diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 2887f3c62f2..f25f11f57ae 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -4943,6 +4943,12 @@
     githubId = 4032;
     name = "Kristoffer Thømt Ravneberg";
   };
+  kritnich = {
+    email = "kritnich@kritni.ch";
+    github = "Kritnich";
+    githubId = 22116767;
+    name = "Kritnich";
+  };
   kroell = {
     email = "nixosmainter@makroell.de";
     github = "rokk4";
diff --git a/nixos/doc/manual/release-notes/rl-2103.xml b/nixos/doc/manual/release-notes/rl-2103.xml
index 09455611fba..0458b3564a9 100644
--- a/nixos/doc/manual/release-notes/rl-2103.xml
+++ b/nixos/doc/manual/release-notes/rl-2103.xml
@@ -461,6 +461,11 @@ self: super:
       mouse section.
      </para>
    </listitem>
+   <listitem>
+    <para>
+     ALSA OSS emulation (<varname>sound.enableOSSEmulation</varname>) is now disabled by default.
+    </para>
+   </listitem>
   </itemizedlist>
  </section>
 
diff --git a/nixos/modules/services/audio/alsa.nix b/nixos/modules/services/audio/alsa.nix
index 3fe76a16540..aff3fe2ba42 100644
--- a/nixos/modules/services/audio/alsa.nix
+++ b/nixos/modules/services/audio/alsa.nix
@@ -32,7 +32,7 @@ in
 
       enableOSSEmulation = mkOption {
         type = types.bool;
-        default = true;
+        default = false;
         description = ''
           Whether to enable ALSA OSS emulation (with certain cards sound mixing may not work!).
         '';
diff --git a/nixos/modules/services/networking/cntlm.nix b/nixos/modules/services/networking/cntlm.nix
index c8e08fdefaa..eea28e12ce0 100644
--- a/nixos/modules/services/networking/cntlm.nix
+++ b/nixos/modules/services/networking/cntlm.nix
@@ -36,12 +36,14 @@ in
     enable = mkEnableOption "cntlm, which starts a local proxy";
 
     username = mkOption {
+      type = types.str;
       description = ''
         Proxy account name, without the possibility to include domain name ('at' sign is interpreted literally).
       '';
     };
 
     domain = mkOption {
+      type = types.str;
       description = "Proxy account domain/workgroup name.";
     };
 
@@ -60,6 +62,7 @@ in
     };
 
     proxy = mkOption {
+      type = types.listOf types.str;
       description = ''
         A list of NTLM/NTLMv2 authenticating HTTP proxies.
 
@@ -75,11 +78,13 @@ in
         A list of domains where the proxy is skipped.
       '';
       default = [];
+      type = types.listOf types.str;
       example = [ "*.example.com" "example.com" ];
     };
 
     port = mkOption {
       default = [3128];
+      type = types.listOf types.port;
       description = "Specifies on which ports the cntlm daemon listens.";
     };
 
diff --git a/pkgs/applications/networking/cluster/starboard/default.nix b/pkgs/applications/networking/cluster/starboard/default.nix
index 3850eb75638..0ce692402e1 100644
--- a/pkgs/applications/networking/cluster/starboard/default.nix
+++ b/pkgs/applications/networking/cluster/starboard/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "starboard";
-  version = "0.8.0";
+  version = "0.9.0";
 
   src = fetchFromGitHub {
     owner = "aquasecurity";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-KRVMgrJ7xtv2SYa249sSDV8PObStAe+UGEgZWv43sk4=";
+    sha256 = "sha256-BzOpP34UumGaAL+vc+lkCKBuK8i0zAWzpMLuPszupQI=";
   };
 
-  vendorSha256 = "sha256-AIMa0lUXFGvhnt8v7l+NIhXLlik5cGYL1OqINNElnx0=";
+  vendorSha256 = "sha256-XOneGFTtoxuHnjGVse15Ypfo7vO3ReeGs46qLG619aM=";
 
   subPackages = [ "cmd/starboard" ];
 
diff --git a/pkgs/applications/networking/mumble/default.nix b/pkgs/applications/networking/mumble/default.nix
index d93e5fbb963..bde8f7c4fed 100644
--- a/pkgs/applications/networking/mumble/default.nix
+++ b/pkgs/applications/networking/mumble/default.nix
@@ -1,6 +1,6 @@
 { lib, stdenv, fetchurl, fetchFromGitHub, fetchpatch, pkg-config, qt5
 , avahi, boost, libopus, libsndfile, protobuf, speex, libcap
-, alsaLib, python
+, alsaLib, python3
 , rnnoise
 , jackSupport ? false, libjack2 ? null
 , speechdSupport ? false, speechd ? null
@@ -25,7 +25,7 @@ let
     patches = (source.patches or [])
       ++ [ ./fix-rnnoise-argument.patch ];
 
-    nativeBuildInputs = [ pkg-config python qt5.qmake ]
+    nativeBuildInputs = [ pkg-config python3 qt5.qmake ]
       ++ (overrides.nativeBuildInputs or [ ]);
 
     buildInputs = [ boost protobuf avahi ]
diff --git a/pkgs/applications/networking/p2p/qbittorrent/default.nix b/pkgs/applications/networking/p2p/qbittorrent/default.nix
index ace528494bc..4c0d391ccaa 100644
--- a/pkgs/applications/networking/p2p/qbittorrent/default.nix
+++ b/pkgs/applications/networking/p2p/qbittorrent/default.nix
@@ -12,13 +12,13 @@ assert trackerSearch -> (python3 != null);
 with lib;
 mkDerivation rec {
   pname = "qbittorrent";
-  version = "4.3.1";
+  version = "4.3.3";
 
   src = fetchFromGitHub {
     owner = "qbittorrent";
     repo = "qbittorrent";
     rev = "release-${version}";
-    sha256 = "17ih00q7idrpl3b2vgh4smva6lazs5jw06pblriscn1lrwdvrc38";
+    sha256 = "0y8vrvfv8n6zg6pgg5a9hmvxi2z9rrfd9k8zv04nv5js91b99ncq";
   };
 
   # NOTE: 2018-05-31: CMake is working but it is not officially supported
diff --git a/pkgs/development/tools/capnproto-java/default.nix b/pkgs/development/tools/capnproto-java/default.nix
new file mode 100644
index 00000000000..95b78b724eb
--- /dev/null
+++ b/pkgs/development/tools/capnproto-java/default.nix
@@ -0,0 +1,35 @@
+{ lib, stdenv, fetchFromGitHub, fetchpatch, capnproto, pkg-config }:
+
+stdenv.mkDerivation rec {
+  pname = "capnproto-java";
+  version = "0.1.5";
+
+  src = fetchFromGitHub {
+    owner = "capnproto";
+    repo = pname;
+    rev = "v${version}";
+    hash = "sha256:1512x70xa6mlg9dmr84r8xbf0jzysjal51ivhhh2ppl97yiqjgls";
+  };
+
+  patches = [
+    # Add make install rule
+    (fetchpatch {
+      url = "https://github.com/capnproto/capnproto-java/commit/e96448d3f5737db25e55cd268652712b69db5cc0.diff";
+      sha256 = "0f3vyap1zsxy675900pzg5ngh7bf9icllm1w04q64g8i91sdzljl";
+    })
+  ];
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [ capnproto ];
+
+  makeFlags = [ "PREFIX=${placeholder "out"}" ];
+
+  meta = with lib; {
+    description = "Cap'n Proto codegen plugin for Java";
+    longDescription = "Only includes compiler plugin, the Java runtime/library that the generated code will link to must be built separately with Maven.";
+    homepage = "https://dwrensha.github.io/capnproto-java/index.html";
+    license = licenses.mit;
+    maintainers = with maintainers; [ bhipple ];
+  };
+}
diff --git a/pkgs/games/wesnoth/default.nix b/pkgs/games/wesnoth/default.nix
index eda6dfb717c..205937028a7 100644
--- a/pkgs/games/wesnoth/default.nix
+++ b/pkgs/games/wesnoth/default.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "wesnoth";
-  version = "1.14.14";
+  version = "1.14.15";
 
   src = fetchFromGitHub {
     rev = version;
     owner = "wesnoth";
     repo = "wesnoth";
-    sha256 = "0rawcm3d1qwf4wxqcbjipl6h30sfv7z70viji28q4givi5hysvka";
+    sha256 = "sha256-HbQy5yhNe6HFydipqh2wWcyLfIjbdRjcBQaqAOtBJsY=";
   };
 
   nativeBuildInputs = [ cmake pkg-config ];
diff --git a/pkgs/servers/teleport/default.nix b/pkgs/servers/teleport/default.nix
index 0b55b82d39e..5cd3448f668 100644
--- a/pkgs/servers/teleport/default.nix
+++ b/pkgs/servers/teleport/default.nix
@@ -1,16 +1,24 @@
 # This file was generated by https://github.com/kamilchm/go2nix v2.0-dev
 { lib, buildGoPackage, zip, fetchFromGitHub }:
+let
+  webassets = fetchFromGitHub {
+    owner = "gravitational";
+    repo = "webassets";
+    rev = "eb98cd28e34144c6473b79743066d1c63c6427ab";
+    sha256 = "001a3bx8yyx1hq8y5yiy1jzp122q8gcl369lj0609gaxp6dk5bdw";
+  };
+in
 
 buildGoPackage rec {
   pname = "teleport";
-  version = "4.2.11";
+  version = "5.1.0";
 
   # This repo has a private submodule "e" which fetchgit cannot handle without failing.
   src = fetchFromGitHub {
     owner = "gravitational";
     repo = "teleport";
     rev = "v${version}";
-    sha256 = "00mkh6rmdgwwhbk3jmxgwl0aisnnqw6q6i5zl1hn69hvdny9liii";
+    sha256 = "0jkr4max6mcn8k5nhlg71byb0yzr9kplpl1q96pdk2gbvkh7q6xb";
   };
 
   goPackagePath = "github.com/gravitational/teleport";
@@ -24,6 +32,7 @@ buildGoPackage rec {
     cd $NIX_BUILD_TOP/go/src/github.com/gravitational/teleport
     mkdir -p build
     echo "making webassets"
+    cp -r ${webassets}/* webassets/
     make build/webassets.zip
     cat build/webassets.zip >> $NIX_BUILD_TOP/go/bin/teleport
     rm -fr build/webassets.zip
diff --git a/pkgs/tools/misc/pcb2gcode/default.nix b/pkgs/tools/misc/pcb2gcode/default.nix
new file mode 100644
index 00000000000..b5675f8287d
--- /dev/null
+++ b/pkgs/tools/misc/pcb2gcode/default.nix
@@ -0,0 +1,46 @@
+{ stdenv
+, lib
+, fetchFromGitHub
+, autoreconfHook
+, pkg-config
+, boost
+, glibmm
+, gtkmm2
+, gerbv
+, librsvg
+, bash
+}:
+
+stdenv.mkDerivation rec {
+  pname = "pcb2gcode";
+  version = "2.1.0";
+
+  src = fetchFromGitHub {
+    owner = "pcb2gcode";
+    repo = "pcb2gcode";
+    rev = "v${version}";
+    sha256 = "0nzglcyh6ban27cc73j4l7w7r9k38qivq0jz8iwnci02pfalw4ry";
+  };
+
+  nativeBuildInputs = [ autoreconfHook pkg-config ];
+
+  buildInputs = [ boost glibmm gtkmm2 gerbv librsvg ];
+
+  postPatch = ''
+    substituteInPlace ./Makefile.am \
+    --replace '`git describe --dirty --always --tags`' '${version}'
+  '';
+
+  meta = with lib; {
+    description = "Command-line tool for isolation, routing and drilling of PCBs ";
+    longDescription = ''
+      pcb2gcode is a command-line software for the isolation, routing and drilling of PCBs.
+      It takes Gerber files as input and it outputs gcode files, suitable for the milling of PCBs.
+      It also includes an Autoleveller, useful for the automatic dynamic calibration of the milling depth.
+    '';
+    homepage = "https://github.com/pcb2gcode/pcb2gcode";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ kritnich ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/tools/security/1password-gui/default.nix b/pkgs/tools/security/1password-gui/default.nix
index ead8aae7d1c..8decd9781ac 100644
--- a/pkgs/tools/security/1password-gui/default.nix
+++ b/pkgs/tools/security/1password-gui/default.nix
@@ -8,11 +8,11 @@
 
 stdenv.mkDerivation rec {
   pname = "1password";
-  version = "0.9.9-3";
+  version = "0.9.10-5";
 
   src = fetchurl {
     url = "https://onepassword.s3.amazonaws.com/linux/appimage/${pname}-${version}.AppImage";
-    hash = "sha256-REuES0yTjTsBHapmj1YLCTIq2cIVtr7Z8ZiEgMCrwrs=";
+    hash = "sha256-eHQZjR3KUQ6SuacKwtV/5hAB0WxoJYulKU4LRn8hlmk=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/tools/security/httpdump/default.nix b/pkgs/tools/security/httpdump/default.nix
new file mode 100644
index 00000000000..c2e5a62969b
--- /dev/null
+++ b/pkgs/tools/security/httpdump/default.nix
@@ -0,0 +1,29 @@
+{ buildGoModule
+, fetchFromGitHub
+, lib
+, libpcap
+}:
+
+buildGoModule rec {
+  pname = "httpdump";
+  version = "20210126-${lib.strings.substring 0 7 rev}";
+  rev = "d2e0deadca5f9ec2544cb252da3c450966d1860e";
+
+  src = fetchFromGitHub {
+    owner = "hsiafan";
+    repo = pname;
+    inherit rev;
+    sha256 = "0yh8kxy1k23lln09b614limwk9y59r7cn5qhbnzc06ga4mxfczv2";
+  };
+
+  vendorSha256 = "0lb1p63lzn1ngj54bar9add7w0azvgcq3azhv9c5glk3ykv9c3iy";
+
+  propagatedBuildInputs = [ libpcap ];
+
+  meta = with lib; {
+    description = "Parse and display HTTP traffic from network device or pcap file";
+    homepage = "https://github.com/hsiafan/httpdump";
+    license = with licenses; [ bsd2 ];
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/tools/security/sudo/default.nix b/pkgs/tools/security/sudo/default.nix
index 1e6af55baab..0f969288a24 100644
--- a/pkgs/tools/security/sudo/default.nix
+++ b/pkgs/tools/security/sudo/default.nix
@@ -6,11 +6,11 @@
 
 stdenv.mkDerivation rec {
   pname = "sudo";
-  version = "1.9.5p1";
+  version = "1.9.5p2";
 
   src = fetchurl {
     url = "https://www.sudo.ws/dist/${pname}-${version}.tar.gz";
-    sha256 = "10kqdfbfpf3vk5ihz5gwynv4pxdf1lg6ircrlanyygb549yg7pad";
+    sha256 = "0y093z4f3822rc88g9asdch12nljdamp817vjxk04mca7ks2x7jk";
   };
 
   prePatch = ''
diff --git a/pkgs/tools/virtualization/ec2instanceconnectcli/default.nix b/pkgs/tools/virtualization/ec2instanceconnectcli/default.nix
new file mode 100644
index 00000000000..4068d71383c
--- /dev/null
+++ b/pkgs/tools/virtualization/ec2instanceconnectcli/default.nix
@@ -0,0 +1,25 @@
+{ lib, buildPythonPackage, fetchPypi, boto3 }:
+
+buildPythonPackage rec {
+  pname = "ec2instanceconnectcli";
+  version = "1.0.2";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "sha256-VaCyCnEhSx1I3bNo57p0IXf92+tO1tT7KSUXzO1IyIU=";
+  };
+
+  propagatedBuildInputs = [ boto3 ];
+
+  # has no tests
+  doCheck = false;
+
+  pythonImportsCheck = [ "ec2instanceconnectcli" ];
+
+  meta = with lib; {
+    description = "Command Line Interface for AWS EC2 Instance Connect";
+    homepage = "https://github.com/aws/aws-ec2-instance-connect-cli";
+    license = licenses.apsl20;
+    maintainers = with maintainers; [ yurrriq ];
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 76bf49b63fa..ef52e0be80f 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -2640,6 +2640,8 @@ in
 
   pbzx = callPackage ../tools/compression/pbzx { };
 
+  pcb2gcode = callPackage ../tools/misc/pcb2gcode { };
+
   persepolis = python3Packages.callPackage ../tools/networking/persepolis {
     wrapQtAppsHook = qt5.wrapQtAppsHook;
   };
@@ -5085,6 +5087,8 @@ in
 
   http-getter = callPackage ../applications/networking/flent/http-getter.nix { };
 
+  httpdump = callPackage ../tools/security/httpdump { };
+
   httpie = callPackage ../tools/networking/httpie { };
 
   httping = callPackage ../tools/networking/httping {};
@@ -13151,6 +13155,8 @@ in
 
   capnproto = callPackage ../development/libraries/capnproto { };
 
+  capnproto-java = callPackage ../development/tools/capnproto-java { };
+
   captive-browser = callPackage ../applications/networking/browsers/captive-browser { };
 
   ndn-cxx = callPackage ../development/libraries/ndn-cxx { };
@@ -23583,7 +23589,6 @@ in
       jackSupport = config.mumble.jackSupport or false;
       speechdSupport = config.mumble.speechdSupport or false;
       pulseSupport = config.pulseaudio or stdenv.isLinux;
-      qt5 = qt514;
     }).mumble;
 
   mumble_overlay = callPackage ../applications/networking/mumble/overlay.nix {
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index b92a8a9f343..13ef9ec9b00 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -2001,6 +2001,8 @@ in {
 
   easywatch = callPackage ../development/python-modules/easywatch { };
 
+  ec2instanceconnectcli = callPackage ../tools/virtualization/ec2instanceconnectcli { };
+
   eccodes = toPythonModule (pkgs.eccodes.override {
     enablePython = true;
     pythonPackages = self;