diff --git a/.github/workflows/editorconfig.yml b/.github/workflows/editorconfig.yml
index 2d7b9d7ce84..4960e9fd3d2 100644
--- a/.github/workflows/editorconfig.yml
+++ b/.github/workflows/editorconfig.yml
@@ -3,6 +3,7 @@ name: "Checking EditorConfig"
 permissions: read-all
 
 on:
+  # avoids approving first time contributors
   pull_request_target:
     branches-ignore:
       - 'release-**'
@@ -29,13 +30,17 @@ jobs:
       if: env.PR_DIFF
     - uses: cachix/install-nix-action@v13
       if: env.PR_DIFF
-    - name: install editorconfig-checker from unstable channel
-      run: |
-        nix-channel --add https://nixos.org/channels/nixpkgs-unstable
-        nix-channel --update
-        nix-env -iA nixpkgs.editorconfig-checker
+      with:
+        # nixpkgs commit is pinned so that it doesn't break
+        nix_path: nixpkgs=https://github.com/NixOS/nixpkgs/archive/f93ecc4f6bc60414d8b73dbdf615ceb6a2c604df.tar.gz
+    - name: install editorconfig-checker
+      run: nix-env -iA editorconfig-checker -f '<nixpkgs>'
       if: env.PR_DIFF
     - name: Checking EditorConfig
       if: env.PR_DIFF
       run: |
         echo "$PR_DIFF" | xargs editorconfig-checker -disable-indent-size
+    - if: ${{ failure() }}
+      run: |
+        echo "::error :: Hey! It looks like your changes don't follow our editorconfig settings. Read https://editorconfig.org/#download to configure your editor so you never see this error again."
+
diff --git a/nixos/modules/services/desktops/pipewire/README.md b/nixos/modules/services/desktops/pipewire/README.md
deleted file mode 100644
index 87288a81cfe..00000000000
--- a/nixos/modules/services/desktops/pipewire/README.md
+++ /dev/null
@@ -1,6 +0,0 @@
-# Updating
-
-1. Update the version & hash in pkgs/development/libraries/pipewire/default.nix
-2. run `nix build -f /path/to/nixpkgs/checkout pipewire pipewire.mediaSession`
-3. copy all JSON files from result/etc/pipewire and result-mediaSession/etc/pipewire/media-session.d to this directory
-4. add new files to the module config and passthru tests
diff --git a/nixos/modules/services/desktops/pipewire/bluez-monitor.conf.json b/nixos/modules/services/desktops/pipewire/bluez-monitor.conf.json
index bd00571bc35..6d1c23e8256 100644
--- a/nixos/modules/services/desktops/pipewire/bluez-monitor.conf.json
+++ b/nixos/modules/services/desktops/pipewire/bluez-monitor.conf.json
@@ -9,7 +9,7 @@
       ],
       "actions": {
         "update-props": {
-          "bluez5.reconnect-profiles": [
+          "bluez5.auto-connect": [
             "hfp_hf",
             "hsp_hs",
             "a2dp_sink"
diff --git a/nixos/modules/services/desktops/pipewire/media-session.conf.json b/nixos/modules/services/desktops/pipewire/media-session.conf.json
index 62e59935dbe..24906e767d6 100644
--- a/nixos/modules/services/desktops/pipewire/media-session.conf.json
+++ b/nixos/modules/services/desktops/pipewire/media-session.conf.json
@@ -59,6 +59,7 @@
     "with-pulseaudio": [
       "with-audio",
       "bluez5",
+      "logind",
       "restore-stream",
       "streams-follow-default"
     ]
diff --git a/nixos/modules/services/desktops/pipewire/pipewire-pulse.conf.json b/nixos/modules/services/desktops/pipewire/pipewire-pulse.conf.json
index 3e776fe75a2..17bbbdef117 100644
--- a/nixos/modules/services/desktops/pipewire/pipewire-pulse.conf.json
+++ b/nixos/modules/services/desktops/pipewire/pipewire-pulse.conf.json
@@ -30,7 +30,10 @@
       "args": {
         "server.address": [
           "unix:native"
-        ]
+        ],
+        "vm.overrides": {
+          "pulse.min.quantum": "1024/48000"
+        }
       }
     }
   ],
diff --git a/nixos/modules/services/desktops/pipewire/pipewire.conf.json b/nixos/modules/services/desktops/pipewire/pipewire.conf.json
index bae87dd6637..a9330f54f4f 100644
--- a/nixos/modules/services/desktops/pipewire/pipewire.conf.json
+++ b/nixos/modules/services/desktops/pipewire/pipewire.conf.json
@@ -2,7 +2,10 @@
   "context.properties": {
     "link.max-buffers": 16,
     "core.daemon": true,
-    "core.name": "pipewire-0"
+    "core.name": "pipewire-0",
+    "vm.overrides": {
+      "default.clock.min-quantum": 1024
+    }
   },
   "context.spa-libs": {
     "audio.convert.*": "audioconvert/libspa-audioconvert",
diff --git a/nixos/modules/services/wayland/cage.nix b/nixos/modules/services/wayland/cage.nix
index 14d84c4ce0f..2e71abb69fc 100644
--- a/nixos/modules/services/wayland/cage.nix
+++ b/nixos/modules/services/wayland/cage.nix
@@ -93,6 +93,6 @@ in {
     systemd.defaultUnit = "graphical.target";
   };
 
-  meta.maintainers = with lib.maintainers; [ matthewbauer flokli ];
+  meta.maintainers = with lib.maintainers; [ matthewbauer ];
 
 }
diff --git a/nixos/modules/services/web-apps/keycloak.nix b/nixos/modules/services/web-apps/keycloak.nix
index a93e9327933..b6e87c89e0a 100644
--- a/nixos/modules/services/web-apps/keycloak.nix
+++ b/nixos/modules/services/web-apps/keycloak.nix
@@ -168,9 +168,10 @@ in
       type = lib.types.str;
       default = "keycloak";
       description = ''
-        Username to use when connecting to an external or manually
-        provisioned database; has no effect when a local database is
-        automatically provisioned.
+        Username to use when connecting to the database.
+        This is also used for automatic provisioning of the database.
+        Changing this after the initial installation doesn't delete the
+        old user and can cause further problems.
       '';
     };
 
@@ -587,8 +588,8 @@ in
             PSQL=${config.services.postgresql.package}/bin/psql
 
             db_password="$(<'${cfg.databasePasswordFile}')"
-            $PSQL -tAc "SELECT 1 FROM pg_roles WHERE rolname='keycloak'" | grep -q 1 || $PSQL -tAc "CREATE ROLE keycloak WITH LOGIN PASSWORD '$db_password' CREATEDB"
-            $PSQL -tAc "SELECT 1 FROM pg_database WHERE datname = 'keycloak'" | grep -q 1 || $PSQL -tAc 'CREATE DATABASE "keycloak" OWNER "keycloak"'
+            $PSQL -tAc "SELECT 1 FROM pg_roles WHERE rolname='${cfg.databaseUsername}'" | grep -q 1 || $PSQL -tAc "CREATE ROLE ${cfg.databaseUsername} WITH LOGIN PASSWORD '$db_password' CREATEDB"
+            $PSQL -tAc "SELECT 1 FROM pg_database WHERE datname = 'keycloak'" | grep -q 1 || $PSQL -tAc 'CREATE DATABASE "keycloak" OWNER "${cfg.databaseUsername}"'
           '';
         };
 
@@ -606,9 +607,9 @@ in
             set -eu
 
             db_password="$(<'${cfg.databasePasswordFile}')"
-            ( echo "CREATE USER IF NOT EXISTS 'keycloak'@'localhost' IDENTIFIED BY '$db_password';"
+            ( echo "CREATE USER IF NOT EXISTS '${cfg.databaseUsername}'@'localhost' IDENTIFIED BY '$db_password';"
               echo "CREATE DATABASE keycloak CHARACTER SET utf8 COLLATE utf8_unicode_ci;"
-              echo "GRANT ALL PRIVILEGES ON keycloak.* TO 'keycloak'@'localhost';"
+              echo "GRANT ALL PRIVILEGES ON keycloak.* TO '${cfg.databaseUsername}'@'localhost';"
             ) | ${config.services.mysql.package}/bin/mysql -N
           '';
         };
diff --git a/nixos/tests/cage.nix b/nixos/tests/cage.nix
index 1ae07b6fd2f..2d4dacfc0e7 100644
--- a/nixos/tests/cage.nix
+++ b/nixos/tests/cage.nix
@@ -3,7 +3,7 @@ import ./make-test-python.nix ({ pkgs, ...} :
 {
   name = "cage";
   meta = with pkgs.lib.maintainers; {
-    maintainers = [ matthewbauer flokli ];
+    maintainers = [ matthewbauer ];
   };
 
   machine = { ... }:
diff --git a/nixos/tests/installed-tests/pipewire.nix b/nixos/tests/installed-tests/pipewire.nix
index f4154b5d2fd..b04265658fc 100644
--- a/nixos/tests/installed-tests/pipewire.nix
+++ b/nixos/tests/installed-tests/pipewire.nix
@@ -2,4 +2,14 @@
 
 makeInstalledTest {
   tested = pkgs.pipewire;
+  testConfig = {
+    hardware.pulseaudio.enable = false;
+    services.pipewire = {
+      enable = true;
+      pulse.enable = true;
+      jack.enable = true;
+      alsa.enable = true;
+      alsa.support32Bit = true;
+    };
+  };
 }
diff --git a/pkgs/applications/blockchains/trezor-suite/default.nix b/pkgs/applications/blockchains/trezor-suite/default.nix
index 68b83aff88d..2f5e6ac0104 100644
--- a/pkgs/applications/blockchains/trezor-suite/default.nix
+++ b/pkgs/applications/blockchains/trezor-suite/default.nix
@@ -1,4 +1,5 @@
 { lib
+, stdenv
 , fetchurl
 , appimageTools
 , tor
@@ -7,12 +8,20 @@
 
 let
   pname = "trezor-suite";
-  version = "21.2.2";
+  version = "21.4.1";
   name = "${pname}-${version}";
 
+  suffix = {
+    aarch64-linux = "linux-arm64";
+    x86_64-linux  = "linux-x86_64";
+  }.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
+
   src = fetchurl {
-    url = "https://github.com/trezor/${pname}/releases/download/v${version}/Trezor-Suite-${version}-linux-x86_64.AppImage";
-    sha256 = "0dj3azx9jvxchrpm02w6nkcis6wlnc6df04z7xc6f66fwn6r3kkw";
+    url = "https://github.com/trezor/${pname}/releases/download/v${version}/Trezor-Suite-${version}-${suffix}.AppImage";
+    sha256 = {
+      aarch64-linux = "51ea8a5210f008d13a729ac42085563b5e8b971b17ed766f84d69d76dcb2db0c";
+      x86_64-linux  = "9219168a504356152b3b807e1e7282e21952461d277596c6b82ddfe81ac2419c";
+    }.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
   };
 
   appimageContents = appimageTools.extractType2 {
@@ -49,6 +58,6 @@ appimageTools.wrapType2 rec {
     homepage = "https://suite.trezor.io";
     license = licenses.unfree;
     maintainers = with maintainers; [ prusnak ];
-    platforms = [ "x86_64-linux" ];
+    platforms = [ "aarch64-linux" "x86_64-linux" ];
   };
 }
diff --git a/pkgs/applications/networking/browsers/palemoon/default.nix b/pkgs/applications/networking/browsers/palemoon/default.nix
index 554167c3574..9bc9727dd18 100644
--- a/pkgs/applications/networking/browsers/palemoon/default.nix
+++ b/pkgs/applications/networking/browsers/palemoon/default.nix
@@ -1,29 +1,59 @@
-{ stdenv, lib, fetchFromGitHub, writeScript, desktop-file-utils
-, pkg-config, autoconf213, alsaLib, bzip2, cairo
-, dbus, dbus-glib, ffmpeg, file, fontconfig, freetype
-, gnome2, gnum4, gtk2, hunspell, libevent, libjpeg
-, libnotify, libstartup_notification, wrapGAppsHook
-, libGLU, libGL, perl, python2, libpulseaudio
-, unzip, xorg, wget, which, yasm, zip, zlib
-
-, withGTK3 ? true, gtk3
+# Compiler in stdenv MUST be a supported one for official branding
+# See https://developer.palemoon.org/build/linux/
+# TODO assert if stdenv.cc is supported?
+{ stdenv
+, lib
+, fetchFromGitHub
+, writeScript
+, alsaLib
+, autoconf213
+, cairo
+, desktop-file-utils
+, dbus
+, dbus-glib
+, ffmpeg
+, fontconfig
+, freetype
+, gnome2
+, gnum4
+, gtk2
+, libevent
+, libGL
+, libGLU
+, libnotify
+, libpulseaudio
+, libstartup_notification
+, perl
+, pkg-config
+, python2
+, unzip
+, which
+, wrapGAppsHook
+, xorg
+, yasm
+, zip
+, zlib
+, withGTK3 ? true
+, gtk3
 }:
 
 let
-
-  libPath = lib.makeLibraryPath [ ffmpeg libpulseaudio ];
+  libPath = lib.makeLibraryPath [
+    ffmpeg
+    libpulseaudio
+  ];
   gtkVersion = if withGTK3 then "3" else "2";
-
-in stdenv.mkDerivation rec {
+in
+stdenv.mkDerivation rec {
   pname = "palemoon";
-  version = "29.1.1";
+  version = "29.2.0";
 
   src = fetchFromGitHub {
     githubBase = "repo.palemoon.org";
     owner = "MoonchildProductions";
     repo = "Pale-Moon";
     rev = "${version}_Release";
-    sha256 = "1ppdmj816zwccb0l0mgpq14ckdwg785wmqz41wran0nl63fg6i1x";
+    sha256 = "0pa9j41bbfarwi60a6hxi5vpn52mwgr4p05l98acv4fcs1ccb427";
     fetchSubmodules = true;
   };
 
@@ -43,24 +73,55 @@ in stdenv.mkDerivation rec {
   '';
 
   nativeBuildInputs = [
-    desktop-file-utils file gnum4 perl pkg-config python2 wget which wrapGAppsHook unzip
+    autoconf213
+    desktop-file-utils
+    gnum4
+    perl
+    pkg-config
+    python2
+    unzip
+    which
+    wrapGAppsHook
+    yasm
+    zip
   ];
 
   buildInputs = [
-    alsaLib bzip2 cairo dbus dbus-glib ffmpeg fontconfig freetype
-    gnome2.GConf gtk2 hunspell libevent libjpeg libnotify
-    libstartup_notification libGLU libGL
-    libpulseaudio yasm zip zlib
+    alsaLib
+    cairo
+    dbus
+    dbus-glib
+    ffmpeg
+    fontconfig
+    freetype
+    gnome2.GConf
+    gtk2
+    libevent
+    libGL
+    libGLU
+    libnotify
+    libpulseaudio
+    libstartup_notification
+    zlib
   ]
   ++ (with xorg; [
-    libX11 libXext libXft libXi libXrender libXScrnSaver
-    libXt pixman xorgproto
+    libX11
+    libXext
+    libXft
+    libXi
+    libXrender
+    libXScrnSaver
+    libXt
+    pixman
+    xorgproto
   ])
   ++ lib.optional withGTK3 gtk3;
 
   enableParallelBuilding = true;
 
   configurePhase = ''
+    runHook preConfigure
+
     export MOZCONFIG=$PWD/mozconfig
     export MOZ_NOSPAM=1
 
@@ -96,9 +157,6 @@ in stdenv.mkDerivation rec {
     ac_add_options --enable-official-branding
     export MOZILLA_OFFICIAL=1
 
-    # For versions after 28.12.0
-    ac_add_options --enable-phoenix-extensions
-
     ac_add_options --x-libraries=${lib.makeLibraryPath [ xorg.libX11 ]}
 
     export MOZ_PKG_SPECIAL=gtk$_GTK_VERSION
@@ -112,24 +170,42 @@ in stdenv.mkDerivation rec {
     mk_add_options MOZ_MAKE_FLAGS="-j${if enableParallelBuilding then "$NIX_BUILD_CORES" else "1"}"
     mk_add_options AUTOCONF=${autoconf213}/bin/autoconf
     '
+
+    runHook postConfigure
   '';
 
-  buildPhase = "./mach build";
+  buildPhase = ''
+    runHook preBuild
+
+    ./mach build
+
+    runHook postBuild
+  '';
 
   installPhase = ''
+    runHook preInstall
+
     ./mach install
 
     # Fix missing icon due to wrong WMClass
+    # TODO report upstream
     substituteInPlace ./palemoon/branding/official/palemoon.desktop \
       --replace 'StartupWMClass="pale moon"' 'StartupWMClass=Pale moon'
     desktop-file-install --dir=$out/share/applications \
       ./palemoon/branding/official/palemoon.desktop
 
+    # Install official branding icons
     for iconname in default{16,22,24,32,48,256} mozicon128; do
       n=''${iconname//[^0-9]/}
       size=$n"x"$n
       install -Dm644 ./palemoon/branding/official/$iconname.png $out/share/icons/hicolor/$size/apps/palemoon.png
     done
+
+    # Remove unneeded SDK data from installation
+    # TODO: move to a separate output?
+    rm -rf $out/{include,share/idl,lib/palemoon-devel-${version}}
+
+    runHook postInstall
   '';
 
   dontWrapGApps = true;
@@ -154,9 +230,9 @@ in stdenv.mkDerivation rec {
       experience, while offering full customization and a growing collection of
       extensions and themes to make the browser truly your own.
     '';
-    homepage    = "https://www.palemoon.org/";
-    license     = licenses.mpl20;
+    homepage = "https://www.palemoon.org/";
+    license = licenses.mpl20;
     maintainers = with maintainers; [ AndersonTorres OPNA2608 ];
-    platforms   = [ "i686-linux" "x86_64-linux" ];
+    platforms = [ "i686-linux" "x86_64-linux" ];
   };
 }
diff --git a/pkgs/applications/science/chemistry/jmol/default.nix b/pkgs/applications/science/chemistry/jmol/default.nix
index bb523cddd19..2da5a070ee8 100644
--- a/pkgs/applications/science/chemistry/jmol/default.nix
+++ b/pkgs/applications/science/chemistry/jmol/default.nix
@@ -17,14 +17,14 @@ let
   };
 in
 stdenv.mkDerivation rec {
-  version = "14.31.35";
+  version = "14.31.36";
   pname = "jmol";
 
   src = let
     baseVersion = "${lib.versions.major version}.${lib.versions.minor version}";
   in fetchurl {
     url = "mirror://sourceforge/jmol/Jmol/Version%20${baseVersion}/Jmol%20${version}/Jmol-${version}-binary.tar.gz";
-    sha256 = "sha256-uB7d27eicfmE1TpjLAxUoC8LBYAOrg3B48M1/CxWZdg=";
+    sha256 = "sha256-YwXgRRUZ75l1ZptscsZae2mwkRkYXJeWSrPvw+R6TkI=";
   };
 
   patchPhase = ''
diff --git a/pkgs/applications/version-management/subversion/CVE-2020-17525.patch b/pkgs/applications/version-management/subversion/CVE-2020-17525.patch
deleted file mode 100644
index c844c3773e3..00000000000
--- a/pkgs/applications/version-management/subversion/CVE-2020-17525.patch
+++ /dev/null
@@ -1,15 +0,0 @@
-Patch included in advisory @ https://subversion.apache.org/security/CVE-2020-17525-advisory.txt
-
---- a/subversion/libsvn_repos/config_file.c
-+++ b/subversion/libsvn_repos/config_file.c
-@@ -237,6 +237,10 @@ get_repos_config(svn_stream_t **stream,
-     {
-       /* Search for a repository in the full path. */
-       repos_root_dirent = svn_repos_find_root_path(dirent, scratch_pool);
-+      if (repos_root_dirent == NULL)
-+        return svn_error_trace(handle_missing_file(stream, checksum, access,
-+                                                   url, must_exist,
-+                                                   svn_node_none));
- 
-       /* Attempt to open a repository at repos_root_dirent. */
-       SVN_ERR(svn_repos_open3(&access->repos, repos_root_dirent, NULL,
diff --git a/pkgs/applications/version-management/subversion/default.nix b/pkgs/applications/version-management/subversion/default.nix
index 9f780de748e..042dafbb674 100644
--- a/pkgs/applications/version-management/subversion/default.nix
+++ b/pkgs/applications/version-management/subversion/default.nix
@@ -6,13 +6,13 @@
 , javahlBindings ? false
 , saslSupport ? false
 , lib, stdenv, fetchurl, apr, aprutil, zlib, sqlite, openssl, lz4, utf8proc
-, apacheHttpd ? null, expat, swig ? null, jdk ? null, python ? null, perl ? null
+, apacheHttpd ? null, expat, swig ? null, jdk ? null, python3 ? null, py3c ? null, perl ? null
 , sasl ? null, serf ? null
 }:
 
 assert bdbSupport -> aprutil.bdbSupport;
 assert httpServer -> apacheHttpd != null;
-assert pythonBindings -> swig != null && python != null;
+assert pythonBindings -> swig != null && python3 != null && py3c != null;
 assert javahlBindings -> jdk != null && perl != null;
 
 let
@@ -31,7 +31,7 @@ let
 
     buildInputs = [ zlib apr aprutil sqlite openssl lz4 utf8proc ]
       ++ lib.optional httpSupport serf
-      ++ lib.optional pythonBindings python
+      ++ lib.optionals pythonBindings [ python3 py3c ]
       ++ lib.optional perlBindings perl
       ++ lib.optional saslSupport sasl;
 
@@ -91,7 +91,7 @@ let
 
     enableParallelBuilding = true;
 
-    checkInputs = [ python ];
+    checkInputs = [ python3 ];
     doCheck = false; # fails 10 out of ~2300 tests
 
     meta = with lib; {
@@ -116,8 +116,7 @@ in {
   };
 
   subversion = common {
-    version = "1.12.2";
-    sha256 = "0wgpw3kzsiawzqk4y0xgh1z93kllxydgv4lsviim45y5wk4bbl1v";
-    extraPatches = [ ./CVE-2020-17525.patch ];
+    version = "1.14.1";
+    sha256 = "1ag1hvcm9q92kgalzbbgcsq9clxnzmbj9nciz9lmabjx4lyajp9c";
   };
 }
diff --git a/pkgs/development/libraries/botan/2.0.nix b/pkgs/development/libraries/botan/2.0.nix
index cb40e535b0c..a486ba49820 100644
--- a/pkgs/development/libraries/botan/2.0.nix
+++ b/pkgs/development/libraries/botan/2.0.nix
@@ -1,9 +1,9 @@
 { callPackage, ... } @ args:
 
 callPackage ./generic.nix (args // {
-  baseVersion = "2.17";
-  revision = "3";
-  sha256 = "121vn1aryk36cpks70kk4c4cfic5g0qs82bf92xap9258ijkn4kr";
+  baseVersion = "2.18";
+  revision = "0";
+  sha256 = "09z3fy31q1pvnvpy4fswrsl2aq8ksl94lbh5rl7b6nqc3qp8ar6c";
   postPatch = ''
     sed -e 's@lang_flags "@&--std=c++11 @' -i src/build-data/cc/{gcc,clang}.txt
   '';
diff --git a/pkgs/development/libraries/botan/default.nix b/pkgs/development/libraries/botan/default.nix
index 8bcc6aaa8ef..c494fa25f77 100644
--- a/pkgs/development/libraries/botan/default.nix
+++ b/pkgs/development/libraries/botan/default.nix
@@ -9,4 +9,8 @@ callPackage ./generic.nix (args // {
   postPatch = ''
     sed -e 's@lang_flags "@&--std=c++11 @' -i src/build-data/cc/{gcc,clang}.txt
   '';
+  knownVulnerabilities = [
+    # https://botan.randombit.net/security.html#id1
+    "2020-03-24: Side channel during CBC padding"
+  ];
 })
diff --git a/pkgs/development/libraries/botan/generic.nix b/pkgs/development/libraries/botan/generic.nix
index 33f9daf7b50..2fc5abc2928 100644
--- a/pkgs/development/libraries/botan/generic.nix
+++ b/pkgs/development/libraries/botan/generic.nix
@@ -4,6 +4,7 @@
 , sourceExtension ? "tar.xz"
 , extraConfigureFlags ? ""
 , postPatch ? null
+, knownVulnerabilities ? [ ]
 , CoreServices
 , Security
 , ...
@@ -49,6 +50,7 @@ stdenv.mkDerivation rec {
     maintainers = with maintainers; [ raskin ];
     platforms = platforms.unix;
     license = licenses.bsd2;
+    inherit knownVulnerabilities;
   };
   passthru.updateInfo.downloadPage = "http://files.randombit.net/botan/";
 }
diff --git a/pkgs/development/libraries/doctest/default.nix b/pkgs/development/libraries/doctest/default.nix
index 233e01e0380..c8e31d43e95 100644
--- a/pkgs/development/libraries/doctest/default.nix
+++ b/pkgs/development/libraries/doctest/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "doctest";
-  version = "2.4.4";
+  version = "2.4.6";
 
   src = fetchFromGitHub {
     owner = "onqtam";
     repo = "doctest";
     rev = version;
-    hash = "sha256-NqXC5948prTCi4gsaR8bJPBTrmH+rJbHsGvwkJlpjXY=";
+    sha256 = "14m3q6d96zg6d99x1152jkly50gdjrn5ylrbhax53pfgfzzc5yqx";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/gupnp-igd/default.nix b/pkgs/development/libraries/gupnp-igd/default.nix
index 09fae015b50..233eb7e3c85 100644
--- a/pkgs/development/libraries/gupnp-igd/default.nix
+++ b/pkgs/development/libraries/gupnp-igd/default.nix
@@ -44,7 +44,9 @@ stdenv.mkDerivation rec {
     "-Dgtk_doc=true"
   ];
 
-  doCheck = true;
+  # Seems to get stuck sometimes.
+  # https://github.com/NixOS/nixpkgs/issues/119288
+  #doCheck = true;
 
   passthru = {
     updateScript = gnome3.updateScript {
diff --git a/pkgs/development/libraries/libmwaw/default.nix b/pkgs/development/libraries/libmwaw/default.nix
index 17e20e3d399..1b8c30f9a8f 100644
--- a/pkgs/development/libraries/libmwaw/default.nix
+++ b/pkgs/development/libraries/libmwaw/default.nix
@@ -3,11 +3,11 @@ let
   s = # Generated upstream information
   rec {
     baseName="libmwaw";
-    version="0.3.17";
+    version="0.3.18";
     name="${baseName}-${version}";
-    hash="074ipcq9w7jbd5x316dzclddgia2ydw098ph9d7p3d713pmkf5cf";
-    url="mirror://sourceforge/libmwaw/libmwaw/libmwaw-0.3.17/libmwaw-0.3.17.tar.xz";
-    sha256="074ipcq9w7jbd5x316dzclddgia2ydw098ph9d7p3d713pmkf5cf";
+    hash="sha256-/F0FFoD4AAvmT/68CwxYcWscm/BgA+w5k4exCdHtHg8=";
+    url="mirror://sourceforge/libmwaw/libmwaw/libmwaw-0.3.18/libmwaw-0.3.18.tar.xz";
+    sha256="sha256-/F0FFoD4AAvmT/68CwxYcWscm/BgA+w5k4exCdHtHg8=";
   };
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/development/libraries/pipewire/0040-alsa-profiles-use-libdir.patch b/pkgs/development/libraries/pipewire/0040-alsa-profiles-use-libdir.patch
index c657d12f7d0..fab89c4ffd9 100644
--- a/pkgs/development/libraries/pipewire/0040-alsa-profiles-use-libdir.patch
+++ b/pkgs/development/libraries/pipewire/0040-alsa-profiles-use-libdir.patch
@@ -1,13 +1,13 @@
 diff --git a/meson.build b/meson.build
-index ffee41b4..f3e4ec74 100644
+index 99a4b2d1..d4a4cda7 100644
 --- a/meson.build
 +++ b/meson.build
-@@ -53,7 +53,7 @@ endif
+@@ -55,7 +55,7 @@ endif
  
- spa_plugindir = join_paths(pipewire_libdir, spa_name)
+ spa_plugindir = pipewire_libdir / spa_name
  
--alsadatadir = join_paths(pipewire_datadir, 'alsa-card-profile', 'mixer')
-+alsadatadir = join_paths(pipewire_libdir, '..', 'share', 'alsa-card-profile', 'mixer')
+-alsadatadir = pipewire_datadir / 'alsa-card-profile' / 'mixer'
++alsadatadir = pipewire_libdir / '..' / 'share' / 'alsa-card-profile' / 'mixer'
  
- pipewire_headers_dir = join_paths(pipewire_name, 'pipewire')
+ pipewire_headers_dir = pipewire_name / 'pipewire'
  
diff --git a/pkgs/development/libraries/pipewire/0050-pipewire-pulse-path.patch b/pkgs/development/libraries/pipewire/0050-pipewire-pulse-path.patch
index 4a6b21dd431..fd7d031ee0f 100644
--- a/pkgs/development/libraries/pipewire/0050-pipewire-pulse-path.patch
+++ b/pkgs/development/libraries/pipewire/0050-pipewire-pulse-path.patch
@@ -1,8 +1,8 @@
 diff --git a/meson_options.txt b/meson_options.txt
-index ce364d93..a6c8af72 100644
+index 66791f3a..93b5e2a9 100644
 --- a/meson_options.txt
 +++ b/meson_options.txt
-@@ -152,6 +152,9 @@ option('udev',
+@@ -172,6 +172,9 @@ option('udev',
  option('udevrulesdir',
         type : 'string',
         description : 'Directory for udev rules (defaults to /lib/udev/rules.d)')
@@ -13,15 +13,15 @@ index ce364d93..a6c8af72 100644
         type : 'string',
         description : 'Directory for user systemd units (defaults to /usr/lib/systemd/user)')
 diff --git a/src/daemon/systemd/user/meson.build b/src/daemon/systemd/user/meson.build
-index 0a5e5042..4a70b0b0 100644
+index aa30a86f..1edebb2d 100644
 --- a/src/daemon/systemd/user/meson.build
 +++ b/src/daemon/systemd/user/meson.build
 @@ -9,7 +9,7 @@ install_data(
  
  systemd_config = configuration_data()
- systemd_config.set('PW_BINARY', join_paths(pipewire_bindir, 'pipewire'))
--systemd_config.set('PW_PULSE_BINARY', join_paths(pipewire_bindir, 'pipewire-pulse'))
-+systemd_config.set('PW_PULSE_BINARY', join_paths(get_option('pipewire_pulse_prefix'), 'bin/pipewire-pulse'))
- systemd_config.set('PW_MEDIA_SESSION_BINARY', join_paths(pipewire_bindir, 'pipewire-media-session'))
+ systemd_config.set('PW_BINARY', pipewire_bindir / 'pipewire')
+-systemd_config.set('PW_PULSE_BINARY', pipewire_bindir / 'pipewire-pulse')
++systemd_config.set('PW_PULSE_BINARY', get_option('pipewire_pulse_prefix') / 'bin/pipewire-pulse')
+ systemd_config.set('PW_MEDIA_SESSION_BINARY', pipewire_bindir / 'pipewire-media-session')
  
  configure_file(input : 'pipewire.service.in',
diff --git a/pkgs/development/libraries/pipewire/0055-pipewire-media-session-path.patch b/pkgs/development/libraries/pipewire/0055-pipewire-media-session-path.patch
index a4fb8b41e7a..be6683c3e7b 100644
--- a/pkgs/development/libraries/pipewire/0055-pipewire-media-session-path.patch
+++ b/pkgs/development/libraries/pipewire/0055-pipewire-media-session-path.patch
@@ -1,8 +1,8 @@
 diff --git a/meson_options.txt b/meson_options.txt
-index e2a1e028..310029f2 100644
+index 93b5e2a9..1b915ac3 100644
 --- a/meson_options.txt
 +++ b/meson_options.txt
-@@ -10,6 +10,9 @@ option('media-session',
+@@ -13,6 +13,9 @@ option('media-session',
         description: 'Build and install pipewire-media-session',
         type: 'feature',
         value: 'auto')
@@ -13,15 +13,15 @@ index e2a1e028..310029f2 100644
         description: 'Build manpages',
         type: 'feature',
 diff --git a/src/daemon/systemd/user/meson.build b/src/daemon/systemd/user/meson.build
-index 5c4d1af0..7296220f 100644
+index 1edebb2d..251270eb 100644
 --- a/src/daemon/systemd/user/meson.build
 +++ b/src/daemon/systemd/user/meson.build
 @@ -10,7 +10,7 @@ install_data(
  systemd_config = configuration_data()
- systemd_config.set('PW_BINARY', join_paths(pipewire_bindir, 'pipewire'))
- systemd_config.set('PW_PULSE_BINARY', join_paths(get_option('pipewire_pulse_prefix'), 'bin/pipewire-pulse'))
--systemd_config.set('PW_MEDIA_SESSION_BINARY', join_paths(pipewire_bindir, 'pipewire-media-session'))
-+systemd_config.set('PW_MEDIA_SESSION_BINARY', join_paths(get_option('media-session-prefix'), 'bin/pipewire-media-session'))
-
+ systemd_config.set('PW_BINARY', pipewire_bindir / 'pipewire')
+ systemd_config.set('PW_PULSE_BINARY', get_option('pipewire_pulse_prefix') / 'bin/pipewire-pulse')
+-systemd_config.set('PW_MEDIA_SESSION_BINARY', pipewire_bindir / 'pipewire-media-session')
++systemd_config.set('PW_MEDIA_SESSION_BINARY', get_option('media-session-prefix') / 'bin/pipewire-media-session')
+ 
  configure_file(input : 'pipewire.service.in',
                 output : 'pipewire.service',
diff --git a/pkgs/development/libraries/pipewire/0070-installed-tests-path.patch b/pkgs/development/libraries/pipewire/0070-installed-tests-path.patch
index cb695fa398c..926de306254 100644
--- a/pkgs/development/libraries/pipewire/0070-installed-tests-path.patch
+++ b/pkgs/development/libraries/pipewire/0070-installed-tests-path.patch
@@ -1,23 +1,23 @@
 diff --git a/meson.build b/meson.build
-index 97d4d939..b17358e5 100644
+index d4a4cda7..a27569bd 100644
 --- a/meson.build
 +++ b/meson.build
 @@ -353,8 +353,8 @@ libinotify_dep = (build_machine.system() == 'freebsd'
-
+ 
  alsa_dep = dependency('alsa', version : '>=1.1.7', required: get_option('pipewire-alsa'))
-
--installed_tests_metadir = join_paths(pipewire_datadir, 'installed-tests', pipewire_name)
--installed_tests_execdir = join_paths(pipewire_libexecdir, 'installed-tests', pipewire_name)
-+installed_tests_metadir = join_paths(get_option('installed_test_prefix'), 'share', 'installed-tests', pipewire_name)
-+installed_tests_execdir = join_paths(get_option('installed_test_prefix'), 'libexec', 'installed-tests', pipewire_name)
+ 
+-installed_tests_metadir = pipewire_datadir / 'installed-tests' / pipewire_name
+-installed_tests_execdir = pipewire_libexecdir / 'installed-tests' / pipewire_name
++installed_tests_metadir = get_option('installed_test_prefix') / 'share' / 'installed-tests' / pipewire_name
++installed_tests_execdir = get_option('installed_test_prefix') / 'libexec' / 'installed-tests' / pipewire_name
  installed_tests_enabled = not get_option('installed_tests').disabled()
  installed_tests_template = files('template.test.in')
-
+ 
 diff --git a/meson_options.txt b/meson_options.txt
-index fba0d647..8c6106cd 100644
+index 1b915ac3..85beb86a 100644
 --- a/meson_options.txt
 +++ b/meson_options.txt
-@@ -26,6 +26,9 @@ option('installed_tests',
+@@ -29,6 +29,9 @@ option('installed_tests',
         description: 'Install manual and automated test executables',
         type: 'feature',
         value: 'disabled')
diff --git a/pkgs/development/libraries/pipewire/0080-pipewire-config-dir.patch b/pkgs/development/libraries/pipewire/0080-pipewire-config-dir.patch
index ad1ae93684b..b92e2818ea0 100644
--- a/pkgs/development/libraries/pipewire/0080-pipewire-config-dir.patch
+++ b/pkgs/development/libraries/pipewire/0080-pipewire-config-dir.patch
@@ -1,30 +1,30 @@
 diff --git a/meson.build b/meson.build
-index 0073eb13..0ffc6863 100644
+index a27569bd..fcf18344 100644
 --- a/meson.build
 +++ b/meson.build
-@@ -34,7 +34,10 @@ pipewire_libexecdir = join_paths(prefix, get_option('libexecdir'))
- pipewire_localedir = join_paths(prefix, get_option('localedir'))
- pipewire_sysconfdir = join_paths(prefix, get_option('sysconfdir'))
+@@ -36,7 +36,10 @@ pipewire_libexecdir = prefix / get_option('libexecdir')
+ pipewire_localedir = prefix / get_option('localedir')
+ pipewire_sysconfdir = prefix / get_option('sysconfdir')
  
--pipewire_configdir = join_paths(pipewire_sysconfdir, 'pipewire')
+-pipewire_configdir = pipewire_sysconfdir / 'pipewire'
 +pipewire_configdir = get_option('pipewire_config_dir')
 +if pipewire_configdir == ''
-+  pipewire_configdir = join_paths(pipewire_sysconfdir, 'pipewire')
++  pipewire_configdir = pipewire_sysconfdir / 'pipewire'
 +endif
- modules_install_dir = join_paths(pipewire_libdir, pipewire_name)
+ modules_install_dir = pipewire_libdir / pipewire_name
  
  if host_machine.system() == 'linux'
 diff --git a/meson_options.txt b/meson_options.txt
-index 4b9e46b8..8c301459 100644
+index 85beb86a..372e8faa 100644
 --- a/meson_options.txt
 +++ b/meson_options.txt
-@@ -56,6 +56,9 @@ option('pipewire-pulseaudio',
- option('libpulse-path',
-        description: 'Where to install the libpulse.so library',
+@@ -67,6 +67,9 @@ option('jack-devel',
+ option('libjack-path',
+        description: 'Where to install the libjack.so library',
         type: 'string')
 +option('pipewire_config_dir',
 +       type : 'string',
 +       description : 'Directory for pipewire configuration (defaults to /etc/pipewire)')
  option('spa-plugins',
         description: 'Enable spa plugins integration',
-        type: 'boolean',
+        type: 'feature',
diff --git a/pkgs/development/libraries/pipewire/default.nix b/pkgs/development/libraries/pipewire/default.nix
index 47a85c36c23..133853e2362 100644
--- a/pkgs/development/libraries/pipewire/default.nix
+++ b/pkgs/development/libraries/pipewire/default.nix
@@ -42,7 +42,7 @@ let
 
   self = stdenv.mkDerivation rec {
     pname = "pipewire";
-    version = "0.3.25";
+    version = "0.3.26";
 
     outputs = [
       "out"
@@ -60,7 +60,7 @@ let
       owner = "pipewire";
       repo = "pipewire";
       rev = version;
-      hash = "sha256:EbXWcf6QLtbvm6/eXBI+PF2sTw2opYfmc+H/SMDEH1U=";
+      sha256 = "sha256-s9+70XXMN4K3yDVwIu+L15gL6rFlpRNVQpeekZQOEec=";
     };
 
     patches = [
@@ -146,29 +146,31 @@ let
       moveToOutput "bin/pipewire-pulse" "$pulse"
     '';
 
-    passthru.tests = {
-      installedTests = nixosTests.installed-tests.pipewire;
+    passthru = {
+      updateScript = ./update.sh;
+      tests = {
+        installedTests = nixosTests.installed-tests.pipewire;
 
-      # This ensures that all the paths used by the NixOS module are found.
-      test-paths = callPackage ./test-paths.nix {
-        paths-out = [
-          "share/alsa/alsa.conf.d/50-pipewire.conf"
-          "nix-support/etc/pipewire/client.conf.json"
-          "nix-support/etc/pipewire/client-rt.conf.json"
-          "nix-support/etc/pipewire/jack.conf.json"
-          "nix-support/etc/pipewire/pipewire.conf.json"
-          "nix-support/etc/pipewire/pipewire-pulse.conf.json"
-        ];
-        paths-out-media-session = [
-          "nix-support/etc/pipewire/media-session.d/alsa-monitor.conf.json"
-          "nix-support/etc/pipewire/media-session.d/bluez-monitor.conf.json"
-          "nix-support/etc/pipewire/media-session.d/media-session.conf.json"
-          "nix-support/etc/pipewire/media-session.d/v4l2-monitor.conf.json"
-        ];
-        paths-lib = [
-          "lib/alsa-lib/libasound_module_pcm_pipewire.so"
-          "share/alsa-card-profile/mixer"
-        ];
+        # This ensures that all the paths used by the NixOS module are found.
+        test-paths = callPackage ./test-paths.nix {
+          paths-out = [
+            "share/alsa/alsa.conf.d/50-pipewire.conf"
+            "nix-support/etc/pipewire/client.conf.json"
+            "nix-support/etc/pipewire/jack.conf.json"
+            "nix-support/etc/pipewire/pipewire.conf.json"
+            "nix-support/etc/pipewire/pipewire-pulse.conf.json"
+          ];
+          paths-out-media-session = [
+            "nix-support/etc/pipewire/media-session.d/alsa-monitor.conf.json"
+            "nix-support/etc/pipewire/media-session.d/bluez-monitor.conf.json"
+            "nix-support/etc/pipewire/media-session.d/media-session.conf.json"
+            "nix-support/etc/pipewire/media-session.d/v4l2-monitor.conf.json"
+          ];
+          paths-lib = [
+            "lib/alsa-lib/libasound_module_pcm_pipewire.so"
+            "share/alsa-card-profile/mixer"
+          ];
+        };
       };
     };
 
diff --git a/pkgs/development/libraries/pipewire/test-paths.nix b/pkgs/development/libraries/pipewire/test-paths.nix
index 11d00e7c2ca..939b79686e3 100644
--- a/pkgs/development/libraries/pipewire/test-paths.nix
+++ b/pkgs/development/libraries/pipewire/test-paths.nix
@@ -1,4 +1,4 @@
-{ lib, runCommand, pipewire, paths-out, paths-lib }:
+{ lib, runCommand, pipewire, paths-out, paths-lib, paths-out-media-session }:
 
 let
   check-path = output: path: ''
diff --git a/pkgs/development/libraries/pipewire/update.sh b/pkgs/development/libraries/pipewire/update.sh
new file mode 100755
index 00000000000..6d0088c206c
--- /dev/null
+++ b/pkgs/development/libraries/pipewire/update.sh
@@ -0,0 +1,24 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -p nix-update -i bash
+# shellcheck shell=bash
+
+set -o errexit -o pipefail -o nounset -o errtrace
+shopt -s inherit_errexit
+shopt -s nullglob
+IFS=$'\n'
+
+NIXPKGS_ROOT="$(git rev-parse --show-toplevel)"
+
+cd "$NIXPKGS_ROOT"
+nix-update pipewire
+outputs=$(nix-build . -A pipewire -A pipewire.mediaSession)
+for p in $outputs; do
+    conf_files=$(find "$p/nix-support/etc/pipewire/" -name '*.conf.json')
+    for c in $conf_files; do
+        file_name=$(basename "$c")
+        if [[ ! -e "nixos/modules/services/desktops/pipewire/$file_name" ]]; then
+            echo "New file $file_name found! Add it to the module config and passthru tests!"
+        fi
+        install -m 0644 "$c" "nixos/modules/services/desktops/pipewire/"
+    done
+done
diff --git a/pkgs/development/libraries/py3c/default.nix b/pkgs/development/libraries/py3c/default.nix
new file mode 100644
index 00000000000..2a89161ef38
--- /dev/null
+++ b/pkgs/development/libraries/py3c/default.nix
@@ -0,0 +1,31 @@
+{ lib, stdenv, fetchFromGitHub, python2, python3 }:
+
+stdenv.mkDerivation rec {
+  pname = "py3c";
+  version = "1.3.1";
+
+  src = fetchFromGitHub {
+    owner = "encukou";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "04i2z7hrig78clc59q3i1z2hh24g7z1bfvxznlzxv00d4s57nhpi";
+  };
+
+  makeFlags = [
+    "prefix=${placeholder "out"}"
+  ];
+
+  doCheck = true;
+
+  checkInputs = [
+    python2
+    python3
+  ];
+
+  meta = with lib; {
+    homepage = "https://github.com/encukou/py3c";
+    description = "Python 2/3 compatibility layer for C extensions";
+    license = licenses.mit;
+    maintainers = with maintainers; [ ajs124 ];
+  };
+}
diff --git a/pkgs/development/tools/ecpdap/default.nix b/pkgs/development/tools/ecpdap/default.nix
new file mode 100644
index 00000000000..dbb9a2405b0
--- /dev/null
+++ b/pkgs/development/tools/ecpdap/default.nix
@@ -0,0 +1,36 @@
+{ lib, fetchFromGitHub, rustPlatform, pkg-config, libusb1 }:
+
+rustPlatform.buildRustPackage rec {
+  pname = "ecpdap";
+  version = "0.1.5";
+
+  src = fetchFromGitHub {
+    owner = "adamgreig";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "1z8w37i6wjz6cr453md54ip21y26605vrx4vpq5wwd11mfvc1jsg";
+  };
+
+  # The lock file was not up to date with cargo.toml for this release
+  #
+  # This patch is the lock file after running `cargo update`
+  cargoPatches = [ ./lock-update.patch ];
+
+  cargoSha256 = "08xcnvbxm508v03b3hmz71mpa3yd8lamvazxivp6qsv46ri163mn";
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [ libusb1 ];
+
+  meta = with lib; {
+    description = "A tool to program ECP5 FPGAs";
+    longDescription = ''
+      ECPDAP allows you to program ECP5 FPGAs and attached SPI flash
+      using CMSIS-DAP probes in JTAG mode.
+    '';
+    homepage = "https://github.com/adamgreig/ecpdap";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ expipiplus1 ];
+  };
+}
+
diff --git a/pkgs/development/tools/ecpdap/lock-update.patch b/pkgs/development/tools/ecpdap/lock-update.patch
new file mode 100644
index 00000000000..f57c1922ad1
--- /dev/null
+++ b/pkgs/development/tools/ecpdap/lock-update.patch
@@ -0,0 +1,345 @@
+diff --git a/Cargo.lock b/Cargo.lock
+index 91f7e0c..1610002 100644
+--- a/Cargo.lock
++++ b/Cargo.lock
+@@ -26,9 +26,9 @@ dependencies = [
+ 
+ [[package]]
+ name = "anyhow"
+-version = "1.0.37"
++version = "1.0.40"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "ee67c11feeac938fae061b232e38e0b6d94f97a9df10e6271319325ac4c56a86"
++checksum = "28b2cd92db5cbd74e8e5028f7e27dd7aa3090e89e4f2a197cc7c8dfb69c7063b"
+ 
+ [[package]]
+ name = "atty"
+@@ -49,15 +49,9 @@ checksum = "cf1de2fe8c75bc145a2f577add951f8134889b4795d47466a54a5c846d691693"
+ 
+ [[package]]
+ name = "cc"
+-version = "1.0.66"
++version = "1.0.67"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "4c0496836a84f8d0495758516b8621a622beb77c0fed418570e50764093ced48"
+-
+-[[package]]
+-name = "cfg-if"
+-version = "0.1.10"
+-source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "4785bdd1c96b2a846b2bd7cc02e86b6b3dbf14e7e53446c4f54c92a361040822"
++checksum = "e3c69b077ad434294d3ce9f1f6143a2a4b89a8a2d54ef813d85003a4fd1137fd"
+ 
+ [[package]]
+ name = "cfg-if"
+@@ -82,9 +76,9 @@ dependencies = [
+ 
+ [[package]]
+ name = "console"
+-version = "0.14.0"
++version = "0.14.1"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "7cc80946b3480f421c2f17ed1cb841753a371c7c5104f51d507e13f532c856aa"
++checksum = "3993e6445baa160675931ec041a5e03ca84b9c6e32a056150d3aa2bdda0a1f45"
+ dependencies = [
+  "encode_unicode",
+  "lazy_static",
+@@ -101,14 +95,14 @@ version = "1.2.1"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "81156fece84ab6a9f2afdb109ce3ae577e42b1228441eded99bd77f627953b1a"
+ dependencies = [
+- "cfg-if 1.0.0",
++ "cfg-if",
+ ]
+ 
+ [[package]]
+ name = "derivative"
+-version = "2.1.1"
++version = "2.2.0"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "cb582b60359da160a9477ee80f15c8d784c477e69c217ef2cdd4169c24ea380f"
++checksum = "fcc3dd5e9e9c0b295d6e1e4d811fb6f157d5ffd784b8d202fc62eac8035a770b"
+ dependencies = [
+  "proc-macro2",
+  "quote",
+@@ -117,7 +111,7 @@ dependencies = [
+ 
+ [[package]]
+ name = "ecpdap"
+-version = "0.1.4"
++version = "0.1.5"
+ dependencies = [
+  "anyhow",
+  "clap",
+@@ -153,11 +147,11 @@ dependencies = [
+ 
+ [[package]]
+ name = "filetime"
+-version = "0.2.13"
++version = "0.2.14"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "0c122a393ea57648015bf06fbd3d372378992e86b9ff5a7a497b076a28c79efe"
++checksum = "1d34cfa13a63ae058bfa601fe9e313bbdb3746427c1459185464ce0fcf62e1e8"
+ dependencies = [
+- "cfg-if 1.0.0",
++ "cfg-if",
+  "libc",
+  "redox_syscall",
+  "winapi",
+@@ -165,9 +159,9 @@ dependencies = [
+ 
+ [[package]]
+ name = "hermit-abi"
+-version = "0.1.17"
++version = "0.1.18"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "5aca5565f760fb5b220e499d72710ed156fdb74e631659e99377d9ebfbd13ae8"
++checksum = "322f4de77956e22ed0e5032c359a0f1273f1f7f0d79bfa3b8ffbc730d7fbcc5c"
+ dependencies = [
+  "libc",
+ ]
+@@ -206,9 +200,9 @@ dependencies = [
+ 
+ [[package]]
+ name = "jep106"
+-version = "0.2.4"
++version = "0.2.5"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "f57cd08ee4fbc8043949150a59e34ea5f2afeb172f875db9607689e48600c653"
++checksum = "939876d20519325db0883757e29e9858ee02919d0f03e43c74f69296caa314f4"
+ dependencies = [
+  "serde",
+ ]
+@@ -221,33 +215,35 @@ checksum = "e2abad23fbc42b3700f2f279844dc832adb2b2eb069b2df918f455c4e18cc646"
+ 
+ [[package]]
+ name = "libc"
+-version = "0.2.81"
++version = "0.2.94"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "1482821306169ec4d07f6aca392a4681f66c75c9918aa49641a2595db64053cb"
++checksum = "18794a8ad5b29321f790b55d93dfba91e125cb1a9edbd4f8e3150acc771c1a5e"
+ 
+ [[package]]
+ name = "libflate"
+-version = "1.0.3"
++version = "1.1.0"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "389de7875e06476365974da3e7ff85d55f1972188ccd9f6020dd7c8156e17914"
++checksum = "6d87eae36b3f680f7f01645121b782798b56ef33c53f83d1c66ba3a22b60bfe3"
+ dependencies = [
+  "adler32",
+  "crc32fast",
+  "libflate_lz77",
+- "rle-decode-fast",
+ ]
+ 
+ [[package]]
+ name = "libflate_lz77"
+-version = "1.0.0"
++version = "1.1.0"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "3286f09f7d4926fc486334f28d8d2e6ebe4f7f9994494b6dab27ddfad2c9b11b"
++checksum = "39a734c0493409afcd49deee13c006a04e3586b9761a03543c6272c9c51f2f5a"
++dependencies = [
++ "rle-decode-fast",
++]
+ 
+ [[package]]
+ name = "libusb1-sys"
+-version = "0.4.3"
++version = "0.4.4"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "5e3b8385bdc8931a82a0865a3a7285e2c28e41287824dc92c7724b7759a0c685"
++checksum = "be241693102a24766d0b8526c8988771edac2842630d7e730f8e9fbc014f3703"
+ dependencies = [
+  "cc",
+  "libc",
+@@ -259,11 +255,11 @@ dependencies = [
+ 
+ [[package]]
+ name = "log"
+-version = "0.4.11"
++version = "0.4.14"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "4fabed175da42fed1fa0746b0ea71f412aa9d35e76e95e59b192c64b9dc2bf8b"
++checksum = "51b9bbe6c47d51fc3e1a9b945965946b4c44142ab8792c50835a980d362c2710"
+ dependencies = [
+- "cfg-if 0.1.10",
++ "cfg-if",
+ ]
+ 
+ [[package]]
+@@ -327,9 +323,9 @@ dependencies = [
+ 
+ [[package]]
+ name = "proc-macro2"
+-version = "1.0.24"
++version = "1.0.26"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "1e0704ee1a7e00d7bb417d0770ea303c1bccbabf0ef1667dae92b5967f5f8a71"
++checksum = "a152013215dca273577e18d2bf00fa862b89b24169fb78c4c95aeb07992c9cec"
+ dependencies = [
+  "unicode-xid",
+ ]
+@@ -342,36 +338,38 @@ checksum = "a1d01941d82fa2ab50be1e79e6714289dd7cde78eba4c074bc5a4374f650dfe0"
+ 
+ [[package]]
+ name = "quote"
+-version = "1.0.8"
++version = "1.0.9"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "991431c3519a3f36861882da93630ce66b52918dcf1b8e2fd66b397fc96f28df"
++checksum = "c3d0b9745dc2debf507c8422de05d7226cc1f0644216dfdfead988f9b1ab32a7"
+ dependencies = [
+  "proc-macro2",
+ ]
+ 
+ [[package]]
+ name = "redox_syscall"
+-version = "0.1.57"
++version = "0.2.6"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "41cc0f7e4d5d4544e8861606a285bb08d3e70712ccc7d2b84d7c0ccfaf4b05ce"
++checksum = "8270314b5ccceb518e7e578952f0b72b88222d02e8f77f5ecf7abbb673539041"
++dependencies = [
++ "bitflags",
++]
+ 
+ [[package]]
+ name = "regex"
+-version = "1.4.2"
++version = "1.4.6"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "38cf2c13ed4745de91a5eb834e11c00bcc3709e773173b2ce4c56c9fbde04b9c"
++checksum = "2a26af418b574bd56588335b3a3659a65725d4e636eb1016c2f9e3b38c7cc759"
+ dependencies = [
+  "aho-corasick",
+  "memchr",
+  "regex-syntax",
+- "thread_local",
+ ]
+ 
+ [[package]]
+ name = "regex-syntax"
+-version = "0.6.21"
++version = "0.6.23"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "3b181ba2dcf07aaccad5448e8ead58db5b742cf85dfe035e2227f137a539a189"
++checksum = "24d5f089152e60f62d28b835fbff2cd2e8dc0baf1ac13343bef92ab7eed84548"
+ 
+ [[package]]
+ name = "rle-decode-fast"
+@@ -391,18 +389,18 @@ dependencies = [
+ 
+ [[package]]
+ name = "serde"
+-version = "1.0.118"
++version = "1.0.125"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "06c64263859d87aa2eb554587e2d23183398d617427327cf2b3d0ed8c69e4800"
++checksum = "558dc50e1a5a5fa7112ca2ce4effcb321b0300c0d4ccf0776a9f60cd89031171"
+ dependencies = [
+  "serde_derive",
+ ]
+ 
+ [[package]]
+ name = "serde_derive"
+-version = "1.0.118"
++version = "1.0.125"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "c84d3526699cd55261af4b941e4e725444df67aa4f9e6a3564f18030d12672df"
++checksum = "b093b7a2bb58203b5da3056c05b4ec1fed827dcfdb37347a8841695263b3d06d"
+ dependencies = [
+  "proc-macro2",
+  "quote",
+@@ -431,9 +429,9 @@ checksum = "8ea5119cdb4c55b55d432abb513a0429384878c15dde60cc77b1c99de1a95a6a"
+ 
+ [[package]]
+ name = "syn"
+-version = "1.0.57"
++version = "1.0.71"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "4211ce9909eb971f111059df92c45640aad50a619cf55cd76476be803c4c68e6"
++checksum = "ad184cc9470f9117b2ac6817bfe297307418819ba40552f9b3846f05c33d5373"
+ dependencies = [
+  "proc-macro2",
+  "quote",
+@@ -442,13 +440,12 @@ dependencies = [
+ 
+ [[package]]
+ name = "tar"
+-version = "0.4.30"
++version = "0.4.33"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "489997b7557e9a43e192c527face4feacc78bfbe6eed67fd55c4c9e381cba290"
++checksum = "c0bcfbd6a598361fda270d82469fff3d65089dc33e175c9a131f7b4cd395f228"
+ dependencies = [
+  "filetime",
+  "libc",
+- "redox_syscall",
+  "xattr",
+ ]
+ 
+@@ -463,9 +460,9 @@ dependencies = [
+ 
+ [[package]]
+ name = "terminal_size"
+-version = "0.1.15"
++version = "0.1.16"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "4bd2d183bd3fac5f5fe38ddbeb4dc9aec4a39a9d7d59e7491d900302da01cbe1"
++checksum = "86ca8ced750734db02076f44132d802af0b33b09942331f4459dde8636fd2406"
+ dependencies = [
+  "libc",
+  "winapi",
+@@ -482,33 +479,24 @@ dependencies = [
+ 
+ [[package]]
+ name = "thiserror"
+-version = "1.0.23"
++version = "1.0.24"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "76cc616c6abf8c8928e2fdcc0dbfab37175edd8fb49a4641066ad1364fdab146"
++checksum = "e0f4a65597094d4483ddaed134f409b2cb7c1beccf25201a9f73c719254fa98e"
+ dependencies = [
+  "thiserror-impl",
+ ]
+ 
+ [[package]]
+ name = "thiserror-impl"
+-version = "1.0.23"
++version = "1.0.24"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "9be73a2caec27583d0046ef3796c3794f868a5bc813db689eed00c7631275cd1"
++checksum = "7765189610d8241a44529806d6fd1f2e0a08734313a35d5b3a556f92b381f3c0"
+ dependencies = [
+  "proc-macro2",
+  "quote",
+  "syn",
+ ]
+ 
+-[[package]]
+-name = "thread_local"
+-version = "1.0.1"
+-source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "d40c6d1b69745a6ec6fb1ca717914848da4b44ae29d9b3080cbee91d72a69b14"
+-dependencies = [
+- "lazy_static",
+-]
+-
+ [[package]]
+ name = "toml"
+ version = "0.5.8"
+@@ -532,9 +520,9 @@ checksum = "f7fe0bb3479651439c9112f72b6c505038574c9fbb575ed1bf3b797fa39dd564"
+ 
+ [[package]]
+ name = "vcpkg"
+-version = "0.2.11"
++version = "0.2.12"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "b00bca6106a5e23f3eee943593759b7fcddb00554332e856d990c893966879fb"
++checksum = "cbdbff6266a24120518560b5dc983096efb98462e51d0d68169895b237be3e5d"
+ 
+ [[package]]
+ name = "vec_map"
diff --git a/pkgs/servers/roon-server/default.nix b/pkgs/servers/roon-server/default.nix
index 145a1927f2c..3fcb8af65e2 100644
--- a/pkgs/servers/roon-server/default.nix
+++ b/pkgs/servers/roon-server/default.nix
@@ -11,15 +11,15 @@
 , zlib
 }: stdenv.mkDerivation rec {
   name = "roon-server";
-  version = "100800753";
+  version = "100800790";
 
   # N.B. The URL is unstable. I've asked for them to provide a stable URL but
   # they have ignored me. If this package fails to build for you, you may need
   # to update the version and sha256.
   # c.f. https://community.roonlabs.com/t/latest-roon-server-is-not-available-for-download-on-nixos/118129
   src = fetchurl {
-    url = "https://web.archive.org/web/20210209195555/https://download.roonlabs.com/builds/RoonServer_linuxx64.tar.bz2";
-    sha256 = "sha256-uas1vqIDWlYr7jgsrlBeJSPjMxwzVnrkCD9jJljkFZs=";
+    url = "https://web.archive.org/web/20210428204513/https://download.roonlabs.com/builds/RoonServer_linuxx64.tar.bz2";
+    sha256 = "1jhj52fmkdgr9qfang1i9qrl1z56h56x07k31n3kllknkv02lc8p";
   };
 
   buildInputs = [
diff --git a/pkgs/tools/system/hwinfo/default.nix b/pkgs/tools/system/hwinfo/default.nix
index 5272fb8666e..503df3a31f9 100644
--- a/pkgs/tools/system/hwinfo/default.nix
+++ b/pkgs/tools/system/hwinfo/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-u5EXU+BrTMeDbZAv8WyBTyFcZHdBIUMpJSLTYgf3Mo8=";
   };
 
-  patchPhase = ''
+  postPatch = ''
     # VERSION and changelog are usually generated using Git
     # unless HWINFO_VERSION is defined (see Makefile)
     export HWINFO_VERSION="${version}"
@@ -32,7 +32,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "Hardware detection tool from openSUSE";
-    license = licenses.gpl2;
+    license = licenses.gpl2Only;
     homepage = "https://github.com/openSUSE/hwinfo";
     maintainers = with maintainers; [ bobvanderlinden ];
     platforms = platforms.linux;
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 145add3de22..ca3e6164ea6 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -12041,6 +12041,8 @@ in
   pypy27Packages = pypy27.pkgs;
   pypy3Packages = pypy3.pkgs;
 
+  py3c = callPackage ../development/libraries/py3c { };
+
   pythonManylinuxPackages = callPackage ./../development/interpreters/python/manylinux { };
 
   update-python-libraries = callPackage ../development/interpreters/python/update-python-libraries { };
@@ -22710,6 +22712,8 @@ in
     jdk = jdk11;
   });
 
+  ecpdap = callPackage ../development/tools/ecpdap { };
+
   ecs-agent = callPackage ../applications/virtualization/ecs-agent { };
 
   ed = callPackage ../applications/editors/ed { };
@@ -25254,10 +25258,7 @@ in
 
   osmscout-server = libsForQt5.callPackage ../applications/misc/osmscout-server { };
 
-  palemoon = callPackage ../applications/networking/browsers/palemoon {
-    # https://developer.palemoon.org/build/linux/
-    stdenv = gcc8Stdenv;
-  };
+  palemoon = callPackage ../applications/networking/browsers/palemoon { };
 
   webbrowser = callPackage ../applications/networking/browsers/webbrowser {};