diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index d24f98efb7d3..60bf5afc69b1 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -154,6 +154,7 @@
   ./programs/gnupg.nix
   ./programs/gphoto2.nix
   ./programs/hamster.nix
+  ./programs/htop.nix
   ./programs/iftop.nix
   ./programs/iotop.nix
   ./programs/java.nix
diff --git a/nixos/modules/programs/htop.nix b/nixos/modules/programs/htop.nix
new file mode 100644
index 000000000000..5c197838e47c
--- /dev/null
+++ b/nixos/modules/programs/htop.nix
@@ -0,0 +1,58 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+
+  cfg = config.programs.htop;
+
+  fmt = value:
+    if isList value then concatStringsSep " " (map fmt value) else
+    if isString value then value else
+    if isBool value || isInt value then toString value else
+    throw "Unrecognized type ${typeOf value} in htop settings";
+
+in
+
+{
+
+  options.programs.htop = {
+    package = mkOption {
+      type = types.package;
+      default = pkgs.htop;
+      defaultText = "pkgs.htop";
+      description = ''
+        The htop package that should be used.
+      '';
+    };
+
+    enable = mkEnableOption "htop process monitor";
+
+    settings = mkOption {
+      type = with types; attrsOf (oneOf [ str int bool (listOf (oneOf [ str int bool ])) ]);
+      default = {};
+      example = {
+        hide_kernel_threads = true;
+        hide_userland_threads = true;
+      };
+      description = ''
+        Extra global default configuration for htop
+        which is read on first startup only.
+        Htop subsequently uses ~/.config/htop/htoprc
+        as configuration source.
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable {
+    environment.systemPackages = [
+      cfg.package
+    ];
+
+    environment.etc."htoprc".text = ''
+      # Global htop configuration
+      # To change set: programs.htop.settings.KEY = VALUE;
+    '' + concatStringsSep "\n" (mapAttrsToList (key: value: "${key}=${fmt value}") cfg.settings);
+  };
+
+}
diff --git a/pkgs/applications/misc/orpie/default.nix b/pkgs/applications/misc/orpie/default.nix
index 45e043b6dcfa..a1f119f6834c 100644
--- a/pkgs/applications/misc/orpie/default.nix
+++ b/pkgs/applications/misc/orpie/default.nix
@@ -13,12 +13,10 @@ ocamlPackages.buildDunePackage rec {
     sha256 = "1rx2nl6cdv609pfymnbq53pi3ql5fr4kda8x10ycd9xq2gc4f21g";
   };
 
+  patches = [ ./prefix.patch ];
+
   preConfigure = ''
-    patchShebangs scripts
-    substituteInPlace scripts/compute_prefix \
-      --replace '"topfind"' \
-      '"${ocamlPackages.findlib}/lib/ocaml/${ocamlPackages.ocaml.version}/site-lib/topfind"'
-    export PREFIX=$out
+    substituteInPlace src/orpie/install.ml.in --replace '@prefix@' $out
   '';
 
   buildInputs = with ocamlPackages; [ curses camlp5 num gsl ];
diff --git a/pkgs/applications/misc/orpie/prefix.patch b/pkgs/applications/misc/orpie/prefix.patch
new file mode 100644
index 000000000000..41e72ca6d616
--- /dev/null
+++ b/pkgs/applications/misc/orpie/prefix.patch
@@ -0,0 +1,11 @@
+--- a/src/orpie/dune	2021-10-05 06:09:09.040120000 +0200
++++ b/src/orpie/dune	2021-10-05 06:10:06.568418512 +0200
+@@ -18,7 +18,7 @@
+ ; Support $PREFIX for overriding installation location
+ (rule
+   (targets install.ml)
+-  (action (run %{project_root}/scripts/compute_prefix subst %{deps} %{targets}))
++  (action (copy# %{deps} %{targets}))
+   (deps (file install.ml.in)))
+ 
+ 
diff --git a/pkgs/development/beam-modules/erlang-ls/default.nix b/pkgs/development/beam-modules/erlang-ls/default.nix
index cad68e6f302a..cec3336dcb4c 100644
--- a/pkgs/development/beam-modules/erlang-ls/default.nix
+++ b/pkgs/development/beam-modules/erlang-ls/default.nix
@@ -1,7 +1,7 @@
 { fetchFromGitHub, fetchgit, fetchHex, rebar3Relx, buildRebar3, rebar3-proper
 , stdenv, writeScript, lib }:
 let
-  version = "0.19.0";
+  version = "0.20.0";
   owner = "erlang-ls";
   repo = "erlang_ls";
   deps = import ./rebar-deps.nix {
@@ -19,7 +19,7 @@ rebar3Relx {
   inherit version;
   src = fetchFromGitHub {
     inherit owner repo;
-    sha256 = "sha256-WesGgLoVR435lNXnsCFYcUoKXDMuL7hWImDluori+dc=";
+    sha256 = "sha256-XBCauvPalIPjVOYlMfWC+5mKku28b/qqKhp9NgSkoyA=";
     rev = version;
   };
   releaseType = "escript";
diff --git a/pkgs/development/compilers/bigloo/default.nix b/pkgs/development/compilers/bigloo/default.nix
index c4fa5712ea63..d61d34276a30 100644
--- a/pkgs/development/compilers/bigloo/default.nix
+++ b/pkgs/development/compilers/bigloo/default.nix
@@ -1,5 +1,5 @@
 { fetchurl, lib, stdenv, autoconf, automake, libtool, gmp
-, darwin
+, darwin, libunistring
 }:
 
 stdenv.mkDerivation rec {
@@ -13,9 +13,10 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ autoconf automake libtool ];
 
-  buildInputs = lib.optional stdenv.isDarwin
+  buildInputs = lib.optionals stdenv.isDarwin [
     darwin.apple_sdk.frameworks.ApplicationServices
-  ;
+    libunistring
+  ];
 
   propagatedBuildInputs = [ gmp ];
 
diff --git a/pkgs/development/coq-modules/StructTact/default.nix b/pkgs/development/coq-modules/StructTact/default.nix
index 9770b9fb9c45..08976c689893 100644
--- a/pkgs/development/coq-modules/StructTact/default.nix
+++ b/pkgs/development/coq-modules/StructTact/default.nix
@@ -4,7 +4,12 @@ with lib; mkCoqDerivation {
   pname = "StructTact";
   owner = "uwplse";
   inherit version;
-  defaultVersion = if versions.isGe "8.5" coq.coq-version then "20181102" else null;
+  defaultVersion = with versions; switch coq.coq-version [
+    { case = range "8.6" "8.14"; out = "20210328"; }
+    { case = range "8.5" "8.13"; out = "20181102"; }
+  ] null;
+  release."20210328".rev =    "179bd5312e9d8b63fc3f4071c628cddfc496d741";
+  release."20210328".sha256 = "sha256:1y5r1zm3hli10ah6lnj7n8hxad6rb6rgldd0g7m2fjibzvwqzhdg";
   release."20181102".rev =    "82a85b7ec07e71fa6b30cfc05f6a7bfb09ef2510";
   release."20181102".sha256 = "08zry20flgj7qq37xk32kzmg4fg6d4wi9m7pf9aph8fd3j2a0b5v";
   preConfigure = "patchShebangs ./configure";
diff --git a/pkgs/development/coq-modules/Verdi/default.nix b/pkgs/development/coq-modules/Verdi/default.nix
index d3769eb2c4db..2701cf6f04c4 100644
--- a/pkgs/development/coq-modules/Verdi/default.nix
+++ b/pkgs/development/coq-modules/Verdi/default.nix
@@ -6,9 +6,12 @@ with lib; mkCoqDerivation {
   owner = "uwplse";
   inherit version;
   defaultVersion = with versions; switch coq.coq-version [
-    { case = isGe "8.7"; out = "20200131"; }
-    { case = isEq "8.6"; out = "20181102"; }
+    { case = range "8.7" "8.14"; out = "20210524"; }
+    { case = range "8.7" "8.13"; out = "20200131"; }
+    { case = "8.6"; out = "20181102"; }
   ] null;
+  release."20210524".rev    = "54597d8ac7ab7dd4dae683f651237644bf77701e";
+  release."20210524".sha256 = "sha256:05wb0km2jkhvi8807glxk9fi1kll4lwisiyzkxhqvymz4x6v8xqv";
   release."20200131".rev    = "fdb4ede19d2150c254f0ebcfbed4fb9547a734b0";
   release."20200131".sha256 = "1a2k19f9q5k5djbxplqmmpwck49kw3lrm3aax920h4yb40czkd8m";
   release."20181102".rev    = "25b79cf1be5527ab8dc1b8314fcee93e76a2e564";
diff --git a/pkgs/development/python-modules/bugsnag/default.nix b/pkgs/development/python-modules/bugsnag/default.nix
index f23bc566bac5..f157f291f7fb 100644
--- a/pkgs/development/python-modules/bugsnag/default.nix
+++ b/pkgs/development/python-modules/bugsnag/default.nix
@@ -8,12 +8,12 @@
 
 buildPythonPackage rec {
   pname = "bugsnag";
-  version = "4.1.0";
+  version = "4.1.1";
   disabled = pythonOlder "3.5";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-3L1ZzZ7eomzJLvtlGK7YOi81b4G/1azHML/iAvsnwcE=";
+    sha256 = "cdbdb3e02ef0c0655bb55be8b05ec1cb830b5ec629923ccb24bfd71dede3d1c3";
   };
 
   propagatedBuildInputs = [ six webob ];
diff --git a/pkgs/development/python-modules/django-webpack-loader/default.nix b/pkgs/development/python-modules/django-webpack-loader/default.nix
index c782a5f6746e..2656dd593c1c 100644
--- a/pkgs/development/python-modules/django-webpack-loader/default.nix
+++ b/pkgs/development/python-modules/django-webpack-loader/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "django-webpack-loader";
-  version = "1.1.0";
+  version = "1.4.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "c7f89a272a177a17a045ceab26bbb7e35d28ca5597c384de96817784b610c977";
+    sha256 = "7e34085b7fc4d352e482ff9cf7d09ae4524e730675e25432ab1d25a2dd94e583";
   };
 
   # django.core.exceptions.ImproperlyConfigured (path issue with DJANGO_SETTINGS_MODULE?)
diff --git a/pkgs/development/python-modules/google-cloud-access-context-manager/default.nix b/pkgs/development/python-modules/google-cloud-access-context-manager/default.nix
index f2e327670586..a3ecf1a6ec4b 100644
--- a/pkgs/development/python-modules/google-cloud-access-context-manager/default.nix
+++ b/pkgs/development/python-modules/google-cloud-access-context-manager/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-access-context-manager";
-  version = "0.1.7";
+  version = "0.1.8";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "02adf212c8d280298ffe03a0c91743618693ec394b42cbb85b4a29f8d9544afa";
+    sha256 = "29101f61fa0e07db6385a94da45aef8edb4efde0d2b700fbbf65164c045744a8";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/langcodes/default.nix b/pkgs/development/python-modules/langcodes/default.nix
index 485bc44ff6e2..66a2bb355b68 100644
--- a/pkgs/development/python-modules/langcodes/default.nix
+++ b/pkgs/development/python-modules/langcodes/default.nix
@@ -8,12 +8,12 @@
 
 buildPythonPackage rec {
   pname = "langcodes";
-  version = "3.1.0";
+  version = "3.2.0";
   disabled = pythonOlder "3.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1ccd37e3a68760d29ec3b17f5962cd1d8f242f4d9705ad1601c5cb7fab48199c";
+    sha256 = "38e06cd104847be351b003a9857e79f108fb94b49dd2e84dbab905fd3777530a";
   };
 
   propagatedBuildInputs = [ marisa-trie ];
diff --git a/pkgs/misc/arm-trusted-firmware/default.nix b/pkgs/misc/arm-trusted-firmware/default.nix
index c3be2213c337..49d27487bae7 100644
--- a/pkgs/misc/arm-trusted-firmware/default.nix
+++ b/pkgs/misc/arm-trusted-firmware/default.nix
@@ -80,6 +80,12 @@ in {
     filesToInstall = ["build/${platform}/release/bl31.bin"];
   };
 
+  armTrustedFirmwareAllwinnerH616 = buildArmTrustedFirmware rec {
+    platform = "sun50i_h616";
+    extraMeta.platforms = ["aarch64-linux"];
+    filesToInstall = ["build/${platform}/release/bl31.bin"];
+  };
+
   armTrustedFirmwareQemu = buildArmTrustedFirmware rec {
     platform = "qemu";
     extraMeta.platforms = ["aarch64-linux"];
diff --git a/pkgs/misc/uboot/default.nix b/pkgs/misc/uboot/default.nix
index 71f3e13fc906..98f037b4fb92 100644
--- a/pkgs/misc/uboot/default.nix
+++ b/pkgs/misc/uboot/default.nix
@@ -11,6 +11,7 @@
 , swig
 , meson-tools
 , armTrustedFirmwareAllwinner
+, armTrustedFirmwareAllwinnerH616
 , armTrustedFirmwareRK3328
 , armTrustedFirmwareRK3399
 , armTrustedFirmwareS905
@@ -282,6 +283,13 @@ in {
     filesToInstall = ["u-boot-sunxi-with-spl.bin"];
   };
 
+  ubootOrangePiZero2 = buildUBoot {
+    defconfig = "orangepi_zero2_defconfig";
+    extraMeta.platforms = ["aarch64-linux"];
+    BL31 = "${armTrustedFirmwareAllwinnerH616}/bl31.bin";
+    filesToInstall = ["u-boot-sunxi-with-spl.bin"];
+  };
+
   ubootPcduino3Nano = buildUBoot {
     defconfig = "Linksprite_pcDuino3_Nano_defconfig";
     extraMeta.platforms = ["armv7l-linux"];
diff --git a/pkgs/tools/misc/chezmoi/default.nix b/pkgs/tools/misc/chezmoi/default.nix
index 8568c6b488c7..415fed33170c 100644
--- a/pkgs/tools/misc/chezmoi/default.nix
+++ b/pkgs/tools/misc/chezmoi/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "chezmoi";
-  version = "2.3.0";
+  version = "2.6.1";
 
   src = fetchFromGitHub {
     owner = "twpayne";
     repo = "chezmoi";
     rev = "v${version}";
-    sha256 = "sha256-hKWajx4cAs6rP536Xnz7zg2LPg36EwDDUBzpQkQLVoE=";
+    sha256 = "sha256-x5KqDVy+thIymZHsmyO+WsGq0IBb2cZxogKsjzunC2o=";
   };
 
-  vendorSha256 = "sha256-ECdsuKvBVyzRo9XviVldHnD4nND9P1v4esLz0+L+c7o=";
+  vendorSha256 = "sha256-8NhJfA9q6di/IPL53U/dwGNAAdtuBX5Lf6fhTk4Mz0Q=";
 
   doCheck = false;
 
diff --git a/pkgs/tools/security/apkleaks/default.nix b/pkgs/tools/security/apkleaks/default.nix
new file mode 100644
index 000000000000..133601e4025f
--- /dev/null
+++ b/pkgs/tools/security/apkleaks/default.nix
@@ -0,0 +1,37 @@
+{ lib
+, fetchFromGitHub
+, jadx
+, python3
+}:
+
+python3.pkgs.buildPythonApplication rec {
+  pname = "apkleaks";
+  version = "2.6.1";
+
+  disabled = python3.pythonOlder "3.6";
+
+  src = fetchFromGitHub {
+    owner = "dwisiswant0";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "0ysciv643p8gkqw2wp7zy4n07hihdcyil8d20lj86cpgga71rd64";
+  };
+
+  propagatedBuildInputs = with python3.pkgs; [
+    jadx
+    pyaxmlparser
+    setuptools
+  ];
+
+  # Project has no tests
+  doCheck = false;
+
+  pythonImportsCheck = [ "apkleaks" ];
+
+  meta = with lib; {
+    description = "Scanning APK file for URIs, endpoints and secrets";
+    homepage = "https://github.com/dwisiswant0/apkleaks";
+    license = with licenses; [ asl20 ];
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/tools/security/ghost/default.nix b/pkgs/tools/security/ghost/default.nix
new file mode 100644
index 000000000000..124caef45c20
--- /dev/null
+++ b/pkgs/tools/security/ghost/default.nix
@@ -0,0 +1,34 @@
+{ lib
+, fetchFromGitHub
+, python3
+}:
+
+python3.pkgs.buildPythonApplication rec {
+  pname = "ghost";
+  version = "8.0.0";
+
+  disabled = python3.pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "EntySec";
+    repo = "Ghost";
+    rev = version;
+    sha256 = "13p3inw7v55na8438awr692v9vb7zgf5ggxpha9r3m8vfm3sb4iz";
+  };
+
+  propagatedBuildInputs = with python3.pkgs; [
+    adb-shell
+  ];
+
+  # Project has no tests
+  doCheck = false;
+
+  pythonImportsCheck = [ "ghost" ];
+
+  meta = with lib; {
+    description = "Android post-exploitation framework";
+    homepage = "https://github.com/EntySec/ghost";
+    license = with licenses; [ mit ];
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/tools/system/htop/default.nix b/pkgs/tools/system/htop/default.nix
index 350c20ae101d..bc8dde743c8e 100644
--- a/pkgs/tools/system/htop/default.nix
+++ b/pkgs/tools/system/htop/default.nix
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
     ++ optional systemdSupport systemd
   ;
 
-  configureFlags = [ "--enable-unicode" ]
+  configureFlags = [ "--enable-unicode" "--sysconfdir=/etc" ]
     ++ optional sensorsSupport "--with-sensors"
   ;
 
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 3a6caf92d685..127375bad407 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -1171,6 +1171,8 @@ with pkgs;
 
   apkid = callPackage ../development/tools/apkid { };
 
+  apkleaks = callPackage ../tools/security/apkleaks { };
+
   apksigcopier = callPackage ../development/tools/apksigcopier { };
 
   apksigner = callPackage ../development/tools/apksigner {
@@ -5313,6 +5315,8 @@ with pkgs;
 
   ghorg = callPackage ../applications/version-management/git-and-tools/ghorg { };
 
+  ghost = callPackage ../tools/security/ghost { };
+
   ghostunnel = callPackage ../tools/networking/ghostunnel { };
 
   ghq = callPackage ../applications/version-management/git-and-tools/ghq { };
@@ -21267,6 +21271,7 @@ with pkgs;
     buildArmTrustedFirmware
     armTrustedFirmwareTools
     armTrustedFirmwareAllwinner
+    armTrustedFirmwareAllwinnerH616
     armTrustedFirmwareQemu
     armTrustedFirmwareRK3328
     armTrustedFirmwareRK3399
@@ -22258,6 +22263,7 @@ with pkgs;
     ubootOrangePiPc
     ubootOrangePiZeroPlus2H5
     ubootOrangePiZero
+    ubootOrangePiZero2
     ubootPcduino3Nano
     ubootPine64
     ubootPine64LTS