diff --git a/third_party/nixpkgs/.github/workflows/editorconfig.yml b/third_party/nixpkgs/.github/workflows/editorconfig.yml
index 7f1808d35f..d61882c504 100644
--- a/third_party/nixpkgs/.github/workflows/editorconfig.yml
+++ b/third_party/nixpkgs/.github/workflows/editorconfig.yml
@@ -14,7 +14,7 @@ jobs:
     - name: Fetch editorconfig-checker
       if: env.GIT_DIFF
       env:
-        ECC_VERSION: "2.1.0"
+        ECC_VERSION: "2.2.0"
         ECC_URL: "https://github.com/editorconfig-checker/editorconfig-checker/releases/download"
       run: |
         curl -sSf -O -L -C - "$ECC_URL/$ECC_VERSION/ec-linux-amd64.tar.gz" && \
diff --git a/third_party/nixpkgs/lib/filesystem.nix b/third_party/nixpkgs/lib/filesystem.nix
index fc35a1a72c..0a1275e547 100644
--- a/third_party/nixpkgs/lib/filesystem.nix
+++ b/third_party/nixpkgs/lib/filesystem.nix
@@ -42,4 +42,16 @@
               type = (builtins.readDir parent).${base} or null;
           in file == /. || type == "directory";
     in go (if isDir then file else parent);
+
+
+  # listFilesRecursive: Path -> [ Path ]
+  #
+  # Given a directory, return a flattened list of all files within it recursively.
+  listFilesRecursive = dir: lib.flatten (lib.mapAttrsToList (name: type:
+    if type == "directory" then
+      lib.filesystem.listFilesRecursive (dir + "/${name}")
+    else
+      dir + "/${name}"
+  ) (builtins.readDir dir));
+
 }
diff --git a/third_party/nixpkgs/lib/strings.nix b/third_party/nixpkgs/lib/strings.nix
index 9fa9f02356..d81e46a176 100644
--- a/third_party/nixpkgs/lib/strings.nix
+++ b/third_party/nixpkgs/lib/strings.nix
@@ -315,6 +315,16 @@ rec {
   */
   escapeNixString = s: escape ["$"] (builtins.toJSON s);
 
+  /* Turn a string into an exact regular expression
+
+     Type: string -> string
+
+     Example:
+       escapeRegex "[^a-z]*"
+       => "\\[\\^a-z]\\*"
+  */
+  escapeRegex = escape (stringToCharacters "\\[{()^$?*+|.");
+
   /* Quotes a string if it can't be used as an identifier directly.
 
      Type: string -> string
@@ -386,8 +396,6 @@ rec {
   /* Cut a string with a separator and produces a list of strings which
      were separated by this separator.
 
-     NOTE: this function is not performant and should never be used.
-
      Example:
        splitString "." "foo.bar.baz"
        => [ "foo" "bar" "baz" ]
@@ -396,26 +404,11 @@ rec {
   */
   splitString = _sep: _s:
     let
-      sep = addContextFrom _s _sep;
-      s = addContextFrom _sep _s;
-      sepLen = stringLength sep;
-      sLen = stringLength s;
-      lastSearch = sLen - sepLen;
-      startWithSep = startAt:
-        substring startAt sepLen s == sep;
-
-      recurse = index: startAt:
-        let cutUntil = i: [(substring startAt (i - startAt) s)]; in
-        if index <= lastSearch then
-          if startWithSep index then
-            let restartAt = index + sepLen; in
-            cutUntil index ++ recurse restartAt restartAt
-          else
-            recurse (index + 1) startAt
-        else
-          cutUntil sLen;
+      sep = builtins.unsafeDiscardStringContext _sep;
+      s = builtins.unsafeDiscardStringContext _s;
+      splits = builtins.filter builtins.isString (builtins.split (escapeRegex sep) s);
     in
-      recurse 0 0;
+      map (v: addContextFrom _sep (addContextFrom _s v)) splits;
 
   /* Return a string without the specified prefix, if the prefix matches.
 
diff --git a/third_party/nixpkgs/lib/tests/misc.nix b/third_party/nixpkgs/lib/tests/misc.nix
index 3a6db53c27..6175f15819 100644
--- a/third_party/nixpkgs/lib/tests/misc.nix
+++ b/third_party/nixpkgs/lib/tests/misc.nix
@@ -154,6 +154,20 @@ runTests {
     expected = [ "2001" "db8" "0" "0042" "" "8a2e" "370" "" ];
   };
 
+  testSplitStringsRegex = {
+    expr = strings.splitString "\\[{}]()^$?*+|." "A\\[{}]()^$?*+|.B";
+    expected = [ "A" "B" ];
+  };
+
+  testSplitStringsDerivation = {
+    expr = take 3  (strings.splitString "/" (derivation {
+      name = "name";
+      builder = "builder";
+      system = "system";
+    }));
+    expected = ["" "nix" "store"];
+  };
+
   testSplitVersionSingle = {
     expr = versions.splitVersion "1";
     expected = [ "1" ];
diff --git a/third_party/nixpkgs/maintainers/maintainer-list.nix b/third_party/nixpkgs/maintainers/maintainer-list.nix
index 8f46e57532..eeb23378b6 100644
--- a/third_party/nixpkgs/maintainers/maintainer-list.nix
+++ b/third_party/nixpkgs/maintainers/maintainer-list.nix
@@ -7419,6 +7419,12 @@
     githubId = 1387224;
     name = "Richard Szibele";
   };
+  rtburns-jpl = {
+    email = "rtburns@jpl.nasa.gov";
+    github = "rtburns-jpl";
+    githubId = 47790121;
+    name = "Ryan Burns";
+  };
   rtreffer = {
     email = "treffer+nixos@measite.de";
     github = "rtreffer";
diff --git a/third_party/nixpkgs/nixos/doc/manual/development/running-nixos-tests-interactively.xml b/third_party/nixpkgs/nixos/doc/manual/development/running-nixos-tests-interactively.xml
index a11a938276..a6044d5f89 100644
--- a/third_party/nixpkgs/nixos/doc/manual/development/running-nixos-tests-interactively.xml
+++ b/third_party/nixpkgs/nixos/doc/manual/development/running-nixos-tests-interactively.xml
@@ -9,7 +9,7 @@
   The test itself can be run interactively. This is particularly useful when
   developing or debugging a test:
 <screen>
-<prompt>$ </prompt>nix-build nixos/tests/login.nix -A driver
+<prompt>$ </prompt>nix-build nixos/tests/login.nix -A driverInteractive
 <prompt>$ </prompt>./result/bin/nixos-test-driver
 starting VDE switch for network 1
 <prompt>&gt;</prompt>
@@ -30,7 +30,7 @@ starting VDE switch for network 1
  <para>
   To just start and experiment with the VMs, run:
 <screen>
-<prompt>$ </prompt>nix-build nixos/tests/login.nix -A driver
+<prompt>$ </prompt>nix-build nixos/tests/login.nix -A driverInteractive
 <prompt>$ </prompt>./result/bin/nixos-run-vms
 </screen>
   The script <command>nixos-run-vms</command> starts the virtual machines
diff --git a/third_party/nixpkgs/nixos/lib/testing-python.nix b/third_party/nixpkgs/nixos/lib/testing-python.nix
index 498f97336c..302c7f78bf 100644
--- a/third_party/nixpkgs/nixos/lib/testing-python.nix
+++ b/third_party/nixpkgs/nixos/lib/testing-python.nix
@@ -17,9 +17,9 @@ rec {
   inherit pkgs;
 
 
-  testDriver = let
+  mkTestDriver = let
     testDriverScript = ./test-driver/test-driver.py;
-  in stdenv.mkDerivation {
+  in qemu_pkg: stdenv.mkDerivation {
     name = "nixos-test-driver";
 
     nativeBuildInputs = [ makeWrapper ];
@@ -47,10 +47,12 @@ rec {
         # TODO: copy user script part into this file (append)
 
         wrapProgram $out/bin/nixos-test-driver \
-          --prefix PATH : "${lib.makeBinPath [ qemu_test vde2 netpbm coreutils ]}" \
+          --prefix PATH : "${lib.makeBinPath [ qemu_pkg vde2 netpbm coreutils ]}" \
       '';
   };
 
+  testDriver = mkTestDriver qemu_test;
+  testDriverInteractive = mkTestDriver qemu_kvm;
 
   # Run an automated test suite in the given virtual network.
   # `driver' is the script that runs the network.
@@ -113,7 +115,11 @@ rec {
       # Generate convenience wrappers for running the test driver
       # interactively with the specified network, and for starting the
       # VMs from the command line.
-      driver = let warn = if skipLint then lib.warn "Linting is disabled!" else lib.id; in warn (runCommand testDriverName
+      driver = testDriver:
+        let
+          warn = if skipLint then lib.warn "Linting is disabled!" else lib.id;
+        in
+        warn (runCommand testDriverName
         { buildInputs = [ makeWrapper];
           testScript = testScript';
           preferLocalBuild = true;
@@ -148,7 +154,7 @@ rec {
         meta = (drv.meta or {}) // t.meta;
       };
 
-      test = passMeta (runTests driver);
+      test = passMeta (runTests (driver testDriver));
 
       nodeNames = builtins.attrNames nodes;
       invalidNodeNames = lib.filter
@@ -165,7 +171,9 @@ rec {
         ''
       else
         test // {
-          inherit nodes driver test;
+          inherit nodes test;
+          driver = driver testDriver;
+          driverInteractive = driver testDriverInteractive;
         };
 
   runInMachine =
diff --git a/third_party/nixpkgs/nixos/modules/config/no-x-libs.nix b/third_party/nixpkgs/nixos/modules/config/no-x-libs.nix
index 941ab78f86..c3120c2bf3 100644
--- a/third_party/nixpkgs/nixos/modules/config/no-x-libs.nix
+++ b/third_party/nixpkgs/nixos/modules/config/no-x-libs.nix
@@ -30,11 +30,12 @@ with lib;
       cairo = super.cairo.override { x11Support = false; };
       dbus = super.dbus.override { x11Support = false; };
       networkmanager-fortisslvpn = super.networkmanager-fortisslvpn.override { withGnome = false; };
+      networkmanager-iodine = super.networkmanager-iodine.override { withGnome = false; };
       networkmanager-l2tp = super.networkmanager-l2tp.override { withGnome = false; };
       networkmanager-openconnect = super.networkmanager-openconnect.override { withGnome = false; };
       networkmanager-openvpn = super.networkmanager-openvpn.override { withGnome = false; };
+      networkmanager-sstp = super.networkmanager-vpnc.override { withGnome = false; };
       networkmanager-vpnc = super.networkmanager-vpnc.override { withGnome = false; };
-      networkmanager-iodine = super.networkmanager-iodine.override { withGnome = false; };
       gobject-introspection = super.gobject-introspection.override { x11Support = false; };
       qemu = super.qemu.override { gtkSupport = false; spiceSupport = false; sdlSupport = false; };
     }));
diff --git a/third_party/nixpkgs/nixos/modules/services/misc/jellyfin.nix b/third_party/nixpkgs/nixos/modules/services/misc/jellyfin.nix
index 0493dadea9..6a47dc3628 100644
--- a/third_party/nixpkgs/nixos/modules/services/misc/jellyfin.nix
+++ b/third_party/nixpkgs/nixos/modules/services/misc/jellyfin.nix
@@ -45,6 +45,46 @@ in
         CacheDirectory = "jellyfin";
         ExecStart = "${cfg.package}/bin/jellyfin --datadir '/var/lib/${StateDirectory}' --cachedir '/var/cache/${CacheDirectory}'";
         Restart = "on-failure";
+
+        # Security options:
+
+        NoNewPrivileges = true;
+
+        AmbientCapabilities = "";
+        CapabilityBoundingSet = "";
+
+        # ProtectClock= adds DeviceAllow=char-rtc r
+        DeviceAllow = "";
+
+        LockPersonality = true;
+
+        PrivateTmp = true;
+        PrivateDevices = true;
+        PrivateUsers = true;
+
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+
+        RemoveIPC = true;
+
+        RestrictNamespaces = true;
+        # AF_NETLINK needed because Jellyfin monitors the network connection
+        RestrictAddressFamilies = [ "AF_NETLINK" "AF_INET" "AF_INET6" ];
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+
+        SystemCallArchitectures = "native";
+        SystemCallErrorNumber = "EPERM";
+        SystemCallFilter = [
+          "@system-service"
+
+          "~@chown" "~@cpu-emulation" "~@debug" "~@keyring" "~@memlock" "~@module"
+          "~@obsolete" "~@privileged" "~@setuid"
+        ];
       };
     };
 
diff --git a/third_party/nixpkgs/nixos/modules/services/networking/networkmanager.nix b/third_party/nixpkgs/nixos/modules/services/networking/networkmanager.nix
index 17c549d42c..201a51ff70 100644
--- a/third_party/nixpkgs/nixos/modules/services/networking/networkmanager.nix
+++ b/third_party/nixpkgs/nixos/modules/services/networking/networkmanager.nix
@@ -15,6 +15,7 @@ let
     networkmanager-openconnect
     networkmanager-openvpn
     networkmanager-vpnc
+    networkmanager-sstp
    ] ++ optional (!delegateWireless && !enableIwd) wpa_supplicant;
 
   delegateWireless = config.networking.wireless.enable == true && cfg.unmanaged != [];
@@ -386,6 +387,9 @@ in {
 
       "NetworkManager/VPN/nm-iodine-service.name".source =
         "${networkmanager-iodine}/lib/NetworkManager/VPN/nm-iodine-service.name";
+
+      "NetworkManager/VPN/nm-sstp-service.name".source =
+        "${networkmanager-sstp}/lib/NetworkManager/VPN/nm-sstp-service.name";
       }
       // optionalAttrs (cfg.appendNameservers != [] || cfg.insertNameservers != [])
          {
diff --git a/third_party/nixpkgs/nixos/modules/testing/test-instrumentation.nix b/third_party/nixpkgs/nixos/modules/testing/test-instrumentation.nix
index c0ec76e8a3..dbbcb0bed5 100644
--- a/third_party/nixpkgs/nixos/modules/testing/test-instrumentation.nix
+++ b/third_party/nixpkgs/nixos/modules/testing/test-instrumentation.nix
@@ -116,6 +116,10 @@ with import ../../lib/qemu-flags.nix { inherit pkgs; };
     users.users.root.initialHashedPassword = mkOverride 150 "";
 
     services.xserver.displayManager.job.logToJournal = true;
+
+    # Make sure we use the Guest Agent from the QEMU package for testing
+    # to reduce the closure size required for the tests.
+    services.qemuGuest.package = pkgs.qemu_test.ga;
   };
 
 }
diff --git a/third_party/nixpkgs/nixos/modules/virtualisation/qemu-guest-agent.nix b/third_party/nixpkgs/nixos/modules/virtualisation/qemu-guest-agent.nix
index 665224e35d..6a735f451a 100644
--- a/third_party/nixpkgs/nixos/modules/virtualisation/qemu-guest-agent.nix
+++ b/third_party/nixpkgs/nixos/modules/virtualisation/qemu-guest-agent.nix
@@ -12,6 +12,11 @@ in {
         default = false;
         description = "Whether to enable the qemu guest agent.";
       };
+      package = mkOption {
+        type = types.package;
+        default = pkgs.qemu.ga;
+        description = "The QEMU guest agent package.";
+      };
   };
 
   config = mkIf cfg.enable (
@@ -25,7 +30,7 @@ in {
       systemd.services.qemu-guest-agent = {
         description = "Run the QEMU Guest Agent";
         serviceConfig = {
-          ExecStart = "${pkgs.qemu.ga}/bin/qemu-ga";
+          ExecStart = "${cfg.package}/bin/qemu-ga";
           Restart = "always";
           RestartSec = 0;
         };
diff --git a/third_party/nixpkgs/pkgs/applications/blockchains/polkadot/default.nix b/third_party/nixpkgs/pkgs/applications/blockchains/polkadot/default.nix
index c55d78b017..45cecf7e9f 100644
--- a/third_party/nixpkgs/pkgs/applications/blockchains/polkadot/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/blockchains/polkadot/default.nix
@@ -7,16 +7,16 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "polkadot";
-  version = "0.8.24";
+  version = "0.8.25";
 
   src = fetchFromGitHub {
     owner = "paritytech";
     repo = "polkadot";
     rev = "v${version}";
-    sha256 = "15q5scajxrf82k8nxysah8cs3yl2p09xzzwlkxvjkcn08r3zhig6";
+    sha256 = "1jdklmysr25rlwgx7pz0jw66j1w60h98kqghzjhr90zhynzh39lz";
   };
 
-  cargoSha256 = "0qp20g5c15qzp2n1nzwqbnn2wx6c905vh652nvkm7sb1d901iiqi";
+  cargoSha256 = "08yfafrspkd1g1mhlfwngbknkxjkyymbcga8n2rdsk7mz0hm0vgy";
 
   cargoPatches = [ ./substrate-wasm-builder-runner.patch ];
 
@@ -37,7 +37,7 @@ rustPlatform.buildRustPackage rec {
     description = "Polkadot Node Implementation";
     homepage = "https://polkadot.network";
     license = licenses.gpl3;
-    maintainers = with maintainers; [ akru andresilva ];
+    maintainers = with maintainers; [ akru andresilva RaghavSood ];
     platforms = platforms.linux;
   };
 }
diff --git a/third_party/nixpkgs/pkgs/applications/misc/keeweb/default.nix b/third_party/nixpkgs/pkgs/applications/misc/keeweb/default.nix
new file mode 100644
index 0000000000..159f034b85
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/applications/misc/keeweb/default.nix
@@ -0,0 +1,65 @@
+{ stdenv, fetchurl, appimageTools, undmg, libsecret }:
+let
+  inherit (stdenv.hostPlatform) system;
+  throwSystem = throw "Unsupported system: ${system}";
+
+  pname = "keeweb";
+  version = "1.15.7";
+  name = "${pname}-${version}";
+
+  suffix = {
+    x86_64-linux = "linux.AppImage";
+    x86_64-darwin = "mac.dmg";
+  }.${system} or throwSystem;
+
+  src = fetchurl {
+    url = "https://github.com/keeweb/keeweb/releases/download/v${version}/KeeWeb-${version}.${suffix}";
+    sha256 = {
+      x86_64-linux = "0cy0avl0m07xs523xm0rzsmifl28sv4rjb2jj3x492qmr2v64ckk";
+      x86_64-darwin = "0r8c3zi0ibj0bb0gfc1axfn0y4qpjqfr0xpcxf810d65kaz6wic4";
+    }.${system} or throwSystem;
+  };
+
+  appimageContents = appimageTools.extract {
+    inherit name src;
+  };
+
+  meta = with stdenv.lib; {
+    description = "Free cross-platform password manager compatible with KeePass";
+    homepage = "https://keeweb.info/";
+    license = licenses.mit;
+    maintainers = with maintainers; [ sikmir ];
+    platforms = [ "x86_64-linux" "x86_64-darwin" ];
+  };
+
+  linux = appimageTools.wrapType2 rec {
+    inherit name src meta;
+
+    extraPkgs = pkgs: with pkgs; [ libsecret ];
+
+    extraInstallCommands = ''
+      mv $out/bin/{${name},${pname}}
+      install -Dm644 ${appimageContents}/keeweb.desktop -t $out/share/applications
+      install -Dm644 ${appimageContents}/keeweb.png -t $out/share/icons/hicolor/256x256/apps
+      install -Dm644 ${appimageContents}/usr/share/mime/keeweb.xml -t $out/share/mime
+      substituteInPlace $out/share/applications/keeweb.desktop \
+        --replace 'Exec=AppRun' 'Exec=${pname}'
+    '';
+  };
+
+  darwin = stdenv.mkDerivation {
+    inherit pname version src meta;
+
+    nativeBuildInputs = [ undmg ];
+
+    sourceRoot = "KeeWeb.app";
+
+    installPhase = ''
+      mkdir -p $out/Applications/KeeWeb.app
+      cp -R . $out/Applications/KeeWeb.app
+    '';
+  };
+in
+if stdenv.isDarwin
+then darwin
+else linux
diff --git a/third_party/nixpkgs/pkgs/applications/misc/octoprint/plugins.nix b/third_party/nixpkgs/pkgs/applications/misc/octoprint/plugins.nix
index 514ac859c7..366b3866df 100644
--- a/third_party/nixpkgs/pkgs/applications/misc/octoprint/plugins.nix
+++ b/third_party/nixpkgs/pkgs/applications/misc/octoprint/plugins.nix
@@ -13,49 +13,111 @@ self: super: let
 in {
   inherit buildPlugin;
 
-  # Deprecated alias
-  m3d-fio = self.m33-fio; # added 2016-08-13
+  abl-expert = buildPlugin rec {
+    pname = "ABL_Expert";
+    version = "0.6";
 
-  m33-fio = buildPlugin rec {
-    pname = "M33-Fio";
-    version = "1.21";
-
-    src = fetchFromGitHub {
-      owner = "donovan6000";
-      repo = "M33-Fio";
-      rev = "V${version}";
-      sha256 = "1la3611kkqn8yiwjn6cizc45ri8pnk6ckld1na4nk6mqk88jvjq7";
+    src = fetchgit {
+      url = "https://framagit.org/razer/Octoprint_ABL_Expert/";
+      rev = version;
+      sha256 = "0ij3rvdwya1sbymwm5swlh2j4jagb6fal945g88zrzh5xf26hzjh";
     };
 
-    patches = [
-      ./m33-fio-one-library.patch
-    ];
+    meta = with stdenv.lib; {
+      description = "Marlin auto bed leveling control, mesh correction, and z probe handling";
+      homepage = "https://framagit.org/razer/Octoprint_ABL_Expert/";
+      license = licenses.agpl3;
+      maintainers = with maintainers; [ WhittlesJr ];
+    };
+  };
 
-    postPatch = ''
-      rm -rf octoprint_m33fio/static/libraries/*
-      (
-        cd 'shared library source'
-        make
-      )
-    '';
+  bedlevelvisualizer = buildPlugin rec {
+    pname = "BedLevelVisualizer";
+    version = "0.1.15";
+
+    src = fetchFromGitHub {
+      owner = "jneilliii";
+      repo = "OctoPrint-${pname}";
+      rev = version;
+      sha256 = "1bq39fnarnpk8phxfbpx6l4n9anf358z1cgid5r89nadmn2a0cny";
+    };
+
+    propagatedBuildInputs = with super; [ numpy ];
 
     meta = with stdenv.lib; {
-      description = "OctoPrint plugin for the Micro 3D printer";
-      homepage = "https://github.com/donovan6000/M33-Fio";
-      license = licenses.gpl3;
-      maintainers = with maintainers; [ abbradar ];
+      description = "Displays 3D mesh of bed topography report";
+      homepage = "https://github.com/jneilliii/OctoPrint-BedLevelVisualizer";
+      license = licenses.agpl3;
+      maintainers = with maintainers; [ lovesegfault ];
+    };
+  };
+
+  curaenginelegacy = buildPlugin rec {
+    pname = "CuraEngineLegacy";
+    version = "1.1.1";
+
+    src = fetchFromGitHub {
+      owner = "OctoPrint";
+      repo = "OctoPrint-${pname}";
+      rev = version;
+      sha256 = "1a7pxlmj1a7blkv97sn1k390pbjcxx2860011pbjcdnli74zpvv5";
+    };
+
+    meta = with stdenv.lib; {
+      description = "Plugin for slicing via Cura Legacy from within OctoPrint";
+      homepage = "https://github.com/OctoPrint/OctoPrint-CuraEngineLegacy";
+      license = licenses.agpl3;
+      maintainers = with maintainers; [ gebner ];
+    };
+  };
+
+  displaylayerprogress = buildPlugin rec {
+    pname = "OctoPrint-DisplayLayerProgress";
+    version = "1.24.0";
+
+    src = fetchFromGitHub {
+      owner = "OllisGit";
+      repo = pname;
+      rev = version;
+      sha256 = "1lbivg3rcjzv8zqvp8n8gcaczxdm7gvd5ihjb6jq0fgf958lv59n";
+    };
+
+    meta = with stdenv.lib; {
+      description = "OctoPrint-Plugin that sends the current progress of a print via M117 command";
+      homepage = "https://github.com/OllisGit/OctoPrint-DisplayLayerProgress";
+      license = licenses.agpl3;
+      maintainers = with maintainers; [ j0hax ];
+    };
+  };
+
+  gcodeeditor = buildPlugin rec {
+    pname = "GcodeEditor";
+    version = "0.2.9";
+
+    src = fetchFromGitHub {
+      owner = "ieatacid";
+      repo = "OctoPrint-${pname}";
+      rev = version;
+      sha256 = "1yjj9lmxbzmzrn7gahw9lj7554fphalbjjp8ns0rr9py3rshwxkm";
+    };
+
+    meta = with stdenv.lib; {
+      description = "Edit gcode on OctoPrint";
+      homepage = "https://github.com/ieatacid/OctoPrint-GcodeEditor";
+      license = licenses.agpl3;
+      maintainers = with maintainers; [ WhittlesJr ];
     };
   };
 
   mqtt = buildPlugin rec {
     pname = "MQTT";
-    version = "0.8.6";
+    version = "0.8.7";
 
     src = fetchFromGitHub {
       owner = "OctoPrint";
       repo = "OctoPrint-MQTT";
       rev = version;
-      sha256 = "0y1jnfplcy8mh3szrfbbvngl02j49cbdizglrfsry4fvqg50zjxd";
+      sha256 = "0k82h7wafbcqdvk5wjw4dp9lydwszfj1lf8vvymwbqdn7pf5h0dy";
     };
 
     propagatedBuildInputs = with super; [ paho-mqtt ];
@@ -68,77 +130,30 @@ in {
     };
   };
 
-  titlestatus = buildPlugin rec {
-    pname = "TitleStatus";
-    version = "0.0.4";
+  printtimegenius = buildPlugin rec {
+    pname = "PrintTimeGenius";
+    version = "2.2.6";
 
     src = fetchFromGitHub {
-      owner = "MoonshineSG";
-      repo = "OctoPrint-TitleStatus";
-      rev = version;
-      sha256 = "1l78xrabn5hcly2mgxwi17nwgnp2s6jxi9iy4wnw8k8icv74ag7k";
-    };
-
-    meta = with stdenv.lib; {
-      description = "Show printers status in window title";
-      homepage = "https://github.com/MoonshineSG/OctoPrint-TitleStatus";
-      license = licenses.agpl3;
-      maintainers = with maintainers; [ abbradar ];
-    };
-  };
-
-  stlviewer = buildPlugin rec {
-    pname = "STLViewer";
-    version = "0.4.2";
-
-    src = fetchFromGitHub {
-      owner = "jneilliii";
-      repo = "OctoPrint-STLViewer";
-      rev = version;
-      sha256 = "0mkvh44fn2ch4z2avsdjwi1rp353ylmk9j5fln4x7rx8ph8y7g2b";
-    };
-
-    meta = with stdenv.lib; {
-      description = "A simple stl viewer tab for OctoPrint";
-      homepage = "https://github.com/jneilliii/Octoprint-STLViewer";
-      license = licenses.agpl3;
-      maintainers = with maintainers; [ abbradar ];
-    };
-  };
-
-  curaenginelegacy = buildPlugin rec {
-    pname = "CuraEngineLegacy";
-    version = "1.0.2";
-
-    src = fetchFromGitHub {
-      owner = "OctoPrint";
+      owner = "eyal0";
       repo = "OctoPrint-${pname}";
       rev = version;
-      sha256 = "1cdb276wfyf3wcfj5g3migd6b6aqmkrxncrqjfcfx4j4k3xac965";
+      sha256 = "04zfgd3x3lbriyzwhpqnwdcfdm19fsqgsb7l2ix5d0ssmqxwg2r6";
     };
 
+    preConfigure = ''
+      # PrintTimeGenius ships with marlin-calc binaries for multiple architectures
+      rm */analyzers/marlin-calc*
+      sed 's@"{}.{}".format(binary_base_name, machine)@"${pkgs.marlin-calc}/bin/marlin-calc"@' -i */analyzers/analyze_progress.py
+    '';
+
+    patches = [
+      ./printtimegenius-logging.patch
+    ];
+
     meta = with stdenv.lib; {
-      description = "Plugin for slicing via Cura Legacy from within OctoPrint";
-      homepage = "https://github.com/OctoPrint/OctoPrint-CuraEngineLegacy";
-      license = licenses.agpl3;
-      maintainers = with maintainers; [ gebner ];
-    };
-  };
-
-  touchui = buildPlugin rec {
-    pname = "TouchUI";
-    version = "0.3.14";
-
-    src = fetchFromGitHub {
-      owner = "BillyBlaze";
-      repo = "OctoPrint-${pname}";
-      rev = version;
-      sha256 = "033b9nk3kpnmjw9nggcaxy39hcgfviykcy2cx0j6m411agvmqbzf";
-    };
-
-    meta = with stdenv.lib; {
-      description = "Touch friendly interface for a small TFT module or phone for OctoPrint";
-      homepage = "https://github.com/BillyBlaze/OctoPrint-TouchUI";
+      description = "Better print time estimation for OctoPrint";
+      homepage = "https://github.com/eyal0/OctoPrint-PrintTimeGenius";
       license = licenses.agpl3;
       maintainers = with maintainers; [ gebner ];
     };
@@ -168,81 +183,15 @@ in {
     };
   };
 
-  printtimegenius = buildPlugin rec {
-    pname = "PrintTimeGenius";
-    version = "2.2.1";
-
-    src = fetchFromGitHub {
-      owner = "eyal0";
-      repo = "OctoPrint-${pname}";
-      rev = version;
-      sha256 = "1dr93vbpxgxw3b1q4rwam8f4dmiwr5vnfr9796g6jx8xkpfzzy1h";
-    };
-
-    preConfigure = ''
-      # PrintTimeGenius ships with marlin-calc binaries for multiple architectures
-      rm */analyzers/marlin-calc*
-      sed 's@"{}.{}".format(binary_base_name, machine)@"${pkgs.marlin-calc}/bin/marlin-calc"@' -i */analyzers/analyze_progress.py
-    '';
-
-    patches = [
-      ./printtimegenius-logging.patch
-    ];
-
-    meta = with stdenv.lib; {
-      description = "Better print time estimation for OctoPrint";
-      homepage = "https://github.com/eyal0/OctoPrint-PrintTimeGenius";
-      license = licenses.agpl3;
-      maintainers = with maintainers; [ gebner ];
-    };
-  };
-
-  abl-expert = buildPlugin rec {
-    pname = "ABL_Expert";
-    version = "2019-12-21";
-
-    src = fetchgit {
-      url = "https://framagit.org/razer/Octoprint_ABL_Expert/";
-      rev = "f11fbe05088ad618bfd9d064ac3881faec223f33";
-      sha256 = "026r4prkyvwzxag5pv36455q7s3gaig37nmr2nbvhwq3d2lbi5s4";
-    };
-
-    meta = with stdenv.lib; {
-      description = "Marlin auto bed leveling control, mesh correction, and z probe handling";
-      homepage = "https://framagit.org/razer/Octoprint_ABL_Expert/";
-      license = licenses.agpl3;
-      maintainers = with maintainers; [ WhittlesJr ];
-    };
-  };
-
-  gcodeeditor = buildPlugin rec {
-    pname = "GcodeEditor";
-    version = "0.2.6";
-
-    src = fetchFromGitHub {
-      owner = "ieatacid";
-      repo = "OctoPrint-${pname}";
-      rev = version;
-      sha256 = "0c6p78r3vd6ys3kld308pyln09zjbr9yif1ljvcx6wlml2i5l1vh";
-    };
-
-    meta = with stdenv.lib; {
-      description = "Edit gcode on OctoPrint";
-      homepage = "https://github.com/ieatacid/OctoPrint-GcodeEditor";
-      license = licenses.agpl3;
-      maintainers = with maintainers; [ WhittlesJr ];
-    };
-  };
-
   simpleemergencystop = buildPlugin rec {
     pname = "SimpleEmergencyStop";
-    version = "0.2.5";
+    version = "1.0.3";
 
     src = fetchFromGitHub {
       owner = "Sebclem";
       repo = "OctoPrint-${pname}";
       rev = version;
-      sha256 = "10wadv09wv2h96igvq3byw9hz1si82n3c7v5y0ii3j7hm2d06y8p";
+      sha256 = "0hhh5grmn32abkix1b9fr1d0pcpdi2r066iypcxdxcza9qzwjiyi";
     };
 
     meta = with stdenv.lib; {
@@ -253,22 +202,79 @@ in {
     };
   };
 
-  displaylayerprogress = buildPlugin rec {
-    pname = "OctoPrint-DisplayLayerProgress";
-    version = "1.24.0";
+  stlviewer = buildPlugin rec {
+    pname = "STLViewer";
+    version = "0.4.2";
 
     src = fetchFromGitHub {
-      owner = "OllisGit";
-      repo = pname;
+      owner = "jneilliii";
+      repo = "OctoPrint-STLViewer";
       rev = version;
-      sha256 = "1lbivg3rcjzv8zqvp8n8gcaczxdm7gvd5ihjb6jq0fgf958lv59n";
+      sha256 = "0mkvh44fn2ch4z2avsdjwi1rp353ylmk9j5fln4x7rx8ph8y7g2b";
     };
 
     meta = with stdenv.lib; {
-      description = "OctoPrint-Plugin that sends the current progress of a print via M117 command";
-      homepage = "https://github.com/OllisGit/OctoPrint-DisplayLayerProgress";
+      description = "A simple stl viewer tab for OctoPrint";
+      homepage = "https://github.com/jneilliii/Octoprint-STLViewer";
       license = licenses.agpl3;
-      maintainers = with maintainers; [ j0hax ];
+      maintainers = with maintainers; [ abbradar ];
+    };
+  };
+
+  themeify = buildPlugin rec {
+    pname = "Themeify";
+    version = "1.2.2";
+
+    src = fetchFromGitHub {
+      owner = "Birkbjo";
+      repo = "Octoprint-${pname}";
+      rev = "v${version}";
+      sha256 = "0j1qs6kyh947npdy7pqda25fjkqinpas3sy0qyscqlxi558lhvx2";
+    };
+
+    meta = with stdenv.lib; {
+      description = "Beautiful themes for OctoPrint";
+      homepage = "https://github.com/birkbjo/OctoPrint-Themeify";
+      license = licenses.agpl3;
+      maintainers = with maintainers; [ lovesegfault ];
+    };
+  };
+
+  titlestatus = buildPlugin rec {
+    pname = "TitleStatus";
+    version = "0.0.5";
+
+    src = fetchFromGitHub {
+      owner = "MoonshineSG";
+      repo = "OctoPrint-TitleStatus";
+      rev = version;
+      sha256 = "10nxjrixg0i6n6x8ghc1ndshm25c97bvkcis5j9kmlkkzs36i2c6";
+    };
+
+    meta = with stdenv.lib; {
+      description = "Show printers status in window title";
+      homepage = "https://github.com/MoonshineSG/OctoPrint-TitleStatus";
+      license = licenses.agpl3;
+      maintainers = with maintainers; [ abbradar ];
+    };
+  };
+
+  touchui = buildPlugin rec {
+    pname = "TouchUI";
+    version = "0.3.16";
+
+    src = fetchFromGitHub {
+      owner = "BillyBlaze";
+      repo = "OctoPrint-${pname}";
+      rev = version;
+      sha256 = "1jlqjirc4ygl4k7jp93l2h6b18jap3mzz8sf2g61j9w0kgv9l365";
+    };
+
+    meta = with stdenv.lib; {
+      description = "Touch friendly interface for a small TFT module or phone for OctoPrint";
+      homepage = "https://github.com/BillyBlaze/OctoPrint-TouchUI";
+      license = licenses.agpl3;
+      maintainers = with maintainers; [ gebner ];
     };
   };
 
@@ -293,13 +299,13 @@ in {
 
   octoprint-dashboard = buildPlugin rec {
     pname = "OctoPrint-Dashboard";
-    version = "1.15.1";
+    version = "1.15.2";
 
     src = fetchFromGitHub {
       owner = "StefanCohen";
       repo = pname;
       rev = version;
-      sha256 = "1psk069g8xdpgbzmna51dh978vrildh33dn7kbbi5y31ry5c3gx6";
+      sha256 = "0p94jwd7kagh3sixhcrqmsgbay4aaf9l1pgyi2b45jym8pvld5n4";
     };
 
     meta = with stdenv.lib; {
diff --git a/third_party/nixpkgs/pkgs/applications/misc/wayst/default.nix b/third_party/nixpkgs/pkgs/applications/misc/wayst/default.nix
new file mode 100644
index 0000000000..99ee326aeb
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/applications/misc/wayst/default.nix
@@ -0,0 +1,91 @@
+{ stdenv
+, lib
+, fetchFromGitHub
+, pkgconfig
+, freetype
+, fontconfig
+, libGL
+, libX11
+, libXrandr
+, libxcb
+, libxkbcommon
+, utf8proc
+, wayland
+
+, libnotify
+, xdg_utils
+, makeDesktopItem
+}:
+
+let
+  desktopItem = makeDesktopItem {
+    desktopName = "Wayst";
+    name = "wayst";
+    exec = "wayst";
+    icon = "wayst";
+    terminal = "false";
+    categories = "System;TerminalEmulator";
+    comment = "A simple terminal emulator";
+    extraEntries = ''
+      GenericName=Terminal
+      Keywords=wayst;terminal;
+    '';
+  };
+in
+stdenv.mkDerivation rec {
+  pname = "wayst";
+  version = "unstable-2020-10-12";
+
+  src = fetchFromGitHub {
+    owner = "91861";
+    repo = pname;
+    rev = "b8c7ca00a785a748026ed1ba08bf3d19916ced18";
+    hash = "sha256-wHAU1yxukxApzhLLLctZ/AYqF7t21HQc5omPBZyxra0=";
+  };
+
+  makeFlags = [ "INSTALL_DIR=\${out}/bin" ];
+
+  nativeBuildInputs = [ pkgconfig ];
+
+  buildInputs = [
+    fontconfig
+    libX11
+    freetype
+    libGL
+    libxcb
+    libxkbcommon
+    libXrandr
+    utf8proc
+    wayland
+  ];
+
+  # This patch forces the Makefile to use utf8proc
+  # The makefile relies on ldconfig to find the utf8proc libraries
+  # which is not possible on nixpkgs
+  patches = [ ./utf8proc.patch ];
+
+  postPatch = ''
+    substituteInPlace src/settings.c \
+      --replace xdg-open ${xdg_utils}/bin/xdg-open
+    substituteInPlace src/main.c \
+      --replace notify-send ${libnotify}/bin/notify-send
+  '';
+
+  preInstall = ''
+    mkdir -p $out/bin
+  '';
+
+  postInstall = ''
+    mkdir -p $out/share/applications
+    ln -s ${desktopItem}/share/applications/* $out/share/applications
+    install -D icons/wayst.svg $out/share/icons/hicolor/scalable/apps/wayst.svg
+  '';
+
+  meta = with lib; {
+    description = "A simple terminal emulator";
+    homepage = "https://github.com/91861/wayst";
+    license = licenses.mit;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ berbiche ];
+  };
+}
diff --git a/third_party/nixpkgs/pkgs/applications/misc/wayst/utf8proc.patch b/third_party/nixpkgs/pkgs/applications/misc/wayst/utf8proc.patch
new file mode 100644
index 0000000000..0923c5dbe1
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/applications/misc/wayst/utf8proc.patch
@@ -0,0 +1,24 @@
+commit caa5a6bed31937f2d1b322da204e11eae57a720f
+Author: Nicolas Berbiche <nicolas@normie.dev>
+Date:   Tue Oct 20 18:14:44 2020 -0400
+
+    PATCH: use nixpkgs utf8proc
+    
+    This patch forces the Makefile to use utf8proc from `buildInputs`.
+    The Makefile relies on ldconfig to find the utf8proc libraries,
+    which is not possible with nixpkgs.
+
+diff --git a/Makefile b/Makefile
+index caccdf7..90b11ea 100644
+--- a/Makefile
++++ b/Makefile
+@@ -29,7 +29,7 @@ else
+ 	LDFLAGS = -O2 -flto
+ endif
+ 
+-ifeq ($(shell ldconfig -p | grep libutf8proc.so > /dev/null || echo fail),fail)
++ifeq (false,fail)
+ $(info libutf8proc not found. Support for language-specific combining characters and unicode normalization will be disabled.)
+ 	CFLAGS += -DNOUTF8PROC
+ else
+
diff --git a/third_party/nixpkgs/pkgs/applications/networking/browsers/chromium/common.nix b/third_party/nixpkgs/pkgs/applications/networking/browsers/chromium/common.nix
index ed5a8a7155..4341a41914 100644
--- a/third_party/nixpkgs/pkgs/applications/networking/browsers/chromium/common.nix
+++ b/third_party/nixpkgs/pkgs/applications/networking/browsers/chromium/common.nix
@@ -319,15 +319,8 @@ let
     NIX_CFLAGS_COMPILE = "-Wno-unknown-warning-option";
 
     buildPhase = let
-      # Build paralelism: on Hydra the build was frequently running into memory
-      # exhaustion, and even other users might be running into similar issues.
-      # -j is halved to avoid memory problems, and -l is slightly increased
-      # so that the build gets slight preference before others
-      # (it will often be on "critical path" and at risk of timing out)
       buildCommand = target: ''
-        ninja -C "${buildPath}"  \
-          -j$(( ($NIX_BUILD_CORES+1) / 2 )) -l$(( $NIX_BUILD_CORES+1 )) \
-          "${target}"
+        ninja -C "${buildPath}" -j$NIX_BUILD_CORES -l$NIX_BUILD_CORES "${target}"
         (
           source chrome/installer/linux/common/installer.include
           PACKAGE=$packageName
diff --git a/third_party/nixpkgs/pkgs/applications/networking/browsers/ungoogled-chromium/common.nix b/third_party/nixpkgs/pkgs/applications/networking/browsers/ungoogled-chromium/common.nix
index 421d6bb745..3df8fb3afd 100644
--- a/third_party/nixpkgs/pkgs/applications/networking/browsers/ungoogled-chromium/common.nix
+++ b/third_party/nixpkgs/pkgs/applications/networking/browsers/ungoogled-chromium/common.nix
@@ -352,15 +352,8 @@ let
     NIX_CFLAGS_COMPILE = "-Wno-unknown-warning-option";
 
     buildPhase = let
-      # Build paralelism: on Hydra the build was frequently running into memory
-      # exhaustion, and even other users might be running into similar issues.
-      # -j is halved to avoid memory problems, and -l is slightly increased
-      # so that the build gets slight preference before others
-      # (it will often be on "critical path" and at risk of timing out)
       buildCommand = target: ''
-        ninja -C "${buildPath}"  \
-          -j$(( ($NIX_BUILD_CORES+1) / 2 )) -l$(( $NIX_BUILD_CORES+1 )) \
-          "${target}"
+        ninja -C "${buildPath}" -j$NIX_BUILD_CORES -l$NIX_BUILD_CORES "${target}"
         (
           source chrome/installer/linux/common/installer.include
           PACKAGE=$packageName
diff --git a/third_party/nixpkgs/pkgs/applications/radio/gqrx/default.nix b/third_party/nixpkgs/pkgs/applications/radio/gqrx/default.nix
index 33b858799e..413424a5b8 100644
--- a/third_party/nixpkgs/pkgs/applications/radio/gqrx/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/radio/gqrx/default.nix
@@ -9,13 +9,13 @@ assert pulseaudioSupport -> libpulseaudio != null;
 
 mkDerivation rec {
   pname = "gqrx";
-  version = "2.12.1";
+  version = "2.13";
 
   src = fetchFromGitHub {
     owner = "csete";
     repo = "gqrx";
     rev = "v${version}";
-    sha256 = "00alf3q6y313xpx6p7v43vqsphd2x4am4q362lw21bcy9wc4jidw";
+    sha256 = "034y8w2cwv35ibqnqb9bdgscsrcp6rr02fgscbfi3gky3n0qddcy";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/third_party/nixpkgs/pkgs/applications/science/chemistry/openmolcas/default.nix b/third_party/nixpkgs/pkgs/applications/science/chemistry/openmolcas/default.nix
index 0d74e784d7..8bc62da3a3 100644
--- a/third_party/nixpkgs/pkgs/applications/science/chemistry/openmolcas/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/science/chemistry/openmolcas/default.nix
@@ -7,7 +7,7 @@
 assert blas.implementation == "openblas" && lapack.implementation == "openblas";
 
 let
-  version = "19.11";
+  version = "20.10";
   gitLabRev = "v${version}";
 
   python = python3.withPackages (ps : with ps; [ six pyparsing ]);
@@ -20,18 +20,13 @@ in stdenv.mkDerivation {
     owner = "Molcas";
     repo = "OpenMolcas";
     rev = gitLabRev;
-    sha256 = "1wwqhkyyi7pw5x1ghnp83ir17zl5jsj7phhqxapybyi3bmg0i00q";
+    sha256 = "1w8av44dx5r9yp2xhf9ypdrhappvk984wrd5pa1ww0qv6j2446ic";
   };
 
-  patches = [ (fetchpatch {
-    name = "Fix-MPI-INT-size"; # upstream patch, fixes a Fortran compiler error
-    url = "https://gitlab.com/Molcas/OpenMolcas/commit/860e3350523f05ab18e49a428febac8a4297b6e4.patch";
-    sha256 = "0h96h5ikbi5l6ky41nkxmxfhjiykkiifq7vc2s3fdy1r1siv09sb";
-  }) (fetchpatch {
-    name = "fix-cisandbox"; # upstream patch, fixes a Fortran compiler error
-    url = "https://gitlab.com/Molcas/OpenMolcas/commit/d871590c8ce4689cd94cdbbc618954c65589393d.patch";
-    sha256 = "0dgz1w2rkglnis76spai3m51qa72j4bz6ppnk5zmzrr6ql7gwpgg";
-  })];
+  patches = [
+    # Required to handle openblas multiple outputs
+    ./openblasPath.patch
+];
 
   nativeBuildInputs = [ perl cmake texlive.combined.scheme-minimal makeWrapper ];
   buildInputs = [
@@ -55,7 +50,7 @@ in stdenv.mkDerivation {
     "-DTOOLS=ON"
     "-DHDF5=ON"
     "-DFDE=ON"
-    "-DOPENBLASROOT=${openblas}"
+    "-DOPENBLASROOT=${openblas.dev}"
   ];
 
   GAROOT=globalarrays;
diff --git a/third_party/nixpkgs/pkgs/applications/science/chemistry/openmolcas/openblasPath.patch b/third_party/nixpkgs/pkgs/applications/science/chemistry/openmolcas/openblasPath.patch
new file mode 100644
index 0000000000..e47adcc3e9
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/applications/science/chemistry/openmolcas/openblasPath.patch
@@ -0,0 +1,12 @@
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index 276ae4e2..db13e6e3 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -1507,7 +1507,6 @@ if (LINALG STREQUAL "OpenBLAS")
+     NAMES openblas
+     PATHS ${OPENBLASROOT}
+     PATH_SUFFIXES lib
+-    NO_DEFAULT_PATH
+   )
+ 
+   if (NOT LIBOPENBLAS)
diff --git a/third_party/nixpkgs/pkgs/applications/science/logic/coq/default.nix b/third_party/nixpkgs/pkgs/applications/science/logic/coq/default.nix
index 946cba41b1..9b7e007ce5 100644
--- a/third_party/nixpkgs/pkgs/applications/science/logic/coq/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/science/logic/coq/default.nix
@@ -109,7 +109,7 @@ self = stdenv.mkDerivation {
   nativeBuildInputs = [ pkgconfig ]
   ++ stdenv.lib.optional (!versionAtLeast "8.6") gnumake42
   ;
-  buildInputs = [ ncurses ocamlPackages.ocaml ocamlPackages.findlib ]
+  buildInputs = [ ncurses ]
   ++ stdenv.lib.optional (!versionAtLeast "8.10") ocamlPackages.camlp5
   ++ stdenv.lib.optional (!versionAtLeast "8.12") ocamlPackages.num
   ++ stdenv.lib.optionals buildIde
@@ -117,7 +117,10 @@ self = stdenv.mkDerivation {
      then [ ocamlPackages.lablgtk3-sourceview3 glib gnome3.defaultIconTheme wrapGAppsHook ]
      else [ ocamlPackages.lablgtk ]);
 
-  propagatedBuildInputs = stdenv.lib.optional (versionAtLeast "8.12") ocamlPackages.num;
+  propagatedBuildInputs = [ ocamlPackages.ocaml ocamlPackages.findlib ]
+    ++ stdenv.lib.optional (versionAtLeast "8.12") ocamlPackages.num;
+
+  propagatedUserEnvPkgs = [ ocamlPackages.ocaml ocamlPackages.findlib ];
 
   postPatch = ''
     UNAME=$(type -tp uname)
diff --git a/third_party/nixpkgs/pkgs/applications/version-management/git-and-tools/default.nix b/third_party/nixpkgs/pkgs/applications/version-management/git-and-tools/default.nix
index e5d2f9f85d..bb317b83c8 100644
--- a/third_party/nixpkgs/pkgs/applications/version-management/git-and-tools/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/version-management/git-and-tools/default.nix
@@ -34,6 +34,8 @@ let
 
   gh = callPackage ./gh { };
 
+  ghorg = callPackage ./ghorg { };
+
   ghq = callPackage ./ghq { };
 
   git = appendToName "minimal" gitBase;
diff --git a/third_party/nixpkgs/pkgs/applications/version-management/git-and-tools/ghorg/default.nix b/third_party/nixpkgs/pkgs/applications/version-management/git-and-tools/ghorg/default.nix
new file mode 100644
index 0000000000..fc2e660fa7
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/applications/version-management/git-and-tools/ghorg/default.nix
@@ -0,0 +1,37 @@
+{ stdenv, buildGoModule, fetchFromGitHub }:
+
+buildGoModule rec {
+  pname = "ghorg";
+  version = "1.4.0";
+
+  src = fetchFromGitHub {
+    owner = "gabrie30";
+    repo = "ghorg";
+    rev = "${version}";
+    sha256 = "0diwndkckv6fga45j9zngizycn5m71r67cziv0zrx6c66ssbj49w";
+  };
+
+  doCheck = false;
+  vendorSha256 = null;
+
+  subPackages = [ "." ];
+
+  buildFlagsArray = [ "-ldflags=-s -w -X main.version=${version}" ];
+
+  meta = with stdenv.lib; {
+    description = "Quickly clone an entire org/users repositories into one directory";
+    longDescription = ''
+      ghorg allows you to quickly clone all of an orgs, or users repos into a
+      single directory. This can be useful in many situations including
+      - Searching an orgs/users codebase with ack, silver searcher, grep etc..
+      - Bash scripting
+      - Creating backups
+      - Onboarding
+      - Performing Audits
+    '';
+    homepage = "https://github.com/gabrie30/ghorg";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ vidbina ];
+    platforms = platforms.all;
+  };
+}
diff --git a/third_party/nixpkgs/pkgs/applications/virtualization/qemu/default.nix b/third_party/nixpkgs/pkgs/applications/virtualization/qemu/default.nix
index 535f837115..3c86720579 100644
--- a/third_party/nixpkgs/pkgs/applications/virtualization/qemu/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/virtualization/qemu/default.nix
@@ -1,17 +1,19 @@
 { stdenv, fetchurl, fetchpatch, python, zlib, pkgconfig, glib
-, ncurses, perl, pixman, vde2, alsaLib, texinfo, flex
+, perl, pixman, vde2, alsaLib, texinfo, flex
 , bison, lzo, snappy, libaio, gnutls, nettle, curl
 , makeWrapper
 , attr, libcap, libcap_ng
 , CoreServices, Cocoa, Hypervisor, rez, setfile
 , numaSupport ? stdenv.isLinux && !stdenv.isAarch32, numactl
 , seccompSupport ? stdenv.isLinux, libseccomp
-, pulseSupport ? !stdenv.isDarwin, libpulseaudio
-, sdlSupport ? !stdenv.isDarwin, SDL2
-, gtkSupport ? !stdenv.isDarwin && !xenSupport, gtk3, gettext, vte, wrapGAppsHook
-, vncSupport ? true, libjpeg, libpng
-, smartcardSupport ? true, libcacard
-, spiceSupport ? !stdenv.isDarwin, spice, spice-protocol
+, alsaSupport ? stdenv.lib.hasSuffix "linux" stdenv.hostPlatform.system && !nixosTestRunner
+, pulseSupport ? !stdenv.isDarwin && !nixosTestRunner, libpulseaudio
+, sdlSupport ? !stdenv.isDarwin && !nixosTestRunner, SDL2
+, gtkSupport ? !stdenv.isDarwin && !xenSupport && !nixosTestRunner, gtk3, gettext, vte, wrapGAppsHook
+, vncSupport ? !nixosTestRunner, libjpeg, libpng
+, smartcardSupport ? !nixosTestRunner, libcacard
+, spiceSupport ? !stdenv.isDarwin && !nixosTestRunner, spice, spice-protocol
+, ncursesSupport ? !nixosTestRunner, ncurses
 , usbredirSupport ? spiceSupport, usbredir
 , xenSupport ? false, xen
 , cephSupport ? false, ceph
@@ -29,7 +31,7 @@
 
 with stdenv.lib;
 let
-  audio = optionalString (hasSuffix "linux" stdenv.hostPlatform.system) "alsa,"
+  audio = optionalString alsaSupport "alsa,"
     + optionalString pulseSupport "pa,"
     + optionalString sdlSupport "sdl,";
 
@@ -50,10 +52,11 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ python python.pkgs.sphinx pkgconfig flex bison ]
     ++ optionals gtkSupport [ wrapGAppsHook ];
   buildInputs =
-    [ zlib glib ncurses perl pixman
+    [ zlib glib perl pixman
       vde2 texinfo makeWrapper lzo snappy
       gnutls nettle curl
     ]
+    ++ optionals ncursesSupport [ ncurses ]
     ++ optionals stdenv.isDarwin [ CoreServices Cocoa Hypervisor rez setfile ]
     ++ optionals seccompSupport [ libseccomp ]
     ++ optionals numaSupport [ numactl ]
diff --git a/third_party/nixpkgs/pkgs/data/themes/numix-solarized/default.nix b/third_party/nixpkgs/pkgs/data/themes/numix-solarized/default.nix
index ae8a1d7145..356f7d33b2 100644
--- a/third_party/nixpkgs/pkgs/data/themes/numix-solarized/default.nix
+++ b/third_party/nixpkgs/pkgs/data/themes/numix-solarized/default.nix
@@ -1,33 +1,29 @@
-{ stdenv, fetchFromGitHub, python3, sass, glib, gdk-pixbuf, libxml2,
-  inkscape, optipng, gtk-engine-murrine
-}:
+{ stdenv, fetchFromGitHub, python3, sassc, glib, gdk-pixbuf, inkscape, gtk-engine-murrine }:
 
 stdenv.mkDerivation rec {
-  version = "20180913";
+  version = "20200910";
   pname = "numix-solarized-gtk-theme";
 
   src = fetchFromGitHub {
     owner = "Ferdi265";
     repo = "numix-solarized-gtk-theme";
     rev = version;
-    sha256 = "1kda0lyqi3cxh163fbj8yyi6jj6pf0y980k4s0cmyi3hkh4cqyd5";
+    sha256 = "05h1563sy6sfz76jadxsf730mav6bbjsk9xnadv49r16b8n8p9a9";
   };
 
-  nativeBuildInputs = [ python3 sass glib gdk-pixbuf libxml2 inkscape optipng ];
+  nativeBuildInputs = [ python3 sassc glib gdk-pixbuf inkscape ];
 
   propagatedUserEnvPkgs = [ gtk-engine-murrine ];
 
   postPatch = ''
     patchShebangs .
     substituteInPlace Makefile --replace '$(DESTDIR)'/usr $out
-    substituteInPlace scripts/render-assets.sh \
-      --replace /usr/bin/inkscape ${inkscape}/bin/inkscape \
-      --replace /usr/bin/optipng ${optipng}/bin/optipng
   '';
 
   buildPhase = "true";
 
   installPhase = ''
+    HOME="$NIX_BUILD_ROOT"  # shut up inkscape's warnings
     for theme in *.colors; do
       make THEME="''${theme/.colors/}" install
     done
diff --git a/third_party/nixpkgs/pkgs/development/libraries/cairo/default.nix b/third_party/nixpkgs/pkgs/development/libraries/cairo/default.nix
index a414191ac0..3a7c63165b 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/cairo/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/cairo/default.nix
@@ -35,6 +35,9 @@ in stdenv.mkDerivation rec {
       url    = "https://gitlab.freedesktop.org/cairo/cairo/commit/6edf572ebb27b00d3c371ba5ae267e39d27d5b6d.patch";
       sha256 = "112hgrrsmcwxh1r52brhi5lksq4pvrz4xhkzcf2iqp55jl2pb7n1";
     })
+  ] ++ optionals stdenv.hostPlatform.isDarwin [
+    # Workaround https://gitlab.freedesktop.org/cairo/cairo/-/issues/121
+    ./skip-configure-stderr-check.patch
   ];
 
   outputs = [ "out" "dev" "devdoc" ];
diff --git a/third_party/nixpkgs/pkgs/development/libraries/cairo/skip-configure-stderr-check.patch b/third_party/nixpkgs/pkgs/development/libraries/cairo/skip-configure-stderr-check.patch
new file mode 100644
index 0000000000..6deecf2a97
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/development/libraries/cairo/skip-configure-stderr-check.patch
@@ -0,0 +1,89 @@
+https://bugs.freedesktop.org/show_bug.cgi?id=30910#c6
+
+Comment 6 Jeremy Huddleston Sequoia 2014-07-15 04:12:40 UTC
+
+Yes, it is still an issue.  We just disable the buggy '"x$cairo_cc_stderr" != "x"' logic, but that's not really a portable solution for you:
+
+diff -Naurp cairo-1.12.2.orig/configure cairo-1.12.2/configure
+--- cairo-1.12.2.orig/configure	2012-04-29 11:49:59.000000000 -0700
++++ cairo-1.12.2/configure	2012-05-03 11:23:49.000000000 -0700
+@@ -18044,7 +18044,7 @@ fi
+ rm -f core conftest.err conftest.$ac_objext \
+     conftest$ac_exeext conftest.$ac_ext
+ 
+-	if test "x$cairo_cc_stderr" != "x"; then
++	if false; then
+ 		cairo_cc_flag=no
+ 	fi
+ 
+@@ -18091,7 +18091,7 @@ fi
+ rm -f core conftest.err conftest.$ac_objext \
+     conftest$ac_exeext conftest.$ac_ext
+ 
+-	if test "x$cairo_cc_stderr" != "x"; then
++	if false; then
+ 		cairo_cc_flag=no
+ 	fi
+ 
+@@ -18161,7 +18161,7 @@ fi
+ rm -f core conftest.err conftest.$ac_objext \
+     conftest$ac_exeext conftest.$ac_ext
+ 
+-	if test "x$cairo_cc_stderr" != "x"; then
++	if false; then
+ 		cairo_cc_flag=no
+ 	fi
+ 
+@@ -18217,7 +18217,7 @@ fi
+ rm -f core conftest.err conftest.$ac_objext \
+     conftest$ac_exeext conftest.$ac_ext
+ 
+-	if test "x$cairo_cc_stderr" != "x"; then
++	if false; then
+ 		cairo_cc_flag=no
+ 	fi
+ 
+@@ -19663,7 +19663,7 @@ fi
+ rm -f core conftest.err conftest.$ac_objext \
+     conftest$ac_exeext conftest.$ac_ext
+ 
+-	if test "x$cairo_cc_stderr" != "x"; then
++	if false; then
+ 		cairo_cc_flag=no
+ 	fi
+ 
+@@ -19710,7 +19710,7 @@ fi
+ rm -f core conftest.err conftest.$ac_objext \
+     conftest$ac_exeext conftest.$ac_ext
+ 
+-	if test "x$cairo_cc_stderr" != "x"; then
++	if false; then
+ 		cairo_cc_flag=no
+ 	fi
+ 
+@@ -32692,7 +32692,7 @@ fi
+ rm -f core conftest.err conftest.$ac_objext \
+     conftest$ac_exeext conftest.$ac_ext
+ 
+-	if test "x$cairo_cc_stderr" != "x"; then
++	if false; then
+ 		cairo_cc_flag=no
+ 	fi
+ 
+@@ -32811,7 +32811,7 @@ fi
+ rm -f core conftest.err conftest.$ac_objext \
+     conftest$ac_exeext conftest.$ac_ext
+ 
+-	if test "x$cairo_cc_stderr" != "x"; then
++	if false ; then
+ 		cairo_cc_flag=no
+ 	fi
+ 
+@@ -32892,7 +32892,7 @@ fi
+ rm -f core conftest.err conftest.$ac_objext \
+     conftest$ac_exeext conftest.$ac_ext
+ 
+-	if test "x$cairo_cc_stderr" != "x"; then
++	if false; then
+ 		cairo_cc_flag=no
+ 	fi
diff --git a/third_party/nixpkgs/pkgs/development/libraries/libndctl/default.nix b/third_party/nixpkgs/pkgs/development/libraries/libndctl/default.nix
index 7c4c49baff..be5c75806d 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/libndctl/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/libndctl/default.nix
@@ -1,6 +1,6 @@
 { stdenv, fetchFromGitHub, autoreconfHook
 , asciidoctor, pkgconfig, xmlto, docbook_xsl, docbook_xml_dtd_45, libxslt
-, json_c, kmod, which, utillinux, systemd, keyutils
+, json_c, kmod, which, utillinux, udev, keyutils
 }:
 
 stdenv.mkDerivation rec {
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
     ];
 
   buildInputs =
-    [ json_c kmod utillinux systemd keyutils
+    [ json_c kmod utillinux udev keyutils
     ];
 
   configureFlags =
diff --git a/third_party/nixpkgs/pkgs/development/ocaml-modules/janestreet/0.13.nix b/third_party/nixpkgs/pkgs/development/ocaml-modules/janestreet/0.13.nix
index b92027a65a..009fa99048 100644
--- a/third_party/nixpkgs/pkgs/development/ocaml-modules/janestreet/0.13.nix
+++ b/third_party/nixpkgs/pkgs/development/ocaml-modules/janestreet/0.13.nix
@@ -392,6 +392,13 @@ rec {
     propagatedBuildInputs = [ async ];
   };
 
+  async_interactive = janePackage {
+    pname = "async_interactive";
+    hash = "1ma24pi3hqzrs1k12sc0aarhf42fap8nl1h7id6k01wp6s3yqi5d";
+    meta.description = "Utilities for building simple command-line based user interfaces";
+    propagatedBuildInputs = [ async ];
+  };
+
   re2 = janePackage {
     pname = "re2";
     hash = "0hmizznlzilynn5kh6149bbpkfw2l0xi7zi1y1fxfww2ma3wpim0";
diff --git a/third_party/nixpkgs/pkgs/development/ocaml-modules/opium_kernel/default.nix b/third_party/nixpkgs/pkgs/development/ocaml-modules/opium_kernel/default.nix
index 8388e108fe..c7bfe1e730 100644
--- a/third_party/nixpkgs/pkgs/development/ocaml-modules/opium_kernel/default.nix
+++ b/third_party/nixpkgs/pkgs/development/ocaml-modules/opium_kernel/default.nix
@@ -1,6 +1,6 @@
 { lib
 , buildDunePackage
-, fetchFromGitHub
+, fetchurl
 
 , ppx_fields_conv
 , ppx_sexp_conv
@@ -8,35 +8,36 @@
 , cohttp-lwt
 , ezjsonm
 , hmap
+, sexplib
 }:
 
 buildDunePackage rec {
-	pname = "opium_kernel";
-  version = "0.17.1";
+  pname = "opium_kernel";
+  version = "0.18.0";
+
+  useDune2 = true;
 
   minimumOCamlVersion = "4.04.1";
-  
-	src = fetchFromGitHub {
-		owner = "rgrinberg";
-		repo = "opium";
-		rev = "v${version}";
-		sha256 = "03xzh0ik6k3c0yn1w1avph667vdagwclzimwwrlf9qdxnzxvcnp3";
-	};
+
+  src = fetchurl {
+    url = "https://github.com/rgrinberg/opium/releases/download/${version}/opium-${version}.tbz";
+    sha256 = "0a2y9gw55psqhqli3a5ps9mfdab8r46fnbj882r2sp366sfcy37q";
+  };
 
   doCheck = true;
 
-	buildInputs = [
+  buildInputs = [
     ppx_sexp_conv ppx_fields_conv
   ];
 
-	propagatedBuildInputs = [
-    hmap cohttp-lwt ezjsonm
+  propagatedBuildInputs = [
+    hmap cohttp-lwt ezjsonm sexplib
   ];
 
   meta = {
-		description = "Sinatra like web toolkit for OCaml based on cohttp & lwt";
+    description = "Sinatra like web toolkit for OCaml based on cohttp & lwt";
     homepage = "https://github.com/rgrinberg/opium";
-		license = lib.licenses.mit;
-		maintainers = [ lib.maintainers.pmahoney ];
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.pmahoney ];
   };
 }
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/block-io/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/block-io/default.nix
index ec1229965e..07d6cffe56 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/block-io/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/block-io/default.nix
@@ -20,13 +20,16 @@ buildPythonPackage rec {
 
   preConfigure = ''
     substituteInPlace setup.py \
-      --replace "ecdsa==0.13" "ecdsa>=0.13"
+      --replace "ecdsa==0.13" "ecdsa>=0.13" \
+      --replace "base58==1.0.3" "base58>=1.0.3"
   '';
 
   # Tests needs a BlockIO API key to run properly
   # https://github.com/BlockIo/block_io-python/blob/79006bc8974544b70a2d8e9f19c759941d32648e/test.py#L18
   doCheck = false;
 
+  pythonImportsCheck = [ "block_io" ];
+
   meta = with stdenv.lib; {
     description = "Integrate Bitcoin, Dogecoin and Litecoin in your Python applications using block.io";
     homepage = "https://github.com/BlockIo/block_io-python";
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/yamale/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/yamale/default.nix
new file mode 100644
index 0000000000..d6fb713185
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/development/python-modules/yamale/default.nix
@@ -0,0 +1,38 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, isPy3k
+, pytest
+, pyyaml
+, ruamel_yaml
+}:
+
+buildPythonPackage rec {
+  pname = "yamale";
+  version = "3.0.4";
+
+  disabled = !isPy3k;
+
+  src = fetchFromGitHub {
+    owner = "23andMe";
+    repo = pname;
+    rev = version;
+    sha256 = "1xjvah4r3gpwk4zxql3c9jpllb34k175fm6iq1zvsd2vv2fwf8s2";
+  };
+
+  propagatedBuildInputs = [
+    pyyaml
+    ruamel_yaml
+  ];
+
+  checkInputs = [
+    pytest
+  ];
+
+  meta = with lib; {
+    description = "A schema and validator for YAML.";
+    homepage = "https://github.com/23andMe/Yamale";
+    license = licenses.mit;
+    maintainers = with maintainers; [ rtburns-jpl ];
+  };
+}
diff --git a/third_party/nixpkgs/pkgs/development/tools/misc/editorconfig-checker/default.nix b/third_party/nixpkgs/pkgs/development/tools/misc/editorconfig-checker/default.nix
index 3975ad3511..741854a507 100644
--- a/third_party/nixpkgs/pkgs/development/tools/misc/editorconfig-checker/default.nix
+++ b/third_party/nixpkgs/pkgs/development/tools/misc/editorconfig-checker/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "editorconfig-checker";
-  version = "2.1.0";
+  version = "2.2.0";
 
   src = fetchFromGitHub {
     owner = "editorconfig-checker";
     repo = "editorconfig-checker";
     rev = "${version}";
-    sha256 = "09v8gqwcaay3bqbidparmg20dy0mvlrzh34591hanbrx3cwhrz3f";
+    sha256 = "18gz94h2x1z6g6r7v9cdixkbcaigd7cl08af6smlkaa89j0aki32";
   };
 
-  vendorSha256 = "132blcdw3lywxhqslkcpwwvkzl4cpbbkhb7ba8mrvfgl5kvfm1q0";
+  vendorSha256 = "1z4j8vm9mnhjhhmhlj0ycs8b1wpm7lhsfqjnk7w8gfapvj3yfk6h";
 
   doCheck = false;
 
diff --git a/third_party/nixpkgs/pkgs/development/web/nodejs/v15.nix b/third_party/nixpkgs/pkgs/development/web/nodejs/v15.nix
new file mode 100644
index 0000000000..97a7ad3223
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/development/web/nodejs/v15.nix
@@ -0,0 +1,13 @@
+{ callPackage, openssl, python3, enableNpm ? true }:
+
+let
+  buildNodejs = callPackage ./nodejs.nix {
+    inherit openssl;
+    python = python3;
+  };
+in
+  buildNodejs {
+    inherit enableNpm;
+    version = "15.0.0";
+    sha256 = "0yrlzxrqb5j0qyj4qgzfxyvvd7c76hpslkiswj3cjcq70qbql4zn";
+  }
diff --git a/third_party/nixpkgs/pkgs/games/minecraft/default.nix b/third_party/nixpkgs/pkgs/games/minecraft/default.nix
index 9bdf979d7d..8052b11fb6 100644
--- a/third_party/nixpkgs/pkgs/games/minecraft/default.nix
+++ b/third_party/nixpkgs/pkgs/games/minecraft/default.nix
@@ -86,11 +86,11 @@ in
 stdenv.mkDerivation rec {
   pname = "minecraft-launcher";
 
-  version = "2.1.17627";
+  version = "2.1.17785";
 
   src = fetchurl {
     url = "https://launcher.mojang.com/download/linux/x86_64/minecraft-launcher_${version}.tar.gz";
-    sha256 = "04zjjyy0psfxfibzbac9w0kkgqwfpf1qmbj5gspyvhaib7k8may0";
+    sha256 = "1r70myf6hqcnkd6v2m2r8cpj060vsjdyp4rfw6d93vwsyqi90jkc";
   };
 
   icon = fetchurl {
diff --git a/third_party/nixpkgs/pkgs/misc/jackaudio/default.nix b/third_party/nixpkgs/pkgs/misc/jackaudio/default.nix
index d500756076..556bb6a740 100644
--- a/third_party/nixpkgs/pkgs/misc/jackaudio/default.nix
+++ b/third_party/nixpkgs/pkgs/misc/jackaudio/default.nix
@@ -27,13 +27,13 @@ let
 in
 stdenv.mkDerivation rec {
   name = "${prefix}jack2-${version}";
-  version = "1.9.14";
+  version = "1.9.16";
 
   src = fetchFromGitHub {
     owner = "jackaudio";
     repo = "jack2";
     rev = "v${version}";
-    sha256 = "1prxg1l8wrxfp2mh7l4mvjvmml6816fciq1la88ylhwm1qnfvnax";
+    sha256 = "0pzgrjy5fi2nif2j442fs3j2bbshxpnmq9kzwcqz54wx1w8fzdfr";
   };
 
   nativeBuildInputs = [ pkgconfig python makeWrapper wafHook ];
diff --git a/third_party/nixpkgs/pkgs/os-specific/linux/iputils/default.nix b/third_party/nixpkgs/pkgs/os-specific/linux/iputils/default.nix
index e12c44888a..3bb653ebcf 100644
--- a/third_party/nixpkgs/pkgs/os-specific/linux/iputils/default.nix
+++ b/third_party/nixpkgs/pkgs/os-specific/linux/iputils/default.nix
@@ -1,6 +1,6 @@
-{ stdenv, fetchFromGitHub
+{ stdenv, fetchFromGitHub, fetchpatch
 , meson, ninja, pkgconfig, gettext, libxslt, docbook_xsl_ns
-, libcap, systemd, libidn2
+, libcap, libidn2
 }:
 
 with stdenv.lib;
@@ -22,18 +22,27 @@ in stdenv.mkDerivation rec {
     sha256 = "1jhbcz75a4ij1myyyi110ma1d8d5hpm3scz9pyw7js6qym50xvh4";
   };
 
+  patches = [
+    # Proposed upstream patch to reduce dependency on systemd: https://github.com/iputils/iputils/pull/297
+    (fetchpatch {
+      url = "https://github.com/iputils/iputils/commit/13d6aefd57fd471ecad06e19073dcc44608dff5e.patch";
+      sha256 = "1n62zxmzp7hgz9qapbbpqv3fxqvc3qyd2a73jhp357x6by84kj49";
+    })
+  ];
+
   mesonFlags = [
     "-DBUILD_RARPD=true"
     "-DBUILD_TRACEROUTE6=true"
     "-DBUILD_TFTPD=true"
     "-DNO_SETCAP_OR_SUID=true"
     "-Dsystemdunitdir=etc/systemd/system"
+    "-DINSTALL_SYSTEMD_UNITS=true"
   ]
     # Disable idn usage w/musl (https://github.com/iputils/iputils/pull/111):
     ++ optional stdenv.hostPlatform.isMusl "-DUSE_IDN=false";
 
   nativeBuildInputs = [ meson ninja pkgconfig gettext libxslt.bin docbook_xsl_ns ];
-  buildInputs = [ libcap systemd ]
+  buildInputs = [ libcap ]
     ++ optional (!stdenv.hostPlatform.isMusl) libidn2;
 
   meta = {
diff --git a/third_party/nixpkgs/pkgs/tools/backup/restic/default.nix b/third_party/nixpkgs/pkgs/tools/backup/restic/default.nix
index 33cac4ad22..6839b47a5f 100644
--- a/third_party/nixpkgs/pkgs/tools/backup/restic/default.nix
+++ b/third_party/nixpkgs/pkgs/tools/backup/restic/default.nix
@@ -1,25 +1,29 @@
-{ stdenv, lib, buildGoPackage, fetchFromGitHub, installShellFiles, makeWrapper
+{ stdenv, lib, buildGoModule, fetchFromGitHub, installShellFiles, makeWrapper
 , nixosTests, rclone }:
 
-buildGoPackage rec {
+buildGoModule rec {
   pname = "restic";
-  version = "0.9.6";
-
-  goPackagePath = "github.com/restic/restic";
+  version = "0.10.0";
 
   src = fetchFromGitHub {
     owner = "restic";
     repo = "restic";
     rev = "v${version}";
-    sha256 = "0lydll93n1lcn1fl669b9cikmzz9d6vfpc8ky3ng5fi8kj3v1dz7";
+    sha256 = "0nrh52cjymzcf093sqqa3kfw2nimnx6qwn8aw0wsci2v2r84yzzx";
   };
 
+  vendorSha256 = "1pfixq3mbfn12gyablc4g0j8r00md3887q0l8xgxy76z0d8w924s";
+
   subPackages = [ "cmd/restic" ];
 
   nativeBuildInputs = [ installShellFiles makeWrapper ];
 
   passthru.tests.restic = nixosTests.restic;
 
+  postPatch = ''
+    rm cmd/restic/integration_fuse_test.go
+  '';
+
   postInstall = ''
     wrapProgram $out/bin/restic --prefix PATH : '${rclone}/bin'
   '' + lib.optionalString (stdenv.hostPlatform == stdenv.buildPlatform) ''
diff --git a/third_party/nixpkgs/pkgs/tools/networking/network-manager/sstp/default.nix b/third_party/nixpkgs/pkgs/tools/networking/network-manager/sstp/default.nix
new file mode 100644
index 0000000000..d5195cba34
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/tools/networking/network-manager/sstp/default.nix
@@ -0,0 +1,64 @@
+{ stdenv
+, autoreconfHook
+, fetchFromGitHub
+, fetchpatch
+, file
+, glib
+, gnome3
+, gtk3
+, intltool
+, libnma
+, libsecret
+, networkmanager
+, pkgconfig
+, ppp
+, sstp
+, substituteAll
+, withGnome ? true }:
+
+let
+  pname = "NetworkManager-sstp";
+  version = "unstable-2020-04-20";
+in stdenv.mkDerivation {
+  name = "${pname}${if withGnome then "-gnome" else ""}-${version}";
+
+  src = fetchFromGitHub {
+    owner = "enaess";
+    repo = "network-manager-sstp";
+    rev = "735d8ca078f933e085029f60a737e3cf1d8c29a8";
+    sha256 = "0aahfhy2ch951kzj6gnd8p8hv2s5yd5y10wrmj68djhnx2ml8cd3";
+  };
+
+  buildInputs = [ sstp networkmanager glib ppp ]
+    ++ stdenv.lib.optionals withGnome [ gtk3 libsecret libnma ];
+
+  nativeBuildInputs = [ file intltool autoreconfHook pkgconfig ];
+
+  postPatch = ''
+    sed -i 's#/sbin/pppd#${ppp}/bin/pppd#' src/nm-sstp-service.c
+    sed -i 's#/sbin/sstpc#${sstp}/bin/sstpc#' src/nm-sstp-service.c
+  '';
+
+  # glib-2.62 deprecations
+  NIX_CFLAGS_COMPILE = "-DGLIB_DISABLE_DEPRECATION_WARNINGS";
+
+  preConfigure = "intltoolize";
+  configureFlags = [
+    "--without-libnm-glib"
+    "--with-gnome=${if withGnome then "yes" else "no"}"
+    "--enable-absolute-paths"
+  ];
+
+  passthru = {
+    updateScript = gnome3.updateScript {
+      packageName = pname;
+      attrPath = "networkmanager-sstp";
+    };
+  };
+
+  meta = with stdenv.lib; {
+    description = "NetworkManager's sstp plugin";
+    inherit (networkmanager.meta) maintainers platforms;
+    license = licenses.gpl2Plus;
+  };
+}
diff --git a/third_party/nixpkgs/pkgs/tools/networking/sstp/default.nix b/third_party/nixpkgs/pkgs/tools/networking/sstp/default.nix
index 4d05b478ab..22ef9102ef 100644
--- a/third_party/nixpkgs/pkgs/tools/networking/sstp/default.nix
+++ b/third_party/nixpkgs/pkgs/tools/networking/sstp/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "sstp-client";
-  version = "1.0.12";
+  version = "1.0.13";
 
   src = fetchurl {
-    url = "mirror://sourceforge/sstp-client/sstp-client/${version}/sstp-client-${version}.tar.gz";
-    sha256 = "1zv7rx6wh9rhbyg9pg6759by8hc6n4162zrrw0y812cnaw3b8zj8";
+    url = "mirror://sourceforge/sstp-client/sstp-client/sstp-client-${version}.tar.gz";
+    sha256 = "06rjyncmgdy212xf9l9z6mfh4gdmgk7l4y841gb8lpbrl3y5h4ln";
   };
 
   patchPhase =
diff --git a/third_party/nixpkgs/pkgs/top-level/all-packages.nix b/third_party/nixpkgs/pkgs/top-level/all-packages.nix
index 897ec8b294..3065dcb806 100644
--- a/third_party/nixpkgs/pkgs/top-level/all-packages.nix
+++ b/third_party/nixpkgs/pkgs/top-level/all-packages.nix
@@ -3427,6 +3427,8 @@ in
 
   wayland-utils = callPackage ../tools/wayland/wayland-utils { };
 
+  wayst = callPackage ../applications/misc/wayst { };
+
   wev = callPackage ../tools/misc/wev { };
 
   wl-clipboard = callPackage ../tools/misc/wl-clipboard { };
@@ -5104,10 +5106,13 @@ in
   nodejs-slim-14_x = callPackage ../development/web/nodejs/v14.nix {
     enableNpm = false;
   };
-
+  nodejs-15_x = callPackage ../development/web/nodejs/v15.nix { };
+  nodejs-slim-15_x = callPackage ../development/web/nodejs/v15.nix {
+    enableNpm = false;
+  };
   # Update this when adding the newest nodejs major version!
-  nodejs_latest = nodejs-14_x;
-  nodejs-slim_latest = nodejs-slim-14_x;
+  nodejs_latest = nodejs-15_x;
+  nodejs-slim_latest = nodejs-slim-15_x;
 
   nodePackages_latest = dontRecurseIntoAttrs (callPackage ../development/node-packages/default.nix {
     nodejs = pkgs.nodejs_latest;
@@ -5727,6 +5732,8 @@ in
 
   networkmanager_strongswan = callPackage ../tools/networking/network-manager/strongswan { };
 
+  networkmanager-sstp = callPackage ../tools/networking/network-manager/sstp { };
+
   networkmanagerapplet = callPackage ../tools/networking/network-manager/applet { };
 
   libnma = callPackage ../tools/networking/network-manager/libnma { };
@@ -20516,6 +20523,8 @@ in
   keepassx2 = callPackage ../applications/misc/keepassx/2.0.nix { };
   keepassxc = libsForQt5.callPackage ../applications/misc/keepassx/community.nix { };
 
+  keeweb = callPackage ../applications/misc/keeweb { };
+
   inherit (gnome3) evince;
   evolution-data-server = gnome3.evolution-data-server;
   evolution-ews = callPackage ../applications/networking/mailreaders/evolution/evolution-ews { };
@@ -27984,6 +27993,8 @@ in
 
   yadm = callPackage ../applications/version-management/yadm { };
 
+  yamale = with python3Packages; toPythonApplication yamale;
+
   yamdi = callPackage ../tools/video/yamdi { };
 
   yandex-disk = callPackage ../tools/filesystems/yandex-disk { };
@@ -28315,4 +28326,5 @@ in
   cagebreak = callPackage ../applications/window-managers/cagebreak/default.nix {};
 
   psftools = callPackage ../os-specific/linux/psftools {};
+
 }
diff --git a/third_party/nixpkgs/pkgs/top-level/perl-packages.nix b/third_party/nixpkgs/pkgs/top-level/perl-packages.nix
index 5d3303a153..e19d881d1e 100644
--- a/third_party/nixpkgs/pkgs/top-level/perl-packages.nix
+++ b/third_party/nixpkgs/pkgs/top-level/perl-packages.nix
@@ -11014,8 +11014,10 @@ let
     };
     propagatedBuildInputs = [ commonsense ];
 
-    meta = with stdenv.lib; {
-      platforms = platforms.linux;
+    meta = {
+      description = "Scalable directory/file change notification for Perl on Linux";
+      license = with stdenv.lib.licenses; [ artistic1 gpl1Plus ];
+      platforms = stdenv.lib.platforms.linux;
     };
   };
 
diff --git a/third_party/nixpkgs/pkgs/top-level/python-packages.nix b/third_party/nixpkgs/pkgs/top-level/python-packages.nix
index aab9f760db..691163d5f9 100644
--- a/third_party/nixpkgs/pkgs/top-level/python-packages.nix
+++ b/third_party/nixpkgs/pkgs/top-level/python-packages.nix
@@ -7687,6 +7687,8 @@ in {
 
   yahooweather = callPackage ../development/python-modules/yahooweather { };
 
+  yamale = callPackage ../development/python-modules/yamale { };
+
   yamllint = callPackage ../development/python-modules/yamllint { };
 
   yamlordereddictloader = callPackage ../development/python-modules/yamlordereddictloader { };