Merge staging-next into staging

52 files changed, 907 insertions, 262 deletions

diff --git a/doc/contributing/coding-conventions.chapter.md b/doc/contributing/coding-conventions.chapter.md
index 85c8626bd99c4..7a8e7741a3302 100644
--- a/doc/contributing/coding-conventions.chapter.md
+++ b/doc/contributing/coding-conventions.chapter.md
@@ -181,6 +181,21 @@
   rev = "${version}";
   ```
 
+- Filling lists condionally _should_ be done with `lib.optional(s)` instead of using `if cond then [ ... ] else null` or `if cond then [ ... ] else [ ]`.
+
+  ```nix
+  buildInputs = lib.optional stdenv.isDarwin iconv;
+  ```
+
+  instead of
+
+  ```nix
+  buildInputs = if stdenv.isDarwin then [ iconv ] else null;
+  ```
+
+  As an exception, an explicit conditional expression with null can be used when fixing a important bug without triggering a mass rebuild.
+  If this is done a follow up pull request _should_ be created to change the code to `lib.optional(s)`.
+
 - Arguments should be listed in the order they are used, with the exception of `lib`, which always goes first.
 
 ## Package naming {#sec-package-naming}
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 6e5a5daa1703c..e34f9e823e1ff 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -10300,6 +10300,12 @@
       fingerprint = "ADF4 C13D 0E36 1240 BD01  9B51 D1DE 6D7F 6936 63A5";
     }];
   };
+  simarra = {
+    name = "simarra";
+    email = "loic.martel@protonmail.com";
+    github = "simarra";
+    githubId = 14372987;
+  };
   simonchatts = {
     email = "code@chatts.net";
     github = "simonchatts";
diff --git a/nixos/modules/services/web-apps/nextcloud.nix b/nixos/modules/services/web-apps/nextcloud.nix
index 8d3741cf89db2..886e030b80c9e 100644
--- a/nixos/modules/services/web-apps/nextcloud.nix
+++ b/nixos/modules/services/web-apps/nextcloud.nix
@@ -312,6 +312,90 @@ in {
           phone-numbers.
         '';
       };
+
+      objectstore = {
+        s3 = {
+          enable = mkEnableOption ''
+            S3 object storage as primary storage.
+
+            This mounts a bucket on an Amazon S3 object storage or compatible
+            implementation into the virtual filesystem.
+
+            See nextcloud's documentation on "Object Storage as Primary
+            Storage" for more details.
+          '';
+          bucket = mkOption {
+            type = types.str;
+            example = "nextcloud";
+            description = ''
+              The name of the S3 bucket.
+            '';
+          };
+          autocreate = mkOption {
+            type = types.bool;
+            description = ''
+              Create the objectstore if it does not exist.
+            '';
+          };
+          key = mkOption {
+            type = types.str;
+            example = "EJ39ITYZEUH5BGWDRUFY";
+            description = ''
+              The access key for the S3 bucket.
+            '';
+          };
+          secretFile = mkOption {
+            type = types.str;
+            example = "/var/nextcloud-objectstore-s3-secret";
+            description = ''
+              The full path to a file that contains the access secret. Must be
+              readable by user <literal>nextcloud</literal>.
+            '';
+          };
+          hostname = mkOption {
+            type = types.nullOr types.str;
+            default = null;
+            example = "example.com";
+            description = ''
+              Required for some non-Amazon implementations.
+            '';
+          };
+          port = mkOption {
+            type = types.nullOr types.port;
+            default = null;
+            description = ''
+              Required for some non-Amazon implementations.
+            '';
+          };
+          useSsl = mkOption {
+            type = types.bool;
+            default = true;
+            description = ''
+              Use SSL for objectstore access.
+            '';
+          };
+          region = mkOption {
+            type = types.nullOr types.str;
+            default = null;
+            example = "REGION";
+            description = ''
+              Required for some non-Amazon implementations.
+            '';
+          };
+          usePathStyle = mkOption {
+            type = types.bool;
+            default = false;
+            description = ''
+              Required for some non-Amazon S3 implementations.
+
+              Ordinarily, requests will be made with
+              http://bucket.hostname.domain/, but with path style
+              enabled requests are made with
+              http://hostname.domain/bucket instead.
+            '';
+          };
+        };
+      };
     };
 
     enableImagemagick = mkEnableOption ''
@@ -479,14 +563,31 @@ in {
         nextcloud-setup = let
           c = cfg.config;
           writePhpArrary = a: "[${concatMapStringsSep "," (val: ''"${toString val}"'') a}]";
+          requiresReadSecretFunction = c.dbpassFile != null || c.objectstore.s3.enable;
+          objectstoreConfig = let s3 = c.objectstore.s3; in optionalString s3.enable ''
+            'objectstore' => [
+              'class' => '\\OC\\Files\\ObjectStore\\S3',
+              'arguments' => [
+                'bucket' => '${s3.bucket}',
+                'autocreate' => ${boolToString s3.autocreate},
+                'key' => '${s3.key}',
+                'secret' => nix_read_secret('${s3.secretFile}'),
+                ${optionalString (s3.hostname != null) "'hostname' => '${s3.hostname}',"}
+                ${optionalString (s3.port != null) "'port' => ${toString s3.port},"}
+                'use_ssl' => ${boolToString s3.useSsl},
+                ${optionalString (s3.region != null) "'region' => '${s3.region}',"}
+                'use_path_style' => ${boolToString s3.usePathStyle},
+              ],
+            ]
+          '';
+
           overrideConfig = pkgs.writeText "nextcloud-config.php" ''
             <?php
-            ${optionalString (c.dbpassFile != null) ''
-              function nix_read_pwd() {
-                $file = "${c.dbpassFile}";
+            ${optionalString requiresReadSecretFunction ''
+              function nix_read_secret($file) {
                 if (!file_exists($file)) {
                   throw new \RuntimeException(sprintf(
-                    "Cannot start Nextcloud, dbpass file %s set by NixOS doesn't seem to "
+                    "Cannot start Nextcloud, secret file %s set by NixOS doesn't seem to "
                     . "exist! Please make sure that the file exists and has appropriate "
                     . "permissions for user & group 'nextcloud'!",
                     $file
@@ -513,11 +614,12 @@ in {
               ${optionalString (c.dbuser != null) "'dbuser' => '${c.dbuser}',"}
               ${optionalString (c.dbtableprefix != null) "'dbtableprefix' => '${toString c.dbtableprefix}',"}
               ${optionalString (c.dbpass != null) "'dbpassword' => '${c.dbpass}',"}
-              ${optionalString (c.dbpassFile != null) "'dbpassword' => nix_read_pwd(),"}
+              ${optionalString (c.dbpassFile != null) "'dbpassword' => nix_read_secret('${c.dbpassFile}'),"}
               'dbtype' => '${c.dbtype}',
               'trusted_domains' => ${writePhpArrary ([ cfg.hostName ] ++ c.extraTrustedDomains)},
               'trusted_proxies' => ${writePhpArrary (c.trustedProxies)},
               ${optionalString (c.defaultPhoneRegion != null) "'default_phone_region' => '${c.defaultPhoneRegion}',"}
+              ${objectstoreConfig}
             ];
           '';
           occInstallCmd = let
diff --git a/pkgs/applications/editors/eclipse/default.nix b/pkgs/applications/editors/eclipse/default.nix
index dc19191d769af..77cf5088a4068 100644
--- a/pkgs/applications/editors/eclipse/default.nix
+++ b/pkgs/applications/editors/eclipse/default.nix
@@ -16,10 +16,10 @@ assert stdenv ? glibc;
 
 let
   platform_major = "4";
-  platform_minor = "20";
+  platform_minor = "21";
   year = "2021";
-  month = "06";
-  timestamp = "${year}${month}111600";
+  month = "09";
+  timestamp = "${year}${month}060500";
   gtk = gtk3;
 in rec {
 
@@ -37,7 +37,7 @@ in rec {
     src =
       fetchurl {
         url = "https://www.eclipse.org/downloads/download.php?r=1&nf=1&file=/technology/epp/downloads/release/${year}-${month}/R/eclipse-cpp-${year}-${month}-R-linux-gtk-x86_64.tar.gz";
-        sha512 = "3ggqiwa1nfszdqzdzw1lzs1sdikkvh2fqq10bqjxsq7xdxkis4zix8g4jcjiwlsz5gz98s61gp0k4m5rqsj0krpklxs9ijwq76khc7z";
+        sha512 = "3xdj7b0mlhdys9q4l19kkf1hm0d67dwx55gzfmgv90nvswv0jhyvs42my4wrlrmkh6lz8m0z6dakadhl1bxf2fd8pdp5sm4bv0w0gwc";
       };
   };
 
@@ -49,7 +49,7 @@ in rec {
     src =
       fetchurl {
         url = "https://www.eclipse.org/downloads/download.php?r=1&nf=1&file=/technology/epp/downloads/release/${year}-${month}/R/eclipse-modeling-${year}-${month}-R-linux-gtk-x86_64.tar.gz";
-        sha512 = "38cdhy6v8jmndanvl3bimfs3pnlnl3w066fqrljy2hwki58gqmxxmbld5mphbh9y5kz9b5kiqvhx06sf0l2ywbarxy9wfhynvzb2k17";
+        sha512 = "20xy4vzqlmg4sdvqimz2nc212vb45k5kwh40qagm13r6h3vfv3yrl8bznnappaf4msfa9xdaxns2kz0x94hw444zjmrnbf7614a48xi";
       };
   };
 
@@ -61,7 +61,7 @@ in rec {
     src =
       fetchurl {
         url = "https://www.eclipse.org/downloads/download.php?r=1&nf=1&file=/eclipse/downloads/drops${platform_major}/R-${platform_major}.${platform_minor}-${timestamp}/eclipse-platform-${platform_major}.${platform_minor}-linux-gtk-x86_64.tar.gz";
-        sha512 = "2chshmn09xdq42nix0jqryhac33xc5sg7nlp2vfmz5km6q4m6mc1k7pw10jmg86zzcvcsdl9k1wkrbcsj5y2gv4cg6rddzsbx9hw3s7";
+        sha512 = "29hab3ha3spk0048k3mf2x5m80hlh1l6nazsykx0xxrqy9vdkdibv6mq74dzf1n93h1bd5qh9axicnhs465kp7r1irdl04761c1wibi";
       };
   };
 
@@ -86,7 +86,7 @@ in rec {
     src =
       fetchurl {
         url = "https://www.eclipse.org/downloads/download.php?r=1&nf=1&file=/eclipse/downloads/drops${platform_major}/R-${platform_major}.${platform_minor}-${timestamp}/eclipse-SDK-${platform_major}.${platform_minor}-linux-gtk-x86_64.tar.gz";
-        sha512 = "308sszkmp5lkva5hfb1qc5cy9b1wajas96xz5nwjl7dm2fn4saiwg3ifh71hzq59wf337hndlb2c2dp6yczsfp3mzfqmsi5a3z7dchr";
+        sha512 = "3ag7nfpnn1149gkva58x0037pbdb5wds0qpwv21lif7a6b1a1n7g2n056bn43a7fkxkkj38752gkz29nvqh5g8hqkg29lax8sjlm7sm";
       };
   };
 
@@ -98,7 +98,7 @@ in rec {
     src =
       fetchurl {
         url = "https://www.eclipse.org/downloads/download.php?r=1&nf=1&file=/technology/epp/downloads/release/${year}-${month}/R/eclipse-java-${year}-${month}-R-linux-gtk-x86_64.tar.gz";
-        sha512 = "1wp3g85bsmv0mbpk76adsz1rzd3vbdn4y4ddv9z41bq96wi9npmybidckvwnrq57lbj8k5g8m0x0f1nhj2rv5bqbsnqjxjpknwa6is0";
+        sha512 = "27h5wjr4k0jhi256rk74kbjbm5h7xi4hbml89n1jhppq1yfyv2mf75zb32iaia2pxclx6hc0cd1hvq85fwvcshnq79fw8za687yvbhv";
       };
   };
 
@@ -110,7 +110,7 @@ in rec {
     src =
       fetchurl {
         url = "https://www.eclipse.org/downloads/download.php?r=1&nf=1&file=/technology/epp/downloads/release/${year}-${month}/R/eclipse-jee-${year}-${month}-R-linux-gtk-x86_64.tar.gz";
-        sha512 = "35v8kjpdlhbcxncqygx7c1kjqy1644c6rhrasg8gxnrhlc69zblf4nvgzf1894vd13qzpkzzxx0qll49933prnw98dqkrd0wxcx7f49";
+        sha512 = "03li2bkhkdybwp411xs8i3cp2hmrfg2xd7inbdsxh07y4b9806spi3q10vga97m7ngl6fl5n0mvgxwj8dbdvp133wn9mgrlajb1n4n8";
       };
   };
 
@@ -122,7 +122,7 @@ in rec {
     src =
       fetchurl {
         url = "https://www.eclipse.org/downloads/download.php?r=1&nf=1&file=/technology/epp/downloads/release/${year}-${month}/R/eclipse-committers-${year}-${month}-R-linux-gtk-x86_64.tar.gz";
-        sha512 = "1jj5h69d4814j1mq6fjd47vkswq7bshbh2flgzmn8ibs0ys67x0nd2lm2ksxmvnipj4j9rw3mh9fmw8m0dzpp41c6q8xxfa93c7pqyg";
+        sha512 = "38xwwvg59bdp0a6brmcvq0wlfikik0wnqq897abf5a8vyr0ci7xp5f4ii90x2l5sj5gmcc6jiwvi99c03cjbgivpalr741yka0p3pv5";
       };
   };
 
@@ -134,7 +134,7 @@ in rec {
     src =
       fetchurl {
         url = "https://www.eclipse.org/downloads/download.php?r=1&nf=1&file=/technology/epp/downloads/release/${year}-${month}/R/eclipse-rcp-${year}-${month}-R-linux-gtk-x86_64.tar.gz";
-        sha512 = "19fr63bdifxqp6imgb4d7v5dnkn9i0n2wmr08xzb0ph425ib936jiw84c2nwnsfnljh0yfj1r3wd36y2nn52fsj6ginl8plc6pi5416";
+        sha512 = "30hhy83lmjldcwwbjpk5q9zjai5r3xyhlrddalgrw8mspknayncaa2l32gg327fw0a8qaakzgwkh68gj81pmk3dps5wzy881pf22dhc";
       };
   };
 
diff --git a/pkgs/applications/editors/eclipse/plugins.nix b/pkgs/applications/editors/eclipse/plugins.nix
index 839b079ce7b7b..46a9b6c477aec 100644
--- a/pkgs/applications/editors/eclipse/plugins.nix
+++ b/pkgs/applications/editors/eclipse/plugins.nix
@@ -248,12 +248,12 @@ rec {
   cdt = buildEclipseUpdateSite rec {
     name = "cdt-${version}";
     # find current version at https://www.eclipse.org/cdt/downloads.php
-    version = "10.3.2";
+    version = "10.4.1";
 
     src = fetchzip {
       stripRoot = false;
       url = "https://www.eclipse.org/downloads/download.php?r=1&nf=1&file=/tools/cdt/releases/${lib.versions.majorMinor version}/${name}/${name}.zip";
-      sha256 = "0zrxgb8mkrzc1zm5225hzn8awj9yl5fd2dcr92692g0yg61nv4jd";
+      sha256 = "1l3v6dryaqifwrv2h4knwmpyf11qbyl04p7gcvgrx3hczc82a6p1";
     };
 
     meta = with lib; {
diff --git a/pkgs/applications/editors/emacs/elisp-packages/emacs2nix.nix b/pkgs/applications/editors/emacs/elisp-packages/emacs2nix.nix
index 1d7238ad226a9..20bb0efdd6637 100644
--- a/pkgs/applications/editors/emacs/elisp-packages/emacs2nix.nix
+++ b/pkgs/applications/editors/emacs/elisp-packages/emacs2nix.nix
@@ -4,8 +4,8 @@ let
   src = pkgs.fetchgit {
     url = "https://github.com/nix-community/emacs2nix.git";
     fetchSubmodules = true;
-    rev = "8612e136199b29201703e3e28eba26ddc53f297e";
-    sha256 = "sha256-p15KuXS18j8nqy69LPnHcj6ciHLxa/nibshts0HMZ0A=";
+    rev = "2e8d2c644397be57455ad32c2849f692eeac7797";
+    sha256 = "sha256-qnOYDYHAQ+r5eegKP9GqHz5R2ig96B2W7M+uYa1ti9M=";
   };
 in
 pkgs.mkShell {
diff --git a/pkgs/applications/editors/texstudio/default.nix b/pkgs/applications/editors/texstudio/default.nix
index a51056130806a..853593557dc51 100644
--- a/pkgs/applications/editors/texstudio/default.nix
+++ b/pkgs/applications/editors/texstudio/default.nix
@@ -3,13 +3,13 @@
 
 mkDerivation rec {
   pname = "texstudio";
-  version = "3.1.2";
+  version = "4.0.0";
 
   src = fetchFromGitHub {
     owner = "${pname}-org";
     repo = pname;
     rev = version;
-    sha256 = "0h5g1sirsy1f2xlq85c1ik1s52gycfipy9yx0flgaw8m4wmhz26v";
+    sha256 = "0fapgc6dvzn47gmhxkqymwi3818rdiag33ml57j2mfmsi5pjxi0f";
   };
 
   nativeBuildInputs = [ qmake wrapQtAppsHook pkg-config ];
diff --git a/pkgs/applications/kde/default.nix b/pkgs/applications/kde/default.nix
index 6860075884103..c477fff5c5a8c 100644
--- a/pkgs/applications/kde/default.nix
+++ b/pkgs/applications/kde/default.nix
@@ -4,8 +4,8 @@
 
 READ THIS FIRST
 
-This module is for official packages in the KDE Applications Bundle. All
-available packages are listed in `./srcs.nix`, although some are not yet
+This module is for official packages in the KDE Gear. All available
+packages are listed in `./srcs.nix`, although some are not yet
 packaged in Nixpkgs (see below).
 
 IF YOUR PACKAGE IS NOT LISTED IN `./srcs.nix`, IT DOES NOT GO HERE.
diff --git a/pkgs/applications/kde/fetch.sh b/pkgs/applications/kde/fetch.sh
index 9c7c1975eac8f..1d10789bccaed 100644
--- a/pkgs/applications/kde/fetch.sh
+++ b/pkgs/applications/kde/fetch.sh
@@ -1 +1 @@
-WGET_ARGS=( http://download.kde.org/stable/release-service/21.08.1/src -A '*.tar.xz' )
+WGET_ARGS=( https://download.kde.org/stable/release-service/21.08.1/src -A '*.tar.xz' )
diff --git a/pkgs/applications/networking/cozy-drive/default.nix b/pkgs/applications/networking/cozy-drive/default.nix
new file mode 100644
index 0000000000000..75a11b0ea12c0
--- /dev/null
+++ b/pkgs/applications/networking/cozy-drive/default.nix
@@ -0,0 +1,35 @@
+{ lib
+, fetchurl
+, appimageTools
+}:
+
+let
+  pname = "cozydrive";
+  version = "3.30.1";
+  name = "${pname}-${version}";
+
+  src = fetchurl {
+    url = "https://github.com/cozy-labs/cozy-desktop/releases/download/v${version}/Cozy-Drive-${version}-x86_64.AppImage";
+    sha256 = "06w305l5iadd4k70jvrvw2scwlfxycign2nz0f2vrwwhqy8bpfqs";
+  };
+  appimageContents = appimageTools.extract { inherit name src; };
+
+in
+appimageTools.wrapType2 {
+  inherit name src;
+  extraInstallCommands = ''
+    mv $out/bin/${name} $out/bin/${pname}
+    install -m 444 -D ${appimageContents}/cozydrive.desktop -t $out/share/applications
+    substituteInPlace $out/share/applications/cozydrive.desktop \
+      --replace 'Exec=AppRun' 'Exec=${pname}'
+    cp -r ${appimageContents}/usr/share/icons $out/share
+  '';
+
+  meta = with lib; {
+    description = "Cozy Drive is a synchronization tool for your files and folders with Cozy Cloud.";
+    homepage = "https://cozy.io";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ "Simarra" ];
+    platforms = [ "x86_64-linux" ];
+  };
+}
diff --git a/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix b/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
index 48ba14824cfa1..51075425b4f99 100644
--- a/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
@@ -25,7 +25,7 @@ let
       else "");
 in stdenv.mkDerivation rec {
   pname = "signal-desktop";
-  version = "5.18.0"; # Please backport all updates to the stable channel.
+  version = "5.18.1"; # Please backport all updates to the stable channel.
   # All releases have a limited lifetime and "expire" 90 days after the release.
   # When releases "expire" the application becomes unusable until an update is
   # applied. The expiration date for the current release can be extracted with:
@@ -35,7 +35,7 @@ in stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://updates.signal.org/desktop/apt/pool/main/s/signal-desktop/signal-desktop_${version}_amd64.deb";
-    sha256 = "1pajv9f6xl06597322swkjzhfqvlfavsbhbn1xnvy4r28i84mp7d";
+    sha256 = "0x1wrzxyspghv0hwdh3sw8536c9qi7211d2g5cr3f33kz9db5xp4";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/networking/irc/catgirl/default.nix b/pkgs/applications/networking/irc/catgirl/default.nix
index 936524918e040..f45f803e805f6 100644
--- a/pkgs/applications/networking/irc/catgirl/default.nix
+++ b/pkgs/applications/networking/irc/catgirl/default.nix
@@ -9,6 +9,16 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-MEm5mrrWfNp+mBHFjGSOGvvfvBJ+Ho/K+mPUxzJDkV0=";
   };
 
+  # catgirl's configure script uses pkg-config --variable exec_prefix openssl
+  # to discover the install location of the openssl(1) utility. exec_prefix
+  # is the "out" output of libressl in our case (where the libraries are
+  # installed), so we need to fix this up.
+  postConfigure = ''
+    substituteInPlace config.mk --replace \
+      "$($PKG_CONFIG --variable exec_prefix openssl)" \
+      "${lib.getBin libressl}"
+  '';
+
   nativeBuildInputs = [ ctags pkg-config ];
   buildInputs = [ libressl ncurses ];
   strictDeps = true;
diff --git a/pkgs/applications/networking/onionshare/default.nix b/pkgs/applications/networking/onionshare/default.nix
index 074fb770b5330..19188155862cf 100644
--- a/pkgs/applications/networking/onionshare/default.nix
+++ b/pkgs/applications/networking/onionshare/default.nix
@@ -1,4 +1,5 @@
 { lib
+, stdenv
 , buildPythonApplication
 , substituteAll
 , fetchFromGitHub
@@ -111,6 +112,11 @@ rec {
       "test_firefox_like_behavior"
       "test_if_unmodified_since"
       "test_get_tor_paths_linux"  # expects /usr instead of /nix/store
+    ] ++ lib.optionals stdenv.isDarwin [
+      # on darwin (and only on darwin) onionshare attempts to discover
+      # user's *real* homedir via /etc/passwd, making it more painful
+      # to fake
+      "test_receive_mode_webhook"
     ];
   };
 
diff --git a/pkgs/applications/networking/remote/vmware-horizon-client/default.nix b/pkgs/applications/networking/remote/vmware-horizon-client/default.nix
index 7c6e46c137928..033386afd1ff5 100644
--- a/pkgs/applications/networking/remote/vmware-horizon-client/default.nix
+++ b/pkgs/applications/networking/remote/vmware-horizon-client/default.nix
@@ -39,7 +39,7 @@
 , zlib
 }:
 let
-  version = "2103";
+  version = "2106.1";
 
   sysArch =
     if stdenv.hostPlatform.system == "x86_64-linux" then "x64"
@@ -50,8 +50,8 @@ let
     name = "vmwareHorizonClientFiles";
     inherit version;
     src = fetchurl {
-      url = "https://download3.vmware.com/software/view/viewclients/CART22FQ1/VMware-Horizon-Client-Linux-2103-8.2.0-17742757.tar.gz";
-      sha256 = "62f95bb802b058a98f5ee6c2296b89bd7e15884a24dc8a8ba7ce89de7e0798e4";
+      url = "https://download3.vmware.com/software/view/viewclients/CART22FQ2/VMware-Horizon-Client-Linux-2106.1-8.3.1-18435609.tar.gz";
+      sha256 = "b42ddb9d7e9c8d0f8b86b69344fcfca45251c5a5f1e06a18a3334d5a04e18c39";
     };
     nativeBuildInputs = [ makeWrapper ];
     installPhase = ''
diff --git a/pkgs/applications/networking/remote/vmware-horizon-client/update.sh b/pkgs/applications/networking/remote/vmware-horizon-client/update.sh
index 126cb17a7c284..eec3d1de79e0e 100755
--- a/pkgs/applications/networking/remote/vmware-horizon-client/update.sh
+++ b/pkgs/applications/networking/remote/vmware-horizon-client/update.sh
@@ -2,13 +2,13 @@
 #!nix-shell -p curl -p jq -p common-updater-scripts -i bash
 set -e
 
-entryPointURL='https://my.vmware.com/channel/public/api/v1.0/products/getRelatedDLGList?locale=en_US&category=desktop_end_user_computing&product=vmware_horizon_clients&version=horizon_8&dlgType=PRODUCT_BINARY'
+entryPointURL='https://customerconnect.vmware.com/channel/public/api/v1.0/products/getRelatedDLGList?locale=en_US&category=desktop_end_user_computing&product=vmware_horizon_clients&version=horizon_8&dlgType=PRODUCT_BINARY'
 
 function getTarballMetaUrl {
     curl "$entryPointURL" | jq -r '
         .dlgEditionsLists | .[] | select(.name | contains("Client for Linux")) |
         .dlgList | .[] | select(.name | contains("tarball version")) |
-        @uri "https://my.vmware.com/channel/public/api/v1.0/dlg/details?locale=en_US&downloadGroup=\(.code)&productId=\(.productId)&rPId=\(.releasePackageId)"
+        @uri "https://customerconnect.vmware.com/channel/public/api/v1.0/dlg/details?locale=en_US&downloadGroup=\(.code)&productId=\(.productId)&rPId=\(.releasePackageId)"
     '
 }
 
diff --git a/pkgs/applications/science/chemistry/siesta/default.nix b/pkgs/applications/science/chemistry/siesta/default.nix
index 7b3a69ae775b2..7ee46f7d7e22f 100644
--- a/pkgs/applications/science/chemistry/siesta/default.nix
+++ b/pkgs/applications/science/chemistry/siesta/default.nix
@@ -1,16 +1,19 @@
-{ lib, stdenv, fetchurl
+{ lib, stdenv
 , gfortran, blas, lapack, scalapack
 , useMpi ? false
 , mpi
+, fetchFromGitLab
 }:
 
-stdenv.mkDerivation {
-  version = "4.1-b3";
+stdenv.mkDerivation rec {
+  version = "4.1.5";
   pname = "siesta";
 
-  src = fetchurl {
-    url = "https://launchpad.net/siesta/4.1/4.1-b3/+download/siesta-4.1-b3.tar.gz";
-    sha256 = "1450jsxj5aifa0b5fcg7mxxq242fvqnp4zxpgzgbkdp99vrp06gm";
+  src = fetchFromGitLab {
+    owner = "siesta-project";
+    repo = "siesta";
+    rev = "v${version}";
+    sha256 = "0lz8rfl5xwdj17zn7a30ipi7cgjwqki21a7wg9rdg7iwx27bpnmg";
   };
 
   passthru = {
@@ -64,7 +67,7 @@ stdenv.mkDerivation {
          matching the quality of other approaches, such as plane-wave
          and all-electron methods.
       '';
-    homepage = "https://www.quantum-espresso.org/";
+    homepage = "https://siesta-project.org/siesta/";
     license = licenses.gpl2;
     platforms = [ "x86_64-linux" ];
     maintainers = [ maintainers.costrouc ];
diff --git a/pkgs/development/interpreters/perl/default.nix b/pkgs/development/interpreters/perl/default.nix
index 7bc067c92c733..45c12b9720c46 100644
--- a/pkgs/development/interpreters/perl/default.nix
+++ b/pkgs/development/interpreters/perl/default.nix
@@ -1,4 +1,4 @@
-{ config, lib, stdenv, fetchurl, fetchFromGitHub, pkgs, buildPackages
+{ config, lib, stdenv, fetchurl, fetchpatch, fetchFromGitHub, pkgs, buildPackages
 , callPackage
 , enableThreading ? true, coreutils, makeWrapper
 }:
@@ -41,7 +41,14 @@ let
       ]
       ++ optional stdenv.isSunOS ./ld-shared.patch
       ++ optionals stdenv.isDarwin [ ./cpp-precomp.patch ./sw_vers.patch ]
-      ++ optional crossCompiling ./MakeMaker-cross.patch;
+      ++ optionals crossCompiling [
+        ./MakeMaker-cross.patch
+        # https://github.com/arsv/perl-cross/pull/120
+        (fetchpatch {
+          url = "https://github.com/arsv/perl-cross/commit/3c318ae6572f8b36cb077c8b49c851e2f5fe181e.patch";
+          sha256 = "0cmcy8bams3c68f6xadl52z2w378wcpdjzi3qi4pcyvcfs011l6g";
+        })
+      ];
 
     # This is not done for native builds because pwd may need to come from
     # bootstrap tools when building bootstrap perl.
@@ -59,7 +66,7 @@ let
       unset src
     '';
 
-    # Build a thread-safe Perl with a dynamic libperls.o.  We need the
+    # Build a thread-safe Perl with a dynamic libperl.so.  We need the
     # "installstyle" option to ensure that modules are put under
     # $out/lib/perl5 - this is the general default, but because $out
     # contains the string "perl", Configure would select $out/lib.
@@ -71,13 +78,14 @@ let
       ++ [
         "-Uinstallusrbinperl"
         "-Dinstallstyle=lib/perl5"
-        "-Duseshrplib"
+      ] ++ lib.optional (!crossCompiling) "-Duseshrplib" ++ [
         "-Dlocincpth=${libcInc}/include"
         "-Dloclibpth=${libcLib}/lib"
       ]
       ++ optionals ((builtins.match ''5\.[0-9]*[13579]\..+'' version) != null) [ "-Dusedevel" "-Uversiononly" ]
       ++ optional stdenv.isSunOS "-Dcc=gcc"
       ++ optional enableThreading "-Dusethreads"
+      ++ optional stdenv.hostPlatform.isStatic "--all-static"
       ++ optionals (!crossCompiling) [
         "-Dprefix=${placeholder "out"}"
         "-Dman1dir=${placeholder "out"}/share/man/man1"
diff --git a/pkgs/development/libraries/restinio/default.nix b/pkgs/development/libraries/restinio/default.nix
new file mode 100644
index 0000000000000..2f26fdceb12c2
--- /dev/null
+++ b/pkgs/development/libraries/restinio/default.nix
@@ -0,0 +1,23 @@
+{ lib, fetchzip }:
+
+let
+  pname = "restinio";
+  version = "0.6.13";
+in
+fetchzip {
+  name = "${pname}-${version}";
+  url = "https://github.com/Stiffstream/restinio/releases/download/v.${version}/${pname}-${version}-full.tar.bz2";
+  sha256 = "0cwbd5ni5pm25c7njs3wllrblb2i853ibjvpbb1iicy833zais8d";
+
+  postFetch = ''
+    mkdir -p $out/include/restinio
+    tar -xjf $downloadedFile --strip-components=3 -C $out/include/restinio --wildcards "*/dev/restinio"
+  '';
+
+  meta = with lib; {
+    description = "Cross-platform, efficient, customizable, and robust asynchronous HTTP/WebSocket server C++14 library";
+    homepage = "https://github.com/Stiffstream/restinio";
+    license = licenses.bsd3;
+    platforms = platforms.all;
+  };
+}
diff --git a/pkgs/development/libraries/science/biology/elastix/default.nix b/pkgs/development/libraries/science/biology/elastix/default.nix
index 55ee5ab4fb667..15465c501b43f 100644
--- a/pkgs/development/libraries/science/biology/elastix/default.nix
+++ b/pkgs/development/libraries/science/biology/elastix/default.nix
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
   ";
 
   meta = with lib; {
-    homepage = "http://elastix.isi.uu.nl/";
+    homepage = "https://elastix.lumc.nl";
     description = "Image registration toolkit based on ITK";
     maintainers = with maintainers; [ bcdarwin ];
     platforms = platforms.x86_64;  # libitkpng linker issues with ITK 5.1
diff --git a/pkgs/development/node-packages/default.nix b/pkgs/development/node-packages/default.nix
index db1312b5ccecf..bbc9a804aa746 100644
--- a/pkgs/development/node-packages/default.nix
+++ b/pkgs/development/node-packages/default.nix
@@ -280,19 +280,19 @@ let
 
     prisma = super.prisma.override {
       nativeBuildInputs = [ pkgs.makeWrapper ];
-      version = "3.1.1";
+      version = "3.2.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/prisma/-/prisma-3.1.1.tgz";
-        sha512 = "sha512-+eZtWIL6hnOKUOvqq9WLBzSw2d/EbTmOx1Td1LI8/0XE40ctXMLG2N1p6NK5/+yivGaoNJ9PDpPsPL9lO4nJrQ==";
+        url = "https://registry.npmjs.org/prisma/-/prisma-3.2.0.tgz";
+        sha512 = "sha512-o8+DH0RD5DbP8QTZej2dsY64yvjOwOG3TWOlJyoCHQ+8DH9m4tzxo38j6IF/PqpN4PmAGPpHuNi/nssG1cvYlQ==";
       };
       dependencies = [
         {
           name = "_at_prisma_slash_engines";
           packageName = "@prisma/engines";
-          version = "3.1.0-24.c22652b7e418506fab23052d569b85d3aec4883f";
+          version = "3.2.0-34.afdab2f10860244038c4e32458134112852d4dad";
           src = fetchurl {
-            url = "https://registry.npmjs.org/@prisma/engines/-/engines-3.1.0-24.c22652b7e418506fab23052d569b85d3aec4883f.tgz";
-            sha512 = "sha512-6NEp0VlLho3hVtIvj2P4h0e19AYqQSXtFGts8gSIXDnV+l5pRFZaDMfGo2RiLMR0Kfrs8c3ZYxYX0sWmVL0tWw==";
+            url = "https://registry.npmjs.org/@prisma/engines/-/engines-3.2.0-34.afdab2f10860244038c4e32458134112852d4dad.tgz";
+            sha512 = "sha512-MiZORXXsGORXTF9RqqKIlN/2ohkaxAWTsS7qxDJTy5ThTYLrXSmzxTSohM4qN/AI616B+o5WV7XTBhjlPKSufg==";
           };
         }
       ];
diff --git a/pkgs/development/python-modules/ailment/default.nix b/pkgs/development/python-modules/ailment/default.nix
index 84e9c9ed89b39..f98cf112eb17e 100644
--- a/pkgs/development/python-modules/ailment/default.nix
+++ b/pkgs/development/python-modules/ailment/default.nix
@@ -7,14 +7,14 @@
 
 buildPythonPackage rec {
   pname = "ailment";
-  version = "9.0.10055";
+  version = "9.0.10072";
   disabled = pythonOlder "3.6";
 
   src = fetchFromGitHub {
     owner = "angr";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-RaYwPWKFYbDbWm5lZYk9qaDCgL8HcimIRZasbPPOlqo=";
+    sha256 = "sha256-sUyR9X/+JedJGsiQQuwgJQB5e1+S1I516P5jDCQRzAw=";
   };
 
   propagatedBuildInputs = [ pyvex ];
diff --git a/pkgs/development/python-modules/angr/default.nix b/pkgs/development/python-modules/angr/default.nix
index cf1c5c160cc9a..342ff82c3afb3 100644
--- a/pkgs/development/python-modules/angr/default.nix
+++ b/pkgs/development/python-modules/angr/default.nix
@@ -43,14 +43,14 @@ in
 
 buildPythonPackage rec {
   pname = "angr";
-  version = "9.0.10055";
+  version = "9.0.10072";
   disabled = pythonOlder "3.6";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-egj24DBP2Bq2GMYOhZZPXmnobpbjxbD2V8MWwZpqhUg=";
+    sha256 = "sha256-mdGcEeuWXo0Qyi8+mU8RSpUoTbUkVBmduTz3B4TW2zg=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/angrop/default.nix b/pkgs/development/python-modules/angrop/default.nix
index 4b16964fa4f0a..a71c6e3c7ef0a 100644
--- a/pkgs/development/python-modules/angrop/default.nix
+++ b/pkgs/development/python-modules/angrop/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "angrop";
-  version = "9.0.10055";
+  version = "9.0.10072";
   disabled = pythonOlder "3.6";
 
   src = fetchFromGitHub {
     owner = "angr";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-OAn57lt25ZmEU62pJLJd+3T0v2nCYRDnwuVhiZfA7Uk=";
+    sha256 = "sha256-FTKvGhONDUifwZhoKBXTZQFNbC/vTcHdLIge3j6U8uo=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/archinfo/default.nix b/pkgs/development/python-modules/archinfo/default.nix
index 6f7f3c47adb80..e20cb09326f78 100644
--- a/pkgs/development/python-modules/archinfo/default.nix
+++ b/pkgs/development/python-modules/archinfo/default.nix
@@ -7,13 +7,13 @@
 
 buildPythonPackage rec {
   pname = "archinfo";
-  version = "9.0.10055";
+  version = "9.0.10072";
 
   src = fetchFromGitHub {
     owner = "angr";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-eQBART7WSAJKQRKNwmR1JKTkrlerHeHVgTK5v0R644Q=";
+    sha256 = "sha256-Nwt2QD+A67Lbgzg/HSR+yaNWk9+EsUWA5nxm4JTikS8=";
   };
 
   checkInputs = [
diff --git a/pkgs/development/python-modules/claripy/default.nix b/pkgs/development/python-modules/claripy/default.nix
index e403891726ab6..584067e10242a 100644
--- a/pkgs/development/python-modules/claripy/default.nix
+++ b/pkgs/development/python-modules/claripy/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "claripy";
-  version = "9.0.10055";
+  version = "9.0.10072";
   disabled = pythonOlder "3.6";
 
   src = fetchFromGitHub {
     owner = "angr";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-QHhZVnUv54I8R7oCOBJgBcKZr8csg2OEOGxn4MKgmtk=";
+    sha256 = "sha256-bsFfp1ocgHhe0/1wWwgnXDQm37gmWQylZvy6HiyQGSw=";
   };
 
   # Use upstream z3 implementation
diff --git a/pkgs/development/python-modules/cle/default.nix b/pkgs/development/python-modules/cle/default.nix
index 0a55542b4870b..c5dea6ece1cfc 100644
--- a/pkgs/development/python-modules/cle/default.nix
+++ b/pkgs/development/python-modules/cle/default.nix
@@ -15,7 +15,7 @@
 
 let
   # The binaries are following the argr projects release cycle
-  version = "9.0.10055";
+  version = "9.0.10072";
 
   # Binary files from https://github.com/angr/binaries (only used for testing and only here)
   binaries = fetchFromGitHub {
@@ -35,7 +35,7 @@ buildPythonPackage rec {
     owner = "angr";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-fqnumSz3BfpG5/ReQQOhSGvsOMuinLs8q2HlPAxYQWM=";
+    sha256 = "sha256-uY0Pp+BssnkQvF8fsVlRW2Wj/JmMBSBudDf9AHekBtw=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/graphene/default.nix b/pkgs/development/python-modules/graphene/default.nix
index 30947c1430303..38c11cc4c8bef 100644
--- a/pkgs/development/python-modules/graphene/default.nix
+++ b/pkgs/development/python-modules/graphene/default.nix
@@ -11,26 +11,19 @@
 , pytest-mock
 , pytz
 , snapshottest
-, fetchpatch
 }:
 
 buildPythonPackage rec {
   pname = "graphene";
-  version = "3.0.0b7";
+  version = "3.0.0b8";
 
   src = fetchFromGitHub {
     owner = "graphql-python";
     repo = "graphene";
     rev = "v${version}";
-    sha256 = "sha256-bVCCLPnV5F8PqLMg3GwcpwpGldrxsU+WryL6gj6y338=";
+    sha256 = "sha256-Pgln369s4qXdKqLxhX+AkgpDQm+MfSZ/OVmB1AaawHI=";
   };
 
-  patches = [ (fetchpatch {
-    # Allow later aniso8601 releases, https://github.com/graphql-python/graphene/pull/1331
-    url = "https://github.com/graphql-python/graphene/commit/26b16f75b125e35eeb2274b7be503ec29f2e8a45.patch";
-    sha256 = "qm96pNOoxPieEy1CFZpa2Mx010pY3QU/vRyuL0qO3Tk=";
-  }) ];
-
   propagatedBuildInputs = [
     aniso8601
     graphql-core
diff --git a/pkgs/development/python-modules/liquidctl/default.nix b/pkgs/development/python-modules/liquidctl/default.nix
index c62e4c74576b0..9ac682b42422d 100644
--- a/pkgs/development/python-modules/liquidctl/default.nix
+++ b/pkgs/development/python-modules/liquidctl/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage rec {
   pname = "liquidctl";
-  version = "1.7.1";
+  version = "1.7.2";
   disabled = pythonOlder "3.6";
 
   src = fetchFromGitHub {
-    owner  = pname;
-    repo   = pname;
-    rev    = "v${version}";
-    sha256 = "sha256-TNDQV1BOVVdvr0XAyWGcwgMbe4mV7J05hQeKVUqVT9s=";
+    owner = pname;
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "sha256-fPSvxdr329SxAe4N7lTa7hddFp1WVUplkhYD1oDQXAI=";
   };
 
   nativeBuildInputs = [ installShellFiles ];
@@ -56,9 +56,9 @@ buildPythonPackage rec {
 
   meta = with lib; {
     description = "Cross-platform CLI and Python drivers for AIO liquid coolers and other devices";
-    homepage    = "https://github.com/liquidctl/liquidctl";
-    changelog   = "https://github.com/liquidctl/liquidctl/blob/master/CHANGELOG.md";
-    license     = licenses.gpl3Plus;
+    homepage = "https://github.com/liquidctl/liquidctl";
+    changelog = "https://github.com/liquidctl/liquidctl/blob/master/CHANGELOG.md";
+    license = licenses.gpl3Plus;
     maintainers = with maintainers; [ arturcygan evils ];
   };
 }
diff --git a/pkgs/development/python-modules/pyvex/default.nix b/pkgs/development/python-modules/pyvex/default.nix
index 6a4215236d858..dc7c0c84b7819 100644
--- a/pkgs/development/python-modules/pyvex/default.nix
+++ b/pkgs/development/python-modules/pyvex/default.nix
@@ -11,11 +11,11 @@
 
 buildPythonPackage rec {
   pname = "pyvex";
-  version = "9.0.10055";
+  version = "9.0.10072";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-ZfsFr8EkzdDYMyE/OJVwQylHVKcOrW1NBMI8cGmyF9A=";
+    sha256 = "sha256-F6NUvcGYshPbfcfhkfbnzIxkXmfpAc/kfHFk5fuaICA=";
   };
 
   postPatch = lib.optionalString stdenv.isDarwin ''
diff --git a/pkgs/development/python-modules/spacy-transformers/default.nix b/pkgs/development/python-modules/spacy-transformers/default.nix
index c13ca40720746..94e7410d6c79a 100644
--- a/pkgs/development/python-modules/spacy-transformers/default.nix
+++ b/pkgs/development/python-modules/spacy-transformers/default.nix
@@ -3,6 +3,7 @@
 , fetchPypi
 , buildPythonPackage
 , pytorch
+, pythonOlder
 , spacy
 , spacy-alignments
 , srsly
@@ -11,11 +12,13 @@
 
 buildPythonPackage rec {
   pname = "spacy-transformers";
-  version = "1.0.2";
+  version = "1.0.6";
+
+  disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-AYshH2trMTgeSkAPRb6wRWpm4gA5FaKV2NJd+PhzAy4=";
+    sha256 = "sha256-zkpSaiqb0wUTugmbeREVJyZzv5qxXXw4YFBpXzdSUXE=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/spacy/annotation-test/annotate.py b/pkgs/development/python-modules/spacy/annotation-test/annotate.py
index eb6288084883d..515b8f57b7ef7 100644
--- a/pkgs/development/python-modules/spacy/annotation-test/annotate.py
+++ b/pkgs/development/python-modules/spacy/annotation-test/annotate.py
@@ -26,10 +26,10 @@ def test_entities(doc_en_core_web_sm):
 
     assert entities == [
         ('Sebastian Thrun', 'PERSON'),
+        ('Google', 'ORG'),
         ('2007', 'DATE'),
         ('American', 'NORP'),
-        ('Thrun', 'PERSON'),
-        ('Recode', 'PERSON'),
+        ('Thrun', 'GPE'),
         ('earlier this week', 'DATE'),
     ]
 
diff --git a/pkgs/development/python-modules/spacy/default.nix b/pkgs/development/python-modules/spacy/default.nix
index 376686e0a6e52..c0c8593452c08 100644
--- a/pkgs/development/python-modules/spacy/default.nix
+++ b/pkgs/development/python-modules/spacy/default.nix
@@ -23,15 +23,20 @@
 , packaging
 , pathy
 , pydantic
+, python
+, tqdm
+, typing-extensions
 }:
 
 buildPythonPackage rec {
   pname = "spacy";
-  version = "3.0.6";
+  version = "3.1.3";
+
+  disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-ViirifH1aAmciAsSqcN/Ts4pq4kmBmDP33KMAnEYecU=";
+    sha256 = "sha256-WAhOZKJ5lxkupI8Yq7MOwUjFu+edBNF7pNL8JiEAwqI=";
   };
 
   propagatedBuildInputs = [
@@ -42,32 +47,27 @@ buildPythonPackage rec {
     jsonschema
     murmurhash
     numpy
+    packaging
+    pathy
     preshed
+    pydantic
     requests
     setuptools
     srsly
     spacy-legacy
     thinc
-    wasabi
-    packaging
-    pathy
-    pydantic
+    tqdm
     typer
-  ] ++ lib.optional (pythonOlder "3.4") pathlib;
+    wasabi
+  ] ++ lib.optional (pythonOlder "3.8") typing-extensions;
 
   checkInputs = [
     pytest
   ];
 
   doCheck = false;
-  # checkPhase = ''
-  #   ${python.interpreter} -m pytest spacy/tests --vectors --models --slow
-  # '';
-
-  postPatch = ''
-    substituteInPlace setup.cfg \
-      --replace "blis>=0.4.0,<0.8.0" "blis>=0.4.0,<1.0" \
-      --replace "pydantic>=1.7.1,<1.8.0" "pydantic>=1.7.1,<1.8.3"
+  checkPhase = ''
+    ${python.interpreter} -m pytest spacy/tests --vectors --models --slow
   '';
 
   pythonImportsCheck = [ "spacy" ];
diff --git a/pkgs/development/python-modules/spacy/models.json b/pkgs/development/python-modules/spacy/models.json
index a2989b6da502b..7c2212359b8ae 100644
--- a/pkgs/development/python-modules/spacy/models.json
+++ b/pkgs/development/python-modules/spacy/models.json
@@ -1,332 +1,332 @@
 [
   {
     "pname": "da_core_news_lg",
-    "version": "3.0.0",
-    "sha256": "0l0wljc1lm9a72ngfd4aa90laz4zcc37ix9nsiaqlw004v01z7wj",
+    "version": "3.1.0",
+    "sha256": "0mchfkj0l1fx1l3bvilwyj7y3frg8hpxyga87vcpf7rzm1iynz1z",
     "license": "cc-by-sa-40"
   },
   {
     "pname": "da_core_news_md",
-    "version": "3.0.0",
-    "sha256": "14h3ym22224aimfk2kj88pmn83hkb57w402i0x6pd7ra86n372lh",
+    "version": "3.1.0",
+    "sha256": "0vbg353cfjlid8k3nk8zzzxsrsvl2qmjhdg5qfr3f91klzy385cg",
     "license": "cc-by-sa-40"
   },
   {
     "pname": "da_core_news_sm",
-    "version": "3.0.0",
-    "sha256": "05893dpmx76waqnlysnkq8hz9271rkk30xf6hy98gka6244l9a1l",
+    "version": "3.1.0",
+    "sha256": "0c0nv42737jbyhvfvz1aqqn97fpd6jrh4bxmkzyjx0svyc1n3bxz",
     "license": "cc-by-sa-40"
   },
   {
     "pname": "de_core_news_lg",
-    "version": "3.0.0",
-    "sha256": "0s7vfpr9gv22pvh697ffg35fppxkjhw23ynf4bpz73hl9jikdqvj",
+    "version": "3.1.0",
+    "sha256": "03hyx9d0050y8hr1mjadbqrxvw7g8xv3zd1vgw4yq68ran6ggjbl",
     "license": "mit"
   },
   {
     "pname": "de_core_news_md",
-    "version": "3.0.0",
-    "sha256": "09vvlm3rxmyiima81y4bvcyxhn9bjxrqlkbmglzmwhrhxm84nkmx",
+    "version": "3.1.0",
+    "sha256": "1n2j4bjlc4vhrr5i6f2vrn4pwwrd0jjc3wc2g8c4dr9jgdcwnl0n",
     "license": "mit"
   },
   {
     "pname": "de_core_news_sm",
-    "version": "3.0.0",
-    "sha256": "1w5aqfzknnnxpsi9i6kn6bki58j0mp24d4gr2203bf6g5kahiq03",
+    "version": "3.1.0",
+    "sha256": "0s82qhyv5x1wzvwy69jwh1sddw53q741ci5d10128mkmjyapdhzv",
     "license": "mit"
   },
   {
     "pname": "de_dep_news_trf",
-    "version": "3.0.0",
-    "sha256": "1snkm911jn73mqfz0y0anr12r6j3gdi6wd8qmd5alwm623x4s6hm",
+    "version": "3.1.0",
+    "sha256": "0ws9xvzz6aimpn4cgi2rdi06acqrisf9c4v31yn1ljrrkwv9clwk",
     "license": "mit"
   },
   {
     "pname": "el_core_news_lg",
-    "version": "3.0.0",
-    "sha256": "011lqmx3f3laf2vvqp0hxp5y105pn54kwdh1xzw4hs2pj6fac9p5",
+    "version": "3.1.0",
+    "sha256": "1gf85gr5dyd3hk38zzp9aax1adhq1f5hhvl6s8sxh4myakpvmikw",
     "license": "cc-by-nc-sa-30"
   },
   {
     "pname": "el_core_news_md",
-    "version": "3.0.0",
-    "sha256": "0p75c18sg38j9dj79ykmm5kzcwjxccpgrcw4cjcscb6ad6wwvcjx",
+    "version": "3.1.0",
+    "sha256": "05k3fp1afhd89v5m46jngvzncf08546r0ic1micc70mzrxifs3jl",
     "license": "cc-by-nc-sa-30"
   },
   {
     "pname": "el_core_news_sm",
-    "version": "3.0.0",
-    "sha256": "0gvisa7yg1w49hpfp79ahy50v64l3rmk56k0k7zkgc8ml1gn892r",
+    "version": "3.1.0",
+    "sha256": "0g7riydqghnri95wbxdbfchgrm88jg7qhv3hfhb4f9zp7viy2fx9",
     "license": "cc-by-nc-sa-30"
   },
   {
     "pname": "en_core_web_lg",
-    "version": "3.0.0",
-    "sha256": "0sdb85zvfb12d14k3wy23dfryy3xwc9ag79zq71qnxwpvvygmc8y",
+    "version": "3.1.0",
+    "sha256": "106mi060r9q06b90cx2hhsr39bajj70gkliwxfbg9mps69ci8xdy",
     "license": "mit"
   },
   {
     "pname": "en_core_web_md",
-    "version": "3.0.0",
-    "sha256": "0c669b1vsp3z28n52lfsijmkn9465r8zjjygjml5rlf9lf1paxa5",
+    "version": "3.1.0",
+    "sha256": "1565swsn628515gfw47h5pf868kw4bnag22iwxyf3mmnlyif63bz",
     "license": "mit"
   },
   {
     "pname": "en_core_web_sm",
-    "version": "3.0.0",
-    "sha256": "0risizvzkicffw7vgrj92z23dfb7zvvzihqgvjcrx8989b7b6wq6",
+    "version": "3.1.0",
+    "sha256": "0q3nz1q4nmj58s5f5h4n43w4pcfai8n51vgr9w7ckrhiappcn97n",
     "license": "mit"
   },
   {
     "pname": "en_core_web_trf",
-    "version": "3.0.0",
-    "sha256": "0plmg77rv1spr0swn4jakci16mbqsxm32mz9nnwc9ylynbvgrhmn",
+    "version": "3.1.0",
+    "sha256": "087dzqazrpl2bc2bys8rdqb8s08il8lc3zjk9scalggkgyqn6h20",
     "license": "mit"
   },
   {
     "pname": "es_core_news_lg",
-    "version": "3.0.0",
-    "sha256": "0832w8qmg0fp2q8329ndlbbzpfkpbw9v38ny7106a45xaz0rn2xc",
+    "version": "3.1.0",
+    "sha256": "1jrkx80n4wkvwvw6lmqd9kxdxag7qr2vfhi0msc43li11bb01dxi",
     "license": "gpl3"
   },
   {
     "pname": "es_core_news_md",
-    "version": "3.0.0",
-    "sha256": "01is980r63a5418jq917scapzkl9xydj56lrsxbr16fya0hh8qnn",
+    "version": "3.1.0",
+    "sha256": "0x4l9d3ky15rsf9h0zx0k9z5g0alwly0lch6dzn5b3ngphz01d43",
     "license": "gpl3"
   },
   {
     "pname": "es_core_news_sm",
-    "version": "3.0.0",
-    "sha256": "1wgya0f25dgix57pb60fyl4hf2msma16d1f6cf617ypk6g3v80rb",
+    "version": "3.1.0",
+    "sha256": "1y3ibgc1q1ck6qrkbwvsv401vcyy9cnpxkzj5lvdhz7xwm8agqw6",
     "license": "gpl3"
   },
   {
     "pname": "es_dep_news_trf",
-    "version": "3.0.0",
-    "sha256": "07lim35p0mxb75qiym79wcrak3j7wcan393260haxgwrj29rzpvv",
+    "version": "3.1.0",
+    "sha256": "1p47ng7837iixfcfir5rrsbix9633hbi8hvg46zyw9waygyp57l3",
     "license": "gpl3"
   },
   {
     "pname": "fr_core_news_lg",
-    "version": "3.0.0",
-    "sha256": "1frg734lb64gkm7pagqp1mj7lqpwsxxj5vyjm10yja0rkdi6kcca",
+    "version": "3.1.0",
+    "sha256": "1vpzhny33i2x9pnh9d9wajj3m5bpxk1bc21r434ir0x81zl61nm8",
     "license": "lgpllr"
   },
   {
     "pname": "fr_core_news_md",
-    "version": "3.0.0",
-    "sha256": "1xshr9r639hdb8vkj5nribk4lkm3a5fb7zrxj3y3p678dr53xalz",
+    "version": "3.1.0",
+    "sha256": "1bqn779zbv8izisk028d8xgga38f4snys3w8kfb05bgmgv9c4qwb",
     "license": "lgpllr"
   },
   {
     "pname": "fr_core_news_sm",
-    "version": "3.0.0",
-    "sha256": "0n23c9rbg1b44c8yjlf6cc0g8ccj6x0rmfjg76ddmpkjaj83jwv1",
+    "version": "3.1.0",
+    "sha256": "0958mpfdmq73gasbqzyg8gjsih0c6bc9b3iyr0llmsibq0lfhglx",
     "license": "lgpllr"
   },
   {
     "pname": "fr_dep_news_trf",
-    "version": "3.0.0",
-    "sha256": "192l6n5yxn1ndc4fk8k759j2d5hryj9mfkpy2aminaxr4dmp2imr",
+    "version": "3.1.0",
+    "sha256": "0afn0a665sqbf28lh4lxz9w2w5982m52kfqzysh5a9r6j734dxqv",
     "license": "lgpllr"
   },
   {
     "pname": "it_core_news_lg",
-    "version": "3.0.0",
-    "sha256": "121nki732wrnfyzcflvsv54nvrz3l3hx55hkd72hlhrvjw0kvkv5",
+    "version": "3.1.0",
+    "sha256": "08l84f9vgi6y1ahkac9pq5i95ninlzcw276vpx4h53zijhk6hvkv",
     "license": "cc-by-nc-sa-30"
   },
   {
     "pname": "it_core_news_md",
-    "version": "3.0.0",
-    "sha256": "0m168wrf1p6dz5kc4n5ga2h8c0d6jzxx876i3ndrg6b7z418hhi5",
+    "version": "3.1.0",
+    "sha256": "1zkw3h626rm2x5pv06yzgbj0hwjlbyn00vg8hjk8k0f5hwad5sf3",
     "license": "cc-by-nc-sa-30"
   },
   {
     "pname": "it_core_news_sm",
-    "version": "3.0.0",
-    "sha256": "132v06cah8l7q4caxg6n4nw34v9jd8y8cqp20njryx4nirm9c36l",
+    "version": "3.1.0",
+    "sha256": "0dn593h105ggzjql8rc0rfn4i78a1l90v7fbycqb427q88fbzkk9",
     "license": "cc-by-nc-sa-30"
   },
   {
     "pname": "lt_core_news_lg",
-    "version": "3.0.0",
-    "sha256": "034qycqpbdiyzhpzjz92kpnx6z2nai70dddz75r48hylzlw1d92h",
+    "version": "3.1.0",
+    "sha256": "1qqds0hxn0lcl51934mgl0c22m7a3vy13rnswb46i5x9lj89d50c",
     "license": "cc-by-sa-40"
   },
   {
     "pname": "lt_core_news_md",
-    "version": "3.0.0",
-    "sha256": "18mb2lmrjwnsc7s4yaq3yvdbh8p8p1k0xpm8cqn521hanpr0jqj3",
+    "version": "3.1.0",
+    "sha256": "0xd8wa1cmywndgd1byiny9rv3008iawxb89pnyradglcbklmffd4",
     "license": "cc-by-sa-40"
   },
   {
     "pname": "lt_core_news_sm",
-    "version": "3.0.0",
-    "sha256": "1p998h9lnp16czj3gg8781gywg17dap2h9f8qc6f87daxyc9bdjs",
+    "version": "3.1.0",
+    "sha256": "0bpf5k09xqdx64rfkpc7949s46b5xm893wx6jwwn2mx4ay6x23s5",
     "license": "cc-by-sa-40"
   },
   {
     "pname": "mk_core_news_lg",
-    "version": "3.0.0",
-    "sha256": "1fmrpgq9plndid7402wkybidpi0phnybb3031jxppan99ihr3hfj",
+    "version": "3.1.0",
+    "sha256": "08i96r0980dgkz2ygj76d0v0lgx0lpb5bxmhxdhv7mhzqs38v436",
     "license": "cc-by-sa-40"
   },
   {
     "pname": "mk_core_news_md",
-    "version": "3.0.0",
-    "sha256": "1mnabkyjxph2xa4g2an5rqp24d4gbq969ln27zpjycyiwxlkz7vl",
+    "version": "3.1.0",
+    "sha256": "1dnah0ycgzy5wp6anpbiclyn0fs6jf7s43sr87rcpfcaflnp1qcs",
     "license": "cc-by-sa-40"
   },
   {
     "pname": "mk_core_news_sm",
-    "version": "3.0.0",
-    "sha256": "1ax6pl61n0p4qf4wcd6c7d42zqjrgh3vhlpl6xby57a78547asxr",
+    "version": "3.1.0",
+    "sha256": "1q1v3i1rpq70nznwhqji2wpjkrxma4v50nsvack1pmqnh9zkcn17",
     "license": "cc-by-sa-40"
   },
   {
     "pname": "nb_core_news_lg",
-    "version": "3.0.0",
-    "sha256": "07a8nsfswlpb2jc2afzf201bjkl2nlz40kqmjx3dbva8jphj3ljs",
+    "version": "3.1.0",
+    "sha256": "0cjd6cl4iaa4c6j7h3gh9iwpnaazhn3w0fmwyp33827y0r1bxanx",
     "license": "mit"
   },
   {
     "pname": "nb_core_news_md",
-    "version": "3.0.0",
-    "sha256": "0y1vydhhgb6cifq7k4vc7dy4jl6wb1z6pklbv65v6nxl7rhn76fz",
+    "version": "3.1.0",
+    "sha256": "17c6khcmpxq7gkdb1hglz3z9jpwdxghfidl4p3cdrphvyxsx8wni",
     "license": "mit"
   },
   {
     "pname": "nb_core_news_sm",
-    "version": "3.0.0",
-    "sha256": "1lk1869cb2176j6lvd8lraclfl706p12m1gvvf1ixm99ra8zkxhs",
+    "version": "3.1.0",
+    "sha256": "0rbq5f5p24yb9j8i4h1z7xrg2knixzdnz9pnpah4klqql9n0w5aw",
     "license": "mit"
   },
   {
     "pname": "nl_core_news_lg",
-    "version": "3.0.0",
-    "sha256": "0iq4ayzh9g9gil4l8kcl5qcm0l16hymavsqgiczf3ddvamciqaxs",
+    "version": "3.1.0",
+    "sha256": "1bg74ig9vcl94sd68m6c2z0vviw41x1mqz3829gzk349qb78h55l",
     "license": "cc-by-sa-40"
   },
   {
     "pname": "nl_core_news_md",
-    "version": "3.0.0",
-    "sha256": "0g9dkzwxndcf05bnhkd9fzqj7n614naspyhalg6h9h1kb7v3m2ak",
+    "version": "3.1.0",
+    "sha256": "1jw2is3n8dg3bkxjq3ziix2xgx3f29s4i7ipibk5w8f0k6d8gyyh",
     "license": "cc-by-sa-40"
   },
   {
     "pname": "nl_core_news_sm",
-    "version": "3.0.0",
-    "sha256": "1l4mk3gs15yc5kssy4x4lyab9kmg9y199h4hvizwh8y1ifqbqy03",
+    "version": "3.1.0",
+    "sha256": "14q8sdl79l5fb32vfk13z69kb3mjb35s6ksbhv0bp7yaav35s8gv",
     "license": "cc-by-sa-40"
   },
   {
     "pname": "pl_core_news_lg",
-    "version": "3.0.0",
-    "sha256": "14ldch7rps1qxh3ldczh7f29ra3dq2kxaxpfbx7r6f1xpmk5s1rv",
+    "version": "3.1.0",
+    "sha256": "1rmb63dvi8fgmnb6q04li1xghb0grlgnbsv6maybnnzmi9471kly",
     "license": "gpl3"
   },
   {
     "pname": "pl_core_news_md",
-    "version": "3.0.0",
-    "sha256": "0fx6ipd8ll2d0w8qwn9cjw0q7w0r3l40467d6mizi4mx93q7m7iw",
+    "version": "3.1.0",
+    "sha256": "11hl9nz1xfb5bz93z3cpzbq58fs4yb4s0184bnsh8bnmqqqkqxmx",
     "license": "gpl3"
   },
   {
     "pname": "pl_core_news_sm",
-    "version": "3.0.0",
-    "sha256": "0p1gcniyrn9qya4wg1qd6ijfchc7lhk0dh4iba8y71mss3n162fs",
+    "version": "3.1.0",
+    "sha256": "05kgv093bq833qczsvksd695494kb7i3gmxcq874z2gg8bhjb70b",
     "license": "gpl3"
   },
   {
     "pname": "pt_core_news_lg",
-    "version": "3.0.0",
-    "sha256": "1vsw1ng364466jz6ffyj9dj3jh4s68gk7csxylc1fj7wac8jxrbj",
+    "version": "3.1.0",
+    "sha256": "1lbzv8789vkcm1jw50g9ny85k3pf245rz9rgr1c7j91d3gzlqkg8",
     "license": "cc-by-sa-40"
   },
   {
     "pname": "pt_core_news_md",
-    "version": "3.0.0",
-    "sha256": "11laikyd6m9zprk7bnfn0v2lixvkcgvpv95dp0zpc0q2izmky6q8",
+    "version": "3.1.0",
+    "sha256": "0a6bs6lpw3n90jzkblkp831xffbglwv33ss16kh2mcvsx41apdhp",
     "license": "cc-by-sa-40"
   },
   {
     "pname": "pt_core_news_sm",
-    "version": "3.0.0",
-    "sha256": "12d59q1gvpx8dj48iq17sindd6wid09hnjb4fw0rb00bb28rmqk1",
+    "version": "3.1.0",
+    "sha256": "0b65ji3sfnx6qhr66m2jm206zgf1vkx8jmp3qxsz8prarsj6az0n",
     "license": "cc-by-sa-40"
   },
   {
     "pname": "ro_core_news_lg",
-    "version": "3.0.0",
-    "sha256": "11mkip5piy6g7rg51ljqjn61s4ydlafl6qp3v29zmm3lghc66h8c",
+    "version": "3.1.0",
+    "sha256": "055yxc0n3c9k28wi4bzq4pvwihj7lq84z7s374cpz8kmykddxjvz",
     "license": "cc-by-sa-40"
   },
   {
     "pname": "ro_core_news_md",
-    "version": "3.0.0",
-    "sha256": "1jyf3khki7xqbp6ir0p4y2p7rdhs36zq2i1960ik4kr2mhnzrblg",
+    "version": "3.1.0",
+    "sha256": "1l1i6jm29qij27laghzgb3ba4a3vk0l5hl09qhrwmrqccycx546r",
     "license": "cc-by-sa-40"
   },
   {
     "pname": "ro_core_news_sm",
-    "version": "3.0.0",
-    "sha256": "0gc61gdfgji92mjdpznkf30nl1fz7378h9bz8dlhvnc401hjzsky",
+    "version": "3.1.0",
+    "sha256": "17dvqn2dip34n3hckdsizjm0mikfqpy5f9f1mz0r9pf2c9fjk1gr",
     "license": "cc-by-sa-40"
   },
   {
     "pname": "ru_core_news_lg",
-    "version": "3.0.0",
-    "sha256": "1x1hxvhki62ypj3x0s4syfhz3znlflp36qkp4l2g2sbxjj2qw7n3",
+    "version": "3.1.0",
+    "sha256": "1748i34rb4cqsjslippay592769gmdzsvly95pfl6nh67vmyd9my",
     "license": "mit"
   },
   {
     "pname": "ru_core_news_md",
-    "version": "3.0.0",
-    "sha256": "0ks0qdyq6627cbg8fbbhvr83d3m8njs2aj8pri540gz9nrbj5479",
+    "version": "3.1.0",
+    "sha256": "0zg3ar1fbrlh2gm30xfc0zz7br4dzzr3bixjvkp5q4k9d2dxmzxh",
     "license": "mit"
   },
   {
     "pname": "ru_core_news_sm",
-    "version": "3.0.0",
-    "sha256": "1x3bmd7f0fqf03wds01imwpbv4xng1qq9iq61m8rbqvskm5jlzbb",
+    "version": "3.1.0",
+    "sha256": "1a507iwgq2940g9gj5a6g25l4l21md0yihivk6fch1k0mjkjrgd0",
     "license": "mit"
   },
   {
     "pname": "xx_ent_wiki_sm",
-    "version": "3.0.0",
-    "sha256": "1115vap4c6snvkwq8bmc8dld1mw5ky0w9n112hadp85pv012ccds",
+    "version": "3.1.0",
+    "sha256": "03kal7nv42yiv8bn9kdi7ngrylzgilk4gqj26jd9q1fszlr018gj",
     "license": "mit"
   },
   {
     "pname": "xx_sent_ud_sm",
-    "version": "3.0.0",
-    "sha256": "062g3xfb3fp33b56wa4fj84smr5rlc0dbja102khxnqm2aakk99k",
+    "version": "3.1.0",
+    "sha256": "0wvfxg2jid3lmxqc9nhizpkqy7206m2axllqbcjgi7pgq56gy7nw",
     "license": "cc-by-sa-30"
   },
   {
     "pname": "zh_core_web_lg",
-    "version": "3.0.0",
-    "sha256": "1ai34fc2wfmb35f1zissddf6jjqpg51wqiyqqq35h03jyf4731jr",
+    "version": "3.1.0",
+    "sha256": "19g557a6n9mwljkbcf3j2ibnizryvnqkl0l5viz8mg8bw39bay2g",
     "license": "mit"
   },
   {
     "pname": "zh_core_web_md",
-    "version": "3.0.0",
-    "sha256": "10npzl8nvyj4jdn2f9iai9inq5c4x3hxdk0ycgg9wcgqaj09gnxa",
+    "version": "3.1.0",
+    "sha256": "1ja4swiy1bx113hpjjx56nixj1xgvw4wlarbxma4xw91g7mmbikg",
     "license": "mit"
   },
   {
     "pname": "zh_core_web_sm",
-    "version": "3.0.0",
-    "sha256": "1f9x5lr8vnvb1n8hc59vm2xi6kv2rj78x1vm916z6ic3vg7vwl1h",
+    "version": "3.1.0",
+    "sha256": "1z97l381ccf1g16834myss4ccyb7x4pbbf6m5skb7300s7csdi1g",
     "license": "mit"
   },
   {
     "pname": "zh_core_web_trf",
-    "version": "3.0.0",
-    "sha256": "178w8dfcvx4aabasid6r0pnwqd5k02cvlq35siqjgfn7j3zb56z0",
+    "version": "3.1.0",
+    "sha256": "11ra9jf10piv79hdyvgg10bwrgcxbb8ml611d3069jjab6vaa8xn",
     "license": "mit"
   }
 ]
diff --git a/pkgs/development/python-modules/thinc/default.nix b/pkgs/development/python-modules/thinc/default.nix
index 6ad29d5736d60..f2a70500a5fa3 100644
--- a/pkgs/development/python-modules/thinc/default.nix
+++ b/pkgs/development/python-modules/thinc/default.nix
@@ -2,41 +2,48 @@
 , lib
 , buildPythonPackage
 , fetchPypi
-, pythonOlder
-, pytest
+, pytestCheckHook
 , blis
 , catalogue
 , cymem
 , cython
-, darwin
+, Accelerate
+, CoreFoundation
+, CoreGraphics
+, CoreVideo
 , hypothesis
 , mock
 , murmurhash
 , numpy
 , pathlib
 , plac
+, pythonOlder
 , preshed
 , pydantic
 , srsly
 , tqdm
+, typing-extensions
 , wasabi
 }:
 
 buildPythonPackage rec {
   pname = "thinc";
-  version = "8.0.3";
+  version = "8.0.10";
+
+  disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-w3CnpG0BtYjY1fmdjV42s8usRRJjg1b6Qw9/Urs6iJc=";
+    hash = "sha256-teTbjSTmvopfHkoXhUdyt5orVgIkUZ9Qoh85UcokAB8=";
   };
 
-  buildInputs = [ cython ] ++ lib.optionals stdenv.isDarwin (with darwin.apple_sdk.frameworks; [
+  buildInputs = [ cython ]
+    ++ lib.optionals stdenv.isDarwin [
     Accelerate
     CoreFoundation
     CoreGraphics
     CoreVideo
-  ]);
+  ];
 
   propagatedBuildInputs = [
     blis
@@ -50,27 +57,20 @@ buildPythonPackage rec {
     tqdm
     pydantic
     wasabi
-  ] ++ lib.optional (pythonOlder "3.4") pathlib;
-
+  ] ++ lib.optional (pythonOlder "3.8") typing-extensions;
 
   checkInputs = [
     hypothesis
     mock
-    pytest
+    pytestCheckHook
   ];
 
   # Cannot find cython modules.
   doCheck = false;
 
-  postPatch = ''
-    substituteInPlace setup.cfg \
-      --replace "blis>=0.4.0,<0.8.0" "blis>=0.4.0,<1.0" \
-      --replace "pydantic>=1.7.1,<1.8.0" "pydantic~=1.7"
-  '';
-
-  checkPhase = ''
-    pytest thinc/tests
-  '';
+  pytestFlagsArray = [
+    "thinc/tests"
+  ];
 
   pythonImportsCheck = [ "thinc" ];
 
diff --git a/pkgs/development/tools/database/prisma-engines/default.nix b/pkgs/development/tools/database/prisma-engines/default.nix
index 6a100bb799d75..eeba3f49fd15a 100644
--- a/pkgs/development/tools/database/prisma-engines/default.nix
+++ b/pkgs/development/tools/database/prisma-engines/default.nix
@@ -11,19 +11,19 @@ let
   node-api-lib = (if stdenv.isDarwin then "libquery_engine.dylib" else "libquery_engine.so");
 in rustPlatform.buildRustPackage rec {
   pname = "prisma-engines";
-  version = "3.1.1";
+  version = "3.2.0";
 
   src = fetchFromGitHub {
     owner = "prisma";
     repo = "prisma-engines";
     rev = version;
-    sha256 = "sha256-7c9jlqMKocA3Kp39zDu2in9nRw4hZRZO1+u/eFfzWa4=";
+    sha256 = "sha256-q0MF6LyIB7dCotYlXiZ4rXl2xMOLqXe5Y+zO+bpoCoY=";
   };
 
   # Use system openssl.
   OPENSSL_NO_VENDOR = 1;
 
-  cargoSha256 = "sha256-W3VaxG9taRv62RW6hQkfdGJo72uHK2X6JIESJEu3PXg=";
+  cargoSha256 = "sha256-NAXoKz+tZmjmZ/PkDaXEp9D++iu/3Knp0Yy6NJWEoDM=";
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ openssl protobuf ];
diff --git a/pkgs/development/tools/database/sqlfluff/default.nix b/pkgs/development/tools/database/sqlfluff/default.nix
index 62bef68b50649..40c4e459a2ee2 100644
--- a/pkgs/development/tools/database/sqlfluff/default.nix
+++ b/pkgs/development/tools/database/sqlfluff/default.nix
@@ -5,14 +5,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "sqlfluff";
-  version = "0.6.6";
+  version = "0.6.8";
   disabled = python3.pythonOlder "3.6";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = version;
-    sha256 = "sha256-I7vsOQtXY/n2Zu0F94f5/uF1ia96R/qQw+duG7X8Dpo=";
+    sha256 = "sha256-Aistr85doKEOD0/uTS/7iRzYggb+hC3njVi4mWt8ndM=";
   };
 
   propagatedBuildInputs = with python3.pkgs; [
diff --git a/pkgs/development/tools/go-containerregistry/default.nix b/pkgs/development/tools/go-containerregistry/default.nix
index 0fcbda6966196..afd91a03f8a1e 100644
--- a/pkgs/development/tools/go-containerregistry/default.nix
+++ b/pkgs/development/tools/go-containerregistry/default.nix
@@ -1,23 +1,36 @@
 { lib, buildGoModule, fetchFromGitHub }:
 
+let bins = [ "crane" "gcrane" ]; in
+
 buildGoModule rec {
   pname = "go-containerregistry";
-  version = "0.4.1";
+  version = "0.6.0";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-3mvGHAPKDUmrQkBKwlxnF6PG0ZpZDqlM9SMkCyC5ytE=";
+    sha256 = "0sk3g1i4w8sh40y1ffa61ap7jsscdvnhvh09k8nznydi465csbmq";
   };
   vendorSha256 = null;
 
   subPackages = [ "cmd/crane" "cmd/gcrane" ];
 
+  outputs = [ "out" ] ++ bins;
+
   ldflags =
     let t = "github.com/google/go-containerregistry"; in
     [ "-s" "-w" "-X ${t}/cmd/crane/cmd.Version=v${version}" "-X ${t}/pkg/v1/remote/transport.Version=${version}" ];
 
+  postInstall =
+    lib.concatStringsSep "\n" (
+      map (bin: ''
+        mkdir -p ''$${bin}/bin &&
+        mv $out/bin/${bin} ''$${bin}/bin/ &&
+        ln -s ''$${bin}/bin/${bin} $out/bin/
+      '') bins
+    );
+
   # NOTE: no tests
   doCheck = false;
 
@@ -25,6 +38,6 @@ buildGoModule rec {
     description = "Tools for interacting with remote images and registries including crane and gcrane";
     homepage = "https://github.com/google/go-containerregistry";
     license = licenses.apsl20;
-    maintainers = with maintainers; [ yurrriq ];
+    maintainers = with maintainers; [ superherointj yurrriq ];
   };
 }
diff --git a/pkgs/development/tools/regclient/default.nix b/pkgs/development/tools/regclient/default.nix
new file mode 100644
index 0000000000000..8df0a3abfdf3b
--- /dev/null
+++ b/pkgs/development/tools/regclient/default.nix
@@ -0,0 +1,41 @@
+{ lib, buildGoModule, fetchFromGitHub }:
+
+let bins = [ "regbot" "regctl" "regsync" ]; in
+
+buildGoModule rec {
+  pname = "regclient";
+  version = "0.3.8";
+  tag = "v${version}";
+
+  src = fetchFromGitHub {
+    owner = "regclient";
+    repo = "regclient";
+    rev = tag;
+    sha256 = "14w0g24sgphgib33sdvrvwk86p7km2pasb5fmr3p48i7sc71ja3h";
+  };
+  vendorSha256 = "sha256-9sRjP7lxMRdt9D9ElIX+mbYIvCaknWMgDyYl+1/q0/g=";
+
+  outputs = [ "out" ] ++ bins;
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X main.VCSTag=${tag}"
+  ];
+
+  postInstall =
+    lib.concatStringsSep "\n" (
+      map (bin: ''
+        mkdir -p ''$${bin}/bin &&
+        mv $out/bin/${bin} ''$${bin}/bin/ &&
+        ln -s ''$${bin}/bin/${bin} $out/bin/
+      '') bins
+    );
+
+  meta = with lib; {
+    description = "Docker and OCI Registry Client in Go and tooling using those libraries";
+    homepage = "https://github.com/regclient/regclient";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ superherointj ];
+  };
+}
diff --git a/pkgs/games/starsector/default.nix b/pkgs/games/starsector/default.nix
new file mode 100644
index 0000000000000..a4819a4fdadf6
--- /dev/null
+++ b/pkgs/games/starsector/default.nix
@@ -0,0 +1,57 @@
+{ lib
+, alsa-lib
+, fetchzip
+, libXxf86vm
+, makeWrapper
+, openjdk
+, stdenv
+, xorg
+}:
+
+stdenv.mkDerivation rec {
+  pname = "starsector";
+  version = "0.95a-RC15";
+
+  src = fetchzip {
+    url = "https://s3.amazonaws.com/fractalsoftworks/starsector/starsector_linux-${version}.zip";
+    sha256 = "sha256-/5ij/079aOad7otXSFFcmVmiYQnMX/0RXGOr1j0rkGY=";
+  };
+
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = with xorg; [
+    alsa-lib
+    libXxf86vm
+  ];
+
+  dontBuild = true;
+
+  # need to cd into $out in order for classpath to pick up correct jar files
+  installPhase = ''
+    mkdir -p $out/bin
+    rm -r jre_linux # remove jre7
+    rm starfarer.api.zip
+    cp -r ./* $out
+
+    wrapProgram $out/starsector.sh \
+      --prefix PATH : ${lib.makeBinPath [ openjdk ]} \
+      --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath buildInputs} \
+      --run "mkdir -p \$XDG_DATA_HOME/starsector; cd $out"
+    ln -s $out/starsector.sh $out/bin/starsector
+  '';
+
+  # it tries to run everything with relative paths, which makes it CWD dependent
+  # also point mod, screenshot, and save directory to $XDG_DATA_HOME
+  postPatch = ''
+    substituteInPlace starsector.sh \
+      --replace "./jre_linux/bin/java" "${openjdk}/bin/java" \
+      --replace "./native/linux" "$out/native/linux" \
+      --replace "./" "\$XDG_DATA_HOME/starsector/"
+  '';
+
+  meta = with lib; {
+    description = "Open-world single-player space-combat, roleplaying, exploration, and economic game";
+    homepage = "https://fractalsoftworks.com";
+    license = licenses.unfree;
+    maintainers = with maintainers; [ bbigras ];
+  };
+}
diff --git a/pkgs/misc/emulators/duckstation/default.nix b/pkgs/misc/emulators/duckstation/default.nix
index 29b867f0e9e3b..e4cf7d89b3b8c 100644
--- a/pkgs/misc/emulators/duckstation/default.nix
+++ b/pkgs/misc/emulators/duckstation/default.nix
@@ -1,33 +1,88 @@
-{ lib, mkDerivation, fetchFromGitHub, cmake, pkg-config, SDL2, qtbase
-, wrapQtAppsHook, qttools, ninja, gtk3 }:
+{ lib
+, mkDerivation
+, fetchFromGitHub
+, cmake
+, extra-cmake-modules
+, pkg-config
+, SDL2
+, qtbase
+, wrapQtAppsHook
+, qttools
+, ninja
+, gtk3
+, libevdev
+, curl
+, libpulseaudio
+, sndio
+, mesa
+}:
 mkDerivation rec {
   pname = "duckstation";
-  version = "unstable-2020-12-29";
+  version = "unstable-2021-10-01";
 
   src = fetchFromGitHub {
     owner = "stenzek";
     repo = pname;
-    rev = "f8dcfabc44ff8391b2d41eab2e883dc8f21a88b7";
-    sha256 = "0v6w4di4yj1hbxpqqrcw8rbfjg18g9kla8mnb3b5zgv7i4dyzykw";
+    rev = "a7096f033ecca48827fa55825fc0d0221265f1c2";
+    sha256 = "sha256-e/Y1TJBuY76q3/0MCAqu9AJzLxIoJ8FJUV5vc/AgcjA=";
   };
 
-  nativeBuildInputs = [ cmake wrapQtAppsHook qttools ];
+  nativeBuildInputs = [ cmake ninja pkg-config extra-cmake-modules wrapQtAppsHook qttools ];
 
-  buildInputs = [ SDL2 qtbase gtk3 pkg-config ];
+  buildInputs = [
+    SDL2
+    qtbase
+    gtk3
+    libevdev
+    sndio
+    mesa
+    curl
+    libpulseaudio
+  ];
+
+  cmakeFlags = [
+    "-DUSE_DRMKMS=ON"
+    "-DUSE_EGL=ON"
+  ];
+
+  postPatch = ''
+    substituteInPlace extras/linux-desktop-files/duckstation-qt.desktop \
+      --replace "duckstation-qt" "duckstation" \
+      --replace "TryExec=duckstation" "tryExec=duckstation-qt" \
+      --replace "Exec=duckstation" "Exec=duckstation-qt"
+    substituteInPlace extras/linux-desktop-files/duckstation-nogui.desktop \
+      --replace "duckstation-nogui" "duckstation" \
+      --replace "TryExec=duckstation" "tryExec=duckstation-nogui" \
+      --replace "Exec=duckstation" "Exec=duckstation-nogui"
+  '';
 
   installPhase = ''
-    mkdir -p $out/
-    mv bin $out/
+    runHook preInstall
+    mkdir -p $out/bin $out/share $out/share/pixmaps $out/share/applications
+    rm bin/common-tests
+
+    cp -r bin $out/share/duckstation
+    ln -s $out/share/duckstation/duckstation-{qt,nogui} $out/bin/
+
+    cp ../extras/icons/icon-256px.png $out/share/pixmaps/duckstation.png
+    cp ../extras/linux-desktop-files/* $out/share/applications/
+    runHook postInstall
+  '';
+
+  doCheck = true;
+  checkPhase = ''
+    runHook preCheck
+    ./bin/common-tests
+    runHook postCheck
   '';
 
   # TODO:
   # - vulkan graphics backend (OpenGL works).
   # - default sound backend (cubeb) does not work, but SDL does.
   meta = with lib; {
-    description =
-      "PlayStation 1 emulator focusing on playability, speed and long-term maintainability";
+    description = "PlayStation 1 emulator focusing on playability, speed and long-term maintainability";
     homepage = "https://github.com/stenzek/duckstation";
-    license = licenses.gpl3;
+    license = licenses.gpl3Only;
     platforms = platforms.linux;
     maintainers = [ maintainers.guibou ];
   };
diff --git a/pkgs/misc/uboot/0001-rpi-Copy-properties-from-firmware-dtb-to-the-loaded-.patch b/pkgs/misc/uboot/0001-rpi-Copy-properties-from-firmware-dtb-to-the-loaded-.patch
new file mode 100644
index 0000000000000..8c4c3eff54928
--- /dev/null
+++ b/pkgs/misc/uboot/0001-rpi-Copy-properties-from-firmware-dtb-to-the-loaded-.patch
@@ -0,0 +1,92 @@
+From 65d90cd17ad7cd3f9aeeb805a08be780fc5bae1a Mon Sep 17 00:00:00 2001
+From: Sjoerd Simons <sjoerd@collabora.com>
+Date: Sun, 22 Aug 2021 16:36:55 +0200
+Subject: [PATCH] rpi: Copy properties from firmware dtb to the loaded dtb
+
+The RPI firmware adjusts several property values in the dtb it passes
+to u-boot depending on the board/SoC revision. Inherit some of these
+when u-boot loads a dtb itself. Specificaly copy:
+
+* /model: The firmware provides a more specific string
+* /memreserve: The firmware defines a reserved range, better keep it
+* emmc2bus and pcie0 dma-ranges: The C0T revision of the bcm2711 Soc (as
+  present on rpi 400 and some rpi 4B boards) has different values for
+  these then the B0T revision. So these need to be adjusted to boot on
+  these boards
+* blconfig: The firmware defines the memory area where the blconfig
+  stored. Copy those over so it can be enabled.
+* /chosen/kaslr-seed: The firmware generates a kaslr seed, take advantage
+  of that.
+
+Signed-off-by: Sjoerd Simons <sjoerd@collabora.com>
+Origin: https://patchwork.ozlabs.org/project/uboot/patch/20210822143656.289891-1-sjoerd@collabora.com/
+---
+ board/raspberrypi/rpi/rpi.c | 48 +++++++++++++++++++++++++++++++++++++
+ 1 file changed, 48 insertions(+)
+
+diff --git a/board/raspberrypi/rpi/rpi.c b/board/raspberrypi/rpi/rpi.c
+index 372b26b6f2..64b8684b68 100644
+--- a/board/raspberrypi/rpi/rpi.c
++++ b/board/raspberrypi/rpi/rpi.c
+@@ -495,10 +495,58 @@ void *board_fdt_blob_setup(void)
+ 	return (void *)fw_dtb_pointer;
+ }
+ 
++int copy_property(void *dst, void *src, char *path, char *property)
++{
++	int dst_offset, src_offset;
++	const fdt32_t *prop;
++	int len;
++
++	src_offset = fdt_path_offset(src, path);
++	dst_offset = fdt_path_offset(dst, path);
++
++	if (src_offset < 0 || dst_offset < 0)
++		return -1;
++
++	prop = fdt_getprop(src, src_offset, property, &len);
++	if (!prop)
++		return -1;
++
++	return fdt_setprop(dst, dst_offset, property, prop, len);
++}
++
++/* Copy tweaks from the firmware dtb to the loaded dtb */
++void  update_fdt_from_fw(void *fdt, void *fw_fdt)
++{
++	/* Using dtb from firmware directly; leave it alone */
++	if (fdt == fw_fdt)
++		return;
++
++	/* The firmware provides a more precie model; so copy that */
++	copy_property(fdt, fw_fdt, "/", "model");
++
++	/* memory reserve as suggested by the firmware */
++	copy_property(fdt, fw_fdt, "/", "memreserve");
++
++	/* Adjust dma-ranges for the SD card and PCI bus as they can depend on
++	 * the SoC revision
++	 */
++	copy_property(fdt, fw_fdt, "emmc2bus", "dma-ranges");
++	copy_property(fdt, fw_fdt, "pcie0", "dma-ranges");
++
++	/* Bootloader configuration template exposes as nvmem */
++	if (copy_property(fdt, fw_fdt, "blconfig", "reg") == 0)
++		copy_property(fdt, fw_fdt, "blconfig", "status");
++
++	/* kernel address randomisation seed as provided by the firmware */
++	copy_property(fdt, fw_fdt, "/chosen", "kaslr-seed");
++}
++
+ int ft_board_setup(void *blob, struct bd_info *bd)
+ {
+ 	int node;
+ 
++	update_fdt_from_fw(blob, (void *)fw_dtb_pointer);
++
+ 	node = fdt_node_offset_by_compatible(blob, -1, "simple-framebuffer");
+ 	if (node < 0)
+ 		lcd_dt_simplefb_add_node(blob);
+-- 
+2.32.0
+
diff --git a/pkgs/misc/uboot/default.nix b/pkgs/misc/uboot/default.nix
index 98f037b4fb929..ee3d49792185c 100644
--- a/pkgs/misc/uboot/default.nix
+++ b/pkgs/misc/uboot/default.nix
@@ -19,10 +19,10 @@
 }:
 
 let
-  defaultVersion = "2021.04";
+  defaultVersion = "2021.10";
   defaultSrc = fetchurl {
     url = "ftp://ftp.denx.de/pub/u-boot/u-boot-${defaultVersion}.tar.bz2";
-    sha256 = "06p1vymf0dl6jc2xy5w7p42mpgppa46lmpm2ishmgsycnldqnhqd";
+    sha256 = "1m0bvwv8r62s4wk4w3cmvs888dhv9gnfa98dczr4drk2jbhj7ryd";
   };
   buildUBoot = {
     version ? null
@@ -43,6 +43,11 @@ let
 
     patches = [
       ./0001-configs-rpi-allow-for-bigger-kernels.patch
+
+      # Make U-Boot forward some important settings from the firmware-provided FDT. Fixes booting on BCM2711C0 boards.
+      # See also: https://github.com/NixOS/nixpkgs/issues/135828
+      # Source: https://patchwork.ozlabs.org/project/uboot/patch/20210822143656.289891-1-sjoerd@collabora.com/
+      ./0001-rpi-Copy-properties-from-firmware-dtb-to-the-loaded-.patch
     ] ++ extraPatches;
 
     postPatch = ''
@@ -109,7 +114,6 @@ let
       maintainers = with maintainers; [ dezgeg samueldr lopsided98 ];
     } // extraMeta;
   } // removeAttrs args [ "extraMeta" ]);
-
 in {
   inherit buildUBoot;
 
@@ -336,6 +340,12 @@ in {
     filesToInstall = ["u-boot.bin"];
   };
 
+  ubootQemuRiscv64Smode = buildUBoot {
+    defconfig = "qemu-riscv64_smode_defconfig";
+    extraMeta.platforms = ["riscv64-linux"];
+    filesToInstall = ["u-boot.bin"];
+  };
+
   ubootRaspberryPi = buildUBoot {
     defconfig = "rpi_defconfig";
     extraMeta.platforms = ["armv6l-linux"];
diff --git a/pkgs/os-specific/linux/bpfmon/default.nix b/pkgs/os-specific/linux/bpfmon/default.nix
new file mode 100644
index 0000000000000..32781d3654917
--- /dev/null
+++ b/pkgs/os-specific/linux/bpfmon/default.nix
@@ -0,0 +1,24 @@
+{ stdenv, fetchFromGitHub, lib, libpcap, yascreen }:
+
+stdenv.mkDerivation rec {
+  pname = "bpfmon";
+  version = "2.50";
+
+  src = fetchFromGitHub {
+    owner = "bbonev";
+    repo = "bpfmon";
+    rev = "v${version}";
+    sha256 = "sha256-x4EuGZBtg45bD9q1B/6KwjDRXXeRsdFmRllREsech+E=";
+  };
+
+  buildInputs = [ libpcap yascreen ];
+  makeFlags = [ "PREFIX=$(out)" ];
+
+  meta = with lib; {
+    description = "BPF based visual packet rate monitor";
+    homepage = "https://github.com/bbonev/bpfmon";
+    maintainers = with maintainers; [ arezvov ];
+    license = licenses.gpl2Plus;
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/os-specific/linux/kernel/linux-lqx.nix b/pkgs/os-specific/linux/kernel/linux-lqx.nix
index e4c9f03539f69..e5a9032d3bdae 100644
--- a/pkgs/os-specific/linux/kernel/linux-lqx.nix
+++ b/pkgs/os-specific/linux/kernel/linux-lqx.nix
@@ -1,7 +1,7 @@
 { lib, fetchFromGitHub, buildLinux, linux_zen, ... } @ args:
 
 let
-  version = "5.14.6";
+  version = "5.14.9";
   suffix = "lqx4";
 in
 
@@ -14,7 +14,7 @@ buildLinux (args // {
     owner = "zen-kernel";
     repo = "zen-kernel";
     rev = "v${version}-${suffix}";
-    sha256 = "sha256-arje/B/oXW/2QUHKi1vJ2n20zNbri1bcMU58mE0evOM=";
+    sha256 = "sha256-nT8lc/JeuXsKVHGPQxK+w8BTasxyIfxCdKbAvoFgbYg=";
   };
 
   extraMeta = {
diff --git a/pkgs/servers/sql/postgresql/ext/pgroonga.nix b/pkgs/servers/sql/postgresql/ext/pgroonga.nix
index 02a5f4fe1353b..86c9e54526f78 100644
--- a/pkgs/servers/sql/postgresql/ext/pgroonga.nix
+++ b/pkgs/servers/sql/postgresql/ext/pgroonga.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "pgroonga";
-  version = "2.3.1";
+  version = "2.3.2";
 
   src = fetchurl {
     url = "https://packages.groonga.org/source/${pname}/${pname}-${version}.tar.gz";
-    sha256 = "0v102hbszq52jvydj2qrysfs1g46wv4vmgwaa9zj0pvknh58lb43";
+    sha256 = "10rj35xxcfg10nvq3zqxm25hfb3hw58z4dda1b4hh8ibyz2489vy";
   };
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/servers/sql/postgresql/ext/pgvector.nix b/pkgs/servers/sql/postgresql/ext/pgvector.nix
index 2c67b65d7609a..c1bd999ebf558 100644
--- a/pkgs/servers/sql/postgresql/ext/pgvector.nix
+++ b/pkgs/servers/sql/postgresql/ext/pgvector.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "pgvector";
-  version = "0.1.8";
+  version = "0.2.0";
 
   src = fetchFromGitHub {
     owner = "ankane";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0kq28k96y5r0k6nhz78c3frqzhf8d1af54dqbpayn7fgvdl0vlm2";
+    sha256 = "1jl6rpys24qxhkv3q798pp9v03z2z7gswivp19yria9xr3bg6wjv";
   };
 
   buildInputs = [ postgresql ];
diff --git a/pkgs/tools/admin/lego/default.nix b/pkgs/tools/admin/lego/default.nix
index 685679467549f..83d16c3eb7720 100644
--- a/pkgs/tools/admin/lego/default.nix
+++ b/pkgs/tools/admin/lego/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "lego";
-  version = "4.4.0";
+  version = "4.5.2";
 
   src = fetchFromGitHub {
     owner = "go-acme";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-+5uy6zVfC+utXfwBCEo597CRo4di73ff0eqHyDUxxII=";
+    sha256 = "sha256-ytU1G0kT8/sx9kR8yrrGqUta+vi96aCovoABit0857g=";
   };
 
-  vendorSha256 = "sha256-JgGDP5H7zKQ8sk36JtM/FCWXl7oTScHNboQ/mE5AisU=";
+  vendorSha256 = "sha256-EK2E2YWdk2X1awdUhMOJh+qr+jnnftnKuPPpiHzXZHk=";
 
   doCheck = false;
 
diff --git a/pkgs/tools/misc/font-config-info/default.nix b/pkgs/tools/misc/font-config-info/default.nix
new file mode 100644
index 0000000000000..89f0d9060386b
--- /dev/null
+++ b/pkgs/tools/misc/font-config-info/default.nix
@@ -0,0 +1,46 @@
+{ stdenv
+, lib
+, fetchFromGitHub
+, pkg-config
+, gtk3
+, xsettingsd
+}:
+
+stdenv.mkDerivation rec {
+  pname = "font-config-info";
+  version = "1.0.0";
+
+  src = fetchFromGitHub {
+    owner = "derat";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "14z7hg9c7q8wliyqv68kp080mmk2rh6kpww6pn87hy7lwq20l2b7";
+  };
+
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
+  buildInputs = [
+    gtk3
+    xsettingsd
+  ];
+
+  postPatch = ''
+    substituteInPlace font-config-info.c --replace "dump_xsettings |" "${xsettingsd}/bin/dump_xsettings |"
+  '';
+
+  installPhase = ''
+    runHook preInstall
+    install -D -t $out/bin font-config-info
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "Prints a Linux system's font configuration";
+    homepage = "https://github.com/derat/font-config-info";
+    license = with licenses; [ bsd3 ];
+    platforms = platforms.unix;
+    maintainers = with maintainers; [ romildo ];
+  };
+}
diff --git a/pkgs/tools/security/spyre/default.nix b/pkgs/tools/security/spyre/default.nix
new file mode 100644
index 0000000000000..112e0afd14555
--- /dev/null
+++ b/pkgs/tools/security/spyre/default.nix
@@ -0,0 +1,35 @@
+{ lib
+, buildGoModule
+, fetchFromGitHub
+, pkg-config
+, yara
+}:
+
+buildGoModule rec {
+  pname = "spyre";
+  version = "1.2.1";
+
+  src = fetchFromGitHub {
+    owner = "spyre-project";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "0iijvwcybp9z70jdh5mkaj7k3cw43r72wg3ayhnpyjmvgrwij43i";
+  };
+
+  vendorSha256 = "1mssfiph4a6jqp2qlrksvzinh0h8qpwdaxa5zx7fsydmqvk93w0g";
+
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
+  buildInputs = [
+    yara
+  ];
+
+  meta = with lib; {
+    description = "YARA-based IOC scanner";
+    homepage = "https://github.com/spyre-project/spyre";
+    license = with licenses; [ lgpl3Plus ];
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/tools/security/usbrip/default.nix b/pkgs/tools/security/usbrip/default.nix
new file mode 100644
index 0000000000000..aa09d759b8e46
--- /dev/null
+++ b/pkgs/tools/security/usbrip/default.nix
@@ -0,0 +1,45 @@
+{ lib
+, fetchFromGitHub
+, python3
+}:
+
+python3.pkgs.buildPythonApplication rec {
+  pname = "usbrip";
+  version = "unstable-2021-07-02";
+
+  disabled = python3.pythonOlder "3.6";
+
+  src = fetchFromGitHub {
+    owner = "snovvcrash";
+    repo = pname;
+    rev = "0f3701607ba13212ebefb4bbd9e68ec0e22d76ac";
+    sha256 = "1vws8ybhv7szpqvlbmv0hrkys2fhhaa5bj9dywv3q2y1xmljl0py";
+  };
+
+  propagatedBuildInputs = with python3.pkgs; [
+    termcolor
+    terminaltables
+    tqdm
+  ];
+
+  postPatch = ''
+    # Remove install helpers which we don't need
+    substituteInPlace setup.py \
+      --replace "parse_requirements('requirements.txt')," "[]," \
+      --replace "resolve('wheel')" "" \
+      --replace "'install': LocalInstallCommand," ""
+  '';
+
+  # Project has no tests
+  doCheck = false;
+
+  pythonImportsCheck = [ "usbrip" ];
+
+  meta = with lib; {
+    description = "Tool to track the history of USB events";
+    homepage = "https://github.com/snovvcrash/usbrip";
+    license = with licenses; [ gpl3Plus ];
+    maintainers = with maintainers; [ fab ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 23156e7b42fd9..6e3da6a2a0b48 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -1621,6 +1621,8 @@ with pkgs;
 
   flood = nodePackages.flood;
 
+  font-config-info = callPackage ../tools/misc/font-config-info { };
+
   fxlinuxprintutil = callPackage ../tools/misc/fxlinuxprintutil { };
 
   genann = callPackage ../development/libraries/genann { };
@@ -2885,6 +2887,7 @@ with pkgs;
   go-chromecast = callPackage ../applications/video/go-chromecast { };
 
   go-containerregistry = callPackage ../development/tools/go-containerregistry { };
+  inherit (go-containerregistry) crane gcrane;
 
   go-rice = callPackage ../tools/misc/go.rice {};
 
@@ -9332,6 +9335,10 @@ with pkgs;
 
   sqls = callPackage ../applications/misc/sqls { };
 
+  starsector = callPackage ../games/starsector {
+    openjdk = openjdk8;
+  };
+
   stdman = callPackage ../data/documentation/stdman { };
 
   steck = callPackage ../servers/pinnwand/steck.nix { };
@@ -14778,6 +14785,9 @@ with pkgs;
 
   redo-sh = callPackage ../development/tools/build-managers/redo-sh { };
 
+  regclient = callPackage ../development/tools/regclient { };
+  inherit (regclient) regbot regctl regsync;
+
   reno = callPackage ../development/tools/reno { };
 
   re2c = callPackage ../development/tools/parsing/re2c { };
@@ -18946,6 +18956,8 @@ with pkgs;
 
   resolv_wrapper = callPackage ../development/libraries/resolv_wrapper { };
 
+  restinio = callPackage ../development/libraries/restinio {};
+
   rhino = callPackage ../development/libraries/java/rhino {
     javac = jdk8;
     jvm = jre8;
@@ -19482,6 +19494,8 @@ with pkgs;
 
   usbredir = callPackage ../development/libraries/usbredir { };
 
+  usbrip = callPackage ../tools/security/usbrip { };
+
   uthash = callPackage ../development/libraries/uthash { };
 
   uthenticode = callPackage ../development/libraries/uthenticode { };
@@ -21326,6 +21340,8 @@ with pkgs;
 
   bolt = callPackage ../os-specific/linux/bolt { };
 
+  bpfmon = callPackage ../os-specific/linux/bpfmon { };
+
   bridge-utils = callPackage ../os-specific/linux/bridge-utils { };
 
   busybox = callPackage ../os-specific/linux/busybox { };
@@ -22272,6 +22288,7 @@ with pkgs;
     ubootPinebookPro
     ubootQemuAarch64
     ubootQemuArm
+    ubootQemuRiscv64Smode
     ubootRaspberryPi
     ubootRaspberryPi2
     ubootRaspberryPi3_32bit
@@ -23912,6 +23929,8 @@ with pkgs;
     buildGoPackage = buildGo115Package;
   };
 
+  cozy-drive = callPackage ../applications/networking/cozy-drive {};
+
   cq-editor = libsForQt5.callPackage ../applications/graphics/cq-editor {
     python3Packages = python37Packages;
   };
@@ -31341,6 +31360,8 @@ with pkgs;
 
   spyder = with python3.pkgs; toPythonApplication spyder;
 
+  spyre = callPackage ../tools/security/spyre { };
+
   openspace = callPackage ../applications/science/astronomy/openspace { };
 
   stellarium = libsForQt5.callPackage ../applications/science/astronomy/stellarium { };
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 95af7eef4d72f..b317230c9a7d1 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -9022,7 +9022,9 @@ in {
 
   thespian = callPackage ../development/python-modules/thespian { };
 
-  thinc = callPackage ../development/python-modules/thinc { };
+  thinc = callPackage ../development/python-modules/thinc {
+    inherit (pkgs.darwin.apple_sdk.frameworks) Accelerate CoreFoundation CoreGraphics CoreVideo;
+  };
 
   threadpool = callPackage ../development/python-modules/threadpool { };