diff --git a/nixos/doc/manual/installation/installing-from-other-distro.xml b/nixos/doc/manual/installation/installing-from-other-distro.xml
index 8ed45899fd7f..45d68f8787f1 100644
--- a/nixos/doc/manual/installation/installing-from-other-distro.xml
+++ b/nixos/doc/manual/installation/installing-from-other-distro.xml
@@ -89,7 +89,7 @@ nixpkgs https://nixos.org/channels/nixpkgs-unstable</screen>
     NixOS partition. They are installed by default on NixOS, but you don't have
     NixOS yet..
    </para>
-<screen><prompt>$ </prompt>nix-env -iE "_: with import &lt;nixpkgs/nixos&gt; { configuration = {}; }; with config.system.build; [ nixos-generate-config nixos-install nixos-enter manual.manpages ]"</screen>
+<screen><prompt>$ </prompt>nix-env -f '&lt;nixpkgs/nixos&gt;' --arg configuration {} -iA config.system.build.{nixos-generate-config,nixos-install,nixos-enter,manual.manpages}</screen>
   </listitem>
   <listitem>
    <note>
diff --git a/nixos/modules/services/networking/corerad.nix b/nixos/modules/services/networking/corerad.nix
index 2d4d414aae10..5d73c0a0d779 100644
--- a/nixos/modules/services/networking/corerad.nix
+++ b/nixos/modules/services/networking/corerad.nix
@@ -6,9 +6,11 @@ let
   cfg = config.services.corerad;
 
   writeTOML = name: x:
-    pkgs.runCommandNoCCLocal name { } ''
-      echo '${builtins.toJSON x}' | ${pkgs.go-toml}/bin/jsontoml > $out
-    '';
+    pkgs.runCommandNoCCLocal name {
+      passAsFile = ["config"];
+      config = builtins.toJSON x;
+      buildInputs = [ pkgs.go-toml ];
+    } "jsontoml < $configPath > $out";
 
 in {
   meta.maintainers = with maintainers; [ mdlayher ];
diff --git a/pkgs/applications/networking/browsers/firefox/common.nix b/pkgs/applications/networking/browsers/firefox/common.nix
index 817d17e8fad0..8060895a2e0f 100644
--- a/pkgs/applications/networking/browsers/firefox/common.nix
+++ b/pkgs/applications/networking/browsers/firefox/common.nix
@@ -94,11 +94,6 @@ stdenv.mkDerivation ({
 
   patches = [
     ./env_var_for_system_dir.patch
-    # Fix for NSS 3.52 (add missing CK_GCM_PARMS field)
-    (fetchpatch {
-      url = "https://hg.mozilla.org/mozilla-central/raw-rev/463069687b3d";
-      sha256 = "00yhz67flnkww3rbry0kqn6z6bm7vxfb2sgf7qikgbjcm3ysvpsm";
-    })
   ]
   ++ patches;
 
@@ -143,7 +138,6 @@ stdenv.mkDerivation ({
     "-Wno-error=format-security");
 
   postPatch = ''
-    substituteInPlace third_party/prio/prio/rand.c --replace 'nspr/prinit.h' 'prinit.h'
     rm -rf obj-x86_64-pc-linux-gnu
   '';
 
diff --git a/pkgs/applications/networking/browsers/firefox/packages.nix b/pkgs/applications/networking/browsers/firefox/packages.nix
index 753791be07c5..f0ca1c7cd154 100644
--- a/pkgs/applications/networking/browsers/firefox/packages.nix
+++ b/pkgs/applications/networking/browsers/firefox/packages.nix
@@ -7,10 +7,10 @@ in
 rec {
   firefox = common rec {
     pname = "firefox";
-    ffversion = "76.0.1";
+    ffversion = "77.0.1";
     src = fetchurl {
       url = "mirror://mozilla/firefox/releases/${ffversion}/source/firefox-${ffversion}.source.tar.xz";
-      sha512 = "0gnhfcgrz6022xf3vqia3s3639xa5pjp13h343d3c09mn8r919cmm6s38vzj1v3734fm25zb68acyarsp72xqq8z1420rh02b2pv38q";
+      sha512 = "ngLihC0YuclLJEV3iPEX+tRzDKIdBe+CCOuFxvWNo7DnX8royOvTj2m4YyWyZoTQ5UCbPTQYmP4otgfovZSe8g==";
     };
 
     patches = [
diff --git a/pkgs/applications/networking/cluster/luigi/default.nix b/pkgs/applications/networking/cluster/luigi/default.nix
index ced4c45d059d..c6e2b7d85598 100644
--- a/pkgs/applications/networking/cluster/luigi/default.nix
+++ b/pkgs/applications/networking/cluster/luigi/default.nix
@@ -2,11 +2,11 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "luigi";
-  version = "2.8.13";
+  version = "3.0.0";
 
   src = python3Packages.fetchPypi {
     inherit pname version;
-    sha256 = "0x14549iwj7r1knc0hmic9ny9hp960yjjqi4mxl78jb69gd3bhmf";
+    sha256 = "1km9fnq4pf0iqqcmz94idm0zb3l92zinz0bn6ip86xqhchafd4vf";
   };
 
   propagatedBuildInputs = with python3Packages; [ dateutil tornado_4 python-daemon boto3 ];
@@ -18,12 +18,13 @@ python3Packages.buildPythonApplication rec {
   makeWrapperArgs = ["--prefix PYTHONPATH . :"];
 
   meta = with lib; {
-    homepage = "https://github.com/spotify/luigi";
     description = "Python package that helps you build complex pipelines of batch jobs";
     longDescription = ''
       Luigi handles dependency resolution, workflow management, visualization,
       handling failures, command line integration, and much more.
     '';
+    homepage = "https://github.com/spotify/luigi";
+    changelog = "https://github.com/spotify/luigi/releases/tag/${version}";
     license =  [ licenses.asl20 ];
     maintainers = [ maintainers.bhipple ];
   };
diff --git a/pkgs/applications/networking/instant-messengers/bluejeans/default.nix b/pkgs/applications/networking/instant-messengers/bluejeans/default.nix
index 14fbd4db1a00..bd71166be222 100644
--- a/pkgs/applications/networking/instant-messengers/bluejeans/default.nix
+++ b/pkgs/applications/networking/instant-messengers/bluejeans/default.nix
@@ -40,11 +40,11 @@
 
 stdenv.mkDerivation rec {
   pname = "bluejeans";
-  version = "2.1.0";
+  version = "2.3.0";
 
   src = fetchurl {
     url = "https://swdl.bluejeans.com/desktop-app/linux/${version}/BlueJeans.rpm";
-    sha256 = "1zhh0pla5gk75p8x84va9flvnk456pbcm1n6x8l82c9682fwr7dd";
+    sha256 = "06lcpkga8h0zpl2wlysj6n979f0yg361frp3zr0vwzln3fiil2a7";
   };
 
   nativeBuildInputs = [ rpmextract makeWrapper ];
@@ -110,6 +110,9 @@ stdenv.mkDerivation rec {
       --set LD_LIBRARY_PATH "${libPath}":"${placeholder "out"}"/opt/BlueJeans \
       --set LD_PRELOAD "$out"/opt/BlueJeans/liblocaltime64_stub.so
 
+    substituteInPlace "$out"/share/applications/bluejeans-v2.desktop \
+      --replace "/opt/BlueJeans/bluejeans-v2" "$out/bin/bluejeans"
+
     patchShebangs "$out"
   '';
 
diff --git a/pkgs/applications/networking/mailreaders/thunderbird/default.nix b/pkgs/applications/networking/mailreaders/thunderbird/default.nix
index e36d99886e21..73536ae5fc1b 100644
--- a/pkgs/applications/networking/mailreaders/thunderbird/default.nix
+++ b/pkgs/applications/networking/mailreaders/thunderbird/default.nix
@@ -43,6 +43,7 @@
 , rustc
 , sqlite
 , stdenv
+, systemd
 , unzip
 , which
 , writeScript
@@ -305,11 +306,11 @@ stdenv.mkDerivation rec {
     )
   '';
 
-  # FIXME: This can probably be removed as soon as we package a
-  # Thunderbird >=71.0 since XUL shouldn't be anymore (in use)?
+  # FIXME: The XUL portion of this can probably be removed as soon as we
+  # package a Thunderbird >=71.0 since XUL shouldn't be anymore (in use)?
   postFixup = ''
     local xul="$out/lib/thunderbird/libxul.so"
-    patchelf --set-rpath "${libnotify}/lib:$(patchelf --print-rpath $xul)" $xul
+    patchelf --set-rpath "${libnotify}/lib:${systemd.lib}/lib:$(patchelf --print-rpath $xul)" $xul
   '';
 
   doInstallCheck = true;
diff --git a/pkgs/applications/science/logic/lean/default.nix b/pkgs/applications/science/logic/lean/default.nix
index 451aab6c049a..7fcc4cdd062e 100644
--- a/pkgs/applications/science/logic/lean/default.nix
+++ b/pkgs/applications/science/logic/lean/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "lean";
-  version = "3.15.0";
+  version = "3.16.2";
 
   src = fetchFromGitHub {
     owner  = "leanprover-community";
     repo   = "lean";
     rev    = "v${version}";
-    sha256 = "0fl8v8n53fr5qdnabici1mj3zpmjrkssx970y3q4m48s68q665v6";
+    sha256 = "0fvm7gvbr5kn258sqpnxa7dvzz84iv1dx1n066vih5gz80plz4lh";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/applications/window-managers/sway/contrib.nix b/pkgs/applications/window-managers/sway/contrib.nix
new file mode 100644
index 000000000000..e2c27fb470f7
--- /dev/null
+++ b/pkgs/applications/window-managers/sway/contrib.nix
@@ -0,0 +1,107 @@
+{ stdenv
+
+, fetchurl
+, coreutils
+, makeWrapper
+, sway-unwrapped
+, installShellFiles
+, wl-clipboard
+, libnotify
+, slurp
+, grim
+, jq
+
+, python3Packages
+}:
+
+{
+
+grimshot = stdenv.mkDerivation rec {
+  pname = "grimshot";
+  version = "2020-05-08";
+  rev = "b1d08db5f5112ab562f89564825e3e791b0682c4";
+
+  # master has new fixes and features, and a man page
+  # after sway-1.5 these may be switched to sway-unwrapped.src
+  bsrc = fetchurl {
+    url = "https://raw.githubusercontent.com/swaywm/sway/${rev}/contrib/grimshot";
+    sha256 = "1awzmzkib8a7q5s78xyh8za03lplqfpbasqp3lidqqmjqs882jq9";
+  };
+
+  msrc = fetchurl {
+    url = "https://raw.githubusercontent.com/swaywm/sway/${rev}/contrib/grimshot.1";
+    sha256 = "191xxjfhf61gkxl3b0f694h0nrwd7vfnyp5afk8snhhr6q7ia4jz";
+  };
+
+  dontBuild = true;
+  dontUnpack = true;
+  dontConfigure = true;
+
+  outputs = [ "out" "man" ];
+
+  nativeBuildInputs = [ makeWrapper installShellFiles ];
+
+  installPhase = ''
+    installManPage ${msrc}
+
+    install -Dm 0755 ${bsrc} $out/bin/grimshot
+    wrapProgram $out/bin/grimshot --set PATH \
+      "${stdenv.lib.makeBinPath [
+        sway-unwrapped
+        wl-clipboard
+        coreutils
+        libnotify
+        slurp
+        grim
+        jq
+        ] }"
+  '';
+
+  doInstallCheck = true;
+
+  installCheckPhase = ''
+    # check always returns 0
+    if [[ $($out/bin/grimshot check | grep "NOT FOUND") ]]; then false
+    else
+      echo "grimshot check passed"
+    fi
+  '';
+
+  meta = with stdenv.lib; {
+    description = "A helper for screenshots within sway";
+    homepage = "https://github.com/swaywm/sway/tree/master/contrib";
+    license = licenses.mit;
+    platforms = platforms.all;
+    maintainers = with maintainers; [
+      sway-unwrapped.meta.maintainers
+      evils
+    ];
+  };
+};
+
+
+inactive-windows-transparency = python3Packages.buildPythonApplication rec {
+  # long name is long
+  lname = "inactive-windows-transparency";
+  pname = "sway-${lname}";
+  version = sway-unwrapped.version;
+
+  src = sway-unwrapped.src;
+
+  format = "other";
+  dontBuild = true;
+  dontConfigure = true;
+
+  propagatedBuildInputs = [ python3Packages.i3ipc ];
+
+  installPhase = ''
+    install -Dm 0755 $src/contrib/${lname}.py $out/bin/${lname}.py
+  '';
+
+  meta = sway-unwrapped.meta // {
+    description = "It makes inactive sway windows transparent";
+    homepage    = "https://github.com/swaywm/sway/tree/${sway-unwrapped.version}/contrib";
+  };
+};
+
+}
diff --git a/pkgs/development/compilers/binaryen/default.nix b/pkgs/development/compilers/binaryen/default.nix
index 3a03f633ff0d..651c88704da3 100644
--- a/pkgs/development/compilers/binaryen/default.nix
+++ b/pkgs/development/compilers/binaryen/default.nix
@@ -1,11 +1,11 @@
 { stdenv, cmake, python3, fetchFromGitHub, emscriptenRev ? null, substituteAll }:
 
 let
-  defaultVersion = "93";
+  defaultVersion = "94";
 
   # Map from git revs to SHA256 hashes
   sha256s = {
-    version_93 = "15y3703ha6mxcq168br0wlydas5rq66msrcsd650zrjz0ndxwsfx";
+    version_94 = "1wk20fhyppb2ljni7ifqnsx9kl1kcl6c0svc0qljf0bs6rvr9qdm";
     "1.39.1" = "0ygm9m5322h4vfpf3j63q32qxk2l26yk62hh7dkb49j51zwl1y3y";
   };
 in
diff --git a/pkgs/development/libraries/libxslt/default.nix b/pkgs/development/libraries/libxslt/default.nix
index a03fca12581f..cf91d7656bf0 100644
--- a/pkgs/development/libraries/libxslt/default.nix
+++ b/pkgs/development/libraries/libxslt/default.nix
@@ -1,10 +1,8 @@
-{ stdenv, fetchurl, fetchpatch, libxml2, findXMLCatalogs, python, libgcrypt
+{ stdenv, fetchurl, fetchpatch, libxml2, findXMLCatalogs, gettext, python, libgcrypt
 , cryptoSupport ? false
 , pythonSupport ? stdenv.buildPlatform == stdenv.hostPlatform
 }:
 
-with stdenv.lib;
-
 stdenv.mkDerivation rec {
   pname = "libxslt";
   version = "1.1.34";
@@ -17,6 +15,7 @@ stdenv.mkDerivation rec {
   outputs = [ "bin" "dev" "out" "man" "doc" ] ++ stdenv.lib.optional pythonSupport "py";
 
   buildInputs = [ libxml2.dev ]
+    ++ stdenv.lib.optional stdenv.isDarwin gettext
     ++ stdenv.lib.optionals pythonSupport [ libxml2.py python ]
     ++ stdenv.lib.optionals cryptoSupport [ libgcrypt ];
 
@@ -27,14 +26,14 @@ stdenv.mkDerivation rec {
     "--without-debug"
     "--without-mem-debug"
     "--without-debugger"
-  ] ++ optional pythonSupport "--with-python=${python}"
-    ++ optional (!cryptoSupport) "--without-crypto";
+  ] ++ stdenv.lib.optional pythonSupport "--with-python=${python}"
+    ++ stdenv.lib.optional (!cryptoSupport) "--without-crypto";
 
   postFixup = ''
     moveToOutput bin/xslt-config "$dev"
     moveToOutput lib/xsltConf.sh "$dev"
     moveToOutput share/man/man1 "$bin"
-  '' + optionalString pythonSupport ''
+  '' + stdenv.lib.optionalString pythonSupport ''
     mkdir -p $py/nix-support
     echo ${libxml2.py} >> $py/nix-support/propagated-build-inputs
     moveToOutput ${python.libPrefix} "$py"
diff --git a/pkgs/development/ocaml-modules/ocsigen-start/default.nix b/pkgs/development/ocaml-modules/ocsigen-start/default.nix
index cc6650df1578..637c06e98dcf 100644
--- a/pkgs/development/ocaml-modules/ocsigen-start/default.nix
+++ b/pkgs/development/ocaml-modules/ocsigen-start/default.nix
@@ -5,7 +5,7 @@
 
 stdenv.mkDerivation rec {
   name = "ocaml${ocaml.version}-ocsigen-start-${version}";
-  version = "2.16.1";
+  version = "2.18.0";
 
   buildInputs = [ ocaml findlib ];
   propagatedBuildInputs = [ pgocaml_ppx safepass ocsigen-toolkit yojson resource-pooling cohttp-lwt-unix ];
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
     owner = "ocsigen";
     repo = "ocsigen-start";
     rev = version;
-    sha256 = "1pzpyrd3vbhc7zvzh6bv44793ikx5bglpd5p4wk5jj65v1w39jwd";
+    sha256 = "0wvh4c26g6qd6i1fryilcqz9giz7v6pnhc90sknhxh6jmwrbjl50";
   };
 
   meta = {
diff --git a/pkgs/development/python-modules/dot2tex/default.nix b/pkgs/development/python-modules/dot2tex/default.nix
index f671cdc9642a..03445f79117f 100644
--- a/pkgs/development/python-modules/dot2tex/default.nix
+++ b/pkgs/development/python-modules/dot2tex/default.nix
@@ -1,8 +1,11 @@
 { stdenv
+, python
 , buildPythonPackage
 , fetchPypi
-, isPy3k
+, substituteAll
 , pyparsing
+, graphviz
+, texlive
 }:
 
 buildPythonPackage rec {
@@ -14,11 +17,26 @@ buildPythonPackage rec {
     sha256 = "1kp77wiv7b5qib82i3y3sn9r49rym43aaqm5aw1bwnzfbbq2m6i9";
   };
 
-  # Tests fail with 3.x. Furthermore, package is no longer maintained.
-  disabled = isPy3k;
+  patches = [
+    (substituteAll {
+      src = ./path.patch;
+      inherit graphviz;
+    })
+    ./test.patch # https://github.com/kjellmf/dot2tex/issues/5
+  ];
 
   propagatedBuildInputs = [ pyparsing ];
 
+  checkInputs = [
+    (texlive.combine {
+      inherit (texlive) scheme-small preview pstricks;
+    })
+  ];
+
+  checkPhase = ''
+    ${python.interpreter} tests/test_dot2tex.py
+  '';
+
   meta = with stdenv.lib; {
     description = "Convert graphs generated by Graphviz to LaTeX friendly formats";
     homepage = "https://github.com/kjellmf/dot2tex";
diff --git a/pkgs/development/python-modules/dot2tex/path.patch b/pkgs/development/python-modules/dot2tex/path.patch
new file mode 100644
index 000000000000..4e05b7a8dff3
--- /dev/null
+++ b/pkgs/development/python-modules/dot2tex/path.patch
@@ -0,0 +1,104 @@
+diff --git a/dot2tex/dotparsing.py b/dot2tex/dotparsing.py
+index 391b5dc..6dc77a3 100644
+--- a/dot2tex/dotparsing.py
++++ b/dot2tex/dotparsing.py
+@@ -180,18 +180,8 @@ def __find_executables(path):
+ def find_graphviz():
+     """Locate Graphviz's executables in the system.
+ 
+-    Tries three methods:
+-
+-    First: Windows Registry (Windows only)
+-    This requires Mark Hammond's pywin32 is installed.
+-
+-    Secondly: Search the path
+-    It will look for 'dot', 'twopi' and 'neato' in all the directories
+-    specified in the PATH environment variable.
+-
+-    Thirdly: Default install location (Windows only)
+-    It will look for 'dot', 'twopi' and 'neato' in the default install
+-    location under the "Program Files" directory.
++    It will look for 'dot', 'twopi' and 'neato' in
++    @graphviz@/bin.
+ 
+     It will return a dictionary containing the program names as keys
+     and their paths as values.
+@@ -199,75 +189,9 @@ def find_graphviz():
+     If this fails, it returns None.
+     """
+ 
+-    # Method 1 (Windows only)
+-    #
+-    if os.sys.platform == 'win32':
+-        try:
+-            import win32api, win32con
+-
+-            # Get the GraphViz install path from the registry
+-            #
+-            hkey = win32api.RegOpenKeyEx(win32con.HKEY_LOCAL_MACHINE,
+-                                         "SOFTWARE\AT&T Research Labs\Graphviz", 0, win32con.KEY_QUERY_VALUE)
+-
+-            path = win32api.RegQueryValueEx(hkey, "InstallPath")[0]
+-            win32api.RegCloseKey(hkey)
+-
+-            # Now append the "bin" subdirectory:
+-            #
+-            path = os.path.join(path, "bin")
+-            progs = __find_executables(path)
+-            if progs is not None:
+-                # print("Used Windows registry")
+-                return progs
+-
+-        except ImportError:
+-            # Print a messaged suggesting they install these?
+-            #
+-            log.debug('The win32api is not installed')
+-            pass
+-        except:
+-            log.debug('Failed to access the registry key')
+-
+-    # Method 2 (Linux, Windows etc)
+-    #
+-    if 'PATH' in os.environ:
+-        for path in os.environ['PATH'].split(os.pathsep):
+-            progs = __find_executables(path)
+-            if progs is not None:
+-                return progs
+-
+-    # Method 3 (Windows only)
+-    #
+-    if os.sys.platform == 'win32':
+-        # Try and work out the equivalent of "C:\Program Files" on this
+-        # machine (might be on drive D:, or in a different language)
+-        #
+-        if 'PROGRAMFILES' in os.environ:
+-            # Note, we could also use the win32api to get this
+-            # information, but win32api may not be installed.
+-
+-            path = os.path.join(os.environ['PROGRAMFILES'], 'ATT', 'GraphViz', 'bin')
+-
+-        else:
+-            # Just in case, try the default...
+-            path = r"C:\Program Files\att\Graphviz\bin"
+-
+-        progs = __find_executables(path)
+-
+-        if progs is not None:
+-            # print("Used default install location")
+-            return progs
+-
+-    for path in (
+-            '/usr/bin', '/usr/local/bin',
+-            '/opt/local/bin',
+-            '/opt/bin', '/sw/bin', '/usr/share',
+-            '/Applications/Graphviz.app/Contents/MacOS/'):
+-        progs = __find_executables(path)
+-        if progs is not None:
+-            # print("Used path")
+-            return progs
++    progs = __find_executables('@graphviz@/bin')
++    if progs is not None:
++        return progs
+ 
+     # Failed to find GraphViz
+     #
diff --git a/pkgs/development/python-modules/dot2tex/test.patch b/pkgs/development/python-modules/dot2tex/test.patch
new file mode 100644
index 000000000000..9ead8ac5ee5c
--- /dev/null
+++ b/pkgs/development/python-modules/dot2tex/test.patch
@@ -0,0 +1,12 @@
+diff --git a/tests/test_dot2tex.py b/tests/test_dot2tex.py
+index 74b01ed..7be9aba 100644
+--- a/tests/test_dot2tex.py
++++ b/tests/test_dot2tex.py
+@@ -147,6 +147,7 @@ class NeedsQuotesTests(unittest.TestCase):
+ 
+ class MultipleStatements(unittest.TestCase):
+     # https://github.com/kjellmf/dot2tex/issues/5
++    @unittest.skip('fails upstream')
+     def test_semicolon(self):
+         """Test for issue 5"""
+         testgraph1 = """
diff --git a/pkgs/development/tools/analysis/flow/default.nix b/pkgs/development/tools/analysis/flow/default.nix
index 8df10222a88e..aed991dab30a 100644
--- a/pkgs/development/tools/analysis/flow/default.nix
+++ b/pkgs/development/tools/analysis/flow/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "flow";
-  version = "0.126.1";
+  version = "0.127.0";
 
   src = fetchFromGitHub {
     owner  = "facebook";
     repo   = "flow";
     rev    = "refs/tags/v${version}";
-    sha256 = "1acmhyhbl4s2c907nj8jwgg9fjjrfr306vagwkcx2lza4clb2aan";
+    sha256 = "0daacbb4il3mm8fkbk5qlpvzp3pmrqagq2hr1gsjaf8vnmissvvm";
   };
 
   installPhase = ''
diff --git a/pkgs/development/tools/continuous-integration/buildkite-cli/default.nix b/pkgs/development/tools/continuous-integration/buildkite-cli/default.nix
new file mode 100644
index 000000000000..06d69c152bad
--- /dev/null
+++ b/pkgs/development/tools/continuous-integration/buildkite-cli/default.nix
@@ -0,0 +1,26 @@
+{ lib, buildGoModule, fetchFromGitHub }:
+
+buildGoModule rec {
+  pname = "buildkite-cli";
+  version = "1.1.0";
+
+  src = fetchFromGitHub {
+    owner = "buildkite";
+    repo = "cli";
+    rev = "v${version}";
+    sha256 = "05hz59qzadkk4ji5icv5sxih31pnn0abnmiwcyfa2mr3l5jaqjnd";
+  };
+
+  vendorSha256 = "0jxh3yhh0sdvaykhinxngpipk369hw8z1y3g2z4c1115m5rjp2bb";
+
+  subPackages = [ "cmd/bk" ];
+
+  buildFlagsArray = [ "-ldflags=-s -w -X main.VERSION=${version}" ];
+
+  meta = with lib; {
+    description = "A command line interface for Buildkite";
+    homepage = "https://github.com/buildkite/cli";
+    license = licenses.mit;
+    maintainers = with maintainers; [ groodt ];
+  };
+}
diff --git a/pkgs/development/tools/continuous-integration/fly/default.nix b/pkgs/development/tools/continuous-integration/fly/default.nix
index 3bf48084bbd8..bdad33dee742 100644
--- a/pkgs/development/tools/continuous-integration/fly/default.nix
+++ b/pkgs/development/tools/continuous-integration/fly/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "fly";
-  version = "6.1.0";
+  version = "6.3.0";
 
   src = fetchFromGitHub {
     owner = "concourse";
     repo = "concourse";
     rev = "v${version}";
-    sha256 = "14sm3xwhm6pfln18i9f9dyj7s2wcri43rxj4s1cja7nwqr5sqb3x";
+    sha256 = "006qkg661hzbc2gpcnpxm09bp1kbb98y0bgdr49bjlnapcmdgr1b";
   };
 
-  vendorSha256 = "1c099sn5rrvj805va1lyjlbv7i2g1z5bxyaisv5l9365z0lv1cwm";
+  vendorSha256 = "03az7l9rf2syw837zliny82xhkqlad16z0vfcg5h21m3bhz6v6jy";
 
   subPackages = [ "fly" ];
 
diff --git a/pkgs/development/tools/dapper/default.nix b/pkgs/development/tools/dapper/default.nix
index d5c7d309e98d..c2dadeb6a933 100644
--- a/pkgs/development/tools/dapper/default.nix
+++ b/pkgs/development/tools/dapper/default.nix
@@ -5,7 +5,7 @@
 
 buildGoPackage rec {
   pname = "dapper";
-  version = "0.4.1";
+  version = "0.5.1";
 
   goPackagePath = "github.com/rancher/dapper";
 
@@ -13,7 +13,7 @@ buildGoPackage rec {
     owner = "rancher";
     repo = "dapper";
     rev = "v${version}";
-    sha256 = "03rmkmlvhmfwcln5v1rqww1kirxm0d1p58h6pj8f5fnhk9spb162";
+    sha256 = "0sf56ii4sn2wdq5kiyl02sgvq0lvynzgiq8v5wrkkabj5107fiqw";
   };
    patchPhase = ''
      substituteInPlace main.go --replace 0.0.0 ${version}
diff --git a/pkgs/development/tools/doctl/default.nix b/pkgs/development/tools/doctl/default.nix
index 5fe7ca69b036..e65fb4a64b73 100644
--- a/pkgs/development/tools/doctl/default.nix
+++ b/pkgs/development/tools/doctl/default.nix
@@ -2,7 +2,7 @@
 
 buildGoModule rec {
   pname = "doctl";
-  version = "1.45.0";
+  version = "1.45.1";
 
   vendorSha256 = null;
 
@@ -30,7 +30,7 @@ buildGoModule rec {
     owner = "digitalocean";
     repo = "doctl";
     rev = "v${version}";
-    sha256 = "1wnrvswysms8p26d8hnxpimx12bhi3sa9k4kwd2dbxg74569gq6d";
+    sha256 = "1zzdjpbag23kr6j3c7zkgqaavlna1q792qhs6s234vxm85zmwh4j";
   };
 
   meta = with lib; {
diff --git a/pkgs/development/tools/lazygit/default.nix b/pkgs/development/tools/lazygit/default.nix
index d08c9057c0fe..c3ae1eb30e87 100644
--- a/pkgs/development/tools/lazygit/default.nix
+++ b/pkgs/development/tools/lazygit/default.nix
@@ -2,7 +2,7 @@
 
 buildGoPackage rec {
   pname = "lazygit";
-  version = "0.20.3";
+  version = "0.20.4";
 
   goPackagePath = "github.com/jesseduffield/lazygit";
 
@@ -12,7 +12,7 @@ buildGoPackage rec {
     owner = "jesseduffield";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1p05lfm74g28ci5575vr22q5db50h19fcvc3lzddp0vyiw570isl";
+    sha256 = "134f04ybzgghm7ghyxair111aflmkjrbfj0bkxfp1w0a3jm6sfsk";
   };
 
   meta = with stdenv.lib; {
diff --git a/pkgs/development/tools/misc/autogen/default.nix b/pkgs/development/tools/misc/autogen/default.nix
index 2911855e7023..3e634bedfd19 100644
--- a/pkgs/development/tools/misc/autogen/default.nix
+++ b/pkgs/development/tools/misc/autogen/default.nix
@@ -33,7 +33,7 @@ stdenv.mkDerivation rec {
   outputs = [ "bin" "dev" "lib" "out" "man" "info" ];
 
   nativeBuildInputs = [
-    which pkgconfig perl autoreconfHook/*patches applied*/ 
+    which pkgconfig perl autoreconfHook/*patches applied*/
   ] ++ stdenv.lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
     # autogen needs a build autogen when cross-compiling
     buildPackages.buildPackages.autogen buildPackages.texinfo
@@ -62,6 +62,7 @@ stdenv.mkDerivation rec {
       sed -e "s|$lib/lib|/no-such-autogen-lib-path|" -i $f
     done
 
+  '' + stdenv.lib.optionalString (!stdenv.hostPlatform.isDarwin) ''
     # remove /build/** from RPATHs
     for f in "$bin"/bin/*; do
       local nrp="$(patchelf --print-rpath "$f" | sed -E 's@(:|^)/build/[^:]*:@\1@g')"
diff --git a/pkgs/os-specific/linux/kernel/hardened/patches.json b/pkgs/os-specific/linux/kernel/hardened/patches.json
index 2e4ea7478065..654615ebe500 100644
--- a/pkgs/os-specific/linux/kernel/hardened/patches.json
+++ b/pkgs/os-specific/linux/kernel/hardened/patches.json
@@ -1,22 +1,22 @@
 {
     "4.14": {
-        "name": "linux-hardened-4.14.183.a.patch",
-        "sha256": "0k9dg37q3hcm13iyw662indwy23aylc03ldqfn7613c7ymqmbzj7",
-        "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.14.183.a/linux-hardened-4.14.183.a.patch"
+        "name": "linux-hardened-4.14.184.a.patch",
+        "sha256": "1g12kz6ikdwp6b7000pfy3myga90mvxyl04b9267fk88jwih6yhk",
+        "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.14.184.a/linux-hardened-4.14.184.a.patch"
     },
     "4.19": {
-        "name": "linux-hardened-4.19.127.a.patch",
-        "sha256": "00nfcs5yn2a70an3ygzzv4s3qa3hf7pni4ad70aw87vyvrqlyx3k",
-        "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.19.127.a/linux-hardened-4.19.127.a.patch"
+        "name": "linux-hardened-4.19.128.a.patch",
+        "sha256": "19ayzx9rf4j31ypavxwamd290lm95wmi7v165avxslahnx6pdsxs",
+        "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.19.128.a/linux-hardened-4.19.128.a.patch"
     },
     "5.4": {
-        "name": "linux-hardened-5.4.45.a.patch",
-        "sha256": "0gihrcxqg3hax20xhvna4lmgsivari6wwsyqz09w34v8p1fhd5nx",
-        "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.4.45.a/linux-hardened-5.4.45.a.patch"
+        "name": "linux-hardened-5.4.46.a.patch",
+        "sha256": "0f2d53na7g6dhiba2ym09lm4fp3hwm6kw6mpm5jk46jmb6j7iwk5",
+        "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.4.46.a/linux-hardened-5.4.46.a.patch"
     },
     "5.6": {
-        "name": "linux-hardened-5.6.17.a.patch",
-        "sha256": "0nci30k7xh56b6454cd0hkpvpkfqb98cqdpvjaamlnmiphz4sk1f",
-        "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.6.17.a/linux-hardened-5.6.17.a.patch"
+        "name": "linux-hardened-5.6.18.a.patch",
+        "sha256": "0idvgjg7kji4w3341acfqywi0qqn3pvxcmiz70cd7inhlqaqrw63",
+        "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.6.18.a/linux-hardened-5.6.18.a.patch"
     }
 }
diff --git a/pkgs/tools/misc/hexyl/default.nix b/pkgs/tools/misc/hexyl/default.nix
index e67b0116df16..d9bed8c607d0 100644
--- a/pkgs/tools/misc/hexyl/default.nix
+++ b/pkgs/tools/misc/hexyl/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname   = "hexyl";
-  version = "0.7.0";
+  version = "0.8.0";
 
   src = fetchFromGitHub {
     owner  = "sharkdp";
     repo   = pname;
     rev    = "v${version}";
-    sha256 = "0blq81zpmzldngk9ymcg56syspjp1g1ziap4z69idv05mfkf6sp3";
+    sha256 = "0aj2sysl0spf5zlcd5kfzlw97w7dzf9x93pv0d1v9blnbd1rz7lm";
   };
 
-  cargoSha256 = "09kccd1brcbvzimm05dyybwrkganqxdkjrvzgcf1l93xs1z2h94b";
+  cargoSha256 = "1am9vs7l2wzgwqakrsl27x1y7jpn9xaqa4kr48wwqzka401h6j4m";
 
   meta = with stdenv.lib; {
     changelog = "https://github.com/sharkdp/hexyl/releases/tag/v${version}";
diff --git a/pkgs/tools/misc/lazydocker/default.nix b/pkgs/tools/misc/lazydocker/default.nix
index b63892178d91..d0c4d71c58a6 100644
--- a/pkgs/tools/misc/lazydocker/default.nix
+++ b/pkgs/tools/misc/lazydocker/default.nix
@@ -2,13 +2,13 @@
 
 buildGoPackage rec {
   pname = "lazydocker";
-  version = "0.8";
+  version = "0.9";
 
   src = fetchFromGitHub {
     owner = "jesseduffield";
     repo = "lazydocker";
     rev = "v${version}";
-    sha256 = "02x03nmkbj0133bziaqmqlh3x515w3n01iqvg7q6b55r7nan7hv7";
+    sha256 = "08j2qp632fdmswnb92wxa9lhnal4mrmq6gmxaxngnxiqgkfx37zy";
   };
 
   goPackagePath = "github.com/jesseduffield/lazydocker";
diff --git a/pkgs/tools/networking/findomain/default.nix b/pkgs/tools/networking/findomain/default.nix
index e19442576988..69e09b60d02a 100644
--- a/pkgs/tools/networking/findomain/default.nix
+++ b/pkgs/tools/networking/findomain/default.nix
@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "findomain";
-  version = "1.5.0";
+  version = "1.7.0";
 
   src = fetchFromGitHub {
     owner = "Edu4rdSHL";
     repo = pname;
     rev = version;
-    sha256 = "1w3parmk3836v5ghn3cgcxyk0alk05r5ljl3j1fpnly5xvl131rd";
+    sha256 = "1q8yxl4y8f787a0q87gxgj1p9lgzhhfk3fgysq9xj8yfvwm8abji";
   };
 
-  cargoSha256 = "1cs076cgkzjan6y78a3bhriv2q2s83hp5vzhkjwz4dqn83r6b8hx";
+  cargoSha256 = "02d538j13v3f1dc99vpzhby42ps7lig000idwdsxa1mwkjxrf2z2";
 
   nativeBuildInputs = [ installShellFiles perl ];
   buildInputs = lib.optional stdenv.isDarwin Security;
diff --git a/pkgs/tools/security/keybase/default.nix b/pkgs/tools/security/keybase/default.nix
index bbc99c2ac410..ee1cfa9d2a41 100644
--- a/pkgs/tools/security/keybase/default.nix
+++ b/pkgs/tools/security/keybase/default.nix
@@ -6,7 +6,7 @@
 
 buildGoPackage rec {
   pname = "keybase";
-  version = "5.4.2";
+  version = "5.5.1";
 
   goPackagePath = "github.com/keybase/client";
   subPackages = [ "go/kbnm" "go/keybase" ];
@@ -17,7 +17,7 @@ buildGoPackage rec {
     owner = "keybase";
     repo = "client";
     rev = "v${version}";
-    sha256 = "08lw5aw962f75xi42bwbgba94hiql2n2jnsxrkx84czi0ijs1wlr";
+    sha256 = "03y69zmzbnfay173xkbzvnhh8zjjd2rfnqmpgr0wvh1psn7mgpsh";
   };
 
   patches = [
diff --git a/pkgs/tools/system/gotop/default.nix b/pkgs/tools/system/gotop/default.nix
index bc6d24cf9175..0d8deb11b9e1 100644
--- a/pkgs/tools/system/gotop/default.nix
+++ b/pkgs/tools/system/gotop/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "gotop";
-  version = "3.5.3";
+  version = "4.0.1";
 
   src = fetchFromGitHub {
     owner = "xxxserxxx";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0m1a5bdqjgsm9fy3d2c6r4nil013cizqyqf19k6r4p9bq8rajnzp";
+    sha256 = "10qfzmq1wdgpvv319khzicalix1x4fqava0wry3bzz84k5c9dabs";
   };
 
-  vendorSha256 = "1pxp0a1hldkdmh174adhq8q0wyz005g7wm8yxknchvp7krxi9r0v";
+  vendorSha256 = "1crphp41bfivfmfp3cl7pjca3ypds6mr3847msd4wvfq4g6imk55";
 
   meta = with stdenv.lib; {
     description = "A terminal based graphical activity monitor inspired by gtop and vtop";
diff --git a/pkgs/tools/text/highlight/default.nix b/pkgs/tools/text/highlight/default.nix
index bc32a60c6727..a918770aa7b9 100644
--- a/pkgs/tools/text/highlight/default.nix
+++ b/pkgs/tools/text/highlight/default.nix
@@ -5,13 +5,13 @@ with stdenv.lib;
 let
   self = stdenv.mkDerivation rec {
     pname = "highlight";
-    version = "3.56";
+    version = "3.57";
 
     src = fetchFromGitLab {
       owner = "saalen";
       repo = "highlight";
       rev = "v${version}";
-      sha256 = "1pilx58dg96zm0yx7i6k92vibwpvpj8ir39f2akrsyjgijnv3sx4";
+      sha256 = "1xrk7c7akjiwh3wh9bll0qh4g0kqvbzjz9ancpadnk0k7bqi0kxf";
     };
 
     enableParallelBuilding = true;
diff --git a/pkgs/tools/typesetting/scdoc/default.nix b/pkgs/tools/typesetting/scdoc/default.nix
index 356433bac41c..5b6cf5e22f21 100644
--- a/pkgs/tools/typesetting/scdoc/default.nix
+++ b/pkgs/tools/typesetting/scdoc/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "scdoc";
-  version = "1.10.1";
+  version = "1.11.0";
 
   src = fetchurl {
     url = "https://git.sr.ht/~sircmpwn/scdoc/archive/${version}.tar.gz";
-    sha256 = "13x7g1r56bshvfmlvapvz35ywnbgsh337kywb5kcv8nc6b3j3q40";
+    sha256 = "17cjh3lcfppyl2mzpanylla93gdgdv5spc8jldshvayzizhfghwa";
   };
 
   postPatch = ''
@@ -24,6 +24,7 @@ stdenv.mkDerivation rec {
       C99.
     '';
     homepage = "https://git.sr.ht/~sircmpwn/scdoc";
+    changelog = "https://git.sr.ht/~sircmpwn/scdoc/refs/${version}";
     license = licenses.mit;
     platforms = platforms.unix;
     maintainers = with maintainers; [ primeos ];
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index c0d94050a433..2b75778322fe 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -10145,6 +10145,8 @@ in
   buildkite-agent2 = throw "pkgs.buildkite-agent2 has been discontinued. Please use pkgs.buildkite-agent (v3.x)";
   buildkite-agent3 = callPackage ../development/tools/continuous-integration/buildkite-agent { };
 
+  buildkite-cli = callPackage ../development/tools/continuous-integration/buildkite-cli { };
+
   libbpf = callPackage ../os-specific/linux/libbpf { };
 
   bpftool = callPackage ../os-specific/linux/bpftool { };
@@ -10381,7 +10383,7 @@ in
 
   dolt = callPackage ../servers/sql/dolt { };
 
-  dot2tex = pythonPackages.dot2tex;
+  dot2tex = with python3.pkgs; toPythonApplication dot2tex;
 
   doxygen = callPackage ../development/tools/documentation/doxygen {
     qt4 = null;
@@ -20205,6 +20207,7 @@ in
   swaybg = callPackage ../applications/window-managers/sway/bg.nix { };
   swayidle = callPackage ../applications/window-managers/sway/idle.nix { };
   swaylock = callPackage ../applications/window-managers/sway/lock.nix { };
+  sway-contrib = recurseIntoAttrs (callPackages ../applications/window-managers/sway/contrib.nix { });
 
   swaylock-fancy = callPackage ../applications/window-managers/sway/lock-fancy.nix { };
 
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 99ac3243d8a3..6aedec7abedc 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -6845,7 +6845,9 @@ in {
 
   jenkins-job-builder = callPackage ../development/python-modules/jenkins-job-builder { };
 
-  dot2tex = callPackage ../development/python-modules/dot2tex { };
+  dot2tex = callPackage ../development/python-modules/dot2tex {
+    inherit (pkgs) graphviz;
+  };
 
   poezio = callPackage ../applications/networking/instant-messengers/poezio {
     inherit (pkgs) pkgconfig;
diff --git a/pkgs/top-level/release-lib.nix b/pkgs/top-level/release-lib.nix
index 9dff0503d23a..1e33c7b0585b 100644
--- a/pkgs/top-level/release-lib.nix
+++ b/pkgs/top-level/release-lib.nix
@@ -145,7 +145,7 @@ rec {
     let res = builtins.tryEval (
       if isDerivation value then
         value.meta.hydraPlatforms
-          or (supportedMatches (value.meta.platforms or [ "x86_64-linux" ]))
+          or (value.meta.platforms or [ "x86_64-linux" ])
       else if value.recurseForDerivations or false || value.recurseForRelease or false then
         packagePlatforms value
       else