diff --git a/third_party/nixpkgs/maintainers/maintainer-list.nix b/third_party/nixpkgs/maintainers/maintainer-list.nix
index 611bb18912..2838f60ad0 100644
--- a/third_party/nixpkgs/maintainers/maintainer-list.nix
+++ b/third_party/nixpkgs/maintainers/maintainer-list.nix
@@ -2023,6 +2023,16 @@
     githubId = 49904992;
     name = "Dawid Sowa";
   };
+  dbirks = {
+    email = "david@birks.dev";
+    github = "dbirks";
+    githubId = 7545665;
+    name = "David Birks";
+    keys = [{
+      longkeyid = "ed25519/0xBB999F83D9A19A36";
+      fingerprint = "B26F 9AD8 DA20 3392 EF87  C61A BB99 9F83 D9A1 9A36";
+    }];
+  };
   dbohdan = {
     email = "dbohdan@dbohdan.com";
     github = "dbohdan";
diff --git a/third_party/nixpkgs/nixos/doc/manual/release-notes/rl-2009.xml b/third_party/nixpkgs/nixos/doc/manual/release-notes/rl-2009.xml
index 881a95a782..afb09d7c5d 100644
--- a/third_party/nixpkgs/nixos/doc/manual/release-notes/rl-2009.xml
+++ b/third_party/nixpkgs/nixos/doc/manual/release-notes/rl-2009.xml
@@ -234,7 +234,17 @@
      </listitem>
     </itemizedlist>
    </listitem>
-
+   <listitem>
+    <para>
+     Starting with this release, the hydra-build-result
+     <literal>nixos-<replaceable>YY.MM</replaceable></literal>
+     branches no longer exist in the <link
+     xlink:href="https://github.com/nixos/nixpkgs-channels">deprecated
+     nixpkgs-channels repository</link>.  These branches are now in
+     <link xlink:href="https://github.com/nixos/nixpkgs">the main nixpkgs
+     repository</link>.
+    </para>
+   </listitem>
   </itemizedlist>
  </section>
 
diff --git a/third_party/nixpkgs/nixos/tests/postfix.nix b/third_party/nixpkgs/nixos/tests/postfix.nix
index 37ae76afec..6d22b4edba 100644
--- a/third_party/nixpkgs/nixos/tests/postfix.nix
+++ b/third_party/nixpkgs/nixos/tests/postfix.nix
@@ -11,9 +11,9 @@ import ./make-test-python.nix {
       enable = true;
       enableSubmission = true;
       enableSubmissions = true;
-      sslCACert = certs.ca.cert;
-      sslCert = certs.${domain}.cert;
-      sslKey = certs.${domain}.key;
+      tlsTrustedAuthorities = "${certs.ca.cert}";
+      sslCert = "${certs.${domain}.cert}";
+      sslKey = "${certs.${domain}.key}";
       submissionsOptions = {
           smtpd_sasl_auth_enable = "yes";
           smtpd_client_restrictions = "permit";
diff --git a/third_party/nixpkgs/pkgs/applications/audio/bambootracker/default.nix b/third_party/nixpkgs/pkgs/applications/audio/bambootracker/default.nix
index a26431a82e..f1f97de256 100644
--- a/third_party/nixpkgs/pkgs/applications/audio/bambootracker/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/audio/bambootracker/default.nix
@@ -3,7 +3,6 @@
 , fetchFromGitHub
 , qmake
 , qtbase
-, qtmultimedia
 , qttools
 , alsaSupport ? stdenv.hostPlatform.isLinux
 , alsaLib
@@ -19,20 +18,20 @@ let
 in
 mkDerivation rec {
   pname = "bambootracker";
-  version = "0.4.4";
+  version = "0.4.5";
 
   src = fetchFromGitHub {
     owner = "rerrahkr";
     repo = "BambooTracker";
     rev = "v${version}";
-    sha256 = "0d0f4jqzknsiq725pvfndarfjg183f92rb0lim3wzshnsixr5vdc";
+    sha256 = "0ibi0sykxf6cp5la2c4pgxf5gvy56yv259fbmdwdrdyv6vlddf42";
   };
 
   sourceRoot = "source/BambooTracker";
 
   nativeBuildInputs = [ qmake qttools ];
 
-  buildInputs = [ qtbase qtmultimedia ]
+  buildInputs = [ qtbase ]
     ++ optional alsaSupport alsaLib
     ++ optional pulseSupport libpulseaudio
     ++ optional jackSupport libjack2;
diff --git a/third_party/nixpkgs/pkgs/applications/audio/vmpk/default.nix b/third_party/nixpkgs/pkgs/applications/audio/vmpk/default.nix
index 62ae1d2c04..dfae5d40e1 100644
--- a/third_party/nixpkgs/pkgs/applications/audio/vmpk/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/audio/vmpk/default.nix
@@ -1,19 +1,22 @@
-{ stdenv, fetchurl, cmake, pkgconfig, alsaLib, libjack2, qt4 }:
+{ mkDerivation, lib, fetchurl, cmake, pkg-config
+, qttools, qtx11extras, drumstick
+, docbook-xsl-nons
+}:
 
-stdenv.mkDerivation rec {
+mkDerivation rec {
   pname = "vmpk";
-  version = "0.5.1";
+  version = "0.7.2";
 
   src = fetchurl {
     url = "mirror://sourceforge/${pname}/${version}/${pname}-${version}.tar.bz2";
-    sha256 = "11fqnxgs9hr9255d93n7lazxzjwn8jpmn23nywdksh0pb1ffvfrc";
+    sha256 = "5oLrjQADg59Mxpb0CNLQAE574IOSYLDLJNaQ/9q2cMQ=";
   };
 
-  nativeBuildInputs = [ cmake pkgconfig ];
+  nativeBuildInputs = [ cmake pkg-config qttools docbook-xsl-nons ];
 
-  buildInputs = [ alsaLib libjack2 qt4 ];
+  buildInputs = [ qtx11extras drumstick ];
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Virtual MIDI Piano Keyboard";
     homepage = "http://vmpk.sourceforge.net/";
     license = licenses.gpl3Plus;
diff --git a/third_party/nixpkgs/pkgs/applications/blockchains/wasabiwallet/default.nix b/third_party/nixpkgs/pkgs/applications/blockchains/wasabiwallet/default.nix
index 3b4ec1c49c..e566661d36 100644
--- a/third_party/nixpkgs/pkgs/applications/blockchains/wasabiwallet/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/blockchains/wasabiwallet/default.nix
@@ -24,11 +24,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "wasabiwallet";
-  version = "1.1.12";
+  version = "1.1.12.2";
 
   src = fetchurl {
     url = "https://github.com/zkSNACKs/WalletWasabi/releases/download/v${version}/Wasabi-${version}.tar.gz";
-    sha256 = "0nfd0pwsgrkaxcxfs8wb3i8kslfcqnc91iahw3rmlcxdzb81kjs4";
+    sha256 = "0nl7n24nsy3gyzrxa6llx81pvsjqcwi0a4qdv34dpcq483aclp2r";
   };
 
   dontBuild = true;
diff --git a/third_party/nixpkgs/pkgs/applications/kde/k3b.nix b/third_party/nixpkgs/pkgs/applications/kde/k3b.nix
index 4bf707cd04..35d55787ec 100644
--- a/third_party/nixpkgs/pkgs/applications/kde/k3b.nix
+++ b/third_party/nixpkgs/pkgs/applications/kde/k3b.nix
@@ -1,6 +1,5 @@
 { mkDerivation, lib
 , extra-cmake-modules, kdoctools, makeWrapper, shared-mime-info
-, qtwebkit
 , libkcddb, karchive, kcmutils, kfilemetadata, knewstuff, knotifyconfig, solid, kxmlgui
 , flac, lame, libmad, libmpcdec, libvorbis
 , libsamplerate, libsndfile, taglib
@@ -17,8 +16,6 @@ mkDerivation {
   };
   nativeBuildInputs = [ extra-cmake-modules kdoctools makeWrapper ];
   buildInputs = [
-    # qt
-    qtwebkit
     # kde
     libkcddb karchive kcmutils kfilemetadata knewstuff knotifyconfig solid kxmlgui
     # formats
diff --git a/third_party/nixpkgs/pkgs/applications/misc/batsignal/default.nix b/third_party/nixpkgs/pkgs/applications/misc/batsignal/default.nix
index 18dbcc9ce2..90fca4ce28 100644
--- a/third_party/nixpkgs/pkgs/applications/misc/batsignal/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/misc/batsignal/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "batsignal";
-  version = "1.1.3";
+  version = "1.2.0";
 
   src = fetchFromGitHub {
     owner = "electrickite";
     repo = "batsignal";
     rev = version;
-    sha256 = "12hj0j18db34x0xzgj6xmhvxm966d05z0rl3d9rlrcd2q96lilwf";
+    sha256 = "0yc7xgwb3i4m8m9kg2xspqig3s2qgh2i9bkalvnkziayjb7y59qn";
   };
 
   buildInputs = [ libnotify glib ];
diff --git a/third_party/nixpkgs/pkgs/applications/misc/gpxsee/default.nix b/third_party/nixpkgs/pkgs/applications/misc/gpxsee/default.nix
index 1bfe642752..11b373ac13 100644
--- a/third_party/nixpkgs/pkgs/applications/misc/gpxsee/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/misc/gpxsee/default.nix
@@ -2,13 +2,13 @@
 
 mkDerivation rec {
   pname = "gpxsee";
-  version = "7.35";
+  version = "7.36";
 
   src = fetchFromGitHub {
     owner = "tumic0";
     repo = "GPXSee";
     rev = version;
-    sha256 = "1schmymcsd8s0r26qwyx56z107ql8pgrk1pnqy19mc7fyirdwmp5";
+    sha256 = "18vsw6hw6kn5wmr4iarhx1v8q455j60fhf0hq69jkfyarl56b99j";
   };
 
   patches = (substituteAll {
diff --git a/third_party/nixpkgs/pkgs/applications/misc/gremlin-console/default.nix b/third_party/nixpkgs/pkgs/applications/misc/gremlin-console/default.nix
index a4932943fa..74485e2004 100644
--- a/third_party/nixpkgs/pkgs/applications/misc/gremlin-console/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/misc/gremlin-console/default.nix
@@ -2,10 +2,10 @@
 
 stdenv.mkDerivation rec {
   pname = "gremlin-console";
-  version = "3.3.4";
+  version = "3.4.8";
   src = fetchzip {
     url = "http://www-eu.apache.org/dist/tinkerpop/${version}/apache-tinkerpop-gremlin-console-${version}-bin.zip";
-    sha256 = "14xr0yqklmm4jvj1hnkj89lj83zzs2l1375ni0jbf12gy31jlb2w";
+    sha256 = "13ycr6ppyrz9rq7dasabjdk8lcsxdj3krb4j7d2jmbh2hij1rdvf";
   };
 
   buildInputs = [ makeWrapper ];
diff --git a/third_party/nixpkgs/pkgs/applications/misc/joplin-desktop/default.nix b/third_party/nixpkgs/pkgs/applications/misc/joplin-desktop/default.nix
index be103f3543..de68e90a4f 100644
--- a/third_party/nixpkgs/pkgs/applications/misc/joplin-desktop/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/misc/joplin-desktop/default.nix
@@ -2,7 +2,7 @@
 
 let
   pname = "joplin-desktop";
-  version = "1.2.6";
+  version = "1.3.18";
   name = "${pname}-${version}";
 
   inherit (stdenv.hostPlatform) system;
@@ -16,8 +16,8 @@ let
   src = fetchurl {
     url = "https://github.com/laurent22/joplin/releases/download/v${version}/Joplin-${version}.${suffix}";
     sha256 = {
-      x86_64-linux = "14svzfhszb0pnsajbydsic0rdc64zp6csqjp6k2p2i20jf0c0im6";
-      x86_64-darwin = "1wdv8idnvn5567xdmsaa3f7skv48i9q6jqd4pgv8pz1zkhiqj0wi";
+      x86_64-linux = "1dldy137ia8qxhf7d5xzq5slm12bhnmw4kx7fm37n1ajjdcn5sf7";
+      x86_64-darwin = "0zm9vhxlfs1ldd8za4yha54psqwl0al4hzdfxjfp7ir98i9a4cj7";
     }.${system} or throwSystem;
   };
 
diff --git a/third_party/nixpkgs/pkgs/applications/misc/klayout/default.nix b/third_party/nixpkgs/pkgs/applications/misc/klayout/default.nix
index 0a8d7ce547..60905be3b1 100644
--- a/third_party/nixpkgs/pkgs/applications/misc/klayout/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/misc/klayout/default.nix
@@ -5,13 +5,13 @@
 
 mkDerivation rec {
   pname = "klayout";
-  version = "0.26.6";
+  version = "0.26.8";
 
   src = fetchFromGitHub {
     owner = "KLayout";
     repo = "klayout";
     rev = "v${version}";
-    sha256 = "0z17pdjdc2r2m5yi5bfz504dzzs978z8p6bhlf08v2npvigp8vz1";
+    sha256 = "0pkhvxcfk70dnmgczyyq585mxrfwqai44ikshs4c1imh92z25llq";
   };
 
   postPatch = ''
diff --git a/third_party/nixpkgs/pkgs/applications/misc/simplenote/default.nix b/third_party/nixpkgs/pkgs/applications/misc/simplenote/default.nix
index 05cf15b8ac..455c08fb29 100644
--- a/third_party/nixpkgs/pkgs/applications/misc/simplenote/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/misc/simplenote/default.nix
@@ -17,10 +17,10 @@ let
 
   pname = "simplenote";
 
-  version = "1.21.1";
+  version = "2.0.0";
 
   sha256 = {
-    x86_64-linux = "00qx82d17yrrg2mxwhm40av0mpf5hy14j338i5ijhwp79yc8fk8x";
+    x86_64-linux = "18alzsl1y9pvd5rs6gfnzv0py8ha0im33ylg7h6dicil5vii4l05";
   }.${system} or throwSystem;
 
   meta = with stdenv.lib; {
diff --git a/third_party/nixpkgs/pkgs/applications/misc/xmenu/default.nix b/third_party/nixpkgs/pkgs/applications/misc/xmenu/default.nix
index ecbb205c98..e84f95e099 100644
--- a/third_party/nixpkgs/pkgs/applications/misc/xmenu/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/misc/xmenu/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "xmenu";
-  version = "4.3.1";
+  version = "4.4.1";
 
   src = fetchFromGitHub {
     owner = "phillbush";
     repo = "xmenu";
     rev = "v${version}";
-    sha256 = "0m97w1nwak5drcxxlyisqb73fxkapy2rlph9mg531kbx3k2h30r1";
+    sha256 = "1s70zvsaqnsjqs298vw3py0vcvia68xlks1wcz37pb88bwligz1x";
   };
 
   buildInputs = [ imlib2 libX11 libXft libXinerama ];
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
   meta = with stdenv.lib; {
     description = "A menu utility for X";
     homepage = "https://github.com/phillbush/xmenu";
-    license = licenses.publicDomain;
+    license = licenses.mit;
     maintainers = with maintainers; [ neonfuz ];
     platforms = platforms.all;
   };
diff --git a/third_party/nixpkgs/pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix b/third_party/nixpkgs/pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix
index f6f6deb738..ff2501d47c 100644
--- a/third_party/nixpkgs/pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix
@@ -231,9 +231,10 @@ stdenv.mkDerivation rec {
 
     # Preload extensions by moving into the runtime instead of storing under the
     # user's profile directory.
-    mkdir -p "$TBB_IN_STORE/browser/extensions"
+    # See https://support.mozilla.org/en-US/kb/deploying-firefox-with-extensions
+    mkdir -p "$TBB_IN_STORE/distribution/extensions"
     mv "$TBB_IN_STORE/TorBrowser/Data/Browser/profile.default/extensions/"* \
-      "$TBB_IN_STORE/browser/extensions"
+      "$TBB_IN_STORE/distribution/extensions"
 
     # Hard-code paths to geoip data files.  TBB resolves the geoip files
     # relative to torrc-defaults_path but if we do not hard-code them
@@ -409,6 +410,5 @@ stdenv.mkDerivation rec {
     # the compound is "libre" in a strict sense (some components place certain
     # restrictions on redistribution), it's free enough for our purposes.
     license = licenses.free;
-    broken = true;
   };
 }
diff --git a/third_party/nixpkgs/pkgs/applications/networking/cluster/kubernetes/default.nix b/third_party/nixpkgs/pkgs/applications/networking/cluster/kubernetes/default.nix
index a56db43319..9a8bbe09a5 100644
--- a/third_party/nixpkgs/pkgs/applications/networking/cluster/kubernetes/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/networking/cluster/kubernetes/default.nix
@@ -15,13 +15,13 @@ with lib;
 
 stdenv.mkDerivation rec {
   pname = "kubernetes";
-  version = "1.19.3";
+  version = "1.19.4";
 
   src = fetchFromGitHub {
     owner = "kubernetes";
     repo = "kubernetes";
     rev = "v${version}";
-    sha256 = "0fpkgrykkjmkrh327g6zf3r6s39bnv5w1wlqsvvzyp2zsswgw81v";
+    sha256 = "05gisihrklkzsdsrrmvmqlfwfdx73jbwd5668n5wa5hp432qyvwi";
   };
 
   nativeBuildInputs = [ removeReferencesTo makeWrapper which go rsync go-bindata ];
diff --git a/third_party/nixpkgs/pkgs/applications/networking/cluster/terragrunt/default.nix b/third_party/nixpkgs/pkgs/applications/networking/cluster/terragrunt/default.nix
index e3f2adacfb..e607a9ee75 100644
--- a/third_party/nixpkgs/pkgs/applications/networking/cluster/terragrunt/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/networking/cluster/terragrunt/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "terragrunt";
-  version = "0.25.5";
+  version = "0.26.2";
 
   src = fetchFromGitHub {
     owner = "gruntwork-io";
     repo = pname;
     rev = "v${version}";
-    sha256 = "19rsnhws4cvssxjmm22j746jck0wzrhwi24hnlwxkdaaw92yd36l";
+    sha256 = "0bp43rsnkq2ysdl0v28i9agan738m0zk5yn8zza6js28sx0y7kns";
   };
 
   vendorSha256 = "0l85jx02dj9qvxs8l0ln5fln8vssi0fisblm5i1scz9x4a1jqg9n";
diff --git a/third_party/nixpkgs/pkgs/applications/networking/gns3/default.nix b/third_party/nixpkgs/pkgs/applications/networking/gns3/default.nix
index d9168d7a29..a0f35f3779 100644
--- a/third_party/nixpkgs/pkgs/applications/networking/gns3/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/networking/gns3/default.nix
@@ -1,7 +1,7 @@
 { callPackage, libsForQt5 }:
 
 let
-  stableVersion = "2.2.15";
+  stableVersion = "2.2.16";
   previewVersion = stableVersion;
   addVersion = args:
     let version = if args.stable then stableVersion else previewVersion;
@@ -26,8 +26,8 @@ let
   };
   mkGui = args: libsForQt5.callPackage (import ./gui.nix (addVersion args // extraArgs)) { };
   mkServer = args: callPackage (import ./server.nix (addVersion args // extraArgs)) { };
-  guiSrcHash = "149yphmxc47bhc2f942lp4bx354qj3cyrpn10s1xabkn2hwrsm0d";
-  serverSrcHash = "03cfg48xzgz362ra5x853k8r244dgbrmszcprs2lg70i3m722345";
+  guiSrcHash = "1kz5gr5rwqp1hn9fw17v6sy2467506zks574nqcd2vgxzhr6cy6x";
+  serverSrcHash = "1r6qj1l8jgyjm67agn83zp9c2n7pgfzwyh8a5q314zxi18nm6rqp";
 in {
   guiStable = mkGui {
     stable = true;
diff --git a/third_party/nixpkgs/pkgs/applications/networking/instant-messengers/dino/default.nix b/third_party/nixpkgs/pkgs/applications/networking/instant-messengers/dino/default.nix
index 795f71a3cd..03508c2ffb 100644
--- a/third_party/nixpkgs/pkgs/applications/networking/instant-messengers/dino/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/networking/instant-messengers/dino/default.nix
@@ -18,24 +18,15 @@
 
 stdenv.mkDerivation rec {
   pname = "dino";
-  version = "0.1.0";
+  version = "0.2.0";
 
   src = fetchFromGitHub {
     owner = "dino";
     repo = "dino";
     rev = "v${version}";
-    sha256 = "1k5cgj5n8s40i71wqdh6m1q0njl45ichfdbbywx9rga5hljz1c54";
+    sha256 = "0wy1hb3kz3k4gqqwx308n37cqag2d017jwfz0b5s30nkx2pbwspw";
   };
 
-  patches = [
-    (fetchpatch {
-      # Allow newer versions of libsignal-protocol-c
-      url = "https://github.com/dino/dino/commit/fbd70ceaac5ebbddfa21a580c61165bf5b861303.patch";
-      sha256 = "0ydpwsmwrzfsry89fsffkfalhki4n1dw99ixjvpiingdrhjmwyl2";
-      excludes = [ "plugins/signal-protocol/libsignal-protocol-c" ];
-    })
-  ];
-
   nativeBuildInputs = [
     vala
     cmake
diff --git a/third_party/nixpkgs/pkgs/applications/networking/instant-messengers/signal-cli/default.nix b/third_party/nixpkgs/pkgs/applications/networking/instant-messengers/signal-cli/default.nix
index c1b9cdc122..995c050d90 100644
--- a/third_party/nixpkgs/pkgs/applications/networking/instant-messengers/signal-cli/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/networking/instant-messengers/signal-cli/default.nix
@@ -2,12 +2,12 @@
 
 stdenv.mkDerivation rec {
   pname = "signal-cli";
-  version = "0.6.10";
+  version = "0.6.11";
 
   # Building from source would be preferred, but is much more involved.
   src = fetchurl {
     url = "https://github.com/AsamK/signal-cli/releases/download/v${version}/signal-cli-${version}.tar.gz";
-    sha256 = "0zglcx5ylqjc3hjkzi84mjhp9dchnnkv12qq75q5pqkx1w45rmim";
+    sha256 = "0gkaxhx87yn8gmkqjdn78m1axfnfkw07sw9qsn7821966fd5l5ax";
   };
 
   buildInputs = lib.optionals stdenv.isLinux [ libmatthew_java dbus dbus_java ];
diff --git a/third_party/nixpkgs/pkgs/applications/networking/seaweedfs/default.nix b/third_party/nixpkgs/pkgs/applications/networking/seaweedfs/default.nix
index be58375586..da54ecf44d 100644
--- a/third_party/nixpkgs/pkgs/applications/networking/seaweedfs/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/networking/seaweedfs/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "seaweedfs";
-  version = "2.07";
+  version = "2.09";
 
   src = fetchFromGitHub {
     owner = "chrislusf";
     repo = "seaweedfs";
     rev = version;
-    sha256 = "0yrfpj4ph9f321vqfn1zadv44pqa3ivjq9rx6gsz9hlv50gfaqn1";
+    sha256 = "0yy5a7hr597vj6xbn7f5vzqdwnr637b3l1d62cmk0h7qbmh4anji";
   };
 
-  vendorSha256 = "1ysqagi4y25bi84h5fhkdimnsigy43klf6hrcqn7q75382fb4bzn";
+  vendorSha256 = "1r7k0rzizs61r4gqqll7l2j7mdpi3w1ja6l4w6vxgzb45h2sjhi7";
 
   subPackages = [ "weed" ];
 
diff --git a/third_party/nixpkgs/pkgs/applications/science/electronics/magic-vlsi/default.nix b/third_party/nixpkgs/pkgs/applications/science/electronics/magic-vlsi/default.nix
index 96849c3002..6667f2be9c 100644
--- a/third_party/nixpkgs/pkgs/applications/science/electronics/magic-vlsi/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/science/electronics/magic-vlsi/default.nix
@@ -1,16 +1,20 @@
-{ stdenv, fetchurl, m4, tcsh, libX11, tcl, tk, cairo, ncurses, mesa_glu, python3 }:
+{ stdenv, fetchurl
+, m4, tcsh, libX11, tcl, tk
+, cairo, ncurses, mesa_glu, python3
+}:
 
-stdenv.mkDerivation {
+stdenv.mkDerivation rec {
   pname = "magic-vlsi";
-  version = "8.3.5";
+  version = "8.3.80";
 
   src = fetchurl {
-    url = "http://opencircuitdesign.com/magic/archive/magic-8.3.5.tgz";
-    sha256 = "0wv4zmxlqjfaakgp802icn0cd9f8ylkz2sppix83axq8p5cg90yq";
+    url    = "http://opencircuitdesign.com/magic/archive/magic-${version}.tgz";
+    sha256 = "0a5x4sh5xsr79pqbgv6221jc4fvaxkg2pvrdhy1cs4bmsc1sbm9j";
   };
 
   buildInputs = [ m4 tcsh libX11 tcl tk cairo ncurses mesa_glu ];
   nativeBuildInputs = [ python3 ];
+  enableParallelBuilding = true;
 
   configureFlags = [
     "--with-tcl=${tcl}"
@@ -22,6 +26,8 @@ stdenv.mkDerivation {
     patchShebangs scripts/*
   '';
 
+  NIX_CFLAGS_COMPILE = "-Wno-implicit-function-declaration";
+
   patches = [
     ./0001-strip-bin-prefix.patch
     ./0002-fix-format-security.patch
@@ -29,8 +35,8 @@ stdenv.mkDerivation {
 
   meta = with stdenv.lib; {
     description = "VLSI layout tool written in Tcl";
-    homepage = "http://opencircuitdesign.com/magic/";
-    license = licenses.mit;
-    maintainers = [ maintainers.anna328p ];
+    homepage    = "http://opencircuitdesign.com/magic/";
+    license     = licenses.mit;
+    maintainers = with maintainers; [ anna328p thoughtpolice ];
   };
 }
diff --git a/third_party/nixpkgs/pkgs/applications/science/electronics/verilog/default.nix b/third_party/nixpkgs/pkgs/applications/science/electronics/verilog/default.nix
index df1ce7b723..abe8037802 100644
--- a/third_party/nixpkgs/pkgs/applications/science/electronics/verilog/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/science/electronics/verilog/default.nix
@@ -6,40 +6,35 @@
 
 let
   iverilog-test = fetchFromGitHub {
-    owner = "steveicarus";
-    repo = "ivtest";
-    rev = "6882cb8ec08926c4e356c6092f0c5f8c23328d5c";
-    sha256 = "04sj5nqzwls1y760kgnd9c2whkcrr8kvj9lisd5rvk0w580kjb2x";
+    owner  = "steveicarus";
+    repo   = "ivtest";
+    rev    = "d4c80beb845cad92136c05074b3910b822a9315f";
+    sha256 = "13cpnkki3xmhsh2v4bp2s35mhwknapcikdh85g4q6925ka940r45";
   };
 in
 stdenv.mkDerivation rec {
-  pname = "iverilog";
-  version = "unstable-2020-08-24";
+  pname   = "iverilog";
+  version = "unstable-2020-10-24";
 
   src = fetchFromGitHub {
-    owner = "steveicarus";
-    repo = pname;
-    rev = "d8556e4c86e1465b68bdc8d5ba2056ba95a42dfd";
-    sha256 = "sha256-sT9j/0Q2FD5MOGpH/quMGvAuM7t7QavRHKD9lX7Elfs=";
+    owner  = "steveicarus";
+    repo   = pname;
+    rev    = "d6e01d0c557253414109a4dde46b2966a5a3fb08";
+    sha256 = "1bl75mbycj9zpjbpay8z12384yk9ih5q9agsrjh9pva0vv3h4y4y";
   };
 
-  enableParallelBuilding = true;
-
-  preConfigure = ''
-    chmod +x $PWD/autoconf.sh
-    $PWD/autoconf.sh
-  '';
-
   nativeBuildInputs = [ autoconf gperf flex bison ];
-
   buildInputs = [ readline ncurses bzip2 zlib ];
 
-  # tests from .travis.yml
-  doCheck = true; # runs ``make check``
-  # most tests pass, but some that rely on exact text of floating-point numbers fail on aarch64.
+  preConfigure = "bash $PWD/autoconf.sh";
+
+  enableParallelBuilding = true;
+  doCheck = true;
+
+  # most tests pass, but some that rely on exact text of floating-point numbers
+  # fail on aarch64.
   doInstallCheck = !stdenv.isAarch64;
   installCheckInputs = [ perl ];
-
   installCheckPhase = ''
     # copy tests to allow writing results
     export TESTDIR=$(mktemp -d)
@@ -58,9 +53,9 @@ stdenv.mkDerivation rec {
 
   meta = with stdenv.lib; {
     description = "Icarus Verilog compiler";
-    homepage = "http://iverilog.icarus.com/";
-    license = with licenses; [ gpl2Plus lgpl21Plus] ;
-    maintainers = with maintainers; [ winden ];
-    platforms = platforms.all;
+    homepage    = "http://iverilog.icarus.com/";
+    license     = with licenses; [ gpl2Plus lgpl21Plus ];
+    maintainers = with maintainers; [ winden thoughtpolice ];
+    platforms   = platforms.all;
   };
 }
diff --git a/third_party/nixpkgs/pkgs/applications/video/makemkv/default.nix b/third_party/nixpkgs/pkgs/applications/video/makemkv/default.nix
index d3cb12924c..6f47307f4a 100644
--- a/third_party/nixpkgs/pkgs/applications/video/makemkv/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/video/makemkv/default.nix
@@ -1,23 +1,33 @@
-{ stdenv, mkDerivation, fetchurl, autoPatchelfHook
-, ffmpeg_3, openssl, qtbase, zlib, pkgconfig
+{ stdenv
+, mkDerivation
+, fetchurl
+, autoPatchelfHook
+, pkg-config
+, ffmpeg_3
+, openssl
+, qtbase
+, zlib
+
+, withJava ? true
+, jre_headless
 }:
 
 let
-  version = "1.15.2";
+  version = "1.15.3";
   # Using two URLs as the first one will break as soon as a new version is released
   src_bin = fetchurl {
     urls = [
       "http://www.makemkv.com/download/makemkv-bin-${version}.tar.gz"
       "http://www.makemkv.com/download/old/makemkv-bin-${version}.tar.gz"
     ];
-    sha256 = "1dbips0qllbwhak44c50nlwn8n3kx8i6773cal5zl3dv4v2nf6ql";
+    hash = "sha256-Y23aetnwqLGaBIgJ/AP0oCrh8P5jpVrcMJgmc0Oe+i8=";
   };
   src_oss = fetchurl {
     urls = [
       "http://www.makemkv.com/download/makemkv-oss-${version}.tar.gz"
       "http://www.makemkv.com/download/old/makemkv-oss-${version}.tar.gz"
     ];
-    sha256 = "1wnhzlz5fw6qwh82hjcpimg60xb3a9a54zb6gcjhqr9zdly2zphy";
+    hash = "sha256-Qruq9YKAaNF1pDtOhptP95UjFL2NA4EuROR4v6XZHEw=";
   };
 in mkDerivation {
   pname = "makemkv";
@@ -27,10 +37,17 @@ in mkDerivation {
 
   sourceRoot = "makemkv-oss-${version}";
 
-  nativeBuildInputs = [ autoPatchelfHook pkgconfig ];
+  nativeBuildInputs = [ autoPatchelfHook pkg-config ];
 
   buildInputs = [ ffmpeg_3 openssl qtbase zlib ];
 
+  qtWrapperArgs =
+    let
+      binPath = stdenv.lib.makeBinPath [ jre_headless ];
+    in stdenv.lib.optionals withJava [
+      ''--prefix PATH : ${binPath}''
+    ];
+
   installPhase = ''
     runHook preInstall
 
diff --git a/third_party/nixpkgs/pkgs/applications/video/obs-studio/default.nix b/third_party/nixpkgs/pkgs/applications/video/obs-studio/default.nix
index 0d0fce279b..cdecde6b86 100644
--- a/third_party/nixpkgs/pkgs/applications/video/obs-studio/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/video/obs-studio/default.nix
@@ -32,6 +32,7 @@
 , alsaLib
 , pulseaudioSupport ? config.pulseaudio or stdenv.isLinux
 , libpulseaudio
+, libcef
 }:
 
 let
@@ -44,8 +45,9 @@ in mkDerivation rec {
   src = fetchFromGitHub {
     owner = "obsproject";
     repo = "obs-studio";
-    rev = version;
-    sha256 = "1d502f80whh686mvq0yn6zpa5nvmnlzxwp5sjz43vpbbvhpbrdqj";
+    rev = "refs/tags/${version}";
+    sha256 = "1bf56z2yb7gq1knqwcqj369c3wl9jr3wll5vlngmfy2gwqrczjmw";
+    fetchSubmodules = true;
   };
 
   nativeBuildInputs = [ addOpenGLRunpath cmake pkgconfig ];
@@ -55,6 +57,7 @@ in mkDerivation rec {
     fdk_aac
     ffmpeg
     jansson
+    libcef
     libjack2
     libv4l
     libxkbcommon
@@ -73,6 +76,18 @@ in mkDerivation rec {
   ++ optional alsaSupport alsaLib
   ++ optional pulseaudioSupport libpulseaudio;
 
+  # Copied from the obs-linuxbrowser
+  postUnpack = ''
+    mkdir -p cef/Release cef/Resources cef/libcef_dll_wrapper/
+    for i in ${libcef}/share/cef/*; do
+      cp -r $i cef/Release/
+      cp -r $i cef/Resources/
+    done
+    cp -r ${libcef}/lib/libcef.so cef/Release/
+    cp -r ${libcef}/lib/libcef_dll_wrapper.a cef/libcef_dll_wrapper/
+    cp -r ${libcef}/include cef/
+  '';
+
   # obs attempts to dlopen libobs-opengl, it fails unless we make sure
   # DL_OPENGL is an explicit path. Not sure if there's a better way
   # to handle this.
@@ -80,6 +95,9 @@ in mkDerivation rec {
     "-DCMAKE_CXX_FLAGS=-DDL_OPENGL=\\\"$(out)/lib/libobs-opengl.so\\\""
     "-DOBS_VERSION_OVERRIDE=${version}"
     "-Wno-dev" # kill dev warnings that are useless for packaging
+    # Add support for browser source
+    "-DBUILD_BROWSER=ON"
+    "-DCEF_ROOT_DIR=../../cef"
   ];
 
   postInstall = ''
diff --git a/third_party/nixpkgs/pkgs/applications/video/obs-studio/linuxbrowser.nix b/third_party/nixpkgs/pkgs/applications/video/obs-studio/linuxbrowser.nix
deleted file mode 100644
index a33383937f..0000000000
--- a/third_party/nixpkgs/pkgs/applications/video/obs-studio/linuxbrowser.nix
+++ /dev/null
@@ -1,49 +0,0 @@
-# We don't have a wrapper which can supply obs-studio plugins so you have to
-# somewhat manually install this:
-
-# nix-env -f . -iA obs-linuxbrowser
-# mkdir -p ~/.config/obs-studio/plugins
-# ln -s ~/.nix-profile/share/obs/obs-plugins/obs-linuxbrowser ~/.config/obs-studio/plugins/
-
-{ stdenv, fetchFromGitHub, obs-studio, cmake, libcef }:
-
-stdenv.mkDerivation rec {
-  pname = "obs-linuxbrowser";
-  version = "0.6.1-6-gf86dba6";
-
-  src = fetchFromGitHub {
-    owner = "bazukas";
-    repo = "obs-linuxbrowser";
-    rev = version;
-    sha256 = "08d7qz0721va88bcyia8p0ycw50f6x3yk97s3vzhsc9xpq691kpi";
-  };
-
-  nativeBuildInputs = [ cmake ];
-  buildInputs = [ obs-studio ];
-  postUnpack = ''
-    mkdir -p cef/Release cef/Resources cef/libcef_dll_wrapper/
-    for i in ${libcef}/share/cef/*; do
-      ln -s $i cef/Release/
-      ln -s $i cef/Resources/
-    done
-    ln -s ${libcef}/lib/libcef.so cef/Release/
-    ln -s ${libcef}/lib/libcef_dll_wrapper.a cef/libcef_dll_wrapper/
-    ln -s ${libcef}/include cef/
-  '';
-  cmakeFlags = [
-    "-DCEF_ROOT_DIR=../../cef"
-    "-DOBS_INCLUDE_SEARCH_DIR=${obs-studio}/include/obs"
-  ];
-  installPhase = ''
-    mkdir -p $out/share/obs/obs-plugins
-    cp -r build/obs-linuxbrowser $out/share/obs/obs-plugins/
-  '';
-
-  meta = with stdenv.lib; {
-    description = "Browser source plugin for obs-studio based on Chromium Embedded Framework";
-    homepage = "https://github.com/bazukas/obs-linuxbrowser";
-    maintainers = with maintainers; [ puffnfresh ];
-    license = licenses.gpl2;
-    platforms = with platforms; linux;
-  };
-}
diff --git a/third_party/nixpkgs/pkgs/desktops/gnome-3/extensions/material-shell/default.nix b/third_party/nixpkgs/pkgs/desktops/gnome-3/extensions/material-shell/default.nix
index 7b5156997b..1b8341a281 100644
--- a/third_party/nixpkgs/pkgs/desktops/gnome-3/extensions/material-shell/default.nix
+++ b/third_party/nixpkgs/pkgs/desktops/gnome-3/extensions/material-shell/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-shell-extension-material-shell";
-  version = "9";
+  version = "10";
 
   src = fetchFromGitHub {
     owner = "material-shell";
     repo = "material-shell";
     rev = version;
-    sha256 = "154ids72hkkvibqpq3522wf6h9qw7zkjnf8dgz50vxbkiiy015xn";
+    sha256 = "18d813n8s7ns8xp75zmlna7a8mi23rn9yqps51xvdd0sdgn72a1c";
   };
 
   # This package has a Makefile, but it's used for building a zip for
diff --git a/third_party/nixpkgs/pkgs/development/compilers/nextpnr/default.nix b/third_party/nixpkgs/pkgs/development/compilers/nextpnr/default.nix
index 5dfefa6122..1f5c6a3d4c 100644
--- a/third_party/nixpkgs/pkgs/development/compilers/nextpnr/default.nix
+++ b/third_party/nixpkgs/pkgs/development/compilers/nextpnr/default.nix
@@ -14,14 +14,14 @@ let
 in
 with stdenv; mkDerivation rec {
   pname = "nextpnr";
-  version = "2020.08.22";
+  version = "2020.11.10";
 
   srcs = [
     (fetchFromGitHub {
       owner  = "YosysHQ";
       repo   = "nextpnr";
-      rev    = "c8ecb8341ca766e1e7565cc2b652b63eaba67508";
-      sha256 = "1cf9ad7w5x452qdc6m9c3in6v9yzip3n1as978lbdh76f5mc00fv";
+      rev    = "cf331ca2a7fa92d3414fabf003ce6fc7b515f76b";
+      sha256 = "0ka8ncfq3v8v70m3gwb3nd2rb39sy4vz0lx9hi277cbdsprmf55j";
       name   = "nextpnr";
     })
     (fetchFromGitHub {
diff --git a/third_party/nixpkgs/pkgs/development/compilers/yosys/default.nix b/third_party/nixpkgs/pkgs/development/compilers/yosys/default.nix
index dcb32690eb..f34c4fb7fe 100644
--- a/third_party/nixpkgs/pkgs/development/compilers/yosys/default.nix
+++ b/third_party/nixpkgs/pkgs/development/compilers/yosys/default.nix
@@ -14,15 +14,32 @@
 , zlib
 }:
 
+# NOTE: as of late 2020, yosys has switched to an automation robot that
+# automatically tags their repository Makefile with a new build number every
+# day when changes are committed. please MAKE SURE that the version number in
+# the 'version' field exactly matches the YOSYS_VER field in the Yosys
+# makefile!
+#
+# if a change in yosys isn't yet available under a build number like this (i.e.
+# it was very recently merged, within an hour), wait a few hours for the
+# automation robot to tag the new version, like so:
+#
+#     https://github.com/YosysHQ/yosys/commit/71ca9a825309635511b64b3ec40e5e5e9b6ad49b
+#
+# note that while most nix packages for "unstable versions" use a date-based
+# version scheme, synchronizing the nix package version here with the unstable
+# yosys version number helps users report better bugs upstream, and is
+# ultimately less confusing than using dates.
+
 stdenv.mkDerivation rec {
   pname   = "yosys";
-  version = "2020.10.20";
+  version = "0.9+3675";
 
   src = fetchFromGitHub {
     owner  = "YosysHQ";
     repo   = "yosys";
-    rev    = "06347b119b08257eff37cdd10ed802e794c1a3cf";
-    sha256 = "07058r8095192gwkiy2yyvj9vxv09fcw9bqi2b39wn85lh5kx2k2";
+    rev    = "71ca9a825309635511b64b3ec40e5e5e9b6ad49b";
+    sha256 = "03jlhfvm5rxx8yybf94nqd3ld2y6brp8r0k6gfi56chv3iqqavy3";
   };
 
   enableParallelBuilding = true;
@@ -55,11 +72,17 @@ stdenv.mkDerivation rec {
     (cd misc && ${protobuf}/bin/protoc --cpp_out ../backends/protobuf/ ./yosys.proto)
 
     if ! grep -q "ABCREV = ${shortAbcRev}" Makefile; then
-      echo "yosys isn't compatible with the provided abc (${shortAbcRev}), failing."
+      echo "ERROR: yosys isn't compatible with the provided abc (${shortAbcRev}), failing."
+      exit 1
+    fi
+
+    if ! grep -q "YOSYS_VER := ${version}" Makefile; then
+      echo "ERROR: yosys version in Makefile isn't equivalent to version of the nix package (${version}), failing."
       exit 1
     fi
   '';
 
+  checkTarget = "test";
   doCheck = true;
   checkInputs = [ verilog ];
 
@@ -68,10 +91,10 @@ stdenv.mkDerivation rec {
   # they just assume that 'yosys-abc' is available -- but it's not installed
   # when using ABCEXTERNAL
   #
-  # add a symlink to fake things so that both variants work the same way.
-  postInstall = ''
-    ln -sfv ${abc-verifier}/bin/abc $out/bin/yosys-abc
-  '';
+  # add a symlink to fake things so that both variants work the same way. this
+  # is also needed at build time for the test suite.
+  postBuild   = "ln -sfv ${abc-verifier}/bin/abc ./yosys-abc";
+  postInstall = "ln -sfv ${abc-verifier}/bin/abc $out/bin/yosys-abc";
 
   meta = with stdenv.lib; {
     description = "Open RTL synthesis framework and tools";
diff --git a/third_party/nixpkgs/pkgs/development/haskell-modules/configuration-common.nix b/third_party/nixpkgs/pkgs/development/haskell-modules/configuration-common.nix
index ff3a7be3b1..02cb1d10aa 100644
--- a/third_party/nixpkgs/pkgs/development/haskell-modules/configuration-common.nix
+++ b/third_party/nixpkgs/pkgs/development/haskell-modules/configuration-common.nix
@@ -1110,9 +1110,9 @@ self: super: {
       })
       (pkgs.fetchpatch {
         # Relax dependency constraints,
-        # upstream PR: https://github.com/james-preston/hail/pull/15
-        url = "https://patch-diff.githubusercontent.com/raw/james-preston/hail/pull/15.patch";
-        sha256 = "03kdvr8hxi6isb8yxp5rgcmz855n19m1yacn3d56a4i58j2mldjw";
+        # upstream PR: https://github.com/james-preston/hail/pull/16
+        url = "https://patch-diff.githubusercontent.com/raw/james-preston/hail/pull/16.patch";
+        sha256 = "0dpagpn654zjrlklihsg911lmxjj8msylbm3c68xa5aad1s9gcf7";
       })
     ];
   });
diff --git a/third_party/nixpkgs/pkgs/development/haskell-modules/configuration-hackage2nix.yaml b/third_party/nixpkgs/pkgs/development/haskell-modules/configuration-hackage2nix.yaml
index 4328d6a758..2c7af6097c 100644
--- a/third_party/nixpkgs/pkgs/development/haskell-modules/configuration-hackage2nix.yaml
+++ b/third_party/nixpkgs/pkgs/development/haskell-modules/configuration-hackage2nix.yaml
@@ -5717,7 +5717,6 @@ broken-packages:
   - Haggressive
   - hahp
   - haiji
-  - hail
   - hailgun-send
   - hairy
   - hakaru
diff --git a/third_party/nixpkgs/pkgs/development/interpreters/evcxr/default.nix b/third_party/nixpkgs/pkgs/development/interpreters/evcxr/default.nix
index 11b9cd1ba5..a97f132b3b 100644
--- a/third_party/nixpkgs/pkgs/development/interpreters/evcxr/default.nix
+++ b/third_party/nixpkgs/pkgs/development/interpreters/evcxr/default.nix
@@ -2,22 +2,30 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "evcxr";
-  version = "0.5.3";
+  version = "0.6.0";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "evcxr";
     rev = "v${version}";
-    sha256 = "144xqi19d2nj9qgmhpx6d1kfhx9vfkmk7rnq6nzybpx4mbbl3ki2";
+    sha256 = "sha256-QpUhUE65/IuT/VenziPX6z+CbJswbPPIv/ZnTthZpEU=";
   };
 
-  cargoSha256 = "07lzxh0wh6azrlzfaacg29zmkn8jdnkdqbwgd5ajy79y8nii3c7z";
+  cargoSha256 = "sha256-iUzVd4XtD+41yTV/BmqWLenzAUNPfS7vIHm1KfuPe9A=";
+
+  RUST_SRC_PATH = "${rustPlatform.rustLibSrc}";
 
   nativeBuildInputs = [ pkgconfig makeWrapper cmake ];
   buildInputs = stdenv.lib.optional stdenv.isDarwin Security;
-  postInstall = ''
-    wrapProgram $out/bin/evcxr --prefix PATH : ${stdenv.lib.makeBinPath [ cargo gcc ]}
-    wrapProgram $out/bin/evcxr_jupyter --prefix PATH : ${stdenv.lib.makeBinPath [ cargo gcc ]}
+  postInstall = let
+    wrap = exe: ''
+      wrapProgram $out/bin/${exe} \
+        --prefix PATH : ${stdenv.lib.makeBinPath [ cargo gcc ]} \
+        --set-default RUST_SRC_PATH "$RUST_SRC_PATH"
+    '';
+  in ''
+    ${wrap "evcxr"}
+    ${wrap "evcxr_jupyter"}
     rm $out/bin/testing_runtime
   '';
 
diff --git a/third_party/nixpkgs/pkgs/development/libraries/armadillo/default.nix b/third_party/nixpkgs/pkgs/development/libraries/armadillo/default.nix
index a306a02be0..450182138a 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/armadillo/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/armadillo/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "armadillo";
-  version = "10.1.1";
+  version = "10.1.2";
 
   src = fetchurl {
     url = "mirror://sourceforge/arma/armadillo-${version}.tar.xz";
-    sha256 = "13hwynp1dnk3flw8ly00wjj12x2wsvj2da39bzay8c08m3dj3q4m";
+    sha256 = "0pb3ypdaiiw0895x1zzzjvkrfp39bsl3s4f6zb5bzv4wbjv7kvwn";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/third_party/nixpkgs/pkgs/development/libraries/ayatana-ido/default.nix b/third_party/nixpkgs/pkgs/development/libraries/ayatana-ido/default.nix
index 7b24f08822..127fe1c975 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/ayatana-ido/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/ayatana-ido/default.nix
@@ -5,13 +5,13 @@
 
 stdenv.mkDerivation rec {
   pname = "ayatana-ido";
-  version = "0.8.0";
+  version = "0.8.1";
 
   src = fetchFromGitHub {
     owner = "AyatanaIndicators";
     repo = pname;
     rev = version;
-    sha256 = "1jmdvvgrgicpnpnygc24qcisqb9y026541gb6lw6fwapvc9aj73p";
+    sha256 = "1mcw6gmacrzx4cyg4223dpwcmj3qf8l30mxsg43292lajzwsm2hz";
   };
 
   nativeBuildInputs = [ pkg-config autoreconfHook gtk-doc vala gobject-introspection ];
diff --git a/third_party/nixpkgs/pkgs/development/libraries/drumstick/default.nix b/third_party/nixpkgs/pkgs/development/libraries/drumstick/default.nix
index 7cd826b1fe..5cef17f111 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/drumstick/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/drumstick/default.nix
@@ -1,5 +1,6 @@
-{ stdenv, fetchurl, alsaLib, cmake, docbook_xsl, docbook_xml_dtd_45, doxygen
-, fluidsynth, pkgconfig, qtbase, qtsvg
+{ stdenv, fetchurl
+, cmake, docbook_xml_dtd_45, docbook_xsl, doxygen, pkg-config, wrapQtAppsHook
+, alsaLib, fluidsynth, qtbase, qtsvg, libpulseaudio
 }:
 
 stdenv.mkDerivation rec {
@@ -11,18 +12,25 @@ stdenv.mkDerivation rec {
     sha256 = "1n9wvg79yvkygrkc8xd8pgrd3d7hqmr7gh24dccf0px23lla9b3m";
   };
 
+  patches = [
+    ./drumstick-fluidsynth.patch
+    ./drumstick-plugins.patch
+  ];
+
+  postPatch = ''
+    substituteInPlace library/rt/backendmanager.cpp --subst-var out
+  '';
+
   outputs = [ "out" "dev" "man" ];
 
   enableParallelBuilding = true;
 
-  #Temporarily remove drumstick-piano; Gives segment fault. Submitted ticket
-  postInstall = ''
-    rm $out/bin/drumstick-vpiano
-    '';
+  nativeBuildInputs = [
+    cmake docbook_xml_dtd_45 docbook_xml_dtd_45 docbook_xsl doxygen pkg-config wrapQtAppsHook
+  ];
 
-  nativeBuildInputs = [ cmake pkgconfig docbook_xsl docbook_xml_dtd_45 docbook_xml_dtd_45 ];
   buildInputs = [
-    alsaLib doxygen fluidsynth qtbase qtsvg
+    alsaLib fluidsynth libpulseaudio qtbase qtsvg
   ];
 
   meta = with stdenv.lib; {
diff --git a/third_party/nixpkgs/pkgs/development/libraries/drumstick/drumstick-fluidsynth.patch b/third_party/nixpkgs/pkgs/development/libraries/drumstick/drumstick-fluidsynth.patch
new file mode 100644
index 0000000000..b8cdf63fb6
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/development/libraries/drumstick/drumstick-fluidsynth.patch
@@ -0,0 +1,9 @@
+It works with fluidsynth 2.
+
+Backported from r400: https://sourceforge.net/p/drumstick/code/400/
+
+--- a/library/rt-backends/CMakeLists.txt
++++ b/library/rt-backends/CMakeLists.txt
+@@ -54,1 +54,1 @@ if (PKG_CONFIG_FOUND)
+-    pkg_check_modules(FLUIDSYNTH fluidsynth>=1.1.1 fluidsynth<=1.1.11)
++    pkg_check_modules(FLUIDSYNTH fluidsynth>=1.1.1)
diff --git a/third_party/nixpkgs/pkgs/development/libraries/drumstick/drumstick-plugins.patch b/third_party/nixpkgs/pkgs/development/libraries/drumstick/drumstick-plugins.patch
new file mode 100644
index 0000000000..cbb0a0e348
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/development/libraries/drumstick/drumstick-plugins.patch
@@ -0,0 +1,12 @@
+Make it look for its plugin in its own installation directory.
+
+--- a/library/rt/backendmanager.cpp
++++ b/library/rt/backendmanager.cpp
+@@ -159,6 +159,7 @@ namespace rt {
+         foreach(const QString& path, QCoreApplication::libraryPaths()) {
+             d->appendDir( path + QDir::separator() + QSTR_DRUMSTICK, result );
+         }
++        d->appendDir( "@out@/lib/drumstick", result );
+         return result;
+     }
+ 
diff --git a/third_party/nixpkgs/pkgs/development/libraries/libcef/default.nix b/third_party/nixpkgs/pkgs/development/libraries/libcef/default.nix
index 4d08c2ba1f..93aaebc110 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/libcef/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/libcef/default.nix
@@ -15,12 +15,12 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "cef-binary";
-  version = "74.1.14-g50c3c5c";
+  version = "75.1.14-gc81164e";
 
   src = fetchurl {
-    name = "cef_binary_74.1.14+g50c3c5c+chromium-74.0.3729.131_linux64_minimal.tar.bz2";
-    url = "http://opensource.spotify.com/cefbuilds/cef_binary_74.1.19%2Bgb62bacf%2Bchromium-74.0.3729.157_linux64_minimal.tar.bz2";
-    sha256 = "0v3540kq4y68gq7mb4d8a9issm363lm5ngrd6d96pcc7vckkw4wn";
+    name = "cef_binary_75.1.14+gc81164e+chromium-75.0.3770.100_linux64_minimal.tar.bz2";
+    url = "http://opensource.spotify.com/cefbuilds/cef_binary_75.1.14%2Bgc81164e%2Bchromium-75.0.3770.100_linux64_minimal.tar.bz2";
+    sha256 = "0985b2bx505j0q693hifjgidzb597wqf5idql5aqxs8lfxhc2pgg";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/third_party/nixpkgs/pkgs/development/libraries/libplacebo/default.nix b/third_party/nixpkgs/pkgs/development/libraries/libplacebo/default.nix
index 0b36efa189..ac8552fa9e 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/libplacebo/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/libplacebo/default.nix
@@ -15,24 +15,16 @@
 
 stdenv.mkDerivation rec {
   pname = "libplacebo";
-  version = "2.72.0";
+  version = "2.72.2";
 
   src = fetchFromGitLab {
     domain = "code.videolan.org";
     owner = "videolan";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1yhf9xyxdawbihsx89dpjlac800wrmpwx63rphad2nj225y9q40f";
+    sha256 = "1ijqpx1pagc6qg63ynqrinvckwc8aaw1i0lx48gg5szwk8afib4i";
   };
 
-  patches = [
-    # to work with latest glslang, remove on release >2.72.0
-    (fetchpatch {
-      url = "https://code.videolan.org/videolan/libplacebo/-/commit/523056828ab86c2f17ea65f432424d48b6fdd389.patch";
-      sha256 = "051vhd0l3yad1fzn5zayi08kqs9an9j8p7m63kgqyfv1ksnydpcs";
-    })
-  ];
-
   nativeBuildInputs = [
     meson
     ninja
diff --git a/third_party/nixpkgs/pkgs/development/libraries/opencascade-occt/default.nix b/third_party/nixpkgs/pkgs/development/libraries/opencascade-occt/default.nix
index 42ca50ae8f..ac2b8ba6d1 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/opencascade-occt/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/opencascade-occt/default.nix
@@ -3,13 +3,13 @@
 
 stdenv.mkDerivation rec {
   pname = "opencascade-occt";
-  version = "7.4.0p1";
+  version = "7.5.0";
   commit = "V${builtins.replaceStrings ["."] ["_"] version}";
 
   src = fetchurl {
     name = "occt-${commit}.tar.gz";
     url = "https://git.dev.opencascade.org/gitweb/?p=occt.git;a=snapshot;h=${commit};sf=tgz";
-    sha256 = "0b9hs3akx1f3hhg4zdip6qdv04ssqqcf9kk12amkidgvsl73z2hs";
+    sha256 = "0bpzpaqki3k6i7xmhan0f1c1fr05smpcmgrp4vh572j61lwpq1r3";
   };
 
   nativeBuildInputs = [ cmake ninja ];
diff --git a/third_party/nixpkgs/pkgs/development/libraries/soundtouch/default.nix b/third_party/nixpkgs/pkgs/development/libraries/soundtouch/default.nix
index 71c7915c2e..b29095f7e1 100644
--- a/third_party/nixpkgs/pkgs/development/libraries/soundtouch/default.nix
+++ b/third_party/nixpkgs/pkgs/development/libraries/soundtouch/default.nix
@@ -2,23 +2,26 @@
 
 stdenv.mkDerivation rec {
   pname = "soundtouch";
-  version = "2.1.2";
+  version = "2.2";
 
   src = fetchFromGitLab {
     owner = pname;
     repo = pname;
     rev = version;
-    sha256 = "174wgm3s0inmbnkrlnspxjwm2014qhjhkbdqa5r8rbfi0nzqxzsz";
+    sha256 = "12i6yg8vvqwyk412lxl2krbfby6hnxld8qxy0k4m5xp4g94jiq4p";
   };
 
   nativeBuildInputs = [ autoconf automake libtool ];
 
   preConfigure = "./bootstrap";
 
+  enableParallelBuilding = true;
+
   meta = with lib; {
     description = "A program and library for changing the tempo, pitch and playback rate of audio";
-    homepage = "http://www.surina.net/soundtouch/";
-    license = licenses.lgpl21;
+    homepage = "https://www.surina.net/soundtouch/";
+    license = licenses.lgpl21Plus;
     platforms = platforms.all;
+    maintainers = with maintainers; [ orivej ];
   };
 }
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/bitstring/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/bitstring/default.nix
index 23f4257a35..a2ba5b1026 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/bitstring/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/bitstring/default.nix
@@ -2,12 +2,11 @@
 
 buildPythonPackage rec {
   pname = "bitstring";
-  version = "3.1.5";
+  version = "3.1.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1algq30j6rz12b1902bpw7iijx5lhrfqhl80d4ac6xzkrrpshqy1";
-    extension = "zip";
+    sha256 = "0jl6192dwrlm5ybkbh7ywmyaymrc3cmz9y07nm7qdli9n9rfpwzx";
   };
 
   meta = with stdenv.lib; {
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/fastecdsa/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/fastecdsa/default.nix
new file mode 100644
index 0000000000..04d9da87c5
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/development/python-modules/fastecdsa/default.nix
@@ -0,0 +1,40 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, gmp
+, pytestCheckHook
+}:
+
+buildPythonPackage rec {
+  pname = "fastecdsa";
+  version = "2.1.5";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "d0772f7fe243e8a82d33e95c542ea6cc0ef7f3cfcced7440d6defa71a35addfa";
+  };
+
+  buildInputs = [ gmp ];
+
+  checkInputs = [ pytestCheckHook ];
+
+  # skip tests which require being online to download test vectors
+  pytestFlags = [
+     "--ignore=fastecdsa/tests/test_wycheproof_vectors.py"
+     "--ignore=fastecdsa/tests/test_rfc6979_ecdsa.py"
+  ];
+
+  # skip tests for now, they fail with
+  # ImportError: cannot import name '_ecdsa' from 'fastecdsa'
+  # but the installed package works just fine
+  doCheck = false;
+
+  pythonImportsCheck = [ "fastecdsa" ];
+
+  meta = with lib; {
+    description = "Fast elliptic curve digital signatures";
+    homepage = "https://github.com/AntonKueltz/fastecdsa";
+    license = licenses.unlicense;
+    maintainers = with maintainers; [ prusnak ];
+  };
+}
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/setuptools-rust/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/setuptools-rust/default.nix
index b04fa39149..84465cd475 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/setuptools-rust/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/setuptools-rust/default.nix
@@ -10,13 +10,13 @@
 
 buildPythonPackage rec {
   pname = "setuptools-rust";
-  version = "0.11.4";
+  version = "0.11.5";
 
   disabled = isPy27;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "9714fcb94c78e6ab1864ddac7750049e105fd4f7c52103aecf40d408e94a722f";
+    sha256 = "04ea21f1bd029046fb87d098be4d7dc74663a58dd1f9fc6edcf8f3e4123ec4a8";
   };
 
   nativeBuildInputs = [ setuptools_scm ];
diff --git a/third_party/nixpkgs/pkgs/development/python-modules/urwidtrees/default.nix b/third_party/nixpkgs/pkgs/development/python-modules/urwidtrees/default.nix
index 1b5c58b9ca..c441d93f6f 100644
--- a/third_party/nixpkgs/pkgs/development/python-modules/urwidtrees/default.nix
+++ b/third_party/nixpkgs/pkgs/development/python-modules/urwidtrees/default.nix
@@ -3,21 +3,29 @@
 , fetchFromGitHub
 , glibcLocales
 , urwid
+, fetchpatch
 }:
 
 buildPythonPackage rec {
   pname = "urwidtrees";
-  version  = "1.0.2";
+  version  = "1.0.3";
 
   src = fetchFromGitHub {
     owner = "pazz";
     repo = "urwidtrees";
     rev = version;
-    sha256 = "1n1kpidvkdnsqyb82vlvk78gmly96kh8351lqxn2pzgwwns6fml2";
+    sha256 = "sha256-yGSjwagCd5TiwEFtF6ZhDuVqj4PTa5pVXhs8ebr2O/g=";
   };
 
   propagatedBuildInputs = [ urwid ];
 
+  patches = [
+    (fetchpatch {
+      url = "https://github.com/pazz/urwidtrees/commit/ed39dbc4fc67b0e0249bf108116a88cd18543aa9.patch";
+    sha256 = "sha256-fA+30d2uVaoNCg4rtoWLNPvrZtq41Co4vcmM80hkURs=";
+    })
+  ];
+
   checkInputs = [ glibcLocales ];
   LC_ALL="en_US.UTF-8";
 
diff --git a/third_party/nixpkgs/pkgs/development/tools/misc/terraformer/default.nix b/third_party/nixpkgs/pkgs/development/tools/misc/terraformer/default.nix
index 6ff0dd77aa..07333d7e24 100644
--- a/third_party/nixpkgs/pkgs/development/tools/misc/terraformer/default.nix
+++ b/third_party/nixpkgs/pkgs/development/tools/misc/terraformer/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "terraformer";
-  version = "0.8.8";
+  version = "0.8.9";
 
   src = fetchFromGitHub {
     owner = "GoogleCloudPlatform";
     repo = pname;
     rev = version;
-    sha256 = "1lzf30vpa0blbkz4ngnhrn3hpbqflqd4sni4bly9yqh4fnc44nvi";
+    sha256 = "11j7yra0qbjadg4cb57qbdxf0di7crfv0aqam6gc1zng3fzlh4w9";
   };
 
-  vendorSha256 = "087448wkaw6jxv9d26hck4w3vdh06vcgywna6ydkqvxr0hp011b6";
+  vendorSha256 = "1lsg5svdnmqiradpr4h2420y5jmml3af8pp0np1735n3wh1q1blh";
 
   subPackages = [ "." ];
 
diff --git a/third_party/nixpkgs/pkgs/development/tools/sd-local/default.nix b/third_party/nixpkgs/pkgs/development/tools/sd-local/default.nix
index 06f6c08fee..54200c1571 100644
--- a/third_party/nixpkgs/pkgs/development/tools/sd-local/default.nix
+++ b/third_party/nixpkgs/pkgs/development/tools/sd-local/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "sd-local";
-  version = "1.0.5";
+  version = "1.0.12";
 
   src = fetchFromGitHub {
     owner = "screwdriver-cd";
     repo = pname;
     rev = "v${version}";
-    sha256 = "09j1wcx66sz2b0pps0bgbay5x06lc0d2awxjvd5zi8wqnbsrdq60";
+    sha256 = "1amj5qsnxf6ya2l5rigjia5qis8i7q0qnd9ci74r721nj95m9jvr";
   };
 
-  vendorSha256 = "1qy51jx181rwim2v53ysgf7rys0nmxsbawvsbh3z1ihh3dlgw5bc";
+  vendorSha256 = "1y4nyw7rpgipblxqaps2zsd07cin8d0i0g9gvsnc3vifi6g29s8z";
 
   subPackages = [ "." ];
 
diff --git a/third_party/nixpkgs/pkgs/development/tools/skaffold/default.nix b/third_party/nixpkgs/pkgs/development/tools/skaffold/default.nix
index d0b0bff05b..e00bed4511 100644
--- a/third_party/nixpkgs/pkgs/development/tools/skaffold/default.nix
+++ b/third_party/nixpkgs/pkgs/development/tools/skaffold/default.nix
@@ -2,7 +2,7 @@
 
 buildGoPackage rec {
   pname = "skaffold";
-  version = "1.15.0";
+  version = "1.16.0";
 
   goPackagePath = "github.com/GoogleContainerTools/skaffold";
   subPackages = ["cmd/skaffold"];
@@ -19,7 +19,7 @@ buildGoPackage rec {
     owner = "GoogleContainerTools";
     repo = "skaffold";
     rev = "v${version}";
-    sha256 = "0cir9ld61pq1rziw6vyz1ihkq0aylzrsxg1vqb9544rwnbq7z2qs";
+    sha256 = "18v1s1k05bq38aljazvpxvp543xchy9h4n531pis4w4jl47n387f";
   };
 
   nativeBuildInputs = [ installShellFiles ];
diff --git a/third_party/nixpkgs/pkgs/development/tools/trellis/default.nix b/third_party/nixpkgs/pkgs/development/tools/trellis/default.nix
index 21f14adc2f..89287b2ac4 100644
--- a/third_party/nixpkgs/pkgs/development/tools/trellis/default.nix
+++ b/third_party/nixpkgs/pkgs/development/tools/trellis/default.nix
@@ -8,26 +8,26 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "trellis";
-  version = "2020.07.27";
+  version = "2020.11.07";
 
   # git describe --tags
   realVersion = with stdenv.lib; with builtins;
-    "1.0-182-g${substring 0 7 (elemAt srcs 0).rev}";
+    "1.0-469-g${substring 0 7 (elemAt srcs 0).rev}";
 
   srcs = [
     (fetchFromGitHub {
        owner  = "SymbiFlow";
        repo   = "prjtrellis";
-       rev    = "8c0a6382e11b160ed88d17af8493c12a897617ed";
-       sha256 = "1g0ppjfw8dq5cg5kl2p1p87grb0i88apaim4f5b6wj4sfqz8iln8";
+       rev    = "b013a135a9b95c18ece559e19aa73ad6c84446c9";
+       sha256 = "09bx30jm9bgdxmbxf49a27spg4yd1nk5r5mympq7xi28hq1xwjnf";
        name   = "trellis";
      })
 
     (fetchFromGitHub {
       owner  = "SymbiFlow";
       repo   = "prjtrellis-db";
-      rev    = "c137076fdd8bfca3d2bf9cdacda9983dbbec599a";
-      sha256 = "1br0vw8wwcn2qhs8kxkis5xqlr2nw7r3mf1qwjp8xckd6fa1wlcw";
+      rev    = "2cf058e7a3ba36134d21e34823e9b2ecaaceac2c";
+      sha256 = "1hjaw5jkwiaiznm2z0smy88m2cdz63cd51z4nibajfih7ikvkj6g";
       name   = "trellis-database";
     })
   ];
diff --git a/third_party/nixpkgs/pkgs/games/empty-epsilon/default.nix b/third_party/nixpkgs/pkgs/games/empty-epsilon/default.nix
index 098ed35406..c006adcb27 100644
--- a/third_party/nixpkgs/pkgs/games/empty-epsilon/default.nix
+++ b/third_party/nixpkgs/pkgs/games/empty-epsilon/default.nix
@@ -4,7 +4,7 @@ let
 
   major = "2020";
   minor = "08";
-  patch = "07";
+  patch = "25";
 
   version = "${major}.${minor}.${patch}";
 
@@ -16,7 +16,7 @@ let
       owner = "daid";
       repo = "SeriousProton";
       rev = "EE-${version}";
-      sha256 = "1mfizhmwh6xgb5n34l3wrbxm21f7gsvsyacsmnxw9rkz0ya7ch30";
+      sha256 = "sha256-LiMEgsUpNBtduFO85ct6NYr/Smbzd8yE8Vce3voErLY=";
     };
 
     nativeBuildInputs = [ cmake ];
@@ -42,7 +42,7 @@ stdenv.mkDerivation {
     owner = "daid";
     repo = "EmptyEpsilon";
     rev = "EE-${version}";
-    sha256 = "0p41wx9yk09xjmfkjpdgi3b2999ps2am3xqwd866q11f6ci7viv5";
+    sha256 = "sha256-3QREWTq1Jq9T/FtGFVU4MidZeUQvRSVChn9JKxv2SiQ=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/third_party/nixpkgs/pkgs/misc/drivers/epson-escpr2/default.nix b/third_party/nixpkgs/pkgs/misc/drivers/epson-escpr2/default.nix
index 0fdf7ecf96..afde25ee6b 100644
--- a/third_party/nixpkgs/pkgs/misc/drivers/epson-escpr2/default.nix
+++ b/third_party/nixpkgs/pkgs/misc/drivers/epson-escpr2/default.nix
@@ -2,7 +2,7 @@
 
 stdenv.mkDerivation rec {
   pname = "epson-inkjet-printer-escpr2";
-  version = "1.1.23";
+  version = "1.1.24";
 
   src = fetchurl {
     # To find new versions, visit
@@ -11,10 +11,10 @@ stdenv.mkDerivation rec {
     # version.  
     # NOTE: Don't forget to update the webarchive link too!
     urls = [
-      "https://download3.ebz.epson.net/dsc/f/03/00/12/04/34/22448566e405c21c3f4436dfd8927176add3e680/epson-inkjet-printer-escpr2-1.1.23-1lsb3.2.src.rpm"
-      "https://web.archive.org/web/20201019154323if_/https://download3.ebz.epson.net/dsc/f/03/00/12/04/34/22448566e405c21c3f4436dfd8927176add3e680/epson-inkjet-printer-escpr2-1.1.23-1lsb3.2.src.rpm"
+      "https://download3.ebz.epson.net/dsc/f/03/00/12/09/63/b7d2bb6a97c9ad99a96ebc68f8abcb1254888e94/epson-inkjet-printer-escpr2-1.1.24-1lsb3.2.src.rpm"
+      "https://web.archive.org/web/20201112163802if_/https://download3.ebz.epson.net/dsc/f/03/00/12/09/63/b7d2bb6a97c9ad99a96ebc68f8abcb1254888e94/epson-inkjet-printer-escpr2-1.1.24-1lsb3.2.src.rpm"
     ];
-    sha256 = "1d5zd8cwgp3n25ramdqwqb770iim7kh4l7hmhf6a6ivpy0cxpwx6";
+    sha256 = "sha256-DPzjKKsTWbfDk1MsVPXNsO5D7C/RiNegmwq2sEMx2co=";
   };
 
   patches = [ ./cups-filter-ppd-dirs.patch ];
diff --git a/third_party/nixpkgs/pkgs/os-specific/linux/kernel/linux-mptcp-94.nix b/third_party/nixpkgs/pkgs/os-specific/linux/kernel/linux-mptcp-94.nix
deleted file mode 100644
index e53c3ceb5c..0000000000
--- a/third_party/nixpkgs/pkgs/os-specific/linux/kernel/linux-mptcp-94.nix
+++ /dev/null
@@ -1,26 +0,0 @@
-{ stdenv, buildPackages, fetchFromGitHub, perl, buildLinux, structuredExtraConfig ? {}, ... } @ args:
-let
-  mptcpVersion = "0.94.6";
-  modDirVersion = "4.14.127";
-in
-buildLinux ({
-  version = "${modDirVersion}-mptcp_v${mptcpVersion}";
-  inherit modDirVersion;
-
-  extraMeta = {
-    branch = "4.4";
-    maintainers = with stdenv.lib.maintainers; [ teto layus ];
-  };
-
-  src = fetchFromGitHub {
-    owner = "multipath-tcp";
-    repo = "mptcp";
-    rev = "v${mptcpVersion}";
-    sha256 = "071cx9205wpzhi5gc2da79w2abs3czd60jg0xml7j1szc5wl4yfn";
-  };
-
-  structuredExtraConfig = stdenv.lib.mkMerge [
-    (import ./mptcp-config.nix { inherit stdenv; })
-    structuredExtraConfig
-  ];
-} // args)
diff --git a/third_party/nixpkgs/pkgs/os-specific/linux/microcode/intel.nix b/third_party/nixpkgs/pkgs/os-specific/linux/microcode/intel.nix
index 475288a0b6..8a975b4fb3 100644
--- a/third_party/nixpkgs/pkgs/os-specific/linux/microcode/intel.nix
+++ b/third_party/nixpkgs/pkgs/os-specific/linux/microcode/intel.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "microcode-intel";
-  version = "20200616";
+  version = "20201110";
 
   src = fetchFromGitHub {
     owner = "intel";
     repo = "Intel-Linux-Processor-Microcode-Data-Files";
     rev = "microcode-${version}";
-    sha256 = "13jrs8hwh7dhjjb9kncb8lk199afaxglkh1cfisl6zca1h36g563";
+    sha256 = "03a89mh5f8zwwg750pahr25qagkjh2rw27bm28vp0586hrd36ll6";
   };
 
   nativeBuildInputs = [ iucode-tool libarchive ];
diff --git a/third_party/nixpkgs/pkgs/os-specific/linux/wireguard/default.nix b/third_party/nixpkgs/pkgs/os-specific/linux/wireguard/default.nix
index ef81dd54a7..25a59b14ab 100644
--- a/third_party/nixpkgs/pkgs/os-specific/linux/wireguard/default.nix
+++ b/third_party/nixpkgs/pkgs/os-specific/linux/wireguard/default.nix
@@ -7,17 +7,13 @@ assert stdenv.lib.versionOlder kernel.version "5.6";
 
 stdenv.mkDerivation rec {
   pname = "wireguard";
-  version = "1.0.20200908";
+  version = "1.0.20201112";
 
   src = fetchzip {
     url = "https://git.zx2c4.com/wireguard-linux-compat/snapshot/wireguard-linux-compat-${version}.tar.xz";
-    sha256 = "1nd2kc3c62907kxm1084dw7krd8xsy3hxydmcpz4jvk03vm5dnkg";
+    sha256 = "sha256-HnYvjZ3VUH79NwNIvyTTygWYbVqEL2ttvlOlLiHhb5s=";
   };
 
-  patches = [
-    ./linux-5.4.76-fix.patch
-  ];
-
   hardeningDisable = [ "pic" ];
 
   KERNELDIR = "${kernel.dev}/lib/modules/${kernel.modDirVersion}/build";
diff --git a/third_party/nixpkgs/pkgs/os-specific/linux/wireguard/linux-5.4.76-fix.patch b/third_party/nixpkgs/pkgs/os-specific/linux/wireguard/linux-5.4.76-fix.patch
deleted file mode 100644
index 78c3365bcb..0000000000
--- a/third_party/nixpkgs/pkgs/os-specific/linux/wireguard/linux-5.4.76-fix.patch
+++ /dev/null
@@ -1,12 +0,0 @@
-diff -u -r wireguard-linux-compat-1.0.20200908/src/compat/compat-asm.h wireguard-linux-compat-1.0.20200908-lts/src/compat/compat-asm.h
---- wireguard-linux-compat-1.0.20200908/src/compat/compat-asm.h	2020-09-08 16:22:40.000000000 +0000
-+++ wireguard-linux-compat-1.0.20200908-lts/src/compat/compat-asm.h	2020-11-10 15:05:43.720093522 +0000
-@@ -40,7 +40,7 @@
- #undef pull
- #endif
- 
--#if LINUX_VERSION_CODE < KERNEL_VERSION(5, 5, 0)
-+#if LINUX_VERSION_CODE < KERNEL_VERSION(5, 4, 76)
- #define SYM_FUNC_START ENTRY
- #define SYM_FUNC_END ENDPROC
- #endif
diff --git a/third_party/nixpkgs/pkgs/servers/bazarr/default.nix b/third_party/nixpkgs/pkgs/servers/bazarr/default.nix
index f220f4002a..2a835c346c 100644
--- a/third_party/nixpkgs/pkgs/servers/bazarr/default.nix
+++ b/third_party/nixpkgs/pkgs/servers/bazarr/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "bazarr";
-  version = "0.9.0.5";
+  version = "0.9.0.6";
 
   src = fetchurl {
     url = "https://github.com/morpheus65535/bazarr/archive/v${version}.tar.gz";
-    sha256 = "1mm8qghkif48jr7fq28kp7zk5x71zm43isf0a96crpi9qi91sdd5";
+    sha256 = "1mgvsi8y3camj215vnbw20f1z6jvpbyrj1hrcj4szxfcjkxdg2hv";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/third_party/nixpkgs/pkgs/servers/mail/postfix/default.nix b/third_party/nixpkgs/pkgs/servers/mail/postfix/default.nix
index 9aee89db9b..a4346bdbd2 100644
--- a/third_party/nixpkgs/pkgs/servers/mail/postfix/default.nix
+++ b/third_party/nixpkgs/pkgs/servers/mail/postfix/default.nix
@@ -1,6 +1,6 @@
 { stdenv, lib, fetchurl, makeWrapper, gnused, db, openssl, cyrus_sasl, libnsl
 , coreutils, findutils, gnugrep, gawk, icu, pcre, m4
-, buildPackages
+, buildPackages, nixosTests
 , withLDAP ? true, openldap
 , withPgSQL ? false, postgresql
 , withMySQL ? false, libmysqlclient
@@ -96,6 +96,8 @@ in stdenv.mkDerivation rec {
       --prefix PATH ":" ${lib.makeBinPath [ coreutils findutils gnugrep gawk gnused ]}
   '';
 
+  passthru.tests = { inherit (nixosTests) postfix postfix-raise-smtpd-tls-security-level; };
+
   meta = with lib; {
     homepage = "http://www.postfix.org/";
     description = "A fast, easy to administer, and secure mail server";
diff --git a/third_party/nixpkgs/pkgs/servers/traefik/default.nix b/third_party/nixpkgs/pkgs/servers/traefik/default.nix
index bc0f052adc..dffb92326b 100644
--- a/third_party/nixpkgs/pkgs/servers/traefik/default.nix
+++ b/third_party/nixpkgs/pkgs/servers/traefik/default.nix
@@ -2,15 +2,15 @@
 
 buildGoModule rec {
   pname = "traefik";
-  version = "2.3.1";
+  version = "2.3.2";
 
   src = fetchzip {
     url = "https://github.com/traefik/traefik/releases/download/v${version}/traefik-v${version}.src.tar.gz";
-    sha256 = "09328yb6pbrikd1dljmf6spg177w1ymqk1i2152m5srd39mc6ixv";
+    sha256 = "1h8wflkzjzz0nr81d99f8vksihqa6q4vmkqq40170a8js06fgizx";
     stripRoot = false;
   };
 
-  vendorSha256 = "026yxahwvbw41vf7yfycwmw797fpw19g1nyi1wcxkkkw383v7dsk";
+  vendorSha256 = "16y6cyw4xipadwz7wlzl55sn81by9hc37crf143dfb4c3kmwb581";
 
   doCheck = false;
 
diff --git a/third_party/nixpkgs/pkgs/servers/web-apps/rss-bridge/default.nix b/third_party/nixpkgs/pkgs/servers/web-apps/rss-bridge/default.nix
index 73c2fcce34..13ad9d69ad 100644
--- a/third_party/nixpkgs/pkgs/servers/web-apps/rss-bridge/default.nix
+++ b/third_party/nixpkgs/pkgs/servers/web-apps/rss-bridge/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "rss-bridge";
-  version = "2020-02-26";
+  version = "2020-11-10";
 
   src = fetchFromGitHub {
     owner = "RSS-Bridge";
     repo = "rss-bridge";
     rev = version;
-    sha256 = "075k4bylx9308d083ry5a9q4629ccnrnndqqdqp1g42rzlqrw79q";
+    sha256 = "00cp61lqvhi7b7j0rglsqg3l7cg8s9b8vq098bgvg5dygyi44hyv";
   };
 
   patchPhase = ''
diff --git a/third_party/nixpkgs/pkgs/tools/admin/ssmsh/default.nix b/third_party/nixpkgs/pkgs/tools/admin/ssmsh/default.nix
new file mode 100644
index 0000000000..03fa9156aa
--- /dev/null
+++ b/third_party/nixpkgs/pkgs/tools/admin/ssmsh/default.nix
@@ -0,0 +1,26 @@
+{ stdenv, buildGoModule, fetchFromGitHub }:
+
+buildGoModule rec {
+  pname = "ssmsh";
+  version = "1.4.3";
+
+  src = fetchFromGitHub {
+    owner = "bwhaley";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "0rvvawn4cavqhbrrp616mi5ipn4q6j22227h4rbjh0zxdlna23gm";
+  };
+
+  vendorSha256 = "127xni0i7w42075bspmm5r61j858i1p59jr2ib8f9r1pbizh63xw";
+
+  doCheck = true;
+
+  buildFlagsArray = [ "-ldflags=-w -s -X main.Version=${version}" ];
+
+  meta = with stdenv.lib; {
+    homepage = "https://github.com/bwhaley/ssmsh";
+    description = "An interactive shell for AWS Parameter Store";
+    license = licenses.mit;
+    maintainers = with maintainers; [ dbirks ];
+  };
+}
diff --git a/third_party/nixpkgs/pkgs/tools/graphics/vips/default.nix b/third_party/nixpkgs/pkgs/tools/graphics/vips/default.nix
index eb5afebaa6..c85e895812 100644
--- a/third_party/nixpkgs/pkgs/tools/graphics/vips/default.nix
+++ b/third_party/nixpkgs/pkgs/tools/graphics/vips/default.nix
@@ -26,7 +26,7 @@
 
 stdenv.mkDerivation rec {
   pname = "vips";
-  version = "8.10.1";
+  version = "8.10.2";
 
   outputs = [ "bin" "out" "man" "dev" ];
 
@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
     owner = "libvips";
     repo = "libvips";
     rev = "v${version}";
-    sha256 = "0zfhp86vbxs5qdnjy8hvdcjslfkafvd3s3rjr2dppwm0iz4gdbfx";
+    sha256 = "1psi39a4h0awwbyizbsk467z0djwq0rh8hvkklbsd5b92m7768sp";
     # Remove unicode file names which leads to different checksums on HFS+
     # vs. other filesystems because of unicode normalisation.
     extraPostFetch = ''
diff --git a/third_party/nixpkgs/pkgs/tools/graphics/viu/default.nix b/third_party/nixpkgs/pkgs/tools/graphics/viu/default.nix
index a434b38453..39b12326e8 100644
--- a/third_party/nixpkgs/pkgs/tools/graphics/viu/default.nix
+++ b/third_party/nixpkgs/pkgs/tools/graphics/viu/default.nix
@@ -2,18 +2,18 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "viu";
-  version = "1.1";
+  version = "1.2.1";
 
   src = fetchFromGitHub {
     owner = "atanunq";
     repo = "viu";
     rev = "v${version}";
-    sha256 = "1algvndpl63g3yzp3hhbgm7839njpbmw954nsiwf0j591spz4lph";
+    sha256 = "1q248jnbv64mkvg18465dpvjkw2v2hfqyvdvdixyrwyrnlv5cicv";
   };
   # tests are failing, reported at upstream: https://github.com/atanunq/viu/issues/40
   doCheck = false;
 
-  cargoSha256 = "1jccaln72aqa9975nbs95gimndqx5kgfkjmh40z6chx1hvn4m2ga";
+  cargoSha256 = "18rskn8fchlgk295yk8sc2g1x6h43rmhqif871hgzdx1i35sbajr";
 
   meta = with lib; {
     description = "A command-line application to view images from the terminal written in Rust";
diff --git a/third_party/nixpkgs/pkgs/tools/misc/colord/default.nix b/third_party/nixpkgs/pkgs/tools/misc/colord/default.nix
index 79d2712917..1db776c8ff 100644
--- a/third_party/nixpkgs/pkgs/tools/misc/colord/default.nix
+++ b/third_party/nixpkgs/pkgs/tools/misc/colord/default.nix
@@ -29,13 +29,13 @@
 
 stdenv.mkDerivation rec {
   pname = "colord";
-  version = "1.4.4";
+  version = "1.4.5";
 
   outputs = [ "out" "dev" "devdoc" "man" "installedTests" ];
 
   src = fetchurl {
     url = "https://www.freedesktop.org/software/colord/releases/${pname}-${version}.tar.xz";
-    sha256 = "19f0938fr7nvvm3jr263dlknaq7md40zrac2npfyz25zc00yh3ws";
+    sha256 = "05sydi6qqqx1rrqwnga1vbg9srkf89wdcfw5w4p4m7r37m2flx5p";
   };
 
   patches = [
diff --git a/third_party/nixpkgs/pkgs/tools/misc/diffoscope/default.nix b/third_party/nixpkgs/pkgs/tools/misc/diffoscope/default.nix
index 011c543208..76c868f9b5 100644
--- a/third_party/nixpkgs/pkgs/tools/misc/diffoscope/default.nix
+++ b/third_party/nixpkgs/pkgs/tools/misc/diffoscope/default.nix
@@ -16,11 +16,11 @@ let
 in
 python3Packages.buildPythonApplication rec {
   pname = "diffoscope";
-  version = "160";
+  version = "161";
 
   src = fetchurl {
     url    = "https://diffoscope.org/archive/diffoscope-${version}.tar.bz2";
-    sha256 = "1nshcgq31nrbh4r70i5azs7s0wfc4llb60ka1w8rncy22rg8rabc";
+    sha256 = "sha256-Frk+aVUQhWn/TvlG4zy5+R2z92rFIwO4NPRXYkS0rN4=";
   };
 
   outputs = [ "out" "man" ];
diff --git a/third_party/nixpkgs/pkgs/tools/misc/rpm-ostree/default.nix b/third_party/nixpkgs/pkgs/tools/misc/rpm-ostree/default.nix
index 456798d816..16d088c009 100644
--- a/third_party/nixpkgs/pkgs/tools/misc/rpm-ostree/default.nix
+++ b/third_party/nixpkgs/pkgs/tools/misc/rpm-ostree/default.nix
@@ -40,13 +40,13 @@
 
 stdenv.mkDerivation rec {
   pname = "rpm-ostree";
-  version = "2020.5";
+  version = "2020.7";
 
   outputs = [ "out" "dev" "man" "devdoc" ];
 
   src = fetchurl {
     url = "https://github.com/coreos/${pname}/releases/download/v${version}/${pname}-${version}.tar.xz";
-    sha256 = "MLLCmnStvGuSbVBdfOm2Sdzzz7LvPQkgDt9G0CDqCkA=";
+    sha256 = "1f8ajri6k5ni2rm8c75nydl8wcza0q6bv2bia3aqd0mr7iw31pbm";
   };
 
   nativeBuildInputs = [
@@ -116,7 +116,7 @@ stdenv.mkDerivation rec {
 
   meta = with stdenv.lib; {
     description = "A hybrid image/package system. It uses OSTree as an image format, and uses RPM as a component model";
-    homepage = "https://rpm-ostree.readthedocs.io/en/latest/";
+    homepage = "https://coreos.github.io/rpm-ostree/";
     license = licenses.lgpl2Plus;
     maintainers = with maintainers; [ copumpkin ];
     platforms = platforms.linux;
diff --git a/third_party/nixpkgs/pkgs/tools/misc/slurp/default.nix b/third_party/nixpkgs/pkgs/tools/misc/slurp/default.nix
index bdbea7367b..32263bad4a 100644
--- a/third_party/nixpkgs/pkgs/tools/misc/slurp/default.nix
+++ b/third_party/nixpkgs/pkgs/tools/misc/slurp/default.nix
@@ -5,13 +5,13 @@
 
 stdenv.mkDerivation rec {
   pname = "slurp";
-  version = "1.3.0";
+  version = "1.3.1";
 
   src = fetchFromGitHub {
     owner = "emersion";
     repo = "slurp";
     rev = "v${version}";
-    sha256 = "191yjn909dax8z66ks58wjadrycpbwryirkfjcy99dhq7dijg9fh";
+    sha256 = "1fby2v2ylcadgclds05wpkl9xi2r9dfz49dqyqpn20rjv1wnz3jv";
   };
 
   nativeBuildInputs = [
diff --git a/third_party/nixpkgs/pkgs/tools/security/1password-gui/default.nix b/third_party/nixpkgs/pkgs/tools/security/1password-gui/default.nix
index 0a76a04196..3a02fceeab 100644
--- a/third_party/nixpkgs/pkgs/tools/security/1password-gui/default.nix
+++ b/third_party/nixpkgs/pkgs/tools/security/1password-gui/default.nix
@@ -13,11 +13,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "1password";
-  version = "0.9.2-1";
+  version = "0.9.3";
 
   src = fetchurl {
     url = "https://onepassword.s3.amazonaws.com/linux/appimage/${pname}-${version}.AppImage";
-    sha256 = "19m8qfhmdzgz76xba9wi5cb12jqwr17afqzajvgq681i52fij0lr";
+    sha256 = "wO1HwXl6Lf7+2fXX7i8nrD/hi9dAWn50Jkoztx6aT0Q=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/third_party/nixpkgs/pkgs/tools/system/inxi/default.nix b/third_party/nixpkgs/pkgs/tools/system/inxi/default.nix
index 2ede543cd3..4257e2f2fd 100644
--- a/third_party/nixpkgs/pkgs/tools/system/inxi/default.nix
+++ b/third_party/nixpkgs/pkgs/tools/system/inxi/default.nix
@@ -22,13 +22,13 @@ let
     ++ recommendedDisplayInformationPrograms;
 in stdenv.mkDerivation rec {
   pname = "inxi";
-  version = "3.1.08-1";
+  version = "3.1.09-1";
 
   src = fetchFromGitHub {
     owner = "smxi";
     repo = "inxi";
     rev = version;
-    sha256 = "15b0fn8kv09k7kzyzix1pr1wmjw5yinzgw01v8pf9p547m4a899a";
+    sha256 = "0m6s8kxjppy3jm39is5i1lbrah29cw86rq0vamvx46izbdyf84y5";
   };
 
   buildInputs = [ perl makeWrapper ];
diff --git a/third_party/nixpkgs/pkgs/tools/text/ugrep/default.nix b/third_party/nixpkgs/pkgs/tools/text/ugrep/default.nix
index 6f44c36026..40266a5440 100644
--- a/third_party/nixpkgs/pkgs/tools/text/ugrep/default.nix
+++ b/third_party/nixpkgs/pkgs/tools/text/ugrep/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "ugrep";
-  version = "2.5.5";
+  version = "3.0.4";
 
   src = fetchFromGitHub {
     owner = "Genivia";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0ba9h0m9c28rllym1djij3b97k4rj06nsgajmbxg5mpxfzplgxy2";
+    sha256 = "0z3l6dm7v5fdki70nmz2qzrzqmkj3lngiwpswqmyygm7v8gvmimv";
   };
 
   buildInputs = [ boost bzip2 lz4 pcre2 xz zlib ];
diff --git a/third_party/nixpkgs/pkgs/tools/text/vale/default.nix b/third_party/nixpkgs/pkgs/tools/text/vale/default.nix
index 4011df9970..5ae858d79d 100644
--- a/third_party/nixpkgs/pkgs/tools/text/vale/default.nix
+++ b/third_party/nixpkgs/pkgs/tools/text/vale/default.nix
@@ -2,7 +2,7 @@
 
 buildGoModule rec {
   pname = "vale";
-  version = "2.5.0";
+  version = "2.6.1";
 
   subPackages = [ "." ];
   outputs = [ "out" "data" ];
@@ -11,7 +11,7 @@ buildGoModule rec {
     owner  = "errata-ai";
     repo   = "vale";
     rev    = "v${version}";
-    sha256 = "0favaijdddm0lajlv0a277mg286jh12kwfndf98zdp0vfq9lv00d";
+    sha256 = "1xn3i1d8z2zlnykcz0z779naashn92kd7fnnssamjqblclr8dsp8";
   };
 
   vendorSha256 = null;
diff --git a/third_party/nixpkgs/pkgs/top-level/all-packages.nix b/third_party/nixpkgs/pkgs/top-level/all-packages.nix
index 551b285d41..4c74f0718c 100644
--- a/third_party/nixpkgs/pkgs/top-level/all-packages.nix
+++ b/third_party/nixpkgs/pkgs/top-level/all-packages.nix
@@ -2532,6 +2532,8 @@ in
 
   socklog = callPackage ../tools/system/socklog { };
 
+  ssmsh = callPackage ../tools/admin/ssmsh { };
+
   stagit = callPackage ../development/tools/stagit { };
 
   starboard = callPackage ../applications/networking/cluster/starboard { };
@@ -17985,18 +17987,11 @@ in
 
   linux_mptcp = linux_mptcp_95;
 
-  linux_mptcp_94 = callPackage ../os-specific/linux/kernel/linux-mptcp-94.nix {
-    kernelPatches =
-      [ kernelPatches.bridge_stp_helper
-        kernelPatches.request_key_helper
-        kernelPatches.cpu-cgroup-v2."4.11"
-        kernelPatches.modinst_arg_list_too_long
-      ]
-      ++ lib.optionals ((stdenv.hostPlatform.platform.kernelArch or null) == "mips")
-      [ kernelPatches.mips_fpureg_emu
-        kernelPatches.mips_fpu_sigill
-        kernelPatches.mips_ext3_n32
-      ];
+  linux_mptcp_5_9 = linux_5_9.override {
+    structuredExtraConfig = with lib.kernel; {
+      MPTCP      = yes;
+      MPTCP_IPV6 = yes;
+    };
   };
 
   linux_mptcp_95 = callPackage ../os-specific/linux/kernel/linux-mptcp-95.nix {
@@ -22822,8 +22817,6 @@ in
     inherit (gnome2) libglade;
   };
 
-  obs-linuxbrowser = callPackage ../applications/video/obs-studio/linuxbrowser.nix { };
-
   obs-studio = libsForQt514.callPackage ../applications/video/obs-studio { };
 
   obs-wlrobs = callPackage ../applications/video/obs-studio/wlrobs.nix { };
@@ -24272,7 +24265,7 @@ in
     onlyLibVLC = true;
   };
 
-  vmpk = callPackage ../applications/audio/vmpk { };
+  vmpk = libsForQt5.callPackage ../applications/audio/vmpk { };
 
   vmware-horizon-client = callPackage ../applications/networking/remote/vmware-horizon-client { };
 
diff --git a/third_party/nixpkgs/pkgs/top-level/perl-packages.nix b/third_party/nixpkgs/pkgs/top-level/perl-packages.nix
index 123f7484a7..f88b68d73c 100644
--- a/third_party/nixpkgs/pkgs/top-level/perl-packages.nix
+++ b/third_party/nixpkgs/pkgs/top-level/perl-packages.nix
@@ -1758,6 +1758,21 @@ let
     buildInputs = [ TestWarn ];
   };
 
+  CatalystAuthenticationStoreLDAP = buildPerlPackage {
+    pname = "Catalyst-Authentication-Store-LDAP";
+    version = "1.016";
+    src = fetchurl {
+      url = "mirror://cpan/authors/id/I/IL/ILMARI/Catalyst-Authentication-Store-LDAP-1.016.tar.gz";
+      sha256 = "0cm399vxqqf05cjgs1j5v3sk4qc6nmws5nfhf52qvpbwc4m82mq8";
+    };
+    propagatedBuildInputs = [ NetLDAP CatalystPluginAuthentication ClassAccessorFast ];
+    buildInputs = [ TestMore TestMockObject TestException NetLDAPServerTest ];
+    meta = {
+      description= "Authentication from an LDAP Directory";
+      license = with stdenv.lib.licenses; [ artistic1 ];
+    };
+  };
+
   CatalystComponentInstancePerContext = buildPerlPackage {
     pname = "Catalyst-Component-InstancePerContext";
     version = "0.001001";
@@ -8300,12 +8315,12 @@ let
     };
   };
 
-  FutureAsyncAwait = buildPerlModule {
+  FutureAsyncAwait = buildPerlModule rec {
     pname = "Future-AsyncAwait";
-    version = "0.45";
+    version = "0.46";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/P/PE/PEVANS/Future-AsyncAwait-0.45.tar.gz";
-      sha256 = "1aq19b21r9i4c1mxkrv0irnx16234cnzsx50178c7xif4gqkar9k";
+      url = "mirror://cpan/authors/id/P/PE/PEVANS/Future-AsyncAwait-${version}.tar.gz";
+      sha256 = "1iqbs7n8923xjkai51hiczn5an8cskddl7qrfi30axjl1d56h6r0";
     };
     buildInputs = [ TestRefcount ];
     propagatedBuildInputs = [ Future XSParseSublike ];
@@ -14910,6 +14925,47 @@ let
     };
   };
 
+  NetLDAPServer = buildPerlPackage {
+    pname = "Net-LDAP-Server";
+    version = "0.43";
+    src = fetchurl {
+      url = "mirror://cpan/authors/id/A/AA/AAR/Net-LDAP-Server-0.43.tar.gz";
+      sha256 = "0qmh3cri3fpccmwz6bhwp78yskrb3qmalzvqn0a23hqbsfs4qv6x";
+    };
+    propagatedBuildInputs = [ NetLDAP ConvertASN1 ];
+    meta = {
+      description = "LDAP server side protocol handling";
+      license = with stdenv.lib.licenses; [ artistic1 ];
+    };
+  };
+
+  NetLDAPSID = buildPerlPackage {
+    pname = "Net-LDAP-SID";
+    version = "0.0001";
+    src = fetchurl {
+      url = "mirror://cpan/authors/id/K/KA/KARMAN/Net-LDAP-SID-0.001.tar.gz";
+      sha256 = "1mnnpkmj8kpb7qw50sm8h4sd8py37ssy2xi5hhxzr5whcx0cvhm8";
+    };
+    meta = {
+      description= "Active Directory Security Identifier manipulation";
+      license = with stdenv.lib.licenses; [ artistic2 ];
+    };
+  };
+
+  NetLDAPServerTest = buildPerlPackage {
+    pname = "Net-LDAP-Server-Test";
+    version = "0.22";
+    src = fetchurl {
+      url = "mirror://cpan/authors/id/K/KA/KARMAN/Net-LDAP-Server-Test-0.22.tar.gz";
+      sha256 = "13idip7jky92v4adw60jn2gcc3zf339gsdqlnc9nnvqzbxxp285i";
+    };
+    propagatedBuildInputs = [ NetLDAP NetLDAPServer TestMore DataDump NetLDAPSID ];
+    meta = {
+      description= "test Net::LDAP code";
+      license = with stdenv.lib.licenses; [ artistic1 ];
+    };
+  };
+
   NetNetmask = buildPerlPackage {
     pname = "Net-Netmask";
     version = "1.9104";
diff --git a/third_party/nixpkgs/pkgs/top-level/python-packages.nix b/third_party/nixpkgs/pkgs/top-level/python-packages.nix
index 044f30e761..d84b4c3662 100644
--- a/third_party/nixpkgs/pkgs/top-level/python-packages.nix
+++ b/third_party/nixpkgs/pkgs/top-level/python-packages.nix
@@ -2012,6 +2012,8 @@ in {
 
   fastdtw = callPackage ../development/python-modules/fastdtw { };
 
+  fastecdsa = callPackage ../development/python-modules/fastecdsa { };
+
   fasteners = callPackage ../development/python-modules/fasteners { };
 
   fastentrypoints = callPackage ../development/python-modules/fastentrypoints { };