diff --git a/nixos/modules/services/monitoring/netdata.nix b/nixos/modules/services/monitoring/netdata.nix
index c2ee1c0df7f..561ce3eec62 100644
--- a/nixos/modules/services/monitoring/netdata.nix
+++ b/nixos/modules/services/monitoring/netdata.nix
@@ -8,6 +8,7 @@ let
   wrappedPlugins = pkgs.runCommand "wrapped-plugins" { preferLocalBuild = true; } ''
     mkdir -p $out/libexec/netdata/plugins.d
     ln -s /run/wrappers/bin/apps.plugin $out/libexec/netdata/plugins.d/apps.plugin
+    ln -s /run/wrappers/bin/cgroup-network $out/libexec/netdata/plugins.d/cgroup-network
     ln -s /run/wrappers/bin/freeipmi.plugin $out/libexec/netdata/plugins.d/freeipmi.plugin
     ln -s /run/wrappers/bin/perf.plugin $out/libexec/netdata/plugins.d/perf.plugin
     ln -s /run/wrappers/bin/slabinfo.plugin $out/libexec/netdata/plugins.d/slabinfo.plugin
@@ -26,6 +27,10 @@ let
       "web files owner" = "root";
       "web files group" = "root";
     };
+    "plugin:cgroups" = {
+      "script to get cgroup network interfaces" = "${wrappedPlugins}/libexec/netdata/plugins.d/cgroup-network";
+      "use unified cgroups" = "yes";
+    };
   };
   mkConfig = generators.toINI {} (recursiveUpdate localConfig cfg.config);
   configFile = pkgs.writeText "netdata.conf" (if cfg.configText != null then cfg.configText else mkConfig);
@@ -183,9 +188,6 @@ in {
         ConfigurationDirectory = "netdata";
         ConfigurationDirectoryMode = "0755";
         # Capabilities
-        AmbientCapabilities = [
-          "CAP_SETUID"            # is required for cgroups and cgroups-network plugins
-        ];
         CapabilityBoundingSet = [
           "CAP_DAC_OVERRIDE"      # is required for freeipmi and slabinfo plugins
           "CAP_DAC_READ_SEARCH"   # is required for apps plugin
@@ -214,7 +216,15 @@ in {
       capabilities = "cap_dac_read_search,cap_sys_ptrace+ep";
       owner = cfg.user;
       group = cfg.group;
-      permissions = "u+rx,g+rx,o-rwx";
+      permissions = "u+rx,g+x,o-rwx";
+    };
+
+    security.wrappers."cgroup-network" = {
+      source = "${cfg.package}/libexec/netdata/plugins.d/cgroup-network.org";
+      capabilities = "cap_setuid+ep";
+      owner = cfg.user;
+      group = cfg.group;
+      permissions = "u+rx,g+x,o-rwx";
     };
 
     security.wrappers."freeipmi.plugin" = {
@@ -222,7 +232,7 @@ in {
       capabilities = "cap_dac_override,cap_fowner+ep";
       owner = cfg.user;
       group = cfg.group;
-      permissions = "u+rx,g+rx,o-rwx";
+      permissions = "u+rx,g+x,o-rwx";
     };
 
     security.wrappers."perf.plugin" = {
@@ -230,7 +240,7 @@ in {
       capabilities = "cap_sys_admin+ep";
       owner = cfg.user;
       group = cfg.group;
-      permissions = "u+rx,g+rx,o-rx";
+      permissions = "u+rx,g+x,o-rwx";
     };
 
     security.wrappers."slabinfo.plugin" = {
@@ -238,7 +248,7 @@ in {
       capabilities = "cap_dac_override+ep";
       owner = cfg.user;
       group = cfg.group;
-      permissions = "u+rx,g+rx,o-rx";
+      permissions = "u+rx,g+x,o-rwx";
     };
 
     security.pam.loginLimits = [
diff --git a/pkgs/applications/misc/overmind/default.nix b/pkgs/applications/misc/overmind/default.nix
index 537ae3741ef..80a423a3c83 100644
--- a/pkgs/applications/misc/overmind/default.nix
+++ b/pkgs/applications/misc/overmind/default.nix
@@ -1,9 +1,8 @@
-{ lib, buildGoPackage, fetchFromGitHub, tmux, which, makeWrapper }:
+{ lib, buildGoModule, fetchFromGitHub, tmux, which, makeWrapper }:
 
-buildGoPackage rec {
+buildGoModule rec {
   pname = "overmind";
-  version = "2.2.0";
-  goPackagePath = "github.com/DarthSim/overmind";
+  version = "2.2.2";
 
   nativeBuildInputs = [ makeWrapper ];
 
@@ -15,10 +14,10 @@ buildGoPackage rec {
     owner = "DarthSim";
     repo = pname;
     rev = "v${version}";
-    sha256 = "00v6l4138vv32bqfkzrhk4hfl52a00rlg9ywhp4difgrnz7zj6xb";
+    sha256 = "zDjIwnhDoUj+zTAhtBa94dx7QhYMCTxv2DNUpeP8CP0=";
   };
 
-  goDeps = ./deps.nix;
+  vendorSha256 = "KDMzR6qAruscgS6/bHTN6RnHOlLKCm9lxkr9k3oLY+Y=";
 
   meta = with lib; {
     homepage = "https://github.com/DarthSim/overmind";
diff --git a/pkgs/applications/misc/overmind/deps.nix b/pkgs/applications/misc/overmind/deps.nix
deleted file mode 100644
index b4c9211a24a..00000000000
--- a/pkgs/applications/misc/overmind/deps.nix
+++ /dev/null
@@ -1,129 +0,0 @@
-# file generated from go.mod using vgo2nix (https://github.com/adisbladis/vgo2nix)
-[
-  {
-    goPackagePath = "github.com/BurntSushi/toml";
-    fetch = {
-      type = "git";
-      url = "https://github.com/BurntSushi/toml";
-      rev = "v0.3.1";
-      sha256 = "1fjdwwfzyzllgiwydknf1pwjvy49qxfsczqx5gz3y0izs7as99j6";
-    };
-  }
-  {
-    goPackagePath = "github.com/DarthSim/godotenv";
-    fetch = {
-      type = "git";
-      url = "https://github.com/DarthSim/godotenv";
-      rev = "v1.3.1";
-      sha256 = "0fb9nl5qrnv7f9w0pgg00ak34afw9kjgcql0l38z22faz2bhgl1q";
-    };
-  }
-  {
-    goPackagePath = "github.com/cpuguy83/go-md2man";
-    fetch = {
-      type = "git";
-      url = "https://github.com/cpuguy83/go-md2man";
-      rev = "f79a8a8ca69d";
-      sha256 = "0r1f7v475dxxgzqci1mxfliwadcrk86ippflx9n411325l4g3ghv";
-    };
-  }
-  {
-    goPackagePath = "github.com/kardianos/osext";
-    fetch = {
-      type = "git";
-      url = "https://github.com/kardianos/osext";
-      rev = "2bc1f35cddc0";
-      sha256 = "1pvrbrvmrf4mx0fxbfaphbzgqgwn8v6lkfk2vyrs0znxrs1xyc5r";
-    };
-  }
-  {
-    goPackagePath = "github.com/matoous/go-nanoid";
-    fetch = {
-      type = "git";
-      url = "https://github.com/matoous/go-nanoid";
-      rev = "eab626deece6";
-      sha256 = "1a82lclk56y7c44jg7wn5vq733dmn0g20r5yqbchrxnpfl75dw89";
-    };
-  }
-  {
-    goPackagePath = "github.com/pmezard/go-difflib";
-    fetch = {
-      type = "git";
-      url = "https://github.com/pmezard/go-difflib";
-      rev = "v1.0.0";
-      sha256 = "0c1cn55m4rypmscgf0rrb88pn58j3ysvc2d0432dp3c6fqg6cnzw";
-    };
-  }
-  {
-    goPackagePath = "github.com/russross/blackfriday";
-    fetch = {
-      type = "git";
-      url = "https://github.com/russross/blackfriday";
-      rev = "v2.0.1";
-      sha256 = "0nlz7isdd4rgnwzs68499hlwicxz34j2k2a0b8jy0y7ycd2bcr5j";
-    };
-  }
-  {
-    goPackagePath = "github.com/sevlyar/go-daemon";
-    fetch = {
-      type = "git";
-      url = "https://github.com/sevlyar/go-daemon";
-      rev = "v0.1.5";
-      sha256 = "1y3gnxaifykcjcbzx91lz9bc93b95w3xj4rjxjbii26pm3j7gqyk";
-    };
-  }
-  {
-    goPackagePath = "github.com/shurcooL/sanitized_anchor_name";
-    fetch = {
-      type = "git";
-      url = "https://github.com/shurcooL/sanitized_anchor_name";
-      rev = "v1.0.0";
-      sha256 = "1gv9p2nr46z80dnfjsklc6zxbgk96349sdsxjz05f3z6wb6m5l8f";
-    };
-  }
-  {
-    goPackagePath = "github.com/urfave/cli";
-    fetch = {
-      type = "git";
-      url = "https://github.com/urfave/cli";
-      rev = "v1.22.2";
-      sha256 = "10mcnvi5qmn00vpyk6si8gjka7p654wr9hac4zc9w5h3ickhvbdc";
-    };
-  }
-  {
-    goPackagePath = "golang.org/x/crypto";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/crypto";
-      rev = "88737f569e3a";
-      sha256 = "02vkqfd6kc28zm6lffagw8nr78sayv6jabfgk9dcifl7826vi3k7";
-    };
-  }
-  {
-    goPackagePath = "golang.org/x/sys";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/sys";
-      rev = "81d4e9dc473e";
-      sha256 = "0074zjpkhclz5qbgjv0zmdwy6hmf5k2ri5yagnm6i12ahxaa48dr";
-    };
-  }
-  {
-    goPackagePath = "gopkg.in/check.v1";
-    fetch = {
-      type = "git";
-      url = "https://gopkg.in/check.v1";
-      rev = "20d25e280405";
-      sha256 = "0k1m83ji9l1a7ng8a7v40psbymxasmssbrrhpdv2wl4rhs0nc3np";
-    };
-  }
-  {
-    goPackagePath = "gopkg.in/yaml.v2";
-    fetch = {
-      type = "git";
-      url = "https://gopkg.in/yaml.v2";
-      rev = "v2.2.2";
-      sha256 = "01wj12jzsdqlnidpyjssmj0r4yavlqy7dwrg7adqd8dicjc4ncsa";
-    };
-  }
-]
diff --git a/pkgs/applications/networking/instant-messengers/jackline/default.nix b/pkgs/applications/networking/instant-messengers/jackline/default.nix
index 4c067e384f9..89d4931a2fe 100644
--- a/pkgs/applications/networking/instant-messengers/jackline/default.nix
+++ b/pkgs/applications/networking/instant-messengers/jackline/default.nix
@@ -4,7 +4,7 @@ with ocamlPackages;
 
 buildDunePackage rec {
   pname = "jackline";
-  version = "unstable-2020-09-03";
+  version = "unstable-2021-04-23";
 
   minimumOCamlVersion = "4.08";
 
@@ -13,8 +13,8 @@ buildDunePackage rec {
   src = fetchFromGitHub {
     owner  = "hannesm";
     repo   = "jackline";
-    rev    = "dd5f19636c9b99b72c348f0f639452d87b7c017c";
-    sha256 = "076smdgig4nwvqsqxa6gsl0c3daq5agwgzp4n2y8xxm3qiq91y89";
+    rev    = "861c59bb7cd27ad5c7558ff94cb0d0e8dca249e5";
+    sha256 = "00waw5qr0n70i9l9b25r9ryfi836x4qrj046bb4k9qa4d0p8q1sa";
   };
 
   nativeBuildInpts = [
diff --git a/pkgs/applications/networking/nym/default.nix b/pkgs/applications/networking/nym/default.nix
index 9251862ba6e..b7bffcd694e 100644
--- a/pkgs/applications/networking/nym/default.nix
+++ b/pkgs/applications/networking/nym/default.nix
@@ -1,8 +1,11 @@
-{ lib
+{ stdenv
+, lib
 , rustPlatform
 , fetchFromGitHub
 , pkg-config
 , openssl
+, Security
+, libiconv
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -20,7 +23,7 @@ rustPlatform.buildRustPackage rec {
 
   nativeBuildInputs = [ pkg-config ];
 
-  buildInputs = [ openssl ];
+  buildInputs = [ openssl ] ++ lib.optionals stdenv.isDarwin [ Security libiconv ];
 
   patches = [ ./ignore-networking-tests.patch ];
   checkType = "debug";
@@ -36,6 +39,6 @@ rustPlatform.buildRustPackage rec {
     homepage = "https://nymtech.net";
     license = licenses.asl20;
     maintainers = [ maintainers.ehmry ];
-    platforms = with platforms; intersectLists (linux ++ darwin) (concatLists [ x86 x86_64 aarch64 arm ]);
+    platforms = platforms.all;
   };
 }
diff --git a/pkgs/development/ocaml-modules/awa/default.nix b/pkgs/development/ocaml-modules/awa/default.nix
index 49d614cda88..14f99bb6f8d 100644
--- a/pkgs/development/ocaml-modules/awa/default.nix
+++ b/pkgs/development/ocaml-modules/awa/default.nix
@@ -8,14 +8,14 @@
 
 buildDunePackage rec {
   pname = "awa";
-  version = "0.0.1";
+  version = "0.0.3";
 
   minimumOCamlVersion = "4.07";
   useDune2 = true;
 
   src = fetchurl {
     url = "https://github.com/mirage/awa-ssh/releases/download/v${version}/awa-v${version}.tbz";
-    sha256 = "c1d604645517b191184a5800f5c48a6a9a3e5a2fce4a0e2ecfeee74586301400";
+    sha256 = "5a7927363ffe672cccf12d5425386e84f6f553a17ffec2b01ae5dc28180c831a";
   };
 
   nativeBuildInputs = [ ppx_sexp_conv ppx_cstruct ];
diff --git a/pkgs/development/ocaml-modules/ca-certs-nss/default.nix b/pkgs/development/ocaml-modules/ca-certs-nss/default.nix
new file mode 100644
index 00000000000..5e6691a9feb
--- /dev/null
+++ b/pkgs/development/ocaml-modules/ca-certs-nss/default.nix
@@ -0,0 +1,55 @@
+{ lib
+, buildDunePackage
+, fetchurl
+, rresult
+, mirage-crypto
+, mirage-clock
+, x509
+, logs
+, fmt
+, hex
+, bos
+, astring
+, cmdliner
+, alcotest
+}:
+
+buildDunePackage rec {
+  pname = "ca-certs-nss";
+  version = "3.64.0.1";
+
+  minimumOCamlVersion = "4.07";
+
+  src = fetchurl {
+    url = "https://github.com/mirage/ca-certs-nss/releases/download/v${version}/ca-certs-nss-v${version}.tbz";
+    sha256 = "909c64076491647471f785527bfdd9a886a34504edabf88542b43f27b86067f9";
+  };
+
+  useDune2 = true;
+
+  propagatedBuildInputs = [
+    rresult
+    mirage-crypto
+    mirage-clock
+    x509
+  ];
+
+  buildInputs = [
+    logs
+    fmt
+    hex
+    bos
+    astring
+    cmdliner
+  ];
+
+  doCheck = true;
+  checkInputs = [ alcotest ];
+
+  meta = with lib; {
+    license = licenses.isc;
+    description = "X.509 trust anchors extracted from Mozilla's NSS";
+    maintainers = [ maintainers.sternenseemann ];
+    homepage = "https://github.com/mirage/ca-certs-nss";
+  };
+}
diff --git a/pkgs/development/ocaml-modules/ca-certs/default.nix b/pkgs/development/ocaml-modules/ca-certs/default.nix
index dacc181f751..acf869dbd27 100644
--- a/pkgs/development/ocaml-modules/ca-certs/default.nix
+++ b/pkgs/development/ocaml-modules/ca-certs/default.nix
@@ -1,24 +1,28 @@
 { lib, buildDunePackage, fetchurl
 , bos, fpath, rresult, ptime, mirage-crypto, x509, astring, logs
+, cacert, alcotest
 }:
 
 buildDunePackage rec {
   pname = "ca-certs";
-  version = "0.2.0";
+  version = "0.2.1";
 
   minimumOCamlVersion = "4.07";
 
   src = fetchurl {
     url = "https://github.com/mirage/ca-certs/releases/download/v${version}/ca-certs-v${version}.tbz";
-    sha256 = "15jfb5zvahs90jsfs7ridqihlka5198z2xrvplj8ddchxfmpx868";
+    sha256 = "d43109496a5129feff967d557c556af96f8b10456896a405c43b7cf0c35d0af3";
   };
 
   useDune2 = true;
 
   propagatedBuildInputs = [ bos fpath rresult ptime mirage-crypto x509 astring logs ];
 
-  # tests need access to network and systemwide ca cert chain
-  doCheck = false;
+  doCheck = true;
+  checkInputs = [
+    cacert    # for /etc/ssl/certs/ca-bundle.crt
+    alcotest
+  ];
 
   meta = with lib; {
     description = "Detect root CA certificates from the operating system";
diff --git a/pkgs/development/ocaml-modules/carton/default.nix b/pkgs/development/ocaml-modules/carton/default.nix
index 31b864e29d3..c10537d5d50 100644
--- a/pkgs/development/ocaml-modules/carton/default.nix
+++ b/pkgs/development/ocaml-modules/carton/default.nix
@@ -7,19 +7,19 @@
 
 buildDunePackage rec {
   pname = "carton";
-  version = "0.4.0";
+  version = "0.4.1";
 
   useDune2 = true;
   minimumOCamlVersion = "4.08";
 
   src = fetchurl {
     url = "https://github.com/mirage/ocaml-git/releases/download/${pname}-v${version}/${pname}-${pname}-v${version}.tbz";
-    sha256 = "777f9692b83cd63570c17527a32c5045818ab9242d923cbbde72fc23d0da0140";
+    sha256 = "d16aad5560d9ab1e3b4d93d2e8fdea638c216ff47338fb630a8aefd22b452665";
   };
 
   # remove changelogs for mimic and the git* packages
   postPatch = ''
-    rm CHANGES.md CHANGES.mimic.md
+    rm CHANGES.md
   '';
 
   buildInputs = [
diff --git a/pkgs/development/ocaml-modules/checkseum/default.nix b/pkgs/development/ocaml-modules/checkseum/default.nix
index 81009981047..527afec33eb 100644
--- a/pkgs/development/ocaml-modules/checkseum/default.nix
+++ b/pkgs/development/ocaml-modules/checkseum/default.nix
@@ -1,23 +1,46 @@
-{ lib, fetchurl, buildDunePackage, dune-configurator
+{ lib, fetchurl, buildDunePackage, dune-configurator, pkg-config
 , bigarray-compat, optint
-, fmt, rresult
-, alcotest
+, fmt, rresult, bos, fpath, astring, alcotest
+, withFreestanding ? false
+, ocaml-freestanding
 }:
 
 buildDunePackage rec {
-  version = "0.2.1";
+  version = "0.3.1";
   pname = "checkseum";
 
   useDune2 = true;
 
+  minimumOCamlVersion = "4.07";
+
   src = fetchurl {
     url = "https://github.com/mirage/checkseum/releases/download/v${version}/checkseum-v${version}.tbz";
-    sha256 = "1swb44c64pcs4dh9ka9lig6d398qwwkd3kkiajicww6qk7jbh3n5";
+    sha256 = "b9e4d054e17618b1faed8c0eb15afe0614b2f093e58b59a180bda4500a5d2da1";
   };
 
-  buildInputs = [ dune-configurator fmt rresult ];
-  propagatedBuildInputs = [ bigarray-compat optint ];
-  checkInputs = lib.optionals doCheck [ alcotest ];
+  patches = [
+    ./makefile-no-opam.patch
+  ];
+
+  nativeBuildInputs = [
+    dune-configurator
+    pkg-config
+  ];
+  propagatedBuildInputs = [
+    bigarray-compat
+    optint
+  ] ++ lib.optionals withFreestanding [
+    ocaml-freestanding
+  ];
+
+  checkInputs = [
+    alcotest
+    bos
+    astring
+    fmt
+    fpath
+    rresult
+  ];
 
   doCheck = true;
 
diff --git a/pkgs/development/ocaml-modules/checkseum/makefile-no-opam.patch b/pkgs/development/ocaml-modules/checkseum/makefile-no-opam.patch
new file mode 100644
index 00000000000..49fb41b2e00
--- /dev/null
+++ b/pkgs/development/ocaml-modules/checkseum/makefile-no-opam.patch
@@ -0,0 +1,12 @@
+diff --git a/freestanding/Makefile b/freestanding/Makefile
+index d535050..bb286bd 100644
+--- a/freestanding/Makefile
++++ b/freestanding/Makefile
+@@ -1,4 +1,6 @@
+-PKG_CONFIG_PATH := $(shell opam config var prefix)/lib/pkgconfig
++ifneq (, $(shell command -v opam))
++PKG_CONFIG_PATH ?= $(shell opam var prefix)/lib/pkgconfig
++endif
+ 
+ EXISTS := $(shell PKG_CONFIG_PATH=$(PKG_CONFIG_PATH) pkg-config --exists ocaml-freestanding; echo $$?)
+ 
diff --git a/pkgs/development/ocaml-modules/cohttp/async.nix b/pkgs/development/ocaml-modules/cohttp/async.nix
index 21e22533f1b..060d2c6fb6a 100644
--- a/pkgs/development/ocaml-modules/cohttp/async.nix
+++ b/pkgs/development/ocaml-modules/cohttp/async.nix
@@ -1,22 +1,60 @@
-{ lib, buildDunePackage, async, cohttp, conduit-async, uri, ppx_sexp_conv
-, logs, magic-mime }:
+{ lib
+, buildDunePackage
+, ppx_sexp_conv
+, base
+, async
+, async_kernel
+, async_unix
+, cohttp
+, conduit-async
+, uri
+, uri-sexp
+, logs
+, fmt
+, sexplib0
+, ipaddr
+, magic-mime
+, ounit
+, mirage-crypto
+, core
+}:
 
-if !lib.versionAtLeast cohttp.version "0.99" then
-  cohttp
-else if !lib.versionAtLeast async.version "0.13" then
-  throw "cohttp-async needs async-0.13 (hence OCaml >= 4.08)"
-else
+buildDunePackage {
+  pname = "cohttp-async";
 
-  buildDunePackage {
-    pname = "cohttp-async";
-    useDune2 = true;
-    inherit (cohttp) version src;
+  inherit (cohttp)
+    version
+    src
+    minimumOCamlVersion
+    useDune2
+    ;
 
-    buildInputs = [ ppx_sexp_conv ];
+  buildInputs = [ ppx_sexp_conv ];
 
-    propagatedBuildInputs = [ async cohttp conduit-async logs magic-mime uri ];
+  propagatedBuildInputs = [
+    cohttp
+    conduit-async
+    async_kernel
+    async_unix
+    async
+    base
+    magic-mime
+    logs
+    fmt
+    sexplib0
+    uri
+    uri-sexp
+    ipaddr
+  ];
 
-    meta = cohttp.meta // {
-      description = "CoHTTP implementation for the Async concurrency library";
-    };
-  }
+  doCheck = true;
+  checkInputs = [
+    ounit
+    mirage-crypto
+    core
+  ];
+
+  meta = cohttp.meta // {
+    description = "CoHTTP implementation for the Async concurrency library";
+  };
+}
diff --git a/pkgs/development/ocaml-modules/cohttp/default.nix b/pkgs/development/ocaml-modules/cohttp/default.nix
index 1cbc43bc280..c1dc973d0ee 100644
--- a/pkgs/development/ocaml-modules/cohttp/default.nix
+++ b/pkgs/development/ocaml-modules/cohttp/default.nix
@@ -1,25 +1,24 @@
 { lib, fetchurl, buildDunePackage
-, ppx_fields_conv, ppx_sexp_conv, stdlib-shims
-, base64, fieldslib, jsonm, re, stringext, uri-sexp
+, ppx_sexp_conv, base64, jsonm, re, stringext, uri-sexp
 , ocaml, fmt, alcotest
 }:
 
 buildDunePackage rec {
   pname = "cohttp";
-  version = "2.5.5";
+  version = "4.0.0";
 
   useDune2 = true;
 
-  minimumOCamlVersion = "4.04.1";
+  minimumOCamlVersion = "4.08";
 
   src = fetchurl {
     url = "https://github.com/mirage/ocaml-cohttp/releases/download/v${version}/cohttp-v${version}.tbz";
-    sha256 = "0ywmql4lp6ps2gd064ixbjzsdnnn5vk3pipm005sswl553qqwaim";
+    sha256 = "bd7aa4cd2c82744990ed7c49e3ee7a40324c64cb3d8509804809155e2bacd1d2";
   };
 
-  buildInputs = [ jsonm ppx_fields_conv ppx_sexp_conv ];
+  buildInputs = [ jsonm ppx_sexp_conv ];
 
-  propagatedBuildInputs = [ base64 fieldslib re stringext uri-sexp stdlib-shims ];
+  propagatedBuildInputs = [ base64 re stringext uri-sexp ];
 
   doCheck = lib.versionAtLeast ocaml.version "4.05";
   checkInputs = [ fmt alcotest ];
diff --git a/pkgs/development/ocaml-modules/cohttp/lwt-unix.nix b/pkgs/development/ocaml-modules/cohttp/lwt-unix.nix
index 845df2a3f54..57885b0e65e 100644
--- a/pkgs/development/ocaml-modules/cohttp/lwt-unix.nix
+++ b/pkgs/development/ocaml-modules/cohttp/lwt-unix.nix
@@ -1,19 +1,28 @@
 { lib, buildDunePackage, cohttp-lwt
-, conduit-lwt-unix, ppx_sexp_conv
-, cmdliner, fmt, magic-mime
+, conduit-lwt-unix, conduit-lwt, ppx_sexp_conv
+, cmdliner, fmt, logs, magic-mime
+, ounit
+, cacert
 }:
 
-if !lib.versionAtLeast cohttp-lwt.version "0.99"
-then cohttp-lwt
-else
-
 buildDunePackage {
   pname = "cohttp-lwt-unix";
-  inherit (cohttp-lwt) version src meta;
+  inherit (cohttp-lwt) version src;
 
   useDune2 = true;
 
   buildInputs = [ cmdliner ppx_sexp_conv ];
 
-  propagatedBuildInputs = [ cohttp-lwt conduit-lwt-unix fmt magic-mime ];
+  propagatedBuildInputs = [
+    cohttp-lwt conduit-lwt conduit-lwt-unix fmt logs magic-mime
+  ];
+
+  # TODO(@sternenseemann): fail for unknown reason
+  # https://github.com/mirage/ocaml-cohttp/issues/675#issuecomment-830692742
+  doCheck = false;
+  checkInputs = [ ounit cacert ];
+
+  meta = cohttp-lwt.meta // {
+    description = "CoHTTP implementation for Unix and Windows using Lwt";
+  };
 }
diff --git a/pkgs/development/ocaml-modules/cohttp/lwt.nix b/pkgs/development/ocaml-modules/cohttp/lwt.nix
index 36831d94613..158aa3b27b2 100644
--- a/pkgs/development/ocaml-modules/cohttp/lwt.nix
+++ b/pkgs/development/ocaml-modules/cohttp/lwt.nix
@@ -1,16 +1,21 @@
-{ lib, buildDunePackage, cohttp, ocaml_lwt, uri, ppx_sexp_conv, logs }:
-
-if !lib.versionAtLeast cohttp.version "0.99"
-then cohttp
-else if !lib.versionAtLeast ppx_sexp_conv.version "0.13"
-then throw "cohttp-lwt is not available for ppx_sexp_conv version ${ppx_sexp_conv.version}"
-else
+{ lib, buildDunePackage, cohttp, ocaml_lwt, uri, ppx_sexp_conv, logs, sexplib0 }:
 
 buildDunePackage {
   pname = "cohttp-lwt";
-  inherit (cohttp) version src useDune2 meta;
+  inherit (cohttp)
+    version
+    src
+    useDune2
+    minimumOCamlVersion
+    ;
 
-  buildInputs = [ uri ppx_sexp_conv ];
+  buildInputs = [ ppx_sexp_conv ];
 
-  propagatedBuildInputs = [ cohttp ocaml_lwt logs ];
+  propagatedBuildInputs = [
+    cohttp ocaml_lwt logs sexplib0 uri
+  ];
+
+  meta = cohttp.meta // {
+    description = "CoHTTP implementation using the Lwt concurrency library";
+  };
 }
diff --git a/pkgs/development/ocaml-modules/cohttp/mirage.nix b/pkgs/development/ocaml-modules/cohttp/mirage.nix
index e7b172349cb..d2d3e945645 100644
--- a/pkgs/development/ocaml-modules/cohttp/mirage.nix
+++ b/pkgs/development/ocaml-modules/cohttp/mirage.nix
@@ -2,6 +2,7 @@
 , mirage-flow, mirage-channel, mirage-kv
 , conduit, conduit-mirage, lwt
 , astring, magic-mime
+, ppx_sexp_conv
 }:
 
 buildDunePackage {
@@ -9,6 +10,8 @@ buildDunePackage {
 
   inherit (cohttp) version src minimumOCamlVersion useDune2;
 
+  nativeBuildInputs = [ ppx_sexp_conv ];
+
   propagatedBuildInputs = [
     mirage-flow mirage-channel conduit conduit-mirage mirage-kv
     lwt cohttp cohttp-lwt astring magic-mime
diff --git a/pkgs/development/ocaml-modules/conduit/async.nix b/pkgs/development/ocaml-modules/conduit/async.nix
index c15ad0520fb..e78cb2bc516 100644
--- a/pkgs/development/ocaml-modules/conduit/async.nix
+++ b/pkgs/development/ocaml-modules/conduit/async.nix
@@ -1,17 +1,17 @@
-{ lib, buildDunePackage, async, async_ssl, ppx_sexp_conv, conduit }:
-
-if !lib.versionAtLeast conduit.version "1.0"
-then conduit
-else
+{ lib, buildDunePackage, async, async_ssl, ppx_sexp_conv, ppx_here, uri, conduit }:
 
 buildDunePackage {
   pname = "conduit-async";
-  useDune2 = true;
-  inherit (conduit) version src;
+  inherit (conduit)
+    version
+    src
+    minimumOCamlVersion
+    useDune2
+    ;
 
-  buildInputs = [ ppx_sexp_conv ];
+  buildInputs = [ ppx_sexp_conv ppx_here ];
 
-  propagatedBuildInputs = [ async async_ssl conduit ];
+  propagatedBuildInputs = [ async async_ssl conduit uri ];
 
   meta = conduit.meta // {
     description = "A network connection establishment library for Async";
diff --git a/pkgs/development/ocaml-modules/conduit/default.nix b/pkgs/development/ocaml-modules/conduit/default.nix
index 8c9b757f87c..96f5bf43d21 100644
--- a/pkgs/development/ocaml-modules/conduit/default.nix
+++ b/pkgs/development/ocaml-modules/conduit/default.nix
@@ -5,18 +5,18 @@
 
 buildDunePackage rec {
   pname = "conduit";
-  version = "2.2.2";
+  version = "4.0.0";
   useDune2 = true;
 
-  minimumOCamlVersion = "4.07";
+  minimumOCamlVersion = "4.03";
 
   src = fetchurl {
-    url = "https://github.com/mirage/ocaml-conduit/releases/download/v2.2.2/conduit-v2.2.2.tbz";
-    sha256 = "1zb83w2pq9c8xrappfxa6y5q93772f5dj22x78camsm77a2c2z55";
+    url = "https://github.com/mirage/ocaml-conduit/releases/download/v${version}/conduit-v${version}.tbz";
+    sha256 = "74b29d72bf47adc5d5c4cae6130ad5a2a4923118b9c571331bd1cb3c56decd2a";
   };
 
   buildInputs = [ ppx_sexp_conv ];
-  propagatedBuildInputs = [ astring ipaddr ipaddr-sexp sexplib uri ];
+  propagatedBuildInputs = [ astring ipaddr ipaddr-sexp sexplib uri logs ];
 
   meta = {
     description = "A network connection establishment library";
diff --git a/pkgs/development/ocaml-modules/conduit/lwt-unix.nix b/pkgs/development/ocaml-modules/conduit/lwt-unix.nix
index ab6449b50a1..ce6016012d7 100644
--- a/pkgs/development/ocaml-modules/conduit/lwt-unix.nix
+++ b/pkgs/development/ocaml-modules/conduit/lwt-unix.nix
@@ -1,18 +1,31 @@
 { buildDunePackage
-, conduit-lwt, ppx_sexp_conv, ocaml_lwt, uri, ipaddr, ipaddr-sexp
-, lwt_ssl, tls
+, conduit-lwt, ppx_sexp_conv, ocaml_lwt, uri, ipaddr, ipaddr-sexp, ca-certs, logs
+, lwt_ssl, tls, lwt_log, ssl
 }:
 
 buildDunePackage {
   pname = "conduit-lwt-unix";
-  inherit (conduit-lwt) version src minimumOCamlVersion;
-
-  useDune2 = true;
+  inherit (conduit-lwt) version src minimumOCamlVersion useDune2;
 
   buildInputs = [ ppx_sexp_conv ];
 
-  propagatedBuildInputs =
-    [ conduit-lwt ocaml_lwt uri ipaddr ipaddr-sexp tls lwt_ssl ];
+  propagatedBuildInputs = [
+    conduit-lwt
+    ocaml_lwt
+    uri
+    ipaddr
+    ipaddr-sexp
+    tls
+    ca-certs
+    logs
+    lwt_ssl
+  ];
+
+  doCheck = true;
+  checkInputs = [
+    lwt_log
+    ssl
+  ];
 
   meta = conduit-lwt.meta // {
     description = "A network connection establishment library for Lwt_unix";
diff --git a/pkgs/development/ocaml-modules/conduit/mirage.nix b/pkgs/development/ocaml-modules/conduit/mirage.nix
index 6100908f785..d1f636be93c 100644
--- a/pkgs/development/ocaml-modules/conduit/mirage.nix
+++ b/pkgs/development/ocaml-modules/conduit/mirage.nix
@@ -1,7 +1,8 @@
 { buildDunePackage, conduit-lwt
-, ppx_sexp_conv, sexplib, cstruct, mirage-stack, mirage-flow
+, ppx_sexp_conv, sexplib, uri, cstruct, mirage-stack, mirage-flow
 , mirage-flow-combinators, mirage-random, mirage-time, mirage-clock
 , dns-client, vchan, xenstore, tls, tls-mirage, ipaddr, ipaddr-sexp
+, tcpip, ca-certs-nss
 }:
 
 buildDunePackage {
@@ -12,10 +13,10 @@ buildDunePackage {
   nativeBuildInputs = [ ppx_sexp_conv ];
 
   propagatedBuildInputs = [
-    sexplib cstruct mirage-stack mirage-clock mirage-flow
+    sexplib uri cstruct mirage-stack mirage-clock mirage-flow
     mirage-flow-combinators mirage-random mirage-time
     dns-client conduit-lwt vchan xenstore tls tls-mirage
-    ipaddr ipaddr-sexp
+    ipaddr ipaddr-sexp tcpip ca-certs-nss
   ];
 
   meta = conduit-lwt.meta // {
diff --git a/pkgs/development/ocaml-modules/curly/default.nix b/pkgs/development/ocaml-modules/curly/default.nix
index 1c48b509c41..20197e207af 100644
--- a/pkgs/development/ocaml-modules/curly/default.nix
+++ b/pkgs/development/ocaml-modules/curly/default.nix
@@ -1,5 +1,6 @@
 { stdenv, lib, buildDunePackage, fetchurl, ocaml
-, result, alcotest, cohttp-lwt-unix, odoc, curl }:
+, result, alcotest, cohttp-lwt-unix, odoc, curl, cacert
+}:
 
 buildDunePackage rec {
   pname = "curly";
@@ -15,8 +16,9 @@ buildDunePackage rec {
   };
 
   propagatedBuildInputs = [ result ];
-  checkInputs = [ alcotest cohttp-lwt-unix ];
+  checkInputs = [ alcotest cohttp-lwt-unix cacert ];
   # test dependencies are only available for >= 4.08
+  # https://github.com/mirage/ca-certs/issues/16
   doCheck = lib.versionAtLeast ocaml.version "4.08"
     # Some test fails in macOS sandbox
     # > Fatal error: exception Unix.Unix_error(Unix.EPERM, "bind", "")
diff --git a/pkgs/development/ocaml-modules/decompress/default.nix b/pkgs/development/ocaml-modules/decompress/default.nix
index d2cba68d732..505ffe3c425 100644
--- a/pkgs/development/ocaml-modules/decompress/default.nix
+++ b/pkgs/development/ocaml-modules/decompress/default.nix
@@ -4,7 +4,7 @@
 }:
 
 buildDunePackage rec {
-  version = "1.3.0";
+  version = "1.4.0";
   pname = "decompress";
 
   minimumOCamlVersion = "4.07";
@@ -13,7 +13,7 @@ buildDunePackage rec {
 
   src = fetchurl {
     url = "https://github.com/mirage/decompress/releases/download/v${version}/decompress-v${version}.tbz";
-    sha256 = "de149896939be13fedec46a4581121d5ab74850a2241d08e6aa8ae4bb18c52c4";
+    sha256 = "d1669e07446d73dd5e16f020d4a1682abcbb1b7a1e3bf19b805429636c26a19b";
   };
 
   buildInputs = [ cmdliner ];
diff --git a/pkgs/development/ocaml-modules/dns/certify.nix b/pkgs/development/ocaml-modules/dns/certify.nix
index 1835114d707..31b39d18225 100644
--- a/pkgs/development/ocaml-modules/dns/certify.nix
+++ b/pkgs/development/ocaml-modules/dns/certify.nix
@@ -1,6 +1,6 @@
 { buildDunePackage, dns, dns-tsig, dns-mirage, randomconv, x509
 , mirage-random, mirage-time, mirage-clock, mirage-stack
-, logs, mirage-crypto-pk, mirage-crypto-rng, tls, lwt
+, logs, mirage-crypto-pk, mirage-crypto-rng, mirage-crypto-ec, lwt
 }:
 
 buildDunePackage {
@@ -21,7 +21,7 @@ buildDunePackage {
     logs
     mirage-crypto-pk
     mirage-crypto-rng
-    tls
+    mirage-crypto-ec
     lwt
   ];
 
diff --git a/pkgs/development/ocaml-modules/dns/default.nix b/pkgs/development/ocaml-modules/dns/default.nix
index 4f0b95da6cb..8a5115f10f0 100644
--- a/pkgs/development/ocaml-modules/dns/default.nix
+++ b/pkgs/development/ocaml-modules/dns/default.nix
@@ -4,14 +4,14 @@
 
 buildDunePackage rec {
   pname = "dns";
-  version = "4.6.3";
+  version = "5.0.1";
 
   useDune2 = true;
   minimumOCamlVersion = "4.07";
 
   src = fetchurl {
     url = "https://github.com/mirage/ocaml-dns/releases/download/v${version}/dns-v${version}.tbz";
-    sha256 = "0g7xw43jm5hv0w9lsnhhi0w3243mxl615cdsvz29yh39fcqvqsdy";
+    sha256 = "72c0a1a91c8e409bd448c8e0ea28d16d13177c326aea403ee1c30ddcb5969adc";
   };
 
   propagatedBuildInputs = [ rresult astring fmt logs ptime domain-name gmap cstruct ipaddr lru duration metrics ];
diff --git a/pkgs/development/ocaml-modules/git/cohttp-mirage.nix b/pkgs/development/ocaml-modules/git/cohttp-mirage.nix
deleted file mode 100644
index d3088400641..00000000000
--- a/pkgs/development/ocaml-modules/git/cohttp-mirage.nix
+++ /dev/null
@@ -1,18 +0,0 @@
-{ lib, buildDunePackage
-, git, mimic, cohttp-mirage, cohttp, cohttp-lwt
-, fmt, lwt, result, rresult, uri
-}:
-
-buildDunePackage {
-  pname = "git-cohttp-mirage";
-
-  inherit (git) version src minimumOCamlVersion useDune2;
-
-  propagatedBuildInputs = [
-    git mimic cohttp-mirage cohttp cohttp-lwt fmt lwt result rresult uri
-  ];
-
-  meta = git.meta // {
-    description = "A package to use HTTP-based ocaml-git with MirageOS backend";
-  };
-}
diff --git a/pkgs/development/ocaml-modules/git/default.nix b/pkgs/development/ocaml-modules/git/default.nix
index b8d73178d09..954e4956c81 100644
--- a/pkgs/development/ocaml-modules/git/default.nix
+++ b/pkgs/development/ocaml-modules/git/default.nix
@@ -1,30 +1,35 @@
 { stdenv, lib, fetchurl, buildDunePackage
 , alcotest, mtime, mirage-crypto-rng, tls, git-binary
 , angstrom, astring, cstruct, decompress, digestif, encore, duff, fmt, checkseum
-, fpath, ke, logs, lwt, ocamlgraph, uri, rresult, base64
+, fpath, ke, logs, lwt, ocamlgraph, uri, rresult, base64, hxd
 , result, bigstringaf, optint, mirage-flow, domain-name, emile
 , mimic, carton, carton-lwt, carton-git, ipaddr, psq, crowbar, alcotest-lwt
 }:
 
 buildDunePackage rec {
   pname = "git";
-  version = "3.3.3";
+  version = "3.4.0";
 
   minimumOCamlVersion = "4.08";
   useDune2 = true;
 
   src = fetchurl {
     url = "https://github.com/mirage/ocaml-git/releases/download/${version}/git-${version}.tbz";
-    sha256 = "0j8pw9w74bfhrjsqr8zm8g7h1az94z9vg7qgc6z6649zm9yjiax3";
+    sha256 = "6eef1240c7c85a8e495b82ef863c509ad41d75e0c45cf73c34ed1bdafd03413f";
   };
 
+  # remove changelog for the carton package
+  postPatch = ''
+    rm CHANGES.carton.md
+  '';
+
   buildInputs = [
     base64
   ];
   propagatedBuildInputs = [
     angstrom astring checkseum cstruct decompress digestif encore duff fmt fpath
     ke logs lwt ocamlgraph uri rresult result bigstringaf optint mirage-flow
-    domain-name emile mimic carton carton-lwt carton-git ipaddr psq
+    domain-name emile mimic carton carton-lwt carton-git ipaddr psq hxd
   ];
   checkInputs = [
     alcotest alcotest-lwt mtime mirage-crypto-rng tls git-binary crowbar
diff --git a/pkgs/development/ocaml-modules/git/paf.nix b/pkgs/development/ocaml-modules/git/paf.nix
new file mode 100644
index 00000000000..cf0272ddf3b
--- /dev/null
+++ b/pkgs/development/ocaml-modules/git/paf.nix
@@ -0,0 +1,49 @@
+{ lib, buildDunePackage
+, git
+, mimic
+, paf
+, ca-certs-nss
+, cohttp
+, cohttp-lwt
+, fmt
+, ipaddr
+, logs
+, lwt
+, mirage-clock
+, mirage-stack
+, mirage-time
+, result
+, rresult
+, tls
+, uri
+}:
+
+buildDunePackage {
+  pname = "git-paf";
+
+  inherit (git) version src minimumOCamlVersion useDune2;
+
+  propagatedBuildInputs = [
+    git
+    mimic
+    paf
+    ca-certs-nss
+    cohttp
+    cohttp-lwt
+    fmt
+    lwt
+    result
+    rresult
+    ipaddr
+    logs
+    mirage-clock
+    mirage-stack
+    mirage-time
+    tls
+    uri
+  ];
+
+  meta = git.meta // {
+    description = "A package to use HTTP-based ocaml-git with MirageOS backend";
+  };
+}
diff --git a/pkgs/development/ocaml-modules/git/unix.nix b/pkgs/development/ocaml-modules/git/unix.nix
index f4cea472886..3e5f464cea0 100644
--- a/pkgs/development/ocaml-modules/git/unix.nix
+++ b/pkgs/development/ocaml-modules/git/unix.nix
@@ -6,7 +6,8 @@
 , tcpip, awa-mirage, mirage-flow
 , alcotest, alcotest-lwt, base64, cstruct
 , ke, mirage-crypto-rng, ocurl, git-binary
-, ptime
+, ptime, mimic, ca-certs-nss, tls, tls-mirage
+, cacert
 }:
 
 buildDunePackage {
@@ -24,10 +25,14 @@ buildDunePackage {
     fmt bos fpath uri digestif logs lwt
     astring cohttp-lwt-unix decompress
     domain-name ipaddr mtime mirage-flow
+    cstruct ptime mimic ca-certs-nss
+    tls tls-mirage
   ];
   checkInputs = [
-    alcotest alcotest-lwt base64 cstruct ke
-    mirage-crypto-rng ocurl git-binary ptime
+    alcotest alcotest-lwt base64 ke
+    mirage-crypto-rng git-binary
+    cohttp-lwt-unix
+    cacert # sets up NIX_SSL_CERT_FILE
   ];
   doCheck = true;
 
diff --git a/pkgs/development/ocaml-modules/irmin/containers.nix b/pkgs/development/ocaml-modules/irmin/containers.nix
index 761e9bf5619..76383099a41 100644
--- a/pkgs/development/ocaml-modules/irmin/containers.nix
+++ b/pkgs/development/ocaml-modules/irmin/containers.nix
@@ -1,6 +1,6 @@
 { buildDunePackage
 , irmin, irmin-unix, irmin-git, ppx_irmin, lwt, mtime
-, alcotest, alcotest-lwt
+, alcotest, alcotest-lwt, cacert
 }:
 
 buildDunePackage {
@@ -18,7 +18,7 @@ buildDunePackage {
 
   doCheck = true;
   checkInputs = [
-    alcotest alcotest-lwt
+    alcotest alcotest-lwt cacert
   ];
 
   meta = ppx_irmin.meta // {
diff --git a/pkgs/development/ocaml-modules/irmin/git.nix b/pkgs/development/ocaml-modules/irmin/git.nix
index a6c1e8af8fa..d477c932928 100644
--- a/pkgs/development/ocaml-modules/irmin/git.nix
+++ b/pkgs/development/ocaml-modules/irmin/git.nix
@@ -1,7 +1,7 @@
 { lib, buildDunePackage
 , git, irmin, irmin-test, ppx_irmin, git-cohttp-unix, git-unix
 , digestif, cstruct, fmt, astring, fpath, logs, lwt, uri
-, mtime, alcotest
+, mtime, alcotest, cacert
 }:
 
 buildDunePackage {
@@ -26,7 +26,7 @@ buildDunePackage {
     uri
   ];
 
-  checkInputs = [ mtime alcotest git-cohttp-unix git-unix irmin-test ];
+  checkInputs = [ mtime alcotest git-cohttp-unix git-unix irmin-test cacert ];
 
   doCheck = true;
 
diff --git a/pkgs/development/ocaml-modules/irmin/graphql.nix b/pkgs/development/ocaml-modules/irmin/graphql.nix
index ca205cac4e1..03c8f1eca29 100644
--- a/pkgs/development/ocaml-modules/irmin/graphql.nix
+++ b/pkgs/development/ocaml-modules/irmin/graphql.nix
@@ -1,5 +1,5 @@
 { lib, buildDunePackage, cohttp-lwt, graphql-cohttp, graphql-lwt, irmin
-, alcotest, alcotest-lwt, logs, yojson, cohttp-lwt-unix
+, alcotest, alcotest-lwt, logs, yojson, cohttp-lwt-unix, cacert
 }:
 
 buildDunePackage rec {
@@ -19,6 +19,7 @@ buildDunePackage rec {
     logs
     cohttp-lwt-unix
     yojson
+    cacert
   ];
 
   meta = irmin.meta // {
diff --git a/pkgs/development/ocaml-modules/irmin/http.nix b/pkgs/development/ocaml-modules/irmin/http.nix
index b50e0b87345..7bfae998202 100644
--- a/pkgs/development/ocaml-modules/irmin/http.nix
+++ b/pkgs/development/ocaml-modules/irmin/http.nix
@@ -1,5 +1,6 @@
 { lib, buildDunePackage, cohttp-lwt, irmin, webmachine
 , checkseum, git-unix, irmin-git, irmin-test, digestif, git-cohttp-unix
+, cacert
 }:
 
 buildDunePackage rec {
@@ -12,7 +13,9 @@ buildDunePackage rec {
 
   propagatedBuildInputs = [ cohttp-lwt irmin webmachine ];
 
-  checkInputs = [ digestif checkseum git-cohttp-unix git-unix irmin-git irmin-test ];
+  checkInputs = [
+    digestif checkseum git-cohttp-unix git-unix irmin-git irmin-test cacert
+  ];
 
   doCheck = true;
 
diff --git a/pkgs/development/ocaml-modules/irmin/mirage-git.nix b/pkgs/development/ocaml-modules/irmin/mirage-git.nix
index dfa84ff2335..e33b766bd4c 100644
--- a/pkgs/development/ocaml-modules/irmin/mirage-git.nix
+++ b/pkgs/development/ocaml-modules/irmin/mirage-git.nix
@@ -1,6 +1,6 @@
 { buildDunePackage, irmin-mirage, irmin-git
 , mirage-kv, cohttp, conduit-lwt, conduit-mirage
-, git-cohttp-mirage, fmt, git, lwt, mirage-clock, uri
+, git-paf, fmt, git, lwt, mirage-clock, uri
 }:
 
 buildDunePackage {
@@ -15,7 +15,7 @@ buildDunePackage {
     cohttp
     conduit-lwt
     conduit-mirage
-    git-cohttp-mirage
+    git-paf
     fmt
     git
     lwt
diff --git a/pkgs/development/ocaml-modules/irmin/ppx.nix b/pkgs/development/ocaml-modules/irmin/ppx.nix
index 7c59e1eaef3..c7eed70d9d9 100644
--- a/pkgs/development/ocaml-modules/irmin/ppx.nix
+++ b/pkgs/development/ocaml-modules/irmin/ppx.nix
@@ -2,11 +2,11 @@
 
 buildDunePackage rec {
   pname = "ppx_irmin";
-  version = "2.5.3";
+  version = "2.6.0";
 
   src = fetchurl {
     url = "https://github.com/mirage/irmin/releases/download/${version}/irmin-${version}.tbz";
-    sha256 = "2c8ef24cc57379c3a138f121fea350ee7b6077abc22a4fdc6a47d0c81585f3f6";
+    sha256 = "1db134221e82c424260a0e206b640fcb82902be35eea4137af2bcd9c98d3ac0f";
   };
 
   minimumOCamlVersion = "4.08";
diff --git a/pkgs/development/ocaml-modules/irmin/unix.nix b/pkgs/development/ocaml-modules/irmin/unix.nix
index a3dfb5d508c..89cf36979bd 100644
--- a/pkgs/development/ocaml-modules/irmin/unix.nix
+++ b/pkgs/development/ocaml-modules/irmin/unix.nix
@@ -1,7 +1,7 @@
 { lib, buildDunePackage
 , checkseum, cmdliner, git-unix, git-cohttp-unix, yaml, fpath
 , irmin, irmin-fs, irmin-git, irmin-graphql, irmin-http
-, irmin-pack, irmin-watcher, irmin-test
+, irmin-pack, irmin-watcher, irmin-test, cacert
 }:
 
 buildDunePackage rec {
@@ -18,7 +18,9 @@ buildDunePackage rec {
     irmin-pack irmin-watcher git-cohttp-unix
   ];
 
-  checkInputs = lib.optional doCheck irmin-test;
+  checkInputs = [
+    irmin-test cacert
+  ];
 
   doCheck = true;
 
diff --git a/pkgs/development/ocaml-modules/letsencrypt/default.nix b/pkgs/development/ocaml-modules/letsencrypt/default.nix
index b3c0d4f8941..0a70bf30242 100644
--- a/pkgs/development/ocaml-modules/letsencrypt/default.nix
+++ b/pkgs/development/ocaml-modules/letsencrypt/default.nix
@@ -31,11 +31,11 @@
 
 buildDunePackage rec {
   pname = "letsencrypt";
-  version = "0.2.4";
+  version = "0.2.5";
 
   src = fetchurl {
     url = "https://github.com/mmaker/ocaml-letsencrypt/releases/download/v${version}/letsencrypt-v${version}.tbz";
-    sha256 = "91c79828a50243804da29c17563c54d2d528a79207e5b874dce6a3e7fedf7567";
+    sha256 = "6e3bbb5f593823d49e83e698c06cf9ed48818695ec8318507b311ae74731e607";
   };
 
   minimumOCamlVersion = "4.08";
diff --git a/pkgs/development/ocaml-modules/mimic/default.nix b/pkgs/development/ocaml-modules/mimic/default.nix
index 3ddae57e9e8..ea163642703 100644
--- a/pkgs/development/ocaml-modules/mimic/default.nix
+++ b/pkgs/development/ocaml-modules/mimic/default.nix
@@ -1,27 +1,23 @@
 { lib, buildDunePackage, fetchurl
-, fmt, mirage-flow, result, rresult, cstruct, logs, ke
+, fmt, mirage-flow, result, rresult, cstruct, logs, ke, lwt
 , alcotest, alcotest-lwt, bigstringaf, bigarray-compat
 }:
 
 buildDunePackage rec {
   pname = "mimic";
-  version = "0.0.2";
+  version = "0.0.3";
 
   minimumOCamlVersion = "4.08";
   useDune2 = true;
 
   src = fetchurl {
-    url = "https://github.com/mirage/ocaml-git/releases/download/${pname}-v${version}/${pname}-${pname}-v${version}.tbz";
-    sha256 = "3ad5af3caa1120ecfdf022de41ba5be8edfbf50270fc99238b82d3d2d6e7c317";
+    url = "https://github.com/dinosaure/mimic/releases/download/${version}/mimic-${version}.tbz";
+    sha256 = "e4743cd2e4f8242eb1ce9d8086fd2affba0eb6a62131309ffa279108bd3dbbcb";
   };
 
-  # don't install changelogs for other packages
-  postPatch = ''
-    rm -f CHANGES.md CHANGES.carton.md
-  '';
-
   propagatedBuildInputs = [
     fmt
+    lwt
     mirage-flow
     result
     rresult
diff --git a/pkgs/development/ocaml-modules/mirage/runtime.nix b/pkgs/development/ocaml-modules/mirage/runtime.nix
index 50121ad6280..aaa51aa276c 100644
--- a/pkgs/development/ocaml-modules/mirage/runtime.nix
+++ b/pkgs/development/ocaml-modules/mirage/runtime.nix
@@ -3,7 +3,7 @@
 
 buildDunePackage rec {
   pname = "mirage-runtime";
-  version = "3.10.1";
+  version = "3.10.3";
 
   useDune2 = true;
 
@@ -11,7 +11,7 @@ buildDunePackage rec {
 
   src = fetchurl {
     url = "https://github.com/mirage/mirage/releases/download/v${version}/mirage-v${version}.tbz";
-    sha256 = "1glmsz2znhfkk4w6d6nsr7q5jqvivhmi8zwagzw2d8pah0c8bhm4";
+    sha256 = "7c8059ef9e330eaef1ed51c0d89afe17900310f8083a426cd8099602222c2281";
   };
 
   propagatedBuildInputs = [ ipaddr functoria-runtime fmt logs ocaml_lwt ];
diff --git a/pkgs/development/ocaml-modules/optint/default.nix b/pkgs/development/ocaml-modules/optint/default.nix
index 7f8ded5feb6..2227f6e033c 100644
--- a/pkgs/development/ocaml-modules/optint/default.nix
+++ b/pkgs/development/ocaml-modules/optint/default.nix
@@ -1,12 +1,12 @@
 { lib, buildDunePackage, fetchurl }:
 
 buildDunePackage rec {
-  minimumOCamlVersion = "4.03";
-  version = "0.0.4";
+  minimumOCamlVersion = "4.07";
+  version = "0.1.0";
   pname = "optint";
   src = fetchurl {
     url = "https://github.com/mirage/optint/releases/download/v${version}/optint-v${version}.tbz";
-    sha256 = "1a7gabxqmfvii8qnxq1clx43md2h9glskxhac8y8r0rhzblx3s1a";
+    sha256 = "27847660223c16cc7eaf8fcd9d5589a0b802114330a2529578f8007d3b01185d";
   };
 
   useDune2 = true;
diff --git a/pkgs/development/ocaml-modules/paf/default.nix b/pkgs/development/ocaml-modules/paf/default.nix
index 0c91051e243..375ba1c125e 100644
--- a/pkgs/development/ocaml-modules/paf/default.nix
+++ b/pkgs/development/ocaml-modules/paf/default.nix
@@ -5,6 +5,7 @@
 , mirage-stack
 , mirage-time
 , httpaf
+, h2
 , tls-mirage
 , mimic
 , cohttp-lwt
@@ -31,11 +32,11 @@
 
 buildDunePackage rec {
   pname = "paf";
-  version = "0.0.1";
+  version = "0.0.3";
 
   src = fetchurl {
     url = "https://github.com/dinosaure/paf-le-chien/releases/download/${version}/paf-${version}.tbz";
-    sha256 = "7a794c21ce458bda302553b0f5ac128c067579fbb3b7b8fba9b410446c43e790";
+    sha256 = "a0bbb84b19e1f0255337fc4d7017f3ea3611b241746e391b11c1d8b1f5f30a2b";
   };
 
   useDune2 = true;
@@ -45,6 +46,7 @@ buildDunePackage rec {
     mirage-stack
     mirage-time
     httpaf
+    h2
     tls-mirage
     mimic
     cohttp-lwt
diff --git a/pkgs/development/ocaml-modules/tls/default.nix b/pkgs/development/ocaml-modules/tls/default.nix
index 2ee01ed8219..dadeb5a98ea 100644
--- a/pkgs/development/ocaml-modules/tls/default.nix
+++ b/pkgs/development/ocaml-modules/tls/default.nix
@@ -1,17 +1,17 @@
 { lib, fetchurl, buildDunePackage, ppx_sexp_conv, ppx_cstruct, cstruct
 , cstruct-sexp, sexplib, mirage-crypto, mirage-crypto-pk, mirage-crypto-rng
-, x509, domain-name, fmt, cstruct-unix, ounit2, ocaml_lwt, ptime
-, hacl_x25519, fiat-p256, hkdf, logs, alcotest }:
+, x509, domain-name, fmt, cstruct-unix, ounit2, ocaml_lwt, ptime, rresult
+, mirage-crypto-ec, hkdf, logs, alcotest }:
 
 buildDunePackage rec {
   minimumOCamlVersion = "4.08";
 
-  version = "0.12.8";
+  version = "0.13.1";
   pname = "tls";
 
   src = fetchurl {
     url = "https://github.com/mirleft/ocaml-tls/releases/download/v${version}/tls-v${version}.tbz";
-    sha256 = "0sgppvfnamfnsglw1cl801i1xqkxbs33g40kwmmqj2vqjcarm26a";
+    sha256 = "ca95fa59a82f7d38b0b495fc0cd1ff54e7728492a292895d0067c1ba9de81b7b";
   };
 
   useDune2 = true;
@@ -21,8 +21,8 @@ buildDunePackage rec {
 
   propagatedBuildInputs = [ ppx_sexp_conv ppx_cstruct cstruct cstruct-sexp
                             sexplib mirage-crypto mirage-crypto-pk mirage-crypto-rng
-                            x509 domain-name fmt ocaml_lwt ptime hacl_x25519 fiat-p256
-                            hkdf logs ];
+                            x509 domain-name fmt ocaml_lwt ptime mirage-crypto-ec
+                            hkdf logs rresult ];
 
   meta = with lib; {
     homepage = "https://github.com/mirleft/ocaml-tls";
diff --git a/pkgs/development/ocaml-modules/tls/mirage.nix b/pkgs/development/ocaml-modules/tls/mirage.nix
index ad81c03c35d..18d0f08357d 100644
--- a/pkgs/development/ocaml-modules/tls/mirage.nix
+++ b/pkgs/development/ocaml-modules/tls/mirage.nix
@@ -1,6 +1,6 @@
 { buildDunePackage, tls
 , x509, lwt, fmt, mirage-flow, mirage-kv, mirage-clock, ptime
-, mirage-crypto, mirage-crypto-pk, hacl_x25519, fiat-p256
+, mirage-crypto, mirage-crypto-pk, mirage-crypto-ec
 }:
 
 buildDunePackage {
@@ -19,8 +19,7 @@ buildDunePackage {
     ptime
     mirage-crypto
     mirage-crypto-pk
-    hacl_x25519
-    fiat-p256
+    mirage-crypto-ec
   ];
 
   meta = tls.meta // {
diff --git a/pkgs/development/ocaml-modules/x509/default.nix b/pkgs/development/ocaml-modules/x509/default.nix
index 637105361fd..0ce57b07168 100644
--- a/pkgs/development/ocaml-modules/x509/default.nix
+++ b/pkgs/development/ocaml-modules/x509/default.nix
@@ -8,11 +8,11 @@ buildDunePackage rec {
   minimumOCamlVersion = "4.07";
 
   pname = "x509";
-  version = "0.12.0";
+  version = "0.13.0";
 
   src = fetchurl {
     url = "https://github.com/mirleft/ocaml-x509/releases/download/v${version}/x509-v${version}.tbz";
-    sha256 = "04g59j8sn8am0z0a94h8cyvr6cqzd5gkn2lj6g51nb5dkwajj19h";
+    sha256 = "4577c2a616bda45cc777869fc44e272397d63a029135a993df8937bcfd6f6c49";
   };
 
   useDune2 = true;
diff --git a/pkgs/development/python-modules/pycflow2dot/default.nix b/pkgs/development/python-modules/pycflow2dot/default.nix
new file mode 100644
index 00000000000..db1ac8fabb2
--- /dev/null
+++ b/pkgs/development/python-modules/pycflow2dot/default.nix
@@ -0,0 +1,41 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, cflow
+, graphviz
+, pydot
+, networkx
+, which
+}:
+
+buildPythonPackage rec {
+  pname = "pycflow2dot";
+  version = "0.2.3";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "1zm8x2pd0q6zza0fw7hg9g1qvybfnjq6ql9b8mh2fc45l7l25655";
+  };
+
+  propagatedBuildInputs = [
+    cflow
+    graphviz
+    pydot
+    networkx
+    which
+  ];
+
+  pythonImportsCheck = [ "pycflow2dot" ];
+  checkPhase = ''
+    cd tests
+    export PATH=$out/bin:$PATH
+    make all
+  '';
+
+  meta = with lib; {
+    description = "Layout C call graphs from cflow using GraphViz dot";
+    homepage    = "https://github.com/johnyf/pycflow2dot";
+    license     = licenses.gpl3Plus;
+    maintainers = with maintainers; [ evils ];
+  };
+}
diff --git a/pkgs/development/python-modules/pysonos/default.nix b/pkgs/development/python-modules/pysonos/default.nix
index 3219bd53ac1..e4296a4f0b5 100644
--- a/pkgs/development/python-modules/pysonos/default.nix
+++ b/pkgs/development/python-modules/pysonos/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "pysonos";
-  version = "0.0.44";
+  version = "0.0.45";
 
   disabled = !isPy3k;
 
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "amelchio";
     repo = pname;
     rev = "v${version}";
-    sha256 = "108818mkb037zs4ikilrskfppcbmqslsm6zaxmy8pphjh7c299mz";
+    sha256 = "0wzmrd9ja5makvsgf0ckil99wr8vw91dml8fi9miiq4la0100q0n";
   };
 
   propagatedBuildInputs = [ ifaddr requests xmltodict ];
diff --git a/pkgs/development/python-modules/tablib/default.nix b/pkgs/development/python-modules/tablib/default.nix
index 5216fc7d0d9..b6754e15ad5 100644
--- a/pkgs/development/python-modules/tablib/default.nix
+++ b/pkgs/development/python-modules/tablib/default.nix
@@ -2,6 +2,7 @@
 , odfpy
 , openpyxl
 , pandas
+, setuptools-scm
 , pytest
 , pytestcov
 , pyyaml
@@ -20,6 +21,7 @@ buildPythonPackage rec {
     sha256 = "f83cac08454f225a34a305daa20e2110d5e6335135d505f93bc66583a5f9c10d";
   };
 
+  nativeBuildInputs = [ setuptools-scm ];
   propagatedBuildInputs = [ xlwt openpyxl pyyaml xlrd odfpy ];
   checkInputs = [ pytest pytestcov unicodecsv pandas ];
 
diff --git a/pkgs/development/tools/golangci-lint/default.nix b/pkgs/development/tools/golangci-lint/default.nix
index 83bc3f473d3..647e8b58490 100644
--- a/pkgs/development/tools/golangci-lint/default.nix
+++ b/pkgs/development/tools/golangci-lint/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "golangci-lint";
-  version = "1.39.0";
+  version = "1.40.0";
 
   src = fetchFromGitHub {
     owner = "golangci";
     repo = "golangci-lint";
     rev = "v${version}";
-    sha256 = "0c9yka27k4v1waijk7mn7k31l5a373sclykypflchy7xnlrsa18v";
+    sha256 = "sha256-/AKDwX4W9MCPXNy2izSGTugLV8DVX4A2djZla8bqDCs=";
   };
 
-  vendorSha256 = "1685iv1lsal462c8xqvs76x9dwvbwazrak902j0p12s0fyb66lpl";
+  vendorSha256 = "sha256-HkVt0Nkq7+gvn5VNeROAmuhlCFGYx2niWb1NwJfLtRc=";
 
   doCheck = false;
 
diff --git a/pkgs/misc/vim-plugins/generated.nix b/pkgs/misc/vim-plugins/generated.nix
index a0eb16763f7..459f768a379 100644
--- a/pkgs/misc/vim-plugins/generated.nix
+++ b/pkgs/misc/vim-plugins/generated.nix
@@ -183,6 +183,18 @@ let
     meta.homepage = "https://github.com/vmchale/ats-vim/";
   };
 
+  aurora = buildVimPluginFrom2Nix {
+    pname = "aurora";
+    version = "2021-05-10";
+    src = fetchFromGitHub {
+      owner = "ray-x";
+      repo = "aurora";
+      rev = "bf185b9c5aaaad7cfd20f29f92d3b77164f8f1e7";
+      sha256 = "17ir0daw3rsfgprgvrskip2r19g15z05spdk14dz105nrgv4hh4y";
+    };
+    meta.homepage = "https://github.com/ray-x/aurora/";
+  };
+
   auto-git-diff = buildVimPluginFrom2Nix {
     pname = "auto-git-diff";
     version = "2019-09-23";
@@ -389,12 +401,12 @@ let
 
   chadtree = buildVimPluginFrom2Nix {
     pname = "chadtree";
-    version = "2021-05-10";
+    version = "2021-05-11";
     src = fetchFromGitHub {
       owner = "ms-jpq";
       repo = "chadtree";
-      rev = "d6ddb11b13a28f858344cdfafbe4d76fe032803a";
-      sha256 = "0wr6m0i0lj5dpp0rbqyx534jnwpmrrywjq55xai5z799dh4in42k";
+      rev = "2ccce5fa035176b51fa628ba6c672dedf78813e8";
+      sha256 = "0nrxxwf4wy6g5222qf4bjbyai8gym1k0b4wdyjpldfk5pdxd81zg";
     };
     meta.homepage = "https://github.com/ms-jpq/chadtree/";
   };
@@ -702,12 +714,12 @@ let
 
   context_filetype-vim = buildVimPluginFrom2Nix {
     pname = "context_filetype-vim";
-    version = "2021-03-04";
+    version = "2021-05-11";
     src = fetchFromGitHub {
       owner = "Shougo";
       repo = "context_filetype.vim";
-      rev = "f5e4ed8f7847cd5474017459c2a0f2dfd2bf971c";
-      sha256 = "039mnsd6k0sgs8l1a8ngl3y817c8g657nv8v9bdw9h8l5a934cb2";
+      rev = "39a552866c83946127f244912b6d408525f03364";
+      sha256 = "0m2w4f3bn8miplxb9q76fcipdkc9lbfyp47193q57s555b1g0x0k";
     };
     meta.homepage = "https://github.com/Shougo/context_filetype.vim/";
   };
@@ -1473,6 +1485,18 @@ let
     meta.homepage = "https://github.com/ncm2/float-preview.nvim/";
   };
 
+  floating-nvim = buildVimPluginFrom2Nix {
+    pname = "floating-nvim";
+    version = "2021-05-08";
+    src = fetchFromGitHub {
+      owner = "fhill2";
+      repo = "floating.nvim";
+      rev = "c47af010aa8e88758995858f0ed2771a99cd3e98";
+      sha256 = "0cvs6c903bq4jk4l197vvdrk8q85rl7z7iy7cvd5m4k7yd937r50";
+    };
+    meta.homepage = "https://github.com/fhill2/floating.nvim/";
+  };
+
   floobits-neovim = buildVimPluginFrom2Nix {
     pname = "floobits-neovim";
     version = "2018-08-01";
@@ -1503,8 +1527,8 @@ let
     src = fetchFromGitHub {
       owner = "rafamadriz";
       repo = "friendly-snippets";
-      rev = "83de9287ad388f55b7d74f66b8ea5b89bb6abf24";
-      sha256 = "13jp8bg85yyxyl390ymrp6qasg4p6a57x08m2l9ld8wiq33ps6yp";
+      rev = "9178101a99226fb4a973fd88ba6e84972c7b0a94";
+      sha256 = "1dy9b5ipzs412sz31mqqrr6rfjs24569pw17z9b3z40dipmzg1x8";
     };
     meta.homepage = "https://github.com/rafamadriz/friendly-snippets/";
   };
@@ -1533,6 +1557,18 @@ let
     meta.homepage = "https://github.com/shumphrey/fugitive-gitlab.vim/";
   };
 
+  fwatch-nvim = buildVimPluginFrom2Nix {
+    pname = "fwatch-nvim";
+    version = "2021-04-26";
+    src = fetchFromGitHub {
+      owner = "rktjmp";
+      repo = "fwatch.nvim";
+      rev = "5fd6bff00d7fa432cdc847819563dad90bcf649d";
+      sha256 = "1jc3kv0w3767593p9capif3p0msf8ac5xal170757ghfiy2jhsp9";
+    };
+    meta.homepage = "https://github.com/rktjmp/fwatch.nvim/";
+  };
+
   fzf-lsp-nvim = buildVimPluginFrom2Nix {
     pname = "fzf-lsp-nvim";
     version = "2021-02-04";
@@ -4127,6 +4163,18 @@ let
     meta.homepage = "https://github.com/osyo-manga/shabadou.vim/";
   };
 
+  Shade-nvim = buildVimPluginFrom2Nix {
+    pname = "Shade-nvim";
+    version = "2021-04-29";
+    src = fetchFromGitHub {
+      owner = "sunjon";
+      repo = "Shade.nvim";
+      rev = "0196387bba50b8d36cec99cd6483583ff2dedb42";
+      sha256 = "0831k71gm8rpl54x63v7mgp9i1fgxydp2wig3yyd98dc7z9d8f48";
+    };
+    meta.homepage = "https://github.com/sunjon/Shade.nvim/";
+  };
+
   ShowMultiBase = buildVimPluginFrom2Nix {
     pname = "ShowMultiBase";
     version = "2010-10-18";
@@ -7087,12 +7135,12 @@ let
 
   vim-matchup = buildVimPluginFrom2Nix {
     pname = "vim-matchup";
-    version = "2021-05-09";
+    version = "2021-05-10";
     src = fetchFromGitHub {
       owner = "andymass";
       repo = "vim-matchup";
-      rev = "2032562ba91b9904fdbaac8a586d93fc69d5aec6";
-      sha256 = "1d38dx5s89113iglbji3q4va3hnjqa6cx141faldp283v39y2qv2";
+      rev = "ea2612d87a38ef2261f66063571eef06689bbb8e";
+      sha256 = "0a7dxvl8p3n8kfm1abm1k2r9l6s230585521scgh8y1sh88zkpay";
     };
     meta.homepage = "https://github.com/andymass/vim-matchup/";
   };
diff --git a/pkgs/misc/vim-plugins/vim-plugin-names b/pkgs/misc/vim-plugins/vim-plugin-names
index 50b26968f8c..8dd07b20256 100644
--- a/pkgs/misc/vim-plugins/vim-plugin-names
+++ b/pkgs/misc/vim-plugins/vim-plugin-names
@@ -131,6 +131,7 @@ fatih/vim-go
 fcpg/vim-osc52
 FelikZ/ctrlp-py-matcher
 fenetikm/falcon
+fhill2/floating.nvim
 fiatjaf/neuron.vim
 fisadev/vim-isort
 flazz/vim-colorschemes
@@ -520,6 +521,7 @@ raghur/fruzzy
 raghur/vim-ghost
 Raimondi/delimitMate
 rakr/vim-one
+ray-x/aurora
 rbgrouleff/bclose.vim
 rbong/vim-flog
 rhysd/committia.vim
@@ -530,6 +532,7 @@ rhysd/vim-grammarous
 rhysd/vim-operator-surround
 RishabhRD/nvim-lsputils
 RishabhRD/popfix
+rktjmp/fwatch.nvim@main
 rktjmp/lush.nvim@main
 rmagatti/auto-session@main
 rodjek/vim-puppet
@@ -596,6 +599,7 @@ steelsojka/completion-buffers
 stefandtw/quickfix-reflector.vim
 stephpy/vim-yaml
 sunaku/vim-dasht
+sunjon/Shade.nvim
 svermeulen/vim-subversive
 t9md/vim-choosewin
 t9md/vim-smalls
diff --git a/pkgs/os-specific/linux/zfs/default.nix b/pkgs/os-specific/linux/zfs/default.nix
index adfd0cda819..6db953ae4ef 100644
--- a/pkgs/os-specific/linux/zfs/default.nix
+++ b/pkgs/os-specific/linux/zfs/default.nix
@@ -182,13 +182,9 @@ let
         license = licenses.cddl;
         platforms = platforms.linux;
         maintainers = with maintainers; [ hmenke jcumming jonringer wizeman fpletz globin mic92 ];
-        broken = if
-          buildKernel && (kernelCompatible != null) && !kernelCompatible
-          then builtins.trace ''
-            Linux v${kernel.version} is not yet supported by zfsonlinux v${version}.
-            ${lib.optionalString (!isUnstable) "Try zfsUnstable or set the NixOS option boot.zfs.enableUnstable."}
-          '' true
-          else false;
+        # If your Linux kernel version is not yet supported by zfs, try zfsUnstable.
+        # On NixOS set the option boot.zfs.enableUnstable.
+        broken = buildKernel && (kernelCompatible != null) && !kernelCompatible;
       };
     };
 in {
@@ -207,12 +203,12 @@ in {
 
   zfsUnstable = common {
     # check the release notes for compatible kernels
-    kernelCompatible = kernel.kernelAtLeast "3.10" && kernel.kernelOlder "5.12";
+    kernelCompatible = kernel.kernelAtLeast "3.10" && kernel.kernelOlder "5.13";
 
     # this package should point to a version / git revision compatible with the latest kernel release
-    version = "2.1.0-rc4";
+    version = "2.1.0-rc5";
 
-    sha256 = "sha256-eakOEA7LCJOYDsZH24Y5JbEd2wh1KfCN+qX3QxQZ4e8=";
+    sha256 = "sha256-cj0P2bw6sTO+Y74pYn/WEpBuVGMMYCreJQjUdC3DMTE=";
 
     isUnstable = true;
   };
diff --git a/pkgs/servers/home-assistant/component-packages.nix b/pkgs/servers/home-assistant/component-packages.nix
index 923e18bd586..afaef82d372 100644
--- a/pkgs/servers/home-assistant/component-packages.nix
+++ b/pkgs/servers/home-assistant/component-packages.nix
@@ -2,7 +2,7 @@
 # Do not edit!
 
 {
-  version = "2021.5.1";
+  version = "2021.5.2";
   components = {
     "abode" = ps: with ps; [ abodepy ];
     "accuweather" = ps: with ps; [ accuweather ];
@@ -375,7 +375,7 @@
     "hvv_departures" = ps: with ps; [ ]; # missing inputs: pygti
     "hydrawise" = ps: with ps; [ hydrawiser ];
     "hyperion" = ps: with ps; [ hyperion-py ];
-    "ialarm" = ps: with ps; [ ]; # missing inputs: pyialarm
+    "ialarm" = ps: with ps; [ pyialarm ];
     "iammeter" = ps: with ps; [ ]; # missing inputs: iammeter
     "iaqualink" = ps: with ps; [ iaqualink ];
     "icloud" = ps: with ps; [ pyicloud ];
diff --git a/pkgs/servers/home-assistant/default.nix b/pkgs/servers/home-assistant/default.nix
index 5383ae33d13..11bf2c744d3 100644
--- a/pkgs/servers/home-assistant/default.nix
+++ b/pkgs/servers/home-assistant/default.nix
@@ -114,7 +114,7 @@ let
   extraBuildInputs = extraPackages py.pkgs;
 
   # Don't forget to run parse-requirements.py after updating
-  hassVersion = "2021.5.1";
+  hassVersion = "2021.5.2";
 
 in with py.pkgs; buildPythonApplication rec {
   pname = "homeassistant";
@@ -133,7 +133,7 @@ in with py.pkgs; buildPythonApplication rec {
     owner = "home-assistant";
     repo = "core";
     rev = version;
-    sha256 = "0bipjfkz4zqhy84jgrn3qxvs4nxya3j08lcsq3xa31xfz8wnpxwj";
+    sha256 = "1v1ah0kdkhx0pkma2qnk56iv00r2lb4i3sfpwlcr64gfkpzpakv8";
   };
 
   # leave this in, so users don't have to constantly update their downstream patch handling
diff --git a/pkgs/tools/graphics/agi/default.nix b/pkgs/tools/graphics/agi/default.nix
index b7cfefe70cb..9c9356371b6 100644
--- a/pkgs/tools/graphics/agi/default.nix
+++ b/pkgs/tools/graphics/agi/default.nix
@@ -14,11 +14,11 @@
 
 stdenv.mkDerivation rec {
   pname = "agi";
-  version = "1.1.0-dev-20210506";
+  version = "1.1.0-dev-20210507";
 
   src = fetchzip {
     url = "https://github.com/google/agi-dev-releases/releases/download/v${version}/agi-${version}-linux.zip";
-    sha256 = "sha256-VB9AL2h+e+92lhsfdYHbSgv5AIrgEPJsa74VGncDHGo=";
+    sha256 = "sha256-Tbxbsh40Lel4kGnCIWyNRge15Y71ao+oUixClBdj4f4=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/system/netdata/default.nix b/pkgs/tools/system/netdata/default.nix
index 5eb39c7f6d8..4dc0d80b3b5 100644
--- a/pkgs/tools/system/netdata/default.nix
+++ b/pkgs/tools/system/netdata/default.nix
@@ -56,6 +56,8 @@ in stdenv.mkDerivation rec {
     # rename this plugin so netdata will look for setuid wrapper
     mv $out/libexec/netdata/plugins.d/apps.plugin \
        $out/libexec/netdata/plugins.d/apps.plugin.org
+    mv $out/libexec/netdata/plugins.d/cgroup-network \
+       $out/libexec/netdata/plugins.d/cgroup-network.org
     mv $out/libexec/netdata/plugins.d/perf.plugin \
        $out/libexec/netdata/plugins.d/perf.plugin.org
     mv $out/libexec/netdata/plugins.d/slabinfo.plugin \
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index a314020ddd6..da621ba9b3e 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -7135,7 +7135,9 @@ in
 
   nylon = callPackage ../tools/networking/nylon { };
 
-  nym = callPackage ../applications/networking/nym { };
+  nym = callPackage ../applications/networking/nym {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
 
   nzbget = callPackage ../tools/networking/nzbget { };
 
@@ -7809,6 +7811,8 @@ in
 
   pycangjie = pythonPackages.pycangjie;
 
+  pycflow2dot = with python.pkgs; toPythonApplication pycflow2dot;
+
   pydb = callPackage ../development/tools/pydb { };
 
   pydf = callPackage ../applications/misc/pydf { };
diff --git a/pkgs/top-level/ocaml-packages.nix b/pkgs/top-level/ocaml-packages.nix
index 453c4629c03..e6815abf43c 100644
--- a/pkgs/top-level/ocaml-packages.nix
+++ b/pkgs/top-level/ocaml-packages.nix
@@ -82,6 +82,8 @@ let
 
     ca-certs = callPackage ../development/ocaml-modules/ca-certs { };
 
+    ca-certs-nss = callPackage ../development/ocaml-modules/ca-certs-nss { };
+
     carton = callPackage ../development/ocaml-modules/carton { };
 
     carton-git = callPackage ../development/ocaml-modules/carton/git.nix { };
@@ -456,7 +458,7 @@ let
 
     git-cohttp-unix = callPackage ../development/ocaml-modules/git/cohttp-unix.nix { };
 
-    git-cohttp-mirage = callPackage ../development/ocaml-modules/git/cohttp-mirage.nix { };
+    git-paf = callPackage ../development/ocaml-modules/git/paf.nix { };
 
     git-unix = callPackage ../development/ocaml-modules/git/unix.nix {
       git-binary = pkgs.git;
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index b01468d3055..ff7cf434dbb 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -5416,6 +5416,10 @@ in {
 
   pycfdns = callPackage ../development/python-modules/pycfdns { };
 
+  pycflow2dot = callPackage ../development/python-modules/pycflow2dot {
+    inherit (pkgs) graphviz;
+  };
+
   pychannels = callPackage ../development/python-modules/pychannels { };
 
   pychart = callPackage ../development/python-modules/pychart { };