Merge remote-tracking branch 'origin/master' into haskell-updates

153 files changed, 1407 insertions, 453 deletions

diff --git a/doc/builders/packages/etc-files.section.md b/doc/builders/packages/etc-files.section.md
new file mode 100644
index 0000000000000..2405a54634d89
--- /dev/null
+++ b/doc/builders/packages/etc-files.section.md
@@ -0,0 +1,18 @@
+# /etc files {#etc}
+
+Certain calls in glibc require access to runtime files found in /etc such as `/etc/protocols` or `/etc/services` -- [getprotobyname](https://linux.die.net/man/3/getprotobyname) is one such function.
+
+On non-NixOS distributions these files are typically provided by packages (i.e. [netbase](https://packages.debian.org/sid/netbase)) if not already pre-installed in your distribution. This can cause non-reproducibility for code if they rely on these files being present.
+
+If [iana-etc](https://hydra.nixos.org/job/nixos/trunk-combined/nixpkgs.iana-etc.x86_64-linux) is part of your _buildInputs_ then it will set the environment varaibles `NIX_ETC_PROTOCOLS` and `NIX_ETC_SERVICES` to the corresponding files in the package through a _setup-hook_.
+
+
+```bash
+> nix-shell -p iana-etc
+
+[nix-shell:~]$ env | grep NIX_ETC
+NIX_ETC_SERVICES=/nix/store/aj866hr8fad8flnggwdhrldm0g799ccz-iana-etc-20210225/etc/services
+NIX_ETC_PROTOCOLS=/nix/store/aj866hr8fad8flnggwdhrldm0g799ccz-iana-etc-20210225/etc/protocols
+```
+
+Nixpkg's version of [glibc](https://github.com/NixOS/nixpkgs/blob/master/pkgs/development/libraries/glibc/default.nix) has been patched to check for the existence of these environment variables. If the environment variable are *not set*, then it will attempt to find the files at the default location within _/etc_.
diff --git a/doc/builders/packages/index.xml b/doc/builders/packages/index.xml
index f5b05b0bbccfc..206e1e49f1f85 100644
--- a/doc/builders/packages/index.xml
+++ b/doc/builders/packages/index.xml
@@ -17,6 +17,7 @@
  <xi:include href="kakoune.section.xml" />
  <xi:include href="linux.section.xml" />
  <xi:include href="locales.section.xml" />
+ <xi:include href="etc-files.section.xml" />
  <xi:include href="nginx.section.xml" />
  <xi:include href="opengl.section.xml" />
  <xi:include href="shell-helpers.section.xml" />
diff --git a/flake.nix b/flake.nix
index ececd26c153c6..1e20fcd40ebe5 100644
--- a/flake.nix
+++ b/flake.nix
@@ -11,15 +11,7 @@
 
       lib = import ./lib;
 
-      systems = [
-        "x86_64-linux"
-        "i686-linux"
-        "x86_64-darwin"
-        "aarch64-linux"
-        "armv6l-linux"
-        "armv7l-linux"
-        "aarch64-darwin"
-      ];
+      systems = lib.systems.supported.hydra;
 
       forAllSystems = f: lib.genAttrs systems (system: f system);
 
diff --git a/lib/systems/default.nix b/lib/systems/default.nix
index ef609859abbf8..529eeb6514b9e 100644
--- a/lib/systems/default.nix
+++ b/lib/systems/default.nix
@@ -8,6 +8,7 @@ rec {
   platforms = import ./platforms.nix { inherit lib; };
   examples = import ./examples.nix { inherit lib; };
   architectures = import ./architectures.nix { inherit lib; };
+  supported = import ./supported.nix { inherit lib; };
 
   # Elaborate a `localSystem` or `crossSystem` so that it contains everything
   # necessary.
diff --git a/lib/systems/supported.nix b/lib/systems/supported.nix
new file mode 100644
index 0000000000000..60bf307413441
--- /dev/null
+++ b/lib/systems/supported.nix
@@ -0,0 +1,24 @@
+# Supported systems according to RFC0046's definition.
+#
+# https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md
+{ lib }:
+rec {
+  # List of systems that are built by Hydra.
+  hydra = tier1 ++ tier2 ++ tier3;
+
+  tier1 = [
+    "x86_64-linux"
+  ];
+
+  tier2 = [
+    "aarch64-linux"
+    "x86_64-darwin"
+  ];
+
+  tier3 = [
+    "armv6l-linux"
+    "armv7l-linux"
+    "i686-linux"
+    "mipsel-linux"
+  ];
+}
diff --git a/lib/tests/modules.sh b/lib/tests/modules.sh
index 2e57c2f8e2a13..b51db91f6b078 100755
--- a/lib/tests/modules.sh
+++ b/lib/tests/modules.sh
@@ -254,8 +254,10 @@ checkConfigOutput / config.value.path ./types-anything/equal-atoms.nix
 checkConfigOutput null config.value.null ./types-anything/equal-atoms.nix
 checkConfigOutput 0.1 config.value.float ./types-anything/equal-atoms.nix
 # Functions can't be merged together
-checkConfigError "The option .* has conflicting definition values" config.value.multiple-lambdas ./types-anything/functions.nix
+checkConfigError "The option .value.multiple-lambdas.<function body>. has conflicting option types" config.applied.multiple-lambdas ./types-anything/functions.nix
 checkConfigOutput '<LAMBDA>' config.value.single-lambda ./types-anything/functions.nix
+checkConfigOutput 'null' config.applied.merging-lambdas.x ./types-anything/functions.nix
+checkConfigOutput 'null' config.applied.merging-lambdas.y ./types-anything/functions.nix
 # Check that all mk* modifiers are applied
 checkConfigError 'attribute .* not found' config.value.mkiffalse ./types-anything/mk-mods.nix
 checkConfigOutput '{ }' config.value.mkiftrue ./types-anything/mk-mods.nix
diff --git a/lib/tests/modules/types-anything/functions.nix b/lib/tests/modules/types-anything/functions.nix
index 0795189139189..21edd4aff9c44 100644
--- a/lib/tests/modules/types-anything/functions.nix
+++ b/lib/tests/modules/types-anything/functions.nix
@@ -1,16 +1,22 @@
-{ lib, ... }: {
+{ lib, config, ... }: {
 
   options.value = lib.mkOption {
     type = lib.types.anything;
   };
 
+  options.applied = lib.mkOption {
+    default = lib.mapAttrs (name: fun: fun null) config.value;
+  };
+
   config = lib.mkMerge [
     {
       value.single-lambda = x: x;
-      value.multiple-lambdas = x: x;
+      value.multiple-lambdas = x: { inherit x; };
+      value.merging-lambdas = x: { inherit x; };
     }
     {
-      value.multiple-lambdas = x: x;
+      value.multiple-lambdas = x: [ x ];
+      value.merging-lambdas = y: { inherit y; };
     }
   ];
 
diff --git a/lib/types.nix b/lib/types.nix
index a0be2ff3a452a..c2532065d7eac 100644
--- a/lib/types.nix
+++ b/lib/types.nix
@@ -192,6 +192,12 @@ rec {
               else (listOf anything).merge;
             # This is the type of packages, only accept a single definition
             stringCoercibleSet = mergeOneOption;
+            lambda = loc: defs: arg: anything.merge
+              (loc ++ [ "<function body>" ])
+              (map (def: {
+                file = def.file;
+                value = def.value arg;
+              }) defs);
             # Otherwise fall back to only allowing all equal definitions
           }.${commonType} or mergeEqualOption;
         in mergeFunction loc defs;
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index d24f98efb7d3c..60bf5afc69b19 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -154,6 +154,7 @@
   ./programs/gnupg.nix
   ./programs/gphoto2.nix
   ./programs/hamster.nix
+  ./programs/htop.nix
   ./programs/iftop.nix
   ./programs/iotop.nix
   ./programs/java.nix
diff --git a/nixos/modules/programs/command-not-found/command-not-found.pl b/nixos/modules/programs/command-not-found/command-not-found.pl
index 6e275bcc8be6c..220d057b7f4f4 100644
--- a/nixos/modules/programs/command-not-found/command-not-found.pl
+++ b/nixos/modules/programs/command-not-found/command-not-found.pl
@@ -25,14 +25,7 @@ if (!defined $res || scalar @$res == 0) {
     print STDERR "$program: command not found\n";
 } elsif (scalar @$res == 1) {
     my $package = @$res[0]->{package};
-    if ($ENV{"NIX_AUTO_INSTALL"} // "") {
-        print STDERR <<EOF;
-The program '$program' is currently not installed. It is provided by
-the package '$package', which I will now install for you.
-EOF
-        ;
-        exit 126 if system("nix-env", "-iA", "nixos.$package") == 0;
-    } elsif ($ENV{"NIX_AUTO_RUN"} // "") {
+    if ($ENV{"NIX_AUTO_RUN"} // "") {
         exec("nix-shell", "-p", $package, "--run", shell_quote("exec", @ARGV));
     } else {
         print STDERR <<EOF;
diff --git a/nixos/modules/programs/environment.nix b/nixos/modules/programs/environment.nix
index 39010323f61e8..d552c751afd73 100644
--- a/nixos/modules/programs/environment.nix
+++ b/nixos/modules/programs/environment.nix
@@ -18,12 +18,16 @@ in
 
     environment.variables =
       { NIXPKGS_CONFIG = "/etc/nix/nixpkgs-config.nix";
+        # note: many programs exec() this directly, so default options for less must not
+        # be specified here; do so in the default value of programs.less.envVariables instead
         PAGER = mkDefault "less";
-        LESS = mkDefault "-R";
         EDITOR = mkDefault "nano";
         XDG_CONFIG_DIRS = [ "/etc/xdg" ]; # needs to be before profile-relative paths to allow changes through environment.etc
       };
 
+    # since we set PAGER to this above, make sure it's installed
+    programs.less.enable = true;
+
     environment.profiles = mkAfter
       [ "/nix/var/nix/profiles/default"
         "/run/current-system/sw"
diff --git a/nixos/modules/programs/htop.nix b/nixos/modules/programs/htop.nix
new file mode 100644
index 0000000000000..5c197838e47c9
--- /dev/null
+++ b/nixos/modules/programs/htop.nix
@@ -0,0 +1,58 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+
+  cfg = config.programs.htop;
+
+  fmt = value:
+    if isList value then concatStringsSep " " (map fmt value) else
+    if isString value then value else
+    if isBool value || isInt value then toString value else
+    throw "Unrecognized type ${typeOf value} in htop settings";
+
+in
+
+{
+
+  options.programs.htop = {
+    package = mkOption {
+      type = types.package;
+      default = pkgs.htop;
+      defaultText = "pkgs.htop";
+      description = ''
+        The htop package that should be used.
+      '';
+    };
+
+    enable = mkEnableOption "htop process monitor";
+
+    settings = mkOption {
+      type = with types; attrsOf (oneOf [ str int bool (listOf (oneOf [ str int bool ])) ]);
+      default = {};
+      example = {
+        hide_kernel_threads = true;
+        hide_userland_threads = true;
+      };
+      description = ''
+        Extra global default configuration for htop
+        which is read on first startup only.
+        Htop subsequently uses ~/.config/htop/htoprc
+        as configuration source.
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable {
+    environment.systemPackages = [
+      cfg.package
+    ];
+
+    environment.etc."htoprc".text = ''
+      # Global htop configuration
+      # To change set: programs.htop.settings.KEY = VALUE;
+    '' + concatStringsSep "\n" (mapAttrsToList (key: value: "${key}=${fmt value}") cfg.settings);
+  };
+
+}
diff --git a/nixos/modules/programs/less.nix b/nixos/modules/programs/less.nix
index c0188788ec74f..794146b19faf5 100644
--- a/nixos/modules/programs/less.nix
+++ b/nixos/modules/programs/less.nix
@@ -24,9 +24,7 @@ let
     }
   '';
 
-  lessKey = pkgs.runCommand "lesskey"
-            { src = pkgs.writeText "lessconfig" configText; preferLocalBuild = true; }
-            "${pkgs.less}/bin/lesskey -o $out $src";
+  lessKey = pkgs.writeText "lessconfig" configText;
 
 in
 
@@ -35,6 +33,8 @@ in
 
     programs.less = {
 
+      # note that environment.nix sets PAGER=less, and
+      # therefore also enables this module
       enable = mkEnableOption "less";
 
       configFile = mkOption {
@@ -81,7 +81,9 @@ in
 
       envVariables = mkOption {
         type = types.attrsOf types.str;
-        default = {};
+        default = {
+          LESS = "-R";
+        };
         example = {
           LESS = "--quit-if-one-screen";
         };
@@ -112,7 +114,7 @@ in
     environment.systemPackages = [ pkgs.less ];
 
     environment.variables = {
-      LESSKEY_SYSTEM = toString lessKey;
+      LESSKEYIN_SYSTEM = toString lessKey;
     } // optionalAttrs (cfg.lessopen != null) {
       LESSOPEN = cfg.lessopen;
     } // optionalAttrs (cfg.lessclose != null) {
diff --git a/nixos/modules/services/misc/gitea.nix b/nixos/modules/services/misc/gitea.nix
index afddc18aa04f9..c0f7661c5698b 100644
--- a/nixos/modules/services/misc/gitea.nix
+++ b/nixos/modules/services/misc/gitea.nix
@@ -349,7 +349,7 @@ in
       server = mkMerge [
         {
           DOMAIN = cfg.domain;
-          STATIC_ROOT_PATH = cfg.staticRootPath;
+          STATIC_ROOT_PATH = toString cfg.staticRootPath;
           LFS_JWT_SECRET = "#lfsjwtsecret#";
           ROOT_URL = cfg.rootUrl;
         }
diff --git a/nixos/modules/system/boot/networkd.nix b/nixos/modules/system/boot/networkd.nix
index a50abc7351176..51e105bf62761 100644
--- a/nixos/modules/system/boot/networkd.nix
+++ b/nixos/modules/system/boot/networkd.nix
@@ -668,6 +668,9 @@ let
           "SendOption"
           "UserClass"
           "VendorClass"
+          "DUIDType"
+          "DUIDRawData"
+          "IAID"
         ])
         (assertValueOneOf "UseAddress" boolValues)
         (assertValueOneOf "UseDNS" boolValues)
@@ -677,6 +680,7 @@ let
         (assertValueOneOf "ForceDHCPv6PDOtherInformation" boolValues)
         (assertValueOneOf "WithoutRA" ["solicit" "information-request"])
         (assertRange "SendOption" 1 65536)
+        (assertInt "IAID")
       ];
 
       sectionDHCPv6PrefixDelegation = checkUnitConfig "DHCPv6PrefixDelegation" [
diff --git a/pkgs/applications/blockchains/particl-core/default.nix b/pkgs/applications/blockchains/particl-core/default.nix
index db2a72f3e5529..d5838a4f4f281 100644
--- a/pkgs/applications/blockchains/particl-core/default.nix
+++ b/pkgs/applications/blockchains/particl-core/default.nix
@@ -17,11 +17,11 @@ with lib;
 
 stdenv.mkDerivation rec {
   pname = "particl-core";
-  version = "0.19.2.13";
+  version = "0.19.2.14";
 
   src = fetchurl {
     url = "https://github.com/particl/particl-core/archive/v${version}.tar.gz";
-    sha256 = "sha256-eXlTfSjxOGZi/0/b7myqILJZYNcbK+QqQmq+PVkh1e8=";
+    sha256 = "sha256-UMU3384r4RGVl0/7OPwdDva09vhQr+9Lqb1oD/PTva8=";
   };
 
   nativeBuildInputs = [ pkg-config autoreconfHook ];
diff --git a/pkgs/applications/editors/android-studio/default.nix b/pkgs/applications/editors/android-studio/default.nix
index 85cd9dd90598d..5a3cd7b13f656 100644
--- a/pkgs/applications/editors/android-studio/default.nix
+++ b/pkgs/applications/editors/android-studio/default.nix
@@ -17,8 +17,8 @@ let
     sha256Hash = "04k7c328bl8ixi8bvp2mm33q2hmv40yc9p5dff5cghyycarwpd3f";
   };
   latestVersion = { # canary & dev
-    version = "2021.1.1.12"; # "Android Studio Bumblebee (2021.1.1) Canary 12"
-    sha256Hash = "1dyn9435s0xbxwj28b0cciz6ry58pgfgba4rbny3jszxi5j3j0r1";
+    version = "2021.1.1.13"; # "Android Studio Bumblebee (2021.1.1) Canary 13"
+    sha256Hash = "04w5jw79fkxk4gy1n9iy8kjxg6k3zcl59z76f04rh556n12f01gm";
   };
 in {
   # Attributes are named by their corresponding release channels
diff --git a/pkgs/applications/graphics/ImageMagick/7.0.nix b/pkgs/applications/graphics/ImageMagick/7.0.nix
index a8af2dfba6553..bc887d9cf80db 100644
--- a/pkgs/applications/graphics/ImageMagick/7.0.nix
+++ b/pkgs/applications/graphics/ImageMagick/7.0.nix
@@ -1,6 +1,6 @@
 { lib, stdenv, fetchFromGitHub, pkg-config, libtool
 , bzip2, zlib, libX11, libXext, libXt, fontconfig, freetype, ghostscript, libjpeg, djvulibre
-, lcms2, openexr, libpng, liblqr1, librsvg, libtiff, libxml2, openjpeg, libwebp, libheif
+, lcms2, openexr, libjxl, libpng, liblqr1, librsvg, libtiff, libxml2, openjpeg, libwebp, libheif
 , ApplicationServices
 , Foundation
 , testVersion, imagemagick
@@ -18,13 +18,13 @@ in
 
 stdenv.mkDerivation rec {
   pname = "imagemagick";
-  version = "7.1.0-6";
+  version = "7.1.0-8";
 
   src = fetchFromGitHub {
     owner = "ImageMagick";
     repo = "ImageMagick";
     rev = version;
-    sha256 = "sha256-rwaMAkbSBTdrJ+OVZfAOBIp1tmC7/TC34w5gBIe+J94=";
+    sha256 = "17kgq0ja3bvc6b9lq3p29pk5j3w9f66nq6d8aidnq5qs6jwm1h5c";
   };
 
   outputs = [ "out" "dev" "doc" ]; # bin/ isn't really big
@@ -37,6 +37,9 @@ stdenv.mkDerivation rec {
     ++ (if arch != null then [ "--with-gcc-arch=${arch}" ] else [ "--without-gcc-arch" ])
     ++ lib.optional (librsvg != null) "--with-rsvg"
     ++ lib.optional (liblqr1 != null) "--with-lqr"
+    # libjxl is broken on aarch64 (see meta.broken in libjxl) for now,
+    # let's disable it for now to unbreak the imagemagick build.
+    ++ lib.optional (libjxl != null && !stdenv.isAarch64) "--with-jxl"
     ++ lib.optionals (ghostscript != null)
       [ "--with-gs-font-dir=${ghostscript}/share/ghostscript/fonts"
         "--with-gslib"
@@ -51,6 +54,10 @@ stdenv.mkDerivation rec {
     [ zlib fontconfig freetype ghostscript
       liblqr1 libpng libtiff libxml2 libheif djvulibre
     ]
+    # libjxl is broken on aarch64 (see meta.broken in libjxl) for now,
+    # let's disable it for now to unbreak the imagemagick build.
+    ++ lib.optionals (!stdenv.isAarch64)
+      [ libjxl ]
     ++ lib.optionals (!stdenv.hostPlatform.isMinGW)
       [ openexr librsvg openjpeg ]
     ++ lib.optionals stdenv.isDarwin [
diff --git a/pkgs/applications/misc/clight/default.nix b/pkgs/applications/misc/clight/default.nix
index 0bed99ab725f9..b5278e7cc75ce 100644
--- a/pkgs/applications/misc/clight/default.nix
+++ b/pkgs/applications/misc/clight/default.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "clight";
-  version = "4.6";
+  version = "4.7";
 
   src = fetchFromGitHub {
     owner = "FedeDP";
     repo = "Clight";
     rev = version;
-    sha256 = "sha256-5kFzVHxoiZi8tz42eUprm49JHCeuA4GPwtHvdiS2RJY=";
+    sha256 = "sha256-+u50XorUyeDsn4FaKdD0wEtQHkwtiyVDY0IAi0vehEQ=";
   };
 
   # dbus-1.pc has datadir=/etc
diff --git a/pkgs/applications/misc/orpie/default.nix b/pkgs/applications/misc/orpie/default.nix
index 45e043b6dcfae..a1f119f6834cd 100644
--- a/pkgs/applications/misc/orpie/default.nix
+++ b/pkgs/applications/misc/orpie/default.nix
@@ -13,12 +13,10 @@ ocamlPackages.buildDunePackage rec {
     sha256 = "1rx2nl6cdv609pfymnbq53pi3ql5fr4kda8x10ycd9xq2gc4f21g";
   };
 
+  patches = [ ./prefix.patch ];
+
   preConfigure = ''
-    patchShebangs scripts
-    substituteInPlace scripts/compute_prefix \
-      --replace '"topfind"' \
-      '"${ocamlPackages.findlib}/lib/ocaml/${ocamlPackages.ocaml.version}/site-lib/topfind"'
-    export PREFIX=$out
+    substituteInPlace src/orpie/install.ml.in --replace '@prefix@' $out
   '';
 
   buildInputs = with ocamlPackages; [ curses camlp5 num gsl ];
diff --git a/pkgs/applications/misc/orpie/prefix.patch b/pkgs/applications/misc/orpie/prefix.patch
new file mode 100644
index 0000000000000..41e72ca6d6163
--- /dev/null
+++ b/pkgs/applications/misc/orpie/prefix.patch
@@ -0,0 +1,11 @@
+--- a/src/orpie/dune	2021-10-05 06:09:09.040120000 +0200
++++ b/src/orpie/dune	2021-10-05 06:10:06.568418512 +0200
+@@ -18,7 +18,7 @@
+ ; Support $PREFIX for overriding installation location
+ (rule
+   (targets install.ml)
+-  (action (run %{project_root}/scripts/compute_prefix subst %{deps} %{targets}))
++  (action (copy# %{deps} %{targets}))
+   (deps (file install.ml.in)))
+ 
+ 
diff --git a/pkgs/applications/misc/solaar/default.nix b/pkgs/applications/misc/solaar/default.nix
index b6059ac1a71b1..641353f53dafe 100644
--- a/pkgs/applications/misc/solaar/default.nix
+++ b/pkgs/applications/misc/solaar/default.nix
@@ -1,4 +1,13 @@
-{ fetchFromGitHub, lib, gobject-introspection, gtk3, python3Packages }:
+{ fetchFromGitHub
+, lib
+, gobject-introspection
+, gtk3
+, python3Packages
+, wrapGAppsHook
+, gdk-pixbuf
+, libappindicator
+, librsvg
+}:
 
 # Although we copy in the udev rules here, you probably just want to use
 # logitech-udev-rules instead of adding this to services.udev.packages on NixOS
@@ -13,6 +22,9 @@ python3Packages.buildPythonApplication rec {
     sha256 = "sha256-Ys0005hIQ+fT4oMeU5iFtbLNqn1WM6iLdIKGwdyn7BM=";
   };
 
+  nativeBuildInputs = [ wrapGAppsHook gdk-pixbuf ];
+  buildInputs = [ libappindicator librsvg ];
+
   propagatedBuildInputs = with python3Packages; [
     gobject-introspection
     gtk3
@@ -23,11 +35,6 @@ python3Packages.buildPythonApplication rec {
     xlib
   ];
 
-  makeWrapperArgs = [
-    "--prefix PYTHONPATH : $PYTHONPATH"
-    "--prefix GI_TYPELIB_PATH : $GI_TYPELIB_PATH"
-  ];
-
   # the -cli symlink is just to maintain compabilility with older versions where
   # there was a difference between the GUI and CLI versions.
   postInstall = ''
diff --git a/pkgs/applications/misc/xmrig/default.nix b/pkgs/applications/misc/xmrig/default.nix
index c0120e33992f5..56c078fd9fc61 100644
--- a/pkgs/applications/misc/xmrig/default.nix
+++ b/pkgs/applications/misc/xmrig/default.nix
@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   pname = "xmrig";
-  version = "6.14.1";
+  version = "6.15.0";
 
   src = fetchFromGitHub {
     owner = "xmrig";
     repo = "xmrig";
     rev = "v${version}";
-    sha256 = "sha256-JJ20LKA4gnPXO6d2Cegr3I67k+ZZc69hdL1dTUIF5OM=";
+    sha256 = "sha256-AsYfByiI5W50T/kOhLtD/kUSwDOWMCo33OZ6WGmNcFk=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/applications/networking/instant-messengers/slack/default.nix b/pkgs/applications/networking/instant-messengers/slack/default.nix
index f53f8d3fedacf..25d1de5efc17a 100644
--- a/pkgs/applications/networking/instant-messengers/slack/default.nix
+++ b/pkgs/applications/networking/instant-messengers/slack/default.nix
@@ -44,14 +44,14 @@ let
 
   pname = "slack";
 
-  x86_64-darwin-version = "4.19.0";
-  x86_64-darwin-sha256 = "0dj51lhxiba69as6x76ni8h20d36bcpf2xz3rxr1s8881mprpfsg";
+  x86_64-darwin-version = "4.20.0";
+  x86_64-darwin-sha256 = "1argl690i4dgz5ih02zg9v4zrlzm282wmibnc6p7xy5jisd5g79w";
 
-  x86_64-linux-version = "4.19.2";
-  x86_64-linux-sha256 = "02npmprwl1h7c2y03khvx8ifhk1gj1axbvlwigp2hkkjdw7y4b5a";
+  x86_64-linux-version = "4.20.0";
+  x86_64-linux-sha256 = "1r8w8s3y74lh4klsmzq2d3f0h721b3a2b53nx8v7b0s6j8w0g0mh";
 
-  aarch64-darwin-version = "4.19.0";
-  aarch64-darwin-sha256 = "1mvs1bdyyyrpqmrbqg4sxpy6ylgchwz39nr232s441iqdz45p87v";
+  aarch64-darwin-version = "4.20.0";
+  aarch64-darwin-sha256 = "1argl690i4dgz5ih02zg9v4zrlzm282wmibnc6p7xy5jisd5g79w";
 
   version = {
     x86_64-darwin = x86_64-darwin-version;
@@ -73,7 +73,7 @@ let
           sha256 = aarch64-darwin-sha256;
         };
         x86_64-linux = fetchurl {
-          url = "${base}/linux_releases/slack-desktop-${version}-amd64.deb";
+          url = "${base}/releases/linux/${version}/prod/x64/slack-desktop-${version}-amd64.deb";
           sha256 = x86_64-linux-sha256;
         };
       }.${system} or throwSystem;
diff --git a/pkgs/applications/networking/remote/citrix-workspace/sources.nix b/pkgs/applications/networking/remote/citrix-workspace/sources.nix
index e492aac9773d5..4d701f835bdcf 100644
--- a/pkgs/applications/networking/remote/citrix-workspace/sources.nix
+++ b/pkgs/applications/networking/remote/citrix-workspace/sources.nix
@@ -100,6 +100,7 @@ let
       x86suffix = "28";
       homepage  = "https://www.citrix.com/downloads/workspace-app/linux/workspace-app-for-linux-latest.html";
     };
+
     "21.08.0" = {
       major     = "21";
       minor     = "8";
@@ -110,6 +111,17 @@ let
       x86suffix = "40";
       homepage  = "https://www.citrix.com/downloads/workspace-app/linux/workspace-app-for-linux-latest.html";
     };
+
+    "21.09.0" = {
+      major     = "21";
+      minor     = "9";
+      patch     = "0";
+      x64hash   = "d58d5cbbcb5ace95b75b1400061d475b8e72dbdf5f03abacea6d39686991f848";
+      x86hash   = "c646c52889e88aa0bb051070076763d5407f21fb6ad6dfcb0fe635ac01180c51";
+      x64suffix = "25";
+      x86suffix = "25";
+      homepage  = "https://www.citrix.com/downloads/workspace-app/linux/workspace-app-for-linux-latest.html";
+    };
   };
 
   # Retain attribute-names for abandoned versions of Citrix workspace to
diff --git a/pkgs/applications/office/trilium/default.nix b/pkgs/applications/office/trilium/default.nix
index 3cf7fd1eaebd3..6cfdf3c8f9252 100644
--- a/pkgs/applications/office/trilium/default.nix
+++ b/pkgs/applications/office/trilium/default.nix
@@ -19,16 +19,16 @@ let
     maintainers = with maintainers; [ fliegendewurst ];
   };
 
-  version = "0.47.7";
+  version = "0.47.8";
 
   desktopSource = {
     url = "https://github.com/zadam/trilium/releases/download/v${version}/trilium-linux-x64-${version}.tar.xz";
-    sha256 = "1fcrc01wr8ln1i77q9h89i90wwyijpfp58fa717wbdvyly4860sh";
+    sha256 = "1vnwjiv4bidw5xspcd7d7fn8dbhvgia9ws363fs5zs48c9k2hwwz";
   };
 
   serverSource = {
     url = "https://github.com/zadam/trilium/releases/download/v${version}/trilium-linux-x64-server-${version}.tar.xz";
-    sha256 = "0qp37y3xgbhl6vj2bkwz1lfylkn82kx7n0lcfr58wxwkn00149ry";
+    sha256 = "1clgw0i3vbl8lrsjdjbn71yhim6356gm8h24831mnksb4sawhh7f";
   };
 
 in {
diff --git a/pkgs/applications/version-management/git-and-tools/git-cliff/default.nix b/pkgs/applications/version-management/git-and-tools/git-cliff/default.nix
index 74e617021c92f..33bb73eb6348f 100644
--- a/pkgs/applications/version-management/git-and-tools/git-cliff/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git-cliff/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "git-cliff";
-  version = "0.3.0";
+  version = "0.4.0";
 
   src = fetchFromGitHub {
     owner = "orhun";
     repo = "git-cliff";
     rev = "v${version}";
-    sha256 = "sha256-d0qY0yGvFf1V8NhS9cHEawkTqMAN6roReAHJ6FT9qJ4=";
+    sha256 = "sha256-9F15XHyFxcE48/ePwjvB7lLkw9FxoQd49G758nupRuk=";
   };
 
-  cargoSha256 = "sha256-UxV9trTm4vZ/boWB7Sl6Dbwhjk8jQnB0QT6bC+aCL+A=";
+  cargoSha256 = "sha256-gPf4sGDbZzfzVJy+9k3FSOdJ5b8Xci1LTjIrCmP9bW8=";
 
   # attempts to run the program on .git in src which is not deterministic
   doCheck = false;
diff --git a/pkgs/build-support/bintools-wrapper/add-hardening.sh b/pkgs/build-support/bintools-wrapper/add-hardening.sh
index 4d289a334b772..0a2b2509a8265 100644
--- a/pkgs/build-support/bintools-wrapper/add-hardening.sh
+++ b/pkgs/build-support/bintools-wrapper/add-hardening.sh
@@ -37,7 +37,11 @@ fi
 for flag in "${!hardeningEnableMap[@]}"; do
   case $flag in
     pie)
-      if [[ ! ("$*" =~ " -shared " || "$*" =~ " -static " || "$*" =~ " -r " || "$*" =~ " -Ur " || "$*" =~ " -i ") ]]; then
+      if [[ ! (" $* " =~ " -shared " \
+            || " $* " =~ " -static " \
+            || " $* " =~ " -r " \
+            || " $* " =~ " -Ur " \
+            || " $* " =~ " -i ") ]]; then
         if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling LDFlags -pie >&2; fi
         hardeningLDFlags+=('-pie')
       fi
diff --git a/pkgs/build-support/cc-wrapper/add-hardening.sh b/pkgs/build-support/cc-wrapper/add-hardening.sh
index 8e2fe6c407ea7..e5d296f6c9c52 100644
--- a/pkgs/build-support/cc-wrapper/add-hardening.sh
+++ b/pkgs/build-support/cc-wrapper/add-hardening.sh
@@ -45,11 +45,12 @@ for flag in "${!hardeningEnableMap[@]}"; do
       hardeningCFlags+=('-fstack-protector-strong' '--param' 'ssp-buffer-size=4')
       ;;
     pie)
+      # NB: we do not use `+=` here, because PIE flags must occur before any PIC flags
       if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling CFlags -fPIE >&2; fi
-      hardeningCFlags+=('-fPIE')
-      if [[ ! ("$*" =~ " -shared " || "$*" =~ " -static ") ]]; then
+      hardeningCFlags=('-fPIE' "${hardeningCFlags[@]}")
+      if [[ ! (" $* " =~ " -shared " || " $* " =~ " -static ") ]]; then
         if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling LDFlags -pie >&2; fi
-        hardeningCFlags+=('-pie')
+        hardeningCFlags=('-pie' "${hardeningCFlags[@]}")
       fi
       ;;
     pic)
diff --git a/pkgs/build-support/setup-hooks/auto-patchelf.sh b/pkgs/build-support/setup-hooks/auto-patchelf.sh
index d310f8255224f..4b3a1c5c39092 100644
--- a/pkgs/build-support/setup-hooks/auto-patchelf.sh
+++ b/pkgs/build-support/setup-hooks/auto-patchelf.sh
@@ -63,10 +63,9 @@ getRpathFromElfBinary() {
     # NOTE: This does not use runPatchelf because it may encounter non-ELF
     # files. Caller is expected to check the return code if needed.
     local rpath
-    rpath="$(patchelf --print-rpath "$1" 2> /dev/null)" || return $?
+    IFS=':' read -ra rpath < <(patchelf --print-rpath "$1" 2> /dev/null) || return $?
 
-    local IFS=':'
-    printf "%s\n" $rpath
+    printf "%s\n" "${rpath[@]}"
 }
 
 populateCacheForDep() {
@@ -115,8 +114,52 @@ populateCacheWithRecursiveDeps() {
     done
 }
 
-getSoArch() {
-    $OBJDUMP -f "$1" | sed -ne 's/^architecture: *\([^,]\+\).*/\1/p'
+getBinArch() {
+    $OBJDUMP -f "$1" 2> /dev/null | sed -ne 's/^architecture: *\([^,]\+\).*/\1/p'
+}
+
+# Returns the specific OS ABI for an ELF file in the format produced by
+# readelf(1), like "UNIX - System V" or "UNIX - GNU".
+getBinOsabi() {
+    $READELF -h "$1" 2> /dev/null | sed -ne 's/^[ \t]*OS\/ABI:[ \t]*\(.*\)/\1/p'
+}
+
+# Tests whether two OS ABIs are compatible, taking into account the generally
+# accepted compatibility of SVR4 ABI with other ABIs.
+areBinOsabisCompatible() {
+    local wanted="$1"
+    local got="$2"
+
+    if [[ -z "$wanted" || -z "$got" ]]; then
+        # One of the types couldn't be detected, so as a fallback we'll assume
+        # they're compatible.
+        return 0
+    fi
+
+    # Generally speaking, the base ABI (0x00), which is represented by
+    # readelf(1) as "UNIX - System V", indicates broad compatibility with other
+    # ABIs.
+    #
+    # TODO: This isn't always true. For example, some OSes embed ABI
+    # compatibility into SHT_NOTE sections like .note.tag and .note.ABI-tag.
+    # It would be prudent to add these to the detection logic to produce better
+    # ABI information.
+    if [[ "$wanted" == "UNIX - System V" ]]; then
+        return 0
+    fi
+
+    # Similarly here, we should be able to link against a superset of features,
+    # so even if the target has another ABI, this should be fine.
+    if [[ "$got" == "UNIX - System V" ]]; then
+        return 0
+    fi
+
+    # Otherwise, we simply return whether the ABIs are identical.
+    if [[ "$wanted" == "$got" ]]; then
+        return 0
+    fi
+
+    return 1
 }
 
 # NOTE: If you want to use this function outside of the autoPatchelf function,
@@ -127,6 +170,7 @@ getSoArch() {
 findDependency() {
     local filename="$1"
     local arch="$2"
+    local osabi="$3"
     local lib dep
 
     if [ $depCacheInitialised -eq 0 ]; then
@@ -138,7 +182,7 @@ findDependency() {
 
     for dep in "${autoPatchelfCachedDeps[@]}"; do
         if [ "$filename" = "${dep##*/}" ]; then
-            if [ "$(getSoArch "$dep")" = "$arch" ]; then
+            if [ "$(getBinArch "$dep")" = "$arch" ] && areBinOsabisCompatible "$osabi" "$(getBinOsabi "$dep")"; then
                 foundDependency="$dep"
                 return 0
             fi
@@ -162,7 +206,24 @@ autoPatchelfFile() {
     local dep rpath="" toPatch="$1"
 
     local interpreter
-    interpreter="$(< "$NIX_CC/nix-support/dynamic-linker")"
+    interpreter="$(< "$NIX_BINTOOLS/nix-support/dynamic-linker")"
+
+    local interpreterArch interpreterOsabi toPatchArch toPatchOsabi
+    interpreterArch="$(getBinArch "$interpreter")"
+    interpreterOsabi="$(getBinOsabi "$interpreter")"
+    toPatchArch="$(getBinArch "$toPatch")"
+    toPatchOsabi="$(getBinOsabi "$toPatch")"
+
+    if [ "$interpreterArch" != "$toPatchArch" ]; then
+        # Our target architecture is different than this file's architecture,
+        # so skip it.
+        echo "skipping $toPatch because its architecture ($toPatchArch) differs from target ($interpreterArch)" >&2
+        return 0
+    elif ! areBinOsabisCompatible "$interpreterOsabi" "$toPatchOsabi"; then
+        echo "skipping $toPatch because its OS ABI ($toPatchOsabi) is not compatible with target ($interpreterOsabi)" >&2
+        return 0
+    fi
+
     if isExecutable "$toPatch"; then
         runPatchelf --set-interpreter "$interpreter" "$toPatch"
         # shellcheck disable=SC2154
@@ -175,7 +236,7 @@ autoPatchelfFile() {
     fi
 
     local libcLib
-    libcLib="$(< "$NIX_CC/nix-support/orig-libc")/lib"
+    libcLib="$(< "$NIX_BINTOOLS/nix-support/orig-libc")/lib"
 
     echo "searching for dependencies of $toPatch" >&2
 
@@ -187,14 +248,21 @@ autoPatchelfFile() {
     # new package where you don't yet know its dependencies.
 
     for dep in $missing; do
-        # Check whether this library exists in libc. If so, we don't need to do
-        # any futher searching -- it will be resolved correctly by the linker.
-        if [ -f "$libcLib/$dep" ]; then
+        if [[ "$dep" == /* ]]; then
+            # This is an absolute path. If it exists, just use it. Otherwise,
+            # we probably want this to produce an error when checked (because
+            # just updating the rpath won't satisfy it).
+            if [ -f "$dep" ]; then
+                continue
+            fi
+        elif [ -f "$libcLib/$dep" ]; then
+            # This library exists in libc, and will be correctly resolved by
+            # the linker.
             continue
         fi
 
         echo -n "  $dep -> " >&2
-        if findDependency "$dep" "$(getSoArch "$toPatch")"; then
+        if findDependency "$dep" "$toPatchArch" "$toPatchOsabi"; then
             rpath="$rpath${rpath:+:}${foundDependency%/*}"
             echo "found: $foundDependency" >&2
         else
diff --git a/pkgs/data/misc/iana-etc/default.nix b/pkgs/data/misc/iana-etc/default.nix
index 60735eb4782ca..29ebac848d855 100644
--- a/pkgs/data/misc/iana-etc/default.nix
+++ b/pkgs/data/misc/iana-etc/default.nix
@@ -1,17 +1,23 @@
-{ lib, fetchzip }:
+{ lib, fetchzip, stdenvNoCC, writeText }:
 
 let
   version = "20210225";
-in fetchzip {
+in stdenvNoCC.mkDerivation {
   name = "iana-etc-${version}";
-  url = "https://github.com/Mic92/iana-etc/releases/download/${version}/iana-etc-${version}.tar.gz";
-  sha256 = "sha256-NVvZG3EJEYOXFDTBXD5m9sg/8msyMiBMkiZr+ZxWZ/g=";
+  src = fetchzip {
+    url = "https://github.com/Mic92/iana-etc/releases/download/${version}/iana-etc-${version}.tar.gz";
+    sha256 = "sha256:1bbbnj2ya0apyyhnw37521yl1hrz3zy3l8dw6sacmir0y6pmx9gi";
+  };
 
-  postFetch = ''
-    tar -xzvf $downloadedFile --strip-components=1
+  installPhase = ''
     install -D -m0644 -t $out/etc services protocols
   '';
 
+  setupHook = writeText "setup-hook" ''
+    export NIX_ETC_PROTOCOLS=@out@/etc/protocols
+    export NIX_ETC_SERVICES=@out@/etc/services
+  '';
+
   meta = with lib; {
     homepage = "https://github.com/Mic92/iana-etc";
     description = "IANA protocol and port number assignments (/etc/protocols and /etc/services)";
diff --git a/pkgs/development/beam-modules/erlang-ls/default.nix b/pkgs/development/beam-modules/erlang-ls/default.nix
index cad68e6f302ab..cec3336dcb4c9 100644
--- a/pkgs/development/beam-modules/erlang-ls/default.nix
+++ b/pkgs/development/beam-modules/erlang-ls/default.nix
@@ -1,7 +1,7 @@
 { fetchFromGitHub, fetchgit, fetchHex, rebar3Relx, buildRebar3, rebar3-proper
 , stdenv, writeScript, lib }:
 let
-  version = "0.19.0";
+  version = "0.20.0";
   owner = "erlang-ls";
   repo = "erlang_ls";
   deps = import ./rebar-deps.nix {
@@ -19,7 +19,7 @@ rebar3Relx {
   inherit version;
   src = fetchFromGitHub {
     inherit owner repo;
-    sha256 = "sha256-WesGgLoVR435lNXnsCFYcUoKXDMuL7hWImDluori+dc=";
+    sha256 = "sha256-XBCauvPalIPjVOYlMfWC+5mKku28b/qqKhp9NgSkoyA=";
     rev = version;
   };
   releaseType = "escript";
diff --git a/pkgs/development/compilers/bigloo/default.nix b/pkgs/development/compilers/bigloo/default.nix
index c4fa5712ea63c..d61d34276a301 100644
--- a/pkgs/development/compilers/bigloo/default.nix
+++ b/pkgs/development/compilers/bigloo/default.nix
@@ -1,5 +1,5 @@
 { fetchurl, lib, stdenv, autoconf, automake, libtool, gmp
-, darwin
+, darwin, libunistring
 }:
 
 stdenv.mkDerivation rec {
@@ -13,9 +13,10 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ autoconf automake libtool ];
 
-  buildInputs = lib.optional stdenv.isDarwin
+  buildInputs = lib.optionals stdenv.isDarwin [
     darwin.apple_sdk.frameworks.ApplicationServices
-  ;
+    libunistring
+  ];
 
   propagatedBuildInputs = [ gmp ];
 
diff --git a/pkgs/development/compilers/gcc/10/default.nix b/pkgs/development/compilers/gcc/10/default.nix
index a1598d3d3f07c..f9dd0465b9258 100644
--- a/pkgs/development/compilers/gcc/10/default.nix
+++ b/pkgs/development/compilers/gcc/10/default.nix
@@ -73,7 +73,9 @@ let majorVersion = "10";
       ++ optional (targetPlatform.libc == "musl" && targetPlatform.isPower) ../ppc-musl.patch
 
       # Obtain latest patch with ../update-mcfgthread-patches.sh
-      ++ optional (!crossStageStatic && targetPlatform.isMinGW) ./Added-mcf-thread-model-support-from-mcfgthread.patch;
+      ++ optional (!crossStageStatic && targetPlatform.isMinGW) ./Added-mcf-thread-model-support-from-mcfgthread.patch
+
+      ++ [ ../libsanitizer-no-cyclades.patch ];
 
     /* Cross-gcc settings (build == host != target) */
     crossMingw = targetPlatform != hostPlatform && targetPlatform.libc == "msvcrt";
diff --git a/pkgs/development/compilers/gcc/11/default.nix b/pkgs/development/compilers/gcc/11/default.nix
index 7b7f542de0cfb..850b267441fd4 100644
--- a/pkgs/development/compilers/gcc/11/default.nix
+++ b/pkgs/development/compilers/gcc/11/default.nix
@@ -78,7 +78,9 @@ let majorVersion = "11";
       })
 
       # Obtain latest patch with ../update-mcfgthread-patches.sh
-      ++ optional (!crossStageStatic && targetPlatform.isMinGW) ./Added-mcf-thread-model-support-from-mcfgthread.patch;
+      ++ optional (!crossStageStatic && targetPlatform.isMinGW) ./Added-mcf-thread-model-support-from-mcfgthread.patch
+
+      ++ [ ../libsanitizer-no-cyclades.patch ];
 
     /* Cross-gcc settings (build == host != target) */
     crossMingw = targetPlatform != hostPlatform && targetPlatform.libc == "msvcrt";
diff --git a/pkgs/development/compilers/gcc/4.8/default.nix b/pkgs/development/compilers/gcc/4.8/default.nix
index 98332290a0789..e1c441e7afe03 100644
--- a/pkgs/development/compilers/gcc/4.8/default.nix
+++ b/pkgs/development/compilers/gcc/4.8/default.nix
@@ -86,6 +86,13 @@ let majorVersion = "4";
         ../struct-ucontext-4.8.patch
         ../sigsegv-not-declared.patch
         ../res_state-not-declared.patch
+        # gcc-11 compatibility
+        (fetchpatch {
+          name = "gcc4-char-reload.patch";
+          url = "https://gcc.gnu.org/git/?p=gcc.git;a=commitdiff_plain;h=d57c99458933a21fdf94f508191f145ad8d5ec58";
+          includes = [ "gcc/reload.h" ];
+          sha256 = "sha256-66AMP7/ajunGKAN5WJz/yPn42URZ2KN51yPrFdsxEuM=";
+        })
       ];
 
     javaEcj = fetchurl {
diff --git a/pkgs/development/compilers/gcc/4.9/default.nix b/pkgs/development/compilers/gcc/4.9/default.nix
index a15cb770fdfad..3b92ecddc08a8 100644
--- a/pkgs/development/compilers/gcc/4.9/default.nix
+++ b/pkgs/development/compilers/gcc/4.9/default.nix
@@ -98,7 +98,18 @@ let majorVersion = "4";
           { commit = "98c7bf9ddc80db965d69d61521b1c7a1cec32d9a"; sha256 = "1d7pfdv1q23nf0wadw7jbp6d6r7pnzjpbyxgbdfv7j1vr9l1bp60"; }
           { commit = "3dc76b53ad896494ca62550a7a752fecbca3f7a2"; sha256 = "0jvdzfpvfdmklfcjwqblwq1i22iqis7ljpvm7adra5d7zf2xk7xz"; }
           { commit = "1e961ed49b18e176c7457f53df2433421387c23b"; sha256 = "04dnqqs4qsvz4g8cq6db5id41kzys7hzhcaycwmc9rpqygs2ajwz"; }
-          { commit = "e137c72d099f9b3b47f4cc718aa11eab14df1a9c"; sha256 = "1ms0dmz74yf6kwgjfs4d2fhj8y6mcp2n184r3jk44wx2xc24vgb2"; }];
+          { commit = "e137c72d099f9b3b47f4cc718aa11eab14df1a9c"; sha256 = "1ms0dmz74yf6kwgjfs4d2fhj8y6mcp2n184r3jk44wx2xc24vgb2"; }]
+
+      ++ [
+        ../libsanitizer-no-cyclades-9.patch
+        # gcc-11 compatibility
+        (fetchpatch {
+          name = "gcc4-char-reload.patch";
+          url = "https://gcc.gnu.org/git/?p=gcc.git;a=commitdiff_plain;h=d57c99458933a21fdf94f508191f145ad8d5ec58";
+          includes = [ "gcc/reload.h" ];
+          sha256 = "sha256-66AMP7/ajunGKAN5WJz/yPn42URZ2KN51yPrFdsxEuM=";
+        })
+      ];
 
     javaEcj = fetchurl {
       # The `$(top_srcdir)/ecj.jar' file is automatically picked up at
diff --git a/pkgs/development/compilers/gcc/6/default.nix b/pkgs/development/compilers/gcc/6/default.nix
index df4a632db05dd..e0ef8e3178992 100644
--- a/pkgs/development/compilers/gcc/6/default.nix
+++ b/pkgs/development/compilers/gcc/6/default.nix
@@ -87,7 +87,9 @@ let majorVersion = "6";
       ++ optional (targetPlatform.libc == "musl" && targetPlatform.isx86_32) (fetchpatch {
         url = "https://git.alpinelinux.org/aports/plain/main/gcc/gcc-6.1-musl-libssp.patch?id=5e4b96e23871ee28ef593b439f8c07ca7c7eb5bb";
         sha256 = "1jf1ciz4gr49lwyh8knfhw6l5gvfkwzjy90m7qiwkcbsf4a3fqn2";
-      });
+      })
+
+      ++ [ ../libsanitizer-no-cyclades-9.patch ];
 
     javaEcj = fetchurl {
       # The `$(top_srcdir)/ecj.jar' file is automatically picked up at
diff --git a/pkgs/development/compilers/gcc/7/default.nix b/pkgs/development/compilers/gcc/7/default.nix
index 44e8b38fdf806..dcb7d0b91f6f1 100644
--- a/pkgs/development/compilers/gcc/7/default.nix
+++ b/pkgs/development/compilers/gcc/7/default.nix
@@ -84,7 +84,9 @@ let majorVersion = "7";
       ++ optional (targetPlatform.libc == "musl") ../libgomp-dont-force-initial-exec.patch
 
       # Obtain latest patch with ../update-mcfgthread-patches.sh
-      ++ optional (!crossStageStatic && targetPlatform.isMinGW) ./Added-mcf-thread-model-support-from-mcfgthread.patch;
+      ++ optional (!crossStageStatic && targetPlatform.isMinGW) ./Added-mcf-thread-model-support-from-mcfgthread.patch
+
+      ++ [ ../libsanitizer-no-cyclades-9.patch ];
 
     /* Cross-gcc settings (build == host != target) */
     crossMingw = targetPlatform != hostPlatform && targetPlatform.libc == "msvcrt";
diff --git a/pkgs/development/compilers/gcc/8/default.nix b/pkgs/development/compilers/gcc/8/default.nix
index b264d37418e8e..a6fd34c60cc39 100644
--- a/pkgs/development/compilers/gcc/8/default.nix
+++ b/pkgs/development/compilers/gcc/8/default.nix
@@ -71,7 +71,9 @@ let majorVersion = "8";
       ++ optional (targetPlatform.libc == "musl") ../libgomp-dont-force-initial-exec.patch
 
       # Obtain latest patch with ../update-mcfgthread-patches.sh
-      ++ optional (!crossStageStatic && targetPlatform.isMinGW) ./Added-mcf-thread-model-support-from-mcfgthread.patch;
+      ++ optional (!crossStageStatic && targetPlatform.isMinGW) ./Added-mcf-thread-model-support-from-mcfgthread.patch
+
+      ++ [ ../libsanitizer-no-cyclades-9.patch ];
 
     /* Cross-gcc settings (build == host != target) */
     crossMingw = targetPlatform != hostPlatform && targetPlatform.libc == "msvcrt";
diff --git a/pkgs/development/compilers/gcc/9/default.nix b/pkgs/development/compilers/gcc/9/default.nix
index 43b2e0b5ef51e..604d90fa7828e 100644
--- a/pkgs/development/compilers/gcc/9/default.nix
+++ b/pkgs/development/compilers/gcc/9/default.nix
@@ -87,7 +87,9 @@ let majorVersion = "9";
       ++ optional (targetPlatform.libc == "musl" && targetPlatform.isPower) ../ppc-musl.patch
 
       # Obtain latest patch with ../update-mcfgthread-patches.sh
-      ++ optional (!crossStageStatic && targetPlatform.isMinGW) ./Added-mcf-thread-model-support-from-mcfgthread.patch;
+      ++ optional (!crossStageStatic && targetPlatform.isMinGW) ./Added-mcf-thread-model-support-from-mcfgthread.patch
+
+      ++ [ ../libsanitizer-no-cyclades-9.patch ];
 
     /* Cross-gcc settings (build == host != target) */
     crossMingw = targetPlatform != hostPlatform && targetPlatform.libc == "msvcrt";
diff --git a/pkgs/development/compilers/gcc/libsanitizer-no-cyclades-9.patch b/pkgs/development/compilers/gcc/libsanitizer-no-cyclades-9.patch
new file mode 100644
index 0000000000000..072403d1495fc
--- /dev/null
+++ b/pkgs/development/compilers/gcc/libsanitizer-no-cyclades-9.patch
@@ -0,0 +1,82 @@
+https://gcc.gnu.org/git/?p=gcc.git;a=patch;h=2b40941d23b1570cdd90083b58fa0f66aa58c86e
+https://gcc.gnu.org/PR100379 
+--- a/libsanitizer/sanitizer_common/sanitizer_common_interceptors_ioctl.inc
++++ b/libsanitizer/sanitizer_common/sanitizer_common_interceptors_ioctl.inc
+@@ -365,15 +365,6 @@ static void ioctl_table_fill() {
+ 
+ #if SANITIZER_LINUX && !SANITIZER_ANDROID
+   // _(SIOCDEVPLIP, WRITE, struct_ifreq_sz); // the same as EQL_ENSLAVE
+-  _(CYGETDEFTHRESH, WRITE, sizeof(int));
+-  _(CYGETDEFTIMEOUT, WRITE, sizeof(int));
+-  _(CYGETMON, WRITE, struct_cyclades_monitor_sz);
+-  _(CYGETTHRESH, WRITE, sizeof(int));
+-  _(CYGETTIMEOUT, WRITE, sizeof(int));
+-  _(CYSETDEFTHRESH, NONE, 0);
+-  _(CYSETDEFTIMEOUT, NONE, 0);
+-  _(CYSETTHRESH, NONE, 0);
+-  _(CYSETTIMEOUT, NONE, 0);
+   _(EQL_EMANCIPATE, WRITE, struct_ifreq_sz);
+   _(EQL_ENSLAVE, WRITE, struct_ifreq_sz);
+   _(EQL_GETMASTRCFG, WRITE, struct_ifreq_sz);
+--- a/libsanitizer/sanitizer_common/sanitizer_platform_limits_posix.cc
++++ b/libsanitizer/sanitizer_common/sanitizer_platform_limits_posix.cc
+@@ -157,7 +157,6 @@ typedef struct user_fpregs elf_fpregset_t;
+ # include <sys/procfs.h>
+ #endif
+ #include <sys/user.h>
+-#include <linux/cyclades.h>
+ #include <linux/if_eql.h>
+ #include <linux/if_plip.h>
+ #include <linux/lp.h>
+@@ -466,7 +465,6 @@ unsigned struct_ElfW_Phdr_sz = sizeof(Elf_Phdr);
+ 
+ #if SANITIZER_LINUX && !SANITIZER_ANDROID
+   unsigned struct_ax25_parms_struct_sz = sizeof(struct ax25_parms_struct);
+-  unsigned struct_cyclades_monitor_sz = sizeof(struct cyclades_monitor);
+ #if EV_VERSION > (0x010000)
+   unsigned struct_input_keymap_entry_sz = sizeof(struct input_keymap_entry);
+ #else
+@@ -833,15 +831,6 @@ unsigned struct_ElfW_Phdr_sz = sizeof(Elf_Phdr);
+ #endif // SANITIZER_LINUX || SANITIZER_FREEBSD
+ 
+ #if SANITIZER_LINUX && !SANITIZER_ANDROID
+-  unsigned IOCTL_CYGETDEFTHRESH = CYGETDEFTHRESH;
+-  unsigned IOCTL_CYGETDEFTIMEOUT = CYGETDEFTIMEOUT;
+-  unsigned IOCTL_CYGETMON = CYGETMON;
+-  unsigned IOCTL_CYGETTHRESH = CYGETTHRESH;
+-  unsigned IOCTL_CYGETTIMEOUT = CYGETTIMEOUT;
+-  unsigned IOCTL_CYSETDEFTHRESH = CYSETDEFTHRESH;
+-  unsigned IOCTL_CYSETDEFTIMEOUT = CYSETDEFTIMEOUT;
+-  unsigned IOCTL_CYSETTHRESH = CYSETTHRESH;
+-  unsigned IOCTL_CYSETTIMEOUT = CYSETTIMEOUT;
+   unsigned IOCTL_EQL_EMANCIPATE = EQL_EMANCIPATE;
+   unsigned IOCTL_EQL_ENSLAVE = EQL_ENSLAVE;
+   unsigned IOCTL_EQL_GETMASTRCFG = EQL_GETMASTRCFG;
+--- a/libsanitizer/sanitizer_common/sanitizer_platform_limits_posix.h
++++ b/libsanitizer/sanitizer_common/sanitizer_platform_limits_posix.h
+@@ -1040,7 +1040,6 @@ struct __sanitizer_cookie_io_functions_t {
+ 
+ #if SANITIZER_LINUX && !SANITIZER_ANDROID
+   extern unsigned struct_ax25_parms_struct_sz;
+-  extern unsigned struct_cyclades_monitor_sz;
+   extern unsigned struct_input_keymap_entry_sz;
+   extern unsigned struct_ipx_config_data_sz;
+   extern unsigned struct_kbdiacrs_sz;
+@@ -1385,15 +1384,6 @@ struct __sanitizer_cookie_io_functions_t {
+ #endif  // SANITIZER_LINUX || SANITIZER_FREEBSD
+ 
+ #if SANITIZER_LINUX && !SANITIZER_ANDROID
+-  extern unsigned IOCTL_CYGETDEFTHRESH;
+-  extern unsigned IOCTL_CYGETDEFTIMEOUT;
+-  extern unsigned IOCTL_CYGETMON;
+-  extern unsigned IOCTL_CYGETTHRESH;
+-  extern unsigned IOCTL_CYGETTIMEOUT;
+-  extern unsigned IOCTL_CYSETDEFTHRESH;
+-  extern unsigned IOCTL_CYSETDEFTIMEOUT;
+-  extern unsigned IOCTL_CYSETTHRESH;
+-  extern unsigned IOCTL_CYSETTIMEOUT;
+   extern unsigned IOCTL_EQL_EMANCIPATE;
+   extern unsigned IOCTL_EQL_ENSLAVE;
+   extern unsigned IOCTL_EQL_GETMASTRCFG;
+-- 
+2.27.0
diff --git a/pkgs/development/compilers/gcc/libsanitizer-no-cyclades.patch b/pkgs/development/compilers/gcc/libsanitizer-no-cyclades.patch
new file mode 100644
index 0000000000000..e2155cd0c982d
--- /dev/null
+++ b/pkgs/development/compilers/gcc/libsanitizer-no-cyclades.patch
@@ -0,0 +1,83 @@
+https://gcc.gnu.org/git/?p=gcc.git;a=patch;h=2bf34b9f4e446bf9be7f04458058dd5319fb396e
+https://gcc.gnu.org/PR100379 
+--- a/libsanitizer/sanitizer_common/sanitizer_common_interceptors_ioctl.inc
++++ b/libsanitizer/sanitizer_common/sanitizer_common_interceptors_ioctl.inc
+@@ -366,15 +366,6 @@ static void ioctl_table_fill() {
+ 
+ #if SANITIZER_LINUX && !SANITIZER_ANDROID
+   // _(SIOCDEVPLIP, WRITE, struct_ifreq_sz); // the same as EQL_ENSLAVE
+-  _(CYGETDEFTHRESH, WRITE, sizeof(int));
+-  _(CYGETDEFTIMEOUT, WRITE, sizeof(int));
+-  _(CYGETMON, WRITE, struct_cyclades_monitor_sz);
+-  _(CYGETTHRESH, WRITE, sizeof(int));
+-  _(CYGETTIMEOUT, WRITE, sizeof(int));
+-  _(CYSETDEFTHRESH, NONE, 0);
+-  _(CYSETDEFTIMEOUT, NONE, 0);
+-  _(CYSETTHRESH, NONE, 0);
+-  _(CYSETTIMEOUT, NONE, 0);
+   _(EQL_EMANCIPATE, WRITE, struct_ifreq_sz);
+   _(EQL_ENSLAVE, WRITE, struct_ifreq_sz);
+   _(EQL_GETMASTRCFG, WRITE, struct_ifreq_sz);
+--- a/libsanitizer/sanitizer_common/sanitizer_platform_limits_posix.cpp
++++ b/libsanitizer/sanitizer_common/sanitizer_platform_limits_posix.cpp
+@@ -130,7 +130,6 @@ typedef struct user_fpregs elf_fpregset_t;
+ # include <sys/procfs.h>
+ #endif
+ #include <sys/user.h>
+-#include <linux/cyclades.h>
+ #include <linux/if_eql.h>
+ #include <linux/if_plip.h>
+ #include <linux/lp.h>
+@@ -443,7 +442,6 @@ unsigned struct_ElfW_Phdr_sz = sizeof(Elf_Phdr);
+ 
+ #if SANITIZER_LINUX && !SANITIZER_ANDROID
+   unsigned struct_ax25_parms_struct_sz = sizeof(struct ax25_parms_struct);
+-  unsigned struct_cyclades_monitor_sz = sizeof(struct cyclades_monitor);
+ #if EV_VERSION > (0x010000)
+   unsigned struct_input_keymap_entry_sz = sizeof(struct input_keymap_entry);
+ #else
+@@ -809,15 +807,6 @@ unsigned struct_ElfW_Phdr_sz = sizeof(Elf_Phdr);
+ #endif // SANITIZER_LINUX
+ 
+ #if SANITIZER_LINUX && !SANITIZER_ANDROID
+-  unsigned IOCTL_CYGETDEFTHRESH = CYGETDEFTHRESH;
+-  unsigned IOCTL_CYGETDEFTIMEOUT = CYGETDEFTIMEOUT;
+-  unsigned IOCTL_CYGETMON = CYGETMON;
+-  unsigned IOCTL_CYGETTHRESH = CYGETTHRESH;
+-  unsigned IOCTL_CYGETTIMEOUT = CYGETTIMEOUT;
+-  unsigned IOCTL_CYSETDEFTHRESH = CYSETDEFTHRESH;
+-  unsigned IOCTL_CYSETDEFTIMEOUT = CYSETDEFTIMEOUT;
+-  unsigned IOCTL_CYSETTHRESH = CYSETTHRESH;
+-  unsigned IOCTL_CYSETTIMEOUT = CYSETTIMEOUT;
+   unsigned IOCTL_EQL_EMANCIPATE = EQL_EMANCIPATE;
+   unsigned IOCTL_EQL_ENSLAVE = EQL_ENSLAVE;
+   unsigned IOCTL_EQL_GETMASTRCFG = EQL_GETMASTRCFG;
+--- a/libsanitizer/sanitizer_common/sanitizer_platform_limits_posix.h
++++ b/libsanitizer/sanitizer_common/sanitizer_platform_limits_posix.h
+@@ -974,7 +974,6 @@ extern unsigned struct_vt_mode_sz;
+ 
+ #if SANITIZER_LINUX && !SANITIZER_ANDROID
+ extern unsigned struct_ax25_parms_struct_sz;
+-extern unsigned struct_cyclades_monitor_sz;
+ extern unsigned struct_input_keymap_entry_sz;
+ extern unsigned struct_ipx_config_data_sz;
+ extern unsigned struct_kbdiacrs_sz;
+@@ -1319,15 +1318,6 @@ extern unsigned IOCTL_VT_WAITACTIVE;
+ #endif  // SANITIZER_LINUX
+ 
+ #if SANITIZER_LINUX && !SANITIZER_ANDROID
+-extern unsigned IOCTL_CYGETDEFTHRESH;
+-extern unsigned IOCTL_CYGETDEFTIMEOUT;
+-extern unsigned IOCTL_CYGETMON;
+-extern unsigned IOCTL_CYGETTHRESH;
+-extern unsigned IOCTL_CYGETTIMEOUT;
+-extern unsigned IOCTL_CYSETDEFTHRESH;
+-extern unsigned IOCTL_CYSETDEFTIMEOUT;
+-extern unsigned IOCTL_CYSETTHRESH;
+-extern unsigned IOCTL_CYSETTIMEOUT;
+ extern unsigned IOCTL_EQL_EMANCIPATE;
+ extern unsigned IOCTL_EQL_ENSLAVE;
+ extern unsigned IOCTL_EQL_GETMASTRCFG;
+-- 
+2.33.0
+
diff --git a/pkgs/development/compilers/llvm/10/compiler-rt/default.nix b/pkgs/development/compilers/llvm/10/compiler-rt/default.nix
index faba5d97b79d0..657a465a3fe78 100644
--- a/pkgs/development/compilers/llvm/10/compiler-rt/default.nix
+++ b/pkgs/development/compilers/llvm/10/compiler-rt/default.nix
@@ -57,6 +57,7 @@ stdenv.mkDerivation {
     ./codesign.patch # Revert compiler-rt commit that makes codesign mandatory
     ./find-darwin-sdk-version.patch # don't test for macOS being >= 10.15
     ./gnu-install-dirs.patch
+    ../../common/compiler-rt/libsanitizer-no-cyclades-11.patch
   ]# ++ lib.optional stdenv.hostPlatform.isMusl ./sanitizers-nongnu.patch
     ++ lib.optional stdenv.hostPlatform.isAarch32 ./armv7l.patch;
 
diff --git a/pkgs/development/compilers/llvm/11/compiler-rt/default.nix b/pkgs/development/compilers/llvm/11/compiler-rt/default.nix
index e5b79692ae241..1111f14f9bea7 100644
--- a/pkgs/development/compilers/llvm/11/compiler-rt/default.nix
+++ b/pkgs/development/compilers/llvm/11/compiler-rt/default.nix
@@ -58,6 +58,7 @@ stdenv.mkDerivation {
     # ld-wrapper dislikes `-rpath-link //nix/store`, so we normalize away the
     # extra `/`.
     ./normalize-var.patch
+    ../../common/compiler-rt/libsanitizer-no-cyclades-11.patch
   ]# ++ lib.optional stdenv.hostPlatform.isMusl ./sanitizers-nongnu.patch
     ++ lib.optional stdenv.hostPlatform.isAarch32 ./armv7l.patch;
 
diff --git a/pkgs/development/compilers/llvm/5/compiler-rt/default.nix b/pkgs/development/compilers/llvm/5/compiler-rt/default.nix
index 9f937ed140fdb..c684437cefdb0 100644
--- a/pkgs/development/compilers/llvm/5/compiler-rt/default.nix
+++ b/pkgs/development/compilers/llvm/5/compiler-rt/default.nix
@@ -57,7 +57,8 @@ stdenv.mkDerivation {
     ./gnu-install-dirs.patch
   ] ++ lib.optional stdenv.hostPlatform.isMusl ./sanitizers-nongnu.patch
     ++ lib.optional (stdenv.hostPlatform.libc == "glibc") ./sys-ustat.patch
-    ++ lib.optional stdenv.hostPlatform.isAarch32 ./armv7l.patch;
+    ++ lib.optional stdenv.hostPlatform.isAarch32 ./armv7l.patch
+    ++ [ ../../common/compiler-rt/libsanitizer-no-cyclades-9.patch ];
 
   # TSAN requires XPC on Darwin, which we have no public/free source files for. We can depend on the Apple frameworks
   # to get it, but they're unfree. Since LLVM is rather central to the stdenv, we patch out TSAN support so that Hydra
diff --git a/pkgs/development/compilers/llvm/5/llvm/default.nix b/pkgs/development/compilers/llvm/5/llvm/default.nix
index 54fd783a7c2de..6388cd65fbf47 100644
--- a/pkgs/development/compilers/llvm/5/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/5/llvm/default.nix
@@ -82,6 +82,9 @@ stdenv.mkDerivation ({
     substituteInPlace unittests/Support/CMakeLists.txt \
       --replace "Path.cpp" ""
     rm unittests/Support/Path.cpp
+
+    # llvm-5 does not support dwarf-5 style info, fails on gcc-11.
+    rm test/tools/llvm-symbolizer/print_context.c
   '' + optionalString stdenv.isAarch64 ''
     patch -p0 < ${../../aarch64.patch}
   '' + optionalString stdenv.hostPlatform.isMusl ''
diff --git a/pkgs/development/compilers/llvm/6/compiler-rt/default.nix b/pkgs/development/compilers/llvm/6/compiler-rt/default.nix
index 7ee0943a88861..74c17fd3e6470 100644
--- a/pkgs/development/compilers/llvm/6/compiler-rt/default.nix
+++ b/pkgs/development/compilers/llvm/6/compiler-rt/default.nix
@@ -55,6 +55,7 @@ stdenv.mkDerivation {
     # https://github.com/llvm/llvm-project/commit/947f9692440836dcb8d88b74b69dd379d85974ce
     ../../common/compiler-rt/glibc.patch
     ./gnu-install-dirs.patch
+    ../../common/compiler-rt/libsanitizer-no-cyclades-9.patch
   ] ++ lib.optional stdenv.hostPlatform.isMusl ./sanitizers-nongnu.patch
     ++ lib.optional stdenv.hostPlatform.isAarch32 ./armv7l.patch;
 
diff --git a/pkgs/development/compilers/llvm/7/compiler-rt/default.nix b/pkgs/development/compilers/llvm/7/compiler-rt/default.nix
index f6190b7991896..6ea1280a40335 100644
--- a/pkgs/development/compilers/llvm/7/compiler-rt/default.nix
+++ b/pkgs/development/compilers/llvm/7/compiler-rt/default.nix
@@ -57,6 +57,7 @@ stdenv.mkDerivation {
     ../../common/compiler-rt/glibc.patch
     ./codesign.patch # Revert compiler-rt commit that makes codesign mandatory
     ./gnu-install-dirs.patch
+    ../../common/compiler-rt/libsanitizer-no-cyclades-9.patch
   ] ++ lib.optional (useLLVM) ./crtbegin-and-end.patch
     ++ lib.optional stdenv.hostPlatform.isMusl ./sanitizers-nongnu.patch
     ++ lib.optional stdenv.hostPlatform.isAarch32 ./armv7l.patch;
diff --git a/pkgs/development/compilers/llvm/8/compiler-rt/default.nix b/pkgs/development/compilers/llvm/8/compiler-rt/default.nix
index bbaae803738d0..62672b336fffe 100644
--- a/pkgs/development/compilers/llvm/8/compiler-rt/default.nix
+++ b/pkgs/development/compilers/llvm/8/compiler-rt/default.nix
@@ -57,6 +57,7 @@ stdenv.mkDerivation {
     ../../common/compiler-rt/glibc.patch
     ./codesign.patch # Revert compiler-rt commit that makes codesign mandatory
     ./gnu-install-dirs.patch
+    ../../common/compiler-rt/libsanitizer-no-cyclades-9.patch
   ]# ++ lib.optional stdenv.hostPlatform.isMusl ./sanitizers-nongnu.patch
     ++ lib.optional (useLLVM) ./crtbegin-and-end.patch
     ++ lib.optional stdenv.hostPlatform.isAarch32 ./armv7l.patch;
diff --git a/pkgs/development/compilers/llvm/9/compiler-rt/default.nix b/pkgs/development/compilers/llvm/9/compiler-rt/default.nix
index 4dc75bd1c14cd..83a75f516a056 100644
--- a/pkgs/development/compilers/llvm/9/compiler-rt/default.nix
+++ b/pkgs/development/compilers/llvm/9/compiler-rt/default.nix
@@ -57,6 +57,7 @@ stdenv.mkDerivation {
     ../../common/compiler-rt/glibc.patch
     ./codesign.patch # Revert compiler-rt commit that makes codesign mandatory
     ./gnu-install-dirs.patch
+    ../../common/compiler-rt/libsanitizer-no-cyclades-9.patch
   ]# ++ lib.optional stdenv.hostPlatform.isMusl ./sanitizers-nongnu.patch
     ++ lib.optional stdenv.hostPlatform.isAarch32 ./armv7l.patch;
 
diff --git a/pkgs/development/compilers/llvm/common/compiler-rt/libsanitizer-no-cyclades-11.patch b/pkgs/development/compilers/llvm/common/compiler-rt/libsanitizer-no-cyclades-11.patch
new file mode 100644
index 0000000000000..890230cc14ee9
--- /dev/null
+++ b/pkgs/development/compilers/llvm/common/compiler-rt/libsanitizer-no-cyclades-11.patch
@@ -0,0 +1,80 @@
+https://github.com/llvm/llvm-project/commit/68d5235cb58f988c71b403334cd9482d663841ab.patch
+https://reviews.llvm.org/D102059
+--- a/lib/sanitizer_common/sanitizer_common_interceptors_ioctl.inc
++++ b/lib/sanitizer_common/sanitizer_common_interceptors_ioctl.inc
+@@ -370,15 +370,6 @@ static void ioctl_table_fill() {
+ 
+ #if SANITIZER_GLIBC
+   // _(SIOCDEVPLIP, WRITE, struct_ifreq_sz); // the same as EQL_ENSLAVE
+-  _(CYGETDEFTHRESH, WRITE, sizeof(int));
+-  _(CYGETDEFTIMEOUT, WRITE, sizeof(int));
+-  _(CYGETMON, WRITE, struct_cyclades_monitor_sz);
+-  _(CYGETTHRESH, WRITE, sizeof(int));
+-  _(CYGETTIMEOUT, WRITE, sizeof(int));
+-  _(CYSETDEFTHRESH, NONE, 0);
+-  _(CYSETDEFTIMEOUT, NONE, 0);
+-  _(CYSETTHRESH, NONE, 0);
+-  _(CYSETTIMEOUT, NONE, 0);
+   _(EQL_EMANCIPATE, WRITE, struct_ifreq_sz);
+   _(EQL_ENSLAVE, WRITE, struct_ifreq_sz);
+   _(EQL_GETMASTRCFG, WRITE, struct_ifreq_sz);
+--- a/lib/sanitizer_common/sanitizer_platform_limits_posix.cpp
++++ b/lib/sanitizer_common/sanitizer_platform_limits_posix.cpp
+@@ -143,7 +143,6 @@ typedef struct user_fpregs elf_fpregset_t;
+ # include <sys/procfs.h>
+ #endif
+ #include <sys/user.h>
+-#include <linux/cyclades.h>
+ #include <linux/if_eql.h>
+ #include <linux/if_plip.h>
+ #include <linux/lp.h>
+@@ -460,7 +459,6 @@ unsigned struct_ElfW_Phdr_sz = sizeof(Elf_Phdr);
+ 
+ #if SANITIZER_GLIBC
+   unsigned struct_ax25_parms_struct_sz = sizeof(struct ax25_parms_struct);
+-  unsigned struct_cyclades_monitor_sz = sizeof(struct cyclades_monitor);
+ #if EV_VERSION > (0x010000)
+   unsigned struct_input_keymap_entry_sz = sizeof(struct input_keymap_entry);
+ #else
+@@ -824,15 +822,6 @@ unsigned struct_ElfW_Phdr_sz = sizeof(Elf_Phdr);
+ #endif // SANITIZER_LINUX
+ 
+ #if SANITIZER_LINUX && !SANITIZER_ANDROID
+-  unsigned IOCTL_CYGETDEFTHRESH = CYGETDEFTHRESH;
+-  unsigned IOCTL_CYGETDEFTIMEOUT = CYGETDEFTIMEOUT;
+-  unsigned IOCTL_CYGETMON = CYGETMON;
+-  unsigned IOCTL_CYGETTHRESH = CYGETTHRESH;
+-  unsigned IOCTL_CYGETTIMEOUT = CYGETTIMEOUT;
+-  unsigned IOCTL_CYSETDEFTHRESH = CYSETDEFTHRESH;
+-  unsigned IOCTL_CYSETDEFTIMEOUT = CYSETDEFTIMEOUT;
+-  unsigned IOCTL_CYSETTHRESH = CYSETTHRESH;
+-  unsigned IOCTL_CYSETTIMEOUT = CYSETTIMEOUT;
+   unsigned IOCTL_EQL_EMANCIPATE = EQL_EMANCIPATE;
+   unsigned IOCTL_EQL_ENSLAVE = EQL_ENSLAVE;
+   unsigned IOCTL_EQL_GETMASTRCFG = EQL_GETMASTRCFG;
+--- a/lib/sanitizer_common/sanitizer_platform_limits_posix.h
++++ b/lib/sanitizer_common/sanitizer_platform_limits_posix.h
+@@ -983,7 +983,6 @@ extern unsigned struct_vt_mode_sz;
+ 
+ #if SANITIZER_LINUX && !SANITIZER_ANDROID
+ extern unsigned struct_ax25_parms_struct_sz;
+-extern unsigned struct_cyclades_monitor_sz;
+ extern unsigned struct_input_keymap_entry_sz;
+ extern unsigned struct_ipx_config_data_sz;
+ extern unsigned struct_kbdiacrs_sz;
+@@ -1328,15 +1327,6 @@ extern unsigned IOCTL_VT_WAITACTIVE;
+ #endif  // SANITIZER_LINUX
+ 
+ #if SANITIZER_LINUX && !SANITIZER_ANDROID
+-extern unsigned IOCTL_CYGETDEFTHRESH;
+-extern unsigned IOCTL_CYGETDEFTIMEOUT;
+-extern unsigned IOCTL_CYGETMON;
+-extern unsigned IOCTL_CYGETTHRESH;
+-extern unsigned IOCTL_CYGETTIMEOUT;
+-extern unsigned IOCTL_CYSETDEFTHRESH;
+-extern unsigned IOCTL_CYSETDEFTIMEOUT;
+-extern unsigned IOCTL_CYSETTHRESH;
+-extern unsigned IOCTL_CYSETTIMEOUT;
+ extern unsigned IOCTL_EQL_EMANCIPATE;
+ extern unsigned IOCTL_EQL_ENSLAVE;
+ extern unsigned IOCTL_EQL_GETMASTRCFG;
diff --git a/pkgs/development/compilers/llvm/common/compiler-rt/libsanitizer-no-cyclades-9.patch b/pkgs/development/compilers/llvm/common/compiler-rt/libsanitizer-no-cyclades-9.patch
new file mode 100644
index 0000000000000..7ef02a1692691
--- /dev/null
+++ b/pkgs/development/compilers/llvm/common/compiler-rt/libsanitizer-no-cyclades-9.patch
@@ -0,0 +1,80 @@
+https://github.com/llvm/llvm-project/commit/68d5235cb58f988c71b403334cd9482d663841ab.patch
+https://reviews.llvm.org/D102059
+--- a/lib/sanitizer_common/sanitizer_common_interceptors_ioctl.inc
++++ b/lib/sanitizer_common/sanitizer_common_interceptors_ioctl.inc
+@@ -370,15 +370,6 @@ static void ioctl_table_fill() {
+ 
+ #if SANITIZER_GLIBC
+   // _(SIOCDEVPLIP, WRITE, struct_ifreq_sz); // the same as EQL_ENSLAVE
+-  _(CYGETDEFTHRESH, WRITE, sizeof(int));
+-  _(CYGETDEFTIMEOUT, WRITE, sizeof(int));
+-  _(CYGETMON, WRITE, struct_cyclades_monitor_sz);
+-  _(CYGETTHRESH, WRITE, sizeof(int));
+-  _(CYGETTIMEOUT, WRITE, sizeof(int));
+-  _(CYSETDEFTHRESH, NONE, 0);
+-  _(CYSETDEFTIMEOUT, NONE, 0);
+-  _(CYSETTHRESH, NONE, 0);
+-  _(CYSETTIMEOUT, NONE, 0);
+   _(EQL_EMANCIPATE, WRITE, struct_ifreq_sz);
+   _(EQL_ENSLAVE, WRITE, struct_ifreq_sz);
+   _(EQL_GETMASTRCFG, WRITE, struct_ifreq_sz);
+--- a/lib/sanitizer_common/sanitizer_platform_limits_posix.cc
++++ b/lib/sanitizer_common/sanitizer_platform_limits_posix.cc
+@@ -143,7 +143,6 @@ typedef struct user_fpregs elf_fpregset_t;
+ # include <sys/procfs.h>
+ #endif
+ #include <sys/user.h>
+-#include <linux/cyclades.h>
+ #include <linux/if_eql.h>
+ #include <linux/if_plip.h>
+ #include <linux/lp.h>
+@@ -460,7 +459,6 @@ unsigned struct_ElfW_Phdr_sz = sizeof(Elf_Phdr);
+ 
+ #if SANITIZER_GLIBC
+   unsigned struct_ax25_parms_struct_sz = sizeof(struct ax25_parms_struct);
+-  unsigned struct_cyclades_monitor_sz = sizeof(struct cyclades_monitor);
+ #if EV_VERSION > (0x010000)
+   unsigned struct_input_keymap_entry_sz = sizeof(struct input_keymap_entry);
+ #else
+@@ -824,15 +822,6 @@ unsigned struct_ElfW_Phdr_sz = sizeof(Elf_Phdr);
+ #endif // SANITIZER_LINUX
+ 
+ #if SANITIZER_LINUX && !SANITIZER_ANDROID
+-  unsigned IOCTL_CYGETDEFTHRESH = CYGETDEFTHRESH;
+-  unsigned IOCTL_CYGETDEFTIMEOUT = CYGETDEFTIMEOUT;
+-  unsigned IOCTL_CYGETMON = CYGETMON;
+-  unsigned IOCTL_CYGETTHRESH = CYGETTHRESH;
+-  unsigned IOCTL_CYGETTIMEOUT = CYGETTIMEOUT;
+-  unsigned IOCTL_CYSETDEFTHRESH = CYSETDEFTHRESH;
+-  unsigned IOCTL_CYSETDEFTIMEOUT = CYSETDEFTIMEOUT;
+-  unsigned IOCTL_CYSETTHRESH = CYSETTHRESH;
+-  unsigned IOCTL_CYSETTIMEOUT = CYSETTIMEOUT;
+   unsigned IOCTL_EQL_EMANCIPATE = EQL_EMANCIPATE;
+   unsigned IOCTL_EQL_ENSLAVE = EQL_ENSLAVE;
+   unsigned IOCTL_EQL_GETMASTRCFG = EQL_GETMASTRCFG;
+--- a/lib/sanitizer_common/sanitizer_platform_limits_posix.h
++++ b/lib/sanitizer_common/sanitizer_platform_limits_posix.h
+@@ -983,7 +983,6 @@ extern unsigned struct_vt_mode_sz;
+ 
+ #if SANITIZER_LINUX && !SANITIZER_ANDROID
+   extern unsigned struct_ax25_parms_struct_sz;
+-  extern unsigned struct_cyclades_monitor_sz;
+   extern unsigned struct_input_keymap_entry_sz;
+   extern unsigned struct_ipx_config_data_sz;
+   extern unsigned struct_kbdiacrs_sz;
+@@ -1328,15 +1327,6 @@ extern unsigned IOCTL_VT_WAITACTIVE;
+ #endif  // SANITIZER_LINUX
+ 
+ #if SANITIZER_LINUX && !SANITIZER_ANDROID
+-  extern unsigned IOCTL_CYGETDEFTHRESH;
+-  extern unsigned IOCTL_CYGETDEFTIMEOUT;
+-  extern unsigned IOCTL_CYGETMON;
+-  extern unsigned IOCTL_CYGETTHRESH;
+-  extern unsigned IOCTL_CYGETTIMEOUT;
+-  extern unsigned IOCTL_CYSETDEFTHRESH;
+-  extern unsigned IOCTL_CYSETDEFTIMEOUT;
+-  extern unsigned IOCTL_CYSETTHRESH;
+-  extern unsigned IOCTL_CYSETTIMEOUT;
+   extern unsigned IOCTL_EQL_EMANCIPATE;
+   extern unsigned IOCTL_EQL_ENSLAVE;
+   extern unsigned IOCTL_EQL_GETMASTRCFG;
diff --git a/pkgs/development/compilers/llvm/rocm/compiler-rt/default.nix b/pkgs/development/compilers/llvm/rocm/compiler-rt/default.nix
index cd277f5149d95..65a45fdae6351 100644
--- a/pkgs/development/compilers/llvm/rocm/compiler-rt/default.nix
+++ b/pkgs/development/compilers/llvm/rocm/compiler-rt/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, version, src, cmake, python3, llvm, libcxxabi }:
+{ stdenv, lib, version, src, cmake, python3, llvm, libcxxabi, fetchpatch }:
 stdenv.mkDerivation rec {
   pname = "compiler-rt";
   inherit version src;
@@ -31,7 +31,13 @@ stdenv.mkDerivation rec {
 
   patches = [
     ./compiler-rt-codesign.patch # Revert compiler-rt commit that makes codesign mandatory
-  ];
+    (fetchpatch {
+      name = "libsanitizer-no-cyclades-rocm.patch";
+      url = "https://reviews.llvm.org/file/data/nrhbpc5axblqwx2xyyzv/PHID-FILE-wwcpjvquusomoddmqcwo/file";
+      sha256 = "sha256-PMMSLr2zHuNDn1OWqumqHwB74ktJSHxhJWkqEKB7Z64=";
+      stripLen = 1;
+     })
+    ];
 
 
   # TSAN requires XPC on Darwin, which we have no public/free source files for. We can depend on the Apple frameworks
diff --git a/pkgs/development/coq-modules/StructTact/default.nix b/pkgs/development/coq-modules/StructTact/default.nix
index 9770b9fb9c45a..08976c6898930 100644
--- a/pkgs/development/coq-modules/StructTact/default.nix
+++ b/pkgs/development/coq-modules/StructTact/default.nix
@@ -4,7 +4,12 @@ with lib; mkCoqDerivation {
   pname = "StructTact";
   owner = "uwplse";
   inherit version;
-  defaultVersion = if versions.isGe "8.5" coq.coq-version then "20181102" else null;
+  defaultVersion = with versions; switch coq.coq-version [
+    { case = range "8.6" "8.14"; out = "20210328"; }
+    { case = range "8.5" "8.13"; out = "20181102"; }
+  ] null;
+  release."20210328".rev =    "179bd5312e9d8b63fc3f4071c628cddfc496d741";
+  release."20210328".sha256 = "sha256:1y5r1zm3hli10ah6lnj7n8hxad6rb6rgldd0g7m2fjibzvwqzhdg";
   release."20181102".rev =    "82a85b7ec07e71fa6b30cfc05f6a7bfb09ef2510";
   release."20181102".sha256 = "08zry20flgj7qq37xk32kzmg4fg6d4wi9m7pf9aph8fd3j2a0b5v";
   preConfigure = "patchShebangs ./configure";
diff --git a/pkgs/development/coq-modules/Verdi/default.nix b/pkgs/development/coq-modules/Verdi/default.nix
index d3769eb2c4dbb..2701cf6f04c43 100644
--- a/pkgs/development/coq-modules/Verdi/default.nix
+++ b/pkgs/development/coq-modules/Verdi/default.nix
@@ -6,9 +6,12 @@ with lib; mkCoqDerivation {
   owner = "uwplse";
   inherit version;
   defaultVersion = with versions; switch coq.coq-version [
-    { case = isGe "8.7"; out = "20200131"; }
-    { case = isEq "8.6"; out = "20181102"; }
+    { case = range "8.7" "8.14"; out = "20210524"; }
+    { case = range "8.7" "8.13"; out = "20200131"; }
+    { case = "8.6"; out = "20181102"; }
   ] null;
+  release."20210524".rev    = "54597d8ac7ab7dd4dae683f651237644bf77701e";
+  release."20210524".sha256 = "sha256:05wb0km2jkhvi8807glxk9fi1kll4lwisiyzkxhqvymz4x6v8xqv";
   release."20200131".rev    = "fdb4ede19d2150c254f0ebcfbed4fb9547a734b0";
   release."20200131".sha256 = "1a2k19f9q5k5djbxplqmmpwck49kw3lrm3aax920h4yb40czkd8m";
   release."20181102".rev    = "25b79cf1be5527ab8dc1b8314fcee93e76a2e564";
diff --git a/pkgs/development/haskell-modules/configuration-common.nix b/pkgs/development/haskell-modules/configuration-common.nix
index 77716828865f3..ad151c0bf952f 100644
--- a/pkgs/development/haskell-modules/configuration-common.nix
+++ b/pkgs/development/haskell-modules/configuration-common.nix
@@ -1477,7 +1477,11 @@ self: super: {
 
   hercules-ci-cli = generateOptparseApplicativeCompletion "hci" (
     # See hercules-ci-optparse-applicative in non-hackage-packages.nix.
-    addBuildDepend (unmarkBroken super.hercules-ci-cli) super.hercules-ci-optparse-applicative
+    addBuildDepend
+      (overrideCabal
+        (unmarkBroken super.hercules-ci-cli)
+        (drv: { hydraPlatforms = [ super.hercules-ci-cli.meta.platforms ]; }))
+      super.hercules-ci-optparse-applicative
   );
 
   # Readline uses Distribution.Simple from Cabal 2, in a way that is not
diff --git a/pkgs/development/interpreters/python/cpython/default.nix b/pkgs/development/interpreters/python/cpython/default.nix
index 353535ed6823f..7bb2bb288931f 100644
--- a/pkgs/development/interpreters/python/cpython/default.nix
+++ b/pkgs/development/interpreters/python/cpython/default.nix
@@ -45,9 +45,7 @@
 # enableLTO is a subset of the enableOptimizations flag that doesn't harm reproducibility.
 # enabling LTO on 32bit arch causes downstream packages to fail when linking
 # enabling LTO on *-darwin causes python3 to fail when linking.
-# enabling LTO with musl and dynamic linking fails with a linker error although it should
-# be possible as alpine is doing it: https://github.com/alpinelinux/aports/blob/a8ccb04668c7729e0f0db6c6ff5f25d7519e779b/main/python3/APKBUILD#L82
-, enableLTO ? stdenv.is64bit && stdenv.isLinux && !(stdenv.hostPlatform.isMusl && !stdenv.hostPlatform.isStatic)
+, enableLTO ? stdenv.is64bit && stdenv.isLinux
 , reproducibleBuild ? false
 , pythonAttr ? "python${sourceVersion.major}${sourceVersion.minor}"
 }:
diff --git a/pkgs/development/libraries/eigen/default.nix b/pkgs/development/libraries/eigen/default.nix
index 3718058042104..18fe7450d5080 100644
--- a/pkgs/development/libraries/eigen/default.nix
+++ b/pkgs/development/libraries/eigen/default.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "eigen";
-  version = "3.3.9";
+  version = "3.4.0";
 
   src = fetchFromGitLab {
     owner = "libeigen";
     repo = pname;
     rev = version;
-    sha256 = "sha256-JMIG7CLMndUsECfbKpXE3BtVFuAjn+CZvf8GXZpLkFQ=";
+    sha256 = "sha256-1/4xMetKMDOgZgzz3WMxfHUEpmdAm52RqZvz6i0mLEw=";
   };
 
   patches = [
diff --git a/pkgs/development/libraries/eigen/include-dir.patch b/pkgs/development/libraries/eigen/include-dir.patch
index 42f8e189c0b7f..9928bbdbed1b1 100644
--- a/pkgs/development/libraries/eigen/include-dir.patch
+++ b/pkgs/development/libraries/eigen/include-dir.patch
@@ -1,23 +1,22 @@
 --- a/CMakeLists.txt
 +++ b/CMakeLists.txt
-@@ -1,6 +1,6 @@
- project(Eigen3)
- 
--cmake_minimum_required(VERSION 2.8.5)
-+cmake_minimum_required(VERSION 3.7)
+@@ -1,5 +1,5 @@
+ # cmake_minimum_require must be the first command of the file
+-cmake_minimum_required(VERSION 3.5.0)
++cmake_minimum_required(VERSION 3.7.0)
  
- # guard against in-source builds
+ project(Eigen3)
  
-@@ -407,7 +407,7 @@ set(PKGCONFIG_INSTALL_DIR
-     CACHE STRING "The directory relative to CMAKE_PREFIX_PATH where eigen3.pc is installed"
+@@ -443,7 +443,7 @@ set(PKGCONFIG_INSTALL_DIR
+     CACHE PATH "The directory relative to CMAKE_INSTALL_PREFIX where eigen3.pc is installed"
      )
  
 -foreach(var INCLUDE_INSTALL_DIR CMAKEPACKAGE_INSTALL_DIR PKGCONFIG_INSTALL_DIR)
 +foreach(var CMAKEPACKAGE_INSTALL_DIR PKGCONFIG_INSTALL_DIR)
+   # If an absolute path is specified, make it relative to "{CMAKE_INSTALL_PREFIX}".
    if(IS_ABSOLUTE "${${var}}")
-     message(FATAL_ERROR "${var} must be relative to CMAKE_PREFIX_PATH. Got: ${${var}}")
-   endif()
-@@ -429,13 +429,6 @@ install(FILES
+     file(RELATIVE_PATH "${var}" "${CMAKE_INSTALL_PREFIX}" "${${var}}")
+@@ -466,13 +466,6 @@ install(FILES
    DESTINATION ${INCLUDE_INSTALL_DIR} COMPONENT Devel
    )
  
@@ -28,10 +27,10 @@
 -        )
 -endif()
 -
- add_subdirectory(Eigen)
+ install(DIRECTORY Eigen DESTINATION ${INCLUDE_INSTALL_DIR} COMPONENT Devel)
  
- add_subdirectory(doc EXCLUDE_FROM_ALL)
-@@ -531,8 +524,15 @@ set ( EIGEN_VERSION_MAJOR  ${EIGEN_WORLD_VERSION} )
+ 
+@@ -593,8 +586,15 @@ set ( EIGEN_VERSION_MAJOR  ${EIGEN_WORLD_VERSION} )
  set ( EIGEN_VERSION_MINOR  ${EIGEN_MAJOR_VERSION} )
  set ( EIGEN_VERSION_PATCH  ${EIGEN_MINOR_VERSION} )
  set ( EIGEN_DEFINITIONS "")
@@ -46,8 +45,8 @@
 +        )
 +endif()
  
- # Interface libraries require at least CMake 3.0
- if (NOT CMAKE_VERSION VERSION_LESS 3.0)
+ include (CMakePackageConfigHelpers)
+ 
 --- a/eigen3.pc.in
 +++ b/eigen3.pc.in
 @@ -6,4 +6,4 @@ Description: A C++ template library for linear algebra: vectors, matrices, and r
diff --git a/pkgs/development/libraries/freeglut/default.nix b/pkgs/development/libraries/freeglut/default.nix
index ecdc1c19ff14f..0e81e2188af38 100644
--- a/pkgs/development/libraries/freeglut/default.nix
+++ b/pkgs/development/libraries/freeglut/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, libXi, libXrandr, libXxf86vm, libGL, libGLU, xlibsWrapper, cmake }:
+{ lib, stdenv, fetchurl, fetchpatch, libXi, libXrandr, libXxf86vm, libGL, libGLU, xlibsWrapper, cmake }:
 
 stdenv.mkDerivation rec {
   pname = "freeglut";
@@ -9,6 +9,15 @@ stdenv.mkDerivation rec {
     sha256 = "0s6sk49q8ijgbsrrryb7dzqx2fa744jhx1wck5cz5jia2010w06l";
   };
 
+  patches = [
+    (fetchpatch {
+      # upstream build fix against -fno-common compilers like >=gcc-10
+      url = "https://github.com/dcnieho/FreeGLUT/commit/b9998bbc1e1c329f6bf69c24606a2be7a4973b8c.patch";
+      sha256 = "0j43vrnm22mz3r3c43szgcnil19cx9vcydzky9gwzqlyacr51swd";
+      stripLen = 2;
+    })
+  ];
+
   outputs = [ "out" "dev" ];
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/gd/default.nix b/pkgs/development/libraries/gd/default.nix
index 36a9309560335..3a64cc5639798 100644
--- a/pkgs/development/libraries/gd/default.nix
+++ b/pkgs/development/libraries/gd/default.nix
@@ -14,25 +14,19 @@
 
 stdenv.mkDerivation rec {
   pname = "gd";
-  version = "2.3.0";
+  version = "2.3.2";
 
   src = fetchurl {
     url = "https://github.com/libgd/libgd/releases/download/${pname}-${version}/libgd-${version}.tar.xz";
-    sha256 = "0n5czhxzinvjvmhkf5l9fwjdx5ip69k5k7pj6zwb6zs1k9dibngc";
+    sha256 = "1yypywkh8vphcy4qqpf51kxpb0a3r7rjqk3fc61rpn70hiq092j7";
   };
 
   hardeningDisable = [ "format" ];
   patches = [
-    # Fixes an issue where some other packages would fail to build
-    # their documentation with an error like:
-    # "Error: Problem doing text layout"
-    #
-    # Can be removed if Wayland can still be built successfully with
-    # documentation.
     (fetchpatch {
-      url = "https://github.com/libgd/libgd/commit/3dd0e308cbd2c24fde2fc9e9b707181252a2de95.patch";
-      excludes = [ "tests/gdimagestringft/.gitignore" ];
-      sha256 = "12iqlanl9czig9d7c3rvizrigw2iacimnmimfcny392dv9iazhl1";
+      name = "CVE-2021-40812.partial.patch";
+      url = "https://github.com/libgd/libgd/commit/6f5136821be86e7068fcdf651ae9420b5d42e9a9.patch";
+      sha256 = "11rvhd23bl05ksj8z39hwrhqqjm66svr4hl3y230wrc64rvnd2d2";
     })
   ];
 
diff --git a/pkgs/development/libraries/glib/default.nix b/pkgs/development/libraries/glib/default.nix
index edb37d2ddd325..679a91d1bc3f5 100644
--- a/pkgs/development/libraries/glib/default.nix
+++ b/pkgs/development/libraries/glib/default.nix
@@ -134,8 +134,6 @@ stdenv.mkDerivation rec {
     "-DG_DISABLE_CAST_CHECKS"
   ];
 
-  hardeningDisable = [ "pie" ];
-
   postPatch = ''
     chmod +x gio/tests/gengiotypefuncs.py
     patchShebangs gio/tests/gengiotypefuncs.py
diff --git a/pkgs/development/libraries/glibc/common.nix b/pkgs/development/libraries/glibc/common.nix
index fe8fd6d80c6dd..a715ba752ec1b 100644
--- a/pkgs/development/libraries/glibc/common.nix
+++ b/pkgs/development/libraries/glibc/common.nix
@@ -120,6 +120,9 @@ stdenv.mkDerivation ({
       })
 
       ./fix-x64-abi.patch
+
+      /* https://github.com/NixOS/nixpkgs/pull/137601 */
+      ./nix-nss-open-files.patch
     ]
     ++ lib.optional stdenv.hostPlatform.isMusl ./fix-rpc-types-musl-conflicts.patch
     ++ lib.optional stdenv.buildPlatform.isDarwin ./darwin-cross-build.patch;
diff --git a/pkgs/development/libraries/glibc/nix-nss-open-files.patch b/pkgs/development/libraries/glibc/nix-nss-open-files.patch
new file mode 100644
index 0000000000000..9a515c4662e2f
--- /dev/null
+++ b/pkgs/development/libraries/glibc/nix-nss-open-files.patch
@@ -0,0 +1,51 @@
+diff --git a/nss/nss_files/files-XXX.c b/nss/nss_files/files-XXX.c
+index 1db9e46127..3a567e0224 100644
+--- a/nss/nss_files/files-XXX.c
++++ b/nss/nss_files/files-XXX.c
+@@ -75,8 +75,20 @@ internal_setent (FILE **stream)
+ 
+   if (*stream == NULL)
+     {
+-      *stream = __nss_files_fopen (DATAFILE);
+-
++      const char *file = DATAFILE;
++
++      #ifdef NIX_DATAFILE
++      // use the Nix environment variable such as `NIX_ETC_PROTOCOLS`
++      char *path = secure_getenv (NIX_DATAFILE);
++
++      // if the environment variable is set, then read from the /nix/store entry instead
++      if (path && path[0]) {
++        file = path;
++      }
++      #endif
++      
++      *stream = __nss_files_fopen (file);
++    
+       if (*stream == NULL)
+ 	status = errno == EAGAIN ? NSS_STATUS_TRYAGAIN : NSS_STATUS_UNAVAIL;
+     }
+diff --git a/nss/nss_files/files-proto.c b/nss/nss_files/files-proto.c
+index c30bedc0aa..b321e68d3c 100644
+--- a/nss/nss_files/files-proto.c
++++ b/nss/nss_files/files-proto.c
+@@ -23,6 +23,7 @@ NSS_DECLARE_MODULE_FUNCTIONS (files)
+ 
+ #define ENTNAME		protoent
+ #define DATABASE	"protocols"
++#define NIX_DATAFILE "NIX_ETC_PROTOCOLS"
+ 
+ struct protoent_data {};
+ 
+diff --git a/nss/nss_files/files-service.c b/nss/nss_files/files-service.c
+index bfc2590699..0bff36aee5 100644
+--- a/nss/nss_files/files-service.c
++++ b/nss/nss_files/files-service.c
+@@ -24,6 +24,7 @@ NSS_DECLARE_MODULE_FUNCTIONS (files)
+ 
+ #define ENTNAME		servent
+ #define DATABASE	"services"
++#define NIX_DATAFILE "NIX_ETC_SERVICES"
+ 
+ struct servent_data {};
+ 
diff --git a/pkgs/development/libraries/intel-gmmlib/default.nix b/pkgs/development/libraries/intel-gmmlib/default.nix
index 5d7e04e759662..de9bf8d972923 100644
--- a/pkgs/development/libraries/intel-gmmlib/default.nix
+++ b/pkgs/development/libraries/intel-gmmlib/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
   src = fetchFromGitHub {
     owner = "intel";
     repo = "gmmlib";
-    rev = "${pname}-${version}";
+    rev = "intel-gmmlib-${version}";
     sha256 = "0dzqfgbd0fxl8rxgf5nmj1jd4izzaqfb0s53l96qwz1j57q5ybj5";
   };
 
@@ -27,6 +27,6 @@ stdenv.mkDerivation rec {
       OpenCL(TM) and the Intel(R) Media Driver for VAAPI.
     '';
     platforms = [ "x86_64-linux" "i686-linux" ];
-    maintainers = with maintainers; [ primeos ];
+    maintainers = with maintainers; [ primeos SuperSandro2000 ];
   };
 }
diff --git a/pkgs/development/libraries/intel-media-driver/default.nix b/pkgs/development/libraries/intel-media-driver/default.nix
index a3825df47a97b..c6271b13a855b 100644
--- a/pkgs/development/libraries/intel-media-driver/default.nix
+++ b/pkgs/development/libraries/intel-media-driver/default.nix
@@ -1,7 +1,14 @@
-{ lib, stdenv, fetchFromGitHub
-, cmake, pkg-config
-, libva, libpciaccess, intel-gmmlib
-, enableX11 ? stdenv.isLinux, libX11
+{ lib
+, stdenv
+, fetchFromGitHub
+, fetchpatch
+, cmake
+, pkg-config
+, libva
+, libpciaccess
+, intel-gmmlib
+, enableX11 ? stdenv.isLinux
+, libX11
 }:
 
 stdenv.mkDerivation rec {
@@ -11,12 +18,20 @@ stdenv.mkDerivation rec {
   outputs = [ "out" "dev" ];
 
   src = fetchFromGitHub {
-    owner  = "intel";
-    repo   = "media-driver";
-    rev    = "intel-media-${version}";
+    owner = "intel";
+    repo = "media-driver";
+    rev = "intel-media-${version}";
     sha256 = "1ch1bvqg6p0i7ahblhy0h9c43y2mfhqb25v1s344iqsrywwcpzzr";
   };
 
+  patches = [
+    # fix platform detection
+    (fetchpatch {
+      url = "https://salsa.debian.org/multimedia-team/intel-media-driver-non-free/-/raw/master/debian/patches/0002-Remove-settings-based-on-ARCH.patch";
+      sha256 = "sha256-f4M0CPtAVf5l2ZwfgTaoPw7sPuAP/Uxhm5JSHEGhKT0=";
+    })
+  ];
+
   cmakeFlags = [
     "-DINSTALL_DRIVER_SYSCONF=OFF"
     "-DLIBVA_DRIVERS_PATH=${placeholder "out"}/lib/dri"
@@ -24,6 +39,8 @@ stdenv.mkDerivation rec {
     "-DMEDIA_RUN_TEST_SUITE=OFF"
   ];
 
+  NIX_CFLAGS_COMPILE = lib.optionalString (stdenv.hostPlatform.system == "i686-linux") "-D_FILE_OFFSET_BITS=64";
+
   nativeBuildInputs = [ cmake pkg-config ];
 
   buildInputs = [ libva libpciaccess intel-gmmlib ]
@@ -45,6 +62,6 @@ stdenv.mkDerivation rec {
     changelog = "https://github.com/intel/media-driver/releases/tag/intel-media-${version}";
     license = with licenses; [ bsd3 mit ];
     platforms = platforms.linux;
-    maintainers = with maintainers; [ primeos jfrankenau ];
+    maintainers = with maintainers; [ primeos jfrankenau SuperSandro2000 ];
   };
 }
diff --git a/pkgs/development/libraries/libiscsi/default.nix b/pkgs/development/libraries/libiscsi/default.nix
index 6dd23d219d957..3cc2e0eee8c3c 100644
--- a/pkgs/development/libraries/libiscsi/default.nix
+++ b/pkgs/development/libraries/libiscsi/default.nix
@@ -13,10 +13,6 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ autoreconfHook ];
 
-  # This can be removed after >=1.20.0, or if the build suceeds with
-  # pie enabled (default on Musl).
-  hardeningDisable = [ "pie" ];
-
   # This problem is gone on libiscsi master.
   NIX_CFLAGS_COMPILE =
     lib.optional stdenv.hostPlatform.is32bit "-Wno-error=sign-compare";
diff --git a/pkgs/development/libraries/libomxil-bellagio/default.nix b/pkgs/development/libraries/libomxil-bellagio/default.nix
index 5e3b0c6798a64..22a6de9fd956f 100644
--- a/pkgs/development/libraries/libomxil-bellagio/default.nix
+++ b/pkgs/development/libraries/libomxil-bellagio/default.nix
@@ -12,7 +12,10 @@ stdenv.mkDerivation rec {
   configureFlags =
     lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [ "ac_cv_func_malloc_0_nonnull=yes" ];
 
-  patches = [ ./fedora-fixes.patch ];
+  patches = [
+    ./fedora-fixes.patch
+    ./fno-common.patch
+  ];
 
   doCheck = false; # fails
 
diff --git a/pkgs/development/libraries/libomxil-bellagio/fno-common.patch b/pkgs/development/libraries/libomxil-bellagio/fno-common.patch
new file mode 100644
index 0000000000000..be70391adaae5
--- /dev/null
+++ b/pkgs/development/libraries/libomxil-bellagio/fno-common.patch
@@ -0,0 +1,32 @@
+Fix build faiure on gcc-10 (defaults to -fno-common).
+--- a/src/omx_reference_resource_manager.c
++++ b/src/omx_reference_resource_manager.c
+@@ -30,6 +30,11 @@
+ #include "base/omx_base_component.h"
+ #include "queue.h"
+ 
++int globalIndex;
++NameIndexType *listOfcomponentRegistered;
++ComponentListType **globalComponentList;
++ComponentListType **globalWaitingComponentList;
++
+ /**
+  * This is the static base pointer of the list
+  */
+--- a/src/omx_reference_resource_manager.h
++++ b/src/omx_reference_resource_manager.h
+@@ -49,10 +49,10 @@ struct NameIndexType {
+ };
+ 
+ 
+-int globalIndex;
+-NameIndexType *listOfcomponentRegistered;
+-ComponentListType **globalComponentList;
+-ComponentListType **globalWaitingComponentList;
++extern int globalIndex;
++extern NameIndexType *listOfcomponentRegistered;
++extern ComponentListType **globalComponentList;
++extern ComponentListType **globalWaitingComponentList;
+ 
+ OMX_ERRORTYPE RM_RegisterComponent(char *name, int max_components);
+ OMX_ERRORTYPE addElemToList(ComponentListType **list, OMX_COMPONENTTYPE *openmaxStandComp, int index, OMX_BOOL bIsWaiting);
diff --git a/pkgs/development/libraries/libpsl/default.nix b/pkgs/development/libraries/libpsl/default.nix
index 85afe93ea7a79..562820bed6a49 100644
--- a/pkgs/development/libraries/libpsl/default.nix
+++ b/pkgs/development/libraries/libpsl/default.nix
@@ -15,7 +15,10 @@
 }:
 
 let
-  enableValgrindTests = !stdenv.isDarwin && lib.meta.availableOn stdenv.hostPlatform valgrind;
+  enableValgrindTests = !stdenv.isDarwin && lib.meta.availableOn stdenv.hostPlatform valgrind
+    # Apparently valgrind doesn't support some new ARM features on (some) Hydra machines:
+    #  VEX: Mismatch detected between RDMA and atomics features.
+    && !stdenv.isAarch64;
 in stdenv.mkDerivation rec {
   pname = "libpsl";
   version = "0.21.0";
diff --git a/pkgs/development/libraries/libunwind/default.nix b/pkgs/development/libraries/libunwind/default.nix
index bda7f72a5576c..643752da1dc57 100644
--- a/pkgs/development/libraries/libunwind/default.nix
+++ b/pkgs/development/libraries/libunwind/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchurl, autoreconfHook, xz, coreutils }:
+{ stdenv, lib, fetchurl, fetchpatch, autoreconfHook, xz, coreutils }:
 
 stdenv.mkDerivation rec {
   pname = "libunwind";
@@ -9,7 +9,15 @@ stdenv.mkDerivation rec {
     sha256 = "0dc46flppifrv2z0mrdqi60165ghxm1wk0g47vcbyzjdplqwjnfz";
   };
 
-  patches = [ ./backtrace-only-with-glibc.patch ];
+  patches = [
+    ./backtrace-only-with-glibc.patch
+
+    (fetchpatch {
+      # upstream build fix against -fno-common compilers like >=gcc-10
+      url = "https://github.com/libunwind/libunwind/commit/29e17d8d2ccbca07c423e3089a6d5ae8a1c9cb6e.patch";
+      sha256 = "1angwfq6h0jskg6zx8g6w9min38g5mgmrcbppcy5hqn59cgsxbw0";
+    })
+  ];
 
   postPatch = lib.optionalString stdenv.hostPlatform.isMusl ''
     substituteInPlace configure.ac --replace "-lgcc_s" "-lgcc_eh"
diff --git a/pkgs/development/libraries/libva/default.nix b/pkgs/development/libraries/libva/default.nix
index 2d4186385193b..10f90a16c927a 100644
--- a/pkgs/development/libraries/libva/default.nix
+++ b/pkgs/development/libraries/libva/default.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libva" + lib.optionalString minimal "minimal";
-  version = "2.12.0";
+  version = "2.13.0";
 
   src = fetchFromGitHub {
     owner  = "intel";
     repo   = "libva";
     rev    = version;
-    sha256 = "1zfv4kjx0715sy62lkpv0s31f9xwy232z5zwqi5all4w1jr630i7";
+    sha256 = "0vsvli3xc0gqqp06p7wkm973lhr7c5qgnyz5jfjmf8kv75rajazp";
   };
 
   outputs = [ "dev" "out" ];
diff --git a/pkgs/development/libraries/mesa/default.nix b/pkgs/development/libraries/mesa/default.nix
index 81d553547c3f8..1d7b73a54196f 100644
--- a/pkgs/development/libraries/mesa/default.nix
+++ b/pkgs/development/libraries/mesa/default.nix
@@ -13,6 +13,8 @@
 , withValgrind ? !stdenv.isDarwin && lib.meta.availableOn stdenv.hostPlatform valgrind-light, valgrind-light
 , enableGalliumNine ? stdenv.isLinux
 , enableOSMesa ? stdenv.isLinux
+, enableOpenCL ? stdenv.isLinux && stdenv.isx86_64
+, libclc
 }:
 
 /** Packaging design:
@@ -31,7 +33,7 @@ with lib;
 let
   # Release calendar: https://www.mesa3d.org/release-calendar.html
   # Release frequency: https://www.mesa3d.org/releasing.html#schedule
-  version = "21.2.2";
+  version = "21.2.3";
   branch  = versions.major version;
 
 self = stdenv.mkDerivation {
@@ -45,7 +47,7 @@ self = stdenv.mkDerivation {
       "ftp://ftp.freedesktop.org/pub/mesa/${version}/mesa-${version}.tar.xz"
       "ftp://ftp.freedesktop.org/pub/mesa/older-versions/${branch}.x/${version}/mesa-${version}.tar.xz"
     ];
-    sha256 = "1i75k6gh76f49vy6kksbsikf593jmgk6slqwbs1fs5s2jyzz3an4";
+    sha256 = "0x3ivd34j938js2iffzlvnlj4hwywxrscd8q1rvq894x2m52hibj";
   };
 
   # TODO:
@@ -53,7 +55,7 @@ self = stdenv.mkDerivation {
   #  ~35 MB in $drivers; watch https://launchpad.net/ubuntu/+source/mesa/+changelog
   patches = [
     ./missing-includes.patch # dev_t needs sys/stat.h, time_t needs time.h, etc.-- fixes build w/musl
-    ./opencl-install-dir.patch
+    ./opencl.patch
     ./disk_cache-include-dri-driver-path-in-cache-key.patch
     # Fix `-Werror=int-conversion` pthread warnings on musl.
     # TODO: Remove when https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/6121 is merged and available
@@ -88,7 +90,8 @@ self = stdenv.mkDerivation {
 
   outputs = [ "out" "dev" "drivers" ]
     ++ lib.optional enableOSMesa "osmesa"
-    ++ lib.optional stdenv.isLinux "driversdev";
+    ++ lib.optional stdenv.isLinux "driversdev"
+    ++ lib.optional enableOpenCL "opencl";
 
   # TODO: Figure out how to enable opencl without having a runtime dependency on clang
   mesonFlags = [
@@ -118,6 +121,9 @@ self = stdenv.mkDerivation {
     "-Dmicrosoft-clc=disabled" # Only relevant on Windows (OpenCL 1.2 API on top of D3D12)
   ] ++ optionals stdenv.isLinux [
     "-Dglvnd=true"
+  ] ++ optionals enableOpenCL [
+    "-Dgallium-opencl=icd" # Enable the gallium OpenCL frontend
+    "-Dclang-libdir=${llvmPackages.clang-unwrapped.lib}/lib"
   ];
 
   buildInputs = with xorg; [
@@ -128,6 +134,7 @@ self = stdenv.mkDerivation {
   ] ++ lib.optionals (elem "wayland" eglPlatforms) [ wayland wayland-protocols ]
     ++ lib.optionals stdenv.isLinux [ libomxil-bellagio libva-minimal ]
     ++ lib.optionals stdenv.isDarwin [ libunwind ]
+    ++ lib.optionals enableOpenCL [ libclc llvmPackages.clang llvmPackages.clang-unwrapped ]
     ++ lib.optional withValgrind valgrind-light;
 
   depsBuildBuild = [ pkg-config ];
@@ -162,7 +169,7 @@ self = stdenv.mkDerivation {
 
     if [ -n "$(shopt -s nullglob; echo "$out"/lib/lib*_mesa*)" ]; then
       # Move other drivers to a separate output
-      mv $out/lib/lib*_mesa* $drivers/lib
+      mv -t $drivers/lib $out/lib/lib*_mesa*
     fi
 
     # Update search path used by glvnd
@@ -175,6 +182,17 @@ self = stdenv.mkDerivation {
     for js in $drivers/share/vulkan/icd.d/*.json; do
       substituteInPlace "$js" --replace "$out" "$drivers"
     done
+  '' + optionalString enableOpenCL ''
+    # Move OpenCL stuff
+    mkdir -p $opencl/lib
+    mv -t "$opencl/lib/"     \
+      $out/lib/gallium-pipe   \
+      $out/lib/libMesaOpenCL*
+
+    # We construct our own .icd file that contains an absolute path.
+    rm -r $out/etc/OpenCL
+    mkdir -p $opencl/etc/OpenCL/vendors/
+    echo $opencl/lib/libMesaOpenCL.so > $opencl/etc/OpenCL/vendors/mesa.icd
   '' + lib.optionalString enableOSMesa ''
     # move libOSMesa to $osmesa, as it's relatively big
     mkdir -p $osmesa/lib
@@ -209,7 +227,10 @@ self = stdenv.mkDerivation {
     done
   '';
 
-  NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isDarwin "-fno-common";
+  NIX_CFLAGS_COMPILE = optionals stdenv.isDarwin [ "-fno-common" ] ++ lib.optionals enableOpenCL [
+    "-UPIPE_SEARCH_DIR"
+    "-DPIPE_SEARCH_DIR=\"${placeholder "opencl"}/lib/gallium-pipe\""
+  ];
 
   passthru = {
     inherit libdrm;
diff --git a/pkgs/development/libraries/mesa/opencl-install-dir.patch b/pkgs/development/libraries/mesa/opencl-install-dir.patch
deleted file mode 100644
index fe85d2c90bb24..0000000000000
--- a/pkgs/development/libraries/mesa/opencl-install-dir.patch
+++ /dev/null
@@ -1,12 +0,0 @@
-diff --git a/src/gallium/targets/opencl/meson.build b/src/gallium/targets/opencl/meson.build
-index 317ad8dab4a..5567308caf0 100644
---- a/src/gallium/targets/opencl/meson.build
-+++ b/src/gallium/targets/opencl/meson.build
-@@ -68,6 +68,6 @@ if with_opencl_icd
-     input : 'mesa.icd.in',
-     output : 'mesa.icd',
-     install : true,
--    install_dir : join_paths(get_option('sysconfdir'), 'OpenCL', 'vendors'),
-+    install_dir : join_paths(get_option('prefix'), 'etc', 'OpenCL', 'vendors'),
-   )
- endif
diff --git a/pkgs/development/libraries/mesa/opencl.patch b/pkgs/development/libraries/mesa/opencl.patch
new file mode 100644
index 0000000000000..ce6e3d575085b
--- /dev/null
+++ b/pkgs/development/libraries/mesa/opencl.patch
@@ -0,0 +1,70 @@
+diff --git a/meson_options.txt b/meson_options.txt
+index a7030aba31e..1d2d8814992 100644
+--- a/meson_options.txt
++++ b/meson_options.txt
+@@ -18,6 +18,12 @@
+ # OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ # SOFTWARE.
+ 
++option(
++  'clang-libdir',
++  type : 'string',
++  value : '',
++  description : 'Locations to search for clang libraries.'
++)
+ option(
+   'platforms',
+   type : 'array',
+diff --git a/src/gallium/targets/opencl/meson.build b/src/gallium/targets/opencl/meson.build
+index b77826b6e1e..14fa9ba7177 100644
+--- a/src/gallium/targets/opencl/meson.build
++++ b/src/gallium/targets/opencl/meson.build
+@@ -30,6 +30,7 @@ if with_ld_version_script
+ endif
+ 
+ llvm_libdir = dep_llvm.get_variable(cmake : 'LLVM_LIBRARY_DIR', configtool: 'libdir')
++clang_libdir = get_option('clang-libdir')
+ opencl_libname = with_opencl_icd ? 'MesaOpenCL' : 'OpenCL'
+ 
+ polly_dep = null_dep
+@@ -60,19 +61,19 @@ else
+ endif
+ if not (dep_clang.found() and dep_clang_usable)
+   dep_clang = [
+-    cpp.find_library('clangCodeGen', dirs : llvm_libdir),
+-    cpp.find_library('clangFrontendTool', dirs : llvm_libdir),
+-    cpp.find_library('clangFrontend', dirs : llvm_libdir),
+-    cpp.find_library('clangDriver', dirs : llvm_libdir),
+-    cpp.find_library('clangSerialization', dirs : llvm_libdir),
+-    cpp.find_library('clangParse', dirs : llvm_libdir),
+-    cpp.find_library('clangSema', dirs : llvm_libdir),
+-    cpp.find_library('clangAnalysis', dirs : llvm_libdir),
+-    cpp.find_library('clangAST', dirs : llvm_libdir),
+-    cpp.find_library('clangASTMatchers', dirs : llvm_libdir),
+-    cpp.find_library('clangEdit', dirs : llvm_libdir),
+-    cpp.find_library('clangLex', dirs : llvm_libdir),
+-    cpp.find_library('clangBasic', dirs : llvm_libdir),
++    cpp.find_library('clangCodeGen', dirs : clang_libdir),
++    cpp.find_library('clangFrontendTool', dirs : clang_libdir),
++    cpp.find_library('clangFrontend', dirs : clang_libdir),
++    cpp.find_library('clangDriver', dirs : clang_libdir),
++    cpp.find_library('clangSerialization', dirs : clang_libdir),
++    cpp.find_library('clangParse', dirs : clang_libdir),
++    cpp.find_library('clangSema', dirs : clang_libdir),
++    cpp.find_library('clangAnalysis', dirs : clang_libdir),
++    cpp.find_library('clangAST', dirs : clang_libdir),
++    cpp.find_library('clangASTMatchers', dirs : clang_libdir),
++    cpp.find_library('clangEdit', dirs : clang_libdir),
++    cpp.find_library('clangLex', dirs : clang_libdir),
++    cpp.find_library('clangBasic', dirs : clang_libdir),
+     polly_dep, polly_isl_dep,
+   ]
+   # check clang once more
+@@ -120,6 +121,6 @@ if with_opencl_icd
+     input : 'mesa.icd.in',
+     output : 'mesa.icd',
+     install : true,
+-    install_dir : join_paths(get_option('sysconfdir'), 'OpenCL', 'vendors'),
++    install_dir : join_paths(get_option('prefix'), 'etc', 'OpenCL', 'vendors'),
+   )
+ endif
diff --git a/pkgs/development/libraries/openexr/3.nix b/pkgs/development/libraries/openexr/3.nix
index ee5e849f2eae9..1fae66829065f 100644
--- a/pkgs/development/libraries/openexr/3.nix
+++ b/pkgs/development/libraries/openexr/3.nix
@@ -8,7 +8,7 @@
 
 stdenv.mkDerivation rec {
   pname = "openexr";
-  version = "3.1.1";
+  version = "3.1.2";
 
   outputs = [ "bin" "dev" "out" "doc" ];
 
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
     owner = "AcademySoftwareFoundation";
     repo = "openexr";
     rev = "v${version}";
-    sha256 = "1p0l07vfpb25fx6jcgk1747v8x9xgpifx4cvvgi3g2473wlx6pyb";
+    sha256 = "0vyclrrikphwkkpyjg8kzh3qzflzk3d6xsidgqllgfdgllr9wmgv";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/pcre2/default.nix b/pkgs/development/libraries/pcre2/default.nix
index 188fa9b16b7ef..dbf8f6b750f8a 100644
--- a/pkgs/development/libraries/pcre2/default.nix
+++ b/pkgs/development/libraries/pcre2/default.nix
@@ -1,30 +1,33 @@
-{ lib, stdenv, fetchurl }:
+{ lib
+, stdenv
+, fetchurl
+}:
 
 stdenv.mkDerivation rec {
   pname = "pcre2";
-  version = "10.36";
+  version = "10.37";
   src = fetchurl {
     url = "https://ftp.pcre.org/pub/pcre/${pname}-${version}.tar.bz2";
-    sha256 = "0p3699msps07p40g9426lvxa3b41rg7k2fn7qxl2jm0kh4kkkvx9";
+    hash = "sha256-TZWpbouAUpiTtFYr4SZI15i5V7G6Gq45YGu8KrlW0nA=";
   };
 
   # Disable jit on Apple Silicon, https://github.com/zherczeg/sljit/issues/51
   configureFlags = [
     "--enable-pcre2-16"
     "--enable-pcre2-32"
-  ] ++ lib.optional (!stdenv.hostPlatform.isRiscV && !(stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64)) "--enable-jit";
+  ] ++ lib.optional (!stdenv.hostPlatform.isRiscV &&
+                     !(stdenv.hostPlatform.isDarwin &&
+                       stdenv.hostPlatform.isAarch64)) "--enable-jit";
 
   outputs = [ "bin" "dev" "out" "doc" "man" "devdoc" ];
 
-  doCheck = false; # fails 1 out of 3 tests, looks like a bug
-
   postFixup = ''
     moveToOutput bin/pcre2-config "$dev"
   '';
 
   meta = with lib; {
-    description = "Perl Compatible Regular Expressions";
     homepage = "http://www.pcre.org/";
+    description = "Perl Compatible Regular Expressions";
     license = licenses.bsd3;
     maintainers = with maintainers; [ ttuegel ];
     platforms = platforms.all;
diff --git a/pkgs/development/libraries/qt-5/modules/qtbase.nix b/pkgs/development/libraries/qt-5/modules/qtbase.nix
index 3cb8a3e801cc5..0d82acc709297 100644
--- a/pkgs/development/libraries/qt-5/modules/qtbase.nix
+++ b/pkgs/development/libraries/qt-5/modules/qtbase.nix
@@ -11,7 +11,7 @@
 , libXcursor, libXext, libXi, libXrender, libinput, libjpeg, libpng
 , libxcb, libxkbcommon, libxml2, libxslt, openssl, pcre16, pcre2, sqlite, udev
 , xcbutil, xcbutilimage, xcbutilkeysyms, xcbutilrenderutil, xcbutilwm
-, zlib
+, zlib, at-spi2-core
 
   # optional dependencies
 , cups ? null, libmysqlclient ? null, postgresql ? null
@@ -68,7 +68,7 @@ stdenv.mkDerivation {
     ] ++ lib.optional libGLSupported libGL
   );
 
-  buildInputs = [ python3 ]
+  buildInputs = [ python3 at-spi2-core ]
     ++ lib.optionals (!stdenv.isDarwin)
     (
       [ libinput ]
@@ -84,6 +84,8 @@ stdenv.mkDerivation {
 
   propagatedNativeBuildInputs = [ lndir ];
 
+  enableParallelBuilding = true;
+
   outputs = [ "bin" "dev" "out" ];
 
   inherit patches;
diff --git a/pkgs/development/libraries/tpm2-tss/default.nix b/pkgs/development/libraries/tpm2-tss/default.nix
index 06e1ac9409a1c..5ab4ff3b413f3 100644
--- a/pkgs/development/libraries/tpm2-tss/default.nix
+++ b/pkgs/development/libraries/tpm2-tss/default.nix
@@ -26,11 +26,21 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [
     autoreconfHook autoconf-archive pkg-config doxygen perl
   ];
-  buildInputs = [ openssl json_c curl libgcrypt ];
+
+  # cmocka is checked / used(?) in the configure script
+  # when unit and/or integration testing is enabled
+  buildInputs = [ openssl json_c curl libgcrypt uthash ]
+    # cmocka doesn't build with pkgsStatic, and we don't need it anyway
+    # when tests are not run
+    ++ lib.optionals (stdenv.buildPlatform == stdenv.hostPlatform) [
+    cmocka
+  ];
+
   checkInputs = [
-    cmocka uthash ibm-sw-tpm2 iproute2 procps_pkg which
+    cmocka which openssl procps_pkg iproute2 ibm-sw-tpm2
   ];
 
+  strictDeps = true;
   preAutoreconf = "./bootstrap";
 
   enableParallelBuilding = true;
@@ -49,7 +59,7 @@ stdenv.mkDerivation rec {
       --replace '@PREFIX@' $out/lib
   '';
 
-  configureFlags = [
+  configureFlags = lib.optionals (stdenv.buildPlatform == stdenv.hostPlatform) [
     "--enable-unit"
     "--enable-integration"
   ];
diff --git a/pkgs/development/libraries/ucx/default.nix b/pkgs/development/libraries/ucx/default.nix
index 22d2b314b2a94..0bb3fe135d664 100644
--- a/pkgs/development/libraries/ucx/default.nix
+++ b/pkgs/development/libraries/ucx/default.nix
@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   pname = "ucx";
-  version = "1.11.1";
+  version = "1.11.2";
 
   src = fetchFromGitHub {
     owner = "openucx";
     repo = "ucx";
     rev = "v${version}";
-    sha256 = "07yyvb87i2f4w9rlvkracwzm133phwjw4zv9rs7xw6ql4pkrhrr3";
+    sha256 = "0a4rbgr3hn3h42krb7lasfidhqcavacbpp1pv66l4lvfc0gkwi2i";
   };
 
   nativeBuildInputs = [ autoreconfHook doxygen ];
diff --git a/pkgs/development/ocaml-modules/twt/default.nix b/pkgs/development/ocaml-modules/twt/default.nix
index 77635e8848e01..f9af4ab8ca05f 100644
--- a/pkgs/development/ocaml-modules/twt/default.nix
+++ b/pkgs/development/ocaml-modules/twt/default.nix
@@ -10,10 +10,9 @@ stdenv.mkDerivation {
 
   buildInputs = [ ocaml findlib ];
 
-  createFindlibDestdir = true;
-
-  configurePhase = ''
-    mkdir $out/bin
+  preInstall = ''
+    mkdir -p $out/bin
+    mkdir -p $OCAMLFIND_DESTDIR
   '';
 
   dontBuild = true;
diff --git a/pkgs/development/php-packages/composer/default.nix b/pkgs/development/php-packages/composer/default.nix
index 15dd3f5bc597e..1afa8f2ae3301 100644
--- a/pkgs/development/php-packages/composer/default.nix
+++ b/pkgs/development/php-packages/composer/default.nix
@@ -1,14 +1,14 @@
 { mkDerivation, fetchurl, makeWrapper, unzip, lib, php }:
 let
   pname = "composer";
-  version = "2.1.5";
+  version = "2.1.8";
 in
 mkDerivation {
   inherit pname version;
 
   src = fetchurl {
     url = "https://getcomposer.org/download/${version}/composer.phar";
-    sha256 = "1v4hjwbv1y5jvj91i2fj8bvmfsymp9ls8h231zd85svfqdy5b5dy";
+    sha256 = "141myfivdjnkx8myvkgl2sclhvx9z1c6a1my4xzscx0injhsrf3p";
   };
 
   dontUnpack = true;
diff --git a/pkgs/development/python-modules/ansible-lint/default.nix b/pkgs/development/python-modules/ansible-lint/default.nix
index eec3b5cc813ea..d035c3267a85d 100644
--- a/pkgs/development/python-modules/ansible-lint/default.nix
+++ b/pkgs/development/python-modules/ansible-lint/default.nix
@@ -18,13 +18,13 @@
 
 buildPythonPackage rec {
   pname = "ansible-lint";
-  version = "5.0.8";
+  version = "5.2.0";
   disabled = isPy27;
   format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-tnuWKEB66bwVuwu3H3mHG99ZP+/msGhMDMRL5fyQgD8=";
+    sha256 = "sha256-eQIDVtk/UD0syGmnJw48BDFtUQ4ztiZO3AjH0NsOgGE=";
   };
 
   nativeBuildInputs = [
@@ -52,18 +52,6 @@ buildPythonPackage rec {
     "--numprocesses" "auto"
   ];
 
-  postPatch = ''
-    # Both patches are addressed in https://github.com/ansible-community/ansible-lint/pull/1549
-    # and should be removed once merged upstream
-
-    # fixes test_get_yaml_files_umlaut and test_run_inside_role_dir
-    substituteInPlace src/ansiblelint/file_utils.py \
-      --replace 'os.path.join(root, name)' 'os.path.normpath(os.path.join(root, name))'
-    # fixes test_custom_kinds
-    substituteInPlace src/ansiblelint/file_utils.py \
-      --replace "if name.endswith('.yaml') or name.endswith('.yml')" ""
-  '';
-
   preCheck = ''
     # ansible wants to write to $HOME and crashes if it can't
     export HOME=$(mktemp -d)
@@ -80,8 +68,18 @@ buildPythonPackage rec {
 
   disabledTests = [
     # requires network
+    "test_cli_auto_detect"
+    "test_install_collection"
     "test_prerun_reqs_v1"
     "test_prerun_reqs_v2"
+    "test_require_collection_wrong_version"
+    # re-execs ansible-lint which does not works correct
+    "test_custom_kinds"
+    "test_run_inside_role_dir"
+    "test_run_multiple_role_path_no_trailing_slash"
+    "test_runner_exclude_globs"
+
+    "test_discover_lintables_umlaut"
   ];
 
   makeWrapperArgs = [ "--prefix PATH : ${lib.makeBinPath [ ansible-base ]}" ];
diff --git a/pkgs/development/python-modules/bugsnag/default.nix b/pkgs/development/python-modules/bugsnag/default.nix
index f23bc566bac5d..f157f291f7fbf 100644
--- a/pkgs/development/python-modules/bugsnag/default.nix
+++ b/pkgs/development/python-modules/bugsnag/default.nix
@@ -8,12 +8,12 @@
 
 buildPythonPackage rec {
   pname = "bugsnag";
-  version = "4.1.0";
+  version = "4.1.1";
   disabled = pythonOlder "3.5";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-3L1ZzZ7eomzJLvtlGK7YOi81b4G/1azHML/iAvsnwcE=";
+    sha256 = "cdbdb3e02ef0c0655bb55be8b05ec1cb830b5ec629923ccb24bfd71dede3d1c3";
   };
 
   propagatedBuildInputs = [ six webob ];
diff --git a/pkgs/development/python-modules/django-webpack-loader/default.nix b/pkgs/development/python-modules/django-webpack-loader/default.nix
index c782a5f6746e1..2656dd593c1c2 100644
--- a/pkgs/development/python-modules/django-webpack-loader/default.nix
+++ b/pkgs/development/python-modules/django-webpack-loader/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "django-webpack-loader";
-  version = "1.1.0";
+  version = "1.4.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "c7f89a272a177a17a045ceab26bbb7e35d28ca5597c384de96817784b610c977";
+    sha256 = "7e34085b7fc4d352e482ff9cf7d09ae4524e730675e25432ab1d25a2dd94e583";
   };
 
   # django.core.exceptions.ImproperlyConfigured (path issue with DJANGO_SETTINGS_MODULE?)
diff --git a/pkgs/development/python-modules/emoji/default.nix b/pkgs/development/python-modules/emoji/default.nix
index 2b20c7de4a393..883ff8bcb61f2 100644
--- a/pkgs/development/python-modules/emoji/default.nix
+++ b/pkgs/development/python-modules/emoji/default.nix
@@ -6,13 +6,13 @@
 
 buildPythonPackage rec {
   pname = "emoji";
-  version = "1.5.2";
+  version = "1.6.0";
 
   src = fetchFromGitHub {
     owner = "carpedm20";
     repo = pname;
     rev = "v${version}";
-    sha256 = "11v8zqz183vpiyg2cp0fghb1hxqsn3yaydm1d97nqd9g2mfy37s1";
+    sha256 = "0sxqw1y070cpg7102a6a1bha8s25vwdgfcjp9nzlrzgd2p6pav41";
   };
 
   checkInputs = [
diff --git a/pkgs/development/python-modules/exchangelib/default.nix b/pkgs/development/python-modules/exchangelib/default.nix
index d278b8bcf4102..686a167d74bf4 100644
--- a/pkgs/development/python-modules/exchangelib/default.nix
+++ b/pkgs/development/python-modules/exchangelib/default.nix
@@ -27,14 +27,14 @@
 
 buildPythonPackage rec {
   pname = "exchangelib";
-  version = "4.5.1";
+  version = "4.5.2";
   disabled = pythonOlder "3.6";
 
   src = fetchFromGitHub {
     owner = "ecederstrand";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0pj6rcink4awjyq1v30camilqr03kd0sb2p03fk9v4lm63d8w28f";
+    sha256 = "1zz4p13ww9y5x0ifvcj652hgfbjqbnmr3snwrs0p315sc3y47ggm";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/google-cloud-access-context-manager/default.nix b/pkgs/development/python-modules/google-cloud-access-context-manager/default.nix
index f2e3276705862..a3ecf1a6ec4b8 100644
--- a/pkgs/development/python-modules/google-cloud-access-context-manager/default.nix
+++ b/pkgs/development/python-modules/google-cloud-access-context-manager/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-access-context-manager";
-  version = "0.1.7";
+  version = "0.1.8";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "02adf212c8d280298ffe03a0c91743618693ec394b42cbb85b4a29f8d9544afa";
+    sha256 = "29101f61fa0e07db6385a94da45aef8edb4efde0d2b700fbbf65164c045744a8";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/google-cloud-bigquery-datatransfer/default.nix b/pkgs/development/python-modules/google-cloud-bigquery-datatransfer/default.nix
index 62956e1e46de1..eff1cef578e53 100644
--- a/pkgs/development/python-modules/google-cloud-bigquery-datatransfer/default.nix
+++ b/pkgs/development/python-modules/google-cloud-bigquery-datatransfer/default.nix
@@ -6,6 +6,7 @@
 , proto-plus
 , pytestCheckHook
 , pytest-asyncio
+, pytz
 , mock
 }:
 
@@ -18,7 +19,7 @@ buildPythonPackage rec {
     sha256 = "fcb71ebe5c5b232d24fe7d666b65709e4fc8db43263c8182e5ed8e5a52abefec";
   };
 
-  propagatedBuildInputs = [ google-api-core libcst proto-plus ];
+  propagatedBuildInputs = [ google-api-core libcst proto-plus pytz ];
   checkInputs = [ mock pytestCheckHook pytest-asyncio ];
 
   pythonImportsCheck = [
diff --git a/pkgs/development/python-modules/langcodes/default.nix b/pkgs/development/python-modules/langcodes/default.nix
index 485bc44ff6e2c..66a2bb355b684 100644
--- a/pkgs/development/python-modules/langcodes/default.nix
+++ b/pkgs/development/python-modules/langcodes/default.nix
@@ -8,12 +8,12 @@
 
 buildPythonPackage rec {
   pname = "langcodes";
-  version = "3.1.0";
+  version = "3.2.0";
   disabled = pythonOlder "3.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1ccd37e3a68760d29ec3b17f5962cd1d8f242f4d9705ad1601c5cb7fab48199c";
+    sha256 = "38e06cd104847be351b003a9857e79f108fb94b49dd2e84dbab905fd3777530a";
   };
 
   propagatedBuildInputs = [ marisa-trie ];
diff --git a/pkgs/development/python-modules/proto-plus/default.nix b/pkgs/development/python-modules/proto-plus/default.nix
index df97d1c4d7807..e623840f1c654 100644
--- a/pkgs/development/python-modules/proto-plus/default.nix
+++ b/pkgs/development/python-modules/proto-plus/default.nix
@@ -10,12 +10,12 @@
 
 buildPythonPackage rec {
   pname = "proto-plus";
-  version = "1.19.0";
+  version = "1.19.2";
   disabled = !isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-zmaVzoBDg61vOSxLsYdMMjiWKQofZWVg3jZBa6gy2R4=";
+    sha256 = "sha256-ylMLBxjGJbpj8VGrP83INrWTQ9FJt9/RXsLc6zhEwi0=";
   };
 
   propagatedBuildInputs = [ protobuf ];
diff --git a/pkgs/development/python-modules/pydaikin/default.nix b/pkgs/development/python-modules/pydaikin/default.nix
index 5eefe5ade5ec4..67f8da66be78b 100644
--- a/pkgs/development/python-modules/pydaikin/default.nix
+++ b/pkgs/development/python-modules/pydaikin/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "pydaikin";
-  version = "2.4.4";
+  version = "2.6.0";
   disabled = pythonOlder "3.6";
 
   src = fetchFromBitbucket {
     owner = "mustang51";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-G7SShq2zjd9KGM7t1KsAMehqm2onB5cYdcOO3k8Sb30=";
+    sha256 = "sha256-Fk6zMWgvhKp+7BMDGw89Akb4fgK6+xi+AyvEY3pdTQQ=";
   };
 
   propagatedBuildInputs = [
@@ -28,7 +28,7 @@ buildPythonPackage rec {
     urllib3
   ];
 
-  # while they have tests, they do not run them in their CI and they fail as of 2.4.4
+  # while they have tests, they do not run them in their CI and they fail as of 2.6.0
   # AttributeError: 'DaikinBRP069' object has no attribute 'last_hour_cool_energy_consumption'
   doCheck = false;
 
diff --git a/pkgs/development/python-modules/pylast/default.nix b/pkgs/development/python-modules/pylast/default.nix
index 5a0a53005bb16..0306008aa7857 100644
--- a/pkgs/development/python-modules/pylast/default.nix
+++ b/pkgs/development/python-modules/pylast/default.nix
@@ -11,12 +11,12 @@
 
 buildPythonPackage rec {
   pname = "pylast";
-  version = "4.2.1";
+  version = "4.3.0";
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-R1enQk6luuBiobMPDn5x1SXx7zUI/5c8dPtyWkmG/18=";
+    sha256 = "71fd876e3753009bd10ea55b3f8f7c5d68591ee18a4127d257fc4a418010aa5c";
   };
 
   nativeBuildInputs = [ setuptools-scm ];
diff --git a/pkgs/development/python-modules/regenmaschine/default.nix b/pkgs/development/python-modules/regenmaschine/default.nix
index 2239b5824e115..65a949ebe772b 100644
--- a/pkgs/development/python-modules/regenmaschine/default.nix
+++ b/pkgs/development/python-modules/regenmaschine/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "regenmaschine";
-  version = "3.1.5";
+  version = "3.2.0";
   format = "pyproject";
   disabled = pythonOlder "3.6";
 
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "bachya";
     repo = pname;
     rev = version;
-    sha256 = "0jm4x66kk7aa19hablkij43vsnsyy85a638zjfjsqghwqppwklgw";
+    sha256 = "sha256-H3ZTts9tk0D53IcnmROCgylhVerctUg/AQCjFo5iJZY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/sh/disable-broken-tests-darwin.patch b/pkgs/development/python-modules/sh/disable-broken-tests-darwin.patch
index c51490ce6a40f..dfeb50db8d0e7 100644
--- a/pkgs/development/python-modules/sh/disable-broken-tests-darwin.patch
+++ b/pkgs/development/python-modules/sh/disable-broken-tests-darwin.patch
@@ -4,15 +4,9 @@ Date: Mon, 20 Jul 2020 19:51:20 +0200
 Subject: [PATCH] Disable tests that fail on Darwin (macOS) or with sandboxing
 
 Signed-off-by: Sirio Balmelli <sirio@b-ad.ch>
----
- test.py | 4 ++++
- 1 file changed, 4 insertions(+)
-
-diff --git a/test.py b/test.py
-index f8029c0..ba1d141 100644
 --- a/test.py
 +++ b/test.py
-@@ -404,6 +404,7 @@ exit(3)
+@@ -377,6 +377,7 @@ exit(3)
          self.assertEqual(sed(_in="one test three", e="s/test/two/").strip(),
                           "one two three")
  
@@ -20,7 +14,7 @@ index f8029c0..ba1d141 100644
      def test_ok_code(self):
          from sh import ls, ErrorReturnCode_1, ErrorReturnCode_2
  
-@@ -1004,6 +1005,7 @@ print(sys.argv[1])
+@@ -982,6 +983,7 @@ print(sys.argv[1])
          now = time.time()
          self.assertGreater(now - start, sleep_time)
  
@@ -28,7 +22,7 @@ index f8029c0..ba1d141 100644
      def test_background_exception(self):
          from sh import ls, ErrorReturnCode_1, ErrorReturnCode_2
          p = ls("/ofawjeofj", _bg=True, _bg_exc=False)  # should not raise
-@@ -1801,6 +1803,7 @@ exit(49)
+@@ -1779,6 +1781,7 @@ exit(49)
          p = python(py.name, _ok_code=49, _bg=True)
          self.assertEqual(49, p.exit_code)
  
@@ -36,7 +30,15 @@ index f8029c0..ba1d141 100644
      def test_cwd(self):
          from sh import pwd
          from os.path import realpath
-@@ -2899,6 +2902,7 @@ print("hi")
+@@ -2777,6 +2780,7 @@ print("cool")
+     # on osx.  so skip it for now if osx
+     @not_macos
+     @requires_progs("lsof")
++    @skipUnless(False, "Flaky on Hydra")
+     def test_no_fd_leak(self):
+         import sh
+         import os
+@@ -2879,6 +2883,7 @@ print("hi")
          python(py.name, _in=stdin)
  
      @requires_utf8
@@ -44,6 +46,3 @@ index f8029c0..ba1d141 100644
      def test_unicode_path(self):
          from sh import Command
  
--- 
-2.27.0
-
diff --git a/pkgs/development/python-modules/sqlalchemy/default.nix b/pkgs/development/python-modules/sqlalchemy/default.nix
index 819f294972468..54f21c49f771a 100644
--- a/pkgs/development/python-modules/sqlalchemy/default.nix
+++ b/pkgs/development/python-modules/sqlalchemy/default.nix
@@ -13,11 +13,11 @@
 
 buildPythonPackage rec {
   pname = "SQLAlchemy";
-  version = "1.4.23";
+  version = "1.4.25";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-dv8kaIH1KAib8ZOFExuWYZe7SUZTmQOW0s4TjipEdYM=";
+    sha256 = "sha256-Gt89JeLjOvvNSM+tgHb5N4eTvkPn/sPkM0MGysa+wTg=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/stestr/default.nix b/pkgs/development/python-modules/stestr/default.nix
index 1e5f965a8026b..2071d20a75f87 100644
--- a/pkgs/development/python-modules/stestr/default.nix
+++ b/pkgs/development/python-modules/stestr/default.nix
@@ -13,11 +13,11 @@
 
 buildPythonPackage rec {
   pname = "stestr";
-  version = "3.2.0";
+  version = "3.2.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "fb492cbdf3d3fdd6812645804efc84a99a68bb60dd7705f15c1a2949c8172bc4";
+    sha256 = "sha256-wj7nq0QSKNiDZZBKIk+4RC2gwCifkBz0qUIukpt76c0=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/testfixtures/default.nix b/pkgs/development/python-modules/testfixtures/default.nix
index c330b5e18b893..be217a16b07a1 100644
--- a/pkgs/development/python-modules/testfixtures/default.nix
+++ b/pkgs/development/python-modules/testfixtures/default.nix
@@ -12,11 +12,11 @@
 
 buildPythonPackage rec {
   pname = "testfixtures";
-  version = "6.18.1";
+  version = "6.18.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-CmQic39tibRc3vHi31V29SrQ9QeVYALOECDaqfRCEdY=";
+    sha256 = "sha256-JgAQCulv/QgjNLN441VVD++LSlKab6TDT0cTCQXHQm0=";
   };
 
   checkInputs = [
diff --git a/pkgs/development/python-modules/vt-py/default.nix b/pkgs/development/python-modules/vt-py/default.nix
index e208e3a768229..0e0d19e4f40ab 100644
--- a/pkgs/development/python-modules/vt-py/default.nix
+++ b/pkgs/development/python-modules/vt-py/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "vt-py";
-  version = "0.7.4";
+  version = "0.7.5";
 
   disabled = pythonOlder "3.6";
 
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "VirusTotal";
     repo = pname;
     rev = version;
-    sha256 = "149fgrqnwf8nyv3msj6p614zbdi7m7s785y3fvh8fm8k7lmgqk8w";
+    sha256 = "sha256-vC2teem231Lw7cglVc+0M+QbgMgZ23JzTYy7wvnhFI4=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/werkzeug/1.nix b/pkgs/development/python-modules/werkzeug/1.nix
index d03909d191d07..ae4df6ae939cd 100644
--- a/pkgs/development/python-modules/werkzeug/1.nix
+++ b/pkgs/development/python-modules/werkzeug/1.nix
@@ -39,6 +39,7 @@ buildPythonPackage rec {
     # E     return Headers(result)
     # E ResourceWarning: unclosed file <_io.FileIO name=11 mode='rb+' closefd=True>
     "TestMultiPart"
+    "TestHTTPUtility"
   ] ++ lib.optionals stdenv.isDarwin [
     "test_get_machine_id"
   ];
diff --git a/pkgs/development/python-modules/yeelight/default.nix b/pkgs/development/python-modules/yeelight/default.nix
index b7472d68a83d1..8c06676bb2141 100644
--- a/pkgs/development/python-modules/yeelight/default.nix
+++ b/pkgs/development/python-modules/yeelight/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "yeelight";
-  version = "0.7.5";
+  version = "0.7.6";
   disabled = pythonOlder "3.4";
 
   src = fetchFromGitLab {
     owner = "stavros";
     repo = "python-yeelight";
     rev = "v${version}";
-    sha256 = "sha256-lEroQ2Gy1ldeIkkSMYcXJk6j6Ls2zigImrIWOPq70D0=";
+    sha256 = "sha256-inp6JKHA1ZgYPNMcQbL/tXOfhBDeMycIycLr69cOEGE=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/tools/analysis/valgrind/coregrind-makefile-race.patch b/pkgs/development/tools/analysis/valgrind/coregrind-makefile-race.patch
deleted file mode 100644
index cd09f0edff378..0000000000000
--- a/pkgs/development/tools/analysis/valgrind/coregrind-makefile-race.patch
+++ /dev/null
@@ -1,41 +0,0 @@
-From 7820fc268fae4353118b6355f1d4b9e1b7eeebec Mon Sep 17 00:00:00 2001
-From: Philippe Waroquiers <philippe.waroquiers@skynet.be>
-Date: Sun, 28 Oct 2018 18:35:11 +0100
-Subject: [PATCH 1/1] Fix dependencies between libcoregrind*.a and
- *m_main.o/*m_libcsetjmp.o
-
-The primary and secondary coregrind libraries must be updated
-when m_main.c or m_libcsetjmp.c are changed.
-
-A dependency was missing between libcoregrind*.a and libnolto_coregrind*.a,
-and so tools were not relinked when m_main.c or m_libcsetjmp.c were
-changed.
----
- coregrind/Makefile.am | 4 ++++
- 1 file changed, 4 insertions(+)
-
-diff --git a/coregrind/Makefile.am b/coregrind/Makefile.am
-index 914a270..8de1996 100644
---- a/coregrind/Makefile.am
-+++ b/coregrind/Makefile.am
-@@ -511,6 +511,8 @@ libcoregrind_@VGCONF_ARCH_PRI@_@VGCONF_OS@_a_CFLAGS += \
- endif
- libcoregrind_@VGCONF_ARCH_PRI@_@VGCONF_OS@_a_LIBADD = \
-     $(libnolto_coregrind_@VGCONF_ARCH_PRI@_@VGCONF_OS@_a_OBJECTS)
-+libcoregrind_@VGCONF_ARCH_PRI@_@VGCONF_OS@_a_DEPENDENCIES = \
-+    libnolto_coregrind-@VGCONF_ARCH_PRI@-@VGCONF_OS@.a
- 
- if VGCONF_HAVE_PLATFORM_SEC
- libcoregrind_@VGCONF_ARCH_SEC@_@VGCONF_OS@_a_SOURCES = \
-@@ -531,6 +533,8 @@ libcoregrind_@VGCONF_ARCH_SEC@_@VGCONF_OS@_a_CFLAGS += \
- endif
- libcoregrind_@VGCONF_ARCH_SEC@_@VGCONF_OS@_a_LIBADD = \
-     $(libnolto_coregrind_@VGCONF_ARCH_SEC@_@VGCONF_OS@_a_OBJECTS)
-+libcoregrind_@VGCONF_ARCH_SEC@_@VGCONF_OS@_a_DEPENDENCIES = \
-+    libnolto_coregrind-@VGCONF_ARCH_SEC@-@VGCONF_OS@.a
- endif
- 
- #----------------------------------------------------------------------------
--- 
-2.9.3
-
diff --git a/pkgs/development/tools/analysis/valgrind/default.nix b/pkgs/development/tools/analysis/valgrind/default.nix
index 5a787d9c3f859..5d747317e4531 100644
--- a/pkgs/development/tools/analysis/valgrind/default.nix
+++ b/pkgs/development/tools/analysis/valgrind/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "valgrind";
-  version = "3.16.1";
+  version = "3.17.0";
 
   src = fetchurl {
     url = "https://sourceware.org/pub/${pname}/${pname}-${version}.tar.bz2";
-    sha256 = "1jik19rcd34ip8a5c9nv5wfj8k8maqb8cyclr4xhznq2gcpkl7y9";
+    sha256 = "18l5jbk301j3462gipqn9bkfx44mdmwn0pwr73r40gl1irkfqfmd";
   };
 
   outputs = [ "out" "dev" "man" "doc" ];
@@ -54,10 +54,10 @@ stdenv.mkDerivation rec {
     lib.optional (stdenv.hostPlatform.system == "x86_64-linux" || stdenv.hostPlatform.system == "x86_64-darwin") "--enable-only64bit"
     ++ lib.optional stdenv.hostPlatform.isDarwin "--with-xcodedir=${xnu}/include";
 
-  doCheck = false; # fails
+  doCheck = true;
 
   postInstall = ''
-    for i in $out/lib/valgrind/*.supp; do
+    for i in $out/libexec/valgrind/*.supp; do
       substituteInPlace $i \
         --replace 'obj:/lib' 'obj:*/lib' \
         --replace 'obj:/usr/X11R6/lib' 'obj:*/lib' \
diff --git a/pkgs/development/tools/misc/gdb/default.nix b/pkgs/development/tools/misc/gdb/default.nix
index ea0002d78c0ac..88e3393dedcbe 100644
--- a/pkgs/development/tools/misc/gdb/default.nix
+++ b/pkgs/development/tools/misc/gdb/default.nix
@@ -26,11 +26,11 @@ assert pythonSupport -> python3 != null;
 
 stdenv.mkDerivation rec {
   pname = targetPrefix + basename;
-  version = "10.2";
+  version = "11.1";
 
   src = fetchurl {
     url = "mirror://gnu/gdb/${basename}-${version}.tar.xz";
-    sha256 = "0aag1c0fw875pvhjg1qp7x8pf6gf92bjv5gcic5716scacyj58da";
+    sha256 = "151z6d0265hv9cgx9zqqa4bd6vbp20hrljhd6bxl7lr0gd0crkyc";
   };
 
   postPatch = if stdenv.isDarwin then ''
diff --git a/pkgs/development/tools/misc/texinfo/common.nix b/pkgs/development/tools/misc/texinfo/common.nix
index d6e6bced405b1..8d8f1e1627aa7 100644
--- a/pkgs/development/tools/misc/texinfo/common.nix
+++ b/pkgs/development/tools/misc/texinfo/common.nix
@@ -54,11 +54,11 @@ stdenv.mkDerivation {
     && !stdenv.isDarwin
     && !stdenv.isSunOS; # flaky
 
-  checkFlagsArray = if version == "6.8" then [
+  checkFlagsArray = [
     # Test is known to fail on various locales on texinfo-6.8:
     #   https://lists.gnu.org/r/bug-texinfo/2021-07/msg00012.html
     "XFAIL_TESTS=test_scripts/layout_formatting_fr_icons.sh"
-  ] else null;
+  ];
 
   meta = {
     homepage = "https://www.gnu.org/software/texinfo/";
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-c-sharp.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-c-sharp.json
index 8a9dd7be6db72..c7236e301ae17 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-c-sharp.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-c-sharp.json
@@ -1,9 +1,9 @@
 {
   "url": "https://github.com/tree-sitter/tree-sitter-c-sharp",
-  "rev": "c9e1952d311cf87762a42a79cb801c7bef1af815",
-  "date": "2021-09-09T23:38:47+01:00",
-  "path": "/nix/store/cl05d3zpbbkhms5fmd6wc4jhasjhg12l-tree-sitter-c-sharp",
-  "sha256": "0kn7p203ij8vz1cdxmxvn85mf3hpmz08l5psza96xxif2lcz8li8",
+  "rev": "52ad1d506debcd4623d641339f8f452e6ea8f10c",
+  "date": "2021-09-23T08:24:24+01:00",
+  "path": "/nix/store/ag2r3d659gj14hgfgdf0nv5dwcihxy3w-tree-sitter-c-sharp",
+  "sha256": "1n8jnw2yp966svkcyh68wwwbqjhrvhykzxilj6k8rn5yx9lpymz5",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-c.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-c.json
index 2f589a92d2d84..82ca08f94f324 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-c.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-c.json
@@ -1,9 +1,9 @@
 {
   "url": "https://github.com/tree-sitter/tree-sitter-c",
-  "rev": "f71e80b9f20c3968c131518ae8d272a3cf81a60b",
-  "date": "2021-09-18T14:26:00-05:00",
-  "path": "/nix/store/22iw8rdpmvxmyrsmxxbyx8yi44jq05qd-tree-sitter-c",
-  "sha256": "13qr8ms8w7y92a33p0wisg4kzj4q3dzi2bn7wd6x815j8hfz627q",
+  "rev": "e348e8ec5efd3aac020020e4af53d2ff18f393a9",
+  "date": "2021-09-20T10:21:48-07:00",
+  "path": "/nix/store/bnc2zml2igbpprx4i0h053inv023z6nj-tree-sitter-c",
+  "sha256": "0fmh8b94ra5fi0j9by9yqbc1pf9sh9pjwc3symrslg855w8a0yx7",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-comment.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-comment.json
index 3da60411f95c4..c25aebe78a721 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-comment.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-comment.json
@@ -1,9 +1,9 @@
 {
   "url": "https://github.com/stsewd/tree-sitter-comment",
-  "rev": "8d480c0a86e3b95812252d29292b2686eb92418d",
-  "date": "2021-08-13T15:03:50-05:00",
-  "path": "/nix/store/4aqsac34f0pzpa889067dqci743axrmx-tree-sitter-comment",
-  "sha256": "0fqhgvpd391nxrpyhxcp674h8qph280ax6rm6dz1pj3lqs3grdka",
+  "rev": "5dd3c62f1bbe378b220fe16b317b85247898639e",
+  "date": "2021-10-01T17:13:56-05:00",
+  "path": "/nix/store/isrc5wlyxvcawfj35yi4nmblshy69b1j-tree-sitter-comment",
+  "sha256": "1wk6lxzndaikbrn72pa54y59qs0xnfaffc8mxmm6c5v5x16l8vb3",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-cpp.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-cpp.json
index 394040a79da0d..7f77cee08b00f 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-cpp.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-cpp.json
@@ -1,9 +1,9 @@
 {
   "url": "https://github.com/tree-sitter/tree-sitter-cpp",
-  "rev": "8b112a131b910ec009853fc9dd1c27eae267a7a6",
-  "date": "2021-09-18T10:53:12-05:00",
-  "path": "/nix/store/bpfw6wckk0yfpr99nrv473g3r3b84vbv-tree-sitter-cpp",
-  "sha256": "0rskvx5krakfkkcmiv9qd0zf8rf63iaigv76x3dq7v00sj8m0xsn",
+  "rev": "a7652fce5943c9d5d9c49dd8e3256a699aa33bf5",
+  "date": "2021-09-24T15:54:22-05:00",
+  "path": "/nix/store/9q4xnklmv1220yjgwdz96qf0l8swx2j6-tree-sitter-cpp",
+  "sha256": "10dbif87axvban83mglvh81gjckbp7qya0rf525s10h8ihy7rbpm",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-dot.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-dot.json
index 7adb92cdd6019..d9156557c54b3 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-dot.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-dot.json
@@ -1,9 +1,9 @@
 {
   "url": "https://github.com/rydesun/tree-sitter-dot",
-  "rev": "e6f55c43b87b81cc982e38d414f0147fefa2515c",
-  "date": "2021-09-01T14:36:57+08:00",
-  "path": "/nix/store/n5a6bzh8rf35865wvcr3cis9r0fn2047-tree-sitter-dot",
-  "sha256": "1s3fpd0lnbm3gk9nbskdkdjlmdm7kz0l0g2zipv1m7qkc05nnkfy",
+  "rev": "3a32e207e126a7f1cdd17de2473db1f03e6a3dac",
+  "date": "2021-10-05T10:30:04+08:00",
+  "path": "/nix/store/zz4sj2r6jyl7k4l7g8qggr0gv4wh5nx7-tree-sitter-dot",
+  "sha256": "17j8spga68y40fy2yizpkx7bmxp7h5p9l334w2b0685w2mnvrlgg",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-elisp.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-elisp.json
index 43d38746c46fd..f6e11391fab21 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-elisp.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-elisp.json
@@ -1,9 +1,9 @@
 {
   "url": "https://github.com/wilfred/tree-sitter-elisp",
-  "rev": "166777abacfe5821d3b7b6873e6d2fd70a99f348",
-  "date": "2021-09-05T23:34:46-07:00",
-  "path": "/nix/store/gfyr8hl9pj2i0dj0qqpwh53jphff2bcd-tree-sitter-elisp",
-  "sha256": "18798jb3cisrvhkmzhq2qxly19hxvznf9k1n5pzl8l1dhw1yvl2a",
+  "rev": "4b0e4a3891337514126ec72c7af394c0ff2cf48c",
+  "date": "2021-10-02T12:14:40-07:00",
+  "path": "/nix/store/1g3q3xzv5n9wzi84awrlbxwm6q3zh8qz-tree-sitter-elisp",
+  "sha256": "1g6qmpxn1y9hzk2kkpp9gpkphaq9j7vvm4nl5zv8a4wzy3w8p1wv",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-fennel.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-fennel.json
index df550680b451f..8684e176cb69e 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-fennel.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-fennel.json
@@ -1,9 +1,9 @@
 {
   "url": "https://github.com/travonted/tree-sitter-fennel",
-  "rev": "42823442a18dd2aa7b0b22dc719abb54abb3fe2e",
-  "date": "2021-09-08T19:22:08-04:00",
-  "path": "/nix/store/2v174r3fc3cqsy8yanq2kdcjqvzl1jx9-tree-sitter-fennel",
-  "sha256": "0a59hgx7mmdicw9fq2q8dcd2ffmcgjdkk3rpwj84ya1qiyvs5x5s",
+  "rev": "fce4331731a960077ff5f98939bc675179f1908a",
+  "date": "2021-09-30T09:09:52-04:00",
+  "path": "/nix/store/mhpkw4gl6lzi306q21kckafqcdc0a715-tree-sitter-fennel",
+  "sha256": "1k8acyav26248liz0psk2r9dl7472mqgdyrjwg3pfxx94jgqjcik",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-go.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-go.json
index 02fff8098ad65..3839bd61dc1f9 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-go.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-go.json
@@ -1,9 +1,9 @@
 {
   "url": "https://github.com/tree-sitter/tree-sitter-go",
-  "rev": "42b1e657c3a394c01df51dd3eadc8b214274a73c",
-  "date": "2021-08-16T18:29:17+02:00",
-  "path": "/nix/store/a1crqhfrd8v9g9w0565aca7nc9k2x7a0-tree-sitter-go",
-  "sha256": "1khsl8qz6r4dqw7h43m3jw3iqhh79sgpnsps0jy95f165iy496z3",
+  "rev": "7f6bfd0161b2fe97f03564edad3287ebea0494a3",
+  "date": "2021-10-04T13:10:27-04:00",
+  "path": "/nix/store/64xzxzc8z4fmwhfb7wbdkcxlk7r3bia2-tree-sitter-go",
+  "sha256": "12naks95vzb0sf219i39myvfpkycr2dh3lv7i7i6kwddmlhqsjnl",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-javascript.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-javascript.json
index a5d506dc24200..b4a4b7b447190 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-javascript.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-javascript.json
@@ -1,9 +1,9 @@
 {
   "url": "https://github.com/tree-sitter/tree-sitter-javascript",
-  "rev": "435db852fbeff8fe298e25ad967c634d9698eec0",
-  "date": "2021-09-13T13:32:20-07:00",
-  "path": "/nix/store/idvb37g3nqpidw0jviiw4b71sqpihhs0-tree-sitter-javascript",
-  "sha256": "0plc5jxxh1bm1dig6gsk1ma7gp29ad3p0169jd9xlagc4vysfgc3",
+  "rev": "fdeb68ac8d2bd5a78b943528bb68ceda3aade2eb",
+  "date": "2021-10-04T13:07:24-04:00",
+  "path": "/nix/store/psmsgqhg4di7mkkd6sgyvcs41jvvq2c3-tree-sitter-javascript",
+  "sha256": "175yrk382n2di0c2xn4gpv8y4n83x1lg4hqn04vabf0yqynlkq67",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-php.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-php.json
index 6c288b7cdae5e..82c97d923fcf5 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-php.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-php.json
@@ -1,9 +1,9 @@
 {
   "url": "https://github.com/tree-sitter/tree-sitter-php",
-  "rev": "d1bdb1e535d39d4f93f7373f406e1837c8a7bb25",
-  "date": "2021-09-10T08:16:50+02:00",
-  "path": "/nix/store/4zzs4f1hz5il35pqyf355aps6k4a83i8-tree-sitter-php",
-  "sha256": "0ymkwlh1japlwsajxd06254qadzq9bvm5db02cg4n3zv0pkvyrzz",
+  "rev": "31550c1506b2033c5631cd18886edd600b67861e",
+  "date": "2021-09-27T11:44:23-07:00",
+  "path": "/nix/store/bls6gpbwqacgz7hr900khlfhbal29y27-tree-sitter-php",
+  "sha256": "1qykyziapwmw5qhd5svawzksp4w9hjdql84d7lqs3w0dfa60bjax",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-python.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-python.json
index 67800f5081a5b..5a597fffb7f69 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-python.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-python.json
@@ -1,9 +1,9 @@
 {
   "url": "https://github.com/tree-sitter/tree-sitter-python",
-  "rev": "9b84b7fd9da1aa74c8a8afae58b7dcc4c109cda4",
-  "date": "2021-09-16T13:02:06+02:00",
-  "path": "/nix/store/vxh1bdkdqj3n6knlz6bbdyl5l4qj2a2v-tree-sitter-python",
-  "sha256": "0r5daw3pbqcaf08gnhghjr15n7vv43njvh4ky6vz985sjzdnjz02",
+  "rev": "8600d7fadf5a51b9396eacbc6d105d0649b4c6f6",
+  "date": "2021-09-30T09:07:59-07:00",
+  "path": "/nix/store/0m86a8y8p8cxq616gacd5wydhayl8g70-tree-sitter-python",
+  "sha256": "0ydiizy1jhmfv0kr7xw9k57jgfpkda95nc1rawzqmsxd7nixnrkp",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-rst.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-rst.json
index 3e2a463b54f4e..4d3596b7c3998 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-rst.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-rst.json
@@ -1,9 +1,9 @@
 {
   "url": "https://github.com/stsewd/tree-sitter-rst",
-  "rev": "a9281c2250e0d32750de159413cdd87120407389",
-  "date": "2021-09-17T19:21:59-05:00",
-  "path": "/nix/store/3cnj1q9xfl0yh096pahqvlrf66azyhsr-tree-sitter-rst",
-  "sha256": "1fxknsmkn3pz1km77mii3w917fdl6h57h4mnw20b0syn4v1ag07d",
+  "rev": "632596b1fe5816315cafa90cdf8f8000e30c93e4",
+  "date": "2021-10-01T17:00:56-05:00",
+  "path": "/nix/store/pnbw1j9ynj4zgjqxjnhq9hgqp3nxm77j-tree-sitter-rst",
+  "sha256": "1l831aw4a080qin7dkq04b28nnyxs1r8zqrbp92d7j4y2lz31dla",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-typescript.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-typescript.json
index 47dea4c92cd2e..b39d7753aad45 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-typescript.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-typescript.json
@@ -1,9 +1,9 @@
 {
   "url": "https://github.com/tree-sitter/tree-sitter-typescript",
-  "rev": "3383cebec9c9546587d9fe00c2e565d91163014a",
-  "date": "2021-09-16T13:01:51-07:00",
-  "path": "/nix/store/ml188xckf51g1r6gw380svxsg639kjgc-tree-sitter-typescript",
-  "sha256": "0vgkhn36cyg134ygx5wzld3ic9rd4lq9s2rp2dkxh0zg610ilcms",
+  "rev": "ef6ee5b39d6c4660809a61c1c8556fb547283864",
+  "date": "2021-10-04T11:58:33-05:00",
+  "path": "/nix/store/ny8gc7l6hpa4snhccyw3149f7s92071l-tree-sitter-typescript",
+  "sha256": "1gyim8yackz9pq6s62wrywr3gsgwa68jwvd0s6i28xxvln2r7wlb",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-verilog.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-verilog.json
index 700ec9f22dd01..28e2deacc8a55 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-verilog.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-verilog.json
@@ -1,9 +1,9 @@
 {
   "url": "https://github.com/tree-sitter/tree-sitter-verilog",
-  "rev": "1b624ab8b3f8d54ecc37847aa04512844f0226ac",
-  "date": "2021-03-31T21:27:26-07:00",
-  "path": "/nix/store/4j6hrf8bc8zjd7r9xnna9njpw0i4z817-tree-sitter-verilog",
-  "sha256": "0ygm6bdxqzpl3qn5l58mnqyj730db0mbasj373bbsx81qmmzkgzz",
+  "rev": "6fae7414fa854b5052bee9111b200e9137797f3d",
+  "date": "2021-10-04T10:25:49-07:00",
+  "path": "/nix/store/aklrgpy0si72r8vac5fqjbzvcpqiy5lk-tree-sitter-verilog",
+  "sha256": "0yjhb2rp7drwkwfp35fgwnp6d7qf6k1k6zlf0dfxygjywnjy0bfs",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-vim.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-vim.json
index 7302892c6bd24..fade08dabe90c 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-vim.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-vim.json
@@ -1,9 +1,9 @@
 {
   "url": "https://github.com/vigoux/tree-sitter-viml",
-  "rev": "59595443fb486449f42db839934117221358a85f",
-  "date": "2021-08-31T08:57:29+02:00",
-  "path": "/nix/store/9sixkkk37c2bl09aik32cd1jd322ywri-tree-sitter-viml",
-  "sha256": "1kh3il5vwlz5qxi9553ks7a0dpwx1n7wnqkv5v8jhslhn7w1c1l1",
+  "rev": "fd7bc35927ab44670e02d5ad035e0363f4ffde2b",
+  "date": "2021-09-27T15:41:51+02:00",
+  "path": "/nix/store/q2z07daw81cgn15z79qsfdqc2jc8ib9l-tree-sitter-viml",
+  "sha256": "0s1bp1c8p2ify67x49fv9wh0brn98lix3742zlds892985xl9zrj",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-zig.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-zig.json
index e7a9dfc826779..e91d3683e79a0 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-zig.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-zig.json
@@ -1,9 +1,9 @@
 {
   "url": "https://github.com/maxxnino/tree-sitter-zig",
-  "rev": "5ca53bb7bd649069a6af48f4dfd32f3187491db1",
-  "date": "2021-09-06T21:30:14+09:00",
-  "path": "/nix/store/x2dfgc97jmvyq5fnbyg9w7rsjz8cknj6-tree-sitter-zig",
-  "sha256": "1c50pvza6l4snmvgj3by053j4z7asy828i9pi1zwm6121sl7ffpd",
+  "rev": "1f27fd1dfe7f352408f01b4894c7825f3a1d6c47",
+  "date": "2021-09-20T17:51:34+09:00",
+  "path": "/nix/store/c4slv3kpl9dxi2fn6nbhar098ikpfivf-tree-sitter-zig",
+  "sha256": "1sbxvn400wizwwgjw7qcxb0z9gazvzcp3z2986lblff2xw8759vw",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
diff --git a/pkgs/development/tools/xcbuild/default.nix b/pkgs/development/tools/xcbuild/default.nix
index af0f546eb82a0..3c90603477e46 100644
--- a/pkgs/development/tools/xcbuild/default.nix
+++ b/pkgs/development/tools/xcbuild/default.nix
@@ -30,6 +30,8 @@ in stdenv.mkDerivation {
     sha256 = "1xxwg2849jizxv0g1hy0b1m3i7iivp9bmc4f5pi76swsn423d41m";
   };
 
+  patches = [ ./includes.patch ];
+
   prePatch = ''
     rmdir ThirdParty/*
     cp -r --no-preserve=all ${googletest} ThirdParty/googletest
diff --git a/pkgs/development/tools/xcbuild/includes.patch b/pkgs/development/tools/xcbuild/includes.patch
new file mode 100644
index 0000000000000..7a05a33eb678f
--- /dev/null
+++ b/pkgs/development/tools/xcbuild/includes.patch
@@ -0,0 +1,10 @@
+--- a/Libraries/plist/Sources/Format/Encoding.cpp
++++ b/Libraries/plist/Sources/Format/Encoding.cpp
+@@ -11,6 +11,7 @@
+ #include <plist/Format/unicode.h>
+ 
+ #include <cassert>
++#include <cstdlib> /* abort() */
+ 
+ #if defined(__linux__)
+ #include <endian.h>
diff --git a/pkgs/development/web/deno/default.nix b/pkgs/development/web/deno/default.nix
index 5a218f908e4ad..34bcd7992ea98 100644
--- a/pkgs/development/web/deno/default.nix
+++ b/pkgs/development/web/deno/default.nix
@@ -17,15 +17,15 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "deno";
-  version = "1.14.2";
+  version = "1.14.3";
 
   src = fetchFromGitHub {
     owner = "denoland";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-7FcGwmJKKOmpuCJgHl65+EnwOWQAbmq6X1lZMhTlDaE=";
+    sha256 = "sha256-Ersfn69vRGKzJ4LV7qLI2orLftHz7tuI8+/zUEPctAE=";
   };
-  cargoSha256 = "sha256-mPxPieatGuROIwLGuQHBrZ8VTGd8c/6bKA+tt3Iv3OI=";
+  cargoSha256 = "sha256-BnJH/jbNiPyRmNjvfE5bNQX58iuAFFaQ93bZsXooTfI=";
 
   # Install completions post-install
   nativeBuildInputs = [ installShellFiles ];
diff --git a/pkgs/development/web/deno/librusty_v8.nix b/pkgs/development/web/deno/librusty_v8.nix
index d7b16d6a59b9f..6fb597b81acd9 100644
--- a/pkgs/development/web/deno/librusty_v8.nix
+++ b/pkgs/development/web/deno/librusty_v8.nix
@@ -11,11 +11,11 @@ let
   };
 in
 fetch_librusty_v8 {
-  version = "0.30.0";
+  version = "0.31.0";
   shas = {
-    x86_64-linux = "sha256-p5Vbt2fQPFR9SfLJ03f62/a8o9QIJOTXbA1s2liwNXY=";
-    aarch64-linux = "sha256-j12KjdnL19d5U/QRfB/7ahUzcYnUddItp29bLM/mWzs=";
-    x86_64-darwin = "sha256-w3k9oj+mP+i/hSf+ZjYLF+zsAcyLezbxhWXYoaPpn+U=";
-    aarch64-darwin = "sha256-bOtZoG8vXnSBNTPJDkyW0xbMEbmGNtq+mEPKoP78Yew=";
+    x86_64-linux = "sha256-KPoxq6rZnwghcDR5cMexN8EMeCfyuKoBcTZ3bv1mEpw=";
+    aarch64-linux = "sha256-S+lHGwbnCu2uNCIE+R5MljltOIqXpFAxvx0cglV8ZNI=";
+    x86_64-darwin = "sha256-o8O+X4SEXP7eY/dfHqe8NT7johtnPJQTBOgApFqOOhY=";
+    aarch64-darwin = "sha256-OQNQh6byNn9R0a6madgUMdUxbUv/R9psnwtTSr3BfzE=";
   };
 }
diff --git a/pkgs/games/crispy-doom/default.nix b/pkgs/games/crispy-doom/default.nix
index 987d0005d24ef..fea0d620a7019 100644
--- a/pkgs/games/crispy-doom/default.nix
+++ b/pkgs/games/crispy-doom/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "crispy-doom";
-  version = "5.10.2";
+  version = "5.10.3";
 
   src = fetchFromGitHub {
     owner = "fabiangreffrath";
     repo = pname;
     rev = "${pname}-${version}";
-    sha256 = "sha256-NUBodIojvlw46yLZ9Bn2pCpBwyVW8noOHQMM4uGmO3U=";
+    sha256 = "sha256-F1cK8qusxOHM0DkLEYV5i2ixP3II8ZttwKxd8htd0+A=";
   };
 
   postPatch = ''
diff --git a/pkgs/misc/arm-trusted-firmware/default.nix b/pkgs/misc/arm-trusted-firmware/default.nix
index c3be2213c337f..49d27487bae7a 100644
--- a/pkgs/misc/arm-trusted-firmware/default.nix
+++ b/pkgs/misc/arm-trusted-firmware/default.nix
@@ -80,6 +80,12 @@ in {
     filesToInstall = ["build/${platform}/release/bl31.bin"];
   };
 
+  armTrustedFirmwareAllwinnerH616 = buildArmTrustedFirmware rec {
+    platform = "sun50i_h616";
+    extraMeta.platforms = ["aarch64-linux"];
+    filesToInstall = ["build/${platform}/release/bl31.bin"];
+  };
+
   armTrustedFirmwareQemu = buildArmTrustedFirmware rec {
     platform = "qemu";
     extraMeta.platforms = ["aarch64-linux"];
diff --git a/pkgs/misc/uboot/default.nix b/pkgs/misc/uboot/default.nix
index 71f3e13fc906e..98f037b4fb929 100644
--- a/pkgs/misc/uboot/default.nix
+++ b/pkgs/misc/uboot/default.nix
@@ -11,6 +11,7 @@
 , swig
 , meson-tools
 , armTrustedFirmwareAllwinner
+, armTrustedFirmwareAllwinnerH616
 , armTrustedFirmwareRK3328
 , armTrustedFirmwareRK3399
 , armTrustedFirmwareS905
@@ -282,6 +283,13 @@ in {
     filesToInstall = ["u-boot-sunxi-with-spl.bin"];
   };
 
+  ubootOrangePiZero2 = buildUBoot {
+    defconfig = "orangepi_zero2_defconfig";
+    extraMeta.platforms = ["aarch64-linux"];
+    BL31 = "${armTrustedFirmwareAllwinnerH616}/bl31.bin";
+    filesToInstall = ["u-boot-sunxi-with-spl.bin"];
+  };
+
   ubootPcduino3Nano = buildUBoot {
     defconfig = "Linksprite_pcDuino3_Nano_defconfig";
     extraMeta.platforms = ["armv7l-linux"];
diff --git a/pkgs/misc/vscode-extensions/vscode-utils.nix b/pkgs/misc/vscode-extensions/vscode-utils.nix
index 1de3bce3d0db7..da3630f97c41a 100644
--- a/pkgs/misc/vscode-extensions/vscode-utils.nix
+++ b/pkgs/misc/vscode-extensions/vscode-utils.nix
@@ -6,8 +6,14 @@ let
     # Same as "Unique Identifier" on the extension's web page.
     # For the moment, only serve as unique extension dir.
     vscodeExtUniqueId,
-    configurePhase ? ":",
-    buildPhase ? ":",
+    configurePhase ? ''
+      runHook preConfigure
+      runHook postConfigure
+    '',
+    buildPhase ?''
+      runHook preBuild
+      runHook postBuild
+    '',
     dontPatchELF ? true,
     dontStrip ? true,
     buildInputs ? [],
diff --git a/pkgs/os-specific/linux/audit/default.nix b/pkgs/os-specific/linux/audit/default.nix
index 6fa7ba28d8e32..a7f17e4495054 100644
--- a/pkgs/os-specific/linux/audit/default.nix
+++ b/pkgs/os-specific/linux/audit/default.nix
@@ -37,7 +37,14 @@ stdenv.mkDerivation rec {
   # TODO: Remove the musl patches when
   #         https://github.com/linux-audit/audit-userspace/pull/25
   #       is available with the next release.
-  patches = [ ./patches/weak-symbols.patch ]
+  patches = [
+    ./patches/weak-symbols.patch
+    (fetchpatch {
+      # upstream build fix against -fno-common compilers like >=gcc-10
+      url = "https://github.com/linux-audit/audit-userspace/commit/017e6c6ab95df55f34e339d2139def83e5dada1f.patch";
+      sha256 = "100xa1rzkv0mvhjbfgpfm72f7c4p68syflvgc3xm6pxgrqqmfq8h";
+    })
+  ]
   ++ lib.optional stdenv.hostPlatform.isMusl [
     (
       let patch = fetchpatch {
diff --git a/pkgs/os-specific/linux/bcc/default.nix b/pkgs/os-specific/linux/bcc/default.nix
index 929981df47060..221f38faa8794 100644
--- a/pkgs/os-specific/linux/bcc/default.nix
+++ b/pkgs/os-specific/linux/bcc/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, fetchpatch
+{ lib, stdenv, fetchFromGitHub
 , makeWrapper, cmake, llvmPackages, kernel
 , flex, bison, elfutils, python, luajit, netperf, iperf, libelf
 , systemtap, bash, libbpf
@@ -29,12 +29,6 @@ python.pkgs.buildPythonApplication rec {
     # This is needed until we fix
     # https://github.com/NixOS/nixpkgs/issues/40427
     ./fix-deadlock-detector-import.patch
-    # Add definition for BTF_KIND_FLOAT, added in Linux 5.14
-    # Can be removed once linuxHeaders (used here via glibc) are bumped to 5.14+.
-    (fetchpatch {
-      url = "https://salsa.debian.org/debian/bpfcc/-/raw/71136ef5b66a2ecefd635a7aca2e0e835ff09095/debian/patches/0004-compat-defs.patch";
-      sha256 = "05s1zxihwkvbl2r2mqc5dj7fpcipqyvwr11v8b9hqbwjkm3qpz40";
-    })
   ];
 
   propagatedBuildInputs = [ python.pkgs.netaddr ];
diff --git a/pkgs/os-specific/linux/kernel-headers/default.nix b/pkgs/os-specific/linux/kernel-headers/default.nix
index 9d727838b3fb7..27428b37284d3 100644
--- a/pkgs/os-specific/linux/kernel-headers/default.nix
+++ b/pkgs/os-specific/linux/kernel-headers/default.nix
@@ -81,12 +81,12 @@ let
 in {
   inherit makeLinuxHeaders;
 
-  linuxHeaders = let version = "5.12"; in
+  linuxHeaders = let version = "5.14"; in
     makeLinuxHeaders {
       inherit version;
       src = fetchurl {
         url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-        sha256 = "sha256-fQ328r8jhNaNC9jh/j4HHWQ2Tc3GAC57XIfJLUj6w2Y=";
+        sha256 = "sha256-fgaLXg0mpisQ5TILJdzldYjLvG94HAkEQhOMnJwycbI=";
       };
       patches = [
          ./no-relocs.patch # for building x86 kernel headers on non-ELF platforms
diff --git a/pkgs/os-specific/linux/kernel/manual-config.nix b/pkgs/os-specific/linux/kernel/manual-config.nix
index dc59a3f2610cb..44e0b1d77b2db 100644
--- a/pkgs/os-specific/linux/kernel/manual-config.nix
+++ b/pkgs/os-specific/linux/kernel/manual-config.nix
@@ -261,8 +261,7 @@ let
         find .  -type f -name '*.lds' -print0 | xargs -0 -r chmod u-w
 
         # Keep root and arch-specific Makefiles
-        chmod u-w Makefile
-        chmod u-w arch/$arch/Makefile*
+        chmod u-w Makefile arch/"$arch"/Makefile*
 
         # Keep whole scripts dir
         chmod u-w -R scripts
diff --git a/pkgs/os-specific/linux/kexec-tools/default.nix b/pkgs/os-specific/linux/kexec-tools/default.nix
index 21d803e2b7211..6e6eecd493193 100644
--- a/pkgs/os-specific/linux/kexec-tools/default.nix
+++ b/pkgs/os-specific/linux/kexec-tools/default.nix
@@ -29,6 +29,13 @@ stdenv.mkDerivation rec {
       url = "https://src.fedoraproject.org/rpms/kexec-tools/raw/cb1e5463b5298b064e9b6c86ad6fe3505fec9298/f/kexec-tools-2.0.20-fix-broken-multiboot2-buliding-for-i386.patch";
       sha256 = "1kzmcsbhwfdgxlc5s88ir0n494phww1j16yk0z42x09qlkxxkg0l";
     })
+
+    (fetchpatch {
+      # upstream build fix against -fno-common compilers like >=gcc-10
+      name = "fno-common.patch";
+      url = "https://git.kernel.org/pub/scm/utils/kernel/kexec/kexec-tools.git/patch/?id=cc087b11462af9f971a2c090d07e8d780a867b50";
+      sha256 = "043hcsy6m14h64p6b9w25c7a3y0f487322dj81l6mbm6sws6s9lv";
+    })
   ];
 
   meta = with lib; {
diff --git a/pkgs/os-specific/linux/libsepol/default.nix b/pkgs/os-specific/linux/libsepol/default.nix
index 732ad88c70db4..e90c089420964 100644
--- a/pkgs/os-specific/linux/libsepol/default.nix
+++ b/pkgs/os-specific/linux/libsepol/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, flex }:
+{ lib, stdenv, fetchurl, fetchpatch, flex }:
 
 stdenv.mkDerivation rec {
   pname = "libsepol";
@@ -13,6 +13,20 @@ stdenv.mkDerivation rec {
     sha256 = "0ygb6dh5lng91xs6xiqf5v0nxa68qmjc787p0s5h9w89364f2yjv";
   };
 
+  patches = [
+    # upstream build fix against -fno-common compilers like >=gcc-10
+    (fetchpatch {
+      url = "https://github.com/SELinuxProject/selinux/commit/a96e8c59ecac84096d870b42701a504791a8cc8c.patch";
+      sha256 = "0aybv4kzbhx8xq6s82dsh4ib76k59qzh2bgxmk44iq5cjnqn5rd6";
+      stripLen = 1;
+    })
+    (fetchpatch {
+      url = "https://github.com/SELinuxProject/selinux/commit/3d32fc24d6aff360a538c63dad08ca5c957551b0.patch";
+      sha256 = "1mphwdlj4d6mwmsp5xkpf6ci4rxhgbi3fm79d08h4jbzxaf4wny4";
+      stripLen = 1;
+    })
+  ];
+
   postPatch = lib.optionalString stdenv.hostPlatform.isStatic ''
     substituteInPlace src/Makefile --replace 'all: $(LIBA) $(LIBSO)' 'all: $(LIBA)'
     sed -i $'/^\t.*LIBSO/d' src/Makefile
diff --git a/pkgs/os-specific/linux/rdma-core/default.nix b/pkgs/os-specific/linux/rdma-core/default.nix
index 242a4d03811f8..ae7fee77309a3 100644
--- a/pkgs/os-specific/linux/rdma-core/default.nix
+++ b/pkgs/os-specific/linux/rdma-core/default.nix
@@ -2,18 +2,16 @@
 , pandoc, ethtool, iproute2, libnl, udev, python3, perl
 } :
 
-let
-  version = "36.0";
 
-in stdenv.mkDerivation {
+stdenv.mkDerivation rec {
   pname = "rdma-core";
-  inherit version;
+  version = "37.0";
 
   src = fetchFromGitHub {
     owner = "linux-rdma";
     repo = "rdma-core";
     rev = "v${version}";
-    sha256 = "0x3mpwmhln6brwrwix9abdq1bs9zi4qnr3r64vwqk7l6f43mqd30";
+    sha256 = "0cz6dq34w0zxm1c6xk4pqascvvppa1b0m8jfnpncg5a68day8x65";
   };
 
   nativeBuildInputs = [ cmake pkg-config pandoc docutils ];
diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index 9f92c34cee6b7..e0a4128b0cdcb 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -184,9 +184,6 @@ stdenv.mkDerivation {
     substituteInPlace src/basic/path-util.h --replace "@defaultPathNormal@" "${placeholder "out"}/bin/"
     substituteInPlace src/boot/efi/meson.build \
       --replace \
-      "find_program('ld'" \
-      "find_program('${stdenv.cc.bintools.targetPrefix}ld'" \
-      --replace \
       "find_program('objcopy'" \
       "find_program('${stdenv.cc.bintools.targetPrefix}objcopy'"
   '' + (
@@ -408,6 +405,7 @@ stdenv.mkDerivation {
     "-Dsmack=true"
     "-Db_pie=true"
     "-Dinstall-sysconfdir=false"
+    "-Defi-ld=${stdenv.cc.bintools.targetPrefix}ld"
     /*
       As of now, systemd doesn't allow runtime configuration of these values. So
       the settings in /etc/login.defs have no effect on it. Many people think this
diff --git a/pkgs/servers/monitoring/unifi-poller/default.nix b/pkgs/servers/monitoring/unifi-poller/default.nix
index 745cfdd345958..6439407e99b85 100644
--- a/pkgs/servers/monitoring/unifi-poller/default.nix
+++ b/pkgs/servers/monitoring/unifi-poller/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "unifi-poller";
-  version = "2.1.0";
+  version = "2.1.3";
 
   src = fetchFromGitHub {
     owner = "unifi-poller";
     repo = "unifi-poller";
     rev = "v${version}";
-    sha256 = "sha256-C7QjMzmy2CMCk2oqRiThUQBKgltT0PzZArvZ+gOmJ2I=";
+    sha256 = "sha256-xh9s1xAhIeEmeDprl7iPdE6pxmxZjzgMvilobiIoJp0=";
   };
 
-  vendorSha256 = "sha256-LOBkdyfsw7ua6TsLglO5jdR9NWo5Df8rnQ8MH+eIz4g=";
+  vendorSha256 = "sha256-HoYgBKTl9HIMVzzzNYtRrfmqb7HCpPHVPeR4gUXneWk=";
 
   ldflags = [
     "-w" "-s"
diff --git a/pkgs/servers/moonraker/default.nix b/pkgs/servers/moonraker/default.nix
index 06a68557d75ea..00d721be2e83d 100644
--- a/pkgs/servers/moonraker/default.nix
+++ b/pkgs/servers/moonraker/default.nix
@@ -11,16 +11,17 @@ let
     inotify-simple
     libnacl
     paho-mqtt
+    pycurl
   ]);
 in stdenvNoCC.mkDerivation rec {
   pname = "moonraker";
-  version = "unstable-2021-09-04";
+  version = "unstable-2021-09-21";
 
   src = fetchFromGitHub {
     owner = "Arksine";
     repo = "moonraker";
-    rev = "db3f69e0dddcc8ac07e895a9a65906a8e08707e7";
-    sha256 = "uam3Vp/NA8HWxqqy6l8UkeaR5OSqHMwb5uXUL4E0jBQ=";
+    rev = "2447ccab6252fddc829da3eec8b29d1abe3dee60";
+    sha256 = "qaorF26e2pkOCxiUfo8MOPQVpZjx5G1uo66jFoQpMcs=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/servers/ums/default.nix b/pkgs/servers/ums/default.nix
index 3d4e4fdf51dc6..48398a5ba6e11 100644
--- a/pkgs/servers/ums/default.nix
+++ b/pkgs/servers/ums/default.nix
@@ -4,16 +4,16 @@
 
 stdenv.mkDerivation rec {
   pname = "ums";
-  version = "9.4.2";
+  version = "10.12.0";
 
   src = {
     i686-linux = fetchurl {
       url =  "mirror://sourceforge/project/unimediaserver/${version}/" + lib.toUpper "${pname}-${version}" + "-x86.tgz";
-      sha256 = "0i319g2c3z9j131nwh5m92clgnxxxs3izplzhjb30bx4lldmjs1j";
+      sha256 = "0j3d5zcwwswlcr2vicmvnnr7n8cg3q46svz0mbmga4j3da4473i6";
     };
     x86_64-linux = fetchurl {
       url =  "mirror://sourceforge/project/unimediaserver/${version}/" + lib.toUpper "${pname}-${version}" + "-x86_64.tgz";
-      sha256 = "07wc0is86fdfyz4as3f17q8pfzl8x55ci65zvpls0a9rfyyvjjw3";
+      sha256 = "06f96vkf593aasyfw458fa4x3rnai2k83vpgzc83hlwr0rw70qfn";
    };
   }.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
 
@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
 
     # ums >= 9.0.0 ships its own JRE in the package. if we remove it, the `UMS.sh`
     # script will correctly fall back to the JRE specified by JAVA_HOME
-    rm -rf $out/jre
+    rm -rf $out/jre8
 
     makeWrapper "$out/UMS.sh" "$out/bin/ums" \
       --prefix LD_LIBRARY_PATH ":" "${lib.makeLibraryPath [ libzen libmediainfo] }" \
diff --git a/pkgs/shells/oil/default.nix b/pkgs/shells/oil/default.nix
index 48bd2fcd83820..3d9a2ec24e689 100644
--- a/pkgs/shells/oil/default.nix
+++ b/pkgs/shells/oil/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "oil";
-  version = "0.9.2";
+  version = "0.9.3";
 
   src = fetchurl {
     url = "https://www.oilshell.org/download/oil-${version}.tar.xz";
-    sha256 = "sha256-msPRus7J/qMfFFaayQfrjFFqhSvPuwpr6EaobOCBaUE=";
+    sha256 = "sha256-YvNgcvafM3jgO3nY1SVcHRNglOwRQQ208W7oLxZg79o=";
   };
 
   postPatch = ''
diff --git a/pkgs/tools/archivers/cpio/default.nix b/pkgs/tools/archivers/cpio/default.nix
index 5b57dc20e3bf9..1ae8de975a5e2 100644
--- a/pkgs/tools/archivers/cpio/default.nix
+++ b/pkgs/tools/archivers/cpio/default.nix
@@ -22,6 +22,12 @@ stdenv.mkDerivation rec {
         "1qkrhi3lbxk6hflp6w3h4sgssc0wblv8r0qgxqzbjrm36pqwxiwh")
     (fp "3" "236684f6deb3178043fe72a8e2faca538fa2aae1"
         "0pidkbxalpj5yz4fr95x8h0rizgjij0xgvjgirfkjk460giawwg6")
+    (fetchpatch {
+      # upstream build fix against -fno-common compilers like >=gcc-10
+      name = "fno-common-fix.patch";
+      url = "https://git.savannah.gnu.org/cgit/cpio.git/patch/?id=641d3f489cf6238bb916368d4ba0d9325a235afb";
+      sha256 = "1ffawzxjw72kzpdwffi2y7pvibrmwf4jzrxdq9f4a75q6crl66iq";
+    })
   ];
 
   preConfigure = lib.optionalString stdenv.isCygwin ''
diff --git a/pkgs/tools/archivers/sharutils/default.nix b/pkgs/tools/archivers/sharutils/default.nix
index ec0f096915f11..c504ed8f16e1f 100644
--- a/pkgs/tools/archivers/sharutils/default.nix
+++ b/pkgs/tools/archivers/sharutils/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, gettext, coreutils }:
+{ lib, stdenv, fetchurl, fetchpatch, gettext, coreutils }:
 
 stdenv.mkDerivation rec {
   pname = "sharutils";
@@ -30,6 +30,19 @@ stdenv.mkDerivation rec {
       url = "https://sources.debian.org/data/main/s/sharutils/1:4.15.2-4/debian/patches/02-fix-ftbfs-with-glibc-2.28.patch";
       sha256 = "15kpjqnfs98n6irmkh8pw7masr08xala7gx024agv7zv14722vkc";
     })
+
+    # pending upstream build fix against -fno-common compilers like >=gcc-10
+    # Taken from https://lists.gnu.org/archive/html/bug-gnu-utils/2020-01/msg00002.html
+    (fetchpatch {
+      name = "sharutils-4.15.2-Fix-building-with-GCC-10.patch";
+      url = "https://lists.gnu.org/archive/html/bug-gnu-utils/2020-01/txtDL8i6V6mUU.txt";
+      sha256 = "0kfch1vm45lg237hr6fdv4b2lh5b1933k0fn8yj91gqm58svskvl";
+    })
+    (fetchpatch {
+      name = "sharutils-4.15.2-Do-not-include-lib-md5.c-into-src-shar.c.patch";
+      url = "https://lists.gnu.org/archive/html/bug-gnu-utils/2020-01/txt5Z_KZup0yN.txt";
+      sha256 = "0an8vfy3qj6sss9w0i4j8ilf7g5mbc7y13l644jy5bcm9przcjbd";
+    })
   ];
 
   postPatch = let
diff --git a/pkgs/tools/misc/chezmoi/default.nix b/pkgs/tools/misc/chezmoi/default.nix
index 8568c6b488c7a..415fed33170cf 100644
--- a/pkgs/tools/misc/chezmoi/default.nix
+++ b/pkgs/tools/misc/chezmoi/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "chezmoi";
-  version = "2.3.0";
+  version = "2.6.1";
 
   src = fetchFromGitHub {
     owner = "twpayne";
     repo = "chezmoi";
     rev = "v${version}";
-    sha256 = "sha256-hKWajx4cAs6rP536Xnz7zg2LPg36EwDDUBzpQkQLVoE=";
+    sha256 = "sha256-x5KqDVy+thIymZHsmyO+WsGq0IBb2cZxogKsjzunC2o=";
   };
 
-  vendorSha256 = "sha256-ECdsuKvBVyzRo9XviVldHnD4nND9P1v4esLz0+L+c7o=";
+  vendorSha256 = "sha256-8NhJfA9q6di/IPL53U/dwGNAAdtuBX5Lf6fhTk4Mz0Q=";
 
   doCheck = false;
 
diff --git a/pkgs/tools/misc/mandoc/default.nix b/pkgs/tools/misc/mandoc/default.nix
index da756f764d400..db0789c112671 100644
--- a/pkgs/tools/misc/mandoc/default.nix
+++ b/pkgs/tools/misc/mandoc/default.nix
@@ -1,41 +1,71 @@
-{ lib, stdenv, fetchurl, zlib }:
+{ lib, stdenv, fetchurl, zlib, perl }:
+
+let
+  # check if we can execute binaries for the host platform on the build platform
+  # even though the platforms aren't the same. mandoc can't be cross compiled
+  # (easily) because of its configurePhase, but we want to allow “native” cross
+  # such as pkgsLLVM and pkgsStatic.
+  executableCross = stdenv.hostPlatform.isCompatible stdenv.buildPlatform;
+
+  # Name of an UTF-8 locale _always_ present at runtime, used for UTF-8 support
+  # (locale set by the user may differ). This would usually be C.UTF-8, but
+  # darwin has no such locale.
+  utf8Locale =
+    if stdenv.hostPlatform.isDarwin
+    then "en_US.UTF-8"
+    else "C.UTF-8";
+in
+
+assert executableCross ||
+  throw "mandoc relies on executing compiled programs in configurePhase, can't cross compile";
 
 stdenv.mkDerivation rec {
   pname = "mandoc";
-  version = "1.14.5";
+  version = "1.14.6";
 
   src = fetchurl {
     url = "https://mandoc.bsd.lv/snapshots/mandoc-${version}.tar.gz";
-    sha256 = "1xyqllxpjj1kimlipx11pzyywf5c25i4wmv0lqm7ph3gnlnb86c2";
+    sha256 = "8bf0d570f01e70a6e124884088870cbed7537f36328d512909eb10cd53179d9c";
   };
 
   buildInputs = [ zlib ];
 
   configureLocal = ''
-    HAVE_WCHAR=1
     MANPATH_DEFAULT="/run/current-system/sw/share/man"
+    MANPATH_BASE="$MANPATH_DEFAULT"
     OSNAME="NixOS"
     PREFIX="$out"
-    HAVE_MANPATH=1
     LD_OHASH="-lutil"
-    BUILD_DB=0
+    # Use symlinks instead of hardlinks (more commonly used in nixpkgs)
+    LN="ln -sf"
+    # nixpkgs doesn't have sbin, install makewhatis to bin
+    SBINDIR="$PREFIX/bin"
     CC=${stdenv.cc.targetPrefix}cc
+    AR=${stdenv.cc.bintools.targetPrefix}ar
+    # Bypass the locale(1)-based check for UTF-8 support since it causes trouble:
+    # * We only have meaningful locale(1) implementations for glibc and macOS
+    # * NetBSD's locale(1) (used for macOS) depends on mandoc
+    # * Sandbox and locales cause all kinds of trouble
+    # * build and host libc (and thus locale handling) may differ
+    HAVE_WCHAR=1
+    UTF8_LOCALE=${utf8Locale}
   '';
 
-  patches = [
-    ./remove-broken-cc-check.patch
-  ];
-
   preConfigure = ''
-    echo $configureLocal > configure.local
+    printf '%s' "$configureLocal" > configure.local
   '';
 
+  doCheck = executableCross;
+  checkTarget = "regress";
+  checkInputs = [ perl ];
+  preCheck = "patchShebangs --build regress/regress.pl";
+
   meta = with lib; {
     homepage = "https://mandoc.bsd.lv/";
     description = "suite of tools compiling mdoc and man";
     downloadPage = "http://mandoc.bsd.lv/snapshots/";
     license = licenses.bsd3;
     platforms = platforms.all;
-    maintainers = with maintainers; [ bb010g ramkromberg ];
+    maintainers = with maintainers; [ bb010g ramkromberg sternenseemann ];
   };
 }
diff --git a/pkgs/tools/misc/mandoc/remove-broken-cc-check.patch b/pkgs/tools/misc/mandoc/remove-broken-cc-check.patch
deleted file mode 100644
index 580226d165bb1..0000000000000
--- a/pkgs/tools/misc/mandoc/remove-broken-cc-check.patch
+++ /dev/null
@@ -1,11 +0,0 @@
---- mandoc-1.14.4.org/configure	2018-08-08 15:51:51.000000000 +0100
-+++ mandoc-1.14.4/configure	2018-08-27 08:19:40.391912427 +0100
-@@ -40,7 +40,7 @@
- OSNAME=
- UTF8_LOCALE=
- 
--CC=`printf "all:\\n\\t@echo \\\$(CC)\\n" | env -i make -sf -`
-+CC=
- CFLAGS=
- LDADD=
- LDFLAGS=
diff --git a/pkgs/tools/misc/yle-dl/default.nix b/pkgs/tools/misc/yle-dl/default.nix
index cb3beca97038c..31d5712e5b33a 100644
--- a/pkgs/tools/misc/yle-dl/default.nix
+++ b/pkgs/tools/misc/yle-dl/default.nix
@@ -2,13 +2,13 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "yle-dl";
-  version = "20210808";
+  version = "20210917";
 
   src = fetchFromGitHub {
     owner = "aajanki";
     repo = "yle-dl";
     rev = version;
-    sha256 = "sha256-pHre4R0zVML1Stp0H4E3ee9Xbb3KNLgZFWOJPC5KTA8=";
+    sha256 = "sha256-l8Wv15DLWRvJ+I6KeTNbIjp+S5EgoqhLOWd0wEyXckk=";
   };
 
   propagatedBuildInputs = with python3Packages; [
diff --git a/pkgs/tools/networking/dhcp/default.nix b/pkgs/tools/networking/dhcp/default.nix
index 2a722d17c01f1..7df04ac0c8957 100644
--- a/pkgs/tools/networking/dhcp/default.nix
+++ b/pkgs/tools/networking/dhcp/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, perl, file, nettools, iputils, iproute2, makeWrapper
+{ stdenv, fetchurl, fetchpatch, perl, file, nettools, iputils, iproute2, makeWrapper
 , coreutils, gnused, openldap ? null
 , buildPackages, lib
 }:
@@ -18,6 +18,12 @@ stdenv.mkDerivation rec {
       # patch, the hostname doesn't get set properly if the old
       # hostname (i.e. before reboot) is equal to the new hostname.
       ./set-hostname.patch
+
+      (fetchpatch {
+        # upstream build fix against -fno-common compilers like >=gcc-10
+        url = "https://gitlab.isc.org/isc-projects/dhcp/-/commit/6c7e61578b1b449272dbb40dd8b98d03dad8a57a.patch";
+        sha256 = "1g37ix0yf9zza8ri8bg438ygcjviniblfyb20y4gzc8lysy28m8b";
+      })
     ];
 
   nativeBuildInputs = [ perl makeWrapper ];
diff --git a/pkgs/tools/security/apkleaks/default.nix b/pkgs/tools/security/apkleaks/default.nix
new file mode 100644
index 0000000000000..133601e4025f0
--- /dev/null
+++ b/pkgs/tools/security/apkleaks/default.nix
@@ -0,0 +1,37 @@
+{ lib
+, fetchFromGitHub
+, jadx
+, python3
+}:
+
+python3.pkgs.buildPythonApplication rec {
+  pname = "apkleaks";
+  version = "2.6.1";
+
+  disabled = python3.pythonOlder "3.6";
+
+  src = fetchFromGitHub {
+    owner = "dwisiswant0";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "0ysciv643p8gkqw2wp7zy4n07hihdcyil8d20lj86cpgga71rd64";
+  };
+
+  propagatedBuildInputs = with python3.pkgs; [
+    jadx
+    pyaxmlparser
+    setuptools
+  ];
+
+  # Project has no tests
+  doCheck = false;
+
+  pythonImportsCheck = [ "apkleaks" ];
+
+  meta = with lib; {
+    description = "Scanning APK file for URIs, endpoints and secrets";
+    homepage = "https://github.com/dwisiswant0/apkleaks";
+    license = with licenses; [ asl20 ];
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/tools/security/ghost/default.nix b/pkgs/tools/security/ghost/default.nix
new file mode 100644
index 0000000000000..124caef45c209
--- /dev/null
+++ b/pkgs/tools/security/ghost/default.nix
@@ -0,0 +1,34 @@
+{ lib
+, fetchFromGitHub
+, python3
+}:
+
+python3.pkgs.buildPythonApplication rec {
+  pname = "ghost";
+  version = "8.0.0";
+
+  disabled = python3.pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "EntySec";
+    repo = "Ghost";
+    rev = version;
+    sha256 = "13p3inw7v55na8438awr692v9vb7zgf5ggxpha9r3m8vfm3sb4iz";
+  };
+
+  propagatedBuildInputs = with python3.pkgs; [
+    adb-shell
+  ];
+
+  # Project has no tests
+  doCheck = false;
+
+  pythonImportsCheck = [ "ghost" ];
+
+  meta = with lib; {
+    description = "Android post-exploitation framework";
+    homepage = "https://github.com/EntySec/ghost";
+    license = with licenses; [ mit ];
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/tools/system/htop/default.nix b/pkgs/tools/system/htop/default.nix
index 350c20ae101d2..bc8dde743c8e2 100644
--- a/pkgs/tools/system/htop/default.nix
+++ b/pkgs/tools/system/htop/default.nix
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
     ++ optional systemdSupport systemd
   ;
 
-  configureFlags = [ "--enable-unicode" ]
+  configureFlags = [ "--enable-unicode" "--sysconfdir=/etc" ]
     ++ optional sensorsSupport "--with-sensors"
   ;
 
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index c4f3a7f06e824..972f01b4f6cb0 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -143,7 +143,8 @@ with pkgs;
 
   autorestic = callPackage ../tools/backup/autorestic { };
 
-  autoPatchelfHook = makeSetupHook { name = "auto-patchelf-hook"; }
+  autoPatchelfHook = makeSetupHook
+    { name = "auto-patchelf-hook"; deps = [ bintools ]; }
     ../build-support/setup-hooks/auto-patchelf.sh;
 
   appimageTools = callPackage ../build-support/appimage {
@@ -1170,6 +1171,8 @@ with pkgs;
 
   apkid = callPackage ../development/tools/apkid { };
 
+  apkleaks = callPackage ../tools/security/apkleaks { };
+
   apksigcopier = callPackage ../development/tools/apksigcopier { };
 
   apksigner = callPackage ../development/tools/apksigner {
@@ -3829,7 +3832,7 @@ with pkgs;
 
   circus = callPackage ../tools/networking/circus { };
 
-  citrix_workspace = citrix_workspace_21_08_0;
+  citrix_workspace = citrix_workspace_21_09_0;
 
   inherit (callPackage ../applications/networking/remote/citrix-workspace { })
     citrix_workspace_20_04_0
@@ -3841,6 +3844,7 @@ with pkgs;
     citrix_workspace_21_03_0
     citrix_workspace_21_06_0
     citrix_workspace_21_08_0
+    citrix_workspace_21_09_0
   ;
 
   citra = libsForQt5.callPackage ../misc/emulators/citra { };
@@ -5220,7 +5224,9 @@ with pkgs;
 
   fverb = callPackage ../applications/audio/fverb { };
 
-  fwknop = callPackage ../tools/security/fwknop { };
+  fwknop = callPackage ../tools/security/fwknop {
+    texinfo = texinfo6_7; # Uses @setcontentsaftertitlepage, removed in 6.8.
+  };
 
   exfat = callPackage ../tools/filesystems/exfat { };
 
@@ -5310,6 +5316,8 @@ with pkgs;
 
   ghorg = callPackage ../applications/version-management/git-and-tools/ghorg { };
 
+  ghost = callPackage ../tools/security/ghost { };
+
   ghostunnel = callPackage ../tools/networking/ghostunnel { };
 
   ghq = callPackage ../applications/version-management/git-and-tools/ghq { };
@@ -15002,8 +15010,8 @@ with pkgs;
   texinfo4 = texinfo413;
   texinfo5 = callPackage ../development/tools/misc/texinfo/5.2.nix { };
   texinfo6_5 = callPackage ../development/tools/misc/texinfo/6.5.nix { }; # needed for allegro
-  texinfo6 = callPackage ../development/tools/misc/texinfo/6.7.nix { };
-  texinfo6_8 = callPackage ../development/tools/misc/texinfo/6.8.nix { };
+  texinfo6_7 = callPackage ../development/tools/misc/texinfo/6.7.nix { }; # needed for gpm, iksemel and fwknop
+  texinfo6 = callPackage ../development/tools/misc/texinfo/6.8.nix { };
   texinfo = texinfo6;
   texinfoInteractive = appendToName "interactive" (
     texinfo.override { interactive = true; }
@@ -21264,6 +21272,7 @@ with pkgs;
     buildArmTrustedFirmware
     armTrustedFirmwareTools
     armTrustedFirmwareAllwinner
+    armTrustedFirmwareAllwinnerH616
     armTrustedFirmwareQemu
     armTrustedFirmwareRK3328
     armTrustedFirmwareRK3399
@@ -21478,6 +21487,10 @@ with pkgs;
 
   gpm = callPackage ../servers/gpm {
     ncurses = null;  # Keep curses disabled for lack of value
+
+    # latest 6.8 mysteriously fails to parse '@headings single':
+    #   https://lists.gnu.org/archive/html/bug-texinfo/2021-09/msg00011.html
+    texinfo = texinfo6_7;
   };
 
   gpm-ncurses = gpm.override { inherit ncurses; };
@@ -22251,6 +22264,7 @@ with pkgs;
     ubootOrangePiPc
     ubootOrangePiZeroPlus2H5
     ubootOrangePiZero
+    ubootOrangePiZero2
     ubootPcduino3Nano
     ubootPine64
     ubootPine64LTS
@@ -25377,7 +25391,9 @@ with pkgs;
     inherit (perlPackages.override { pkgs = pkgs // { imagemagick = imagemagickBig;}; }) ImageMagick;
   };
 
-  iksemel = callPackage ../development/libraries/iksemel { };
+  iksemel = callPackage ../development/libraries/iksemel {
+    texinfo = texinfo6_7; # Uses @setcontentsaftertitlepage, removed in 6.8.
+  };
 
   imag = callPackage ../applications/misc/imag {
     inherit (darwin.apple_sdk.frameworks) Security;
@@ -25429,6 +25445,7 @@ with pkgs;
     djvulibre = null;
     lcms2 = null;
     openexr = null;
+    libjxl = null;
     libpng = null;
     liblqr1 = null;
     librsvg = null;