NixOS
diff --git a/pkgs/applications/audio/denemo/default.nix b/pkgs/applications/audio/denemo/default.nix
@@ -6,11 +6,11 @@
 
 stdenv.mkDerivation rec {
   pname = "denemo";
-  version = "2.3.0";
+  version = "2.4.0";
 
   src = fetchurl {
     url = "https://ftp.gnu.org/gnu/denemo/denemo-${version}.tar.gz";
-    sha256 = "1blkcl3slbsq9jlhwcf2m9v9g38a0sjfhh9advgi2qr1gxri08by";
+    sha256 = "145kq0zfgdadykl3i6na221i4s5wzdrcqq48amzyfarnrqk2rmpd";
   };
 
   buildInputs = [

diff --git a/pkgs/applications/audio/ft2-clone/default.nix b/pkgs/applications/audio/ft2-clone/default.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "ft2-clone";
-  version = "1.23";
+  version = "1.24";
 
   src = fetchFromGitHub {
     owner = "8bitbubsy";
     repo = "ft2-clone";
     rev = "v${version}";
-    sha256 = "03prdifc2nz7smmzdy19flp33m927vb7j5bhdc46gak753pikw7d";
+    sha256 = "0wb7xsc2m9f4q5zsf5ai6h6c0558lkziv30b5a8ic64wp0layr6k";
   };
 
   nativeBuildInputs = [ cmake ];

diff --git a/pkgs/applications/misc/geoipupdate/default.nix b/pkgs/applications/misc/geoipupdate/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "geoipupdate";
-  version = "4.2.2";
+  version = "4.3.0";
 
   src = fetchFromGitHub {
     owner = "maxmind";
     repo = "geoipupdate";
     rev = "v${version}";
-    sha256 = "057f9kp8g3wixjh9dm58g0qvzfcmhwbk1d573ldly4g5404r9bvf";
+    sha256 = "08h14bf4z2gx9sy34jpi2pvxv3i8g9ypl222hzdjsp2ixhl0jia9";
   };
 
   vendorSha256 = "0q4byhvs1c1xm4qjvs2vyf98vdv121qn0z51arcf7k4ayrys5xcx";

diff --git a/pkgs/applications/networking/browsers/vivaldi/default.nix b/pkgs/applications/networking/browsers/vivaldi/default.nix
@@ -18,11 +18,11 @@ let
   vivaldiName = if isSnapshot then "vivaldi-snapshot" else "vivaldi";
 in stdenv.mkDerivation rec {
   pname = "vivaldi";
-  version = "2.11.1811.52-1";
+  version = "3.0.1874.38-1";
 
   src = fetchurl {
     url = "https://downloads.vivaldi.com/${branch}/vivaldi-${branch}_${version}_amd64.deb";
-    sha256 = "0bq9ggk75xzka2nbrnc7vghq8s7jjy9nbfmyrf51kf0nni1zg1fp";
+    sha256 = "03667f8rlk8shxq6ghjg4q9hqhsaw4gwpqnjpyili49qczd5423w";
   };
 
   unpackPhase = ''

diff --git a/pkgs/applications/networking/cluster/kube3d/default.nix b/pkgs/applications/networking/cluster/kube3d/default.nix
@@ -2,7 +2,7 @@
 
 buildGoModule rec {
   pname = "kube3d";
-  version = "1.6.0";
+  version = "1.7.0";
   k3sVersion = "1.17.3-k3s1";
 
   goPackagePath = "github.com/rancher/k3d";
@@ -11,7 +11,7 @@ buildGoModule rec {
     owner  = "rancher";
     repo   = "k3d";
     rev    = "v${version}";
-    sha256 = "0qjwqqynvgzainq66fpzczgynwk3hv7wzgfy5271fc6mj2k0zz5x";
+    sha256 = "0aij2l7zmg4cxbw7pwf7ddc64di25hpjvbmp1madhz9q28rwfa9w";
   };
 
   buildFlagsArray = ''

diff --git a/pkgs/applications/networking/cluster/kubeseal/default.nix b/pkgs/applications/networking/cluster/kubeseal/default.nix
@@ -2,19 +2,21 @@
 
 buildGoModule rec {
   pname = "kubeseal";
-  version = "0.12.0";
+  version = "0.12.3";
 
   src = fetchFromGitHub {
     owner = "bitnami-labs";
     repo = "sealed-secrets";
     rev = "v${version}";
-    sha256 = "0z51iwdc4m0y8wyyx3mcvbzxlrgws7n5wkcd0g7nr73irnsld4lh";
+    sha256 = "1h8n2219xh0gl42kz3rkv3aj3wfwivvs9skwbbrvmrkwwrpxkgdj";
   };
 
   vendorSha256 = null;
 
   subPackages = [ "cmd/kubeseal" ];
 
+  buildFlagsArray = [ "-ldflags=-s -w -X main.VERSION=${version}" ];
+
   meta = with lib; {
     description = "A Kubernetes controller and tool for one-way encrypted Secrets";
     homepage = "https://github.com/bitnami-labs/sealed-secrets";

diff --git a/pkgs/applications/networking/instant-messengers/skypeforlinux/default.nix b/pkgs/applications/networking/instant-messengers/skypeforlinux/default.nix
@@ -7,7 +7,7 @@ let
 
   # Please keep the version x.y.0.z and do not update to x.y.76.z because the
   # source of the latter disappears much faster.
-  version = "8.59.0.77";
+  version = "8.60.0.76";
 
   rpath = stdenv.lib.makeLibraryPath [
     alsaLib
@@ -65,7 +65,7 @@ let
           "https://mirror.cs.uchicago.edu/skype/pool/main/s/skypeforlinux/skypeforlinux_${version}_amd64.deb"
           "https://web.archive.org/web/https://repo.skype.com/deb/pool/main/s/skypeforlinux/skypeforlinux_${version}_amd64.deb"
         ];
-        sha256 = "1cnlwlp84942ywji3x60zvhijavazdxfym3rfzq3ysky28b6mn6i";
+        sha256 = "1y919ki0c17vip90fln17impwky08qgprw0j1dgz239qqpwakn7a";
       }
     else
       throw "Skype for linux is not supported on ${stdenv.hostPlatform.system}";

diff --git a/pkgs/build-support/docker/default.nix b/pkgs/build-support/docker/default.nix
@@ -392,14 +392,10 @@ rec {
         (cd layer; eval "$extraCommands")
       fi
 
-      # Tar up the layer and throw it into 'layer.tar'.
+      # Tar up the layer and throw it into 'layer.tar', while calculating its checksum.
       echo "Packing layer..."
       mkdir $out
-      tar --transform='s|^\./||' -C layer --sort=name --mtime="@$SOURCE_DATE_EPOCH" --owner=${toString uid} --group=${toString gid} -cf $out/layer.tar .
-
-      # Compute a checksum of the tarball.
-      echo "Computing layer checksum..."
-      tarhash=$(tarsum < $out/layer.tar)
+      tarhash=$(tar --transform='s|^\./||' -C layer --sort=name --mtime="@$SOURCE_DATE_EPOCH" --owner=${toString uid} --group=${toString gid} -cf - . | tee $out/layer.tar | tarsum)
 
       # Add a 'checksum' field to the JSON, with the value set to the
       # checksum of the tarball.
@@ -449,11 +445,7 @@ rec {
       # Tar up the layer and throw it into 'layer.tar'.
       echo "Packing layer..."
       mkdir $out
-      tar -C layer --hard-dereference --sort=name --mtime="@$SOURCE_DATE_EPOCH" --owner=${toString uid} --group=${toString gid} -cf $out/layer.tar .
-
-      # Compute a checksum of the tarball.
-      echo "Computing layer checksum..."
-      tarhash=$(tarsum < $out/layer.tar)
+      tarhash=$(tar -C layer --hard-dereference --sort=name --mtime="@$SOURCE_DATE_EPOCH" --owner=${toString uid} --group=${toString gid} -cf - . | tee $out/layer.tar | tarsum)
 
       # Add a 'checksum' field to the JSON, with the value set to the
       # checksum of the tarball.
@@ -537,11 +529,10 @@ rec {
 
         echo "Packing layer..."
         mkdir -p $out
-        tar -C layer --hard-dereference --sort=name --mtime="@$SOURCE_DATE_EPOCH" -cf $out/layer.tar .
+        tarhash=$(tar -C layer --hard-dereference --sort=name --mtime="@$SOURCE_DATE_EPOCH" -cf - . |
+                    tee $out/layer.tar |
+                    ${tarsum}/bin/tarsum)
 
-        # Compute the tar checksum and add it to the output json.
-        echo "Computing checksum..."
-        tarhash=$(${tarsum}/bin/tarsum < $out/layer.tar)
         cat ${baseJson} | jshon -s "$tarhash" -i checksum > $out/json
         # Indicate to docker that we're using schema version 1.0.
         echo -n "1.0" > $out/VERSION

diff --git a/pkgs/build-support/docker/store-path-to-layer.sh b/pkgs/build-support/docker/store-path-to-layer.sh
@@ -11,39 +11,35 @@ echo "Creating layer #$layerNumber for $@"
 mkdir -p "$layerPath"
 
 # Make sure /nix and /nix/store appear first in the archive.
+#
 # We create the directories here and use them because
 # when there are other things being added to the
 # nix store, tar could fail, saying,
 # "tar: /nix/store: file changed as we read it"
 mkdir -p nix/store
-tar -cf "$layerPath/layer.tar"  \
-    --mtime="@$SOURCE_DATE_EPOCH" \
-    --owner=0 --group=0 \
-    --transform='s,nix,/nix,' \
-    nix
-
-# We change into the /nix/store in order to avoid a similar
-# "file changed as we read it" error as above. Namely,
-# if we use the absolute path of /nix/store/123-pkg
-# and something new is added to the nix store while tar
-# is running, it will detect a change to /nix/store and
-# fail. Instead, if we cd into the nix store and copy
-# the relative nix store path, tar will ignore changes
-# to /nix/store. In order to create the correct structure
-# in the tar file, we transform the relative nix store
-# path to the absolute store path.
-for storePath in "$@"; do
-  n=$(basename "$storePath")
-  tar -C /nix/store -rpf "$layerPath/layer.tar" \
+
+# Then we change into the /nix/store in order to
+# avoid a similar "file changed as we read it" error
+# as above. Namely, if we use the absolute path of
+# /nix/store/123-pkg and something new is added to the nix
+# store while tar is running, it will detect a change to
+# /nix/store and fail. Instead, if we cd into the nix store
+# and copy the relative nix store path, tar will ignore
+# changes to /nix/store. In order to create the correct
+# structure in the tar file, we transform the relative nix
+# store path to the absolute store path.
+tarhash=$(
+  basename -a "$@" |
+    tar -cp nix \
+      -C /nix/store --verbatim-files-from --files-from - \
       --hard-dereference --sort=name \
       --mtime="@$SOURCE_DATE_EPOCH" \
       --owner=0 --group=0 \
-      --transform="s,$n,/nix/store/$n," \
-      $n
-done
-
-# Compute a checksum of the tarball.
-tarhash=$(tarsum < $layerPath/layer.tar)
+      --transform 's,^nix(/|$),/nix/,' \
+      --transform 's,^[^/],/nix/store/\0,rS' |
+    tee "$layerPath/layer.tar" |
+    tarsum
+)
 
 # Add a 'checksum' field to the JSON, with the value set to the
 # checksum of the tarball.

diff --git a/pkgs/development/libraries/libcint/default.nix b/pkgs/development/libraries/libcint/default.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libcint";
-  version = "3.0.19";
+  version = "3.0.20";
 
   src = fetchFromGitHub {
     owner = "sunqm";
     repo = "libcint";
     rev = "v${version}";
-    sha256 = "0x613f2hiqi2vbhp20fcl7rhxb07f2714lplzd0vkvv07phagip9";
+    sha256 = "0iqqq568q9sxppr08rvmpyjq0n82pm04x9rxhh3mf20x1ds7ngj5";
   };
 
   nativeBuildInputs = [ cmake ];

diff --git a/pkgs/development/tools/analysis/codeql/default.nix b/pkgs/development/tools/analysis/codeql/default.nix
@@ -12,15 +12,15 @@
 
 stdenv.mkDerivation rec {
   pname = "codeql";
-  version = "2.1.1";
+  version = "2.1.3";
 
   dontConfigure = true;
   dontBuild = true;
   dontStrip = true;
 
   src = fetchzip {
     url = "https://github.com/github/codeql-cli-binaries/releases/download/v${version}/codeql.zip";
-    sha256 = "0yaxv89p5pdj1qymc5bnz0mphrypil9dnijvp3ml9hk1vxw6lfvb";
+    sha256 = "1b0hqc8zs6v47w9sjk40sbj1fw5x5bxg7kw9s84y6s60yr897376";
   };
 
   nativeBuildInputs = [

diff --git a/pkgs/development/tools/git-quick-stats/default.nix b/pkgs/development/tools/git-quick-stats/default.nix
@@ -1,12 +1,12 @@
 { stdenv, fetchFromGitHub }:
 stdenv.mkDerivation rec {
   pname = "git-quick-stats";
-  version = "2.0.16";
+  version = "2.1.1";
   src = fetchFromGitHub {
     repo = "git-quick-stats";
     owner = "arzzen";
     rev = version;
-    sha256 = "03v06r6gbn8bhya1ig9wdc92hh2ip7072syxkam3sjv150ld80cn";
+    sha256 = "1mdja838jxhcasi251fsc3yig3s5vmfqab1wpm34xinr8blii90f";
   };
   PREFIX = builtins.placeholder "out";
   meta = with stdenv.lib; {

diff --git a/pkgs/development/tools/gomodifytags/default.nix b/pkgs/development/tools/gomodifytags/default.nix
@@ -2,7 +2,7 @@
 
 buildGoModule rec {
   pname = "gomodifytags";
-  version = "1.4.0";
+  version = "1.6.0";
 
   vendorSha256 = null;
 
@@ -12,7 +12,7 @@ buildGoModule rec {
     owner = "fatih";
     repo = "gomodifytags";
     rev = "v${version}";
-    sha256 = "1436wjqs6n2jxlyzx38nm4ih6fr11bybivg3wy5nvzfs6cs59q63";
+    sha256 = "1wmzl5sk5mc46njzn86007sqyyv6han058ppiw536qyhk88rzazq";
   };
 
   meta = {

diff --git a/pkgs/development/tools/kubie/default.nix b/pkgs/development/tools/kubie/default.nix
@@ -1,31 +1,30 @@
-{ stdenv, rustPlatform, fetchFromGitHub }:
+{ stdenv, rustPlatform, fetchFromGitHub, installShellFiles, Security }:
 
-with rustPlatform;
-
-buildRustPackage rec {
+rustPlatform.buildRustPackage rec {
   pname = "kubie";
-  version = "0.8.4";
+  version = "0.9.1";
 
   src = fetchFromGitHub {
     rev = "v${version}";
     owner = "sbstp";
     repo = "kubie";
-    sha256 = "1f82xlhhxbjadjw609kr1kdm4n69c9mqjia4b3k505wjh7cc55n0";
+    sha256 = "0q1dxry10iaf7zx6vyr0da4ihqx7l8dlyhlqm8qqfz913h2wam8c";
   };
 
-  cargoSha256 = "0mish7wqwq5ynl98n6swdn5i6mg62aih5rfykbl3wx39b468n481";
+  cargoSha256 = "13zs2xz3s4732zxsimg7b22d9707ln4gpscznxi13cjkf5as9gbz";
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
 
-  installPhase = ''
-    mkdir -p $out/share/bash-completion/completions
-    cp -v ${src}/completion/kubie.bash $out/share/bash-completion/completions/kubie
+  postInstall = ''
+    installShellCompletion completion/kubie.bash
   '';
 
   meta = with stdenv.lib; {
-    description =
-      "Shell independent context and namespace switcher for kubectl";
+    description = "Shell independent context and namespace switcher for kubectl";
     homepage = "https://github.com/sbstp/kubie";
     license = with licenses; [ zlib ];
     maintainers = with maintainers; [ illiusdope ];
-    platforms = platforms.all;
   };
 }
diff --git a/pkgs/development/tools/misc/editorconfig-checker/default.nix b/pkgs/development/tools/misc/editorconfig-checker/default.nix
@@ -1,22 +1,30 @@
-{ buildGoModule, fetchFromGitHub, lib }:
+{ lib, buildGoModule, fetchFromGitHub, installShellFiles }:
 
 buildGoModule rec {
   pname = "editorconfig-checker";
-  version = "2.0.3";
+  version = "2.0.4";
 
   src = fetchFromGitHub {
     owner = "editorconfig-checker";
     repo = "editorconfig-checker";
     rev = "${version}";
-    sha256 = "1gn7q6wg7byhr1l5ly60rbb700xrww9slbq7gbxbw5c1fl0pp3yk";
+    sha256 = "1y90yz8da0iqig3m0kbjcicwblkirbbx0s3agpmz2pdca6y2ijwi";
   };
 
-  vendorSha256 = "1w5hsdmi95v7qj3fc4jkjapw8cnh41f09wbbzcfmfmvygrii7z16";
+  vendorSha256 = "1lyrqrm3pyfv470dmymbkb3vpvp0i2zsndp7qw34fbhp2gnay5kh";
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  buildFlagsArray = [ "-ldflags=-X main.version=${version}" ];
+
+  postInstall = ''
+    installManPage docs/editorconfig-checker.1
+  '';
 
   meta = with lib; {
     description = "A tool to verify that your files are in harmony with your .editorconfig";
     homepage = "https://editorconfig-checker.github.io/";
     license = licenses.mit;
     maintainers = with maintainers; [ uri-canva ];
   };
-}
+}
diff --git a/pkgs/development/tools/vultr-cli/default.nix b/pkgs/development/tools/vultr-cli/default.nix
@@ -0,0 +1,22 @@
+{ stdenv, buildGoModule, fetchFromGitHub }:
+
+buildGoModule rec {
+  pname = "vultr-cli";
+  version = "0.3.1";
+
+  src = fetchFromGitHub {
+    owner = "vultr";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "1z3vbcpchrf3bak08p72c96c2l39hdp196fqc5wvsqar3mzrrz7s";
+  };
+
+  vendorSha256 = null;
+
+  meta = with stdenv.lib; {
+    description = "Official command line tool for Vultr services";
+    homepage = "https://github.com/vultr/vultr-cli";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ filalex77 ];
+  };
+}