diff --git a/nixos/modules/services/monitoring/prometheus/exporters.nix b/nixos/modules/services/monitoring/prometheus/exporters.nix
index 5f6a86afdcd..0b65b4865b1 100644
--- a/nixos/modules/services/monitoring/prometheus/exporters.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters.nix
@@ -28,6 +28,7 @@ let
     "blackbox"
     "collectd"
     "dnsmasq"
+    "domain"
     "dovecot"
     "fritzbox"
     "json"
diff --git a/nixos/modules/services/monitoring/prometheus/exporters/domain.nix b/nixos/modules/services/monitoring/prometheus/exporters/domain.nix
new file mode 100644
index 00000000000..61e2fc80afd
--- /dev/null
+++ b/nixos/modules/services/monitoring/prometheus/exporters/domain.nix
@@ -0,0 +1,19 @@
+{ config, lib, pkgs, options }:
+
+with lib;
+
+let
+  cfg = config.services.prometheus.exporters.domain;
+in
+{
+  port = 9222;
+  serviceOpts = {
+    serviceConfig = {
+      ExecStart = ''
+        ${pkgs.prometheus-domain-exporter}/bin/domain_exporter \
+          --bind ${cfg.listenAddress}:${toString cfg.port} \
+          ${concatStringsSep " \\\n  " cfg.extraFlags}
+      '';
+    };
+  };
+}
diff --git a/nixos/modules/services/web-servers/nginx/default.nix b/nixos/modules/services/web-servers/nginx/default.nix
index 6c8341c1115..f011b527238 100644
--- a/nixos/modules/services/web-servers/nginx/default.nix
+++ b/nixos/modules/services/web-servers/nginx/default.nix
@@ -154,9 +154,9 @@ let
 
       ${optionalString (cfg.recommendedProxySettings) ''
         proxy_redirect          off;
-        proxy_connect_timeout   90;
-        proxy_send_timeout      90;
-        proxy_read_timeout      90;
+        proxy_connect_timeout   60;
+        proxy_send_timeout      60;
+        proxy_read_timeout      60;
         proxy_http_version      1.0;
         include ${recommendedProxyConfig};
       ''}
diff --git a/nixos/tests/prometheus-exporters.nix b/nixos/tests/prometheus-exporters.nix
index c32cd341e5e..a43dca4fe14 100644
--- a/nixos/tests/prometheus-exporters.nix
+++ b/nixos/tests/prometheus-exporters.nix
@@ -201,6 +201,22 @@ let
       '';
     };
 
+    # Access to WHOIS server is required to properly test this exporter, so
+    # just perform basic sanity check that the exporter is running and returns
+    # a failure.
+    domain = {
+      exporterConfig = {
+        enable = true;
+      };
+      exporterTest = ''
+        wait_for_unit("prometheus-domain-exporter.service")
+        wait_for_open_port(9222)
+        succeed(
+            "curl -sSf 'http://localhost:9222/probe?target=nixos.org' | grep -q 'domain_probe_success 0'"
+        )
+      '';
+    };
+
     dovecot = {
       exporterConfig = {
         enable = true;
diff --git a/pkgs/applications/audio/apple-music-electron/default.nix b/pkgs/applications/audio/apple-music-electron/default.nix
index 5d0cb68edb7..e4d43d7f01f 100644
--- a/pkgs/applications/audio/apple-music-electron/default.nix
+++ b/pkgs/applications/audio/apple-music-electron/default.nix
@@ -18,7 +18,7 @@ in appimageTools.wrapType2 {
 
     install -m 444 -D ${appimageContents}/${pname}.desktop -t $out/share/applications
     substituteInPlace $out/share/applications/${pname}.desktop \
-      --replace 'Exec=AppRun' 'Exec=$out/bin/apple-music-electron'
+      --replace "Exec=AppRun" "Exec=$out/bin/apple-music-electron"
     cp -r ${appimageContents}/usr/share/icons $out/share
   '';
 
diff --git a/pkgs/applications/radio/gnuradio/3.8.nix b/pkgs/applications/radio/gnuradio/3.8.nix
index 7e2069c346c..9f90d3c0353 100644
--- a/pkgs/applications/radio/gnuradio/3.8.nix
+++ b/pkgs/applications/radio/gnuradio/3.8.nix
@@ -1,6 +1,5 @@
 { lib, stdenv
 , fetchFromGitHub
-, fetchpatch
 , cmake
 # Remove gcc and python references
 , removeReferencesTo
diff --git a/pkgs/applications/virtualization/cloud-hypervisor/cargo-lock-vendor-fix.patch b/pkgs/applications/virtualization/cloud-hypervisor/cargo-lock-vendor-fix.patch
deleted file mode 100644
index 7a7378faa58..00000000000
--- a/pkgs/applications/virtualization/cloud-hypervisor/cargo-lock-vendor-fix.patch
+++ /dev/null
@@ -1,53 +0,0 @@
-diff --git a/Cargo.lock b/Cargo.lock
-index e566ed25..a661a963 100644
---- a/Cargo.lock
-+++ b/Cargo.lock
-@@ -689,7 +689,7 @@ dependencies = [
-  "serde",
-  "serde_derive",
-  "serde_json",
-- "vfio-bindings 0.2.0 (git+https://github.com/rust-vmm/vfio-bindings)",
-+ "vfio-bindings",
-  "vfio-ioctls",
-  "vm-allocator",
-  "vm-device",
-@@ -1346,17 +1346,12 @@ checksum = "f1bddf1187be692e79c5ffeab891132dfb0f236ed36a43c7ed39f1165ee20191"
- [[package]]
- name = "vfio-bindings"
- version = "0.2.0"
--source = "git+https://github.com/rust-vmm/vfio-bindings#f08cbcbf4041c981441d9c036c49ebad5098ed1c"
-+source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "4a21f546f2bda37f5a8cfb138c87f95b8e34d2d78d6a7a92ba3785f4e08604a7"
- dependencies = [
-  "vmm-sys-util",
- ]
- 
--[[package]]
--name = "vfio-bindings"
--version = "0.2.0"
--source = "registry+https://github.com/rust-lang/crates.io-index"
--checksum = "4a21f546f2bda37f5a8cfb138c87f95b8e34d2d78d6a7a92ba3785f4e08604a7"
--
- [[package]]
- name = "vfio-ioctls"
- version = "0.1.0"
-@@ -1366,7 +1361,7 @@ dependencies = [
-  "kvm-bindings",
-  "kvm-ioctls",
-  "log 0.4.8",
-- "vfio-bindings 0.2.0 (registry+https://github.com/rust-lang/crates.io-index)",
-+ "vfio-bindings",
-  "vm-memory",
-  "vmm-sys-util",
- ]
-diff --git a/pci/Cargo.toml b/pci/Cargo.toml
-index 9c6955c7..4ecf8e6b 100644
---- a/pci/Cargo.toml
-+++ b/pci/Cargo.toml
-@@ -23,5 +23,5 @@ vm-memory = "0.2.1"
- vm-migration = { path = "../vm-migration" }
- 
- [dependencies.vfio-bindings]
--git = "https://github.com/rust-vmm/vfio-bindings"
-+version = "0.2.0"
- features = ["fam-wrappers"]
diff --git a/pkgs/applications/virtualization/cloud-hypervisor/default.nix b/pkgs/applications/virtualization/cloud-hypervisor/default.nix
index 32d5be13d3b..5a12be3afa6 100644
--- a/pkgs/applications/virtualization/cloud-hypervisor/default.nix
+++ b/pkgs/applications/virtualization/cloud-hypervisor/default.nix
@@ -1,28 +1,27 @@
-{ lib, fetchFromGitHub, rustPlatform, pkg-config, openssl }:
+{ lib, stdenv, fetchFromGitHub, rustPlatform, pkg-config, dtc, openssl }:
 
 rustPlatform.buildRustPackage rec {
   pname = "cloud-hypervisor";
-  version = "0.8.0";
+  version = "0.14.1";
 
   src = fetchFromGitHub {
     owner = "cloud-hypervisor";
     repo = pname;
     rev = "v${version}";
-    sha256 = "h2aWWjycTm84TS89/vhqnAvwOqeeSDtvvCt+Is6I0eI=";
+    sha256 = "0pnfg6dzpz8v40cwg3dmlj52x8pblavv7mkczar814dwbk01y7vr";
   };
 
   nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ openssl ];
+  buildInputs = [ openssl ] ++ lib.optional stdenv.isAarch64 dtc;
 
-  cargoPatches = [ ./cargo-lock-vendor-fix.patch ];
-  cargoSha256 = "fOIB+qVDqAAgQPW3bK2NfST24GzYJeRXgaMFXyNPcPQ=";
+  cargoSha256 = "0dbjds40znly11i0ssfv66w82ynxp00ixw1349m5ln9i9ms94sr4";
 
   meta = with lib; {
     homepage = "https://github.com/cloud-hypervisor/cloud-hypervisor";
     description = "Open source Virtual Machine Monitor (VMM) that runs on top of KVM";
     changelog = "https://github.com/cloud-hypervisor/cloud-hypervisor/releases/tag/v${version}";
     license = with licenses; [ asl20 bsd3 ];
-    maintainers = with maintainers; [ offline ];
-    platforms = [ "x86_64-linux" ];
+    maintainers = with maintainers; [ offline qyliss ];
+    platforms = [ "aarch64-linux" "x86_64-linux" ];
   };
 }
diff --git a/pkgs/development/libraries/coordgenlibs/default.nix b/pkgs/development/libraries/coordgenlibs/default.nix
index 267c7df9452..3121741ca02 100644
--- a/pkgs/development/libraries/coordgenlibs/default.nix
+++ b/pkgs/development/libraries/coordgenlibs/default.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "coordgenlibs";
-  version = "2.0.0";
+  version = "2.0.2";
 
   src = fetchFromGitHub {
     owner = "schrodinger";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-lfA0y/tT64C/7NjBff4HEzIfhZ3piFBkQjX5xVbFXFc=";
+    sha256 = "sha256-BcDqrOotqRPMnzvfjzbeCf8gT3yQzKihywKrpah1D7w=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/python-modules/minio/default.nix b/pkgs/development/python-modules/minio/default.nix
index df0f421c17a..b23d264f72d 100644
--- a/pkgs/development/python-modules/minio/default.nix
+++ b/pkgs/development/python-modules/minio/default.nix
@@ -8,6 +8,7 @@
 , pytz
 , pytestCheckHook
 , urllib3
+, certifi
 }:
 
 buildPythonPackage rec {
@@ -26,6 +27,7 @@ buildPythonPackage rec {
     python-dateutil
     pytz
     urllib3
+    certifi
   ];
 
   checkInputs = [ faker mock nose pytestCheckHook ];
diff --git a/pkgs/development/python-modules/pysmappee/default.nix b/pkgs/development/python-modules/pysmappee/default.nix
index ceba7489e8b..626f55fc92a 100644
--- a/pkgs/development/python-modules/pysmappee/default.nix
+++ b/pkgs/development/python-modules/pysmappee/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "pysmappee";
-  version = "0.2.17";
+  version = "0.2.18";
   disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "smappee";
     repo = pname;
     rev = version;
-    sha256 = "00274fbclj5kmwxi2bfx4913r4l0y8qvkfcc9d7ryalvf8jq24k6";
+    sha256 = "sha256-DnRtKr8aGZ6rcN/wTpcFNaI+EJm07nObfWyBpLkQF38=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/tools/rust/cargo-make/default.nix b/pkgs/development/tools/rust/cargo-make/default.nix
index 01f1123238c..54eead5d2a6 100644
--- a/pkgs/development/tools/rust/cargo-make/default.nix
+++ b/pkgs/development/tools/rust/cargo-make/default.nix
@@ -4,11 +4,11 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-make";
-  version = "0.32.15";
+  version = "0.32.16";
 
   src = fetchCrate {
     inherit pname version;
-    sha256 = "sha256-BvZe2+PwradByyDeqhs3u42tbLrR5UMyUhJVSlX/U+w=";
+    sha256 = "sha256-FrrQcZHy5WjNYCod2TBWVAj4clNWPLWLIR2/Kvkz4q0=";
   };
 
   nativeBuildInputs = [ pkg-config ];
@@ -16,7 +16,7 @@ rustPlatform.buildRustPackage rec {
   buildInputs = [ openssl ]
     ++ lib.optionals stdenv.isDarwin [ Security SystemConfiguration ];
 
-  cargoSha256 = "sha256-eA1cyffQAmSN3jQo5k8H6eYrS23qUxsiAqWzwrYmh3o=";
+  cargoSha256 = "sha256-QEHl/Hhug0Ua/SZV0iq1jc6QGGxA1NwheEgGBZRYunI=";
 
   # Some tests fail because they need network access.
   # However, Travis ensures a proper build.
diff --git a/pkgs/development/tools/shellharden/default.nix b/pkgs/development/tools/shellharden/default.nix
new file mode 100644
index 00000000000..09c77f087d2
--- /dev/null
+++ b/pkgs/development/tools/shellharden/default.nix
@@ -0,0 +1,28 @@
+{ lib, rustPlatform, fetchFromGitHub }:
+
+rustPlatform.buildRustPackage rec {
+  pname = "shellharden";
+  version = "4.1.2";
+
+  src = fetchFromGitHub {
+    owner = "anordal";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "1003kgnql0z158d3rzz8s3i7s7rx9hjqqvp3li8xhzrgszvkgqk4";
+  };
+
+  cargoSha256 = "1h4wp9xs9nq90ml2km9gd0afrzri6fbgskz6d15jqykm2fw72l88";
+
+  postPatch = "patchShebangs moduletests/run";
+
+  meta = with lib; {
+    description = "The corrective bash syntax highlighter";
+    longDescription = ''
+      Shellharden is a syntax highlighter and a tool to semi-automate the
+      rewriting of scripts to ShellCheck conformance, mainly focused on quoting.
+    '';
+    homepage = "https://github.com/anordal/shellharden";
+    license = licenses.mpl20;
+    maintainers = with maintainers; [ oxzi ];
+  };
+}
diff --git a/pkgs/games/devilutionx/default.nix b/pkgs/games/devilutionx/default.nix
index 73968b51564..1e88907cc17 100644
--- a/pkgs/games/devilutionx/default.nix
+++ b/pkgs/games/devilutionx/default.nix
@@ -1,13 +1,13 @@
 { lib, stdenv, fetchFromGitHub, cmake, SDL2, SDL2_mixer, SDL2_ttf, libsodium, pkg-config }:
 stdenv.mkDerivation rec {
-  version = "1.0.1";
-  pname = "devilutionx";
+  version = "2020-10-20";
+  pname = "devilutionx-unstable";
 
   src = fetchFromGitHub {
     owner = "diasurgical";
     repo = "devilutionX";
-    rev = version;
-    sha256 = "1jvjlch9ql5s5jx9g5y5pkc2xn62199qylsmzpqzx1jc3k2vmw5i";
+    rev = "432fbc8ef7b98e567b08e44ce91b198374a5ff01";
+    sha256 = "03w3bgmzwsbycx3fzvn47fsmabl069gw77yn2fqg89wlgaw1yrr9";
   };
 
   NIX_CFLAGS_COMPILE = [
@@ -15,6 +15,12 @@ stdenv.mkDerivation rec {
     ''-DTTF_FONT_PATH="${placeholder "out"}/share/fonts/truetype/CharisSILB.ttf"''
   ];
 
+  cmakeFlags = [
+    "-DBINARY_RELEASE=ON"
+  ];
+
+  enableParallelBuilding = true;
+
   nativeBuildInputs = [ pkg-config cmake ];
   buildInputs = [ libsodium SDL2 SDL2_mixer SDL2_ttf ];
 
@@ -40,6 +46,6 @@ stdenv.mkDerivation rec {
     longDescription = "In order to play this game a copy of diabdat.mpq is required. Place a copy of diabdat.mpq in ~/.local/share/diasurgical/devilution before executing the game.";
     license = licenses.unlicense;
     maintainers = [ maintainers.karolchmist ];
-    platforms = platforms.linux ++ platforms.darwin ++ platforms.windows;
+    platforms = platforms.linux ++ platforms.windows;
   };
 }
diff --git a/pkgs/servers/home-assistant/default.nix b/pkgs/servers/home-assistant/default.nix
index 73b1b5e7afa..ed2e85b5c56 100644
--- a/pkgs/servers/home-assistant/default.nix
+++ b/pkgs/servers/home-assistant/default.nix
@@ -314,6 +314,7 @@ in with py.pkgs; buildPythonApplication rec {
     "sensor"
     "smarttub"
     "smtp"
+    "smappee"
     "solaredge"
     "sonos"
     "spotify"
diff --git a/pkgs/servers/monitoring/prometheus/domain-exporter.nix b/pkgs/servers/monitoring/prometheus/domain-exporter.nix
new file mode 100644
index 00000000000..a0bc409a7fc
--- /dev/null
+++ b/pkgs/servers/monitoring/prometheus/domain-exporter.nix
@@ -0,0 +1,26 @@
+{ lib, buildGoModule, fetchFromGitHub, nixosTests }:
+
+buildGoModule rec {
+  pname = "domain-exporter";
+  version = "1.10.0";
+
+  src = fetchFromGitHub {
+    owner = "caarlos0";
+    repo = "domain_exporter";
+    rev = "v${version}";
+    sha256 = "0pvz5vx9jvxdrkmzqzh7dfi09sb55j6zpx5728m5v38p8cl8vyh6";
+  };
+
+  vendorSha256 = "02m2mnx93xq6cl54waazgxq6vqbswfn9aafz0h694n6rskvdn784";
+
+  doCheck = false; # needs internet connection
+
+  passthru.tests = { inherit (nixosTests.prometheus-exporters) domain; };
+
+  meta = with lib; {
+    homepage = "https://github.com/caarlos0/domain_exporter";
+    description = "Exports the expiration time of your domains as prometheus metrics";
+    license = licenses.mit;
+    maintainers = with maintainers; [ mmilata prusnak ];
+  };
+}
diff --git a/pkgs/shells/dash/default.nix b/pkgs/shells/dash/default.nix
index 24d5af7e74e..f044c41b73d 100644
--- a/pkgs/shells/dash/default.nix
+++ b/pkgs/shells/dash/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, buildPackages, autoreconfHook, fetchurl }:
+{ lib, stdenv, buildPackages, autoreconfHook, fetchurl, libedit }:
 
 stdenv.mkDerivation rec {
   pname = "dash";
@@ -11,7 +11,6 @@ stdenv.mkDerivation rec {
 
   hardeningDisable = [ "format" ];
 
-  # Temporary fix until a proper one is accepted upstream
   patches = [
     (fetchurl {
       # Dash executes code when noexec ("-n") is specified
@@ -19,9 +18,18 @@ stdenv.mkDerivation rec {
       url = "https://git.kernel.org/pub/scm/utils/dash/dash.git/patch/?id=29d6f2148f10213de4e904d515e792d2cf8c968e";
       sha256 = "08q90bx36ixwlcj331dh7420qyj8i0qh1cc1gljrhd83fhl9w0y5";
     })
-  ] ++ lib.optional stdenv.isDarwin ./0001-fix-dirent64-et-al-on-darwin.patch;
+  ] ++ lib.optionals stdenv.isDarwin [
+      # Temporary fix until a proper one is accepted upstream
+    ./0001-fix-dirent64-et-al-on-darwin.patch
+  ];
+
   depsBuildBuild = [ buildPackages.stdenv.cc ];
   nativeBuildInputs = lib.optional stdenv.isDarwin autoreconfHook;
+  buildInputs = [ libedit ];
+
+  configureFlags = [ "--with-libedit" ];
+
+  enableParallelBuilding = true;
 
   meta = with lib; {
     homepage = "http://gondor.apana.org.au/~herbert/dash/";
diff --git a/pkgs/tools/misc/chezmoi/default.nix b/pkgs/tools/misc/chezmoi/default.nix
index 1418dcd4abe..78a2dcb456c 100644
--- a/pkgs/tools/misc/chezmoi/default.nix
+++ b/pkgs/tools/misc/chezmoi/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "chezmoi";
-  version = "2.0.7";
+  version = "2.0.8";
 
   src = fetchFromGitHub {
     owner = "twpayne";
     repo = "chezmoi";
     rev = "v${version}";
-    sha256 = "sha256-mJJtkJ57rYEe1BWK3TWAMOar/IUUC9ybiccx81puHsE=";
+    sha256 = "sha256-bGrGekZLystw3AvQP9bdFGlxteGCzwrhamaO8WLKf7U=";
   };
 
   vendorSha256 = "sha256-YU+t8GVsLYWONezUIB4NUrVxtYOmf/2b5v4v3VSYtBU=";
diff --git a/pkgs/tools/misc/fselect/default.nix b/pkgs/tools/misc/fselect/default.nix
index 2350fd6afe4..71ed340d14c 100644
--- a/pkgs/tools/misc/fselect/default.nix
+++ b/pkgs/tools/misc/fselect/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "fselect";
-  version = "0.7.3";
+  version = "0.7.4";
 
   src = fetchFromGitHub {
     owner = "jhspetersson";
     repo = "fselect";
     rev = version;
-    sha256 = "sha256-udHSyw7tf1toB+v67BvJ49INFJdNR2BjQuHEzQJyIoU=";
+    sha256 = "sha256-gwFX5c5y4bL+KhPDnvCbDco1ORYyqZYFsetMrmOATZU=";
   };
 
-  cargoSha256 = "sha256-vVIanMkc0sPzu0L48oOh8wEEUOckR/AYkz81u4OR+fE=";
+  cargoSha256 = "sha256-2cs+5UL3tNfUzjlFIdsG05moiOktXSJOZJlgo/rZINw=";
 
   nativeBuildInputs = [ installShellFiles ];
   buildInputs = lib.optional stdenv.isDarwin libiconv;
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index bc728f12450..2ca19cb30c0 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -13232,6 +13232,8 @@ in
 
   shellcheck = callPackage ../development/tools/shellcheck {};
 
+  shellharden = callPackage ../development/tools/shellharden {};
+
   schemaspy = callPackage ../development/tools/database/schemaspy { };
 
   shncpd = callPackage ../tools/networking/shncpd { };
@@ -18870,6 +18872,7 @@ in
   prometheus-consul-exporter = callPackage ../servers/monitoring/prometheus/consul-exporter.nix { };
   prometheus-dnsmasq-exporter = callPackage ../servers/monitoring/prometheus/dnsmasq-exporter.nix { };
   prometheus-dovecot-exporter = callPackage ../servers/monitoring/prometheus/dovecot-exporter.nix { };
+  prometheus-domain-exporter = callPackage ../servers/monitoring/prometheus/domain-exporter.nix { };
   prometheus-flow-exporter = callPackage ../servers/monitoring/prometheus/flow-exporter.nix { };
   prometheus-fritzbox-exporter = callPackage ../servers/monitoring/prometheus/fritzbox-exporter.nix { };
   prometheus-gitlab-ci-pipelines-exporter = callPackage ../servers/monitoring/prometheus/gitlab-ci-pipelines-exporter.nix { };