diff --git a/doc/languages-frameworks/android.section.md b/doc/languages-frameworks/android.section.md
index 416073df078..e7dbbf6f8ec 100644
--- a/doc/languages-frameworks/android.section.md
+++ b/doc/languages-frameworks/android.section.md
@@ -25,7 +25,7 @@ let
     abiVersions = [ "armeabi-v7a" "arm64-v8a" ];
     cmakeVersions = [ "3.10.2" ];
     includeNDK = true;
-    ndkVersion = "22.0.7026061";
+    ndkVersions = ["22.0.7026061"];
     useGoogleAPIs = false;
     useGoogleTVAddOns = false;
     includeExtras = [
@@ -52,7 +52,11 @@ The following parameters are supported:
 * `cmakeVersions` specifies which CMake versions should be deployed.
 * `includeNDK` specifies that the Android NDK bundle should be included.
   Defaults to: `false`.
-* `ndkVersion` specifies the NDK version that we want to use.
+* `ndkVersions` specifies the NDK versions that we want to use. These are linked
+  under the `ndk` directory of the SDK root, and the first is linked under the
+  `ndk-bundle` directory.
+* `ndkVersion` is equivalent to specifying one entry in `ndkVersions`, and
+  `ndkVersions` overrides this parameter if provided.
 * `includeExtras` is an array of identifier strings referring to arbitrary
   add-on packages that should be installed.
 * `platformVersions` specifies which platform SDK versions should be included.
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index a2a5bdb0b23..33b2c95ff9f 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -498,6 +498,12 @@
     githubId = 15623522;
     name = "Amar Paul";
   };
+  ambroisie = {
+    email = "bruno.nixpkgs@belanyi.fr";
+    github = "ambroisie";
+    githubId = 12465195;
+    name = "Bruno BELANYI";
+  };
   ambrop72 = {
     email = "ambrop7@gmail.com";
     github = "ambrop72";
@@ -8839,6 +8845,12 @@
     githubId = 15379000;
     name = "schneefux";
   };
+  schnusch = {
+    email = "schnusch@users.noreply.github.com";
+    github = "schnusch";
+    githubId = 5104601;
+    name = "schnusch";
+  };
   schristo = {
     email = "schristopher@konputa.com";
     name = "Scott Christopher";
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 9d30e9ee3aa..cb3edc00bc4 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -529,6 +529,7 @@
   ./services/misc/parsoid.nix
   ./services/misc/plex.nix
   ./services/misc/plikd.nix
+  ./services/misc/podgrab.nix
   ./services/misc/tautulli.nix
   ./services/misc/pinnwand.nix
   ./services/misc/pykms.nix
diff --git a/nixos/modules/services/misc/podgrab.nix b/nixos/modules/services/misc/podgrab.nix
new file mode 100644
index 00000000000..7077408b794
--- /dev/null
+++ b/nixos/modules/services/misc/podgrab.nix
@@ -0,0 +1,50 @@
+{ config, lib, pkgs, ... }:
+let
+  cfg = config.services.podgrab;
+in
+{
+  options.services.podgrab = with lib; {
+    enable = mkEnableOption "Podgrab, a self-hosted podcast manager";
+
+    passwordFile = mkOption {
+      type = with types; nullOr str;
+      default = null;
+      example = "/run/secrets/password.env";
+      description = ''
+        The path to a file containing the PASSWORD environment variable
+        definition for Podgrab's authentification.
+      '';
+    };
+
+    port = mkOption {
+      type = types.port;
+      default = 8080;
+      example = 4242;
+      description = "The port on which Podgrab will listen for incoming HTTP traffic.";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    systemd.services.podgrab = {
+      description = "Podgrab podcast manager";
+      wantedBy = [ "multi-user.target" ];
+      environment = {
+        CONFIG = "/var/lib/podgrab/config";
+        DATA = "/var/lib/podgrab/data";
+        GIN_MODE = "release";
+        PORT = toString cfg.port;
+      };
+      serviceConfig = {
+        DynamicUser = true;
+        EnvironmentFile = lib.optional (cfg.passwordFile != null) [
+          cfg.passwordFile
+        ];
+        ExecStart = "${pkgs.podgrab}/bin/podgrab";
+        WorkingDirectory = "${pkgs.podgrab}/share";
+        StateDirectory = [ "podgrab/config" "podgrab/data" ];
+      };
+    };
+  };
+
+  meta.maintainers = with lib.maintainers; [ ambroisie ];
+}
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 45e32204f25..6e728d711db 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -325,6 +325,7 @@ in
   pleroma = handleTestOn [ "x86_64-linux" "aarch64-linux" ] ./pleroma.nix {};
   plikd = handleTest ./plikd.nix {};
   plotinus = handleTest ./plotinus.nix {};
+  podgrab = handleTest ./podgrab.nix {};
   podman = handleTestOn ["x86_64-linux"] ./podman.nix {};
   pomerium = handleTestOn ["x86_64-linux"] ./pomerium.nix {};
   postfix = handleTest ./postfix.nix {};
diff --git a/nixos/tests/podgrab.nix b/nixos/tests/podgrab.nix
new file mode 100644
index 00000000000..e927e25fea5
--- /dev/null
+++ b/nixos/tests/podgrab.nix
@@ -0,0 +1,34 @@
+let
+  defaultPort = 8080;
+  customPort = 4242;
+in
+import ./make-test-python.nix ({ pkgs, ... }: {
+  name = "podgrab";
+
+  nodes = {
+    default = { ... }: {
+      services.podgrab.enable = true;
+    };
+
+    customized = { ... }: {
+      services.podgrab = {
+        enable = true;
+        port = customPort;
+      };
+    };
+  };
+
+  testScript = ''
+    start_all()
+
+    default.wait_for_unit("podgrab")
+    default.wait_for_open_port("${toString defaultPort}")
+    default.succeed("curl --fail http://localhost:${toString defaultPort}")
+
+    customized.wait_for_unit("podgrab")
+    customized.wait_for_open_port("${toString customPort}")
+    customized.succeed("curl --fail http://localhost:${toString customPort}")
+  '';
+
+  meta.maintainers = with pkgs.lib.maintainers; [ ambroisie ];
+})
diff --git a/pkgs/applications/misc/cura/default.nix b/pkgs/applications/misc/cura/default.nix
index 46143747f6d..a33cb7b2ce6 100644
--- a/pkgs/applications/misc/cura/default.nix
+++ b/pkgs/applications/misc/cura/default.nix
@@ -3,13 +3,13 @@
 
 mkDerivation rec {
   pname = "cura";
-  version = "4.8.0";
+  version = "4.9.0";
 
   src = fetchFromGitHub {
     owner = "Ultimaker";
     repo = "Cura";
     rev = version;
-    sha256 = "060fqzspipm93ks0inrj7yrj5wmvkdfv8xaxrv22590yb9f95s9m";
+    sha256 = "1q515qwrzla3ikbsjmk91y0nrbwih11jycgmd50lkrmnkh7qj0r2";
   };
 
   materials = fetchFromGitHub {
@@ -22,7 +22,7 @@ mkDerivation rec {
   buildInputs = [ qtbase qtquickcontrols2 qtgraphicaleffects ];
   propagatedBuildInputs = with python3.pkgs; [
     libsavitar numpy-stl pyserial requests uranium zeroconf pynest2d
-    sentry-sdk trimesh
+    sentry-sdk trimesh keyring
   ] ++ plugins;
   nativeBuildInputs = [ cmake python3.pkgs.wrapPython ];
 
diff --git a/pkgs/applications/misc/cura/plugins.nix b/pkgs/applications/misc/cura/plugins.nix
index 4bf7ba8d852..76a5808963f 100644
--- a/pkgs/applications/misc/cura/plugins.nix
+++ b/pkgs/applications/misc/cura/plugins.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, fetchpatch, python3Packages, libspnav }:
+{ lib, stdenv, fetchFromGitHub, fetchpatch, python3Packages, libspnav, jq }:
 
 let
 
@@ -34,18 +34,28 @@ let
 
     rawmouse = stdenv.mkDerivation rec {
       pname = "RawMouse";
-      version = "1.0.13";
+      version = "1.1.0";
 
       src = fetchFromGitHub {
         owner = "smartavionics";
         repo = pname;
         rev = version;
-        sha256 = "1cj40pgsfcwliz47mkiqjbslkwcm34qb1pajc2mcljgflcnickly";
+        sha256 = "0hvi7qwd4xfnqnhbj9dgfjmvv9df7s42asf3fdfxv43n6nx74scw";
       };
 
+      nativeBuildInputs = [ jq ];
+
+      propagatedBuildInputs = with python3Packages; [
+        hidapi
+      ];
+
       buildPhase = ''
-        substituteInPlace RawMouse/config.json --replace \
-          /usr/local/lib/libspnav.so ${libspnav}/lib/libspnav.so
+        jq 'del(.devices) | .libspnav="${libspnav}/lib/libspnav.so"' \
+          <RawMouse/config.json >RawMouse/config.json.new
+        mv RawMouse/config.json.new RawMouse/config.json
+
+        # remove prebuilt binaries
+        rm -r RawMouse/hidapi
       '';
 
       installPhase = ''
diff --git a/pkgs/applications/misc/curaengine/default.nix b/pkgs/applications/misc/curaengine/default.nix
index 4a4558ba289..76947c1ed94 100644
--- a/pkgs/applications/misc/curaengine/default.nix
+++ b/pkgs/applications/misc/curaengine/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "curaengine";
-  version = "4.8.0";
+  version = "4.9.0";
 
   src = fetchFromGitHub {
     owner = "Ultimaker";
     repo = "CuraEngine";
     rev = version;
-    sha256 = "083l327ry6hv3yaa1p8dx1hx7fm12b0lh5nlbshxjyym0vi15rw2";
+    sha256 = "0b82hwn7pb73h1azaandq93bkzlzskhgk71pwf4yws0j9bm6z084";
   };
 
   nativeBuildInputs = [ cmake ];
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "A powerful, fast and robust engine for processing 3D models into 3D printing instruction";
     homepage = "https://github.com/Ultimaker/CuraEngine";
-    license = licenses.agpl3;
+    license = licenses.agpl3Only;
     platforms = platforms.linux;
     maintainers = with maintainers; [ abbradar gebner ];
   };
diff --git a/pkgs/applications/misc/sigal/default.nix b/pkgs/applications/misc/sigal/default.nix
index f2333aa9942..860e8f8adb5 100644
--- a/pkgs/applications/misc/sigal/default.nix
+++ b/pkgs/applications/misc/sigal/default.nix
@@ -1,33 +1,40 @@
-{ lib, python3Packages, ffmpeg_3 }:
+{ lib, python3Packages, ffmpeg }:
 
 python3Packages.buildPythonApplication rec {
-  version = "2.1.1";
+  version = "2.2";
   pname   = "sigal";
 
   src = python3Packages.fetchPypi {
     inherit version pname;
-    sha256 = "0l07p457svznirz7qllgyl3qbhiisv7klhz7cbdw6417hxf9bih8";
+    sha256 = "sha256-49XsNdZuicsiYJZuF1UdqMA4q33Ly/Ug/Hc4ybJKmPo=";
   };
 
   disabled = !(python3Packages.pythonAtLeast "3.6");
 
-  checkInputs = with python3Packages; [ pytest ];
   propagatedBuildInputs = with python3Packages; [
+    # install_requires
     jinja2
     markdown
     pillow
     pilkit
-    clint
     click
     blinker
     natsort
-    setuptools_scm
+    # extras_require
+    boto
+    brotli
+    feedgenerator
+    zopfli
+    cryptography
   ];
 
-  makeWrapperArgs = [ "--prefix PATH : ${ffmpeg_3}/bin" ];
+  checkInputs = [
+    ffmpeg
+  ] ++ (with python3Packages; [
+    pytestCheckHook
+  ]);
 
-  # No tests included
-  doCheck = false;
+  makeWrapperArgs = [ "--prefix PATH : ${ffmpeg}/bin" ];
 
   meta = with lib; {
     description = "Yet another simple static gallery generator";
diff --git a/pkgs/applications/science/math/qalculate-gtk/default.nix b/pkgs/applications/science/math/qalculate-gtk/default.nix
index 7ee86793089..56b6df94e8f 100644
--- a/pkgs/applications/science/math/qalculate-gtk/default.nix
+++ b/pkgs/applications/science/math/qalculate-gtk/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "qalculate-gtk";
-  version = "3.17.0";
+  version = "3.18.0";
 
   src = fetchFromGitHub {
     owner = "qalculate";
     repo = "qalculate-gtk";
     rev = "v${version}";
-    sha256 = "sha256-Nxe1DZL8mh9aBWXQdlp5wC1l5b9mchlrRyE+LKC+yLI=";
+    sha256 = "sha256-hE0di7B6dCnMmMBLgFkb6vPS4hS/7zD6BbviIucrn1I=";
   };
 
   hardeningDisable = [ "format" ];
diff --git a/pkgs/applications/version-management/git-review/default.nix b/pkgs/applications/version-management/git-review/default.nix
index 042bdc2a19d..38eed2dd5af 100644
--- a/pkgs/applications/version-management/git-review/default.nix
+++ b/pkgs/applications/version-management/git-review/default.nix
@@ -1,8 +1,14 @@
-{ lib, fetchurl, buildPythonApplication, pbr, requests, setuptools }:
+{ lib
+, fetchurl
+, buildPythonApplication
+, pbr
+, requests
+, setuptools
+}:
 
 buildPythonApplication rec {
   pname = "git-review";
-  version = "2.0.0";
+  version = "2.1.0";
 
   # Manually set version because prb wants to get it from the git
   # upstream repository (and we are installing from tarball instead)
@@ -10,17 +16,28 @@ buildPythonApplication rec {
 
   src = fetchurl {
     url = "https://opendev.org/opendev/${pname}/archive/${version}.tar.gz";
-    sha256 = "0dkyd5g2xmvsa114is3cd9qmki3hi6c06wjnra0f4xq3aqm0ajnj";
+    hash = "sha256-3A1T+/iXhNeMS2Aww5jISoiNExdv9N9/kwyATSuwVTE=";
   };
 
-  propagatedBuildInputs = [ pbr requests setuptools ];
+  nativeBuildInputs = [
+    pbr
+  ];
 
-  # Don't do tests because they require gerrit which is not packaged
+  propagatedBuildInputs = [
+    requests
+    setuptools # implicit dependency, used to get package version through pkg_resources
+  ];
+
+  # Don't run tests because they pull in external dependencies
+  # (a specific build of gerrit + maven plugins), and I haven't figured
+  # out how to work around this yet.
   doCheck = false;
 
+  pythonImportsCheck = [ "git_review" ];
+
   meta = with lib; {
-    homepage = "https://opendev.org/opendev/git-review";
     description = "Tool to submit code to Gerrit";
+    homepage = "https://opendev.org/opendev/git-review";
     license = licenses.asl20;
     maintainers = with maintainers; [ metadark ];
   };
diff --git a/pkgs/applications/virtualization/qemu/default.nix b/pkgs/applications/virtualization/qemu/default.nix
index c04d3b33945..d01af5dddb8 100644
--- a/pkgs/applications/virtualization/qemu/default.nix
+++ b/pkgs/applications/virtualization/qemu/default.nix
@@ -84,6 +84,126 @@ stdenv.mkDerivation rec {
   patches = [
     ./fix-qemu-ga.patch
     ./9p-ignore-noatime.patch
+    (fetchpatch {
+      name = "CVE-2020-27821.patch";
+      url = "https://sources.debian.org/data/main/q/qemu/1:5.2+dfsg-10/debian/patches/memory-clamp-cached-translation-if-points-to-MMIO-region-CVE-2020-27821.patch";
+      sha256 = "0sj0kr0g6jalygr5mb9i17fgr491jzaxvk3dvala0268940s01x9";
+    })
+    (fetchpatch {
+      name = "CVE-2020-20221.patch";
+      url = "https://sources.debian.org/data/main/q/qemu/1:5.2+dfsg-10/debian/patches/arm_gic-fix-interrupt-ID-in-GICD_SGIR-CVE-2021-20221.patch";
+      sha256 = "1iyvcw87hzlc57fg5l87vddqmch8iw2yghk0s125hk5shn1bygjq";
+    })
+    (fetchpatch {
+      name = "CVE-2020-20181.patch";
+      url = "https://sources.debian.org/data/main/q/qemu/1:5.2+dfsg-10/debian/patches/9pfs-Fully-restart-unreclaim-loop-CVE-2021-20181.patch";
+      sha256 = "149ifiazj6rn4d4mv2c7lcayq744fijsv5abxlb8bhbkj99wd64f";
+    })
+    (fetchpatch {
+      name = "CVE-2020-35517.part-1.patch";
+      url = "https://sources.debian.org/data/main/q/qemu/1:5.2+dfsg-10/debian/patches/virtiofsd-extract-lo_do_open-from-lo_open.patch";
+      sha256 = "0j4waaz6q54by4a7vd5m8s2n8y0an9hqf0ndycxsy03g4ksm669d";
+    })
+    (fetchpatch {
+      name = "CVE-2020-35517.part-2.patch";
+      url = "https://sources.debian.org/data/main/q/qemu/1:5.2+dfsg-10/debian/patches/virtiofsd-optionally-return-inode-pointer-from-lo_do_lookup.patch";
+      sha256 = "08bag890r6dx2rhnq58gyvsxvzwqgvn83pjlg95b5ic0z6gyjnsg";
+    })
+    (fetchpatch {
+      name = "CVE-2020-35517.part-3.patch";
+      url = "https://sources.debian.org/data/main/q/qemu/1:5.2+dfsg-10/debian/patches/virtiofsd-prevent-opening-of-special-files-CVE-2020-35517.patch";
+      sha256 = "0ziy6638zbkn037l29ywirvgymbqq66l5rngg8iwyky67acilv94";
+    })
+    (fetchpatch {
+      name = "CVE-2021-20263.part-1.patch";
+      url = "https://sources.debian.org/data/main/q/qemu/1:5.2+dfsg-10/debian/patches/virtiofsd-save-error-code-early-at-the-failure-callsite.patch";
+      sha256 = "15rwb15yjpclrqaxkhx76npr8zlfm9mj4jb19czg093is2cn4rys";
+    })
+    (fetchpatch {
+      name = "CVE-2021-20263.part-2.patch";
+      url = "https://sources.debian.org/data/main/q/qemu/1:5.2+dfsg-10/debian/patches/virtiofsd-drop-remapped-security.capability-xattr-as-needed-CVE-2021-20263.patch";
+      sha256 = "06ylz80ilg30wlskd4dsjx677fp5qr8cranwlakvjhr88b630xw0";
+    })
+    (fetchpatch {
+      name = "CVE-2021-3416.part-1.patch";
+      url = "https://sources.debian.org/data/main/q/qemu/1:5.2+dfsg-10/debian/patches/net-qemu_receive_packet-for-loopback-introduce.patch";
+      sha256 = "0hcpf00vqpg9rc0wl8cry905w04614843aqifybyv15wbv190gpz";
+    })
+    (fetchpatch {
+      name = "CVE-2021-3416.part-2.patch";
+      url = "https://sources.debian.org/data/main/q/qemu/1:5.2+dfsg-10/debian/patches/net-qemu_receive_packet-for-loopback-cadence_gem.patch";
+      sha256 = "12mjnrvs6p4g5frzqb08k4h86hphdqlka91fcma2a3m4ap98nrxy";
+    })
+    (fetchpatch {
+      name = "CVE-2021-3416.part-3.patch";
+      url = "https://sources.debian.org/data/main/q/qemu/1:5.2+dfsg-10/debian/patches/net-qemu_receive_packet-for-loopback-dp8393x.patch";
+      sha256 = "02z6q0578fj55phjlg2larrsx3psch2ixzy470yf57jl3jq1dy6k";
+    })
+    (fetchpatch {
+      name = "CVE-2021-3416.part-4.patch";
+      url = "https://sources.debian.org/data/main/q/qemu/1:5.2+dfsg-10/debian/patches/net-qemu_receive_packet-for-loopback-e1000.patch";
+      sha256 = "0zzbiz8i9js524mcdi739c7hrsmn82gnafrygi0xrd5sqf1hp08z";
+    })
+    (fetchpatch {
+      name = "CVE-2021-3416.part-5.patch";
+      url = "https://sources.debian.org/data/main/q/qemu/1:5.2+dfsg-10/debian/patches/net-qemu_receive_packet-for-loopback-lan9118.patch";
+      sha256 = "1f44v5znd9s7l7wgc71nbg8jw1bjqiga4wkz7d7cpnkv3l7b9kjj";
+    })
+    (fetchpatch {
+      name = "CVE-2021-3416.part-6.patch";
+      url = "https://sources.debian.org/data/main/q/qemu/1:5.2+dfsg-10/debian/patches/net-qemu_receive_packet-for-loopback-msf2.patch";
+      sha256 = "04n1rzn6gfxdalp34903ysdhlvxqkfndnqayjj3iv1k27i5pcidn";
+    })
+    (fetchpatch {
+      name = "CVE-2021-3416.part-7.patch";
+      url = "https://sources.debian.org/data/main/q/qemu/1:5.2+dfsg-10/debian/patches/net-qemu_receive_packet-for-loopback-pcnet.patch";
+      sha256 = "1p9ls6f8r6hxprj8ha6278fydcxj3av29p1hvszxmabazml2g7l2";
+    })
+    (fetchpatch {
+      name = "CVE-2021-3416.part-8.patch";
+      url = "https://sources.debian.org/data/main/q/qemu/1:5.2+dfsg-10/debian/patches/net-qemu_receive_packet-for-loopback-rtl8139.patch";
+      sha256 = "0lms1zn49kpwblkp54widjjy7fwyhdh1x832l1jvds79l2nm6i04";
+    })
+    (fetchpatch {
+      name = "CVE-2021-3416.part-9.patch";
+      url = "https://sources.debian.org/data/main/q/qemu/1:5.2+dfsg-10/debian/patches/net-qemu_receive_packet-for-loopback-sungem.patch";
+      sha256 = "1mkzyrgsp9ml9yqzjxdfqnwjr7n0fd8vxby4yp4ksrskyni8y0p4";
+    })
+    (fetchpatch {
+      name = "CVE-2021-3416.part-10.patch";
+      url = "https://sources.debian.org/data/main/q/qemu/1:5.2+dfsg-10/debian/patches/net-qemu_receive_packet-for-loopback-tx_pkt-iov.patch";
+      sha256 = "1pwqq8yw06y3p6hah3dgjhsqzk802wbn7zyajla1zwdfpic63jss";
+    })
+    (fetchpatch {
+      name = "CVE-2021-3409.part-1.patch";
+      url = "https://sources.debian.org/data/main/q/qemu/1:5.2+dfsg-10/debian/patches/sdhci/dont-transfer-any-data-when-command-time-out.patch";
+      sha256 = "0wf1yhb9mqpfgh9rv0hff0v1sw3zl2vsfgjrby4r8jvxdfjrxj8s";
+    })
+    (fetchpatch {
+      name = "CVE-2021-3409.part-2.patch";
+      url = "https://sources.debian.org/data/main/q/qemu/1:5.2+dfsg-10/debian/patches/sdhci/dont-write-to-SDHC_SYSAD-register-when-transfer-is-in-progress.patch";
+      sha256 = "1dd405dsdc7fbp68yf6f32js1azsv3n595c6nbxh28kfh9lspx4v";
+    })
+    (fetchpatch {
+      name = "CVE-2021-3409.part-3.patch";
+      url = "https://sources.debian.org/data/main/q/qemu/1:5.2+dfsg-10/debian/patches/sdhci/correctly-set-the-controller-status-for-ADMA.patch";
+      sha256 = "08jk51pfrbn1zfymahgllrzivajh2v2qx0868rv9zmgi0jldbky6";
+    })
+    (fetchpatch {
+      name = "CVE-2021-3409.part-4.patch";
+      url = "https://sources.debian.org/data/main/q/qemu/1:5.2+dfsg-10/debian/patches/sdhci/limit-block-size-only-when-SDHC_BLKSIZE-register-is-writable.patch";
+      sha256 = "1valfhw3l83br1cny6n4kmrv0f416hl625mggayqfz4prsknyhh7";
+    })
+    (fetchpatch {
+      name = "CVE-2021-3409.part-5.patch";
+      url = "https://sources.debian.org/data/main/q/qemu/1:5.2+dfsg-10/debian/patches/sdhci/reset-the-data-pointer-of-s-fifo_buffer-when-a-different-block-size-is-programmed.patch";
+      sha256 = "01p5qrr00rh3mlwrp3qq56h7yhqv0w7pw2cw035nxw3mnap03v31";
+    })
+    (fetchpatch {
+      name = "CVE-2021-3392.patch";
+      url = "https://sources.debian.org/data/main/q/qemu/1:5.2+dfsg-10/debian/patches/mptsas-remove-unused-MPTSASState.pending-CVE-2021-3392.patch";
+      sha256 = "0n7dn2p102c21mf3ncqrnks0wl5kas6yspafbn8jd03ignjgc4hd";
+    })
   ] ++ optional nixosTestRunner ./force-uid0-on-9p.patch
     ++ optionals stdenv.hostPlatform.isMusl [
     (fetchpatch {
diff --git a/pkgs/data/fonts/termsyn/default.nix b/pkgs/data/fonts/termsyn/default.nix
new file mode 100644
index 00000000000..50450a04e2d
--- /dev/null
+++ b/pkgs/data/fonts/termsyn/default.nix
@@ -0,0 +1,26 @@
+{ lib, stdenv, fetchurl, mkfontscale }:
+
+stdenv.mkDerivation rec {
+  pname = "termsyn";
+  version = "1.8.7";
+
+  src = fetchurl {
+    url = "mirror://sourceforge/termsyn/termsyn-${version}.tar.gz";
+    sha256 = "15vsmc3nmzl0pkgdpr2993da7p38fiw2rvcg01pwldzmpqrmkpn6";
+  };
+
+  nativeBuildInputs = [ mkfontscale ];
+
+  installPhase = ''
+    install -m 644 -D *.pcf -t "$out/share/fonts"
+    install -m 644 -D *.psfu -t "$out/share/kbd/consolefonts"
+    mkfontdir "$out/share/fonts"
+  '';
+
+  meta = with lib; {
+    description = "Monospaced font based on terminus and tamsyn";
+    homepage = "https://sourceforge.net/projects/termsyn/";
+    license = licenses.gpl2Only;
+    maintainers = with maintainers; [ sophrosyne ];
+  };
+}
diff --git a/pkgs/development/mobile/androidenv/compose-android-packages.nix b/pkgs/development/mobile/androidenv/compose-android-packages.nix
index 5db3538563f..f528fcd8558 100644
--- a/pkgs/development/mobile/androidenv/compose-android-packages.nix
+++ b/pkgs/development/mobile/androidenv/compose-android-packages.nix
@@ -3,10 +3,10 @@
 }:
 
 { toolsVersion ? "26.1.1"
-, platformToolsVersion ? "30.0.5"
+, platformToolsVersion ? "31.0.2"
 , buildToolsVersions ? [ "30.0.3" ]
 , includeEmulator ? false
-, emulatorVersion ? "30.3.4"
+, emulatorVersion ? "30.6.3"
 , platformVersions ? []
 , includeSources ? false
 , includeSystemImages ? false
@@ -14,7 +14,8 @@
 , abiVersions ? [ "armeabi-v7a" ]
 , cmakeVersions ? [ ]
 , includeNDK ? false
-, ndkVersion ? "22.0.7026061"
+, ndkVersion ? "22.1.7171670"
+, ndkVersions ? [ndkVersion]
 , useGoogleAPIs ? false
 , useGoogleTVAddOns ? false
 , includeExtras ? []
@@ -175,10 +176,18 @@ rec {
     }
   ) cmakeVersions;
 
-  ndk-bundle = import ./ndk-bundle {
-    inherit deployAndroidPackage os autoPatchelfHook makeWrapper pkgs pkgsHostHost lib platform-tools;
-    package = packages.ndk-bundle.${ndkVersion};
-  };
+  # Creates a NDK bundle.
+  makeNdkBundle = ndkVersion:
+    import ./ndk-bundle {
+      inherit deployAndroidPackage os autoPatchelfHook makeWrapper pkgs pkgsHostHost lib platform-tools;
+      package = packages.ndk-bundle.${ndkVersion};
+    };
+
+  # All NDK bundles.
+  ndk-bundles = if includeNDK then map makeNdkBundle ndkVersions else [];
+
+  # The "default" NDK bundle.
+  ndk-bundle = if includeNDK then lib.findFirst (x: x != null) null ndk-bundles else null;
 
   google-apis = map (version:
     deployAndroidPackage {
@@ -203,6 +212,15 @@ rec {
       '') plugins}
     '';
 
+  # Function that automatically links all NDK plugins.
+  linkNdkPlugins = {name, plugins, rootName ? name}:
+    lib.optionalString (plugins != []) ''
+      mkdir -p ${rootName}
+      ${lib.concatMapStrings (plugin: ''
+        ln -s ${plugin}/libexec/android-sdk/${name} ${rootName}/${plugin.version}
+      '') plugins}
+    '';
+
   # Function that automatically links a plugin for which only one version exists
   linkPlugin = {name, plugin, check ? true}:
     lib.optionalString check ''
@@ -233,13 +251,13 @@ rec {
 
     postInstall = ''
       # Symlink all requested plugins
-
       ${linkPlugin { name = "platform-tools"; plugin = platform-tools; }}
       ${linkPlugins { name = "build-tools"; plugins = build-tools; }}
       ${linkPlugin { name = "emulator"; plugin = emulator; check = includeEmulator; }}
       ${linkPlugins { name = "platforms"; plugins = platforms; }}
       ${linkPlatformPlugins { name = "sources"; plugins = sources; check = includeSources; }}
       ${linkPlugins { name = "cmake"; plugins = cmake; }}
+      ${linkNdkPlugins { name = "ndk-bundle"; rootName = "ndk"; plugins = ndk-bundles; }}
       ${linkPlugin { name = "ndk-bundle"; plugin = ndk-bundle; check = includeNDK; }}
 
       ${lib.optionalString includeSystemImages ''
diff --git a/pkgs/development/mobile/androidenv/examples/shell.nix b/pkgs/development/mobile/androidenv/examples/shell.nix
index aa5337c9298..95f6a3bdbba 100644
--- a/pkgs/development/mobile/androidenv/examples/shell.nix
+++ b/pkgs/development/mobile/androidenv/examples/shell.nix
@@ -23,14 +23,14 @@ let
   android = {
     versions = {
       tools = "26.1.1";
-      platformTools = "30.0.5";
+      platformTools = "31.0.2";
       buildTools = "30.0.3";
-      ndk = "22.0.7026061";
-
-      # or the LTS NDK:
-      # ndk = "21.3.6528147";
-      cmake = "3.10.2";
-      emulator = "30.3.4";
+      ndk = [
+        "22.1.7171670"
+        "21.3.6528147" # LTS NDK
+      ];
+      cmake = "3.18.1";
+      emulator = "30.6.3";
     };
 
     platforms = ["23" "24" "25" "26" "27" "28" "29" "30"];
@@ -69,7 +69,7 @@ let
     emulatorVersion = android.versions.emulator;
 
     includeNDK = true;
-    ndkVersion = android.versions.ndk;
+    ndkVersions = android.versions.ndk;
     cmakeVersions = [android.versions.cmake];
 
     useGoogleAPIs = true;
@@ -130,7 +130,7 @@ pkgs.mkShell rec {
 
   shellHook = ''
     # Add cmake to the path.
-    cmake_root="$(echo "$ANDROID_SDK_ROOT/cmake/${android.versions.cmake}".*/)"
+    cmake_root="$(echo "$ANDROID_SDK_ROOT/cmake/${android.versions.cmake}"*/)"
     export PATH="$cmake_root/bin:$PATH"
 
     # Write out local.properties for Android Studio.
diff --git a/pkgs/development/mobile/androidenv/repo.json b/pkgs/development/mobile/androidenv/repo.json
index f3606279c5a..e8e0bf080fe 100644
--- a/pkgs/development/mobile/androidenv/repo.json
+++ b/pkgs/development/mobile/androidenv/repo.json
@@ -425,16 +425,16 @@
       "archives": [
         {
           "os": "windows",
-          "sha1": "9b3479ce8f42fdcbd487aa843a2453d5950f5fc9",
-          "size": 164505,
-          "url": "https://dl.google.com/android/repository/gvm-windows_v1_6_0.zip"
+          "sha1": "1d35ead3cdfaf6e51001455f66a2db102dd647b7",
+          "size": 167191,
+          "url": "https://dl.google.com/android/repository/gvm-windows_v1_7_0.zip"
         }
       ],
       "displayName": "Android Emulator Hypervisor Driver for AMD Processors (installer)",
       "license": "android-sdk-license",
       "name": "extras-google-Android_Emulator_Hypervisor_Driver",
       "path": "extras/google/Android_Emulator_Hypervisor_Driver",
-      "revision": "1.6.0"
+      "revision": "1.7.0"
     },
     "extras;google;admob_ads_sdk": {
       "archives": [
@@ -466,33 +466,6 @@
       "path": "extras/google/analytics_sdk_v2",
       "revision": "3"
     },
-    "extras;google;auto": {
-      "archives": [
-        {
-          "os": "linux",
-          "sha1": "202a6e1b3009a0eb815f8c672d2d5b3717de6169",
-          "size": 1346009,
-          "url": "https://dl.google.com/android/repository/desktop-head-unit-linux_r01.1.zip"
-        },
-        {
-          "os": "macosx",
-          "sha1": "8179cbb3914493ebc5eb65b731cba061582f2e84",
-          "size": 2375533,
-          "url": "https://dl.google.com/android/repository/desktop-head-unit-macosx_r01.1.zip"
-        },
-        {
-          "os": "windows",
-          "sha1": "99c4a7172d73673552119347bc24c58b47da177b",
-          "size": 2691901,
-          "url": "https://dl.google.com/android/repository/desktop-head-unit-windows_r01.1.zip"
-        }
-      ],
-      "displayName": "Android Auto Desktop Head Unit emulator",
-      "license": "android-sdk-license",
-      "name": "extras-google-auto",
-      "path": "extras/google/auto",
-      "revision": "1.1"
-    },
     "extras;google;gcm": {
       "archives": [
         {
@@ -1537,21 +1510,21 @@
           "archives": [
             {
               "os": "windows",
-              "sha1": "ef4661e49abeb64c173636012526e41ff6f39dc1",
-              "size": 1404149582,
-              "url": "https://dl.google.com/android/repository/sys-img/google_apis_playstore/x86_64-30_r09-windows.zip"
+              "sha1": "ead1babced6bdfaa8e641faeb6ed115ca603c4a9",
+              "size": 1404405641,
+              "url": "https://dl.google.com/android/repository/sys-img/google_apis_playstore/x86_64-30_r10-windows.zip"
             },
             {
               "os": "macosx",
-              "sha1": "ef4661e49abeb64c173636012526e41ff6f39dc1",
-              "size": 1404149582,
-              "url": "https://dl.google.com/android/repository/sys-img/google_apis_playstore/x86_64-30_r09-darwin.zip"
+              "sha1": "ead1babced6bdfaa8e641faeb6ed115ca603c4a9",
+              "size": 1404405641,
+              "url": "https://dl.google.com/android/repository/sys-img/google_apis_playstore/x86_64-30_r10-darwin.zip"
             },
             {
               "os": "linux",
-              "sha1": "ef4661e49abeb64c173636012526e41ff6f39dc1",
-              "size": 1404149582,
-              "url": "https://dl.google.com/android/repository/sys-img/google_apis_playstore/x86_64-30_r09-linux.zip"
+              "sha1": "ead1babced6bdfaa8e641faeb6ed115ca603c4a9",
+              "size": 1404405641,
+              "url": "https://dl.google.com/android/repository/sys-img/google_apis_playstore/x86_64-30_r10-linux.zip"
             }
           ],
           "displayName": "Google Play Intel x86 Atom_64 System Image",
@@ -1561,6 +1534,58 @@
           "revision": "30-google_apis_playstore-x86_64"
         }
       }
+    },
+    "S": {
+      "google_apis_playstore": {
+        "arm64-v8a": {
+          "archives": [
+            {
+              "os": "macosx",
+              "sha1": "528e302e9966e8320d1c2bdc8235762fe4a9e733",
+              "size": 1333046412,
+              "url": "https://dl.google.com/android/repository/sys-img/google_apis_playstore/arm64-v8a-S_r03-darwin.zip"
+            },
+            {
+              "os": "linux",
+              "sha1": "528e302e9966e8320d1c2bdc8235762fe4a9e733",
+              "size": 1333046412,
+              "url": "https://dl.google.com/android/repository/sys-img/google_apis_playstore/arm64-v8a-S_r03-linux.zip"
+            }
+          ],
+          "displayName": "Google Play ARM 64 v8a System Image",
+          "license": "android-sdk-arm-dbt-license",
+          "name": "system-image-S-google_apis_playstore-arm64-v8a",
+          "path": "system-images/android-S/google_apis_playstore/arm64-v8a",
+          "revision": "S-google_apis_playstore-arm64-v8a"
+        },
+        "x86_64": {
+          "archives": [
+            {
+              "os": "windows",
+              "sha1": "093e0537cb18b25d8399a1af3ec955d2085f15ff",
+              "size": 1384401947,
+              "url": "https://dl.google.com/android/repository/sys-img/google_apis_playstore/x86_64-S_r03-windows.zip"
+            },
+            {
+              "os": "macosx",
+              "sha1": "093e0537cb18b25d8399a1af3ec955d2085f15ff",
+              "size": 1384401947,
+              "url": "https://dl.google.com/android/repository/sys-img/google_apis_playstore/x86_64-S_r03-darwin.zip"
+            },
+            {
+              "os": "linux",
+              "sha1": "093e0537cb18b25d8399a1af3ec955d2085f15ff",
+              "size": 1384401947,
+              "url": "https://dl.google.com/android/repository/sys-img/google_apis_playstore/x86_64-S_r03-linux.zip"
+            }
+          ],
+          "displayName": "Google Play Intel x86 Atom_64 System Image",
+          "license": "android-sdk-preview-license",
+          "name": "system-image-S-google_apis_playstore-x86_64",
+          "path": "system-images/android-S/google_apis_playstore/x86_64",
+          "revision": "S-google_apis_playstore-x86_64"
+        }
+      }
     }
   },
   "licenses": {
@@ -3075,6 +3100,33 @@
         "name": "build-tools",
         "path": "build-tools/30.0.3",
         "revision": "30.0.3"
+      },
+      "31.0.0-rc3": {
+        "archives": [
+          {
+            "os": "macosx",
+            "sha1": "e75dfb7a975809ba0ca0d25c2b82f7fd56444a4b",
+            "size": 53224980,
+            "url": "https://dl.google.com/android/repository/012061446cfd98341585d0d07401d0bd1a4c30f6.build-tools_r31-rc3-macosx.zip"
+          },
+          {
+            "os": "windows",
+            "sha1": "9d9ce209353c9046abe16285d58ef893c4b42221",
+            "size": 57592553,
+            "url": "https://dl.google.com/android/repository/41966dc138d44a3e3797b92fb68bf70552011d5d.build-tools_r31-rc3-windows.zip"
+          },
+          {
+            "os": "linux",
+            "sha1": "6859f11348d3984afbfcc74984802bd2e31cc0e2",
+            "size": 54724181,
+            "url": "https://dl.google.com/android/repository/build-tools_r31-rc3-linux.zip"
+          }
+        ],
+        "displayName": "Android SDK Build-Tools 31-rc3",
+        "license": "android-sdk-preview-license",
+        "name": "build-tools",
+        "path": "build-tools/31.0.0-rc3",
+        "revision": "31.0.0-rc3"
       }
     },
     "cmake": {
@@ -3109,14 +3161,14 @@
         "archives": [
           {
             "os": "windows",
-            "sha1": "80916762df6955f431743066e3568ae65b1b2b2f",
-            "size": 14677038,
+            "sha1": "63723e9657a3ce1fc3ae078229c6199af80b76bd",
+            "size": 14676950,
             "url": "https://dl.google.com/android/repository/7c386a739f915f5bd60051f2572c24782388e807.cmake-3.18.1-windows.zip"
           },
           {
             "os": "macosx",
-            "sha1": "1580deb8fb5d705aefb028413dad1a3a129891fe",
-            "size": 18505815,
+            "sha1": "809fdc8e14c745c6df4e506cc2157910f50b9cd9",
+            "size": 18505220,
             "url": "https://dl.google.com/android/repository/ba34c321f92f6e6fd696c8354c262c122f56abf8.cmake-3.18.1-darwin.zip"
           },
           {
@@ -3127,7 +3179,7 @@
           }
         ],
         "displayName": "CMake 3.18.1",
-        "license": "android-sdk-preview-license",
+        "license": "android-sdk-license",
         "name": "cmake",
         "path": "cmake/3.18.1",
         "revision": "3.18.1"
@@ -3198,8 +3250,8 @@
           },
           {
             "os": "macosx",
-            "sha1": "a69c4493c4c919698989484bf0ea684550ec5217",
-            "size": 86522172,
+            "sha1": "d45816955198c4dfd652584f4c0f1b0e86efb1b7",
+            "size": 86521848,
             "url": "https://dl.google.com/android/repository/commandlinetools-mac-6514223_latest.zip"
           },
           {
@@ -3325,74 +3377,59 @@
       }
     },
     "emulator": {
-      "28.0.25": {
+      "30.5.5": {
         "archives": [
+          {
+            "os": "macosx",
+            "sha1": "90f8a9942253db75ab4d13f791377e9739a88617",
+            "size": 300476485,
+            "url": "https://dl.google.com/android/repository/emulator-darwin_x64-7285888.zip"
+          },
+          {
+            "os": "linux",
+            "sha1": "ccdee1aa99e4ec39f5a762d6912682ac248b92f0",
+            "size": 272500365,
+            "url": "https://dl.google.com/android/repository/emulator-linux_x64-7285888.zip"
+          },
           {
             "os": "windows",
-            "sha1": "6004fd05db29f8088ec89ba85c273c0bf86ef0be",
-            "size": 372563893,
-            "url": "https://dl.google.com/android/repository/emulator-windows-5395263.zip"
+            "sha1": "84c3105ba1a3a94963e1f99b3f706d0231948fc9",
+            "size": 324371999,
+            "url": "https://dl.google.com/android/repository/emulator-windows_x64-7285888.zip"
           }
         ],
         "displayName": "Android Emulator",
         "license": "android-sdk-license",
         "name": "emulator",
         "path": "emulator",
-        "revision": "28.0.25"
+        "revision": "30.5.5"
       },
-      "30.2.6": {
+      "30.6.3": {
         "archives": [
           {
             "os": "macosx",
-            "sha1": "60cc4cfe372b3189679e1e08c929ff2fb793f3f6",
-            "size": 292634405,
-            "url": "https://dl.google.com/android/repository/emulator-darwin-6962233.zip"
+            "sha1": "66c9b788de49548d0faab052274f97b042f7241d",
+            "size": 308984491,
+            "url": "https://dl.google.com/android/repository/emulator-darwin_x64-7266284.zip"
           },
           {
             "os": "linux",
-            "sha1": "751044f953541b70a656d77343f6b0aac1153e24",
-            "size": 262303903,
-            "url": "https://dl.google.com/android/repository/emulator-linux-6962233.zip"
+            "sha1": "ecd9b55fe4784b6c8683faa4b1d2c951b8929154",
+            "size": 272243636,
+            "url": "https://dl.google.com/android/repository/emulator-linux_x64-7266284.zip"
           },
           {
             "os": "windows",
-            "sha1": "daa448bc56199b6beeaecf5f796d26c65e5a5fb8",
-            "size": 258566662,
-            "url": "https://dl.google.com/android/repository/emulator-windows-6962233.zip"
-          }
-        ],
-        "displayName": "Android Emulator",
-        "license": "android-sdk-license",
-        "name": "emulator",
-        "path": "emulator",
-        "revision": "30.2.6"
-      },
-      "30.3.4": {
-        "archives": [
-          {
-            "os": "macosx",
-            "sha1": "7c456b3946a89d8543a070d9f643f3fe87283d68",
-            "size": 295125219,
-            "url": "https://dl.google.com/android/repository/emulator-darwin-7020230.zip"
-          },
-          {
-            "os": "linux",
-            "sha1": "5285e71825453c83ad951b55a7a7d917a667221a",
-            "size": 265877671,
-            "url": "https://dl.google.com/android/repository/emulator-linux-7020230.zip"
-          },
-          {
-            "os": "windows",
-            "sha1": "918b6236a57d425b7a95495cd76a2cf1aaa98560",
-            "size": 320221036,
-            "url": "https://dl.google.com/android/repository/emulator-windows-7020230.zip"
+            "sha1": "5736749dc46ad950ec84e8275dfde2606d3e8a80",
+            "size": 324657514,
+            "url": "https://dl.google.com/android/repository/emulator-windows_x64-7266284.zip"
           }
         ],
         "displayName": "Android Emulator",
         "license": "android-sdk-preview-license",
         "name": "emulator",
         "path": "emulator",
-        "revision": "30.3.4"
+        "revision": "30.6.3"
       }
     },
     "extras": {
@@ -3911,6 +3948,33 @@
         "path": "ndk/21.3.6528147",
         "revision": "21.3.6528147"
       },
+      "21.4.7075529": {
+        "archives": [
+          {
+            "os": "macosx",
+            "sha1": "3f15c23a1c247ad17c7c271806848dbd40434738",
+            "size": 1042617180,
+            "url": "https://dl.google.com/android/repository/android-ndk-r21e-darwin-x86_64.zip"
+          },
+          {
+            "os": "linux",
+            "sha1": "c3ebc83c96a4d7f539bd72c241b2be9dcd29bda9",
+            "size": 1190670072,
+            "url": "https://dl.google.com/android/repository/android-ndk-r21e-linux-x86_64.zip"
+          },
+          {
+            "os": "windows",
+            "sha1": "fc44fea8bb3f5a6789821f40f41dce2d2cd5dc30",
+            "size": 1109665123,
+            "url": "https://dl.google.com/android/repository/android-ndk-r21e-windows-x86_64.zip"
+          }
+        ],
+        "displayName": "NDK (Side by side) 21.4.7075529",
+        "license": "android-sdk-license",
+        "name": "ndk",
+        "path": "ndk/21.4.7075529",
+        "revision": "21.4.7075529"
+      },
       "22.0.6917172-rc1": {
         "archives": [
           {
@@ -3964,6 +4028,114 @@
         "name": "ndk",
         "path": "ndk/22.0.7026061",
         "revision": "22.0.7026061"
+      },
+      "22.1.7171670": {
+        "archives": [
+          {
+            "os": "macosx",
+            "sha1": "dc80e8a2cfcb28db74c1931d42c652e9d17ff2c3",
+            "size": 1049337733,
+            "url": "https://dl.google.com/android/repository/android-ndk-r22b-darwin-x86_64.zip"
+          },
+          {
+            "os": "linux",
+            "sha1": "9ece64c7f19763dd67320d512794969930fce9dc",
+            "size": 1148198368,
+            "url": "https://dl.google.com/android/repository/android-ndk-r22b-linux-x86_64.zip"
+          },
+          {
+            "os": "windows",
+            "sha1": "96ba1a049303cf6bf3ee84cfd64d6bcd43486a50",
+            "size": 1082301775,
+            "url": "https://dl.google.com/android/repository/android-ndk-r22b-windows-x86_64.zip"
+          }
+        ],
+        "displayName": "NDK (Side by side) 22.1.7171670",
+        "license": "android-sdk-license",
+        "name": "ndk",
+        "path": "ndk/22.1.7171670",
+        "revision": "22.1.7171670"
+      },
+      "23.0.7123448-rc1": {
+        "archives": [
+          {
+            "os": "macosx",
+            "sha1": "708ebbceb719c43a3165503ea82fb107d823ad54",
+            "size": 721278316,
+            "url": "https://dl.google.com/android/repository/android-ndk-r23-beta1-darwin-x86_64.zip"
+          },
+          {
+            "os": "linux",
+            "sha1": "1340ed20f27fcb184ea814ae63e0f3cd75890342",
+            "size": 804392699,
+            "url": "https://dl.google.com/android/repository/android-ndk-r23-beta1-linux-x86_64.zip"
+          },
+          {
+            "os": "windows",
+            "sha1": "c056900896129d3dd4eb953a53a8961d9853aa20",
+            "size": 749304589,
+            "url": "https://dl.google.com/android/repository/android-ndk-r23-beta1-windows-x86_64.zip"
+          }
+        ],
+        "displayName": "NDK (Side by side) 23.0.7123448",
+        "license": "android-sdk-preview-license",
+        "name": "ndk",
+        "path": "ndk/23.0.7123448",
+        "revision": "23.0.7123448-rc1"
+      },
+      "23.0.7196353-rc2": {
+        "archives": [
+          {
+            "os": "macosx",
+            "sha1": "454fd0c1e8385896ad465d7cfd653e28fbf3523f",
+            "size": 674507658,
+            "url": "https://dl.google.com/android/repository/android-ndk-r23-beta2-darwin-x86_64.zip"
+          },
+          {
+            "os": "linux",
+            "sha1": "290e8c39bb9732ac8784855e1f22342eb488228e",
+            "size": 705747711,
+            "url": "https://dl.google.com/android/repository/android-ndk-r23-beta2-linux-x86_64.zip"
+          },
+          {
+            "os": "windows",
+            "sha1": "00194ae44ce90f2052ab8e42f1a11a0db8d50c2a",
+            "size": 747953762,
+            "url": "https://dl.google.com/android/repository/android-ndk-r23-beta2-windows-x86_64.zip"
+          }
+        ],
+        "displayName": "NDK (Side by side) 23.0.7196353",
+        "license": "android-sdk-preview-license",
+        "name": "ndk",
+        "path": "ndk/23.0.7196353",
+        "revision": "23.0.7196353-rc2"
+      },
+      "23.0.7272597-rc3": {
+        "archives": [
+          {
+            "os": "macosx",
+            "sha1": "3b977f0f8e0fa2d6777fae6b1d37aebfc075ab56",
+            "size": 695243724,
+            "url": "https://dl.google.com/android/repository/android-ndk-r23-beta3-darwin-x86_64.zip"
+          },
+          {
+            "os": "linux",
+            "sha1": "2298465ef13dab0c527b9cf6ef892b1ec6461fb4",
+            "size": 724828157,
+            "url": "https://dl.google.com/android/repository/android-ndk-r23-beta3-linux-x86_64.zip"
+          },
+          {
+            "os": "windows",
+            "sha1": "8c10a51f50f4f12ccc839dcb4bd8107133024c2f",
+            "size": 785932724,
+            "url": "https://dl.google.com/android/repository/android-ndk-r23-beta3-windows-x86_64.zip"
+          }
+        ],
+        "displayName": "NDK (Side by side) 23.0.7272597",
+        "license": "android-sdk-preview-license",
+        "name": "ndk",
+        "path": "ndk/23.0.7272597",
+        "revision": "23.0.7272597-rc3"
       }
     },
     "ndk-bundle": {
@@ -4426,6 +4598,33 @@
         "path": "ndk-bundle",
         "revision": "21.3.6528147"
       },
+      "21.4.7075529": {
+        "archives": [
+          {
+            "os": "macosx",
+            "sha1": "3f15c23a1c247ad17c7c271806848dbd40434738",
+            "size": 1042617180,
+            "url": "https://dl.google.com/android/repository/android-ndk-r21e-darwin-x86_64.zip"
+          },
+          {
+            "os": "linux",
+            "sha1": "c3ebc83c96a4d7f539bd72c241b2be9dcd29bda9",
+            "size": 1190670072,
+            "url": "https://dl.google.com/android/repository/android-ndk-r21e-linux-x86_64.zip"
+          },
+          {
+            "os": "windows",
+            "sha1": "fc44fea8bb3f5a6789821f40f41dce2d2cd5dc30",
+            "size": 1109665123,
+            "url": "https://dl.google.com/android/repository/android-ndk-r21e-windows-x86_64.zip"
+          }
+        ],
+        "displayName": "NDK",
+        "license": "android-sdk-license",
+        "name": "ndk-bundle",
+        "path": "ndk-bundle",
+        "revision": "21.4.7075529"
+      },
       "22.0.6917172-rc1": {
         "archives": [
           {
@@ -4479,6 +4678,114 @@
         "name": "ndk-bundle",
         "path": "ndk-bundle",
         "revision": "22.0.7026061"
+      },
+      "22.1.7171670": {
+        "archives": [
+          {
+            "os": "macosx",
+            "sha1": "dc80e8a2cfcb28db74c1931d42c652e9d17ff2c3",
+            "size": 1049337733,
+            "url": "https://dl.google.com/android/repository/android-ndk-r22b-darwin-x86_64.zip"
+          },
+          {
+            "os": "linux",
+            "sha1": "9ece64c7f19763dd67320d512794969930fce9dc",
+            "size": 1148198368,
+            "url": "https://dl.google.com/android/repository/android-ndk-r22b-linux-x86_64.zip"
+          },
+          {
+            "os": "windows",
+            "sha1": "96ba1a049303cf6bf3ee84cfd64d6bcd43486a50",
+            "size": 1082301775,
+            "url": "https://dl.google.com/android/repository/android-ndk-r22b-windows-x86_64.zip"
+          }
+        ],
+        "displayName": "NDK",
+        "license": "android-sdk-license",
+        "name": "ndk-bundle",
+        "path": "ndk-bundle",
+        "revision": "22.1.7171670"
+      },
+      "23.0.7123448-rc1": {
+        "archives": [
+          {
+            "os": "macosx",
+            "sha1": "708ebbceb719c43a3165503ea82fb107d823ad54",
+            "size": 721278316,
+            "url": "https://dl.google.com/android/repository/android-ndk-r23-beta1-darwin-x86_64.zip"
+          },
+          {
+            "os": "linux",
+            "sha1": "1340ed20f27fcb184ea814ae63e0f3cd75890342",
+            "size": 804392699,
+            "url": "https://dl.google.com/android/repository/android-ndk-r23-beta1-linux-x86_64.zip"
+          },
+          {
+            "os": "windows",
+            "sha1": "c056900896129d3dd4eb953a53a8961d9853aa20",
+            "size": 749304589,
+            "url": "https://dl.google.com/android/repository/android-ndk-r23-beta1-windows-x86_64.zip"
+          }
+        ],
+        "displayName": "NDK",
+        "license": "android-sdk-preview-license",
+        "name": "ndk-bundle",
+        "path": "ndk-bundle",
+        "revision": "23.0.7123448-rc1"
+      },
+      "23.0.7196353-rc2": {
+        "archives": [
+          {
+            "os": "macosx",
+            "sha1": "454fd0c1e8385896ad465d7cfd653e28fbf3523f",
+            "size": 674507658,
+            "url": "https://dl.google.com/android/repository/android-ndk-r23-beta2-darwin-x86_64.zip"
+          },
+          {
+            "os": "linux",
+            "sha1": "290e8c39bb9732ac8784855e1f22342eb488228e",
+            "size": 705747711,
+            "url": "https://dl.google.com/android/repository/android-ndk-r23-beta2-linux-x86_64.zip"
+          },
+          {
+            "os": "windows",
+            "sha1": "00194ae44ce90f2052ab8e42f1a11a0db8d50c2a",
+            "size": 747953762,
+            "url": "https://dl.google.com/android/repository/android-ndk-r23-beta2-windows-x86_64.zip"
+          }
+        ],
+        "displayName": "NDK",
+        "license": "android-sdk-preview-license",
+        "name": "ndk-bundle",
+        "path": "ndk-bundle",
+        "revision": "23.0.7196353-rc2"
+      },
+      "23.0.7272597-rc3": {
+        "archives": [
+          {
+            "os": "macosx",
+            "sha1": "3b977f0f8e0fa2d6777fae6b1d37aebfc075ab56",
+            "size": 695243724,
+            "url": "https://dl.google.com/android/repository/android-ndk-r23-beta3-darwin-x86_64.zip"
+          },
+          {
+            "os": "linux",
+            "sha1": "2298465ef13dab0c527b9cf6ef892b1ec6461fb4",
+            "size": 724828157,
+            "url": "https://dl.google.com/android/repository/android-ndk-r23-beta3-linux-x86_64.zip"
+          },
+          {
+            "os": "windows",
+            "sha1": "8c10a51f50f4f12ccc839dcb4bd8107133024c2f",
+            "size": 785932724,
+            "url": "https://dl.google.com/android/repository/android-ndk-r23-beta3-windows-x86_64.zip"
+          }
+        ],
+        "displayName": "NDK",
+        "license": "android-sdk-preview-license",
+        "name": "ndk-bundle",
+        "path": "ndk-bundle",
+        "revision": "23.0.7272597-rc3"
       }
     },
     "patcher": {
@@ -4499,32 +4806,32 @@
       }
     },
     "platform-tools": {
-      "30.0.5": {
+      "31.0.2": {
         "archives": [
           {
             "os": "macosx",
-            "sha1": "6f77800c35f27dc8e014a214e656aae17c7ea2d0",
-            "size": 13311295,
-            "url": "https://dl.google.com/android/repository/eabcd8b4b7ab518c6af9c941af8494072f17ec4b.platform-tools_r30.0.5-darwin.zip"
+            "sha1": "78937049851e1db90317612c6b831759f56fc86d",
+            "size": 13829393,
+            "url": "https://dl.google.com/android/repository/42b081e1e068bb936179551684cdcb30315e245c.platform-tools_r31.0.2-darwin.zip"
           },
           {
             "os": "linux",
-            "sha1": "ba07433b8e34c2a51c250033abcd1442a28d0863",
-            "size": 13338136,
-            "url": "https://dl.google.com/android/repository/platform-tools_r30.0.5-linux.zip"
+            "sha1": "ff02a9d8c6fa9687e1207fc0c4b84033925d452d",
+            "size": 13876419,
+            "url": "https://dl.google.com/android/repository/platform-tools_r31.0.2-linux.zip"
           },
           {
             "os": "windows",
-            "sha1": "e66c951841f78f225e36cfae74e81712a704a37a",
-            "size": 12328924,
-            "url": "https://dl.google.com/android/repository/platform-tools_r30.0.5-windows.zip"
+            "sha1": "9cc0f642a66706a978214395b85c8e8228c24f2f",
+            "size": 12537668,
+            "url": "https://dl.google.com/android/repository/platform-tools_r31.0.2-windows.zip"
           }
         ],
         "displayName": "Android SDK Platform-Tools",
         "license": "android-sdk-license",
         "name": "platform-tools",
         "path": "platform-tools",
-        "revision": "30.0.5"
+        "revision": "31.0.2"
       }
     },
     "platforms": {
@@ -5022,35 +5329,77 @@
         "name": "platforms",
         "path": "platforms/android-9",
         "revision": "9"
+      },
+      "S": {
+        "archives": [
+          {
+            "os": "all",
+            "sha1": "3aee3ad760dc7becf657d6421629fe360215f92e",
+            "size": 56206479,
+            "url": "https://dl.google.com/android/repository/platform-S_r03.zip"
+          }
+        ],
+        "displayName": "Android SDK Platform S",
+        "license": "android-sdk-license",
+        "name": "platforms",
+        "path": "platforms/android-S",
+        "revision": "S"
       }
     },
     "skiaparser": {
-      "5": {
+      "2": {
         "archives": [
           {
             "os": "linux",
-            "sha1": "b4ac0f553c2b582fd4e1896f46e2021b9da9d19b",
-            "size": 6234850,
-            "url": "https://dl.google.com/android/repository/skiaparser-6923996-linux.zip"
+            "sha1": "2703a570224a5ced1f73eb3efbdb3192a1ecec81",
+            "size": 6681896,
+            "url": "https://dl.google.com/android/repository/skiaparser-7248848-linux.zip"
           },
           {
             "os": "macosx",
-            "sha1": "6d4bafe363b8536c9c3da51fac6f4b16c5685359",
-            "size": 6297430,
-            "url": "https://dl.google.com/android/repository/skiaparser-6923996-mac.zip"
+            "sha1": "ecf8794beccf578d4130bb9f7f2c7fa0c40c62c2",
+            "size": 7340904,
+            "url": "https://dl.google.com/android/repository/skiaparser-7248848-mac.zip"
           },
           {
             "os": "windows",
-            "sha1": "2aafef23d600d05467e645cd1420e8c7e5a5dad3",
-            "size": 6008442,
-            "url": "https://dl.google.com/android/repository/skiaparser-6923996-win.zip"
+            "sha1": "84c28480ca057e48e8d2fed0ae8f52fc21aa7e61",
+            "size": 6450856,
+            "url": "https://dl.google.com/android/repository/skiaparser-7248848-win.zip"
+          }
+        ],
+        "displayName": "Layout Inspector image server for API S",
+        "license": "android-sdk-license",
+        "name": "skiaparser",
+        "path": "skiaparser/2",
+        "revision": "2"
+      },
+      "6": {
+        "archives": [
+          {
+            "os": "linux",
+            "sha1": "78af2cd3e4168af80c16d7686536baa318e10cc4",
+            "size": 6323164,
+            "url": "https://dl.google.com/android/repository/skiaparser-7083912-linux.zip"
+          },
+          {
+            "os": "macosx",
+            "sha1": "73aa4e3b52177cf7d4cf956a74311e0097987bb4",
+            "size": 6561072,
+            "url": "https://dl.google.com/android/repository/skiaparser-7083912-mac.zip"
+          },
+          {
+            "os": "windows",
+            "sha1": "28dde025a70a0f4819cf195c1cb6e0e2b4bf4514",
+            "size": 6059180,
+            "url": "https://dl.google.com/android/repository/skiaparser-7083912-win.zip"
           }
         ],
         "displayName": "Layout Inspector image server for API 29-30",
         "license": "android-sdk-license",
         "name": "skiaparser",
         "path": "skiaparser/1",
-        "revision": "5"
+        "revision": "6"
       }
     },
     "sources": {
diff --git a/pkgs/development/ocaml-modules/mirage-bootvar-xen/default.nix b/pkgs/development/ocaml-modules/mirage-bootvar-xen/default.nix
new file mode 100644
index 00000000000..c280853488d
--- /dev/null
+++ b/pkgs/development/ocaml-modules/mirage-bootvar-xen/default.nix
@@ -0,0 +1,34 @@
+{ lib
+, buildDunePackage
+, fetchurl
+, mirage-xen
+, parse-argv
+, lwt
+}:
+
+buildDunePackage rec {
+  pname = "mirage-bootvar-xen";
+  version = "0.8.0";
+
+  minimumOCamlVersion = "4.08";
+
+  useDune2 = true;
+
+  src = fetchurl {
+    url = "https://github.com/mirage/mirage-bootvar-xen/releases/download/v${version}/mirage-bootvar-xen-v${version}.tbz";
+    sha256 = "0nk80giq9ng3svbnm68fjby2f1dnarddm3lk7mw7w59av71q0rcv";
+  };
+
+  propagatedBuildInputs = [
+    mirage-xen
+    lwt
+    parse-argv
+  ];
+
+  meta = with lib; {
+    description = "Handle boot-time arguments for Xen platform";
+    license = licenses.isc;
+    maintainers = [ maintainers.sternenseemann ];
+    homepage = "https://github.com/mirage/mirage-bootvar-xen";
+  };
+}
diff --git a/pkgs/development/ocaml-modules/mirage-net-xen/default.nix b/pkgs/development/ocaml-modules/mirage-net-xen/default.nix
new file mode 100644
index 00000000000..0d7a7e53fb1
--- /dev/null
+++ b/pkgs/development/ocaml-modules/mirage-net-xen/default.nix
@@ -0,0 +1,39 @@
+{ lib
+, buildDunePackage
+, netchannel
+, ppx_sexp_conv
+, lwt
+, cstruct
+, mirage-net
+, mirage-xen
+, io-page
+, lwt-dllist
+, logs
+}:
+
+buildDunePackage {
+  pname = "mirage-net-xen";
+
+  inherit (netchannel)
+    src
+    version
+    useDune2
+    minimumOCamlVersion
+    meta
+    ;
+
+  nativeBuildInputs = [
+    ppx_sexp_conv
+  ];
+
+  propagatedBuildInputs = [
+    lwt
+    cstruct
+    netchannel
+    mirage-net
+    mirage-xen
+    io-page
+    lwt-dllist
+    logs
+  ];
+}
diff --git a/pkgs/development/ocaml-modules/mirage-xen/default.nix b/pkgs/development/ocaml-modules/mirage-xen/default.nix
new file mode 100644
index 00000000000..0d53d0f9c3b
--- /dev/null
+++ b/pkgs/development/ocaml-modules/mirage-xen/default.nix
@@ -0,0 +1,78 @@
+{ lib
+, buildDunePackage
+, fetchurl
+, pkg-config
+, cstruct
+, lwt
+, shared-memory-ring-lwt
+, xenstore
+, lwt-dllist
+, mirage-profile
+, mirage-runtime
+, logs
+, fmt
+, ocaml-freestanding
+, bheap
+, duration
+, io-page
+}:
+
+buildDunePackage rec {
+  pname = "mirage-xen";
+  version = "6.0.0";
+
+  useDune2 = true;
+
+  src = fetchurl {
+    url = "https://github.com/mirage/mirage-xen/releases/download/v${version}/mirage-xen-v${version}.tbz";
+    sha256 = "f991e972059b27993c287ad010d9281fee061efaa1dd475d0955179f93710fbd";
+  };
+
+  patches = [
+    ./makefile-no-opam.patch
+    ./pkg-config.patch
+  ];
+
+  # can't handle OCAMLFIND_DESTDIR with substituteAll
+  postPatch = ''
+    substituteInPlace lib/bindings/mirage-xen.pc \
+      --replace "@out@" "$out" \
+      --replace "@OCAMLFIND_DESTDIR@" "$OCAMLFIND_DESTDIR"
+  '';
+
+  minimumOCamlVersion = "4.08";
+
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
+  propagatedBuildInputs = [
+    cstruct
+    lwt
+    shared-memory-ring-lwt
+    xenstore
+    lwt-dllist
+    mirage-profile
+    mirage-runtime
+    io-page
+    logs
+    fmt
+    bheap
+    duration
+    (ocaml-freestanding.override { target = "xen"; })
+  ];
+
+  # Move pkg-config files into their well-known location.
+  # This saves us an extra setup hook and causes no issues
+  # since we patch all relative paths out of the .pc file.
+  postInstall = ''
+    mv $OCAMLFIND_DESTDIR/pkgconfig $out/lib/pkgconfig
+  '';
+
+  meta = with lib; {
+    description = "Xen core platform libraries for MirageOS";
+    license = licenses.isc;
+    maintainers = [ maintainers.sternenseemann ];
+    homepage = "https://github.com/mirage/mirage-xen";
+  };
+}
diff --git a/pkgs/development/ocaml-modules/mirage-xen/makefile-no-opam.patch b/pkgs/development/ocaml-modules/mirage-xen/makefile-no-opam.patch
new file mode 100644
index 00000000000..905e6efc3f4
--- /dev/null
+++ b/pkgs/development/ocaml-modules/mirage-xen/makefile-no-opam.patch
@@ -0,0 +1,12 @@
+diff --git a/lib/bindings/Makefile b/lib/bindings/Makefile
+index 4e413c0..67c7bdc 100644
+--- a/lib/bindings/Makefile
++++ b/lib/bindings/Makefile
+@@ -1,4 +1,6 @@
+-PKG_CONFIG_PATH := $(shell opam config var prefix)/lib/pkgconfig
++ifneq (, $(shell command -v opam))
++	PKG_CONFIG_PATH ?= $(shell opam config var prefix)/lib/pkgconfig
++endif
+ 
+ CC ?= cc
+ FREESTANDING_CFLAGS := $(shell PKG_CONFIG_PATH=$(PKG_CONFIG_PATH) pkg-config --cflags ocaml-freestanding)
diff --git a/pkgs/development/ocaml-modules/mirage-xen/pkg-config.patch b/pkgs/development/ocaml-modules/mirage-xen/pkg-config.patch
new file mode 100644
index 00000000000..19205cf7ee4
--- /dev/null
+++ b/pkgs/development/ocaml-modules/mirage-xen/pkg-config.patch
@@ -0,0 +1,13 @@
+diff --git a/lib/bindings/mirage-xen.pc b/lib/bindings/mirage-xen.pc
+index a03a217..8499aa4 100644
+--- a/lib/bindings/mirage-xen.pc
++++ b/lib/bindings/mirage-xen.pc
+@@ -1,6 +1,6 @@
+-prefix=${pcfiledir}/../..
++prefix=@out@
+ exec_prefix=${prefix}
+-libdir=${exec_prefix}/lib
++libdir=@OCAMLFIND_DESTDIR@
+ 
+ Name: mirage-xen
+ Version: 6.0.0
diff --git a/pkgs/development/ocaml-modules/netchannel/default.nix b/pkgs/development/ocaml-modules/netchannel/default.nix
new file mode 100644
index 00000000000..e7b021d6fbe
--- /dev/null
+++ b/pkgs/development/ocaml-modules/netchannel/default.nix
@@ -0,0 +1,55 @@
+{ lib
+, buildDunePackage
+, fetchurl
+, ppx_sexp_conv
+, ppx_cstruct
+, lwt
+, mirage-net
+, io-page
+, mirage-xen
+, ipaddr
+, mirage-profile
+, shared-memory-ring
+, sexplib
+, logs
+, rresult
+}:
+
+buildDunePackage rec {
+  pname = "netchannel";
+  version = "2.0.0";
+
+  useDune2 = true;
+
+  minimumOCamlVersion = "4.08";
+
+  src = fetchurl {
+    url = "https://github.com/mirage/mirage-net-xen/releases/download/v${version}/mirage-net-xen-v${version}.tbz";
+    sha256 = "ec3906ef1804ef6a9e36b91f4ae73ce4849e9e0d1d36a80fe66b5f905fab93ad";
+  };
+
+  nativeBuildInputs = [
+    ppx_cstruct
+  ];
+
+  propagatedBuildInputs = [
+    ppx_sexp_conv
+    lwt
+    mirage-net
+    io-page
+    mirage-xen
+    ipaddr
+    mirage-profile
+    shared-memory-ring
+    sexplib
+    logs
+    rresult
+  ];
+
+  meta = with lib; {
+    description = "Network device for reading and writing Ethernet frames via then Xen netfront/netback protocol";
+    license = licenses.isc;
+    maintainers = [ maintainers.sternenseemann ];
+    homepage = "https://github.com/mirage/mirage-net-xen";
+  };
+}
diff --git a/pkgs/development/ocaml-modules/shared-memory-ring/default.nix b/pkgs/development/ocaml-modules/shared-memory-ring/default.nix
new file mode 100644
index 00000000000..3a96d4adee4
--- /dev/null
+++ b/pkgs/development/ocaml-modules/shared-memory-ring/default.nix
@@ -0,0 +1,41 @@
+{ lib
+, buildDunePackage
+, fetchurl
+, ppx_cstruct
+, mirage-profile
+, cstruct
+, ounit
+}:
+
+buildDunePackage rec {
+  pname = "shared-memory-ring";
+  version = "3.1.0";
+
+  useDune2 = true;
+
+  src = fetchurl {
+    url = "https://github.com/mirage/shared-memory-ring/releases/download/v${version}/shared-memory-ring-v${version}.tbz";
+    sha256 = "06350ph3rdfvybi0cgs3h3rdkmjspk3c4375rxvbdg0kza1w22x1";
+  };
+
+  nativeBuildInputs = [
+    ppx_cstruct
+  ];
+
+  propagatedBuildInputs = [
+    mirage-profile
+    cstruct
+  ];
+
+  doCheck = true;
+  checkInputs = [
+    ounit
+  ];
+
+  meta = with lib; {
+    description = "Shared memory rings for RPC and bytestream communications";
+    license = licenses.isc;
+    homepage = "https://github.com/mirage/shared-memory-ring";
+    maintainers = [ maintainers.sternenseemann ];
+  };
+}
diff --git a/pkgs/development/ocaml-modules/shared-memory-ring/lwt.nix b/pkgs/development/ocaml-modules/shared-memory-ring/lwt.nix
new file mode 100644
index 00000000000..8f41253bab8
--- /dev/null
+++ b/pkgs/development/ocaml-modules/shared-memory-ring/lwt.nix
@@ -0,0 +1,37 @@
+{ lib
+, buildDunePackage
+, shared-memory-ring
+, ppx_cstruct
+, cstruct
+, lwt
+, lwt-dllist
+, mirage-profile
+, ounit
+}:
+
+buildDunePackage {
+  pname = "shared-memory-ring-lwt";
+
+  inherit (shared-memory-ring) version src useDune2;
+
+  buildInputs = [
+    ppx_cstruct
+  ];
+
+  propagatedBuildInputs = [
+    shared-memory-ring
+    cstruct
+    lwt
+    lwt-dllist
+    mirage-profile
+  ];
+
+  doCheck = true;
+  checkInputs = [
+    ounit
+  ];
+
+  meta = shared-memory-ring.meta // {
+    description = "Shared memory rings for RPC and bytestream communications using Lwt";
+  };
+}
diff --git a/pkgs/development/python-modules/libarcus/default.nix b/pkgs/development/python-modules/libarcus/default.nix
index 6e5d8f771e8..edea85876a8 100644
--- a/pkgs/development/python-modules/libarcus/default.nix
+++ b/pkgs/development/python-modules/libarcus/default.nix
@@ -3,14 +3,14 @@
 
 buildPythonPackage rec {
   pname = "libarcus";
-  version = "4.8.0";
+  version = "4.9.0";
   format = "other";
 
   src = fetchFromGitHub {
     owner = "Ultimaker";
     repo = "libArcus";
     rev = version;
-    sha256 = "1dvz1rkvm4309yzvj7vy49v1vskr5yfq4nzqdiydp1jb7zpvhqqm";
+    sha256 = "0wq72nf680bwxijjajb4piw563rnvflshmw96kqln4lsny7ydjj2";
   };
 
   disabled = pythonOlder "3.4.0";
diff --git a/pkgs/development/python-modules/libsavitar/default.nix b/pkgs/development/python-modules/libsavitar/default.nix
index 7ef22e3f6ee..f6aa1b378f5 100644
--- a/pkgs/development/python-modules/libsavitar/default.nix
+++ b/pkgs/development/python-modules/libsavitar/default.nix
@@ -2,14 +2,14 @@
 
 buildPythonPackage rec {
   pname = "libsavitar";
-  version = "4.8.0";
+  version = "4.9.0";
   format = "other";
 
   src = fetchFromGitHub {
     owner = "Ultimaker";
     repo = "libSavitar";
     rev = version;
-    sha256 = "1mxkvnhn8k1a86jlnjnlpf0b8dvrcg3n7pslf60s13cgb7w3sfzh";
+    sha256 = "0434cb19v9phc9xicbmgpbig18ivplcpqhnsjgca4p8n8c715k9h";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/openshift/default.nix b/pkgs/development/python-modules/openshift/default.nix
new file mode 100644
index 00000000000..052d364982b
--- /dev/null
+++ b/pkgs/development/python-modules/openshift/default.nix
@@ -0,0 +1,39 @@
+{
+  lib
+  , buildPythonPackage
+  , fetchPypi
+  , jinja2
+  , kubernetes
+  , ruamel-yaml
+  , six
+  , python-string-utils
+}:
+
+buildPythonPackage rec {
+  pname = "openshift";
+  version = "0.12.0";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "sha256-aggRnD4goiZJPp4cngp8AIrJC/V46378cwUSfq8Xml4=";
+  };
+
+  propagatedBuildInputs = [
+    jinja2
+    kubernetes
+    python-string-utils
+    ruamel-yaml
+    six
+  ];
+
+  # tries to connect to the network
+  doCheck = false;
+  pythonImportsCheck = ["openshift"];
+
+  meta = with lib; {
+    description = "Python client for the OpenShift API";
+    homepage = "https://github.com/openshift/openshift-restclient-python";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ teto ];
+  };
+}
diff --git a/pkgs/development/python-modules/python-string-utils/default.nix b/pkgs/development/python-modules/python-string-utils/default.nix
new file mode 100644
index 00000000000..d8d1b136fb3
--- /dev/null
+++ b/pkgs/development/python-modules/python-string-utils/default.nix
@@ -0,0 +1,27 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, pytest
+}:
+
+buildPythonPackage rec {
+  pname = "python-string-utils";
+  version = "1.0.0";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "sha256-3PkGCwPwdkfApgNAjciwP4B/O1SgXG4Z6xRGAlb6wMs=";
+  };
+
+  pythonImportsCheck = ["string_utils"];
+
+  # tests are not available in pypi tarball
+  doCheck = false;
+
+  meta = with lib; {
+    description = "A handy Python library to validate, manipulate and generate strings.";
+    homepage = "https://github.com/daveoncode/python-string-utils";
+    license = licenses.mit;
+    maintainers = with maintainers; [ teto ];
+  };
+}
diff --git a/pkgs/development/python-modules/uranium/default.nix b/pkgs/development/python-modules/uranium/default.nix
index 0c068428f6c..db8c8c8bd23 100644
--- a/pkgs/development/python-modules/uranium/default.nix
+++ b/pkgs/development/python-modules/uranium/default.nix
@@ -2,7 +2,7 @@
 , pyqt5, numpy, scipy, shapely, libarcus, cryptography, doxygen, gettext, pythonOlder }:
 
 buildPythonPackage rec {
-  version = "4.7.1";
+  version = "4.9.0";
   pname = "uranium";
   format = "other";
 
@@ -10,7 +10,7 @@ buildPythonPackage rec {
     owner = "Ultimaker";
     repo = "Uranium";
     rev = version;
-    sha256 = "1h5d3scy3cnbyhh0pbavflpqklhn2lbp7hl193rc5gx8yzr3mqbh";
+    sha256 = "0bqrc4g4pd7b209swlv06bm5sx7df96h9kjpqpra4mfz469km4nn";
   };
 
   disabled = pythonOlder "3.5.0";
diff --git a/pkgs/development/tools/analysis/tflint/default.nix b/pkgs/development/tools/analysis/tflint/default.nix
index d52ac500e80..9f4efe396c6 100644
--- a/pkgs/development/tools/analysis/tflint/default.nix
+++ b/pkgs/development/tools/analysis/tflint/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "tflint";
-  version = "0.27.0";
+  version = "0.28.0";
 
   src = fetchFromGitHub {
     owner = "terraform-linters";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1s49a3yihfkd8ib336a29ch53mpcyxzicglss7bqmqapv6zi37dg";
+    sha256 = "1d746016iyswb9kw7gprg32vj5rcfa2y9j11r2hsp61hsjfvmg8c";
   };
 
-  vendorSha256 = "1w72n1sprwylaj96aj03h4qq43525q15iwb6vf23gf6913zhvqy3";
+  vendorSha256 = "0whd0b9rll0s42hrr2fqp412d5frzmrnqnynpq75wda5rqzmaf8r";
 
   doCheck = false;
 
diff --git a/pkgs/games/soldat-unstable/default.nix b/pkgs/games/soldat-unstable/default.nix
index d48cf3048ee..19ff4b5c6c0 100644
--- a/pkgs/games/soldat-unstable/default.nix
+++ b/pkgs/games/soldat-unstable/default.nix
@@ -38,15 +38,15 @@ let
 in
 
 stdenv.mkDerivation rec {
-  pname = "soldat-unstable";
-  version = "2020-11-26";
+  pname = "soldat";
+  version = "unstable-2021-02-09";
 
   src = fetchFromGitHub {
     name = "soldat";
     owner = "Soldat";
     repo = "soldat";
-    rev = "2280296ac56883f6a9cad4da48025af8ae7782e7";
-    sha256 = "17i3nlhxm4x4zx00i00aivhxmagbnyizxnpwiqzg57bf23hrvdj3";
+    rev = "c304c3912ca7a88461970a859049d217a44c6375";
+    sha256 = "09sl2zybfcmnl2n3qghp0gylmr71y01534l6nq0y9llbdy0bf306";
   };
 
   nativeBuildInputs = [ fpc makeWrapper autoPatchelfHook ];
@@ -63,14 +63,9 @@ stdenv.mkDerivation rec {
     })
   ];
 
-  postPatch = ''
-    for f in client/Makefile server/Makefile; do
-      # fix unportable uname invocation
-      substituteInPlace "$f" --replace "uname -p" "uname -m"
-    done
-  '';
-
   buildPhase = ''
+    runHook preBuild
+
     mkdir -p client/build server/build
 
     # build .so from stb headers
@@ -87,9 +82,13 @@ stdenv.mkDerivation rec {
     pushd server
     make mode=release
     popd
+
+    runHook postBuild
   '';
 
   installPhase = ''
+    runHook preInstall
+
     install -Dm644 client/libs/stb/libstb.so -t $out/lib
     install -Dm755 client/build/soldat_* $out/bin/soldat
     install -Dm755 server/build/soldatserver_* $out/bin/soldatserver
@@ -107,6 +106,8 @@ stdenv.mkDerivation rec {
         --add-flags "-fs_userpath \"$configDir\"" \
         --add-flags "-fs_basepath \"${base}/share/soldat\""
     done
+
+    runHook postInstall
   '';
 
   meta = with lib; {
diff --git a/pkgs/servers/misc/podgrab/default.nix b/pkgs/servers/misc/podgrab/default.nix
new file mode 100644
index 00000000000..a5fd230d48f
--- /dev/null
+++ b/pkgs/servers/misc/podgrab/default.nix
@@ -0,0 +1,30 @@
+{ lib, fetchFromGitHub, buildGoModule, nixosTests }:
+
+buildGoModule rec {
+  pname = "podgrab";
+  version = "unstable-2021-04-14";
+
+  src = fetchFromGitHub {
+    owner = "akhilrex";
+    repo = pname;
+    rev = "3179a875b8b638fb86d0e829d12a9761c1cd7f90";
+    sha256 = "sha256-vhxIm20ZUi+RusrAsSY54tv/D570/oMO5qLz9dNqgqo=";
+  };
+
+  vendorSha256 = "sha256-xY9xNuJhkWPgtqA/FBVIp7GuWOv+3nrz6l3vaZVLlIE=";
+
+  postInstall = ''
+    mkdir -p $out/share/
+    cp -r $src/client $out/share/
+    cp -r $src/webassets $out/share/
+  '';
+
+  passthru.tests = { inherit (nixosTests) podgrab; };
+
+  meta = with lib; {
+    description = "A self-hosted podcast manager to download episodes as soon as they become live";
+    homepage = "https://github.com/akhilrex/podgrab";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ ambroisie ];
+  };
+}
diff --git a/pkgs/servers/teleport/default.nix b/pkgs/servers/teleport/default.nix
index 2350311b9db..c9ace581c7e 100644
--- a/pkgs/servers/teleport/default.nix
+++ b/pkgs/servers/teleport/default.nix
@@ -1,27 +1,27 @@
 # This file was generated by https://github.com/kamilchm/go2nix v2.0-dev
-{ lib, buildGoPackage, zip, fetchFromGitHub, makeWrapper, xdg-utils }:
+{ lib, buildGoModule, zip, fetchFromGitHub, makeWrapper, xdg-utils }:
 let
   webassets = fetchFromGitHub {
     owner = "gravitational";
     repo = "webassets";
-    rev = "8ace0cfcc6867651bed3fd5b5f35aaa2a80e1106";
-    sha256 = "sha256-mzvYysCFMvWHo8Y4cmhAju62jjpe92j564gc12BSdZA=";
+    rev = "cf396f868aebb8ba654ea2398c25f033181e7114";
+    sha256 = "sha256-12jkpWl/kL0ttRHtxyDnKjYAZNrheEGQF8HEGSXvvAk=";
   };
 in
 
-buildGoPackage rec {
+buildGoModule rec {
   pname = "teleport";
-  version = "5.2.1";
+  version = "6.1.2";
 
   # This repo has a private submodule "e" which fetchgit cannot handle without failing.
   src = fetchFromGitHub {
     owner = "gravitational";
     repo = "teleport";
     rev = "v${version}";
-    sha256 = "sha256-8WEVH+04y1/s9KpBlK/LrgHG7qTpu2LqtanKKdi9N08=";
+    sha256 = "sha256-4ZaebTTgGrGRQbMfDw1PL/qtDKmHbSY6kPmWyFeIcAU=";
   };
 
-  goPackagePath = "github.com/gravitational/teleport";
+  vendorSha256 = null;
 
   subPackages = [ "tool/tctl" "tool/teleport" "tool/tsh" ];
 
@@ -29,7 +29,6 @@ buildGoPackage rec {
 
   postBuild = ''
     pushd .
-    cd $NIX_BUILD_TOP/go/src/github.com/gravitational/teleport
     mkdir -p build
     echo "making webassets"
     cp -r ${webassets}/* webassets/
@@ -41,13 +40,21 @@ buildGoPackage rec {
     popd
   '';
 
+  # Do not strip the embedded web assets
+  dontStrip = true;
+
   # Reduce closure size for client machines
   outputs = [ "out" "client" ];
 
   buildTargets = [ "full" ];
 
+  preCheck = ''
+    export HOME=$(mktemp -d)
+  '';
+
   postInstall = ''
     install -Dm755 -t $client/bin $out/bin/tsh
+    wrapProgram $client/bin/tsh --prefix PATH : ${xdg-utils}/bin
     wrapProgram $out/bin/tsh --prefix PATH : ${xdg-utils}/bin
   '';
 
@@ -62,7 +69,7 @@ buildGoPackage rec {
 
   meta = with lib; {
     description = "A SSH CA management suite";
-    homepage = "https://gravitational.com/teleport/";
+    homepage = "https://goteleport.com/";
     license = licenses.asl20;
     maintainers = with maintainers; [ sigma tomberek freezeboy ];
     platforms = platforms.unix;
diff --git a/pkgs/tools/inputmethods/remote-touchpad/default.nix b/pkgs/tools/inputmethods/remote-touchpad/default.nix
new file mode 100644
index 00000000000..0bd2b09aafc
--- /dev/null
+++ b/pkgs/tools/inputmethods/remote-touchpad/default.nix
@@ -0,0 +1,33 @@
+{ buildGoModule
+, fetchFromGitHub
+, lib
+, libX11
+, libXi
+, libXt
+, libXtst
+}:
+
+buildGoModule rec {
+  pname = "remote-touchpad";
+  version = "1.0.1";
+
+  src = fetchFromGitHub {
+    owner = "unrud";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "0zmbn4s3yhcgmijc96vja7zj2sh6q0nkybhqy0fwz6sqzk8hq02x";
+  };
+
+  buildInputs = [ libX11 libXi libXt libXtst ];
+  buildFlags = [ "-tags" "portal,x11" ];
+
+  vendorSha256 = "0q1qk5g7kqpcci5fgamvxa8989jglv69kwg5rvkphbnx1bzlivrl";
+
+  meta = with lib; {
+    description = "Control mouse and keyboard from the webbrowser of a smartphone.";
+    homepage = "https://github.com/unrud/remote-touchpad";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ schnusch ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/tools/wayland/wdomirror/default.nix b/pkgs/tools/wayland/wdomirror/default.nix
new file mode 100644
index 00000000000..8fddf51f539
--- /dev/null
+++ b/pkgs/tools/wayland/wdomirror/default.nix
@@ -0,0 +1,38 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, meson
+, ninja
+, pkg-config
+, wayland
+, wayland-protocols
+}:
+
+stdenv.mkDerivation {
+  pname = "wdomirror";
+  version = "unstable-2021-01-08";
+
+  src = fetchFromGitHub {
+    owner = "progandy";
+    repo = "wdomirror";
+    rev = "e4a4934e6f739909fbf346cbc001c72690b5c906";
+    sha256 = "1fz0sajhdjqas3l6mpik8w1k15wbv65hgh9r9vdgfqvw5l6cx7jv";
+  };
+
+  nativeBuildInputs = [ meson ninja pkg-config wayland-protocols ];
+
+  buildInputs = [ wayland ];
+
+  installPhase = ''
+    runHook preInstall
+    install -m755 -D wdomirror $out/bin/wdomirror
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "Mirrors an output of a wlroots compositor to a window";
+    license = licenses.mit;
+    platforms = platforms.unix;
+    maintainers = with maintainers; [ jpas ];
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 8ff08ad2c55..fa8a27bfb1d 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -912,6 +912,8 @@ in
     inherit (haskellPackages) ghcWithPackages;
   };
 
+  termsyn = callPackage ../data/fonts/termsyn { };
+
   tilda = callPackage ../applications/terminal-emulators/tilda {
     gtk = gtk3;
   };
@@ -2133,6 +2135,8 @@ in
 
   wev = callPackage ../tools/wayland/wev { };
 
+  wdomirror = callPackage ../tools/wayland/wdomirror { };
+
   wl-clipboard = callPackage ../tools/wayland/wl-clipboard { };
 
   wlogout = callPackage ../tools/wayland/wlogout { };
@@ -7975,6 +7979,8 @@ in
 
   reftools = callPackage ../development/tools/reftools { };
 
+  remote-touchpad = callPackage ../tools/inputmethods/remote-touchpad { };
+
   reposurgeon = callPackage ../applications/version-management/reposurgeon { };
 
   reptyr = callPackage ../os-specific/linux/reptyr {};
@@ -18530,6 +18536,8 @@ in
 
   hyp = callPackage ../servers/http/hyp { };
 
+  podgrab = callPackage ../servers/misc/podgrab { };
+
   prosody = callPackage ../servers/xmpp/prosody {
     # _compat can probably be removed on next minor version after 0.10.0
     lua5 = lua5_2_compat;
diff --git a/pkgs/top-level/ocaml-packages.nix b/pkgs/top-level/ocaml-packages.nix
index a2718e6d8df..b94210f0d48 100644
--- a/pkgs/top-level/ocaml-packages.nix
+++ b/pkgs/top-level/ocaml-packages.nix
@@ -674,6 +674,8 @@ let
 
     mirage-bootvar-unix = callPackage ../development/ocaml-modules/mirage-bootvar-unix { };
 
+    mirage-bootvar-xen = callPackage ../development/ocaml-modules/mirage-bootvar-xen { };
+
     mirage-channel = callPackage ../development/ocaml-modules/mirage-channel { };
 
     mirage-clock = callPackage ../development/ocaml-modules/mirage-clock { };
@@ -716,6 +718,8 @@ let
 
     mirage-net = callPackage ../development/ocaml-modules/mirage-net { };
 
+    mirage-net-xen = callPackage ../development/ocaml-modules/mirage-net-xen { };
+
     mirage-profile = callPackage ../development/ocaml-modules/mirage-profile { };
 
     mirage-protocols = callPackage ../development/ocaml-modules/mirage-protocols { };
@@ -738,6 +742,8 @@ let
 
     mirage-unix = callPackage ../development/ocaml-modules/mirage-unix { };
 
+    mirage-xen = callPackage ../development/ocaml-modules/mirage-xen { };
+
     mirage-vnetif = callPackage ../development/ocaml-modules/mirage-vnetif { };
 
     mlgmp =  callPackage ../development/ocaml-modules/mlgmp { };
@@ -752,6 +758,8 @@ let
 
     mustache =  callPackage ../development/ocaml-modules/mustache { };
 
+    netchannel = callPackage ../development/ocaml-modules/netchannel { };
+
     nocrypto =  callPackage ../development/ocaml-modules/nocrypto { };
 
     nonstd =  callPackage ../development/ocaml-modules/nonstd { };
@@ -1137,6 +1145,10 @@ let
 
     sha = callPackage ../development/ocaml-modules/sha { };
 
+    shared-memory-ring = callPackage ../development/ocaml-modules/shared-memory-ring { };
+
+    shared-memory-ring-lwt = callPackage ../development/ocaml-modules/shared-memory-ring/lwt.nix { };
+
     sodium = callPackage ../development/ocaml-modules/sodium { };
 
     spelll = callPackage ../development/ocaml-modules/spelll { };
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 3e9626426f3..439d4d8e4a5 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -4624,6 +4624,8 @@ in {
 
   opensensemap-api = callPackage ../development/python-modules/opensensemap-api { };
 
+  openshift = callPackage ../development/python-modules/openshift { };
+
   opentimestamps = callPackage ../development/python-modules/opentimestamps { };
 
   opentracing = callPackage ../development/python-modules/opentracing { };
@@ -6359,6 +6361,8 @@ in {
 
   pytest-shutil = callPackage ../development/python-modules/pytest-shutil { };
 
+  python-string-utils = callPackage ../development/python-modules/python-string-utils { };
+
   pytest-socket = callPackage ../development/python-modules/pytest-socket { };
 
   pytest-subtesthack = callPackage ../development/python-modules/pytest-subtesthack { };