diff --git a/nixos/modules/services/continuous-integration/hercules-ci-agent/common.nix b/nixos/modules/services/continuous-integration/hercules-ci-agent/common.nix
index 24884655c66..9f9b86ee61c 100644
--- a/nixos/modules/services/continuous-integration/hercules-ci-agent/common.nix
+++ b/nixos/modules/services/continuous-integration/hercules-ci-agent/common.nix
@@ -7,7 +7,6 @@ Platform-specific code is in the respective default.nix files.
  */
 
 { config, lib, options, pkgs, ... }:
-
 let
   inherit (lib)
     filterAttrs
@@ -22,7 +21,7 @@ let
   cfg =
     config.services.hercules-ci-agent;
 
-  format = pkgs.formats.toml {};
+  format = pkgs.formats.toml { };
 
   settingsModule = { config, ... }: {
     freeformType = format.type;
@@ -36,10 +35,14 @@ let
       };
       concurrentTasks = mkOption {
         description = ''
-          Number of tasks to perform simultaneously, such as evaluations, derivations.
+          Number of tasks to perform simultaneously.
 
-          You must have a total capacity across agents of at least 2 concurrent tasks on <literal>x86_64-linux</literal>
-          to allow for import from derivation.
+          A task is a single derivation build or an evaluation.
+          At minimum, you need 2 concurrent tasks for <literal>x86_64-linux</literal>
+          in your cluster, to allow for import from derivation.
+
+          <literal>concurrentTasks</literal> can be around the CPU core count or lower if memory is
+          the bottleneck.
         '';
         type = types.int;
         default = 4;
@@ -85,38 +88,39 @@ let
     };
   };
 
-  # TODO (2022) remove
+  # TODO (roberth, >=2022) remove
   checkNix =
     if !cfg.checkNix
     then ""
     else if lib.versionAtLeast config.nix.package.version "2.3.10"
     then ""
-    else pkgs.stdenv.mkDerivation {
-      name = "hercules-ci-check-system-nix-src";
-      inherit (config.nix.package) src patches;
-      configurePhase = ":";
-      buildPhase = ''
-        echo "Checking in-memory pathInfoCache expiry"
-        if ! grep 'PathInfoCacheValue' src/libstore/store-api.hh >/dev/null; then
-          cat 1>&2 <<EOF
+    else
+      pkgs.stdenv.mkDerivation {
+        name = "hercules-ci-check-system-nix-src";
+        inherit (config.nix.package) src patches;
+        configurePhase = ":";
+        buildPhase = ''
+          echo "Checking in-memory pathInfoCache expiry"
+          if ! grep 'PathInfoCacheValue' src/libstore/store-api.hh >/dev/null; then
+            cat 1>&2 <<EOF
 
-          You are deploying Hercules CI Agent on a system with an incompatible
-          nix-daemon. Please make sure nix.package is set to a Nix version of at
-          least 2.3.10 or a master version more recent than Mar 12, 2020.
-        EOF
-          exit 1
-        fi
-      '';
-      installPhase = "touch $out";
-    };
+            You are deploying Hercules CI Agent on a system with an incompatible
+            nix-daemon. Please make sure nix.package is set to a Nix version of at
+            least 2.3.10 or a master version more recent than Mar 12, 2020.
+          EOF
+            exit 1
+          fi
+        '';
+        installPhase = "touch $out";
+      };
 
 in
 {
   imports = [
-    (mkRenamedOptionModule ["services" "hercules-ci-agent" "extraOptions"] ["services" "hercules-ci-agent" "settings"])
-    (mkRenamedOptionModule ["services" "hercules-ci-agent" "baseDirectory"] ["services" "hercules-ci-agent" "settings" "baseDirectory"])
-    (mkRenamedOptionModule ["services" "hercules-ci-agent" "concurrentTasks"] ["services" "hercules-ci-agent" "settings" "concurrentTasks"])
-    (mkRemovedOptionModule ["services" "hercules-ci-agent" "patchNix"] "Nix versions packaged in this version of Nixpkgs don't need a patched nix-daemon to work correctly in Hercules CI Agent clusters.")
+    (mkRenamedOptionModule [ "services" "hercules-ci-agent" "extraOptions" ] [ "services" "hercules-ci-agent" "settings" ])
+    (mkRenamedOptionModule [ "services" "hercules-ci-agent" "baseDirectory" ] [ "services" "hercules-ci-agent" "settings" "baseDirectory" ])
+    (mkRenamedOptionModule [ "services" "hercules-ci-agent" "concurrentTasks" ] [ "services" "hercules-ci-agent" "settings" "concurrentTasks" ])
+    (mkRemovedOptionModule [ "services" "hercules-ci-agent" "patchNix" ] "Nix versions packaged in this version of Nixpkgs don't need a patched nix-daemon to work correctly in Hercules CI Agent clusters.")
   ];
 
   options.services.hercules-ci-agent = {
diff --git a/nixos/modules/services/continuous-integration/hercules-ci-agent/default.nix b/nixos/modules/services/continuous-integration/hercules-ci-agent/default.nix
index 79d1ce58054..e8a42e59de0 100644
--- a/nixos/modules/services/continuous-integration/hercules-ci-agent/default.nix
+++ b/nixos/modules/services/continuous-integration/hercules-ci-agent/default.nix
@@ -7,9 +7,7 @@ Code that is shared with nix-darwin goes in common.nix.
  */
 
 { pkgs, config, lib, ... }:
-
 let
-
   inherit (lib) mkIf mkDefault;
 
   cfg = config.services.hercules-ci-agent;
@@ -21,7 +19,7 @@ in
 {
   imports = [
     ./common.nix
-    (lib.mkRenamedOptionModule ["services" "hercules-ci-agent" "user"] ["systemd" "services" "hercules-ci-agent" "serviceConfig" "User"])
+    (lib.mkRenamedOptionModule [ "services" "hercules-ci-agent" "user" ] [ "systemd" "services" "hercules-ci-agent" "serviceConfig" "User" ])
   ];
 
   config = mkIf cfg.enable {
@@ -80,6 +78,8 @@ in
       isSystemUser = true;
     };
 
-    users.groups.hercules-ci-agent = {};
+    users.groups.hercules-ci-agent = { };
   };
+
+  meta.maintainers = [ lib.maintainers.roberth ];
 }
diff --git a/pkgs/applications/editors/retext/default.nix b/pkgs/applications/editors/retext/default.nix
index 6bf0f191ece..19cc7bc2970 100644
--- a/pkgs/applications/editors/retext/default.nix
+++ b/pkgs/applications/editors/retext/default.nix
@@ -6,30 +6,10 @@
 
 let
   version = "7.0.4";
-  python = let
-    packageOverrides = self: super: {
-      markdown = super.markdown.overridePythonAttrs(old: {
-        src = super.fetchPypi {
-          version = "3.0.1";
-          pname = "Markdown";
-          sha256 = "d02e0f9b04c500cde6637c11ad7c72671f359b87b9fe924b2383649d8841db7c";
-        };
-      });
-
-      chardet = super.chardet.overridePythonAttrs(old: {
-        src = super.fetchPypi {
-          version = "2.3.0";
-          pname = "chardet";
-          sha256 = "e53e38b3a4afe6d1132de62b7400a4ac363452dc5dfcf8d88e8e0cce663c68aa";
-        };
-        patches = [];
-      });
-    };
-    in python3.override { inherit packageOverrides; };
-  pythonEnv = python.withPackages (ps: with ps; [
+  pythonEnv = python3.withPackages (ps: with ps; [
     pyqt5 docutils pyenchant Markups markdown pygments chardet
   ]);
-in python.pkgs.buildPythonApplication {
+in python3.pkgs.buildPythonApplication {
   inherit version;
   pname = "retext";
 
diff --git a/pkgs/applications/misc/gpxsee/default.nix b/pkgs/applications/misc/gpxsee/default.nix
index c79c2886fd4..5ea01dfa19f 100644
--- a/pkgs/applications/misc/gpxsee/default.nix
+++ b/pkgs/applications/misc/gpxsee/default.nix
@@ -2,13 +2,13 @@
 
 mkDerivation rec {
   pname = "gpxsee";
-  version = "8.3";
+  version = "8.5";
 
   src = fetchFromGitHub {
     owner = "tumic0";
     repo = "GPXSee";
     rev = version;
-    sha256 = "sha256-D58Q9qZ7x2j//pOQa+oIgVK/9F0du2FUoZprSFEKViU=";
+    sha256 = "sha256-ygBM8HtCF8d4KVOakP4ssFyTgAsPQDfjAMJaEqo+Ml4=";
   };
 
   patches = (substituteAll {
diff --git a/pkgs/applications/misc/xpdf/default.nix b/pkgs/applications/misc/xpdf/default.nix
index cafbcd4b11c..e57fb75c11f 100644
--- a/pkgs/applications/misc/xpdf/default.nix
+++ b/pkgs/applications/misc/xpdf/default.nix
@@ -12,11 +12,11 @@ assert enablePrinting -> cups != null;
 
 stdenv.mkDerivation rec {
   pname = "xpdf";
-  version = "4.02";
+  version = "4.03";
 
   src = fetchzip {
-    url = "https://xpdfreader-dl.s3.amazonaws.com/${pname}-${version}.tar.gz";
-    sha256 = "0dzwq6fnk013wa4l5mjpvm4mms2mh5hbrxv4rhk2ab5ljbzz7b2w";
+    url = "https://dl.xpdfreader.com/xpdf-${version}.tar.gz";
+    sha256 = "09yhvmh1vxjy763nnmawynygp5bh3j4i8ixqja64j11676yl77n6";
   };
 
   # Fix "No known features for CXX compiler", see
@@ -36,8 +36,6 @@ stdenv.mkDerivation rec {
     lib.optional enablePrinting cups ++
     lib.optional enablePDFtoPPM freetype;
 
-  hardeningDisable = [ "format" ];
-
   desktopItem = makeDesktopItem {
     name = "xpdf";
     desktopName = "Xpdf";
@@ -48,11 +46,16 @@ stdenv.mkDerivation rec {
     terminal = "false";
   };
 
-  postInstall = ''
-    install -Dm644 ${desktopItem}/share/applications/xpdf.desktop $out/share/applications/xpdf.desktop
+  postInstall = lib.optionalString (!stdenv.isDarwin) ''
+    install -Dm644 ${desktopItem}/share/applications/xpdf.desktop -t $out/share/applications
     install -Dm644 $src/xpdf-qt/xpdf-icon.svg $out/share/pixmaps/xpdf.svg
   '';
 
+  # wrapQtAppsHook broken on macOS (https://github.com/NixOS/nixpkgs/issues/102044)
+  postFixup = lib.optionalString stdenv.isDarwin ''
+    wrapQtApp $out/bin/xpdf
+  '';
+
   meta = with lib; {
     homepage = "https://www.xpdfreader.com";
     description = "Viewer for Portable Document Format (PDF) files";
@@ -69,7 +72,7 @@ stdenv.mkDerivation rec {
         pdffonts:  lists fonts used in PDF files
         pdfdetach: extracts attached files from PDF files
     '';
-    license = with licenses; [ gpl2 gpl3 ];
+    license = with licenses; [ gpl2Only gpl3Only ];
     platforms = platforms.unix;
     maintainers = with maintainers; [ sikmir ];
     knownVulnerabilities = [
diff --git a/pkgs/applications/misc/xpdf/libxpdf.nix b/pkgs/applications/misc/xpdf/libxpdf.nix
index 342c00aa12e..065ca813155 100644
--- a/pkgs/applications/misc/xpdf/libxpdf.nix
+++ b/pkgs/applications/misc/xpdf/libxpdf.nix
@@ -2,30 +2,34 @@
 }:
 
 stdenv.mkDerivation {
-  name = "libxpdf-3.02pl4";
+  name = "libxpdf-3.02pl5";
 
   src = fetchurl {
-    url = "ftp://ftp.foolabs.com/pub/xpdf/xpdf-3.02.tar.gz";
+    url = "https://dl.xpdfreader.com/old/xpdf-3.02.tar.gz";
     sha256 = "000zq4ddbwyxiki4vdwpmxbnw5n9hsg9hvwra2p33hslyib7sfmk";
   };
 
   patches = [
     (fetchurl {
-      url = "ftp://ftp.foolabs.com/pub/xpdf/xpdf-3.02pl1.patch";
+      url = "https://dl.xpdfreader.com/old/xpdf-3.02pl1.patch";
       sha256 = "1wxv9l0d2kkwi961ihpdwi75whdvk7cgqxkbfym8cjj11fq17xjq";
     })
     (fetchurl {
-      url = "ftp://ftp.foolabs.com/pub/xpdf/xpdf-3.02pl2.patch";
+      url = "https://dl.xpdfreader.com/old/xpdf-3.02pl2.patch";
       sha256 = "1nfrgsh9xj0vryd8h65myzd94bjz117y89gq0hzji9dqn23xihfi";
     })
     (fetchurl {
-      url = "ftp://ftp.foolabs.com/pub/xpdf/xpdf-3.02pl3.patch";
+      url = "https://dl.xpdfreader.com/old/xpdf-3.02pl3.patch";
       sha256 = "0jskkv8x6dqr9zj4azaglas8cziwqqrkbbnzrpm2kzrvsbxyhk2r";
     })
     (fetchurl {
-      url = "ftp://ftp.foolabs.com/pub/xpdf/xpdf-3.02pl4.patch";
+      url = "https://dl.xpdfreader.com/old/xpdf-3.02pl4.patch";
       sha256 = "1c48h7aizx0ngmzlzw0mpja1w8vqyy3pg62hyxp7c60k86al715h";
     })
+    (fetchurl {
+      url = "https://dl.xpdfreader.com/old/xpdf-3.02pl5.patch";
+      sha256 = "1fki66pw56yr6aw38f6amrx7wxwcxbx4704pjqq7pqqr784b7z4j";
+    })
     ./xpdf-3.02-protection.patch
     ./libxpdf.patch
   ];
@@ -48,6 +52,6 @@ stdenv.mkDerivation {
 
   meta = with lib; {
     platforms = platforms.unix;
-    license = licenses.gpl2;
+    license = licenses.gpl2Only;
   };
 }
diff --git a/pkgs/applications/networking/mumble/default.nix b/pkgs/applications/networking/mumble/default.nix
index bde8f7c4fed..2eeb151bebe 100644
--- a/pkgs/applications/networking/mumble/default.nix
+++ b/pkgs/applications/networking/mumble/default.nix
@@ -133,14 +133,14 @@ let
   } source;
 
   source = rec {
-    version = "1.3.3";
+    version = "1.3.4";
 
     # Needs submodules
     src = fetchFromGitHub {
       owner = "mumble-voip";
       repo = "mumble";
       rev = version;
-      sha256 = "1jaq5bl5gdpzd4pskpcd2j93g2w320znn4s8ck8f4jz5f46da1bj";
+      sha256 = "sha256-njovShQpW0JNeeE8VugdmGzDk3fKG8/fcJoBgdyTZug=";
       fetchSubmodules = true;
     };
   };
diff --git a/pkgs/applications/science/logic/z3/default.nix b/pkgs/applications/science/logic/z3/default.nix
index cd58740186f..cfef5960bd9 100644
--- a/pkgs/applications/science/logic/z3/default.nix
+++ b/pkgs/applications/science/logic/z3/default.nix
@@ -1,9 +1,15 @@
-{ lib, stdenv, fetchFromGitHub, python, fixDarwinDylibNames
+{ lib
+, stdenv
+, fetchFromGitHub
+, python
+, fixDarwinDylibNames
 , javaBindings ? false
 , ocamlBindings ? false
 , pythonBindings ? true
 , jdk ? null
-, ocaml ? null, findlib ? null, zarith ? null
+, ocaml ? null
+, findlib ? null
+, zarith ? null
 }:
 
 assert javaBindings -> jdk != null;
@@ -13,19 +19,19 @@ with lib;
 
 stdenv.mkDerivation rec {
   pname = "z3";
-  version = "4.8.9";
+  version = "4.8.10";
 
   src = fetchFromGitHub {
-    owner  = "Z3Prover";
-    repo   = pname;
-    rev    = "z3-${version}";
-    sha256 = "1hnbzq10d23drd7ksm3c1n2611c3kd0q0yxgz8y78zaafwczvwxx";
+    owner = "Z3Prover";
+    repo = pname;
+    rev = "z3-${version}";
+    sha256 = "1w1ym2l0gipvjx322npw7lhclv8rslq58gnj0d9i96masi3gbycf";
   };
 
   nativeBuildInputs = optional stdenv.hostPlatform.isDarwin fixDarwinDylibNames;
   buildInputs = [ python ]
-  ++ optional javaBindings jdk
-  ++ optionals ocamlBindings [ ocaml findlib zarith ]
+    ++ optional javaBindings jdk
+    ++ optionals ocamlBindings [ ocaml findlib zarith ]
   ;
   propagatedBuildInputs = [ python.pkgs.setuptools ];
   enableParallelBuilding = true;
@@ -35,16 +41,17 @@ stdenv.mkDerivation rec {
     mkdir -p $OCAMLFIND_DESTDIR/stublibs
   '';
 
-  configurePhase = concatStringsSep " " (
-    [ "${python.interpreter} scripts/mk_make.py --prefix=$out" ]
-    ++ optional javaBindings   "--java"
-    ++ optional ocamlBindings  "--ml"
-    ++ optional pythonBindings "--python --pypkgdir=$out/${python.sitePackages}"
-  ) + "\n" + "cd build";
+  configurePhase = concatStringsSep " "
+    (
+      [ "${python.interpreter} scripts/mk_make.py --prefix=$out" ]
+        ++ optional javaBindings "--java"
+        ++ optional ocamlBindings "--ml"
+        ++ optional pythonBindings "--python --pypkgdir=$out/${python.sitePackages}"
+    ) + "\n" + "cd build";
 
   postInstall = ''
     mkdir -p $dev $lib
-    mv $out/lib     $lib/lib
+    mv $out/lib $lib/lib
     mv $out/include $dev/include
   '' + optionalString pythonBindings ''
     mkdir -p $python/lib
@@ -53,14 +60,13 @@ stdenv.mkDerivation rec {
   '';
 
   outputs = [ "out" "lib" "dev" "python" ]
-  ++ optional ocamlBindings "ocaml"
-  ;
+    ++ optional ocamlBindings "ocaml";
 
-  meta = {
+  meta = with lib; {
     description = "A high-performance theorem prover and SMT solver";
-    homepage    = "https://github.com/Z3Prover/z3";
-    license     = lib.licenses.mit;
-    platforms   = lib.platforms.unix;
-    maintainers = with lib.maintainers; [ thoughtpolice ttuegel ];
+    homepage = "https://github.com/Z3Prover/z3";
+    license = licenses.mit;
+    platforms = platforms.unix;
+    maintainers = with maintainers; [ thoughtpolice ttuegel ];
   };
 }
diff --git a/pkgs/development/compilers/lobster/default.nix b/pkgs/development/compilers/lobster/default.nix
index b65d640b475..59e853f4c7e 100644
--- a/pkgs/development/compilers/lobster/default.nix
+++ b/pkgs/development/compilers/lobster/default.nix
@@ -19,13 +19,13 @@
 
 stdenv.mkDerivation rec {
   pname = "lobster";
-  version = "unstable-2020-10-04";
+  version = "unstable-2020-12-25";
 
   src = fetchFromGitHub {
     owner = "aardappel";
     repo = pname;
-    rev = "4c5e78f021ce9d06592fb3a66388e5e31fac1adb";
-    sha256 = "1wnbc8kr1dyfs53nlcxah22ghphmazzrlcj9z47cgkdsj1qfy84x";
+    rev = "70e44d475995b03363dedf9c2bcb817b0db8fdcf";
+    sha256 = "0azhminzrkbpvkapass1kccd6123bg7qmcbnzr5774n6bz5365g3";
   };
 
   nativeBuildInputs = [ cmake ];
@@ -48,7 +48,9 @@ stdenv.mkDerivation rec {
 
   passthru = {
     tests.can-run-hello-world = callPackage ./test-can-run-hello-world.nix {};
-    updateScript = unstableGitUpdater { };
+    updateScript = unstableGitUpdater {
+      url = "https://github.com/aardappel/lobster";
+    };
   };
 
   meta = with lib; {
diff --git a/pkgs/development/compilers/qbe/default.nix b/pkgs/development/compilers/qbe/default.nix
index 9ebcb2242dd..b4bc2a35a55 100644
--- a/pkgs/development/compilers/qbe/default.nix
+++ b/pkgs/development/compilers/qbe/default.nix
@@ -5,12 +5,12 @@
 
 stdenv.mkDerivation rec {
   pname = "qbe";
-  version = "unstable-2019-07-11";
+  version = "unstable-2020-10-05";
 
   src = fetchgit {
     url = "git://c9x.me/qbe.git";
-    rev = "7bf08ff50729037c8820b26d085905175b5593c8";
-    sha256 = "0w1yack5ky6x6lbw8vn6swsy8s90n6ny0jpkw0866ja677z7qz34";
+    rev = "496c069405cd79aed968f59dd5a5f92d1f96809f";
+    sha256 = "1vpszl77j9mnw8r0p9l23k8nxbnz31lgii7v3mai130nbpjsjsdf";
   };
 
   makeFlags = [ "PREFIX=$(out)" ];
diff --git a/pkgs/development/python-modules/imbalanced-learn/default.nix b/pkgs/development/python-modules/imbalanced-learn/default.nix
index f5418b89e80..e0c2adb8e8b 100644
--- a/pkgs/development/python-modules/imbalanced-learn/default.nix
+++ b/pkgs/development/python-modules/imbalanced-learn/default.nix
@@ -1,4 +1,5 @@
 { lib, buildPythonPackage, fetchPypi, isPy27
+, fetchpatch
 , pandas
 , pytestCheckHook
 , scikitlearn
@@ -15,6 +16,16 @@ buildPythonPackage rec {
     sha256 = "da59de0d1c0fa66f62054dd9a0a295a182563aa1abbb3bf9224a3678fcfe8fa4";
   };
 
+  patches = [
+    # Fix compatibility with scikit-learn 0.24. This patch will be included in releases of
+    # imbalanced-learn after 0.7.0
+    (fetchpatch {
+      url = "https://github.com/scikit-learn-contrib/imbalanced-learn/commit/dc4051fe0011c68d900be05971b71016d4ad9e90.patch";
+      sha256 = "1rv61k9wv4q37a0v943clr8fflcg9ly530smgndgkjlxkyzw6swh";
+      excludes = ["doc/conf.py" "build_tools/*" "azure-pipelines.yml"];
+    })
+  ];
+
   propagatedBuildInputs = [ scikitlearn ];
   checkInputs = [ pytestCheckHook pandas ];
   preCheck = ''
@@ -32,5 +43,6 @@ buildPythonPackage rec {
     description = "Library offering a number of re-sampling techniques commonly used in datasets showing strong between-class imbalance";
     homepage = "https://github.com/scikit-learn-contrib/imbalanced-learn";
     license = licenses.mit;
+    maintainers = [ maintainers.rmcgibbo ];
   };
 }
diff --git a/pkgs/development/python-modules/powerline/default.nix b/pkgs/development/python-modules/powerline/default.nix
index 5834dd76036..1ad17d0459d 100644
--- a/pkgs/development/python-modules/powerline/default.nix
+++ b/pkgs/development/python-modules/powerline/default.nix
@@ -8,6 +8,7 @@
 , pygit2
 , pyuv
 , i3ipc
+, stdenv
 }:
 
 # TODO: bzr support is missing because nixpkgs switched to `breezy`
@@ -29,8 +30,7 @@ buildPythonPackage rec {
     hglib
     pygit2
     pyuv
-    i3ipc
-  ];
+  ] ++ lib.optionals (!stdenv.isDarwin) [ i3ipc ];
 
   # tests are travis-specific
   doCheck = false;
diff --git a/pkgs/development/python-modules/staticjinja/default.nix b/pkgs/development/python-modules/staticjinja/default.nix
index a49f6a4fdfc..e7f1e442f4d 100644
--- a/pkgs/development/python-modules/staticjinja/default.nix
+++ b/pkgs/development/python-modules/staticjinja/default.nix
@@ -1,33 +1,35 @@
 { lib
 , fetchFromGitHub
 , buildPythonPackage
+, poetry
 , isPy27
 , docopt
 , easywatch
 , jinja2
 , pytestCheckHook
 , pytest-check
-, fetchPypi
 , markdown
-, sphinx
-, sphinx_rtd_theme
 }:
 
 buildPythonPackage rec {
   pname = "staticjinja";
-  version = "1.0.3";
+  version = "1.0.4";
+  format = "pyproject";
 
   disabled = isPy27; # 0.4.0 drops python2 support
 
-  # For some reason, in pypi the tests get disabled when using
-  # PY_IGNORE_IMPORTMISMATCH, so we just fetch from GitHub
+  # No tests in pypi
   src = fetchFromGitHub {
     owner = "staticjinja";
     repo = pname;
     rev = version;
-    sha256 = "12rpv5gv64i5j4w98wm1444xnnmarcn3pg783j3fkkzc58lk5wwj";
+    sha256 = "1saz6f71s693gz9c2k3bq2di2mrkj65mgmfdg86jk0z0zzjk90y1";
   };
 
+  nativeBuildInputs = [
+    poetry
+  ];
+
   propagatedBuildInputs = [
     jinja2
     docopt
@@ -38,15 +40,10 @@ buildPythonPackage rec {
     pytestCheckHook
     pytest-check
     markdown
-    sphinx_rtd_theme
-    sphinx
   ];
 
+  # The tests need to find and call the installed staticjinja executable
   preCheck = ''
-    # Import paths differ by a "build/lib" subdirectory, but the files are
-    # the same, so we ignore import mismatches.
-    export PY_IGNORE_IMPORTMISMATCH=1
-    # The tests need to find and call the installed staticjinja executable
     export PATH="$PATH:$out/bin";
   '';
 
diff --git a/pkgs/development/python-modules/transformers/default.nix b/pkgs/development/python-modules/transformers/default.nix
index 65c2af44493..6c04bacbd7c 100644
--- a/pkgs/development/python-modules/transformers/default.nix
+++ b/pkgs/development/python-modules/transformers/default.nix
@@ -16,13 +16,13 @@
 
 buildPythonPackage rec {
   pname = "transformers";
-  version = "4.2.2";
+  version = "4.3.2";
 
   src = fetchFromGitHub {
     owner = "huggingface";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-sBMCzEgYX6HQbzoEIYnmMdpYecCCsQjTdl2mO1Veu9M=";
+    hash = "sha256-vv4wKf1PcuVR63ZQJd3oixdNvS7VcTmAaKkmL8I4COg=";
   };
 
   propagatedBuildInputs = [
@@ -41,7 +41,7 @@ buildPythonPackage rec {
   doCheck = false;
 
   postPatch = ''
-    sed -ri 's/tokenizers==[^"]+/tokenizers/g' setup.py src/transformers/dependency_versions_table.py
+    sed -ri 's/tokenizers[=>]=[^"]+/tokenizers/g' setup.py src/transformers/dependency_versions_table.py
   '';
 
   pythonImportsCheck = [ "transformers" ];
diff --git a/pkgs/development/tools/electron/default.nix b/pkgs/development/tools/electron/default.nix
index 2e60885111d..e906936d2e7 100644
--- a/pkgs/development/tools/electron/default.nix
+++ b/pkgs/development/tools/electron/default.nix
@@ -76,30 +76,30 @@ rec {
     headers = "18frb1z5qkyff5z1w44mf4iz9aw9j4lq0h9yxgfnp33zf7sl9qb5";
   };
 
-  electron_9 = mkElectron "9.4.1" {
-    x86_64-linux = "36c6c33e2702f591c34a7e6ebd7d0828d554a4ce2eafb319a0cd16ffd4cc4b28";
-    x86_64-darwin = "3e2f87d899be684eab226c572c566e89c05114059c9add1a33d2be63100b18fd";
-    i686-linux = "be5f8d18f11ad7c0655faec4040a8af6239f29f1155210024a01826a30b0dbbe";
-    armv7l-linux = "b710a0e3b80ef265760d49c9210f78a6410007521b0ed73c8b868b05d22a0a60";
-    aarch64-linux = "e2fc73309780fc0e9b5abebcb8256b2bc389672f0bcc261269da5891a3df66dc";
-    headers = "0sabqcjd6gcc6khyhiz3rk30p1y4bxsajy4rs9866bqyafq86j6q";
+  electron_9 = mkElectron "9.4.3" {
+    x86_64-linux = "7744ec8af6512e569d600d7fd8e9105d3ca5ac7b6f54390dd553edbd7816289f";
+    x86_64-darwin = "68c67a32f149618d629eb4a8a8044b98dc6ceedc16d46ff20782fcccad72fc44";
+    i686-linux = "904955ee8365b95439fb4643844ac868b59525ed230a76c8e0395c0aa5719813";
+    armv7l-linux = "5cfb3ae97a75d33d4b102d75944610dd56a566ee98186a030eb5bdbbd3d76323";
+    aarch64-linux = "8afa647e4b5b1e290d5d852c7420e82916ba740e3e5576599076dc139cd1d556";
+    headers = "0712160j1yvl9fmj2vm9lznkwnmji1hjzyicb4vis52lbrwx820l";
   };
 
-  electron_10 = mkElectron "10.3.0" {
-    x86_64-linux = "1a4afb659400c7acca0734df1b981b867e5dfdd15d4d3b73fd276d87b682f089";
-    x86_64-darwin = "9c5cca484b28dc5cca89a7f1c77e65b3a04251f4eee740265c358efae351cb94";
-    i686-linux = "fcb298bca0ab229e92b92c418d3e352885ff4291f735a35c7822b3ca17ae8a86";
-    armv7l-linux = "48accf0fbef1f2d1a81e12c2e66b9280f871029b16947d0bebe036cf1fb71b1c";
-    aarch64-linux = "2c99b4ec87ba657c33efb3a7e907e3f3e315e87347954231cb8bae393c1c96fd";
-    headers = "1k97pfzxqrgw4y76js2chq13avgp9czin9q9mlh1zdf13bih96hj";
+  electron_10 = mkElectron "10.3.2" {
+    x86_64-linux = "e28748c813ddc69c611a47961d68ae2dc3761f547c509d9ce2c56c2c6eadc9a2";
+    x86_64-darwin = "3120ae3eab94d9102003f6fa2dc833a0629295c7ec0e154b35f61116d55a4954";
+    i686-linux = "13f42ad6ea0fa41553b8f50323d0baaa29272220a2e81ca5293ad4439cda1d79";
+    armv7l-linux = "0e571f63697b8985782175af07bdd7069886195d9ccd7fc5c04578b4144ea922";
+    aarch64-linux = "173551fa6cd3ca1fb52fab3bd3e7f0ffd3e4758e78a5174e6d636a45a282ab8f";
+    headers = "00x71b18prc55pv3sykbzpmkxf8yjzf2cdnlqif993jab8fbwmqn";
   };
 
-  electron_11 = mkElectron "11.2.1" {
-    x86_64-linux = "607d9d58c9a3b5c36461acc6bbe473bc604eee42a55c2c617ac46d095cf98abb";
-    x86_64-darwin = "39d95668a3ea04bdc652ff9e2889c7a88f638534420e8e256679cbf4b7658a65";
-    i686-linux = "59f226133d01fb6acf86fe98907964f79dcf2902054e5c4c9c4ff84a3ea88f4a";
-    armv7l-linux = "85051d8eacf04aeec3dd74e46e7888d01bd4e6caf7ec2001122a1f3e11db44ee";
-    aarch64-linux = "8aa9be5d6c139386390bad64f78b95756206a40fe4982fc9f199b67a7d06bec5";
-    headers = "12sy8zzb0z654b85c5l1j8762nhwmkim1pbz1y3qzgbzvpbd5arq";
+  electron_11 = mkElectron "11.2.3" {
+    x86_64-linux = "9249901fd7b85a7f952abe0df2ce83a566df612ef3ee15cce488cb1d751bc94d";
+    x86_64-darwin = "e0b2784b25fd4a5ee4041d508d59bbb8386039c7ea7e9cea3e547c672f052b60";
+    i686-linux = "78b2dd2d7b5e891e695cd31c28ac5fa1e99967ff538b944aa9d1ec224e82a964";
+    armv7l-linux = "06178cd44792c7dceb72286460948cb7f575acba4e46cf72c154f243e93eaf65";
+    aarch64-linux = "e23f2572a6a66779aff5d7cf25149fd343b0eef420fbfa3e8c3742284ce6e613";
+    headers = "1yjc7zl7l5n3l2s2x3lbic2lc527alcd4mnwih7pjl5dhvdgmbm9";
   };
 }
diff --git a/pkgs/development/tools/kustomize/default.nix b/pkgs/development/tools/kustomize/default.nix
index 6164be83b88..f658995fe90 100644
--- a/pkgs/development/tools/kustomize/default.nix
+++ b/pkgs/development/tools/kustomize/default.nix
@@ -2,9 +2,9 @@
 
 buildGoModule rec {
   pname = "kustomize";
-  version = "3.9.3";
+  version = "3.10.0";
   # rev is the 3.9.3 commit, mainly for kustomize version command output
-  rev = "1ae8303bdc9372bc7c15942df6e9cf5d67fdba1a";
+  rev = "602ad8aa98e2e17f6c9119e027a09757e63c8bec";
 
   buildFlagsArray = let t = "sigs.k8s.io/kustomize/api/provenance"; in
     ''
@@ -17,13 +17,13 @@ buildGoModule rec {
     owner = "kubernetes-sigs";
     repo = pname;
     rev = "kustomize/v${version}";
-    sha256 = "147g8mhgcb8sjx10sz7r9yh84gqxwk6dald848jim2v2rax47v0p";
+    sha256 = "1qr0mi83df8d9qd2svyr1h26pg97qi67nnygrkydnp8an28k48hi";
   };
 
   # avoid finding test and development commands
   sourceRoot = "source/kustomize";
 
-  vendorSha256 = "0ps4is8x2akvvvvin9sqdyjg4ms3b5b5y15923rs65fd7x33rxgp";
+  vendorSha256 = "0p2j8mm7jpladpm6v3451g38n5bax0g368dk5h5r5gmkr6srxdy4";
 
   meta = with lib; {
     description = "Customization of kubernetes YAML configurations";
@@ -34,6 +34,6 @@ buildGoModule rec {
     '';
     homepage = "https://github.com/kubernetes-sigs/kustomize";
     license = licenses.asl20;
-    maintainers = with maintainers; [ carlosdagos vdemeester periklis zaninime Chili-Man ];
+    maintainers = with maintainers; [ carlosdagos vdemeester periklis zaninime Chili-Man saschagrunert ];
   };
 }
diff --git a/pkgs/games/widelands/default.nix b/pkgs/games/widelands/default.nix
index ba7ce241b86..8b96dcc04e2 100644
--- a/pkgs/games/widelands/default.nix
+++ b/pkgs/games/widelands/default.nix
@@ -5,7 +5,7 @@
 
 stdenv.mkDerivation rec {
   pname = "widelands";
-  version = "20";
+  version = "21";
 
   meta = with lib; {
     description = "RTS with multiple-goods economy";
@@ -26,8 +26,8 @@ stdenv.mkDerivation rec {
   ];
 
   src = fetchurl {
-    url = "https://launchpad.net/widelands/build${version}/build${version}/+download/widelands-build${version}.tar.bz2";
-    sha256 = "1cmwfwk7j6yi2pwmm4rm57s23sdzasqf53nx6567sdagqyc4sn9q";
+    url = "https://launchpad.net/widelands/build${version}/build${version}/+download/widelands-build${version}-source.tar.gz";
+    sha256 = "sha256-YB4OTG+Rs/sOzizRuD7PsCNEobkZT7tw7z9w4GmU41c=";
   };
 
   preConfigure = ''
@@ -45,12 +45,8 @@ stdenv.mkDerivation rec {
     SDL2 SDL2_image SDL2_mixer SDL2_net SDL2_ttf
   ];
 
-  prePatch = ''
-    substituteInPlace ./debian/org.widelands.widelands.desktop --replace "/usr/share/games/widelands/data/" "$out/share/widelands/"
-  '';
-
   postInstall = ''
     mkdir -p "$out/share/applications/"
-    cp -v "../debian/org.widelands.widelands.desktop" "$out/share/applications/"
+    cp -v "../xdg/org.widelands.Widelands.desktop" "$out/share/applications/"
   '';
 }
diff --git a/pkgs/servers/sql/mysql/5.7.x.nix b/pkgs/servers/sql/mysql/5.7.x.nix
index 98166d0b38a..54790093215 100644
--- a/pkgs/servers/sql/mysql/5.7.x.nix
+++ b/pkgs/servers/sql/mysql/5.7.x.nix
@@ -23,8 +23,9 @@ self = stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake bison pkg-config rpcsvc-proto ];
 
-  buildInputs = [ boost libedit libevent lz4 ncurses openssl protobuf readline zlib libtirpc ]
-     ++ lib.optionals stdenv.isDarwin [ perl cctools CoreServices developer_cmds ];
+  buildInputs = [ boost libedit libevent lz4 ncurses openssl protobuf readline zlib ]
+     ++ lib.optionals stdenv.isDarwin [ perl cctools CoreServices developer_cmds ]
+     ++ lib.optionals stdenv.isLinux [ libtirpc ];
 
   outputs = [ "out" "static" ];
 
diff --git a/pkgs/tools/misc/ttwatch/default.nix b/pkgs/tools/misc/ttwatch/default.nix
index 5e541345410..ecfc40bdf6f 100644
--- a/pkgs/tools/misc/ttwatch/default.nix
+++ b/pkgs/tools/misc/ttwatch/default.nix
@@ -5,13 +5,13 @@
 
 stdenv.mkDerivation {
   pname = "ttwatch";
-  version = "2020-02-05";
+  version = "2020-06-24";
 
   src = fetchFromGitHub {
     owner = "ryanbinns";
     repo = "ttwatch";
-    rev = "bfdf1372515574e1fb3871dc1039f8d8a5dbdada";
-    sha256 = "07nd4dbkchxy8js1h1f6pzn63pls2afww97wyiiw6zid43mpqyg4";
+    rev = "260aff5869fd577d788d86b546399353d9ff72c1";
+    sha256 = "0yd2hs9d03gfvwm1vywpg2qga6x5c74zrj665wf9aa8gmn96hv8r";
   };
 
   nativeBuildInputs = [ cmake perl pkg-config ];
diff --git a/pkgs/tools/package-management/smlpkg/default.nix b/pkgs/tools/package-management/smlpkg/default.nix
new file mode 100644
index 00000000000..f3f7750f1bd
--- /dev/null
+++ b/pkgs/tools/package-management/smlpkg/default.nix
@@ -0,0 +1,42 @@
+{ lib, stdenv, fetchFromGitHub, mlton, unzip }:
+
+stdenv.mkDerivation rec {
+  pname = "smlpkg";
+  version = "0.1.5";
+
+  src = fetchFromGitHub {
+    owner = "diku-dk";
+    repo = "smlpkg";
+    rev = "v${version}";
+    sha256 = "1xmbdnfc34ia0a78dhkfv5jyadxndinhw8c47l1mjd4l7n8vqnph";
+  };
+
+  enableParallelBuilding = true;
+
+  nativeBuildInputs = [ mlton ];
+
+  # Set as an environment variable in all the phase scripts.
+  MLCOMP = "mlton";
+
+  buildFlags = ["all"];
+  installFlags = ["prefix=$(out)"];
+
+  doCheck = true;
+
+  checkInputs = [ unzip ];
+
+  # We cannot run the pkgtests, as Nix does not allow network
+  # connections.
+  checkPhase = ''
+    runHook preCheck
+    make -C src test
+    runHook postCheck
+  '';
+
+  meta = with lib; {
+    description = "Generic package manager for Standard ML libraries and programs";
+    homepage = "https://github.com/diku-dk/smlpkg";
+    license = licenses.mit;
+    maintainers = with maintainers; [ athas ];
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index e7369b37281..ddaccb4e757 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -4993,9 +4993,7 @@ in
     hdf4 = null;
   };
 
-  haproxy = callPackage ../tools/networking/haproxy {
-    stdenv = if stdenv.cc.isClang then llvmPackages_6.stdenv else stdenv;
-  };
+  haproxy = callPackage ../tools/networking/haproxy { };
 
   hackertyper = callPackage ../tools/misc/hackertyper { };
 
@@ -10884,6 +10882,8 @@ in
   smlnjBootstrap = callPackage ../development/compilers/smlnj/bootstrap.nix { };
   smlnj = callPackage ../development/compilers/smlnj { };
 
+  smlpkg = callPackage ../tools/package-management/smlpkg { };
+
   solc = callPackage ../development/compilers/solc { };
 
   souffle = callPackage ../development/compilers/souffle {
@@ -27265,9 +27265,7 @@ in
 
   wesnoth-dev = wesnoth;
 
-  widelands = callPackage ../games/widelands {
-    lua = lua5_2;
-  };
+  widelands = callPackage ../games/widelands { };
 
   worldofgoo = callPackage ../games/worldofgoo { };
 
diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 94497d7571f..171187c0ded 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -8480,10 +8480,10 @@ let
 
   FutureAsyncAwait = buildPerlModule rec {
     pname = "Future-AsyncAwait";
-    version = "0.47";
+    version = "0.48";
     src = fetchurl {
       url = "mirror://cpan/authors/id/P/PE/PEVANS/Future-AsyncAwait-${version}.tar.gz";
-      sha256 = "1ja85hzzl36sjikcyavjqy4m41f2yyrsr1ipypzi5mlw7clhmdi3";
+      sha256 = "077jnf5a07x0p30iqcw3kh53xh3dplhb0jyyyq9b4c79ira3ds6r";
     };
     buildInputs = [ TestRefcount ];
     propagatedBuildInputs = [ Future XSParseSublike ];
diff --git a/pkgs/top-level/php-packages.nix b/pkgs/top-level/php-packages.nix
index f2d39811a7a..3df697d3d56 100644
--- a/pkgs/top-level/php-packages.nix
+++ b/pkgs/top-level/php-packages.nix
@@ -510,6 +510,8 @@ lib.makeScope pkgs.newScope (self: with self; {
           ++ lib.optional (lib.versionOlder php.version "7.4") [ "--with-libxml-dir=${libxml2.dev}" ]; }
       { name = "xmlrpc";
         buildInputs = [ libxml2 libiconv ];
+        # xmlrpc was unbundled in 8.0 https://php.watch/versions/8.0/xmlrpc
+        enable = lib.versionOlder php.version "8.0";
         configureFlags = [ "--with-xmlrpc" ]
           # Required to build on darwin.
           ++ lib.optional (lib.versionOlder php.version "7.4") [ "--with-libxml-dir=${libxml2.dev}" ]; }
@@ -520,7 +522,7 @@ lib.makeScope pkgs.newScope (self: with self; {
           ++ lib.optional (lib.versionOlder php.version "7.4") [ "--with-libxml-dir=${libxml2.dev}" ]; }
       { name = "xsl";
         buildInputs = [ libxslt libxml2 ];
-        doCheck = !(lib.versionOlder php.version "7.4");
+        doCheck = lib.versionOlder php.version "8.0";
         configureFlags = [ "--with-xsl=${libxslt.dev}" ]; }
       { name = "zend_test"; }
       { name = "zip";