diff --git a/nixos/doc/manual/development/running-nixos-tests-interactively.section.md b/nixos/doc/manual/development/running-nixos-tests-interactively.section.md
index 3ba4e16e77f4..f87298201791 100644
--- a/nixos/doc/manual/development/running-nixos-tests-interactively.section.md
+++ b/nixos/doc/manual/development/running-nixos-tests-interactively.section.md
@@ -5,7 +5,7 @@ when developing or debugging a test:
 
 ```ShellSession
 $ nix-build nixos/tests/login.nix -A driverInteractive
-$ ./result/bin/nixos-test-driver
+$ ./result/bin/nixos-test-driver --interactive
 starting VDE switch for network 1
 >
 ```
@@ -24,20 +24,11 @@ back into the test driver command line upon its completion. This allows
 you to inspect the state of the VMs after the test (e.g. to debug the
 test script).
 
-To just start and experiment with the VMs, run:
-
-```ShellSession
-$ nix-build nixos/tests/login.nix -A driverInteractive
-$ ./result/bin/nixos-run-vms
-```
-
-The script `nixos-run-vms` starts the virtual machines defined by test.
-
 You can re-use the VM states coming from a previous run by setting the
 `--keep-vm-state` flag.
 
 ```ShellSession
-$ ./result/bin/nixos-run-vms --keep-vm-state
+$ ./result/bin/nixos-test-driver --interactive --keep-vm-state
 ```
 
 The machine state is stored in the `$TMPDIR/vm-state-machinename`
diff --git a/nixos/doc/manual/from_md/development/running-nixos-tests-interactively.section.xml b/nixos/doc/manual/from_md/development/running-nixos-tests-interactively.section.xml
index a2030e9c0739..17003cbcbfdc 100644
--- a/nixos/doc/manual/from_md/development/running-nixos-tests-interactively.section.xml
+++ b/nixos/doc/manual/from_md/development/running-nixos-tests-interactively.section.xml
@@ -6,7 +6,7 @@
   </para>
   <programlisting>
 $ nix-build nixos/tests/login.nix -A driverInteractive
-$ ./result/bin/nixos-test-driver
+$ ./result/bin/nixos-test-driver --interactive
 starting VDE switch for network 1
 &gt;
 </programlisting>
@@ -25,23 +25,12 @@ starting VDE switch for network 1
     completion. This allows you to inspect the state of the VMs after
     the test (e.g. to debug the test script).
   </para>
-  <para>
-    To just start and experiment with the VMs, run:
-  </para>
-  <programlisting>
-$ nix-build nixos/tests/login.nix -A driverInteractive
-$ ./result/bin/nixos-run-vms
-</programlisting>
-  <para>
-    The script <literal>nixos-run-vms</literal> starts the virtual
-    machines defined by test.
-  </para>
   <para>
     You can re-use the VM states coming from a previous run by setting
     the <literal>--keep-vm-state</literal> flag.
   </para>
   <programlisting>
-$ ./result/bin/nixos-run-vms --keep-vm-state
+$ ./result/bin/nixos-test-driver --interactive --keep-vm-state
 </programlisting>
   <para>
     The machine state is stored in the
diff --git a/nixos/lib/test-driver/test-driver.py b/nixos/lib/test-driver/test-driver.py
old mode 100644
new mode 100755
index 2a3e4d94b948..1720e553d733
--- a/nixos/lib/test-driver/test-driver.py
+++ b/nixos/lib/test-driver/test-driver.py
@@ -24,7 +24,6 @@ import sys
 import telnetlib
 import tempfile
 import time
-import traceback
 import unicodedata
 
 CHAR_TO_KEY = {
@@ -930,29 +929,16 @@ def join_all() -> None:
             machine.wait_for_shutdown()
 
 
-def test_script() -> None:
-    exec(os.environ["testScript"])
-
-
-def run_tests() -> None:
+def run_tests(interactive: bool = False) -> None:
     global machines
-    tests = os.environ.get("tests", None)
-    if tests is not None:
-        with log.nested("running the VM test script"):
-            try:
-                exec(tests, globals())
-            except Exception as e:
-                eprint("error: ")
-                traceback.print_exc()
-                sys.exit(1)
+    if interactive:
+        ptpython.repl.embed(globals(), locals())
     else:
-        ptpython.repl.embed(locals(), globals())
-
-    # TODO: Collect coverage data
-
-    for machine in machines:
-        if machine.is_up():
-            machine.execute("sync")
+        test_script()
+        # TODO: Collect coverage data
+        for machine in machines:
+            if machine.is_up():
+                machine.execute("sync")
 
 
 def serial_stdout_on() -> None:
@@ -965,6 +951,31 @@ def serial_stdout_off() -> None:
     log._print_serial_logs = False
 
 
+class EnvDefault(argparse.Action):
+    """An argpars Action that takes values from the specified
+    environment variable as the flags default value.
+    """
+
+    def __init__(self, envvar, required=False, default=None, nargs=None, **kwargs):  # type: ignore
+        if not default and envvar:
+            if envvar in os.environ:
+                if nargs is not None and (nargs.isdigit() or nargs in ["*", "+"]):
+                    default = os.environ[envvar].split()
+                else:
+                    default = os.environ[envvar]
+                kwargs["help"] = (
+                    kwargs["help"] + f" (default from environment: {default})"
+                )
+        if required and default:
+            required = False
+        super(EnvDefault, self).__init__(
+            default=default, required=required, nargs=nargs, **kwargs
+        )
+
+    def __call__(self, parser, namespace, values, option_string=None):  # type: ignore
+        setattr(namespace, self.dest, values)
+
+
 @contextmanager
 def subtest(name: str) -> Iterator[None]:
     with log.nested(name):
@@ -986,18 +997,52 @@ if __name__ == "__main__":
         help="re-use a VM state coming from a previous run",
         action="store_true",
     )
-    (cli_args, vm_scripts) = arg_parser.parse_known_args()
+    arg_parser.add_argument(
+        "-I",
+        "--interactive",
+        help="drop into a python repl and run the tests interactively",
+        action="store_true",
+    )
+    arg_parser.add_argument(
+        "--start-scripts",
+        metavar="START-SCRIPT",
+        action=EnvDefault,
+        envvar="startScripts",
+        nargs="*",
+        help="start scripts for participating virtual machines",
+    )
+    arg_parser.add_argument(
+        "--vlans",
+        metavar="VLAN",
+        action=EnvDefault,
+        envvar="vlans",
+        nargs="*",
+        help="vlans to span by the driver",
+    )
+    arg_parser.add_argument(
+        "testscript",
+        action=EnvDefault,
+        envvar="testScript",
+        help="the test script to run",
+        type=pathlib.Path,
+    )
+
+    args = arg_parser.parse_args()
+    global test_script
+
+    def test_script() -> None:
+        with log.nested("running the VM test script"):
+            exec(pathlib.Path(args.testscript).read_text(), globals())
 
     log = Logger()
 
-    vlan_nrs = list(dict.fromkeys(os.environ.get("VLANS", "").split()))
-    vde_sockets = [create_vlan(v) for v in vlan_nrs]
+    vde_sockets = [create_vlan(v) for v in args.vlans]
     for nr, vde_socket, _, _ in vde_sockets:
         os.environ["QEMU_VDE_SOCKET_{}".format(nr)] = vde_socket
 
     machines = [
-        create_machine({"startCommand": s, "keepVmState": cli_args.keep_vm_state})
-        for s in vm_scripts
+        create_machine({"startCommand": s, "keepVmState": args.keep_vm_state})
+        for s in args.start_scripts
     ]
     machine_eval = [
         "{0} = machines[{1}]".format(m.name, idx) for idx, m in enumerate(machines)
@@ -1017,6 +1062,6 @@ if __name__ == "__main__":
         log.close()
 
     tic = time.time()
-    run_tests()
+    run_tests(args.interactive)
     toc = time.time()
     print("test script finished in {:.2f}s".format(toc - tic))
diff --git a/nixos/lib/testing-python.nix b/nixos/lib/testing-python.nix
index c703484666d5..6369d6ef05d4 100644
--- a/nixos/lib/testing-python.nix
+++ b/nixos/lib/testing-python.nix
@@ -83,7 +83,10 @@ rec {
         ''
           mkdir -p $out
 
-          LOGFILE=/dev/null tests='exec(os.environ["testScript"])' ${driver}/bin/nixos-test-driver
+          # effectively mute the XMLLogger
+          export LOGFILE=/dev/null
+
+          ${driver}/bin/nixos-test-driver
         '';
 
       passthru = driver.passthru // {
@@ -166,7 +169,10 @@ rec {
       ''
         mkdir -p $out/bin
 
+        vmStartScripts=($(for i in ${toString vms}; do echo $i/bin/run-*-vm; done))
         echo -n "$testScript" > $out/test-script
+        ln -s ${testDriver}/bin/nixos-test-driver $out/bin/nixos-test-driver
+
         ${lib.optionalString (!skipLint) ''
           PYFLAKES_BUILTINS="$(
             echo -n ${lib.escapeShellArg (lib.concatStringsSep "," nodeHostNames)},
@@ -174,17 +180,12 @@ rec {
           )" ${python3Packages.pyflakes}/bin/pyflakes $out/test-script
         ''}
 
-        ln -s ${testDriver}/bin/nixos-test-driver $out/bin/
-        vms=($(for i in ${toString vms}; do echo $i/bin/run-*-vm; done))
+        # set defaults through environment
+        # see: ./test-driver/test-driver.py argparse implementation
         wrapProgram $out/bin/nixos-test-driver \
-          --add-flags "''${vms[*]}" \
-          --run "export testScript=\"\$(${coreutils}/bin/cat $out/test-script)\"" \
-          --set VLANS '${toString vlans}'
-        ln -s ${testDriver}/bin/nixos-test-driver $out/bin/nixos-run-vms
-        wrapProgram $out/bin/nixos-run-vms \
-          --add-flags "''${vms[*]}" \
-          --set tests 'start_all(); join_all();' \
-          --set VLANS '${toString vlans}'
+          --set startScripts "''${vmStartScripts[*]}" \
+          --set testScript "$out/test-script" \
+          --set vlans '${toString vlans}'
       '');
 
   # Make a full-blown test
diff --git a/nixos/modules/services/web-apps/miniflux.nix b/nixos/modules/services/web-apps/miniflux.nix
index 01710b1bd59c..1bbadafa2078 100644
--- a/nixos/modules/services/web-apps/miniflux.nix
+++ b/nixos/modules/services/web-apps/miniflux.nix
@@ -98,6 +98,29 @@ in
         EnvironmentFile = if cfg.adminCredentialsFile == null
         then defaultCredentials
         else cfg.adminCredentialsFile;
+        # Hardening
+        CapabilityBoundingSet = [ "" ];
+        DeviceAllow = [ "" ];
+        LockPersonality = true;
+        MemoryDenyWriteExecute = true;
+        PrivateDevices = true;
+        PrivateUsers = true;
+        ProcSubset = "pid";
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectProc = "invisible";
+        RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        SystemCallArchitectures = "native";
+        SystemCallFilter = [ "@system-service" "~@privileged" "~@resources" ];
+        UMask = "0077";
       };
 
       environment = cfg.config;
diff --git a/pkgs/applications/audio/cozy-audiobooks/default.nix b/pkgs/applications/audio/cozy-audiobooks/default.nix
index 5eb71cbe04f3..88ac8002140e 100644
--- a/pkgs/applications/audio/cozy-audiobooks/default.nix
+++ b/pkgs/applications/audio/cozy-audiobooks/default.nix
@@ -8,11 +8,13 @@
 , gtk3
 , gst_all_1
 , gobject-introspection
+, libhandy
 , python3Packages
 , file
 , cairo
 , gettext
 , gnome
+, pantheon
 }:
 
 python3Packages.buildPythonApplication rec {
@@ -20,7 +22,7 @@ python3Packages.buildPythonApplication rec {
   format = "other"; # no setup.py
 
   pname = "cozy";
-  version = "0.7.2";
+  version = "1.0.3";
 
   # Temporary fix
   # See https://github.com/NixOS/nixpkgs/issues/57029
@@ -31,7 +33,7 @@ python3Packages.buildPythonApplication rec {
     owner = "geigi";
     repo = pname;
     rev = version;
-    sha256 = "0fmbddi4ga0bppwg3rm3yjmf7jgqc6zfslmavnr1pglbzkjhy9fs";
+    sha256 = "0m0xiqpb87pwr3fhy0a4qxg67yjhwchcxj3x2anyy0li4inryxag";
   };
 
   nativeBuildInputs = [
@@ -47,6 +49,8 @@ python3Packages.buildPythonApplication rec {
     cairo
     gettext
     gnome.adwaita-icon-theme
+    libhandy
+    pantheon.granite
   ] ++ (with gst_all_1; [
     gstreamer
     gst-plugins-good
@@ -70,8 +74,7 @@ python3Packages.buildPythonApplication rec {
   ];
 
   postPatch = ''
-    chmod +x meson/post_install.py
-    patchShebangs meson/post_install.py
+    patchShebangs meson/*.py
   '';
 
   postInstall = ''
diff --git a/pkgs/applications/misc/audio/wavrsocvt/default.nix b/pkgs/applications/misc/audio/wavrsocvt/default.nix
index 3b32f0d7f30b..6b09a2e38d8c 100644
--- a/pkgs/applications/misc/audio/wavrsocvt/default.nix
+++ b/pkgs/applications/misc/audio/wavrsocvt/default.nix
@@ -8,8 +8,6 @@ stdenv.mkDerivation {
     sha256 = "15qlvdfwbiclljj7075ycm78yzqahzrgl4ky8pymix5179acm05h";
   };
 
-  phases = [ "unpackPhase" "installPhase" ];
-
   unpackPhase = ''
     tar -zxf $src
     '';
diff --git a/pkgs/applications/misc/avrdudess/default.nix b/pkgs/applications/misc/avrdudess/default.nix
index 14b372d91e59..61cab2b6a2a4 100644
--- a/pkgs/applications/misc/avrdudess/default.nix
+++ b/pkgs/applications/misc/avrdudess/default.nix
@@ -10,7 +10,8 @@ stdenv.mkDerivation {
 
   nativeBuildInputs = [ unzip ];
 
-  phases = [ "buildPhase" ];
+  dontUnpack = true;
+  dontInstall = true;
 
   buildPhase = ''
     mkdir -p "$out/avrdudess"
diff --git a/pkgs/applications/misc/azuredatastudio/default.nix b/pkgs/applications/misc/azuredatastudio/default.nix
index 56894a29a662..fca1ad12fd1c 100644
--- a/pkgs/applications/misc/azuredatastudio/default.nix
+++ b/pkgs/applications/misc/azuredatastudio/default.nix
@@ -38,7 +38,7 @@ stdenv.mkDerivation rec {
     at-spi2-atk
   ];
 
-  phases = "unpackPhase fixupPhase";
+  dontInstall = true;
 
   # change this to azuredatastudio-insiders for insiders releases
   edition = "azuredatastudio";
diff --git a/pkgs/applications/misc/emem/default.nix b/pkgs/applications/misc/emem/default.nix
index ab718cdffcf2..f82ce53d9746 100644
--- a/pkgs/applications/misc/emem/default.nix
+++ b/pkgs/applications/misc/emem/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     sha256 = "18x3s3jrph8k3pc75jgwkfqazygpsx93zjxx68zms58my17cybh1";
   };
 
-  phases = [ "buildPhase" "installPhase" ];
+  dontUnpack = true;
 
   buildPhase = ''
     mkdir -p $out/bin $out/share/java
diff --git a/pkgs/applications/misc/ganttproject-bin/default.nix b/pkgs/applications/misc/ganttproject-bin/default.nix
index 2b4504a1dce2..76a19f5188c8 100644
--- a/pkgs/applications/misc/ganttproject-bin/default.nix
+++ b/pkgs/applications/misc/ganttproject-bin/default.nix
@@ -15,8 +15,6 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ makeWrapper ];
   buildInputs = [ jre ];
 
-  phases = [ "unpackPhase" "installPhase" "fixupPhase" ];
-
   installPhase = let
 
     desktopItem = makeDesktopItem {
diff --git a/pkgs/applications/misc/gollum/default.nix b/pkgs/applications/misc/gollum/default.nix
index 59bb05f85ced..cc9f9df0c608 100644
--- a/pkgs/applications/misc/gollum/default.nix
+++ b/pkgs/applications/misc/gollum/default.nix
@@ -8,7 +8,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ makeWrapper ];
 
-  phases = [ "installPhase" ];
+  dontUnpack = true;
 
   installPhase = let
     env = bundlerEnv {
diff --git a/pkgs/applications/misc/hello-unfree/default.nix b/pkgs/applications/misc/hello-unfree/default.nix
index 7c54c3201111..5c9a507fc071 100644
--- a/pkgs/applications/misc/hello-unfree/default.nix
+++ b/pkgs/applications/misc/hello-unfree/default.nix
@@ -4,7 +4,7 @@ stdenv.mkDerivation {
   pname = "example-unfree-package";
   version = "1.0";
 
-  phases = [ "installPhase" "fixupPhase" ];
+  dontUnpack = true;
 
   installPhase = ''
     mkdir -p $out/bin
diff --git a/pkgs/applications/misc/rtv/default.nix b/pkgs/applications/misc/rtv/default.nix
deleted file mode 100644
index be539a37a301..000000000000
--- a/pkgs/applications/misc/rtv/default.nix
+++ /dev/null
@@ -1,46 +0,0 @@
-{ lib, fetchFromGitHub, python3Packages }:
-
-with python3Packages;
-buildPythonApplication rec {
-  version = "1.27.0";
-  pname = "rtv";
-
-  src = fetchFromGitHub {
-    owner = "michael-lazar";
-    repo = "rtv";
-    rev = "v${version}";
-    sha256 = "1hw7xy2kjxq7y3wcibcz4l7zj8icvigialqr17l362xry0y17y5j";
-  };
-
-  # Tests try to access network
-  doCheck = false;
-
-  checkPhase = ''
-    py.test
-  '';
-
-  checkInputs = [
-    coverage
-    coveralls
-    docopt
-    mock
-    pylint
-    pytest
-    vcrpy
-  ];
-
-  propagatedBuildInputs = [
-    beautifulsoup4
-    decorator
-    kitchen
-    requests
-    six
-  ];
-
-  meta = with lib; {
-    homepage = "https://github.com/michael-lazar/rtv";
-    description = "Browse Reddit from your Terminal";
-    license = licenses.mit;
-    maintainers = with maintainers; [ matthiasbeyer wedens ];
-  };
-}
diff --git a/pkgs/applications/misc/smos/default.nix b/pkgs/applications/misc/smos/default.nix
index 7d994a749bd4..aa2f53b5a2c7 100644
--- a/pkgs/applications/misc/smos/default.nix
+++ b/pkgs/applications/misc/smos/default.nix
@@ -4,7 +4,7 @@
 }:
 
 stdenv.mkDerivation rec {
-  name = "smos-${version}";
+  pname = "smos";
   version = "0.1.0";
 
   src = fetchurl {
@@ -12,7 +12,8 @@ stdenv.mkDerivation rec {
     sha256 = "sha256:07yavk7xl92yjwwjdig90yq421n8ldv4fjfw7izd4hfpzw849a12";
   };
 
-  phases = [ "unpackPhase" ];
+  dontInstall = true;
+
   unpackCmd = "${unzip}/bin/unzip -d $out $curSrc";
   sourceRoot = ".";
 
diff --git a/pkgs/applications/networking/cloudflared/default.nix b/pkgs/applications/networking/cloudflared/default.nix
index 9026738133b0..61e2063f2cb2 100644
--- a/pkgs/applications/networking/cloudflared/default.nix
+++ b/pkgs/applications/networking/cloudflared/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "cloudflared";
-  version = "2021.7.4";
+  version = "2021.8.1";
 
   src = fetchFromGitHub {
     owner  = "cloudflare";
     repo   = "cloudflared";
     rev    = version;
-    sha256 = "sha256-3HK7QLUhU6MUayRYec4LP2BfbwEsvtjtCf++o1cQsQw=";
+    sha256 = "sha256-92Uq7hSqfsiES6dSCw4cotfLJ8TLRRO6QPkwQ8iv124=";
   };
 
   vendorSha256 = null;
diff --git a/pkgs/applications/office/pympress/default.nix b/pkgs/applications/office/pympress/default.nix
index ebc93edba6ef..2a97de6ca5b8 100644
--- a/pkgs/applications/office/pympress/default.nix
+++ b/pkgs/applications/office/pympress/default.nix
@@ -1,21 +1,34 @@
 { lib
+, stdenv
+, fetchpatch
 , python3Packages
 , wrapGAppsHook
 , gtk3
 , gobject-introspection
 , libcanberra-gtk3
 , poppler_gi
+, withGstreamer ? stdenv.isLinux
+, withVLC ? stdenv.isLinux
  }:
 
 python3Packages.buildPythonApplication rec {
   pname = "pympress";
-  version = "1.5.1";
+  version = "1.6.3";
 
   src = python3Packages.fetchPypi {
     inherit pname version;
-    sha256 = "173d9scf2z29qg279jf33zcl7sgc3wp662fgpm943bn9667q18wf";
+    sha256 = "sha256-f+OjE0x/3yfJYHCLB+on7TT7MJ2vNu87SHRi67qFDCM=";
   };
 
+  patches = [
+    # Should not be needed once v1.6.4 is released
+    (fetchpatch {
+      name = "fix-setuptools-version-parsing.patch";
+      url = "https://github.com/Cimbali/pympress/commit/474514d71396ac065e210fd846e07ed1139602d0.diff";
+      sha256 = "sha256-eiw54sjMrXrNrhtkAXxiSTatzoA0NDA03L+HpTDax58=";
+    })
+  ];
+
   nativeBuildInputs = [
     wrapGAppsHook
   ];
@@ -23,16 +36,15 @@ python3Packages.buildPythonApplication rec {
   buildInputs = [
     gtk3
     gobject-introspection
-    libcanberra-gtk3
     poppler_gi
-  ];
+  ] ++ lib.optional withGstreamer libcanberra-gtk3;
 
   propagatedBuildInputs = with python3Packages; [
     pycairo
     pygobject3
-    python-vlc
+    setuptools
     watchdog
-  ];
+  ] ++ lib.optional withVLC python-vlc;
 
   doCheck = false; # there are no tests
 
diff --git a/pkgs/applications/science/chemistry/avogadro2/default.nix b/pkgs/applications/science/chemistry/avogadro2/default.nix
new file mode 100644
index 000000000000..437123faafd8
--- /dev/null
+++ b/pkgs/applications/science/chemistry/avogadro2/default.nix
@@ -0,0 +1,37 @@
+{ lib, stdenv, fetchFromGitHub, cmake, eigen, avogadrolibs, molequeue, hdf5
+, openbabel, qttools, wrapQtAppsHook
+}:
+
+stdenv.mkDerivation rec {
+  pname = "avogadro2";
+  version = "1.94.0";
+
+  src = fetchFromGitHub {
+    owner = "OpenChemistry";
+    repo = "avogadroapp";
+    rev = version;
+    sha256 = "6RaiX23YUMfTYAuSighcLGGlJtqeydNgi3PWGF77Jp8=";
+  };
+
+  nativeBuildInputs = [ cmake wrapQtAppsHook ];
+
+  buildInputs = [
+    avogadrolibs
+    molequeue
+    eigen
+    hdf5
+    qttools
+  ];
+
+  propagatedBuildInputs = [ openbabel ];
+
+  qtWrapperArgs = [ "--prefix PATH : ${openbabel}/bin" ];
+
+  meta = with lib; {
+    description = "Molecule editor and visualizer";
+    maintainers = with maintainers; [ sheepforce ];
+    homepage = "https://github.com/OpenChemistry/avogadroapp";
+    platforms = platforms.mesaPlatforms;
+    license = licenses.bsd3;
+  };
+}
diff --git a/pkgs/applications/science/electronics/vhd2vl/default.nix b/pkgs/applications/science/electronics/vhd2vl/default.nix
index adce30551071..f0dd990a35bc 100644
--- a/pkgs/applications/science/electronics/vhd2vl/default.nix
+++ b/pkgs/applications/science/electronics/vhd2vl/default.nix
@@ -4,6 +4,7 @@
 , bison
 , flex
 , verilog
+, which
 }:
 
 stdenv.mkDerivation rec {
@@ -29,6 +30,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [
     bison
     flex
+    which
   ];
 
   buildInputs = [
@@ -36,8 +38,9 @@ stdenv.mkDerivation rec {
   ];
 
   installPhase = ''
-    mkdir -p $out/bin
-    cp src/vhd2vl $out/bin/
+    runHook preInstall
+    install -D -m755 src/vhd2vl $out/bin/vdh2vl
+    runHook postInstall
   '';
 
   meta = with lib; {
diff --git a/pkgs/applications/science/math/polymake/default.nix b/pkgs/applications/science/math/polymake/default.nix
index b1abb31c7650..9566801479a3 100644
--- a/pkgs/applications/science/math/polymake/default.nix
+++ b/pkgs/applications/science/math/polymake/default.nix
@@ -1,27 +1,32 @@
 { lib, stdenv, fetchurl
-, ninja, libxml2, libxslt, readline, perl, gmp, mpfr, boost
+, perl, gmp, mpfr, flint, boost
 , bliss, ppl, singular, cddlib, lrs, nauty
-, ant, openjdk
+, ninja, ant, openjdk
 , perlPackages
 , makeWrapper
 }:
 
+# polymake compiles its own version of sympol and atint because we
+# don't have those packages. other missing optional dependencies:
+# javaview, libnormaliz, scip, soplex, jreality.
+
 stdenv.mkDerivation rec {
   pname = "polymake";
-  version = "3.2.rc4";
+  version = "4.4";
 
   src = fetchurl {
-    url = "https://polymake.org/lib/exe/fetch.php/download/polymake-3.2r4.tar.bz2";
-    sha256 = "02jpkvy1cc6kc23vkn7nkndzr40fq1gkb3v257bwyi1h5d37fyqy";
+    # "The minimal version is a packager friendly version which omits
+    # the bundled sources of cdd, lrs, libnormaliz, nauty and jReality."
+    url = "https://polymake.org/lib/exe/fetch.php/download/polymake-${version}-minimal.tar.bz2";
+    sha256 = "sha256-2nF5F2xznI77pl2TslrxA8HLpw4fmzVnPOM8N3kOwJE=";
   };
 
   buildInputs = [
-    libxml2 libxslt readline perl gmp mpfr boost
+    perl gmp mpfr flint boost
     bliss ppl singular cddlib lrs nauty
     openjdk
-  ] ++
-  (with perlPackages; [
-    XMLLibXML XMLLibXSLT XMLWriter TermReadLineGnu TermReadKey
+  ] ++ (with perlPackages; [
+    JSON TermReadLineGnu TermReadKey XMLSAX
   ]);
 
   nativeBuildInputs = [
@@ -36,11 +41,11 @@ stdenv.mkDerivation rec {
     done
   '';
 
-  meta = {
+  meta = with lib; {
     description = "Software for research in polyhedral geometry";
-    license = lib.licenses.gpl2 ;
-    maintainers = [lib.maintainers.raskin];
-    platforms = lib.platforms.linux;
+    license = licenses.gpl2Plus;
+    maintainers = teams.sage.members;
+    platforms = platforms.linux;
     homepage = "https://www.polymake.org/doku.php";
   };
 }
diff --git a/pkgs/data/fonts/vista-fonts-cht/default.nix b/pkgs/data/fonts/vista-fonts-cht/default.nix
new file mode 100644
index 000000000000..264d5a41bf48
--- /dev/null
+++ b/pkgs/data/fonts/vista-fonts-cht/default.nix
@@ -0,0 +1,41 @@
+{ lib, stdenvNoCC, fetchurl, cabextract }:
+
+stdenvNoCC.mkDerivation {
+  pname = "vista-fonts-cht";
+  version = "1";
+
+  src = fetchurl {
+    url = https://download.microsoft.com/download/7/6/b/76bd7a77-be02-47f3-8472-fa1de7eda62f/VistaFont_CHT.EXE;
+    sha256 = "sha256-fSnbbxlMPzbhFSQyKxQaS5paiWji8njK7tS8Eppsj6g=";
+  };
+
+  nativeBuildInputs = [ cabextract ];
+
+  unpackPhase = ''
+    cabextract --lowercase --filter '*.TTF' $src
+  '';
+
+  installPhase = ''
+    mkdir -p $out/share/fonts/truetype
+    cp *.ttf $out/share/fonts/truetype
+
+    # Set up no-op font configs to override any aliases set up by
+    # other packages.
+    mkdir -p $out/etc/fonts/conf.d
+    substitute ${./no-op.conf} $out/etc/fonts/conf.d/30-msjhenghei.conf \
+      --subst-var-by fontname "Microsoft JhengHei"
+  '';
+
+
+  meta = with lib; {
+    description = "TrueType fonts from Microsoft Windows Vista For Traditional Chinese (Microsoft JhengHei)";
+    homepage = "https://www.microsoft.com/typography/fonts/family.aspx";
+    license = licenses.unfree;
+    maintainers = with maintainers; [ atkinschang ];
+
+    # Set a non-zero priority to allow easy overriding of the
+    # fontconfig configuration files.
+    priority = 5;
+    platforms = platforms.all;
+  };
+}
diff --git a/pkgs/data/fonts/vista-fonts-cht/no-op.conf b/pkgs/data/fonts/vista-fonts-cht/no-op.conf
new file mode 100644
index 000000000000..3f8a9b9b5444
--- /dev/null
+++ b/pkgs/data/fonts/vista-fonts-cht/no-op.conf
@@ -0,0 +1,9 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE fontconfig SYSTEM "urn:fontconfig:fonts.dtd">
+<fontconfig>
+  <!-- This configuation is intentionally left empty in order to
+       override any other font package that may wish to set up an
+       alias for the Microsoft @fontname@ font. If you actually do
+       want to have the alias then please change the priority of that
+       package; see the Nix manual page for nix-env for details. -->
+</fontconfig>
diff --git a/pkgs/desktops/pantheon/granite/default.nix b/pkgs/desktops/pantheon/granite/default.nix
index 2397dd8ffcf5..7f3a6dc0983e 100644
--- a/pkgs/desktops/pantheon/granite/default.nix
+++ b/pkgs/desktops/pantheon/granite/default.nix
@@ -46,16 +46,13 @@ stdenv.mkDerivation rec {
     wrapGAppsHook
   ];
 
-  buildInputs = [
+  propagatedBuildInputs = [
     glib
+    gsettings-desktop-schemas # is_clock_format_12h uses "org.gnome.desktop.interface clock-format"
     gtk3
     libgee
   ];
 
-  propagatedBuildInputs = [
-    gsettings-desktop-schemas # is_clock_format_12h uses "org.gnome.desktop.interface clock-format"
-  ];
-
   postPatch = ''
     chmod +x meson/post_install.py
     patchShebangs meson/post_install.py
diff --git a/pkgs/development/interpreters/clojure/default.nix b/pkgs/development/interpreters/clojure/default.nix
index 77ec74e8c3f5..3fca18f65a6e 100644
--- a/pkgs/development/interpreters/clojure/default.nix
+++ b/pkgs/development/interpreters/clojure/default.nix
@@ -29,6 +29,7 @@ stdenv.mkDerivation rec {
       echo "Installing libs into $clojure_lib_dir"
       install -Dm644 deps.edn "$clojure_lib_dir/deps.edn"
       install -Dm644 example-deps.edn "$clojure_lib_dir/example-deps.edn"
+      install -Dm644 tools.edn "$clojure_lib_dir/tools.edn"
       install -Dm644 exec.jar "$clojure_lib_dir/libexec/exec.jar"
       install -Dm644 clojure-tools-${version}.jar "$clojure_lib_dir/libexec/clojure-tools-${version}.jar"
 
@@ -48,7 +49,7 @@ stdenv.mkDerivation rec {
 
   doInstallCheck = true;
   installCheckPhase = ''
-    CLJ_CONFIG=$out CLJ_CACHE=$out/libexec $out/bin/clojure \
+    CLJ_CONFIG=$TMPDIR CLJ_CACHE=$TMPDIR/.clj_cache $out/bin/clojure \
       -Spath \
       -Sverbose \
       -Scp $out/libexec/clojure-tools-${version}.jar
diff --git a/pkgs/development/libraries/pugixml/default.nix b/pkgs/development/libraries/pugixml/default.nix
index 14ef8130431a..57335fa3d970 100644
--- a/pkgs/development/libraries/pugixml/default.nix
+++ b/pkgs/development/libraries/pugixml/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "pugixml";
-  version = "1.11.1";
+  version = "1.11.4";
 
   src = fetchFromGitHub {
     owner = "zeux";
     repo = "pugixml";
     rev = "v${version}";
-    sha256 = "0iwn627wynrqrwb2ddm38p6y6cpgcavgbkrrxwxa0d26m9v2avpr";
+    sha256 = "sha256-pXadPs2Dlht3BMNYDVxWZqnVv0umDgYVcqH5YVxr+uA=";
   };
 
   outputs = if shared then [ "out" "dev" ] else [ "out" ];
diff --git a/pkgs/development/libraries/science/chemistry/avogadrolibs/default.nix b/pkgs/development/libraries/science/chemistry/avogadrolibs/default.nix
new file mode 100644
index 000000000000..1130f5c44e70
--- /dev/null
+++ b/pkgs/development/libraries/science/chemistry/avogadrolibs/default.nix
@@ -0,0 +1,68 @@
+{ lib, stdenv, fetchFromGitHub, cmake, zlib, eigen, libGL, doxygen, spglib
+, mmtf-cpp, glew, python3, libarchive, libmsym, msgpack, qttools, wrapQtAppsHook
+}:
+
+let
+  pythonWP = python3.withPackages (p: with p; [ openbabel-bindings numpy ]);
+
+  # Pure data repositories
+  moleculesRepo = fetchFromGitHub {
+    owner = "OpenChemistry";
+    repo = "molecules";
+    rev = "1.0.0";
+    sha256 = "guY6osnpv7Oqt+HE1BpIqL10POp+x8GAci2kY0bLmqg=";
+  };
+  crystalsRepo = fetchFromGitHub {
+    owner = "OpenChemistry";
+    repo = "crystals";
+    rev = "1.0.1";
+    sha256 = "sH/WuvLaYu6akOc3ssAKhnxD8KNoDxuafDSozHqJZC4=";
+  };
+
+in stdenv.mkDerivation rec {
+  pname = "avogadrolibs";
+  version = "1.94.0";
+
+  src = fetchFromGitHub {
+    owner = "OpenChemistry";
+    repo = pname;
+    rev = version;
+    sha256 = "6bChJhqrjOxeEWZBNToq3JExHPu7DUMsEHWBDe75zAo=";
+  };
+
+  postUnpack = ''
+    cp -r ${moleculesRepo} molecules
+    cp -r ${crystalsRepo} crystals
+  '';
+
+  nativeBuildInputs = [
+    cmake
+    wrapQtAppsHook
+  ];
+
+  buildInputs = [
+    eigen
+    zlib
+    libGL
+    spglib
+    mmtf-cpp
+    glew
+    libarchive
+    libmsym
+    msgpack
+    qttools
+  ];
+
+  postFixup = ''
+    substituteInPlace $out/lib/cmake/${pname}/AvogadroLibsConfig.cmake \
+      --replace "''${AvogadroLibs_INSTALL_PREFIX}/$out" "''${AvogadroLibs_INSTALL_PREFIX}"
+  '';
+
+  meta = with lib; {
+    description = "Molecule editor and visualizer";
+    maintainers = with maintainers; [ sheepforce ];
+    homepage = "https://github.com/OpenChemistry/avogadrolibs";
+    platforms = platforms.linux;
+    license = licenses.gpl2Only;
+  };
+}
diff --git a/pkgs/development/libraries/science/chemistry/libmsym/default.nix b/pkgs/development/libraries/science/chemistry/libmsym/default.nix
new file mode 100644
index 000000000000..8c605f3e07d4
--- /dev/null
+++ b/pkgs/development/libraries/science/chemistry/libmsym/default.nix
@@ -0,0 +1,23 @@
+{ stdenv, lib, fetchFromGitHub, cmake } :
+
+stdenv.mkDerivation rec {
+  pname = "libmsym";
+  version = "0.2.3";
+
+  src = fetchFromGitHub  {
+    owner = "mcodev31";
+    repo = pname;
+    rev = "v${version}";
+    sha256= "k+OEwrA/saupP/wX6Ii5My0vffiJ0X9xMCTrliMSMik=";
+  };
+
+  nativeBuildInputs = [ cmake ];
+
+  meta = with lib; {
+    description = " molecular point group symmetry lib";
+    homepage = "https://github.com/rcsb/mmtf-cpp";
+    license = licenses.mit;
+    platforms = platforms.linux;
+    maintainers = [ maintainers.sheepforce ];
+  };
+}
diff --git a/pkgs/development/libraries/science/chemistry/mmtf-cpp/default.nix b/pkgs/development/libraries/science/chemistry/mmtf-cpp/default.nix
new file mode 100644
index 000000000000..ec1fed68ff93
--- /dev/null
+++ b/pkgs/development/libraries/science/chemistry/mmtf-cpp/default.nix
@@ -0,0 +1,25 @@
+{ stdenv, lib, fetchFromGitHub, cmake, msgpack } :
+
+stdenv.mkDerivation rec {
+  pname = "mmtf-cpp";
+  version = "1.0.0";
+
+  src = fetchFromGitHub  {
+    owner = "rcsb";
+    repo = pname;
+    rev = "v${version}";
+    sha256= "17ylramda69plf5w0v5hxbl4ggkdi5s15z55cv0pljl12yvyva8l";
+  };
+
+  nativeBuildInputs = [ cmake ];
+
+  buildInputs = [ msgpack ];
+
+  meta = with lib; {
+    description = "A library of exchange-correlation functionals with arbitrary-order derivatives";
+    homepage = "https://github.com/rcsb/mmtf-cpp";
+    license = licenses.mit;
+    platforms = platforms.linux;
+    maintainers = [ maintainers.sheepforce ];
+  };
+}
diff --git a/pkgs/development/libraries/science/chemistry/molequeue/default.nix b/pkgs/development/libraries/science/chemistry/molequeue/default.nix
new file mode 100644
index 000000000000..1e8ca2d961d3
--- /dev/null
+++ b/pkgs/development/libraries/science/chemistry/molequeue/default.nix
@@ -0,0 +1,33 @@
+{ lib, stdenv, fetchFromGitHub, cmake, qttools, wrapQtAppsHook }:
+
+stdenv.mkDerivation rec {
+  pname = "molequeue";
+  version = "0.9.0";
+
+  src = fetchFromGitHub {
+    owner = "OpenChemistry";
+    repo = pname;
+    rev = version;
+    sha256 = "+NoY8YVseFyBbxc3ttFWiQuHQyy1GN8zvV1jGFjmvLg=";
+  };
+
+  nativeBuildInputs = [
+    cmake
+    wrapQtAppsHook
+  ];
+
+  buildInputs = [ qttools ];
+
+  postFixup = ''
+    substituteInPlace $out/lib/cmake/molequeue/MoleQueueConfig.cmake \
+      --replace "''${MoleQueue_INSTALL_PREFIX}/$out" "''${MoleQueue_INSTALL_PREFIX}"
+  '';
+
+  meta = with lib; {
+    description = "Desktop integration of high performance computing resources";
+    maintainers = with maintainers; [ sheepforce ];
+    homepage = "https://github.com/OpenChemistry/molequeue";
+    platforms = platforms.linux;
+    license = licenses.bsd3;
+  };
+}
diff --git a/pkgs/development/python-modules/awslambdaric/default.nix b/pkgs/development/python-modules/awslambdaric/default.nix
index 6bb6702b1e2b..f5d282ac0ee1 100644
--- a/pkgs/development/python-modules/awslambdaric/default.nix
+++ b/pkgs/development/python-modules/awslambdaric/default.nix
@@ -13,6 +13,11 @@ buildPythonPackage rec {
     sha256 = "120qar8iaxj6dmnhjw1c40n2w06f1nyxy57dwh06xdiany698fg4";
   };
 
+  postPatch = ''
+    substituteInPlace requirements/base.txt \
+      --replace 'simplejson==3' 'simplejson~=3'
+  '';
+
   propagatedBuildInputs = [ simplejson ];
 
   nativeBuildInputs = [ autoconf automake cmake libtool perl ];
@@ -21,10 +26,6 @@ buildPythonPackage rec {
 
   dontUseCmakeConfigure = true;
 
-  preBuild = ''
-    substituteInPlace requirements/base.txt --replace 'simplejson==3' 'simplejson~=3'
-  '';
-
   checkInputs = [ pytestCheckHook ];
 
   pythonImportsCheck = [ "awslambdaric" "runtime_client" ];
diff --git a/pkgs/development/python-modules/ignite/default.nix b/pkgs/development/python-modules/ignite/default.nix
index 72a607505cdc..177fd8915607 100644
--- a/pkgs/development/python-modules/ignite/default.nix
+++ b/pkgs/development/python-modules/ignite/default.nix
@@ -3,6 +3,7 @@
 , fetchFromGitHub
 , pytestCheckHook
 , pytest-xdist
+, torchvision
 , pythonOlder
 , matplotlib
 , mock
@@ -14,16 +15,16 @@
 
 buildPythonPackage rec {
   pname = "ignite";
-  version = "0.4.5";
+  version = "0.4.6";
 
   src = fetchFromGitHub {
     owner = "pytorch";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-FGFpaqq7InwRqFmQTmXGpJEjRUB69ZN/l20l42L2BAA=";
+    sha256 = "sha256-dlKGXjUUnyYmPDilo0LQg9OkSkBnMYNgzlFLIfI0T6I=";
   };
 
-  checkInputs = [ pytestCheckHook matplotlib mock pytest-xdist ];
+  checkInputs = [ pytestCheckHook matplotlib mock pytest-xdist torchvision ];
   propagatedBuildInputs = [ pytorch scikit-learn tqdm pynvml ];
 
   # runs succesfully in 3.9, however, async isn't correctly closed so it will fail after test suite.
@@ -38,6 +39,7 @@ buildPythonPackage rec {
     "--ignore=tests/ignite/contrib/handlers/test_trains_logger.py"
     "--ignore=tests/ignite/metrics/nlp/test_bleu.py"
     "--ignore=tests/ignite/metrics/nlp/test_rouge.py"
+    "--ignore=tests/ignite/metrics/gan" # requires pytorch_fid; tries to download model to $HOME
     "--ignore=tests/ignite/metrics/test_dill.py"
     "--ignore=tests/ignite/metrics/test_psnr.py"
     "--ignore=tests/ignite/metrics/test_ssim.py"
diff --git a/pkgs/development/python-modules/pynvml/default.nix b/pkgs/development/python-modules/pynvml/default.nix
index 75d8056fa557..59698fa18767 100644
--- a/pkgs/development/python-modules/pynvml/default.nix
+++ b/pkgs/development/python-modules/pynvml/default.nix
@@ -7,12 +7,12 @@
 
 buildPythonPackage rec {
   pname = "pynvml";
-  version = "8.0.4";
+  version = "11.0.0";
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0pfykj1amqh1rixp90rg85v1nj6qmx89fahqr6ii4zlcckffmm68";
+    sha256 = "sha256-1fxKItNVtAw0HWugqoiKLU0iUxd9JDkA+EAbfmyssbs=";
   };
 
   propagatedBuildInputs = [ cudatoolkit ];
diff --git a/pkgs/development/python-modules/threadpoolctl/default.nix b/pkgs/development/python-modules/threadpoolctl/default.nix
index 20fad7c18a0a..7ba82aaec296 100644
--- a/pkgs/development/python-modules/threadpoolctl/default.nix
+++ b/pkgs/development/python-modules/threadpoolctl/default.nix
@@ -4,14 +4,13 @@
 , fetchFromGitHub
 , flit
 , pytestCheckHook
-, pytest-cov
 , numpy
 , scipy
 }:
 
 buildPythonPackage rec {
   pname = "threadpoolctl";
-  version = "2.1.0";
+  version = "2.2.0";
 
   disabled = isPy27;
   format = "flit";
@@ -20,10 +19,10 @@ buildPythonPackage rec {
     owner = "joblib";
     repo = pname;
     rev = version;
-    sha256 = "0sl6mp3b2gb0dvqkhnkmrp2g3r5c7clyyyxzq44xih6sw1pgx9df";
+    sha256 = "7UUjbX1IpXtUAgN48Db43Zr1u360UETSUnIHD6rQRLs=";
   };
 
-  checkInputs = [ pytestCheckHook pytest-cov numpy scipy ];
+  checkInputs = [ pytestCheckHook numpy scipy ];
 
   meta = with lib; {
     homepage = "https://github.com/joblib/threadpoolctl";
diff --git a/pkgs/development/python-modules/xml-marshaller/default.nix b/pkgs/development/python-modules/xml-marshaller/default.nix
index 748b68756208..30300c61045d 100644
--- a/pkgs/development/python-modules/xml-marshaller/default.nix
+++ b/pkgs/development/python-modules/xml-marshaller/default.nix
@@ -10,13 +10,15 @@ buildPythonPackage rec {
   version = "1.0.2";
 
   src = fetchPypi {
-    inherit version;
     pname = "xml_marshaller";
+    inherit version;
     sha256 = "sha256-QvBALLDD8o5nZQ5Z4bembhadK6jcydWKQpJaSmGqqJM=";
   };
 
   propagatedBuildInputs = [ lxml six ];
 
+  pythonImportsCheck = [ "xml_marshaller" ];
+
   meta = with lib; {
     description = "This module allows one to marshal simple Python data types into a custom XML format.";
     homepage = "https://www.python.org/community/sigs/current/xml-sig/";
diff --git a/pkgs/development/tools/kind/default.nix b/pkgs/development/tools/kind/default.nix
index 88bc30943c38..e667238b9b09 100644
--- a/pkgs/development/tools/kind/default.nix
+++ b/pkgs/development/tools/kind/default.nix
@@ -13,6 +13,11 @@ buildGoModule rec {
     sha256 = "sha256-pjg52ONseKNw06EOBzD6Elge+Cz+C3llPvjJPHkn1cw=";
   };
 
+  patches = [
+    # fix kernel module path used by kind
+    ./kernel-module-path.patch
+  ];
+
   vendorSha256 = "sha256-HiVdekSZrC/RkMSvcwm1mv6AE4bA5kayUsMdVCbckiE=";
 
   doCheck = false;
diff --git a/pkgs/development/tools/kind/kernel-module-path.patch b/pkgs/development/tools/kind/kernel-module-path.patch
new file mode 100644
index 000000000000..833cd3388ec2
--- /dev/null
+++ b/pkgs/development/tools/kind/kernel-module-path.patch
@@ -0,0 +1,47 @@
+diff --git a/pkg/cluster/internal/providers/common/getmodules.go b/pkg/cluster/internal/providers/common/getmodules.go
+new file mode 100644
+index 00000000..f42a883d
+--- /dev/null
++++ b/pkg/cluster/internal/providers/common/getmodules.go
+@@ -0,0 +1,15 @@
++package common
++
++import "os"
++
++const (
++	fhsKernalModulePath = "/lib/modules"
++	nixKernalModulePath = "/run/booted-system/kernel-modules/lib"
++)
++
++func GetKernelModulePath() string {
++	if _, err := os.Stat(nixKernalModulePath); !os.IsNotExist(err) {
++		return nixKernalModulePath
++	}
++	return fhsKernalModulePath
++}
+diff --git a/pkg/cluster/internal/providers/docker/provision.go b/pkg/cluster/internal/providers/docker/provision.go
+index 50161861..86d5b7b6 100644
+--- a/pkg/cluster/internal/providers/docker/provision.go
++++ b/pkg/cluster/internal/providers/docker/provision.go
+@@ -242,7 +242,7 @@ func runArgsForNode(node *config.Node, clusterIPFamily config.ClusterIPFamily, n
+ 		// (please don't depend on doing this though!)
+ 		"--volume", "/var",
+ 		// some k8s things want to read /lib/modules
+-		"--volume", "/lib/modules:/lib/modules:ro",
++		"--volume", fmt.Sprintf("%s:/lib/modules:ro", common.GetKernelModulePath()),
+ 	},
+ 		args...,
+ 	)
+diff --git a/pkg/cluster/internal/providers/podman/provision.go b/pkg/cluster/internal/providers/podman/provision.go
+index 51dce486..3bc36b42 100644
+--- a/pkg/cluster/internal/providers/podman/provision.go
++++ b/pkg/cluster/internal/providers/podman/provision.go
+@@ -205,7 +205,7 @@ func runArgsForNode(node *config.Node, clusterIPFamily config.ClusterIPFamily, n
+ 		// dev: devices on the volume will be able to be used by processes within the container
+ 		"--volume", fmt.Sprintf("%s:/var:suid,exec,dev", varVolume),
+ 		// some k8s things want to read /lib/modules
+-		"--volume", "/lib/modules:/lib/modules:ro",
++		"--volume", fmt.Sprintf("%s:/lib/modules:ro", common.GetKernelModulePath()),
+ 	},
+ 		args...,
+ 	)
diff --git a/pkgs/development/tools/misc/teensy-loader-cli/default.nix b/pkgs/development/tools/misc/teensy-loader-cli/default.nix
index 156e3f7f895d..ccae93770249 100644
--- a/pkgs/development/tools/misc/teensy-loader-cli/default.nix
+++ b/pkgs/development/tools/misc/teensy-loader-cli/default.nix
@@ -1,31 +1,46 @@
-{ lib, stdenv, fetchFromGitHub, go-md2man, installShellFiles, libusb-compat-0_1 }:
+{ stdenv
+, lib
+, fetchFromGitHub
+, go-md2man
+, installShellFiles
+, libusb-compat-0_1
+}:
 
 stdenv.mkDerivation rec {
   pname = "teensy-loader-cli";
-  version = "2.1.20191110";
+  version = "2.1+unstable=2021-04-10";
 
   src = fetchFromGitHub {
     owner = "PaulStoffregen";
     repo = "teensy_loader_cli";
-    rev = "e98b5065cdb9f04aa4dde3f2e6e6e6f12dd97592";
-    sha256 = "1yx8vsh6b29pqr4zb6sx47429i9x51hj9psn8zksfz75j5ivfd5i";
+    rev = "9dbbfa3b367b6c37e91e8a42dae3c6edfceccc4d";
+    sha256 = "lQ1XtaWPr6nvE8NArD1980QVOH6NggO3FlfsntUjY7s=";
   };
 
-  buildInputs = [ libusb-compat-0_1 ];
+  nativeBuildInputs = [
+    go-md2man
+    installShellFiles
+  ];
 
-  nativeBuildInputs = [ go-md2man installShellFiles ];
+  buildInputs = [
+    libusb-compat-0_1
+  ];
 
   installPhase = ''
+    runHook preInstall
+
     install -Dm555 teensy_loader_cli $out/bin/teensy-loader-cli
     install -Dm444 -t $out/share/doc/${pname} *.md *.txt
     go-md2man -in README.md -out ${pname}.1
     installManPage *.1
+
+    runHook postInstall
   '';
 
   meta = with lib; {
     description = "Firmware uploader for the Teensy microcontroller boards";
     homepage = "https://www.pjrc.com/teensy/";
-    license = licenses.gpl3;
+    license = licenses.gpl3Only;
     platforms = platforms.unix;
   };
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/default.nix b/pkgs/development/tools/parsing/tree-sitter/grammars/default.nix
index 2671e4148b1d..10c551c1442a 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/default.nix
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/default.nix
@@ -3,10 +3,12 @@
   tree-sitter-bash = (builtins.fromJSON (builtins.readFile ./tree-sitter-bash.json));
   tree-sitter-c = (builtins.fromJSON (builtins.readFile ./tree-sitter-c.json));
   tree-sitter-c-sharp = (builtins.fromJSON (builtins.readFile ./tree-sitter-c-sharp.json));
+  tree-sitter-comment = (builtins.fromJSON (builtins.readFile ./tree-sitter-comment.json));
   tree-sitter-cpp = (builtins.fromJSON (builtins.readFile ./tree-sitter-cpp.json));
   tree-sitter-css = (builtins.fromJSON (builtins.readFile ./tree-sitter-css.json));
   tree-sitter-embedded-template = (builtins.fromJSON (builtins.readFile ./tree-sitter-embedded-template.json));
   tree-sitter-fennel = (builtins.fromJSON (builtins.readFile ./tree-sitter-fennel.json));
+  tree-sitter-fish = (builtins.fromJSON (builtins.readFile ./tree-sitter-fish.json));
   tree-sitter-fluent = (builtins.fromJSON (builtins.readFile ./tree-sitter-fluent.json));
   tree-sitter-go = (builtins.fromJSON (builtins.readFile ./tree-sitter-go.json));
   tree-sitter-haskell = (builtins.fromJSON (builtins.readFile ./tree-sitter-haskell.json));
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-comment.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-comment.json
new file mode 100644
index 000000000000..54e275adf6ec
--- /dev/null
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-comment.json
@@ -0,0 +1,10 @@
+{
+  "url": "https://github.com/stsewd/tree-sitter-comment",
+  "rev": "894b61d68a31d93c33ed48dcc7f427174b440abe",
+  "date": "2021-04-27T15:25:48-05:00",
+  "path": "/nix/store/w0yz9imzi33glwk6ilm0jqipcyzl8hgm-tree-sitter-comment",
+  "sha256": "1vfayzzcv6lj63pgcxr8f7rcd81jkgnfdlmhs39i7w3m0s6dv1qg",
+  "fetchSubmodules": false,
+  "deepClone": false,
+  "leaveDotGit": false
+}
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-fish.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-fish.json
new file mode 100644
index 000000000000..4dc81284db91
--- /dev/null
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-fish.json
@@ -0,0 +1,10 @@
+{
+  "url": "https://github.com/ram02z/tree-sitter-fish",
+  "rev": "db7139393e50765520618fa469f41dfbb0b3822b",
+  "date": "2021-07-06T21:05:19+02:00",
+  "path": "/nix/store/k67b4bn67zd3dj9yg0q7jywy3vnkv8gw-tree-sitter-fish",
+  "sha256": "09l5myivlq3z53nqlx8x8c45sww2k7vmjp8z0rvwzv08rnym0fah",
+  "fetchSubmodules": false,
+  "deepClone": false,
+  "leaveDotGit": false
+}
diff --git a/pkgs/development/tools/parsing/tree-sitter/update.nix b/pkgs/development/tools/parsing/tree-sitter/update.nix
index 55237b298d2a..308ca3eeb69f 100644
--- a/pkgs/development/tools/parsing/tree-sitter/update.nix
+++ b/pkgs/development/tools/parsing/tree-sitter/update.nix
@@ -70,6 +70,10 @@ let
   # If you need a grammar that already exists in the official orga,
   # make sure to give it a different name.
   otherGrammars = {
+    "tree-sitter-comment" = {
+      orga = "stsewd";
+      repo = "tree-sitter-comment";
+    };
     "tree-sitter-nix" = {
       orga = "cstrahan";
       repo = "tree-sitter-nix";
@@ -106,6 +110,10 @@ let
       orga = "GrayJack";
       repo = "tree-sitter-zig";
     };
+    "tree-sitter-fish" = {
+      orga = "ram02z";
+      repo = "tree-sitter-fish";
+    };
   };
 
   allGrammars =
diff --git a/pkgs/development/tools/yarn/default.nix b/pkgs/development/tools/yarn/default.nix
index 1868bdaf2c32..10012e552ced 100644
--- a/pkgs/development/tools/yarn/default.nix
+++ b/pkgs/development/tools/yarn/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "yarn";
-  version = "1.22.10";
+  version = "1.22.11";
 
   src = fetchzip {
     url = "https://github.com/yarnpkg/yarn/releases/download/v${version}/yarn-v${version}.tar.gz";
-    sha256 = "0pdimll8lhsnqfafhdaxd6h6mgxhj1c7h56r111cmxhzw462y3mr";
+    sha256 = "0gmk46b9gd6q0zi3a2adgf8c1y05c2lf34k5wrw7alnlwy8iqvvp";
   };
 
   buildInputs = [ nodejs ];
diff --git a/pkgs/misc/emulators/wine/sources.nix b/pkgs/misc/emulators/wine/sources.nix
index 6accb486d57c..7e278684cef4 100644
--- a/pkgs/misc/emulators/wine/sources.nix
+++ b/pkgs/misc/emulators/wine/sources.nix
@@ -44,16 +44,16 @@ in rec {
 
   unstable = fetchurl rec {
     # NOTE: Don't forget to change the SHA256 for staging as well.
-    version = "6.13";
+    version = "6.14";
     url = "https://dl.winehq.org/wine/source/6.x/wine-${version}.tar.xz";
-    sha256 = "sha256-4DohoBHUXSrp8iIED7dpC5cVY3bnQx+GHyAHPq8k8oo=";
+    sha256 = "sha256-ZLRxk5lDvAjjUQJ9tvvCRlwTllCjv/65Flf/DujCUgI=";
     inherit (stable) gecko32 gecko64;
 
     ## see http://wiki.winehq.org/Mono
     mono = fetchurl rec {
-      version = "6.2.0";
+      version = "6.3.0";
       url = "https://dl.winehq.org/wine/wine-mono/${version}/wine-mono-${version}-x86.msi";
-      sha256 = "sha256-zY1TUT2DV7KHama6sIllTvmUH0LvaQ+1VcZJP1OB28o=";
+      sha256 = "sha256-pfAtMqAoNpKkpiX1Qc+7tFGIMShHTFyANiOFMXzQmfA=";
     };
 
     patches = [
@@ -65,7 +65,7 @@ in rec {
   staging = fetchFromGitHub rec {
     # https://github.com/wine-staging/wine-staging/releases
     inherit (unstable) version;
-    sha256 = "sha256-3IpO+eQ/+DiQZH6en5Q/p+j441LDvjn4i9Ex7PY8KCk=";
+    sha256 = "sha256-yzpRWNx/e3BDCh1dyf8VdjLgvu6yZ/CXre/cb1roaVs=";
     owner = "wine-staging";
     repo = "wine-staging";
     rev = "v${version}";
diff --git a/pkgs/tools/misc/etcher/default.nix b/pkgs/tools/misc/etcher/default.nix
index d0fae336d9d3..6834179cfe9a 100644
--- a/pkgs/tools/misc/etcher/default.nix
+++ b/pkgs/tools/misc/etcher/default.nix
@@ -59,6 +59,9 @@ stdenv.mkDerivation rec {
     cp -a usr/share/* $out/share
     cp -a opt/balenaEtcher/{locales,resources} $out/share/${pname}
 
+    substituteInPlace $out/share/applications/balena-etcher-electron.desktop \
+      --replace /opt/balenaEtcher/balena-etcher-electron ${pname}
+
     runHook postInstall
   '';
 
diff --git a/pkgs/tools/networking/dnsproxy/default.nix b/pkgs/tools/networking/dnsproxy/default.nix
index 7a49af85d39d..3debf67f81a9 100644
--- a/pkgs/tools/networking/dnsproxy/default.nix
+++ b/pkgs/tools/networking/dnsproxy/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "dnsproxy";
-  version = "0.39.1";
+  version = "0.39.2";
 
   src = fetchFromGitHub {
     owner = "AdguardTeam";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-3ixWiY7gJaavJw3WuK3aTYE6lb328VgWSPCuf5PN8Ds=";
+    sha256 = "sha256-FuPNWoLsqPvz4J+ymfEKBjPmLlxwDUp/196REDnGPmQ=";
   };
 
   vendorSha256 = null;
diff --git a/pkgs/tools/package-management/nix-simple-deploy/default.nix b/pkgs/tools/package-management/nix-simple-deploy/default.nix
index 75f47d35ce2c..bd16ecc6f3fc 100644
--- a/pkgs/tools/package-management/nix-simple-deploy/default.nix
+++ b/pkgs/tools/package-management/nix-simple-deploy/default.nix
@@ -1,21 +1,29 @@
-{ lib, fetchFromGitHub, rustPlatform }:
+{ lib, fetchFromGitHub, rustPlatform, makeWrapper, openssh, nix-serve }:
 
 rustPlatform.buildRustPackage rec {
   pname = "nix-simple-deploy";
-  version = "0.1.1";
+  version = "0.2.1";
 
   src = fetchFromGitHub {
     owner = "misuzu";
     repo = pname;
     rev = version;
-    sha256 = "12g0sbgs2dfnk0agp1kagfi1yhk26ga98zygxxrjhjxrqb2n5w80";
+    sha256 = "0vkgs3ffb5vdzhrqdnd54vbi36vrgd3408zvjn0rmqlnwi3wwhnk";
   };
 
-  cargoSha256 = "1wp8wdv25j8ybq2j04z3nl4yc95wkj5h740lzpyps08yaxj8bncr";
+  cargoSha256 = "0z4d4cazl6qvigyqzdayxqfjc1ki1rhrpm76agc8lkrxrvhyay2h";
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  postInstall = ''
+    wrapProgram "$out/bin/nix-simple-deploy" \
+      --prefix PATH : "${lib.makeBinPath [ openssh nix-serve ]}"
+  '';
 
   meta = with lib; {
     description = "Deploy software or an entire NixOS system configuration to another NixOS system";
     homepage = "https://github.com/misuzu/nix-simple-deploy";
+    platforms = platforms.unix;
     license = with licenses; [ asl20 /* OR */ mit ];
     maintainers = with maintainers; [ misuzu ];
   };
diff --git a/pkgs/tools/text/mdbook/default.nix b/pkgs/tools/text/mdbook/default.nix
index 29007dd1282d..d3a136d6bf75 100644
--- a/pkgs/tools/text/mdbook/default.nix
+++ b/pkgs/tools/text/mdbook/default.nix
@@ -2,22 +2,22 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "mdbook";
-  version = "0.4.10";
+  version = "0.4.12";
 
   src = fetchFromGitHub {
-    owner = "rust-lang-nursery";
+    owner = "rust-lang";
     repo = "mdBook";
     rev = "v${version}";
-    sha256 = "sha256-1Ddy/kb2Q7P+tzyEr3EC3qWm6MGSsDL3/vnPJLAm/J0=";
+    sha256 = "sha256-2lxotwL3Dc9jRA12iKO5zotO80pa+RfUZucyDRgFOsI=";
   };
 
-  cargoSha256 = "sha256-x2BwnvEwTqz378aDE7OHWuEwNEsUnRudLq7sUJjHRpA=";
+  cargoSha256 = "sha256-TNd4pj4qSKgmmVtSCSKFCxNtv96xD7+24BPsLXPgiEI=";
 
   buildInputs = lib.optionals stdenv.isDarwin [ CoreServices ];
 
   meta = with lib; {
     description = "Create books from MarkDown";
-    homepage = "https://github.com/rust-lang-nursery/mdbook";
+    homepage = "https://github.com/rust-lang/mdBook";
     license = [ licenses.mpl20 ];
     maintainers = [ maintainers.havvy ];
   };
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index a91db037114c..ae0194850666 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -709,6 +709,7 @@ mapAliases ({
   redkite = throw "redkite was archived by upstream"; # added 2021-04-12
   rkt = throw "rkt was archived by upstream"; # added 2020-05-16
   rpiboot-unstable = rpiboot; # added 2021-07-30
+  rtv = throw "rtv was archived by upstream. Consider using tuir, an actively maintained fork"; # added 2021-08-08
   ruby_2_0_0 = throw "ruby_2_0_0 was deprecated on 2018-02-13: use a newer version of ruby";
   ruby_2_1_0 = throw "ruby_2_1_0 was deprecated on 2018-02-13: use a newer version of ruby";
   ruby_2_2_9 = throw "ruby_2_2_9 was deprecated on 2018-02-13: use a newer version of ruby";
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index f402775f9af8..dac91c0ad2f1 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -6844,6 +6844,8 @@ in
 
   libmesode = callPackage ../development/libraries/libmesode {};
 
+  libmsym = callPackage ../development/libraries/science/chemistry/libmsym { };
+
   libnabo = callPackage ../development/libraries/libnabo { };
 
   libngspice = callPackage ../development/libraries/libngspice { };
@@ -14082,6 +14084,8 @@ in
 
   mkdocs = callPackage ../development/tools/documentation/mkdocs { };
 
+  mmtf-cpp = callPackage ../development/libraries/science/chemistry/mmtf-cpp { };
+
   mockgen = callPackage ../development/tools/mockgen { };
 
   modd = callPackage ../development/tools/modd { };
@@ -23102,6 +23106,8 @@ in
 
   vistafonts-chs = callPackage ../data/fonts/vista-fonts-chs { };
 
+  vistafonts-cht = callPackage ../data/fonts/vista-fonts-cht { };
+
   vollkorn = callPackage ../data/fonts/vollkorn { };
 
   weather-icons = callPackage ../data/fonts/weather-icons { };
@@ -26757,9 +26763,7 @@ in
 
   polylith = callPackage ../development/tools/misc/polylith { };
 
-  polymake = callPackage ../applications/science/math/polymake {
-    openjdk = openjdk8; # TODO: remove override https://github.com/NixOS/nixpkgs/pull/89731
-  };
+  polymake = callPackage ../applications/science/math/polymake { };
 
   pond = callPackage ../applications/networking/instant-messengers/pond { };
 
@@ -27099,8 +27103,6 @@ in
   rtl-sdr = callPackage ../applications/radio/rtl-sdr { };
   librtlsdr = callPackage ../development/libraries/librtlsdr { };
 
-  rtv = callPackage ../applications/misc/rtv { };
-
   rubyripper = callPackage ../applications/audio/rubyripper {};
 
   runc = callPackage ../applications/virtualization/runc {};
@@ -30085,6 +30087,12 @@ in
     eigen = eigen2;
   };
 
+  avogadrolibs = libsForQt5.callPackage ../development/libraries/science/chemistry/avogadrolibs { };
+
+  molequeue = libsForQt5.callPackage ../development/libraries/science/chemistry/molequeue { };
+
+  avogadro2 = libsForQt5.callPackage ../applications/science/chemistry/avogadro2 { };
+
   chemtool = callPackage ../applications/science/chemistry/chemtool { };
 
   cp2k = callPackage ../applications/science/chemistry/cp2k { };