diff --git a/doc/languages-frameworks/python.section.md b/doc/languages-frameworks/python.section.md
index cc1a7083dc25..53466921887c 100644
--- a/doc/languages-frameworks/python.section.md
+++ b/doc/languages-frameworks/python.section.md
@@ -765,7 +765,7 @@ and in this case the `python38` interpreter is automatically used.
 ### Interpreters {#interpreters}
 
 Versions 2.7, 3.6, 3.7, 3.8 and 3.9 of the CPython interpreter are available as
-respectively `python27`, `python36`, `python37`, `python38` and `python39`. The
+respectively `python27`, `python37`, `python38` and `python39`. The
 aliases `python2` and `python3` correspond to respectively `python27` and
 `python39`. The attribute `python` maps to `python2`. The PyPy interpreters
 compatible with Python 2.7 and 3 are available as `pypy27` and `pypy3`, with
@@ -830,10 +830,10 @@ attribute set is created for each available Python interpreter. The available
 sets are
 
 * `pkgs.python27Packages`
-* `pkgs.python36Packages`
 * `pkgs.python37Packages`
 * `pkgs.python38Packages`
 * `pkgs.python39Packages`
+* `pkgs.python310Packages`
 * `pkgs.pypyPackages`
 
 and the aliases
diff --git a/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml b/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml
index 700ad741c003..17035df345ae 100644
--- a/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml
@@ -15,6 +15,12 @@
   <section xml:id="sec-release-21.11-highlights">
     <title>Highlights</title>
     <itemizedlist>
+      <listitem>
+        <para>
+          <literal>iptables</literal> now uses
+          <literal>nf_tables</literal> backend.
+        </para>
+      </listitem>
       <listitem>
         <para>
           PHP now defaults to PHP 8.0, updated from 7.4.
@@ -373,6 +379,14 @@
           nobody/nogroup, which is unsafe.
         </para>
       </listitem>
+      <listitem>
+        <para>
+          Since <literal>iptables</literal> now uses
+          <literal>nf_tables</literal> backend and
+          <literal>ipset</literal> doesn’t support it, some applications
+          (ferm, shorewall, firehol) may have limited functionality.
+        </para>
+      </listitem>
       <listitem>
         <para>
           The <literal>paperless</literal> module and package have been
diff --git a/nixos/doc/manual/release-notes/rl-2111.section.md b/nixos/doc/manual/release-notes/rl-2111.section.md
index ab1e94d59f18..94c79b9452a7 100644
--- a/nixos/doc/manual/release-notes/rl-2111.section.md
+++ b/nixos/doc/manual/release-notes/rl-2111.section.md
@@ -6,6 +6,8 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 ## Highlights {#sec-release-21.11-highlights}
 
+- `iptables` now uses `nf_tables` backend.
+
 - PHP now defaults to PHP 8.0, updated from 7.4.
 
 - kOps now defaults to 1.21.1, which uses containerd as the default runtime.
@@ -114,6 +116,8 @@ In addition to numerous new and upgraded packages, this release has the followin
 - The `security.wrappers` option now requires to always specify an owner, group and whether the setuid/setgid bit should be set.
   This is motivated by the fact that before NixOS 21.11, specifying either setuid or setgid but not owner/group resulted in wrappers owned by nobody/nogroup, which is unsafe.
 
+- Since `iptables` now uses `nf_tables` backend and `ipset` doesn't support it, some applications (ferm, shorewall, firehol) may have limited functionality.
+
 - The `paperless` module and package have been removed. All users should migrate to the
   successor `paperless-ng` instead. The Paperless project [has been
   archived](https://github.com/the-paperless-project/paperless/commit/9b0063c9731f7c5f65b1852cb8caff97f5e40ba4)
diff --git a/nixos/modules/hardware/printers.nix b/nixos/modules/hardware/printers.nix
index 7bab4f7038d9..ef07542950ba 100644
--- a/nixos/modules/hardware/printers.nix
+++ b/nixos/modules/hardware/printers.nix
@@ -116,19 +116,14 @@ in {
       description = "Ensure NixOS-configured CUPS printers";
       wantedBy = [ "multi-user.target" ];
       requires = [ cupsUnit ];
-      # in contrast to cups.socket, for cups.service, this is actually not enough,
-      # as the cups service reports its activation before clients can actually interact with it.
-      # Because of this, commands like `lpinfo -v` will report a bad file descriptor
-      # due to the missing UNIX socket without sufficient sleep time.
       after = [ cupsUnit ];
 
       serviceConfig = {
         Type = "oneshot";
+        RemainAfterExit = true;
       };
 
-       # sleep 10 is required to wait until cups.service is actually initialized and has created its UNIX socket file
-      script = (optionalString (!config.services.printing.startWhenNeeded) "sleep 10\n")
-        + (concatMapStringsSep "\n" ensurePrinter cfg.ensurePrinters)
+      script = concatMapStringsSep "\n" ensurePrinter cfg.ensurePrinters
         + optionalString (cfg.ensureDefaultPrinter != null) (ensureDefaultPrinter cfg.ensureDefaultPrinter);
     };
   };
diff --git a/nixos/modules/security/ca.nix b/nixos/modules/security/ca.nix
index 83c15f90f92e..f71d9d90ec5b 100644
--- a/nixos/modules/security/ca.nix
+++ b/nixos/modules/security/ca.nix
@@ -8,12 +8,10 @@ let
 
   cacertPackage = pkgs.cacert.override {
     blacklist = cfg.caCertificateBlacklist;
+    extraCertificateFiles = cfg.certificateFiles;
+    extraCertificateStrings = cfg.certificates;
   };
-
-  caCertificates = pkgs.runCommand "ca-certificates.crt" {
-    files = cfg.certificateFiles ++ [ (builtins.toFile "extra.crt" (concatStringsSep "\n" cfg.certificates)) ];
-    preferLocalBuild = true;
-  } "awk 1 $files > $out";  # awk ensures a newline between each pair of consecutive files
+  caBundle = "${cacertPackage}/etc/ssl/certs/ca-bundle.crt";
 
 in
 
@@ -74,16 +72,17 @@ in
 
   config = {
 
-    security.pki.certificateFiles = [ "${cacertPackage}/etc/ssl/certs/ca-bundle.crt" ];
-
     # NixOS canonical location + Debian/Ubuntu/Arch/Gentoo compatibility.
-    environment.etc."ssl/certs/ca-certificates.crt".source = caCertificates;
+    environment.etc."ssl/certs/ca-certificates.crt".source = caBundle;
 
     # Old NixOS compatibility.
-    environment.etc."ssl/certs/ca-bundle.crt".source = caCertificates;
+    environment.etc."ssl/certs/ca-bundle.crt".source = caBundle;
 
     # CentOS/Fedora compatibility.
-    environment.etc."pki/tls/certs/ca-bundle.crt".source = caCertificates;
+    environment.etc."pki/tls/certs/ca-bundle.crt".source = caBundle;
+
+    # P11-Kit trust source.
+    environment.etc."ssl/trust-source".source = "${cacertPackage.p11kit}/etc/ssl/trust-source";
 
   };
 
diff --git a/nixos/modules/services/networking/networkmanager.nix b/nixos/modules/services/networking/networkmanager.nix
index 2a826e0f0870..74daf0ae9faf 100644
--- a/nixos/modules/services/networking/networkmanager.nix
+++ b/nixos/modules/services/networking/networkmanager.nix
@@ -502,13 +502,6 @@ in {
 
     systemd.services.ModemManager.aliases = [ "dbus-org.freedesktop.ModemManager1.service" ];
 
-    # override unit as recommended by upstream - see https://github.com/NixOS/nixpkgs/issues/88089
-    # TODO: keep an eye on modem-manager releases as this will eventually be added to the upstream unit
-    systemd.services.ModemManager.serviceConfig.ExecStart = [
-      ""
-      "${pkgs.modemmanager}/sbin/ModemManager --filter-policy=STRICT"
-    ];
-
     systemd.services.NetworkManager-dispatcher = {
       wantedBy = [ "network.target" ];
       restartTriggers = [ configFile overrideNameserversScript ];
diff --git a/nixos/modules/virtualisation/libvirtd.nix b/nixos/modules/virtualisation/libvirtd.nix
index 77b43d9d843f..55ec76b4c954 100644
--- a/nixos/modules/virtualisation/libvirtd.nix
+++ b/nixos/modules/virtualisation/libvirtd.nix
@@ -168,7 +168,7 @@ in {
       etc."qemu/bridge.conf".text = lib.concatMapStringsSep "\n" (e:
         "allow ${e}") cfg.allowedBridges;
       systemPackages = with pkgs; [ libressl.nc iptables cfg.package cfg.qemuPackage ];
-      etc.ethertypes.source = "${pkgs.ebtables}/etc/ethertypes";
+      etc.ethertypes.source = "${pkgs.iptables}/etc/ethertypes";
     };
 
     boot.kernelModules = [ "tun" ];
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index a6eb2c032588..bd02c7af10dc 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -430,6 +430,7 @@ in
   systemd-binfmt = handleTestOn ["x86_64-linux"] ./systemd-binfmt.nix {};
   systemd-boot = handleTest ./systemd-boot.nix {};
   systemd-confinement = handleTest ./systemd-confinement.nix {};
+  systemd-cryptenroll = handleTest ./systemd-cryptenroll.nix {};
   systemd-journal = handleTest ./systemd-journal.nix {};
   systemd-networkd = handleTest ./systemd-networkd.nix {};
   systemd-networkd-dhcpserver = handleTest ./systemd-networkd-dhcpserver.nix {};
diff --git a/nixos/tests/custom-ca.nix b/nixos/tests/custom-ca.nix
index 05cfbbb2fdf2..4480519c7edc 100644
--- a/nixos/tests/custom-ca.nix
+++ b/nixos/tests/custom-ca.nix
@@ -109,9 +109,7 @@ in
 
       environment.systemPackages = with pkgs; [
         xdotool
-        # Firefox was disabled here, because we needed to disable p11-kit support in nss,
-        # which is why it will not use the system certificate store for the time being.
-        # firefox
+        firefox
         chromium
         qutebrowser
         midori
@@ -153,9 +151,7 @@ in
         machine.fail("curl -fv https://bad.example.com")
 
     browsers = {
-      # Firefox was disabled here, because we needed to disable p11-kit support in nss,
-      # which is why it will not use the system certificate store for the time being.
-      #"firefox": "Security Risk",
+      "firefox": "Security Risk",
       "chromium": "not private",
       "qutebrowser -T": "Certificate error",
       "midori": "Security"
diff --git a/nixos/tests/printing.nix b/nixos/tests/printing.nix
index badcb99a57af..6338fd8d8ac1 100644
--- a/nixos/tests/printing.nix
+++ b/nixos/tests/printing.nix
@@ -53,18 +53,10 @@ in {
 
     start_all()
 
-    with subtest("Make sure that cups is up on both sides"):
+    with subtest("Make sure that cups is up on both sides and printers are set up"):
         serviceServer.wait_for_unit("cups.service")
         serviceClient.wait_for_unit("cups.service")
-
-    with subtest(
-        "Wait until cups is fully initialized and ensure-printers has "
-        "executed with 10s delay"
-    ):
-        serviceClient.sleep(20)
-        socketActivatedClient.wait_until_succeeds(
-            "systemctl show ensure-printers | grep -q -E 'code=exited ; status=0'"
-        )
+        socketActivatedClient.wait_for_unit("ensure-printers.service")
 
 
     def test_printing(client, server):
diff --git a/nixos/tests/systemd-cryptenroll.nix b/nixos/tests/systemd-cryptenroll.nix
new file mode 100644
index 000000000000..2c436f2de890
--- /dev/null
+++ b/nixos/tests/systemd-cryptenroll.nix
@@ -0,0 +1,55 @@
+import ./make-test-python.nix ({ pkgs, ... }: {
+  name = "systemd-cryptenroll";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ ymatsiuk ];
+  };
+
+  machine = { pkgs, lib, ... }: {
+    environment.systemPackages = [ pkgs.cryptsetup ];
+    virtualisation = {
+      emptyDiskImages = [ 512 ];
+      memorySize = 1024;
+      qemu.options = [
+        "-chardev socket,id=chrtpm,path=/tmp/swtpm-sock"
+        "-tpmdev emulator,id=tpm0,chardev=chrtpm"
+        "-device tpm-tis,tpmdev=tpm0"
+      ];
+    };
+  };
+
+  testScript = ''
+    import subprocess
+    import tempfile
+
+    def start_swtpm(tpmstate):
+        subprocess.Popen(["${pkgs.swtpm}/bin/swtpm", "socket", "--tpmstate", "dir="+tpmstate, "--ctrl", "type=unixio,path=/tmp/swtpm-sock", "--log", "level=0", "--tpm2"])
+
+    with tempfile.TemporaryDirectory() as tpmstate:
+        start_swtpm(tpmstate)
+        machine.start()
+
+        # Verify the TPM device is available and accessible by systemd-cryptenroll
+        machine.succeed("test -e /dev/tpm0")
+        machine.succeed("test -e /dev/tpmrm0")
+        machine.succeed("systemd-cryptenroll --tpm2-device=list")
+
+        # Create LUKS partition
+        machine.succeed("echo -n lukspass | cryptsetup luksFormat -q /dev/vdb -")
+        # Enroll new LUKS key and bind it to Secure Boot state
+        # For more details on PASSWORD variable, check the following issue:
+        # https://github.com/systemd/systemd/issues/20955
+        machine.succeed("PASSWORD=lukspass systemd-cryptenroll --tpm2-device=auto --tpm2-pcrs=7 /dev/vdb")
+        # Add LUKS partition to /etc/crypttab to test auto unlock
+        machine.succeed("echo 'luks /dev/vdb - tpm2-device=auto' >> /etc/crypttab")
+        machine.shutdown()
+
+        start_swtpm(tpmstate)
+        machine.start()
+
+        # Test LUKS partition automatic unlock on boot
+        machine.wait_for_unit("systemd-cryptsetup@luks.service")
+        # Wipe TPM2 slot
+        machine.succeed("systemd-cryptenroll --wipe-slot=tpm2 /dev/vdb")
+  '';
+})
+
diff --git a/pkgs/applications/audio/bambootracker/default.nix b/pkgs/applications/audio/bambootracker/default.nix
index 591c14c1adfa..b2cce97bbc46 100644
--- a/pkgs/applications/audio/bambootracker/default.nix
+++ b/pkgs/applications/audio/bambootracker/default.nix
@@ -30,13 +30,9 @@ mkDerivation rec {
 
   postConfigure = "make qmake_all";
 
-  # 1. installs app bundle on darwin, move to app bundle dir & link binary to bin
-  # 2. wrapQtAppsHook fails to wrap mach-o binaries automatically, manually call wrapper
-  #    (see https://github.com/NixOS/nixpkgs/issues/102044)
   postInstall = lib.optionalString stdenv.hostPlatform.isDarwin ''
     mkdir -p $out/Applications
     mv $out/{bin,Applications}/BambooTracker.app
-    wrapQtApp $out/Applications/BambooTracker.app/Contents/MacOS/BambooTracker
     ln -s $out/{Applications/BambooTracker.app/Contents/MacOS,bin}/BambooTracker
   '';
 
diff --git a/pkgs/applications/audio/fluidsynth/default.nix b/pkgs/applications/audio/fluidsynth/default.nix
index 1a6471397de6..fa53bee5dc8d 100644
--- a/pkgs/applications/audio/fluidsynth/default.nix
+++ b/pkgs/applications/audio/fluidsynth/default.nix
@@ -11,8 +11,8 @@ let
       sha256 = "0n75jq3xgq46hfmjkaaxz3gic77shs4fzajq40c8gk043i84xbdh";
     };
     "2" = {
-      fluidsynthVersion = "2.0.6";
-      sha256 = "0nas9pp9r8rnziznxm65x2yzf1ryg98zr3946g0br3s38sjf8l3a";
+      fluidsynthVersion = "2.2.3";
+      sha256 = "0x5808d03ym23np17nl8gfbkx3c4y3d7jyyr2222wn2prswbb6x3";
     };
   };
 in
diff --git a/pkgs/applications/audio/munt/default.nix b/pkgs/applications/audio/munt/default.nix
index 191612700f41..93a9ce258544 100644
--- a/pkgs/applications/audio/munt/default.nix
+++ b/pkgs/applications/audio/munt/default.nix
@@ -36,7 +36,6 @@ mkDerivation rec {
   postInstall = lib.optionalString stdenv.hostPlatform.isDarwin ''
     mkdir $out/Applications
     mv $out/bin/${mainProgram}.app $out/Applications/
-    wrapQtApp $out/Applications/${mainProgram}.app/Contents/MacOS/${mainProgram}
     ln -s $out/{Applications/${mainProgram}.app/Contents/MacOS,bin}/${mainProgram}
   '';
 
diff --git a/pkgs/applications/editors/mindforger/default.nix b/pkgs/applications/editors/mindforger/default.nix
index 6b93153ec041..2f75fb34cd18 100644
--- a/pkgs/applications/editors/mindforger/default.nix
+++ b/pkgs/applications/editors/mindforger/default.nix
@@ -52,7 +52,6 @@ stdenv.mkDerivation rec {
   postInstall = lib.optionalString stdenv.isDarwin ''
     mkdir "$out"/Applications
     mv app/mindforger.app "$out"/Applications/
-    wrapQtApp "$out"/Applications/mindforger.app/Contents/MacOS/mindforger
   '';
 
   meta = with lib; {
diff --git a/pkgs/applications/gis/openorienteering-mapper/default.nix b/pkgs/applications/gis/openorienteering-mapper/default.nix
index 21b4cfa94b13..d186d36efcf8 100644
--- a/pkgs/applications/gis/openorienteering-mapper/default.nix
+++ b/pkgs/applications/gis/openorienteering-mapper/default.nix
@@ -76,9 +76,6 @@ mkDerivation rec {
   postInstall = with stdenv; lib.optionalString isDarwin ''
     mkdir -p $out/Applications
     mv $out/Mapper.app $out/Applications
-    # Fixes "This application failed to start because it could not find or load the Qt
-    # platform plugin "cocoa"."
-    wrapQtApp $out/Applications/Mapper.app/Contents/MacOS/Mapper
     mkdir -p $out/bin
     ln -s $out/Applications/Mapper.app/Contents/MacOS/Mapper $out/bin/mapper
   '';
diff --git a/pkgs/applications/graphics/fbida/default.nix b/pkgs/applications/graphics/fbida/default.nix
index f2d2e267595c..279f49e6a495 100644
--- a/pkgs/applications/graphics/fbida/default.nix
+++ b/pkgs/applications/graphics/fbida/default.nix
@@ -10,6 +10,15 @@ stdenv.mkDerivation rec {
     sha256 = "0f242mix20rgsqz1llibhsz4r2pbvx6k32rmky0zjvnbaqaw1dwm";
   };
 
+  patches = [
+    # Upstream patch to fix build on -fno-common toolchains.
+    (fetchurl {
+      name = "no-common.patch";
+      url = "https://git.kraxel.org/cgit/fbida/patch/?id=1bb8a8aa29845378903f3c690e17c0867c820da2";
+      sha256 = "0n5vqbp8wd87q60zfwdf22jirggzngypc02ha34gsj1rd6pvwahi";
+    })
+  ];
+
   nativeBuildInputs = [ pkg-config which ];
   buildInputs = [
     libexif libjpeg libpng giflib freetype fontconfig libtiff libwebp
@@ -19,7 +28,7 @@ stdenv.mkDerivation rec {
 
   makeFlags = [ "prefix=$(out)" "verbose=yes" "STRIP=" "JPEG_VER=62" ];
 
-  patchPhase = ''
+  postPatch = ''
     sed -e 's@ cpp\>@ gcc -E -@' -i GNUmakefile
     sed -e 's@$(HAVE_LINUX_FB_H)@yes@' -i GNUmakefile
   '';
diff --git a/pkgs/applications/graphics/openscad/default.nix b/pkgs/applications/graphics/openscad/default.nix
index c7be99469b05..be079b6bdb20 100644
--- a/pkgs/applications/graphics/openscad/default.nix
+++ b/pkgs/applications/graphics/openscad/default.nix
@@ -65,8 +65,6 @@ mkDerivation rec {
     mv $out/bin/*.app $out/Applications
     rmdir $out/bin || true
 
-    wrapQtApp "$out"/Applications/OpenSCAD.app/Contents/MacOS/OpenSCAD
-
     mv --target-directory=$out/Applications/OpenSCAD.app/Contents/Resources \
       $out/share/openscad/{examples,color-schemes,locale,libraries,fonts,templates}
 
diff --git a/pkgs/applications/kde/fetch.sh b/pkgs/applications/kde/fetch.sh
index 1d10789bccae..5742a9b85c4c 100644
--- a/pkgs/applications/kde/fetch.sh
+++ b/pkgs/applications/kde/fetch.sh
@@ -1 +1 @@
-WGET_ARGS=( https://download.kde.org/stable/release-service/21.08.1/src -A '*.tar.xz' )
+WGET_ARGS=( https://download.kde.org/stable/release-service/21.08.2/src -A '*.tar.xz' )
diff --git a/pkgs/applications/kde/srcs.nix b/pkgs/applications/kde/srcs.nix
index 4f4ab4464a39..43fc81b3c247 100644
--- a/pkgs/applications/kde/srcs.nix
+++ b/pkgs/applications/kde/srcs.nix
@@ -4,1811 +4,1811 @@
 
 {
   akonadi = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/akonadi-21.08.1.tar.xz";
-      sha256 = "02abs3mxwna30rgidlndj4jq0swy3id236ckw726vp3r8m9qimd6";
-      name = "akonadi-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/akonadi-21.08.2.tar.xz";
+      sha256 = "0jwhjdqha82hbyg2wmzjl5qi2rgmyd2sghdw85s77y63bxm9f0s2";
+      name = "akonadi-21.08.2.tar.xz";
     };
   };
   akonadi-calendar = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/akonadi-calendar-21.08.1.tar.xz";
-      sha256 = "1p8myayr6kfgp805wdpy39f9bjxw1fafv6kn35h1zsl1fgyc4812";
-      name = "akonadi-calendar-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/akonadi-calendar-21.08.2.tar.xz";
+      sha256 = "0k4cbcr6cw9rcrzidlbjbpshmsfh0p2m8bd9inkgzxi08drwizsa";
+      name = "akonadi-calendar-21.08.2.tar.xz";
     };
   };
   akonadi-calendar-tools = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/akonadi-calendar-tools-21.08.1.tar.xz";
-      sha256 = "0j8cc0x2bx64crgvprksnmng4yi7fk71s5pfyjrnw8d9xnj7vvvg";
-      name = "akonadi-calendar-tools-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/akonadi-calendar-tools-21.08.2.tar.xz";
+      sha256 = "1hxah75grydlaz6hzd3ng91dsap860111alph7vnrqcakhcfm0yc";
+      name = "akonadi-calendar-tools-21.08.2.tar.xz";
     };
   };
   akonadi-contacts = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/akonadi-contacts-21.08.1.tar.xz";
-      sha256 = "13sjy2jg4bbg7dm182apppmcpkhmiwhkpnkjhh13dhz8v7488vnc";
-      name = "akonadi-contacts-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/akonadi-contacts-21.08.2.tar.xz";
+      sha256 = "1ap2c16c0z4m7f3zsp5w5wqwcdr3fn1n2kvb6d647c3knszgibvg";
+      name = "akonadi-contacts-21.08.2.tar.xz";
     };
   };
   akonadi-import-wizard = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/akonadi-import-wizard-21.08.1.tar.xz";
-      sha256 = "1v0nzaijy6nahjx4j1wsvi8s6s3zk79b8h01n3r6gwilbxklqnqs";
-      name = "akonadi-import-wizard-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/akonadi-import-wizard-21.08.2.tar.xz";
+      sha256 = "0hgbjdkl4nva9dy9ljn8f5g4v9bw1rl84x2m0x94msf6bih20nr3";
+      name = "akonadi-import-wizard-21.08.2.tar.xz";
     };
   };
   akonadi-mime = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/akonadi-mime-21.08.1.tar.xz";
-      sha256 = "15lm1248diqhnv1qldcyyfi1v7w8h13jvwhp80py93hijq07iwz5";
-      name = "akonadi-mime-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/akonadi-mime-21.08.2.tar.xz";
+      sha256 = "0fkv26zl92xijkibpxvbqcmip24qrq58lan3w9s642gqh972a6x3";
+      name = "akonadi-mime-21.08.2.tar.xz";
     };
   };
   akonadi-notes = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/akonadi-notes-21.08.1.tar.xz";
-      sha256 = "1r43pvxpk3f183qaiydxg83xc1y5zss7xgxq5p1vnwgqyifibh3h";
-      name = "akonadi-notes-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/akonadi-notes-21.08.2.tar.xz";
+      sha256 = "0r19g9a0asqlw1qsh9vidbwpgbslfwqc8g577hdkhahfvg7hplmq";
+      name = "akonadi-notes-21.08.2.tar.xz";
     };
   };
   akonadi-search = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/akonadi-search-21.08.1.tar.xz";
-      sha256 = "1w5vps398kadl6p2jhsj18jqfn4lyysx09jzj6q9cvkvzmq4im6i";
-      name = "akonadi-search-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/akonadi-search-21.08.2.tar.xz";
+      sha256 = "1a1pf9q93z0cv7v2fxksiw3vn5dylg0lgniv98z9p6zv0wijxhn5";
+      name = "akonadi-search-21.08.2.tar.xz";
     };
   };
   akonadiconsole = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/akonadiconsole-21.08.1.tar.xz";
-      sha256 = "1dplpb6z3glps82bzlqhnx29k13m6b7q2wvdlcw9hfqrp2xgzyfk";
-      name = "akonadiconsole-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/akonadiconsole-21.08.2.tar.xz";
+      sha256 = "07vr4nwjzz6y1babwnhhidpv8pldx7vk2mq98midqji87xxh7r10";
+      name = "akonadiconsole-21.08.2.tar.xz";
     };
   };
   akregator = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/akregator-21.08.1.tar.xz";
-      sha256 = "03rv9m3f7vrn80jfdmnbzxsl226s82liyfam1cysxl2skkmvpimm";
-      name = "akregator-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/akregator-21.08.2.tar.xz";
+      sha256 = "15qkkfrxiwcd1gz5skqj8sb8fkr1mkc51wc2chqr4jv6aa0lbf5r";
+      name = "akregator-21.08.2.tar.xz";
     };
   };
   analitza = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/analitza-21.08.1.tar.xz";
-      sha256 = "0aagcj2dvm5aq24m6r5z79qsq2ra8xwzj7b1f64kcq8sabw7dbn4";
-      name = "analitza-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/analitza-21.08.2.tar.xz";
+      sha256 = "1y4amcl3sjpxhlqzyjmnpycgv3jfdn4458zch9qzakvjxamq6m9c";
+      name = "analitza-21.08.2.tar.xz";
     };
   };
   ark = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/ark-21.08.1.tar.xz";
-      sha256 = "1ss33qizhg325k4hhf8339xg52iv4s32qjm048zhi2jaz54pdnv0";
-      name = "ark-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/ark-21.08.2.tar.xz";
+      sha256 = "0hxzd0qr07wyz5v76nj4qj4db4lav53xapknmakif1fkghj1r51g";
+      name = "ark-21.08.2.tar.xz";
     };
   };
   artikulate = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/artikulate-21.08.1.tar.xz";
-      sha256 = "0x71m715iw1hv6xy36sd2gzd0cnsbn09wipp02nx2dc161lavnxk";
-      name = "artikulate-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/artikulate-21.08.2.tar.xz";
+      sha256 = "0b4fvxwrynnwr8mm87h60mhk293invaq8vw4y9dk6hv36l1z5fbf";
+      name = "artikulate-21.08.2.tar.xz";
     };
   };
   audiocd-kio = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/audiocd-kio-21.08.1.tar.xz";
-      sha256 = "1aqzgmpypzska5lgjwjpnbl6q2cbyiirph6h8ph5wnnb992lx8li";
-      name = "audiocd-kio-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/audiocd-kio-21.08.2.tar.xz";
+      sha256 = "1l0wym8gisgwv2mg2jsvpj8hb2yvmzd7dcximg540ljphv3hp1p2";
+      name = "audiocd-kio-21.08.2.tar.xz";
     };
   };
   baloo-widgets = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/baloo-widgets-21.08.1.tar.xz";
-      sha256 = "01f0hpgvlwxn3yms6yyi0ykryb78c9plp0q2z0ywk1p4lx4iywhd";
-      name = "baloo-widgets-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/baloo-widgets-21.08.2.tar.xz";
+      sha256 = "1fk8qvqh1xx6139wvyfk607vkb7w3d79gc3v3c8s96pkp5b228ax";
+      name = "baloo-widgets-21.08.2.tar.xz";
     };
   };
   blinken = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/blinken-21.08.1.tar.xz";
-      sha256 = "1bfkiwg2cwn4dizwcjb0ynzvvdxndf5172a8z0ch9b2wxlaljh87";
-      name = "blinken-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/blinken-21.08.2.tar.xz";
+      sha256 = "1ciq6fk9430p8sihc1q40djjw4994w1lghps9kr3415ryv08bfci";
+      name = "blinken-21.08.2.tar.xz";
     };
   };
   bomber = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/bomber-21.08.1.tar.xz";
-      sha256 = "1ppsnnbwsf1y9pavnpxr64k845gx1yn5p1mqswpcqgp9zd58f338";
-      name = "bomber-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/bomber-21.08.2.tar.xz";
+      sha256 = "0wk6j89m8lbp83yfz2xwy78x99cvph9p36jzscpp4i894j6fad61";
+      name = "bomber-21.08.2.tar.xz";
     };
   };
   bovo = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/bovo-21.08.1.tar.xz";
-      sha256 = "0qs96ds0clbvf7q487h9bq7l4haymdcyxzq8rlfd74qpki9cb9aa";
-      name = "bovo-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/bovo-21.08.2.tar.xz";
+      sha256 = "1k5ncxxx64yj2b71jlpz7ll935mrilhrhphwz1h8n8pdr6dn91mf";
+      name = "bovo-21.08.2.tar.xz";
     };
   };
   calendarsupport = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/calendarsupport-21.08.1.tar.xz";
-      sha256 = "0n9mbwdgyc4530g1rn9b393qq8pgpcclcpip9p72q8qc630jsvbw";
-      name = "calendarsupport-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/calendarsupport-21.08.2.tar.xz";
+      sha256 = "01plq4qzp94lxcc2gp04afnlvmni8993c8mf6kl256158z0y24ik";
+      name = "calendarsupport-21.08.2.tar.xz";
     };
   };
   cantor = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/cantor-21.08.1.tar.xz";
-      sha256 = "18gl6bw8mnn9sp4jws5b57k9w9scqg53ynw6yrabx2796k0hwfiw";
-      name = "cantor-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/cantor-21.08.2.tar.xz";
+      sha256 = "07xxwm3aa00v6cax7nyv326glapll01qh4libszhhn8pwpiyl00w";
+      name = "cantor-21.08.2.tar.xz";
     };
   };
   cervisia = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/cervisia-21.08.1.tar.xz";
-      sha256 = "0dah0lgzpdzxyvccqk2k2qbl5x4dl53qp23d0rxb5cg1ba5h7n2l";
-      name = "cervisia-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/cervisia-21.08.2.tar.xz";
+      sha256 = "0x4hisqfkizjxzl34s0yc6dn5r5fyh7f5yaadq5g47fdcah5cmmf";
+      name = "cervisia-21.08.2.tar.xz";
     };
   };
   dolphin = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/dolphin-21.08.1.tar.xz";
-      sha256 = "1vmk9iaylw427x203ccdjhlbah3dr5fz7l3lc113nczq54kcwpbf";
-      name = "dolphin-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/dolphin-21.08.2.tar.xz";
+      sha256 = "18aiqpf8qsig64gpcn6b1f0fs5mvzbdg8ncbhcjq0gy8gh3xamj2";
+      name = "dolphin-21.08.2.tar.xz";
     };
   };
   dolphin-plugins = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/dolphin-plugins-21.08.1.tar.xz";
-      sha256 = "0gnmr73ly0djngp3imdi4zm72icj3gilqcshb4ks3rq3lwk408rr";
-      name = "dolphin-plugins-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/dolphin-plugins-21.08.2.tar.xz";
+      sha256 = "0278pmakd4xqc8ckyxkzvf1xj1jp7jdq3a86i0n0k691zfljnan7";
+      name = "dolphin-plugins-21.08.2.tar.xz";
     };
   };
   dragon = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/dragon-21.08.1.tar.xz";
-      sha256 = "050jrizyip362fanrbx3fwp4n69sr7d4y2w6n70aqv8hhi90xqjy";
-      name = "dragon-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/dragon-21.08.2.tar.xz";
+      sha256 = "0ddijz96z58582w298jp11vns9fx3rmzqd3x1qplxvp4sl0hp9l7";
+      name = "dragon-21.08.2.tar.xz";
     };
   };
   elisa = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/elisa-21.08.1.tar.xz";
-      sha256 = "12kr5aixw5gdmy2vj6id0wmznkwg6p1ysxcqayk8bwvv2qz2pygr";
-      name = "elisa-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/elisa-21.08.2.tar.xz";
+      sha256 = "14wi7dva0bfagxw49bs80qszqcv6k16s0569mh1c4m97gzlzgv35";
+      name = "elisa-21.08.2.tar.xz";
     };
   };
   eventviews = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/eventviews-21.08.1.tar.xz";
-      sha256 = "04z5cb4vhxcwxp8dwv7w4400zmj090gr7dm4d4h4x39312d25rhh";
-      name = "eventviews-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/eventviews-21.08.2.tar.xz";
+      sha256 = "0d1ahknazkjav9641i1wggj9f67cr3s3y176v1j6ljhr4dl3m3xj";
+      name = "eventviews-21.08.2.tar.xz";
     };
   };
   ffmpegthumbs = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/ffmpegthumbs-21.08.1.tar.xz";
-      sha256 = "13v5y99fvj0p9f9hqafw652qzb7z267fjfsqykv7wb3pv274f11w";
-      name = "ffmpegthumbs-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/ffmpegthumbs-21.08.2.tar.xz";
+      sha256 = "1gsxcm86aq3r485ivk532a949z5l4129kildbd752c2qy0hdy5z1";
+      name = "ffmpegthumbs-21.08.2.tar.xz";
     };
   };
   filelight = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/filelight-21.08.1.tar.xz";
-      sha256 = "0smvvh7g9p0vh4s3xd0pk6whszk8vmqv9ww1jp0y3dy6ai2cwixi";
-      name = "filelight-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/filelight-21.08.2.tar.xz";
+      sha256 = "0phisyrnxc6i19253fdayx8cn51y6vxd66gfdy08hi4r31ih57jd";
+      name = "filelight-21.08.2.tar.xz";
     };
   };
   granatier = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/granatier-21.08.1.tar.xz";
-      sha256 = "1n7bvkh118530hi0aka9wwz7kycljwawb5d0wxzjb74kqp5rp0lv";
-      name = "granatier-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/granatier-21.08.2.tar.xz";
+      sha256 = "1bly3jlmn9d2im05srr3v28mw8wmr3hnw180wi8lpfzianh589v7";
+      name = "granatier-21.08.2.tar.xz";
     };
   };
   grantlee-editor = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/grantlee-editor-21.08.1.tar.xz";
-      sha256 = "1nfqylrnkvhjiygah527i9q16987n99ry69nwd1000xvf7r1k2yd";
-      name = "grantlee-editor-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/grantlee-editor-21.08.2.tar.xz";
+      sha256 = "1sm35c4r5sawcrclv1sc6ij4gsll87zwmissahgf30km32vz0rbv";
+      name = "grantlee-editor-21.08.2.tar.xz";
     };
   };
   grantleetheme = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/grantleetheme-21.08.1.tar.xz";
-      sha256 = "0zscb0wb85g1r0zcqb50ylg1r0640mjk985ifffnjzxlx4ayqglm";
-      name = "grantleetheme-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/grantleetheme-21.08.2.tar.xz";
+      sha256 = "0xm19a21y8b4cqiqg6mhxip1xxk7hrz88z1sijhhgc8d14i7mkdk";
+      name = "grantleetheme-21.08.2.tar.xz";
     };
   };
   gwenview = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/gwenview-21.08.1.tar.xz";
-      sha256 = "187br8271z00v02vllpxqwk8x6y38gg43xixczd8x4j0p6rgv8a0";
-      name = "gwenview-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/gwenview-21.08.2.tar.xz";
+      sha256 = "0yignay0g4vz3zj9xpziinsqd8pwywd1cq43f0n5hmzxrrv0abcf";
+      name = "gwenview-21.08.2.tar.xz";
     };
   };
   incidenceeditor = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/incidenceeditor-21.08.1.tar.xz";
-      sha256 = "1xyb106ck64qq4z083g0qx9n3rax5ma41jsfwl8am8w5q4szxw31";
-      name = "incidenceeditor-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/incidenceeditor-21.08.2.tar.xz";
+      sha256 = "0xrz3kzf4mc37zgfbjgc23l7wxry9m6d5igvyf1qm33yxwr4w78q";
+      name = "incidenceeditor-21.08.2.tar.xz";
     };
   };
   itinerary = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/itinerary-21.08.1.tar.xz";
-      sha256 = "018871y48yd2z2qsrnjhymb72nn4by2l8lrz38gcd9fq2dwlh5fs";
-      name = "itinerary-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/itinerary-21.08.2.tar.xz";
+      sha256 = "059n7xy3gjbqxl9cn7nxng9y4662ggi2lh2zj3yv0knwy78ccwjk";
+      name = "itinerary-21.08.2.tar.xz";
     };
   };
   juk = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/juk-21.08.1.tar.xz";
-      sha256 = "0q2q31r72d28hhabrnwglhcz6h3ay70i4fg7gyn658njvx8gl26b";
-      name = "juk-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/juk-21.08.2.tar.xz";
+      sha256 = "0c74s9ylx1xh1y581ygm6zyafwv3l5d7297wfg50f64nyr5npxm2";
+      name = "juk-21.08.2.tar.xz";
     };
   };
   k3b = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/k3b-21.08.1.tar.xz";
-      sha256 = "1gs4api78ngyb03sgknhc1cil6rx7rd1y66674lmi3sssyhi6bkz";
-      name = "k3b-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/k3b-21.08.2.tar.xz";
+      sha256 = "1g9xgzklsyard3ghcmr9irixcilga6kcj46jav884y8w7zxb4mrd";
+      name = "k3b-21.08.2.tar.xz";
     };
   };
   kaccounts-integration = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/kaccounts-integration-21.08.1.tar.xz";
-      sha256 = "1860njydckpdz34y7g94pa4xz0229j1szj8ihvql05kgysdm11qp";
-      name = "kaccounts-integration-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/kaccounts-integration-21.08.2.tar.xz";
+      sha256 = "1ckwm2kwb83kl89491wrmpd748zhkwd1vyaffwiyaqkp4rkrjph0";
+      name = "kaccounts-integration-21.08.2.tar.xz";
     };
   };
   kaccounts-providers = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/kaccounts-providers-21.08.1.tar.xz";
-      sha256 = "1w5k7y8xakp1lf4ca3wip7af3f9avd04i6zixv7kq9w3fh1mndp0";
-      name = "kaccounts-providers-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/kaccounts-providers-21.08.2.tar.xz";
+      sha256 = "15q1ibhxwxcvsjn6b2whyynhipq5b571d98bz20dn25fff88xllg";
+      name = "kaccounts-providers-21.08.2.tar.xz";
     };
   };
   kaddressbook = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/kaddressbook-21.08.1.tar.xz";
-      sha256 = "05lrxban904szlqhri71qqfykyygsxwgsx9w406s213vwkakirxb";
-      name = "kaddressbook-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/kaddressbook-21.08.2.tar.xz";
+      sha256 = "1pvd31zpam13jv0mhxzaagdlvnav60znd68l24y1dw5i98wk7n72";
+      name = "kaddressbook-21.08.2.tar.xz";
     };
   };
   kajongg = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/kajongg-21.08.1.tar.xz";
-      sha256 = "1izm0n2nsvxh9zvws53q4hkpzjihjwwccspas7k10ryasgp4nwsb";
-      name = "kajongg-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/kajongg-21.08.2.tar.xz";
+      sha256 = "0c8kxh6kbk7ml16df4gmr142rjllc7v0v7m3kw4ksngk93f7vz2s";
+      name = "kajongg-21.08.2.tar.xz";
     };
   };
   kalarm = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/kalarm-21.08.1.tar.xz";
-      sha256 = "088461j6piwas0g4chpj579r3bhyncmyajsfh2hz4679ir5lf6yh";
-      name = "kalarm-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/kalarm-21.08.2.tar.xz";
+      sha256 = "06cww023m4ng4g3v344lci0rvapk4zyzf1vi5jlajfs5d8bfkgf5";
+      name = "kalarm-21.08.2.tar.xz";
     };
   };
   kalarmcal = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/kalarmcal-21.08.1.tar.xz";
-      sha256 = "1s0yrh0y54rjp4d6y8vcixxrlsdra1xr8j3lxswl2h866p87v7fa";
-      name = "kalarmcal-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/kalarmcal-21.08.2.tar.xz";
+      sha256 = "0xdcazbbkm2z0r2g1avwh9bvdkvv0fy6qhhddlmfzj4cwh4c9vih";
+      name = "kalarmcal-21.08.2.tar.xz";
     };
   };
   kalgebra = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/kalgebra-21.08.1.tar.xz";
-      sha256 = "0a8hmzdslr92v9a8pjf7rnmpf040l9cizzlx8xrxqk2bdb7qls5w";
-      name = "kalgebra-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/kalgebra-21.08.2.tar.xz";
+      sha256 = "07fw8ab8gy9mam5dij6i9nl1zv4fp13vari6nzdk337klhsdbsjr";
+      name = "kalgebra-21.08.2.tar.xz";
     };
   };
   kalzium = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/kalzium-21.08.1.tar.xz";
-      sha256 = "0ijxyzryry1j9gfdmk56dlzyb4iz0v4vmjzjnqkv6sq2lm47lhyp";
-      name = "kalzium-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/kalzium-21.08.2.tar.xz";
+      sha256 = "0hjkpgclm67nyninywdmcpi7vn3jmf7ikbd4afg4bhj5mcz2a4vg";
+      name = "kalzium-21.08.2.tar.xz";
     };
   };
   kamera = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/kamera-21.08.1.tar.xz";
-      sha256 = "0cmppa8bc9iqbdk0pbnzrj1qqryqmrdgs7hliay3hsl7gjlz9zgy";
-      name = "kamera-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/kamera-21.08.2.tar.xz";
+      sha256 = "1arb93sa730ha8bgbcvp6bng8s4fp9yvcv0qvkhk2nl4db4m5rng";
+      name = "kamera-21.08.2.tar.xz";
     };
   };
   kamoso = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/kamoso-21.08.1.tar.xz";
-      sha256 = "15nqy97m913f0sdjs15bjivs7hvxghlhlw5579fsnfahg5iz5qp6";
-      name = "kamoso-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/kamoso-21.08.2.tar.xz";
+      sha256 = "0rkd9mk7rgha40j19rwpyqmn8lchqahakn4p3sbab7h3p3cq2b7p";
+      name = "kamoso-21.08.2.tar.xz";
     };
   };
   kanagram = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/kanagram-21.08.1.tar.xz";
-      sha256 = "1jqrmgyd2ijqb1sq17r7mijvcix6syys02kyasyilwgibbnlzjz1";
-      name = "kanagram-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/kanagram-21.08.2.tar.xz";
+      sha256 = "12iq58jc36rp664c92s7442gnxq6k1fi4017a4hwqq67b9ismgzl";
+      name = "kanagram-21.08.2.tar.xz";
     };
   };
   kapman = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/kapman-21.08.1.tar.xz";
-      sha256 = "072376xqm4a8fwvslf9grsklvzb50d9f098z4qba1lh3y3ivp7wm";
-      name = "kapman-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/kapman-21.08.2.tar.xz";
+      sha256 = "04yv6j2bjlgclp916k2gibhhv5d64sxk181cqw7sh5j4aq555a3r";
+      name = "kapman-21.08.2.tar.xz";
     };
   };
   kapptemplate = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/kapptemplate-21.08.1.tar.xz";
-      sha256 = "1crll3dr299qpigh2w9psvpi0r4jmb8y0b0facfcfcs6j9ldfbw5";
-      name = "kapptemplate-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/kapptemplate-21.08.2.tar.xz";
+      sha256 = "0vgfz4pz9yjns4dpks8mrp8zzipka4chw257l1db25khibksgh48";
+      name = "kapptemplate-21.08.2.tar.xz";
     };
   };
   kate = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/kate-21.08.1.tar.xz";
-      sha256 = "0k9kf8x5gbj5vbnr6lfhizi8122p76xixw480a3zsqi57i4bxk0z";
-      name = "kate-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/kate-21.08.2.tar.xz";
+      sha256 = "1cm6iq3cqmp0kvsxhv0vlqy1dyzmis9fb0a6298q0lyjkmsri26n";
+      name = "kate-21.08.2.tar.xz";
     };
   };
   katomic = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/katomic-21.08.1.tar.xz";
-      sha256 = "1595swszpw2ia9dh5c6wgrz04qlcvw84l474imkms4gv1cz583pb";
-      name = "katomic-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/katomic-21.08.2.tar.xz";
+      sha256 = "0lng3fpc1b255n8hayla3lpb77rmgvx8bkzi1s152kq7bf2mnxj7";
+      name = "katomic-21.08.2.tar.xz";
     };
   };
   kbackup = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/kbackup-21.08.1.tar.xz";
-      sha256 = "04795m0r4icfpv6166ingb82mfai0g6q48f9qvcqn029z0f347ya";
-      name = "kbackup-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/kbackup-21.08.2.tar.xz";
+      sha256 = "06xvw94m6zr7zj0i54if9vanbflnj88b0c16751br6ibp2m9zvlp";
+      name = "kbackup-21.08.2.tar.xz";
     };
   };
   kblackbox = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/kblackbox-21.08.1.tar.xz";
-      sha256 = "019nd86wmm1m8yz0lsayx37mqyzhx1pa5kbddajf5032dscncymd";
-      name = "kblackbox-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/kblackbox-21.08.2.tar.xz";
+      sha256 = "093k42259lwbhmq6pm5hv1iqm4maqd63qic80p748wmh88bsh8yg";
+      name = "kblackbox-21.08.2.tar.xz";
     };
   };
   kblocks = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/kblocks-21.08.1.tar.xz";
-      sha256 = "1grgkikl7zcs58y86kaw6slq7wvqa51g85kvwrysniv6l3yzhvxj";
-      name = "kblocks-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/kblocks-21.08.2.tar.xz";
+      sha256 = "0p4k3wr8756qfxr09daqp7z3461ljnd3yv34h893j5dini1lfy3d";
+      name = "kblocks-21.08.2.tar.xz";
     };
   };
   kbounce = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/kbounce-21.08.1.tar.xz";
-      sha256 = "18sd3yzz0mj9j666pnkm49ngfzh7aw125a5zyf1k947z6ayv5zix";
-      name = "kbounce-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/kbounce-21.08.2.tar.xz";
+      sha256 = "06zd4p8glpzp7q4a8qcmnj1lszgfdircfkgc8ay5abmfx2rr9hcw";
+      name = "kbounce-21.08.2.tar.xz";
     };
   };
   kbreakout = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/kbreakout-21.08.1.tar.xz";
-      sha256 = "0264w926ldfhdx22z1iqk41w5a9gnycff4vdjf0i6rzyws2qsb0g";
-      name = "kbreakout-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/kbreakout-21.08.2.tar.xz";
+      sha256 = "1gj37ryhak1czv95ksigssmbmicdpirzi1l5zsv1w7jdh4nqcz54";
+      name = "kbreakout-21.08.2.tar.xz";
     };
   };
   kbruch = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/kbruch-21.08.1.tar.xz";
-      sha256 = "1rbkwzca3m93p3z294cwkiyycg0w87r6j37v0zyiq802pwkkpm34";
-      name = "kbruch-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/kbruch-21.08.2.tar.xz";
+      sha256 = "1syy188f3sg3r22f7dklzman0h8fz6r1n4r5z986240q0r316rbn";
+      name = "kbruch-21.08.2.tar.xz";
     };
   };
   kcachegrind = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/kcachegrind-21.08.1.tar.xz";
-      sha256 = "09zgilcya7asj2si747snli6h0s7wzgjzkns9f53rwvq06xbp2zv";
-      name = "kcachegrind-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/kcachegrind-21.08.2.tar.xz";
+      sha256 = "126qa061bwz2d4s721vbv2099mz07vw3i1yw7vm0b3ih43h95149";
+      name = "kcachegrind-21.08.2.tar.xz";
     };
   };
   kcalc = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/kcalc-21.08.1.tar.xz";
-      sha256 = "0si3mp1xbk6gps5fhc9fv1vskx37pgwx72i2x1kcm7azif26nzsk";
-      name = "kcalc-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/kcalc-21.08.2.tar.xz";
+      sha256 = "01923w7zav2iia5pffs33vhblzh26lr1zpf2274cgplsbb5lcc9p";
+      name = "kcalc-21.08.2.tar.xz";
     };
   };
   kcalutils = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/kcalutils-21.08.1.tar.xz";
-      sha256 = "1xrggb8vv8lrjyhdb9yf2fzs36q766if78hlymgfndj1z37s0m6m";
-      name = "kcalutils-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/kcalutils-21.08.2.tar.xz";
+      sha256 = "0kvfpsz6zxdbgl4qvk3q55fjgjql1chx844cys26anhza0ld9afz";
+      name = "kcalutils-21.08.2.tar.xz";
     };
   };
   kcharselect = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/kcharselect-21.08.1.tar.xz";
-      sha256 = "0qbhmyczc13kmbls06732i91s8n6w396dfj1z50z28wrkyqls8zr";
-      name = "kcharselect-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/kcharselect-21.08.2.tar.xz";
+      sha256 = "08x060xmnyzqyadimwdqz767q29rmd48m8aqr3dsrzvb969ijnha";
+      name = "kcharselect-21.08.2.tar.xz";
     };
   };
   kcolorchooser = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/kcolorchooser-21.08.1.tar.xz";
-      sha256 = "13zdyksijxflvjb3zaszl6q7wzwz0pxsq8hyi5pb2gb7gryz65h7";
-      name = "kcolorchooser-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/kcolorchooser-21.08.2.tar.xz";
+      sha256 = "00vn2001crd0in3zd016xkhm38qgl7m03k1n90fiashjlnfd0928";
+      name = "kcolorchooser-21.08.2.tar.xz";
     };
   };
   kcron = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/kcron-21.08.1.tar.xz";
-      sha256 = "0c9d3rlml2adk11bp541l1zpbgp3q6mfhb7bpq4alrwlrbd4fxan";
-      name = "kcron-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/kcron-21.08.2.tar.xz";
+      sha256 = "1ryfa084cfp7v11lbr58j4rx3n4m70ynpzbyavin31x1zzbw7bh8";
+      name = "kcron-21.08.2.tar.xz";
     };
   };
   kde-dev-scripts = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/kde-dev-scripts-21.08.1.tar.xz";
-      sha256 = "1pv0qj7xpvxqgcrjbr9989cax0aan64cbipia4kmlg7kriz5wz6c";
-      name = "kde-dev-scripts-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/kde-dev-scripts-21.08.2.tar.xz";
+      sha256 = "093i4k4qqmjlffjyz7wqfv4lpsq6x9rc4svldbq5iszk8a7ldal5";
+      name = "kde-dev-scripts-21.08.2.tar.xz";
     };
   };
   kde-dev-utils = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/kde-dev-utils-21.08.1.tar.xz";
-      sha256 = "02ksa35xh8vw08pqik7q8v3wax1fcvx2inicm1b2z2c4gq5k766l";
-      name = "kde-dev-utils-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/kde-dev-utils-21.08.2.tar.xz";
+      sha256 = "1gidcxnixymzvdqjyzwdc9bfphvrbq7xx1miabn221gjc42bkggs";
+      name = "kde-dev-utils-21.08.2.tar.xz";
     };
   };
   kdebugsettings = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/kdebugsettings-21.08.1.tar.xz";
-      sha256 = "1fmnmvyzlhczbsxdpnm3bi50pdh2659raizaqbal2yjxcp6rlb90";
-      name = "kdebugsettings-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/kdebugsettings-21.08.2.tar.xz";
+      sha256 = "1wpj1hldrpbi538fd69i36zr3q3dg04i5bcmy41i1brzbddxl6sv";
+      name = "kdebugsettings-21.08.2.tar.xz";
     };
   };
   kdeconnect-kde = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/kdeconnect-kde-21.08.1.tar.xz";
-      sha256 = "01nwzsryxg7kkxb6g4h0lwn6g5zx4k64vizqk4gsvkif8d5zfc33";
-      name = "kdeconnect-kde-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/kdeconnect-kde-21.08.2.tar.xz";
+      sha256 = "09dv3l5g0wjilpga11mkxbyy3d8xk46pb2i35yvjbgi9yzp0xzfv";
+      name = "kdeconnect-kde-21.08.2.tar.xz";
     };
   };
   kdeedu-data = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/kdeedu-data-21.08.1.tar.xz";
-      sha256 = "19hc9mykw8q0krcxmrjq4mhn5dljfrv9pzv38dm80w3yfflj8y65";
-      name = "kdeedu-data-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/kdeedu-data-21.08.2.tar.xz";
+      sha256 = "0zm7gl4nz1b6m9m8hw5zklf5nbfh6qms7qbrrdxzcn6kj50zx6m2";
+      name = "kdeedu-data-21.08.2.tar.xz";
     };
   };
   kdegraphics-mobipocket = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/kdegraphics-mobipocket-21.08.1.tar.xz";
-      sha256 = "06zpm5d58q10dalm2lm7v7lcjmainn3lmagra6a1f007yshm3i32";
-      name = "kdegraphics-mobipocket-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/kdegraphics-mobipocket-21.08.2.tar.xz";
+      sha256 = "15wd7sfwfz3n1a0m0l2ymyhsdxjajw3kkl4piv9956amcg1bxlcp";
+      name = "kdegraphics-mobipocket-21.08.2.tar.xz";
     };
   };
   kdegraphics-thumbnailers = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/kdegraphics-thumbnailers-21.08.1.tar.xz";
-      sha256 = "0hqdxsnv6xgvy2knnhq733hbfgzhr6f4fi63l80saysqvpjyrxly";
-      name = "kdegraphics-thumbnailers-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/kdegraphics-thumbnailers-21.08.2.tar.xz";
+      sha256 = "1261kn4fa2lrissqc9cb5s7rd94pzfzq79kjw3gagbhrjfs91872";
+      name = "kdegraphics-thumbnailers-21.08.2.tar.xz";
     };
   };
   kdenetwork-filesharing = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/kdenetwork-filesharing-21.08.1.tar.xz";
-      sha256 = "1q5wisy6gz94lbf3dnmxp3rq0c5b1laajph8lnlm9dhfxxmrkacf";
-      name = "kdenetwork-filesharing-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/kdenetwork-filesharing-21.08.2.tar.xz";
+      sha256 = "0xyph51w7ba0jrp9dds0v97k7av2h5a3098h7wpwd0sclj2hbnwc";
+      name = "kdenetwork-filesharing-21.08.2.tar.xz";
     };
   };
   kdenlive = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/kdenlive-21.08.1.tar.xz";
-      sha256 = "0gjv1fm07f1qckpmlvia58myg9si9z46nwxiz1lcca5mx5k7rpcz";
-      name = "kdenlive-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/kdenlive-21.08.2.tar.xz";
+      sha256 = "10x160sdj7dk27aa7iyvfmpgfidc8pisfmx6a50z0b23y54kg77m";
+      name = "kdenlive-21.08.2.tar.xz";
     };
   };
   kdepim-addons = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/kdepim-addons-21.08.1.tar.xz";
-      sha256 = "08vpjcqnjh99bbmwp3h64anp53zafifblqy2f7bqkvwifmlrqvz8";
-      name = "kdepim-addons-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/kdepim-addons-21.08.2.tar.xz";
+      sha256 = "050kbxh89drd0yd9gzjjipmz1cvxkk5riivr5fcccqayyvskvyh2";
+      name = "kdepim-addons-21.08.2.tar.xz";
     };
   };
   kdepim-runtime = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/kdepim-runtime-21.08.1.tar.xz";
-      sha256 = "0ai6v5sysh5pzwpvbhjzi1fvfp608abpndh9nhnm7b87hca73vm9";
-      name = "kdepim-runtime-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/kdepim-runtime-21.08.2.tar.xz";
+      sha256 = "0vzly768f2g0zhprl1970k16kza128izhrby2mm1wdskrmdrvflq";
+      name = "kdepim-runtime-21.08.2.tar.xz";
     };
   };
   kdesdk-kioslaves = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/kdesdk-kioslaves-21.08.1.tar.xz";
-      sha256 = "0cz2cmcgksfkgl2nh0nnyz38q3rp1dfwhnajgcif5q0ka528v33w";
-      name = "kdesdk-kioslaves-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/kdesdk-kioslaves-21.08.2.tar.xz";
+      sha256 = "1g4i7sc30m7sjmmgjf12b83yhcwpdnvb7gzdjs1da5np5nq96j4y";
+      name = "kdesdk-kioslaves-21.08.2.tar.xz";
     };
   };
   kdesdk-thumbnailers = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/kdesdk-thumbnailers-21.08.1.tar.xz";
-      sha256 = "1cvh2p3vfzbqbr9cfa1bchgflmp9mi12qx1j6j1jdaqqwhz43kj6";
-      name = "kdesdk-thumbnailers-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/kdesdk-thumbnailers-21.08.2.tar.xz";
+      sha256 = "1bdwdpvdqx19j714fnxfhi3b647ynm1cgrkny7i27pkqlyw72hjg";
+      name = "kdesdk-thumbnailers-21.08.2.tar.xz";
     };
   };
   kdf = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/kdf-21.08.1.tar.xz";
-      sha256 = "1xmn7dhbnj9bhaw545ry0qwayxh3jhpgx9xa2fjcc0dhn8yx1spv";
-      name = "kdf-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/kdf-21.08.2.tar.xz";
+      sha256 = "1z2m9a4rzjsjxv9pkassn3j7pxkqrpq04hw0j6q913q69a999rwg";
+      name = "kdf-21.08.2.tar.xz";
     };
   };
   kdialog = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/kdialog-21.08.1.tar.xz";
-      sha256 = "1mxmj5cm5h1dhqkblcqdc7ba9x04sqj6gp0b12gii7jsz3g0pa94";
-      name = "kdialog-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/kdialog-21.08.2.tar.xz";
+      sha256 = "08klapfcxwp3mf7jv7swsia4719fq6aqdv7lnxr16j8sd6h3z0yx";
+      name = "kdialog-21.08.2.tar.xz";
     };
   };
   kdiamond = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/kdiamond-21.08.1.tar.xz";
-      sha256 = "0l8z71k0a300yp03mkpabi3a9xydky6x19sk7xhq727canrb3nwz";
-      name = "kdiamond-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/kdiamond-21.08.2.tar.xz";
+      sha256 = "1k458rs0x82jf4sjzcry4xzazwfn9drg41736749nc5d26k6csz1";
+      name = "kdiamond-21.08.2.tar.xz";
     };
   };
   keditbookmarks = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/keditbookmarks-21.08.1.tar.xz";
-      sha256 = "0j9m5l3llb969ras4bvsswahqqpwrv1zscjpdscchk72vxi2ky4w";
-      name = "keditbookmarks-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/keditbookmarks-21.08.2.tar.xz";
+      sha256 = "07yscqr3zzjvb1snl1k0ilmpgv8wrxvjrjdcr1410llfwd80fpvi";
+      name = "keditbookmarks-21.08.2.tar.xz";
     };
   };
   kfind = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/kfind-21.08.1.tar.xz";
-      sha256 = "0d3milbrznwls197a5bjrdwarpdly4pyask7j97ia7nx0z91k35f";
-      name = "kfind-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/kfind-21.08.2.tar.xz";
+      sha256 = "1rqn77m8i3fvknkq4gdl4fyihxkc34537010d6i992pxcx9yxv4d";
+      name = "kfind-21.08.2.tar.xz";
     };
   };
   kfloppy = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/kfloppy-21.08.1.tar.xz";
-      sha256 = "1nxkjaarvr7fq494hb4pk6nf9731f74zsxhfia3lzb2qf3rnxhvg";
-      name = "kfloppy-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/kfloppy-21.08.2.tar.xz";
+      sha256 = "0g54qwrmqkd3jxi6nwprzd0jckzdq3iawibfsfblkchnd8hnlxiw";
+      name = "kfloppy-21.08.2.tar.xz";
     };
   };
   kfourinline = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/kfourinline-21.08.1.tar.xz";
-      sha256 = "0niwvc1fxvxk5xi90n753y7gjhljrnm3jjzxgjxs9ca5y1c7jcac";
-      name = "kfourinline-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/kfourinline-21.08.2.tar.xz";
+      sha256 = "0z28lzx9jqp2krgwf6cpwv4hhyl8q8azgw3ni24c8hjl81sxidvb";
+      name = "kfourinline-21.08.2.tar.xz";
     };
   };
   kgeography = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/kgeography-21.08.1.tar.xz";
-      sha256 = "0wqblfs4h8pr0c3m9qv5xpz1sq1zxxbbgv42d0m12fhlbmhx0l64";
-      name = "kgeography-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/kgeography-21.08.2.tar.xz";
+      sha256 = "16rqlh2n4xz5rcs0p9ppzsk7wh060zf1i5yfx4cjrswfn2wk5brv";
+      name = "kgeography-21.08.2.tar.xz";
     };
   };
   kget = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/kget-21.08.1.tar.xz";
-      sha256 = "06lng1sr1l5a7qcbld7xn97vlaxnq4f98sai2llmjkyna3awzi6r";
-      name = "kget-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/kget-21.08.2.tar.xz";
+      sha256 = "11h073nkk5axr263wz5wjq8pdad2wk3nmhixx12ilkqqinb0pi6h";
+      name = "kget-21.08.2.tar.xz";
     };
   };
   kgoldrunner = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/kgoldrunner-21.08.1.tar.xz";
-      sha256 = "1dggs4fbfqc7q97j8fpi2v6q52165yikaps15mracn319c8mbx85";
-      name = "kgoldrunner-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/kgoldrunner-21.08.2.tar.xz";
+      sha256 = "13y8a1zxfy16sbdf2c94wdx15ghmb436pzx7kvvsfv8d5yizlzdz";
+      name = "kgoldrunner-21.08.2.tar.xz";
     };
   };
   kgpg = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/kgpg-21.08.1.tar.xz";
-      sha256 = "0q4k7ahh1qr4fnkw4na5kyp4kq922a45hjgz9qzh7whn6zqrhsxs";
-      name = "kgpg-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/kgpg-21.08.2.tar.xz";
+      sha256 = "051z9h12zqmhgvr8pk17vsfzld25mpklk1z6nknlf3hydjnq6ns1";
+      name = "kgpg-21.08.2.tar.xz";
     };
   };
   khangman = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/khangman-21.08.1.tar.xz";
-      sha256 = "1jv7vbk4za17l73b10xx1ckv56qhsvlf2irlys917bk39jhxmwpp";
-      name = "khangman-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/khangman-21.08.2.tar.xz";
+      sha256 = "0xrwsg5pv1y5lh6d2na1gx8aiimpbl8y2i9a4qj3qg5l4nf0inal";
+      name = "khangman-21.08.2.tar.xz";
     };
   };
   khelpcenter = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/khelpcenter-21.08.1.tar.xz";
-      sha256 = "09ayg8kb4b4v30xjm8ca5csw1axipn1336mq2sfqra5qwkj8d93y";
-      name = "khelpcenter-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/khelpcenter-21.08.2.tar.xz";
+      sha256 = "0ivm1z7c6yy6dm9sb88ggiww9c2k526lhpipkgiwm6kslzallxsn";
+      name = "khelpcenter-21.08.2.tar.xz";
     };
   };
   kidentitymanagement = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/kidentitymanagement-21.08.1.tar.xz";
-      sha256 = "0xhkz33w0z9jlxlqb06w5fiyj1qz2mjssrbba2kdm55q67lj1b76";
-      name = "kidentitymanagement-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/kidentitymanagement-21.08.2.tar.xz";
+      sha256 = "0kaws0w21sm0mb0fd5av7gid8gvyz0zxxjrbx0kf3c52dwkrmw5c";
+      name = "kidentitymanagement-21.08.2.tar.xz";
     };
   };
   kig = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/kig-21.08.1.tar.xz";
-      sha256 = "0gvp07mnkpfamdq78bv2r1m84l4xp23qh2i6iscdhjdh05dzyl6s";
-      name = "kig-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/kig-21.08.2.tar.xz";
+      sha256 = "1i5lszzj200mda7vbc8c6bzdlx8ycf2d8kk28pl2n17ajra33iim";
+      name = "kig-21.08.2.tar.xz";
     };
   };
   kigo = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/kigo-21.08.1.tar.xz";
-      sha256 = "1y7fh9acng4a135bz7skg7hgmyisaxgwli4ddv7y5h3r1rlhfd47";
-      name = "kigo-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/kigo-21.08.2.tar.xz";
+      sha256 = "0ss15k2qpmrf4xvsjpqpvf9pvw8wijmk4zqqhvsjrbd5xrk53bkf";
+      name = "kigo-21.08.2.tar.xz";
     };
   };
   killbots = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/killbots-21.08.1.tar.xz";
-      sha256 = "02rh60ww43r3zqv3v7zs42j7nl8b5373mykbql80amxnbj5965mn";
-      name = "killbots-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/killbots-21.08.2.tar.xz";
+      sha256 = "11cgkx5wpzgzx62frn90h35ga2scrvyxv7sasfsxldf3yiv15m30";
+      name = "killbots-21.08.2.tar.xz";
     };
   };
   kimagemapeditor = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/kimagemapeditor-21.08.1.tar.xz";
-      sha256 = "1mrf0k923gwy4cfh7g5yv0nnm4kx0j0yk9sz051sbvvbm4hbxqjg";
-      name = "kimagemapeditor-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/kimagemapeditor-21.08.2.tar.xz";
+      sha256 = "0k1jl5d9qxdg9lrz19vzjbsnpnf236hmckvwy9c620sik0rzpj12";
+      name = "kimagemapeditor-21.08.2.tar.xz";
     };
   };
   kimap = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/kimap-21.08.1.tar.xz";
-      sha256 = "19b8awcbrn61dwqli10v883i8s18sjz8w335c2sxlhzqgdijgxhl";
-      name = "kimap-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/kimap-21.08.2.tar.xz";
+      sha256 = "0qdl94zqk0qvy5mcnbhskh7dskcx8g1bkv4qv8zjjj9rz1r2rm2x";
+      name = "kimap-21.08.2.tar.xz";
     };
   };
   kio-extras = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/kio-extras-21.08.1.tar.xz";
-      sha256 = "0wlgd0cc56gzicgi16nx4592i6f6594d1mvz7d0266xrwmm8n688";
-      name = "kio-extras-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/kio-extras-21.08.2.tar.xz";
+      sha256 = "0735c9n50qflkcl8j032m84wvb6alv8rr9yfhyzflzv56k8r4034";
+      name = "kio-extras-21.08.2.tar.xz";
     };
   };
   kio-gdrive = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/kio-gdrive-21.08.1.tar.xz";
-      sha256 = "1vqm8b819hg1yfjlz1x3yis9qkbclahp7l00cpqbxnra0ph9b1vw";
-      name = "kio-gdrive-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/kio-gdrive-21.08.2.tar.xz";
+      sha256 = "0mbh5ccw3iyfnhqkidds9kq8bm7dwpx5zrnbqi93fach7zmpidk2";
+      name = "kio-gdrive-21.08.2.tar.xz";
     };
   };
   kipi-plugins = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/kipi-plugins-21.08.1.tar.xz";
-      sha256 = "1w6sw3wn0nj15jv6qp0yg7psg1m87b3izgn303z74vzkhqw04pid";
-      name = "kipi-plugins-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/kipi-plugins-21.08.2.tar.xz";
+      sha256 = "0ygji1dm6bzyn6f455l1avbw12kl5vdhx1g8lwvgfc51vflv3vxp";
+      name = "kipi-plugins-21.08.2.tar.xz";
     };
   };
   kirigami-gallery = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/kirigami-gallery-21.08.1.tar.xz";
-      sha256 = "0db1a5czq0xg0dhhmphds5vrz2lq771zwmps7gq6ahpfj01vyavd";
-      name = "kirigami-gallery-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/kirigami-gallery-21.08.2.tar.xz";
+      sha256 = "1i5aly7pwc39avarqmi8wwzv6bbza5pxaz5v8jm6b57d5mampkn8";
+      name = "kirigami-gallery-21.08.2.tar.xz";
     };
   };
   kiriki = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/kiriki-21.08.1.tar.xz";
-      sha256 = "0x7iq3y2jc4wykgcyrgm8gmrkvlhs8gsxdl0495n1x1invsnmj00";
-      name = "kiriki-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/kiriki-21.08.2.tar.xz";
+      sha256 = "1l3sc3fi4b8hc9dyrsi66src52wygckngiwqq8hf4mj2h0hf9s55";
+      name = "kiriki-21.08.2.tar.xz";
     };
   };
   kiten = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/kiten-21.08.1.tar.xz";
-      sha256 = "1skyfw5bshy6z8xvhs5q9f3c8nwqbm4mc74jcs6yhzc3i4mp82n3";
-      name = "kiten-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/kiten-21.08.2.tar.xz";
+      sha256 = "12jmsg26y4ldkh5qyz2bzyd14wk401p7kl48m5ngxv95qxw2ix9s";
+      name = "kiten-21.08.2.tar.xz";
     };
   };
   kitinerary = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/kitinerary-21.08.1.tar.xz";
-      sha256 = "0r7mrcs7gh9ffscksvkh5v78dr2y1nh26p8r8ginafachg32p0mi";
-      name = "kitinerary-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/kitinerary-21.08.2.tar.xz";
+      sha256 = "1l21q95rszdm1gp1msr9mzlj8ay115dl4cxchhm1mz7w7h53scg3";
+      name = "kitinerary-21.08.2.tar.xz";
     };
   };
   kjumpingcube = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/kjumpingcube-21.08.1.tar.xz";
-      sha256 = "1kh3jqp3m96lal6salcrqhgzg1pbacx20xn41c1jy272ch57r2jj";
-      name = "kjumpingcube-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/kjumpingcube-21.08.2.tar.xz";
+      sha256 = "1akg30mz8j6w6dzc43z56siiljblqpah80ghbashq3h2wq3q1lxz";
+      name = "kjumpingcube-21.08.2.tar.xz";
     };
   };
   kldap = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/kldap-21.08.1.tar.xz";
-      sha256 = "1m92kd6mrz3dxap6rzw0r85wij030a60n10hkgkjkxb8npgvl14g";
-      name = "kldap-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/kldap-21.08.2.tar.xz";
+      sha256 = "1vc94n9wq1422bp9ky2sapy8wra0gi5gfl6dz0h8wxnxflb28zvw";
+      name = "kldap-21.08.2.tar.xz";
     };
   };
   kleopatra = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/kleopatra-21.08.1.tar.xz";
-      sha256 = "1j1jd8ivcw2r2nlzzhr24kxcvfp5q1206gpkchd5mvsl6q34fmzx";
-      name = "kleopatra-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/kleopatra-21.08.2.tar.xz";
+      sha256 = "1ym40xxwl9qqz8sbsck606vzxys5qhkca8g23gqn3sxx3kk8zpn9";
+      name = "kleopatra-21.08.2.tar.xz";
     };
   };
   klettres = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/klettres-21.08.1.tar.xz";
-      sha256 = "0scgccwsma1hc1zp52h4rqddwizsqzwsh6gql5lf4qxhr8ihgj4m";
-      name = "klettres-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/klettres-21.08.2.tar.xz";
+      sha256 = "1n3qw190nznz0h4l68iy9azky57f8pflx10dihhl541jspgga5lg";
+      name = "klettres-21.08.2.tar.xz";
     };
   };
   klickety = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/klickety-21.08.1.tar.xz";
-      sha256 = "0r8dr4blwv1l6b8585qw7q258qr9pgk97pmrfmpssb90yxni2c1c";
-      name = "klickety-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/klickety-21.08.2.tar.xz";
+      sha256 = "1vi4xx4y7s225b3vgi2z8l1d5z4fgz3v5jfg4zq6v1pis46zpmwz";
+      name = "klickety-21.08.2.tar.xz";
     };
   };
   klines = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/klines-21.08.1.tar.xz";
-      sha256 = "1iyk91spsnfrkbjyf6jng6rgximcav2zf2xqkq1q2vvyhwwpchn6";
-      name = "klines-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/klines-21.08.2.tar.xz";
+      sha256 = "1gxaadl8gnbaliwbnr6ychp1da5dgppk58jgv5z0zngacwy80d97";
+      name = "klines-21.08.2.tar.xz";
     };
   };
   kmag = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/kmag-21.08.1.tar.xz";
-      sha256 = "1hdjcya1jv6adz0d9hp1sq7y8f6fvzpw30fchmjkdm9y2kf8il6c";
-      name = "kmag-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/kmag-21.08.2.tar.xz";
+      sha256 = "0y68vg95fjhfsjvvn2i214jrv06f6811j1asjxrgvwcmwdf0fnc0";
+      name = "kmag-21.08.2.tar.xz";
     };
   };
   kmahjongg = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/kmahjongg-21.08.1.tar.xz";
-      sha256 = "1wrzyiv07cffn5xiachqa8k9spcsi3iwvdj6prgbgdndbffw2gim";
-      name = "kmahjongg-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/kmahjongg-21.08.2.tar.xz";
+      sha256 = "1fx4almqcz8x3pzbrjv9yd9kfb7akrfy45z7idhyb31dkdaxi40w";
+      name = "kmahjongg-21.08.2.tar.xz";
     };
   };
   kmail = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/kmail-21.08.1.tar.xz";
-      sha256 = "08q7c8l2nfrvw5xgc2dzcmidcpsjfya3jjnssziy3hpznmf8jpjr";
-      name = "kmail-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/kmail-21.08.2.tar.xz";
+      sha256 = "0way147xqjhapswdfqnnvav8dk41lf2050jzmd6jz7qj0dina977";
+      name = "kmail-21.08.2.tar.xz";
     };
   };
   kmail-account-wizard = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/kmail-account-wizard-21.08.1.tar.xz";
-      sha256 = "1xqm4737p5l5cwqlnn7xladz4yna7aghl84hlbvzrfcc72v5xkal";
-      name = "kmail-account-wizard-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/kmail-account-wizard-21.08.2.tar.xz";
+      sha256 = "0ac4p9jy3n45i0aj0fn2151pdbjmvkzyr3qlzdidzf386y7m7y9b";
+      name = "kmail-account-wizard-21.08.2.tar.xz";
     };
   };
   kmailtransport = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/kmailtransport-21.08.1.tar.xz";
-      sha256 = "0zd03s4848n3g1w8fm0q3kq5sy91zhjw3hc2w6ncv6cgbb9s50dv";
-      name = "kmailtransport-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/kmailtransport-21.08.2.tar.xz";
+      sha256 = "0q76wanhby9gb9c07z8gpkmdqn6rv82bh6fz182m7bdzkqh4rbxx";
+      name = "kmailtransport-21.08.2.tar.xz";
     };
   };
   kmbox = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/kmbox-21.08.1.tar.xz";
-      sha256 = "027x76lrjssrhqpr651fyqqkdv6jmiad901cssv7w54r2dpzs6w3";
-      name = "kmbox-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/kmbox-21.08.2.tar.xz";
+      sha256 = "055vx2cr9zqab887grjans5cassh2g86r1lcn64jb61sh1cvzj7y";
+      name = "kmbox-21.08.2.tar.xz";
     };
   };
   kmime = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/kmime-21.08.1.tar.xz";
-      sha256 = "0prsmiv0g6icclhv7mkha66pddmdqz2mi69njz0xwz6m3ax068jw";
-      name = "kmime-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/kmime-21.08.2.tar.xz";
+      sha256 = "1dg0vm576gqvj7ia80zcdyf9cyg3fzvj7j3fkxx79mw17binlzg4";
+      name = "kmime-21.08.2.tar.xz";
     };
   };
   kmines = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/kmines-21.08.1.tar.xz";
-      sha256 = "0nx07cghq20rja8rncrayx87v357s036whdfyzc6qkhdmlmkh6qj";
-      name = "kmines-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/kmines-21.08.2.tar.xz";
+      sha256 = "0vzspy446pwbd04zyq7x0s7q6nrhmdnzq3jfvv6nnazhjmxpfafv";
+      name = "kmines-21.08.2.tar.xz";
     };
   };
   kmix = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/kmix-21.08.1.tar.xz";
-      sha256 = "0jc0b1j32gg7az0z7m1cvfdjrwss4q91hm1cfhrk5fq12620vivf";
-      name = "kmix-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/kmix-21.08.2.tar.xz";
+      sha256 = "1srv1alrq2w87rmv9jriz1y37rb0fp7w14291ky64gf23phwmfdq";
+      name = "kmix-21.08.2.tar.xz";
     };
   };
   kmousetool = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/kmousetool-21.08.1.tar.xz";
-      sha256 = "04a5zrxg48svrvdf8gf3qc7cj7cayzhw0q4l1v8nzs2ykc330xq1";
-      name = "kmousetool-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/kmousetool-21.08.2.tar.xz";
+      sha256 = "1b09z6793zjjspcrhz4f1vxk3zbs4qdrkdp59q61i7ganm49znma";
+      name = "kmousetool-21.08.2.tar.xz";
     };
   };
   kmouth = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/kmouth-21.08.1.tar.xz";
-      sha256 = "1rmqppmjjcrc7xp63csdgp440f003nia6hcnixxlya8pwn90bpwr";
-      name = "kmouth-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/kmouth-21.08.2.tar.xz";
+      sha256 = "1b9bc0vnqihaqa4wfa9sqcrq92q1kyw0w1ikkx3pb8rzdzkk4cv2";
+      name = "kmouth-21.08.2.tar.xz";
     };
   };
   kmplot = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/kmplot-21.08.1.tar.xz";
-      sha256 = "0mkcrdg0v98hdy5lgkyfv4x019w4sm7yiyfpryhx1wiqcpibxwl1";
-      name = "kmplot-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/kmplot-21.08.2.tar.xz";
+      sha256 = "0p81x7qlpj1b84wzqqb7sxmbmnxfys0clg1k07d2hw4rb8gisgic";
+      name = "kmplot-21.08.2.tar.xz";
     };
   };
   knavalbattle = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/knavalbattle-21.08.1.tar.xz";
-      sha256 = "1lvq223jspc5y0z6qaf648m85a58yp88b0jm8510p77ymxhyvgm7";
-      name = "knavalbattle-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/knavalbattle-21.08.2.tar.xz";
+      sha256 = "0zhp8zmnsjv1ainlc98waixv2p05w8jh91clb8747rc8x4k3phxk";
+      name = "knavalbattle-21.08.2.tar.xz";
     };
   };
   knetwalk = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/knetwalk-21.08.1.tar.xz";
-      sha256 = "1akv78yaym474b57d9qxqp3vivs405m1zm6x0plf2g1adp93myz2";
-      name = "knetwalk-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/knetwalk-21.08.2.tar.xz";
+      sha256 = "1jb6w790jfngifhgp4clgakiacw0lbn40jnj00zlzcg751vl6ajl";
+      name = "knetwalk-21.08.2.tar.xz";
     };
   };
   knights = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/knights-21.08.1.tar.xz";
-      sha256 = "1m00nryw69k4dyb0vvnjz3fwasf67ghkq78l7k8ck9vvzrihmwd1";
-      name = "knights-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/knights-21.08.2.tar.xz";
+      sha256 = "0v72niszn93671c4313f3cz2y8wq5nsww0c4irsbz9jpivcq080z";
+      name = "knights-21.08.2.tar.xz";
     };
   };
   knotes = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/knotes-21.08.1.tar.xz";
-      sha256 = "1av537f02zsz72mqkzlcrv977kf96nrdwsj4fx7kmdbhf5x9rvgv";
-      name = "knotes-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/knotes-21.08.2.tar.xz";
+      sha256 = "1g3rmkpwbicga09qwhxn47rhiv9rfaacpzapsrhddh63831bl999";
+      name = "knotes-21.08.2.tar.xz";
     };
   };
   kolf = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/kolf-21.08.1.tar.xz";
-      sha256 = "15wk2c2pzpg39hv6s1b80mf5l7gkbxlprahjq6wh6f6a5hm3wkxb";
-      name = "kolf-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/kolf-21.08.2.tar.xz";
+      sha256 = "1dziji28syv7rirm959ahcch6696sc4y6pnfp40v11j1pw58jm8p";
+      name = "kolf-21.08.2.tar.xz";
     };
   };
   kollision = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/kollision-21.08.1.tar.xz";
-      sha256 = "15ddxccj29094lxrihchc17x2a2xnjk790dqhfja9d235vkg3lpb";
-      name = "kollision-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/kollision-21.08.2.tar.xz";
+      sha256 = "04hb91gqy58lvhwy0hx27xcd1pvqm378lcavswh7b142f63mhmjf";
+      name = "kollision-21.08.2.tar.xz";
     };
   };
   kolourpaint = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/kolourpaint-21.08.1.tar.xz";
-      sha256 = "0vjssni7c8dx1617gsnkp8dip92agys8n1ydzdly6jpwhvlr382a";
-      name = "kolourpaint-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/kolourpaint-21.08.2.tar.xz";
+      sha256 = "0p64dp63m8ycy5qrgd6fdgf670y5iqdyw4gjbkwphg01qp8kpj6d";
+      name = "kolourpaint-21.08.2.tar.xz";
     };
   };
   kompare = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/kompare-21.08.1.tar.xz";
-      sha256 = "0sigh2c91ff7r6yclx18lcwqbwh4gbj55n5fjpd1fw9rb7xf9j3n";
-      name = "kompare-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/kompare-21.08.2.tar.xz";
+      sha256 = "14bbqxdzj67g2m6zmz28ax6v4bzz9nmyy45flqzm8jqvq9afqb1d";
+      name = "kompare-21.08.2.tar.xz";
     };
   };
   konqueror = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/konqueror-21.08.1.tar.xz";
-      sha256 = "155dc8nd3kgr25wpjisnp9z2jr1f31vcnm8ywa98p4i59kaaxh7h";
-      name = "konqueror-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/konqueror-21.08.2.tar.xz";
+      sha256 = "0v5l1nqa0fm4q17l0rncriwyvkgq0pdg2q4kjc92kvvdvrpm3jjp";
+      name = "konqueror-21.08.2.tar.xz";
     };
   };
   konquest = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/konquest-21.08.1.tar.xz";
-      sha256 = "0i0pm5zq2ipm1ipsam19c771v16bxlhilidny336rzwfa1vik0zl";
-      name = "konquest-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/konquest-21.08.2.tar.xz";
+      sha256 = "0shky9cys79prdgr6bcmi50gvfmqr0famdq6gqacv9krbja4pl20";
+      name = "konquest-21.08.2.tar.xz";
     };
   };
   konsole = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/konsole-21.08.1.tar.xz";
-      sha256 = "0v74yrblwakbmy0p4x5j9lhmqyavgsffahr51bh5r5qcgx0cafjv";
-      name = "konsole-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/konsole-21.08.2.tar.xz";
+      sha256 = "1lhpgags85y0s5p44dpa2k0b9vq46m7h19pha59w1wy72an884ig";
+      name = "konsole-21.08.2.tar.xz";
     };
   };
   kontact = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/kontact-21.08.1.tar.xz";
-      sha256 = "1aqyrkmc7hnzja1spm75ybrb9c3yg37rklcgdr7myyyhjxmvnrzg";
-      name = "kontact-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/kontact-21.08.2.tar.xz";
+      sha256 = "1a7d7xfby796kk9hbqqnnhjnn5yvk99hglm4270azlcgbjxf4s2j";
+      name = "kontact-21.08.2.tar.xz";
     };
   };
   kontactinterface = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/kontactinterface-21.08.1.tar.xz";
-      sha256 = "1l251rw80c329sgrv25r8cn242v0kl7pvcfv9xkakql7dw707xs9";
-      name = "kontactinterface-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/kontactinterface-21.08.2.tar.xz";
+      sha256 = "0wavclk0z55z8xmqiq6wjhlf2byiggmj9fr5kwdk8wsjfj30npwg";
+      name = "kontactinterface-21.08.2.tar.xz";
     };
   };
   kontrast = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/kontrast-21.08.1.tar.xz";
-      sha256 = "05nw7z05maxpcr37andv60fn9s8kprz474bkza980ah05xzvkkvb";
-      name = "kontrast-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/kontrast-21.08.2.tar.xz";
+      sha256 = "12pmkkgrj848whwfz523ciix2a4dm3wgw1vva30svyvlv6qyrgwa";
+      name = "kontrast-21.08.2.tar.xz";
     };
   };
   konversation = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/konversation-21.08.1.tar.xz";
-      sha256 = "0v3nvyjc13jav8x9krg9sd9p533j7ndan0fqb5p0virwk1dznvfy";
-      name = "konversation-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/konversation-21.08.2.tar.xz";
+      sha256 = "1blaxxpp0831frw2v4ylvq23ffyqabbq1zcqj0v4kq736acdl8pa";
+      name = "konversation-21.08.2.tar.xz";
     };
   };
   kopeninghours = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/kopeninghours-21.08.1.tar.xz";
-      sha256 = "09yskjfkr190vkp8xgj2hicfyg1mx9mqm7pgn4133qfn08xh52vd";
-      name = "kopeninghours-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/kopeninghours-21.08.2.tar.xz";
+      sha256 = "1g4g3hc0zpklnw8an49dk25zfw740w4slkm52191q2ajymp589l0";
+      name = "kopeninghours-21.08.2.tar.xz";
     };
   };
   kopete = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/kopete-21.08.1.tar.xz";
-      sha256 = "131nic6w1bzc0l94b8jkzac2dckaz64y2fgplyiqjidicm0cyrd1";
-      name = "kopete-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/kopete-21.08.2.tar.xz";
+      sha256 = "015pjfc5kxhm5nmjv8fx4jlczp0l3vhqrkxgfvq83a200nlvg2pm";
+      name = "kopete-21.08.2.tar.xz";
     };
   };
   korganizer = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/korganizer-21.08.1.tar.xz";
-      sha256 = "0x05i3c0nj46bnnd7msz1rpghbr2p6sywfsa15d6l1j72i2ay0vr";
-      name = "korganizer-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/korganizer-21.08.2.tar.xz";
+      sha256 = "0izrzg5xxqgz0wq0vkv1i1xcf0xnzgfwixy8f4gcvihpqxyvixb7";
+      name = "korganizer-21.08.2.tar.xz";
     };
   };
   kosmindoormap = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/kosmindoormap-21.08.1.tar.xz";
-      sha256 = "1v31cik859b994xka37z0l86nd0crykbsnafyxpmqdzf942ixixb";
-      name = "kosmindoormap-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/kosmindoormap-21.08.2.tar.xz";
+      sha256 = "0yf4n48x041wl07f575hzqdkn1qmx3idpxswinsk9r8zdr2dwch7";
+      name = "kosmindoormap-21.08.2.tar.xz";
     };
   };
   kpat = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/kpat-21.08.1.tar.xz";
-      sha256 = "1dxihma5mad2kbg7wzfbnaq3gmgwav70rqrj5fpji42pvlqx4vyn";
-      name = "kpat-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/kpat-21.08.2.tar.xz";
+      sha256 = "16cj3w4cibar1q12wam3i623kzddhl39ychvi3nphlni5cmr4x42";
+      name = "kpat-21.08.2.tar.xz";
     };
   };
   kpimtextedit = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/kpimtextedit-21.08.1.tar.xz";
-      sha256 = "1zaavf0gpaibk22fz8ij0fqrlp18lj07hgdg6ynhdmhamw59sfr5";
-      name = "kpimtextedit-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/kpimtextedit-21.08.2.tar.xz";
+      sha256 = "0v479g998amh822lxr0l2d9xhlrwbij9prlrn1z9y9al056cic7h";
+      name = "kpimtextedit-21.08.2.tar.xz";
     };
   };
   kpkpass = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/kpkpass-21.08.1.tar.xz";
-      sha256 = "0z8dk548awy37iq8zz41x2wm2i9bhpfa2g0ghlwvhj7sy97ap1vk";
-      name = "kpkpass-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/kpkpass-21.08.2.tar.xz";
+      sha256 = "003rmp8svnz74qfd3727l7p5wj56j9x8w3dwk19ysyklh2rbaj2p";
+      name = "kpkpass-21.08.2.tar.xz";
     };
   };
   kpmcore = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/kpmcore-21.08.1.tar.xz";
-      sha256 = "1aw21x70kgm1dmhqr384k6rbsd1fx70zd94i0slq5zyf37zx6b9l";
-      name = "kpmcore-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/kpmcore-21.08.2.tar.xz";
+      sha256 = "0rn8x0add1qflsbgppmhz1zbnjvy39d5wckxga0vmhdix2m3d60g";
+      name = "kpmcore-21.08.2.tar.xz";
     };
   };
   kpublictransport = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/kpublictransport-21.08.1.tar.xz";
-      sha256 = "1dbbsdrzhqaiz6d4hlyy1f50m6hi0arafxrxr65gh9h4zs2ym4qs";
-      name = "kpublictransport-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/kpublictransport-21.08.2.tar.xz";
+      sha256 = "1g4k1wxhvjya0k79ysr92kq37fbdfly5qdrmp11apvar4la4xmr8";
+      name = "kpublictransport-21.08.2.tar.xz";
     };
   };
   kqtquickcharts = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/kqtquickcharts-21.08.1.tar.xz";
-      sha256 = "0ghmxzy3jqzy3zdpp5zhjv3mcq6micnnk1jhnlq03v4z981rrs6h";
-      name = "kqtquickcharts-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/kqtquickcharts-21.08.2.tar.xz";
+      sha256 = "04cxw88lv7mj74znzfl3m9jzks11z837y3bch40qdn8ysk9wqjhn";
+      name = "kqtquickcharts-21.08.2.tar.xz";
     };
   };
   krdc = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/krdc-21.08.1.tar.xz";
-      sha256 = "038m7wgpg33sqqqq7iy4rvficsi7x2012rimxb1gn2azg5kcwk6v";
-      name = "krdc-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/krdc-21.08.2.tar.xz";
+      sha256 = "0zrpfbs4r0d4wnficmhn0av7877hbrl4jvxpi0qiy2gdc7zksnbd";
+      name = "krdc-21.08.2.tar.xz";
     };
   };
   kreversi = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/kreversi-21.08.1.tar.xz";
-      sha256 = "1gh7zhqzyh2m34v3gyb902c6cvw33rbib5g8p3dwsmm5v2bfgggj";
-      name = "kreversi-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/kreversi-21.08.2.tar.xz";
+      sha256 = "18z2aclpd0xln1n442jg13n5j2yip6dldfvd5z56g7n23l9paywq";
+      name = "kreversi-21.08.2.tar.xz";
     };
   };
   krfb = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/krfb-21.08.1.tar.xz";
-      sha256 = "0l28l9wmfxf6vihxr86pwxj027fkz0k0pwkif8had0s4swc9jfnx";
-      name = "krfb-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/krfb-21.08.2.tar.xz";
+      sha256 = "1hn21d0cp2k6zair2wwf492y0ip69f1b5axaaz9fqgmgqn0l47qb";
+      name = "krfb-21.08.2.tar.xz";
     };
   };
   kross-interpreters = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/kross-interpreters-21.08.1.tar.xz";
-      sha256 = "1fznrng6mz9s8ynzr48p05n6akkmzn3fifbgpxs98nhzlz2ay574";
-      name = "kross-interpreters-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/kross-interpreters-21.08.2.tar.xz";
+      sha256 = "07f153ib1gmbfnkchzymvwlng3sgn28zspxkrx75g8xa5jszwwym";
+      name = "kross-interpreters-21.08.2.tar.xz";
     };
   };
   kruler = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/kruler-21.08.1.tar.xz";
-      sha256 = "0l78hk7zjwjxba094gjvajh32v4avdc80h5r0rv94k2r3gckfjv4";
-      name = "kruler-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/kruler-21.08.2.tar.xz";
+      sha256 = "082z14vcp1ww42jrlxl128gp6y5iqrz360cipvj4xph4q7lpgb0r";
+      name = "kruler-21.08.2.tar.xz";
     };
   };
   kshisen = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/kshisen-21.08.1.tar.xz";
-      sha256 = "107y828nkdzza5hi68pxxk5gp017dy2yxdmmhmg6ylppk5gfp6dp";
-      name = "kshisen-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/kshisen-21.08.2.tar.xz";
+      sha256 = "12mi59n8sm7wqf53wbi2nlh4d2i673x93rlqz6qxkaqznlpf7lrr";
+      name = "kshisen-21.08.2.tar.xz";
     };
   };
   ksirk = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/ksirk-21.08.1.tar.xz";
-      sha256 = "0l6bfpima9whgfdkbghhfh36p6kjs8j26gz5zc7r8fcswv66ya21";
-      name = "ksirk-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/ksirk-21.08.2.tar.xz";
+      sha256 = "1j6nzyl3ppi68d1y84yals0y90km5mxzz4x44frn3k3bb1n1imzc";
+      name = "ksirk-21.08.2.tar.xz";
     };
   };
   ksmtp = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/ksmtp-21.08.1.tar.xz";
-      sha256 = "0pl167gjhpmdvhsjm6hcygxwjs8v1z4xfc7x0c69bac8rdrzrlb6";
-      name = "ksmtp-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/ksmtp-21.08.2.tar.xz";
+      sha256 = "08bdi23qwvayl9w1nsfgpxpxmxrw820qcmvw03ivdk1h7m6sl3yh";
+      name = "ksmtp-21.08.2.tar.xz";
     };
   };
   ksnakeduel = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/ksnakeduel-21.08.1.tar.xz";
-      sha256 = "1jk4mdxg2b1aa1686rimhjqh91ijaf8n7fahvswwbl473zfjf748";
-      name = "ksnakeduel-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/ksnakeduel-21.08.2.tar.xz";
+      sha256 = "0n7digcymwrcg24y2libp0x67s1rj2qmps4yzp2bxpgasx9pf6ik";
+      name = "ksnakeduel-21.08.2.tar.xz";
     };
   };
   kspaceduel = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/kspaceduel-21.08.1.tar.xz";
-      sha256 = "0q2mpidkhgjz3nm88j3m8wdb06y3m8ixr0540q0s9i9d997jdkch";
-      name = "kspaceduel-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/kspaceduel-21.08.2.tar.xz";
+      sha256 = "1gjb23dw8fh61b7s23b2bfkgcfxqvndrv1x7lkk2bpi4i4g6sqz3";
+      name = "kspaceduel-21.08.2.tar.xz";
     };
   };
   ksquares = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/ksquares-21.08.1.tar.xz";
-      sha256 = "0z7h5vig5zablvdlv7lanmsjjbqq931pqjyynm75mygrrbavgcfq";
-      name = "ksquares-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/ksquares-21.08.2.tar.xz";
+      sha256 = "10sl49mjjlpqyh6f930iz1nncy2dqzm1b8hksn8zxz5kwi2gvfrc";
+      name = "ksquares-21.08.2.tar.xz";
     };
   };
   ksudoku = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/ksudoku-21.08.1.tar.xz";
-      sha256 = "0aax14xwg42wr8g563nbpn7m55gs4k50kwk0zn79pf62i78g10lp";
-      name = "ksudoku-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/ksudoku-21.08.2.tar.xz";
+      sha256 = "15svd1paf1hx5aqmdrh6bcdag7k8iq18fpjflk3vkkip6s76lrv6";
+      name = "ksudoku-21.08.2.tar.xz";
     };
   };
   ksystemlog = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/ksystemlog-21.08.1.tar.xz";
-      sha256 = "1vv0wbb3npbq8r0mq8y5lc36qx1hxdjxygfcnw2h9hm4dwl8mc5v";
-      name = "ksystemlog-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/ksystemlog-21.08.2.tar.xz";
+      sha256 = "1qnnhbi75glgvcvpmpy5zrq6x6hygl7r7v4h99lfm48jdfpyxilj";
+      name = "ksystemlog-21.08.2.tar.xz";
     };
   };
   kteatime = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/kteatime-21.08.1.tar.xz";
-      sha256 = "0gjnvcvrnb3049ln64chnjgr7xm722ighjscxxhqz61i872dgb72";
-      name = "kteatime-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/kteatime-21.08.2.tar.xz";
+      sha256 = "02vkh3dyacba9x0zl8j8g8isj50h8wz7mjnfqgxc67azcwwx41sp";
+      name = "kteatime-21.08.2.tar.xz";
     };
   };
   ktimer = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/ktimer-21.08.1.tar.xz";
-      sha256 = "1l79yrg6g78gf8av1h6yr4mxyd1n63g4r38qp4csvpnjpx7y8ijd";
-      name = "ktimer-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/ktimer-21.08.2.tar.xz";
+      sha256 = "0rfmrh7i8c23r6wdyh4w55980vlj2p127mbpiw5brj4dazdjll5x";
+      name = "ktimer-21.08.2.tar.xz";
     };
   };
   ktnef = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/ktnef-21.08.1.tar.xz";
-      sha256 = "08wk4ssasqqixwnp59smv64c8m4jf89vpcwc3zvz4h92sfk0pk33";
-      name = "ktnef-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/ktnef-21.08.2.tar.xz";
+      sha256 = "05l4g38f2m3qjl6q45j12zarpazsizjl2pyqh87vhaxgnf4fbqqp";
+      name = "ktnef-21.08.2.tar.xz";
     };
   };
   ktorrent = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/ktorrent-21.08.1.tar.xz";
-      sha256 = "1r7w43ns4zy94y82dbghrjgqv1sbdj01rni0iijirzjjikr5av9m";
-      name = "ktorrent-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/ktorrent-21.08.2.tar.xz";
+      sha256 = "1nd72jcvsc0kabd23ddy93dxp59ihg5npa8r3vbzvic89xlpkivi";
+      name = "ktorrent-21.08.2.tar.xz";
     };
   };
   ktouch = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/ktouch-21.08.1.tar.xz";
-      sha256 = "00pyrp00dqbanb2w0cxmxh8aahih714q85prjij6iy5sv0917zr7";
-      name = "ktouch-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/ktouch-21.08.2.tar.xz";
+      sha256 = "16r3hj160y1517dk1nzvikwkjlfbzmjpx54k9jc98csaplbv683l";
+      name = "ktouch-21.08.2.tar.xz";
     };
   };
   ktp-accounts-kcm = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/ktp-accounts-kcm-21.08.1.tar.xz";
-      sha256 = "0pn8g5w4p2synwfskw9m805nj2wk9g7yff423243qc3fxl572sv8";
-      name = "ktp-accounts-kcm-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/ktp-accounts-kcm-21.08.2.tar.xz";
+      sha256 = "0fxlkbx8kzlbfyfj7ac6m0y6vc80n3nlm5skrq106vbm1nnh565p";
+      name = "ktp-accounts-kcm-21.08.2.tar.xz";
     };
   };
   ktp-approver = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/ktp-approver-21.08.1.tar.xz";
-      sha256 = "1q2rsg9520ra7ap3ipvv0sdyc2mzbzap2ygzkwbm80fpspl6b973";
-      name = "ktp-approver-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/ktp-approver-21.08.2.tar.xz";
+      sha256 = "1pbc2f477xysv707j1xbcw799pxas31j5cmf26wrkbjmzxh5nhnd";
+      name = "ktp-approver-21.08.2.tar.xz";
     };
   };
   ktp-auth-handler = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/ktp-auth-handler-21.08.1.tar.xz";
-      sha256 = "0yzh2sqsyic3d979mj3m8d9m42y37w3h2s7gsyifw08gf5sna48p";
-      name = "ktp-auth-handler-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/ktp-auth-handler-21.08.2.tar.xz";
+      sha256 = "1fwzm15s8q8h47kfqw4jz2vfv81fc4azxg7c9r4vvlh23grlzbx8";
+      name = "ktp-auth-handler-21.08.2.tar.xz";
     };
   };
   ktp-call-ui = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/ktp-call-ui-21.08.1.tar.xz";
-      sha256 = "0m8x3mfhy5rnv9wp15zrl5fiwdkm66pc8szkncqnjxw2nv721s3m";
-      name = "ktp-call-ui-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/ktp-call-ui-21.08.2.tar.xz";
+      sha256 = "0d4iaqpl67w3q7rrk2h9glq91ha03hvnrywi6271nc4892r4b2ys";
+      name = "ktp-call-ui-21.08.2.tar.xz";
     };
   };
   ktp-common-internals = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/ktp-common-internals-21.08.1.tar.xz";
-      sha256 = "12jcfr3cvyhzn62jnlnfmp39wyxa06bih4qz8gxzv56nl434qzv0";
-      name = "ktp-common-internals-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/ktp-common-internals-21.08.2.tar.xz";
+      sha256 = "1jc8dv4563y4xlx13sz07lmkfnxraidqpxq08plapkliq56hv2xd";
+      name = "ktp-common-internals-21.08.2.tar.xz";
     };
   };
   ktp-contact-list = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/ktp-contact-list-21.08.1.tar.xz";
-      sha256 = "1d4d0bvi9c813c3gyws3gc8zca1az2f3ych2r1cgpdhhbqjrf3wl";
-      name = "ktp-contact-list-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/ktp-contact-list-21.08.2.tar.xz";
+      sha256 = "1glh9np0q82x9z7pb3xzvq1mwmfggzq8lc5in1lhhjzhpnla2n21";
+      name = "ktp-contact-list-21.08.2.tar.xz";
     };
   };
   ktp-contact-runner = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/ktp-contact-runner-21.08.1.tar.xz";
-      sha256 = "0l2qimrpfnpmhvspgv62y8a7hsbw4abz92n1xry040qmkfqzv2l7";
-      name = "ktp-contact-runner-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/ktp-contact-runner-21.08.2.tar.xz";
+      sha256 = "15xvw84c4ygz1zz3qkjmxfjrkczwrdwdmls5a4bc4d4i78df8v4m";
+      name = "ktp-contact-runner-21.08.2.tar.xz";
     };
   };
   ktp-desktop-applets = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/ktp-desktop-applets-21.08.1.tar.xz";
-      sha256 = "03si91agdjascs6ri0g5zrhicjzx24p6kh2ni1d96k5sc7alwxnl";
-      name = "ktp-desktop-applets-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/ktp-desktop-applets-21.08.2.tar.xz";
+      sha256 = "09bli0hhibwhia5zsprf1mv2li344lcqjq6pkirzz8h2dr1nr2s5";
+      name = "ktp-desktop-applets-21.08.2.tar.xz";
     };
   };
   ktp-filetransfer-handler = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/ktp-filetransfer-handler-21.08.1.tar.xz";
-      sha256 = "08dklgklc31fvcdi3917lh77gr58y75f1di0xhjf6jq8vxplqjd8";
-      name = "ktp-filetransfer-handler-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/ktp-filetransfer-handler-21.08.2.tar.xz";
+      sha256 = "0g0w1ayj3m6lkmy71xqvfg829rk9y5z98h6rnim3ag9yx44namzw";
+      name = "ktp-filetransfer-handler-21.08.2.tar.xz";
     };
   };
   ktp-kded-module = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/ktp-kded-module-21.08.1.tar.xz";
-      sha256 = "1135hh82ivvbpks9k39baisrq053570yq2x851j4vb2qrxg000yg";
-      name = "ktp-kded-module-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/ktp-kded-module-21.08.2.tar.xz";
+      sha256 = "1rx79zqqk2gl2qi28q429ss63kyndfzs24mdrn4491hsbln0sv1x";
+      name = "ktp-kded-module-21.08.2.tar.xz";
     };
   };
   ktp-send-file = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/ktp-send-file-21.08.1.tar.xz";
-      sha256 = "1fnn5m9spa0x8nw1rx94x85hy06qwkb1fl5l498rmhyzikhxmhqp";
-      name = "ktp-send-file-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/ktp-send-file-21.08.2.tar.xz";
+      sha256 = "1791zhp5rpwizx3y48hgamk7pgbx2yk650nczxbnza828m1lxzab";
+      name = "ktp-send-file-21.08.2.tar.xz";
     };
   };
   ktp-text-ui = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/ktp-text-ui-21.08.1.tar.xz";
-      sha256 = "0cfnf688jz5953x7jxjrdlfs96rxjcfzvasrc881y1aprav1dmjq";
-      name = "ktp-text-ui-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/ktp-text-ui-21.08.2.tar.xz";
+      sha256 = "1pinn61dkb2jcyzms3kf70sxjbkd3pkn6cxvxs8zsj1m1bdkydym";
+      name = "ktp-text-ui-21.08.2.tar.xz";
     };
   };
   ktuberling = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/ktuberling-21.08.1.tar.xz";
-      sha256 = "1f3a74nfh4fhxibcfxgjdj6phy185iz6y9nfg3pag3jvqsn8nx49";
-      name = "ktuberling-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/ktuberling-21.08.2.tar.xz";
+      sha256 = "0h7vhvh03w11dr17zxdmb5j2vz8flwahvz70h9kw8a63sxpw0x6f";
+      name = "ktuberling-21.08.2.tar.xz";
     };
   };
   kturtle = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/kturtle-21.08.1.tar.xz";
-      sha256 = "15ng6k6xfaj37dvycm29pj2pk73yfr66pp0wgj719c0kq7c9avdp";
-      name = "kturtle-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/kturtle-21.08.2.tar.xz";
+      sha256 = "1f3iw3fk4l8q2jnnadaqjbj6jzmw86ibf0p515x4rrqz4l8m6plg";
+      name = "kturtle-21.08.2.tar.xz";
     };
   };
   kubrick = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/kubrick-21.08.1.tar.xz";
-      sha256 = "03i0b24mmq3jqf7812a9sjr8lr82mq9mrq75z2a9h62jinvxvigj";
-      name = "kubrick-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/kubrick-21.08.2.tar.xz";
+      sha256 = "0kvd8dsg9hdgid70jd5b1vngqpmi9rigkvxl2v4h2ps1ziqqxa78";
+      name = "kubrick-21.08.2.tar.xz";
     };
   };
   kwalletmanager = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/kwalletmanager-21.08.1.tar.xz";
-      sha256 = "1a4aiajq04rlm566jwqwjq2b6sfamnabfrjfa80pld3qcmq0l1mz";
-      name = "kwalletmanager-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/kwalletmanager-21.08.2.tar.xz";
+      sha256 = "134690b4bhkjczwxg8776163aggwrqmb84xkvb7612wgs5jygyib";
+      name = "kwalletmanager-21.08.2.tar.xz";
     };
   };
   kwave = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/kwave-21.08.1.tar.xz";
-      sha256 = "1dl7kn67hp9y39xlnq989kg743295a23kbpjpvbjashgdqy3hqwl";
-      name = "kwave-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/kwave-21.08.2.tar.xz";
+      sha256 = "0sivhgcypwpdi6g0mkdzf1k2hqkj1vj4b5cdcvn8chs2gk9pisgh";
+      name = "kwave-21.08.2.tar.xz";
     };
   };
   kwordquiz = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/kwordquiz-21.08.1.tar.xz";
-      sha256 = "1mzdmgls07bb6k2x6qb1xzp04jpfifdrka2k6kzwy9bq071gs7q5";
-      name = "kwordquiz-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/kwordquiz-21.08.2.tar.xz";
+      sha256 = "1prj7iz71z8zy2ynjad7yqkgswg96q4hmc76kg1lvahn2waikr0y";
+      name = "kwordquiz-21.08.2.tar.xz";
     };
   };
   libgravatar = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/libgravatar-21.08.1.tar.xz";
-      sha256 = "08xl8nb0bn6zf9sh7sn4v7aa86ffqb16hixci4ymixyxy5c4gwbv";
-      name = "libgravatar-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/libgravatar-21.08.2.tar.xz";
+      sha256 = "047fbdj02rnb7bn2vn9lava2mh4ypzlyd8iiri4mbpd686lmi0s1";
+      name = "libgravatar-21.08.2.tar.xz";
     };
   };
   libkcddb = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/libkcddb-21.08.1.tar.xz";
-      sha256 = "08841rssxcg9vi490qih8jxnalnbjd2wqsgcq22gkm1ahfj5dizq";
-      name = "libkcddb-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/libkcddb-21.08.2.tar.xz";
+      sha256 = "03az77p3p0c0shzi2y2n5721gppzgrq469afvpjppria1n3ks5d2";
+      name = "libkcddb-21.08.2.tar.xz";
     };
   };
   libkcompactdisc = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/libkcompactdisc-21.08.1.tar.xz";
-      sha256 = "1q838md6kqvjmc61sy943lqgv5isll2px1s0izyvvxkf747hcpin";
-      name = "libkcompactdisc-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/libkcompactdisc-21.08.2.tar.xz";
+      sha256 = "0sjr8gdbqsjlggxax0l2bxn42l9znplrjiln15izj2zwfkah7d69";
+      name = "libkcompactdisc-21.08.2.tar.xz";
     };
   };
   libkdcraw = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/libkdcraw-21.08.1.tar.xz";
-      sha256 = "17ijpgljhrm851mdnd1znjpa7hidmv1d5d05q68r6lp1aclcgmwm";
-      name = "libkdcraw-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/libkdcraw-21.08.2.tar.xz";
+      sha256 = "0yhcrzl7piginz19vmyg63154j9rrqxfvfchn9k8g9jiddwnjfd8";
+      name = "libkdcraw-21.08.2.tar.xz";
     };
   };
   libkdegames = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/libkdegames-21.08.1.tar.xz";
-      sha256 = "0vfx3ksy6z5h4hjx0dl3fr3phfz3q590h86ksbp5q20lyylmdpji";
-      name = "libkdegames-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/libkdegames-21.08.2.tar.xz";
+      sha256 = "0jbb4h515c9h08r7dqaslqgrpmb6f08ai46phwgipd67jzgh6wh7";
+      name = "libkdegames-21.08.2.tar.xz";
     };
   };
   libkdepim = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/libkdepim-21.08.1.tar.xz";
-      sha256 = "10zb97zf1jidh9q6dkn8cjs9f4gqz2xn6yqylsbq0bjlycv991fh";
-      name = "libkdepim-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/libkdepim-21.08.2.tar.xz";
+      sha256 = "1j8nkfgzixpchz34p338mcm87f112ddy1linhaczg5fal1brangh";
+      name = "libkdepim-21.08.2.tar.xz";
     };
   };
   libkeduvocdocument = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/libkeduvocdocument-21.08.1.tar.xz";
-      sha256 = "0wnyx7h284g6wssnfdfz4m0hcb0rc6fnlryav8vnjcyzz7p5ni6l";
-      name = "libkeduvocdocument-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/libkeduvocdocument-21.08.2.tar.xz";
+      sha256 = "051mzwbrlpvjnqphf01nzzc76zbz9hasd57sn6y6x8cviflf7kmy";
+      name = "libkeduvocdocument-21.08.2.tar.xz";
     };
   };
   libkexiv2 = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/libkexiv2-21.08.1.tar.xz";
-      sha256 = "0wnpkzivb5f5z3d1dn5952cx07q8nw421xrs21r57cmbsss344xa";
-      name = "libkexiv2-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/libkexiv2-21.08.2.tar.xz";
+      sha256 = "0spa6pbr6rpnznvm2z0c410k5wssw4rw15rdc3f5ds9mbzbyxpva";
+      name = "libkexiv2-21.08.2.tar.xz";
     };
   };
   libkgapi = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/libkgapi-21.08.1.tar.xz";
-      sha256 = "14wzl40j5baw20628dqcpkg8vi6jsq5f9gw0sc1my8qhw91mj3vy";
-      name = "libkgapi-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/libkgapi-21.08.2.tar.xz";
+      sha256 = "13dna8iv3qzkc1jagjgji928g88wrgds47lcfj3dqkn8swamisa0";
+      name = "libkgapi-21.08.2.tar.xz";
     };
   };
   libkipi = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/libkipi-21.08.1.tar.xz";
-      sha256 = "13579gqxyj8dwmrmxylnw6mf56vr73vlbbv07rpi661kfrbjk2ms";
-      name = "libkipi-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/libkipi-21.08.2.tar.xz";
+      sha256 = "134iaagdn49y79aihi6k5pgx0cyk52wq38cdiinpcsxqc4xmzswh";
+      name = "libkipi-21.08.2.tar.xz";
     };
   };
   libkleo = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/libkleo-21.08.1.tar.xz";
-      sha256 = "1n1nacr1q0nw2jq8px6b3cmda6ff9mygggfrl3xh6qz042bg77xz";
-      name = "libkleo-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/libkleo-21.08.2.tar.xz";
+      sha256 = "14p3x2jq9sa5gkhcd7q3g5ras2sl62shrjm9kx4426mbnj10n0q2";
+      name = "libkleo-21.08.2.tar.xz";
     };
   };
   libkmahjongg = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/libkmahjongg-21.08.1.tar.xz";
-      sha256 = "0ry6wz0i9dccjn5w2qy2nin0rhbg30vlbcr4zrlx8bxsw0la2k94";
-      name = "libkmahjongg-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/libkmahjongg-21.08.2.tar.xz";
+      sha256 = "195c7bgn4jp2whqrg7l8g147kj92bvdcvcrh7n186kac9q0jqr3b";
+      name = "libkmahjongg-21.08.2.tar.xz";
     };
   };
   libkomparediff2 = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/libkomparediff2-21.08.1.tar.xz";
-      sha256 = "0n6xxam33k8j6c9wqdf0lhfpk6nyf9brhvdkivdamp0idhi3rcpx";
-      name = "libkomparediff2-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/libkomparediff2-21.08.2.tar.xz";
+      sha256 = "08y9p3il0i5sayq42v9p1v9f6yynp7ljb5d4ls1hf5ww4xxvx10x";
+      name = "libkomparediff2-21.08.2.tar.xz";
     };
   };
   libksane = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/libksane-21.08.1.tar.xz";
-      sha256 = "1x4wsdfczqnasr6ps8677m0ix1fqqd2316f6k2k3awn9qfgsqy3x";
-      name = "libksane-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/libksane-21.08.2.tar.xz";
+      sha256 = "094k5f0qwcm74jn5jlzs0mr74myp4s217ah2pl1kny1fm5hv5pyj";
+      name = "libksane-21.08.2.tar.xz";
     };
   };
   libksieve = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/libksieve-21.08.1.tar.xz";
-      sha256 = "1569xcjz575f8007z91zs9xn5wjklzkiy6l0cl7yzpzn880wc03p";
-      name = "libksieve-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/libksieve-21.08.2.tar.xz";
+      sha256 = "1jxb0a18mf8yqxbi90jbgjh90x17qr6z7ga6zxdb8gk1hjsyb10y";
+      name = "libksieve-21.08.2.tar.xz";
     };
   };
   libktorrent = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/libktorrent-21.08.1.tar.xz";
-      sha256 = "0y5881v0g49rr8dspzaq4l1c62rchgfq4mjx64sn0ng2jjpnhv1x";
-      name = "libktorrent-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/libktorrent-21.08.2.tar.xz";
+      sha256 = "16rx0na7gy03c0qbwy07q7si35z62p0pq7fcvf3ggr594akwz4kl";
+      name = "libktorrent-21.08.2.tar.xz";
     };
   };
   lokalize = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/lokalize-21.08.1.tar.xz";
-      sha256 = "0ih7a1rkwn9jpgk3qld8anavr0g4wlf8figwikhvbc2dw79lxs7k";
-      name = "lokalize-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/lokalize-21.08.2.tar.xz";
+      sha256 = "01f48fsrv095vlgxfjfdlm70xwsw73x5zhqbm38szn6r404jcmjm";
+      name = "lokalize-21.08.2.tar.xz";
     };
   };
   lskat = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/lskat-21.08.1.tar.xz";
-      sha256 = "1d89yqfsc703pnvxljcsn33wpsv64s4nr2wlmlbl609m9x8b9g9b";
-      name = "lskat-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/lskat-21.08.2.tar.xz";
+      sha256 = "03www1ix31ifmn6hvzymvhg157rdhahjfwvc9arns23zxpn1sq9p";
+      name = "lskat-21.08.2.tar.xz";
     };
   };
   mailcommon = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/mailcommon-21.08.1.tar.xz";
-      sha256 = "1r0qyqasah4z8vx836fhvv1f4zm20az9qrw8122l3a986lazh1zw";
-      name = "mailcommon-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/mailcommon-21.08.2.tar.xz";
+      sha256 = "0d0czxrf3i796pyrlifv4psq3hl4z2abhsqj1ns30xng45pzyrvz";
+      name = "mailcommon-21.08.2.tar.xz";
     };
   };
   mailimporter = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/mailimporter-21.08.1.tar.xz";
-      sha256 = "05kiizbdnsl15ry2zb5sg94lcdwq9w4lnznd6zcq8n09s0zpz8nf";
-      name = "mailimporter-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/mailimporter-21.08.2.tar.xz";
+      sha256 = "0vd0bghszwr1wh4x2ygd7flg0kypb8m92gvh0q800gdgnqj87lw7";
+      name = "mailimporter-21.08.2.tar.xz";
     };
   };
   marble = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/marble-21.08.1.tar.xz";
-      sha256 = "01hf3wwz9zflkpgx1pbkxbnl1vs2yyafrwmldnil66nkxsxx7izw";
-      name = "marble-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/marble-21.08.2.tar.xz";
+      sha256 = "1l8dwj0kyq8r3cap2sjsr4blbz591l6cxhglkhxwds901igacmxa";
+      name = "marble-21.08.2.tar.xz";
     };
   };
   markdownpart = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/markdownpart-21.08.1.tar.xz";
-      sha256 = "0xgs2kxnbrn70mrzza2d4f7xpx9ks3dbl3yj1y1kds7bnidsf3f9";
-      name = "markdownpart-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/markdownpart-21.08.2.tar.xz";
+      sha256 = "0vx2d31d9c9ipwkbnlrjhzkaj97a7vz6vigbbkvw4cyaqhq6zkqp";
+      name = "markdownpart-21.08.2.tar.xz";
     };
   };
   mbox-importer = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/mbox-importer-21.08.1.tar.xz";
-      sha256 = "06mgz10ma8r0vi7ln9zxz2kipdp9rd0zw0sgm69h43rq9zyjnjkk";
-      name = "mbox-importer-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/mbox-importer-21.08.2.tar.xz";
+      sha256 = "1bf4awkrivx209rnwflxrqdxzvj8mzlgzis79hn9n654qy6ar2d5";
+      name = "mbox-importer-21.08.2.tar.xz";
     };
   };
   messagelib = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/messagelib-21.08.1.tar.xz";
-      sha256 = "1r3lqacixy5vy36jgy6glz08gp8k4559h1bdqyh7svmmflhs927i";
-      name = "messagelib-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/messagelib-21.08.2.tar.xz";
+      sha256 = "0gsxik4ib72xhw948h257m17w4k49sa3ymbg87n0q8nd6gykxyhr";
+      name = "messagelib-21.08.2.tar.xz";
     };
   };
   minuet = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/minuet-21.08.1.tar.xz";
-      sha256 = "0law0ram3xdf5ayc7j8as1xwj83k37mf7w6qkkp3hy3kj2r2dahx";
-      name = "minuet-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/minuet-21.08.2.tar.xz";
+      sha256 = "13i37xw2aarmqi25m1r68z9zjwqf9nx8bxlflb0wxghzf3pgrp4v";
+      name = "minuet-21.08.2.tar.xz";
     };
   };
   okular = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/okular-21.08.1.tar.xz";
-      sha256 = "1vk1mn40i80b5vkxq47i1qf2i734n5nfa1wgx3748jwc1fws631p";
-      name = "okular-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/okular-21.08.2.tar.xz";
+      sha256 = "0y3n340fbhsgmmrq4vz2p9682xzs7hsvvna8ffh4r15wgl1qdb9q";
+      name = "okular-21.08.2.tar.xz";
     };
   };
   palapeli = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/palapeli-21.08.1.tar.xz";
-      sha256 = "09mswv446s6vqlllhz727qpd7mdszdkgivfn9sazgmydmmmzrw53";
-      name = "palapeli-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/palapeli-21.08.2.tar.xz";
+      sha256 = "0pl6hi0c5fa6zs3gdicm1s7rmzzdjjvrm8s8ds6f4ghq6dmlknqj";
+      name = "palapeli-21.08.2.tar.xz";
     };
   };
   parley = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/parley-21.08.1.tar.xz";
-      sha256 = "02v9gfjdryf48m5iinsc9qg2qfmj1s96xga5b3ndd63g66b6gp9b";
-      name = "parley-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/parley-21.08.2.tar.xz";
+      sha256 = "0lykvjaxfj6blgjkmipvlw9531npz46d6jwq6w5wxvk6f1b2cgbh";
+      name = "parley-21.08.2.tar.xz";
     };
   };
   partitionmanager = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/partitionmanager-21.08.1.tar.xz";
-      sha256 = "16vc0g08rs6dz87zv4b1ygs198c6mbjwcp2j4994z6cf16bxfgz8";
-      name = "partitionmanager-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/partitionmanager-21.08.2.tar.xz";
+      sha256 = "1fa90mnby2kf5a85wjz7xvb999gh5c2yn0j3g562zndqznqhcpvx";
+      name = "partitionmanager-21.08.2.tar.xz";
     };
   };
   picmi = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/picmi-21.08.1.tar.xz";
-      sha256 = "1yshwfl8baw0cw8hnvzkb3y72r0bycyr19rwwns9sjc3fk9gnk6a";
-      name = "picmi-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/picmi-21.08.2.tar.xz";
+      sha256 = "0qvz4fl4jb256rwmaw0bszr3x2b5jd8priilc3jr33v393f3pd6q";
+      name = "picmi-21.08.2.tar.xz";
     };
   };
   pim-data-exporter = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/pim-data-exporter-21.08.1.tar.xz";
-      sha256 = "1vx7h7900wq8icx7q4khkx9g5gm6j5c8dl38q08pwda4vl0pmxmd";
-      name = "pim-data-exporter-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/pim-data-exporter-21.08.2.tar.xz";
+      sha256 = "0li96fkwkdg4ziyv4n56vn49wav4kilf7lqb4s9xwj8h44kjpa5f";
+      name = "pim-data-exporter-21.08.2.tar.xz";
     };
   };
   pim-sieve-editor = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/pim-sieve-editor-21.08.1.tar.xz";
-      sha256 = "0ph62khl2k2gpfjf05p9sklihib0hbxgl3n1bv59l58awj9brs0r";
-      name = "pim-sieve-editor-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/pim-sieve-editor-21.08.2.tar.xz";
+      sha256 = "173c595djmz3wyzl9dl3br8m3k0940ncdyjf8rjfgrh79y86bh7m";
+      name = "pim-sieve-editor-21.08.2.tar.xz";
     };
   };
   pimcommon = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/pimcommon-21.08.1.tar.xz";
-      sha256 = "1379lhvin2vkikd3fzanhwfjszb4cc9f3h9bxf3md3h4gx1i6hb6";
-      name = "pimcommon-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/pimcommon-21.08.2.tar.xz";
+      sha256 = "074pbxprzx8hd6fikjvx8hn9g9135swzhj1f5zvfvhyvlpyj90wg";
+      name = "pimcommon-21.08.2.tar.xz";
     };
   };
   poxml = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/poxml-21.08.1.tar.xz";
-      sha256 = "10wwrbmhwbjk71m4ya1shb7mviil33fciykrzyqvvdnvx668aawm";
-      name = "poxml-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/poxml-21.08.2.tar.xz";
+      sha256 = "1h7y4y1n3xcpgrkabik21ilck5dmq6p3qxs3xm9vzq1jxpb9izyf";
+      name = "poxml-21.08.2.tar.xz";
     };
   };
   print-manager = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/print-manager-21.08.1.tar.xz";
-      sha256 = "1hzykjnymr0knh67h6s5214bjp5lk1klm6znh8q2asf49c6x2zgw";
-      name = "print-manager-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/print-manager-21.08.2.tar.xz";
+      sha256 = "0g2y2i7iysi6i397gd9fpqpk9cha7z4b2wz6shcqp0jyvvwl1pd3";
+      name = "print-manager-21.08.2.tar.xz";
     };
   };
   rocs = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/rocs-21.08.1.tar.xz";
-      sha256 = "1b527n0csk43sxafynqijiwf0bzj89viznpxnk2ayb9lik4q3djm";
-      name = "rocs-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/rocs-21.08.2.tar.xz";
+      sha256 = "0cvgi42w1a7zd6bzazly9w2azbyp9gzvkyx5wlff5z99nk6v3mp0";
+      name = "rocs-21.08.2.tar.xz";
     };
   };
   signon-kwallet-extension = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/signon-kwallet-extension-21.08.1.tar.xz";
-      sha256 = "1x1q1vmqm9nq7sjhxc495x612jh39scxba0nbr8a4rval144268m";
-      name = "signon-kwallet-extension-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/signon-kwallet-extension-21.08.2.tar.xz";
+      sha256 = "19jp6h9xqhlyvddgyg9jz74by0pcxqm920c5h8vln5vkkcgsdwws";
+      name = "signon-kwallet-extension-21.08.2.tar.xz";
     };
   };
   skanlite = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/skanlite-21.08.1.tar.xz";
-      sha256 = "17lnazx1h4lk78037gvzscnm3p2yl6dhc4970bdq982ahwp63gg8";
-      name = "skanlite-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/skanlite-21.08.2.tar.xz";
+      sha256 = "1zwrb7j7x234vbb57p8gzbqz2mfr1n2i84yjf16jrsv1fm53z9md";
+      name = "skanlite-21.08.2.tar.xz";
     };
   };
   spectacle = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/spectacle-21.08.1.tar.xz";
-      sha256 = "0bs93gylw90wj3b9kw71xhqy60smggh38s5g4jcras1n6iqmb06x";
-      name = "spectacle-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/spectacle-21.08.2.tar.xz";
+      sha256 = "0m59cnfqkm379i6ayj1g5flszqs26dmnwl79324d1j6bxk24mjrh";
+      name = "spectacle-21.08.2.tar.xz";
     };
   };
   step = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/step-21.08.1.tar.xz";
-      sha256 = "0rg69j8r479vzyrajbdjgh5l2506w8f2dnlh1di545gzjk2ww448";
-      name = "step-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/step-21.08.2.tar.xz";
+      sha256 = "15l11s39hw847kd37fhq6kp3ajbsxidkfpp2ryb9dfh595lncg2r";
+      name = "step-21.08.2.tar.xz";
     };
   };
   svgpart = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/svgpart-21.08.1.tar.xz";
-      sha256 = "1silp6k0l9xb363h8whiv4dry6gf1mj4w53mksl1i2slhqn9q96v";
-      name = "svgpart-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/svgpart-21.08.2.tar.xz";
+      sha256 = "14xgwdvpcvgw0jj4gy3175ah38x9f8lhknqbw5bczvm9cy8j7qfw";
+      name = "svgpart-21.08.2.tar.xz";
     };
   };
   sweeper = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/sweeper-21.08.1.tar.xz";
-      sha256 = "0p25bkczxmx93igicyiasvjd4v9rc3sg7gm7b9ddgzz8rrnr0d9p";
-      name = "sweeper-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/sweeper-21.08.2.tar.xz";
+      sha256 = "1yvcfdhapml1vzqns67v6j2c39g752f8czxs7bnczi69fq1ksh0b";
+      name = "sweeper-21.08.2.tar.xz";
     };
   };
   umbrello = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/umbrello-21.08.1.tar.xz";
-      sha256 = "0x4f3hiydyprhzd56i8lijwfhzca041bmbbxp7x1dckv3shdangc";
-      name = "umbrello-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/umbrello-21.08.2.tar.xz";
+      sha256 = "1xiz006ppgss6rxg7lndgnrbcdbm0iq1hjly3rjn943ff11wq5yr";
+      name = "umbrello-21.08.2.tar.xz";
     };
   };
   yakuake = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/yakuake-21.08.1.tar.xz";
-      sha256 = "1x41jrkvlff8x5qcd12lcrv6zqzw7jqw02ikpmqv1v4gw7lz94w9";
-      name = "yakuake-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/yakuake-21.08.2.tar.xz";
+      sha256 = "1d8dh10jkpm4pm8fh1bmkdwvv59gk0fg6dr3gahlspnh4hhzy4hg";
+      name = "yakuake-21.08.2.tar.xz";
     };
   };
   zeroconf-ioslave = {
-    version = "21.08.1";
+    version = "21.08.2";
     src = fetchurl {
-      url = "${mirror}/stable/release-service/21.08.1/src/zeroconf-ioslave-21.08.1.tar.xz";
-      sha256 = "113sp3lqzyxx7icww4sznc23kxarmxz0158kzl6nazxj4m6cnm4r";
-      name = "zeroconf-ioslave-21.08.1.tar.xz";
+      url = "${mirror}/stable/release-service/21.08.2/src/zeroconf-ioslave-21.08.2.tar.xz";
+      sha256 = "0xgm4y29iklal5kd5z76jdw6wgw0mg9xn0f0d07zyshv5hjgllv6";
+      name = "zeroconf-ioslave-21.08.2.tar.xz";
     };
   };
 }
diff --git a/pkgs/applications/misc/goldendict/default.nix b/pkgs/applications/misc/goldendict/default.nix
index 03668e586117..f0eed5c1e2fc 100644
--- a/pkgs/applications/misc/goldendict/default.nix
+++ b/pkgs/applications/misc/goldendict/default.nix
@@ -56,7 +56,6 @@ mkDerivation rec {
   postInstall = lib.optionalString stdenv.isDarwin ''
     mkdir -p $out/Applications
     mv GoldenDict.app $out/Applications
-    wrapQtApp $out/Applications/GoldenDict.app/Contents/MacOS/GoldenDict
   '';
 
   meta = with lib; {
diff --git a/pkgs/applications/misc/gpxlab/default.nix b/pkgs/applications/misc/gpxlab/default.nix
index c8d6eb3b84c7..8d2b95ea4f31 100644
--- a/pkgs/applications/misc/gpxlab/default.nix
+++ b/pkgs/applications/misc/gpxlab/default.nix
@@ -28,7 +28,6 @@ mkDerivation rec {
   postInstall = lib.optionalString stdenv.isDarwin ''
     mkdir -p $out/Applications
     mv GPXLab/GPXLab.app $out/Applications
-    wrapQtApp $out/Applications/GPXLab.app/Contents/MacOS/GPXLab
   '';
 
   meta = with lib; {
diff --git a/pkgs/applications/misc/gpxsee/default.nix b/pkgs/applications/misc/gpxsee/default.nix
index f008ea439ed6..bbe77c182205 100644
--- a/pkgs/applications/misc/gpxsee/default.nix
+++ b/pkgs/applications/misc/gpxsee/default.nix
@@ -26,7 +26,6 @@ mkDerivation rec {
   postInstall = with stdenv; lib.optionalString isDarwin ''
     mkdir -p $out/Applications
     mv GPXSee.app $out/Applications
-    wrapQtApp $out/Applications/GPXSee.app/Contents/MacOS/GPXSee
   '';
 
   meta = with lib; {
diff --git a/pkgs/applications/misc/keepassx/community.nix b/pkgs/applications/misc/keepassx/community.nix
index fdd606c892d2..a8548f2c5c00 100644
--- a/pkgs/applications/misc/keepassx/community.nix
+++ b/pkgs/applications/misc/keepassx/community.nix
@@ -115,11 +115,6 @@ stdenv.mkDerivation rec {
   ++ optional (stdenv.isDarwin && withKeePassTouchID)
     darwin.apple_sdk.frameworks.LocalAuthentication;
 
-  preFixup = optionalString stdenv.isDarwin ''
-    # Make it work without Qt in PATH.
-    wrapQtApp $out/Applications/KeePassXC.app/Contents/MacOS/KeePassXC
-  '';
-
   passthru.tests = nixosTests.keepassxc;
 
   meta = {
diff --git a/pkgs/applications/misc/lsd2dsl/default.nix b/pkgs/applications/misc/lsd2dsl/default.nix
index 8c884305277a..2dfbaeb9941a 100644
--- a/pkgs/applications/misc/lsd2dsl/default.nix
+++ b/pkgs/applications/misc/lsd2dsl/default.nix
@@ -30,9 +30,6 @@ mkDerivation rec {
 
   installPhase = ''
     install -Dm755 console/lsd2dsl gui/lsd2dsl-qtgui -t $out/bin
-  '' + lib.optionalString stdenv.isDarwin ''
-    wrapQtApp $out/bin/lsd2dsl
-    wrapQtApp $out/bin/lsd2dsl-qtgui
   '';
 
   meta = with lib; {
diff --git a/pkgs/applications/misc/merkaartor/default.nix b/pkgs/applications/misc/merkaartor/default.nix
index 90d91583a26f..eda540427bbd 100644
--- a/pkgs/applications/misc/merkaartor/default.nix
+++ b/pkgs/applications/misc/merkaartor/default.nix
@@ -50,7 +50,6 @@ mkDerivation rec {
     mkdir -p $out/Applications
     mv binaries/bin/merkaartor.app $out/Applications
     mv binaries/bin/plugins $out/Applications/merkaartor.app/Contents
-    wrapQtApp $out/Applications/merkaartor.app/Contents/MacOS/merkaartor
   '';
 
   meta = with lib; {
diff --git a/pkgs/applications/misc/multibootusb/default.nix b/pkgs/applications/misc/multibootusb/default.nix
index 1d625a67b7b9..3890246a63d6 100644
--- a/pkgs/applications/misc/multibootusb/default.nix
+++ b/pkgs/applications/misc/multibootusb/default.nix
@@ -1,6 +1,6 @@
 { fetchFromGitHub, libxcb, mtools, p7zip, parted, procps, qemu, unzip, zip,
   coreutils, gnugrep, which, gnused, e2fsprogs, autoPatchelfHook, gptfdisk,
-  python36Packages, qt5, runtimeShell, lib, util-linux, wrapQtAppsHook }:
+  python3Packages, qt5, runtimeShell, lib, util-linux, wrapQtAppsHook }:
 
 # Note: Multibootusb is tricky to maintain. It relies on the
 # $PYTHONPATH variable containing some of their code, so that
@@ -13,7 +13,7 @@
 #
 # https://github.com/mbusb/multibootusb/blob/0d34d70c3868f1d7695cfd141141b17c075de967/scripts/osdriver.py#L59
 
-python36Packages.buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
   pname = "multibootusb";
   name = "${pname}-${version}";
   version = "9.2.0";
@@ -42,7 +42,7 @@ python36Packages.buildPythonApplication rec {
 
   buildInputs = [
     libxcb
-    python36Packages.python
+    python3Packages.python
     qt5.full
   ];
 
@@ -58,12 +58,12 @@ python36Packages.buildPythonApplication rec {
   # "Failed to connect to socket /run/dbus/system_bus_socket: No such file or directory"
   doCheck = false;
 
-  pythonPath = [
-    python36Packages.dbus-python
-    python36Packages.pyqt5
-    python36Packages.pytest-shutil
-    python36Packages.pyudev
-    python36Packages.six
+  pythonPath = with python3Packages; [
+    dbus-python
+    pyqt5
+    pytest-shutil
+    pyudev
+    six
   ];
 
   # multibootusb ships zips with various versions of syslinux, we need to patchelf them
@@ -95,7 +95,7 @@ python36Packages.buildPythonApplication rec {
       "''${qtWrapperArgs[@]}"
 
       # Then, add the installed scripts/ directory to the python path
-      --prefix "PYTHONPATH" ":" "$out/lib/${python36Packages.python.libPrefix}/site-packages"
+      --prefix "PYTHONPATH" ":" "$out/lib/${python3Packages.python.libPrefix}/site-packages"
 
       # Add some runtime dependencies
       --prefix "PATH" ":" "${lib.makeBinPath runTimeDeps}"
diff --git a/pkgs/applications/misc/sleepyhead/default.nix b/pkgs/applications/misc/sleepyhead/default.nix
index bf8a9efb9fd0..94c47c23afef 100644
--- a/pkgs/applications/misc/sleepyhead/default.nix
+++ b/pkgs/applications/misc/sleepyhead/default.nix
@@ -33,10 +33,6 @@ in mkDerivation {
     cp sleepyhead/SleepyHead $out/bin
   '';
 
-  postFixup = lib.optionalString stdenv.isDarwin ''
-    wrapQtApp "$out/Applications/SleepyHead.app/Contents/MacOS/SleepyHead"
-  '';
-
   meta = with lib; {
     homepage = "https://sleepyhead.jedimark.net/";
     description = "Review and explore data produced by CPAP and related machines";
diff --git a/pkgs/applications/misc/xpdf/default.nix b/pkgs/applications/misc/xpdf/default.nix
index e57fb75c11f1..eb5ebf3a7177 100644
--- a/pkgs/applications/misc/xpdf/default.nix
+++ b/pkgs/applications/misc/xpdf/default.nix
@@ -51,11 +51,6 @@ stdenv.mkDerivation rec {
     install -Dm644 $src/xpdf-qt/xpdf-icon.svg $out/share/pixmaps/xpdf.svg
   '';
 
-  # wrapQtAppsHook broken on macOS (https://github.com/NixOS/nixpkgs/issues/102044)
-  postFixup = lib.optionalString stdenv.isDarwin ''
-    wrapQtApp $out/bin/xpdf
-  '';
-
   meta = with lib; {
     homepage = "https://www.xpdfreader.com";
     description = "Viewer for Portable Document Format (PDF) files";
diff --git a/pkgs/applications/networking/browsers/firefox/common.nix b/pkgs/applications/networking/browsers/firefox/common.nix
index 2600b5209bb1..a1a215aefcbd 100644
--- a/pkgs/applications/networking/browsers/firefox/common.nix
+++ b/pkgs/applications/networking/browsers/firefox/common.nix
@@ -117,9 +117,7 @@ let
                 then overrideCC stdenv llvmPackages.clangUseLLVM
                 else stdenv;
 
-  # Disable p11-kit support in nss until our cacert packages has caught up exposing CKA_NSS_MOZILLA_CA_POLICY
-  # https://github.com/NixOS/nixpkgs/issues/126065
-  nss_pkg = if lib.versionOlder version "83" then nss_3_53 else nss.override { useP11kit = false; };
+  nss_pkg = if lib.versionOlder version "83" then nss_3_53 else nss;
 
   # --enable-release adds -ffunction-sections & LTO that require a big amount of
   # RAM and the 32-bit memory space cannot handle that linking
diff --git a/pkgs/applications/networking/cluster/k3s/default.nix b/pkgs/applications/networking/cluster/k3s/default.nix
index 78dffeb20ede..11b36d9c77e5 100644
--- a/pkgs/applications/networking/cluster/k3s/default.nix
+++ b/pkgs/applications/networking/cluster/k3s/default.nix
@@ -13,7 +13,6 @@
 , pkg-config
 , ethtool
 , util-linux
-, ipset
 , fetchFromGitHub
 , fetchurl
 , fetchzip
@@ -254,7 +253,6 @@ stdenv.mkDerivation rec {
     bridge-utils
     ethtool
     util-linux # kubelet wants 'nsenter' from util-linux: https://github.com/kubernetes/kubernetes/issues/26093#issuecomment-705994388
-    ipset
     conntrack-tools
   ];
 
diff --git a/pkgs/applications/networking/firehol/default.nix b/pkgs/applications/networking/firehol/default.nix
index 424c67721046..145fae2553a2 100644
--- a/pkgs/applications/networking/firehol/default.nix
+++ b/pkgs/applications/networking/firehol/default.nix
@@ -1,5 +1,5 @@
 { stdenv, lib, fetchFromGitHub, pkgs
-, autoconf, automake, curl, iprange, iproute2, ipset, iptables, iputils
+, autoconf, automake, curl, iprange, iproute2, iptables, iputils
 , kmod, nettools, procps, tcpdump, traceroute, util-linux, whois
 
 # If true, just install FireQOS without FireHOL
@@ -35,13 +35,14 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ autoconf automake ];
   buildInputs = [
-    curl iprange iproute2 ipset iptables iputils kmod
+    curl iprange iproute2 iptables iputils kmod
     nettools procps tcpdump traceroute util-linux whois
   ];
 
   preConfigure = "./autogen.sh";
   configureFlags = [ "--localstatedir=/var"
-                     "--disable-doc" "--disable-man" ] ++
+                     "--disable-doc" "--disable-man"
+                     "--disable-update-ipsets" ] ++
                    lib.optional onlyQOS [ "--disable-firehol" ];
 
   meta = with lib; {
diff --git a/pkgs/applications/networking/instant-messengers/chatterino2/default.nix b/pkgs/applications/networking/instant-messengers/chatterino2/default.nix
index 99e3a90b60b6..7a2415199375 100644
--- a/pkgs/applications/networking/instant-messengers/chatterino2/default.nix
+++ b/pkgs/applications/networking/instant-messengers/chatterino2/default.nix
@@ -16,9 +16,6 @@ mkDerivation rec {
     mkdir -p "$out/Applications"
     mv bin/chatterino.app "$out/Applications/"
   '';
-  postFixup = lib.optionalString stdenv.isDarwin ''
-    wrapQtApp "$out/Applications/chatterino.app/Contents/MacOS/chatterino"
-  '';
   meta = with lib; {
     description = "A chat client for Twitch chat";
     longDescription = ''
diff --git a/pkgs/applications/networking/instant-messengers/tensor/default.nix b/pkgs/applications/networking/instant-messengers/tensor/default.nix
index 172d11f6b857..477e5442b829 100644
--- a/pkgs/applications/networking/instant-messengers/tensor/default.nix
+++ b/pkgs/applications/networking/instant-messengers/tensor/default.nix
@@ -34,7 +34,6 @@ mkDerivation rec {
 
     mkdir -p $out/Applications
     cp -r tensor.app $out/Applications/tensor.app
-    wrapQtApp $out/Applications/tensor.app/Contents/MacOS/tensor
 
     runHook postInstall
   '' else ''
diff --git a/pkgs/applications/networking/irc/communi/default.nix b/pkgs/applications/networking/irc/communi/default.nix
index 9148a26567df..df7168ac308e 100644
--- a/pkgs/applications/networking/irc/communi/default.nix
+++ b/pkgs/applications/networking/irc/communi/default.nix
@@ -38,8 +38,6 @@ stdenv.mkDerivation rec {
     install_name_tool \
       -add_rpath @executable_path/../Frameworks \
       $out/Applications/Communi.app/Contents/MacOS/Communi
-
-    wrapQtApp $out/Applications/Communi.app/Contents/MacOS/Communi
   '' else ''
     substituteInPlace "$out/share/applications/communi.desktop" \
       --replace "/usr/bin" "$out/bin"
diff --git a/pkgs/applications/networking/sniffers/wireshark/default.nix b/pkgs/applications/networking/sniffers/wireshark/default.nix
index 50a28b5998eb..7c9eda762603 100644
--- a/pkgs/applications/networking/sniffers/wireshark/default.nix
+++ b/pkgs/applications/networking/sniffers/wireshark/default.nix
@@ -66,8 +66,6 @@ in stdenv.mkDerivation {
             install_name_tool -change "$dylib" "$out/lib/$dylib" "$f"
         done
     done
-
-    wrapQtApp $out/Applications/Wireshark.app/Contents/MacOS/Wireshark
   '' else optionalString withQt ''
     install -Dm644 -t $out/share/applications ../wireshark.desktop
 
diff --git a/pkgs/applications/office/beamerpresenter/default.nix b/pkgs/applications/office/beamerpresenter/default.nix
index 351609d8c058..e898a43ad97c 100644
--- a/pkgs/applications/office/beamerpresenter/default.nix
+++ b/pkgs/applications/office/beamerpresenter/default.nix
@@ -37,10 +37,6 @@ stdenv.mkDerivation rec {
     done
   '';
 
-  postInstall = lib.optionalString stdenv.isDarwin ''
-    wrapQtApp "$out"/bin/beamerpresenter.app/Contents/MacOS/beamerpresenter
-  '';
-
   meta = with lib; {
     description = "Modular multi screen pdf presentation software respecting your window manager";
     homepage = "https://github.com/stiglers-eponym/BeamerPresenter";
diff --git a/pkgs/applications/science/astronomy/stellarium/default.nix b/pkgs/applications/science/astronomy/stellarium/default.nix
index 898885047a05..f54dcb94e23b 100644
--- a/pkgs/applications/science/astronomy/stellarium/default.nix
+++ b/pkgs/applications/science/astronomy/stellarium/default.nix
@@ -28,10 +28,6 @@ mkDerivation rec {
                 'SET(CMAKE_INSTALL_PREFIX "${placeholder "out"}/Stellarium.app/Contents")'
   '';
 
-  postFixup = lib.optionalString stdenv.isDarwin ''
-    wrapQtApp "$out"/Stellarium.app/Contents/MacOS/stellarium
-  '';
-
   meta = with lib; {
     description = "Free open-source planetarium";
     homepage = "http://stellarium.org/";
diff --git a/pkgs/applications/version-management/git-and-tools/git/default.nix b/pkgs/applications/version-management/git-and-tools/git/default.nix
index 6bdefb8cb38d..bd6f347792ad 100644
--- a/pkgs/applications/version-management/git-and-tools/git/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git/default.nix
@@ -25,7 +25,7 @@ assert sendEmailSupport -> perlSupport;
 assert svnSupport -> perlSupport;
 
 let
-  version = "2.33.0";
+  version = "2.33.1";
   svn = subversionClient.override { perlBindings = perlSupport; };
 
   gitwebPerlLibs = with perlPackages; [ CGI HTMLParser CGIFast FCGI FCGIProcManager HTMLTagCloud ];
@@ -37,7 +37,7 @@ stdenv.mkDerivation {
 
   src = fetchurl {
     url = "https://www.kernel.org/pub/software/scm/git/git-${version}.tar.xz";
-    sha256 = "0kqcs8nj5h7rh3q86pw5777awq7gn77lgxk88ynjl1rfz2snlg5z";
+    sha256 = "sha256-4FSm5sKwiL0b/19h7ZulqpHJo81QlTmktBxd3wIgHy8=";
   };
 
   outputs = [ "out" ] ++ lib.optional withManual "doc";
diff --git a/pkgs/applications/video/jellyfin-media-player/default.nix b/pkgs/applications/video/jellyfin-media-player/default.nix
index 8c23bfc5c298..82d34d188ff6 100644
--- a/pkgs/applications/video/jellyfin-media-player/default.nix
+++ b/pkgs/applications/video/jellyfin-media-player/default.nix
@@ -94,9 +94,6 @@ mkDerivation rec {
     mv $out/Resources/* "$out/Applications/Jellyfin Media Player.app/Contents/Resources/"
     rmdir $out/Resources
 
-    # fix 'Could not find the Qt platform plugin "cocoa" in ""' error
-    wrapQtApp "$out/Applications/Jellyfin Media Player.app/Contents/MacOS/Jellyfin Media Player"
-
     ln -s "$out/Applications/Jellyfin Media Player.app/Contents/MacOS/Jellyfin Media Player" $out/bin/jellyfinmediaplayer
   '';
 
diff --git a/pkgs/build-support/bintools-wrapper/default.nix b/pkgs/build-support/bintools-wrapper/default.nix
index 3d64639d33fa..53f367b9b84d 100644
--- a/pkgs/build-support/bintools-wrapper/default.nix
+++ b/pkgs/build-support/bintools-wrapper/default.nix
@@ -324,6 +324,16 @@ stdenv.mkDerivation {
       echo "-arch ${targetPlatform.darwinArch}" >> $out/nix-support/libc-ldflags
     ''
 
+    ##
+    ## GNU specific extra strip flags
+    ##
+
+    # TODO(@sternenseemann): make a generic strip wrapper?
+    + optionalString (bintools.isGNU or false) ''
+      wrap ${targetPrefix}strip ${./gnu-binutils-strip-wrapper.sh} \
+        "${bintools_bin}/bin/${targetPrefix}strip"
+    ''
+
     ###
     ### Remove LC_UUID
     ###
diff --git a/pkgs/build-support/bintools-wrapper/gnu-binutils-strip-wrapper.sh b/pkgs/build-support/bintools-wrapper/gnu-binutils-strip-wrapper.sh
new file mode 100644
index 000000000000..5b5136e3d14c
--- /dev/null
+++ b/pkgs/build-support/bintools-wrapper/gnu-binutils-strip-wrapper.sh
@@ -0,0 +1,4 @@
+#! @shell@
+# shellcheck shell=bash
+
+exec @prog@ --enable-deterministic-archives "$@"
diff --git a/pkgs/build-support/rust/hooks/cargo-check-hook.sh b/pkgs/build-support/rust/hooks/cargo-check-hook.sh
index f0339afb38fa..8a8e434f0ff6 100644
--- a/pkgs/build-support/rust/hooks/cargo-check-hook.sh
+++ b/pkgs/build-support/rust/hooks/cargo-check-hook.sh
@@ -16,11 +16,11 @@ cargoCheckHook() {
         threads=1
     fi
 
-    if [ "${cargoBuildType}" != "debug" ]; then
-        cargoBuildProfileFlag="--${cargoBuildType}"
+    if [ "${cargoCheckType}" != "debug" ]; then
+        cargoCheckProfileFlag="--${cargoCheckType}"
     fi
 
-    argstr="${cargoBuildProfileFlag} --target @rustTargetPlatformSpec@ --frozen ${cargoTestFlags}";
+    argstr="${cargoCheckProfileFlag} --target @rustTargetPlatformSpec@ --frozen ${cargoTestFlags}";
 
     (
         set -x
diff --git a/pkgs/build-support/setup-hooks/strip.sh b/pkgs/build-support/setup-hooks/strip.sh
index c31a50eba57b..2d8e66a89fa3 100644
--- a/pkgs/build-support/setup-hooks/strip.sh
+++ b/pkgs/build-support/setup-hooks/strip.sh
@@ -51,7 +51,7 @@ stripDirs() {
 
     if [ -n "${dirs}" ]; then
         header "stripping (with command $cmd and flags $stripFlags) in$dirs"
-        find $dirs -type f -exec $cmd $commonStripFlags $stripFlags '{}' \; 2>/dev/null
+        find $dirs -type f -exec $cmd $stripFlags '{}' \; 2>/dev/null
         stopNest
     fi
 }
diff --git a/pkgs/data/misc/cacert/default.nix b/pkgs/data/misc/cacert/default.nix
index bd67e2a58f12..49645ee80083 100644
--- a/pkgs/data/misc/cacert/default.nix
+++ b/pkgs/data/misc/cacert/default.nix
@@ -1,126 +1,27 @@
 { lib
 , stdenv
+, writeText
 , fetchurl
-, nss
-, python3
-, blacklist ? [ ]
+, buildcatrust
+, blacklist ? []
+, extraCertificateFiles ? []
+, extraCertificateStrings ? []
 
-  # Used for tests only
+# Used by update.sh
+, nssOverride ? null
+
+# Used for tests only
 , runCommand
 , cacert
 , openssl
 }:
 
 let
-  certdata2pem = fetchurl {
-    name = "certdata2pem.py";
-    urls = [
-      "https://salsa.debian.org/debian/ca-certificates/raw/debian/20170717/mozilla/certdata2pem.py"
-      "https://git.launchpad.net/ubuntu/+source/ca-certificates/plain/mozilla/certdata2pem.py?id=47e49e1e0a8a1ca74deda27f88fe181191562957"
-    ];
-    sha256 = "1d4q27j1gss0186a5m8bs5dk786w07ccyq0qi6xmd2zr1a8q16wy";
-  };
-in
-
-stdenv.mkDerivation rec {
-  pname = "nss-cacert";
-  version = "3.66";
-
-  src = fetchurl {
-    url = "mirror://mozilla/security/nss/releases/NSS_${lib.replaceStrings ["."] ["_"] version}_RTM/src/nss-${version}.tar.gz";
-    sha256 = "1jfdnh5l4k57r2vb07s06hqi7m2qzk0d9x25lsdsrw3cflx9x9w9";
-  };
-
-  outputs = [ "out" "unbundled" ];
-
-  nativeBuildInputs = [ python3 ];
-
-  configurePhase = ''
-    ln -s nss/lib/ckfw/builtins/certdata.txt
-
-    cat << EOF > blacklist.txt
-    ${lib.concatStringsSep "\n" (map (c: ''"${c}"'') blacklist)}
-    EOF
-
-    # copy from the store, otherwise python will scan it for imports
-    cat "${certdata2pem}" > certdata2pem.py
-  '';
-
-  buildPhase = ''
-    python certdata2pem.py | grep -vE '^(!|UNTRUSTED)'
-
-    for cert in *.crt; do
-      echo $cert | cut -d. -f1 | sed -e 's,_, ,g' >> ca-bundle.crt
-      cat $cert >> ca-bundle.crt
-      echo >> ca-bundle.crt
-    done
-  '';
-
-  installPhase = ''
-    mkdir -pv $out/etc/ssl/certs
-    cp -v ca-bundle.crt $out/etc/ssl/certs
-    # install individual certs in unbundled output
-    mkdir -pv $unbundled/etc/ssl/certs
-    cp -v *.crt $unbundled/etc/ssl/certs
-    rm $unbundled/etc/ssl/certs/ca-bundle.crt  # not wanted in unbundled
-  '';
-
-  setupHook = ./setup-hook.sh;
-
-  passthru = {
-    updateScript = ./update.sh;
-    tests = {
-      # Test that building this derivation with a blacklist works, and that UTF-8 is supported.
-      blacklist-utf8 =
-        let
-          blacklistCAToFingerprint = {
-            # "blacklist" uses the CA name from the NSS bundle, but we check for presence using the SHA256 fingerprint.
-            "CFCA EV ROOT" = "5C:C3:D7:8E:4E:1D:5E:45:54:7A:04:E6:87:3E:64:F9:0C:F9:53:6D:1C:CC:2E:F8:00:F3:55:C4:C5:FD:70:FD";
-            "NetLock Arany (Class Gold) Főtanúsítvány" = "6C:61:DA:C3:A2:DE:F0:31:50:6B:E0:36:D2:A6:FE:40:19:94:FB:D1:3D:F9:C8:D4:66:59:92:74:C4:46:EC:98";
-          };
-          mapBlacklist = f: lib.concatStringsSep "\n" (lib.mapAttrsToList f blacklistCAToFingerprint);
-        in
-        runCommand "verify-the-cacert-filter-output"
-          {
-            cacert = cacert.unbundled;
-            cacertWithExcludes = (cacert.override {
-              blacklist = builtins.attrNames blacklistCAToFingerprint;
-            }).unbundled;
-
-            nativeBuildInputs = [ openssl ];
-          } ''
-          isPresent() {
-            # isPresent <unbundled-dir> <ca name> <ca sha256 fingerprint>
-            for f in $1/etc/ssl/certs/*.crt; do
-              fingerprint="$(openssl x509 -in "$f" -noout -fingerprint -sha256 | cut -f2 -d=)"
-              if [[ "x$fingerprint" == "x$3" ]]; then
-                return 0
-              fi
-            done
-            return 1
-          }
-
-          # Ensure that each certificate is in the main "cacert".
-          ${mapBlacklist (caName: caFingerprint: ''
-            isPresent "$cacert" "${caName}" "${caFingerprint}" || ({
-              echo "CA fingerprint ${caFingerprint} (${caName}) is missing from the CA bundle. Consider picking a different CA for the blacklist test." >&2
-              exit 1
-            })
-          '')}
-
-          # Ensure that each certificate is NOT in the "cacertWithExcludes".
-          ${mapBlacklist (caName: caFingerprint: ''
-            isPresent "$cacertWithExcludes" "${caName}" "${caFingerprint}" && ({
-              echo "CA fingerprint ${caFingerprint} (${caName}) is present in the cacertWithExcludes bundle." >&2
-              exit 1
-            })
-          '')}
-
-          touch $out
-        '';
-    };
-  };
+  blocklist = writeText "cacert-blocklist.txt" (lib.concatStringsSep "\n" blacklist);
+  extraCertificatesBundle = writeText "cacert-extra-certificates-bundle.crt" (lib.concatStringsSep "\n\n" extraCertificateStrings);
 
+  srcVersion = "3.71";
+  version = if nssOverride != null then nssOverride.version else srcVersion;
   meta = with lib; {
     homepage = "https://curl.haxx.se/docs/caextract.html";
     description = "A bundle of X.509 certificates of public Certificate Authorities (CA)";
@@ -128,4 +29,179 @@ stdenv.mkDerivation rec {
     maintainers = with maintainers; [ andir fpletz lukegb ];
     license = licenses.mpl20;
   };
+  certdata = stdenv.mkDerivation {
+    pname = "nss-cacert-certdata";
+    inherit version;
+
+    src = if nssOverride != null then nssOverride.src else fetchurl {
+      url = "mirror://mozilla/security/nss/releases/NSS_${lib.replaceStrings ["."] ["_"] version}_RTM/src/nss-${version}.tar.gz";
+      sha256 = "0ly2l3dv6z5hlxs72h5x6796ni3x1bq60saavaf42ddgv4ax7b4r";
+    };
+
+    dontBuild = true;
+
+    installPhase = ''
+      runHook preInstall
+
+      mkdir $out
+      cp nss/lib/ckfw/builtins/certdata.txt $out
+
+      runHook postInstall
+    '';
+
+    inherit meta;
+  };
+in
+stdenv.mkDerivation rec {
+  pname = "nss-cacert";
+  inherit version;
+
+  src = certdata;
+
+  outputs = [ "out" "unbundled" "p11kit" ];
+
+  nativeBuildInputs = [ buildcatrust ];
+
+  buildPhase = ''
+    mkdir unbundled
+    buildcatrust \
+      --certdata_input certdata.txt \
+      --ca_bundle_input "${extraCertificatesBundle}" ${lib.escapeShellArgs (map (arg: "${arg}") extraCertificateFiles)} \
+      --blocklist "${blocklist}" \
+      --ca_bundle_output ca-bundle.crt \
+      --ca_unpacked_output unbundled \
+      --p11kit_output ca-bundle.trust.p11-kit
+  '';
+
+  installPhase = ''
+    install -D -t "$out/etc/ssl/certs" ca-bundle.crt
+
+    # install p11-kit specific output to p11kit output
+    install -D -t "$p11kit/etc/ssl/trust-source" ca-bundle.trust.p11-kit
+
+    # install individual certs in unbundled output
+    install -D -t "$unbundled/etc/ssl/certs" unbundled/*.crt
+  '';
+
+  setupHook = ./setup-hook.sh;
+
+  passthru = {
+    updateScript = ./update.sh;
+    tests = let
+      isTrusted = ''
+        isTrusted() {
+          # isTrusted <unbundled-dir> <ca name> <ca sha256 fingerprint>
+          for f in $1/etc/ssl/certs/*.crt; do
+            if ! [[ -s "$f" ]]; then continue; fi
+            fingerprint="$(openssl x509 -in "$f" -noout -fingerprint -sha256 | cut -f2 -d=)"
+            if [[ "x$fingerprint" == "x$3" ]]; then
+              # If the certificate is treated as rejected for TLS Web Server, then we consider it untrusted.
+              if openssl x509 -in "$f" -noout -text | grep -q '^Rejected Uses:'; then
+                if openssl x509 -in "$f" -noout -text | grep -A1 '^Rejected Uses:' | grep -q 'TLS Web Server'; then
+                  return 1
+                fi
+              fi
+              return 0
+            fi
+          done
+          return 1
+        }
+      '';
+    in {
+      # Test that building this derivation with a blacklist works, and that UTF-8 is supported.
+      blacklist-utf8 = let
+        blacklistCAToFingerprint = {
+          # "blacklist" uses the CA name from the NSS bundle, but we check for presence using the SHA256 fingerprint.
+          "CFCA EV ROOT" = "5C:C3:D7:8E:4E:1D:5E:45:54:7A:04:E6:87:3E:64:F9:0C:F9:53:6D:1C:CC:2E:F8:00:F3:55:C4:C5:FD:70:FD";
+          "NetLock Arany (Class Gold) Főtanúsítvány" = "6C:61:DA:C3:A2:DE:F0:31:50:6B:E0:36:D2:A6:FE:40:19:94:FB:D1:3D:F9:C8:D4:66:59:92:74:C4:46:EC:98";
+        };
+        mapBlacklist = f: lib.concatStringsSep "\n" (lib.mapAttrsToList f blacklistCAToFingerprint);
+      in runCommand "verify-the-cacert-filter-output" {
+        cacert = cacert.unbundled;
+        cacertWithExcludes = (cacert.override {
+          blacklist = builtins.attrNames blacklistCAToFingerprint;
+        }).unbundled;
+
+        nativeBuildInputs = [ openssl ];
+      } ''
+        ${isTrusted}
+
+        # Ensure that each certificate is in the main "cacert".
+        ${mapBlacklist (caName: caFingerprint: ''
+          isTrusted "$cacert" "${caName}" "${caFingerprint}" || ({
+            echo "CA fingerprint ${caFingerprint} (${caName}) is missing from the CA bundle. Consider picking a different CA for the blacklist test." >&2
+            exit 1
+          })
+        '')}
+
+        # Ensure that each certificate is NOT in the "cacertWithExcludes".
+        ${mapBlacklist (caName: caFingerprint: ''
+          isTrusted "$cacertWithExcludes" "${caName}" "${caFingerprint}" && ({
+            echo "CA fingerprint ${caFingerprint} (${caName}) is present in the cacertWithExcludes bundle." >&2
+            exit 1
+          })
+        '')}
+
+        touch "$out"
+      '';
+
+      # Test that we can add additional certificates to the store, and have them be trusted.
+      extra-certificates = let
+        extraCertificateStr = ''
+          -----BEGIN CERTIFICATE-----
+          MIIB5DCCAWqgAwIBAgIUItvsAYEIdYDkOIo5sdDYMcUaNuIwCgYIKoZIzj0EAwIw
+          KTEnMCUGA1UEAwweTml4T1MgY2FjZXJ0IGV4dHJhIGNlcnRpZmljYXRlMB4XDTIx
+          MDYxMjE5MDQzMFoXDTIyMDYxMjE5MDQzMFowKTEnMCUGA1UEAwweTml4T1MgY2Fj
+          ZXJ0IGV4dHJhIGNlcnRpZmljYXRlMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEuP8y
+          lAm6ZyQt9v/P6gTlV/a9R+D61WjucW04kaegOhg8csiluimYodiSv0Pbgymu+Zxm
+          A3Bz9QGmytaYTiJ16083rJkwwIhqoYl7kWsLzreSTaLz87KH+rdeol59+H0Oo1Mw
+          UTAdBgNVHQ4EFgQUCxuHfvqI4YVU5M+A0+aKvd1LrdswHwYDVR0jBBgwFoAUCxuH
+          fvqI4YVU5M+A0+aKvd1LrdswDwYDVR0TAQH/BAUwAwEB/zAKBggqhkjOPQQDAgNo
+          ADBlAjEArgxgjdNmRlSEuai0dzlktmBEDZKy2Iiul+ttSoce9ohfEVYESwO602HW
+          keVvI56vAjBCro3dc3m2TuktiKO6lQV56PUEyxko4H/sR5pnHlduCGRDlFzQKXf/
+          pMMmtj7cVb8=
+          -----END CERTIFICATE-----
+        '';
+        extraCertificateFile = ./test-cert-file.crt;
+        extraCertificatesToFingerprint = {
+          # String above
+          "NixOS cacert extra certificate string" = "A3:20:D0:84:96:97:25:FF:98:B8:A9:6D:A3:7C:89:95:6E:7A:77:21:92:F3:33:E9:31:AF:5E:03:CE:A9:E5:EE";
+
+          # File
+          "NixOS cacert extra certificate file" = "88:B8:BE:A7:57:AC:F1:FE:D6:98:8B:50:E0:BD:0A:AE:88:C7:DF:70:26:E1:67:5E:F5:F6:91:27:FF:02:D4:A5";
+        };
+        mapExtra = f: lib.concatStringsSep "\n" (lib.mapAttrsToList f extraCertificatesToFingerprint);
+      in runCommand "verify-the-cacert-extra-output" {
+        cacert = cacert.unbundled;
+        cacertWithExtras = (cacert.override {
+          extraCertificateStrings = [ extraCertificateStr ];
+          extraCertificateFiles = [ extraCertificateFile ];
+        }).unbundled;
+
+        nativeBuildInputs = [ openssl ];
+      } ''
+        ${isTrusted}
+
+        # Ensure that the extra certificate is not in the main "cacert".
+        ${mapExtra (extraName: extraFingerprint: ''
+          isTrusted "$cacert" "${extraName}" "${extraFingerprint}" && ({
+            echo "'extra' CA fingerprint ${extraFingerprint} (${extraName}) is present in the main CA bundle." >&2
+            exit 1
+          })
+        '')}
+
+        # Ensure that the extra certificates ARE in the "cacertWithExtras".
+        ${mapExtra (extraName: extraFingerprint: ''
+          isTrusted "$cacertWithExtras" "${extraName}" "${extraFingerprint}" || ({
+            echo "CA fingerprint ${extraFingerprint} (${extraName}) is not present in the cacertWithExtras bundle." >&2
+            exit 1
+          })
+        '')}
+
+        touch "$out"
+      '';
+    };
+  };
+
+  inherit meta;
 }
diff --git a/pkgs/data/misc/cacert/test-cert-file.crt b/pkgs/data/misc/cacert/test-cert-file.crt
new file mode 100644
index 000000000000..095f38817d20
--- /dev/null
+++ b/pkgs/data/misc/cacert/test-cert-file.crt
@@ -0,0 +1,13 @@
+-----BEGIN CERTIFICATE-----
+MIIB7TCCAXSgAwIBAgIUFJB0STXn22fIEDjpncEt++IdFeMwCgYIKoZIzj0EAwIw
+LjEsMCoGA1UEAwwjTml4T1MgY2FjZXJ0IGV4dHJhIGNlcnRpZmljYXRlIGZpbGUw
+HhcNMjEwNjEyMTkxODA4WhcNMjIwNjEyMTkxODA4WjAuMSwwKgYDVQQDDCNOaXhP
+UyBjYWNlcnQgZXh0cmEgY2VydGlmaWNhdGUgZmlsZTB2MBAGByqGSM49AgEGBSuB
+BAAiA2IABMifTLM5K5xd+guGdKE1+NR7wnEJbxw5INzuMrkg/7jgEIQil4+L2YOF
+kU1gxcM80Ot8tQAG5OcSvX1DF6CxunpoCT+hnHqyfqoWFvl89i1BUKjyWCQ5WXEe
+nSkuJUmYC6NTMFEwHQYDVR0OBBYEFBE2kNis1ri4fweyNVRmvje83gFQMB8GA1Ud
+IwQYMBaAFBE2kNis1ri4fweyNVRmvje83gFQMA8GA1UdEwEB/wQFMAMBAf8wCgYI
+KoZIzj0EAwIDZwAwZAIwUZf1qaSb4cezulV+4B4FoJHY2B/nRVIi/rFD8634YEDT
+vcg6dmCi/AqLEzJn7uFMAjBVTu4EVC/mtQCGESFChMeb04fsuhXgttWSwWliVPEG
+jkG7u0UNNGaU8dvrjpqRRmA=
+-----END CERTIFICATE-----
diff --git a/pkgs/data/misc/cacert/update.sh b/pkgs/data/misc/cacert/update.sh
index 1c286dc6206f..72d581b9650f 100755
--- a/pkgs/data/misc/cacert/update.sh
+++ b/pkgs/data/misc/cacert/update.sh
@@ -28,7 +28,7 @@ BASEDIR="$(dirname "$0")/../../../.."
 
 
 CURRENT_PATH=$(nix-build --no-out-link -A cacert.out)
-PATCHED_PATH=$(nix-build --no-out-link -E "with import $BASEDIR {}; let nss_pkg = pkgs.nss_latest or pkgs.nss; in (cacert.overrideAttrs (_: { inherit (nss_pkg) src version; })).out")
+PATCHED_PATH=$(nix-build --no-out-link -E "with import $BASEDIR {}; let nss_pkg = pkgs.nss_latest or pkgs.nss; in (cacert.override { nssOverride = nss_pkg; }).out")
 
 # Check the hash of the etc subfolder
 # We can't check the entire output as that contains the nix-support folder
@@ -38,5 +38,5 @@ PATCHED_HASH=$(nix-hash "$PATCHED_PATH/etc")
 
 if [[ "$CURRENT_HASH" !=  "$PATCHED_HASH" ]]; then
     NSS_VERSION=$(nix-instantiate --json --eval -E "with import $BASEDIR {}; nss.version" | jq -r .)
-    update-source-version cacert "$NSS_VERSION"
+    update-source-version --version-key=srcVersion cacert.src "$NSS_VERSION"
 fi
diff --git a/pkgs/data/misc/tzdata/default.nix b/pkgs/data/misc/tzdata/default.nix
index aa3d9e787b68..fddd1aec61ac 100644
--- a/pkgs/data/misc/tzdata/default.nix
+++ b/pkgs/data/misc/tzdata/default.nix
@@ -2,16 +2,16 @@
 
 stdenv.mkDerivation rec {
   pname = "tzdata";
-  version = "2021a";
+  version = "2021c";
 
   srcs =
     [ (fetchurl {
         url = "https://data.iana.org/time-zones/releases/tzdata${version}.tar.gz";
-        sha256 = "022fn6gkmp7pamlgab04x0dm5hnyn2m2fcnyr3pvm36612xd5rrr";
+        sha256 = "0himprzx3ahxkmg4rvp8n5lqry76qzc65j6sfq151hqirg4d3wdl";
       })
       (fetchurl {
         url = "https://data.iana.org/time-zones/releases/tzcode${version}.tar.gz";
-        sha256 = "1l02b0jiwp3fl0xd6227i69d26rmx3yrnq0ssq9vvdmm4jhvyipb";
+        sha256 = "01fsa661vzdij46z286pa8q07cppqz29sr2pf0qqldqpldbb6km3";
       })
     ];
 
@@ -73,6 +73,6 @@ stdenv.mkDerivation rec {
       publicDomain # tzdata
     ];
     platforms = platforms.all;
-    maintainers = with maintainers; [ fpletz ];
+    maintainers = with maintainers; [ ajs124 fpletz ];
   };
 }
diff --git a/pkgs/development/compilers/llvm/10/llvm/default.nix b/pkgs/development/compilers/llvm/10/llvm/default.nix
index 93cdc7307daa..4e590dba4337 100644
--- a/pkgs/development/compilers/llvm/10/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/10/llvm/default.nix
@@ -65,6 +65,14 @@ in stdenv.mkDerivation (rec {
       sha256 = "sha256:12s8vr6ibri8b48h2z38f3afhwam10arfiqfy4yg37bmc054p5hi";
       stripLen = 1;
     })
+
+    # Fix missing includes for GCC 11
+    (fetchpatch {
+      name = "headers-gcc-11.patch";
+      url = "https://github.com/llvm/llvm-project/commit/b498303066a63a203d24f739b2d2e0e56dca70d1.patch";
+      sha256 = "0nh123kld0dgz2h941lng331dkj3wbm5lfxm375k1f569gv83hlk";
+      stripLen = 1;
+    })
   ] ++ lib.optional enablePolly ./gnu-install-dirs-polly.patch;
 
   postPatch = optionalString stdenv.isDarwin ''
diff --git a/pkgs/development/compilers/llvm/8/llvm/default.nix b/pkgs/development/compilers/llvm/8/llvm/default.nix
index 6f14b375c62c..83b779b56d82 100644
--- a/pkgs/development/compilers/llvm/8/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/8/llvm/default.nix
@@ -63,6 +63,14 @@ in stdenv.mkDerivation ({
       sha256 = "0rwx6jpqq4xnf4mvfm8v2d4r34y1yi05am0mx5k2d5bha9j64lqg";
     })
     ./gnu-install-dirs.patch
+
+    # Fix missing includes for GCC 11
+    (fetchpatch {
+      name = "headers-gcc-11.patch";
+      url = "https://github.com/llvm/llvm-project/commit/b498303066a63a203d24f739b2d2e0e56dca70d1.patch";
+      sha256 = "0nh123kld0dgz2h941lng331dkj3wbm5lfxm375k1f569gv83hlk";
+      stripLen = 1;
+    })
   ] ++ lib.optional enablePolly ./gnu-install-dirs-polly.patch;
 
   postPatch = optionalString stdenv.isDarwin ''
diff --git a/pkgs/development/compilers/llvm/9/llvm/default.nix b/pkgs/development/compilers/llvm/9/llvm/default.nix
index e763d3e1e7d0..570795824ee5 100644
--- a/pkgs/development/compilers/llvm/9/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/9/llvm/default.nix
@@ -1,6 +1,7 @@
 { lib, stdenv, llvm_meta
 , pkgsBuildBuild
 , fetch
+, fetchpatch
 , cmake
 , python3
 , libffi
@@ -60,6 +61,14 @@ in stdenv.mkDerivation (rec {
     # Force a test to evaluate the saved benchmark for a CPU for which LLVM has
     # an execution model. See NixOS/nixpkgs#119673.
     ../../exegesis-force-bdver2.patch
+
+    # Fix missing includes for GCC 11
+    (fetchpatch {
+      name = "headers-gcc-11.patch";
+      url = "https://github.com/llvm/llvm-project/commit/b498303066a63a203d24f739b2d2e0e56dca70d1.patch";
+      sha256 = "0nh123kld0dgz2h941lng331dkj3wbm5lfxm375k1f569gv83hlk";
+      stripLen = 1;
+    })
   ] ++ lib.optional enablePolly ./gnu-install-dirs-polly.patch;
 
   postPatch = optionalString stdenv.isDarwin ''
diff --git a/pkgs/development/interpreters/guile/1.8.nix b/pkgs/development/interpreters/guile/1.8.nix
index 6277312acc85..c8e15be2c014 100644
--- a/pkgs/development/interpreters/guile/1.8.nix
+++ b/pkgs/development/interpreters/guile/1.8.nix
@@ -1,13 +1,22 @@
-{ lib, stdenv, pkgsBuildBuild, buildPackages
-, fetchurl, makeWrapper, gawk, pkg-config
-, libtool, readline, gmp
+{ lib
+, stdenv
+, fetchurl
+, buildPackages
+, gawk
+, gmp
+, libtool
+, makeWrapper
+, pkg-config
+, pkgsBuildBuild
+, readline
 }:
 
 stdenv.mkDerivation rec {
-  name = "guile-1.8.8";
+  pname = "guile";
+  version = "1.8.8";
 
   src = fetchurl {
-    url = "mirror://gnu/guile/${name}.tar.gz";
+    url = "mirror://gnu/${pname}/${pname}-${version}.tar.gz";
     sha256 = "0l200a0v7h8bh0cwz6v7hc13ds39cgqsmfrks55b1rbj5vniyiy3";
   };
 
@@ -15,18 +24,28 @@ stdenv.mkDerivation rec {
   setOutputFlags = false; # $dev gets into the library otherwise
 
   # GCC 4.6 raises a number of set-but-unused warnings.
-  configureFlags = [ "--disable-error-on-warning" ]
-    # Guile needs patching to preset results for the configure tests about
-    # pthreads, which work only in native builds.
-    ++ lib.optional (stdenv.hostPlatform != stdenv.buildPlatform)
-                          "--with-threads=no";
-
-  depsBuildBuild = [ buildPackages.stdenv.cc ]
-    ++ lib.optional (stdenv.hostPlatform != stdenv.buildPlatform)
-                           pkgsBuildBuild.guile_1_8;
-  nativeBuildInputs = [ makeWrapper gawk pkg-config ];
-  buildInputs = [ readline libtool ];
+  configureFlags = [
+    "--disable-error-on-warning"
+  ]
+  # Guile needs patching to preset results for the configure tests about
+  # pthreads, which work only in native builds.
+  ++ lib.optional (stdenv.hostPlatform != stdenv.buildPlatform)
+    "--with-threads=no";
 
+  depsBuildBuild = [
+    buildPackages.stdenv.cc
+  ]
+  ++ lib.optional (stdenv.hostPlatform != stdenv.buildPlatform)
+    pkgsBuildBuild.guile_1_8;
+  nativeBuildInputs = [
+    gawk
+    makeWrapper
+    pkg-config
+  ];
+  buildInputs = [
+    libtool
+    readline
+  ];
   propagatedBuildInputs = [
     gmp
 
@@ -38,7 +57,9 @@ stdenv.mkDerivation rec {
   ];
 
   patches = [
+    # Fix doc snarfing with GCC 4.5.
     ./cpp-4.5.patch
+    # Self explanatory
     ./CVE-2016-8605.patch
   ];
 
@@ -46,13 +67,12 @@ stdenv.mkDerivation rec {
     sed -e '/lt_dlinit/a  lt_dladdsearchdir("'$out/lib'");' -i libguile/dynl.c
   '';
 
-
   postInstall = ''
     wrapProgram $out/bin/guile-snarf --prefix PATH : "${gawk}/bin"
   ''
-    # XXX: See http://thread.gmane.org/gmane.comp.lib.gnulib.bugs/18903 for
-    # why `--with-libunistring-prefix' and similar options coming from
-    # `AC_LIB_LINKFLAGS_BODY' don't work on NixOS/x86_64.
+  # XXX: See http://thread.gmane.org/gmane.comp.lib.gnulib.bugs/18903 for
+  # why `--with-libunistring-prefix' and similar options coming from
+  # `AC_LIB_LINKFLAGS_BODY' don't work on NixOS/x86_64.
   + ''
     sed -i "$out/lib/pkgconfig/guile"-*.pc    \
         -e "s|-lltdl|-L${libtool.lib}/lib -lltdl|g"
@@ -65,19 +85,21 @@ stdenv.mkDerivation rec {
   doCheck = false;
   doInstallCheck = doCheck;
 
-  setupHook = ./setup-hook.sh;
+  setupHook = ./setup-hook-1.8.sh;
 
-  meta = {
+  meta = with lib; {
+    homepage = "https://www.gnu.org/software/guile/";
     description = "Embeddable Scheme implementation";
-    homepage    = "https://www.gnu.org/software/guile/";
-    license     = lib.licenses.lgpl2Plus;
-    maintainers = [ lib.maintainers.ludo ];
-    platforms   = lib.platforms.unix;
-
     longDescription = ''
-      GNU Guile is an interpreter for the Scheme programming language,
-      packaged as a library that can be embedded into programs to make
-      them extensible.  It supports many SRFIs.
+      GNU Guile is an implementation of the Scheme programming language, with
+      support for many SRFIs, packaged for use in a wide variety of
+      environments.  In addition to implementing the R5RS Scheme standard and a
+      large subset of R6RS, Guile includes a module system, full access to POSIX
+      system calls, networking support, multiple threads, dynamic linking, a
+      foreign function call interface, and powerful string processing.
     '';
+    license = licenses.lgpl3Plus;
+    maintainers = with maintainers; [ ludo ];
+    platforms = platforms.all;
   };
 }
diff --git a/pkgs/development/interpreters/guile/2.0.nix b/pkgs/development/interpreters/guile/2.0.nix
index b93ec556cd43..8214ca2adcda 100644
--- a/pkgs/development/interpreters/guile/2.0.nix
+++ b/pkgs/development/interpreters/guile/2.0.nix
@@ -1,88 +1,123 @@
-{ lib, stdenv, pkgsBuildBuild, buildPackages
-, fetchpatch, fetchurl, makeWrapper, gawk, pkg-config
-, libffi, libtool, readline, gmp, boehmgc, libunistring
+{ lib
+, stdenv
+, fetchurl
+, fetchpatch
+, boehmgc
+, buildPackages
 , coverageAnalysis ? null
+, gawk
+, gmp
+, libffi
+, libtool
+, libunistring
+, makeWrapper
+, pkg-config
+, pkgsBuildBuild
+, readline
 }:
 
-# Do either a coverage analysis build or a standard build.
-(if coverageAnalysis != null
- then coverageAnalysis
- else stdenv.mkDerivation)
-
-(rec {
-  name = "guile-2.0.13";
+let
+  # Do either a coverage analysis build or a standard build.
+  builder = if coverageAnalysis != null
+            then coverageAnalysis
+            else stdenv.mkDerivation;
+in
+builder rec {
+  pname = "guile";
+  version = "2.0.13";
 
   src = fetchurl {
-    url = "mirror://gnu/guile/${name}.tar.xz";
+    url = "mirror://gnu/${pname}/${pname}-${version}.tar.xz";
     sha256 = "12yqkr974y91ylgw6jnmci2v90i90s7h9vxa4zk0sai8vjnz4i1p";
   };
 
   outputs = [ "out" "dev" "info" ];
   setOutputFlags = false; # $dev gets into the library otherwise
 
-  depsBuildBuild = [ buildPackages.stdenv.cc ]
-    ++ lib.optional (stdenv.hostPlatform != stdenv.buildPlatform)
-                           pkgsBuildBuild.guile_2_0;
-  nativeBuildInputs = [ makeWrapper gawk pkg-config ];
-  buildInputs = [ readline libtool libunistring libffi ];
+  depsBuildBuild = [
+    buildPackages.stdenv.cc
+  ]
+  ++ lib.optional (stdenv.hostPlatform != stdenv.buildPlatform)
+    pkgsBuildBuild.guile_2_0;
 
+  nativeBuildInputs = [
+    makeWrapper
+    gawk
+    pkg-config
+  ];
+  buildInputs = [
+    readline
+    libtool
+    libunistring
+    libffi
+  ];
   propagatedBuildInputs = [
-    gmp boehmgc
+    boehmgc
+    gmp
 
-    # XXX: These ones aren't normally needed here, but `libguile*.la' has '-l'
-    # flags for them without corresponding '-L' flags. Adding them here will add
-    # the needed `-L' flags.  As for why the `.la' file lacks the `-L' flags,
-    # see below.
-    libtool libunistring
+    # These ones aren't normally needed here, but `libguile*.la' has '-l'
+    # flags for them without corresponding '-L' flags. Adding them here will
+    # add the needed `-L' flags.  As for why the `.la' file lacks the `-L'
+    # flags, see below.
+    libtool
+    libunistring
   ];
 
   enableParallelBuilding = true;
 
-  patches = [ ./disable-gc-sensitive-tests.patch ./eai_system.patch ./clang.patch
+  patches = [
+    # Small fixes to Clang compiler
+    ./clang.patch
+    # Self-explanatory
+    ./disable-gc-sensitive-tests.patch
+    # Read the header of the patch to more info
+    ./eai_system.patch
+    # RISC-V endianness
+    ./riscv.patch
+    # Fixes stability issues with 00-repl-server.test
     (fetchpatch {
-      # Fixes stability issues with 00-repl-server.test
       url = "https://git.savannah.gnu.org/cgit/guile.git/patch/?id=2fbde7f02adb8c6585e9baf6e293ee49cd23d4c4";
       sha256 = "0p6c1lmw1iniq03z7x5m65kg3lq543kgvdb4nrxsaxjqf3zhl77v";
+    })] ++
+  (lib.optional (coverageAnalysis != null) ./gcov-file-name.patch)
+  ++ lib.optionals stdenv.isDarwin [
+    ./filter-mkostemp-darwin.patch
+    (fetchpatch {
+      url = "https://gitlab.gnome.org/GNOME/gtk-osx/raw/52898977f165777ad9ef169f7d4818f2d4c9b731/patches/guile-clocktime.patch";
+      sha256 = "12wvwdna9j8795x59ldryv9d84c1j3qdk2iskw09306idfsis207";
     })
-    ./riscv.patch
-  ] ++
-    (lib.optional (coverageAnalysis != null) ./gcov-file-name.patch)
-    ++ lib.optionals stdenv.isDarwin [
-      (fetchpatch {
-        url = "https://gitlab.gnome.org/GNOME/gtk-osx/raw/52898977f165777ad9ef169f7d4818f2d4c9b731/patches/guile-clocktime.patch";
-        sha256 = "12wvwdna9j8795x59ldryv9d84c1j3qdk2iskw09306idfsis207";
-      })
-      ./filter-mkostemp-darwin.patch
-    ];
+  ];
 
   # Explicitly link against libgcc_s, to work around the infamous
   # "libgcc_s.so.1 must be installed for pthread_cancel to work".
 
   # don't have "libgcc_s.so.1" on darwin
-  LDFLAGS = lib.optionalString (!stdenv.isDarwin && !stdenv.hostPlatform.isMusl) "-lgcc_s";
+  LDFLAGS = lib.optionalString
+    (!stdenv.isDarwin && !stdenv.hostPlatform.isMusl) "-lgcc_s";
 
-  configureFlags = [ "--with-libreadline-prefix" ]
-    ++ lib.optionals stdenv.isSunOS [
-      # Make sure the right <gmp.h> is found, and not the incompatible
-      # /usr/include/mp.h from OpenSolaris.  See
-      # <https://lists.gnu.org/archive/html/hydra-users/2012-08/msg00000.html>
-      # for details.
-      "--with-libgmp-prefix=${gmp.dev}"
+  configureFlags = [
+    "--with-libreadline-prefix"
+  ] ++ lib.optionals stdenv.isSunOS [
+    # Make sure the right <gmp.h> is found, and not the incompatible
+    # /usr/include/mp.h from OpenSolaris. See
+    # <https://lists.gnu.org/archive/html/hydra-users/2012-08/msg00000.html>
+    # for details.
+    "--with-libgmp-prefix=${lib.getDev gmp}"
 
-      # Same for these (?).
-      "--with-libreadline-prefix=${readline.dev}"
-      "--with-libunistring-prefix=${libunistring}"
+    # Same for these (?).
+    "--with-libreadline-prefix=${lib.getDev readline}"
+    "--with-libunistring-prefix=${libunistring}"
 
-      # See below.
-      "--without-threads"
-    ];
+    # See below.
+    "--without-threads"
+  ];
 
   postInstall = ''
     wrapProgram $out/bin/guile-snarf --prefix PATH : "${gawk}/bin"
   ''
-    # XXX: See http://thread.gmane.org/gmane.comp.lib.gnulib.bugs/18903 for
-    # why `--with-libunistring-prefix' and similar options coming from
-    # `AC_LIB_LINKFLAGS_BODY' don't work on NixOS/x86_64.
+  # XXX: See http://thread.gmane.org/gmane.comp.lib.gnulib.bugs/18903 for
+  # why `--with-libunistring-prefix' and similar options coming from
+  # `AC_LIB_LINKFLAGS_BODY' don't work on NixOS/x86_64.
   + ''
     sed -i "$out/lib/pkgconfig/guile"-*.pc    \
         -e "s|-lunistring|-L${libunistring}/lib -lunistring|g ;
@@ -90,7 +125,7 @@
             s|-lltdl|-L${libtool.lib}/lib -lltdl|g ;
             s|includedir=$out|includedir=$dev|g
             "
-  '';
+    '';
 
   # make check doesn't work on darwin
   # On Linuxes+Hydra the tests are flaky; feel free to investigate deeper.
@@ -99,24 +134,23 @@
 
   setupHook = ./setup-hook-2.0.sh;
 
-  meta = {
+  meta = with lib; {
+    homepage = "https://www.gnu.org/software/guile/";
     description = "Embeddable Scheme implementation";
-    homepage    = "https://www.gnu.org/software/guile/";
-    license     = lib.licenses.lgpl3Plus;
-    maintainers = with lib.maintainers; [ ludo lovek323 ];
-    platforms   = lib.platforms.all;
-
     longDescription = ''
-      GNU Guile is an implementation of the Scheme programming language, with
-      support for many SRFIs, packaged for use in a wide variety of
-      environments.  In addition to implementing the R5RS Scheme standard
-      and a large subset of R6RS, Guile includes a module system, full access
-      to POSIX system calls, networking support, multiple threads, dynamic
-      linking, a foreign function call interface, and powerful string
-      processing.
-    '';
+        GNU Guile is an implementation of the Scheme programming language, with
+        support for many SRFIs, packaged for use in a wide variety of
+        environments.  In addition to implementing the R5RS Scheme standard and
+        a large subset of R6RS, Guile includes a module system, full access to
+        POSIX system calls, networking support, multiple threads, dynamic
+        linking, a foreign function call interface, and powerful string
+        processing.
+      '';
+    license = licenses.lgpl3Plus;
+    maintainers = with maintainers; [ ludo lovek323 vrthra ];
+    platforms = platforms.all;
   };
-})
+}
 
 //
 
diff --git a/pkgs/development/interpreters/guile/default.nix b/pkgs/development/interpreters/guile/2.2.nix
similarity index 54%
rename from pkgs/development/interpreters/guile/default.nix
rename to pkgs/development/interpreters/guile/2.2.nix
index ed685682db66..19ef0e608485 100644
--- a/pkgs/development/interpreters/guile/default.nix
+++ b/pkgs/development/interpreters/guile/2.2.nix
@@ -1,41 +1,65 @@
-{ lib, stdenv, pkgsBuildBuild, buildPackages
-, fetchurl, makeWrapper, gawk, pkg-config
-, libffi, libtool, readline, gmp, boehmgc, libunistring
-, coverageAnalysis ? null
+{ lib
+, stdenv
+, fetchurl
 , fetchpatch
+, boehmgc
+, buildPackages
+, coverageAnalysis ? null
+, gawk
+, gmp
+, libffi
+, libtool
+, libunistring
+, makeWrapper
+, pkg-config
+, pkgsBuildBuild
+, readline
 }:
 
-# Do either a coverage analysis build or a standard build.
-(if coverageAnalysis != null
- then coverageAnalysis
- else stdenv.mkDerivation)
-
-(rec {
-  name = "guile-${version}";
+let
+  # Do either a coverage analysis build or a standard build.
+  builder = if coverageAnalysis != null
+            then coverageAnalysis
+            else stdenv.mkDerivation;
+in
+builder rec {
+  pname = "guile";
   version = "2.2.7";
 
   src = fetchurl {
-    url = "mirror://gnu/guile/${name}.tar.xz";
+    url = "mirror://gnu/${pname}/${pname}-${version}.tar.xz";
     sha256 = "013mydzhfswqci6xmyc1ajzd59pfbdak15i0b090nhr9bzm7dxyd";
   };
 
   outputs = [ "out" "dev" "info" ];
   setOutputFlags = false; # $dev gets into the library otherwise
 
-  depsBuildBuild = [ buildPackages.stdenv.cc ]
-    ++ lib.optional (stdenv.hostPlatform != stdenv.buildPlatform)
-                           pkgsBuildBuild.guile;
-  nativeBuildInputs = [ makeWrapper gawk pkg-config ];
-  buildInputs = [ readline libtool libunistring libffi ];
-
+  depsBuildBuild = [
+    buildPackages.stdenv.cc
+  ]
+  ++ lib.optional (stdenv.hostPlatform != stdenv.buildPlatform)
+    pkgsBuildBuild.guile;
+  nativeBuildInputs = [
+    gawk
+    makeWrapper
+    pkg-config
+  ];
+  buildInputs = [
+    libffi
+    libtool
+    libunistring
+    readline
+  ];
   propagatedBuildInputs = [
-    gmp boehmgc
+    boehmgc
+    gmp
 
     # XXX: These ones aren't normally needed here, but `libguile*.la' has '-l'
     # flags for them without corresponding '-L' flags. Adding them here will add
     # the needed `-L' flags.  As for why the `.la' file lacks the `-L' flags,
     # see below.
-    libtool libunistring
+    libtool
+    libunistring
   ];
 
   # According to Bernhard M. Wiedemann <bwiedemann suse de> on
@@ -47,9 +71,11 @@
   enableParallelBuilding = false;
 
   patches = [
+    # Read the header of the patch to more info
     ./eai_system.patch
   ] ++ lib.optional (coverageAnalysis != null) ./gcov-file-name.patch
-    ++ lib.optional stdenv.isDarwin (fetchpatch {
+  ++ lib.optional stdenv.isDarwin
+    (fetchpatch {
       url = "https://gitlab.gnome.org/GNOME/gtk-osx/raw/52898977f165777ad9ef169f7d4818f2d4c9b731/patches/guile-clocktime.patch";
       sha256 = "12wvwdna9j8795x59ldryv9d84c1j3qdk2iskw09306idfsis207";
     });
@@ -61,27 +87,28 @@
   LDFLAGS = lib.optionalString
     (!stdenv.isDarwin && !stdenv.hostPlatform.isStatic) "-lgcc_s";
 
-  configureFlags = [ "--with-libreadline-prefix=${readline.dev}" ]
-    ++ lib.optionals stdenv.isSunOS [
-      # Make sure the right <gmp.h> is found, and not the incompatible
-      # /usr/include/mp.h from OpenSolaris.  See
-      # <https://lists.gnu.org/archive/html/hydra-users/2012-08/msg00000.html>
-      # for details.
-      "--with-libgmp-prefix=${gmp.dev}"
+  configureFlags = [
+    "--with-libreadline-prefix=${lib.getDev readline}"
+  ] ++ lib.optionals stdenv.isSunOS [
+    # Make sure the right <gmp.h> is found, and not the incompatible
+    # /usr/include/mp.h from OpenSolaris.  See
+    # <https://lists.gnu.org/archive/html/hydra-users/2012-08/msg00000.html>
+    # for details.
+    "--with-libgmp-prefix=${lib.getDev gmp}"
 
-      # Same for these (?).
-      "--with-libunistring-prefix=${libunistring}"
+    # Same for these (?).
+    "--with-libunistring-prefix=${libunistring}"
 
-      # See below.
-      "--without-threads"
-    ];
+    # See below.
+    "--without-threads"
+  ];
 
   postInstall = ''
     wrapProgram $out/bin/guile-snarf --prefix PATH : "${gawk}/bin"
   ''
-    # XXX: See http://thread.gmane.org/gmane.comp.lib.gnulib.bugs/18903 for
-    # why `--with-libunistring-prefix' and similar options coming from
-    # `AC_LIB_LINKFLAGS_BODY' don't work on NixOS/x86_64.
+  # XXX: See http://thread.gmane.org/gmane.comp.lib.gnulib.bugs/18903 for
+  # why `--with-libunistring-prefix' and similar options coming from
+  # `AC_LIB_LINKFLAGS_BODY' don't work on NixOS/x86_64.
   + ''
     sed -i "$out/lib/pkgconfig/guile"-*.pc    \
         -e "s|-lunistring|-L${libunistring}/lib -lunistring|g ;
@@ -89,7 +116,7 @@
             s|-lltdl|-L${libtool.lib}/lib -lltdl|g ;
             s|includedir=$out|includedir=$dev|g
             "
-  '';
+    '';
 
   # make check doesn't work on darwin
   # On Linuxes+Hydra the tests are flaky; feel free to investigate deeper.
@@ -98,21 +125,19 @@
 
   setupHook = ./setup-hook-2.2.sh;
 
-  meta = {
+  meta = with lib; {
+    homepage = "https://www.gnu.org/software/guile/";
     description = "Embeddable Scheme implementation";
-    homepage    = "https://www.gnu.org/software/guile/";
-    license     = lib.licenses.lgpl3Plus;
-    maintainers = with lib.maintainers; [ ludo lovek323 vrthra ];
-    platforms   = lib.platforms.all;
-
     longDescription = ''
       GNU Guile is an implementation of the Scheme programming language, with
       support for many SRFIs, packaged for use in a wide variety of
-      environments.  In addition to implementing the R5RS Scheme standard
-      and a large subset of R6RS, Guile includes a module system, full access
-      to POSIX system calls, networking support, multiple threads, dynamic
-      linking, a foreign function call interface, and powerful string
-      processing.
+      environments.  In addition to implementing the R5RS Scheme standard and a
+      large subset of R6RS, Guile includes a module system, full access to POSIX
+      system calls, networking support, multiple threads, dynamic linking, a
+      foreign function call interface, and powerful string processing.
     '';
+    license = licenses.lgpl3Plus;
+    maintainers = with maintainers; [ ludo lovek323 vrthra ];
+    platforms = platforms.all;
   };
-})
+}
diff --git a/pkgs/development/interpreters/guile/3.0.nix b/pkgs/development/interpreters/guile/3.0.nix
new file mode 100644
index 000000000000..5241c03a954e
--- /dev/null
+++ b/pkgs/development/interpreters/guile/3.0.nix
@@ -0,0 +1,141 @@
+{ lib
+, stdenv
+, fetchurl
+, fetchpatch
+, boehmgc
+, buildPackages
+, coverageAnalysis ? null
+, gawk
+, gmp
+, libffi
+, libtool
+, libunistring
+, makeWrapper
+, pkg-config
+, pkgsBuildBuild
+, readline
+}:
+
+let
+  # Do either a coverage analysis build or a standard build.
+  builder = if coverageAnalysis != null
+            then coverageAnalysis
+            else stdenv.mkDerivation;
+in
+builder rec {
+  pname = "guile";
+  version = "3.0.7";
+
+  src = fetchurl {
+    url = "mirror://gnu/${pname}/${pname}-${version}.tar.xz";
+    sha256 = "sha256-9X2GxwYgJxv863qb4MgXRKAz8IrcfOuoMsmRerPmkbc=";
+  };
+
+  outputs = [ "out" "dev" "info" ];
+  setOutputFlags = false; # $dev gets into the library otherwise
+
+  depsBuildBuild = [
+    buildPackages.stdenv.cc
+  ] ++ lib.optional (stdenv.hostPlatform != stdenv.buildPlatform)
+    pkgsBuildBuild.guile;
+  nativeBuildInputs = [
+    gawk
+    makeWrapper
+    pkg-config
+  ];
+  buildInputs = [
+    libffi
+    libtool
+    libunistring
+    readline
+  ];
+  propagatedBuildInputs = [
+    boehmgc
+    gmp
+
+    # These ones aren't normally needed here, but `libguile*.la' has '-l'
+    # flags for them without corresponding '-L' flags. Adding them here will
+    # add the needed `-L' flags.  As for why the `.la' file lacks the `-L'
+    # flags, see below.
+    libtool
+    libunistring
+  ];
+
+  # According to Bernhard M. Wiedemann <bwiedemann suse de> on
+  # #reproducible-builds on irc.oftc.net, (2020-01-29): they had to build
+  # Guile without parallel builds to make it reproducible.
+  #
+  # re: https://issues.guix.gnu.org/issue/20272
+  # re: https://build.opensuse.org/request/show/732638
+  enableParallelBuilding = false;
+
+  patches = [
+    ./eai_system.patch
+  ] ++ lib.optional (coverageAnalysis != null) ./gcov-file-name.patch
+  ++ lib.optional stdenv.isDarwin
+    (fetchpatch {
+      url = "https://gitlab.gnome.org/GNOME/gtk-osx/raw/52898977f165777ad9ef169f7d4818f2d4c9b731/patches/guile-clocktime.patch";
+      sha256 = "12wvwdna9j8795x59ldryv9d84c1j3qdk2iskw09306idfsis207";
+    });
+
+  # Explicitly link against libgcc_s, to work around the infamous
+  # "libgcc_s.so.1 must be installed for pthread_cancel to work".
+
+  # don't have "libgcc_s.so.1" on darwin
+  LDFLAGS = lib.optionalString
+    (!stdenv.isDarwin && !stdenv.hostPlatform.isStatic) "-lgcc_s";
+
+  configureFlags = [
+    "--with-libreadline-prefix=${lib.getDev readline}"
+  ] ++ lib.optionals stdenv.isSunOS [
+    # Make sure the right <gmp.h> is found, and not the incompatible
+    # /usr/include/mp.h from OpenSolaris.  See
+    # <https://lists.gnu.org/archive/html/hydra-users/2012-08/msg00000.html>
+    # for details.
+    "--with-libgmp-prefix=${lib.getDev gmp}"
+
+    # Same for these (?).
+    "--with-libunistring-prefix=${libunistring}"
+
+    # See below.
+    "--without-threads"
+  ];
+
+  postInstall = ''
+    wrapProgram $out/bin/guile-snarf --prefix PATH : "${gawk}/bin"
+  ''
+  # XXX: See http://thread.gmane.org/gmane.comp.lib.gnulib.bugs/18903 for
+  # why `--with-libunistring-prefix' and similar options coming from
+  # `AC_LIB_LINKFLAGS_BODY' don't work on NixOS/x86_64.
+  + ''
+    sed -i "$out/lib/pkgconfig/guile"-*.pc    \
+        -e "s|-lunistring|-L${libunistring}/lib -lunistring|g ;
+            s|^Cflags:\(.*\)$|Cflags: -I${libunistring}/include \1|g ;
+            s|-lltdl|-L${libtool.lib}/lib -lltdl|g ;
+            s|includedir=$out|includedir=$dev|g
+            "
+    '';
+
+  # make check doesn't work on darwin
+  # On Linuxes+Hydra the tests are flaky; feel free to investigate deeper.
+  doCheck = false;
+  doInstallCheck = doCheck;
+
+  setupHook = ./setup-hook-3.0.sh;
+
+  meta = with lib; {
+    homepage = "https://www.gnu.org/software/guile/";
+    description = "Embeddable Scheme implementation";
+    longDescription = ''
+      GNU Guile is an implementation of the Scheme programming language, with
+      support for many SRFIs, packaged for use in a wide variety of
+      environments.  In addition to implementing the R5RS Scheme standard and a
+      large subset of R6RS, Guile includes a module system, full access to POSIX
+      system calls, networking support, multiple threads, dynamic linking, a
+      foreign function call interface, and powerful string processing.
+    '';
+    license = licenses.lgpl3Plus;
+    maintainers = with maintainers; [ ludo lovek323 vrthra ];
+    platforms = platforms.all;
+  };
+}
diff --git a/pkgs/development/interpreters/guile/setup-hook.sh b/pkgs/development/interpreters/guile/setup-hook-1.8.sh
similarity index 78%
rename from pkgs/development/interpreters/guile/setup-hook.sh
rename to pkgs/development/interpreters/guile/setup-hook-1.8.sh
index d006b50ce8ef..946e595ac0bf 100644
--- a/pkgs/development/interpreters/guile/setup-hook.sh
+++ b/pkgs/development/interpreters/guile/setup-hook-1.8.sh
@@ -1,6 +1,5 @@
 addGuileLibPath () {
-    if test -d "$1/share/guile/site"
-    then
+    if test -d "$1/share/guile/site"; then
         export GUILE_LOAD_PATH="${GUILE_LOAD_PATH-}${GUILE_LOAD_PATH:+:}$1/share/guile/site"
     fi
 }
diff --git a/pkgs/development/interpreters/guile/setup-hook-2.0.sh b/pkgs/development/interpreters/guile/setup-hook-2.0.sh
index 288f7e242f98..d83f9c647057 100644
--- a/pkgs/development/interpreters/guile/setup-hook-2.0.sh
+++ b/pkgs/development/interpreters/guile/setup-hook-2.0.sh
@@ -1,21 +1,17 @@
 addGuileLibPath () {
-    if test -d "$1/share/guile/site/2.0"
-    then
+    if test -d "$1/share/guile/site/2.0"; then
         export GUILE_LOAD_PATH="${GUILE_LOAD_PATH-}${GUILE_LOAD_PATH:+:}$1/share/guile/site/2.0"
         export GUILE_LOAD_COMPILED_PATH="${GUILE_LOAD_COMPILED_PATH-}${GUILE_LOAD_COMPILED_PATH:+:}$1/share/guile/site/2.0"
-    elif test -d "$1/share/guile/site"
-    then
+    elif test -d "$1/share/guile/site"; then
         export GUILE_LOAD_PATH="${GUILE_LOAD_PATH-}${GUILE_LOAD_PATH:+:}$1/share/guile/site"
         export GUILE_LOAD_COMPILED_PATH="${GUILE_LOAD_COMPILED_PATH-}${GUILE_LOAD_COMPILED_PATH:+:}$1/share/guile/site"
     fi
 
-    if test -d "$1/lib/guile/2.0/ccache"
-    then
+    if test -d "$1/lib/guile/2.0/ccache"; then
         export GUILE_LOAD_COMPILED_PATH="${GUILE_LOAD_COMPILED_PATH-}${GUILE_LOAD_COMPILED_PATH:+:}$1/lib/guile/2.0/ccache"
     fi
 
-    if test -d "$1/lib/guile/2.0/site-ccache"
-    then
+    if test -d "$1/lib/guile/2.0/site-ccache"; then
         export GUILE_LOAD_COMPILED_PATH="${GUILE_LOAD_COMPILED_PATH-}${GUILE_LOAD_COMPILED_PATH:+:}$1/lib/guile/2.0/site-ccache"
     fi
 }
diff --git a/pkgs/development/interpreters/guile/setup-hook-2.2.sh b/pkgs/development/interpreters/guile/setup-hook-2.2.sh
index 1430dbe07205..d6bb23e7949a 100644
--- a/pkgs/development/interpreters/guile/setup-hook-2.2.sh
+++ b/pkgs/development/interpreters/guile/setup-hook-2.2.sh
@@ -1,21 +1,17 @@
 addGuileLibPath () {
-    if test -d "$1/share/guile/site/2.2"
-    then
+    if test -d "$1/share/guile/site/2.2"; then
         export GUILE_LOAD_PATH="${GUILE_LOAD_PATH-}${GUILE_LOAD_PATH:+:}$1/share/guile/site/2.2"
         export GUILE_LOAD_COMPILED_PATH="${GUILE_LOAD_COMPILED_PATH-}${GUILE_LOAD_COMPILED_PATH:+:}$1/share/guile/site/2.2"
-    elif test -d "$1/share/guile/site"
-    then
+    elif test -d "$1/share/guile/site"; then
         export GUILE_LOAD_PATH="${GUILE_LOAD_PATH-}${GUILE_LOAD_PATH:+:}$1/share/guile/site"
         export GUILE_LOAD_COMPILED_PATH="${GUILE_LOAD_COMPILED_PATH-}${GUILE_LOAD_COMPILED_PATH:+:}$1/share/guile/site"
     fi
 
-    if test -d "$1/lib/guile/2.2/ccache"
-    then
+    if test -d "$1/lib/guile/2.2/ccache"; then
         export GUILE_LOAD_COMPILED_PATH="${GUILE_LOAD_COMPILED_PATH-}${GUILE_LOAD_COMPILED_PATH:+:}$1/lib/guile/2.2/ccache"
     fi
 
-    if test -d "$1/lib/guile/2.2/site-ccache"
-    then
+    if test -d "$1/lib/guile/2.2/site-ccache"; then
         export GUILE_LOAD_COMPILED_PATH="${GUILE_LOAD_COMPILED_PATH-}${GUILE_LOAD_COMPILED_PATH:+:}$1/lib/guile/2.2/site-ccache"
     fi
 }
diff --git a/pkgs/development/interpreters/guile/setup-hook-3.0.sh b/pkgs/development/interpreters/guile/setup-hook-3.0.sh
new file mode 100644
index 000000000000..e13ec2767fd4
--- /dev/null
+++ b/pkgs/development/interpreters/guile/setup-hook-3.0.sh
@@ -0,0 +1,19 @@
+addGuileLibPath () {
+    if test -d "$1/share/guile/site/3.0"; then
+        export GUILE_LOAD_PATH="${GUILE_LOAD_PATH-}${GUILE_LOAD_PATH:+:}$1/share/guile/site/3.0"
+        export GUILE_LOAD_COMPILED_PATH="${GUILE_LOAD_COMPILED_PATH-}${GUILE_LOAD_COMPILED_PATH:+:}$1/share/guile/site/3.0"
+    elif test -d "$1/share/guile/site"; then
+        export GUILE_LOAD_PATH="${GUILE_LOAD_PATH-}${GUILE_LOAD_PATH:+:}$1/share/guile/site"
+        export GUILE_LOAD_COMPILED_PATH="${GUILE_LOAD_COMPILED_PATH-}${GUILE_LOAD_COMPILED_PATH:+:}$1/share/guile/site"
+    fi
+
+    if test -d "$1/lib/guile/3.0/ccache"; then
+        export GUILE_LOAD_COMPILED_PATH="${GUILE_LOAD_COMPILED_PATH-}${GUILE_LOAD_COMPILED_PATH:+:}$1/lib/guile/3.0/ccache"
+    fi
+
+    if test -d "$1/lib/guile/3.0/site-ccache"; then
+        export GUILE_LOAD_COMPILED_PATH="${GUILE_LOAD_COMPILED_PATH-}${GUILE_LOAD_COMPILED_PATH:+:}$1/lib/guile/3.0/site-ccache"
+    fi
+}
+
+addEnvHooks "$hostOffset" addGuileLibPath
diff --git a/pkgs/development/interpreters/python/cpython/default.nix b/pkgs/development/interpreters/python/cpython/default.nix
index 7bb2bb288931..e4a974a255b8 100644
--- a/pkgs/development/interpreters/python/cpython/default.nix
+++ b/pkgs/development/interpreters/python/cpython/default.nix
@@ -284,7 +284,10 @@ in with passthru; stdenv.mkDerivation {
   CPPFLAGS = concatStringsSep " " (map (p: "-I${getDev p}/include") buildInputs);
   LDFLAGS = concatStringsSep " " (map (p: "-L${getLib p}/lib") buildInputs);
   LIBS = "${optionalString (!stdenv.isDarwin) "-lcrypt"} ${optionalString (ncurses != null) "-lncurses"}";
-  NIX_LDFLAGS = optionalString (stdenv.isLinux && !stdenv.hostPlatform.isMusl) "-lgcc_s" + optionalString stdenv.hostPlatform.isMusl "-lgcc_eh";
+  NIX_LDFLAGS = lib.optionalString stdenv.cc.isGNU ({
+    "glibc" = "-lgcc_s";
+    "musl" = "-lgcc_eh";
+  }."${stdenv.hostPlatform.libc}" or "");
   # Determinism: We fix the hashes of str, bytes and datetime objects.
   PYTHONHASHSEED=0;
 
diff --git a/pkgs/development/interpreters/python/default.nix b/pkgs/development/interpreters/python/default.nix
index 73b8912027bf..471320ee2c11 100644
--- a/pkgs/development/interpreters/python/default.nix
+++ b/pkgs/development/interpreters/python/default.nix
@@ -37,7 +37,7 @@ with pkgs;
           keep = self: {
             # TODO maybe only define these here so nothing is needed to be kept in sync.
             inherit (self)
-              isPy27 isPy35 isPy36 isPy37 isPy38 isPy39 isPy3k isPyPy pythonAtLeast pythonOlder
+              isPy27 isPy35 isPy36 isPy37 isPy38 isPy39 isPy310 isPy3k isPyPy pythonAtLeast pythonOlder
               python bootstrapped-pip buildPythonPackage buildPythonApplication
               fetchPypi
               hasPythonModule requiredPythonModules makePythonPath disabledIf
@@ -123,10 +123,10 @@ with pkgs;
       sourceVersion = {
         major = "3";
         minor = "8";
-        patch = "11";
+        patch = "12";
         suffix = "";
       };
-      sha256 = "1chg8b0m1yrz50lizid20zha0dmj40z0iih3jqcrg7pyxca126pv";
+      sha256 = "1si8hw2xpagh4iji89zdx69p3dv5mjqwwbx2x2sl6lrp41jaglxi";
     };
     python39 = {
       sourceVersion = {
@@ -154,28 +154,15 @@ in {
     inherit passthruFun;
   };
 
-  python36 = callPackage ./cpython {
-    self = python36;
-    sourceVersion = {
-      major = "3";
-      minor = "6";
-      patch = "14";
-      suffix = "";
-    };
-    sha256 = "1bnm0bx7xf1jpfm0bmzlq19vwm0bvcbl7klx4rvgq05xryhafqr6";
-    inherit (darwin) configd;
-    inherit passthruFun;
-  };
-
   python37 = callPackage ./cpython {
     self = python37;
     sourceVersion = {
       major = "3";
       minor = "7";
-      patch = "11";
+      patch = "12";
       suffix = "";
     };
-    sha256 = "0d57b5a47wapzpkkq5rbvvi4caylc35j5910b64rxxn4nmm1kd6x";
+    sha256 = "041jqjl5wf7gsw84zd3jgvg91skq20l2fy5zbhz237w38zxzfyzp";
     inherit (darwin) configd;
     inherit passthruFun;
   };
@@ -198,9 +185,9 @@ in {
       major = "3";
       minor = "10";
       patch = "0";
-      suffix = "rc1";
+      suffix = "";
     };
-    sha256 = "0f76q6rsvbvrzcnsp0k7sp555krrgvjpcd09l1rybl4249ln2w3r";
+    sha256 = "00mhn6kj4qkvkkv6hh2klnnjr0yk0c9hspp7njc7n6m1lvkzi6as";
     inherit (darwin) configd;
     inherit passthruFun;
   };
diff --git a/pkgs/development/interpreters/spidermonkey/78.nix b/pkgs/development/interpreters/spidermonkey/78.nix
index 9b81dcc55e7f..5a63be5b838b 100644
--- a/pkgs/development/interpreters/spidermonkey/78.nix
+++ b/pkgs/development/interpreters/spidermonkey/78.nix
@@ -15,7 +15,7 @@
 , rustc
 , rust-cbindgen
 , yasm
-, llvmPackages_11
+, llvmPackages_12
 , nspr
 }:
 
@@ -43,7 +43,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [
     autoconf213
     cargo
-    llvmPackages_11.llvm # for llvm-objdump
+    llvmPackages_12.llvm # for llvm-objdump
     perl
     pkg-config
     python3
diff --git a/pkgs/development/interpreters/tcl/mk-tcl-derivation.nix b/pkgs/development/interpreters/tcl/mk-tcl-derivation.nix
index f3d34f13c688..0e44eb358593 100644
--- a/pkgs/development/interpreters/tcl/mk-tcl-derivation.nix
+++ b/pkgs/development/interpreters/tcl/mk-tcl-derivation.nix
@@ -32,7 +32,7 @@ let
   defaultTclPkgConfigureFlags = [
     "--with-tcl=${tcl}/lib"
     "--with-tclinclude=${tcl}/include"
-    "--exec-prefix=\${out}"
+    "--exec-prefix=${placeholder "out"}"
   ];
 
   self = (stdenv.mkDerivation ((builtins.removeAttrs attrs [
diff --git a/pkgs/development/libraries/boehm-gc/7.6.6.nix b/pkgs/development/libraries/boehm-gc/7.6.6.nix
deleted file mode 100644
index 13f490af3e2b..000000000000
--- a/pkgs/development/libraries/boehm-gc/7.6.6.nix
+++ /dev/null
@@ -1,74 +0,0 @@
-{ lib, stdenv, fetchurl, fetchpatch, pkg-config, libatomic_ops
-, enableLargeConfig ? false # doc: https://github.com/ivmai/bdwgc/blob/v7.6.6/doc/README.macros#L179
-}:
-
-stdenv.mkDerivation rec {
-  pname = "boehm-gc";
-  version = "7.6.6";
-
-  src = fetchurl {
-    urls = [
-      "https://www.hboehm.info/gc/gc_source/gc-${version}.tar.gz"
-      "https://github.com/ivmai/bdwgc/releases/download/v${version}/gc-${version}.tar.gz"
-    ];
-    sha256 = "1p1r015a7jbpvkkbgzv1y8nxrbbp6dg0mq3ksi6ji0qdz3wfss79";
-  };
-
-  buildInputs = [ libatomic_ops ];
-  nativeBuildInputs = [ pkg-config ];
-
-  outputs = [ "out" "dev" "doc" ];
-  separateDebugInfo = stdenv.isLinux;
-
-  preConfigure = lib.optionalString (stdenv.hostPlatform.libc == "musl") ''
-    export NIX_CFLAGS_COMPILE+=" -D_GNU_SOURCE -DUSE_MMAP -DHAVE_DL_ITERATE_PHDR"
-  '';
-
-  patches = [ (fetchpatch {
-    url = "https://gitweb.gentoo.org/proj/musl.git/plain/dev-libs/boehm-gc/files/boehm-gc-7.6.0-sys_select.patch";
-    sha256 = "1gydwlklvci30f5dpp5ccw2p2qpph5y41r55wx9idamjlq66fbb3";
-  }) ] ++
-    # https://github.com/ivmai/bdwgc/pull/208
-    lib.optional stdenv.hostPlatform.isRiscV ./riscv.patch;
-
-  configureFlags =
-    [ "--enable-cplusplus" ]
-    ++ lib.optional enableLargeConfig "--enable-large-config"
-    ++ lib.optional (stdenv.hostPlatform.libc == "musl") "--disable-static";
-
-  doCheck = true; # not cross;
-
-  # Don't run the native `strip' when cross-compiling.
-  dontStrip = stdenv.hostPlatform != stdenv.buildPlatform;
-
-  enableParallelBuilding = true;
-
-  meta = {
-    description = "The Boehm-Demers-Weiser conservative garbage collector for C and C++";
-
-    longDescription = ''
-      The Boehm-Demers-Weiser conservative garbage collector can be used as a
-      garbage collecting replacement for C malloc or C++ new.  It allows you
-      to allocate memory basically as you normally would, without explicitly
-      deallocating memory that is no longer useful.  The collector
-      automatically recycles memory when it determines that it can no longer
-      be otherwise accessed.
-
-      The collector is also used by a number of programming language
-      implementations that either use C as intermediate code, want to
-      facilitate easier interoperation with C libraries, or just prefer the
-      simple collector interface.
-
-      Alternatively, the garbage collector may be used as a leak detector for
-      C or C++ programs, though that is not its primary goal.
-    '';
-
-    homepage = "https://hboehm.info/gc/";
-
-    # non-copyleft, X11-style license
-    license = "https://hboehm.info/gc/license.txt";
-
-    maintainers = [ ];
-    platforms = lib.platforms.all;
-  };
-}
diff --git a/pkgs/development/libraries/boehm-gc/default.nix b/pkgs/development/libraries/boehm-gc/default.nix
index 85ae01036ed1..2c467e90634f 100644
--- a/pkgs/development/libraries/boehm-gc/default.nix
+++ b/pkgs/development/libraries/boehm-gc/default.nix
@@ -1,18 +1,18 @@
 { lib, stdenv, fetchurl
 , autoreconfHook
-, enableLargeConfig ? false # doc: https://github.com/ivmai/bdwgc/blob/v7.6.6/doc/README.macros#L179
+, enableLargeConfig ? false # doc: https://github.com/ivmai/bdwgc/blob/v8.0.6/doc/README.macros#L195
 }:
 
 stdenv.mkDerivation rec {
   pname = "boehm-gc";
-  version = "8.0.4";
+  version = "8.0.6";
 
   src = fetchurl {
     urls = [
       "https://github.com/ivmai/bdwgc/releases/download/v${version}/gc-${version}.tar.gz"
       "https://www.hboehm.info/gc/gc_source/gc-${version}.tar.gz"
     ];
-    sha256 = "1798rp3mcfkgs38ynkbg2p47bq59pisrc6mn0l20pb5iczf0ssj3";
+    sha256 = "3b4914abc9fa76593596773e4da671d7ed4d5390e3d46fbf2e5f155e121bea11";
   };
 
   outputs = [ "out" "dev" "doc" ];
@@ -22,10 +22,8 @@ stdenv.mkDerivation rec {
     export NIX_CFLAGS_COMPILE+=" -D_GNU_SOURCE -DUSE_MMAP -DHAVE_DL_ITERATE_PHDR"
   '';
 
-  patches = # https://github.com/ivmai/bdwgc/pull/208
-    lib.optional stdenv.hostPlatform.isRiscV ./riscv.patch
-    # boehm-gc whitelists GCC threading models
-    ++ lib.optional stdenv.hostPlatform.isMinGW ./mcfgthread.patch;
+  # boehm-gc whitelists GCC threading models
+  patches = lib.optional stdenv.hostPlatform.isMinGW ./mcfgthread.patch;
 
   configureFlags =
     [ "--enable-cplusplus" "--with-libatomic-ops=none" ]
diff --git a/pkgs/development/libraries/boehm-gc/riscv.patch b/pkgs/development/libraries/boehm-gc/riscv.patch
deleted file mode 100644
index 249137d0a0dc..000000000000
--- a/pkgs/development/libraries/boehm-gc/riscv.patch
+++ /dev/null
@@ -1,53 +0,0 @@
-diff --git a/include/private/gcconfig.h b/include/private/gcconfig.h
-index a8e55dd2..439cc88d 100644
---- a/include/private/gcconfig.h
-+++ b/include/private/gcconfig.h
-@@ -650,6 +650,15 @@
- #   endif
- #   define mach_type_known
- # endif
-+# if defined(__riscv) && defined(LINUX)
-+#   if __riscv_xlen == 32
-+#     define RISCV32
-+#     define mach_type_known
-+#   elif __riscv_xlen == 64
-+#     define RISCV64
-+#     define mach_type_known
-+#   endif
-+# endif
- 
- # if defined(SN_TARGET_PSP2)
- #   define mach_type_known
-@@ -2970,6 +2979,32 @@
- #   endif
- # endif
- 
-+# ifdef RISCV32
-+#   define CPP_WORDSZ 32
-+#   define MACH_TYPE "RISC-V 32"
-+#   define ALIGNMENT 4
-+#   ifdef LINUX
-+#     define OS_TYPE "LINUX"
-+      extern int __data_start[];
-+#     define DATASTART ((ptr_t)__data_start)
-+#     define LINUX_STACKBOTTOM
-+#     define DYNAMIC_LOADING
-+#   endif
-+# endif
-+
-+# ifdef RISCV64
-+#   define CPP_WORDSZ 64
-+#   define MACH_TYPE "RISC-V 64"
-+#   define ALIGNMENT 8
-+#   ifdef LINUX
-+#     define OS_TYPE "LINUX"
-+      extern int __data_start[];
-+#     define DATASTART ((ptr_t)__data_start)
-+#     define LINUX_STACKBOTTOM
-+#     define DYNAMIC_LOADING
-+#   endif
-+# endif
-+
- #if defined(__GLIBC__) && !defined(DONT_USE_LIBC_PRIVATES)
-   /* Use glibc's stack-end marker. */
- # define USE_LIBC_PRIVATES
diff --git a/pkgs/development/libraries/git2/default.nix b/pkgs/development/libraries/git2/default.nix
index b02e1ecc6f7b..35ef9fba1051 100644
--- a/pkgs/development/libraries/git2/default.nix
+++ b/pkgs/development/libraries/git2/default.nix
@@ -5,14 +5,14 @@
 
 stdenv.mkDerivation rec {
   pname = "libgit2";
-  version = "1.1.1";
+  version = "1.3.0";
   # keep the version in sync with python3.pkgs.pygit2 and libgit2-glib
 
   src = fetchFromGitHub {
     owner = "libgit2";
     repo = "libgit2";
     rev = "v${version}";
-    sha256 = "sha256-SxceIxT0aeiiiZCeSIe6EOa+MyVpQVaiv/ZZn6fkwIc=";
+    sha256 = "sha256-7atNkOBzX+nU1gtFQEaE+EF1L+eex+Ajhq2ocoJY920=";
   };
 
   cmakeFlags = [
diff --git a/pkgs/development/libraries/glibc/2.33-master.patch.gz b/pkgs/development/libraries/glibc/2.33-master.patch.gz
index 4a287d5c9ca1..a5f8154dd823 100644
Binary files a/pkgs/development/libraries/glibc/2.33-master.patch.gz and b/pkgs/development/libraries/glibc/2.33-master.patch.gz differ
diff --git a/pkgs/development/libraries/glibc/common.nix b/pkgs/development/libraries/glibc/common.nix
index a715ba752ec1..3f78ef4041a6 100644
--- a/pkgs/development/libraries/glibc/common.nix
+++ b/pkgs/development/libraries/glibc/common.nix
@@ -42,7 +42,7 @@
 
 let
   version = "2.33";
-  patchSuffix = "-50";
+  patchSuffix = "-55";
   sha256 = "sha256-LiVWAA4QXb1X8Layoy/yzxc73k8Nhd/8z9i35RoGd/8=";
 in
 
@@ -61,7 +61,7 @@ stdenv.mkDerivation ({
     [
       /* No tarballs for stable upstream branch, only https://sourceware.org/git/glibc.git and using git would complicate bootstrapping.
           $ git fetch --all -p && git checkout origin/release/2.33/master && git describe
-          glibc-2.33-50-gc6cadbf83a
+          glibc-2.33-55-g4b95183785
           $ git show --minimal --reverse glibc-2.33.. | gzip -9n --rsyncable - > 2.33-master.patch.gz
 
          To compare the archive contents zdiff can be used.
diff --git a/pkgs/development/libraries/gtk/2.x.nix b/pkgs/development/libraries/gtk/2.x.nix
index 1a7cc57fbeaf..bbf20d609702 100644
--- a/pkgs/development/libraries/gtk/2.x.nix
+++ b/pkgs/development/libraries/gtk/2.x.nix
@@ -21,11 +21,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "gtk+";
-  version = "2.24.32";
+  version = "2.24.33";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gtk+/2.24/${pname}-${version}.tar.xz";
-    sha256 = "b6c8a93ddda5eabe3bfee1eb39636c9a03d2a56c7b62828b359bf197943c582e";
+    sha256 = "rCrHV/WULTGKMRpUsMgLXvKV8pnCpzxjL2v7H/Scxto=";
   };
 
   outputs = [ "out" "dev" "devdoc" ];
diff --git a/pkgs/development/libraries/kde-frameworks/fetch.sh b/pkgs/development/libraries/kde-frameworks/fetch.sh
index 05c89d25ce62..7f6c19667e15 100644
--- a/pkgs/development/libraries/kde-frameworks/fetch.sh
+++ b/pkgs/development/libraries/kde-frameworks/fetch.sh
@@ -1 +1 @@
-WGET_ARGS=( https://download.kde.org/stable/frameworks/5.85/ -A '*.tar.xz' )
+WGET_ARGS=( https://download.kde.org/stable/frameworks/5.87/ -A '*.tar.xz' )
diff --git a/pkgs/development/libraries/kde-frameworks/karchive.nix b/pkgs/development/libraries/kde-frameworks/karchive.nix
index 3602cb7b0617..bd010f3f11cf 100644
--- a/pkgs/development/libraries/kde-frameworks/karchive.nix
+++ b/pkgs/development/libraries/kde-frameworks/karchive.nix
@@ -1,13 +1,13 @@
 {
   mkDerivation,
   extra-cmake-modules,
-  bzip2, xz, qtbase, zlib,
+  bzip2, xz, qtbase, zlib, zstd
 }:
 
 mkDerivation {
   name = "karchive";
   nativeBuildInputs = [ extra-cmake-modules ];
-  buildInputs = [ bzip2 xz zlib ];
+  buildInputs = [ bzip2 xz zlib zstd ];
   propagatedBuildInputs = [ qtbase ];
   outputs = [ "out" "dev" ];
 }
diff --git a/pkgs/development/libraries/kde-frameworks/kcontacts.nix b/pkgs/development/libraries/kde-frameworks/kcontacts.nix
index 74b6652aee2a..56887b775f4a 100644
--- a/pkgs/development/libraries/kde-frameworks/kcontacts.nix
+++ b/pkgs/development/libraries/kde-frameworks/kcontacts.nix
@@ -1,6 +1,6 @@
 {
   mkDerivation, lib,
-  extra-cmake-modules,
+  extra-cmake-modules, isocodes,
   kcoreaddons, kconfig, kcodecs, ki18n, qtbase,
 }:
 
@@ -9,6 +9,9 @@ mkDerivation {
   meta = {
     license = [ lib.licenses.lgpl21 ];
   };
+  propagatedBuildInputs = [
+    isocodes
+  ];
   nativeBuildInputs = [ extra-cmake-modules ];
   buildInputs = [ kcoreaddons kconfig kcodecs ki18n qtbase ];
   outputs = [ "out" "dev" ];
diff --git a/pkgs/development/libraries/kde-frameworks/kded.nix b/pkgs/development/libraries/kde-frameworks/kded.nix
index 936119ab7f5c..250a999f4d6c 100644
--- a/pkgs/development/libraries/kde-frameworks/kded.nix
+++ b/pkgs/development/libraries/kde-frameworks/kded.nix
@@ -1,7 +1,7 @@
 {
   mkDerivation, propagate, wrapGAppsHook,
   extra-cmake-modules, kdoctools,
-  gsettings-desktop-schemas, kconfig, kcoreaddons, kcrash, kdbusaddons, kinit,
+  gsettings-desktop-schemas, kconfig, kcoreaddons, kcrash, kdbusaddons,
   kservice, qtbase,
 }:
 
@@ -9,7 +9,7 @@ mkDerivation {
   name = "kded";
   nativeBuildInputs = [ extra-cmake-modules kdoctools wrapGAppsHook ];
   buildInputs = [
-    gsettings-desktop-schemas kconfig kcoreaddons kcrash kdbusaddons kinit
+    gsettings-desktop-schemas kconfig kcoreaddons kcrash kdbusaddons
     kservice qtbase
   ];
   outputs = [ "out" "dev" ];
diff --git a/pkgs/development/libraries/kde-frameworks/kio/0002-Debug-module-loader.patch b/pkgs/development/libraries/kde-frameworks/kio/0002-Debug-module-loader.patch
index d0bad0caf4ab..9653e3ad3f3a 100644
--- a/pkgs/development/libraries/kde-frameworks/kio/0002-Debug-module-loader.patch
+++ b/pkgs/development/libraries/kde-frameworks/kio/0002-Debug-module-loader.patch
@@ -11,15 +11,15 @@ diff --git a/src/kiod/kiod_main.cpp b/src/kiod/kiod_main.cpp
 index 1976ee1..eb402bf 100644
 --- a/src/kiod/kiod_main.cpp
 +++ b/src/kiod/kiod_main.cpp
-@@ -50,7 +50,7 @@ void KIOD::loadModule(const QString &name)
-         module = factory->create<KDEDModule>();
+@@ -49,7 +49,7 @@ void KIOD::loadModule(const QString &name)
+         module->setModuleName(name); // makes it register to DBus
+         m_modules.insert(name, module);
+     } else {
+-        qCWarning(KIOD_CATEGORY) << "Error loading plugin:" << result.errorText;
++        qCWarning(KIOD_CATEGORY) << "Error loading plugin:" << name << result.errorText;
      }
-     if (!module) {
--        qCWarning(KIOD_CATEGORY) << "Error loading plugin:" << loader.errorString();
-+        qCWarning(KIOD_CATEGORY) << "Error loading plugin" << name << loader.errorString();
-         return;
-     }
-     module->setModuleName(name); // makes it register to DBus
+ }
+ 
 -- 
 2.30.1
 
diff --git a/pkgs/development/libraries/kde-frameworks/kio/default.nix b/pkgs/development/libraries/kde-frameworks/kio/default.nix
index 84957c183ff5..12df0496a946 100644
--- a/pkgs/development/libraries/kde-frameworks/kio/default.nix
+++ b/pkgs/development/libraries/kde-frameworks/kio/default.nix
@@ -1,23 +1,27 @@
 {
-  mkDerivation, fetchpatch,
-  util-linux, extra-cmake-modules, kdoctools, qttools,
+  stdenv, lib, mkDerivation, fetchpatch,
+  extra-cmake-modules, kdoctools, qttools,
+  acl, attr, libkrb5, util-linux,
   karchive, kbookmarks, kcompletion, kconfig, kconfigwidgets, kcoreaddons,
   kdbusaddons, ki18n, kiconthemes, kitemviews, kjobwidgets, knotifications,
   kservice, ktextwidgets, kwallet, kwidgetsaddons, kwindowsystem, kxmlgui,
-  qtbase, qtscript, qtx11extras, solid, kcrash
+  qtbase, qtscript, qtx11extras, solid, kcrash, kded
 }:
 
 mkDerivation {
   name = "kio";
   nativeBuildInputs = [ extra-cmake-modules kdoctools ];
   buildInputs = [
-    util-linux karchive kconfigwidgets kdbusaddons ki18n kiconthemes knotifications
+    karchive kconfigwidgets kdbusaddons ki18n kiconthemes knotifications
     ktextwidgets kwallet kwidgetsaddons kwindowsystem qtscript qtx11extras
-    kcrash
+    kcrash libkrb5
+  ] ++ lib.lists.optionals stdenv.isLinux [
+    acl attr # both are needed for ACL support
+    util-linux # provides libmount
   ];
   propagatedBuildInputs = [
     kbookmarks kcompletion kconfig kcoreaddons kitemviews kjobwidgets kservice
-    kxmlgui qtbase qttools solid
+    kxmlgui qtbase qttools solid kded
   ];
   outputs = [ "out" "dev" ];
   patches = [
diff --git a/pkgs/development/libraries/kde-frameworks/knewstuff/default.nix b/pkgs/development/libraries/kde-frameworks/knewstuff/default.nix
index b775fcbef8f6..6d170c0bb129 100644
--- a/pkgs/development/libraries/kde-frameworks/knewstuff/default.nix
+++ b/pkgs/development/libraries/kde-frameworks/knewstuff/default.nix
@@ -3,7 +3,7 @@
   extra-cmake-modules,
   attica, karchive, kcompletion, kconfig, kcoreaddons, ki18n, kiconthemes,
   kio, kitemviews, kpackage, kservice, ktextwidgets, kwidgetsaddons, kxmlgui, qtbase,
-  qtdeclarative, kirigami2,
+  qtdeclarative, kirigami2, syndication,
 }:
 
 mkDerivation {
@@ -12,7 +12,7 @@ mkDerivation {
   buildInputs = [
     karchive kcompletion kconfig kcoreaddons ki18n kiconthemes kio kitemviews
     kpackage
-    ktextwidgets kwidgetsaddons qtbase qtdeclarative kirigami2
+    ktextwidgets kwidgetsaddons qtbase qtdeclarative kirigami2 syndication
   ];
   propagatedBuildInputs = [ attica kservice kxmlgui ];
   patches = [
diff --git a/pkgs/development/libraries/kde-frameworks/kpackage/0002-QDirIterator-follow-symlinks.patch b/pkgs/development/libraries/kde-frameworks/kpackage/0002-QDirIterator-follow-symlinks.patch
index 1edf2a1c63c8..eaa25985e07c 100644
--- a/pkgs/development/libraries/kde-frameworks/kpackage/0002-QDirIterator-follow-symlinks.patch
+++ b/pkgs/development/libraries/kde-frameworks/kpackage/0002-QDirIterator-follow-symlinks.patch
@@ -12,10 +12,10 @@ diff --git a/src/kpackage/packageloader.cpp b/src/kpackage/packageloader.cpp
 index f03d882..d5aee56 100644
 --- a/src/kpackage/packageloader.cpp
 +++ b/src/kpackage/packageloader.cpp
-@@ -210,7 +210,7 @@ QList<KPluginMetaData> PackageLoader::listPackages(const QString &packageFormat,
+@@ -196,7 +196,7 @@ QList<KPluginMetaData> PackageLoader::listPackages(const QString &packageFormat,
      }
 
-     for (auto const &plugindir : qAsConst(paths)) {
+     for (auto const &plugindir : std::as_const(paths)) {
 -        const QDirIterator::IteratorFlags flags = QDirIterator::Subdirectories;
 +        const QDirIterator::IteratorFlags flags = QDirIterator::Subdirectories | QDirIterator::FollowSymlinks;
          const QStringList nameFilters = {QStringLiteral("metadata.json"), QStringLiteral("metadata.desktop")};
diff --git a/pkgs/development/libraries/kde-frameworks/purpose.nix b/pkgs/development/libraries/kde-frameworks/purpose.nix
index 7e4d002e2a1e..0f376ce9ec3a 100644
--- a/pkgs/development/libraries/kde-frameworks/purpose.nix
+++ b/pkgs/development/libraries/kde-frameworks/purpose.nix
@@ -1,14 +1,14 @@
 {
-  mkDerivation, extra-cmake-modules, qtbase
-, qtdeclarative, kconfig, kcoreaddons, ki18n, kio, kirigami2
-, fetchpatch
+  mkDerivation, extra-cmake-modules, intltool, qtbase
+, accounts-qt, qtdeclarative, kaccounts-integration, kconfig, kcoreaddons, ki18n, kio, kirigami2
+, fetchpatch, signond
 }:
 
 mkDerivation {
   name = "purpose";
-  nativeBuildInputs = [ extra-cmake-modules ];
+  nativeBuildInputs = [ extra-cmake-modules intltool ];
   buildInputs = [
-    qtbase qtdeclarative kconfig kcoreaddons
-    ki18n kio kirigami2
+    qtbase accounts-qt qtdeclarative kaccounts-integration kconfig kcoreaddons
+    ki18n kio kirigami2 signond
   ];
 }
diff --git a/pkgs/development/libraries/kde-frameworks/srcs.nix b/pkgs/development/libraries/kde-frameworks/srcs.nix
index 73d4ce478c61..03f261c19b02 100644
--- a/pkgs/development/libraries/kde-frameworks/srcs.nix
+++ b/pkgs/development/libraries/kde-frameworks/srcs.nix
@@ -4,667 +4,667 @@
 
 {
   attica = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/attica-5.85.0.tar.xz";
-      sha256 = "1rwb2jz2chvxa7hdxn5ms1f93ykpk26kmnngwcixqr7gwlcv8prl";
-      name = "attica-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/attica-5.87.0.tar.xz";
+      sha256 = "0wjfrlmwg03js544xjlpznxxqv14cj40fpzbfnlj24kjgd1ai8dq";
+      name = "attica-5.87.0.tar.xz";
     };
   };
   baloo = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/baloo-5.85.0.tar.xz";
-      sha256 = "0kcilv41assarhp54i99scpg08m11fjznw4d1lx5rdy7fyd4bd41";
-      name = "baloo-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/baloo-5.87.0.tar.xz";
+      sha256 = "0h55hn6klsq19l44qzc95l1r7hx2zr9hr4ysxd8kvcxc02imaswb";
+      name = "baloo-5.87.0.tar.xz";
     };
   };
   bluez-qt = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/bluez-qt-5.85.0.tar.xz";
-      sha256 = "18h0swvmimfxr9ygg0fs9gg0bm4a016n55hkvqx6n3y505b2lnx8";
-      name = "bluez-qt-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/bluez-qt-5.87.0.tar.xz";
+      sha256 = "1shk3riddgdb0i6f0603hbhww13z1b566rdaplxsbgk8cyhl5acz";
+      name = "bluez-qt-5.87.0.tar.xz";
     };
   };
   breeze-icons = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/breeze-icons-5.85.0.tar.xz";
-      sha256 = "0g97md30f76x38skqf7xpxxrcpydx4z5adrknq0bcnpqg3baw1s4";
-      name = "breeze-icons-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/breeze-icons-5.87.0.tar.xz";
+      sha256 = "19f7n4r6b0b1l8hc79xbj8gc18xf488bk4i0wdbw22x9vwl4h58h";
+      name = "breeze-icons-5.87.0.tar.xz";
     };
   };
   extra-cmake-modules = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/extra-cmake-modules-5.85.0.tar.xz";
-      sha256 = "0d36dg727d0ilq0ag4mv3vhp065p60nnl61014jm1p0kn71hjhks";
-      name = "extra-cmake-modules-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/extra-cmake-modules-5.87.0.tar.xz";
+      sha256 = "1axwz0p3ggjpcxpqqlyng3fa2pxmjxgybncgkp8i81i7iq6sf72l";
+      name = "extra-cmake-modules-5.87.0.tar.xz";
     };
   };
   frameworkintegration = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/frameworkintegration-5.85.0.tar.xz";
-      sha256 = "1j3p1hy5fhy1b83mcy2n25a8rzwv8n79c2jwfxhyd2hw1yvrkmzr";
-      name = "frameworkintegration-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/frameworkintegration-5.87.0.tar.xz";
+      sha256 = "1bbgxqgy28abrk2cgzj7k2m18xmkl9kw58dal03pzlmh77br00lb";
+      name = "frameworkintegration-5.87.0.tar.xz";
     };
   };
   kactivities = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/kactivities-5.85.0.tar.xz";
-      sha256 = "0c40ripx3k8rccaj699ill4kmdnh1vl9gsxvzvff0y312ya1v2gm";
-      name = "kactivities-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/kactivities-5.87.0.tar.xz";
+      sha256 = "1ynngg9x70dwcnn4ncf7h63hj5p187d4mk1aqriax0iz21mfjmp9";
+      name = "kactivities-5.87.0.tar.xz";
     };
   };
   kactivities-stats = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/kactivities-stats-5.85.0.tar.xz";
-      sha256 = "08y5wqalsd3xwczb87n2n5l0rky8lydhyb66xvh2dzl5fmw7k5z1";
-      name = "kactivities-stats-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/kactivities-stats-5.87.0.tar.xz";
+      sha256 = "1n7jzbfwgwclnrnssxm180fis74qp3v9nximhc0l8fmb8ac1f106";
+      name = "kactivities-stats-5.87.0.tar.xz";
     };
   };
   kapidox = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/kapidox-5.85.0.tar.xz";
-      sha256 = "1cmx16gy2s6j2vvs0nn62vczjf6pc8s7dvdz47lrnpmc7p8yzddm";
-      name = "kapidox-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/kapidox-5.87.0.tar.xz";
+      sha256 = "0iyla9i4ln6w9wkm4dand53ir6gzsm4180diwi9p2q5mfrk0rvja";
+      name = "kapidox-5.87.0.tar.xz";
     };
   };
   karchive = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/karchive-5.85.0.tar.xz";
-      sha256 = "0bvbmd3phjyk11ylggmzl0kihmg7w623alplwp3j4mj8jn8nw6cc";
-      name = "karchive-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/karchive-5.87.0.tar.xz";
+      sha256 = "0d8wqrynwmqazlf5v7qas9akrvcwr4lrqg3dcbnq61mmc252wgqh";
+      name = "karchive-5.87.0.tar.xz";
     };
   };
   kauth = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/kauth-5.85.0.tar.xz";
-      sha256 = "1ib1i4mpxdkddn0kd6prx0j8vc55ai6nlx71lakr2cdafp296fhs";
-      name = "kauth-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/kauth-5.87.0.tar.xz";
+      sha256 = "1gbq487v2nn0zyis6xdvsn0mz7yy131vafq76jdi7b6nyh5c1lgi";
+      name = "kauth-5.87.0.tar.xz";
     };
   };
   kbookmarks = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/kbookmarks-5.85.0.tar.xz";
-      sha256 = "0jraagmjch0pda15k9ywpidl474x4wq60zzffi2n3vmy8y9hs4rn";
-      name = "kbookmarks-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/kbookmarks-5.87.0.tar.xz";
+      sha256 = "0klws0psdq9vx09p38ckki7aqbdkcns1smk8ckj79krpsjv8q9nx";
+      name = "kbookmarks-5.87.0.tar.xz";
     };
   };
   kcalendarcore = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/kcalendarcore-5.85.0.tar.xz";
-      sha256 = "04nrfwd4g5v4lnmlcq0rdmx8xfn9wbzp92izsy7zwwxcmpwivysq";
-      name = "kcalendarcore-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/kcalendarcore-5.87.0.tar.xz";
+      sha256 = "0ig2w0dxrf9ih9hqk5rvqqmyhg658m1hs4807zl66llplkr58q0n";
+      name = "kcalendarcore-5.87.0.tar.xz";
     };
   };
   kcmutils = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/kcmutils-5.85.0.tar.xz";
-      sha256 = "14yfkrqv77r6hm390ib8g7gcjcw3dlnlqs9bd3y0mg123wps7s10";
-      name = "kcmutils-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/kcmutils-5.87.0.tar.xz";
+      sha256 = "09pcif2gmkbhwqb8cxfs89nw81wdpdsd4a2n7xdm1xz6lpwwmk1h";
+      name = "kcmutils-5.87.0.tar.xz";
     };
   };
   kcodecs = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/kcodecs-5.85.0.tar.xz";
-      sha256 = "1zgpi177j0j3jzi3n0kjyddy0d7b9vp7kxv6c2jsqx9ppps0l1k5";
-      name = "kcodecs-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/kcodecs-5.87.0.tar.xz";
+      sha256 = "1fb8agbkwxnxb0hlzz0ya460z3ihn9qz2zvjdxvk21rjhmp1alh7";
+      name = "kcodecs-5.87.0.tar.xz";
     };
   };
   kcompletion = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/kcompletion-5.85.0.tar.xz";
-      sha256 = "1vy41mavbm8avr9jfspys4mpzc4i5rkg5gpl9hcbjrkldb9ymfj1";
-      name = "kcompletion-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/kcompletion-5.87.0.tar.xz";
+      sha256 = "15c9sgdgw6cf5y2jjgjlsxn0p0pxvrmhzcyq05d9fqhy185ng03p";
+      name = "kcompletion-5.87.0.tar.xz";
     };
   };
   kconfig = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/kconfig-5.85.0.tar.xz";
-      sha256 = "0qmrv8ixlg7qrb7fyyvk7a0a7avvpflc05rj46zzip6kjhl4imds";
-      name = "kconfig-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/kconfig-5.87.0.tar.xz";
+      sha256 = "1l8px5qpf5qfma24filim1swblgbdvnf25pc38qc6s79inkganrl";
+      name = "kconfig-5.87.0.tar.xz";
     };
   };
   kconfigwidgets = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/kconfigwidgets-5.85.0.tar.xz";
-      sha256 = "0hx8f1dcd38wsrifh4j3a5m05xahdqrhsysasbdwxhr5s29d7vvr";
-      name = "kconfigwidgets-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/kconfigwidgets-5.87.0.tar.xz";
+      sha256 = "18m3nqlp87am2w8my4y933ck9k3cs5q62nkhbp8ngaavw8cfbd84";
+      name = "kconfigwidgets-5.87.0.tar.xz";
     };
   };
   kcontacts = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/kcontacts-5.85.0.tar.xz";
-      sha256 = "07j2h8fd62j7jbcm5fyv27vy120687k1cmp2rw06sf3xl480nk8k";
-      name = "kcontacts-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/kcontacts-5.87.0.tar.xz";
+      sha256 = "02zyirvds572rxbdc47ncs71a66z5hql0vpj8lx1zpr0nnvpvlcv";
+      name = "kcontacts-5.87.0.tar.xz";
     };
   };
   kcoreaddons = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/kcoreaddons-5.85.0.tar.xz";
-      sha256 = "052l8kvv7k3m43r6arckg4fls0y913gklc8jx09y56g1m51mgbwh";
-      name = "kcoreaddons-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/kcoreaddons-5.87.0.tar.xz";
+      sha256 = "19pdpz7jjknccaqc2i6zfmclmrk60clzanvx72ryvh7yb0xyk7yj";
+      name = "kcoreaddons-5.87.0.tar.xz";
     };
   };
   kcrash = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/kcrash-5.85.0.tar.xz";
-      sha256 = "14hknkl4md0qzh44f1zqraljzvlbwzc95mci713a9mhk9rb0957f";
-      name = "kcrash-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/kcrash-5.87.0.tar.xz";
+      sha256 = "1l48dn5vqn4lns57v61p1a8r3pklx4xclsa3890pjf6iviqxf22r";
+      name = "kcrash-5.87.0.tar.xz";
     };
   };
   kdav = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/kdav-5.85.0.tar.xz";
-      sha256 = "11wwdv19d0fy7b1bzgqaciv4hg99a8pi6g2ymjn3g0l3ps05a0sl";
-      name = "kdav-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/kdav-5.87.0.tar.xz";
+      sha256 = "0sb1g0wdpql5gw52nxhzkk1wa9md2k25lwyf902g3pf7ahdgdk5z";
+      name = "kdav-5.87.0.tar.xz";
     };
   };
   kdbusaddons = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/kdbusaddons-5.85.0.tar.xz";
-      sha256 = "0f8k2kynbspi86gcvpzn209m1bm6vc65flqlnh8prbkd3gg283d6";
-      name = "kdbusaddons-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/kdbusaddons-5.87.0.tar.xz";
+      sha256 = "14xmrvak95aqc98a6k6ldg1w4g7syx2xng3vgvwj9wzpzr3shp6p";
+      name = "kdbusaddons-5.87.0.tar.xz";
     };
   };
   kdeclarative = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/kdeclarative-5.85.0.tar.xz";
-      sha256 = "1qdbvfx0i09hn9236hnb73fzym529wjsgqmfwzhh5a6dnqdh1rjd";
-      name = "kdeclarative-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/kdeclarative-5.87.0.tar.xz";
+      sha256 = "0zx4alsqk3vqfgyi6x7v2mcar92j3swmg0ms0b9mjl95bvpgi4k7";
+      name = "kdeclarative-5.87.0.tar.xz";
     };
   };
   kded = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/kded-5.85.0.tar.xz";
-      sha256 = "1yar9zcrrs0c0hakg8sfisnp32284ljj1axhgmx8hkwfj591jdiw";
-      name = "kded-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/kded-5.87.0.tar.xz";
+      sha256 = "18dw1dd2lmwsh04yan1q72c5lzcgzm9kig1rqag3rg81h7pclsr5";
+      name = "kded-5.87.0.tar.xz";
     };
   };
   kdelibs4support = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/portingAids/kdelibs4support-5.85.0.tar.xz";
-      sha256 = "1c4zd60s7l1qv719nl28j7gh3lpr1cwqq5vcibb9a6di04k27mm0";
-      name = "kdelibs4support-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/portingAids/kdelibs4support-5.87.0.tar.xz";
+      sha256 = "17kw76fd97rhdyna3dc7hsajvd8bv9l71qx0xaqn65pvzbndf2jf";
+      name = "kdelibs4support-5.87.0.tar.xz";
     };
   };
   kdesignerplugin = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/portingAids/kdesignerplugin-5.85.0.tar.xz";
-      sha256 = "0pchfvmy7r2mkd412nbzk2pkji2dx5lispwcnk759ffm4wlnxncf";
-      name = "kdesignerplugin-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/portingAids/kdesignerplugin-5.87.0.tar.xz";
+      sha256 = "12rckqvg6w5cycvmxbrkvxi7ysfk6bqk3yi1ik4ryqh4x5dz2am9";
+      name = "kdesignerplugin-5.87.0.tar.xz";
     };
   };
   kdesu = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/kdesu-5.85.0.tar.xz";
-      sha256 = "1xqzkyd9flglr3aqabkh54yl7a5a429d24mpqphakc3djmdv5d08";
-      name = "kdesu-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/kdesu-5.87.0.tar.xz";
+      sha256 = "05bb3hcb00j1f047q6ngbb8arrp4s03da880sky0slvvicm4ynkr";
+      name = "kdesu-5.87.0.tar.xz";
     };
   };
   kdewebkit = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/portingAids/kdewebkit-5.85.0.tar.xz";
-      sha256 = "14w254wfp35sldadff1y62yl6f1kshlfk4vlhlan626vyidypc43";
-      name = "kdewebkit-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/portingAids/kdewebkit-5.87.0.tar.xz";
+      sha256 = "1a578sa6nfp2vycrrhc37idwg47nrrfhv6dp8rfb2gj4vf67bzcv";
+      name = "kdewebkit-5.87.0.tar.xz";
     };
   };
   kdnssd = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/kdnssd-5.85.0.tar.xz";
-      sha256 = "0i1qv6qjsdlb08mwiqs3s6v2hwfr77i65hgc0qj9pbhzvm5v6x8m";
-      name = "kdnssd-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/kdnssd-5.87.0.tar.xz";
+      sha256 = "1rs8i75qm1vazy8cnvcv3sha6faf27bav491z8brcs8fiab96dnw";
+      name = "kdnssd-5.87.0.tar.xz";
     };
   };
   kdoctools = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/kdoctools-5.85.0.tar.xz";
-      sha256 = "01bxzp65ffwr14yrrbw8p15lkwhisv15drwkgcwg48f289f51if1";
-      name = "kdoctools-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/kdoctools-5.87.0.tar.xz";
+      sha256 = "0md5wiv5mv4q63g9ads8d0xg8qxlh91dqgyg66n8abcg56qq83ps";
+      name = "kdoctools-5.87.0.tar.xz";
     };
   };
   kemoticons = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/kemoticons-5.85.0.tar.xz";
-      sha256 = "0zihi00fql8q4jp08n71agmjrpr5177yw24w0vf0lmjhgmxwkrsw";
-      name = "kemoticons-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/kemoticons-5.87.0.tar.xz";
+      sha256 = "0iah6ws0x9xnm900rii2k82gf155cbwlnxbz2rxbybp1dmbjbz5y";
+      name = "kemoticons-5.87.0.tar.xz";
     };
   };
   kfilemetadata = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/kfilemetadata-5.85.0.tar.xz";
-      sha256 = "07i52zi4jmqhm2sazw2jx7g7s3mp8c7kr32z3ikifsc5wfzy8kix";
-      name = "kfilemetadata-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/kfilemetadata-5.87.0.tar.xz";
+      sha256 = "1nh4gzprc588q8zfz94j76x3vvf77cnsc30xrs07316726mksw2i";
+      name = "kfilemetadata-5.87.0.tar.xz";
     };
   };
   kglobalaccel = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/kglobalaccel-5.85.0.tar.xz";
-      sha256 = "0f5ly344a06aaj3rcsa45xzg9xx0s2qsgk5r0h2kphkj8n2gpp70";
-      name = "kglobalaccel-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/kglobalaccel-5.87.0.tar.xz";
+      sha256 = "1wk6mxq6ylkvalcwbrkmc0whvkbllkfwnsf4hxz86cnixqb7ybjh";
+      name = "kglobalaccel-5.87.0.tar.xz";
     };
   };
   kguiaddons = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/kguiaddons-5.85.0.tar.xz";
-      sha256 = "1d1724k67chiv4sxbaifnwzwcss3kry3ms9frpxifi2nsn0x9nhc";
-      name = "kguiaddons-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/kguiaddons-5.87.0.tar.xz";
+      sha256 = "1k88x22f8db90x28fryg6cp239sfs0zrjk18l72v09bg3zc7y1lh";
+      name = "kguiaddons-5.87.0.tar.xz";
     };
   };
   kholidays = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/kholidays-5.85.0.tar.xz";
-      sha256 = "0nrxn8sjzp1lg3va7703d5hxmda33d0f91rgq2s99mxi77a82yi2";
-      name = "kholidays-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/kholidays-5.87.0.tar.xz";
+      sha256 = "1ca51vkmwwrl1fvs2fw16nvpmag2licywwmwjiaapkk8hv6v1gzm";
+      name = "kholidays-5.87.0.tar.xz";
     };
   };
   khtml = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/portingAids/khtml-5.85.0.tar.xz";
-      sha256 = "0ma9sk51pszxqmvzlrfdsnh2f8fm09wd0kaywsrkvbh2q2f6kg8g";
-      name = "khtml-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/portingAids/khtml-5.87.0.tar.xz";
+      sha256 = "1jxpznzw4r8ikx0g5n1fg0qrkllph5cwih4lcvwjn6cqx2ypgn6f";
+      name = "khtml-5.87.0.tar.xz";
     };
   };
   ki18n = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/ki18n-5.85.0.tar.xz";
-      sha256 = "1h1jcdyc3cphkn56qfn5j6jbbb6wp5z0vp8kxzm1wd023sj83dqn";
-      name = "ki18n-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/ki18n-5.87.0.tar.xz";
+      sha256 = "0395khchbhp7x4fgb2fwxlpx0mhdvbkgd0v7kwgmm0n4bkn7jphi";
+      name = "ki18n-5.87.0.tar.xz";
     };
   };
   kiconthemes = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/kiconthemes-5.85.0.tar.xz";
-      sha256 = "0k6ni351b051k8rfncpddf5zplqmg71wf9a5h8k6ix787h1r5dcp";
-      name = "kiconthemes-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/kiconthemes-5.87.0.tar.xz";
+      sha256 = "04chb3y3d6hxwy9f1xdifvl2mbcd8xbh7fv6x5m5vnb1cviwc6j7";
+      name = "kiconthemes-5.87.0.tar.xz";
     };
   };
   kidletime = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/kidletime-5.85.0.tar.xz";
-      sha256 = "1nclrxipjzasqi8g84lvpsr5rwfs9xfqgj377wfphm4qbml09x2z";
-      name = "kidletime-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/kidletime-5.87.0.tar.xz";
+      sha256 = "1m0p602i9c4dmkll3g8flmzq23ywv20rxnvzc1c8bf5kqn6321qp";
+      name = "kidletime-5.87.0.tar.xz";
     };
   };
   kimageformats = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/kimageformats-5.85.0.tar.xz";
-      sha256 = "1687sh19ph1v1bg4xrdrf0gs2nna0ds8gcqc8x7ydgdc2301m9jh";
-      name = "kimageformats-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/kimageformats-5.87.0.tar.xz";
+      sha256 = "0c4qq5j6hzz90kh7mmirafglr9l5wck3r67ij436gpmq69ignvmg";
+      name = "kimageformats-5.87.0.tar.xz";
     };
   };
   kinit = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/kinit-5.85.0.tar.xz";
-      sha256 = "03m6ik7l54q1w615111rqs0m7az7snh6x418s90xnzm81g0dzpwj";
-      name = "kinit-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/kinit-5.87.0.tar.xz";
+      sha256 = "0435syvhisagbq82qcbims5adq88ivv793gvb3kx03hxhyyx81xs";
+      name = "kinit-5.87.0.tar.xz";
     };
   };
   kio = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/kio-5.85.0.tar.xz";
-      sha256 = "1xhrmpz9xbwipxqvj7l6d1n471isb3jggrvgcx5hqlz659yqmmg4";
-      name = "kio-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/kio-5.87.0.tar.xz";
+      sha256 = "0sxwrqvfkqm679v99lx50vd2p4bx10pdzrjhxg0njfwww2fxa7mr";
+      name = "kio-5.87.0.tar.xz";
     };
   };
   kirigami2 = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/kirigami2-5.85.0.tar.xz";
-      sha256 = "0axdsxzmr735ci19srmgkgpm4x7h23vk37hhakfc6n30ry0j7lik";
-      name = "kirigami2-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/kirigami2-5.87.0.tar.xz";
+      sha256 = "1wvj0nnb1dd1k12arlmlx99gjhk7v2jpw5sgyjka6kkps31nr1zi";
+      name = "kirigami2-5.87.0.tar.xz";
     };
   };
   kitemmodels = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/kitemmodels-5.85.0.tar.xz";
-      sha256 = "0c55lw6r78x41v6fgycr68inviaxlxa6bj8zm8fdia631mhx273s";
-      name = "kitemmodels-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/kitemmodels-5.87.0.tar.xz";
+      sha256 = "1qx78pfbnwsq8nn6fa8qjjc0zn4nwh4dqs0ifb9iaam33cl3kw92";
+      name = "kitemmodels-5.87.0.tar.xz";
     };
   };
   kitemviews = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/kitemviews-5.85.0.tar.xz";
-      sha256 = "1fr8ivpvpaxykrgnjjsf8nhnhs60i4xhlkanvhrkkgjabxk0sbl0";
-      name = "kitemviews-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/kitemviews-5.87.0.tar.xz";
+      sha256 = "1nrg92nyc39fl1n7k38pa4k8dahwl76wadv0v0ixyh1zx0x4clbg";
+      name = "kitemviews-5.87.0.tar.xz";
     };
   };
   kjobwidgets = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/kjobwidgets-5.85.0.tar.xz";
-      sha256 = "05gpp2bvirbxs5yk0ysi5gh72axwv253yc2sqmzdsjylq4fjy8rl";
-      name = "kjobwidgets-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/kjobwidgets-5.87.0.tar.xz";
+      sha256 = "0s0g4dygc6c9p5w7vdk7bninizsdhj5xan351x15b4k0ddgq8sz5";
+      name = "kjobwidgets-5.87.0.tar.xz";
     };
   };
   kjs = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/portingAids/kjs-5.85.0.tar.xz";
-      sha256 = "0inliv97x63174n3mn5jqyy8d440863g3m5pn69cq1i2mr5zyswb";
-      name = "kjs-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/portingAids/kjs-5.87.0.tar.xz";
+      sha256 = "1ihwhjgk3k2nmyfg2brdjriymm2qi5dgmh47phmb9b2gvzqx6yg8";
+      name = "kjs-5.87.0.tar.xz";
     };
   };
   kjsembed = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/portingAids/kjsembed-5.85.0.tar.xz";
-      sha256 = "1j8prfg7hpk0g7manilds27ivrcgxr3hidjzy0yzn13ckvv3ccj1";
-      name = "kjsembed-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/portingAids/kjsembed-5.87.0.tar.xz";
+      sha256 = "0j8b637k8vx2qhl3zf6744ywykv6hnfcs2xgsq0i8w5ji0a2jigv";
+      name = "kjsembed-5.87.0.tar.xz";
     };
   };
   kmediaplayer = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/portingAids/kmediaplayer-5.85.0.tar.xz";
-      sha256 = "1bmj24d3si937svh8zdi7xs0y4j1ibyj8z8q1y4k2vp8fa9fack6";
-      name = "kmediaplayer-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/portingAids/kmediaplayer-5.87.0.tar.xz";
+      sha256 = "0mrmb7q4wmj8v9ipb9vh4c8scl1mr0frz3yvpc96dyimvb87pp08";
+      name = "kmediaplayer-5.87.0.tar.xz";
     };
   };
   knewstuff = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/knewstuff-5.85.0.tar.xz";
-      sha256 = "1j90ysfw1qygaiigizbjik1k7zkl6wkin0r7r9q8r3dibvbqziph";
-      name = "knewstuff-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/knewstuff-5.87.0.tar.xz";
+      sha256 = "0xnilr3r3l36g3j7a2nf2kqmill22ibrr6qfniqcywmcqpnq7x4q";
+      name = "knewstuff-5.87.0.tar.xz";
     };
   };
   knotifications = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/knotifications-5.85.0.tar.xz";
-      sha256 = "0qr695sn2di24cal0x6yj4x1a8qk6jny68r4d4xdcy5i1i4yyni5";
-      name = "knotifications-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/knotifications-5.87.0.tar.xz";
+      sha256 = "03zraci1lnzz3d5i97i2m2h4z8xp4fmm28aizk3xipqkgy3q61c3";
+      name = "knotifications-5.87.0.tar.xz";
     };
   };
   knotifyconfig = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/knotifyconfig-5.85.0.tar.xz";
-      sha256 = "1aphmi7r4zmzrfk8635a66dnkd6zg2i17nrm0hfqhqhcfn217mfv";
-      name = "knotifyconfig-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/knotifyconfig-5.87.0.tar.xz";
+      sha256 = "0jd5yzjg625ixm3fbmpafvg6wc69cvppqr0z0y0wzkbzbd930ggh";
+      name = "knotifyconfig-5.87.0.tar.xz";
     };
   };
   kpackage = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/kpackage-5.85.0.tar.xz";
-      sha256 = "14rwq5ckns06h0n8h4q2r7ilfr1myxcan1md1zz4cg4vb87ckimj";
-      name = "kpackage-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/kpackage-5.87.0.tar.xz";
+      sha256 = "1dmhj1byxmk407mcz62ydrzzjab6c4da22blkm4f5das79blkdsy";
+      name = "kpackage-5.87.0.tar.xz";
     };
   };
   kparts = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/kparts-5.85.0.tar.xz";
-      sha256 = "07px14xdh7p2kb9kvsma16xifsc65mhpm6xmnz15i5pdmrz1wxc1";
-      name = "kparts-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/kparts-5.87.0.tar.xz";
+      sha256 = "0jmjyvrskhvnp0w1d9l9k5azwf1ppda97qp2801179x77bgdfbgi";
+      name = "kparts-5.87.0.tar.xz";
     };
   };
   kpeople = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/kpeople-5.85.0.tar.xz";
-      sha256 = "03ynnbjj939b3cmczlz9piilkgh45fbyal71pab0qfpxr66m9fk5";
-      name = "kpeople-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/kpeople-5.87.0.tar.xz";
+      sha256 = "002qnfxyrzv9jr1z86ih7v7bprbpfx311s646rbmjc6c9wqa5a1a";
+      name = "kpeople-5.87.0.tar.xz";
     };
   };
   kplotting = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/kplotting-5.85.0.tar.xz";
-      sha256 = "0jhkc12fiz50iavz9msj6w29lhqrm6chl1521sx55km9cb3wmzda";
-      name = "kplotting-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/kplotting-5.87.0.tar.xz";
+      sha256 = "1np6rqrxldnhz82ak291kr87zqccmp9a3v4gvxl0xsm2qnpzxlxz";
+      name = "kplotting-5.87.0.tar.xz";
     };
   };
   kpty = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/kpty-5.85.0.tar.xz";
-      sha256 = "1zmzzlzv1pnx0d7w6v8yiccw1q2g94pfjzh4sm2k1fickgrfrir8";
-      name = "kpty-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/kpty-5.87.0.tar.xz";
+      sha256 = "1qd2lj53m0gbpmfilwrcz5v2m735daqlxj2qv1j5m28b3bjwz2li";
+      name = "kpty-5.87.0.tar.xz";
     };
   };
   kquickcharts = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/kquickcharts-5.85.0.tar.xz";
-      sha256 = "1hnbr3qkjy48pq8hkvl7lcfd8cywkkr77n8qf296rjmrv23jw4xf";
-      name = "kquickcharts-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/kquickcharts-5.87.0.tar.xz";
+      sha256 = "1dx4ilwih9pfimfn5l3fgjf0z1k75p6sb7y03akgnl4i9w2aycv8";
+      name = "kquickcharts-5.87.0.tar.xz";
     };
   };
   kross = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/portingAids/kross-5.85.0.tar.xz";
-      sha256 = "07gnh98avv5zzybh4262jqkjy8kg0cplryv356kvsbarl4ksy4kr";
-      name = "kross-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/portingAids/kross-5.87.0.tar.xz";
+      sha256 = "1nnyl67b43064y5gvj7ccvzz5481vbaycjhxxzgf4iaj0qm2vpfh";
+      name = "kross-5.87.0.tar.xz";
     };
   };
   krunner = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/krunner-5.85.0.tar.xz";
-      sha256 = "1pz466pjrqd3dj2wdqsqxcpmim0ig8i7gvnw96mxlh262cv15h4d";
-      name = "krunner-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/krunner-5.87.0.tar.xz";
+      sha256 = "0ygqfaif9xp30ahrld85xzsgmfmy51560hl8ym8shggwar20kb1s";
+      name = "krunner-5.87.0.tar.xz";
     };
   };
   kservice = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/kservice-5.85.0.tar.xz";
-      sha256 = "008b56jibgvpg6qqh7wqbg39fyca62w6nj7c9qxsgj1bd91vglg2";
-      name = "kservice-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/kservice-5.87.0.tar.xz";
+      sha256 = "0a3fcqhwbzqwy9wy1787p8hr1s1jfmz3y1dk2spiifwk9l668mxn";
+      name = "kservice-5.87.0.tar.xz";
     };
   };
   ktexteditor = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/ktexteditor-5.85.0.tar.xz";
-      sha256 = "1j6xkz8w7mb47ypgcf00m7hl1ayli8r5a3l4fk5xzsz1k0g72l6m";
-      name = "ktexteditor-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/ktexteditor-5.87.0.tar.xz";
+      sha256 = "13dnwf2zvp3k6xb0ry5a11gaf2j7x2swhq8d689w4gf3awpma7rg";
+      name = "ktexteditor-5.87.0.tar.xz";
     };
   };
   ktextwidgets = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/ktextwidgets-5.85.0.tar.xz";
-      sha256 = "128jjcay0s2qi0zs32zxwlmh2xq4kzasc0zhy3l9gfv898yaq6zy";
-      name = "ktextwidgets-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/ktextwidgets-5.87.0.tar.xz";
+      sha256 = "04gmqw8wjf6r8lpsjcsg0925a6b6hnckzy5i9ykvian1kq2d79fr";
+      name = "ktextwidgets-5.87.0.tar.xz";
     };
   };
   kunitconversion = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/kunitconversion-5.85.0.tar.xz";
-      sha256 = "0rcnmdqnm7h8ffxacza2v7y7zicly0yvz07g4857jxpk7h4z62hy";
-      name = "kunitconversion-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/kunitconversion-5.87.0.tar.xz";
+      sha256 = "1b5yvs0inr0kj7i4j5yavlxz6n8h3d2wbgw39r2harzxd4xjzz4h";
+      name = "kunitconversion-5.87.0.tar.xz";
     };
   };
   kwallet = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/kwallet-5.85.0.tar.xz";
-      sha256 = "053ddi83a5d1i61r8y6jimd5pafmilja25w5pl09g3fqkp3id677";
-      name = "kwallet-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/kwallet-5.87.0.tar.xz";
+      sha256 = "1a2qiwhf6hwh6qs9x84hz1ryaaqqm8bpg9v29kjy6cq9krn3mwar";
+      name = "kwallet-5.87.0.tar.xz";
     };
   };
   kwayland = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/kwayland-5.85.0.tar.xz";
-      sha256 = "0sfzpqb3v79jrhc49f4v3akc9wrv1976nb7xs9nd6ips237v86v2";
-      name = "kwayland-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/kwayland-5.87.0.tar.xz";
+      sha256 = "03lrlprvc3bj43f0l0dirg93l7amzlcx4ajaqh9h54g030qanfmc";
+      name = "kwayland-5.87.0.tar.xz";
     };
   };
   kwidgetsaddons = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/kwidgetsaddons-5.85.0.tar.xz";
-      sha256 = "14042vc9jl48fclsfmsincwqj2s6mfm3lbq4yg5vlj931kznyr31";
-      name = "kwidgetsaddons-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/kwidgetsaddons-5.87.0.tar.xz";
+      sha256 = "00gv9lxiah6yg8lxjd0md0zyvhi7zc9s6fg14jfh0cb1i0zrn49b";
+      name = "kwidgetsaddons-5.87.0.tar.xz";
     };
   };
   kwindowsystem = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/kwindowsystem-5.85.0.tar.xz";
-      sha256 = "07k6d6sgxlfwkjg0r9lgvlkd7j53b986qfv283c313ahy5c3gd3d";
-      name = "kwindowsystem-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/kwindowsystem-5.87.0.tar.xz";
+      sha256 = "0rxmpawp5g46xp5irk1gcdq6n2y9r9vlx1dm5gpqhcfh7gr64ja2";
+      name = "kwindowsystem-5.87.0.tar.xz";
     };
   };
   kxmlgui = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/kxmlgui-5.85.0.tar.xz";
-      sha256 = "1ciwrm16a5cgmkkm8cv72cyr45q418gsrxc3qrjq3iic9ycf6fi5";
-      name = "kxmlgui-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/kxmlgui-5.87.0.tar.xz";
+      sha256 = "1wnss0rjspgih3m2a3faflamf7n681k8sf8pzrcsrvvrzq95n65i";
+      name = "kxmlgui-5.87.0.tar.xz";
     };
   };
   kxmlrpcclient = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/portingAids/kxmlrpcclient-5.85.0.tar.xz";
-      sha256 = "117cvdf7iy1139sx0vk906whmkm3ffw0wivqdjdcfwxsdxi6s6d1";
-      name = "kxmlrpcclient-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/portingAids/kxmlrpcclient-5.87.0.tar.xz";
+      sha256 = "03l5zs4l52f3w01hsk00r8hmnccyy3iw2vhiclvpp6dksmb8yad7";
+      name = "kxmlrpcclient-5.87.0.tar.xz";
     };
   };
   modemmanager-qt = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/modemmanager-qt-5.85.0.tar.xz";
-      sha256 = "1jb27266dc6ry2y3w9bf1sf20xxw2rkb6ac8z9p46r0myhj2zn2j";
-      name = "modemmanager-qt-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/modemmanager-qt-5.87.0.tar.xz";
+      sha256 = "1ag98r2hhd93gki3dvlz48sgqc2805b0p0w4m0az0czvxnclg0rk";
+      name = "modemmanager-qt-5.87.0.tar.xz";
     };
   };
   networkmanager-qt = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/networkmanager-qt-5.85.0.tar.xz";
-      sha256 = "1lg17ibk9mn4jsxh6dl0yzyhy26xifymvrf5saggl28vkkhvnh6r";
-      name = "networkmanager-qt-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/networkmanager-qt-5.87.0.tar.xz";
+      sha256 = "0a4sxcm88mfry1sjc4r0qx5aqmbb61ghmd912wqk19nx18qgkm5y";
+      name = "networkmanager-qt-5.87.0.tar.xz";
     };
   };
   oxygen-icons5 = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/oxygen-icons5-5.85.0.tar.xz";
-      sha256 = "0if136n5mkvxhiyvlmwmj3q9y1g1gr9qz4qqdcsn6wy9jippq46g";
-      name = "oxygen-icons5-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/oxygen-icons5-5.87.0.tar.xz";
+      sha256 = "0mpxv2m6nkl1cp3p0xgpm916k2ykvkyk0x0ka4azs8iyy0anc36m";
+      name = "oxygen-icons5-5.87.0.tar.xz";
     };
   };
   plasma-framework = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/plasma-framework-5.85.0.tar.xz";
-      sha256 = "1zzqmm7s39bcay3b4f6qzhd5pw3q6p9fas94i88afhqsxjbkm6w7";
-      name = "plasma-framework-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/plasma-framework-5.87.0.tar.xz";
+      sha256 = "1y7w4b7jb8rnkfan97yln5w9w68skrmif4wqqba4f9mj6y2dcajb";
+      name = "plasma-framework-5.87.0.tar.xz";
     };
   };
   prison = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/prison-5.85.0.tar.xz";
-      sha256 = "1c6dq4ql3n6s9xwvs6ix8n3fsv96aqdvd0qwc1n4sap9xlg3752n";
-      name = "prison-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/prison-5.87.0.tar.xz";
+      sha256 = "0vb8ny4za37v4nmcy9qw8zz5zcr46clci9lg22s84f26l4vlcs87";
+      name = "prison-5.87.0.tar.xz";
     };
   };
   purpose = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/purpose-5.85.0.tar.xz";
-      sha256 = "13r47g81qfqdvd0s70r9dwlcdg8c6m5xrnpvypjs6cd51907m0f5";
-      name = "purpose-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/purpose-5.87.0.tar.xz";
+      sha256 = "0ddpm2hm3x1p25hkjzff4vs906n5bkkk4j3myh0gvyqn8accdhsd";
+      name = "purpose-5.87.0.tar.xz";
     };
   };
   qqc2-desktop-style = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/qqc2-desktop-style-5.85.0.tar.xz";
-      sha256 = "1hkcy3dzaqfkxnmj9k278q0dijiwhjmzw98xxj9fh8mjygwkj1dp";
-      name = "qqc2-desktop-style-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/qqc2-desktop-style-5.87.0.tar.xz";
+      sha256 = "02i4rg5gf7i63lm4f0afm9n3lgzvklpbg43d0zcsdwzph386baq7";
+      name = "qqc2-desktop-style-5.87.0.tar.xz";
     };
   };
   solid = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/solid-5.85.0.tar.xz";
-      sha256 = "0gcddgrz07j9dgf4fg9hc810zr8f3az9b0qvxax9ys9x5kg1dr57";
-      name = "solid-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/solid-5.87.0.tar.xz";
+      sha256 = "0zmcc4ryp4j93999f0fgwvchs4gycbynsz0wghrhdqkfhsjvhqra";
+      name = "solid-5.87.0.tar.xz";
     };
   };
   sonnet = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/sonnet-5.85.0.tar.xz";
-      sha256 = "1cg2f09c0blk7ymlq7j3a1bci78kv1n0xq3ys4kxgf53khwhdqpw";
-      name = "sonnet-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/sonnet-5.87.0.tar.xz";
+      sha256 = "1cc9j9ks33s6amr01a7ywnqiqvm498vlmqqva40ddvkfq1azxmhs";
+      name = "sonnet-5.87.0.tar.xz";
     };
   };
   syndication = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/syndication-5.85.0.tar.xz";
-      sha256 = "05hvzxzlvdzc2sxapjvqhdycdvn6bnq0hs45c88pb13ncxxljdxh";
-      name = "syndication-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/syndication-5.87.0.tar.xz";
+      sha256 = "1xbs83smgqzk01r7nds6p74v9n1pa0zhlafbbxlj2m226p1zf8bs";
+      name = "syndication-5.87.0.tar.xz";
     };
   };
   syntax-highlighting = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/syntax-highlighting-5.85.0.tar.xz";
-      sha256 = "1qn9n2sv9n22j7bhq4n93i985v244kkg0vi5c33s9zppb4xgd34a";
-      name = "syntax-highlighting-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/syntax-highlighting-5.87.0.tar.xz";
+      sha256 = "148wm3qdjkwzvcm51x3cppsxl4rylbjyjp1pfh6545fhikm5nqi6";
+      name = "syntax-highlighting-5.87.0.tar.xz";
     };
   };
   threadweaver = {
-    version = "5.85.0";
+    version = "5.87.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.85/threadweaver-5.85.0.tar.xz";
-      sha256 = "0md5bnkn5bh2jqzj7m444bmn5c7davyhwlffi0pg22r01m44l6s3";
-      name = "threadweaver-5.85.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.87/threadweaver-5.87.0.tar.xz";
+      sha256 = "1gqpzv2ijw66fpvaqv66xsglh19lv0k4j9i505xmmkzlyddbhkch";
+      name = "threadweaver-5.87.0.tar.xz";
     };
   };
 }
diff --git a/pkgs/development/libraries/libaom/default.nix b/pkgs/development/libraries/libaom/default.nix
index 9a8ac1be95fe..62415ea1335e 100644
--- a/pkgs/development/libraries/libaom/default.nix
+++ b/pkgs/development/libraries/libaom/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libaom";
-  version = "3.1.2";
+  version = "3.1.3";
 
   src = fetchzip {
     url = "https://aomedia.googlesource.com/aom/+archive/v${version}.tar.gz";
-    sha256 = "1c7yrhb56qj5c3lz54n1f9cbrvdr32g2yrrdiiy72sib8ycq9hz2";
+    sha256 = "08rk31d2cp9k9nj37s6a4n7klpfqfbj62anwyiggzsz7b68psjq3";
     stripRoot = false;
   };
 
diff --git a/pkgs/development/libraries/libaom/outputs.patch b/pkgs/development/libraries/libaom/outputs.patch
index 7c0ff397dfee..bbf660aaa5c9 100644
--- a/pkgs/development/libraries/libaom/outputs.patch
+++ b/pkgs/development/libraries/libaom/outputs.patch
@@ -1,37 +1,55 @@
+diff --git a/build/cmake/aom_install.cmake b/build/cmake/aom_install.cmake
+index 0bd2bf035..5cf5acea8 100644
 --- a/build/cmake/aom_install.cmake
 +++ b/build/cmake/aom_install.cmake
-@@ -45,2 +45,2 @@ macro(setup_aom_install_targets)
+@@ -42,8 +42,8 @@ macro(setup_aom_install_targets)
+               -DAOM_ROOT=${AOM_ROOT}
+               -DCMAKE_INSTALL_PREFIX=${CMAKE_INSTALL_PREFIX}
+               -DCMAKE_INSTALL_BINDIR=${CMAKE_INSTALL_BINDIR}
 -              -DCMAKE_INSTALL_INCLUDEDIR=${CMAKE_INSTALL_INCLUDEDIR}
 -              -DCMAKE_INSTALL_LIBDIR=${CMAKE_INSTALL_LIBDIR}
 +              -DCMAKE_INSTALL_FULL_INCLUDEDIR=${CMAKE_INSTALL_FULL_INCLUDEDIR}
 +              -DCMAKE_INSTALL_FULL_LIBDIR=${CMAKE_INSTALL_FULL_LIBDIR}
-@@ -82,14 +82,14 @@ macro(setup_aom_install_targets)
-     install(
-       FILES ${AOM_INSTALL_INCS}
--      DESTINATION "${CMAKE_INSTALL_PREFIX}/${CMAKE_INSTALL_INCLUDEDIR}/aom")
-+      DESTINATION "${CMAKE_INSTALL_FULL_INCLUDEDIR}/aom")
-     install(
-       FILES "${AOM_PKG_CONFIG_FILE}"
--      DESTINATION "${CMAKE_INSTALL_PREFIX}/${CMAKE_INSTALL_LIBDIR}/pkgconfig")
-+      DESTINATION "${CMAKE_INSTALL_FULL_LIBDIR}/pkgconfig")
-     install(TARGETS ${AOM_INSTALL_LIBS} DESTINATION
--                    "${CMAKE_INSTALL_PREFIX}/${CMAKE_INSTALL_LIBDIR}")
-+                    "${CMAKE_INSTALL_FULL_LIBDIR}")
- 
-     if(ENABLE_EXAMPLES)
-       install(TARGETS ${AOM_INSTALL_BINS} DESTINATION
--                      "${CMAKE_INSTALL_PREFIX}/${CMAKE_INSTALL_BINDIR}")
-+                      "${CMAKE_INSTALL_FULL_BINDIR}")
-     endif()
+               -DCMAKE_PROJECT_NAME=${CMAKE_PROJECT_NAME}
+               -DCONFIG_MULTITHREAD=${CONFIG_MULTITHREAD}
+               -DCONFIG_TUNE_VMAF=${CONFIG_TUNE_VMAF}
+@@ -84,12 +84,12 @@ macro(setup_aom_install_targets)
+     # Setup the install rules. install() will automatically prepend
+     # CMAKE_INSTALL_PREFIX to relative paths
+     install(FILES ${AOM_INSTALL_INCS}
+-            DESTINATION "${CMAKE_INSTALL_INCLUDEDIR}/aom")
++            DESTINATION "${CMAKE_INSTALL_FULL_INCLUDEDIR}/aom")
+     install(FILES "${AOM_PKG_CONFIG_FILE}"
+-            DESTINATION "${CMAKE_INSTALL_LIBDIR}/pkgconfig")
++            DESTINATION "${CMAKE_INSTALL_FULL_LIBDIR}/pkgconfig")
+     install(TARGETS ${AOM_INSTALL_LIBS};${AOM_INSTALL_BINS}
+-            RUNTIME DESTINATION "${CMAKE_INSTALL_BINDIR}"
+-            LIBRARY DESTINATION "${CMAKE_INSTALL_LIBDIR}"
+-            ARCHIVE DESTINATION "${CMAKE_INSTALL_LIBDIR}")
++            RUNTIME DESTINATION "${CMAKE_INSTALL_FULL_BINDIR}"
++            LIBRARY DESTINATION "${CMAKE_INSTALL_FULL_LIBDIR}"
++            ARCHIVE DESTINATION "${CMAKE_INSTALL_FULL_LIBDIR}")
    endif()
+ endmacro()
+diff --git a/build/cmake/pkg_config.cmake b/build/cmake/pkg_config.cmake
+index e8fff2e77..b8a73aad4 100644
 --- a/build/cmake/pkg_config.cmake
 +++ b/build/cmake/pkg_config.cmake
-@@ -14,2 +14,2 @@
+@@ -11,8 +11,8 @@
+ cmake_minimum_required(VERSION 3.5)
+ 
+ set(REQUIRED_ARGS "AOM_ROOT" "AOM_CONFIG_DIR" "CMAKE_INSTALL_PREFIX"
 -                  "CMAKE_INSTALL_BINDIR" "CMAKE_INSTALL_INCLUDEDIR"
 -                  "CMAKE_INSTALL_LIBDIR" "CMAKE_PROJECT_NAME"
 +                  "CMAKE_INSTALL_BINDIR" "CMAKE_INSTALL_FULL_INCLUDEDIR"
 +                  "CMAKE_INSTALL_FULL_LIBDIR" "CMAKE_PROJECT_NAME"
-@@ -38,4 +38,4 @@ endif()
+                   "CONFIG_MULTITHREAD" "HAVE_PTHREAD_H")
+ 
+ foreach(arg ${REQUIRED_ARGS})
+@@ -35,15 +35,15 @@ else()
+ endif()
+ 
+ # Write pkg-config info.
 -set(prefix "${CMAKE_INSTALL_PREFIX}")
 -set(bindir "${CMAKE_INSTALL_BINDIR}")
 -set(includedir "${CMAKE_INSTALL_INCLUDEDIR}")
@@ -40,6 +58,12 @@
 +get_filename_component(exec_prefix "${CMAKE_INSTALL_FULL_LIBDIR}" DIRECTORY)
 +get_filename_component(includedir "${CMAKE_INSTALL_FULL_INCLUDEDIR}" NAME)
 +get_filename_component(libdir "${CMAKE_INSTALL_FULL_LIBDIR}" NAME)
-@@ -46 +46 @@ file(APPEND "${pkgconfig_file}" "prefix=${prefix}\n")
+ set(pkgconfig_file "${AOM_CONFIG_DIR}/aom.pc")
+ string(TOLOWER ${CMAKE_PROJECT_NAME} pkg_name)
+ file(WRITE "${pkgconfig_file}" "# libaom pkg-config.\n")
+ file(APPEND "${pkgconfig_file}" "prefix=${prefix}\n")
 -file(APPEND "${pkgconfig_file}" "exec_prefix=\${prefix}\n")
 +file(APPEND "${pkgconfig_file}" "exec_prefix=${exec_prefix}\n")
+ file(APPEND "${pkgconfig_file}" "includedir=\${prefix}/${includedir}\n")
+ file(APPEND "${pkgconfig_file}" "libdir=\${exec_prefix}/${libdir}\n\n")
+ file(APPEND "${pkgconfig_file}" "Name: ${pkg_name}\n")
diff --git a/pkgs/development/libraries/libass/default.nix b/pkgs/development/libraries/libass/default.nix
index afc99220534f..19f6589ec950 100644
--- a/pkgs/development/libraries/libass/default.nix
+++ b/pkgs/development/libraries/libass/default.nix
@@ -15,11 +15,11 @@ in
 with lib;
 stdenv.mkDerivation rec {
   pname = "libass";
-  version = "0.15.1";
+  version = "0.15.2";
 
   src = fetchurl {
     url = "https://github.com/libass/libass/releases/download/${version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-HN05ydAHsG5zfnc4AE1/OM+bHpKEPzcweyTn/2OrjlM=";
+    sha256 = "sha256-G+LfnESFpX14uxjAqO0Ve8h6Wo3UjGYZYcYlyxEoMv0=";
   };
 
   configureFlags = [
diff --git a/pkgs/development/libraries/libdeflate/default.nix b/pkgs/development/libraries/libdeflate/default.nix
index d7a4aa91fb54..3fb89091aa0d 100644
--- a/pkgs/development/libraries/libdeflate/default.nix
+++ b/pkgs/development/libraries/libdeflate/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libdeflate";
-  version = "1.7";
+  version = "1.8";
 
   src = fetchFromGitHub {
     owner = "ebiggers";
     repo = "libdeflate";
     rev = "v${version}";
-    sha256 = "1hnn1yd9s5h92xs72y73izak47kdz070kxkw3kyz2d3az6brfdgh";
+    sha256 = "sha256-P7YbuhP2/zJCpE9dxZev1yy5oda8WKAHY84ZLTL8gVs=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/libraries/libfido2/default.nix b/pkgs/development/libraries/libfido2/default.nix
index 64c16e92c44b..62a72175b8ee 100644
--- a/pkgs/development/libraries/libfido2/default.nix
+++ b/pkgs/development/libraries/libfido2/default.nix
@@ -1,7 +1,6 @@
 { lib
 , stdenv
 , fetchurl
-, fetchpatch
 , cmake
 , pkg-config
 , hidapi
@@ -13,24 +12,14 @@
 
 stdenv.mkDerivation rec {
   pname = "libfido2";
-  version = "1.7.0";
+  version = "1.8.0";
 
   # releases on https://developers.yubico.com/libfido2/Releases/ are signed
   src = fetchurl {
     url = "https://developers.yubico.com/${pname}/Releases/${pname}-${version}.tar.gz";
-    sha256 = "13khkp2q8g447797l09p83qxy0z8vgmzr54l8dcnapy9lsr4jrqi";
+    sha256 = "07gxyy5yzgfh5hg7q9fr77z5mkj0xjvd5ya7p5f5kar4iwc92hjm";
   };
 
-  patches = [
-    # fix log truncation
-    # https://github.com/Yubico/libfido2/issues/318
-    # https://github.com/Yubico/libfido2/pull/319
-    (fetchpatch {
-      url = "https://github.com/Yubico/libfido2/commit/8edb9a204b2f4aeb487e282908c3187f1d02d606.patch";
-      sha256 = "1i360bghwbdccgkzjfzvhilscnwsj9lhfiviy000n928698l4wan";
-    })
-  ];
-
   nativeBuildInputs = [ cmake pkg-config ];
 
   buildInputs = [ libcbor openssl zlib ]
diff --git a/pkgs/development/libraries/libfive/default.nix b/pkgs/development/libraries/libfive/default.nix
index 3833a7fe880a..8634f05ebbc7 100644
--- a/pkgs/development/libraries/libfive/default.nix
+++ b/pkgs/development/libraries/libfive/default.nix
@@ -36,8 +36,6 @@ mkDerivation {
       -change libfive.dylib $out/lib/libfive.dylib \
       -change libfive-guile.dylib $out/lib/libfive-guile.dylib \
       $out/Applications/Studio.app/Contents/MacOS/Studio
-
-    wrapQtApp $out/Applications/Studio.app/Contents/MacOS/Studio
   '' else ''
     # Link "Studio" binary to "libfive-studio" to be more obvious:
     ln -s "$out/bin/Studio" "$out/bin/libfive-studio"
diff --git a/pkgs/development/libraries/libinput/default.nix b/pkgs/development/libraries/libinput/default.nix
index 375154ea46ad..baee67cb826d 100644
--- a/pkgs/development/libraries/libinput/default.nix
+++ b/pkgs/development/libraries/libinput/default.nix
@@ -22,11 +22,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "libinput";
-  version = "1.18.1";
+  version = "1.19.1";
 
   src = fetchurl {
     url = "https://www.freedesktop.org/software/libinput/libinput-${version}.tar.xz";
-    sha256 = "1jx7y48ym89grjz67jmn80h5j8c36qgwb0h5c703nln2zchl18cw";
+    sha256 = "sha256-C9z1sXg7c3hUt68coi32e8Nqb+fJz6cfAekUn5IgRG0=";
   };
 
   outputs = [ "bin" "out" "dev" ];
diff --git a/pkgs/development/libraries/libksba/default.nix b/pkgs/development/libraries/libksba/default.nix
index d8aabb11755d..63c0ed63bae4 100644
--- a/pkgs/development/libraries/libksba/default.nix
+++ b/pkgs/development/libraries/libksba/default.nix
@@ -1,10 +1,11 @@
 { buildPackages, lib, stdenv, fetchurl, gettext, libgpg-error }:
 
 stdenv.mkDerivation rec {
-  name = "libksba-1.5.1";
+  pname = "libksba";
+  version = "1.5.1";
 
   src = fetchurl {
-    url = "mirror://gnupg/libksba/${name}.tar.bz2";
+    url = "mirror://gnupg/libksba/libksba-${version}.tar.bz2";
     sha256 = "sha256-sPTGXk5EfZojSfa4wOd6KL6VMeRUi6AsVF0fRtx7+SE=";
   };
 
@@ -26,6 +27,7 @@ stdenv.mkDerivation rec {
     homepage = "https://www.gnupg.org";
     description = "CMS and X.509 access library";
     platforms = platforms.all;
+    maintainers = with maintainers; [ ];
     license = licenses.lgpl3;
   };
 }
diff --git a/pkgs/development/libraries/libqmi/default.nix b/pkgs/development/libraries/libqmi/default.nix
index 196b9d3ad521..c3c9bf6947eb 100644
--- a/pkgs/development/libraries/libqmi/default.nix
+++ b/pkgs/development/libraries/libqmi/default.nix
@@ -15,13 +15,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libqmi";
-  version = "1.28.8";
+  version = "1.30.2";
 
   outputs = [ "out" "dev" "devdoc" ];
 
   src = fetchurl {
     url = "https://www.freedesktop.org/software/libqmi/${pname}-${version}.tar.xz";
-    sha256 = "sha256-bju70gC8G2SyP2JU/vkhLyaZ7HfPsyB10rpQecc6n3g=";
+    sha256 = "sha256-vgHs4OosIZTL6ldEv1qvBsBLpft+x4h6ExFsdtEU/t0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/librsvg/default.nix b/pkgs/development/libraries/librsvg/default.nix
index 03bd2eb96bc6..3abcdb1ee8c4 100644
--- a/pkgs/development/libraries/librsvg/default.nix
+++ b/pkgs/development/libraries/librsvg/default.nix
@@ -12,10 +12,12 @@
 , ApplicationServices
 , Foundation
 , libobjc
+, rustPlatform
 , rustc
 , cargo
 , gnome
 , vala
+, withIntrospection ? stdenv.hostPlatform == stdenv.buildPlatform
 , gobject-introspection
 , nixosTests
 }:
@@ -31,11 +33,20 @@ stdenv.mkDerivation rec {
     sha256 = "14zkdd7a9mymnfs3laqj0gr69c16nwixvbc5a4gvd534w6riz0mx";
   };
 
+  cargoVendorDir = "vendor";
+
+  strictDeps = true;
+
+  depsBuildBuild = [ pkg-config ];
+
   nativeBuildInputs = [
+    gdk-pixbuf
     pkg-config
     rustc
     cargo
     vala
+    rustPlatform.cargoSetupHook
+  ] ++ lib.optionals withIntrospection [
     gobject-introspection
   ] ++ lib.optionals stdenv.isDarwin [
     ApplicationServices
@@ -47,6 +58,8 @@ stdenv.mkDerivation rec {
     bzip2
     pango
     libintl
+  ] ++ lib.optionals withIntrospection [
+    gobject-introspection
   ] ++ lib.optionals stdenv.isDarwin [
     libobjc
   ];
@@ -58,12 +71,12 @@ stdenv.mkDerivation rec {
   ];
 
   configureFlags = [
-    "--enable-introspection"
-  ] ++ lib.optionals (!stdenv.isDarwin) [
+    (lib.enableFeature withIntrospection "introspection")
+
     # Vapi does not build on MacOS.
     # https://github.com/NixOS/nixpkgs/pull/117081#issuecomment-827782004
-    "--enable-vala"
-  ] ++ [
+    (lib.enableFeature (withIntrospection && !stdenv.isDarwin) "vala")
+
     "--enable-installed-tests"
     "--enable-always-build-tests"
   ] ++ lib.optional stdenv.isDarwin "--disable-Bsymbolic";
@@ -95,11 +108,11 @@ stdenv.mkDerivation rec {
         -i gdk-pixbuf-loader/librsvg.thumbnailer.in
   '';
 
-  # Merge gdkpixbuf and librsvg loaders
-  postInstall = ''
-    mv $GDK_PIXBUF/loaders.cache $GDK_PIXBUF/loaders.cache.tmp
-    cat ${gdk-pixbuf.out}/lib/gdk-pixbuf-2.0/2.10.0/loaders.cache $GDK_PIXBUF/loaders.cache.tmp > $GDK_PIXBUF/loaders.cache
-    rm $GDK_PIXBUF/loaders.cache.tmp
+  # Not generated when cross compiling.
+  postInstall = lib.optionalString (stdenv.hostPlatform == stdenv.buildPlatform) ''
+    # Merge gdkpixbuf and librsvg loaders
+    cat ${lib.getLib gdk-pixbuf}/lib/gdk-pixbuf-2.0/2.10.0/loaders.cache $GDK_PIXBUF/loaders.cache > $GDK_PIXBUF/loaders.cache.tmp
+    mv $GDK_PIXBUF/loaders.cache.tmp $GDK_PIXBUF/loaders.cache
   '';
 
   passthru = {
diff --git a/pkgs/development/libraries/libvirt/5.9.0.nix b/pkgs/development/libraries/libvirt/5.9.0.nix
index c8ad0e7e6030..f7a393e8fda9 100644
--- a/pkgs/development/libraries/libvirt/5.9.0.nix
+++ b/pkgs/development/libraries/libvirt/5.9.0.nix
@@ -2,7 +2,7 @@
 , pkg-config, makeWrapper, libtool, autoconf, automake, fetchpatch
 , coreutils, libxml2, gnutls, perl, python2, attr
 , iproute2, iptables, readline, lvm2, util-linux, systemd, libpciaccess, gettext
-, libtasn1, ebtables, libgcrypt, yajl, pmutils, libcap_ng, libapparmor
+, libtasn1, libgcrypt, yajl, pmutils, libcap_ng, libapparmor
 , dnsmasq, libnl, libpcap, libxslt, xhtml1, numad, numactl, perlPackages
 , curl, libiconv, gmp, zfs, parted, bridge-utils, dmidecode, glib, rpcsvc-proto, libtirpc
 , enableXen ? false, xen ? null
@@ -54,7 +54,7 @@ in stdenv.mkDerivation rec {
 
   preConfigure = ''
     ${ optionalString (!buildFromTarball) "./bootstrap --no-git --gnulib-srcdir=$(pwd)/.gnulib" }
-    PATH=${lib.makeBinPath ([ dnsmasq ] ++ optionals stdenv.isLinux [ iproute2 iptables ebtables lvm2 systemd numad ] ++ optionals enableIscsi [ openiscsi ])}:$PATH
+    PATH=${lib.makeBinPath ([ dnsmasq ] ++ optionals stdenv.isLinux [ iproute2 iptables lvm2 systemd numad ] ++ optionals enableIscsi [ openiscsi ])}:$PATH
     # the path to qemu-kvm will be stored in VM's .xml and .save files
     # do not use "''${qemu_kvm}/bin/qemu-kvm" to avoid bound VMs to particular qemu derivations
     substituteInPlace src/lxc/lxc_conf.c \
@@ -75,7 +75,6 @@ in stdenv.mkDerivation rec {
   ] ++ optionals stdenv.isLinux [
     "QEMU_BRIDGE_HELPER=/run/wrappers/bin/qemu-bridge-helper"
     "QEMU_PR_HELPER=/run/libvirt/nix-helpers/qemu-pr-helper"
-    "EBTABLES_PATH=${ebtables}/bin/ebtables-legacy"
     "CFLAGS=-I${libtirpc.dev}/include/tirpc"
     "--with-attr"
     "--with-apparmor"
@@ -101,7 +100,7 @@ in stdenv.mkDerivation rec {
 
 
   postInstall = let
-    binPath = [ iptables iproute2 pmutils numad numactl bridge-utils dmidecode dnsmasq ebtables ] ++ optionals enableIscsi [ openiscsi ];
+    binPath = [ iptables iproute2 pmutils numad numactl bridge-utils dmidecode dnsmasq ] ++ optionals enableIscsi [ openiscsi ];
   in ''
     substituteInPlace $out/libexec/libvirt-guests.sh \
       --replace 'ON_BOOT=start'       'ON_BOOT=''${ON_BOOT:-start}' \
diff --git a/pkgs/development/libraries/libvirt/default.nix b/pkgs/development/libraries/libvirt/default.nix
index dca856dbb571..27b69ef1bb0b 100644
--- a/pkgs/development/libraries/libvirt/default.nix
+++ b/pkgs/development/libraries/libvirt/default.nix
@@ -22,7 +22,6 @@
 , gettext
 , libtasn1
 , iptables
-, ebtables
 , libgcrypt
 , yajl
 , pmutils
@@ -68,19 +67,6 @@ with lib;
 # if you update, also bump <nixpkgs/pkgs/development/python-modules/libvirt/default.nix> and SysVirt in <nixpkgs/pkgs/top-level/perl-packages.nix>
 let
   buildFromTarball = stdenv.isDarwin;
-  # libvirt hardcodes the binary name 'ebtables', but in nixpkgs the ebtables
-  # binary we want to use is named 'ebtables-legacy'.
-  # Create a derivation to alias the binary name so that libvirt can find the right one, and use that below.
-  ebtables-compat = stdenv.mkDerivation {
-    pname = "ebtables-compat";
-    version = ebtables.version;
-    src = null;
-    buildInputs = [ ebtables ];
-    buildCommand = ''
-      mkdir -p $out/bin
-      ln -sf ${ebtables}/bin/ebtables-legacy $out/bin/ebtables
-    '';
-  };
 in
 stdenv.mkDerivation rec {
   pname = "libvirt";
@@ -178,7 +164,7 @@ stdenv.mkDerivation rec {
       '';
     in
     ''
-      PATH=${lib.makeBinPath ([ dnsmasq ] ++ optionals stdenv.isLinux [ iproute2 iptables ebtables-compat lvm2 systemd numad ] ++ optionals enableIscsi [ openiscsi ])}:$PATH
+      PATH=${lib.makeBinPath ([ dnsmasq ] ++ optionals stdenv.isLinux [ iproute2 iptables lvm2 systemd numad ] ++ optionals enableIscsi [ openiscsi ])}:$PATH
       # the path to qemu-kvm will be stored in VM's .xml and .save files
       # do not use "''${qemu_kvm}/bin/qemu-kvm" to avoid bound VMs to particular qemu derivations
       substituteInPlace src/lxc/lxc_conf.c \
@@ -226,8 +212,7 @@ stdenv.mkDerivation rec {
 
   postInstall =
     let
-      # Keep the legacy iptables binary for now for backwards compatibility (comment on #109332)
-      binPath = [ iptables ebtables-compat iproute2 pmutils numad numactl bridge-utils dmidecode dnsmasq ] ++ optionals enableIscsi [ openiscsi ];
+      binPath = [ iptables iproute2 pmutils numad numactl bridge-utils dmidecode dnsmasq ] ++ optionals enableIscsi [ openiscsi ];
     in
     ''
         substituteInPlace $out/libexec/libvirt-guests.sh \
diff --git a/pkgs/development/libraries/libxml2/default.nix b/pkgs/development/libraries/libxml2/default.nix
index c98a1cbce0e9..bc11c9cfea1f 100644
--- a/pkgs/development/libraries/libxml2/default.nix
+++ b/pkgs/development/libraries/libxml2/default.nix
@@ -1,5 +1,6 @@
 { stdenv, lib, fetchurl, fetchpatch
 , zlib, xz, libintl, python, gettext, ncurses, findXMLCatalogs
+, libiconv
 , pythonSupport ? enableShared && stdenv.buildPlatform == stdenv.hostPlatform
 , icuSupport ? false, icu ? null
 , enableShared ? stdenv.hostPlatform.libc != "msvcrt" && !stdenv.hostPlatform.isStatic
@@ -52,7 +53,9 @@ stdenv.mkDerivation rec {
     # RUNPATH for that, leading to undefined references for its users.
     ++ lib.optional stdenv.isFreeBSD xz;
 
-  propagatedBuildInputs = [ zlib findXMLCatalogs ] ++ lib.optional icuSupport icu;
+  propagatedBuildInputs = [ zlib findXMLCatalogs ]
+    ++ lib.optional stdenv.isDarwin libiconv
+    ++ lib.optional icuSupport icu;
 
   configureFlags = [
     "--exec_prefix=$dev"
diff --git a/pkgs/development/libraries/mesa/default.nix b/pkgs/development/libraries/mesa/default.nix
index 1d7b73a54196..035ff3b6e9c3 100644
--- a/pkgs/development/libraries/mesa/default.nix
+++ b/pkgs/development/libraries/mesa/default.nix
@@ -93,6 +93,10 @@ self = stdenv.mkDerivation {
     ++ lib.optional stdenv.isLinux "driversdev"
     ++ lib.optional enableOpenCL "opencl";
 
+  preConfigure = ''
+    PATH=${llvmPackages.libllvm.dev}/bin:$PATH
+  '';
+
   # TODO: Figure out how to enable opencl without having a runtime dependency on clang
   mesonFlags = [
     "--sysconfdir=/etc"
diff --git a/pkgs/development/libraries/nss/default.nix b/pkgs/development/libraries/nss/default.nix
index c1b90a8da873..9d85515e2faf 100644
--- a/pkgs/development/libraries/nss/default.nix
+++ b/pkgs/development/libraries/nss/default.nix
@@ -27,7 +27,7 @@ let
   #       It will rebuild itself using the version of this package (NSS) and if
   #       an update is required do the required changes to the expression.
   #       Example: nix-shell ./maintainers/scripts/update.nix --argstr package cacert
-  version = "3.70";
+  version = "3.71";
 
 in
 stdenv.mkDerivation rec {
@@ -36,7 +36,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://mozilla/security/nss/releases/NSS_${lib.replaceStrings [ "." ] [ "_" ] version}_RTM/src/${pname}-${version}.tar.gz";
-    sha256 = "sha256-K4mruGAe5AW+isW1cD1x8fs4pRw6ZKPYNDh/eLMlURs=";
+    sha256 = "0ly2l3dv6z5hlxs72h5x6796ni3x1bq60saavaf42ddgv4ax7b4r";
   };
 
   depsBuildBuild = [ buildPackages.stdenv.cc ];
diff --git a/pkgs/development/libraries/p11-kit/default.nix b/pkgs/development/libraries/p11-kit/default.nix
index 681b60e16de4..4ddc01ee6b2b 100644
--- a/pkgs/development/libraries/p11-kit/default.nix
+++ b/pkgs/development/libraries/p11-kit/default.nix
@@ -31,7 +31,7 @@ stdenv.mkDerivation rec {
   configureFlags = [
     "--sysconfdir=/etc"
     "--localstatedir=/var"
-    "--with-trust-paths=/etc/ssl/certs/ca-certificates.crt"
+    "--with-trust-paths=/etc/ssl/trust-source:/etc/ssl/certs/ca-certificates.crt"
   ];
 
   enableParallelBuilding = true;
diff --git a/pkgs/development/libraries/plasma-wayland-protocols/default.nix b/pkgs/development/libraries/plasma-wayland-protocols/default.nix
index fff25d5bb44f..0523b4601146 100644
--- a/pkgs/development/libraries/plasma-wayland-protocols/default.nix
+++ b/pkgs/development/libraries/plasma-wayland-protocols/default.nix
@@ -5,11 +5,11 @@
 
 mkDerivation rec {
   pname = "plasma-wayland-protocols";
-  version = "1.3.0";
+  version = "1.4.0";
 
   src = fetchurl {
     url = "mirror://kde/stable/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-DaojYvLg0V954OAG6NfxkI6I43tcUgi0DJyw1NbcqbU=";
+    sha256 = "sha256-OLBDHZMagzk3cKu4KUIGk2tjuJzu4/DGPw8Ibz0rG6k=";
   };
 
   nativeBuildInputs = [ extra-cmake-modules ];
diff --git a/pkgs/development/libraries/qt-5/5.15/default.nix b/pkgs/development/libraries/qt-5/5.15/default.nix
index 10d0d49236aa..a1d5be70c012 100644
--- a/pkgs/development/libraries/qt-5/5.15/default.nix
+++ b/pkgs/development/libraries/qt-5/5.15/default.nix
@@ -112,6 +112,11 @@ let
         url = "https://codereview.qt-project.org/gitweb?p=qt/qtbase.git;a=patch;h=049e14870c13235cd066758f29c42dc96c1ccdf8";
         sha256 = "1cb2hwi859hds0fa2cbap014qaa7mah9p0rcxcm2cvj2ybl33qfc";
       })
+      (fetchpatch { # This can be removed when https://codereview.qt-project.org/c/qt/qtbase/+/363880/3 is included in an release.
+        name = "qtbase-mysql-version-vs-functionality-check.patch";
+        url = "https://codereview.qt-project.org/gitweb?p=qt/qtbase.git;a=patch;h=211369133cf40b2f522caaff259c19069ed23ca4";
+        sha256 = "19kq9h10qm344fpdqa9basrbzh1y5kr48c6jzz3nvk61pk4ja1k4";
+      })
     ];
     qtdeclarative = [ ./qtdeclarative.patch ];
     qtscript = [ ./qtscript.patch ];
diff --git a/pkgs/development/libraries/qt-5/hooks/wrap-qt-apps-hook.sh b/pkgs/development/libraries/qt-5/hooks/wrap-qt-apps-hook.sh
index ce4d78fbb50f..c085cdaca52e 100644
--- a/pkgs/development/libraries/qt-5/hooks/wrap-qt-apps-hook.sh
+++ b/pkgs/development/libraries/qt-5/hooks/wrap-qt-apps-hook.sh
@@ -76,7 +76,7 @@ wrapQtAppsHook() {
     [ -z "$wrapQtAppsHookHasRun" ] || return 0
     wrapQtAppsHookHasRun=1
 
-    local targetDirs=( "$prefix/bin" "$prefix/sbin" "$prefix/libexec"  )
+    local targetDirs=( "$prefix/bin" "$prefix/sbin" "$prefix/libexec" "$prefix/Applications" "$prefix/"*.app )
     echo "wrapping Qt applications in ${targetDirs[@]}"
 
     for targetDir in "${targetDirs[@]}"
@@ -85,7 +85,7 @@ wrapQtAppsHook() {
 
         find "$targetDir" ! -type d -executable -print0 | while IFS= read -r -d '' file
         do
-            patchelf --print-interpreter "$file" >/dev/null 2>&1 || continue
+            isELF "$file" || isMachO "$file" || continue
 
             if [ -f "$file" ]
             then
diff --git a/pkgs/development/libraries/science/math/suitesparse/default.nix b/pkgs/development/libraries/science/math/suitesparse/default.nix
index e053d5bcf342..5a6de9f64e83 100644
--- a/pkgs/development/libraries/science/math/suitesparse/default.nix
+++ b/pkgs/development/libraries/science/math/suitesparse/default.nix
@@ -12,7 +12,7 @@
 
 stdenv.mkDerivation rec {
   pname = "suitesparse";
-  version = "5.9.0";
+  version = "5.10.1";
 
   outputs = [ "out" "dev" "doc" ];
 
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
     owner = "DrTimothyAldenDavis";
     repo = "SuiteSparse";
     rev = "v${version}";
-    sha256 = "sha256-tvwpSVgZrfYZHXHN8OQF0Y/aJM03JHGPFok7hUqPE/4=";
+    sha256 = "sha256-ifuoXgVQp2vHR/reC/Hjbt3vqaKpql3Nfxdb/Cgv/aU=";
   };
 
   nativeBuildInputs = [
@@ -53,7 +53,7 @@ stdenv.mkDerivation rec {
     "CUBLAS_LIB=${cudatoolkit}/lib/libcublas.so"
   ] ++ lib.optionals stdenv.isDarwin [
     # Unless these are set, the build will attempt to use `Accelerate` on darwin, see:
-    # https://github.com/DrTimothyAldenDavis/SuiteSparse/blob/v5.9.0/SuiteSparse_config/SuiteSparse_config.mk#L368
+    # https://github.com/DrTimothyAldenDavis/SuiteSparse/blob/v5.10.1/SuiteSparse_config/SuiteSparse_config.mk#L368
     "BLAS=-lblas"
     "LAPACK=-llapack"
   ]
diff --git a/pkgs/development/libraries/uthash/default.nix b/pkgs/development/libraries/uthash/default.nix
index 97c6d10191f3..f6c6e378421b 100644
--- a/pkgs/development/libraries/uthash/default.nix
+++ b/pkgs/development/libraries/uthash/default.nix
@@ -1,23 +1,23 @@
-{ lib, stdenv, fetchurl, perl }:
+{ lib, stdenv, fetchFromGitHub, perl }:
 
 stdenv.mkDerivation rec {
   pname = "uthash";
-  version = "2.1.0";
+  version = "2.3.0";
 
-  src = fetchurl {
-    url = "https://github.com/troydhanson/uthash/archive/v${version}.tar.gz";
-    sha256 = "17k6k97n20jpi9zj3lzvqfw8pv670r6rdqrjf8vrbx6hcj7csb0m";
+  src = fetchFromGitHub {
+    owner = "troydhanson";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "sha256-F0M5ENT3bMn3dD16Oaq9mBFYOWzVliVWupAIrLc2nkQ=";
   };
 
-  dontBuild = false;
-
   doCheck = true;
   checkInputs = [ perl ];
-  checkTarget = "-C tests/";
+  checkTarget = "all";
+  preCheck = "cd tests";
 
   installPhase = ''
-    mkdir -p "$out/include"
-    cp ./src/* "$out/include/"
+    install -Dm644 $src/include/*.h -t $out/include
   '';
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/FormEncode/default.nix b/pkgs/development/python-modules/FormEncode/default.nix
index 7a3967404c94..08bcbaa6516a 100644
--- a/pkgs/development/python-modules/FormEncode/default.nix
+++ b/pkgs/development/python-modules/FormEncode/default.nix
@@ -1,34 +1,50 @@
-{ lib, buildPythonPackage, fetchPypi, dnspython, pycountry, nose, setuptools-scm, six, isPy27 }:
+{ lib
+, buildPythonPackage
+, isPy27
+, fetchPypi
+, nose
+, setuptools-scm
+, six
+, dnspython
+, pycountry
+, pytestCheckHook
+}:
 
 buildPythonPackage rec {
   pname = "FormEncode";
-  version = "2.0.0";
+  version = "2.0.1";
 
   disabled = isPy27;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "049pm276140h30xgzwylhpii24xcln1qfdlfmbj69sqpfhlr5szj";
+    sha256 = "8f2974112c2557839d5bae8b76490104c03830785d923abbdef148bf3f710035";
   };
 
   postPatch = ''
-    sed -i 's/setuptools_scm_git_archive//' setup.py
-    sed -i 's/use_scm_version=.*,/version="${version}",/' setup.py
+    sed -i '/setuptools_scm_git_archive/d' setup.py
   '';
 
   nativeBuildInputs = [ setuptools-scm ];
+
   propagatedBuildInputs = [ six ];
 
-  checkInputs = [ dnspython pycountry nose ];
+  checkInputs = [
+    dnspython
+    pycountry
+    pytestCheckHook
+  ];
 
-  preCheck = ''
-    # requires dns resolving
-    sed -i 's/test_unicode_ascii_subgroup/noop/' formencode/tests/test_email.py
-  '';
+  disabledTests = [
+    # requires network for DNS resolution
+    "test_doctests"
+    "test_unicode_ascii_subgroup"
+  ];
 
   meta = with lib; {
     description = "FormEncode validates and converts nested structures";
     homepage = "http://formencode.org";
     license = licenses.mit;
+    maintainers = with maintainers; [ ];
   };
 }
diff --git a/pkgs/development/python-modules/absl-py/default.nix b/pkgs/development/python-modules/absl-py/default.nix
index 8ad21f54bbd1..611686e5c0af 100644
--- a/pkgs/development/python-modules/absl-py/default.nix
+++ b/pkgs/development/python-modules/absl-py/default.nix
@@ -8,11 +8,11 @@
 
 buildPythonPackage rec {
   pname = "absl-py";
-  version = "0.13.0";
+  version = "0.14.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "6953272383486044699fd0e9f00aad167a27e08ce19aae66c6c4b10e7e767793";
+    sha256 = "eb0383bd431c0d7b2320179904cab00120a10977e3c9671d99efbbed17efb55a";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/accupy/default.nix b/pkgs/development/python-modules/accupy/default.nix
index 67aba7342148..fff517c84fbe 100644
--- a/pkgs/development/python-modules/accupy/default.nix
+++ b/pkgs/development/python-modules/accupy/default.nix
@@ -1,6 +1,6 @@
 { lib
 , buildPythonPackage
-, fetchPypi
+, fetchFromGitHub
 , pythonOlder
 , mpmath
 , numpy
@@ -11,17 +11,19 @@
 , pytestCheckHook
 , matplotlib
 , dufte
-, isPy27
+, perfplot
 }:
 
 buildPythonPackage rec {
   pname = "accupy";
-  version = "0.3.4";
-  disabled = isPy27;
+  version = "0.3.6";
+  disabled = pythonOlder "3.7";
 
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "36506aca53154528997ac22aee6292c83da0f4850bb375c149512b5284bd4948";
+  src = fetchFromGitHub {
+    owner = "nschloe";
+    repo = pname;
+    rev = version;
+    sha256 = "0sxkwpp2xy2jgakhdxr4nh1cspqv8l89kz6s832h05pbpyc0n767";
   };
 
   nativeBuildInputs = [
@@ -39,6 +41,7 @@ buildPythonPackage rec {
   ] ++ lib.optional (pythonOlder "3.8") importlib-metadata;
 
   checkInputs = [
+    perfplot
     pytestCheckHook
     matplotlib
     dufte
diff --git a/pkgs/development/python-modules/aioambient/default.nix b/pkgs/development/python-modules/aioambient/default.nix
index 3e5c0c8dfe89..d60a62496cd9 100644
--- a/pkgs/development/python-modules/aioambient/default.nix
+++ b/pkgs/development/python-modules/aioambient/default.nix
@@ -27,6 +27,11 @@ buildPythonPackage rec {
     sha256 = "sha256-blejTXyLe3B2kNytBh+zJz0Q0xDP+Vo2SV9gc7OX6S0=";
   };
 
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace 'websockets = ">=8.1,<10.0"' 'websockets = ">=8.1,<11.0"'
+  '';
+
   nativeBuildInputs = [
     poetry-core
   ];
diff --git a/pkgs/development/python-modules/aiobotocore/default.nix b/pkgs/development/python-modules/aiobotocore/default.nix
index f6024c953fda..9fbbbac43ef8 100644
--- a/pkgs/development/python-modules/aiobotocore/default.nix
+++ b/pkgs/development/python-modules/aiobotocore/default.nix
@@ -10,12 +10,12 @@
 
 buildPythonPackage rec {
   pname = "aiobotocore";
-  version = "1.4.1";
+  version = "1.4.2";
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "09f06723d1d69c6d407d9a356ca65ab42a5b7b73a45be4b1ed0ed1a6b6057a9f";
+    sha256 = "c2f4ef325aaa839e9e2a53346b4c1c203656783a4985ab36fd4c2a9ef2dc1d2b";
   };
 
   # relax version constraints: aiobotocore works with newer botocore versions
diff --git a/pkgs/development/python-modules/alembic/default.nix b/pkgs/development/python-modules/alembic/default.nix
index af8b1fc37215..957b82e14467 100644
--- a/pkgs/development/python-modules/alembic/default.nix
+++ b/pkgs/development/python-modules/alembic/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage rec {
   pname = "alembic";
-  version = "1.7.1";
+  version = "1.7.4";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "aea964d3dcc9c205b8759e4e9c1c3935ea3afeee259bffd7ed8414f8085140fb";
+    sha256 = "9d33f3ff1488c4bfab1e1a6dfebbf085e8a8e1a3e047a43ad29ad1f67f012a1d";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/amqtt/default.nix b/pkgs/development/python-modules/amqtt/default.nix
index 1f5fee4d71bb..d61140081ef1 100644
--- a/pkgs/development/python-modules/amqtt/default.nix
+++ b/pkgs/development/python-modules/amqtt/default.nix
@@ -26,6 +26,11 @@ buildPythonPackage rec {
     sha256 = "sha256-27LmNR1KC8w3zRJ7YBlBolQ4Q70ScTPqypMCpU6fO+I=";
   };
 
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace 'websockets = "^9.0"' 'websockets = "^10.0"'
+  '';
+
   nativeBuildInputs = [ poetry-core ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/arrow/default.nix b/pkgs/development/python-modules/arrow/default.nix
index 956dd5f40f2d..72bbdb7b977c 100644
--- a/pkgs/development/python-modules/arrow/default.nix
+++ b/pkgs/development/python-modules/arrow/default.nix
@@ -12,13 +12,13 @@
 
 buildPythonPackage rec {
   pname = "arrow";
-  version = "1.1.1";
+  version = "1.2.0";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "dee7602f6c60e3ec510095b5e301441bc56288cb8f51def14dcb3079f623823a";
+    sha256 = "16fc29bbd9e425e3eb0fef3018297910a0f4568f21116fc31771e2760a50e074";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/arviz/default.nix b/pkgs/development/python-modules/arviz/default.nix
index 39a0d38a0e94..5aa10201917d 100644
--- a/pkgs/development/python-modules/arviz/default.nix
+++ b/pkgs/development/python-modules/arviz/default.nix
@@ -22,13 +22,13 @@
 
 buildPythonPackage rec {
   pname = "arviz";
-  version = "0.11.2";
+  version = "0.11.4";
 
   src = fetchFromGitHub {
     owner = "arviz-devs";
     repo = "arviz";
     rev = "v${version}";
-    sha256 = "0npwrpy262y6zqd0znz4w7ikfdyz4kc4gikmkpj6h1j6vxggrfaa";
+    sha256 = "0vindadyxhxhrhbalys6kzrda2d4qpqbqbsbwfprp8pxkldgk548";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/astroid/default.nix b/pkgs/development/python-modules/astroid/default.nix
index a4694663bb6b..b6ba53055d36 100644
--- a/pkgs/development/python-modules/astroid/default.nix
+++ b/pkgs/development/python-modules/astroid/default.nix
@@ -1,10 +1,12 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+, fetchpatch
 , pythonOlder
 , isPyPy
 , lazy-object-proxy
 , wrapt
+, typing-extensions
 , typed-ast
 , pytestCheckHook
 , setuptools-scm
@@ -13,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "astroid";
-  version = "2.7.3"; # Check whether the version is compatible with pylint
+  version = "2.8.2"; # Check whether the version is compatible with pylint
 
   disabled = pythonOlder "3.6";
 
@@ -21,11 +23,19 @@ buildPythonPackage rec {
     owner = "PyCQA";
     repo = pname;
     rev = "v${version}";
-    sha256 = "08qxw58cdyglkni6ahyil4cmnb48zz0wr4v05gzqk4r5ifs4gl2m";
+    sha256 = "0140h4l7licwdw0scnfzsbi5b2ncxi7fxhdab7c1i3sk01r4asp6";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION=version;
 
+  patches = [
+    (fetchpatch {
+      # Allow wrapt 1.13 (https://github.com/PyCQA/astroid/pull/1203)
+      url = "https://github.com/PyCQA/astroid/commit/fd510e08c2ee862cd284861e02b9bcc9a7fd9809.patch";
+      sha256 = "1s10whslcqnyz251fb76qkc9p41gagxljpljsmw89id1wywmjib4";
+    })
+  ];
+
   nativeBuildInputs = [
     setuptools-scm
   ];
@@ -34,6 +44,8 @@ buildPythonPackage rec {
   propagatedBuildInputs = [
     lazy-object-proxy
     wrapt
+  ] ++ lib.optionals (pythonOlder "3.10") [
+    typing-extensions
   ] ++ lib.optional (!isPyPy && pythonOlder "3.8") typed-ast;
 
   checkInputs = [
diff --git a/pkgs/development/python-modules/asyncssh/default.nix b/pkgs/development/python-modules/asyncssh/default.nix
index 5afd91f52f3e..da8d194561fe 100644
--- a/pkgs/development/python-modules/asyncssh/default.nix
+++ b/pkgs/development/python-modules/asyncssh/default.nix
@@ -18,12 +18,12 @@
 
 buildPythonPackage rec {
   pname = "asyncssh";
-  version = "2.7.1";
+  version = "2.7.2";
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "8c8852eb00a09e45c403086e10965cb6d13e5cd203a1688d91e9c81aa080d052";
+    sha256 = "96b09239c3cc134cfb66ae1138313fdb48cc390806f21f831dd44f8a1d8252a1";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/aws-lambda-builders/default.nix b/pkgs/development/python-modules/aws-lambda-builders/default.nix
index c967e6b7b468..b93ba47c72a4 100644
--- a/pkgs/development/python-modules/aws-lambda-builders/default.nix
+++ b/pkgs/development/python-modules/aws-lambda-builders/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "aws-lambda-builders";
-  version = "1.6.0";
+  version = "1.8.1";
 
   # No tests available in PyPI tarball
   src = fetchFromGitHub {
     owner = "awslabs";
     repo = "aws-lambda-builders";
     rev = "v${version}";
-    sha256 = "sha256-H25Y1gusV+sSX0f6ii49bE36CgM1E3oWsX8AiVH85Y4=";
+    sha256 = "1avq04hmps2cd33dd5n4bc3lclqg0hv6khn804fbv0hmy7lywp8b";
   };
 
   # Package is not compatible with Python 3.5
diff --git a/pkgs/development/python-modules/aws-sam-translator/default.nix b/pkgs/development/python-modules/aws-sam-translator/default.nix
index 8bf823e83f0a..9807c6581c55 100644
--- a/pkgs/development/python-modules/aws-sam-translator/default.nix
+++ b/pkgs/development/python-modules/aws-sam-translator/default.nix
@@ -14,13 +14,13 @@
 
 buildPythonPackage rec {
   pname = "aws-sam-translator";
-  version = "1.38.0";
+  version = "1.39.0";
 
   src = fetchFromGitHub {
     owner = "aws";
     repo = "serverless-application-model";
     rev = "v${version}";
-    sha256 = "0nn9jfqz13kzmxm0r9vy24p8sqxv3mrm5d3lx7ah6rc581q8nv1k";
+    sha256 = "1a9m7zyqc414adw1i0sr2n9nlnmry0gi1ah1qna3yv9dx4ql9v9c";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/awscrt/default.nix b/pkgs/development/python-modules/awscrt/default.nix
index 4b48d74c43f7..fbdd15522e6a 100644
--- a/pkgs/development/python-modules/awscrt/default.nix
+++ b/pkgs/development/python-modules/awscrt/default.nix
@@ -2,7 +2,7 @@
 
 buildPythonPackage rec {
   pname = "awscrt";
-  version = "0.12.4";
+  version = "0.12.5";
 
   buildInputs = lib.optionals stdenv.isDarwin [ CoreFoundation Security ];
 
@@ -22,7 +22,7 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "6ad69336bc5277f501bd7e33f82e11db2665370c7d279496ee39fe2f369baeb2";
+    sha256 = "8bb80b37ebfd01f6078c60bb3231118380ac06842de692f6e37b6f8643e15a1d";
   };
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/azure-core/default.nix b/pkgs/development/python-modules/azure-core/default.nix
index cd0a816815cd..773696c03958 100644
--- a/pkgs/development/python-modules/azure-core/default.nix
+++ b/pkgs/development/python-modules/azure-core/default.nix
@@ -44,6 +44,11 @@ buildPythonPackage rec {
     typing-extensions
   ];
 
+  # test server needs to be available
+  preCheck = ''
+    export PYTHONPATH=tests/testserver_tests/coretestserver:$PYTHONPATH
+  '';
+
   pytestFlagsArray = [ "tests/" ];
   # disable tests which touch network
   disabledTests = [ "aiohttp" "multipart_send" "response" "request" "timeout" ];
diff --git a/pkgs/development/python-modules/binwalk/default.nix b/pkgs/development/python-modules/binwalk/default.nix
index 9f4966ffe897..00c65af578f7 100644
--- a/pkgs/development/python-modules/binwalk/default.nix
+++ b/pkgs/development/python-modules/binwalk/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+, fetchpatch
 , stdenv
 , zlib
 , xz
@@ -22,15 +23,28 @@
 
 buildPythonPackage rec {
   pname = "binwalk";
-  version = "2.3.2";
+  version = "2.3.3";
 
   src = fetchFromGitHub {
     owner = "ReFirmLabs";
     repo = "binwalk";
     rev = "v${version}";
-    sha256 = "sha256-lfHXutAp06Xr/TSBpDwBUBC/mWI9XuyImoKwA3inqgU=";
+    sha256 = "0phqyqv34vhh80dgipiggs4n3iq2vfjk9ywx2c5d8g61vzgbd2g8";
   };
 
+  patches = [
+    # test_firmware_zip fails with 2.3.3 upgrade
+    # https://github.com/ReFirmLabs/binwalk/issues/566
+    (fetchpatch {
+      url = "https://github.com/ReFirmLabs/binwalk/commit/dd4f2efd275c9dd1001130e82e0f985110cd2754.patch";
+      sha256 = "1707n4nf1d1ay1yn4i8qlrvj2c1120g88hjwyklpsc2s2dcnqj9r";
+      includes = [
+        "testing/tests/test_firmware_zip.py"
+      ];
+      revert = true;
+    })
+  ];
+
   propagatedBuildInputs = [ zlib xz ncompress gzip bzip2 gnutar p7zip cabextract squashfsTools xz pycrypto ]
   ++ lib.optionals visualizationSupport [ matplotlib pyqtgraph ]
   ++ lib.optionals (!stdenv.isDarwin) [ cramfsprogs cramfsswap sasquatch ];
diff --git a/pkgs/development/python-modules/blessed/default.nix b/pkgs/development/python-modules/blessed/default.nix
index f3a6a9dd3b45..981b5c85f96e 100644
--- a/pkgs/development/python-modules/blessed/default.nix
+++ b/pkgs/development/python-modules/blessed/default.nix
@@ -4,11 +4,11 @@
 
 buildPythonPackage rec {
   pname = "blessed";
-  version = "1.18.1";
+  version = "1.19.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "8b09936def6bc06583db99b65636b980075733e13550cb6af262ce724a55da23";
+    sha256 = "4db0f94e5761aea330b528e84a250027ffe996b5a94bf03e502600c9a5ad7a61";
   };
 
   checkInputs = [ pytest mock glibcLocales ];
diff --git a/pkgs/development/python-modules/block-io/default.nix b/pkgs/development/python-modules/block-io/default.nix
index a76132e3e211..f634bf17ecc0 100644
--- a/pkgs/development/python-modules/block-io/default.nix
+++ b/pkgs/development/python-modules/block-io/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "block-io";
-  version = "2.0.4";
+  version = "2.0.5";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "817c9cd2ff76659caca4bb3d6758d5782a85f8c0ea13b08c4e14f0c2a8b7586d";
+    sha256 = "af70c3be444f2f2d07c0603cef547b51bbd9f4fbd4aadebd8f1e8ee73ccbc5e5";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/browser-cookie3/default.nix b/pkgs/development/python-modules/browser-cookie3/default.nix
index d4d52b9b03b1..7bfd288bc884 100644
--- a/pkgs/development/python-modules/browser-cookie3/default.nix
+++ b/pkgs/development/python-modules/browser-cookie3/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "browser-cookie3";
-  version = "0.12.1";
+  version = "0.13.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "72c1e6aa6a98adab3a6797b889664bdbfddc287474dd8e774da37a854ec32185";
+    sha256 = "9f8e5ddf5a6641a1fdca12d82b0923777ba59a988b68c9bcf358bfb7c42ef25b";
   };
 
   disabled = !isPy3k;
diff --git a/pkgs/development/python-modules/buildcatrust/default.nix b/pkgs/development/python-modules/buildcatrust/default.nix
new file mode 100644
index 000000000000..9fc0330ad0ba
--- /dev/null
+++ b/pkgs/development/python-modules/buildcatrust/default.nix
@@ -0,0 +1,32 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, pytestCheckHook
+}:
+
+buildPythonPackage rec {
+  pname = "buildcatrust";
+  version = "0.1.3";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "sha256:0s0m0fy943dakw9cbd40h46qmrhhgrcp292kppyb34m6y27sbagy";
+  };
+
+  checkInputs = [
+    pytestCheckHook
+  ];
+  disabledTestPaths = [
+    # Non-hermetic, needs internet access (e.g. attempts to retrieve NSS store).
+    "buildcatrust/tests/test_nonhermetic.py"
+  ];
+
+  pythonImportsCheck = [ "buildcatrust" "buildcatrust.cli" ];
+
+  meta = with lib; {
+    description = "Build SSL/TLS trust stores";
+    homepage = "https://github.com/lukegb/buildcatrust";
+    license = licenses.mit;
+    maintainers = with maintainers; [ lukegb ];
+  };
+}
diff --git a/pkgs/development/python-modules/certifi/default.nix b/pkgs/development/python-modules/certifi/default.nix
index e21719245c8a..53fe66f01532 100644
--- a/pkgs/development/python-modules/certifi/default.nix
+++ b/pkgs/development/python-modules/certifi/default.nix
@@ -7,7 +7,7 @@
 
 buildPythonPackage rec {
   pname = "certifi";
-  version = "2021.05.30";
+  version = "2021.10.08";
 
   disabled = isPy27;
 
@@ -15,7 +15,7 @@ buildPythonPackage rec {
     owner = pname;
     repo = "python-certifi";
     rev = version;
-    sha256 = "1i4ljsc47iac6kl1w4w6x0qia08s9z394z9lbyzc05pm7y8a3cmj";
+    sha256 = "sha256-SFb/spVHK15b53ZG1P147DcTjs1dqR0+MBXzpE+CWpo=";
   };
 
   checkInputs = [
diff --git a/pkgs/development/python-modules/cfn-lint/default.nix b/pkgs/development/python-modules/cfn-lint/default.nix
index 6f6d55502958..f0769f57275a 100644
--- a/pkgs/development/python-modules/cfn-lint/default.nix
+++ b/pkgs/development/python-modules/cfn-lint/default.nix
@@ -21,13 +21,13 @@
 
 buildPythonPackage rec {
   pname = "cfn-lint";
-  version = "0.53.1";
+  version = "0.54.2";
 
   src = fetchFromGitHub {
     owner = "aws-cloudformation";
     repo = "cfn-python-lint";
     rev = "v${version}";
-    sha256 = "1wj2pzrrmrdf3mkhnz1qx41rshvfpgwlrxrb80d63r098pnq6df8";
+    sha256 = "04d5zyjnrl3b6cb2fxmbpii27mnq77wqsglfxfv2a1zj2p9xby0p";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/cftime/default.nix b/pkgs/development/python-modules/cftime/default.nix
index 46fad656cabe..7688851ecf11 100644
--- a/pkgs/development/python-modules/cftime/default.nix
+++ b/pkgs/development/python-modules/cftime/default.nix
@@ -10,11 +10,11 @@
 
 buildPythonPackage rec {
   pname = "cftime";
-  version = "1.5.0";
+  version = "1.5.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "b644bcb53346b6f4fe2fcc9f3b574740a2097637492dcca29632c817e0604f29";
+    sha256 = "8a398caed78389b366f1037ca62939ff01af2f1789c77bce05eb903f19ffd840";
   };
 
   checkInputs = [
diff --git a/pkgs/development/python-modules/charset-normalizer/default.nix b/pkgs/development/python-modules/charset-normalizer/default.nix
index dc0f5e1b296a..66d9e23668b4 100644
--- a/pkgs/development/python-modules/charset-normalizer/default.nix
+++ b/pkgs/development/python-modules/charset-normalizer/default.nix
@@ -6,13 +6,13 @@
 
 buildPythonPackage rec {
   pname = "charset-normalizer";
-  version = "2.0.1";
+  version = "2.0.5";
 
   src = fetchFromGitHub {
     owner = "Ousret";
     repo = "charset_normalizer";
     rev = version;
-    sha256 = "04rnyrqay11kma9pzagi1mzhc0sq37ggpv39kad2d4ynm35v2hfq";
+    sha256 = "0pv6yf5ialc82iimsjbq3gp5hh02pg4a7sdma48gd81h4h8qd627";
   };
 
   checkInputs = [
diff --git a/pkgs/development/python-modules/cli-helpers/default.nix b/pkgs/development/python-modules/cli-helpers/default.nix
index 1dc04d707882..a9e3daa8372b 100644
--- a/pkgs/development/python-modules/cli-helpers/default.nix
+++ b/pkgs/development/python-modules/cli-helpers/default.nix
@@ -10,11 +10,11 @@
 
 buildPythonPackage rec {
   pname = "cli_helpers";
-  version = "2.1.0";
+  version = "2.2.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "dd6f164310f7d86fa3da1f82043a9c784e44a02ad49be932a80624261e56979b";
+    sha256 = "733f65d8c921e0cffa8f7ae4c8735bd7ecdffec383c5246f647ddd0fddb33448";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/click-didyoumean/default.nix b/pkgs/development/python-modules/click-didyoumean/default.nix
index c4574072b4ca..565663aee0cc 100644
--- a/pkgs/development/python-modules/click-didyoumean/default.nix
+++ b/pkgs/development/python-modules/click-didyoumean/default.nix
@@ -4,11 +4,11 @@
 
 buildPythonPackage rec {
   pname = "click-didyoumean";
-  version = "0.0.3";
+  version = "0.3.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1svaza5lpvdbmyrx5xi0riqzq4hb9wnlpqrg6r8zy14pbi42j8hi";
+    sha256 = "f184f0d851d96b6d29297354ed981b7dd71df7ff500d82fa6d11f0856bee8035";
   };
 
   propagatedBuildInputs = [ click ];
diff --git a/pkgs/development/python-modules/click/default.nix b/pkgs/development/python-modules/click/default.nix
index d20322e3b843..a9e83804f707 100644
--- a/pkgs/development/python-modules/click/default.nix
+++ b/pkgs/development/python-modules/click/default.nix
@@ -9,11 +9,11 @@
 
 buildPythonPackage rec {
   pname = "click";
-  version = "8.0.1";
+  version = "8.0.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0ymdyf37acq4qxh038q0xx44qgj6y2kf0jd0ivvix6qij88w214c";
+    sha256 = "7027bc7bbafaab8b2c2816861d8eb372429ee3c02e193fc2f93d6c4ab9de49c5";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/cmarkgfm/default.nix b/pkgs/development/python-modules/cmarkgfm/default.nix
index 7379d6dc6c96..42fff42458b3 100644
--- a/pkgs/development/python-modules/cmarkgfm/default.nix
+++ b/pkgs/development/python-modules/cmarkgfm/default.nix
@@ -7,11 +7,11 @@
 
 buildPythonPackage rec {
   pname = "cmarkgfm";
-  version = "0.5.3";
+  version = "0.6.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-tqVJq6Mnq9mG1nSM8hyGN9dBx2hQ5/773vjSi/4TjjI=";
+    sha256 = "ec2bf8d5799c4b5bbfbae30a4a1dfcb06512f2e17e9ee60ba7e1d390318582fc";
   };
 
   propagatedBuildInputs = [ cffi ];
diff --git a/pkgs/development/python-modules/cmd2/default.nix b/pkgs/development/python-modules/cmd2/default.nix
index f74cf77c5e4a..f7308fd8ba93 100644
--- a/pkgs/development/python-modules/cmd2/default.nix
+++ b/pkgs/development/python-modules/cmd2/default.nix
@@ -18,13 +18,13 @@
 
 buildPythonPackage rec {
   pname = "cmd2";
-  version = "2.1.2";
+  version = "2.2.0";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "25dbb2e9847aaa686a8a21e84e3d101db8b79f5cb992e044fc54210ab8c0ad41";
+    sha256 = "34cd12424d9e2835eff125146af3d9f4a4c2931c6bc5a3cea9790bd4f55756d9";
   };
 
   LC_ALL = "en_US.UTF-8";
diff --git a/pkgs/development/python-modules/cucumber-tag-expressions/default.nix b/pkgs/development/python-modules/cucumber-tag-expressions/default.nix
index 09987ddb3bf2..f286cd4a7f02 100644
--- a/pkgs/development/python-modules/cucumber-tag-expressions/default.nix
+++ b/pkgs/development/python-modules/cucumber-tag-expressions/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "cucumber-tag-expressions";
-  version = "4.0.2";
+  version = "4.1.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "4ef4e0513d4c26d42299ffed010ed5e24125b87fc64de2e74b979d4a84c8f522";
+    sha256 = "e314d5fed6eebb2f90380271f562248fb15e18636764faf40f4dde4b28b1f960";
   };
 
   checkInputs = [ pytest pytest-html ];
diff --git a/pkgs/development/python-modules/curtsies/default.nix b/pkgs/development/python-modules/curtsies/default.nix
index 7b34884e26e2..549d6062c174 100644
--- a/pkgs/development/python-modules/curtsies/default.nix
+++ b/pkgs/development/python-modules/curtsies/default.nix
@@ -2,10 +2,10 @@
 
 buildPythonPackage rec {
   pname = "curtsies";
-  version = "0.3.5";
+  version = "0.3.9";
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1g8dwafx4vx06isjkn28r3cwb0hw1bv67lgygaz34yk66lrzz1x5";
+    sha256 = "933b503767ce38fe32a1f77639d9a4fa3d5229d41abb31a91a6fcbdf01511a55";
   };
 
   propagatedBuildInputs = [ blessings cwcwidth ]
diff --git a/pkgs/development/python-modules/ddt/default.nix b/pkgs/development/python-modules/ddt/default.nix
index 11d32adf3bfb..bc5964c73769 100644
--- a/pkgs/development/python-modules/ddt/default.nix
+++ b/pkgs/development/python-modules/ddt/default.nix
@@ -9,11 +9,11 @@
 
 buildPythonPackage rec {
   pname = "ddt";
-  version = "1.4.2";
+  version = "1.4.4";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-ZKZzZqJxXmNriGlMxgdcwC2ykvAQmLjjhTl8iU05U3g=";
+    sha256 = "8de39a69730442dc835e4d33f9d2e33043ff91151c8d18086959ee556febb9f8";
   };
 
   checkInputs = [ six pyyaml mock pytestCheckHook ];
diff --git a/pkgs/development/python-modules/decorator/default.nix b/pkgs/development/python-modules/decorator/default.nix
index f8d3f5c9ac61..0c1889963157 100644
--- a/pkgs/development/python-modules/decorator/default.nix
+++ b/pkgs/development/python-modules/decorator/default.nix
@@ -5,11 +5,11 @@
 
 buildPythonPackage rec {
   pname = "decorator";
-  version = "5.0.9";
+  version = "5.1.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "72ecfba4320a893c53f9706bebb2d55c270c1e51a28789361aa93e4a21319ed5";
+    sha256 = "e59913af105b9860aa2c8d3272d9de5a56a4e608db9a2f167a8480b323d529a7";
   };
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/devtools/default.nix b/pkgs/development/python-modules/devtools/default.nix
index 32050acfdf27..fdb240dde842 100644
--- a/pkgs/development/python-modules/devtools/default.nix
+++ b/pkgs/development/python-modules/devtools/default.nix
@@ -3,14 +3,14 @@
 
 buildPythonPackage rec {
   pname = "devtools";
-  version = "0.6.1";
+  version = "0.8.0";
   disabled = pythonOlder "3.6";
 
   src = fetchFromGitHub {
     owner = "samuelcolvin";
     repo = "python-${pname}";
     rev = "v${version}";
-    sha256 = "0s1d2jwijini7y1a3318yhb98mh1mw4pzlfx2zck3a8nqw984ki3";
+    sha256 = "0yavcbxzxi1nfa1k326gsl03y8sadi5z5acamwd8b1bsiv15p757";
   };
 
   propagatedBuildInputs = [ pygments ];
diff --git a/pkgs/development/python-modules/distlib/default.nix b/pkgs/development/python-modules/distlib/default.nix
index 002c0923c26f..1c565b3f158b 100644
--- a/pkgs/development/python-modules/distlib/default.nix
+++ b/pkgs/development/python-modules/distlib/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "distlib";
-  version = "0.3.2";
+  version = "0.3.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "106fef6dc37dd8c0e2c0a60d3fca3e77460a48907f335fa28420463a6f799736";
+    sha256 = "d982d0751ff6eaaab5e2ec8e691d949ee80eddf01a62eaa96ddb11531fe16b05";
     extension = "zip";
   };
 
diff --git a/pkgs/development/python-modules/django-haystack/default.nix b/pkgs/development/python-modules/django-haystack/default.nix
index c207a37ebf15..0f0f4a0a1174 100644
--- a/pkgs/development/python-modules/django-haystack/default.nix
+++ b/pkgs/development/python-modules/django-haystack/default.nix
@@ -1,30 +1,60 @@
-{ lib, buildPythonPackage, fetchPypi
-, setuptools, setuptools-scm, django, python-dateutil, whoosh, pysolr
-, coverage, mock, nose, geopy, requests }:
+{ lib
+, buildPythonPackage
+, pythonOlder
+, fetchPypi
+
+# build dependencies
+, setuptools-scm
+
+# dependencies
+, django
+
+# tests
+, geopy
+, nose
+, pysolr
+, python-dateutil
+, requests
+, whoosh
+}:
 
 buildPythonPackage rec {
   pname = "django-haystack";
   version = "3.1.1";
+  format = "setuptools";
+  disabled = pythonOlder "3.5";
 
   src = fetchPypi {
     inherit pname version;
     sha256 = "6d05756b95d7d5ec1dbd4668eb999ced1504b47f588e2e54be53b1404c516a82";
   };
 
-  checkInputs = [ pysolr whoosh python-dateutil geopy coverage nose mock coverage requests ];
-  propagatedBuildInputs = [ django setuptools ];
-  nativeBuildInputs = [ setuptools-scm ];
-
   postPatch = ''
-    sed -i 's/geopy==/geopy>=/' setup.py
+    substituteInPlace setup.py \
+      --replace "geopy==" "geopy>="
   '';
 
-  # ImportError: cannot import name django.contrib.gis.geos.prototypes
-  doCheck = false;
+  nativeBuildInputs = [
+    setuptools-scm
+  ];
+
+  propagatedBuildInputs = [
+    django
+  ];
+
+  checkInputs = [
+    geopy
+    nose
+    pysolr
+    python-dateutil
+    requests
+    whoosh
+  ];
 
   meta = with lib; {
-    description = "Modular search for Django";
+    description = "Pluggable search for Django";
     homepage = "http://haystacksearch.org/";
     license = licenses.bsd3;
+    maintainers = with maintainers; [ ];
   };
 }
diff --git a/pkgs/development/python-modules/django-mailman3/default.nix b/pkgs/development/python-modules/django-mailman3/default.nix
index 00eea271b493..cc04bf0d441f 100644
--- a/pkgs/development/python-modules/django-mailman3/default.nix
+++ b/pkgs/development/python-modules/django-mailman3/default.nix
@@ -4,11 +4,11 @@
 
 buildPythonPackage rec {
   pname = "django-mailman3";
-  version = "1.3.6";
+  version = "1.3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "cd3cb1ac26a3658bd694b82f00eaab98903bd2edff34956e90c187c9ab5c0dae";
+    sha256 = "6ea8c24c13e7afe744f18e18e4d19d0e74223e0d9bd5d782deea85dcb865feb7";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/djangorestframework/default.nix b/pkgs/development/python-modules/djangorestframework/default.nix
index 66a57625b4a9..131be8781b36 100644
--- a/pkgs/development/python-modules/djangorestframework/default.nix
+++ b/pkgs/development/python-modules/djangorestframework/default.nix
@@ -1,7 +1,7 @@
 { lib, buildPythonPackage, fetchFromGitHub, django, isPy27 }:
 
 buildPythonPackage rec {
-  version = "3.12.2";
+  version = "3.12.4";
   pname = "djangorestframework";
   disabled = isPy27;
 
@@ -9,7 +9,7 @@ buildPythonPackage rec {
     owner = "encode";
     repo = "django-rest-framework";
     rev = version;
-    sha256 = "y/dw6qIOc6NaNpBWJXDwHX9aFodgKv9rGKWQKS6STlk=";
+    sha256 = "sha256-FjMRfVyLmm5J9uOUTLZpO3Pvge3RoYnqIRvzMng7wZo=";
   };
 
   # Test settings are missing
diff --git a/pkgs/development/python-modules/docker/default.nix b/pkgs/development/python-modules/docker/default.nix
index 3c41ccd17324..f70fcebb26f3 100644
--- a/pkgs/development/python-modules/docker/default.nix
+++ b/pkgs/development/python-modules/docker/default.nix
@@ -14,11 +14,11 @@
 
 buildPythonPackage rec {
   pname = "docker";
-  version = "5.0.0";
+  version = "5.0.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-PovEdTTgypMx1ywy8ogbsTuT3tC83qs8gz+3z2HAqaU=";
+    sha256 = "d916a26b62970e7c2f554110ed6af04c7ccff8e9f81ad17d0d40c75637e227fb";
   };
 
   nativeBuildInputs = lib.optional isPy27 mock;
diff --git a/pkgs/development/python-modules/docplex/default.nix b/pkgs/development/python-modules/docplex/default.nix
index 670ccae65422..b7b0231a806e 100644
--- a/pkgs/development/python-modules/docplex/default.nix
+++ b/pkgs/development/python-modules/docplex/default.nix
@@ -9,12 +9,12 @@
 
 buildPythonPackage rec {
   pname = "docplex";
-  version = "2.21.207";
+  version = "2.22.213";
 
   # No source available from official repo
   src = fetchPypi {
     inherit pname version;
-    sha256 = "4f1781592be2b093db939772db8c6575a0f017041fb0cfd784bedf4222ac5e58";
+    sha256 = "8a86bba42b5b65f2e0f88ed350115efeb783b444661e2cfcf3a67d5c59bcb0bd";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/dropbox/default.nix b/pkgs/development/python-modules/dropbox/default.nix
index 5b46c8183c81..849f551ac067 100644
--- a/pkgs/development/python-modules/dropbox/default.nix
+++ b/pkgs/development/python-modules/dropbox/default.nix
@@ -3,11 +3,11 @@
 
 buildPythonPackage rec {
   pname = "dropbox";
-  version = "11.20.0";
+  version = "11.21.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1aa351ec8bbb11cf3560e731b81d25f39c7edcb5fa92c06c5d68866cb9f90d54";
+    sha256 = "6a4697acfe95bea13af9c133a41a8d774946c58ab47083b4c82a017a1b08c380";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/editdistance/default.nix b/pkgs/development/python-modules/editdistance/default.nix
index 01e59fdb040d..a831570363da 100644
--- a/pkgs/development/python-modules/editdistance/default.nix
+++ b/pkgs/development/python-modules/editdistance/default.nix
@@ -7,14 +7,14 @@
 
 buildPythonPackage rec {
   pname = "editdistance";
-  version = "0.5.3";
+  version = "0.6.0";
 
 
   src = fetchFromGitHub {
     owner = "roy-ht";
     repo = pname;
-    rev = "v${version}";
-    sha256 = "0vk8vz41p2cs7s7zbaw3cnw2jnvy5rhy525xral68dh14digpgsd";
+    rev = version;
+    sha256 = "1qajskfyx2ki81ybksf0lgl1pdyw7al4ci39zrj66ylsn8fssg89";
   };
 
   nativeBuildInputs = [ cython ];
diff --git a/pkgs/development/python-modules/eventlet/default.nix b/pkgs/development/python-modules/eventlet/default.nix
index 92ff2cdacaf6..9b8ff979ffd2 100644
--- a/pkgs/development/python-modules/eventlet/default.nix
+++ b/pkgs/development/python-modules/eventlet/default.nix
@@ -40,7 +40,9 @@ buildPythonPackage rec {
   checkPhase = ''
     runHook preCheck
 
-    nosetests --exclude test_getaddrinfo --exclude test_hosts_no_network
+    # test_fork-after_monkey_patch fails on aarch64 on hydra only
+    #   AssertionError: Expected single line "pass" in stdout
+    nosetests --exclude test_getaddrinfo --exclude test_hosts_no_network --exclude test_fork_after_monkey_patch
 
     runHook postCheck
   '';
diff --git a/pkgs/development/python-modules/faker/default.nix b/pkgs/development/python-modules/faker/default.nix
index ae47989141e9..f363b6bb6f66 100644
--- a/pkgs/development/python-modules/faker/default.nix
+++ b/pkgs/development/python-modules/faker/default.nix
@@ -1,23 +1,23 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, freezegun
+, pillow
+, pytestCheckHook
 , python-dateutil
 , text-unidecode
-, freezegun
-, pytestCheckHook
 , ukpostcodeparser
-, pillow
 , validators
 }:
 
 buildPythonPackage rec {
   pname = "faker";
-  version = "8.8.2";
+  version = "9.3.1";
 
   src = fetchPypi {
     pname = "Faker";
     inherit version;
-    sha256 = "sha256-IlNMOqbS7584QDojTcm3G1y4ePt2XHKZS+Xce06vCGU=";
+    hash = "sha256-zdnpry+6XJbuLsSshBm7pFjia1iiuYwfZGfuZglr7lI=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/falcon/default.nix b/pkgs/development/python-modules/falcon/default.nix
index eb6cbfa242e1..a42da353fc68 100644
--- a/pkgs/development/python-modules/falcon/default.nix
+++ b/pkgs/development/python-modules/falcon/default.nix
@@ -1,28 +1,53 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, coverage
-, ddt
-, nose
+, pythonOlder
+, aiofiles
+, cbor2
+, httpx
+, msgpack
+, pecan
+, pytest-asyncio
+, pytestCheckHook
 , pyyaml
 , requests
 , testtools
+, websockets
 }:
 
 buildPythonPackage rec {
   pname = "falcon";
-  version = "2.0.0";
+  version = "3.0.1";
+  format = "pyproject";
+  disabled = pythonOlder "3.5";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "eea593cf466b9c126ce667f6d30503624ef24459f118c75594a69353b6c3d5fc";
+    sha256 = "sha256-xB2E2zJYgahw6LcSnV7P2XL6QyPPd7cRmh0qIZZu5oE=";
   };
 
-  checkInputs = [coverage ddt nose pyyaml requests testtools];
+  checkInputs = [
+    aiofiles
+    cbor2
+    httpx
+    msgpack
+    pecan
+    pytest-asyncio
+    pytestCheckHook
+    pyyaml
+    requests
+    testtools
+    websockets
+  ];
 
-  # The travis build fails since the migration from multiprocessing to threading for hosting the API under test.
-  # OSError: [Errno 98] Address already in use
-  doCheck = false;
+  disabledTestPaths = [
+    # missing optional nuts package
+    "falcon/bench/nuts/nuts/tests/test_functional.py"
+    # missing optional mujson package
+    "tests/test_media_handlers.py"
+    # tries to run uvicorn binary and doesn't find it
+    "tests/asgi/test_asgi_servers.py"
+  ];
 
   meta = with lib; {
     description = "An unladen web framework for building APIs and app backends";
diff --git a/pkgs/development/python-modules/filelock/default.nix b/pkgs/development/python-modules/filelock/default.nix
index 97073bb6b03b..d5ccc117beff 100644
--- a/pkgs/development/python-modules/filelock/default.nix
+++ b/pkgs/development/python-modules/filelock/default.nix
@@ -1,14 +1,30 @@
-{ lib, buildPythonPackage, fetchPypi }:
+{ lib
+, buildPythonPackage
+, pythonOlder
+, fetchPypi
+, setuptools-scm
+, pytestCheckHook
+}:
 
 buildPythonPackage rec {
   pname = "filelock";
-  version = "3.0.12";
+  version = "3.3.0";
+  format = "pyproject";
+  disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "18d82244ee114f543149c66a6e0c14e9c4f8a1044b5cdaadd0f82159d6a6ff59";
+    sha256 = "8c7eab13dc442dc249e95158bcc12dec724465919bdc9831fdbf0660f03d1785";
   };
 
+  nativeBuildInputs = [
+    setuptools-scm
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+  ];
+
   meta = with lib; {
     homepage = "https://github.com/benediktschmitt/py-filelock";
     description = "A platform independent file lock for Python";
diff --git a/pkgs/development/python-modules/flake8/default.nix b/pkgs/development/python-modules/flake8/default.nix
index 0110db18c4c3..78c1a74b85c1 100644
--- a/pkgs/development/python-modules/flake8/default.nix
+++ b/pkgs/development/python-modules/flake8/default.nix
@@ -1,6 +1,17 @@
-{ lib, buildPythonPackage, fetchPypi, pythonOlder
-, mock, pytest, pytest-runner
-, configparser, enum34, mccabe, pycodestyle, pyflakes, functools32, typing ? null, importlib-metadata
+{ lib
+, buildPythonPackage
+, fetchPypi
+, pythonOlder
+, configparser
+, enum34
+, mccabe
+, pycodestyle
+, pyflakes
+, functools32
+, typing
+, importlib-metadata
+, mock
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
@@ -12,21 +23,34 @@ buildPythonPackage rec {
     sha256 = "07528381786f2a6237b061f6e96610a4167b226cb926e2aa2b6b1d78057c576b";
   };
 
-  checkInputs = [ pytest mock pytest-runner ];
-  propagatedBuildInputs = [ pyflakes pycodestyle mccabe ]
-    ++ lib.optionals (pythonOlder "3.2") [ configparser functools32 ]
-    ++ lib.optionals (pythonOlder "3.4") [ enum34 ]
-    ++ lib.optionals (pythonOlder "3.5") [ typing ]
-    ++ lib.optionals (pythonOlder "3.8") [ importlib-metadata ];
-
-  # fixtures fail to initialize correctly
-  checkPhase = ''
-    py.test tests --ignore=tests/integration/test_checker.py
+  postPatch = ''
+    substituteInPlace setup.cfg \
+      --replace "pyflakes >= 2.3.0, < 2.4.0" "pyflakes >= 2.3.0, < 2.5.0"
   '';
 
+  propagatedBuildInputs = [
+    pyflakes
+    pycodestyle
+    mccabe
+  ] ++ lib.optionals (pythonOlder "3.2") [
+    configparser
+    functools32
+  ] ++ lib.optionals (pythonOlder "3.4") [
+    enum34
+  ] ++ lib.optionals (pythonOlder "3.5") [
+    typing
+  ] ++ lib.optionals (pythonOlder "3.8") [
+    importlib-metadata
+  ];
+
+  checkInputs = [
+    mock
+    pytestCheckHook
+  ];
+
   meta = with lib; {
-    description = "Code checking using pep8 and pyflakes";
-    homepage = "https://pypi.python.org/pypi/flake8";
+    description = "Flake8 is a wrapper around pyflakes, pycodestyle and mccabe.";
+    homepage = "https://github.com/pycqa/flake8";
     license = licenses.mit;
     maintainers = with maintainers; [ ];
   };
diff --git a/pkgs/development/python-modules/flask/default.nix b/pkgs/development/python-modules/flask/default.nix
index 166b30ac9856..2fe71c2d6db9 100644
--- a/pkgs/development/python-modules/flask/default.nix
+++ b/pkgs/development/python-modules/flask/default.nix
@@ -11,12 +11,12 @@
 }:
 
 buildPythonPackage rec {
-  version = "2.0.1";
+  version = "2.0.2";
   pname = "Flask";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0mcgwq7b4qd99mf5bsvs3wphchxarf8kgil4hwww3blj31xjak0w";
+    sha256 = "7b2fb8e934ddd50731893bdcdb00fc8c0315916f9fcd50d22c7cc1a95ab634e2";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/flexmock/default.nix b/pkgs/development/python-modules/flexmock/default.nix
index 6061f04d627b..cd546b8c3b0d 100644
--- a/pkgs/development/python-modules/flexmock/default.nix
+++ b/pkgs/development/python-modules/flexmock/default.nix
@@ -6,11 +6,11 @@
 
 buildPythonPackage rec {
   pname = "flexmock";
-  version = "0.10.9";
+  version = "0.10.10";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "9c128b7cf31fac5340062c9c2cf1e0b12c601ee2d5c10ef39cc191036fb2e688";
+    sha256 = "8bb073f4b7b590672e8c312e73d6a14f88ae624a867b691462f9e8c24b9f19d1";
   };
 
   checkInputs = [ pytest ];
diff --git a/pkgs/development/python-modules/flufl/bounce.nix b/pkgs/development/python-modules/flufl/bounce.nix
index 301b16035396..7687c0980c70 100644
--- a/pkgs/development/python-modules/flufl/bounce.nix
+++ b/pkgs/development/python-modules/flufl/bounce.nix
@@ -2,13 +2,13 @@
 
 buildPythonPackage rec {
   pname = "flufl.bounce";
-  version = "3.0.2";
+  version = "4.0";
 
   buildInputs = [ nose2 ];
   propagatedBuildInputs = [ atpublic zope_interface ];
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "5014b23248fce72b13143c32da30073e6abc655b963e7739575608280c52c9a7";
+    sha256 = "sha256-JVBK65duwP5aGc1sQTo0EMtRT9zb3Kn5tdjTQ6hgODE=";
   };
 }
diff --git a/pkgs/development/python-modules/flufl/i18n.nix b/pkgs/development/python-modules/flufl/i18n.nix
index b757585e40d7..70b97a083d8f 100644
--- a/pkgs/development/python-modules/flufl/i18n.nix
+++ b/pkgs/development/python-modules/flufl/i18n.nix
@@ -2,7 +2,7 @@
 
 buildPythonPackage rec {
   pname = "flufl.i18n";
-  version = "3.1.5";
+  version = "3.2";
 
   propagatedBuildInputs = [ atpublic ];
 
@@ -12,6 +12,6 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "b7016000a4d9d366866e776947b777dbe2b1532c990efeef58922b3e7bcab36e";
+    sha256 = "sha256-w1yPjqtmrbf9ZKFCCGAQUGbSs2y2VbM/+xSv6OIj7WI=";
   };
 }
diff --git a/pkgs/development/python-modules/flufl/lock.nix b/pkgs/development/python-modules/flufl/lock.nix
index 792af5a6c725..c0f3ec60cf35 100644
--- a/pkgs/development/python-modules/flufl/lock.nix
+++ b/pkgs/development/python-modules/flufl/lock.nix
@@ -4,11 +4,11 @@
 
 buildPythonPackage rec {
   pname = "flufl.lock";
-  version = "5.1";
+  version = "6.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1ylahys50vaj7iw6dhlx3gg7vs8cms9sbyvscd06clnk6lqk78ad";
+    sha256 = "sha256-/HSO5gnshktIOO9knb0RcPp53rDCE8L9URUb7mp/wkI=";
   };
 
   propagatedBuildInputs = [ atpublic psutil ];
diff --git a/pkgs/development/python-modules/frozendict/default.nix b/pkgs/development/python-modules/frozendict/default.nix
index 4acf53563ded..4e486ae6016e 100644
--- a/pkgs/development/python-modules/frozendict/default.nix
+++ b/pkgs/development/python-modules/frozendict/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "frozendict";
-  version = "2.0.5";  # 2.0.6 breaks canonicaljson
+  version = "2.0.6";  # 2.0.6 breaks canonicaljson
   format = "setuptools";
 
   disabled = !isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-wb7hwHDY2fZA4SjluHV2pEAAhgCfeGLRPAv4YA5iE9M=";
+    sha256 = "3f00de72805cf4c9e81b334f3f04809278b967d2fed84552313a0fcce511beb1";
   };
 
   pythonImportsCheck = [
diff --git a/pkgs/development/python-modules/furl/default.nix b/pkgs/development/python-modules/furl/default.nix
index c3c45e48d663..5872ab8b7824 100644
--- a/pkgs/development/python-modules/furl/default.nix
+++ b/pkgs/development/python-modules/furl/default.nix
@@ -9,11 +9,11 @@
 
 buildPythonPackage rec {
   pname = "furl";
-  version = "2.1.2";
+  version = "2.1.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-99ujPq++59vIOWNTSyXnL4FsztSKxTGR7mC/zGKTORg=";
+    sha256 = "5a6188fe2666c484a12159c18be97a1977a71d632ef5bb867ef15f54af39cc4e";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/geventhttpclient/default.nix b/pkgs/development/python-modules/geventhttpclient/default.nix
index fd759a0bd723..0d5b46b4dd30 100644
--- a/pkgs/development/python-modules/geventhttpclient/default.nix
+++ b/pkgs/development/python-modules/geventhttpclient/default.nix
@@ -13,11 +13,11 @@
 
 buildPythonPackage rec {
   pname = "geventhttpclient";
-  version = "1.5.1";
+  version = "1.5.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "4aead64253d2769a6528544f7812ce8d71ae13551d079f2d9a3533d72818f2e0";
+    sha256 = "f3c5884d62be75162426728e3d86788740b13e363b197ef592f1443dba240709";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/google-cloud-datastore/default.nix b/pkgs/development/python-modules/google-cloud-datastore/default.nix
index f1449bbccd0a..84266540fd41 100644
--- a/pkgs/development/python-modules/google-cloud-datastore/default.nix
+++ b/pkgs/development/python-modules/google-cloud-datastore/default.nix
@@ -13,11 +13,11 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-datastore";
-  version = "2.1.6";
+  version = "2.2.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-31PBHWnU0KbX8ymFh7+dP0uVbM6BWexdaumMVQbBO6o=";
+    sha256 = "e1349f4650ceeec92c266076104a0d9068f6374a20d7ea0f754ba89d16cbf5b1";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/google-cloud-storage/default.nix b/pkgs/development/python-modules/google-cloud-storage/default.nix
index 5ad4c2a31f66..df6a16377b5e 100644
--- a/pkgs/development/python-modules/google-cloud-storage/default.nix
+++ b/pkgs/development/python-modules/google-cloud-storage/default.nix
@@ -54,6 +54,7 @@ buildPythonPackage rec {
     "tests/system/test_bucket.py"
     "tests/system/test_fileio.py"
     "tests/system/test_kms_integration.py"
+    "tests/conformance/test_conformance.py" # requires docker
   ];
 
   preCheck = ''
diff --git a/pkgs/development/python-modules/gradient/default.nix b/pkgs/development/python-modules/gradient/default.nix
index a0788070a965..556688323b1e 100644
--- a/pkgs/development/python-modules/gradient/default.nix
+++ b/pkgs/development/python-modules/gradient/default.nix
@@ -22,11 +22,11 @@
 
 buildPythonPackage rec {
   pname = "gradient";
-  version = "1.7.4";
+  version = "1.8.9";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "de1d33672f13d4de37a66ba9aebfd503a098d0ca26e5eb8b071e1c0dacd557ea";
+    sha256 = "c05913efe7fcc9f75c1fe84c157d2c2cf3ec0983e132d418c6e59fabc6361a1e";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/greenlet/default.nix b/pkgs/development/python-modules/greenlet/default.nix
index e997c7da3987..6f42eeefa9f4 100644
--- a/pkgs/development/python-modules/greenlet/default.nix
+++ b/pkgs/development/python-modules/greenlet/default.nix
@@ -9,12 +9,12 @@
 
 buildPythonPackage rec {
   pname = "greenlet";
-  version = "1.1.1";
+  version = "1.1.2";
   disabled = isPyPy;  # builtin for pypy
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "c0f22774cd8294078bdf7392ac73cf00bfa1e5e0ed644bd064fdabc5f2a2f481";
+    sha256 = "e30f5ea4ae2346e62cedde8794a56858a67b878dd79f7df76a0767e356b1744a";
   };
 
   checkPhase = ''
diff --git a/pkgs/development/python-modules/hass-nabucasa/default.nix b/pkgs/development/python-modules/hass-nabucasa/default.nix
index 90fd6bf50185..48788537a660 100644
--- a/pkgs/development/python-modules/hass-nabucasa/default.nix
+++ b/pkgs/development/python-modules/hass-nabucasa/default.nix
@@ -24,6 +24,13 @@ buildPythonPackage rec {
     sha256 = "sha256-0E8eiHzqbxHbtAd97MbvFMRDWTu25E9x/44oNGC4mUM=";
   };
 
+  postPatch = ''
+    sed -i 's/"acme.*"/"acme"/' setup.py
+    substituteInPlace setup.py \
+      --replace "cryptography>=2.8,<4.0" "cryptography" \
+      --replace "snitun==" "snitun>="
+  '';
+
   propagatedBuildInputs = [
     acme
     aiohttp
@@ -40,12 +47,6 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
-  postPatch = ''
-    sed -i 's/"acme.*"/"acme"/' setup.py
-    substituteInPlace setup.py \
-      --replace "snitun==" "snitun>="
-  '';
-
   pythonImportsCheck = [ "hass_nabucasa" ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/humanize/default.nix b/pkgs/development/python-modules/humanize/default.nix
index 85ec6257ea5d..f878320e5d47 100644
--- a/pkgs/development/python-modules/humanize/default.nix
+++ b/pkgs/development/python-modules/humanize/default.nix
@@ -9,13 +9,13 @@
 }:
 
 buildPythonPackage rec {
-  version = "3.11.0";
+  version = "3.12.0";
   pname = "humanize";
   disabled = isPy27; # setup.py no longer compatible
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "4160cdc63fcd0daac27d2e1e218a31bb396fc3fe5712d153675d89432a03778f";
+    sha256 = "5ec1a66e230a3e31fb3f184aab9436ea13d4e37c168e0ffc345ae5bb57e58be6";
   };
 
   nativeBuildInputs = [ setuptools-scm ];
diff --git a/pkgs/development/python-modules/hypothesis/default.nix b/pkgs/development/python-modules/hypothesis/default.nix
index 4d0a1713d954..ee3778685905 100644
--- a/pkgs/development/python-modules/hypothesis/default.nix
+++ b/pkgs/development/python-modules/hypothesis/default.nix
@@ -18,14 +18,14 @@ buildPythonPackage rec {
   # If you need these, you can just add them to your environment.
 
   pname = "hypothesis";
-  version = "6.17.3";
+  version = "6.23.2";
 
   # Use github tarballs that includes tests
   src = fetchFromGitHub {
     owner = "HypothesisWorks";
     repo = "hypothesis-python";
     rev = "hypothesis-python-${version}";
-    sha256 = "1g96q3l97lq3xps36cv147dvj44nh1b0k67z817x7zfwyw844sgn";
+    sha256 = "1mdygyq6ra4kysi0y2g3a4bgpqrcb8ci2061117zyms419qwwh4l";
   };
 
   postUnpack = "sourceRoot=$sourceRoot/hypothesis-python";
diff --git a/pkgs/development/python-modules/imap-tools/default.nix b/pkgs/development/python-modules/imap-tools/default.nix
index 392663e391d1..eb81678ae4f1 100644
--- a/pkgs/development/python-modules/imap-tools/default.nix
+++ b/pkgs/development/python-modules/imap-tools/default.nix
@@ -7,7 +7,7 @@
 
 buildPythonPackage rec {
   pname = "imap-tools";
-  version = "0.48.1";
+  version = "0.49.1";
 
   disabled = isPy27;
 
@@ -15,7 +15,7 @@ buildPythonPackage rec {
     owner = "ikvk";
     repo = "imap_tools";
     rev = "v${version}";
-    sha256 = "sha256-AS407jsDk+dAz1DPM44vTUQEleohr9xKnjgCw5Rjs9M=";
+    sha256 = "071bri1h6j8saqqlb50zibdrk5hgkpwp4ysiskl1zin18794bq82";
   };
 
   checkInputs = [
@@ -29,6 +29,9 @@ buildPythonPackage rec {
     "test_connectio"
     "test_attributes"
     "test_live"
+    # logic operator tests broken in 0.49.0
+    # https://github.com/ikvk/imap_tools/issues/143
+    "test_logic_operators"
   ];
 
   pythonImportsCheck = [ "imap_tools" ];
diff --git a/pkgs/development/python-modules/importlib-metadata/default.nix b/pkgs/development/python-modules/importlib-metadata/default.nix
index d67a6c947517..158f101167e2 100644
--- a/pkgs/development/python-modules/importlib-metadata/default.nix
+++ b/pkgs/development/python-modules/importlib-metadata/default.nix
@@ -10,13 +10,13 @@
 
 buildPythonPackage rec {
   pname = "importlib-metadata";
-  version = "4.6.4";
+  version = "4.8.1";
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     pname = "importlib_metadata";
     inherit version;
-    sha256 = "sha256-ezCnjbKSLXim9H+zBoMVahTzxqpcwj93zIln6astAC8=";
+    sha256 = "sha256-8oSz4RJWrR5dA6uGuyzNb1M5aI/xek15eg/n3zJvI7E=";
   };
 
   nativeBuildInputs = [ setuptools-scm ];
diff --git a/pkgs/development/python-modules/influxdb/default.nix b/pkgs/development/python-modules/influxdb/default.nix
index 3b9672701833..8ecd46e3b96b 100644
--- a/pkgs/development/python-modules/influxdb/default.nix
+++ b/pkgs/development/python-modules/influxdb/default.nix
@@ -57,6 +57,8 @@ buildPythonPackage rec {
     #   b'foo[30 chars]_one="1",column_two=1i 0\nfoo,tag_one=red,tag_[46 chars]00\n'
     "test_write_points_from_dataframe_with_nan_json"
     "test_write_points_from_dataframe_with_tags_and_nan_json"
+    # Reponse is not empty but `s = '孝'` and the JSON decoder chokes on that
+    "test_query_with_empty_result"
   ];
 
   pythonImportsCheck = [ "influxdb" ];
diff --git a/pkgs/development/python-modules/inform/default.nix b/pkgs/development/python-modules/inform/default.nix
index 9ef6fd1e0a1d..aff0d77e7022 100644
--- a/pkgs/development/python-modules/inform/default.nix
+++ b/pkgs/development/python-modules/inform/default.nix
@@ -7,13 +7,13 @@
 
 buildPythonPackage rec {
   pname = "inform";
-  version = "1.25";
+  version = "1.26";
 
   src = fetchFromGitHub {
     owner = "KenKundert";
     repo = "inform";
     rev = "v${version}";
-    sha256 = "1r56wmn21c7ggy33548l6dfjswhadkp2iaalfb7xgsxmq7qfcnax";
+    sha256 = "0snrmvmc3rnz90cql5ayzs878rrkadk46rhvf2sn78nb0x57wa20";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/ipykernel/default.nix b/pkgs/development/python-modules/ipykernel/default.nix
index 041818900978..f64b793b610b 100644
--- a/pkgs/development/python-modules/ipykernel/default.nix
+++ b/pkgs/development/python-modules/ipykernel/default.nix
@@ -13,11 +13,11 @@
 
 buildPythonPackage rec {
   pname = "ipykernel";
-  version = "6.3.0";
+  version = "6.4.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "5314690a638f893e2cc3bf3d25042920e9fbb873f7d8263033390264caeb95f4";
+    sha256 = "df3355e5eec23126bc89767a676c5f0abfc7f4c3497d118c592b83b316e8c0cd";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/ipympl/default.nix b/pkgs/development/python-modules/ipympl/default.nix
index 2d25eb645bad..4075ae5d1909 100644
--- a/pkgs/development/python-modules/ipympl/default.nix
+++ b/pkgs/development/python-modules/ipympl/default.nix
@@ -8,11 +8,11 @@
 
 buildPythonPackage rec {
   pname = "ipympl";
-  version = "0.7.0";
+  version = "0.8.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "f0f1f356d8cb9d4fb51bb86dbbf837c190145316cb72f66081872ebc4d6db0a1";
+    sha256 = "ef5d21820ed88a8bd6efddb884c333d0eaea7f2f7d4b3054e6d386b07a36dd9d";
   };
 
   propagatedBuildInputs = [ ipywidgets matplotlib jupyter-packaging ];
diff --git a/pkgs/development/python-modules/ipython/default.nix b/pkgs/development/python-modules/ipython/default.nix
index 548ba874cd70..b8a13eb436c0 100644
--- a/pkgs/development/python-modules/ipython/default.nix
+++ b/pkgs/development/python-modules/ipython/default.nix
@@ -23,12 +23,12 @@
 
 buildPythonPackage rec {
   pname = "ipython";
-  version = "7.27.0";
+  version = "7.28.0";
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "58b55ebfdfa260dad10d509702dc2857cb25ad82609506b070cf2d7b7df5af13";
+    sha256 = "2097be5c814d1b974aea57673176a924c4c8c9583890e7a5f082f547b9975b11";
   };
 
   prePatch = lib.optionalString stdenv.isDarwin ''
diff --git a/pkgs/development/python-modules/ipywidgets/default.nix b/pkgs/development/python-modules/ipywidgets/default.nix
index a0087131b1af..c324eea947da 100644
--- a/pkgs/development/python-modules/ipywidgets/default.nix
+++ b/pkgs/development/python-modules/ipywidgets/default.nix
@@ -15,11 +15,11 @@
 
 buildPythonPackage rec {
   pname = "ipywidgets";
-  version = "7.6.3";
+  version = "7.6.5";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "9f1a43e620530f9e570e4a493677d25f08310118d315b00e25a18f12913c41f0";
+    sha256 = "00974f7cb4d5f8d494c19810fedb9fa9b64bffd3cda7c2be23c133a1ad3c99c5";
   };
 
   # Tests are not distributed
diff --git a/pkgs/development/python-modules/iterm2/default.nix b/pkgs/development/python-modules/iterm2/default.nix
index a1b777c1bb76..125dc2691e5b 100644
--- a/pkgs/development/python-modules/iterm2/default.nix
+++ b/pkgs/development/python-modules/iterm2/default.nix
@@ -5,11 +5,11 @@
 
 buildPythonPackage rec {
   pname = "iterm2";
-  version = "1.27";
+  version = "1.29";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "dcbd89d0502e72a9a41b055f5cf10b5a991f60fb12df29918d9c2183d1389abd";
+    sha256 = "8245562ed713fd473520f81361cdc1b15835920e1ceb7d588678cd153e77c2b6";
   };
 
   propagatedBuildInputs = [ protobuf websockets ];
diff --git a/pkgs/development/python-modules/jax/default.nix b/pkgs/development/python-modules/jax/default.nix
index f0b4d6e26324..e1d21af094f9 100644
--- a/pkgs/development/python-modules/jax/default.nix
+++ b/pkgs/development/python-modules/jax/default.nix
@@ -7,14 +7,14 @@
 
 buildPythonPackage rec {
   pname = "jax";
-  version = "0.2.19";
+  version = "0.2.21";
 
   # Fetching from pypi doesn't allow us to run the test suite. See https://discourse.nixos.org/t/pythonremovetestsdir-hook-being-run-before-checkphase/14612/3.
   src = fetchFromGitHub {
     owner = "google";
     repo = pname;
     rev = "jax-v${version}";
-    sha256 = "sha256-pVn62G7pydR7ybkf7gSbu0FlEq2c0US6H2GTBAljup4=";
+    sha256 = "05w157h6jv20k8w2gnmlxbycmzf24lr5v392q0c5v0qcql11q7pn";
   };
 
   # jaxlib is _not_ included in propagatedBuildInputs because there are
diff --git a/pkgs/development/python-modules/jedi/default.nix b/pkgs/development/python-modules/jedi/default.nix
index 0dba5e8f192c..4e4aa0a94f18 100644
--- a/pkgs/development/python-modules/jedi/default.nix
+++ b/pkgs/development/python-modules/jedi/default.nix
@@ -1,29 +1,49 @@
-{ lib, buildPythonPackage, fetchFromGitHub, fetchPypi, pytest, glibcLocales, tox, pytest-cov, parso }:
+{ lib
+, stdenv
+, buildPythonPackage
+, pythonOlder
+, fetchFromGitHub
+, fetchPypi
+, colorama
+, django
+, docopt
+, pytestCheckHook
+, parso
+}:
 
 buildPythonPackage rec {
   pname = "jedi";
-  # switch back to stable version on the next release.
-  # current stable is incompatible with parso
-  version = "2020-08-06";
+  version = "0.18.0";
+  disabled = pythonOlder "3.6";
 
   src = fetchFromGitHub {
     owner = "davidhalter";
     repo = "jedi";
-    rev = "216f976fd5cab7a460e5d287e853d11759251e52";
-    sha256 = "1kb2ajzigadl95pnwglg8fxz9cvpg9hx30hqqj91jkgrc7djdldj";
+    rev = "v${version}";
+    sha256 = "0d8zdj56hyxbsvvrid6r3nprm0ygxaad6zpsbhbj6k7p3dcx7acw";
     fetchSubmodules = true;
   };
 
-  checkInputs = [ pytest glibcLocales tox pytest-cov ];
-
   propagatedBuildInputs = [ parso ];
 
-  checkPhase = ''
-    LC_ALL="en_US.UTF-8" py.test test
+  checkInputs = [
+    colorama
+    django
+    docopt
+    pytestCheckHook
+  ];
+
+  preCheck = ''
+    export HOME=$TMPDIR
   '';
 
-  # tox required for tests: https://github.com/davidhalter/jedi/issues/808
-  doCheck = false;
+  disabledTests = [
+    # Assertions mismatches with pytest>=6.0
+    "test_completion"
+  ] ++ lib.optionals (stdenv.isAarch64 && pythonOlder "3.9") [
+    # AssertionError: assert 'foo' in ['setup']
+    "test_init_extension_module"
+  ];
 
   meta = with lib; {
     homepage = "https://github.com/davidhalter/jedi";
diff --git a/pkgs/development/python-modules/jinja2/default.nix b/pkgs/development/python-modules/jinja2/default.nix
index d54372379b86..7be9367da916 100644
--- a/pkgs/development/python-modules/jinja2/default.nix
+++ b/pkgs/development/python-modules/jinja2/default.nix
@@ -10,12 +10,12 @@
 
 buildPythonPackage rec {
   pname = "Jinja2";
-  version = "3.0.1";
+  version = "3.0.2";
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "197ms1wimxql650245v63wkv04n8bicj549wfhp51bx68x5lhgvh";
+    sha256 = "827a0e32839ab1600d4eb1c4c33ec5a8edfbc5cb42dafa13b81f182f97784b45";
   };
 
   propagatedBuildInputs = [
@@ -31,6 +31,13 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
+  pytestFlagsArray = [
+    # Avoid failure due to deprecation warning
+    # Fixed in https://github.com/python/cpython/pull/28153
+    # Remove after cpython 3.9.8
+    "-p no:warnings"
+  ];
+
   meta = with lib; {
     homepage = "http://jinja.pocoo.org/";
     description = "Stand-alone template engine";
diff --git a/pkgs/development/python-modules/joblib/default.nix b/pkgs/development/python-modules/joblib/default.nix
index aad27b5ae636..2b011f56c1e8 100644
--- a/pkgs/development/python-modules/joblib/default.nix
+++ b/pkgs/development/python-modules/joblib/default.nix
@@ -13,12 +13,12 @@
 
 buildPythonPackage rec {
   pname = "joblib";
-  version = "1.0.1";
+  version = "1.1.0";
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "9c17567692206d2f3fb9ecf5e991084254fe631665c450b443761c4186a613f7";
+    sha256 = "4158fcecd13733f8be669be0683b96ebdbbd38d23559f54dca7205aea1bf1e35";
   };
 
   checkInputs = [ sphinx numpydoc pytestCheckHook ];
diff --git a/pkgs/development/python-modules/josepy/default.nix b/pkgs/development/python-modules/josepy/default.nix
index 02f7319d7ff9..b262e6883322 100644
--- a/pkgs/development/python-modules/josepy/default.nix
+++ b/pkgs/development/python-modules/josepy/default.nix
@@ -10,11 +10,11 @@
 
 buildPythonPackage rec {
   pname = "josepy";
-  version = "1.9.0";
+  version = "1.10.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "51cce8d97ced0556aae0ce3161b26d5f0f54bc42c749d3c606edc6d97d9802dc";
+    sha256 = "e9bcaf605411cadaec04841ae2d5f77ebb178b7b6df7c9aed1d97399ac18685b";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/jupyter_client/default.nix b/pkgs/development/python-modules/jupyter_client/default.nix
index e30b3cb63a71..b543008988ea 100644
--- a/pkgs/development/python-modules/jupyter_client/default.nix
+++ b/pkgs/development/python-modules/jupyter_client/default.nix
@@ -14,11 +14,11 @@
 
 buildPythonPackage rec {
   pname = "jupyter_client";
-  version = "7.0.2";
+  version = "7.0.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0c6cabd07e003a2e9692394bf1ae794188ad17d2e250ed747232d7a473aa772c";
+    sha256 = "8b6e06000eb9399775e0a55c52df6c1be4766666209c22f90c2691ded0e338dc";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/jupyter_core/default.nix b/pkgs/development/python-modules/jupyter_core/default.nix
index cdd0485b6843..f83ba1362341 100644
--- a/pkgs/development/python-modules/jupyter_core/default.nix
+++ b/pkgs/development/python-modules/jupyter_core/default.nix
@@ -12,12 +12,12 @@
 
 buildPythonPackage rec {
   pname = "jupyter_core";
-  version = "4.7.1";
+  version = "4.8.1";
   disabled = !isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "79025cb3225efcd36847d0840f3fc672c0abd7afd0de83ba8a1d3837619122b4";
+    sha256 = "ef210dcb4fca04de07f2ead4adf408776aca94d17151d6f750ad6ded0b91ea16";
   };
 
   checkInputs = [ pytest mock glibcLocales nose ];
diff --git a/pkgs/development/python-modules/jupyterlab-git/default.nix b/pkgs/development/python-modules/jupyterlab-git/default.nix
index dbff1660b1cc..c33798252cd4 100644
--- a/pkgs/development/python-modules/jupyterlab-git/default.nix
+++ b/pkgs/development/python-modules/jupyterlab-git/default.nix
@@ -10,12 +10,12 @@
 
 buildPythonPackage rec {
   pname = "jupyterlab_git";
-  version = "0.32.2";
+  version = "0.33.0";
   disabled = pythonOlder "3.5";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "4c5743a05150ed7736e028aac15787a66735f160e9ae198dacc5a4bd1a727ce2";
+    sha256 = "2370f3cefa5fef4d37dc211035cdccfe7cc4ef170df76413765a1933c5217465";
   };
 
   propagatedBuildInputs = [ notebook nbdime git ];
diff --git a/pkgs/development/python-modules/jupyterlab/default.nix b/pkgs/development/python-modules/jupyterlab/default.nix
index b1c70d0263d8..d018b626996f 100644
--- a/pkgs/development/python-modules/jupyterlab/default.nix
+++ b/pkgs/development/python-modules/jupyterlab/default.nix
@@ -10,12 +10,12 @@
 
 buildPythonPackage rec {
   pname = "jupyterlab";
-  version = "3.1.17";
+  version = "3.1.18";
   disabled = pythonOlder "3.5";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "7e829cedce4fec676fb9d83850805df9e563b3ca7f20f70bd2ea177a462b7a78";
+    sha256 = "a43733acc3729557fc4758cff55652e52896e42c64c1f12540656ae7f298b806";
   };
 
   nativeBuildInputs = [ jupyter-packaging ];
diff --git a/pkgs/development/python-modules/jupyterlab_server/default.nix b/pkgs/development/python-modules/jupyterlab_server/default.nix
index a56b5d86abef..f342f2f64eca 100644
--- a/pkgs/development/python-modules/jupyterlab_server/default.nix
+++ b/pkgs/development/python-modules/jupyterlab_server/default.nix
@@ -16,12 +16,12 @@
 
 buildPythonPackage rec {
   pname = "jupyterlab_server";
-  version = "2.8.1";
+  version = "2.8.2";
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "39fd519e9b3275873bd15de891363c28f2649814f7bbc11c57469c60e8408e97";
+    sha256 = "26d813c8162c83d466df7d155865987dabe70aa452f9187dfb79fd88afc8fa0b";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/keyring/default.nix b/pkgs/development/python-modules/keyring/default.nix
index cf765c06d869..8f86e6a5dd35 100644
--- a/pkgs/development/python-modules/keyring/default.nix
+++ b/pkgs/development/python-modules/keyring/default.nix
@@ -13,12 +13,12 @@
 
 buildPythonPackage rec {
   pname = "keyring";
-  version = "23.1.0";
+  version = "23.2.1";
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "b7e0156667f5dcc73c1f63a518005cd18a4eb23fe77321194fefcc03748b21a4";
+    sha256 = "6334aee6073db2fb1f30892697b1730105b5e9a77ce7e61fca6b435225493efe";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/labelbox/default.nix b/pkgs/development/python-modules/labelbox/default.nix
index 5f8057df849d..5c7d7afedc43 100644
--- a/pkgs/development/python-modules/labelbox/default.nix
+++ b/pkgs/development/python-modules/labelbox/default.nix
@@ -19,14 +19,14 @@
 
 buildPythonPackage rec {
   pname = "labelbox";
-  version = "3.2.0";
+  version = "3.6.1";
   disabled = pythonOlder "3.6";
 
   src = fetchFromGitHub {
     owner = "Labelbox";
     repo = "labelbox-python";
-    rev = "V${version}";
-    sha256 = "0vp1lk7hipa4ixa1zcy99r9b5xb1gv54h4i0izx6fv4zf9m0gmw1";
+    rev = "v${version}";
+    sha256 = "0mix7ajdvyhyvi8nwmxz62mzwl3242h2pzj84zikrmh1ampwvg3g";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/leather/default.nix b/pkgs/development/python-modules/leather/default.nix
index 197e88e8e8b2..af2cb219cdbd 100644
--- a/pkgs/development/python-modules/leather/default.nix
+++ b/pkgs/development/python-modules/leather/default.nix
@@ -1,16 +1,35 @@
-{ lib, fetchPypi, buildPythonPackage, six }:
+{ lib
+, fetchPypi
+, buildPythonPackage
+, six
+, cssselect
+, lxml
+, nose
+}:
 
 buildPythonPackage rec {
   pname = "leather";
-  version = "0.3.3";
+  version = "0.3.4";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "125r372q7bwcajfdysp7w5zh5wccwxf1mkhqawl8h518nl1icv87";
+    sha256 = "b43e21c8fa46b2679de8449f4d953c06418666dc058ce41055ee8a8d3bb40918";
   };
 
   propagatedBuildInputs = [ six ];
 
+  checkInputs = [
+    cssselect
+    lxml
+    nose
+  ];
+
+  checkPhase = ''
+    runHook preCheck
+    nosetests
+    runHook postCheck
+  '';
+
   meta = with lib; {
     homepage = "http://leather.rtfd.io";
     description = "Python charting library";
diff --git a/pkgs/development/python-modules/libarchive-c/default.nix b/pkgs/development/python-modules/libarchive-c/default.nix
index 48262398fcbf..7c33652c0ea5 100644
--- a/pkgs/development/python-modules/libarchive-c/default.nix
+++ b/pkgs/development/python-modules/libarchive-c/default.nix
@@ -38,11 +38,6 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
-  disabledTests = lib.optionals (pythonAtLeast "3.9") [
-    # causes python3.9 to segfault
-    "test_custom_writer_and_stream_reader"
-  ];
-
   meta = with lib; {
     homepage = "https://github.com/Changaco/python-libarchive-c";
     description = "Python interface to libarchive";
diff --git a/pkgs/development/python-modules/libusb1/default.nix b/pkgs/development/python-modules/libusb1/default.nix
index 0d8142645e1b..7d921a9c8976 100644
--- a/pkgs/development/python-modules/libusb1/default.nix
+++ b/pkgs/development/python-modules/libusb1/default.nix
@@ -1,27 +1,27 @@
-{ lib, stdenv, buildPythonPackage, fetchPypi, libusb1, pytest }:
+{ lib, stdenv, buildPythonPackage, fetchPypi, libusb1, pytestCheckHook }:
 
 buildPythonPackage rec {
   pname = "libusb1";
-  version = "1.9.3";
+  version = "1.10.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "60e6ce37be064f6e51d02b25da44230ecc9c0b1fdb6f14568c71457d963c1749";
+    sha256 = "8d70e5ef11a9facf304e696cc1d571c526bd9e02a8710a045b3b2567db7a54e0";
   };
 
   postPatch = ''
-    substituteInPlace usb1/libusb1.py --replace \
+    substituteInPlace usb1/_libusb1.py --replace \
       "ctypes.util.find_library(base_name)" \
       "'${libusb1}/lib/libusb-1.0${stdenv.hostPlatform.extensions.sharedLibrary}'"
   '';
 
   buildInputs = [ libusb1 ];
 
-  checkInputs = [ pytest ];
+  checkInputs = [ pytestCheckHook ];
 
-  checkPhase = ''
-    py.test usb1/testUSB1.py
-  '';
+  pytestFlagsArray = [
+    "usb1/testUSB1.py"
+  ];
 
   meta = with lib; {
     homepage    = "https://github.com/vpelletier/python-libusb1";
diff --git a/pkgs/development/python-modules/line_profiler/default.nix b/pkgs/development/python-modules/line_profiler/default.nix
index aac026cea929..3ca82c968966 100644
--- a/pkgs/development/python-modules/line_profiler/default.nix
+++ b/pkgs/development/python-modules/line_profiler/default.nix
@@ -11,11 +11,11 @@
 
 buildPythonPackage rec {
   pname = "line_profiler";
-  version = "3.3.0";
+  version = "3.3.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "8bd8353e9403b226def4438dbfdb57cafefb24488e49a6039cc63906c0bc8836";
+    sha256 = "6e2fb792ca022f900f374f9659fd3e7c530cd4df7d3b7e84be889093b487639f";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/makefun/default.nix b/pkgs/development/python-modules/makefun/default.nix
index 12655c0d6de1..aeb13abd0dfe 100644
--- a/pkgs/development/python-modules/makefun/default.nix
+++ b/pkgs/development/python-modules/makefun/default.nix
@@ -2,24 +2,30 @@
 , fetchPypi
 , buildPythonPackage
 , setuptools-scm
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "makefun";
-  version = "1.11.3";
+  version = "1.12.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "033eed65e2c1804fca84161a38d1fc8bb8650d32a89ac1c5dc7e54b2b2c2e88c";
+    sha256 = "4d0e90ca3fdbdeb6a4a0891e2da7d4b8e80386e19e6db91ce29b8aa5c876ecfe";
   };
 
-  nativeBuildInputs = [ setuptools-scm ];
+  postPatch = ''
+    substituteInPlace setup.cfg \
+      --replace "pytest-runner" ""
+  '';
 
-  # Disabling tests for now due to various (transitive) dependencies on modules
-  # from @smarie which are, as of yet, not part of nixpkgs. Also introduces
-  # a tricky dependency: makefun tests depend on pytest-cases, installing
-  # pytest-cases depends on makefun.
-  doCheck = false;
+  nativeBuildInputs = [
+    setuptools-scm
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+  ];
 
   pythonImportsCheck = [ "makefun" ];
 
diff --git a/pkgs/development/python-modules/mathlibtools/default.nix b/pkgs/development/python-modules/mathlibtools/default.nix
index 969a91870b0f..a788a9c60b7d 100644
--- a/pkgs/development/python-modules/mathlibtools/default.nix
+++ b/pkgs/development/python-modules/mathlibtools/default.nix
@@ -3,11 +3,11 @@
 
 buildPythonPackage rec {
   pname = "mathlibtools";
-  version = "1.0.0";
+  version = "1.1.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "da41c65e206f55b1faea303581fc11215e52d6e6990b827336b2e1eb82aad96c";
+    sha256 = "789f070f35424e89e4f2e2c007382250133cc48877627e37c5c463bcf4a1b58a";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/matplotlib-inline/default.nix b/pkgs/development/python-modules/matplotlib-inline/default.nix
index f4c220dea6c6..9ee23b87ee81 100644
--- a/pkgs/development/python-modules/matplotlib-inline/default.nix
+++ b/pkgs/development/python-modules/matplotlib-inline/default.nix
@@ -8,11 +8,11 @@
 
 buildPythonPackage rec {
   pname = "matplotlib-inline";
-  version = "0.1.2";
+  version = "0.1.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0glrhcv1zqck1whsh3p75x0chda588xw22swbmvqalwz7kvmy7gl";
+    sha256 = "a04bfba22e0d1395479f866853ec1ee28eea1485c1d69a6faf00dc3e24ff34ee";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/mdformat/default.nix b/pkgs/development/python-modules/mdformat/default.nix
index 43f95bc952a2..101ed2aa1346 100644
--- a/pkgs/development/python-modules/mdformat/default.nix
+++ b/pkgs/development/python-modules/mdformat/default.nix
@@ -6,20 +6,22 @@
 , poetry-core
 , pytestCheckHook
 , pythonOlder
+, tomli
 , typing-extensions
 }:
 
 buildPythonPackage rec {
   pname = "mdformat";
-  version = "0.7.9";
+  version = "0.7.10";
   format = "pyproject";
-  disabled = pythonOlder "3.6";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "executablebooks";
     repo = pname;
     rev = version;
-    sha256 = "sha256-qGRZCDo/ACSXtJa4omepjaR0KNWeR4vvvUUbQpKlrtI=";
+    sha256 = "sha256-Zw7ZGV/Hd0MRxxQVwkjtE6MJXNLQ0A0PJlQr4x9h2ww=";
   };
 
   nativeBuildInputs = [
@@ -28,6 +30,7 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [
     markdown-it-py
+    tomli
   ] ++ lib.optionals (pythonOlder "3.10") [
     importlib-metadata
   ] ++ lib.optionals (pythonOlder "3.7") [
diff --git a/pkgs/development/python-modules/mistune/default.nix b/pkgs/development/python-modules/mistune/default.nix
index 3020eca4eed5..c7e7d6d54c73 100644
--- a/pkgs/development/python-modules/mistune/default.nix
+++ b/pkgs/development/python-modules/mistune/default.nix
@@ -4,8 +4,8 @@ self: rec {
     sha256 = "59a3429db53c50b5c6bcc8a07f8848cb00d7dc8bdb431a4ab41920d201d4756e";
   };
   mistune_2_0 = self.callPackage ./common.nix {
-    version = "2.0.0a4";
-    sha256 = "0i6cblmjl58kdmaa21xm0l1ls0kvjpfy45sf73fw3ws6305f628k";
+    version = "2.0.0rc1";
+    sha256 = "1nd7iav1ixh9hlj4hxn6lmpava88d86ys8rqm30wgvr7gjlxnas5";
   };
   mistune = mistune_0_8;
 }
diff --git a/pkgs/development/python-modules/mlflow/default.nix b/pkgs/development/python-modules/mlflow/default.nix
index b50d98513a2f..6ef5788b8418 100644
--- a/pkgs/development/python-modules/mlflow/default.nix
+++ b/pkgs/development/python-modules/mlflow/default.nix
@@ -25,12 +25,12 @@
 
 buildPythonPackage rec {
   pname = "mlflow";
-  version = "1.20.1";
+  version = "1.20.2";
   disabled = isPy27;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "71764443c4942f181fee2d5bf44dd74a0507bcc5b62a1f1e08079d1f40a15fc0";
+    sha256 = "b15ff0c7e5e64f864a0b40c99b9a582227315eca2065d9f831db9aeb8f24637b";
   };
 
   # run into https://stackoverflow.com/questions/51203641/attributeerror-module-alembic-context-has-no-attribute-config
diff --git a/pkgs/development/python-modules/more-itertools/default.nix b/pkgs/development/python-modules/more-itertools/default.nix
index d523a0bdb1e8..a03b3a06c393 100644
--- a/pkgs/development/python-modules/more-itertools/default.nix
+++ b/pkgs/development/python-modules/more-itertools/default.nix
@@ -9,11 +9,11 @@
 
 buildPythonPackage rec {
   pname = "more-itertools";
-  version = "8.8.0";
+  version = "8.10.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "83f0308e05477c68f56ea3a888172c78ed5d5b3c282addb67508e7ba6c8f813a";
+    sha256 = "sha256-HevKvrHfeTgUhZ1kqBrXyxBQTCQ0k2jM8hTGZMR09B8=";
   };
 
   checkInputs = [ nose ];
diff --git a/pkgs/development/python-modules/msal/default.nix b/pkgs/development/python-modules/msal/default.nix
index aa8daa1a2e8d..aaacce907927 100644
--- a/pkgs/development/python-modules/msal/default.nix
+++ b/pkgs/development/python-modules/msal/default.nix
@@ -21,6 +21,13 @@ buildPythonPackage rec {
     requests
   ];
 
+  # we already have cryptography included, version bounds are causing issues
+  postPatch = ''
+    substituteInPlace setup.py \
+      --replace "PyJWT[crypto]>=1.0.0,<3" "PyJWT" \
+      --replace "cryptography>=0.6,<38" "cryptography"
+  '';
+
   # Tests assume Network Connectivity:
   # https://github.com/AzureAD/microsoft-authentication-library-for-python/blob/e2958961e8ec16d0af4199f60c36c3f913497e48/tests/test_authority.py#L73
   doCheck = false;
diff --git a/pkgs/development/python-modules/multidict/default.nix b/pkgs/development/python-modules/multidict/default.nix
index ec19843ab9dc..6a167697f9cd 100644
--- a/pkgs/development/python-modules/multidict/default.nix
+++ b/pkgs/development/python-modules/multidict/default.nix
@@ -1,22 +1,27 @@
 { lib
 , fetchPypi
 , buildPythonPackage
-, pytestCheckHook, pytest-runner, pytest-cov
+, pytestCheckHook
 , isPy3k
 }:
 
 buildPythonPackage rec {
   pname = "multidict";
-  version = "5.1.0";
+  version = "5.2.0";
+
+  disabled = !isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "25b4e5f22d3a37ddf3effc0710ba692cfc792c2b9edfb9c05aefe823256e84d5";
+    sha256 = "0dd1c93edb444b33ba2274b66f63def8a327d607c6c790772f448a53b6ea59ce";
   };
 
-  checkInputs = [ pytestCheckHook pytest-runner pytest-cov ];
+  postPatch = ''
+    substituteInPlace setup.cfg \
+      --replace "--cov=multidict --cov-report term-missing:skip-covered --cov-report xml" ""
+  '';
 
-  disabled = !isPy3k;
+  checkInputs = [ pytestCheckHook ];
 
   meta = with lib; {
     description = "Multidict implementation";
diff --git a/pkgs/development/python-modules/multimethod/default.nix b/pkgs/development/python-modules/multimethod/default.nix
index af2e5950dc2d..fe2bb2ef45c1 100644
--- a/pkgs/development/python-modules/multimethod/default.nix
+++ b/pkgs/development/python-modules/multimethod/default.nix
@@ -1,21 +1,23 @@
 { lib
 , buildPythonPackage
-, fetchPypi
+, fetchFromGitHub
 , pytestCheckHook
-, pytest-cov
 }:
+
 buildPythonPackage rec {
   pname = "multimethod";
-  version = "1.5";
+  version = "1.6";
+  format = "pyproject";
 
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "b9c6f85ecf187f14a3951fff319643e1fac3086d757dec64f2469e1fd136b65d";
+  src = fetchFromGitHub {
+    owner = "coady";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "09vrxzv8q0lqsbh6d83wjdd29ja66rj31y7wmyha14jk603fd9k0";
   };
 
   checkInputs = [
     pytestCheckHook
-    pytest-cov
   ];
 
   pythonImportsCheck = [
diff --git a/pkgs/development/python-modules/mypy-protobuf/default.nix b/pkgs/development/python-modules/mypy-protobuf/default.nix
index c7194d19b5cb..fdcfed839c78 100644
--- a/pkgs/development/python-modules/mypy-protobuf/default.nix
+++ b/pkgs/development/python-modules/mypy-protobuf/default.nix
@@ -2,13 +2,14 @@
 
 buildPythonApplication rec {
   pname = "mypy-protobuf";
-  version = "2.9";
+  version = "2.10";
+  format = "pyproject";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "278172935d7121c2f8c7c0a05518dd565a2b76d9e9c4a0a3fcd08a21fa685d43";
+    sha256 = "1fed214e16351b09946770794a321a818abb744078b1d863a479da070028684c";
   };
 
   propagatedBuildInputs = [ protobuf types-protobuf grpcio-tools ];
diff --git a/pkgs/development/python-modules/nbconvert/default.nix b/pkgs/development/python-modules/nbconvert/default.nix
index 67d08f9e50ff..1d6e988b2480 100644
--- a/pkgs/development/python-modules/nbconvert/default.nix
+++ b/pkgs/development/python-modules/nbconvert/default.nix
@@ -23,11 +23,11 @@
 
 buildPythonPackage rec {
   pname = "nbconvert";
-  version = "6.1.0";
+  version = "6.2.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "d22a8ff202644d31db254d24d52c3a96c82156623fcd7c7f987bba2612303ec9";
+    sha256 = "16ceecd0afaa8fd26c245fa32e2c52066c02f13aa73387fffafd84750baea863";
   };
 
   # Add $out/share/jupyter to the list of paths that are used to search for
diff --git a/pkgs/development/python-modules/networkx/default.nix b/pkgs/development/python-modules/networkx/default.nix
index 0ed9f3b9cb3c..e8769f9efc7d 100644
--- a/pkgs/development/python-modules/networkx/default.nix
+++ b/pkgs/development/python-modules/networkx/default.nix
@@ -10,11 +10,11 @@
 buildPythonPackage rec {
   pname = "networkx";
   # upgrade may break sage, please test the sage build or ping @timokau on upgrade
-  version = "2.6.2";
+  version = "2.6.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "2306f1950ce772c5a59a57f5486d59bb9cab98497c45fc49cbc45ac0dec119bb";
+    sha256 = "c0946ed31d71f1b732b5aaa6da5a0388a345019af232ce2f49c766e2d6795c51";
   };
 
   propagatedBuildInputs = [ decorator setuptools ];
diff --git a/pkgs/development/python-modules/nilearn/default.nix b/pkgs/development/python-modules/nilearn/default.nix
index 6e3158b27961..41f84dbb6679 100644
--- a/pkgs/development/python-modules/nilearn/default.nix
+++ b/pkgs/development/python-modules/nilearn/default.nix
@@ -3,11 +3,11 @@
 
 buildPythonPackage rec {
   pname = "nilearn";
-  version = "0.8.0";
+  version = "0.8.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "f2d3dc81005f829f3a183efa6c90d698ea6818c06264d2e3f03e805c4340febb";
+    sha256 = "a0489940855130f35bbc4cac0750479a6f82025215ea7b1d778faca064219298";
   };
 
   checkInputs = [ pytestCheckHook ];
diff --git a/pkgs/development/python-modules/nmigen/default.nix b/pkgs/development/python-modules/nmigen/default.nix
index 8bd198713a3f..0228e7b3185c 100644
--- a/pkgs/development/python-modules/nmigen/default.nix
+++ b/pkgs/development/python-modules/nmigen/default.nix
@@ -55,7 +55,8 @@ buildPythonPackage rec {
 
   postPatch = ''
     substituteInPlace setup.py \
-      --replace "Jinja2~=2.11" "Jinja2>=2.11"
+      --replace "Jinja2~=2.11" "Jinja2>=2.11" \
+      --replace "pyvcd~=0.2.2" "pyvcd"
   '';
 
   pythonImportsCheck = [ "nmigen" ];
diff --git a/pkgs/development/python-modules/notebook/default.nix b/pkgs/development/python-modules/notebook/default.nix
index bc1296b8a50c..45be74a9e6e1 100644
--- a/pkgs/development/python-modules/notebook/default.nix
+++ b/pkgs/development/python-modules/notebook/default.nix
@@ -27,12 +27,12 @@
 
 buildPythonPackage rec {
   pname = "notebook";
-  version = "6.4.3";
+  version = "6.4.4";
   disabled = !isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "03awxl8hr7ibwr6n48gci8jx80f18zll439wyr8gj35h6vnxzdp6";
+    sha256 = "26b0095c568e307a310fd78818ad8ebade4f00462dada4c0e34cbad632b9085d";
   };
 
   LC_ALL = "en_US.utf8";
diff --git a/pkgs/development/python-modules/numba/default.nix b/pkgs/development/python-modules/numba/default.nix
index 287737900b89..c45419c5c88c 100644
--- a/pkgs/development/python-modules/numba/default.nix
+++ b/pkgs/development/python-modules/numba/default.nix
@@ -12,13 +12,13 @@
 }:
 
 buildPythonPackage rec {
-  version = "0.54.0";
+  version = "0.54.1";
   pname = "numba";
   disabled = pythonOlder "3.6" || pythonAtLeast "3.10";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "bad6bd98ab2e41c34aa9c80b8d9737e07d92a53df4f74d3ada1458b0b516ccff";
+    sha256 = "f9dfc803c864edcc2381219b800abf366793400aea55e26d4d5b7d953e14f43f";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/ocrmypdf/default.nix b/pkgs/development/python-modules/ocrmypdf/default.nix
index 5c6b87b38fed..b6aef62dd74d 100644
--- a/pkgs/development/python-modules/ocrmypdf/default.nix
+++ b/pkgs/development/python-modules/ocrmypdf/default.nix
@@ -5,6 +5,7 @@
 , fetchFromGitHub
 , ghostscript
 , img2pdf
+, importlib-metadata
 , importlib-resources
 , jbig2enc
 , leptonica
@@ -15,6 +16,7 @@
 , pngquant
 , pytest-xdist
 , pytestCheckHook
+, pythonOlder
 , reportlab
 , setuptools
 , setuptools-scm
@@ -28,7 +30,7 @@
 
 buildPythonPackage rec {
   pname = "ocrmypdf";
-  version = "12.6.0";
+  version = "12.7.0";
 
   src = fetchFromGitHub {
     owner = "jbarlow83";
@@ -40,7 +42,7 @@ buildPythonPackage rec {
     extraPostFetch = ''
       rm "$out/.git_archival.txt"
     '';
-    sha256 = "0zw7c6l9fkf128gxsbd7v4abazlxiygqys6627jpsjbmxg5jgp5w";
+    sha256 = "sha256-lpTuaZRrmFoKV1SAFoGpsYfPBkLB2+iB63fg3t9RC5o=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
@@ -66,7 +68,6 @@ buildPythonPackage rec {
     cffi
     coloredlogs
     img2pdf
-    importlib-resources
     pdfminer
     pikepdf
     pillow
@@ -74,7 +75,11 @@ buildPythonPackage rec {
     reportlab
     setuptools
     tqdm
-  ];
+  ] ++ (lib.optionals (pythonOlder "3.8") [
+    importlib-metadata
+  ]) ++ (lib.optionals (pythonOlder "3.9") [
+    importlib-resources
+  ]);
 
   checkInputs = [
     pytest-xdist
diff --git a/pkgs/development/python-modules/openpyxl/default.nix b/pkgs/development/python-modules/openpyxl/default.nix
index 317aba65621a..f8b97b6f2ea3 100644
--- a/pkgs/development/python-modules/openpyxl/default.nix
+++ b/pkgs/development/python-modules/openpyxl/default.nix
@@ -10,12 +10,12 @@
 
 buildPythonPackage rec {
   pname = "openpyxl";
-  version = "3.0.7";
+  version = "3.0.9";
   disabled = isPy27; # 2.6.4 was final python2 release
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "6456a3b472e1ef0facb1129f3c6ef00713cebf62e736cd7a75bcc3247432f251";
+    sha256 = "40f568b9829bf9e446acfffce30250ac1fa39035124d55fc024025c41481c90f";
   };
 
   checkInputs = [ pytest ];
diff --git a/pkgs/development/python-modules/optuna/default.nix b/pkgs/development/python-modules/optuna/default.nix
index 457d796d0b78..b7247083be43 100644
--- a/pkgs/development/python-modules/optuna/default.nix
+++ b/pkgs/development/python-modules/optuna/default.nix
@@ -30,14 +30,14 @@
 
 buildPythonPackage rec {
   pname = "optuna";
-  version = "2.9.1";
+  version = "2.10.0";
   disabled = isPy27;
 
   src = fetchFromGitHub {
     owner = "optuna";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1fx80qjrkmnvn2mg9fx26qn3sjlwnwqlmkaf6sqhdw79pn6khlpi";
+    sha256 = "0fha0pwxq6n3mbpvpz3vk8hh61zqncj5cnq063kzfl5d8rd48vcd";
   };
 
   checkInputs = [
diff --git a/pkgs/development/python-modules/pandas/default.nix b/pkgs/development/python-modules/pandas/default.nix
index 52a77826f2d6..019429111308 100644
--- a/pkgs/development/python-modules/pandas/default.nix
+++ b/pkgs/development/python-modules/pandas/default.nix
@@ -33,11 +33,11 @@
 
 buildPythonPackage rec {
   pname = "pandas";
-  version = "1.3.2";
+  version = "1.3.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "cbcb84d63867af3411fa063af3de64902665bb5b3d40b25b2059e40603594e87";
+    sha256 = "272c8cb14aa9793eada6b1ebe81994616e647b5892a370c7135efb2924b701df";
   };
 
   nativeBuildInputs = [ cython ];
diff --git a/pkgs/development/python-modules/pandocfilters/default.nix b/pkgs/development/python-modules/pandocfilters/default.nix
index 8ca57440b3f7..9dac79bea743 100644
--- a/pkgs/development/python-modules/pandocfilters/default.nix
+++ b/pkgs/development/python-modules/pandocfilters/default.nix
@@ -4,12 +4,12 @@
 }:
 
 buildPythonPackage rec {
-  version = "1.4.3";
+  version = "1.5.0";
   pname = "pandocfilters";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "bc63fbb50534b4b1f8ebe1860889289e8af94a23bff7445259592df25a3906eb";
+    sha256 = "0b679503337d233b4339a817bfc8c50064e2eff681314376a47cb582305a7a38";
   };
 
   # No tests available
diff --git a/pkgs/development/python-modules/parfive/default.nix b/pkgs/development/python-modules/parfive/default.nix
index b525c39de220..e551dbb3e765 100644
--- a/pkgs/development/python-modules/parfive/default.nix
+++ b/pkgs/development/python-modules/parfive/default.nix
@@ -13,11 +13,11 @@
 
 buildPythonPackage rec {
   pname = "parfive";
-  version = "1.3.0";
+  version = "1.5.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "c3067e6ca9d6fb88a10958338360bd9c47edfd8ab11098d4c601f7f2887edadd";
+    sha256 = "f36128e8a93f3494ce3de8af883eeba4bd651ab228682810a46ec4b7897a84b3";
   };
 
   buildInputs = [
diff --git a/pkgs/development/python-modules/patsy/default.nix b/pkgs/development/python-modules/patsy/default.nix
index bd3c103b9a74..71bf10bb3c00 100644
--- a/pkgs/development/python-modules/patsy/default.nix
+++ b/pkgs/development/python-modules/patsy/default.nix
@@ -1,31 +1,35 @@
 { lib
 , fetchPypi
 , buildPythonPackage
-, nose
 , six
 , numpy
 , scipy # optional, allows spline-related features (see patsy's docs)
-, parameterized
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "patsy";
-  version = "0.5.1";
+  version = "0.5.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "149rbrdzwns0ay88caf1zsm1r53v1q5np1mrb36na50y432cw5gi";
+    sha256 = "5053de7804676aba62783dbb0f23a2b3d74e35e5bfa238b88b7cbf148a38b69d";
   };
 
-  checkInputs = [ nose parameterized ];
-  checkPhase = "nosetests -v";
-
   propagatedBuildInputs = [
     six
     numpy
     scipy
   ];
 
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "patsy"
+  ];
+
   meta = {
     description = "A Python package for describing statistical models";
     homepage = "https://github.com/pydata/patsy";
diff --git a/pkgs/development/python-modules/pdoc3/default.nix b/pkgs/development/python-modules/pdoc3/default.nix
index 1a3996311570..9edd16289918 100644
--- a/pkgs/development/python-modules/pdoc3/default.nix
+++ b/pkgs/development/python-modules/pdoc3/default.nix
@@ -1,4 +1,7 @@
-{ lib, buildPythonPackage, fetchPypi
+{ lib
+, buildPythonPackage
+, fetchPypi
+, fetchpatch
 , pythonOlder
 , Mako
 , markdown
@@ -16,8 +19,24 @@ buildPythonPackage rec {
     sha256 = "5f22e7bcb969006738e1aa4219c75a32f34c2d62d46dc9d2fb2d3e0b0287e4b7";
   };
 
-  nativeBuildInputs = [ setuptools-git setuptools-scm ];
-  propagatedBuildInputs = [ Mako markdown ];
+  patches = [
+    (fetchpatch {
+      # test_Class_params fails in 0.10.0
+      # https://github.com/pdoc3/pdoc/issues/355
+      url = "https://github.com/pdoc3/pdoc/commit/4aa70de2221a34a3003a7e5f52a9b91965f0e359.patch";
+      sha256 = "07sbf7bh09vgd5z1lbay604rz7rhg88414whs6iy60wwbvkz5c2v";
+    })
+  ];
+
+  nativeBuildInputs = [
+    setuptools-git
+    setuptools-scm
+  ];
+
+  propagatedBuildInputs = [
+    Mako
+    markdown
+  ];
 
   meta = with lib; {
     description = "Auto-generate API documentation for Python projects.";
diff --git a/pkgs/development/python-modules/pikepdf/default.nix b/pkgs/development/python-modules/pikepdf/default.nix
index 2b0b9bc4999a..ab78f2262445 100644
--- a/pkgs/development/python-modules/pikepdf/default.nix
+++ b/pkgs/development/python-modules/pikepdf/default.nix
@@ -2,7 +2,7 @@
 , attrs
 , buildPythonPackage
 , defusedxml
-, fetchPypi
+, fetchFromGitHub
 , hypothesis
 , isPy3k
 , jbig2dec
@@ -27,9 +27,17 @@ buildPythonPackage rec {
   version = "3.2.0";
   disabled = ! isPy3k;
 
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "a0582f00440668c07edb8403e82724961c7812c8e6c30655e34825b2645f15cd";
+  src = fetchFromGitHub {
+    owner = "pikepdf";
+    repo = "pikepdf";
+    rev = "v${version}";
+    # The content of .git_archival.txt is substituted upon tarball creation,
+    # which creates indeterminism if master no longer points to the tag.
+    # See https://github.com/jbarlow83/OCRmyPDF/issues/841
+    extraPostFetch = ''
+      rm "$out/.git_archival.txt"
+    '';
+    sha256 = "03c7ihd6rf6kdfc3cpgxy5pi6cj4zwscz8nyxmmp15fmdk3hkw4g";
   };
 
   patches = [
@@ -40,6 +48,8 @@ buildPythonPackage rec {
     })
   ];
 
+  SETUPTOOLS_SCM_PRETEND_VERSION = version;
+
   buildInputs = [
     pybind11
     qpdf
diff --git a/pkgs/development/python-modules/pip-tools/default.nix b/pkgs/development/python-modules/pip-tools/default.nix
index 9ac877be8848..1cda1fd87523 100644
--- a/pkgs/development/python-modules/pip-tools/default.nix
+++ b/pkgs/development/python-modules/pip-tools/default.nix
@@ -15,13 +15,13 @@
 
 buildPythonPackage rec {
   pname = "pip-tools";
-  version = "6.2.0";
+  version = "6.3.1";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "9ed38c73da4993e531694ea151f77048b4dbf2ba7b94c4a569daa39568cc6564";
+    sha256 = "992d968df6f1a19d4d37c53b68b3d4b601b894fb3ee0926d1fa762ebc7c7e9e9";
   };
 
   LC_ALL = "en_US.UTF-8";
diff --git a/pkgs/development/python-modules/plaid-python/default.nix b/pkgs/development/python-modules/plaid-python/default.nix
index b864dedecfe7..1250c88864dd 100644
--- a/pkgs/development/python-modules/plaid-python/default.nix
+++ b/pkgs/development/python-modules/plaid-python/default.nix
@@ -1,12 +1,12 @@
 { lib, buildPythonPackage, fetchPypi, requests, pytest }:
 
 buildPythonPackage rec {
-  version = "8.1.0";
+  version = "8.3.0";
   pname = "plaid-python";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "b1f7b5b58ba3c171bb795352119d54797c8c50877bc376d26cd756de2453e9fd";
+    sha256 = "b11779042bf6dcf1474a35a88bc52959ee41f1deeedcc6667b4d740a5627f28d";
   };
 
   checkInputs = [ pytest ];
diff --git a/pkgs/development/python-modules/platformdirs/default.nix b/pkgs/development/python-modules/platformdirs/default.nix
index f49b8716211e..062295a4eada 100644
--- a/pkgs/development/python-modules/platformdirs/default.nix
+++ b/pkgs/development/python-modules/platformdirs/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "platformdirs";
-  version = "2.3.0";
+  version = "2.4.0";
   disabled = pythonOlder "3.6";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = version;
-    sha256 = "sha256-g2DPNN7VxK3EjOXOpSWA4a+PghZ7v2jmjw9+VQyCTBI=";
+    sha256 = "sha256-Ox1CVq2M2eddZtpuZx0IfvuOm6RPsAs27WkMdZSeh0E=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
diff --git a/pkgs/development/python-modules/plotly/default.nix b/pkgs/development/python-modules/plotly/default.nix
index 4b849dd016b8..5ef6c785fed0 100644
--- a/pkgs/development/python-modules/plotly/default.nix
+++ b/pkgs/development/python-modules/plotly/default.nix
@@ -9,11 +9,11 @@
 
 buildPythonPackage rec {
   pname = "plotly";
-  version = "5.3.0";
+  version = "5.3.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "b6dc306c56e7d5fa7d017718894099b27290b427abf4acad8e5b77fdc3bd32ec";
+    sha256 = "6598393e898a9c5ae78397f76f07002ec41fd92e5f746d3b9806248d53885643";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pluggy/default.nix b/pkgs/development/python-modules/pluggy/default.nix
index 1a1c23f22d0a..8d1fcbed3a7f 100644
--- a/pkgs/development/python-modules/pluggy/default.nix
+++ b/pkgs/development/python-modules/pluggy/default.nix
@@ -2,6 +2,7 @@
 , lib
 , fetchPypi
 , setuptools-scm
+, pythonOlder
 , importlib-metadata
 }:
 
@@ -23,12 +24,14 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [ setuptools-scm ];
 
-  propagatedBuildInputs = [ importlib-metadata ];
+  propagatedBuildInputs = lib.optionals (pythonOlder "3.8") [
+    importlib-metadata
+  ];
 
   meta = {
     description = "Plugin and hook calling mechanisms for Python";
     homepage = "https://github.com/pytest-dev/pluggy";
     license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ ];
+    maintainers = with lib.maintainers; [ dotlambda ];
   };
 }
diff --git a/pkgs/development/python-modules/poetry-core/default.nix b/pkgs/development/python-modules/poetry-core/default.nix
index 7eef9e740d31..e8632d0ed078 100644
--- a/pkgs/development/python-modules/poetry-core/default.nix
+++ b/pkgs/development/python-modules/poetry-core/default.nix
@@ -1,4 +1,5 @@
 { lib, buildPythonPackage, fetchFromGitHub, pythonOlder, isPy27
+, git
 , importlib-metadata
 , intreehooks
 , pathlib2
@@ -12,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "poetry-core";
-  version = "1.0.4";
+  version = "1.0.7";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "python-poetry";
     repo = pname;
     rev = version;
-    sha256 = "0jgd4d7m5y8ly8n0l9lcq7cjab2y3hifk90f343ksmjzssfd5lg3";
+    sha256 = "0v86x8f8pcbviv2cdn7jjbgj3c994qasx0bqk1kr0mj8m6pjwy9z";
   };
 
   postPatch = lib.optionalString (pythonOlder "3.8") ''
@@ -41,6 +42,7 @@ buildPythonPackage rec {
   ];
 
   checkInputs = [
+    git
     pep517
     pytest-mock
     pytestCheckHook
diff --git a/pkgs/development/python-modules/poetry/default.nix b/pkgs/development/python-modules/poetry/default.nix
index 29477474c845..368f28212882 100644
--- a/pkgs/development/python-modules/poetry/default.nix
+++ b/pkgs/development/python-modules/poetry/default.nix
@@ -24,7 +24,7 @@
 
 buildPythonPackage rec {
   pname = "poetry";
-  version = "1.1.8";
+  version = "1.1.11";
   format = "pyproject";
   disabled = isPy27;
 
@@ -32,7 +32,7 @@ buildPythonPackage rec {
     owner = "python-poetry";
     repo = pname;
     rev = version;
-    sha256 = "0qcgjb78nj69sppd8146519q9422xxg1bi34gyxy51sjkvd5lxhz";
+    sha256 = "1f3y3gav2snvcf2h9mbkinvnlcyl9kndf6bh6j0vxkxzlmb4zilx";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/portend/default.nix b/pkgs/development/python-modules/portend/default.nix
index d48f387400e4..52e46cec75a0 100644
--- a/pkgs/development/python-modules/portend/default.nix
+++ b/pkgs/development/python-modules/portend/default.nix
@@ -3,11 +3,11 @@
 
 buildPythonPackage rec {
   pname = "portend";
-  version = "2.7.1";
+  version = "2.7.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "986ed9a278e64a87b5b5f4c21e61c25bebdce9919a92238d9c14c37a7416482b";
+    sha256 = "3fbc0df9e4970b661e4d7386a91fc7bcf34ebeaf0333ce15d819d515a71ba8b2";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/prettytable/default.nix b/pkgs/development/python-modules/prettytable/default.nix
index 5b3253b31b39..ddaa842e9b11 100644
--- a/pkgs/development/python-modules/prettytable/default.nix
+++ b/pkgs/development/python-modules/prettytable/default.nix
@@ -10,11 +10,11 @@
 
 buildPythonPackage rec {
   pname = "prettytable";
-  version = "2.2.0";
+  version = "2.2.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "bd81678c108e6c73d4f1e47cd4283de301faaa6ff6220bcd1d4022038c56b416";
+    sha256 = "6d465005573a5c058d4ca343449a5b28c21252b86afcdfa168cdc6a440f0b24c";
   };
 
   nativeBuildInputs = [ setuptools-scm ];
diff --git a/pkgs/development/python-modules/proto-plus/default.nix b/pkgs/development/python-modules/proto-plus/default.nix
index e623840f1c65..a6d60567ef96 100644
--- a/pkgs/development/python-modules/proto-plus/default.nix
+++ b/pkgs/development/python-modules/proto-plus/default.nix
@@ -10,12 +10,12 @@
 
 buildPythonPackage rec {
   pname = "proto-plus";
-  version = "1.19.2";
+  version = "1.19.4";
   disabled = !isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-ylMLBxjGJbpj8VGrP83INrWTQ9FJt9/RXsLc6zhEwi0=";
+    sha256 = "416dc38b090ca2093f6fac74977ac4a5599e496483a43c0076e6f6a4dd77ed9c";
   };
 
   propagatedBuildInputs = [ protobuf ];
diff --git a/pkgs/development/python-modules/pudb/default.nix b/pkgs/development/python-modules/pudb/default.nix
index 6df85ca5f089..3459c5c99742 100644
--- a/pkgs/development/python-modules/pudb/default.nix
+++ b/pkgs/development/python-modules/pudb/default.nix
@@ -1,29 +1,43 @@
 { lib
 , buildPythonPackage
+, isPy3k
 , fetchPypi
+, jedi
 , pygments
 , urwid
-, isPy3k
+, pytest-mock
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "pudb";
   version = "2021.1";
+  disabled = !isPy3k;
 
   src = fetchPypi {
     inherit pname version;
     sha256 = "309ee82b45a0ffca0bc4c7f521fd3e357589c764f339bdf9dcabb7ad40692d6e";
   };
 
-  propagatedBuildInputs = [ pygments urwid ];
+  propagatedBuildInputs = [
+    jedi
+    pygments
+    urwid
+  ];
 
-  # Tests fail on python 3 due to writes to the read-only home directory
-  doCheck = !isPy3k;
+  preCheck = ''
+    export HOME=$TMPDIR
+  '';
+
+  checkInputs = [
+    pytest-mock
+    pytestCheckHook
+  ];
 
   meta = with lib; {
     description = "A full-screen, console-based Python debugger";
+    homepage = "https://github.com/inducer/pudb";
     license = licenses.mit;
-    platforms = platforms.all;
+    maintainers = with maintainers; [ ];
   };
-
 }
diff --git a/pkgs/development/python-modules/pyatv/default.nix b/pkgs/development/python-modules/pyatv/default.nix
index eaeda0ed3417..253c35e5ab57 100644
--- a/pkgs/development/python-modules/pyatv/default.nix
+++ b/pkgs/development/python-modules/pyatv/default.nix
@@ -1,11 +1,11 @@
 { lib
 , buildPythonPackage
 , aiohttp
-, audio-metadata
 , bitarray
 , cryptography
 , deepdiff
 , fetchFromGitHub
+, mediafile
 , miniaudio
 , netifaces
 , protobuf
@@ -19,13 +19,13 @@
 
 buildPythonPackage rec {
   pname = "pyatv";
-  version = "0.8.2";
+  version = "0.9.2";
 
   src = fetchFromGitHub {
     owner = "postlund";
     repo = pname;
     rev = "v${version}";
-    sha256 = "035cjm78xakvfi7k8zahjk0xr23p9my67d8jvq5bqrd506awrl0f";
+    sha256 = "0rpf8qspk433jpj7qy3mv20vf3hbm6msx3mii5kq0dmsh5pqy6h4";
   };
 
   postPatch = ''
@@ -35,9 +35,9 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [
     aiohttp
-    audio-metadata
     bitarray
     cryptography
+    mediafile
     miniaudio
     netifaces
     protobuf
diff --git a/pkgs/development/python-modules/pybind11/default.nix b/pkgs/development/python-modules/pybind11/default.nix
index e6be3f063fef..fccc064f23ef 100644
--- a/pkgs/development/python-modules/pybind11/default.nix
+++ b/pkgs/development/python-modules/pybind11/default.nix
@@ -12,13 +12,13 @@
 
 buildPythonPackage rec {
   pname = "pybind11";
-  version = "2.7.1";
+  version = "2.8.0";
 
   src = fetchFromGitHub {
     owner = "pybind";
     repo = pname;
     rev = "v${version}";
-    sha256 = "13nq16pxz4vck7jn936ymhm0y0q82hd7kkw0ip7k85cx7wywzbql";
+    sha256 = "sha256-kmyfRNZM9AtF0QA1MnWEPwWb6BebkkpanTvQwsraSJo=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/python-modules/pycountry/default.nix b/pkgs/development/python-modules/pycountry/default.nix
index 525a56107118..868504e39949 100644
--- a/pkgs/development/python-modules/pycountry/default.nix
+++ b/pkgs/development/python-modules/pycountry/default.nix
@@ -1,7 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-,
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
@@ -13,10 +13,19 @@ buildPythonPackage rec {
     sha256 = "0hnbabsmqimx5hqh0jbd2f64i8fhzhhbrvid57048hs5sd9ll241";
   };
 
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "pycountry"
+  ];
+
   meta = with lib; {
-    homepage = "https://bitbucket.org/flyingcircus/pycountry";
+    homepage = "https://github.com/flyingcircusio/pycountry";
     description = "ISO country, subdivision, language, currency and script definitions and their translations";
     license = licenses.lgpl2;
+    maintainers = with maintainers; [ ];
   };
 
 }
diff --git a/pkgs/development/python-modules/pycryptodome/default.nix b/pkgs/development/python-modules/pycryptodome/default.nix
index 0c57ad9c96f2..19b2447acb11 100644
--- a/pkgs/development/python-modules/pycryptodome/default.nix
+++ b/pkgs/development/python-modules/pycryptodome/default.nix
@@ -1,12 +1,12 @@
 { lib, fetchPypi, buildPythonPackage }:
 
 buildPythonPackage rec {
-  version = "3.10.1";
+  version = "3.11.0";
   pname = "pycryptodome";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "3e2e3a06580c5f190df843cdb90ea28d61099cf4924334d5297a995de68e4673";
+    sha256 = "428096bbf7a77e207f418dfd4d7c284df8ade81d2dc80f010e92753a3e406ad0";
   };
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/pycryptodomex/default.nix b/pkgs/development/python-modules/pycryptodomex/default.nix
index fae49e7be0a7..eab3a6b0bbd5 100644
--- a/pkgs/development/python-modules/pycryptodomex/default.nix
+++ b/pkgs/development/python-modules/pycryptodomex/default.nix
@@ -5,11 +5,11 @@
 
 buildPythonPackage rec {
   pname = "pycryptodomex";
-  version = "3.10.1";
+  version = "3.11.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-VBzT4+JS+xmntI9CC3mLU0gzArf+TZlUyUdgXQomPWI=";
+    sha256 = "0398366656bb55ebdb1d1d493a7175fc48ade449283086db254ac44c7d318d6d";
   };
 
   pythonImportsCheck = [ "Cryptodome" ];
diff --git a/pkgs/development/python-modules/pyexcel/default.nix b/pkgs/development/python-modules/pyexcel/default.nix
index ca562ca5586b..c6bc3cf0777f 100644
--- a/pkgs/development/python-modules/pyexcel/default.nix
+++ b/pkgs/development/python-modules/pyexcel/default.nix
@@ -2,41 +2,38 @@
 , buildPythonPackage
 , fetchPypi
 , isPy3k
+, chardet
 , lml
 , pyexcel-io
 , texttable
-, nose
 }:
 
 buildPythonPackage rec {
   pname = "pyexcel";
-  version = "0.6.6";
+  version = "0.6.7";
 
   disabled = !isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "39b0bb8f033d9b5523b126cf5a5259d1990ea82b8a23c8eab7aa5e23116803df";
+    sha256 = "cbbd9875729767564b3b64b6ed6a9870b14631184943d13646833d94157dd10f";
   };
 
   propagatedBuildInputs = [
+    chardet
     lml
     pyexcel-io
     texttable
   ];
 
-  checkInputs = [
-    nose
+  pythonImportsCheck = [
+    "pyexcel"
   ];
 
   # Tests depend on pyexcel-xls & co. causing circular dependency.
   # https://github.com/pyexcel/pyexcel/blob/dev/tests/requirements.txt
   doCheck = false;
 
-  pythonImportsCheck = [ "pyexcel" ];
-
-  checkPhase = "nosetests";
-
   meta = {
     description = "Single API for reading, manipulating and writing data in csv, ods, xls, xlsx and xlsm files";
     homepage = "http://docs.pyexcel.org/";
diff --git a/pkgs/development/python-modules/pyflakes/default.nix b/pkgs/development/python-modules/pyflakes/default.nix
index 1f098ed781c8..f8e00b20e726 100644
--- a/pkgs/development/python-modules/pyflakes/default.nix
+++ b/pkgs/development/python-modules/pyflakes/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "pyflakes";
-  version = "2.3.1";
+  version = "2.4.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "f5bc8ecabc05bb9d291eb5203d6810b49040f6ff446a756326104746cc00c1db";
+    sha256 = "05a85c2872edf37a4ed30b0cce2f6093e1d0581f8c19d7393122da7e25b2b24c";
   };
 
   checkInputs = [ unittest2 ];
diff --git a/pkgs/development/python-modules/pygit2/default.nix b/pkgs/development/python-modules/pygit2/default.nix
index 1ec0c6a97b39..d0cd948bdcde 100644
--- a/pkgs/development/python-modules/pygit2/default.nix
+++ b/pkgs/development/python-modules/pygit2/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "pygit2";
-  version = "1.6.1";
+  version = "1.7.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "c3303776f774d3e0115c1c4f6e1fc35470d15f113a7ae9401a0b90acfa1661ac";
+    sha256 = "602bffa8b4dbc185a6c7f36515563b600e0ee9002583c97ae3150eedaf340edb";
   };
 
   preConfigure = lib.optionalString stdenv.isDarwin ''
diff --git a/pkgs/development/python-modules/pylint/default.nix b/pkgs/development/python-modules/pylint/default.nix
index 2e4953ec7b9b..4bf6c4ad93e8 100644
--- a/pkgs/development/python-modules/pylint/default.nix
+++ b/pkgs/development/python-modules/pylint/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "pylint";
-  version = "2.10.2";
+  version = "2.11.1";
 
   disabled = pythonOlder "3.6";
 
@@ -24,7 +24,7 @@ buildPythonPackage rec {
     owner = "PyCQA";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-hkrkgUdC5LO1oSPFL6gvIk0zFpMw45gCmnoRbdPZuRs=";
+    sha256 = "08kc9139v1sd0vhna0rqikyds0xq8hxv0j9707n2i1nbv2z6xhsv";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/pymatgen/default.nix b/pkgs/development/python-modules/pymatgen/default.nix
index 56e436e96d2c..cc262e004fd3 100644
--- a/pkgs/development/python-modules/pymatgen/default.nix
+++ b/pkgs/development/python-modules/pymatgen/default.nix
@@ -21,11 +21,11 @@
 
 buildPythonPackage rec {
   pname = "pymatgen";
-  version = "2022.0.12";
+  version = "2022.0.14";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "bad712c883a12d774a8a58c35abc5d582c5e5eafdbb5351dc06ebe98c28bd135";
+    sha256 = "03d24ebafc21becab376c26de09437dd5cfb7bda7099046194e95b4c9fa35209";
   };
 
   nativeBuildInputs = [ glibcLocales ];
diff --git a/pkgs/development/python-modules/pyperf/default.nix b/pkgs/development/python-modules/pyperf/default.nix
index f4239fb92252..40a77fc0c7bd 100644
--- a/pkgs/development/python-modules/pyperf/default.nix
+++ b/pkgs/development/python-modules/pyperf/default.nix
@@ -15,11 +15,11 @@
 
 buildPythonPackage rec {
   pname = "pyperf";
-  version = "2.2.0";
+  version = "2.3.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "498bb4d1fe21350c2b7c1aa8bb3eae9c9979358d0b66327954bc66839fcba8b6";
+    sha256 = "8a85dd42e067131d5b26b71472336da7f7f4b87ff9c97350d89f5ff0de9adedc";
   };
 
   checkInputs = [ nose psutil ] ++
diff --git a/pkgs/development/python-modules/pytest-astropy/default.nix b/pkgs/development/python-modules/pytest-astropy/default.nix
index f6736a736c34..db52ca9f6a85 100644
--- a/pkgs/development/python-modules/pytest-astropy/default.nix
+++ b/pkgs/development/python-modules/pytest-astropy/default.nix
@@ -15,12 +15,12 @@
 
 buildPythonPackage rec {
   pname = "pytest-astropy";
-  version = "0.8.0";
+  version = "0.9.0";
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "619800eb2cbf64548fbea25268efe7c6f6ae206cb4825f34abd36f27bcf946a2";
+    sha256 = "7cdac1b2a5460f37477a329712c3a5d4af4ddf876b064731995663621be4308b";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/pytest-doctestplus/default.nix b/pkgs/development/python-modules/pytest-doctestplus/default.nix
index 8cd73f483fa8..0ae23ff57276 100644
--- a/pkgs/development/python-modules/pytest-doctestplus/default.nix
+++ b/pkgs/development/python-modules/pytest-doctestplus/default.nix
@@ -10,12 +10,12 @@
 
 buildPythonPackage rec {
   pname = "pytest-doctestplus";
-  version = "0.10.1";
+  version = "0.11.0";
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "7e9e0912c206c53cd6ee996265aa99d5c99c9334e37d025ce6114bc0416ffc14";
+    sha256 = "efcb24a366d3b033d343298c2a60eae418b06803c85373450f10306815c7c632";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/pytest-xdist/default.nix b/pkgs/development/python-modules/pytest-xdist/default.nix
index e9b13177d9dd..b8f4814e533f 100644
--- a/pkgs/development/python-modules/pytest-xdist/default.nix
+++ b/pkgs/development/python-modules/pytest-xdist/default.nix
@@ -13,12 +13,12 @@
 
 buildPythonPackage rec {
   pname = "pytest-xdist";
-  version = "2.3.0";
+  version = "2.4.0";
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "e8ecde2f85d88fbcadb7d28cb33da0fa29bca5cf7d5967fa89fc0e97e5299ea5";
+    sha256 = "89b330316f7fc475f999c81b577c2b926c9569f3d397ae432c0c2e2496d61ff9";
   };
 
   nativeBuildInputs = [ setuptools-scm ];
diff --git a/pkgs/development/python-modules/python-miio/default.nix b/pkgs/development/python-modules/python-miio/default.nix
index 48c9f9a404d3..46900dd80e3d 100644
--- a/pkgs/development/python-modules/python-miio/default.nix
+++ b/pkgs/development/python-modules/python-miio/default.nix
@@ -37,6 +37,7 @@ buildPythonPackage rec {
     substituteInPlace pyproject.toml \
       --replace 'click = "^7"' 'click = "*"' \
       --replace 'croniter = "^0"' 'croniter = "*"' \
+      --replace 'cryptography = "^3"' 'cryptography = "*"' \
       --replace 'defusedxml = "^0.6"' 'defusedxml = "*"'
   '';
 
@@ -74,4 +75,3 @@ buildPythonPackage rec {
     maintainers = with maintainers; [ flyfloh ];
   };
 }
-
diff --git a/pkgs/development/python-modules/pytz/default.nix b/pkgs/development/python-modules/pytz/default.nix
index 1a1e1585d289..f7f406e487cc 100644
--- a/pkgs/development/python-modules/pytz/default.nix
+++ b/pkgs/development/python-modules/pytz/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "pytz";
-  version = "2021.1";
+  version = "2021.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-g6SpCJS/OOJDzwUsi1jzgb/pp6SD9qnKsUC8f3AqxNo=";
+    sha256 = "acad2d8b20a1af07d4e4c9d2e9285c5ed9104354062f275f3fcd88dcef4f1326";
   };
 
   checkPhase = ''
diff --git a/pkgs/development/python-modules/pyvcd/default.nix b/pkgs/development/python-modules/pyvcd/default.nix
index 09f995412fcd..464e10c33179 100644
--- a/pkgs/development/python-modules/pyvcd/default.nix
+++ b/pkgs/development/python-modules/pyvcd/default.nix
@@ -4,33 +4,30 @@
 , pythonOlder
 , setuptools-scm
 , six
-, pytest
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
-  version = "0.2.4";
+  version = "0.3.0";
   pname = "pyvcd";
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "071e51a8362908ad5a2a12f078185639b98b20b653a56f01679de169d0fa425d";
+    sha256 = "ec4d9198bd20f9e07d78f6558ff8bcd45b172ee332e7e8a4588727eeb6a362bc";
   };
 
   buildInputs = [ setuptools-scm ];
+
   propagatedBuildInputs = [ six ];
 
-  checkPhase = ''
-    py.test
-  '';
-
-  checkInputs = [ pytest ];
+  checkInputs = [ pytestCheckHook ];
 
   meta = with lib; {
     description = "Python package for writing Value Change Dump (VCD) files";
     homepage = "https://github.com/SanDisk-Open-Source/pyvcd";
     changelog = "https://github.com/SanDisk-Open-Source/pyvcd/blob/${version}/CHANGELOG.rst";
     license = licenses.mit;
-    maintainers = [ maintainers.sb0 maintainers.emily ];
+    maintainers = with maintainers; [ sb0 emily ];
   };
 }
diff --git a/pkgs/development/python-modules/pyzmq/default.nix b/pkgs/development/python-modules/pyzmq/default.nix
index 816c46204f88..60fcce9442a8 100644
--- a/pkgs/development/python-modules/pyzmq/default.nix
+++ b/pkgs/development/python-modules/pyzmq/default.nix
@@ -9,11 +9,11 @@
 
 buildPythonPackage rec {
   pname = "pyzmq";
-  version = "22.2.1";
+  version = "22.3.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "6d18c76676771fd891ca8e0e68da0bbfb88e30129835c0ade748016adb3b6242";
+    sha256 = "8eddc033e716f8c91c6a2112f0a8ebc5e00532b4a6ae1eb0ccc48e027f9c671c";
   };
 
   checkInputs = [
diff --git a/pkgs/development/python-modules/qiling/default.nix b/pkgs/development/python-modules/qiling/default.nix
index 0bd86c3caf53..61787548f846 100644
--- a/pkgs/development/python-modules/qiling/default.nix
+++ b/pkgs/development/python-modules/qiling/default.nix
@@ -11,11 +11,11 @@
 }:
 buildPythonPackage rec {
   pname = "qiling";
-  version = "1.2.4";
+  version = "1.3.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "ecaa4415eea44f6f48021c1f7794c0d9fae7d64c8e43a3ff1d5de8e99bd963aa";
+    sha256 = "084ad706f6803d7de2391eab928ecf4cb3e8d892fd2988666d4791a422d6ab9a";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/qtpy/default.nix b/pkgs/development/python-modules/qtpy/default.nix
index 7ee51449ed90..ef981f19c664 100644
--- a/pkgs/development/python-modules/qtpy/default.nix
+++ b/pkgs/development/python-modules/qtpy/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "QtPy";
-  version = "1.10.0";
+  version = "1.11.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "3d20f010caa3b2c04835d6a2f66f8873b041bdaf7a76085c2a0d7890cdd65ea9";
+    sha256 = "d6e4ae3a41f1fcb19762b58f35ad6dd443b4bdc867a4cb81ef10ccd85403c92b";
   };
 
   # no concrete propagatedBuildInputs as multiple backends are supposed
diff --git a/pkgs/development/python-modules/rdflib/default.nix b/pkgs/development/python-modules/rdflib/default.nix
index 5b16e2f744e2..97a2fe532bc5 100644
--- a/pkgs/development/python-modules/rdflib/default.nix
+++ b/pkgs/development/python-modules/rdflib/default.nix
@@ -10,11 +10,11 @@
 
 buildPythonPackage rec {
   pname = "rdflib";
-  version = "6.0.0";
+  version = "6.0.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "7ce4d757eb26f4dd43205ec340d8c097f29e5adfe45d6ea20238c731dc679879";
+    sha256 = "f071caff0b68634e4a7bd1d66ea3416ac98f1cc3b915938147ea899c32608728";
   };
 
   propagatedBuildInputs = [isodate html5lib SPARQLWrapper ];
diff --git a/pkgs/development/python-modules/readme_renderer/default.nix b/pkgs/development/python-modules/readme_renderer/default.nix
index 0d22a0c56c9f..43d1494a58b0 100644
--- a/pkgs/development/python-modules/readme_renderer/default.nix
+++ b/pkgs/development/python-modules/readme_renderer/default.nix
@@ -13,12 +13,12 @@
 
 buildPythonPackage rec {
   pname = "readme_renderer";
-  version = "29.0";
+  version = "30.0";
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-kv1awr+Gd/MQ8zA6pLzludX58glKuYwp8TeR17gFo9s=";
+    sha256 = "sha256-gplwDXqRDDBAcqdgHq+tpnEqWwEaIBOUF+Gx6fBGRdg=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/regex/default.nix b/pkgs/development/python-modules/regex/default.nix
index 92ce64d186db..b62355bb2c10 100644
--- a/pkgs/development/python-modules/regex/default.nix
+++ b/pkgs/development/python-modules/regex/default.nix
@@ -7,11 +7,11 @@
 
 buildPythonPackage rec {
   pname = "regex";
-  version = "2021.8.28";
+  version = "2021.10.8";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "f585cbbeecb35f35609edccb95efd95a3e35824cd7752b586503f7e6087303f1";
+    sha256 = "26895d7c9bbda5c52b3635ce5991caa90fbb1ddfac9c9ff1c7ce505e2282fb2a";
   };
 
   # Sources for different Python releases are located in same folder
diff --git a/pkgs/development/python-modules/requests/default.nix b/pkgs/development/python-modules/requests/default.nix
index f7c2cdbf27ac..8ba7aef46074 100644
--- a/pkgs/development/python-modules/requests/default.nix
+++ b/pkgs/development/python-modules/requests/default.nix
@@ -36,12 +36,10 @@ buildPythonPackage rec {
   '';
 
   propagatedBuildInputs = [
-    brotlicffi
     certifi
-    charset-normalizer
-    chardet
     idna
     urllib3
+    chardet
   ] ++ lib.optionals (isPy3k) [
     brotlicffi
     charset-normalizer
diff --git a/pkgs/development/python-modules/rich/default.nix b/pkgs/development/python-modules/rich/default.nix
index 6c953a4579ea..ff330289734d 100644
--- a/pkgs/development/python-modules/rich/default.nix
+++ b/pkgs/development/python-modules/rich/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "rich";
-  version = "10.9.0";
+  version = "10.12.0";
   format = "pyproject";
   disabled = pythonOlder "3.6";
 
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "willmcgugan";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0lf2s7n9b31aavwl5xjl3x1pjc756s8pbk0whh5kag80z5v6qc32";
+    sha256 = "1qq4k0pxq3r0463z4h65i9rb8cvilpnqmparklj5y5qk6svz0y2n";
   };
 
   nativeBuildInputs = [ poetry-core ];
diff --git a/pkgs/development/python-modules/sanic-testing/default.nix b/pkgs/development/python-modules/sanic-testing/default.nix
index 5e7deb51362e..c99a78e0cc18 100644
--- a/pkgs/development/python-modules/sanic-testing/default.nix
+++ b/pkgs/development/python-modules/sanic-testing/default.nix
@@ -10,13 +10,13 @@
 
 buildPythonPackage rec {
   pname = "sanic-testing";
-  version = "0.6.0";
+  version = "0.7.0";
 
   src = fetchFromGitHub {
     owner = "sanic-org";
     repo = "sanic-testing";
     rev = "v${version}";
-    sha256 = "1pf619cd3dckn3d8gh18vbn7dflvb0mzpf6frx4y950x2j3rdplk";
+    sha256 = "0ib6rf1ly1059lfprc3hpmy377c3wfgfhnar6n4jgbxiyin7vzm7";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/schedule/default.nix b/pkgs/development/python-modules/schedule/default.nix
index 55dc83878060..4aad4dc1abd4 100644
--- a/pkgs/development/python-modules/schedule/default.nix
+++ b/pkgs/development/python-modules/schedule/default.nix
@@ -15,6 +15,13 @@ buildPythonPackage rec {
 
   buildInputs = [ mock ];
 
+  preCheck = ''
+    # https://github.com/dbader/schedule/issues/488
+    substituteInPlace test_schedule.py --replace \
+      "self.assertRaises(ScheduleValueError, every().day.until, datetime.time(hour=5))" \
+      "# self.assertRaises(ScheduleValueError, every().day.until, datetime.time(hour=5))"
+  '';
+
   meta = with lib; {
     description = "Python job scheduling for humans";
     homepage = "https://github.com/dbader/schedule";
diff --git a/pkgs/development/python-modules/schema-salad/default.nix b/pkgs/development/python-modules/schema-salad/default.nix
index e6342b90bba4..4e778054875e 100644
--- a/pkgs/development/python-modules/schema-salad/default.nix
+++ b/pkgs/development/python-modules/schema-salad/default.nix
@@ -12,11 +12,11 @@
 
 buildPythonPackage rec {
   pname = "schema-salad";
-  version = "8.1.20210721123742";
+  version = "8.2.20210918131710";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1549555b9b5656cfc690716f04fb76b9fa002feb278638c446522f030632b450";
+    sha256 = "464180407f49a3533cd5a5bc7db9254769bc77595ea00562bbe4a50493f7f445";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/setuptools-scm/default.nix b/pkgs/development/python-modules/setuptools-scm/default.nix
index 6713e5e84f4b..62568869b7bf 100644
--- a/pkgs/development/python-modules/setuptools-scm/default.nix
+++ b/pkgs/development/python-modules/setuptools-scm/default.nix
@@ -8,12 +8,12 @@
 
 buildPythonPackage rec {
   pname = "setuptools-scm";
-  version = "6.3.1";
+  version = "6.3.2";
 
   src = fetchPypi {
     pname = "setuptools_scm";
     inherit version;
-    sha256 = "sha256-D2omORKxN5jAKLmicdka873g5CeECRx5fezMOtOn9ZY=";
+    sha256 = "1wm0i27siyy1yqr9rv7lqvb65agay9051yi8jzmi8dgb3q4ai6m4";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/signify/default.nix b/pkgs/development/python-modules/signify/default.nix
index be0623b1b73b..dbad1a8167db 100644
--- a/pkgs/development/python-modules/signify/default.nix
+++ b/pkgs/development/python-modules/signify/default.nix
@@ -1,31 +1,49 @@
-{ lib, buildPythonPackage, fetchFromGitHub, pythonOlder, pytestCheckHook
-, certvalidator, pyasn1, pyasn1-modules
+{ lib
+, buildPythonPackage
+, pythonOlder
+, fetchFromGitHub
+, asn1crypto
+, certvalidator
+, oscrypto
+, pyasn1
+, pyasn1-modules
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "signify";
-  version = "0.3.0";
-  disabled = pythonOlder "3.5";
+  version = "0.4.0";
+  disabled = pythonOlder "3.6";
+  format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "ralphje";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-JxQECpwHhPm8TCVW/bCnEpu5I/WETyZVBx29SQE4NmE=";
+    sha256 = "sha256-YJc9RIqkEL7dd1ahE4IbxyyZgsZWBDqbXZAvI/nK24M=";
   };
-  patches = [
-    # Upstream patch is available here:
-    #  https://github.com/ralphje/signify/commit/8c345be954e898a317825bb450bed5ba0304b2b5.patch
-    # But update a couple other things and dont apply cleanly. This is an extract of the part
-    # we care about and breaks the tests after 2021-03-01
-    ./certificate-expiration-date.patch
+
+  propagatedBuildInputs = [
+    asn1crypto
+    certvalidator
+    oscrypto
+    pyasn1
+    pyasn1-modules
   ];
 
-  propagatedBuildInputs = [ certvalidator pyasn1 pyasn1-modules ];
+  pythonImportsCheck = [
+    "signify"
+  ];
 
-  checkInputs = [ pytestCheckHook ];
-  pytestFlagsArray = [ "-v" ];
-  pythonImportsCheck = [ "signify" ];
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  disabledTests = [
+    # chain doesn't validate because end-entitys certificate expired
+    # https://github.com/ralphje/signify/issues/27
+    "test_revoked_certificate"
+  ];
 
   meta = with lib; {
     homepage = "https://github.com/ralphje/signify";
diff --git a/pkgs/development/python-modules/sigtools/default.nix b/pkgs/development/python-modules/sigtools/default.nix
index 1d81ba5180cf..b61e64684c86 100644
--- a/pkgs/development/python-modules/sigtools/default.nix
+++ b/pkgs/development/python-modules/sigtools/default.nix
@@ -12,11 +12,11 @@
 
 buildPythonPackage rec {
   pname = "sigtools";
-  version = "2.0.2";
+  version = "2.0.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1b890f22ece64bc47d3d4e84c950581e83917794a6cf1548698145590e221aff";
+    sha256 = "e7789628ec0d02e421bca76532b0d5da149f96f09e7ed4a5cbf318624b75e949";
   };
 
   buildInputs = [ repeated_test sphinx mock coverage unittest2 ];
diff --git a/pkgs/development/python-modules/simpleai/default.nix b/pkgs/development/python-modules/simpleai/default.nix
index 2ad7fe9ba28d..9dbf40a54706 100644
--- a/pkgs/development/python-modules/simpleai/default.nix
+++ b/pkgs/development/python-modules/simpleai/default.nix
@@ -6,13 +6,13 @@
 }:
 
 buildPythonPackage rec {
-   version = "0.8.2";
+   version = "0.8.3";
    pname = "simpleai";
    disabled = isPy3k;
 
    src = fetchPypi {
      inherit pname version;
-     sha256 = "2927d460b09ff6dd177999c2f48f3275c84c956efe5b41b567b5316e2259d21e";
+     sha256 = "1d5be7a00f1f42ed86683019262acbb14e6eca1ed92ce7d7fdf932838d3742e5";
    };
 
    propagatedBuildInputs = [ numpy ];
diff --git a/pkgs/development/python-modules/sphinxcontrib-tikz/default.nix b/pkgs/development/python-modules/sphinxcontrib-tikz/default.nix
index cc5412fe42ff..44772172dffb 100644
--- a/pkgs/development/python-modules/sphinxcontrib-tikz/default.nix
+++ b/pkgs/development/python-modules/sphinxcontrib-tikz/default.nix
@@ -9,11 +9,11 @@
 
 buildPythonPackage rec {
   pname = "sphinxcontrib-tikz";
-  version = "0.4.14";
+  version = "0.4.15";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1614a45c960b80009dd42f96689122c9c0781018a0c5ec5828f4cdc5e35b11ad";
+    sha256 = "27f9a7a6a64f1bf3ea4dd0e963b7da7c7778948856c8d557a71d64ace086519f";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/spyder-kernels/default.nix b/pkgs/development/python-modules/spyder-kernels/default.nix
index 5ce41d8d7575..d19a52804b79 100644
--- a/pkgs/development/python-modules/spyder-kernels/default.nix
+++ b/pkgs/development/python-modules/spyder-kernels/default.nix
@@ -3,11 +3,11 @@
 
 buildPythonPackage rec {
   pname = "spyder-kernels";
-  version = "2.1.0";
+  version = "2.1.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "6c287207c7855bb581eae66ef8d990407382d5f9caccb1e0cabf909aaaf10c9b";
+    sha256 = "ab5c2a90d44f0a26e7a6862e3cb73bb2d7084bc72f9336d8c2d2a78c145c4645";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/spyder/default.nix b/pkgs/development/python-modules/spyder/default.nix
index dbe54d52e3a9..85a1293ab95f 100644
--- a/pkgs/development/python-modules/spyder/default.nix
+++ b/pkgs/development/python-modules/spyder/default.nix
@@ -8,13 +8,13 @@
 
 buildPythonPackage rec {
   pname = "spyder";
-  version = "5.1.1";
+  version = "5.1.5";
 
   disabled = isPy27;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "6551acfd6fedfebd1f938ef67d3db415b33540f8377e7de3f4d4a2a11dd1b915";
+    sha256 = "f9ce23187f5de18f489fb03c38d884e4484b9c7292f9831faaa029fb7752fc93";
   };
 
   nativeBuildInputs = [ pyqtwebengine.wrapQtAppsHook ];
diff --git a/pkgs/development/python-modules/sqlparse/default.nix b/pkgs/development/python-modules/sqlparse/default.nix
index 3ee59c391f88..29e92cdecb93 100644
--- a/pkgs/development/python-modules/sqlparse/default.nix
+++ b/pkgs/development/python-modules/sqlparse/default.nix
@@ -8,13 +8,13 @@
 
 buildPythonPackage rec {
   pname = "sqlparse";
-  version = "0.4.1";
+  version = "0.4.2";
 
   disabled = !isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0f91fd2e829c44362cbcfab3e9ae12e22badaa8a29ad5ff599f9ec109f0454e8";
+    sha256 = "0c00730c74263a94e5a9919ade150dfc3b19c574389985446148402998287dae";
   };
 
   nativeBuildInputs = [ installShellFiles ];
diff --git a/pkgs/development/python-modules/sqlsoup/default.nix b/pkgs/development/python-modules/sqlsoup/default.nix
index a6ffd3227cd4..df1f988a03eb 100644
--- a/pkgs/development/python-modules/sqlsoup/default.nix
+++ b/pkgs/development/python-modules/sqlsoup/default.nix
@@ -14,8 +14,9 @@ buildPythonPackage rec {
 
   meta = with lib; {
     description = "A one step database access tool, built on the SQLAlchemy ORM";
-    homepage = "https://bitbucket.org/zzzeek/sqlsoup";
+    homepage = "https://github.com/zzzeek/sqlsoup";
     license = licenses.mit;
     maintainers = [ maintainers.globin ];
+    broken = true; # incompatible with sqlalchemy>=1.4 and unmaintained since 2016
   };
 }
diff --git a/pkgs/development/python-modules/statsmodels/default.nix b/pkgs/development/python-modules/statsmodels/default.nix
index 9aebe88b7923..2be02376360f 100644
--- a/pkgs/development/python-modules/statsmodels/default.nix
+++ b/pkgs/development/python-modules/statsmodels/default.nix
@@ -13,12 +13,12 @@
 
 buildPythonPackage rec {
   pname = "statsmodels";
-  version = "0.12.2";
+  version = "0.13.0";
   disabled = isPy27;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "8ad7a7ae7cdd929095684118e3b05836c0ccb08b6a01fe984159475d174a1b10";
+    sha256 = "f2efc02011b7240a9e851acd76ab81150a07d35c97021cb0517887539a328f8a";
   };
 
   nativeBuildInputs = [ cython ];
diff --git a/pkgs/development/python-modules/subprocess-tee/default.nix b/pkgs/development/python-modules/subprocess-tee/default.nix
index e2e9ad081eaa..df15dcdfb4f1 100644
--- a/pkgs/development/python-modules/subprocess-tee/default.nix
+++ b/pkgs/development/python-modules/subprocess-tee/default.nix
@@ -8,11 +8,11 @@
 
 buildPythonPackage rec {
   pname = "subprocess-tee";
-  version = "0.3.2";
+  version = "0.3.5";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "01b0z8mcm568v9carhi0py1hs34wrbnlzyvdmhqzipql407kdpk2";
+    sha256 = "ff5cced589a4b8ac973276ca1ba21bb6e3de600cde11a69947ff51f696efd577";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/sympy/default.nix b/pkgs/development/python-modules/sympy/default.nix
index 0d9cf098e662..fcaa0bc27711 100644
--- a/pkgs/development/python-modules/sympy/default.nix
+++ b/pkgs/development/python-modules/sympy/default.nix
@@ -8,11 +8,11 @@
 
 buildPythonPackage rec {
   pname = "sympy";
-  version = "1.8";
+  version = "1.9";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1ca588a9f6ce6a323c5592f9635159c2093572826668a1022c75c75bdf0297cb";
+    sha256 = "c7a880e229df96759f955d4f3970d4cabce79f60f5b18830c08b90ce77cd5fdc";
   };
 
   checkInputs = [ glibcLocales ];
diff --git a/pkgs/development/python-modules/tempora/default.nix b/pkgs/development/python-modules/tempora/default.nix
index 7bd7605fc3ff..e9cd3e84fee5 100644
--- a/pkgs/development/python-modules/tempora/default.nix
+++ b/pkgs/development/python-modules/tempora/default.nix
@@ -6,11 +6,11 @@
 
 buildPythonPackage rec {
   pname = "tempora";
-  version = "4.1.1";
+  version = "4.1.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "c54da0f05405f04eb67abbb1dff4448fd91428b58cb00f0f645ea36f6a927950";
+    sha256 = "fd6cafd66b01390d53a760349cf0b3123844ec6ae3d1043d7190473ea9459138";
   };
 
   disabled = pythonOlder "3.2";
diff --git a/pkgs/development/python-modules/terminado/default.nix b/pkgs/development/python-modules/terminado/default.nix
index aff355d963ce..28b0eb09dbed 100644
--- a/pkgs/development/python-modules/terminado/default.nix
+++ b/pkgs/development/python-modules/terminado/default.nix
@@ -7,11 +7,11 @@
 
 buildPythonPackage rec {
   pname = "terminado";
-  version = "0.11.1";
+  version = "0.12.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "962b402edbb480718054dc37027bada293972ecadfb587b89f01e2b8660a2132";
+    sha256 = "b20fd93cc57c1678c799799d117874367cc07a3d2d55be95205b1a88fa08393f";
   };
 
   propagatedBuildInputs = [ ptyprocess tornado ];
diff --git a/pkgs/development/python-modules/termplotlib/default.nix b/pkgs/development/python-modules/termplotlib/default.nix
index 492d51dcb2ca..06432b673afd 100644
--- a/pkgs/development/python-modules/termplotlib/default.nix
+++ b/pkgs/development/python-modules/termplotlib/default.nix
@@ -9,13 +9,13 @@
 
 buildPythonPackage rec {
   pname = "termplotlib";
-  version = "0.3.8";
+  version = "0.3.9";
 
   src = fetchFromGitHub {
     owner = "nschloe";
     repo = pname;
     rev = "v${version}";
-    sha256 = "10k70pb7554cc2zwkcgxfak8nb7iqqw6njbnaqfdz07l4v9f6smm";
+    sha256 = "1qfrv2w7vb2bbjvd5lqfq57c23iqkry0pwmif1ha3asmz330rja1";
   };
 
   format = "pyproject";
diff --git a/pkgs/development/python-modules/tern/default.nix b/pkgs/development/python-modules/tern/default.nix
index b8aee5ab9315..64e1951bf446 100644
--- a/pkgs/development/python-modules/tern/default.nix
+++ b/pkgs/development/python-modules/tern/default.nix
@@ -16,11 +16,11 @@
 
 buildPythonPackage rec {
   pname = "tern";
-  version = "2.7.0";
+  version = "2.8.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "cfd59431cafd6adf05ccb94be964098d9301f83a03bf715def7861811e4a4b74";
+    sha256 = "dd7d8ad929ffe951b1f7f86310b9d5ba749b4306132c3611ff1d5a2c4d79d2bd";
   };
 
   preBuild = ''
diff --git a/pkgs/development/python-modules/tifffile/default.nix b/pkgs/development/python-modules/tifffile/default.nix
index 236f3443ca6b..f495541f5de1 100644
--- a/pkgs/development/python-modules/tifffile/default.nix
+++ b/pkgs/development/python-modules/tifffile/default.nix
@@ -13,11 +13,11 @@
 
 buildPythonPackage rec {
   pname = "tifffile";
-  version = "2021.8.8";
+  version = "2021.8.30";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "8260f31c4700143e8374ff6cde5cef7fe54fc9b7313afe88329f407881901dc5";
+    sha256 = "8760e61e30106ea0dab9ec42a238d70a3ff55dde9c54456e7b748fe717cb782d";
   };
 
   patches = lib.optional isPy27 ./python2-regex-compat.patch;
diff --git a/pkgs/development/python-modules/tomli/default.nix b/pkgs/development/python-modules/tomli/default.nix
index 79cd5a4f500c..19a0fe6135e5 100644
--- a/pkgs/development/python-modules/tomli/default.nix
+++ b/pkgs/development/python-modules/tomli/default.nix
@@ -7,7 +7,7 @@
 
 buildPythonPackage rec {
   pname = "tomli";
-  version = "1.1.0";
+  version = "1.2.1";
   format = "pyproject";
 
   outputs = [
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "hukkin";
     repo = pname;
     rev = version;
-    sha256 = "1cj6iil9sii1zl0l4pw7h4alcnhwdbxinpph2f0rm5rghrp6prjm";
+    sha256 = "sha256-30AQ9MQmclcjl1d83mIoxFXzaJn1OFKQlVxayqC5NxY=";
   };
 
   nativeBuildInputs = [ flit-core ];
diff --git a/pkgs/development/python-modules/torchvision/default.nix b/pkgs/development/python-modules/torchvision/default.nix
index fc9905881cb6..d5b40471c7a5 100644
--- a/pkgs/development/python-modules/torchvision/default.nix
+++ b/pkgs/development/python-modules/torchvision/default.nix
@@ -24,13 +24,13 @@ let
   cudaArchStr = lib.optionalString cudaSupport lib.strings.concatStringsSep ";" pytorch.cudaArchList;
 in buildPythonPackage rec {
   pname = "torchvision";
-  version = "0.10.0";
+  version = "0.10.1";
 
   src = fetchFromGitHub {
     owner = "pytorch";
     repo = "vision";
     rev = "v${version}";
-    sha256 = "13j04ij0jmi58nhav1p69xrm8dg7jisg23268i3n6lnms37n02kc";
+    sha256 = "0dw4q4yf86wwkm38bpsjf0yfzai46icvaly861ymh5v9f90q60jw";
   };
 
   nativeBuildInputs = [ libpng ninja which ]
diff --git a/pkgs/development/python-modules/tox/default.nix b/pkgs/development/python-modules/tox/default.nix
index c660327ad72e..8940a57196ac 100644
--- a/pkgs/development/python-modules/tox/default.nix
+++ b/pkgs/development/python-modules/tox/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "tox";
-  version = "3.24.3";
+  version = "3.24.4";
 
   buildInputs = [ setuptools-scm ];
   propagatedBuildInputs = [ packaging pluggy py six virtualenv toml filelock ];
@@ -22,7 +22,7 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "c6c4e77705ada004283610fd6d9ba4f77bc85d235447f875df9f0ba1bc23b634";
+    sha256 = "c30b57fa2477f1fb7c36aa1d83292d5c2336cd0018119e1b1c17340e2c2708ca";
   };
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/tqdm/default.nix b/pkgs/development/python-modules/tqdm/default.nix
index babea4357a79..606308f88967 100644
--- a/pkgs/development/python-modules/tqdm/default.nix
+++ b/pkgs/development/python-modules/tqdm/default.nix
@@ -14,11 +14,11 @@
 
 buildPythonPackage rec {
   pname = "tqdm";
-  version = "4.62.2";
+  version = "4.62.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "a4d6d112e507ef98513ac119ead1159d286deab17dffedd96921412c2d236ff5";
+    sha256 = "d359de7217506c9851b7869f3708d8ee53ed70a1b8edbba4dbcb47442592920d";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/traits/default.nix b/pkgs/development/python-modules/traits/default.nix
index e4e82db9e446..2d88fb3221aa 100644
--- a/pkgs/development/python-modules/traits/default.nix
+++ b/pkgs/development/python-modules/traits/default.nix
@@ -9,22 +9,16 @@
 
 buildPythonPackage rec {
   pname = "traits";
-  version = "6.2.0";
-  disabled = isPy27; # setup.py no longer py3 compat
+  version = "6.3.0";
+  disabled = isPy27;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "16fa1518b0778fd53bf0547e6a562b1787bf68c8f6b7995a13bd1902529fdb0c";
+    sha256 = "770241df047feb9e3ed4c26a36c2468a5b754e6082a78eeb737f058bd45344f5";
   };
 
-  # Use pytest because its easier to discover tests
-  buildInputs = [ pytest ];
   propagatedBuildInputs = [ numpy ];
 
-  checkPhase = ''
-    py.test $out/${python.sitePackages}
-  '';
-
   # Test suite is broken for 3.x on latest release
   # https://github.com/enthought/traits/issues/187
   # https://github.com/enthought/traits/pull/188
@@ -34,7 +28,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Explicitly typed attributes for Python";
     homepage = "https://pypi.python.org/pypi/traits";
-    license = "BSD";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ ];
   };
-
 }
diff --git a/pkgs/development/python-modules/trimesh/default.nix b/pkgs/development/python-modules/trimesh/default.nix
index 1da8a14e43bf..79d25ccc3c50 100644
--- a/pkgs/development/python-modules/trimesh/default.nix
+++ b/pkgs/development/python-modules/trimesh/default.nix
@@ -6,11 +6,11 @@
 
 buildPythonPackage rec {
   pname = "trimesh";
-  version = "3.9.31";
+  version = "3.9.32";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "cdb7e5b996a2ea180a53b283ac8fac4a8978ae31c860b55c14a205fc772144c2";
+    sha256 = "4e60f5230a4fd0cda5731f236c370d8e1950894b7dbe7a3222cd4051d3d4bb88";
   };
 
   propagatedBuildInputs = [ numpy ];
diff --git a/pkgs/development/python-modules/trytond/default.nix b/pkgs/development/python-modules/trytond/default.nix
index 75e1ee68e4b3..a9f1a58b1298 100644
--- a/pkgs/development/python-modules/trytond/default.nix
+++ b/pkgs/development/python-modules/trytond/default.nix
@@ -23,12 +23,12 @@
 
 buildPythonApplication rec {
   pname = "trytond";
-  version = "6.0.5";
+  version = "6.0.8";
   disabled = pythonOlder "3.5";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "3ccb98dbf905d99991ed0151e13c91cd9267e4aa104fa40097df4e02580dadfc";
+    sha256 = "686d498f9648875f48edc9fc2e97cd465ed4ea9270c4984b6f2db20a2eac4942";
   };
 
   # Tells the tests which database to use
diff --git a/pkgs/development/python-modules/tubeup/default.nix b/pkgs/development/python-modules/tubeup/default.nix
index c8e5db2680d4..49a293565595 100644
--- a/pkgs/development/python-modules/tubeup/default.nix
+++ b/pkgs/development/python-modules/tubeup/default.nix
@@ -9,13 +9,13 @@
 
 buildPythonPackage rec {
   pname = "tubeup";
-  version = "0.0.26";
+  version = "0.0.27";
 
   disabled = isPy27;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "842bc03c354d8f952436109264db6cd9146f26cee281d1540d5d7c3aa7371bcc";
+    sha256 = "77affb4105fc319d82c56aa5706151a4976b8b504dd252fe3db01443e27cba50";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/typed-settings/default.nix b/pkgs/development/python-modules/typed-settings/default.nix
index 47c98ad9531e..ea5092cb2ae8 100644
--- a/pkgs/development/python-modules/typed-settings/default.nix
+++ b/pkgs/development/python-modules/typed-settings/default.nix
@@ -1,8 +1,10 @@
 { lib
 , buildPythonPackage
+, pythonOlder
 , fetchPypi
 , setuptoolsBuildHook
 , attrs
+, cattrs
 , toml
 , pytestCheckHook
 , click
@@ -10,28 +12,43 @@
 
 buildPythonPackage rec {
   pname = "typed-settings";
-  version = "0.10.0";
+  version = "0.11.1";
   format = "pyproject";
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1fr6qkq3ldlp5i5l4b891w9ail9lfhaxlar3yij912slq5w0s8aw";
+    sha256 = "sha256-gcyOeUyRAwU5s+XoQO/yM0tx7QHjDsBeyoe5HRZHtIs=";
   };
 
   nativeBuildInputs = [
     setuptoolsBuildHook
-    pytestCheckHook
   ];
 
   propagatedBuildInputs = [
     attrs
+    cattrs
     toml
   ];
 
+  preCheck = ''
+    pushd tests
+  '';
+
   checkInputs = [
     click
+    pytestCheckHook
   ];
 
+  disabledTests = [
+    # mismatches in click help output
+    "test_help"
+  ];
+
+  postCheck = ''
+    popd
+  '';
+
   meta = {
     description = "Typed settings based on attrs classes";
     homepage = "https://gitlab.com/sscherfke/typed-settings";
diff --git a/pkgs/development/python-modules/ufonormalizer/default.nix b/pkgs/development/python-modules/ufonormalizer/default.nix
index 5d0af719a39b..dbc02750de9a 100644
--- a/pkgs/development/python-modules/ufonormalizer/default.nix
+++ b/pkgs/development/python-modules/ufonormalizer/default.nix
@@ -2,13 +2,13 @@
 
 buildPythonPackage rec {
   pname = "ufonormalizer";
-  version = "0.6.0";
+  version = "0.6.1";
 
   disabled = pythonOlder "3.5";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0w44qlvg4xks7jb0lf3lhsbylagq956x0wkcal9ix34bz3p7vdxd";
+    sha256 = "e61110e75a500083f265385b1354b578610f9542e3bbbeedb98a2a6155e4aa6c";
     extension = "zip";
   };
 
diff --git a/pkgs/development/python-modules/ujson/default.nix b/pkgs/development/python-modules/ujson/default.nix
index 7b0a1f37deae..70e676f6b2cc 100644
--- a/pkgs/development/python-modules/ujson/default.nix
+++ b/pkgs/development/python-modules/ujson/default.nix
@@ -9,12 +9,12 @@
 
 buildPythonPackage rec {
   pname = "ujson";
-  version = "4.1.0";
+  version = "4.2.0";
   disabled = isPyPy || pythonOlder "3.5";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-IrY+xECfDS8sTJ1aozGZfgJHC3oVoyM/PMMvL5uS1Yw=";
+    sha256 = "fffe509f556861c7343c6cba57ed05fe7bcf4b48a934a5b946ccb45428cf8883";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/unrardll/default.nix b/pkgs/development/python-modules/unrardll/default.nix
index 49e070b84631..4feb29a09016 100644
--- a/pkgs/development/python-modules/unrardll/default.nix
+++ b/pkgs/development/python-modules/unrardll/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "unrardll";
-  version = "0.1.4";
+  version = "0.1.5";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "4149c0729cf96a0bae80360e7d94dc40af1088c8da7f6eb8d10e09b8632e92ad";
+    sha256 = "8bebb480b96cd49d4290d814914f39cff75cf0fa0514c4790bb32b1757227c78";
   };
 
   buildInputs = [ unrar ];
diff --git a/pkgs/development/python-modules/urllib3/default.nix b/pkgs/development/python-modules/urllib3/default.nix
index 1c25612a16d9..cf7afaa173e2 100644
--- a/pkgs/development/python-modules/urllib3/default.nix
+++ b/pkgs/development/python-modules/urllib3/default.nix
@@ -19,11 +19,11 @@
 
 buildPythonPackage rec {
   pname = "urllib3";
-  version = "1.26.6";
+  version = "1.26.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-9XtMFsYvonYLfj2Xw1slVRL7a1miWXMPNroyzp+ONC8=";
+    sha256 = "sha256-SYfGVVT3otvzDBj9SHeO8SSvb6t3GjdxA9oFheIzbs4=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/virtualenv/default.nix b/pkgs/development/python-modules/virtualenv/default.nix
index 10e1ebbc87bc..c5aa9f0bac94 100644
--- a/pkgs/development/python-modules/virtualenv/default.nix
+++ b/pkgs/development/python-modules/virtualenv/default.nix
@@ -23,11 +23,11 @@
 
 buildPythonPackage rec {
   pname = "virtualenv";
-  version = "20.7.2";
+  version = "20.8.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "9ef4e8ee4710826e98ff3075c9a4739e2cb1040de6a2a8d35db0055840dc96a0";
+    sha256 = "bcc17f0b3a29670dd777d6f0755a4c04f28815395bca279cdcb213b97199a6b8";
   };
 
   nativeBuildInputs = [
@@ -72,11 +72,8 @@ buildPythonPackage rec {
   ];
 
   disabledTests = [
-    "test_can_build_c_extensions"
-    "test_xonsh" # imports xonsh, which is not in pythonPackages
-    # tests search `python3`, fail on python2, pypy
-    "test_python_via_env_var"
-    "test_python_multi_value_prefer_newline_via_env_var"
+    # Permission Error
+    "test_bad_exe_py_info_no_raise"
   ];
 
   pythonImportsCheck = [ "virtualenv" ];
diff --git a/pkgs/development/python-modules/vivisect/default.nix b/pkgs/development/python-modules/vivisect/default.nix
index 5dc8bc2254d4..d664cf1d27fe 100644
--- a/pkgs/development/python-modules/vivisect/default.nix
+++ b/pkgs/development/python-modules/vivisect/default.nix
@@ -10,12 +10,12 @@
 }:
 buildPythonPackage rec {
   pname = "vivisect";
-  version = "1.0.4";
+  version = "1.0.5";
   disabled = isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "bd47b2cf5874cd2f74e6c36b8a97bf301785bacf9ac0297bbe78ec1b8c86c755";
+    sha256 = "f629dc0143656b06b64e2da1772deda67d37a3e048e74bd728de4a4f24bf877b";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/watchdog/default.nix b/pkgs/development/python-modules/watchdog/default.nix
index 7dab01b3ca09..c68fc2980cee 100644
--- a/pkgs/development/python-modules/watchdog/default.nix
+++ b/pkgs/development/python-modules/watchdog/default.nix
@@ -13,11 +13,11 @@
 
 buildPythonPackage rec {
   pname = "watchdog";
-  version = "2.1.5";
+  version = "2.1.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "5563b005907613430ef3d4aaac9c78600dd5704e84764cb6deda4b3d72807f09";
+    sha256 = "sha256-o25132x2fL9G9hqRxws7pxgR36CspKMk2UB6Bqi3ouc=";
   };
 
   buildInputs = lib.optionals stdenv.isDarwin [ CoreServices ];
diff --git a/pkgs/development/python-modules/websockets/default.nix b/pkgs/development/python-modules/websockets/default.nix
index 51df6c70235d..611c84ea814c 100644
--- a/pkgs/development/python-modules/websockets/default.nix
+++ b/pkgs/development/python-modules/websockets/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "websockets";
-  version = "9.1";
+  version = "10.0";
   disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "aaugustin";
     repo = pname;
     rev = version;
-    sha256 = "sha256-7Y12IUG+ulD4+CTRlY+NE6qYZyI9gCPDydwpt+uyYZk=";
+    sha256 = "sha256-F10C8ukjYfbn2X2PMzrdSDqvs51/A9lx8Y3kv8YJ8Cw=";
   };
 
   # Tests fail on Darwin with `OSError: AF_UNIX path too long`
diff --git a/pkgs/development/python-modules/wrapt/default.nix b/pkgs/development/python-modules/wrapt/default.nix
index 0d5376e10047..d4bdac9e6f5d 100644
--- a/pkgs/development/python-modules/wrapt/default.nix
+++ b/pkgs/development/python-modules/wrapt/default.nix
@@ -5,14 +5,14 @@
 
 buildPythonPackage rec {
   pname = "wrapt";
-  version = "1.12.1";
+  version = "1.13.1";
 
   # No tests in archive
   doCheck = false;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "b62ffa81fb85f4332a4f609cab4ac40709470da05643a082ec1eb88e6d9b97d7";
+    sha256 = "909a80ce028821c7ad01bdcaa588126825931d177cdccd00b3545818d4a195ce";
   };
 
   meta = {
diff --git a/pkgs/development/python-modules/yarl/default.nix b/pkgs/development/python-modules/yarl/default.nix
index 66d219f9348e..a5aab308eab6 100644
--- a/pkgs/development/python-modules/yarl/default.nix
+++ b/pkgs/development/python-modules/yarl/default.nix
@@ -1,32 +1,52 @@
 { lib
-, fetchPypi
 , buildPythonPackage
+, fetchPypi
+, python
 , pythonOlder
-, multidict
-, pytest-runner
-, pytest
-, typing-extensions
 , idna
+, multidict
+, typing-extensions
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "yarl";
-  version = "1.6.3";
+  version = "1.7.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "8a9066529240171b68893d60dca86a763eae2139dd42f42106b03cf4b426bf10";
+    sha256 = "8e7ebaf62e19c2feb097ffb7c94deb0f0c9fab52590784c8cd679d30ab009162";
   };
 
-  checkInputs = [ pytest pytest-runner ];
-  propagatedBuildInputs = [ multidict idna ]
-    ++ lib.optionals (pythonOlder "3.8") [
-      typing-extensions
-    ];
+  postPatch = ''
+    sed -i '/^addopts/d' setup.cfg
+  '';
+
+  propagatedBuildInputs = [
+    idna
+    multidict
+  ] ++ lib.optionals (pythonOlder "3.8") [
+    typing-extensions
+  ];
+
+  preCheck = ''
+    # don't import yarl from ./ so the C extension is available
+    pushd tests
+  '';
+
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  postCheck = ''
+    popd
+  '';
+
+  pythonImportsCheck = [ "yarl" ];
 
   meta = with lib; {
     description = "Yet another URL library";
-    homepage = "https://github.com/aio-libs/yarl/";
+    homepage = "https://github.com/aio-libs/yarl";
     license = licenses.asl20;
     maintainers = with maintainers; [ dotlambda ];
   };
diff --git a/pkgs/development/python-modules/zarr/default.nix b/pkgs/development/python-modules/zarr/default.nix
index cc47fe9e5ac1..0a8f13705eb5 100644
--- a/pkgs/development/python-modules/zarr/default.nix
+++ b/pkgs/development/python-modules/zarr/default.nix
@@ -12,12 +12,12 @@
 
 buildPythonPackage rec {
   pname = "zarr";
-  version = "2.10.0";
+  version = "2.10.1";
   disabled = isPy27;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "8ca8e505cadb4f7f97aab4e4193bb302b6338bf54593c98fe7581bf574ed864c";
+    sha256 = "29e90114f037d433752b3cf951e4a3cb6c6f67b6501a273439b4be4a824e4caf";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/zipp/default.nix b/pkgs/development/python-modules/zipp/default.nix
index c070e2327772..dc30128c9ead 100644
--- a/pkgs/development/python-modules/zipp/default.nix
+++ b/pkgs/development/python-modules/zipp/default.nix
@@ -7,11 +7,11 @@
 
 buildPythonPackage rec {
   pname = "zipp";
-  version = "3.5.0";
+  version = "3.6.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "f5812b1e007e48cff63449a5e9f4e7ebea716b4111f9c4f9a645f91d579bf0c4";
+    sha256 = "71c644c5369f4a6e07636f0aa966270449561fcea2e3d6747b8d23efaa9d7832";
   };
 
   nativeBuildInputs = [ setuptools-scm ];
diff --git a/pkgs/development/tools/misc/autogen/default.nix b/pkgs/development/tools/misc/autogen/default.nix
index 75c6471eb4c6..da5bdf9742e7 100644
--- a/pkgs/development/tools/misc/autogen/default.nix
+++ b/pkgs/development/tools/misc/autogen/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, buildPackages, fetchurl, autoreconfHook, which, pkg-config, perl, guile, libxml2 }:
+{ lib, stdenv, buildPackages, fetchurl, fetchpatch, autoreconfHook, which, pkg-config, perl, guile, libxml2 }:
 
 stdenv.mkDerivation rec {
   pname = "autogen";
@@ -28,6 +28,13 @@ stdenv.mkDerivation rec {
       pname = "31_allow_overriding_AGexe_for_crossbuild";
       sha256 = "0h9wkc9bqb509knh8mymi43hg6n6sxg2lixvjlchcx7z0j7p8xkf";
     })
+    # Next upstream release will contain guile-3 support. We apply non-invasive
+    # patch meanwhile.
+    (fetchpatch {
+      name = "guile-3.patch";
+      url = "https://gitweb.gentoo.org/repo/gentoo.git/plain/sys-devel/autogen/files/autogen-5.18.16-guile-3.patch?id=43bcc61c56a5a7de0eaf806efec7d8c0e4c01ae7";
+      sha256 = "18d7y1f6164dm1wlh7rzbacfygiwrmbc35a7qqsbdawpkhydm5lr";
+    })
   ];
 
   outputs = [ "bin" "dev" "lib" "out" "man" "info" ];
diff --git a/pkgs/development/tools/misc/elfutils/default.nix b/pkgs/development/tools/misc/elfutils/default.nix
index c1227775785a..c89dd5832994 100644
--- a/pkgs/development/tools/misc/elfutils/default.nix
+++ b/pkgs/development/tools/misc/elfutils/default.nix
@@ -1,5 +1,5 @@
-{ lib, stdenv, fetchurl, fetchpatch, pkg-config, autoreconfHook, musl-fts
-, musl-obstack, m4, zlib, bzip2, bison, flex, gettext, xz, setupDebugInfoDirs
+{ lib, stdenv, fetchurl, fetchpatch, pkg-config, musl-fts
+, musl-obstack, m4, zlib, zstd, bzip2, bison, flex, gettext, xz, setupDebugInfoDirs
 , argp-standalone
 , enableDebuginfod ? false, sqlite, curl, libmicrohttpd_0_9_70, libarchive
 }:
@@ -7,11 +7,11 @@
 # TODO: Look at the hardcoded paths to kernel, modules etc.
 stdenv.mkDerivation rec {
   pname = "elfutils";
-  version = "0.182";
+  version = "0.185";
 
   src = fetchurl {
     url = "https://sourceware.org/elfutils/ftp/${version}/${pname}-${version}.tar.bz2";
-    sha256 = "7MQGkU7fM18Lf8CE6+bEYMTW1Rdb/dZojBx42RRriFg=";
+    sha256 = "sha256-3I0+dKsglGXn9Wjhs7uaWhQvhlbitX0QBJpz2irmtaY=";
   };
 
   patches = [
@@ -27,43 +27,29 @@ stdenv.mkDerivation rec {
       url = "https://git.alpinelinux.org/aports/plain/main/elfutils/musl-asm-ptrace-h.patch?id=2e3d4976eeffb4704cf83e2cc3306293b7c7b2e9";
       sha256 = "8D1wPcdgAkE/TNBOgsHaeTZYhd9l+9TrZg8d5C7kG6k=";
     })
-    (fetchpatch {
-      name = "musl-fts-obstack.patch";
-      url = "https://git.alpinelinux.org/aports/plain/main/elfutils/musl-fts-obstack.patch?id=2e3d4976eeffb4704cf83e2cc3306293b7c7b2e9";
-      sha256 = "3lbC0UtscTIJgT7kOXnnjWrpPAVt2PYMbW+uJK6K350=";
-    })
     (fetchpatch {
       name = "musl-macros.patch";
       url = "https://git.alpinelinux.org/aports/plain/main/elfutils/musl-macros.patch?id=2e3d4976eeffb4704cf83e2cc3306293b7c7b2e9";
       sha256 = "tp6O1TRsTAMsFe8vw3LMENT/vAu6OmyA8+pzgThHeA8=";
     })
-    (fetchpatch {
-      name = "musl-qsort_r.patch";
-      url = "https://git.alpinelinux.org/aports/plain/main/elfutils/musl-qsort_r.patch?id=2e3d4976eeffb4704cf83e2cc3306293b7c7b2e9";
-      sha256 = "FPWCkdtFT3zw8aNnz0Jz5Vmu8B/mRfNgfhbM/ej7d8M=";
-    })
-    (fetchpatch {
-      name = "musl-strerror_r.patch";
-      url = "https://git.alpinelinux.org/aports/plain/main/elfutils/musl-strerror_r.patch?id=2e3d4976eeffb4704cf83e2cc3306293b7c7b2e9";
-      sha256 = "QF6YwWkcT12dZHKzfqFgxy/1fkIllo0AAosbV0sM5PU=";
-    })
     (fetchpatch {
       name = "musl-strndupa.patch";
       url = "https://git.alpinelinux.org/aports/plain/main/elfutils/musl-strndupa.patch?id=2e3d4976eeffb4704cf83e2cc3306293b7c7b2e9";
       sha256 = "sha256-7daehJj1t0wPtQzTv+/Rpuqqs5Ng/EYnZzrcf2o/Lb0=";
     })
-  ] ++ lib.optional stdenv.hostPlatform.isMusl [ ./musl-error_h.patch ];
+  ] ++ lib.optionals stdenv.hostPlatform.isMusl [ ./musl-error_h.patch ];
+
+  postPatch = ''
+    patchShebangs tests/*.sh
+  '';
 
   outputs = [ "bin" "dev" "out" "man" ];
 
-  hardeningDisable = [ "format" ];
-
   # We need bzip2 in NativeInputs because otherwise we can't unpack the src,
   # as the host-bzip2 will be in the path.
   nativeBuildInputs = [ m4 bison flex gettext bzip2 ]
-    ++ lib.optional stdenv.hostPlatform.isMusl autoreconfHook
-    ++ lib.optional (enableDebuginfod || stdenv.hostPlatform.isMusl) pkg-config;
-  buildInputs = [ zlib bzip2 xz ]
+    ++ lib.optional enableDebuginfod pkg-config;
+  buildInputs = [ zlib zstd bzip2 xz ]
     ++ lib.optionals stdenv.hostPlatform.isMusl [
     argp-standalone
     musl-fts
@@ -77,22 +63,24 @@ stdenv.mkDerivation rec {
 
   propagatedNativeBuildInputs = [ setupDebugInfoDirs ];
 
-  preConfigure = lib.optionalString stdenv.hostPlatform.isMusl ''
-    NIX_CFLAGS_COMPILE+=" -Wno-null-dereference"
-  '';
+  NIX_CFLAGS_COMPILE = lib.optionals stdenv.hostPlatform.isMusl [
+    "-Wno-null-dereference"
+  ];
 
   configureFlags = [
     "--program-prefix=eu-" # prevent collisions with binutils
     "--enable-deterministic-archives"
-  ] ++ lib.optionals (!enableDebuginfod) [
-    "--disable-libdebuginfod"
-    "--disable-debuginfod"
+    (lib.enableFeature enableDebuginfod "libdebuginfod")
+    (lib.enableFeature enableDebuginfod "debuginfod")
   ];
 
   enableParallelBuilding = true;
 
-  doCheck = false; # fails 3 out of 174 tests
-  doInstallCheck = false; # fails 70 out of 174 tests
+  # Backtrace unwinding tests rely on glibc-internal symbol names.
+  # Musl provides slightly different forms and fails.
+  # Let's disable tests there until musl support is fully upstreamed.
+  doCheck = !stdenv.hostPlatform.isMusl;
+  doInstallCheck = !stdenv.hostPlatform.isMusl;
 
   meta = with lib; {
     homepage = "https://sourceware.org/elfutils/";
@@ -101,6 +89,6 @@ stdenv.mkDerivation rec {
     # licenses are GPL2 or LGPL3+ for libraries, GPL3+ for bins,
     # but since this package isn't split that way, all three are listed.
     license = with licenses; [ gpl2Only lgpl3Plus gpl3Plus ];
-    maintainers = [ maintainers.eelco ];
+    maintainers = with maintainers; [ eelco r-burns ];
   };
 }
diff --git a/pkgs/development/tools/misc/gdb/default.nix b/pkgs/development/tools/misc/gdb/default.nix
index 88e3393dedcb..62290548ec7b 100644
--- a/pkgs/development/tools/misc/gdb/default.nix
+++ b/pkgs/development/tools/misc/gdb/default.nix
@@ -7,6 +7,7 @@
 , ncurses, readline, gmp, mpfr, expat, libipt, zlib, dejagnu, sourceHighlight
 
 , pythonSupport ? stdenv.hostPlatform == stdenv.buildPlatform && !stdenv.hostPlatform.isCygwin, python3 ? null
+, enableDebuginfod ? false, elfutils
 , guile ? null
 , safePaths ? [
    # $debugdir:$datadir/auto-load are whitelisted by default by GDB
@@ -48,7 +49,8 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ ncurses readline gmp mpfr expat libipt zlib guile sourceHighlight ]
     ++ lib.optional pythonSupport python3
-    ++ lib.optional doCheck dejagnu;
+    ++ lib.optional doCheck dejagnu
+    ++ lib.optional enableDebuginfod (elfutils.override { enableDebuginfod = true; });
 
   propagatedNativeBuildInputs = [ setupDebugInfoDirs ];
 
@@ -89,7 +91,8 @@ stdenv.mkDerivation rec {
     "--with-expat" "--with-libexpat-prefix=${expat.dev}"
     "--with-auto-load-safe-path=${builtins.concatStringsSep ":" safePaths}"
   ] ++ lib.optional (!pythonSupport) "--without-python"
-    ++ lib.optional stdenv.hostPlatform.isMusl "--disable-nls";
+    ++ lib.optional stdenv.hostPlatform.isMusl "--disable-nls"
+    ++ lib.optional enableDebuginfod "--with-debuginfod=yes";
 
   postInstall =
     '' # Remove Info files already provided by Binutils and other packages.
diff --git a/pkgs/development/tools/rust/cargo-c/default.nix b/pkgs/development/tools/rust/cargo-c/default.nix
index 8b4780d7ea08..0b82c1b5a366 100644
--- a/pkgs/development/tools/rust/cargo-c/default.nix
+++ b/pkgs/development/tools/rust/cargo-c/default.nix
@@ -1,39 +1,34 @@
-{ rustPlatform, stdenv, lib, fetchFromGitHub, fetchurl
-, pkg-config, curl, openssl
-, CoreFoundation, libiconv, Security
+{ lib
+, rustPlatform
+, fetchCrate
+, pkg-config
+, curl
+, openssl
+, stdenv
+, CoreFoundation
+, libiconv
+, Security
 }:
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-c";
   version = "0.9.2";
 
-  src = stdenv.mkDerivation rec {
-    name = "${pname}-source-${version}";
-
-    src = fetchFromGitHub {
-      owner = "lu-zero";
-      repo = pname;
-      rev = "v${version}";
-      sha256 = "0hvlrhmbplx4cj4l5fynihgr9cdh0rkpwvipizk1gpp6p1ksr5hz";
-    };
-    cargoLock = fetchurl {
-      url = "https://github.com/lu-zero/${pname}/releases/download/v${version}/Cargo.lock";
-      sha256 = "0ckn31asz7013206j153ig96602dxvxm6skdz1plan0h05j5mgah";
-    };
-
-    installPhase = ''
-      mkdir -p $out
-      cp -R ./* $out/
-      cp ${cargoLock} $out/Cargo.lock
-    '';
+  src = fetchCrate {
+    inherit pname;
+    # this version may need to be updated along with package version
+    version = "${version}+cargo-0.55";
+    sha256 = "sha256-yh5vAtKlBvoSlJBsW2RSduSK6T8aOssM84WQMNjLZqA=";
   };
 
-  cargoSha256 = "0c0vn2pcy5px02mc0l4a3w7z9n8hc6br5w3ww6nrav5w6911jp52";
-
+  cargoSha256 = "sha256-YikTjAeroaHyNe3ygUWRHSXJwdm2BSBV7RgIDN4suZ4=";
 
   nativeBuildInputs = [ pkg-config (lib.getDev curl) ];
-  buildInputs = [ openssl curl ]
-  ++ lib.optionals stdenv.isDarwin [ CoreFoundation libiconv Security ];
+  buildInputs = [ openssl curl ] ++ lib.optionals stdenv.isDarwin [
+    CoreFoundation
+    libiconv
+    Security
+  ];
 
   # Ensure that we are avoiding build of the curl vendored in curl-sys
   doInstallCheck = stdenv.hostPlatform.libc == "glibc";
@@ -55,7 +50,6 @@ rustPlatform.buildRustPackage rec {
     homepage = "https://github.com/lu-zero/cargo-c";
     changelog = "https://github.com/lu-zero/cargo-c/releases/tag/v${version}";
     license = licenses.mit;
-    platforms = platforms.unix;
     maintainers = with maintainers; [ ];
   };
 }
diff --git a/pkgs/development/web/nodejs/v14.nix b/pkgs/development/web/nodejs/v14.nix
index cb8d8aac3632..0e0bde32b2f8 100644
--- a/pkgs/development/web/nodejs/v14.nix
+++ b/pkgs/development/web/nodejs/v14.nix
@@ -7,7 +7,7 @@ let
 in
   buildNodejs {
     inherit enableNpm;
-    version = "14.18.0";
-    sha256 = "0naqv0aglsqy51pyiz42xz7wx5pfsbyscpdl8rir6kmfl1c52j3b";
+    version = "14.18.1";
+    sha256 = "1vc9rypkgr5i5y946jnyr9jjpydxvm74p1s17rg2zayzvlddg89z";
     patches = lib.optional stdenv.isDarwin ./bypass-xcodebuild.diff;
   }
diff --git a/pkgs/misc/cups/default.nix b/pkgs/misc/cups/default.nix
index 3812ae500e5c..e1a4e733d6e9 100644
--- a/pkgs/misc/cups/default.nix
+++ b/pkgs/misc/cups/default.nix
@@ -28,16 +28,15 @@ stdenv.mkDerivation rec {
   pname = "cups";
 
   # After 2.2.6, CUPS requires headers only available in macOS 10.12+
-  version = if stdenv.isDarwin then "2.2.6" else "2.3.3";
+  version = if stdenv.isDarwin then "2.2.6" else "2.3.3op2";
 
-  passthru = { inherit version; };
-
-  src = fetchurl {
+  src = fetchurl (if stdenv.isDarwin then {
     url = "https://github.com/apple/cups/releases/download/v${version}/cups-${version}-source.tar.gz";
-    sha256 = if version == "2.2.6"
-             then "16qn41b84xz6khrr2pa2wdwlqxr29rrrkjfi618gbgdkq9w5ff20"
-             else "1vpk0b2vq830f8fvf9z8qjsm5k141i7pi8djbinpnr78pi4dj7r6";
-  };
+    sha256 = "16qn41b84xz6khrr2pa2wdwlqxr29rrrkjfi618gbgdkq9w5ff20";
+  } else {
+    url = "https://github.com/OpenPrinting/cups/releases/download/v${version}/cups-${version}-source.tar.gz";
+    sha256 = "1pwndz4gwkm7311wkhhzlw2diy7wbck7yy026jbaxh3rprdmgcyy";
+  });
 
   outputs = [ "out" "lib" "dev" "man" ];
 
@@ -49,10 +48,8 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ pkg-config removeReferencesTo ];
 
   buildInputs = [ zlib libjpeg libpng libtiff libusb1 gnutls libpaper ]
-    ++ optionals stdenv.isLinux [ avahi pam dbus ]
+    ++ optionals stdenv.isLinux [ avahi pam dbus acl ]
     ++ optional enableSystemd systemd
-    # Separate from above only to not modify order, to avoid mass rebuilds; merge this with the above at next big change.
-    ++ optionals stdenv.isLinux [ acl ]
     ++ optionals stdenv.isDarwin (with darwin; [
       configd apple_sdk.frameworks.ApplicationServices
     ]);
@@ -129,18 +126,8 @@ stdenv.mkDerivation rec {
       sed -e "/^cups_serverbin=/s|$lib|$out|" \
           -i "$dev/bin/cups-config"
 
-      # Rename systemd files provided by CUPS
       for f in "$out"/lib/systemd/system/*; do
-        substituteInPlace "$f" \
-          --replace "$lib/$libexec" "$out/$libexec" \
-          --replace "org.cups.cupsd" "cups" \
-          --replace "org.cups." ""
-
-        if [[ "$f" =~ .*cupsd\..* ]]; then
-          mv "$f" "''${f/org\.cups\.cupsd/cups}"
-        else
-          mv "$f" "''${f/org\.cups\./}"
-        fi
+        substituteInPlace "$f" --replace "$lib/$libexec" "$out/$libexec"
       done
     '' + optionalString stdenv.isLinux ''
       # Use xdg-open when on Linux
@@ -149,9 +136,9 @@ stdenv.mkDerivation rec {
     '';
 
   meta = {
-    homepage = "https://cups.org/";
+    homepage = "https://openprinting.github.io/cups/";
     description = "A standards-based printing system for UNIX";
-    license = licenses.gpl2; # actually LGPL for the library and GPL for the rest
+    license = licenses.asl20;
     maintainers = with maintainers; [ matthewbauer ];
     platforms = platforms.unix;
   };
diff --git a/pkgs/os-specific/linux/iptables/default.nix b/pkgs/os-specific/linux/iptables/default.nix
index fe0e82c4a8e6..50730597d9e6 100644
--- a/pkgs/os-specific/linux/iptables/default.nix
+++ b/pkgs/os-specific/linux/iptables/default.nix
@@ -1,6 +1,6 @@
 { lib, stdenv, fetchurl, pkg-config, pruneLibtoolFiles, flex, bison
 , libmnl, libnetfilter_conntrack, libnfnetlink, libnftnl, libpcap
-, nftablesCompat ? false
+, nftablesCompat ? true
 }:
 
 with lib;
diff --git a/pkgs/os-specific/linux/kernel/linux-libre.nix b/pkgs/os-specific/linux/kernel/linux-libre.nix
index d8d9edcf4af7..ac0f875e3ebb 100644
--- a/pkgs/os-specific/linux/kernel/linux-libre.nix
+++ b/pkgs/os-specific/linux/kernel/linux-libre.nix
@@ -14,9 +14,14 @@ let
   minor = lib.versions.minor linux.modDirVersion;
   patch = lib.versions.patch linux.modDirVersion;
 
+  # See http://linux-libre.fsfla.org/pub/linux-libre/releases
+  versionPrefix = if linux.kernelOlder "5.14" then
+    "gnu1"
+  else
+    "gnu";
 in linux.override {
   argsOverride = {
-    modDirVersion = "${linux.modDirVersion}-gnu";
+    modDirVersion = "${linux.modDirVersion}-${versionPrefix}";
     isLibre = true;
 
     src = stdenv.mkDerivation {
@@ -35,10 +40,8 @@ in linux.override {
       '';
     };
 
-    extraMeta.broken = true;
-
     passthru.updateScript = ./update-libre.sh;
 
-    maintainers = [ lib.maintainers.qyliss ];
+    maintainers = with lib.maintainers; [ qyliss ivar ];
   };
 }
diff --git a/pkgs/os-specific/linux/libbpf/default.nix b/pkgs/os-specific/linux/libbpf/default.nix
index 649ad88a3d18..6f242f4c0364 100644
--- a/pkgs/os-specific/linux/libbpf/default.nix
+++ b/pkgs/os-specific/linux/libbpf/default.nix
@@ -7,13 +7,13 @@ with builtins;
 
 stdenv.mkDerivation rec {
   pname = "libbpf";
-  version = "0.4.0";
+  version = "0.5.0";
 
   src = fetchFromGitHub {
     owner  = "libbpf";
     repo   = "libbpf";
     rev    = "v${version}";
-    sha256 = "1by5w7g3i2fc10bi6f0j8jqi2nq0x8r973j2qx7qlfryjxr7b2v3";
+    sha256 = "08mg5agd40qaz1hz5rqqhf0wgfna06f7l01z5v06y995xdmw2v9g";
   };
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/os-specific/linux/nftables/default.nix b/pkgs/os-specific/linux/nftables/default.nix
index e0e69adb4b6b..73adcd786057 100644
--- a/pkgs/os-specific/linux/nftables/default.nix
+++ b/pkgs/os-specific/linux/nftables/default.nix
@@ -4,7 +4,7 @@
 , gmp, jansson, readline
 , withDebugSymbols ? false
 , withPython ? false , python3
-, withXtables ? false , iptables
+, withXtables ? true , iptables
 }:
 
 with lib;
diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index 3af70ff9151c..3cb9216b184e 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -251,6 +251,7 @@ stdenv.mkDerivation {
           { name = "libtss2-esys.so.0"; pkg = opt withTpm2Tss tpm2-tss; }
           { name = "libtss2-rc.so.0"; pkg = opt withTpm2Tss tpm2-tss; }
           { name = "libtss2-mu.so.0"; pkg = opt withTpm2Tss tpm2-tss; }
+          { name = "libtss2-tcti-"; pkg = opt withTpm2Tss tpm2-tss; }
           { name = "libfido2.so.1"; pkg = opt withFido2 libfido2; }
         ];
 
@@ -267,8 +268,12 @@ stdenv.mkDerivation {
         '' else ''
           # ensure that the library we provide actually exists
           if ! [ -e ${library} ]; then
-            echo 'The shared library `${library}` does not exist but was given as subtitute for `${dl.name}`'
-            exit 1
+            # exceptional case, details:
+            # https://github.com/systemd/systemd-stable/blob/v249-stable/src/shared/tpm2-util.c#L157
+            if ! [[ "${library}" =~ .*libtss2-tcti-$ ]]; then
+              echo 'The shared library `${library}` does not exist but was given as subtitute for `${dl.name}`'
+              exit 1
+            fi
           fi
           # make the path to the dependency explicit
           for file in $(grep -lr '"${dl.name}"' src); do
@@ -353,6 +358,7 @@ stdenv.mkDerivation {
     ++ lib.optionals withHomed [ p11-kit ]
     ++ lib.optionals (withHomed || withCryptsetup) [ libfido2 ]
     ++ lib.optionals withLibBPF [ libbpf ]
+    ++ lib.optional withTpm2Tss tpm2-tss
   ;
 
   #dontAddPrefix = true;
@@ -452,7 +458,7 @@ stdenv.mkDerivation {
     "-Dnss-systemd=false"
   ] ++ lib.optionals withLibBPF [
     "-Dbpf-framework=true"
-  ];
+  ] ++ lib.optional withTpm2Tss "-Dtpm2=true";
 
   preConfigure = ''
     mesonFlagsArray+=(-Dntp-servers="0.nixos.pool.ntp.org 1.nixos.pool.ntp.org 2.nixos.pool.ntp.org 3.nixos.pool.ntp.org")
diff --git a/pkgs/os-specific/linux/util-linux/default.nix b/pkgs/os-specific/linux/util-linux/default.nix
index 73f321f26318..7ab2489f5e8a 100644
--- a/pkgs/os-specific/linux/util-linux/default.nix
+++ b/pkgs/os-specific/linux/util-linux/default.nix
@@ -1,5 +1,7 @@
 { lib, stdenv, fetchurl, pkg-config, zlib, shadow, libcap_ng
-, ncurses ? null, perl ? null, pam, systemd ? null, minimal ? false }:
+, ncurses ? null, pam, systemd ? null
+, nlsSupport ? true
+}:
 
 stdenv.mkDerivation rec {
   pname = "util-linux";
@@ -14,7 +16,7 @@ stdenv.mkDerivation rec {
     ./rtcwake-search-PATH-for-shutdown.patch
   ];
 
-  outputs = [ "bin" "dev" "out" "man" ];
+  outputs = [ "bin" "dev" "out" "lib" "man" ];
 
   postPatch = ''
     patchShebangs tests/run.sh
@@ -30,6 +32,7 @@ stdenv.mkDerivation rec {
   # somewhat risky because we have to consider that mount can setuid
   # root...
   configureFlags = [
+    "--localstatedir=/var"
     "--enable-write"
     "--enable-last"
     "--enable-mesg"
@@ -37,30 +40,29 @@ stdenv.mkDerivation rec {
     "--enable-fs-paths-default=/run/wrappers/bin:/run/current-system/sw/bin:/sbin"
     "--disable-makeinstall-setuid" "--disable-makeinstall-chown"
     "--disable-su" # provided by shadow
+    (lib.enableFeature nlsSupport "nls")
     (lib.withFeature (ncurses != null) "ncursesw")
     (lib.withFeature (systemd != null) "systemd")
     (lib.withFeatureAs (systemd != null)
        "systemdsystemunitdir" "${placeholder "bin"}/lib/systemd/system/")
+    "SYSCONFSTATICDIR=${placeholder "lib"}/lib"
   ] ++ lib.optional (stdenv.hostPlatform != stdenv.buildPlatform)
        "scanf_cv_type_modifier=ms"
   ;
 
   makeFlags = [
     "usrbin_execdir=${placeholder "bin"}/bin"
+    "usrlib_execdir=${placeholder "lib"}/lib"
     "usrsbin_execdir=${placeholder "bin"}/sbin"
   ];
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs =
     [ zlib pam libcap_ng ]
-    ++ lib.filter (p: p != null) [ ncurses systemd perl ];
+    ++ lib.filter (p: p != null) [ ncurses systemd ];
 
   doCheck = false; # "For development purpose only. Don't execute on production system!"
 
-  postInstall = lib.optionalString minimal ''
-    rm -rf $out/share/{locale,doc,bash-completion}
-  '';
-
   enableParallelBuilding = true;
 
   meta = with lib; {
diff --git a/pkgs/servers/home-assistant/default.nix b/pkgs/servers/home-assistant/default.nix
index b2c3196bdbca..655cbf708bcd 100644
--- a/pkgs/servers/home-assistant/default.nix
+++ b/pkgs/servers/home-assistant/default.nix
@@ -144,10 +144,12 @@ in with py.pkgs; buildPythonApplication rec {
       --replace "awesomeversion==21.4.0" "awesomeversion" \
       --replace "bcrypt==3.1.7" "bcrypt" \
       --replace "cryptography==3.3.2" "cryptography" \
+      --replace "jinja2==3.0.1" "jinja2" \
       --replace "pip>=8.0.3,<20.3" "pip" \
       --replace "requests==2.25.1" "requests>=2.25.1" \
       --replace "ruamel.yaml==0.15.100" "ruamel.yaml" \
-      --replace "voluptuous==0.12.1" "voluptuous==0.12.2"
+      --replace "voluptuous==0.12.1" "voluptuous==0.12.2" \
+      --replace "yarl==1.6.3" "yarl==1.7.0"
     substituteInPlace tests/test_config.py --replace '"/usr"' '"/build/media"'
   '';
 
diff --git a/pkgs/servers/mail/mailman/default.nix b/pkgs/servers/mail/mailman/default.nix
index 1213347a0ac7..557a9d54c149 100644
--- a/pkgs/servers/mail/mailman/default.nix
+++ b/pkgs/servers/mail/mailman/default.nix
@@ -1,23 +1,52 @@
-{ lib, buildPythonPackage, fetchPypi, fetchpatch, isPy3k, alembic, aiosmtpd, dnspython
-, flufl_bounce, flufl_i18n, flufl_lock, lazr_config, lazr_delegates, passlib
-, requests, zope_configuration, click, falcon, importlib-resources
-, zope_component, lynx, postfix, authheaders, gunicorn
+{ lib, python3, fetchPypi, fetchpatch, pythonOlder, postfix, lynx
 }:
 
+let
+  py = python3.override {
+    packageOverrides = self: super: {
+      # https://gitlab.com/mailman/mailman/-/issues/845
+      sqlalchemy = super.sqlalchemy.overridePythonAttrs (oldAttrs: rec {
+        version = "1.3.24";
+        src = oldAttrs.src.override {
+          inherit version;
+          sha256 = "06bmxzssc66cblk1hamskyv5q3xf1nh1py3vi6dka4lkpxy7gfzb";
+        };
+      });
+    };
+  };
+
+in
+
+with py.pkgs;
+
 buildPythonPackage rec {
   pname = "mailman";
-  version = "3.3.4";
-  disabled = !isPy3k;
+  version = "3.3.5";
+  disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "01rx322b8mzcdj9xh4bjwnl0zis6n2wxd31rrij4cw3a2j03xpas";
+    sha256 = "12mgxs1ndhdjjkydx48b95na9k9h0disfqgrr6wxx7vda6dqvcwz";
   };
 
   propagatedBuildInputs = [
-    alembic aiosmtpd click dnspython falcon flufl_bounce flufl_i18n flufl_lock
-    importlib-resources lazr_config passlib requests zope_configuration
-    zope_component authheaders gunicorn
+    aiosmtpd
+    alembic
+    authheaders
+    click
+    dnspython
+    falcon
+    flufl_bounce
+    flufl_i18n
+    flufl_lock
+    gunicorn
+    importlib-resources
+    lazr_config
+    passlib
+    requests
+    sqlalchemy
+    zope_component
+    zope_configuration
   ];
 
   patches = [
@@ -33,6 +62,9 @@ buildPythonPackage rec {
   ];
 
   postPatch = ''
+    substituteInPlace setup.py \
+      --replace "alembic>=1.6.2,<1.7" "alembic>=1.6.2"
+
     substituteInPlace src/mailman/config/postfix.cfg \
       --replace /usr/sbin/postmap ${postfix}/bin/postmap
     substituteInPlace src/mailman/config/schema.cfg \
@@ -48,6 +80,7 @@ buildPythonPackage rec {
   # 'runner' scripts.
   dontWrapPythonPrograms = true;
 
+  # requires flufl.testing, which the upstream has archived
   doCheck = false;
 
   meta = {
diff --git a/pkgs/servers/mail/mailman/hyperkitty.nix b/pkgs/servers/mail/mailman/hyperkitty.nix
index 1c20e33bd0c2..d0d7cbc7fbb6 100644
--- a/pkgs/servers/mail/mailman/hyperkitty.nix
+++ b/pkgs/servers/mail/mailman/hyperkitty.nix
@@ -1,35 +1,83 @@
-{ lib, buildPythonPackage, fetchPypi, isPy3k, isort, coverage, mock
-, robot-detection, django_extensions, rjsmin, cssmin, django-mailman3
-, django-haystack, flufl_lock, networkx, python-dateutil, defusedxml
-, django-paintstore, djangorestframework, django, django-q
-, django_compressor, beautifulsoup4, six, psycopg2, whoosh, elasticsearch
+{ lib
+, buildPythonPackage
+, fetchFromGitLab
+, isPy3k
+
+# dependencies
+, defusedxml
+, django
+, django-gravatar2
+, django-haystack
+, django-mailman3
+, django-paintstore
+, django-q
+, django_compressor
+, django_extensions
+, djangorestframework
+, flufl_lock
+, mistune_2_0
+, networkx
+, psycopg2
+, python-dateutil
+, robot-detection
+
+# tests
+, beautifulsoup4
+, elasticsearch
+, mock
+, whoosh
 }:
 
 buildPythonPackage rec {
   pname = "HyperKitty";
   # Note: Mailman core must be on the latest version before upgrading HyperKitty.
   # See: https://gitlab.com/mailman/postorius/-/issues/516#note_544571309
-  version = "1.3.4";
+  #
+  # Update to next stable version > 1.3.4 that has fixed tests, see
+  # https://gitlab.com/mailman/django-mailman3/-/issues/48
+  version = "1.3.5";
   disabled = !isPy3k;
 
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "1lbh8n66fp3l5s0xvmvsbfvgs3z4knx0gwf0q117n2nfkslf13zp";
+  src = fetchFromGitLab {
+    domain = "gitlab.com";
+    owner = "mailman";
+    repo = "hyperkitty";
+    rev = version;
+    sha256 = "0v70r0r6w0q56hk2hw1qp3ci0bwd9x8inf4gai6ybjqjfskqrxi4";
   };
 
-  nativeBuildInputs = [ isort ];
+  postPatch = ''
+    # isort is a development dependency
+    sed -i '/isort/d' setup.py
+  '';
+
   propagatedBuildInputs = [
-    robot-detection django_extensions rjsmin cssmin django-mailman3
-    django-haystack flufl_lock networkx python-dateutil defusedxml
-    django-paintstore djangorestframework django django-q
-    django_compressor six psycopg2 isort
+    django
+    django-gravatar2
+    django-haystack
+    django-mailman3
+    django-q
+    django_compressor
+    django_extensions
+    djangorestframework
+    flufl_lock
+    mistune_2_0
+    networkx
+    psycopg2
+    python-dateutil
+    robot-detection
   ];
 
   # Some of these are optional runtime dependencies that are not
   # listed as dependencies in setup.py.  To use these, they should be
   # dependencies of the Django Python environment, but not of
   # HyperKitty so they're not included for people who don't need them.
-  checkInputs = [ beautifulsoup4 coverage elasticsearch mock whoosh ];
+  checkInputs = [
+    beautifulsoup4
+    elasticsearch
+    mock
+    whoosh
+  ];
 
   checkPhase = ''
     cd $NIX_BUILD_TOP/$sourceRoot
diff --git a/pkgs/servers/x11/xorg/default.nix b/pkgs/servers/x11/xorg/default.nix
index 018ec774a3a9..49f5a24eaaea 100644
--- a/pkgs/servers/x11/xorg/default.nix
+++ b/pkgs/servers/x11/xorg/default.nix
@@ -3087,11 +3087,11 @@ lib.makeScope newScope (self: with self; {
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xorgproto = callPackage ({ stdenv, pkg-config, fetchurl, libXt, python3 }: stdenv.mkDerivation {
     pname = "xorgproto";
-    version = "2021.4";
+    version = "2021.5";
     builder = ./builder.sh;
     src = fetchurl {
-      url = "mirror://xorg/individual/proto/xorgproto-2021.4.tar.bz2";
-      sha256 = "1gwz8lhvczjinndrq2jb0swfvhk7p65rprkwiqwlp132041mfl8g";
+      url = "mirror://xorg/individual/proto/xorgproto-2021.5.tar.bz2";
+      sha256 = "05d0kib351qmnlfimaznaw0220fr0ym7fx2gn9h2jqxxilxncbxa";
     };
     hardeningDisable = [ "bindnow" "relro" ];
     nativeBuildInputs = [ pkg-config python3 ];
diff --git a/pkgs/servers/x11/xorg/tarballs.list b/pkgs/servers/x11/xorg/tarballs.list
index 64ecbfa0a4a5..bc9344f66cb3 100644
--- a/pkgs/servers/x11/xorg/tarballs.list
+++ b/pkgs/servers/x11/xorg/tarballs.list
@@ -211,7 +211,7 @@ mirror://xorg/individual/lib/libXxf86misc-1.0.4.tar.bz2
 mirror://xorg/individual/lib/libXxf86vm-1.1.4.tar.bz2
 mirror://xorg/individual/lib/xtrans-1.4.0.tar.bz2
 mirror://xorg/individual/proto/xcb-proto-1.14.1.tar.xz
-mirror://xorg/individual/proto/xorgproto-2021.4.tar.bz2
+mirror://xorg/individual/proto/xorgproto-2021.5.tar.bz2
 mirror://xorg/individual/util/gccmakedep-1.0.3.tar.bz2
 mirror://xorg/individual/util/imake-1.0.8.tar.bz2
 mirror://xorg/individual/util/lndir-1.0.3.tar.bz2
diff --git a/pkgs/stdenv/darwin/default.nix b/pkgs/stdenv/darwin/default.nix
index 81313fb390ec..b25a840f460e 100644
--- a/pkgs/stdenv/darwin/default.nix
+++ b/pkgs/stdenv/darwin/default.nix
@@ -458,7 +458,7 @@ rec {
           libxml2 gettext sharutils gmp libarchive ncurses pkg-config libedit groff
           openssh sqlite sed serf openldap db cyrus-sasl expat apr-util subversion xz
           findfreetype libssh curl cmake autoconf automake libtool ed cpio coreutils
-          libssh2 nghttp2 libkrb5 ninja brotli;
+          libssh2 nghttp2 libkrb5 ninja brotli libiconv;
 
         "${finalLlvmPackages}" = super."${finalLlvmPackages}" // (
           let
diff --git a/pkgs/stdenv/generic/make-derivation.nix b/pkgs/stdenv/generic/make-derivation.nix
index 56cfa0c503f8..8fa306370494 100644
--- a/pkgs/stdenv/generic/make-derivation.nix
+++ b/pkgs/stdenv/generic/make-derivation.nix
@@ -305,6 +305,9 @@ else let
           cpu_family = '${cpuFamily stdenv.targetPlatform}'
           cpu = '${stdenv.targetPlatform.parsed.cpu.name}'
           endian = ${if stdenv.targetPlatform.isLittleEndian then "'little'" else "'big'"}
+
+          [binaries]
+          llvm-config = 'llvm-config-native'
         '';
       in [ "--cross-file=${crossFile}" ] ++ mesonFlags;
     } // lib.optionalAttrs (attrs.enableParallelBuilding or false) {
diff --git a/pkgs/stdenv/generic/setup.sh b/pkgs/stdenv/generic/setup.sh
index f90d9020f89f..fd0535898a8d 100644
--- a/pkgs/stdenv/generic/setup.sh
+++ b/pkgs/stdenv/generic/setup.sh
@@ -1,5 +1,6 @@
 set -eu
 set -o pipefail
+shopt -s inherit_errexit
 
 if [[ -n "${BASH_VERSINFO-}" && "${BASH_VERSINFO-}" -lt 4 ]]; then
     echo "Detected Bash version that isn't supported by Nixpkgs (${BASH_VERSION})"
@@ -409,15 +410,14 @@ findInputs() {
     # The current package's host and target offset together
     # provide a <=-preserving homomorphism from the relative
     # offsets to current offset
-    local -i mapOffsetResult
     function mapOffset() {
         local -r inputOffset="$1"
+        local -n outputOffset="$2"
         if (( inputOffset <= 0 )); then
-            local -r outputOffset=$((inputOffset + hostOffset))
+            outputOffset=$((inputOffset + hostOffset))
         else
-            local -r outputOffset=$((inputOffset - 1 + targetOffset))
+            outputOffset=$((inputOffset - 1 + targetOffset))
         fi
-        mapOffsetResult="$outputOffset"
     }
 
     # Host offset relative to that of the package whose immediate
@@ -429,16 +429,16 @@ findInputs() {
 
         # Host offset relative to the package currently being
         # built---as absolute an offset as will be used.
-        mapOffset relHostOffset
-        local -i hostOffsetNext="$mapOffsetResult"
+        local hostOffsetNext
+        mapOffset "$relHostOffset" hostOffsetNext
 
         # Ensure we're in bounds relative to the package currently
         # being built.
-        [[ "${allPlatOffsets[*]}" = *"$hostOffsetNext"*  ]] || continue
+        (( -1 <= hostOffsetNext && hostOffsetNext <= 1 )) || continue
 
         # Target offset relative to the *host* offset of the package
         # whose immediate dependencies we are currently exploring.
-        local -i relTargetOffset
+        local relTargetOffset
         for relTargetOffset in "${allPlatOffsets[@]}"; do
             (( "$relHostOffset" <= "$relTargetOffset" )) || continue
 
@@ -448,12 +448,12 @@ findInputs() {
 
             # Target offset relative to the package currently being
             # built.
-            mapOffset relTargetOffset
-            local -i targetOffsetNext="$mapOffsetResult"
+            local targetOffsetNext
+            mapOffset "$relTargetOffset" targetOffsetNext
 
             # Once again, ensure we're in bounds relative to the
             # package currently being built.
-            [[ "${allPlatOffsets[*]}" = *"$targetOffsetNext"* ]] || continue
+            (( -1 <= hostOffsetNext && hostOffsetNext <= 1 )) || continue
 
             [[ -f "$pkg/nix-support/$file" ]] || continue
 
diff --git a/pkgs/stdenv/linux/default.nix b/pkgs/stdenv/linux/default.nix
index 1fbd3cba27ef..d2c74f7722d3 100644
--- a/pkgs/stdenv/linux/default.nix
+++ b/pkgs/stdenv/linux/default.nix
@@ -375,12 +375,7 @@ in
       targetPlatform = localSystem;
       inherit config;
 
-      preHook = ''
-        # Make "strip" produce deterministic output, by setting
-        # timestamps etc. to a fixed value.
-        commonStripFlags="--enable-deterministic-archives"
-        ${commonPreHook}
-      '';
+      preHook = commonPreHook;
 
       initialPath =
         ((import ../common-path.nix) {pkgs = prevStage;});
diff --git a/pkgs/tools/admin/lxd/default.nix b/pkgs/tools/admin/lxd/default.nix
index 12ea0f7a55d0..ec6b867f9f7c 100644
--- a/pkgs/tools/admin/lxd/default.nix
+++ b/pkgs/tools/admin/lxd/default.nix
@@ -1,22 +1,14 @@
 { lib, hwdata, pkg-config, lxc, buildGoPackage, fetchurl
 , makeWrapper, acl, rsync, gnutar, xz, btrfs-progs, gzip, dnsmasq, attr
-, squashfsTools, iproute2, iptables, ebtables, iptables-nftables-compat, libcap
+, squashfsTools, iproute2, iptables, libcap
 , dqlite, raft-canonical, sqlite-replication, udev
 , writeShellScriptBin, apparmor-profiles, apparmor-parser
 , criu
 , bash
 , installShellFiles
-, nftablesSupport ? false
 , nixosTests
 }:
 
-let
-  networkPkgs = if nftablesSupport then
-    [ iptables-nftables-compat ]
-  else
-    [ iptables ebtables ];
-
-in
 buildGoPackage rec {
   pname = "lxd";
   version = "4.19";
@@ -45,7 +37,7 @@ buildGoPackage rec {
     rm $out/bin/{deps,macaroon-identity,generate}
 
     wrapProgram $out/bin/lxd --prefix PATH : ${lib.makeBinPath (
-      networkPkgs
+      [ iptables ]
       ++ [ acl rsync gnutar xz btrfs-progs gzip dnsmasq squashfsTools iproute2 bash criu attr ]
       ++ [ (writeShellScriptBin "apparmor_parser" ''
              exec '${apparmor-parser}/bin/apparmor_parser' -I '${apparmor-profiles}/etc/apparmor.d' "$@"
diff --git a/pkgs/tools/audio/opl3bankeditor/common.nix b/pkgs/tools/audio/opl3bankeditor/common.nix
index 9f6972ce9540..04f4d3aae5ab 100644
--- a/pkgs/tools/audio/opl3bankeditor/common.nix
+++ b/pkgs/tools/audio/opl3bankeditor/common.nix
@@ -53,7 +53,6 @@ mkDerivation rec {
     mv "${binname}.app" $out/Applications/
 
     install_name_tool -change {,${qwt}/lib/}libqwt.6.dylib "$out/Applications/${binname}.app/Contents/MacOS/${binname}"
-    wrapQtApp "$out/Applications/${binname}.app/Contents/MacOS/${binname}"
 
     ln -s "$out/Applications/${binname}.app/Contents/MacOS/${binname}" $out/bin/${mainProgram}
   '';
diff --git a/pkgs/tools/compression/gzip/default.nix b/pkgs/tools/compression/gzip/default.nix
index 6bcd5ae0c427..8bec5b481c90 100644
--- a/pkgs/tools/compression/gzip/default.nix
+++ b/pkgs/tools/compression/gzip/default.nix
@@ -11,11 +11,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gzip";
-  version = "1.10";
+  version = "1.11";
 
   src = fetchurl {
     url = "mirror://gnu/gzip/${pname}-${version}.tar.xz";
-    sha256 = "1h6p374d3j8d4cdfydzls021xa2yby8myc0h8d6m8bc7k6ncq9c4";
+    sha256 = "01vrly90rvc98af6rcmrb3gwv1l6pylasvsdka23dffwizb9b6lv";
   };
 
   outputs = [ "out" "man" "info" ];
diff --git a/pkgs/tools/filesystems/android-file-transfer/default.nix b/pkgs/tools/filesystems/android-file-transfer/default.nix
index a8511f8b99ae..b355b0eb6864 100644
--- a/pkgs/tools/filesystems/android-file-transfer/default.nix
+++ b/pkgs/tools/filesystems/android-file-transfer/default.nix
@@ -29,9 +29,6 @@ mkDerivation rec {
   postInstall = lib.optionalString stdenv.isDarwin ''
     mkdir $out/Applications
     mv $out/*.app $out/Applications
-    for f in $out/Applications/android-file-transfer.app/Contents/MacOS/*; do
-      wrapQtApp "$f"
-    done
   '';
 
   meta = with lib; {
diff --git a/pkgs/tools/graphics/gnuplot/default.nix b/pkgs/tools/graphics/gnuplot/default.nix
index 741468dfd994..c6c90442ddce 100644
--- a/pkgs/tools/graphics/gnuplot/default.nix
+++ b/pkgs/tools/graphics/gnuplot/default.nix
@@ -58,8 +58,6 @@ in
        --prefix PATH : '${coreutils}/bin' \
        --prefix PATH : '${fontconfig.bin}/bin' \
        --run '. ${./set-gdfontpath-from-fontconfig.sh}'
-  '' + lib.optionalString (stdenv.isDarwin && withQt) ''
-     wrapQtApp $out/bin/gnuplot
   '';
 
   enableParallelBuilding = true;
diff --git a/pkgs/tools/misc/coreutils/default.nix b/pkgs/tools/misc/coreutils/default.nix
index f22a7268fbc9..16f3e4c721f7 100644
--- a/pkgs/tools/misc/coreutils/default.nix
+++ b/pkgs/tools/misc/coreutils/default.nix
@@ -22,14 +22,14 @@ with lib;
 
 stdenv.mkDerivation (rec {
   pname = "coreutils";
-  version = "8.32";
+  version = "9.0";
 
   src = fetchurl {
     url = "mirror://gnu/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-RFjY3nhJ30TMqxXhaxVIsoUiTbul8I+sBwwcDgvMTPo=";
+    sha256 = "sha256-zjCs30pBvFuzDdlV6eqnX6IWtOPesIiJ7TJDPHs7l84=";
   };
 
-  patches = [ ./sys-getdents-undeclared.patch ]
+  patches = [ ./fix-chmod-exit-code.patch ]
     ++ optional stdenv.hostPlatform.isCygwin ./coreutils-8.23-4.cygwin.patch
     # fix gnulib tests on 32-bit ARM. Included on coreutils master.
     # https://lists.gnu.org/r/bug-gnulib/2020-08/msg00225.html
@@ -74,23 +74,26 @@ stdenv.mkDerivation (rec {
     sed '2i print "Skipping id zero test"; exit 77' -i ./tests/id/zero.sh
     sed '2i print "Skipping misc help-versiob test"; exit 77' -i ./tests/misc/help-version.sh
     sed '2i print "Skipping chown separator test"; exit 77' -i ./tests/chown/separator.sh
-  '' + optionalString (stdenv.hostPlatform.libc == "musl") (lib.concatStringsSep "\n" [
+  '' + (optionalString (stdenv.hostPlatform.libc == "musl") (lib.concatStringsSep "\n" [
     ''
       echo "int main() { return 77; }" > gnulib-tests/test-parse-datetime.c
       echo "int main() { return 77; }" > gnulib-tests/test-getlogin.c
     ''
-  ]);
+  ])) + (optionalString stdenv.isAarch64 ''
+    sed '2i print "Skipping tail assert test"; exit 77' -i ./tests/tail-2/assert.sh
+  '');
 
   outputs = [ "out" "info" ];
 
-  nativeBuildInputs = [ perl xz.bin ]
-    ++ optionals stdenv.hostPlatform.isCygwin [ autoreconfHook texinfo ];  # due to patch
+  nativeBuildInputs = [ perl xz.bin autoreconfHook ] # autoreconfHook is due to patch, normally only needed for cygwin
+    ++ optionals stdenv.hostPlatform.isCygwin [ texinfo ];  # due to patch
   configureFlags = [ "--with-packager=https://NixOS.org" ]
     ++ optional (singleBinary != false)
       ("--enable-single-binary" + optionalString (isString singleBinary) "=${singleBinary}")
     ++ optional withOpenssl "--with-openssl"
     ++ optional stdenv.hostPlatform.isSunOS "ac_cv_func_inotify_init=no"
     ++ optional withPrefix "--program-prefix=g"
+    ++ optional stdenv.isDarwin "--disable-nls" # the shipped configure script doesn't enable nls, but using autoreconfHook does so which breaks the build
     ++ optionals (stdenv.hostPlatform != stdenv.buildPlatform && stdenv.hostPlatform.libc == "glibc") [
       # TODO(19b98110126fde7cbb1127af7e3fe1568eacad3d): Needed for fstatfs() I
       # don't know why it is not properly detected cross building with glibc.
@@ -152,7 +155,7 @@ stdenv.mkDerivation (rec {
     license = licenses.gpl3Plus;
     platforms = platforms.unix ++ platforms.windows;
     priority = 10;
-    maintainers = [ maintainers.eelco ];
+    maintainers = [ maintainers.eelco maintainers.das_j ];
   };
 } // optionalAttrs stdenv.hostPlatform.isMusl {
   # Work around a bogus warning in conjunction with musl.
diff --git a/pkgs/tools/misc/coreutils/fix-chmod-exit-code.patch b/pkgs/tools/misc/coreutils/fix-chmod-exit-code.patch
new file mode 100644
index 000000000000..a966c3bda917
--- /dev/null
+++ b/pkgs/tools/misc/coreutils/fix-chmod-exit-code.patch
@@ -0,0 +1,108 @@
+From e8b56ebd536e82b15542a00c888109471936bfda Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?P=C3=A1draig=20Brady?= <P@draigBrady.com>
+Date: Fri, 24 Sep 2021 20:57:41 +0100
+Subject: [PATCH] chmod: fix exit status when ignoring symlinks
+
+* src/chmod.c: Reorder enum so CH_NOT_APPLIED
+can be treated as a non error.
+* tests/chmod/ignore-symlink.sh: A new test.
+* tests/local.mk: Reference the new test.
+* NEWS: Mention the bug fix.
+Fixes https://bugs.gnu.org/50784
+---
+ NEWS                          |  6 ++++++
+ src/chmod.c                   |  4 ++--
+ tests/chmod/ignore-symlink.sh | 31 +++++++++++++++++++++++++++++++
+ tests/local.mk                |  1 +
+ 4 files changed, 40 insertions(+), 2 deletions(-)
+ create mode 100755 tests/chmod/ignore-symlink.sh
+
+diff --git a/NEWS b/NEWS
+index a1470a7d7..1cb3c28a1 100644
+--- a/NEWS
++++ b/NEWS
+@@ -2,6 +2,12 @@ GNU coreutils NEWS                                    -*- outline -*-
+ 
+ * Noteworthy changes in release ?.? (????-??-??) [?]
+ 
++** Bug fixes
++
++  chmod -R no longer exits with error status when encountering symlinks.
++  All files would be processed correctly, but the exit status was incorrect.
++  [bug introduced in coreutils-9.0]
++
+ 
+ * Noteworthy changes in release 9.0 (2021-09-24) [stable]
+ 
+diff --git a/src/chmod.c b/src/chmod.c
+index 37b04f500..57ac47f33 100644
+--- a/src/chmod.c
++++ b/src/chmod.c
+@@ -44,8 +44,8 @@ struct change_status
+   enum
+     {
+       CH_NO_STAT,
+-      CH_NOT_APPLIED,
+       CH_FAILED,
++      CH_NOT_APPLIED,
+       CH_NO_CHANGE_REQUESTED,
+       CH_SUCCEEDED
+     }
+@@ -322,7 +322,7 @@ process_file (FTS *fts, FTSENT *ent)
+   if ( ! recurse)
+     fts_set (fts, ent, FTS_SKIP);
+ 
+-  return CH_NO_CHANGE_REQUESTED <= ch.status;
++  return CH_NOT_APPLIED <= ch.status;
+ }
+ 
+ /* Recursively change the modes of the specified FILES (the last entry
+diff --git a/tests/chmod/ignore-symlink.sh b/tests/chmod/ignore-symlink.sh
+new file mode 100755
+index 000000000..5ce3de816
+--- /dev/null
++++ b/tests/chmod/ignore-symlink.sh
+@@ -0,0 +1,31 @@
++#!/bin/sh
++# Test for proper exit code of chmod on a processed symlink.
++
++# Copyright (C) 2021 Free Software Foundation, Inc.
++
++# This program is free software: you can redistribute it and/or modify
++# it under the terms of the GNU General Public License as published by
++# the Free Software Foundation, either version 3 of the License, or
++# (at your option) any later version.
++
++# This program is distributed in the hope that it will be useful,
++# but WITHOUT ANY WARRANTY; without even the implied warranty of
++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++# GNU General Public License for more details.
++
++# You should have received a copy of the GNU General Public License
++# along with this program.  If not, see <https://www.gnu.org/licenses/>.
++
++. "${srcdir=.}/tests/init.sh"; path_prepend_ ./src
++print_ver_ chmod
++
++mkdir dir || framework_failure_
++touch dir/f || framework_failure_
++ln -s f dir/l || framework_failure_
++
++# This operation ignores symlinks but should succeed.
++chmod u+w -R dir 2> out || fail=1
++
++compare /dev/null out || fail=1
++
++Exit $fail
+diff --git a/tests/local.mk b/tests/local.mk
+index 228d0e368..b5b893fb7 100644
+--- a/tests/local.mk
++++ b/tests/local.mk
+@@ -456,6 +456,7 @@ all_tests =					\
+   tests/chmod/c-option.sh			\
+   tests/chmod/equal-x.sh			\
+   tests/chmod/equals.sh				\
++  tests/chmod/ignore-symlink.sh			\
+   tests/chmod/inaccessible.sh			\
+   tests/chmod/octal.sh				\
+   tests/chmod/setgid.sh				\
diff --git a/pkgs/tools/misc/coreutils/sys-getdents-undeclared.patch b/pkgs/tools/misc/coreutils/sys-getdents-undeclared.patch
deleted file mode 100644
index 0af5de68415a..000000000000
--- a/pkgs/tools/misc/coreutils/sys-getdents-undeclared.patch
+++ /dev/null
@@ -1,100 +0,0 @@
-From 10fcb97bd728f09d4a027eddf8ad2900f0819b0a Mon Sep 17 00:00:00 2001
-From: Paul Eggert <eggert@cs.ucla.edu>
-Date: Thu, 5 Mar 2020 17:25:29 -0800
-Subject: ls: restore 8.31 behavior on removed directories
-
-* NEWS: Mention this.
-* src/ls.c: Do not include <sys/sycall.h>
-(print_dir): Don't worry about whether the directory is removed.
-* tests/ls/removed-directory.sh: Adjust to match new (i.e., old)
-behavior.
----
- NEWS (removed diff in nixpkgs)|  6 ++++++
- src/ls.c                      | 22 ----------------------
- tests/ls/removed-directory.sh | 10 ++--------
- 3 files changed, 8 insertions(+), 30 deletions(-)
-
-diff --git a/src/ls.c b/src/ls.c
-index 24b983287..4acf5f44d 100644
---- a/src/ls.c
-+++ b/src/ls.c
-@@ -49,10 +49,6 @@
- # include <sys/ptem.h>
- #endif
- 
--#ifdef __linux__
--# include <sys/syscall.h>
--#endif
--
- #include <stdio.h>
- #include <assert.h>
- #include <setjmp.h>
-@@ -2896,7 +2892,6 @@ print_dir (char const *name, char const *realname, bool command_line_arg)
-   struct dirent *next;
-   uintmax_t total_blocks = 0;
-   static bool first = true;
--  bool found_any_entries = false;
- 
-   errno = 0;
-   dirp = opendir (name);
-@@ -2972,7 +2967,6 @@ print_dir (char const *name, char const *realname, bool command_line_arg)
-       next = readdir (dirp);
-       if (next)
-         {
--          found_any_entries = true;
-           if (! file_ignored (next->d_name))
-             {
-               enum filetype type = unknown;
-@@ -3018,22 +3012,6 @@ print_dir (char const *name, char const *realname, bool command_line_arg)
-           if (errno != EOVERFLOW)
-             break;
-         }
--#ifdef __linux__
--      else if (! found_any_entries)
--        {
--          /* If readdir finds no directory entries at all, not even "." or
--             "..", then double check that the directory exists.  */
--          if (syscall (SYS_getdents, dirfd (dirp), NULL, 0) == -1
--              && errno != EINVAL)
--            {
--              /* We exclude EINVAL as that pertains to buffer handling,
--                 and we've passed NULL as the buffer for simplicity.
--                 ENOENT is returned if appropriate before buffer handling.  */
--              file_failure (command_line_arg, _("reading directory %s"), name);
--            }
--          break;
--        }
--#endif
-       else
-         break;
- 
-diff --git a/tests/ls/removed-directory.sh b/tests/ls/removed-directory.sh
-index e8c835dab..fe8f929a1 100755
---- a/tests/ls/removed-directory.sh
-+++ b/tests/ls/removed-directory.sh
-@@ -26,20 +26,14 @@ case $host_triplet in
-   *) skip_ 'non linux kernel' ;;
- esac
- 
--LS_FAILURE=2
--
--cat <<\EOF >exp-err || framework_failure_
--ls: reading directory '.': No such file or directory
--EOF
--
- cwd=$(pwd)
- mkdir d || framework_failure_
- cd d || framework_failure_
- rmdir ../d || framework_failure_
- 
--returns_ $LS_FAILURE ls >../out 2>../err || fail=1
-+ls >../out 2>../err || fail=1
- cd "$cwd" || framework_failure_
- compare /dev/null out || fail=1
--compare exp-err err || fail=1
-+compare /dev/null err || fail=1
- 
- Exit $fail
--- 
-cgit v1.2.1
-
diff --git a/pkgs/tools/networking/curl/CVE-2021-22945.patch b/pkgs/tools/networking/curl/CVE-2021-22945.patch
new file mode 100644
index 000000000000..f8e570d2d65c
--- /dev/null
+++ b/pkgs/tools/networking/curl/CVE-2021-22945.patch
@@ -0,0 +1,27 @@
+From 43157490a5054bd24256fe12876931e8abc9df49 Mon Sep 17 00:00:00 2001
+From: z2_ on hackerone <>
+Date: Tue, 24 Aug 2021 09:50:33 +0200
+Subject: [PATCH] mqtt: clear the leftovers pointer when sending succeeds
+
+CVE-2021-22945
+
+Bug: https://curl.se/docs/CVE-2021-22945.html
+---
+ lib/mqtt.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/lib/mqtt.c b/lib/mqtt.c
+index f077e6c3dc44..fcd40b41e600 100644
+--- a/lib/mqtt.c
++++ b/lib/mqtt.c
+@@ -128,6 +128,10 @@ static CURLcode mqtt_send(struct Curl_easy *data,
+     mq->sendleftovers = sendleftovers;
+     mq->nsend = nsend;
+   }
++  else {
++    mq->sendleftovers = NULL;
++    mq->nsend = 0;
++  }
+   return result;
+ }
+ 
diff --git a/pkgs/tools/networking/curl/default.nix b/pkgs/tools/networking/curl/default.nix
index b3572e01c96d..7d6b96ac9f01 100644
--- a/pkgs/tools/networking/curl/default.nix
+++ b/pkgs/tools/networking/curl/default.nix
@@ -57,6 +57,7 @@ stdenv.mkDerivation rec {
     ./CVE-2021-22897.patch
     ./CVE-2021-22898.patch
     ./CVE-2021-22901.patch
+    ./CVE-2021-22945.patch
   ];
 
   outputs = [ "bin" "dev" "out" "man" "devdoc" ];
diff --git a/pkgs/tools/networking/ferm/default.nix b/pkgs/tools/networking/ferm/default.nix
index 29f9481fe328..580ca848c62b 100644
--- a/pkgs/tools/networking/ferm/default.nix
+++ b/pkgs/tools/networking/ferm/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, makeWrapper, perl, ebtables, ipset, iptables, nixosTests }:
+{ lib, stdenv, fetchurl, makeWrapper, perl, iptables, nixosTests }:
 
 let
   inherit (lib.versions) majorMinor;
@@ -23,7 +23,7 @@ in stdenv.mkDerivation rec {
   postInstall = ''
     rm -r $out/lib/systemd
     for i in "$out/sbin/"*; do
-      wrapProgram "$i" --prefix PATH : "${lib.makeBinPath [ iptables ipset ebtables ]}"
+      wrapProgram "$i" --prefix PATH : "${lib.makeBinPath [ iptables ]}"
     done
   '';
 
diff --git a/pkgs/tools/networking/modemmanager/default.nix b/pkgs/tools/networking/modemmanager/default.nix
index e352e67d3fe5..299342197897 100644
--- a/pkgs/tools/networking/modemmanager/default.nix
+++ b/pkgs/tools/networking/modemmanager/default.nix
@@ -5,11 +5,11 @@
 
 stdenv.mkDerivation rec {
   pname = "modemmanager";
-  version = "1.16.10";
+  version = "1.18.2";
 
   src = fetchurl {
     url = "https://www.freedesktop.org/software/ModemManager/ModemManager-${version}.tar.xz";
-    sha256 = "sha256-LM8fcWwtEh6OZwm8+K8p7oaXGpCtrMoujWKIswJ4hi4=";
+    sha256 = "sha256-N0vhWK4cH7OKKe7xzDzfif81NrSP8TINIIqyBOpsX4o=";
   };
 
   nativeBuildInputs = [ vala gobject-introspection gettext pkg-config ];
diff --git a/pkgs/tools/networking/networkmanager/default.nix b/pkgs/tools/networking/networkmanager/default.nix
index 8a1a6dd8fa1b..3913cb0520b7 100644
--- a/pkgs/tools/networking/networkmanager/default.nix
+++ b/pkgs/tools/networking/networkmanager/default.nix
@@ -54,11 +54,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "networkmanager";
-  version = "1.32.10";
+  version = "1.32.12";
 
   src = fetchurl {
     url = "mirror://gnome/sources/NetworkManager/${lib.versions.majorMinor version}/NetworkManager-${version}.tar.xz";
-    sha256 = "sha256-PlzMZoBWWePxGnGOOlmflya3mgHW/xSBS+ati8Xai7g=";
+    sha256 = "sha256-qKs2oKUC/nPNjjustlhfl/u5Tr73nids268Rwz/49Us=";
   };
 
   outputs = [ "out" "dev" "devdoc" "man" "doc" ];
diff --git a/pkgs/tools/networking/openssh/common.nix b/pkgs/tools/networking/openssh/common.nix
index eaa42039dbaa..fefa80b9c4f6 100644
--- a/pkgs/tools/networking/openssh/common.nix
+++ b/pkgs/tools/networking/openssh/common.nix
@@ -122,7 +122,7 @@ stdenv.mkDerivation rec {
     changelog = "https://www.openssh.com/releasenotes.html";
     license = licenses.bsd2;
     platforms = platforms.unix ++ platforms.windows;
-    maintainers = with maintainers; [ eelco aneeshusa ];
+    maintainers = (extraMeta.maintainers or []) ++ (with maintainers; [ eelco aneeshusa ]);
     mainProgram = "ssh";
   } // extraMeta;
 }
diff --git a/pkgs/tools/networking/openssh/default.nix b/pkgs/tools/networking/openssh/default.nix
index c8bc1f8a1dda..4bc181717168 100644
--- a/pkgs/tools/networking/openssh/default.nix
+++ b/pkgs/tools/networking/openssh/default.nix
@@ -1,4 +1,4 @@
-{ callPackage, fetchurl, fetchpatch, fetchFromGitHub, autoreconfHook }:
+{ callPackage, lib, fetchurl, fetchpatch, fetchFromGitHub, autoreconfHook }:
 let
   common = opts: callPackage (import ./common.nix opts) { };
 in
@@ -6,14 +6,15 @@ in
 
   openssh = common rec {
     pname = "openssh";
-    version = "8.7p1";
+    version = "8.8p1";
 
     src = fetchurl {
       url = "mirror://openbsd/OpenSSH/portable/openssh-${version}.tar.gz";
-      sha256 = "090yxpi03pxxzb4ppx8g8hdpw7c4nf8p0avr6c7ybsaana5lp8vw";
+      sha256 = "1s8z6f7mi1pwsl79cqai8cr350m5lf2ifcxff57wx6mvm478k425";
     };
 
     extraPatches = [ ./ssh-keysign-8.5.patch ];
+    extraMeta.maintainers = with lib.maintainers; [ das_j ];
   };
 
   openssh_hpn = common rec {
diff --git a/pkgs/tools/networking/ppp/default.nix b/pkgs/tools/networking/ppp/default.nix
index 708932ac1c9d..5608b032ac50 100644
--- a/pkgs/tools/networking/ppp/default.nix
+++ b/pkgs/tools/networking/ppp/default.nix
@@ -4,6 +4,7 @@
 , substituteAll
 , libpcap
 , openssl
+, bash
 }:
 
 stdenv.mkDerivation rec {
@@ -31,18 +32,22 @@ stdenv.mkDerivation rec {
   buildInputs = [
     libpcap
     openssl
+    bash
   ];
 
   postPatch = ''
-    # strip is not found when cross compiling with seemingly no way to point
-    # make to the right place, fixup phase will correctly strip
-    # everything anyway so we remove it from the Makefiles
     for file in $(find -name Makefile.linux); do
-      substituteInPlace "$file" --replace '$(INSTALL) -s' '$(INSTALL)'
       substituteInPlace "$file" --replace '-m 4550' '-m 550'
     done
+
+    patchShebangs --host \
+      scripts/{pon,poff,plog}
   '';
 
+  makeFlags = [
+    "CC=${stdenv.cc.targetPrefix}cc"
+  ];
+
   installPhase = ''
     runHook preInstall
     mkdir -p $out/bin
@@ -52,9 +57,7 @@ stdenv.mkDerivation rec {
   '';
 
   postFixup = ''
-    for tgt in pon poff plog; do
-      substituteInPlace "$out/bin/$tgt" --replace "/usr/sbin" "$out/bin"
-    done
+    substituteInPlace "$out/bin/pon" --replace "/usr/sbin" "$out/bin"
   '';
 
   meta = with lib; {
diff --git a/pkgs/tools/networking/shorewall/default.nix b/pkgs/tools/networking/shorewall/default.nix
index f95fc9d92b18..0c9e515ce094 100644
--- a/pkgs/tools/networking/shorewall/default.nix
+++ b/pkgs/tools/networking/shorewall/default.nix
@@ -1,10 +1,8 @@
 { coreutils
-, ebtables
 , fetchurl
 , gnugrep
 , gnused
 , iproute2
-, ipset
 , iptables
 , perl
 , perlPackages
@@ -17,8 +15,6 @@ let
            [ "${coreutils}/bin"
              "${iproute2}/bin"
              "${iptables}/bin"
-             "${ipset}/bin"
-             "${ebtables}/bin"
              "${util-linux}/bin"
              "${gnugrep}/bin"
              "${gnused}/bin"
@@ -47,9 +43,7 @@ stdenv.mkDerivation rec {
   buildInputs = [
     coreutils
     iproute2
-    ipset
     iptables
-    ebtables
     util-linux
     gnugrep
     gnused
diff --git a/pkgs/tools/text/glogg/default.nix b/pkgs/tools/text/glogg/default.nix
index 306c25498ad3..855490df4ab4 100644
--- a/pkgs/tools/text/glogg/default.nix
+++ b/pkgs/tools/text/glogg/default.nix
@@ -25,7 +25,6 @@ mkDerivation rec {
     mkdir -p $out/Applications
     mv $out/bin/glogg.app $out/Applications/glogg.app
     rm -fr $out/{bin,share}
-    wrapQtApp $out/Applications/glogg.app/Contents/MacOS/glogg
   '';
 
   meta = with lib; {
diff --git a/pkgs/tools/text/gnugrep/default.nix b/pkgs/tools/text/gnugrep/default.nix
index c5a661af1153..bb0c90197d3c 100644
--- a/pkgs/tools/text/gnugrep/default.nix
+++ b/pkgs/tools/text/gnugrep/default.nix
@@ -5,7 +5,7 @@
 # cgit) that are needed here should be included directly in Nixpkgs as
 # files.
 
-let version = "3.6"; in
+let version = "3.7"; in
 
 stdenv.mkDerivation {
   pname = "gnugrep";
@@ -13,7 +13,7 @@ stdenv.mkDerivation {
 
   src = fetchurl {
     url = "mirror://gnu/grep/grep-${version}.tar.xz";
-    sha256 = "0gipv6bzkm1aihj0ncqpyh164xrzgcxcv9r1kwzyk2g1mzl1azk6";
+    sha256 = "0g42svbc1nq5bamxfj6x7320wli4dlj86padk0hwgbk04hqxl42w";
   };
 
   # Perl is needed for testing
diff --git a/pkgs/tools/text/source-highlight/default.nix b/pkgs/tools/text/source-highlight/default.nix
index 8817b7a09fda..4a7b588cd9d4 100644
--- a/pkgs/tools/text/source-highlight/default.nix
+++ b/pkgs/tools/text/source-highlight/default.nix
@@ -4,6 +4,8 @@ stdenv.mkDerivation rec {
   pname = "source-highlight";
   version = "3.1.9";
 
+  outputs = [ "out" "doc" "dev" ];
+
   src = fetchurl {
     url = "mirror://gnu/src-highlite/${pname}-${version}.tar.gz";
     sha256 = "148w47k3zswbxvhg83z38ifi85f9dqcpg7icvvw1cm6bg21x4zrs";
@@ -28,7 +30,10 @@ stdenv.mkDerivation rec {
   strictDeps = true;
   buildInputs = [ boost ];
 
-  configureFlags = [ "--with-boost=${boost.out}" ];
+  configureFlags = [
+    "--with-boost=${boost.out}"
+    "--with-bash-completion=${placeholder "out"}/share/bash_completion.d"
+  ];
 
   doCheck = !stdenv.cc.isClang;
 
@@ -37,8 +42,6 @@ stdenv.mkDerivation rec {
   # them in parallel by make will eventually break one or more tests.
   enableParallelChecking = false;
 
-  outputs = [ "out" "doc" "dev" ];
-
   meta = with lib; {
     description = "Source code renderer with syntax highlighting";
     longDescription = ''
diff --git a/pkgs/tools/typesetting/tex/texlive/combine.nix b/pkgs/tools/typesetting/tex/texlive/combine.nix
index 1367d651a091..9569ec88854f 100644
--- a/pkgs/tools/typesetting/tex/texlive/combine.nix
+++ b/pkgs/tools/typesetting/tex/texlive/combine.nix
@@ -33,9 +33,9 @@ let
       ++ lib.optional (lib.any pkgNeedsRuby splitBin.wrong) ruby;
   };
 
-  uniqueStrings = list: lib.sort (a: b: a < b) (lib.unique list);
+  sortedUniqueStrings = list: lib.sort (a: b: a < b) (lib.unique list);
 
-  mkUniqueOutPaths = pkgs: uniqueStrings
+  mkUniqueOutPaths = pkgs: lib.unique
     (map (p: p.outPath) (builtins.filter lib.isDerivation pkgs));
 
 in (buildEnv {
@@ -124,9 +124,9 @@ in (buildEnv {
     # now filter hyphenation patterns and formats
   (let
     hyphens = lib.filter (p: p.hasHyphens or false && p.tlType == "run") pkgList.splitBin.wrong;
-    hyphenPNames = uniqueStrings (map (p: p.pname) hyphens);
+    hyphenPNames = sortedUniqueStrings (map (p: p.pname) hyphens);
     formats = lib.filter (p: p.hasFormats or false && p.tlType == "run") pkgList.splitBin.wrong;
-    formatPNames = uniqueStrings (map (p: p.pname) formats);
+    formatPNames = sortedUniqueStrings (map (p: p.pname) formats);
     # sed expression that prints the lines in /start/,/end/ except for /end/
     section = start: end: "/${start}/,/${end}/{ /${start}/p; /${end}/!p; };\n";
     script =
diff --git a/pkgs/tools/video/rav1e/default.nix b/pkgs/tools/video/rav1e/default.nix
index 53e139cde3bb..d6fc422b4cd4 100644
--- a/pkgs/tools/video/rav1e/default.nix
+++ b/pkgs/tools/video/rav1e/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, rustPlatform, rust, fetchurl, fetchFromGitHub, lib, nasm, cargo-c, libiconv }:
+{ lib, rust, stdenv, rustPlatform, fetchCrate, nasm, cargo-c, libiconv }:
 
 let
   rustTargetPlatformSpec = rust.toRustTargetSpec stdenv.hostPlatform;
@@ -6,29 +6,13 @@ in rustPlatform.buildRustPackage rec {
   pname = "rav1e";
   version = "0.4.1";
 
-  src = stdenv.mkDerivation rec {
-    name = "${pname}-${version}-source";
-
-    src = fetchFromGitHub {
-      owner = "xiph";
-      repo = "rav1e";
-      rev = "v${version}";
-      sha256 = "0jnq5a3fv6fzzbmprzfxidlcwwgblkwwm0135cfw741wjv7f7h6r";
-    };
-
-    cargoLock = fetchurl {
-      url = "https://github.com/xiph/rav1e/releases/download/v${version}/Cargo.lock";
-      sha256 = "14fi9wam9rs5206rvcd2f3sjpzq41pnfml14w74wn2ws3gpi46zn";
-    };
-
-    installPhase = ''
-      mkdir -p $out
-      cp -r ./* $out/
-      cp ${cargoLock} $out/Cargo.lock
-    '';
+  src = fetchCrate {
+    inherit pname version;
+    sha256 = "sha256-9fBAH1vuLJ3yu8X5+CQGLQFDlzTYoFBUTy3Muo6hLkw=";
   };
 
-  cargoSha256 = "0miq6iiywwbxm6k0alnqg6bnd14pwc8vl9d8fgg6c0vjlfy5zhlb";
+  cargoSha256 = "sha256-QhWVqHcNjJF94uTvHGVnV8MTp2bYOuCEjaMBfViOLRo=";
+
   nativeBuildInputs = [ nasm cargo-c ];
   buildInputs = lib.optionals stdenv.isDarwin [ libiconv ];
 
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index e322993db783..5472abb8f139 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -305,6 +305,8 @@ with pkgs;
 
   html5validator = python3Packages.callPackage ../applications/misc/html5validator { };
 
+  buildcatrust = with python3.pkgs; toPythonApplication buildcatrust;
+
   probe-run = callPackage ../development/tools/rust/probe-run {
     inherit (darwin.apple_sdk.frameworks) AppKit IOKit;
   };
@@ -8604,7 +8606,7 @@ with pkgs;
 
   pycangjie = pythonPackages.pycangjie;
 
-  pycflow2dot = with python.pkgs; toPythonApplication pycflow2dot;
+  pycflow2dot = with python3.pkgs; toPythonApplication pycflow2dot;
 
   pydb = callPackage ../development/tools/pydb { };
 
@@ -13273,12 +13275,6 @@ with pkgs;
     bluezSupport = true;
     x11Support = true;
   };
-  python36Full = python36.override {
-    self = python36Full;
-    pythonAttr = "python36Full";
-    bluezSupport = true;
-    x11Support = true;
-  };
   python37Full = python37.override {
     self = python37Full;
     pythonAttr = "python37Full";
@@ -13304,11 +13300,10 @@ with pkgs;
   python3Packages = python3.pkgs;
 
   pythonInterpreters = callPackage ./../development/interpreters/python { };
-  inherit (pythonInterpreters) python27 python36 python37 python38 python39 python310 python3Minimal pypy27 pypy37;
+  inherit (pythonInterpreters) python27 python37 python38 python39 python310 python3Minimal pypy27 pypy37;
 
   # Python package sets.
   python27Packages = python27.pkgs;
-  python36Packages = python36.pkgs;
   python37Packages = python37.pkgs;
   python38Packages = recurseIntoAttrs python38.pkgs;
   python39Packages = recurseIntoAttrs python39.pkgs;
@@ -13510,7 +13505,9 @@ with pkgs;
   # Needed for autogen
   guile_2_0 = callPackage ../development/interpreters/guile/2.0.nix { };
 
-  guile_2_2 = callPackage ../development/interpreters/guile { };
+  guile_2_2 = callPackage ../development/interpreters/guile/2.2.nix { };
+
+  guile_3_0 = callPackage ../development/interpreters/guile/3.0.nix { };
 
   guile = guile_2_2;
 
@@ -15451,7 +15448,6 @@ with pkgs;
   bobcat = callPackage ../development/libraries/bobcat { };
 
   boehmgc = callPackage ../development/libraries/boehm-gc { };
-  boehmgc_766 = callPackage ../development/libraries/boehm-gc/7.6.6.nix { };
 
   boolstuff = callPackage ../development/libraries/boolstuff { };
 
@@ -18133,6 +18129,7 @@ with pkgs;
 
   libxml2 = callPackage ../development/libraries/libxml2 {
     python = python3;
+    inherit (darwin) libiconv;
   };
 
   libxml2Python = let
@@ -20316,9 +20313,7 @@ with pkgs;
 
   dex2jar = callPackage ../development/tools/java/dex2jar { };
 
-  doh-proxy = callPackage ../servers/dns/doh-proxy {
-    python3Packages = python36Packages;
-  };
+  doh-proxy = callPackage ../servers/dns/doh-proxy { };
 
   doh-proxy-rust = callPackage ../servers/dns/doh-proxy-rust {
     inherit (darwin.apple_sdk.frameworks) Security;
@@ -21679,9 +21674,9 @@ with pkgs;
   iputils = hiPrio (callPackage ../os-specific/linux/iputils { });
   # hiPrio for collisions with inetutils (ping and tftpd.8.gz)
 
-  iptables = iptables-legacy;
-  iptables-legacy = callPackage ../os-specific/linux/iptables { };
-  iptables-nftables-compat = callPackage ../os-specific/linux/iptables { nftablesCompat = true; };
+  iptables = callPackage ../os-specific/linux/iptables { };
+  iptables-legacy = callPackage ../os-specific/linux/iptables { nftablesCompat = false; };
+  iptables-nftables-compat = iptables;
 
   iptstate = callPackage ../os-specific/linux/iptstate { } ;
 
@@ -22463,9 +22458,8 @@ with pkgs;
   util-linuxCurses = util-linux;
 
   util-linuxMinimal = if stdenv.isLinux then appendToName "minimal" (util-linux.override {
-    minimal = true;
+    nlsSupport = false;
     ncurses = null;
-    perl = null;
     systemd = null;
   }) else util-linux;
 
@@ -31332,9 +31326,9 @@ with pkgs;
   } // (config.caffe or {}));
 
   caffe2 = callPackage ../development/libraries/science/math/caffe2 (rec {
-    inherit (python36Packages) python future six numpy pydot;
+    inherit (python3Packages) python future six numpy pydot;
     protobuf = protobuf3_1;
-    python-protobuf = python36Packages.protobuf.override { inherit protobuf; };
+    python-protobuf = python3Packages.protobuf.override { inherit protobuf; };
     opencv3 = opencv3WithoutCuda; # Used only for image loading.
   });
 
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 573d73ba7cf6..cf8faad01c58 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -1306,6 +1306,8 @@ in {
 
   build = callPackage ../development/python-modules/build { };
 
+  buildcatrust = callPackage ../development/python-modules/buildcatrust { };
+
   bumps = callPackage ../development/python-modules/bumps { };
 
   bunch = callPackage ../development/python-modules/bunch { };
diff --git a/pkgs/top-level/release-python.nix b/pkgs/top-level/release-python.nix
index 485410356048..af492cc4b987 100644
--- a/pkgs/top-level/release-python.nix
+++ b/pkgs/top-level/release-python.nix
@@ -4,7 +4,10 @@
 */
 
 { # The platforms for which we build Nixpkgs.
-  supportedSystems ? [ "x86_64-linux" ]
+  supportedSystems ? [
+    "aarch64-linux"
+    "x86_64-linux"
+  ]
 , # Attributes passed to nixpkgs. Don't build packages marked as unfree.
   nixpkgsArgs ? { config = { allowUnfree = false; inHydra = true; }; }
 }: