diff --git a/nixos/modules/services/amqp/rabbitmq.nix b/nixos/modules/services/amqp/rabbitmq.nix
index 646708e01c48..fc8a1bc3c23c 100644
--- a/nixos/modules/services/amqp/rabbitmq.nix
+++ b/nixos/modules/services/amqp/rabbitmq.nix
@@ -57,7 +57,7 @@ in {
         description = ''
           Port on which RabbitMQ will listen for AMQP connections.
         '';
-        type = types.int;
+        type = types.port;
       };
 
       dataDir = mkOption {
diff --git a/nixos/modules/services/databases/mysql.nix b/nixos/modules/services/databases/mysql.nix
index 2d8d613ed88e..b801b5cce635 100644
--- a/nixos/modules/services/databases/mysql.nix
+++ b/nixos/modules/services/databases/mysql.nix
@@ -48,7 +48,7 @@ in
       };
 
       port = mkOption {
-        type = types.int;
+        type = types.port;
         default = 3306;
         description = "Port of MySQL.";
       };
diff --git a/nixos/modules/services/editors/infinoted.nix b/nixos/modules/services/editors/infinoted.nix
index 10d868b7f161..3eb0753194dd 100644
--- a/nixos/modules/services/editors/infinoted.nix
+++ b/nixos/modules/services/editors/infinoted.nix
@@ -51,7 +51,7 @@ in {
     };
 
     port = mkOption {
-      type = types.int;
+      type = types.port;
       default = 6523;
       description = ''
         Port to listen on
diff --git a/nixos/modules/services/misc/docker-registry.nix b/nixos/modules/services/misc/docker-registry.nix
index 1c2e2cc53590..e212f581c28a 100644
--- a/nixos/modules/services/misc/docker-registry.nix
+++ b/nixos/modules/services/misc/docker-registry.nix
@@ -58,7 +58,7 @@ in {
     port = mkOption {
       description = "Docker registry port to bind to.";
       default = 5000;
-      type = types.int;
+      type = types.port;
     };
 
     storagePath = mkOption {
diff --git a/nixos/modules/services/misc/gitea.nix b/nixos/modules/services/misc/gitea.nix
index 95369ff7ee48..b6c1ca3e61a9 100644
--- a/nixos/modules/services/misc/gitea.nix
+++ b/nixos/modules/services/misc/gitea.nix
@@ -82,7 +82,7 @@ in
         };
 
         port = mkOption {
-          type = types.int;
+          type = types.port;
           default = (if !usePostgresql then 3306 else pg.port);
           description = "Database host port.";
         };
diff --git a/nixos/modules/services/misc/gpsd.nix b/nixos/modules/services/misc/gpsd.nix
index f954249942a8..fafea10daba7 100644
--- a/nixos/modules/services/misc/gpsd.nix
+++ b/nixos/modules/services/misc/gpsd.nix
@@ -62,7 +62,7 @@ in
       };
 
       port = mkOption {
-        type = types.int;
+        type = types.port;
         default = 2947;
         description = ''
           The port where to listen for TCP connections.
diff --git a/nixos/modules/services/misc/leaps.nix b/nixos/modules/services/misc/leaps.nix
index ef89d3e64d0c..f797218522c5 100644
--- a/nixos/modules/services/misc/leaps.nix
+++ b/nixos/modules/services/misc/leaps.nix
@@ -11,7 +11,7 @@ in
     services.leaps = {
       enable = mkEnableOption "leaps";
       port = mkOption {
-        type = types.int;
+        type = types.port;
         default = 8080;
         description = "A port where leaps listens for incoming http requests";
       };
diff --git a/nixos/modules/services/misc/mwlib.nix b/nixos/modules/services/misc/mwlib.nix
index 6b41b552a86d..8dd17c06c0b3 100644
--- a/nixos/modules/services/misc/mwlib.nix
+++ b/nixos/modules/services/misc/mwlib.nix
@@ -34,7 +34,7 @@ in
 
       port = mkOption {
         default = 8899;
-        type = types.int;
+        type = types.port;
         description = "Specify port to listen on.";
       }; # nserve.port
 
@@ -68,7 +68,7 @@ in
 
       port = mkOption {
         default = 14311;
-        type = types.int;
+        type = types.port;
         description = "Specify port to listen on.";
       }; # qserve.port
 
@@ -137,7 +137,7 @@ in
 
             port = mkOption {
               default = 8898;
-              type = types.int;
+              type = types.port;
               description = "Port to listen to when serving files from cache.";
             }; # nslave.http.port
 
diff --git a/nixos/modules/services/misc/octoprint.nix b/nixos/modules/services/misc/octoprint.nix
index 5a64946f9f63..c926d889b37a 100644
--- a/nixos/modules/services/misc/octoprint.nix
+++ b/nixos/modules/services/misc/octoprint.nix
@@ -40,7 +40,7 @@ in
       };
 
       port = mkOption {
-        type = types.int;
+        type = types.port;
         default = 5000;
         description = ''
           Port to bind OctoPrint to.
diff --git a/nixos/modules/services/misc/paperless.nix b/nixos/modules/services/misc/paperless.nix
index bfaf760fb836..43730b80eb2c 100644
--- a/nixos/modules/services/misc/paperless.nix
+++ b/nixos/modules/services/misc/paperless.nix
@@ -67,7 +67,7 @@ in
     };
 
     port = mkOption {
-      type = types.int;
+      type = types.port;
       default = 28981;
       description = "Server port to listen on.";
     };
diff --git a/nixos/modules/services/misc/redmine.nix b/nixos/modules/services/misc/redmine.nix
index e0055576d6f6..66c8e558fb04 100644
--- a/nixos/modules/services/misc/redmine.nix
+++ b/nixos/modules/services/misc/redmine.nix
@@ -71,7 +71,7 @@ in
       };
 
       port = mkOption {
-        type = types.int;
+        type = types.port;
         default = 3000;
         description = "Port on which Redmine is ran.";
       };
diff --git a/nixos/modules/services/misc/subsonic.nix b/nixos/modules/services/misc/subsonic.nix
index 152917d345cc..e17a98a5e1de 100644
--- a/nixos/modules/services/misc/subsonic.nix
+++ b/nixos/modules/services/misc/subsonic.nix
@@ -28,7 +28,7 @@ let cfg = config.services.subsonic; in {
       };
 
       port = mkOption {
-        type = types.int;
+        type = types.port;
         default = 4040;
         description = ''
           The port on which Subsonic will listen for
@@ -37,7 +37,7 @@ let cfg = config.services.subsonic; in {
       };
 
       httpsPort = mkOption {
-        type = types.int;
+        type = types.port;
         default = 0;
         description = ''
           The port on which Subsonic will listen for
diff --git a/nixos/modules/services/monitoring/grafana.nix b/nixos/modules/services/monitoring/grafana.nix
index c3e1f72945bf..e0b2624b6cac 100644
--- a/nixos/modules/services/monitoring/grafana.nix
+++ b/nixos/modules/services/monitoring/grafana.nix
@@ -292,7 +292,7 @@ in {
     port = mkOption {
       description = "Listening port.";
       default = 3000;
-      type = types.int;
+      type = types.port;
     };
 
     socket = mkOption {
diff --git a/nixos/modules/services/networking/murmur.nix b/nixos/modules/services/networking/murmur.nix
index b03630208df8..f8bb878ec65d 100644
--- a/nixos/modules/services/networking/murmur.nix
+++ b/nixos/modules/services/networking/murmur.nix
@@ -98,7 +98,7 @@ in
       };
 
       port = mkOption {
-        type = types.int;
+        type = types.port;
         default = 64738;
         description = "Ports to bind to (UDP and TCP).";
       };
diff --git a/nixos/modules/services/networking/namecoind.nix b/nixos/modules/services/networking/namecoind.nix
index 4966ed2cac8d..8f7a5123f7e1 100644
--- a/nixos/modules/services/networking/namecoind.nix
+++ b/nixos/modules/services/networking/namecoind.nix
@@ -105,7 +105,7 @@ in
       };
 
       rpc.port = mkOption {
-        type = types.int;
+        type = types.port;
         default = 8332;
         description = ''
           Port the RPC server will bind to.
diff --git a/nixos/modules/services/networking/nar-serve.nix b/nixos/modules/services/networking/nar-serve.nix
index ddd42fa01073..745138186a20 100644
--- a/nixos/modules/services/networking/nar-serve.nix
+++ b/nixos/modules/services/networking/nar-serve.nix
@@ -13,7 +13,7 @@ in
       enable = mkEnableOption "Serve NAR file contents via HTTP";
 
       port = mkOption {
-        type = types.int;
+        type = types.port;
         default = 8383;
         description = ''
           Port number where nar-serve will listen on.
diff --git a/nixos/modules/services/networking/nix-serve.nix b/nixos/modules/services/networking/nix-serve.nix
index 347d87b3f385..b17f35c769bb 100644
--- a/nixos/modules/services/networking/nix-serve.nix
+++ b/nixos/modules/services/networking/nix-serve.nix
@@ -11,7 +11,7 @@ in
       enable = mkEnableOption "nix-serve, the standalone Nix binary cache server";
 
       port = mkOption {
-        type = types.int;
+        type = types.port;
         default = 5000;
         description = ''
           Port number where nix-serve will listen on.
diff --git a/nixos/modules/services/web-servers/ttyd.nix b/nixos/modules/services/web-servers/ttyd.nix
index 01a01d97a234..68d55ee6ffd2 100644
--- a/nixos/modules/services/web-servers/ttyd.nix
+++ b/nixos/modules/services/web-servers/ttyd.nix
@@ -33,7 +33,7 @@ in
       enable = mkEnableOption "ttyd daemon";
 
       port = mkOption {
-        type = types.int;
+        type = types.port;
         default = 7681;
         description = "Port to listen on (use 0 for random port)";
       };
diff --git a/pkgs/applications/graphics/ImageMagick/6.x.nix b/pkgs/applications/graphics/ImageMagick/6.x.nix
index 5fea254ce08d..4ac4af48aab8 100644
--- a/pkgs/applications/graphics/ImageMagick/6.x.nix
+++ b/pkgs/applications/graphics/ImageMagick/6.x.nix
@@ -1,6 +1,6 @@
 { lib, stdenv, fetchFromGitHub, pkg-config, libtool
 , bzip2, zlib, libX11, libXext, libXt, fontconfig, freetype, ghostscript, libjpeg, djvulibre
-, lcms2, openexr, libpng, librsvg, libtiff, libxml2, openjpeg, libwebp, fftw, libheif, libde265
+, lcms2, openexr, libpng, liblqr1, librsvg, libtiff, libxml2, openjpeg, libwebp, fftw, libheif, libde265
 , ApplicationServices, Foundation
 }:
 
@@ -34,6 +34,7 @@ stdenv.mkDerivation rec {
     [ "--with-frozenpaths" ]
     ++ (if arch != null then [ "--with-gcc-arch=${arch}" ] else [ "--without-gcc-arch" ])
     ++ lib.optional (librsvg != null) "--with-rsvg"
+    ++ lib.optional (liblqr1 != null) "--with-lqr"
     ++ lib.optionals (ghostscript != null)
       [ "--with-gs-font-dir=${ghostscript}/share/ghostscript/fonts"
         "--with-gslib"
@@ -46,7 +47,7 @@ stdenv.mkDerivation rec {
 
   buildInputs =
     [ zlib fontconfig freetype ghostscript
-      libpng libtiff libxml2 libheif libde265 djvulibre
+      liblqr1 libpng libtiff libxml2 libheif libde265 djvulibre
     ]
     ++ lib.optionals (!stdenv.hostPlatform.isMinGW)
       [ openexr librsvg openjpeg ]
diff --git a/pkgs/applications/graphics/ImageMagick/7.0.nix b/pkgs/applications/graphics/ImageMagick/7.0.nix
index e2fdb19127dc..0fd76235f528 100644
--- a/pkgs/applications/graphics/ImageMagick/7.0.nix
+++ b/pkgs/applications/graphics/ImageMagick/7.0.nix
@@ -1,6 +1,6 @@
 { lib, stdenv, fetchFromGitHub, pkg-config, libtool
 , bzip2, zlib, libX11, libXext, libXt, fontconfig, freetype, ghostscript, libjpeg, djvulibre
-, lcms2, openexr, libpng, librsvg, libtiff, libxml2, openjpeg, libwebp, libheif
+, lcms2, openexr, libpng, liblqr1, librsvg, libtiff, libxml2, openjpeg, libwebp, libheif
 , ApplicationServices
 , Foundation
 , testVersion, imagemagick
@@ -18,13 +18,13 @@ in
 
 stdenv.mkDerivation rec {
   pname = "imagemagick";
-  version = "7.1.0-0";
+  version = "7.1.0-2";
 
   src = fetchFromGitHub {
     owner = "ImageMagick";
     repo = "ImageMagick";
     rev = version;
-    sha256 = "sha256-TmyJMzj5tHMrVm6xRguZmXIg7c6mHmqusMMdJAHNqNg=";
+    sha256 = "sha256-0nTz9UBspROrNj72amyZmFYK/y9Xg4+qNt4raZiK3AI=";
   };
 
   outputs = [ "out" "dev" "doc" ]; # bin/ isn't really big
@@ -36,6 +36,7 @@ stdenv.mkDerivation rec {
     [ "--with-frozenpaths" ]
     ++ (if arch != null then [ "--with-gcc-arch=${arch}" ] else [ "--without-gcc-arch" ])
     ++ lib.optional (librsvg != null) "--with-rsvg"
+    ++ lib.optional (liblqr1 != null) "--with-lqr"
     ++ lib.optionals (ghostscript != null)
       [ "--with-gs-font-dir=${ghostscript}/share/ghostscript/fonts"
         "--with-gslib"
@@ -48,7 +49,7 @@ stdenv.mkDerivation rec {
 
   buildInputs =
     [ zlib fontconfig freetype ghostscript
-      libpng libtiff libxml2 libheif djvulibre
+      liblqr1 libpng libtiff libxml2 libheif djvulibre
     ]
     ++ lib.optionals (!stdenv.hostPlatform.isMinGW)
       [ openexr librsvg openjpeg ]
@@ -84,7 +85,7 @@ stdenv.mkDerivation rec {
     homepage = "http://www.imagemagick.org/";
     description = "A software suite to create, edit, compose, or convert bitmap images";
     platforms = platforms.linux ++ platforms.darwin;
-    maintainers = with maintainers; [ erictapen ];
+    maintainers = with maintainers; [ erictapen dotlambda ];
     license = licenses.asl20;
     mainProgram = "magick";
   };
diff --git a/pkgs/applications/networking/cluster/fn-cli/default.nix b/pkgs/applications/networking/cluster/fn-cli/default.nix
index 8620c43cdbe7..95e16797cf4f 100644
--- a/pkgs/applications/networking/cluster/fn-cli/default.nix
+++ b/pkgs/applications/networking/cluster/fn-cli/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "fn";
-  version = "0.6.7";
+  version = "0.6.8";
 
   src = fetchFromGitHub {
     owner = "fnproject";
     repo = "cli";
     rev = version;
-    sha256 = "sha256-50tPR+x3U4XJB6lthEiZjOy2pD8LprSE41ZpH2Px8JY=";
+    sha256 = "sha256-8b1VyukVMTXLAnvYcjXgTdPtMq3YxJgTpxe25Kj+Wpw=";
   };
 
   vendorSha256 = null;
diff --git a/pkgs/applications/science/math/glsurf/default.nix b/pkgs/applications/science/math/glsurf/default.nix
index 208bb95f930e..58b2a617bd63 100644
--- a/pkgs/applications/science/math/glsurf/default.nix
+++ b/pkgs/applications/science/math/glsurf/default.nix
@@ -1,7 +1,12 @@
-{ lib, stdenv, fetchurl, ocamlPackages, libGLU, libGL, freeglut, giflib
-, libmysqlclient, mpfr, gmp, libtiff, libjpeg, libpng
+{ lib, stdenv, fetchurl, ocamlPackages, makeWrapper
+, libGLU, libGL, freeglut, mpfr, gmp
+, pkgsHostTarget
 }:
 
+let
+  inherit (pkgsHostTarget.targetPackages.stdenv) cc;
+in
+
 stdenv.mkDerivation {
   name = "glsurf-3.3.1";
 
@@ -10,17 +15,32 @@ stdenv.mkDerivation {
     sha256 = "0w8xxfnw2snflz8wdr2ca9f5g91w5vbyp1hwlx1v7vg83d4bwqs7";
   };
 
-  buildInputs = [ freeglut libGLU libGL libmysqlclient mpfr giflib gmp
-    libtiff libjpeg libpng ]
-  ++ (with ocamlPackages; [
-    ocaml findlib ocaml_mysql lablgl camlimages_4_1_2 mlgmpidl
+  nativeBuildInputs = [
+    makeWrapper
+  ] ++ (with ocamlPackages; [
+    ocaml findlib
   ]);
 
+  buildInputs = [
+    freeglut libGL libGLU mpfr gmp
+  ] ++ (with ocamlPackages; [
+    camlp4 lablgl camlimages_4_2_4
+  ]);
+
+  postPatch = ''
+    for f in callbacks*/Makefile src/Makefile; do
+      substituteInPlace "$f" --replace "+camlp4" \
+        "${ocamlPackages.camlp4}/lib/ocaml/${ocamlPackages.ocaml.version}/site-lib/camlp4"
+    done
+  '';
+
   installPhase = ''
     mkdir -p $out/bin $out/share/doc/glsurf
     cp ./src/glsurf.opt $out/bin/glsurf
     cp ./doc/doc.pdf $out/share/doc/glsurf
     cp -r ./examples $out/share/doc/glsurf
+
+    wrapProgram "$out/bin/glsurf" --set CC "${cc}/bin/${cc.targetPrefix}cc"
   '';
 
   meta = {
diff --git a/pkgs/build-support/trivial-builders.nix b/pkgs/build-support/trivial-builders.nix
index 219f808403cc..6f51ba512c12 100644
--- a/pkgs/build-support/trivial-builders.nix
+++ b/pkgs/build-support/trivial-builders.nix
@@ -116,7 +116,7 @@ rec {
     , checkPhase ? ""    # syntax checks, e.g. for scripts
     }:
     runCommand name
-      { inherit text executable;
+      { inherit text executable checkPhase;
         passAsFile = [ "text" ];
         # Pointless to do this on a remote machine.
         preferLocalBuild = true;
@@ -132,7 +132,7 @@ rec {
           echo -n "$text" > "$n"
         fi
 
-        ${checkPhase}
+        eval "$checkPhase"
 
         (test -n "$executable" && chmod +x "$n") || true
       '';
diff --git a/pkgs/build-support/trivial-builders/test-overriding.nix b/pkgs/build-support/trivial-builders/test-overriding.nix
new file mode 100644
index 000000000000..ddd5dc050752
--- /dev/null
+++ b/pkgs/build-support/trivial-builders/test-overriding.nix
@@ -0,0 +1,119 @@
+# Check that overriding works for trivial-builders like
+# `writeShellScript` via `overrideAttrs`. This is useful
+# to override the `checkPhase`, e. g. when you want
+# to enable extglob in `writeShellScript`.
+#
+# Run using `nix-build -A tests.trivial-overriding`.
+{ lib
+, runtimeShell
+, runCommand
+, callPackage
+, writeShellScript
+, writeTextFile
+, writeShellScriptBin
+}:
+
+let
+  extglobScript = ''
+    shopt -s extglob
+    touch success
+    echo @(success|failure)
+    rm success
+  '';
+
+  # Reuse the old `checkPhase` of `writeShellScript`, but enable extglob.
+  allowExtglob = old: {
+    checkPhase = ''
+      # make sure we don't change the settings for
+      # the rest of the derivation's build
+      (
+        export BASHOPTS
+        shopt -s extglob
+        ${old.checkPhase}
+      )
+    '';
+  };
+
+  # Run old checkPhase, but only succeed if it fails.
+  # This HACK is required because we can't introspect build failures
+  # in nix: With `assertFail` we want to make sure that the default
+  # `checkPhase` would fail if extglob was used in the script.
+  assertFail = old: {
+    # write old checkPhase into a shell script, so we can check for
+    # the phase to fail even though we have `set -e`.
+    checkPhase = ''
+      if source ${writeShellScript "old-check-phase" old.checkPhase} 2>/dev/null; then
+        exit 1
+      fi
+    '';
+  };
+
+  simpleCase = case:
+    writeShellScript "test-trivial-overriding-${case}" extglobScript;
+
+  callPackageCase = case: callPackage (
+    { writeShellScript }:
+    writeShellScript "test-trivial-callpackage-overriding-${case}" extglobScript
+  ) { };
+
+  binCase = case:
+    writeShellScriptBin "test-trivial-overriding-bin-${case}" extglobScript;
+
+  # building this derivation would fail without overriding
+  textFileCase = writeTextFile {
+    name = "test-trivial-overriding-text-file";
+    checkPhase = "false";
+    text = ''
+      #!${runtimeShell}
+      echo success
+    '';
+    executable = true;
+  };
+
+  mkCase = f: type: isBin:
+    let
+      drv = (f type).overrideAttrs
+        (if type == "succ" then allowExtglob else assertFail);
+    in if isBin then "${drv}/bin/${drv.name}" else drv;
+
+  writeTextOverrides = {
+    # Enabling globbing in checkPhase
+    simpleSucc = mkCase simpleCase "succ" false;
+    # Ensure it's possible to fail; in this case globbing is not enabled.
+    simpleFail = mkCase simpleCase "fail" false;
+    # Do the same checks after wrapping with callPackage
+    # to make sure callPackage doesn't mess with the override
+    callpSucc = mkCase callPackageCase "succ" false;
+    callpFail = mkCase callPackageCase "fail" false;
+    # Do the same check using `writeShellScriptBin`
+    binSucc = mkCase binCase "succ" true;
+    binFail = mkCase binCase "fail" true;
+    # Check that we can also override plain writeTextFile
+    textFileSuccess = textFileCase.overrideAttrs (_: {
+      checkPhase = "true";
+    });
+  };
+
+  # `runTest` forces nix to build the script of our test case and
+  # run its `checkPhase` which is our main interest. Additionally
+  # it executes the script and thus makes sure that extglob also
+  # works at run time.
+  runTest = script:
+    let
+      name = script.name or (builtins.baseNameOf script);
+    in writeShellScript "run-${name}" ''
+      if [ "$(${script})" != "success" ]; then
+        echo "Failed in ${script}"
+        exit 1
+      fi
+    '';
+in
+
+runCommand "test-writeShellScript-overriding" {
+  passthru = { inherit writeTextOverrides; };
+} ''
+  ${lib.concatMapStrings (test: ''
+      ${runTest test}
+    '') (lib.attrValues writeTextOverrides)}
+  touch "$out"
+''
diff --git a/pkgs/desktops/gnome/core/gnome-shell/default.nix b/pkgs/desktops/gnome/core/gnome-shell/default.nix
index 41d2fac5e612..c1bd10ce2ea3 100644
--- a/pkgs/desktops/gnome/core/gnome-shell/default.nix
+++ b/pkgs/desktops/gnome/core/gnome-shell/default.nix
@@ -66,13 +66,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "gnome-shell";
-  version = "40.1";
+  version = "40.2";
 
   outputs = [ "out" "devdoc" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-shell/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-9j4r7Zm9iVjPMT2F9EoBjVn4UqBbqfKap8t0S+xvprc=";
+    sha256 = "sha256-Tp2CmwOfoK3TO7ZYP8e04Cjtjc/3r4pXfgnMZpiMKBw=";
   };
 
   patches = [
diff --git a/pkgs/development/compilers/rust/1_52.nix b/pkgs/development/compilers/rust/1_53.nix
similarity index 56%
rename from pkgs/development/compilers/rust/1_52.nix
rename to pkgs/development/compilers/rust/1_53.nix
index 49176ad3fedd..dda6d3931903 100644
--- a/pkgs/development/compilers/rust/1_52.nix
+++ b/pkgs/development/compilers/rust/1_53.nix
@@ -20,8 +20,8 @@
 } @ args:
 
 import ./default.nix {
-  rustcVersion = "1.52.1";
-  rustcSha256 = "sha256-Om8jom0Oj4erv78yxc19qgwLcdCYar78Vrml+/vQv5g=";
+  rustcVersion = "1.53.0";
+  rustcSha256 = "1f95p259dfp5ca118bg107rj3rqwlswy65dxn3hg8sqgl4wwmxsw";
 
   llvmSharedForBuild = pkgsBuildBuild.llvmPackages_12.libllvm.override { enableSharedLibraries = true; };
   llvmSharedForHost = pkgsBuildHost.llvmPackages_12.libllvm.override { enableSharedLibraries = true; };
@@ -34,24 +34,24 @@ import ./default.nix {
 
   # Note: the version MUST be one version prior to the version we're
   # building
-  bootstrapVersion = "1.51.0";
+  bootstrapVersion = "1.52.1";
 
   # fetch hashes by running `print-hashes.sh ${bootstrapVersion}`
   bootstrapHashes = {
-    i686-unknown-linux-gnu = "de2e8ef724d89ba6f567f07ebacf5a244c7cdae30ee559f1913310eda38d9cd1";
-    x86_64-unknown-linux-gnu = "9e125977aa13f012a68fdc6663629c685745091ae244f0587dd55ea4e3a3e42f";
-    x86_64-unknown-linux-musl = "cb65c3a19ba0e09a94ccfd8551e648efaa1db52b0db19ae475d35a46f8750871";
-    arm-unknown-linux-gnueabihf = "ab26464947ce80b4c361b08242dc215a5664f9f4ad23f66891ec27d55a0440b7";
-    armv7-unknown-linux-gnueabihf = "5d381b7ee16c559efefedfac7ec4d392e838fddaf50049255844dcff2b2614dd";
-    aarch64-unknown-linux-gnu = "fd31c78fffad52c03cac5a7c1ee5db3f34b2a77d7bc862707c0f71e209180a84";
-    aarch64-unknown-linux-musl = "06cdaa1117dcdd392ede938b655b9bc45cf2a76bd42870ca223189e6eb29d435";
-    x86_64-apple-darwin = "765212098a415996b767d1e372ce266caf94027402b269fec33291fffc085ca4";
-    aarch64-apple-darwin = "95d0410bbd20b05f8b7d5adf70e8737873995bc86611a90e643d7081ca35147f";
-    powerpc64le-unknown-linux-gnu = "7362f561104d7be4836507d3a53cd39444efcdf065813d559beb1f54ce9f7680";
-    riscv64gc-unknown-linux-gnu = "9d0c2c4ab2397e78758de8b6b57051482bcf20b6748e0e16d9d5bd23ce73d72a";
+    i686-unknown-linux-gnu = "c91f0431c8137a4e98e097ab47b49846820531aafb6e9c249b71b770771832e9";
+    x86_64-unknown-linux-gnu = "617ae06e212cb65bc4abbf52b158b0328b9f1a6c2f822c27c95b274d6fbc0627";
+    x86_64-unknown-linux-musl = "c3eae6e78ee29e03416897f89b54448b2a03d063f07a78cde41757ad2e02c2f0";
+    arm-unknown-linux-gnueabihf = "ef412d923a0c5a9fa54422f40cde62f2e85a62339057cb8b986a545b108d3347";
+    armv7-unknown-linux-gnueabihf = "ec47b3f5c801f8a4df7180e088dcc1817ee160df34ef64ddac4fa50f714f119f";
+    aarch64-unknown-linux-gnu = "17d9aa7bb73b819ef70d81013498727b7218533ee6cf3bd802c4eac29137fbcb";
+    aarch64-unknown-linux-musl = "f2bae2b32f05a90eec041352d9329deb3e907f5560b9fda525788df3b8008b6b";
+    x86_64-apple-darwin = "cfa73228ea54e2c94f75d1b142ea41444c463f4ee8562a3eca1b11b2fe8af95a";
+    aarch64-apple-darwin = "217e9723f828c5359467d69b363a342d702bdcbbcc4107be907e6bc4531f4912";
+    powerpc64le-unknown-linux-gnu = "f258c5d7d6d9022108672b7383412d930a5f59d7644d148e413c3ab0ae45604f";
+    riscv64gc-unknown-linux-gnu = "c1c98ccc8bb4147a819411a10162c8f8ce1aaa5c65cf2c74802dce4dacd6e64b";
   };
 
-  selectRustPackage = pkgs: pkgs.rust_1_52;
+  selectRustPackage = pkgs: pkgs.rust_1_53;
 
   rustcPatches = [
   ];
diff --git a/pkgs/development/compilers/rust/rustc.nix b/pkgs/development/compilers/rust/rustc.nix
index b8fca884edcf..dae944092409 100644
--- a/pkgs/development/compilers/rust/rustc.nix
+++ b/pkgs/development/compilers/rust/rustc.nix
@@ -159,6 +159,9 @@ in stdenv.mkDerivation rec {
     # remove references to llvm-config in lib/rustlib/x86_64-unknown-linux-gnu/codegen-backends/librustc_codegen_llvm-llvm.so
     # and thus a transitive dependency on ncurses
     find $out/lib -name "*.so" -type f -exec remove-references-to -t ${llvmShared} '{}' '+'
+
+    # remove uninstall script that doesn't really make sense for Nix.
+    rm $out/lib/rustlib/uninstall.sh
   '';
 
   configurePlatforms = [];
diff --git a/pkgs/development/compilers/vala/default.nix b/pkgs/development/compilers/vala/default.nix
index 3703225489dd..69d5789bfb0b 100644
--- a/pkgs/development/compilers/vala/default.nix
+++ b/pkgs/development/compilers/vala/default.nix
@@ -116,18 +116,18 @@ in rec {
   };
 
   vala_0_48 = generic {
-    version = "0.48.17";
-    sha256 = "1wlb4vd7k6hg10s09npglbhfcgjzxkywd4v0l96qhn19m9b8cszj";
+    version = "0.48.18";
+    sha256 = "1pbz4nyrrf9wp8rp953sczx545s4g0h5mars9ynkn788dzs2h3wy";
   };
 
   vala_0_50 = generic {
-    version = "0.50.4";
-    sha256 = "1353j852h04d1x6b4n6lbg3ay40ph0adb9yi25dh74pligx33z2q";
+    version = "0.50.9";
+    sha256 = "0w5ngs90rq7vy21nqfq8drqyb33kxm17j161qvakwpsbjsidv1mn";
   };
 
   vala_0_52 = generic {
-    version = "0.52.2";
-    sha256 = "sha256-OjxGCAO6Zh5RO+PQmEtYPgVHP2AsdfqY6RdVUDcUqXs=";
+    version = "0.52.4";
+    sha256 = "0cfz3xshc9azxx4fn25x9gadnph6jvf1r2wzd7p5krk0a4755ppc";
   };
 
   vala = vala_0_52;
diff --git a/pkgs/development/interpreters/lua-5/default.nix b/pkgs/development/interpreters/lua-5/default.nix
index d2ba451b9e60..3e36f77dab43 100644
--- a/pkgs/development/interpreters/lua-5/default.nix
+++ b/pkgs/development/interpreters/lua-5/default.nix
@@ -19,10 +19,6 @@ rec {
 
     patches =
       lib.optionals stdenv.isDarwin [ ./5.2.darwin.patch ];
-
-    postBuild = lib.optionalString (!stdenv.isDarwin) ''
-      ( cd src; make $makeFlags "''${makeFlagsArray[@]}" liblua.so )
-    '';
   };
 
   lua5_3_compat = lua5_3.override({
diff --git a/pkgs/development/interpreters/lua-5/interpreter.nix b/pkgs/development/interpreters/lua-5/interpreter.nix
index fd8c47d751b3..3476b2b648b6 100644
--- a/pkgs/development/interpreters/lua-5/interpreter.nix
+++ b/pkgs/development/interpreters/lua-5/interpreter.nix
@@ -7,6 +7,7 @@
 , patches ? []
 , postConfigure ? null
 , postBuild ? null
+, staticOnly ? stdenv.hostPlatform.isStatic
 }:
 let
 luaPackages = callPackage ../../lua-modules {lua=self; overrides=packageOverrides;};
@@ -38,7 +39,7 @@ self = stdenv.mkDerivation rec {
 
   inherit patches;
 
-  postPatch = lib.optionalString (!stdenv.isDarwin) ''
+  postPatch = lib.optionalString (!stdenv.isDarwin && !staticOnly) ''
     # Add a target for a shared library to the Makefile.
     sed -e '1s/^/LUA_SO = liblua.so/' \
         -e 's/ALL_T *= */&$(LUA_SO) /' \
@@ -56,6 +57,10 @@ self = stdenv.mkDerivation rec {
     "PLAT=${plat}"
     "CC=${stdenv.cc.targetPrefix}cc"
     "RANLIB=${stdenv.cc.targetPrefix}ranlib"
+    # Lua links with readline wich depends on ncurses. For some reason when
+    # building pkgsStatic.lua it fails because symbols from ncurses are not
+    # found. Adding ncurses here fixes the problem.
+    "MYLIBS=-lncurses"
   ];
 
   configurePhase = ''
@@ -66,7 +71,8 @@ self = stdenv.mkDerivation rec {
     makeFlagsArray+=(${lib.optionalString stdenv.isDarwin "CC=\"$CC\""}${lib.optionalString (stdenv.buildPlatform != stdenv.hostPlatform) " 'AR=${stdenv.cc.targetPrefix}ar rcu'"})
 
     installFlagsArray=( TO_BIN="lua luac" INSTALL_DATA='cp -d' \
-      TO_LIB="${if stdenv.isDarwin then "liblua.${version}.dylib" else "liblua.a liblua.so liblua.so.${luaversion} liblua.so.${version}"}" )
+      TO_LIB="${if stdenv.isDarwin then "liblua.${version}.dylib"
+                else ("liblua.a" + lib.optionalString (!staticOnly) " liblua.so liblua.so.${luaversion} liblua.so.${version}" )}" )
 
     runHook postConfigure
   '';
diff --git a/pkgs/development/interpreters/tcl/tcl-package-hook.sh b/pkgs/development/interpreters/tcl/tcl-package-hook.sh
index 747783cb1c27..41603037931f 100644
--- a/pkgs/development/interpreters/tcl/tcl-package-hook.sh
+++ b/pkgs/development/interpreters/tcl/tcl-package-hook.sh
@@ -2,6 +2,8 @@
 # * wrap any installed executables with a wrapper that configures TCLLIBPATH
 # * write a setup hook that extends the TCLLIBPATH of any anti-dependencies
 
+tclWrapperArgs=( ${tclWrapperArgs-} )
+
 # Add a directory to TCLLIBPATH, provided that it exists
 _addToTclLibPath() {
     local tclPkg="$1"
@@ -50,10 +52,12 @@ wrapTclBins() {
         return
     fi
 
+    tclWrapperArgs+=(--prefix TCLLIBPATH ' ' "$TCLLIBPATH")
+
     find "$tclBinsDir" -type f -executable -print |
         while read -r someBin; do
             echo "Adding TCLLIBPATH wrapper for $someBin"
-            wrapProgram "$someBin" --prefix TCLLIBPATH ' ' "$TCLLIBPATH"
+            wrapProgram "$someBin" "${tclWrapperArgs[@]}"
         done
 }
 
diff --git a/pkgs/development/libraries/cairo/default.nix b/pkgs/development/libraries/cairo/default.nix
index 839b7e9f40b9..f18a7e94f069 100644
--- a/pkgs/development/libraries/cairo/default.nix
+++ b/pkgs/development/libraries/cairo/default.nix
@@ -35,6 +35,13 @@ in stdenv.mkDerivation rec {
       url    = "https://gitlab.freedesktop.org/cairo/cairo/commit/6edf572ebb27b00d3c371ba5ae267e39d27d5b6d.patch";
       sha256 = "112hgrrsmcwxh1r52brhi5lksq4pvrz4xhkzcf2iqp55jl2pb7n1";
     })
+
+    # Fix PDF output.
+    # https://gitlab.freedesktop.org/cairo/cairo/issues/342
+    (fetchpatch {
+      url = "https://gitlab.freedesktop.org/cairo/cairo/commit/5e34c5a9640e49dcc29e6b954c4187cfc838dbd1.patch";
+      sha256 = "yCwsDUY7efVvOZkA6a0bPS+RrVc8Yk9bfPwWHeOjq5o=";
+    })
   ] ++ optionals stdenv.hostPlatform.isDarwin [
     # Workaround https://gitlab.freedesktop.org/cairo/cairo/-/issues/121
     ./skip-configure-stderr-check.patch
@@ -64,14 +71,15 @@ in stdenv.mkDerivation rec {
     ++ optional glSupport libGL
     ; # TODO: maybe liblzo but what would it be for here?
 
-  configureFlags = (if stdenv.isDarwin then [
+  configureFlags = [
+    "--enable-tee"
+  ] ++ (if stdenv.isDarwin then [
     "--disable-dependency-tracking"
     "--enable-quartz"
     "--enable-quartz-font"
     "--enable-quartz-image"
     "--enable-ft"
-  ] else ([ "--enable-tee" ]
-    ++ optional xcbSupport "--enable-xcb"
+  ] else (optional xcbSupport "--enable-xcb"
     ++ optional glSupport "--enable-gl"
     ++ optional pdfSupport "--enable-pdf"
   )) ++ optional (!x11Support) "--disable-xlib";
diff --git a/pkgs/development/libraries/enchant/2.x.nix b/pkgs/development/libraries/enchant/2.x.nix
index 93815308f9c0..f2a4ae31346e 100644
--- a/pkgs/development/libraries/enchant/2.x.nix
+++ b/pkgs/development/libraries/enchant/2.x.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation rec {
   pname = "enchant";
-  version = "2.2.15";
+  version = "2.3.0";
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
     url = "https://github.com/AbiWord/${pname}/releases/download/v${version}/${pname}-${version}.tar.gz";
-    sha256 = "sha256-Ow8iFVeBFfKOKmqlSbNRKGADlDBL151vKLDTs9b0bAM=";
+    sha256 = "sha256-32gGO2wTskX6ckaw4JigPnT3qRxtiUe8XE9CzlXi5B0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/fontconfig/default.nix b/pkgs/development/libraries/fontconfig/default.nix
index c0846edbbfe4..075c810131c7 100644
--- a/pkgs/development/libraries/fontconfig/default.nix
+++ b/pkgs/development/libraries/fontconfig/default.nix
@@ -3,6 +3,7 @@
 , substituteAll
 , fetchurl
 , pkg-config
+, python3
 , freetype
 , expat
 , libxslt
@@ -14,67 +15,29 @@
 
 stdenv.mkDerivation rec {
   pname = "fontconfig";
-  version = "2.13.92";
+  version = "2.13.93";
 
   src = fetchurl {
     url = "http://fontconfig.org/release/${pname}-${version}.tar.xz";
-    sha256 = "0kkfsvxcvcphm9zcgsh646gix3qn4spz555wa1jp5hbq70l62vjh";
+    sha256 = "1850q4k80yxma5g3yxkvyv8i5a3xqzswwml8gjy3jmywx8qqd5pa";
   };
 
   patches = [
-    # Fix fonts not being loaded when missing included configs that have ignore_missing="yes".
-    # https://bugzilla.redhat.com/show_bug.cgi?id=1744377
+    # Fix build with no docbook2html.
     (fetchpatch {
-      url = "https://gitlab.freedesktop.org/fontconfig/fontconfig/commit/fcada522913e5e07efa6367eff87ace9f06d24c8.patch";
-      sha256 = "1jbm3vw45b3qjnqrh2545v1k8vmb29c09v2wj07jnrq3lnchbvmn";
+      url = "https://gitlab.freedesktop.org/fontconfig/fontconfig/-/commit/60ce9b695ee9d1ac514a61f562e210d3278ba605.patch";
+      sha256 = "0hfd2jdvsgackdp29dyzf5b1277pnbacihxqh9vdn63rr932ipra";
     })
-
-    # Register JoyPixels as an emoji font.
-    # https://gitlab.freedesktop.org/fontconfig/fontconfig/merge_requests/67
-    (fetchpatch {
-      url = "https://gitlab.freedesktop.org/fontconfig/fontconfig/commit/65087ac7ce4cc5f2109967c1380b474955dcb590.patch";
-      sha256 = "1dkrbqx1c1d8yfnx0igvv516wanw2ksrpm3fbpm2h9nw0hccwqvm";
-    })
-
-    # Fix invalid DTD in reset-dirs.
-    # https://gitlab.freedesktop.org/fontconfig/fontconfig/merge_requests/78
-    (fetchpatch {
-      url = "https://gitlab.freedesktop.org/fontconfig/fontconfig/commit/a4aa66a858f1ecd375c5efe5916398281f73f794.patch";
-      sha256 = "1j4ky8jhpllfm1lh2if34xglh2hl79nsa0xxgzxpj9sx6h4v99j5";
-    })
-
-    # Do not include its tags, they are external now and only cause warnings with old fontconfig clients.
-    # https://gitlab.freedesktop.org/fontconfig/fontconfig/merge_requests/97
-    (fetchpatch {
-      url = "https://gitlab.freedesktop.org/fontconfig/fontconfig/commit/528b17b2837c3b102acd90cc7548d07bacaccb1f.patch";
-      sha256 = "1zf4wcd2xlprh805jalfy8ja5c2qzgkh4fwd1m9d638nl9gx932m";
-    })
-    # https://gitlab.freedesktop.org/fontconfig/fontconfig/merge_requests/100
-    (fetchpatch {
-      url = "https://gitlab.freedesktop.org/fontconfig/fontconfig/commit/37c7c748740bf6f2468d59e67951902710240b34.patch";
-      sha256 = "1rz5zrfwhpn9g49wrzzrmdglj78pbvpnw8ksgsw6bxq8l5d84jfr";
-    })
-
-    # Show warning instead of error when encountering unknown attribute in config.
-    # https://gitlab.freedesktop.org/fontconfig/fontconfig/merge_requests/111
-    (fetchpatch {
-      url = "https://gitlab.freedesktop.org/fontconfig/fontconfig/commit/409b37c62780728755c908991c912a6b16f2389c.patch";
-      sha256 = "zJFh37QErSAINPGFkFVJyhYRP27BuIN7PIgoDl/PIwI=";
-    })
-
-    # Combination of
-    # https://gitlab.freedesktop.org/fontconfig/fontconfig/-/merge_requests/88
-    # https://gitlab.freedesktop.org/fontconfig/fontconfig/-/merge_requests/131
-    ./macos-atomics.h
   ];
 
   outputs = [ "bin" "dev" "lib" "out" ]; # $out contains all the config
 
   nativeBuildInputs = [
+    autoreconfHook
     gperf
     libxslt
     pkg-config
-    autoreconfHook
+    python3
   ];
 
   buildInputs = [
@@ -85,6 +48,11 @@ stdenv.mkDerivation rec {
     freetype
   ];
 
+  postPatch = ''
+    # Requires networking.
+    sed -i '/check_PROGRAMS += test-crbug1004254/d' test/Makefile.am
+  '';
+
   configureFlags = [
     "--sysconfdir=/etc"
     "--with-arch=${stdenv.hostPlatform.parsed.cpu.name}"
diff --git a/pkgs/development/libraries/fontconfig/macos-atomics.h b/pkgs/development/libraries/fontconfig/macos-atomics.h
deleted file mode 100644
index 07b0cf1d52dc..000000000000
--- a/pkgs/development/libraries/fontconfig/macos-atomics.h
+++ /dev/null
@@ -1,39 +0,0 @@
---- a/src/fcatomic.h	2020-11-27 13:23:44.000000000 +0900
-+++ b/src/fcatomic.h	2020-11-27 13:24:43.000000000 +0900
-@@ -70,24 +70,25 @@
- #elif !defined(FC_NO_MT) && defined(__APPLE__)
- 
- #include <libkern/OSAtomic.h>
--#ifdef __MAC_OS_X_MIN_REQUIRED
- #include <AvailabilityMacros.h>
--#elif defined(__IPHONE_OS_MIN_REQUIRED)
--#include <Availability.h>
--#endif
- 
- typedef int fc_atomic_int_t;
- #define fc_atomic_int_add(AI, V)	(OSAtomicAdd32Barrier ((V), &(AI)) - (V))
- 
--#define fc_atomic_ptr_get(P)		(OSMemoryBarrier (), (void *) *(P))
--#if (MAC_OS_X_VERSION_MIN_REQUIRED > MAC_OS_X_VERSION_10_4 || __IPHONE_VERSION_MIN_REQUIRED >= 20100)
--#define fc_atomic_ptr_cmpexch(P,O,N)	OSAtomicCompareAndSwapPtrBarrier ((void *) (O), (void *) (N), (void **) (P))
--#else
--#if __ppc64__ || __x86_64__
--#define fc_atomic_ptr_cmpexch(P,O,N)	OSAtomicCompareAndSwap64Barrier ((int64_t) (O), (int64_t) (N), (int64_t*) (P))
-+#if (MAC_OS_X_VERSION_MIN_REQUIRED > MAC_OS_X_VERSION_10_4 || __IPHONE_OS_VERSION_MIN_REQUIRED >= 20100)
-+
-+#if SIZEOF_VOID_P == 8
-+#define fc_atomic_ptr_get(P)		OSAtomicAdd64Barrier (0, (int64_t*)(P))
-+#elif SIZEOF_VOID_P == 4
-+#define fc_atomic_ptr_get(P)		OSAtomicAdd32Barrier (0, (int32_t*)(P))
- #else
--#define fc_atomic_ptr_cmpexch(P,O,N)	OSAtomicCompareAndSwap32Barrier ((int32_t) (O), (int32_t) (N), (int32_t*) (P))
-+#error "SIZEOF_VOID_P not 4 or 8 (assumes CHAR_BIT is 8)"
- #endif
-+
-+#define fc_atomic_ptr_cmpexch(P,O,N)	OSAtomicCompareAndSwapPtrBarrier ((void *) (O), (void *) (N), (void **) (P))
-+
-+#else
-+#error "Your macOS / iOS targets are too old"
- #endif
- 
- #elif !defined(FC_NO_MT) && defined(HAVE_INTEL_ATOMIC_PRIMITIVES)
diff --git a/pkgs/development/libraries/gdbm/default.nix b/pkgs/development/libraries/gdbm/default.nix
index 16c045cd68ef..83df37f236be 100644
--- a/pkgs/development/libraries/gdbm/default.nix
+++ b/pkgs/development/libraries/gdbm/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gdbm";
-  version = "1.19";
+  version = "1.20";
 
   src = fetchurl {
     url = "mirror://gnu/gdbm/${pname}-${version}.tar.gz";
-    sha256 = "sha256-N+0SIUEiuXLhig2UmVA55XdIGRk573QRWx1B2IETZLw=";
+    sha256 = "sha256-OurAVkizSCoQotqYa586OAoprWUL6AuYF6Q1+4EUopI=";
   };
 
   doCheck = true; # not cross;
diff --git a/pkgs/development/libraries/glib/default.nix b/pkgs/development/libraries/glib/default.nix
index e15f59757862..3c8fe4d569fa 100644
--- a/pkgs/development/libraries/glib/default.nix
+++ b/pkgs/development/libraries/glib/default.nix
@@ -45,11 +45,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "glib";
-  version = "2.68.2";
+  version = "2.68.3";
 
   src = fetchurl {
     url = "mirror://gnome/sources/glib/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-7Md5ipzANOq9/X8kbm3UYc2/EXX8wumGfMfae3MJ4Ps=";
+    sha256 = "0f1iprj7v0b5wn9njj39dkl25g6filfs7i4ybk20jq821k1a7qg7";
   };
 
   patches = optionals stdenv.isDarwin [
diff --git a/pkgs/development/libraries/gtkmm/3.x.nix b/pkgs/development/libraries/gtkmm/3.x.nix
index 0f6811815f60..2e43e58db42d 100644
--- a/pkgs/development/libraries/gtkmm/3.x.nix
+++ b/pkgs/development/libraries/gtkmm/3.x.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gtkmm";
-  version = "3.24.4";
+  version = "3.24.5";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-m+txw+kM/Pt5A5a1Hj9ecWmWZ1Hv1PPvlpcRS+O+Z0M=";
+    sha256 = "1ri2msp3cmzi6r65ghwb8gfavfaxv0axpwi3q60nm7v8hvg36qw5";
   };
 
   outputs = [ "out" "dev" ];
diff --git a/pkgs/development/libraries/gtkmm/4.x.nix b/pkgs/development/libraries/gtkmm/4.x.nix
index 50839568462f..0a654d9518dc 100644
--- a/pkgs/development/libraries/gtkmm/4.x.nix
+++ b/pkgs/development/libraries/gtkmm/4.x.nix
@@ -17,13 +17,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gtkmm";
-  version = "4.0.1";
+  version = "4.2.0";
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-iXPZvHhI4CyyBR4F8+46S6/+L+tK9KVIfw4xMu7AOIQ=";
+    sha256 = "12x9j82y37r4v0ngs22rzp4wmw7k2bbb9d3bymcczzz7y8w4q328";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/libdvdnav/default.nix b/pkgs/development/libraries/libdvdnav/default.nix
index 3eb1032b2a79..8414605593de 100644
--- a/pkgs/development/libraries/libdvdnav/default.nix
+++ b/pkgs/development/libraries/libdvdnav/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libdvdnav";
-  version = "6.1.0";
+  version = "6.1.1";
 
   src = fetchurl {
     url = "http://get.videolan.org/libdvdnav/${version}/${pname}-${version}.tar.bz2";
-    sha256 = "0nzf1ir27s5vs1jrisdiw9ag2sc160k3gv7nplv9ypppm5gb35zn";
+    sha256 = "sha256-wZGnR1lH0yP/doDPksD7G+gjdwGIXzdlbGTQTpjRjUg=";
   };
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/development/libraries/libmbim/default.nix b/pkgs/development/libraries/libmbim/default.nix
index ef13fdc9de12..43a88f9dd5fb 100644
--- a/pkgs/development/libraries/libmbim/default.nix
+++ b/pkgs/development/libraries/libmbim/default.nix
@@ -11,11 +11,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libmbim";
-  version = "1.24.6";
+  version = "1.24.8";
 
   src = fetchurl {
     url = "https://www.freedesktop.org/software/libmbim/${pname}-${version}.tar.xz";
-    sha256 = "sha256-dgRlyqoczWmcFCkOl5HaRW1TAN0R6/TBSGFRAz6HXf0=";
+    sha256 = "sha256-AlkHNhY//xDlcyGR/MwbmSCWlhbdxZYToAMFKhFqPCU=";
   };
 
   outputs = [ "out" "dev" "man" ];
diff --git a/pkgs/development/libraries/libqmi/default.nix b/pkgs/development/libraries/libqmi/default.nix
index a812a2d78489..157445cfee82 100644
--- a/pkgs/development/libraries/libqmi/default.nix
+++ b/pkgs/development/libraries/libqmi/default.nix
@@ -15,13 +15,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libqmi";
-  version = "1.28.4";
+  version = "1.28.6";
 
   outputs = [ "out" "dev" "devdoc" ];
 
   src = fetchurl {
     url = "https://www.freedesktop.org/software/libqmi/${pname}-${version}.tar.xz";
-    sha256 = "sha256-OxTNKrUiGnrbs5/tFu9pdTjqHHkwiCGtLRm1BeHarqA=";
+    sha256 = "1zg5k8f6l87iy9hmzwckdx532s845z9c5npblmpf1pp17n4r1f6b";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/libsoup/default.nix b/pkgs/development/libraries/libsoup/default.nix
index 960591d1a22d..0cc4c8b3453a 100644
--- a/pkgs/development/libraries/libsoup/default.nix
+++ b/pkgs/development/libraries/libsoup/default.nix
@@ -1,6 +1,24 @@
-{ stdenv, lib, fetchurl, fetchpatch, glib, libxml2, meson, ninja, pkg-config, gnome, libsysprof-capture
-, gnomeSupport ? true, sqlite, glib-networking, gobject-introspection, vala
-, libpsl, python3, brotli
+{ stdenv
+, lib
+, fetchurl
+, glib
+, libxml2
+, meson
+, ninja
+, pkg-config
+, gnome
+, libsysprof-capture
+, gnomeSupport ? true
+, sqlite
+, glib-networking
+, gobject-introspection
+, withIntrospection ? stdenv.buildPlatform == stdenv.hostPlatform
+, vala
+, withVala ? stdenv.buildPlatform == stdenv.hostPlatform
+, libpsl
+, python3
+, brotli
+, fetchpatch
 }:
 
 stdenv.mkDerivation rec {
@@ -35,7 +53,9 @@ stdenv.mkDerivation rec {
   ] ++ lib.optionals stdenv.isLinux [
     libsysprof-capture
   ];
-  nativeBuildInputs = [ meson ninja pkg-config gobject-introspection vala glib ];
+  nativeBuildInputs = [ meson ninja pkg-config glib ]
+    ++ lib.optional withIntrospection gobject-introspection
+    ++ lib.optional withVala vala;
   propagatedBuildInputs = [ glib libxml2 ];
 
   NIX_CFLAGS_COMPILE = [ "-lpthread" ];
@@ -43,7 +63,8 @@ stdenv.mkDerivation rec {
   mesonFlags = [
     "-Dtls_check=false" # glib-networking is a runtime dependency, not a compile-time dependency
     "-Dgssapi=disabled"
-    "-Dvapi=enabled"
+    "-Dvapi=${if withVala then "enabled" else "disabled"}"
+    "-Dintrospection=${if withIntrospection then "enabled" else "disabled"}"
     "-Dgnome=${lib.boolToString gnomeSupport}"
     "-Dntlm=disabled"
   ] ++ lib.optionals (!stdenv.isLinux) [
diff --git a/pkgs/development/libraries/libvpx/1_8.nix b/pkgs/development/libraries/libvpx/1_8.nix
index f1a2bf377cc0..befbafd5a4ec 100644
--- a/pkgs/development/libraries/libvpx/1_8.nix
+++ b/pkgs/development/libraries/libvpx/1_8.nix
@@ -69,7 +69,14 @@ stdenv.mkDerivation rec {
 #    ./CVE-2019-9232.CVE-2019-9325.CVE-2019-9371.CVE-2019-9433.patch
   ];
 
-  postPatch = "patchShebangs .";
+  postPatch = ''
+    patchShebangs --build \
+      build/make/*.sh \
+      build/make/*.pl \
+      build/make/*.pm \
+      test/*.sh \
+      configure
+  '';
 
   outputs = [ "bin" "dev" "out" ];
   setOutputFlags = false;
@@ -135,11 +142,6 @@ stdenv.mkDerivation rec {
                     experimentalFpMbStatsSupport ||
                     experimentalEmulateHardwareSupport) "experimental")
   ] ++ optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
-    #"--extra-cflags="
-    #"--extra-cxxflags="
-    #"--prefix="
-    #"--libc="
-    #"--libdir="
     "--enable-external-build"
     # libvpx darwin targets include darwin version (ie. ARCH-darwinXX-gcc, XX being the darwin version)
     # See all_platforms: https://github.com/webmproject/libvpx/blob/master/configure
diff --git a/pkgs/development/libraries/libvpx/default.nix b/pkgs/development/libraries/libvpx/default.nix
index f19183966163..d538aa41bff3 100644
--- a/pkgs/development/libraries/libvpx/default.nix
+++ b/pkgs/development/libraries/libvpx/default.nix
@@ -65,7 +65,21 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-EZP33U10fchyqy7Jr26vHgUUfWR6xtG3fcMWUII0m9w=";
   };
 
-  postPatch = "patchShebangs .";
+  postPatch = ''
+    patchShebangs --build \
+      build/make/*.sh \
+      build/make/*.pl \
+      build/make/*.pm \
+      test/*.sh \
+      configure
+
+    # When cross-compiling (for aarch64-multiplatform), the compiler errors out on these flags.
+    # Since they're 'just' warnings, it's fine to just remove them.
+    substituteInPlace configure \
+      --replace "check_add_cflags -Wparentheses-equality" "" \
+      --replace "check_add_cflags -Wunreachable-code-loop-increment" "" \
+      --replace "check_cflags -Wshorten-64-to-32 && add_cflags_only -Wshorten-64-to-32" ""
+  '';
 
   outputs = [ "bin" "dev" "out" ];
   setOutputFlags = false;
@@ -131,12 +145,6 @@ stdenv.mkDerivation rec {
                     experimentalFpMbStatsSupport ||
                     experimentalEmulateHardwareSupport) "experimental")
   ] ++ optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
-    #"--extra-cflags="
-    #"--extra-cxxflags="
-    #"--prefix="
-    #"--libc="
-    #"--libdir="
-    "--enable-external-build"
     # libvpx darwin targets include darwin version (ie. ARCH-darwinXX-gcc, XX being the darwin version)
     # See all_platforms: https://github.com/webmproject/libvpx/blob/master/configure
     # Darwin versions: 10.4=8, 10.5=9, 10.6=10, 10.7=11, 10.8=12, 10.9=13, 10.10=14
diff --git a/pkgs/development/libraries/mesa/default.nix b/pkgs/development/libraries/mesa/default.nix
index bdecfe0d57ad..aaa78de47f75 100644
--- a/pkgs/development/libraries/mesa/default.nix
+++ b/pkgs/development/libraries/mesa/default.nix
@@ -31,7 +31,7 @@ with lib;
 let
   # Release calendar: https://www.mesa3d.org/release-calendar.html
   # Release frequency: https://www.mesa3d.org/releasing.html#schedule
-  version = "21.1.3";
+  version = "21.1.4";
   branch  = versions.major version;
 
 self = stdenv.mkDerivation {
@@ -45,7 +45,7 @@ self = stdenv.mkDerivation {
       "ftp://ftp.freedesktop.org/pub/mesa/${version}/mesa-${version}.tar.xz"
       "ftp://ftp.freedesktop.org/pub/mesa/older-versions/${branch}.x/${version}/mesa-${version}.tar.xz"
     ];
-    sha256 = "0s8yi7y63xsyqw19ihil18fykkjxr6ibcir2fvymz1vh4ql23qnb";
+    sha256 = "02z9g6zpkg1p1sm8f84xdi7v2n7x534x9pn565bvcr411527y5qz";
   };
 
   prePatch = "patchShebangs .";
diff --git a/pkgs/development/libraries/pango/default.nix b/pkgs/development/libraries/pango/default.nix
index cfd0ff23259c..c75e33a0686e 100644
--- a/pkgs/development/libraries/pango/default.nix
+++ b/pkgs/development/libraries/pango/default.nix
@@ -24,14 +24,14 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "pango";
-  version = "1.48.4";
+  version = "1.48.5";
 
   outputs = [ "bin" "out" "dev" ]
     ++ lib.optionals withDocs [ "devdoc" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "0ym3cvajy2asapj8xbhfpy05rak79afrhi32hiss0w900vxi72a1";
+    sha256 = "0aivpd6l5687lj5293j859zd7vq97yxpzvad0b6jvh3kc54p87jh";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/protobuf/3.17.nix b/pkgs/development/libraries/protobuf/3.17.nix
new file mode 100644
index 000000000000..d869b9ce76ef
--- /dev/null
+++ b/pkgs/development/libraries/protobuf/3.17.nix
@@ -0,0 +1,6 @@
+{ callPackage, ... }:
+
+callPackage ./generic-v3.nix {
+  version = "3.17.3";
+  sha256 = "08644kaxhpjs38q5q4fp01yr0wakg1ijha4g3lzp2ifg7y3c465d";
+}
diff --git a/pkgs/development/libraries/science/math/liblapack/default.nix b/pkgs/development/libraries/science/math/liblapack/default.nix
index 50563f2745ab..66f343d4912d 100644
--- a/pkgs/development/libraries/science/math/liblapack/default.nix
+++ b/pkgs/development/libraries/science/math/liblapack/default.nix
@@ -7,7 +7,7 @@
 }:
 let
   inherit (lib) optional;
-  version = "3.9.0";
+  version = "3.9.1";
 in
 
 stdenv.mkDerivation rec {
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
     owner = "Reference-LAPACK";
     repo = "lapack";
     rev = "v${version}";
-    sha256 = "0sxnc97z67i7phdmcnq8f8lmxgw10wdwvr8ami0w3pb179cgrbpb";
+    sha256 = "sha256-B7eRaEY9vaLvuKkJ7d2KWanGE7OXh43O0UbXFheUWK8=";
   };
 
   nativeBuildInputs = [ gfortran cmake ];
diff --git a/pkgs/development/libraries/silgraphite/graphite2.nix b/pkgs/development/libraries/silgraphite/graphite2.nix
index cd737a82a293..25f4b5e13177 100644
--- a/pkgs/development/libraries/silgraphite/graphite2.nix
+++ b/pkgs/development/libraries/silgraphite/graphite2.nix
@@ -1,4 +1,11 @@
-{ lib, stdenv, fetchurl, pkg-config, freetype, cmake }:
+{ lib
+, stdenv
+, fetchurl
+, pkg-config
+, freetype
+, cmake
+, static ? stdenv.hostPlatform.isStatic
+}:
 
 stdenv.mkDerivation rec {
   version = "1.3.14";
@@ -15,7 +22,22 @@ stdenv.mkDerivation rec {
 
   patches = lib.optionals stdenv.isDarwin [ ./macosx.patch ];
 
-  doCheck = false; # fails, probably missing something
+  cmakeFlags = lib.optionals static [
+    "-DBUILD_SHARED_LIBS=OFF"
+  ];
+
+  # Remove a test that fails to statically link (undefined reference to png and
+  # freetype symbols)
+  postConfigure = lib.optionals static ''
+    sed -e '/freetype freetype.c/d' -i ../tests/examples/CMakeLists.txt
+  '';
+
+  preCheck = ''
+    export LD_LIBRARY_PATH=$LD_LIBRARY_PATH''${LD_LIBRARY_PATH:+:}$PWD/src/
+    export DYLD_LIBRARY_PATH=$DYLD_LIBRARY_PATH''${DYLD_LIBRARY_PATH:+:}$PWD/src/
+  '';
+
+  doCheck = true;
 
   meta = with lib; {
     description = "An advanced font engine";
diff --git a/pkgs/development/ocaml-modules/camlimages/4.1.2.nix b/pkgs/development/ocaml-modules/camlimages/4.1.2.nix
deleted file mode 100644
index dba303afdf24..000000000000
--- a/pkgs/development/ocaml-modules/camlimages/4.1.2.nix
+++ /dev/null
@@ -1,37 +0,0 @@
-{ lib, stdenv, fetchFromGitLab, fetchpatch, omake, ocaml, findlib
-, graphicsmagick, ghostscript
-, freetype, giflib, libjpeg, libpng, libtiff, libXpm
-}:
-
-stdenv.mkDerivation rec {
-  pname = "camlimages";
-  version = "4.1.2";
-
-  src = fetchFromGitLab {
-    owner = "camlspotter";
-    repo = "camlimages";
-    rev = "98661d507e12ce91a51295a50f244cb8265b4439"; # no tag
-    sha256 = "0kpxj8wm2m17wjq217jzjpfgv1d7sp4w1yd1gi8ipn5rj4sid2j8";
-  };
-
-  buildInputs = [ ocaml omake findlib graphicsmagick ghostscript ];
-  propagatedBuildInputs = [ libtiff libjpeg libpng giflib freetype libXpm ];
-
-  createFindlibDestdir = true;
-
-  buildPhase = ''
-    omake
-  '';
-
-  installPhase = ''
-    omake install
-  '';
-
-  meta = with lib; {
-    branch = "4.1";
-    homepage = "https://gitlab.com/camlspotter/camlimages";
-    description = "OCaml image processing library";
-    license = licenses.lgpl2;
-    maintainers = [ maintainers.vbgl ];
-  };
-}
diff --git a/pkgs/development/ocaml-modules/camlimages/4.2.4.nix b/pkgs/development/ocaml-modules/camlimages/4.2.4.nix
new file mode 100644
index 000000000000..8ed562a27e69
--- /dev/null
+++ b/pkgs/development/ocaml-modules/camlimages/4.2.4.nix
@@ -0,0 +1,75 @@
+{ stdenv
+, lib
+, fetchFromGitLab
+, ocaml
+, findlib
+, omake
+, graphicsmagick
+, libpng
+, libjpeg
+, libexif
+, libtiff
+, libXpm
+, freetype
+, giflib
+, ghostscript
+}:
+
+assert lib.versionOlder ocaml.version "4.06";
+
+stdenv.mkDerivation rec {
+  name = "ocaml${ocaml.version}-${pname}-${version}";
+  pname = "camlimages";
+  version = "4.2.4";
+
+  src = fetchFromGitLab {
+    owner = "camlspotter";
+    repo = pname;
+    rev = "c4f0ec4178fd18cb85872181965c5f020c349160";
+    sha256 = "17hvsql5dml7ialjcags8wphs7w6z88b2rgjir1382bg8vn62bkr";
+  };
+
+  nativeBuildInputs = [
+    omake
+    ocaml
+    findlib
+    graphicsmagick
+  ];
+
+  propagatedBuildInputs = [
+    libpng
+    libjpeg
+    libexif
+    libtiff
+    libXpm
+    freetype
+    giflib
+    ghostscript
+  ];
+
+  buildPhase = ''
+    runHook preBuild
+    omake
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preBuild
+    omake install
+    runHook postBuild
+  '';
+
+  createFindlibDestdir = true;
+
+  meta = with lib; {
+    # 4.2.5 requires OCaml >= 4.06
+    branch = "4.2.4";
+    homepage = "https://gitlab.com/camlspotter/camlimages";
+    description = "OCaml image processing library";
+    license = licenses.lgpl2Only;
+    maintainers = [
+      maintainers.vbgl
+      maintainers.sternenseemann
+    ];
+  };
+}
diff --git a/pkgs/development/python-modules/graphviz/default.nix b/pkgs/development/python-modules/graphviz/default.nix
index 1a0e6d903a47..0a2413e9d761 100644
--- a/pkgs/development/python-modules/graphviz/default.nix
+++ b/pkgs/development/python-modules/graphviz/default.nix
@@ -8,7 +8,6 @@
 , mock
 , pytestCheckHook
 , pytest-mock
-, pytestcov
 }:
 
 buildPythonPackage rec {
@@ -30,12 +29,20 @@ buildPythonPackage rec {
     })
   ];
 
+  postPatch = ''
+    sed -i "/--cov/d" setup.cfg
+  '';
+
   # Fontconfig error: Cannot load default config file
   FONTCONFIG_FILE = makeFontsConf {
     fontDirectories = [ freefont_ttf ];
   };
 
-  checkInputs = [ mock pytestCheckHook pytest-mock pytestcov ];
+  checkInputs = [ mock pytestCheckHook pytest-mock ];
+
+  preCheck = ''
+    export HOME=$TMPDIR
+  '';
 
   meta = with lib; {
     description = "Simple Python interface for Graphviz";
diff --git a/pkgs/development/python-modules/transitions/default.nix b/pkgs/development/python-modules/transitions/default.nix
index c469875728cd..752cd8fb4d55 100644
--- a/pkgs/development/python-modules/transitions/default.nix
+++ b/pkgs/development/python-modules/transitions/default.nix
@@ -33,6 +33,7 @@ buildPythonPackage rec {
 
   preCheck = ''
     export FONTCONFIG_FILE=${fontconfig.out}/etc/fonts/fonts.conf
+    export HOME=$TMPDIR
   '';
 
   meta = with lib; {
diff --git a/pkgs/development/ruby-modules/bundler/default.nix b/pkgs/development/ruby-modules/bundler/default.nix
index fc2733de3f00..912bace20201 100644
--- a/pkgs/development/ruby-modules/bundler/default.nix
+++ b/pkgs/development/ruby-modules/bundler/default.nix
@@ -4,8 +4,8 @@ buildRubyGem rec {
   inherit ruby;
   name = "${gemName}-${version}";
   gemName = "bundler";
-  version = "2.1.4";
-  source.sha256 = "12glbb1357x91fvd004jgkw7ihlkpc9dwr349pd7j83isqhls0ah";
+  version = "2.2.20";
+  source.sha256 = "259ba486173d72a71df43fee8e3bc8dcb868c8a65e0c4020af3a6f13c3a57ff8";
   dontPatchShebangs = true;
 
   postFixup = ''
diff --git a/pkgs/development/tools/eclipse-mat/default.nix b/pkgs/development/tools/eclipse-mat/default.nix
index 608c721caf00..01146542d0cc 100644
--- a/pkgs/development/tools/eclipse-mat/default.nix
+++ b/pkgs/development/tools/eclipse-mat/default.nix
@@ -20,7 +20,7 @@
 
 with lib;
 let
-  pVersion = "1.11.0.20201202";
+  pVersion = "1.12.0.20210602";
   pVersionTriple = splitVersion pVersion;
   majorVersion = elemAt pVersionTriple 0;
   minorVersion = elemAt pVersionTriple 1;
@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "http://ftp.halifax.rwth-aachen.de/eclipse//mat/${baseVersion}/rcp/MemoryAnalyzer-${version}-linux.gtk.x86_64.zip";
-    sha256 = "sha256-HtIKcGfdjb2wovGGSxv16ud7y1cPQFBn77pkhiekAkI=";
+    sha256 = "sha256-qX4RPuZdeiEduJAEpzOi/QnbJ+kaD0PZ3WHrmGsvqHc=";
   };
 
   desktopItem = makeDesktopItem {
diff --git a/pkgs/games/scid-vs-pc/default.nix b/pkgs/games/scid-vs-pc/default.nix
index 2837f96357a7..9d3cdeb02e93 100644
--- a/pkgs/games/scid-vs-pc/default.nix
+++ b/pkgs/games/scid-vs-pc/default.nix
@@ -42,6 +42,7 @@ tcl.mkTclDerivation rec {
 
   dontPatchShebangs = true;
 
+  # TODO: can this use tclWrapperArgs?
   postFixup = ''
     sed -i -e '1c#!'"$out"'/bin/tcscid' "$out/bin/scidpgn"
     sed -i -e '1c#!${tk}/bin/wish' "$out/bin/sc_remote"
diff --git a/pkgs/games/scid/default.nix b/pkgs/games/scid/default.nix
index 43794f6bc255..a1955e9cced0 100644
--- a/pkgs/games/scid/default.nix
+++ b/pkgs/games/scid/default.nix
@@ -31,6 +31,7 @@ tcl.mkTclDerivation {
 
   dontPatchShebangs = true;
 
+  # TODO: can this use tclWrapperArgs?
   postFixup = ''
     for cmd in sc_addmove sc_eco sc_epgn scidpgn \
                sc_import sc_spell sc_tree spliteco
diff --git a/pkgs/os-specific/darwin/apple-sdk-11.0/private-frameworks.nix b/pkgs/os-specific/darwin/apple-sdk-11.0/private-frameworks.nix
index bb4300d623a4..b8786ec92f6d 100644
--- a/pkgs/os-specific/darwin/apple-sdk-11.0/private-frameworks.nix
+++ b/pkgs/os-specific/darwin/apple-sdk-11.0/private-frameworks.nix
@@ -15,4 +15,7 @@
   SignpostMetrics = {};
   PassKitCore = {};
   SkyLight = {};
+
+  # Also expose CoreSymbolication; used by `root` package.
+  CoreSymbolication = {};
 }
diff --git a/pkgs/stdenv/generic/setup.sh b/pkgs/stdenv/generic/setup.sh
index a73474c952e5..066ef6ed9eb3 100644
--- a/pkgs/stdenv/generic/setup.sh
+++ b/pkgs/stdenv/generic/setup.sh
@@ -1,6 +1,12 @@
 set -eu
 set -o pipefail
 
+if [ -n "${BASH_VERSINFO-}" ] && [ "${BASH_VERSINFO-}" -lt 4 ]; then
+    echo "Detected Bash version that isn't supported by Nixpkgs (${BASH_VERSION})"
+    echo "Please install Bash 4 or greater to continue."
+    exit 1
+fi
+
 if (( "${NIX_DEBUG:-0}" >= 6 )); then
     set -x
 fi
diff --git a/pkgs/test/default.nix b/pkgs/test/default.nix
index 8c9e7b6f2813..ebf732839cea 100644
--- a/pkgs/test/default.nix
+++ b/pkgs/test/default.nix
@@ -52,6 +52,7 @@ with pkgs;
   cuda = callPackage ./cuda { };
 
   trivial = callPackage ../build-support/trivial-builders/test.nix {};
+  trivial-overriding = callPackage ../build-support/trivial-builders/test-overriding.nix {};
 
   writers = callPackage ../build-support/writers/test.nix {};
 }
diff --git a/pkgs/tools/admin/clair/default.nix b/pkgs/tools/admin/clair/default.nix
index 46989bc24fb0..0298ca29a7c4 100644
--- a/pkgs/tools/admin/clair/default.nix
+++ b/pkgs/tools/admin/clair/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "clair";
-  version = "4.1.0";
+  version = "4.1.1";
 
   src = fetchFromGitHub {
     owner = "quay";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-Ns02Yi0FJPOCpjr1P5c1KOkRZ8saxQzXg/Zn5vYLztU=";
+    sha256 = "sha256-E04G3EJ0JrOVjtTd3nBHZehzuDrvt6t4hfFdGO92uuk=";
   };
 
-  vendorSha256 = "sha256-aFaeRhg+aLOmS7VFbgdxaEtZcBKn9zCVINad6ahpDCo=";
+  vendorSha256 = "sha256-xgP5IhB9eyKOIBlT5jKDJkUy8lz2UrWmGqqeDhqRawY=";
 
   doCheck = false;
 
diff --git a/pkgs/tools/graphics/graphviz/base.nix b/pkgs/tools/graphics/graphviz/base.nix
index 1a387042b2d5..f225f2196cc8 100644
--- a/pkgs/tools/graphics/graphviz/base.nix
+++ b/pkgs/tools/graphics/graphviz/base.nix
@@ -2,7 +2,7 @@
 
 { lib, stdenv, fetchFromGitLab, autoreconfHook, pkg-config, cairo, expat, flex
 , fontconfig, gd, gettext, gts, libdevil, libjpeg, libpng, libtool, pango
-, bison, fetchpatch, xorg ? null, ApplicationServices }:
+, bison, fetchpatch, xorg, ApplicationServices, python3 }:
 
 let
   inherit (lib) optional optionals optionalString;
@@ -41,7 +41,7 @@ stdenv.mkDerivation {
     inherit sha256 rev;
   };
 
-  nativeBuildInputs = [ autoreconfHook pkg-config ];
+  nativeBuildInputs = [ autoreconfHook pkg-config python3 ];
 
   buildInputs = [
     libpng libjpeg expat bison libtool fontconfig gd gts libdevil flex pango
diff --git a/pkgs/tools/graphics/graphviz/default.nix b/pkgs/tools/graphics/graphviz/default.nix
index c79fe3aaf4d5..0662205d17e9 100644
--- a/pkgs/tools/graphics/graphviz/default.nix
+++ b/pkgs/tools/graphics/graphviz/default.nix
@@ -1,5 +1,5 @@
 import ./base.nix rec {
-  rev = "da4c2ec6f24ca1b6d1752c6b5bc4389e55682147"; # use rev as tags have disappeared before
-  version = "2.42.2";
-  sha256 = "0lacl11amyvj04j78m63qifljl4c0nkyy50z4bkg8mg9j4hjdy0x";
+  rev = "a11eb938514725493324d18db1686f9a99c8569f"; # use rev as tags have disappeared before
+  version = "2.47.2";
+  sha256 = "sha256-6JFjM/2xl7KVmGhSr6RWgO23UwLDyAif3ONsBG4t/Wc=";
  }
diff --git a/pkgs/tools/misc/desktop-file-utils/default.nix b/pkgs/tools/misc/desktop-file-utils/default.nix
index 09c0e0d25c60..da87d048b709 100644
--- a/pkgs/tools/misc/desktop-file-utils/default.nix
+++ b/pkgs/tools/misc/desktop-file-utils/default.nix
@@ -14,6 +14,11 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ glib libintl ];
 
+  postPatch = ''
+    substituteInPlace src/install.c \
+      --replace \"update-desktop-database\" \"$out/bin/update-desktop-database\"
+  '';
+
   setupHook = ./setup-hook.sh;
 
   meta = {
diff --git a/pkgs/tools/misc/expect/default.nix b/pkgs/tools/misc/expect/default.nix
index 03e8e260ac6b..5a792c040b39 100644
--- a/pkgs/tools/misc/expect/default.nix
+++ b/pkgs/tools/misc/expect/default.nix
@@ -25,10 +25,9 @@ tcl.mkTclDerivation rec {
   strictDeps = true;
   hardeningDisable = [ "format" ];
 
-  postInstall = lib.optionalString stdenv.isDarwin ''
-    for i in $out/bin/*; do
-      wrapProgram $i --prefix DYLD_LIBRARY_PATH : $out/lib/expect${version}
-    done
+  postInstall = ''
+    tclWrapperArgs+=(--prefix PATH : ${lib.makeBinPath [ tcl ]})
+    ${lib.optionalString stdenv.isDarwin "tclWrapperArgs+=(--prefix DYLD_LIBRARY_PATH : $out/lib/expect${version})"}
   '';
 
   outputs = [ "out" "dev" ];
diff --git a/pkgs/tools/networking/modem-manager/default.nix b/pkgs/tools/networking/modem-manager/default.nix
index 71ea50ea1726..2a99c127acbc 100644
--- a/pkgs/tools/networking/modem-manager/default.nix
+++ b/pkgs/tools/networking/modem-manager/default.nix
@@ -1,20 +1,34 @@
-{ lib, stdenv, fetchurl, glib, udev, libgudev, polkit, ppp, gettext, pkg-config
-, libmbim, libqmi, systemd, vala, gobject-introspection, dbus }:
+{ lib, stdenv, fetchurl, fetchpatch
+, glib, udev, libgudev, polkit, ppp, gettext, pkg-config, python3
+, libmbim, libqmi, systemd, vala, gobject-introspection, dbus
+}:
 
 stdenv.mkDerivation rec {
   pname = "modem-manager";
-  version = "1.14.12";
+  version = "1.16.6";
 
-  package = "ModemManager";
   src = fetchurl {
-    url = "https://www.freedesktop.org/software/${package}/${package}-${version}.tar.xz";
-    sha256 = "sha256-0QqXEZndwl3N8VbFasCOkWEsCVOdVlIueu1G1G5IO7E=";
+    url = "https://www.freedesktop.org/software/ModemManager/ModemManager-${version}.tar.xz";
+    sha256 = "05wn94x71qr36avxjzvyf56nj5illynnf9nn15b17lv61wkbd41a";
   };
 
+  patches = [
+    # Fix a broken test.
+    # https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/merge_requests/556
+    (fetchpatch {
+      url = "https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/commit/a324667386f35df0c3b3bbf615fa0560d215485d.patch";
+      sha256 = "1xj9gfl6spbp4xdp6gn76k8zvzam5m6lgmbiwdn6ixffzhlfwi5l";
+    })
+  ];
+
   nativeBuildInputs = [ vala gobject-introspection gettext pkg-config ];
 
   buildInputs = [ glib udev libgudev polkit ppp libmbim libqmi systemd ];
 
+  installCheckInputs = [
+    python3 python3.pkgs.dbus-python python3.pkgs.pygobject3
+  ];
+
   configureFlags = [
     "--with-polkit"
     "--with-udev-base-dir=${placeholder "out"}/lib/udev"
@@ -26,19 +40,29 @@ stdenv.mkDerivation rec {
     "--with-systemd-journal"
   ];
 
-  preCheck = ''
-    export G_TEST_DBUS_DAEMON="${dbus.daemon}/bin/dbus-daemon"
+  postPatch = ''
+    patchShebangs tools/test-modemmanager-service.py
   '';
 
-  enableParallelBuilding = true;
+  # In Nixpkgs g-ir-scanner is patched to produce absolute paths, and
+  # that interferes with ModemManager's tests, causing them to try to
+  # load libraries from the install path, which doesn't usually exist
+  # when `make check' is run.  So to work around that, we run it as an
+  # install check instead, when those paths will have been created.
+  doInstallCheck = true;
+  preInstallCheck = ''
+    export G_TEST_DBUS_DAEMON="${dbus.daemon}/bin/dbus-daemon"
+    patchShebangs tools/tests/test-wrapper.sh
+  '';
+  installCheckTarget = "check";
 
-  doCheck = true;
+  enableParallelBuilding = true;
 
   meta = with lib; {
     description = "WWAN modem manager, part of NetworkManager";
     homepage = "https://www.freedesktop.org/wiki/Software/ModemManager/";
     license = licenses.gpl2Plus;
-    maintainers = [ ];
+    maintainers = teams.freedesktop.members;
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/tools/typesetting/asciidoctor/Gemfile.lock b/pkgs/tools/typesetting/asciidoctor/Gemfile.lock
index 4e321311f28c..3240f65167e1 100644
--- a/pkgs/tools/typesetting/asciidoctor/Gemfile.lock
+++ b/pkgs/tools/typesetting/asciidoctor/Gemfile.lock
@@ -5,15 +5,15 @@ GEM
     addressable (2.7.0)
       public_suffix (>= 2.0.2, < 5.0)
     afm (0.2.2)
-    asciidoctor (2.0.12)
-    asciidoctor-diagram (2.1.0)
+    asciidoctor (2.0.15)
+    asciidoctor-diagram (2.1.2)
       asciidoctor (>= 1.5.7, < 3.x)
-      asciidoctor-diagram-ditaamini (~> 0.13)
+      asciidoctor-diagram-ditaamini (~> 1.0.0)
       asciidoctor-diagram-plantuml (~> 1.2021)
       rexml
-    asciidoctor-diagram-ditaamini (0.13.1)
-    asciidoctor-diagram-plantuml (1.2021.0)
-    asciidoctor-epub3 (1.5.0.alpha.19)
+    asciidoctor-diagram-ditaamini (1.0.0)
+    asciidoctor-diagram-plantuml (1.2021.7)
+    asciidoctor-epub3 (1.5.1)
       asciidoctor (>= 1.5.6, < 3.0.0)
       gepub (~> 1.0.0)
       mime-types (~> 3.0)
@@ -21,67 +21,66 @@ GEM
       asciidoctor (~> 2.0)
       asciimath (~> 2.0)
       mathematical (~> 1.6.0)
-    asciidoctor-pdf (1.5.4)
-      asciidoctor (>= 1.5.3, < 3.0.0)
-      concurrent-ruby (~> 1.1.0)
-      prawn (~> 2.2.0)
-      prawn-icon (~> 2.5.0)
-      prawn-svg (~> 0.31.0)
+    asciidoctor-pdf (1.6.0)
+      asciidoctor (~> 2.0)
+      concurrent-ruby (~> 1.1)
+      prawn (~> 2.4.0)
+      prawn-icon (~> 3.0.0)
+      prawn-svg (~> 0.32.0)
       prawn-table (~> 0.2.0)
       prawn-templates (~> 0.1.0)
       safe_yaml (~> 1.0.0)
-      thread_safe (~> 0.3.0)
       treetop (~> 1.6.0)
-      ttfunk (~> 1.5.0, >= 1.5.1)
     asciidoctor-revealjs (4.1.0)
       asciidoctor (>= 2.0.0, < 3.0.0)
       concurrent-ruby (~> 1.0)
       thread_safe (~> 0.3.5)
     asciimath (2.0.2)
     coderay (1.1.3)
-    concurrent-ruby (1.1.8)
+    concurrent-ruby (1.1.9)
     css_parser (1.9.0)
       addressable
     gepub (1.0.13)
       nokogiri (>= 1.8.2, < 1.12)
       rubyzip (> 1.1.1, < 2.4)
     hashery (2.1.2)
-    i18n (1.8.9)
+    i18n (1.8.10)
       concurrent-ruby (~> 1.0)
     mathematical (1.6.14)
       ruby-enum (~> 0.4)
     mime-types (3.3.1)
       mime-types-data (~> 3.2015)
     mime-types-data (3.2021.0225)
-    mini_portile2 (2.5.0)
-    nokogiri (1.11.1)
+    mini_portile2 (2.5.3)
+    nokogiri (1.11.7)
       mini_portile2 (~> 2.5.0)
       racc (~> 1.4)
-    pdf-core (0.7.0)
-    pdf-reader (2.4.2)
+    pdf-core (0.9.0)
+    pdf-reader (2.5.0)
       Ascii85 (~> 1.0)
       afm (~> 0.2.1)
       hashery (~> 2.0)
       ruby-rc4
       ttfunk
     polyglot (0.3.5)
-    prawn (2.2.2)
-      pdf-core (~> 0.7.0)
-      ttfunk (~> 1.5)
-    prawn-icon (2.5.0)
+    prawn (2.4.0)
+      pdf-core (~> 0.9.0)
+      ttfunk (~> 1.7)
+    prawn-icon (3.0.0)
       prawn (>= 1.1.0, < 3.0.0)
-    prawn-svg (0.31.0)
+    prawn-svg (0.32.0)
       css_parser (~> 1.6)
       prawn (>= 0.11.1, < 3)
+      rexml (~> 3.2)
     prawn-table (0.2.2)
       prawn (>= 1.3.0, < 3.0.0)
     prawn-templates (0.1.2)
       pdf-reader (~> 2.0)
       prawn (~> 2.2)
     public_suffix (4.0.6)
-    pygments.rb (2.1.0)
+    pygments.rb (2.2.0)
     racc (1.5.2)
-    rexml (3.2.4)
+    rexml (3.2.5)
     rouge (3.26.0)
     ruby-enum (0.9.0)
       i18n
@@ -91,7 +90,7 @@ GEM
     thread_safe (0.3.6)
     treetop (1.6.11)
       polyglot (~> 0.3)
-    ttfunk (1.5.1)
+    ttfunk (1.7.0)
 
 PLATFORMS
   ruby
diff --git a/pkgs/tools/typesetting/asciidoctor/gemset.nix b/pkgs/tools/typesetting/asciidoctor/gemset.nix
index 19106214c263..6fe57ff48565 100644
--- a/pkgs/tools/typesetting/asciidoctor/gemset.nix
+++ b/pkgs/tools/typesetting/asciidoctor/gemset.nix
@@ -35,10 +35,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1gjk9v83vw0pz4x0xqqnw231z9sgscm6vnacjw7hy5njkw8fskj9";
+      sha256 = "0k3lijm4dmiz977bfmpclk5glj5jwv7bidamwwwywm60ywb0n4n4";
       type = "gem";
     };
-    version = "2.0.12";
+    version = "2.0.15";
   };
   asciidoctor-diagram = {
     dependencies = ["asciidoctor" "asciidoctor-diagram-ditaamini" "asciidoctor-diagram-plantuml" "rexml"];
@@ -46,30 +46,30 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1fh73k306q1x4rzsly2fy1rdq1kpkdvs3r1084hgk0sh516ksc0s";
+      sha256 = "09ci775f7y7d6spn0fl5wfmfyxianjp4z0p3fwcrzajy63f381v9";
       type = "gem";
     };
-    version = "2.1.0";
+    version = "2.1.2";
   };
   asciidoctor-diagram-ditaamini = {
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "08jwpyklcplmfcxs4z9z0b0la6xdwrnf9bk6c02y54502228bg6b";
+      sha256 = "1frnjz0j00v5hqp5macgnn6jq77jcpjy2l6hqmn5jn5ds7bmi2rl";
       type = "gem";
     };
-    version = "0.13.1";
+    version = "1.0.0";
   };
   asciidoctor-diagram-plantuml = {
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0bxlkq3k775lhhnbs85cx8cbixhw7p70hnxrqnnig470h6jhmj0b";
+      sha256 = "1kcxwbaancxfq08fr7syg8mxsi97jiczxyp4an2x0ymq3mkss0k8";
       type = "gem";
     };
-    version = "1.2021.0";
+    version = "1.2021.7";
   };
   asciidoctor-epub3 = {
     dependencies = ["asciidoctor" "gepub" "mime-types"];
@@ -77,10 +77,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1fgi0rb8026k0a43wnanan6nzc8386azygmfl4zv7c9vram4nr6h";
+      sha256 = "05lylv2k18vcnf3647n47zdqxpa70bg16znzn252ymp8say25zzg";
       type = "gem";
     };
-    version = "1.5.0.alpha.19";
+    version = "1.5.1";
   };
   asciidoctor-mathematical = {
     dependencies = ["asciidoctor" "asciimath" "mathematical"];
@@ -94,15 +94,15 @@
     version = "0.3.5";
   };
   asciidoctor-pdf = {
-    dependencies = ["asciidoctor" "concurrent-ruby" "prawn" "prawn-icon" "prawn-svg" "prawn-table" "prawn-templates" "safe_yaml" "thread_safe" "treetop" "ttfunk"];
+    dependencies = ["asciidoctor" "concurrent-ruby" "prawn" "prawn-icon" "prawn-svg" "prawn-table" "prawn-templates" "safe_yaml" "treetop"];
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0k8hn9lrvr08grqx17x2vrllw5qmfh0j08wp56464w2pj279ka67";
+      sha256 = "0sxfz3qp2j76jlab7fb1d1ylbf0h2nnbkhg019qqch5wkd4k1iw9";
       type = "gem";
     };
-    version = "1.5.4";
+    version = "1.6.0";
   };
   asciidoctor-revealjs = {
     dependencies = ["asciidoctor" "concurrent-ruby" "thread_safe"];
@@ -140,10 +140,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0mr23wq0szj52xnj0zcn1k0c7j4v79wlwbijkpfcscqww3l6jlg3";
+      sha256 = "0nwad3211p7yv9sda31jmbyw6sdafzmdi2i2niaz6f0wk5nq9h0f";
       type = "gem";
     };
-    version = "1.1.8";
+    version = "1.1.9";
   };
   css_parser = {
     dependencies = ["addressable"];
@@ -183,10 +183,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "08p6b13p99j1rrcrw1l3v0kb9mxbsvy6nk31r8h4rnszdgzpga32";
+      sha256 = "0g2fnag935zn2ggm5cn6k4s4xvv53v2givj1j90szmvavlpya96a";
       type = "gem";
     };
-    version = "1.8.9";
+    version = "1.8.10";
   };
   mathematical = {
     dependencies = ["ruby-enum"];
@@ -225,10 +225,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1hdbpmamx8js53yk3h8cqy12kgv6ca06k0c9n3pxh6b6cjfs19x7";
+      sha256 = "1ad0mli9rc0f17zw4ibp24dbj1y39zkykijsjmnzl4gwpg5s0j6k";
       type = "gem";
     };
-    version = "2.5.0";
+    version = "2.5.3";
   };
   nokogiri = {
     dependencies = ["mini_portile2" "racc"];
@@ -236,20 +236,20 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1ajwkqr28hwqbyl1l3czx4a34c88acxywyqp8cjyy0zgsd6sbhj2";
+      sha256 = "1vrn31385ix5k9b0yalnlzv360isv6dincbcvi8psllnwz4sjxj9";
       type = "gem";
     };
-    version = "1.11.1";
+    version = "1.11.7";
   };
   pdf-core = {
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "19llwch2wfg51glb0kff0drfp3n6nb9vim4zlvzckxysksvxpby1";
+      sha256 = "1fz0yj4zrlii2j08kaw11j769s373ayz8jrdhxwwjzmm28pqndjg";
       type = "gem";
     };
-    version = "0.7.0";
+    version = "0.9.0";
   };
   pdf-reader = {
     dependencies = ["Ascii85" "afm" "hashery" "ruby-rc4" "ttfunk"];
@@ -257,10 +257,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1cxladxy18dhk4a3b263crq8hyxb3q0c7ifxrb5nr1bs6y0pk8i6";
+      sha256 = "14cxj3ra9nnn334qpm2vsx9s0zk3095s8ih6cwcp47h3hv03c73y";
       type = "gem";
     };
-    version = "2.4.2";
+    version = "2.5.0";
   };
   polyglot = {
     groups = ["default"];
@@ -278,10 +278,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1qdjf1v6sfl44g3rqxlg8k4jrzkwaxgvh2l4xws97a8f3xv4na4m";
+      sha256 = "1g9avv2rprsjisdk137s9ljr05r7ajhm78hxa1vjsv0jyx22f1l2";
       type = "gem";
     };
-    version = "2.2.2";
+    version = "2.4.0";
   };
   prawn-icon = {
     dependencies = ["prawn"];
@@ -289,21 +289,21 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1ivkdf8rdf92hhy97vbmc2a4w97vcvqd58jcj4z9hz3hfsb1526w";
+      sha256 = "1xdnjik5zinnkjavmybbh2s52wzcpb8hzaqckiv0mxp0vs0x9j6s";
       type = "gem";
     };
-    version = "2.5.0";
+    version = "3.0.0";
   };
   prawn-svg = {
-    dependencies = ["css_parser" "prawn"];
+    dependencies = ["css_parser" "prawn" "rexml"];
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1rb5hmjqc4hvy6liw9y51y6glbw66f09r09w0nvdfxhfi2kka16l";
+      sha256 = "0mbxzw7r7hv43db9422flc24ib9d8bdy1nasbni2h998jc5a5lb6";
       type = "gem";
     };
-    version = "0.31.0";
+    version = "0.32.0";
   };
   prawn-table = {
     dependencies = ["prawn"];
@@ -342,10 +342,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1736rbjgin97p3vjknz60p6dl66c936djwsk7wnwvwmav8r1nx0y";
+      sha256 = "1mshqjh8v0v8k29f8annqfr4qlgkp39nbwx3sgm69aymv4skfddb";
       type = "gem";
     };
-    version = "2.1.0";
+    version = "2.2.0";
   };
   racc = {
     groups = ["default"];
@@ -362,10 +362,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1mkvkcw9fhpaizrhca0pdgjcrbns48rlz4g6lavl5gjjq3rk2sq3";
+      sha256 = "08ximcyfjy94pm1rhcx04ny1vx2sk0x4y185gzn86yfsbzwkng53";
       type = "gem";
     };
-    version = "3.2.4";
+    version = "3.2.5";
   };
   rouge = {
     groups = ["default"];
@@ -444,9 +444,9 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1mgrnqla5n51v4ivn844albsajkck7k6lviphfqa8470r46c58cd";
+      sha256 = "15iaxz9iak5643bq2bc0jkbjv8w2zn649lxgvh5wg48q9d4blw13";
       type = "gem";
     };
-    version = "1.5.1";
+    version = "1.7.0";
   };
 }
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index cca8a0f97893..1020c51ebffd 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -7927,11 +7927,7 @@ in
 
   pk2cmd = callPackage ../tools/misc/pk2cmd { };
 
-  plantuml = callPackage ../tools/misc/plantuml {
-    # Graphviz 2.39 and 2.40 are discouraged by the PlantUML project, see
-    # http://plantuml.com/faq (heading: "Which version of Graphviz should I use ?")
-    graphviz = graphviz_2_32;
-  };
+  plantuml = callPackage ../tools/misc/plantuml { };
 
   plantuml-server = callPackage ../tools/misc/plantuml-server { };
 
@@ -11879,19 +11875,19 @@ in
     inherit (darwin.apple_sdk.frameworks) CoreFoundation Security;
     llvm_10 = llvmPackages_10.libllvm;
   };
-  rust_1_52 = callPackage ../development/compilers/rust/1_52.nix {
+  rust_1_53 = callPackage ../development/compilers/rust/1_53.nix {
     inherit (darwin.apple_sdk.frameworks) CoreFoundation Security;
     llvm_12 = llvmPackages_12.libllvm;
   };
-  rust = rust_1_52;
+  rust = rust_1_53;
 
   mrustc = callPackage ../development/compilers/mrustc { };
   mrustc-minicargo = callPackage ../development/compilers/mrustc/minicargo.nix { };
   mrustc-bootstrap = callPackage ../development/compilers/mrustc/bootstrap.nix { };
 
   rustPackages_1_45 = rust_1_45.packages.stable;
-  rustPackages_1_52 = rust_1_52.packages.stable;
-  rustPackages = rustPackages_1_52;
+  rustPackages_1_53 = rust_1_53.packages.stable;
+  rustPackages = rustPackages_1_53;
 
   inherit (rustPackages) cargo clippy rustc rustPlatform;
 
@@ -15345,8 +15341,7 @@ in
   glpk = callPackage ../development/libraries/glpk { };
 
   glsurf = callPackage ../applications/science/math/glsurf {
-    libpng = libpng12;
-    ocamlPackages = ocaml-ng.ocamlPackages_4_01_0;
+    ocamlPackages = ocaml-ng.ocamlPackages_4_05;
   };
 
   glui = callPackage ../development/libraries/glui {};
@@ -17820,8 +17815,9 @@ in
     python = python37;
   };
 
-  protobuf = protobuf3_16;
+  protobuf = protobuf3_17;
 
+  protobuf3_17 = callPackage ../development/libraries/protobuf/3.17.nix { };
   protobuf3_16 = callPackage ../development/libraries/protobuf/3.16.nix { };
   protobuf3_15 = callPackage ../development/libraries/protobuf/3.15.nix { };
   protobuf3_14 = callPackage ../development/libraries/protobuf/3.14.nix { };
@@ -24774,6 +24770,7 @@ in
     lcms2 = null;
     openexr = null;
     libpng = null;
+    liblqr1 = null;
     librsvg = null;
     libtiff = null;
     libxml2 = null;
@@ -24804,6 +24801,7 @@ in
     lcms2 = null;
     openexr = null;
     libpng = null;
+    liblqr1 = null;
     librsvg = null;
     libtiff = null;
     libxml2 = null;
diff --git a/pkgs/top-level/ocaml-packages.nix b/pkgs/top-level/ocaml-packages.nix
index 9931a7004b49..6e25108d04fe 100644
--- a/pkgs/top-level/ocaml-packages.nix
+++ b/pkgs/top-level/ocaml-packages.nix
@@ -120,12 +120,8 @@ let
       then callPackage ../development/ocaml-modules/camomile { }
       else callPackage ../development/ocaml-modules/camomile/0.8.5.nix { };
 
-    camlimages_4_1_2 =
-      if lib.versionOlder "4.02" ocaml.version
-      then null
-      else callPackage ../development/ocaml-modules/camlimages/4.1.2.nix {
-      libpng = pkgs.libpng12;
-    };
+    camlimages_4_2_4 = callPackage ../development/ocaml-modules/camlimages/4.2.4.nix { };
+
     camlimages = callPackage ../development/ocaml-modules/camlimages { };
 
     benchmark = callPackage ../development/ocaml-modules/benchmark { };