diff --git a/doc/languages-frameworks/python.section.md b/doc/languages-frameworks/python.section.md
index 838426afa04f..7da839ee4826 100644
--- a/doc/languages-frameworks/python.section.md
+++ b/doc/languages-frameworks/python.section.md
@@ -643,7 +643,7 @@ and in this case the `python38` interpreter is automatically used.
 Versions 2.7, 3.5, 3.6, 3.7 and 3.8 of the CPython interpreter are available as
 respectively `python27`, `python35`, `python36`, `python37` and `python38`. The
 aliases `python2` and `python3` correspond to respectively `python27` and
-`python37`. The default interpreter, `python`, maps to `python2`. The PyPy
+`python38`. The default interpreter, `python`, maps to `python2`. The PyPy
 interpreters compatible with Python 2.7 and 3 are available as `pypy27` and
 `pypy3`, with aliases `pypy2` mapping to `pypy27` and `pypy` mapping to `pypy2`.
 The Nix expressions for the interpreters can be found in
diff --git a/doc/languages-frameworks/rust.section.md b/doc/languages-frameworks/rust.section.md
index f56bc5285b93..ec418c563359 100644
--- a/doc/languages-frameworks/rust.section.md
+++ b/doc/languages-frameworks/rust.section.md
@@ -75,6 +75,72 @@ pkgs.rustPlatform.buildRustPackage {
 }
 ```
 
+### Running package tests
+
+When using `buildRustPackage`, the `checkPhase` is enabled by default and runs
+`cargo test` on the package to build. To make sure that we don't compile the
+sources twice and to actually test the artifacts that will be used at runtime, 
+the tests will be ran in the `release` mode by default.
+
+However, in some cases the test-suite of a package doesn't work properly in the
+`release` mode. For these situations, the mode for `checkPhase` can be changed like
+so:
+
+```nix
+rustPlatform.buildRustPackage {
+  /* ... */
+  checkType = "debug";
+}
+```
+
+Please note that the code will be compiled twice here: once in `release` mode
+for the `buildPhase`, and again in `debug` mode for the `checkPhase`.
+
+#### Tests relying on the structure of the `target/` directory
+
+Some tests may rely on the structure of the `target/` directory. Those tests
+are likely to fail because we use `cargo --target` during the build. This means that
+the artifacts
+[are stored in `target/<architecture>/release/`](https://doc.rust-lang.org/cargo/guide/build-cache.html),
+rather than in `target/release/`.
+
+This can only be worked around by patching the affected tests accordingly.
+
+#### Disabling package-tests
+
+In some instances, it may be necessary to disable testing altogether (with `doCheck = false;`):
+
+* If no tests exist -- the `checkPhase` should be explicitly disabled to skip
+  unnecessary build steps to speed up the build.
+* If tests are highly impure (e.g. due to network usage).
+
+There will obviously be some corner-cases not listed above where it's sensible to disable tests.
+The above are just guidelines, and exceptions may be granted on a case-by-case basis.
+
+However, please check if it's possible to disable a problematic subset of the
+test suite and leave a comment explaining your reasoning.
+
+### Building a package in `debug` mode
+
+By default, `buildRustPackage` will use `release` mode for builds. If a package
+should be built in `debug` mode, it can be configured like so:
+
+```nix
+rustPlatform.buildRustPackage {
+  /* ... */
+  buildType = "debug";
+}
+```
+
+In this scenario, the `checkPhase` will be ran in `debug` mode as well.
+
+### Custom `build`/`install`-procedures
+
+Some packages may use custom scripts for building/installing, e.g. with a `Makefile`.
+In these cases, it's recommended to override the `buildPhase`/`installPhase`/`checkPhase`.
+
+Otherwise, some steps may fail because of the modified directory structure of `target/`.
+
 ### Building a crate with an absent or out-of-date Cargo.lock file
 
 `buildRustPackage` needs a `Cargo.lock` file to get all dependencies in the
diff --git a/nixos/doc/manual/release-notes/rl-2009.xml b/nixos/doc/manual/release-notes/rl-2009.xml
index 40316b980f3b..c7b30a198d86 100644
--- a/nixos/doc/manual/release-notes/rl-2009.xml
+++ b/nixos/doc/manual/release-notes/rl-2009.xml
@@ -42,6 +42,11 @@
      PHP now defaults to PHP 7.4, updated from 7.3.
     </para>
    </listitem>
+   <listitem>
+    <para>
+     Python 3 now defaults to Python 3.8 instead of 3.7.
+    </para>
+   </listitem>
    <listitem>
     <para>
      Two new options, <link linkend="opt-services.openssh.authorizedKeysCommand">authorizedKeysCommand</link>
@@ -486,9 +491,21 @@ systemd.services.nginx.serviceConfig.ReadWritePaths = [ "/var/www" ];
     </para>
    </listitem>
    <listitem>
-   <para>
-     The default output of <literal>buildGoPackage</literal> is now <literal>$out</literal> instead of <literal>$bin</literal>.
-   </para>
+    <para>
+      The default output of <literal>buildGoPackage</literal> is now <literal>$out</literal> instead of <literal>$bin</literal>.
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     Packages built using <literal>buildRustPackage</literal> now use <literal>release</literal>
+     mode for the <literal>checkPhase</literal> by default.
+    </para>
+    <para>
+     Please note that Rust packages utilizing a custom build/install procedure
+     (e.g. by using a <filename>Makefile</filename>) or test suites that rely on the
+     structure of the <filename>target/</filename> directory may break due to those assumptions.
+     For further information, please read the Rust section in the Nixpkgs manual.
+    </para>
    </listitem>
    <listitem>
    <para>
diff --git a/pkgs/applications/editors/neovim/gnvim/default.nix b/pkgs/applications/editors/neovim/gnvim/default.nix
index e9f42d2b9b5e..3693ff322338 100644
--- a/pkgs/applications/editors/neovim/gnvim/default.nix
+++ b/pkgs/applications/editors/neovim/gnvim/default.nix
@@ -33,6 +33,10 @@ rustPlatform.buildRustPackage rec {
     EOF
   '';
 
+  buildPhase = ''
+    make build
+  '';
+
   installPhase = ''
     make install PREFIX="${placeholder "out"}"
   '';
diff --git a/pkgs/applications/networking/nym/default.nix b/pkgs/applications/networking/nym/default.nix
index 4a4f5c54f6b6..4dfe1dc54929 100644
--- a/pkgs/applications/networking/nym/default.nix
+++ b/pkgs/applications/networking/nym/default.nix
@@ -24,8 +24,20 @@ rustPlatform.buildRustPackage rec {
 
   buildInputs = [ openssl ];
 
-  # tests disabled until a release with https://github.com/nymtech/nym/pull/260 is available
-  doCheck = false;
+  checkType = "debug";
+
+  /*
+  Nym's test presence::converting_mixnode_presence_into_topology_mixnode::it_returns_resolved_ip_on_resolvable_hostname tries to resolve nymtech.net.
+  Since there is no external DNS resolution available in the build sandbox, we point cargo and its children (that's what we remove the 'unsetenv' call for) to a hosts file in which we statically resolve nymtech.net.
+  */
+  preCheck = ''
+    export LD_PRELOAD=${libredirect.overrideAttrs (drv: {
+      postPatch = "sed -i -e /unsetenv/d libredirect.c";
+    })}/lib/libredirect.so
+    export NIX_REDIRECTS=/etc/hosts=${writeText "nym_resolve_test_hosts" "127.0.0.1 nymtech.net"}
+  '';
+
+  postCheck = "unset NIX_REDIRECTS LD_PRELOAD";
 
 
   passthru.updateScript = ./update.sh;
diff --git a/pkgs/applications/version-management/git-and-tools/git/default.nix b/pkgs/applications/version-management/git-and-tools/git/default.nix
index 78981ef9ad0f..5686b1c6f3f5 100644
--- a/pkgs/applications/version-management/git-and-tools/git/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git/default.nix
@@ -21,7 +21,7 @@ assert sendEmailSupport -> perlSupport;
 assert svnSupport -> perlSupport;
 
 let
-  version = "2.26.2";
+  version = "2.27.0";
   svn = subversionClient.override { perlBindings = perlSupport; };
 
   gitwebPerlLibs = with perlPackages; [ CGI HTMLParser CGIFast FCGI FCGIProcManager HTMLTagCloud ];
@@ -33,7 +33,7 @@ stdenv.mkDerivation {
 
   src = fetchurl {
     url = "https://www.kernel.org/pub/software/scm/git/git-${version}.tar.xz";
-    sha256 = "0j685w6pzkn926z5nf5r8fij4ziipvw4c9yb0wc577nzf4j16rbd";
+    sha256 = "1ybk39ylvs32lywq7ra4l2kdr5izc80r9461hwfnw8pssxs9gjkk";
   };
 
   outputs = [ "out" ] ++ stdenv.lib.optional withManual "doc";
@@ -286,13 +286,14 @@ stdenv.mkDerivation {
         mv t/{,skip-}$test.sh || true
       else
         sed -i t/$test.sh \
-          -e "/^ *test_expect_.*$pattern/,/^ *' *\$/{s/^/#/}"
+          -e "/^\s*test_expect_.*$pattern/,/^\s*' *\$/{s/^/: #/}"
       fi
     }
 
     # Shared permissions are forbidden in sandbox builds.
     disable_test t0001-init shared
     disable_test t1301-shared-repo
+    disable_test t5324-split-commit-graph 'split commit-graph respects core.sharedrepository'
 
     # Our patched gettext never fallbacks
     disable_test t0201-gettext-fallbacks
@@ -343,6 +344,6 @@ stdenv.mkDerivation {
     '';
 
     platforms = stdenv.lib.platforms.all;
-    maintainers = with stdenv.lib.maintainers; [ peti wmertens globin ];
+    maintainers = with stdenv.lib.maintainers; [ primeos peti wmertens globin ];
   };
 }
diff --git a/pkgs/build-support/rust/default.nix b/pkgs/build-support/rust/default.nix
index 770a6d1042e7..8d3a7ba6929c 100644
--- a/pkgs/build-support/rust/default.nix
+++ b/pkgs/build-support/rust/default.nix
@@ -28,6 +28,13 @@
 , meta ? {}
 , target ? null
 , cargoVendorDir ? null
+, checkType ? buildType
+
+# Needed to `pushd`/`popd` into a subdir of a tarball if this subdir
+# contains a Cargo.toml, but isn't part of a workspace (which is e.g. the
+# case for `rustfmt`/etc from the `rust-sources).
+# Otherwise, everything from the tarball would've been built/tested.
+, buildAndTestSubdir ? null
 , ... } @ args:
 
 assert cargoVendorDir == null -> cargoSha256 != "unset";
@@ -163,6 +170,7 @@ stdenv.mkDerivation (args // {
   '';
 
   buildPhase = with builtins; args.buildPhase or ''
+    ${stdenv.lib.optionalString (buildAndTestSubdir != null) "pushd ${buildAndTestSubdir}"}
     runHook preBuild
 
     (
@@ -178,22 +186,29 @@ stdenv.mkDerivation (args // {
         --frozen ${concatStringsSep " " cargoBuildFlags}
     )
 
-    # rename the output dir to a architecture independent one
-    mapfile -t targets < <(find "$NIX_BUILD_TOP" -type d | grep '${releaseDir}$')
-    for target in "''${targets[@]}"; do
-      rm -rf "$target/../../${buildType}"
-      ln -srf "$target" "$target/../../"
-    done
-
     runHook postBuild
+
+    ${stdenv.lib.optionalString (buildAndTestSubdir != null) "popd"}
+
+    # This needs to be done after postBuild: packages like `cargo` do a pushd/popd in
+    # the pre/postBuild-hooks that need to be taken into account before gathering
+    # all binaries to install.
+    bins=$(find $releaseDir \
+      -maxdepth 1 \
+      -type f \
+      -executable ! \( -regex ".*\.\(so.[0-9.]+\|so\|a\|dylib\)" \))
   '';
 
-  checkPhase = args.checkPhase or ''
+  checkPhase = args.checkPhase or (let
+    argstr = "${stdenv.lib.optionalString (checkType == "release") "--release"} --target ${rustTarget} --frozen";
+  in ''
+    ${stdenv.lib.optionalString (buildAndTestSubdir != null) "pushd ${buildAndTestSubdir}"}
     runHook preCheck
-    echo "Running cargo cargo test -- ''${checkFlags} ''${checkFlagsArray+''${checkFlagsArray[@]}}"
-    cargo test -- ''${checkFlags} ''${checkFlagsArray+"''${checkFlagsArray[@]}"}
+    echo "Running cargo test ${argstr} -- ''${checkFlags} ''${checkFlagsArray+''${checkFlagsArray[@]}}"
+    cargo test ${argstr} -- ''${checkFlags} ''${checkFlagsArray+"''${checkFlagsArray[@]}"}
     runHook postCheck
-  '';
+    ${stdenv.lib.optionalString (buildAndTestSubdir != null) "popd"}
+  '');
 
   doCheck = args.doCheck or true;
 
@@ -203,13 +218,16 @@ stdenv.mkDerivation (args // {
 
   installPhase = args.installPhase or ''
     runHook preInstall
+
+    # rename the output dir to a architecture independent one
+    mapfile -t targets < <(find "$NIX_BUILD_TOP" -type d | grep '${releaseDir}$')
+    for target in "''${targets[@]}"; do
+      rm -rf "$target/../../${buildType}"
+      ln -srf "$target" "$target/../../"
+    done
     mkdir -p $out/bin $out/lib
 
-    find $releaseDir \
-      -maxdepth 1 \
-      -type f \
-      -executable ! \( -regex ".*\.\(so.[0-9.]+\|so\|a\|dylib\)" \) \
-      -print0 | xargs -r -0 cp -t $out/bin
+    xargs -r cp -t $out/bin <<< $bins
     find $releaseDir \
       -maxdepth 1 \
       -regex ".*\.\(so.[0-9.]+\|so\|a\|dylib\)" \
diff --git a/pkgs/development/compilers/rust/cargo.nix b/pkgs/development/compilers/rust/cargo.nix
index 65614b9480e7..dfea7f6c8ef6 100644
--- a/pkgs/development/compilers/rust/cargo.nix
+++ b/pkgs/development/compilers/rust/cargo.nix
@@ -9,8 +9,7 @@ rustPlatform.buildRustPackage {
 
   # the rust source tarball already has all the dependencies vendored, no need to fetch them again
   cargoVendorDir = "vendor";
-  preBuild = "pushd src/tools/cargo";
-  postBuild = "popd";
+  buildAndTestSubdir = "src/tools/cargo";
 
   passthru.rustc = rustc;
 
diff --git a/pkgs/development/compilers/rust/clippy.nix b/pkgs/development/compilers/rust/clippy.nix
index 4857b587847e..0546ad9bac1a 100644
--- a/pkgs/development/compilers/rust/clippy.nix
+++ b/pkgs/development/compilers/rust/clippy.nix
@@ -5,8 +5,7 @@ rustPlatform.buildRustPackage {
 
   # the rust source tarball already has all the dependencies vendored, no need to fetch them again
   cargoVendorDir = "vendor";
-  preBuild = "pushd src/tools/clippy";
-  postBuild = "popd";
+  buildAndTestSubdir = "src/tools/clippy";
 
   # changes hash of vendor directory otherwise
   dontUpdateAutotoolsGnuConfigScripts = true;
diff --git a/pkgs/development/compilers/rust/rls/default.nix b/pkgs/development/compilers/rust/rls/default.nix
index 05a9d5049a4f..63a3c96a8f92 100644
--- a/pkgs/development/compilers/rust/rls/default.nix
+++ b/pkgs/development/compilers/rust/rls/default.nix
@@ -10,8 +10,9 @@ rustPlatform.buildRustPackage {
   dontUpdateAutotoolsGnuConfigScripts = true;
 
   cargoVendorDir = "vendor";
+  buildAndTestSubdir = "src/tools/rls";
+
   preBuild = ''
-    pushd src/tools/rls
     # client tests are flaky
     rm tests/client.rs
   '';
@@ -28,8 +29,6 @@ rustPlatform.buildRustPackage {
 
   doCheck = true;
 
-  preInstall = "popd";
-
   doInstallCheck = true;
   installCheckPhase = ''
     $out/bin/rls --version
diff --git a/pkgs/development/compilers/rust/rustfmt.nix b/pkgs/development/compilers/rust/rustfmt.nix
index f8ed0bce2e0d..66a18f40ad42 100644
--- a/pkgs/development/compilers/rust/rustfmt.nix
+++ b/pkgs/development/compilers/rust/rustfmt.nix
@@ -6,8 +6,7 @@ rustPlatform.buildRustPackage rec {
 
   # the rust source tarball already has all the dependencies vendored, no need to fetch them again
   cargoVendorDir = "vendor";
-  preBuild = "pushd src/tools/rustfmt";
-  preInstall = "popd";
+  buildAndTestSubdir = "src/tools/rustfmt";
 
   # changes hash of vendor directory otherwise
   dontUpdateAutotoolsGnuConfigScripts = true;
@@ -17,12 +16,6 @@ rustPlatform.buildRustPackage rec {
   # As of 1.0.0 and rustc 1.30 rustfmt requires a nightly compiler
   RUSTC_BOOTSTRAP = 1;
 
-  # we run tests in debug mode so tests look for a debug build of
-  # rustfmt. Anyway this adds nearly no compilation time.
-  preCheck = ''
-    cargo build
-  '';
-
   meta = with stdenv.lib; {
     description = "A tool for formatting Rust code according to style guidelines";
     homepage = "https://github.com/rust-lang-nursery/rustfmt";
diff --git a/pkgs/development/interpreters/perl/default.nix b/pkgs/development/interpreters/perl/default.nix
index cc43a7d2f858..9690dfac2f20 100644
--- a/pkgs/development/interpreters/perl/default.nix
+++ b/pkgs/development/interpreters/perl/default.nix
@@ -170,11 +170,11 @@ let
       priority = 6; # in `buildEnv' (including the one inside `perl.withPackages') the library files will have priority over files in `perl`
     };
   } // optionalAttrs (stdenv.buildPlatform != stdenv.hostPlatform) rec {
-    crossVersion = "1.3.2"; # Mar 21, 2020
+    crossVersion = "1.3.4"; # Jun 2, 2020
 
     perl-cross-src = fetchurl {
       url = "https://github.com/arsv/perl-cross/archive/${crossVersion}.tar.gz";
-      sha256 = "1283crdjsyi45mgdiak4jmy907mqn09frxzxp21b18hvxmfn4smq";
+      sha256 = "15wvlafhpsh9h66s3vazhx46hf8ik75473acrvf6722ijd1wpz45";
     };
 
     depsBuildBuild = [ buildPackages.stdenv.cc makeWrapper ];
@@ -194,23 +194,23 @@ in {
   perl528 = common {
     perl = pkgs.perl528;
     buildPerl = buildPackages.perl528;
-    version = "5.28.2";
-    sha256 = "1iynpsxdym4h76kgndmn3ykvwxhqz444xvaz8z2irsxkvmnlb5da";
+    version = "5.28.3";
+    sha256 = "052if351m81yhaab429i1kv77v9b15qm0g48kr6y2yjrc7bc3jdg";
   };
 
   # Maint version
   perl530 = common {
     perl = pkgs.perl530;
     buildPerl = buildPackages.perl530;
-    version = "5.30.2";
-    sha256 = "128nfdxcvxfn5kq55qcfrx2851ys8hv794dcdxbyny8rm7w7vnv6";
+    version = "5.30.3";
+    sha256 = "0vs0wwwlw47sswxaflkk4hw0y45cmc7arxx788kwpbminy5lrq1j";
   };
 
   # the latest Devel version
   perldevel = common {
     perl = pkgs.perldevel;
     buildPerl = buildPackages.perldevel;
-    version = "5.31.10";
-    sha256 = "1gvv5zs54gzb947x7ryjkaalm9rbqf8l8hwjwdm9lbfgkpg07kny";
+    version = "5.32.0-RC0";
+    sha256 = "02i6n1xa4j0ksp014yy8q0j7scjcy5mr0yd4iash2ryrrfv5yw5k";
   };
 }
diff --git a/pkgs/development/interpreters/python/cpython/2.7/default.nix b/pkgs/development/interpreters/python/cpython/2.7/default.nix
index 696be2136ecc..db86b67835e3 100644
--- a/pkgs/development/interpreters/python/cpython/2.7/default.nix
+++ b/pkgs/development/interpreters/python/cpython/2.7/default.nix
@@ -12,6 +12,7 @@
 , zlib
 , self
 , configd, coreutils
+, autoreconfHook
 , python-setup-hook
 # Some proprietary libs assume UCS2 unicode, especially on darwin :(
 , ucsEncoding ? 4
@@ -85,6 +86,9 @@ let
       # backported in debian since 2013.
       # https://bugs.python.org/issue13146
       ./atomic_pyc.patch
+
+      # Backport from CPython 3.8 of a good list of tests to run for PGO.
+      ./profile-task.patch
     ] ++ optionals (x11Support && stdenv.isDarwin) [
       ./use-correct-tcl-tk-on-darwin.patch
     ] ++ optionals stdenv.isLinux [
@@ -135,6 +139,7 @@ let
     '';
 
   configureFlags = [
+    "--enable-optimizations"
     "--enable-shared"
     "--with-threads"
     "--enable-unicode=ucs${toString ucsEncoding}"
@@ -182,8 +187,9 @@ let
     ++ optionals x11Support [ tcl tk xlibsWrapper libX11 ]
     ++ optional (stdenv.isDarwin && configd != null) configd;
   nativeBuildInputs =
-    optionals (stdenv.hostPlatform != stdenv.buildPlatform)
-    [ buildPackages.stdenv.cc buildPackages.python ];
+    [ autoreconfHook ]
+    ++ optionals (stdenv.hostPlatform != stdenv.buildPlatform)
+      [ buildPackages.stdenv.cc buildPackages.python ];
 
   mkPaths = paths: {
     C_INCLUDE_PATH = makeSearchPathOutput "dev" "include" paths;
diff --git a/pkgs/development/interpreters/python/cpython/2.7/profile-task.patch b/pkgs/development/interpreters/python/cpython/2.7/profile-task.patch
new file mode 100644
index 000000000000..9c085657ac9d
--- /dev/null
+++ b/pkgs/development/interpreters/python/cpython/2.7/profile-task.patch
@@ -0,0 +1,21 @@
+Backport from CPython 3.8 of a good list of tests to run for PGO.
+
+Upstream commit:
+  https://github.com/python/cpython/commit/4e16a4a31
+
+Upstream discussion:
+  https://bugs.python.org/issue36044
+
+diff --git a/Makefile.pre.in b/Makefile.pre.in
+index 00fdd21ce..713dc1e53 100644
+--- a/Makefile.pre.in
++++ b/Makefile.pre.in
+@@ -259,7 +259,7 @@ TCLTK_LIBS=
+ # The task to run while instrumented when building the profile-opt target.
+ # We exclude unittests with -x that take a rediculious amount of time to
+ # run in the instrumented training build or do not provide much value.
+-PROFILE_TASK=-m test.regrtest --pgo -x test_asyncore test_gdb test_multiprocessing test_subprocess
++PROFILE_TASK=-m test.regrtest --pgo test_array test_base64 test_binascii test_binop test_bisect test_bytes test_bz2 test_cmath test_codecs test_collections test_complex test_dataclasses test_datetime test_decimal test_difflib test_embed test_float test_fstring test_functools test_generators test_hashlib test_heapq test_int test_itertools test_json test_long test_lzma test_math test_memoryview test_operator test_ordered_dict test_pickle test_pprint test_re test_set test_sqlite test_statistics test_struct test_tabnanny test_time test_unicode test_xml_etree test_xml_etree_c
+ 
+ # report files for gcov / lcov coverage report
+ COVERAGE_INFO= $(abs_builddir)/coverage.info
diff --git a/pkgs/development/interpreters/python/cpython/3.5/profile-task.patch b/pkgs/development/interpreters/python/cpython/3.5/profile-task.patch
new file mode 100644
index 000000000000..39d5587379ca
--- /dev/null
+++ b/pkgs/development/interpreters/python/cpython/3.5/profile-task.patch
@@ -0,0 +1,21 @@
+Backport from CPython 3.8 of a good list of tests to run for PGO.
+
+Upstream commit:
+  https://github.com/python/cpython/commit/4e16a4a31
+
+Upstream discussion:
+  https://bugs.python.org/issue36044
+
+diff --git a/Makefile.pre.in b/Makefile.pre.in
+index 00fdd21ce..713dc1e53 100644
+--- a/Makefile.pre.in
++++ b/Makefile.pre.in
+@@ -259,7 +259,7 @@ TCLTK_LIBS=
+ # The task to run while instrumented when building the profile-opt target.
+ # We exclude unittests with -x that take a rediculious amount of time to
+ # run in the instrumented training build or do not provide much value.
+-PROFILE_TASK=-m test.regrtest --pgo -x test_asyncore test_gdb test_multiprocessing_fork test_multiprocessing_forkserver test_multiprocessing_main_handling test_multiprocessing_spawn test_subprocess
++PROFILE_TASK=-m test.regrtest --pgo test_array test_base64 test_binascii test_binop test_bisect test_bytes test_bz2 test_cmath test_codecs test_collections test_complex test_dataclasses test_datetime test_decimal test_difflib test_embed test_float test_fstring test_functools test_generators test_hashlib test_heapq test_int test_itertools test_json test_long test_lzma test_math test_memoryview test_operator test_ordered_dict test_pickle test_pprint test_re test_set test_sqlite test_statistics test_struct test_tabnanny test_time test_unicode test_xml_etree test_xml_etree_c
+ 
+ # report files for gcov / lcov coverage report
+ COVERAGE_INFO= $(abs_builddir)/coverage.info
diff --git a/pkgs/development/interpreters/python/cpython/3.6/profile-task.patch b/pkgs/development/interpreters/python/cpython/3.6/profile-task.patch
new file mode 100644
index 000000000000..df55da3a4132
--- /dev/null
+++ b/pkgs/development/interpreters/python/cpython/3.6/profile-task.patch
@@ -0,0 +1,21 @@
+Backport from CPython 3.8 of a good list of tests to run for PGO.
+
+Upstream commit:
+  https://github.com/python/cpython/commit/4e16a4a31
+
+Upstream discussion:
+  https://bugs.python.org/issue36044
+
+diff --git a/Makefile.pre.in b/Makefile.pre.in
+index 00fdd21ce..713dc1e53 100644
+--- a/Makefile.pre.in
++++ b/Makefile.pre.in
+@@ -259,7 +259,7 @@ TCLTK_LIBS=
+ # The task to run while instrumented when building the profile-opt target.
+ # We exclude unittests with -x that take a rediculious amount of time to
+ # run in the instrumented training build or do not provide much value.
+-PROFILE_TASK=-m test.regrtest --pgo
++PROFILE_TASK=-m test.regrtest --pgo test_array test_base64 test_binascii test_binop test_bisect test_bytes test_bz2 test_cmath test_codecs test_collections test_complex test_dataclasses test_datetime test_decimal test_difflib test_embed test_float test_fstring test_functools test_generators test_hashlib test_heapq test_int test_itertools test_json test_long test_lzma test_math test_memoryview test_operator test_ordered_dict test_pickle test_pprint test_re test_set test_sqlite test_statistics test_struct test_tabnanny test_time test_unicode test_xml_etree test_xml_etree_c
+ 
+ # report files for gcov / lcov coverage report
+ COVERAGE_INFO= $(abs_builddir)/coverage.info
diff --git a/pkgs/development/interpreters/python/cpython/default.nix b/pkgs/development/interpreters/python/cpython/default.nix
index 32fc65368623..ee77185cde65 100644
--- a/pkgs/development/interpreters/python/cpython/default.nix
+++ b/pkgs/development/interpreters/python/cpython/default.nix
@@ -12,6 +12,7 @@
 , zlib
 , self
 , configd
+, autoreconfHook
 , python-setup-hook
 , nukeReferences
 # For the Python package set
@@ -30,6 +31,7 @@
 , stripBytecode ? false
 , includeSiteCustomize ? true
 , static ? false
+, enableOptimizations ? true
 }:
 
 assert x11Support -> tcl != null
@@ -53,6 +55,7 @@ let
   version = with sourceVersion; "${major}.${minor}.${patch}${suffix}";
 
   nativeBuildInputs = [
+    autoreconfHook
     nukeReferences
   ] ++ optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
     buildPackages.stdenv.cc
@@ -110,6 +113,14 @@ in with passthru; stdenv.mkDerivation {
   ] ++ optionals (isPy37 || isPy38 || isPy39) [
     # Fix darwin build https://bugs.python.org/issue34027
     ./3.7/darwin-libutil.patch
+  ] ++ optionals (pythonOlder "3.8") [
+    # Backport from CPython 3.8 of a good list of tests to run for PGO.
+    (
+      if isPy36 || isPy37 then
+        ./3.6/profile-task.patch
+      else
+        ./3.5/profile-task.patch
+    )
   ] ++ optionals (isPy3k && hasDistutilsCxxPatch) [
     # Fix for http://bugs.python.org/issue1222585
     # Upstream distutils is calling C compiler to compile C++ code, which
@@ -142,10 +153,14 @@ in with passthru; stdenv.mkDerivation {
 
   configureFlags = [
     "--enable-shared"
-    "--with-threads"
     "--without-ensurepip"
     "--with-system-expat"
     "--with-system-ffi"
+  ] ++ optionals enableOptimizations [
+    "--enable-optimizations"
+  ] ++ optionals (pythonOlder "3.7") [
+    # This is unconditionally true starting in CPython 3.7.
+    "--with-threads"
   ] ++ optionals (sqlite != null && isPy3k) [
     "--enable-loadable-sqlite-extensions"
   ] ++ optionals (openssl != null) [
diff --git a/pkgs/development/interpreters/python/default.nix b/pkgs/development/interpreters/python/default.nix
index a3ba72a27b27..b05f989714a5 100644
--- a/pkgs/development/interpreters/python/default.nix
+++ b/pkgs/development/interpreters/python/default.nix
@@ -129,7 +129,7 @@ in {
   };
 
   # Minimal versions of Python (built without optional dependencies)
-  python3Minimal = (python37.override {
+  python3Minimal = (python38.override {
     self = python3Minimal;
     pythonForBuild = pkgs.buildPackages.python3Minimal;
     # strip down that python version as much as possible
@@ -146,6 +146,7 @@ in {
     rebuildBytecode = false;
     stripBytecode = true;
     includeSiteCustomize = false;
+    enableOptimizations = false;
   }).overrideAttrs(old: {
     pname = "python3-minimal";
     meta = old.meta // {
diff --git a/pkgs/development/interpreters/python/hooks/pip-build-hook.sh b/pkgs/development/interpreters/python/hooks/pip-build-hook.sh
index 292f13d30154..6dd384b4847f 100644
--- a/pkgs/development/interpreters/python/hooks/pip-build-hook.sh
+++ b/pkgs/development/interpreters/python/hooks/pip-build-hook.sh
@@ -24,7 +24,8 @@ pipShellHook() {
       export PATH="$tmp_path/bin:$PATH"
       export PYTHONPATH="$tmp_path/@pythonSitePackages@:$PYTHONPATH"
       mkdir -p "$tmp_path/@pythonSitePackages@"
-      @pythonInterpreter@ -m pip install -e . --prefix "$tmp_path" >&2
+      @pythonInterpreter@ -m pip install -e . --prefix "$tmp_path" \
+         --no-build-isolation >&2
     fi
 
     runHook postShellHook
diff --git a/pkgs/development/interpreters/python/hooks/setuptools-build-hook.sh b/pkgs/development/interpreters/python/hooks/setuptools-build-hook.sh
index 2aec92793825..311590425e68 100644
--- a/pkgs/development/interpreters/python/hooks/setuptools-build-hook.sh
+++ b/pkgs/development/interpreters/python/hooks/setuptools-build-hook.sh
@@ -29,7 +29,8 @@ setuptoolsShellHook() {
         export PATH="$tmp_path/bin:$PATH"
         export PYTHONPATH="$tmp_path/@pythonSitePackages@:$PYTHONPATH"
         mkdir -p "$tmp_path/@pythonSitePackages@"
-        eval "@pythonInterpreter@ -m pip install -e . --prefix $tmp_path >&2"
+        eval "@pythonInterpreter@ -m pip install -e . --prefix $tmp_path \
+          --no-build-isolation >&2"
     fi
 
     runHook postShellHook
diff --git a/pkgs/development/libraries/audio/libgme/default.nix b/pkgs/development/libraries/audio/libgme/default.nix
index bcd6070831bb..3ac8293986d8 100644
--- a/pkgs/development/libraries/audio/libgme/default.nix
+++ b/pkgs/development/libraries/audio/libgme/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromBitbucket, cmake }:
+{ stdenv, fetchFromBitbucket, cmake, removeReferencesTo }:
 let
   version = "0.6.3";
 in stdenv.mkDerivation {
@@ -21,4 +21,14 @@ in stdenv.mkDerivation {
   };
 
   buildInputs = [ cmake ];
+
+  nativeBuildInputs = [ removeReferencesTo ];
+
+  # It used to reference it, in the past, but thanks to the postFixup hook, now
+  # it doesn't.
+  disallowedReferences = [ stdenv.cc.cc ];
+
+  postFixup = stdenv.lib.optionalString stdenv.isLinux ''
+    remove-references-to -t ${stdenv.cc.cc} "$(readlink -f $out/lib/libgme.so)"
+  '';
 }
diff --git a/pkgs/development/libraries/dbus/default.nix b/pkgs/development/libraries/dbus/default.nix
index a3e3c4ebd89a..049623d3d911 100644
--- a/pkgs/development/libraries/dbus/default.nix
+++ b/pkgs/development/libraries/dbus/default.nix
@@ -20,11 +20,11 @@ assert enableSystemd -> systemd != null;
 
 stdenv.mkDerivation rec {
   pname = "dbus";
-  version = "1.12.16";
+  version = "1.12.18";
 
   src = fetchurl {
     url = "https://dbus.freedesktop.org/releases/dbus/dbus-${version}.tar.gz";
-    sha256 = "107ckxaff1cv4q6kmfdi2fb1nlsv03312a7kf6lb4biglhpjv8jl";
+    sha256 = "01jkm6shm76bl3cflmnn37dv6nkph0w1akbqpklyac02hiq4vkv4";
   };
 
   patches = lib.optional stdenv.isSunOS ./implement-getgrouplist.patch;
diff --git a/pkgs/development/libraries/glibc/2.30-cve-2020-1752.patch b/pkgs/development/libraries/glibc/2.30-cve-2020-1752.patch
new file mode 100644
index 000000000000..75d874b93d09
--- /dev/null
+++ b/pkgs/development/libraries/glibc/2.30-cve-2020-1752.patch
@@ -0,0 +1,62 @@
+From: Andreas Schwab <schwab@suse.de>
+Date: Wed, 19 Feb 2020 16:21:46 +0000 (+0100)
+Subject: Fix use-after-free in glob when expanding ~user (bug 25414)
+X-Git-Url: https://sourceware.org/git/?p=glibc.git;a=commitdiff_plain;h=da97c6b88eb03fb834e92964b0895c2ac8d61f63;hp=dd34bce38c822b67fcc42e73969bf6699d6874b6
+
+Fix use-after-free in glob when expanding ~user (bug 25414)
+
+The value of `end_name' points into the value of `dirname', thus don't
+deallocate the latter before the last use of the former.
+
+(cherry picked from commit ddc650e9b3dc916eab417ce9f79e67337b05035c)
+---
+
+diff --git a/posix/glob.c b/posix/glob.c
+index e73e35c510..c6cbd0eb43 100644
+--- a/posix/glob.c
++++ b/posix/glob.c
+@@ -827,31 +827,32 @@ __glob (const char *pattern, int flags, int (*errfunc) (const char *, int),
+ 	      {
+ 		size_t home_len = strlen (p->pw_dir);
+ 		size_t rest_len = end_name == NULL ? 0 : strlen (end_name);
+-		char *d;
++		char *d, *newp;
++		bool use_alloca = glob_use_alloca (alloca_used,
++						   home_len + rest_len + 1);
+ 
+-		if (__glibc_unlikely (malloc_dirname))
+-		  free (dirname);
+-		malloc_dirname = 0;
+-
+-		if (glob_use_alloca (alloca_used, home_len + rest_len + 1))
+-		  dirname = alloca_account (home_len + rest_len + 1,
+-					    alloca_used);
++		if (use_alloca)
++		  newp = alloca_account (home_len + rest_len + 1, alloca_used);
+ 		else
+ 		  {
+-		    dirname = malloc (home_len + rest_len + 1);
+-		    if (dirname == NULL)
++		    newp = malloc (home_len + rest_len + 1);
++		    if (newp == NULL)
+ 		      {
+ 			scratch_buffer_free (&pwtmpbuf);
+ 			retval = GLOB_NOSPACE;
+ 			goto out;
+ 		      }
+-		    malloc_dirname = 1;
+ 		  }
+-		d = mempcpy (dirname, p->pw_dir, home_len);
++		d = mempcpy (newp, p->pw_dir, home_len);
+ 		if (end_name != NULL)
+ 		  d = mempcpy (d, end_name, rest_len);
+ 		*d = '\0';
+ 
++		if (__glibc_unlikely (malloc_dirname))
++		  free (dirname);
++		dirname = newp;
++		malloc_dirname = !use_alloca;
++
+ 		dirlen = home_len + rest_len;
+ 		dirname_modified = 1;
+ 	      }
diff --git a/pkgs/development/libraries/glibc/common.nix b/pkgs/development/libraries/glibc/common.nix
index 0429c7295fb8..36b6bea61cd4 100644
--- a/pkgs/development/libraries/glibc/common.nix
+++ b/pkgs/development/libraries/glibc/common.nix
@@ -106,10 +106,10 @@ stdenv.mkDerivation ({
         url = "https://salsa.debian.org/glibc-team/glibc/raw/49767c9f7de4828220b691b29de0baf60d8a54ec/debian/patches/localedata/locale-C.diff";
         sha256 = "0irj60hs2i91ilwg5w7sqrxb695c93xg0ik7yhhq9irprd7fidn4";
       })
-    ]
-    ++ lib.optionals stdenv.isx86_64 [
+
       ./fix-x64-abi.patch
       ./2.27-CVE-2019-19126.patch
+      ./2.30-cve-2020-1752.patch
     ]
     ++ lib.optional stdenv.hostPlatform.isMusl ./fix-rpc-types-musl-conflicts.patch
     ++ lib.optional stdenv.buildPlatform.isDarwin ./darwin-cross-build.patch;
diff --git a/pkgs/development/libraries/gnutls/default.nix b/pkgs/development/libraries/gnutls/default.nix
index 6d0faa03a888..f75d107718da 100644
--- a/pkgs/development/libraries/gnutls/default.nix
+++ b/pkgs/development/libraries/gnutls/default.nix
@@ -8,7 +8,7 @@
 
 assert guileBindings -> guile != null;
 let
-  version = "3.6.13";
+  version = "3.6.14";
 
   # XXX: Gnulib's `test-select' fails on FreeBSD:
   # https://hydra.nixos.org/build/2962084/nixlog/1/raw .
@@ -24,7 +24,7 @@ stdenv.mkDerivation {
 
   src = fetchurl {
     url = "mirror://gnupg/gnutls/v3.6/gnutls-${version}.tar.xz";
-    sha256 = "0f1gnm0756qms5cpx6yn6xb8d3imc2gkqmygf12n9x6r8zs1s11j";
+    sha256 = "0qwxsfizynly0ns537vnhnlm5lh03la4vbsmz675n0n7vqd7ac2n";
   };
 
   outputs = [ "bin" "dev" "out" "man" "devdoc" ];
diff --git a/pkgs/development/libraries/jbig2dec/default.nix b/pkgs/development/libraries/jbig2dec/default.nix
index 8cc2ce008716..22d38a080cab 100644
--- a/pkgs/development/libraries/jbig2dec/default.nix
+++ b/pkgs/development/libraries/jbig2dec/default.nix
@@ -1,18 +1,19 @@
-{ stdenv, fetchurl, python3, autoconf }:
+{ stdenv, fetchurl, python3, autoreconfHook }:
 
 stdenv.mkDerivation rec {
-  name = "jbig2dec-0.17";
+  pname = "jbig2dec";
+  version = "0.18";
 
   src = fetchurl {
-    url = "https://github.com/ArtifexSoftware/ghostpdl-downloads/releases/download/gs950/${name}.tar.gz";
-    sha256 = "0wpvslmwazia3z8gyk343kbq6yj47pxr4x5yjvx332v309qssazp";
+    url = "https://github.com/ArtifexSoftware/ghostpdl-downloads/releases/download/gs952/${pname}-${version}.tar.gz";
+    sha256 = "0pigfw2v0ppvr0lbysm69gx0zsa5q2q92yrb8af2j3im6x97f6cy";
   };
 
   postPatch = ''
     patchShebangs test_jbig2dec.py
   '';
 
-  buildInputs = [ autoconf ];
+  buildInputs = [ autoreconfHook ];
 
   checkInputs = [ python3 ];
   doCheck = true;
diff --git a/pkgs/development/libraries/libarchive/default.nix b/pkgs/development/libraries/libarchive/default.nix
index 118adc61623a..d1917de37d6a 100644
--- a/pkgs/development/libraries/libarchive/default.nix
+++ b/pkgs/development/libraries/libarchive/default.nix
@@ -1,6 +1,6 @@
 {
   fetchFromGitHub, stdenv, pkgconfig, autoreconfHook,
-  acl, attr, bzip2, e2fsprogs, libxml2, lzo, openssl, sharutils, xz, zlib,
+  acl, attr, bzip2, e2fsprogs, libxml2, lzo, openssl, sharutils, xz, zlib, zstd,
 
   # Optional but increases closure only negligibly.
   xarSupport ? true,
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
   outputs = [ "out" "lib" "dev" ];
 
   nativeBuildInputs = [ pkgconfig autoreconfHook ];
-  buildInputs = [ sharutils zlib bzip2 openssl xz lzo ]
+  buildInputs = [ sharutils zlib bzip2 openssl xz lzo zstd ]
     ++ stdenv.lib.optionals stdenv.isLinux [ e2fsprogs attr acl ]
     ++ stdenv.lib.optional xarSupport libxml2;
 
diff --git a/pkgs/development/libraries/libexif/default.nix b/pkgs/development/libraries/libexif/default.nix
index 090c6a2fff34..fd2ed39e34a4 100644
--- a/pkgs/development/libraries/libexif/default.nix
+++ b/pkgs/development/libraries/libexif/default.nix
@@ -1,45 +1,24 @@
-{ stdenv, fetchurl, fetchpatch, gettext }:
+{ stdenv, fetchFromGitHub, autoreconfHook, gettext }:
 
 stdenv.mkDerivation rec {
-  name = "libexif-0.6.21";
+  pname = "libexif";
+  version = "0.6.22";
 
-  src = fetchurl {
-    url = "mirror://sourceforge/libexif/${name}.tar.bz2";
-    sha256 = "06nlsibr3ylfwp28w8f5466l6drgrnydgxrm4jmxzrmk5svaxk8n";
+  src = fetchFromGitHub {
+    owner = pname;
+    repo = pname;
+    rev = "${pname}-${builtins.replaceStrings ["."] ["_"] version}-release";
+    sha256 = "0mzndakdi816zcs13z7yzp7hj031p2dcyfq2p391r63d9z21jmy1";
   };
 
-  patches = [
-    (fetchpatch {
-      name = "CVE-2017-7544.patch";
-      url = "https://github.com/libexif/libexif/commit/c39acd1692023b26290778a02a9232c873f9d71a.patch";
-      sha256 = "0xgx6ly2i4q05shb61mfx6njwf1yp347jkznm0ka4m85i41xm6sd";
-    })
-    (fetchpatch {
-      name = "CVE-2018-20030-1.patch";
-      url = "https://github.com/libexif/libexif/commit/5d28011c40ec86cf52cffad541093d37c263898a.patch";
-      sha256 = "1wv8s962wmbn2m2xypgirf12g6msrbplpsmd5bh86irfwhkcppj3";
-    })
-    (fetchpatch {
-      name = "CVE-2018-20030-2.patch";
-      url = "https://github.com/libexif/libexif/commit/6aa11df549114ebda520dde4cdaea2f9357b2c89.patch";
-      sha256 = "01aqvz63glwq6wg0wr7ykqqghb4abgq77ghvhizbzadg1k4h7drx";
-      excludes = [ "NEWS" ];
-    })
-    (fetchpatch {
-      name = "CVE-2019-9278.patch";
-      url = "https://github.com/libexif/libexif/commit/75aa73267fdb1e0ebfbc00369e7312bac43d0566.patch";
-      sha256 = "10ikg33mips5zq9as7l9xqnyzbg1wwr4sw17517nzf4hafjpasrj";
-    })
-  ];
+  nativeBuildInputs = [ autoreconfHook gettext ];
 
-  buildInputs = [ gettext ];
-
-  meta = {
+  meta = with stdenv.lib; {
     homepage = "https://libexif.github.io/";
     description = "A library to read and manipulate EXIF data in digital photographs";
-    license = stdenv.lib.licenses.lgpl21;
-    platforms = stdenv.lib.platforms.unix;
-    maintainers = [ stdenv.lib.maintainers.erictapen ];
+    license = licenses.lgpl21;
+    platforms = platforms.unix;
+    maintainers = with maintainers; [ erictapen ];
   };
 
 }
diff --git a/pkgs/development/libraries/libgpg-error/default.nix b/pkgs/development/libraries/libgpg-error/default.nix
index e170e4931b83..1e49a72096a3 100644
--- a/pkgs/development/libraries/libgpg-error/default.nix
+++ b/pkgs/development/libraries/libgpg-error/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, buildPackages, fetchurl, gettext, fetchpatch
+{ stdenv, lib, buildPackages, fetchurl, gettext
 , genPosixLockObjOnly ? false
 }: let
   genPosixLockObjOnlyAttrs = lib.optionalAttrs genPosixLockObjOnly {
@@ -17,25 +17,14 @@
   };
 in stdenv.mkDerivation (rec {
   pname = "libgpg-error";
-  version = "1.36";
+  version = "1.38";
 
   src = fetchurl {
     url = "mirror://gnupg/${pname}/${pname}-${version}.tar.bz2";
-    sha256 = "0z696dmhfxm2n6pmr8b857wwljq9h633yi99bhbn7h88f91rigds";
+    sha256 = "00px79xzyc5lj8aig7i4fhk29h1lkqp4840wjfgi9mv9m9sq566q";
   };
 
-  # Remove gawk buildfix on > 1.36
-  patches = [
-    (fetchpatch {
-      url = "https://dev.gnupg.org/rE7865041c77f4f7005282f10f9b6666b19072fbdf?diff=1";
-      sha256 = "0hs4rpwqq2afpsbqliq451jjaysq2iyzxvd9sx3992b4vnllgqqq";
-    })
-  ];
-
   postPatch = ''
-    # Remove on > 1.36 release: gawk upgrade fix didn't include Makefile regeneration
-    sed 's/-v namespace=errnos_/-v pkg_namespace=errnos_/' -i src/Makefile.in
-
     sed '/BUILD_TIMESTAMP=/s/=.*/=1970-01-01T00:01+0000/' -i ./configure
   '' + lib.optionalString (stdenv.hostPlatform.isAarch32 && stdenv.buildPlatform != stdenv.hostPlatform) ''
     ln -s lock-obj-pub.arm-unknown-linux-gnueabi.h src/syscfg/lock-obj-pub.linux-gnueabihf.h
diff --git a/pkgs/development/libraries/libheif/default.nix b/pkgs/development/libraries/libheif/default.nix
index b5717034da0e..d147820cff1c 100644
--- a/pkgs/development/libraries/libheif/default.nix
+++ b/pkgs/development/libraries/libheif/default.nix
@@ -2,7 +2,7 @@
 
 stdenv.mkDerivation rec {
   pname = "libheif";
-  version = "1.6.2";
+  version = "1.7.0";
 
   outputs = [ "bin" "out" "dev" "man" ];
 
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
     owner = "strukturag";
     repo = "libheif";
     rev = "v${version}";
-    sha256 = "0ngbzban585hsgs6fb6fkhccc91kxn1n59qvqjp8bw41l24i3nr2";
+    sha256 = "0alri5h486ck9b5z6wwrmlpzydhz58l223z3zxkizqrzxlllhr6p";
   };
 
   nativeBuildInputs = [ autoreconfHook pkgconfig ];
diff --git a/pkgs/development/libraries/libpcap/default.nix b/pkgs/development/libraries/libpcap/default.nix
index 123c2f2f0676..078b68aab11e 100644
--- a/pkgs/development/libraries/libpcap/default.nix
+++ b/pkgs/development/libraries/libpcap/default.nix
@@ -22,12 +22,14 @@ stdenv.mkDerivation rec {
     "ac_cv_linux_vers=2"
   ];
 
-  dontStrip = stdenv.hostPlatform != stdenv.buildPlatform;
-
   prePatch = stdenv.lib.optionalString stdenv.isDarwin ''
     substituteInPlace configure --replace " -arch i386" ""
   '';
 
+  postInstall = ''
+    rm -f $out/lib/libpcap.a
+  '';
+
   meta = with stdenv.lib; {
     homepage = "https://www.tcpdump.org";
     description = "Packet Capture Library";
diff --git a/pkgs/development/libraries/libssh2/CVE-2019-17498.patch b/pkgs/development/libraries/libssh2/CVE-2019-17498.patch
new file mode 100644
index 000000000000..8681c3ef6091
--- /dev/null
+++ b/pkgs/development/libraries/libssh2/CVE-2019-17498.patch
@@ -0,0 +1,210 @@
+From b9aa7c2495694d0527e4e7fd560a3f0f18556c72 Mon Sep 17 00:00:00 2001
+From: Will Cosgrove <will@panic.com>
+Date: Thu, 29 Aug 2019 15:14:19 -0700
+Subject: [PATCH 1/5] packet.c: improve parsing of packets
+
+file: packet.c
+
+notes:
+Use _libssh2_get_string API in SSH_MSG_DEBUG, additional uint32 bounds check in SSH_MSG_GLOBAL_REQUEST
+---
+ src/packet.c | 30 +++++++++++++++---------------
+ 1 file changed, 15 insertions(+), 15 deletions(-)
+
+diff --git a/src/packet.c b/src/packet.c
+index 38ab62944..ac69768cd 100644
+--- a/src/packet.c
++++ b/src/packet.c
+@@ -537,26 +537,26 @@ _libssh2_packet_add(LIBSSH2_SESSION * session, unsigned char *data,
+         case SSH_MSG_DEBUG:
+             if(datalen >= 2) {
+                 int always_display = data[1];
+-
++            
+                 if(datalen >= 6) {
+-                    message_len = _libssh2_ntohu32(data + 2);
+-
+-                    if(message_len <= (datalen - 10)) {
+-                        /* 6 = packet_type(1) + display(1) + message_len(4) */
+-                        message = (char *) data + 6;
+-                        language_len = _libssh2_ntohu32(data + 6 +
+-                                                        message_len);
+-
+-                        if(language_len <= (datalen - 10 - message_len))
+-                            language = (char *) data + 10 + message_len;
+-                    }
++                    struct string_buf buf;
++                    buf.data = (unsigned char *)data;
++                    buf.dataptr = buf.data;
++                    buf.len = datalen;
++                    buf.dataptr += 2; /* advance past type & always display */
++
++                    _libssh2_get_string(&buf, &message, &message_len);
++                    _libssh2_get_string(&buf, &language, &language_len);
+                 }
+ 
+                 if(session->ssh_msg_debug) {
+-                    LIBSSH2_DEBUG(session, always_display, message,
+-                                  message_len, language, language_len);
++                    LIBSSH2_DEBUG(session, always_display,
++                                  (const char *)message,
++                                  message_len, (const char *)language,
++                                  language_len);
+                 }
+             }
++
+             /*
+              * _libssh2_debug will actually truncate this for us so
+              * that it's not an inordinate about of data
+@@ -579,7 +579,7 @@ _libssh2_packet_add(LIBSSH2_SESSION * session, unsigned char *data,
+                 uint32_t len = 0;
+                 unsigned char want_reply = 0;
+                 len = _libssh2_ntohu32(data + 1);
+-                if(datalen >= (6 + len)) {
++                if((len <= (UINT_MAX - 6) && (datalen >= (6 + len))) {
+                     want_reply = data[5 + len];
+                     _libssh2_debug(session,
+                                    LIBSSH2_TRACE_CONN,
+
+From 8b3cf0b17c1b84a138bed9423a9e0743452b4de9 Mon Sep 17 00:00:00 2001
+From: Will Cosgrove <will@panic.com>
+Date: Thu, 29 Aug 2019 15:15:33 -0700
+Subject: [PATCH 2/5] stray whitespace
+
+---
+ src/packet.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/packet.c b/src/packet.c
+index ac69768cd..8908b2c5a 100644
+--- a/src/packet.c
++++ b/src/packet.c
+@@ -537,7 +537,7 @@ _libssh2_packet_add(LIBSSH2_SESSION * session, unsigned char *data,
+         case SSH_MSG_DEBUG:
+             if(datalen >= 2) {
+                 int always_display = data[1];
+-            
++
+                 if(datalen >= 6) {
+                     struct string_buf buf;
+                     buf.data = (unsigned char *)data;
+
+From 1c6fa92b77e34d089493fe6d3e2c6c8775858b94 Mon Sep 17 00:00:00 2001
+From: Will Cosgrove <will@panic.com>
+Date: Thu, 29 Aug 2019 15:24:22 -0700
+Subject: [PATCH 3/5] fixed type issue, updated SSH_MSG_DISCONNECT
+
+SSH_MSG_DISCONNECT now also uses  _libssh2_get API.
+---
+ src/packet.c | 40 +++++++++++++++-------------------------
+ 1 file changed, 15 insertions(+), 25 deletions(-)
+
+diff --git a/src/packet.c b/src/packet.c
+index 8908b2c5a..97f0cdd4b 100644
+--- a/src/packet.c
++++ b/src/packet.c
+@@ -419,8 +419,8 @@ _libssh2_packet_add(LIBSSH2_SESSION * session, unsigned char *data,
+                     size_t datalen, int macstate)
+ {
+     int rc = 0;
+-    char *message = NULL;
+-    char *language = NULL;
++    unsigned char *message = NULL;
++    unsigned char *language = NULL;
+     size_t message_len = 0;
+     size_t language_len = 0;
+     LIBSSH2_CHANNEL *channelp = NULL;
+@@ -472,33 +472,23 @@ _libssh2_packet_add(LIBSSH2_SESSION * session, unsigned char *data,
+ 
+         case SSH_MSG_DISCONNECT:
+             if(datalen >= 5) {
+-                size_t reason = _libssh2_ntohu32(data + 1);
++                uint32_t reason = 0;
++                struct string_buf buf;
++                buf.data = (unsigned char *)data;
++                buf.dataptr = buf.data;
++                buf.len = datalen;
++                buf.dataptr++; /* advance past type */
+ 
+-                if(datalen >= 9) {
+-                    message_len = _libssh2_ntohu32(data + 5);
++                _libssh2_get_u32(&buf, &reason);
++                _libssh2_get_string(&buf, &message, &message_len);
++                _libssh2_get_string(&buf, &language, &language_len);
+ 
+-                    if(message_len < datalen-13) {
+-                        /* 9 = packet_type(1) + reason(4) + message_len(4) */
+-                        message = (char *) data + 9;
+-
+-                        language_len =
+-                            _libssh2_ntohu32(data + 9 + message_len);
+-                        language = (char *) data + 9 + message_len + 4;
+-
+-                        if(language_len > (datalen-13-message_len)) {
+-                            /* bad input, clear info */
+-                            language = message = NULL;
+-                            language_len = message_len = 0;
+-                        }
+-                    }
+-                    else
+-                        /* bad size, clear it */
+-                        message_len = 0;
+-                }
+                 if(session->ssh_msg_disconnect) {
+-                    LIBSSH2_DISCONNECT(session, reason, message,
+-                                       message_len, language, language_len);
++                    LIBSSH2_DISCONNECT(session, reason, (const char *)message,
++                                       message_len, (const char *)language,
++                                       language_len);
+                 }
++
+                 _libssh2_debug(session, LIBSSH2_TRACE_TRANS,
+                                "Disconnect(%d): %s(%s)", reason,
+                                message, language);
+
+From 77616117cc9dbbdd0fe1157098435bff73a83a0f Mon Sep 17 00:00:00 2001
+From: Will Cosgrove <will@panic.com>
+Date: Thu, 29 Aug 2019 15:26:32 -0700
+Subject: [PATCH 4/5] fixed stray (
+
+bad paste
+---
+ src/packet.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/packet.c b/src/packet.c
+index 97f0cdd4b..bd4c39e46 100644
+--- a/src/packet.c
++++ b/src/packet.c
+@@ -569,7 +569,7 @@ _libssh2_packet_add(LIBSSH2_SESSION * session, unsigned char *data,
+                 uint32_t len = 0;
+                 unsigned char want_reply = 0;
+                 len = _libssh2_ntohu32(data + 1);
+-                if((len <= (UINT_MAX - 6) && (datalen >= (6 + len))) {
++                if(len <= (UINT_MAX - 6) && datalen >= (6 + len)) {
+                     want_reply = data[5 + len];
+                     _libssh2_debug(session,
+                                    LIBSSH2_TRACE_CONN,
+
+From 436c45dc143cadc8c59afac6c4255be332856581 Mon Sep 17 00:00:00 2001
+From: Will Cosgrove <will@panic.com>
+Date: Thu, 29 Aug 2019 15:29:00 -0700
+Subject: [PATCH 5/5] added additional parentheses for clarity
+
+---
+ src/packet.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/packet.c b/src/packet.c
+index bd4c39e46..2e01bfc5d 100644
+--- a/src/packet.c
++++ b/src/packet.c
+@@ -569,7 +569,7 @@ _libssh2_packet_add(LIBSSH2_SESSION * session, unsigned char *data,
+                 uint32_t len = 0;
+                 unsigned char want_reply = 0;
+                 len = _libssh2_ntohu32(data + 1);
+-                if(len <= (UINT_MAX - 6) && datalen >= (6 + len)) {
++                if((len <= (UINT_MAX - 6)) && (datalen >= (6 + len))) {
+                     want_reply = data[5 + len];
+                     _libssh2_debug(session,
+                                    LIBSSH2_TRACE_CONN,
diff --git a/pkgs/development/libraries/libssh2/default.nix b/pkgs/development/libraries/libssh2/default.nix
index 5cc0232e17de..8ce9c814df05 100644
--- a/pkgs/development/libraries/libssh2/default.nix
+++ b/pkgs/development/libraries/libssh2/default.nix
@@ -15,12 +15,8 @@ stdenv.mkDerivation rec {
     ++ stdenv.lib.optional stdenv.hostPlatform.isMinGW windows.mingw_w64;
 
   patches = [
-    # not able to use fetchpatch here: infinite recursion
-    (fetchurl {
-      name = "CVE-2019-17498.patch";
-      url = "https://github.com/libssh2/libssh2/pull/402.patch";
-      sha256 = "1n9s2mcz5dkw0xpm3c5x4hzj8bar4i6z0pr1rmqjplhfg888vdvc";
-    })
+    # Not able to use fetchpatch here: infinite recursion
+    ./CVE-2019-17498.patch
   ];
 
   meta = with stdenv.lib; {
diff --git a/pkgs/development/libraries/mesa/default.nix b/pkgs/development/libraries/mesa/default.nix
index aa70e9e5a549..03977c74f11d 100644
--- a/pkgs/development/libraries/mesa/default.nix
+++ b/pkgs/development/libraries/mesa/default.nix
@@ -11,6 +11,8 @@
 , eglPlatforms ? [ "x11" "surfaceless" ] ++ lib.optionals stdenv.isLinux [ "wayland" "drm" ]
 , OpenGL, Xplugin
 , withValgrind ? stdenv.hostPlatform.isLinux && !stdenv.hostPlatform.isAarch32, valgrind-light
+, enableGalliumNine ? stdenv.isLinux
+, enableOSMesa ? stdenv.isLinux
 }:
 
 /** Packaging design:
@@ -27,7 +29,9 @@
 with stdenv.lib;
 
 let
-  version = "20.0.2";
+  # Release calendar: https://www.mesa3d.org/release-calendar.html
+  # Release frequency: https://www.mesa3d.org/releasing.html#schedule
+  version = "20.0.7"; # Update only to the final (last planned) release (i.e. X.Y.MAX)?
   branch  = versions.major version;
 in
 
@@ -37,12 +41,12 @@ stdenv.mkDerivation {
 
   src = fetchurl {
     urls = [
+      "https://mesa.freedesktop.org/archive/mesa-${version}.tar.xz"
       "ftp://ftp.freedesktop.org/pub/mesa/mesa-${version}.tar.xz"
       "ftp://ftp.freedesktop.org/pub/mesa/${version}/mesa-${version}.tar.xz"
       "ftp://ftp.freedesktop.org/pub/mesa/older-versions/${branch}.x/${version}/mesa-${version}.tar.xz"
-      "https://mesa.freedesktop.org/archive/mesa-${version}.tar.xz"
     ];
-    sha256 = "0vz8k07d23qdwy67fnna9y0ynnni0m8lgswcmdm60l4mcv5z2m5a";
+    sha256 = "0y517qpdg6v6dsdgzb365p03m30511sbyh8pq0mcvhvjwy7javpy";
   };
 
   prePatch = "patchShebangs .";
@@ -79,7 +83,7 @@ stdenv.mkDerivation {
       "find_program('${buildPackages.pkg-config.targetPrefix}pkg-config')"
   '';
 
-  outputs = [ "out" "dev" "drivers" "osmesa" ];
+  outputs = [ "out" "dev" "drivers" ] ++ lib.optional enableOSMesa "osmesa";
 
   # TODO: Figure out how to enable opencl without having a runtime dependency on clang
   mesonFlags = [
@@ -103,10 +107,10 @@ stdenv.mkDerivation {
     "-Domx-libs-path=${placeholder "drivers"}/lib/bellagio"
     "-Dva-libs-path=${placeholder "drivers"}/lib/dri"
     "-Dd3d-drivers-path=${placeholder "drivers"}/lib/d3d"
+    "-Dgallium-nine=${if enableGalliumNine then "true" else "false"}" # Direct3D in Wine
+    "-Dosmesa=${if enableOSMesa then "gallium" else "none"}" # used by wine
   ] ++ optionals stdenv.isLinux [
     "-Dglvnd=true"
-    "-Dosmesa=gallium" # used by wine
-    "-Dgallium-nine=true" # Direct3D in Wine
   ];
 
   buildInputs = with xorg; [
@@ -142,17 +146,17 @@ stdenv.mkDerivation {
   '' + optionalString stdenv.isLinux ''
     mkdir -p $drivers/lib
 
-    # move gallium-related stuff to $drivers, so $out doesn't depend on LLVM
-    mv -t $drivers/lib       \
-      $out/lib/libxatracker* \
-      $out/lib/libvulkan_*
+    if [ -n "$(shopt -s nullglob; echo "$out/lib/libxatracker"*)" -o -n "$(shopt -s nullglob; echo "$out/lib/libvulkan_"*)" ]; then
+      # move gallium-related stuff to $drivers, so $out doesn't depend on LLVM
+      mv -t $drivers/lib       \
+        $out/lib/libxatracker* \
+        $out/lib/libvulkan_*
+    fi
 
-    # Move other drivers to a separate output
-    mv $out/lib/lib*_mesa* $drivers/lib
-
-    # move libOSMesa to $osmesa, as it's relatively big
-    mkdir -p $osmesa/lib
-    mv -t $osmesa/lib/ $out/lib/libOSMesa*
+    if [ -n "$(shopt -s nullglob; echo "$out"/lib/lib*_mesa*)" ]; then
+      # Move other drivers to a separate output
+      mv $out/lib/lib*_mesa* $drivers/lib
+    fi
 
     # move vendor files
     mv $out/share/ $drivers/
@@ -167,6 +171,10 @@ stdenv.mkDerivation {
     for js in $drivers/share/vulkan/icd.d/*.json; do
       substituteInPlace "$js" --replace "$out" "$drivers"
     done
+  '' + lib.optionalString enableOSMesa ''
+    # move libOSMesa to $osmesa, as it's relatively big
+    mkdir -p $osmesa/lib
+    mv -t $osmesa/lib/ $out/lib/libOSMesa*
   '';
 
   # TODO:
@@ -181,7 +189,9 @@ stdenv.mkDerivation {
 
     # Update search path used by pkg-config
     for pc in $dev/lib/pkgconfig/{d3d,dri,xatracker}.pc; do
-      substituteInPlace "$pc" --replace $out $drivers
+      if [ -f "$pc" ]; then
+        substituteInPlace "$pc" --replace $out $drivers
+      fi
     done
 
     # add RPATH so the drivers can find the moved libgallium and libdricore9
@@ -215,6 +225,6 @@ stdenv.mkDerivation {
     changelog = "https://www.mesa3d.org/relnotes/${version}.html";
     license = licenses.mit; # X11 variant, in most files
     platforms = platforms.mesaPlatforms;
-    maintainers = with maintainers; [ vcunat ];
+    maintainers = with maintainers; [ primeos vcunat ]; # Help is welcome :)
   };
 }
diff --git a/pkgs/development/libraries/nss/default.nix b/pkgs/development/libraries/nss/default.nix
index 5251c680361a..d083a256cd11 100644
--- a/pkgs/development/libraries/nss/default.nix
+++ b/pkgs/development/libraries/nss/default.nix
@@ -5,7 +5,7 @@ let
     url = "http://dev.gentoo.org/~polynomial-c/mozilla/nss-3.15.4-pem-support-20140109.patch.xz";
     sha256 = "10ibz6y0hknac15zr6dw4gv9nb5r5z9ym6gq18j3xqx7v7n3vpdw";
   };
-  version = "3.52";
+  version = "3.52.1";
   underscoreVersion = builtins.replaceStrings ["."] ["_"] version;
 
 in stdenv.mkDerivation rec {
@@ -14,7 +14,7 @@ in stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://mozilla/security/nss/releases/NSS_${underscoreVersion}_RTM/src/${pname}-${version}.tar.gz";
-    sha256 = "0q8m9jf6zgkbhx71myjb7y0gcl5ib3gj6qkl9yvdqpd6vl6fn2ha";
+    sha256 = "0y4jb9095f7bbgw7d7kvzm4c3g4p5i6y68fwhb8wlkpb7b1imj5w";
   };
 
   depsBuildBuild = [ buildPackages.stdenv.cc ];
diff --git a/pkgs/development/libraries/openh264/default.nix b/pkgs/development/libraries/openh264/default.nix
index e038bb7f66de..ee430f800dd3 100644
--- a/pkgs/development/libraries/openh264/default.nix
+++ b/pkgs/development/libraries/openh264/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "openh264";
-  version = "2.1.0";
+  version = "2.1.1";
 
   src = fetchFromGitHub {
     owner = "cisco";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1wba260n1932vafd5ni2jqv9kzc7lj6a1asm1cqk8jv690m6zvpi";
+    sha256 = "0ffav46pz3sbj92nipd62z03fibyqgclfq9w8lgr80s6za6zdk5s";
   };
 
   nativeBuildInputs = [ nasm ];
diff --git a/pkgs/development/libraries/pcre2/default.nix b/pkgs/development/libraries/pcre2/default.nix
index 6c5d526d523b..d39b91355b98 100644
--- a/pkgs/development/libraries/pcre2/default.nix
+++ b/pkgs/development/libraries/pcre2/default.nix
@@ -2,10 +2,10 @@
 
 stdenv.mkDerivation rec {
   pname = "pcre2";
-  version = "10.34";
+  version = "10.35";
   src = fetchurl {
     url = "https://ftp.pcre.org/pub/pcre/${pname}-${version}.tar.bz2";
-    sha256 = "1jlqnzcz2yi70dm40wyfa9w8is9z2kh4dl8zjnv3vqd9mgzp7i3l";
+    sha256 = "04s6kmk9qdd4rjz477h547j4bx7hfz0yalpvrm381rqc5ghaijww";
   };
 
   configureFlags = [
diff --git a/pkgs/development/libraries/readline/6.3.nix b/pkgs/development/libraries/readline/6.3.nix
index 3f3503bb2ba6..2b0cf978d43e 100644
--- a/pkgs/development/libraries/readline/6.3.nix
+++ b/pkgs/development/libraries/readline/6.3.nix
@@ -32,10 +32,6 @@ stdenv.mkDerivation {
      in
        import ./readline-6.3-patches.nix patch);
 
-  # Don't run the native `strip' when cross-compiling.
-  dontStrip = stdenv.hostPlatform != stdenv.buildPlatform;
-  bash_cv_func_sigsetjmp = if stdenv.isCygwin then "missing" else null;
-
   meta = with stdenv.lib; {
     description = "Library for interactive line editing";
 
diff --git a/pkgs/development/libraries/readline/7.0.nix b/pkgs/development/libraries/readline/7.0.nix
index c4bcda0110a4..248ef55cce88 100644
--- a/pkgs/development/libraries/readline/7.0.nix
+++ b/pkgs/development/libraries/readline/7.0.nix
@@ -32,10 +32,6 @@ stdenv.mkDerivation rec {
     ]
     ++ upstreamPatches;
 
-  # Don't run the native `strip' when cross-compiling.
-  dontStrip = stdenv.hostPlatform != stdenv.buildPlatform;
-  bash_cv_func_sigsetjmp = if stdenv.isCygwin then "missing" else null;
-
   meta = with stdenv.lib; {
     description = "Library for interactive line editing";
 
diff --git a/pkgs/development/libraries/readline/8.0.nix b/pkgs/development/libraries/readline/8.0.nix
index 23075abd6f2e..6e1182647c29 100644
--- a/pkgs/development/libraries/readline/8.0.nix
+++ b/pkgs/development/libraries/readline/8.0.nix
@@ -32,10 +32,6 @@ stdenv.mkDerivation rec {
     ]
     ++ upstreamPatches;
 
-  # Don't run the native `strip' when cross-compiling.
-  dontStrip = stdenv.hostPlatform != stdenv.buildPlatform;
-  bash_cv_func_sigsetjmp = if stdenv.isCygwin then "missing" else null;
-
   meta = with stdenv.lib; {
     description = "Library for interactive line editing";
 
diff --git a/pkgs/development/libraries/sqlite/analyzer.nix b/pkgs/development/libraries/sqlite/analyzer.nix
index 4e37febbe756..cf8a9aaa7326 100644
--- a/pkgs/development/libraries/sqlite/analyzer.nix
+++ b/pkgs/development/libraries/sqlite/analyzer.nix
@@ -6,11 +6,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "sqlite-analyzer";
-  version = "3.31.1";
+  version = "3.32.2";
 
   src = assert version == sqlite.version; fetchurl {
     url = "https://sqlite.org/2020/sqlite-src-${archiveVersion version}.zip";
-    sha256 = "0n7f3w59gr80s6k4l5a9bp2s97dlfapfbhb3qdhak6axhn127p7j";
+    sha256 = "1jqhs896cvp9l399mjpbv1x2qbfvq875l1vrgnl3zc4ffdjxs9z0";
   };
 
   nativeBuildInputs = [ unzip ];
diff --git a/pkgs/development/libraries/sqlite/default.nix b/pkgs/development/libraries/sqlite/default.nix
index 245c55e9ea88..35d3d062ab78 100644
--- a/pkgs/development/libraries/sqlite/default.nix
+++ b/pkgs/development/libraries/sqlite/default.nix
@@ -10,12 +10,12 @@ in
 
 stdenv.mkDerivation rec {
   pname = "sqlite";
-  version = "3.31.1";
+  version = "3.32.2";
 
   # NB! Make sure to update analyzer.nix src (in the same directory).
   src = fetchurl {
     url = "https://sqlite.org/2020/sqlite-autoconf-${archiveVersion version}.tar.gz";
-    sha256 = "1bj936svd8i5g25xd1bj52hj4zca01fgl3sqkj86z9q5pkz4wa32";
+    sha256 = "1130bcd70s2vlsq0d638pb5qrw9kwqvjswnp2dfypghx9hjz3gid";
   };
 
   outputs = [ "bin" "dev" "out" ];
diff --git a/pkgs/development/python-modules/Cython/default.nix b/pkgs/development/python-modules/Cython/default.nix
index f0b8a5dd560d..3d5afd52abdd 100644
--- a/pkgs/development/python-modules/Cython/default.nix
+++ b/pkgs/development/python-modules/Cython/default.nix
@@ -26,11 +26,11 @@ let
 
 in buildPythonPackage rec {
   pname = "Cython";
-  version = "0.29.14";
+  version = "0.29.19";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "e4d6bb8703d0319eb04b7319b12ea41580df44fd84d83ccda13ea463c6801414";
+    sha256 = "0n2j87nka8cs772qc60d0c7lrpvsw0y8p3qzvhrsi3nmq1yqmycp";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/GitPython/default.nix b/pkgs/development/python-modules/GitPython/default.nix
index b5ffacae2964..7b39ebb7a390 100644
--- a/pkgs/development/python-modules/GitPython/default.nix
+++ b/pkgs/development/python-modules/GitPython/default.nix
@@ -1,13 +1,13 @@
 { lib, buildPythonPackage, fetchPypi, isPy27, substituteAll, git, gitdb, mock, nose, ddt }:
 
 buildPythonPackage rec {
-  version = "3.1.2";
+  version = "3.1.3";
   pname = "GitPython";
   disabled = isPy27; # no longer supported
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "864a47472548f3ba716ca202e034c1900f197c0fb3a08f641c20c3cafd15ed94";
+    sha256 = "e107af4d873daed64648b4f4beb89f89f0cfbe3ef558fc7821ed2331c2f8da1a";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/JPype1/default.nix b/pkgs/development/python-modules/JPype1/default.nix
index c43b2a05a519..b70879952f4e 100644
--- a/pkgs/development/python-modules/JPype1/default.nix
+++ b/pkgs/development/python-modules/JPype1/default.nix
@@ -6,11 +6,11 @@
 
 buildPythonPackage rec {
   pname = "JPype1";
-  version = "0.7.4";
+  version = "0.7.5";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "92f24b0fe11e90b57343494ce38699043d9e6828a22a99dddbcf99c0adb4c1f7";
+    sha256 = "7bbd25453dc04704d77d854c80acb5537ecb18b9de8a5572e5f22649a2160aaf";
   };
 
   checkInputs = [
diff --git a/pkgs/development/python-modules/Mako/default.nix b/pkgs/development/python-modules/Mako/default.nix
index 597a4695c0cb..375a02968646 100644
--- a/pkgs/development/python-modules/Mako/default.nix
+++ b/pkgs/development/python-modules/Mako/default.nix
@@ -10,11 +10,11 @@
 
 buildPythonPackage rec {
   pname = "Mako";
-  version = "1.1.2";
+  version = "1.1.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "3139c5d64aa5d175dbafb95027057128b5fbd05a40c53999f3905ceb53366d9d";
+    sha256 = "8195c8c1400ceb53496064314c6736719c6f25e7479cd24c77be3d9361cddc27";
   };
 
   checkInputs = [ markupsafe nose mock ];
diff --git a/pkgs/development/python-modules/aioharmony/default.nix b/pkgs/development/python-modules/aioharmony/default.nix
index 13769bbeaed3..09b6919495de 100644
--- a/pkgs/development/python-modules/aioharmony/default.nix
+++ b/pkgs/development/python-modules/aioharmony/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "aioharmony";
-  version = "0.2.1";
+  version = "0.2.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "8c8f6e3b776e4e7eba5a1d2ae739aac6a1dd558a7f15951c34ffe0ee28f7f538";
+    sha256 = "445323810978454ba3b32be53ba6b43cf9948586de3f9734b8743b55858b3cc7";
   };
 
   disabled = !isPy3k;
diff --git a/pkgs/development/python-modules/aiolifx/default.nix b/pkgs/development/python-modules/aiolifx/default.nix
index c40f8d3b4471..7b33b1c508f8 100644
--- a/pkgs/development/python-modules/aiolifx/default.nix
+++ b/pkgs/development/python-modules/aiolifx/default.nix
@@ -8,11 +8,11 @@
 
 buildPythonPackage rec {
   pname = "aiolifx";
-  version = "0.6.7";
+  version = "0.6.8";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "cf53c9faea6eee25a466e73eef1753b82a75c7497648149c19c15342df2678f2";
+    sha256 = "9f9055bc2a9a72c5eab17e0ce5522edecd6de07e21cf347bf0cffabdabe5570e";
   };
 
   # tests are not implemented
diff --git a/pkgs/development/python-modules/aioresponses/default.nix b/pkgs/development/python-modules/aioresponses/default.nix
index bbeca1c31507..9034e6a67316 100644
--- a/pkgs/development/python-modules/aioresponses/default.nix
+++ b/pkgs/development/python-modules/aioresponses/default.nix
@@ -11,12 +11,12 @@
 
 buildPythonPackage rec {
   pname = "aioresponses";
-  version = "0.6.3";
+  version = "0.6.4";
   disabled = pythonOlder "3.5";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "06w15iyr07s861hkzqfdclzxkpvgg83sx8f235mz8k2490hnyqvv";
+    sha256 = "4397ca736238a1ada8c7f47e557dda05e9ecfdd467b9f6b83871efd365af7e9f";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/appdirs/default.nix b/pkgs/development/python-modules/appdirs/default.nix
index 2f7f2ae0281b..22fa3dc98fb0 100644
--- a/pkgs/development/python-modules/appdirs/default.nix
+++ b/pkgs/development/python-modules/appdirs/default.nix
@@ -5,11 +5,11 @@
 
 buildPythonPackage rec {
   pname = "appdirs";
-  version = "1.4.3";
+  version = "1.4.4";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "9e5896d1372858f8dd3344faf4e5014d21849c756c8d5701f78f8a103b372d92";
+    sha256 = "7d5d0167b2b1ba821647616af46a749d1c653740dd0d2415100fe26e27afdf41";
   };
 
   meta = {
diff --git a/pkgs/development/python-modules/atlassian-python-api/default.nix b/pkgs/development/python-modules/atlassian-python-api/default.nix
index f9462c5b0a50..5f124cc09434 100755
--- a/pkgs/development/python-modules/atlassian-python-api/default.nix
+++ b/pkgs/development/python-modules/atlassian-python-api/default.nix
@@ -16,11 +16,11 @@
 
 buildPythonPackage rec {
   pname = "atlassian-python-api";
-  version = "1.15.7";
+  version = "1.15.9";
   
   src = fetchPypi {
     inherit pname version;
-    sha256 = "b54cce1ca4bea838a949b4362410b1d717597951e5b7efbfa34ce89bc5df805e";
+    sha256 = "c6a3125ee68ecf4d11947497c1f891b6436df9d8453f8865cabf595813504cc1";
   };
   
   checkInputs = [ pytestrunner pytest ];
diff --git a/pkgs/development/python-modules/autopep8/default.nix b/pkgs/development/python-modules/autopep8/default.nix
index 715e4da8f44e..7b7131f2a7fc 100644
--- a/pkgs/development/python-modules/autopep8/default.nix
+++ b/pkgs/development/python-modules/autopep8/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "autopep8";
-  version = "1.5.2";
+  version = "1.5.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0m29ndgrcgrzi3y1fsxmdl421x6n4gn02l70hsz8486h8zzdhbqm";
+    sha256 = "60fd8c4341bab59963dafd5d2a566e94f547e660b9b396f772afe67d8481dbf0";
   };
 
   propagatedBuildInputs = [ pycodestyle ];
diff --git a/pkgs/development/python-modules/awkward1/default.nix b/pkgs/development/python-modules/awkward1/default.nix
index 3e2b08061d92..0c2b3338690f 100644
--- a/pkgs/development/python-modules/awkward1/default.nix
+++ b/pkgs/development/python-modules/awkward1/default.nix
@@ -10,11 +10,11 @@
 
 buildPythonPackage rec {
   pname = "awkward1";
-  version = "0.2.19";
+  version = "0.2.22";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "23446eacdf52cad1fb0b5bb0f2ed16c1ae8bb5a282d667ad37ab69494e1ef27f";
+    sha256 = "c64a8ad0204743d49cf2f8775f92d9c23dd9d7eb6996a61f4a9de57a53d429f9";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/python-modules/bids-validator/default.nix b/pkgs/development/python-modules/bids-validator/default.nix
index 56a941e60e09..036f54346144 100644
--- a/pkgs/development/python-modules/bids-validator/default.nix
+++ b/pkgs/development/python-modules/bids-validator/default.nix
@@ -4,12 +4,12 @@
 }:
 
 buildPythonPackage rec {
-  version = "1.5.1";
+  version = "1.5.2";
   pname = "bids-validator";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1fy8w56m0x546zjk3is1xp83jm19fkn4y15g5jgmq29sfzc8n3y3";
+    sha256 = "6f3bd0402d41ee9be03637d74f34a7db279d00cb9c6386b0597cbbac16ee8f4e";
   };
 
   propagatedBuildInputs = [ ];
diff --git a/pkgs/development/python-modules/bleak/default.nix b/pkgs/development/python-modules/bleak/default.nix
index 559fd33e8eb0..b7ebca9eb034 100644
--- a/pkgs/development/python-modules/bleak/default.nix
+++ b/pkgs/development/python-modules/bleak/default.nix
@@ -2,13 +2,13 @@
 
 buildPythonPackage rec {
   pname = "bleak";
-  version = "0.6.2";
+  version = "0.6.4";
 
   disabled = !isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1kmq2z3dhq6dd20i5w71gshjrfvyw0pkpnld8iib9ai2rz6a8aj0";
+    sha256 = "1dc32899d0700c5b5ed9abf642dfee28ac62b1fb5d7be5fa5a6db104dec9a03c";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/block-io/default.nix b/pkgs/development/python-modules/block-io/default.nix
index f80c8a8c145f..505d3ffe149c 100644
--- a/pkgs/development/python-modules/block-io/default.nix
+++ b/pkgs/development/python-modules/block-io/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "block-io";
-  version = "1.1.10";
+  version = "1.1.13";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "ba2e750085d9da4d1567932f3f719974fdc3f02649ee0d5c2f85fce592208723";
+    sha256 = "a45e31361d17ce272a0d563a689d6b87b65cc16e9348f8cd3a6460c93359b1bd";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/boto3/default.nix b/pkgs/development/python-modules/boto3/default.nix
index 2903b8ae7c66..1baa668d3c89 100644
--- a/pkgs/development/python-modules/boto3/default.nix
+++ b/pkgs/development/python-modules/boto3/default.nix
@@ -13,11 +13,11 @@
 
 buildPythonPackage rec {
   pname =  "boto3";
-  version = "1.13.6"; # N.B: if you change this, change botocore too
+  version = "1.13.23"; # N.B: if you change this, change botocore too
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "f1ac7eb23ff8b1d7e314123668ff1e93b874dd396ac5424adc443d68bd8a6fbf";
+    sha256 = "bcaa88b2f81b88741c47da52f3414c876236700441df87b6198f860e6a200d6f";
   };
 
   propagatedBuildInputs = [ botocore jmespath s3transfer ] ++ lib.optionals (!isPy3k) [ futures ];
diff --git a/pkgs/development/python-modules/botocore/default.nix b/pkgs/development/python-modules/botocore/default.nix
index 9bf977f831dd..060abad204b0 100644
--- a/pkgs/development/python-modules/botocore/default.nix
+++ b/pkgs/development/python-modules/botocore/default.nix
@@ -12,11 +12,11 @@
 
 buildPythonPackage rec {
   pname = "botocore";
-  version = "1.16.6"; # N.B: if you change this, change boto3 and awscli to a matching version
+  version = "1.16.23"; # N.B: if you change this, change boto3 and awscli to a matching version
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "b9c8e0aa07770b7b371d586db41eef46e70bfc4ab47f7a1ee1acd4e9c811c6c9";
+    sha256 = "5831068c9b49b4c91b0733e0ec784a7733d8732359d73c67a07a0b0868433cae";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/bugsnag/default.nix b/pkgs/development/python-modules/bugsnag/default.nix
index 2f0e67683d9a..612ab13c1934 100644
--- a/pkgs/development/python-modules/bugsnag/default.nix
+++ b/pkgs/development/python-modules/bugsnag/default.nix
@@ -7,11 +7,11 @@
 
 buildPythonPackage rec {
   pname = "bugsnag";
-  version = "3.6.0";
+  version = "3.6.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "17cjh7g8gbr0gb22nzybkw7vq9x5wfa5ln94hhzijbz934bw1f37";
+    sha256 = "8878437aa44ec485cecb255742035b3b98a6c7e7d167a943b5fbe597b2f8f7f9";
   };
 
   propagatedBuildInputs = [ six webob ];
diff --git a/pkgs/development/python-modules/can/default.nix b/pkgs/development/python-modules/can/default.nix
index 3629e0097eda..0a7e58ac8006 100644
--- a/pkgs/development/python-modules/can/default.nix
+++ b/pkgs/development/python-modules/can/default.nix
@@ -16,11 +16,11 @@
 
 buildPythonPackage rec {
   pname = "python-can";
-  version = "3.3.2";
+  version = "3.3.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "5fefb5c1e7e7f07faefc02c6eac79f9b58376f007048a04d8e7f325d48ec6b2e";
+    sha256 = "ecd69cf6b2f0235345ebe607a15325cf1384c85b24ffbe1d68c3754357f87488";
   };
 
   propagatedBuildInputs = [ wrapt pyserial aenum ] ++ lib.optional (pythonOlder "3.5") typing;
diff --git a/pkgs/development/python-modules/cnvkit/default.nix b/pkgs/development/python-modules/cnvkit/default.nix
index 054e302dfe76..f4f46f2dff0f 100644
--- a/pkgs/development/python-modules/cnvkit/default.nix
+++ b/pkgs/development/python-modules/cnvkit/default.nix
@@ -18,11 +18,11 @@
 
 buildPythonPackage rec {
   pname = "CNVkit";
-  version = "0.9.6";
+  version = "0.9.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1hj8c98s538i0hg5mrz4bw4v07qmcl51rhxq611rj2nglnc9r25y";
+    sha256 = "d68adc0121e17c61a3aa28c0a9ba6526510a5a0df0f0a6eb1818bab71b7e927a";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/coverage/default.nix b/pkgs/development/python-modules/coverage/default.nix
index 04c469204d78..a22009ac9db1 100644
--- a/pkgs/development/python-modules/coverage/default.nix
+++ b/pkgs/development/python-modules/coverage/default.nix
@@ -6,11 +6,11 @@
 
 buildPythonPackage rec {
   pname = "coverage";
-  version = "4.5.4";
+  version = "5.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "e07d9f1a23e9e93ab5c62902833bf3e4b1f65502927379148b6622686223125c";
+    sha256 = "0ll0hr8g3szbxa4al6khhzi6l92a3vwyldj0085whl44s55gq2zr";
   };
 
   # No tests in archive
diff --git a/pkgs/development/python-modules/croniter/default.nix b/pkgs/development/python-modules/croniter/default.nix
index 90334fd42250..15aaf97d15c0 100644
--- a/pkgs/development/python-modules/croniter/default.nix
+++ b/pkgs/development/python-modules/croniter/default.nix
@@ -8,11 +8,11 @@
 
 buildPythonPackage rec {
   pname = "croniter";
-  version = "0.3.31";
+  version = "0.3.32";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "15riw8sl8jzzkvvjlz3i3p7jcx423zipxhff5ddvki6zgnrb9149";
+    sha256 = "0d5bf45f12861c1b718c51bd6e2ab056da94e651bf22900658421cdde0ff7088";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/django-mailman3/default.nix b/pkgs/development/python-modules/django-mailman3/default.nix
index bcb39633f7ea..c8fdd57c98e1 100644
--- a/pkgs/development/python-modules/django-mailman3/default.nix
+++ b/pkgs/development/python-modules/django-mailman3/default.nix
@@ -4,11 +4,11 @@
 
 buildPythonPackage rec {
   pname = "django-mailman3";
-  version = "1.3.2";
+  version = "1.3.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1vq5qa136h4rz4hjznnk6y8l443i41yh4w4wxg20f9b059xrsld1";
+    sha256 = "1q9ciy2yawgvbha5kwlzwdmdqvas287dc0i60ygp2799jnfr5dr6";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/django_modelcluster/default.nix b/pkgs/development/python-modules/django_modelcluster/default.nix
index 27060e18ae27..4ded69bc3256 100644
--- a/pkgs/development/python-modules/django_modelcluster/default.nix
+++ b/pkgs/development/python-modules/django_modelcluster/default.nix
@@ -8,11 +8,11 @@
 
 buildPythonPackage rec {
   pname = "django-modelcluster";
-  version = "5.0.1";
+  version = "5.0.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1fk7fh30i0fzi0hjd841vxh25iryvgp4lirmxfpq428w4nq7p1bg";
+    sha256 = "c7a42cf9b93d1161a10bf59919f7ee52d996a523a4134b2a136f6fe1eba7a2fa";
   };
 
   disabled = pythonOlder "3.5";
diff --git a/pkgs/development/python-modules/dnslib/default.nix b/pkgs/development/python-modules/dnslib/default.nix
index fafa4c5cbf57..df9843893238 100644
--- a/pkgs/development/python-modules/dnslib/default.nix
+++ b/pkgs/development/python-modules/dnslib/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "dnslib";
-  version = "0.9.12";
+  version = "0.9.13";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "c206f09948f3ad17884adffdb552b700072c6022fa59744a0f0606114c475e19";
+    sha256 = "a0fed3e139c12ee4884b19bcde1d4a170745bcabb6026397876e3236ce38b9db";
   };
 
   checkPhase = "VERSIONS=${python.interpreter} ./run_tests.sh";
diff --git a/pkgs/development/python-modules/doc8/default.nix b/pkgs/development/python-modules/doc8/default.nix
index f7e620f491cb..c2a7df098f4b 100644
--- a/pkgs/development/python-modules/doc8/default.nix
+++ b/pkgs/development/python-modules/doc8/default.nix
@@ -12,11 +12,11 @@
 
 buildPythonPackage rec {
   pname = "doc8";
-  version = "0.8.0";
+  version = "0.8.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "2df89f9c1a5abfb98ab55d0175fed633cae0cf45025b8b1e0ee5ea772be28543";
+    sha256 = "4d1df12598807cf08ffa9a1d5ef42d229ee0de42519da01b768ff27211082c12";
   };
 
   buildInputs = [ pbr ];
diff --git a/pkgs/development/python-modules/docker/default.nix b/pkgs/development/python-modules/docker/default.nix
index a31ba7c69c03..9c788bde123d 100644
--- a/pkgs/development/python-modules/docker/default.nix
+++ b/pkgs/development/python-modules/docker/default.nix
@@ -11,11 +11,11 @@
 
 buildPythonPackage rec {
   pname = "docker";
-  version = "4.2.0";
+  version = "4.2.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0bkj1xfp6mnvk1i9hl5awsmwi07q6iwwsjznd7kvrx5m19i6dbnx";
+    sha256 = "380a20d38fbfaa872e96ee4d0d23ad9beb0f9ed57ff1c30653cbeb0c9c0964f2";
   };
 
   nativeBuildInputs = lib.optional isPy27 mock;
diff --git a/pkgs/development/python-modules/dockerfile-parse/default.nix b/pkgs/development/python-modules/dockerfile-parse/default.nix
index ffed5fb170d4..580945656b4c 100644
--- a/pkgs/development/python-modules/dockerfile-parse/default.nix
+++ b/pkgs/development/python-modules/dockerfile-parse/default.nix
@@ -1,12 +1,12 @@
 { stdenv, buildPythonPackage, fetchPypi, six, pytestcov, pytest }:
 
 buildPythonPackage rec {
-  version = "0.0.17";
+  version = "0.0.18";
   pname = "dockerfile-parse";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "a69d4ed44c4a890c16437327009ae59ec3a3afeb1abc3819d0c1b14a46099220";
+    sha256 = "a09eae6871b7b314f8a8bddb67b6c5002708b22247511906cf2a9a45564b83db";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/elasticsearch-dsl/default.nix b/pkgs/development/python-modules/elasticsearch-dsl/default.nix
index 712766fa58e2..68d658f4989e 100644
--- a/pkgs/development/python-modules/elasticsearch-dsl/default.nix
+++ b/pkgs/development/python-modules/elasticsearch-dsl/default.nix
@@ -10,11 +10,11 @@
 
 buildPythonPackage rec {
   pname = "elasticsearch-dsl";
-  version = "7.2.0";
+  version = "7.2.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "19q91srlcvfrk5rnk18c0mzvki9l893g7rqgymfg0p8abb9c05a0";
+    sha256 = "1e345535164cb684de4b825e1d0daf81b75554b30d3905446584a9e4af0cc3e7";
   };
 
   propagatedBuildInputs = [ elasticsearch python-dateutil six ]
diff --git a/pkgs/development/python-modules/elasticsearch/default.nix b/pkgs/development/python-modules/elasticsearch/default.nix
index 821a890346fc..b04bc9069f71 100644
--- a/pkgs/development/python-modules/elasticsearch/default.nix
+++ b/pkgs/development/python-modules/elasticsearch/default.nix
@@ -7,11 +7,11 @@
 
 buildPythonPackage (rec {
   pname = "elasticsearch";
-  version = "7.7.0";
+  version = "7.7.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1fm6lalyiy4ayj0mp400dvy629j2av5cqww72w4cg8bqifb83pim";
+    sha256 = "9bfcb2bd137d6d7ca123e252b9d7261cfe4f7723f7b749a99c52b47766cf387c";
   };
 
   # Check is disabled because running them destroy the content of the local cluster!
diff --git a/pkgs/development/python-modules/eve/default.nix b/pkgs/development/python-modules/eve/default.nix
index 7a74de03d522..062d6e3bedb8 100644
--- a/pkgs/development/python-modules/eve/default.nix
+++ b/pkgs/development/python-modules/eve/default.nix
@@ -11,11 +11,11 @@
 
 buildPythonPackage rec {
   pname = "Eve";
-  version = "1.1";
+  version = "1.1.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1a7i7x77p5wjqfzmgn30m9sz2mcz06k4qf5af6a45109lafcq0bv";
+    sha256 = "dbb409c481ffd5100a5ab13177f6ef6284257e33ac8e5090cd50e42533607ebd";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/flask-sqlalchemy/default.nix b/pkgs/development/python-modules/flask-sqlalchemy/default.nix
index 2453bb50766d..594af9f74bf4 100644
--- a/pkgs/development/python-modules/flask-sqlalchemy/default.nix
+++ b/pkgs/development/python-modules/flask-sqlalchemy/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "Flask-SQLAlchemy";
-  version = "2.4.1";
+  version = "2.4.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "6974785d913666587949f7c2946f7001e4fa2cb2d19f4e69ead02e4b8f50b33d";
+    sha256 = "0b656fbf87c5f24109d859bafa791d29751fabbda2302b606881ae5485b557a5";
   };
 
   propagatedBuildInputs = [ flask sqlalchemy ];
diff --git a/pkgs/development/python-modules/geoalchemy2/default.nix b/pkgs/development/python-modules/geoalchemy2/default.nix
index e4fbb37c966e..892b373f065c 100644
--- a/pkgs/development/python-modules/geoalchemy2/default.nix
+++ b/pkgs/development/python-modules/geoalchemy2/default.nix
@@ -7,11 +7,11 @@
 
 buildPythonPackage rec {
   pname = "GeoAlchemy2";
-  version = "0.8.0";
+  version = "0.8.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0kqxm9imqjbhjj5imvf2kl57di454xmnnsr3i0cs66ibq90nx5m8";
+    sha256 = "a5a2444d90ce7f2c6b2d7bd7346c8aed16fd32c3e190e631576a51814e8f7ee9";
   };
 
   propagatedBuildInputs = [ sqlalchemy shapely ];
diff --git a/pkgs/development/python-modules/google_cloud_resource_manager/default.nix b/pkgs/development/python-modules/google_cloud_resource_manager/default.nix
index d1d4217b3ccc..84fac88bcfa9 100644
--- a/pkgs/development/python-modules/google_cloud_resource_manager/default.nix
+++ b/pkgs/development/python-modules/google_cloud_resource_manager/default.nix
@@ -9,11 +9,11 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-resource-manager";
-  version = "0.30.1";
+  version = "0.30.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "03n9ahf4qiyamblh217m5bjc8n57gh09xz87l2iw84c81xxdfcpg";
+    sha256 = "de7eba5235df61deee2291a2fe70b904154df613a334109488afdea7a4c0011f";
   };
 
   checkInputs = [ pytest mock ];
diff --git a/pkgs/development/python-modules/google_resumable_media/default.nix b/pkgs/development/python-modules/google_resumable_media/default.nix
index e9c7eecbc3a7..40c8f2596bb1 100644
--- a/pkgs/development/python-modules/google_resumable_media/default.nix
+++ b/pkgs/development/python-modules/google_resumable_media/default.nix
@@ -10,11 +10,11 @@
 
 buildPythonPackage rec {
   pname = "google-resumable-media";
-  version = "0.5.0";
+  version = "0.5.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "2a8fd188afe1cbfd5998bf20602f76b0336aa892de88fe842a806b9a3ed78d2a";
+    sha256 = "97155236971970382b738921f978a6f86a7b5a0b0311703d991e065d3cb55773";
   };
 
   checkInputs = [ pytest mock ];
diff --git a/pkgs/development/python-modules/greenlet/default.nix b/pkgs/development/python-modules/greenlet/default.nix
index f6cff7411d21..c325c9652491 100644
--- a/pkgs/development/python-modules/greenlet/default.nix
+++ b/pkgs/development/python-modules/greenlet/default.nix
@@ -8,12 +8,12 @@
 
 buildPythonPackage rec {
   pname = "greenlet";
-  version = "0.4.15";
+  version = "0.4.16";
   disabled = isPyPy;  # builtin for pypy
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "9416443e219356e3c31f1f918a91badf2e37acf297e2fa13d24d1cc2380f8fbc";
+    sha256 = "6e06eac722676797e8fce4adb8ad3dc57a1bb3adfb0dd3fdf8306c055a38456c";
   };
 
   propagatedBuildInputs = [ six ];
diff --git a/pkgs/development/python-modules/hsaudiotag3k/default.nix b/pkgs/development/python-modules/hsaudiotag3k/default.nix
index 28fa42b70f04..d12d3bc8c832 100644
--- a/pkgs/development/python-modules/hsaudiotag3k/default.nix
+++ b/pkgs/development/python-modules/hsaudiotag3k/default.nix
@@ -6,12 +6,12 @@
 
 buildPythonPackage rec {
   pname = "hsaudiotag3k";
-  version = "1.1.3";
+  version = "1.1.3.post1";
   disabled = !isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0bv5k5594byr2bmhh77xv10fkdpckcmxg3w380yp30aqf83rcsx3";
+    sha256 = "ef60e9210d4727e82f0095a686cb07b676d055918f0c59c5bfa8598da03e59d1";
   };
 
   # no tests
diff --git a/pkgs/development/python-modules/httplib2/default.nix b/pkgs/development/python-modules/httplib2/default.nix
index f0191ad8226c..5495c806dc0f 100644
--- a/pkgs/development/python-modules/httplib2/default.nix
+++ b/pkgs/development/python-modules/httplib2/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "httplib2";
-  version = "0.17.3";
+  version = "0.17.4";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "39dd15a333f67bfb70798faa9de8a6e99c819da6ad82b77f9a259a5c7b1225a2";
+    sha256 = "1e9340ecf0187a621bdcfb407c32e04e8e09fc6ab28b050efa38f20eae0e975f";
   };
 
   # Needs setting up
diff --git a/pkgs/development/python-modules/hvac/default.nix b/pkgs/development/python-modules/hvac/default.nix
index a783246ee5c3..d68e12b37732 100644
--- a/pkgs/development/python-modules/hvac/default.nix
+++ b/pkgs/development/python-modules/hvac/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "hvac";
-  version = "0.10.1";
+  version = "0.10.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1fcd2psvkfsqy45iygm59rzhb7qkbgv3c1dk3x3jvhy6a1ls4kkq";
+    sha256 = "391b558a465d1919a2862926ab9a7c6bef1f2ac2c46daf8dd5115080c42978e4";
   };
 
   propagatedBuildInputs = [ requests six ];
diff --git a/pkgs/development/python-modules/identify/default.nix b/pkgs/development/python-modules/identify/default.nix
index 19ad7317ce41..9f78298a3f3a 100644
--- a/pkgs/development/python-modules/identify/default.nix
+++ b/pkgs/development/python-modules/identify/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "identify";
-  version = "1.4.16";
+  version = "1.4.19";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "19zk3qmcf0afbcbfnj7cmmgr47pxhjqwa1bfdc3fp60yy10kvbgr";
+    sha256 = "249ebc7e2066d6393d27c1b1be3b70433f824a120b1d8274d362f1eb419e3b52";
   };
 
   # Tests not included in PyPI tarball
diff --git a/pkgs/development/python-modules/importlib-metadata/default.nix b/pkgs/development/python-modules/importlib-metadata/default.nix
index 76545edcbeba..5a3137922475 100644
--- a/pkgs/development/python-modules/importlib-metadata/default.nix
+++ b/pkgs/development/python-modules/importlib-metadata/default.nix
@@ -13,12 +13,12 @@
 
 buildPythonPackage rec {
   pname = "importlib-metadata";
-  version = "1.5.0";
+  version = "1.6.0";
 
   src = fetchPypi {
     pname = "importlib_metadata";
     inherit version;
-    sha256 = "00ikdj4gjhankdljnz7g5ggak4k9lql2926x0x117ir9j2lv7x86";
+    sha256 = "07icyggasn38yv2swdrd8z6i0plazmc9adavsdkbqqj91j53ll9l";
   };
 
   nativeBuildInputs = [ setuptools_scm ];
@@ -26,7 +26,7 @@ buildPythonPackage rec {
   propagatedBuildInputs = [ zipp ]
     ++ lib.optionals (!isPy3k) [ pathlib2 contextlib2 configparser ];
 
-  checkInputs = [ importlib-resources packaging ];
+  doCheck = false; # Cyclic dependencies.
 
   # removing test_main.py - it requires 'pyflakefs'
   # and adding `pyflakefs` to `checkInputs` causes infinite recursion.
diff --git a/pkgs/development/python-modules/importlib-resources/default.nix b/pkgs/development/python-modules/importlib-resources/default.nix
index 6fba0a703e16..7faefd4c0e1e 100644
--- a/pkgs/development/python-modules/importlib-resources/default.nix
+++ b/pkgs/development/python-modules/importlib-resources/default.nix
@@ -1,24 +1,28 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, pathlib2
+, setuptools_scm
+, toml
+, importlib-metadata
 , typing
-, isPy3k
+, singledispatch
 , pythonOlder
 , python
 }:
 
 buildPythonPackage rec {
   pname = "importlib_resources";
-  version = "1.0.2";
+  version = "1.5.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "d3279fd0f6f847cced9f7acc19bd3e5df54d34f93a2e7bb5f238f81545787078";
+    sha256 = "1jilyxyb2z7hzcjhx1ddni52mq00i728wqh8f5k4469yhdkdz1vg";
   };
 
+  nativeBuildInputs = [ setuptools_scm toml ];
   propagatedBuildInputs = [
-  ] ++ lib.optional (!isPy3k) pathlib2
+    importlib-metadata
+  ] ++ lib.optional (pythonOlder "3.4") singledispatch
     ++ lib.optional (pythonOlder "3.5") typing
   ;
 
diff --git a/pkgs/development/python-modules/ipython/7.9.nix b/pkgs/development/python-modules/ipython/7.9.nix
index 4c8086def330..9953868df5f3 100644
--- a/pkgs/development/python-modules/ipython/7.9.nix
+++ b/pkgs/development/python-modules/ipython/7.9.nix
@@ -64,6 +64,6 @@ buildPythonPackage rec {
     description = "IPython: Productive Interactive Computing";
     homepage = "http://ipython.org/";
     license = licenses.bsd3;
-    maintainers = with maintainers; [ bjornfor fridh ];
+    maintainers = with maintainers; [ bjornfor ];
   };
 }
diff --git a/pkgs/development/python-modules/ipython/default.nix b/pkgs/development/python-modules/ipython/default.nix
index 69fe73eb3423..692daa7b2f38 100644
--- a/pkgs/development/python-modules/ipython/default.nix
+++ b/pkgs/development/python-modules/ipython/default.nix
@@ -22,12 +22,12 @@
 
 buildPythonPackage rec {
   pname = "ipython";
-  version = "7.14.0";
+  version = "7.15.0";
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "f0126781d0f959da852fb3089e170ed807388e986a8dd4e6ac44855845b0fb1c";
+    sha256 = "0ef1433879816a960cd3ae1ae1dc82c64732ca75cec8dab5a4e29783fb571d0e";
   };
 
   prePatch = lib.optionalString stdenv.isDarwin ''
diff --git a/pkgs/development/python-modules/isbnlib/default.nix b/pkgs/development/python-modules/isbnlib/default.nix
index 11ae3157615a..2c454fd9ce0c 100644
--- a/pkgs/development/python-modules/isbnlib/default.nix
+++ b/pkgs/development/python-modules/isbnlib/default.nix
@@ -7,11 +7,11 @@
 
 buildPythonPackage rec {
   pname = "isbnlib";
-  version = "3.10.1";
+  version = "3.10.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1ky5ynb8p580y2x3vpib6yrvdjgjb0wpqmdfnq5pqi3qzjyzsqra";
+    sha256 = "2295c01465fe19776b1f9432fd99fd24e61230d146ded2752e0d980ef6f4101f";
   };
 
   checkInputs = [
diff --git a/pkgs/development/python-modules/jupyter_client/5.nix b/pkgs/development/python-modules/jupyter_client/5.nix
index 4855663ebc7d..8ce8150cbd47 100644
--- a/pkgs/development/python-modules/jupyter_client/5.nix
+++ b/pkgs/development/python-modules/jupyter_client/5.nix
@@ -34,6 +34,6 @@ buildPythonPackage rec {
     description = "Jupyter protocol implementation and client libraries";
     homepage = "https://jupyter.org/";
     license = lib.licenses.bsd3;
-    maintainers = with lib.maintainers; [ fridh ];
+    maintainers = with lib.maintainers; [  ];
   };
 }
diff --git a/pkgs/development/python-modules/jupyterlab/default.nix b/pkgs/development/python-modules/jupyterlab/default.nix
index a8057ed06ae5..8d08fec6f5d9 100644
--- a/pkgs/development/python-modules/jupyterlab/default.nix
+++ b/pkgs/development/python-modules/jupyterlab/default.nix
@@ -8,12 +8,12 @@
 
 buildPythonPackage rec {
   pname = "jupyterlab";
-  version = "2.1.2";
+  version = "2.1.4";
   disabled = pythonOlder "3.5";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "380c29d674f6dcf8e380615334c7813bb4feb7bbb6222baf1d4c9f8318f4b104";
+    sha256 = "7b5bd4a05330a01c8522ee7f1cda5cb2e0d96412d9e1e879a19b3afb63d4ac69";
   };
 
   propagatedBuildInputs = [ jupyterlab_server notebook ];
diff --git a/pkgs/development/python-modules/jupyterlab_server/default.nix b/pkgs/development/python-modules/jupyterlab_server/default.nix
index cd166b2d801e..9185c2940060 100644
--- a/pkgs/development/python-modules/jupyterlab_server/default.nix
+++ b/pkgs/development/python-modules/jupyterlab_server/default.nix
@@ -11,12 +11,12 @@
 
 buildPythonPackage rec {
   pname = "jupyterlab_server";
-  version = "1.1.3";
+  version = "1.1.5";
   disabled = pythonOlder "3.5";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "17eac20af10167abebbeca72e7e390b9c19a400b8fffa158b5cfdcac344253d4";
+    sha256 = "3398e401b95da868bc96bdaa44fa61252bf3e68fc9dd1645bd93293cce095f6c";
   };
 
   checkInputs = [ requests pytest ];
diff --git a/pkgs/development/python-modules/keras-preprocessing/default.nix b/pkgs/development/python-modules/keras-preprocessing/default.nix
index cb4b6d249b60..d62a179136f4 100644
--- a/pkgs/development/python-modules/keras-preprocessing/default.nix
+++ b/pkgs/development/python-modules/keras-preprocessing/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "Keras_Preprocessing";
-  version = "1.1.0";
+  version = "1.1.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1r98nm4k1svsqjyaqkfk23i31bl1kcfcyp7094yyj3c43phfp3as";
+    sha256 = "add82567c50c8bc648c14195bf544a5ce7c1f76761536956c3d2978970179ef3";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/kombu/default.nix b/pkgs/development/python-modules/kombu/default.nix
index 437f03276708..27d225c6f7cf 100644
--- a/pkgs/development/python-modules/kombu/default.nix
+++ b/pkgs/development/python-modules/kombu/default.nix
@@ -11,11 +11,11 @@
 
 buildPythonPackage rec {
   pname = "kombu";
-  version = "4.6.8";
+  version = "4.6.10";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0xlv1rsfc3vn22l35csaj939zygd15nzmxbz3bcl981685vxl71d";
+    sha256 = "437b9cdea193cc2ed0b8044c85fd0f126bb3615ca2f4d4a35b39de7cacfa3c1a";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/mailmanclient/default.nix b/pkgs/development/python-modules/mailmanclient/default.nix
index 247a7ed1b004..45dfc55ae9a8 100644
--- a/pkgs/development/python-modules/mailmanclient/default.nix
+++ b/pkgs/development/python-modules/mailmanclient/default.nix
@@ -2,20 +2,16 @@
 
 buildPythonPackage rec {
   pname = "mailmanclient";
-  version = "3.3.0";
+  version = "3.3.1";
   disabled = !isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "c8736cbe152ae1bd58b46ccfbcafb6a1e301513530772e7fda89f91d1e5c1ae9";
+    sha256 = "0pjgzpvhdb6ql8asb20xr8d01m646zpghmcp9fmscks0n1k4di4g";
   };
 
   propagatedBuildInputs = [ six httplib2 requests ];
 
-  # no tests with Pypi tar ball, checkPhase removes setup.py which invalidates import check
-  doCheck = false;
-  pythonImportsCheck = [ "mailmanclient" ];
-
   meta = with stdenv.lib; {
     homepage = "https://www.gnu.org/software/mailman/";
     description = "REST client for driving Mailman 3";
diff --git a/pkgs/development/python-modules/mautrix/default.nix b/pkgs/development/python-modules/mautrix/default.nix
index 1bf23111422d..364b62ef8676 100644
--- a/pkgs/development/python-modules/mautrix/default.nix
+++ b/pkgs/development/python-modules/mautrix/default.nix
@@ -4,11 +4,11 @@
 
 buildPythonPackage rec {
   pname = "mautrix";
-  version = "0.5.0";
+  version = "0.5.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0hcm2hwryfr6js33zcl2k95wbjrgcj89pi90lka0hjw9vs9bmdz6";
+    sha256 = "a8dcf86c3562c1c6c25247b0a1a16f95d821bc8b3805141787c0b9ed8a2b4ca9";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/meinheld/default.nix b/pkgs/development/python-modules/meinheld/default.nix
index 247523a9a830..2941505184de 100644
--- a/pkgs/development/python-modules/meinheld/default.nix
+++ b/pkgs/development/python-modules/meinheld/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "meinheld";
-  version = "1.0.1";
+  version = "1.0.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "447de7189e4dc9c1f425aa1b9c8210aab492fda4d86f73a24059264e7d8b0134";
+    sha256 = "008c76937ac2117cc69e032dc69cea9f85fc605de9bac1417f447c41c16a56d6";
   };
 
   propagatedBuildInputs = [ greenlet ];
diff --git a/pkgs/development/python-modules/msgpack-numpy/default.nix b/pkgs/development/python-modules/msgpack-numpy/default.nix
index d646c1ed15f2..9be30fff5383 100644
--- a/pkgs/development/python-modules/msgpack-numpy/default.nix
+++ b/pkgs/development/python-modules/msgpack-numpy/default.nix
@@ -9,11 +9,11 @@
 
 buildPythonPackage rec {
   pname = "msgpack-numpy";
-  version = "0.4.5";
+  version = "0.4.6.post0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0z3ls52iamqv6fbn1ljnd5nnnzaiakczciry5c3vym5r77wgc9mg";
+    sha256 = "dfcb0c9cb5850e656344ac464a260e7b8b9b1c62d77c2e1d3d9ef15a88f1df6b";
   };
 
   buildInputs = [
diff --git a/pkgs/development/python-modules/multidict/default.nix b/pkgs/development/python-modules/multidict/default.nix
index 155395efa4ad..d818a63cd5d0 100644
--- a/pkgs/development/python-modules/multidict/default.nix
+++ b/pkgs/development/python-modules/multidict/default.nix
@@ -8,11 +8,11 @@
 
 buildPythonPackage rec {
   pname = "multidict";
-  version = "4.7.5";
+  version = "4.7.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "aee283c49601fa4c13adc64c09c978838a7e812f85377ae130a24d7198c0331e";
+    sha256 = "fbb77a75e529021e7c4a8d4e823d88ef4d23674a202be4f5addffc72cbb91430";
   };
 
   checkInputs = [ pytest pytestrunner pytestcov ];
diff --git a/pkgs/development/python-modules/nbformat/2.nix b/pkgs/development/python-modules/nbformat/2.nix
index faf2cee2b008..06d02520b20d 100644
--- a/pkgs/development/python-modules/nbformat/2.nix
+++ b/pkgs/development/python-modules/nbformat/2.nix
@@ -36,6 +36,6 @@ buildPythonPackage rec {
     description = "The Jupyter Notebook format";
     homepage = "https://jupyter.org/";
     license = lib.licenses.bsd3;
-    maintainers = with lib.maintainers; [ fridh globin ];
+    maintainers = with lib.maintainers; [ globin ];
   };
 }
diff --git a/pkgs/development/python-modules/notebook/2.nix b/pkgs/development/python-modules/notebook/2.nix
index 8b8cce2f8245..37f39c44967c 100644
--- a/pkgs/development/python-modules/notebook/2.nix
+++ b/pkgs/development/python-modules/notebook/2.nix
@@ -71,6 +71,6 @@ buildPythonPackage rec {
     description = "The Jupyter HTML notebook is a web-based notebook environment for interactive computing";
     homepage = "https://jupyter.org/";
     license = lib.licenses.bsd3;
-    maintainers = with lib.maintainers; [ fridh ];
+    maintainers = with lib.maintainers; [ ];
   };
 }
diff --git a/pkgs/development/python-modules/numpy/default.nix b/pkgs/development/python-modules/numpy/default.nix
index 62a871fda092..0c9bac973203 100644
--- a/pkgs/development/python-modules/numpy/default.nix
+++ b/pkgs/development/python-modules/numpy/default.nix
@@ -35,13 +35,13 @@ let
   };
 in buildPythonPackage rec {
   pname = "numpy";
-  version = "1.18.4";
+  version = "1.18.5";
   format = "pyproject.toml";
 
   src = fetchPypi {
     inherit pname version;
     extension = "zip";
-    sha256 = "bbcc85aaf4cd84ba057decaead058f43191cc0e30d6bc5d44fe336dc3d3f4509";
+    sha256 = "34e96e9dae65c4839bd80012023aadd6ee2ccb73ce7fdf3074c62f301e63120b";
   };
 
   nativeBuildInputs = [ gfortran pytest cython setuptoolsBuildHook ];
diff --git a/pkgs/development/python-modules/pandas/default.nix b/pkgs/development/python-modules/pandas/default.nix
index 0f4a35420865..5d7bb4a6d696 100644
--- a/pkgs/development/python-modules/pandas/default.nix
+++ b/pkgs/development/python-modules/pandas/default.nix
@@ -30,11 +30,11 @@ let
 
 in buildPythonPackage rec {
   pname = "pandas";
-  version = "1.0.3";
+  version = "1.0.4";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "11j5s6hz29yh3rwa2rjgric0knbhp9shphd4i7hx00xr5wr2xx1j";
+    sha256 = "b35d625282baa7b51e82e52622c300a1ca9f786711b2af7cbe64f1e6831f4126";
   };
 
   checkInputs = [ pytest glibcLocales moto hypothesis ];
diff --git a/pkgs/development/python-modules/phik/default.nix b/pkgs/development/python-modules/phik/default.nix
index e09182d5e714..ca1b5ba65da7 100644
--- a/pkgs/development/python-modules/phik/default.nix
+++ b/pkgs/development/python-modules/phik/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage rec {
   pname = "phik";
-  version = "0.9.11";
+  version = "0.9.12";
   format = "wheel";
   disabled = !isPy3k;
 
   src = fetchPypi {
     inherit pname version format;
     python = "py3";
-    sha256 = "b8c36dc50265d8c0626b34e3bc74cd0edd342d9d8ecc3d78c06817200bb31d10";
+    sha256 = "c4f86e5587e5b456e69bf69d95d07fe7aafc341c40f8f3a21dd5b52272e9ae7b";
   };
 
   checkInputs = [
diff --git a/pkgs/development/python-modules/phonenumbers/default.nix b/pkgs/development/python-modules/phonenumbers/default.nix
index e9f50420ca9e..2ba64faad31e 100644
--- a/pkgs/development/python-modules/phonenumbers/default.nix
+++ b/pkgs/development/python-modules/phonenumbers/default.nix
@@ -6,7 +6,7 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "09kww3fzn85gbj4lw8kqrppm9kq7nmy7b96p76sscamrpsdg31im";
+    sha256 = "3586f19abeb92aa6b539d7a4757cb507cf54efcd78224e895caf20fbdde07c26";
   };
 
   meta = {
diff --git a/pkgs/development/python-modules/pyenchant/default.nix b/pkgs/development/python-modules/pyenchant/default.nix
index 1d2686ec2992..1c82f7c9d630 100644
--- a/pkgs/development/python-modules/pyenchant/default.nix
+++ b/pkgs/development/python-modules/pyenchant/default.nix
@@ -7,12 +7,12 @@
 
 buildPythonPackage rec {
   pname = "pyenchant";
-  version = "3.1.0";
+  version = "3.1.1";
   disabled = isPy27;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "14is5p40f516plzccwg6yf51zkja38abw46kybzwgyy94phr8i9b";
+    sha256 = "ce0915d7acd771fde6e8c2dce8ad0cb0e6f7c4fa8430cc96e3e7134e99aeb12f";
   };
 
   propagatedBuildInputs = [ enchant2 ];
diff --git a/pkgs/development/python-modules/pyhomematic/default.nix b/pkgs/development/python-modules/pyhomematic/default.nix
index 5349ea994a44..14bf1cfe7be0 100644
--- a/pkgs/development/python-modules/pyhomematic/default.nix
+++ b/pkgs/development/python-modules/pyhomematic/default.nix
@@ -2,13 +2,13 @@
 
 buildPythonPackage rec {
   pname = "pyhomematic";
-  version = "0.1.66";
+  version = "0.1.67";
 
   disabled = !isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "f046db8406ee8a1aea6f6b05de8a133d3459b990c065c3f66446050e9aad5d79";
+    sha256 = "2d18e0059367e9e32d6472023322113fce431bcc72187b4a6eb7402fe5d2794b";
   };
 
   # PyPI tarball does not include tests/ directory
diff --git a/pkgs/development/python-modules/pysonos/default.nix b/pkgs/development/python-modules/pysonos/default.nix
index 67e8e5573d7f..427c42545c5a 100644
--- a/pkgs/development/python-modules/pysonos/default.nix
+++ b/pkgs/development/python-modules/pysonos/default.nix
@@ -13,13 +13,13 @@
 
 buildPythonPackage rec {
   pname = "pysonos";
-  version = "0.0.28";
+  version = "0.0.31";
 
   disabled = !isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "09852c0bfe07e3529f8665527381f586c7ea3beabcd7291311e679d56459069d";
+    sha256 = "03f21d2fb27cd938bd2c47f8582c0737eb7426a0cd59e5a60171fabe5e963e62";
   };
 
   propagatedBuildInputs = [ xmltodict requests ifaddr ];
diff --git a/pkgs/development/python-modules/pytest-flake8/default.nix b/pkgs/development/python-modules/pytest-flake8/default.nix
index af1cbb2add51..a5ed447aceac 100644
--- a/pkgs/development/python-modules/pytest-flake8/default.nix
+++ b/pkgs/development/python-modules/pytest-flake8/default.nix
@@ -2,7 +2,7 @@
 
 buildPythonPackage rec {
   pname = "pytest-flake8";
-  version = "1.0.5";
+  version = "1.0.6";
 
   # although pytest is a runtime dependency, do not add it as
   # propagatedBuildInputs in order to allow packages depend on another version
@@ -12,7 +12,7 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "d85efaafbdb9580791cfa8671799dd40d482fc30bd4476c1ca5efd661e751333";
+    sha256 = "1b82bb58c88eb1db40524018d3fcfd0424575029703b4e2d8e3ee873f2b17027";
   };
 
   checkPhase = ''
diff --git a/pkgs/development/python-modules/pytest/default.nix b/pkgs/development/python-modules/pytest/default.nix
index 9e0cd88cf0a4..daf43961ea67 100644
--- a/pkgs/development/python-modules/pytest/default.nix
+++ b/pkgs/development/python-modules/pytest/default.nix
@@ -19,7 +19,7 @@
 }:
 
 buildPythonPackage rec {
-  version = "5.4.2";
+  version = "5.4.3";
   pname = "pytest";
 
   disabled = !isPy3k;
@@ -31,7 +31,7 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "eb2b5e935f6a019317e455b6da83dd8650ac9ffd2ee73a7b657a30873d67a698";
+    sha256 = "7979331bfcba207414f5e1263b5a0f8f521d0f457318836a7355531ed1a4c7d8";
   };
 
   checkInputs = [ hypothesis pygments ];
diff --git a/pkgs/development/python-modules/python-miio/default.nix b/pkgs/development/python-modules/python-miio/default.nix
index 5b8c140df67e..a18645697089 100644
--- a/pkgs/development/python-modules/python-miio/default.nix
+++ b/pkgs/development/python-modules/python-miio/default.nix
@@ -15,11 +15,11 @@
 
 buildPythonPackage rec {
   pname = "python-miio";
-  version = "0.5.0.1";
+  version = "0.5.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "fa9c318256945ad4a8623fdf921ce81c466a7aea18b04a6711efb662f520b195";
+    sha256 = "8d23caf4906f2112dc88b9a6d5e1767877744cae016cd71c2bf75592a4be3b79";
   };
 
   checkInputs = [ pytest ];
diff --git a/pkgs/development/python-modules/pytrends/default.nix b/pkgs/development/python-modules/pytrends/default.nix
index db7f781c5bf4..0b0bad801e12 100644
--- a/pkgs/development/python-modules/pytrends/default.nix
+++ b/pkgs/development/python-modules/pytrends/default.nix
@@ -8,11 +8,11 @@
 
 buildPythonPackage rec {
   pname = "pytrends";
-  version = "4.7.2";
+  version = "4.7.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1cf80573276b3a93c4fb2ff296c260fa86e7ab43709473ce34f3bad3841f06df";
+    sha256 = "8ccb06c57c31fa157b978a0d810de7718ee46583d28cf818250d45f36abd2faa";
   };
 
   doCheck = false;
diff --git a/pkgs/development/python-modules/readthedocs-sphinx-ext/default.nix b/pkgs/development/python-modules/readthedocs-sphinx-ext/default.nix
index efadd4337126..68ccf676f292 100644
--- a/pkgs/development/python-modules/readthedocs-sphinx-ext/default.nix
+++ b/pkgs/development/python-modules/readthedocs-sphinx-ext/default.nix
@@ -9,11 +9,11 @@
 
 buildPythonPackage rec {
   pname = "readthedocs-sphinx-ext";
-  version = "1.0.3";
+  version = "1.0.4";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "faccf1c52aab34b1fdfd672ec4ce4321975453b05741e32a94b33cc682d045b2";
+    sha256 = "33dbb135373d539233f7fbdb5e8dcfa07d41254300ee23719eb9caa8c68a40ae";
   };
 
   propagatedBuildInputs = [ requests ];
diff --git a/pkgs/development/python-modules/restructuredtext_lint/default.nix b/pkgs/development/python-modules/restructuredtext_lint/default.nix
index 4f62d232ab5e..17bf5fbf2974 100644
--- a/pkgs/development/python-modules/restructuredtext_lint/default.nix
+++ b/pkgs/development/python-modules/restructuredtext_lint/default.nix
@@ -8,11 +8,11 @@
 
 buildPythonPackage rec {
   pname = "restructuredtext_lint";
-  version = "1.3.0";
+  version = "1.3.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "97b3da356d5b3a8514d8f1f9098febd8b41463bed6a1d9f126cf0a048b6fd908";
+    sha256 = "470e53b64817211a42805c3a104d2216f6f5834b22fe7adb637d1de4d6501fb8";
   };
 
   checkInputs = [ nose testtools ];
diff --git a/pkgs/development/python-modules/rethinkdb/default.nix b/pkgs/development/python-modules/rethinkdb/default.nix
index fc33d7206e76..f1239b75d481 100644
--- a/pkgs/development/python-modules/rethinkdb/default.nix
+++ b/pkgs/development/python-modules/rethinkdb/default.nix
@@ -5,11 +5,11 @@
 
 buildPythonPackage rec {
   pname = "rethinkdb";
-  version = "2.4.6";
+  version = "2.4.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "4eb4252b498af3f5d01e07d7870eb35f78b96bccc45812d313c14c5184789d74";
+    sha256 = "945b5efdc10f468fc056bd53a4e4224ec4c2fe1a7e83ae47443bbb6e7c7a1f7d";
   };
 
   doCheck = false;
diff --git a/pkgs/development/python-modules/snapcast/default.nix b/pkgs/development/python-modules/snapcast/default.nix
index 6e319a183418..93d7d1d9d9cf 100644
--- a/pkgs/development/python-modules/snapcast/default.nix
+++ b/pkgs/development/python-modules/snapcast/default.nix
@@ -3,13 +3,13 @@
 
 buildPythonPackage rec {
   pname = "snapcast";
-  version = "2.1.0";
+  version = "2.1.1";
 
   disabled = !isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1z3c9p22pm3823jzh917c3rryv02mhigrjkjf9wlhzmjwx5vmjqf";
+    sha256 = "c3ecd63d997fbcf6e5322dc47c1f02615f1d9611cba01ec18e9c9f8c14ed824b";
   };
 
   checkInputs = [ pytest ];
diff --git a/pkgs/development/python-modules/snowflake-connector-python/default.nix b/pkgs/development/python-modules/snowflake-connector-python/default.nix
index 0b14a97b647f..1d8389d80640 100644
--- a/pkgs/development/python-modules/snowflake-connector-python/default.nix
+++ b/pkgs/development/python-modules/snowflake-connector-python/default.nix
@@ -25,12 +25,12 @@
 
 buildPythonPackage rec {
   pname = "snowflake-connector-python";
-  version = "2.2.5";
+  version = "2.2.7";
   disabled = isPy27;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "2f720c4989b2ad92c1fc3c221f049102155f2d8006527daa15f2b54ecfdaf652";
+    sha256 = "84974778dd8d1efd4ff87d8404d71241f90e02044b1b94a52eea567080f93ac4";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/snscrape/default.nix b/pkgs/development/python-modules/snscrape/default.nix
index 9f0b805a19da..4370388959d0 100644
--- a/pkgs/development/python-modules/snscrape/default.nix
+++ b/pkgs/development/python-modules/snscrape/default.nix
@@ -11,13 +11,13 @@
 
 buildPythonPackage rec {
   pname = "snscrape";
-  version = "0.3.1";
+  version = "0.3.2";
 
   disabled = !isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "11jv5mv3l11qjlsjihd74gc1jafq0i7360cksqjkx1wv2hcc32rf";
+    sha256 = "ea038827afe439577eb109ebd1b5c481d516d489c624fc3fe6e92ec71ef42be9";
   };
 
   # There are no tests; make sure the executable works.
diff --git a/pkgs/development/python-modules/soupsieve/default.nix b/pkgs/development/python-modules/soupsieve/default.nix
index b8cdd63cbde5..bb5ecbc839c2 100644
--- a/pkgs/development/python-modules/soupsieve/default.nix
+++ b/pkgs/development/python-modules/soupsieve/default.nix
@@ -9,11 +9,11 @@
 
 buildPythonPackage rec {
   pname = "soupsieve";
-  version = "1.9.5";
+  version = "1.9.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "e2c1c5dee4a1c36bcb790e0fabd5492d874b8ebd4617622c4f6a731701060dda";
+    sha256 = "7985bacc98c34923a439967c1a602dc4f1e15f923b6fcf02344184f86cc7efaa";
   };
 
   checkPhase = ''
diff --git a/pkgs/development/python-modules/sphinxcontrib-katex/default.nix b/pkgs/development/python-modules/sphinxcontrib-katex/default.nix
index d3c9fe152806..95bd4b592010 100644
--- a/pkgs/development/python-modules/sphinxcontrib-katex/default.nix
+++ b/pkgs/development/python-modules/sphinxcontrib-katex/default.nix
@@ -2,7 +2,7 @@
 
 buildPythonPackage rec {
   pname = "sphinxcontrib-katex";
-  version = "0.6.0";
+  version = "0.6.1";
 
   # pkgutil namespaces are broken in nixpkgs (because they can't scan multiple
   # directories). But python2 is EOL, so not supporting it should be ok.
@@ -10,7 +10,7 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1692q3f3z1rsd3nyxd8wrv0vscwcq2gqjbv79c8ws402y3m7y5ni";
+    sha256 = "88320b2780f350d67f84a5424973ce24aee65701e8e163a7f5856c5df3353188";
   };
 
   propagatedBuildInputs = [ sphinx ];
diff --git a/pkgs/development/python-modules/sqlalchemy/default.nix b/pkgs/development/python-modules/sqlalchemy/default.nix
index 9be357fbed33..cd2b00021e7b 100644
--- a/pkgs/development/python-modules/sqlalchemy/default.nix
+++ b/pkgs/development/python-modules/sqlalchemy/default.nix
@@ -6,11 +6,11 @@
 
 buildPythonPackage rec {
   pname = "SQLAlchemy";
-  version = "1.3.16";
+  version = "1.3.17";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0w1xfy7j1h0dyfwk6zc6lfbv2m77lmxk7g17sbgpi08bq0kf293j";
+    sha256 = "156a27548ba4e1fed944ff9fcdc150633e61d350d673ae7baaf6c25c04ac1f71";
   };
 
   checkInputs = [
diff --git a/pkgs/development/python-modules/sqlmap/default.nix b/pkgs/development/python-modules/sqlmap/default.nix
index bc94ad50861a..81aede240eeb 100644
--- a/pkgs/development/python-modules/sqlmap/default.nix
+++ b/pkgs/development/python-modules/sqlmap/default.nix
@@ -7,11 +7,11 @@
 
 buildPythonPackage rec {
   pname = "sqlmap";
-  version = "1.4.5";
+  version = "1.4.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1ec0d320aca95be3ba53d1af0faefc047864dfe6328622ae10e33a6ed9446ca8";
+    sha256 = "0da3a6700a370fcd671265502c7c4aca39a1d055de9a1dcc8b9b751c9ad3efa8";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/stytra/default.nix b/pkgs/development/python-modules/stytra/default.nix
index 970fe5a19878..8ca61b3b29ca 100644
--- a/pkgs/development/python-modules/stytra/default.nix
+++ b/pkgs/development/python-modules/stytra/default.nix
@@ -30,12 +30,12 @@
 
 buildPythonPackage rec {
   pname = "stytra";
-  version = "0.8.27";
+  version = "0.8.33";
   disabled = !isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "8fc1ca5f75f47ec1eeb3d62722437bed4ddf598e130b3dd22f0e663f61857df5";
+    sha256 = "b0aacc8e2c1bba33c337ebc76c0d8f2971c113d298aea2a375d84a5eeff5d83e";
   };
   doCheck = false;
   checkInputs = [
diff --git a/pkgs/development/python-modules/toml/default.nix b/pkgs/development/python-modules/toml/default.nix
index 29d0a4c692f3..8e96efcdf444 100644
--- a/pkgs/development/python-modules/toml/default.nix
+++ b/pkgs/development/python-modules/toml/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "toml";
-  version = "0.10.0";
+  version = "0.10.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0p1xww2mzkhqvxkfvmfzm58bbfj812zhdz4rwdjiv94ifz2q37r2";
+    sha256 = "926b612be1e5ce0634a2ca03470f95169cf16f939018233a670519cb4ac58b0f";
   };
 
   # This package has a test script (built for Travis) that involves a)
diff --git a/pkgs/development/python-modules/tqdm/default.nix b/pkgs/development/python-modules/tqdm/default.nix
index af72dc6b8a5f..138c24ebbe3c 100644
--- a/pkgs/development/python-modules/tqdm/default.nix
+++ b/pkgs/development/python-modules/tqdm/default.nix
@@ -9,11 +9,11 @@
 
 buildPythonPackage rec {
   pname = "tqdm";
-  version = "4.46.0";
+  version = "4.46.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "4733c4a10d0f2a4d098d801464bdaf5240c7dadd2a7fde4ee93b0a0efd9fb25e";
+    sha256 = "cd140979c2bebd2311dfb14781d8f19bd5a9debb92dcab9f6ef899c987fcf71f";
   };
 
   checkInputs = [ nose coverage glibcLocales flake8 ];
diff --git a/pkgs/development/python-modules/trimesh/default.nix b/pkgs/development/python-modules/trimesh/default.nix
index be135f651213..c6d1ba00a850 100644
--- a/pkgs/development/python-modules/trimesh/default.nix
+++ b/pkgs/development/python-modules/trimesh/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "trimesh";
-  version = "3.6.38";
+  version = "3.6.43";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0rdffk6a1jlfanb4i0prvy68qya8waa390yyw2kix4ja8fk7y6sx";
+    sha256 = "f62dbaf4739858148fe4889f3b4dff93da281982b6592f211c4d33c2e00678eb";
   };
 
   propagatedBuildInputs = [ numpy ];
diff --git a/pkgs/development/python-modules/txdbus/default.nix b/pkgs/development/python-modules/txdbus/default.nix
index 0fbe4900f9e5..8ef694d34ff2 100644
--- a/pkgs/development/python-modules/txdbus/default.nix
+++ b/pkgs/development/python-modules/txdbus/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "txdbus";
-  version = "1.1.0";
+  version = "1.1.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0z41n1ikpdvk0nm8dbyh6g9bg781q4j6hg2b09b5k4wdqm17zxbg";
+    sha256 = "eefcffa4efbf82ba11222f17f5989fe1b2b6ef57226ef896c4a7084c990ba217";
   };
 
   propagatedBuildInputs = [ six twisted ];
diff --git a/pkgs/development/python-modules/uproot/default.nix b/pkgs/development/python-modules/uproot/default.nix
index 55c215ac75a3..3d472a604d64 100644
--- a/pkgs/development/python-modules/uproot/default.nix
+++ b/pkgs/development/python-modules/uproot/default.nix
@@ -16,11 +16,11 @@
 
 buildPythonPackage rec {
   pname = "uproot";
-  version = "3.11.5";
+  version = "3.11.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "05bb55d0576813bb7bf252654cf854fcbabe34e30eb99beb70eff6abc4d3f121";
+    sha256 = "3fbf9dfe5ce996ffda3a49d16eba804b95fb05bc041fc4e7bc05317a03bf6cba";
   };
 
   nativeBuildInputs = [ pytestrunner ];
diff --git a/pkgs/development/python-modules/vertica-python/default.nix b/pkgs/development/python-modules/vertica-python/default.nix
index cfbfcde6fd50..8beb39b26d9e 100644
--- a/pkgs/development/python-modules/vertica-python/default.nix
+++ b/pkgs/development/python-modules/vertica-python/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "vertica-python";
-  version = "0.10.3";
+  version = "0.10.4";
   
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0de23c0a09f0d849db626569207d52d324ffd51c69b4f7f3650f167c3c2c9de9";
+    sha256 = "570525d0371806993874bd2ee0f47cc5d68994abb5aa382e964e53e0b81160b2";
   };
   
   propagatedBuildInputs = [ future dateutil six ];
diff --git a/pkgs/development/python-modules/zeroc-ice/default.nix b/pkgs/development/python-modules/zeroc-ice/default.nix
index ccc34b42afb4..16bf5b7855c5 100644
--- a/pkgs/development/python-modules/zeroc-ice/default.nix
+++ b/pkgs/development/python-modules/zeroc-ice/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "zeroc-ice";
-  version = "3.7.3";
+  version = "3.7.4";
 
   src = fetchPypi {
     inherit version pname;
-    sha256 = "1adec3b54c77c46acfc8a99d6336ce9a0223a7016852666358133cbe37d99744";
+    sha256 = "dc79a1eaad1d1cd1cf8cfe636e1bc413c60645e3e87a5a8e9b97ce882690e0e4";
   };
 
   buildInputs = [ openssl bzip2 ];
diff --git a/pkgs/development/python-modules/zeroconf/default.nix b/pkgs/development/python-modules/zeroconf/default.nix
index d293ae449c1d..e9d3c6e038ea 100644
--- a/pkgs/development/python-modules/zeroconf/default.nix
+++ b/pkgs/development/python-modules/zeroconf/default.nix
@@ -10,12 +10,12 @@
 
 buildPythonPackage rec {
   pname = "zeroconf";
-  version = "0.26.1";
+  version = "0.26.3";
   disabled = isPy27;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "09rvliph7phvgzwmmdv1kwcp3andpiiqfpkrwq1vkxvwqa3mgwji";
+    sha256 = "43ad5006c00be2040cdca1fe768206f4a25356d3cc87eff8b66bd7ead2a82440";
   };
 
   propagatedBuildInputs = [ ifaddr ]
diff --git a/pkgs/development/python-modules/zope_interface/default.nix b/pkgs/development/python-modules/zope_interface/default.nix
index 9214c0badf0a..5e7086191cce 100644
--- a/pkgs/development/python-modules/zope_interface/default.nix
+++ b/pkgs/development/python-modules/zope_interface/default.nix
@@ -6,15 +6,17 @@
 
 buildPythonPackage rec {
   pname = "zope.interface";
-  version = "4.7.2";
-  
+  version = "5.1.0";
+
   src = fetchPypi {
     inherit pname version;
-    sha256 = "fd1101bd3fcb4f4cf3485bb20d6cb0b56909b94d3bd2a53a6cb9d381c3da3365";
+    sha256 = "03nrl6b8cb600dnnh46y149awvrm0gxyqgwq5hdw3lvys8mw9r20";
   };
 
   propagatedBuildInputs = [ zope_event ];
 
+  doCheck = false; # Circular deps.
+
   meta = with stdenv.lib; {
     description = "Zope.Interface";
     homepage = "http://zope.org/Products/ZopeInterface";
diff --git a/pkgs/development/python-modules/zstd/default.nix b/pkgs/development/python-modules/zstd/default.nix
index c96e08ccb513..8f61f2ffc66e 100644
--- a/pkgs/development/python-modules/zstd/default.nix
+++ b/pkgs/development/python-modules/zstd/default.nix
@@ -3,11 +3,11 @@
 
 buildPythonPackage rec {
   pname = "zstd";
-  version = "1.4.4.0";
+  version = "1.4.5.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "33f2c1fd8d3f9ac8e35fb3e199896afc54cceb68878570c6d4b72985dc6584a5";
+    sha256 = "2a1806d625bd2d8944ead4b3018fc6444a31467fa09935e9c1d4296275f024c6";
   };
 
   postPatch = ''
diff --git a/pkgs/development/tools/misc/autogen/default.nix b/pkgs/development/tools/misc/autogen/default.nix
index 65c4f3174051..2911855e7023 100644
--- a/pkgs/development/tools/misc/autogen/default.nix
+++ b/pkgs/development/tools/misc/autogen/default.nix
@@ -1,34 +1,39 @@
-{ stdenv, buildPackages, fetchurl, which, pkgconfig, perl, guile, libxml2 }:
+{ stdenv, buildPackages, fetchurl, autoreconfHook, which, pkgconfig, perl, guile, libxml2 }:
 
 stdenv.mkDerivation rec {
   pname = "autogen";
-  version = "5.18.12";
+  version = "5.18.16";
 
   src = fetchurl {
     url = "mirror://gnu/autogen/rel${version}/autogen-${version}.tar.xz";
-    sha256 = "1n5zq4872sakvz9c7ncsdcfp0z8rsybsxvbmhkpbd19ii0pacfxy";
+    sha256 = "16mlbdys8q4ckxlvxyhwkdnh1ay9f6g0cyp1kylkpalgnik398gq";
   };
 
+  patches = let
+    dp = { ver ? "1%255.18.16-4", pname, name ? (pname + ".diff"), sha256 }: fetchurl {
+      url = "https://salsa.debian.org/debian/autogen/-/raw/debian/${ver}"
+          + "/debian/patches/${pname}.diff?inline=false";
+      inherit name sha256;
+    };
+  in [
+    (dp {
+      pname = "20_no_Werror";
+      sha256 = "08z4s2ifiqyaacjpd9pzr59w8m4j3548kkaq1bwvp2gjn29m680x";
+    })
+    (dp {
+      pname = "30_ag_macros.m4_syntax_error";
+      sha256 = "1z8vmbwbkz3505wd33i2xx91mlf8rwsa7klndq37nw821skxwyh3";
+    })
+    (dp {
+      pname = "31_allow_overriding_AGexe_for_crossbuild";
+      sha256 = "0h9wkc9bqb509knh8mymi43hg6n6sxg2lixvjlchcx7z0j7p8xkf";
+    })
+  ];
+
   outputs = [ "bin" "dev" "lib" "out" "man" "info" ];
 
-  patches = [
-    # Temporary, so builds with a prefixed pkg-config (like cross builds) work.
-    #
-    # https://savannah.gnu.org/support/?109050 was supposed to fix this, but
-    # the generated configure script mysteriously still contained hard-coded
-    # pkg-config. I tried regenerating it, but that didn't help. Only
-    # https://git.savannah.gnu.org/cgit/autogen.git/commit/?h=5cbe233387d7f7b36752736338d1cd4f71287daa,
-    # in the next release, finally fixes this, by getting rid of some
-    # metaprogramming of the autoconf m4 metaprogram! There evidentally was
-    # some sort escaping error such that the `PKG_CONFIG` check got evaluated
-    # before `configure` was generated.
-    #
-    # Remove this when the version is bumped
-    ./pkg-config-use-var.patch
-  ];
-
   nativeBuildInputs = [
-    which pkgconfig perl
+    which pkgconfig perl autoreconfHook/*patches applied*/ 
   ] ++ stdenv.lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
     # autogen needs a build autogen when cross-compiling
     buildPackages.buildPackages.autogen buildPackages.texinfo
@@ -45,13 +50,7 @@ stdenv.mkDerivation rec {
     #"MAKEINFO=${buildPackages.texinfo}/bin/makeinfo"
   ];
 
-  postPatch = ''
-    # Fix a broken sed expression used for detecting the minor
-    # version of guile we are using
-    sed -i "s,sed '.*-I.*',sed 's/\\\(^\\\| \\\)-I/\\\1/g',g" configure
-
-    substituteInPlace pkg/libopts/mklibsrc.sh --replace /tmp $TMPDIR
-  '';
+  #doCheck = true; # not reliable
 
   postInstall = ''
     mkdir -p $dev/bin
@@ -62,9 +61,13 @@ stdenv.mkDerivation rec {
       sed -e "s|$bin/bin|/no-such-autogen-bin-path|" -i $f
       sed -e "s|$lib/lib|/no-such-autogen-lib-path|" -i $f
     done
-  '';
 
-  #doCheck = true; # 2 tests fail because of missing /dev/tty
+    # remove /build/** from RPATHs
+    for f in "$bin"/bin/*; do
+      local nrp="$(patchelf --print-rpath "$f" | sed -E 's@(:|^)/build/[^:]*:@\1@g')"
+      patchelf --set-rpath "$nrp" "$f"
+    done
+  '';
 
   meta = with stdenv.lib; {
     description = "Automated text and program generation tool";
diff --git a/pkgs/development/tools/misc/autogen/pkg-config-use-var.patch b/pkgs/development/tools/misc/autogen/pkg-config-use-var.patch
deleted file mode 100644
index 69476f62c6db..000000000000
--- a/pkgs/development/tools/misc/autogen/pkg-config-use-var.patch
+++ /dev/null
@@ -1,13 +0,0 @@
-diff --git a/configure b/configure
-index c3f761d1c3f..14b101f67c1
---- a/configure
-+++ b/configure
-@@ -16683,7 +16683,7 @@ fi
- 
- 
- 
--  ag_gv=`gdir=\`pkg-config --cflags-only-I \
-+  ag_gv=`gdir=\`${PKG_CONFIG} --cflags-only-I \
-   guile-${GUILE_EFFECTIVE_VERSION} | \
-   sed 's/\(^\| \)-I/\1/g'\`
-   for d in $gdir
diff --git a/pkgs/development/tools/misc/gdb/default.nix b/pkgs/development/tools/misc/gdb/default.nix
index f6a001e488c3..7702df423bb5 100644
--- a/pkgs/development/tools/misc/gdb/default.nix
+++ b/pkgs/development/tools/misc/gdb/default.nix
@@ -18,7 +18,7 @@
 
 let
   basename = "gdb-${version}";
-  version = "9.1";
+  version = "9.2";
 in
 
 assert pythonSupport -> python3 != null;
@@ -31,7 +31,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://gnu/gdb/${basename}.tar.xz";
-    sha256 = "0dqp1p7w836iwijg1zb4a784n0j4pyjiw5v6h8fg5lpx6b40x7k9";
+    sha256 = "0mf5fn8v937qwnal4ykn3ji1y2sxk0fa1yfqi679hxmpg6pdf31n";
   };
 
   postPatch = if stdenv.isDarwin then ''
diff --git a/pkgs/development/tools/misc/libtool/libtool2.nix b/pkgs/development/tools/misc/libtool/libtool2.nix
index 4bf637c0eba8..fbe49dc68b2a 100644
--- a/pkgs/development/tools/misc/libtool/libtool2.nix
+++ b/pkgs/development/tools/misc/libtool/libtool2.nix
@@ -26,10 +26,6 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  # Don't run the native `strip' when cross-compiling.  This breaks at least
-  # with `.a' files for MinGW.
-  dontStrip = stdenv.hostPlatform != stdenv.buildPlatform;
-
   meta = with stdenv.lib; {
     description = "GNU Libtool, a generic library support script";
     longDescription = ''
diff --git a/pkgs/development/tools/rust/rust-analyzer/generic.nix b/pkgs/development/tools/rust/rust-analyzer/generic.nix
index de755ec17ff5..ae6ad80cdd9a 100644
--- a/pkgs/development/tools/rust/rust-analyzer/generic.nix
+++ b/pkgs/development/tools/rust/rust-analyzer/generic.nix
@@ -15,9 +15,7 @@ rustPlatform.buildRustPackage {
     inherit rev sha256;
   };
 
-  preBuild = "pushd crates/rust-analyzer";
-  # Do not checking other crates in checkPhase.
-  preInstall = "popd";
+  buildAndTestSubdir = "crates/rust-analyzer";
 
   cargoBuildFlags = lib.optional useJemalloc "--features=jemalloc";
 
diff --git a/pkgs/misc/ghostscript/0001-Bug-702364-Fix-missing-echogs-dependencies.patch b/pkgs/misc/ghostscript/0001-Bug-702364-Fix-missing-echogs-dependencies.patch
index c914634f579c..dd31260302c6 100644
--- a/pkgs/misc/ghostscript/0001-Bug-702364-Fix-missing-echogs-dependencies.patch
+++ b/pkgs/misc/ghostscript/0001-Bug-702364-Fix-missing-echogs-dependencies.patch
@@ -1,18 +1,5 @@
-From 9f56e78d111d726ca95a59b2d64e5c3298451505 Mon Sep 17 00:00:00 2001
-From: Chris Liddell <chris.liddell@artifex.com>
-Date: Mon, 27 Apr 2020 11:04:57 +0100
-Subject: [PATCH] Bug 702364: Fix missing echogs dependencies
-
-Rebased version of http://git.ghostscript.com/?p=ghostpdl.git;a=patch;h=1b4c3669a20c
-to fix parallel build
----
- contrib/contrib.mak | 281 ++++++++++++++++++++++----------------------
- 1 file changed, 143 insertions(+), 138 deletions(-)
-
-diff --git a/contrib/contrib.mak b/contrib/contrib.mak
-index 5411ae902..7dd9822a9 100644
---- a/contrib/contrib.mak
-+++ b/contrib/contrib.mak
+--- a/contrib/contrib.mak	2020-03-19 09:21:42.000000000 +0100
++++ b/contrib/contrib.mak	2020-05-14 13:41:03.202258445 +0200
 @@ -22,6 +22,10 @@
  CONTRIB_MAK=$(CONTRIBDIR)$(D)contrib.mak $(TOP_MAKEFILES)
  CONTRIBSRC=$(CONTRIBDIR)$(D)
@@ -24,7 +11,7 @@ index 5411ae902..7dd9822a9 100644
  ###### --------------------------- Catalog -------------------------- ######
  
  # The following drivers are user-contributed, and maintained (if at all) by
-@@ -161,19 +165,19 @@ $(DEVOBJ)gdevbjca.$(OBJ) : $(CONTRIBSRC)gdevbjca.c $(PDEVH) $(bjc_h) \
+@@ -185,19 +189,19 @@
  	$(DEVCC) $(DEVO_)gdevbjca.$(OBJ) $(C_) $(CONTRIBSRC)gdevbjca.c
  
  $(DD)bjcmono.dev : $(bjc_) $(DD)page.dev \
@@ -48,7 +35,7 @@ index 5411ae902..7dd9822a9 100644
  	$(SETPDEV) $(DD)bjccolor $(bjc_)
  
  
-@@ -184,25 +188,25 @@ cdeskjet8_=$(DEVOBJ)gdevcd8.$(OBJ) $(HPPCL)
+@@ -208,25 +212,25 @@
  # Author: Uli Wortmann (uliw@erdw.ethz.ch), Martin Gerbershagen (ger@ulm.temic.de)
  # Printer: HP 670
  $(DD)cdj670.dev : $(cdeskjet8_) $(DD)page.dev \
@@ -78,7 +65,7 @@ index 5411ae902..7dd9822a9 100644
  	$(SETPDEV2) $(DD)cdj1600 $(cdeskjet8_)
  
  $(DEVOBJ)gdevcd8.$(OBJ) : $(CONTRIBSRC)gdevcd8.c $(PDEVH) $(math__h)\
-@@ -220,7 +224,8 @@ $(DEVOBJ)gdevcd8.$(OBJ) : $(CONTRIBSRC)gdevcd8.c $(PDEVH) $(math__h)\
+@@ -244,7 +248,8 @@
  
  # Author: Matthew Gelhaus (mgelhaus@proaxis.com)
  # Printer: HP 880c
@@ -88,7 +75,7 @@ index 5411ae902..7dd9822a9 100644
  	$(SETPDEV2) $(DD)cdj880 $(cdeskjet8_)
  
  
-@@ -231,7 +236,7 @@ cdeskjet9_=$(DEVOBJ)gdevdj9.$(OBJ) $(HPPCL)
+@@ -255,7 +260,7 @@
  # Author: Rene Harsch (rene@harsch.net)
  # Printer: HP 970Cxi
  $(DD)cdj970.dev : $(cdeskjet9_) $(DD)page.dev \
@@ -97,7 +84,7 @@ index 5411ae902..7dd9822a9 100644
  	$(SETPDEV2) $(DD)cdj970 $(cdeskjet9_)
  
  $(DEVOBJ)gdevdj9.$(OBJ) : $(CONTRIBSRC)gdevdj9.c $(PDEVH) $(math__h) $(string__h)\
-@@ -244,7 +249,7 @@ $(DEVOBJ)gdevdj9.$(OBJ) : $(CONTRIBSRC)gdevdj9.c $(PDEVH) $(math__h) $(string__h
+@@ -268,7 +273,7 @@
  ### NOTE:  Same as chp2200 (some PJL and CRD changes).
  
  $(DD)cdnj500.dev : $(cdeskjet8_) $(DD)page.dev \
@@ -106,7 +93,7 @@ index 5411ae902..7dd9822a9 100644
  	$(SETPDEV2) $(DD)cdnj500 $(cdeskjet8_)
  
  
-@@ -253,7 +258,7 @@ $(DD)cdnj500.dev : $(cdeskjet8_) $(DD)page.dev \
+@@ -277,7 +282,7 @@
  ### NOTE:  Depends on the presence of the cdj850 section.
  
  $(DD)chp2200.dev : $(cdeskjet8_) $(DD)page.dev \
@@ -115,7 +102,7 @@ index 5411ae902..7dd9822a9 100644
  	$(SETPDEV2) $(DD)chp2200 $(cdeskjet8_)
  
  
-@@ -264,11 +269,11 @@ $(DD)chp2200.dev : $(cdeskjet8_) $(DD)page.dev \
+@@ -288,11 +293,11 @@
  GDIMONO=$(DEVOBJ)gdevgdi.$(OBJ) $(HPPCL)
  
  $(DD)gdi.dev : $(GDIMONO) $(DD)page.dev \
@@ -129,7 +116,7 @@ index 5411ae902..7dd9822a9 100644
  	$(SETPDEV) $(DD)samsunggdi $(GDIMONO)
  
  $(DEVOBJ)gdevgdi.$(OBJ) : $(CONTRIBSRC)gdevgdi.c $(PDEVH) $(gdevpcl_h) \
-@@ -282,17 +287,17 @@ $(DEVOBJ)gdevgdi.$(OBJ) : $(CONTRIBSRC)gdevgdi.c $(PDEVH) $(gdevpcl_h) \
+@@ -306,17 +311,17 @@
  
  hl1250_=$(DEVOBJ)gdevhl12.$(OBJ) $(HPDLJM)
  $(DD)hl1250.dev : $(hl1250_) $(DD)page.dev \
@@ -150,7 +137,7 @@ index 5411ae902..7dd9822a9 100644
  	$(DEVCC) $(DEVO_)gdevhl12.$(OBJ) $(C_) $(CONTRIBSRC)gdevhl12.c
  
  
-@@ -303,37 +308,37 @@ ln03_=$(DEVOBJ)gdevln03.$(OBJ)
+@@ -327,37 +332,37 @@
  # Author: Ulrich Mueller (ulm@vsnhd1.cern.ch)
  # Printer: DEC LN03
  $(DD)ln03.dev : $(ln03_) $(DD)page.dev \
@@ -194,7 +181,7 @@ index 5411ae902..7dd9822a9 100644
  	$(SETPDEV) $(DD)la75plus $(ln03_)
  
  $(DEVOBJ)gdevln03.$(OBJ) : $(CONTRIBSRC)gdevln03.c $(PDEVH) \
-@@ -356,27 +361,27 @@ $(DEVOBJ)gdevescv.$(OBJ) : $(ESCV_SRC)gdevescv.c $(ESCV_SRC)gdevescv.h $(PDEVH)
+@@ -380,233 +385,233 @@
  	$(DEVCC) -DA4 $(DEVO_)gdevescv.$(OBJ) $(C_) $(escv_opts) $(ESCV_SRC)gdevescv.c
  
  $(DD)alc1900.dev : $(escv_) $(DD)page.dev \
@@ -228,7 +215,8 @@ index 5411ae902..7dd9822a9 100644
  	$(SETPDEV) $(DD)alc8600 $(escv_)
  
  $(DD)alc9100.dev : $(escv_) $(DD)page.dev \
-@@ -384,11 +389,11 @@ $(DD)alc9100.dev : $(escv_) $(DD)page.dev \
+-                           $(CONTRIB_MAK) $(MAKEDIRS)
++                           $(CONTDEV) $(CONTRIB_MAK) $(MAKEDIRS)
  	$(SETPDEV) $(DD)alc9100 $(escv_)
  
  $(DD)lp3000c.dev : $(escv_) $(DD)page.dev \
@@ -242,7 +230,8 @@ index 5411ae902..7dd9822a9 100644
  	$(SETPDEV) $(DD)lp8000c $(escv_)
  
  $(DD)lp8200c.dev : $(escv_) $(DD)page.dev \
-@@ -396,15 +401,15 @@ $(DD)lp8200c.dev : $(escv_) $(DD)page.dev \
+-                           $(CONTRIB_MAK) $(MAKEDIRS)
++                           $(CONTDEV) $(CONTRIB_MAK) $(MAKEDIRS)
  	$(SETPDEV) $(DD)lp8200c $(escv_)
  
  $(DD)lp8300c.dev : $(escv_) $(DD)page.dev \
@@ -261,7 +250,8 @@ index 5411ae902..7dd9822a9 100644
  	$(SETPDEV) $(DD)lp8800c $(escv_)
  
  $(DD)lp9000c.dev : $(escv_) $(DD)page.dev \
-@@ -412,177 +417,177 @@ $(DD)lp9000c.dev : $(escv_) $(DD)page.dev \
+-                           $(CONTRIB_MAK) $(MAKEDIRS)
++                           $(CONTDEV) $(CONTRIB_MAK) $(MAKEDIRS)
  	$(SETPDEV) $(DD)lp9000c $(escv_)
  
  $(DD)lp9200c.dev : $(escv_) $(DD)page.dev \
@@ -481,7 +471,7 @@ index 5411ae902..7dd9822a9 100644
  	$(SETPDEV) $(DD)lex2050 $(lex2050_)
  
  $(DEVOBJ)gdevlx7.$(OBJ) : $(CONTRIBSRC)gdevlx7.c $(PDEVH) \
-@@ -599,7 +604,7 @@ $(DEVOBJ)gdevlx32.$(OBJ) : $(CONTRIBSRC)gdevlx32.c $(PDEVH) $(gsparam_h) \
+@@ -623,7 +628,7 @@
  	$(DEVCC) $(DEVO_)gdevlx32.$(OBJ) $(C_) $(CONTRIBSRC)gdevlx32.c
  
  $(DD)lxm3200.dev : $(lxm3200_) $(DD)page.dev \
@@ -490,7 +480,7 @@ index 5411ae902..7dd9822a9 100644
  	$(SETPDEV) $(DD)lxm3200 $(lxm3200_)
  
  
-@@ -625,13 +630,13 @@ $(DEVOBJ)gdevlips.$(OBJ) : $(GX) $(LIPS_SRC)gdevlips.c $(std_h) \
+@@ -649,13 +654,13 @@
  	$(DEVCC) $(DEVO_)gdevlips.$(OBJ) $(LIPS_OPT) $(C_) $(LIPS_SRC)gdevlips.c
  
  $(DD)lips4.dev : $(lipsr_) $(DD)page.dev \
@@ -506,7 +496,7 @@ index 5411ae902..7dd9822a9 100644
  	$(SETDEV) $(DD)lips4v $(lipsv_)
  	$(ADDMOD) $(DD)lips4v -include $(GLD)vector
  
-@@ -644,11 +649,11 @@ $(DEVOBJ)gdevl4v.$(OBJ) : $(LIPS_SRC)gdevl4v.c $(LIPS_SRC)gdevlips.h $(GDEV)\
+@@ -668,11 +673,11 @@
  ### --------------- Some extra devices: lips2p, bjc880j ---------------- ###
  
  $(DD)lips2p.dev : $(lipsr_) $(DD)page.dev \
@@ -520,7 +510,7 @@ index 5411ae902..7dd9822a9 100644
  	$(SETPDEV) $(DD)bjc880j $(lipsr_)
  
  
-@@ -657,15 +662,15 @@ $(DD)bjc880j.dev : $(lipsr_) $(DD)page.dev \
+@@ -681,15 +686,15 @@
  md2k_=$(DEVOBJ)gdevmd2k.$(OBJ)
  
  $(DD)md2k.dev : $(md2k_) $(DD)page.dev \
@@ -539,7 +529,7 @@ index 5411ae902..7dd9822a9 100644
  	$(DEVCC) $(DEVO_)gdevmd2k.$(OBJ) $(C_) $(CONTRIBSRC)gdevmd2k.c
   
  
-@@ -673,7 +678,7 @@ $(DEVOBJ)gdevmd2k.$(OBJ) : $(CONTRIBSRC)gdevmd2k.c $(PDEVH) $(gsparam_h) \
+@@ -697,7 +702,7 @@
  
  oki4w_=$(DEVOBJ)gdevop4w.$(OBJ)
  $(DD)oki4w.dev : $(oki4w_) $(DD)page.dev \
@@ -548,7 +538,7 @@ index 5411ae902..7dd9822a9 100644
  	$(SETPDEV) $(DD)oki4w $(oki4w_)
  
  # Author: Ivan Schreter (ivan@shadow.sk)
-@@ -696,11 +701,11 @@ $(DEVOBJ)gdevopvp.$(OBJ) : $(OPVP_SRC)gdevopvp.c $(OPVP_SRC)opvp_common.h\
+@@ -720,11 +725,11 @@
  	$(DEVCC) $(DEVO_)gdevopvp.$(OBJ) $(OPVP_OPT) $(C_) $(OPVP_SRC)gdevopvp.c
  
  $(DD)opvp.dev : $(opvp_) $(DD)page.dev \
@@ -562,7 +552,7 @@ index 5411ae902..7dd9822a9 100644
  	$(SETPDEV) $(DD)oprp $(opvp_)
  
  
-@@ -877,78 +882,78 @@ $(DEVOBJ)pclcomp.$(OBJ) : $(pcl3_src)pclcomp.c $(pcl3_src)pclgen.h \
+@@ -901,78 +906,78 @@
  
  # The generic pcl3 device with selectable subdevices
  $(DD)pcl3.dev : $(pcl3_) $(DD)page.dev \
@@ -665,7 +655,7 @@ index 5411ae902..7dd9822a9 100644
  	$(SETPDEV) $(DD)hpdj1120c $(pcl3_)
  
  #------------------------------------------------------------------------------
-@@ -985,7 +990,7 @@ pcl3-install:
+@@ -1009,7 +1014,7 @@
  
  xes_=$(DEVOBJ)gdevxes.$(OBJ)
  $(DD)xes.dev : $(xes_) $(DD)page.dev \
@@ -674,7 +664,7 @@ index 5411ae902..7dd9822a9 100644
  	$(SETPDEV) $(DD)xes $(xes_)
  
  # Author: Peter Flass (flass@lbdrscs.bitnet)
-@@ -1005,16 +1010,16 @@ JAPSRC=$(JAPDIR)$(D)
+@@ -1029,16 +1034,16 @@
  
  pr201_=$(DEVOBJ)gdevp201.$(OBJ) $(DEVOBJ)gdevprn.$(OBJ)
  
@@ -695,7 +685,7 @@ index 5411ae902..7dd9822a9 100644
  	$(SETPDEV) $(DD)pr1000_4 $(pr201_)
  
  $(DEVOBJ)gdevp201.$(OBJ) : $(JAPSRC)gdevp201.c $(PDEVH) \
-@@ -1025,7 +1030,7 @@ $(DEVOBJ)gdevp201.$(OBJ) : $(JAPSRC)gdevp201.c $(PDEVH) \
+@@ -1049,7 +1054,7 @@
  
  jj100_=$(DEVOBJ)gdevj100.$(OBJ) $(DEVOBJ)gdevprn.$(OBJ)
  
@@ -704,7 +694,7 @@ index 5411ae902..7dd9822a9 100644
  	$(SETPDEV) $(DD)jj100 $(jj100_)
  
  $(DEVOBJ)gdevj100.$(OBJ) : $(JAPSRC)gdevj100.c $(PDEVH) \
-@@ -1037,11 +1042,11 @@ $(DEVOBJ)gdevj100.$(OBJ) : $(JAPSRC)gdevj100.c $(PDEVH) \
+@@ -1061,11 +1066,11 @@
  bj10v_=$(DEVOBJ)gdev10v.$(OBJ) $(DEVOBJ)gdevprn.$(OBJ)
  
  $(DD)bj10v.dev : $(bj10v_) \
@@ -718,7 +708,7 @@ index 5411ae902..7dd9822a9 100644
  	$(SETPDEV) $(DD)bj10vh $(bj10v_)
  
  # Uncomment the following line if you are using MS-DOS on PC9801 series.
-@@ -1056,7 +1061,7 @@ $(DEVOBJ)gdev10v.$(OBJ) : $(JAPSRC)gdev10v.c $(PDEVH) \
+@@ -1080,7 +1085,7 @@
  dmprt_=$(DEVOBJ)gdevdmpr.$(OBJ) $(DEVOBJ)dviprlib.$(OBJ) $(DEVOBJ)gdevprn.$(OBJ)
  
  $(DD)dmprt.dev : $(dmprt_) $(DD)page.dev \
@@ -727,7 +717,7 @@ index 5411ae902..7dd9822a9 100644
  	$(SETDEV) $(DD)dmprt $(dmprt_)
  	$(ADDMOD) $(DD)dmprt -ps dmp_init
  
-@@ -1086,19 +1091,19 @@ $(DEVOBJ)gdevmjc.$(OBJ) : $(JAPSRC)gdevmjc.c $(JAPSRC)gdevmjc.h $(PDEVH) $(gdevp
+@@ -1110,19 +1115,19 @@
  	$(DEVCC) -DA4 $(DEVO_)gdevmjc.$(OBJ) $(C_) $(JAPSRC)gdevmjc.c
  
  $(DD)mj700v2c.dev : $(mj700v2c_) $(DD)page.dev \
@@ -751,7 +741,7 @@ index 5411ae902..7dd9822a9 100644
  	$(SETPDEV) $(DD)mj8000c $(mj700v2c_)
  
  ### ----------------- The Fujitsu FMPR printer device ----------------- ###
-@@ -1106,7 +1111,7 @@ $(DD)mj8000c.dev : $(mj700v2c_) $(DD)page.dev \
+@@ -1130,7 +1135,7 @@
  fmpr_=$(DEVOBJ)gdevfmpr.$(OBJ) $(DEVOBJ)gdevprn.$(OBJ)
  
  $(DD)fmpr.dev : $(fmpr_) $(DD)page.dev \
@@ -760,7 +750,7 @@ index 5411ae902..7dd9822a9 100644
  	$(SETPDEV) $(DD)fmpr $(fmpr_)
  
  $(DEVOBJ)gdevfmpr.$(OBJ) : $(JAPSRC)gdevfmpr.c $(PDEVH) \
-@@ -1118,7 +1123,7 @@ $(DEVOBJ)gdevfmpr.$(OBJ) : $(JAPSRC)gdevfmpr.c $(PDEVH) \
+@@ -1142,7 +1147,7 @@
  fmlbp_=$(DEVOBJ)gdevfmlbp.$(OBJ) $(DEVOBJ)gdevprn.$(OBJ)
  
  $(DD)fmlbp.dev : $(fmlbp_) $(DD)page.dev \
@@ -769,7 +759,7 @@ index 5411ae902..7dd9822a9 100644
  	$(SETPDEV) $(DD)fmlbp $(fmlbp_)
  
  $(DEVOBJ)gdevfmlbp.$(OBJ) : $(JAPSRC)gdevfmlbp.c $(PDEVH) \
-@@ -1135,7 +1140,7 @@ $(DEVOBJ)gdevfmlbp.$(OBJ) : $(JAPSRC)gdevfmlbp.c $(PDEVH) \
+@@ -1159,7 +1164,7 @@
  ml6_=$(DEVOBJ)gdevml6.$(OBJ) $(DEVOBJ)gdevprn.$(OBJ)
  
  $(DD)ml600.dev : $(ml6_) $(DD)page.dev \
@@ -778,7 +768,7 @@ index 5411ae902..7dd9822a9 100644
  	$(SETPDEV) $(DD)ml600 $(ml6_)
  
  $(DEVOBJ)gdevml6.$(OBJ) : $(JAPSRC)gdevml6.c $(PDEVH) \
-@@ -1148,11 +1153,11 @@ $(DEVOBJ)gdevml6.$(OBJ) : $(JAPSRC)gdevml6.c $(PDEVH) \
+@@ -1172,11 +1177,11 @@
  lbp3x0_=$(DEVOBJ)gdevlbp3.$(OBJ)
  
  $(DD)lbp310.dev :$(lbp3x0_) $(DD)page.dev \
@@ -792,7 +782,7 @@ index 5411ae902..7dd9822a9 100644
  	$(SETPDEV) $(DD)lbp320 $(lbp3x0_)
  
  $(DEVOBJ)gdevlbp3.$(OBJ) : $(JAPSRC)gdevlbp3.c $(PDEVH)
-@@ -1167,7 +1172,7 @@ $(DEVOBJ)gdevnpdl.$(OBJ) : $(JAPSRC)gdevnpdl.c $(LIPS_SRC)gdevlprn.h $(PDEVH) \
+@@ -1191,7 +1196,7 @@
  	$(DEVCC) -DA4 $(DEVO_)gdevnpdl.$(OBJ) $(LIPS_OPT) $(C_) $(JAPSRC)gdevnpdl.c
  
  $(DD)npdl.dev : $(npdl_) $(DD)page.dev \
@@ -801,7 +791,7 @@ index 5411ae902..7dd9822a9 100644
  	$(SETPDEV) $(DD)npdl $(npdl_)
  
  ### ------- EPSON ESC/Page printer device ----------------- ###
-@@ -1179,11 +1184,11 @@ $(DEVOBJ)gdevespg.$(OBJ) : $(JAPSRC)gdevespg.c $(LIPS_SRC)gdevlprn.h $(PDEVH) \
+@@ -1203,11 +1208,11 @@
  	$(DEVCC) -DA4 $(DEVO_)gdevespg.$(OBJ) $(LIPS_OPT) $(C_) $(JAPSRC)gdevespg.c
  
  $(DD)escpage.dev : $(escpage_) $(DD)page.dev \
@@ -815,7 +805,7 @@ index 5411ae902..7dd9822a9 100644
  	$(SETPDEV) $(DD)lp2000 $(escpage_)
  
  ### --- The RICOH RPDL language printer device ------ ###
-@@ -1194,7 +1199,7 @@ $(DEVOBJ)gdevrpdl.$(OBJ) : $(JAPSRC)gdevrpdl.c $(LIPS_SRC)gdevlprn.h $(PDEVH) \
+@@ -1218,7 +1223,7 @@
  	$(DEVCC) $(DEVO_)gdevrpdl.$(OBJ) $(LIPS_OPT) $(C_) $(JAPSRC)gdevrpdl.c
  
  $(DD)rpdl.dev : $(rpdl_) $(DD)page.dev \
@@ -824,21 +814,7 @@ index 5411ae902..7dd9822a9 100644
  	$(SETPDEV) $(DD)rpdl $(rpdl_)
  
  ### ---------- RICOH RPDL IV(600dpi) printer devices ---------- ###
-@@ -1204,11 +1209,11 @@ $(DD)rpdl.dev : $(rpdl_) $(DD)page.dev \
- #	$(DEVCC) $(DEVO_)gdevrpdl.$(OBJ) $(C_) $(JAPSRC)gdevrpdl.c
- #
- #$(DD)nx100f.dev : $(rpdl_) $(DD)page.dev \
--                           $(CONTRIB_MAK) $(MAKEDIRS)
-+                           $(CONTDEV) $(CONTRIB_MAK) $(MAKEDIRS)
- #	$(SETPDEV2) $(DD)nx100f $(rpdl_)
- #
- #$(DD)nx100v.dev : $(rpdl_) $(DD)page.dev \
--                           $(CONTRIB_MAK) $(MAKEDIRS)
-+                           $(CONTDEV) $(CONTRIB_MAK) $(MAKEDIRS)
- #	$(SETPDEV2) $(DD)nx100v $(rpdl_)
- 
- ### ------------ The ALPS Micro Dry printer devices ------------ ###
-@@ -1216,15 +1221,15 @@ $(DD)rpdl.dev : $(rpdl_) $(DD)page.dev \
+@@ -1240,15 +1245,15 @@
  alps_=$(DEVOBJ)gdevalps.$(OBJ)
  
  $(DD)md50Mono.dev : $(alps_) $(DD)page.dev \
@@ -857,6 +833,3 @@ index 5411ae902..7dd9822a9 100644
  	$(SETPDEV) $(DD)md1xMono $(alps_)
  
  $(DEVOBJ)gdevalps.$(OBJ) : $(JAPSRC)gdevalps.c $(PDEVH) \
--- 
-2.26.2
-
diff --git a/pkgs/misc/ghostscript/default.nix b/pkgs/misc/ghostscript/default.nix
index 7f6766cf4624..a10595591875 100644
--- a/pkgs/misc/ghostscript/default.nix
+++ b/pkgs/misc/ghostscript/default.nix
@@ -10,8 +10,8 @@ assert cupsSupport -> cups != null;
 
 let
   version = "9.${ver_min}";
-  ver_min = "50";
-  sha512 = "3p46kzn6kh7z4qqnqydmmvdlgzy5730z3yyvyxv6i4yb22mgihzrwqmhmvfn3b7lypwf6fdkkndarzv7ly3zndqpyvg89x436sms7iw";
+  ver_min = "52";
+  sha512 = "1ksm3v4nw8acc4j817n44l1c65ijk0mr3mp4kryy17jz41bmzzql5d8vr40h59n9dmf8b2wmnbq45bj3an1zrpfagavlf0i9s436jjc";
 
   fonts = stdenv.mkDerivation {
     name = "ghostscript-fonts";
@@ -47,11 +47,6 @@ stdenv.mkDerivation rec {
   patches = [
     ./urw-font-files.patch
     ./doc-no-ref.diff
-    (fetchpatch {
-      name = "CVE-2019-14869.patch";
-      url = "https://git.ghostscript.com/?p=ghostpdl.git;a=patch;h=485904772c5f0aa1140032746e5a0abfc40f4cef";
-      sha256 = "0z5gnvgpp0dlzgvpw9a1yan7qyycv3mf88l93fvb1kyay893rshp";
-    })
     # rebased version of upstream http://git.ghostscript.com/?p=ghostpdl.git;a=patch;h=1b4c3669a20c,
     # Remove on update to version > 9.52
     ./0001-Bug-702364-Fix-missing-echogs-dependencies.patch
diff --git a/pkgs/os-specific/linux/iproute/default.nix b/pkgs/os-specific/linux/iproute/default.nix
index 46312a637dab..3ac79464ac4b 100644
--- a/pkgs/os-specific/linux/iproute/default.nix
+++ b/pkgs/os-specific/linux/iproute/default.nix
@@ -5,11 +5,11 @@
 
 stdenv.mkDerivation rec {
   pname = "iproute2";
-  version = "5.6.0";
+  version = "5.7.0";
 
   src = fetchurl {
     url = "mirror://kernel/linux/utils/net/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "14j6n1bc09xhq8lxs40vfsx8bb8lx12a07ga4rsxl8vfrqjhwnqv";
+    sha256 = "088gs56iqhdlpw1iqjwrss4zxd4zbl2wl8s2implrrdajjxcfpbj";
   };
 
   preConfigure = ''
diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix
index 06ed2cf15598..433c27d4113e 100644
--- a/pkgs/os-specific/linux/kernel/common-config.nix
+++ b/pkgs/os-specific/linux/kernel/common-config.nix
@@ -727,6 +727,7 @@ let
       PSI = whenAtLeast "4.20" yes;
 
       MODVERSIONS        = whenOlder "4.9" yes;
+      MOUSE_ELAN_I2C_SMBUS = yes;
       MOUSE_PS2_ELANTECH = yes; # Elantech PS/2 protocol extension
       MTRR_SANITIZER     = yes;
       NET_FC             = yes; # Fibre Channel driver support
diff --git a/pkgs/os-specific/linux/systemd/0005-Add-some-NixOS-specific-unit-directories.patch b/pkgs/os-specific/linux/systemd/0005-Add-some-NixOS-specific-unit-directories.patch
index 23aa893362b5..a9b60cbb2e20 100644
--- a/pkgs/os-specific/linux/systemd/0005-Add-some-NixOS-specific-unit-directories.patch
+++ b/pkgs/os-specific/linux/systemd/0005-Add-some-NixOS-specific-unit-directories.patch
@@ -24,8 +24,8 @@ index 8331832c7a..bedb97115d 100644
  systemduserconfdir=${sysconfdir}/systemd/user
 -systemdsystemunitpath=${systemdsystemconfdir}:/etc/systemd/system:/run/systemd/system:/usr/local/lib/systemd/system:${systemdsystemunitdir}:/usr/lib/systemd/system:/lib/systemd/system
 -systemduserunitpath=${systemduserconfdir}:/etc/systemd/user:/run/systemd/user:/usr/local/lib/systemd/user:/usr/local/share/systemd/user:${systemduserunitdir}:/usr/lib/systemd/user:/usr/share/systemd/user
-+systemdsystemunitpath=${systemdsystemconfdir}:/etc/systemd/system:/etc/systemd-mutable/system:/nix/var/nix/profiles/default/lib/systemd/user:/run/systemd/system:${systemdsystemunitdir}
-+systemduserunitpath=${systemduserconfdir}:/etc/systemd/user:/etc/systemd-mutable/user:/nix/var/nix/profiles/default/lib/systemd/system:/run/systemd/user:${systemduserunitdir}
++systemdsystemunitpath=${systemdsystemconfdir}:/etc/systemd/system:/etc/systemd-mutable/system:/nix/var/nix/profiles/default/lib/systemd/system:/run/systemd/system:${systemdsystemunitdir}
++systemduserunitpath=${systemduserconfdir}:/etc/systemd/user:/etc/systemd-mutable/user:/nix/var/nix/profiles/default/lib/systemd/user:/run/systemd/user:${systemduserunitdir}
  systemdsystemgeneratordir=${rootprefix}/lib/systemd/system-generators
  systemdusergeneratordir=${prefix}/lib/systemd/user-generators
  systemdsystemgeneratorpath=/run/systemd/system-generators:/etc/systemd/system-generators:/usr/local/lib/systemd/system-generators:${systemdsystemgeneratordir}
diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index 722b4db9a80a..3235fb3b95cd 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -66,9 +66,6 @@ in stdenv.mkDerivation {
 
   postPatch = ''
     substituteInPlace src/basic/path-util.h --replace "@defaultPathNormal@" "${placeholder "out"}/bin/"
-  ''
-    # TODO: unconditionalize on the next rebuild
-  + stdenv.lib.optionalString (stdenv.hostPlatform != stdenv.buildPlatform) ''
     substituteInPlace src/boot/efi/meson.build \
       --replace \
       "find_program('ld'" \
diff --git a/pkgs/servers/mail/mailman/default.nix b/pkgs/servers/mail/mailman/default.nix
index 8443a1968fdf..37b4d29eeb16 100644
--- a/pkgs/servers/mail/mailman/default.nix
+++ b/pkgs/servers/mail/mailman/default.nix
@@ -6,12 +6,12 @@
 
 buildPythonPackage rec {
   pname = "mailman";
-  version = "3.3.0";
+  version = "3.3.1";
   disabled = !isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1qph9i93ndahfxi3bb2sd0kjm2c0pkh844ai6zacfmvihl1k3pvy";
+    sha256 = "0idfiv48jjgc0jq4731094ddhraqq8bxnwmjk6sg5ask0jss9kxq";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/servers/mail/mailman/hyperkitty.nix b/pkgs/servers/mail/mailman/hyperkitty.nix
index 57c1b355bf26..5ed5b74d309a 100644
--- a/pkgs/servers/mail/mailman/hyperkitty.nix
+++ b/pkgs/servers/mail/mailman/hyperkitty.nix
@@ -7,12 +7,12 @@
 
 buildPythonPackage rec {
   pname = "HyperKitty";
-  version = "1.3.2";
+  version = "1.3.3";
   disabled = !isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "092fkv0xyf5vgj33xwq0mh9h5c5d56ifwimaqbfpx5cwc6yivb88";
+    sha256 = "0p85r9q6mn5as5b39xp9hkkipnk0156acx540n2ygk3qb3jd4a5n";
   };
 
   nativeBuildInputs = [ isort ];
diff --git a/pkgs/servers/mail/mailman/postorius.nix b/pkgs/servers/mail/mailman/postorius.nix
index 5f542b9036ea..ae797fa6cbc7 100644
--- a/pkgs/servers/mail/mailman/postorius.nix
+++ b/pkgs/servers/mail/mailman/postorius.nix
@@ -4,11 +4,11 @@
 
 buildPythonPackage rec {
   pname = "postorius";
-  version = "1.3.2";
+  version = "1.3.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0wrm0hda7ym9qaygxirqaaii66ndmgyy7gx8wqdg07pfx14zcyja";
+    sha256 = "08jn23gblbkfl09qlykbpsmp39mmach3sl69h1j5cd5kkx839rwa";
   };
 
   propagatedBuildInputs = [ django-mailman3 readme_renderer ];
diff --git a/pkgs/servers/sql/postgresql/default.nix b/pkgs/servers/sql/postgresql/default.nix
index 8ba7e9c96cfc..2b440f78e99d 100644
--- a/pkgs/servers/sql/postgresql/default.nix
+++ b/pkgs/servers/sql/postgresql/default.nix
@@ -182,41 +182,41 @@ let
 in self: {
 
   postgresql_9_5 = self.callPackage generic {
-    version = "9.5.21";
+    version = "9.5.22";
     psqlSchema = "9.5";
-    sha256 = "0b3kzc0431bvp55jns42q9h1119gy075mp4aywnkq93pm17nxdby";
+    sha256 = "03v4d4nr9f86y0i1j5jmvfan5w8y4ga1mar59lhcnj3jl5q58ma8";
     this = self.postgresql_9_5;
     inherit self;
   };
 
   postgresql_9_6 = self.callPackage generic {
-    version = "9.6.17";
+    version = "9.6.18";
     psqlSchema = "9.6";
-    sha256 = "1hm0w6n988n9qn2wylhjq02i5ayzb16rzhgkcv09fpsl68ny7qgn";
+    sha256 = "16crr2a1sl97aiacqzd0bk56yl1abq6blc0c6qpx5rl5ny1c4zji";
     this = self.postgresql_9_6;
     inherit self;
   };
 
   postgresql_10 = self.callPackage generic {
-    version = "10.12";
+    version = "10.13";
     psqlSchema = "10.0"; # should be 10, but changing it is invasive
-    sha256 = "1rsab4zf4rx7pvvhlwhb04kb95aiad9cwazc4ksbvg2gij47z3rq";
+    sha256 = "1qal0yp7a90yzya7hl56gsmw5fvacplrdhpn7h9gnbyr1i2iyw2d";
     this = self.postgresql_10;
     inherit self;
   };
 
   postgresql_11 = self.callPackage generic {
-    version = "11.7";
+    version = "11.8";
     psqlSchema = "11.1"; # should be 11, but changing it is invasive
-    sha256 = "04x343i4v0w4jf1v5ial8rwsizs1qhdjfbanbnibdys6i0xfjjij";
+    sha256 = "1qksqyayxmnccmbapg3ajsw9pjgqva0inxjhx64rqd6ckhrg9wpa";
     this = self.postgresql_11;
     inherit self;
   };
 
   postgresql_12 = self.callPackage generic {
-    version = "12.2";
+    version = "12.3";
     psqlSchema = "12";
-    sha256 = "1pmmd59pvfs50gsi728bw9f1jl59xghsjdanfimph0659x6cq7dd";
+    sha256 = "0hfg3n7rlz96579cj3z1dh2idl15rh3wfvn8jl31jj4h2yk69vcl";
     this = self.postgresql_12;
     inherit self;
   };
diff --git a/pkgs/tools/compression/zstd/default.nix b/pkgs/tools/compression/zstd/default.nix
index eb42fdbaff4f..f919fb92ed1d 100644
--- a/pkgs/tools/compression/zstd/default.nix
+++ b/pkgs/tools/compression/zstd/default.nix
@@ -51,14 +51,16 @@ stdenv.mkDerivation rec {
   preInstall = ''
     substituteInPlace ../programs/zstdgrep \
       --replace ":-grep" ":-${gnugrep}/bin/grep" \
-      --replace ":-zstdcat" ":-$out/bin/zstdcat"
+      --replace ":-zstdcat" ":-$bin/bin/zstdcat"
 
     substituteInPlace ../programs/zstdless \
-      --replace "zstdcat" "$out/bin/zstdcat"
+      --replace "zstdcat" "$bin/bin/zstdcat"
   '';
   # Don't duplicate the library code in runtime closures.
   postInstall = stdenv.lib.optionalString enableShared ''rm "$out"/lib/libzstd.a'';
 
+  outputs = [ "bin" "dev" "man" "out" ];
+
   meta = with stdenv.lib; {
     description = "Zstandard real-time compression algorithm";
     longDescription = ''
diff --git a/pkgs/tools/filesystems/btrfs-progs/default.nix b/pkgs/tools/filesystems/btrfs-progs/default.nix
index 5c73ee945c79..5a6dafae2980 100644
--- a/pkgs/tools/filesystems/btrfs-progs/default.nix
+++ b/pkgs/tools/filesystems/btrfs-progs/default.nix
@@ -4,11 +4,11 @@
 
 stdenv.mkDerivation rec {
   pname = "btrfs-progs";
-  version = "5.6";
+  version = "5.6.1";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/people/kdave/btrfs-progs/btrfs-progs-v${version}.tar.xz";
-    sha256 = "0srg276yccfmqz0skmmga3vbqx4wiqsk1l6h86n6ryhxa9viqcm1";
+    sha256 = "1nwnvjdnr9fjj2q2p2vpjabfdhcrwykgj9knjcsqy0c7p1bgbk2h";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/misc/fontforge/default.nix b/pkgs/tools/misc/fontforge/default.nix
index 67ab7b2d6917..82fd5c8210dd 100644
--- a/pkgs/tools/misc/fontforge/default.nix
+++ b/pkgs/tools/misc/fontforge/default.nix
@@ -1,21 +1,24 @@
 { stdenv, fetchurl, lib
-, autoconf, automake, gnum4, libtool, perl, uthash, pkgconfig, gettext
+, cmake, perl, uthash, pkgconfig, gettext
 , python, freetype, zlib, glib, libungif, libpng, libjpeg, libtiff, libxml2, cairo, pango
 , readline, woff2, zeromq, libuninameslist
 , withSpiro ? false, libspiro
-, withGTK ? false, gtk2
+, withGTK ? false, gtk3
+, withGUI ? withGTK
 , withPython ? true
 , withExtras ? true
 , Carbon ? null, Cocoa ? null
 }:
 
+assert withGTK -> withGUI;
+
 stdenv.mkDerivation rec {
   pname = "fontforge";
-  version = "20190801";
+  version = "20200314";
 
   src = fetchurl {
-    url = "https://github.com/${pname}/${pname}/releases/download/${version}/${pname}-${version}.tar.gz";
-    sha256 = "0lh8yx01asbzxm6car5cfi64njh5p4lxc7iv8dldr5rwg357a86r";
+    url = "https://github.com/${pname}/${pname}/releases/download/${version}/${pname}-${version}.tar.xz";
+    sha256 = "0qf88wd6riycq56d24brybyc93ns74s0nyyavm43zp2kfcihn6fd";
   };
 
   # use $SOURCE_DATE_EPOCH instead of non-deterministic timestamps
@@ -30,41 +33,33 @@ stdenv.mkDerivation rec {
   # do not use x87's 80-bit arithmetic, rouding errors result in very different font binaries
   NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isi686 "-msse2 -mfpmath=sse";
 
-  nativeBuildInputs = [ pkgconfig autoconf automake gnum4 libtool perl gettext ];
+  nativeBuildInputs = [ pkgconfig cmake ];
   buildInputs = [
     readline uthash woff2 zeromq libuninameslist
     python freetype zlib glib libungif libpng libjpeg libtiff libxml2
   ]
     ++ lib.optionals withSpiro [libspiro]
-    ++ lib.optionals withGTK [ gtk2 cairo pango ]
+    ++ lib.optionals withGUI [ gtk3 cairo pango ]
     ++ lib.optionals stdenv.isDarwin [ Carbon Cocoa ];
 
-    configureFlags = [ "--enable-woff2" ]
-    ++ lib.optionals (!withPython) [ "--disable-python-scripting" "--disable-python-extension" ]
-    ++ lib.optional withGTK "--enable-gtk2-use"
-    ++ lib.optional (!withGTK) "--without-x"
-    ++ lib.optional withExtras "--enable-fontforge-extras";
+  cmakeFlags = [ "-DCMAKE_BUILD_WITH_INSTALL_RPATH=ON" ]
+    ++ lib.optional (!withSpiro) "-DENABLE_LIBSPIRO=OFF"
+    ++ lib.optional (!withGUI) "-DENABLE_GUI=OFF"
+    ++ lib.optional (!withGTK) "-DENABLE_X11=ON"
+    ++ lib.optional withExtras "-DENABLE_FONTFORGE_EXTRAS=ON";
 
   # work-around: git isn't really used, but configuration fails without it
   preConfigure = ''
     # The way $version propagates to $version of .pe-scripts (https://github.com/dejavu-fonts/dejavu-fonts/blob/358190f/scripts/generate.pe#L19)
     export SOURCE_DATE_EPOCH=$(date -d ${version} +%s)
-
-    export GIT="$(type -P true)"
-    ./bootstrap --skip-git --force
   '';
 
-  doCheck = false; # tries to wget some fonts
-  doInstallCheck = doCheck;
-
   postInstall =
     # get rid of the runtime dependency on python
     lib.optionalString (!withPython) ''
       rm -r "$out/share/fontforge/python"
     '';
 
-  enableParallelBuilding = true;
-
   meta = {
     description = "A font editor";
     homepage = "http://fontforge.github.io";
diff --git a/pkgs/tools/package-management/cargo-deb/default.nix b/pkgs/tools/package-management/cargo-deb/default.nix
index c6e8b4803ccf..96ef0eef8c5a 100644
--- a/pkgs/tools/package-management/cargo-deb/default.nix
+++ b/pkgs/tools/package-management/cargo-deb/default.nix
@@ -2,7 +2,9 @@
 , lib
 , fetchFromGitHub
 , rustPlatform
-, Security }:
+, rust
+, Security
+}:
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-deb";
@@ -19,6 +21,13 @@ rustPlatform.buildRustPackage rec {
 
   cargoSha256 = "1vqnnqn6rzkdi239bh3lk7gaxr7w6v3c4ws4ya1ah04g6v9hkzlw";
 
+  checkType = "debug";
+
+  preCheck = ''
+    substituteInPlace tests/command.rs \
+      --replace 'target/debug' "target/${rust.toRustTarget stdenv.buildPlatform}/debug"
+  '';
+
   meta = with lib; {
     description = "Generate Debian packages from information in Cargo.toml";
     homepage = "https://github.com/mmstick/cargo-deb";
diff --git a/pkgs/tools/security/ripasso/cursive.nix b/pkgs/tools/security/ripasso/cursive.nix
index c8a55d3f397f..29229bff0028 100644
--- a/pkgs/tools/security/ripasso/cursive.nix
+++ b/pkgs/tools/security/ripasso/cursive.nix
@@ -12,6 +12,8 @@ buildRustPackage rec {
     sha256 = "164da20j727p8l7hh37j2r8pai9sj402nhswvg0nrlgj53nr6083";
   };
 
+  patches = [ ./fix-tests.patch ];
+
   cargoSha256 = "1wpn67v0xmxhn1dgzhh1pwz1yc3cizmfxhpb7qv9b27ynx4486ji";
 
   cargoBuildFlags = [ "-p ripasso-cursive -p ripasso-man" ];
diff --git a/pkgs/tools/security/ripasso/fix-tests.patch b/pkgs/tools/security/ripasso/fix-tests.patch
new file mode 100644
index 000000000000..433ff933b1f7
--- /dev/null
+++ b/pkgs/tools/security/ripasso/fix-tests.patch
@@ -0,0 +1,35 @@
+diff --git a/src/pass/test.rs b/src/pass/test.rs
+index c980a2f..2e6c8cc 100644
+--- a/src/pass/test.rs
++++ b/src/pass/test.rs
+@@ -56,6 +56,7 @@ fn populate_password_list_small_repo() {
+     base_path.pop();
+     base_path.pop();
+     base_path.pop();
++    base_path.pop();
+     base_path.push("testres");
+ 
+     let mut password_dir: PathBuf = base_path.clone();
+@@ -84,6 +85,7 @@ fn populate_password_list_repo_with_deleted_files() {
+     base_path.pop();
+     base_path.pop();
+     base_path.pop();
++    base_path.pop();
+     base_path.push("testres");
+ 
+     let mut password_dir: PathBuf = base_path.clone();
+@@ -112,6 +114,7 @@ fn populate_password_list_directory_without_git() {
+     base_path.pop();
+     base_path.pop();
+     base_path.pop();
++    base_path.pop();
+     base_path.push("testres");
+ 
+     let mut password_dir: PathBuf = base_path.clone();
+@@ -149,4 +152,4 @@ fn parse_signing_keys_empty() {
+     let result = PasswordStore::parse_signing_keys(&None).unwrap();
+ 
+     assert_eq!(result.len(), 0);
+-}
+\ No newline at end of file
++}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 040dac2cec0f..306f08406261 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -624,7 +624,7 @@ in
 
   airfield = callPackage ../tools/networking/airfield { };
 
-  apache-airflow = with python3.pkgs; toPythonApplication apache-airflow;
+  apache-airflow = with python37.pkgs; toPythonApplication apache-airflow;
 
   airsonic = callPackage ../servers/misc/airsonic { };
 
@@ -777,7 +777,7 @@ in
 
   iamy = callPackage ../tools/admin/iamy { };
 
-  azure-cli = callPackage ../tools/admin/azure-cli { python = python3; };
+  azure-cli = callPackage ../tools/admin/azure-cli { python = python37; };
 
   azure-storage-azcopy = callPackage ../development/tools/azcopy { };
 
@@ -1133,9 +1133,7 @@ in
 
   atftp = callPackage ../tools/networking/atftp { };
 
-  autogen = callPackage ../development/tools/misc/autogen {
-    guile = guile_2_0;
-  };
+  autogen = callPackage ../development/tools/misc/autogen { };
 
   autojump = callPackage ../tools/misc/autojump { };
 
@@ -3527,7 +3525,7 @@ in
   fontforge-gtk = fontforge.override {
     withSpiro = true;
     withGTK = true;
-    gtk2 = gtk2-x11;
+    gtk3 = gtk3-x11;
     inherit (darwin.apple_sdk.frameworks) Carbon Cocoa;
   };
 
@@ -7908,7 +7906,11 @@ in
 
   zssh = callPackage ../tools/networking/zssh { };
 
-  zstd = callPackage ../tools/compression/zstd { };
+  zstd = callPackage ../tools/compression/zstd {
+    cmake = cmake.override {
+      libarchive = libarchive.override { zstd = null; };
+    };
+  };
 
   zsync = callPackage ../tools/compression/zsync { };
 
@@ -9650,7 +9652,7 @@ in
   # When switching these sets, please update docs at ../../doc/languages-frameworks/python.md
   python = python2;
   python2 = python27;
-  python3 = python37;
+  python3 = python38;
   pypy = pypy2;
   pypy2 = pypy27;
   pypy3 = pypy36;
@@ -11133,7 +11135,9 @@ in
 
   vultr-cli = callPackage ../development/tools/vultr-cli { };
 
-  vulnix = callPackage ../tools/security/vulnix { };
+  vulnix = callPackage ../tools/security/vulnix {
+    python3Packages = python37Packages;
+  };
 
   vtable-dumper = callPackage ../development/tools/misc/vtable-dumper { };
 
@@ -15738,7 +15742,9 @@ in
 
   hiawatha = callPackage ../servers/http/hiawatha {};
 
-  home-assistant = callPackage ../servers/home-assistant { };
+  home-assistant = callPackage ../servers/home-assistant { 
+    python3 = python37;
+  };
 
   home-assistant-cli = callPackage ../servers/home-assistant/cli.nix { };