diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index e1e77aa83ef3..7e4e02c5a7f0 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -10678,6 +10678,16 @@
     githubId = 9853194;
     name = "Philipp Bartsch";
   };
+  toastal = {
+    email = "toastal+nix@posteo.net";
+    github = "toastal";
+    githubId = 561087;
+    name = "toastal";
+    keys = [{
+      longkeyid = "ed25519/5CCE6F1466D47C9E";
+      fingerprint = "7944 74B7 D236 DAB9 C9EF  E7F9 5CCE 6F14 66D4 7C9E";
+    }];
+  };
   tobim = {
     email = "nix@tobim.fastmail.fm";
     github = "tobim";
@@ -11878,12 +11888,6 @@
     githubId = 8686360;
     name = "Illia Shestakov";
   };
-  foxit64 = {
-    email = "o4nsxy05@gmail.com";
-    github = "foxit64";
-    githubId = 56247270;
-    name = "Foxit";
-  };
   masaeedu = {
     email = "masaeedu@gmail.com";
     github = "masaeedu";
diff --git a/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml b/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml
index a5228a70212e..42d87c27bcc4 100644
--- a/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml
@@ -492,7 +492,7 @@
         </itemizedlist>
       </listitem>
     </itemizedlist>
-    <itemizedlist spacing="compact">
+    <itemizedlist>
       <listitem>
         <para>
           <literal>yggdrasil</literal> was upgraded to a new major
@@ -501,6 +501,14 @@
           changelog</link>.
         </para>
       </listitem>
+      <listitem>
+        <para>
+          <literal>icingaweb2</literal> was upgraded to a new release
+          which requires a manual database upgrade, see
+          <link xlink:href="https://github.com/Icinga/icingaweb2/releases/tag/v2.9.0">upstream
+          changelog</link>.
+        </para>
+      </listitem>
     </itemizedlist>
   </section>
   <section xml:id="sec-release-21.11-notable-changes">
diff --git a/nixos/doc/manual/release-notes/rl-2111.section.md b/nixos/doc/manual/release-notes/rl-2111.section.md
index 3916da1f069d..f2a8dff7988c 100644
--- a/nixos/doc/manual/release-notes/rl-2111.section.md
+++ b/nixos/doc/manual/release-notes/rl-2111.section.md
@@ -126,6 +126,8 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - `yggdrasil` was upgraded to a new major release with breaking changes, see [upstream changelog](https://github.com/yggdrasil-network/yggdrasil-go/releases/tag/v0.4.0).
 
+- `icingaweb2` was upgraded to a new release which requires a manual database upgrade, see [upstream changelog](https://github.com/Icinga/icingaweb2/releases/tag/v2.9.0).
+
 ## Other Notable Changes {#sec-release-21.11-notable-changes}
 
 - The setting [`services.openssh.logLevel`](options.html#opt-services.openssh.logLevel) `"VERBOSE"` `"INFO"`. This brings NixOS in line with upstream and other Linux distributions, and reduces log spam on servers due to bruteforcing botnets.
diff --git a/nixos/modules/programs/xwayland.nix b/nixos/modules/programs/xwayland.nix
index 7e9a424a7150..cb3c9c5b156c 100644
--- a/nixos/modules/programs/xwayland.nix
+++ b/nixos/modules/programs/xwayland.nix
@@ -10,14 +10,16 @@ in
 {
   options.programs.xwayland = {
 
-    enable = mkEnableOption ''
-      Xwayland X server allows running X programs on a Wayland compositor.
-    '';
+    enable = mkEnableOption "Xwayland (an X server for interfacing X11 apps with the Wayland protocol)";
 
     defaultFontPath = mkOption {
       type = types.str;
       default = optionalString config.fonts.fontDir.enable
         "/run/current-system/sw/share/X11/fonts";
+      defaultText = literalExample ''
+        optionalString config.fonts.fontDir.enable
+          "/run/current-system/sw/share/X11/fonts";
+      '';
       description = ''
         Default font path. Setting this option causes Xwayland to be rebuilt.
       '';
@@ -25,7 +27,15 @@ in
 
     package = mkOption {
       type = types.path;
-      description = "The Xwayland package";
+      default = pkgs.xwayland.override (oldArgs: {
+        inherit (cfg) defaultFontPath;
+      });
+      defaultText = literalExample ''
+        pkgs.xwayland.override (oldArgs: {
+          inherit (config.programs.xwayland) defaultFontPath;
+        });
+      '';
+      description = "The Xwayland package to use.";
     };
 
   };
@@ -37,9 +47,5 @@ in
 
     environment.systemPackages = [ cfg.package ];
 
-    programs.xwayland.package = pkgs.xwayland.override (oldArgs: {
-      inherit (cfg) defaultFontPath;
-    });
-
   };
 }
diff --git a/nixos/modules/services/cluster/k3s/default.nix b/nixos/modules/services/cluster/k3s/default.nix
index 300c182406ce..d0fb8cc50985 100644
--- a/nixos/modules/services/cluster/k3s/default.nix
+++ b/nixos/modules/services/cluster/k3s/default.nix
@@ -35,10 +35,20 @@ in
 
     token = mkOption {
       type = types.str;
-      description = "The k3s token to use when connecting to the server. This option only makes sense for an agent.";
+      description = ''
+        The k3s token to use when connecting to the server. This option only makes sense for an agent.
+        WARNING: This option will expose store your token unencrypted world-readable in the nix store.
+        If this is undesired use the tokenFile option instead.
+      '';
       default = "";
     };
 
+    tokenFile = mkOption {
+      type = types.nullOr types.path;
+      description = "File path containing k3s token to use when connecting to the server. This option only makes sense for an agent.";
+      default = null;
+    };
+
     docker = mkOption {
       type = types.bool;
       default = false;
@@ -68,8 +78,8 @@ in
         message = "serverAddr should be set if role is 'agent'";
       }
       {
-        assertion = cfg.role == "agent" -> cfg.token != "";
-        message = "token should be set if role is 'agent'";
+        assertion = cfg.role == "agent" -> cfg.token != "" || cfg.tokenFile != null;
+        message = "token or tokenFile should be set if role is 'agent'";
       }
     ];
 
@@ -105,7 +115,12 @@ in
             "${cfg.package}/bin/k3s ${cfg.role}"
           ] ++ (optional cfg.docker "--docker")
           ++ (optional cfg.disableAgent "--disable-agent")
-          ++ (optional (cfg.role == "agent") "--server ${cfg.serverAddr} --token ${cfg.token}")
+          ++ (optional (cfg.role == "agent") "--server ${cfg.serverAddr} ${
+            if cfg.tokenFile != null then
+              "--token-file ${cfg.tokenFile}"
+            else
+              "--token ${cfg.token}"
+          }")
           ++ [ cfg.extraFlags ]
         );
       };
diff --git a/nixos/modules/services/web-apps/discourse.nix b/nixos/modules/services/web-apps/discourse.nix
index d3ae072f86a8..8d5302ba267b 100644
--- a/nixos/modules/services/web-apps/discourse.nix
+++ b/nixos/modules/services/web-apps/discourse.nix
@@ -475,21 +475,16 @@ in
       plugins = lib.mkOption {
         type = lib.types.listOf lib.types.package;
         default = [];
-        example = ''
-          [
-            (pkgs.fetchFromGitHub {
-              owner = "discourse";
-              repo = "discourse-spoiler-alert";
-              rev = "e200cfa571d252cab63f3d30d619b370986e4cee";
-              sha256 = "0ya69ix5g77wz4c9x9gmng6l25ghb5xxlx3icr6jam16q14dzc33";
-            })
+        example = lib.literalExample ''
+          with config.services.discourse.package.plugins; [
+            discourse-canned-replies
+            discourse-github
           ];
         '';
         description = ''
-          <productname>Discourse</productname> plugins to install as a
-          list of derivations. As long as a plugin supports the
-          standard install method, packaging it should only require
-          fetching its source with an appropriate fetcher.
+          Plugins to install as part of
+          <productname>Discourse</productname>, expressed as a list of
+          derivations.
         '';
       };
 
diff --git a/nixos/modules/services/web-apps/discourse.xml b/nixos/modules/services/web-apps/discourse.xml
index bae562423213..1d6866e7b352 100644
--- a/nixos/modules/services/web-apps/discourse.xml
+++ b/nixos/modules/services/web-apps/discourse.xml
@@ -262,9 +262,31 @@ services.discourse = {
     <para>
       You can install <productname>Discourse</productname> plugins
       using the <xref linkend="opt-services.discourse.plugins" />
-      option. As long as a plugin supports the standard install
-      method, packaging it should only require fetching its source
-      with an appropriate fetcher.
+      option. Pre-packaged plugins are provided in
+      <literal>&lt;your_discourse_package_here&gt;.plugins</literal>. If
+      you want the full suite of plugins provided through
+      <literal>nixpkgs</literal>, you can also set the <xref
+      linkend="opt-services.discourse.package" /> option to
+      <literal>pkgs.discourseAllPlugins</literal>.
+    </para>
+
+    <para>
+      Plugins can be built with the
+      <literal>&lt;your_discourse_package_here&gt;.mkDiscoursePlugin</literal>
+      function. Normally, it should suffice to provide a
+      <literal>name</literal> and <literal>src</literal> attribute. If
+      the plugin has Ruby dependencies, however, they need to be
+      packaged in accordance with the <link
+      xlink:href="https://nixos.org/manual/nixpkgs/stable/#developing-with-ruby">Developing
+      with Ruby</link> section of the Nixpkgs manual and the
+      appropriate gem options set in <literal>bundlerEnvArgs</literal>
+      (normally <literal>gemdir</literal> is sufficient). A plugin's
+      Ruby dependencies are listed in its
+      <filename>plugin.rb</filename> file as function calls to
+      <literal>gem</literal>. To construct the corresponding
+      <filename>Gemfile</filename>, run <command>bundle
+      init</command>, then add the <literal>gem</literal> lines to it
+      verbatim.
     </para>
 
     <para>
@@ -280,7 +302,10 @@ services.discourse = {
     <para>
       For example, to add the <link
       xlink:href="https://github.com/discourse/discourse-spoiler-alert">discourse-spoiler-alert</link>
-      plugin and disable it by default:
+      and <link
+      xlink:href="https://github.com/discourse/discourse-solved">discourse-solved</link>
+      plugins, and disable <literal>discourse-spoiler-alert</literal>
+      by default:
 
 <programlisting>
 services.discourse = {
@@ -301,13 +326,9 @@ services.discourse = {
     <link linkend="opt-services.discourse.mail.outgoing.passwordFile">passwordFile</link> = "/path/to/smtp_password_file";
   };
   <link linkend="opt-services.discourse.mail.incoming.enable">mail.incoming.enable</link> = true;
-  <link linkend="opt-services.discourse.mail.incoming.enable">plugins</link> = [
-    (pkgs.fetchFromGitHub {
-      owner = "discourse";
-      repo = "discourse-spoiler-alert";
-      rev = "e200cfa571d252cab63f3d30d619b370986e4cee";
-      sha256 = "0ya69ix5g77wz4c9x9gmng6l25ghb5xxlx3icr6jam16q14dzc33";
-    })
+  <link linkend="opt-services.discourse.mail.incoming.enable">plugins</link> = with config.services.discourse.package.plugins; [
+    discourse-spoiler-alert
+    discourse-solved
   ];
   <link linkend="opt-services.discourse.siteSettings">siteSettings</link> = {
     plugins = {
diff --git a/nixos/modules/services/web-apps/icingaweb2/icingaweb2.nix b/nixos/modules/services/web-apps/icingaweb2/icingaweb2.nix
index eea49bda283b..f8f0854f1bcb 100644
--- a/nixos/modules/services/web-apps/icingaweb2/icingaweb2.nix
+++ b/nixos/modules/services/web-apps/icingaweb2/icingaweb2.nix
@@ -23,6 +23,16 @@ in {
       '';
     };
 
+    libraryPaths = mkOption {
+      type = attrsOf package;
+      default = { };
+      description = ''
+        Libraries to add to the Icingaweb2 library path.
+        The name of the attribute is the name of the library, the value
+        is the package to add.
+      '';
+    };
+
     virtualHost = mkOption {
       type = nullOr str;
       default = "icingaweb2";
@@ -167,6 +177,9 @@ in {
     services.phpfpm.pools = mkIf (cfg.pool == "${poolName}") {
       ${poolName} = {
         user = "icingaweb2";
+        phpEnv = {
+          ICINGAWEB_LIBDIR = toString (pkgs.linkFarm "icingaweb2-libdir" (mapAttrsToList (name: path: { inherit name path; }) cfg.libraryPaths));
+        };
         phpPackage = pkgs.php.withExtensions ({ enabled, all }: [ all.imagick ] ++ enabled);
         phpOptions = ''
           date.timezone = "${cfg.timezone}"
@@ -184,6 +197,11 @@ in {
       };
     };
 
+    services.icingaweb2.libraryPaths = {
+      ipl = pkgs.icingaweb2-ipl;
+      thirdparty = pkgs.icingaweb2-thirdparty;
+    };
+
     systemd.services."phpfpm-${poolName}".serviceConfig.ReadWritePaths = [ "/etc/icingaweb2" ];
 
     services.nginx = {
diff --git a/pkgs/applications/graphics/fig2dev/default.nix b/pkgs/applications/graphics/fig2dev/default.nix
index c7484f4cbfe7..31d14185dcd9 100644
--- a/pkgs/applications/graphics/fig2dev/default.nix
+++ b/pkgs/applications/graphics/fig2dev/default.nix
@@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchurl
+, fetchpatch
 , ghostscript
 , libpng
 , makeWrapper
@@ -20,6 +21,15 @@ stdenv.mkDerivation rec {
     sha256 = "1bm75lf9j54qpbjx8hzp6ixaayp1x9w4v3yxl6vxyw8g5m4sqdk3";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "CVE-2021-3561.patch";
+      # Using Debian patch since it is not possible to download it directly from Sourceforge
+      url = "https://sources.debian.org/data/main/f/fig2dev/1:3.2.8-3/debian/patches/33_sanitize-color.patch";
+      sha256 = "1bppr3li03nj4qjibnddr2f38mpk55pcn5z6k98pf00gabq33fgs";
+    })
+  ];
+
   nativeBuildInputs = [ makeWrapper ];
   buildInputs = [ libpng ];
 
diff --git a/pkgs/applications/misc/dstask/default.nix b/pkgs/applications/misc/dstask/default.nix
index cd1c659ec5bc..c17ed9b3af5e 100644
--- a/pkgs/applications/misc/dstask/default.nix
+++ b/pkgs/applications/misc/dstask/default.nix
@@ -36,7 +36,7 @@ buildGoModule rec {
     description = "Command line todo list with super-reliable git sync";
     homepage = src.meta.homepage;
     license = licenses.mit;
-    maintainers = with maintainers; [ stianlagstad foxit64 ];
+    maintainers = with maintainers; [ stianlagstad ];
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/applications/misc/gopacked/default.nix b/pkgs/applications/misc/gopacked/default.nix
index 57f6be40ab02..42b886e4c72b 100644
--- a/pkgs/applications/misc/gopacked/default.nix
+++ b/pkgs/applications/misc/gopacked/default.nix
@@ -19,7 +19,6 @@ buildGoModule rec {
     description = "A simple text-based Minecraft modpack manager";
     license = licenses.agpl3;
     homepage = src.meta.homepage;
-    maintainers = with maintainers; [ foxit64 ];
+    maintainers = with maintainers; [ ];
   };
-
 }
diff --git a/pkgs/applications/networking/cloudflared/default.nix b/pkgs/applications/networking/cloudflared/default.nix
index ed4ffffe451c..374062f0d80b 100644
--- a/pkgs/applications/networking/cloudflared/default.nix
+++ b/pkgs/applications/networking/cloudflared/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "cloudflared";
-  version = "2021.6.0";
+  version = "2021.7.0";
 
   src = fetchFromGitHub {
     owner  = "cloudflare";
     repo   = "cloudflared";
     rev    = version;
-    sha256 = "sha256-cX0kdBPDgwjHphxGWrnXohHPp1nzs4SnvCry4AxMtp0=";
+    sha256 = "sha256-FQejuKBDUCCcEq9ZmSMigdvqowTurCYEhOiXQN7exIE=";
   };
 
   vendorSha256 = null;
diff --git a/pkgs/applications/networking/instant-messengers/psi-plus/default.nix b/pkgs/applications/networking/instant-messengers/psi-plus/default.nix
index c9b4c7e52923..01a8a71f0326 100644
--- a/pkgs/applications/networking/instant-messengers/psi-plus/default.nix
+++ b/pkgs/applications/networking/instant-messengers/psi-plus/default.nix
@@ -1,14 +1,45 @@
-{ lib, mkDerivation, fetchFromGitHub, cmake
-, qtbase, qtmultimedia, qtx11extras, qttools, qtwebengine
-, libidn, qca-qt5, libXScrnSaver, hunspell
-, libsecret, libgcrypt, libotr, html-tidy, libgpgerror, libsignal-protocol-c
+{ lib
+, mkDerivation
+, fetchFromGitHub
+, cmake
+, qtbase
+, qtmultimedia
+, qtx11extras
+, qttools
+, libidn
+, qca-qt5
+, libXScrnSaver
+, hunspell
+, libsecret
+, libgcrypt
+, libotr
+, html-tidy
+, libgpgerror
+, libsignal-protocol-c
 , usrsctp
 
-# Voice messages
+, chatType ? "basic" # See the assertion below for available options
+, qtwebkit
+, qtwebengine
+
+, enablePlugins ? true
+
+  # Voice messages
 , voiceMessagesSupport ? true
 , gst_all_1
+
+, enablePsiMedia ? false
+, pkg-config
 }:
 
+assert builtins.elem (lib.toLower chatType) [
+  "basic" # Basic implementation, no web stuff involved
+  "webkit" # Legacy one, based on WebKit (see https://wiki.qt.io/Qt_WebKit)
+  "webengine" # QtWebEngine (see https://wiki.qt.io/QtWebEngine)
+];
+
+assert enablePsiMedia -> enablePlugins;
+
 mkDerivation rec {
   pname = "psi-plus";
   version = "1.5.1549";
@@ -21,19 +52,40 @@ mkDerivation rec {
   };
 
   cmakeFlags = [
-    "-DENABLE_PLUGINS=ON"
+    "-DCHAT_TYPE=${chatType}"
+    "-DENABLE_PLUGINS=${if enablePlugins then "ON" else "OFF"}"
+    "-DBUILD_PSIMEDIA=${if enablePsiMedia then "ON" else "OFF"}"
   ];
 
-  nativeBuildInputs = [ cmake qttools ];
+  nativeBuildInputs = [
+    cmake
+    qttools
+  ] ++ lib.optionals enablePsiMedia [
+    pkg-config
+  ];
 
   buildInputs = [
-    qtbase qtmultimedia qtx11extras qtwebengine
-    libidn qca-qt5 libXScrnSaver hunspell
-    libsecret libgcrypt libotr html-tidy libgpgerror libsignal-protocol-c
+    qtbase
+    qtmultimedia
+    qtx11extras
+    libidn
+    qca-qt5
+    libXScrnSaver
+    hunspell
+    libsecret
+    libgcrypt
+    libotr
+    html-tidy
+    libgpgerror
+    libsignal-protocol-c
     usrsctp
   ] ++ lib.optionals voiceMessagesSupport [
     gst_all_1.gst-plugins-base
     gst_all_1.gst-plugins-good
+  ] ++ lib.optionals (chatType == "webkit") [
+    qtwebkit
+  ] ++ lib.optionals (chatType == "webengine") [
+    qtwebengine
   ];
 
   preFixup = lib.optionalString voiceMessagesSupport ''
diff --git a/pkgs/applications/science/math/mathematica/l10ns.nix b/pkgs/applications/science/math/mathematica/l10ns.nix
index d9f6a0c74e82..7de63c287eaa 100644
--- a/pkgs/applications/science/math/mathematica/l10ns.nix
+++ b/pkgs/applications/science/math/mathematica/l10ns.nix
@@ -8,10 +8,10 @@ let allVersions = with lib; flip map
   # N.B. Versions in this list should be ordered from newest to oldest.
   [
     {
-      version = "12.3.0";
+      version = "12.3.1";
       lang = "en";
       language = "English";
-      sha256 = "045df045f6e796ded59f64eb2e0f1949ac88dcba1d5b6e05fb53ea0a4aed7215";
+      sha256 = "51b9cab12fd91b009ea7ad4968a2c8a59e94dc55d2e6cc1d712acd5ba2c4d509";
     }
     {
       version = "11.3.0";
diff --git a/pkgs/applications/virtualization/docker/default.nix b/pkgs/applications/virtualization/docker/default.nix
index ee7c4d6bcfad..ec358507c2d2 100644
--- a/pkgs/applications/virtualization/docker/default.nix
+++ b/pkgs/applications/virtualization/docker/default.nix
@@ -8,7 +8,7 @@ rec {
       , moby-src
       , runcRev, runcSha256
       , containerdRev, containerdSha256
-      , tiniRev, tiniSha256, buildxSupport ? false
+      , tiniRev, tiniSha256, buildxSupport ? true
       # package dependencies
       , stdenv, fetchFromGitHub, buildGoPackage
       , makeWrapper, installShellFiles, pkg-config, glibc
@@ -77,6 +77,10 @@ rec {
 
       extraPath = optionals (stdenv.isLinux) (makeBinPath [ iproute2 iptables e2fsprogs xz xfsprogs procps util-linux git ]);
 
+      postPatch = ''
+        patchShebangs hack/make.sh hack/make/
+      '';
+
       buildPhase = ''
         export GOCACHE="$TMPDIR/go-cache"
         # build engine
@@ -88,11 +92,6 @@ rec {
         cd -
       '';
 
-      postPatch = ''
-        patchShebangs .
-        substituteInPlace ./hack/make.sh --replace libsystemd-journal libsystemd
-      '';
-
       installPhase = ''
         cd ./go/src/${goPackagePath}
         install -Dm755 ./bundles/dynbinary-daemon/dockerd $out/libexec/docker/dockerd
@@ -144,6 +143,14 @@ rec {
       sqlite lvm2 btrfs-progs systemd libseccomp
     ] ++ optionals (buildxSupport) [ docker-buildx ];
 
+    postPatch = ''
+      patchShebangs man scripts/build/
+      substituteInPlace ./scripts/build/.variables --replace "set -eu" ""
+    '' + optionalString buildxSupport ''
+      substituteInPlace ./cli-plugins/manager/manager_unix.go --replace /usr/libexec/docker/cli-plugins \
+          ${lib.strings.makeSearchPathOutput "bin" "libexec/docker/cli-plugins" [docker-buildx]}
+    '';
+
     # Keep eyes on BUILDTIME format - https://github.com/docker/cli/blob/${version}/scripts/build/.variables
     buildPhase = ''
       export GOCACHE="$TMPDIR/go-cache"
@@ -162,14 +169,6 @@ rec {
       cd -
     '';
 
-    postPatch = ''
-      patchShebangs .
-      substituteInPlace ./scripts/build/.variables --replace "set -eu" ""
-    '' + optionalString buildxSupport ''
-      substituteInPlace ./cli-plugins/manager/manager_unix.go --replace /usr/libexec/docker/cli-plugins \
-          ${lib.strings.makeSearchPathOutput "bin" "libexec/docker/cli-plugins" [docker-buildx]}
-    '';
-
     outputs = ["out" "man"];
 
     installPhase = ''
@@ -211,7 +210,7 @@ rec {
       homepage = "https://www.docker.com/";
       description = "An open source project to pack, ship and run any application as a lightweight container";
       license = licenses.asl20;
-      maintainers = with maintainers; [ offline tailhook vdemeester periklis ];
+      maintainers = with maintainers; [ offline tailhook vdemeester periklis mikroskeem ];
       platforms = with platforms; linux ++ darwin;
     };
 
@@ -222,14 +221,14 @@ rec {
   # Get revisions from
   # https://github.com/moby/moby/tree/${version}/hack/dockerfile/install/*
   docker_20_10 = callPackage dockerGen rec {
-    version = "20.10.6";
+    version = "20.10.7";
     rev = "v${version}";
-    sha256 = "15kknb26vyzjgqmn8r81a1sy1i5br6bvngqd5xljihppnxvp2gvl";
+    sha256 = "1r854jrjph4v1n5lr82z0cl0241ycili4qr3qh3k3bmqx790cds3";
     moby-src = fetchFromGitHub {
       owner = "moby";
       repo = "moby";
       rev = "v${version}";
-      sha256 = "1l4ra9bsvydaxd2fy7dgxp7ynpp0mrlwvcdhxiafw596559ab6qk";
+      sha256 = "0xhn11kgcbzda4z9j0rflvq0nfivizh3jrzhanwn5vnghafy4zqw";
     };
     runcRev = "b9ee9c6314599f1b4a7f497e1f1f856fe433d3b7"; # v1.0.0-rc95
     runcSha256 = "18sbvmlvb6kird4w3rqsfrjdj7n25firabvdxsl0rxjfy9r1g2xb";
diff --git a/pkgs/data/fonts/kanit/default.nix b/pkgs/data/fonts/kanit/default.nix
new file mode 100644
index 000000000000..9b5be79061c1
--- /dev/null
+++ b/pkgs/data/fonts/kanit/default.nix
@@ -0,0 +1,39 @@
+{ lib, stdenv, fetchFromGitHub }:
+
+stdenv.mkDerivation rec {
+  pname = "kanit";
+  version = "unstable-2020-06-16";
+
+  src = fetchFromGitHub {
+    owner = "cadsondemak";
+    repo = pname;
+    rev = "467dfe842185681d8042cd608b8291199dd37cda";
+    sha256 = "0p0klb0376r8ki4ap2j99j7jcsq6wgb7m1hf3j1dkncwm7ikmg3h";
+  };
+
+  installPhase = ''
+    mkdir -p $out/share/doc/${pname}/css/ $out/share/fonts/{opentype,truetype}
+
+    cp $src/OFL.txt $src/documentation/{BRIEF.md,features.html} $out/share/doc/${pname}
+    cp $src/documentation/css/fonts.css $out/share/doc/${pname}/css
+    cp $src/fonts/otf/*.otf $out/share/fonts/opentype
+    cp $src/fonts/ttf/*.ttf $out/share/fonts/truetype
+  '';
+
+  meta = with lib; {
+    homepage = "https://cadsondemak.github.io/kanit/";
+    description = "A loopless Thai and sans serif Latin typeface for contemporary and futuristic uses";
+    longDescription = ''
+      Kanit means mathematics in Thai, and the Kanit typeface family is a formal
+      Loopless Thai and Sans Latin design. It is a combination of concepts,
+      mixing a Humanist Sans Serif motif with the curves of Capsulated Geometric
+      styles that makes it suitable for various uses, contemporary and
+      futuristic. A notable detail is that the stroke terminals have flat angles,
+      which allows the design to enjoy decreased spacing between letters while
+      preserving readability and legibility at smaller point sizes.
+    '';
+    license = licenses.ofl;
+    platforms = platforms.all;
+    maintainers = [ maintainers.toastal ];
+  };
+}
diff --git a/pkgs/development/python-modules/aws-sam-translator/default.nix b/pkgs/development/python-modules/aws-sam-translator/default.nix
index 166ba0b72498..bad8ee9bd2de 100644
--- a/pkgs/development/python-modules/aws-sam-translator/default.nix
+++ b/pkgs/development/python-modules/aws-sam-translator/default.nix
@@ -10,11 +10,11 @@
 
 buildPythonPackage rec {
   pname = "aws-sam-translator";
-  version = "1.36.0";
+  version = "1.37.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "fa1b990d9329d19052e7b91cf0b19371ed9d31a529054b616005884cd662b584";
+    sha256 = "0p2qd8gwxsfq17nmrlkpf31aqbfzjrwjk3n4p8vhci8mm11dk138";
   };
 
   # Tests are not included in the PyPI package
diff --git a/pkgs/development/tools/aws-sam-cli/default.nix b/pkgs/development/tools/aws-sam-cli/default.nix
index 3837e2e37076..f07bcdd5fd5b 100644
--- a/pkgs/development/tools/aws-sam-cli/default.nix
+++ b/pkgs/development/tools/aws-sam-cli/default.nix
@@ -5,11 +5,11 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "aws-sam-cli";
-  version = "1.23.0";
+  version = "1.26.0";
 
   src = python3.pkgs.fetchPypi {
     inherit pname version;
-    sha256 = "0j0q6p08c3l9z0yc2cggw797k47cjh6ljpchiqgg0fh6mk32215f";
+    sha256 = "11aqdwhs7wa6cp9zijqi4in3zvwirfnlcy45rrnsq0jdsh3i9hbh";
   };
 
   # Tests are not included in the PyPI package
@@ -40,6 +40,8 @@ python3.pkgs.buildPythonApplication rec {
   # fix over-restrictive version bounds
   postPatch = ''
     substituteInPlace requirements/base.txt \
+      --replace "click~=7.1" "click~=8.0" \
+      --replace "Flask~=1.1.2" "Flask~=2.0" \
       --replace "dateparser~=0.7" "dateparser>=0.7" \
       --replace "docker~=4.2.0" "docker>=4.2.0" \
       --replace "requests==2.23.0" "requests~=2.24" \
diff --git a/pkgs/games/mudlet/default.nix b/pkgs/games/mudlet/default.nix
index b6f66b30769d..139baece4a6f 100644
--- a/pkgs/games/mudlet/default.nix
+++ b/pkgs/games/mudlet/default.nix
@@ -1,24 +1,24 @@
-{ fetchFromGitHub, fetchpatch, lib, stdenv, wrapQtAppsHook, git, pcre, pugixml, qtbase, libsForQt5, qtmultimedia, qttools, yajl, libzip, hunspell
-, boost, libGLU, lua, cmake,  which, }:
+{ fetchFromGitHub, lib, stdenv, wrapQtAppsHook, git, pcre, pugixml, qtbase, libsForQt5, libsecret, qtmultimedia, qttools, yajl, libzip, hunspell
+, boost, libGLU, lua, cmake,  which, pkg-config, }:
 
 let
   luaEnv = lua.withPackages(ps: with ps; [ luazip luafilesystem lrexlib-pcre luasql-sqlite3 lua-yajl luautf8 ]);
 in
 stdenv.mkDerivation rec {
   pname = "mudlet";
-  version = "4.9.1";
+  version = "4.12.0";
 
   src = fetchFromGitHub {
     owner = "Mudlet";
     repo = "Mudlet";
     rev = "Mudlet-${version}";
     fetchSubmodules = true;
-    sha256 = "0i022qcmlq4xwl2yh4xd5qdc0ag52605qmqqz6bim0h8f3dp8cx1";
+    sha256 = "023plm5mwm15xikmdh1mq3gx1n7y4a0r0kw9fvk3rvm9brm78hzp";
   };
 
-  nativeBuildInputs = [ cmake wrapQtAppsHook git qttools which ];
+  nativeBuildInputs = [ pkg-config cmake wrapQtAppsHook git qttools which ];
   buildInputs = [
-    pcre pugixml qtbase libsForQt5.qtkeychain qtmultimedia luaEnv libzip libGLU yajl boost hunspell
+    pcre pugixml qtbase libsForQt5.qtkeychain qtmultimedia luaEnv libsecret libzip libGLU yajl boost hunspell
   ];
 
   WITH_FONTS = "NO";
diff --git a/pkgs/games/the-powder-toy/default.nix b/pkgs/games/the-powder-toy/default.nix
index 703578c2d4e8..1dec8da537a7 100644
--- a/pkgs/games/the-powder-toy/default.nix
+++ b/pkgs/games/the-powder-toy/default.nix
@@ -1,28 +1,27 @@
-{ lib, stdenv, fetchFromGitHub, scons, pkg-config, SDL2, lua, fftwFloat,
-  zlib, bzip2, curl, darwin }:
+{ lib, stdenv, fetchFromGitHub, meson, luajit, ninja, pkg-config
+, python3, SDL2, lua, fftwFloat, zlib, bzip2, curl, darwin }:
 
 stdenv.mkDerivation rec {
   pname = "the-powder-toy";
-  version = "95.0";
+  version = "96.0.348";
 
   src = fetchFromGitHub {
     owner = "The-Powder-Toy";
     repo = "The-Powder-Toy";
     rev = "v${version}";
-    sha256 = "18rp2g1mj0gklra06wm9dm57h73hmm301npndh0y8ap192i5s8sa";
+    sha256 = "sha256-PAnjNeqGJPW7TeoIsaOnuOb1loyKs8pjBseKoD0CvQU=";
   };
 
-  nativeBuildInputs = [ scons pkg-config ];
+  nativeBuildInputs = [ meson ninja pkg-config python3 ];
 
-  propagatedBuildInputs = lib.optionals stdenv.isDarwin
-    [ darwin.apple_sdk.frameworks.Cocoa ];
-
-  buildInputs = [ SDL2 lua fftwFloat zlib bzip2 curl ];
+  buildInputs = [ luajit SDL2 lua fftwFloat zlib bzip2 curl ];
 
   installPhase = ''
-    install -Dm 755 build/powder* "$out/bin/powder"
+    install -Dm 755 powder $out/bin/powder
   '';
 
+  propagatedBuildInputs = lib.optionals stdenv.isDarwin [ darwin.apple_sdk.frameworks.Cocoa ];
+
   enableParallelBuilding = true;
 
   meta = with lib; {
diff --git a/pkgs/misc/vscode-extensions/default.nix b/pkgs/misc/vscode-extensions/default.nix
index 19b816fbc77e..ecddd603d560 100644
--- a/pkgs/misc/vscode-extensions/default.nix
+++ b/pkgs/misc/vscode-extensions/default.nix
@@ -1335,8 +1335,8 @@ let
         mktplcRef = {
           name = "vspacecode";
           publisher = "VSpaceCode";
-          version = "0.9.1";
-          sha256 = "sha256-/qJKYXR0DznqwF7XuJsz+OghIBzdWjm6dAlaRX4wdRU=";
+          version = "0.10.1";
+          sha256 = "sha256-H7SCC/ZhDswMQjLX+qpQa6A1N83MobJRPC4pyIbZ1kA=";
         };
         meta = {
           license = lib.licenses.mit;
@@ -1347,8 +1347,8 @@ let
         mktplcRef = {
           name = "whichkey";
           publisher = "VSpaceCode";
-          version = "0.8.5";
-          sha256 = "sha256-p5fukIfk/tZFQrkf6VuT4fjmeGtKAqHDh6r6ky847ks=";
+          version = "0.9.2";
+          sha256 = "sha256-f+t2d8iWW88OYzuYFxzQPnmFMgx/DELBywYhA8A/0EU=";
         };
         meta = {
           license = lib.licenses.mit;
diff --git a/pkgs/os-specific/linux/kernel/linux-4.4.nix b/pkgs/os-specific/linux/kernel/linux-4.4.nix
index 9a5dcb7e1ad1..5b7050b7069a 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.4.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.4.nix
@@ -1,13 +1,13 @@
 { buildPackages, fetchurl, perl, buildLinux, nixosTests, stdenv, ... } @ args:
 
 buildLinux (args // rec {
-  version = "4.4.274";
+  version = "4.4.275";
   extraMeta.branch = "4.4";
   extraMeta.broken = stdenv.isAarch64;
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "1n4wawk8fi5s22177994vq9hzay49cackdabl9r1x8y2i9jcqmg4";
+    sha256 = "1aiwq6019sibsw5smj6ii28cr64dv24c19k4n8c09nakhmhcg94i";
   };
 
   kernelTests = args.kernelTests or [ nixosTests.kernel-generic.linux_4_4 ];
diff --git a/pkgs/os-specific/linux/kernel/linux-4.9.nix b/pkgs/os-specific/linux/kernel/linux-4.9.nix
index a4d57135e4af..71a5f5eec316 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.9.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.9.nix
@@ -1,13 +1,13 @@
 { buildPackages, fetchurl, perl, buildLinux, nixosTests, stdenv, ... } @ args:
 
 buildLinux (args // rec {
-  version = "4.9.274";
+  version = "4.9.275";
   extraMeta.branch = "4.9";
   extraMeta.broken = stdenv.isAarch64;
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "0xdi33f25lbpplx36cz7chdsn7a6xdjvwxgvnmvrw7b2y0g45m95";
+    sha256 = "08mz7mzmhk5n1gwadrc5fw8s40jk0rayvdpjcricl4sv56574lb6";
   };
 
   kernelTests = args.kernelTests or [ nixosTests.kernel-generic.linux_4_9 ];
diff --git a/pkgs/os-specific/linux/kernel/linux-5.13.nix b/pkgs/os-specific/linux/kernel/linux-5.13.nix
index c13b37a74aac..da90ee69de80 100644
--- a/pkgs/os-specific/linux/kernel/linux-5.13.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.13.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "5.13.1";
+  version = "5.13.2";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,7 +13,7 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "140a9ngzlarin84mnnwgx6z3ckw431d578aixxl60ll5853gdakj";
+    sha256 = "0dx9khk7fh003xyb3xix0kc0rmjncg7ric5p830zhadnrw4hv563";
   };
 
   kernelTests = args.kernelTests or [ nixosTests.kernel-generic.linux_5_13 ];
diff --git a/pkgs/os-specific/linux/kernel/linux-libre.nix b/pkgs/os-specific/linux/kernel/linux-libre.nix
index 76b5c1cf146d..656324569631 100644
--- a/pkgs/os-specific/linux/kernel/linux-libre.nix
+++ b/pkgs/os-specific/linux/kernel/linux-libre.nix
@@ -1,8 +1,8 @@
 { stdenv, lib, fetchsvn, linux
 , scripts ? fetchsvn {
     url = "https://www.fsfla.org/svn/fsfla/software/linux-libre/releases/branches/";
-    rev = "18132";
-    sha256 = "01mgpfx5cddq4bgffydkxpm3xlgf7zfjr1c1icsyn7f2pibd114q";
+    rev = "18165";
+    sha256 = "17birwp6byxr4yb8cbc0afssli84ds1p2sisjl4g6rx3r7yqvsxn";
   }
 , ...
 }:
diff --git a/pkgs/os-specific/linux/kernel/linux-rt-5.4.nix b/pkgs/os-specific/linux/kernel/linux-rt-5.4.nix
index ec3aa7f7006e..4c49dc9c42a4 100644
--- a/pkgs/os-specific/linux/kernel/linux-rt-5.4.nix
+++ b/pkgs/os-specific/linux/kernel/linux-rt-5.4.nix
@@ -6,7 +6,7 @@
 , ... } @ args:
 
 let
-  version = "5.4.123-rt59"; # updated by ./update-rt.sh
+  version = "5.4.129-rt61"; # updated by ./update-rt.sh
   branch = lib.versions.majorMinor version;
   kversion = builtins.elemAt (lib.splitString "-" version) 0;
 in buildLinux (args // {
@@ -14,14 +14,14 @@ in buildLinux (args // {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${kversion}.tar.xz";
-    sha256 = "1pi223dls52piw65s3v4ml23wdyy73xpbdvp511187b6zgzk7zlf";
+    sha256 = "1ps64gx85lmbriq445hd2hcv4g4b1d1cwf4r3nd90x6i2cj4c9j4";
   };
 
   kernelPatches = let rt-patch = {
     name = "rt";
     patch = fetchurl {
       url = "mirror://kernel/linux/kernel/projects/rt/${branch}/older/patch-${version}.patch.xz";
-      sha256 = "1m1mnmk7h35p7dv6mg3pla6pw3b645hbbccjmp1jc3fyn6qiy6fq";
+      sha256 = "0b3hp6a7afkjqd7an4hj423nq6flwzd42kjcyk4pifv5fx6c7pgq";
     };
   }; in [ rt-patch ] ++ kernelPatches;
 
diff --git a/pkgs/os-specific/linux/nvidia-x11/builder.sh b/pkgs/os-specific/linux/nvidia-x11/builder.sh
index 70fc5126a939..e6ad62b1128d 100755
--- a/pkgs/os-specific/linux/nvidia-x11/builder.sh
+++ b/pkgs/os-specific/linux/nvidia-x11/builder.sh
@@ -20,7 +20,7 @@ buildPhase() {
         sysSrc=$(echo $kernel/lib/modules/$kernelVersion/source)
         sysOut=$(echo $kernel/lib/modules/$kernelVersion/build)
         unset src # used by the nv makefile
-        make IGNORE_PREEMPT_RT_PRESENCE=1 SYSSRC=$sysSrc SYSOUT=$sysOut module -j$NIX_BUILD_CORES
+        make IGNORE_PREEMPT_RT_PRESENCE=1 NV_BUILD_SUPPORTS_HMM=1 SYSSRC=$sysSrc SYSOUT=$sysOut module -j$NIX_BUILD_CORES
 
         cd ..
     fi
diff --git a/pkgs/servers/icingaweb2/default.nix b/pkgs/servers/icingaweb2/default.nix
index 6e8cdd5dca41..7923674a3b76 100644
--- a/pkgs/servers/icingaweb2/default.nix
+++ b/pkgs/servers/icingaweb2/default.nix
@@ -1,14 +1,14 @@
-{ stdenv, lib, fetchFromGitHub, makeWrapper, php }:
+{ stdenvNoCC, lib, fetchFromGitHub, makeWrapper, php }:
 
-stdenv.mkDerivation rec {
+stdenvNoCC.mkDerivation rec {
   pname = "icingaweb2";
-  version = "2.8.3";
+  version = "2.9.0";
 
   src = fetchFromGitHub {
     owner = "Icinga";
     repo = "icingaweb2";
     rev = "v${version}";
-    sha256 = "sha256-wk6rTEYRS0q0HpQRbFAmfeYVrF/xLP/HchEXNqqNpYg=";
+    sha256 = "1vp2gdvgvw960178yaqql6iza0rg2h8japsnass3kkrwrmb2liq5";
   };
 
   nativeBuildInputs = [ makeWrapper ];
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
       Analyse problems and act on them.
     '';
     homepage = "https://www.icinga.com/products/icinga-web-2/";
-    license = licenses.gpl2;
+    license = licenses.gpl2Only;
     platforms = platforms.all;
     maintainers = with maintainers; [ das_j ];
   };
diff --git a/pkgs/servers/icingaweb2/ipl.nix b/pkgs/servers/icingaweb2/ipl.nix
new file mode 100644
index 000000000000..35b9357009c4
--- /dev/null
+++ b/pkgs/servers/icingaweb2/ipl.nix
@@ -0,0 +1,26 @@
+{ stdenvNoCC, lib, fetchFromGitHub }:
+
+stdenvNoCC.mkDerivation rec {
+  pname = "icingaweb2-ipl";
+  version = "0.6.0";
+
+  src = fetchFromGitHub {
+    owner = "Icinga";
+    repo = "icinga-php-library";
+    rev = "v${version}";
+    sha256 = "0nzvd84r9f1mypfhq4p37hsvkrbd5wzgs1m9qhj45ncvf5rq49f1";
+  };
+
+  installPhase = ''
+    mkdir -p "$out"
+    cp -r * "$out"
+  '';
+
+  meta = {
+    description = "PHP library package for Icingaweb 2";
+    homepage = "https://github.com/Icinga/icinga-php-library";
+    license = lib.licenses.mit;
+    platforms = lib.platforms.all;
+    maintainers = with lib.maintainers; [ das_j ];
+  };
+}
diff --git a/pkgs/servers/icingaweb2/thirdparty.nix b/pkgs/servers/icingaweb2/thirdparty.nix
new file mode 100644
index 000000000000..ae3ce9538c95
--- /dev/null
+++ b/pkgs/servers/icingaweb2/thirdparty.nix
@@ -0,0 +1,26 @@
+{ stdenvNoCC, lib, fetchFromGitHub }:
+
+stdenvNoCC.mkDerivation rec {
+  pname = "icingaweb2-thirdparty";
+  version = "0.10.0";
+
+  src = fetchFromGitHub {
+    owner = "Icinga";
+    repo = "icinga-php-thirdparty";
+    rev = "v${version}";
+    sha256 = "03zq6p2xyjrln8hdfks70hg8mwa51d3pnkswnzavpbxlbk83vzz5";
+  };
+
+  installPhase = ''
+    mkdir -p "$out"
+    cp -r * "$out"
+  '';
+
+  meta = {
+    description = "Third party dependencies for Icingaweb 2";
+    homepage = "https://github.com/Icinga/icinga-php-thirdparty";
+    license = lib.licenses.mit;
+    platforms = lib.platforms.all;
+    maintainers = with lib.maintainers; [ das_j ];
+  };
+}
diff --git a/pkgs/servers/janus-gateway/default.nix b/pkgs/servers/janus-gateway/default.nix
new file mode 100644
index 000000000000..6c6d6759f329
--- /dev/null
+++ b/pkgs/servers/janus-gateway/default.nix
@@ -0,0 +1,59 @@
+{ lib, stdenv, fetchFromGitHub, autoreconfHook, pkg-config, gengetopt
+, glib, libconfig, libnice, jansson, boringssl, zlib, srtp, libuv
+, libmicrohttpd, curl, libwebsockets, sofia_sip, libogg, libopus
+, usrsctp, ffmpeg
+}:
+
+let
+  libwebsockets_janus = libwebsockets.overrideAttrs (_: {
+    configureFlags = [
+      "-DLWS_MAX_SMP=1"
+      "-DLWS_WITHOUT_EXTENSIONS=0"
+    ];
+  });
+in
+
+stdenv.mkDerivation rec {
+  pname = "janus-gateway";
+  version = "0.11.3";
+
+  src = fetchFromGitHub {
+    owner = "meetecho";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "15nadpz67w24f4wz8ya0kx0a1jc4wxv1kl0d5fr7kckkdyijh7gz";
+  };
+
+  nativeBuildInputs = [ autoreconfHook pkg-config gengetopt ];
+
+  buildInputs = [
+    glib libconfig libnice jansson boringssl zlib srtp libuv libmicrohttpd
+    curl libwebsockets_janus sofia_sip libogg libopus usrsctp ffmpeg
+  ];
+
+  enableParallelBuilding = true;
+
+  configureFlags = [
+    "--enable-boringssl=${boringssl}"
+    "--enable-libsrtp2"
+    "--enable-turn-rest-api"
+    "--enable-json-logger"
+    "--enable-gelf-event-handler"
+    "--enable-post-processing"
+  ];
+
+  outputs = [ "out" "dev" "doc" "man" ];
+
+  postInstall = ''
+    moveToOutput share/janus "$doc"
+    moveToOutput etc "$doc"
+  '';
+
+  meta = with lib; {
+    description = "General purpose WebRTC server";
+    homepage = "https://janus.conf.meetecho.com/";
+    license = licenses.gpl3Only;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ fpletz ];
+  };
+}
diff --git a/pkgs/servers/monitoring/telegraf/default.nix b/pkgs/servers/monitoring/telegraf/default.nix
index 0a60ebc77c5c..578bb10652a0 100644
--- a/pkgs/servers/monitoring/telegraf/default.nix
+++ b/pkgs/servers/monitoring/telegraf/default.nix
@@ -27,6 +27,6 @@ buildGoModule rec {
     description = "The plugin-driven server agent for collecting & reporting metrics";
     license = licenses.mit;
     homepage = "https://www.influxdata.com/time-series-platform/telegraf/";
-    maintainers = with maintainers; [ mic92 roblabla timstott foxit64 ];
+    maintainers = with maintainers; [ mic92 roblabla timstott ];
   };
 }
diff --git a/pkgs/servers/web-apps/discourse/default.nix b/pkgs/servers/web-apps/discourse/default.nix
index 5a3301040d33..72ea8a943dc2 100644
--- a/pkgs/servers/web-apps/discourse/default.nix
+++ b/pkgs/servers/web-apps/discourse/default.nix
@@ -9,13 +9,13 @@
 }:
 
 let
-  version = "2.7.4";
+  version = "2.7.5";
 
   src = fetchFromGitHub {
     owner = "discourse";
     repo = "discourse";
     rev = "v${version}";
-    sha256 = "sha256-3cvrdWBXRM5F8qFEqbe8ru1U0wBqCkRxK7GAV0beJNk=";
+    sha256 = "sha256-OykWaiBAHcZy41i+aRzBHCRgwnfQUBijHjb+ofIk25M=";
   };
 
   runtimeDeps = [
@@ -64,7 +64,6 @@ let
       });
     in
       stdenv.mkDerivation (builtins.removeAttrs args [ "bundlerEnvArgs" ] // {
-        inherit name pname version src meta;
         pluginName = if name != null then name else "${pname}-${version}";
         phases = [ "unpackPhase" "installPhase" ];
         installPhase = ''
@@ -151,6 +150,7 @@ let
       brotli
       procps
       nodePackages.uglify-js
+      nodePackages.terser
     ];
 
     patches = [
diff --git a/pkgs/servers/web-apps/discourse/plugins/all-plugins.nix b/pkgs/servers/web-apps/discourse/plugins/all-plugins.nix
index e6640cbbe975..f64fbb137dfc 100644
--- a/pkgs/servers/web-apps/discourse/plugins/all-plugins.nix
+++ b/pkgs/servers/web-apps/discourse/plugins/all-plugins.nix
@@ -3,10 +3,10 @@ let
   callPackage = newScope args;
 in
 {
-  discourse-spoiler-alert = callPackage ./discourse-spoiler-alert {};
-  discourse-solved = callPackage ./discourse-solved {};
   discourse-canned-replies = callPackage ./discourse-canned-replies {};
-  discourse-math = callPackage ./discourse-math {};
   discourse-github = callPackage ./discourse-github {};
+  discourse-math = callPackage ./discourse-math {};
+  discourse-solved = callPackage ./discourse-solved {};
+  discourse-spoiler-alert = callPackage ./discourse-spoiler-alert {};
   discourse-yearly-review = callPackage ./discourse-yearly-review {};
 }
diff --git a/pkgs/servers/web-apps/discourse/plugins/discourse-canned-replies/default.nix b/pkgs/servers/web-apps/discourse/plugins/discourse-canned-replies/default.nix
index 05c153cd70b1..558abec36f47 100644
--- a/pkgs/servers/web-apps/discourse/plugins/discourse-canned-replies/default.nix
+++ b/pkgs/servers/web-apps/discourse/plugins/discourse-canned-replies/default.nix
@@ -1,11 +1,17 @@
-{ mkDiscoursePlugin, fetchFromGitHub }:
+{ lib, mkDiscoursePlugin, fetchFromGitHub }:
 
 mkDiscoursePlugin {
   name = "discourse-canned-replies";
   src = fetchFromGitHub {
     owner = "discourse";
     repo = "discourse-canned-replies";
-    rev = "7ee748f18a276aca42185e2079c1d4cadeecdaf8";
-    sha256 = "0j10kxfr6v2rdd58smg2i7iac46z74qnnjk8b91jd1svazhis1ph";
+    rev = "e3f1de8928df5955b64994079b7e2073556e5456";
+    sha256 = "1g4fazm6cn6hbfd08mq2zhc6dgm4qj1r1f1amhbgxhk6qsxf42cd";
+  };
+  meta = with lib; {
+    homepage = "https://github.com/discourse/discourse-canned-replies";
+    maintainers = with maintainers; [ talyz ];
+    license = licenses.gpl2Only;
+    description = "Adds support for inserting a canned reply into the composer window via a UI";
   };
 }
diff --git a/pkgs/servers/web-apps/discourse/plugins/discourse-github/Gemfile b/pkgs/servers/web-apps/discourse/plugins/discourse-github/Gemfile
index f0205f4ff1df..7c0e7f435ae7 100644
--- a/pkgs/servers/web-apps/discourse/plugins/discourse-github/Gemfile
+++ b/pkgs/servers/web-apps/discourse/plugins/discourse-github/Gemfile
@@ -1,3 +1,9 @@
-source 'https://rubygems.org'
+# frozen_string_literal: true
+
+source "https://rubygems.org"
+
+git_source(:github) { |repo_name| "https://github.com/#{repo_name}" }
+
+# gem "rails"
 gem 'sawyer', '0.8.2'
 gem 'octokit', '4.21.0'
diff --git a/pkgs/servers/web-apps/discourse/plugins/discourse-github/Gemfile.lock b/pkgs/servers/web-apps/discourse/plugins/discourse-github/Gemfile.lock
index f28833a35c0f..0486ea1402b9 100644
--- a/pkgs/servers/web-apps/discourse/plugins/discourse-github/Gemfile.lock
+++ b/pkgs/servers/web-apps/discourse/plugins/discourse-github/Gemfile.lock
@@ -1,21 +1,25 @@
 GEM
   remote: https://rubygems.org/
   specs:
-    addressable (2.7.0)
+    addressable (2.8.0)
       public_suffix (>= 2.0.2, < 5.0)
-    faraday (1.4.2)
+    faraday (1.5.0)
       faraday-em_http (~> 1.0)
       faraday-em_synchrony (~> 1.0)
       faraday-excon (~> 1.1)
+      faraday-httpclient (~> 1.0.1)
       faraday-net_http (~> 1.0)
       faraday-net_http_persistent (~> 1.1)
+      faraday-patron (~> 1.0)
       multipart-post (>= 1.2, < 3)
       ruby2_keywords (>= 0.0.4)
     faraday-em_http (1.0.0)
     faraday-em_synchrony (1.0.0)
     faraday-excon (1.1.0)
+    faraday-httpclient (1.0.1)
     faraday-net_http (1.0.1)
     faraday-net_http_persistent (1.1.0)
+    faraday-patron (1.0.0)
     multipart-post (2.1.1)
     octokit (4.21.0)
       faraday (>= 0.9)
@@ -27,11 +31,11 @@ GEM
       faraday (> 0.8, < 2.0)
 
 PLATFORMS
-  ruby
+  x86_64-linux
 
 DEPENDENCIES
   octokit (= 4.21.0)
   sawyer (= 0.8.2)
 
 BUNDLED WITH
-   2.1.4
+   2.2.20
diff --git a/pkgs/servers/web-apps/discourse/plugins/discourse-github/default.nix b/pkgs/servers/web-apps/discourse/plugins/discourse-github/default.nix
index e5d8cff0a9fd..bb6d16bfe465 100644
--- a/pkgs/servers/web-apps/discourse/plugins/discourse-github/default.nix
+++ b/pkgs/servers/web-apps/discourse/plugins/discourse-github/default.nix
@@ -1,4 +1,4 @@
-{ mkDiscoursePlugin, fetchFromGitHub }:
+{ lib, mkDiscoursePlugin, fetchFromGitHub }:
 
 mkDiscoursePlugin {
   name = "discourse-github";
@@ -6,7 +6,14 @@ mkDiscoursePlugin {
   src = fetchFromGitHub {
     owner = "discourse";
     repo = "discourse-github";
-    rev = "151e353a5a1971157c70c2e2b0f56387f212a81f";
-    sha256 = "00kra6zd2k1f2vwcdvxnxnammzh72f5qxcqbb94m0z6maj598wdy";
+    rev = "154fd5ea597640c2259ce489b4ce75b48ac1973c";
+    sha256 = "0wb5p219z42rc035rnh2iwrbsj000nxa9shbmc325rzcg6xlhdhw";
   };
+  meta = with lib; {
+    homepage = "https://github.com/discourse/discourse-github";
+    maintainers = with maintainers; [ talyz ];
+    license = licenses.mit;
+    description = "Adds GitHub badges and linkback functionality";
+  };
+
 }
diff --git a/pkgs/servers/web-apps/discourse/plugins/discourse-github/gemset.nix b/pkgs/servers/web-apps/discourse/plugins/discourse-github/gemset.nix
index bad1f9629578..ae20ec895210 100644
--- a/pkgs/servers/web-apps/discourse/plugins/discourse-github/gemset.nix
+++ b/pkgs/servers/web-apps/discourse/plugins/discourse-github/gemset.nix
@@ -5,21 +5,21 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1fvchp2rhp2rmigx7qglf69xvjqvzq7x0g49naliw29r2bz656sy";
+      sha256 = "022r3m9wdxljpbya69y2i3h9g3dhhfaqzidf95m6qjzms792jvgp";
       type = "gem";
     };
-    version = "2.7.0";
+    version = "2.8.0";
   };
   faraday = {
-    dependencies = ["faraday-em_http" "faraday-em_synchrony" "faraday-excon" "faraday-net_http" "faraday-net_http_persistent" "multipart-post" "ruby2_keywords"];
+    dependencies = ["faraday-em_http" "faraday-em_synchrony" "faraday-excon" "faraday-httpclient" "faraday-net_http" "faraday-net_http_persistent" "faraday-patron" "multipart-post" "ruby2_keywords"];
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "07mhk70gv453pg38md346470hknyhipdqppnplq706ll3k3lzb7v";
+      sha256 = "0gwbii45plm9bljk22bwzhzxrc5xid8qx24f54vrm74q3zaz00ah";
       type = "gem";
     };
-    version = "1.4.2";
+    version = "1.5.0";
   };
   faraday-em_http = {
     groups = ["default"];
@@ -51,6 +51,16 @@
     };
     version = "1.1.0";
   };
+  faraday-httpclient = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0fyk0jd3ks7fdn8nv3spnwjpzx2lmxmg2gh4inz3by1zjzqg33sc";
+      type = "gem";
+    };
+    version = "1.0.1";
+  };
   faraday-net_http = {
     groups = ["default"];
     platforms = [];
@@ -71,6 +81,16 @@
     };
     version = "1.1.0";
   };
+  faraday-patron = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "19wgsgfq0xkski1g7m96snv39la3zxz6x7nbdgiwhg5v82rxfb6w";
+      type = "gem";
+    };
+    version = "1.0.0";
+  };
   multipart-post = {
     groups = ["default"];
     platforms = [];
diff --git a/pkgs/servers/web-apps/discourse/plugins/discourse-math/default.nix b/pkgs/servers/web-apps/discourse/plugins/discourse-math/default.nix
index 8cf2a4abc0d1..0e751c1dc545 100644
--- a/pkgs/servers/web-apps/discourse/plugins/discourse-math/default.nix
+++ b/pkgs/servers/web-apps/discourse/plugins/discourse-math/default.nix
@@ -1,11 +1,17 @@
-{ mkDiscoursePlugin, fetchFromGitHub }:
+{ lib, mkDiscoursePlugin, fetchFromGitHub }:
 
 mkDiscoursePlugin {
   name = "discourse-math";
   src = fetchFromGitHub {
     owner = "discourse";
     repo = "discourse-math";
-    rev = "143ddea4558ea9a1b3fd71635bc11e055763c8e7";
-    sha256 = "18pq5ybl3g34i39cpixc3nszvq8gx5yji58zlbbl6428mm011cbx";
+    rev = "aed0c83cee568d5239143bcf1df59c5fbe86b276";
+    sha256 = "1k6kpnhf8s2l0w9zr5pn3wvn8w0n3gwkv7qkv0mkhkzy246ag20z";
+  };
+  meta = with lib; {
+    homepage = "https://github.com/discourse/discourse-math";
+    maintainers = with maintainers; [ talyz ];
+    license = licenses.mit;
+    description = "Official MathJax support for Discourse";
   };
 }
diff --git a/pkgs/servers/web-apps/discourse/plugins/discourse-solved/default.nix b/pkgs/servers/web-apps/discourse/plugins/discourse-solved/default.nix
index c382a83d0893..2d451418bdd9 100644
--- a/pkgs/servers/web-apps/discourse/plugins/discourse-solved/default.nix
+++ b/pkgs/servers/web-apps/discourse/plugins/discourse-solved/default.nix
@@ -1,11 +1,17 @@
-{ mkDiscoursePlugin, fetchFromGitHub }:
+{ lib, mkDiscoursePlugin, fetchFromGitHub }:
 
 mkDiscoursePlugin {
   name = "discourse-solved";
   src = fetchFromGitHub {
     owner = "discourse";
     repo = "discourse-solved";
-    rev = "179611766d53974308e6f7def21836997c3c55fc";
-    sha256 = "sha256:1s77h42d3bv2lqw33akxh8ss482vxnz4d7qz6xicwqfwv34qjf03";
+    rev = "b96374bf4ab7e6d5cecb0761918b060a524eb9bf";
+    sha256 = "0zrv70p0wz93akpcj6gpwjkw7az3iz9bx4n2z630kyrlmxdbj32a";
+  };
+  meta = with lib; {
+    homepage = "https://github.com/discourse/discourse-solved";
+    maintainers = with maintainers; [ talyz ];
+    license = licenses.mit;
+    description = "Allow accepted answers on topics";
   };
 }
diff --git a/pkgs/servers/web-apps/discourse/plugins/discourse-spoiler-alert/default.nix b/pkgs/servers/web-apps/discourse/plugins/discourse-spoiler-alert/default.nix
index 8eba43e47e40..da47dbf182c6 100644
--- a/pkgs/servers/web-apps/discourse/plugins/discourse-spoiler-alert/default.nix
+++ b/pkgs/servers/web-apps/discourse/plugins/discourse-spoiler-alert/default.nix
@@ -1,11 +1,17 @@
-{ mkDiscoursePlugin, fetchFromGitHub }:
+{ lib, mkDiscoursePlugin, fetchFromGitHub }:
 
 mkDiscoursePlugin {
   name = "discourse-spoiler-alert";
   src = fetchFromGitHub {
     owner = "discourse";
     repo = "discourse-spoiler-alert";
-    rev = "e200cfa571d252cab63f3d30d619b370986e4cee";
-    sha256 = "0ya69ix5g77wz4c9x9gmng6l25ghb5xxlx3icr6jam16q14dzc33";
+    rev = "ec14a2316da0a4fc055cfc21c68a60040188a2b4";
+    sha256 = "11n977gp8va7jkqa6i3ja279k4nmkhk5l4hg9xhs229450m1rnfp";
+  };
+  meta = with lib; {
+    homepage = "https://github.com/discourse/discourse-spoiler-alert";
+    maintainers = with maintainers; [ talyz ];
+    license = licenses.mit;
+    description = "Hide spoilers behind the spoiler-alert jQuery plugin";
   };
 }
diff --git a/pkgs/servers/web-apps/discourse/plugins/discourse-yearly-review/default.nix b/pkgs/servers/web-apps/discourse/plugins/discourse-yearly-review/default.nix
index 8e76123ae593..b20e16118c7e 100644
--- a/pkgs/servers/web-apps/discourse/plugins/discourse-yearly-review/default.nix
+++ b/pkgs/servers/web-apps/discourse/plugins/discourse-yearly-review/default.nix
@@ -1,11 +1,17 @@
-{ mkDiscoursePlugin, fetchFromGitHub }:
+{ lib, mkDiscoursePlugin, fetchFromGitHub }:
 
 mkDiscoursePlugin {
   name = "discourse-yearly-review";
   src = fetchFromGitHub {
     owner = "discourse";
     repo = "discourse-yearly-review";
-    rev = "d1471bdb68945f55342e72e2c525b4f628419a50";
-    sha256 = "sha256:0xpl0l1vpih8xzb6y7k1lm72nj4ya99378viyhqfvpwzsn5pha2a";
+    rev = "95149df2282d62eebeb265b4895df15a2b259d03";
+    sha256 = "02n27al8n8cxz3dx4awlnd4qhv8a0fmjac57yyblmpviapja1wj7";
+  };
+  meta = with lib; {
+    homepage = "https://github.com/discourse/discourse-yearly-review";
+    maintainers = with maintainers; [ talyz ];
+    license = licenses.mit;
+    description = "Publishes an automated Year in Review topic";
   };
 }
diff --git a/pkgs/servers/web-apps/discourse/rubyEnv/Gemfile.lock b/pkgs/servers/web-apps/discourse/rubyEnv/Gemfile.lock
index af968cdf3313..1f7a3641caad 100644
--- a/pkgs/servers/web-apps/discourse/rubyEnv/Gemfile.lock
+++ b/pkgs/servers/web-apps/discourse/rubyEnv/Gemfile.lock
@@ -186,11 +186,6 @@ GEM
     jwt (2.2.3)
     kgio (2.11.3)
     libv8-node (15.14.0.1)
-    libv8-node (15.14.0.1-arm64-darwin-20)
-    libv8-node (15.14.0.1-x86_64-darwin-18)
-    libv8-node (15.14.0.1-x86_64-darwin-19)
-    libv8-node (15.14.0.1-x86_64-darwin-20)
-    libv8-node (15.14.0.1-x86_64-linux)
     listen (3.5.1)
       rb-fsevent (~> 0.10, >= 0.10.3)
       rb-inotify (~> 0.9, >= 0.9.10)
@@ -214,7 +209,7 @@ GEM
       rack (>= 1.1.3)
     method_source (1.0.0)
     mini_mime (1.1.0)
-    mini_portile2 (2.5.1)
+    mini_portile2 (2.5.3)
     mini_racer (0.4.0)
       libv8-node (~> 15.14.0.0)
     mini_scheduler (0.13.0)
@@ -232,7 +227,7 @@ GEM
     multipart-post (2.1.1)
     mustache (1.1.1)
     nio4r (2.5.7)
-    nokogiri (1.11.5)
+    nokogiri (1.11.7)
       mini_portile2 (~> 2.5.0)
       racc (~> 1.4)
     nokogumbo (2.0.5)
@@ -267,7 +262,7 @@ GEM
     omniauth-twitter (1.4.0)
       omniauth-oauth (~> 1.1)
       rack
-    onebox (2.2.15)
+    onebox (2.2.17)
       addressable (~> 2.7.0)
       htmlentities (~> 4.3)
       multi_json (~> 1.11)
@@ -465,12 +460,7 @@ GEM
     zeitwerk (2.4.2)
 
 PLATFORMS
-  arm64-darwin-20
   ruby
-  x86_64-darwin-18
-  x86_64-darwin-19
-  x86_64-darwin-20
-  x86_64-linux
 
 DEPENDENCIES
   actionmailer (= 6.1.3.2)
@@ -600,4 +590,4 @@ DEPENDENCIES
   yaml-lint
 
 BUNDLED WITH
-   2.2.16
+   2.2.20
diff --git a/pkgs/servers/web-apps/discourse/rubyEnv/gemset.nix b/pkgs/servers/web-apps/discourse/rubyEnv/gemset.nix
index 974df1ed4eae..2fe2587d25f5 100644
--- a/pkgs/servers/web-apps/discourse/rubyEnv/gemset.nix
+++ b/pkgs/servers/web-apps/discourse/rubyEnv/gemset.nix
@@ -1135,10 +1135,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0xg1x4708a4pn2wk8qs2d8kfzzdyv9kjjachg2f1phsx62ap2rx2";
+      sha256 = "1ad0mli9rc0f17zw4ibp24dbj1y39zkykijsjmnzl4gwpg5s0j6k";
       type = "gem";
     };
-    version = "2.5.1";
+    version = "2.5.3";
   };
   mini_racer = {
     dependencies = ["libv8-node"];
@@ -1284,10 +1284,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1i80ny61maqzqr1fq5wgpkijmh5j8abisrmhn16kv7mzmxqg5w0m";
+      sha256 = "1vrn31385ix5k9b0yalnlzv360isv6dincbcvi8psllnwz4sjxj9";
       type = "gem";
     };
-    version = "1.11.5";
+    version = "1.11.7";
   };
   nokogumbo = {
     dependencies = ["nokogiri"];
@@ -1414,10 +1414,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0a76xmwikcg2lv8k2cawzhmi2hx7j145v12mbpriby6zff797z4g";
+      sha256 = "1swlysqwfc6mb7smv52yv12sd79dchjf2f6r738wrag0wp5hazqy";
       type = "gem";
     };
-    version = "2.2.15";
+    version = "2.2.17";
   };
   openssl = {
     groups = ["default"];
diff --git a/pkgs/servers/web-apps/discourse/update.py b/pkgs/servers/web-apps/discourse/update.py
index c401ab552bb7..ae4dadfc3a73 100755
--- a/pkgs/servers/web-apps/discourse/update.py
+++ b/pkgs/servers/web-apps/discourse/update.py
@@ -1,5 +1,5 @@
 #!/usr/bin/env nix-shell
-#! nix-shell -i python3 -p bundix bundler nix-update python3 python3Packages.requests python3Packages.click python3Packages.click-log
+#! nix-shell -i python3 -p bundix bundler nix-update nix-universal-prefetch python3 python3Packages.requests python3Packages.click python3Packages.click-log
 
 import click
 import click_log
@@ -8,17 +8,22 @@ import tempfile
 import re
 import logging
 import subprocess
-import pathlib
+import os
+import stat
+import json
+import requests
 from distutils.version import LooseVersion
+from pathlib import Path
 from typing import Iterable
 
-import requests
 
 logger = logging.getLogger(__name__)
 
 
 class DiscourseRepo:
     version_regex = re.compile(r'^v\d+\.\d+\.\d+$')
+    _latest_commit_sha = None
+
     def __init__(self, owner: str = 'discourse', repo: str = 'discourse'):
         self.owner = owner
         self.repo = repo
@@ -35,6 +40,15 @@ class DiscourseRepo:
         versions.sort(key=lambda x: LooseVersion(x.replace('v', '')), reverse=True)
         return versions
 
+    @property
+    def latest_commit_sha(self) -> str:
+        if self._latest_commit_sha is None:
+            r = requests.get(f'https://api.github.com/repos/{self.owner}/{self.repo}/commits?per_page=1')
+            r.raise_for_status()
+            self._latest_commit_sha = r.json()[0]['sha']
+
+        return self._latest_commit_sha
+
     @staticmethod
     def rev2version(tag: str) -> str:
         """
@@ -57,19 +71,23 @@ class DiscourseRepo:
 
 def _call_nix_update(pkg, version):
     """calls nix-update from nixpkgs root dir"""
-    nixpkgs_path = pathlib.Path(__file__).parent / '../../../../'
+    nixpkgs_path = Path(__file__).parent / '../../../../'
     return subprocess.check_output(['nix-update', pkg, '--version', version], cwd=nixpkgs_path)
 
 
+def _nix_eval(expr: str):
+    nixpkgs_path = Path(__file__).parent / '../../../../'
+    return json.loads(subprocess.check_output(['nix', 'eval', '--json', f'(with import {nixpkgs_path} {{}}; {expr})'], text=True))
+
+
 def _get_current_package_version(pkg: str):
-    nixpkgs_path = pathlib.Path(__file__).parent / '../../../../'
-    return subprocess.check_output(['nix', 'eval', '--raw', f'nixpkgs.{pkg}.version'], text=True)
+    return _nix_eval(f'{pkg}.version')
 
 
 def _diff_file(filepath: str, old_version: str, new_version: str):
     repo = DiscourseRepo()
 
-    current_dir = pathlib.Path(__file__).parent
+    current_dir = Path(__file__).parent
 
     old = repo.get_file(filepath, 'v' + old_version)
     new = repo.get_file(filepath, 'v' + new_version)
@@ -148,17 +166,87 @@ def update(rev):
     version = repo.rev2version(rev)
     logger.debug(f"Using version {version}")
 
-    rubyenv_dir = pathlib.Path(__file__).parent / "rubyEnv"
+    rubyenv_dir = Path(__file__).parent / "rubyEnv"
 
     for fn in ['Gemfile.lock', 'Gemfile']:
         with open(rubyenv_dir / fn, 'w') as f:
             f.write(repo.get_file(fn, rev))
 
     subprocess.check_output(['bundle', 'lock'], cwd=rubyenv_dir)
+    for platform in ['arm64-darwin-20', 'x86_64-darwin-18',
+                     'x86_64-darwin-19', 'x86_64-darwin-20',
+                     'x86_64-linux']:
+        subprocess.check_output(['bundle', 'lock', '--remove-platform', platform], cwd=rubyenv_dir)
     subprocess.check_output(['bundix'], cwd=rubyenv_dir)
 
     _call_nix_update('discourse', repo.rev2version(rev))
 
+@cli.command()
+def update_plugins():
+    """Update plugins to their latest revision.
+
+    """
+    plugins = [
+        {'name': 'discourse-canned-replies'},
+        {'name': 'discourse-github'},
+        {'name': 'discourse-math'},
+        {'name': 'discourse-solved'},
+        {'name': 'discourse-spoiler-alert'},
+        {'name': 'discourse-yearly-review'},
+    ]
+
+    for plugin in plugins:
+        fetcher = plugin.get('fetcher') or "fetchFromGitHub"
+        owner = plugin.get('owner') or "discourse"
+        name = plugin.get('name')
+        repo_name = plugin.get('repo_name') or name
+
+        repo = DiscourseRepo(owner=owner, repo=repo_name)
+        prev_commit_sha = _nix_eval(f'discourse.plugins.{name}.src.rev')
+
+        if prev_commit_sha == repo.latest_commit_sha:
+            click.echo(f'Plugin {name} is already at the latest revision')
+            continue
+
+        filename = _nix_eval(f'builtins.unsafeGetAttrPos "src" discourse.plugins.{name}')['file']
+        prev_hash = _nix_eval(f'discourse.plugins.{name}.src.outputHash')
+        new_hash = subprocess.check_output([
+            'nix-universal-prefetch', fetcher,
+            '--owner', owner,
+            '--repo', repo_name,
+            '--rev', repo.latest_commit_sha,
+        ], text=True).strip("\n")
+
+        click.echo(f"Update {name}, {prev_commit_sha} -> {repo.latest_commit_sha} in {filename}")
+
+        with open(filename, 'r+') as f:
+            content = f.read()
+            content = content.replace(prev_commit_sha, repo.latest_commit_sha)
+            content = content.replace(prev_hash, new_hash)
+            f.seek(0)
+            f.write(content)
+            f.truncate()
+
+        rubyenv_dir = Path(filename).parent
+        gemfile = rubyenv_dir / "Gemfile"
+        gemfile_text = ''
+        for line in repo.get_file('plugin.rb', repo.latest_commit_sha).splitlines():
+            if 'gem ' in line:
+                gemfile_text = gemfile_text + line + os.linesep
+
+        if len(gemfile_text) > 0:
+            if os.path.isfile(gemfile):
+                os.remove(gemfile)
+
+            subprocess.check_output(['bundle', 'init'], cwd=rubyenv_dir)
+            os.chmod(gemfile, stat.S_IREAD | stat.S_IWRITE | stat.S_IRGRP | stat.S_IROTH)
+
+            with open(gemfile, 'a') as f:
+                f.write(gemfile_text)
+
+            subprocess.check_output(['bundle', 'lock', '--update'], cwd=rubyenv_dir)
+            subprocess.check_output(['bundix'], cwd=rubyenv_dir)
+
 
 if __name__ == '__main__':
     cli()
diff --git a/pkgs/servers/x11/xorg/default.nix b/pkgs/servers/x11/xorg/default.nix
index 125c329c4bde..9a75403cec62 100644
--- a/pkgs/servers/x11/xorg/default.nix
+++ b/pkgs/servers/x11/xorg/default.nix
@@ -3102,11 +3102,11 @@ lib.makeScope newScope (self: with self; {
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xorgserver = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto, openssl, libX11, libXau, libXaw, libxcb, xcbutil, xcbutilwm, xcbutilimage, xcbutilkeysyms, xcbutilrenderutil, libXdmcp, libXfixes, libxkbfile, libXmu, libXpm, libXrender, libXres, libXt }: stdenv.mkDerivation {
     pname = "xorg-server";
-    version = "1.20.11";
+    version = "1.20.12";
     builder = ./builder.sh;
     src = fetchurl {
-      url = "mirror://xorg/individual/xserver/xorg-server-1.20.11.tar.bz2";
-      sha256 = "0jacqgin8kcyy8fyv0lhgb4if8g9hp60rm3ih3s1mgps7xp7jk4i";
+      url = "mirror://xorg/individual/xserver/xorg-server-1.20.12.tar.xz";
+      sha256 = "1b4ckvxaiiiwdxwyfzbbfkr384qqy5qzfsm37z0fr08x8f9w0v9k";
     };
     hardeningDisable = [ "bindnow" "relro" ];
     nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/servers/x11/xorg/tarballs.list b/pkgs/servers/x11/xorg/tarballs.list
index 4bb1867903ee..42cb2da3a0d6 100644
--- a/pkgs/servers/x11/xorg/tarballs.list
+++ b/pkgs/servers/x11/xorg/tarballs.list
@@ -218,4 +218,4 @@ mirror://xorg/individual/util/lndir-1.0.3.tar.bz2
 mirror://xorg/individual/util/makedepend-1.0.6.tar.bz2
 mirror://xorg/individual/util/util-macros-1.19.3.tar.bz2
 mirror://xorg/individual/util/xorg-cf-files-1.0.6.tar.bz2
-mirror://xorg/individual/xserver/xorg-server-1.20.11.tar.bz2
+mirror://xorg/individual/xserver/xorg-server-1.20.12.tar.xz
diff --git a/pkgs/tools/misc/infracost/default.nix b/pkgs/tools/misc/infracost/default.nix
index c912eb3322bf..3d91dd6d9abb 100644
--- a/pkgs/tools/misc/infracost/default.nix
+++ b/pkgs/tools/misc/infracost/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "infracost";
-  version = "0.9.3";
+  version = "0.9.4";
 
   src = fetchFromGitHub {
     owner = "infracost";
     rev = "v${version}";
     repo = "infracost";
-    sha256 = "sha256-3AH/VUKIno/jObep5GNfIpyOW5TcfZ5UZyornJWTGOw=";
+    sha256 = "sha256-OQwMO9bhPK+Wjob8rAFYJQRpAYf1bPdRi2BjETjpSpE=";
   };
   vendorSha256 = "sha256-zMEtVPyzwW4SrbpydDFDqgHEC0/khkrSxlEnQ5I0he8=";
 
@@ -25,12 +25,7 @@ buildGoModule rec {
   '';
 
   postInstall = ''
-    # panic if .config directory can't be accessed
-    # https://github.com/infracost/infracost/pull/862
-    export HOME="$TMPDIR"
-    mkdir -p "$HOME/.config/infracost"
     export INFRACOST_SKIP_UPDATE_CHECK=true
-
     installShellCompletion --cmd infracost \
       --bash <($out/bin/infracost completion --shell bash) \
       --fish <($out/bin/infracost completion --shell fish) \
@@ -41,10 +36,7 @@ buildGoModule rec {
   installCheckPhase = ''
     runHook preInstallCheck
 
-    export HOME="$TMPDIR"
-    mkdir -p "$HOME/.config/infracost"
     export INFRACOST_SKIP_UPDATE_CHECK=true
-
     $out/bin/infracost --help
     $out/bin/infracost --version | grep "v${version}"
 
@@ -60,7 +52,7 @@ buildGoModule rec {
       This helps developers, DevOps et al. quickly see the cost breakdown and
       compare different deployment options upfront.
     '';
-    license = [ licenses.asl20 ];
+    license = licenses.asl20;
     maintainers = with maintainers; [ davegallant jk ];
   };
 }
diff --git a/pkgs/tools/misc/tremor-rs/default.nix b/pkgs/tools/misc/tremor-rs/default.nix
index 9c0a68805a6f..5f6acfd9696f 100644
--- a/pkgs/tools/misc/tremor-rs/default.nix
+++ b/pkgs/tools/misc/tremor-rs/default.nix
@@ -3,16 +3,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "tremor";
-  version = "0.11.2";
+  version = "0.11.5";
 
   src = fetchFromGitHub {
     owner = "tremor-rs";
     repo = "tremor-runtime";
     rev = "v${version}";
-    sha256 = "sha256-FedRwFVc+m25+Elj1Vp/fInbK6DVsUpniw29/dtecWo=";
+    sha256 = "sha256-fE0f0tCI2V+HqHZwn9cO+xs0o3o6w0nrJg9Et0zJMOE=";
   };
 
-  cargoSha256 = "sha256-jxXoFOwoBSkn7pv10ctLpD7ko8bokc1ADkB7NQFRC7c=";
+  cargoHash = "sha256-dky9ejzMgKXlzpg+9bmkd7th+EHBpNmZJkgYt2pjuuI=";
 
   nativeBuildInputs = [ cmake pkg-config installShellFiles ];
 
diff --git a/pkgs/tools/networking/innernet/default.nix b/pkgs/tools/networking/innernet/default.nix
index cee4956269e1..f643702d625b 100644
--- a/pkgs/tools/networking/innernet/default.nix
+++ b/pkgs/tools/networking/innernet/default.nix
@@ -2,15 +2,15 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "innernet";
-  version = "1.3.1";
+  version = "1.4.0";
 
   src = fetchFromGitHub {
     owner = "tonarino";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-Tnwq86gAbi24O8/26134gJCf9+wol1zma980t9iHEKY=";
+    sha256 = "sha256-n+xNWhOkRCIcoBHR8u+xZK81fU0usIfFhYg3BO9yXik=";
   };
-  cargoSha256 = "sha256-Wy+i1lmXpsy0Sy0GF5XUfXsLQHeV7cQo9nUxUEFnHOU=";
+  cargoSha256 = "sha256-cTqQtJpuwVlUKfAK8ASf6vq6PU2NE8PT/el/Hz4HgtA=";
 
   nativeBuildInputs = with llvmPackages; [
     llvm
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 473d40b4a009..8a9a4283bbc4 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -2487,6 +2487,10 @@ in
 
   discourse = callPackage ../servers/web-apps/discourse { };
 
+  discourseAllPlugins = discourse.override {
+    plugins = lib.filter (p: p ? pluginName) (builtins.attrValues discourse.plugins);
+  };
+
   discourse-mail-receiver = callPackage ../servers/web-apps/discourse/mail_receiver { };
 
   discocss = callPackage ../tools/misc/discocss { };
@@ -19518,6 +19522,8 @@ in
 
   icecream = callPackage ../servers/icecream { };
 
+  icingaweb2-ipl = callPackage ../servers/icingaweb2/ipl.nix { };
+  icingaweb2-thirdparty = callPackage ../servers/icingaweb2/thirdparty.nix { };
   icingaweb2 = callPackage ../servers/icingaweb2 { };
   icingaweb2Modules = {
     theme-april = callPackage ../servers/icingaweb2/theme-april { };
@@ -19537,6 +19543,8 @@ in
 
   ircdHybrid = callPackage ../servers/irc/ircd-hybrid { };
 
+  janus-gateway = callPackage ../servers/janus-gateway { };
+
   jboss = callPackage ../servers/http/jboss { };
 
   jboss_mysql_jdbc = callPackage ../servers/http/jboss/jdbc/mysql { };
@@ -22294,6 +22302,8 @@ in
 
   juno-theme = callPackage ../data/themes/juno { };
 
+  kanit-font = callPackage ../data/fonts/kanit { };
+
   kanji-stroke-order-font = callPackage ../data/fonts/kanji-stroke-order-font {};
 
   kawkab-mono-font = callPackage ../data/fonts/kawkab-mono {};