development/python-modules/networkx/2.2.nix { };
+  networkx = callPackage ../development/python-modules/networkx { };
 
   neuron-mpi = pkgs.neuron-mpi.override { inherit python; };
 
@@ -4746,11 +4437,6 @@ in {
     inherit (pkgs) nix;
   };
 
-  # This is used for NixOps to make sure we won't break it with the next major version of nixpart.
-  nixpart0 = callPackage ../tools/filesystems/nixpart/0.4 { };
-
-  nixpart = callPackage ../tools/filesystems/nixpart { };
-
   nixpkgs = callPackage ../development/python-modules/nixpkgs { };
 
   nixpkgs-pytools = callPackage ../development/python-modules/nixpkgs-pytools { };
@@ -4793,14 +4479,10 @@ in {
 
   nose-exclude = callPackage ../development/python-modules/nose-exclude { };
 
-  nose-focus = callPackage ../development/python-modules/nose-focus { };
-
   nose-timer = callPackage ../development/python-modules/nose-timer { };
 
   nosejs = callPackage ../development/python-modules/nosejs { };
 
-  nose-of-yeti = callPackage ../development/python-modules/nose-of-yeti { };
-
   nose-pattern-exclude = callPackage ../development/python-modules/nose-pattern-exclude { };
 
   nose_progressive = callPackage ../development/python-modules/nose_progressive { };
@@ -4811,17 +4493,12 @@ in {
 
   nosexcover = callPackage ../development/python-modules/nosexcover { };
 
-  notebook = if isPy3k then
-    callPackage ../development/python-modules/notebook { }
-  else
-    callPackage ../development/python-modules/notebook/2.nix { };
+  notebook = callPackage ../development/python-modules/notebook { };
 
   notedown = callPackage ../development/python-modules/notedown { };
 
   notify2 = callPackage ../development/python-modules/notify2 { };
 
-  notify = callPackage ../development/python-modules/notify { };
-
   notify-py = callPackage ../development/python-modules/notify-py { };
 
   notmuch = callPackage ../development/python-modules/notmuch {
@@ -4858,10 +4535,7 @@ in {
 
   numpydoc = callPackage ../development/python-modules/numpydoc { };
 
-  numpy = if pythonOlder "3.5" then
-    callPackage ../development/python-modules/numpy/1.16.nix { }
-  else
-    callPackage ../development/python-modules/numpy { };
+  numpy = callPackage ../development/python-modules/numpy { };
 
   numpy-stl = callPackage ../development/python-modules/numpy-stl { };
 
@@ -4871,8 +4545,6 @@ in {
 
   nwdiag = callPackage ../development/python-modules/nwdiag { };
 
-  nxt-python = callPackage ../development/python-modules/nxt-python { };
-
   oath = callPackage ../development/python-modules/oath { };
 
   oauth2 = callPackage ../development/python-modules/oauth2 { };
@@ -4883,10 +4555,7 @@ in {
 
   oauthenticator = callPackage ../development/python-modules/oauthenticator { };
 
-  oauthlib = if isPy27 then
-    callPackage ../development/python-modules/oauthlib/3.1.nix { }
-  else
-    callPackage ../development/python-modules/oauthlib { };
+  oauthlib = callPackage ../development/python-modules/oauthlib { };
 
   obfsproxy = callPackage ../development/python-modules/obfsproxy { };
 
@@ -4941,21 +4610,13 @@ in {
     pythonPackages = self;
   });
 
-  opencv = disabledIf isPy3k (toPythonModule (pkgs.opencv.override {
-    enablePython = true;
-    pythonPackages = self;
-  }));
-
   openerz-api = callPackage ../development/python-modules/openerz-api { };
 
   openhomedevice = callPackage ../development/python-modules/openhomedevice { };
 
   openidc-client = callPackage ../development/python-modules/openidc-client { };
 
-  openpyxl = if pythonAtLeast "3.6" then
-    callPackage ../development/python-modules/openpyxl { }
-  else
-    callPackage ../development/python-modules/openpyxl/2.nix { };
+  openpyxl = callPackage ../development/python-modules/openpyxl { };
 
   openrazer = callPackage ../development/python-modules/openrazer/pylib.nix { };
 
@@ -4965,6 +4626,8 @@ in {
 
   opensensemap-api = callPackage ../development/python-modules/opensensemap-api { };
 
+  openshift = callPackage ../development/python-modules/openshift { };
+
   opentimestamps = callPackage ../development/python-modules/opentimestamps { };
 
   opentracing = callPackage ../development/python-modules/opentracing { };
@@ -4976,14 +4639,11 @@ in {
 
   openwebifpy = callPackage ../development/python-modules/openwebifpy { };
 
-  openwrt-luci-rpc = disabledIf (!isPy3k) (callPackage ../development/python-modules/openwrt-luci-rpc { });
+  openwrt-luci-rpc = callPackage ../development/python-modules/openwrt-luci-rpc { };
 
   openwrt-ubus-rpc = callPackage ../development/python-modules/openwrt-ubus-rpc { };
 
-  opt-einsum = if isPy27 then
-    callPackage ../development/python-modules/opt-einsum/2.nix { }
-  else
-    callPackage ../development/python-modules/opt-einsum { };
+  opt-einsum = callPackage ../development/python-modules/opt-einsum { };
 
   optuna = callPackage ../development/python-modules/optuna { };
 
@@ -5025,9 +4685,7 @@ in {
 
   packageurl-python = callPackage ../development/python-modules/packageurl-python { };
 
-  packaging = if isPy3k
-    then callPackage ../development/python-modules/packaging { }
-    else callPackage ../development/python-modules/packaging/2.nix { };
+  packaging = callPackage ../development/python-modules/packaging { };
 
   packet-python = callPackage ../development/python-modules/packet-python { };
 
@@ -5035,8 +4693,6 @@ in {
 
   pagelabels = callPackage ../development/python-modules/pagelabels { };
 
-  pagerduty = callPackage ../development/python-modules/pagerduty { };
-
   paho-mqtt = callPackage ../development/python-modules/paho-mqtt { };
 
   palettable = callPackage ../development/python-modules/palettable { };
@@ -5048,10 +4704,7 @@ in {
 
   pamqp = callPackage ../development/python-modules/pamqp { };
 
-  pandas = if isPy3k then
-    callPackage ../development/python-modules/pandas { }
-  else
-    callPackage ../development/python-modules/pandas/2.nix { };
+  pandas = callPackage ../development/python-modules/pandas { };
 
   pandas-datareader = callPackage ../development/python-modules/pandas-datareader { };
 
@@ -5115,8 +4768,6 @@ in {
 
   pastel = callPackage ../development/python-modules/pastel { };
 
-  pasteScript = callPackage ../development/python-modules/pastescript { };
-
   patator = callPackage ../development/python-modules/patator { };
 
   patch = callPackage ../development/python-modules/patch { };
@@ -5131,10 +4782,7 @@ in {
 
   pathos = callPackage ../development/python-modules/pathos { };
 
-  pathpy = if isPy3k then
-    callPackage ../development/python-modules/path.py { }
-  else
-    callPackage ../development/python-modules/path.py/2.nix { };
+  pathpy = callPackage ../development/python-modules/path.py { };
 
   pathspec = callPackage ../development/python-modules/pathspec { };
 
@@ -5268,16 +4916,10 @@ in {
 
   pillowfight = callPackage ../development/python-modules/pillowfight { };
 
-  pillow = if isPy27 then
-    callPackage ../development/python-modules/pillow/6.nix {
-      inherit (pkgs) freetype libjpeg zlib libtiff libwebp tcl lcms2 tk;
-      inherit (pkgs.xorg) libX11;
-    }
-  else
-    callPackage ../development/python-modules/pillow {
-      inherit (pkgs) freetype libjpeg zlib libtiff libwebp tcl lcms2 tk;
-      inherit (pkgs.xorg) libX11 libxcb;
-    };
+  pillow = callPackage ../development/python-modules/pillow {
+    inherit (pkgs) freetype libjpeg zlib libtiff libwebp tcl lcms2 tk;
+    inherit (pkgs.xorg) libX11 libxcb;
+  };
 
   pillow-simd = callPackage ../development/python-modules/pillow-simd {
       inherit (pkgs) freetype libjpeg zlib libtiff libwebp tcl lcms2 tk;
@@ -5290,10 +4932,7 @@ in {
 
   pint = callPackage ../development/python-modules/pint { };
 
-  pip = if isPy3k then
-    callPackage ../development/python-modules/pip { }
-  else
-    callPackage ../development/python-modules/pip/20.nix { };
+  pip = callPackage ../development/python-modules/pip { };
 
   pipdate = callPackage ../development/python-modules/pipdate { };
 
@@ -5327,6 +4966,8 @@ in {
 
   pynws = callPackage ../development/python-modules/pynws { };
 
+  pynx584 = callPackage ../development/python-modules/pynx584 { };
+
   pysbd = callPackage ../development/python-modules/pysbd { };
 
   pyshark = callPackage ../development/python-modules/pyshark { };
@@ -5432,7 +5073,7 @@ in {
 
   poster3 = callPackage ../development/python-modules/poster3 { };
 
-  postorius = disabledIf (!isPy3k) (callPackage ../servers/mail/mailman/postorius.nix { });
+  postorius = callPackage ../servers/mail/mailman/postorius.nix { };
 
   potr = callPackage ../development/python-modules/potr { };
 
@@ -5460,10 +5101,7 @@ in {
 
   prawcore = callPackage ../development/python-modules/prawcore { };
 
-  praw = if isPy3k then
-    callPackage ../development/python-modules/praw { }
-  else
-    callPackage ../development/python-modules/praw/6.3.nix { };
+  praw = callPackage ../development/python-modules/praw { };
 
   precis-i18n = callPackage ../development/python-modules/precis-i18n { };
 
@@ -5479,10 +5117,7 @@ in {
 
   pretend = callPackage ../development/python-modules/pretend { };
 
-  prettytable = if isPy3k then
-    callPackage ../development/python-modules/prettytable { }
-  else
-    callPackage ../development/python-modules/prettytable/1.nix { };
+  prettytable = callPackage ../development/python-modules/prettytable { };
 
   primer3 = callPackage ../development/python-modules/primer3 { };
 
@@ -5490,8 +5125,6 @@ in {
 
   prison = callPackage ../development/python-modules/prison { };
 
-  privacyidea = callPackage ../development/python-modules/privacyidea { };
-
   privacyidea-ldap-proxy = callPackage ../development/python-modules/privacyidea/ldap-proxy.nix { };
 
   proboscis = callPackage ../development/python-modules/proboscis { };
@@ -5500,8 +5133,6 @@ in {
 
   proglog = callPackage ../development/python-modules/proglog { };
 
-  progressbar231 = callPackage ../development/python-modules/progressbar231 { };
-
   progressbar2 = callPackage ../development/python-modules/progressbar2 { };
 
   progressbar33 = callPackage ../development/python-modules/progressbar33 { };
@@ -5516,12 +5147,7 @@ in {
 
   promise = callPackage ../development/python-modules/promise { };
 
-  prompt_toolkit = let
-    filename = if isPy3k then
-      ../development/python-modules/prompt_toolkit
-    else
-      ../development/python-modules/prompt_toolkit/1.nix;
-  in callPackage filename { };
+  prompt_toolkit = callPackage ../development/python-modules/prompt_toolkit { };
 
   property-manager = callPackage ../development/python-modules/property-manager { };
 
@@ -5640,8 +5266,6 @@ in {
 
   pyalmond = callPackage ../development/python-modules/pyalmond { };
 
-  pyamf = callPackage ../development/python-modules/pyamf { };
-
   pyamg = callPackage ../development/python-modules/pyamg { };
 
   pyaml = callPackage ../development/python-modules/pyaml { };
@@ -5686,8 +5310,6 @@ in {
 
   pyblock = callPackage ../development/python-modules/pyblock { };
 
-  pyblosxom = callPackage ../development/python-modules/pyblosxom { };
-
   pybluez = callPackage ../development/python-modules/pybluez { };
 
   pybotvac = callPackage ../development/python-modules/pybotvac { };
@@ -5708,18 +5330,14 @@ in {
 
   py = callPackage ../development/python-modules/py { };
 
-  pycangjie = disabledIf (!isPy3k) (callPackage ../development/python-modules/pycangjie { });
+  pycangjie = callPackage ../development/python-modules/pycangjie { };
 
   pycapnp = callPackage ../development/python-modules/pycapnp { };
 
   pycaption = callPackage ../development/python-modules/pycaption { };
 
-  pycarddav = callPackage ../development/python-modules/pycarddav { };
-
   pycares = callPackage ../development/python-modules/pycares { };
 
-  pycassa = callPackage ../development/python-modules/pycassa { };
-
   pycategories = callPackage ../development/python-modules/pycategories { };
 
   pycdio = callPackage ../development/python-modules/pycdio { };
@@ -5776,8 +5394,6 @@ in {
 
   pycryptodomex = callPackage ../development/python-modules/pycryptodomex { };
 
-  pycryptopp = callPackage ../development/python-modules/pycryptopp { };
-
   pyct = callPackage ../development/python-modules/pyct { };
 
   pycuda = callPackage ../development/python-modules/pycuda {
@@ -5787,8 +5403,6 @@ in {
 
   pycups = callPackage ../development/python-modules/pycups { };
 
-  pycurl2 = callPackage ../development/python-modules/pycurl2 { };
-
   pycurl = callPackage ../development/python-modules/pycurl { };
 
   pycxx = callPackage ../development/python-modules/pycxx { };
@@ -5813,15 +5427,9 @@ in {
 
   pydispatcher = callPackage ../development/python-modules/pydispatcher { };
 
-  pydns = let
-    py3 = callPackage ../development/python-modules/py3dns { };
-    py2 = callPackage ../development/python-modules/pydns { };
-  in if isPy3k then py3 else py2;
+  pydns = callPackage ../development/python-modules/py3dns { };
 
-  pydocstyle = if isPy27 then
-    callPackage ../development/python-modules/pydocstyle/2.nix { }
-  else
-    callPackage ../development/python-modules/pydocstyle { };
+  pydocstyle = callPackage ../development/python-modules/pydocstyle { };
 
   pydocumentdb = callPackage ../development/python-modules/pydocumentdb { };
 
@@ -5869,16 +5477,12 @@ in {
 
   pyexcel = callPackage ../development/python-modules/pyexcel { };
 
-  pyexcelerator = callPackage ../development/python-modules/pyexcelerator { };
-
   pyexcel-io = callPackage ../development/python-modules/pyexcel-io { };
 
   pyexcel-ods = callPackage ../development/python-modules/pyexcel-ods { };
 
   pyexcel-xls = callPackage ../development/python-modules/pyexcel-xls { };
 
-  pyexiv2 = disabledIf isPy3k (toPythonModule (callPackage ../development/python-modules/pyexiv2 { }));
-
   pyext = callPackage ../development/python-modules/pyext { };
 
   pyezviz = callPackage ../development/python-modules/pyezviz { };
@@ -5949,10 +5553,7 @@ in {
 
   pygments-better-html = callPackage ../development/python-modules/pygments-better-html { };
 
-  pygments = if isPy3k then
-    callPackage ../development/python-modules/Pygments { }
-  else
-    callPackage ../development/python-modules/Pygments/2_5.nix { };
+  pygments = callPackage ../development/python-modules/Pygments { };
 
   pygments-markdown-lexer = callPackage ../development/python-modules/pygments-markdown-lexer { };
 
@@ -5962,14 +5563,9 @@ in {
 
   pygobject2 = callPackage ../development/python-modules/pygobject { };
 
-  pygobject3 = if isPy3k then
-    callPackage ../development/python-modules/pygobject/3.nix {
-      inherit (pkgs) meson;
-    }
-  else
-    callPackage ../development/python-modules/pygobject/3.36.nix {
-      inherit (pkgs) meson;
-    };
+  pygobject3 = callPackage ../development/python-modules/pygobject/3.nix {
+    inherit (pkgs) meson;
+  };
 
   pygogo = callPackage ../development/python-modules/pygogo { };
 
@@ -5985,20 +5581,9 @@ in {
 
   pygtail = callPackage ../development/python-modules/pygtail { };
 
-  pygtk = callPackage ../development/python-modules/pygtk { };
-
-  pyGtkGlade = self.pygtk.override {
-    inherit (pkgs.gnome2) libglade;
-  };
-
-  pygtksourceview = callPackage ../development/python-modules/pygtksourceview { };
-
   pygtrie = callPackage ../development/python-modules/pygtrie { };
 
-  pyhamcrest = if isPy3k then
-    callPackage ../development/python-modules/pyhamcrest { }
-  else
-    callPackage ../development/python-modules/pyhamcrest/1.nix { };
+  pyhamcrest = callPackage ../development/python-modules/pyhamcrest { };
 
   pyhaversion = callPackage ../development/python-modules/pyhaversion { };
 
@@ -6052,8 +5637,6 @@ in {
 
   pykerberos = callPackage ../development/python-modules/pykerberos { };
 
-  pykickstart = callPackage ../development/python-modules/pykickstart { };
-
   pykira = callPackage ../development/python-modules/pykira { };
 
   pykka = callPackage ../development/python-modules/pykka { };
@@ -6076,10 +5659,7 @@ in {
 
   pylev = callPackage ../development/python-modules/pylev { };
 
-  pylibacl = if isPy3k then
-    callPackage ../development/python-modules/pylibacl { }
-  else
-    callPackage ../development/python-modules/pylibacl/0.5.nix { };
+  pylibacl = callPackage ../development/python-modules/pylibacl { };
 
   pylibconfig2 = callPackage ../development/python-modules/pylibconfig2 { };
 
@@ -6101,10 +5681,7 @@ in {
 
   pylint-flask = callPackage ../development/python-modules/pylint-flask { };
 
-  pylint = if isPy3k then
-    callPackage ../development/python-modules/pylint { }
-  else
-    callPackage ../development/python-modules/pylint/1.9.nix { };
+  pylint = callPackage ../development/python-modules/pylint { };
 
   pylint-plugin-utils = callPackage ../development/python-modules/pylint-plugin-utils { };
 
@@ -6240,11 +5817,6 @@ in {
 
   pynzb = callPackage ../development/python-modules/pynzb { };
 
-  pyobjc = if stdenv.isDarwin then
-    callPackage ../development/python-modules/pyobjc { }
-  else
-    throw "pyobjc can only be built on Mac OS";
-
   pyocr = callPackage ../development/python-modules/pyocr {
     tesseract = pkgs.tesseract4;
   };
@@ -6302,8 +5874,6 @@ in {
 
   pypdf2 = callPackage ../development/python-modules/pypdf2 { };
 
-  pyPdf = callPackage ../development/python-modules/pypdf { };
-
   pypeg2 = callPackage ../development/python-modules/pypeg2 { };
 
   pyperclip = callPackage ../development/python-modules/pyperclip { };
@@ -6322,8 +5892,6 @@ in {
 
   pyplatec = callPackage ../development/python-modules/pyplatec { };
 
-  pypoppler = callPackage ../development/python-modules/pypoppler { };
-
   pyppeteer = callPackage ../development/python-modules/pyppeteer { };
 
   pyprind = callPackage ../development/python-modules/pyprind { };
@@ -6414,8 +5982,6 @@ in {
 
   pyregion = callPackage ../development/python-modules/pyregion { };
 
-  pyreport = callPackage ../development/python-modules/pyreport { };
-
   pyres = callPackage ../development/python-modules/pyres { };
 
   pyrisco = callPackage ../development/python-modules/pyrisco { };
@@ -6572,8 +6138,6 @@ in {
     inherit (pkgs) sqlcipher;
   };
 
-  pysqlite = callPackage ../development/python-modules/pysqlite { };
-
   pysqueezebox = callPackage ../development/python-modules/pysqueezebox { };
 
   pysrim = callPackage ../development/python-modules/pysrim { };
@@ -6594,8 +6158,6 @@ in {
 
   py_stringmatching = callPackage ../development/python-modules/py_stringmatching { };
 
-  pystringtemplate = callPackage ../development/python-modules/stringtemplate { };
-
   pysvn = callPackage ../development/python-modules/pysvn {
     inherit (pkgs) bash subversion apr aprutil expat neon openssl;
   };
@@ -6622,8 +6184,7 @@ in {
 
   pytesseract = callPackage ../development/python-modules/pytesseract { };
 
-  # pytest>=6 is too new for most packages
-  pytest = if isPy3k then self.pytest_6 else self.pytest_4;
+  pytest = self.pytest_6;
 
   pytest_4 = callPackage
     ../development/python-modules/pytest/4.nix {
@@ -6635,24 +6196,18 @@ in {
 
   pytest_5 = callPackage
     ../development/python-modules/pytest/5.nix {
-      # hypothesis & pygments tests require pytest that causes dependency cycle
+      # hypothesis tests require pytest that causes dependency cycle
       hypothesis = self.hypothesis.override {
         doCheck = false;
       };
-      pygments = self.pygments.override {
-        doCheck = false;
-      };
     };
 
   pytest_6 =
     callPackage ../development/python-modules/pytest {
-      # hypothesis & pygments tests require pytest that causes dependency cycle
+      # hypothesis tests require pytest that causes dependency cycle
       hypothesis = self.hypothesis.override {
         doCheck = false;
       };
-      pygments = self.pygments.override {
-        doCheck = false;
-      };
     };
 
   pytest_6_1 = self.pytest_6.overridePythonAttrs (oldAttrs: rec {
@@ -6753,10 +6308,7 @@ in {
 
   pytest-metadata = callPackage ../development/python-modules/pytest-metadata { };
 
-  pytest-mock = if isPy3k then
-    callPackage ../development/python-modules/pytest-mock { }
-  else
-    callPackage ../development/python-modules/pytest-mock/2.nix { };
+  pytest-mock = callPackage ../development/python-modules/pytest-mock { };
 
   pytest-mpl = callPackage ../development/python-modules/pytest-mpl { };
 
@@ -6813,6 +6365,8 @@ in {
 
   pytest-shutil = callPackage ../development/python-modules/pytest-shutil { };
 
+  python-string-utils = callPackage ../development/python-modules/python-string-utils { };
+
   pytest-socket = callPackage ../development/python-modules/pytest-socket { };
 
   pytest-subtesthack = callPackage ../development/python-modules/pytest-subtesthack { };
@@ -6841,18 +6395,13 @@ in {
 
   pytest-watch = callPackage ../development/python-modules/pytest-watch { };
 
-  pytest-xdist = self.pytest_xdist; # added 2021-01-04
-  pytest_xdist = if isPy27 then
-    callPackage ../development/python-modules/pytest-xdist/1.nix { }
-  else
-    callPackage ../development/python-modules/pytest-xdist { };
+  pytest_xdist = self.pytest-xdist; # added 2021-01-04
+  pytest-xdist = callPackage ../development/python-modules/pytest-xdist { };
 
   pytest-xprocess = callPackage ../development/python-modules/pytest-xprocess { };
 
   pytest-xvfb = callPackage ../development/python-modules/pytest-xvfb { };
 
-  python2-pythondialog = callPackage ../development/python-modules/python2-pythondialog { };
-
   python3-openid = callPackage ../development/python-modules/python3-openid { };
 
   python-awair = callPackage ../development/python-modules/python-awair { };
@@ -6931,8 +6480,6 @@ in {
     inherit (pkgs) igraph;
   };
 
-  pythonIRClib = callPackage ../development/python-modules/pythonirclib { };
-
   pythonix = callPackage ../development/python-modules/pythonix {
     meson = pkgs.meson.override { python3 = self.python; };
   };
@@ -6967,8 +6514,6 @@ in {
 
   python_magic = callPackage ../development/python-modules/python-magic { };
 
-  pythonmagick = callPackage ../development/python-modules/pythonmagick { };
-
   python-mapnik = callPackage ../development/python-modules/python-mapnik { };
 
   python-markdown-math = callPackage ../development/python-modules/python-markdown-math { };
@@ -7010,8 +6555,6 @@ in {
 
   python_openzwave = callPackage ../development/python-modules/python_openzwave { };
 
-  python-otr = callPackage ../development/python-modules/python-otr { };
-
   python-packer = callPackage ../development/python-modules/python-packer { };
 
   python-pam = callPackage ../development/python-modules/python-pam {
@@ -7061,12 +6604,8 @@ in {
 
   python-sql = callPackage ../development/python-modules/python-sql { };
 
-  python_statsd = callPackage ../development/python-modules/python_statsd { };
-
   python-stdnum = callPackage ../development/python-modules/python-stdnum { };
 
-  python-sybase = callPackage ../development/python-modules/sybase { };
-
   python-telegram-bot = callPackage ../development/python-modules/python-telegram-bot { };
 
   python-toolbox = callPackage ../development/python-modules/python-toolbox { };
@@ -7176,8 +6715,6 @@ in {
     inherit (pkgs) libusb1;
   };
 
-  pyutil = callPackage ../development/python-modules/pyutil { };
-
   pyutilib = callPackage ../development/python-modules/pyutilib { };
 
   pyuv = callPackage ../development/python-modules/pyuv { };
@@ -7222,8 +6759,6 @@ in {
     inherit (pkgs) libxml2;
   };
 
-  PyWebDAV = callPackage ../development/python-modules/pywebdav { };
-
   pywebpush = callPackage ../development/python-modules/pywebpush { };
 
   pywebview = callPackage ../development/python-modules/pywebview { };
@@ -7238,16 +6773,7 @@ in {
 
   pywizlight = callPackage ../development/python-modules/pywizlight { };
 
-  pyxattr = let
-    pyxattr' = callPackage ../development/python-modules/pyxattr { };
-    pyxattr_2 = pyxattr'.overridePythonAttrs (oldAttrs: rec {
-      version = "0.6.1";
-      src = oldAttrs.src.override {
-        inherit version;
-        sha256 = "b525843f6b51036198b3b87c4773a5093d6dec57d60c18a1f269dd7059aa16e3";
-      };
-    });
-  in if isPy3k then pyxattr' else pyxattr_2;
+  pyxattr = callPackage ../development/python-modules/pyxattr { };
 
   pyworld = callPackage ../development/python-modules/pyworld { };
 
@@ -7263,8 +6789,6 @@ in {
 
   pyxl3 = callPackage ../development/python-modules/pyxl3 { };
 
-  pyxml = disabledIf isPy3k (callPackage ../development/python-modules/pyxml { });
-
   pyxnat = callPackage ../development/python-modules/pyxnat { };
 
   pyyaml = callPackage ../development/python-modules/pyyaml { };
@@ -7299,8 +6823,6 @@ in {
 
   qiskit-terra = callPackage ../development/python-modules/qiskit-terra { };
 
-  qpid-python = callPackage ../development/python-modules/qpid-python { };
-
   qrcode = callPackage ../development/python-modules/qrcode { };
 
   qreactor = callPackage ../development/python-modules/qreactor { };
@@ -7313,8 +6835,6 @@ in {
 
   qscintilla = self.qscintilla-qt4;
 
-  qserve = callPackage ../development/python-modules/qserve { };
-
   qtawesome = callPackage ../development/python-modules/qtawesome { };
 
   qtconsole = callPackage ../development/python-modules/qtconsole { };
@@ -7424,8 +6944,6 @@ in {
 
   relatorio = callPackage ../development/python-modules/relatorio { };
 
-  remotecv = callPackage ../development/python-modules/remotecv { };
-
   rencode = callPackage ../development/python-modules/rencode { };
 
   repeated_test = callPackage ../development/python-modules/repeated_test { };
@@ -7512,8 +7030,6 @@ in {
 
   rfcat = callPackage ../development/python-modules/rfcat { };
 
-  rhpl = disabledIf isPy3k (callPackage ../development/python-modules/rhpl { });
-
   rich = callPackage ../development/python-modules/rich { };
 
   rig = callPackage ../development/python-modules/rig { };
@@ -7526,9 +7042,9 @@ in {
 
   rising = callPackage ../development/python-modules/rising { };
 
-  rivet = disabledIf (!isPy3k) (toPythonModule (pkgs.rivet.override {
+  rivet = toPythonModule (pkgs.rivet.override {
     python3 = python;
-  }));
+  });
 
   rjsmin = callPackage ../development/python-modules/rjsmin { };
 
@@ -7552,8 +7068,6 @@ in {
 
   robotframework-requests = callPackage ../development/python-modules/robotframework-requests { };
 
-  robotframework-ride = callPackage ../development/python-modules/robotframework-ride { };
-
   robotframework-selenium2library = callPackage ../development/python-modules/robotframework-selenium2library { };
 
   robotframework-seleniumlibrary = callPackage ../development/python-modules/robotframework-seleniumlibrary { };
@@ -7590,29 +7104,23 @@ in {
 
   rpdb = callPackage ../development/python-modules/rpdb { };
 
-  rpkg = callPackage ../development/python-modules/rpkg { };
-
   rply = callPackage ../development/python-modules/rply { };
 
-  rpm = disabledIf (!isPy3k) (toPythonModule (pkgs.rpm.override {
+  rpm = toPythonModule (pkgs.rpm.override {
     inherit python;
-  }));
+  });
+
+  rpmfile = callPackage ../development/python-modules/rpmfile { };
 
   rpmfluff = callPackage ../development/python-modules/rpmfluff { };
 
-  rpy2 = if isPy3k then
-    callPackage ../development/python-modules/rpy2 { }
-  else
-    callPackage ../development/python-modules/rpy2/2.nix { };
+  rpy2 = callPackage ../development/python-modules/rpy2 { };
 
   rpyc = callPackage ../development/python-modules/rpyc { };
 
   rq = callPackage ../development/python-modules/rq { };
 
-  rsa = if isPy3k then
-    callPackage ../development/python-modules/rsa { }
-  else
-    callPackage ../development/python-modules/rsa/4_0.nix { };
+  rsa = callPackage ../development/python-modules/rsa { };
 
   rtmidi-python = callPackage ../development/python-modules/rtmidi-python { };
 
@@ -7625,9 +7133,6 @@ in {
   ruamel-base = self.ruamel_base;
   ruamel_base = callPackage ../development/python-modules/ruamel_base { };
 
-  ruamel-ordereddict = self.ruamel_ordereddict;
-  ruamel_ordereddict = callPackage ../development/python-modules/ruamel_ordereddict { };
-
   ruamel-yaml = self.ruamel_yaml;
   ruamel_yaml = callPackage ../development/python-modules/ruamel_yaml { };
 
@@ -7638,8 +7143,6 @@ in {
 
   ruffus = callPackage ../development/python-modules/ruffus { };
 
-  runsnakerun = callPackage ../development/python-modules/runsnakerun { };
-
   runway-python = callPackage ../development/python-modules/runway-python { };
 
   rx = callPackage ../development/python-modules/rx { };
@@ -7682,8 +7185,6 @@ in {
 
   samsungtvws = callPackage ../development/python-modules/samsungtvws { };
 
-  sandboxlib = callPackage ../development/python-modules/sandboxlib { };
-
   sanic-auth = callPackage ../development/python-modules/sanic-auth { };
 
   sanic = callPackage ../development/python-modules/sanic { };
@@ -7698,8 +7199,6 @@ in {
 
   scancode-toolkit = callPackage ../development/python-modules/scancode-toolkit { };
 
-  scandir = callPackage ../development/python-modules/scandir { };
-
   scapy = callPackage ../development/python-modules/scapy { };
 
   schedule = callPackage ../development/python-modules/schedule { };
@@ -7718,11 +7217,9 @@ in {
 
   scikitimage = callPackage ../development/python-modules/scikit-image { };
 
-  scikitlearn = let args = { inherit (pkgs) gfortran glibcLocales; };
-  in if isPy3k then
-    callPackage ../development/python-modules/scikitlearn args
-  else
-    callPackage ../development/python-modules/scikitlearn/0.20.nix args;
+  scikitlearn = callPackage ../development/python-modules/scikitlearn {
+    inherit (pkgs) gfortran glibcLocales;
+  };
 
   scikit-optimize = callPackage ../development/python-modules/scikit-optimize { };
 
@@ -7750,16 +7247,7 @@ in {
     disabled = !isPy3k;
   });
 
-  scipy = let
-    scipy_ = callPackage ../development/python-modules/scipy { };
-    scipy_1_2 = scipy_.overridePythonAttrs (oldAttrs: rec {
-      version = "1.2.2";
-      src = oldAttrs.src.override {
-        inherit version;
-        sha256 = "a4331e0b8dab1ff75d2c67b5158a8bb9a83c799d7140094dda936d876c7cfbb1";
-      };
-    });
-  in if pythonOlder "3.5" then scipy_1_2 else scipy_;
+  scipy = callPackage ../development/python-modules/scipy { };
 
   scour = callPackage ../development/python-modules/scour { };
 
@@ -7785,10 +7273,7 @@ in {
 
   sdnotify = callPackage ../development/python-modules/sdnotify { };
 
-  seaborn = if isPy3k then
-    callPackage ../development/python-modules/seaborn { }
-  else
-    callPackage ../development/python-modules/seaborn/0.9.1.nix { };
+  seaborn = callPackage ../development/python-modules/seaborn { };
 
   seabreeze = callPackage ../development/python-modules/seabreeze { };
 
@@ -7798,10 +7283,7 @@ in {
     inherit (pkgs) secp256k1;
   };
 
-  secretstorage = if isPy3k then
-    callPackage ../development/python-modules/secretstorage { }
-  else
-    callPackage ../development/python-modules/secretstorage/2.nix { };
+  secretstorage = callPackage ../development/python-modules/secretstorage { };
 
   secure = callPackage ../development/python-modules/secure { };
 
@@ -7815,8 +7297,6 @@ in {
 
   selenium = callPackage ../development/python-modules/selenium { };
 
-  semantic = callPackage ../development/python-modules/semantic { };
-
   semantic-version = callPackage ../development/python-modules/semantic-version { };
 
   semver = callPackage ../development/python-modules/semver { };
@@ -7839,7 +7319,7 @@ in {
 
   seqeval = callPackage ../development/python-modules/seqeval { };
 
-  sequoia = disabledIf (isPyPy || !isPy3k) (toPythonModule (pkgs.sequoia.override {
+  sequoia = disabledIf isPyPy (toPythonModule (pkgs.sequoia.override {
     pythonPackages = self;
     pythonSupport = true;
   }));
@@ -7850,14 +7330,10 @@ in {
 
   serverlessrepo = callPackage ../development/python-modules/serverlessrepo { };
 
-  serversyncstorage = callPackage ../development/python-modules/serversyncstorage { };
-
   service-identity = callPackage ../development/python-modules/service_identity { };
 
   setproctitle = callPackage ../development/python-modules/setproctitle { };
 
-  setuptoolsDarcs = callPackage ../development/python-modules/setuptoolsdarcs { };
-
   setuptools-git = callPackage ../development/python-modules/setuptools-git { };
 
   setuptools-lint = callPackage ../development/python-modules/setuptools-lint { };
@@ -7917,8 +7393,6 @@ in {
 
   simanneal = callPackage ../development/python-modules/simanneal { };
 
-  simpleai = callPackage ../development/python-modules/simpleai { };
-
   simpleaudio = callPackage ../development/python-modules/simpleaudio { };
 
   simplebayes = callPackage ../development/python-modules/simplebayes { };
@@ -7935,8 +7409,6 @@ in {
 
   simplekml = callPackage ../development/python-modules/simplekml { };
 
-  simpleparse = callPackage ../development/python-modules/simpleparse { };
-
   simple-salesforce = callPackage ../development/python-modules/simple-salesforce { };
 
   simple-websocket-server = callPackage ../development/python-modules/simple-websocket-server { };
@@ -7945,16 +7417,12 @@ in {
 
   simpy = callPackage ../development/python-modules/simpy { };
 
-  singledispatch = callPackage ../development/python-modules/singledispatch { };
-
   signify = callPackage ../development/python-modules/signify { };
 
   sip = callPackage ../development/python-modules/sip { };
 
   sip_5 = callPackage ../development/python-modules/sip/5.x.nix { };
 
-  sipsimple = callPackage ../development/python-modules/sipsimple { };
-
   six = callPackage ../development/python-modules/six { };
 
   skein = callPackage ../development/python-modules/skein {
@@ -7993,12 +7461,8 @@ in {
 
   slob = callPackage ../development/python-modules/slob { };
 
-  slowaes = callPackage ../development/python-modules/slowaes { };
-
   sly = callPackage ../development/python-modules/sly { };
 
-  smartdc = callPackage ../development/python-modules/smartdc { };
-
   smart_open = callPackage ../development/python-modules/smart_open { };
 
   smartypants = callPackage ../development/python-modules/smartypants { };
@@ -8039,8 +7503,6 @@ in {
 
   snscrape = callPackage ../development/python-modules/snscrape { };
 
-  snug = callPackage ../development/python-modules/snug { };
-
   snuggs = callPackage ../development/python-modules/snuggs { };
 
   soapysdr = toPythonModule (pkgs.soapysdr.override {
@@ -8083,10 +7545,7 @@ in {
 
   soundfile = callPackage ../development/python-modules/soundfile { };
 
-  soupsieve = if isPy3k then
-    callPackage ../development/python-modules/soupsieve { }
-  else
-    callPackage ../development/python-modules/soupsieve/1.nix { };
+  soupsieve = callPackage ../development/python-modules/soupsieve { };
 
   spacy = callPackage ../development/python-modules/spacy { };
 
@@ -8094,8 +7553,6 @@ in {
 
   spake2 = callPackage ../development/python-modules/spake2 { };
 
-  spambayes = callPackage ../development/python-modules/spambayes { };
-
   spark_parser = callPackage ../development/python-modules/spark_parser { };
 
   sparklines = callPackage ../development/python-modules/sparklines { };
@@ -8158,15 +7615,9 @@ in {
     texLive = pkgs.texlive.combine { inherit (pkgs.texlive) scheme-small standalone pgfplots; };
   };
 
-  sphinxcontrib-websupport = if isPy3k then
-    callPackage ../development/python-modules/sphinxcontrib-websupport { }
-  else
-    callPackage ../development/python-modules/sphinxcontrib-websupport/1_1.nix { };
+  sphinxcontrib-websupport = callPackage ../development/python-modules/sphinxcontrib-websupport { };
 
-  sphinx = if isPy3k then
-    callPackage ../development/python-modules/sphinx { }
-  else
-    callPackage ../development/python-modules/sphinx/2.nix { };
+  sphinx = callPackage ../development/python-modules/sphinx { };
 
   sphinx-argparse = callPackage ../development/python-modules/sphinx-argparse { };
 
@@ -8214,8 +7665,6 @@ in {
 
   sqlalchemy-utils = callPackage ../development/python-modules/sqlalchemy-utils { };
 
-  sqlite3dbm = callPackage ../development/python-modules/sqlite3dbm { };
-
   sqlitedict = callPackage ../development/python-modules/sqlitedict { };
 
   sqlite-fts4 = callPackage ../development/python-modules/sqlite-fts4 { };
@@ -8230,8 +7679,6 @@ in {
 
   sqlsoup = callPackage ../development/python-modules/sqlsoup { };
 
-  squaremap = callPackage ../development/python-modules/squaremap { };
-
   srp = callPackage ../development/python-modules/srp { };
 
   srptools = callPackage ../development/python-modules/srptools { };
@@ -8280,7 +7727,7 @@ in {
 
   stm32loader = callPackage ../development/python-modules/stm32loader { };
 
-  stompclient = callPackage ../development/python-modules/stompclient { };
+  stone = callPackage ../development/python-modules/stone { };
 
   strategies = callPackage ../development/python-modules/strategies { };
 
@@ -8316,16 +7763,10 @@ in {
 
   subdownloader = callPackage ../development/python-modules/subdownloader { };
 
-  subliminal = callPackage ../development/python-modules/subliminal { };
-
-  subprocess32 = callPackage ../development/python-modules/subprocess32 { };
-
   subunit = callPackage ../development/python-modules/subunit {
     inherit (pkgs) subunit cppunit check;
   };
 
-  suds = callPackage ../development/python-modules/suds { };
-
   suds-jurko = callPackage ../development/python-modules/suds-jurko { };
 
   sumo = callPackage ../development/python-modules/sumo { };
@@ -8370,10 +7811,7 @@ in {
     inherit (pkgs) symengine;
   };
 
-  sympy = if isPy3k then
-    callPackage ../development/python-modules/sympy { }
-  else
-    callPackage ../development/python-modules/sympy/1_5.nix { };
+  sympy = callPackage ../development/python-modules/sympy { };
 
   systembridge = callPackage ../development/python-modules/systembridge { };
 
@@ -8385,19 +7823,16 @@ in {
 
   tableaudocumentapi = callPackage ../development/python-modules/tableaudocumentapi { };
 
-  tables = if isPy3k then
-    callPackage ../development/python-modules/tables {
-      hdf5 = pkgs.hdf5_1_10;
-    }
-  else
-    callPackage ../development/python-modules/tables/3.5.nix {
-      hdf5 = pkgs.hdf5_1_10;
-    };
+  tables = callPackage ../development/python-modules/tables {
+    hdf5 = pkgs.hdf5_1_10;
+  };
 
   tablib = callPackage ../development/python-modules/tablib { };
 
   tabulate = callPackage ../development/python-modules/tabulate { };
 
+  tabview = callPackage ../development/python-modules/tabview { };
+
   tadasets = callPackage ../development/python-modules/tadasets { };
 
   tag-expressions = callPackage ../development/python-modules/tag-expressions { };
@@ -8406,8 +7841,6 @@ in {
 
   tailer = callPackage ../development/python-modules/tailer { };
 
-  tarman = callPackage ../development/python-modules/tarman { };
-
   tasklib = callPackage ../development/python-modules/tasklib { };
 
   taskw = callPackage ../development/python-modules/taskw { };
@@ -8563,8 +7996,6 @@ in {
 
   thrift = callPackage ../development/python-modules/thrift { };
 
-  thumbor = callPackage ../development/python-modules/thumbor { };
-
   thumborPexif = callPackage ../development/python-modules/thumborpexif { };
 
   tkinter = let
@@ -8611,28 +8042,21 @@ in {
 
   tmb = callPackage ../development/python-modules/tmb { };
 
-  tmdb3 = callPackage ../development/python-modules/tmdb3 { };
-
   todoist = callPackage ../development/python-modules/todoist { };
 
   toggl-cli = callPackage ../development/python-modules/toggl-cli { };
 
-  tokenizers = disabledIf (!isPy3k) (toPythonModule (callPackage ../development/python-modules/tokenizers { }));
+  tokenizers = toPythonModule (callPackage ../development/python-modules/tokenizers { });
 
-  tokenize-rt = disabledIf (!isPy3k) (toPythonModule (callPackage ../development/python-modules/tokenize-rt { }));
+  tokenize-rt = toPythonModule (callPackage ../development/python-modules/tokenize-rt { });
 
   tokenlib = callPackage ../development/python-modules/tokenlib { };
 
-  tokenserver = callPackage ../development/python-modules/tokenserver { };
-
   toml = callPackage ../development/python-modules/toml { };
 
   tomlkit = callPackage ../development/python-modules/tomlkit { };
 
-  toolz = if isPy3k then
-    callPackage ../development/python-modules/toolz { }
-  else
-    callPackage ../development/python-modules/toolz/2.nix { };
+  toolz = callPackage ../development/python-modules/toolz { };
 
   toonapi = callPackage ../development/python-modules/toonapi { };
 
@@ -8644,10 +8068,7 @@ in {
 
   torchvision = callPackage ../development/python-modules/torchvision { };
 
-  tornado = if isPy3k then
-    callPackage ../development/python-modules/tornado { }
-  else
-    callPackage ../development/python-modules/tornado/5.nix { };
+  tornado = callPackage ../development/python-modules/tornado { };
 
   # Used by circus and grab-site, 2020-08-29
   tornado_4 = callPackage ../development/python-modules/tornado/4.nix { };
@@ -8671,10 +8092,7 @@ in {
 
   trackpy = callPackage ../development/python-modules/trackpy { };
 
-  traitlets = if pythonOlder "3.7" then
-    callPackage ../development/python-modules/traitlets/4.nix { }
-  else
-    callPackage ../development/python-modules/traitlets { };
+  traitlets = callPackage ../development/python-modules/traitlets { };
 
   traits = callPackage ../development/python-modules/traits { };
 
@@ -8710,20 +8128,14 @@ in {
     pytestCheckHook = self.pytestCheckHook_6_1;
   };
 
-  trollius = callPackage ../development/python-modules/trollius { };
-
   trueskill = callPackage ../development/python-modules/trueskill { };
 
   trustme = callPackage ../development/python-modules/trustme { };
 
   trytond = callPackage ../development/python-modules/trytond { };
 
-  ttystatus = callPackage ../development/python-modules/ttystatus { };
-
   tunigo = callPackage ../development/python-modules/tunigo { };
 
-  TurboCheetah = callPackage ../development/python-modules/TurboCheetah { };
-
   tubeup = callPackage ../development/python-modules/tubeup { };
 
   tumpa = callPackage ../development/python-modules/tumpa { };
@@ -8800,7 +8212,7 @@ in {
 
   typesystem = callPackage ../development/python-modules/typesystem { };
 
-  typing = callPackage ../development/python-modules/typing { };
+  typing = null;
 
   typing-extensions = callPackage ../development/python-modules/typing-extensions { };
 
@@ -8828,10 +8240,7 @@ in {
 
   ufoprocessor = callPackage ../development/python-modules/ufoprocessor { };
 
-  ujson = if isPy27 then
-    callPackage ../development/python-modules/ujson/2.nix { }
-  else
-    callPackage ../development/python-modules/ujson { };
+  ujson = callPackage ../development/python-modules/ujson { };
 
   ukpostcodeparser = callPackage ../development/python-modules/ukpostcodeparser { };
 
@@ -8839,8 +8248,6 @@ in {
 
   umap-learn = callPackage ../development/python-modules/umap-learn { };
 
-  umemcache = callPackage ../development/python-modules/umemcache { };
-
   u-msgpack-python = callPackage ../development/python-modules/u-msgpack-python { };
 
   uncertainties = callPackage ../development/python-modules/uncertainties { };
@@ -8911,12 +8318,9 @@ in {
 
   urlgrabber = callPackage ../development/python-modules/urlgrabber { };
 
-  urllib3 = if isPy3k then
-    callPackage ../development/python-modules/urllib3 {
-      pytestCheckHook = self.pytestCheckHook_6_1;
-    }
-  else
-    callPackage ../development/python-modules/urllib3/2.nix { };
+  urllib3 = callPackage ../development/python-modules/urllib3 {
+    pytestCheckHook = self.pytestCheckHook_6_1;
+  };
 
   urlpy = callPackage ../development/python-modules/urlpy { };
 
@@ -8956,10 +8360,7 @@ in {
 
   varint = callPackage ../development/python-modules/varint { };
 
-  vcrpy = if isPy27 then
-    callPackage ../development/python-modules/vcrpy/3.nix { }
-  else
-    callPackage ../development/python-modules/vcrpy { };
+  vcrpy = callPackage ../development/python-modules/vcrpy { };
 
   vcver = callPackage ../development/python-modules/vcver { };
 
@@ -9173,8 +8574,6 @@ in {
 
   worldengine = callPackage ../development/python-modules/worldengine { };
 
-  wptserve = callPackage ../development/python-modules/wptserve { };
-
   wrapio = callPackage ../development/python-modules/wrapio { };
 
   wrapt = callPackage ../development/python-modules/wrapt { };
@@ -9187,8 +8586,6 @@ in {
 
   wsgiproxy2 = callPackage ../development/python-modules/wsgiproxy2 { };
 
-  WSGIProxy = callPackage ../development/python-modules/wsgiproxy { };
-
   wsgitools = callPackage ../development/python-modules/wsgitools { };
 
   WSME = callPackage ../development/python-modules/WSME { };
@@ -9206,10 +8603,6 @@ in {
 
   wurlitzer = callPackage ../development/python-modules/wurlitzer { };
 
-  wxPython30 = callPackage ../development/python-modules/wxPython/3.0.nix {
-    wxGTK = pkgs.wxGTK30;
-  };
-
   wxPython_4_0 = callPackage ../development/python-modules/wxPython/4.0.nix {
     inherit (pkgs.darwin.apple_sdk.frameworks) AudioToolbox Carbon Cocoa CoreFoundation IOKit OpenGL;
     wxGTK = pkgs.wxGTK30.override {
@@ -9225,8 +8618,6 @@ in {
     };
   };
 
-  wxPython = self.wxPython30;
-
   x11_hash = callPackage ../development/python-modules/x11_hash { };
 
   x256 = callPackage ../development/python-modules/x256 { };
@@ -9246,8 +8637,6 @@ in {
 
   xboxapi = callPackage ../development/python-modules/xboxapi { };
 
-  xcaplib = callPackage ../development/python-modules/xcaplib { };
-
   xcffib = callPackage ../development/python-modules/xcffib { };
 
   xdg = callPackage ../development/python-modules/xdg { };
@@ -9256,7 +8645,7 @@ in {
 
   xdot = callPackage ../development/python-modules/xdot { };
 
-  xenomapper = disabledIf (!isPy3k) (callPackage ../applications/science/biology/xenomapper { });
+  xenomapper = callPackage ../applications/science/biology/xenomapper { };
 
   xgboost = callPackage ../development/python-modules/xgboost {
     inherit (pkgs) xgboost;
@@ -9356,8 +8745,6 @@ in {
 
   yeelight = callPackage ../development/python-modules/yeelight { };
 
-  yenc = callPackage ../development/python-modules/yenc { };
-
   yfinance = callPackage ../development/python-modules/yfinance { };
 
   yoda = toPythonModule (pkgs.yoda.override { inherit python; });
@@ -9375,8 +8762,6 @@ in {
     inherit (pkgs) jq;
   };
 
-  yt = callPackage ../development/python-modules/yt { };
-
   ytmusicapi = callPackage ../development/python-modules/ytmusicapi { };
 
   yubico-client = callPackage ../development/python-modules/yubico-client { };
@@ -9391,8 +8776,6 @@ in {
 
   zarr = callPackage ../development/python-modules/zarr { };
 
-  zbase32 = callPackage ../development/python-modules/zbase32 { };
-
   zc_buildout221 = callPackage ../development/python-modules/buildout { };
 
   zc_buildout = self.zc_buildout221; # A patched version of buildout, useful for buildout based development on Nix
@@ -9405,9 +8788,9 @@ in {
 
   zdaemon = callPackage ../development/python-modules/zdaemon { };
 
-  zeek = disabledIf (!isPy3k) (toPythonModule (pkgs.zeek.override {
+  zeek = toPythonModule (pkgs.zeek.override {
     python3 = python;
-  })).py;
+  }).py;
 
   zeep = callPackage ../development/python-modules/zeep { };
 
@@ -9423,8 +8806,6 @@ in {
 
   zetup = callPackage ../development/python-modules/zetup { };
 
-  zfec = callPackage ../development/python-modules/zfec { };
-
   zha-quirks = callPackage ../development/python-modules/zha-quirks { };
 
   zict = callPackage ../development/python-modules/zict { };
@@ -9445,10 +8826,7 @@ in {
 
   zipfile36 = callPackage ../development/python-modules/zipfile36 { };
 
-  zipp = if pythonOlder "3.6" then
-    callPackage ../development/python-modules/zipp/1.nix { }
-  else
-    callPackage ../development/python-modules/zipp { };
+  zipp = callPackage ../development/python-modules/zipp { };
 
   zipstream = callPackage ../development/python-modules/zipstream { };
 
diff --git a/third_party/nixpkgs/pkgs/top-level/python2-packages.nix b/third_party/nixpkgs/pkgs/top-level/python2-packages.nix
new file mode 100644
index 0000000000..474d3c2f95
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/top-level/python2-packages.nix
@@ -0,0 +1,649 @@
+# Extension with Python 2 packages that is overlayed on top
+# of the Python 3 packages set. This way, Python 2+3 compatible
+# packages can still be used.
+
+self: super:
+
+with self; with super; {
+
+  affinity = callPackage ../development/python-modules/affinity { };
+
+  antlr4-python2-runtime = callPackage ../development/python-modules/antlr4-python2-runtime {
+    inherit (pkgs) antlr4;
+  };
+
+  appleseed = toPythonModule (pkgs.appleseed.override { inherit (self) python; });
+
+  application = callPackage ../development/python-modules/application { };
+
+  arrow = callPackage ../development/python-modules/arrow/2.nix { };
+
+  ase = callPackage ../development/python-modules/ase/3.17.nix { };
+
+  astroid = callPackage ../development/python-modules/astroid/1.6.nix { };
+
+  backports_lzma = callPackage ../development/python-modules/backports_lzma { };
+
+  backports_os = callPackage ../development/python-modules/backports_os { };
+
+  bcrypt = callPackage ../development/python-modules/bcrypt/3_1.nix { };
+
+  bitbucket_api = callPackage ../development/python-modules/bitbucket-api { };
+
+  bitbucket-cli = callPackage ../development/python-modules/bitbucket-cli { };
+
+  blivet = callPackage ../development/python-modules/blivet { };
+
+  box2d = callPackage ../development/python-modules/box2d { };
+
+  browsermob-proxy = callPackage ../development/python-modules/browsermob-proxy { };
+
+  cairocffi = callPackage ../development/python-modules/cairocffi/0_9.nix { };
+
+  cairosvg = callPackage ../development/python-modules/cairosvg/1_x.nix { };
+
+  CDDB = callPackage ../development/python-modules/cddb { };
+
+  cdecimal = callPackage ../development/python-modules/cdecimal { };
+
+  chardet = callPackage ../development/python-modules/chardet/2.nix { };
+
+  cheetah = callPackage ../development/python-modules/cheetah { };
+
+  cherrypi = callPackage ../development/python-modules/cherrypy/17.nix { };
+
+  cjson = callPackage ../development/python-modules/cjson { };
+
+  cliapp = callPackage ../development/python-modules/cliapp { };
+
+  closure-linter = callPackage ../development/python-modules/closure-linter { };
+
+  cmdtest = callPackage ../development/python-modules/cmdtest { };
+
+  coilmq = callPackage ../development/python-modules/coilmq { };
+
+  configparser = callPackage ../development/python-modules/configparser/4.nix { };
+
+  construct = callPackage ../development/python-modules/construct/2.10.54.nix { };
+
+  convertdate = callPackage ../development/python-modules/convertdate/2.2.x.nix { };
+
+  cryptography = callPackage ../development/python-modules/cryptography/3.3.nix { };
+
+  cryptography_vectors = callPackage ../development/python-modules/cryptography/vectors-3.3.nix { };
+
+  darcsver = callPackage ../development/python-modules/darcsver { };
+
+  dateparser = callPackage ../development/python-modules/dateparser/0.x.nix { };
+
+  deskcon = callPackage ../development/python-modules/deskcon { };
+
+  django_evolution = callPackage ../development/python-modules/django_evolution { };
+
+  dnspython = super.dnspython_1;
+
+  docker-py = disabled super.docker-py;
+
+  dtopt = callPackage ../development/python-modules/dtopt { };
+
+  dulwich = callPackage ../development/python-modules/dulwich/0_19.nix { };
+
+  enum = callPackage ../development/python-modules/enum { };
+
+  eventlib = callPackage ../development/python-modules/eventlib { };
+
+  faulthandler = callPackage ../development/python-modules/faulthandler { };
+
+  fdint = callPackage ../development/python-modules/fdint { };
+
+  feedparser = callPackage ../development/python-modules/feedparser/5.nix { };
+
+  flask_ldap_login = callPackage ../development/python-modules/flask-ldap-login { };
+
+  flit = disabled super.flit;
+
+  flit-core = disabled super.flit-core;
+
+  flup = callPackage ../development/python-modules/flup { };
+
+  fontforge = disabled super.fontforge;
+
+  freezegun = callPackage ../development/python-modules/freezegun/0.3.nix { };
+
+  fudge = callPackage ../development/python-modules/fudge { };
+
+  futures = callPackage ../development/python-modules/futures { };
+
+  gdcm = disabled super.gdcm;
+
+  gaia = disabledIf (isPyPy || isPy3k) (toPythonModule (pkgs.gaia.override {
+    pythonPackages = self;
+    pythonSupport = true;
+  })); # gaia isn't supported with python3 and it's not available from pypi
+
+  geant4 = disabled super.geant4;
+
+  geopy = callPackage ../development/python-modules/geopy/2.nix { };
+
+  # Python 2.7 support was deprecated but is still needed by weboob and duplicity
+  google-api-python-client = super.google-api-python-client.overridePythonAttrs (old: rec {
+    version = "1.7.6";
+    src = old.src.override {
+      inherit version;
+      sha256 = "14w5sdrp0bk9n0r2lmpqmrbf2zclpfq6q7giyahnskkfzdkb165z";
+    };
+  });
+
+  gateone = callPackage ../development/python-modules/gateone { };
+
+  gdrivefs = callPackage ../development/python-modules/gdrivefs { };
+
+  gsd = callPackage ../development/python-modules/gsd/1.7.nix { };
+
+  gnutls = callPackage ../development/python-modules/gnutls { };
+
+  google-apputils = callPackage ../development/python-modules/google-apputils { };
+
+  grib-api = disabledIf (!isPy27) (toPythonModule (pkgs.grib-api.override {
+    enablePython = true;
+    pythonPackages = self;
+  }));
+
+  gunicorn = callPackage ../development/python-modules/gunicorn/19.nix { };
+
+  gwyddion = toPythonModule (pkgs.gwyddion.override {
+    pythonSupport = true;
+    pythonPackages = self;
+  });
+
+  hg-git = callPackage ../development/python-modules/hg-git { };
+
+  hgsvn = callPackage ../development/python-modules/hgsvn { };
+
+  hsaudiotag = callPackage ../development/python-modules/hsaudiotag { };
+
+  html2text = callPackage ../development/python-modules/html2text/2018.nix { };
+
+  httpretty = callPackage ../development/python-modules/httpretty/0.nix { };
+
+  http_signature = callPackage ../development/python-modules/http_signature { };
+
+  hypothesis = super.hypothesis_4;
+
+  idna = callPackage ../development/python-modules/idna/2.nix { };
+
+  imagecodecs-lite = disabled super.imagecodecs-lite;
+
+  imbalanced-learn = callPackage ../development/python-modules/imbalanced-learn/0.4.nix { };
+
+  importlib-metadata = callPackage ../development/python-modules/importlib-metadata/2.nix { };
+
+  ipaddr = callPackage ../development/python-modules/ipaddr { };
+
+  ipykernel = callPackage ../development/python-modules/ipykernel/4.nix { };
+
+  ipython = callPackage ../development/python-modules/ipython/5.nix { };
+
+  isort = callPackage ../development/python-modules/isort/4.nix { };
+
+  jaraco_functools = callPackage ../development/python-modules/jaraco_functools/2.nix { };
+
+  jaraco_stream = callPackage ../development/python-modules/jaraco_stream/2.nix { };
+
+  jsonrpclib = callPackage ../development/python-modules/jsonrpclib { };
+
+  jupyter_client = callPackage ../development/python-modules/jupyter_client/5.nix { };
+
+  jupyter_console = callPackage ../development/python-modules/jupyter_console/5.nix { };
+
+  keyring = callPackage ../development/python-modules/keyring/2.nix { };
+
+  koji = callPackage ../development/python-modules/koji { };
+
+  konfig = callPackage ../development/python-modules/konfig { };
+
+  kicad = disabled super.kicad;
+
+  kiwisolver = callPackage ../development/python-modules/kiwisolver/1_1.nix { };
+
+  larch = callPackage ../development/python-modules/larch { };
+
+  Lasagne = callPackage ../development/python-modules/lasagne { };
+
+  le = callPackage ../development/python-modules/le { };
+
+  libcloud = callPackage ../development/python-modules/libcloud/2.nix { };
+
+  libgpiod = disabled super.libgpiod;
+
+  libnl-python = toPythonModule (pkgs.libnl.override {
+    pythonSupport = true;
+    inherit python;
+  }).py;
+
+  libplist = toPythonModule (pkgs.libplist.override {
+    enablePython = true;
+    inherit python;
+  }).py;
+
+  libtorrent-rasterbar = (toPythonModule (pkgs.libtorrent-rasterbar-1_2_x.override { inherit python; })).python;
+
+  libvirt = callPackage ../development/python-modules/libvirt/5.9.0.nix {
+    libvirt = pkgs.libvirt_5_9_0;
+  };
+
+  lightblue = callPackage ../development/python-modules/lightblue { };
+
+  lirc = disabled super.lirc;
+
+  lpod = callPackage ../development/python-modules/lpod { };
+
+  lsi = callPackage ../development/python-modules/lsi { };
+
+  lxc = callPackage ../development/python-modules/lxc { };
+
+  mapsplotlib = callPackage ../development/python-modules/mapsplotlib { };
+
+  marionette-harness = callPackage ../development/python-modules/marionette-harness { };
+
+  marisa = callPackage ../development/python-modules/marisa {
+    inherit (pkgs) marisa;
+  };
+
+  marionette_driver = callPackage ../development/python-modules/marionette-harness/marionette_driver.nix { };
+
+  markdown = callPackage ../development/python-modules/markdown/3_1.nix { };
+
+  matplotlib = callPackage ../development/python-modules/matplotlib/2.nix {
+    stdenv = if stdenv.isDarwin then pkgs.clangStdenv else pkgs.stdenv;
+    inherit (pkgs.darwin.apple_sdk.frameworks) Cocoa;
+  };
+
+  meliae = callPackage ../development/python-modules/meliae { };
+
+  mercurial = disabled super.mercurial;
+
+  meson = disabled super.meson;
+
+  metaphone = callPackage ../development/python-modules/metaphone { };
+
+  mock = callPackage ../development/python-modules/mock/2.nix { };
+
+  # Needed here because moinmoin is loaded as a Python library.
+  moinmoin = callPackage ../development/python-modules/moinmoin { };
+
+  monosat = disabled super.monosat;
+
+  more-itertools = callPackage ../development/python-modules/more-itertools/2.7.nix { };
+
+  mozcrash = callPackage ../development/python-modules/marionette-harness/mozcrash.nix { };
+
+  mozdevice = callPackage ../development/python-modules/marionette-harness/mozdevice.nix { };
+
+  mozfile = callPackage ../development/python-modules/marionette-harness/mozfile.nix { };
+
+  mozhttpd = callPackage ../development/python-modules/marionette-harness/mozhttpd.nix { };
+
+  mozinfo = callPackage ../development/python-modules/marionette-harness/mozinfo.nix { };
+
+  mozlog = callPackage ../development/python-modules/marionette-harness/mozlog.nix { };
+
+  moznetwork = callPackage ../development/python-modules/marionette-harness/moznetwork.nix { };
+
+  mozprocess = callPackage ../development/python-modules/marionette-harness/mozprocess.nix { };
+
+  mozprofile = callPackage ../development/python-modules/marionette-harness/mozprofile.nix { };
+
+  mozterm = callPackage ../development/python-modules/mozterm { };
+
+  mozrunner = callPackage ../development/python-modules/marionette-harness/mozrunner.nix { };
+
+  mozsvc = callPackage ../development/python-modules/mozsvc { };
+
+  moztest = callPackage ../development/python-modules/marionette-harness/moztest.nix { };
+
+  mozversion = callPackage ../development/python-modules/marionette-harness/mozversion.nix { };
+
+  mpd = callPackage ../development/python-modules/mpd { };
+
+  mrbob = callPackage ../development/python-modules/mrbob { };
+
+  msrplib = callPackage ../development/python-modules/msrplib { };
+
+  mwlib = callPackage ../development/python-modules/mwlib { };
+
+  mwlib-ext = callPackage ../development/python-modules/mwlib-ext { };
+
+  mwlib-rl = callPackage ../development/python-modules/mwlib-rl { };
+
+  mutagen = callPackage ../development/python-modules/mutagen/1.43.nix { };
+
+  muttils = callPackage ../development/python-modules/muttils { };
+
+  namebench = callPackage ../development/python-modules/namebench { };
+
+  nbformat = callPackage ../development/python-modules/nbformat/2.nix { };
+
+  networkx = callPackage ../development/python-modules/networkx/2.2.nix { };
+
+  nevow = callPackage ../development/python-modules/nevow { };
+
+  # This is used for NixOps to make sure we won't break it with the next major version of nixpart.
+  nixpart0 = callPackage ../tools/filesystems/nixpart/0.4 { };
+
+  nixpart = callPackage ../tools/filesystems/nixpart { };
+
+  nose-focus = callPackage ../development/python-modules/nose-focus { };
+
+  nose-of-yeti = callPackage ../development/python-modules/nose-of-yeti { };
+
+  notebook = callPackage ../development/python-modules/notebook/2.nix { };
+
+  notify = callPackage ../development/python-modules/notify { };
+
+  numpy = callPackage ../development/python-modules/numpy/1.16.nix { };
+
+  nxt-python = callPackage ../development/python-modules/nxt-python { };
+
+  oauthlib = callPackage ../development/python-modules/oauthlib/3.1.nix { };
+
+  opencv = toPythonModule (pkgs.opencv.override {
+    enablePython = true;
+    pythonPackages = self;
+  });
+
+  openpyxl = callPackage ../development/python-modules/openpyxl/2.nix { };
+
+  openwrt-luci-rpc = disabled super.openwrt-luci-rpc;
+
+  opt-einsum = callPackage ../development/python-modules/opt-einsum/2.nix { };
+
+  packaging = callPackage ../development/python-modules/packaging/2.nix { };
+
+  pagerduty = callPackage ../development/python-modules/pagerduty { };
+
+  pandas = callPackage ../development/python-modules/pandas/2.nix { };
+
+  pasteScript = callPackage ../development/python-modules/pastescript { };
+
+  pathpy = callPackage ../development/python-modules/path.py/2.nix { };
+
+  pillow = callPackage ../development/python-modules/pillow/6.nix {
+    inherit (pkgs) freetype libjpeg zlib libtiff libwebp tcl lcms2 tk;
+    inherit (pkgs.xorg) libX11;
+  };
+
+  pip = callPackage ../development/python-modules/pip/20.nix { };
+
+  postorius = disabled super.postorius;
+
+  praw = callPackage ../development/python-modules/praw/6.3.nix { };
+
+  prettytable = callPackage ../development/python-modules/prettytable/1.nix { };
+
+  privacyidea = callPackage ../development/python-modules/privacyidea { };
+
+  progressbar231 = callPackage ../development/python-modules/progressbar231 { };
+
+  prompt_toolkit = callPackage ../development/python-modules/prompt_toolkit/1.nix { };
+
+  pyamf = callPackage ../development/python-modules/pyamf { };
+
+  pyblosxom = callPackage ../development/python-modules/pyblosxom { };
+
+  pycairo = callPackage ../development/python-modules/pycairo/1.18.nix {
+    inherit (pkgs) meson;
+  };
+
+  pycangjie = disabled pycangjie;
+
+  pycarddav = callPackage ../development/python-modules/pycarddav { };
+
+  pycassa = callPackage ../development/python-modules/pycassa { };
+
+  pycryptopp = callPackage ../development/python-modules/pycryptopp { };
+
+  pycurl2 = callPackage ../development/python-modules/pycurl2 { };
+
+  pydns = callPackage ../development/python-modules/pydns { };
+
+  pydocstyle = callPackage ../development/python-modules/pydocstyle/2.nix { };
+
+  pyechonest = callPackage ../development/python-modules/pyechonest { };
+
+  pyexcelerator = callPackage ../development/python-modules/pyexcelerator { };
+
+  pyexiv2 = toPythonModule (callPackage ../development/python-modules/pyexiv2 { });
+
+  pygments = callPackage ../development/python-modules/Pygments/2_5.nix { };
+
+  pygobject3 = callPackage ../development/python-modules/pygobject/3.36.nix {
+    inherit (pkgs) meson;
+  };
+
+  pygtk = callPackage ../development/python-modules/pygtk { };
+
+  pygtksourceview = callPackage ../development/python-modules/pygtksourceview { };
+
+  pyGtkGlade = self.pygtk.override {
+    inherit (pkgs.gnome2) libglade;
+  };
+
+  pyhamcrest = callPackage ../development/python-modules/pyhamcrest/1.nix { };
+
+  pykickstart = callPackage ../development/python-modules/pykickstart { };
+
+  pylibacl = callPackage ../development/python-modules/pylibacl/0.5.nix { };
+
+  pylint = callPackage ../development/python-modules/pylint/1.9.nix { };
+
+  pyobjc = if stdenv.isDarwin then
+    callPackage ../development/python-modules/pyobjc { }
+  else
+    throw "pyobjc can only be built on Mac OS";
+
+  pyPdf = callPackage ../development/python-modules/pypdf { };
+
+  pypoppler = callPackage ../development/python-modules/pypoppler { };
+
+  pyreport = callPackage ../development/python-modules/pyreport { };
+
+  pyroma = callPackage ../development/python-modules/pyroma/2.nix { };
+
+  pysqlite = callPackage ../development/python-modules/pysqlite { };
+
+  pystringtemplate = callPackage ../development/python-modules/stringtemplate { };
+
+  pytest = pytest_4;
+
+  pytest-mock = callPackage ../development/python-modules/pytest-mock/2.nix { };
+
+  pytestrunner = callPackage ../development/python-modules/pytestrunner/2.nix { };
+
+  pytest_xdist = self.pytest-xdist; # added 2021-01-04
+  pytest-xdist = callPackage ../development/python-modules/pytest-xdist/1.nix { };
+
+  python-otr = callPackage ../development/python-modules/python-otr { };
+
+  python_statsd = callPackage ../development/python-modules/python_statsd { };
+
+  python-sybase = callPackage ../development/python-modules/sybase { };
+
+  python2-pythondialog = callPackage ../development/python-modules/python2-pythondialog { };
+
+  pythonIRClib = callPackage ../development/python-modules/pythonirclib { };
+
+  pythonmagick = callPackage ../development/python-modules/pythonmagick { };
+
+  pyutil = callPackage ../development/python-modules/pyutil { };
+
+  pyxattr = super.pyxattr.overridePythonAttrs (oldAttrs: rec {
+    version = "0.6.1";
+    src = oldAttrs.src.override {
+      inherit version;
+      sha256 = "b525843f6b51036198b3b87c4773a5093d6dec57d60c18a1f269dd7059aa16e3";
+    };
+  });
+
+  PyWebDAV = callPackage ../development/python-modules/pywebdav { };
+
+  pyxml = callPackage ../development/python-modules/pyxml { };
+
+  qpid-python = callPackage ../development/python-modules/qpid-python { };
+
+  qserve = callPackage ../development/python-modules/qserve { };
+
+  remotecv = callPackage ../development/python-modules/remotecv { };
+
+  rhpl = callPackage ../development/python-modules/rhpl { };
+
+  rivet = disabled super.rivet;
+
+  robotframework-ride = callPackage ../development/python-modules/robotframework-ride { };
+
+  ruamel-ordereddict = self.ruamel_ordereddict;
+  ruamel_ordereddict = callPackage ../development/python-modules/ruamel_ordereddict { };
+
+  runsnakerun = callPackage ../development/python-modules/runsnakerun { };
+
+  rpm = disabled super.rpm;
+
+  rpkg = callPackage ../development/python-modules/rpkg { };
+
+  rpy2 = callPackage ../development/python-modules/rpy2/2.nix { };
+
+  rsa = callPackage ../development/python-modules/rsa/4_0.nix { };
+
+  sandboxlib = callPackage ../development/python-modules/sandboxlib { };
+
+  scandir = callPackage ../development/python-modules/scandir { };
+
+  scikitlearn = callPackage ../development/python-modules/scikitlearn/0.20.nix {
+    inherit (pkgs) gfortran glibcLocales;
+  };
+
+  scipy = super.scipy.overridePythonAttrs (oldAttrs: rec {
+    version = "1.2.2";
+    src = oldAttrs.src.override {
+      inherit version;
+      sha256 = "a4331e0b8dab1ff75d2c67b5158a8bb9a83c799d7140094dda936d876c7cfbb1";
+    };
+  });
+
+  seaborn = callPackage ../development/python-modules/seaborn/0.9.1.nix { };
+
+  secretstorage = callPackage ../development/python-modules/secretstorage/2.nix { };
+
+  semantic = callPackage ../development/python-modules/semantic { };
+
+  serversyncstorage = callPackage ../development/python-modules/serversyncstorage { };
+
+  sequoia = disabled super.sequoia;
+
+  setuptools = callPackage ../development/python-modules/setuptools/44.0.nix { };
+
+  setuptools_scm = callPackage ../development/python-modules/setuptools_scm/2.nix { };
+
+  setuptoolsDarcs = callPackage ../development/python-modules/setuptoolsdarcs { };
+
+  simpleai = callPackage ../development/python-modules/simpleai { };
+
+  simpleparse = callPackage ../development/python-modules/simpleparse { };
+
+  singledispatch = callPackage ../development/python-modules/singledispatch { };
+
+  sipsimple = callPackage ../development/python-modules/sipsimple { };
+
+  slowaes = callPackage ../development/python-modules/slowaes { };
+
+  smartdc = callPackage ../development/python-modules/smartdc { };
+
+  snug = callPackage ../development/python-modules/snug { };
+
+  soupsieve = callPackage ../development/python-modules/soupsieve/1.nix { };
+
+  spambayes = callPackage ../development/python-modules/spambayes { };
+
+  sphinxcontrib-websupport = callPackage ../development/python-modules/sphinxcontrib-websupport/1_1.nix { };
+
+  sphinx = callPackage ../development/python-modules/sphinx/2.nix { };
+
+  sqlite3dbm = callPackage ../development/python-modules/sqlite3dbm { };
+
+  squaremap = callPackage ../development/python-modules/squaremap { };
+
+  stompclient = callPackage ../development/python-modules/stompclient { };
+
+  subliminal = callPackage ../development/python-modules/subliminal { };
+
+  subprocess32 = callPackage ../development/python-modules/subprocess32 { };
+
+  suds = callPackage ../development/python-modules/suds { };
+
+  sympy = callPackage ../development/python-modules/sympy/1_5.nix { };
+
+  tables = callPackage ../development/python-modules/tables/3.5.nix {
+    hdf5 = pkgs.hdf5_1_10;
+  };
+
+  tarman = callPackage ../development/python-modules/tarman { };
+
+  thumbor = callPackage ../development/python-modules/thumbor { };
+
+  tmdb3 = callPackage ../development/python-modules/tmdb3 { };
+
+  tokenizers = disabled super.tokenizers;
+
+  tokenize-rt = disabled super.tokenize-rt;
+
+  tokenserver = callPackage ../development/python-modules/tokenserver { };
+
+  toolz = callPackage ../development/python-modules/toolz/2.nix { };
+
+  tornado = callPackage ../development/python-modules/tornado/5.nix { };
+
+  traitlets = callPackage ../development/python-modules/traitlets/4.nix { };
+
+  trollius = callPackage ../development/python-modules/trollius { };
+
+  ttystatus = callPackage ../development/python-modules/ttystatus { };
+
+  TurboCheetah = callPackage ../development/python-modules/TurboCheetah { };
+
+  typing = callPackage ../development/python-modules/typing { };
+
+  ujson = callPackage ../development/python-modules/ujson/2.nix { };
+
+  umemcache = callPackage ../development/python-modules/umemcache { };
+
+  urllib3 = callPackage ../development/python-modules/urllib3/2.nix { };
+
+  wptserve = callPackage ../development/python-modules/wptserve { };
+
+  WSGIProxy = callPackage ../development/python-modules/wsgiproxy { };
+
+  wxPython30 = callPackage ../development/python-modules/wxPython/3.0.nix {
+    wxGTK = pkgs.wxGTK30;
+  };
+
+  wxPython = self.wxPython30;
+
+  vcrpy = callPackage ../development/python-modules/vcrpy/3.nix { };
+
+  xcaplib = callPackage ../development/python-modules/xcaplib { };
+
+  xenomapper = disabled super.xenomapper;
+
+  yenc = callPackage ../development/python-modules/yenc { };
+
+  yt = callPackage ../development/python-modules/yt { };
+
+  zeek = disablede super.zeek;
+
+  zbase32 = callPackage ../development/python-modules/zbase32 { };
+
+  zfec = callPackage ../development/python-modules/zfec { };
+
+  zipp = callPackage ../development/python-modules/zipp/1.nix { };
+
+}