diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index e3a0e4beee2a..0fa804c1f9c1 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -8531,6 +8531,12 @@
     githubId = 638763;
     name = "Stuart Moss";
   };
+  stunkymonkey = {
+    email = "account@buehler.rocks";
+    github = "Stunkymonkey";
+    githubId = 1315818;
+    name = "Felix Bühler";
+  };
   suhr = {
     email = "suhr@i2pmail.org";
     github = "suhr";
diff --git a/nixos/modules/services/web-apps/grocy.nix b/nixos/modules/services/web-apps/grocy.nix
index 568bdfd0c429..be2de638dd96 100644
--- a/nixos/modules/services/web-apps/grocy.nix
+++ b/nixos/modules/services/web-apps/grocy.nix
@@ -115,9 +115,9 @@ in {
       user = "grocy";
       group = "nginx";
 
-      # PHP 7.3 is the only version which is supported/tested by upstream:
-      # https://github.com/grocy/grocy/blob/v2.6.0/README.md#how-to-install
-      phpPackage = pkgs.php73;
+      # PHP 7.4 is the only version which is supported/tested by upstream:
+      # https://github.com/grocy/grocy/blob/v3.0.0/README.md#how-to-install
+      phpPackage = pkgs.php74;
 
       inherit (cfg.phpfpm) settings;
 
diff --git a/nixos/release-combined.nix b/nixos/release-combined.nix
index 5f8a64702a82..ea82adf09ad1 100644
--- a/nixos/release-combined.nix
+++ b/nixos/release-combined.nix
@@ -145,6 +145,7 @@ in rec {
         (onFullSupported "nixos.tests.printing")
         (onFullSupported "nixos.tests.proxy")
         (onFullSupported "nixos.tests.sddm.default")
+        (onFullSupported "nixos.tests.shadow")
         (onFullSupported "nixos.tests.simple")
         (onFullSupported "nixos.tests.switchTest")
         (onFullSupported "nixos.tests.udisks2")
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 306aca79d13c..659e538b31d0 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -324,6 +324,7 @@ in
   redis = handleTest ./redis.nix {};
   redmine = handleTest ./redmine.nix {};
   restic = handleTest ./restic.nix {};
+  ripgrep = handleTest ./ripgrep.nix {};
   robustirc-bridge = handleTest ./robustirc-bridge.nix {};
   roundcube = handleTest ./roundcube.nix {};
   rspamd = handleTest ./rspamd.nix {};
@@ -339,6 +340,7 @@ in
   scala = handleTest ./scala.nix {};
   sddm = handleTest ./sddm.nix {};
   service-runner = handleTest ./service-runner.nix {};
+  shadow = handleTest ./shadow.nix {};
   shadowsocks = handleTest ./shadowsocks {};
   shattered-pixel-dungeon = handleTest ./shattered-pixel-dungeon.nix {};
   shiori = handleTest ./shiori.nix {};
diff --git a/nixos/tests/ripgrep.nix b/nixos/tests/ripgrep.nix
new file mode 100644
index 000000000000..9f76290488fa
--- /dev/null
+++ b/nixos/tests/ripgrep.nix
@@ -0,0 +1,13 @@
+import ./make-test-python.nix ({ pkgs, ... }: {
+  name = "ripgrep";
+  meta = with pkgs.stdenv.lib.maintainers; { maintainers = [ nequissimus ]; };
+
+  nodes.ripgrep = { pkgs, ... }: { environment.systemPackages = [ pkgs.ripgrep ]; };
+
+  testScript = ''
+    ripgrep.succeed('echo "abc\nbcd\ncde" > /tmp/foo')
+    assert "bcd" in ripgrep.succeed("rg -N 'bcd' /tmp/foo")
+    assert "bcd\ncde" in ripgrep.succeed("rg -N 'cd' /tmp/foo")
+    assert "ripgrep ${pkgs.ripgrep.version}" in ripgrep.succeed("rg --version | head -1")
+  '';
+})
diff --git a/nixos/tests/shadow.nix b/nixos/tests/shadow.nix
new file mode 100644
index 000000000000..e8624fde4cbd
--- /dev/null
+++ b/nixos/tests/shadow.nix
@@ -0,0 +1,98 @@
+let
+  password1 = "foobar";
+  password2 = "helloworld";
+  password3 = "bazqux";
+in import ./make-test-python.nix ({ pkgs, ... }: {
+  name = "shadow";
+  meta = with pkgs.stdenv.lib.maintainers; { maintainers = [ nequissimus ]; };
+
+  nodes.shadow = { pkgs, ... }: {
+    environment.systemPackages = [ pkgs.shadow ];
+
+    users = {
+      mutableUsers = true;
+      users.emma = {
+        password = password1;
+        shell = pkgs.bash;
+      };
+      users.layla = {
+        password = password2;
+        shell = pkgs.shadow;
+      };
+    };
+  };
+
+  testScript = ''
+    shadow.wait_for_unit("multi-user.target")
+    shadow.wait_until_succeeds("pgrep -f 'agetty.*tty1'")
+
+    with subtest("Normal login"):
+        shadow.send_key("alt-f2")
+        shadow.wait_until_succeeds(f"[ $(fgconsole) = 2 ]")
+        shadow.wait_for_unit(f"getty@tty2.service")
+        shadow.wait_until_succeeds(f"pgrep -f 'agetty.*tty2'")
+        shadow.wait_until_tty_matches(2, "login: ")
+        shadow.send_chars("emma\n")
+        shadow.wait_until_tty_matches(2, "login: emma")
+        shadow.wait_until_succeeds("pgrep login")
+        shadow.send_chars("${password1}\n")
+        shadow.send_chars("whoami > /tmp/1\n")
+        shadow.wait_for_file("/tmp/1")
+        assert "emma" in shadow.succeed("cat /tmp/1")
+
+    with subtest("Change password"):
+        shadow.send_key("alt-f3")
+        shadow.wait_until_succeeds(f"[ $(fgconsole) = 3 ]")
+        shadow.wait_for_unit(f"getty@tty3.service")
+        shadow.wait_until_succeeds(f"pgrep -f 'agetty.*tty3'")
+        shadow.wait_until_tty_matches(3, "login: ")
+        shadow.send_chars("emma\n")
+        shadow.wait_until_tty_matches(3, "login: emma")
+        shadow.wait_until_succeeds("pgrep login")
+        shadow.send_chars("${password1}\n")
+        shadow.send_chars("passwd\n")
+        shadow.sleep(2)
+        shadow.send_chars("${password1}\n")
+        shadow.sleep(2)
+        shadow.send_chars("${password3}\n")
+        shadow.sleep(2)
+        shadow.send_chars("${password3}\n")
+        shadow.sleep(2)
+        shadow.send_key("alt-f4")
+        shadow.wait_until_succeeds(f"[ $(fgconsole) = 4 ]")
+        shadow.wait_for_unit(f"getty@tty4.service")
+        shadow.wait_until_succeeds(f"pgrep -f 'agetty.*tty4'")
+        shadow.wait_until_tty_matches(4, "login: ")
+        shadow.send_chars("emma\n")
+        shadow.wait_until_tty_matches(4, "login: emma")
+        shadow.wait_until_succeeds("pgrep login")
+        shadow.send_chars("${password1}\n")
+        shadow.wait_until_tty_matches(4, "Login incorrect")
+        shadow.wait_until_tty_matches(4, "login:")
+        shadow.send_chars("emma\n")
+        shadow.wait_until_tty_matches(4, "login: emma")
+        shadow.wait_until_succeeds("pgrep login")
+        shadow.send_chars("${password3}\n")
+        shadow.send_chars("whoami > /tmp/2\n")
+        shadow.wait_for_file("/tmp/2")
+        assert "emma" in shadow.succeed("cat /tmp/2")
+
+    with subtest("Groups"):
+        assert "foobar" not in shadow.succeed("groups emma")
+        shadow.succeed("groupadd foobar")
+        shadow.succeed("usermod -a -G foobar emma")
+        assert "foobar" in shadow.succeed("groups emma")
+
+    with subtest("nologin shell"):
+        shadow.send_key("alt-f5")
+        shadow.wait_until_succeeds(f"[ $(fgconsole) = 5 ]")
+        shadow.wait_for_unit(f"getty@tty5.service")
+        shadow.wait_until_succeeds(f"pgrep -f 'agetty.*tty5'")
+        shadow.wait_until_tty_matches(5, "login: ")
+        shadow.send_chars("layla\n")
+        shadow.wait_until_tty_matches(5, "login: layla")
+        shadow.wait_until_succeeds("pgrep login")
+        shadow.send_chars("${password2}\n")
+        shadow.wait_until_tty_matches(5, "login:")
+  '';
+})
diff --git a/pkgs/applications/misc/mediaelch/default.nix b/pkgs/applications/misc/mediaelch/default.nix
new file mode 100644
index 000000000000..c4ed0c975eab
--- /dev/null
+++ b/pkgs/applications/misc/mediaelch/default.nix
@@ -0,0 +1,41 @@
+{ stdenv
+, mkDerivation
+, fetchFromGitHub
+, qmake
+, curl
+, ffmpeg
+, libmediainfo
+, libzen
+, qtbase
+, qtdeclarative
+, qtmultimedia
+}:
+
+mkDerivation rec {
+  pname = "mediaelch";
+  version = "2.8.2";
+
+  src = fetchFromGitHub {
+    owner = "Komet";
+    repo = "MediaElch";
+    rev = "v${version}";
+    sha256 = "0y26vfgrdym461lzmm5x3z5ai9ky09vlk3cy4sq6hwlj7mzcz0k7";
+    fetchSubmodules = true;
+  };
+
+  nativeBuildInputs = [ qmake ];
+
+  buildInputs = [ curl libmediainfo libzen ffmpeg qtbase qtdeclarative qtmultimedia ];
+
+  prePatch = ''
+    substituteInPlace MediaElch.pro --replace "/usr" "$out"
+  '';
+
+  meta = with stdenv.lib; {
+    homepage = "https://mediaelch.de/mediaelch/";
+    description = "Media Manager for Kodi";
+    license = licenses.lgpl3Only;
+    maintainers = with maintainers; [ stunkymonkey ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/applications/networking/instant-messengers/telegram/tdesktop/default.nix b/pkgs/applications/networking/instant-messengers/telegram/tdesktop/default.nix
index 6518f73a2299..d4cc5293a9be 100644
--- a/pkgs/applications/networking/instant-messengers/telegram/tdesktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/telegram/tdesktop/default.nix
@@ -22,12 +22,12 @@ let
 
 in mkDerivation rec {
   pname = "telegram-desktop";
-  version = "2.4.7";
+  version = "2.5.1";
 
   # Telegram-Desktop with submodules
   src = fetchurl {
     url = "https://github.com/telegramdesktop/tdesktop/releases/download/v${version}/tdesktop-${version}-full.tar.gz";
-    sha256 = "1j2v29952l0am357pqvvgzm2zghmwhlr833kgp85hssxpr9xy4vv";
+    sha256 = "1qpap599h2c4hlmr00k82r6138ym4zqrbfpvm97gm97adn3mxk7i";
   };
 
   postPatch = ''
@@ -80,9 +80,6 @@ in mkDerivation rec {
   # TODO: Package mapbox-variant
 
   postFixup = ''
-    # Nuke refs to `tg_owt` which is introduced by `__FILE__` in headers.
-    remove-references-to -t ${tg_owt} $out/bin/telegram-desktop
-
     # This is necessary to run Telegram in a pure environment.
     # We also use gappsWrapperArgs from wrapGAppsHook.
     wrapProgram $out/bin/telegram-desktop \
diff --git a/pkgs/applications/networking/instant-messengers/telegram/tdesktop/tg_owt.nix b/pkgs/applications/networking/instant-messengers/telegram/tdesktop/tg_owt.nix
index 48499bf9f2c7..2853418da0e3 100644
--- a/pkgs/applications/networking/instant-messengers/telegram/tdesktop/tg_owt.nix
+++ b/pkgs/applications/networking/instant-messengers/telegram/tdesktop/tg_owt.nix
@@ -1,10 +1,10 @@
-{ lib, stdenv, fetchFromGitHub, cmake, ninja, yasm
-, pkg-config, libjpeg, openssl, libopus, ffmpeg, alsaLib, libpulseaudio
+{ lib, stdenv, fetchFromGitHub, pkg-config, cmake, ninja, yasm
+, libjpeg, openssl, libopus, ffmpeg, alsaLib, libpulseaudio, protobuf
 }:
 
 let
-  rev = "e8fcae73947445db3d418fb7c20b964b59e14706";
-  sha256 = "0s2dd41r71aixhvympiqfks1liv7x78y60n0i87vmyxyfx449b5h";
+  rev = "6eaebec41b34a0a0d98f02892d0cfe6bbcbc0a39";
+  sha256 = "0dbc36j09jmxvznal55hi3qrfyvj4y0ila6347nav9skcmk8fm64";
 
 in stdenv.mkDerivation {
   pname = "tg_owt";
@@ -14,11 +14,16 @@ in stdenv.mkDerivation {
     owner = "desktop-app";
     repo = "tg_owt";
     inherit rev sha256;
+    fetchSubmodules = true;
   };
 
+  outputs = [ "out" "dev" ];
+
   nativeBuildInputs = [ pkg-config cmake ninja yasm ];
 
-  buildInputs = [ libjpeg openssl libopus ffmpeg alsaLib libpulseaudio ];
+  buildInputs = [
+    libjpeg openssl libopus ffmpeg alsaLib libpulseaudio protobuf
+  ];
 
   meta.license = lib.licenses.bsd3;
 }
diff --git a/pkgs/applications/version-management/git-and-tools/delta/default.nix b/pkgs/applications/version-management/git-and-tools/delta/default.nix
index f667a7b6d8c1..0fa30651170a 100644
--- a/pkgs/applications/version-management/git-and-tools/delta/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/delta/default.nix
@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "delta";
-  version = "0.4.4";
+  version = "0.4.5";
 
   src = fetchFromGitHub {
     owner = "dandavison";
     repo = pname;
     rev = version;
-    sha256 = "1ng22g9h1l1v2yav8zh6w4nn6ifv8sfz8566m8155d0cza2iimw6";
+    sha256 = "0rh902h76pn7ja5zizlfklmwcyyki4b0v4irw1j40cjjnah75ljp";
   };
 
-  cargoSha256 = "0b3qv1ksk8fmpawih2qrz29wlpj1gvq9hw4yqm7hdk6awl5h8lvv";
+  cargoSha256 = "1rniihx1rb18n2bp4b2yhn4ayih5cbcyqmiv6jckas7jwrgk6wra";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/development/python-modules/JPype1/default.nix b/pkgs/development/python-modules/JPype1/default.nix
index 11ac2b7599b2..1a58562ab06d 100644
--- a/pkgs/development/python-modules/JPype1/default.nix
+++ b/pkgs/development/python-modules/JPype1/default.nix
@@ -9,12 +9,12 @@
 
 buildPythonPackage rec {
   pname = "JPype1";
-  version = "1.1.2";
+  version = "1.2.0";
   disabled = isPy27;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "c6e36de9f7ef826ff27f6d5260acc710ebc585a534c12cbac905db088ab1d992";
+    sha256 = "62ca03e7f7963ba4ac1065ee48ff661f752b3db3c23549ed8933ab40196a3157";
   };
 
   propagatedBuildInputs = lib.optionals (pythonOlder "3.8") [
diff --git a/pkgs/development/python-modules/azure-mgmt-synapse/default.nix b/pkgs/development/python-modules/azure-mgmt-synapse/default.nix
index 2135853ff9de..22b6281fa769 100644
--- a/pkgs/development/python-modules/azure-mgmt-synapse/default.nix
+++ b/pkgs/development/python-modules/azure-mgmt-synapse/default.nix
@@ -6,12 +6,12 @@
 
 buildPythonPackage rec {
   pname = "azure-mgmt-synapse";
-  version = "0.5.0";
+  version = "0.6.0";
   disabled = pythonOlder "3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "4eb76230c38525b71eb1addefebd265bc3d9b68ba7ff60ce5356d39f68ed2837";
+    sha256 = "f81cb52b220774aab93ffcf25bdc17e03fd84b6916836640789f86fbf636b984";
     extension = "zip";
   };
 
diff --git a/pkgs/development/python-modules/boto3/default.nix b/pkgs/development/python-modules/boto3/default.nix
index d79fc6ec09d2..a04f5d042946 100644
--- a/pkgs/development/python-modules/boto3/default.nix
+++ b/pkgs/development/python-modules/boto3/default.nix
@@ -13,11 +13,11 @@
 
 buildPythonPackage rec {
   pname =  "boto3";
-  version = "1.16.41"; # N.B: if you change this, change botocore too
+  version = "1.16.42"; # N.B: if you change this, change botocore too
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-DYTobuAuMshtMONd6WgDA6SAhz3S6Z3NyDSGuS3/sDw=";
+    sha256 = "sha256-ko5z9R9xRpobDOrR+7N/MERX7FRACDPALAwyjmRYH+o=";
   };
 
   propagatedBuildInputs = [ botocore jmespath s3transfer ] ++ lib.optionals (!isPy3k) [ futures ];
diff --git a/pkgs/development/python-modules/botocore/default.nix b/pkgs/development/python-modules/botocore/default.nix
index 2d00011526a8..c23804c7cb89 100644
--- a/pkgs/development/python-modules/botocore/default.nix
+++ b/pkgs/development/python-modules/botocore/default.nix
@@ -12,11 +12,11 @@
 
 buildPythonPackage rec {
   pname = "botocore";
-  version = "1.19.41"; # N.B: if you change this, change boto3 and awscli to a matching version
+  version = "1.19.42"; # N.B: if you change this, change boto3 and awscli to a matching version
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-VKillJeoO6LYn7lPht0HtiLXtfHW6ZJSIuu8ResNY6w=";
+    sha256 = "sha256-8LBx/Qj01y17osVH2lKavr4FJwXBWVvm0SohUadaYCk=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/breathe/default.nix b/pkgs/development/python-modules/breathe/default.nix
index 729b9f9f24a5..e283c9ee6bed 100644
--- a/pkgs/development/python-modules/breathe/default.nix
+++ b/pkgs/development/python-modules/breathe/default.nix
@@ -1,13 +1,13 @@
 { lib, fetchPypi, buildPythonPackage, docutils, six, sphinx, isPy3k, isPy27 }:
 
 buildPythonPackage rec {
-  version = "4.24.1";
+  version = "4.25.1";
   pname = "breathe";
   disabled = isPy27;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "d8e47ba4b975f3228a13daf481762f784f87d1e6e87a01619360d59e558d2fc0";
+    sha256 = "bf81658ed31f8f586247d203923479fcde6c3797d376c804bdafa7e56ffd43b5";
   };
 
   propagatedBuildInputs = [ docutils six sphinx ];
diff --git a/pkgs/development/python-modules/bumps/default.nix b/pkgs/development/python-modules/bumps/default.nix
index 37ddae150363..e2938e0f32e2 100644
--- a/pkgs/development/python-modules/bumps/default.nix
+++ b/pkgs/development/python-modules/bumps/default.nix
@@ -2,7 +2,7 @@
 
 buildPythonPackage rec {
   pname = "bumps";
-  version = "0.7.18";
+  version = "0.8.0";
 
   propagatedBuildInputs = [six];
 
@@ -12,7 +12,7 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "3217d4fd3ec767448d742f3b6ff527cc3817f2421b9a9a8456e1d8ee4a9b1087";
+    sha256 = "9f92c05effd8175763799d19ca55592e89b053318f611148a6725159aea41d67";
   };
 
   meta = with stdenv.lib; {
diff --git a/pkgs/development/python-modules/clickhouse-driver/default.nix b/pkgs/development/python-modules/clickhouse-driver/default.nix
index 9cb88b5cbc9b..a1addcfc97ab 100644
--- a/pkgs/development/python-modules/clickhouse-driver/default.nix
+++ b/pkgs/development/python-modules/clickhouse-driver/default.nix
@@ -14,11 +14,11 @@
 
 buildPythonPackage rec {
   pname = "clickhouse-driver";
-  version = "0.1.5";
+  version = "0.2.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1827cm5z2zd6mxn9alq54bbzw6vhz4a30a54vacqn7nz691qs1gd";
+    sha256 = "62d37f93872d5a13eb6b0d52bab2b593ed0e14cf9200949aa2d02f9801064c0f";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/django-storages/default.nix b/pkgs/development/python-modules/django-storages/default.nix
index c0467bbba705..e3e48bda68b9 100644
--- a/pkgs/development/python-modules/django-storages/default.nix
+++ b/pkgs/development/python-modules/django-storages/default.nix
@@ -4,11 +4,11 @@
 
 buildPythonPackage rec {
   pname = "django-storages";
-  version = "1.10.1";
+  version = "1.11";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "652275ab7844538c462b62810276c0244866f345878256a9e0e86f5b1283ae18";
+    sha256 = "7af56611c62a1c174aab4e862efb7fdd98296dccf76f42135f5b6851fc313c97";
   };
 
   propagatedBuildInputs = [ django ];
diff --git a/pkgs/development/tools/build-managers/leiningen/default.nix b/pkgs/development/tools/build-managers/leiningen/default.nix
index 713f499ce2b2..f1445970f6a7 100644
--- a/pkgs/development/tools/build-managers/leiningen/default.nix
+++ b/pkgs/development/tools/build-managers/leiningen/default.nix
@@ -3,17 +3,17 @@
 
 stdenv.mkDerivation rec {
   pname = "leiningen";
-  version = "2.9.1";
+  version = "2.9.5";
 
   src = fetchurl {
     url = "https://raw.github.com/technomancy/leiningen/${version}/bin/lein-pkg";
-    sha256 = "1h0gpzpr7xk6hvmrrq41bcp2k9aai348baf8ad9bxvci01n4zb12";
+    sha256 = "12kv3286a2vkm3qpm2msiks87mkspxddgl7bwiacdias9dfda09n";
   };
 
   jarsrc = fetchurl {
     # NOTE: This is actually a .jar, Github has issues
     url = "https://github.com/technomancy/leiningen/releases/download/${version}/${pname}-${version}-standalone.zip";
-    sha256 = "1y2mva5s2w2szzn1b9rhz0dvkffls4ravii677ybcf2w9wd86z7a";
+    sha256 = "1shyvg1471sc3bv4h3ax51626xw8a8w05f43bny6gmp8pyc0qjfz";
   };
 
   JARNAME = "${pname}-${version}-standalone.jar";
@@ -48,5 +48,6 @@ stdenv.mkDerivation rec {
     description = "Project automation for Clojure";
     license = stdenv.lib.licenses.epl10;
     platforms = stdenv.lib.platforms.linux ++ stdenv.lib.platforms.darwin;
+    maintainers = with stdenv.lib.maintainers; [ thiagokokada ];
   };
 }
diff --git a/pkgs/development/web/nodejs/v15.nix b/pkgs/development/web/nodejs/v15.nix
index 06cb48260cdb..3569ad3a1024 100644
--- a/pkgs/development/web/nodejs/v15.nix
+++ b/pkgs/development/web/nodejs/v15.nix
@@ -8,6 +8,6 @@ let
 in
   buildNodejs {
     inherit enableNpm;
-    version = "15.4.0";
-    sha256 = "0kp0hckhjkmaqyvjpcj17rj6fw9fg3c95j78r2nr10bc65anjwms";
+    version = "15.5.0";
+    sha256 = "1wzcypb1kawc6m5q36cd31qjg7ljby8py9qg555m4bqm5gpvvfjg";
   }
diff --git a/pkgs/os-specific/linux/shadow/default.nix b/pkgs/os-specific/linux/shadow/default.nix
index 7399ac90586c..59cc59d7714d 100644
--- a/pkgs/os-specific/linux/shadow/default.nix
+++ b/pkgs/os-specific/linux/shadow/default.nix
@@ -1,5 +1,5 @@
-{ stdenv, fetchpatch, fetchFromGitHub, autoreconfHook, libxslt, libxml2
-, docbook_xml_dtd_45, docbook_xsl, itstool, flex, bison
+{ stdenv, nixosTests, fetchpatch, fetchFromGitHub, autoreconfHook, libxslt
+, libxml2 , docbook_xml_dtd_45, docbook_xsl, itstool, flex, bison
 , pam ? null, glibcCross ? null
 }:
 
@@ -86,5 +86,6 @@ stdenv.mkDerivation rec {
 
   passthru = {
     shellPath = "/bin/nologin";
+    tests = { inherit (nixosTests) shadow; };
   };
 }
diff --git a/pkgs/servers/dns/bind/default.nix b/pkgs/servers/dns/bind/default.nix
index 61ab6f98d21c..858a4fcb5fa0 100644
--- a/pkgs/servers/dns/bind/default.nix
+++ b/pkgs/servers/dns/bind/default.nix
@@ -10,11 +10,11 @@ assert enablePython -> python3 != null;
 
 stdenv.mkDerivation rec {
   pname = "bind";
-  version = "9.16.8";
+  version = "9.16.10";
 
   src = fetchurl {
     url = "https://downloads.isc.org/isc/bind9/${version}/${pname}-${version}.tar.xz";
-    sha256 = "0ccdbqmpvnxlbrxjsx2w8ir4xh961svzcw7n87n8dglj6rb9r6wy";
+    sha256 = "sha256-vEf8AZxiBeamv7g5xUShRyMh3wU3upBbhGpMv/4zYrM=";
   };
 
   outputs = [ "out" "lib" "dev" "man" "dnsutils" "host" ];
@@ -22,11 +22,6 @@ stdenv.mkDerivation rec {
   patches = [
     ./dont-keep-configure-flags.patch
     ./remove-mkdir-var.patch
-    # Fix cross-compilation (will be included in next release after 9.16.8)
-    (fetchpatch {
-      url = "https://gitlab.isc.org/isc-projects/bind9/-/commit/35ca6df07277adff4df7472a0b01ea5438cdf1ff.patch";
-      sha256 = "1sj0hcd0wgkam7hrbp2vw2yymmni4azr9ixd9shz1l6ja90bdj9h";
-    })
   ];
 
   nativeBuildInputs = [ perl pkg-config ];
diff --git a/pkgs/servers/grocy/0001-Define-configs-with-env-vars.patch b/pkgs/servers/grocy/0001-Define-configs-with-env-vars.patch
index ed315c854c82..0d6ae781b757 100644
--- a/pkgs/servers/grocy/0001-Define-configs-with-env-vars.patch
+++ b/pkgs/servers/grocy/0001-Define-configs-with-env-vars.patch
@@ -1,20 +1,20 @@
-From 931958d8f11cb55f2e88a178a3b828f3c537eba8 Mon Sep 17 00:00:00 2001
+From 7ed6c641cc501246931721700b73f40dce7e8f4b Mon Sep 17 00:00:00 2001
 From: Maximilian Bosch <maximilian@mbosch.me>
-Date: Fri, 6 Mar 2020 23:43:58 +0100
+Date: Tue, 22 Dec 2020 15:38:56 +0100
 Subject: [PATCH 1/2] Define configs with env vars
 
 ---
  app.php                      | 4 ++--
  services/DatabaseService.php | 2 +-
  services/FilesService.php    | 2 +-
- services/StockService.php    | 2 +-
- 4 files changed, 5 insertions(+), 5 deletions(-)
+ services/StockService.php    | 3 +--
+ 4 files changed, 5 insertions(+), 6 deletions(-)
 
 diff --git a/app.php b/app.php
-index af65ad1..4963c28 100644
+index 8176ebe..04432ba 100644
 --- a/app.php
 +++ b/app.php
-@@ -25,7 +25,7 @@ else
+@@ -10,7 +10,7 @@ use Slim\Factory\AppFactory;
  require_once __DIR__ . '/vendor/autoload.php';
  
  // Load config files
@@ -23,33 +23,32 @@ index af65ad1..4963c28 100644
  require_once __DIR__ . '/config-dist.php'; // For not in own config defined values we use the default ones
  
  // Definitions for dev/demo/prerelease mode
-@@ -50,7 +50,7 @@ $app = AppFactory::create();
+@@ -37,7 +37,7 @@ $app = AppFactory::create();
+ 
  $container = $app->getContainer();
- $container->set('view', function(Container $container)
- {
+ $container->set('view', function (Container $container) {
 -	return new Slim\Views\Blade(__DIR__ . '/views', GROCY_DATAPATH . '/viewcache');
-+	return new \Slim\Views\Blade(__DIR__ . '/views', getenv('GROCY_CACHE_DIR'));
++	return new Slim\Views\Blade(__DIR__ . '/views', getenv('GROCY_CACHE_DIR'));
  });
- $container->set('LoginControllerInstance', function(Container $container)
- {
+ $container->set('UrlManager', function (Container $container) {
+ 	return new UrlManager(GROCY_BASE_URL);
 diff --git a/services/DatabaseService.php b/services/DatabaseService.php
-index 23fc7b9..daa1993 100644
+index d1080b0..8bc4ee1 100644
 --- a/services/DatabaseService.php
 +++ b/services/DatabaseService.php
-@@ -25,7 +25,7 @@ class DatabaseService
- 			return GROCY_DATAPATH . '/grocy_' . GROCY_CULTURE . '.db';
+@@ -105,6 +105,6 @@ class DatabaseService
+ 			return GROCY_DATAPATH . '/grocy_' . $dbSuffix . '.db';
  		}
  
 -		return GROCY_DATAPATH . '/grocy.db';
 +		return getenv('GROCY_DB_FILE');
  	}
- 
-     private static $DbConnectionRaw = null;
+ }
 diff --git a/services/FilesService.php b/services/FilesService.php
-index cecdae3..357298d 100644
+index 8c1483e..8f74b4b 100644
 --- a/services/FilesService.php
 +++ b/services/FilesService.php
-@@ -12,7 +12,7 @@ class FilesService extends BaseService
+@@ -70,7 +70,7 @@ class FilesService extends BaseService
  	{
  		parent::__construct();
  
@@ -59,18 +58,19 @@ index cecdae3..357298d 100644
  		if (!file_exists($this->StoragePath))
  		{
 diff --git a/services/StockService.php b/services/StockService.php
-index bfde3fc..53b2245 100644
+index 4741b4b..6d4e748 100644
 --- a/services/StockService.php
 +++ b/services/StockService.php
-@@ -934,7 +934,7 @@ class StockService extends BaseService
+@@ -1374,8 +1374,7 @@ class StockService extends BaseService
  			throw new \Exception('No barcode lookup plugin defined');
  		}
  
 -		$path = GROCY_DATAPATH . "/plugins/$pluginName.php";
-+		$path = getenv('GROCY_PLUGIN_DIR');
+-
++		$path = getenv('GROCY_PLUGIN_DIR') . "/$pluginName.php";
  		if (file_exists($path))
  		{
  			require_once $path;
 -- 
-2.25.0
+2.29.2
 
diff --git a/pkgs/servers/grocy/0002-Remove-check-for-config-file-as-it-s-stored-in-etc-g.patch b/pkgs/servers/grocy/0002-Remove-check-for-config-file-as-it-s-stored-in-etc-g.patch
index e7f84a146fbf..b065ca801d5f 100644
--- a/pkgs/servers/grocy/0002-Remove-check-for-config-file-as-it-s-stored-in-etc-g.patch
+++ b/pkgs/servers/grocy/0002-Remove-check-for-config-file-as-it-s-stored-in-etc-g.patch
@@ -1,24 +1,24 @@
-From 1556489f0b475ae56e5ed3afba19cc2abb696a76 Mon Sep 17 00:00:00 2001
-From: Maximilian Bosch <maximilian@mbosch.me>
-Date: Thu, 16 Apr 2020 19:37:32 +0200
-Subject: [PATCH 2/2] Remove check for config-file as it's stored in /etc/grocy
-
----
- helpers/PrerequisiteChecker.php | 1 -
- 1 file changed, 1 deletion(-)
-
-diff --git a/helpers/PrerequisiteChecker.php b/helpers/PrerequisiteChecker.php
-index d4bf74c6..ca7686c9 100644
---- a/helpers/PrerequisiteChecker.php
-+++ b/helpers/PrerequisiteChecker.php
-@@ -8,7 +8,6 @@ class PrerequisiteChecker
+From c46323dfc4a3d5bf17f7508f5b5f223858a598c3 Mon Sep 17 00:00:00 2001
+From: Maximilian Bosch <maximilian@mbosch.me>
+Date: Tue, 22 Dec 2020 15:39:15 +0100
+Subject: [PATCH 2/2] Remove check for config-file as it's stored in /etc/grocy
+
+---
+ helpers/PrerequisiteChecker.php | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/helpers/PrerequisiteChecker.php b/helpers/PrerequisiteChecker.php
+index cbe0a3a..a484db2 100644
+--- a/helpers/PrerequisiteChecker.php
++++ b/helpers/PrerequisiteChecker.php
+@@ -11,7 +11,6 @@ class PrerequisiteChecker
  {
-     public function checkRequirements()
-     {
--        self::checkForConfigFile();
-         self::checkForConfigDistFile();
-         self::checkForComposer();
-         self::checkForYarn();
--- 
-2.25.0
-
+ 	public function checkRequirements()
+ 	{
+-		self::checkForConfigFile();
+ 		self::checkForConfigDistFile();
+ 		self::checkForComposer();
+ 		self::checkForPhpExtensions();
+-- 
+2.29.2
+
diff --git a/pkgs/servers/grocy/default.nix b/pkgs/servers/grocy/default.nix
index 193f3929809a..2f2772505f6a 100644
--- a/pkgs/servers/grocy/default.nix
+++ b/pkgs/servers/grocy/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "grocy";
-  version = "2.7.1";
+  version = "3.0.0";
 
   src = fetchurl {
     url = "https://github.com/grocy/grocy/releases/download/v${version}/grocy_${version}.zip";
-    sha256 = "0ab1yxj499vadakq2c1lils3ir6fm02wrdgrirrlar4s4z6c4p7r";
+    sha256 = "sha256-O7DksfA95IHvLJyRrWG8iECcUUDsOtytd78koNZdQzE=";
   };
 
   nativeBuildInputs = [ unzip ];
@@ -14,6 +14,8 @@ stdenv.mkDerivation rec {
     unzip ${src} -d .
   '';
 
+  # NOTE: if patches are created from a git checkout, those should be modified
+  # with `unixdos` to make sure those apply here.
   patches = [
     ./0001-Define-configs-with-env-vars.patch
     ./0002-Remove-check-for-config-file-as-it-s-stored-in-etc-g.patch
diff --git a/pkgs/servers/samba/0001-lib-util-Standardize-use-of-st_-acm-time-ns.patch b/pkgs/servers/samba/0001-lib-util-Standardize-use-of-st_-acm-time-ns.patch
new file mode 100644
index 000000000000..6de704cba285
--- /dev/null
+++ b/pkgs/servers/samba/0001-lib-util-Standardize-use-of-st_-acm-time-ns.patch
@@ -0,0 +1,569 @@
+From 55a5b9c8254126d0acef8702526c92a31200a07c Mon Sep 17 00:00:00 2001
+From: Matthew DeVore <matvore@google.com>
+Date: Tue, 4 Aug 2020 17:49:42 -0700
+Subject: [PATCH] lib/util: Standardize use of st_[acm]time ns
+
+Commit 810397f89a10, and possibly others, broke the build for macOS and
+other environments which don't have st_[acm]tim fields on 'struct stat'.
+
+Multiple places in the codebase used the config.h values to determine
+how to access the nanosecond or microsecond values of the stat
+timestamps, so rather than add more, centralize them all into
+lib/util/time.c.
+
+Also allow pvfs_fileinfo.c to read nanosecond-granularity timestamps on
+platforms where it didn't before, since its #if branches were not
+complete.
+
+Signed-off-by: Matthew DeVore <matvore@google.com>
+Reviewed-by: Jeremy Allison <jra@samba.org>
+Reviewed-by: Volker Lendecke <vl@samba.org>
+
+Autobuild-User(master): Volker Lendecke <vl@samba.org>
+Autobuild-Date(master): Sat Aug 15 08:51:09 UTC 2020 on sn-devel-184
+---
+ lib/replace/wscript                         |   2 -
+ lib/util/time.c                             | 230 ++++++++++++++++++++
+ lib/util/time.h                             |  18 ++
+ source3/lib/system.c                        | 121 +---------
+ source3/libsmb/libsmb_stat.c                |  24 +-
+ source4/ntvfs/posix/pvfs_fileinfo.c         |  11 +-
+ source4/torture/libsmbclient/libsmbclient.c |   7 +-
+ 7 files changed, 277 insertions(+), 136 deletions(-)
+
+diff --git a/lib/replace/wscript b/lib/replace/wscript
+index 64f305d6df0..85bc11d2f01 100644
+--- a/lib/replace/wscript
++++ b/lib/replace/wscript
+@@ -746,8 +746,6 @@ def configure(conf):
+ 
+     conf.CHECK_CODE('mkdir("foo",0777)', define='HAVE_MKDIR_MODE', headers='sys/stat.h')
+ 
+-    conf.CHECK_STRUCTURE_MEMBER('struct stat', 'st_mtim.tv_nsec', define='HAVE_STAT_TV_NSEC',
+-                                headers='sys/stat.h')
+     # we need the st_rdev test under two names
+     conf.CHECK_STRUCTURE_MEMBER('struct stat', 'st_rdev',
+                                 define='HAVE_STRUCT_STAT_ST_RDEV',
+diff --git a/lib/util/time.c b/lib/util/time.c
+index 0fac5e2e397..b5c1d700b23 100644
+--- a/lib/util/time.c
++++ b/lib/util/time.c
+@@ -26,6 +26,10 @@
+ #include "byteorder.h"
+ #include "time_basic.h"
+ #include "lib/util/time.h" /* Avoid /usr/include/time.h */
++#include <sys/stat.h>
++#ifndef NO_CONFIG_H
++#include "config.h"
++#endif
+ 
+ /**
+  * @file
+@@ -1232,3 +1236,229 @@ struct timespec time_t_to_full_timespec(time_t t)
+ 	}
+ 	return (struct timespec){.tv_sec = t};
+ }
++
++#if !defined(HAVE_STAT_HIRES_TIMESTAMPS)
++
++/* Old system - no ns timestamp. */
++time_t get_atimensec(const struct stat *st)
++{
++	return 0;
++}
++
++time_t get_mtimensec(const struct stat *st)
++{
++	return 0;
++}
++
++time_t get_ctimensec(const struct stat *st)
++{
++	return 0;
++}
++
++/* Set does nothing with no ns timestamp. */
++void set_atimensec(struct stat *st, time_t ns)
++{
++	return;
++}
++
++void set_mtimensec(struct stat *st, time_t ns)
++{
++	return;
++}
++
++void set_ctimensec(struct stat *st, time_t ns)
++{
++	return;
++}
++
++#elif HAVE_STRUCT_STAT_ST_MTIMESPEC_TV_NSEC
++
++time_t get_atimensec(const struct stat *st)
++{
++	return st->st_atimespec.tv_nsec;
++}
++
++time_t get_mtimensec(const struct stat *st)
++{
++	return st->st_mtimespec.tv_nsec;
++}
++
++time_t get_ctimensec(const struct stat *st)
++{
++	return st->st_ctimespec.tv_nsec;
++}
++
++void set_atimensec(struct stat *st, time_t ns)
++{
++	st->st_atimespec.tv_nsec = ns;
++}
++
++void set_mtimensec(struct stat *st, time_t ns)
++{
++	st->st_mtimespec.tv_nsec = ns;
++}
++
++void set_ctimensec(struct stat *st, time_t ns)
++{
++	st->st_ctimespec.tv_nsec = ns;
++}
++
++#elif HAVE_STRUCT_STAT_ST_MTIM_TV_NSEC
++
++time_t get_atimensec(const struct stat *st)
++{
++	return st->st_atim.tv_nsec;
++}
++
++time_t get_mtimensec(const struct stat *st)
++{
++	return st->st_mtim.tv_nsec;
++}
++
++time_t get_ctimensec(const struct stat *st)
++{
++	return st->st_ctim.tv_nsec;
++}
++
++void set_atimensec(struct stat *st, time_t ns)
++{
++	st->st_atim.tv_nsec = ns;
++}
++
++void set_mtimensec(struct stat *st, time_t ns)
++{
++	st->st_mtim.tv_nsec = ns;
++}
++void set_ctimensec(struct stat *st, time_t ns)
++{
++	st->st_ctim.tv_nsec = ns;
++}
++
++#elif HAVE_STRUCT_STAT_ST_MTIMENSEC
++
++time_t get_atimensec(const struct stat *st)
++{
++	return st->st_atimensec;
++}
++
++time_t get_mtimensec(const struct stat *st)
++{
++	return st->st_mtimensec;
++}
++
++time_t get_ctimensec(const struct stat *st)
++{
++	return st->st_ctimensec;
++}
++
++void set_atimensec(struct stat *st, time_t ns)
++{
++	st->st_atimensec = ns;
++}
++
++void set_mtimensec(struct stat *st, time_t ns)
++{
++	st->st_mtimensec = ns;
++}
++
++void set_ctimensec(struct stat *st, time_t ns)
++{
++	st->st_ctimensec = ns;
++}
++
++#elif HAVE_STRUCT_STAT_ST_MTIME_N
++
++time_t get_atimensec(const struct stat *st)
++{
++	return st->st_atime_n;
++}
++
++time_t get_mtimensec(const struct stat *st)
++{
++	return st->st_mtime_n;
++}
++
++time_t get_ctimensec(const struct stat *st)
++{
++	return st->st_ctime_n;
++}
++
++void set_atimensec(struct stat *st, time_t ns)
++{
++	st->st_atime_n = ns;
++}
++
++void set_mtimensec(struct stat *st, time_t ns)
++{
++	st->st_mtime_n = ns;
++}
++
++void set_ctimensec(struct stat *st, time_t ns)
++{
++	st->st_ctime_n = ns;
++}
++
++#elif HAVE_STRUCT_STAT_ST_UMTIME
++
++/* Only usec timestamps available. Convert to/from nsec. */
++
++time_t get_atimensec(const struct stat *st)
++{
++	return st->st_uatime * 1000;
++}
++
++time_t get_mtimensec(const struct stat *st)
++{
++	return st->st_umtime * 1000;
++}
++
++time_t get_ctimensec(const struct stat *st)
++{
++	return st->st_uctime * 1000;
++}
++
++void set_atimensec(struct stat *st, time_t ns)
++{
++	st->st_uatime = ns / 1000;
++}
++
++void set_mtimensec(struct stat *st, time_t ns)
++{
++	st->st_umtime = ns / 1000;
++}
++
++void set_ctimensec(struct stat *st, time_t ns)
++{
++	st->st_uctime = ns / 1000;
++}
++
++#else
++#error CONFIGURE_ERROR_IN_DETECTING_TIMESPEC_IN_STAT
++#endif
++
++struct timespec get_atimespec(const struct stat *pst)
++{
++	struct timespec ret;
++
++	ret.tv_sec = pst->st_atime;
++	ret.tv_nsec = get_atimensec(pst);
++	return ret;
++}
++
++struct timespec get_mtimespec(const struct stat *pst)
++{
++	struct timespec ret;
++
++	ret.tv_sec = pst->st_mtime;
++	ret.tv_nsec = get_mtimensec(pst);
++	return ret;
++}
++
++struct timespec get_ctimespec(const struct stat *pst)
++{
++	struct timespec ret;
++
++	ret.tv_sec = pst->st_mtime;
++	ret.tv_nsec = get_ctimensec(pst);
++	return ret;
++}
+diff --git a/lib/util/time.h b/lib/util/time.h
+index 4a90b40d5ce..04945b5f25f 100644
+--- a/lib/util/time.h
++++ b/lib/util/time.h
+@@ -375,4 +375,22 @@ time_t full_timespec_to_time_t(const struct timespec *ts);
+ time_t nt_time_to_full_time_t(NTTIME nt);
+ struct timespec time_t_to_full_timespec(time_t t);
+ 
++/*
++ * Functions to get and set the number of nanoseconds for times in a stat field.
++ * If the stat has timestamp granularity less than nanosecond, then the set_*
++ * operations will be lossy.
++ */
++struct stat;
++time_t get_atimensec(const struct stat *);
++time_t get_mtimensec(const struct stat *);
++time_t get_ctimensec(const struct stat *);
++void set_atimensec(struct stat *, time_t);
++void set_mtimensec(struct stat *, time_t);
++void set_ctimensec(struct stat *, time_t);
++
++/* These are convenience wrappers for the above getters. */
++struct timespec get_atimespec(const struct stat *);
++struct timespec get_mtimespec(const struct stat *);
++struct timespec get_ctimespec(const struct stat *);
++
+ #endif /* _SAMBA_TIME_H_ */
+diff --git a/source3/lib/system.c b/source3/lib/system.c
+index f1265e0c43f..7c8cd19d11f 100644
+--- a/source3/lib/system.c
++++ b/source3/lib/system.c
+@@ -25,7 +25,8 @@
+ #include "system/capability.h"
+ #include "system/passwd.h"
+ #include "system/filesys.h"
+-#include "../lib/util/setid.h"
++#include "lib/util/setid.h"
++#include "lib/util/time.h"
+ 
+ #ifdef HAVE_SYS_SYSCTL_H
+ #include <sys/sysctl.h>
+@@ -122,124 +123,6 @@ int sys_fcntl_int(int fd, int cmd, int arg)
+ 	return ret;
+ }
+ 
+-/****************************************************************************
+- Get/Set all the possible time fields from a stat struct as a timespec.
+-****************************************************************************/
+-
+-static struct timespec get_atimespec(const struct stat *pst)
+-{
+-#if !defined(HAVE_STAT_HIRES_TIMESTAMPS)
+-	struct timespec ret;
+-
+-	/* Old system - no ns timestamp. */
+-	ret.tv_sec = pst->st_atime;
+-	ret.tv_nsec = 0;
+-	return ret;
+-#else
+-#if defined(HAVE_STRUCT_STAT_ST_MTIM_TV_NSEC)
+-	struct timespec ret;
+-	ret.tv_sec = pst->st_atim.tv_sec;
+-	ret.tv_nsec = pst->st_atim.tv_nsec;
+-	return ret;
+-#elif defined(HAVE_STRUCT_STAT_ST_MTIMENSEC)
+-	struct timespec ret;
+-	ret.tv_sec = pst->st_atime;
+-	ret.tv_nsec = pst->st_atimensec;
+-	return ret;
+-#elif defined(HAVE_STRUCT_STAT_ST_MTIME_N)
+-	struct timespec ret;
+-	ret.tv_sec = pst->st_atime;
+-	ret.tv_nsec = pst->st_atime_n;
+-	return ret;
+-#elif defined(HAVE_STRUCT_STAT_ST_UMTIME)
+-	struct timespec ret;
+-	ret.tv_sec = pst->st_atime;
+-	ret.tv_nsec = pst->st_uatime * 1000;
+-	return ret;
+-#elif defined(HAVE_STRUCT_STAT_ST_MTIMESPEC_TV_NSEC)
+-	return pst->st_atimespec;
+-#else
+-#error	CONFIGURE_ERROR_IN_DETECTING_TIMESPEC_IN_STAT
+-#endif
+-#endif
+-}
+-
+-static struct timespec get_mtimespec(const struct stat *pst)
+-{
+-#if !defined(HAVE_STAT_HIRES_TIMESTAMPS)
+-	struct timespec ret;
+-
+-	/* Old system - no ns timestamp. */
+-	ret.tv_sec = pst->st_mtime;
+-	ret.tv_nsec = 0;
+-	return ret;
+-#else
+-#if defined(HAVE_STRUCT_STAT_ST_MTIM_TV_NSEC)
+-	struct timespec ret;
+-	ret.tv_sec = pst->st_mtim.tv_sec;
+-	ret.tv_nsec = pst->st_mtim.tv_nsec;
+-	return ret;
+-#elif defined(HAVE_STRUCT_STAT_ST_MTIMENSEC)
+-	struct timespec ret;
+-	ret.tv_sec = pst->st_mtime;
+-	ret.tv_nsec = pst->st_mtimensec;
+-	return ret;
+-#elif defined(HAVE_STRUCT_STAT_ST_MTIME_N)
+-	struct timespec ret;
+-	ret.tv_sec = pst->st_mtime;
+-	ret.tv_nsec = pst->st_mtime_n;
+-	return ret;
+-#elif defined(HAVE_STRUCT_STAT_ST_UMTIME)
+-	struct timespec ret;
+-	ret.tv_sec = pst->st_mtime;
+-	ret.tv_nsec = pst->st_umtime * 1000;
+-	return ret;
+-#elif defined(HAVE_STRUCT_STAT_ST_MTIMESPEC_TV_NSEC)
+-	return pst->st_mtimespec;
+-#else
+-#error	CONFIGURE_ERROR_IN_DETECTING_TIMESPEC_IN_STAT
+-#endif
+-#endif
+-}
+-
+-static struct timespec get_ctimespec(const struct stat *pst)
+-{
+-#if !defined(HAVE_STAT_HIRES_TIMESTAMPS)
+-	struct timespec ret;
+-
+-	/* Old system - no ns timestamp. */
+-	ret.tv_sec = pst->st_ctime;
+-	ret.tv_nsec = 0;
+-	return ret;
+-#else
+-#if defined(HAVE_STRUCT_STAT_ST_MTIM_TV_NSEC)
+-	struct timespec ret;
+-	ret.tv_sec = pst->st_ctim.tv_sec;
+-	ret.tv_nsec = pst->st_ctim.tv_nsec;
+-	return ret;
+-#elif defined(HAVE_STRUCT_STAT_ST_MTIMENSEC)
+-	struct timespec ret;
+-	ret.tv_sec = pst->st_ctime;
+-	ret.tv_nsec = pst->st_ctimensec;
+-	return ret;
+-#elif defined(HAVE_STRUCT_STAT_ST_MTIME_N)
+-	struct timespec ret;
+-	ret.tv_sec = pst->st_ctime;
+-	ret.tv_nsec = pst->st_ctime_n;
+-	return ret;
+-#elif defined(HAVE_STRUCT_STAT_ST_UMTIME)
+-	struct timespec ret;
+-	ret.tv_sec = pst->st_ctime;
+-	ret.tv_nsec = pst->st_uctime * 1000;
+-	return ret;
+-#elif defined(HAVE_STRUCT_STAT_ST_MTIMESPEC_TV_NSEC)
+-	return pst->st_ctimespec;
+-#else
+-#error	CONFIGURE_ERROR_IN_DETECTING_TIMESPEC_IN_STAT
+-#endif
+-#endif
+-}
+-
+ /****************************************************************************
+  Return the best approximation to a 'create time' under UNIX from a stat
+  structure.
+diff --git a/source3/libsmb/libsmb_stat.c b/source3/libsmb/libsmb_stat.c
+index 790934bd565..b01aeb51ac1 100644
+--- a/source3/libsmb/libsmb_stat.c
++++ b/source3/libsmb/libsmb_stat.c
+@@ -27,6 +27,7 @@
+ #include "libsmbclient.h"
+ #include "libsmb_internal.h"
+ #include "../libcli/smb/smbXcli_base.h"
++#include "lib/util/time.h"
+ 
+ /*
+  * Generate an inode number from file name for those things that need it
+@@ -102,18 +103,29 @@ void setup_stat(struct stat *st,
+ 	}
+ 
+ 	st->st_dev = dev;
+-	st->st_atim = access_time_ts;
+-	st->st_ctim = change_time_ts;
+-	st->st_mtim = write_time_ts;
++
++	st->st_atime = access_time_ts.tv_sec;
++	set_atimensec(st, access_time_ts.tv_nsec);
++
++	st->st_ctime = change_time_ts.tv_sec;
++	set_ctimensec(st, change_time_ts.tv_nsec);
++
++	st->st_mtime = write_time_ts.tv_sec;
++	set_mtimensec(st, write_time_ts.tv_nsec);
+ }
+ 
+ void setup_stat_from_stat_ex(const struct stat_ex *stex,
+ 			     const char *fname,
+ 			     struct stat *st)
+ {
+-	st->st_atim = stex->st_ex_atime;
+-	st->st_ctim = stex->st_ex_ctime;
+-	st->st_mtim = stex->st_ex_mtime;
++	st->st_atime = stex->st_ex_atime.tv_sec;
++	set_atimensec(st, stex->st_ex_atime.tv_nsec);
++
++	st->st_ctime = stex->st_ex_ctime.tv_sec;
++	set_ctimensec(st, stex->st_ex_ctime.tv_nsec);
++
++	st->st_mtime = stex->st_ex_mtime.tv_sec;
++	set_mtimensec(st, stex->st_ex_mtime.tv_nsec);
+ 
+ 	st->st_mode = stex->st_ex_mode;
+ 	st->st_size = stex->st_ex_size;
+diff --git a/source4/ntvfs/posix/pvfs_fileinfo.c b/source4/ntvfs/posix/pvfs_fileinfo.c
+index d2e2aeea265..977ea4fa3d5 100644
+--- a/source4/ntvfs/posix/pvfs_fileinfo.c
++++ b/source4/ntvfs/posix/pvfs_fileinfo.c
+@@ -21,6 +21,7 @@
+ 
+ #include "includes.h"
+ #include "vfs_posix.h"
++#include "lib/util/time.h"
+ 
+ /****************************************************************************
+  Change a unix mode to a dos mode.
+@@ -72,12 +73,10 @@ NTSTATUS pvfs_fill_dos_info(struct pvfs_state *pvfs, struct pvfs_filename *name,
+ 	unix_to_nt_time(&name->dos.access_time, name->st.st_atime);
+ 	unix_to_nt_time(&name->dos.write_time,  name->st.st_mtime);
+ 	unix_to_nt_time(&name->dos.change_time, name->st.st_ctime);
+-#ifdef HAVE_STAT_TV_NSEC
+-	name->dos.create_time += name->st.st_ctim.tv_nsec / 100;
+-	name->dos.access_time += name->st.st_atim.tv_nsec / 100;
+-	name->dos.write_time  += name->st.st_mtim.tv_nsec / 100;
+-	name->dos.change_time += name->st.st_ctim.tv_nsec / 100;
+-#endif
++	name->dos.create_time += get_ctimensec(&name->st) / 100;
++	name->dos.access_time += get_atimensec(&name->st) / 100;
++	name->dos.write_time  += get_mtimensec(&name->st) / 100;
++	name->dos.change_time += get_ctimensec(&name->st) / 100;
+ 	name->dos.attrib = dos_mode_from_stat(pvfs, &name->st);
+ 	name->dos.alloc_size = pvfs_round_alloc_size(pvfs, name->st.st_size);
+ 	name->dos.nlink = name->st.st_nlink;
+diff --git a/source4/torture/libsmbclient/libsmbclient.c b/source4/torture/libsmbclient/libsmbclient.c
+index 3f3992593f9..4fbd759487b 100644
+--- a/source4/torture/libsmbclient/libsmbclient.c
++++ b/source4/torture/libsmbclient/libsmbclient.c
+@@ -27,6 +27,7 @@
+ #include "lib/param/loadparm.h"
+ #include "lib/param/param_global.h"
+ #include "dynconfig.h"
++#include "lib/util/time.h"
+ 
+ /* test string to compare with when debug_callback is called */
+ #define TEST_STRING "smbc_setLogCallback test"
+@@ -1231,8 +1232,8 @@ static bool torture_libsmbclient_utimes(struct torture_context *tctx)
+ 	ret = smbc_fstat(fhandle, &st);
+ 	torture_assert_int_not_equal(tctx, ret, -1, "smbc_fstat failed");
+ 
+-	tbuf[0] = convert_timespec_to_timeval(st.st_atim);
+-	tbuf[1] = convert_timespec_to_timeval(st.st_mtim);
++	tbuf[0] = convert_timespec_to_timeval(get_atimespec(&st));
++	tbuf[1] = convert_timespec_to_timeval(get_mtimespec(&st));
+ 
+ 	tbuf[1] = timeval_add(&tbuf[1], 0, 100000); /* 100 msec */
+ 
+@@ -1244,7 +1245,7 @@ static bool torture_libsmbclient_utimes(struct torture_context *tctx)
+ 
+ 	torture_assert_int_equal(
+ 		tctx,
+-		st.st_mtim.tv_nsec / 1000,
++		get_mtimensec(&st) / 1000,
+ 		tbuf[1].tv_usec,
+ 		"smbc_utimes did not update msec");
+ 
+-- 
+2.29.2
+
diff --git a/pkgs/servers/samba/4.x.nix b/pkgs/servers/samba/4.x.nix
index ec28834659aa..164604242d86 100644
--- a/pkgs/servers/samba/4.x.nix
+++ b/pkgs/servers/samba/4.x.nix
@@ -12,6 +12,7 @@
 , docbook_xml_dtd_45
 , readline
 , popt
+, dbus
 , libbsd
 , libarchive
 , zlib
@@ -43,11 +44,11 @@ with stdenv.lib;
 
 stdenv.mkDerivation rec {
   pname = "samba";
-  version = "4.12.6";
+  version = "4.13.3";
 
   src = fetchurl {
     url = "mirror://samba/pub/samba/stable/${pname}-${version}.tar.gz";
-    sha256 = "1v3cmw40csmi3jd8mhlx4bm7bk4m0426zkyin7kq11skwnsrna02";
+    sha256 = "0hb5fli4kgwg376c289mcmdqszd51vs8pzzrw7j6yr9k7za8a1f1";
   };
 
   outputs = [ "out" "dev" "man" ];
@@ -57,6 +58,8 @@ stdenv.mkDerivation rec {
     ./patch-source3__libads__kerberos_keytab.c.patch
     ./4.x-no-persistent-install-dynconfig.patch
     ./4.x-fix-makeflags-parsing.patch
+    # Backport, should be removed for version 4.14
+    ./0001-lib-util-Standardize-use-of-st_-acm-time-ns.patch
   ];
 
   nativeBuildInputs = [
@@ -79,6 +82,7 @@ stdenv.mkDerivation rec {
     python
     readline
     popt
+    dbus
     jansson
     libbsd
     libarchive
@@ -154,6 +158,7 @@ stdenv.mkDerivation rec {
     description = "The standard Windows interoperability suite of programs for Linux and Unix";
     license = licenses.gpl3;
     platforms = platforms.unix;
+    broken = stdenv.isDarwin;
     maintainers = with maintainers; [ aneeshusa ];
   };
 }
diff --git a/pkgs/tools/admin/awscli/default.nix b/pkgs/tools/admin/awscli/default.nix
index a80536821b24..3dd63148e84d 100644
--- a/pkgs/tools/admin/awscli/default.nix
+++ b/pkgs/tools/admin/awscli/default.nix
@@ -28,11 +28,11 @@ let
 
 in with py.pkgs; buildPythonApplication rec {
   pname = "awscli";
-  version = "1.18.201"; # N.B: if you change this, change botocore to a matching version too
+  version = "1.18.202"; # N.B: if you change this, change botocore to a matching version too
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-w3kZgB8rIEFlJ7cikU0ISTAl/3c8MzKQL2B2Rrr1B8c=";
+    sha256 = "sha256-nlgqIzFELlg8Ck3HCXBx/LDzlM9p2CGKOgA2vS+r2y0=";
   };
 
   postPatch = ''
diff --git a/pkgs/tools/misc/z-lua/default.nix b/pkgs/tools/misc/z-lua/default.nix
index 59149506e6c0..dc6892368673 100644
--- a/pkgs/tools/misc/z-lua/default.nix
+++ b/pkgs/tools/misc/z-lua/default.nix
@@ -20,8 +20,10 @@ stdenv.mkDerivation rec {
   installPhase = ''
     runHook preInstall
 
-    install -Dm755 z.lua $out/bin/z
-    wrapProgram $out/bin/z --set LUA_CPATH "${lua52Packages.luafilesystem}/lib/lua/5.2/lfs.so" --set _ZL_USE_LFS 1;
+    install -Dm755 z.lua $out/bin/z.lua
+    wrapProgram $out/bin/z.lua --set LUA_CPATH "${lua52Packages.luafilesystem}/lib/lua/5.2/lfs.so" --set _ZL_USE_LFS 1;
+    # Create symlink for backwards compatibility. See: https://github.com/NixOS/nixpkgs/pull/96081
+    ln -s $out/bin/z.lua $out/bin/z
 
     runHook postInstall
   '';
diff --git a/pkgs/tools/text/ripgrep/default.nix b/pkgs/tools/text/ripgrep/default.nix
index 7bd8a74f4587..c69c6fef8cbd 100644
--- a/pkgs/tools/text/ripgrep/default.nix
+++ b/pkgs/tools/text/ripgrep/default.nix
@@ -1,4 +1,5 @@
 { stdenv
+, nixosTests
 , fetchFromGitHub
 , rustPlatform
 , asciidoctor
@@ -34,6 +35,8 @@ rustPlatform.buildRustPackage rec {
     installShellCompletion --zsh complete/_rg
   '';
 
+  passthru.tests = { inherit (nixosTests) ripgrep; };
+
   meta = with stdenv.lib; {
     description = "A utility that combines the usability of The Silver Searcher with the raw speed of grep";
     homepage = "https://github.com/BurntSushi/ripgrep";
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index ed45301f1d6b..8d9b684b9e7d 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -5140,7 +5140,7 @@ in
 
   ksmoothdock = libsForQt514.callPackage ../applications/misc/ksmoothdock { };
 
-  kstars = libsForQt514.callPackage ../applications/science/astronomy/kstars { };
+  kstars = libsForQt5.callPackage ../applications/science/astronomy/kstars { };
 
   kytea = callPackage ../tools/text/kytea { };
 
@@ -22675,6 +22675,8 @@ in
 
   mda_lv2 = callPackage ../applications/audio/mda-lv2 { };
 
+  mediaelch = libsForQt5.callPackage ../applications/misc/mediaelch { };
+
   mediainfo = callPackage ../applications/misc/mediainfo { };
 
   mediainfo-gui = callPackage ../applications/misc/mediainfo-gui { };