diff --git a/nixos/modules/services/web-servers/nginx/default.nix b/nixos/modules/services/web-servers/nginx/default.nix
index be589e42ddd6..5717b86b3bea 100644
--- a/nixos/modules/services/web-servers/nginx/default.nix
+++ b/nixos/modules/services/web-servers/nginx/default.nix
@@ -896,7 +896,7 @@ in
         PrivateMounts = true;
         # System Call Filtering
         SystemCallArchitectures = "native";
-        SystemCallFilter = "~@cpu-emulation @debug @keyring @ipc @mount @obsolete @privileged @setuid";
+        SystemCallFilter = "~@cpu-emulation @debug @keyring @ipc @mount @obsolete @privileged @setuid @mincore";
       };
     };
 
diff --git a/pkgs/applications/graphics/menyoki/default.nix b/pkgs/applications/graphics/menyoki/default.nix
index 77d1fd230726..afaa681437cc 100644
--- a/pkgs/applications/graphics/menyoki/default.nix
+++ b/pkgs/applications/graphics/menyoki/default.nix
@@ -6,6 +6,7 @@
 , stdenv
 , libX11
 , libXrandr
+, AppKit
 , withSki ? true
 }:
 
@@ -25,7 +26,8 @@ rustPlatform.buildRustPackage rec {
   nativeBuildInputs = [ installShellFiles ]
     ++ lib.optional stdenv.isLinux pkg-config;
 
-  buildInputs = lib.optionals stdenv.isLinux [ libX11 libXrandr ];
+  buildInputs = lib.optionals stdenv.isLinux [ libX11 libXrandr ]
+    ++ lib.optional stdenv.isDarwin AppKit;
 
   buildNoDefaultFeatures = !withSki;
 
diff --git a/pkgs/applications/misc/cardpeek/default.nix b/pkgs/applications/misc/cardpeek/default.nix
index 1d5baf9f6b34..adabcdac9542 100644
--- a/pkgs/applications/misc/cardpeek/default.nix
+++ b/pkgs/applications/misc/cardpeek/default.nix
@@ -1,29 +1,50 @@
-{ lib, stdenv, fetchFromGitHub, pkg-config, autoreconfHook,
-  glib, gtk3, pcsclite, lua5_2, curl, readline }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, pkg-config
+, autoreconfHook
+, glib
+, gtk3
+, pcsclite
+, lua5_2
+, curl
+, readline
+, PCSC
+, xcbuild
+}:
 let
   version = "0.8.4";
 in
-  stdenv.mkDerivation {
-    pname = "cardpeek";
-    inherit version;
+stdenv.mkDerivation {
+  pname = "cardpeek";
+  inherit version;
 
-    src = fetchFromGitHub {
-      owner = "L1L1";
-      repo = "cardpeek";
-      rev = "cardpeek-${version}";
-      sha256 = "1ighpl7nvcvwnsd6r5h5n9p95kclwrq99hq7bry7s53yr57l6588";
-    };
+  src = fetchFromGitHub {
+    owner = "L1L1";
+    repo = "cardpeek";
+    rev = "cardpeek-${version}";
+    sha256 = "1ighpl7nvcvwnsd6r5h5n9p95kclwrq99hq7bry7s53yr57l6588";
+  };
 
-    nativeBuildInputs = [ pkg-config autoreconfHook ];
-    buildInputs = [ glib gtk3 pcsclite lua5_2 curl readline ];
+  postPatch = lib.optionalString stdenv.isDarwin ''
+    # replace xcode check and hard-coded PCSC framework path
+    substituteInPlace configure.ac \
+      --replace 'if test ! -e "/Applications/Xcode.app/"; then' 'if test yes != yes; then' \
+      --replace 'PCSC_HEADERS=`ls -d /Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/*.sdk/System/Library/Frameworks/PCSC.framework/Versions/Current/Headers/ | sort | head -1`' 'PCSC_HEADERS=${PCSC}/Library/Frameworks/PCSC.framework/Headers'
+  '';
 
-    enableParallelBuilding = true;
+  nativeBuildInputs = [ pkg-config autoreconfHook ];
+  buildInputs = [ glib gtk3 lua5_2 curl readline ]
+    ++ lib.optional stdenv.isDarwin PCSC
+    ++ lib.optional stdenv.isLinux pcsclite;
 
-    meta = with lib; {
-      homepage = "https://github.com/L1L1/cardpeek";
-      description = "A tool to read the contents of ISO7816 smart cards";
-      license = licenses.gpl3Plus;
-      platforms = with platforms; linux ++ darwin;
-      maintainers = with maintainers; [ embr ];
-    };
-  }
+  enableParallelBuilding = true;
+
+  meta = with lib; {
+    homepage = "https://github.com/L1L1/cardpeek";
+    description = "A tool to read the contents of ISO7816 smart cards";
+    license = licenses.gpl3Plus;
+    platforms = with platforms; linux ++ darwin;
+    maintainers = with maintainers; [ embr ];
+  };
+}
diff --git a/pkgs/applications/science/astronomy/gildas/default.nix b/pkgs/applications/science/astronomy/gildas/default.nix
index b716b0f2f90f..beb3bd92ea5e 100644
--- a/pkgs/applications/science/astronomy/gildas/default.nix
+++ b/pkgs/applications/science/astronomy/gildas/default.nix
@@ -7,8 +7,8 @@ let
 in
 
 stdenv.mkDerivation rec {
-  srcVersion = "sep20a";
-  version = "20200901_a";
+  srcVersion = "nov21a";
+  version = "20211101_a";
   pname = "gildas";
 
   src = fetchurl {
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
     # source code of the previous release to a different directory
     urls = [ "http://www.iram.fr/~gildas/dist/gildas-src-${srcVersion}.tar.xz"
       "http://www.iram.fr/~gildas/dist/archive/gildas/gildas-src-${srcVersion}.tar.xz" ];
-    sha256 = "9faa0b3e674b5ffe5b1aee88027d7401a46ae28cd0b306595300547605d6222a";
+    sha256 = "0fb6iqwh4hm7v7sib7sx98vxdavn3d6q2gq6y6vxg2z29g31f8g2";
   };
 
   nativeBuildInputs = [ pkg-config groff perl getopt gfortran which ];
diff --git a/pkgs/applications/science/math/R/default.nix b/pkgs/applications/science/math/R/default.nix
index 0a9a976f18a3..815d108ce412 100644
--- a/pkgs/applications/science/math/R/default.nix
+++ b/pkgs/applications/science/math/R/default.nix
@@ -33,11 +33,15 @@ stdenv.mkDerivation rec {
     ./no-usr-local-search-paths.patch
   ];
 
+  # Test of the examples for package 'tcltk' fails in Darwin sandbox. See:
+  # https://github.com/NixOS/nixpkgs/issues/146131
   prePatch = lib.optionalString stdenv.isDarwin ''
     substituteInPlace configure \
       --replace "-install_name libRblas.dylib" "-install_name $out/lib/R/lib/libRblas.dylib" \
       --replace "-install_name libRlapack.dylib" "-install_name $out/lib/R/lib/libRlapack.dylib" \
       --replace "-install_name libR.dylib" "-install_name $out/lib/R/lib/libR.dylib"
+    substituteInPlace tests/Examples/Makefile.in \
+      --replace "test-Examples: test-Examples-Base" "test-Examples:" # do not test the examples
   '';
 
   dontDisableStatic = static;
diff --git a/pkgs/development/libraries/igraph/default.nix b/pkgs/development/libraries/igraph/default.nix
index 03573716fa35..159943d8db4b 100644
--- a/pkgs/development/libraries/igraph/default.nix
+++ b/pkgs/development/libraries/igraph/default.nix
@@ -21,13 +21,13 @@
 
 stdenv.mkDerivation rec {
   pname = "igraph";
-  version = "0.9.4";
+  version = "0.9.5";
 
   src = fetchFromGitHub {
     owner = "igraph";
     repo = pname;
     rev = version;
-    sha256 = "sha256-tF+cnJRv125bSpZIpABTIHAfJO4TNfSBHjnzpNTbFgk=";
+    sha256 = "sha256-R5v1nbfYyIOzdw7LmkGQE4yVxpTVs6YF62jkfFrA1z8=";
   };
 
   # Normally, igraph wants us to call bootstrap.sh, which will call
diff --git a/pkgs/development/libraries/mapnik/default.nix b/pkgs/development/libraries/mapnik/default.nix
index 6fff0c1e1bbc..14eb3c047e2a 100644
--- a/pkgs/development/libraries/mapnik/default.nix
+++ b/pkgs/development/libraries/mapnik/default.nix
@@ -93,7 +93,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "An open source toolkit for developing mapping applications";
     homepage = "https://mapnik.org";
-    maintainers = with maintainers; [ hrdinka ];
+    maintainers = with maintainers; [ hrdinka erictapen ];
     license = licenses.lgpl21;
     platforms = platforms.all;
     # https://github.com/mapnik/mapnik/issues/4232
diff --git a/pkgs/development/libraries/unicorn/default.nix b/pkgs/development/libraries/unicorn/default.nix
index 57983537ad14..2be3c9508291 100644
--- a/pkgs/development/libraries/unicorn/default.nix
+++ b/pkgs/development/libraries/unicorn/default.nix
@@ -2,6 +2,7 @@
 , fetchFromGitHub
 , pkg-config
 , cmake
+, IOKit
 }:
 
 stdenv.mkDerivation rec {
@@ -16,6 +17,7 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ pkg-config cmake ];
+  buildInputs = lib.optionals stdenv.isDarwin [ IOKit ];
 
   meta = with lib; {
     description = "Lightweight multi-platform CPU emulator library";
diff --git a/pkgs/development/python-modules/atomman/default.nix b/pkgs/development/python-modules/atomman/default.nix
index b576504588aa..8e03dbe67af7 100644
--- a/pkgs/development/python-modules/atomman/default.nix
+++ b/pkgs/development/python-modules/atomman/default.nix
@@ -1,39 +1,66 @@
-{ lib, buildPythonPackage, fetchFromGitHub, isPy27
+{ lib
+, buildPythonPackage
 , cython
 , datamodeldict
+, fetchFromGitHub
 , matplotlib
 , numericalunits
 , numpy
 , pandas
+, potentials
 , pytest
+, pythonOlder
 , scipy
 , toolz
 , xmltodict
+, python
 }:
 
 buildPythonPackage rec {
-  version = "1.3.0";
+  version = "1.4.2";
   pname = "atomman";
-  disabled = isPy27;
+  format = "setuptools";
+
+  disabled = pythonOlder "3.6";
 
   src = fetchFromGitHub {
     owner = "usnistgov";
-    repo  = "atomman";
+    repo = "atomman";
     rev = "v${version}";
-    sha256 = "09pfykd96wmw00s3kgabghykjn8b4yjml4ybpi7kwy7ygdmzcx51";
+    sha256 = "sha256-Kq4mDykYf74ylWw2golxc81CYKGokXro64YUsFctLmk=";
   };
 
-  checkInputs = [ pytest ];
-  propagatedBuildInputs = [ xmltodict datamodeldict numpy matplotlib scipy pandas cython numericalunits toolz ];
+  propagatedBuildInputs = [
+    cython
+    datamodeldict
+    matplotlib
+    numericalunits
+    numpy
+    pandas
+    potentials
+    scipy
+    toolz
+    xmltodict
+  ];
+
+  checkInputs = [
+    pytest
+  ];
 
   checkPhase = ''
-    py.test tests -k 'not test_atomic'
+    # pytestCheckHook doesn't work
+    py.test tests -k "not test_rootdir and not test_version \
+      and not test_atomic_mass and not imageflags"
   '';
 
+  pythonImportsCheck = [
+    "atomman"
+  ];
+
   meta = with lib; {
-    homepage = "https://github.com/usnistgov/atomman/";
     description = "Atomistic Manipulation Toolkit";
+    homepage = "https://github.com/usnistgov/atomman/";
     license = licenses.mit;
-    maintainers = [ maintainers.costrouc ];
+    maintainers = with maintainers; [ costrouc ];
   };
 }
diff --git a/pkgs/development/python-modules/cdcs/default.nix b/pkgs/development/python-modules/cdcs/default.nix
new file mode 100644
index 000000000000..9dd8a272395b
--- /dev/null
+++ b/pkgs/development/python-modules/cdcs/default.nix
@@ -0,0 +1,44 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, numpy
+, pandas
+, pytestCheckHook
+, pythonOlder
+, requests
+}:
+
+buildPythonPackage rec {
+  version = "0.1.5";
+  pname = "cdcs";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.6";
+
+  src = fetchFromGitHub {
+    owner = "usnistgov";
+    repo = "pycdcs";
+    rev = "v${version}";
+    sha256 = "0sd0s0mka2bvpxxiz98cjc2h5ncsb7d03af1q3w9w8pmvfsgj7pc";
+  };
+
+  propagatedBuildInputs = [
+    numpy
+    pandas
+    requests
+  ];
+
+  # Project has no tests
+  doCheck = false;
+
+  pythonImportsCheck = [
+    "cdcs"
+  ];
+
+  meta = with lib; {
+    description = "Python client for performing REST calls to configurable data curation system (CDCS) databases";
+    homepage = "https://github.com/usnistgov/pycdcs";
+    license = licenses.mit;
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/development/python-modules/clize/default.nix b/pkgs/development/python-modules/clize/default.nix
index faeb54f794bb..4f9a562543b9 100644
--- a/pkgs/development/python-modules/clize/default.nix
+++ b/pkgs/development/python-modules/clize/default.nix
@@ -15,11 +15,11 @@
 
 buildPythonPackage rec {
   pname = "clize";
-  version = "4.2.0";
+  version = "4.2.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "06p47i6hri006v7xbx7myj02as1a6f34rv88wfa9rb067p13nmyz";
+    sha256 = "3177a028e4169d8865c79af82bdd441b24311d4bd9c0ae8803641882d340a51d";
   };
 
   checkInputs = [
diff --git a/pkgs/development/python-modules/cozy/default.nix b/pkgs/development/python-modules/cozy/default.nix
index fcd002f762d7..8787ca368f1a 100644
--- a/pkgs/development/python-modules/cozy/default.nix
+++ b/pkgs/development/python-modules/cozy/default.nix
@@ -1,5 +1,5 @@
 { buildPythonPackage, isPy3k, fetchFromGitHub, lib,
-  z3, ply, python-igraph, oset, ordered-set, dictionaries, setuptools }:
+  z3, ply, igraph, oset, ordered-set, dictionaries, setuptools }:
 
 buildPythonPackage {
   pname = "cozy";
@@ -7,7 +7,7 @@ buildPythonPackage {
   disabled = !isPy3k;
 
   propagatedBuildInputs = [
-    setuptools z3 ply python-igraph oset ordered-set dictionaries
+    setuptools z3 ply igraph oset ordered-set dictionaries
   ];
 
   src = fetchFromGitHub {
diff --git a/pkgs/development/python-modules/explorerscript/default.nix b/pkgs/development/python-modules/explorerscript/default.nix
index b0f1a16fe421..a77c31e26a63 100644
--- a/pkgs/development/python-modules/explorerscript/default.nix
+++ b/pkgs/development/python-modules/explorerscript/default.nix
@@ -1,4 +1,11 @@
-{ lib, buildPythonPackage, fetchFromGitHub, antlr4-python3-runtime, pygments, python-igraph }:
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, fetchpatch
+, antlr4-python3-runtime
+, igraph
+, pygments
+}:
 
 buildPythonPackage rec {
   pname = "explorerscript";
@@ -11,7 +18,15 @@ buildPythonPackage rec {
     sha256 = "1vzyliiyrxx8l9sfbqcyr4xn5swd7znkxy69kn0vb5rban8hm9c1";
   };
 
-  propagatedBuildInputs = [ antlr4-python3-runtime python-igraph ];
+  patches = [
+    # https://github.com/SkyTemple/ExplorerScript/pull/17
+    (fetchpatch {
+      url = "https://github.com/SkyTemple/ExplorerScript/commit/47d8b3d246881d675a82b4049b87ed7d9a0e1b15.patch";
+      sha256 = "0sadw9l2nypl2s8lw526lvbdj4rzqdvrjncx4zxxgyp3x47csb48";
+    })
+  ];
+
+  propagatedBuildInputs = [ antlr4-python3-runtime igraph ];
   checkInputs = [ pygments ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/python-igraph/default.nix b/pkgs/development/python-modules/igraph/default.nix
similarity index 92%
rename from pkgs/development/python-modules/python-igraph/default.nix
rename to pkgs/development/python-modules/igraph/default.nix
index ce5073ed087e..91e676602360 100644
--- a/pkgs/development/python-modules/python-igraph/default.nix
+++ b/pkgs/development/python-modules/igraph/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "python-igraph";
-  version = "0.9.6";
+  version = "0.9.8";
 
   disabled = pythonOlder "3.6";
 
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "igraph";
     repo = "python-igraph";
     rev = version;
-    sha256 = "sha256-x/BUlMmSgjY2v6bVKPxmz86OCz6xgRUcfSqI3vV9MPs=";
+    sha256 = "sha256-RtvT5/LZ/xP68yBB7DDKJGeNCiX4HyPTCuk+Ijd2nFs=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/kmapper/default.nix b/pkgs/development/python-modules/kmapper/default.nix
index 630c025e0936..c3418b2c5c94 100644
--- a/pkgs/development/python-modules/kmapper/default.nix
+++ b/pkgs/development/python-modules/kmapper/default.nix
@@ -8,7 +8,7 @@
 , pytestCheckHook
 , networkx
 , matplotlib
-, python-igraph
+, igraph
 , plotly
 , ipywidgets
 }:
@@ -35,7 +35,7 @@ buildPythonPackage rec {
     pytestCheckHook
     networkx
     matplotlib
-    python-igraph
+    igraph
     plotly
     ipywidgets
   ];
diff --git a/pkgs/development/python-modules/libcloud/default.nix b/pkgs/development/python-modules/libcloud/default.nix
index eacc05ffd144..77aa9e2927a5 100644
--- a/pkgs/development/python-modules/libcloud/default.nix
+++ b/pkgs/development/python-modules/libcloud/default.nix
@@ -1,40 +1,49 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, isPy27
-, mock
 , pycrypto
+, pythonOlder
 , requests
-, pytest-runner
-, pytest
-, requests-mock
-, typing
 }:
 
 buildPythonPackage rec {
   pname = "apache-libcloud";
-  version = "3.4.0";
+  version = "3.4.1";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "17618ccbe3493f2be015db9e1efa35080ff34d470de723f1384d908ff126e51c";
+    sha256 = "sha256-iPGNoM8/rAr3I+dD+3QdnRviUYge2reloNFimVW1ARs=";
   };
 
-  checkInputs = [ mock pytest pytest-runner requests-mock ];
-  propagatedBuildInputs = [ pycrypto requests ] ++ lib.optionals isPy27 [ typing ];
+  propagatedBuildInputs = [
+    pycrypto
+    requests
+  ];
 
-  preConfigure = "cp libcloud/test/secrets.py-dist libcloud/test/secrets.py";
+  preConfigure = ''
+    cp libcloud/test/secrets.py-dist libcloud/test/secrets.py
+  '';
+
+  postPatch = ''
+    substituteInPlace setup.py \
+      --replace "setup_requires=pytest_runner," "setup_requires=[],"
+  '';
 
   # requires a certificates file
   doCheck = false;
 
-  pythonImportsCheck = [ "libcloud" ];
+  pythonImportsCheck = [
+    "libcloud"
+  ];
 
   meta = with lib; {
     description = "A unified interface to many cloud providers";
     homepage = "https://libcloud.apache.org/";
     changelog = "https://github.com/apache/libcloud/blob/v${version}/CHANGES.rst";
     license = licenses.asl20;
+    maintainers = with maintainers; [ ];
   };
-
 }
diff --git a/pkgs/development/python-modules/potentials/default.nix b/pkgs/development/python-modules/potentials/default.nix
new file mode 100644
index 000000000000..24db19b3c065
--- /dev/null
+++ b/pkgs/development/python-modules/potentials/default.nix
@@ -0,0 +1,58 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, ipywidgets
+, cdcs
+, bibtexparser
+, habanero
+, pandas
+, requests
+, numpy
+, matplotlib
+, unidecode
+, datamodeldict
+, xmltodict
+, pytestCheckHook
+, pythonOlder
+}:
+
+buildPythonPackage rec {
+  version = "0.3.1";
+  pname = "potentials";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "02l1rav5jdfsb00byxbswyhqdnjljp9y7g4ddn4mivzi7x39qa52";
+  };
+
+  propagatedBuildInputs = [
+    ipywidgets
+    cdcs
+    bibtexparser
+    habanero
+    pandas
+    requests
+    numpy
+    matplotlib
+    unidecode
+    datamodeldict
+    xmltodict
+  ];
+
+  # Project has no tests
+  doCheck = false;
+
+  pythonImportsCheck = [
+    "potentials"
+  ];
+
+  meta = with lib; {
+    description = "Python API database tools for accessing the NIST Interatomic Potentials Repository";
+    homepage = "https://github.com/usnistgov/potentials";
+    license = licenses.mit;
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/development/python-modules/python-mapnik/default.nix b/pkgs/development/python-modules/python-mapnik/default.nix
index 3a4e4af54def..2d888518ff45 100644
--- a/pkgs/development/python-modules/python-mapnik/default.nix
+++ b/pkgs/development/python-modules/python-mapnik/default.nix
@@ -68,7 +68,7 @@ buildPythonPackage rec {
 
   meta = with lib; {
     description = "Python bindings for Mapnik";
-    maintainers = with maintainers; [ ];
+    maintainers = with maintainers; [ erictapen ];
     homepage = "https://mapnik.org";
     license = licenses.lgpl21;
   };
diff --git a/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.sh b/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.sh
index 198a6eae6005..244e1c1d52b1 100755
--- a/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.sh
+++ b/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.sh
@@ -29,7 +29,9 @@ upgrade_all=
 profile=/nix/var/nix/profiles/system
 buildHost=localhost
 targetHost=
-maybeSudo=()
+remoteSudo=
+# comma separated list of vars to preserve when using sudo
+preservedSudoVars=NIXOS_INSTALL_BOOTLOADER
 
 while [ "$#" -gt 0 ]; do
     i="$1"; shift 1
@@ -100,7 +102,7 @@ while [ "$#" -gt 0 ]; do
         shift 1
         ;;
       --use-remote-sudo)
-        maybeSudo=(sudo --)
+        remoteSudo=1
         ;;
       --flake)
         flake="$1"
@@ -126,8 +128,8 @@ while [ "$#" -gt 0 ]; do
     esac
 done
 
-if [ -n "$SUDO_USER" ]; then
-    maybeSudo=(sudo --)
+if [[ -n "$SUDO_USER" || -n $remoteSudo ]]; then
+    maybeSudo=(sudo --preserve-env="$preservedSudoVars" --)
 fi
 
 if [ -z "$buildHost" -a -n "$targetHost" ]; then
diff --git a/pkgs/servers/http/nginx/stable.nix b/pkgs/servers/http/nginx/stable.nix
index bb554c500e27..5db7c65daa40 100644
--- a/pkgs/servers/http/nginx/stable.nix
+++ b/pkgs/servers/http/nginx/stable.nix
@@ -1,6 +1,6 @@
 { callPackage, ... } @ args:
 
 callPackage ./generic.nix args {
-  version = "1.20.1";
-  sha256 = "0jccnknx57yvbvx6qwwisa8rb5zm1wb54xnz0nm0phym6cay2qp4";
+  version = "1.20.2";
+  sha256 = "0hjsyjzd35qyw49w210f67g678kvzinw4kg1acb0l6c2fxspd24m";
 }
diff --git a/pkgs/servers/sql/mariadb/default.nix b/pkgs/servers/sql/mariadb/default.nix
index 0034a831bfe2..90fa78351286 100644
--- a/pkgs/servers/sql/mariadb/default.nix
+++ b/pkgs/servers/sql/mariadb/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchzip, fetchFromGitHub, cmake, pkg-config, makeWrapper, ncurses, nixosTests
+{ lib, stdenv, fetchurl, fetchFromGitHub, cmake, pkg-config, makeWrapper, ncurses, nixosTests
 , libiconv, openssl, pcre2, boost, judy, bison, libxml2, libkrb5, linux-pam, curl
 , libaio, libevent, jemalloc, cracklib, systemd, perl
 , bzip2, lz4, lzo, snappy, xz, zlib, zstd
@@ -24,9 +24,9 @@ mariadb = server // {
 common = rec { # attributes common to both builds
   version = "10.6.5";
 
-  src = fetchzip {
+  src = fetchurl {
     url = "https://downloads.mariadb.com/MariaDB/mariadb-${version}/source/mariadb-${version}.tar.gz";
-    sha256 = "0rvcllbplgn92kr5n3qxfasnsqc8cn9ijm01fb7i7j2p9zxnfhig";
+    sha256 = "sha256-4L4EBCjZpCqLtL0iG1Z/8lIs1vqJBjhic9pPA8XCCo8=";
   };
 
   nativeBuildInputs = [ cmake pkg-config ]
@@ -44,7 +44,10 @@ common = rec { # attributes common to both builds
 
   patches = [
     ./cmake-includedir.patch
-  ];
+  ]
+  # Fixes a build issue as documented on
+  # https://jira.mariadb.org/browse/MDEV-26769?focusedCommentId=206073&page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-206073
+  ++ lib.optional (!stdenv.isLinux) ./macos-MDEV-26769-regression-fix.patch;
 
   cmakeFlags = [
     "-DBUILD_CONFIG=mysql_release"
diff --git a/pkgs/servers/sql/mariadb/macos-MDEV-26769-regression-fix.patch b/pkgs/servers/sql/mariadb/macos-MDEV-26769-regression-fix.patch
new file mode 100644
index 000000000000..8c0e6f78e287
--- /dev/null
+++ b/pkgs/servers/sql/mariadb/macos-MDEV-26769-regression-fix.patch
@@ -0,0 +1,12 @@
+diff -ru a/storage/innobase/include/buf0types.h b/storage/innobase/include/buf0types.h
+--- a/storage/innobase/include/buf0types.h	2021-11-17 02:37:32.000000000 -0500
++++ b/storage/innobase/include/buf0types.h	2021-11-17 02:38:50.000000000 -0500
+@@ -179,7 +179,7 @@
+ #include "sux_lock.h"
+ 
+ #ifdef SUX_LOCK_GENERIC
+-class page_hash_latch : private rw_lock
++class page_hash_latch : public rw_lock
+ {
+   /** Wait for a shared lock */
+   void read_lock_wait();
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index c274525fd95c..ea2d2794c876 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -2379,7 +2379,7 @@ with pkgs;
 
   catclock = callPackage ../applications/misc/catclock { };
 
-  cardpeek = callPackage ../applications/misc/cardpeek { };
+  cardpeek = callPackage ../applications/misc/cardpeek { inherit (darwin.apple_sdk.frameworks) PCSC; };
 
   cawbird = callPackage ../applications/networking/cawbird { };
 
@@ -10647,7 +10647,9 @@ with pkgs;
     withRedis = true;
   };
 
-  unicorn = callPackage ../development/libraries/unicorn { };
+  unicorn = callPackage ../development/libraries/unicorn {
+    inherit (darwin.apple_sdk.frameworks) IOKit;
+  };
 
   units = callPackage ../tools/misc/units {
     enableCurrenciesUpdater = true;
@@ -18508,7 +18510,15 @@ with pkgs;
 
   opencl-clang = callPackage ../development/libraries/opencl-clang { };
 
-  mapnik = callPackage ../development/libraries/mapnik { };
+  mapnik = callPackage ../development/libraries/mapnik {
+    gdal = gdal.override {
+      libgeotiff = libgeotiff.override { proj = proj_7; };
+      libspatialite = libspatialite.override { proj = proj_7; };
+      proj = proj_7;
+    };
+    proj = proj_7;
+  };
+
 
   marisa = callPackage ../development/libraries/marisa {};
 
@@ -26611,6 +26621,7 @@ with pkgs;
 
   menyoki = callPackage ../applications/graphics/menyoki {
     inherit (xorg) libX11 libXrandr;
+    inherit (darwin.apple_sdk.frameworks) AppKit;
   };
 
   mercurial = callPackage ../applications/version-management/mercurial {
diff --git a/pkgs/top-level/python-aliases.nix b/pkgs/top-level/python-aliases.nix
index 54885b48abf5..7c7c0133ee9d 100644
--- a/pkgs/top-level/python-aliases.nix
+++ b/pkgs/top-level/python-aliases.nix
@@ -75,6 +75,7 @@ mapAliases ({
   pytestpep8 = throw "pytestpep8 was removed because it is abandoned and no longer compatible with pytest v6.0"; # added 2020-12-10
   pytestquickcheck = pytest-quickcheck; # added 2021-07-20
   pytestrunner = pytest-runner; # added 2021-01-04
+  python-igraph = igraph; # added 2021-11-11
   python-lz4 = lz4; # added 2018-06-01
   python_mimeparse = python-mimeparse; # added 2021-10-31
   python-subunit = subunit; # added 2021-09-10
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index f337d6a63e69..337038a72dea 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -1411,6 +1411,8 @@ in {
 
   cchardet = callPackage ../development/python-modules/cchardet { };
 
+  cdcs = callPackage ../development/python-modules/cdcs { };
+
   celery = callPackage ../development/python-modules/celery { };
 
   cement = callPackage ../development/python-modules/cement { };
@@ -3702,6 +3704,10 @@ in {
 
   ignite = callPackage ../development/python-modules/ignite { };
 
+  igraph = callPackage ../development/python-modules/igraph {
+    inherit (pkgs) igraph;
+  };
+
   ihatemoney = callPackage ../development/python-modules/ihatemoney { };
 
   ijson = callPackage ../development/python-modules/ijson { };
@@ -5920,6 +5926,8 @@ in {
 
   pot = callPackage ../development/python-modules/pot { };
 
+  potentials = callPackage ../development/python-modules/potentials { };
+
   potr = callPackage ../development/python-modules/potr { };
 
   power = callPackage ../development/python-modules/power { };
@@ -7515,10 +7523,6 @@ in {
 
   python-http-client = callPackage ../development/python-modules/python-http-client { };
 
-  python-igraph = callPackage ../development/python-modules/python-igraph {
-    inherit (pkgs) igraph;
-  };
-
   pythonix = callPackage ../development/python-modules/pythonix {
     nix = pkgs.nix_2_3;
     meson = pkgs.meson.override { python3 = self.python; };