diff --git a/nixos/modules/services/web-apps/hledger-web.nix b/nixos/modules/services/web-apps/hledger-web.nix
index 43fc4daa177..a69767194c3 100644
--- a/nixos/modules/services/web-apps/hledger-web.nix
+++ b/nixos/modules/services/web-apps/hledger-web.nix
@@ -26,19 +26,46 @@ in {
       '';
     };
 
-    capabilities = mkOption {
-      type = types.commas;
-      default = "view";
+    capabilities = {
+      view = mkOption {
+        type = types.bool;
+        default = true;
+        description = ''
+          Enable the view capability.
+        '';
+      };
+      add = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          Enable the add capability.
+        '';
+      };
+      manage = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          Enable the manage capability.
+        '';
+      };
+    };
+
+    stateDir = mkOption {
+      type = types.path;
+      default = "/var/lib/hledger-web";
       description = ''
-        Enable the view, add, and/or manage capabilities. E.g. view,add
+        Path the service has access to. If left as the default value this
+        directory will automatically be created before the hledger-web server
+        starts, otherwise the sysadmin is responsible for ensuring the
+        directory exists with appropriate ownership and permissions.
       '';
     };
 
-    journalFile = mkOption {
-      type = types.path;
-      example = "/home/hledger/.hledger.journal";
+    journalFiles = mkOption {
+      type = types.listOf types.str;
+      default = [ ".hledger.journal" ];
       description = ''
-        Input journal file.
+        Paths to journal files relative to <option>services.hledger-web.stateDir</option>.
       '';
     };
 
@@ -50,28 +77,66 @@ in {
         Base URL, when sharing over a network.
       '';
     };
+
+    extraOptions = mkOption {
+      type = types.listOf types.str;
+      default = [];
+      example = [ "--forecast" ];
+      description = ''
+        Extra command line arguments to pass to hledger-web.
+      '';
+    };
+
   };
 
   config = mkIf cfg.enable {
-    systemd.services.hledger-web = {
+
+    users.users.hledger = {
+      name = "hledger";
+      group = "hledger";
+      isSystemUser = true;
+      home = cfg.stateDir;
+      useDefaultShell = true;
+    };
+
+    users.groups.hledger = {};
+
+    systemd.services.hledger-web = let
+      capabilityString = with cfg.capabilities; concatStringsSep "," (
+        (optional view "view")
+        ++ (optional add "add")
+        ++ (optional manage "manage")
+      );
+      serverArgs = with cfg; escapeShellArgs ([
+        "--serve"
+        "--host=${host}"
+        "--port=${toString port}"
+        "--capabilities=${capabilityString}"
+        (optionalString (cfg.baseUrl != null) "--base-url=${cfg.baseUrl}")
+        (optionalString (cfg.serveApi) "--serve-api")
+      ] ++ (map (f: "--file=${stateDir}/${f}") cfg.journalFiles)
+        ++ extraOptions);
+    in {
       description = "hledger-web - web-app for the hledger accounting tool.";
       documentation = [ https://hledger.org/hledger-web.html ];
       wantedBy = [ "multi-user.target" ];
       after = [ "networking.target" ];
-      serviceConfig = {
-        ExecStart = ''
-          ${pkgs.hledger-web}/bin/hledger-web \
-          --host=${cfg.host} \
-          --port=${toString cfg.port} \
-          --file=${cfg.journalFile}  \
-          "--capabilities=${cfg.capabilities}" \
-          ${optionalString (cfg.baseUrl != null) "--base-url=${cfg.baseUrl}"} \
-          ${optionalString (cfg.serveApi) "--serve-api"}
-        '';
-        Restart = "always";
-      };
+      serviceConfig = mkMerge [
+        {
+          ExecStart = "${pkgs.hledger-web}/bin/hledger-web ${serverArgs}";
+          Restart = "always";
+          WorkingDirectory = cfg.stateDir;
+          User = "hledger";
+          Group = "hledger";
+          PrivateTmp = true;
+        }
+        (mkIf (cfg.stateDir == "/var/lib/hledger-web") {
+          StateDirectory = "hledger-web";
+        })
+      ];
     };
+
   };
 
-  meta.maintainers = with lib.maintainers; [ marijanp ];
+  meta.maintainers = with lib.maintainers; [ marijanp erictapen ];
 }
diff --git a/nixos/tests/hledger-web.nix b/nixos/tests/hledger-web.nix
index 378d819437d..f8919f7d4bd 100644
--- a/nixos/tests/hledger-web.nix
+++ b/nixos/tests/hledger-web.nix
@@ -13,25 +13,22 @@ rec {
   name = "hledger-web";
   meta.maintainers = with lib.maintainers; [ marijanp ];
 
-  nodes = {
-    server = { config, pkgs, ... }: rec {
+  nodes = rec {
+    server = { config, pkgs, ... }: {
       services.hledger-web = {
         host = "127.0.0.1";
         port = 5000;
         enable = true;
-        journalFile = journal;
+        capabilities.manage = true;
       };
-      networking.firewall.allowedTCPPorts = [ services.hledger-web.port ];
+      networking.firewall.allowedTCPPorts = [ config.services.hledger-web.port ];
+      systemd.services.hledger-web.preStart = ''
+        ln -s ${journal} /var/lib/hledger-web/.hledger.journal
+      '';
     };
-    apiserver = { config, pkgs, ... }: rec {
-      services.hledger-web = {
-        host = "127.0.0.1";
-        port = 5000;
-        enable = true;
-        serveApi = true;
-        journalFile = journal;
-      };
-      networking.firewall.allowedTCPPorts = [ services.hledger-web.port ];
+    apiserver = { ... }: {
+      imports = [ server ];
+      services.hledger-web.serveApi = true;
     };
   };
 
@@ -42,7 +39,7 @@ rec {
     server.wait_for_open_port(5000)
     with subtest("Check if web UI is accessible"):
         page = server.succeed("curl -L http://127.0.0.1:5000")
-        assert "test.journal" in page
+        assert ".hledger.journal" in page
 
     apiserver.wait_for_unit("hledger-web.service")
     apiserver.wait_for_open_port(5000)
diff --git a/pkgs/applications/editors/tiled/default.nix b/pkgs/applications/editors/tiled/default.nix
index b6222c8a6d2..4fbbacf8f1e 100644
--- a/pkgs/applications/editors/tiled/default.nix
+++ b/pkgs/applications/editors/tiled/default.nix
@@ -3,13 +3,13 @@
 
 mkDerivation rec {
   pname = "tiled";
-  version = "1.4.3";
+  version = "1.5.0";
 
   src = fetchFromGitHub {
     owner = "bjorn";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0n8p7bp5pqq72c65av3v7wbazwphh78pw27nqvpiyp9y8k5w4pg0";
+    sha256 = "sha256-Pf9nA5DUAJ+PPNG+oP7RO4/TD8fy4ADsyq625a6cbFk=";
   };
 
   nativeBuildInputs = [ pkg-config qmake ];
diff --git a/pkgs/applications/networking/cloudflared/default.nix b/pkgs/applications/networking/cloudflared/default.nix
index 6b1df1acf5a..8310d058492 100644
--- a/pkgs/applications/networking/cloudflared/default.nix
+++ b/pkgs/applications/networking/cloudflared/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "cloudflared";
-  version = "2021.2.1";
+  version = "2021.3.3";
 
   src = fetchFromGitHub {
     owner  = "cloudflare";
     repo   = "cloudflared";
     rev    = version;
-    sha256 = "sha256-kmlyj6Q+OAJ0cKMeWxajPDBm99WpRf+Gpvc+Jy79DCo=";
+    sha256 = "sha256-St2WBdy76OVFlYoY1RGwQj1WsUpPtsL7yX1MFwztKgs=";
   };
 
   vendorSha256 = null;
diff --git a/pkgs/applications/networking/instant-messengers/telegram/tdesktop/default.nix b/pkgs/applications/networking/instant-messengers/telegram/tdesktop/default.nix
index 566e62ae7f0..4d6e22bd89c 100644
--- a/pkgs/applications/networking/instant-messengers/telegram/tdesktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/telegram/tdesktop/default.nix
@@ -1,8 +1,8 @@
-{ mkDerivation, lib, fetchurl, callPackage
+{ mkDerivation, lib, fetchurl, fetchpatch, callPackage
 , pkg-config, cmake, ninja, python3, wrapGAppsHook, wrapQtAppsHook, removeReferencesTo
 , qtbase, qtimageformats, gtk3, libsForQt5, enchant2, lz4, xxHash
 , dee, ffmpeg, openalSoft, minizip, libopus, alsaLib, libpulseaudio, range-v3
-, tl-expected, hunspell
+, tl-expected, hunspell, glibmm
 # Transitive dependencies:
 , pcre, xorg, util-linux, libselinux, libsepol, epoxy
 , at-spi2-core, libXtst, libthai, libdatrie
@@ -20,15 +20,19 @@ with lib;
 
 let
   tg_owt = callPackage ./tg_owt.nix {};
+  tgcalls-gcc10-fix = fetchpatch { # "Fix build on GCC 10, second attempt."
+    url = "https://github.com/TelegramMessenger/tgcalls/commit/eded7cc540123eaf26361958b9a61c65cb2f7cfc.patch";
+    sha256 = "19n1hvn44pp01zc90g93vq2bcr2gdnscaj5il9f82klgh4llvjli";
+  };
 
 in mkDerivation rec {
   pname = "telegram-desktop";
-  version = "2.6.1";
+  version = "2.7.1";
 
   # Telegram-Desktop with submodules
   src = fetchurl {
     url = "https://github.com/telegramdesktop/tdesktop/releases/download/v${version}/tdesktop-${version}-full.tar.gz";
-    sha256 = "0wwb18wnh9sbfc6h7m8lj8qmc2n2p0zmp2977ddif6k2gi6qr1y7";
+    sha256 = "01fxzcfz3xankmdar55ja55pb9hkvlf1plgpgjpsda9xwqgbxgs1";
   };
 
   postPatch = ''
@@ -36,6 +40,7 @@ in mkDerivation rec {
       --replace '"libenchant-2.so.2"' '"${enchant2}/lib/libenchant-2.so.2"'
     substituteInPlace Telegram/CMakeLists.txt \
       --replace '"''${TDESKTOP_LAUNCHER_BASENAME}.appdata.xml"' '"''${TDESKTOP_LAUNCHER_BASENAME}.metainfo.xml"'
+    patch -d Telegram/ThirdParty/tgcalls/ -p1 < "${tgcalls-gcc10-fix}"
   '';
 
   # We want to run wrapProgram manually (with additional parameters)
@@ -47,7 +52,7 @@ in mkDerivation rec {
   buildInputs = [
     qtbase qtimageformats gtk3 libsForQt5.kwayland libsForQt5.libdbusmenu enchant2 lz4 xxHash
     dee ffmpeg openalSoft minizip libopus alsaLib libpulseaudio range-v3
-    tl-expected hunspell
+    tl-expected hunspell glibmm
     tg_owt
     # Transitive dependencies:
     pcre xorg.libpthreadstubs xorg.libXdmcp util-linux libselinux libsepol epoxy
diff --git a/pkgs/applications/networking/instant-messengers/telegram/tdesktop/tg_owt.nix b/pkgs/applications/networking/instant-messengers/telegram/tdesktop/tg_owt.nix
index 7efac01c55a..6bd72134e02 100644
--- a/pkgs/applications/networking/instant-messengers/telegram/tdesktop/tg_owt.nix
+++ b/pkgs/applications/networking/instant-messengers/telegram/tdesktop/tg_owt.nix
@@ -4,8 +4,8 @@
 }:
 
 let
-  rev = "a19877363082da634a3c851a4698376504d2eaee";
-  sha256 = "03m6fkc3m2wbh821mr3ybsmd7sjllky44mizny96k4b249dkvzx7";
+  rev = "2d804d2c9c5d05324c8ab22f2e6ff8306521b3c3";
+  sha256 = "0kz0i381iwsgcc3yzsq7njx3gkqja4bb9fsgc24vhg0md540qhyn";
 
 in stdenv.mkDerivation {
   pname = "tg_owt";
diff --git a/pkgs/applications/office/banking/default.nix b/pkgs/applications/office/banking/default.nix
new file mode 100644
index 00000000000..c71c1eafa66
--- /dev/null
+++ b/pkgs/applications/office/banking/default.nix
@@ -0,0 +1,67 @@
+{ lib
+, fetchurl
+, fetchFromGitLab
+, python3
+, appstream-glib
+, desktop-file-utils
+, glib
+, gtk3
+, libxml2
+, meson
+, ninja
+, pkg-config
+, wrapGAppsHook
+, gobject-introspection
+, libhandy
+, librsvg
+}:
+
+python3.pkgs.buildPythonApplication rec {
+  pname = "banking";
+  version = "0.3.0";
+  format = "other";
+
+  src = fetchFromGitLab {
+    owner = "tabos";
+    repo = "banking";
+    rev = version;
+    sha256 = "1w5x9iczw5hb9bfdm1df37n8xhdrida1yfrd82k9l8hb1k4q3h9d";
+  };
+
+  postPatch = ''
+    patchShebangs meson_post_install.py
+  '';
+
+  nativeBuildInputs = [
+    appstream-glib # for appstream-util
+    desktop-file-utils # for desktop-file-validate
+    glib # for glib-compile-resources
+    gtk3 # for gtk-update-icon-cache
+    libxml2 # for xmllint
+    meson
+    ninja
+    pkg-config
+    wrapGAppsHook
+  ];
+
+  buildInputs = [
+    gobject-introspection
+    gtk3
+    libhandy
+    librsvg
+  ];
+
+  propagatedBuildInputs = with python3.pkgs; [
+    cryptography
+    fints
+    mt-940
+    pygobject3
+  ];
+
+  meta = with lib; {
+    description = "Banking application for small screens";
+    homepage = "https://tabos.gitlab.io/project/banking/";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ dotlambda ];
+  };
+}
diff --git a/pkgs/applications/window-managers/herbstluftwm/default.nix b/pkgs/applications/window-managers/herbstluftwm/default.nix
index a1151dcf82e..ce0b40c0bb7 100644
--- a/pkgs/applications/window-managers/herbstluftwm/default.nix
+++ b/pkgs/applications/window-managers/herbstluftwm/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, cmake, pkg-config, python3, libX11, libXext, libXinerama, libXrandr, libXft, freetype, asciidoc-full
+{ lib, stdenv, fetchurl, cmake, pkg-config, python3, libX11, libXext, libXinerama, libXrandr, libXft, freetype, asciidoc
 , xdotool, xorgserver, xsetroot, xterm, runtimeShell
 , nixosTests }:
 
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
   ];
 
   depsBuildBuild = [
-    asciidoc-full
+    asciidoc
   ];
 
   buildInputs = [
diff --git a/pkgs/data/fonts/vollkorn/default.nix b/pkgs/data/fonts/vollkorn/default.nix
index 571a88b89e0..6c5836da5b0 100644
--- a/pkgs/data/fonts/vollkorn/default.nix
+++ b/pkgs/data/fonts/vollkorn/default.nix
@@ -5,7 +5,7 @@ let
 in
 fetchzip {
   name = "${pname}-${version}";
-  url = "http://vollkorn-typeface.com/download/vollkorn-4-105.zip";
+  url = "http://vollkorn-typeface.com/download/vollkorn-${builtins.replaceStrings ["."] ["-"] version}.zip";
   sha256 = "0srff2nqs7353mqcpmvaq156lamfh621py4h1771n0l9ix2c8mss";
   stripRoot = false;
 
diff --git a/pkgs/development/libraries/google-cloud-cpp/default.nix b/pkgs/development/libraries/google-cloud-cpp/default.nix
index af451281402..d493f31d375 100644
--- a/pkgs/development/libraries/google-cloud-cpp/default.nix
+++ b/pkgs/development/libraries/google-cloud-cpp/default.nix
@@ -9,10 +9,8 @@
 , doxygen
 , protobuf
 , crc32c
-, c-ares
 , fetchurl
 , openssl
-, zlib
 , libnsl
 }:
 let
@@ -33,7 +31,7 @@ let
     };
 
     nativeBuildInputs = [ cmake pkg-config ];
-    buildInputs = [ c-ares c-ares.cmake-config grpc openssl protobuf zlib ];
+    buildInputs = [ grpc openssl protobuf ];
 
     postPatch = ''
       sed -e 's,https://github.com/googleapis/googleapis/archive/9c9f778aedde02f9826d2ae5d0f9c96409ba0f25.tar.gz,file://${googleapis},' \
@@ -55,7 +53,7 @@ in stdenv.mkDerivation rec {
     sha256 = "15wci4m8h6py7fqfziq8mp5m6pxp2h1cbh5rp2k90mk5js4jb9pa";
   };
 
-  buildInputs = [ curl crc32c c-ares c-ares.cmake-config googleapis-cpp-cmakefiles grpc protobuf libnsl ];
+  buildInputs = [ curl crc32c googleapis-cpp-cmakefiles grpc protobuf libnsl ];
   nativeBuildInputs = [ clang-tools cmake pkg-config doxygen ];
 
   outputs = [ "out" "dev" ];
diff --git a/pkgs/development/libraries/libmspack/default.nix b/pkgs/development/libraries/libmspack/default.nix
index 4ad60bcfb18..a26f0c3f3a4 100644
--- a/pkgs/development/libraries/libmspack/default.nix
+++ b/pkgs/development/libraries/libmspack/default.nix
@@ -1,17 +1,18 @@
 {lib, stdenv, fetchurl}:
 
 stdenv.mkDerivation rec {
-  name = "libmspack-0.7.1alpha";
+  pname = "libmspack";
+  version = "0.10.1alpha";
 
   src = fetchurl {
-    url = "https://www.cabextract.org.uk/libmspack/${name}.tar.gz";
-    sha256 = "0zn4vwzk5ankgd0l88cipan19pzbzv0sm3fba17lvqwka3dp1acp";
+    url = "https://www.cabextract.org.uk/libmspack/${pname}-${version}.tar.gz";
+    sha256 = "13janaqsvm7aqc4agjgd4819pbgqv50j88bh5kci1z70wvg65j5s";
   };
 
   meta = {
     description = "A de/compression library for various Microsoft formats";
     homepage = "https://www.cabextract.org.uk/libmspack";
-    license = lib.licenses.lgpl2;
+    license = lib.licenses.lgpl2Only;
     platforms = lib.platforms.unix;
   };
 }
diff --git a/pkgs/development/libraries/libnbd/default.nix b/pkgs/development/libraries/libnbd/default.nix
index 6ad0435a84e..6afced2d6d1 100644
--- a/pkgs/development/libraries/libnbd/default.nix
+++ b/pkgs/development/libraries/libnbd/default.nix
@@ -11,11 +11,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libnbd";
-  version = "1.7.2";
+  version = "1.7.4";
 
   src = fetchurl {
     url = "https://download.libguestfs.org/libnbd/${lib.versions.majorMinor version}-development/${pname}-${version}.tar.gz";
-    hash = "sha256-+xC4wDEeWi3RteF04C/qjMmjM+lmhtrtXZZyM1UUli4=";
+    sha256 = "0d586c8mbk50hjslq32n70sdp2a7lbsjv9zhky4w6jy950rrdfqh";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/lightstep-tracer-cpp/default.nix b/pkgs/development/libraries/lightstep-tracer-cpp/default.nix
index d47c7b50abe..8ef4513a18d 100644
--- a/pkgs/development/libraries/lightstep-tracer-cpp/default.nix
+++ b/pkgs/development/libraries/lightstep-tracer-cpp/default.nix
@@ -1,12 +1,8 @@
 { stdenv, lib, fetchFromGitHub, pkg-config, cmake
-, opentracing-cpp, protobuf, zlib
-, enableGrpc ? false, grpc ? null, openssl ? null, c-ares ? null
+, opentracing-cpp, protobuf
+, enableGrpc ? false, grpc, openssl
 }:
 
-assert enableGrpc -> grpc != null;
-assert enableGrpc -> openssl != null;
-assert enableGrpc -> c-ares != null;
-
 stdenv.mkDerivation rec {
   pname = "lightstep-tracer-cpp";
   version = "0.14.0";
@@ -23,9 +19,9 @@ stdenv.mkDerivation rec {
   ];
 
   buildInputs = [
-    opentracing-cpp protobuf zlib
+    opentracing-cpp protobuf
   ] ++ lib.optionals enableGrpc [
-    grpc openssl c-ares c-ares.cmake-config
+    grpc openssl
   ];
 
   cmakeFlags = lib.optionals (!enableGrpc) [ "-DWITH_GRPC=OFF" ];
diff --git a/pkgs/development/libraries/lmdb/default.nix b/pkgs/development/libraries/lmdb/default.nix
index a59b460734d..229e82c323a 100644
--- a/pkgs/development/libraries/lmdb/default.nix
+++ b/pkgs/development/libraries/lmdb/default.nix
@@ -2,12 +2,12 @@
 
 stdenv.mkDerivation rec {
   pname = "lmdb";
-  version = "0.9.25";
+  version = "0.9.28";
 
   src = fetchgit {
     url = "https://git.openldap.org/openldap/openldap.git";
     rev = "LMDB_${version}";
-    sha256 = "0i60zlca8r6fib23gdgl4c80gxpx24772ggpvz94yr7zaai4k11w";
+    sha256 = "012a8bs49cswsnzw7k4piis5b6dn4by85w7a7mai9i04xcjyy9as";
   };
 
   postUnpack = "sourceRoot=\${sourceRoot}/libraries/liblmdb";
diff --git a/pkgs/development/libraries/physics/rivet/default.nix b/pkgs/development/libraries/physics/rivet/default.nix
index 7cacab9bdf4..44065904d99 100644
--- a/pkgs/development/libraries/physics/rivet/default.nix
+++ b/pkgs/development/libraries/physics/rivet/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, fastjet, fastjet-contrib, ghostscript, gsl, hepmc, imagemagick, less, python3, rsync, texlive, yoda, which, makeWrapper }:
+{ lib, stdenv, fetchurl, fetchpatch, fastjet, fastjet-contrib, ghostscript, hepmc, imagemagick, less, python3, rsync, texlive, yoda, which, makeWrapper }:
 
 stdenv.mkDerivation rec {
   pname = "rivet";
@@ -11,6 +11,38 @@ stdenv.mkDerivation rec {
 
   patches = [
     ./darwin.patch # configure relies on impure sw_vers to -Dunix
+
+    # fix compilation errors (fails depending on number of cores filesystem ordering?)
+    # https://gitlab.com/hepcedar/rivet/-/merge_requests/220
+    (fetchpatch {
+      url = "https://gitlab.com/hepcedar/rivet/commit/3203bf12a4bef81f880789eb9cde7ff489ae5115.diff";
+      sha256 = "0zn5yxlv6dk4vcqgz0syzb9mp4qc9smpmgshcqimcvii7qcp20mc";
+    })
+    # https://gitlab.com/hepcedar/rivet/-/merge_requests/223
+    (fetchpatch {
+      url = "https://gitlab.com/hepcedar/rivet/commit/476f267c46b126fa163a92aa6cbcb7806c4624c3.diff";
+      sha256 = "0dhkraddzp06v5z0d2wf0c8vsd50hl5pqsjgsrb8x14d0vwi8rnc";
+    })
+
+    # fix for new python and fix transparency gs 9.52
+    # gs 9.52 opacity fix
+    (fetchpatch {
+      url = "https://gitlab.com/hepcedar/rivet/commit/25c4bee19882fc56407b0a438f86e1a11753d5e6.diff";
+      sha256 = "18p2wk54r0qfq6l27z6805zq1z5jhk5sbxbjixgibzq8prj1a78v";
+    })
+
+    # make-plots: fix wrong logic in Plot.set_xmax()
+    (fetchpatch {
+      url = "https://gitlab.com/hepcedar/rivet/commit/d371c6c10cf67a41c0e4e27c16ff5723d6276ad2.diff";
+      sha256 = "0w622rd5darj7qafbbc84blznvy5rnhsdyr2n1i1fkz19mrf5h2p";
+    })
+
+    # fix https://gitlab.com/hepcedar/rivet/-/issues/200
+    (fetchpatch {
+      url = "https://gitlab.com/hepcedar/rivet/commit/442dbd17dcb3bd6e30b26e54c50f6a8237f966f9.diff";
+      includes = [ "bin/make-pgfplots" "bin/make-plots" "bin/make-plots-fast" ];
+      sha256 = "0c3rysgcib49km1zdpgsdai3xi4s6ijqgxp4whn04mrh3qf4bmr3";
+    })
   ];
 
   latex = texlive.combine { inherit (texlive)
diff --git a/pkgs/development/php-packages/pcov/default.nix b/pkgs/development/php-packages/pcov/default.nix
index 84fbc4f7a46..1422e1b176d 100644
--- a/pkgs/development/php-packages/pcov/default.nix
+++ b/pkgs/development/php-packages/pcov/default.nix
@@ -3,8 +3,8 @@
 buildPecl {
   pname = "pcov";
 
-  version = "1.0.6";
-  sha256 = "1psfwscrc025z8mziq69pcx60k4fbkqa5g2ia8lplb94mmarj0v1";
+  version = "1.0.8";
+  sha256 = "sha256-6rbniyxLIHPW/e+eWZN1qS8F1rOB7ld1N8JKUS1geRQ=";
 
   buildInputs = [ pcre' ];
 
diff --git a/pkgs/development/python-modules/llfuse/default.nix b/pkgs/development/python-modules/llfuse/default.nix
index e74263cdb77..16adf1beabd 100644
--- a/pkgs/development/python-modules/llfuse/default.nix
+++ b/pkgs/development/python-modules/llfuse/default.nix
@@ -1,42 +1,53 @@
-{ lib, stdenv, fetchPypi, fetchpatch, buildPythonPackage, pkg-config, pytest, fuse, attr, which
+{ lib
+, stdenv
+, buildPythonPackage
+, pythonOlder
+, fetchFromGitHub
 , contextlib2
+, cython
+, fuse
+, pkg-config
+, pytestCheckHook
+, python
+, which
 }:
 
 buildPythonPackage rec {
   pname = "llfuse";
-  version = "1.3.8";
+  version = "1.4.1";
 
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "1g2cdhdqrb6m7655qp61pn61pwj1ql61cdzhr2jvl3w4i8877ddr";
+  disabled = pythonOlder "3.5";
+
+  src = fetchFromGitHub {
+    owner = "python-llfuse";
+    repo = "python-llfuse";
+    rev = "release-${version}";
+    sha256 = "1dcpdg6cpkmdbyg66fgrylj7dp9zqzg5bf23y6m6673ykgxlv480";
   };
 
-  patches = [
-    # fix tests with pytest 6
-    (fetchpatch {
-      url = "https://github.com/python-llfuse/python-llfuse/commit/1ed8b280d2544eedf8bf209761bef0d2519edd17.diff";
-      sha256 = "0wailfrr1i0n2m9ylwpr00jh79s7z3l36w7x19jx1x4djcz2hdps";
-    })
-  ];
-
-  nativeBuildInputs = [ pkg-config ];
+  nativeBuildInputs = [ cython pkg-config ];
 
   buildInputs = [ fuse ];
 
-  checkInputs = [ pytest which ] ++
-    lib.optionals stdenv.isLinux [ attr ];
-
   propagatedBuildInputs = [ contextlib2 ];
 
-  checkPhase = ''
-    py.test -k "not test_listdir" ${lib.optionalString stdenv.isDarwin ''-m "not uses_fuse"''}
+  preBuild = ''
+    ${python.interpreter} setup.py build_cython
   '';
 
+  checkInputs = [ pytestCheckHook which ];
+
+  disabledTests = [
+    "test_listdir" # accesses /usr/bin
+  ] ++ lib.optionals stdenv.isDarwin [
+    "uses_fuse"
+  ];
+
   meta = with lib; {
     description = "Python bindings for the low-level FUSE API";
     homepage = "https://github.com/python-llfuse/python-llfuse";
     license = licenses.lgpl2Plus;
     platforms = platforms.unix;
-    maintainers = with maintainers; [ bjornfor ];
+    maintainers = with maintainers; [ bjornfor dotlambda ];
   };
 }
diff --git a/pkgs/development/python-modules/nose-timer/default.nix b/pkgs/development/python-modules/nose-timer/default.nix
index c93f5bda983..bbc164c85e2 100644
--- a/pkgs/development/python-modules/nose-timer/default.nix
+++ b/pkgs/development/python-modules/nose-timer/default.nix
@@ -1,20 +1,44 @@
-{ buildPythonPackage, fetchPypi, lib, nose, }:
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, nose
+, mock
+, parameterized
+, termcolor
+}:
 
 buildPythonPackage rec {
   pname = "nose-timer";
-  version = "1.0.0";
+  version = "1.0.1";
 
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "09hwjwbczi06bfqgiylb2yxs5h88jdl26zi1fdqxdzvamrkksf2c";
+  src = fetchFromGitHub {
+    owner = "mahmoudimus";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "0xsai2l5i1av62y9y0q63wy2zk27klmf2jizgghhxg2y8nfa8x3x";
   };
 
   propagatedBuildInputs = [ nose ];
 
+  checkInputs = [
+    mock
+    nose
+    parameterized
+    termcolor
+  ];
+
+  checkPhase = ''
+    runHook preCheck
+    nosetests --verbosity 2 tests
+    runHook postCheck
+  '';
+
+  pythonImportsCheck = [ "nosetimer" ];
+
   meta = with lib; {
+    description = "A timer plugin for nosetests";
     homepage = "https://github.com/mahmoudimus/nose-timer";
     license = licenses.mit;
-    description = "A timer plugin for nosetests (how much time does every test take?)";
     maintainers = with maintainers; [ doronbehar ];
   };
 }
diff --git a/pkgs/development/python-modules/parameterized/default.nix b/pkgs/development/python-modules/parameterized/default.nix
index dbf5475bab3..1183c09e62e 100644
--- a/pkgs/development/python-modules/parameterized/default.nix
+++ b/pkgs/development/python-modules/parameterized/default.nix
@@ -1,28 +1,40 @@
-{ lib, fetchPypi, buildPythonPackage, nose, mock, glibcLocales, isPy3k, isPy38 }:
+{ lib
+, buildPythonPackage
+, fetchPypi
+, glibcLocales
+, isPy3k
+, mock
+, nose
+}:
 
 buildPythonPackage rec {
   pname = "parameterized";
-  version = "0.7.5";
+  version = "0.8.1";
+  disable = !isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "b5e6af67b9e49485e30125b1c8f031ffa81a265ca08bfa73f31551bf03cf68c4";
+    sha256 = "sha256-Qbv/N9YYZDD3f5ANd35btqJJKKHEb7HeaS+LUriDO1w=";
   };
 
-  # Tests require some python3-isms but code works without.
-  # python38 is not fully supported yet
-  doCheck = isPy3k && (!isPy38);
-
-  checkInputs = [ nose mock glibcLocales ];
+  checkInputs = [
+    nose
+    mock
+    glibcLocales
+  ];
 
   checkPhase = ''
+    runHook preCheck
     LC_ALL="en_US.UTF-8" nosetests -v
+    runHook postCheck
   '';
 
+  pythonImportsCheck = [ "parameterized" ];
+
   meta = with lib; {
     description = "Parameterized testing with any Python test framework";
-    homepage = "https://pypi.python.org/pypi/parameterized";
-    license = licenses.bsd3;
+    homepage = "https://github.com/wolever/parameterized";
+    license = licenses.bsd2;
     maintainers = with maintainers; [ ma27 ];
   };
 }
diff --git a/pkgs/development/python-modules/qiskit-ibmq-provider/default.nix b/pkgs/development/python-modules/qiskit-ibmq-provider/default.nix
index 9346fae9743..80f060c6681 100644
--- a/pkgs/development/python-modules/qiskit-ibmq-provider/default.nix
+++ b/pkgs/development/python-modules/qiskit-ibmq-provider/default.nix
@@ -39,7 +39,7 @@ let
 in
 buildPythonPackage rec {
   pname = "qiskit-ibmq-provider";
-  version = "0.12.1";
+  version = "0.12.2";
 
   disabled = pythonOlder "3.6";
 
@@ -47,7 +47,7 @@ buildPythonPackage rec {
     owner = "Qiskit";
     repo = pname;
     rev = version;
-    sha256 = "1i5dj5dl0hxqd61bdflyy6yq958fj9qhf6s6m40n1vnql7g50gdx";
+    sha256 = "0yil363mqssq0453nrwxgkjivzk3a4jgbnaf21bp7lwfcl2jdhqm";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/qiskit/default.nix b/pkgs/development/python-modules/qiskit/default.nix
index 5051c6541cd..97603dc3cde 100644
--- a/pkgs/development/python-modules/qiskit/default.nix
+++ b/pkgs/development/python-modules/qiskit/default.nix
@@ -15,7 +15,7 @@
 buildPythonPackage rec {
   pname = "qiskit";
   # NOTE: This version denotes a specific set of subpackages. See https://qiskit.org/documentation/release_notes.html#version-history
-  version = "0.24.0";
+  version = "0.24.1";
 
   disabled = pythonOlder "3.6";
 
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "qiskit";
     repo = "qiskit";
     rev = version;
-    sha256 = "1b78q75bi666v0yj33bkjlc40d2172dsq5yp1s2kkisjfa8qmh7h";
+    sha256 = "0qfz69n8sl7sk4hzygni9qars9q1cyz0n3bv1lca00ia5qsc72d2";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/tools/flawfinder/default.nix b/pkgs/development/tools/flawfinder/default.nix
new file mode 100644
index 00000000000..28805b4abe4
--- /dev/null
+++ b/pkgs/development/tools/flawfinder/default.nix
@@ -0,0 +1,35 @@
+{ lib
+, stdenv
+, fetchurl
+, installShellFiles
+, python3
+}:
+
+stdenv.mkDerivation rec {
+  pname = "flawfinder";
+  version = "2.0.15";
+
+  src = fetchurl {
+    url = "https://dwheeler.com/flawfinder/flawfinder-${version}.tar.gz";
+    sha256 = "01j4szy8gwvikrfzfayfayjnc1za0jxsnxp5fsa6d06kn69wyr8a";
+  };
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  buildInputs = [ python3 ];
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p $out/bin
+    cp ${pname} $out/bin
+    installManPage flawfinder.1
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "Tool to examines C/C++ source code for security flaws";
+    homepage = "https://dwheeler.com/flawfinder/";
+    license = with licenses; [ gpl2Only ];
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/misc/vscode-extensions/default.nix b/pkgs/misc/vscode-extensions/default.nix
index 533c2e3f4a0..4fb1602c5bf 100644
--- a/pkgs/misc/vscode-extensions/default.nix
+++ b/pkgs/misc/vscode-extensions/default.nix
@@ -48,6 +48,18 @@ let
         };
       };
 
+      alygin.vscode-tlaplus = buildVscodeMarketplaceExtension {
+        mktplcRef = {
+          name = "vscode-tlaplus";
+          publisher = "alygin";
+          version = "1.5.3";
+          sha256 = "1cy0qn8iyjrinscn9p5ckpsa2hyryapxfi7is6s2zk2mpligbb1d";
+        };
+        meta = {
+          license = lib.licenses.mit;
+        };
+      };
+
       antfu.icons-carbon = buildVscodeMarketplaceExtension {
         mktplcRef = {
           name = "icons-carbon";
@@ -75,6 +87,18 @@ let
         };
       };
 
+      baccata.scaladex-search = buildVscodeMarketplaceExtension {
+        mktplcRef = {
+          name = "scaladex-search";
+          publisher = "baccata";
+          version = "0.0.1";
+          sha256 = "1y8p4rr8qq5ng52g4pbx8ayq04gi2869wrx68k69rl7ga7bzcyp9";
+        };
+        meta = {
+          license = lib.licenses.asl20;
+        };
+      };
+
       bbenoist.Nix = buildVscodeMarketplaceExtension {
         mktplcRef = {
           name = "Nix";
@@ -111,6 +135,18 @@ let
         };
       };
 
+      codezombiech.gitignore = buildVscodeMarketplaceExtension {
+        mktplcRef = {
+          name = "gitignore";
+          publisher = "codezombiech";
+          version = "0.6.0";
+          sha256 = "0gnc0691pwkd9s8ldqabmpfvj0236rw7bxvkf0bvmww32kv1ia0b";
+        };
+        meta = with lib; {
+          license = licenses.mit;
+        };
+      };
+
       CoenraadS.bracket-pair-colorizer = buildVscodeMarketplaceExtension {
         meta = with lib; {
           changelog = "https://marketplace.visualstudio.com/items/CoenraadS.bracket-pair-colorizer/changelog";
@@ -201,6 +237,20 @@ let
         };
       };
 
+      dotjoshjohnson.xml = buildVscodeMarketplaceExtension {
+        mktplcRef = {
+          name = "xml";
+          publisher = "dotjoshjohnson";
+          version = "2.5.1";
+          sha256 = "1v4x6yhzny1f8f4jzm4g7vqmqg5bqchyx4n25mkgvw2xp6yls037";
+        };
+        meta = {
+          description = "XML Tools";
+          homepage = "https://github.com/DotJoshJohnson/vscode-xml";
+          license = lib.licenses.mit;
+        };
+      };
+
       dracula-theme.theme-dracula = buildVscodeMarketplaceExtension {
         mktplcRef = {
           name = "theme-dracula";
@@ -229,6 +279,18 @@ let
         };
       };
 
+      edonet.vscode-command-runner = buildVscodeMarketplaceExtension {
+        mktplcRef = {
+          name = "vscode-command-runner";
+          publisher = "edonet";
+          version = "0.0.116";
+          sha256 = "0fxvplyk080m0cdsvzynp6wjillrd4flr5qz7af7fibb2jbmfdkn";
+        };
+        meta = {
+          license = lib.licenses.mit;
+        };
+      };
+
       elmtooling.elm-ls-vscode = buildVscodeMarketplaceExtension {
         mktplcRef = {
           name = "elm-ls-vscode";
@@ -345,19 +407,33 @@ let
         };
       };
 
-      github.github-vscode-theme = buildVscodeMarketplaceExtension {
-        mktplcRef = {
-          name = "github-vscode-theme";
-          publisher = "github";
-          version = "1.1.5";
-          sha256 = "10f0098cce026d1f0c855fb7a66ea60b5d8acd2b76126ea94fe7361e49cd9ed2";
+      github = {
+        github-vscode-theme = buildVscodeMarketplaceExtension {
+          mktplcRef = {
+            name = "github-vscode-theme";
+            publisher = "github";
+            version = "1.1.5";
+            sha256 =
+              "10f0098cce026d1f0c855fb7a66ea60b5d8acd2b76126ea94fe7361e49cd9ed2";
+          };
+          meta = with lib; {
+            description = "GitHub theme for VS Code";
+            downloadPage =
+              "https://marketplace.visualstudio.com/items?itemName=GitHub.github-vscode-theme";
+            homepage = "https://github.com/primer/github-vscode-theme";
+            license = licenses.mit;
+            maintainers = with maintainers; [ hugolgst ];
+          };
         };
-        meta = with lib; {
-          description = "GitHub theme for VS Code";
-          downloadPage = "https://marketplace.visualstudio.com/items?itemName=GitHub.github-vscode-theme";
-          homepage = "https://github.com/primer/github-vscode-theme";
-          license = licenses.mit;
-          maintainers = with maintainers; [ hugolgst ];
+
+        vscode-pull-request-github = buildVscodeMarketplaceExtension {
+          mktplcRef = {
+            name = "vscode-pull-request-github";
+            publisher = "github";
+            version = "0.22.0";
+            sha256 = "13p3z86vkra26npp5a78pxdwa4z6jqjzsd38arhgdnjgwmi6bnrw";
+          };
+          meta = { license = lib.licenses.mit; };
         };
       };
 
@@ -512,6 +588,18 @@ let
         };
       };
 
+      mishkinf.goto-next-previous-member = buildVscodeMarketplaceExtension {
+        mktplcRef = {
+          name = "goto-next-previous-member";
+          publisher = "mishkinf";
+          version = "0.0.5";
+          sha256 = "0kgzap1k924i95al0a63hxcsv8skhaapgfpi9d7vvaxm0fc10l1i";
+        };
+        meta = {
+          license = lib.licenses.mit;
+        };
+      };
+
       mskelton.one-dark-theme = buildVscodeMarketplaceExtension {
         mktplcRef = {
           name = "one-dark-theme";
@@ -540,8 +628,8 @@ let
         mktplcRef = {
           name = "vscode-docker";
           publisher = "ms-azuretools";
-          version = "0.8.1";
-          sha256 = "0n59whmcrx8946xix6skvc50f2vsc85ckvn8cs06w9mqmymm1q0s";
+          version = "1.9.1";
+          sha256 = "1l7pm3s5kbf2vark164ykz4qbpa1ac9ls691hham36f6v91dmff9";
         };
         meta = {
           license = lib.licenses.mit;
@@ -691,8 +779,8 @@ let
         mktplcRef = {
           name = "scala";
           publisher = "scala-lang";
-          version = "0.4.5";
-          sha256 = "0nrj32a7a86vwc9gfh748xs3mmfwbc304dp7nks61f0lx8b4wzxw";
+          version = "0.5.1";
+          sha256 = "0p9nhds2xn08xz8x822q15jdrdlqkg2wa1y7mk9k89n8n2kfh91g";
         };
         meta = {
           license = lib.licenses.mit;
@@ -703,8 +791,8 @@ let
         mktplcRef = {
           name = "metals";
           publisher = "scalameta";
-          version = "1.9.10";
-          sha256 = "1afmqzlw3bl9bv59l9b2jrljhbq8djb7vl8rjv58c5wi7nvm2qab";
+          version = "1.9.13";
+          sha256 = "0vrg25ygmyjx1lwif2ypyv688b290ycfn1qf0izxbmgi2z3f0wf9";
         };
         meta = {
           license = lib.licenses.asl20;
@@ -723,6 +811,19 @@ let
         };
       };
 
+
+      shyykoserhiy.vscode-spotify = buildVscodeMarketplaceExtension {
+        mktplcRef = {
+          name = "vscode-spotify";
+          publisher = "shyykoserhiy";
+          version = "3.2.1";
+          sha256 = "14d68rcnjx4a20r0ps9g2aycv5myyhks5lpfz0syr2rxr4kd1vh6";
+        };
+        meta = {
+          license = lib.licenses.mit;
+        };
+      };
+
       skyapps.fish-vscode = buildVscodeMarketplaceExtension {
         mktplcRef = {
           name = "fish-vscode";
@@ -730,8 +831,20 @@ let
           version = "0.2.1";
           sha256 = "0y1ivymn81ranmir25zk83kdjpjwcqpnc9r3jwfykjd9x0jib2hl";
         };
-        meta = with lib; {
-          license = licenses.mit;
+        meta = {
+          license = lib.licenses.mit;
+        };
+      };
+
+      slevesque.vscode-multiclip = buildVscodeMarketplaceExtension {
+        mktplcRef = {
+          name = "vscode-multiclip";
+          publisher = "slevesque";
+          version = "0.1.5";
+          sha256 = "1cg8dqj7f10fj9i0g6mi3jbyk61rs6rvg9aq28575rr52yfjc9f9";
+        };
+        meta = {
+          license = lib.licenses.mit;
         };
       };
 
@@ -771,6 +884,18 @@ let
         };
       };
 
+      timonwong.shellcheck = buildVscodeMarketplaceExtension {
+        mktplcRef = {
+          name = "shellcheck";
+          publisher = "timonwong";
+          version = "0.12.3";
+          sha256 = "1i9rszgnac2z1kyahmgxmz05ib7z14s458fvvjlzmvl64fa1fdvf";
+        };
+        meta = {
+          license = lib.licenses.mit;
+        };
+      };
+
       tomoki1207.pdf = buildVscodeMarketplaceExtension {
         mktplcRef = {
           name = "pdf";
@@ -848,6 +973,42 @@ let
         };
       };
 
+      xyz.local-history = buildVscodeMarketplaceExtension {
+        mktplcRef = {
+          name = "local-history";
+          publisher = "xyz";
+          version = "1.8.1";
+          sha256 = "1mfmnbdv76nvwg4xs3rgsqbxk8hw9zr1b61har9c3pbk9r4cay7v";
+        };
+        meta = {
+          license = lib.licenses.mit;
+        };
+      };
+
+      yzhang.markdown-all-in-one = buildVscodeMarketplaceExtension {
+        mktplcRef = {
+          name = "markdown-all-in-one";
+          publisher = "yzhang";
+          version = "3.4.0";
+          sha256 = "0ihfrsg2sc8d441a2lkc453zbw1jcpadmmkbkaf42x9b9cipd5qb";
+        };
+        meta = {
+          license = lib.licenses.mit;
+        };
+      };
+
+      zhuangtongfa.material-theme = buildVscodeMarketplaceExtension {
+        mktplcRef = {
+          name = "material-theme";
+          publisher = "zhuangtongfa";
+          version = "3.9.12";
+          sha256 = "017h9hxplf2rhmlhn3vag0wypcx6gxi7p9fgllj5jzwrl2wsjl0g";
+        };
+        meta = {
+          license = lib.licenses.mit;
+        };
+      };
+
       llvm-org.lldb-vscode = llvmPackages_8.lldb;
 
       WakaTime.vscode-wakatime = callPackage ./wakatime {};
diff --git a/pkgs/os-specific/linux/firmware/system76-firmware/default.nix b/pkgs/os-specific/linux/firmware/system76-firmware/default.nix
index a5722d59c25..138fea042fc 100644
--- a/pkgs/os-specific/linux/firmware/system76-firmware/default.nix
+++ b/pkgs/os-specific/linux/firmware/system76-firmware/default.nix
@@ -29,11 +29,11 @@ rustPlatform.buildRustPackage rec {
     done
   '';
 
-  meta = {
+  meta = with lib; {
     description = "Tools for managing firmware updates for system76 devices";
     homepage = "https://github.com/pop-os/system76-firmware";
-    license = lib.licenses.gpl3;
-    maintainers = [ lib.maintainers.shlevy ];
-    platforms = lib.platforms.linux;
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ shlevy ];
+    platforms = [ "i686-linux" "x86_64-linux" ];
   };
 }
diff --git a/pkgs/os-specific/linux/sysdig/default.nix b/pkgs/os-specific/linux/sysdig/default.nix
index ecbd23e117f..23e78dd848e 100644
--- a/pkgs/os-specific/linux/sysdig/default.nix
+++ b/pkgs/os-specific/linux/sysdig/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchFromGitHub, cmake, kernel, installShellFiles
-, luajit, zlib, ncurses, perl, jsoncpp, libb64, openssl, curl, jq, gcc, elfutils, tbb, c-ares, protobuf, grpc
+, luajit, ncurses, perl, jsoncpp, libb64, openssl, curl, jq, gcc, elfutils, tbb, protobuf, grpc
 }:
 
 with lib;
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake perl installShellFiles ];
   buildInputs = [
-    zlib luajit ncurses jsoncpp libb64 openssl curl jq gcc elfutils tbb c-ares protobuf grpc
+    luajit ncurses jsoncpp libb64 openssl curl jq gcc elfutils tbb protobuf grpc
   ] ++ optionals (kernel != null) kernel.moduleBuildDependencies;
 
   hardeningDisable = [ "pic" ];
diff --git a/pkgs/servers/http/nginx/generic.nix b/pkgs/servers/http/nginx/generic.nix
index 251f099f7d9..d249d47a215 100644
--- a/pkgs/servers/http/nginx/generic.nix
+++ b/pkgs/servers/http/nginx/generic.nix
@@ -1,4 +1,5 @@
 { lib, stdenv, fetchurl, fetchpatch, openssl, zlib, pcre, libxml2, libxslt
+
 , nixosTests
 , substituteAll, gd, geoip, perl
 , withDebug ? false
@@ -55,7 +56,6 @@ stdenv.mkDerivation {
     "--with-http_realip_module"
     "--with-http_addition_module"
     "--with-http_xslt_module"
-    "--with-http_geoip_module"
     "--with-http_sub_module"
     "--with-http_dav_module"
     "--with-http_flv_module"
@@ -81,7 +81,6 @@ stdenv.mkDerivation {
     "--with-debug"
   ] ++ optionals withStream [
     "--with-stream"
-    "--with-stream_geoip_module"
     "--with-stream_realip_module"
     "--with-stream_ssl_module"
     "--with-stream_ssl_preread_module"
@@ -94,6 +93,8 @@ stdenv.mkDerivation {
     "--with-perl_modules_path=lib/perl5"
   ]
     ++ optional (gd != null) "--with-http_image_filter_module"
+    ++ optional (geoip != null) "--with-http_geoip_module"
+    ++ optional (withStream && geoip != null) "--with-stream_geoip_module"
     ++ optional (with stdenv.hostPlatform; isLinux || isFreeBSD) "--with-file-aio"
     ++ configureFlags
     ++ map (mod: "--add-module=${mod.src}") modules;
diff --git a/pkgs/servers/isso/default.nix b/pkgs/servers/isso/default.nix
index 4db8ac1f403..3338f8b2a84 100644
--- a/pkgs/servers/isso/default.nix
+++ b/pkgs/servers/isso/default.nix
@@ -3,14 +3,14 @@
 with python3Packages; buildPythonApplication rec {
 
   pname = "isso";
-  version = "0.12.4";
+  version = "0.12.5";
 
   # no tests on PyPI
   src = fetchFromGitHub {
     owner = "posativ";
     repo = pname;
     rev = version;
-    sha256 = "16wjpz8r74fzjvzhl6by3sjc2g1riz8lh59ccgp14bns1yhsh2yi";
+    sha256 = "12ccfba2kwbfm9h4zhlxrcigi98akbdm4qi89iglr4z53ygzpay5";
   };
 
   propagatedBuildInputs = [
@@ -23,7 +23,7 @@ with python3Packages; buildPythonApplication rec {
     flask-caching
   ];
 
-  buildInputs = [
+  nativeBuildInputs = [
     cffi
   ];
 
diff --git a/pkgs/servers/rippled/default.nix b/pkgs/servers/rippled/default.nix
index 0b2a0e38f01..6bedb891b57 100644
--- a/pkgs/servers/rippled/default.nix
+++ b/pkgs/servers/rippled/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchgit, fetchurl, git, cmake, pkg-config
-, openssl,  zlib, boost, grpc, c-ares, abseil-cpp, protobuf3_8, libnsl }:
+, openssl, boost, grpc, abseil-cpp, protobuf3_8, libnsl }:
 
 let
   sqlite3 = fetchurl rec {
@@ -130,7 +130,7 @@ in stdenv.mkDerivation rec {
   cmakeFlags = ["-Dstatic=OFF" "-DBoost_NO_BOOST_CMAKE=ON"];
 
   nativeBuildInputs = [ pkg-config cmake git ];
-  buildInputs = [ openssl openssl.dev boostSharedStatic zlib grpc c-ares c-ares.cmake-config abseil-cpp protobuf3_8 libnsl ];
+  buildInputs = [ openssl openssl.dev boostSharedStatic grpc abseil-cpp protobuf3_8 libnsl ];
 
   preConfigure = ''
     export HOME=$PWD
diff --git a/pkgs/shells/bash/5.1.nix b/pkgs/shells/bash/5.1.nix
index 5dd060db7ef..d234b18e6c9 100644
--- a/pkgs/shells/bash/5.1.nix
+++ b/pkgs/shells/bash/5.1.nix
@@ -45,7 +45,7 @@ stdenv.mkDerivation rec {
     -DSSH_SOURCE_BASHRC
   '';
 
-  patchFlags = [ "-p0" "-T" ];
+  patchFlags = [ "-p0" ];
 
   patches = upstreamPatches
     ++ [ ./pgrp-pipe-5.1.patch ];
diff --git a/pkgs/shells/bash/pgrp-pipe-5.1.patch b/pkgs/shells/bash/pgrp-pipe-5.1.patch
index 2a9fa6f33c3..478327cafc4 100644
--- a/pkgs/shells/bash/pgrp-pipe-5.1.patch
+++ b/pkgs/shells/bash/pgrp-pipe-5.1.patch
@@ -14,18 +14,3 @@ diff -u ./configure ../bash-5.0-fixed/configure
  netbsd*|openbsd*)	LOCAL_CFLAGS="-DDEV_FD_STAT_BROKEN" ;;
  *qnx[67]*)	LOCAL_LIBS="-lncurses" ;;
  *qnx*)		LOCAL_CFLAGS="-Dqnx -F -3s" LOCAL_LDFLAGS="-3s" LOCAL_LIBS="-lunix -lncurses" ;;
-diff -u ./configure.ac ../bash-5.0-fixed/configure.ac
---- ./configure.ac	2019-01-02 15:39:11.000000000 +0100
-+++ ../bash-5.0-fixed/configure.ac	2019-01-02 15:39:11.000000000 +0100
-@@ -1108,10 +1108,7 @@
- solaris2*)	LOCAL_CFLAGS=-DSOLARIS ;;
- lynxos*)	LOCAL_CFLAGS=-DRECYCLES_PIDS ;;
- linux*)		LOCAL_LDFLAGS=-rdynamic		 # allow dynamic loading
--		case "`uname -r`" in
--		1.*|2.[[0123]]*)	: ;;
--		*)	AC_DEFINE(PGRP_PIPE) ;;
--		esac ;;
-+		AC_DEFINE(PGRP_PIPE) ;;
- netbsd*|openbsd*)	LOCAL_CFLAGS="-DDEV_FD_STAT_BROKEN" ;;
- *qnx[[67]]*)	LOCAL_LIBS="-lncurses" ;;
- *qnx*)		LOCAL_CFLAGS="-Dqnx -F -3s" LOCAL_LDFLAGS="-3s" LOCAL_LIBS="-lunix -lncurses" ;;
diff --git a/pkgs/tools/admin/aws-lambda-runtime-interface-emulator/default.nix b/pkgs/tools/admin/aws-lambda-runtime-interface-emulator/default.nix
new file mode 100644
index 00000000000..84372423d61
--- /dev/null
+++ b/pkgs/tools/admin/aws-lambda-runtime-interface-emulator/default.nix
@@ -0,0 +1,25 @@
+{ lib, buildGoModule, fetchFromGitHub }:
+
+buildGoModule rec {
+  pname = "aws-lambda-runtime-interface-emulator";
+  version = "1.0";
+
+  src = fetchFromGitHub {
+    owner = "aws";
+    repo = "aws-lambda-runtime-interface-emulator";
+    rev = "v${version}";
+    sha256 = "sha256-vbVygZzLlJlxaRF/LIqSJP0gZGyu1wSSdeVjILl/OJE=";
+  };
+
+  vendorSha256 = "sha256-WcvYPGgkrK7Zs5IplAoUTay5ys9LrDJHpRN3ywEdWRM=";
+
+  # disabled because I lack the skill
+  doCheck = false;
+
+  meta = with lib; {
+    description = "To locally test their Lambda function packaged as a container image.";
+    homepage = "https://github.com/aws/aws-lambda-runtime-interface-emulator";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ teto ];
+  };
+}
diff --git a/pkgs/tools/misc/paperlike-go/default.nix b/pkgs/tools/misc/paperlike-go/default.nix
index 301cc81ec80..0278fb1f791 100644
--- a/pkgs/tools/misc/paperlike-go/default.nix
+++ b/pkgs/tools/misc/paperlike-go/default.nix
@@ -5,20 +5,20 @@
 
 buildGoModule {
   pname = "paperlike-go";
-  version = "unstable-2021-03-22";
+  version = "unstable-2021-03-26";
 
   src = fetchFromGitHub {
     owner = "leoluk";
     repo = "paperlike-go";
-    rev = "a7d89fd4d4cbcec7be016860e9063676ad4cca0f";
-    sha256 = "0ym340520a0j4gvgk4x091lcz1apsv9lnwx0nnha86qvzqcy528l";
+    rev = "bd658d88ea9a3b21e1b301b96253abab7cf56d79";
+    sha256 = "1h0n2n5w5pn3r08qf6hbmiib5m71br27y66ki9ajnaa890377qaj";
   };
 
   subPackages = [ "cmd/paperlike-cli" ];
 
   vendorSha256 = "00mn0zfivxp2h77s7gmyyjp8p5a1vysn73wwaalgajymvljxxx1r";
 
-  meta = with lib; {
+  meta = {
     description = "paperlike-go is a Linux Go library and CLI utility to control a Dasung Paperlike display via I2C DDC.";
     homepage = "https://github.com/leoluk/paperlike-go";
     license = lib.licenses.asl20;
diff --git a/pkgs/tools/misc/uwuify/default.nix b/pkgs/tools/misc/uwuify/default.nix
new file mode 100644
index 00000000000..b90bd8bb46d
--- /dev/null
+++ b/pkgs/tools/misc/uwuify/default.nix
@@ -0,0 +1,23 @@
+{ lib, stdenv, fetchFromGitHub, rustPlatform, libiconv }:
+
+rustPlatform.buildRustPackage rec {
+  pname = "uwuify";
+  version = "0.2.1";
+
+  src = fetchFromGitHub {
+    owner = "Daniel-Liu-c0deb0t";
+    repo = "uwu";
+    rev = "v${version}";
+    sha256 = "sha256-tPmLqgrWi7wDoMjMrxodKp4S0ICwV9Kp7Pa151rHho0=";
+  };
+
+  cargoSha256 = "sha256-HUP6OEvoGJ/BtAl+yuGzqEp1bsxfGAh0UJtXz9/ZiK8=";
+  buildInputs = lib.optionals stdenv.isDarwin [ libiconv ];
+
+  meta = with lib; {
+    description = "Fast text uwuifier";
+    homepage = "https://github.com/Daniel-Liu-c0deb0t/uwu";
+    license = licenses.mit;
+    maintainers = with maintainers; [ siraben ];
+  };
+}
diff --git a/pkgs/tools/networking/xh/default.nix b/pkgs/tools/networking/xh/default.nix
index 33f3e394d71..7acdc2d7e9c 100644
--- a/pkgs/tools/networking/xh/default.nix
+++ b/pkgs/tools/networking/xh/default.nix
@@ -3,16 +3,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "xh";
-  version = "0.9.1";
+  version = "0.9.2";
 
   src = fetchFromGitHub {
     owner = "ducaale";
     repo = "xh";
     rev = "v${version}";
-    sha256 = "pRVlcaPfuO7IMH2p0AQfVrCIXCRyF37WIirOJQkcAJE=";
+    sha256 = "cOlya3ngIoaoqzh0fIbNAjwO7S7wZCQk7WVqgZona8A=";
   };
 
-  cargoSha256 = "dXo1+QvCW3CWN2OhsqGh2Q1xet6cmi2xVy1Xk7s1YR8=";
+  cargoSha256 = "5B2fY+S9z6o+CHCIK93+Yj8dpaiQi4PSMQw1mfXg1NA=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/tools/security/pwncat/default.nix b/pkgs/tools/security/pwncat/default.nix
new file mode 100644
index 00000000000..559dc8d8e3c
--- /dev/null
+++ b/pkgs/tools/security/pwncat/default.nix
@@ -0,0 +1,24 @@
+{ lib
+, buildPythonApplication
+, fetchPypi
+}:
+
+buildPythonApplication rec {
+  pname = "pwncat";
+  version = "0.1.0";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "0sfdqphs0v3lj3vffda4w05r6sqir7qafa8lmlh0wr921wyiqwag";
+  };
+
+  # Tests requires to start containers
+  doCheck = false;
+
+  meta = with lib; {
+    description = " TCP/UDP communication suite";
+    homepage = "https://pwncat.org/";
+    license = with licenses; [ mit ];
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 960b672c96f..a6b83304d1a 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -1048,6 +1048,8 @@ in
 
   awslogs = callPackage ../tools/admin/awslogs { };
 
+  aws-lambda-rie = callPackage ../tools/admin/aws-lambda-runtime-interface-emulator { };
+
   aws-env = callPackage ../tools/admin/aws-env { };
 
   aws-google-auth = python3Packages.callPackage ../tools/admin/aws-google-auth { };
@@ -3360,6 +3362,8 @@ in
 
   usbview = callPackage ../tools/misc/usbview { };
 
+  uwuify = callPackage ../tools/misc/uwuify { };
+
   anthy = callPackage ../tools/inputmethods/anthy { };
 
   evdevremapkeys = callPackage ../tools/inputmethods/evdevremapkeys { };
@@ -4408,6 +4412,8 @@ in
 
   flamegraph = callPackage ../development/tools/flamegraph { };
 
+  flawfinder = callPackage ../development/tools/flawfinder { };
+
   flips = callPackage ../tools/compression/flips { };
 
   fmbt = callPackage ../development/tools/fmbt {
@@ -21722,6 +21728,8 @@ in
 
   bandwidth = callPackage ../tools/misc/bandwidth { };
 
+  banking = callPackage ../applications/office/banking { };
+
   baresip = callPackage ../applications/networking/instant-messengers/baresip { };
 
   barrier = libsForQt5.callPackage ../applications/misc/barrier {};
@@ -29702,6 +29710,8 @@ in
 
   pyupgrade = with python3Packages; toPythonApplication pyupgrade;
 
+  pwncat = python3Packages.callPackage ../tools/security/pwncat { };
+
   pwntools = with python3Packages; toPythonApplication pwntools;
 
   uae = callPackage ../misc/emulators/uae { };