diff --git a/nixos/modules/programs/ssh.nix b/nixos/modules/programs/ssh.nix
index 18b183eca9e2..733b8f7636fd 100644
--- a/nixos/modules/programs/ssh.nix
+++ b/nixos/modules/programs/ssh.nix
@@ -235,6 +235,7 @@ in
     systemd.user.services.ssh-agent = mkIf cfg.startAgent
       { description = "SSH Agent";
         wantedBy = [ "default.target" ];
+        unitConfig.ConditionUser = "!@system";
         serviceConfig =
           { ExecStartPre = "${pkgs.coreutils}/bin/rm -f %t/ssh-agent";
             ExecStart =
diff --git a/nixos/modules/services/network-filesystems/kbfs.nix b/nixos/modules/services/network-filesystems/kbfs.nix
index 7b2eea3b5850..263b70d04a56 100644
--- a/nixos/modules/services/network-filesystems/kbfs.nix
+++ b/nixos/modules/services/network-filesystems/kbfs.nix
@@ -48,6 +48,7 @@ in {
       requires = [ "keybase.service" ];
       after = [ "keybase.service" ];
       path = [ "/run/wrappers" ];
+      unitConfig.ConditionUser = "!@system";
       serviceConfig = {
         ExecStartPre = "${pkgs.coreutils}/bin/mkdir -p ${cfg.mountPoint}";
         ExecStart = "${pkgs.kbfs}/bin/kbfsfuse ${toString cfg.extraFlags} ${cfg.mountPoint}";
diff --git a/nixos/modules/services/networking/keybase.nix b/nixos/modules/services/networking/keybase.nix
index a149f16a84cb..85f52be8a6ac 100644
--- a/nixos/modules/services/networking/keybase.nix
+++ b/nixos/modules/services/networking/keybase.nix
@@ -26,6 +26,7 @@ in {
 
     systemd.user.services.keybase = {
       description = "Keybase service";
+      unitConfig.ConditionUser = "!@system";
       serviceConfig = {
         ExecStart = ''
           ${pkgs.keybase}/bin/keybase service --auto-forked
diff --git a/pkgs/applications/networking/browsers/chromium/common.nix b/pkgs/applications/networking/browsers/chromium/common.nix
index ea0e01843404..3e63389be02d 100644
--- a/pkgs/applications/networking/browsers/chromium/common.nix
+++ b/pkgs/applications/networking/browsers/chromium/common.nix
@@ -67,7 +67,8 @@ let
     in attrs: concatStringsSep " " (attrValues (mapAttrs toFlag attrs));
 
   gnSystemLibraries = [
-    "flac" "libwebp" "libxslt" "yasm" "opus" "snappy" "libpng" "zlib"
+    "flac" "libwebp" "libxslt" "yasm" "opus" "snappy" "libpng"
+    # "zlib" # version 77 reports unresolved dependency on //third_party/zlib:zlib_config
     # "libjpeg" # fails with multiple undefined references to chromium_jpeg_*
     # "re2" # fails with linker errors
     # "ffmpeg" # https://crbug.com/731766
diff --git a/pkgs/applications/networking/browsers/chromium/upstream-info.nix b/pkgs/applications/networking/browsers/chromium/upstream-info.nix
index 89d969587a1c..d8d2aff0d097 100644
--- a/pkgs/applications/networking/browsers/chromium/upstream-info.nix
+++ b/pkgs/applications/networking/browsers/chromium/upstream-info.nix
@@ -1,18 +1,18 @@
 # This file is autogenerated from update.sh in the same directory.
 {
   beta = {
-    sha256 = "0pq7q7plbmfg2f6m74wl2l19k15ik2mvw56bfzk4c9cdns8w6b8a";
-    sha256bin64 = "09zf3kldvi8zh7arvl94vjmbvgsghwa51b5j0ic8ncdn880dlq0j";
-    version = "76.0.3809.25";
+    sha256 = "1521vh38mfgy7aj1lw1vpbdm8m6wyh52d5p7bz4x6kvvxsnacp11";
+    sha256bin64 = "0rbc0ld655szg42mqjdby8749d2jg34nlpp4cpq66qb4zi6vvb04";
+    version = "76.0.3809.87";
   };
   dev = {
-    sha256 = "19v1i4ks5rpwdcwmfj8qqni4afyhnddb5hbbisabnjif3b8xrvjw";
-    sha256bin64 = "0vsbxvqidrvw797h0and67pdb4maijsiv6jkpj3kqaxakiwnadxj";
-    version = "76.0.3809.21";
+    sha256 = "15v25nwcdxqgw6n0ym7fz5qaq0a74p0wiwcq155xy6zvr3q8q1nw";
+    sha256bin64 = "1qawl0hsl6qpc10avli8raw4nzwcpmp6dyada5pga7i4k5jpsr95";
+    version = "77.0.3860.5";
   };
   stable = {
-    sha256 = "0f9qjhxvk8sajj7qa061crfmln65q7sniylrgp0qijwyw6xrmddi";
-    sha256bin64 = "1xvqfrq119iwgvd2d4z2v2ladi2kl52kji55yxdmyi377dpk5rfa";
-    version = "75.0.3770.90";
+    sha256 = "1521vh38mfgy7aj1lw1vpbdm8m6wyh52d5p7bz4x6kvvxsnacp11";
+    sha256bin64 = "0hnfn2zxdrp96a4p98r08w4krzwkpb1kp4rjk03754akjyg1b3xx";
+    version = "76.0.3809.87";
   };
 }
diff --git a/pkgs/applications/networking/dsvpn/default.nix b/pkgs/applications/networking/dsvpn/default.nix
new file mode 100644
index 000000000000..68198ae14e20
--- /dev/null
+++ b/pkgs/applications/networking/dsvpn/default.nix
@@ -0,0 +1,29 @@
+{ stdenv, fetchFromGitHub }:
+
+stdenv.mkDerivation rec {
+  pname = "dsvpn";
+  version = "0.1.0";
+
+  src = fetchFromGitHub {
+    owner = "jedisct1";
+    repo = pname;
+    rev = version;
+    sha256 = "1g747197zpg83ba9l9vxg8m3jv13wcprhnyr8asdxq745kzmynsr";
+  };
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm755 -t $out/bin dsvpn
+
+    runHook postInstall
+  '';
+
+  meta = with stdenv.lib; {
+    description = "A Dead Simple VPN";
+    homepage = "https://github.com/jedisct1/dsvpn";
+    license = licenses.mit;
+    maintainers = [ maintainers.marsam ];
+    platforms = platforms.unix;
+  };
+}
diff --git a/pkgs/development/compilers/reason/default.nix b/pkgs/development/compilers/reason/default.nix
index 1b84b9348520..715b000f323d 100644
--- a/pkgs/development/compilers/reason/default.nix
+++ b/pkgs/development/compilers/reason/default.nix
@@ -1,5 +1,5 @@
 { stdenv, makeWrapper, fetchFromGitHub, ocaml, findlib, dune
-, menhir, merlin_extend, ppx_tools_versioned, utop
+, menhir, merlin-extend, ppx_tools_versioned, utop
 }:
 
 stdenv.mkDerivation rec {
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ makeWrapper ];
 
-  propagatedBuildInputs = [ menhir merlin_extend ppx_tools_versioned ];
+  propagatedBuildInputs = [ menhir merlin-extend ppx_tools_versioned ];
 
   buildInputs = [ ocaml findlib dune utop menhir ];
 
diff --git a/pkgs/development/libraries/protobuf/3.8.nix b/pkgs/development/libraries/protobuf/3.8.nix
new file mode 100644
index 000000000000..2ea03643b3ae
--- /dev/null
+++ b/pkgs/development/libraries/protobuf/3.8.nix
@@ -0,0 +1,6 @@
+{ callPackage, ... }:
+
+callPackage ./generic-v3.nix {
+  version = "3.8.0";
+  sha256 = "0vll02a6k46k720wfh25sl4hdai0130s3ix2l1wh6j1lm9pi7bm8";
+}
diff --git a/pkgs/development/libraries/protobuf/3.9.nix b/pkgs/development/libraries/protobuf/3.9.nix
new file mode 100644
index 000000000000..6652ba7648c5
--- /dev/null
+++ b/pkgs/development/libraries/protobuf/3.9.nix
@@ -0,0 +1,6 @@
+{ callPackage, ... }:
+
+callPackage ./generic-v3.nix {
+  version = "3.9.0";
+  sha256 = "1xq2njqrbmizwg91ggi1lqr0n26cm2jdyk668ljc24ihrpk0z9bw";
+}
diff --git a/pkgs/development/ocaml-modules/merlin-extend/default.nix b/pkgs/development/ocaml-modules/merlin-extend/default.nix
new file mode 100644
index 000000000000..ad3b1337977f
--- /dev/null
+++ b/pkgs/development/ocaml-modules/merlin-extend/default.nix
@@ -0,0 +1,22 @@
+{ lib, buildDunePackage, fetchFromGitHub, cppo }:
+
+buildDunePackage rec {
+  pname = "merlin-extend";
+  version = "0.4";
+
+  src = fetchFromGitHub {
+    owner = "let-def";
+    repo = pname;
+    sha256 = "1dxiqmm7ry24gvw6p9n4mrz37mnq4s6m8blrccsv3rb8yq82acx9";
+    rev = "v${version}";
+  };
+
+  buildInputs = [ cppo ];
+
+  meta = with lib; {
+    inherit (src.meta) homepage;
+    description = "SDK to extend Merlin";
+    license = licenses.mit;
+    maintainers = [ maintainers.volth ];
+  };
+}
diff --git a/pkgs/development/ocaml-modules/merlin_extend/default.nix b/pkgs/development/ocaml-modules/merlin_extend/default.nix
deleted file mode 100644
index 79b8b69bbb57..000000000000
--- a/pkgs/development/ocaml-modules/merlin_extend/default.nix
+++ /dev/null
@@ -1,26 +0,0 @@
-{ stdenv, buildOcaml, fetchFromGitHub, cppo }:
-
-buildOcaml rec {
-  name = "merlin_extend";
-  version = "0.3";
-
-  minimumSupportedOcamlVersion = "4.02";
-
-  src = fetchFromGitHub {
-    owner = "let-def";
-    repo = "merlin-extend";
-    sha256 = "1z6hybcb7ry0bkzjd0r2dlcgjnhhxdsr06x3h03sj7h5fihsc7vd";
-    rev = "v${version}";
-  };
-
-  buildInputs = [ cppo ];
-
-  createFindlibDestdir = true;
-
-  meta = with stdenv.lib; {
-    homepage = https://github.com/let-def/merlin-extend;
-    description = "SDK to extend Merlin";
-    license = licenses.mit;
-    maintainers = [ maintainers.volth ];
-  };
-}
diff --git a/pkgs/development/python-modules/pynamodb/default.nix b/pkgs/development/python-modules/pynamodb/default.nix
new file mode 100644
index 000000000000..e7cd0872c76a
--- /dev/null
+++ b/pkgs/development/python-modules/pynamodb/default.nix
@@ -0,0 +1,33 @@
+{ lib
+, buildPythonPackage
+, botocore
+, fetchPypi
+, mock
+, mypy
+, python-dateutil
+, pytest
+, requests
+}:
+
+buildPythonPackage rec {
+  pname = "pynamodb";
+  version = "3.4.1";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "1cwgqvpqn59y3zq4wv35m1v4jrh3ih6zbyv30g5nxbw13vddxr92";
+  };
+
+  propagatedBuildInputs = [ python-dateutil botocore ];
+  checkInputs = [ requests mock pytest mypy ];
+
+  meta = with lib; {
+    description = "A Pythonic interface for Amazon’s DynamoDB that supports Python 2 and 3.";
+    longDescription = ''
+      DynamoDB is a great NoSQL service provided by Amazon, but the API is
+      verbose. PynamoDB presents you with a simple, elegant API.
+    '';
+    homepage = "http://jlafon.io/pynamodb.html";
+    license = licenses.mit;
+  };
+}
diff --git a/pkgs/development/python-modules/redis/default.nix b/pkgs/development/python-modules/redis/default.nix
index 1851fe7a0de9..62a1177054b9 100644
--- a/pkgs/development/python-modules/redis/default.nix
+++ b/pkgs/development/python-modules/redis/default.nix
@@ -1,18 +1,20 @@
-{ fetchPypi, buildPythonPackage }:
+{ lib, fetchPypi, buildPythonPackage }:
+
 buildPythonPackage rec {
   pname = "redis";
-  version = "3.1.0";
+  version = "3.3.4";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "7ba8612bbfd966dea8c62322543fed0095da2834dbd5a7c124afbc617a156aa7";
+    sha256 = "18n6k113izfqsm8yysrw1a5ba6kv0vsgfz6ab5n0k6k65yvr690z";
   };
 
   # tests require a running redis
   doCheck = false;
 
-  meta = {
+  meta = with lib; {
     description = "Python client for Redis key-value store";
     homepage = "https://pypi.python.org/pypi/redis/";
+    license = with licenses; [ mit ];
   };
 }
diff --git a/pkgs/development/tools/rubocop/Gemfile.lock b/pkgs/development/tools/rubocop/Gemfile.lock
index 5d18d3442811..df5bee57be6b 100644
--- a/pkgs/development/tools/rubocop/Gemfile.lock
+++ b/pkgs/development/tools/rubocop/Gemfile.lock
@@ -7,7 +7,7 @@ GEM
     parser (2.6.3.0)
       ast (~> 2.4.0)
     rainbow (3.0.0)
-    rubocop (0.73.0)
+    rubocop (0.74.0)
       jaro_winkler (~> 1.5.1)
       parallel (~> 1.10)
       parser (>= 2.6)
diff --git a/pkgs/development/tools/rubocop/gemset.nix b/pkgs/development/tools/rubocop/gemset.nix
index 9eaa50eff958..892d0d74d7b2 100644
--- a/pkgs/development/tools/rubocop/gemset.nix
+++ b/pkgs/development/tools/rubocop/gemset.nix
@@ -56,10 +56,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1b5zc8xaqb5krchjrjqj7sc205awmnpksc4ng0rbckd6xcbr7n0f";
+      sha256 = "0wpyass9qb2wvq8zsc7wdzix5xy2ldiv66wnx8mwwprz2dcvzayk";
       type = "gem";
     };
-    version = "0.73.0";
+    version = "0.74.0";
   };
   ruby-progressbar = {
     groups = ["default"];
diff --git a/pkgs/servers/monitoring/prometheus/pushgateway.nix b/pkgs/servers/monitoring/prometheus/pushgateway.nix
index 3c3835913865..1c00f734c19e 100644
--- a/pkgs/servers/monitoring/prometheus/pushgateway.nix
+++ b/pkgs/servers/monitoring/prometheus/pushgateway.nix
@@ -43,7 +43,7 @@ buildGoPackage rec {
     description = "Allows ephemeral and batch jobs to expose metrics to Prometheus";
     homepage = https://github.com/prometheus/pushgateway;
     license = licenses.asl20;
-    maintainers = with maintainers; [ benley fpletz ivan ];
+    maintainers = with maintainers; [ benley fpletz ];
     platforms = platforms.unix;
   };
 }
diff --git a/pkgs/servers/sql/postgresql/ext/timescaledb.nix b/pkgs/servers/sql/postgresql/ext/timescaledb.nix
index c77c01f8d204..77da47b00e0d 100644
--- a/pkgs/servers/sql/postgresql/ext/timescaledb.nix
+++ b/pkgs/servers/sql/postgresql/ext/timescaledb.nix
@@ -8,7 +8,7 @@
 
 stdenv.mkDerivation rec {
   name = "timescaledb-${version}";
-  version = "1.4.0";
+  version = "1.4.1";
 
   nativeBuildInputs = [ cmake ];
   buildInputs = [ postgresql openssl ];
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
     owner  = "timescale";
     repo   = "timescaledb";
     rev    = "refs/tags/${version}";
-    sha256 = "0xjl3pdm36pksbkhl44kixqkfv8qpdm4frfwxv0p4vvjmlhslz48";
+    sha256 = "1gbca0fyaxjkwijdp2ah4iykwq5xabz9kkf8ak76sif4lz64y54b";
   };
 
   cmakeFlags = [ "-DSEND_TELEMETRY_DEFAULT=OFF" ];
@@ -39,7 +39,7 @@ stdenv.mkDerivation rec {
   meta = with stdenv.lib; {
     description = "Scales PostgreSQL for time-series data via automatic partitioning across time and space";
     homepage    = https://www.timescale.com/;
-    maintainers = with maintainers; [ volth ];
+    maintainers = with maintainers; [ volth marsam ];
     platforms   = postgresql.meta.platforms;
     license     = licenses.asl20;
   };
diff --git a/pkgs/tools/misc/stow/default.nix b/pkgs/tools/misc/stow/default.nix
index a4d322ae1841..d5eecff72781 100644
--- a/pkgs/tools/misc/stow/default.nix
+++ b/pkgs/tools/misc/stow/default.nix
@@ -1,26 +1,18 @@
-{ stdenv, fetchurl, perl, perlPackages, makeWrapper }:
+{ stdenv, fetchurl, perl, perlPackages }:
 
 let
   pname = "stow";
-  version = "2.3.0";
+  version = "2.3.1";
 in
 stdenv.mkDerivation {
   name = "${pname}-${version}";
 
   src = fetchurl {
     url = "mirror://gnu/stow/stow-${version}.tar.bz2";
-    sha256 = "1fnn83wwx3yaxpqkq8xyya3aiibz19fwrfj30nsiikm7igmwgiv5";
+    sha256 = "0bs2b90wjkk1camcasy8kn403kazq6c7fj5m5msfl3navbgwz9i6";
   };
 
-  nativeBuildInputs = [ makeWrapper ];
-  buildInputs = with perlPackages; [ perl IOStringy TestOutput HashMerge Clone CloneChoose ];
-
-  postFixup = ''
-    wrapProgram "$out"/bin/stow \
-    --set PERL5LIB "$out/lib/perl5/site_perl:${with perlPackages; makePerlPath [
-      HashMerge Clone CloneChoose
-    ]}"
-  '';
+  buildInputs = with perlPackages; [ perl IOStringy TestOutput ];
 
   doCheck = true;
 
diff --git a/pkgs/tools/misc/z-lua/default.nix b/pkgs/tools/misc/z-lua/default.nix
index 9b0f5e477a1c..aed902044f98 100644
--- a/pkgs/tools/misc/z-lua/default.nix
+++ b/pkgs/tools/misc/z-lua/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "z-lua";
-  version = "1.7.1";
+  version = "1.7.2";
 
   src = fetchFromGitHub {
     owner = "skywind3000";
     repo = "z.lua";
     rev = "v${version}";
-    sha256 = "01n4x84rpmyjyfga90s2s63gdk17z944hz35fk95qnshc5fapfq8";
+    sha256 = "17klcw2iv7d636mp7fb80kjvqd3xqkzqhwz41ri1l029dxji4zzh";
   };
 
   dontBuild = true;
diff --git a/pkgs/tools/text/gnupatch/default.nix b/pkgs/tools/text/gnupatch/default.nix
index 33bec808a2a3..91552d25d51d 100644
--- a/pkgs/tools/text/gnupatch/default.nix
+++ b/pkgs/tools/text/gnupatch/default.nix
@@ -15,10 +15,12 @@ stdenv.mkDerivation rec {
     ./CVE-2018-6951.patch
     (fetchurl {
       url = https://git.savannah.gnu.org/cgit/patch.git/patch/?id=b5a91a01e5d0897facdd0f49d64b76b0f02b43e1;
+      name = "Allow_input_files_to_be_missing_for_ed-style_patches.patch";
       sha256 = "0iw0lk0yhnhvfjzal48ij6zdr92mgb84jq7fwryy1hdhi47hhq64";
     })
     (fetchurl { # CVE-2018-1000156
       url = https://git.savannah.gnu.org/cgit/patch.git/patch/?id=123eaff0d5d1aebe128295959435b9ca5909c26d;
+      name = "Fix_arbitrary_command_execution_in_ed-style_patches.patch";
       sha256 = "1bpy16n3hm5nv9xkrn6c4wglzsdzj3ss1biq16w9kfv48p4hx2vg";
     })
     # https://git.savannah.gnu.org/cgit/patch.git/commit/?id=9c986353e420ead6e706262bf204d6e03322c300
diff --git a/pkgs/tools/text/ripgrep/default.nix b/pkgs/tools/text/ripgrep/default.nix
index 311767a786fc..4fa90441bdbe 100644
--- a/pkgs/tools/text/ripgrep/default.nix
+++ b/pkgs/tools/text/ripgrep/default.nix
@@ -5,16 +5,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "ripgrep";
-  version = "11.0.1";
+  version = "11.0.2";
 
   src = fetchFromGitHub {
     owner = "BurntSushi";
     repo = pname;
     rev = version;
-    sha256 = "0vak82d4vyw0w8agswbyxa6g3zs2h9mxm2xjw0xs9qccvmi7whbb";
+    sha256 = "1iga3320mgi7m853la55xip514a3chqsdi1a1rwv25lr9b1p7vd3";
   };
 
-  cargoSha256 = "1k1wg27p7w8b3cgygnkr6yhsc4hpnvrpa227s612vy2zfcmgb1kx";
+  cargoSha256 = "11477l4l1y55klw5dp2kbsnv989vdz1547ml346hcfbkzv7m450v";
 
   cargoBuildFlags = stdenv.lib.optional withPCRE2 "--features pcre2";
 
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 8b5592b221b7..5c4ba842cd84 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -1484,6 +1484,8 @@ in
     gtk = gtk3;
   };
 
+  dsvpn = callPackage ../applications/networking/dsvpn { };
+
   dtools = callPackage ../development/tools/dtools { };
 
   dtrx = callPackage ../tools/compression/dtrx { };
@@ -12864,6 +12866,8 @@ in
 
   protobuf = protobuf3_7;
 
+  protobuf3_9 = callPackage ../development/libraries/protobuf/3.9.nix { };
+  protobuf3_8 = callPackage ../development/libraries/protobuf/3.8.nix { };
   protobuf3_7 = callPackage ../development/libraries/protobuf/3.7.nix { };
   protobuf3_6 = callPackage ../development/libraries/protobuf/3.6.nix { };
   protobuf3_1 = callPackage ../development/libraries/protobuf/3.1.nix { };
diff --git a/pkgs/top-level/ocaml-packages.nix b/pkgs/top-level/ocaml-packages.nix
index 949c5b6a3085..a543e31bdcb6 100644
--- a/pkgs/top-level/ocaml-packages.nix
+++ b/pkgs/top-level/ocaml-packages.nix
@@ -436,7 +436,7 @@ let
 
     merlin = callPackage ../development/tools/ocaml/merlin { };
 
-    merlin_extend = callPackage ../development/ocaml-modules/merlin_extend { };
+    merlin-extend = callPackage ../development/ocaml-modules/merlin-extend { };
 
     mezzo = callPackage ../development/compilers/mezzo { };
 
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index a994979a719a..d581522a5488 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -129,6 +129,8 @@ in {
 
   py3to2 = callPackage ../development/python-modules/3to2 { };
 
+  pynamodb = callPackage ../development/python-modules/pynamodb { };
+
   absl-py = callPackage ../development/python-modules/absl-py { };
 
   adb-homeassistant = callPackage ../development/python-modules/adb-homeassistant { };