diff --git a/pkgs/applications/editors/emacs/generic.nix b/pkgs/applications/editors/emacs/generic.nix
index 619bde59874c..70e253dd6dfb 100644
--- a/pkgs/applications/editors/emacs/generic.nix
+++ b/pkgs/applications/editors/emacs/generic.nix
@@ -159,10 +159,14 @@ let emacs = stdenv.mkDerivation (lib.optionalAttrs nativeComp {
   '' + lib.optionalString (nativeComp && withNS) ''
     ln -snf $out/lib/emacs/*/native-lisp $out/Applications/Emacs.app/Contents/native-lisp
   '' + lib.optionalString nativeComp ''
-    $out/bin/emacs --batch \
-      -l comp --eval "(mapatoms (lambda (s) \
-                        (when (subr-primitive-p (symbol-function s)) \
-                          (comp-trampoline-compile s))))"
+    echo "Generating native-compiled trampolines..."
+    # precompile trampolines in parallel, but avoid spawning one process per trampoline.
+    # 1000 is a rough lower bound on the number of trampolines compiled.
+    $out/bin/emacs --batch --eval "(mapatoms (lambda (s) \
+      (when (subr-primitive-p (symbol-function s)) (print s))))" \
+      | xargs -n $((1000/NIX_BUILD_CORES + 1)) -P $NIX_BUILD_CORES \
+        $out/bin/emacs --batch -l comp --eval "(while argv \
+          (comp-trampoline-compile (intern (pop argv))))"
     mkdir -p $out/share/emacs/native-lisp
     $out/bin/emacs --batch \
       --eval "(add-to-list 'comp-eln-load-path \"$out/share/emacs/native-lisp\")" \
diff --git a/pkgs/build-support/fetchgit/nix-prefetch-git b/pkgs/build-support/fetchgit/nix-prefetch-git
index a2dad2f698c3..f2df9d9a8693 100755
--- a/pkgs/build-support/fetchgit/nix-prefetch-git
+++ b/pkgs/build-support/fetchgit/nix-prefetch-git
@@ -149,7 +149,19 @@ checkout_hash(){
     fi
 
     clean_git fetch -t ${builder:+--progress} origin || return 1
-    clean_git checkout -b "$branchName" "$hash" || return 1
+
+    local object_type=$(git cat-file -t "$hash")
+    if [[ "$object_type" == "commit" ]]; then
+        clean_git checkout -b "$branchName" "$hash" || return 1
+    elif [[ "$object_type" == "tree" ]]; then
+        clean_git config user.email "nix-prefetch-git@localhost"
+        clean_git config user.name "nix-prefetch-git"
+        local commit_id=$(git commit-tree "$hash" -m "Commit created from tree hash $hash")
+        clean_git checkout -b "$branchName" "$commit_id" || return 1
+    else
+        echo "Unrecognized git object type: $object_type"
+        return 1
+    fi
 }
 
 # Fetch only a branch/tag and checkout it.
diff --git a/pkgs/build-support/go/garble.nix b/pkgs/build-support/go/garble.nix
index 27277d1b9925..da1e3152ba4c 100644
--- a/pkgs/build-support/go/garble.nix
+++ b/pkgs/build-support/go/garble.nix
@@ -1,4 +1,5 @@
-{ buildGoModule
+{ stdenv
+, buildGoModule
 , fetchFromGitHub
 , lib
 }:
@@ -15,6 +16,15 @@ buildGoModule rec {
 
   vendorSha256 = "sha256-x2fk2QmZDK2yjyfYdK7x+sQjvt7tuggmm8ieVjsNKek=";
 
+  preBuild = ''
+    # https://github.com/burrowers/garble/issues/184
+    substituteInPlace testdata/scripts/tiny.txt \
+      --replace "{6,8}" "{4,8}"
+  '' + lib.optionalString (!stdenv.isx86_64) ''
+    # The test assumex amd64 assembly
+    rm testdata/scripts/asm.txt
+  '';
+
   meta = {
     description = "Obfuscate Go code by wrapping the Go toolchain";
     homepage = "https://github.com/burrowers/garble/";
diff --git a/pkgs/development/interpreters/python/cpython/3.7/find_library.patch b/pkgs/development/interpreters/python/cpython/3.6/find_library.patch
similarity index 100%
rename from pkgs/development/interpreters/python/cpython/3.7/find_library.patch
rename to pkgs/development/interpreters/python/cpython/3.6/find_library.patch
diff --git a/pkgs/development/interpreters/python/cpython/3.7/no-ldconfig.patch b/pkgs/development/interpreters/python/cpython/3.7/no-ldconfig.patch
index a1f9d68eb166..4324fc5ea61f 100644
--- a/pkgs/development/interpreters/python/cpython/3.7/no-ldconfig.patch
+++ b/pkgs/development/interpreters/python/cpython/3.7/no-ldconfig.patch
@@ -1,18 +1,18 @@
-From 597e73f2a4b2f0b508127931b36d5540d6941823 Mon Sep 17 00:00:00 2001
+From ba458f33f335b217d078fdce56e9c6f9f93adb49 Mon Sep 17 00:00:00 2001
 From: Frederik Rietdijk <fridh@fridh.nl>
 Date: Mon, 28 Aug 2017 09:24:06 +0200
 Subject: [PATCH] Don't use ldconfig
 
 ---
- Lib/ctypes/util.py | 70 ++----------------------------------------------------
- 1 file changed, 2 insertions(+), 68 deletions(-)
+ Lib/ctypes/util.py | 78 ++--------------------------------------------
+ 1 file changed, 2 insertions(+), 76 deletions(-)
 
 diff --git a/Lib/ctypes/util.py b/Lib/ctypes/util.py
-index 5e8b31a854..7b45ce6c15 100644
+index 0c2510e..79635a8 100644
 --- a/Lib/ctypes/util.py
 +++ b/Lib/ctypes/util.py
-@@ -94,46 +94,7 @@ elif os.name == "posix":
-     import re, tempfile
+@@ -100,54 +100,7 @@ elif os.name == "posix":
+             return thefile.read(4) == elf_header
  
      def _findLib_gcc(name):
 -        # Run GCC's linker with the -t (aka --trace) option and examine the
@@ -51,15 +51,23 @@ index 5e8b31a854..7b45ce6c15 100644
 -                # Raised if the file was already removed, which is the normal
 -                # behaviour of GCC if linking fails
 -                pass
--        res = re.search(expr, trace)
+-        res = re.findall(expr, trace)
 -        if not res:
 -            return None
--        return os.fsdecode(res.group(0))
+-
+-        for file in res:
+-            # Check if the given file is an elf file: gcc can report
+-            # some files that are linker scripts and not actual
+-            # shared objects. See bpo-41976 for more details
+-            if not _is_elf(file):
+-                continue
+-            return os.fsdecode(file)
+-
 +        return None
  
- 
      if sys.platform == "sunos5":
-@@ -255,34 +216,7 @@ elif os.name == "posix":
+         # use /usr/ccs/bin/dump on solaris
+@@ -268,34 +221,7 @@ elif os.name == "posix":
      else:
  
          def _findSoname_ldconfig(name):
@@ -96,5 +104,5 @@ index 5e8b31a854..7b45ce6c15 100644
          def _findLib_ld(name):
              # See issue #9998 for why this is needed
 -- 
-2.15.0
+2.30.0
 
diff --git a/pkgs/development/interpreters/python/cpython/default.nix b/pkgs/development/interpreters/python/cpython/default.nix
index 7bc6084f61dd..1ae8d19ac58e 100644
--- a/pkgs/development/interpreters/python/cpython/default.nix
+++ b/pkgs/development/interpreters/python/cpython/default.nix
@@ -222,9 +222,9 @@ in with passthru; stdenv.mkDerivation {
       else
         ./3.7/fix-finding-headers-when-cross-compiling.patch
     )
-  ] ++ optionals (isPy36 || isPy37) [
+  ] ++ optionals (isPy36) [
     # Backport a fix for ctypes.util.find_library.
-    ./3.7/find_library.patch
+    ./3.6/find_library.patch
   ];
 
   postPatch = ''
diff --git a/pkgs/development/interpreters/python/pypy/prebuilt.nix b/pkgs/development/interpreters/python/pypy/prebuilt.nix
index f301fd15f09c..460af1cc67b4 100644
--- a/pkgs/development/interpreters/python/pypy/prebuilt.nix
+++ b/pkgs/development/interpreters/python/pypy/prebuilt.nix
@@ -1,4 +1,5 @@
-{ stdenv
+{ lib
+, stdenv
 , fetchurl
 , python-setup-hook
 , self
@@ -31,9 +32,15 @@ let
     implementation = "pypy";
     libPrefix = "pypy${pythonVersion}";
     executable = "pypy${if isPy3k then "3" else ""}";
-    pythonForBuild = self; # Not possible to cross-compile with.
     sitePackages = "site-packages";
     hasDistutilsCxxPatch = false;
+
+    # Not possible to cross-compile with.
+    pythonOnBuildForBuild = throw "${pname} does not support cross compilation";
+    pythonOnBuildForHost = self;
+    pythonOnBuildForTarget = throw "${pname} does not support cross compilation";
+    pythonOnHostForHost = throw "${pname} does not support cross compilation";
+    pythonOnTargetForTarget = throw "${pname} does not support cross compilation";
   };
   pname = "${passthru.executable}_prebuilt";
   version = with sourceVersion; "${major}.${minor}.${patch}";
diff --git a/pkgs/development/python-modules/numba/default.nix b/pkgs/development/python-modules/numba/default.nix
index aa08ead2d971..3f67c044deab 100644
--- a/pkgs/development/python-modules/numba/default.nix
+++ b/pkgs/development/python-modules/numba/default.nix
@@ -4,12 +4,9 @@
 , fetchPypi
 , python
 , buildPythonPackage
-, isPy27
-, isPy3k
 , numpy
 , llvmlite
-, funcsigs
-, singledispatch
+, setuptools
 , libcxx
 }:
 
@@ -26,9 +23,8 @@ buildPythonPackage rec {
 
   NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isDarwin "-I${libcxx}/include/c++/v1";
 
-  propagatedBuildInputs = [numpy llvmlite]
-    ++ lib.optionals isPy27 [ funcsigs singledispatch];
-
+  propagatedBuildInputs = [ numpy llvmlite setuptools ];
+  pythonImportsCheck = [ "numba" ];
   # Copy test script into $out and run the test suite.
   checkPhase = ''
     ${python.interpreter} -m numba.runtests
diff --git a/pkgs/development/python-modules/numpy-stl/default.nix b/pkgs/development/python-modules/numpy-stl/default.nix
index cb43084556e8..2176b5f94979 100644
--- a/pkgs/development/python-modules/numpy-stl/default.nix
+++ b/pkgs/development/python-modules/numpy-stl/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "numpy-stl";
-  version = "2.13.0";
+  version = "2.15.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "648386e6cdad3218adc4e3e6a349bee41c55a61980dace616c05d6a31e8c652d";
+    sha256 = "f57fdb3c0e420f729dbe54ec3add9bdbbd19b62183aa8f4576e00e5834b2ef52";
   };
 
   checkInputs = [ pytest pytestrunner ];
diff --git a/pkgs/development/python-modules/pypcap/default.nix b/pkgs/development/python-modules/pypcap/default.nix
index 08c90d828986..fbf6769ab4ca 100644
--- a/pkgs/development/python-modules/pypcap/default.nix
+++ b/pkgs/development/python-modules/pypcap/default.nix
@@ -1,34 +1,50 @@
-{ lib, writeText, buildPythonPackage, fetchPypi, libpcap, dpkt }:
+{ lib
+, buildPythonPackage
+, dpkt
+, fetchFromGitHub
+, fetchpatch
+, libpcap
+, pytestCheckHook
+}:
 
 buildPythonPackage rec {
   pname = "pypcap";
   version = "1.2.3";
 
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "1w5i79gh7cswvznr8rhilcmzhnh2y5c4jwh2qrfnpx05zqigm1xd";
+
+  src = fetchFromGitHub {
+    owner = "pynetwork";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "1zscfk10jpqwxgc8d84y8bffiwr92qrg2b24afhjwiyr352l67cf";
   };
 
   patches = [
-    # The default setup.py searchs for pcap.h in a static list of default
-    # folders. So we have to add the path to libpcap in the nix-store.
-    (writeText "libpcap-path.patch"
-      ''
-      --- a/setup.py
-      +++ b/setup.py
-      @@ -28,6 +28,7 @@ def recursive_search(path, target_files):
-
-       def find_prefix_and_pcap_h():
-           prefixes = chain.from_iterable((
-      +        '${libpcap}',
-               ('/usr', sys.prefix),
-               glob.glob('/opt/libpcap*'),
-               glob.glob('../libpcap*'),
-      '')
+    # Support for Python 3.9, https://github.com/pynetwork/pypcap/pull/102
+    (fetchpatch {
+      name = "support-python-3.9.patch";
+      url = "https://github.com/pynetwork/pypcap/pull/102/commits/e22f5d25f0d581d19ef337493434e72cd3a6ae71.patch";
+      sha256 = "0n1syh1vcplgsf6njincpqphd2w030s3b2jyg86d7kbqv1w5wk0l";
+    })
   ];
 
+  postPatch = ''
+    # Add the path to libpcap in the nix-store
+    substituteInPlace setup.py --replace "('/usr', sys.prefix)" "'${libpcap}'"
+    # Remove coverage from test run
+    sed -i "/--cov/d" setup.cfg
+  '';
+
   buildInputs = [ libpcap ];
-  checkInputs = [ dpkt ];
+
+  checkInputs = [
+    dpkt
+    pytestCheckHook
+  ];
+
+  pytestFlagsArray = [ "tests" ];
+
+  pythonImportsCheck = [ "pcap" ];
 
   meta = with lib; {
     homepage = "https://github.com/pynetwork/pypcap";
diff --git a/pkgs/servers/keycloak/default.nix b/pkgs/servers/keycloak/default.nix
index 468904b3f0d0..aaa2a2f2b5c8 100644
--- a/pkgs/servers/keycloak/default.nix
+++ b/pkgs/servers/keycloak/default.nix
@@ -18,11 +18,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname   = "keycloak";
-  version = "12.0.2";
+  version = "12.0.3";
 
   src = fetchzip {
     url    = "https://github.com/keycloak/keycloak/releases/download/${version}/keycloak-${version}.zip";
-    sha256 = "006k6ac00iz61s6hi3wzj6w71mhhv7n00vh82ak4yhwr97jffqbz";
+    sha256 = "sha256-YUeSX02iLhrGzItnbUbK8ib7IfWG3+2k154cTPAt8Wc=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/tools/system/netdata/default.nix b/pkgs/tools/system/netdata/default.nix
index e727734be6d0..6fd15d3d20d7 100644
--- a/pkgs/tools/system/netdata/default.nix
+++ b/pkgs/tools/system/netdata/default.nix
@@ -15,14 +15,14 @@ with lib;
 let
   go-d-plugin = callPackage ./go.d.plugin.nix {};
 in stdenv.mkDerivation rec {
-  version = "1.29.1";
+  version = "1.29.2";
   pname = "netdata";
 
   src = fetchFromGitHub {
     owner = "netdata";
     repo = "netdata";
     rev = "v${version}";
-    sha256 = "sha256-Wmfqxjy0kCy8vsegoe+Jn5Az/XEZxeHZDRMLmOrp+Iw=";
+    sha256 = "sha256-Y949jHIX3VOwaxeaBqqTZUx66Sd0s27kMCCjcnJORO4=";
   };
 
   nativeBuildInputs = [ autoreconfHook pkg-config ];
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index d77b084f777c..d3424ad39306 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -13797,7 +13797,10 @@ in
 
   ganv = callPackage ../development/libraries/ganv { };
 
-  garble = callPackage ../build-support/go/garble.nix { };
+  garble = callPackage ../build-support/go/garble.nix {
+    # https://github.com/burrowers/garble/issues/124
+    buildGoModule = buildGo115Module;
+  };
 
   gcab = callPackage ../development/libraries/gcab { };