diff --git a/nixos/tests/systemd-networkd.nix b/nixos/tests/systemd-networkd.nix
index 4f2cb75f5a0..7faeae3704e 100644
--- a/nixos/tests/systemd-networkd.nix
+++ b/nixos/tests/systemd-networkd.nix
@@ -6,7 +6,6 @@ let generateNodeConf = { lib, pkgs, config, privk, pubk, peerId, nodeId, ...}: {
       networking.firewall.enable = false;
       virtualisation.vlans = [ 1 ];
       environment.systemPackages = with pkgs; [ wireguard-tools ];
-      boot.extraModulePackages = [ config.boot.kernelPackages.wireguard ];
       systemd.network = {
         enable = true;
         netdevs = {
diff --git a/pkgs/applications/audio/squeezelite/default.nix b/pkgs/applications/audio/squeezelite/default.nix
index 6bb3bef8a50..600ba95947a 100644
--- a/pkgs/applications/audio/squeezelite/default.nix
+++ b/pkgs/applications/audio/squeezelite/default.nix
@@ -2,7 +2,7 @@
 , alsaLib, flac, libmad, libvorbis, mpg123
 , dsdSupport ? true
 , faad2Support ? true, faad2
-, ffmpegSupport ? true, ffmpeg_3
+, ffmpegSupport ? true, ffmpeg
 , opusSupport ? true, opusfile
 , resampleSupport ? true, soxr
 , sslSupport ? true, openssl
@@ -35,7 +35,7 @@ in stdenv.mkDerivation {
 
   buildInputs = [ alsaLib flac libmad libvorbis mpg123 ]
     ++ optional faad2Support faad2
-    ++ optional ffmpegSupport ffmpeg_3
+    ++ optional ffmpegSupport ffmpeg
     ++ optional opusSupport opusfile
     ++ optional resampleSupport soxr
     ++ optional sslSupport openssl;
diff --git a/pkgs/applications/networking/browsers/palemoon/default.nix b/pkgs/applications/networking/browsers/palemoon/default.nix
index 9bc9727dd18..63f1958f4a6 100644
--- a/pkgs/applications/networking/browsers/palemoon/default.nix
+++ b/pkgs/applications/networking/browsers/palemoon/default.nix
@@ -142,6 +142,8 @@ stdenv.mkDerivation rec {
     ac_add_options --enable-jemalloc
     ac_add_options --enable-strip
     ac_add_options --enable-devtools
+    # Missing from build instructions, https://forum.palemoon.org/viewtopic.php?f=5&t=25843#p214767
+    ac_add_options --enable-av1
 
     ac_add_options --disable-eme
     ac_add_options --disable-webrtc
@@ -159,8 +161,6 @@ stdenv.mkDerivation rec {
 
     ac_add_options --x-libraries=${lib.makeLibraryPath [ xorg.libX11 ]}
 
-    export MOZ_PKG_SPECIAL=gtk$_GTK_VERSION
-
     #
     # NixOS-specific adjustments
     #
diff --git a/pkgs/applications/version-management/git-repo/default.nix b/pkgs/applications/version-management/git-repo/default.nix
index 72f6d67c2f1..cd6d9b0fd51 100644
--- a/pkgs/applications/version-management/git-repo/default.nix
+++ b/pkgs/applications/version-management/git-repo/default.nix
@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   pname = "git-repo";
-  version = "2.13.1";
+  version = "2.14.5";
 
   src = fetchFromGitHub {
     owner = "android";
     repo = "tools_repo";
     rev = "v${version}";
-    sha256 = "sha256-D6gh14XOZ6Fjypfhg9l5ozPhyf6u6M0Wc8HdagdPM/Q=";
+    sha256 = "sha256-3FSkWpHda1jVhy/633B+ippWcbKd83IlQcJYS9Qx5wQ=";
   };
 
   patches = [ ./import-ssl-module.patch ];
diff --git a/pkgs/development/idris-modules/data.nix b/pkgs/development/idris-modules/data.nix
deleted file mode 100644
index 0517edec2d2..00000000000
--- a/pkgs/development/idris-modules/data.nix
+++ /dev/null
@@ -1,25 +0,0 @@
-{ build-idris-package
-, fetchFromGitHub
-, contrib
-, lib
-}:
-build-idris-package  {
-  name = "data";
-  version = "2018-03-19";
-
-  idrisDeps = [ contrib ];
-
-  src = fetchFromGitHub {
-    owner = "jdevuyst";
-    repo = "idris-data";
-    rev = "105b78ac13235edc596287367a675d7cd04ce5d5";
-    sha256 = "17wz4jddan39984qibx2x7nv2zkqznv0fpab20nrm4zgy17v77ii";
-  };
-
-  meta = {
-    description = "Functional data structures in Idris";
-    homepage = "https://github.com/jdevuyst/idris-data";
-    license = lib.licenses.bsd3;
-    maintainers = [ lib.maintainers.brainrape ];
-  };
-}
diff --git a/pkgs/development/idris-modules/default.nix b/pkgs/development/idris-modules/default.nix
index 7011a513c10..d6fb1ac78bd 100644
--- a/pkgs/development/idris-modules/default.nix
+++ b/pkgs/development/idris-modules/default.nix
@@ -75,8 +75,6 @@
 
     cube = callPackage ./cube.nix {};
 
-    data = callPackage ./data.nix {};
-
     derive = callPackage ./derive.nix {};
 
     descncrunch = callPackage ./descncrunch.nix {};
diff --git a/pkgs/development/php-packages/phpcbf/default.nix b/pkgs/development/php-packages/phpcbf/default.nix
index da114a4d348..caf3b515aab 100644
--- a/pkgs/development/php-packages/phpcbf/default.nix
+++ b/pkgs/development/php-packages/phpcbf/default.nix
@@ -1,14 +1,14 @@
 { mkDerivation, fetchurl, lib, php, makeWrapper }:
 let
   pname = "phpcbf";
-  version = "3.5.8";
+  version = "3.6.0";
 in
 mkDerivation {
   inherit pname version;
 
   src = fetchurl {
     url = "https://github.com/squizlabs/PHP_CodeSniffer/releases/download/${version}/phpcbf.phar";
-    sha256 = "15ci30yvw3p9zlmzsk9s4mxzb3wax3gl9p55slhf1bzwn1xxwyb0";
+    sha256 = "04wb1imm4934mpy2hxcmqh4cn7md1vwmfii39p6mby809325b5z1";
   };
 
   phases = [ "installPhase" ];
diff --git a/pkgs/development/php-packages/phpcs/default.nix b/pkgs/development/php-packages/phpcs/default.nix
index d2053dbe9cb..87433066ea9 100644
--- a/pkgs/development/php-packages/phpcs/default.nix
+++ b/pkgs/development/php-packages/phpcs/default.nix
@@ -1,14 +1,14 @@
 { mkDerivation, fetchurl, makeWrapper, lib, php }:
 let
   pname = "phpcs";
-  version = "3.5.8";
+  version = "3.6.0";
 in
 mkDerivation {
   inherit pname version;
 
   src = fetchurl {
     url = "https://github.com/squizlabs/PHP_CodeSniffer/releases/download/${version}/phpcs.phar";
-    sha256 = "037mdnpbgd9xaj556pf14h02a4a6f5zzdg58p2z1sivxcygf8aka";
+    sha256 = "0sdi78hrwd3r5p1b38qmp89m41kfszh2qn4n5zhq2dmhsjdhjziz";
   };
 
   phases = [ "installPhase" ];
diff --git a/pkgs/development/python-modules/ldaptor/19.nix b/pkgs/development/python-modules/ldaptor/19.nix
new file mode 100644
index 00000000000..cca696f1dff
--- /dev/null
+++ b/pkgs/development/python-modules/ldaptor/19.nix
@@ -0,0 +1,36 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, twisted
+, passlib
+, pyopenssl
+, pyparsing
+, service-identity
+, zope_interface
+, isPy3k
+, python
+}:
+
+buildPythonPackage rec {
+  pname = "ldaptor";
+  version = "19.1.0";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "64c7b870c77e34e4f5f9cfdf330b9702e89b4dd0f64275704f86c1468312c755";
+  };
+
+  propagatedBuildInputs = [
+    twisted passlib pyopenssl pyparsing service-identity zope_interface
+  ];
+
+  disabled = isPy3k;
+
+  doCheck = false;
+
+  meta = {
+    description = "A Pure-Python Twisted library for LDAP";
+    homepage = "https://github.com/twisted/ldaptor";
+    license = lib.licenses.mit;
+  };
+}
diff --git a/pkgs/development/python-modules/msal/default.nix b/pkgs/development/python-modules/msal/default.nix
index 3df0527589a..735d74b5237 100644
--- a/pkgs/development/python-modules/msal/default.nix
+++ b/pkgs/development/python-modules/msal/default.nix
@@ -9,11 +9,11 @@
 
 buildPythonPackage rec {
   pname = "msal";
-  version = "1.10.0";
+  version = "1.11.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "582e92e3b9fa68084dca6ecfd8db866ddc75cd9043de267c79d6b6277dd27f55";
+    sha256 = "sha256-RnrwK7lKh6G2lbUb+GdmfoKKzA3Twd5fpUP2kALbSfo=";
   };
 
   propagatedBuildInputs = [
@@ -22,15 +22,15 @@ buildPythonPackage rec {
   ];
 
   # Tests assume Network Connectivity:
-  #   https://github.com/AzureAD/microsoft-authentication-library-for-python/blob/e2958961e8ec16d0af4199f60c36c3f913497e48/tests/test_authority.py#L73
+  # https://github.com/AzureAD/microsoft-authentication-library-for-python/blob/e2958961e8ec16d0af4199f60c36c3f913497e48/tests/test_authority.py#L73
   doCheck = false;
 
+  pythonImportsCheck = [ "msal" ];
+
   meta = with lib; {
     description = "The Microsoft Authentication Library (MSAL) for Python library enables your app to access the Microsoft Cloud by supporting authentication of users with Microsoft Azure Active Directory accounts (AAD) and Microsoft Accounts (MSA) using industry standard OAuth2 and OpenID Connect";
     homepage = "https://github.com/AzureAD/microsoft-authentication-library-for-python";
     license = licenses.mit;
-    maintainers = with maintainers; [
-      kamadorueda
-    ];
+    maintainers = with maintainers; [ kamadorueda ];
   };
 }
diff --git a/pkgs/development/python-modules/mwoauth/default.nix b/pkgs/development/python-modules/mwoauth/default.nix
index 0a73e99391e..8743329917e 100644
--- a/pkgs/development/python-modules/mwoauth/default.nix
+++ b/pkgs/development/python-modules/mwoauth/default.nix
@@ -17,14 +17,28 @@ buildPythonPackage rec {
     sha256 = "9e0d70a1fa6f452584de1cb853ae6c11f41233549f7839cfb879f99410f6ad46";
   };
 
-  # package has no tests
+  propagatedBuildInputs = [
+    oauthlib
+    pyjwt
+    requests
+    requests_oauthlib
+    six
+  ];
+
+  postPatch = ''
+    # https://github.com/mediawiki-utilities/python-mwoauth/pull/43
+    substituteInPlace setup.py --replace "PyJWT>=1.0.1,<2.0.0" "PyJWT>=1.0.1"
+  '';
+
+  # PyPI source has no tests included
+  # https://github.com/mediawiki-utilities/python-mwoauth/issues/44
   doCheck = false;
 
-  propagatedBuildInputs = [ six pyjwt requests oauthlib requests_oauthlib ];
+  pythonImportsCheck = [ "mwoauth" ];
 
   meta = with lib; {
-    description = "A library designed to provide a simple means to performing an OAuth handshake with a MediaWiki installation with the OAuth Extension installed.";
-    homepage =  "https://github.com/mediawiki-utilities/python-mwoauth";
+    description = "Python library to perform OAuth handshakes with a MediaWiki installation";
+    homepage = "https://github.com/mediawiki-utilities/python-mwoauth";
     license = licenses.mit;
     maintainers = with maintainers; [ ixxie ];
   };
diff --git a/pkgs/development/python-modules/oauthenticator/default.nix b/pkgs/development/python-modules/oauthenticator/default.nix
index 839582e87f0..25e81c89c25 100644
--- a/pkgs/development/python-modules/oauthenticator/default.nix
+++ b/pkgs/development/python-modules/oauthenticator/default.nix
@@ -14,20 +14,18 @@
 
 buildPythonPackage rec {
   pname = "oauthenticator";
-  version = "0.13.0";
+  version = "14.0.0";
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "5202adcd96ddbbccbc267da02f2d14e977300c81291aaa77be4fd9f2e27cfa37";
+    sha256 = "1zfcl3dq9ladqg7fnpx6kgxf1ckjzlc8v3j6wa8w6iwglm40ax4r";
   };
 
   propagatedBuildInputs = [
     jupyterhub
   ];
 
-  pytestFlagsArray = [ "oauthenticator/tests" ];
-
   checkInputs = [
     google-api-python-client
     google-auth-oauthlib
@@ -38,6 +36,20 @@ buildPythonPackage rec {
     requests-mock
   ];
 
+  postPatch = ''
+  # The constraint was removed. No longer needed for > 14.0.0
+  # https://github.com/jupyterhub/oauthenticator/pull/431
+    substituteInPlace test-requirements.txt --replace "pyjwt>=1.7,<2.0" "pyjwt"
+  '';
+
+  disabledTests = [
+    # Test are outdated, https://github.com/jupyterhub/oauthenticator/issues/432
+    "test_azuread"
+    "test_mediawiki"
+  ];
+
+  pythonImportsCheck = [ "oauthenticator" ];
+
   meta = with lib; {
     description = "Authenticate JupyterHub users with common OAuth providers, including GitHub, Bitbucket, and more.";
     homepage =  "https://github.com/jupyterhub/oauthenticator";
diff --git a/pkgs/development/python-modules/privacyidea/default.nix b/pkgs/development/python-modules/privacyidea/default.nix
index c28a0090168..11ff6f71af6 100644
--- a/pkgs/development/python-modules/privacyidea/default.nix
+++ b/pkgs/development/python-modules/privacyidea/default.nix
@@ -1,10 +1,10 @@
 { lib, buildPythonPackage, fetchFromGitHub, cacert, openssl, python, nixosTests
 
 , cryptography, pyrad, pymysql, python-dateutil, flask-versioned, flask_script
-, defusedxml, croniter, flask_migrate, pyjwt, configobj, sqlsoup, pillow
+, defusedxml, croniter, flask_migrate, pyjwt1, configobj, sqlsoup, pillow
 , python-gnupg, passlib, pyopenssl, beautifulsoup4, smpplib, flask-babel
 , ldap3, huey, pyyaml, qrcode, oauth2client, requests, lxml, cbor2, psycopg2
-, pydash
+, pydash, ecdsa
 
 , mock, pytestCheckHook, responses, testfixtures
 }:
@@ -29,10 +29,10 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [
     cryptography pyrad pymysql python-dateutil flask-versioned flask_script
-    defusedxml croniter flask_migrate pyjwt configobj sqlsoup pillow
+    defusedxml croniter flask_migrate pyjwt1 configobj sqlsoup pillow
     python-gnupg passlib pyopenssl beautifulsoup4 smpplib flask-babel
     ldap3 huey pyyaml qrcode oauth2client requests lxml cbor2 psycopg2
-    pydash
+    pydash ecdsa
   ];
 
   passthru.tests = { inherit (nixosTests) privacyidea; };
diff --git a/pkgs/development/python-modules/pyflume/default.nix b/pkgs/development/python-modules/pyflume/default.nix
index 5c79cd4d257..7c80aab59cd 100644
--- a/pkgs/development/python-modules/pyflume/default.nix
+++ b/pkgs/development/python-modules/pyflume/default.nix
@@ -41,6 +41,15 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
+  postPatch = ''
+    # https://github.com/ChrisMandich/PyFlume/issues/18
+    substituteInPlace setup.py \
+      --replace "pyjwt==2.0.1" "pyjwt>=2.0.1" \
+      --replace "ratelimit==2.2.1" "ratelimit>=2.2.1" \
+      --replace "pytz==2019.2" "pytz>=2019.2" \
+      --replace "requests==2.24.0" "requests>=2.24.0"
+  '';
+
   pythonImportsCheck = [ "pyflume" ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/pyjwt/default.nix b/pkgs/development/python-modules/pyjwt/default.nix
index c33f2b06808..4617869988f 100644
--- a/pkgs/development/python-modules/pyjwt/default.nix
+++ b/pkgs/development/python-modules/pyjwt/default.nix
@@ -1,28 +1,35 @@
-{ lib, buildPythonPackage, fetchPypi
-, cryptography, ecdsa
-, pytestrunner, pytestcov, pytest }:
+{ lib
+, buildPythonPackage
+, fetchPypi
+, cryptography
+, ecdsa
+, pytest-cov
+, pytestCheckHook
+, pythonOlder
+}:
 
 buildPythonPackage rec {
-  pname = "PyJWT";
-  version = "2.0.1";
+  pname = "pyjwt";
+  version = "2.1.0";
+  disabled = pythonOlder "3.6";
 
   src = fetchPypi {
-    inherit pname version;
-    sha256 = "a5c70a06e1f33d81ef25eecd50d50bd30e34de1ca8b2b9fa3fe0daaabcf69bf7";
+    pname = "PyJWT";
+    inherit version;
+    sha256 = "sha256-+6ROeJi7yhYKKytQH0koJPyDgkhdOm8Rul0MGTfOYTA=";
   };
 
-  propagatedBuildInputs = [ cryptography ecdsa ];
+  propagatedBuildInputs = [
+    cryptography
+    ecdsa
+  ];
 
-  checkInputs = [ pytestrunner pytestcov pytest ];
+  checkInputs = [
+    pytest-cov
+    pytestCheckHook
+  ];
 
-  postPatch = ''
-    substituteInPlace setup.py --replace "pytest>=4.0.1,<5.0.0" "pytest"
-  '';
-
-  # ecdsa changed internal behavior
-  checkPhase = ''
-    pytest tests -k 'not ec_verify_should_return_false_if_signature_invalid'
-  '';
+  pythonImportsCheck = [ "jwt" ];
 
   meta = with lib; {
     description = "JSON Web Token implementation in Python";
diff --git a/pkgs/development/python-modules/snowflake-connector-python/default.nix b/pkgs/development/python-modules/snowflake-connector-python/default.nix
index fdf984563ea..237f36e201b 100644
--- a/pkgs/development/python-modules/snowflake-connector-python/default.nix
+++ b/pkgs/development/python-modules/snowflake-connector-python/default.nix
@@ -1,5 +1,6 @@
-{ buildPythonPackage
-, isPy27
+{ lib
+, buildPythonPackage
+, pythonOlder
 , asn1crypto
 , azure-storage-blob
 , boto3
@@ -10,7 +11,6 @@
 , idna
 , ijson
 , isPy3k
-, lib
 , oscrypto
 , pyarrow
 , pyasn1-modules
@@ -25,20 +25,14 @@
 
 buildPythonPackage rec {
   pname = "snowflake-connector-python";
-  version = "2.4.1";
-  disabled = isPy27;
+  version = "2.4.3";
+  disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "5c9180e61202a7beb1df83231688423091ca0a04ee559d2a78ff77f9c727baae";
+    sha256 = "sha256-+jAfUwaofWM5Ef1kk4AEAbBM/UES8/ZzLd4QJfkEQsM=";
   };
 
-  postPatch = ''
-    substituteInPlace setup.py \
-      --replace "'pyOpenSSL>=16.2.0,<20.0.0'," "'pyOpenSSL'," \
-      --replace 'pytz<2021.0' 'pytz'
-  '';
-
   propagatedBuildInputs = [
     azure-storage-blob
     asn1crypto
@@ -55,16 +49,26 @@ buildPythonPackage rec {
     pytz
     requests
     six
-  ] ++ lib.optionals (!isPy3k) [
     pyarrow
     pyasn1-modules
     urllib3
   ];
 
-  # tests require encrypted secrets, see
+  postPatch = ''
+    # https://github.com/snowflakedb/snowflake-connector-python/issues/705
+    substituteInPlace setup.py \
+      --replace "idna>=2.5,<3" "idna" \
+      --replace "chardet>=3.0.2,<4" "chardet"
+  '';
+
+  # Tests require encrypted secrets, see
   # https://github.com/snowflakedb/snowflake-connector-python/tree/master/.github/workflows/parameters
   doCheck = false;
-  pythonImportsCheck = [ "snowflake" "snowflake.connector" ];
+
+  pythonImportsCheck = [
+    "snowflake"
+    "snowflake.connector"
+  ];
 
   meta = with lib; {
     description = "Snowflake Connector for Python";
diff --git a/pkgs/development/tools/misc/nimlsp/default.nix b/pkgs/development/tools/misc/nimlsp/default.nix
index 7f73fb9a1bc..b1d59c9450a 100644
--- a/pkgs/development/tools/misc/nimlsp/default.nix
+++ b/pkgs/development/tools/misc/nimlsp/default.nix
@@ -16,13 +16,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "nimlsp";
-  version = "0.2.6";
+  version = "0.3.2";
 
   src = fetchFromGitHub {
     owner = "PMunch";
     repo = "nimlsp";
     rev = "v${version}";
-    sha256 = "13kw3zjh0iqymwqxwhyj8jz6hgswwahf1rjd6iad7c6gcwrrg6yl";
+    sha256 = "1lm823nvpp3bj9527jd8n1jxh6y8p8ngkfkj91p94m7ffai6jazq";
   };
 
   nativeBuildInputs = [ nim ];
diff --git a/pkgs/servers/radarr/default.nix b/pkgs/servers/radarr/default.nix
index 47edb29723e..fb5792c6e42 100644
--- a/pkgs/servers/radarr/default.nix
+++ b/pkgs/servers/radarr/default.nix
@@ -9,14 +9,14 @@ let
   }."${stdenv.hostPlatform.system}" or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
 
   hash = {
-    x64-linux_hash = "sha256-bTh+Z5w5ZkL2iPteStqVcoFDGZIbpVjuXn20TZsfgtY=";
-    arm64-linux_hash = "sha256-aIzVSIRuGNiIFJPToXCQwYsbICKuPtwKATnQhkxvJuA=";
-    x64-osx_hash = "sha256-FxRSAJvRQya2x1kei6yRceGcyQ2mCaFveyeMGw0Jqw4=";
+    x64-linux_hash = "sha256-5W4X1E7794hFVPo4+s826CNIrw6Z/n0cDjj6pmsj2Dk=";
+    arm64-linux_hash = "sha256-gqCgToAVIS+IEulFY4mo2Mtcb3nyFpzDBqVEewREQcs=";
+    x64-osx_hash = "sha256-MFpIzSYAvAWVHMdEd+aP67s3po+yb3qWzSd/Ko++5Jc=";
   }."${arch}-${os}_hash";
 
 in stdenv.mkDerivation rec {
   pname = "radarr";
-  version = "3.0.2.4552";
+  version = "3.1.1.4954";
 
   src = fetchurl {
     url = "https://github.com/Radarr/Radarr/releases/download/v${version}/Radarr.master.${version}.${os}-core-${arch}.tar.gz";
diff --git a/pkgs/servers/sql/mariadb/default.nix b/pkgs/servers/sql/mariadb/default.nix
index e70d43a1505..db588b3abe0 100644
--- a/pkgs/servers/sql/mariadb/default.nix
+++ b/pkgs/servers/sql/mariadb/default.nix
@@ -22,14 +22,14 @@ mariadb = server // {
 };
 
 common = rec { # attributes common to both builds
-  version = "10.5.8";
+  version = "10.5.10";
 
   src = fetchurl {
     urls = [
       "https://downloads.mariadb.org/f/mariadb-${version}/source/mariadb-${version}.tar.gz"
       "https://downloads.mariadb.com/MariaDB/mariadb-${version}/source/mariadb-${version}.tar.gz"
     ];
-    sha256 = "1s3vfm73911cddjhgpcbkya6nz7ag2zygg56qqzwscn5ybv28j7b";
+    sha256 = "1fxsq2xgcb8j81z043bifpmxblj6nb3wqjm9rgsnpwmazkwk5zx5";
     name   = "mariadb-${version}.tar.gz";
   };
 
diff --git a/pkgs/servers/sql/mariadb/galera/default.nix b/pkgs/servers/sql/mariadb/galera/default.nix
index 3c13388c460..165b9216240 100644
--- a/pkgs/servers/sql/mariadb/galera/default.nix
+++ b/pkgs/servers/sql/mariadb/galera/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchFromGitHub, buildEnv
-, asio, boost, check, openssl, scons
+, asio, boost, check, openssl, cmake
 }:
 
 let
@@ -10,50 +10,33 @@ let
 
 in stdenv.mkDerivation rec {
   pname = "mariadb-galera";
-  version = "26.4.7";
+  version = "26.4.8";
 
   src = fetchFromGitHub {
     owner = "codership";
     repo = "galera";
     rev = "release_${version}";
-    sha256 = "0h7s670pcasq8wzprhyxqfca2cghi62b8xz2kikb2a86wd453qil";
+    sha256 = "0rx710dfijiykpi41rhxx8vafk07bffv2nbl3d4ggc32rzv88369";
     fetchSubmodules = true;
   };
 
-  buildInputs = [ asio boost check openssl scons ];
-
-  postPatch = ''
-    substituteInPlace SConstruct \
-      --replace "boost_library_path = '''" "boost_library_path = '${boost}/lib'"
-  '';
+  buildInputs = [ asio boost check openssl cmake ];
 
   preConfigure = ''
-    export CPPFLAGS="-I${asio}/include -I${boost.dev}/include -I${check}/include -I${openssl.dev}/include"
-    export LIBPATH="${galeraLibs}/lib"
+    # make sure bundled asio cannot be used, but leave behind license, because it gets installed
+    rm -r asio/{asio,asio.hpp}
   '';
 
-  sconsFlags = "ssl=1 system_asio=1 strict_build_flags=0";
-
-  enableParallelBuilding = true;
-
-  installPhase = ''
-    # copied with modifications from scripts/packages/freebsd.sh
-    GALERA_LICENSE_DIR="$share/licenses/${pname}-${version}"
-    install -d $out/{bin,lib/galera,share/doc/galera,$GALERA_LICENSE_DIR}
-    install -m 555 "garb/garbd"                       "$out/bin/garbd"
-    install -m 444 "libgalera_smm.so"                 "$out/lib/galera/libgalera_smm.so"
-    install -m 444 "scripts/packages/README"          "$out/share/doc/galera/"
-    install -m 444 "scripts/packages/README-MySQL"    "$out/share/doc/galera/"
-    install -m 444 "scripts/packages/freebsd/LICENSE" "$out/$GALERA_LICENSE_DIR"
-    install -m 444 "LICENSE"                          "$out/$GALERA_LICENSE_DIR/GPLv2"
-    install -m 444 "asio/LICENSE_1_0.txt"             "$out/$GALERA_LICENSE_DIR/LICENSE.asio"
+  postInstall = ''
+    # for backwards compatibility
+    ln -s . $out/lib/galera
   '';
 
   meta = with lib; {
     description = "Galera 3 wsrep provider library";
     homepage = "https://galeracluster.com/";
-    license = licenses.lgpl2;
-    maintainers = with maintainers; [ izorkin ];
+    license = licenses.lgpl2Only;
+    maintainers = with maintainers; [ ajs124 izorkin ];
     platforms = platforms.all;
   };
 }
diff --git a/pkgs/tools/admin/lxd/default.nix b/pkgs/tools/admin/lxd/default.nix
index 417e01a325d..f0deb99c44f 100644
--- a/pkgs/tools/admin/lxd/default.nix
+++ b/pkgs/tools/admin/lxd/default.nix
@@ -18,13 +18,13 @@ let
 in
 buildGoPackage rec {
   pname = "lxd";
-  version = "4.13";
+  version = "4.14";
 
   goPackagePath = "github.com/lxc/lxd";
 
   src = fetchurl {
-    url = "https://github.com/lxc/lxd/releases/download/${pname}-${version}/${pname}-${version}.tar.gz";
-    sha256 = "0w2r80wf86jijgfxbkv06lgfhz4p2aaidsqd96bx3q1382nrbzcf";
+    url = "https://linuxcontainers.org/downloads/lxd/lxd-${version}.tar.gz";
+    sha256 = "1x9gv70j333w254jgg1n0kvxpwv6vww0v0i862pglq48xhdaa7hy";
   };
 
   postPatch = ''
diff --git a/pkgs/tools/graphics/agi/default.nix b/pkgs/tools/graphics/agi/default.nix
index 071538d1703..b7cfefe70cb 100644
--- a/pkgs/tools/graphics/agi/default.nix
+++ b/pkgs/tools/graphics/agi/default.nix
@@ -14,11 +14,11 @@
 
 stdenv.mkDerivation rec {
   pname = "agi";
-  version = "1.1.0-dev-20210504";
+  version = "1.1.0-dev-20210506";
 
   src = fetchzip {
     url = "https://github.com/google/agi-dev-releases/releases/download/v${version}/agi-${version}-linux.zip";
-    sha256 = "sha256-q9xWe1gGX7SV/tAUHu/uBB709aqegIsNLTPM5zljgYY=";
+    sha256 = "sha256-VB9AL2h+e+92lhsfdYHbSgv5AIrgEPJsa74VGncDHGo=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/misc/esphome/default.nix b/pkgs/tools/misc/esphome/default.nix
index d2b84b28533..77273f8fd2f 100644
--- a/pkgs/tools/misc/esphome/default.nix
+++ b/pkgs/tools/misc/esphome/default.nix
@@ -8,13 +8,13 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "esphome";
-  version = "1.17.1";
+  version = "1.17.2";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    sha256 = "0483glwi155ca1wnffwhmwn17d7kwk4hjwmckb8zs197rfqmb55v";
+    sha256 = "1md52xzlrzf99s5q2152s1b7yql2h02ss451g68ky207xz660aj1";
   };
 
   postPatch = ''
diff --git a/pkgs/tools/networking/croc/default.nix b/pkgs/tools/networking/croc/default.nix
index 09edbaf7516..e57409fe558 100644
--- a/pkgs/tools/networking/croc/default.nix
+++ b/pkgs/tools/networking/croc/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "croc";
-  version = "9.1.1";
+  version = "9.1.2";
 
   src = fetchFromGitHub {
     owner = "schollz";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-MiTc8uT4FUHqEgE37kZ0pc7y1aK6u+4LqYQ8l1j2jA4=";
+    sha256 = "sha256-7v8vz0n35ATWdmMcM2U7z1sONbmsaWQahHsramivm88=";
   };
 
-  vendorSha256 = "sha256-UGFFzpbBeL4YS3VSjCa31E2fiqND8j3E4FjRflg1NFc=";
+  vendorSha256 = "sha256-IAyiD4v2UEGlWj8oZ0E3YhqyThJTjwjWjOzQKuj6Q9s=";
 
   doCheck = false;
 
diff --git a/pkgs/tools/system/bottom/default.nix b/pkgs/tools/system/bottom/default.nix
index 29c1d6376fe..d96573325b8 100644
--- a/pkgs/tools/system/bottom/default.nix
+++ b/pkgs/tools/system/bottom/default.nix
@@ -33,5 +33,6 @@ rustPlatform.buildRustPackage rec {
     license = licenses.mit;
     maintainers = with maintainers; [ berbiche ];
     platforms = platforms.unix;
+    mainProgram = "btm";
   };
 }
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 7d6ea19d8b5..6c8e2d37456 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -5181,7 +5181,9 @@ in {
 
   prison = callPackage ../development/python-modules/prison { };
 
-  privacyidea-ldap-proxy = callPackage ../development/python-modules/privacyidea/ldap-proxy.nix { };
+  privacyidea = callPackage ../development/python-modules/privacyidea { };
+
+  pyjwt1 = callPackage ../development/python-modules/pyjwt/1.nix { };
 
   proboscis = callPackage ../development/python-modules/proboscis { };
 
diff --git a/pkgs/top-level/python2-packages.nix b/pkgs/top-level/python2-packages.nix
index e21f9034292..9eae7555ea4 100644
--- a/pkgs/top-level/python2-packages.nix
+++ b/pkgs/top-level/python2-packages.nix
@@ -383,7 +383,9 @@ with self; with super; {
 
   prettytable = callPackage ../development/python-modules/prettytable/1.nix { };
 
-  privacyidea = callPackage ../development/python-modules/privacyidea { };
+  privacyidea-ldap-proxy = callPackage ../development/python-modules/privacyidea/ldap-proxy.nix { };
+
+  ldaptor = callPackage ../development/python-modules/ldaptor/19.nix { };
 
   progressbar231 = callPackage ../development/python-modules/progressbar231 { };