diff --git a/doc/contributing/submitting-changes.chapter.md b/doc/contributing/submitting-changes.chapter.md
index 40fc5ea78921..44e981f12a53 100644
--- a/doc/contributing/submitting-changes.chapter.md
+++ b/doc/contributing/submitting-changes.chapter.md
@@ -174,10 +174,13 @@ digraph {
     "staging-next" -> master [color="#E85EB0"] [label="stabilization ends"] [fontcolor="#E85EB0"]
     "staging" -> "staging-next" [color="#E85EB0"] [label="stabilization starts"] [fontcolor="#E85EB0"]
 
-    master -> "staging-next" -> staging [color="#5F5EE8"] [label="every six hours/any time"] [fontcolor="#5F5EE8"]
+    master -> "staging-next" -> staging [color="#5F5EE8"] [label="every six hours (GitHub Action)"] [fontcolor="#5F5EE8"]
 }
 ```
 
+[This GitHub Action](https://github.com/NixOS/nixpkgs/blob/master/.github/workflows/merge-staging.yml) brings changes from `master` to `staging-next` and from `staging-next` to `staging` every 6 hours.
+
+
 ### Master branch {#submitting-changes-master-branch}
 
 The `master` branch is the main development branch. It should only see non-breaking commits that do not cause mass rebuilds.
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index da8fdd1a64a2..747ce8475414 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -2103,6 +2103,12 @@
     email = "christoph.senjak@googlemail.com";
     name = "Christoph-Simon Senjak";
   };
+  davhau = {
+    email = "d.hauer.it@gmail.com";
+    name = "David Hauer";
+    github = "DavHau";
+    githubId = 42246742;
+  };
   david-sawatzke = {
     email = "d-nix@sawatzke.dev";
     github = "david-sawatzke";
diff --git a/nixos/modules/services/printing/cupsd.nix b/nixos/modules/services/printing/cupsd.nix
index e67badfcd29e..b19cd0732526 100644
--- a/nixos/modules/services/printing/cupsd.nix
+++ b/nixos/modules/services/printing/cupsd.nix
@@ -270,7 +270,7 @@ in
       drivers = mkOption {
         type = types.listOf types.path;
         default = [];
-        example = literalExample "with pkgs; [ gutenprint hplip splix cups-googlecloudprint ]";
+        example = literalExample "with pkgs; [ gutenprint hplip splix ]";
         description = ''
           CUPS drivers to use. Drivers provided by CUPS, cups-filters,
           Ghostscript and Samba are added unconditionally. If this list contains
diff --git a/nixos/modules/system/boot/loader/grub/install-grub.pl b/nixos/modules/system/boot/loader/grub/install-grub.pl
index 59f5638044fe..6e354f013fa2 100644
--- a/nixos/modules/system/boot/loader/grub/install-grub.pl
+++ b/nixos/modules/system/boot/loader/grub/install-grub.pl
@@ -356,11 +356,11 @@ else {
         if ($suffix eq ".jpg") {
             $suffix = ".jpeg";
         }
-		if ($backgroundColor) {
-			$conf .= "
-		    background_color '$backgroundColor'
-		    ";
-		}
+        if ($backgroundColor) {
+            $conf .= "
+            background_color '$backgroundColor'
+            ";
+        }
         copy $splashImage, "$bootPath/background$suffix" or die "cannot copy $splashImage to $bootPath: $!\n";
         $conf .= "
             insmod " . substr($suffix, 1) . "
diff --git a/nixos/modules/system/boot/luksroot.nix b/nixos/modules/system/boot/luksroot.nix
index 8dd2ea20519a..fa14d86e253d 100644
--- a/nixos/modules/system/boot/luksroot.nix
+++ b/nixos/modules/system/boot/luksroot.nix
@@ -56,7 +56,7 @@ let
 
         ykinfo -v 1>/dev/null 2>&1
         if [ $? != 0 ]; then
-            echo -n "Waiting $secs seconds for Yubikey to appear..."
+            echo -n "Waiting $secs seconds for YubiKey to appear..."
             local success=false
             for try in $(seq $secs); do
                 echo -n .
@@ -118,7 +118,7 @@ let
     # Cryptsetup locking directory
     mkdir -p /run/cryptsetup
 
-    # For Yubikey salt storage
+    # For YubiKey salt storage
     mkdir -p /crypt-storage
 
     ${optionalString luks.gpgSupport ''
@@ -218,7 +218,7 @@ let
     }
 
     ${optionalString (luks.yubikeySupport && (yubikey != null)) ''
-    # Yubikey
+    # YubiKey
     rbtohex() {
         ( od -An -vtx1 | tr -d ' \n' )
     }
@@ -244,7 +244,7 @@ let
         local new_k_luks
 
         mount -t ${yubikey.storage.fsType} ${yubikey.storage.device} /crypt-storage || \
-          die "Failed to mount Yubikey salt storage device"
+          die "Failed to mount YubiKey salt storage device"
 
         salt="$(cat /crypt-storage${yubikey.storage.path} | sed -n 1p | tr -d '\n')"
         iterations="$(cat /crypt-storage${yubikey.storage.path} | sed -n 2p | tr -d '\n')"
@@ -254,8 +254,27 @@ let
         for try in $(seq 3); do
             ${optionalString yubikey.twoFactor ''
             echo -n "Enter two-factor passphrase: "
-            read -r k_user
-            echo
+            k_user=
+            while true; do
+                if [ -e /crypt-ramfs/passphrase ]; then
+                    echo "reused"
+                    k_user=$(cat /crypt-ramfs/passphrase)
+                    break
+                else
+                    # Try reading it from /dev/console with a timeout
+                    IFS= read -t 1 -r k_user
+                    if [ -n "$k_user" ]; then
+                       ${if luks.reusePassphrases then ''
+                         # Remember it for the next device
+                         echo -n "$k_user" > /crypt-ramfs/passphrase
+                       '' else ''
+                         # Don't save it to ramfs. We are very paranoid
+                       ''}
+                       echo
+                       break
+                    fi
+                fi
+            done
             ''}
 
             if [ ! -z "$k_user" ]; then
@@ -268,6 +287,11 @@ let
 
             if [ $? == 0 ]; then
                 opened=true
+                ${if luks.reusePassphrases then ''
+                  # We don't rm here because we might reuse it for the next device
+                '' else ''
+                  rm -f /crypt-ramfs/passphrase
+                ''}
                 break
             else
                 opened=false
@@ -317,7 +341,7 @@ let
         if wait_yubikey ${toString yubikey.gracePeriod}; then
             do_open_yubikey
         else
-            echo "No yubikey found, falling back to non-yubikey open procedure"
+            echo "No YubiKey found, falling back to non-YubiKey open procedure"
             open_normally
         fi
     }
@@ -665,8 +689,8 @@ in
           yubikey = mkOption {
             default = null;
             description = ''
-              The options to use for this LUKS device in Yubikey-PBA.
-              If null (the default), Yubikey-PBA will be disabled for this device.
+              The options to use for this LUKS device in YubiKey-PBA.
+              If null (the default), YubiKey-PBA will be disabled for this device.
             '';
 
             type = with types; nullOr (submodule {
@@ -674,13 +698,13 @@ in
                 twoFactor = mkOption {
                   default = true;
                   type = types.bool;
-                  description = "Whether to use a passphrase and a Yubikey (true), or only a Yubikey (false).";
+                  description = "Whether to use a passphrase and a YubiKey (true), or only a YubiKey (false).";
                 };
 
                 slot = mkOption {
                   default = 2;
                   type = types.int;
-                  description = "Which slot on the Yubikey to challenge.";
+                  description = "Which slot on the YubiKey to challenge.";
                 };
 
                 saltLength = mkOption {
@@ -704,7 +728,7 @@ in
                 gracePeriod = mkOption {
                   default = 10;
                   type = types.int;
-                  description = "Time in seconds to wait for the Yubikey.";
+                  description = "Time in seconds to wait for the YubiKey.";
                 };
 
                 /* TODO: Add to the documentation of the current module:
@@ -779,9 +803,9 @@ in
       default = false;
       type = types.bool;
       description = ''
-            Enables support for authenticating with a Yubikey on LUKS devices.
+            Enables support for authenticating with a YubiKey on LUKS devices.
             See the NixOS wiki for information on how to properly setup a LUKS device
-            and a Yubikey to work with this feature.
+            and a YubiKey to work with this feature.
           '';
     };
 
@@ -799,7 +823,7 @@ in
 
     assertions =
       [ { assertion = !(luks.gpgSupport && luks.yubikeySupport);
-          message = "Yubikey and GPG Card may not be used at the same time.";
+          message = "YubiKey and GPG Card may not be used at the same time.";
         }
 
         { assertion = !(luks.gpgSupport && luks.fido2Support);
@@ -807,7 +831,7 @@ in
         }
 
         { assertion = !(luks.fido2Support && luks.yubikeySupport);
-          message = "FIDO2 and Yubikey may not be used at the same time.";
+          message = "FIDO2 and YubiKey may not be used at the same time.";
         }
       ];
 
diff --git a/pkgs/applications/audio/espeak-ng/default.nix b/pkgs/applications/audio/espeak-ng/default.nix
index 50d7af6d1164..44d5a0aa15aa 100644
--- a/pkgs/applications/audio/espeak-ng/default.nix
+++ b/pkgs/applications/audio/espeak-ng/default.nix
@@ -1,5 +1,6 @@
 { stdenv, lib, fetchFromGitHub, autoconf, automake, which, libtool, pkg-config
-, ronn
+, ronn, substituteAll
+, mbrolaSupport ? true, mbrola
 , pcaudiolibSupport ? true, pcaudiolib
 , sonicSupport ? true, sonic }:
 
@@ -14,13 +15,26 @@ stdenv.mkDerivation rec {
     sha256 = "0jkqhf2h94vbqq7mg7mmm23bq372fa7mdk941my18c3vkldcir1b";
   };
 
+  patches = lib.optionals mbrolaSupport [
+    # Hardcode correct mbrola paths.
+    (substituteAll {
+      src = ./mbrola.patch;
+      inherit mbrola;
+    })
+  ];
+
   nativeBuildInputs = [ autoconf automake which libtool pkg-config ronn ];
 
-  buildInputs = lib.optional pcaudiolibSupport pcaudiolib
+  buildInputs = lib.optional mbrolaSupport mbrola
+             ++ lib.optional pcaudiolibSupport pcaudiolib
              ++ lib.optional sonicSupport sonic;
 
   preConfigure = "./autogen.sh";
 
+  configureFlags = [
+    "--with-mbrola=${if mbrolaSupport then "yes" else "no"}"
+  ];
+
   postInstall = lib.optionalString stdenv.isLinux ''
     patchelf --set-rpath "$(patchelf --print-rpath $out/bin/espeak-ng)" $out/bin/speak-ng
   '';
@@ -29,7 +43,7 @@ stdenv.mkDerivation rec {
     description = "Open source speech synthesizer that supports over 70 languages, based on eSpeak";
     homepage = "https://github.com/espeak-ng/espeak-ng";
     changelog = "https://github.com/espeak-ng/espeak-ng/blob/${version}/CHANGELOG.md";
-    license = licenses.gpl3;
+    license = licenses.gpl3Plus;
     maintainers = with maintainers; [ aske ];
     platforms = platforms.all;
   };
diff --git a/pkgs/applications/audio/espeak-ng/mbrola.patch b/pkgs/applications/audio/espeak-ng/mbrola.patch
new file mode 100644
index 000000000000..2f6c61cca4ef
--- /dev/null
+++ b/pkgs/applications/audio/espeak-ng/mbrola.patch
@@ -0,0 +1,22 @@
+--- a/src/libespeak-ng/mbrowrap.c
++++ b/src/libespeak-ng/mbrowrap.c
+@@ -205,7 +205,7 @@
+ 		signal(SIGTERM, SIG_IGN);
+ 
+ 		snprintf(charbuf, sizeof(charbuf), "%g", mbr_volume);
+-		execlp("mbrola", "mbrola", "-e", "-v", charbuf,
++		execlp("@mbrola@/bin/mbrola", "mbrola", "-e", "-v", charbuf,
+ 		       voice_path, "-", "-.wav", (char *)NULL);
+ 		/* if execution reaches this point then the exec() failed */
+ 		snprintf(mbr_errorbuf, sizeof(mbr_errorbuf),
+--- a/src/libespeak-ng/synth_mbrola.c
++++ b/src/libespeak-ng/synth_mbrola.c
+@@ -85,7 +85,7 @@
+ 	if (!load_MBR())
+ 		return ENS_MBROLA_NOT_FOUND;
+ 
+-	sprintf(path, "%s/mbrola/%s", path_home, mbrola_voice);
++	sprintf(path, "@mbrola@/share/mbrola/voices/%s/%s", mbrola_voice, mbrola_voice);
+ #ifdef PLATFORM_POSIX
+ 	// if not found, then also look in
+ 	//   usr/share/mbrola/xx, /usr/share/mbrola/xx/xx, /usr/share/mbrola/voices/xx
diff --git a/pkgs/applications/audio/mbrola/default.nix b/pkgs/applications/audio/mbrola/default.nix
new file mode 100644
index 000000000000..01a9fdd636b0
--- /dev/null
+++ b/pkgs/applications/audio/mbrola/default.nix
@@ -0,0 +1,39 @@
+{ stdenv, lib, fetchFromGitHub }:
+
+let
+  voices = fetchFromGitHub {
+    owner = "numediart";
+    repo = "MBROLA-voices";
+    rev = "fe05a0ccef6a941207fd6aaad0b31294a1f93a51";  # using latest commit
+    sha256 = "1w0y2xjp9rndwdjagp2wxh656mdm3d6w9cs411g27rjyfy1205a0";
+  };
+in
+stdenv.mkDerivation rec {
+  pname = "mbrola";
+  version = "3.3";
+
+  src = fetchFromGitHub {
+    owner = "numediart";
+    repo = "MBROLA";
+    rev = version;
+    sha256 = "1w86gv6zs2cbr0731n49z8v6xxw0g8b0hzyv2iqb9mqcfh38l8zy";
+  };
+
+  installPhase = ''
+    runHook preInstall
+    install -D Bin/mbrola $out/bin/mbrola
+
+    # TODO: package separately because it's very big
+    install -d $out/share/mbrola/voices
+    cp -R ${voices}/data/* $out/share/mbrola/voices/
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "Speech synthesizer based on the concatenation of diphones";
+    homepage = "https://github.com/numediart/MBROLA";
+    license = licenses.agpl3Plus;
+    maintainers = with maintainers; [ davidak ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/applications/editors/emacs/generic.nix b/pkgs/applications/editors/emacs/generic.nix
index 9377d3ba89c9..619bde59874c 100644
--- a/pkgs/applications/editors/emacs/generic.nix
+++ b/pkgs/applications/editors/emacs/generic.nix
@@ -159,6 +159,10 @@ let emacs = stdenv.mkDerivation (lib.optionalAttrs nativeComp {
   '' + lib.optionalString (nativeComp && withNS) ''
     ln -snf $out/lib/emacs/*/native-lisp $out/Applications/Emacs.app/Contents/native-lisp
   '' + lib.optionalString nativeComp ''
+    $out/bin/emacs --batch \
+      -l comp --eval "(mapatoms (lambda (s) \
+                        (when (subr-primitive-p (symbol-function s)) \
+                          (comp-trampoline-compile s))))"
     mkdir -p $out/share/emacs/native-lisp
     $out/bin/emacs --batch \
       --eval "(add-to-list 'comp-eln-load-path \"$out/share/emacs/native-lisp\")" \
diff --git a/pkgs/applications/misc/dasel/default.nix b/pkgs/applications/misc/dasel/default.nix
index 061e3bc62de9..f4dafd9e134b 100644
--- a/pkgs/applications/misc/dasel/default.nix
+++ b/pkgs/applications/misc/dasel/default.nix
@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "dasel";
-  version = "1.13.0";
+  version = "1.13.1";
 
   src = fetchFromGitHub {
     owner = "TomWright";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-310zrxVjUECg/3+ydo9J8EdF0RbguBIT2PklEgpgRFU=";
+    sha256 = "sha256-fgXhWouqStfxWs6cFNVxWI1INVYswVUTOuLr09utxpY=";
   };
 
   vendorSha256 = "sha256-BdX4DO77mIf/+aBdkNVFUzClsIml1UMcgvikDbbdgcY=";
diff --git a/pkgs/applications/misc/far2l/default.nix b/pkgs/applications/misc/far2l/default.nix
index b414cbdd0ed4..87eaed975352 100644
--- a/pkgs/applications/misc/far2l/default.nix
+++ b/pkgs/applications/misc/far2l/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, fetchpatch, makeWrapper, cmake, pkg-config, wxGTK30, glib, pcre, m4, bash
+{ lib, stdenv, fetchFromGitHub, makeWrapper, cmake, pkg-config, wxGTK30, glib, pcre, m4, bash
 , xdg-utils, gvfs, zip, unzip, gzip, bzip2, gnutar, p7zip, xz, imagemagick
 , libuchardet, spdlog, xercesc, fmt, openssl, libssh, samba, neon, libnfs, libarchive }:
 
diff --git a/pkgs/applications/misc/gsimplecal/default.nix b/pkgs/applications/misc/gsimplecal/default.nix
index 21128ac9119a..2d855d0c9fcc 100644
--- a/pkgs/applications/misc/gsimplecal/default.nix
+++ b/pkgs/applications/misc/gsimplecal/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gsimplecal";
-  version = "2.1";
+  version = "2.2";
 
   src = fetchurl {
     url = "https://github.com/dmedvinsky/gsimplecal/archive/v${version}.tar.gz";
-    sha256 = "1sa05ifjp41xipfspk5n6l3wzpzmp3i45q88l01p4l6k6drsq336";
+    sha256 = "sha256-f19cnTX83LZT2d01B1EdWSaHcfHqpFPTo5glYkAokq8=";
   };
 
   postPatch = ''
diff --git a/pkgs/applications/misc/koreader/default.nix b/pkgs/applications/misc/koreader/default.nix
index a903600b46d2..d41565770665 100644
--- a/pkgs/applications/misc/koreader/default.nix
+++ b/pkgs/applications/misc/koreader/default.nix
@@ -11,12 +11,12 @@
 let font-droid = nerdfonts.override { fonts = [ "DroidSansMono" ]; };
 in stdenv.mkDerivation rec {
   pname = "koreader";
-  version = "2021.01.1";
+  version = "2021.02";
 
   src = fetchurl {
     url =
       "https://github.com/koreader/koreader/releases/download/v${version}/koreader-${version}-amd64.deb";
-    sha256 = "0kignyia2xrg84bqzsp8rid4c79zg11lhw52z1854jw9v9324pja";
+    sha256 = "0v7jx4a2kz1i1k9jqwcxbgdikflk28cnnp69sbhha8pkkbk8c5wh";
   };
 
   sourceRoot = ".";
diff --git a/pkgs/applications/misc/subsurface/default.nix b/pkgs/applications/misc/subsurface/default.nix
index 98392ae27f24..19fdd4640e40 100644
--- a/pkgs/applications/misc/subsurface/default.nix
+++ b/pkgs/applications/misc/subsurface/default.nix
@@ -1,16 +1,17 @@
 { lib, stdenv, fetchurl, fetchFromGitHub, autoreconfHook, cmake, wrapQtAppsHook, pkg-config, qmake
 , curl, grantlee, libgit2, libusb-compat-0_1, libssh2, libxml2, libxslt, libzip, zlib
 , qtbase, qtconnectivity, qtlocation, qtsvg, qttools, qtwebkit, libXcomposite
+, bluez
 }:
 
 let
-  version = "4.9.6";
+  version = "4.9.10";
 
   subsurfaceSrc = (fetchFromGitHub {
     owner = "Subsurface";
     repo = "subsurface";
     rev = "v${version}";
-    sha256 = "1w1ak0fi6ljhg2jc4mjqyrbpax3iawrnsaqq6ls7qdzrhi37rggf";
+    sha256 = "12ndhjplz3cwndwzhfc959dc0i6rm2qf3v2d8n9kba8nj63iblfs";
     fetchSubmodules = true;
   });
 
@@ -84,6 +85,7 @@ in stdenv.mkDerivation {
     libdc googlemaps
     curl grantlee libgit2 libssh2 libusb-compat-0_1 libxml2 libxslt libzip
     qtbase qtconnectivity qtsvg qttools qtwebkit
+    bluez
   ];
 
   nativeBuildInputs = [ cmake wrapQtAppsHook pkg-config ];
@@ -105,7 +107,7 @@ in stdenv.mkDerivation {
     '';
     homepage = "https://subsurface-divelog.org";
     license = licenses.gpl2;
-    maintainers = with maintainers; [ mguentner ];
+    maintainers = with maintainers; [ mguentner adisbladis ];
     platforms = platforms.all;
   };
 }
diff --git a/pkgs/applications/networking/cluster/nerdctl/default.nix b/pkgs/applications/networking/cluster/nerdctl/default.nix
index 28f7b540722e..d11461366b61 100644
--- a/pkgs/applications/networking/cluster/nerdctl/default.nix
+++ b/pkgs/applications/networking/cluster/nerdctl/default.nix
@@ -4,17 +4,12 @@
 , makeWrapper
 , buildkit
 , cni-plugins
-, extraPackages ? []
+, extraPackages ? [ ]
 }:
 
-let
-  binPath = lib.makeBinPath ([
-    buildkit
-  ] ++ extraPackages);
-in
 buildGoModule rec {
   pname = "nerdctl";
-  version = "0.5.0";
+  version = "0.6.0";
 
   src = fetchFromGitHub {
     owner = "AkihiroSuda";
@@ -37,15 +32,25 @@ buildGoModule rec {
 
   postInstall = ''
     wrapProgram $out/bin/nerdctl \
-      --prefix PATH : "${binPath}" \
+      --prefix PATH : "${lib.makeBinPath ([ buildkit ] ++ extraPackages)}" \
       --prefix CNI_PATH : "${cni-plugins}/bin"
   '';
 
+  doInstallCheck = true;
+  installCheckPhase = ''
+    runHook preInstallCheck
+    $out/bin/nerdctl --help
+    # --version will error without containerd.sock access
+    $out/bin/nerdctl --help | grep "${version}"
+    runHook postInstallCheck
+  '';
+
   meta = with lib; {
+    homepage = "https://github.com/AkihiroSuda/nerdctl/";
+    changelog = "https://github.com/AkihiroSuda/nerdctl/releases/tag/v${version}";
     description = "A Docker-compatible CLI for containerd";
-    homepage = src.meta.homepage;
     license = licenses.asl20;
-    platforms = platforms.linux;
     maintainers = with maintainers; [ jk ];
+    platforms = platforms.linux;
   };
 }
diff --git a/pkgs/applications/networking/feedreaders/feedreader/default.nix b/pkgs/applications/networking/feedreaders/feedreader/default.nix
index d550a1265470..c9339601a4b3 100644
--- a/pkgs/applications/networking/feedreaders/feedreader/default.nix
+++ b/pkgs/applications/networking/feedreaders/feedreader/default.nix
@@ -1,6 +1,6 @@
 { lib, stdenv, fetchFromGitHub, nix-update-script, meson, ninja, pkg-config, vala, gettext, python3
 , appstream-glib, desktop-file-utils, wrapGAppsHook, gnome-online-accounts
-, gtk3, libgee, libpeas, librest, webkitgtk, gsettings-desktop-schemas, pantheon
+, gtk3, libgee, libpeas, librest, webkitgtk, gsettings-desktop-schemas
 , curl, glib, gnome3, gst_all_1, json-glib, libnotify, libsecret, sqlite, gumbo, libxml2
 }:
 
diff --git a/pkgs/applications/networking/mailreaders/aerc/default.nix b/pkgs/applications/networking/mailreaders/aerc/default.nix
index b43e6bb093c4..3124239b0d9a 100644
--- a/pkgs/applications/networking/mailreaders/aerc/default.nix
+++ b/pkgs/applications/networking/mailreaders/aerc/default.nix
@@ -1,7 +1,6 @@
 { lib, buildGoModule, fetchurl
-, go, ncurses, notmuch, scdoc
-, python3, perl, w3m, dante
-, fetchFromGitHub
+, ncurses, notmuch, scdoc
+, python3, w3m, dante
 }:
 
 buildGoModule rec {
diff --git a/pkgs/applications/networking/mailreaders/neomutt/default.nix b/pkgs/applications/networking/mailreaders/neomutt/default.nix
index c0ebb3d8078f..0c02f512dad9 100644
--- a/pkgs/applications/networking/mailreaders/neomutt/default.nix
+++ b/pkgs/applications/networking/mailreaders/neomutt/default.nix
@@ -1,8 +1,6 @@
-{ lib, stdenv, fetchFromGitHub, gettext, makeWrapper, tcl, which, writeScript
+{ lib, stdenv, fetchFromGitHub, gettext, makeWrapper, tcl, which
 , ncurses, perl , cyrus_sasl, gss, gpgme, kerberos, libidn, libxml2, notmuch, openssl
-, lmdb, libxslt, docbook_xsl, docbook_xml_dtd_42, w3m, mailcap, runtimeShell, sqlite, zlib
-, glibcLocales
-, fetchpatch
+, lmdb, libxslt, docbook_xsl, docbook_xml_dtd_42, w3m, mailcap, sqlite, zlib
 }:
 
 stdenv.mkDerivation rec {
diff --git a/pkgs/applications/networking/p2p/tribler/default.nix b/pkgs/applications/networking/p2p/tribler/default.nix
index 36b7451e441b..6e2533621e6c 100644
--- a/pkgs/applications/networking/p2p/tribler/default.nix
+++ b/pkgs/applications/networking/p2p/tribler/default.nix
@@ -1,5 +1,5 @@
-{ stdenv, fetchurl, pkgs, python3Packages, makeWrapper
-, enablePlayer ? true, libvlc ? null, qt5, lib }:
+{ stdenv, fetchurl, python3Packages, makeWrapper
+, enablePlayer ? true, libvlc, qt5, lib }:
 
 stdenv.mkDerivation rec {
   pname = "tribler";
diff --git a/pkgs/applications/version-management/git-and-tools/git/default.nix b/pkgs/applications/version-management/git-and-tools/git/default.nix
index c955c04d7796..5d1589446bef 100644
--- a/pkgs/applications/version-management/git-and-tools/git/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git/default.nix
@@ -1,5 +1,4 @@
 { fetchurl, lib, stdenv, buildPackages
-, fetchpatch
 , curl, openssl, zlib, expat, perlPackages, python3, gettext, cpio
 , gnugrep, gnused, gawk, coreutils # needed at runtime by git-filter-branch etc
 , openssh, pcre2
diff --git a/pkgs/build-support/go/garble.nix b/pkgs/build-support/go/garble.nix
new file mode 100644
index 000000000000..27277d1b9925
--- /dev/null
+++ b/pkgs/build-support/go/garble.nix
@@ -0,0 +1,24 @@
+{ buildGoModule
+, fetchFromGitHub
+, lib
+}:
+buildGoModule rec {
+  pname = "garble";
+  version = "20200107";
+
+  src = fetchFromGitHub {
+    owner = "burrowers";
+    repo = pname;
+    rev = "835f4aadf321521acf06aac4d5068473dc4b2ac1";
+    sha256 = "sha256-NodsVHRll2YZoxrhmniJvelQOStG82u3kJyc0t8OXD8=";
+  };
+
+  vendorSha256 = "sha256-x2fk2QmZDK2yjyfYdK7x+sQjvt7tuggmm8ieVjsNKek=";
+
+  meta = {
+    description = "Obfuscate Go code by wrapping the Go toolchain";
+    homepage = "https://github.com/burrowers/garble/";
+    maintainers = with lib.maintainers; [ davhau ];
+    license = lib.licenses.bsd3;
+  };
+}
diff --git a/pkgs/data/fonts/iosevka/default.nix b/pkgs/data/fonts/iosevka/default.nix
index cbdd309db5e5..04e5b48bd0bd 100644
--- a/pkgs/data/fonts/iosevka/default.nix
+++ b/pkgs/data/fonts/iosevka/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, pkgs, fetchFromGitHub, nodejs, nodePackages, remarshal
+{ stdenv, lib, nodejs, nodePackages, remarshal
 , ttfautohint-nox
   # Custom font set options.
   # See https://typeof.net/Iosevka/customizer
diff --git a/pkgs/data/icons/iso-flags/default.nix b/pkgs/data/icons/iso-flags/default.nix
index 4252853b898c..57cc1752f187 100644
--- a/pkgs/data/icons/iso-flags/default.nix
+++ b/pkgs/data/icons/iso-flags/default.nix
@@ -1,9 +1,7 @@
 { lib, stdenv
 , fetchFromGitHub
 , perl
-, perlPackages
 , inkscape
-, pngcrush
 , librsvg
 , targets ? [ "all" ]
 }:
diff --git a/pkgs/desktops/cinnamon/cinnamon-screensaver/default.nix b/pkgs/desktops/cinnamon/cinnamon-screensaver/default.nix
index 80a026e88361..0e8f6dbf8c3d 100644
--- a/pkgs/desktops/cinnamon/cinnamon-screensaver/default.nix
+++ b/pkgs/desktops/cinnamon/cinnamon-screensaver/default.nix
@@ -11,18 +11,10 @@
 , intltool
 , libxslt
 , gtk3
-, libnotify
-, libxkbfile
-, cinnamon-menus
 , libgnomekbd
-, libxklavier
-, networkmanager
-, libwacom
 , gnome3
 , libtool
 , wrapGAppsHook
-, tzdata
-, glibc
 , gobject-introspection
 , python3
 , pam
diff --git a/pkgs/desktops/gnome-3/core/gnome-contacts/default.nix b/pkgs/desktops/gnome-3/core/gnome-contacts/default.nix
index 3a7e21c65f54..ef5e564beb95 100644
--- a/pkgs/desktops/gnome-3/core/gnome-contacts/default.nix
+++ b/pkgs/desktops/gnome-3/core/gnome-contacts/default.nix
@@ -2,7 +2,6 @@
 , gettext
 , fetchurl
 , evolution-data-server
-, fetchpatch
 , pkg-config
 , libxslt
 , docbook_xsl
diff --git a/pkgs/desktops/gnome-3/core/gnome-control-center/default.nix b/pkgs/desktops/gnome-3/core/gnome-control-center/default.nix
index 5a78f412dc7a..98d87dc09c85 100644
--- a/pkgs/desktops/gnome-3/core/gnome-control-center/default.nix
+++ b/pkgs/desktops/gnome-3/core/gnome-control-center/default.nix
@@ -22,7 +22,6 @@
 , gnome-color-manager
 , gnome-desktop
 , gnome-online-accounts
-, gnome-session
 , gnome-settings-daemon
 , gnome3
 , grilo
diff --git a/pkgs/desktops/gnome-3/core/gnome-initial-setup/default.nix b/pkgs/desktops/gnome-3/core/gnome-initial-setup/default.nix
index 002ae9197b74..d2909c449d4a 100644
--- a/pkgs/desktops/gnome-3/core/gnome-initial-setup/default.nix
+++ b/pkgs/desktops/gnome-3/core/gnome-initial-setup/default.nix
@@ -30,7 +30,6 @@
 , systemd
 , libnma
 , tzdata
-, yelp
 , libgnomekbd
 , gsettings-desktop-schemas
 , gnome-tour
diff --git a/pkgs/desktops/gnome-3/misc/gnome-applets/default.nix b/pkgs/desktops/gnome-3/misc/gnome-applets/default.nix
index 1f9b1ba871dd..1947179028bf 100644
--- a/pkgs/desktops/gnome-3/misc/gnome-applets/default.nix
+++ b/pkgs/desktops/gnome-3/misc/gnome-applets/default.nix
@@ -16,7 +16,6 @@
 , adwaita-icon-theme
 , libgweather
 , gucharmap
-, tracker
 , polkit
 , gnome3
 }:
diff --git a/pkgs/desktops/pantheon/desktop/elementary-session-settings/default.nix b/pkgs/desktops/pantheon/desktop/elementary-session-settings/default.nix
index 27a379f4738d..e45d25cfa342 100644
--- a/pkgs/desktops/pantheon/desktop/elementary-session-settings/default.nix
+++ b/pkgs/desktops/pantheon/desktop/elementary-session-settings/default.nix
@@ -11,7 +11,6 @@
 , wingpanel
 , orca
 , onboard
-, at-spi2-core
 , elementary-default-settings
 , elementary-settings-daemon
 , runtimeShell
diff --git a/pkgs/development/interpreters/python/tests.nix b/pkgs/development/interpreters/python/tests.nix
index ff27ca8ec208..cfba04da9380 100644
--- a/pkgs/development/interpreters/python/tests.nix
+++ b/pkgs/development/interpreters/python/tests.nix
@@ -101,6 +101,24 @@ let
     };
   };
 
+  # Tests to ensure overriding works as expected.
+  overrideTests = let
+    extension = self: super: {
+      foobar = super.numpy;
+    };
+  in {
+    test-packageOverrides = let
+      myPython = let
+        self = python.override {
+          packageOverrides = extension;
+          inherit self;
+        };
+      in self;
+    in assert myPython.pkgs.foobar == myPython.pkgs.numpy; myPython.withPackages(ps: with ps; [ foobar ]);
+    # overrideScope is broken currently
+    # test-overrideScope = let
+    #  myPackages = python.pkgs.overrideScope extension;
+    # in assert myPackages.foobar == myPackages.numpy; myPackages.python.withPackages(ps: with ps; [ foobar ]);
+  };
 
-
-in lib.optionalAttrs (stdenv.hostPlatform == stdenv.buildPlatform ) (environmentTests // integrationTests)
+in lib.optionalAttrs (stdenv.hostPlatform == stdenv.buildPlatform ) (environmentTests // integrationTests // overrideTests)
diff --git a/pkgs/development/libraries/g2o/default.nix b/pkgs/development/libraries/g2o/default.nix
index b967a89568d2..0536ec95c6ff 100644
--- a/pkgs/development/libraries/g2o/default.nix
+++ b/pkgs/development/libraries/g2o/default.nix
@@ -43,5 +43,7 @@ mkDerivation rec {
     license = with licenses; [ bsd3 lgpl3 gpl3 ];
     maintainers = with maintainers; [ lopsided98 ];
     platforms = platforms.all;
+    # fatal error: 'qglviewer.h' file not found
+    broken = stdenv.isDarwin;
   };
 }
diff --git a/pkgs/development/python-modules/androidtv/default.nix b/pkgs/development/python-modules/androidtv/default.nix
index ec00c31147b0..aae46e4e3225 100644
--- a/pkgs/development/python-modules/androidtv/default.nix
+++ b/pkgs/development/python-modules/androidtv/default.nix
@@ -7,7 +7,6 @@
 , mock
 , pure-python-adb
 , pytestCheckHook
-, python
 }:
 
 buildPythonPackage rec {
diff --git a/pkgs/development/python-modules/graphene/default.nix b/pkgs/development/python-modules/graphene/default.nix
index bf7d08cdce36..2839fc337cd8 100644
--- a/pkgs/development/python-modules/graphene/default.nix
+++ b/pkgs/development/python-modules/graphene/default.nix
@@ -2,7 +2,6 @@
 , buildPythonPackage
 , fetchFromGitHub
 , aniso8601
-, iso8601
 , graphql-core
 , graphql-relay
 , promise
diff --git a/pkgs/development/python-modules/lammps-cython/default.nix b/pkgs/development/python-modules/lammps-cython/default.nix
index 609d7a410c17..cf6bdc38ffaa 100644
--- a/pkgs/development/python-modules/lammps-cython/default.nix
+++ b/pkgs/development/python-modules/lammps-cython/default.nix
@@ -47,5 +47,7 @@ buildPythonPackage rec {
     homepage = "https://gitlab.com/costrouc/lammps-cython";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ costrouc ];
+    # fails import check
+    broken = true;
   };
 }
diff --git a/pkgs/development/python-modules/lightparam/default.nix b/pkgs/development/python-modules/lightparam/default.nix
index 0c3eb5292a88..936cc9a06269 100644
--- a/pkgs/development/python-modules/lightparam/default.nix
+++ b/pkgs/development/python-modules/lightparam/default.nix
@@ -1,4 +1,4 @@
-{ lib, pkgs, buildPythonPackage, fetchFromGitHub, isPy3k
+{ lib, buildPythonPackage, fetchFromGitHub, isPy3k
 , ipython
 , ipywidgets
 , numpy
diff --git a/pkgs/development/python-modules/moderngl_window/default.nix b/pkgs/development/python-modules/moderngl_window/default.nix
index b4aee8c61cf7..7f6d9893c969 100644
--- a/pkgs/development/python-modules/moderngl_window/default.nix
+++ b/pkgs/development/python-modules/moderngl_window/default.nix
@@ -7,7 +7,6 @@
 , pyglet
 , pillow
 , pyrr
-, pytest
 }:
 
 buildPythonPackage rec {
diff --git a/pkgs/development/python-modules/nbdime/default.nix b/pkgs/development/python-modules/nbdime/default.nix
index 1c1e52b5a79d..66e1edd93908 100644
--- a/pkgs/development/python-modules/nbdime/default.nix
+++ b/pkgs/development/python-modules/nbdime/default.nix
@@ -1,4 +1,4 @@
-{ lib, buildPythonPackage, fetchPypi, callPackage, isPy3k
+{ lib, buildPythonPackage, fetchPypi, isPy3k
 , hypothesis
 , setuptools_scm
 , six
diff --git a/pkgs/development/python-modules/nbsphinx/default.nix b/pkgs/development/python-modules/nbsphinx/default.nix
index 979b357607e5..2622b815f1ee 100644
--- a/pkgs/development/python-modules/nbsphinx/default.nix
+++ b/pkgs/development/python-modules/nbsphinx/default.nix
@@ -7,7 +7,6 @@
 , nbformat
 , sphinx
 , traitlets
-, python
 , isPy3k
 }:
 
diff --git a/pkgs/development/python-modules/ndjson/default.nix b/pkgs/development/python-modules/ndjson/default.nix
index 175b04d31074..715a1989b455 100644
--- a/pkgs/development/python-modules/ndjson/default.nix
+++ b/pkgs/development/python-modules/ndjson/default.nix
@@ -1,4 +1,4 @@
-{ lib, buildPythonPackage, fetchPypi, wheel, watchdog, flake8
+{ lib, buildPythonPackage, fetchPypi, watchdog, flake8
 , pytest, pytestrunner, coverage, sphinx, twine }:
 
 buildPythonPackage rec {
diff --git a/pkgs/development/python-modules/notebook/default.nix b/pkgs/development/python-modules/notebook/default.nix
index bab3aa590ec6..926dd3698c62 100644
--- a/pkgs/development/python-modules/notebook/default.nix
+++ b/pkgs/development/python-modules/notebook/default.nix
@@ -12,7 +12,6 @@
 , tornado
 , ipython_genutils
 , traitlets
-, jupyter
 , jupyter_core
 , jupyter_client
 , nbformat
diff --git a/pkgs/development/python-modules/onnx/default.nix b/pkgs/development/python-modules/onnx/default.nix
index 278d7c1df046..95e67c58d55e 100644
--- a/pkgs/development/python-modules/onnx/default.nix
+++ b/pkgs/development/python-modules/onnx/default.nix
@@ -1,5 +1,4 @@
 { lib
-, fetchpatch
 , buildPythonPackage
 , fetchPypi
 , pythonOlder
diff --git a/pkgs/development/python-modules/phonemizer/default.nix b/pkgs/development/python-modules/phonemizer/default.nix
index 2d6531794313..80bc0737cac2 100644
--- a/pkgs/development/python-modules/phonemizer/default.nix
+++ b/pkgs/development/python-modules/phonemizer/default.nix
@@ -2,14 +2,11 @@
 , substituteAll
 , buildPythonApplication
 , fetchPypi
-, python3Packages
-, pkgs
 , joblib
 , segments
 , attrs
 , espeak-ng
 , pytestCheckHook
-, pytestrunner
 , pytestcov
 }:
 
diff --git a/pkgs/development/python-modules/qiskit-aer/default.nix b/pkgs/development/python-modules/qiskit-aer/default.nix
index 062aeeb97ff3..bb04309d1a58 100644
--- a/pkgs/development/python-modules/qiskit-aer/default.nix
+++ b/pkgs/development/python-modules/qiskit-aer/default.nix
@@ -6,7 +6,6 @@
 , blas
 , catch2
 , cmake
-, conan
 , cython
 , fmt
 , muparserx
diff --git a/pkgs/development/python-modules/robotframework-tools/default.nix b/pkgs/development/python-modules/robotframework-tools/default.nix
index 5e8ca33fffba..77a7fe13df99 100644
--- a/pkgs/development/python-modules/robotframework-tools/default.nix
+++ b/pkgs/development/python-modules/robotframework-tools/default.nix
@@ -1,7 +1,6 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, isPy3k
 , robotframework
 , moretools
 , pathpy
diff --git a/pkgs/development/tools/misc/clojure-lsp/default.nix b/pkgs/development/tools/misc/clojure-lsp/default.nix
index 5797fcc4109c..c0d4567fe0b7 100644
--- a/pkgs/development/tools/misc/clojure-lsp/default.nix
+++ b/pkgs/development/tools/misc/clojure-lsp/default.nix
@@ -1,24 +1,59 @@
-{ lib, stdenv, fetchurl, jre, makeWrapper }:
+{ lib, stdenv, callPackage, fetchFromGitHub, leiningen, openjdk11
+, graalvm11-ce, babashka }:
 
-stdenv.mkDerivation rec {
+let
   pname = "clojure-lsp";
   version = "2021.02.14-19.46.47";
+  leiningen11 = leiningen.override ({ jdk = openjdk11; });
 
-  src = fetchurl {
-    url = "https://github.com/clojure-lsp/clojure-lsp/releases/download/${version}/${pname}.jar";
-    sha256 = "sha256-fLwubRwWa1fu37bdkaCr2uZK79z37wqPLToOb5BlegY=";
+  src = fetchFromGitHub {
+    owner = pname;
+    repo = pname;
+    rev = version;
+    sha256 = "sha256-Zj7/8RcuxCy2xdd+5jeOb1GTsQsX0EVW32k32fA6uf4=";
   };
 
-  dontUnpack = true;
+  repository = callPackage ./repository.nix {
+    inherit src pname version;
+    leiningen = leiningen11;
+  };
+in stdenv.mkDerivation rec {
+  inherit src pname version;
 
-  nativeBuildInputs = [ makeWrapper ];
+  postPatch = ''
+    # Hack to set maven cache in another directory since MAVEN_OPTS doesn't work
+    substituteInPlace project.clj \
+      --replace ":main" ":local-repo \"${repository}\" :main"
+  '';
+
+  GRAALVM_HOME = graalvm11-ce;
+
+  buildInputs = [ graalvm11-ce leiningen11 repository ];
+
+  buildPhase = with lib; ''
+    runHook preBuild
+
+    export LEIN_HOME="$(mktemp -d)"
+    bash ./graalvm/native-unix-compile.sh
+
+    runHook postBuild
+  '';
 
   installPhase = ''
-    install -Dm644 $src $out/share/java/${pname}.jar
-    makeWrapper ${jre}/bin/java $out/bin/${pname} \
-      --add-flags "-Xmx2g" \
-      --add-flags "-server" \
-      --add-flags "-jar $out/share/java/${pname}.jar"
+    runHook preInstall
+
+    install -Dm755 ./clojure-lsp $out/bin/clojure-lsp
+
+    runHook postInstall
+  '';
+
+  doCheck = true;
+  checkPhase = ''
+    runHook preCheck
+
+    ${babashka}/bin/bb ./integration-test/run-all.clj ./clojure-lsp
+
+    runHook postCheck
   '';
 
   meta = with lib; {
@@ -26,6 +61,6 @@ stdenv.mkDerivation rec {
     homepage = "https://github.com/snoe/clojure-lsp";
     license = licenses.mit;
     maintainers = [ maintainers.ericdallo ];
-    platforms = jre.meta.platforms;
+    platforms = graalvm11-ce.meta.platforms;
   };
 }
diff --git a/pkgs/development/tools/misc/clojure-lsp/repository.nix b/pkgs/development/tools/misc/clojure-lsp/repository.nix
new file mode 100644
index 000000000000..122096e9657a
--- /dev/null
+++ b/pkgs/development/tools/misc/clojure-lsp/repository.nix
@@ -0,0 +1,40 @@
+{ lib, stdenv, src, pname, version, leiningen }:
+
+stdenv.mkDerivation {
+  inherit src;
+
+  name = "${pname}-${version}-repository";
+  buildInputs = [ leiningen ];
+
+  postPatch = ''
+    # Hack to set maven cache in another directory since MAVEN_OPTS doesn't work
+    substituteInPlace project.clj \
+      --replace ":main" ":local-repo \"$out\" :main"
+  '';
+
+  buildPhase = ''
+    runHook preBuild
+
+    export LEIN_HOME="$(mktemp -d)"
+    lein with-profiles +native-image deps
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    find $out -type f \
+      -name \*.lastUpdated -or \
+      -name resolver-status.properties -or \
+      -name _remote.repositories \
+      -delete
+
+    runHook postInstall
+  '';
+
+  dontFixup = true;
+  outputHashAlgo = "sha256";
+  outputHashMode = "recursive";
+  outputHash = "sha256-aWZPsJF32ENyYNZCHf5amxVF9pb+5M73JqG/OITZlak=";
+}
diff --git a/pkgs/development/tools/misc/hydra/common.nix b/pkgs/development/tools/misc/hydra/common.nix
index cf56e6c1a9c9..c253bda36b8f 100644
--- a/pkgs/development/tools/misc/hydra/common.nix
+++ b/pkgs/development/tools/misc/hydra/common.nix
@@ -1,7 +1,7 @@
-{ stdenv, nix, perlPackages, buildEnv, fetchFromGitHub
+{ stdenv, nix, perlPackages, buildEnv
 , makeWrapper, autoconf, automake, libtool, unzip, pkg-config, sqlite, libpqxx
 , top-git, mercurial, darcs, subversion, breezy, openssl, bzip2, libxslt
-, guile, perl, postgresql, nukeReferences, git, boehmgc, nlohmann_json
+, perl, postgresql, nukeReferences, git, boehmgc, nlohmann_json
 , docbook_xsl, openssh, gnused, coreutils, findutils, gzip, lzma, gnutar
 , rpm, dpkg, cdrkit, pixz, lib, boost, autoreconfHook, src ? null, version ? null
 , migration ? false, patches ? []
diff --git a/pkgs/development/tools/ocaml/utop/default.nix b/pkgs/development/tools/ocaml/utop/default.nix
index 622ac80306f7..53dd4e9827f1 100644
--- a/pkgs/development/tools/ocaml/utop/default.nix
+++ b/pkgs/development/tools/ocaml/utop/default.nix
@@ -8,13 +8,13 @@ else
 
 buildDunePackage rec {
   pname = "utop";
-  version = "2.6.0";
+  version = "2.7.0";
 
   useDune2 = true;
 
   src = fetchurl {
     url = "https://github.com/ocaml-community/utop/releases/download/${version}/utop-${version}.tbz";
-    sha256 = "17n9igl74xcvj0mzdh2ybda29f2m48a5lj4yf8lrdqr7vg0982jd";
+    sha256 = "sha256-4GisU98mfDzA8vabvCBEBPA2LMTmRyofxUfjJqY8P90=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/development/tools/rust/maturin/default.nix b/pkgs/development/tools/rust/maturin/default.nix
index a4a8870aa10b..02b111567ccd 100644
--- a/pkgs/development/tools/rust/maturin/default.nix
+++ b/pkgs/development/tools/rust/maturin/default.nix
@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "maturin";
-  version = "0.9.3";
+  version = "0.9.4";
 
   src = fetchFromGitHub {
     owner = "PyO3";
     repo = "maturin";
     rev = "v${version}";
-    hash = "sha256-3Tir9jvpSgjyF5tEn3xpPcpSATEnn9yaWIKE8hZIdsM=";
+    hash = "sha256-9emrBajFd0eLHcsd9Uf6MLCWqZFqxmZdWPBLGIYc2kU=";
   };
 
-  cargoHash = "sha256-o0+ZlGnnVUJiTqIdioj+geiP6PWz/AKCXhx+/TgKmqs=";
+  cargoHash = "sha256-poMMEj+zrlU+v5axJbZai2kv36stEKgaciF4zd9A6Qg=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/os-specific/linux/firmware/fwupd/default.nix b/pkgs/os-specific/linux/firmware/fwupd/default.nix
index 2b35d609706b..bfa7783b6b83 100644
--- a/pkgs/os-specific/linux/firmware/fwupd/default.nix
+++ b/pkgs/os-specific/linux/firmware/fwupd/default.nix
@@ -91,6 +91,12 @@ let
 
   self = stdenv.mkDerivation rec {
     pname = "fwupd";
+    # A regression is present in https://github.com/fwupd/fwupd/commit/fde4b1676a2c64e70bebd88f7720307c62635654
+    # released with 1.5.6.
+    # Fix for the regression: https://github.com/fwupd/fwupd/pull/2902
+    # Maintainer says a new release is to be expected in a few days:
+    #   https://twitter.com/hughsient/status/1362476792297185289
+    # In the mean time, please do not release 1.5.6 and go strait to 1.5.7
     version = "1.5.5";
 
     # libfwupd goes to lib
diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix
index 11e318bd1401..24c992dc907d 100644
--- a/pkgs/os-specific/linux/kernel/common-config.nix
+++ b/pkgs/os-specific/linux/kernel/common-config.nix
@@ -95,7 +95,9 @@ let
       BLK_CGROUP_IOCOST = whenAtLeast "5.4" yes;
       IOSCHED_DEADLINE = whenOlder "5.0" yes; # Removed in 5.0-RC1
       MQ_IOSCHED_DEADLINE = whenAtLeast "4.11" yes;
+      BFQ_GROUP_IOSCHED = whenAtLeast "4.12" yes;
       MQ_IOSCHED_KYBER = whenAtLeast "4.12" yes;
+      IOSCHED_BFQ = whenAtLeast "4.12" module;
     };
 
     # Enable NUMA.
@@ -258,6 +260,7 @@ let
       DRM_AMD_DC_DCN2_0 = whenBetween "5.3" "5.6" yes;
       DRM_AMD_DC_DCN2_1 = whenBetween "5.4" "5.6" yes;
       DRM_AMD_DC_DCN3_0 = whenBetween "5.9" "5.11" yes;
+      DRM_AMD_DC_DCN = whenAtLeast "5.11" yes;
       DRM_AMD_DC_HDCP = whenAtLeast "5.5" yes;
       DRM_AMD_DC_SI = whenAtLeast "5.10" yes;
     } // optionalAttrs (stdenv.hostPlatform.system == "x86_64-linux") {
diff --git a/pkgs/servers/openafs/1.8/module.nix b/pkgs/servers/openafs/1.8/module.nix
index 97e20238a7c3..1bb6ee32396b 100644
--- a/pkgs/servers/openafs/1.8/module.nix
+++ b/pkgs/servers/openafs/1.8/module.nix
@@ -19,22 +19,36 @@ in stdenv.mkDerivation {
   buildInputs = [ kerberos ];
 
   patches = [
+    # LINUX 5.8: Replace kernel_setsockopt with new funcs
     (fetchpatch {
       url = "https://github.com/openafs/openafs/commit/d7fc5bf9bf031089d80703c48daf30d5b15a80ca.patch";
       sha256 = "0469ydzgvyvrl1b2s1qbl9cd8c5c1nb99c3z52z5i685da5z6pab";
     })
+    # LINUX 5.8: do not set name field in backing_dev_info
     (fetchpatch {
       url = "https://github.com/openafs/openafs/commit/335f37be13d2ff954e4aeea617ee66502170805e.patch";
       sha256 = "0jr6cgplnip61cjlcd3fvgsc6n3jhfk93mm9m7ak04w1vc26dk9x";
     })
+    # LINUX 5.8: use lru_cache_add
     (fetchpatch {
       url = "https://github.com/openafs/openafs/commit/facff58b840a47853592510617ba7a1da2e3eaa9.patch";
       sha256 = "0izafg6bi5iaigq3jjx0zlg1cxwaddz3238hk0s08fcb6nyhkvx1";
     })
+    # LINUX 5.9: Remove HAVE_UNLOCKED_IOCTL/COMPAT_IOCTL
     (fetchpatch {
       url = "https://github.com/openafs/openafs/commit/e7902252f15acfc28453c531f6fa3b29c9c91b92.patch";
       sha256 = "1jy4v8yx8p6mhma6b3h3g94mb38bw7hg7q6lnyc8bijkbnl0d1rl";
     })
+    # Linux: Refactor test for 32bit compat
+    (fetchpatch {
+      url = "https://github.com/openafs/openafs/commit/4ad1057ab8fd206c9fa8d5e3bdde4f1a8417afdb.patch";
+      sha256 = "0v2537wkav78yi8lv6fkd1n6rf2g17igf44rpa3kd0kkidxv5lqr";
+    })
+    # Linux 5.11: Test 32bit compat with in_compat_syscall
+    (fetchpatch {
+      url = "https://github.com/openafs/openafs/commit/ee53dd3bc087a05e22fc4111297a51ddb30013f0.patch";
+      sha256 = "0dfab3zk0dmf6iksna5n09lf5dn4f8w43q4irl2yf5dgqm35shkr";
+    })
   ];
 
   hardeningDisable = [ "pic" ];
diff --git a/pkgs/tools/X11/xkb-switch/default.nix b/pkgs/tools/X11/xkb-switch/default.nix
index 65426a049fea..e2f15d969edd 100644
--- a/pkgs/tools/X11/xkb-switch/default.nix
+++ b/pkgs/tools/X11/xkb-switch/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "xkb-switch";
-  version = "1.6.0";
+  version = "1.8.5";
 
   src = fetchFromGitHub {
     owner = "ierton";
     repo = "xkb-switch";
     rev = version;
-    sha256 = "11yn0y1kx04rqxh0d81b5q7kbyz58pi48bl7hyhlv7p8yndkfg4b";
+    sha256 = "sha256-DZAIL6+D+Hgs+fkJwRaQb9BHrEjAkxiqhOZyrR+Mpuk=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/tools/filesystems/smbnetfs/default.nix b/pkgs/tools/filesystems/smbnetfs/default.nix
index 05d7189fbaac..98f8861699f4 100644
--- a/pkgs/tools/filesystems/smbnetfs/default.nix
+++ b/pkgs/tools/filesystems/smbnetfs/default.nix
@@ -11,10 +11,6 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ pkg-config autoconf ];
   buildInputs = [ fuse samba glib attr libsecret ];
 
-  postPatch = ''
-    substituteInPlace src/function.c --replace "attr/xattr.h" "sys/xattr.h"
-  '';
-
   meta = with lib; {
     description = "A FUSE FS for mounting Samba shares";
     maintainers = with maintainers; [ raskin ];
diff --git a/pkgs/tools/misc/bat-extras/default.nix b/pkgs/tools/misc/bat-extras/default.nix
index 7d3f1dc0a36c..323099f02c67 100644
--- a/pkgs/tools/misc/bat-extras/default.nix
+++ b/pkgs/tools/misc/bat-extras/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, callPackage, fetchFromGitHub, bash, makeWrapper, bat
+{ lib, stdenv, fetchFromGitHub, bash, makeWrapper, bat
 # batdiff, batgrep, and batwatch
 , coreutils
 , less
diff --git a/pkgs/tools/misc/fwup/default.nix b/pkgs/tools/misc/fwup/default.nix
index 4d072e6d2bfa..5d3259c4b6e5 100644
--- a/pkgs/tools/misc/fwup/default.nix
+++ b/pkgs/tools/misc/fwup/default.nix
@@ -1,27 +1,68 @@
-{ stdenv, lib, fetchFromGitHub, autoreconfHook, makeWrapper, pkg-config
-, zlib, lzma, bzip2, mtools, dosfstools, zip, unzip, libconfuse, libsodium
-, libarchive, darwin, coreutils }:
+{ stdenv
+, lib
+, fetchFromGitHub
+, autoreconfHook
+, DiskArbitration
+, pkg-config
+, bzip2
+, libarchive
+, libconfuse
+, libsodium
+, lzma
+, zlib
+, coreutils
+, dosfstools
+, mtools
+, unzip
+, zip
+, which
+, xdelta
+}:
 
 stdenv.mkDerivation rec {
   pname = "fwup";
-  version = "1.5.2";
+  version = "1.8.3";
 
   src = fetchFromGitHub {
     owner = "fhunleth";
     repo = "fwup";
     rev = "v${version}";
-    sha256 = "05sjdlh450hk474a44yr6kz9dzx72jfxpi1krxbd0pdizlmfypsg";
+    sha256 = "sha256-ayfcnIZ7MuBsCy1giwmY2D2C6AukwS+fevmXqGa4c1w=";
   };
 
-  doCheck = true;
-  patches = lib.optional stdenv.isDarwin [ ./fix-testrunner-darwin.patch ];
+  patches = [ ./fix-testrunner-darwin.patch ];
 
-  nativeBuildInputs = [ pkg-config autoreconfHook makeWrapper ];
-  buildInputs = [ zlib lzma bzip2 libconfuse libsodium libarchive ]
+  nativeBuildInputs = [
+    autoreconfHook
+    pkg-config
+  ];
+
+  buildInputs = [
+    bzip2
+    libarchive
+    libconfuse
+    libsodium
+    lzma
+    zlib
+  ]
     ++ lib.optionals stdenv.isDarwin [
-      darwin.apple_sdk.frameworks.DiskArbitration
-    ];
-  propagatedBuildInputs = [ zip unzip mtools dosfstools coreutils ];
+    DiskArbitration
+  ];
+
+  propagatedBuildInputs = [
+    coreutils
+    dosfstools
+    mtools
+    unzip
+    zip
+  ];
+
+  checkInputs = [
+    which
+    xdelta
+  ];
+
+  doCheck = true;
 
   meta = with lib; {
     description = "Configurable embedded Linux firmware update creator and runner";
diff --git a/pkgs/tools/misc/nix-direnv/default.nix b/pkgs/tools/misc/nix-direnv/default.nix
index 6aaf8cc8a523..833f8313f617 100644
--- a/pkgs/tools/misc/nix-direnv/default.nix
+++ b/pkgs/tools/misc/nix-direnv/default.nix
@@ -15,9 +15,8 @@ stdenv.mkDerivation rec {
   # getting sourced, not executed:
   postPatch = ''
     substituteInPlace direnvrc \
-      --replace "grep" "${gnugrep}/bin/grep" \
-      --replace "nix-shell" "${nix}/bin/nix-shell" \
-      --replace "nix-instantiate" "${nix}/bin/nix-instantiate"
+      --replace "\''${NIX_BIN_PREFIX:-}" "\''${NIX_BIN_PREFIX:-${nix}/bin/}" \
+      --replace "grep" "${gnugrep}/bin/grep"
   '';
 
   installPhase = ''
diff --git a/pkgs/tools/misc/parallel/default.nix b/pkgs/tools/misc/parallel/default.nix
index aec80f0ede02..d5aef2f5ffec 100644
--- a/pkgs/tools/misc/parallel/default.nix
+++ b/pkgs/tools/misc/parallel/default.nix
@@ -1,21 +1,14 @@
 { fetchurl, lib, stdenv, perl, makeWrapper, procps, coreutils }:
 
 stdenv.mkDerivation rec {
-  name = "parallel-20200922";
+  pname = "parallel";
+  version = "20210122";
 
   src = fetchurl {
-    url = "mirror://gnu/parallel/${name}.tar.bz2";
-    sha256 = "0wj19kwjk0hwm8bk9yfcf3rpr0314lmjy5xxlvvdqnbbc4ml2418";
+    url = "mirror://gnu/parallel/${pname}-${version}.tar.bz2";
+    sha256 = "1wxkqz6ld1bp0ilvc04vhq99qjay1nl6pbk3qzvp3sjavv9vdwdl";
   };
 
-  patches = [
-    ./fix-max-line-length-allowed.diff
-  ];
-
-  postPatch = ''
-    substituteInPlace src/parallel --subst-var-by coreutils ${coreutils}
-  '';
-
   outputs = [ "out" "man" "doc" ];
 
   nativeBuildInputs = [ makeWrapper ];
@@ -23,7 +16,7 @@ stdenv.mkDerivation rec {
 
   postInstall = ''
     wrapProgram $out/bin/parallel \
-      --prefix PATH : "${lib.makeBinPath [ procps perl ]}"
+      --prefix PATH : "${lib.makeBinPath [ procps perl coreutils ]}"
   '';
 
   doCheck = true;
diff --git a/pkgs/tools/misc/parallel/fix-max-line-length-allowed.diff b/pkgs/tools/misc/parallel/fix-max-line-length-allowed.diff
deleted file mode 100644
index c6d501ecb22a..000000000000
--- a/pkgs/tools/misc/parallel/fix-max-line-length-allowed.diff
+++ /dev/null
@@ -1,17 +0,0 @@
-Correct path to coreutils echo to fix parallel --max-line-length-allowed.
-
-Author: Bjørn Forsman
-
-diff --git a/src/parallel b/src/parallel
-index a047fd94..9fc5f671 100755
---- a/src/parallel
-+++ b/src/parallel
-@@ -11580,7 +11580,7 @@ sub is_acceptable_command_line_length($$) {
- 	$len += length $Global::parallel_env;
-     }
-     # Force using non-built-in command
--    ::qqx("/bin/echo ".${string}x(($len-length "/bin/echo ")/length $string));
-+    ::qqx("@coreutils@/bin/echo ".${string}x(($len-length "@coreutils@/bin/echo ")/length $string));
-     ::debug("init", "$len=$? ");
-     return not $?;
- }
diff --git a/pkgs/tools/security/secretscanner/default.nix b/pkgs/tools/security/secretscanner/default.nix
new file mode 100644
index 000000000000..93d440009f3f
--- /dev/null
+++ b/pkgs/tools/security/secretscanner/default.nix
@@ -0,0 +1,37 @@
+{ lib
+, buildGoModule
+, fetchFromGitHub
+, hyperscan
+, pkg-config
+}:
+
+buildGoModule rec {
+  pname = "secretscanner";
+  version = "20210214-${lib.strings.substring 0 7 rev}";
+  rev = "42a38f9351352bf6240016b5b93d971be35cad46";
+
+  src = fetchFromGitHub {
+    owner = "deepfence";
+    repo = "SecretScanner";
+    inherit rev;
+    sha256 = "0yga71f7bx5a3hj5agr88pd7j8jnxbwqm241fhrvv8ic4sx0mawg";
+  };
+
+  vendorSha256 = "0b7qa83iqnigihgwlqsxi28n7d9h0dk3wx1bqvhn4k01483cipsd";
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [ hyperscan ];
+
+  postInstall = ''
+    mv $out/bin/SecretScanner $out/bin/$pname
+  '';
+
+  meta = with lib; {
+    description = "Tool to find secrets and passwords in container images and file systems";
+    homepage = "https://github.com/deepfence/SecretScanner";
+    license = with licenses; [ mit ];
+    maintainers = with maintainers; [ fab ];
+  };
+}
+
diff --git a/pkgs/tools/text/ripgrep/default.nix b/pkgs/tools/text/ripgrep/default.nix
index 04f0cb59c038..8c9eef9cc3dd 100644
--- a/pkgs/tools/text/ripgrep/default.nix
+++ b/pkgs/tools/text/ripgrep/default.nix
@@ -1,5 +1,4 @@
 { lib, stdenv
-, nixosTests
 , fetchFromGitHub
 , rustPlatform
 , asciidoctor
@@ -43,6 +42,8 @@ rustPlatform.buildRustPackage rec {
     echo "abc\nbcd\ncde" > "$file"
     $out/bin/rg -N 'bcd' "$file"
     $out/bin/rg -N 'cd' "$file"
+  '' + lib.optionalString withPCRE2 ''
+    echo '(a(aa)aa)' | $out/bin/rg -P '\((a*|(?R))*\)'
   '';
 
   meta = with lib; {
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index eeb85e3a105e..63c01f8e8c45 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -2352,7 +2352,9 @@ in
 
   qt-video-wlr = libsForQt5.callPackage ../applications/misc/qt-video-wlr { };
 
-  fwup = callPackage ../tools/misc/fwup { };
+  fwup = callPackage ../tools/misc/fwup {
+    inherit (darwin.apple_sdk.frameworks) DiskArbitration;
+  };
 
   fx_cast_bridge = callPackage ../tools/misc/fx_cast { };
 
@@ -10019,7 +10021,7 @@ in
     profiledCompiler = false;
   });
 
-  libgccjit = gcc9.cc.override {
+  libgccjit = gcc.cc.override {
     name = "libgccjit";
     langFortran = false;
     langCC = false;
@@ -13785,6 +13787,8 @@ in
 
   ganv = callPackage ../development/libraries/ganv { };
 
+  garble = callPackage ../build-support/go/garble.nix { };
+
   gcab = callPackage ../development/libraries/gcab { };
 
   gcovr = with python3Packages; toPythonApplication gcovr;
@@ -23581,6 +23585,8 @@ in
 
   mblaze = callPackage ../applications/networking/mailreaders/mblaze { };
 
+  mbrola = callPackage ../applications/audio/mbrola { };
+
   mcomix3 = callPackage ../applications/graphics/mcomix3 {};
 
   mcpp = callPackage ../development/compilers/mcpp { };
@@ -24862,6 +24868,8 @@ in
 
   seafile-client = libsForQt5.callPackage ../applications/networking/seafile-client { };
 
+  secretscanner = callPackage ../tools/security/secretscanner { };
+
   sent = callPackage ../applications/misc/sent { };
 
   seq24 = callPackage ../applications/audio/seq24 { };