diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index b890c8aec0e6..7ab74a2337a1 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -5054,6 +5054,12 @@
       fingerprint = "8992 44FC D291 5CA2 0A97  802C 156C 88A5 B0A0 4B2A";
     }];
   };
+  kiyengar = {
+    email = "hello@kiyengar.net";
+    github = "karthikiyengar";
+    githubId = 8260207;
+    name = "Karthik Iyengar";
+  };
   kkallio = {
     email = "tierpluspluslists@gmail.com";
     name = "Karn Kallio";
@@ -10392,6 +10398,12 @@
     githubId = 1322287;
     name = "William O'Hanley";
   };
+  woky = {
+    email = "pampu.andrei@pm.me";
+    github = "andreisergiu98";
+    githubId = 11740700;
+    name = "Andrei Pampu";
+  };
   wolfangaukang = {
     email = "liquid.query960@4wrd.cc";
     github = "wolfangaukang";
diff --git a/nixos/doc/manual/release-notes/rl-2105.xml b/nixos/doc/manual/release-notes/rl-2105.xml
index 916cea929727..ba42601096b2 100644
--- a/nixos/doc/manual/release-notes/rl-2105.xml
+++ b/nixos/doc/manual/release-notes/rl-2105.xml
@@ -244,7 +244,7 @@
    </listitem>
    <listitem>
      <para>
-       xfsprogs was update from 4.19 to 5.10. It now enables reflink support by default on filesystem creation.
+       xfsprogs was update from 4.19 to 5.11. It now enables reflink support by default on filesystem creation.
        Support for reflinks was added with an experimental status to kernel 4.9 and deemed stable in kernel 4.16.
        If you want to be able to mount XFS filesystems created with this release of xfsprogs on kernel releases older than those, you need to format them
        with <literal>mkfs.xfs -m reflink=0</literal>.
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index fa8d78c7d888..eaf046b160f1 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -515,6 +515,7 @@
   ./services/misc/nzbget.nix
   ./services/misc/nzbhydra2.nix
   ./services/misc/octoprint.nix
+  ./services/misc/ombi.nix
   ./services/misc/osrm.nix
   ./services/misc/packagekit.nix
   ./services/misc/paperless.nix
diff --git a/nixos/modules/services/misc/ombi.nix b/nixos/modules/services/misc/ombi.nix
new file mode 100644
index 000000000000..83f433e0be4a
--- /dev/null
+++ b/nixos/modules/services/misc/ombi.nix
@@ -0,0 +1,80 @@
+{ config, pkgs, lib, ... }:
+
+with lib;
+
+let cfg = config.services.ombi;
+
+in {
+  options = {
+    services.ombi = {
+      enable = mkEnableOption ''
+        Ombi.
+        Optionally see <link xlink:href="https://docs.ombi.app/info/reverse-proxy"/>
+        on how to set up a reverse proxy
+      '';
+
+      dataDir = mkOption {
+        type = types.str;
+        default = "/var/lib/ombi";
+        description = "The directory where Ombi stores its data files.";
+      };
+
+      port = mkOption {
+        type = types.port;
+        default = 5000;
+        description = "The port for the Ombi web interface.";
+      };
+
+      openFirewall = mkOption {
+        type = types.bool;
+        default = false;
+        description = "Open ports in the firewall for the Ombi web interface.";
+      };
+
+      user = mkOption {
+        type = types.str;
+        default = "ombi";
+        description = "User account under which Ombi runs.";
+      };
+
+      group = mkOption {
+        type = types.str;
+        default = "ombi";
+        description = "Group under which Ombi runs.";
+      };
+    };
+  };
+
+  config = mkIf cfg.enable {
+    systemd.tmpfiles.rules = [
+      "d '${cfg.dataDir}' 0700 ${cfg.user} ${cfg.group} - -"
+    ];
+
+    systemd.services.ombi = {
+      description = "Ombi";
+      after = [ "network.target" ];
+      wantedBy = [ "multi-user.target" ];
+
+      serviceConfig = {
+        Type = "simple";
+        User = cfg.user;
+        Group = cfg.group;
+        ExecStart = "${pkgs.ombi}/bin/Ombi --storage '${cfg.dataDir}' --host 'http://*:${toString cfg.port}'";
+        Restart = "on-failure";
+      };
+    };
+
+    networking.firewall = mkIf cfg.openFirewall {
+      allowedTCPPorts = [ cfg.port ];
+    };
+
+    users.users = mkIf (cfg.user == "ombi") {
+      ombi = {
+        group = cfg.group;
+        home = cfg.dataDir;
+      };
+    };
+
+    users.groups = mkIf (cfg.group == "ombi") { ombi = { }; };
+  };
+}
diff --git a/nixos/modules/services/monitoring/netdata.nix b/nixos/modules/services/monitoring/netdata.nix
index d5b679097b30..007024c04ce5 100644
--- a/nixos/modules/services/monitoring/netdata.nix
+++ b/nixos/modules/services/monitoring/netdata.nix
@@ -123,9 +123,20 @@ in {
             "error log" = "syslog";
           };
         '';
-        };
+      };
+
+      enableAnalyticsReporting = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          Enable reporting of anonymous usage statistics to Netdata Inc. via either
+          Google Analytics (in versions prior to 1.29.4), or Netdata Inc.'s
+          self-hosted PostHog (in versions 1.29.4 and later).
+          See: <link xlink:href="https://learn.netdata.cloud/docs/agent/anonymous-statistics"/>
+        '';
       };
     };
+  };
 
   config = mkIf cfg.enable {
     assertions =
@@ -140,8 +151,12 @@ in {
       wantedBy = [ "multi-user.target" ];
       path = (with pkgs; [ curl gawk which ]) ++ lib.optional cfg.python.enable
         (pkgs.python3.withPackages cfg.python.extraPackages);
+      environment = {
+        PYTHONPATH = "${cfg.package}/libexec/netdata/python.d/python_modules";
+      } // lib.optionalAttrs (!cfg.enableAnalyticsReporting) {
+        DO_NOT_TRACK = "1";
+      };
       serviceConfig = {
-        Environment="PYTHONPATH=${cfg.package}/libexec/netdata/python.d/python_modules";
         ExecStart = "${cfg.package}/bin/netdata -P /run/netdata/netdata.pid -D -c ${configFile}";
         ExecReload = "${pkgs.util-linux}/bin/kill -s HUP -s USR1 -s USR2 $MAINPID";
         TimeoutStopSec = 60;
diff --git a/nixos/modules/services/security/privacyidea.nix b/nixos/modules/services/security/privacyidea.nix
index c2988858e56c..f7b40089a932 100644
--- a/nixos/modules/services/security/privacyidea.nix
+++ b/nixos/modules/services/security/privacyidea.nix
@@ -57,6 +57,26 @@ in
     services.privacyidea = {
       enable = mkEnableOption "PrivacyIDEA";
 
+      environmentFile = mkOption {
+        type = types.nullOr types.path;
+        default = null;
+        example = "/root/privacyidea.env";
+        description = ''
+          File to load as environment file. Environment variables
+          from this file will be interpolated into the config file
+          using <package>envsubst</package> which is helpful for specifying
+          secrets:
+          <programlisting>
+          { <xref linkend="opt-services.privacyidea.secretKey" /> = "$SECRET"; }
+          </programlisting>
+
+          The environment-file can now specify the actual secret key:
+          <programlisting>
+          SECRET=veryverytopsecret
+          </programlisting>
+        '';
+      };
+
       stateDir = mkOption {
         type = types.str;
         default = "/var/lib/privacyidea";
@@ -206,7 +226,7 @@ in
         wantedBy = [ "multi-user.target" ];
         after = [ "postgresql.service" ];
         path = with pkgs; [ openssl ];
-        environment.PRIVACYIDEA_CONFIGFILE = piCfgFile;
+        environment.PRIVACYIDEA_CONFIGFILE = "${cfg.stateDir}/privacyidea.cfg";
         preStart = let
           pi-manage = "${pkgs.sudo}/bin/sudo -u privacyidea -HE ${penv}/bin/pi-manage";
           pgsu = config.services.postgresql.superUser;
@@ -214,6 +234,10 @@ in
         in ''
           mkdir -p ${cfg.stateDir} /run/privacyidea
           chown ${cfg.user}:${cfg.group} -R ${cfg.stateDir} /run/privacyidea
+          umask 077
+          ${lib.getBin pkgs.envsubst}/bin/envsubst -o ${cfg.stateDir}/privacyidea.cfg \
+                                                   -i "${piCfgFile}"
+          chown ${cfg.user}:${cfg.group} ${cfg.stateDir}/privacyidea.cfg
           if ! test -e "${cfg.stateDir}/db-created"; then
             ${pkgs.sudo}/bin/sudo -u ${pgsu} ${psql}/bin/createuser --no-superuser --no-createdb --no-createrole ${cfg.user}
             ${pkgs.sudo}/bin/sudo -u ${pgsu} ${psql}/bin/createdb --owner ${cfg.user} privacyidea
@@ -231,6 +255,7 @@ in
           Type = "notify";
           ExecStart = "${uwsgi}/bin/uwsgi --json ${piuwsgi}";
           ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
+          EnvironmentFile = lib.mkIf (cfg.environmentFile != null) cfg.environmentFile;
           ExecStop = "${pkgs.coreutils}/bin/kill -INT $MAINPID";
           NotifyAccess = "main";
           KillSignal = "SIGQUIT";
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 4c3435451ad1..62188ddf9e8d 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -290,6 +290,7 @@ in
   nzbget = handleTest ./nzbget.nix {};
   nzbhydra2 = handleTest ./nzbhydra2.nix {};
   oh-my-zsh = handleTest ./oh-my-zsh.nix {};
+  ombi = handleTest ./ombi.nix {};
   openarena = handleTest ./openarena.nix {};
   openldap = handleTest ./openldap.nix {};
   opensmtpd = handleTest ./opensmtpd.nix {};
diff --git a/nixos/tests/ombi.nix b/nixos/tests/ombi.nix
new file mode 100644
index 000000000000..bfca86af8175
--- /dev/null
+++ b/nixos/tests/ombi.nix
@@ -0,0 +1,18 @@
+import ./make-test-python.nix ({ lib, ... }:
+
+with lib;
+
+{
+  name = "ombi";
+  meta.maintainers = with maintainers; [ woky ];
+
+  nodes.machine =
+    { pkgs, ... }:
+    { services.ombi.enable = true; };
+
+  testScript = ''
+    machine.wait_for_unit("ombi.service")
+    machine.wait_for_open_port("5000")
+    machine.succeed("curl --fail http://localhost:5000/")
+  '';
+})
diff --git a/nixos/tests/privacyidea.nix b/nixos/tests/privacyidea.nix
index b71ff0a1669f..4a94f0727946 100644
--- a/nixos/tests/privacyidea.nix
+++ b/nixos/tests/privacyidea.nix
@@ -12,10 +12,16 @@ import ./make-test-python.nix ({ pkgs, ...} : rec {
 
     services.privacyidea = {
       enable = true;
-      secretKey = "testing";
-      pepper = "testing";
+      secretKey = "$SECRET_KEY";
+      pepper = "$PEPPER";
       adminPasswordFile = pkgs.writeText "admin-password" "testing";
       adminEmail = "root@localhost";
+
+      # Don't try this at home!
+      environmentFile = pkgs.writeText "pi-secrets.env" ''
+        SECRET_KEY=testing
+        PEPPER=testing
+      '';
     };
     services.nginx = {
       enable = true;
@@ -29,6 +35,8 @@ import ./make-test-python.nix ({ pkgs, ...} : rec {
     machine.start()
     machine.wait_for_unit("multi-user.target")
     machine.succeed("curl --fail http://localhost | grep privacyIDEA")
+    machine.succeed("grep \"SECRET_KEY = 'testing'\" /var/lib/privacyidea/privacyidea.cfg")
+    machine.succeed("grep \"PI_PEPPER = 'testing'\" /var/lib/privacyidea/privacyidea.cfg")
     machine.succeed(
         "curl --fail http://localhost/auth -F username=admin -F password=testing | grep token"
     )
diff --git a/pkgs/applications/audio/spotify/default.nix b/pkgs/applications/audio/spotify/default.nix
index 69aae9d6433d..3be5af2755be 100644
--- a/pkgs/applications/audio/spotify/default.nix
+++ b/pkgs/applications/audio/spotify/default.nix
@@ -10,14 +10,14 @@ let
   # If an update breaks things, one of those might have valuable info:
   # https://aur.archlinux.org/packages/spotify/
   # https://community.spotify.com/t5/Desktop-Linux
-  version = "1.1.55.494.gca75f788";
+  version = "1.1.55.498.gf9a83c60";
   # To get the latest stable revision:
   # curl -H 'X-Ubuntu-Series: 16' 'https://api.snapcraft.io/api/v1/snaps/details/spotify?channel=stable' | jq '.download_url,.version,.last_updated'
   # To get general information:
   # curl -H 'Snap-Device-Series: 16' 'https://api.snapcraft.io/v2/snaps/info/spotify' | jq '.'
   # More examples of api usage:
   # https://github.com/canonical-websites/snapcraft.io/blob/master/webapp/publisher/snaps/views.py
-  rev = "45";
+  rev = "46";
 
   deps = [
     alsaLib
@@ -79,7 +79,7 @@ stdenv.mkDerivation {
   # https://community.spotify.com/t5/Desktop-Linux/Redistribute-Spotify-on-Linux-Distributions/td-p/1695334
   src = fetchurl {
     url = "https://api.snapcraft.io/api/v1/snaps/download/pOBIoZ2LrCB3rDohMxoYGnbN14EHOgD7_${rev}.snap";
-    sha512 = "5d61a2d5b26be651620ab5d18d3a204d8d7b09dcec8a733ddc176c44cb43e9176c4350933ebe4498b065ba219113f3226c13bea9659da738fe635f41d01db303";
+    sha512 = "dabb55d2ba41f977b6d3f03bfcf147d11785136dd1277efc62011c8371ef25cc04531266bd16608639b9b6a500c1a18a45f44ba7a43e17ab5ac139e36eff7149";
   };
 
   nativeBuildInputs = [ makeWrapper squashfsTools ];
diff --git a/pkgs/applications/display-managers/lightdm/gtk-greeter.nix b/pkgs/applications/display-managers/lightdm/gtk-greeter.nix
index 90f7a03d0dd2..b012699a16ba 100644
--- a/pkgs/applications/display-managers/lightdm/gtk-greeter.nix
+++ b/pkgs/applications/display-managers/lightdm/gtk-greeter.nix
@@ -9,7 +9,7 @@
 , useGTK2 ? false
 , gtk2
 , gtk3 # gtk3 seems better supported
-, exo
+, xfce4-dev-tools
 , at-spi2-core
 , librsvg
 , hicolor-icon-theme
@@ -31,8 +31,8 @@ stdenv.mkDerivation rec {
     sha256 = "1g7wc3d3vqfa7mrdhx1w9ywydgjbffla6rbrxq9k3sc62br97qms";
   };
 
-  nativeBuildInputs = [ pkg-config intltool wrapGAppsHook ];
-  buildInputs = [ lightdm exo librsvg hicolor-icon-theme ]
+  nativeBuildInputs = [ pkg-config intltool xfce4-dev-tools wrapGAppsHook ];
+  buildInputs = [ lightdm librsvg hicolor-icon-theme ]
     ++ (if useGTK2 then [ gtk2 ] else [ gtk3 ]);
 
   configureFlags = [
@@ -42,6 +42,13 @@ stdenv.mkDerivation rec {
     "--sbindir=${placeholder "out"}/bin" # for wrapGAppsHook to wrap automatically
   ] ++ lib.optional useGTK2 "--with-gtk2";
 
+  postPatch = ''
+    # exo-csource has been dropped from exo, and replaced by xdt-csource from xfce4-dev-tools
+    for f in configure.ac src/Makefile.am; do
+      substituteInPlace $f --replace exo-csource xdt-csource
+    done
+  '';
+
   preConfigure = ''
     configureFlagsArray+=( --enable-at-spi-command="${at-spi2-core}/libexec/at-spi-bus-launcher --launch-immediately" )
   '';
@@ -66,7 +73,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     homepage = "https://launchpad.net/lightdm-gtk-greeter";
     platforms = platforms.linux;
-    license = licenses.gpl3;
+    license = licenses.gpl3Plus;
     maintainers = with maintainers; [ ];
   };
 }
diff --git a/pkgs/applications/misc/kiwix/default.nix b/pkgs/applications/misc/kiwix/default.nix
index dff50bafaf80..f3406d4159b8 100644
--- a/pkgs/applications/misc/kiwix/default.nix
+++ b/pkgs/applications/misc/kiwix/default.nix
@@ -1,109 +1,48 @@
-{ lib, stdenv, fetchurl, makeWrapper, pkg-config
-, zip, python, zlib, which, icu, libmicrohttpd, lzma, aria2, wget, bc
-, libuuid, libX11, libXext, libXt, libXrender, glib, dbus, dbus-glib
-, gtk2, gdk-pixbuf, pango, cairo, freetype, fontconfig, alsaLib, atk, cmake
-, xapian, ctpp2, zimlib
+{ lib, mkDerivation, fetchFromGitHub
+, callPackage
+, pkg-config
+, makeWrapper
+, qmake
+, qtbase
+, qtwebengine
+, qtsvg
+, qtimageformats
+, aria2
 }:
 
-with lib;
-
-let
-  xulrunner64_tar = fetchurl {
-    url = "http://download.kiwix.org/dev/xulrunner-29.0.en-US.linux-x86_64.tar.bz2";
-    sha256 = "0i3m30gm5z7qmas14id6ypvbmnb2k7jhz8aby2wz5vvv49zqmx3s";
-  };
-  xulrunnersdk64_tar = fetchurl {
-    url = "http://download.kiwix.org/dev/xulrunner-29.0.en-US.linux-x86_64.sdk.tar.bz2";
-    sha256 = "0z90v7c4mq15g5klmsj8vs2r10fbygj3qzynx4952hkv8ihw8n3a";
-  };
-  xulrunner32_tar = fetchurl {
-    url = "http://download.kiwix.org/dev/xulrunner-29.0.en-US.linux-i686.tar.bz2";
-    sha256 = "0yln6pxz8f6b9wm9124sx049z8mgi17lgd63rcv2hnix825y8gjb";
-  };
-  xulrunnersdk32_tar = fetchurl {
-    url = "http://download.kiwix.org/dev/xulrunner-29.0.en-US.linux-i686.sdk.tar.bz2";
-    sha256 = "1h9vcbvf8wgds6i2z20y7krpys0mqsqhv1ijyfljanp6vyll9fvi";
-  };
-
-  xulrunner = if stdenv.hostPlatform.system == "x86_64-linux"
-              then { tar = xulrunner64_tar; sdk = xulrunnersdk64_tar; }
-              else { tar = xulrunner32_tar; sdk = xulrunnersdk32_tar; };
-
-  pugixml = stdenv.mkDerivation rec {
-    version = "1.2";
-    pname = "pugixml";
-
-    src = fetchurl {
-      url = "http://download.kiwix.org/dev/${pname}-${version}.tar.gz";
-      sha256 = "0sqk0vdwjq44jxbbkj1cy8qykrmafs1sickzldb2w2nshsnjshhg";
-    };
-
-    nativeBuildInputs = [ cmake ];
-
-    unpackPhase = ''
-      # not a nice src archive: all the files are in the root :(
-      mkdir ${pname}-${version}
-      cd ${pname}-${version}
-      tar -xf ${src}
-
-      # and the build scripts are in there :'(
-      cd scripts
-    '';
-  };
-
-in
-
-stdenv.mkDerivation rec {
+mkDerivation rec {
   pname = "kiwix";
-  version = "0.9";
+  version = "2.0.5";
 
-  src = fetchurl {
-    url = "http://download.kiwix.org/src/kiwix-${version}-src.tar.xz";
-    sha256 = "0577phhy2na59cpcqjgldvksp0jwczyg0l6c9ghnr19i375l7yqc";
+  src = fetchFromGitHub {
+    owner = pname;
+    repo = "${pname}-desktop";
+    rev = version;
+    sha256 = "12v43bcg4g8fcp02y2srsfdvcb7dpl4pxb9z7a235006s0kfv8yn";
   };
 
-  nativeBuildInputs = [ pkg-config ];
+  nativeBuildInputs = [
+    qmake
+    pkg-config
+  ];
+
   buildInputs = [
-    zip python zlib xapian which icu libmicrohttpd
-    lzma zimlib ctpp2 aria2 wget bc libuuid makeWrapper pugixml
+    qtbase
+    qtwebengine
+    qtsvg
+    qtimageformats
+    (callPackage ./lib.nix {})
   ];
 
-  postUnpack = ''
-    cd kiwix*
-    mkdir static
-    cp Makefile.in static/
-
-    cd src/dependencies
-
-    tar -xf ${xulrunner.tar}
-    tar -xf ${xulrunner.sdk}
-
-    cd ../../..
-  '';
-
-  configureFlags = [
-    "--disable-staticbins"
+  qtWrapperArgs = [
+    "--prefix PATH : ${lib.makeBinPath [ aria2 ]}"
   ];
 
-  postInstall = ''
-    cp -r src/dependencies/xulrunner $out/lib/kiwix
-
-    patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" $out/lib/kiwix/xulrunner/xulrunner
-
-    rm $out/bin/kiwix
-    makeWrapper $out/lib/kiwix/kiwix-launcher $out/bin/kiwix \
-      --suffix LD_LIBRARY_PATH : ${makeLibraryPath [stdenv.cc.cc libX11 libXext libXt libXrender glib dbus dbus-glib gtk2 gdk-pixbuf pango cairo freetype fontconfig alsaLib atk]} \
-      --suffix PATH : ${aria2}/bin
-  '';
-
-  meta = {
+  meta = with lib; {
     description = "An offline reader for Web content";
     homepage = "https://kiwix.org";
     license = licenses.gpl3;
     platforms = platforms.linux;
-    maintainers = with maintainers; [ robbinch ];
-    knownVulnerabilities = [
-      "CVE-2015-1032"
-    ];
+    maintainers = with maintainers; [ ajs124 ];
   };
 }
diff --git a/pkgs/applications/misc/kiwix/lib.nix b/pkgs/applications/misc/kiwix/lib.nix
new file mode 100644
index 000000000000..dcde5c390a47
--- /dev/null
+++ b/pkgs/applications/misc/kiwix/lib.nix
@@ -0,0 +1,55 @@
+{ stdenv, lib, fetchFromGitHub
+, meson, ninja, pkg-config
+, python3
+, curl
+, icu
+, pugixml
+, zimlib
+, zlib
+, libmicrohttpd
+, mustache-hpp
+, gtest
+}:
+
+
+stdenv.mkDerivation rec {
+  pname = "kiwix-lib";
+  version = "9.4.1";
+
+  src = fetchFromGitHub {
+    owner = "kiwix";
+    repo = pname;
+    rev = version;
+    sha256 = "034nk6l623v78clrs2d0k1vg69sbzrd8c0q79qiqmlkinck1nkxw";
+  };
+
+  nativeBuildInputs = [
+    meson
+    ninja
+    pkg-config
+    python3
+  ];
+
+  buildInputs = [
+    icu
+    zlib
+    mustache-hpp
+  ];
+
+  propagatedBuildInputs = [
+    curl
+    libmicrohttpd
+    pugixml
+    zimlib
+  ];
+
+  checkInputs = [
+    gtest
+  ];
+
+  doCheck = true;
+
+  postPatch = ''
+    patchShebangs scripts
+  '';
+}
diff --git a/pkgs/applications/misc/unipicker/default.nix b/pkgs/applications/misc/unipicker/default.nix
new file mode 100644
index 000000000000..fc47a872848f
--- /dev/null
+++ b/pkgs/applications/misc/unipicker/default.nix
@@ -0,0 +1,36 @@
+{ stdenv, fetchFromGitHub, lib, fzf, xclip }:
+
+stdenv.mkDerivation rec {
+   pname = "unipicker";
+   version = "unstable-2018-07-10";
+
+   src = fetchFromGitHub {
+      owner = "jeremija";
+      repo = pname;
+      rev = "767571c87cdb1e654408d19fc4db98e5e6725c04";
+      sha256 = "1k4v53pm3xivwg9vq2kndpcmah0yn4679r5jzxvg38bbkfdk86c1";
+   };
+
+   buildInputs = [
+      fzf
+      xclip
+   ];
+
+   preInstall = ''
+      substituteInPlace unipicker --replace "/etc/unipickerrc" "$out/etc/unipickerrc"
+      substituteInPlace unipickerrc --replace "/usr/local" "$out"
+   '';
+
+   makeFlags = [
+      "PREFIX=$(out)"
+      "DESTDIR=$(out)"
+   ];
+
+   meta = with lib; {
+    description = "A CLI utility for searching unicode characters by description and optionally copying them to clipboard";
+    homepage = "https://github.com/jeremija/unipicker";
+    license = licenses.mit;
+    maintainers = with maintainers; [ kiyengar ];
+    platforms = with platforms; unix;
+   };
+}
diff --git a/pkgs/applications/networking/browsers/chromium/upstream-info.json b/pkgs/applications/networking/browsers/chromium/upstream-info.json
index cc99017a0972..bf3d02fc823e 100644
--- a/pkgs/applications/networking/browsers/chromium/upstream-info.json
+++ b/pkgs/applications/networking/browsers/chromium/upstream-info.json
@@ -18,9 +18,9 @@
     }
   },
   "beta": {
-    "version": "90.0.4430.40",
-    "sha256": "0n7g4j981h3fn5wgpb3azpili9682nq0yikhd4z7dr7agvpnfr3k",
-    "sha256bin64": "120rbh8bpcj3z5kqdaicqnsd2mh0xcr8y1411kl0zpwa6hfvgm3r",
+    "version": "90.0.4430.51",
+    "sha256": "1k87fw0pv0d2zlxm0il9b5p60gdz6l44jssmsns4zy2fmd9316wr",
+    "sha256bin64": "0q5yx7bc266azs3nl29ksz4yafvy2nmzn09ifcgr69fjkvsr1qh7",
     "deps": {
       "gn": {
         "version": "2021-02-09",
diff --git a/pkgs/applications/networking/browsers/gmni/default.nix b/pkgs/applications/networking/browsers/gmni/default.nix
new file mode 100644
index 000000000000..7baca62e6732
--- /dev/null
+++ b/pkgs/applications/networking/browsers/gmni/default.nix
@@ -0,0 +1,24 @@
+{ stdenv, lib, fetchFromSourcehut, pkg-config, bearssl, scdoc }:
+
+stdenv.mkDerivation rec {
+  pname = "gmni";
+  version = "unstable-2021-03-26";
+
+  src = fetchFromSourcehut {
+    owner = "~sircmpwn";
+    repo = "gmni";
+    rev = "77b73efbcd3ea7ed9e3e4c0aa19d9247e21d3c87";
+    sha256 = "1wvnzyv7vyddcd39y6q5aflpnnsdl4k4y5aj5ssb7vgkld0h1b7r";
+  };
+
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [ bearssl scdoc ];
+
+  meta = with lib; {
+    description = "A Gemini client";
+    homepage = "https://git.sr.ht/~sircmpwn/gmni";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ bsima jb55 ];
+    platforms = platforms.all;
+  };
+}
diff --git a/pkgs/applications/networking/cluster/tektoncd-cli/default.nix b/pkgs/applications/networking/cluster/tektoncd-cli/default.nix
index 847e3f64ca6b..c59c03714890 100644
--- a/pkgs/applications/networking/cluster/tektoncd-cli/default.nix
+++ b/pkgs/applications/networking/cluster/tektoncd-cli/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "tektoncd-cli";
-  version = "0.17.0";
+  version = "0.17.1";
 
   src = fetchFromGitHub {
     owner = "tektoncd";
     repo = "cli";
     rev = "v${version}";
-    sha256 = "sha256-IyYlmatgcVbUj1WCPAFVOIgn1iHM80P4ie6d1YD3ISM=";
+    sha256 = "sha256-xwUTSJ0rlNzQqGQp6jL03L4SuHUvvD3aWXxa1Xp0UyM=";
   };
 
   vendorSha256 = null;
diff --git a/pkgs/applications/version-management/git-and-tools/bit/default.nix b/pkgs/applications/version-management/git-and-tools/bit/default.nix
index e41c2569fcb3..1c88edfd901d 100644
--- a/pkgs/applications/version-management/git-and-tools/bit/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/bit/default.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "bit";
-  version = "1.0.5";
+  version = "1.0.6";
 
   src = fetchFromGitHub {
     owner = "chriswalz";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0dv6ma2vwb21cbxkxzrpmj7cqlhwr7a86i4g728m3y1aclh411sn";
+    sha256 = "sha256-juQAFVqs0d4EtoX24EyrlKd2qRRseP+jKfM0ymkD39E=";
   };
 
-  vendorSha256 = "1j6w7bll4zyp99579dhs2rza4y9kgfz3g8d5grfzgqck6cjj9mn8";
+  vendorSha256 = "sha256-3Y/B14xX5jaoL44rq9+Nn4niGViLPPXBa8WcJgTvYTA=";
 
   propagatedBuildInputs = [ git ];
 
diff --git a/pkgs/applications/window-managers/xmonad/log-applet/default.nix b/pkgs/applications/window-managers/xmonad/log-applet/default.nix
index ebabcf196d5b..830242667db6 100644
--- a/pkgs/applications/window-managers/xmonad/log-applet/default.nix
+++ b/pkgs/applications/window-managers/xmonad/log-applet/default.nix
@@ -38,7 +38,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     homepage = "https://github.com/kalj/xmonad-log-applet";
     license = licenses.bsd3;
-    broken = desktopSupport == "gnomeflashback";
+    broken = desktopSupport == "gnomeflashback" || desktopSupport == "xfce4";
     description = "An applet that will display XMonad log information (${desktopSupport} version)";
     platforms = platforms.linux;
     maintainers = with maintainers; [ abbradar ];
diff --git a/pkgs/data/fonts/kreative-square-fonts/default.nix b/pkgs/data/fonts/kreative-square-fonts/default.nix
new file mode 100644
index 000000000000..c9e51319733f
--- /dev/null
+++ b/pkgs/data/fonts/kreative-square-fonts/default.nix
@@ -0,0 +1,28 @@
+{ lib, fetchFromGitHub }:
+
+let
+  pname = "kreative-square-fonts";
+  version = "unstable-2021-01-29";
+in
+fetchFromGitHub {
+  name = "${pname}-${version}";
+
+  owner = "kreativekorp";
+  repo = "open-relay";
+  rev = "084f05af3602307499981651eca56851bec01fca";
+
+  postFetch = ''
+    tar xf $downloadedFile --strip=1
+    install -Dm444 -t $out/share/fonts/truetype/ KreativeSquare/KreativeSquare.ttf
+    install -Dm444 -t $out/share/fonts/truetype/ KreativeSquare/KreativeSquareSM.ttf
+  '';
+  sha256 = "15vvbbzv6b3jh7lxg77viycdd7yf3y8lxy54vs3rsrsxwncg0pak";
+
+  meta = with lib; {
+    description = "Fullwidth scalable monospace font designed specifically to support pseudographics, semigraphics, and private use characters";
+    homepage = "https://www.kreativekorp.com/software/fonts/ksquare.shtml";
+    license = licenses.ofl;
+    platforms = platforms.all;
+    maintainers = [ maintainers.linus ];
+  };
+}
diff --git a/pkgs/desktops/xfce/applications/gigolo/default.nix b/pkgs/desktops/xfce/applications/gigolo/default.nix
index 6a3123db4da9..b9ff011f3be1 100644
--- a/pkgs/desktops/xfce/applications/gigolo/default.nix
+++ b/pkgs/desktops/xfce/applications/gigolo/default.nix
@@ -1,4 +1,4 @@
-{ mkXfceDerivation, exo, gtk3, gvfs, glib }:
+{ lib, mkXfceDerivation, gtk3, gvfs, glib }:
 
 mkXfceDerivation {
   category = "apps";
@@ -8,10 +8,15 @@ mkXfceDerivation {
 
   sha256 = "8UDb4H3zxRKx2y+MRsozQoR3es0fs5ooR/5wBIE11bY=";
 
-  nativeBuildInputs = [ exo ];
   buildInputs = [ gtk3 glib gvfs ];
 
+  postPatch = ''
+    # exo-csource has been dropped from exo
+    substituteInPlace src/Makefile.am --replace exo-csource xdt-csource
+  '';
+
   meta = {
     description = "A frontend to easily manage connections to remote filesystems";
+    license = with lib.licenses; [ gpl2Only ];
   };
 }
diff --git a/pkgs/desktops/xfce/applications/mousepad/allow-checking-parent-sources-when-looking-up-schema.patch b/pkgs/desktops/xfce/applications/mousepad/allow-checking-parent-sources-when-looking-up-schema.patch
new file mode 100644
index 000000000000..aa797bf42cfe
--- /dev/null
+++ b/pkgs/desktops/xfce/applications/mousepad/allow-checking-parent-sources-when-looking-up-schema.patch
@@ -0,0 +1,25 @@
+From 3b06d6129033ddaa8dc455a6a572077fd63a3816 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Jos=C3=A9=20Romildo=20Malaquias?= <malaquias@gmail.com>
+Date: Mon, 1 Mar 2021 17:03:07 -0300
+Subject: [PATCH] Allow checking parent sources when looking up schema
+
+---
+ mousepad/mousepad-settings-store.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/mousepad/mousepad-settings-store.c b/mousepad/mousepad-settings-store.c
+index e5a848b..de989bd 100644
+--- a/mousepad/mousepad-settings-store.c
++++ b/mousepad/mousepad-settings-store.c
+@@ -181,7 +181,7 @@ mousepad_settings_store_add_settings (MousepadSettingsStore *self,
+   const gchar      *prefix;
+ 
+   /* loop through keys in schema and store mapping of their setting name to GSettings */
+-  schema = g_settings_schema_source_lookup (source, schema_id, FALSE);
++  schema = g_settings_schema_source_lookup (source, schema_id, TRUE);
+   keys = g_settings_schema_list_keys (schema);
+   prefix = schema_id + MOUSEPAD_ID_LEN + 1;
+   for (key = keys; key && *key; key++)
+-- 
+2.30.0
+
diff --git a/pkgs/desktops/xfce/applications/mousepad/default.nix b/pkgs/desktops/xfce/applications/mousepad/default.nix
index 3c84f5558a11..eaac32bb5e34 100644
--- a/pkgs/desktops/xfce/applications/mousepad/default.nix
+++ b/pkgs/desktops/xfce/applications/mousepad/default.nix
@@ -1,20 +1,20 @@
-{ mkXfceDerivation, exo, glib, gtk3, gtksourceview3, xfconf }:
+{ mkXfceDerivation, gobject-introspection, vala, gtk3, gtksourceview3, xfconf }:
 
 mkXfceDerivation {
   category = "apps";
   pname = "mousepad";
-  version = "0.4.2";
+  version = "0.5.3";
   odd-unstable = false;
 
-  sha256 = "0a35vaq4l0d8vzw7hqpvbgkr3wj1sqr2zvj7bc5z4ikz2cppqj7p";
+  sha256 = "0ki5k5p24dpawkyq4k8am1fcq02njhnmhq5vf2ah1zqbc0iyl5yn";
 
-  nativeBuildInputs = [ exo ];
-  buildInputs = [ glib gtk3 gtksourceview3 xfconf ];
+  nativeBuildInputs = [ gobject-introspection vala ];
 
-  # See https://github.com/NixOS/nixpkgs/issues/36468
-  NIX_CFLAGS_COMPILE = "-I${glib.dev}/include/gio-unix-2.0";
+  buildInputs = [ gtk3 gtksourceview3 xfconf ];
+
+  patches = [ ./allow-checking-parent-sources-when-looking-up-schema.patch ];
 
   meta = {
-    description = "A simple text editor for Xfce";
+    description = "Simple text editor for Xfce";
   };
 }
diff --git a/pkgs/desktops/xfce/applications/parole/default.nix b/pkgs/desktops/xfce/applications/parole/default.nix
index bfb865184487..5c55a22ea74c 100644
--- a/pkgs/desktops/xfce/applications/parole/default.nix
+++ b/pkgs/desktops/xfce/applications/parole/default.nix
@@ -7,9 +7,9 @@
 mkXfceDerivation {
   category = "apps";
   pname = "parole";
-  version = "1.0.5";
+  version = "4.16.0";
 
-  sha256 = "0qgis2gnkcvg7xwp76cbi0ihqdjprvvw2d66hk7klhrafp7c0v13";
+  sha256 = "07hcnbcd56lq7z3gq1cnk71ppy98hwdvlfp5z3zlc55cqrry26zm";
 
   postPatch = ''
     substituteInPlace src/plugins/mpris2/Makefile.am \
diff --git a/pkgs/desktops/xfce/applications/ristretto/default.nix b/pkgs/desktops/xfce/applications/ristretto/default.nix
index 8766bd302ab3..e439c3d055df 100644
--- a/pkgs/desktops/xfce/applications/ristretto/default.nix
+++ b/pkgs/desktops/xfce/applications/ristretto/default.nix
@@ -1,4 +1,4 @@
-{ mkXfceDerivation, automakeAddFlags, exo, gtk3, glib, libexif
+{ mkXfceDerivation, gtk3, glib, libexif
 , libxfce4ui, libxfce4util, xfconf }:
 
 mkXfceDerivation {
@@ -8,9 +8,13 @@ mkXfceDerivation {
 
   sha256 = "07h7wbq3xh2ac6q4kp2ai1incfn0zfxxngap7hzqx47a5xw2mrm8";
 
-  nativeBuildInputs = [ exo ];
   buildInputs = [ glib gtk3 libexif libxfce4ui libxfce4util xfconf ];
 
+  postPatch = ''
+    # exo-csource has been dropped from exo
+    substituteInPlace src/Makefile.am --replace exo-csource xdt-csource
+  '';
+
   meta = {
     description = "A fast and lightweight picture-viewer for the Xfce desktop environment";
   };
diff --git a/pkgs/desktops/xfce/applications/xfce4-dict/default.nix b/pkgs/desktops/xfce/applications/xfce4-dict/default.nix
index 7e582abc05f7..6761d2ed5cd9 100644
--- a/pkgs/desktops/xfce/applications/xfce4-dict/default.nix
+++ b/pkgs/desktops/xfce/applications/xfce4-dict/default.nix
@@ -3,9 +3,9 @@
 mkXfceDerivation {
   category = "apps";
   pname = "xfce4-dict";
-  version = "0.8.3";
+  version = "0.8.4";
 
-  sha256 = "0p7k2ffknr23hh3j17dhh5q8adn736p2piwx0sg8f5dvvhhc5whz";
+  sha256 = "0gm5gwqxhnv3qz9ggf8dj1sq5s72xcliidkyip9l91msx03hfjah";
 
   patches = [ ./configure-gio.patch ];
 
diff --git a/pkgs/desktops/xfce/applications/xfce4-notifyd/default.nix b/pkgs/desktops/xfce/applications/xfce4-notifyd/default.nix
index c9a614888404..64ab34d2b6fe 100644
--- a/pkgs/desktops/xfce/applications/xfce4-notifyd/default.nix
+++ b/pkgs/desktops/xfce/applications/xfce4-notifyd/default.nix
@@ -4,9 +4,9 @@
 mkXfceDerivation {
   category = "apps";
   pname = "xfce4-notifyd";
-  version = "0.6.1";
+  version = "0.6.2";
 
-  sha256 = "18d2q5b54df8j2281lash8gm0826c6apn39q4igfz2zfcyqjh1if";
+  sha256 = "1q8n7dffyqbfyy6vpqlmnsfpavlc7iz6hhv1h27fkwzswy2rx28s";
 
   buildInputs = [ exo gtk3 glib libnotify libxfce4ui libxfce4util xfce4-panel xfconf ];
 
diff --git a/pkgs/desktops/xfce/applications/xfce4-screenshooter/default.nix b/pkgs/desktops/xfce/applications/xfce4-screenshooter/default.nix
index 8c0fa3e3edb6..3098b9c756ea 100644
--- a/pkgs/desktops/xfce/applications/xfce4-screenshooter/default.nix
+++ b/pkgs/desktops/xfce/applications/xfce4-screenshooter/default.nix
@@ -3,10 +3,10 @@
 mkXfceDerivation {
   category = "apps";
   pname = "xfce4-screenshooter";
-  version = "1.9.7";
+  version = "1.9.8";
   odd-unstable = false;
 
-  sha256 = "14vbd7iigaw57hl47rnixk873c20q5clqynzkm9zzpqc568dxixd";
+  sha256 = "0pbzjcaxm8gk0s75s99kvzygmih4yghp7ngf2mxymjiywcxqr40d";
 
   buildInputs = [ exo gtk3 libsoup libxfce4ui libxfce4util xfce4-panel glib-networking ];
 
diff --git a/pkgs/desktops/xfce/applications/xfce4-taskmanager/default.nix b/pkgs/desktops/xfce/applications/xfce4-taskmanager/default.nix
index fd59b173a732..5a1510eaa8c5 100644
--- a/pkgs/desktops/xfce/applications/xfce4-taskmanager/default.nix
+++ b/pkgs/desktops/xfce/applications/xfce4-taskmanager/default.nix
@@ -3,9 +3,9 @@
 mkXfceDerivation {
   category = "apps";
   pname = "xfce4-taskmanager";
-  version = "1.2.3";
+  version = "1.4.2";
 
-  sha256 = "0818chns7vkvjqakgz8z790adkygcq4jlw59dv6kyzk17hxq6cxv";
+  sha256 = "1l7k00y3d9j38g4hxjrcrh1y4s6s77sq4sjcadsbpzs6zdf05hld";
 
   nativeBuildInputs = [ exo ];
   buildInputs = [ gtk3 libwnck3 libXmu ];
diff --git a/pkgs/desktops/xfce/applications/xfce4-terminal/default.nix b/pkgs/desktops/xfce/applications/xfce4-terminal/default.nix
index 56de8d3bfb83..19d98f84e3ae 100644
--- a/pkgs/desktops/xfce/applications/xfce4-terminal/default.nix
+++ b/pkgs/desktops/xfce/applications/xfce4-terminal/default.nix
@@ -1,11 +1,13 @@
-{ mkXfceDerivation, gtk3, libxfce4ui, vte, xfconf, pcre2 }:
+{ mkXfceDerivation, gtk3, libxfce4ui, vte, xfconf, pcre2, libxslt, docbook_xml_dtd_45, docbook_xsl }:
 
 mkXfceDerivation {
   category = "apps";
   pname = "xfce4-terminal";
-  version = "0.8.9.2";
+  version = "0.8.10";
 
-  sha256 = "1vlpfsrdalqmsd86aj0kvvam5skzn6xngigjziwli6q6il6lb9fj";
+  sha256 = "0v58qcrdpqpd2nbwlc4ra7j9nkvfzfhb1zcp1kggbn627q86i0ql";
+
+  nativeBuildInputs = [ libxslt docbook_xml_dtd_45 docbook_xsl ];
 
   buildInputs = [ gtk3 libxfce4ui vte xfconf pcre2 ];
 
diff --git a/pkgs/desktops/xfce/applications/xfdashboard/default.nix b/pkgs/desktops/xfce/applications/xfdashboard/default.nix
index a9610125b5b5..837361669480 100644
--- a/pkgs/desktops/xfce/applications/xfdashboard/default.nix
+++ b/pkgs/desktops/xfce/applications/xfdashboard/default.nix
@@ -17,11 +17,11 @@
 mkXfceDerivation {
   category = "apps";
   pname = "xfdashboard";
-  version = "0.7.7";
+  version = "0.9.1";
   rev-prefix = "";
   odd-unstable = false;
 
-  sha256 = "0b9pl3k8wl7svwhb9knhvr86gjg2904n788l8cbczwy046ql7pyc";
+  sha256 = "14k774wxbk3w0ci2mmm6bhq4i742qahd0j0dr40iwmld55473zgd";
 
   buildInputs = [
     clutter
diff --git a/pkgs/desktops/xfce/art/xfwm4-themes/default.nix b/pkgs/desktops/xfce/art/xfwm4-themes/default.nix
index 569a18a796e8..31623598d316 100644
--- a/pkgs/desktops/xfce/art/xfwm4-themes/default.nix
+++ b/pkgs/desktops/xfce/art/xfwm4-themes/default.nix
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     homepage = "https://www.xfce.org/";
     description = "Themes for Xfce";
-    license = licenses.gpl3;
+    license = licenses.gpl3Only;
     platforms = platforms.linux;
     maintainers = [ maintainers.volth ];
   };
diff --git a/pkgs/desktops/xfce/core/exo/default.nix b/pkgs/desktops/xfce/core/exo/default.nix
index 17da815534ce..d9afdfe0d9cf 100644
--- a/pkgs/desktops/xfce/core/exo/default.nix
+++ b/pkgs/desktops/xfce/core/exo/default.nix
@@ -1,12 +1,12 @@
-{ mkXfceDerivation, docbook_xsl, glib, libxslt, gtk2, gtk3
+{ mkXfceDerivation, docbook_xsl, glib, libxslt, gtk3
 , libxfce4ui, libxfce4util, perl }:
 
 mkXfceDerivation {
   category = "xfce";
   pname = "exo";
-  version = "0.12.11";
+  version = "4.16.1";
 
-  sha256 = "1db7w6jk3i501x4qw0hs0ydrm1fjdkxmahzbv5iag859wnnlg0pd";
+  sha256 = "1220mq8gs5s8l0d1p92j6icldzqj6zaisp27ss5jm7hwkkcnms9n";
 
   nativeBuildInputs = [
     libxslt
@@ -14,7 +14,6 @@ mkXfceDerivation {
   ];
 
   buildInputs = [
-    gtk2 # some xfce plugins still uses gtk2
     gtk3
     glib
     libxfce4ui
diff --git a/pkgs/desktops/xfce/core/garcon/default.nix b/pkgs/desktops/xfce/core/garcon/default.nix
index 69184f2afa88..56ce6ac8aa29 100644
--- a/pkgs/desktops/xfce/core/garcon/default.nix
+++ b/pkgs/desktops/xfce/core/garcon/default.nix
@@ -1,15 +1,18 @@
-{ mkXfceDerivation, gtk3, libxfce4ui, libxfce4util }:
+{ lib, mkXfceDerivation, gobject-introspection, gtk3, libxfce4ui, libxfce4util }:
 
 mkXfceDerivation {
   category = "xfce";
   pname = "garcon";
-  version = "0.6.4";
+  version = "4.16.1";
 
-  sha256 = "0pamhp1wffiw638s66nws2mpzmwkhvhb6iwccfy8b0kyr57wipjv";
+  sha256 = "134nm1754i12axl4si60fdwkbk2v6z108nrj9c0lb5in1zmqwa9a";
+
+  nativeBuildInputs = [ gobject-introspection ];
 
   buildInputs = [ gtk3 libxfce4ui libxfce4util ];
 
   meta = {
     description = "Xfce menu support library";
+    license = with lib.licenses; [ lgpl2Only fdl11Only ];
   };
 }
diff --git a/pkgs/desktops/xfce/core/libxfce4ui/default.nix b/pkgs/desktops/xfce/core/libxfce4ui/default.nix
index 79c8ec74b626..e17880f1b1b0 100644
--- a/pkgs/desktops/xfce/core/libxfce4ui/default.nix
+++ b/pkgs/desktops/xfce/core/libxfce4ui/default.nix
@@ -1,15 +1,15 @@
-{ lib, mkXfceDerivation, gobject-introspection, gtk2, gtk3, libICE, libSM
-, libstartup_notification, libxfce4util, xfconf }:
+{ lib, mkXfceDerivation, gobject-introspection, vala, gtk3, libICE, libSM
+, libstartup_notification, libgtop, epoxy, libxfce4util, xfconf }:
 
 mkXfceDerivation {
   category = "xfce";
   pname = "libxfce4ui";
-  version = "4.14.1";
+  version = "4.16.0";
 
-  sha256 = "0fnncf30s51qhgixn57z4d021pjjhzgsg2x69w4dy68vff2347qy";
+  sha256 = "0a9wfdpsv83giwv6kcidvpd6c665aa7sv6f2l1q6qcq214vb0rk2";
 
-  nativeBuildInputs = [ gobject-introspection ];
-  buildInputs =  [ gtk2 gtk3 libstartup_notification xfconf ];
+  nativeBuildInputs = [ gobject-introspection vala ];
+  buildInputs =  [ gtk3 libstartup_notification libgtop epoxy xfconf ];
   propagatedBuildInputs = [ libxfce4util libICE libSM ];
 
   configureFlags = [
@@ -18,6 +18,6 @@ mkXfceDerivation {
 
   meta = with lib; {
     description = "Widgets library for Xfce";
-    license = licenses.lgpl2Plus;
+    license = with licenses; [ lgpl2Plus lgpl21Plus ];
   };
 }
diff --git a/pkgs/desktops/xfce/core/libxfce4util/default.nix b/pkgs/desktops/xfce/core/libxfce4util/default.nix
index 4540d2352511..69c392128503 100644
--- a/pkgs/desktops/xfce/core/libxfce4util/default.nix
+++ b/pkgs/desktops/xfce/core/libxfce4util/default.nix
@@ -1,13 +1,13 @@
-{ lib, mkXfceDerivation, gobject-introspection }:
+{ lib, mkXfceDerivation, gobject-introspection, vala }:
 
 mkXfceDerivation {
   category = "xfce";
   pname = "libxfce4util";
-  version = "4.14.0";
+  version = "4.16.0";
 
-  sha256 = "0vq16bzmnykiikg4dhiaj0qbyj76nkdd54j6k6n568h3dc9ix6q4";
+  sha256 = "1p0snipc81dhaq5glv7c1zfq5pcvgq7nikl4ikhfm2af9picfsxb";
 
-  nativeBuildInputs = [ gobject-introspection ];
+  nativeBuildInputs = [ gobject-introspection vala ];
 
   meta = with lib; {
     description = "Extension library for Xfce";
diff --git a/pkgs/desktops/xfce/core/thunar-volman/default.nix b/pkgs/desktops/xfce/core/thunar-volman/default.nix
index ecc26ccb8fea..6ceca34b1bdd 100644
--- a/pkgs/desktops/xfce/core/thunar-volman/default.nix
+++ b/pkgs/desktops/xfce/core/thunar-volman/default.nix
@@ -3,11 +3,11 @@
 mkXfceDerivation {
   category = "xfce";
   pname = "thunar-volman";
-  version = "0.9.5";
+  version = "4.16.0";
 
   buildInputs = [ exo gtk3 libgudev libxfce4ui libxfce4util xfconf ];
 
-  sha256 = "1qrlpn0q5g9psd41l6y80r3bvbg8jaic92m6r400zzwcvivf95z0";
+  sha256 = "002nkxsvcq384dgpj7lv3bmb21ks64hsq13l67z1dcjbj51hzl03";
 
   odd-unstable = false;
 
diff --git a/pkgs/desktops/xfce/core/thunar/default.nix b/pkgs/desktops/xfce/core/thunar/default.nix
index 00da58f6628b..cc94683ddde4 100644
--- a/pkgs/desktops/xfce/core/thunar/default.nix
+++ b/pkgs/desktops/xfce/core/thunar/default.nix
@@ -21,9 +21,9 @@
 let unwrapped = mkXfceDerivation {
   category = "xfce";
   pname = "thunar";
-  version = "1.8.15";
+  version = "4.16.6";
 
-  sha256 = "1y9d88i0kwl7ak4d65gy3qf4bpkiyaqxd4g6px3v1ykf274k8al8";
+  sha256 = "12zqwazsqdmghy4h2c4fwxha069l07d46i512395y22h7n6655rn";
 
   nativeBuildInputs = [
     docbook_xsl
diff --git a/pkgs/desktops/xfce/core/tumbler/default.nix b/pkgs/desktops/xfce/core/tumbler/default.nix
index cb6f90e5b96e..510d30ae63fb 100644
--- a/pkgs/desktops/xfce/core/tumbler/default.nix
+++ b/pkgs/desktops/xfce/core/tumbler/default.nix
@@ -5,7 +5,6 @@
 , freetype
 , libgsf
 , poppler
-, libjpeg
 , gst_all_1
 }:
 
@@ -14,9 +13,9 @@
 mkXfceDerivation {
   category = "xfce";
   pname = "tumbler";
-  version = "0.2.9";
+  version = "4.16.0";
 
-  sha256 = "0b3mli40msv35qn67c1m9rn5bigj6ls10l08qk7fa3fwvzl49hmw";
+  sha256 = "1z4q858afj3yksim4lc96wylgvymv4cv6iw41qdxl5xd6ii2ddr4";
 
   buildInputs = [
     ffmpegthumbnailer
diff --git a/pkgs/desktops/xfce/core/xfce4-appfinder/default.nix b/pkgs/desktops/xfce/core/xfce4-appfinder/default.nix
index cbb444c6c764..01cc70e3b9af 100644
--- a/pkgs/desktops/xfce/core/xfce4-appfinder/default.nix
+++ b/pkgs/desktops/xfce/core/xfce4-appfinder/default.nix
@@ -3,9 +3,9 @@
 mkXfceDerivation {
   category = "xfce";
   pname = "xfce4-appfinder";
-  version = "4.14.0";
+  version = "4.16.1";
 
-  sha256 = "04h7jxfm3wkxnxfy8149dckay7i160vvk4p9lnq6xny22r4x20h8";
+  sha256 = "1r7sjdavqadrpgxqclrznds7a1c2i7mlvghx5mi6qqnh42425gsy";
 
   nativeBuildInputs = [ exo ];
   buildInputs = [ garcon gtk3 libxfce4ui libxfce4util xfconf ];
diff --git a/pkgs/desktops/xfce/core/xfce4-dev-tools/default.nix b/pkgs/desktops/xfce/core/xfce4-dev-tools/default.nix
index 38fe82ffb011..9b3f443ba38a 100644
--- a/pkgs/desktops/xfce/core/xfce4-dev-tools/default.nix
+++ b/pkgs/desktops/xfce/core/xfce4-dev-tools/default.nix
@@ -1,14 +1,27 @@
-{ mkXfceDerivation, autoreconfHook, autoconf, automake
-, glib, gtk-doc, intltool, libtool }:
+{ mkXfceDerivation
+, autoreconfHook
+, libxslt
+, docbook_xsl
+, autoconf
+, automake
+, glib
+, gtk-doc
+, intltool
+, libtool
+}:
 
 mkXfceDerivation {
   category = "xfce";
   pname = "xfce4-dev-tools";
-  version = "4.14.0";
+  version = "4.16.0";
 
-  sha256 = "10hcj88784faqrk08xb538355cla26vdk9ckx158hqdqv38sb42f";
+  sha256 = "0w47npi1np9vb7lhzjr680aa1xb8ch6kcbg0l0bqnpm0y0jmvgz6";
 
-  nativeBuildInputs = [ autoreconfHook ];
+  nativeBuildInputs = [
+    autoreconfHook
+    libxslt
+    docbook_xsl
+  ];
 
   propagatedBuildInputs = [
     autoconf
@@ -19,11 +32,6 @@ mkXfceDerivation {
     libtool
   ];
 
-  preAutoreconf = ''
-    substitute configure.ac.in configure.ac \
-      --subst-var-by REVISION UNKNOWN
-  '';
-
   setupHook = ./setup-hook.sh;
 
   meta = {
diff --git a/pkgs/desktops/xfce/core/xfce4-dev-tools/setup-hook.sh b/pkgs/desktops/xfce/core/xfce4-dev-tools/setup-hook.sh
index 600bf47fd872..3abf3172ea66 100644
--- a/pkgs/desktops/xfce/core/xfce4-dev-tools/setup-hook.sh
+++ b/pkgs/desktops/xfce/core/xfce4-dev-tools/setup-hook.sh
@@ -1,5 +1,5 @@
 xdtEnvHook() {
-    addToSearchPath ACLOCAL_PATH $1/share/xfce4/dev-tools/m4macros
+    addToSearchPath ACLOCAL_PATH $1/share/aclocal
 }
 
 envHooks+=(xdtEnvHook)
diff --git a/pkgs/desktops/xfce/core/xfce4-panel/default.nix b/pkgs/desktops/xfce/core/xfce4-panel/default.nix
index b7bede9e27bb..0a08d3882386 100644
--- a/pkgs/desktops/xfce/core/xfce4-panel/default.nix
+++ b/pkgs/desktops/xfce/core/xfce4-panel/default.nix
@@ -1,17 +1,48 @@
-{ mkXfceDerivation, tzdata, exo, garcon, gtk2, gtk3, glib, gettext, glib-networking, libxfce4ui, libxfce4util, libwnck3, xfconf, gobject-introspection }:
+{ mkXfceDerivation
+, exo
+, garcon
+, gettext
+, glib
+, gobject-introspection
+, gtk3
+, libdbusmenu-gtk3
+, libwnck3
+, libxfce4ui
+, libxfce4util
+, tzdata
+, vala
+, xfconf
+}:
 
 mkXfceDerivation {
   category = "xfce";
   pname = "xfce4-panel";
-  version = "4.14.4";
+  version = "4.16.2";
 
-  sha256 = "1srzgb9vsvfrbhym74zkz9hdhxcrvbffxpfgv5vprhlwxw3vk3fq";
+  sha256 = "0wy66viwjnp1c0lgf90fp3vyqy0f1m1kbfdym8a0yrv2b6sn3958";
 
-  nativeBuildInputs = [ gobject-introspection ];
-  buildInputs = [ exo garcon gtk2 gtk3 glib glib-networking libxfce4ui libxfce4util libwnck3 xfconf ];
+  nativeBuildInputs = [
+    gobject-introspection
+    vala
+  ];
+
+  buildInputs = [
+    exo
+    garcon
+    libdbusmenu-gtk3
+    libxfce4ui
+    libwnck3
+    xfconf
+    tzdata
+  ];
+
+  propagatedBuildInputs = [
+    glib
+    gtk3
+    libxfce4util
+  ];
 
   patches = [ ./xfce4-panel-datadir.patch ];
-  patchFlags = [ "-p1" ];
 
   postPatch = ''
     for f in $(find . -name \*.sh); do
@@ -21,9 +52,10 @@ mkXfceDerivation {
        --replace "/usr/share/zoneinfo" "${tzdata}/share/zoneinfo"
   '';
 
-  configureFlags = [ "--enable-gtk3" ];
+  # Workaround https://bugzilla.xfce.org/show_bug.cgi?id=15825
+  NIX_CFLAGS_COMPILE = "-I${glib.dev}/include/gio-unix-2.0";
 
-  meta =  {
+  meta = {
     description = "Xfce's panel";
   };
 }
diff --git a/pkgs/desktops/xfce/core/xfce4-power-manager/default.nix b/pkgs/desktops/xfce/core/xfce4-power-manager/default.nix
index 9f9a552b8cc6..709b6a2a0cbf 100644
--- a/pkgs/desktops/xfce/core/xfce4-power-manager/default.nix
+++ b/pkgs/desktops/xfce/core/xfce4-power-manager/default.nix
@@ -4,9 +4,9 @@
 mkXfceDerivation {
   category = "xfce";
   pname = "xfce4-power-manager";
-  version = "1.6.6";
+  version = "4.16.0";
 
-  sha256 = "0lyp3dp4ijbpf21vanrvgm6rmfp8v0zyqxibdj5gxnadmvcq38iy";
+  sha256 = "1rfw07xbv83rfb0mz3ayanlcvnaq7xpl2znsyya0hspysvavwks2";
 
   nativeBuildInputs = [ automakeAddFlags exo ];
   buildInputs = [ gtk3 libnotify libxfce4ui libxfce4util upower xfconf ];
diff --git a/pkgs/desktops/xfce/core/xfce4-session/default.nix b/pkgs/desktops/xfce/core/xfce4-session/default.nix
index c7442a01957a..0d4c0615898c 100644
--- a/pkgs/desktops/xfce/core/xfce4-session/default.nix
+++ b/pkgs/desktops/xfce/core/xfce4-session/default.nix
@@ -1,11 +1,11 @@
-{ mkXfceDerivation, polkit, exo, libxfce4util, libxfce4ui, xfconf, iceauth, gtk3, glib, libwnck3, xorg, xfce4-session }:
+{ mkXfceDerivation, polkit, exo, libxfce4util, libxfce4ui, xfconf, iceauth, gtk3, glib, libwnck3, xfce4-session }:
 
 mkXfceDerivation {
   category = "xfce";
   pname = "xfce4-session";
-  version = "4.14.2";
+  version = "4.16.0";
 
-  sha256 = "1gr6j96l792v33lbh7rqpbdjmy8m68hy14bsndx6bykv10zvmgx2";
+  sha256 = "0b8vkcqn2arjp6qdwmzr0f84n8fjgy2kbf9h4gq03400ar1l111c";
 
   buildInputs = [ exo gtk3 glib libxfce4ui libxfce4util libwnck3 xfconf polkit iceauth ];
 
diff --git a/pkgs/desktops/xfce/core/xfce4-settings/default.nix b/pkgs/desktops/xfce/core/xfce4-settings/default.nix
index 9b263e5ee733..71645cd1f988 100644
--- a/pkgs/desktops/xfce/core/xfce4-settings/default.nix
+++ b/pkgs/desktops/xfce/core/xfce4-settings/default.nix
@@ -1,16 +1,16 @@
-{ mkXfceDerivation, automakeAddFlags, exo, garcon, gtk3, glib
+{ mkXfceDerivation, exo, garcon, gtk3, glib
 , libnotify, libxfce4ui, libxfce4util, libxklavier
 , upower, xfconf, xf86inputlibinput }:
 
 mkXfceDerivation {
   category = "xfce";
   pname = "xfce4-settings";
-  version = "4.14.3";
+  version = "4.16.0";
 
-  sha256 = "1zzngdj7mp2r6rcs8gvda1218zlz5gpnc6gsp20z32l69psp3yld";
+  sha256 = "0iha3jm7vmgk6hq7z4l2r7w9qm5jraka0z580i8i83704kfx9g0y";
 
   postPatch = ''
-    for f in $(find . -name \*.c); do
+    for f in xfsettingsd/pointers.c dialogs/mouse-settings/main.c; do
       substituteInPlace $f --replace \"libinput-properties.h\" '<xorg/libinput-properties.h>'
     done
   '';
diff --git a/pkgs/desktops/xfce/core/xfconf/default.nix b/pkgs/desktops/xfce/core/xfconf/default.nix
index 357f4b234108..41af53c9cc21 100644
--- a/pkgs/desktops/xfce/core/xfconf/default.nix
+++ b/pkgs/desktops/xfce/core/xfconf/default.nix
@@ -1,11 +1,13 @@
-{ mkXfceDerivation, libxfce4util }:
+{ mkXfceDerivation, libxfce4util, gobject-introspection, vala }:
 
 mkXfceDerivation {
   category = "xfce";
   pname = "xfconf";
-  version = "4.14.3";
+  version = "4.16.0";
 
-  sha256 = "0yxpdcyz81di7w9493jzps09bgrlgianjj5abnzahqmkpmpvb0rh";
+  sha256 = "00cp2cm1w5a6k7g0fjvqx7d2iwaqw196vii9jkx1aa7mb0f2gk63";
+
+  nativeBuildInputs = [ gobject-introspection vala ];
 
   buildInputs = [ libxfce4util ];
 
diff --git a/pkgs/desktops/xfce/core/xfdesktop/default.nix b/pkgs/desktops/xfce/core/xfdesktop/default.nix
index 75e9fc8cb653..a9e461a4e646 100644
--- a/pkgs/desktops/xfce/core/xfdesktop/default.nix
+++ b/pkgs/desktops/xfce/core/xfdesktop/default.nix
@@ -3,9 +3,9 @@
 mkXfceDerivation {
   category = "xfce";
   pname = "xfdesktop";
-  version = "4.14.2";
+  version = "4.16.0";
 
-  sha256 = "04fhm1pf9290sy3ymrmnfnm2x6fq5ldzvj5bjd9kz6zkx0nsq1za";
+  sha256 = "1znbccr25wvizmzzgdcf719y3qc9gqdi1g4rasgrmi95427lvwn3";
 
   buildInputs = [
     exo
diff --git a/pkgs/desktops/xfce/core/xfwm4/default.nix b/pkgs/desktops/xfce/core/xfwm4/default.nix
index df46a80c4b7b..f8cfc551545c 100644
--- a/pkgs/desktops/xfce/core/xfwm4/default.nix
+++ b/pkgs/desktops/xfce/core/xfwm4/default.nix
@@ -5,9 +5,9 @@
 mkXfceDerivation {
   category = "xfce";
   pname = "xfwm4";
-  version = "4.14.6";
+  version = "4.16.1";
 
-  sha256 = "1ml5b4nn8laqhjihfqqsbjn66525abhin5d32bplh1k9yfxw4xi4";
+  sha256 = "1lhxm9ifkrnvn1vq3aak3kd695i1ishpryjnw617ifzawy9lj10b";
 
   nativeBuildInputs = [ exo librsvg ];
 
diff --git a/pkgs/desktops/xfce/mkXfceDerivation.nix b/pkgs/desktops/xfce/mkXfceDerivation.nix
index 5c47dc7f85d1..a9f30ebfab55 100644
--- a/pkgs/desktops/xfce/mkXfceDerivation.nix
+++ b/pkgs/desktops/xfce/mkXfceDerivation.nix
@@ -48,7 +48,7 @@ let
 
     meta = with lib; {
       homepage = "https://gitlab.xfce.org/${category}/${pname}/about";
-      license = licenses.gpl2; # some libraries are under LGPLv2+
+      license = licenses.gpl2Plus; # some libraries are under LGPLv2+
       platforms = platforms.linux;
     };
   };
diff --git a/pkgs/desktops/xfce/panel-plugins/xfce4-clipman-plugin/default.nix b/pkgs/desktops/xfce/panel-plugins/xfce4-clipman-plugin/default.nix
index 2349b4bf3e8d..1f79e0ffb298 100644
--- a/pkgs/desktops/xfce/panel-plugins/xfce4-clipman-plugin/default.nix
+++ b/pkgs/desktops/xfce/panel-plugins/xfce4-clipman-plugin/default.nix
@@ -1,4 +1,4 @@
-{ mkXfceDerivation, gtk3, libXtst, libxfce4ui, libxfce4util, xfce4-panel, xfconf, exo }:
+{ mkXfceDerivation, libXtst, libxfce4ui, xfce4-panel, xfconf }:
 
 mkXfceDerivation {
   category = "panel-plugins";
@@ -6,7 +6,12 @@ mkXfceDerivation {
   version = "1.6.1";
   sha256 = "03akijvry1n1fkziyvxwcksl4vy4lmnpgd5izjs8jai5sndhsszl";
 
-  buildInputs = [ exo gtk3 libXtst libxfce4ui libxfce4util xfce4-panel xfconf ];
+  buildInputs = [ libXtst libxfce4ui xfce4-panel xfconf ];
+
+  postPatch = ''
+    # exo-csource has been dropped from exo
+    substituteInPlace panel-plugin/Makefile.am --replace exo-csource xdt-csource
+  '';
 
   meta = {
     description = "Clipboard manager for Xfce panel";
diff --git a/pkgs/desktops/xfce/panel-plugins/xfce4-cpufreq-plugin/default.nix b/pkgs/desktops/xfce/panel-plugins/xfce4-cpufreq-plugin/default.nix
index 3798edbf89dc..f776e6c1693a 100644
--- a/pkgs/desktops/xfce/panel-plugins/xfce4-cpufreq-plugin/default.nix
+++ b/pkgs/desktops/xfce/panel-plugins/xfce4-cpufreq-plugin/default.nix
@@ -3,8 +3,8 @@
 mkXfceDerivation {
   category = "panel-plugins";
   pname = "xfce4-cpufreq-plugin";
-  version = "1.2.1";
-  sha256 = "1p7c4g3yfc19ksdckxpzq1q35jvplh5g55299cvv0afhdb5l8zhv";
+  version = "1.2.5";
+  sha256 = "1isqlfhz1ijl1h3hfvi0n4misdjsrhd7pc9h5rkaqm4vh543ggxg";
 
   buildInputs = [ gtk3 libxfce4ui libxfce4util xfce4-panel xfconf ];
 
diff --git a/pkgs/desktops/xfce/panel-plugins/xfce4-cpugraph-plugin/default.nix b/pkgs/desktops/xfce/panel-plugins/xfce4-cpugraph-plugin/default.nix
index e80d0bbc9ac7..991da9928ff4 100644
--- a/pkgs/desktops/xfce/panel-plugins/xfce4-cpugraph-plugin/default.nix
+++ b/pkgs/desktops/xfce/panel-plugins/xfce4-cpugraph-plugin/default.nix
@@ -20,11 +20,11 @@ let
   category = "panel-plugins";
 in stdenv.mkDerivation rec {
   pname  = "xfce4-cpugraph-plugin";
-  version = "1.2.1";
+  version = "1.2.3";
 
   src = fetchurl {
     url = "mirror://xfce/src/${category}/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.bz2";
-    sha256 = "YVrfmr2RQXpEMZ2OTa3GAS+iKjd48vN5cXUS3Lfvkko=";
+    sha256 = "13302psv0fzg2dsgadr8j6mb06k1bsa4zw6hxmb644vqlvcwq37v";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/desktops/xfce/panel-plugins/xfce4-datetime-plugin/default.nix b/pkgs/desktops/xfce/panel-plugins/xfce4-datetime-plugin/default.nix
index 304b9d9076db..44d255c5fa64 100644
--- a/pkgs/desktops/xfce/panel-plugins/xfce4-datetime-plugin/default.nix
+++ b/pkgs/desktops/xfce/panel-plugins/xfce4-datetime-plugin/default.nix
@@ -3,17 +3,16 @@
 , intltool
 , libxfce4ui
 , xfce4-panel
-, gtk3
 , gettext
 }:
 
 mkXfceDerivation {
   category = "panel-plugins";
   pname = "xfce4-datetime-plugin";
-  version = "0.8.0";
+  version = "0.8.1";
 
-  rev-prefix = "datetime-";
-  sha256 = "12drh7y70d70r93lpv43fkj5cbyl0vciz4a41nxrknrfbhxrvyah";
+  rev-prefix = "xfce4-datetime-plugin-";
+  sha256 = "06h13bmh2sni4qbr3kfnqaa5dq5f48h4xkywrm9pa6h2nyvn4rma";
 
   nativeBuildInputs = [
     gettext
@@ -21,7 +20,6 @@ mkXfceDerivation {
   ];
 
   buildInputs = [
-    gtk3
     libxfce4ui
     xfce4-panel
   ];
diff --git a/pkgs/desktops/xfce/panel-plugins/xfce4-dockbarx-plugin/default.nix b/pkgs/desktops/xfce/panel-plugins/xfce4-dockbarx-plugin/default.nix
index e64d6fbae511..2c83abe6575e 100644
--- a/pkgs/desktops/xfce/panel-plugins/xfce4-dockbarx-plugin/default.nix
+++ b/pkgs/desktops/xfce/panel-plugins/xfce4-dockbarx-plugin/default.nix
@@ -1,30 +1,30 @@
-{ lib, stdenv, pkg-config, fetchFromGitHub, python2, bash, vala_0_46
+{ lib, stdenv, pkg-config, fetchFromGitHub, python3, bash, vala_0_48
 , dockbarx, gtk2, xfce, pythonPackages, wafHook }:
 
 stdenv.mkDerivation rec {
   pname = "xfce4-dockbarx-plugin";
   version = "${ver}-${rev}";
-  ver = "0.5";
-  rev = "a2dcb66";
+  ver = "0.6";
+  rev = "5213876";
 
   src = fetchFromGitHub {
-    owner = "TiZ-EX1";
+    owner = "xuzhen";
     repo = "xfce4-dockbarx-plugin";
     rev = rev;
-    sha256 = "1f75iwlshnif60x0qqdqw5ffng2m4f4zp0ijkrbjz83wm73nsxfx";
+    sha256 = "0s8bljn4ga2hj480j0jwkc0npp8szbmirmcsys791gk32iq4dasn";
   };
 
   pythonPath = [ dockbarx ];
 
   nativeBuildInputs = [ pkg-config wafHook ];
-  buildInputs = [ python2 vala_0_46 gtk2 pythonPackages.wrapPython ]
+  buildInputs = [ python3 vala_0_48 gtk2 pythonPackages.wrapPython ]
     ++ (with xfce; [ libxfce4util xfce4-panel xfconf xfce4-dev-tools ])
     ++ pythonPath;
 
   postPatch = ''
     substituteInPlace wscript           --replace /usr/share/            "\''${PREFIX}/share/"
     substituteInPlace src/dockbarx.vala --replace /usr/share/            $out/share/
-    substituteInPlace src/dockbarx.vala --replace '/usr/bin/env python2' ${bash}/bin/bash
+    substituteInPlace src/dockbarx.vala --replace '/usr/bin/env python3' ${bash}/bin/bash
   '';
 
   postFixup = ''
@@ -32,7 +32,7 @@ stdenv.mkDerivation rec {
   '';
 
   meta = with lib; {
-    homepage = "https://github.com/TiZ-EX1/xfce4-dockbarx-plugin";
+    homepage = "https://github.com/xuzhen/xfce4-dockbarx-plugin";
     description = "A plugins to embed DockbarX into xfce4-panel";
     license = licenses.mit;
     platforms = platforms.linux;
diff --git a/pkgs/desktops/xfce/panel-plugins/xfce4-embed-plugin/default.nix b/pkgs/desktops/xfce/panel-plugins/xfce4-embed-plugin/default.nix
index cf383f840d5c..7c48e4a2a9f8 100644
--- a/pkgs/desktops/xfce/panel-plugins/xfce4-embed-plugin/default.nix
+++ b/pkgs/desktops/xfce/panel-plugins/xfce4-embed-plugin/default.nix
@@ -44,6 +44,7 @@ in stdenv.mkDerivation rec {
     description = "Embed arbitrary app windows on Xfce panel";
     license = licenses.gpl2Plus;
     platforms = platforms.linux;
+    broken = true; # unmaintained plugin; no longer compatible with xfce 4.16
     maintainers = [ ];
   };
 }
diff --git a/pkgs/desktops/xfce/panel-plugins/xfce4-hardware-monitor-plugin/default.nix b/pkgs/desktops/xfce/panel-plugins/xfce4-hardware-monitor-plugin/default.nix
index 8afff65696d3..3a01e8063874 100644
--- a/pkgs/desktops/xfce/panel-plugins/xfce4-hardware-monitor-plugin/default.nix
+++ b/pkgs/desktops/xfce/panel-plugins/xfce4-hardware-monitor-plugin/default.nix
@@ -33,8 +33,9 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     homepage = "https://goodies.xfce.org/projects/panel-plugins/xfce4-hardware-monitor-plugin";
     description = "Hardware monitor plugin for the XFCE4 panel";
-    license = licenses.gpl3;
+    license = licenses.gpl3Only;
     platforms = platforms.unix;
+    broken = true; # unmaintained plugin; no longer compatible with xfce 4.16
     maintainers = [ maintainers.romildo ];
   };
 }
diff --git a/pkgs/desktops/xfce/panel-plugins/xfce4-mailwatch-plugin/default.nix b/pkgs/desktops/xfce/panel-plugins/xfce4-mailwatch-plugin/default.nix
index df31ea3b9b59..b9f4481be32c 100644
--- a/pkgs/desktops/xfce/panel-plugins/xfce4-mailwatch-plugin/default.nix
+++ b/pkgs/desktops/xfce/panel-plugins/xfce4-mailwatch-plugin/default.nix
@@ -1,5 +1,5 @@
-{ lib, stdenv, fetchurl, pkg-config, intltool, libxfce4util, xfce4-panel, libxfce4ui,
-  gtk2, exo, gnutls, libgcrypt, xfce }:
+{ lib, stdenv, fetchurl, pkg-config, intltool, xfce4-panel, libxfce4ui,
+  exo, gnutls, libgcrypt, xfce }:
 
 let
   category = "panel-plugins";
@@ -7,11 +7,11 @@ in
 
 stdenv.mkDerivation rec {
   pname  = "xfce4-mailwatch-plugin";
-  version = "1.2.0";
+  version = "1.3.0";
 
   src = fetchurl {
     url = "mirror://xfce/src/${category}/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.bz2";
-    sha256 = "1bfw3smwivr9mzdyq768biqrl4aq94zqi3xjzq6kqnd8561cqjk2";
+    sha256 = "0bmykjhd3gs1737fl3zn5gg6f3vlncak2xqz89zv5018znz1xy90";
   };
 
   nativeBuildInputs = [
@@ -20,11 +20,9 @@ stdenv.mkDerivation rec {
   ];
 
   buildInputs = [
-    libxfce4util
     libxfce4ui
     xfce4-panel
-    gtk2
-    exo # needs exo with gtk2 support
+    exo
     gnutls
     libgcrypt
   ];
@@ -38,7 +36,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     homepage = "https://docs.xfce.org/panel-plugins/xfce4-mailwatch-plugin";
     description = "Mail watcher plugin for Xfce panel";
-    license = licenses.gpl2;
+    license = licenses.gpl2Only;
     platforms = platforms.linux;
     maintainers = [ ];
   };
diff --git a/pkgs/desktops/xfce/panel-plugins/xfce4-namebar-plugin/default.nix b/pkgs/desktops/xfce/panel-plugins/xfce4-namebar-plugin/default.nix
index 407f349d9bfc..ec57a7260f6d 100644
--- a/pkgs/desktops/xfce/panel-plugins/xfce4-namebar-plugin/default.nix
+++ b/pkgs/desktops/xfce/panel-plugins/xfce4-namebar-plugin/default.nix
@@ -16,9 +16,8 @@ stdenv.mkDerivation rec {
   buildInputs = [ gtk3 libwnck3 libxfce4util xfce4-panel ];
 
   postPatch = ''
-    for f in src/preferences.vala src/namebar.vala; do
-      substituteInPlace $f --replace 'var dirs = Environment.get_system_data_dirs()' "string[] dirs = { \"$out/share\" }"
-    done
+    substituteInPlace src/namebar.vala --replace 'var dirs = Environment.get_system_data_dirs()' "string[] dirs = { \"$out/share\" }"
+    substituteInPlace src/preferences.vala --replace 'var dir_strings = Environment.get_system_data_dirs()' "string[] dir_strings = { \"$out/share\" }"
   '';
 
   passthru.updateScript = xfce.updateScript {
diff --git a/pkgs/desktops/xfce/panel-plugins/xfce4-notes-plugin/default.nix b/pkgs/desktops/xfce/panel-plugins/xfce4-notes-plugin/default.nix
index 7442e30ed69f..79519b858760 100644
--- a/pkgs/desktops/xfce/panel-plugins/xfce4-notes-plugin/default.nix
+++ b/pkgs/desktops/xfce/panel-plugins/xfce4-notes-plugin/default.nix
@@ -1,15 +1,11 @@
 { lib
 , stdenv
 , fetchurl
-, fetchpatch
 , pkg-config
 , intltool
-, libxfce4util
 , xfce4-panel
 , libxfce4ui
 , xfconf
-, gtk2
-, libunique
 , xfce
 }:
 
@@ -30,16 +26,11 @@ in stdenv.mkDerivation rec {
   ];
 
   buildInputs = [
-    libxfce4util
     libxfce4ui
     xfce4-panel
     xfconf
-    gtk2
-    libunique
   ];
 
-  hardeningDisable = [ "format" ];
-
   passthru.updateScript = xfce.updateScript {
     inherit pname version;
     attrPath = "xfce.${pname}";
diff --git a/pkgs/desktops/xfce/panel-plugins/xfce4-sensors-plugin/default.nix b/pkgs/desktops/xfce/panel-plugins/xfce4-sensors-plugin/default.nix
index 845f1b22e33a..dbefda4e5ee2 100644
--- a/pkgs/desktops/xfce/panel-plugins/xfce4-sensors-plugin/default.nix
+++ b/pkgs/desktops/xfce/panel-plugins/xfce4-sensors-plugin/default.nix
@@ -8,11 +8,11 @@ in
 
 stdenv.mkDerivation rec {
   pname  = "xfce4-sensors-plugin";
-  version = "1.3.92";
+  version = "1.3.95";
 
   src = fetchurl {
     url = "mirror://xfce/src/${category}/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.bz2";
-    sha256 = "04jibw23ibi61f19gc9xy400yhcdiya4px6zp8c7fjq65hyn9iix";
+    sha256 = "0v44qwrwb95jrlsni1gdlc0zhymlm62w42zs3jbr5mcdc7j4mil3";
   };
 
   nativeBuildInputs = [
@@ -47,7 +47,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     homepage = "https://docs.xfce.org/panel-plugins/xfce4-sensors-plugin";
     description = "A panel plug-in for different sensors using acpi, lm_sensors and hddtemp";
-    license = licenses.gpl2;
+    license = licenses.gpl2Plus;
     platforms = platforms.unix;
     maintainers = [ maintainers.romildo ];
   };
diff --git a/pkgs/desktops/xfce/panel-plugins/xfce4-systemload-plugin/default.nix b/pkgs/desktops/xfce/panel-plugins/xfce4-systemload-plugin/default.nix
index 13bce97fe33f..3c35297897b7 100644
--- a/pkgs/desktops/xfce/panel-plugins/xfce4-systemload-plugin/default.nix
+++ b/pkgs/desktops/xfce/panel-plugins/xfce4-systemload-plugin/default.nix
@@ -3,10 +3,9 @@
 , fetchurl
 , pkg-config
 , intltool
-, libxfce4util
 , xfce4-panel
 , libxfce4ui
-, gtk3
+, xfconf
 , xfce
 }:
 
@@ -14,11 +13,11 @@ let
   category = "panel-plugins";
 in stdenv.mkDerivation rec {
   pname  = "xfce4-systemload-plugin";
-  version = "1.2.4";
+  version = "1.3.1";
 
   src = fetchurl {
     url = "mirror://xfce/src/${category}/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.bz2";
-    sha256 = "BTG435I8ujvo0GTLi2OLlU33SRXlpEciiZlReEd4mDU=";
+    sha256 = "0lknh5l30qs5c69wwjcblbyhczvdbxs59fqkb8mpqbfm05w01lan";
   };
 
   nativeBuildInputs = [
@@ -27,10 +26,9 @@ in stdenv.mkDerivation rec {
   ];
 
   buildInputs = [
-    libxfce4util
     libxfce4ui
     xfce4-panel
-    gtk3
+    xfconf
   ];
 
   passthru.updateScript = xfce.updateScript {
diff --git a/pkgs/desktops/xfce/panel-plugins/xfce4-timer-plugin/default.nix b/pkgs/desktops/xfce/panel-plugins/xfce4-timer-plugin/default.nix
index 7c2fb69dc5c4..3731d3937bd9 100644
--- a/pkgs/desktops/xfce/panel-plugins/xfce4-timer-plugin/default.nix
+++ b/pkgs/desktops/xfce/panel-plugins/xfce4-timer-plugin/default.nix
@@ -38,7 +38,7 @@ stdenv.mkDerivation rec {
     homepage = "https://docs.xfce.org/panel-plugins/xfce4-timer-plugin";
     description = "Simple countdown and alarm plugin for the Xfce panel";
     platforms = platforms.linux;
-    license = licenses.gpl2;
+    license = licenses.gpl2Plus;
     maintainers = [ ];
   };
 }
diff --git a/pkgs/desktops/xfce/panel-plugins/xfce4-verve-plugin/default.nix b/pkgs/desktops/xfce/panel-plugins/xfce4-verve-plugin/default.nix
index 94b467fd6828..209e25bc9e3f 100644
--- a/pkgs/desktops/xfce/panel-plugins/xfce4-verve-plugin/default.nix
+++ b/pkgs/desktops/xfce/panel-plugins/xfce4-verve-plugin/default.nix
@@ -5,7 +5,6 @@
 , pcre
 , libxfce4util
 , xfce4-panel
-, xfconf
 }:
 
 mkXfceDerivation {
diff --git a/pkgs/desktops/xfce/panel-plugins/xfce4-weather-plugin/default.nix b/pkgs/desktops/xfce/panel-plugins/xfce4-weather-plugin/default.nix
index 18639946ce8b..5992bf343edc 100644
--- a/pkgs/desktops/xfce/panel-plugins/xfce4-weather-plugin/default.nix
+++ b/pkgs/desktops/xfce/panel-plugins/xfce4-weather-plugin/default.nix
@@ -1,5 +1,5 @@
-{ lib, stdenv, fetchurl, pkg-config, intltool, gtk3, libxml2, libsoup, upower,
-  libxfce4ui, libxfce4util, xfce4-panel, hicolor-icon-theme, xfce }:
+{ lib, stdenv, fetchurl, pkg-config, intltool, libxml2, libsoup, upower,
+  libxfce4ui, xfce4-panel, xfconf, hicolor-icon-theme, xfce }:
 
 let
   category = "panel-plugins";
@@ -7,11 +7,11 @@ in
 
 stdenv.mkDerivation rec {
   pname  = "xfce4-weather-plugin";
-  version = "0.10.1";
+  version = "0.11.0";
 
   src = fetchurl {
     url = "mirror://xfce/src/${category}/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.bz2";
-    sha256 = "12bs2rfmmy021087i10vxibdbbvd5vld0vk3h5hymhpz7rgszcmg";
+    sha256 = "1z2k24d599mxf5gqa35i3xmc3gk2yvqs80hxxpyw06yma6ljw973";
   };
 
   nativeBuildInputs = [
@@ -20,13 +20,12 @@ stdenv.mkDerivation rec {
   ];
 
   buildInputs = [
-    gtk3
     libxml2
     libsoup
     upower
     libxfce4ui
-    libxfce4util
     xfce4-panel
+    xfconf
     hicolor-icon-theme
   ];
 
diff --git a/pkgs/desktops/xfce/panel-plugins/xfce4-whiskermenu-plugin/default.nix b/pkgs/desktops/xfce/panel-plugins/xfce4-whiskermenu-plugin/default.nix
index ef269d64e04c..123376b0f2ba 100644
--- a/pkgs/desktops/xfce/panel-plugins/xfce4-whiskermenu-plugin/default.nix
+++ b/pkgs/desktops/xfce/panel-plugins/xfce4-whiskermenu-plugin/default.nix
@@ -3,10 +3,10 @@
 mkXfceDerivation {
   category = "panel-plugins";
   pname = "xfce4-whiskermenu-plugin";
-  version = "2.4.6";
+  version = "2.5.3";
   rev-prefix = "v";
   odd-unstable = false;
-  sha256 = "03asfaxqbhawzb3870az7qgid5y7cg3ip8h6r4z8kavcd0b7x4ii";
+  sha256 = "15kcph35pji3l1y81snrmpqzhhpdc9h4nk6cjsjyla51a1s2y3hz";
 
   nativeBuildInputs = [ cmake ];
 
diff --git a/pkgs/desktops/xfce/panel-plugins/xfce4-windowck-plugin/default.nix b/pkgs/desktops/xfce/panel-plugins/xfce4-windowck-plugin/default.nix
index ec6ef0e7b62c..281003db92a0 100644
--- a/pkgs/desktops/xfce/panel-plugins/xfce4-windowck-plugin/default.nix
+++ b/pkgs/desktops/xfce/panel-plugins/xfce4-windowck-plugin/default.nix
@@ -1,15 +1,14 @@
-{ lib, stdenv, fetchFromGitHub, pkg-config, intltool, python3, imagemagick, libwnck, gtk2
-, exo, libxfce4ui, libxfce4util, xfce4-panel, xfconf, xfce4-dev-tools, xfce }:
+{ lib, stdenv, fetchFromGitHub, pkg-config, intltool, python3, imagemagick, libwnck3, libxfce4ui, xfce4-panel, xfconf, xfce4-dev-tools, xfce }:
 
 stdenv.mkDerivation rec {
   pname  = "xfce4-windowck-plugin";
-  version = "0.4.6";
+  version = "0.4.10";
 
   src = fetchFromGitHub {
-    owner = "cedl38";
+    owner = "invidian";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1gwrbjfv4cnlsqh05h42w41z3xs15yjj6j8y9gxvvvvlgzzp4p3g";
+    sha256 = "0l066a174v2c7ly125v9x1fgbg5bnpwdwnjh69v9kp4plp791q4n";
   };
 
   nativeBuildInputs = [
@@ -20,11 +19,8 @@ stdenv.mkDerivation rec {
   buildInputs = [
     python3
     imagemagick
-    libwnck
-    gtk2
-    exo
+    libwnck3
     libxfce4ui
-    libxfce4util
     xfce4-panel
     xfconf
     xfce4-dev-tools
diff --git a/pkgs/desktops/xfce/thunar-plugins/dropbox/default.nix b/pkgs/desktops/xfce/thunar-plugins/dropbox/default.nix
index b632fde2df2f..d43c56c72888 100644
--- a/pkgs/desktops/xfce/thunar-plugins/dropbox/default.nix
+++ b/pkgs/desktops/xfce/thunar-plugins/dropbox/default.nix
@@ -39,7 +39,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     homepage = "https://github.com/Jeinzi/thunar-dropbox";
     description = "A plugin that adds context-menu items for Dropbox to Thunar";
-    license = licenses.gpl3;
+    license = licenses.gpl3Only;
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/development/compilers/flutter/default.nix b/pkgs/development/compilers/flutter/default.nix
index 14f4d93caa03..736178e76ca2 100644
--- a/pkgs/development/compilers/flutter/default.nix
+++ b/pkgs/development/compilers/flutter/default.nix
@@ -4,7 +4,7 @@ let
   getPatches = dir:
     let files = builtins.attrNames (builtins.readDir dir);
     in map (f: dir + ("/" + f)) files;
-  version = "1.22.4";
+  version = "2.0.3";
   channel = "stable";
   filename = "flutter_linux_${version}-${channel}.tar.xz";
 in
@@ -15,7 +15,7 @@ in
     pname = "flutter";
     src = fetchurl {
       url = "https://storage.googleapis.com/flutter_infra/releases/${channel}/linux/${filename}";
-      sha256 = "0qalgav9drqddcj8lfvl9ddf3325n953pvkmgha47lslg9sa88zw";
+      sha256 = "14a63cpkp78rgymmlrppds69jsrdarg33dr43nb7s61r0xfh9icm";
     };
     patches = getPatches ./patches;
   };
diff --git a/pkgs/development/compilers/flutter/flutter.nix b/pkgs/development/compilers/flutter/flutter.nix
index 4a7aa0d01463..27436d8b6143 100644
--- a/pkgs/development/compilers/flutter/flutter.nix
+++ b/pkgs/development/compilers/flutter/flutter.nix
@@ -41,11 +41,10 @@ let
 
     buildInputs = [ git ];
 
-    inherit src patches;
+    inherit src patches version;
 
     postPatch = ''
       patchShebangs --build ./bin/
-      find ./bin/ -executable -type f -exec patchelf --set-interpreter $(cat $NIX_CC/nix-support/dynamic-linker) {} \;
     '';
 
     buildPhase = ''
diff --git a/pkgs/development/compilers/flutter/patches/disable-auto-update.patch b/pkgs/development/compilers/flutter/patches/disable-auto-update.patch
index 35ce5b367350..1fe098136843 100644
--- a/pkgs/development/compilers/flutter/patches/disable-auto-update.patch
+++ b/pkgs/development/compilers/flutter/patches/disable-auto-update.patch
@@ -1,8 +1,8 @@
 diff --git a/bin/internal/shared.sh b/bin/internal/shared.sh
-index 8d613de739..a673466726 100644
+index c44f867746..c9eda34e26 100644
 --- a/bin/internal/shared.sh
 +++ b/bin/internal/shared.sh
-@@ -204,8 +204,6 @@ function shared::execute() {
+@@ -218,8 +218,6 @@ function shared::execute() {
    # FLUTTER_TOOL_ARGS="--enable-asserts $FLUTTER_TOOL_ARGS"
    # FLUTTER_TOOL_ARGS="$FLUTTER_TOOL_ARGS --observe=65432"
  
@@ -12,20 +12,18 @@ index 8d613de739..a673466726 100644
    case "$BIN_NAME" in
      flutter*)
 diff --git a/packages/flutter_tools/lib/src/runner/flutter_command_runner.dart b/packages/flutter_tools/lib/src/runner/flutter_command_runner.dart
-index 8a1a1e29da..778f253358 100644
+index 3dc7929dd1..e65d70d55b 100644
 --- a/packages/flutter_tools/lib/src/runner/flutter_command_runner.dart
 +++ b/packages/flutter_tools/lib/src/runner/flutter_command_runner.dart
-@@ -293,13 +293,6 @@ class FlutterCommandRunner extends CommandRunner<void> {
+@@ -246,11 +246,7 @@ class FlutterCommandRunner extends CommandRunner<void> {
            globals.flutterUsage.suppressAnalytics = true;
          }
  
--        try {
--          await globals.flutterVersion.ensureVersionFile();
--        } on FileSystemException catch (e) {
--          globals.printError('Failed to write the version file to the artifact cache: "$e".');
--          globals.printError('Please ensure you have permissions in the artifact cache directory.');
--          throwToolExit('Failed to write the version file');
--        }
+-        globals.flutterVersion.ensureVersionFile();
          final bool machineFlag = topLevelResults['machine'] as bool;
-         if (topLevelResults.command?.name != 'upgrade' && topLevelResults['version-check'] as bool && !machineFlag) {
-           await globals.flutterVersion.checkFlutterVersionFreshness();
+-        if (topLevelResults.command?.name != 'upgrade' && topLevelResults['version-check'] as bool && !machineFlag) {
+-          await globals.flutterVersion.checkFlutterVersionFreshness();
+-        }
+ 
+         // See if the user specified a specific device.
+         globals.deviceManager.specifiedDeviceId = topLevelResults['device-id'] as String;
diff --git a/pkgs/development/compilers/flutter/patches/move-cache.patch b/pkgs/development/compilers/flutter/patches/move-cache.patch
index dc77496edb31..d6a45a97e581 100644
--- a/pkgs/development/compilers/flutter/patches/move-cache.patch
+++ b/pkgs/development/compilers/flutter/patches/move-cache.patch
@@ -1,59 +1,54 @@
-diff --git a/dev/devicelab/lib/framework/runner.dart b/dev/devicelab/lib/framework/runner.dart
-index d045c83f04..d51973020b 100644
---- a/dev/devicelab/lib/framework/runner.dart
-+++ b/dev/devicelab/lib/framework/runner.dart
-@@ -136,7 +136,7 @@ Future<void> cleanupSystem() async {
-     print('\nTelling Gradle to shut down (JAVA_HOME=$javaHome)');
-     final String gradlewBinaryName = Platform.isWindows ? 'gradlew.bat' : 'gradlew';
-     final Directory tempDir = Directory.systemTemp.createTempSync('flutter_devicelab_shutdown_gradle.');
--    recursiveCopy(Directory(path.join(flutterDirectory.path, 'bin', 'cache', 'artifacts', 'gradle_wrapper')), tempDir);
-+    recursiveCopy(Directory(path.join(globals.fsUtils.homeDirPath, '.cache', 'flutter', 'artifacts', 'gradle_wrapper')), tempDir);
-     copy(File(path.join(path.join(flutterDirectory.path, 'packages', 'flutter_tools'), 'templates', 'app', 'android.tmpl', 'gradle', 'wrapper', 'gradle-wrapper.properties')), Directory(path.join(tempDir.path, 'gradle', 'wrapper')));
-     if (!Platform.isWindows) {
-       await exec(
 diff --git a/packages/flutter_tools/lib/src/asset.dart b/packages/flutter_tools/lib/src/asset.dart
-index 8da01315ae..bb8d61d7f2 100644
+index a6c59bae07..21f6c9812a 100644
 --- a/packages/flutter_tools/lib/src/asset.dart
 +++ b/packages/flutter_tools/lib/src/asset.dart
-@@ -8,6 +8,7 @@ import 'package:meta/meta.dart';
+@@ -5,6 +5,7 @@
+ import 'package:meta/meta.dart';
  import 'package:package_config/package_config.dart';
- import 'package:yaml/yaml.dart';
  
 +import 'base/common.dart';
  import 'base/context.dart';
  import 'base/file_system.dart';
- import 'base/utils.dart';
-@@ -399,7 +400,7 @@ List<_Asset> _getMaterialAssets(String fontSet) {
-     for (final Map<dynamic, dynamic> font in (family['fonts'] as List<dynamic>).cast<Map<dynamic, dynamic>>()) {
-       final Uri entryUri = globals.fs.path.toUri(font['asset'] as String);
-       result.add(_Asset(
--        baseDir: globals.fs.path.join(Cache.flutterRoot, 'bin', 'cache', 'artifacts', 'material_fonts'),
-+        baseDir: globals.fs.path.join(globals.fsUtils.homeDirPath, '.cache', 'flutter', 'artifacts', 'material_fonts'),
-         relativeUri: Uri(path: entryUri.pathSegments.last),
-         entryUri: entryUri,
-         package: null,
+ import 'base/logger.dart';
+@@ -14,6 +15,7 @@ import 'cache.dart';
+ import 'convert.dart';
+ import 'dart/package_map.dart';
+ import 'devfs.dart';
++import 'globals.dart' as globals;
+ import 'flutter_manifest.dart';
+ import 'license_collector.dart';
+ import 'project.dart';
+@@ -377,7 +379,7 @@ class ManifestAssetBundle implements AssetBundle {
+       for (final Map<String, Object> font in family['fonts'] as List<Map<String, Object>>) {
+         final Uri entryUri = _fileSystem.path.toUri(font['asset'] as String);
+         result.add(_Asset(
+-          baseDir: _fileSystem.path.join(Cache.flutterRoot, 'bin', 'cache', 'artifacts', 'material_fonts'),
++          baseDir: _fileSystem.path.join(globals.fsUtils.homeDirPath, '.cache', 'flutter', 'artifacts', 'material_fonts'),
+           relativeUri: Uri(path: entryUri.pathSegments.last),
+           entryUri: entryUri,
+           package: null,
 diff --git a/packages/flutter_tools/lib/src/cache.dart b/packages/flutter_tools/lib/src/cache.dart
-index a35d8f87d0..a40027dc74 100644
+index 11e3bf3e11..39d6fae0d1 100644
 --- a/packages/flutter_tools/lib/src/cache.dart
 +++ b/packages/flutter_tools/lib/src/cache.dart
-@@ -215,8 +215,15 @@ class Cache {
+@@ -321,8 +321,15 @@ class Cache {
        return;
      }
      assert(_lock == null);
 +
-+    final Directory dir = globals.fs.directory(globals.fs.path.join(globals.fsUtils.homeDirPath, '.cache', 'flutter'));
++    final Directory dir = _fileSystem.directory(_fileSystem.path.join(globals.fsUtils.homeDirPath, '.cache', 'flutter'));
 +    if (!dir.existsSync()) {
 +      dir.createSync(recursive: true);
 +      globals.os.chmod(dir, '755');
 +    }
 +
      final File lockFile =
--        globals.fs.file(globals.fs.path.join(flutterRoot, 'bin', 'cache', 'lockfile'));
-+        globals.fs.file(globals.fs.path.join(globals.fsUtils.homeDirPath, '.cache', 'flutter', 'lockfile'));
+-      _fileSystem.file(_fileSystem.path.join(flutterRoot, 'bin', 'cache', 'lockfile'));
++      _fileSystem.file(_fileSystem.path.join(globals.fsUtils.homeDirPath, '.cache', 'flutter', 'lockfile'));
      try {
        _lock = lockFile.openSync(mode: FileMode.write);
      } on FileSystemException catch (e) {
-@@ -319,7 +326,7 @@ class Cache {
+@@ -424,7 +431,7 @@ class Cache {
      if (_rootOverride != null) {
        return _fileSystem.directory(_fileSystem.path.join(_rootOverride.path, 'bin', 'cache'));
      } else {
diff --git a/pkgs/development/compilers/llvm/12/bintools.nix b/pkgs/development/compilers/llvm/12/bintools.nix
new file mode 100644
index 000000000000..53f7941e3369
--- /dev/null
+++ b/pkgs/development/compilers/llvm/12/bintools.nix
@@ -0,0 +1,29 @@
+{ runCommand, stdenv, llvm, lld, version }:
+
+let
+  prefix =
+    if stdenv.hostPlatform != stdenv.targetPlatform
+    then "${stdenv.targetPlatform.config}-"
+    else "";
+in runCommand "llvm-binutils-${version}" { preferLocalBuild = true; } ''
+   mkdir -p $out/bin
+   for prog in ${lld}/bin/*; do
+     ln -s $prog $out/bin/${prefix}$(basename $prog)
+   done
+   for prog in ${llvm}/bin/*; do
+     ln -sf $prog $out/bin/${prefix}$(basename $prog)
+   done
+
+   ln -s ${llvm}/bin/llvm-ar $out/bin/${prefix}ar
+   ln -s ${llvm}/bin/llvm-as $out/bin/${prefix}as
+   ln -s ${llvm}/bin/llvm-dwp $out/bin/${prefix}dwp
+   ln -s ${llvm}/bin/llvm-nm $out/bin/${prefix}nm
+   ln -s ${llvm}/bin/llvm-objcopy $out/bin/${prefix}objcopy
+   ln -s ${llvm}/bin/llvm-objdump $out/bin/${prefix}objdump
+   ln -s ${llvm}/bin/llvm-ranlib $out/bin/${prefix}ranlib
+   ln -s ${llvm}/bin/llvm-readelf $out/bin/${prefix}readelf
+   ln -s ${llvm}/bin/llvm-size $out/bin/${prefix}size
+   ln -s ${llvm}/bin/llvm-strip $out/bin/${prefix}strip
+
+   ln -s ${lld}/bin/lld $out/bin/${prefix}ld
+''
diff --git a/pkgs/development/compilers/llvm/12/clang/default.nix b/pkgs/development/compilers/llvm/12/clang/default.nix
new file mode 100644
index 000000000000..955cfb631f62
--- /dev/null
+++ b/pkgs/development/compilers/llvm/12/clang/default.nix
@@ -0,0 +1,110 @@
+{ lib, stdenv, fetch, cmake, libxml2, llvm, version, clang-tools-extra_src, python3, lld
+, fixDarwinDylibNames
+, enableManpages ? false
+}:
+
+let
+  self = stdenv.mkDerivation ({
+    pname = "clang";
+    inherit version;
+
+    src = fetch "clang" "1xg2wy86zdj1d4h33n9mmb4j0x8bp9a5pk4qnnx3imlh8n6vhrqj";
+    inherit clang-tools-extra_src;
+
+    unpackPhase = ''
+      unpackFile $src
+      mv clang-* clang
+      sourceRoot=$PWD/clang
+      unpackFile ${clang-tools-extra_src}
+    '';
+
+    nativeBuildInputs = [ cmake python3 lld ]
+      ++ lib.optional enableManpages python3.pkgs.sphinx
+      ++ lib.optional stdenv.hostPlatform.isDarwin fixDarwinDylibNames;
+
+    buildInputs = [ libxml2 llvm ];
+
+    cmakeFlags = [
+      "-DCMAKE_CXX_FLAGS=-std=c++14"
+      "-DCLANGD_BUILD_XPC=OFF"
+    ] ++ lib.optionals enableManpages [
+      "-DCLANG_INCLUDE_DOCS=ON"
+      "-DLLVM_ENABLE_SPHINX=ON"
+      "-DSPHINX_OUTPUT_MAN=ON"
+      "-DSPHINX_OUTPUT_HTML=OFF"
+      "-DSPHINX_WARNINGS_AS_ERRORS=OFF"
+    ];
+
+    patches = [
+      ./purity.patch
+      # https://reviews.llvm.org/D51899
+    ];
+
+    postPatch = ''
+      sed -i -e 's/DriverArgs.hasArg(options::OPT_nostdlibinc)/true/' \
+             -e 's/Args.hasArg(options::OPT_nostdlibinc)/true/' \
+             lib/Driver/ToolChains/*.cpp
+
+      # Patch for standalone doc building
+      sed -i '1s,^,find_package(Sphinx REQUIRED)\n,' docs/CMakeLists.txt
+    '' + lib.optionalString stdenv.hostPlatform.isMusl ''
+      sed -i -e 's/lgcc_s/lgcc_eh/' lib/Driver/ToolChains/*.cpp
+    '';
+
+    outputs = [ "out" "lib" "python" ];
+
+    # Clang expects to find LLVMgold in its own prefix
+    postInstall = ''
+      if [ -e ${llvm}/lib/LLVMgold.so ]; then
+        ln -sv ${llvm}/lib/LLVMgold.so $out/lib
+      fi
+
+      ln -sv $out/bin/clang $out/bin/cpp
+
+      # Move libclang to 'lib' output
+      moveToOutput "lib/libclang.*" "$lib"
+      moveToOutput "lib/libclang-cpp.*" "$lib"
+      substituteInPlace $out/lib/cmake/clang/ClangTargets-release.cmake \
+          --replace "\''${_IMPORT_PREFIX}/lib/libclang." "$lib/lib/libclang." \
+          --replace "\''${_IMPORT_PREFIX}/lib/libclang-cpp." "$lib/lib/libclang-cpp."
+
+      mkdir -p $python/bin $python/share/clang/
+      mv $out/bin/{git-clang-format,scan-view} $python/bin
+      if [ -e $out/bin/set-xcode-analyzer ]; then
+        mv $out/bin/set-xcode-analyzer $python/bin
+      fi
+      mv $out/share/clang/*.py $python/share/clang
+      rm $out/bin/c-index-test
+    '';
+
+    passthru = {
+      isClang = true;
+      inherit llvm;
+    };
+
+    meta = {
+      description = "A c, c++, objective-c, and objective-c++ frontend for the llvm compiler";
+      homepage    = "https://llvm.org/";
+      license     = lib.licenses.ncsa;
+      platforms   = lib.platforms.all;
+    };
+  } // lib.optionalAttrs enableManpages {
+    pname = "clang-manpages";
+
+    buildPhase = ''
+      make docs-clang-man
+    '';
+
+    installPhase = ''
+      mkdir -p $out/share/man/man1
+      # Manually install clang manpage
+      cp docs/man/*.1 $out/share/man/man1/
+    '';
+
+    outputs = [ "out" ];
+
+    doCheck = false;
+
+    meta.description = "man page for Clang ${version}";
+  });
+in self
diff --git a/pkgs/development/compilers/llvm/12/clang/purity.patch b/pkgs/development/compilers/llvm/12/clang/purity.patch
new file mode 100644
index 000000000000..deb230a36c5b
--- /dev/null
+++ b/pkgs/development/compilers/llvm/12/clang/purity.patch
@@ -0,0 +1,28 @@
+From 4add81bba40dcec62c4ea4481be8e35ac53e89d8 Mon Sep 17 00:00:00 2001
+From: Will Dietz <w@wdtz.org>
+Date: Thu, 18 May 2017 11:56:12 -0500
+Subject: [PATCH] "purity" patch for 5.0
+
+---
+ lib/Driver/ToolChains/Gnu.cpp | 7 -------
+ 1 file changed, 7 deletions(-)
+
+diff --git a/lib/Driver/ToolChains/Gnu.cpp b/lib/Driver/ToolChains/Gnu.cpp
+index fe3c0191bb..c6a482bece 100644
+--- a/lib/Driver/ToolChains/Gnu.cpp
++++ b/lib/Driver/ToolChains/Gnu.cpp
+@@ -487,12 +487,6 @@ void tools::gnutools::Linker::ConstructJob(Compilation &C, const JobAction &JA,
+   if (!IsStatic) {
+     if (Args.hasArg(options::OPT_rdynamic))
+       CmdArgs.push_back("-export-dynamic");
+-
+-    if (!Args.hasArg(options::OPT_shared) && !IsStaticPIE) {
+-      CmdArgs.push_back("-dynamic-linker");
+-      CmdArgs.push_back(Args.MakeArgString(Twine(D.DyldPrefix) +
+-                                           ToolChain.getDynamicLinker(Args)));
+-    }
+   }
+ 
+   CmdArgs.push_back("-o");
+-- 
+2.11.0
diff --git a/pkgs/development/compilers/llvm/12/compiler-rt-X86-support-extension.patch b/pkgs/development/compilers/llvm/12/compiler-rt-X86-support-extension.patch
new file mode 100644
index 000000000000..f6f9336ad5ad
--- /dev/null
+++ b/pkgs/development/compilers/llvm/12/compiler-rt-X86-support-extension.patch
@@ -0,0 +1,23 @@
+diff --git a/lib/builtins/CMakeLists.txt b/lib/builtins/CMakeLists.txt
+index 3a66dd9c3fb..7efc85d9f9f 100644
+--- a/lib/builtins/CMakeLists.txt
++++ b/lib/builtins/CMakeLists.txt
+@@ -301,6 +301,10 @@ if (NOT MSVC)
+     i386/umoddi3.S
+   )
+ 
++  set(i486_SOURCES ${i386_SOURCES})
++  set(i586_SOURCES ${i386_SOURCES})
++  set(i686_SOURCES ${i386_SOURCES})
++
+   if (WIN32)
+     set(i386_SOURCES
+       ${i386_SOURCES}
+@@ -608,6 +612,7 @@ else ()
+   endif()
+ 
+   foreach (arch ${BUILTIN_SUPPORTED_ARCH})
++      message("arch: ${arch}")
+     if (CAN_TARGET_${arch})
+       # For ARM archs, exclude any VFP builtins if VFP is not supported
+       if (${arch} MATCHES "^(arm|armhf|armv7|armv7s|armv7k|armv7m|armv7em)$")
diff --git a/pkgs/development/compilers/llvm/12/compiler-rt-armv7l.patch b/pkgs/development/compilers/llvm/12/compiler-rt-armv7l.patch
new file mode 100644
index 000000000000..120cfe6feb2a
--- /dev/null
+++ b/pkgs/development/compilers/llvm/12/compiler-rt-armv7l.patch
@@ -0,0 +1,32 @@
+diff -ur compiler-rt-10.0.0.src/cmake/builtin-config-ix.cmake compiler-rt-10.0.0.src-patched/cmake/builtin-config-ix.cmake
+--- compiler-rt-10.0.0.src/cmake/builtin-config-ix.cmake	2020-03-24 00:01:02.000000000 +0900
++++ compiler-rt-10.0.0.src-patched/cmake/builtin-config-ix.cmake	2020-05-10 03:42:00.883450706 +0900
+@@ -24,7 +24,7 @@
+ 
+ 
+ set(ARM64 aarch64)
+-set(ARM32 arm armhf armv6m armv7m armv7em armv7 armv7s armv7k)
++set(ARM32 arm armhf armv6m armv7m armv7em armv7 armv7s armv7k armv7l)
+ set(HEXAGON hexagon)
+ set(X86 i386)
+ set(X86_64 x86_64)
+diff -ur compiler-rt-10.0.0.src/lib/builtins/CMakeLists.txt compiler-rt-10.0.0.src-patched/lib/builtins/CMakeLists.txt
+--- compiler-rt-10.0.0.src/lib/builtins/CMakeLists.txt	2020-03-24 00:01:02.000000000 +0900
++++ compiler-rt-10.0.0.src-patched/lib/builtins/CMakeLists.txt	2020-05-10 03:44:49.468579650 +0900
+@@ -474,6 +474,7 @@
+ set(armv7_SOURCES ${arm_SOURCES})
+ set(armv7s_SOURCES ${arm_SOURCES})
+ set(armv7k_SOURCES ${arm_SOURCES})
++set(armv7l_SOURCES ${arm_SOURCES})
+ set(arm64_SOURCES ${aarch64_SOURCES})
+ 
+ # macho_embedded archs
+@@ -595,7 +596,7 @@
+   foreach (arch ${BUILTIN_SUPPORTED_ARCH})
+     if (CAN_TARGET_${arch})
+       # For ARM archs, exclude any VFP builtins if VFP is not supported
+-      if (${arch} MATCHES "^(arm|armhf|armv7|armv7s|armv7k|armv7m|armv7em)$")
++      if (${arch} MATCHES "^(arm|armhf|armv7|armv7s|armv7k|armv7l|armv7m|armv7em)$")
+         string(REPLACE ";" " " _TARGET_${arch}_CFLAGS "${TARGET_${arch}_CFLAGS}")
+         check_compile_definition(__VFP_FP__ "${CMAKE_C_FLAGS} ${_TARGET_${arch}_CFLAGS}" COMPILER_RT_HAS_${arch}_VFP)
+         if(NOT COMPILER_RT_HAS_${arch}_VFP)
diff --git a/pkgs/development/compilers/llvm/12/compiler-rt-codesign.patch b/pkgs/development/compilers/llvm/12/compiler-rt-codesign.patch
new file mode 100644
index 000000000000..3cc12b94b200
--- /dev/null
+++ b/pkgs/development/compilers/llvm/12/compiler-rt-codesign.patch
@@ -0,0 +1,33 @@
+From 3dec5f3475a26aeb4678627795c4b67c6b7b4785 Mon Sep 17 00:00:00 2001
+From: Will Dietz <w@wdtz.org>
+Date: Tue, 19 Sep 2017 13:13:06 -0500
+Subject: [PATCH] remove codesign use on Apple, disable ios sim testing that
+ needs it
+
+---
+ cmake/Modules/AddCompilerRT.cmake |  8 ------
+ test/asan/CMakeLists.txt          | 52 ---------------------------------------
+ test/tsan/CMakeLists.txt          | 47 -----------------------------------
+ 3 files changed, 107 deletions(-)
+
+diff --git a/cmake/Modules/AddCompilerRT.cmake b/cmake/Modules/AddCompilerRT.cmake
+index bc5fb9ff7..b64eb4246 100644
+--- a/cmake/Modules/AddCompilerRT.cmake
++++ b/cmake/Modules/AddCompilerRT.cmake
+@@ -210,14 +210,6 @@ function(add_compiler_rt_runtime name type)
+         set_target_properties(${libname} PROPERTIES IMPORT_PREFIX "")
+         set_target_properties(${libname} PROPERTIES IMPORT_SUFFIX ".lib")
+       endif()
+-      if(APPLE)
+-        # Ad-hoc sign the dylibs
+-        add_custom_command(TARGET ${libname}
+-          POST_BUILD  
+-          COMMAND codesign --sign - $<TARGET_FILE:${libname}>
+-          WORKING_DIRECTORY ${COMPILER_RT_LIBRARY_OUTPUT_DIR}
+-        )
+-      endif()
+     endif()
+     install(TARGETS ${libname}
+       ARCHIVE DESTINATION ${COMPILER_RT_LIBRARY_INSTALL_DIR}
+2.14.1
+
diff --git a/pkgs/development/compilers/llvm/12/compiler-rt.nix b/pkgs/development/compilers/llvm/12/compiler-rt.nix
new file mode 100644
index 000000000000..4a6f7ea99af3
--- /dev/null
+++ b/pkgs/development/compilers/llvm/12/compiler-rt.nix
@@ -0,0 +1,90 @@
+{ lib, stdenv, version, fetch, cmake, python3, llvm, libcxxabi }:
+
+let
+
+  useLLVM = stdenv.hostPlatform.useLLVM or false;
+  bareMetal = stdenv.hostPlatform.parsed.kernel.name == "none";
+  inherit (stdenv.hostPlatform) isMusl;
+
+in
+
+stdenv.mkDerivation rec {
+  pname = "compiler-rt";
+  inherit version;
+  src = fetch pname "1n4jf0clwj3q0vfc7xjl0k4dqj69fvgsmib8qdqh45imgamnypvb";
+
+  nativeBuildInputs = [ cmake python3 llvm ];
+  buildInputs = lib.optional stdenv.hostPlatform.isDarwin libcxxabi;
+
+  NIX_CFLAGS_COMPILE = [
+    "-DSCUDO_DEFAULT_OPTIONS=DeleteSizeMismatch=0:DeallocationTypeMismatch=0"
+  ];
+
+  cmakeFlags = [
+    "-DCOMPILER_RT_DEFAULT_TARGET_ONLY=ON"
+    "-DCMAKE_C_COMPILER_TARGET=${stdenv.hostPlatform.config}"
+    "-DCMAKE_ASM_COMPILER_TARGET=${stdenv.hostPlatform.config}"
+  ] ++ lib.optionals (stdenv.isDarwin) [
+    "-DDARWIN_macosx_OVERRIDE_SDK_VERSION=ON"
+    "-DDARWIN_osx_ARCHS=${stdenv.hostPlatform.parsed.cpu.name}"
+  ] ++ lib.optionals (useLLVM || bareMetal || isMusl) [
+    "-DCOMPILER_RT_BUILD_SANITIZERS=OFF"
+    "-DCOMPILER_RT_BUILD_XRAY=OFF"
+    "-DCOMPILER_RT_BUILD_LIBFUZZER=OFF"
+    "-DCOMPILER_RT_BUILD_PROFILE=OFF"
+  ] ++ lib.optionals (useLLVM || bareMetal) [
+    "-DCMAKE_C_COMPILER_WORKS=ON"
+    "-DCMAKE_CXX_COMPILER_WORKS=ON"
+    "-DCOMPILER_RT_BAREMETAL_BUILD=ON"
+    "-DCMAKE_SIZEOF_VOID_P=${toString (stdenv.hostPlatform.parsed.cpu.bits / 8)}"
+  ] ++ lib.optionals (useLLVM) [
+    "-DCOMPILER_RT_BUILD_BUILTINS=ON"
+    "-DCMAKE_C_FLAGS=-nodefaultlibs"
+    #https://stackoverflow.com/questions/53633705/cmake-the-c-compiler-is-not-able-to-compile-a-simple-test-program
+    "-DCMAKE_TRY_COMPILE_TARGET_TYPE=STATIC_LIBRARY"
+  ] ++ lib.optionals (bareMetal) [
+    "-DCOMPILER_RT_OS_DIR=baremetal"
+  ];
+
+  outputs = [ "out" "dev" ];
+
+  patches = [
+    ./compiler-rt-codesign.patch # Revert compiler-rt commit that makes codesign mandatory
+    ./compiler-rt-X86-support-extension.patch # Add support for i486 i586 i686 by reusing i386 config
+  ]# ++ lib.optional stdenv.hostPlatform.isMusl ./sanitizers-nongnu.patch
+    ++ lib.optional stdenv.hostPlatform.isAarch32 ./compiler-rt-armv7l.patch;
+
+
+  # TSAN requires XPC on Darwin, which we have no public/free source files for. We can depend on the Apple frameworks
+  # to get it, but they're unfree. Since LLVM is rather central to the stdenv, we patch out TSAN support so that Hydra
+  # can build this. If we didn't do it, basically the entire nixpkgs on Darwin would have an unfree dependency and we'd
+  # get no binary cache for the entire platform. If you really find yourself wanting the TSAN, make this controllable by
+  # a flag and turn the flag off during the stdenv build.
+  postPatch = lib.optionalString (!stdenv.isDarwin) ''
+    substituteInPlace cmake/builtin-config-ix.cmake \
+      --replace 'set(X86 i386)' 'set(X86 i386 i486 i586 i686)'
+  '' + lib.optionalString stdenv.isDarwin ''
+    substituteInPlace cmake/builtin-config-ix.cmake \
+      --replace 'set(ARM64 arm64 arm64e)' 'set(ARM64)'
+    substituteInPlace cmake/config-ix.cmake \
+      --replace 'set(COMPILER_RT_HAS_TSAN TRUE)' 'set(COMPILER_RT_HAS_TSAN FALSE)'
+  '' + lib.optionalString (useLLVM) ''
+    substituteInPlace lib/builtins/int_util.c \
+      --replace "#include <stdlib.h>" ""
+    substituteInPlace lib/builtins/clear_cache.c \
+      --replace "#include <assert.h>" ""
+    substituteInPlace lib/builtins/cpu_model.c \
+      --replace "#include <assert.h>" ""
+  '';
+
+  # Hack around weird upsream RPATH bug
+  postInstall = lib.optionalString (stdenv.hostPlatform.isDarwin || stdenv.hostPlatform.isWasm) ''
+    ln -s "$out/lib"/*/* "$out/lib"
+  '' + lib.optionalString (useLLVM) ''
+    ln -s $out/lib/*/clang_rt.crtbegin-*.o $out/lib/crtbegin.o
+    ln -s $out/lib/*/clang_rt.crtend-*.o $out/lib/crtend.o
+    ln -s $out/lib/*/clang_rt.crtbegin_shared-*.o $out/lib/crtbeginS.o
+    ln -s $out/lib/*/clang_rt.crtend_shared-*.o $out/lib/crtendS.o
+  '';
+
+}
diff --git a/pkgs/development/compilers/llvm/12/default.nix b/pkgs/development/compilers/llvm/12/default.nix
new file mode 100644
index 000000000000..b0ee0b836795
--- /dev/null
+++ b/pkgs/development/compilers/llvm/12/default.nix
@@ -0,0 +1,204 @@
+{ lowPrio, newScope, pkgs, lib, stdenv, cmake, gccForLibs
+, libxml2, python3, isl, fetchurl, overrideCC, wrapCCWith, wrapBintoolsWith
+, buildPackages
+, buildLlvmTools # tools, but from the previous stage, for cross
+, targetLlvmLibraries # libraries, but from the next stage, for cross
+, darwin
+}:
+
+let
+  release_version = "12.0.0";
+  candidate = "rc3"; # empty or "rcN"
+  dash-candidate = lib.optionalString (candidate != "") "-${candidate}";
+  version = "${release_version}${dash-candidate}"; # differentiating these (variables) is important for RCs
+  targetConfig = stdenv.targetPlatform.config;
+
+  fetch = name: sha256: fetchurl {
+    url = "https://github.com/llvm/llvm-project/releases/download/llvmorg-${version}/${name}-${release_version}${candidate}.src.tar.xz";
+    inherit sha256;
+  };
+
+  clang-tools-extra_src = fetch "clang-tools-extra" "1p6ln69iciwwpng226mfvxf3vylfvbz73y0a4y4v2rg7pn7hk671";
+
+  tools = lib.makeExtensible (tools: let
+    callPackage = newScope (tools // { inherit stdenv cmake libxml2 python3 isl release_version version fetch; });
+    mkExtraBuildCommands = cc: ''
+      rsrc="$out/resource-root"
+      mkdir "$rsrc"
+      ln -s "${cc}/lib/clang/${release_version}/include" "$rsrc"
+      ln -s "${targetLlvmLibraries.compiler-rt.out}/lib" "$rsrc/lib"
+      ln -s "${targetLlvmLibraries.compiler-rt.out}/share" "$rsrc/share"
+      echo "-resource-dir=$rsrc" >> $out/nix-support/cc-cflags
+    '';
+  in {
+
+    llvm = callPackage ./llvm.nix { };
+
+    clang-unwrapped = callPackage ./clang {
+      inherit (tools) lld;
+      inherit clang-tools-extra_src;
+    };
+
+    # disabled until recommonmark supports sphinx 3
+    #Llvm-manpages = lowPrio (tools.llvm.override {
+    #  enableManpages = true;
+    #  python3 = pkgs.python3;  # don't use python-boot
+    #});
+
+    clang-manpages = lowPrio (tools.clang-unwrapped.override {
+      enableManpages = true;
+      python3 = pkgs.python3;  # don't use python-boot
+    });
+
+    # disabled until recommonmark supports sphinx 3
+    # lldb-manpages = lowPrio (tools.lldb.override {
+    #   enableManpages = true;
+    #   python3 = pkgs.python3;  # don't use python-boot
+    # });
+
+    libclang = tools.clang-unwrapped.lib;
+
+    clang = if stdenv.cc.isGNU then tools.libstdcxxClang else tools.libcxxClang;
+
+    libstdcxxClang = wrapCCWith rec {
+      cc = tools.clang-unwrapped;
+      # libstdcxx is taken from gcc in an ad-hoc way in cc-wrapper.
+      libcxx = null;
+      extraPackages = [
+        targetLlvmLibraries.compiler-rt
+      ];
+      extraBuildCommands = mkExtraBuildCommands cc;
+    };
+
+    libcxxClang = wrapCCWith rec {
+      cc = tools.clang-unwrapped;
+      libcxx = targetLlvmLibraries.libcxx;
+      extraPackages = [
+        targetLlvmLibraries.libcxxabi
+        targetLlvmLibraries.compiler-rt
+      ];
+      extraBuildCommands = mkExtraBuildCommands cc;
+    };
+
+    lld = callPackage ./lld.nix {
+      libunwind = libraries.libunwind;
+    };
+
+    lldb = callPackage ./lldb.nix {
+      inherit (darwin) libobjc bootstrap_cmds;
+      inherit (darwin.apple_sdk.libs) xpc;
+      inherit (darwin.apple_sdk.frameworks) Foundation Carbon Cocoa;
+    };
+
+    # Below, is the LLVM bootstrapping logic. It handles building a
+    # fully LLVM toolchain from scratch. No GCC toolchain should be
+    # pulled in. As a consequence, it is very quick to build different
+    # targets provided by LLVM and we can also build for what GCC
+    # doesn’t support like LLVM. Probably we should move to some other
+    # file.
+
+    bintools = callPackage ./bintools.nix {};
+
+    lldClang = wrapCCWith rec {
+      cc = tools.clang-unwrapped;
+      libcxx = targetLlvmLibraries.libcxx;
+      bintools = wrapBintoolsWith {
+        inherit (tools) bintools;
+      };
+      extraPackages = [
+        targetLlvmLibraries.libcxxabi
+        targetLlvmLibraries.compiler-rt
+      ] ++ lib.optionals (!stdenv.targetPlatform.isWasm) [
+        targetLlvmLibraries.libunwind
+      ];
+      extraBuildCommands = ''
+        echo "-rtlib=compiler-rt -Wno-unused-command-line-argument" >> $out/nix-support/cc-cflags
+        echo "-B${targetLlvmLibraries.compiler-rt}/lib" >> $out/nix-support/cc-cflags
+      '' + lib.optionalString (!stdenv.targetPlatform.isWasm) ''
+        echo "--unwindlib=libunwind" >> $out/nix-support/cc-cflags
+      '' + lib.optionalString stdenv.targetPlatform.isWasm ''
+        echo "-fno-exceptions" >> $out/nix-support/cc-cflags
+      '' + mkExtraBuildCommands cc;
+    };
+
+    lldClangNoLibcxx = wrapCCWith rec {
+      cc = tools.clang-unwrapped;
+      libcxx = null;
+      bintools = wrapBintoolsWith {
+        inherit (tools) bintools;
+      };
+      extraPackages = [
+        targetLlvmLibraries.compiler-rt
+      ];
+      extraBuildCommands = ''
+        echo "-rtlib=compiler-rt" >> $out/nix-support/cc-cflags
+        echo "-B${targetLlvmLibraries.compiler-rt}/lib" >> $out/nix-support/cc-cflags
+        echo "-nostdlib++" >> $out/nix-support/cc-cflags
+      '' + mkExtraBuildCommands cc;
+    };
+
+    lldClangNoLibc = wrapCCWith rec {
+      cc = tools.clang-unwrapped;
+      libcxx = null;
+      bintools = wrapBintoolsWith {
+        inherit (tools) bintools;
+        libc = null;
+      };
+      extraPackages = [
+        targetLlvmLibraries.compiler-rt
+      ];
+      extraBuildCommands = ''
+        echo "-rtlib=compiler-rt" >> $out/nix-support/cc-cflags
+        echo "-B${targetLlvmLibraries.compiler-rt}/lib" >> $out/nix-support/cc-cflags
+      '' + mkExtraBuildCommands cc;
+    };
+
+    lldClangNoCompilerRt = wrapCCWith {
+      cc = tools.clang-unwrapped;
+      libcxx = null;
+      bintools = wrapBintoolsWith {
+        inherit (tools) bintools;
+        libc = null;
+      };
+      extraPackages = [ ];
+      extraBuildCommands = ''
+        echo "-nostartfiles" >> $out/nix-support/cc-cflags
+      '';
+    };
+
+  });
+
+  libraries = lib.makeExtensible (libraries: let
+    callPackage = newScope (libraries // buildLlvmTools // { inherit stdenv cmake libxml2 python3 isl release_version version fetch; });
+  in {
+
+    compiler-rt = callPackage ./compiler-rt.nix ({} //
+      (lib.optionalAttrs (stdenv.hostPlatform.useLLVM or false) {
+        stdenv = overrideCC stdenv buildLlvmTools.lldClangNoCompilerRt;
+      }));
+
+    stdenv = overrideCC stdenv buildLlvmTools.clang;
+
+    libcxxStdenv = overrideCC stdenv buildLlvmTools.libcxxClang;
+
+    libcxx = callPackage ./libc++ ({} //
+      (lib.optionalAttrs (stdenv.hostPlatform.useLLVM or false) {
+        stdenv = overrideCC stdenv buildLlvmTools.lldClangNoLibcxx;
+      }));
+
+    libcxxabi = callPackage ./libc++abi.nix ({} //
+      (lib.optionalAttrs (stdenv.hostPlatform.useLLVM or false) {
+        stdenv = overrideCC stdenv buildLlvmTools.lldClangNoLibcxx;
+        libunwind = libraries.libunwind;
+      }));
+
+    openmp = callPackage ./openmp.nix {};
+
+    libunwind = callPackage ./libunwind.nix ({} //
+      (lib.optionalAttrs (stdenv.hostPlatform.useLLVM or false) {
+        stdenv = overrideCC stdenv buildLlvmTools.lldClangNoLibcxx;
+      }));
+
+  });
+
+in { inherit tools libraries; } // libraries // tools
diff --git a/pkgs/development/compilers/llvm/12/libc++/default.nix b/pkgs/development/compilers/llvm/12/libc++/default.nix
new file mode 100644
index 000000000000..8f2672cc0d93
--- /dev/null
+++ b/pkgs/development/compilers/llvm/12/libc++/default.nix
@@ -0,0 +1,56 @@
+{ lib, stdenv, fetch, fetchpatch, cmake, python3, libcxxabi, llvm, fixDarwinDylibNames, version
+, enableShared ? !stdenv.hostPlatform.isStatic
+}:
+
+stdenv.mkDerivation {
+  pname = "libc++";
+  inherit version;
+
+  src = fetch "libcxx" "1114yvbipwdk1qk1xrb7s05hf7cycyknpf4ph0wbqpjzzzxk0hgk";
+
+  postUnpack = ''
+    unpackFile ${libcxxabi.src}
+    mv libcxxabi-* libcxxabi
+    unpackFile ${llvm.src}
+    mv llvm-* llvm
+  '';
+
+  patches = [
+    (fetchpatch {
+      # Backported from LLVM 12, avoids clashes with commonly used "block.h" header.
+      url = "https://github.com/llvm/llvm-project/commit/19bc9ea480b60b607a3e303f20c7a3a2ea553369.patch";
+      sha256 = "sha256-aWa66ogmPkG0xHzSfcpD0qZyZQcNKwLV44js4eiun78=";
+      stripLen = 1;
+    })
+  ] ++ lib.optional stdenv.hostPlatform.isMusl ../../libcxx-0001-musl-hacks.patch;
+
+  preConfigure = lib.optionalString stdenv.hostPlatform.isMusl ''
+    patchShebangs utils/cat_files.py
+  '';
+
+  nativeBuildInputs = [ cmake python3 ]
+    ++ lib.optional stdenv.isDarwin fixDarwinDylibNames;
+
+  buildInputs = [ libcxxabi ];
+
+  cmakeFlags = [
+    "-DLIBCXX_CXX_ABI=libcxxabi"
+  ] ++ lib.optional (stdenv.hostPlatform.isMusl || stdenv.hostPlatform.isWasi) "-DLIBCXX_HAS_MUSL_LIBC=1"
+    ++ lib.optional (stdenv.hostPlatform.useLLVM or false) "-DLIBCXX_USE_COMPILER_RT=ON"
+    ++ lib.optional stdenv.hostPlatform.isWasm [
+      "-DLIBCXX_ENABLE_THREADS=OFF"
+      "-DLIBCXX_ENABLE_FILESYSTEM=OFF"
+      "-DLIBCXX_ENABLE_EXCEPTIONS=OFF"
+    ] ++ lib.optional (!enableShared) "-DLIBCXX_ENABLE_SHARED=OFF";
+
+  passthru = {
+    isLLVM = true;
+  };
+
+  meta = {
+    homepage = "https://libcxx.llvm.org/";
+    description = "A new implementation of the C++ standard library, targeting C++11";
+    license = with lib.licenses; [ ncsa mit ];
+    platforms = lib.platforms.all;
+  };
+}
diff --git a/pkgs/development/compilers/llvm/12/libc++abi.nix b/pkgs/development/compilers/llvm/12/libc++abi.nix
new file mode 100644
index 000000000000..24ef8168fcda
--- /dev/null
+++ b/pkgs/development/compilers/llvm/12/libc++abi.nix
@@ -0,0 +1,69 @@
+{ lib, stdenv, cmake, fetch, libcxx, libunwind, llvm, version
+, enableShared ? !stdenv.hostPlatform.isStatic
+}:
+
+stdenv.mkDerivation {
+  pname = "libc++abi";
+  inherit version;
+
+  src = fetch "libcxxabi" "1vdc6zld5rlbrbpxf0fxs0m6k1cabpi82ksiwgj1pmhx8l140n0q";
+
+  nativeBuildInputs = [ cmake ];
+  buildInputs = lib.optional (!stdenv.isDarwin && !stdenv.isFreeBSD && !stdenv.hostPlatform.isWasm) libunwind;
+
+  cmakeFlags = lib.optionals (stdenv.hostPlatform.useLLVM or false) [
+    "-DLLVM_ENABLE_LIBCXX=ON"
+    "-DLIBCXXABI_USE_LLVM_UNWINDER=ON"
+  ] ++ lib.optionals stdenv.hostPlatform.isWasm [
+    "-DLIBCXXABI_ENABLE_THREADS=OFF"
+    "-DLIBCXXABI_ENABLE_EXCEPTIONS=OFF"
+  ] ++ lib.optionals (!enableShared) [
+    "-DLIBCXXABI_ENABLE_SHARED=OFF"
+  ];
+
+  patches = [ ./libcxxabi-no-threads.patch ];
+
+  postUnpack = ''
+    unpackFile ${libcxx.src}
+    mv libcxx-* libcxx
+    unpackFile ${llvm.src}
+    mv llvm-* llvm
+  '' + lib.optionalString stdenv.isDarwin ''
+    export TRIPLE=x86_64-apple-darwin
+  '' + lib.optionalString stdenv.hostPlatform.isMusl ''
+    patch -p1 -d libcxx -i ${../libcxx-0001-musl-hacks.patch}
+  '' + lib.optionalString stdenv.hostPlatform.isWasm ''
+    patch -p1 -d llvm -i ${./libcxxabi-wasm.patch}
+  '';
+
+  installPhase = if stdenv.isDarwin
+    then ''
+      for file in lib/*.dylib; do
+        # this should be done in CMake, but having trouble figuring out
+        # the magic combination of necessary CMake variables
+        # if you fancy a try, take a look at
+        # https://gitlab.kitware.com/cmake/community/-/wikis/doc/cmake/RPATH-handling
+        install_name_tool -id $out/$file $file
+      done
+      make install
+      install -d 755 $out/include
+      install -m 644 ../include/*.h $out/include
+    ''
+    else ''
+      install -d -m 755 $out/include $out/lib
+      install -m 644 lib/libc++abi.a $out/lib
+      install -m 644 ../include/cxxabi.h $out/include
+    '' + lib.optionalString enableShared ''
+      install -m 644 lib/libc++abi.so.1.0 $out/lib
+      ln -s libc++abi.so.1.0 $out/lib/libc++abi.so
+      ln -s libc++abi.so.1.0 $out/lib/libc++abi.so.1
+    '';
+
+  meta = {
+    homepage = "https://libcxxabi.llvm.org/";
+    description = "A new implementation of low level support for a standard C++ library";
+    license = with lib.licenses; [ ncsa mit ];
+    maintainers = with lib.maintainers; [ vlstill ];
+    platforms = lib.platforms.all;
+  };
+}
diff --git a/pkgs/development/compilers/llvm/12/libcxxabi-no-threads.patch b/pkgs/development/compilers/llvm/12/libcxxabi-no-threads.patch
new file mode 100644
index 000000000000..787f3e16500e
--- /dev/null
+++ b/pkgs/development/compilers/llvm/12/libcxxabi-no-threads.patch
@@ -0,0 +1,12 @@
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index 4138acf..41b4763 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -362,6 +362,7 @@ if (NOT LIBCXXABI_ENABLE_THREADS)
+                         " is also set to ON.")
+   endif()
+   add_definitions(-D_LIBCXXABI_HAS_NO_THREADS)
++  add_definitions(-D_LIBCPP_HAS_NO_THREADS)
+ endif()
+ 
+ if (LIBCXXABI_HAS_EXTERNAL_THREAD_API)
diff --git a/pkgs/development/compilers/llvm/12/libcxxabi-wasm.patch b/pkgs/development/compilers/llvm/12/libcxxabi-wasm.patch
new file mode 100644
index 000000000000..4ebfe46aa813
--- /dev/null
+++ b/pkgs/development/compilers/llvm/12/libcxxabi-wasm.patch
@@ -0,0 +1,16 @@
+diff --git a/cmake/modules/HandleLLVMOptions.cmake b/cmake/modules/HandleLLVMOptions.cmake
+index 15497d405e0..33f7f18193a 100644
+--- a/cmake/modules/HandleLLVMOptions.cmake
++++ b/cmake/modules/HandleLLVMOptions.cmake
+@@ -127,7 +127,10 @@ else(WIN32)
+       set(LLVM_HAVE_LINK_VERSION_SCRIPT 1)
+     endif()
+   else(FUCHSIA OR UNIX)
+-    MESSAGE(SEND_ERROR "Unable to determine platform")
++    if(${CMAKE_SYSTEM_NAME} MATCHES "Wasi")
++    else()
++      MESSAGE(SEND_ERROR "Unable to determine platform")
++    endif()
+   endif(FUCHSIA OR UNIX)
+ endif(WIN32)
+ 
diff --git a/pkgs/development/compilers/llvm/12/libunwind.nix b/pkgs/development/compilers/llvm/12/libunwind.nix
new file mode 100644
index 000000000000..eba07ac76be9
--- /dev/null
+++ b/pkgs/development/compilers/llvm/12/libunwind.nix
@@ -0,0 +1,14 @@
+{ lib, stdenv, version, fetch, cmake, fetchpatch
+, enableShared ? !stdenv.hostPlatform.isStatic
+}:
+
+stdenv.mkDerivation rec {
+  pname = "libunwind";
+  inherit version;
+
+  src = fetch pname "18n3k2kf6pyvzspnz1i22czbgi14kmch76fxml8kvhky7mw7v1yz";
+
+  nativeBuildInputs = [ cmake ];
+
+  cmakeFlags = lib.optional (!enableShared) "-DLIBUNWIND_ENABLE_SHARED=OFF";
+}
diff --git a/pkgs/development/compilers/llvm/12/lld.nix b/pkgs/development/compilers/llvm/12/lld.nix
new file mode 100644
index 000000000000..b605e20d1da0
--- /dev/null
+++ b/pkgs/development/compilers/llvm/12/lld.nix
@@ -0,0 +1,39 @@
+{ lib, stdenv
+, fetch
+, libunwind
+, cmake
+, libxml2
+, llvm
+, version
+}:
+
+stdenv.mkDerivation rec {
+  pname = "lld";
+  inherit version;
+
+  src = fetch pname "097pxd7hgipr538vi48q8fi5svbd03bx3d078a06wigmvb7kzvw1";
+
+  nativeBuildInputs = [ cmake ];
+  buildInputs = [ llvm libxml2 ];
+
+  postPatch = ''
+    substituteInPlace MachO/CMakeLists.txt --replace \
+      '(''${LLVM_MAIN_SRC_DIR}/' '('
+    mkdir -p libunwind/include
+    tar -xf "${libunwind.src}" --wildcards -C libunwind/include --strip-components=2 "libunwind-*/include/"
+  '';
+
+  outputs = [ "out" "dev" ];
+
+  postInstall = ''
+    moveToOutput include "$dev"
+    moveToOutput lib "$dev"
+  '';
+
+  meta = {
+    description = "The LLVM Linker";
+    homepage    = "https://lld.llvm.org/";
+    license     = lib.licenses.ncsa;
+    platforms   = lib.platforms.all;
+  };
+}
diff --git a/pkgs/development/compilers/llvm/12/lldb-procfs.patch b/pkgs/development/compilers/llvm/12/lldb-procfs.patch
new file mode 100644
index 000000000000..b075dbaeee0a
--- /dev/null
+++ b/pkgs/development/compilers/llvm/12/lldb-procfs.patch
@@ -0,0 +1,31 @@
+--- a/source/Plugins/Process/Linux/Procfs.h
++++ b/source/Plugins/Process/Linux/Procfs.h
+@@ -11,21 +11,12 @@
+ // sys/procfs.h on Android/Linux for all supported architectures.
+ 
+ #include <sys/ptrace.h>
++#include <asm/ptrace.h>
+ 
+-#ifdef __ANDROID__
+-#if defined(__arm64__) || defined(__aarch64__)
+-typedef unsigned long elf_greg_t;
+-typedef elf_greg_t
+-    elf_gregset_t[(sizeof(struct user_pt_regs) / sizeof(elf_greg_t))];
+-typedef struct user_fpsimd_state elf_fpregset_t;
+-#ifndef NT_FPREGSET
+-#define NT_FPREGSET NT_PRFPREG
+-#endif // NT_FPREGSET
+-#elif defined(__mips__)
+-#ifndef NT_FPREGSET
+-#define NT_FPREGSET NT_PRFPREG
+-#endif // NT_FPREGSET
+-#endif
+-#else // __ANDROID__
++#if !defined(__GLIBC__) && defined(__powerpc__)
++#define pt_regs musl_pt_regs
++#include <sys/procfs.h>
++#undef pt_regs
++#else
+ #include <sys/procfs.h>
+-#endif // __ANDROID__
++#endif
diff --git a/pkgs/development/compilers/llvm/12/lldb.nix b/pkgs/development/compilers/llvm/12/lldb.nix
new file mode 100644
index 000000000000..ab356419ea25
--- /dev/null
+++ b/pkgs/development/compilers/llvm/12/lldb.nix
@@ -0,0 +1,103 @@
+{ lib, stdenv
+, fetch
+, cmake
+, zlib
+, ncurses
+, swig
+, which
+, libedit
+, libxml2
+, llvm
+, clang-unwrapped
+, python3
+, version
+, libobjc
+, xpc
+, Foundation
+, bootstrap_cmds
+, Carbon
+, Cocoa
+, lit
+, enableManpages ? false
+}:
+
+stdenv.mkDerivation (rec {
+  pname = "lldb";
+  inherit version;
+
+  src = fetch pname "077fli9l0fg4kpa5l9vrj810s13ajs15d745lg4l8kmjkbw7p3yh";
+
+  patches = [ ./lldb-procfs.patch ];
+
+  nativeBuildInputs = [ cmake python3 which swig lit ]
+    ++ lib.optionals enableManpages [ python3.pkgs.sphinx python3.pkgs.recommonmark ];
+
+  buildInputs = [
+    ncurses
+    zlib
+    libedit
+    libxml2
+    llvm
+  ]
+  ++ lib.optionals stdenv.isDarwin [
+    libobjc
+    xpc
+    Foundation
+    bootstrap_cmds
+    Carbon
+    Cocoa
+  ];
+
+  hardeningDisable = [ "format" ];
+
+  cmakeFlags = [
+    "-DLLVM_ENABLE_RTTI=OFF"
+    "-DClang_DIR=${clang-unwrapped}/lib/cmake"
+    "-DLLVM_EXTERNAL_LIT=${lit}/bin/lit"
+  ] ++ lib.optionals stdenv.isDarwin [
+    "-DLLDB_USE_SYSTEM_DEBUGSERVER=ON"
+  ] ++ lib.optionals (!stdenv.isDarwin) [
+    "-DLLDB_CODESIGN_IDENTITY=" # codesigning makes nondeterministic
+  ] ++ lib.optionals enableManpages [
+    "-DLLVM_ENABLE_SPHINX=ON"
+    "-DSPHINX_OUTPUT_MAN=ON"
+    "-DSPHINX_OUTPUT_HTML=OFF"
+  ];
+
+  postInstall = ''
+    # Editor support
+    # vscode:
+    install -D ../tools/lldb-vscode/package.json $out/share/vscode/extensions/llvm-org.lldb-vscode-0.1.0/package.json
+    mkdir -p $out/share/vscode/extensions/llvm-org.lldb-vscode-0.1.0/bin
+    ln -s $out/bin/lldb-vscode $out/share/vscode/extensions/llvm-org.lldb-vscode-0.1.0/bin
+  '';
+
+  meta = with lib; {
+    description = "A next-generation high-performance debugger";
+    homepage = "https://lldb.llvm.org";
+    license = licenses.ncsa;
+    platforms = platforms.all;
+  };
+} // lib.optionalAttrs enableManpages {
+  pname = "lldb-manpages";
+
+  buildPhase = ''
+    make docs-lldb-man
+  '';
+
+  propagatedBuildInputs = [];
+  # manually install lldb man page
+  installPhase = ''
+    mkdir -p $out/share/man/man1
+    install docs/man/lldb.1 -t $out/share/man/man1/
+  '';
+
+  postPatch = null;
+  postInstall = null;
+
+  outputs = [ "out" ];
+
+  doCheck = false;
+
+  meta.description = "man pages for LLDB ${version}";
+})
diff --git a/pkgs/development/compilers/llvm/12/llvm-outputs.patch b/pkgs/development/compilers/llvm/12/llvm-outputs.patch
new file mode 100644
index 000000000000..40096fa3497f
--- /dev/null
+++ b/pkgs/development/compilers/llvm/12/llvm-outputs.patch
@@ -0,0 +1,26 @@
+diff --git a/tools/llvm-config/llvm-config.cpp b/tools/llvm-config/llvm-config.cpp
+index 94d426b..37f7794 100644
+--- a/tools/llvm-config/llvm-config.cpp
++++ b/tools/llvm-config/llvm-config.cpp
+@@ -333,6 +333,21 @@ int main(int argc, char **argv) {
+     ActiveIncludeOption = "-I" + ActiveIncludeDir;
+   }
+ 
++  /// Nix-specific multiple-output handling: override ActiveLibDir if --link-shared
++  if (!IsInDevelopmentTree) {
++    bool WantShared = true;
++    for (int i = 1; i < argc; ++i) {
++      StringRef Arg = argv[i];
++      if (Arg == "--link-shared")
++        WantShared = true;
++      else if (Arg == "--link-static")
++        WantShared = false; // the last one wins
++    }
++
++    if (WantShared)
++      ActiveLibDir = std::string("@lib@") + "/lib" + LLVM_LIBDIR_SUFFIX;
++  }
++
+   /// We only use `shared library` mode in cases where the static library form
+   /// of the components provided are not available; note however that this is
+   /// skipped if we're run from within the build dir. However, once installed,
diff --git a/pkgs/development/compilers/llvm/12/llvm.nix b/pkgs/development/compilers/llvm/12/llvm.nix
new file mode 100644
index 000000000000..87175b474c5f
--- /dev/null
+++ b/pkgs/development/compilers/llvm/12/llvm.nix
@@ -0,0 +1,189 @@
+{ lib, stdenv
+, fetch
+, cmake
+, python3
+, libffi
+, libbfd
+, libpfm
+, libxml2
+, ncurses
+, version
+, release_version
+, zlib
+, buildPackages
+, debugVersion ? false
+, enableManpages ? false
+, enableSharedLibraries ? true
+, enablePFM ? !(stdenv.isDarwin
+  || stdenv.isAarch64 # broken for Ampere eMAG 8180 (c2.large.arm on Packet) #56245
+  || stdenv.isAarch32 # broken for the armv7l builder
+)
+, enablePolly ? false
+}:
+
+let
+  inherit (lib) optional optionals optionalString;
+
+  # Used when creating a version-suffixed symlink of libLLVM.dylib
+  shortVersion = with lib;
+    concatStringsSep "." (take 1 (splitString "." release_version));
+
+in stdenv.mkDerivation (rec {
+  pname = "llvm";
+  inherit version;
+
+  src = fetch pname "1lpdkndjb8cxpcyjv9glqp58687j8y8cvd7r72pw6sbqkkzq86g5";
+  polly_src = fetch "polly" "002a8q3lgspvqdb8fi09cl11x438x6a2d2sb026jargrx92i5vas";
+
+  unpackPhase = ''
+    unpackFile $src
+    mv llvm-${release_version}* llvm
+    sourceRoot=$PWD/llvm
+  '' + optionalString enablePolly ''
+    unpackFile $polly_src
+    mv polly-* $sourceRoot/tools/polly
+  '';
+
+  outputs = [ "out" "python" ]
+    ++ optional enableSharedLibraries "lib";
+
+  nativeBuildInputs = [ cmake python3 ]
+    ++ optionals enableManpages [ python3.pkgs.sphinx python3.pkgs.recommonmark ];
+
+  buildInputs = [ libxml2 libffi ]
+    ++ optional enablePFM libpfm; # exegesis
+
+  propagatedBuildInputs = [ ncurses zlib ];
+
+  postPatch = optionalString stdenv.isDarwin ''
+    substituteInPlace cmake/modules/AddLLVM.cmake \
+      --replace 'set(_install_name_dir INSTALL_NAME_DIR "@rpath")' "set(_install_name_dir)" \
+      --replace 'set(_install_rpath "@loader_path/../lib''${LLVM_LIBDIR_SUFFIX}" ''${extra_libdir})' ""
+  ''
+  # Patch llvm-config to return correct library path based on --link-{shared,static}.
+  + optionalString (enableSharedLibraries) ''
+    substitute '${./llvm-outputs.patch}' ./llvm-outputs.patch --subst-var lib
+    patch -p1 < ./llvm-outputs.patch
+  '' + ''
+    # FileSystem permissions tests fail with various special bits
+    substituteInPlace unittests/Support/CMakeLists.txt \
+      --replace "Path.cpp" ""
+    rm unittests/Support/Path.cpp
+    substituteInPlace unittests/IR/CMakeLists.txt \
+      --replace "PassBuilderCallbacksTest.cpp" ""
+    rm unittests/IR/PassBuilderCallbacksTest.cpp
+  '' + optionalString stdenv.hostPlatform.isMusl ''
+    patch -p1 -i ${../TLI-musl.patch}
+    substituteInPlace unittests/Support/CMakeLists.txt \
+      --replace "add_subdirectory(DynamicLibrary)" ""
+    rm unittests/Support/DynamicLibrary/DynamicLibraryTest.cpp
+    # valgrind unhappy with musl or glibc, but fails w/musl only
+    rm test/CodeGen/AArch64/wineh4.mir
+  '' + optionalString stdenv.hostPlatform.isAarch32 ''
+    # skip failing X86 test cases on 32-bit ARM
+    rm test/DebugInfo/X86/convert-debugloc.ll
+    rm test/DebugInfo/X86/convert-inlined.ll
+    rm test/DebugInfo/X86/convert-linked.ll
+    rm test/tools/dsymutil/X86/op-convert.test
+  '' + optionalString (stdenv.hostPlatform.system == "armv6l-linux") ''
+    # Seems to require certain floating point hardware (NEON?)
+    rm test/ExecutionEngine/frem.ll
+  '' + ''
+    patchShebangs test/BugPoint/compile-custom.ll.py
+  '';
+
+  # hacky fix: created binaries need to be run before installation
+  preBuild = ''
+    mkdir -p $out/
+    ln -sv $PWD/lib $out
+  '';
+
+  # E.g. mesa.drivers use the build-id as a cache key (see #93946):
+  LDFLAGS = optionalString (enableSharedLibraries && !stdenv.isDarwin) "-Wl,--build-id=sha1";
+
+  cmakeFlags = with stdenv; [
+    "-DCMAKE_BUILD_TYPE=${if debugVersion then "Debug" else "Release"}"
+    "-DLLVM_INSTALL_UTILS=ON"  # Needed by rustc
+    "-DLLVM_BUILD_TESTS=ON"
+    "-DLLVM_ENABLE_FFI=ON"
+    "-DLLVM_ENABLE_RTTI=ON"
+    "-DLLVM_HOST_TRIPLE=${stdenv.hostPlatform.config}"
+    "-DLLVM_DEFAULT_TARGET_TRIPLE=${stdenv.hostPlatform.config}"
+    "-DLLVM_ENABLE_DUMP=ON"
+  ] ++ optionals enableSharedLibraries [
+    "-DLLVM_LINK_LLVM_DYLIB=ON"
+  ] ++ optionals enableManpages [
+    "-DLLVM_BUILD_DOCS=ON"
+    "-DLLVM_ENABLE_SPHINX=ON"
+    "-DSPHINX_OUTPUT_MAN=ON"
+    "-DSPHINX_OUTPUT_HTML=OFF"
+    "-DSPHINX_WARNINGS_AS_ERRORS=OFF"
+  ] ++ optionals (!isDarwin) [
+    "-DLLVM_BINUTILS_INCDIR=${libbfd.dev}/include"
+  ] ++ optionals isDarwin [
+    "-DLLVM_ENABLE_LIBCXX=ON"
+    "-DCAN_TARGET_i386=false"
+  ] ++ optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
+    "-DCMAKE_CROSSCOMPILING=True"
+    "-DLLVM_TABLEGEN=${buildPackages.llvm_12}/bin/llvm-tblgen"
+  ];
+
+  postBuild = ''
+    rm -R $out
+  '';
+
+  preCheck = ''
+    export LD_LIBRARY_PATH=$LD_LIBRARY_PATH''${LD_LIBRARY_PATH:+:}$PWD/lib
+  '';
+
+  postInstall = ''
+    mkdir -p $python/share
+    mv $out/share/opt-viewer $python/share/opt-viewer
+  ''
+  + optionalString enableSharedLibraries ''
+    moveToOutput "lib/libLLVM-*" "$lib"
+    moveToOutput "lib/libLLVM${stdenv.hostPlatform.extensions.sharedLibrary}" "$lib"
+  ''
+  + optionalString (enableSharedLibraries && (!stdenv.isDarwin)) ''
+    substituteInPlace "$out/lib/cmake/llvm/LLVMExports-${if debugVersion then "debug" else "release"}.cmake" \
+      --replace "\''${_IMPORT_PREFIX}/lib/libLLVM-" "$lib/lib/libLLVM-"
+  ''
+  + optionalString (stdenv.isDarwin && enableSharedLibraries) ''
+    substituteInPlace "$out/lib/cmake/llvm/LLVMExports-${if debugVersion then "debug" else "release"}.cmake" \
+      --replace "\''${_IMPORT_PREFIX}/lib/libLLVM.dylib" "$lib/lib/libLLVM.dylib"
+    ln -s $lib/lib/libLLVM.dylib $lib/lib/libLLVM-${shortVersion}.dylib
+    ln -s $lib/lib/libLLVM.dylib $lib/lib/libLLVM-${release_version}.dylib
+  '';
+
+  doCheck = stdenv.isLinux && (!stdenv.isx86_32) && (!stdenv.hostPlatform.isMusl);
+
+  checkTarget = "check-all";
+
+  requiredSystemFeatures = [ "big-parallel" ];
+  meta = {
+    description = "Collection of modular and reusable compiler and toolchain technologies";
+    homepage    = "https://llvm.org/";
+    license     = lib.licenses.ncsa;
+    maintainers = with lib.maintainers; [ lovek323 raskin dtzWill primeos ];
+    platforms   = lib.platforms.all;
+  };
+} // lib.optionalAttrs enableManpages {
+  pname = "llvm-manpages";
+
+  buildPhase = ''
+    make docs-llvm-man
+  '';
+
+  installPhase = ''
+    make -C docs install
+  '';
+
+  postPatch = null;
+  postInstall = null;
+
+  outputs = [ "out" ];
+
+  doCheck = false;
+
+  meta.description = "man pages for LLVM ${version}";
+})
diff --git a/pkgs/development/compilers/llvm/12/openmp.nix b/pkgs/development/compilers/llvm/12/openmp.nix
new file mode 100644
index 000000000000..3cb5a09de8fe
--- /dev/null
+++ b/pkgs/development/compilers/llvm/12/openmp.nix
@@ -0,0 +1,35 @@
+{ lib
+, stdenv
+, fetch
+, fetchpatch
+, cmake
+, llvm
+, perl
+, version
+}:
+
+stdenv.mkDerivation rec {
+  pname = "openmp";
+  inherit version;
+
+  src = fetch pname "0kw1g7ndvwi0g7lx5d55mp81h9vffxz820l9r2wjdvvfs3dsyq05";
+
+  patches = [
+    # Fix compilation on aarch64-darwin, remove after the next release.
+    (fetchpatch {
+      url = "https://github.com/llvm/llvm-project/commit/7b5254223acbf2ef9cd278070c5a84ab278d7e5f.patch";
+      sha256 = "sha256-A+9/IVIoazu68FK5H5CiXcOEYe1Hpp4xTx2mIw7m8Es=";
+      stripLen = 1;
+    })
+  ];
+
+  nativeBuildInputs = [ cmake perl ];
+  buildInputs = [ llvm ];
+
+  meta = {
+    description = "Components required to build an executable OpenMP program";
+    homepage    = "https://openmp.llvm.org/";
+    license     = lib.licenses.mit;
+    platforms   = lib.platforms.all;
+  };
+}
diff --git a/pkgs/development/compilers/llvm/12/sanitizers-nongnu.patch b/pkgs/development/compilers/llvm/12/sanitizers-nongnu.patch
new file mode 100644
index 000000000000..1f2ac97818eb
--- /dev/null
+++ b/pkgs/development/compilers/llvm/12/sanitizers-nongnu.patch
@@ -0,0 +1,412 @@
+From f7a253f8f85d0f49df6b73996737a3e84ac64236 Mon Sep 17 00:00:00 2001
+From: Will Dietz <w@wdtz.org>
+Date: Mon, 24 Sep 2018 11:17:25 -0500
+Subject: [PATCH] Ported to 7.0, taken from gentoo-musl project.
+
+------
+Ported to compiler-rt-sanitizers-5.0.0. Taken from
+
+https://gist.githubusercontent.com/pwaller/2337f3290f12634cad3e3730cff0a6c1/raw/83c87a8585e2f9662494db5662e5361beb093c26/nongnu.patch
+Signed-off-by: Jory A. Pratt <anarchy@gentoo.org>
+
+Taken from gentoo-musl project, with a few additional minor fixes.
+---
+ lib/asan/asan_linux.cc                        |  4 +-
+ lib/interception/interception_linux.cc        |  2 +-
+ lib/interception/interception_linux.h         |  2 +-
+ lib/msan/msan_linux.cc                        |  2 +-
+ lib/sanitizer_common/sanitizer_allocator.cc   |  2 +-
+ .../sanitizer_common_interceptors_ioctl.inc   |  4 +-
+ .../sanitizer_common_syscalls.inc             |  2 +-
+ lib/sanitizer_common/sanitizer_linux.cc       |  8 +++-
+ .../sanitizer_linux_libcdep.cc                | 10 ++---
+ lib/sanitizer_common/sanitizer_platform.h     |  6 +++
+ .../sanitizer_platform_interceptors.h         |  4 +-
+ .../sanitizer_platform_limits_posix.cc        | 37 +++++++++++--------
+ lib/tsan/rtl/tsan_platform_linux.cc           |  2 +-
+ 13 files changed, 51 insertions(+), 34 deletions(-)
+
+diff --git a/lib/asan/asan_linux.cc b/lib/asan/asan_linux.cc
+index 625f32d40..73cf77aca 100644
+--- a/lib/asan/asan_linux.cc
++++ b/lib/asan/asan_linux.cc
+@@ -46,7 +46,7 @@
+ #include <link.h>
+ #endif
+ 
+-#if SANITIZER_ANDROID || SANITIZER_FREEBSD || SANITIZER_SOLARIS
++#if SANITIZER_ANDROID || SANITIZER_FREEBSD || SANITIZER_SOLARIS || SANITIZER_NONGNU
+ #include <ucontext.h>
+ extern "C" void* _DYNAMIC;
+ #elif SANITIZER_NETBSD
+@@ -139,7 +139,7 @@ void AsanApplyToGlobals(globals_op_fptr op, const void *needle) {
+   UNIMPLEMENTED();
+ }
+ 
+-#if SANITIZER_ANDROID
++#if SANITIZER_ANDROID || SANITIZER_NONGNU
+ // FIXME: should we do anything for Android?
+ void AsanCheckDynamicRTPrereqs() {}
+ void AsanCheckIncompatibleRT() {}
+diff --git a/lib/interception/interception_linux.cc b/lib/interception/interception_linux.cc
+index 26bfcd8f6..529b234f7 100644
+--- a/lib/interception/interception_linux.cc
++++ b/lib/interception/interception_linux.cc
+@@ -43,7 +43,7 @@ bool GetRealFunctionAddress(const char *func_name, uptr *func_addr,
+ }
+ 
+ // Android and Solaris do not have dlvsym
+-#if !SANITIZER_ANDROID && !SANITIZER_SOLARIS && !SANITIZER_OPENBSD
++#if !SANITIZER_ANDROID && !SANITIZER_SOLARIS && !SANITIZER_OPENBSD && !SANITIZER_NONGNU
+ void *GetFuncAddrVer(const char *func_name, const char *ver) {
+   return dlvsym(RTLD_NEXT, func_name, ver);
+ }
+diff --git a/lib/interception/interception_linux.h b/lib/interception/interception_linux.h
+index 942c25609..24a4d5080 100644
+--- a/lib/interception/interception_linux.h
++++ b/lib/interception/interception_linux.h
+@@ -36,7 +36,7 @@ void *GetFuncAddrVer(const char *func_name, const char *ver);
+       (::__interception::uptr) & WRAP(func))
+ 
+ // Android,  Solaris and OpenBSD do not have dlvsym
+-#if !SANITIZER_ANDROID && !SANITIZER_SOLARIS && !SANITIZER_OPENBSD
++#if !SANITIZER_ANDROID && !SANITIZER_SOLARIS && !SANITIZER_OPENBSD && !SANITIZER_NONGNU
+ #define INTERCEPT_FUNCTION_VER_LINUX_OR_FREEBSD(func, symver) \
+   (::__interception::real_##func = (func##_f)(                \
+        unsigned long)::__interception::GetFuncAddrVer(#func, symver))
+diff --git a/lib/msan/msan_linux.cc b/lib/msan/msan_linux.cc
+index 385a650c4..6e30a8ce9 100644
+--- a/lib/msan/msan_linux.cc
++++ b/lib/msan/msan_linux.cc
+@@ -13,7 +13,7 @@
+ //===----------------------------------------------------------------------===//
+ 
+ #include "sanitizer_common/sanitizer_platform.h"
+-#if SANITIZER_FREEBSD || SANITIZER_LINUX || SANITIZER_NETBSD
++#if SANITIZER_FREEBSD || (SANITIZER_LINUX && !SANITIZER_NONGNU) || SANITIZER_NETBSD
+ 
+ #include "msan.h"
+ #include "msan_report.h"
+diff --git a/lib/sanitizer_common/sanitizer_allocator.cc b/lib/sanitizer_common/sanitizer_allocator.cc
+index 6bfd5e5ee..048f6154f 100644
+--- a/lib/sanitizer_common/sanitizer_allocator.cc
++++ b/lib/sanitizer_common/sanitizer_allocator.cc
+@@ -27,7 +27,7 @@ const char *SecondaryAllocatorName = "LargeMmapAllocator";
+ 
+ // ThreadSanitizer for Go uses libc malloc/free.
+ #if SANITIZER_GO || defined(SANITIZER_USE_MALLOC)
+-# if SANITIZER_LINUX && !SANITIZER_ANDROID
++# if SANITIZER_LINUX && !SANITIZER_ANDROID && !SANITIZER_NONGNU
+ extern "C" void *__libc_malloc(uptr size);
+ #  if !SANITIZER_GO
+ extern "C" void *__libc_memalign(uptr alignment, uptr size);
+diff --git a/lib/sanitizer_common/sanitizer_common_interceptors_ioctl.inc b/lib/sanitizer_common/sanitizer_common_interceptors_ioctl.inc
+index 2d633c173..b6eb23116 100644
+--- a/lib/sanitizer_common/sanitizer_common_interceptors_ioctl.inc
++++ b/lib/sanitizer_common/sanitizer_common_interceptors_ioctl.inc
+@@ -104,7 +104,7 @@ static void ioctl_table_fill() {
+   _(SIOCGETVIFCNT, WRITE, struct_sioc_vif_req_sz);
+ #endif
+ 
+-#if SANITIZER_LINUX
++#if SANITIZER_LINUX && !SANITIZER_NONGNU
+   // Conflicting request ids.
+   // _(CDROMAUDIOBUFSIZ, NONE, 0);
+   // _(SNDCTL_TMR_CONTINUE, NONE, 0);
+@@ -365,7 +365,7 @@ static void ioctl_table_fill() {
+   _(VT_WAITACTIVE, NONE, 0);
+ #endif
+ 
+-#if SANITIZER_LINUX && !SANITIZER_ANDROID
++#if SANITIZER_LINUX && !SANITIZER_ANDROID && !SANITIZER_NONGNU
+   // _(SIOCDEVPLIP, WRITE, struct_ifreq_sz); // the same as EQL_ENSLAVE
+   _(CYGETDEFTHRESH, WRITE, sizeof(int));
+   _(CYGETDEFTIMEOUT, WRITE, sizeof(int));
+diff --git a/lib/sanitizer_common/sanitizer_common_syscalls.inc b/lib/sanitizer_common/sanitizer_common_syscalls.inc
+index 469c8eb7e..24f87867d 100644
+--- a/lib/sanitizer_common/sanitizer_common_syscalls.inc
++++ b/lib/sanitizer_common/sanitizer_common_syscalls.inc
+@@ -2038,7 +2038,7 @@ POST_SYSCALL(setrlimit)(long res, long resource, void *rlim) {
+   }
+ }
+ 
+-#if !SANITIZER_ANDROID
++#if !SANITIZER_ANDROID && !SANITIZER_NONGNU
+ PRE_SYSCALL(prlimit64)(long pid, long resource, const void *new_rlim,
+                        void *old_rlim) {
+   if (new_rlim) PRE_READ(new_rlim, struct_rlimit64_sz);
+diff --git a/lib/sanitizer_common/sanitizer_linux.cc b/lib/sanitizer_common/sanitizer_linux.cc
+index 96d6c1eff..9e2b7fb9d 100644
+--- a/lib/sanitizer_common/sanitizer_linux.cc
++++ b/lib/sanitizer_common/sanitizer_linux.cc
+@@ -541,13 +541,13 @@ const char *GetEnv(const char *name) {
+ #endif
+ }
+ 
+-#if !SANITIZER_FREEBSD && !SANITIZER_NETBSD && !SANITIZER_OPENBSD
++#if !SANITIZER_FREEBSD && !SANITIZER_NETBSD && !SANITIZER_OPENBSD && !SANITIZER_NONGNU
+ extern "C" {
+ SANITIZER_WEAK_ATTRIBUTE extern void *__libc_stack_end;
+ }
+ #endif
+ 
+-#if !SANITIZER_GO && !SANITIZER_FREEBSD && !SANITIZER_NETBSD &&                \
++#if (!SANITIZER_GO || SANITIZER_NONGNU) && !SANITIZER_FREEBSD && !SANITIZER_NETBSD &&                \
+     !SANITIZER_OPENBSD
+ static void ReadNullSepFileToArray(const char *path, char ***arr,
+                                    int arr_size) {
+@@ -590,6 +590,10 @@ static void GetArgsAndEnv(char ***argv, char ***envp) {
+ #elif SANITIZER_NETBSD
+   *argv = __ps_strings->ps_argvstr;
+   *envp = __ps_strings->ps_envstr;
++#elif SANITIZER_NONGNU
++    static const int kMaxArgv = 2000, kMaxEnvp = 2000;
++    ReadNullSepFileToArray("/proc/self/cmdline", argv, kMaxArgv);
++    ReadNullSepFileToArray("/proc/self/environ", envp, kMaxEnvp);
+ #else // SANITIZER_FREEBSD
+ #if !SANITIZER_GO
+   if (&__libc_stack_end) {
+diff --git a/lib/sanitizer_common/sanitizer_linux_libcdep.cc b/lib/sanitizer_common/sanitizer_linux_libcdep.cc
+index 4962ff832..438f94dbe 100644
+--- a/lib/sanitizer_common/sanitizer_linux_libcdep.cc
++++ b/lib/sanitizer_common/sanitizer_linux_libcdep.cc
+@@ -179,7 +179,7 @@ __attribute__((unused)) static bool GetLibcVersion(int *major, int *minor,
+ }
+ 
+ #if !SANITIZER_FREEBSD && !SANITIZER_ANDROID && !SANITIZER_GO &&               \
+-    !SANITIZER_NETBSD && !SANITIZER_OPENBSD && !SANITIZER_SOLARIS
++    !SANITIZER_NETBSD && !SANITIZER_OPENBSD && !SANITIZER_SOLARIS && !SANITIZER_NONGNU
+ static uptr g_tls_size;
+ 
+ #ifdef __i386__
+@@ -261,7 +261,7 @@ void InitTlsSize() { }
+ #if (defined(__x86_64__) || defined(__i386__) || defined(__mips__) ||          \
+      defined(__aarch64__) || defined(__powerpc64__) || defined(__s390__) ||    \
+      defined(__arm__)) &&                                                      \
+-    SANITIZER_LINUX && !SANITIZER_ANDROID
++    SANITIZER_LINUX && !SANITIZER_ANDROID && !SANITIZER_NONGNU
+ // sizeof(struct pthread) from glibc.
+ static atomic_uintptr_t thread_descriptor_size;
+ 
+@@ -426,7 +426,7 @@ int GetSizeFromHdr(struct dl_phdr_info *info, size_t size, void *data) {
+ 
+ #if !SANITIZER_GO
+ static void GetTls(uptr *addr, uptr *size) {
+-#if SANITIZER_LINUX && !SANITIZER_ANDROID
++#if SANITIZER_LINUX && !SANITIZER_ANDROID && !SANITIZER_NONGNU
+ # if defined(__x86_64__) || defined(__i386__) || defined(__s390__)
+   *addr = ThreadSelf();
+   *size = GetTlsSize();
+@@ -470,7 +470,7 @@ static void GetTls(uptr *addr, uptr *size) {
+ #elif SANITIZER_OPENBSD
+   *addr = 0;
+   *size = 0;
+-#elif SANITIZER_ANDROID
++#elif SANITIZER_ANDROID || SANITIZER_NONGNU
+   *addr = 0;
+   *size = 0;
+ #elif SANITIZER_SOLARIS
+@@ -486,7 +486,7 @@ static void GetTls(uptr *addr, uptr *size) {
+ #if !SANITIZER_GO
+ uptr GetTlsSize() {
+ #if SANITIZER_FREEBSD || SANITIZER_ANDROID || SANITIZER_NETBSD ||              \
+-    SANITIZER_OPENBSD || SANITIZER_SOLARIS
++    SANITIZER_OPENBSD || SANITIZER_SOLARIS || SANITIZER_NONGNU
+   uptr addr, size;
+   GetTls(&addr, &size);
+   return size;
+diff --git a/lib/sanitizer_common/sanitizer_platform.h b/lib/sanitizer_common/sanitizer_platform.h
+index d81e25580..e10680ac8 100644
+--- a/lib/sanitizer_common/sanitizer_platform.h
++++ b/lib/sanitizer_common/sanitizer_platform.h
+@@ -208,6 +208,12 @@
+ # define SANITIZER_SOLARIS32 0
+ #endif
+ 
++#if defined(__linux__) && !defined(__GLIBC__)
++# define SANITIZER_NONGNU 1
++#else
++# define SANITIZER_NONGNU 0
++#endif
++
+ #if defined(__myriad2__)
+ # define SANITIZER_MYRIAD2 1
+ #else
+diff --git a/lib/sanitizer_common/sanitizer_platform_interceptors.h b/lib/sanitizer_common/sanitizer_platform_interceptors.h
+index f95539a73..6c53b3415 100644
+--- a/lib/sanitizer_common/sanitizer_platform_interceptors.h
++++ b/lib/sanitizer_common/sanitizer_platform_interceptors.h
+@@ -39,7 +39,7 @@
+ # include "sanitizer_platform_limits_solaris.h"
+ #endif
+ 
+-#if SANITIZER_LINUX && !SANITIZER_ANDROID
++#if SANITIZER_LINUX && !SANITIZER_ANDROID && !SANITIZER_NONGNU
+ # define SI_LINUX_NOT_ANDROID 1
+ #else
+ # define SI_LINUX_NOT_ANDROID 0
+@@ -322,7 +322,7 @@
+ #define SANITIZER_INTERCEPT_ETHER_R (SI_FREEBSD || SI_LINUX_NOT_ANDROID)
+ #define SANITIZER_INTERCEPT_SHMCTL          \
+   (SI_NETBSD || SI_OPENBSD || SI_SOLARIS || \
+-  ((SI_FREEBSD || SI_LINUX_NOT_ANDROID) && \
++  ((SI_FREEBSD || SI_LINUX_NOT_ANDROID || SANITIZER_NONGNU) && \
+     SANITIZER_WORDSIZE == 64))  // NOLINT
+ #define SANITIZER_INTERCEPT_RANDOM_R SI_LINUX_NOT_ANDROID
+ #define SANITIZER_INTERCEPT_PTHREAD_ATTR_GET SI_POSIX
+diff --git a/lib/sanitizer_common/sanitizer_platform_limits_posix.cc b/lib/sanitizer_common/sanitizer_platform_limits_posix.cc
+index 54da635d7..2f6ff69c3 100644
+--- a/lib/sanitizer_common/sanitizer_platform_limits_posix.cc
++++ b/lib/sanitizer_common/sanitizer_platform_limits_posix.cc
+@@ -14,6 +14,9 @@
+ 
+ #include "sanitizer_platform.h"
+ 
++// Workaround musl <--> linux conflicting definition of 'struct sysinfo'
++#define _LINUX_SYSINFO_H
++
+ #if SANITIZER_LINUX || SANITIZER_FREEBSD || SANITIZER_MAC
+ // Tests in this file assume that off_t-dependent data structures match the
+ // libc ABI. For example, struct dirent here is what readdir() function (as
+@@ -138,12 +141,14 @@ typedef struct user_fpregs elf_fpregset_t;
+ 
+ #if SANITIZER_LINUX && !SANITIZER_ANDROID
+ #include <glob.h>
+-#include <obstack.h>
++#  if !SANITIZER_NONGNU
++#    include <obstack.h>
++#  endif
+ #include <mqueue.h>
+-#include <net/if_ppp.h>
+-#include <netax25/ax25.h>
+-#include <netipx/ipx.h>
+-#include <netrom/netrom.h>
++#include <linux/if_ppp.h>
++#include <linux/ax25.h>
++#include <linux/ipx.h>
++#include <linux/netrom.h>
+ #if HAVE_RPC_XDR_H
+ # include <rpc/xdr.h>
+ #elif HAVE_TIRPC_RPC_XDR_H
+@@ -251,7 +256,7 @@ namespace __sanitizer {
+   unsigned struct_itimerspec_sz = sizeof(struct itimerspec);
+ #endif // SANITIZER_LINUX || SANITIZER_FREEBSD
+ 
+-#if SANITIZER_LINUX && !SANITIZER_ANDROID
++#if SANITIZER_LINUX && !SANITIZER_ANDROID && !SANITIZER_NONGNU
+   // Use pre-computed size of struct ustat to avoid <sys/ustat.h> which
+   // has been removed from glibc 2.28.
+ #if defined(__aarch64__) || defined(__s390x__) || defined (__mips64) \
+@@ -322,7 +327,7 @@ unsigned struct_ElfW_Phdr_sz = sizeof(ElfW(Phdr));
+ unsigned struct_ElfW_Phdr_sz = sizeof(Elf_Phdr);
+ #endif
+ 
+-#if (SANITIZER_LINUX || SANITIZER_FREEBSD) && !SANITIZER_ANDROID
++#if (SANITIZER_LINUX || SANITIZER_FREEBSD) && !SANITIZER_ANDROID && !SANITIZER_NONGNU
+   int glob_nomatch = GLOB_NOMATCH;
+   int glob_altdirfunc = GLOB_ALTDIRFUNC;
+ #endif
+@@ -416,7 +421,7 @@ unsigned struct_ElfW_Phdr_sz = sizeof(Elf_Phdr);
+   unsigned struct_termios_sz = sizeof(struct termios);
+   unsigned struct_winsize_sz = sizeof(struct winsize);
+ 
+-#if SANITIZER_LINUX
++#if SANITIZER_LINUX && !SANITIZER_NONGNU
+   unsigned struct_arpreq_sz = sizeof(struct arpreq);
+   unsigned struct_cdrom_msf_sz = sizeof(struct cdrom_msf);
+   unsigned struct_cdrom_multisession_sz = sizeof(struct cdrom_multisession);
+@@ -466,7 +471,7 @@ unsigned struct_ElfW_Phdr_sz = sizeof(Elf_Phdr);
+   unsigned struct_vt_mode_sz = sizeof(struct vt_mode);
+ #endif // SANITIZER_LINUX || SANITIZER_FREEBSD
+ 
+-#if SANITIZER_LINUX && !SANITIZER_ANDROID
++#if SANITIZER_LINUX && !SANITIZER_ANDROID && !SANITIZER_NONGNU
+   unsigned struct_ax25_parms_struct_sz = sizeof(struct ax25_parms_struct);
+   unsigned struct_cyclades_monitor_sz = sizeof(struct cyclades_monitor);
+ #if EV_VERSION > (0x010000)
+@@ -834,7 +839,7 @@ unsigned struct_ElfW_Phdr_sz = sizeof(Elf_Phdr);
+   unsigned IOCTL_VT_WAITACTIVE = VT_WAITACTIVE;
+ #endif // SANITIZER_LINUX || SANITIZER_FREEBSD
+ 
+-#if SANITIZER_LINUX && !SANITIZER_ANDROID
++#if SANITIZER_LINUX && !SANITIZER_ANDROID && !SANITIZER_NONGNU
+   unsigned IOCTL_CYGETDEFTHRESH = CYGETDEFTHRESH;
+   unsigned IOCTL_CYGETDEFTIMEOUT = CYGETDEFTIMEOUT;
+   unsigned IOCTL_CYGETMON = CYGETMON;
+@@ -989,7 +994,7 @@ CHECK_SIZE_AND_OFFSET(dl_phdr_info, dlpi_phdr);
+ CHECK_SIZE_AND_OFFSET(dl_phdr_info, dlpi_phnum);
+ #endif // SANITIZER_LINUX || SANITIZER_FREEBSD
+ 
+-#if (SANITIZER_LINUX || SANITIZER_FREEBSD) && !SANITIZER_ANDROID
++#if (SANITIZER_LINUX || SANITIZER_FREEBSD) && !SANITIZER_ANDROID && !SANITIZER_NONGNU
+ CHECK_TYPE_SIZE(glob_t);
+ CHECK_SIZE_AND_OFFSET(glob_t, gl_pathc);
+ CHECK_SIZE_AND_OFFSET(glob_t, gl_pathv);
+@@ -1023,6 +1028,7 @@ CHECK_TYPE_SIZE(iovec);
+ CHECK_SIZE_AND_OFFSET(iovec, iov_base);
+ CHECK_SIZE_AND_OFFSET(iovec, iov_len);
+ 
++#if !SANITIZER_NONGNU
+ CHECK_TYPE_SIZE(msghdr);
+ CHECK_SIZE_AND_OFFSET(msghdr, msg_name);
+ CHECK_SIZE_AND_OFFSET(msghdr, msg_namelen);
+@@ -1036,6 +1042,7 @@ CHECK_TYPE_SIZE(cmsghdr);
+ CHECK_SIZE_AND_OFFSET(cmsghdr, cmsg_len);
+ CHECK_SIZE_AND_OFFSET(cmsghdr, cmsg_level);
+ CHECK_SIZE_AND_OFFSET(cmsghdr, cmsg_type);
++#endif
+ 
+ #ifndef __GLIBC_PREREQ
+ #define __GLIBC_PREREQ(x, y) 0
+@@ -1145,7 +1152,7 @@ CHECK_SIZE_AND_OFFSET(mntent, mnt_passno);
+ 
+ CHECK_TYPE_SIZE(ether_addr);
+ 
+-#if (SANITIZER_LINUX || SANITIZER_FREEBSD) && !SANITIZER_ANDROID
++#if (SANITIZER_LINUX || SANITIZER_FREEBSD) && !SANITIZER_ANDROID && !SANITIZER_NONGNU
+ CHECK_TYPE_SIZE(ipc_perm);
+ # if SANITIZER_FREEBSD
+ CHECK_SIZE_AND_OFFSET(ipc_perm, key);
+@@ -1206,7 +1213,7 @@ CHECK_SIZE_AND_OFFSET(ifaddrs, ifa_dstaddr);
+ CHECK_SIZE_AND_OFFSET(ifaddrs, ifa_data);
+ #endif
+ 
+-#if SANITIZER_LINUX
++#if SANITIZER_LINUX && !SANITIZER_NONGNU
+ COMPILER_CHECK(sizeof(__sanitizer_mallinfo) == sizeof(struct mallinfo));
+ #endif
+ 
+@@ -1256,7 +1263,7 @@ COMPILER_CHECK(__sanitizer_XDR_DECODE == XDR_DECODE);
+ COMPILER_CHECK(__sanitizer_XDR_FREE == XDR_FREE);
+ #endif
+ 
+-#if SANITIZER_LINUX && !SANITIZER_ANDROID
++#if SANITIZER_LINUX && !SANITIZER_ANDROID && !SANITIZER_NONGNU
+ COMPILER_CHECK(sizeof(__sanitizer_FILE) <= sizeof(FILE));
+ CHECK_SIZE_AND_OFFSET(FILE, _flags);
+ CHECK_SIZE_AND_OFFSET(FILE, _IO_read_ptr);
+@@ -1275,7 +1282,7 @@ CHECK_SIZE_AND_OFFSET(FILE, _chain);
+ CHECK_SIZE_AND_OFFSET(FILE, _fileno);
+ #endif
+ 
+-#if SANITIZER_LINUX && !SANITIZER_ANDROID
++#if SANITIZER_LINUX && !SANITIZER_ANDROID && !SANITIZER_NONGNU
+ COMPILER_CHECK(sizeof(__sanitizer__obstack_chunk) <= sizeof(_obstack_chunk));
+ CHECK_SIZE_AND_OFFSET(_obstack_chunk, limit);
+ CHECK_SIZE_AND_OFFSET(_obstack_chunk, prev);
+diff --git a/lib/tsan/rtl/tsan_platform_linux.cc b/lib/tsan/rtl/tsan_platform_linux.cc
+index de989b780..51a97b554 100644
+--- a/lib/tsan/rtl/tsan_platform_linux.cc
++++ b/lib/tsan/rtl/tsan_platform_linux.cc
+@@ -294,7 +294,7 @@ void InitializePlatform() {
+ // This is required to properly "close" the fds, because we do not see internal
+ // closes within glibc. The code is a pure hack.
+ int ExtractResolvFDs(void *state, int *fds, int nfd) {
+-#if SANITIZER_LINUX && !SANITIZER_ANDROID
++#if SANITIZER_LINUX && !SANITIZER_ANDROID && !SANITIZER_NONGNU
+   int cnt = 0;
+   struct __res_state *statp = (struct __res_state*)state;
+   for (int i = 0; i < MAXNS && cnt < nfd; i++) {
+-- 
+2.19.0
+
diff --git a/pkgs/development/compilers/llvm/update.sh b/pkgs/development/compilers/llvm/update.sh
new file mode 100755
index 000000000000..8f28d34073cd
--- /dev/null
+++ b/pkgs/development/compilers/llvm/update.sh
@@ -0,0 +1,44 @@
+#!/usr/bin/env bash
+
+set -eu
+
+# Example usage: ./pkgs/development/compilers/llvm/update.sh 12.0.0-rc4
+
+readonly VERSION="$1"
+readonly VERSION_MAJOR="${VERSION%%.*}"
+readonly VERSION_MAIN="${VERSION%%-*}"
+declare VERSION_PATCH="${VERSION/$VERSION_MAIN/}"
+readonly VERSION_PATCH="${VERSION_PATCH/-/}"
+
+readonly DIR="pkgs/development/compilers/llvm/$VERSION_MAJOR"
+readonly FILE="$DIR/default.nix"
+
+sed -Ei \
+  -e "s/release_version = \".+\";/release_version = \"$VERSION_MAIN\";/" \
+  -e "s/candidate = \".*\";/candidate = \"$VERSION_PATCH\";/" \
+  "$FILE"
+
+readonly ATTRSET="llvmPackages_$VERSION_MAJOR"
+readonly SOURCES=(
+  "clang-unwrapped.src"
+  "compiler-rt.src"
+  "clang-unwrapped.clang-tools-extra_src"
+  "libcxx.src"
+  "libcxxabi.src"
+  "libunwind.src"
+  "lld.src"
+  "lldb.src"
+  "llvm.src"
+  "llvm.polly_src"
+  "openmp.src"
+)
+
+for SOURCE in "${SOURCES[@]}"; do
+  echo "Updating the hash of $SOURCE:"
+  declare ATTR="$ATTRSET.$SOURCE"
+  declare OLD_HASH="$(nix eval -f . $ATTR.outputHash)"
+  declare NEW_HASH="\"$(nix-prefetch-url -A $ATTR)\""
+  find "$DIR" -type f -exec sed -i "s/$OLD_HASH/$NEW_HASH/" {} +
+done
+
+echo OK
diff --git a/pkgs/development/interpreters/dart/default.nix b/pkgs/development/interpreters/dart/default.nix
index 5fb180201b96..685d58f11027 100644
--- a/pkgs/development/interpreters/dart/default.nix
+++ b/pkgs/development/interpreters/dart/default.nix
@@ -2,7 +2,7 @@
 , lib
 , fetchurl
 , unzip
-, version ? "2.10.5"
+, version ? "2.12.2"
 , sources ?
   let
     base = "https://storage.googleapis.com/dart-archive/channels";
@@ -11,24 +11,24 @@
     aarch64 = "arm64";
     # Make sure that if the user overrides version parameter they're
     # also need to override sources, to avoid mistakes
-    version = "2.10.5";
+    version = "2.12.2";
   in
   {
     "${version}-x86_64-darwin" = fetchurl {
       url = "${base}/stable/release/${version}/sdk/dartsdk-macos-${x86_64}-release.zip";
-      sha256 = "1vb2m25w6v901id9syan9q69fa60sxxd7qpyzq21fn5dpah0g99i";
+      sha256 = "0h6mpy0kfc842vhg053fyxbjnd8lw1d1shdcsj800048260lxhyd";
     };
     "${version}-x86_64-linux" = fetchurl {
       url = "${base}/stable/release/${version}/sdk/dartsdk-linux-${x86_64}-release.zip";
-      sha256 = "1mb6m3vxjya1dz47mdna23c2015n3bz8dvz8fwggq6k3zp0a4dsh";
+      sha256 = "1gg210gf4yif3bl9k19znkndc4c1cd529xwxpi20ykaw3zfxxz2z";
     };
     "${version}-i686-linux" = fetchurl {
       url = "${base}/stable/release/${version}/sdk/dartsdk-linux-${i686}-release.zip";
-      sha256 = "10g4qrwvmabrdg4i8y0wq9g7whqcpkdfp05yilflg70ybplrscf7";
+      sha256 = "1wngxba71j20gq9vy7n8q0m9rnqs047xm5b03bxk3hhaq6dyzkwn";
     };
     "${version}-aarch64-linux" = fetchurl {
       url = "${base}/stable/release/${version}/sdk/dartsdk-linux-${aarch64}-release.zip";
-      sha256 = "0js83wy496swcwia144fhxk872irb5nr6i8558hxabkdrpv1bky5";
+      sha256 = "0rqsmzl5g5kgk54qb03kamjm5n5g5pqfl79np37xdzwqbv0zx22b";
     };
   }
 }:
diff --git a/pkgs/development/libraries/mustache-hpp/default.nix b/pkgs/development/libraries/mustache-hpp/default.nix
new file mode 100644
index 000000000000..373f232a9866
--- /dev/null
+++ b/pkgs/development/libraries/mustache-hpp/default.nix
@@ -0,0 +1,26 @@
+{ lib, stdenv, fetchFromGitHub, cmake }:
+
+stdenv.mkDerivation rec {
+  pname = "mustache";
+  version = "4.1";
+
+  src = fetchFromGitHub {
+    owner = "kainjow";
+    repo = "Mustache";
+    rev = "v${version}";
+    sha256 = "0r9rbk6v1wpld2ismfsk2lkhbyv3dkf0p03hkjivbj05qkfhvlbb";
+  };
+
+  nativeBuildInputs = [ cmake ];
+
+  installPhase = ''
+    mkdir -p $out/include
+    cp ../mustache.hpp $out/include
+  '';
+
+  meta = with lib; {
+    description = "Mustache text templates for modern C++";
+    homepage = "https://github.com/kainjow/Mustache";
+    license = licenses.boost;
+  };
+}
diff --git a/pkgs/development/libraries/zimlib/default.nix b/pkgs/development/libraries/zimlib/default.nix
index 6dc998cd0e27..76d54ed62563 100644
--- a/pkgs/development/libraries/zimlib/default.nix
+++ b/pkgs/development/libraries/zimlib/default.nix
@@ -1,23 +1,55 @@
-{ lib, stdenv, fetchurl, lzma }:
+{ lib, stdenv, fetchFromGitHub
+, meson, ninja, pkg-config
+, python3
+, icu
+, libuuid
+, xapian
+, xz
+, zstd
+, gtest
+}:
 
 stdenv.mkDerivation rec {
   pname = "zimlib";
-  version = "1.4";
+  version = "6.3.0";
 
-  src = fetchurl {
-    url = "http://www.openzim.org/download/${pname}-${version}.tar.gz";
-    sha256 = "14ra3iq42x53k1nqxb5lsg4gadlkpkgv6cbjjl6305ajmbrghcdq";
+  src = fetchFromGitHub {
+    owner = "openzim";
+    repo = "libzim";
+    rev = version;
+    sha256 = "0iy0f1clhihq277x218ccx3mszgpr3h9l0by48b9ykr115nffw3s";
   };
 
-  buildInputs = [ lzma ];
+  nativeBuildInputs = [
+    meson
+    pkg-config
+    ninja
+    python3
+  ];
 
-  enableParallelBuilding = true;
+  propagatedBuildInputs = [
+    icu
+    libuuid
+    xapian
+    xz
+    zstd
+  ];
+
+  postPatch = ''
+    patchShebangs scripts
+  '';
+
+  checkInputs = [
+    gtest
+  ];
+
+  doCheck = true;
 
   meta = with lib; {
     description = "Library for reading and writing ZIM files";
     homepage =  "https://www.openzim.org/wiki/Zimlib";
     license = licenses.gpl2;
-    maintainers = with maintainers; [ robbinch ];
+    maintainers = with maintainers; [ ajs124 ];
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/development/ocaml-modules/bigstring/default.nix b/pkgs/development/ocaml-modules/bigstring/default.nix
index 98687262c33b..f966e0b90b1b 100644
--- a/pkgs/development/ocaml-modules/bigstring/default.nix
+++ b/pkgs/development/ocaml-modules/bigstring/default.nix
@@ -2,7 +2,9 @@
 
 buildDunePackage rec {
   pname = "bigstring";
-  version = "0.2";
+  version = "0.3";
+
+  useDune2 = true;
 
   minimumOCamlVersion = "4.03";
 
@@ -10,10 +12,11 @@ buildDunePackage rec {
     owner = "c-cube";
     repo = "ocaml-bigstring";
     rev = version;
-    sha256 = "0ypdf29cmwmjm3djr5ygz8ls81dl41a4iz1xx5gbcdpbrdiapb77";
+    sha256 = "0bkxwdcswy80f6rmx5wjza92xzq4rdqsb4a9fm8aav8bdqx021n8";
   };
 
-  doCheck = true;
+  # Circular dependency with bigstring-unix
+  doCheck = false;
 
   meta = with lib; {
     homepage = "https://github.com/c-cube/ocaml-bigstring";
diff --git a/pkgs/development/ocaml-modules/cpu/default.nix b/pkgs/development/ocaml-modules/cpu/default.nix
index 083f00d5d5f1..33702ca18296 100644
--- a/pkgs/development/ocaml-modules/cpu/default.nix
+++ b/pkgs/development/ocaml-modules/cpu/default.nix
@@ -4,6 +4,8 @@ buildDunePackage rec {
   pname = "cpu";
   version = "2.0.0";
 
+  useDune2 = true;
+
   src = fetchFromGitHub {
     owner = "UnixJunkie";
     repo   = pname;
diff --git a/pkgs/development/ocaml-modules/crowbar/default.nix b/pkgs/development/ocaml-modules/crowbar/default.nix
index d05d15286bf7..e114e7d8433a 100644
--- a/pkgs/development/ocaml-modules/crowbar/default.nix
+++ b/pkgs/development/ocaml-modules/crowbar/default.nix
@@ -5,6 +5,8 @@ buildDunePackage rec {
   pname = "crowbar";
   version = "0.2";
 
+  useDune2 = true;
+
   src = fetchFromGitHub {
     owner  = "stedolan";
     repo   = pname;
diff --git a/pkgs/development/ocaml-modules/dtoa/default.nix b/pkgs/development/ocaml-modules/dtoa/default.nix
index 62fa7cd08c8b..da075f5c7982 100644
--- a/pkgs/development/ocaml-modules/dtoa/default.nix
+++ b/pkgs/development/ocaml-modules/dtoa/default.nix
@@ -4,6 +4,8 @@ buildDunePackage rec {
   pname = "dtoa";
   version = "0.3.2";
 
+  useDune2 = true;
+
   minimumOCamlVersion = "4.02";
 
   src = fetchurl {
diff --git a/pkgs/development/ocaml-modules/hidapi/default.nix b/pkgs/development/ocaml-modules/hidapi/default.nix
index cd95b34fa2bd..0de997881c2c 100644
--- a/pkgs/development/ocaml-modules/hidapi/default.nix
+++ b/pkgs/development/ocaml-modules/hidapi/default.nix
@@ -1,4 +1,4 @@
-{ pkgs, lib, fetchurl, buildDunePackage, pkg-config
+{ pkgs, lib, fetchurl, buildDunePackage, pkg-config, dune-configurator
 , bigstring,
 }:
 
@@ -6,6 +6,8 @@ buildDunePackage rec {
   pname = "hidapi";
   version = "1.1.1";
 
+  useDune2 = true;
+
   src = fetchurl {
     url = "https://github.com/vbmithr/ocaml-hidapi/releases/download/${version}/${pname}-${version}.tbz";
     sha256 = "1j7rd7ajrzla76r3sxljx6fb18f4f4s3jd7vhv59l2ilxyxycai2";
@@ -13,7 +15,7 @@ buildDunePackage rec {
 
   minimumOCamlVersion = "4.03";
 
-  buildInputs = [ pkgs.hidapi pkg-config ];
+  buildInputs = [ pkgs.hidapi pkg-config dune-configurator ];
   propagatedBuildInputs = [ bigstring ];
 
   doCheck = true;
diff --git a/pkgs/development/ocaml-modules/parany/default.nix b/pkgs/development/ocaml-modules/parany/default.nix
index afe9e7d39b57..a4378016b47c 100644
--- a/pkgs/development/ocaml-modules/parany/default.nix
+++ b/pkgs/development/ocaml-modules/parany/default.nix
@@ -4,6 +4,8 @@ buildDunePackage rec {
   pname = "parany";
   version = "8.0.0";
 
+  useDune2 = true;
+
   src = fetchFromGitHub {
     owner = "UnixJunkie";
     repo   = pname;
diff --git a/pkgs/development/python-modules/mcstatus/default.nix b/pkgs/development/python-modules/mcstatus/default.nix
index f8ddac600a69..7ed7a0ff328b 100644
--- a/pkgs/development/python-modules/mcstatus/default.nix
+++ b/pkgs/development/python-modules/mcstatus/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "mcstatus";
-  version = "5.1.1";
+  version = "5.1.2";
   disabled = pythonOlder "3.6";
 
   src = fetchFromGitHub {
     owner = "Dinnerbone";
     repo = pname;
     rev = "release-${version}";
-    sha256 = "1a3qrl6w76ayqkl1knaz5ai0brrzpjfdk33lyb1n1p7gnc73nhlr";
+    sha256 = "16k5vcqpd9r7mm1cg9khzba42rcxs491h8gk2klymav249yzrwk7";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/solax/default.nix b/pkgs/development/python-modules/solax/default.nix
index bce0bc74f912..a5ca45627164 100644
--- a/pkgs/development/python-modules/solax/default.nix
+++ b/pkgs/development/python-modules/solax/default.nix
@@ -12,11 +12,11 @@
 
 buildPythonPackage rec {
   pname = "solax";
-  version = "0.2.5";
+  version = "0.2.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0h7q6y2cdkj9dqxw0k7pgz7a7vbpq1qw50pmy9rajphhv2600cbc";
+    sha256 = "sha256-3WhJBBnIl6C0AdEsmSX3ZEVDThzCBguS4UUri80ifGg=";
   };
 
   nativeBuildInputs = [ setuptools-scm ];
diff --git a/pkgs/development/python-modules/vsure/default.nix b/pkgs/development/python-modules/vsure/default.nix
index bd592d686826..4928c2adc40c 100644
--- a/pkgs/development/python-modules/vsure/default.nix
+++ b/pkgs/development/python-modules/vsure/default.nix
@@ -6,11 +6,11 @@
 
 buildPythonPackage rec {
   pname = "vsure";
-  version = "1.7.3";
+  version = "1.8.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-tnUL9krKHqHR79EROsmVflCy9uO1n0iV6evQc/YpxnM=";
+    sha256 = "sha256-Zh83t7yjZU2NjOgCkqPUHbqvEyEWXGITRgr5d2fLtRI=";
   };
 
   propagatedBuildInputs = [ requests ];
diff --git a/pkgs/development/tools/hover/default.nix b/pkgs/development/tools/hover/default.nix
index 81661dce8b40..d3e72811db8b 100644
--- a/pkgs/development/tools/hover/default.nix
+++ b/pkgs/development/tools/hover/default.nix
@@ -18,7 +18,7 @@
 
 let
   pname = "hover";
-  version = "0.46.2";
+  version = "0.46.3";
 
   libs = with xorg; [
     libX11.dev
@@ -46,13 +46,13 @@ let
 
     subPackages = [ "." ];
 
-    vendorSha256 = "0hdh4vwzvwlarjzg6pv9dp665r9px9yplfjpgyyfjyy5b9sxl795";
+    vendorSha256 = "sha256-qTBGmONlcFJcN+9bMZbVY+6kOQ97JmJWWvgmNeDWBL0=";
 
     src = fetchFromGitHub {
       rev = "v${version}";
       owner = "go-flutter-desktop";
       repo = pname;
-      sha256 = "1gmsv7hmj7zzfwbz50az3kvgzqvj0jn8i2pv7sjyl9dx1bavi5g3";
+      sha256 = "sha256-0qzbRzpqoZcAt3k52+omqZ3Fq1KdS++wPpQkBkG1p6o=";
     };
 
     nativeBuildInputs = [ addOpenGLRunpath makeWrapper ];
diff --git a/pkgs/development/tools/hover/fix-assets-path.patch b/pkgs/development/tools/hover/fix-assets-path.patch
index 27d49197e567..00b1900bf776 100644
--- a/pkgs/development/tools/hover/fix-assets-path.patch
+++ b/pkgs/development/tools/hover/fix-assets-path.patch
@@ -53,7 +53,7 @@ index cb75563..3822e80 100644
 -func ExecuteTemplateFromAssetsBox(boxed, to string, assetsBox *rice.Box, templateData interface{}) {
 -	templateString, err := assetsBox.String(boxed)
 +func ExecuteTemplateFromAssetsBox(boxed, to string, assetsBox string, templateData interface{}) {
-+	templateString, err := ioutil.ReadFile(boxed + "/" + boxed)
++	templateString, err := ioutil.ReadFile(assetsBox + "/" + boxed)
  	if err != nil {
  		log.Errorf("Failed to find template file: %v\n", err)
  		os.Exit(1)
diff --git a/pkgs/misc/vscode-extensions/ms-vsliveshare-vsliveshare/default.nix b/pkgs/misc/vscode-extensions/ms-vsliveshare-vsliveshare/default.nix
index 836b9cc2a2b9..a307ed57019d 100644
--- a/pkgs/misc/vscode-extensions/ms-vsliveshare-vsliveshare/default.nix
+++ b/pkgs/misc/vscode-extensions/ms-vsliveshare-vsliveshare/default.nix
@@ -38,8 +38,8 @@ in ((vscode-utils.override { stdenv = gccStdenv; }).buildVscodeMarketplaceExtens
   mktplcRef = {
     name = "vsliveshare";
     publisher = "ms-vsliveshare";
-    version = "1.0.3968";
-    sha256 = "1nmhkxrlg9blxcqh7a3hl0wc5mkk2p77mn228lvmcirpbk3acsx5";
+    version = "1.0.4070";
+    sha256 = "18dddaz5g0kbrmj9l9k0fivdj6p6y5a6iw24ikvzmypz8zql7gd5";
   };
 }).overrideAttrs({ nativeBuildInputs ? [], buildInputs ? [], ... }: {
   nativeBuildInputs = nativeBuildInputs ++ [
diff --git a/pkgs/servers/gemini/gmnisrv/default.nix b/pkgs/servers/gemini/gmnisrv/default.nix
new file mode 100644
index 000000000000..4a8e187561c4
--- /dev/null
+++ b/pkgs/servers/gemini/gmnisrv/default.nix
@@ -0,0 +1,25 @@
+{ stdenv, lib, fetchFromSourcehut, pkg-config, openssl, mime-types, scdoc }:
+
+stdenv.mkDerivation rec {
+  pname = "gmnisrv";
+  version = "unstable-2021-03-26";
+
+  src = fetchFromSourcehut {
+    owner = "~sircmpwn";
+    repo = "gmnisrv";
+    rev = "f23ec10a6d66c574bbf718c4b10f2cf91ea8daef";
+    sha256 = "1d9rjx0s092yfzjxd2yvzixhqgg883nlnmsysgp21w75n2as354n";
+  };
+
+  MIMEDB = "${mime-types}/etc/mime.types";
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [ openssl mime-types scdoc ];
+
+  meta = with lib; {
+    description = "A simple Gemini protocol server";
+    homepage = "https://git.sr.ht/~sircmpwn/gmnisrv";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ bsima jb55 ];
+    platforms = platforms.all;
+  };
+}
diff --git a/pkgs/servers/home-assistant/default.nix b/pkgs/servers/home-assistant/default.nix
index e667378af5b3..09ea7dae554f 100644
--- a/pkgs/servers/home-assistant/default.nix
+++ b/pkgs/servers/home-assistant/default.nix
@@ -257,6 +257,7 @@ in with py.pkgs; buildPythonApplication rec {
     "media_player"
     "media_source"
     "met"
+    "minecraft_server"
     "mobile_app"
     "modbus"
     "moon"
@@ -322,6 +323,7 @@ in with py.pkgs; buildPythonApplication rec {
     "upnp"
     "uptime"
     "vacuum"
+    "verisure"
     "weather"
     "webhook"
     "websocket_api"
diff --git a/pkgs/servers/ombi/default.nix b/pkgs/servers/ombi/default.nix
new file mode 100644
index 000000000000..bbad311eddaf
--- /dev/null
+++ b/pkgs/servers/ombi/default.nix
@@ -0,0 +1,66 @@
+{ lib, stdenv, fetchurl, makeWrapper, patchelf, openssl, libunwind, zlib, krb5, icu, nixosTests }:
+
+let
+  os = if stdenv.isDarwin then "osx" else "linux";
+  arch = {
+    x86_64-linux = "x64";
+    aarch64-linux = "arm64";
+    x86_64-darwin = "x64";
+  }."${stdenv.hostPlatform.system}" or (throw
+    "Unsupported system: ${stdenv.hostPlatform.system}");
+
+  hash = {
+    x64-linux_hash = "sha256-Cuvz9Mhwpg8RIaiSXib+QW00DM66qPRQulrchRL2BSk=";
+    arm64-linux_hash = "sha256-uyVwa73moHWMZScNNSOU17lALuK3PC/cvTZPJ9qg7JQ=";
+    x64-osx_hash = "sha256-FGXLsfEuCW94D786LJ/wvA9TakOn5sG2M1rDXPQicYw=";
+  }."${arch}-${os}_hash";
+
+  rpath = lib.makeLibraryPath [
+    stdenv.cc.cc openssl libunwind zlib krb5 icu
+  ];
+
+  dynamicLinker = stdenv.cc.bintools.dynamicLinker;
+
+in stdenv.mkDerivation rec {
+  pname = "ombi";
+  version = "4.0.1292";
+
+  sourceRoot = ".";
+
+  src = fetchurl {
+    url = "https://github.com/Ombi-app/Ombi/releases/download/v${version}/${os}-${arch}.tar.gz";
+    sha256 = hash;
+  };
+
+  buildInputs = [ makeWrapper patchelf ];
+
+  installPhase = ''
+    mkdir -p $out/{bin,share/${pname}-${version}}
+    cp -r * $out/share/${pname}-${version}
+
+    makeWrapper $out/share/${pname}-${version}/Ombi $out/bin/Ombi \
+      --run "cd $out/share/${pname}-${version}"
+  '';
+
+  dontPatchELF = true;
+  postFixup = ''
+    patchelf --set-interpreter "${dynamicLinker}" \
+      --set-rpath "$ORIGIN:${rpath}" $out/share/${pname}-${version}/Ombi
+
+    find $out -type f -name "*.so" -exec \
+      patchelf --set-rpath '$ORIGIN:${rpath}' {} ';'
+  '';
+
+  passthru = {
+    updateScript = ./update.sh;
+    tests.smoke-test = nixosTests.ombi;
+  };
+
+  meta = with lib; {
+    description = "Self-hosted web application that automatically gives your shared Plex or Emby users the ability to request content by themselves";
+    homepage = "https://ombi.io/";
+    license = licenses.gpl2Only;
+    maintainers = with maintainers; [ woky ];
+    platforms = [ "x86_64-linux" "aarch64-linux" "x86_64-darwin" ];
+  };
+}
diff --git a/pkgs/servers/ombi/update.sh b/pkgs/servers/ombi/update.sh
new file mode 100755
index 000000000000..fb2549bb7468
--- /dev/null
+++ b/pkgs/servers/ombi/update.sh
@@ -0,0 +1,42 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p curl gnused nix-prefetch jq
+
+set -e
+
+dirname="$(dirname "$0")"
+
+updateHash()
+{
+    version=$1
+    arch=$2
+    os=$3
+
+    hashKey="${arch}-${os}_hash"
+
+    url="https://github.com/Ombi-app/Ombi/releases/download/v$version/$os-$arch.tar.gz"
+    hash=$(nix-prefetch-url --type sha256 $url)
+    sriHash="$(nix to-sri --type sha256 $hash)"
+
+    sed -i "s|$hashKey = \"[a-zA-Z0-9\/+-=]*\";|$hashKey = \"$sriHash\";|g" "$dirname/default.nix"
+}
+
+updateVersion()
+{
+    sed -i "s/version = \"[0-9.]*\";/version = \"$1\";/g" "$dirname/default.nix"
+}
+
+currentVersion=$(cd $dirname && nix eval --raw '(with import ../../.. {}; ombi.version)')
+
+latestTag=$(curl https://api.github.com/repos/Ombi-App/Ombi/tags | jq -r '.[] | .name' | sort --version-sort | tail -1)
+latestVersion="$(expr $latestTag : 'v\(.*\)')"
+
+if [[ "$currentVersion" == "$latestVersion" ]]; then
+    echo "Ombi is up-to-date: ${currentVersion}"
+    exit 0
+fi
+
+updateVersion $latestVersion
+
+updateHash $latestVersion x64 linux
+updateHash $latestVersion arm64 linux
+updateHash $latestVersion x64 osx
diff --git a/pkgs/shells/zsh/zsh-fzf-tab/default.nix b/pkgs/shells/zsh/zsh-fzf-tab/default.nix
index fafb4a505748..ee0f702780f3 100644
--- a/pkgs/shells/zsh/zsh-fzf-tab/default.nix
+++ b/pkgs/shells/zsh/zsh-fzf-tab/default.nix
@@ -4,13 +4,13 @@ let
   INSTALL_PATH="${placeholder "out"}/share/fzf-tab";
 in stdenv.mkDerivation rec {
   pname = "zsh-fzf-tab";
-  version = "unstable-2021-02-14";
+  version = "unstable-2021-04-01";
 
   src = fetchFromGitHub {
     owner = "Aloxaf";
     repo = "fzf-tab";
-    rev = "8cebb8f01ca57076c3c7cd66365270d989bcaa89";
-    sha256 = "119m84g2c4z9xdr22j401p09n3cpiyj61dw5m7xkm6309nd7zz0a";
+    rev = "0c36bdcf6a80ec009280897f07f56969f94d377e";
+    sha256 = "0ymp9ky0jlkx9b63jajvpac5g3ll8snkf8q081g0yw42b9hwpiid";
   };
 
   buildInputs = [ ncurses ];
diff --git a/pkgs/tools/admin/aws-vault/default.nix b/pkgs/tools/admin/aws-vault/default.nix
index 56a0d252a8c4..d9f20a9bc34b 100644
--- a/pkgs/tools/admin/aws-vault/default.nix
+++ b/pkgs/tools/admin/aws-vault/default.nix
@@ -1,13 +1,13 @@
 { buildGoModule, lib, fetchFromGitHub, installShellFiles }:
 buildGoModule rec {
   pname = "aws-vault";
-  version = "6.3.0";
+  version = "6.3.1";
 
   src = fetchFromGitHub {
     owner = "99designs";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-bmqmT/gkdgczrDfZdI+FySX5CuesJXWKS0JatzaubIw=";
+    sha256 = "sha256-yNmjoCq9fYzt/lZQlVgxQvxKWCh5Lxd4NSX7c+gE/As=";
   };
 
   vendorSha256 = "sha256-Lb5iiuT/Fd3RMt98AafIi9I0FHJaSpJ8pH7r4yZiiiw=";
diff --git a/pkgs/tools/admin/google-cloud-sdk/default.nix b/pkgs/tools/admin/google-cloud-sdk/default.nix
index 1d70fa24fb5a..2ff2bf92f89b 100644
--- a/pkgs/tools/admin/google-cloud-sdk/default.nix
+++ b/pkgs/tools/admin/google-cloud-sdk/default.nix
@@ -21,18 +21,18 @@ let
   sources = name: system: {
     x86_64-darwin = {
       url = "${baseUrl}/${name}-darwin-x86_64.tar.gz";
-      sha256 = "09jhcv0ysq37k06b4rw3f9w33spvkkxx7fydraikm3zzvy28l58x";
+      sha256 = "0csgdmzr9h3vnqn8gxvgg2mnjzackkvrid1i55l2fqcad69h6w1k";
     };
 
     x86_64-linux = {
       url = "${baseUrl}/${name}-linux-x86_64.tar.gz";
-      sha256 = "1971fz8cv69y7kvirgw9n0xr7z9b1yyh4y43mg10lvv3glx46xcy";
+      sha256 = "0gcxldk3c03dipbkj9yzaa4v1s6bf9zlwslvi8dv3s3kbljjd84b";
     };
   }.${system};
 
 in stdenv.mkDerivation rec {
   pname = "google-cloud-sdk";
-  version = "332.0.0";
+  version = "334.0.0";
 
   src = fetchurl (sources "${pname}-${version}" stdenv.hostPlatform.system);
 
diff --git a/pkgs/tools/filesystems/xfsprogs/default.nix b/pkgs/tools/filesystems/xfsprogs/default.nix
index 009c5e05d5da..85efb13b82ef 100644
--- a/pkgs/tools/filesystems/xfsprogs/default.nix
+++ b/pkgs/tools/filesystems/xfsprogs/default.nix
@@ -4,11 +4,11 @@
 
 stdenv.mkDerivation rec {
   pname = "xfsprogs";
-  version = "5.10.0";
+  version = "5.11.0";
 
   src = fetchurl {
     url = "mirror://kernel/linux/utils/fs/xfs/xfsprogs/${pname}-${version}.tar.xz";
-    sha256 = "1schqzjx836jd54l10pqds7hyli2m77df3snk95xbr23dpj1fh70";
+    sha256 = "0lxks616nmdk8zkdbwpq5sf9zz19smgy5rpmp3hpk2mvrl7kk70f";
   };
 
   outputs = [ "bin" "dev" "out" "doc" ];
@@ -48,7 +48,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     homepage = "https://xfs.org/";
     description = "SGI XFS utilities";
-    license = licenses.lgpl21;
+    license = with licenses; [ gpl2Only lgpl21 gpl3Plus ];  # see https://git.kernel.org/pub/scm/fs/xfs/xfsprogs-dev.git/tree/debian/copyright
     platforms = platforms.linux;
     maintainers = with maintainers; [ dezgeg ajs124 ];
   };
diff --git a/pkgs/tools/misc/youtube-dl/default.nix b/pkgs/tools/misc/youtube-dl/default.nix
index 9c24e2b0af29..8afd9786564c 100644
--- a/pkgs/tools/misc/youtube-dl/default.nix
+++ b/pkgs/tools/misc/youtube-dl/default.nix
@@ -18,11 +18,11 @@ buildPythonPackage rec {
   # The websites youtube-dl deals with are a very moving target. That means that
   # downloads break constantly. Because of that, updates should always be backported
   # to the latest stable release.
-  version = "2021.03.31";
+  version = "2021.04.01";
 
   src = fetchurl {
     url = "https://yt-dl.org/downloads/${version}/${pname}-${version}.tar.gz";
-    sha256 = "1svcgrhq1yxpcd6k3piqs5paalrcsq9bm79h5ras1g7yjzid05gj";
+    sha256 = "1vw9l32bv115129v1lfar626y3vivvxkp36bc1phjcrsjfayz67h";
   };
 
   nativeBuildInputs = [ installShellFiles makeWrapper ];
diff --git a/pkgs/tools/security/credslayer/default.nix b/pkgs/tools/security/credslayer/default.nix
new file mode 100644
index 000000000000..0de8d37c0db4
--- /dev/null
+++ b/pkgs/tools/security/credslayer/default.nix
@@ -0,0 +1,42 @@
+{ lib
+, fetchFromGitHub
+, python3
+, wireshark-cli
+}:
+
+python3.pkgs.buildPythonApplication rec {
+  pname = "credslayer";
+  version = "0.1.2";
+
+  src = fetchFromGitHub {
+    owner = "ShellCode33";
+    repo = "CredSLayer";
+    rev = "v${version}";
+    sha256 = "1rbfy0h9c2gra1r2b39kngj3m7g177nmzzs5xy9np8lxixrh17pc";
+  };
+
+  propagatedBuildInputs = with python3.pkgs; [
+    pyshark
+  ];
+
+  checkInputs = with python3.pkgs; [
+    wireshark-cli
+    pytestCheckHook
+  ];
+
+  pytestFlagsArray = [ "tests/tests.py" ];
+
+  disabledTests = [
+    # Requires a telnet setup
+    "test_telnet"
+  ];
+
+  pythonImportsCheck = [ "credslayer" ];
+
+  meta = with lib; {
+    description = "Extract credentials and other useful info from network captures";
+    homepage = "https://github.com/ShellCode33/CredSLayer";
+    license = with licenses; [ gpl3Only ];
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/tools/security/nuclei/default.nix b/pkgs/tools/security/nuclei/default.nix
index 977a49617c6f..4f6f75bab446 100644
--- a/pkgs/tools/security/nuclei/default.nix
+++ b/pkgs/tools/security/nuclei/default.nix
@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "nuclei";
-  version = "2.3.2";
+  version = "2.3.3";
 
   src = fetchFromGitHub {
     owner = "projectdiscovery";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-QF9w3ZrW+Mbl6EOC1n2848+q71AhxXTf0j//Us9L1r8=";
+    sha256 = "sha256-6Y93Buxq9HIqeXY92xq5KjSn2nn+u05bKGNNi/myeSo=";
   };
 
   vendorSha256 = "sha256-qmuua7HXnwuy24CSqHKALqNDmXBvSIXYTVu3kaGVoeU=";
diff --git a/pkgs/tools/text/zimreader/default.nix b/pkgs/tools/text/zimreader/default.nix
deleted file mode 100644
index 64e6bf60e35d..000000000000
--- a/pkgs/tools/text/zimreader/default.nix
+++ /dev/null
@@ -1,38 +0,0 @@
-{ lib, stdenv, fetchFromGitHub, fetchpatch, automake, autoconf, libtool
-, zimlib, cxxtools, tntnet
-}:
-
-stdenv.mkDerivation {
-  name = "zimreader-0.92";
-
-  src = fetchFromGitHub {
-    owner = "wikimedia";
-    repo = "openzim";
-    rev = "r1.3"; # there multiple tools with different version in the repo
-    sha256 = "0x529137rxy6ld64xqa6xmn93121ripxvkf3sc7hv3wg6km182sw";
-  };
-
-  patchFlags = [ "-p2" ];
-  patches = [
-    (fetchpatch {
-      name = "zimreader_tntnet221.patch";
-      url = "https://github.com/wikimedia/openzim/compare/r1.3...juliendehos:3ee5f11eaa811284d340451e6f466529c00f6ef2.patch";
-      sha256 = "0rc5n20svyyndqh7hsynjyblfraphgi0f6khw6f5jq89w9i1j1hd";
-    })
-  ];
-
-  enableParallelBuilding = true;
-  buildInputs = [ automake autoconf libtool zimlib cxxtools tntnet ];
-  setSourceRoot = ''
-    sourceRoot=$(echo */zimreader)
-  '';
-  preConfigure = "./autogen.sh";
-
-  meta = {
-    description = "A tool to serve ZIM files using HTTP";
-    homepage = "http://git.wikimedia.org/log/openzim";
-    license = lib.licenses.gpl2;
-    maintainers = with lib.maintainers; [ robbinch juliendehos ];
-    platforms = [ "x86_64-linux" ];
-  };
-}
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index d49e073a5f20..7e8eddc2099e 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -827,6 +827,7 @@ mapAliases ({
   ytop = throw "ytop has been abandoned by upstream. Consider switching to bottom instead";
   yubikey-neo-manager = throw "yubikey-neo-manager has been removed because it was broken. Use yubikey-manager-qt instead."; # added 2021-03-08
   yuzu = yuzu-mainline; # added 2021-01-25
+  zimreader = throw "zimreader has been removed from nixpkgs as it has been replaced by kiwix-serve and stopped working with modern zimlib versions."; # added 2021-03-28
   zdfmediathk = mediathekview; # added 2019-01-19
   gnome_user_docs = gnome-user-docs; # added 2019-11-20
   # spidermonkey is not ABI upwards-ompatible, so only allow this for nix-shell
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 5ec802aeef45..d6d875e892a4 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -285,6 +285,8 @@ in
 
   creddump = callPackage ../tools/security/creddump {};
 
+  credslayer = callPackage ../tools/security/credslayer { };
+
   device-tree_rpi = callPackage ../os-specific/linux/device-tree/raspberrypi.nix {};
 
   devour = callPackage ../tools/X11/devour {};
@@ -1382,6 +1384,10 @@ in
 
   glasgow = with python3Packages; toPythonApplication glasgow;
 
+  gmni = callPackage ../applications/networking/browsers/gmni { };
+
+  gmnisrv = callPackage ../servers/gemini/gmnisrv { };
+
   goimapnotify = callPackage ../tools/networking/goimapnotify { };
 
   gojsontoyaml = callPackage ../development/tools/gojsontoyaml { };
@@ -6963,6 +6969,8 @@ in
     inherit (darwin.apple_sdk.frameworks) CoreFoundation;
   };
 
+  ombi = callPackage ../servers/ombi { };
+
   omping = callPackage ../applications/networking/omping { };
 
   onefetch = callPackage ../tools/misc/onefetch {
@@ -9569,8 +9577,6 @@ in
   zinnia = callPackage ../tools/inputmethods/zinnia { };
   tegaki-zinnia-japanese = callPackage ../tools/inputmethods/tegaki-zinnia-japanese { };
 
-  zimreader = callPackage ../tools/text/zimreader { };
-
   zimwriterfs = callPackage ../tools/text/zimwriterfs { };
 
   par = callPackage ../tools/text/par { };
@@ -9924,6 +9930,7 @@ in
     };
   };
 
+  clang_12 = llvmPackages_12.clang;
   clang_11 = llvmPackages_11.clang;
   clang_10 = llvmPackages_10.clang;
   clang_9  = llvmPackages_9.clang;
@@ -10801,6 +10808,7 @@ in
   lld_9 = llvmPackages_9.lld;
   lld_10 = llvmPackages_10.lld;
   lld_11 = llvmPackages_11.lld;
+  lld_12 = llvmPackages_12.lld;
 
   lldb = llvmPackages_latest.lldb;
   lldb_5 = llvmPackages_5.lldb;
@@ -10810,10 +10818,12 @@ in
   lldb_9 = llvmPackages_9.lldb;
   lldb_10 = llvmPackages_10.lldb;
   lldb_11 = llvmPackages_11.lldb;
+  lldb_12 = llvmPackages_12.lldb;
 
   llvm = llvmPackages.llvm;
   llvm-manpages = llvmPackages.llvm-manpages;
 
+  llvm_12 = llvmPackages_12.llvm;
   llvm_11 = llvmPackages_11.llvm;
   llvm_10 = llvmPackages_10.llvm;
   llvm_9  = llvmPackages_9.llvm;
@@ -10878,6 +10888,14 @@ in
     stdenv = gcc7Stdenv;
   }));
 
+  llvmPackages_12 = callPackage ../development/compilers/llvm/12 ({
+    inherit (stdenvAdapters) overrideCC;
+    buildLlvmTools = buildPackages.llvmPackages_12.tools;
+    targetLlvmLibraries = targetPackages.llvmPackages_12.libraries;
+  } // lib.optionalAttrs (stdenv.hostPlatform.isi686 && buildPackages.stdenv.cc.isGNU) {
+    stdenv = gcc7Stdenv;
+  });
+
   llvmPackages_latest = llvmPackages_11;
 
   llvmPackages_rocm = recurseIntoAttrs (callPackage ../development/compilers/llvm/rocm { });
@@ -21038,6 +21056,8 @@ in
 
   koreader = callPackage ../applications/misc/koreader {};
 
+  kreative-square-fonts = callPackage ../data/fonts/kreative-square-fonts { };
+
   lato = callPackage ../data/fonts/lato {};
 
   league-of-moveable-type = callPackage ../data/fonts/league-of-moveable-type {};
@@ -21164,6 +21184,8 @@ in
 
   mustache-go = callPackage ../development/tools/mustache-go { };
 
+  mustache-hpp = callPackage ../development/libraries/mustache-hpp { };
+
   myrica = callPackage ../data/fonts/myrica { };
 
   nafees = callPackage ../data/fonts/nafees { };
@@ -23729,7 +23751,7 @@ in
     ffmpeg = ffmpeg_2;
   };
 
-  kiwix = callPackage ../applications/misc/kiwix { };
+  kiwix = libsForQt5.callPackage ../applications/misc/kiwix { };
 
   klayout = libsForQt5.callPackage ../applications/misc/klayout { };
 
@@ -25519,7 +25541,7 @@ in
   };
 
   lightdm_gtk_greeter = callPackage ../applications/display-managers/lightdm/gtk-greeter.nix {
-    inherit (xfce) exo;
+    inherit (xfce) xfce4-dev-tools;
   };
 
   lightdm-mini-greeter = callPackage ../applications/display-managers/lightdm-mini-greeter { };
@@ -26008,6 +26030,8 @@ in
 
   unigine-valley = callPackage ../applications/graphics/unigine-valley { };
 
+  unipicker = callPackage ../applications/misc/unipicker { };
+
   unison = callPackage ../applications/networking/sync/unison {
     ocamlPackages = ocaml-ng.ocamlPackages_4_09;
     enableX11 = config.unison.enableX11 or true;
@@ -29513,6 +29537,8 @@ in
     nixUnstable
     nixFlakes;
 
+  nixStatic = pkgsStatic.nix;
+
   nixops = callPackage ../tools/package-management/nixops { };
 
   nixopsUnstable = lowPrio (callPackage ../applications/networking/cluster/nixops { });
diff --git a/pkgs/top-level/static.nix b/pkgs/top-level/static.nix
index b3fe7bf8c94f..3cddcde603d8 100644
--- a/pkgs/top-level/static.nix
+++ b/pkgs/top-level/static.nix
@@ -93,27 +93,37 @@ in {
   clangStdenv = foldl (flip id) super.clangStdenv staticAdapters;
   libcxxStdenv = foldl (flip id) super.libcxxStdenv staticAdapters;
 
-  zlib = super.zlib.override {
-    # Don’t use new stdenv zlib because
-    # it doesn’t like the --disable-shared flag
-    stdenv = super.stdenv;
-  };
-  openssl = super.openssl_1_1.overrideAttrs (o: {
-    # OpenSSL doesn't like the `--enable-static` / `--disable-shared` flags.
-    configureFlags = (removeUnknownConfigureFlags o.configureFlags);
-  });
   boost = super.boost.override {
     # Don’t use new stdenv for boost because it doesn’t like the
     # --disable-shared flag
     stdenv = super.stdenv;
   };
+
+  curl = super.curl.override {
+    # brotli doesn't build static (Mar. 2021)
+    brotliSupport = false;
+    # disable gss becuase of: undefined reference to `k5_bcmp'
+    gssSupport = false;
+  };
+
+  ocaml-ng = self.lib.mapAttrs (_: set:
+    if set ? overrideScope' then set.overrideScope' ocamlStaticAdapter else set
+  ) super.ocaml-ng;
+
+  openssl = super.openssl_1_1.overrideAttrs (o: {
+    # OpenSSL doesn't like the `--enable-static` / `--disable-shared` flags.
+    configureFlags = (removeUnknownConfigureFlags o.configureFlags);
+  });
+
   perl = super.perl.override {
     # Don’t use new stdenv zlib because
     # it doesn’t like the --disable-shared flag
     stdenv = super.stdenv;
   };
 
-  ocaml-ng = self.lib.mapAttrs (_: set:
-    if set ? overrideScope' then set.overrideScope' ocamlStaticAdapter else set
-  ) super.ocaml-ng;
+  zlib = super.zlib.override {
+    # Don’t use new stdenv zlib because
+    # it doesn’t like the --disable-shared flag
+    stdenv = super.stdenv;
+  };
 }