diff --git a/.github/workflows/editorconfig.yml b/.github/workflows/editorconfig.yml
index 270728a61c6f..c20ed3ab768d 100644
--- a/.github/workflows/editorconfig.yml
+++ b/.github/workflows/editorconfig.yml
@@ -25,7 +25,7 @@ jobs:
     - name: Fetch editorconfig-checker
       if: env.PR_DIFF
       env:
-        ECC_VERSION: "2.3.1"
+        ECC_VERSION: "2.3.5"
         ECC_URL: "https://github.com/editorconfig-checker/editorconfig-checker/releases/download"
       run: |
         curl -sSf -O -L -C - "$ECC_URL/$ECC_VERSION/ec-linux-amd64.tar.gz" && \
diff --git a/nixos/tests/bitwarden.nix b/nixos/tests/bitwarden.nix
index 5345c7245d00..3813a1f70f96 100644
--- a/nixos/tests/bitwarden.nix
+++ b/nixos/tests/bitwarden.nix
@@ -113,6 +113,7 @@ let
                   driver.find_element_by_css_selector('input#masterPasswordRetype').send_keys(
                     '${userPassword}'
                   )
+                  driver.find_element_by_css_selector('input#acceptPolicies').click()
 
                   driver.find_element_by_xpath("//button[contains(., 'Submit')]").click()
 
diff --git a/pkgs/applications/audio/new-session-manager/default.nix b/pkgs/applications/audio/new-session-manager/default.nix
index 0badb85f02c4..eedd193b2c54 100644
--- a/pkgs/applications/audio/new-session-manager/default.nix
+++ b/pkgs/applications/audio/new-session-manager/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "new-session-manager";
-  version = "1.5.0";
+  version = "1.5.1";
 
   src = fetchFromGitHub {
     owner = "linuxaudio";
     repo = "new-session-manager";
     rev = "v${version}";
-    sha256 = "sha256-YP5AHoFP8P1o0Y2jAipRcNPxPRuM7COs5tBMm6Eojoc=";
+    sha256 = "sha256-hcw+Fn5s1S786eqmR95RmkFcIaRzWaH38YE9DXVQJU0=";
   };
 
   nativeBuildInputs = [ meson pkg-config ninja ];
diff --git a/pkgs/applications/networking/remote/citrix-workspace/default.nix b/pkgs/applications/networking/remote/citrix-workspace/default.nix
index 3a6054db3543..c73789ddeb7b 100644
--- a/pkgs/applications/networking/remote/citrix-workspace/default.nix
+++ b/pkgs/applications/networking/remote/citrix-workspace/default.nix
@@ -14,7 +14,7 @@ let
       Citrix Workspace at version ${x} is not supported anymore!
 
       Actively supported releases are listed here:
-      https://www.citrix.com/en-gb/support/product-lifecycle/milestones/receiver.html
+      https://www.citrix.com/support/product-lifecycle/milestones/receiver.html
     '')) unsupportedVersions
   );
 
diff --git a/pkgs/applications/networking/remote/citrix-workspace/sources.nix b/pkgs/applications/networking/remote/citrix-workspace/sources.nix
index 75eb4645f4fb..1256f47041aa 100644
--- a/pkgs/applications/networking/remote/citrix-workspace/sources.nix
+++ b/pkgs/applications/networking/remote/citrix-workspace/sources.nix
@@ -11,7 +11,7 @@ let
   # Attribute-set with all actively supported versions of the Citrix workspace app
   # for Linux.
   #
-  # The latest versions can be found at https://www.citrix.com/de-de/downloads/workspace-app/linux/
+  # The latest versions can be found at https://www.citrix.com/downloads/workspace-app/linux/
   supportedVersions = lib.mapAttrs mkVersionInfo {
     "20.04.0" = {
       major     = "20";
@@ -78,6 +78,17 @@ let
       x86suffix = "14";
       homepage  = "https://www.citrix.com/de-de/downloads/workspace-app/linux/workspace-app-for-linux-latest.html";
     };
+
+    "21.03.0" = {
+      major     = "21";
+      minor     = "3";
+      patch     = "0";
+      x64hash   = "004pgvxl81l99sqvrs5xzvjivjlc21rrlm2gky9hmbsm53nsl3zc";
+      x86hash   = "11nn9734a515dm1q880z9wmhvx8ikyh3riayyn42z22q4kd852n3";
+      x64suffix = "38";
+      x86suffix = "38";
+      homepage  = "https://www.citrix.com/downloads/workspace-app/linux/workspace-app-for-linux-latest.html";
+    };
   };
 
   # Retain attribute-names for abandoned versions of Citrix workspace to
diff --git a/pkgs/applications/networking/znc/default.nix b/pkgs/applications/networking/znc/default.nix
index 557c2865fa1f..e5aec9117068 100644
--- a/pkgs/applications/networking/znc/default.nix
+++ b/pkgs/applications/networking/znc/default.nix
@@ -39,6 +39,8 @@ stdenv.mkDerivation rec {
   ] ++ optional (!withIPv6) [ "--disable-ipv6" ]
     ++ optional withDebug [ "--enable-debug" ];
 
+  enableParallelBuilding = true;
+
   meta = with lib; {
     description = "Advanced IRC bouncer";
     homepage = "https://wiki.znc.in/ZNC";
diff --git a/pkgs/applications/science/biology/picard-tools/default.nix b/pkgs/applications/science/biology/picard-tools/default.nix
index 52a17e8d01cd..ed0d043cd542 100644
--- a/pkgs/applications/science/biology/picard-tools/default.nix
+++ b/pkgs/applications/science/biology/picard-tools/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "picard-tools";
-  version = "2.25.0";
+  version = "2.25.1";
 
   src = fetchurl {
     url = "https://github.com/broadinstitute/picard/releases/download/${version}/picard.jar";
-    sha256 = "sha256-+vJDTahP4htRbVeBd2eSD97fwZ69wB2cro1tMxT36Jc=";
+    sha256 = "sha256-bW5iLWtGX5/HBMN7y6VbDaxa0U0HCIu9vfreXNAn7hw=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/desktops/plasma-5/fetch.sh b/pkgs/desktops/plasma-5/fetch.sh
index 1a739585efe0..10214b3fe23f 100644
--- a/pkgs/desktops/plasma-5/fetch.sh
+++ b/pkgs/desktops/plasma-5/fetch.sh
@@ -1 +1 @@
-WGET_ARGS=( https://download.kde.org/stable/plasma/5.21.1/ -A '*.tar.xz' )
+WGET_ARGS=( https://download.kde.org/stable/plasma/5.21.3/ -A '*.tar.xz' )
diff --git a/pkgs/desktops/plasma-5/srcs.nix b/pkgs/desktops/plasma-5/srcs.nix
index 96a60ac5e4b1..bf93e0564d9f 100644
--- a/pkgs/desktops/plasma-5/srcs.nix
+++ b/pkgs/desktops/plasma-5/srcs.nix
@@ -1,422 +1,422 @@
 # DO NOT EDIT! This file is generated automatically.
-# Command: ./maintainers/scripts/fetch-kde-qt.sh pkgs/desktops/plasma-5/
+# Command: ./maintainers/scripts/fetch-kde-qt.sh pkgs/desktops/plasma-5
 { fetchurl, mirror }:
 
 {
   bluedevil = {
-    version = "5.21.1";
+    version = "5.21.3";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.1/bluedevil-5.21.1.tar.xz";
-      sha256 = "0b69gacp5cbl32m92k2j36cqq38lpxlybx3wnzj1148j6wvfbajn";
-      name = "bluedevil-5.21.1.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.3/bluedevil-5.21.3.tar.xz";
+      sha256 = "1xqm4bn97asilc4yw5rvmmhk7c7wvmbalalr6gz8gw4gv0pg67qv";
+      name = "bluedevil-5.21.3.tar.xz";
     };
   };
   breeze = {
-    version = "5.21.1";
+    version = "5.21.3";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.1/breeze-5.21.1.tar.xz";
-      sha256 = "1xdpsc4nf0556x9iimszi287jjks8qpqi45n81iccbcz91i5bnb5";
-      name = "breeze-5.21.1.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.3/breeze-5.21.3.tar.xz";
+      sha256 = "0frm3f8q1n0pdzjk7zwmvlrl19fb9265ihnnfhak6ckaq50x72l3";
+      name = "breeze-5.21.3.tar.xz";
     };
   };
   breeze-grub = {
-    version = "5.21.1";
+    version = "5.21.3";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.1/breeze-grub-5.21.1.tar.xz";
-      sha256 = "0w0kkdqliliy72f41xps0a2mr0rf4kn08immichcvrm47r9bjr37";
-      name = "breeze-grub-5.21.1.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.3/breeze-grub-5.21.3.tar.xz";
+      sha256 = "1j0pk4pv5pxwhwah1gd5znnsw3j15x2sc74pp6zinz9a1ywjklnz";
+      name = "breeze-grub-5.21.3.tar.xz";
     };
   };
   breeze-gtk = {
-    version = "5.21.1";
+    version = "5.21.3";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.1/breeze-gtk-5.21.1.tar.xz";
-      sha256 = "14xq2796n8927362851kffpvxxscw82sm5j9ghsb24hr860zcdk7";
-      name = "breeze-gtk-5.21.1.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.3/breeze-gtk-5.21.3.tar.xz";
+      sha256 = "1x5by915lfhbkhgrhy3lkwg64skwdlqaxzbq92x0m9v9a9agwidc";
+      name = "breeze-gtk-5.21.3.tar.xz";
     };
   };
   breeze-plymouth = {
-    version = "5.21.1";
+    version = "5.21.3";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.1/breeze-plymouth-5.21.1.tar.xz";
-      sha256 = "0xgxmh5gnjz8r5h97arsb1ddvizfpajw6zfwrkrsiw0kxkb0ppn9";
-      name = "breeze-plymouth-5.21.1.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.3/breeze-plymouth-5.21.3.tar.xz";
+      sha256 = "01ida3pfj6g1igndjfjpv16199zysgxlxlnc7vsx7kr8aval8pmx";
+      name = "breeze-plymouth-5.21.3.tar.xz";
     };
   };
   discover = {
-    version = "5.21.1";
+    version = "5.21.3";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.1/discover-5.21.1.tar.xz";
-      sha256 = "1a1wmils7ijkvn1x5gqrdg3rv7mcnh0gaaig9ca555qqc2ab0ivl";
-      name = "discover-5.21.1.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.3/discover-5.21.3.tar.xz";
+      sha256 = "170kxhrwj4mvj5qg7cyz3sxdfyp7rr4pgsi3v7kahs19a9w3isnx";
+      name = "discover-5.21.3.tar.xz";
     };
   };
   drkonqi = {
-    version = "5.21.1";
+    version = "5.21.3";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.1/drkonqi-5.21.1.tar.xz";
-      sha256 = "1iqk9mg5bi5yn9ccalwva8yshamrmsx4kfww8imxv8mhmq9p4mib";
-      name = "drkonqi-5.21.1.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.3/drkonqi-5.21.3.tar.xz";
+      sha256 = "1hq37vi0vndhy66labspm75blicx1g4q594wxfxzl076mav5jds4";
+      name = "drkonqi-5.21.3.tar.xz";
     };
   };
   kactivitymanagerd = {
-    version = "5.21.1";
+    version = "5.21.3";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.1/kactivitymanagerd-5.21.1.tar.xz";
-      sha256 = "1wzwkyylk4qsiab7jzlw62mfv5r3pxdk3vqyydca112836nhbdj3";
-      name = "kactivitymanagerd-5.21.1.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.3/kactivitymanagerd-5.21.3.tar.xz";
+      sha256 = "1x5p6rbjf9kz07r5mrkiglvbigvk5bfx8qpb8l2vagsbvlg298c3";
+      name = "kactivitymanagerd-5.21.3.tar.xz";
     };
   };
   kde-cli-tools = {
-    version = "5.21.1";
+    version = "5.21.3";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.1/kde-cli-tools-5.21.1.tar.xz";
-      sha256 = "0835323rbb3akhzdnjxb2myfbfz0wh3c5j1jih4l9zqr0ixx9lb3";
-      name = "kde-cli-tools-5.21.1.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.3/kde-cli-tools-5.21.3.tar.xz";
+      sha256 = "0hkmr3zxg4np1ppsgj77ijgkwgvl7d0zxwl46xjc2px877lx8bpp";
+      name = "kde-cli-tools-5.21.3.tar.xz";
     };
   };
   kdecoration = {
-    version = "5.21.1";
+    version = "5.21.3";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.1/kdecoration-5.21.1.tar.xz";
-      sha256 = "1qy848hvqiar3vj7cz0srszybqj9sf5lfip8ws0fwllqgsa5v505";
-      name = "kdecoration-5.21.1.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.3/kdecoration-5.21.3.tar.xz";
+      sha256 = "06a3gsf1lyjxccjzn0ad254wsf7x2bln2i6kyk5j4gwqss6lplf5";
+      name = "kdecoration-5.21.3.tar.xz";
     };
   };
   kde-gtk-config = {
-    version = "5.21.1";
+    version = "5.21.3";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.1/kde-gtk-config-5.21.1.tar.xz";
-      sha256 = "0nq741x9flnyzhgj5h4r1774b11211ab0lcclhlji9ch7kqxs8dc";
-      name = "kde-gtk-config-5.21.1.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.3/kde-gtk-config-5.21.3.tar.xz";
+      sha256 = "17fyan2jah059kj1i0sy7h901a4d2k7cc87sd84mskyys7g8vs1h";
+      name = "kde-gtk-config-5.21.3.tar.xz";
     };
   };
   kdeplasma-addons = {
-    version = "5.21.1";
+    version = "5.21.3";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.1/kdeplasma-addons-5.21.1.tar.xz";
-      sha256 = "0xpki1kabdm4fwifx0xsb0isig9dnzks4zfglrkg9g0nafahsbf8";
-      name = "kdeplasma-addons-5.21.1.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.3/kdeplasma-addons-5.21.3.tar.xz";
+      sha256 = "1181ax96csn4170p5blvhr679d7l865nby5a66swscyl3a5ys8b1";
+      name = "kdeplasma-addons-5.21.3.tar.xz";
     };
   };
   kgamma5 = {
-    version = "5.21.1";
+    version = "5.21.3";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.1/kgamma5-5.21.1.tar.xz";
-      sha256 = "1316l73jj4b41mrsk1vba3g4mdj0q6hxazqqkvzrcinzwr34p3l2";
-      name = "kgamma5-5.21.1.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.3/kgamma5-5.21.3.tar.xz";
+      sha256 = "0h8rwwd6lyfzmxsr5sfvllh1j8gk1pbq1w2fva8q534qrkqhqb49";
+      name = "kgamma5-5.21.3.tar.xz";
     };
   };
   khotkeys = {
-    version = "5.21.1";
+    version = "5.21.3";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.1/khotkeys-5.21.1.tar.xz";
-      sha256 = "1kp6s1qgzz6j5z4widy5hqnwyh90vw3adf47jk54msdzlh2ak0q7";
-      name = "khotkeys-5.21.1.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.3/khotkeys-5.21.3.tar.xz";
+      sha256 = "1n3ahrb5mzrxap572ydal1sy5q71af97iy4i2fwbljdb6zb1l1bl";
+      name = "khotkeys-5.21.3.tar.xz";
     };
   };
   kinfocenter = {
-    version = "5.21.1";
+    version = "5.21.3";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.1/kinfocenter-5.21.1.tar.xz";
-      sha256 = "1fy5985f4zf9v656dfb30c95pkbasx2302qamdxpfhrl465nqn5d";
-      name = "kinfocenter-5.21.1.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.3/kinfocenter-5.21.3.tar.xz";
+      sha256 = "1hj4mnx2mxb1ya7la05frx5c39cp3q7c5f78lnp6p8bkv3ylik72";
+      name = "kinfocenter-5.21.3.tar.xz";
     };
   };
   kmenuedit = {
-    version = "5.21.1";
+    version = "5.21.3";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.1/kmenuedit-5.21.1.tar.xz";
-      sha256 = "1cksy6fn9mx96jnlglzmg0n9817vmypl1lwxdyxncxzw275k0c05";
-      name = "kmenuedit-5.21.1.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.3/kmenuedit-5.21.3.tar.xz";
+      sha256 = "0fc3sal11amaj5ydws86hdmc45zhrxkv6lc5sfy200wvff3ynjjj";
+      name = "kmenuedit-5.21.3.tar.xz";
     };
   };
   kscreen = {
-    version = "5.21.1";
+    version = "5.21.3";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.1/kscreen-5.21.1.tar.xz";
-      sha256 = "0w199x0ig7vv7ki17v5paipw1jkkiavj6296zmpbnxn88n6i8jw3";
-      name = "kscreen-5.21.1.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.3/kscreen-5.21.3.tar.xz";
+      sha256 = "1f9gxdlj883ddmc1xgd1nmm8n6m5yd269kfx3m9bbp61cw4hrqlm";
+      name = "kscreen-5.21.3.tar.xz";
     };
   };
   kscreenlocker = {
-    version = "5.21.1";
+    version = "5.21.3";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.1/kscreenlocker-5.21.1.tar.xz";
-      sha256 = "1qpmysv7cby0bir4qyr1if3zc1ky43fyzhhxfqc69mcx803iabyv";
-      name = "kscreenlocker-5.21.1.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.3/kscreenlocker-5.21.3.tar.xz";
+      sha256 = "1hjlpwwca9nrdwgsiy5ss5ainr1fy1wfvi4g599cvijb77qc84h0";
+      name = "kscreenlocker-5.21.3.tar.xz";
     };
   };
   ksshaskpass = {
-    version = "5.21.1";
+    version = "5.21.3";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.1/ksshaskpass-5.21.1.tar.xz";
-      sha256 = "11avkc3qqskq8pkdsq1jikpdh9izghv3algbf67lwl236s8mmdzk";
-      name = "ksshaskpass-5.21.1.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.3/ksshaskpass-5.21.3.tar.xz";
+      sha256 = "16c2kzdmw3viphaygdff29cvi06r53ag4a6hkxw15yrscw31n3ns";
+      name = "ksshaskpass-5.21.3.tar.xz";
     };
   };
   ksysguard = {
-    version = "5.21.1";
+    version = "5.21.3";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.1/ksysguard-5.21.1.tar.xz";
-      sha256 = "1fnccjs04b3pvdb8wwmw03g8x4h7zw5q4pxh0gfy7w705w3wkxwm";
-      name = "ksysguard-5.21.1.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.3/ksysguard-5.21.3.tar.xz";
+      sha256 = "0ys1idjqb9n67czdhlds6mhhiizxq8qq4rmds9nq8cm961g5kqsf";
+      name = "ksysguard-5.21.3.tar.xz";
     };
   };
   kwallet-pam = {
-    version = "5.21.1";
+    version = "5.21.3";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.1/kwallet-pam-5.21.1.tar.xz";
-      sha256 = "0ybdyalppfypvq26j6lxjfz2zm41kw1nlsyh857z06f0s65257zb";
-      name = "kwallet-pam-5.21.1.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.3/kwallet-pam-5.21.3.tar.xz";
+      sha256 = "1dnni2k4ry11mfjnfc0i44zww3glhsbr70qnpkl9dsf5rj4dcwj3";
+      name = "kwallet-pam-5.21.3.tar.xz";
     };
   };
   kwayland-integration = {
-    version = "5.21.1";
+    version = "5.21.3";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.1/kwayland-integration-5.21.1.tar.xz";
-      sha256 = "0s0gljcfv3sjh63d8bcjmzqgvxrqzjbxj8dsyi68w187dxzca8b4";
-      name = "kwayland-integration-5.21.1.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.3/kwayland-integration-5.21.3.tar.xz";
+      sha256 = "0kqw5dbsxmdm5fi34yq718ngkx5j23211jh4l9vl029qgbi42xhc";
+      name = "kwayland-integration-5.21.3.tar.xz";
     };
   };
   kwayland-server = {
-    version = "5.21.1";
+    version = "5.21.3";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.1/kwayland-server-5.21.1.tar.xz";
-      sha256 = "00d14d8q3jw1h2yyn49wpxndwl5v1clxnialrqgkyli6qkwkf29m";
-      name = "kwayland-server-5.21.1.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.3/kwayland-server-5.21.3.tar.xz";
+      sha256 = "0d3asblzz9c7cbjfdk33z26hn5n14rdrc3s9jm9awvcc1sd122a4";
+      name = "kwayland-server-5.21.3.tar.xz";
     };
   };
   kwin = {
-    version = "5.21.1";
+    version = "5.21.3";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.1/kwin-5.21.1.tar.xz";
-      sha256 = "035w7b9cfg3hv9kw3rab1y9xw4r51psz7csx7nki05nwzx84812s";
-      name = "kwin-5.21.1.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.3/kwin-5.21.3.tar.xz";
+      sha256 = "0ni0ipfm0hp90sq03m1a5lm6shxb2cf9j1a4kiqpaf7n62ch8f3w";
+      name = "kwin-5.21.3.tar.xz";
     };
   };
   kwrited = {
-    version = "5.21.1";
+    version = "5.21.3";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.1/kwrited-5.21.1.tar.xz";
-      sha256 = "15xsjkxqx48wpzjawv4qpbgh8a48sfrmldgcwhn1cscq8s0marh3";
-      name = "kwrited-5.21.1.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.3/kwrited-5.21.3.tar.xz";
+      sha256 = "01nn94qmi8q38rdv694d9qs7zahsziclmkw49zy0wlffq4ivpk6x";
+      name = "kwrited-5.21.3.tar.xz";
     };
   };
   libkscreen = {
-    version = "5.21.1";
+    version = "5.21.3";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.1/libkscreen-5.21.1.tar.xz";
-      sha256 = "0hrgmnvyv5v5d15wj1gynyzk83jj8p9cjhz0q2l41n2rh81rw52z";
-      name = "libkscreen-5.21.1.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.3/libkscreen-5.21.3.tar.xz";
+      sha256 = "1j2d1xpn48ks0wk9vvnvj9r03bc0ggrqvblyhs30p31svfihjs3a";
+      name = "libkscreen-5.21.3.tar.xz";
     };
   };
   libksysguard = {
-    version = "5.21.1";
+    version = "5.21.3.1";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.1/libksysguard-5.21.1.tar.xz";
-      sha256 = "14zafjp0ikqgkdr8a04idj08xami2xn8cw3scgwfcix3y7mv0ip8";
-      name = "libksysguard-5.21.1.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.3/libksysguard-5.21.3.1.tar.xz";
+      sha256 = "0nayjihapn71wrnzfb4wv9laafysl0x6sn98sbwhclapbdvxnw73";
+      name = "libksysguard-5.21.3.1.tar.xz";
     };
   };
   milou = {
-    version = "5.21.1";
+    version = "5.21.3";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.1/milou-5.21.1.tar.xz";
-      sha256 = "095mk7592r4fwkw5f3p8mgc0p2wg8wi347qx8s1yblwjcml86a5f";
-      name = "milou-5.21.1.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.3/milou-5.21.3.tar.xz";
+      sha256 = "0qbk0y783n7f7pl0akx252vyblrrgmsg5yr7ncaijq4x4l90f1yf";
+      name = "milou-5.21.3.tar.xz";
     };
   };
   oxygen = {
-    version = "5.21.1";
+    version = "5.21.3";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.1/oxygen-5.21.1.tar.xz";
-      sha256 = "1s5bzdj5l515g4biarrzmkc7vpi0hqbk75rjjkr11fsvkghhphwg";
-      name = "oxygen-5.21.1.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.3/oxygen-5.21.3.tar.xz";
+      sha256 = "16yj1qx4mbi62brkn8wkcr6sz5dkbl2pf49zc1hadnxfm9wd3z0a";
+      name = "oxygen-5.21.3.tar.xz";
     };
   };
   plasma-browser-integration = {
-    version = "5.21.1";
+    version = "5.21.3";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.1/plasma-browser-integration-5.21.1.tar.xz";
-      sha256 = "0m99il47932ybsdp5z7apgb9l991wdhbrm3sninflcrg6ag9myp3";
-      name = "plasma-browser-integration-5.21.1.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.3/plasma-browser-integration-5.21.3.tar.xz";
+      sha256 = "1hz996lv3vvp1zldzpkb9dmvnn94v69j2vq9sfs446c25ggf9d6y";
+      name = "plasma-browser-integration-5.21.3.tar.xz";
     };
   };
   plasma-desktop = {
-    version = "5.21.1";
+    version = "5.21.3";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.1/plasma-desktop-5.21.1.tar.xz";
-      sha256 = "1ligy1ps3ajrsg6lvb9ailirgc52sswbknp0zn53n8gka176c555";
-      name = "plasma-desktop-5.21.1.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.3/plasma-desktop-5.21.3.tar.xz";
+      sha256 = "0bryk523qfzb5max1h460d67ir6xbrsws9bq72bdfbv1wkv64kyy";
+      name = "plasma-desktop-5.21.3.tar.xz";
     };
   };
   plasma-disks = {
-    version = "5.21.1";
+    version = "5.21.3";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.1/plasma-disks-5.21.1.tar.xz";
-      sha256 = "0py662wlqbx5408rjbxnsa5ccnsaqx2wfy84fvjs4vl73wqmi2nl";
-      name = "plasma-disks-5.21.1.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.3/plasma-disks-5.21.3.tar.xz";
+      sha256 = "18a7dppfhb2wpb7sfhnayq96bxjlzygdz7sppcjikxil8klhv1aq";
+      name = "plasma-disks-5.21.3.tar.xz";
     };
   };
   plasma-firewall = {
-    version = "5.21.1";
+    version = "5.21.3";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.1/plasma-firewall-5.21.1.tar.xz";
-      sha256 = "19q7w9m1vj7gs5d3prraciw00iy0ywjfxlpjhxjiq0s0s0icf1hb";
-      name = "plasma-firewall-5.21.1.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.3/plasma-firewall-5.21.3.tar.xz";
+      sha256 = "0bzmcakzwiimc90bbpih1z5isrcfhdfwlslp4q3v3npppnivv9bw";
+      name = "plasma-firewall-5.21.3.tar.xz";
     };
   };
   plasma-integration = {
-    version = "5.21.1";
+    version = "5.21.3";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.1/plasma-integration-5.21.1.tar.xz";
-      sha256 = "0i51grmjkf9k6z1aq4j69wqdwdnn4rcryvi7b9lfpqaz1phsqhq7";
-      name = "plasma-integration-5.21.1.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.3/plasma-integration-5.21.3.tar.xz";
+      sha256 = "09dlbfildd8wl0nbss84yibljyl6cadx95q8q4n0c5wymyc4zqy1";
+      name = "plasma-integration-5.21.3.tar.xz";
     };
   };
   plasma-nano = {
-    version = "5.21.1";
+    version = "5.21.3";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.1/plasma-nano-5.21.1.tar.xz";
-      sha256 = "0qz14rmnlpk8mc1lgk854zlp032znc27j0wg6a7zsljikbx90dzm";
-      name = "plasma-nano-5.21.1.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.3/plasma-nano-5.21.3.tar.xz";
+      sha256 = "1yqn29769nnfhiyqbpv15c0zxvkfzq4yvk9x9qlchbcwjc1gr23j";
+      name = "plasma-nano-5.21.3.tar.xz";
     };
   };
   plasma-nm = {
-    version = "5.21.1";
+    version = "5.21.3";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.1/plasma-nm-5.21.1.tar.xz";
-      sha256 = "0lg9fkk4lag5pi648jv66b8mzp645xx75y4zylj87yz3i8h9may4";
-      name = "plasma-nm-5.21.1.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.3/plasma-nm-5.21.3.tar.xz";
+      sha256 = "0d7v757kzd0pcvlz201m0njcz9y8j0bqkwbzdz3gik9s7x6rl73p";
+      name = "plasma-nm-5.21.3.tar.xz";
     };
   };
   plasma-pa = {
-    version = "5.21.1";
+    version = "5.21.3";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.1/plasma-pa-5.21.1.tar.xz";
-      sha256 = "17vxvvrii3q46k22k3v94hicvxw7cdfl4rgaqbb8rvy94f2dhvir";
-      name = "plasma-pa-5.21.1.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.3/plasma-pa-5.21.3.tar.xz";
+      sha256 = "16z9xzn5swrzz86yd8lykjphs92ghdsahfxjv0v9nj3ca24kfibp";
+      name = "plasma-pa-5.21.3.tar.xz";
     };
   };
   plasma-phone-components = {
-    version = "5.21.1";
+    version = "5.21.3";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.1/plasma-phone-components-5.21.1.tar.xz";
-      sha256 = "1fzjwc1x40n8wxq9fqm83j07yg9zniilmafcsv0rd80k6v99691i";
-      name = "plasma-phone-components-5.21.1.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.3/plasma-phone-components-5.21.3.tar.xz";
+      sha256 = "1dhv0gdyk47dl8il6zwjdz84jmz2d4ppfyifzc2rzf0ys934scn0";
+      name = "plasma-phone-components-5.21.3.tar.xz";
     };
   };
   plasma-sdk = {
-    version = "5.21.1";
+    version = "5.21.3";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.1/plasma-sdk-5.21.1.tar.xz";
-      sha256 = "0s18lgp8baan9s9qr8wwaq3ah668255whz9xpl2xl1qv9qnr5v28";
-      name = "plasma-sdk-5.21.1.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.3/plasma-sdk-5.21.3.tar.xz";
+      sha256 = "0asbb7j5b8c4kixw1yf7mdfyd8gjrf57gdb2wfs1npasak0dw84w";
+      name = "plasma-sdk-5.21.3.tar.xz";
     };
   };
   plasma-systemmonitor = {
-    version = "5.21.1";
+    version = "5.21.3";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.1/plasma-systemmonitor-5.21.1.tar.xz";
-      sha256 = "1mfmlnsa2iy4wrdi2hghrapd7j02k3xkv4cfv44pw29i5iihvx6a";
-      name = "plasma-systemmonitor-5.21.1.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.3/plasma-systemmonitor-5.21.3.tar.xz";
+      sha256 = "1w1xzqmpzk016f8rkyx6cvm6lng3h177c441hird13n6v147l7ll";
+      name = "plasma-systemmonitor-5.21.3.tar.xz";
     };
   };
   plasma-tests = {
-    version = "5.21.1";
+    version = "5.21.3";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.1/plasma-tests-5.21.1.tar.xz";
-      sha256 = "1qxlwvxwkqgxy6kvd9dqp7wg02gc4j37az20gxglm5s4jf9j47kr";
-      name = "plasma-tests-5.21.1.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.3/plasma-tests-5.21.3.tar.xz";
+      sha256 = "000iwijpxxicixy5zbbgfs96h988x1d4wvjw90vagjw4hj361dk8";
+      name = "plasma-tests-5.21.3.tar.xz";
     };
   };
   plasma-thunderbolt = {
-    version = "5.21.1";
+    version = "5.21.3";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.1/plasma-thunderbolt-5.21.1.tar.xz";
-      sha256 = "1v6yjxk30wpr86f1m7zn9sm5vvagcjmqz8b3s9sliv0z69n50fzx";
-      name = "plasma-thunderbolt-5.21.1.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.3/plasma-thunderbolt-5.21.3.tar.xz";
+      sha256 = "1j0nb9p5wbgksxy19bxsz9ni9ys40r4arvs8rl8pvvv9hndqhndm";
+      name = "plasma-thunderbolt-5.21.3.tar.xz";
     };
   };
   plasma-vault = {
-    version = "5.21.1";
+    version = "5.21.3";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.1/plasma-vault-5.21.1.tar.xz";
-      sha256 = "0mfjmmn3s2piqg8idmndh1klrr3fllka0lx6ckx7bmj1g7z3kr0d";
-      name = "plasma-vault-5.21.1.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.3/plasma-vault-5.21.3.tar.xz";
+      sha256 = "1q59q6y8gx4qbp1a5nbsg8zmrdljacfqd3i5n214nlj6al13sg9j";
+      name = "plasma-vault-5.21.3.tar.xz";
     };
   };
   plasma-workspace = {
-    version = "5.21.1";
+    version = "5.21.3";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.1/plasma-workspace-5.21.1.tar.xz";
-      sha256 = "0aq2158sijlgz3baslj57kzhmdx3m0zir80qz1svw94grfszjc2a";
-      name = "plasma-workspace-5.21.1.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.3/plasma-workspace-5.21.3.tar.xz";
+      sha256 = "1djanxc7mslw9hnbzlngf6pflc6byjzqb14ibilg3fxsir2jwq40";
+      name = "plasma-workspace-5.21.3.tar.xz";
     };
   };
   plasma-workspace-wallpapers = {
-    version = "5.21.1";
+    version = "5.21.3";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.1/plasma-workspace-wallpapers-5.21.1.tar.xz";
-      sha256 = "1pfgzzfhwdgczhrgizwi7rvav1hawwv6zra8nlqnfia8rc4mjs3n";
-      name = "plasma-workspace-wallpapers-5.21.1.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.3/plasma-workspace-wallpapers-5.21.3.tar.xz";
+      sha256 = "1qjkk3qfzz1id898kmx7xx6rr6p77y0jfwkjyf26abk51bdfk9lm";
+      name = "plasma-workspace-wallpapers-5.21.3.tar.xz";
     };
   };
   plymouth-kcm = {
-    version = "5.21.1";
+    version = "5.21.3";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.1/plymouth-kcm-5.21.1.tar.xz";
-      sha256 = "1il5a60db4brgs0ifmbxhq1ncqg80pkz5pnddbb3vwiwgwrsjziw";
-      name = "plymouth-kcm-5.21.1.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.3/plymouth-kcm-5.21.3.tar.xz";
+      sha256 = "0wmpvb06z0js50c9jpv61jlxbx9sf1f5lidzs5v4xs31shxc9sbg";
+      name = "plymouth-kcm-5.21.3.tar.xz";
     };
   };
   polkit-kde-agent = {
-    version = "1-5.21.1";
+    version = "1-5.21.3";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.1/polkit-kde-agent-1-5.21.1.tar.xz";
-      sha256 = "1lm6rl3lfimlfw7yaqk81jdrdi31qbz951vzcss4prwa1iqdi7b2";
-      name = "polkit-kde-agent-1-5.21.1.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.3/polkit-kde-agent-1-5.21.3.tar.xz";
+      sha256 = "06qpkf01665mjr49wyc3f336g6g7l93k8l35q0yyih58i3v04s0v";
+      name = "polkit-kde-agent-1-5.21.3.tar.xz";
     };
   };
   powerdevil = {
-    version = "5.21.1";
+    version = "5.21.3";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.1/powerdevil-5.21.1.tar.xz";
-      sha256 = "08a9wl97lpcm0qz438ha8avdc6ybsij5vvy3p0ijkdn1psq2974b";
-      name = "powerdevil-5.21.1.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.3/powerdevil-5.21.3.tar.xz";
+      sha256 = "0lk6bvc0mym3x3sd85bsvsxvm82vr40lcx355xjycxskf75c5jzz";
+      name = "powerdevil-5.21.3.tar.xz";
     };
   };
   qqc2-breeze-style = {
-    version = "5.21.1";
+    version = "5.21.3";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.1/qqc2-breeze-style-5.21.1.tar.xz";
-      sha256 = "1k4zl5hbbyk2v9gila8whkh7yniv3nwcgdc73ysc75ivqyzydsix";
-      name = "qqc2-breeze-style-5.21.1.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.3/qqc2-breeze-style-5.21.3.tar.xz";
+      sha256 = "1ydvirjrkjbwfc2faz74dd9zlmfz18fa3cig143gna9rfr5api54";
+      name = "qqc2-breeze-style-5.21.3.tar.xz";
     };
   };
   sddm-kcm = {
-    version = "5.21.1";
+    version = "5.21.3";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.1/sddm-kcm-5.21.1.tar.xz";
-      sha256 = "0j76zwmn2r62hjzv1gni44a9admd38x2s8s30qfc1dzc7nkv61sh";
-      name = "sddm-kcm-5.21.1.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.3/sddm-kcm-5.21.3.tar.xz";
+      sha256 = "1flqgfpiz66s7dsw1k95zdrbj7ka09r0i2pcdygnrwlls5yvqljz";
+      name = "sddm-kcm-5.21.3.tar.xz";
     };
   };
   systemsettings = {
-    version = "5.21.1";
+    version = "5.21.3";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.1/systemsettings-5.21.1.tar.xz";
-      sha256 = "0kzg3raa2f3lwb5qs10g8kzmv6px8fk4z2sq5jnjl3n9zqgzykkr";
-      name = "systemsettings-5.21.1.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.3/systemsettings-5.21.3.tar.xz";
+      sha256 = "08ynlg282x1klgpd43mh3ng4m579iq9hjlln96fqaw19g7x1i58x";
+      name = "systemsettings-5.21.3.tar.xz";
     };
   };
   xdg-desktop-portal-kde = {
-    version = "5.21.1";
+    version = "5.21.3";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.21.1/xdg-desktop-portal-kde-5.21.1.tar.xz";
-      sha256 = "1xfnwycrq51sz1r57misrz8acq6yd1vrr5gjir4f1ynfclhf9aj6";
-      name = "xdg-desktop-portal-kde-5.21.1.tar.xz";
+      url = "${mirror}/stable/plasma/5.21.3/xdg-desktop-portal-kde-5.21.3.tar.xz";
+      sha256 = "05r1kbw39jmj2gfn42052y779l0k89kxh7xynw07igr7c5mxy4ih";
+      name = "xdg-desktop-portal-kde-5.21.3.tar.xz";
     };
   };
 }
diff --git a/pkgs/development/libraries/qt-5/5.15/default.nix b/pkgs/development/libraries/qt-5/5.15/default.nix
index ef0d2c82c026..c32f4b001e9d 100644
--- a/pkgs/development/libraries/qt-5/5.15/default.nix
+++ b/pkgs/development/libraries/qt-5/5.15/default.nix
@@ -59,14 +59,29 @@ let
         rev = "a059e7404a6db799f4da0ad696e65ae9c854b4b0";
       in
       {
-        version = "${branchName}-${lib.substring 0 8 rev}";
+        version = "${branchName}-${lib.substring 0 7 rev}";
 
         src = fetchgit {
           url = "https://github.com/qt/qtwebengine.git";
-          sha256 = "19l1i4sk3pvnwbvz5s97jchqawfz8k1xmjza29bgvkp1zz96r0jx";
+          sha256 = "1vdgxfbmx4z4qrm2g61dl64gqn3fv5f83jwpp7h1gyfx5z2qvfmv";
           inherit rev branchName;
           fetchSubmodules = true;
           leaveDotGit = true;
+          name = "qtwebengine-${substring 0 7 rev}.tar.gz";
+          postFetch = ''
+            # remove submodule .git directory
+            rm -rf $out/src/3rdparty/.git
+
+            # compress to not exceed the 2GB output limit
+            mv $out source
+            # try to make a deterministic tarball
+            tar -I 'gzip -n' \
+              --sort name \
+              --mtime 1970-01-01 \
+              --owner=root --group=root \
+              --numeric-owner --mode=go=rX,u+rw,a-s \
+              -cf $out source
+          '';
         };
       };
   };
diff --git a/pkgs/development/libraries/tachyon/default.nix b/pkgs/development/libraries/tachyon/default.nix
index f536442295ef..47cebd62df65 100644
--- a/pkgs/development/libraries/tachyon/default.nix
+++ b/pkgs/development/libraries/tachyon/default.nix
@@ -13,10 +13,10 @@ assert stdenv.isDarwin -> Carbon != null;
 
 stdenv.mkDerivation rec {
   pname = "tachyon";
-  version = "0.99b2";
+  version = "0.99b6";
   src = fetchurl {
     url = "http://jedi.ks.uiuc.edu/~johns/tachyon/files/${version}/${pname}-${version}.tar.gz";
-    sha256 = "04m0bniszyg7ryknj8laj3rl5sspacw5nr45x59j2swcsxmdvn1v";
+    sha256 = "15wv2748ngk2iid798a774sjxhhijq7kjm32yl897x54fsfazp7l";
   };
   buildInputs = lib.optionals stdenv.isDarwin [
     Carbon
@@ -36,8 +36,11 @@ stdenv.mkDerivation rec {
   '';
   arch = if stdenv.hostPlatform.system == "x86_64-linux"   then "linux-64-thr"  else
          if stdenv.hostPlatform.system == "i686-linux"     then "linux-thr"     else
-         if stdenv.hostPlatform.system == "aarch64-linux"  then "linux-arm-thr" else
-         if stdenv.hostPlatform.system == "armv7l-linux"   then "linux-arm-thr" else
+         # 2021-03-29: multithread (-DTHR -D_REENTRANT) was disabled on linux-arm
+         # because it caused Sage's 3D plotting tests to hang indefinitely.
+         # see https://github.com/NixOS/nixpkgs/pull/117465
+         if stdenv.hostPlatform.system == "aarch64-linux"  then "linux-arm"     else
+         if stdenv.hostPlatform.system == "armv7l-linux"   then "linux-arm"     else
          if stdenv.hostPlatform.system == "x86_64-darwin"  then "macosx-thr"    else
          if stdenv.hostPlatform.system == "i686-darwin"    then "macosx-64-thr" else
          if stdenv.hostPlatform.system == "i686-cygwin"    then "win32"         else
diff --git a/pkgs/development/libraries/tachyon/make-archs.patch b/pkgs/development/libraries/tachyon/make-archs.patch
index cf83f8c8c31c..ee81681e101f 100644
--- a/pkgs/development/libraries/tachyon/make-archs.patch
+++ b/pkgs/development/libraries/tachyon/make-archs.patch
@@ -22,11 +22,11 @@ index 08afb85..dbeb691 100644
  	"RANLIB = ranlib" \
  	"LIBS = -L. -ltachyon $(MISCLIB) -lm -lpthread"
  
-+# Linux Arm using gcc, with threads
-+linux-arm-thr:
++# Linux Arm using gcc
++linux-arm:
 +	$(MAKE) all \
-+	"ARCH = linux-arm-thr" \
-+	"CFLAGS = -Wall -O3 -fomit-frame-pointer -ffast-math -DLinux -DTHR -D_REENTRANT $(MISCFLAGS)" \
++	"ARCH = linux-arm" \
++	"CFLAGS = -Wall -O3 -fomit-frame-pointer -ffast-math -DLinux $(MISCFLAGS)" \
 +	"ARFLAGS = r" \
 +	"STRIP = strip" \
 +	"RANLIB = ranlib" \
diff --git a/pkgs/development/libraries/tachyon/no-absolute-paths.patch b/pkgs/development/libraries/tachyon/no-absolute-paths.patch
index faa3810fb5c6..8ebc6560405b 100644
--- a/pkgs/development/libraries/tachyon/no-absolute-paths.patch
+++ b/pkgs/development/libraries/tachyon/no-absolute-paths.patch
@@ -1,5 +1,4 @@
 diff --git a/unix/Make-config b/unix/Make-config
-index ee4f388..c1d51d4 100644
 --- a/unix/Make-config
 +++ b/unix/Make-config
 @@ -18,7 +18,7 @@
@@ -11,7 +10,7 @@ index ee4f388..c1d51d4 100644
  
  
  
-@@ -30,7 +30,7 @@ SHELL=/bin/sh
+@@ -30,7 +30,7 @@
  
  # The following line should be set to -Ixxx where xxx is your X11 include path
  # Sun puts X11 in /usr/openwin/xxx
@@ -20,16 +19,20 @@ index ee4f388..c1d51d4 100644
  
  # Others typically use /usr/X11 or /usr/X11R6
  #X11INC= -I/usr/X11
-@@ -57,7 +57,7 @@ X11LIB= -lX11
+@@ -105,9 +105,9 @@
  ##########################################################################
- 
- # Standard MPICH installation location
+ # Customize MPI directories and includes as-needed.
+ # A typical MPICH installation location:
 -MPIDIR=/usr/local/mpi
+-MPIINC=$(MPIDIR)/include
+-MPILIB=$(MPIDIR)/lib
 +# MPIDIR=/usr/local/mpi
++# MPIINC=$(MPIDIR)/include
++# MPILIB=$(MPIDIR)/lib
  
- # UMR CS Dept
- #MPIDIR=/software/all/mpi
-@@ -108,9 +108,9 @@ MBOX=
+ # MPI defines and any flags needed by the local installation.
+ # Always list -DMPI at a minimum.  
+@@ -166,9 +166,9 @@
  #   http://www.ijg.org/files/
  ##########################################################################
  # Uncomment the following lines to disable JPEG support
@@ -42,7 +45,7 @@ index ee4f388..c1d51d4 100644
  
  # Uncomment the following lines to enable JPEG support
  #USEJPEG= -DUSEJPEG
-@@ -128,9 +128,9 @@ JPEGLIB=
+@@ -186,9 +186,9 @@
  #   http://www.libpng.org/
  ##########################################################################
  # Uncomment the following lines to disable PNG support
diff --git a/pkgs/development/ocaml-modules/spelll/default.nix b/pkgs/development/ocaml-modules/spelll/default.nix
index 5901dcb896ac..9df0779e53a3 100644
--- a/pkgs/development/ocaml-modules/spelll/default.nix
+++ b/pkgs/development/ocaml-modules/spelll/default.nix
@@ -6,6 +6,8 @@ buildDunePackage rec {
   pname = "spelll";
   version = "0.3";
 
+  useDune2 = true;
+
   src = fetchFromGitHub {
     owner = "c-cube";
     repo = pname;
diff --git a/pkgs/development/tools/misc/editorconfig-checker/default.nix b/pkgs/development/tools/misc/editorconfig-checker/default.nix
index b93416094931..b4359bb18601 100644
--- a/pkgs/development/tools/misc/editorconfig-checker/default.nix
+++ b/pkgs/development/tools/misc/editorconfig-checker/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "editorconfig-checker";
-  version = "2.3.4";
+  version = "2.3.5";
 
   src = fetchFromGitHub {
     owner = "editorconfig-checker";
     repo = "editorconfig-checker";
     rev = version;
-    sha256 = "sha256-aTHY9RFFkpTQKv+Erczu5joqvE7L05Ev2GOSiXNxLj8=";
+    sha256 = "sha256-t1qvmTs6hOrAnq5hjU2Qjt33vdW9MuSOvWCCY82db+g=";
   };
 
-  vendorSha256 = "sha256-y+wQ6XzX4vmKzesUcF9jgfrKPj5EsCuw/aKizVX/ogI=";
+  vendorSha256 = "sha256-Rs7u/ZepnMNg5EZ/HWqSdO428KOkxpSbo7rl0treqUY=";
 
   doCheck = false;
 
diff --git a/pkgs/os-specific/linux/nvidia-x11/default.nix b/pkgs/os-specific/linux/nvidia-x11/default.nix
index a5a02206c477..1da25db7ae35 100644
--- a/pkgs/os-specific/linux/nvidia-x11/default.nix
+++ b/pkgs/os-specific/linux/nvidia-x11/default.nix
@@ -28,10 +28,10 @@ rec {
   # Policy: use the highest stable version as the default (on our master).
   stable = if stdenv.hostPlatform.system == "x86_64-linux"
     then generic {
-      version = "460.56";
-      sha256_64bit = "003kwlsghlix2kilrqad7mn7ygkb755rzjlxd0b52vqz1nx1qmsf";
-      settingsSha256 = "1xwhbd78q0bc3v8fnlss9amkl03vnvf91ffpfnz0v7clvn3xymkf";
-      persistencedSha256 = "0sh2csv04fkimf1msbmdc608gxb3j95g8i3rqf32b1pl9jv0p5ly";
+      version = "460.67";
+      sha256_64bit = "L2cRySVw7mgYSN25mJV+b4uOeHTdjLGvFPEkwyFgtec=";
+      settingsSha256 = "DB+ZeKm6cYQuVkJWjVd71qOTOmwIcRqx1CxfkgMbDpg=";
+      persistencedSha256 = "HCmZZRlNhOHi5yN2lNHhBILZkdng73q0vCbv7CIX/8s=";
     }
     else legacy_390;
 
diff --git a/pkgs/servers/monitoring/zabbix/agent2.nix b/pkgs/servers/monitoring/zabbix/agent2.nix
index f3c1be0f8e2a..741a880a8616 100644
--- a/pkgs/servers/monitoring/zabbix/agent2.nix
+++ b/pkgs/servers/monitoring/zabbix/agent2.nix
@@ -10,7 +10,7 @@ import ./versions.nix ({ version, sha256 }:
       inherit sha256;
     };
 
-    vendorSha256 = "1kb3lc9jjv0cpzq93k1b9y496i95fcnwhb03j0gwlyqmgsa6yn81";
+    vendorSha256 = "1ral3xg58x0lf5vl839nlabf443yzqnbrlzm0q127mvv412f5ajc";
 
     nativeBuildInputs = [ autoreconfHook pkg-config];
     buildInputs = [ libiconv openssl pcre zlib ];
diff --git a/pkgs/servers/monitoring/zabbix/versions.nix b/pkgs/servers/monitoring/zabbix/versions.nix
index a19b2432becd..b3cdca20b3bc 100644
--- a/pkgs/servers/monitoring/zabbix/versions.nix
+++ b/pkgs/servers/monitoring/zabbix/versions.nix
@@ -1,16 +1,16 @@
 generic: {
   v50 = generic {
-    version = "5.0.5";
-    sha256 = "104jxyaclx92pyas7kqz357da7qjcw44yx3yi7vqlc7h5ch3avgc";
+    version = "5.0.9";
+    sha256 = "16vwh01hlxmh9qg3d7q1vsmz3bwydk7v7da58d3764ldmh8ag199";
   };
 
   v40 = generic {
-    version = "4.0.26";
-    sha256 = "0mbk8afkwv208hwyl0zr2l4sib65z7n9ykisznk6pjzb9kdl73s1";
+    version = "4.0.29";
+    sha256 = "0qghx7r7rbyya79mfsvr5fqws2d8ffn86zfdkzdrnmyl0x25fr9y";
   };
 
   v30 = generic {
-    version = "3.0.31";
-    sha256 = "0a2jznpmg24lqdqbc9p8i2q6jkz0hx53hh6q12xsvvmq48vi3snm";
+    version = "3.0.32";
+    sha256 = "1n9l0llmifmg5zzh2jzqax8y23ch7250v36bcfkpizvr8wji7xi7";
   };
 }
diff --git a/pkgs/tools/security/bitwarden_rs/default.nix b/pkgs/tools/security/bitwarden_rs/default.nix
index 2cce00693a4f..5676e4005c13 100644
--- a/pkgs/tools/security/bitwarden_rs/default.nix
+++ b/pkgs/tools/security/bitwarden_rs/default.nix
@@ -8,13 +8,13 @@ let
 
 in rustPlatform.buildRustPackage rec {
   pname = "bitwarden_rs";
-  version = "1.19.0";
+  version = "1.20.0";
 
   src = fetchFromGitHub {
     owner = "dani-garcia";
     repo = pname;
     rev = version;
-    sha256 = "1iww8fhh4indmgw1j35whqyakd4bppmiyjpcdf2qrzg52x5binh0";
+    sha256 = "1ncy4iwmdzdp8rv1gc5i4s1rp97d94n4l4bh08v6w4zdpx0zn8b9";
   };
 
   nativeBuildInputs = [ pkg-config ];
@@ -25,7 +25,7 @@ in rustPlatform.buildRustPackage rec {
 
   RUSTC_BOOTSTRAP = 1;
 
-  cargoSha256 = "0ga7ahlszja8ilng8xsrwdy7zy6bbci4mf00lknladjhlw16wibf";
+  cargoSha256 = "139by5y2ma3v52nabzr5man1qy395rchs2dlivkj9xi829kg4mcr";
   cargoBuildFlags = [ featuresFlag ];
 
   checkPhase = ''
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index ada7fe20324f..ff72352c5f06 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -3285,7 +3285,7 @@ in
 
   circus = callPackage ../tools/networking/circus { };
 
-  citrix_workspace = citrix_workspace_21_01_0;
+  citrix_workspace = citrix_workspace_21_03_0;
 
   inherit (callPackage ../applications/networking/remote/citrix-workspace { })
     citrix_workspace_20_04_0
@@ -3294,6 +3294,7 @@ in
     citrix_workspace_20_10_0
     citrix_workspace_20_12_0
     citrix_workspace_21_01_0
+    citrix_workspace_21_03_0
   ;
 
   citra = libsForQt5.callPackage ../misc/emulators/citra { };
diff --git a/pkgs/top-level/ruby-packages.nix b/pkgs/top-level/ruby-packages.nix
index 1268c43c0797..13e91d5b0f69 100644
--- a/pkgs/top-level/ruby-packages.nix
+++ b/pkgs/top-level/ruby-packages.nix
@@ -1238,10 +1238,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1vmw752c26ny2jwl0npn0gbyqwgz4hdmlpxnsld9qi9xhk5b1qh7";
+      sha256 = "0jdbcjv4v7sj888bv3vc6d1dg4ackkh7ywlmn9ln2g9alk7kisar";
       type = "gem";
     };
-    version = "2.3.0";
+    version = "2.3.1";
   };
   kramdown-parser-gfm = {
     dependencies = ["kramdown"];