Merge master into staging-next

33 files changed, 388 insertions, 64 deletions

diff --git a/doc/builders/fetchers.chapter.md b/doc/builders/fetchers.chapter.md
index 16e4baa966b0d..317c9430cd005 100644
--- a/doc/builders/fetchers.chapter.md
+++ b/doc/builders/fetchers.chapter.md
@@ -72,3 +72,7 @@ This is used with Savannah repositories. The arguments expected are very similar
 ## `fetchFromRepoOrCz`
 
 This is used with repo.or.cz repositories. The arguments expected are very similar to fetchFromGitHub above.
+
+## `fetchFromSourcehut`
+
+This is used with sourcehut repositories. The arguments expected are very similar to fetchFromGitHub above. Don't forget the tilde (~) in front of the user name!
diff --git a/nixos/modules/services/networking/privoxy.nix b/nixos/modules/services/networking/privoxy.nix
index f1a9c6029cb07..7c22b7d09b9bd 100644
--- a/nixos/modules/services/networking/privoxy.nix
+++ b/nixos/modules/services/networking/privoxy.nix
@@ -205,9 +205,8 @@ in
 
     users.groups.privoxy = {};
 
-    systemd.tmpfiles.rules = with cfg.settings; [
-      "d ${certificate-directory} 0770 privoxy privoxy ${cfg.certsLifetime}"
-    ];
+    systemd.tmpfiles.rules = optional cfg.inspectHttps
+      "d ${cfg.settings.certificate-directory} 0770 privoxy privoxy ${cfg.certsLifetime}";
 
     systemd.services.privoxy = {
       description = "Filtering web proxy";
diff --git a/nixos/modules/services/web-apps/nextcloud.nix b/nixos/modules/services/web-apps/nextcloud.nix
index 5636415f6a0d0..9a541aba6e43b 100644
--- a/nixos/modules/services/web-apps/nextcloud.nix
+++ b/nixos/modules/services/web-apps/nextcloud.nix
@@ -10,7 +10,7 @@ let
     extensions = { enabled, all }:
       (with all;
         enabled
-        ++ [ imagick ] # Always enabled
+        ++ optional (!cfg.disableImagemagick) imagick
         # Optionally enabled depending on caching settings
         ++ optional cfg.caching.apcu apcu
         ++ optional cfg.caching.redis redis
@@ -303,6 +303,18 @@ in {
       };
     };
 
+    disableImagemagick = mkOption {
+      type = types.bool;
+      default = false;
+      description = ''
+        Whether to not load the ImageMagick module into PHP.
+        This is used by the theming app and for generating previews of certain images (e.g. SVG and HEIF).
+        You may want to disable it for increased security. In that case, previews will still be available
+        for some images (e.g. JPEG and PNG).
+        See https://github.com/nextcloud/server/issues/13099
+      '';
+    };
+
     caching = {
       apcu = mkOption {
         type = types.bool;
diff --git a/nixos/tests/nextcloud/basic.nix b/nixos/tests/nextcloud/basic.nix
index 0b8e1937128c9..5074b6cdafefe 100644
--- a/nixos/tests/nextcloud/basic.nix
+++ b/nixos/tests/nextcloud/basic.nix
@@ -7,7 +7,7 @@ in {
     maintainers = [ globin eqyiel ];
   };
 
-  nodes = {
+  nodes = rec {
     # The only thing the client needs to do is download a file.
     client = { ... }: {
       services.davfs2.enable = true;
@@ -47,9 +47,14 @@ in {
 
       environment.systemPackages = [ cfg.services.nextcloud.occ ];
     };
+
+    nextcloudWithoutMagick = args@{ config, pkgs, lib, ... }:
+      lib.mkMerge
+      [ (nextcloud args)
+        { services.nextcloud.disableImagemagick = true; } ];
   };
 
-  testScript = let
+  testScript = { nodes, ... }: let
     withRcloneEnv = pkgs.writeScript "with-rclone-env" ''
       #!${pkgs.runtimeShell}
       export RCLONE_CONFIG_NEXTCLOUD_TYPE=webdav
@@ -68,8 +73,19 @@ in {
       #!${pkgs.runtimeShell}
       diff <(echo 'hi') <(${pkgs.rclone}/bin/rclone cat nextcloud:test-shared-file)
     '';
+
+    findInClosure = what: drv: pkgs.runCommand "find-in-closure" { exportReferencesGraph = [ "graph" drv ]; inherit what; } ''
+      test -e graph
+      grep "$what" graph >$out || true
+    '';
+    nextcloudUsesImagick = findInClosure "imagick" nodes.nextcloud.config.system.build.vm;
+    nextcloudWithoutDoesntUseIt = findInClosure "imagick" nodes.nextcloudWithoutMagick.config.system.build.vm;
   in ''
-    start_all()
+    assert open("${nextcloudUsesImagick}").read() != ""
+    assert open("${nextcloudWithoutDoesntUseIt}").read() == ""
+
+    nextcloud.start()
+    client.start()
     nextcloud.wait_for_unit("multi-user.target")
     # This is just to ensure the nextcloud-occ program is working
     nextcloud.succeed("nextcloud-occ status")
diff --git a/pkgs/applications/networking/browsers/brave/default.nix b/pkgs/applications/networking/browsers/brave/default.nix
index 0de942a1728e5..430f9e38e2663 100644
--- a/pkgs/applications/networking/browsers/brave/default.nix
+++ b/pkgs/applications/networking/browsers/brave/default.nix
@@ -90,11 +90,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "brave";
-  version = "1.21.73";
+  version = "1.21.74";
 
   src = fetchurl {
     url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_amd64.deb";
-    sha256 = "12jkj9h1smipqlkidnd3r492yfnncl0b2dmjq22qp2vsrscc3jfg";
+    sha256 = "2csyjwn5j5+cRmjq0+gHLWvIVjtaSaN9rVZ8ikI0gec=";
   };
 
   dontConfigure = true;
@@ -160,7 +160,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     homepage = "https://brave.com/";
     description = "Privacy-oriented browser for Desktop and Laptop computers";
-    changelog = "https://github.com/brave/brave-browser/blob/v${version}/CHANGELOG.md";
+    changelog = "https://github.com/brave/brave-browser/blob/master/CHANGELOG_DESKTOP.md";
     longDescription = ''
       Brave browser blocks the ads and trackers that slow you down,
       chew up your bandwidth, and invade your privacy. Brave lets you
diff --git a/pkgs/applications/networking/browsers/castor/default.nix b/pkgs/applications/networking/browsers/castor/default.nix
index daead82e48545..259a8780901ea 100644
--- a/pkgs/applications/networking/browsers/castor/default.nix
+++ b/pkgs/applications/networking/browsers/castor/default.nix
@@ -1,5 +1,5 @@
 { lib
-, fetchurl
+, fetchFromSourcehut
 , rustPlatform
 , pkg-config
 , wrapGAppsHook
@@ -15,9 +15,11 @@ rustPlatform.buildRustPackage rec {
   pname = "castor";
   version = "0.8.16";
 
-  src = fetchurl {
-    url = "https://git.sr.ht/~julienxx/castor/archive/${version}.tar.gz";
-    sha256 = "1qwsprwazkzcs70h219fhh5jj5s5hm1k120fn3pk4qivii4lyhah";
+  src = fetchFromSourcehut {
+    owner = "~julienxx";
+    repo = pname;
+    rev = version;
+    sha256 = "0rwg1w7srjwa23mkypl8zk6674nhph4xsc6nc01f6g5k959szylr";
   };
 
   cargoSha256 = "0yn2kfiaz6d8wc8rdqli2pwffp5vb1v3zi7520ysrd5b6fc2csf2";
diff --git a/pkgs/applications/networking/browsers/chromium/common.nix b/pkgs/applications/networking/browsers/chromium/common.nix
index 6c77ed3d18181..3197e272f0e2e 100644
--- a/pkgs/applications/networking/browsers/chromium/common.nix
+++ b/pkgs/applications/networking/browsers/chromium/common.nix
@@ -17,7 +17,7 @@
 , protobuf, speechd, libXdamage, cups
 , ffmpeg, libxslt, libxml2, at-spi2-core
 , jre8
-, pipewire_0_2
+, pipewire
 , libva
 , libdrm, wayland, mesa, libxkbcommon # Ozone
 
@@ -140,7 +140,7 @@ let
       libXScrnSaver libXcursor libXtst libxshmfence libGLU libGL
       pciutils protobuf speechd libXdamage at-spi2-core
       jre
-      pipewire_0_2
+      pipewire
       libva
       libdrm wayland mesa.drivers libxkbcommon
     ] ++ optional gnomeKeyringSupport libgnome-keyring3
@@ -263,6 +263,7 @@ let
       use_pulseaudio = true;
       link_pulseaudio = true;
     } // optionalAttrs (chromiumVersionAtLeast "89") {
+      rtc_pipewire_version = "0.3"; # TODO: Can be removed once ungoogled-chromium is at M90
       # Disable PGO (defaults to 2 since M89) because it fails without additional changes:
       # error: Could not read profile ../../chrome/build/pgo_profiles/chrome-linux-master-1610647094-405a32bcf15e5a84949640f99f84a5b9f61e2f2e.profdata: Unsupported instrumentation profile format version
       chrome_pgo_phase = 0;
diff --git a/pkgs/applications/networking/browsers/chromium/default.nix b/pkgs/applications/networking/browsers/chromium/default.nix
index 79899d822b00f..cf2fedde97e2c 100644
--- a/pkgs/applications/networking/browsers/chromium/default.nix
+++ b/pkgs/applications/networking/browsers/chromium/default.nix
@@ -2,7 +2,7 @@
 , llvmPackages_11, ed, gnugrep, coreutils, xdg-utils
 , glib, gtk3, gnome3, gsettings-desktop-schemas, gn, fetchgit
 , libva ? null
-, pipewire_0_2
+, pipewire
 , gcc, nspr, nss, runCommand
 , lib
 
@@ -161,7 +161,7 @@ in stdenv.mkDerivation {
 
   buildCommand = let
     browserBinary = "${chromiumWV}/libexec/chromium/chromium";
-    libPath = lib.makeLibraryPath [ libva pipewire_0_2 ];
+    libPath = lib.makeLibraryPath [ libva pipewire ];
 
   in with lib; ''
     mkdir -p "$out/bin"
diff --git a/pkgs/applications/networking/browsers/chromium/upstream-info.json b/pkgs/applications/networking/browsers/chromium/upstream-info.json
index 4ee7adf65c59a..b4c9d2c73b466 100644
--- a/pkgs/applications/networking/browsers/chromium/upstream-info.json
+++ b/pkgs/applications/networking/browsers/chromium/upstream-info.json
@@ -44,19 +44,19 @@
     }
   },
   "ungoogled-chromium": {
-    "version": "88.0.4324.182",
-    "sha256": "10av060ix6lgsvv99lyvyy03r0m3zwdg4hddbi6dycrdxk1iyh9h",
-    "sha256bin64": "1rjg23xiybpnis93yb5zkvglm3r4fds9ip5mgl6f682z5x0yj05b",
+    "version": "89.0.4389.82",
+    "sha256": "0yg33d6zldz3j1jghhdci63fn46i10dkz3nb95jdrbv8gd018jfz",
+    "sha256bin64": "1sqzzillq38qyh85449ncz8bni93mjxb6r4z8y5h8k2w3j38jc0q",
     "deps": {
       "gn": {
-        "version": "2020-11-05",
+        "version": "2021-01-07",
         "url": "https://gn.googlesource.com/gn",
-        "rev": "53d92014bf94c3893886470a1c7c1289f8818db0",
-        "sha256": "1xcm07qjk6m2czi150fiqqxql067i832adck6zxrishm70c9jbr9"
+        "rev": "595e3be7c8381d4eeefce62a63ec12bae9ce5140",
+        "sha256": "08y7cjlgjdbzja5ij31wxc9i191845m01v1hc7y176svk9y0hj1d"
       },
       "ungoogled-patches": {
-        "rev": "88.0.4324.182-1",
-        "sha256": "1c9y1dn9s06pskkjw2r8lsbplak8m2rwh4drixvjpif7b4cgdhay"
+        "rev": "89.0.4389.82-1",
+        "sha256": "183w22q6mpmw7s1l65dzvc5i422vl7qax6q4xpgr3krcx4y00878"
       }
     }
   }
diff --git a/pkgs/applications/video/avidemux/default.nix b/pkgs/applications/video/avidemux/default.nix
index da3c25def3f1d..9b2073bc799e5 100644
--- a/pkgs/applications/video/avidemux/default.nix
+++ b/pkgs/applications/video/avidemux/default.nix
@@ -25,11 +25,11 @@ assert !withQT -> default != "qt5";
 
 stdenv.mkDerivation rec {
   pname = "avidemux";
-  version = "2.7.6";
+  version = "2.7.8";
 
   src = fetchurl {
     url = "mirror://sourceforge/avidemux/avidemux/${version}/avidemux_${version}.tar.gz";
-    sha256 = "1kwkn976ppahrcr74bnv6sqx75pzl9y21m1mvr5ksi1m6lgp924s";
+    sha256 = "sha256-YopAT1If8oEnYHAK4+KqeOWBaw/z+2/QWsPnUkjZdAE=";
   };
 
   patches = [
diff --git a/pkgs/build-support/fetchsourcehut/default.nix b/pkgs/build-support/fetchsourcehut/default.nix
new file mode 100644
index 0000000000000..ed2f074200cd0
--- /dev/null
+++ b/pkgs/build-support/fetchsourcehut/default.nix
@@ -0,0 +1,25 @@
+{ fetchzip, lib }:
+
+{ owner
+, repo, rev
+, domain ? "sr.ht"
+, vc ? "git"
+, name ? "source"
+, ... # For hash agility
+} @ args:
+
+with lib;
+
+assert (lib.assertOneOf "vc" vc [ "hg" "git" ]);
+
+let
+  baseUrl = "https://${vc}.${domain}/${owner}/${repo}";
+
+in fetchzip (recursiveUpdate {
+  inherit name;
+  url = "${baseUrl}/archive/${rev}.tar.gz";
+  meta.homepage = "${baseUrl}/";
+  extraPostFetch = optionalString (vc == "hg") ''
+    rm -f "$out/.hg_archival.txt"
+  ''; # impure file; see #12002
+} (removeAttrs args [ "owner" "repo" "rev" "domain" "vc" ])) // { inherit rev; }
diff --git a/pkgs/development/interpreters/evcxr/default.nix b/pkgs/development/interpreters/evcxr/default.nix
index fa428b983356f..7f248c8d430f3 100644
--- a/pkgs/development/interpreters/evcxr/default.nix
+++ b/pkgs/development/interpreters/evcxr/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "evcxr";
-  version = "0.7.0";
+  version = "0.8.1";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "evcxr";
     rev = "v${version}";
-    sha256 = "sha256-33XeepqwYmTMcObroPTuxykYuM9qYI1+LV5lZIFSomg=";
+    sha256 = "sha256-5YbvPDyGaoKPelLep2tVica08SI7Cyo9SLMnE6dmWe4=";
   };
 
-  cargoSha256 = "sha256-tjCID3YeGkxcq/LqJDMHGNpv1MCXKtcLlDnNkFwx1zU=";
+  cargoSha256 = "sha256-hqVmNBrvagqhGPWTaBXuY8lULolWIoR5ovEhH5k1tz4=";
 
   RUST_SRC_PATH = "${rustPlatform.rustLibSrc}";
 
diff --git a/pkgs/development/ocaml-modules/ppx_cstubs/default.nix b/pkgs/development/ocaml-modules/ppx_cstubs/default.nix
new file mode 100644
index 0000000000000..b4ddb4dd5e45c
--- /dev/null
+++ b/pkgs/development/ocaml-modules/ppx_cstubs/default.nix
@@ -0,0 +1,44 @@
+{ lib
+, fetchFromGitHub
+, buildDunePackage
+, bigarray-compat
+, containers
+, cppo
+, ctypes
+, integers
+, num
+, ppxlib
+, re
+}:
+
+buildDunePackage rec {
+  pname = "ppx_cstubs";
+  version = "0.6.1.1";
+
+  useDune2 = true;
+
+  src = fetchFromGitHub {
+    owner = "fdopen";
+    repo = "ppx_cstubs";
+    rev = version;
+    sha256 = "0rgg78435ypi6ryhcq5ljkch4qjvra2jqjd47c2hhhcbwvi2ssxh";
+  };
+
+  buildInputs = [
+    bigarray-compat
+    containers
+    cppo
+    ctypes
+    integers
+    num
+    ppxlib
+    re
+  ];
+
+  meta = with lib; {
+    homepage = "https://github.com/fdopen/ppx_cstubs";
+    description = "Preprocessor for easier stub generation with ocaml-ctypes";
+    license = licenses.mit;
+    maintainers = [ maintainers.osener ];
+  };
+}
diff --git a/pkgs/development/ocaml-modules/ppx_deriving/default.nix b/pkgs/development/ocaml-modules/ppx_deriving/default.nix
index 910e539009661..7d415bd894e02 100644
--- a/pkgs/development/ocaml-modules/ppx_deriving/default.nix
+++ b/pkgs/development/ocaml-modules/ppx_deriving/default.nix
@@ -1,15 +1,28 @@
-{ lib, fetchurl, buildDunePackage
-, cppo, ppxlib, ppx_derivers, result, ounit, ocaml-migrate-parsetree
+{ lib
+, fetchurl
+, buildDunePackage
+, cppo
+, ppxlib
+, ppx_derivers
+, result
+, ounit
+, ocaml-migrate-parsetree
+, ocaml-migrate-parsetree-2-1
 }:
 
 let params =
-  if lib.versionAtLeast ppxlib.version "0.15"
-  then {
+  if lib.versionAtLeast ppxlib.version "0.20" then {
+    version = "5.2.1";
+    sha256 = "11h75dsbv3rs03pl67hdd3lbim7wjzh257ij9c75fcknbfr5ysz9";
+    useOMP2 = true;
+  } else if lib.versionAtLeast ppxlib.version "0.15" then {
     version = "5.1";
     sha256 = "1i64fd7qrfzbam5hfbl01r0sx4iihsahcwqj13smmrjlnwi3nkxh";
+    useOMP2 = false;
   } else {
     version = "5.0";
     sha256 = "0fkzrn4pdyvf1kl0nwvhqidq01pnq3ql8zk1jd56hb0cxaw851w3";
+    useOMP2 = false;
   }
 ; in
 
@@ -25,7 +38,13 @@ buildDunePackage rec {
   };
 
   buildInputs = [ ppxlib cppo ];
-  propagatedBuildInputs = [ ocaml-migrate-parsetree ppx_derivers result ];
+  propagatedBuildInputs = [
+    (if params.useOMP2
+    then ocaml-migrate-parsetree-2-1
+    else ocaml-migrate-parsetree)
+    ppx_derivers
+    result
+  ];
 
   doCheck = true;
   checkInputs = [ ounit ];
diff --git a/pkgs/development/ocaml-modules/ppxlib/default.nix b/pkgs/development/ocaml-modules/ppxlib/default.nix
index 03085a13cdf0e..11b608e6ef5cb 100644
--- a/pkgs/development/ocaml-modules/ppxlib/default.nix
+++ b/pkgs/development/ocaml-modules/ppxlib/default.nix
@@ -25,6 +25,10 @@ let param = {
     sha256 = "1ciy6va2gjrpjs02kha83pzh0x1gkmfsfsdgabbs1v14a8qgfibm";
     min_version = "4.07";
   };
+  "0.22.0" = {
+    sha256 = "0kf7lgcwygf6zlx7rwddqpqvasa6v7xiq0bqal8vxlib6lpg074q";
+    min_version = "4.07";
+  };
 }."${version}"; in
 
 if param ? max_version && lib.versionAtLeast ocaml.version param.max_version
diff --git a/pkgs/development/python-modules/construct/2.10.54.nix b/pkgs/development/python-modules/construct/2.10.54.nix
new file mode 100644
index 0000000000000..6bb279490ab29
--- /dev/null
+++ b/pkgs/development/python-modules/construct/2.10.54.nix
@@ -0,0 +1,29 @@
+{ lib, stdenv, buildPythonPackage, fetchFromGitHub, pythonOlder
+, six, pytestCheckHook, pytest-benchmark, enum34, numpy, arrow, ruamel_yaml
+}:
+
+buildPythonPackage rec {
+  pname   = "construct";
+  version = "2.10.54";
+
+  # no tests in PyPI tarball
+  src = fetchFromGitHub {
+    owner  = pname;
+    repo   = pname;
+    rev    = "v${version}";
+    sha256 = "1mqspsn6bf3ibvih1zna2glkg8iw7vy5zg9gzg0d1m8zcndk2c48";
+  };
+
+  checkInputs = [ pytestCheckHook pytest-benchmark enum34 numpy arrow ruamel_yaml ];
+
+  disabledTests = lib.optionals stdenv.isDarwin [ "test_multiprocessing" ];
+
+  pytestFlagsArray = [ "--benchmark-disable" ];
+
+  meta = with lib; {
+    description = "Powerful declarative parser (and builder) for binary data";
+    homepage = "https://construct.readthedocs.org/";
+    license = licenses.mit;
+    maintainers = with maintainers; [ dotlambda ];
+  };
+}
diff --git a/pkgs/development/python-modules/convertdate/2.2.x.nix b/pkgs/development/python-modules/convertdate/2.2.x.nix
new file mode 100644
index 0000000000000..d67f4c5a3449d
--- /dev/null
+++ b/pkgs/development/python-modules/convertdate/2.2.x.nix
@@ -0,0 +1,36 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, pymeeus
+, pytz
+, pytestCheckHook
+}:
+
+buildPythonPackage rec {
+  pname = "convertdate";
+  version = "2.2.2";
+
+  # Tests are not available in the PyPI tarball so use GitHub instead.
+  src = fetchFromGitHub {
+    owner = "fitnr";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "1xgi7x9b9kxm0q51bqnmwdm5lp8vwhx5yk4d1b23r37spz9dbhw5";
+  };
+
+  propagatedBuildInputs = [
+    pymeeus
+    pytz
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  meta = with lib; {
+    homepage = "https://github.com/fitnr/convertdate";
+    description = "Utils for converting between date formats and calculating holidays";
+    license = licenses.mit;
+    maintainers = with maintainers; [ jluttine ];
+  };
+}
diff --git a/pkgs/development/python-modules/convertdate/default.nix b/pkgs/development/python-modules/convertdate/default.nix
index f285a74e5449a..0dee95541b082 100644
--- a/pkgs/development/python-modules/convertdate/default.nix
+++ b/pkgs/development/python-modules/convertdate/default.nix
@@ -1,5 +1,6 @@
 { lib
 , buildPythonPackage
+, isPy27
 , fetchFromGitHub
 , pymeeus
 , pytz
@@ -10,6 +11,8 @@ buildPythonPackage rec {
   pname = "convertdate";
   version = "2.3.0";
 
+  disabled = isPy27;
+
   # Tests are not available in the PyPI tarball so use GitHub instead.
   src = fetchFromGitHub {
     owner = "fitnr";
diff --git a/pkgs/development/python-modules/dateparser/0.x.nix b/pkgs/development/python-modules/dateparser/0.x.nix
new file mode 100644
index 0000000000000..49e2d1f2796eb
--- /dev/null
+++ b/pkgs/development/python-modules/dateparser/0.x.nix
@@ -0,0 +1,55 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, mock
+, parameterized
+, pytestCheckHook
+, dateutil
+, pytz
+, regex
+, tzlocal
+, convertdate
+, umalqurra
+, jdatetime
+, ruamel_yaml
+}:
+
+buildPythonPackage rec {
+  pname = "dateparser";
+  version = "0.7.6";
+
+  src = fetchFromGitHub {
+    owner = "scrapinghub";
+    repo = "dateparser";
+    rev = "v${version}";
+    sha256 = "0j3sm4hlx7z0ci5fnjq5n9i02vvlfz0wxa889ydryfknjhy5apqw";
+  };
+
+  checkInputs = [
+    mock
+    parameterized
+    pytestCheckHook
+  ];
+
+  pytestFlagsArray = [ "tests" ];
+
+  disabledTestPaths = [
+    "tests/test_dateparser_data_integrity.py" # ImportError: No module named ruamel.yaml
+  ];
+
+  propagatedBuildInputs = [
+    # install_requires
+    dateutil pytz regex tzlocal
+    # extra_requires
+    convertdate umalqurra jdatetime ruamel_yaml
+  ];
+
+  pythonImportsCheck = [ "dateparser" ];
+
+  meta = with lib; {
+    description = "Date parsing library designed to parse dates from HTML pages";
+    homepage = "https://github.com/scrapinghub/dateparser";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ dotlambda ];
+  };
+}
diff --git a/pkgs/development/python-modules/pystray/default.nix b/pkgs/development/python-modules/pystray/default.nix
index 6b4bdb59f1ef3..39fab3e7bf8c3 100644
--- a/pkgs/development/python-modules/pystray/default.nix
+++ b/pkgs/development/python-modules/pystray/default.nix
@@ -3,13 +3,13 @@
 
 buildPythonPackage rec {
   pname = "pystray";
-  version = "0.16.0";
+  version = "0.17.2";
 
   src = fetchFromGitHub {
     owner = "moses-palmer";
     repo = "pystray";
     rev = "v${version}";
-    sha256 = "0q5yqfm5mzffx9vnp9xcnclgjzgs0b7f50i9xmxn1m1iha1zawh1";
+    sha256 = "sha256-/dU+jwe/3qhypq7e5tawhJKzSryW7EIbmrpP+VLDvHA=";
   };
 
   propagatedBuildInputs = [ pillow xlib six ];
diff --git a/pkgs/development/python-modules/vcrpy/3.nix b/pkgs/development/python-modules/vcrpy/3.nix
new file mode 100644
index 0000000000000..ddd4015aad1e7
--- /dev/null
+++ b/pkgs/development/python-modules/vcrpy/3.nix
@@ -0,0 +1,48 @@
+{ buildPythonPackage
+, lib
+, six
+, fetchPypi
+, pyyaml
+, mock
+, contextlib2
+, wrapt
+, pytest
+, pytest-httpbin
+, yarl
+, pythonOlder
+, pythonAtLeast
+}:
+
+buildPythonPackage rec {
+  pname = "vcrpy";
+  version = "3.0.0";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "21168d5ae14263a833d4b71acfd8278d8841114f24be1b4ab4a5719d0c7f07bc";
+  };
+
+  checkInputs = [
+    pytest
+    pytest-httpbin
+  ];
+
+  propagatedBuildInputs = [
+    pyyaml
+    wrapt
+    six
+  ]
+  ++ lib.optionals (pythonOlder "3.3") [ contextlib2 mock ]
+  ++ lib.optionals (pythonAtLeast "3.4") [ yarl ];
+
+  checkPhase = ''
+    py.test --ignore=tests/integration -k "not TestVCRConnection"
+  '';
+
+  meta = with lib; {
+    description = "Automatically mock your HTTP interactions to simplify and speed up testing";
+    homepage = "https://github.com/kevin1024/vcrpy";
+    license = licenses.mit;
+  };
+}
+
diff --git a/pkgs/development/python-modules/vcrpy/default.nix b/pkgs/development/python-modules/vcrpy/default.nix
index e67bbc59e9329..7766e75ba05ee 100644
--- a/pkgs/development/python-modules/vcrpy/default.nix
+++ b/pkgs/development/python-modules/vcrpy/default.nix
@@ -1,5 +1,6 @@
 { buildPythonPackage
 , lib
+, isPy27
 , six
 , fetchPypi
 , pyyaml
@@ -17,6 +18,8 @@ buildPythonPackage rec {
   pname = "vcrpy";
   version = "4.1.1";
 
+  disabled = isPy27;
+
   src = fetchPypi {
     inherit pname version;
     sha256 = "57095bf22fc0a2d99ee9674cdafebed0f3ba763018582450706f7d3a74fff599";
diff --git a/pkgs/development/tools/glpaper/default.nix b/pkgs/development/tools/glpaper/default.nix
index 6b7b13437cc6a..f6465d53cae06 100644
--- a/pkgs/development/tools/glpaper/default.nix
+++ b/pkgs/development/tools/glpaper/default.nix
@@ -1,12 +1,14 @@
-{ lib, stdenv, fetchhg, meson, ninja, pkg-config, wlroots, wayland, wayland-protocols
+{ lib, stdenv, fetchFromSourcehut, meson, ninja, pkg-config, wlroots, wayland, wayland-protocols
 , libX11, libGL }:
 
-stdenv.mkDerivation {
-  name = "glpaper";
+stdenv.mkDerivation rec {
+  pname = "glpaper";
   version = "unstable-2020-10-11";
 
-  src = fetchhg {
-    url = "https://hg.sr.ht/~scoopta/glpaper";
+  src = fetchFromSourcehut {
+    owner = "~scoopta";
+    repo = pname;
+    vc = "hg";
     rev = "9e7ec7cd270af330039c395345c7d23c04682267";
     sha256 = "sha256-yBHRg6eg+PK/ixuM0MBty3RJY9qcemr3Dt+8SAitqnk=";
   };
diff --git a/pkgs/games/among-sus/default.nix b/pkgs/games/among-sus/default.nix
index 1ec0a42ea18e4..454c7d181f951 100644
--- a/pkgs/games/among-sus/default.nix
+++ b/pkgs/games/among-sus/default.nix
@@ -1,11 +1,12 @@
-{ lib, stdenv, fetchgit, port ? "1234" }:
+{ lib, stdenv, fetchFromSourcehut, port ? "1234" }:
 
 stdenv.mkDerivation {
   pname = "among-sus-unstable";
   version = "2020-10-29";
 
-  src = fetchgit {
-    url = "https://git.sr.ht/~martijnbraam/among-sus";
+  src = fetchFromSourcehut {
+    owner = "~martijnbraam";
+    repo = "among-sus";
     rev = "1f4c8d800d025d36ac66826937161be3252fbc57";
     sha256 = "19jq7ygh9l11dl1h6702bg57m04y35nqd6yqx1rgp1kxwhp45xyh";
   };
diff --git a/pkgs/games/eidolon/default.nix b/pkgs/games/eidolon/default.nix
index dcb72d53b3285..7112c6bf49c50 100644
--- a/pkgs/games/eidolon/default.nix
+++ b/pkgs/games/eidolon/default.nix
@@ -1,11 +1,12 @@
-{ lib, fetchgit, rustPlatform, pkg-config, openssl }:
+{ lib, fetchFromSourcehut, rustPlatform, pkg-config, openssl }:
 
 rustPlatform.buildRustPackage rec {
   pname = "eidolon";
   version = "1.4.6";
 
-  src = fetchgit {
-    url = "https://git.sr.ht/~nicohman/eidolon";
+  src = fetchFromSourcehut {
+    owner = "~nicohman";
+    repo = pname;
     rev = version;
     sha256 = "1yn3k569pxzw43mmsk97088xpkdc714rks3ncchbb6ccx25kgxrr";
   };
diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix
index 5e749ed3fcf2a..4fef56077c016 100644
--- a/pkgs/os-specific/linux/kernel/common-config.nix
+++ b/pkgs/os-specific/linux/kernel/common-config.nix
@@ -772,6 +772,8 @@ let
       MLX4_EN_VXLAN = whenOlder "4.8" yes;
       MLX5_CORE_EN       = option yes;
 
+      NVME_MULTIPATH = whenAtLeast "4.15" yes;
+
       PSI = whenAtLeast "4.20" yes;
 
       MODVERSIONS        = whenOlder "4.9" yes;
diff --git a/pkgs/tools/audio/beets/default.nix b/pkgs/tools/audio/beets/default.nix
index 61340938f51e9..a3eedf3ea47ec 100644
--- a/pkgs/tools/audio/beets/default.nix
+++ b/pkgs/tools/audio/beets/default.nix
@@ -21,6 +21,7 @@
 , enableKodiupdate       ? true
 , enableLastfm           ? true
 , enableLoadext          ? true
+, enableLyrics           ? true
 , enableMpd              ? true
 , enablePlaylist         ? true
 , enableReplaygain       ? true
@@ -59,6 +60,7 @@ let
     lastgenre = enableLastfm;
     lastimport = enableLastfm;
     loadext = enableLoadext;
+    lyrics = enableLyrics;
     mpdstats = enableMpd;
     mpdupdate = enableMpd;
     playlist = enablePlaylist;
@@ -73,7 +75,7 @@ let
   pluginsWithoutDeps = [
     "bench" "bpd" "bpm" "bucket" "cue" "duplicates" "edit" "embedart"
     "export" "filefilter" "fish" "freedesktop" "fromfilename" "ftintitle" "fuzzy"
-    "hook" "ihate" "importadded" "importfeeds" "info" "inline" "ipfs" "lyrics"
+    "hook" "ihate" "importadded" "importfeeds" "info" "inline" "ipfs"
     "mbcollection" "mbsubmit" "mbsync" "metasync" "missing" "parentwork" "permissions" "play"
     "plexupdate" "random" "rewrite" "scrub" "smartplaylist" "spotify" "the"
     "types" "unimported" "zero"
@@ -130,6 +132,8 @@ in pythonPackages.buildPythonApplication rec {
   ] ++ lib.optional enableAbsubmit         essentia-extractor
     ++ lib.optional enableAcoustid         pythonPackages.pyacoustid
     ++ lib.optional enableBeatport         pythonPackages.requests_oauthlib
+    ++ lib.optional enableConvert          ffmpeg
+    ++ lib.optional enableDiscogs          pythonPackages.discogs_client
     ++ lib.optional (enableFetchart
                   || enableDeezer
                   || enableEmbyupdate
@@ -139,10 +143,9 @@ in pythonPackages.buildPythonApplication rec {
                   || enableSubsonicplaylist
                   || enableSubsonicupdate
                   || enableAcousticbrainz) pythonPackages.requests
-    ++ lib.optional enableConvert          ffmpeg
-    ++ lib.optional enableDiscogs          pythonPackages.discogs_client
     ++ lib.optional enableKeyfinder        keyfinder-cli
     ++ lib.optional enableLastfm           pythonPackages.pylast
+    ++ lib.optional enableLyrics           pythonPackages.beautifulsoup4
     ++ lib.optional enableMpd              pythonPackages.mpd2
     ++ lib.optional enableSonosUpdate      pythonPackages.soco
     ++ lib.optional enableThumbnails       pythonPackages.pyxdg
diff --git a/pkgs/tools/misc/fselect/default.nix b/pkgs/tools/misc/fselect/default.nix
index 963063710a319..2350fd6afe48e 100644
--- a/pkgs/tools/misc/fselect/default.nix
+++ b/pkgs/tools/misc/fselect/default.nix
@@ -1,4 +1,4 @@
-{ lib, fetchFromGitHub, rustPlatform, installShellFiles }:
+{ lib, stdenv, fetchFromGitHub, rustPlatform, installShellFiles, libiconv }:
 
 rustPlatform.buildRustPackage rec {
   pname = "fselect";
@@ -14,6 +14,7 @@ rustPlatform.buildRustPackage rec {
   cargoSha256 = "sha256-vVIanMkc0sPzu0L48oOh8wEEUOckR/AYkz81u4OR+fE=";
 
   nativeBuildInputs = [ installShellFiles ];
+  buildInputs = lib.optional stdenv.isDarwin libiconv;
 
   postInstall = ''
     installManPage docs/fselect.1
diff --git a/pkgs/tools/security/hcxtools/default.nix b/pkgs/tools/security/hcxtools/default.nix
index 20e28fa125387..9478844055e1c 100644
--- a/pkgs/tools/security/hcxtools/default.nix
+++ b/pkgs/tools/security/hcxtools/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "hcxtools";
-  version = "6.1.5";
+  version = "6.1.6";
 
   src = fetchFromGitHub {
     owner = "ZerBea";
     repo = pname;
     rev = version;
-    sha256 = "1xvr89r6287788bx5qbw9sr8jvmajps0rpc7fvh9bfzb6zw2rq6w";
+    sha256 = "sha256-x6sVFjM2GMGqpoAW7CtCLUoEAYLgulaUKXequQ7DmGQ=";
   };
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/tools/security/rbw/default.nix b/pkgs/tools/security/rbw/default.nix
index 9f19a34c162ce..c1f99719d76c5 100644
--- a/pkgs/tools/security/rbw/default.nix
+++ b/pkgs/tools/security/rbw/default.nix
@@ -2,7 +2,6 @@
 , stdenv
 , rustPlatform
 , fetchCrate
-, pinentry
 , openssl
 , pkg-config
 , makeWrapper
@@ -40,10 +39,7 @@ rustPlatform.buildRustPackage rec {
 
   buildInputs = lib.optionals stdenv.isDarwin [ Security libiconv ];
 
-  postPatch = ''
-    substituteInPlace src/pinentry.rs \
-      --replace 'Command::new("pinentry")' 'Command::new("${pinentry}/${pinentry.binaryPath or "bin/pinentry"}")'
-  '' + lib.optionalString withFzf ''
+  postPatch = lib.optionalString withFzf ''
     patchShebangs bin/rbw-fzf
     substituteInPlace bin/rbw-fzf \
         --replace fzf ${fzf}/bin/fzf \
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 989fd945d036b..168620603a964 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -482,6 +482,8 @@ in
 
   fetchFromSavannah = callPackage ../build-support/fetchsavannah {};
 
+  fetchFromSourcehut = callPackage ../build-support/fetchsourcehut { };
+
   fetchFromGitLab = callPackage ../build-support/fetchgitlab {};
 
   fetchFromGitiles = callPackage ../build-support/fetchgitiles {};
diff --git a/pkgs/top-level/ocaml-packages.nix b/pkgs/top-level/ocaml-packages.nix
index f31125ef82f5b..3c8c500d8b5de 100644
--- a/pkgs/top-level/ocaml-packages.nix
+++ b/pkgs/top-level/ocaml-packages.nix
@@ -1001,6 +1001,10 @@ let
 
     ppx_cstruct = callPackage ../development/ocaml-modules/cstruct/ppx.nix { };
 
+    ppx_cstubs = callPackage ../development/ocaml-modules/ppx_cstubs {
+      ppxlib = ppxlib.override { version = "0.22.0"; };
+    };
+
     ppx_derivers = callPackage ../development/ocaml-modules/ppx_derivers {};
 
     ppx_deriving = callPackage ../development/ocaml-modules/ppx_deriving {};
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 9a8c19dd5c9dd..acc0b300a1474 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -1464,7 +1464,10 @@ in {
 
   constantly = callPackage ../development/python-modules/constantly { };
 
-  construct = callPackage ../development/python-modules/construct { };
+  construct = if isPy27 then
+    callPackage ../development/python-modules/construct/2.10.54.nix { }
+  else
+    callPackage ../development/python-modules/construct { };
 
   consul = callPackage ../development/python-modules/consul { };
 
@@ -1474,7 +1477,10 @@ in {
 
   contextvars = callPackage ../development/python-modules/contextvars { };
 
-  convertdate = callPackage ../development/python-modules/convertdate { };
+  convertdate = if isPy27 then
+    callPackage ../development/python-modules/convertdate/2.2.x.nix { }
+  else
+    callPackage ../development/python-modules/convertdate { };
 
   cookiecutter = callPackage ../development/python-modules/cookiecutter { };
 
@@ -1668,7 +1674,10 @@ in {
     inherit (pkgs.llvmPackages) libcxx;
   };
 
-  dateparser = callPackage ../development/python-modules/dateparser { };
+  dateparser = if isPy27 then
+    callPackage ../development/python-modules/dateparser/0.x.nix { }
+  else
+    callPackage ../development/python-modules/dateparser { };
 
   datrie = callPackage ../development/python-modules/datrie { };
 
@@ -8367,7 +8376,10 @@ in {
 
   varint = callPackage ../development/python-modules/varint { };
 
-  vcrpy = callPackage ../development/python-modules/vcrpy { };
+  vcrpy = if isPy27 then
+    callPackage ../development/python-modules/vcrpy/3.nix { }
+  else
+    callPackage ../development/python-modules/vcrpy { };
 
   vcver = callPackage ../development/python-modules/vcver { };