diff --git a/nixos/modules/services/home-automation/evcc.nix b/nixos/modules/services/home-automation/evcc.nix
index c12ba9d0c1e2..efa2cf244313 100644
--- a/nixos/modules/services/home-automation/evcc.nix
+++ b/nixos/modules/services/home-automation/evcc.nix
@@ -48,7 +48,10 @@ in
       wantedBy = [
         "multi-user.target"
       ];
-
+      environment.HOME = "/var/lib/evcc";
+      path = with pkgs; [
+        glibc # requires getent
+      ];
       serviceConfig = {
         ExecStart = "${package}/bin/evcc --config ${configFile} ${escapeShellArgs cfg.extraArgs}";
         CapabilityBoundingSet = [ "" ];
@@ -77,6 +80,7 @@ in
         ProtectKernelModules = true;
         ProtectKernelTunables = true;
         ProtectProc = "invisible";
+        StateDirectory = "evcc";
         SystemCallArchitectures = "native";
         SystemCallFilter = [
           "@system-service"
diff --git a/nixos/tests/evcc.nix b/nixos/tests/evcc.nix
index 0fc261142f78..c223977a9d82 100644
--- a/nixos/tests/evcc.nix
+++ b/nixos/tests/evcc.nix
@@ -87,6 +87,7 @@ import ./make-test-python.nix ({ pkgs, lib, ...} :
 
     with subtest("Check journal for errors"):
         _, output = machine.execute("journalctl -o cat -u evcc.service")
+        assert "FATAL" not in output
         assert "ERROR" not in output
 
     with subtest("Check systemd hardening"):
diff --git a/pkgs/applications/audio/pt2-clone/default.nix b/pkgs/applications/audio/pt2-clone/default.nix
index 77695f968969..5cd2a2687889 100644
--- a/pkgs/applications/audio/pt2-clone/default.nix
+++ b/pkgs/applications/audio/pt2-clone/default.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "pt2-clone";
-  version = "1.54";
+  version = "1.55";
 
   src = fetchFromGitHub {
     owner = "8bitbubsy";
     repo = "pt2-clone";
     rev = "v${version}";
-    sha256 = "sha256-d/BUt6jqJmw2MnerbvvhuUWpTHgQr47XuSoFDXo7GEQ=";
+    sha256 = "sha256-NwkHb0FOg9wAgtcEtWqOpNGvBXjQIoc4pMmf/32Gxr0=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix
index 1f5acc0b10da..e5b557acb57e 100644
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -1550,8 +1550,8 @@ let
         mktplcRef = {
           name = "magit";
           publisher = "kahole";
-          version = "0.6.18";
-          sha256 = "0sqzz5bbqqg60aypvwxcqnxrr72gmwfj9sv0amgkyaf60zg5sf7w";
+          version = "0.6.36";
+          sha256 = "sha256-4712BPibXJkkq0XEO9n0ZrdXAcID7IAabu/FOTiTeTo=";
         };
         meta = {
           license = lib.licenses.mit;
diff --git a/pkgs/applications/graphics/drawio/default.nix b/pkgs/applications/graphics/drawio/default.nix
index 513822b4e744..6c17c0715787 100644
--- a/pkgs/applications/graphics/drawio/default.nix
+++ b/pkgs/applications/graphics/drawio/default.nix
@@ -11,11 +11,11 @@
 
 stdenv.mkDerivation rec {
   pname = "drawio";
-  version = "20.6.1";
+  version = "20.6.2";
 
   src = fetchurl {
     url = "https://github.com/jgraph/drawio-desktop/releases/download/v${version}/drawio-x86_64-${version}.rpm";
-    sha256 = "8d1e3d44e53e62dd6dc7f231af5b682c9ff0e798a6480528444ba52cce02b4c9";
+    sha256 = "cf408c19622d7812b93f0f778b7f091a4387992f9d9a767f4bc1c417b61b7058";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/networking/p2p/transmission/default.nix b/pkgs/applications/networking/p2p/transmission/default.nix
index 3cf59928ca90..2bb2967ec745 100644
--- a/pkgs/applications/networking/p2p/transmission/default.nix
+++ b/pkgs/applications/networking/p2p/transmission/default.nix
@@ -16,6 +16,7 @@
 , miniupnpc
 , dht
 , libnatpmp
+, libiconv
   # Build options
 , enableGTK3 ? false
 , gtk3
@@ -93,7 +94,7 @@ in stdenv.mkDerivation {
   ++ lib.optionals enableGTK3 [ gtk3 xorg.libpthreadstubs ]
   ++ lib.optionals enableSystemd [ systemd ]
   ++ lib.optionals stdenv.isLinux [ inotify-tools ]
-  ;
+  ++ lib.optionals stdenv.isDarwin [ libiconv ];
 
   postInstall = ''
     mkdir $apparmor
diff --git a/pkgs/applications/networking/p2p/zeronet-conservancy/default.nix b/pkgs/applications/networking/p2p/zeronet-conservancy/default.nix
index b43ba703baf3..75e7981af5b2 100644
--- a/pkgs/applications/networking/p2p/zeronet-conservancy/default.nix
+++ b/pkgs/applications/networking/p2p/zeronet-conservancy/default.nix
@@ -6,14 +6,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "zeronet-conservancy";
-  version = "0.7.8";
+  version = "0.7.8.1";
   format = "other";
 
   src = fetchFromGitHub {
     owner = "zeronet-conservancy";
     repo = "zeronet-conservancy";
     rev = "v${version}";
-    sha256 = "sha256-U61cQzZfEKCrnk/80yEwh8rh+VojXsvrAQV0ckFqM/4=";
+    sha256 = "sha256-+wZiwUy5bmW8+3h4SuvNN8I6mCIPOlOeFmiXlMu12OU=";
   };
 
   propagatedBuildInputs = with python3Packages; [
diff --git a/pkgs/desktops/pantheon/apps/elementary-music/default.nix b/pkgs/desktops/pantheon/apps/elementary-music/default.nix
index 0a59e4559b8b..dbc96fe02de4 100644
--- a/pkgs/desktops/pantheon/apps/elementary-music/default.nix
+++ b/pkgs/desktops/pantheon/apps/elementary-music/default.nix
@@ -1,7 +1,6 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, fetchpatch
 , nix-update-script
 , meson
 , ninja
@@ -19,42 +18,15 @@
 
 stdenv.mkDerivation rec {
   pname = "elementary-music";
-  version = "7.0.0";
+  version = "7.0.1";
 
   src = fetchFromGitHub {
     owner = "elementary";
     repo = "music";
     rev = version;
-    sha256 = "sha256-fZbOjZd6udJWM+jWXCmGwt6cyl/lXPsgM9XeTScbqts=";
+    sha256 = "sha256-PttmC1Z3rX2XWCECc320HMs692hSBsxkmnh1Q8a/Mg8=";
   };
 
-  patches = [
-    # Use file basename for fallback audio object title
-    # https://github.com/elementary/music/pull/710
-    (fetchpatch {
-      url = "https://github.com/elementary/music/commit/97a437edc7652e0b85b7d3c6fd87089c14ec02e2.patch";
-      sha256 = "sha256-VmK5dKfSKWAIxfaKXsC8tjg6Pqq1XSGxJDQOZWJX92w=";
-    })
-    # Skip invalid files instead of stopping playback
-    # https://github.com/elementary/music/pull/711
-    (fetchpatch {
-      url = "https://github.com/elementary/music/commit/88f332197d2131daeff3306ec2a484a28fa4db21.patch";
-      sha256 = "sha256-Zga0UmL1PAq4P58IjOuEiXGGn187a0/LHbXXze4sSpY=";
-    })
-    # Enable the NEXT button if repeat mode is set to ALL or ONE
-    # https://github.com/elementary/music/pull/712
-    (fetchpatch {
-      url = "https://github.com/elementary/music/commit/3249e3ca247dfd5ff6b14f4feeeeed63b435bcb8.patch";
-      sha256 = "sha256-nx/nlSSRxu4wy8QG5yYBi0BdRoUmnyry7mwzuk5NJxU=";
-    })
-    # Hard code GTK styles
-    # https://github.com/elementary/music/pull/723
-    (fetchpatch {
-      url = "https://github.com/elementary/music/commit/4e22268d38574e56eb3b42ae201c99cc98b510db.patch";
-      sha256 = "sha256-DZds7pg0vYL9vga+tP7KJHcjQTmdKHS+D+q/2aYfMmk=";
-    })
-  ];
-
   nativeBuildInputs = [
     meson
     ninja
diff --git a/pkgs/development/libraries/geos/default.nix b/pkgs/development/libraries/geos/default.nix
index cfcccc571818..a331e0254568 100644
--- a/pkgs/development/libraries/geos/default.nix
+++ b/pkgs/development/libraries/geos/default.nix
@@ -6,15 +6,17 @@
 
 stdenv.mkDerivation rec {
   pname = "geos";
-  version = "3.11.0";
+  version = "3.11.1";
 
   src = fetchurl {
     url = "https://download.osgeo.org/geos/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-eauMq/SqhgTRYVV7UuPk2EV1rNwNCMsJqz96rvpNhYo=";
+    hash = "sha256-bQ6zz6n5LZR3Mcx18XUDVrO9/AfqAgVT2vavHHaOC+I=";
   };
 
   nativeBuildInputs = [ cmake ];
 
+  doCheck = true;
+
   meta = with lib; {
     description = "C++ port of the Java Topology Suite (JTS)";
     homepage = "https://trac.osgeo.org/geos";
diff --git a/pkgs/development/ocaml-modules/piqi/default.nix b/pkgs/development/ocaml-modules/piqi/default.nix
index ec8231285827..b52c73d0534e 100644
--- a/pkgs/development/ocaml-modules/piqi/default.nix
+++ b/pkgs/development/ocaml-modules/piqi/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
 
   strictDeps = true;
 
-  patches = [ ./no-ocamlpath-override.patch ];
+  patches = [ ./no-stream.patch ./no-ocamlpath-override.patch ];
 
   createFindlibDestdir = true;
 
diff --git a/pkgs/development/ocaml-modules/piqi/no-stream.patch b/pkgs/development/ocaml-modules/piqi/no-stream.patch
new file mode 100644
index 000000000000..fde1c46cce42
--- /dev/null
+++ b/pkgs/development/ocaml-modules/piqi/no-stream.patch
@@ -0,0 +1,14 @@
+--- ./piqilib/piq_lexer.ml
++++ ./piqilib/piq_lexer.ml
+@@ -476,11 +476,6 @@ let init_from_string s =
+   make_buf lexbuf
+ 
+ 
+-let init_from_stream s =
+-  let lexbuf = Sedlexing.Utf8.from_stream s in
+-  make_buf lexbuf
+-
+-
+ let init_from_channel ch =
+   let lexbuf = Sedlexing.Utf8.from_channel ch in
+   make_buf lexbuf
diff --git a/pkgs/development/ocaml-modules/sedlex/default.nix b/pkgs/development/ocaml-modules/sedlex/default.nix
index a6a7604208ab..cfe1938bf55b 100644
--- a/pkgs/development/ocaml-modules/sedlex/default.nix
+++ b/pkgs/development/ocaml-modules/sedlex/default.nix
@@ -10,8 +10,8 @@
 
 let param =
   if lib.versionAtLeast ppxlib.version "0.26.0" then {
-    version = "2.6";
-    sha256 = "sha256-AU+dV+jTG9v3BXzip2Bnv04Ewyo3pyUglDDBFsOsFf0=";
+    version = "3.0";
+    sha256 = "sha256-+4ggynMznVfjviMBjXil8CXdMByq4kSmDz6P2PyEETA=";
   } else {
     version = "2.5";
     sha256 = "sha256:062a5dvrzvb81l3a9phljrhxfw9nlb61q341q0a6xn65hll3z2wy";
diff --git a/pkgs/development/python-modules/autobahn/default.nix b/pkgs/development/python-modules/autobahn/default.nix
index a6e6de722744..c18d3b2bb84f 100644
--- a/pkgs/development/python-modules/autobahn/default.nix
+++ b/pkgs/development/python-modules/autobahn/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, fetchpatch
 , attrs
 , argon2-cffi
 , base58
@@ -53,6 +54,14 @@ buildPythonPackage rec {
 
   disabled = pythonOlder "3.7";
 
+  patches = [
+    (fetchpatch {
+      # https://github.com/crossbario/autobahn-python/pull/1604
+      url = "https://github.com/crossbario/autobahn-python/commit/ffe679fae4ebcdde964d4ee88cb82a9c65c40529.patch";
+      sha256 = "sha256-QNnQkxMZJsFbiYUp4Os+dWo7jdCa96+kyb/2HxSMU8k=";
+    })
+  ];
+
   src = fetchPypi {
     inherit pname version;
     sha256 = "sha256-i0Yuouaq1rTcDtRfuAC2y/6wMl5/5pg5B/Ei8r5KH+k=";
diff --git a/pkgs/development/python-modules/ical/default.nix b/pkgs/development/python-modules/ical/default.nix
index c472048d38e5..734dbc1bbc76 100644
--- a/pkgs/development/python-modules/ical/default.nix
+++ b/pkgs/development/python-modules/ical/default.nix
@@ -42,6 +42,9 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
+  # https://github.com/allenporter/ical/issues/136
+  disabledTests = [ "test_all_zoneinfo" ];
+
   pythonImportsCheck = [
     "ical"
   ];
diff --git a/pkgs/tools/security/modsecurity/Makefile.am.patch b/pkgs/tools/security/modsecurity/Makefile.am.patch
new file mode 100644
index 000000000000..6f2e2ed36454
--- /dev/null
+++ b/pkgs/tools/security/modsecurity/Makefile.am.patch
@@ -0,0 +1,17 @@
+--- a/apache2/Makefile.am
++++ b/apache2/Makefile.am
+@@ -179,7 +179,6 @@ install-exec-hook: $(pkglib_LTLIBRARIES)
+ 	for m in $(pkglib_LTLIBRARIES); do \
+ 	  base=`echo $$m | sed 's/\..*//'`; \
+ 	  rm -f $(DESTDIR)$(pkglibdir)/$$base.*a; \
+-	  install -D -m444 $(DESTDIR)$(pkglibdir)/$$base.so $(DESTDIR)$(APXS_MODULES)/$$base.so; \
+ 	done
+ else
+ install-exec-hook: $(pkglib_LTLIBRARIES)
+@@ -187,6 +186,5 @@ install-exec-hook: $(pkglib_LTLIBRARIES)
+ 	for m in $(pkglib_LTLIBRARIES); do \
+ 	  base=`echo $$m | sed 's/\..*//'`; \
+ 	  rm -f $(DESTDIR)$(pkglibdir)/$$base.*a; \
+-	  cp -p $(DESTDIR)$(pkglibdir)/$$base.so $(DESTDIR)$(APXS_MODULES); \
+ 	done
+ endif
diff --git a/pkgs/tools/security/modsecurity/Makefile.in.patch b/pkgs/tools/security/modsecurity/Makefile.in.patch
deleted file mode 100644
index 98384c754ce7..000000000000
--- a/pkgs/tools/security/modsecurity/Makefile.in.patch
+++ /dev/null
@@ -1,17 +0,0 @@
---- a/apache2/Makefile.in	2017-10-10 09:45:51.000000000 -0400
-+++ b/apache2/Makefile.in	2017-10-10 09:46:04.000000000 -0400
-@@ -1208,14 +1208,12 @@
- @LINUX_TRUE@	for m in $(pkglib_LTLIBRARIES); do \
- @LINUX_TRUE@	  base=`echo $$m | sed 's/\..*//'`; \
- @LINUX_TRUE@	  rm -f $(DESTDIR)$(pkglibdir)/$$base.*a; \
--@LINUX_TRUE@	  install -D -m444 $(DESTDIR)$(pkglibdir)/$$base.so $(DESTDIR)$(APXS_MODULES)/$$base.so; \
- @LINUX_TRUE@	done
- @LINUX_FALSE@install-exec-hook: $(pkglib_LTLIBRARIES)
- @LINUX_FALSE@	@echo "Removing unused static libraries..."; \
- @LINUX_FALSE@	for m in $(pkglib_LTLIBRARIES); do \
- @LINUX_FALSE@	  base=`echo $$m | sed 's/\..*//'`; \
- @LINUX_FALSE@	  rm -f $(DESTDIR)$(pkglibdir)/$$base.*a; \
--@LINUX_FALSE@	  cp -p $(DESTDIR)$(pkglibdir)/$$base.so $(DESTDIR)$(APXS_MODULES); \
- @LINUX_FALSE@	done
- 
- # Tell versions [3.59,3.63) of GNU make to not export all variables.
diff --git a/pkgs/tools/security/modsecurity/default.nix b/pkgs/tools/security/modsecurity/default.nix
index 1bbefd1342c3..431a6f9338ea 100644
--- a/pkgs/tools/security/modsecurity/default.nix
+++ b/pkgs/tools/security/modsecurity/default.nix
@@ -1,6 +1,6 @@
-{ stdenv, lib, fetchurl, pkg-config
+{ stdenv, lib, fetchFromGitHub, pkg-config, autoreconfHook
 , curl, apacheHttpd, pcre, apr, aprutil, libxml2
-, luaSupport ? false, lua5
+, luaSupport ? false, lua5, perl
 }:
 
 with lib;
@@ -11,14 +11,16 @@ in
 
 stdenv.mkDerivation rec {
   pname = "modsecurity";
-  version = "2.9.3";
+  version = "2.9.6";
 
-  src = fetchurl {
-    url = "https://www.modsecurity.org/tarball/${version}/${pname}-${version}.tar.gz";
-    sha256 = "0611nskd2y6yagrciqafxdn4rxbdk2v4swf45kc1sgwx2sfh34j1";
+  src = fetchFromGitHub {
+    owner = "SpiderLabs";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "sha256-C/D/UWaI4GsXjfhLmNnYhRJoUvlsps1551SqhmZUc/4=";
   };
 
-  nativeBuildInputs = [ pkg-config ];
+  nativeBuildInputs = [ pkg-config autoreconfHook ];
   buildInputs = [  curl apacheHttpd pcre apr aprutil libxml2 ] ++
     optional luaSupport lua5;
 
@@ -37,7 +39,10 @@ stdenv.mkDerivation rec {
   outputs = ["out" "nginx"];
   # by default modsecurity's install script copies compiled output to httpd's modules folder
   # this patch removes those lines
-  patches = [ ./Makefile.in.patch ];
+  patches = [ ./Makefile.am.patch ];
+
+  doCheck = true;
+  checkInputs = [ perl ];
 
   postInstall = ''
     mkdir -p $nginx