Merge remote-tracking branch 'upstream/staging-next' into down-integrate-staging

44 files changed, 404 insertions, 316 deletions

diff --git a/pkgs/tools/admin/lxd/default.nix b/pkgs/tools/admin/lxd/default.nix
index 91f71ece4210e..417e01a325d37 100644
--- a/pkgs/tools/admin/lxd/default.nix
+++ b/pkgs/tools/admin/lxd/default.nix
@@ -18,13 +18,13 @@ let
 in
 buildGoPackage rec {
   pname = "lxd";
-  version = "4.12";
+  version = "4.13";
 
   goPackagePath = "github.com/lxc/lxd";
 
   src = fetchurl {
     url = "https://github.com/lxc/lxd/releases/download/${pname}-${version}/${pname}-${version}.tar.gz";
-    sha256 = "1qgi9ciljq8h3ja9kalfvnxnjymddd5j4agv984137z443mqfnrw";
+    sha256 = "0w2r80wf86jijgfxbkv06lgfhz4p2aaidsqd96bx3q1382nrbzcf";
   };
 
   postPatch = ''
diff --git a/pkgs/tools/admin/pulumi/data.nix b/pkgs/tools/admin/pulumi/data.nix
index 707aff2011b75..5a1dcfe16ecc8 100644
--- a/pkgs/tools/admin/pulumi/data.nix
+++ b/pkgs/tools/admin/pulumi/data.nix
@@ -1,20 +1,20 @@
 # DO NOT EDIT! This file is generated automatically by update.sh
 { }:
 {
-  version = "2.23.2";
+  version = "2.24.1";
   pulumiPkgs = {
     x86_64-linux = [
       {
-        url = "https://get.pulumi.com/releases/sdk/pulumi-v2.23.2-linux-x64.tar.gz";
-        sha256 = "0bg90kj8lb1bw3vx0672rbzmc5wylx90cad3h93qlwxsfvijmk7x";
+        url = "https://get.pulumi.com/releases/sdk/pulumi-v2.24.1-linux-x64.tar.gz";
+        sha256 = "1c3a0ibwchl0lmcb8hr4j0x9b7hfsd0pfg6ay808zg1v8ddrj3xm";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-auth0-v1.9.1-linux-amd64.tar.gz";
-        sha256 = "084l6si66sxy55i4y14rn287v69vli17n283s718v00zrmgdah35";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-auth0-v1.10.0-linux-amd64.tar.gz";
+        sha256 = "1gqbs33mqqssymn48glm9h5qfkc1097ygk0mdanfigyhwv6rdmnc";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aws-v3.34.2-linux-amd64.tar.gz";
-        sha256 = "1xpil1a7gwcmjb3my9s37gf45i17l5mnxh0bkfbfwiw5znv7cjqa";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aws-v3.36.0-linux-amd64.tar.gz";
+        sha256 = "0dg5szlslp863slv6lfd8g98946ljvxhvq64b3j4zk6rsn0badvh";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-cloudflare-v2.14.2-linux-amd64.tar.gz";
@@ -29,20 +29,20 @@
         sha256 = "0b3bz952wz7fsbk51j0mlfsyyg9ymc9wnq8kgm7dvs1p5zgzv4ni";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-digitalocean-v3.6.1-linux-amd64.tar.gz";
-        sha256 = "114r26ncf3rlw6h0wsmyxhpcxb5hy20fk8kav858hvqacby5w6sq";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-digitalocean-v3.7.0-linux-amd64.tar.gz";
+        sha256 = "0l1y8fckx7k3lasb6rzy3v58cl1x3qzbb999wi14z16z2a63zwsw";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-docker-v2.9.1-linux-amd64.tar.gz";
         sha256 = "178l4h7wj9pn1283zajaqm7fwcfwzpzq7swrgr8q880qsa611gjs";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-gcp-v4.17.0-linux-amd64.tar.gz";
-        sha256 = "0xzix9mn3n3n4y7l6xl0bn2xq338436ykb34j2fi20wxg5wb99lf";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-gcp-v4.19.0-linux-amd64.tar.gz";
+        sha256 = "0iliagpyvzn63pwcdq74w8ag9vc7asqpq658b19zly4jd6z3cwkd";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-github-v3.3.1-linux-amd64.tar.gz";
-        sha256 = "1pg1q70gkp300swl5hnjdx7s9yjg0d88r280ylga73syncms4s3w";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-github-v3.4.0-linux-amd64.tar.gz";
+        sha256 = "0zp3rwhngj009a9s6w2vyvgyhj7nd03mwm44x62ikhnz6f414kr9";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-gitlab-v3.8.1-linux-amd64.tar.gz";
@@ -73,8 +73,8 @@
         sha256 = "0glbjhgrb2hiyhd6kwmy7v384j8zw641pw9737g1fczv3x16a3s3";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-postgresql-v2.8.1-linux-amd64.tar.gz";
-        sha256 = "05rcvp2gkx14gy46a0vx9ch3xysnn0wlgsn80rfav35v932x9f3g";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-postgresql-v2.9.0-linux-amd64.tar.gz";
+        sha256 = "0n486h5f683yq6z53s9l9x5air1vk4nz1skiirsprz7a12cy2xkn";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-random-v3.1.1-linux-amd64.tar.gz";
@@ -91,16 +91,16 @@
     ];
     x86_64-darwin = [
       {
-        url = "https://get.pulumi.com/releases/sdk/pulumi-v2.23.2-darwin-x64.tar.gz";
-        sha256 = "19g3bsmrjwfbnmw20zh0cqnhz83jl4ikfwg4rhdxsvazdmbym905";
+        url = "https://get.pulumi.com/releases/sdk/pulumi-v2.24.1-darwin-x64.tar.gz";
+        sha256 = "1x6z0drvaxrps47nisvw513vgskaf86mz8fzlhqfkddp2k5la5j1";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-auth0-v1.9.1-darwin-amd64.tar.gz";
-        sha256 = "1jkw0pvwz25dvxva7dipdxf4lppgr2m8ynbjl32fijzqs61y690m";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-auth0-v1.10.0-darwin-amd64.tar.gz";
+        sha256 = "05cz7b738bcai4aiya4rkjhmkh9pg6za4xp2snb9nx0jkw2vw2ms";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aws-v3.34.2-darwin-amd64.tar.gz";
-        sha256 = "0chjps0m203xb1ybky77lg1miv7d4cp1z8xxqhymrylfqaz4xj8q";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aws-v3.36.0-darwin-amd64.tar.gz";
+        sha256 = "0k74x9a6b9xngrp1cgdal86h23m95r5sa3q036ms4py0phq47r2w";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-cloudflare-v2.14.2-darwin-amd64.tar.gz";
@@ -115,20 +115,20 @@
         sha256 = "09nd5nfvjqgpbjs82bm5ym5wdg37mg863wvdp8s3fd8id4gdqb24";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-digitalocean-v3.6.1-darwin-amd64.tar.gz";
-        sha256 = "1f3mfgh24h2hwmshs4qpplgrxplxl7iab29xp4c7p1g573na3b7a";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-digitalocean-v3.7.0-darwin-amd64.tar.gz";
+        sha256 = "0iflll8lkk3s3dx3xl0iqmxac9nlspjnv8gmjfqwpryzk8h1fmzy";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-docker-v2.9.1-darwin-amd64.tar.gz";
         sha256 = "10vp75fc41yk9lg5x7wyhs4mn2f4krfnw4jn5xys7dd475blm6rh";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-gcp-v4.17.0-darwin-amd64.tar.gz";
-        sha256 = "0cl7im10is9wvw3ygis9xy3f77npijsf1dsb49ww057kqhgv1v3i";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-gcp-v4.19.0-darwin-amd64.tar.gz";
+        sha256 = "061s8snsgz044ilh2s48810bmayypdyq9aqkhgal6v3l86jl8m95";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-github-v3.3.1-darwin-amd64.tar.gz";
-        sha256 = "1b7azajh9kzq8akyf5pf16hh3had8iwph6cw06b7mv1wqyd01k6z";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-github-v3.4.0-darwin-amd64.tar.gz";
+        sha256 = "1p6xxhy30qzprxk3kwiwimw5m0c73fk7c9j4vrzj2z4kpgj8qx7w";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-gitlab-v3.8.1-darwin-amd64.tar.gz";
@@ -159,8 +159,8 @@
         sha256 = "0621njipng32x43lw8n49mapq10lnvibg8vlvgciqsfvrbpz1yp5";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-postgresql-v2.8.1-darwin-amd64.tar.gz";
-        sha256 = "1r5rhn1yjjr0rw7qm2n8dqyqk1r1hkgvdmdq2x9smnvd2mwwjfah";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-postgresql-v2.9.0-darwin-amd64.tar.gz";
+        sha256 = "08af55rrzpm42vx7w1i1cmfk48czjfwln737prp5mwcvddmg5s1g";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-random-v3.1.1-darwin-amd64.tar.gz";
diff --git a/pkgs/tools/admin/pulumi/update.sh b/pkgs/tools/admin/pulumi/update.sh
index af65df8daebdb..31ac38ab27562 100755
--- a/pkgs/tools/admin/pulumi/update.sh
+++ b/pkgs/tools/admin/pulumi/update.sh
@@ -3,20 +3,20 @@
 
 # Version of Pulumi from
 # https://www.pulumi.com/docs/get-started/install/versions/
-VERSION="2.23.2"
+VERSION="2.24.1"
 
 # Grab latest release ${VERSION} from
 # https://github.com/pulumi/pulumi-${NAME}/releases
 plugins=(
-    "auth0=1.9.1"
-    "aws=3.34.2"
+    "auth0=1.10.0"
+    "aws=3.36.0"
     "cloudflare=2.14.2"
     "consul=2.9.1"
     "datadog=2.17.1"
-    "digitalocean=3.6.1"
+    "digitalocean=3.7.0"
     "docker=2.9.1"
-    "gcp=4.17.0"
-    "github=3.3.1"
+    "gcp=4.19.0"
+    "github=3.4.0"
     "gitlab=3.8.1"
     "hcloud=0.7.1"
     "kubernetes=2.8.3"
@@ -24,7 +24,7 @@ plugins=(
     "mysql=2.5.1"
     "openstack=2.17.1"
     "packet=3.2.2"
-    "postgresql=2.8.1"
+    "postgresql=2.9.0"
     "random=3.1.1"
     "vault=3.5.1"
     "vsphere=2.13.1"
diff --git a/pkgs/tools/audio/spotdl/default.nix b/pkgs/tools/audio/spotdl/default.nix
index 520af8404aeb1..5dc6e39f8d2e1 100644
--- a/pkgs/tools/audio/spotdl/default.nix
+++ b/pkgs/tools/audio/spotdl/default.nix
@@ -1,20 +1,30 @@
 { lib
 , python3
 , fetchFromGitHub
+, fetchpatch
 , ffmpeg
 }:
 
 python3.pkgs.buildPythonApplication rec {
   pname = "spotdl";
-  version = "3.5.0";
+  version = "3.5.1";
 
   src = fetchFromGitHub {
     owner = "spotDL";
     repo = "spotify-downloader";
     rev = "v${version}";
-    sha256 = "1nxf911hi578jw24hlcvyy33z1pkvr41pfrywbs3157rj1fj2vfi";
+    sha256 = "sha256-Mc0aODyt0rwmBhkvY/gH1ODz4k8LOxyU5xXglSb6sPs=";
   };
 
+  patches = [
+    # https://github.com/spotDL/spotify-downloader/pull/1254
+    (fetchpatch {
+      name = "subprocess-dont-use-shell.patch";
+      url = "https://github.com/spotDL/spotify-downloader/commit/fe9848518900577776b463ef0798796201e226ac.patch";
+      sha256 = "1kqq3y31dcx1zglywr564hkd2px3qx6sk3rkg7yz8n5hnfjhp6fn";
+    })
+  ];
+
   propagatedBuildInputs = with python3.pkgs; [
     spotipy
     pytube
@@ -32,6 +42,7 @@ python3.pkgs.buildPythonApplication rec {
     pytest-mock
     pytest-vcr
     pyfakefs
+    pytest-subprocess
   ];
 
   makeWrapperArgs = [
diff --git a/pkgs/tools/filesystems/ceph/ceph-glibc-2-32-sigdescr_np.patch b/pkgs/tools/filesystems/ceph/ceph-glibc-2-32-sigdescr_np.patch
deleted file mode 100644
index f78c7af9e35ab..0000000000000
--- a/pkgs/tools/filesystems/ceph/ceph-glibc-2-32-sigdescr_np.patch
+++ /dev/null
@@ -1,63 +0,0 @@
-From b9b6faf66ae67648626470cb4fc3f0850ac4d842 Mon Sep 17 00:00:00 2001
-From: David Disseldorp <ddiss@suse.de>
-Date: Tue, 1 Sep 2020 13:49:21 +0200
-Subject: [PATCH] cmake: detect and use sigdescr_np() if available
-
-sys_siglist is deprecated with glibc 2.32. A new thread-safe and
-async-signal safe sigdescr_np() function is provided, so use it if
-available.
-
-Fixes: https://tracker.ceph.com/issues/47187
-Signed-off-by: David Disseldorp <ddiss@suse.de>
----
- cmake/modules/CephChecks.cmake | 1 +
- src/global/signal_handler.h    | 8 +++++---
- src/include/config-h.in.cmake  | 3 +++
- 3 files changed, 9 insertions(+), 3 deletions(-)
-
-diff --git a/cmake/modules/CephChecks.cmake b/cmake/modules/CephChecks.cmake
-index 23687283a7c6..ca86dcbc73de 100644
---- a/cmake/modules/CephChecks.cmake
-+++ b/cmake/modules/CephChecks.cmake
-@@ -24,6 +24,7 @@ check_function_exists(strerror_r HAVE_Strerror_R)
- check_function_exists(name_to_handle_at HAVE_NAME_TO_HANDLE_AT)
- check_function_exists(pipe2 HAVE_PIPE2)
- check_function_exists(accept4 HAVE_ACCEPT4)
-+check_function_exists(sigdescr_np HAVE_SIGDESCR_NP)
- 
- include(CMakePushCheckState)
- cmake_push_check_state(RESET)
-diff --git a/src/global/signal_handler.h b/src/global/signal_handler.h
-index 476724201aa9..c101b2e28733 100644
---- a/src/global/signal_handler.h
-+++ b/src/global/signal_handler.h
-@@ -20,10 +20,12 @@
- 
- typedef void (*signal_handler_t)(int);
- 
--#ifndef HAVE_REENTRANT_STRSIGNAL
--# define sig_str(signum) sys_siglist[signum]
--#else
-+#ifdef HAVE_SIGDESCR_NP
-+# define sig_str(signum) sigdescr_np(signum)
-+#elif HAVE_REENTRANT_STRSIGNAL
- # define sig_str(signum) strsignal(signum)
-+#else
-+# define sig_str(signum) sys_siglist[signum]
- #endif
- 
- void install_sighandler(int signum, signal_handler_t handler, int flags);
-diff --git a/src/include/config-h.in.cmake b/src/include/config-h.in.cmake
-index 1ea3703f620c..59bd4273511a 100644
---- a/src/include/config-h.in.cmake
-+++ b/src/include/config-h.in.cmake
-@@ -220,6 +220,9 @@
- /* Define to 1 if you have sched.h. */
- #cmakedefine HAVE_SCHED 1
- 
-+/* Define to 1 if you have sigdescr_np. */
-+#cmakedefine HAVE_SIGDESCR_NP 1
-+
- /* Support SSE (Streaming SIMD Extensions) instructions */
- #cmakedefine HAVE_SSE
- 
diff --git a/pkgs/tools/filesystems/ceph/default.nix b/pkgs/tools/filesystems/ceph/default.nix
index aaa5806d402a9..e923bb6132ecd 100644
--- a/pkgs/tools/filesystems/ceph/default.nix
+++ b/pkgs/tools/filesystems/ceph/default.nix
@@ -110,6 +110,7 @@ let
     ps.jsonpatch
     ps.pecan
     ps.prettytable
+    ps.pyopenssl
     ps.pyjwt
     ps.webob
     ps.bcrypt
@@ -122,10 +123,10 @@ let
   ]);
   sitePackages = ceph-python-env.python.sitePackages;
 
-  version = "15.2.8";
+  version = "15.2.10";
   src = fetchurl {
     url = "http://download.ceph.com/tarballs/ceph-${version}.tar.gz";
-    sha256 = "1nmrras3g2zapcd06qr5m7y4zkymnr0r53jkpicjw2g4q7wfmib4";
+    sha256 = "1xfijynfb56gydpwh6h4q781xymwxih6nx26idnkcjqih48nsn01";
   };
 in rec {
   ceph = stdenv.mkDerivation {
@@ -134,7 +135,6 @@ in rec {
 
     patches = [
       ./0000-fix-SPDK-build-env.patch
-      ./ceph-glibc-2-32-sigdescr_np.patch
     ];
 
     nativeBuildInputs = [
diff --git a/pkgs/tools/graphics/wdisplays/default.nix b/pkgs/tools/graphics/wdisplays/default.nix
index 2640769d186bc..073a3b1b6d476 100644
--- a/pkgs/tools/graphics/wdisplays/default.nix
+++ b/pkgs/tools/graphics/wdisplays/default.nix
@@ -1,36 +1,25 @@
-{ lib, stdenv, fetchFromGitHub, meson, ninja, pkg-config, gtk3, epoxy, wayland, wrapGAppsHook
-, fetchpatch
-}:
+{ lib, stdenv, fetchFromGitHub, meson, ninja, pkg-config, gtk3, epoxy, wayland, wrapGAppsHook }:
 
 stdenv.mkDerivation rec {
   pname = "wdisplays";
-  version = "1.0";
+  version = "unstable-2021-04-03";
 
   nativeBuildInputs = [ meson ninja pkg-config wrapGAppsHook ];
 
   buildInputs = [ gtk3 epoxy wayland ];
 
   src = fetchFromGitHub {
-    owner = "cyclopsian";
+    owner = "luispabon";
     repo = "wdisplays";
-    rev = version;
-    sha256 = "1xhgrcihja2i7yg54ghbwr1v6kf8jnsfcp364yb97vkxskc4y21y";
+    rev = "7f2eac0d2aa81b5f495da7950fd5a94683f7868e";
+    sha256 = "sha256-cOF3+T34zPro58maWUouGG+vlLm2C5NfcH7PZhSvApE=";
   };
 
-  patches = [
-    # Fixes `Gdk-Message: 10:26:38.752: Error reading events from display: Success`
-    # https://github.com/cyclopsian/wdisplays/pull/20
-    (fetchpatch {
-      url = "https://github.com/cyclopsian/wdisplays/commit/5198a9c94b40ff157c284df413be5402f1b75118.patch";
-      sha256 = "1xwphyn0ksf8isy9dz3mfdhmsz4jv02870qz5615zs7aqqfcwn85";
-    })
-  ];
-
   meta = with lib; {
     description = "A graphical application for configuring displays in Wayland compositors";
-    homepage = "https://github.com/cyclopsian/wdisplays";
-    maintainers = with lib.maintainers; [ lheckemann ma27 ];
-    license = lib.licenses.mit;
-    platforms = lib.platforms.linux;
+    homepage = "https://github.com/luispabon/wdisplays";
+    maintainers = with maintainers; [ lheckemann ma27 ];
+    license = licenses.gpl3Plus;
+    platforms = platforms.linux;
   };
 }
diff --git a/pkgs/tools/inputmethods/fcitx5/fcitx5-lua.nix b/pkgs/tools/inputmethods/fcitx5/fcitx5-lua.nix
index 560393b31939f..f4df324fa0587 100644
--- a/pkgs/tools/inputmethods/fcitx5/fcitx5-lua.nix
+++ b/pkgs/tools/inputmethods/fcitx5/fcitx5-lua.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation rec {
   pname = "fcitx5-lua";
-  version = "5.0.3";
+  version = "5.0.4";
 
   src = fetchFromGitHub {
     owner = "fcitx";
     repo = "fcitx5-lua";
     rev = version;
-    sha256 = "sha256-46s3F3NHGuef0wPhYiPocms0jv5Vo+cVRd5FzlfjMZY=";
+    sha256 = "sha256-1gKfFq+x/tCOYqESO49Qddp5z6zXO7ULjTJgDEl8BqI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/inputmethods/fcitx5/fcitx5-qt.nix b/pkgs/tools/inputmethods/fcitx5/fcitx5-qt.nix
index bfb06a98e8fdd..b24dac6886d93 100644
--- a/pkgs/tools/inputmethods/fcitx5/fcitx5-qt.nix
+++ b/pkgs/tools/inputmethods/fcitx5/fcitx5-qt.nix
@@ -12,13 +12,13 @@
 
 mkDerivation rec {
   pname = "fcitx5-qt";
-  version = "5.0.2";
+  version = "5.0.4";
 
   src = fetchFromGitHub {
     owner = "fcitx";
     repo = "fcitx5-qt";
     rev = version;
-    sha256 = "sha256-QylvjhjiIujYGKFtL4bKVXpobkN5t6Q2MGf16dsL24A=";
+    sha256 = "sha256-PZbnxt30Tv7i+Q6G9UpGgWDs65rn0MZVe1ybhz4vN9I=";
   };
 
   preConfigure = ''
diff --git a/pkgs/tools/misc/disfetch/default.nix b/pkgs/tools/misc/disfetch/default.nix
index 58f7da84fc001..865769dc56ce2 100644
--- a/pkgs/tools/misc/disfetch/default.nix
+++ b/pkgs/tools/misc/disfetch/default.nix
@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   pname = "disfetch";
-  version = "1.21";
+  version = "1.22";
 
   src = fetchFromGitHub {
     owner = "llathasa-veleth";
     repo = "disfetch";
     rev = version;
-    sha256 = "sha256-AAfpv1paEnHu1S2B8yC0hyYOj5deKTkCyLGvp6Roz64=";
+    sha256 = "sha256-fNmoaEwRrm6EFe+BwOTwAs1THMYhcal1eshXf+1mVQg=";
   };
 
   dontBuild = true;
diff --git a/pkgs/tools/misc/lorri/default.nix b/pkgs/tools/misc/lorri/default.nix
index 9635b6b42385c..c544bbd03a148 100644
--- a/pkgs/tools/misc/lorri/default.nix
+++ b/pkgs/tools/misc/lorri/default.nix
@@ -12,10 +12,10 @@
 
 let
   # Run `eval $(nix-build -A lorri.updater)` after updating the revision!
-  version = "1.3.1";
-  gitRev = "df83b9b175fecc8ec8b02096c5cfe2db3d00b92e";
-  sha256 = "1df6p0b482vhymw3z7gimc441jr7aix9lhdbcm5wjvw9f276016f";
-  cargoSha256 = "1f9b2h3zakw7qmlnc4rqhxnw80sl5h4mj8cghr82iacxwqz499ql";
+  version = "1.4.0";
+  gitRev = "fee4ffac9ee16fc921d413789cc059b043f2db3d";
+  sha256 = "sha256:0ix0k85ywlvkxsampajkq521d290gb0n60qwhnk6j0sc55yn558h";
+  cargoSha256 = "sha256:1ngn4wnyh6cjnyg7mb48zvng0zn5fcn8s75y88nh91xq9x1bi2d9";
 
 in (rustPlatform.buildRustPackage rec {
   pname = "lorri";
diff --git a/pkgs/tools/misc/osm2pgsql/default.nix b/pkgs/tools/misc/osm2pgsql/default.nix
index a6b8d01dd463a..4d959c6480a29 100644
--- a/pkgs/tools/misc/osm2pgsql/default.nix
+++ b/pkgs/tools/misc/osm2pgsql/default.nix
@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation rec {
   pname = "osm2pgsql";
-  version = "1.4.1";
+  version = "1.4.2";
 
   src = fetchFromGitHub {
     owner = "openstreetmap";
     repo = pname;
     rev = version;
-    sha256 = "0ld43k7xx395hd6kcn8wyacvb1cfjy670lh9w6yhfi78nxqj9mmy";
+    sha256 = "141blh6lwbgn8hh45xaa0yiwygdc444h9zahx5xrzx5pck9zb5ps";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/tools/misc/rmlint/default.nix b/pkgs/tools/misc/rmlint/default.nix
index 09ebbe33a3422..8211c5aebc774 100644
--- a/pkgs/tools/misc/rmlint/default.nix
+++ b/pkgs/tools/misc/rmlint/default.nix
@@ -18,6 +18,8 @@
 , wrapGAppsHook
 , withGui ? false }:
 
+assert withGui -> !stdenv.isDarwin;
+
 with lib;
 stdenv.mkDerivation rec {
   pname = "rmlint";
@@ -30,12 +32,9 @@ stdenv.mkDerivation rec {
     sha256 = "15xfkcw1bkfyf3z8kl23k3rlv702m0h7ghqxvhniynvlwbgh6j2x";
   };
 
-  CFLAGS="-I${lib.getDev util-linux}/include";
-
   nativeBuildInputs = [
     pkg-config
     sphinx
-    gettext
     scons
   ] ++ lib.optionals withGui [
     makeWrapper
@@ -57,9 +56,21 @@ stdenv.mkDerivation rec {
     python3.pkgs.pygobject3
   ];
 
-  # this doesn't seem to support configureFlags, and appends $out afterwards,
-  # so add the --without-gui in front of it
-  prefixKey = lib.optionalString (!withGui) " --without-gui " + "--prefix=";
+  prePatch = ''
+    export CFLAGS="$NIX_CFLAGS_COMPILE"
+    export LDFLAGS="''${NIX_LDFLAGS//-rpath /-Wl,-rpath=}"
+
+    # remove sources of nondeterminism
+    substituteInPlace lib/cmdline.c \
+      --replace "__DATE__" "\"Jan  1 1970\"" \
+      --replace "__TIME__" "\"00:00:00\""
+    substituteInPlace docs/SConscript \
+      --replace "gzip -c " "gzip -cn "
+  '';
+
+  prefixKey = "--prefix=";
+
+  sconsFlags = lib.optionals (!withGui) [ "--without-gui" ];
 
   # in GUI mode, this shells out to itself, and tries to import python modules
   postInstall = lib.optionalString withGui ''
@@ -70,8 +81,8 @@ stdenv.mkDerivation rec {
   meta = {
     description = "Extremely fast tool to remove duplicates and other lint from your filesystem";
     homepage = "https://rmlint.readthedocs.org";
-    platforms = platforms.linux;
+    platforms = platforms.unix;
     license = licenses.gpl3;
-    maintainers = [ maintainers.koral ];
+    maintainers = with maintainers; [ aaschmid koral ];
   };
 }
diff --git a/pkgs/tools/misc/tmux/default.nix b/pkgs/tools/misc/tmux/default.nix
index 2043cfe101184..534fe54bc187c 100644
--- a/pkgs/tools/misc/tmux/default.nix
+++ b/pkgs/tools/misc/tmux/default.nix
@@ -2,7 +2,6 @@
 , fetchFromGitHub
 , autoreconfHook
 , pkg-config
-, makeWrapper
 , bison
 , ncurses
 , libevent
@@ -41,7 +40,6 @@ stdenv.mkDerivation rec {
   buildInputs = [
     ncurses
     libevent
-    makeWrapper
   ];
 
   configureFlags = [
diff --git a/pkgs/tools/misc/watchexec/default.nix b/pkgs/tools/misc/watchexec/default.nix
index 5f80dad854e32..5a264db2d4d2b 100644
--- a/pkgs/tools/misc/watchexec/default.nix
+++ b/pkgs/tools/misc/watchexec/default.nix
@@ -1,21 +1,21 @@
-{ lib, stdenv, rustPlatform, fetchFromGitHub, CoreServices, installShellFiles }:
+{ lib, stdenv, rustPlatform, fetchFromGitHub, CoreServices, installShellFiles, libiconv }:
 
 rustPlatform.buildRustPackage rec {
   pname = "watchexec";
-  version = "1.14.1";
+  version = "1.15.0";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = version;
-    sha256 = "0m4hipjgg64572lzqy9hz4iq9c4awc93c9rmnpap5iyi855x7idj";
+    sha256 = "1b0ds04q4g8xcgwkziwb5hsi7v73w9y0prvhxz880zzh930652n2";
   };
 
-  cargoSha256 = "0035pqr61mdx699hd4f8hnxknvsdg67l6ys7gxym3fzd9dcmqqff";
+  cargoSha256 = "0jpfgyz5l4fdb5cnqmadzjzrvc6dwgray4b0mx80pghpjw8a8qfb";
 
   nativeBuildInputs = [ installShellFiles ];
 
-  buildInputs = lib.optionals stdenv.isDarwin [ CoreServices ];
+  buildInputs = lib.optionals stdenv.isDarwin [ CoreServices libiconv ];
 
   postInstall = ''
     installManPage doc/watchexec.1
@@ -27,6 +27,5 @@ rustPlatform.buildRustPackage rec {
     homepage = "https://github.com/watchexec/watchexec";
     license = with licenses; [ asl20 ];
     maintainers = [ maintainers.michalrus ];
-    platforms = platforms.linux ++ platforms.darwin;
   };
 }
diff --git a/pkgs/tools/misc/zoxide/default.nix b/pkgs/tools/misc/zoxide/default.nix
index 1e1ec8723bfc8..5cad350f49826 100644
--- a/pkgs/tools/misc/zoxide/default.nix
+++ b/pkgs/tools/misc/zoxide/default.nix
@@ -4,6 +4,7 @@
 , rustPlatform
 , withFzf ? true
 , fzf
+, libiconv
   # checkInputs
 , fish
 , powershell
@@ -15,15 +16,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "zoxide";
-  version = "0.5.0";
+  version = "0.6.0";
 
   src = fetchFromGitHub {
     owner = "ajeetdsouza";
     repo = "zoxide";
     rev = "v${version}";
-    sha256 = "143lh94mw31pm9q7ib63h2k842g3h222mdabhf25hpb19lka2w5y";
+    sha256 = "ZeGFsVBpEhKi4EIhpQlCuriFzmHAgLYw3qE/zqfyqgU=";
   };
 
+  buildInputs = lib.optionals stdenv.isDarwin [ libiconv ];
+
   # tests are broken on darwin
   doCheck = !stdenv.isDarwin;
 
@@ -46,7 +49,7 @@ rustPlatform.buildRustPackage rec {
       --replace '"fzf"' '"${fzf}/bin/fzf"'
   '';
 
-  cargoSha256 = "05mp101yk1zkjj1gwbkldizq6f9f8089gqgvq42c4ngq88pc7v9a";
+  cargoSha256 = "Hzn01+OhdBrZD1woXN4Pwf/S72Deln1gyyBOWyDC6iM=";
 
   meta = with lib; {
     description = "A fast cd command that learns your habits";
diff --git a/pkgs/tools/networking/clash/default.nix b/pkgs/tools/networking/clash/default.nix
index ede7dce272485..9cad36c68a632 100644
--- a/pkgs/tools/networking/clash/default.nix
+++ b/pkgs/tools/networking/clash/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "clash";
-  version = "1.4.2";
+  version = "1.5.0";
 
   src = fetchFromGitHub {
     owner = "Dreamacro";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-ObnlcKTuO/yFNMXLwGvRTLnz18bNquq6dye2qpL7+VM=";
+    sha256 = "sha256-I4qpcHsN8WGt7YLNXO08BJypilhMSVmZjqECDjlEqXU=";
   };
 
-  vendorSha256 = "sha256-6ZQMDXc2NFs6l/DWPPCFJ+c40764hXzFTdi1Pxk1fnU=";
+  vendorSha256 = "sha256-Nfzk7p52msGxTPDbs4g9KuRPFxp4Npt0QXkdVOZvipc=";
 
   doCheck = false;
 
diff --git a/pkgs/tools/networking/dnsproxy/default.nix b/pkgs/tools/networking/dnsproxy/default.nix
index 0b36c76ca62d4..20256aa006bd0 100644
--- a/pkgs/tools/networking/dnsproxy/default.nix
+++ b/pkgs/tools/networking/dnsproxy/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "dnsproxy";
-  version = "0.36.0";
+  version = "0.37.0";
 
   src = fetchFromGitHub {
     owner = "AdguardTeam";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-VTmQ37kUWlc18p8Qdm2ZFID+t6OIp7y2qU12rXqE6Xo=";
+    sha256 = "sha256-3zsEEq6pVo5yHY4v5TXhZo4jo6htjCYypzxMMv8zQGE=";
   };
 
   vendorSha256 = null;
diff --git a/pkgs/tools/networking/oapi-codegen/default.nix b/pkgs/tools/networking/oapi-codegen/default.nix
index 583189f57db26..ce490cafef6ab 100644
--- a/pkgs/tools/networking/oapi-codegen/default.nix
+++ b/pkgs/tools/networking/oapi-codegen/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "oapi-codegen";
-  version = "1.5.6";
+  version = "1.6.0";
 
   src = fetchFromGitHub {
     owner = "deepmap";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-edIm1O+LQdmKhH8/5WuSsxVtOcf3VlkObGjIY+30mms=";
+    sha256 = "sha256-doJ1ceuJ/gL9vlGgV/hKIJeAErAseH0dtHKJX2z7pV0=";
   };
 
-  vendorSha256 = "sha256-lhWnPZavtBEa4A76rvr0xw3L5W6HYK1Uw+PW8z8gWuU=";
+  vendorSha256 = "sha256-Y4WM+o+5jiwj8/99UyNHLpBNbtJkKteIGW2P1Jd9L6M=";
 
   # Tests use network
   doCheck = false;
diff --git a/pkgs/tools/networking/p2p/amule/default.nix b/pkgs/tools/networking/p2p/amule/default.nix
index 075d60038d8ec..96bf7656e8ae8 100644
--- a/pkgs/tools/networking/p2p/amule/default.nix
+++ b/pkgs/tools/networking/p2p/amule/default.nix
@@ -2,53 +2,46 @@
 , enableDaemon ? false # build amule daemon
 , httpServer ? false # build web interface for the daemon
 , client ? false # build amule remote gui
-, fetchFromGitHub, stdenv, lib, zlib, wxGTK, perl, cryptopp, libupnp, gettext, libpng
-, autoreconfHook, pkg-config, makeWrapper, libX11 }:
+, fetchFromGitHub
+, stdenv
+, lib
+, cmake
+, zlib
+, wxGTK
+, perl
+, cryptopp
+, libupnp
+, gettext
+, libpng
+, autoreconfHook
+, pkg-config
+, makeWrapper
+, libX11
+}:
 
 stdenv.mkDerivation rec {
   pname = "amule";
-  version = "unstable-20201006";
+  version = "2.3.3";
 
   src = fetchFromGitHub {
     owner = "amule-project";
     repo = "amule";
-    rev = "6f8951527eda670c7266984ce476061bfe8867fc";
-    sha256 = "12b44b6hz3mb7nsn6xhzvm726xs06xcim013i1appif4dr8njbx1";
+    rev = version;
+    sha256 = "1nm4vxgmisn1b6l3drmz0q04x067j2i8lw5rnf0acaapwlp8qwvi";
   };
 
-  postPatch = ''
-    substituteInPlace src/libs/ec/file_generator.pl \
-      --replace /usr/bin/perl ${perl}/bin/perl
-
-    # autotools expects these to be in the root
-    cp docs/{AUTHORS,README} .
-    cp docs/Changelog ./ChangeLog
-    cp docs/Changelog ./NEWS
-  '';
-
-  preAutoreconf = ''
-    pushd src/pixmaps/flags_xpm >/dev/null
-    ./makeflags.sh
-    popd >/dev/null
-  '';
-
-  nativeBuildInputs = [ autoreconfHook gettext makeWrapper pkg-config ];
+  nativeBuildInputs = [ cmake gettext makeWrapper pkg-config ];
 
   buildInputs = [
-    zlib wxGTK perl cryptopp libupnp
+    zlib wxGTK perl cryptopp.dev libupnp
   ] ++ lib.optional httpServer libpng
     ++ lib.optional client libX11;
 
-  enableParallelBuilding = true;
-
-  configureFlags = [
-    "--with-crypto-prefix=${cryptopp}"
-    "--disable-debug"
-    "--enable-optimize"
-    (lib.enableFeature monolithic   "monolithic")
-    (lib.enableFeature enableDaemon "amule-daemon")
-    (lib.enableFeature client       "amule-gui")
-    (lib.enableFeature httpServer   "webserver")
+  cmakeFlags = [
+    "-DBUILD_MONOLITHIC=${if monolithic then "ON" else "OFF"}"
+    "-DBUILD_DAEMON=${if enableDaemon then "ON" else "OFF"}"
+    "-DBUILD_REMOTEGUI=${if client then "ON" else "OFF"}"
+    "-DBUILD_WEBSERVER=${if httpServer then "ON" else "OFF"}"
   ];
 
   # aMule will try to `dlopen' libupnp and libixml, so help it
@@ -75,7 +68,7 @@ stdenv.mkDerivation rec {
     license = licenses.gpl2Plus;
     maintainers = with maintainers; [ phreedom ];
     platforms = platforms.unix;
-    # Could not find crypto++ installation or sources.
-    broken = true;
+    # cmake fails: Cannot specify link libraries for target "wxWidgets::ADV" which is not built by this project.
+    broken = enableDaemon;
   };
 }
diff --git a/pkgs/tools/networking/shadowsocks-rust/default.nix b/pkgs/tools/networking/shadowsocks-rust/default.nix
index 54c5701b8eca4..5b5d8ee1545ed 100644
--- a/pkgs/tools/networking/shadowsocks-rust/default.nix
+++ b/pkgs/tools/networking/shadowsocks-rust/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "shadowsocks-rust";
-  version = "1.10.2";
+  version = "1.10.5";
 
   src = fetchFromGitHub {
     rev = "v${version}";
     owner = "shadowsocks";
     repo = pname;
-    sha256 = "155v63v0wf0ky5nl2f1dvky8n9pdk40l1lqyz8l1i1kjcvvcmj26";
+    sha256 = "0nagn7792qniczzv0912h89bn8rm8hyikdiw7cqwknx0hw8dwz1z";
   };
 
-  cargoSha256 = "1vb6kis54g4lfc9d0h1961dclaqhq019iw509ydcsa1n7bp25caq";
+  cargoSha256 = "0arqc0wnvfkmk8xzsdc6fvd1adazrw950ld8xyh7r588pyphjmhn";
 
   RUSTC_BOOTSTRAP = 1;
 
diff --git a/pkgs/tools/networking/tcpdump/default.nix b/pkgs/tools/networking/tcpdump/default.nix
index 71c435df0c587..f1fe052763965 100644
--- a/pkgs/tools/networking/tcpdump/default.nix
+++ b/pkgs/tools/networking/tcpdump/default.nix
@@ -1,22 +1,14 @@
-{ lib, stdenv, fetchurl, libpcap, perl, fetchpatch }:
+{ lib, stdenv, fetchurl, libpcap, perl }:
 
 stdenv.mkDerivation rec {
   pname = "tcpdump";
-  version = "4.9.3";
+  version = "4.99.0";
 
   src = fetchurl {
     url = "http://www.tcpdump.org/release/${pname}-${version}.tar.gz";
-    sha256 = "0434vdcnbqaia672rggjzdn4bb8p8dchz559yiszzdk0sjrprm1c";
+    sha256 = "0hmqh2fx8rgs9v1mk3vpywj61xvkifz260q685xllxr8jmxg3wlc";
   };
 
-  patches = [
-    # Patch for CVE-2020-8037
-    (fetchpatch {
-      url = "https://github.com/the-tcpdump-group/tcpdump/commit/32027e199368dad9508965aae8cd8de5b6ab5231.patch";
-      sha256 = "sha256-bO3aV032ru9+M/9isBRjmH8jTZLKj9Zf9ha2rmOaZwc=";
-    })
-  ];
-
   postPatch = ''
     patchShebangs tests
   '';
@@ -29,11 +21,11 @@ stdenv.mkDerivation rec {
     (stdenv.hostPlatform != stdenv.buildPlatform)
     "ac_cv_linux_vers=2";
 
-  meta = {
+  meta = with lib; {
     description = "Network sniffer";
-    homepage = "http://www.tcpdump.org/";
-    license = "BSD-style";
-    maintainers = with lib.maintainers; [ globin ];
-    platforms = lib.platforms.unix;
+    homepage = "https://www.tcpdump.org/";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ globin ];
+    platforms = platforms.unix;
   };
 }
diff --git a/pkgs/tools/security/chipsec/compile-ko.diff b/pkgs/tools/security/chipsec/compile-ko.diff
new file mode 100644
index 0000000000000..0ab2c80a62515
--- /dev/null
+++ b/pkgs/tools/security/chipsec/compile-ko.diff
@@ -0,0 +1,13 @@
+diff --git i/setup.py w/setup.py
+index cfe2665..5795874 100755
+--- i/setup.py
++++ w/setup.py
+@@ -179,7 +179,7 @@ class build_ext(_build_ext):
+             driver_build_function = self._build_win_driver 
+             self._build_win_compression()
+ 
+-        if not self.skip_driver:
++        if True:
+             driver_build_function()
+ 
+     def get_source_files(self):
diff --git a/pkgs/tools/security/chipsec/default.nix b/pkgs/tools/security/chipsec/default.nix
index 7e00c0b07cf7b..fbb9c421e3539 100644
--- a/pkgs/tools/security/chipsec/default.nix
+++ b/pkgs/tools/security/chipsec/default.nix
@@ -1,29 +1,54 @@
-{ stdenv, lib, fetchFromGitHub, python2Packages, nasm, libelf
-, kernel ? null, withDriver ? false }:
-python2Packages.buildPythonApplication rec {
+{ lib
+, stdenv
+, fetchFromGitHub
+, kernel ? null
+, libelf
+, nasm
+, python3
+, withDriver ? false
+}:
+
+python3.pkgs.buildPythonApplication rec {
   pname = "chipsec";
-  version = "1.5.1";
+  version = "1.6.1";
+  disabled = !stdenv.isLinux;
 
   src = fetchFromGitHub {
     owner = "chipsec";
     repo = "chipsec";
     rev = version;
-    sha256 = "1rxr9i08a22m15slvlkrhnki30jixi2ds096kmmc2nqzfr9yibmb";
+    sha256 = "01sp24z63r3nqxx57zc4873b8i5dqipy7yrxzrwjns531vznhiy2";
   };
 
-  disabled = !stdenv.isLinux;
+  patches = lib.optionals withDriver [ ./ko-path.diff ./compile-ko.diff ];
+
+  KSRC = lib.optionalString withDriver "${kernel.dev}/lib/modules/${kernel.modDirVersion}/build";
 
   nativeBuildInputs = [
-    nasm libelf
+    libelf
+    nasm
   ];
 
-  setupPyBuildFlags = lib.optional (!withDriver) "--skip-driver";
+  checkInputs = [
+    python3.pkgs.distro
+    python3.pkgs.pytestCheckHook
+  ];
+
+  preBuild = lib.optionalString withDriver ''
+    export CHIPSEC_BUILD_LIB=$(mktemp -d)
+    mkdir -p $CHIPSEC_BUILD_LIB/chipsec/helper/linux
+  '';
+
+  preInstall = lib.optionalString withDriver ''
+    mkdir -p $out/${python3.pkgs.python.sitePackages}/drivers/linux
+    mv $CHIPSEC_BUILD_LIB/chipsec/helper/linux/chipsec.ko \
+      $out/${python3.pkgs.python.sitePackages}/drivers/linux/chipsec.ko
+  '';
 
-  checkPhase = "python setup.py build "
-             + lib.optionalString (!withDriver) "--skip-driver "
-             + "test";
+  setupPyBuildFlags = [ "--build-lib=$CHIPSEC_BUILD_LIB" ]
+                   ++ lib.optional (!withDriver) "--skip-driver";
 
-  KERNEL_SRC_DIR = lib.optionalString withDriver "${kernel.dev}/lib/modules/${kernel.modDirVersion}/build";
+  pythonImportsCheck = [ "chipsec" ];
 
   meta = with lib; {
     description = "Platform Security Assessment Framework";
@@ -34,7 +59,7 @@ python2Packages.buildPythonApplication rec {
       interfaces, and forensic capabilities. It can be run on Windows, Linux,
       Mac OS X and UEFI shell.
     '';
-    license = licenses.gpl2;
+    license = licenses.gpl2Only;
     homepage = "https://github.com/chipsec/chipsec";
     maintainers = with maintainers; [ johnazoidberg ];
     platforms = if withDriver then [ "x86_64-linux" ] else platforms.all;
diff --git a/pkgs/tools/security/chipsec/ko-path.diff b/pkgs/tools/security/chipsec/ko-path.diff
new file mode 100644
index 0000000000000..ad26d232d964e
--- /dev/null
+++ b/pkgs/tools/security/chipsec/ko-path.diff
@@ -0,0 +1,13 @@
+diff --git c/chipsec/helper/linux/linuxhelper.py i/chipsec/helper/linux/linuxhelper.py
+index c51b5e6..4be05ea 100644
+--- c/chipsec/helper/linux/linuxhelper.py
++++ i/chipsec/helper/linux/linuxhelper.py
+@@ -152,7 +152,7 @@ class LinuxHelper(Helper):
+             else:
+                 a2 = "a2=0x{}".format(phys_mem_access_prot)
+ 
+-        driver_path = os.path.join(chipsec.file.get_main_dir(), "chipsec", "helper", "linux", "chipsec.ko" )
++        driver_path = os.path.join(chipsec.file.get_main_dir(), "drivers", "linux", "chipsec.ko" )
+         if not os.path.exists(driver_path):
+             driver_path += ".xz"
+             if not os.path.exists(driver_path):
diff --git a/pkgs/tools/security/clamav/default.nix b/pkgs/tools/security/clamav/default.nix
index bad5f3f476e31..bbad0ab1f2f24 100644
--- a/pkgs/tools/security/clamav/default.nix
+++ b/pkgs/tools/security/clamav/default.nix
@@ -5,11 +5,11 @@
 
 stdenv.mkDerivation rec {
   pname = "clamav";
-  version = "0.103.1";
+  version = "0.103.2";
 
   src = fetchurl {
     url = "https://www.clamav.net/downloads/production/${pname}-${version}.tar.gz";
-    sha256 = "sha256-cwjEe4myaK87nzYUBSiSekn/PmM6nJwKrCcS2BBW4lc=";
+    sha256 = "sha256-1LXQrGZiYuQjoyb7VHeMqnxpYk1sP5VCiV/rhHgnG9I=";
   };
 
   # don't install sample config files into the absolute sysconfdir folder
diff --git a/pkgs/tools/security/clevis/default.nix b/pkgs/tools/security/clevis/default.nix
index 36b5ab47304cd..7f26dcabb7db9 100644
--- a/pkgs/tools/security/clevis/default.nix
+++ b/pkgs/tools/security/clevis/default.nix
@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   pname = "clevis";
-  version = "15";
+  version = "16";
 
   src = fetchFromGitHub {
     owner = "latchset";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0wfgd2v1r47ckh5qp60b903191fx0fa27zyadxlsb8riqszhmwvz";
+    sha256 = "sha256-DWrxk+Nb2ptF5nCaXYvRY8hAFa/n+6OGdKWO+Sq61yk=";
   };
 
   nativeBuildInputs = [ meson ninja pkg-config asciidoc ];
diff --git a/pkgs/tools/security/dnsx/default.nix b/pkgs/tools/security/dnsx/default.nix
index 35f033cb983ff..9b1457554fcbe 100644
--- a/pkgs/tools/security/dnsx/default.nix
+++ b/pkgs/tools/security/dnsx/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "dnsx";
-  version = "1.0.1";
+  version = "1.0.2";
 
   src = fetchFromGitHub {
     owner = "projectdiscovery";
     repo = "dnsx";
     rev = "v${version}";
-    sha256 = "1pgq21pbnz2dm272zrhd455njj5vg4kywpd230acj675nlgir6y1";
+    sha256 = "sha256-CjWFXYU34PE4I9xihQbPxVcxLyiMCYueuaB/LaXhHQg=";
   };
 
-  vendorSha256 = "0j2cqvskzxbyfrvsv4gm4qwfjm0digizcg157z5iignnknddajax";
+  vendorSha256 = "sha256-vTXvlpXpFf78Cwxq/y6ysSeXM3g71kHBn9zd6c4mxlk=";
 
   meta = with lib; {
     description = "Fast and multi-purpose DNS toolkit";
diff --git a/pkgs/tools/security/enpass/data.json b/pkgs/tools/security/enpass/data.json
index 7a52e260eb927..bb74f73fb7578 100644
--- a/pkgs/tools/security/enpass/data.json
+++ b/pkgs/tools/security/enpass/data.json
@@ -1,8 +1,8 @@
 {
   "amd64": {
-    "path": "pool/main/e/enpass/enpass_6.5.1.723_amd64.deb",
-    "sha256": "d9bb408fa2253ce44ab5396898f7db13291ce23ae58964f4a27ade38bd5067bf",
-    "version": "6.5.1.723"
+    "path": "pool/main/e/enpass/enpass_6.6.1.809_amd64.deb",
+    "sha256": "b1b9bd67653c3163bd80b340150ecf123552cbe4af23c350fbadea8ffd7939ba",
+    "version": "6.6.1.809"
   },
   "i386": {
     "path": "pool/main/e/enpass/enpass_5.6.9_i386.deb", 
diff --git a/pkgs/tools/security/gitleaks/default.nix b/pkgs/tools/security/gitleaks/default.nix
index 9e34b07121fa2..685280ab4adbb 100644
--- a/pkgs/tools/security/gitleaks/default.nix
+++ b/pkgs/tools/security/gitleaks/default.nix
@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "gitleaks";
-  version = "7.3.0";
+  version = "7.4.0";
 
   src = fetchFromGitHub {
     owner = "zricethezav";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-IJaumIFuIhrvXZ45uz8RUxAuprnWdv2lNzxNUascvVc=";
+    sha256 = "sha256-AY9pOARFAqIOimhcwEyau2MwJCFsWu8I36P7Z0xyJH0=";
   };
 
   vendorSha256 = "sha256-Cc4DJPpOMHxDcH22S7znYo7QHNRXv8jOJhznu09kaE4=";
diff --git a/pkgs/tools/security/hfinger/default.nix b/pkgs/tools/security/hfinger/default.nix
new file mode 100644
index 0000000000000..9e053276ecf70
--- /dev/null
+++ b/pkgs/tools/security/hfinger/default.nix
@@ -0,0 +1,36 @@
+{ lib
+, fetchFromGitHub
+, python3
+, wireshark-cli
+}:
+
+python3.pkgs.buildPythonApplication rec {
+  pname = "hfinger";
+  version = "0.2.0";
+  disabled = python3.pythonOlder "3.3";
+
+  src = fetchFromGitHub {
+    owner = "CERT-Polska";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "1vz8mf572qyng684fvb9gdwaaiybk7mjmikbymvjvy24d10raak1";
+  };
+
+  propagatedBuildInputs = with python3.pkgs; [
+    fnvhash
+    python_magic
+  ] ++ [
+    wireshark-cli
+  ];
+
+  # Project has no tests
+  doCheck = false;
+  pythonImportsCheck = [ "hfinger" ];
+
+  meta = with lib; {
+    description = "Fingerprinting tool for HTTP requests";
+    homepage = "https://github.com/CERT-Polska/hfinger";
+    license = with licenses; [ gpl3Only ];
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/tools/security/httpx/default.nix b/pkgs/tools/security/httpx/default.nix
index bff9e03bc6f4e..129395912f950 100644
--- a/pkgs/tools/security/httpx/default.nix
+++ b/pkgs/tools/security/httpx/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "httpx";
-  version = "1.0.3";
+  version = "1.0.4";
 
   src = fetchFromGitHub {
     owner = "projectdiscovery";
     repo = "httpx";
     rev = "v${version}";
-    sha256 = "15ihc5926kbai16i59c7bmvgd162qq9dpd52g4vrp7dq4jrz155m";
+    sha256 = "sha256-w5CNvtlhvm1SyAKaoA7Fw8ZSY9Z78MentrSNS4mpr1Q=";
   };
 
-  vendorSha256 = "0fg93vhwpx113fpw8qg4ram4bdh6a8x3a36pr1c962s4vhrabwy2";
+  vendorSha256 = "sha256-VBxGapvC2QE/0slsAiCBzmwOSMeGepZU0pYVDepSrwg=";
 
   meta = with lib; {
     description = "Fast and multi-purpose HTTP toolkit";
diff --git a/pkgs/tools/security/metasploit/Gemfile b/pkgs/tools/security/metasploit/Gemfile
index 150f00e92b451..247e2b6690449 100644
--- a/pkgs/tools/security/metasploit/Gemfile
+++ b/pkgs/tools/security/metasploit/Gemfile
@@ -1,4 +1,4 @@
 # frozen_string_literal: true
 source "https://rubygems.org"
 
-gem "metasploit-framework", git: "https://github.com/rapid7/metasploit-framework", ref: "refs/tags/6.0.38"
+gem "metasploit-framework", git: "https://github.com/rapid7/metasploit-framework", ref: "refs/tags/6.0.39"
diff --git a/pkgs/tools/security/metasploit/Gemfile.lock b/pkgs/tools/security/metasploit/Gemfile.lock
index c64e2b31aff52..97e7b9962abcf 100644
--- a/pkgs/tools/security/metasploit/Gemfile.lock
+++ b/pkgs/tools/security/metasploit/Gemfile.lock
@@ -1,9 +1,9 @@
 GIT
   remote: https://github.com/rapid7/metasploit-framework
-  revision: 4c7a221f3d186b0cd65d2a765533fda54f0848f4
-  ref: refs/tags/6.0.38
+  revision: 5cba6ecd3c745f45290400f0705400f26913852e
+  ref: refs/tags/6.0.39
   specs:
-    metasploit-framework (6.0.38)
+    metasploit-framework (6.0.39)
       actionpack (~> 5.2.2)
       activerecord (~> 5.2.2)
       activesupport (~> 5.2.2)
@@ -27,11 +27,11 @@ GIT
       jsobfu
       json
       metasm
-      metasploit-concern
-      metasploit-credential
-      metasploit-model
+      metasploit-concern (~> 3.0.0)
+      metasploit-credential (~> 4.0.0)
+      metasploit-model (~> 3.1.0)
       metasploit-payloads (= 2.0.41)
-      metasploit_data_models
+      metasploit_data_models (~> 4.1.0)
       metasploit_payloads-mettle (= 1.0.8)
       mqtt
       msgpack
@@ -123,13 +123,13 @@ GEM
     arel-helpers (2.12.0)
       activerecord (>= 3.1.0, < 7)
     aws-eventstream (1.1.1)
-    aws-partitions (1.441.0)
+    aws-partitions (1.443.0)
     aws-sdk-core (3.113.1)
       aws-eventstream (~> 1, >= 1.0.2)
       aws-partitions (~> 1, >= 1.239.0)
       aws-sigv4 (~> 1.1)
       jmespath (~> 1.0)
-    aws-sdk-ec2 (1.232.0)
+    aws-sdk-ec2 (1.234.0)
       aws-sdk-core (~> 3, >= 3.112.0)
       aws-sigv4 (~> 1.1)
     aws-sdk-iam (1.52.0)
@@ -190,7 +190,7 @@ GEM
     jsobfu (0.4.2)
       rkelly-remix
     json (2.5.1)
-    loofah (2.9.0)
+    loofah (2.9.1)
       crass (~> 1.0.2)
       nokogiri (>= 1.5.9)
     metasm (1.0.4)
@@ -213,7 +213,7 @@ GEM
       activesupport (~> 5.2.2)
       railties (~> 5.2.2)
     metasploit-payloads (2.0.41)
-    metasploit_data_models (4.1.2)
+    metasploit_data_models (4.1.3)
       activerecord (~> 5.2.2)
       activesupport (~> 5.2.2)
       arel-helpers
@@ -238,7 +238,7 @@ GEM
     network_interface (0.0.2)
     nexpose (7.3.0)
     nio4r (2.5.7)
-    nokogiri (1.11.2)
+    nokogiri (1.11.3)
       mini_portile2 (~> 2.5.0)
       racc (~> 1.4)
     octokit (4.20.0)
@@ -330,15 +330,15 @@ GEM
       rex-socket
       rex-text
     rex-struct2 (0.1.3)
-    rex-text (0.2.33)
+    rex-text (0.2.34)
     rex-zip (0.1.4)
       rex-text
-    rexml (3.2.4)
+    rexml (3.2.5)
     rkelly-remix (0.0.7)
     ruby-macho (2.5.0)
     ruby-rc4 (0.1.5)
     ruby2_keywords (0.0.4)
-    ruby_smb (2.0.7)
+    ruby_smb (2.0.8)
       bindata
       openssl-ccm
       openssl-cmac
diff --git a/pkgs/tools/security/metasploit/default.nix b/pkgs/tools/security/metasploit/default.nix
index 5dce17ff190b5..6232c85a2f208 100644
--- a/pkgs/tools/security/metasploit/default.nix
+++ b/pkgs/tools/security/metasploit/default.nix
@@ -8,13 +8,13 @@ let
   };
 in stdenv.mkDerivation rec {
   pname = "metasploit-framework";
-  version = "6.0.38";
+  version = "6.0.39";
 
   src = fetchFromGitHub {
     owner = "rapid7";
     repo = "metasploit-framework";
     rev = version;
-    sha256 = "sha256-/e1BWhkM4A+xrvDS6Z01sND9aOZDn+cL0RIcAgT5oZs=";
+    sha256 = "sha256-9uoxxcuEJudJGRQfkVBUWDHoZ1sxaIb+Hjf/sEpcqik=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/tools/security/metasploit/gemset.nix b/pkgs/tools/security/metasploit/gemset.nix
index 49fedb7a84a22..3e195ffcc1022 100644
--- a/pkgs/tools/security/metasploit/gemset.nix
+++ b/pkgs/tools/security/metasploit/gemset.nix
@@ -114,10 +114,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "07i9mqbh19pd25wd3laxv1bcmzcpriw54g0x3mqzkn600h8f3lg9";
+      sha256 = "0vvav3449v3m0nyflcw07sbxlpgqf4pwa2fmirgjvc9r9asssi79";
       type = "gem";
     };
-    version = "1.441.0";
+    version = "1.443.0";
   };
   aws-sdk-core = {
     groups = ["default"];
@@ -134,10 +134,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0n7hi66zpm8mgfgf32gw7c9p4rv09q9kipsr01l5l2n2d69k67q5";
+      sha256 = "1rlq8vifcmz24v1aw8vj2czqj4dnf00smm5ndfpaxz5k6550lbz4";
       type = "gem";
     };
-    version = "1.232.0";
+    version = "1.234.0";
   };
   aws-sdk-iam = {
     groups = ["default"];
@@ -474,10 +474,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0bzwvxvilx7w1p3pg028ks38925y9i0xm870lm7s12w7598hiyck";
+      sha256 = "1w9mbii8515p28xd4k72f3ab2g6xiyq15497ys5r8jn6m355lgi7";
       type = "gem";
     };
-    version = "2.9.0";
+    version = "2.9.1";
   };
   metasm = {
     groups = ["default"];
@@ -514,12 +514,12 @@
     platforms = [];
     source = {
       fetchSubmodules = false;
-      rev = "4c7a221f3d186b0cd65d2a765533fda54f0848f4";
-      sha256 = "16x1z420470js45yg7s3wrlgvl5h6nfyklphmsqhzq0c35d43vgx";
+      rev = "5cba6ecd3c745f45290400f0705400f26913852e";
+      sha256 = "0adabi5b1zrp3vz8cs1ibdkyhcaqai8927ql354yf9l4rg2k3spn";
       type = "git";
       url = "https://github.com/rapid7/metasploit-framework";
     };
-    version = "6.0.38";
+    version = "6.0.39";
   };
   metasploit-model = {
     groups = ["default"];
@@ -546,10 +546,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1kzlvq20ml4b5lr1qbrkmivdi37mxi8fasdqg4yla2libfbdz008";
+      sha256 = "0li8lphplsmv9x1f14c22w95gjx2lscas3x5py7x7kc05pfv33bg";
       type = "gem";
     };
-    version = "4.1.2";
+    version = "4.1.3";
   };
   metasploit_payloads-mettle = {
     groups = ["default"];
@@ -696,10 +696,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0b51df8fwadak075cvi17w0nch6qz1r66564qp29qwfj67j9qp0p";
+      sha256 = "19d78mdg2lbz9jb4ph6nk783c9jbsdm8rnllwhga6pd53xffp6x0";
       type = "gem";
     };
-    version = "1.11.2";
+    version = "1.11.3";
   };
   octokit = {
     groups = ["default"];
@@ -1096,10 +1096,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1933p6fri27d2gscws43k1v8jw1821l5j4yfi9z97ch5l80mv1zr";
+      sha256 = "01g6jr73c3hbqhmzlc80jlqz2cwn9bq1j3cc19fpkq3hdg89drjp";
       type = "gem";
     };
-    version = "0.2.33";
+    version = "0.2.34";
   };
   rex-zip = {
     groups = ["default"];
@@ -1116,10 +1116,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1mkvkcw9fhpaizrhca0pdgjcrbns48rlz4g6lavl5gjjq3rk2sq3";
+      sha256 = "08ximcyfjy94pm1rhcx04ny1vx2sk0x4y185gzn86yfsbzwkng53";
       type = "gem";
     };
-    version = "3.2.4";
+    version = "3.2.5";
   };
   rkelly-remix = {
     groups = ["default"];
@@ -1166,10 +1166,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0px84i3d9kqb40ff7nk3k7hb3w3kk80w5zsgi61svgddp1dbzh1n";
+      sha256 = "0bg7xxw5cww4wy7vhr54i07ni82sh4qq465fir7az5z0hf36b1kg";
       type = "gem";
     };
-    version = "2.0.7";
+    version = "2.0.8";
   };
   rubyntlm = {
     groups = ["default"];
diff --git a/pkgs/tools/security/sops/default.nix b/pkgs/tools/security/sops/default.nix
index ec1ade20a19ad..1cf89143925ac 100644
--- a/pkgs/tools/security/sops/default.nix
+++ b/pkgs/tools/security/sops/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "sops";
-  version = "3.7.0";
+  version = "3.7.1";
 
   src = fetchFromGitHub {
     rev = "v${version}";
     owner = "mozilla";
     repo = pname;
-    sha256 = "1a0v1jgbz8n3dymzr2shg2ms9sxjwaci209ldzq8v4g737v10zgm";
+    sha256 = "0z3jcyl245yjszzjf2h6l1dwa092vxzvfmnivmwi6jvpsdcv33h1";
   };
 
-  vendorSha256 = "1qaml2h3c8fhmi8ahp2fmd0hagqp5xqaf8jxjh4mfmbv2is3yz1l";
+  vendorSha256 = "1mnwgsbpi56ql0lbpn7dkaps96x9b1lmhlk5cd6d40da7xj616n7";
 
   doCheck = false;
 
diff --git a/pkgs/tools/security/step-ca/default.nix b/pkgs/tools/security/step-ca/default.nix
index f3c9990a3c742..84fe06e6c19c5 100644
--- a/pkgs/tools/security/step-ca/default.nix
+++ b/pkgs/tools/security/step-ca/default.nix
@@ -2,29 +2,43 @@
 , lib
 , fetchFromGitHub
 , buildGoModule
+, coreutils
 , pcsclite
 , PCSC
 , pkg-config
+, hsmSupport ? true
 }:
 
 buildGoModule rec {
   pname = "step-ca";
-  version = "0.15.6";
+  version = "0.15.11";
 
   src = fetchFromGitHub {
     owner = "smallstep";
     repo = "certificates";
     rev = "v${version}";
-    sha256 = "0n26692ph4q4cmrqammfazmx1k9p2bydwqc57q4hz5ni6jd31zbz";
+    sha256 = "wFRs3n6V0z2keNVtqFw1q5jpA6BvNK5EftsNhichfsY=";
   };
 
-  vendorSha256 = "0w0phyqymcg2h2jjasxmkf4ryn4y1bqahcy94rs738cqr5ifyfbg";
+  vendorSha256 = "f1NdszqYYx6X1HqwqG26jjfjXq1gDXLOrh64ccKRQ90=";
 
-  nativeBuildInputs = [ pkg-config ];
+  nativeBuildInputs = lib.optionals hsmSupport [ pkg-config ];
 
   buildInputs =
-    lib.optional stdenv.isLinux (lib.getDev pcsclite)
-    ++ lib.optional stdenv.isDarwin PCSC;
+    lib.optionals (hsmSupport && stdenv.isLinux) [ pcsclite ]
+    ++ lib.optionals (hsmSupport && stdenv.isDarwin) [ PCSC ];
+
+  postPatch = ''
+    substituteInPlace systemd/step-ca.service --replace "/bin/kill" "${coreutils}/bin/kill"
+  '';
+
+  preBuild = ''
+    ${lib.optionalString (!hsmSupport) "export CGO_ENABLED=0"}
+  '';
+
+  postInstall = ''
+    install -Dm444 -t $out/lib/systemd/system systemd/step-ca.service
+  '';
 
   # Tests fail on darwin with
   # panic: httptest: failed to listen on a port: listen tcp6 [::1]:0: bind: operation not permitted [recovered]
@@ -35,7 +49,7 @@ buildGoModule rec {
     description = "A private certificate authority (X.509 & SSH) & ACME server for secure automated certificate management, so you can use TLS everywhere & SSO for SSH";
     homepage = "https://smallstep.com/certificates/";
     license = licenses.asl20;
-    maintainers = with maintainers; [ cmcdragonkai ];
+    maintainers = with maintainers; [ cmcdragonkai mohe2015 ];
     platforms = platforms.linux ++ platforms.darwin;
   };
 }
diff --git a/pkgs/tools/system/gdu/default.nix b/pkgs/tools/system/gdu/default.nix
index 839c48c320a42..c9479dca9065d 100644
--- a/pkgs/tools/system/gdu/default.nix
+++ b/pkgs/tools/system/gdu/default.nix
@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "gdu";
-  version = "4.9.1";
+  version = "4.10.0";
 
   src = fetchFromGitHub {
     owner = "dundee";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-blvnwsmcHf0yH2C/NUCsVQECIH4SI0BTNiMzCuNd0H0=";
+    sha256 = "sha256-qYxWjvXGaygoe88muQmQWlDJfM04wqxHy8+l7KO688U=";
   };
 
   vendorSha256 = "sha256-QiO5p0x8kmIN6f0uYS0IR2MlWtRYTHeZpW6Nmupjias=";
diff --git a/pkgs/tools/text/amber/default.nix b/pkgs/tools/text/amber/default.nix
index e9ceaffa73422..632a318e8620c 100644
--- a/pkgs/tools/text/amber/default.nix
+++ b/pkgs/tools/text/amber/default.nix
@@ -4,16 +4,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "amber";
-  version = "0.5.8";
+  version = "0.5.9";
 
   src = fetchFromGitHub {
     owner = "dalance";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0j9h9zzg6n4mhq2bqj71k5db595ilbgd9dn6ygmzsm74619q4454";
+    sha256 = "sha256-mmgJCD7kJjvpxyagsoe5CSzqIEZcIiYMAMP3axRphv4=";
   };
 
-  cargoSha256 = "0h47xqqq8f8m28rl1s6r305cf3dvk94aa86j6m0rk535i2jqfvhp";
+  cargoSha256 = "sha256-opRinhTmhZxpAwHNiVOLXL8boQf09Y1NXrWQ6HWQYQ0=";
 
   buildInputs = lib.optional stdenv.isDarwin Security;
 
diff --git a/pkgs/tools/text/frangipanni/default.nix b/pkgs/tools/text/frangipanni/default.nix
index 1f0dcfa941729..def134af50580 100644
--- a/pkgs/tools/text/frangipanni/default.nix
+++ b/pkgs/tools/text/frangipanni/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "frangipanni";
-  version = "0.4.0";
+  version = "0.4.2";
 
   src = fetchFromGitHub {
     owner = "birchb1024";
     repo = "frangipanni";
     rev = "v${version}";
-    sha256 = "sha256-NgRDXrAsfnj1cqO+2AN8nSuxS9KGNIl+pJkCADmDOqY=";
+    sha256 = "sha256-RzXfsaT/CUyWCpB5JGgl511gxgvzerqgwjpORgzyPCQ=";
   };
 
   vendorSha256 = "sha256-TSN5M/UCTtfoTf1hDCfrJMCFdSwL/NVXssgt4aefom8=";
diff --git a/pkgs/tools/typesetting/tex/mftrace/default.nix b/pkgs/tools/typesetting/tex/mftrace/default.nix
new file mode 100644
index 0000000000000..627b08436581b
--- /dev/null
+++ b/pkgs/tools/typesetting/tex/mftrace/default.nix
@@ -0,0 +1,63 @@
+{ stdenv
+, fetchFromGitHub
+, lib
+, makeWrapper
+, autoreconfHook
+, buildEnv
+, python3
+, fontforge
+, potrace
+, texlive
+}:
+
+/*
+  To use with a texlive distribution, ensure that the desired fonts and
+  the packages kpathsea, t1utils, metafont are available at runtime.
+
+  Possible overrides:
+  - potrace = autotrace
+  - fontforge = ghostscript (limited functionality)
+  - fontforge = null (limited functionality)
+*/
+
+let self = stdenv.mkDerivation rec {
+  pname = "mftrace";
+  version = "1.2.20";
+
+  # https://lilypond.org/download/sources/mftrace/mftrace-1.2.20.tar.gz
+  # is incomplete, fetch repo and use autoconf instead
+  # see https://github.com/hanwen/mftrace/issues/13
+  src = fetchFromGitHub {
+    owner = "hanwen";
+    repo = "mftrace";
+    rev = "release/${version}";
+    sha256 = "02ik25aczkbi10jrjlnxby3fmixxrwm2k5r4fkfif3bjfym7nqbc";
+  };
+
+  nativeBuildInputs = [ makeWrapper autoreconfHook python3 potrace ];
+
+  buildInputs = [ fontforge potrace ];
+
+  postInstall = ''
+    wrapProgram $out/bin/mftrace --prefix PATH : ${lib.makeBinPath buildInputs}
+  '';
+
+  # experimental texlive.combine support
+  # (note that only the bin/ folder will be combined into texlive)
+  passthru.tlType = "bin";
+  passthru.pkgs = [ self ] ++
+    (with texlive; kpathsea.pkgs ++ t1utils.pkgs ++ metafont.pkgs);
+
+  meta = with lib; {
+    description = "Scalable PostScript Fonts for MetaFont";
+    longDescription = ''
+      mftrace is a small Python program that lets you trace a TeX bitmap
+      font into a PFA or PFB font (A PostScript Type1 Scalable Font) or
+      TTF (TrueType) font.
+    '';
+    homepage = "https://lilypond.org/mftrace/";
+    license = with licenses; [ gpl2Only mit ];
+    maintainers = with maintainers; [ xworld21 ];
+    platforms = platforms.all;
+  };
+}; in self
diff --git a/pkgs/tools/virtualization/cri-tools/default.nix b/pkgs/tools/virtualization/cri-tools/default.nix
index 6e29a5a8d8332..637ff51317ff9 100644
--- a/pkgs/tools/virtualization/cri-tools/default.nix
+++ b/pkgs/tools/virtualization/cri-tools/default.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "cri-tools";
-  version = "1.20.0";
+  version = "1.21.0";
 
   src = fetchFromGitHub {
     owner = "kubernetes-sigs";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-fU3g0m2drUsa2Jyz+QYXi4xWTOLINGsDw3dKcesAkkE=";
+    sha256 = "sha256-chU7qNapmM4Gm8lYcdUreg1ZP93UM0LpIEk+w5cutlg=";
   };
 
   vendorSha256 = null;
diff --git a/pkgs/tools/virtualization/linode-cli/default.nix b/pkgs/tools/virtualization/linode-cli/default.nix
index 47953d21dfe0e..ba343fe657ba2 100644
--- a/pkgs/tools/virtualization/linode-cli/default.nix
+++ b/pkgs/tools/virtualization/linode-cli/default.nix
@@ -1,7 +1,6 @@
 { lib
 , buildPythonApplication
 , fetchFromGitHub
-, fetchpatch
 , fetchurl
 , terminaltables
 , colorclass
@@ -13,31 +12,23 @@
 let
 
   spec = fetchurl {
-    url = "https://raw.githubusercontent.com/linode/linode-api-docs/v4.67.0/openapi.yaml";
-    sha256 = "0vsblprkqlr9508x5rkm0wj6lc3w72xiwiqxia9asgr5k45hhfnr";
+    url = "https://raw.githubusercontent.com/linode/linode-api-docs/v4.89.0/openapi.yaml";
+    sha256 = "sha256-R7Dmq8ifGEjh47ftuoGrbymYBsPCj/ULz0j1OqJDcwY=";
   };
 
 in
 
 buildPythonApplication rec {
   pname = "linode-cli";
-  version = "2.15.0";
+  version = "5.0.1";
 
   src = fetchFromGitHub {
     owner = "linode";
     repo = pname;
     rev = version;
-    sha256 = "06iz9xjj6h1ry176558488fl9j18a5vf724zh4cxlcksdy72dnna";
+    sha256 = "sha256-zelopRaHaDCnbYA/y7dNMBh70g0+wuc6t9LH/VLaUIk=";
   };
 
-  patches = [
-    # make enum34 depend on python version
-    ( fetchpatch {
-        url = "https://github.com/linode/linode-cli/pull/184/commits/4cf55759c5da33fbc49b9ba664698875d67d4f76.patch";
-        sha256 = "04n9a6yh0abyyymvfzajhav6qxwvzjl2vs8jnqp3yqrma7kl0slj";
-    })
-  ];
-
   # remove need for git history
   prePatch = ''
     substituteInPlace setup.py \