diff --git a/nixos/modules/virtualisation/amazon-image.nix b/nixos/modules/virtualisation/amazon-image.nix
index 44cb60809452..819e93a43e57 100644
--- a/nixos/modules/virtualisation/amazon-image.nix
+++ b/nixos/modules/virtualisation/amazon-image.nix
@@ -11,6 +11,7 @@ with lib;
 let
   cfg = config.ec2;
   metadataFetcher = import ./ec2-metadata-fetcher.nix {
+    inherit (pkgs) curl;
     targetRoot = "$targetRoot/";
     wgetExtraOptions = "-q";
   };
diff --git a/nixos/modules/virtualisation/ec2-metadata-fetcher.nix b/nixos/modules/virtualisation/ec2-metadata-fetcher.nix
index b531787c31a2..812e93ec4aab 100644
--- a/nixos/modules/virtualisation/ec2-metadata-fetcher.nix
+++ b/nixos/modules/virtualisation/ec2-metadata-fetcher.nix
@@ -1,23 +1,79 @@
-{ targetRoot, wgetExtraOptions }:
+{ curl, targetRoot, wgetExtraOptions }:
+# Note: be very cautious about dependencies, each dependency grows
+# the closure of the initrd. Ideally we would not even require curl,
+# but there is no reasonable way to send an HTTP PUT request without
+# it. Note: do not be fooled: the wget referenced in this script
+# is busybox's wget, not the fully featured one with --method support.
+#
+# Make sure that every package you depend on here is already listed as
+# a channel blocker for both the full-sized and small channels.
+# Otherwise, we risk breaking user deploys in released channels.
 ''
   metaDir=${targetRoot}etc/ec2-metadata
   mkdir -m 0755 -p "$metaDir"
 
+  get_imds_token() {
+    # retry-delay of 1 selected to give the system a second to get going,
+    # but not add a lot to the bootup time
+    ${curl}/bin/curl \
+      -v \
+      --retry 3 \
+      --retry-delay 1 \
+      --fail \
+      -X PUT \
+      --connect-timeout 1 \
+      -H "X-aws-ec2-metadata-token-ttl-seconds: 600" \
+      http://169.254.169.254/latest/api/token
+  }
+
+  preflight_imds_token() {
+    # retry-delay of 1 selected to give the system a second to get going,
+    # but not add a lot to the bootup time
+    ${curl}/bin/curl \
+      -v \
+      --retry 3 \
+      --retry-delay 1 \
+      --fail \
+      --connect-timeout 1 \
+      -H "X-aws-ec2-metadata-token: $IMDS_TOKEN" \
+      http://169.254.169.254/1.0/meta-data/instance-id
+  }
+
+  try=1
+  while [ $try -le 3 ]; do
+    echo "(attempt $try/3) getting an EC2 instance metadata service v2 token..."
+    IMDS_TOKEN=$(get_imds_token) && break
+    try=$((try + 1))
+    sleep 1
+  done
+
+  if [ "x$IMDS_TOKEN" == "x" ]; then
+    echo "failed to fetch an IMDS2v token."
+  fi
+
+  try=1
+  while [ $try -le 10 ]; do
+    echo "(attempt $try/10) validating the EC2 instance metadata service v2 token..."
+    preflight_imds_token && break
+    try=$((try + 1))
+    sleep 1
+  done
+
   echo "getting EC2 instance metadata..."
 
   if ! [ -e "$metaDir/ami-manifest-path" ]; then
-    wget ${wgetExtraOptions} -O "$metaDir/ami-manifest-path" http://169.254.169.254/1.0/meta-data/ami-manifest-path
+    wget ${wgetExtraOptions} --header "X-aws-ec2-metadata-token: $IMDS_TOKEN" -O "$metaDir/ami-manifest-path" http://169.254.169.254/1.0/meta-data/ami-manifest-path
   fi
 
   if ! [ -e "$metaDir/user-data" ]; then
-    wget ${wgetExtraOptions} -O "$metaDir/user-data" http://169.254.169.254/1.0/user-data && chmod 600 "$metaDir/user-data"
+    wget ${wgetExtraOptions} --header "X-aws-ec2-metadata-token: $IMDS_TOKEN" -O "$metaDir/user-data" http://169.254.169.254/1.0/user-data && chmod 600 "$metaDir/user-data"
   fi
 
   if ! [ -e "$metaDir/hostname" ]; then
-    wget ${wgetExtraOptions} -O "$metaDir/hostname" http://169.254.169.254/1.0/meta-data/hostname
+    wget ${wgetExtraOptions} --header "X-aws-ec2-metadata-token: $IMDS_TOKEN" -O "$metaDir/hostname" http://169.254.169.254/1.0/meta-data/hostname
   fi
 
   if ! [ -e "$metaDir/public-keys-0-openssh-key" ]; then
-    wget ${wgetExtraOptions} -O "$metaDir/public-keys-0-openssh-key" http://169.254.169.254/1.0/meta-data/public-keys/0/openssh-key
+    wget ${wgetExtraOptions} --header "X-aws-ec2-metadata-token: $IMDS_TOKEN" -O "$metaDir/public-keys-0-openssh-key" http://169.254.169.254/1.0/meta-data/public-keys/0/openssh-key
   fi
 ''
diff --git a/nixos/modules/virtualisation/openstack-config.nix b/nixos/modules/virtualisation/openstack-config.nix
index c2da5d0d2301..d01e0f23aba1 100644
--- a/nixos/modules/virtualisation/openstack-config.nix
+++ b/nixos/modules/virtualisation/openstack-config.nix
@@ -3,7 +3,7 @@
 with lib;
 
 let
-  metadataFetcher = import ./ec2-metadata-fetcher.nix {
+  metadataFetcher = import ./openstack-metadata-fetcher.nix {
     targetRoot = "/";
     wgetExtraOptions = "--retry-connrefused";
   };
diff --git a/nixos/modules/virtualisation/openstack-metadata-fetcher.nix b/nixos/modules/virtualisation/openstack-metadata-fetcher.nix
new file mode 100644
index 000000000000..b531787c31a2
--- /dev/null
+++ b/nixos/modules/virtualisation/openstack-metadata-fetcher.nix
@@ -0,0 +1,23 @@
+{ targetRoot, wgetExtraOptions }:
+''
+  metaDir=${targetRoot}etc/ec2-metadata
+  mkdir -m 0755 -p "$metaDir"
+
+  echo "getting EC2 instance metadata..."
+
+  if ! [ -e "$metaDir/ami-manifest-path" ]; then
+    wget ${wgetExtraOptions} -O "$metaDir/ami-manifest-path" http://169.254.169.254/1.0/meta-data/ami-manifest-path
+  fi
+
+  if ! [ -e "$metaDir/user-data" ]; then
+    wget ${wgetExtraOptions} -O "$metaDir/user-data" http://169.254.169.254/1.0/user-data && chmod 600 "$metaDir/user-data"
+  fi
+
+  if ! [ -e "$metaDir/hostname" ]; then
+    wget ${wgetExtraOptions} -O "$metaDir/hostname" http://169.254.169.254/1.0/meta-data/hostname
+  fi
+
+  if ! [ -e "$metaDir/public-keys-0-openssh-key" ]; then
+    wget ${wgetExtraOptions} -O "$metaDir/public-keys-0-openssh-key" http://169.254.169.254/1.0/meta-data/public-keys/0/openssh-key
+  fi
+''
diff --git a/nixos/release-combined.nix b/nixos/release-combined.nix
index d8b9a5f9b4bc..1ef357463a10 100644
--- a/nixos/release-combined.nix
+++ b/nixos/release-combined.nix
@@ -49,6 +49,7 @@ in rec {
         [ "nixos.channel" ]
         (onFullSupported "nixos.dummy")
         (onAllSupported "nixos.iso_minimal")
+        (onAllSupported "nixos.amazonImage")
         (onSystems ["x86_64-linux"] "nixos.iso_plasma5")
         (onSystems ["x86_64-linux"] "nixos.iso_gnome")
         (onFullSupported "nixos.manual")
diff --git a/nixos/release-small.nix b/nixos/release-small.nix
index 6da2c59cedd4..996db54c9a40 100644
--- a/nixos/release-small.nix
+++ b/nixos/release-small.nix
@@ -28,7 +28,7 @@ let
 in rec {
 
   nixos = {
-    inherit (nixos') channel manual options iso_minimal dummy;
+    inherit (nixos') channel manual options iso_minimal amazonImage dummy;
     tests = {
       inherit (nixos'.tests)
         containers-imperative
@@ -92,6 +92,7 @@ in rec {
       [ "nixos.channel"
         "nixos.dummy.x86_64-linux"
         "nixos.iso_minimal.x86_64-linux"
+        "nixos.amazonImage.x86_64-linux"
         "nixos.manual.x86_64-linux"
         "nixos.tests.boot.biosCdrom.x86_64-linux"
         "nixos.tests.containers-imperative.x86_64-linux"
diff --git a/nixos/tests/docker-tools.nix b/nixos/tests/docker-tools.nix
index c1c41b0fc110..a20a08fc90db 100644
--- a/nixos/tests/docker-tools.nix
+++ b/nixos/tests/docker-tools.nix
@@ -234,5 +234,17 @@ import ./make-test-python.nix ({ pkgs, ... }: {
             "docker run --rm file-in-store nix-store --verify --check-contents",
             "docker run --rm file-in-store |& grep 'some data'",
         )
+
+    with subtest("Ensure cross compiled image can be loaded and has correct arch."):
+        docker.succeed(
+            "docker load --input='${pkgs.dockerTools.examples.cross-aarch64}'",
+        )
+        assert (
+            docker.succeed(
+                "docker inspect ${pkgs.dockerTools.examples.cross-aarch64.imageName} "
+                + "| ${pkgs.jq}/bin/jq -r .[].Architecture"
+            ).strip()
+            == "arm64v8"
+        )
   '';
 })
diff --git a/pkgs/applications/networking/instant-messengers/matrix-dl/default.nix b/pkgs/applications/networking/instant-messengers/matrix-dl/default.nix
index 97f775220229..caf6669e120b 100644
--- a/pkgs/applications/networking/instant-messengers/matrix-dl/default.nix
+++ b/pkgs/applications/networking/instant-messengers/matrix-dl/default.nix
@@ -1,14 +1,14 @@
 { lib, python3Packages, fetchFromGitHub }:
 
 python3Packages.buildPythonApplication rec {
-  pname = "matrix-dl-unstable";
-  version = "2019-09-22";
+  pname = "matrix-dl";
+  version = "unstable-2020-07-14";
 
   src = fetchFromGitHub {
     owner = "rubo77";
-    repo = "matrix-dl";
-    rev = "e91610f45b7b3b0aca34923309fc83ba377f8a69";
-    sha256 = "036xfdd21pcfjlilknc67z5jqpk0vz07853wwcsiac32iypc6f2q";
+    repo = pname;
+    rev = "b1a86d1421f39ee327284e1023f09dc165e3c8a5";
+    sha256 = "1l8nh8z7kz24v0wcy3ll3w6in2yxwa1yz8lyc3x0blz37d8ss4ql";
   };
 
   propagatedBuildInputs = with python3Packages; [
diff --git a/pkgs/applications/terminal-emulators/mlterm/default.nix b/pkgs/applications/terminal-emulators/mlterm/default.nix
index e3e8fcd32a5d..9c01430d6dfc 100644
--- a/pkgs/applications/terminal-emulators/mlterm/default.nix
+++ b/pkgs/applications/terminal-emulators/mlterm/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchurl, pkgconfig, autoconf, makeDesktopItem
+{ stdenv, lib, fetchFromGitHub, pkgconfig, autoconf, makeDesktopItem
 , libX11, gdk-pixbuf, cairo, libXft, gtk3, vte
 , harfbuzz #substituting glyphs with opentype fonts
 , fribidi, m17n_lib #bidi and encoding
@@ -12,9 +12,11 @@ stdenv.mkDerivation rec {
   pname = "mlterm";
   version = "3.9.1";
 
-  src = fetchurl {
-    url = "mirror://sourceforge/project/mlterm/01release/${pname}-${version}/${pname}-${version}.tar.gz";
-    sha256 = "03fnynwv7d1aicwk2rp31sgncv5m65agvygqvsgn59v9di40gnnb";
+  src = fetchFromGitHub {
+    owner = "arakiken";
+    repo = pname;
+    rev = "rel-${lib.replaceStrings [ "." ] [ "_" ] version}"; # 3.9.1 -> rel-3_9_1
+    sha256 = "1hh196kz2n3asv8r8r2bdk5b2w93zq7rw4880ciiq1554h0ib7fj";
   };
 
   nativeBuildInputs = [ pkgconfig autoconf wrapGAppsHook ];
diff --git a/pkgs/applications/version-management/mercurial/default.nix b/pkgs/applications/version-management/mercurial/default.nix
index c7a1c4149870..e0400fd46c65 100644
--- a/pkgs/applications/version-management/mercurial/default.nix
+++ b/pkgs/applications/version-management/mercurial/default.nix
@@ -4,26 +4,24 @@
 }:
 
 let
-  inherit (python3Packages) docutils dulwich python;
+  inherit (python3Packages) docutils python;
 
 in python3Packages.buildPythonApplication rec {
   pname = "mercurial";
-  version = "5.4.2";
+  version = "5.6";
 
   src = fetchurl {
     url = "https://mercurial-scm.org/release/mercurial-${version}.tar.gz";
-    sha256 = "0ls8nwx3nz26pibphw54fg8pxqb365zmmqx95lqrxqqyf3d972sw";
+    sha256 = "1hk2y30zzdnlv8f71kabvh0xi9c7qhp28ksh20vpd0r712sv79yz";
   };
 
   format = "other";
 
-  inherit python; # pass it so that the same version can be used in hg2git
+  passthru = { inherit python; }; # pass it so that the same version can be used in hg2git
 
   buildInputs = [ makeWrapper docutils unzip ]
     ++ stdenv.lib.optionals stdenv.isDarwin [ ApplicationServices ];
 
-  propagatedBuildInputs = [ dulwich ];
-
   makeFlags = [ "PREFIX=$(out)" ];
 
   postInstall = (stdenv.lib.optionalString guiSupport ''
diff --git a/pkgs/build-support/docker/default.nix b/pkgs/build-support/docker/default.nix
index ba76ce2b817d..e4e8f794bc4c 100644
--- a/pkgs/build-support/docker/default.nix
+++ b/pkgs/build-support/docker/default.nix
@@ -31,6 +31,7 @@
   writeScript,
   writeText,
   writePython3,
+  system,  # Note: This is the cross system we're compiling for
 }:
 
 # WARNING: this API is unstable and may be subject to backwards-incompatible changes in the future.
@@ -48,7 +49,7 @@ let
     # A user is required by nix
     # https://github.com/NixOS/nix/blob/9348f9291e5d9e4ba3c4347ea1b235640f54fd79/src/libutil/util.cc#L478
     export USER=nobody
-    ${nix}/bin/nix-store --load-db < ${closureInfo {rootPaths = contentsList;}}/registration
+    ${buildPackages.nix}/bin/nix-store --load-db < ${closureInfo {rootPaths = contentsList;}}/registration
 
     mkdir -p nix/var/nix/gcroots/docker/
     for i in ${lib.concatStringsSep " " contentsList}; do
@@ -56,6 +57,16 @@ let
     done;
   '';
 
+  # Map nixpkgs architecture to Docker notation
+  # Reference: https://github.com/docker-library/official-images#architectures-other-than-amd64
+  getArch = nixSystem: {
+    aarch64-linux = "arm64v8";
+    armv7l-linux = "arm32v7";
+    x86_64-linux = "amd64";
+    powerpc64le-linux = "ppc64le";
+    i686-linux = "i386";
+  }.${nixSystem} or "Can't map Nix system ${nixSystem} to Docker architecture notation. Please check that your input and your requested build are correct or update the mapping in Nixpkgs.";
+
 in
 rec {
 
@@ -72,7 +83,7 @@ rec {
     , imageDigest
     , sha256
     , os ? "linux"
-    , arch ? buildPackages.go.GOARCH
+    , arch ? getArch system
 
       # This is used to set name to the pulled image
     , finalImageName ? imageName
@@ -443,7 +454,7 @@ rec {
       runCommand "${name}.tar.gz" {
         inherit (stream) imageName;
         passthru = { inherit (stream) imageTag; };
-        buildInputs = [ pigz ];
+        nativeBuildInputs = [ pigz ];
       } "${stream} | pigz -nT > $out";
 
   # 1. extract the base image
@@ -488,7 +499,7 @@ rec {
       baseJson = let
           pure = writeText "${baseName}-config.json" (builtins.toJSON {
             inherit created config;
-            architecture = buildPackages.go.GOARCH;
+            architecture = getArch system;
             os = "linux";
           });
           impure = runCommand "${baseName}-config.json"
@@ -715,7 +726,7 @@ rec {
       streamScript = writePython3 "stream" {} ./stream_layered_image.py;
       baseJson = writeText "${name}-base.json" (builtins.toJSON {
          inherit config;
-         architecture = buildPackages.go.GOARCH;
+         architecture = getArch system;
          os = "linux";
       });
 
@@ -762,7 +773,7 @@ rec {
             else
               lib.head (lib.strings.splitString "-" (baseNameOf conf.outPath));
         paths = referencesByPopularity overallClosure;
-        buildInputs = [ jq ];
+        nativeBuildInputs = [ jq ];
       } ''
         ${if (tag == null) then ''
           outName="$(basename "$out")"
@@ -826,7 +837,7 @@ rec {
           # take images can know in advance how the image is supposed to be used.
           isExe = true;
         };
-        buildInputs = [ makeWrapper ];
+        nativeBuildInputs = [ makeWrapper ];
       } ''
         makeWrapper ${streamScript} $out --add-flags ${conf}
       '';
diff --git a/pkgs/build-support/docker/examples.nix b/pkgs/build-support/docker/examples.nix
index 4a611add8a12..cd91c721241b 100644
--- a/pkgs/build-support/docker/examples.nix
+++ b/pkgs/build-support/docker/examples.nix
@@ -7,7 +7,7 @@
 #  $ nix-build '<nixpkgs>' -A dockerTools.examples.redis
 #  $ docker load < result
 
-{ pkgs, buildImage, pullImage, shadowSetup, buildImageWithNixDb }:
+{ pkgs, buildImage, pullImage, shadowSetup, buildImageWithNixDb, pkgsCross }:
 
 rec {
   # 1. basic example
@@ -407,4 +407,11 @@ rec {
       contents = [ pkgs.bash pkgs.coreutils ] ++ nonRootShadowSetup { uid = 999; user = "somebody"; };
     };
 
+  # basic example, with cross compilation
+  cross-aarch64 = pkgsCross.aarch64-multiplatform.dockerTools.buildImage {
+    name = "hello-cross";
+    tag = "latest";
+    contents = pkgsCross.aarch64-multiplatform.hello;
+  };
+
 }
diff --git a/pkgs/development/interpreters/cling/default.nix b/pkgs/development/interpreters/cling/default.nix
new file mode 100644
index 000000000000..68819fa7ab06
--- /dev/null
+++ b/pkgs/development/interpreters/cling/default.nix
@@ -0,0 +1,102 @@
+{ stdenv
+, python
+, libffi
+, git
+, cmake
+, zlib
+, fetchgit
+, makeWrapper
+, runCommand
+, runCommandNoCC
+, llvmPackages_5
+, glibc
+}:
+
+let
+  unwrapped = stdenv.mkDerivation rec {
+    pname = "cling-unwrapped";
+    version = "0.7";
+
+    src = fetchgit {
+      url = "http://root.cern/git/clang.git";
+      # This commit has the tag cling-0.7 so we use it, even though cpt.py
+      # tries to use refs/tags/cling-patches-rrelease_50
+      rev = "354b25b5d915ff3b1946479ad07f3f2768ea1621";
+      branchName = "cling-patches";
+      sha256 = "0q8q2nnvjx3v59ng0q3qqqhzmzf4pmfqqiy3rz1f3drx5w3lgyjg";
+    };
+
+    clingSrc = fetchgit {
+      url = "http://root.cern/git/cling.git";
+      rev = "70163975eee5a76b45a1ca4016bfafebc9b57e07";
+      sha256 = "1mv2fhk857kp5rq714bq49iv7gy9fgdwibydj5wy1kq2m3sf3ysi";
+    };
+
+    preConfigure = ''
+      echo "add_llvm_external_project(cling)" >> tools/CMakeLists.txt
+      cp -r $clingSrc ./tools/cling
+      chmod -R a+w ./tools/cling
+    '';
+
+    nativeBuildInputs = [ python git cmake ];
+    buildInputs = [ libffi llvmPackages_5.llvm zlib ];
+
+    cmakeFlags = [
+      "-DLLVM_TARGETS_TO_BUILD=host;NVPTX"
+      "-DLLVM_ENABLE_RTTI=ON"
+
+      # Setting -DCLING_INCLUDE_TESTS=ON causes the cling/tools targets to be built;
+      # see cling/tools/CMakeLists.txt
+      "-DCLING_INCLUDE_TESTS=ON"
+    ];
+
+    meta = with stdenv.lib; {
+      description = "The Interactive C++ Interpreter";
+      homepage = "https://root.cern/cling/";
+      license = with licenses; [ lgpl21 ncsa ];
+      maintainers = with maintainers; [ thomasjm ];
+      platforms = platforms.unix;
+    };
+  };
+
+  # The flags passed to the wrapped cling should
+  # a) prevent it from searching for system include files and libs, and
+  # b) provide it with the include files and libs it needs (C and C++ standard library)
+
+  # These are also exposed as cling.flags/cling.compilerIncludeFlags because it's handy to be
+  # able to pass them to tools that wrap Cling, particularly Jupyter kernels such as xeus-cling
+  # and the built-in jupyter-cling-kernel. Both of these use Cling as a library by linking against
+  # libclingJupyter.so, so the makeWrapper approach to wrapping the binary doesn't work.
+  # Thus, if you're packaging a Jupyter kernel, you either need to pass these flags as extra
+  # args to xcpp (for xeus-cling) or put them in the environment variable CLING_OPTS
+  # (for jupyter-cling-kernel)
+  flags = [
+    "-nostdinc"
+    "-nostdinc++"
+    "-isystem" "${glibc.dev}/include"
+    "-I" "${unwrapped}/include"
+    "-I" "${unwrapped}/lib/clang/5.0.2/include"
+  ];
+
+  # Autodetect the include paths for the compiler used to build Cling, in the same way Cling does at
+  # https://github.com/root-project/cling/blob/v0.7/lib/Interpreter/CIFactory.cpp#L107:L111
+  # Note: it would be nice to just put the compiler in Cling's PATH and let it do this by itself, but
+  # unfortunately passing -nostdinc/-nostdinc++ disables Cling's autodetection logic.
+  compilerIncludeFlags = runCommandNoCC "compiler-include-flags.txt" {} ''
+    export LC_ALL=C
+    ${stdenv.cc}/bin/c++ -xc++ -E -v /dev/null 2>&1 | sed -n -e '/^.include/,''${' -e '/^ \/.*++/p' -e '}' > tmp
+    sed -e 's/^/-isystem /' -i tmp
+    tr '\n' ' ' < tmp > $out
+  '';
+
+in
+
+runCommand "cling-${unwrapped.version}" {
+  buildInputs = [ makeWrapper ];
+  inherit unwrapped flags compilerIncludeFlags;
+  inherit (unwrapped) meta;
+} ''
+  makeWrapper $unwrapped/bin/cling $out/bin/cling \
+    --add-flags "$(cat "$compilerIncludeFlags")" \
+    --add-flags "$flags"
+''
diff --git a/pkgs/development/python-modules/aiokafka/default.nix b/pkgs/development/python-modules/aiokafka/default.nix
index c6cfe99297b0..ba32976b96b1 100644
--- a/pkgs/development/python-modules/aiokafka/default.nix
+++ b/pkgs/development/python-modules/aiokafka/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "aiokafka";
-  version = "0.6.0";
+  version = "0.7.0";
 
   disabled = isPy27;
 
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "aio-libs";
     repo = "aiokafka";
     rev = "v${version}";
-    sha256 = "1l5nkz9blmfrbsj7m76vm8vcfdgvab33anzpq62384scp9yf8dln";
+    sha256 = "16pcgv38syqy6sj3w7zx95zgynpd642n3i95dpiw0ivhpqrxxhrf";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/alerta-server/default.nix b/pkgs/development/python-modules/alerta-server/default.nix
index dd3e4ab1b116..f8a3b9684805 100644
--- a/pkgs/development/python-modules/alerta-server/default.nix
+++ b/pkgs/development/python-modules/alerta-server/default.nix
@@ -4,11 +4,11 @@
 
 buildPythonPackage rec {
   pname = "alerta-server";
-  version = "8.0.3";
+  version = "8.1.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "894d240c51428225264867a80094b9743d71272635a18ddfefa5832b61fed2c6";
+    sha256 = "32a97eee95aea5527f6efa844c18b727fe4a6d61356ea3c0769a29a163ddcb7e";
   };
 
   propagatedBuildInputs = [
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     pymongo
     python-dateutil
     pytz
-    pyyaml  
+    pyyaml
     requests
     requests-hawk
     sentry-sdk
diff --git a/pkgs/development/python-modules/asana/default.nix b/pkgs/development/python-modules/asana/default.nix
index 7c08cf1acbbc..71c003ef9b0a 100644
--- a/pkgs/development/python-modules/asana/default.nix
+++ b/pkgs/development/python-modules/asana/default.nix
@@ -4,7 +4,7 @@
 
 buildPythonPackage rec {
   pname = "asana";
-  version = "0.8.2";
+  version = "0.10.3";
 
   # upstream reportedly doesn't support 3.7 yet, blocked on
   # https://bugs.python.org/issue34226
@@ -14,7 +14,7 @@ buildPythonPackage rec {
     owner = "asana";
     repo = "python-asana";
     rev = "v${version}";
-    sha256 = "113zwnrpim1pdw8dzid2wpp5gzr2zk26jjl4wrwhgj0xk1cw94yi";
+    sha256 = "11nsfygcfpc2qb2gy4npi9w00cqfh88g7k3rsfq7xambz1zjdz1n";
   };
 
   checkInputs = [ pytest responses ];
diff --git a/pkgs/development/python-modules/littleutils/default.nix b/pkgs/development/python-modules/littleutils/default.nix
new file mode 100644
index 000000000000..ea490f19fe5d
--- /dev/null
+++ b/pkgs/development/python-modules/littleutils/default.nix
@@ -0,0 +1,25 @@
+{ buildPythonPackage
+, fetchPypi
+, lib
+}:
+
+buildPythonPackage rec {
+  pname = "littleutils";
+  version = "0.2.2";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "0vwijrylppmk0nbddqvn527r9cg3zw8d6zk6r58hslry42jf7jp6";
+  };
+
+  # This tiny package has no unit tests at all
+  doCheck = false;
+  pythonImportsCheck = [ "littleutils" ];
+
+  meta = with lib; {
+    description = "Small collection of Python utility functions";
+    homepage = "https://github.com/alexmojaki/littleutils";
+    license = licenses.mit;
+    maintainers = with maintainers; [ jluttine ];
+  };
+}
diff --git a/pkgs/development/python-modules/stack-data/default.nix b/pkgs/development/python-modules/stack-data/default.nix
new file mode 100644
index 000000000000..71f114e3528b
--- /dev/null
+++ b/pkgs/development/python-modules/stack-data/default.nix
@@ -0,0 +1,54 @@
+{ asttokens
+, buildPythonPackage
+, executing
+, fetchFromGitHub
+, git
+, lib
+, littleutils
+, pure-eval
+, pygments
+, pytestCheckHook
+, setuptools_scm
+, toml
+, typeguard
+}:
+
+buildPythonPackage rec {
+  pname = "stack_data";
+  version = "0.0.7";
+
+  src = fetchFromGitHub {
+    owner = "alexmojaki";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "148lhxihak8jm5dvryhsiykmn3s4mrlba8ki4dy1nbd8jnz06a4w";
+  };
+
+  SETUPTOOLS_SCM_PRETEND_VERSION = version;
+
+  nativeBuildInputs = [
+    git
+    setuptools_scm
+    toml
+  ];
+
+  propagatedBuildInputs = [
+    asttokens
+    executing
+    pure-eval
+  ];
+
+  checkInputs = [
+    littleutils
+    pygments
+    pytestCheckHook
+    typeguard
+  ];
+
+  meta = with lib; {
+    description = "Extract data from stack frames and tracebacks";
+    homepage = "https://github.com/alexmojaki/stack_data/";
+    license = licenses.mit;
+    maintainers = with maintainers; [ jluttine ];
+  };
+}
diff --git a/pkgs/development/tools/misc/blackfire/php-probe.nix b/pkgs/development/tools/misc/blackfire/php-probe.nix
index a14f5b0edb6b..8a02f6157304 100644
--- a/pkgs/development/tools/misc/blackfire/php-probe.nix
+++ b/pkgs/development/tools/misc/blackfire/php-probe.nix
@@ -17,11 +17,11 @@ let
   }.${lib.versions.majorMinor php.version} or (throw "Unsupported PHP version.");
 in stdenv.mkDerivation rec {
   pname = "php-blackfire";
-  version = "1.43.0";
+  version = "1.44.0";
 
   src = fetchurl {
     url = "https://packages.blackfire.io/debian/pool/any/main/b/blackfire-php/blackfire-php_${version}_amd64.deb";
-    sha256 = "1038qbpqkamd51ip25z6fbbz69faggahhdw75lnsd8prrwjcpli7";
+    sha256 = "15y1244bbs07i7rg6cy8kynp1may4mbkmmwbxgq8q5zma3ldc8ci";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/os-specific/linux/microcode/intel.nix b/pkgs/os-specific/linux/microcode/intel.nix
index 19487fb70587..50055102dbbe 100644
--- a/pkgs/os-specific/linux/microcode/intel.nix
+++ b/pkgs/os-specific/linux/microcode/intel.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "microcode-intel";
-  version = "20201112";
+  version = "20201118";
 
   src = fetchFromGitHub {
     owner = "intel";
     repo = "Intel-Linux-Processor-Microcode-Data-Files";
     rev = "microcode-${version}";
-    sha256 = "104l3py5z6405wpa2fscqpc5r9dgrf1ckaf27hrswivi32gvp7f2";
+    sha256 = "1xs3f2rbfqnpz9qs7a1kl363qdyb8fybmmyd37v573clqf7l4lgg";
   };
 
   nativeBuildInputs = [ iucode-tool libarchive ];
diff --git a/pkgs/servers/asterisk/default.nix b/pkgs/servers/asterisk/default.nix
index aa4b2a64150e..9a393cdeb009 100644
--- a/pkgs/servers/asterisk/default.nix
+++ b/pkgs/servers/asterisk/default.nix
@@ -98,15 +98,15 @@ in rec {
   # Series  Type       Rel. Date   Sec. Fixes  EOL
   # 13.x    LTS        2014-10-24  2020-10-24  2021-10-24
   # 16.x    LTS        2018-10-09  2022-10-09  2023-10-09
+  # 17.x    Standard   2019-10-28  2020-10-28  2021-10-28
   # 18.x    LTS        2020-10-20  2024-10-20  2025-10-20
   asterisk-lts = asterisk_18;
-  # 17.x    Standard   2019-10-28  2020-10-28  2021-10-28
   asterisk-stable = asterisk_18;
   asterisk = asterisk_18;
 
   asterisk_13 = common {
-    version = "13.37.1";
-    sha256 = "1zc3104zw4y7i8bhhgrgy3snq0zr1904p64ykfc3ldh4xyfy3ld6";
+    version = "13.38.0";
+    sha256 = "1kxff6pbry8nydkspi0mqllidz2lw3d3g3r127x8jwgx021x0rik";
     externals = {
       "externals_cache/pjproject-2.10.tar.bz2" = pjproject_2_10;
       "addons/mp3" = mp3-202;
@@ -114,8 +114,8 @@ in rec {
   };
 
   asterisk_16 = common {
-    version = "16.14.1";
-    sha256 = "1lhh3npyy8hvy29jwjgapnxfjv1ahp2qdi4iq1d6a61ffhd20vfs";
+    version = "16.15.0";
+    sha256 = "12nc7ywm6w1xyn720kdc1sqz5wkjjrkxr25wisl02f4v5wz8py7m";
     externals = {
       "externals_cache/pjproject-2.10.tar.bz2" = pjproject_2_10;
       "addons/mp3" = mp3-202;
@@ -123,8 +123,8 @@ in rec {
   };
 
   asterisk_17 = common {
-    version = "17.8.1";
-    sha256 = "0m7gw01kpvsc0f9lb1hiq5b4g1fdh4gdfyxlqxp6m37vgxh2a48p";
+    version = "17.9.0";
+    sha256 = "1fnm1z7g45m883ivkm36r4kqb7163bzazi70mwf0fc2rc28jd1z4";
     externals = {
       "externals_cache/pjproject-2.10.tar.bz2" = pjproject_2_10;
       "addons/mp3" = mp3-202;
@@ -132,8 +132,8 @@ in rec {
   };
 
   asterisk_18 = common {
-    version = "18.0.1";
-    sha256 = "1kyly10pk7bpfqg3mjbvb8p795fnj9lvd29yp2xsxwgsqi1dn9p8";
+    version = "18.1.0";
+    sha256 = "1pq2nrf60xnvh2h1rv82bdfbxxxd277g68xas0vbfgr4531gc4nc";
     externals = {
       "externals_cache/pjproject-2.10.tar.bz2" = pjproject_2_10;
       "addons/mp3" = mp3-202;
diff --git a/pkgs/servers/dns/bind/default.nix b/pkgs/servers/dns/bind/default.nix
index 16d031d49fea..61ab6f98d21c 100644
--- a/pkgs/servers/dns/bind/default.nix
+++ b/pkgs/servers/dns/bind/default.nix
@@ -22,6 +22,11 @@ stdenv.mkDerivation rec {
   patches = [
     ./dont-keep-configure-flags.patch
     ./remove-mkdir-var.patch
+    # Fix cross-compilation (will be included in next release after 9.16.8)
+    (fetchpatch {
+      url = "https://gitlab.isc.org/isc-projects/bind9/-/commit/35ca6df07277adff4df7472a0b01ea5438cdf1ff.patch";
+      sha256 = "1sj0hcd0wgkam7hrbp2vw2yymmni4azr9ixd9shz1l6ja90bdj9h";
+    })
   ];
 
   nativeBuildInputs = [ perl pkg-config ];
diff --git a/pkgs/servers/mail/postfix/default.nix b/pkgs/servers/mail/postfix/default.nix
index a4346bdbd2b1..694d7044b8a2 100644
--- a/pkgs/servers/mail/postfix/default.nix
+++ b/pkgs/servers/mail/postfix/default.nix
@@ -26,11 +26,11 @@ in stdenv.mkDerivation rec {
 
   pname = "postfix";
 
-  version = "3.5.7";
+  version = "3.5.8";
 
   src = fetchurl {
     url = "ftp://ftp.cs.uu.nl/mirror/postfix/postfix-release/official/${pname}-${version}.tar.gz";
-    sha256 = "0q89iwan5yd84yrzdv3sqg1zanmw56bl2f5gyv5wfg8m9vqp995p";
+    sha256 = "0vs50z5p5xcrdbbkb0dnbx1sk5fx8d2z97sw2p2iip1yrwl2cn12";
   };
 
   nativeBuildInputs = [ makeWrapper m4 ];
diff --git a/pkgs/tools/networking/mailutils/default.nix b/pkgs/tools/networking/mailutils/default.nix
index adcd2f1dc131..ff7d4176bd2e 100644
--- a/pkgs/tools/networking/mailutils/default.nix
+++ b/pkgs/tools/networking/mailutils/default.nix
@@ -3,13 +3,12 @@
 , python3, gss, libmysqlclient, system-sendmail }:
 
 stdenv.mkDerivation rec {
-  name = "${project}-${version}";
-  project = "mailutils";
-  version = "3.9";
+  pname = "mailutils";
+  version = "3.10";
 
   src = fetchurl {
-    url = "mirror://gnu/${project}/${name}.tar.xz";
-    sha256 = "1g1xf2lal04nsnf1iym9n9n0wxjpqbcr9nysxpm98v4pniinqwsz";
+    url = "mirror://gnu/${pname}/${pname}-${version}.tar.xz";
+    sha256 = "17smrxjdgbbzbzakik30vj46q4iib85ksqhb82jr4vjp57akszh9";
   };
 
   postPatch = ''
@@ -32,6 +31,18 @@ stdenv.mkDerivation rec {
   patches = [
     ./fix-build-mb-len-max.patch
     ./path-to-cat.patch
+    # mailquota.c:277: undefined reference to `get_size'
+    # https://lists.gnu.org/archive/html/bug-mailutils/2020-08/msg00002.html
+    (fetchpatch {
+      url = "http://git.savannah.gnu.org/cgit/mailutils.git/patch/?id=37713b42a501892469234b90454731d8d8b7a3e6";
+      sha256 = "1mwj77nxvf4xvqf26yjs59jyksnizj0lmbymbzg4kmqynzq3zjny";
+    })
+    # Fix cross-compilation
+    # https://lists.gnu.org/archive/html/bug-mailutils/2020-11/msg00038.html
+    (fetchpatch {
+      url = "https://lists.gnu.org/archive/html/bug-mailutils/2020-11/txtiNjqcNpqOk.txt";
+      sha256 = "0ghzqb8qx2q8cffbvqzw19mivv7r5f16whplzhm7hdj0j2i6xf6s";
+    })
   ];
 
   enableParallelBuilding = false;
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index a5f21c65fc85..98929c26ec77 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -239,7 +239,7 @@ in
   grsync = callPackage ../applications/misc/grsync { };
 
   dockerTools = callPackage ../build-support/docker {
-    writePython3 = writers.writePython3;
+    writePython3 = buildPackages.writers.writePython3;
   };
 
   snapTools = callPackage ../build-support/snap { };
@@ -10189,6 +10189,8 @@ in
 
   ceptre = callPackage ../development/interpreters/ceptre { };
 
+  cling = callPackage ../development/interpreters/cling { };
+
   clips = callPackage ../development/interpreters/clips { };
 
   clisp = callPackage ../development/interpreters/clisp { };
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index d74d95f17f4c..015d27c56608 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -3517,6 +3517,8 @@ in {
 
   lirc = disabledIf isPy27 (toPythonModule (pkgs.lirc.override { python3 = python; }));
 
+  littleutils = callPackage ../development/python-modules/littleutils { };
+
   livelossplot = callPackage ../development/python-modules/livelossplot { };
 
   livereload = callPackage ../development/python-modules/livereload { };
@@ -6926,6 +6928,8 @@ in {
 
   sslyze = callPackage ../development/python-modules/sslyze { };
 
+  stack-data = callPackage ../development/python-modules/stack-data { };
+
   starlette = callPackage ../development/python-modules/starlette { };
 
   staticjinja = callPackage ../development/python-modules/staticjinja { };