diff --git a/nixos/tests/wmderland.nix b/nixos/tests/wmderland.nix
index d121ed98b7a..6de0cd9212e 100644
--- a/nixos/tests/wmderland.nix
+++ b/nixos/tests/wmderland.nix
@@ -1,6 +1,6 @@
 import ./make-test-python.nix ({ pkgs, ...} : {
   name = "wmderland";
-  meta = with pkgs.stdenv.lib.maintainers; {
+  meta = with pkgs.lib.maintainers; {
     maintainers = [ takagiy ];
   };
 
diff --git a/pkgs/applications/networking/mailreaders/himalaya/default.nix b/pkgs/applications/networking/mailreaders/himalaya/default.nix
index 7a453bdb64b..03a81283a65 100644
--- a/pkgs/applications/networking/mailreaders/himalaya/default.nix
+++ b/pkgs/applications/networking/mailreaders/himalaya/default.nix
@@ -11,16 +11,20 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "himalaya";
-  version = "0.3.0";
+  version = "0.3.1";
 
   src = fetchFromGitHub {
     owner = "soywod";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-s2QZSusJLeo4WIorSj+e1yYqWXFqTt8YF6/Tyz9fHeY=";
+    sha256 = "sha256:0m95gjdzh94vsbs7cdxlczk29m536acwlg4y55j7rz9cdcjfvzkj";
   };
 
-  cargoSha256 = "sha256-u9dLqr5CnrgYiDWAiW9u1zcUWmprOiq5+TfafO8M+WU=";
+  cargoSha256 = "sha256:0bz91vs5i3qb8rd9yfajavb4lyp24cxmxalzkg2chii4ckr8d3ph";
+
+  # use --lib flag to avoid test with imap server
+  # https://github.com/soywod/himalaya/issues/145
+  cargoTestFlags = [ "--lib" ];
 
   nativeBuildInputs = [ ]
     ++ lib.optionals (enableCompletions) [ installShellFiles ]
diff --git a/pkgs/applications/networking/mailreaders/mutt/default.nix b/pkgs/applications/networking/mailreaders/mutt/default.nix
index 27c06c95d99..b5f938b264e 100644
--- a/pkgs/applications/networking/mailreaders/mutt/default.nix
+++ b/pkgs/applications/networking/mailreaders/mutt/default.nix
@@ -27,11 +27,11 @@ with lib;
 
 stdenv.mkDerivation rec {
   pname = "mutt";
-  version = "2.0.6";
+  version = "2.0.7";
 
   src = fetchurl {
     url = "http://ftp.mutt.org/pub/mutt/${pname}-${version}.tar.gz";
-    sha256 = "165mpivdhvhavglykwlz0hss2akxd6i6l40rgxs29mjzi52irqw1";
+    sha256 = "sha256-lXaIxqUhVhmS1PLyfPn+sjnHxsAELGBhwOR0p90mzJE=";
   };
 
   patches = optional smimeSupport (fetchpatch {
diff --git a/pkgs/applications/science/math/gmsh/default.nix b/pkgs/applications/science/math/gmsh/default.nix
index b85f8ba47a4..84f7ca72a3c 100644
--- a/pkgs/applications/science/math/gmsh/default.nix
+++ b/pkgs/applications/science/math/gmsh/default.nix
@@ -5,11 +5,11 @@ assert (!blas.isILP64) && (!lapack.isILP64);
 
 stdenv.mkDerivation rec {
   pname = "gmsh";
-  version = "4.8.3";
+  version = "4.8.4";
 
   src = fetchurl {
     url = "http://gmsh.info/src/gmsh-${version}-source.tgz";
-    sha256 = "sha256-JvJIsSmgDR6gZY8CRBDCSQvNneckVFoRRKCSxgQnZ3U=";
+    sha256 = "sha256-dg29wHLqo8gtBmxbo7BurN0zBOsqlzc/5K2pUJ8Las4=";
   };
 
   buildInputs = [ blas lapack gmm fltk libjpeg zlib libGLU libGL
diff --git a/pkgs/applications/video/recapp/default.nix b/pkgs/applications/video/recapp/default.nix
new file mode 100644
index 00000000000..7ec88af821e
--- /dev/null
+++ b/pkgs/applications/video/recapp/default.nix
@@ -0,0 +1,81 @@
+{ lib
+, python3
+, fetchFromGitHub
+, appstream-glib
+, desktop-file-utils
+, gettext
+, glib
+, gobject-introspection
+, gtk3
+, gst_all_1
+, libnotify
+, librsvg
+, meson
+, ninja
+, pkg-config
+, slop
+, wrapGAppsHook
+}:
+
+python3.pkgs.buildPythonApplication rec {
+  pname = "recapp";
+  version = "1.1.1";
+
+  format = "other";
+
+  src = fetchFromGitHub {
+    owner = "amikha1lov";
+    repo = "RecApp";
+    rev = "v${version}";
+    sha256 = "08bpfcqgw0lj6j7y5b2i18kffawlzp6pfk4wdpmk29vwmgk9s9yc";
+  };
+
+  postPatch = ''
+    patchShebangs build-aux/meson
+  '';
+
+  nativeBuildInputs = [
+    appstream-glib
+    desktop-file-utils
+    gettext
+    glib
+    gtk3
+    meson
+    ninja
+    pkg-config
+    wrapGAppsHook
+  ];
+
+  buildInputs = [
+    libnotify
+    librsvg
+    gobject-introspection
+    gtk3
+    gst_all_1.gst-plugins-base
+    gst_all_1.gst-plugins-good
+    gst_all_1.gst-plugins-bad
+    gst_all_1.gst-plugins-ugly
+  ];
+
+  propagatedBuildInputs = with python3.pkgs; [
+    pulsectl
+    pydbus
+    pygobject3
+  ];
+
+  dontWrapGApps = true;
+
+  preFixup = ''
+    makeWrapperArgs+=(
+      "''${gappsWrapperArgs[@]}"
+      "--prefix" "PATH" ":" "${lib.makeBinPath [ gst_all_1.gstreamer.dev slop ]}"
+    )
+  '';
+
+  meta = with lib; {
+    description = "User friendly Open Source screencaster for Linux written in GTK";
+    homepage = "https://github.com/amikha1lov/RecApp";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ dotlambda ];
+  };
+}
diff --git a/pkgs/development/libraries/aws-c-cal/default.nix b/pkgs/development/libraries/aws-c-cal/default.nix
index 057aad447d5..3246c572962 100644
--- a/pkgs/development/libraries/aws-c-cal/default.nix
+++ b/pkgs/development/libraries/aws-c-cal/default.nix
@@ -13,7 +13,9 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake ];
 
-  buildInputs = [ aws-c-common openssl ] ++ lib.optionals stdenv.isDarwin [ Security ];
+  buildInputs = [ aws-c-common openssl ];
+
+  propagatedBuildInputs = lib.optionals stdenv.hostPlatform.isDarwin [ Security ];
 
   cmakeFlags = [
     "-DBUILD_SHARED_LIBS=ON"
diff --git a/pkgs/development/libraries/aws-c-io/default.nix b/pkgs/development/libraries/aws-c-io/default.nix
index 337149e6f8e..39230cc088d 100644
--- a/pkgs/development/libraries/aws-c-io/default.nix
+++ b/pkgs/development/libraries/aws-c-io/default.nix
@@ -13,15 +13,14 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake ];
 
-  buildInputs = [ aws-c-cal aws-c-common s2n-tls] ++ lib.optionals stdenv.isDarwin [ Security ];
+  buildInputs = [ aws-c-cal aws-c-common s2n-tls];
+  propagatedBuildInputs = lib.optionals stdenv.hostPlatform.isDarwin [ Security ];
 
   cmakeFlags = [
     "-DBUILD_SHARED_LIBS=ON"
     "-DCMAKE_MODULE_PATH=${aws-c-common}/lib/cmake"
   ];
 
-  NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isDarwin "-Wno-error";
-
   meta = with lib; {
     description = "AWS SDK for C module for IO and TLS";
     homepage = "https://github.com/awslabs/aws-c-io";
diff --git a/pkgs/development/libraries/aws-sdk-cpp/default.nix b/pkgs/development/libraries/aws-sdk-cpp/default.nix
index 7fd7b2fbbdd..dd215dc01c5 100644
--- a/pkgs/development/libraries/aws-sdk-cpp/default.nix
+++ b/pkgs/development/libraries/aws-sdk-cpp/default.nix
@@ -26,12 +26,15 @@ stdenv.mkDerivation rec {
 
   buildInputs = [
     curl openssl s2n-tls zlib
-    aws-c-cal aws-c-common aws-c-event-stream aws-c-io aws-checksums
+    aws-c-common aws-c-event-stream aws-checksums
   ] ++ lib.optionals (stdenv.isDarwin &&
                         ((builtins.elem "text-to-speech" apis) ||
                          (builtins.elem "*" apis)))
          [ CoreAudio AudioToolbox ];
 
+  # propagation is needed for Security.framework to be available when linking
+  propagatedBuildInputs = [ aws-c-cal aws-c-io ];
+
   cmakeFlags = [
     "-DBUILD_DEPS=OFF"
     "-DCMAKE_SKIP_BUILD_RPATH=OFF"
diff --git a/pkgs/development/tools/cloud-nuke/default.nix b/pkgs/development/tools/cloud-nuke/default.nix
index 6254ec0a2c2..b947fc1ebfe 100644
--- a/pkgs/development/tools/cloud-nuke/default.nix
+++ b/pkgs/development/tools/cloud-nuke/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "cloud-nuke";
-  version = "0.1.29";
+  version = "0.1.30";
 
   src = fetchFromGitHub {
     owner = "gruntwork-io";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-RPlEFajIjEBKdL97xjQP6r3AAcCQlxw2Il8nkSjxa+k=";
+    sha256 = "sha256-uQj14arxDPc8/k1Cvp3T6hqjln30NFk9MzvYy8tAiJ8=";
   };
 
   vendorSha256 = "sha256-pl3dLisu4Oc77kgfuteKbsZaDzrHo1wUigZEkM4081Q=";
diff --git a/pkgs/development/tools/rust/maturin/pyo3-test/generic.nix b/pkgs/development/tools/rust/maturin/pyo3-test/generic.nix
index 41175ad8538..a5713d944a8 100644
--- a/pkgs/development/tools/rust/maturin/pyo3-test/generic.nix
+++ b/pkgs/development/tools/rust/maturin/pyo3-test/generic.nix
@@ -27,7 +27,7 @@ python.pkgs.buildPythonPackage rec {
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src patches;
     name = "${pname}-${version}";
-    hash = "sha256-//TmozgWy9zrSpMKX92XdHj4fw/T1Elfgn4YhhR7ot0=";
+    hash = "sha256-u3L9nXHKILznyZTgxdvZyOCQZFZhuADrtI7zXYQzrbE=";
   };
 
   patches = [ ./Cargo.lock.patch ];
diff --git a/pkgs/tools/misc/dua/default.nix b/pkgs/tools/misc/dua/default.nix
index f0bb6905b43..5bff1f66d56 100644
--- a/pkgs/tools/misc/dua/default.nix
+++ b/pkgs/tools/misc/dua/default.nix
@@ -1,14 +1,16 @@
-{ lib, rustPlatform, fetchFromGitHub }:
+{ lib, stdenv, rustPlatform, fetchFromGitHub, libiconv }:
 
 rustPlatform.buildRustPackage rec {
   pname = "dua";
-  version = "2.11.1";
+  version = "2.11.2";
+
+  buildInputs = lib.optionals stdenv.isDarwin [ libiconv ];
 
   src = fetchFromGitHub {
     owner = "Byron";
     repo = "dua-cli";
     rev = "v${version}";
-    sha256 = "sha256-pjFApZQJqw0fJmJteO7VZWRLogV3rO5XDagZd1MliZg=";
+    sha256 = "sha256-sT4hg5MC6xuhSKeNxaVY9vOlMEx23uwxgK6UMLO4kVs=";
     # Remove unicode file names which leads to different checksums on HFS+
     # vs. other filesystems because of unicode normalisation.
     extraPostFetch = ''
@@ -16,7 +18,7 @@ rustPlatform.buildRustPackage rec {
     '';
   };
 
-  cargoSha256 = "sha256-xsTScRAu0SF1xtjUwBtNJUNIItoR0jjEd2CuSmmeh9c=";
+  cargoSha256 = "sha256-DOotIN8XScgHR9L6aFgky2B18piGIKfLWx1GTdYnCB0=";
 
   doCheck = false;
 
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 72527400ea8..b38c86e3ae3 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -25812,6 +25812,8 @@ in
 
   reaper = callPackage ../applications/audio/reaper { };
 
+  recapp = callPackage ../applications/video/recapp { };
+
   recode = callPackage ../tools/text/recode { };
 
   reddsaver = callPackage ../applications/misc/reddsaver {