diff --git a/doc/builders/special/mkshell.section.md b/doc/builders/special/mkshell.section.md
index 1feb75cbd6f..8a62c50e17d 100644
--- a/doc/builders/special/mkshell.section.md
+++ b/doc/builders/special/mkshell.section.md
@@ -1,15 +1,17 @@
 # pkgs.mkShell {#sec-pkgs-mkShell}
 
-`pkgs.mkShell` is a special kind of derivation that is only useful when using it combined with `nix-shell`. It will in fact fail to instantiate when invoked with `nix-build`.
+`pkgs.mkShell` is a special kind of derivation that is only useful when using
+it combined with `nix-shell`. It will in fact fail to instantiate when invoked
+with `nix-build`.
 
 ## Usage {#sec-pkgs-mkShell-usage}
 
 ```nix
 { pkgs ? import <nixpkgs> {} }:
 pkgs.mkShell {
-  # this will make all the build inputs from hello and gnutar
-  # available to the shell environment
+  # specify which packages to add to the shell environment
+  packages = [ pkgs.gnumake ];
+  # add all the dependencies, of the given packages, to the shell environment
   inputsFrom = with pkgs; [ hello gnutar ];
-  buildInputs = [ pkgs.gnumake ];
 }
 ```
diff --git a/doc/languages-frameworks/dotnet.section.md b/doc/languages-frameworks/dotnet.section.md
index 36369fd4e63..725ffd4becc 100644
--- a/doc/languages-frameworks/dotnet.section.md
+++ b/doc/languages-frameworks/dotnet.section.md
@@ -10,7 +10,7 @@ with import <nixpkgs> {};
 
 mkShell {
   name = "dotnet-env";
-  buildInputs = [
+  packages = [
     dotnet-sdk_3
   ];
 }
@@ -25,7 +25,7 @@ with import <nixpkgs> {};
 
 mkShell {
   name = "dotnet-env";
-  buildInputs = [
+  packages = [
     (with dotnetCorePackages; combinePackages [
       sdk_3_1
       sdk_3_0
diff --git a/doc/languages-frameworks/python.section.md b/doc/languages-frameworks/python.section.md
index 96ac61ab54c..b466748f548 100644
--- a/doc/languages-frameworks/python.section.md
+++ b/doc/languages-frameworks/python.section.md
@@ -245,7 +245,7 @@ let
     ps.toolz
   ]);
 in mkShell {
-  buildInputs = [
+  packages = [
     pythonEnv
 
     black
diff --git a/doc/languages-frameworks/ruby.section.md b/doc/languages-frameworks/ruby.section.md
index c519d79d3da..b8fc19eb6b0 100644
--- a/doc/languages-frameworks/ruby.section.md
+++ b/doc/languages-frameworks/ruby.section.md
@@ -106,7 +106,7 @@ let
     name = "gems-for-some-project";
     gemdir = ./.;
   };
-in mkShell { buildInputs = [ gems gems.wrappedRuby ]; }
+in mkShell { packages = [ gems gems.wrappedRuby ]; }
 ```
 
 With this file in your directory, you can run `nix-shell` to build and use the gems. The important parts here are `bundlerEnv` and `wrappedRuby`.
diff --git a/maintainers/scripts/update-luarocks-shell.nix b/maintainers/scripts/update-luarocks-shell.nix
index 23a940b3691..d3f342b07a9 100644
--- a/maintainers/scripts/update-luarocks-shell.nix
+++ b/maintainers/scripts/update-luarocks-shell.nix
@@ -2,8 +2,11 @@
 }:
 with nixpkgs;
 mkShell {
-  buildInputs = [
-    bash luarocks-nix nix-prefetch-scripts parallel
+  packages = [
+    bash
+    luarocks-nix
+    nix-prefetch-scripts
+    parallel
   ];
   LUAROCKS_NIXPKGS_PATH = toString nixpkgs.path;
 }
diff --git a/nixos/doc/manual/shell.nix b/nixos/doc/manual/shell.nix
index cc3609d750e..e5ec9b8f97f 100644
--- a/nixos/doc/manual/shell.nix
+++ b/nixos/doc/manual/shell.nix
@@ -4,5 +4,5 @@ in
 pkgs.mkShell {
   name = "nixos-manual";
 
-  buildInputs = with pkgs; [ xmlformat jing xmloscopy ruby ];
+  packages = with pkgs; [ xmlformat jing xmloscopy ruby ];
 }
diff --git a/nixos/modules/virtualisation/docker.nix b/nixos/modules/virtualisation/docker.nix
index 954e33ff24a..29f133786d8 100644
--- a/nixos/modules/virtualisation/docker.nix
+++ b/nixos/modules/virtualisation/docker.nix
@@ -151,8 +151,8 @@ in
   config = mkIf cfg.enable (mkMerge [{
       boot.kernelModules = [ "bridge" "veth" ];
       boot.kernel.sysctl = {
-        "net.ipv4.conf.all.forwarding" = mkOverride 99 true;
-        "net.ipv4.conf.default.forwarding" = mkOverride 99 true;
+        "net.ipv4.conf.all.forwarding" = mkOverride 98 true;
+        "net.ipv4.conf.default.forwarding" = mkOverride 98 true;
       };
       environment.systemPackages = [ cfg.package ]
         ++ optional cfg.enableNvidia pkgs.nvidia-docker;
diff --git a/pkgs/applications/blockchains/ergo/default.nix b/pkgs/applications/blockchains/ergo/default.nix
index d4210c83bb2..c9761542da0 100644
--- a/pkgs/applications/blockchains/ergo/default.nix
+++ b/pkgs/applications/blockchains/ergo/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "ergo";
-  version = "4.0.9";
+  version = "4.0.10";
 
   src = fetchurl {
     url = "https://github.com/ergoplatform/ergo/releases/download/v${version}/ergo-${version}.jar";
-    sha256 = "sha256-FstAKUZVKW9U6QTqqCEDybvbBl+0H9qVHqFMPubdDpk=";
+    sha256 = "sha256-o3+yL81WO5/UGh0gl4MOewPHTDch/Vij8mzZWOlEkjg=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/applications/editors/emacs-modes/emacs2nix.nix b/pkgs/applications/editors/emacs-modes/emacs2nix.nix
index cc82646870c..658756250a0 100644
--- a/pkgs/applications/editors/emacs-modes/emacs2nix.nix
+++ b/pkgs/applications/editors/emacs-modes/emacs2nix.nix
@@ -7,10 +7,10 @@ let
     rev = "860da04ca91cbb69c9b881a54248d16bdaaf9923";
     sha256 = "1r3xmyk9rfgx7ln69dk8mgbnh3awcalm3r1c5ia2shlsrymvv1df";
   };
+in
+pkgs.mkShell {
 
-in pkgs.mkShell {
-
-  buildInputs = [
+  packages = [
     pkgs.bash
   ];
 
diff --git a/pkgs/applications/editors/emacs-modes/updater-emacs.nix b/pkgs/applications/editors/emacs-modes/updater-emacs.nix
index 4c321065445..7502bcc2fee 100644
--- a/pkgs/applications/editors/emacs-modes/updater-emacs.nix
+++ b/pkgs/applications/editors/emacs-modes/updater-emacs.nix
@@ -29,7 +29,7 @@ let
   in [ promise semaphore ]);
 
 in pkgs.mkShell {
-  buildInputs = [
+  packages = [
     pkgs.git
     pkgs.nix
     pkgs.bash
diff --git a/pkgs/applications/misc/gpsprune/default.nix b/pkgs/applications/misc/gpsprune/default.nix
index 70645202a46..583a8a1931b 100644
--- a/pkgs/applications/misc/gpsprune/default.nix
+++ b/pkgs/applications/misc/gpsprune/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gpsprune";
-  version = "20.3";
+  version = "20.4";
 
   src = fetchurl {
     url = "https://activityworkshop.net/software/gpsprune/gpsprune_${version}.jar";
-    sha256 = "sha256-hmAksLPQxzB4O+ET+O/pmL/J4FG4+Dt0ulSsgjBWKxw=";
+    sha256 = "sha256-ZTYkKyu0/axf2uLUmQHRW/2bQ6p2zK7xBF66ozbPS2c=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/applications/misc/sweethome3d/default.nix b/pkgs/applications/misc/sweethome3d/default.nix
index 0b97110b1dd..387177a8c4c 100644
--- a/pkgs/applications/misc/sweethome3d/default.nix
+++ b/pkgs/applications/misc/sweethome3d/default.nix
@@ -1,19 +1,17 @@
 { lib
 , stdenv
 , fetchurl
-, fetchsvn
 , makeWrapper
 , makeDesktopItem
-# sweethome3d 6.4.2 does not yet build with jdk 9 and later.
-# this is fixed on trunk (7699?) but let's build with jdk8 until then.
+# sweethome3d 6.5.2 does not yet fully build&run with jdk 9 and later?
 , jdk8
-# it can run on the latest stable jre fine though
-, jre
+, jre8
 , ant
 , gtk3
 , gsettings-desktop-schemas
 , p7zip
 , libXxf86vm
+, unzip
 }:
 
 let
@@ -49,7 +47,7 @@ let
       patchelf --set-rpath ${libXxf86vm}/lib lib/java3d-1.6/linux/i586/libnativewindow_x11.so
     '';
 
-    nativeBuildInputs = [ makeWrapper ];
+    nativeBuildInputs = [ makeWrapper unzip ];
     buildInputs = [ ant jdk8 p7zip gtk3 gsettings-desktop-schemas ];
 
     buildPhase = ''
@@ -77,7 +75,7 @@ let
       # without it a "Profiles [GL4bc, GL3bc, GL2, GLES1] not available on device null"
       # exception is thrown on startup.
       # https://discourse.nixos.org/t/glx-not-recognised-after-mesa-update/6753
-      makeWrapper ${jre}/bin/java $out/bin/$exec \
+      makeWrapper ${jre8}/bin/java $out/bin/$exec \
         --set MESA_GL_VERSION_OVERRIDE 2.1 \
         --prefix XDG_DATA_DIRS : "$XDG_ICON_DIRS:${gtk3.out}/share:${gsettings-desktop-schemas}/share:$out/share:$GSETTINGS_SCHEMAS_PATH" \
         --add-flags "-Dsun.java2d.opengl=true -jar $out/share/java/${module}-${version}.jar -cp $out/share/java/Furniture.jar:$out/share/java/Textures.jar:$out/share/java/Help.jar -d${toString stdenv.hostPlatform.parsed.cpu.bits}"
@@ -102,14 +100,13 @@ in {
 
   application = mkSweetHome3D rec {
     pname = lib.toLower module + "-application";
-    version = "6.4.2";
+    version = "6.5.2";
     module = "SweetHome3D";
     description = "Design and visualize your future home";
     license = lib.licenses.gpl2Plus;
-    src = fetchsvn {
-      url = "https://svn.code.sf.net/p/sweethome3d/code/tags/V_" + d2u version + "/SweetHome3D/";
-      sha256 = "13rczayakwb5246hqnp8lnw61p0p7ywr2294bnlp4zwsrz1in9z4";
-      rev = "7504";
+    src = fetchurl {
+      url = "mirror://sourceforge/sweethome3d/${module}-${version}-src.zip";
+      sha256 = "1j0xm2vmcxxjmf12k8rfnisq9hd7hqaiyxrfbrbjxis9iq3kycp3";
     };
     desktopName = "Sweet Home 3D";
     icons = {
diff --git a/pkgs/applications/misc/sweethome3d/editors.nix b/pkgs/applications/misc/sweethome3d/editors.nix
index f5dbd0510a3..783ea3e7940 100644
--- a/pkgs/applications/misc/sweethome3d/editors.nix
+++ b/pkgs/applications/misc/sweethome3d/editors.nix
@@ -1,17 +1,17 @@
 { lib
 , stdenv
-, fetchcvs
+, fetchurl
 , makeWrapper
 , makeDesktopItem
-# sweethome3d 6.4.2 does not yet build with jdk 9 and later.
-# this is fixed on trunk (7699?) but let's build with jdk8 until then.
+# sweethome3d 6.5.2 does not yet fully build&run with jdk 9 and later?
 , jdk8
-# it can run on the latest stable jre fine though
-, jre
+, jre8
 , ant
 , gtk3
 , gsettings-desktop-schemas
-, sweethome3dApp }:
+, sweethome3dApp
+, unzip
+}:
 
 let
 
@@ -20,6 +20,14 @@ let
     + removeSuffix "libraryeditor" (toLower m)
     + "-editor";
 
+  applicationSrc = stdenv.mkDerivation {
+    name = "application-src";
+    src = sweethome3dApp.src;
+    nativeBuildInputs = [ unzip ];
+    buildPhase = "";
+    installPhase = "cp -r . $out";
+  };
+
   mkEditorProject =
   { pname, module, version, src, license, description, desktopName }:
 
@@ -35,18 +43,18 @@ let
       categories = "Graphics;2DGraphics;3DGraphics;";
     };
 
-    nativeBuildInputs = [ makeWrapper ];
-    buildInputs = [ ant jre jdk8 gtk3 gsettings-desktop-schemas ];
+    nativeBuildInputs = [ makeWrapper unzip ];
+    buildInputs = [ ant jre8 jdk8 gtk3 gsettings-desktop-schemas ];
 
     postPatch = ''
-      sed -i -e 's,../SweetHome3D,${application.src},g' build.xml
+      sed -i -e 's,../SweetHome3D,${applicationSrc},g' build.xml
       sed -i -e 's,lib/macosx/java3d-1.6/jogl-all.jar,lib/java3d-1.6/jogl-all.jar,g' build.xml
     '';
 
     buildPhase = ''
       runHook preBuild
 
-      ant -lib ${application.src}/libtest -lib ${application.src}/lib -lib ${jdk8}/lib
+      ant -lib ${applicationSrc}/libtest -lib ${applicationSrc}/lib -lib ${jdk8}/lib
 
       runHook postBuild
     '';
@@ -56,7 +64,7 @@ let
       mkdir -p $out/share/{java,applications}
       cp ${module}-${version}.jar $out/share/java/.
       cp "${editorItem}/share/applications/"* $out/share/applications
-      makeWrapper ${jre}/bin/java $out/bin/$exec \
+      makeWrapper ${jre8}/bin/java $out/bin/$exec \
         --prefix XDG_DATA_DIRS : "$XDG_ICON_DIRS:${gtk3.out}/share:${gsettings-desktop-schemas}/share:$out/share:$GSETTINGS_SCHEMAS_PATH" \
         --add-flags "-jar $out/share/java/${module}-${version}.jar -d${toString stdenv.hostPlatform.parsed.cpu.bits}"
     '';
@@ -78,31 +86,27 @@ let
 in {
 
   textures-editor = mkEditorProject rec {
-    version = "1.5";
+    version = "1.7";
     module = "TexturesLibraryEditor";
     pname = module;
     description = "Easily create SH3T files and edit the properties of the texture images it contain";
     license = lib.licenses.gpl2Plus;
-    src = fetchcvs {
-      cvsRoot = ":pserver:anonymous@sweethome3d.cvs.sourceforge.net:/cvsroot/sweethome3d";
-      sha256 = "15wxdns3hc8yq362x0rj53bcxran2iynxznfcb9js85psd94zq7h";
-      module = module;
-      tag = "V_" + d2u version;
+    src = fetchurl {
+      url = "mirror://sourceforge/sweethome3d/${module}-${version}-src.zip";
+      sha256 = "03vb9y645qzffxxdhgbjb0d98k3lafxckg2vh2s86j62b6357d0h";
     };
     desktopName = "Sweet Home 3D - Textures Library Editor";
   };
 
   furniture-editor = mkEditorProject rec {
-    version = "1.19";
+    version = "1.27";
     module = "FurnitureLibraryEditor";
     pname = module;
     description = "Quickly create SH3F files and edit the properties of the 3D models it contain";
     license = lib.licenses.gpl2;
-    src = fetchcvs {
-      cvsRoot = ":pserver:anonymous@sweethome3d.cvs.sourceforge.net:/cvsroot/sweethome3d";
-      sha256 = "0rr4nqil1mngak3ds5vz7f1whrgcgzpk6fb0qcr5ljms0jx0ylvs";
-      module = module;
-      tag = "V_" + d2u version;
+    src = fetchurl {
+      url = "mirror://sourceforge/sweethome3d/${module}-${version}-src.zip";
+      sha256 = "1zxbcn9awgax8lalzkc05f5yfwbgnrayc17fkyv5i19j4qb3r2a0";
     };
     desktopName = "Sweet Home 3D - Furniture Library Editor";
   };
diff --git a/pkgs/applications/networking/cluster/nixops/shell.nix b/pkgs/applications/networking/cluster/nixops/shell.nix
index 3fc06b0bc73..0139cb2c812 100644
--- a/pkgs/applications/networking/cluster/nixops/shell.nix
+++ b/pkgs/applications/networking/cluster/nixops/shell.nix
@@ -1,7 +1,7 @@
-{ pkgs ? import <nixpkgs> {} }:
+{ pkgs ? import <nixpkgs> { } }:
 
 pkgs.mkShell {
-  buildInputs = [
+  packages = [
     pkgs.poetry2nix.cli
     pkgs.pkg-config
     pkgs.libvirt
diff --git a/pkgs/applications/terminal-emulators/terminator/default.nix b/pkgs/applications/terminal-emulators/terminator/default.nix
index 82286289fba..6ddeffe68eb 100644
--- a/pkgs/applications/terminal-emulators/terminator/default.nix
+++ b/pkgs/applications/terminal-emulators/terminator/default.nix
@@ -13,13 +13,13 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "terminator";
-  version = "2.1.0";
+  version = "2.1.1";
 
   src = fetchFromGitHub {
     owner = "gnome-terminator";
     repo = "terminator";
     rev = "v${version}";
-    sha256 = "sha256-Rd5XieB7K2BkSzrAr6Kmoa30xuwvsGKpPrsG2wrU1o8=";
+    sha256 = "1pfrzna30xv9yri6dsny1j5k35417m4hsg97c455vssywyl9w4jr";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/virtualization/open-vm-tools/default.nix b/pkgs/applications/virtualization/open-vm-tools/default.nix
index bc66791ad36..e7479957444 100644
--- a/pkgs/applications/virtualization/open-vm-tools/default.nix
+++ b/pkgs/applications/virtualization/open-vm-tools/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchFromGitHub, makeWrapper, autoreconfHook,
+{ stdenv, lib, fetchFromGitHub, makeWrapper, autoreconfHook, fetchpatch,
   fuse, libmspack, openssl, pam, xercesc, icu, libdnet, procps, libtirpc, rpcsvc-proto,
   libX11, libXext, libXinerama, libXi, libXrender, libXrandr, libXtst,
   pkg-config, glib, gdk-pixbuf-xlib, gtk3, gtkmm3, iproute2, dbus, systemd, which,
@@ -23,6 +23,18 @@ stdenv.mkDerivation rec {
   buildInputs = [ fuse glib icu libdnet libmspack libtirpc openssl pam procps rpcsvc-proto xercesc ]
       ++ lib.optionals withX [ gdk-pixbuf-xlib gtk3 gtkmm3 libX11 libXext libXinerama libXi libXrender libXrandr libXtst ];
 
+  patches = [
+    # Fix building with glib 2.68. Remove after next release.
+    # We drop AUTHORS due to conflicts when applying.
+    # https://github.com/vmware/open-vm-tools/pull/505
+    (fetchpatch {
+      url = "https://github.com/vmware/open-vm-tools/commit/82931a1bcb39d5132910c7fb2ddc086c51d06662.patch";
+      stripLen = 1;
+      excludes = [ "AUTHORS" ];
+      sha256 = "0yz5hnngr5vd4416hvmh8734a9vxa18d2xd37kl7if0p9vik6zlg";
+    })
+  ];
+
   postPatch = ''
      # Build bugfix for 10.1.0, stolen from Arch PKGBUILD
      mkdir -p common-agent/etc/config
diff --git a/pkgs/applications/virtualization/virt-manager/qt.nix b/pkgs/applications/virtualization/virt-manager/qt.nix
index 1633c8d66f3..840ada805d7 100644
--- a/pkgs/applications/virtualization/virt-manager/qt.nix
+++ b/pkgs/applications/virtualization/virt-manager/qt.nix
@@ -6,13 +6,13 @@
 
 mkDerivation rec {
   pname = "virt-manager-qt";
-  version = "0.71.95";
+  version = "0.72.97";
 
   src = fetchFromGitHub {
     owner  = "F1ash";
     repo   = "qt-virt-manager";
     rev    = version;
-    sha256 = "1s8753bzsjyixpv1c2l9d1xjcn8i47k45qj7pr50prc64ldf5f47";
+    sha256 = "0b2bx7ah35glcsiv186sc9cqdrkhg1vs9jz036k9byk61np0cb1i";
   };
 
   cmakeFlags = [
@@ -22,10 +22,9 @@ mkDerivation rec {
 
   patches = [
     (fetchpatch {
-      # Maintainer note: Check whether this patch is still needed when a new version is released
-      name = "krdc-variable-name-changes.patch";
-      url = "https://github.com/fadenb/qt-virt-manager/commit/4640f5f64534ed7c8a1ecc6851f1c7503988de6d.patch";
-      sha256 = "1chl58nra1mj96n8jmnjbsyr6vlwkhn38afhwqsbr0bgyg23781v";
+      # drop with next update
+      url = "https://github.com/F1ash/qt-virt-manager/commit/0d338b037ef58c376d468c1cd4521a34ea181edd.patch";
+      sha256 = "1wjqyc5wsnxfwwjzgqjr9hcqhd867amwhjd712qyvpvz8x7p2s24";
     })
   ];
 
diff --git a/pkgs/build-support/agda/default.nix b/pkgs/build-support/agda/default.nix
index 984d61f1f75..ed7d11a1314 100644
--- a/pkgs/build-support/agda/default.nix
+++ b/pkgs/build-support/agda/default.nix
@@ -1,6 +1,6 @@
 # Builder for Agda packages.
 
-{ stdenv, lib, self, Agda, runCommandNoCC, makeWrapper, writeText, mkShell, ghcWithPackages, nixosTests }:
+{ stdenv, lib, self, Agda, runCommandNoCC, makeWrapper, writeText, ghcWithPackages, nixosTests }:
 
 with lib.strings;
 
diff --git a/pkgs/build-support/mkshell/default.nix b/pkgs/build-support/mkshell/default.nix
index a70dc0390cb..7ca4cc23c1d 100644
--- a/pkgs/build-support/mkshell/default.nix
+++ b/pkgs/build-support/mkshell/default.nix
@@ -3,18 +3,22 @@
 # A special kind of derivation that is only meant to be consumed by the
 # nix-shell.
 {
-  inputsFrom ? [], # a list of derivations whose inputs will be made available to the environment
-  buildInputs ? [],
-  nativeBuildInputs ? [],
-  propagatedBuildInputs ? [],
-  propagatedNativeBuildInputs ? [],
-  ...
+  # a list of packages to add to the shell environment
+  packages ? [ ]
+, # propagate all the inputs from the given derivations
+  inputsFrom ? [ ]
+, buildInputs ? [ ]
+, nativeBuildInputs ? [ ]
+, propagatedBuildInputs ? [ ]
+, propagatedNativeBuildInputs ? [ ]
+, ...
 }@attrs:
 let
   mergeInputs = name: lib.concatLists (lib.catAttrs name
-    ([attrs] ++ inputsFrom));
+    ([ attrs ] ++ inputsFrom));
 
   rest = builtins.removeAttrs attrs [
+    "packages"
     "inputsFrom"
     "buildInputs"
     "nativeBuildInputs"
@@ -26,15 +30,15 @@ in
 
 stdenv.mkDerivation ({
   name = "nix-shell";
-  phases = ["nobuildPhase"];
+  phases = [ "nobuildPhase" ];
 
   buildInputs = mergeInputs "buildInputs";
-  nativeBuildInputs = mergeInputs "nativeBuildInputs";
+  nativeBuildInputs = packages ++ (mergeInputs "nativeBuildInputs");
   propagatedBuildInputs = mergeInputs "propagatedBuildInputs";
   propagatedNativeBuildInputs = mergeInputs "propagatedNativeBuildInputs";
 
   shellHook = lib.concatStringsSep "\n" (lib.catAttrs "shellHook"
-    (lib.reverseList inputsFrom ++ [attrs]));
+    (lib.reverseList inputsFrom ++ [ attrs ]));
 
   nobuildPhase = ''
     echo
diff --git a/pkgs/development/compilers/elm/packages/elm-instrument.nix b/pkgs/development/compilers/elm/packages/elm-instrument.nix
index cf0ba2303e1..18f4d3aff19 100644
--- a/pkgs/development/compilers/elm/packages/elm-instrument.nix
+++ b/pkgs/development/compilers/elm/packages/elm-instrument.nix
@@ -1,4 +1,4 @@
-{ mkDerivation, ansi-terminal, ansi-wl-pprint, base, binary
+{ mkDerivation, fetchpatch, ansi-terminal, ansi-wl-pprint, base, binary
 , bytestring, Cabal, cmark, containers, directory, elm-format
 , fetchgit, filepath, free, HUnit, indents, json, mtl
 , optparse-applicative, parsec, process, QuickCheck, quickcheck-io
@@ -14,6 +14,15 @@ mkDerivation {
     rev = "63e15bb5ec5f812e248e61b6944189fa4a0aee4e";
     fetchSubmodules = true;
   };
+  patches = [
+    # Update code after breaking change in optparse-applicative
+    # https://github.com/zwilias/elm-instrument/pull/5
+    (fetchpatch {
+      name = "update-optparse-applicative.patch";
+      url = "https://github.com/mdevlamynck/elm-instrument/commit/c548709d4818aeef315528e842eaf4c5b34b59b4.patch";
+      sha256 = "0ln7ik09n3r3hk7jmwwm46kz660mvxfa71120rkbbaib2falfhsc";
+    })
+  ];
   isLibrary = true;
   isExecutable = true;
   setupHaskellDepends = [ base Cabal directory filepath process ];
diff --git a/pkgs/development/mobile/androidenv/examples/shell.nix b/pkgs/development/mobile/androidenv/examples/shell.nix
index 95f6a3bdbba..45cccf22c7d 100644
--- a/pkgs/development/mobile/androidenv/examples/shell.nix
+++ b/pkgs/development/mobile/androidenv/examples/shell.nix
@@ -115,7 +115,7 @@ let
 in
 pkgs.mkShell rec {
   name = "androidenv-demo";
-  buildInputs = [ androidSdk platformTools jdk pkgs.android-studio ];
+  packages = [ androidSdk platformTools jdk pkgs.android-studio ];
 
   LANG = "C.UTF-8";
   LC_ALL = "C.UTF-8";
diff --git a/pkgs/development/node-packages/default.nix b/pkgs/development/node-packages/default.nix
index 3654d7b5296..22c06e96afe 100644
--- a/pkgs/development/node-packages/default.nix
+++ b/pkgs/development/node-packages/default.nix
@@ -1,4 +1,4 @@
-{ pkgs, nodejs, stdenv }:
+{ pkgs, nodejs, stdenv, fetchFromGitHub }:
 
 let
   since = (version: pkgs.lib.versionAtLeast nodejs.version version);
@@ -209,6 +209,26 @@ let
       '';
     };
 
+    netlify-cli =
+      let
+        esbuild = pkgs.esbuild.overrideAttrs (old: rec {
+          version = "0.11.14";
+
+          src = fetchFromGitHub {
+            owner = "evanw";
+            repo = "esbuild";
+            rev = "v${version}";
+            sha256 = "sha256-N7WNam0zF1t++nLVhuxXSDGV/JaFtlFhufp+etinvmM=";
+          };
+
+        });
+      in
+      super.netlify-cli.override {
+        preRebuild = ''
+          export ESBUILD_BINARY_PATH="${esbuild}/bin/esbuild"
+        '';
+      };
+
     ssb-server = super.ssb-server.override {
       buildInputs = [ pkgs.automake pkgs.autoconf self.node-gyp-build ];
       meta.broken = since "10";
diff --git a/pkgs/development/python-modules/csvw/default.nix b/pkgs/development/python-modules/csvw/default.nix
index 3df013e7599..27f3f291113 100644
--- a/pkgs/development/python-modules/csvw/default.nix
+++ b/pkgs/development/python-modules/csvw/default.nix
@@ -42,6 +42,12 @@ buildPythonPackage rec {
     pytest-mock
   ];
 
+  disabledTests = [
+    # this test is flaky on darwin because it depends on the resolution of filesystem mtimes
+    # https://github.com/cldf/csvw/blob/45584ad63ff3002a9b3a8073607c1847c5cbac58/tests/test_db.py#L257
+    "test_write_file_exists"
+  ];
+
   meta = with lib; {
     description = "CSV on the Web";
     homepage = "https://github.com/cldf/csvw";
diff --git a/pkgs/development/python-modules/glcontext/default.nix b/pkgs/development/python-modules/glcontext/default.nix
new file mode 100644
index 00000000000..c5a06fb6499
--- /dev/null
+++ b/pkgs/development/python-modules/glcontext/default.nix
@@ -0,0 +1,49 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, isPy3k
+, libGL
+, libX11
+, pytestCheckHook
+, psutil
+}:
+
+buildPythonPackage rec {
+  pname = "glcontext";
+  version = "2.3.3";
+
+  src = fetchFromGitHub {
+    owner = "moderngl";
+    repo = pname;
+    rev = version;
+    sha256 = "16kwrfjijn9bnb48rk17wapmhxq6g9s59zczh65imyncb9k82wkc";
+  };
+
+  disabled = !isPy3k;
+
+  buildInputs = [ libGL libX11 ];
+
+  postPatch = ''
+    substituteInPlace glcontext/x11.cpp \
+      --replace '"libGL.so"' '"${libGL}/lib/libGL.so"' \
+      --replace '"libX11.so"' '"${libX11}/lib/libX11.so"'
+    substituteInPlace glcontext/egl.cpp \
+      --replace '"libGL.so"' '"${libGL}/lib/libGL.so"' \
+      --replace '"libEGL.so"' '"${libGL}/lib/libEGL.so"'
+  '';
+
+  # Tests fail because they try to open display. See
+  # https://github.com/NixOS/nixpkgs/pull/121439
+  # for details.
+  doCheck = false;
+
+  pythonImportsCheck = [ "glcontext" ];
+
+  meta = with lib; {
+    homepage = "https://github.com/moderngl/glcontext";
+    description = "OpenGL implementation for ModernGL";
+    license = licenses.mit;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ friedelino ];
+  };
+}
diff --git a/pkgs/development/python-modules/globus-sdk/default.nix b/pkgs/development/python-modules/globus-sdk/default.nix
index 0c2d74a90e1..d251ec75ff5 100644
--- a/pkgs/development/python-modules/globus-sdk/default.nix
+++ b/pkgs/development/python-modules/globus-sdk/default.nix
@@ -28,6 +28,11 @@ buildPythonPackage rec {
     responses
   ];
 
+  postPatch = ''
+    substituteInPlace setup.py \
+    --replace "pyjwt[crypto]>=1.5.3,<2.0.0" "pyjwt[crypto] >=1.5.3, <3.0.0"
+  '';
+
   pythonImportsCheck = [ "globus_sdk" ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/ipydatawidgets/default.nix b/pkgs/development/python-modules/ipydatawidgets/default.nix
index a0efa9b575d..e6e1e605cca 100644
--- a/pkgs/development/python-modules/ipydatawidgets/default.nix
+++ b/pkgs/development/python-modules/ipydatawidgets/default.nix
@@ -13,13 +13,13 @@
 
 buildPythonPackage rec {
   pname = "ipydatawidgets";
-  version = "4.2.0";
+  version = "4.1.0";
 
   disabled = isPy27;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "d0e4b58b59b508165e8562b8f5d1dbfcd739855847ec0477bd9185a5e9b7c5bc";
+    sha256 = "d9f94828c11e3b40350fb14a02e027f42670a7c372bcb30db18d552dcfab7c01";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/moderngl/default.nix b/pkgs/development/python-modules/moderngl/default.nix
index f32f541573e..447d2b00b01 100644
--- a/pkgs/development/python-modules/moderngl/default.nix
+++ b/pkgs/development/python-modules/moderngl/default.nix
@@ -4,6 +4,7 @@
 , isPy3k
 , libGL
 , libX11
+, glcontext
 }:
 
 buildPythonPackage rec {
@@ -17,7 +18,7 @@ buildPythonPackage rec {
 
   disabled = !isPy3k;
 
-  buildInputs = [ libGL libX11 ];
+  buildInputs = [ libGL libX11 glcontext ];
 
   # Tests need a display to run.
   doCheck = false;
diff --git a/pkgs/development/python-modules/moderngl_window/default.nix b/pkgs/development/python-modules/moderngl_window/default.nix
index 7f6d9893c96..e06d5aa3780 100644
--- a/pkgs/development/python-modules/moderngl_window/default.nix
+++ b/pkgs/development/python-modules/moderngl_window/default.nix
@@ -7,6 +7,7 @@
 , pyglet
 , pillow
 , pyrr
+, glcontext
 }:
 
 buildPythonPackage rec {
@@ -20,7 +21,7 @@ buildPythonPackage rec {
     sha256 = "1p03j91pk2bwycd13p0qi8kns1sf357180hd2mkaip8mfaf33x3q";
   };
 
-  propagatedBuildInputs = [ numpy moderngl pyglet pillow pyrr ];
+  propagatedBuildInputs = [ numpy moderngl pyglet pillow pyrr glcontext ];
 
   disabled = !isPy3k;
 
diff --git a/pkgs/development/python-modules/pytorch-metric-learning/default.nix b/pkgs/development/python-modules/pytorch-metric-learning/default.nix
index 285602bce4a..fd2c80af890 100644
--- a/pkgs/development/python-modules/pytorch-metric-learning/default.nix
+++ b/pkgs/development/python-modules/pytorch-metric-learning/default.nix
@@ -41,10 +41,16 @@ buildPythonPackage rec {
   disabledTests = [
     # requires FAISS (not in Nixpkgs)
     "test_accuracy_calculator_and_faiss"
+    "test_global_embedding_space_tester"
+    "test_with_same_parent_label_tester"
     # require network access:
     "test_get_nearest_neighbors"
     "test_tuplestoweights_sampler"
     "test_untrained_indexer"
+    "test_metric_loss_only"
+    "test_pca"
+    # flaky
+    "test_distributed_classifier_loss_and_miner"
   ];
 
   meta = {
diff --git a/pkgs/development/python-modules/sanic/default.nix b/pkgs/development/python-modules/sanic/default.nix
index 31dcc86e0bc..8c18380c3ba 100644
--- a/pkgs/development/python-modules/sanic/default.nix
+++ b/pkgs/development/python-modules/sanic/default.nix
@@ -37,8 +37,12 @@ buildPythonPackage rec {
   inherit doCheck;
 
   disabledTests = [
-    "test_gunicorn" # No "examples" directory in pypi distribution.
-    "test_zero_downtime" # No "examples.delayed_response.app" module in pypi distribution.
+    # No "examples" directory in pypi distribution
+    "test_gunicorn"
+    "test_zero_downtime"
+    # flaky
+    "test_keep_alive_client_timeout"
+    "test_reloader_live"
   ];
 
   __darwinAllowLocalNetworking = true;
diff --git a/pkgs/development/tools/rq/default.nix b/pkgs/development/tools/rq/default.nix
index 88a7c346a80..7d222e03bc9 100644
--- a/pkgs/development/tools/rq/default.nix
+++ b/pkgs/development/tools/rq/default.nix
@@ -16,6 +16,13 @@ rustPlatform.buildRustPackage rec {
   buildInputs = [ llvmPackages.libclang v8 ]
   ++ lib.optionals stdenv.isDarwin [ libiconv ];
 
+  postPatch = ''
+    # Remove #[deny(warnings)] which is equivalent to -Werror in C.
+    # Prevents build failures when upgrading rustc, which may give more warnings.
+    substituteInPlace src/lib.rs \
+      --replace "#![deny(warnings)]" ""
+  '';
+
   configurePhase = ''
     export LIBCLANG_PATH="${llvmPackages.libclang.lib}/lib"
     export V8_SOURCE="${v8}"
diff --git a/pkgs/os-specific/linux/anbox/kmod.nix b/pkgs/os-specific/linux/anbox/kmod.nix
index 1ed6d9c5f72..9ce65cd8726 100644
--- a/pkgs/os-specific/linux/anbox/kmod.nix
+++ b/pkgs/os-specific/linux/anbox/kmod.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation {
   pname = "anbox-modules";
-  version = "2019-11-15-" + kernel.version;
+  version = "2020-06-14-${kernel.version}";
 
   src = fetchFromGitHub {
     owner = "anbox";
     repo = "anbox-modules";
-    rev = "e0a237e571989987806b32881044c539db25e3e1";
-    sha256 = "1km1nslp4f5znwskh4bb1b61r1inw1dlbwiyyq3rrh0f0agf8d0v";
+    rev = "98f0f3b3b1eeb5a6954ca15ec43e150b76369086";
+    sha256 = "sha256-6xDJQ4YItdbYqle/9VNfOc7D80yFGd9cFyF+CuABaF0=";
   };
 
   nativeBuildInputs = kernel.moduleBuildDependencies;
@@ -34,10 +34,9 @@ stdenv.mkDerivation {
   meta = with lib; {
     description = "Anbox ashmem and binder drivers.";
     homepage = "https://github.com/anbox/anbox-modules";
-    license = licenses.gpl2;
+    license = licenses.gpl2Only;
     platforms = platforms.linux;
-    broken = (versionOlder kernel.version "4.4");
+    broken = kernel.kernelOlder "4.4" || kernel.kernelAtLeast "5.5";
     maintainers = with maintainers; [ edwtjo ];
   };
-
 }
diff --git a/pkgs/os-specific/linux/batman-adv/default.nix b/pkgs/os-specific/linux/batman-adv/default.nix
index 354f4b1bff2..7da14593410 100644
--- a/pkgs/os-specific/linux/batman-adv/default.nix
+++ b/pkgs/os-specific/linux/batman-adv/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, kernel }:
+{ lib, stdenv, fetchurl, fetchpatch, kernel }:
 
 let cfg = import ./version.nix; in
 
@@ -11,6 +11,14 @@ stdenv.mkDerivation rec {
     sha256 = cfg.sha256.${pname};
   };
 
+  patches = [
+    (fetchpatch {
+      # Fix build with Kernel>=5.12, remove for batman-adv>=2021.1
+      url = "https://git.open-mesh.org/batman-adv.git/patch/6d67ca7f530d4620e3d066b02aefbfd8893d6c05?hp=362da918384286a959ad7c3455d9d33d9ff99d7d";
+      sha256 = "039x67yfkwl0b8af8vwx5m58ji2qn8x44rr1rkzi5j43cvmnh2cg";
+    })
+  ];
+
   nativeBuildInputs = kernel.moduleBuildDependencies;
 
   hardeningDisable = [ "pic" ];
diff --git a/pkgs/os-specific/linux/kernel/hardened/patches.json b/pkgs/os-specific/linux/kernel/hardened/patches.json
index d97341fccca..e7325f714cd 100644
--- a/pkgs/os-specific/linux/kernel/hardened/patches.json
+++ b/pkgs/os-specific/linux/kernel/hardened/patches.json
@@ -13,20 +13,20 @@
     },
     "5.10": {
         "extra": "-hardened1",
-        "name": "linux-hardened-5.10.35-hardened1.patch",
-        "sha256": "133k9h187jpkyfqrd66v4k0z3l3gg6r0g4x8nsic9sarapdd62v7",
-        "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.10.35-hardened1/linux-hardened-5.10.35-hardened1.patch"
+        "name": "linux-hardened-5.10.36-hardened1.patch",
+        "sha256": "0pkci99h0lrxyx5p7ml3m4194bl359m2ihm9izw0b33n35alkvbc",
+        "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.10.36-hardened1/linux-hardened-5.10.36-hardened1.patch"
     },
     "5.11": {
         "extra": "-hardened1",
-        "name": "linux-hardened-5.11.19-hardened1.patch",
-        "sha256": "16czmg41nijl7zaahb4ggi8z7hizc0qsqg3az8vzll5kvzzr313f",
-        "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.11.19-hardened1/linux-hardened-5.11.19-hardened1.patch"
+        "name": "linux-hardened-5.11.20-hardened1.patch",
+        "sha256": "06jf2r9xr8kzybia590x21p20mfags8j1flj0g4ci6r0fsfbmymf",
+        "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.11.20-hardened1/linux-hardened-5.11.20-hardened1.patch"
     },
     "5.4": {
         "extra": "-hardened1",
-        "name": "linux-hardened-5.4.117-hardened1.patch",
-        "sha256": "0b9mfw49yrdgsj9804nh0qxzj49z2xb1jvxhvdxpm9yjlnyw85bv",
-        "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.4.117-hardened1/linux-hardened-5.4.117-hardened1.patch"
+        "name": "linux-hardened-5.4.118-hardened1.patch",
+        "sha256": "1zkcdxqysgcidary6nl4c2hrn6r23gi4r8rqhjan22xa3l3lj43b",
+        "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.4.118-hardened1/linux-hardened-5.4.118-hardened1.patch"
     }
 }
diff --git a/pkgs/os-specific/linux/kernel/linux-4.4.nix b/pkgs/os-specific/linux/kernel/linux-4.4.nix
index 7ba90db9aed..36b54e8191d 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.4.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.4.nix
@@ -1,8 +1,9 @@
-{ buildPackages, fetchurl, perl, buildLinux, nixosTests, ... } @ args:
+{ buildPackages, fetchurl, perl, buildLinux, nixosTests, stdenv, ... } @ args:
 
 buildLinux (args // rec {
   version = "4.4.268";
   extraMeta.branch = "4.4";
+  extraMeta.broken = stdenv.isAarch64;
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
diff --git a/pkgs/os-specific/linux/kernel/linux-4.9.nix b/pkgs/os-specific/linux/kernel/linux-4.9.nix
index c6308a178e4..d1cd267dd22 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.9.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.9.nix
@@ -1,8 +1,9 @@
-{ buildPackages, fetchurl, perl, buildLinux, nixosTests, ... } @ args:
+{ buildPackages, fetchurl, perl, buildLinux, nixosTests, stdenv, ... } @ args:
 
 buildLinux (args // rec {
   version = "4.9.268";
   extraMeta.branch = "4.9";
+  extraMeta.broken = stdenv.isAarch64;
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
diff --git a/pkgs/os-specific/linux/kernel/linux-5.10.nix b/pkgs/os-specific/linux/kernel/linux-5.10.nix
index f40e7740c45..70afd9fb09b 100644
--- a/pkgs/os-specific/linux/kernel/linux-5.10.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.10.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "5.10.35";
+  version = "5.10.36";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,7 +13,7 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "1zcqsjzqgcvlhkjwhzs6sxgbhzkfg898pbisivjqfymp8nfs2dxc";
+    sha256 = "0s5jw7y17hnl66iybw6f4pbc5j5rilphqbv3iql22wq053vyg749";
   };
 
   kernelTests = args.kernelTests or [ nixosTests.kernel-generic.linux_5_10 ];
diff --git a/pkgs/os-specific/linux/kernel/linux-5.11.nix b/pkgs/os-specific/linux/kernel/linux-5.11.nix
index 9d704bf3078..fe680a88dea 100644
--- a/pkgs/os-specific/linux/kernel/linux-5.11.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.11.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "5.11.19";
+  version = "5.11.20";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,7 +13,7 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "0jrb8wbxj0dadyadggcn49hlxzxgz8mz8xr0ckgbnnvb8snikvjs";
+    sha256 = "15q7pw1wvl6ndvb6154p6vjr4qa4fa6lpbqpxvwy2kywc2jyxykk";
   };
 
   kernelTests = args.kernelTests or [ nixosTests.kernel-generic.linux_5_11 ];
diff --git a/pkgs/os-specific/linux/kernel/linux-5.12.nix b/pkgs/os-specific/linux/kernel/linux-5.12.nix
index 9450b4ec304..3b63b3d1895 100644
--- a/pkgs/os-specific/linux/kernel/linux-5.12.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.12.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "5.12.2";
+  version = "5.12.3";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,7 +13,7 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "03gp5vq8vkwvksjsa1birds37rmrr73s9ik6m1wvgz8mdncvk64c";
+    sha256 = "13c7jbizf254rh4arvlgzk87vx7sz6psba47jnax23lbgal18dqk";
   };
 
   kernelTests = args.kernelTests or [ nixosTests.kernel-generic.linux_5_12 ];
diff --git a/pkgs/os-specific/linux/kernel/linux-5.4.nix b/pkgs/os-specific/linux/kernel/linux-5.4.nix
index ebb7ffca409..0b648780cb8 100644
--- a/pkgs/os-specific/linux/kernel/linux-5.4.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.4.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "5.4.117";
+  version = "5.4.118";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,7 +13,7 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "0w679qymqh8dlb1mh2vxr382m1pzxdjwlp3bqzjr4043fmbrp62f";
+    sha256 = "06w2vhw6pdy49n3dcnq12bn50glbg9pwaqvs4nlzbljg4yf50w6r";
   };
 
   kernelTests = args.kernelTests or [ nixosTests.kernel-generic.linux_5_4 ];
diff --git a/pkgs/os-specific/linux/kernel/linux-rt-5.10.nix b/pkgs/os-specific/linux/kernel/linux-rt-5.10.nix
index 368d65d75bb..90c0c4e2930 100644
--- a/pkgs/os-specific/linux/kernel/linux-rt-5.10.nix
+++ b/pkgs/os-specific/linux/kernel/linux-rt-5.10.nix
@@ -6,7 +6,7 @@
 , ... } @ args:
 
 let
-  version = "5.10.30-rt38"; # updated by ./update-rt.sh
+  version = "5.10.35-rt39"; # updated by ./update-rt.sh
   branch = lib.versions.majorMinor version;
   kversion = builtins.elemAt (lib.splitString "-" version) 0;
 in buildLinux (args // {
@@ -18,14 +18,14 @@ in buildLinux (args // {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${kversion}.tar.xz";
-    sha256 = "0h06lavcbbj9a4dfzca9sprghiq9z33q8i4gh3n2912wmjsnj0nl";
+    sha256 = "1zcqsjzqgcvlhkjwhzs6sxgbhzkfg898pbisivjqfymp8nfs2dxc";
   };
 
   kernelPatches = let rt-patch = {
     name = "rt";
     patch = fetchurl {
       url = "mirror://kernel/linux/kernel/projects/rt/${branch}/older/patch-${version}.patch.xz";
-      sha256 = "0f8wcs0y1qx3kqsan8g7bh1my2yc77k6d1g3q12nfxvbmlgs766n";
+      sha256 = "03gq9y111k4js4cc87yc9y7hyg1wxwbc1bjyjdvb4nrx2wqka79y";
     };
   }; in [ rt-patch ] ++ lib.remove rt-patch kernelPatches;
 
diff --git a/pkgs/servers/unfs3/default.nix b/pkgs/servers/unfs3/default.nix
index 257bb21b42b..4e1e25f19e8 100644
--- a/pkgs/servers/unfs3/default.nix
+++ b/pkgs/servers/unfs3/default.nix
@@ -29,5 +29,8 @@ stdenv.mkDerivation rec {
     license = lib.licenses.bsd3;
     platforms = lib.platforms.unix;
     maintainers = [ ];
+
+    # https://github.com/unfs3/unfs3/issues/13
+    broken = true;
   };
 }
diff --git a/pkgs/tools/X11/opentabletdriver/shell.nix b/pkgs/tools/X11/opentabletdriver/shell.nix
index 526fa4a4432..4367d22e9df 100644
--- a/pkgs/tools/X11/opentabletdriver/shell.nix
+++ b/pkgs/tools/X11/opentabletdriver/shell.nix
@@ -1,9 +1,9 @@
-{ pkgs ? import ../../../../. {} }:
+{ pkgs ? import ../../../../. { } }:
 
 with pkgs;
 
 mkShell {
-  buildInputs = [
+  packages = [
     common-updater-scripts
     curl
     dotnetCorePackages.sdk_5_0
diff --git a/pkgs/tools/admin/google-cloud-sdk/default.nix b/pkgs/tools/admin/google-cloud-sdk/default.nix
index ac4d2799e49..c945ae5557a 100644
--- a/pkgs/tools/admin/google-cloud-sdk/default.nix
+++ b/pkgs/tools/admin/google-cloud-sdk/default.nix
@@ -21,18 +21,18 @@ let
   sources = name: system: {
     x86_64-darwin = {
       url = "${baseUrl}/${name}-darwin-x86_64.tar.gz";
-      sha256 = "1xb6s78q0fba45595d868vmbxdb41060jbygypfa5hvvcz8d8ayk";
+      sha256 = "1ag8h8gj3cld2qxqdrrqdwrz3d9d5m4c2wkx7b78vjpimv76qx5d";
     };
 
     x86_64-linux = {
       url = "${baseUrl}/${name}-linux-x86_64.tar.gz";
-      sha256 = "19ywvp7nm91rc32r7dzb6yf3ss74m3s01fh2xqnmdg382jjlzdby";
+      sha256 = "1mm9lvbgszr5d6gs1qqn63012mgxq94xxkcc400fgfx3apzpkbpj";
     };
   }.${system};
 
 in stdenv.mkDerivation rec {
   pname = "google-cloud-sdk";
-  version = "339.0.0";
+  version = "340.0.0";
 
   src = fetchurl (sources "${pname}-${version}" stdenv.hostPlatform.system);
 
diff --git a/pkgs/tools/typesetting/pdf2djvu/default.nix b/pkgs/tools/typesetting/pdf2djvu/default.nix
index 370d54adde9..47256f9f7ee 100644
--- a/pkgs/tools/typesetting/pdf2djvu/default.nix
+++ b/pkgs/tools/typesetting/pdf2djvu/default.nix
@@ -1,6 +1,7 @@
 { stdenv
 , lib
 , fetchFromGitHub
+, fetchpatch
 , autoreconfHook
 , gettext
 , libtool
@@ -25,6 +26,15 @@ stdenv.mkDerivation rec {
     sha256 = "1igabfy3fd7qndihmkfk9incc15pjxpxh2cn5pfw5fxfwrpjrarn";
   };
 
+  patches = [
+    # Not included in 0.9.17.1, but will be in the next version.
+    (fetchpatch {
+      name = "no-poppler-splash.patch";
+      url = "https://github.com/jwilk/pdf2djvu/commit/2ec7eee57a47bbfd296badaa03dc20bf71b50201.patch";
+      sha256 = "03kap7k2j29r16qgl781cxpswzg3r2yn513cqycgl0vax2xj3gly";
+    })
+  ];
+
   nativeBuildInputs = [ autoreconfHook pkg-config ];
 
   buildInputs = [
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 248cf5c424e..cd594bb8465 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -2729,6 +2729,8 @@ in {
 
   glasgow = callPackage ../development/python-modules/glasgow { };
 
+  glcontext = callPackage ../development/python-modules/glcontext { };
+
   glob2 = callPackage ../development/python-modules/glob2 { };
 
   globre = callPackage ../development/python-modules/globre { };