diff --git a/nixos/modules/installer/cd-dvd/iso-image.nix b/nixos/modules/installer/cd-dvd/iso-image.nix
index 1418420afcd9..7a4738599b01 100644
--- a/nixos/modules/installer/cd-dvd/iso-image.nix
+++ b/nixos/modules/installer/cd-dvd/iso-image.nix
@@ -162,12 +162,14 @@ let
   isolinuxCfg = concatStringsSep "\n"
     ([ baseIsolinuxCfg ] ++ optional config.boot.loader.grub.memtest86.enable isolinuxMemtest86Entry);
 
+  refindBinary = if targetArch == "x64" || targetArch == "aa64" then "refind_${targetArch}.efi" else null;
+
   # Setup instructions for rEFInd.
   refind =
-    if targetArch == "x64" then
+    if refindBinary != null then
       ''
       # Adds rEFInd to the ISO.
-      cp -v ${pkgs.refind}/share/refind/refind_x64.efi $out/EFI/boot/
+      cp -v ${pkgs.refind}/share/refind/${refindBinary} $out/EFI/boot/
       ''
     else
       "# No refind for ${targetArch}"
@@ -186,7 +188,10 @@ let
 
     # Fonts can be loaded?
     # (This font is assumed to always be provided as a fallback by NixOS)
-    if loadfont (hd0)/EFI/boot/unicode.pf2; then
+    if loadfont /EFI/boot/unicode.pf2; then
+      set with_fonts=true
+    fi
+    if [ "\$textmode" != "true" -a "\$with_fonts" == "true" ]; then
       # Use graphical term, it can be either with background image or a theme.
       # input is "console", while output is "gfxterm".
       # This enables "serial" input and output only when possible.
@@ -207,11 +212,11 @@ let
     ${ # When there is a theme configured, use it, otherwise use the background image.
     if config.isoImage.grubTheme != null then ''
       # Sets theme.
-      set theme=(hd0)/EFI/boot/grub-theme/theme.txt
+      set theme=/EFI/boot/grub-theme/theme.txt
       # Load theme fonts
-      $(find ${config.isoImage.grubTheme} -iname '*.pf2' -printf "loadfont (hd0)/EFI/boot/grub-theme/%P\n")
+      $(find ${config.isoImage.grubTheme} -iname '*.pf2' -printf "loadfont /EFI/boot/grub-theme/%P\n")
     '' else ''
-      if background_image (hd0)/EFI/boot/efi-background.png; then
+      if background_image /EFI/boot/efi-background.png; then
         # Black background means transparent background when there
         # is a background image set... This seems undocumented :(
         set color_normal=black/black
@@ -264,6 +269,8 @@ let
 
     cat <<EOF > $out/EFI/boot/grub.cfg
 
+    set with_fonts=false
+    set textmode=false
     # If you want to use serial for "terminal_*" commands, you need to set one up:
     #   Example manual configuration:
     #    → serial --unit=0 --speed=115200 --word=8 --parity=no --stop=1
@@ -273,8 +280,28 @@ let
     export with_serial
     clear
     set timeout=10
+
+    # This message will only be viewable when "gfxterm" is not used.
+    echo ""
+    echo "Loading graphical boot menu..."
+    echo ""
+    echo "Press 't' to use the text boot menu on this console..."
+    echo ""
+
     ${grubMenuCfg}
 
+    hiddenentry 'Text mode' --hotkey 't' {
+      loadfont /EFI/boot/unicode.pf2
+      set textmode=true
+      terminal_output gfxterm console
+    }
+    hiddenentry 'GUI mode' --hotkey 'g' {
+      $(find ${config.isoImage.grubTheme} -iname '*.pf2' -printf "loadfont /EFI/boot/grub-theme/%P\n")
+      set textmode=false
+      terminal_output gfxterm
+    }
+
+
     # If the parameter iso_path is set, append the findiso parameter to the kernel
     # line. We need this to allow the nixos iso to be booted from grub directly.
     if [ \''${iso_path} ] ; then
@@ -337,11 +364,15 @@ let
       }
     }
 
-    menuentry 'rEFInd' --class refind {
-      # UUID is hard-coded in the derivation.
-      search --set=root --no-floppy --fs-uuid 1234-5678
-      chainloader (\$root)/EFI/boot/refind_x64.efi
-    }
+    ${lib.optionalString (refindBinary != null) ''
+    # GRUB apparently cannot do "chainloader" operations on "CD".
+    if [ "\$root" != "cd0" ]; then
+      menuentry 'rEFInd' --class refind {
+        # \$root defaults to the drive the EFI is found on.
+        chainloader (\$root)/EFI/boot/${refindBinary}
+      }
+    fi
+    ''}
     menuentry 'Firmware Setup' --class settings {
       fwsetup
       clear
diff --git a/pkgs/applications/audio/audacity/default.nix b/pkgs/applications/audio/audacity/default.nix
index 36320a01061f..1bbed0613c8e 100644
--- a/pkgs/applications/audio/audacity/default.nix
+++ b/pkgs/applications/audio/audacity/default.nix
@@ -28,6 +28,7 @@
 , ffmpeg
 , soundtouch
 , pcre /*, portaudio - given up fighting their portaudio.patch */
+, linuxHeaders
 , at-spi2-core ? null
 , dbus ? null
 , epoxy ? null
@@ -41,24 +42,35 @@
 }:
 
 # TODO
-# - as of 2.4.2, GTK2 is still the recommended version ref https://www.audacityteam.org/download/source/ check if that changes in future versions
+# - as of 3.0.2, GTK2 is still the recommended version ref https://www.audacityteam.org/download/source/ check if that changes in future versions
 # - detach sbsms
 
+let
+  wxGTK-audacity = wxGTK.overrideAttrs (oldAttrs: rec {
+    src = fetchFromGitHub {
+      owner = "audacity";
+      repo = "wxWidgets";
+      rev = "07e7d832c7a337aedba3537b90b2c98c4d8e2985";
+      sha256 = "1mawnkcrmqj98jp0jxlnh9xkc950ca033ccb51c7035pzmi9if9a";
+      fetchSubmodules = true;
+    };
+  });
+in
 stdenv.mkDerivation rec {
   pname = "audacity";
-  version = "2.4.2";
+  version = "3.0.2";
 
   src = fetchFromGitHub {
     owner = "audacity";
     repo = "audacity";
     rev = "Audacity-${version}";
-    sha256 = "sha256-hpRTo5B0EMyzORopsNPOgv6mohBkwJfWfCLnPvFmdFI=";
+    sha256 = "035qq2ff16cdl2cb9iply2bfjmhfl1dpscg79x6c9l0i9m8k41zj";
   };
 
   patches = [
     (fetchpatch {
-      url = "https://github.com/audacity/audacity/commit/a070b5d8a8ba10fb86edba6aeb8fdab0f66ba408.patch";
-      sha256 = "sha256-8UZupGcN+/tytAhyy5T1P0nufvsQPeyLgOUMGt7l8Oc=";
+      url = "https://github.com/audacity/audacity/commit/007852e51fcbb5f1f359d112f28b8984a604dac6.patch";
+      sha256 = "0zp2iydd46analda9cfnbmzdkjphz5m7dynrdj5qdnmq6j3px9fw";
       name = "audacity_xdg_paths.patch";
     })
   ];
@@ -68,6 +80,10 @@ stdenv.mkDerivation rec {
     touch src/RevisionIdent.h
   '';
 
+  preConfigure = ''
+    substituteInPlace src/FileNames.cpp --replace /usr/include/linux/magic.h ${linuxHeaders}/include/linux/magic.h
+  '';
+
   # workaround for a broken cmake. Drop it with a later version to see if it works.
   # https://github.com/NixOS/nixpkgs/issues/94905
   cmakeFlags = lib.optional stdenv.isLinux "-DCMAKE_OSX_ARCHITECTURES=";
@@ -86,7 +102,14 @@ stdenv.mkDerivation rec {
     "-lswscale"
   ];
 
-  nativeBuildInputs = [ cmake gettext pkg-config python3 ];
+  nativeBuildInputs = [
+    cmake
+    gettext
+    pkg-config
+    python3
+  ] ++ lib.optionals stdenv.isLinux [
+    linuxHeaders
+  ];
 
   buildInputs = [
     alsaLib
@@ -110,8 +133,8 @@ stdenv.mkDerivation rec {
     sratom
     suil
     twolame
-    wxGTK
-    wxGTK.gtk
+    wxGTK-audacity
+    wxGTK-audacity.gtk
   ] ++ lib.optionals stdenv.isLinux [
     at-spi2-core
     dbus
diff --git a/pkgs/applications/misc/hugo/default.nix b/pkgs/applications/misc/hugo/default.nix
index 0f9ca5c4b84a..b8ea6b83b907 100644
--- a/pkgs/applications/misc/hugo/default.nix
+++ b/pkgs/applications/misc/hugo/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "hugo";
-  version = "0.82.1";
+  version = "0.83.1";
 
   src = fetchFromGitHub {
     owner = "gohugoio";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-6poWFcApwCos3XvS/Wq1VJyf5xTUWtqWNFXIhjNsXVs=";
+    sha256 = "sha256-c9T3a6J78uLumBTy/DgE4gbxCmEXVGKd9JyF9dyrL6g=";
   };
 
-  vendorSha256 = "sha256-pJBm+yyy1DbH28oVBQA+PHSDtSg3RcgbRlurrwnnEls=";
+  vendorSha256 = "sha256-ddCyMmZ5RIZWzT2RYNnSW795oR7PIRudl3QTjsXtBGk=";
 
   doCheck = false;
 
diff --git a/pkgs/applications/networking/syncthing/default.nix b/pkgs/applications/networking/syncthing/default.nix
index 2fa4f0b93c8e..556bb1a0b4a4 100644
--- a/pkgs/applications/networking/syncthing/default.nix
+++ b/pkgs/applications/networking/syncthing/default.nix
@@ -4,16 +4,16 @@ let
   common = { stname, target, postInstall ? "" }:
     buildGoModule rec {
       pname = stname;
-      version = "1.15.1";
+      version = "1.16.0";
 
       src = fetchFromGitHub {
         owner  = "syncthing";
         repo   = "syncthing";
         rev    = "v${version}";
-        sha256 = "sha256-d7b1hqW0ZWg74DyW1ZYMT7sIR7H89Ph38XE2Mhh7ySg=";
+        sha256 = "sha256-AAJLtykSQLM13I77E7LD1W8hXLvZQ3XqgOWrTBGYn3k=";
       };
 
-      vendorSha256 = "sha256-00DdGJNCZ94Wj6yvVXJYNJZEiGxYbqTkX6wwon0O1tc=";
+      vendorSha256 = "sha256-cN6Dgztq0/pAwfuBGFtTzK7XKXV7LrkgDGGzjkTDUN8=";
 
       doCheck = false;
 
diff --git a/pkgs/applications/version-management/sourcehut/builds.nix b/pkgs/applications/version-management/sourcehut/builds.nix
index 7fb26476d8ae..c8163caf8eae 100644
--- a/pkgs/applications/version-management/sourcehut/builds.nix
+++ b/pkgs/applications/version-management/sourcehut/builds.nix
@@ -1,24 +1,34 @@
-{ lib, fetchgit, buildPythonPackage
+{ lib
+, fetchFromSourcehut
+, buildPythonPackage
 , buildGoModule
-, srht, redis, celery, pyyaml, markdown }:
-
+, srht
+, redis
+, celery
+, pyyaml
+, markdown
+, ansi2html
+, python
+}:
 let
-  version = "0.63.4";
+  version = "0.66.7";
 
   buildWorker = src: buildGoModule {
     inherit src version;
     pname = "builds-sr-ht-worker";
 
-    vendorSha256 = "1sbcjp93gb0c4p7dd1gjhmhwr1pygxvrrzp954j2fvxvi38w6571";
+    vendorSha256 = "sha256-giOaldV46aBqXyFH/cQVsbUr6Rb4VMhbBO86o48tRZY=";
   };
-in buildPythonPackage rec {
+in
+buildPythonPackage rec {
   inherit version;
   pname = "buildsrht";
 
-  src = fetchgit {
-    url = "https://git.sr.ht/~sircmpwn/builds.sr.ht";
+  src = fetchFromSourcehut {
+    owner = "~sircmpwn";
+    repo = "builds.sr.ht";
     rev = version;
-    sha256 = "1w3rb685nqg2h0k3ag681svc400si9r1gy0sdim3wa2qh8glbqni";
+    sha256 = "sha256-2MLs/DOXHjEYarXDVUcPZe3o0fmZbzVxn528SE72lhM=";
   };
 
   nativeBuildInputs = srht.nativeBuildInputs;
@@ -29,10 +39,12 @@ in buildPythonPackage rec {
     celery
     pyyaml
     markdown
+    ansi2html
   ];
 
   preBuild = ''
     export PKGVER=${version}
+    export SRHT_PATH=${srht}/${python.sitePackages}/srht
   '';
 
   postInstall = ''
@@ -44,8 +56,6 @@ in buildPythonPackage rec {
     cp ${buildWorker "${src}/worker"}/bin/worker $out/bin/builds.sr.ht-worker
   '';
 
-  dontUseSetuptoolsCheck = true;
-
   meta = with lib; {
     homepage = "https://git.sr.ht/~sircmpwn/builds.sr.ht";
     description = "Continuous integration service for the sr.ht network";
diff --git a/pkgs/applications/version-management/sourcehut/core.nix b/pkgs/applications/version-management/sourcehut/core.nix
index 69f8a7d4e458..d359d524eb29 100644
--- a/pkgs/applications/version-management/sourcehut/core.nix
+++ b/pkgs/applications/version-management/sourcehut/core.nix
@@ -1,24 +1,48 @@
-{ lib, fetchgit, fetchNodeModules, buildPythonPackage
-, pgpy, flask, bleach, humanize, html5lib, markdown, psycopg2, pygments
-, requests, sqlalchemy, cryptography, beautifulsoup4, sqlalchemy-utils, prometheus_client
-, celery, alembic, importlib-metadata, mistletoe
-, sassc, nodejs
-, writeText }:
+{ lib
+, fetchgit
+, fetchNodeModules
+, buildPythonPackage
+, pgpy
+, flask
+, bleach
+, misaka
+, humanize
+, html5lib
+, markdown
+, psycopg2
+, pygments
+, requests
+, sqlalchemy
+, cryptography
+, beautifulsoup4
+, sqlalchemy-utils
+, prometheus_client
+, celery
+, alembic
+, importlib-metadata
+, mistletoe
+, minio
+, sassc
+, nodejs
+, redis
+, writeText
+}:
 
 buildPythonPackage rec {
   pname = "srht";
-  version = "0.65.2";
+  version = "0.67.4";
 
   src = fetchgit {
     url = "https://git.sr.ht/~sircmpwn/core.sr.ht";
     rev = version;
-    sha256 = "1jfp1vc8mink3c7ccacgnqx8hpkck82ipxiql38q1y9l8xcsah03";
+    sha256 = "sha256-XvzFfcBK5Mq8p7xEBAF/eupUE1kkUBh5k+ByM/WA9bc=";
+    fetchSubmodules = true;
   };
 
   node_modules = fetchNodeModules {
     src = "${src}/srht";
     nodejs = nodejs;
-    sha256 = "0gwa2xb75g7fclrsr7r131kj8ri5gmhd96yw1iws5pmgsn2rlqi1";
+    sha256 = "sha256-IWKahdWv3qJ5DNyb1GB9JWYkZxghn6wzZe68clYXij8=";
   };
 
   patches = [
@@ -34,6 +58,7 @@ buildPythonPackage rec {
     pgpy
     flask
     bleach
+    misaka
     humanize
     html5lib
     markdown
@@ -51,6 +76,8 @@ buildPythonPackage rec {
     celery
     alembic
     importlib-metadata
+    minio
+    redis
   ];
 
   PKGVER = version;
diff --git a/pkgs/applications/version-management/sourcehut/default.nix b/pkgs/applications/version-management/sourcehut/default.nix
index 8d2e8ceed335..43d783e1934d 100644
--- a/pkgs/applications/version-management/sourcehut/default.nix
+++ b/pkgs/applications/version-management/sourcehut/default.nix
@@ -1,14 +1,16 @@
-{ python38, openssl
-, callPackage, recurseIntoAttrs }:
+{ python3
+, openssl
+, callPackage
+, recurseIntoAttrs
+}:
 
 # To expose the *srht modules, they have to be a python module so we use `buildPythonModule`
 # Then we expose them through all-packages.nix as an application through `toPythonApplication`
 # https://github.com/NixOS/nixpkgs/pull/54425#discussion_r250688781
-
 let
   fetchNodeModules = callPackage ./fetchNodeModules.nix { };
 
-  python = python38.override {
+  python = python3.override {
     packageOverrides = self: super: {
       srht = self.callPackage ./core.nix { inherit fetchNodeModules; };
 
@@ -26,7 +28,8 @@ let
       scmsrht = self.callPackage ./scm.nix { };
     };
   };
-in with python.pkgs; recurseIntoAttrs {
+in
+with python.pkgs; recurseIntoAttrs {
   inherit python;
   buildsrht = toPythonApplication buildsrht;
   dispatchsrht = toPythonApplication dispatchsrht;
diff --git a/pkgs/applications/version-management/sourcehut/dispatch.nix b/pkgs/applications/version-management/sourcehut/dispatch.nix
index 5ce140273ebd..637c6f9c1df4 100644
--- a/pkgs/applications/version-management/sourcehut/dispatch.nix
+++ b/pkgs/applications/version-management/sourcehut/dispatch.nix
@@ -1,14 +1,21 @@
-{ lib, fetchgit, buildPythonPackage
-, srht, pyyaml, PyGithub }:
+{ lib
+, fetchFromSourcehut
+, buildPythonPackage
+, srht
+, pyyaml
+, PyGithub
+, python
+}:
 
 buildPythonPackage rec {
   pname = "dispatchsrht";
-  version = "0.14.9";
+  version = "0.15.8";
 
-  src = fetchgit {
-    url = "https://git.sr.ht/~sircmpwn/dispatch.sr.ht";
+  src = fetchFromSourcehut {
+    owner = "~sircmpwn";
+    repo = "dispatch.sr.ht";
     rev = version;
-    sha256 = "JUffuJTKY4I8CrJc8tJWL+CbJCZtiqtUSO9SgYoeux0=";
+    sha256 = "sha256-zWCGPjIgMKHXHJUs9aciV7IFgo0rpahon6KXHDwcfss=";
   };
 
   nativeBuildInputs = srht.nativeBuildInputs;
@@ -21,10 +28,9 @@ buildPythonPackage rec {
 
   preBuild = ''
     export PKGVER=${version}
+    export SRHT_PATH=${srht}/${python.sitePackages}/srht
   '';
 
-  dontUseSetuptoolsCheck = true;
-
   meta = with lib; {
     homepage = "https://dispatch.sr.ht/~sircmpwn/dispatch.sr.ht";
     description = "Task dispatcher and service integration tool for the sr.ht network";
diff --git a/pkgs/applications/version-management/sourcehut/git.nix b/pkgs/applications/version-management/sourcehut/git.nix
index a25a14f610c1..e44fb9cd6c6c 100644
--- a/pkgs/applications/version-management/sourcehut/git.nix
+++ b/pkgs/applications/version-management/sourcehut/git.nix
@@ -1,20 +1,32 @@
-{ lib, fetchgit, buildPythonPackage
+{ lib
+, fetchFromSourcehut
+, buildPythonPackage
 , buildGoModule
-, srht, minio, pygit2, scmsrht }:
-
+, python
+, srht
+, pygit2
+, scmsrht
+}:
 let
-  version = "0.61.10";
+  version = "0.72.8";
+
+  src = fetchFromSourcehut {
+    owner = "~sircmpwn";
+    repo = "git.sr.ht";
+    rev = version;
+    sha256 = "sha256-AB2uzajO5PtcpJfbOOTfuDFM6is5K39v3AZJ1hShRNc=";
+  };
 
   buildShell = src: buildGoModule {
     inherit src version;
     pname = "gitsrht-shell";
-    vendorSha256 = "1abyv2s5l3bs0iylpgyj3jri2hh1iy8fiadxm7g6l2vl58h0b9ba";
+    vendorSha256 = "sha256-aqUFICp0C2reqb2p6JCPAUIRsxzSv0t9BHoNWrTYfqk=";
   };
 
   buildDispatcher = src: buildGoModule {
     inherit src version;
     pname = "gitsrht-dispatcher";
-    vendorSha256 = "1lzkf13m54pq0gnn3bcxc80nfg76hgck4l8q8jpaicrsiwgcyrd9";
+    vendorSha256 = "sha256-qWXPHo86s6iuRBhRMtmD5jxnAWKdrWHtA/iSUkdw89M=";
   };
 
   buildKeys = src: buildGoModule {
@@ -29,32 +41,24 @@ let
     vendorSha256 = "0fwzqpjv8x5y3w3bfjd0x0cvqjjak23m0zj88hf32jpw49xmjkih";
   };
 
-  buildAPI = src: buildGoModule {
-    inherit src version;
-    pname = "gitsrht-api";
-    vendorSha256 = "0d6kmsbsgj2q5nddx4w675zbsiarffj9vqplwvqk7dwz4id2wnif";
-  };
-in buildPythonPackage rec {
-  pname = "gitsrht";
-  inherit version;
+  updateHook = buildUpdateHook "${src}/gitsrht-update-hook";
 
-  src = fetchgit {
-    url = "https://git.sr.ht/~sircmpwn/git.sr.ht";
-    rev = version;
-    sha256 = "0g7aj5wlns0m3kf2aajqjjb5fwk5vbb8frrkdfp4118235h3xcqy";
-  };
+in
+buildPythonPackage rec {
+  inherit src version;
+  pname = "gitsrht";
 
   nativeBuildInputs = srht.nativeBuildInputs;
 
   propagatedBuildInputs = [
     srht
-    minio
     pygit2
     scmsrht
   ];
 
   preBuild = ''
     export PKGVER=${version}
+    export SRHT_PATH=${srht}/${python.sitePackages}/srht
   '';
 
   postInstall = ''
@@ -62,11 +66,11 @@ in buildPythonPackage rec {
     cp ${buildShell "${src}/gitsrht-shell"}/bin/gitsrht-shell $out/bin/gitsrht-shell
     cp ${buildDispatcher "${src}/gitsrht-dispatch"}/bin/gitsrht-dispatch $out/bin/gitsrht-dispatch
     cp ${buildKeys "${src}/gitsrht-keys"}/bin/gitsrht-keys $out/bin/gitsrht-keys
-    cp ${buildUpdateHook "${src}/gitsrht-update-hook"}/bin/gitsrht-update-hook $out/bin/gitsrht-update-hook
-    cp ${buildAPI "${src}/api"}/bin/api $out/bin/gitsrht-api
+    cp ${updateHook}/bin/gitsrht-update-hook $out/bin/gitsrht-update-hook
   '';
-
-  dontUseSetuptoolsCheck = true;
+  passthru = {
+    inherit updateHook;
+  };
 
   meta = with lib; {
     homepage = "https://git.sr.ht/~sircmpwn/git.sr.ht";
diff --git a/pkgs/applications/version-management/sourcehut/hg.nix b/pkgs/applications/version-management/sourcehut/hg.nix
index c8fa64c8b4d9..cddb76cabf25 100644
--- a/pkgs/applications/version-management/sourcehut/hg.nix
+++ b/pkgs/applications/version-management/sourcehut/hg.nix
@@ -1,14 +1,21 @@
-{ lib, fetchhg, buildPythonPackage
-, srht, hglib, scmsrht, unidiff }:
+{ lib
+, fetchhg
+, buildPythonPackage
+, srht
+, hglib
+, scmsrht
+, unidiff
+, python
+}:
 
 buildPythonPackage rec {
   pname = "hgsrht";
-  version = "0.26.19";
+  version = "0.27.4";
 
   src = fetchhg {
     url = "https://hg.sr.ht/~sircmpwn/hg.sr.ht";
     rev = version;
-    sha256 = "0dc0lgqq8zdaywbd50dlxypk1lv0nffvqr3889v10ycy45qcfymv";
+    sha256 = "1c0qfi0gmbfngvds6917fy9ii2iglawn429757rh7b4bvzn7n6mr";
   };
 
   nativeBuildInputs = srht.nativeBuildInputs;
@@ -22,10 +29,9 @@ buildPythonPackage rec {
 
   preBuild = ''
     export PKGVER=${version}
+    export SRHT_PATH=${srht}/${python.sitePackages}/srht
   '';
 
-  dontUseSetuptoolsCheck = true;
-
   meta = with lib; {
     homepage = "https://git.sr.ht/~sircmpwn/hg.sr.ht";
     description = "Mercurial repository hosting service for the sr.ht network";
diff --git a/pkgs/applications/version-management/sourcehut/hub.nix b/pkgs/applications/version-management/sourcehut/hub.nix
index 8b6d92019976..17cb3fe4b614 100644
--- a/pkgs/applications/version-management/sourcehut/hub.nix
+++ b/pkgs/applications/version-management/sourcehut/hub.nix
@@ -1,14 +1,18 @@
-{ lib, fetchgit, buildPythonPackage
-, srht }:
+{ lib
+, fetchFromSourcehut
+, buildPythonPackage
+, srht
+}:
 
 buildPythonPackage rec {
   pname = "hubsrht";
-  version = "0.11.5";
+  version = "0.13.1";
 
-  src = fetchgit {
-    url = "https://git.sr.ht/~sircmpwn/hub.sr.ht";
+  src = fetchFromSourcehut {
+    owner = "~sircmpwn";
+    repo = "hub.sr.ht";
     rev = version;
-    sha256 = "0cysdfy1z69jaizblbq0ywpcvcnx57rlzg42k98kd9w2mqzj5173";
+    sha256 = "sha256-Kqzy4mh5Nn1emzHBco/LVuXro/tW3NX+OYqdEwBSQ/U=";
   };
 
   nativeBuildInputs = srht.nativeBuildInputs;
diff --git a/pkgs/applications/version-management/sourcehut/lists.nix b/pkgs/applications/version-management/sourcehut/lists.nix
index 98191f564e96..b419b49f7b5d 100644
--- a/pkgs/applications/version-management/sourcehut/lists.nix
+++ b/pkgs/applications/version-management/sourcehut/lists.nix
@@ -1,14 +1,24 @@
-{ lib, fetchgit, buildPythonPackage
-, srht, asyncpg, aiosmtpd, pygit2, emailthreads }:
+{ lib
+, fetchFromSourcehut
+, buildPythonPackage
+, srht
+, asyncpg
+, aiosmtpd
+, pygit2
+, emailthreads
+, redis
+, python
+}:
 
 buildPythonPackage rec {
   pname = "listssrht";
-  version = "0.45.15";
+  version = "0.48.19";
 
-  src = fetchgit {
-    url = "https://git.sr.ht/~sircmpwn/lists.sr.ht";
+  src = fetchFromSourcehut {
+    owner = "~sircmpwn";
+    repo = "lists.sr.ht";
     rev = version;
-    sha256 = "0f3yl5nf385j7mhcrmda7zk58i1y6fm00i479js90xxhjifmqkq6";
+    sha256 = "sha256-bsakEMyvWaxiE4/SGcAP4mlGG9jkdHfFxpt9H+TJn/8=";
   };
 
   nativeBuildInputs = srht.nativeBuildInputs;
@@ -19,14 +29,14 @@ buildPythonPackage rec {
     asyncpg
     aiosmtpd
     emailthreads
+    redis
   ];
 
   preBuild = ''
     export PKGVER=${version}
+    export SRHT_PATH=${srht}/${python.sitePackages}/srht
   '';
 
-  dontUseSetuptoolsCheck = true;
-
   meta = with lib; {
     homepage = "https://git.sr.ht/~sircmpwn/lists.sr.ht";
     description = "Mailing list service for the sr.ht network";
diff --git a/pkgs/applications/version-management/sourcehut/man.nix b/pkgs/applications/version-management/sourcehut/man.nix
index e3751a6d5c8b..bd331f000a72 100644
--- a/pkgs/applications/version-management/sourcehut/man.nix
+++ b/pkgs/applications/version-management/sourcehut/man.nix
@@ -1,14 +1,20 @@
-{ lib, fetchgit, buildPythonPackage
-, srht, pygit2 }:
+{ lib
+, fetchFromSourcehut
+, buildPythonPackage
+, srht
+, pygit2
+, python
+}:
 
 buildPythonPackage rec {
   pname = "mansrht";
-  version = "0.15.4";
+  version = "0.15.12";
 
-  src = fetchgit {
-    url = "https://git.sr.ht/~sircmpwn/man.sr.ht";
+  src = fetchFromSourcehut {
+    owner = "~sircmpwn";
+    repo = "man.sr.ht";
     rev = version;
-    sha256 = "0spi0yy2myxw4kggy54yskda14c4vaq2ng9dd9krqsajnsy7anrw";
+    sha256 = "sha256-MqH/8K9XRvEg6P7GHE6XXtWnhDP3wT8iGoNaFtYQbio=";
   };
 
   nativeBuildInputs = srht.nativeBuildInputs;
@@ -20,10 +26,9 @@ buildPythonPackage rec {
 
   preBuild = ''
     export PKGVER=${version}
+    export SRHT_PATH=${srht}/${python.sitePackages}/srht
   '';
 
-  dontUseSetuptoolsCheck = true;
-
   meta = with lib; {
     homepage = "https://git.sr.ht/~sircmpwn/man.sr.ht";
     description = "Wiki service for the sr.ht network";
diff --git a/pkgs/applications/version-management/sourcehut/meta.nix b/pkgs/applications/version-management/sourcehut/meta.nix
index b5b15520d253..a285d484ed2a 100644
--- a/pkgs/applications/version-management/sourcehut/meta.nix
+++ b/pkgs/applications/version-management/sourcehut/meta.nix
@@ -1,26 +1,42 @@
-{ lib, fetchgit, buildPythonPackage
+{ lib
+, fetchFromSourcehut
+, buildPythonPackage
 , buildGoModule
-, pgpy, srht, redis, bcrypt, qrcode, stripe, zxcvbn, alembic, pystache
-, sshpubkeys, weasyprint }:
-
+, pgpy
+, srht
+, redis
+, bcrypt
+, qrcode
+, stripe
+, zxcvbn
+, alembic
+, pystache
+, dnspython
+, sshpubkeys
+, weasyprint
+, prometheus_client
+, python
+}:
 let
-  version = "0.51.2";
+  version = "0.53.14";
 
-  buildAPI = src: buildGoModule {
+  src = fetchFromSourcehut {
+    owner = "~sircmpwn";
+    repo = "meta.sr.ht";
+    rev = version;
+    sha256 = "sha256-/+r/XLDkcSTW647xPMh5bcJmR2xZNNH74AJ5jemna2k=";
+  };
+
+  buildApi = src: buildGoModule {
     inherit src version;
     pname = "metasrht-api";
-
-    vendorSha256 = "0k7i7j604wqvzjavmcsw7g2x059jkkgrgz1qyvzlqc0y4ws59xkq";
+    vendorSha256 = "sha256-eZyDrr2VcNMxI++18qUy7LA1Q1YDlWCoRtl00L8lfR4=";
   };
-in buildPythonPackage rec {
+
+in
+buildPythonPackage rec {
   pname = "metasrht";
-  inherit version;
-
-  src = fetchgit {
-    url = "https://git.sr.ht/~sircmpwn/meta.sr.ht";
-    rev = version;
-    sha256 = "0c9y1hzx3dj0awxrhkzrcsmy6q9fqm6v6dbp9y1ria3v47xa3nv7";
-  };
+  inherit version src;
 
   nativeBuildInputs = srht.nativeBuildInputs;
 
@@ -36,19 +52,20 @@ in buildPythonPackage rec {
     pystache
     sshpubkeys
     weasyprint
+    prometheus_client
+    dnspython
   ];
 
   preBuild = ''
     export PKGVER=${version}
+    export SRHT_PATH=${srht}/${python.sitePackages}/srht
   '';
 
   postInstall = ''
     mkdir -p $out/bin
-    cp ${buildAPI "${src}/api"}/bin/api $out/bin/metasrht-api
+    cp ${buildApi "${src}/api/"}/bin/api $out/bin/metasrht-api
   '';
 
-  dontUseSetuptoolsCheck = true;
-
   meta = with lib; {
     homepage = "https://git.sr.ht/~sircmpwn/meta.sr.ht";
     description = "Account management service for the sr.ht network";
diff --git a/pkgs/applications/version-management/sourcehut/paste.nix b/pkgs/applications/version-management/sourcehut/paste.nix
index dab518e70aee..0d8c91354937 100644
--- a/pkgs/applications/version-management/sourcehut/paste.nix
+++ b/pkgs/applications/version-management/sourcehut/paste.nix
@@ -1,14 +1,20 @@
-{ lib, fetchgit, buildPythonPackage
-, srht, pyyaml }:
+{ lib
+, fetchFromSourcehut
+, buildPythonPackage
+, srht
+, pyyaml
+, python
+}:
 
 buildPythonPackage rec {
   pname = "pastesrht";
-  version = "0.11.2";
+  version = "0.12.1";
 
-  src = fetchgit {
-    url = "https://git.sr.ht/~sircmpwn/paste.sr.ht";
+  src = fetchFromSourcehut {
+    owner = "~sircmpwn";
+    repo = "paste.sr.ht";
     rev = version;
-    sha256 = "15hm5165v8a7ryw6i0vlf189slw4rp22cfgzznih18pbml7d0c8s";
+    sha256 = "sha256-QQhd2LeH9BLmlHilhsv+9fZ+RPNmEMSmOpFA3dsMBFc=";
   };
 
   nativeBuildInputs = srht.nativeBuildInputs;
@@ -20,10 +26,9 @@ buildPythonPackage rec {
 
   preBuild = ''
     export PKGVER=${version}
+    export SRHT_PATH=${srht}/${python.sitePackages}/srht
   '';
 
-  dontUseSetuptoolsCheck = true;
-
   meta = with lib; {
     homepage = "https://git.sr.ht/~sircmpwn/paste.sr.ht";
     description = "Ad-hoc text file hosting service for the sr.ht network";
diff --git a/pkgs/applications/version-management/sourcehut/scm.nix b/pkgs/applications/version-management/sourcehut/scm.nix
index 615716d03afd..1f3852653601 100644
--- a/pkgs/applications/version-management/sourcehut/scm.nix
+++ b/pkgs/applications/version-management/sourcehut/scm.nix
@@ -1,15 +1,22 @@
-{ lib, fetchgit, buildPythonPackage
-, srht, redis, pyyaml, buildsrht
-, writeText }:
+{ lib
+, fetchFromSourcehut
+, buildPythonPackage
+, srht
+, redis
+, pyyaml
+, buildsrht
+, writeText
+}:
 
 buildPythonPackage rec {
   pname = "scmsrht";
-  version = "0.22.4";
+  version = "0.22.9";
 
-  src = fetchgit {
-    url = "https://git.sr.ht/~sircmpwn/scm.sr.ht";
+  src = fetchFromSourcehut {
+    owner = "~sircmpwn";
+    repo = "scm.sr.ht";
     rev = version;
-    sha256 = "1djyrwa44wml9lj3njy6qbxyc3g1msswbh0y9jyjzxh2c02bl3jn";
+    sha256 = "sha256-327G6C8FW+iZx+167D7TQsFtV6FGc8MpMVo9L/cUUqU=";
   };
 
   nativeBuildInputs = srht.nativeBuildInputs;
diff --git a/pkgs/applications/version-management/sourcehut/todo.nix b/pkgs/applications/version-management/sourcehut/todo.nix
index 5e75efb08864..85e1f5637b62 100644
--- a/pkgs/applications/version-management/sourcehut/todo.nix
+++ b/pkgs/applications/version-management/sourcehut/todo.nix
@@ -1,15 +1,24 @@
-{ lib, fetchgit, buildPythonPackage
-, srht, redis, alembic, pystache
-, pytest, factory_boy }:
+{ lib
+, fetchFromSourcehut
+, buildPythonPackage
+, srht
+, redis
+, alembic
+, pystache
+, pytest
+, factory_boy
+, python
+}:
 
 buildPythonPackage rec {
   pname = "todosrht";
-  version = "0.62.1";
+  version = "0.64.14";
 
-  src = fetchgit {
-    url = "https://git.sr.ht/~sircmpwn/todo.sr.ht";
+  src = fetchFromSourcehut {
+    owner = "~sircmpwn";
+    repo = "todo.sr.ht";
     rev = version;
-    sha256 = "17fsv2z37sjzqzpvx39nc36xln1ayivzjg309d2vmb94aaym4nz2";
+    sha256 = "sha256-huIAhn6h1F5w5ST4/yBwr82kAzyYwhLu+gpRuOQgnsE=";
   };
 
   nativeBuildInputs = srht.nativeBuildInputs;
@@ -23,6 +32,7 @@ buildPythonPackage rec {
 
   preBuild = ''
     export PKGVER=${version}
+    export SRHT_PATH=${srht}/${python.sitePackages}/srht
   '';
 
   # pytest tests fail
diff --git a/pkgs/applications/window-managers/cagebreak/default.nix b/pkgs/applications/window-managers/cagebreak/default.nix
index 505d1cb1520c..de996f080e76 100644
--- a/pkgs/applications/window-managers/cagebreak/default.nix
+++ b/pkgs/applications/window-managers/cagebreak/default.nix
@@ -1,38 +1,75 @@
-{ lib, stdenv, fetchFromGitHub
-, meson, ninja, pkg-config, wayland, scdoc, makeWrapper
-, wlroots, wayland-protocols, pixman, libxkbcommon
-, cairo , pango, fontconfig, pandoc, systemd, mesa
-, withXwayland ? true, xwayland
+{ lib
+, stdenv
+, fetchFromGitHub
+, cairo
+, fontconfig
+, libxkbcommon
+, makeWrapper
+, mesa
+, meson
+, ninja
 , nixosTests
+, pandoc
+, pango
+, pixman
+, pkg-config
+, scdoc
+, systemd
+, wayland
+, wayland-protocols
+, withXwayland ? true , xwayland
+, wlroots
 }:
 
 stdenv.mkDerivation rec {
   pname = "cagebreak";
-  version = "1.6.0";
+  version = "1.7.0";
 
   src = fetchFromGitHub {
     owner = "project-repo";
-    repo = "cagebreak";
+    repo = pname;
     rev = version;
-    hash = "sha256-F7fqDVbJS6pVgmj6C1/l9PAaz5yzcYpaq6oc6a6v/Qk=";
+    hash = "sha256-HpAjJHu5sxZKof3ydnU3wcP5GpnH6Ax8m1T1vVoq+oI=";
   };
 
-  nativeBuildInputs = [ meson ninja pkg-config wayland scdoc makeWrapper ];
+  nativeBuildInputs = [
+    makeWrapper
+    meson
+    ninja
+    pandoc
+    pkg-config
+    scdoc
+    wayland
+  ];
 
   buildInputs = [
-    wlroots wayland wayland-protocols pixman libxkbcommon cairo
-    pango fontconfig pandoc systemd
+    cairo
+    fontconfig
+    libxkbcommon
     mesa # for libEGL headers
+    pango
+    pixman
+    systemd
+    wayland
+    wayland-protocols
+    wlroots
   ];
 
-  outputs = [ "out" "contrib" ];
+  outputs = [
+    "out"
+    "contrib"
+  ];
 
   mesonFlags = [
-    "-Dxwayland=${lib.boolToString withXwayland}"
-    "-Dversion_override=${version}"
     "-Dman-pages=true"
+    "-Dversion_override=${version}"
+    "-Dxwayland=${lib.boolToString withXwayland}"
   ];
 
+  postPatch = ''
+    sed -i -e 's|<drm_fourcc.h>|<libdrm/drm_fourcc.h>|' *.c
+  '';
+
   postInstall = ''
     mkdir -p $contrib/share/cagebreak
     cp $src/examples/config $contrib/share/cagebreak/config
diff --git a/pkgs/development/libraries/qscintilla/default.nix b/pkgs/development/libraries/qscintilla/default.nix
index 314bdabdb558..28c16e325350 100644
--- a/pkgs/development/libraries/qscintilla/default.nix
+++ b/pkgs/development/libraries/qscintilla/default.nix
@@ -6,14 +6,14 @@
 
 let
   pname = "qscintilla-qt${if withQt5 then "5" else "4"}";
-  version = "2.11.5";
+  version = "2.11.6";
 
 in stdenv.mkDerivation rec {
   inherit pname version;
 
   src = fetchurl {
     url = "https://www.riverbankcomputing.com/static/Downloads/QScintilla/${version}/QScintilla-${version}.tar.gz";
-    sha256 = "k2Hib9f7e1gZp+uSxcGIChjem9PtndLrAI5XOIaWcWs=";
+    sha256 = "5zRgV9tH0vs4RGf6/M/LE6oHQTc8XVk7xytVsvDdIKc=";
   };
 
   sourceRoot = "QScintilla-${version}/Qt4Qt5";
diff --git a/pkgs/development/libraries/xdg-desktop-portal-wlr/default.nix b/pkgs/development/libraries/xdg-desktop-portal-wlr/default.nix
index b51d179f95cf..59816a4ef6f7 100644
--- a/pkgs/development/libraries/xdg-desktop-portal-wlr/default.nix
+++ b/pkgs/development/libraries/xdg-desktop-portal-wlr/default.nix
@@ -1,6 +1,6 @@
-{ lib, stdenv, fetchFromGitHub
+{ lib, stdenv, fetchFromGitHub, makeWrapper
 , meson, ninja, pkg-config, wayland-protocols
-, pipewire, wayland, systemd, libdrm, iniparser, scdoc }:
+, pipewire, wayland, systemd, libdrm, iniparser, scdoc, grim }:
 
 stdenv.mkDerivation rec {
   pname = "xdg-desktop-portal-wlr";
@@ -13,13 +13,17 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-6ArUQfWx5rNdpsd8Q22MqlpxLT8GTSsymAf21zGe1KI=";
   };
 
-  nativeBuildInputs = [ meson ninja pkg-config wayland-protocols ];
+  nativeBuildInputs = [ meson ninja pkg-config wayland-protocols makeWrapper ];
   buildInputs = [ pipewire wayland systemd libdrm iniparser scdoc ];
 
   mesonFlags = [
     "-Dsd-bus-provider=libsystemd"
   ];
 
+  postInstall = ''
+    wrapProgram $out/libexec/xdg-desktop-portal-wlr --prefix PATH ":" ${lib.makeBinPath [ grim ]}
+  '';
+
   meta = with lib; {
     homepage = "https://github.com/emersion/xdg-desktop-portal-wlr";
     description = "xdg-desktop-portal backend for wlroots";
diff --git a/pkgs/development/python-modules/aiodiscover/default.nix b/pkgs/development/python-modules/aiodiscover/default.nix
index 8a7f72f8b863..942482ba5ebb 100644
--- a/pkgs/development/python-modules/aiodiscover/default.nix
+++ b/pkgs/development/python-modules/aiodiscover/default.nix
@@ -1,6 +1,6 @@
 { lib
-, async-dns
 , buildPythonPackage
+, dnspython
 , fetchFromGitHub
 , ifaddr
 , pyroute2
@@ -11,18 +11,18 @@
 
 buildPythonPackage rec {
   pname = "aiodiscover";
-  version = "1.3.4";
+  version = "1.4.0";
   disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "bdraco";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-TmWl5d5HwyqWPUjwtEvc5FzVfxV/K1pekljcMkGN0Ag=";
+    sha256 = "sha256-t0bs3n0eLUR22i1lZkepCffjiUFzvXBdP7Xq49KXeS4=";
   };
 
   propagatedBuildInputs = [
-    async-dns
+    dnspython
     pyroute2
     ifaddr
   ];
@@ -36,10 +36,6 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
-  preBuild = ''
-    export HOME=$TMPDIR
-  '';
-
   disabledTests = [
     # Tests require access to /etc/resolv.conf
     "test_async_discover_hosts"
diff --git a/pkgs/development/tools/misc/hydra/common.nix b/pkgs/development/tools/misc/hydra/common.nix
index 0cc7769d3c50..9ad8295c9b9d 100644
--- a/pkgs/development/tools/misc/hydra/common.nix
+++ b/pkgs/development/tools/misc/hydra/common.nix
@@ -37,6 +37,8 @@ let
         CatalystViewTT
         CatalystXScriptServerStarman
         CatalystXRoleApplicator
+        CryptPassphrase
+        CryptPassphraseArgon2
         CryptRandPasswd
         DBDPg
         DBDSQLite
@@ -61,6 +63,7 @@ let
         SQLSplitStatement
         SetScalar
         Starman
+        StringCompareConstantTime
         SysHostnameLong
         TermSizeAny
         TextDiff
diff --git a/pkgs/development/tools/misc/hydra/default.nix b/pkgs/development/tools/misc/hydra/default.nix
index 7bed3b5d2027..142322eb59d4 100644
--- a/pkgs/development/tools/misc/hydra/default.nix
+++ b/pkgs/development/tools/misc/hydra/default.nix
@@ -2,12 +2,12 @@
 
 {
   hydra-unstable = callPackage ./common.nix {
-    version = "2021-04-29";
+    version = "2021-05-03";
     src = fetchFromGitHub {
       owner = "NixOS";
       repo = "hydra";
-      rev = "6047b1dd04d44acff9343b6b971ab609b73099d5";
-      sha256 = "sha256-E7JOHhSd4gIzE6FvSZVMxZE9WagbBkrfZVoibkanaYE=";
+      rev = "886e6f85e45a1f757e9b77d2a9e4539fbde29468";
+      sha256 = "t7Qb57Xjc0Ou+VDGC1N5u9AmeODW6MVOwKSrYRJq5f0=";
     };
     nix = nixFlakes;
 
diff --git a/pkgs/misc/vscode-extensions/default.nix b/pkgs/misc/vscode-extensions/default.nix
index 15d280c07501..ab8e19ca8fc3 100644
--- a/pkgs/misc/vscode-extensions/default.nix
+++ b/pkgs/misc/vscode-extensions/default.nix
@@ -444,8 +444,8 @@ let
           mktplcRef = {
             name = "github-vscode-theme";
             publisher = "github";
-            version = "4.0.2";
-            sha256 = "06mysdwjh7km874rrk0xc0xxaqx15b4a7x1i8dly440h8w3ng5bs";
+            version = "4.1.1";
+            sha256 = "14wz2b0bn1rnmpj28c0mivz2gacla2dgg8ncv7qfx9bsxhf95g68";
           };
           meta = with lib; {
             description = "GitHub theme for VS Code";
diff --git a/pkgs/servers/misc/gobgpd/default.nix b/pkgs/servers/misc/gobgpd/default.nix
index 71f370a1a97c..c747e5266a05 100644
--- a/pkgs/servers/misc/gobgpd/default.nix
+++ b/pkgs/servers/misc/gobgpd/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "gobgpd";
-  version = "2.26.0";
+  version = "2.27.0";
 
   src = fetchFromGitHub {
     owner = "osrg";
     repo = "gobgp";
     rev = "v${version}";
-    sha256 = "10fq74hv3vmcq58i3w67ic370925vl9wl6khcmy3f2vg60i962di";
+    sha256 = "sha256-Ofg+z8wUttqM1THatPFi0cuyLSEryhTmg3JC1o+16eA=";
   };
 
-  vendorSha256 = "0dmd4r6x76jn8pyvp47x4llzc2wij5m9lchgyaagcb5sfdgbns9x";
+  vendorSha256 = "sha256-PWm7XnO6LPaU8g8ymmqRkQv2KSX9kLv9RVaa000mrTY=";
 
   postConfigure = ''
     export CGO_ENABLED=0
diff --git a/pkgs/tools/misc/grub/2.0x.nix b/pkgs/tools/misc/grub/2.0x.nix
index 20f251872856..f36e64f57b26 100644
--- a/pkgs/tools/misc/grub/2.0x.nix
+++ b/pkgs/tools/misc/grub/2.0x.nix
@@ -1,6 +1,8 @@
 { lib, stdenv, fetchgit, flex, bison, python3, autoconf, automake, gnulib, libtool
 , gettext, ncurses, libusb-compat-0_1, freetype, qemu, lvm2, unifont, pkg-config
 , buildPackages
+, fetchpatch
+, pkgsBuildBuild
 , nixosTests
 , fuse # only needed for grub-mount
 , runtimeShell
@@ -55,6 +57,12 @@ stdenv.mkDerivation rec {
 
   patches = [
     ./fix-bash-completion.patch
+    (fetchpatch {
+      name = "Add-hidden-menu-entries.patch";
+      # https://lists.gnu.org/archive/html/grub-devel/2016-04/msg00089.html
+      url = "https://marc.info/?l=grub-devel&m=146193404929072&q=mbox";
+      sha256 = "00wa1q5adiass6i0x7p98vynj9vsz1w0gn1g4dgz89v35mpyw2bi";
+    })
   ];
 
   postPatch = if kbdcompSupport then ''
diff --git a/pkgs/tools/networking/gobgp/default.nix b/pkgs/tools/networking/gobgp/default.nix
index d48234f8dc75..942df983fcdc 100644
--- a/pkgs/tools/networking/gobgp/default.nix
+++ b/pkgs/tools/networking/gobgp/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "gobgp";
-  version = "2.26.0";
+  version = "2.27.0";
 
   src = fetchFromGitHub {
     owner = "osrg";
     repo = "gobgp";
     rev = "v${version}";
-    sha256 = "sha256-sQmTIjBvCzd8ZXAayhPdRSRwBovH8BFRwazusSE52IE=";
+    sha256 = "sha256-Ofg+z8wUttqM1THatPFi0cuyLSEryhTmg3JC1o+16eA=";
   };
 
   vendorSha256 = "sha256-PWm7XnO6LPaU8g8ymmqRkQv2KSX9kLv9RVaa000mrTY=";
diff --git a/pkgs/tools/networking/tcpreplay/default.nix b/pkgs/tools/networking/tcpreplay/default.nix
index a33bb4865687..ed83e4d45549 100644
--- a/pkgs/tools/networking/tcpreplay/default.nix
+++ b/pkgs/tools/networking/tcpreplay/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "tcpreplay";
-  version = "4.3.3";
+  version = "4.3.4";
 
   src = fetchurl {
     url = "https://github.com/appneta/tcpreplay/releases/download/v${version}/tcpreplay-${version}.tar.gz";
-    sha256 = "1plgjm3dr9rr5q71s7paqk2wgrvkihbk2yrf9g3zaks3m750497d";
+    sha256 = "sha256-7gZTEIBsIuL9NvAU4euzMbmKfsTblY6Rw9nL2gZA2Sw=";
   };
 
   buildInputs = [ libpcap ]
@@ -27,13 +27,9 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "A suite of utilities for editing and replaying network traffic";
-    homepage = "http://tcpreplay.appneta.com/";
-    license = with licenses; [ bsd3 gpl3 ];
+    homepage = "https://tcpreplay.appneta.com/";
+    license = with licenses; [ bsdOriginalUC gpl3Only ];
     maintainers = with maintainers; [ eleanor ];
     platforms = platforms.unix;
-    knownVulnerabilities = [
-      "CVE-2020-24265" # https://github.com/appneta/tcpreplay/issues/616
-      "CVE-2020-24266" # https://github.com/appneta/tcpreplay/issues/617
-    ];
   };
 }
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index d042fbff6a74..72527400ea8f 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -22170,9 +22170,7 @@ in
   audacious = libsForQt5.callPackage ../applications/audio/audacious { };
   audaciousQt5 = audacious;
 
-  audacity-gtk2 = callPackage ../applications/audio/audacity { wxGTK = wxGTK31-gtk2; };
-  audacity-gtk3 = callPackage ../applications/audio/audacity { wxGTK = wxGTK31-gtk3; };
-  audacity = audacity-gtk2;
+  audacity = callPackage ../applications/audio/audacity { wxGTK = wxGTK31-gtk2; };
 
   audio-recorder = callPackage ../applications/audio/audio-recorder { };
 
@@ -31293,9 +31291,7 @@ in
 
   bottom = callPackage ../tools/system/bottom {};
 
-  cagebreak = callPackage ../applications/window-managers/cagebreak/default.nix {
-    wlroots = wlroots_0_12;
-  };
+  cagebreak = callPackage ../applications/window-managers/cagebreak/default.nix { };
 
   psftools = callPackage ../os-specific/linux/psftools {};
 
diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 9dc9444e0964..e7c83018327f 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -3907,6 +3907,20 @@ let
     };
   };
 
+  CryptArgon2 = perlPackages.buildPerlModule {
+    pname = "Crypt-Argon2";
+    version = "0.010";
+    src = fetchurl {
+      url = "mirror://cpan/authors/id/L/LE/LEONT/Crypt-Argon2-0.010.tar.gz";
+      sha256 = "3ea1c006f10ef66fd417e502a569df15c4cc1c776b084e35639751c41ce6671a";
+    };
+    nativeBuildInputs = [ pkgs.ld-is-cc-hook ];
+    meta = {
+      description = "Perl interface to the Argon2 key derivation functions";
+      license = lib.licenses.cc0;
+    };
+  };
+
   CryptBlowfish = buildPerlPackage {
     pname = "Crypt-Blowfish";
     version = "2.14";
@@ -4081,6 +4095,33 @@ let
     };
   };
 
+  CryptPassphrase = buildPerlPackage {
+    pname = "Crypt-Passphrase";
+    version = "0.003";
+    src = fetchurl {
+      url = "mirror://cpan/authors/id/L/LE/LEONT/Crypt-Passphrase-0.003.tar.gz";
+      sha256 = "685aa090f8179a86d6896212ccf8ccfde7a79cce857199bb14e2277a10d240ad";
+    };
+    meta = {
+      description = "A module for managing passwords in a cryptographically agile manner";
+      license = with lib.licenses; [ artistic1 gpl1Plus ];
+    };
+  };
+
+  CryptPassphraseArgon2 = buildPerlPackage {
+    pname = "Crypt-Passphrase-Argon2";
+    version = "0.002";
+    src = fetchurl {
+      url = "mirror://cpan/authors/id/L/LE/LEONT/Crypt-Passphrase-Argon2-0.002.tar.gz";
+      sha256 = "3906ff81697d13804ee21bd5ab78ffb1c4408b4822ce020e92ecf4737ba1f3a8";
+    };
+    propagatedBuildInputs = with perlPackages; [ CryptArgon2 CryptPassphrase ];
+    meta = {
+      description = "An Argon2 encoder for Crypt::Passphrase";
+      license = with lib.licenses; [ artistic1 gpl1Plus ];
+    };
+  };
+
   CryptPasswdMD5 = buildPerlModule {
     pname = "Crypt-PasswdMD5";
     version = "1.40";
@@ -18819,6 +18860,19 @@ let
     };
   };
 
+  StringCompareConstantTime = buildPerlPackage {
+    pname = "String-Compare-ConstantTime";
+    version = "0.321";
+    src = fetchurl {
+      url = "mirror://cpan/authors/id/F/FR/FRACTAL/String-Compare-ConstantTime-0.321.tar.gz";
+      sha256 = "0b26ba2b121d8004425d4485d1d46f59001c83763aa26624dff6220d7735d7f7";
+    };
+    meta = {
+      description = "Timing side-channel protected string compare";
+      license = with lib.licenses; [ artistic1 gpl1Plus ];
+    };
+  };
+
   StringCRC32 = buildPerlPackage {
     pname = "String-CRC32";
     version = "2";