diff --git a/nixos/lib/utils.nix b/nixos/lib/utils.nix
index c9dfdbed99a3..1a51b149e56e 100644
--- a/nixos/lib/utils.nix
+++ b/nixos/lib/utils.nix
@@ -14,8 +14,30 @@ rec {
   fsNeededForBoot = fs: fs.neededForBoot || elem fs.mountPoint pathsNeededForBoot;
 
   # Check whenever `b` depends on `a` as a fileSystem
-  fsBefore = a: b: a.mountPoint == b.device
-                || hasPrefix "${a.mountPoint}${optionalString (!(hasSuffix "/" a.mountPoint)) "/"}" b.mountPoint;
+  fsBefore = a: b:
+    let
+      # normalisePath adds a slash at the end of the path if it didn't already
+      # have one.
+      #
+      # The reason slashes are added at the end of each path is to prevent `b`
+      # from accidentally depending on `a` in cases like
+      #    a = { mountPoint = "/aaa"; ... }
+      #    b = { device     = "/aaaa"; ... }
+      # Here a.mountPoint *is* a prefix of b.device even though a.mountPoint is
+      # *not* a parent of b.device. If we add a slash at the end of each string,
+      # though, this is not a problem: "/aaa/" is not a prefix of "/aaaa/".
+      normalisePath = path: "${path}${optionalString (!(hasSuffix "/" path)) "/"}";
+      normalise = mount: mount // { device = normalisePath mount.device;
+                                    mountPoint = normalisePath mount.mountPoint;
+                                    depends = map normalisePath mount.depends;
+                                  };
+
+      a' = normalise a;
+      b' = normalise b;
+
+    in hasPrefix a'.mountPoint b'.device
+    || hasPrefix a'.mountPoint b'.mountPoint
+    || any (hasPrefix a'.mountPoint) b'.depends;
 
   # Escape a path according to the systemd rules, e.g. /dev/xyzzy
   # becomes dev-xyzzy.  FIXME: slow.
diff --git a/nixos/modules/installer/cd-dvd/iso-image.nix b/nixos/modules/installer/cd-dvd/iso-image.nix
index c2836b5a9a1b..4e5d888c4bbd 100644
--- a/nixos/modules/installer/cd-dvd/iso-image.nix
+++ b/nixos/modules/installer/cd-dvd/iso-image.nix
@@ -680,6 +680,12 @@ in
           "upperdir=/nix/.rw-store/store"
           "workdir=/nix/.rw-store/work"
         ];
+
+        depends = [
+          "/nix/.ro-store"
+          "/nix/.rw-store/store"
+          "/nix/.rw-store/work"
+        ];
       };
 
     boot.initrd.availableKernelModules = [ "squashfs" "iso9660" "uas" "overlay" ];
diff --git a/nixos/modules/installer/netboot/netboot.nix b/nixos/modules/installer/netboot/netboot.nix
index fa074fdfcc6e..238ab6d0617b 100644
--- a/nixos/modules/installer/netboot/netboot.nix
+++ b/nixos/modules/installer/netboot/netboot.nix
@@ -57,6 +57,12 @@ with lib;
           "upperdir=/nix/.rw-store/store"
           "workdir=/nix/.rw-store/work"
         ];
+
+        depends = [
+          "/nix/.ro-store"
+          "/nix/.rw-store/store"
+          "/nix/.rw-store/work"
+        ];
       };
 
     boot.initrd.availableKernelModules = [ "squashfs" "overlay" ];
diff --git a/nixos/modules/services/networking/tailscale.nix b/nixos/modules/services/networking/tailscale.nix
index 9a28a266a928..c33a38179ee4 100644
--- a/nixos/modules/services/networking/tailscale.nix
+++ b/nixos/modules/services/networking/tailscale.nix
@@ -15,6 +15,12 @@ in {
       description = "The port to listen on for tunnel traffic (0=autoselect).";
     };
 
+    interfaceName = mkOption {
+      type = types.str;
+      default = "tailscale0";
+      description = ''The interface name for tunnel traffic. Use "userspace-networking" (beta) to not use TUN.'';
+    };
+
     package = mkOption {
       type = types.package;
       default = pkgs.tailscale;
@@ -29,7 +35,10 @@ in {
     systemd.services.tailscaled = {
       wantedBy = [ "multi-user.target" ];
       path = [ pkgs.openresolv ];
-      serviceConfig.Environment = "PORT=${toString cfg.port}";
+      serviceConfig.Environment = [
+        "PORT=${toString cfg.port}"
+        ''"FLAGS=--tun ${lib.escapeShellArg cfg.interfaceName}"''
+      ];
     };
   };
 }
diff --git a/nixos/modules/tasks/filesystems.nix b/nixos/modules/tasks/filesystems.nix
index 065d6cc95d18..2949c82df8fe 100644
--- a/nixos/modules/tasks/filesystems.nix
+++ b/nixos/modules/tasks/filesystems.nix
@@ -24,13 +24,15 @@ let
 
   specialFSTypes = [ "proc" "sysfs" "tmpfs" "ramfs" "devtmpfs" "devpts" ];
 
+  nonEmptyWithoutTrailingSlash = addCheckDesc "non-empty without trailing slash" types.str
+    (s: isNonEmpty s && (builtins.match ".+/" s) == null);
+
   coreFileSystemOpts = { name, config, ... }: {
 
     options = {
       mountPoint = mkOption {
         example = "/mnt/usb";
-        type = addCheckDesc "non-empty without trailing slash" types.str
-          (s: isNonEmpty s && (builtins.match ".+/" s) == null);
+        type = nonEmptyWithoutTrailingSlash;
         description = "Location of the mounted the file system.";
       };
 
@@ -55,6 +57,20 @@ let
         type = types.listOf nonEmptyStr;
       };
 
+      depends = mkOption {
+        default = [ ];
+        example = [ "/persist" ];
+        type = types.listOf nonEmptyWithoutTrailingSlash;
+        description = ''
+          List of paths that should be mounted before this one. This filesystem's
+          <option>device</option> and <option>mountPoint</option> are always
+          checked and do not need to be included explicitly. If a path is added
+          to this list, any other filesystem whose mount point is a parent of
+          the path will be mounted before this filesystem. The paths do not need
+          to actually be the <option>mountPoint</option> of some other filesystem.
+        '';
+      };
+
     };
 
     config = {
diff --git a/pkgs/applications/audio/faust/faust2.nix b/pkgs/applications/audio/faust/faust2.nix
index 995618af4ce5..c1d351fa53e1 100644
--- a/pkgs/applications/audio/faust/faust2.nix
+++ b/pkgs/applications/audio/faust/faust2.nix
@@ -178,6 +178,12 @@ let
 
         # export parts of the build environment
         for script in "$out"/bin/*; do
+          # e.g. NIX_CC_WRAPPER_TARGET_HOST_x86_64_unknown_linux_gnu
+          nix_cc_wrapper_target_host="$(printenv | grep ^NIX_CC_WRAPPER_TARGET_HOST | sed 's/=.*//')"
+
+          # e.g. NIX_BINTOOLS_WRAPPER_TARGET_HOST_x86_64_unknown_linux_gnu
+          nix_bintools_wrapper_target_host="$(printenv | grep ^NIX_BINTOOLS_WRAPPER_TARGET_HOST | sed 's/=.*//')"
+
           wrapProgram "$script" \
             --set FAUSTLDDIR "${faust}/lib" \
             --set FAUSTLIB "${faust}/share/faust" \
@@ -187,7 +193,9 @@ let
             --prefix PKG_CONFIG_PATH : "$PKG_CONFIG_PATH" \
             --set NIX_CFLAGS_COMPILE "$NIX_CFLAGS_COMPILE" \
             --set NIX_LDFLAGS "$NIX_LDFLAGS -lpthread" \
-            --prefix LIBRARY_PATH $libPath
+            --set "$nix_cc_wrapper_target_host" "''${!nix_cc_wrapper_target_host}" \
+            --set "$nix_bintools_wrapper_target_host" "''${!nix_bintools_wrapper_target_host}" \
+            --prefix LIBRARY_PATH "$libPath"
         done
       '';
     });
diff --git a/pkgs/applications/editors/vscode/vscodium.nix b/pkgs/applications/editors/vscode/vscodium.nix
index 7dadd02a4476..1a31d4e56fab 100644
--- a/pkgs/applications/editors/vscode/vscodium.nix
+++ b/pkgs/applications/editors/vscode/vscodium.nix
@@ -13,10 +13,10 @@ let
   archive_fmt = if system == "x86_64-darwin" then "zip" else "tar.gz";
 
   sha256 = {
-    x86_64-linux = "1gw2273ab0gdyav6mz7wk7d6g6cwcdvx0xaghvm610m1pvkbvxkz";
-    x86_64-darwin = "1zfzsr8gybmpmxc3jlfj6sx3m6ny6hc3dxvpgffni7k5zgv651df";
-    aarch64-linux = "079bp48h0qfpsbyir2qg3w1f43dc68ngmxqdqb3jnkx721affjzs";
-    armv7l-linux = "1d9243hk07xawv44909lk6y6bnvy0wjhy8xl13n3a11pg3djn5bm";
+    x86_64-linux = "1pjqw0chyhmamgnbih05ach94xgz6kglx7n958y2652ps2q5fzhw";
+    x86_64-darwin = "0k9rinsy0zz48pxprkyxshksgh6shk1h69fkrdi2q0f4mkvzmi3a";
+    aarch64-linux = "0hd3kxg5pwkf0rhbq4f246x82nic24splpqj4h68qfw856p2zg7d";
+    armv7l-linux = "0219yagcdiv1n3xbbk1rs94n4zwfv9s70yqrc0all7jl5xl1mbwh";
   }.${system};
 
   sourceRoot = {
@@ -31,7 +31,7 @@ in
 
     # Please backport all compatible updates to the stable release.
     # This is important for the extension ecosystem.
-    version = "1.56.2";
+    version = "1.57.0";
     pname = "vscodium";
 
     executableName = "codium";
diff --git a/pkgs/applications/misc/joplin-desktop/default.nix b/pkgs/applications/misc/joplin-desktop/default.nix
index 9c559a364ef9..2d9a2ca59045 100644
--- a/pkgs/applications/misc/joplin-desktop/default.nix
+++ b/pkgs/applications/misc/joplin-desktop/default.nix
@@ -2,7 +2,7 @@
 
 let
   pname = "joplin-desktop";
-  version = "1.7.11";
+  version = "1.8.5";
   name = "${pname}-${version}";
 
   inherit (stdenv.hostPlatform) system;
@@ -16,8 +16,8 @@ let
   src = fetchurl {
     url = "https://github.com/laurent22/joplin/releases/download/v${version}/Joplin-${version}.${suffix}";
     sha256 = {
-      x86_64-linux = "11vjipvhfvf6wxldcg743anma005j8dbbngqk6sq9hlf677ahxii";
-      x86_64-darwin = "1l7m86jlf1m066n6rwmh5fkpx2pj3wj5h9ncxdd24v0zll6ki8vs";
+      x86_64-linux = "11csbr72i5kac2bk7wpa877lay2z1n58s0yildkfnjy552ihdxny";
+      x86_64-darwin = "1n0ni3ixml99ag83bcn5wg6f0kldjhwkkddd9km37ykr8vxxl952";
     }.${system} or throwSystem;
   };
 
diff --git a/pkgs/applications/misc/prusa-slicer/super-slicer.nix b/pkgs/applications/misc/prusa-slicer/super-slicer.nix
index 4175cb2b2220..2bf28aa892f5 100644
--- a/pkgs/applications/misc/prusa-slicer/super-slicer.nix
+++ b/pkgs/applications/misc/prusa-slicer/super-slicer.nix
@@ -1,7 +1,7 @@
 { lib, fetchFromGitHub, makeDesktopItem, prusa-slicer }:
 let
   appname = "SuperSlicer";
-  version = "2.2.54.2";
+  version = "2.3.56.5";
   pname = "super-slicer";
   description = "PrusaSlicer fork with more features and faster development cycle";
   override = super: {
@@ -10,20 +10,19 @@ let
     src = fetchFromGitHub {
       owner = "supermerill";
       repo = "SuperSlicer";
-      sha256 = "sha256-ThmsxFXI1uReK+JwpHrIWzHpBdIOP77kDjv+QaK+Azk=";
+      sha256 = "sha256-Gg+LT1YKyUGNJE9XvWE1LSlIQ6Vq5GfVBTUw/A7Qx7E=";
       rev = version;
+      fetchSubmodules = true;
     };
 
+    # We don't need PS overrides anymore, and gcode-viewer is embedded in the binary.
+    postInstall = null;
+
     # See https://github.com/supermerill/SuperSlicer/issues/432
     cmakeFlags = super.cmakeFlags ++ [
       "-DSLIC3R_BUILD_TESTS=0"
     ];
 
-    postInstall = ''
-      mkdir -p "$out/share/pixmaps/"
-      ln -s "$out/share/SuperSlicer/icons/Slic3r.png" "$out/share/pixmaps/${appname}.png"
-    '';
-
     desktopItems = [
       (makeDesktopItem {
         name = appname;
diff --git a/pkgs/applications/networking/ftp/filezilla/default.nix b/pkgs/applications/networking/ftp/filezilla/default.nix
index df993625e6d1..5472782758cb 100644
--- a/pkgs/applications/networking/ftp/filezilla/default.nix
+++ b/pkgs/applications/networking/ftp/filezilla/default.nix
@@ -11,6 +11,7 @@
 , pugixml
 , sqlite
 , tinyxml
+, wrapGAppsHook
 , wxGTK30-gtk3
 , xdg-utils
 }:
@@ -35,7 +36,7 @@ stdenv.mkDerivation rec {
     "--disable-autoupdatecheck"
   ];
 
-  nativeBuildInputs = [ autoreconfHook pkg-config ];
+  nativeBuildInputs = [ autoreconfHook pkg-config wrapGAppsHook ];
 
   buildInputs = [
     dbus
diff --git a/pkgs/applications/terminal-emulators/kitty/default.nix b/pkgs/applications/terminal-emulators/kitty/default.nix
index 428830d945e6..e101d5d3a8cd 100644
--- a/pkgs/applications/terminal-emulators/kitty/default.nix
+++ b/pkgs/applications/terminal-emulators/kitty/default.nix
@@ -21,14 +21,14 @@
 with python3Packages;
 buildPythonApplication rec {
   pname = "kitty";
-  version = "0.21.0";
+  version = "0.21.1";
   format = "other";
 
   src = fetchFromGitHub {
     owner = "kovidgoyal";
     repo = "kitty";
     rev = "v${version}";
-    sha256 = "sha256-n8ipIQAfKPVApJhuTrlSSsd6dlPeCUvk7rdiVmL9i+4=";
+    sha256 = "sha256-/+OSVjC4++A4kaxEfI2kIgjXxL67lfoXCdH2PykLWxA=";
   };
 
   buildInputs = [
@@ -68,17 +68,21 @@ buildPythonApplication rec {
 
   dontConfigure = true;
 
-  buildPhase = if stdenv.isDarwin then ''
-    ${python.interpreter} setup.py kitty.app \
-    --update-check-interval=0 \
-    --disable-link-time-optimization
-    make man
-  '' else ''
-    ${python.interpreter} setup.py linux-package \
-    --update-check-interval=0 \
-    --egl-library='${lib.getLib libGL}/lib/libEGL.so.1' \
-    --startup-notification-library='${libstartup_notification}/lib/libstartup-notification-1.so' \
-    --canberra-library='${libcanberra}/lib/libcanberra.so'
+  buildPhase = ''
+    runHook preBuild
+    ${if stdenv.isDarwin then ''
+      ${python.interpreter} setup.py kitty.app \
+      --update-check-interval=0 \
+      --disable-link-time-optimization
+      make man
+    '' else ''
+      ${python.interpreter} setup.py linux-package \
+      --update-check-interval=0 \
+      --egl-library='${lib.getLib libGL}/lib/libEGL.so.1' \
+      --startup-notification-library='${libstartup_notification}/lib/libstartup-notification-1.so' \
+      --canberra-library='${libcanberra}/lib/libcanberra.so'
+    ''}
+    runHook postBuild
   '';
 
   checkInputs = [ pillow ];
diff --git a/pkgs/applications/version-management/gitlab/data.json b/pkgs/applications/version-management/gitlab/data.json
index 40af0656fe6b..d7e6261a9325 100644
--- a/pkgs/applications/version-management/gitlab/data.json
+++ b/pkgs/applications/version-management/gitlab/data.json
@@ -1,13 +1,13 @@
 {
-  "version": "13.12.2",
-  "repo_hash": "1wzbjw21pan5cfiz1jd03c3w9sgyvmn35f6dm2sr2k54acsw034p",
+  "version": "13.12.3",
+  "repo_hash": "0kpdl1gwcxy13lwyl96nsia62wysrnxdygil6sz6s72hg0y2fsgr",
   "owner": "gitlab-org",
   "repo": "gitlab",
-  "rev": "v13.12.2-ee",
+  "rev": "v13.12.3-ee",
   "passthru": {
-    "GITALY_SERVER_VERSION": "13.12.2",
+    "GITALY_SERVER_VERSION": "13.12.3",
     "GITLAB_PAGES_VERSION": "1.39.0",
     "GITLAB_SHELL_VERSION": "13.18.0",
-    "GITLAB_WORKHORSE_VERSION": "13.12.2"
+    "GITLAB_WORKHORSE_VERSION": "13.12.3"
   }
 }
diff --git a/pkgs/applications/version-management/gitlab/gitaly/default.nix b/pkgs/applications/version-management/gitlab/gitaly/default.nix
index 994683c2e2b1..6276dd75eaf9 100644
--- a/pkgs/applications/version-management/gitlab/gitaly/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitaly/default.nix
@@ -21,14 +21,14 @@ let
       };
   };
 in buildGoModule rec {
-  version = "13.12.2";
+  version = "13.12.3";
   pname = "gitaly";
 
   src = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "gitaly";
     rev = "v${version}";
-    sha256 = "sha256-jZg/OlecYlGjDxlxsayAuqzptil1OPtyPjOe1WYT0HY=";
+    sha256 = "sha256-qqLVYNCE8rKPBY5tj6AAoWcyIEtQZkO980NVPg0WO18=";
   };
 
   vendorSha256 = "sha256-drS0L0olEFHYJVC0VYwEZeNYa8fjwrfxlhrEQa4pqzY=";
diff --git a/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix b/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix
index c6302be8d184..e900a6522ebf 100644
--- a/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix
@@ -5,7 +5,7 @@ in
 buildGoModule rec {
   pname = "gitlab-workhorse";
 
-  version = "13.12.2";
+  version = "13.12.3";
 
   src = fetchFromGitLab {
     owner = data.owner;
diff --git a/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile b/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile
index bb95233c6eb0..14dcc7ab4b17 100644
--- a/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile
+++ b/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile
@@ -309,12 +309,12 @@ gem 'rack-attack', '~> 6.3.0'
 gem 'sentry-raven', '~> 3.0'
 
 # PostgreSQL query parsing
-gem 'pg_query', '~> 2.0.3'
+gem 'pg_query', '~> 1.3.0'
 
 gem 'premailer-rails', '~> 1.10.3'
 
 # LabKit: Tracing and Correlation
-gem 'gitlab-labkit', '~> 0.17.1'
+gem 'gitlab-labkit', '~> 0.16.2'
 # Thrift is a dependency of gitlab-labkit, we want a version higher than 0.14.0
 # because of https://gitlab.com/gitlab-org/gitlab/-/issues/321900
 gem 'thrift', '>= 0.14.0'
@@ -485,7 +485,7 @@ gem 'gitaly', '~> 13.12.0.pre.rc1'
 
 gem 'grpc', '~> 1.30.2'
 
-gem 'google-protobuf', '~> 3.15.8'
+gem 'google-protobuf', '~> 3.14.0'
 
 gem 'toml-rb', '~> 1.0.0'
 
diff --git a/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile.lock b/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile.lock
index 6f40a15a64bc..31f362c9f9b4 100644
--- a/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile.lock
+++ b/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile.lock
@@ -460,13 +460,13 @@ GEM
       fog-xml (~> 0.1.0)
       google-api-client (>= 0.44.2, < 0.51)
       google-cloud-env (~> 1.2)
-    gitlab-labkit (0.17.1)
+    gitlab-labkit (0.16.2)
       actionpack (>= 5.0.0, < 7.0.0)
       activesupport (>= 5.0.0, < 7.0.0)
       grpc (~> 1.19)
       jaeger-client (~> 1.1)
       opentracing (~> 0.4)
-      pg_query (~> 2.0)
+      pg_query (~> 1.3)
       redis (> 3.0.0, < 5.0.0)
     gitlab-license (1.5.0)
     gitlab-mail_room (0.0.9)
@@ -509,7 +509,7 @@ GEM
       signet (~> 0.12)
     google-cloud-env (1.4.0)
       faraday (>= 0.17.3, < 2.0)
-    google-protobuf (3.15.8)
+    google-protobuf (3.14.0)
     googleapis-common-protos-types (1.0.6)
       google-protobuf (~> 3.14)
     googleauth (0.14.0)
@@ -896,8 +896,7 @@ GEM
     peek (1.1.0)
       railties (>= 4.0.0)
     pg (1.2.3)
-    pg_query (2.0.3)
-      google-protobuf (~> 3.15.5)
+    pg_query (1.3.0)
     plist (3.6.0)
     png_quantizator (0.2.1)
     po_to_json (1.0.1)
@@ -1473,7 +1472,7 @@ DEPENDENCIES
   gitlab-experiment (~> 0.5.4)
   gitlab-fog-azure-rm (~> 1.0.1)
   gitlab-fog-google (~> 1.13)
-  gitlab-labkit (~> 0.17.1)
+  gitlab-labkit (~> 0.16.2)
   gitlab-license (~> 1.5)
   gitlab-mail_room (~> 0.0.9)
   gitlab-markup (~> 1.7.1)
@@ -1485,7 +1484,7 @@ DEPENDENCIES
   gitlab_omniauth-ldap (~> 2.1.1)
   gon (~> 6.4.0)
   google-api-client (~> 0.33)
-  google-protobuf (~> 3.15.8)
+  google-protobuf (~> 3.14.0)
   gpgme (~> 2.0.19)
   grape (~> 1.5.2)
   grape-entity (~> 0.9.0)
@@ -1565,7 +1564,7 @@ DEPENDENCIES
   parslet (~> 1.8)
   peek (~> 1.1)
   pg (~> 1.1)
-  pg_query (~> 2.0.3)
+  pg_query (~> 1.3.0)
   png_quantizator (~> 0.2.1)
   premailer-rails (~> 1.10.3)
   prometheus-client-mmap (~> 0.12.0)
diff --git a/pkgs/applications/version-management/gitlab/rubyEnv/gemset.nix b/pkgs/applications/version-management/gitlab/rubyEnv/gemset.nix
index 9500febc8563..f9b174c43f1c 100644
--- a/pkgs/applications/version-management/gitlab/rubyEnv/gemset.nix
+++ b/pkgs/applications/version-management/gitlab/rubyEnv/gemset.nix
@@ -1978,10 +1978,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1y1sk3xmxj14nzx7v2zgq4q4d5lh4v1pvhs03n03j3kp4fbrj469";
+      sha256 = "0184rq6sal3xz4f0w5iaa5zf3q55i4dh0rlvr25l1g0s2imwr3fa";
       type = "gem";
     };
-    version = "0.17.1";
+    version = "0.16.2";
   };
   gitlab-license = {
     groups = ["default"];
@@ -2127,10 +2127,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0d9ayd4c69iag9nny7yydjx6dw4ymd52x1kv917ngv3vmsdkv51x";
+      sha256 = "0pbm2kjhxvazx9d5c071bxcjx5cbip6d2y36dii2a4558nqjd12p";
       type = "gem";
     };
-    version = "3.15.8";
+    version = "3.14.0";
   };
   googleapis-common-protos-types = {
     dependencies = ["google-protobuf"];
@@ -3811,15 +3811,14 @@
     version = "1.2.3";
   };
   pg_query = {
-    dependencies = ["google-protobuf"];
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1mii63kgppy2zil2qn54c94z93b6ama6x7gq6rbv4xxlfk8ncrag";
+      sha256 = "1i9l3y502ddm2lq3ajhxhqq17vs9hgxkxm443yw221ccibcfh6qf";
       type = "gem";
     };
-    version = "2.0.3";
+    version = "1.3.0";
   };
   plist = {
     groups = ["default"];
diff --git a/pkgs/desktops/xfce/applications/xfce4-screenshooter/default.nix b/pkgs/desktops/xfce/applications/xfce4-screenshooter/default.nix
index 3098b9c756ea..d2d17f5afe84 100644
--- a/pkgs/desktops/xfce/applications/xfce4-screenshooter/default.nix
+++ b/pkgs/desktops/xfce/applications/xfce4-screenshooter/default.nix
@@ -3,10 +3,10 @@
 mkXfceDerivation {
   category = "apps";
   pname = "xfce4-screenshooter";
-  version = "1.9.8";
+  version = "1.9.9";
   odd-unstable = false;
 
-  sha256 = "0pbzjcaxm8gk0s75s99kvzygmih4yghp7ngf2mxymjiywcxqr40d";
+  sha256 = "1myzm9sk968bcl9yqh6zyaa3ck42rw01hbcqn8z4sipiwsbhkrj0";
 
   buildInputs = [ exo gtk3 libsoup libxfce4ui libxfce4util xfce4-panel glib-networking ];
 
diff --git a/pkgs/desktops/xfce/mkXfceDerivation.nix b/pkgs/desktops/xfce/mkXfceDerivation.nix
index a9f30ebfab55..7858450b0816 100644
--- a/pkgs/desktops/xfce/mkXfceDerivation.nix
+++ b/pkgs/desktops/xfce/mkXfceDerivation.nix
@@ -47,7 +47,7 @@ let
     };
 
     meta = with lib; {
-      homepage = "https://gitlab.xfce.org/${category}/${pname}/about";
+      homepage = "https://gitlab.xfce.org/${category}/${pname}";
       license = licenses.gpl2Plus; # some libraries are under LGPLv2+
       platforms = platforms.linux;
     };
diff --git a/pkgs/development/compilers/llvm/git/default.nix b/pkgs/development/compilers/llvm/git/default.nix
index a01eddf6705b..9a5d34107fb4 100644
--- a/pkgs/development/compilers/llvm/git/default.nix
+++ b/pkgs/development/compilers/llvm/git/default.nix
@@ -21,8 +21,8 @@ let
   release_version = "13.0.0";
   candidate = ""; # empty or "rcN"
   dash-candidate = lib.optionalString (candidate != "") "-${candidate}";
-  rev = "d3676d4b666ead794fc58bbc7e07aa406dcf487a"; # When using a Git commit
-  rev-version = "unstable-2021-05-17"; # When using a Git commit
+  rev = "50c0aaed47b518beea550a6858c2967eaeaef7eb"; # When using a Git commit
+  rev-version = "unstable-2021-06-04"; # When using a Git commit
   version = if rev != "" then rev-version else "${release_version}${dash-candidate}";
   targetConfig = stdenv.targetPlatform.config;
 
@@ -30,7 +30,7 @@ let
     owner = "llvm";
     repo = "llvm-project";
     rev = if rev != "" then rev else "llvmorg-${version}";
-    sha256 = "0aw5hnlp3m21dqyqz9z8669achsfhyi7lsl17hh0j45q0qlxnmyw";
+    sha256 = "1w1ahcg707yh3xiy6y28b90ag03dwjplj0bg39l4w72krqr28661";
   };
 
   llvm_meta = {
@@ -257,9 +257,7 @@ let
 
     libunwind = callPackage ./libunwind {
       inherit llvm_meta;
-      stdenv = if stdenv.hostPlatform.useLLVM or false
-               then overrideCC stdenv buildLlvmTools.clangNoLibcxx
-               else stdenv;
+      stdenv = overrideCC stdenv buildLlvmTools.clangNoLibcxx;
     };
 
     openmp = callPackage ./openmp {
diff --git a/pkgs/development/compilers/llvm/git/openmp/default.nix b/pkgs/development/compilers/llvm/git/openmp/default.nix
index 07488c1c33f4..c5a33df97560 100644
--- a/pkgs/development/compilers/llvm/git/openmp/default.nix
+++ b/pkgs/development/compilers/llvm/git/openmp/default.nix
@@ -18,6 +18,10 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ cmake perl ];
   buildInputs = [ llvm ];
 
+  cmakeFlags = [
+    "-DLIBOMPTARGET_BUILD_AMDGCN_BCLIB=OFF" # Building the AMDGCN device RTL currently fails
+  ];
+
   meta = llvm_meta // {
     homepage = "https://openmp.llvm.org/";
     description = "Support for the OpenMP language";
diff --git a/pkgs/development/libraries/hunspell/dictionaries.nix b/pkgs/development/libraries/hunspell/dictionaries.nix
index f2c6165df844..596326b36df4 100644
--- a/pkgs/development/libraries/hunspell/dictionaries.nix
+++ b/pkgs/development/libraries/hunspell/dictionaries.nix
@@ -5,10 +5,11 @@
 
 let
   mkDict =
-  { name, readmeFile, dictFileName, ... }@args:
+  { pname, readmeFile, dictFileName, ... }@args:
   stdenv.mkDerivation ({
-    inherit name;
+    inherit pname;
     installPhase = ''
+      runHook preInstall
       # hunspell dicts
       install -dm755 "$out/share/hunspell"
       install -m644 ${dictFileName}.dic "$out/share/hunspell/"
@@ -19,7 +20,7 @@ let
       ln -sv "$out/share/hunspell/${dictFileName}.aff" "$out/share/myspell/dicts/"
       # docs
       install -dm755 "$out/share/doc"
-      install -m644 ${readmeFile} $out/share/doc/${name}.txt
+      install -m644 ${readmeFile} $out/share/doc/${pname}.txt
       runHook postInstall
     '';
   } // args);
@@ -29,7 +30,7 @@ let
     mkDict rec {
       inherit dictFileName;
       version = "2.2";
-      name = "hunspell-dict-${shortName}-rla-${version}";
+      pname = "hunspell-dict-${shortName}-rla";
       readmeFile = "README.txt";
       src = fetchFromGitHub {
         owner = "sbosio";
@@ -70,7 +71,7 @@ let
       version = "2.40";
       # Should really use a string function or something
       _version = "2-40";
-      name = "hunspell-dict-${shortName}-dsso-${version}";
+      pname = "hunspell-dict-${shortName}-dsso";
       _name = "ooo_swedish_dict_${_version}";
       readmeFile = "LICENSE_en_US.txt";
       src = fetchurl {
@@ -104,7 +105,7 @@ let
         ln -sv "$out/share/hunspell/${dictFileName}.aff" "$out/share/myspell/dicts/"
         # docs
         install -dm755 "$out/share/doc"
-        install -m644 ${readmeFile} $out/share/doc/${name}.txt
+        install -m644 ${readmeFile} $out/share/doc/${pname}.txt
       '';
     };
 
@@ -113,7 +114,7 @@ let
     mkDict rec {
       inherit dictFileName;
       version = "5.3";
-      name = "hunspell-dict-${shortName}-dicollecte-${version}";
+      pname = "hunspell-dict-${shortName}-dicollecte";
       readmeFile = "README_dict_fr.txt";
       src = fetchurl {
          url = "http://www.dicollecte.org/download/fr/hunspell-french-dictionaries-v${version}.zip";
@@ -146,7 +147,7 @@ let
     mkDict rec {
       inherit src srcFileName dictFileName;
       version = "2018.04.16";
-      name = "hunspell-dict-${shortName}-wordlist-${version}";
+      pname = "hunspell-dict-${shortName}-wordlist";
       srcReadmeFile = "README_" + srcFileName + ".txt";
       readmeFile = "README_" + dictFileName + ".txt";
       meta = with lib; {
@@ -174,7 +175,7 @@ let
     mkDict rec {
       inherit src dictFileName;
       version = "2.4";
-      name = "hunspell-dict-${shortName}-linguistico-${version}";
+      pname = "hunspell-dict-${shortName}-linguistico";
       readmeFile = dictFileName + "_README.txt";
       meta = with lib; {
         description = "Hunspell dictionary for ${shortDescription}";
@@ -198,7 +199,7 @@ let
   mkDictFromXuxen =
     { shortName, srcs, shortDescription, longDescription, dictFileName }:
     stdenv.mkDerivation rec {
-      name = "hunspell-dict-${shortName}-xuxen-${version}";
+      pname = "hunspell-dict-${shortName}-xuxen";
       version = "5-2015.11.10";
 
       inherit srcs;
@@ -231,7 +232,7 @@ let
   mkDictFromJ3e =
     { shortName, shortDescription, dictFileName }:
     stdenv.mkDerivation rec {
-      name = "hunspell-dict-${shortName}-j3e-${version}";
+      pname = "hunspell-dict-${shortName}-j3e";
       version = "20161207";
 
       src = fetchurl {
@@ -272,7 +273,7 @@ let
     , readmeFile ? "README_${dictFileName}.txt"
     , sourceRoot ? dictFileName }:
     mkDict rec {
-      name = "hunspell-dict-${shortName}-libreoffice-${version}";
+      pname = "hunspell-dict-${shortName}-libreoffice";
       version = "6.3.0.4";
       inherit dictFileName readmeFile;
       src = fetchFromGitHub {
@@ -699,7 +700,7 @@ in rec {
 
   uk_UA = uk-ua;
   uk-ua = mkDict rec {
-    name = "hunspell-dict-uk-ua-${version}";
+    pname = "hunspell-dict-uk-ua";
     version = "4.6.3";
     _version = "4-6.3";
 
@@ -760,7 +761,7 @@ in rec {
 
   da_DK = da-dk;
   da-dk = mkDict rec {
-    name = "hunspell-dict-da-dk-${version}";
+    pname = "hunspell-dict-da-dk";
     version = "2.5.189";
 
     src = fetchurl {
@@ -785,6 +786,36 @@ in rec {
     };
   };
 
+  /* DUTCH */
+
+  nl_NL = nl_nl;
+  nl_nl = mkDict rec {
+    pname = "hunspell-dict-nl-nl";
+    version = "2.20.19";
+
+    src = fetchFromGitHub {
+      owner = "OpenTaal";
+      repo = "opentaal-hunspell";
+      rev = version;
+      sha256 = "0jma8mmrncyzd77kxliyngs4z6z4769g3nh0a7xn2pd4s5y2xdpy";
+    };
+
+    preInstall = ''
+      mv nl.aff nl_NL.aff
+      mv nl.dic nl_NL.dic
+    '';
+
+    dictFileName = "nl_NL";
+    readmeFile = "README.md";
+
+    meta = with lib; {
+      description = "Hunspell dictionary for Dutch (Netherlands) from OpenTaal";
+      homepage = "https://www.opentaal.org/";
+      license = with licenses; [ bsd3 cc-by-nc-30 ];
+      maintainers = with maintainers; [ artturin ];
+    };
+  };
+
   /* HEBREW */
 
   he_IL = he-il;
diff --git a/pkgs/development/ocaml-modules/cstruct/1.9.0.nix b/pkgs/development/ocaml-modules/cstruct/1.9.0.nix
deleted file mode 100644
index 750a153c1c48..000000000000
--- a/pkgs/development/ocaml-modules/cstruct/1.9.0.nix
+++ /dev/null
@@ -1,36 +0,0 @@
-{ lib, stdenv, fetchFromGitHub, ocaml, ocamlbuild, ocplib-endian, sexplib, findlib, ppx_tools
-, async ? null, lwt ? null
-}:
-
-assert lib.versionAtLeast ocaml.version "4.01";
-
-let version = "1.9.0"; in
-
-let opt = b: "--${if b != null then "en" else "dis"}able"; in
-
-stdenv.mkDerivation {
-  name = "ocaml${ocaml.version}-cstruct-${version}";
-
-  src = fetchFromGitHub {
-    owner = "mirage";
-    repo = "ocaml-cstruct";
-    rev = "v${version}";
-    sha256 = "1c1j21zgmxi9spq23imy7byn50qr7hlds1cfpzxlsx9dp309jngy";
-  };
-
-  configureFlags = [ "${opt lwt}-lwt" "${opt async}-async" "${opt ppx_tools}-ppx" ];
-
-  buildInputs = [ ocaml findlib ocamlbuild ppx_tools lwt async ];
-  propagatedBuildInputs = [ ocplib-endian sexplib ];
-
-  createFindlibDestdir = true;
-  dontStrip = true;
-
-  meta = with lib; {
-    homepage = "https://github.com/mirage/ocaml-cstruct";
-    description = "Map OCaml arrays onto C-like structs";
-    license = lib.licenses.isc;
-    maintainers = [ maintainers.vbgl maintainers.ericbmerritt ];
-    platforms = ocaml.meta.platforms or [];
-  };
-}
diff --git a/pkgs/development/python-modules/aemet-opendata/default.nix b/pkgs/development/python-modules/aemet-opendata/default.nix
new file mode 100644
index 000000000000..9c344f720aec
--- /dev/null
+++ b/pkgs/development/python-modules/aemet-opendata/default.nix
@@ -0,0 +1,40 @@
+{ lib
+, buildPythonPackage
+, pythonOlder
+, fetchFromGitHub
+, geopy
+, requests
+, urllib3
+}:
+
+buildPythonPackage rec {
+  pname = "aemet-opendata";
+  version = "0.2.1";
+
+  disabled = pythonOlder "3.6";
+
+  src = fetchFromGitHub {
+    owner = "Noltari";
+    repo = "AEMET-OpenData";
+    rev = version;
+    sha256 = "0jl1897m3qmr48n469mq7d66k1j0rn7hlbcahm0ylf5i3ma03aiw";
+  };
+
+  propagatedBuildInputs = [
+    geopy
+    requests
+    urllib3
+  ];
+
+  # no tests implemented
+  doCheck = false;
+
+  pythonImportsCheck = [ "aemet_opendata.interface" ];
+
+  meta = with lib; {
+    description = "Python client for AEMET OpenData Rest API";
+    homepage = "https://github.com/Noltari/AEMET-OpenData";
+    license = licenses.gpl2Only;
+    maintainers = with maintainers; [ dotlambda ];
+  };
+}
diff --git a/pkgs/development/python-modules/awesomeversion/default.nix b/pkgs/development/python-modules/awesomeversion/default.nix
index 5eadd131d9ad..eed172868056 100644
--- a/pkgs/development/python-modules/awesomeversion/default.nix
+++ b/pkgs/development/python-modules/awesomeversion/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "awesomeversion";
-  version = "21.5.0";
+  version = "21.6.0";
   disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "ludeeus";
     repo = pname;
     rev = version;
-    sha256 = "sha256-0EOGWJZyvcRJyOqkcISvjL7o6lIaCwMKLftshsQCR6E=";
+    sha256 = "sha256-TODlLaj3bcNVHrly614oKe2OkhmowsJojpR7apUIojc=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/bitvavo-aio/default.nix b/pkgs/development/python-modules/bitvavo-aio/default.nix
new file mode 100644
index 000000000000..39094d74e5f5
--- /dev/null
+++ b/pkgs/development/python-modules/bitvavo-aio/default.nix
@@ -0,0 +1,35 @@
+{ lib
+, aiohttp
+, buildPythonPackage
+, fetchFromGitHub
+, pythonOlder
+}:
+
+buildPythonPackage rec {
+  pname = "bitvavo-aio";
+  version = "1.0.3";
+  disabled = pythonOlder "3.6";
+
+  src = fetchFromGitHub {
+    owner = "cyberjunky";
+    repo = pname;
+    rev = version;
+    sha256 = "1d9nbbvv7xnkixj03sfhs2da5j3i2m7p73r7j1yb7b39zas2rbig";
+  };
+
+  propagatedBuildInputs = [
+    aiohttp
+  ];
+
+  # Project has no tests
+  doCheck = false;
+
+  pythonImportsCheck = [ "bitvavo" ];
+
+  meta = with lib; {
+    description = "Python client for Bitvavo crypto exchange API";
+    homepage = "https://github.com/cyberjunky/bitvavo-aio";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/development/python-modules/blurhash/default.nix b/pkgs/development/python-modules/blurhash/default.nix
new file mode 100644
index 000000000000..665f08f7987c
--- /dev/null
+++ b/pkgs/development/python-modules/blurhash/default.nix
@@ -0,0 +1,39 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, pytestCheckHook
+, pillow
+, numpy
+}:
+
+buildPythonPackage rec {
+  pname = "blurhash";
+  version = "1.1.4";
+
+  src = fetchFromGitHub {
+    owner = "halcy";
+    repo = "blurhash-python";
+    # There are no tags: https://github.com/halcy/blurhash-python/issues/4
+    rev = "22e081ef1c24da1bb5c5eaa2c1d6649724deaef8";
+    sha256 = "1qq6mhydlp7q3na4kmaq3871h43wh3pyfyxr4b79bia73wjdylxf";
+  };
+
+  postPatch = ''
+    sed -i '/^addopts/d' setup.cfg
+  '';
+
+  checkInputs = [
+    pytestCheckHook
+    pillow
+    numpy
+  ];
+
+  pythonImportsCheck = [ "blurhash" ];
+
+  meta = with lib; {
+    description = "Pure-Python implementation of the blurhash algorithm";
+    homepage = "https://github.com/halcy/blurhash-python";
+    license = licenses.mit;
+    maintainers = with maintainers; [ dotlambda ];
+  };
+}
diff --git a/pkgs/development/python-modules/buienradar/default.nix b/pkgs/development/python-modules/buienradar/default.nix
new file mode 100644
index 000000000000..a366e0cdd3bc
--- /dev/null
+++ b/pkgs/development/python-modules/buienradar/default.nix
@@ -0,0 +1,58 @@
+{ lib
+, buildPythonPackage
+, pythonOlder
+, fetchFromGitHub
+, docopt
+, pytz
+, requests
+, setuptools
+, vincenty
+, xmltodict
+, pytestCheckHook
+}:
+
+buildPythonPackage rec {
+  pname = "buienradar";
+  version = "1.0.4";
+
+  disabled = pythonOlder "3.4";
+
+  src = fetchFromGitHub {
+    owner = "mjj4791";
+    repo = "python-buienradar";
+    rev = version;
+    sha256 = "1s0m5x7wdvzzsm797lh6531k614ybh7z0cikxjxqw377mivpz4wq";
+  };
+
+  propagatedBuildInputs = [
+    docopt
+    pytz
+    requests
+    setuptools
+    vincenty
+    xmltodict
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  disabledTests = [
+    # require network connection
+    "test_rain_data"
+    "test_json_data"
+    "test_xml_data"
+  ];
+
+  pythonImportsCheck = [
+    "buienradar.buienradar"
+    "buienradar.constants"
+  ];
+
+  meta = with lib; {
+    description = "Library and CLI tools for interacting with buienradar";
+    homepage = "https://github.com/mjj4791/python-buienradar";
+    license = licenses.mit;
+    maintainers = with maintainers; [ dotlambda ];
+  };
+}
diff --git a/pkgs/development/python-modules/discordpy/default.nix b/pkgs/development/python-modules/discordpy/default.nix
index 3fb5e7ae55e4..6de2b9f81721 100644
--- a/pkgs/development/python-modules/discordpy/default.nix
+++ b/pkgs/development/python-modules/discordpy/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "discord.py";
-  version = "1.7.2";
+  version = "1.7.3";
   disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "Rapptz";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-NY1/RKp8w9gAqGYXnCNhNZqR/inGMvUvxjJ1MMs62B8=";
+    sha256 = "sha256-eKXCzGFSzxpdZed4/4G6uJ96s5yCm6ci8K8XYR1zQlE=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/jeepney/default.nix b/pkgs/development/python-modules/jeepney/default.nix
index 84096c6db4f9..cea428a9ffd0 100644
--- a/pkgs/development/python-modules/jeepney/default.nix
+++ b/pkgs/development/python-modules/jeepney/default.nix
@@ -2,9 +2,11 @@
 , buildPythonPackage
 , fetchPypi
 , pythonOlder
+, dbus
 , pytest
+, pytest-trio
+, pytest-asyncio
 , testpath
-, tornado
 , trio
 }:
 
@@ -12,30 +14,44 @@ buildPythonPackage rec {
   pname = "jeepney";
   version = "0.6.0";
 
-  disabled = pythonOlder "3.5";
+  disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
     sha256 = "7d59b6622675ca9e993a6bd38de845051d315f8b0c72cca3aef733a20b648657";
   };
 
-  propagatedBuildInputs = [
-    tornado
-  ];
-
   checkInputs = [
+    dbus
     pytest
+    pytest-trio
+    pytest-asyncio
     testpath
     trio
   ];
 
   checkPhase = ''
-    pytest
+    runHook preCheck
+
+    dbus-run-session --config-file=${dbus}/share/dbus-1/session.conf -- pytest
+
+    runHook postCheck
   '';
 
+  pythonImportsCheck = [
+    "jeepney"
+    "jeepney.auth"
+    "jeepney.io"
+    "jeepney.io.asyncio"
+    "jeepney.io.blocking"
+    "jeepney.io.threading"
+    "jeepney.io.trio"
+  ];
+
   meta = with lib; {
     homepage = "https://gitlab.com/takluyver/jeepney";
     description = "Pure Python DBus interface";
     license = licenses.mit;
+    maintainers = with maintainers; [ dotlambda ];
   };
 }
diff --git a/pkgs/development/python-modules/mastodon-py/default.nix b/pkgs/development/python-modules/mastodon-py/default.nix
new file mode 100644
index 000000000000..c1a7c8985b78
--- /dev/null
+++ b/pkgs/development/python-modules/mastodon-py/default.nix
@@ -0,0 +1,61 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, blurhash
+, cryptography
+, decorator
+, http-ece
+, python-dateutil
+, python_magic
+, pytz
+, requests
+, six
+, pytestCheckHook
+, pytest-mock
+, pytest-vcr
+, requests-mock
+}:
+
+buildPythonPackage rec {
+  pname = "mastodon-py";
+  version = "1.5.1";
+
+  src = fetchFromGitHub {
+    owner = "halcy";
+    repo = "Mastodon.py";
+    rev = version;
+    sha256 = "044iqydw69a6xpz2hdjv1fc6a9b7bqdpnh3b33xqbks9d2415ddm";
+  };
+
+  postPatch = ''
+    sed -i '/^addopts/d' setup.cfg
+  '';
+
+  propagatedBuildInputs = [
+    blurhash
+    cryptography
+    decorator
+    http-ece
+    python-dateutil
+    python_magic
+    pytz
+    requests
+    six
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+    pytest-mock
+    pytest-vcr
+    requests-mock
+  ];
+
+  pythonImportsCheck = [ "mastodon" ];
+
+  meta = with lib; {
+    description = "Python wrapper for the Mastodon API";
+    homepage = "https://github.com/halcy/Mastodon.py";
+    license = licenses.mit;
+    maintainers = with maintainers; [ dotlambda ];
+  };
+}
diff --git a/pkgs/development/python-modules/notify-py/darwin-paths.patch b/pkgs/development/python-modules/notify-py/darwin-paths.patch
new file mode 100644
index 000000000000..3088825b9b9b
--- /dev/null
+++ b/pkgs/development/python-modules/notify-py/darwin-paths.patch
@@ -0,0 +1,13 @@
+diff --git a/notifypy/os_notifiers/macos.py b/notifypy/os_notifiers/macos.py
+index 68731fb..53fcee3 100644
+--- a/notifypy/os_notifiers/macos.py
++++ b/notifypy/os_notifiers/macos.py
+@@ -75,7 +75,7 @@ class MacOSNotifier(BaseNotifier):
+     def _find_installed_afplay():
+         """Function to find the path for afplay"""
+         try:
+-            run_which_for_aplay = subprocess.check_output(["which", "afplay"])
++            run_which_for_aplay = subprocess.check_output(["@which@", "afplay"])
+             return run_which_for_aplay.decode("utf-8")
+         except subprocess.CalledProcessError:
+             logger.exception("Unable to find aplay.")
diff --git a/pkgs/development/python-modules/notify-py/default.nix b/pkgs/development/python-modules/notify-py/default.nix
index ba4725c9aaa4..497b20d3df8f 100644
--- a/pkgs/development/python-modules/notify-py/default.nix
+++ b/pkgs/development/python-modules/notify-py/default.nix
@@ -1,5 +1,17 @@
-{ lib, stdenv, buildPythonPackage, fetchFromGitHub, isPy3k, coreutils, alsa-utils
-, libnotify, which, jeepney, loguru, pytestCheckHook }:
+{ lib
+, stdenv
+, buildPythonPackage
+, isPy3k
+, fetchFromGitHub
+, substituteAll
+, alsa-utils
+, libnotify
+, which
+, jeepney
+, loguru
+, pytestCheckHook
+, coreutils
+}:
 
 buildPythonPackage rec {
   pname = "notify-py";
@@ -14,15 +26,28 @@ buildPythonPackage rec {
     sha256 = "1n35adwsyhz304n4ifnsz6qzkymwhyqc8sg8d76qv5psv2xsnzlf";
   };
 
-  propagatedNativeBuildInputs = [ which ]
-    ++ lib.optionals stdenv.isLinux [ alsa-utils libnotify ];
+  patches = lib.optionals stdenv.isLinux [
+    # hardcode paths to aplay and notify-send
+    (substituteAll {
+      src = ./linux-paths.patch;
+      aplay = "${alsa-utils}/bin/aplay";
+      notifysend = "${libnotify}/bin/notify-send";
+    })
+  ] ++ lib.optionals stdenv.isDarwin [
+    # hardcode path to which
+    (substituteAll {
+      src = ./darwin-paths.patch;
+      which = "${which}/bin/which";
+    })
+  ];
+
   propagatedBuildInputs = [ loguru ]
     ++ lib.optionals stdenv.isLinux [ jeepney ];
 
-  checkInputs = [ coreutils pytestCheckHook ];
+  checkInputs = [ pytestCheckHook ];
 
   # Tests search for "afplay" binary which is built in to MacOS and not available in nixpkgs
-  preCheck = ''
+  preCheck = lib.optionalString stdenv.isDarwin ''
     mkdir $TMP/bin
     ln -s ${coreutils}/bin/true $TMP/bin/afplay
     export PATH="$TMP/bin:$PATH"
@@ -31,9 +56,9 @@ buildPythonPackage rec {
   pythonImportsCheck = [ "notifypy" ];
 
   meta = with lib; {
-    description = "Python Module for sending cross-platform desktop notifications on Windows, macOS, and Linux.";
-    homepage = "https://github.com/ms7m/notify-py/";
+    description = "Cross-platform desktop notification library for Python";
+    homepage = "https://github.com/ms7m/notify-py";
     license = licenses.mit;
-    maintainers = with maintainers; [ austinbutler ];
+    maintainers = with maintainers; [ austinbutler dotlambda ];
   };
 }
diff --git a/pkgs/development/python-modules/notify-py/linux-paths.patch b/pkgs/development/python-modules/notify-py/linux-paths.patch
new file mode 100644
index 000000000000..f043ec14a467
--- /dev/null
+++ b/pkgs/development/python-modules/notify-py/linux-paths.patch
@@ -0,0 +1,54 @@
+diff --git a/notifypy/os_notifiers/linux.py b/notifypy/os_notifiers/linux.py
+index ee89216..5201574 100644
+--- a/notifypy/os_notifiers/linux.py
++++ b/notifypy/os_notifiers/linux.py
+@@ -53,30 +53,12 @@ class LinuxNotifierLibNotify(BaseNotifier):
+     @staticmethod
+     def _find_installed_aplay():
+         """Function to find the path for notify-send"""
+-        try:
+-            run_which_for_aplay = subprocess.check_output(["which", "aplay"])
+-            return run_which_for_aplay.decode("utf-8")
+-        except subprocess.CalledProcessError:
+-            logger.exception("Unable to find aplay.")
+-            return False
+-        except Exception:
+-            logger.exception("Unhandled exception for finding aplay.")
+-            return False
++        return "@aplay@"
+ 
+     @staticmethod
+     def _find_installed_notify_send():
+         """Function to find the path for notify-send"""
+-        try:
+-            run_which_for_notify_send = subprocess.check_output(
+-                ["which", "notify-send"]
+-            )
+-            return run_which_for_notify_send.decode("utf-8")
+-        except subprocess.CalledProcessError:
+-            logger.exception("Unable to find notify-send.")
+-            return False
+-        except Exception:
+-            logger.exception("Unhandled exception for finding notify-send.")
+-            return False
++        return "@notifysend@"
+ 
+     def send_notification(
+         self,
+@@ -159,15 +141,7 @@ class LinuxNotifier(BaseNotifier):
+     @staticmethod
+     def _find_installed_aplay():
+         """Function to find the path for notify-send"""
+-        try:
+-            run_which_for_aplay = subprocess.check_output(["which", "aplay"])
+-            return run_which_for_aplay.decode("utf-8")
+-        except subprocess.CalledProcessError:
+-            logger.exception("Unable to find aplay.")
+-            return False
+-        except Exception:
+-            logger.exception("Unhandled exception for finding aplay.")
+-            return False
++        return "@aplay@"
+ 
+     def send_notification(
+         self,
diff --git a/pkgs/development/python-modules/pyatag/default.nix b/pkgs/development/python-modules/pyatag/default.nix
new file mode 100644
index 000000000000..d2ed7d6ff34a
--- /dev/null
+++ b/pkgs/development/python-modules/pyatag/default.nix
@@ -0,0 +1,39 @@
+{ lib
+, buildPythonPackage
+, isPy27
+, fetchFromGitHub
+, aiohttp
+}:
+
+buildPythonPackage rec {
+  pname = "pyatag";
+  version = "0.3.5.3";
+
+  disabled = isPy27;
+
+  src = fetchFromGitHub {
+    owner = "MatsNl";
+    repo = "pyatag";
+    rev = version;
+    sha256 = "00ly4injmgrj34p0lyx7cz2crgnfcijmzc0540gf7hpwha0marf6";
+  };
+
+  propagatedBuildInputs = [
+    aiohttp
+  ];
+
+  # no tests implemented
+  doCheck = false;
+
+  pythonImportsCheck = [
+    "pyatag"
+    "pyatag.discovery"
+  ];
+
+  meta = with lib; {
+    description = "Python module to talk to Atag One";
+    homepage = "https://github.com/MatsNl/pyatag";
+    license = licenses.mit;
+    maintainers = with maintainers; [ dotlambda ];
+  };
+}
diff --git a/pkgs/development/python-modules/pyialarm/default.nix b/pkgs/development/python-modules/pyialarm/default.nix
index 9603964ca481..312ef8a99657 100644
--- a/pkgs/development/python-modules/pyialarm/default.nix
+++ b/pkgs/development/python-modules/pyialarm/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "pyialarm";
-  version = "1.8.1";
+  version = "1.9.0";
   disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "RyuzakiKK";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-Hig1BlgZX2FBh+wx7qz9lmkBIFn/IHActf9FXDU6Yz8=";
+    sha256 = "sha256-mvi8cd9uVFvG1Jc3OeuEwuLjbuMjPRrNRHFUVe3g/NM=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/spiderpy/default.nix b/pkgs/development/python-modules/spiderpy/default.nix
new file mode 100644
index 000000000000..166f821fb3ee
--- /dev/null
+++ b/pkgs/development/python-modules/spiderpy/default.nix
@@ -0,0 +1,36 @@
+{ lib
+, buildPythonPackage
+, isPy27
+, fetchFromGitHub
+, requests
+}:
+
+buildPythonPackage rec {
+  pname = "spiderpy";
+  version = "1.5.0";
+
+  disabled = isPy27;
+
+  src = fetchFromGitHub {
+    owner = "peternijssen";
+    repo = "spiderpy";
+    rev = version;
+    sha256 = "1nbfjqwiyyl7lhkb4rvickxiy9nwynr2sxr1hpyv0vm09h6q8hsc";
+  };
+
+  propagatedBuildInputs = [
+    requests
+  ];
+
+  # no unit tests implemented
+  doCheck = false;
+
+  pythonImportsCheck = [ "spiderpy.spiderapi" ];
+
+  meta = with lib; {
+    description = "Unofficial Python wrapper for the Spider API";
+    homepage = "https://www.github.com/peternijssen/spiderpy";
+    license = licenses.mit;
+    maintainers = with maintainers; [ dotlambda ];
+  };
+}
diff --git a/pkgs/development/python-modules/vincenty/default.nix b/pkgs/development/python-modules/vincenty/default.nix
new file mode 100644
index 000000000000..dbf174bd2a72
--- /dev/null
+++ b/pkgs/development/python-modules/vincenty/default.nix
@@ -0,0 +1,28 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+}:
+
+buildPythonPackage rec {
+  pname = "vincenty";
+  version = "0.1.4";
+
+  src = fetchFromGitHub {
+    owner = "maurycyp";
+    repo = "vincenty";
+    rev = version;
+    sha256 = "1li8gv0zb1pdbxdybgaykm38lqbkb5dr7rph6zs1k4k3sh15ldw3";
+  };
+
+  # no tests implemented
+  doCheck = false;
+
+  pythonImportsCheck = [ "vincenty" ];
+
+  meta = with lib; {
+    description = "Calculate the geographical distance between 2 points with extreme accuracy";
+    homepage = "https://github.com/maurycyp/vincenty";
+    license = licenses.unlicense;
+    maintainers = with maintainers; [ dotlambda ];
+  };
+}
diff --git a/pkgs/development/tools/database/litecli/default.nix b/pkgs/development/tools/database/litecli/default.nix
index ee18a72216dc..75e600ccb513 100644
--- a/pkgs/development/tools/database/litecli/default.nix
+++ b/pkgs/development/tools/database/litecli/default.nix
@@ -1,16 +1,15 @@
-{ lib, python3Packages }:
+{ lib
+, python3Packages
+}:
 
 python3Packages.buildPythonApplication rec {
   pname = "litecli";
-  version = "1.5.0";
-
-  # Python 2 won't have prompt_toolkit 2.x.x
-  # See: https://github.com/NixOS/nixpkgs/blob/f49e2ad3657dede09dc998a4a98fd5033fb52243/pkgs/top-level/python-packages.nix#L3408
-  disabled = python3Packages.isPy27;
+  version = "1.6.0";
+  disabled = python3Packages.pythonOlder "3.4";
 
   src = python3Packages.fetchPypi {
     inherit pname version;
-    sha256 = "b09f0804d26b018360b240778612390810e8e00ea0f79d5412fd0d4775c0e3cd";
+    sha256 = "sha256-TSdOFHW007syOEg4gwvEqDiJkrfLgRmqjP/H/6oBZ/k=";
   };
 
   propagatedBuildInputs = with python3Packages; [
@@ -27,6 +26,8 @@ python3Packages.buildPythonApplication rec {
     mock
   ];
 
+  pythonImportsCheck = [ "litecli" ];
+
   meta = with lib; {
     description = "Command-line interface for SQLite";
     longDescription = ''
diff --git a/pkgs/development/tools/misc/terraform-ls/default.nix b/pkgs/development/tools/misc/terraform-ls/default.nix
index ac7d2e3132e4..dec2cd3a19a4 100644
--- a/pkgs/development/tools/misc/terraform-ls/default.nix
+++ b/pkgs/development/tools/misc/terraform-ls/default.nix
@@ -1,4 +1,4 @@
-{ lib, buildGoModule, fetchFromGitHub }:
+{ lib, buildGoModule, fetchFromGitHub, stdenv }:
 
 buildGoModule rec {
   pname = "terraform-ls";
@@ -17,8 +17,23 @@ buildGoModule rec {
   '';
 
   preCheck = ''
-    # Remove test that requires networking
+    # Remove tests that requires networking
     rm internal/terraform/exec/exec_test.go
+  '' + lib.optionalString stdenv.isAarch64 ''
+    # Not all test failures have tracking issues as HashiCorp do not have
+    # aarch64 testing infra easily available, see issue 549 below.
+
+    # Remove file that contains `TestLangServer_workspaceExecuteCommand_modules_multiple`
+    # which fails on aarch64: https://github.com/hashicorp/terraform-ls/issues/549
+    rm internal/langserver/handlers/execute_command_modules_test.go
+
+    # `TestModuleManager_ModuleCandidatesByPath` variants fail
+    rm internal/terraform/module/module_manager_test.go
+
+    # internal/terraform/module/module_ops_queue_test.go:17:15: undefined: testLogger
+    # internal/terraform/module/watcher_test.go:39:11: undefined: testLogger
+    # internal/terraform/module/watcher_test.go:79:14: undefined: testLogger
+    rm internal/terraform/module/{watcher_test,module_ops_queue_test}.go
   '';
 
   meta = with lib; {
diff --git a/pkgs/misc/vscode-extensions/default.nix b/pkgs/misc/vscode-extensions/default.nix
index 7951636c60c6..8f09964a2fbc 100644
--- a/pkgs/misc/vscode-extensions/default.nix
+++ b/pkgs/misc/vscode-extensions/default.nix
@@ -245,6 +245,19 @@ let
         };
       };
 
+      coolbear.systemd-unit-file = buildVscodeMarketplaceExtension {
+        mktplcRef = {
+          publisher = "coolbear";
+          name = "systemd-unit-file";
+          version = "1.0.6";
+          sha256 = "0sc0zsdnxi4wfdlmaqwb6k2qc21dgwx6ipvri36x7agk7m8m4736";
+        };
+        meta = {
+          license = lib.licenses.mit;
+          maintainers = with lib.maintainers; [ kamadorueda ];
+        };
+      };
+
       dbaeumer.vscode-eslint = buildVscodeMarketplaceExtension {
         mktplcRef = {
           name = "vscode-eslint";
diff --git a/pkgs/misc/vscode-extensions/terraform/default.nix b/pkgs/misc/vscode-extensions/terraform/default.nix
index 90ea121850d2..cd6d7b8615c7 100644
--- a/pkgs/misc/vscode-extensions/terraform/default.nix
+++ b/pkgs/misc/vscode-extensions/terraform/default.nix
@@ -3,13 +3,13 @@ vscode-utils.buildVscodeMarketplaceExtension rec {
   mktplcRef = {
     name = "terraform";
     publisher = "hashicorp";
-    version = "2.12.0";
+    version = "2.12.1";
   };
 
   vsix = fetchurl {
     name = "${mktplcRef.publisher}-${mktplcRef.name}.zip";
     url = "https://github.com/hashicorp/vscode-terraform/releases/download/v${mktplcRef.version}/${mktplcRef.name}-${mktplcRef.version}.vsix";
-    sha256 = "1r12yxpf0wlh7vdxpj04356zlgxmlwz9apdlxnv5ay056a2a8k3a";
+    sha256 = "0mna2agv2g0fw17m2swlzvj5qdqkr074n630x8yibi4ihv6z3l3y";
   };
 
   patches = [ ./fix-terraform-ls.patch ];
diff --git a/pkgs/os-specific/linux/wireguard/default.nix b/pkgs/os-specific/linux/wireguard/default.nix
index 2578d09fc1ec..e183b4ac5d4b 100644
--- a/pkgs/os-specific/linux/wireguard/default.nix
+++ b/pkgs/os-specific/linux/wireguard/default.nix
@@ -7,11 +7,11 @@ assert lib.versionOlder kernel.version "5.6";
 
 stdenv.mkDerivation rec {
   pname = "wireguard";
-  version = "1.0.20210424";
+  version = "1.0.20210606";
 
   src = fetchzip {
     url = "https://git.zx2c4.com/wireguard-linux-compat/snapshot/wireguard-linux-compat-${version}.tar.xz";
-    sha256 = "sha256-VLtIxYh308X28c9EOeHx0eA7HP2aRlekPXRt015/qAg=";
+    sha256 = "sha256-ha7x6+41oPRRhuRwEb1ojRWLF1dlEMoJtqXrzRKQ408=";
   };
 
   hardeningDisable = [ "pic" ];
diff --git a/pkgs/servers/home-assistant/component-packages.nix b/pkgs/servers/home-assistant/component-packages.nix
index 793d869be589..f7f5f589f62a 100644
--- a/pkgs/servers/home-assistant/component-packages.nix
+++ b/pkgs/servers/home-assistant/component-packages.nix
@@ -12,7 +12,7 @@
     "adguard" = ps: with ps; [ adguardhome ];
     "ads" = ps: with ps; [ pyads ];
     "advantage_air" = ps: with ps; [ advantage-air ];
-    "aemet" = ps: with ps; [ ]; # missing inputs: AEMET-OpenData
+    "aemet" = ps: with ps; [ aemet-opendata ];
     "aftership" = ps: with ps; [ pyaftership ];
     "agent_dvr" = ps: with ps; [ agent-py ];
     "air_quality" = ps: with ps; [ ];
@@ -55,7 +55,7 @@
     "asterisk_cdr" = ps: with ps; [ ]; # missing inputs: asterisk_mbox
     "asterisk_mbox" = ps: with ps; [ ]; # missing inputs: asterisk_mbox
     "asuswrt" = ps: with ps; [ aioasuswrt ];
-    "atag" = ps: with ps; [ ]; # missing inputs: pyatag
+    "atag" = ps: with ps; [ pyatag ];
     "aten_pe" = ps: with ps; [ atenpdu ];
     "atome" = ps: with ps; [ ]; # missing inputs: pyatome
     "august" = ps: with ps; [ yalexs ];
@@ -106,7 +106,7 @@
     "bsblan" = ps: with ps; [ bsblan ];
     "bt_home_hub_5" = ps: with ps; [ ]; # missing inputs: bthomehub5-devicelist
     "bt_smarthub" = ps: with ps; [ ]; # missing inputs: btsmarthub_devicelist
-    "buienradar" = ps: with ps; [ ]; # missing inputs: buienradar
+    "buienradar" = ps: with ps; [ buienradar ];
     "caldav" = ps: with ps; [ caldav ];
     "calendar" = ps: with ps; [ aiohttp-cors ];
     "camera" = ps: with ps; [ aiohttp-cors ];
@@ -483,7 +483,7 @@
     "manual_mqtt" = ps: with ps; [ aiohttp-cors paho-mqtt ];
     "map" = ps: with ps; [ aiohttp-cors pillow ];
     "marytts" = ps: with ps; [ ]; # missing inputs: speak2mary
-    "mastodon" = ps: with ps; [ ]; # missing inputs: Mastodon.py
+    "mastodon" = ps: with ps; [ mastodon-py ];
     "matrix" = ps: with ps; [ matrix-client ];
     "maxcube" = ps: with ps; [ ]; # missing inputs: maxcube-api
     "mazda" = ps: with ps; [ pymazda ];
@@ -794,7 +794,7 @@
     "spaceapi" = ps: with ps; [ aiohttp-cors ];
     "spc" = ps: with ps; [ ]; # missing inputs: pyspcwebgw
     "speedtestdotnet" = ps: with ps; [ speedtest-cli ];
-    "spider" = ps: with ps; [ ]; # missing inputs: spiderpy
+    "spider" = ps: with ps; [ spiderpy ];
     "splunk" = ps: with ps; [ ]; # missing inputs: hass_splunk
     "spotify" = ps: with ps; [ aiohttp-cors spotipy ];
     "sql" = ps: with ps; [ sqlalchemy ];
diff --git a/pkgs/servers/home-assistant/default.nix b/pkgs/servers/home-assistant/default.nix
index df6b475cf65e..da3e16b0a209 100644
--- a/pkgs/servers/home-assistant/default.nix
+++ b/pkgs/servers/home-assistant/default.nix
@@ -274,6 +274,7 @@ in with py.pkgs; buildPythonApplication rec {
     "acmeda"
     "adguard"
     "advantage_air"
+    "aemet"
     "agent_dvr"
     "air_quality"
     "airly"
@@ -295,6 +296,7 @@ in with py.pkgs; buildPythonApplication rec {
     "aprs"
     "arlo"
     "asuswrt"
+    "atag"
     "august"
     "aurora"
     "auth"
@@ -312,6 +314,7 @@ in with py.pkgs; buildPythonApplication rec {
     "broadlink"
     "brother"
     "bsblan"
+    "buienradar"
     "caldav"
     "calendar"
     "camera"
@@ -592,6 +595,7 @@ in with py.pkgs; buildPythonApplication rec {
     "soundtouch"
     "spaceapi"
     "speedtestdotnet"
+    "spider"
     "spotify"
     "sql"
     "squeezebox"
diff --git a/pkgs/tools/filesystems/rar2fs/default.nix b/pkgs/tools/filesystems/rar2fs/default.nix
index ddd37387fae6..19db209cbf91 100644
--- a/pkgs/tools/filesystems/rar2fs/default.nix
+++ b/pkgs/tools/filesystems/rar2fs/default.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "rar2fs";
-  version = "1.29.4";
+  version = "1.29.5";
 
   src = fetchFromGitHub {
     owner = "hasse69";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-O14KuzngzsGazvwz3FCPe0SplO8I6CPJjpCLBPcZq6k=";
+    sha256 = "sha256-x3QBnnwt9pXT0egOJ2rnUcZP99y9eVcw3rNTkdH2LYs=";
   };
 
   postPatch = ''
diff --git a/pkgs/tools/misc/mathpix-snipping-tool/default.nix b/pkgs/tools/misc/mathpix-snipping-tool/default.nix
new file mode 100644
index 000000000000..7e940ee4f77f
--- /dev/null
+++ b/pkgs/tools/misc/mathpix-snipping-tool/default.nix
@@ -0,0 +1,31 @@
+{ appimageTools, lib, fetchurl }:
+let
+  pname = "mathpix-snipping-tool";
+  version = "03.00.0025";
+  name = "${pname}-${version}";
+
+  src = fetchurl {
+    url = "https://download.mathpix.com/linux/Mathpix_Snipping_Tool-x86_64.v${version}.AppImage";
+    sha256 = "0p39rsmjfz3m5s3k9pmmkqbp8f21s1cwjgspz8m47dq5jjls8ay8";
+  };
+
+  appimageContents = appimageTools.extract { inherit name src; };
+in appimageTools.wrapType2 {
+  inherit name src;
+
+  extraInstallCommands = ''
+    mv $out/bin/${name} $out/bin/${pname}
+
+    install -m 444 -D ${appimageContents}/${pname}.desktop -t $out/share/applications
+
+    cp -r ${appimageContents}/usr/share/icons $out/share
+  '';
+
+  meta = with lib; {
+    description = "OCR tool to convert pictures to LaTeX.";
+    homepage = "https://mathpix.com/";
+    license = licenses.unfree;
+    maintainers = [ maintainers.hiro98 ];
+    platforms = [ "x86_64-linux" ];
+  };
+}
diff --git a/pkgs/tools/misc/vector/default.nix b/pkgs/tools/misc/vector/default.nix
index 161c28054b0b..e8c3ed7cbe9e 100644
--- a/pkgs/tools/misc/vector/default.nix
+++ b/pkgs/tools/misc/vector/default.nix
@@ -2,41 +2,57 @@
 , lib
 , fetchFromGitHub
 , rustPlatform
-, openssl
 , pkg-config
+, llvmPackages
+, openssl
 , protobuf
+, rdkafka
+, oniguruma
+, zstd
 , Security
 , libiconv
-, rdkafka
-, tzdata
 , coreutils
 , CoreServices
-, features ? ([ "jemallocator" "rdkafka" "rdkafka/dynamic_linking" ]
-    ++ (lib.optional stdenv.targetPlatform.isUnix "unix")
-    ++ [ "sinks" "sources" "transforms" ])
+, tzdata
+  # kafka is optional but one of the most used features
+, enableKafka ? true
+  # TODO investigate adding "api" "api-client" "vrl-cli" and various "vendor-*"
+  # "disk-buffer" is using leveldb TODO: investigate how useful
+  # it would be, perhaps only for massive scale?
+, features ? ([ "sinks" "sources" "transforms" ]
+    # the second feature flag is passed to the rdkafka dependency
+    # building on linux fails without this feature flag (both x86_64 and AArch64)
+    ++ (lib.optionals enableKafka [ "rdkafka-plain" "rdkafka/dynamic_linking" ])
+    ++ (lib.optional stdenv.targetPlatform.isUnix "unix"))
 }:
 
 rustPlatform.buildRustPackage rec {
   pname = "vector";
-  version = "0.13.1";
+  version = "0.14.0";
 
   src = fetchFromGitHub {
     owner = "timberio";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-ige0138alZ0KAmPakPVmDVydz5qco6m0xK7AEzScyXc=";
+    sha256 = "sha256-wtihrR19jMJ7Kgvy6XBzOUrC/WKNVl2MVx4lWgXYlvg=";
   };
 
-  cargoSha256 = "sha256-oK4M6zTfI0QVW9kQTgpP/vSxFt2VlRABmKvQ4aAqC74=";
+  cargoSha256 = "sha256-VYIzAqh5Xxmn1koxhh+UDb2G3WS2UVXffuBY7h5Kr7A=";
   nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ openssl protobuf rdkafka ]
+  buildInputs = [ oniguruma openssl protobuf rdkafka zstd ]
     ++ lib.optional stdenv.isDarwin [ Security libiconv coreutils CoreServices ];
 
   # needed for internal protobuf c wrapper library
   PROTOC = "${protobuf}/bin/protoc";
   PROTOC_INCLUDE = "${protobuf}/include";
+  RUSTONIG_SYSTEM_LIBONIG = true;
+  LIBCLANG_PATH = "${llvmPackages.libclang.lib}/lib";
 
   cargoBuildFlags = [ "--no-default-features" "--features" (lib.concatStringsSep "," features) ];
+  # TODO investigate compilation failure for tests
+  # dev dependency includes httpmock which depends on iashc which depends on curl-sys with http2 feature enabled
+  # compilation fails because of a missing http2 include
+  doCheck = !stdenv.isDarwin;
   checkPhase = "TZDIR=${tzdata}/share/zoneinfo cargo test --no-default-features --features ${lib.concatStringsSep "," features} -- --test-threads 1";
 
   # recent overhauls of DNS support in 0.9 mean that we try to resolve
diff --git a/pkgs/tools/security/gpg-tui/default.nix b/pkgs/tools/security/gpg-tui/default.nix
index 4aae027f0155..acef238c1fe6 100644
--- a/pkgs/tools/security/gpg-tui/default.nix
+++ b/pkgs/tools/security/gpg-tui/default.nix
@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "gpg-tui";
-  version = "0.4.1";
+  version = "0.5.0";
 
   src = fetchFromGitHub {
     owner = "orhun";
     repo = "gpg-tui";
     rev = "v${version}";
-    sha256 = "sha256-PLKBkOwhp8Os2yAx+nzfWs41d3v12nnUVFB6oDfl00Y=";
+    sha256 = "sha256-D3H1tJ+7ObNssrc/eMzYQPxeA8cOpGgRF/5VX2kfha0=";
   };
 
-  cargoSha256 = "sha256-lHrA4TlaOcMhO2a8lnd8hc6X2cDnWKMNLWEzlezIcNE=";
+  cargoSha256 = "sha256-0NctI16ZsOAEkuCRQ45aOl4p2a3N6Nx88HwtbWht/UY=";
 
   nativeBuildInputs = [
     gpgme # for gpgme-config
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 80980a63c00b..a16c2bdd2d9a 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -6317,6 +6317,8 @@ in
     inherit (darwin.apple_sdk.frameworks) Security;
   };
 
+  mathpix-snipping-tool = callPackage ../tools/misc/mathpix-snipping-tool { };
+
   /* Python 3.8 is currently broken with matrix-synapse since `python38Packages.bleach` fails
     (https://github.com/NixOS/nixpkgs/issues/76093) */
   matrix-synapse = callPackage ../servers/matrix-synapse { /*python3 = python38;*/ };
diff --git a/pkgs/top-level/ocaml-packages.nix b/pkgs/top-level/ocaml-packages.nix
index bdb16cba2a78..9168661a75b9 100644
--- a/pkgs/top-level/ocaml-packages.nix
+++ b/pkgs/top-level/ocaml-packages.nix
@@ -215,10 +215,7 @@ let
 
     csexp = callPackage ../development/ocaml-modules/csexp { };
 
-    cstruct =
-      if lib.versionAtLeast ocaml.version "4.2"
-      then callPackage ../development/ocaml-modules/cstruct {}
-      else callPackage ../development/ocaml-modules/cstruct/1.9.0.nix { };
+    cstruct = callPackage ../development/ocaml-modules/cstruct {};
 
     cstruct-lwt = callPackage ../development/ocaml-modules/cstruct/lwt.nix { };
 
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index aa261fb84b63..c76f3753ad55 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -207,6 +207,8 @@ in {
 
   advantage-air = callPackage ../development/python-modules/advantage-air { };
 
+  aemet-opendata = callPackage ../development/python-modules/aemet-opendata { };
+
   aenum = callPackage ../development/python-modules/aenum { };
 
   afdko = callPackage ../development/python-modules/afdko { };
@@ -1071,6 +1073,8 @@ in {
 
   bitstruct = callPackage ../development/python-modules/bitstruct { };
 
+  bitvavo-aio = callPackage ../development/python-modules/bitvavo-aio { };
+
   bjoern = callPackage ../development/python-modules/bjoern { };
 
   bkcharts = callPackage ../development/python-modules/bkcharts { };
@@ -1107,6 +1111,8 @@ in {
 
   bluepy-devices = callPackage ../development/python-modules/bluepy-devices { };
 
+  blurhash = callPackage ../development/python-modules/blurhash { };
+
   bme680 = callPackage ../development/python-modules/bme680 { };
 
   bokeh = callPackage ../development/python-modules/bokeh { };
@@ -1188,6 +1194,8 @@ in {
 
   bugzilla = callPackage ../development/python-modules/bugzilla { };
 
+  buienradar = callPackage ../development/python-modules/buienradar { };
+
   buildbot = callPackage ../development/python-modules/buildbot { };
 
   buildbot-ui = self.buildbot.withPlugins (with self.buildbot-plugins; [ www ]);
@@ -4204,6 +4212,8 @@ in {
 
   mask-rcnn = callPackage ../development/python-modules/mask-rcnn { };
 
+  mastodon-py = callPackage ../development/python-modules/mastodon-py { };
+
   mat2 = callPackage ../development/python-modules/mat2 { };
 
   matchpy = callPackage ../development/python-modules/matchpy { };
@@ -5167,6 +5177,8 @@ in {
 
   ppdeep = callPackage ../development/python-modules/ppdeep { };
 
+  pyatag = callPackage ../development/python-modules/pyatag { };
+
   pynndescent = callPackage ../development/python-modules/pynndescent { };
 
   pynobo = callPackage ../development/python-modules/pynobo { };
@@ -7912,6 +7924,8 @@ in {
 
   sphfile = callPackage ../development/python-modules/sphfile { };
 
+  spiderpy = callPackage ../development/python-modules/spiderpy { };
+
   spinners = callPackage ../development/python-modules/spinners { };
 
   sphinxcontrib-actdiag = callPackage ../development/python-modules/sphinxcontrib-actdiag { };
@@ -8767,6 +8781,8 @@ in {
 
   viewstate = callPackage ../development/python-modules/viewstate { };
 
+  vincenty = callPackage ../development/python-modules/vincenty { };
+
   vine = callPackage ../development/python-modules/vine { };
 
   virtkey = callPackage ../development/python-modules/virtkey { };