about summary refs log tree commit diff
diff options
context:
space:
mode:
authorgithub-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>2022-03-05 00:10:25 +0000
committerGitHub <noreply@github.com>2022-03-05 00:10:25 +0000
commit398b2ea4e6a2c2d307ef5006840fa26f7efbf082 (patch)
tree0074daaf04b3ec160288fa44ace74d38bbc0a806
parent4ae95d3027a5de5a50c9bfea075f38ed5fd3537f (diff)
parent041689514562b87c6a0941b896fba76ded30a0bf (diff)
downloadnixlib-398b2ea4e6a2c2d307ef5006840fa26f7efbf082.tar
nixlib-398b2ea4e6a2c2d307ef5006840fa26f7efbf082.tar.gz
nixlib-398b2ea4e6a2c2d307ef5006840fa26f7efbf082.tar.bz2
nixlib-398b2ea4e6a2c2d307ef5006840fa26f7efbf082.tar.lz
nixlib-398b2ea4e6a2c2d307ef5006840fa26f7efbf082.tar.xz
nixlib-398b2ea4e6a2c2d307ef5006840fa26f7efbf082.tar.zst
nixlib-398b2ea4e6a2c2d307ef5006840fa26f7efbf082.zip
Merge master into haskell-updates
-rw-r--r--maintainers/maintainer-list.nix24
-rw-r--r--nixos/doc/manual/development/unit-handling.section.md15
-rw-r--r--nixos/doc/manual/from_md/development/unit-handling.section.xml22
-rw-r--r--nixos/doc/manual/from_md/release-notes/rl-2205.section.xml7
-rw-r--r--nixos/doc/manual/release-notes/rl-2205.section.md2
-rw-r--r--nixos/modules/misc/version.nix51
-rw-r--r--nixos/modules/module-list.nix1
-rw-r--r--nixos/modules/programs/firejail.nix4
-rw-r--r--nixos/modules/security/pam.nix2
-rw-r--r--nixos/modules/services/networking/snowflake-proxy.nix81
-rw-r--r--nixos/modules/services/system/earlyoom.nix35
-rw-r--r--nixos/modules/system/activation/switch-to-configuration.pl9
-rw-r--r--nixos/tests/switch-test.nix196
-rw-r--r--pkgs/applications/audio/cardinal/default.nix76
-rw-r--r--pkgs/applications/audio/vmpk/default.nix4
-rw-r--r--pkgs/applications/blockchains/elements/default.nix4
-rw-r--r--pkgs/applications/editors/vim/macvim.nix6
-rw-r--r--pkgs/applications/editors/vim/macvim.patch66
-rw-r--r--pkgs/applications/editors/vim/plugins/overrides.nix2
-rw-r--r--pkgs/applications/editors/vscode/vscode.nix12
-rw-r--r--pkgs/applications/editors/vscode/vscodium.nix10
-rw-r--r--pkgs/applications/misc/avizo/default.nix11
-rw-r--r--pkgs/applications/misc/avizo/use-sysconfdir-instead-of-etc.patch15
-rw-r--r--pkgs/applications/misc/calibre/default.nix1
-rw-r--r--pkgs/applications/misc/joplin-desktop/default.nix6
-rw-r--r--pkgs/applications/misc/limesctl/default.nix6
-rw-r--r--pkgs/applications/misc/logseq/default.nix4
-rw-r--r--pkgs/applications/misc/upwork/default.nix6
-rw-r--r--pkgs/applications/networking/browsers/chromium/upstream-info.json12
-rw-r--r--pkgs/applications/networking/browsers/lagrange/default.nix4
-rw-r--r--pkgs/applications/networking/cluster/fluxcd/default.nix8
-rw-r--r--pkgs/applications/networking/instant-messengers/cinny/default.nix4
-rw-r--r--pkgs/applications/networking/instant-messengers/signal-desktop/default.nix4
-rw-r--r--pkgs/applications/networking/instant-messengers/skypeforlinux/default.nix4
-rw-r--r--pkgs/applications/networking/instant-messengers/vk-messenger/default.nix10
-rw-r--r--pkgs/applications/office/jameica/default.nix1
-rw-r--r--pkgs/applications/science/biology/angsd/default.nix25
-rw-r--r--pkgs/applications/science/biology/minimap2/default.nix3
-rw-r--r--pkgs/applications/science/chemistry/jmol/default.nix4
-rw-r--r--pkgs/applications/version-management/gitea/default.nix4
-rw-r--r--pkgs/applications/virtualization/podman/default.nix1
-rw-r--r--pkgs/applications/virtualization/qemu/default.nix2
-rw-r--r--pkgs/applications/virtualization/seabios/default.nix13
-rw-r--r--pkgs/build-support/singularity-tools/default.nix4
-rw-r--r--pkgs/data/fonts/sarasa-gothic/default.nix4
-rw-r--r--pkgs/data/icons/numix-icon-theme-circle/default.nix4
-rw-r--r--pkgs/data/icons/numix-icon-theme-square/default.nix4
-rw-r--r--pkgs/data/icons/papirus-icon-theme/default.nix4
-rw-r--r--pkgs/desktops/plasma-5/3rdparty/addons/krunner-ssh.nix43
-rw-r--r--pkgs/desktops/plasma-5/default.nix1
-rw-r--r--pkgs/development/compilers/cudatoolkit/default.nix6
-rw-r--r--pkgs/development/compilers/haxe/default.nix2
-rw-r--r--pkgs/development/compilers/reason/default.nix3
-rw-r--r--pkgs/development/libraries/arrow-cpp/default.nix4
-rw-r--r--pkgs/development/libraries/cmark-gfm/default.nix4
-rw-r--r--pkgs/development/libraries/expat/default.nix19
-rw-r--r--pkgs/development/libraries/libdeltachat/default.nix6
-rw-r--r--pkgs/development/libraries/libwbxml/default.nix28
-rw-r--r--pkgs/development/libraries/physics/pythia/default.nix4
-rw-r--r--pkgs/development/libraries/pipewire/wireplumber.nix1
-rw-r--r--pkgs/development/libraries/spice-gtk/default.nix2
-rw-r--r--pkgs/development/libraries/umockdev/default.nix4
-rw-r--r--pkgs/development/ocaml-modules/janestreet/0.12.nix4
-rw-r--r--pkgs/development/ocaml-modules/janestreet/0.14.nix1
-rw-r--r--pkgs/development/ocaml-modules/janestreet/janePackage_0_12.nix8
-rw-r--r--pkgs/development/ocaml-modules/ocaml-migrate-parsetree/1.8.x.nix4
-rw-r--r--pkgs/development/ocaml-modules/ppx_deriving/default.nix5
-rw-r--r--pkgs/development/ocaml-modules/wasm/default.nix1
-rw-r--r--pkgs/development/php-packages/phpstan/default.nix4
-rw-r--r--pkgs/development/python-modules/APScheduler/default.nix4
-rw-r--r--pkgs/development/python-modules/awkward/default.nix4
-rw-r--r--pkgs/development/python-modules/azure-mgmt-containerregistry/default.nix4
-rw-r--r--pkgs/development/python-modules/azure-mgmt-datafactory/default.nix4
-rw-r--r--pkgs/development/python-modules/bandit/default.nix4
-rw-r--r--pkgs/development/python-modules/cfn-lint/default.nix4
-rw-r--r--pkgs/development/python-modules/djangorestframework-simplejwt/default.nix4
-rw-r--r--pkgs/development/python-modules/dropbox/default.nix4
-rw-r--r--pkgs/development/python-modules/furo/default.nix4
-rw-r--r--pkgs/development/python-modules/google-resumable-media/default.nix4
-rw-r--r--pkgs/development/python-modules/hypothesmith/default.nix5
-rw-r--r--pkgs/development/python-modules/kaldi-active-grammar/0001-stub.patch26
-rw-r--r--pkgs/development/python-modules/kaldi-active-grammar/0002-exec-path.patch8
-rw-r--r--pkgs/development/python-modules/kaldi-active-grammar/default.nix2
-rw-r--r--pkgs/development/python-modules/lark/default.nix17
-rw-r--r--pkgs/development/python-modules/pg8000/default.nix4
-rw-r--r--pkgs/development/python-modules/pycfmodel/default.nix4
-rw-r--r--pkgs/development/python-modules/pyobihai/default.nix12
-rw-r--r--pkgs/development/python-modules/slack-sdk/default.nix4
-rw-r--r--pkgs/development/python-modules/sybil/default.nix6
-rw-r--r--pkgs/development/python-modules/testfixtures/default.nix20
-rw-r--r--pkgs/development/python-modules/tikzplotlib/default.nix44
-rw-r--r--pkgs/development/tools/checkmate/default.nix6
-rw-r--r--pkgs/development/tools/devpi-client/default.nix66
-rw-r--r--pkgs/development/tools/earthly/default.nix6
-rw-r--r--pkgs/development/tools/esbuild/default.nix4
-rw-r--r--pkgs/development/tools/go-bindata/default.nix4
-rw-r--r--pkgs/development/tools/ocaml/camlp5/default.nix1
-rw-r--r--pkgs/development/tools/ocaml/ocamlformat/generic.nix4
-rw-r--r--pkgs/development/tools/rust/cargo-llvm-lines/default.nix6
-rw-r--r--pkgs/games/minecraft-servers/versions.json6
-rw-r--r--pkgs/games/steam/fhsenv.nix2
-rw-r--r--pkgs/os-specific/linux/kernel/hardened/patches.json50
-rw-r--r--pkgs/os-specific/linux/kernel/linux-4.14.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/linux-4.19.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/linux-4.9.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/linux-5.10.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/linux-5.15.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/linux-5.16.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/linux-5.4.nix4
-rw-r--r--pkgs/os-specific/linux/rtl88x2bu/default.nix10
-rw-r--r--pkgs/servers/endlessh-go/default.nix22
-rw-r--r--pkgs/servers/http/envoy/0001-quiche-update-QUICHE-tar-13949.patch2980
-rw-r--r--pkgs/servers/http/envoy/0002-Add-upb-patch-to-make-it-compile-under-GCC10.patch91
-rw-r--r--pkgs/servers/http/envoy/default.nix32
-rw-r--r--pkgs/servers/jackett/default.nix4
-rw-r--r--pkgs/servers/misc/gobgpd/default.nix6
-rw-r--r--pkgs/servers/monitoring/prometheus/varnish-exporter.nix6
-rw-r--r--pkgs/tools/admin/cf-vault/default.nix23
-rw-r--r--pkgs/tools/admin/ejson2env/default.nix22
-rw-r--r--pkgs/tools/admin/exoscale-cli/default.nix4
-rw-r--r--pkgs/tools/admin/syft/default.nix6
-rw-r--r--pkgs/tools/audio/midimonster/default.nix57
-rw-r--r--pkgs/tools/misc/cloud-sql-proxy/default.nix6
-rw-r--r--pkgs/tools/misc/shellspec/default.nix34
-rw-r--r--pkgs/tools/misc/smug/default.nix24
-rw-r--r--pkgs/tools/misc/vtm/default.nix28
-rw-r--r--pkgs/tools/networking/gobgp/default.nix6
-rw-r--r--pkgs/tools/networking/minio-client/default.nix4
-rw-r--r--pkgs/tools/networking/openssh/default.nix8
-rw-r--r--pkgs/tools/networking/rdap/default.nix25
-rw-r--r--pkgs/tools/package-management/pdm/default.nix3
-rw-r--r--pkgs/tools/security/exploitdb/default.nix4
-rw-r--r--pkgs/tools/security/jadx/default.nix6
-rw-r--r--pkgs/tools/security/krunner-pass/default.nix24
-rw-r--r--pkgs/tools/security/tboot/default.nix4
-rw-r--r--pkgs/tools/system/btop/default.nix4
-rw-r--r--pkgs/tools/system/consul-template/default.nix6
-rw-r--r--pkgs/tools/system/thermald/default.nix1
-rw-r--r--pkgs/tools/text/diffr/default.nix2
-rw-r--r--pkgs/tools/text/igrep/default.nix35
-rw-r--r--pkgs/tools/text/recode/default.nix9
-rw-r--r--pkgs/tools/video/svt-av1/default.nix4
-rw-r--r--pkgs/top-level/aliases.nix1
-rw-r--r--pkgs/top-level/all-packages.nix56
-rw-r--r--pkgs/top-level/ocaml-packages.nix2
-rw-r--r--pkgs/top-level/python-packages.nix6
146 files changed, 1333 insertions, 3558 deletions
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 07822cfa623e..e803c5ceb4d3 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -6350,6 +6350,12 @@
     githubId = 37185887;
     name = "Calvin Kim";
   };
+  keldu = {
+    email = "mail@keldu.de";
+    github = "keldu";
+    githubId = 15373888;
+    name = "Claudius Holeksa";
+  };
   kennyballou = {
     email = "kb@devnulllabs.io";
     github = "kennyballou";
@@ -7963,6 +7969,12 @@
     githubId = 668926;
     name = "Maximilian Güntner";
   };
+  mh = {
+    email = "68288772+markus-heinrich@users.noreply.github.com";
+    github = "markus-heinrich";
+    githubId = 68288772;
+    name = "Markus Heinrich";
+  };
   mhaselsteiner = {
     email = "magdalena.haselsteiner@gmx.at";
     github = "mhaselsteiner";
@@ -10976,6 +10988,12 @@
     githubId = 19472270;
     name = "Sebastian";
   };
+  sebastianblunt = {
+    name = "Sebastian Blunt";
+    email = "nix@sebastianblunt.com";
+    github = "sebastianblunt";
+    githubId = 47431204;
+  };
   sebbadk = {
     email = "sebastian@sebba.dk";
     github = "SEbbaDK";
@@ -12860,6 +12878,12 @@
     githubId = 118959;
     name = "VinyMeuh";
   };
+  viraptor = {
+    email = "nix@viraptor.info";
+    github = "viraptor";
+    githubId = 188063;
+    name = "Stanisław Pitucha";
+  };
   viric = {
     email = "viric@viric.name";
     github = "viric";
diff --git a/nixos/doc/manual/development/unit-handling.section.md b/nixos/doc/manual/development/unit-handling.section.md
index d477f2c860f3..bd4fe9e670f5 100644
--- a/nixos/doc/manual/development/unit-handling.section.md
+++ b/nixos/doc/manual/development/unit-handling.section.md
@@ -41,17 +41,18 @@ checks:
     `RefuseManualStop` in the `[Unit]` section, and `X-OnlyManualStart` in the
     `[Unit]` section.
 
-  - The rest of the behavior is decided whether the unit has `X-StopIfChanged`
-    in the `[Service]` section set (exposed via
+  - Further behavior depends on the unit having `X-StopIfChanged` in the
+    `[Service]` section set to `true` (exposed via
     [systemd.services.\<name\>.stopIfChanged](#opt-systemd.services)). This is
     set to `true` by default and must be explicitly turned off if not wanted.
     If the flag is enabled, the unit is **stop**ped and then **start**ed. If
     not, the unit is **restart**ed. The goal of the flag is to make sure that
     the new unit never runs in the old environment which is still in place
-    before the activation script is run.
+    before the activation script is run. This behavior is different when the
+    service is socket-activated, as outlined in the following steps.
 
   - The last thing that is taken into account is whether the unit is a service
-    and socket-activated. Due to a bug, this is currently only done when
-    `X-StopIfChanged` is set. If the unit is socket-activated, the socket is
-    stopped and started, and the service is stopped and to be started by socket
-    activation.
+    and socket-activated. If `X-StopIfChanged` is **not** set, the service
+    is **restart**ed with the others. If it is set, both the service and the
+    socket are **stop**ped and the socket is **start**ed, leaving socket
+    activation to start the service when it's needed.
diff --git a/nixos/doc/manual/from_md/development/unit-handling.section.xml b/nixos/doc/manual/from_md/development/unit-handling.section.xml
index a6a654042f6f..57c4754c0018 100644
--- a/nixos/doc/manual/from_md/development/unit-handling.section.xml
+++ b/nixos/doc/manual/from_md/development/unit-handling.section.xml
@@ -88,9 +88,10 @@
         </listitem>
         <listitem>
           <para>
-            The rest of the behavior is decided whether the unit has
+            Further behavior depends on the unit having
             <literal>X-StopIfChanged</literal> in the
-            <literal>[Service]</literal> section set (exposed via
+            <literal>[Service]</literal> section set to
+            <literal>true</literal> (exposed via
             <link linkend="opt-systemd.services">systemd.services.&lt;name&gt;.stopIfChanged</link>).
             This is set to <literal>true</literal> by default and must
             be explicitly turned off if not wanted. If the flag is
@@ -100,17 +101,22 @@
             is <emphasis role="strong">restart</emphasis>ed. The goal of
             the flag is to make sure that the new unit never runs in the
             old environment which is still in place before the
-            activation script is run.
+            activation script is run. This behavior is different when
+            the service is socket-activated, as outlined in the
+            following steps.
           </para>
         </listitem>
         <listitem>
           <para>
             The last thing that is taken into account is whether the
-            unit is a service and socket-activated. Due to a bug, this
-            is currently only done when
-            <literal>X-StopIfChanged</literal> is set. If the unit is
-            socket-activated, the socket is stopped and started, and the
-            service is stopped and to be started by socket activation.
+            unit is a service and socket-activated. If
+            <literal>X-StopIfChanged</literal> is
+            <emphasis role="strong">not</emphasis> set, the service is
+            <emphasis role="strong">restart</emphasis>ed with the
+            others. If it is set, both the service and the socket are
+            <emphasis role="strong">stop</emphasis>ped and the socket is
+            <emphasis role="strong">start</emphasis>ed, leaving socket
+            activation to start the service when it’s needed.
           </para>
         </listitem>
       </itemizedlist>
diff --git a/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml b/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
index 4f9cd121799f..2bcfc86b432b 100644
--- a/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
@@ -122,6 +122,13 @@
       </listitem>
       <listitem>
         <para>
+          <link xlink:href="https://snowflake.torproject.org/">snowflake-proxy</link>,
+          a system to defeat internet censorship. Available as
+          <link xlink:href="options.html#opt-services.snowflake-proxy.enable">services.snowflake-proxy</link>.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
           <link xlink:href="https://ergo.chat">ergochat</link>, a modern
           IRC with IRCv3 features. Available as
           <link xlink:href="options.html#opt-services.ergochat.enable">services.ergochat</link>.
diff --git a/nixos/doc/manual/release-notes/rl-2205.section.md b/nixos/doc/manual/release-notes/rl-2205.section.md
index de384c102dc7..650ace8d9d2a 100644
--- a/nixos/doc/manual/release-notes/rl-2205.section.md
+++ b/nixos/doc/manual/release-notes/rl-2205.section.md
@@ -37,6 +37,8 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - [heisenbridge](https://github.com/hifi/heisenbridge), a bouncer-style Matrix IRC bridge. Available as [services.heisenbridge](options.html#opt-services.heisenbridge.enable).
 
+- [snowflake-proxy](https://snowflake.torproject.org/), a system to defeat internet censorship. Available as [services.snowflake-proxy](options.html#opt-services.snowflake-proxy.enable).
+
 - [ergochat](https://ergo.chat), a modern IRC with IRCv3 features. Available as [services.ergochat](options.html#opt-services.ergochat.enable).
 
 - [PowerDNS-Admin](https://github.com/ngoduykhanh/PowerDNS-Admin), a web interface for the PowerDNS server. Available at [services.powerdns-admin](options.html#opt-services.powerdns-admin.enable).
diff --git a/nixos/modules/misc/version.nix b/nixos/modules/misc/version.nix
index 6c526f6d4f2d..6c072021ed83 100644
--- a/nixos/modules/misc/version.nix
+++ b/nixos/modules/misc/version.nix
@@ -1,12 +1,17 @@
 { config, lib, options, pkgs, ... }:
 
-with lib;
-
 let
   cfg = config.system.nixos;
   opt = options.system.nixos;
-in
 
+  inherit (lib)
+    concatStringsSep mapAttrsToList toLower
+    literalExpression mkRenamedOptionModule mkDefault mkOption trivial types;
+
+  attrsToText = attrs:
+    concatStringsSep "\n" (mapAttrsToList (n: v: ''${n}="${toString v}"'') attrs);
+
+in
 {
   imports = [
     (mkRenamedOptionModule [ "system" "nixosVersion" ] [ "system" "nixos" "version" ])
@@ -101,22 +106,30 @@ in
     # Generate /etc/os-release.  See
     # https://www.freedesktop.org/software/systemd/man/os-release.html for the
     # format.
-    environment.etc.os-release.text =
-      ''
-        NAME=NixOS
-        ID=nixos
-        VERSION="${cfg.release} (${cfg.codeName})"
-        VERSION_CODENAME=${toLower cfg.codeName}
-        VERSION_ID="${cfg.release}"
-        BUILD_ID="${cfg.version}"
-        PRETTY_NAME="NixOS ${cfg.release} (${cfg.codeName})"
-        LOGO="nix-snowflake"
-        HOME_URL="https://nixos.org/"
-        DOCUMENTATION_URL="https://nixos.org/learn.html"
-        SUPPORT_URL="https://nixos.org/community.html"
-        BUG_REPORT_URL="https://github.com/NixOS/nixpkgs/issues"
-      '';
-
+    environment.etc = {
+      "lsb-release".text = attrsToText {
+        LSB_VERSION = "${cfg.release} (${cfg.codeName})";
+        DISTRIB_ID = "nixos";
+        DISTRIB_RELEASE = cfg.release;
+        DISTRIB_CODENAME = toLower cfg.codeName;
+        DISTRIB_DESCRIPTION = "NixOS ${cfg.release} (${cfg.codeName})";
+      };
+
+      "os-release".text = attrsToText {
+        NAME = "NixOS";
+        ID = "nixos";
+        VERSION = "${cfg.release} (${cfg.codeName})";
+        VERSION_CODENAME = toLower cfg.codeName;
+        VERSION_ID = cfg.release;
+        BUILD_ID = cfg.version;
+        PRETTY_NAME = "NixOS ${cfg.release} (${cfg.codeName})";
+        LOGO = "nix-snowflake";
+        HOME_URL = "https://nixos.org/";
+        DOCUMENTATION_URL = "https://nixos.org/learn.html";
+        SUPPORT_URL = "https://nixos.org/community.html";
+        BUG_REPORT_URL = "https://github.com/NixOS/nixpkgs/issues";
+      };
+    };
   };
 
   # uses version info nixpkgs, which requires a full nixpkgs path
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index c102f4c97ee3..7bce1119d738 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -877,6 +877,7 @@
   ./services/networking/shorewall6.nix
   ./services/networking/shout.nix
   ./services/networking/sniproxy.nix
+  ./services/networking/snowflake-proxy.nix
   ./services/networking/smartdns.nix
   ./services/networking/smokeping.nix
   ./services/networking/softether.nix
diff --git a/nixos/modules/programs/firejail.nix b/nixos/modules/programs/firejail.nix
index 8c10d7c4df39..76b42168c198 100644
--- a/nixos/modules/programs/firejail.nix
+++ b/nixos/modules/programs/firejail.nix
@@ -17,8 +17,8 @@ let
         then value
         else { executable = value; profile = null; extraArgs = []; };
         args = lib.escapeShellArgs (
-          (optional (opts.profile != null) "--profile=${toString opts.profile}")
-          ++ opts.extraArgs
+          opts.extraArgs
+          ++ (optional (opts.profile != null) "--profile=${toString opts.profile}")
           );
       in
       ''
diff --git a/nixos/modules/security/pam.nix b/nixos/modules/security/pam.nix
index 9f295db84fd6..c0ef8b5f30bd 100644
--- a/nixos/modules/security/pam.nix
+++ b/nixos/modules/security/pam.nix
@@ -518,7 +518,7 @@ let
                 auth optional ${pkgs.pam_gnupg}/lib/security/pam_gnupg.so ${optionalString cfg.gnupg.storeOnly " store-only"}
               '' +
               optionalString cfg.googleAuthenticator.enable ''
-                auth required ${pkgs.googleAuthenticator}/lib/security/pam_google_authenticator.so no_increment_hotp
+                auth required ${pkgs.google-authenticator}/lib/security/pam_google_authenticator.so no_increment_hotp
               '' +
               optionalString cfg.duoSecurity.enable ''
                 auth required ${pkgs.duo-unix}/lib/security/pam_duo.so
diff --git a/nixos/modules/services/networking/snowflake-proxy.nix b/nixos/modules/services/networking/snowflake-proxy.nix
new file mode 100644
index 000000000000..2124644ed9b5
--- /dev/null
+++ b/nixos/modules/services/networking/snowflake-proxy.nix
@@ -0,0 +1,81 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.services.snowflake-proxy;
+in
+{
+  options = {
+    services.snowflake-proxy = {
+      enable = mkEnableOption "System to defeat internet censorship";
+
+      broker = mkOption {
+        description = "Broker URL (default \"https://snowflake-broker.torproject.net/\")";
+        type = with types; nullOr str;
+        default = null;
+      };
+
+      capacity = mkOption {
+        description = "Limits the amount of maximum concurrent clients allowed.";
+        type = with types; nullOr int;
+        default = null;
+      };
+
+      relay = mkOption {
+        description = "websocket relay URL (default \"wss://snowflake.bamsoftware.com/\")";
+        type = with types; nullOr str;
+        default = null;
+      };
+
+      stun = mkOption {
+        description = "STUN broker URL (default \"stun:stun.stunprotocol.org:3478\")";
+        type = with types; nullOr str;
+        default = null;
+      };
+    };
+  };
+
+  config = mkIf cfg.enable {
+    systemd.services.snowflake-proxy = {
+      wantedBy = [ "network-online.target" ];
+      serviceConfig = {
+        ExecStart =
+          "${pkgs.snowflake}/bin/proxy " + concatStringsSep " " (
+            optional (cfg.broker != null) "-broker ${cfg.broker}"
+            ++ optional (cfg.capacity != null) "-capacity ${builtins.toString cfg.capacity}"
+            ++ optional (cfg.relay != null) "-relay ${cfg.relay}"
+            ++ optional (cfg.stun != null) "-stun ${cfg.stun}"
+          );
+
+        # Security Hardening
+        # Refer to systemd.exec(5) for option descriptions.
+        CapabilityBoundingSet = "";
+
+        # implies RemoveIPC=, PrivateTmp=, NoNewPrivileges=, RestrictSUIDSGID=,
+        # ProtectSystem=strict, ProtectHome=read-only
+        DynamicUser = true;
+        LockPersonality = true;
+        PrivateDevices = true;
+        PrivateUsers = true;
+        ProcSubset = "pid";
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectProc = "invisible";
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        RestrictAddressFamilies = [ "AF_INET" "AF_INET6" "AF_UNIX" ];
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        SystemCallArchitectures = "native";
+        SystemCallFilter = "~@clock @cpu-emulation @debug @mount @obsolete @reboot @swap @privileged @resources";
+        UMask = "0077";
+      };
+    };
+  };
+
+  meta.maintainers = with maintainers; [ yayayayaka ];
+}
diff --git a/nixos/modules/services/system/earlyoom.nix b/nixos/modules/services/system/earlyoom.nix
index 452efc736439..b355df056bc1 100644
--- a/nixos/modules/services/system/earlyoom.nix
+++ b/nixos/modules/services/system/earlyoom.nix
@@ -39,20 +39,12 @@ in
         '';
       };
 
-      useKernelOOMKiller= mkOption {
-        type = types.bool;
-        default = false;
-        description = ''
-          Use kernel OOM killer instead of own user-space implementation.
-        '';
-      };
-
+      # TODO: remove or warn after 1.7 (https://github.com/rfjakob/earlyoom/commit/7ebc4554)
       ignoreOOMScoreAdjust = mkOption {
         type = types.bool;
         default = false;
         description = ''
           Ignore oom_score_adjust values of processes.
-          User-space implementation only.
         '';
       };
 
@@ -87,16 +79,21 @@ in
     };
   };
 
+  imports = [
+    (mkRemovedOptionModule [ "services" "earlyoom" "useKernelOOMKiller" ] ''
+      This option is deprecated and ignored by earlyoom since 1.2.
+    '')
+  ];
+
   config = mkIf ecfg.enable {
     assertions = [
       { assertion = ecfg.freeMemThreshold > 0 && ecfg.freeMemThreshold <= 100;
         message = "Needs to be a positive percentage"; }
       { assertion = ecfg.freeSwapThreshold > 0 && ecfg.freeSwapThreshold <= 100;
         message = "Needs to be a positive percentage"; }
-      { assertion = !ecfg.useKernelOOMKiller || !ecfg.ignoreOOMScoreAdjust;
-        message = "Both options in conjunction do not make sense"; }
     ];
 
+    # TODO: reimplement this option as -N after 1.7 (https://github.com/rfjakob/earlyoom/commit/afe03606)
     warnings = optional (ecfg.notificationsCommand != null)
       "`services.earlyoom.notificationsCommand` is deprecated and ignored by earlyoom since 1.6.";
 
@@ -107,15 +104,13 @@ in
       serviceConfig = {
         StandardOutput = "null";
         StandardError = "journal";
-        ExecStart = ''
-          ${pkgs.earlyoom}/bin/earlyoom \
-          -m ${toString ecfg.freeMemThreshold} \
-          -s ${toString ecfg.freeSwapThreshold} \
-          ${optionalString ecfg.useKernelOOMKiller "-k"} \
-          ${optionalString ecfg.ignoreOOMScoreAdjust "-i"} \
-          ${optionalString ecfg.enableDebugInfo "-d"} \
-          ${optionalString ecfg.enableNotifications "-n"}
-        '';
+        ExecStart = concatStringsSep " " ([
+          "${pkgs.earlyoom}/bin/earlyoom"
+          "-m ${toString ecfg.freeMemThreshold}"
+          "-s ${toString ecfg.freeSwapThreshold}"
+        ] ++ optional ecfg.ignoreOOMScoreAdjust "-i"
+          ++ optional ecfg.enableDebugInfo "-d"
+          ++ optional ecfg.enableNotifications "-n");
       };
     };
 
diff --git a/nixos/modules/system/activation/switch-to-configuration.pl b/nixos/modules/system/activation/switch-to-configuration.pl
index a8fe14c58f05..3a5ffe822ed7 100644
--- a/nixos/modules/system/activation/switch-to-configuration.pl
+++ b/nixos/modules/system/activation/switch-to-configuration.pl
@@ -307,6 +307,7 @@ sub handleModifiedUnit {
         # seem to get applied on daemon-reload.
     } elsif ($unit =~ /\.mount$/) {
         # Reload the changed mount unit to force a remount.
+        # FIXME: only reload when Options= changed, restart otherwise
         $unitsToReload->{$unit} = 1;
         recordUnit($reloadListFile, $unit);
     } elsif ($unit =~ /\.socket$/) {
@@ -339,7 +340,7 @@ sub handleModifiedUnit {
                 # If this unit is socket-activated, then stop the
                 # socket unit(s) as well, and restart the
                 # socket(s) instead of the service.
-                my $socketActivated = 0;
+                my $socket_activated = 0;
                 if ($unit =~ /\.service$/) {
                     my @sockets = split(/ /, join(" ", @{$unitInfo{Service}{Sockets} // []}));
                     if (scalar @sockets == 0) {
@@ -347,13 +348,15 @@ sub handleModifiedUnit {
                     }
                     foreach my $socket (@sockets) {
                         if (defined $activePrev->{$socket}) {
+                            # We can now be sure this is a socket-activate unit
+
                             $unitsToStop->{$socket} = 1;
                             # Only restart sockets that actually
                             # exist in new configuration:
                             if (-e "$out/etc/systemd/system/$socket") {
                                 $unitsToStart->{$socket} = 1;
                                 recordUnit($startListFile, $socket);
-                                $socketActivated = 1;
+                                $socket_activated = 1;
                             }
                             # Remove from units to reload so we don't restart and reload
                             if ($unitsToReload->{$unit}) {
@@ -368,7 +371,7 @@ sub handleModifiedUnit {
                 # that this unit needs to be started below.
                 # We write this to a file to ensure that the
                 # service gets restarted if we're interrupted.
-                if (!$socketActivated) {
+                if (!$socket_activated) {
                     $unitsToStart->{$unit} = 1;
                     recordUnit($startListFile, $unit);
                 }
diff --git a/nixos/tests/switch-test.nix b/nixos/tests/switch-test.nix
index b429babce838..78eb71f0a28e 100644
--- a/nixos/tests/switch-test.nix
+++ b/nixos/tests/switch-test.nix
@@ -1,6 +1,46 @@
 # Test configuration switching.
 
-import ./make-test-python.nix ({ pkgs, ...} : {
+import ./make-test-python.nix ({ pkgs, ...} : let
+
+  # Simple service that can either be socket-activated or that will
+  # listen on port 1234 if not socket-activated.
+  # A connection to the socket causes 'hello' to be written to the client.
+  socketTest = pkgs.writeScript "socket-test.py" /* python */ ''
+    #!${pkgs.python3}/bin/python3
+
+    from socketserver import TCPServer, StreamRequestHandler
+    import socket
+    import os
+
+
+    class Handler(StreamRequestHandler):
+        def handle(self):
+            self.wfile.write("hello".encode("utf-8"))
+
+
+    class Server(TCPServer):
+        def __init__(self, server_address, handler_cls):
+            listenFds = os.getenv('LISTEN_FDS')
+            if listenFds is None or int(listenFds) < 1:
+                print(f'Binding to {server_address}')
+                TCPServer.__init__(
+                        self, server_address, handler_cls, bind_and_activate=True)
+            else:
+                TCPServer.__init__(
+                        self, server_address, handler_cls, bind_and_activate=False)
+                # Override socket
+                print(f'Got activated by {os.getenv("LISTEN_FDNAMES")} '
+                      f'with {listenFds} FDs')
+                self.socket = socket.fromfd(3, self.address_family,
+                                            self.socket_type)
+
+
+    if __name__ == "__main__":
+        server = Server(("localhost", 1234), Handler)
+        server.serve_forever()
+  '';
+
+in {
   name = "switch-test";
   meta = with pkgs.lib.maintainers; {
     maintainers = [ gleber das_j ];
@@ -8,6 +48,7 @@ import ./make-test-python.nix ({ pkgs, ...} : {
 
   nodes = {
     machine = { pkgs, lib, ... }: {
+      environment.systemPackages = [ pkgs.socat ]; # for the socket activation stuff
       users.mutableUsers = false;
 
       specialisation = rec {
@@ -231,6 +272,40 @@ import ./make-test-python.nix ({ pkgs, ...} : {
           systemd.services.reload-triggers-and-restart.serviceConfig.X-Modified = "test";
         };
 
+        simple-socket.configuration = {
+          systemd.services.socket-activated = {
+            description = "A socket-activated service";
+            stopIfChanged = lib.mkDefault false;
+            serviceConfig = {
+              ExecStart = socketTest;
+              ExecReload = "${pkgs.coreutils}/bin/true";
+            };
+          };
+          systemd.sockets.socket-activated = {
+            wantedBy = [ "sockets.target" ];
+            listenStreams = [ "/run/test.sock" ];
+            socketConfig.SocketMode = lib.mkDefault "0777";
+          };
+        };
+
+        simple-socket-service-modified.configuration = {
+          imports = [ simple-socket.configuration ];
+          systemd.services.socket-activated.serviceConfig.X-Test = "test";
+        };
+
+        simple-socket-stop-if-changed.configuration = {
+          imports = [ simple-socket.configuration ];
+          systemd.services.socket-activated.stopIfChanged = true;
+        };
+
+        simple-socket-stop-if-changed-and-reloadtrigger.configuration = {
+          imports = [ simple-socket.configuration ];
+          systemd.services.socket-activated = {
+            stopIfChanged = true;
+            reloadTriggers = [ "test" ];
+          };
+        };
+
         mount.configuration = {
           systemd.mounts = [
             {
@@ -378,7 +453,6 @@ import ./make-test-python.nix ({ pkgs, ...} : {
         assert_lacks(out, "\nrestarting the following units:")
         assert_lacks(out, "\nstarting the following units:")
         assert_lacks(out, "the following new units were started:")
-        assert_lacks(out, "as well:")
 
         # Start a simple service
         out = switch_to_specialisation("${machine}", "simpleService")
@@ -388,7 +462,6 @@ import ./make-test-python.nix ({ pkgs, ...} : {
         assert_lacks(out, "\nrestarting the following units:")
         assert_lacks(out, "\nstarting the following units:")
         assert_contains(out, "the following new units were started: test.service\n")
-        assert_lacks(out, "as well:")
 
         # Not changing anything doesn't do anything
         out = switch_to_specialisation("${machine}", "simpleService")
@@ -398,7 +471,6 @@ import ./make-test-python.nix ({ pkgs, ...} : {
         assert_lacks(out, "\nrestarting the following units:")
         assert_lacks(out, "\nstarting the following units:")
         assert_lacks(out, "the following new units were started:")
-        assert_lacks(out, "as well:")
 
         # Restart the simple service
         out = switch_to_specialisation("${machine}", "simpleServiceModified")
@@ -408,7 +480,6 @@ import ./make-test-python.nix ({ pkgs, ...} : {
         assert_lacks(out, "\nrestarting the following units:")
         assert_contains(out, "\nstarting the following units: test.service\n")
         assert_lacks(out, "the following new units were started:")
-        assert_lacks(out, "as well:")
 
         # Restart the service with stopIfChanged=false
         out = switch_to_specialisation("${machine}", "simpleServiceNostop")
@@ -418,7 +489,6 @@ import ./make-test-python.nix ({ pkgs, ...} : {
         assert_contains(out, "\nrestarting the following units: test.service\n")
         assert_lacks(out, "\nstarting the following units:")
         assert_lacks(out, "the following new units were started:")
-        assert_lacks(out, "as well:")
 
         # Reload the service with reloadIfChanged=true
         out = switch_to_specialisation("${machine}", "simpleServiceReload")
@@ -428,7 +498,6 @@ import ./make-test-python.nix ({ pkgs, ...} : {
         assert_lacks(out, "\nrestarting the following units:")
         assert_lacks(out, "\nstarting the following units:")
         assert_lacks(out, "the following new units were started:")
-        assert_lacks(out, "as well:")
 
         # Nothing happens when restartIfChanged=false
         out = switch_to_specialisation("${machine}", "simpleServiceNorestart")
@@ -438,7 +507,6 @@ import ./make-test-python.nix ({ pkgs, ...} : {
         assert_lacks(out, "\nrestarting the following units:")
         assert_lacks(out, "\nstarting the following units:")
         assert_lacks(out, "the following new units were started:")
-        assert_lacks(out, "as well:")
 
         # Dry mode shows different messages
         out = switch_to_specialisation("${machine}", "simpleService", action="dry-activate")
@@ -448,7 +516,6 @@ import ./make-test-python.nix ({ pkgs, ...} : {
         assert_lacks(out, "\nrestarting the following units:")
         assert_lacks(out, "\nstarting the following units:")
         assert_lacks(out, "the following new units were started:")
-        assert_lacks(out, "as well:")
         assert_contains(out, "would start the following units: test.service\n")
 
         # Ensure \ works in unit names
@@ -459,7 +526,6 @@ import ./make-test-python.nix ({ pkgs, ...} : {
         assert_lacks(out, "\nrestarting the following units:")
         assert_lacks(out, "\nstarting the following units:")
         assert_contains(out, "the following new units were started: escaped\\x2ddash.service\n")
-        assert_lacks(out, "as well:")
 
         out = switch_to_specialisation("${machine}", "unitWithBackslashModified")
         assert_contains(out, "stopping the following units: escaped\\x2ddash.service\n")
@@ -468,7 +534,6 @@ import ./make-test-python.nix ({ pkgs, ...} : {
         assert_lacks(out, "\nrestarting the following units:")
         assert_contains(out, "\nstarting the following units: escaped\\x2ddash.service\n")
         assert_lacks(out, "the following new units were started:")
-        assert_lacks(out, "as well:")
 
     with subtest("failing units"):
         # Let the simple service fail
@@ -482,7 +547,6 @@ import ./make-test-python.nix ({ pkgs, ...} : {
         assert_lacks(out, "the following new units were started:")
         assert_contains(out, "warning: the following units failed: test.service\n")
         assert_contains(out, "Main PID:")  # output of systemctl
-        assert_lacks(out, "as well:")
 
         # A unit that gets into autorestart without failing is not treated as failed
         out = switch_to_specialisation("${machine}", "autorestartService")
@@ -492,7 +556,6 @@ import ./make-test-python.nix ({ pkgs, ...} : {
         assert_lacks(out, "\nrestarting the following units:")
         assert_lacks(out, "\nstarting the following units:")
         assert_contains(out, "the following new units were started: autorestart.service\n")
-        assert_lacks(out, "as well:")
         machine.systemctl('stop autorestart.service')  # cancel the 20y timer
 
         # Switching to the same system should do nothing (especially not treat the unit as failed)
@@ -503,7 +566,6 @@ import ./make-test-python.nix ({ pkgs, ...} : {
         assert_lacks(out, "\nrestarting the following units:")
         assert_lacks(out, "\nstarting the following units:")
         assert_contains(out, "the following new units were started: autorestart.service\n")
-        assert_lacks(out, "as well:")
         machine.systemctl('stop autorestart.service')  # cancel the 20y timer
 
         # If systemd thinks the unit has failed and is in autorestart, we should show it as failed
@@ -516,7 +578,6 @@ import ./make-test-python.nix ({ pkgs, ...} : {
         assert_lacks(out, "the following new units were started:")
         assert_contains(out, "warning: the following units failed: autorestart.service\n")
         assert_contains(out, "Main PID:")  # output of systemctl
-        assert_lacks(out, "as well:")
 
     with subtest("unit file parser"):
         # Switch to a well-known state
@@ -530,7 +591,6 @@ import ./make-test-python.nix ({ pkgs, ...} : {
         assert_contains(out, "\nrestarting the following units: test.service\n")
         assert_lacks(out, "\nstarting the following units:")
         assert_lacks(out, "the following new units were started:")
-        assert_lacks(out, "as well:")
 
         # Rename it
         out = switch_to_specialisation("${machine}", "simpleServiceWithExtraSectionOtherName")
@@ -540,7 +600,6 @@ import ./make-test-python.nix ({ pkgs, ...} : {
         assert_contains(out, "\nrestarting the following units: test.service\n")
         assert_lacks(out, "\nstarting the following units:")
         assert_lacks(out, "the following new units were started:")
-        assert_lacks(out, "as well:")
 
         # Remove it
         out = switch_to_specialisation("${machine}", "simpleServiceNostop")
@@ -550,7 +609,6 @@ import ./make-test-python.nix ({ pkgs, ...} : {
         assert_contains(out, "\nrestarting the following units: test.service\n")
         assert_lacks(out, "\nstarting the following units:")
         assert_lacks(out, "the following new units were started:")
-        assert_lacks(out, "as well:")
 
         # [Install] section is ignored
         out = switch_to_specialisation("${machine}", "simpleServiceWithInstallSection")
@@ -560,7 +618,6 @@ import ./make-test-python.nix ({ pkgs, ...} : {
         assert_lacks(out, "\nrestarting the following units:")
         assert_lacks(out, "\nstarting the following units:")
         assert_lacks(out, "the following new units were started:")
-        assert_lacks(out, "as well:")
 
         # Add a key
         out = switch_to_specialisation("${machine}", "simpleServiceWithExtraKey")
@@ -570,7 +627,6 @@ import ./make-test-python.nix ({ pkgs, ...} : {
         assert_contains(out, "\nrestarting the following units: test.service\n")
         assert_lacks(out, "\nstarting the following units:")
         assert_lacks(out, "the following new units were started:")
-        assert_lacks(out, "as well:")
 
         # Change its value
         out = switch_to_specialisation("${machine}", "simpleServiceWithExtraKeyOtherValue")
@@ -580,7 +636,6 @@ import ./make-test-python.nix ({ pkgs, ...} : {
         assert_contains(out, "\nrestarting the following units: test.service\n")
         assert_lacks(out, "\nstarting the following units:")
         assert_lacks(out, "the following new units were started:")
-        assert_lacks(out, "as well:")
 
         # Rename it
         out = switch_to_specialisation("${machine}", "simpleServiceWithExtraKeyOtherName")
@@ -590,7 +645,6 @@ import ./make-test-python.nix ({ pkgs, ...} : {
         assert_contains(out, "\nrestarting the following units: test.service\n")
         assert_lacks(out, "\nstarting the following units:")
         assert_lacks(out, "the following new units were started:")
-        assert_lacks(out, "as well:")
 
         # Remove it
         out = switch_to_specialisation("${machine}", "simpleServiceNostop")
@@ -600,7 +654,6 @@ import ./make-test-python.nix ({ pkgs, ...} : {
         assert_contains(out, "\nrestarting the following units: test.service\n")
         assert_lacks(out, "\nstarting the following units:")
         assert_lacks(out, "the following new units were started:")
-        assert_lacks(out, "as well:")
 
         # Add a reload trigger
         out = switch_to_specialisation("${machine}", "simpleServiceReloadTrigger")
@@ -610,7 +663,6 @@ import ./make-test-python.nix ({ pkgs, ...} : {
         assert_lacks(out, "\nrestarting the following units:")
         assert_lacks(out, "\nstarting the following units:")
         assert_lacks(out, "the following new units were started:")
-        assert_lacks(out, "as well:")
 
         # Modify the reload trigger
         out = switch_to_specialisation("${machine}", "simpleServiceReloadTriggerModified")
@@ -620,7 +672,6 @@ import ./make-test-python.nix ({ pkgs, ...} : {
         assert_lacks(out, "\nrestarting the following units:")
         assert_lacks(out, "\nstarting the following units:")
         assert_lacks(out, "the following new units were started:")
-        assert_lacks(out, "as well:")
 
         # Modify the reload trigger and something else
         out = switch_to_specialisation("${machine}", "simpleServiceReloadTriggerModifiedAndSomethingElse")
@@ -630,7 +681,6 @@ import ./make-test-python.nix ({ pkgs, ...} : {
         assert_contains(out, "\nrestarting the following units: test.service\n")
         assert_lacks(out, "\nstarting the following units:")
         assert_lacks(out, "the following new units were started:")
-        assert_lacks(out, "as well:")
 
         # Remove the reload trigger
         out = switch_to_specialisation("${machine}", "simpleServiceReloadTriggerModifiedSomethingElse")
@@ -640,7 +690,6 @@ import ./make-test-python.nix ({ pkgs, ...} : {
         assert_lacks(out, "\nrestarting the following units:")
         assert_lacks(out, "\nstarting the following units:")
         assert_lacks(out, "the following new units were started:")
-        assert_lacks(out, "as well:")
 
     with subtest("restart and reload by activation script"):
         switch_to_specialisation("${machine}", "simpleServiceNorestart")
@@ -650,7 +699,7 @@ import ./make-test-python.nix ({ pkgs, ...} : {
         assert_lacks(out, "reloading the following units:")
         assert_lacks(out, "restarting the following units:")
         assert_contains(out, "\nstarting the following units: no-restart-service.service, reload-triggers-and-restart-by-as.service, simple-reload-service.service, simple-restart-service.service, simple-service.service\n")
-        assert_lacks(out, "as well:")
+        assert_contains(out, "the following new units were started: no-restart-service.service, reload-triggers-and-restart-by-as.service, reload-triggers-and-restart.service, reload-triggers.service, simple-reload-service.service, simple-restart-service.service, simple-service.service\n")
         # Switch to the same system where the example services get restarted
         # and reloaded by the activation script
         out = switch_to_specialisation("${machine}", "restart-and-reload-by-activation-script")
@@ -659,7 +708,7 @@ import ./make-test-python.nix ({ pkgs, ...} : {
         assert_contains(out, "reloading the following units: reload-triggers-and-restart.service, reload-triggers.service, simple-reload-service.service\n")
         assert_contains(out, "restarting the following units: reload-triggers-and-restart-by-as.service, simple-restart-service.service, simple-service.service\n")
         assert_lacks(out, "\nstarting the following units:")
-        assert_lacks(out, "as well:")
+        assert_lacks(out, "the following new units were started:")
         # Switch to the same system and see if the service gets restarted when it's modified
         # while the fact that it's supposed to be reloaded by the activation script is ignored.
         out = switch_to_specialisation("${machine}", "restart-and-reload-by-activation-script-modified")
@@ -668,7 +717,7 @@ import ./make-test-python.nix ({ pkgs, ...} : {
         assert_contains(out, "reloading the following units: reload-triggers.service, simple-reload-service.service\n")
         assert_contains(out, "restarting the following units: reload-triggers-and-restart-by-as.service, reload-triggers-and-restart.service, simple-restart-service.service, simple-service.service\n")
         assert_lacks(out, "\nstarting the following units:")
-        assert_lacks(out, "as well:")
+        assert_lacks(out, "the following new units were started:")
         # The same, but in dry mode
         out = switch_to_specialisation("${machine}", "restart-and-reload-by-activation-script", action="dry-activate")
         assert_lacks(out, "would stop the following units:")
@@ -676,7 +725,71 @@ import ./make-test-python.nix ({ pkgs, ...} : {
         assert_contains(out, "would reload the following units: reload-triggers.service, simple-reload-service.service\n")
         assert_contains(out, "would restart the following units: reload-triggers-and-restart-by-as.service, reload-triggers-and-restart.service, simple-restart-service.service, simple-service.service\n")
         assert_lacks(out, "\nwould start the following units:")
-        assert_lacks(out, "as well:")
+
+    with subtest("socket-activated services"):
+        # Socket-activated services don't get started, just the socket
+        machine.fail("[ -S /run/test.sock ]")
+        out = switch_to_specialisation("${machine}", "simple-socket")
+        # assert_lacks(out, "stopping the following units:") not relevant
+        assert_lacks(out, "NOT restarting the following changed units:")
+        assert_lacks(out, "reloading the following units:")
+        assert_lacks(out, "\nrestarting the following units:")
+        assert_lacks(out, "\nstarting the following units:")
+        assert_contains(out, "the following new units were started: socket-activated.socket\n")
+        machine.succeed("[ -S /run/test.sock ]")
+
+        # Changing a non-activated service does nothing
+        out = switch_to_specialisation("${machine}", "simple-socket-service-modified")
+        assert_lacks(out, "stopping the following units:")
+        assert_lacks(out, "NOT restarting the following changed units:")
+        assert_lacks(out, "reloading the following units:")
+        assert_lacks(out, "\nrestarting the following units:")
+        assert_lacks(out, "\nstarting the following units:")
+        assert_lacks(out, "the following new units were started:")
+        machine.succeed("[ -S /run/test.sock ]")
+        # The unit is properly activated when the socket is accessed
+        if machine.succeed("socat - UNIX-CONNECT:/run/test.sock") != "hello":
+            raise Exception("Socket was not properly activated")  # idk how that would happen tbh
+
+        # Changing an activated service with stopIfChanged=false restarts the service
+        out = switch_to_specialisation("${machine}", "simple-socket")
+        assert_lacks(out, "stopping the following units:")
+        assert_lacks(out, "NOT restarting the following changed units:")
+        assert_lacks(out, "reloading the following units:")
+        assert_contains(out, "\nrestarting the following units: socket-activated.service\n")
+        assert_lacks(out, "\nstarting the following units:")
+        assert_lacks(out, "the following new units were started:")
+        machine.succeed("[ -S /run/test.sock ]")
+        # Socket-activation of the unit still works
+        if machine.succeed("socat - UNIX-CONNECT:/run/test.sock") != "hello":
+            raise Exception("Socket was not properly activated after the service was restarted")
+
+        # Changing an activated service with stopIfChanged=true stops the service and
+        # socket and starts the socket
+        out = switch_to_specialisation("${machine}", "simple-socket-stop-if-changed")
+        assert_contains(out, "stopping the following units: socket-activated.service, socket-activated.socket\n")
+        assert_lacks(out, "NOT restarting the following changed units:")
+        assert_lacks(out, "reloading the following units:")
+        assert_lacks(out, "\nrestarting the following units:")
+        assert_contains(out, "\nstarting the following units: socket-activated.socket\n")
+        assert_lacks(out, "the following new units were started:")
+        machine.succeed("[ -S /run/test.sock ]")
+        # Socket-activation of the unit still works
+        if machine.succeed("socat - UNIX-CONNECT:/run/test.sock") != "hello":
+            raise Exception("Socket was not properly activated after the service was restarted")
+
+        # Changing a reload trigger of a socket-activated unit only reloads it
+        out = switch_to_specialisation("${machine}", "simple-socket-stop-if-changed-and-reloadtrigger")
+        assert_lacks(out, "stopping the following units:")
+        assert_lacks(out, "NOT restarting the following changed units:")
+        assert_contains(out, "reloading the following units: socket-activated.service\n")
+        assert_lacks(out, "\nrestarting the following units:")
+        assert_lacks(out, "\nstarting the following units: socket-activated.socket")
+        assert_lacks(out, "the following new units were started:")
+        machine.succeed("[ -S /run/test.sock ]")
+        # Socket-activation of the unit still works
+        if machine.succeed("socat - UNIX-CONNECT:/run/test.sock") != "hello":
+            raise Exception("Socket was not properly activated after the service was restarted")
 
     with subtest("mounts"):
         switch_to_specialisation("${machine}", "mount")
@@ -689,7 +802,6 @@ import ./make-test-python.nix ({ pkgs, ...} : {
         assert_lacks(out, "\nrestarting the following units:")
         assert_lacks(out, "\nstarting the following units:")
         assert_lacks(out, "the following new units were started:")
-        assert_lacks(out, "as well:")
         # It changed
         out = machine.succeed("mount | grep 'on /testmount'")
         assert_contains(out, "size=10240k")
@@ -700,11 +812,11 @@ import ./make-test-python.nix ({ pkgs, ...} : {
         assert_contains(out, "OnCalendar=2014-03-25 02:59:56 UTC")
         out = switch_to_specialisation("${machine}", "timerModified")
         assert_lacks(out, "stopping the following units:")
+        assert_lacks(out, "NOT restarting the following units:")
         assert_lacks(out, "reloading the following units:")
-        assert_contains(out, "restarting the following units: test-timer.timer\n")
+        assert_contains(out, "\nrestarting the following units: test-timer.timer\n")
         assert_lacks(out, "\nstarting the following units:")
         assert_lacks(out, "the following new units were started:")
-        assert_lacks(out, "as well:")
         # It changed
         out = machine.succeed("systemctl show test-timer.timer")
         assert_contains(out, "OnCalendar=Fri 2012-11-23 16:00:00")
@@ -716,8 +828,7 @@ import ./make-test-python.nix ({ pkgs, ...} : {
         assert_lacks(out, "reloading the following units:")
         assert_lacks(out, "\nrestarting the following units:")
         assert_lacks(out, "\nstarting the following units:")
-        assert_contains(out, "the following new units were started: test-watch.path")
-        assert_lacks(out, "as well:")
+        assert_contains(out, "the following new units were started: test-watch.path\n")
         machine.fail("test -f /testpath-modified")
 
         # touch the file, unit should be triggered
@@ -739,8 +850,21 @@ import ./make-test-python.nix ({ pkgs, ...} : {
     with subtest("slices"):
         machine.succeed("echo 0 > /proc/sys/vm/panic_on_oom")  # allow OOMing
         out = switch_to_specialisation("${machine}", "slice")
+        # assert_lacks(out, "stopping the following units:") not relevant
+        assert_lacks(out, "NOT restarting the following changed units:")
+        assert_lacks(out, "reloading the following units:")
+        assert_lacks(out, "\nrestarting the following units:")
+        assert_lacks(out, "\nstarting the following units:")
+        assert_lacks(out, "the following new units were started:")
         machine.fail("systemctl start testservice.service")
+
         out = switch_to_specialisation("${machine}", "sliceModified")
+        assert_lacks(out, "stopping the following units:")
+        assert_lacks(out, "NOT restarting the following changed units:")
+        assert_lacks(out, "reloading the following units:")
+        assert_lacks(out, "\nrestarting the following units:")
+        assert_lacks(out, "\nstarting the following units:")
+        assert_lacks(out, "the following new units were started:")
         machine.succeed("systemctl start testservice.service")
         machine.succeed("echo 1 > /proc/sys/vm/panic_on_oom")  # disallow OOMing
   '';
diff --git a/pkgs/applications/audio/cardinal/default.nix b/pkgs/applications/audio/cardinal/default.nix
new file mode 100644
index 000000000000..9200a36f9f34
--- /dev/null
+++ b/pkgs/applications/audio/cardinal/default.nix
@@ -0,0 +1,76 @@
+{
+  stdenv
+, fetchFromGitHub
+, fetchpatch
+, fetchurl
+, fetchzip
+, freetype
+, jansson
+, lib
+, libGL
+, libX11
+, libXcursor
+, libXext
+, libXrandr
+, libarchive
+, liblo
+, libsamplerate
+, mesa
+, pkg-config
+, python3
+, speexdsp
+}:
+
+stdenv.mkDerivation rec {
+  name = "cardinal-${version}";
+  version = "22.02";
+
+  src = fetchurl {
+    url =
+      "https://github.com/DISTRHO/Cardinal/releases/download/${version}/cardinal-${version}.tar.xz";
+    sha256 = "sha256-IVlAROFGFffTEU00NCmv74w1DRb7dNMp20FeBVoDrdM=";
+  };
+
+  patches = [
+    # see https://github.com/DISTRHO/Cardinal/issues/151#issuecomment-1041886260
+    (fetchpatch {
+      url =
+        "https://github.com/DISTRHO/Cardinal/commit/13e9ef37c5dd35d77a54b1cb006767be7a72ac69.patch";
+      sha256 = "sha256-NYUYLbLeBX1WEzjPi0s/T1N+EXQKyi0ifbPxgBYDjRs=";
+    })
+  ];
+
+  prePatch = ''
+    patchShebangs ./dpf/utils/generate-ttl.sh
+  '';
+
+  enableParallelBuilding = true;
+
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [
+    freetype
+    jansson
+    libGL
+    libX11
+    libXcursor
+    libXext
+    libXrandr
+    libXrandr
+    libarchive
+    liblo
+    libsamplerate
+    mesa
+    python3
+    speexdsp
+  ];
+
+  makeFlags = [ "SYSDEPS=true" "PREFIX=$(out)" ];
+
+  meta = {
+    description = "Plugin wrapper around VCV Rack";
+    homepage = "https://github.com/DISTRHO/cardinal";
+    license = lib.licenses.gpl3;
+    maintainers = [ lib.maintainers.magnetophon ];
+    platforms = lib.platforms.all;
+  };
+}
diff --git a/pkgs/applications/audio/vmpk/default.nix b/pkgs/applications/audio/vmpk/default.nix
index a68ed3ceae5d..ff9b6c679aae 100644
--- a/pkgs/applications/audio/vmpk/default.nix
+++ b/pkgs/applications/audio/vmpk/default.nix
@@ -5,11 +5,11 @@
 
 mkDerivation rec {
   pname = "vmpk";
-  version = "0.8.5";
+  version = "0.8.6";
 
   src = fetchurl {
     url = "mirror://sourceforge/${pname}/${version}/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-SPome4UKGOWQLT9RMoGZ0wUdwodG8mSIaGFCg0i5CmY=";
+    sha256 = "sha256-cwfJJVeUokyZI1iGvqBvXjcBR36VGodzrUx5Atv3POM=";
   };
 
   nativeBuildInputs = [ cmake pkg-config qttools docbook-xsl-nons ];
diff --git a/pkgs/applications/blockchains/elements/default.nix b/pkgs/applications/blockchains/elements/default.nix
index 6c8d895e03a4..be124d6f34d3 100644
--- a/pkgs/applications/blockchains/elements/default.nix
+++ b/pkgs/applications/blockchains/elements/default.nix
@@ -24,13 +24,13 @@
 with lib;
 stdenv.mkDerivation rec {
   pname = if withGui then "elements" else "elementsd";
-  version = "0.21.0.1";
+  version = "0.21.0.2";
 
   src = fetchFromGitHub {
     owner = "ElementsProject";
     repo = "elements";
     rev = "elements-${version}";
-    sha256 = "sha256-nZa5doiFQJhtK8cUUISTZhS61HzW7CMB9pPsWKc8Gac=";
+    sha256 = "sha256-5b3wylp9Z2U0ueu2gI9jGeWiiJoddjcjQ/6zkFATyvA=";
   };
 
   nativeBuildInputs =
diff --git a/pkgs/applications/editors/vim/macvim.nix b/pkgs/applications/editors/vim/macvim.nix
index c71f057fe0f8..806e2f9d4fd0 100644
--- a/pkgs/applications/editors/vim/macvim.nix
+++ b/pkgs/applications/editors/vim/macvim.nix
@@ -27,13 +27,13 @@ in
 stdenv.mkDerivation {
   pname = "macvim";
 
-  version = "8.2.1719";
+  version = "8.2.3455";
 
   src = fetchFromGitHub {
     owner = "macvim-dev";
     repo = "macvim";
-    rev = "snapshot-166";
-    sha256 = "1p51q59l1dl5lnf1ms960lm8zfg39p8xq0pdjw6wdyypjj3r8v3v";
+    rev = "snapshot-172";
+    sha256 = "sha256-LLLQ/V1vyKTuSXzHW3SOlOejZD5AV16NthEdMoTnfko=";
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/applications/editors/vim/macvim.patch b/pkgs/applications/editors/vim/macvim.patch
index 49354aa9a8d1..6af3e384a63c 100644
--- a/pkgs/applications/editors/vim/macvim.patch
+++ b/pkgs/applications/editors/vim/macvim.patch
@@ -1,10 +1,10 @@
 diff --git a/src/MacVim/vimrc b/src/MacVim/vimrc
-index af43549..dfb10fe 100644
+index 32c89b387..c2af70127 100644
 --- a/src/MacVim/vimrc
 +++ b/src/MacVim/vimrc
-@@ -14,35 +14,5 @@ set backspace+=indent,eol,start
- " translated to English).
- set langmenu=none
+@@ -9,35 +9,5 @@ set nocompatible
+ " more sensible value.  Add "set backspace&" to your ~/.vimrc to reset it.
+ set backspace+=indent,eol,start
  
 -" Python2
 -" MacVim is configured by default to use the pre-installed System python2
@@ -29,22 +29,22 @@ index af43549..dfb10fe 100644
 -" or an installation from python.org:
 -if exists("&pythonthreedll") && exists("&pythonthreehome") &&
 -      \ !filereadable(&pythonthreedll)
--  if filereadable("/opt/local/Library/Frameworks/Python.framework/Versions/3.8/Python")
--    " MacPorts python 3.8
--    set pythonthreedll=/opt/local/Library/Frameworks/Python.framework/Versions/3.8/Python
--  elseif filereadable("/Library/Frameworks/Python.framework/Versions/3.8/Python")
+-  if filereadable("/opt/local/Library/Frameworks/Python.framework/Versions/3.9/Python")
+-    " MacPorts python 3.9
+-    set pythonthreedll=/opt/local/Library/Frameworks/Python.framework/Versions/3.9/Python
+-  elseif filereadable("/Library/Frameworks/Python.framework/Versions/3.9/Python")
 -    " https://www.python.org/downloads/mac-osx/
--    set pythonthreedll=/Library/Frameworks/Python.framework/Versions/3.8/Python
+-    set pythonthreedll=/Library/Frameworks/Python.framework/Versions/3.9/Python
 -  endif
 -endif
 -
 +" Default cscopeprg to the Nix-installed path
 +set cscopeprg=@CSCOPE@
 diff --git a/src/Makefile b/src/Makefile
-index fd2d5e1..37a6d6a 100644
+index c4a3ada37..06ee3de44 100644
 --- a/src/Makefile
 +++ b/src/Makefile
-@@ -1397,7 +1397,7 @@ MACVIMGUI_SRC	= gui.c gui_beval.c MacVim/gui_macvim.m MacVim/MMBackend.m \
+@@ -1402,7 +1402,7 @@ MACVIMGUI_SRC	= gui.c gui_beval.c MacVim/gui_macvim.m MacVim/MMBackend.m \
  		  MacVim/MacVim.m
  MACVIMGUI_OBJ	= objects/gui.o objects/gui_beval.o \
  		  objects/gui_macvim.o objects/MMBackend.o objects/MacVim.o
@@ -52,12 +52,12 @@ index fd2d5e1..37a6d6a 100644
 +MACVIMGUI_DEFS	= -DMACOS_X_DARWIN -DFEAT_GUI_MACVIM -Wall -Wno-unknown-pragmas -pipe
  MACVIMGUI_IPATH	=
  MACVIMGUI_LIBS_DIR =
- MACVIMGUI_LIBS1	= -framework Cocoa -framework Carbon
+ MACVIMGUI_LIBS1	=
 diff --git a/src/auto/configure b/src/auto/configure
-index 06257a5..68437df 100755
+index 39ef81449..d8fa7ec2f 100755
 --- a/src/auto/configure
 +++ b/src/auto/configure
-@@ -5872,10 +5872,7 @@ $as_echo "not found" >&6; }
+@@ -5896,10 +5896,7 @@ $as_echo "not found" >&6; }
  
      for path in "${vi_cv_path_mzscheme_pfx}/lib" "${SCHEME_LIB}"; do
        if test "X$path" != "X"; then
@@ -69,7 +69,7 @@ index 06257a5..68437df 100755
  	  MZSCHEME_LIBS="${path}/libmzscheme3m.a"
  	  MZSCHEME_CFLAGS="-DMZ_PRECISE_GC"
  	elif test -f "${path}/libracket3m.a"; then
-@@ -6260,23 +6257,6 @@ $as_echo ">>> too old; need Perl version 5.003_01 or later <<<" >&6; }
+@@ -6287,23 +6284,6 @@ $as_echo ">>> too old; need Perl version 5.003_01 or later <<<" >&6; }
    fi
  
    if test "x$MACOS_X" = "xyes"; then
@@ -93,7 +93,7 @@ index 06257a5..68437df 100755
                  PERL_LIBS=`echo "$PERL_LIBS" | sed -e 's/-arch\ ppc//' -e 's/-arch\ i386//' -e 's/-arch\ x86_64//'`
      PERL_CFLAGS=`echo "$PERL_CFLAGS" | sed -e 's/-arch\ ppc//' -e 's/-arch\ i386//' -e 's/-arch\ x86_64//'`
    fi
-@@ -6499,13 +6479,7 @@ __:
+@@ -6526,13 +6506,6 @@ __:
  eof
  	    	    eval "`cd ${PYTHON_CONFDIR} && make -f "${tmp_mkf}" __ | sed '/ directory /d'`"
  	    rm -f -- "${tmp_mkf}"
@@ -104,11 +104,10 @@ index 06257a5..68437df 100755
 -		  vi_cv_path_python_plibs="-F${python_PYTHONFRAMEWORKPREFIX} -framework Python"
 -	      fi
 -	    else
-+
  	      vi_cv_path_python_plibs="-L${PYTHON_CONFDIR} -lpython${vi_cv_var_python_version}"
  	      	      	      	      if test -n "${python_LINKFORSHARED}" && test -n "${python_PYTHONFRAMEWORKPREFIX}"; then
  	        python_link_symbol=`echo ${python_LINKFORSHARED} | sed 's/\([^ \t][^ \t]*[ \t][ \t]*[^ \t][^ \t]*\)[ \t].*/\1/'`
-@@ -6520,7 +6494,6 @@ eof
+@@ -6547,7 +6520,6 @@ eof
  	      fi
  	      vi_cv_path_python_plibs="${vi_cv_path_python_plibs} ${python_BASEMODLIBS} ${python_LIBS} ${python_SYSLIBS} ${python_LINKFORSHARED}"
  	      	      vi_cv_path_python_plibs=`echo $vi_cv_path_python_plibs | sed s/-ltermcap//`
@@ -116,7 +115,7 @@ index 06257a5..68437df 100755
  
  fi
  
-@@ -6599,13 +6572,6 @@ rm -f core conftest.err conftest.$ac_objext \
+@@ -6626,13 +6598,6 @@ rm -f core conftest.err conftest.$ac_objext \
  $as_echo "no" >&6; }
  	fi
  
@@ -130,7 +129,7 @@ index 06257a5..68437df 100755
  			{ $as_echo "$as_me:${as_lineno-$LINENO}: checking if compile and link flags for Python are sane" >&5
  $as_echo_n "checking if compile and link flags for Python are sane... " >&6; }
  	cflags_save=$CFLAGS
-@@ -7499,11 +7465,7 @@ $as_echo "$tclver - OK" >&6; };
+@@ -7557,11 +7522,7 @@ $as_echo "$tclver - OK" >&6; };
  
        { $as_echo "$as_me:${as_lineno-$LINENO}: checking for location of Tcl include" >&5
  $as_echo_n "checking for location of Tcl include... " >&6; }
@@ -142,7 +141,7 @@ index 06257a5..68437df 100755
        TCL_INC=
        for try in $tclinc; do
  	if test -f "$try/tcl.h"; then
-@@ -7521,13 +7483,8 @@ $as_echo "<not found>" >&6; }
+@@ -7579,13 +7540,8 @@ $as_echo "<not found>" >&6; }
        if test -z "$SKIP_TCL"; then
  	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for location of tclConfig.sh script" >&5
  $as_echo_n "checking for location of tclConfig.sh script... " >&6; }
@@ -156,9 +155,9 @@ index 06257a5..68437df 100755
  	for try in $tclcnf; do
  	  if test -f "$try/tclConfig.sh"; then
  	    { $as_echo "$as_me:${as_lineno-$LINENO}: result: $try/tclConfig.sh" >&5
-@@ -7717,10 +7674,6 @@ $as_echo "$rubyhdrdir" >&6; }
- 	if test -f "$rubylibdir/$librubya"; then
- 	  librubyarg="$librubyarg"
+@@ -7774,10 +7730,6 @@ $as_echo "$rubyhdrdir" >&6; }
+ 	rubylibdir=`$vi_cv_path_ruby -r rbconfig -e "print $ruby_rbconfig.expand($ruby_rbconfig::CONFIG['libdir'])"`
+ 	if test -f "$rubylibdir/$librubya" || expr "$librubyarg" : "-lruby"; then
  	  RUBY_LIBS="$RUBY_LIBS -L$rubylibdir"
 -        elif test "$vi_cv_path_ruby" = "/usr/bin/ruby" -a -d "/System/Library/Frameworks/Ruby.framework"; then
 -                        RUBY_LIBS="-framework Ruby"
@@ -168,7 +167,7 @@ index 06257a5..68437df 100755
  
  	if test "X$librubyarg" != "X"; then
 diff --git a/src/vim.h b/src/vim.h
-index bbc01ee..5a93591 100644
+index 4ff59f201..f91cb9836 100644
 --- a/src/vim.h
 +++ b/src/vim.h
 @@ -244,17 +244,6 @@
@@ -190,15 +189,14 @@ index bbc01ee..5a93591 100644
  # include "os_amiga.h"
  #endif
 diff --git a/src/vimtutor b/src/vimtutor
-index 1e8769b..47078b0 100755
+index 3b154f288..e89f26060 100755
 --- a/src/vimtutor
 +++ b/src/vimtutor
-@@ -16,7 +16,7 @@ seq="vim vim81 vim80 vim8 vim74 vim73 vim72 vim71 vim70 vim7 vim6 vi"
- if test "$1" = "-g"; then 
-   # Try to use the GUI version of Vim if possible, it will fall back
-   # on Vim if Gvim is not installed.
--  seq="gvim gvim81 gvim80 gvim8 gvim74 gvim73 gvim72 gvim71 gvim70 gvim7 gvim6 $seq"
-+  seq="mvim gvim gvim81 gvim80 gvim8 gvim74 gvim73 gvim72 gvim71 gvim70 gvim7 gvim6 $seq"
-   shift
+@@ -16,6 +16,6 @@ seq="vim vim81 vim80 vim8 vim74 vim73 vim72 vim71 vim70 vim7 vim6 vi"
+ if test "$1" = "-g"; then
+     # Try to use the GUI version of Vim if possible, it will fall back
+     # on Vim if Gvim is not installed.
+-    seq="gvim gvim81 gvim80 gvim8 gvim74 gvim73 gvim72 gvim71 gvim70 gvim7 gvim6 $seq"
++    seq="mvim gvim gvim81 gvim80 gvim8 gvim74 gvim73 gvim72 gvim71 gvim70 gvim7 gvim6 $seq"
+     shift
  fi
- 
diff --git a/pkgs/applications/editors/vim/plugins/overrides.nix b/pkgs/applications/editors/vim/plugins/overrides.nix
index 059622495731..bb8e6a50cf73 100644
--- a/pkgs/applications/editors/vim/plugins/overrides.nix
+++ b/pkgs/applications/editors/vim/plugins/overrides.nix
@@ -820,7 +820,7 @@ self: super: {
             libiconv
           ];
 
-          cargoSha256 = "sha256-JKi51kzCHMctUX6tT8K2Rq1slV3Ek67dCgbPjBkwPTE=";
+          cargoSha256 = "12xaxpg4ws09rnp9prrqcac8581ggr36mpy39xyfngjy5xvcalaq";
         };
       in
       ''
diff --git a/pkgs/applications/editors/vscode/vscode.nix b/pkgs/applications/editors/vscode/vscode.nix
index 496dbe2496d1..5e8337f6b0ed 100644
--- a/pkgs/applications/editors/vscode/vscode.nix
+++ b/pkgs/applications/editors/vscode/vscode.nix
@@ -14,17 +14,17 @@ let
   archive_fmt = if stdenv.isDarwin then "zip" else "tar.gz";
 
   sha256 = {
-    x86_64-linux = "0gv71l9cidkbbv7b1dsfyn7lnlwcmjds9qx6nrh7alymdm1xa2xr";
-    x86_64-darwin = "1is795040xb3l23crblwf056wsvsi4dip3lkwhlblhkpsl0048f1";
-    aarch64-linux = "186dy6h3krc6fqvmh1nay1dk5109kl9p25kx37jkbzf2qhnpibm8";
-    aarch64-darwin = "04xc5fy4wcplfrigbm624dpzxd2m4rkq979xr1i57p3d20i96s6g";
-    armv7l-linux = "1k7bfmrfw16zpn33p7ycxpp6g9xh8aypmf61nrkx2jn99nxy5d3s";
+    x86_64-linux = "04lyih67vcf2hficvlv1r25k8k48n9x15sbqrfp1syzhy5i4zch3";
+    x86_64-darwin = "0460mh1ah9hswn8ihais5hzvz453r36ay2bb3hy3z1grfs3s5blk";
+    aarch64-linux = "1db2r4ja0srya2lw900l4mk24xva00kf7vxajcb7q0rab4cpfr3n";
+    aarch64-darwin = "04c43ibbarsqdm1wcsmsi9rnfsl3lyq638d3j0dj94xifk0v61j9";
+    armv7l-linux = "1qzi2biy5mjbxdgcakzmid68ykq6vrgj4lqmz0jk3g46r4kpnrgd";
   }.${system};
 in
   callPackage ./generic.nix rec {
     # Please backport all compatible updates to the stable release.
     # This is important for the extension ecosystem.
-    version = "1.64.2";
+    version = "1.65.0";
     pname = "vscode";
 
     executableName = "code" + lib.optionalString isInsiders "-insiders";
diff --git a/pkgs/applications/editors/vscode/vscodium.nix b/pkgs/applications/editors/vscode/vscodium.nix
index b1ab8c57ee8b..39c04314af08 100644
--- a/pkgs/applications/editors/vscode/vscodium.nix
+++ b/pkgs/applications/editors/vscode/vscodium.nix
@@ -13,10 +13,10 @@ let
   archive_fmt = if system == "x86_64-darwin" then "zip" else "tar.gz";
 
   sha256 = {
-    x86_64-linux = "0ldfp4r7nb9npvjadgj63sd369nqmbgf5y4kpp93slsy1lbs0bk8";
-    x86_64-darwin = "05z0jx2cc1askzzdxa8vxj8gp0v9rm1jw6005bpmijvyb8s2d30w";
-    aarch64-linux = "1a5fyxzz51rb0af0wv3xh2h87yq00y5k501p7idqhj0zvd5mpqh6";
-    armv7l-linux = "05byi0aba516whzry5qkxfkm82sy2dgv1m0hyycmnkb2dwmb552m";
+    x86_64-linux = "0a38bjkksna7q2lhcm1hgfn189jw3k8svw0jf591bpq7jvknim1v";
+    x86_64-darwin = "173rhavczm0k9qgrlz68rdvwsmy3ynq2g14shx9gipchr1i0rih5";
+    aarch64-linux = "00xkhwvxmyiyy9k1vh23sqyib584qafzs1m57xraqq3n8098jrng";
+    armv7l-linux = "0lqq54hnv4b1m47cya7196cn00jwslcsh5ykicgq0dxljrcawi0y";
   }.${system};
 
   sourceRoot = {
@@ -31,7 +31,7 @@ in
 
     # Please backport all compatible updates to the stable release.
     # This is important for the extension ecosystem.
-    version = "1.64.2";
+    version = "1.65.0";
     pname = "vscodium";
 
     executableName = "codium";
diff --git a/pkgs/applications/misc/avizo/default.nix b/pkgs/applications/misc/avizo/default.nix
index 7325e29f682b..d4808829586b 100644
--- a/pkgs/applications/misc/avizo/default.nix
+++ b/pkgs/applications/misc/avizo/default.nix
@@ -7,26 +7,19 @@
 
 stdenv.mkDerivation rec {
   pname = "avizo";
-  # Note: remove the 'use-sysconfig' patch on the next update
-  version = "1.1";
+  version = "1.2";
 
   src = fetchFromGitHub {
     owner = "misterdanb";
     repo = "avizo";
     rev = version;
-    sha256 = "sha256-0BJodJ6WaHhuSph2D1AC+DMafctgiSCyaZ8MFn89AA8=";
+    sha256 = "sha256-BRtdCOBFsKkJif/AlnF7N9ZDcmA+878M9lDQld+SAgo=";
   };
 
   nativeBuildInputs = [ meson ninja pkg-config vala gobject-introspection wrapGAppsHook ];
 
   buildInputs = [ dbus dbus-glib gdk-pixbuf glib gtk-layer-shell gtk3 librsvg ];
 
-  patches = [
-    # Remove on next update
-    # See https://github.com/misterdanb/avizo/pull/30
-    ./use-sysconfdir-instead-of-etc.patch
-  ];
-
   postInstall = ''
     substituteInPlace "$out"/bin/volumectl \
       --replace 'avizo-client' "$out/bin/avizo-client"
diff --git a/pkgs/applications/misc/avizo/use-sysconfdir-instead-of-etc.patch b/pkgs/applications/misc/avizo/use-sysconfdir-instead-of-etc.patch
deleted file mode 100644
index 947559760cbc..000000000000
--- a/pkgs/applications/misc/avizo/use-sysconfdir-instead-of-etc.patch
+++ /dev/null
@@ -1,15 +0,0 @@
-diff --git a/meson.build b/meson.build
-index 1c789be..cd4b07a 100644
---- a/meson.build
-+++ b/meson.build
-@@ -12,7 +12,9 @@ app_resources_service = gnome.compile_resources(
-   source_dir : '.',
-   c_name : 'avizo_resources')
- 
--install_data('config.ini', install_dir: '/etc/xdg/avizo')
-+sysconfdir = get_option('sysconfdir')
-+
-+install_data('config.ini', install_dir: join_paths(sysconfdir, 'xdg/avizo'))
- install_data('volumectl', install_dir: 'bin')
- install_data('lightctl', install_dir: 'bin')
- 
diff --git a/pkgs/applications/misc/calibre/default.nix b/pkgs/applications/misc/calibre/default.nix
index 5b3231856482..b3754fed1796 100644
--- a/pkgs/applications/misc/calibre/default.nix
+++ b/pkgs/applications/misc/calibre/default.nix
@@ -96,7 +96,6 @@ mkDerivation rec {
       feedparser
       html2text
       html5-parser
-      jeepney
       lxml
       markdown
       mechanize
diff --git a/pkgs/applications/misc/joplin-desktop/default.nix b/pkgs/applications/misc/joplin-desktop/default.nix
index 2003e0d7e76c..42d87b41fc99 100644
--- a/pkgs/applications/misc/joplin-desktop/default.nix
+++ b/pkgs/applications/misc/joplin-desktop/default.nix
@@ -2,7 +2,7 @@
 
 let
   pname = "joplin-desktop";
-  version = "2.6.10";
+  version = "2.7.13";
   name = "${pname}-${version}";
 
   inherit (stdenv.hostPlatform) system;
@@ -16,8 +16,8 @@ let
   src = fetchurl {
     url = "https://github.com/laurent22/joplin/releases/download/v${version}/Joplin-${version}.${suffix}";
     sha256 = {
-      x86_64-linux = "sha256-2/QYEzQjB9n/4k5I/fry3ol8Fpsb5+tc1ttVdf2ID+4=";
-      x86_64-darwin = "sha256-BwBpq78hYJVUItUgs9lonBTV4YWJ+qvML6VTj5M4BQ4=";
+      x86_64-linux = "sha256-ObuBcFV5fq2sryC+ETTAH+S19EW+nVlxdVOtOpiBeDs=";
+      x86_64-darwin = "sha256-f0+/kUukP+zIzTSSGO1ctUBd/uCSrAKz+uBnrzpPy5k=";
     }.${system} or throwSystem;
   };
 
diff --git a/pkgs/applications/misc/limesctl/default.nix b/pkgs/applications/misc/limesctl/default.nix
index eadd6c8db55a..73c8abaa13fe 100644
--- a/pkgs/applications/misc/limesctl/default.nix
+++ b/pkgs/applications/misc/limesctl/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "limesctl";
-  version = "2.0.1";
+  version = "3.0.0";
 
   src = fetchFromGitHub {
     owner = "sapcc";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-E6LwNiCykBqjkifUSi6oBWqCEhkRO+03HSKn4p45kh0=";
+    sha256 = "sha256-52Tq6gKozM/IFUyAy8N+YDqlbcFNQw6b2tc268Zco6g=";
   };
 
-  vendorSha256 = "sha256-SzgiWqPuDZuSH8I9im8r+06E085PWyHwLjwxcaoJgQo=";
+  vendorSha256 = "sha256-7QEb5J5IaxisKjbulyHq5PGVeKAX022Pz+5OV5qD7Uo=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/applications/misc/logseq/default.nix b/pkgs/applications/misc/logseq/default.nix
index 09e31cd3409f..f4e43a79a8f7 100644
--- a/pkgs/applications/misc/logseq/default.nix
+++ b/pkgs/applications/misc/logseq/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "logseq";
-  version = "0.6.0";
+  version = "0.6.1";
 
   src = fetchurl {
     url = "https://github.com/logseq/logseq/releases/download/${version}/logseq-linux-x64-${version}.AppImage";
-    sha256 = "9u2KdrNVAx+sy/8s2VP0DIzSMTvBK56pUGQaj7wulz0=";
+    sha256 = "ccLqOKH10hmROnxlnNxuD5/AqAcFIILIoW/9yZLEep0=";
     name = "${pname}-${version}.AppImage";
   };
 
diff --git a/pkgs/applications/misc/upwork/default.nix b/pkgs/applications/misc/upwork/default.nix
index 5543b3442bd2..dc50a3b95678 100644
--- a/pkgs/applications/misc/upwork/default.nix
+++ b/pkgs/applications/misc/upwork/default.nix
@@ -6,11 +6,11 @@
 
 stdenv.mkDerivation rec {
   pname = "upwork";
-  version = "5.6.10.0";
+  version = "5.6.10.1";
 
   src = fetchurl {
-    url = "https://upwork-usw2-desktopapp.upwork.com/binaries/v5_6_10_0_b124e6f3a4944b32/${pname}_${version}_amd64.deb";
-    sha256 = "fd201ce817abe32e1b582bb4b55fef85ac8132806f5ddf0548fd25bbfd48833c";
+    url = "https://upwork-usw2-desktopapp.upwork.com/binaries/v5_6_10_1_de501d28cc034306/${pname}_${version}_amd64.deb";
+    sha256 = "8faf896d2570d1d210793f46a3860e934d03498c1f11640d43721b6eb2b56860";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/networking/browsers/chromium/upstream-info.json b/pkgs/applications/networking/browsers/chromium/upstream-info.json
index 155425908e75..9fdb482c4634 100644
--- a/pkgs/applications/networking/browsers/chromium/upstream-info.json
+++ b/pkgs/applications/networking/browsers/chromium/upstream-info.json
@@ -32,15 +32,15 @@
     }
   },
   "dev": {
-    "version": "100.0.4896.20",
-    "sha256": "0g16xzimp39vk5b27bj12rh14520wihj4m4mwxf387rv0yp03cnr",
-    "sha256bin64": "1hyqsqpmhxdja6jzvmq0cwwcg4nq72w0zdpa0xh24n5g4cd9xz04",
+    "version": "101.0.4919.0",
+    "sha256": "01dp3pkpf2m6r6vfyqgcg99xcii0qi3qm0g69r3nnj2hrs7ziqv2",
+    "sha256bin64": "1x7bfcnhrbakcbdyp1sc79jx6qysnnyj1by6qnl7gyffh8xyb95g",
     "deps": {
       "gn": {
-        "version": "2022-01-21",
+        "version": "2022-03-01",
         "url": "https://gn.googlesource.com/gn",
-        "rev": "0725d7827575b239594fbc8fd5192873a1d62f44",
-        "sha256": "1dzdvcn2r5c9giknvasf3y5y4901kav7igivjvrpww66ywsj8fzr"
+        "rev": "d7c2209cebcfe37f46dba7be4e1a7000ffc342fb",
+        "sha256": "0b024mr8bdsnkkd3qkh097a7w0gpicarijnsbpfgkf6imnkccg5w"
       }
     }
   },
diff --git a/pkgs/applications/networking/browsers/lagrange/default.nix b/pkgs/applications/networking/browsers/lagrange/default.nix
index bf370dd6ec0c..00d0bc8f6fd5 100644
--- a/pkgs/applications/networking/browsers/lagrange/default.nix
+++ b/pkgs/applications/networking/browsers/lagrange/default.nix
@@ -19,13 +19,13 @@
 
 stdenv.mkDerivation rec {
   pname = "lagrange";
-  version = "1.10.6";
+  version = "1.11.1";
 
   src = fetchFromGitHub {
     owner = "skyjake";
     repo = "lagrange";
     rev = "v${version}";
-    sha256 = "sha256-N4NB4lfWIN+jreAuaaGKRdpgwHy2CKrPrGxu1iSCZyU=";
+    sha256 = "sha256-RrdD+G8DKOBm0TpmRQg1uMGNFAlAADFeK3h6oyo5RZ4=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/applications/networking/cluster/fluxcd/default.nix b/pkgs/applications/networking/cluster/fluxcd/default.nix
index be22e1f534dd..a583bf308954 100644
--- a/pkgs/applications/networking/cluster/fluxcd/default.nix
+++ b/pkgs/applications/networking/cluster/fluxcd/default.nix
@@ -1,9 +1,9 @@
 { lib, buildGoModule, fetchFromGitHub, fetchzip, installShellFiles }:
 
 let
-  version = "0.27.2";
-  sha256 = "0rdsc9i8mjiwyb6l9sbhxirl4i3b50m6505wwvhxz4y5arzdi1k6";
-  manifestsSha256 = "0h966xqjkvrblxd62iph9vwr2h7w1ig943hi5vg0swy4674v3ybf";
+  version = "0.27.3";
+  sha256 = "08ax1033456hfm5qz0r671xm5ig0047nqp7xffyn9za498bm4i5q";
+  manifestsSha256 = "165kspq10nvlihcb1460qmbw5r1mlzs5gliw01qa4mymvzmlggk7";
 
   manifests = fetchzip {
     url =
@@ -23,7 +23,7 @@ in buildGoModule rec {
     inherit sha256;
   };
 
-  vendorSha256 = "sha256-xkhbGID+oI7+kLml8CveEet7gtPSty8LGv1gkqpqg6w=";
+  vendorSha256 = "sha256-ENSfec7iSKOkILgVCVnORpAia4D+vBjQAUXDA7EIvVQ=";
 
   postUnpack = ''
     cp -r ${manifests} source/cmd/flux/manifests
diff --git a/pkgs/applications/networking/instant-messengers/cinny/default.nix b/pkgs/applications/networking/instant-messengers/cinny/default.nix
index 4c8f356cdf47..c46c19896d5e 100644
--- a/pkgs/applications/networking/instant-messengers/cinny/default.nix
+++ b/pkgs/applications/networking/instant-messengers/cinny/default.nix
@@ -4,11 +4,11 @@ let
   configOverrides = writeText "cinny-config-overrides.json" (builtins.toJSON conf);
 in stdenv.mkDerivation rec {
   pname = "cinny";
-  version = "1.6.1";
+  version = "1.7.0";
 
   src = fetchurl {
     url = "https://github.com/ajbura/cinny/releases/download/v${version}/cinny-v${version}.tar.gz";
-    sha256 = "sha256-RJpLK16bedpqo/JJf3atpiuL5spHJNowomcusjZtEWA=";
+    sha256 = "0133dbzxy0n0i6bn2p3lx33kpabnf9kzs9mv4xws30hbns25q99k";
   };
 
   installPhase = ''
diff --git a/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix b/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
index 9cc4e057995b..6d1bb0af147f 100644
--- a/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
@@ -4,7 +4,7 @@
 , libXext, libXfixes, libXrender, libXtst, libXScrnSaver, nss, nspr, alsa-lib
 , cups, expat, libuuid, at-spi2-core, libappindicator-gtk3, mesa
 # Runtime dependencies:
-, systemd, libnotify, libdbusmenu, libpulseaudio
+, systemd, libnotify, libdbusmenu, libpulseaudio, xdg-utils
 # Unfortunately this also overwrites the UI language (not just the spell
 # checking language!):
 , hunspellDicts, spellcheckerLanguage ? null # E.g. "de_DE"
@@ -84,6 +84,7 @@ in stdenv.mkDerivation rec {
     (lib.getLib systemd)
     libnotify
     libdbusmenu
+    xdg-utils
   ];
 
   unpackPhase = "dpkg-deb -x $src .";
@@ -123,6 +124,7 @@ in stdenv.mkDerivation rec {
       --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [ stdenv.cc.cc ] }"
       ${customLanguageWrapperArgs}
       --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--enable-features=UseOzonePlatform --ozone-platform=wayland}}"
+      --suffix PATH : ${lib.makeBinPath [ xdg-utils ]}
     )
 
     # Fix the desktop link
diff --git a/pkgs/applications/networking/instant-messengers/skypeforlinux/default.nix b/pkgs/applications/networking/instant-messengers/skypeforlinux/default.nix
index 4fc3d56baccf..b23f4f107aed 100644
--- a/pkgs/applications/networking/instant-messengers/skypeforlinux/default.nix
+++ b/pkgs/applications/networking/instant-messengers/skypeforlinux/default.nix
@@ -7,7 +7,7 @@ let
 
   # Please keep the version x.y.0.z and do not update to x.y.76.z because the
   # source of the latter disappears much faster.
-  version = "8.80.0.143";
+  version = "8.81.0.268";
 
   rpath = lib.makeLibraryPath [
     alsa-lib
@@ -68,7 +68,7 @@ let
           "https://mirror.cs.uchicago.edu/skype/pool/main/s/skypeforlinux/skypeforlinux_${version}_amd64.deb"
           "https://web.archive.org/web/https://repo.skype.com/deb/pool/main/s/skypeforlinux/skypeforlinux_${version}_amd64.deb"
         ];
-        sha256 = "sha256-SLypP+ZRHMWeB3KuvmmYb0Y1T3ipSpWNiYYQIzMCDDY=";
+        sha256 = "sha256-MqXLK+AdYkQVTeTjul9Dru78597FuThRUVq7/y9FYUU=";
       }
     else
       throw "Skype for linux is not supported on ${stdenv.hostPlatform.system}";
diff --git a/pkgs/applications/networking/instant-messengers/vk-messenger/default.nix b/pkgs/applications/networking/instant-messengers/vk-messenger/default.nix
index 51b119aa6de5..5fb0f14f36a0 100644
--- a/pkgs/applications/networking/instant-messengers/vk-messenger/default.nix
+++ b/pkgs/applications/networking/instant-messengers/vk-messenger/default.nix
@@ -4,20 +4,20 @@
 
 let
   pname = "vk-messenger";
-  version = "5.2.3";
+  version = "5.3.2";
 
   src = {
     i686-linux = fetchurl {
       url = "https://desktop.userapi.com/rpm/master/vk-${version}.i686.rpm";
-      sha256 = "09zi2rzsank6lhw1z9yar1rp634y6qskvr2i0rvqg2fij7cy6w19";
+      sha256 = "L0nE0zW4LP8udcE8uPy+cH9lLuQsUSq7cF13Gv7w2rI=";
     };
     x86_64-linux = fetchurl {
       url = "https://desktop.userapi.com/rpm/master/vk-${version}.x86_64.rpm";
-      sha256 = "1m6saanpv1k5wc5s58jpf0wsgjsj7haabx8nycm1fjyhky1chirb";
+      sha256 = "spDw9cfDSlIuCwOqREsqXC19tx62TiAz9fjIS9lYjSQ=";
     };
     x86_64-darwin = fetchurl {
-      url = "https://web.archive.org/web/20210310071550/https://desktop.userapi.com/mac/master/vk.dmg";
-      sha256 = "0j5qsr0fyl55d0x46xm4h2ykwr4y9z1dsllhqx5lnc15nc051s9b";
+      url = "https://web.archive.org/web/20220302083827/https://desktop.userapi.com/mac/master/vk.dmg";
+      sha256 = "hxK8I9sF6njfCxSs1KBCHfnG81JGKUgHKAeFLtuCNe0=";
     };
   }.${stdenv.system} or (throw "Unsupported system: ${stdenv.system}");
 
diff --git a/pkgs/applications/office/jameica/default.nix b/pkgs/applications/office/jameica/default.nix
index 9ef7afcf958b..767a4202ae86 100644
--- a/pkgs/applications/office/jameica/default.nix
+++ b/pkgs/applications/office/jameica/default.nix
@@ -17,6 +17,7 @@ let
     comment = "Free Runtime Environment for Java Applications.";
     desktopName = "Jameica";
     genericName = "Jameica";
+    icon = "jameica";
     categories = [ "Office" ];
   };
 in
diff --git a/pkgs/applications/science/biology/angsd/default.nix b/pkgs/applications/science/biology/angsd/default.nix
new file mode 100644
index 000000000000..02e00cd19ad6
--- /dev/null
+++ b/pkgs/applications/science/biology/angsd/default.nix
@@ -0,0 +1,25 @@
+{ lib, stdenv, fetchFromGitHub, htslib, zlib, bzip2, xz, curl, openssl }:
+
+stdenv.mkDerivation rec {
+  pname = "angsd";
+  version = "0.937";
+
+  src = fetchFromGitHub {
+    owner = "ANGSD";
+    repo = "angsd";
+    sha256 = "1020gh066dprqhfi90ywqzqqnq7awn49wrkkjnizmmab52v00kxs";
+    rev = "${version}";
+  };
+
+  buildInputs = [ htslib zlib bzip2 xz curl openssl ];
+
+  makeFlags = [ "HTSSRC=systemwide" "prefix=$(out)" ];
+
+  meta = with lib; {
+    description = "Program for analysing NGS data";
+    homepage = "http://www.popgen.dk/angsd";
+    maintainers = [ maintainers.bzizou ];
+    license = licenses.gpl2;
+  };
+}
+
diff --git a/pkgs/applications/science/biology/minimap2/default.nix b/pkgs/applications/science/biology/minimap2/default.nix
index bba8a02b76e3..7e162e2d27c6 100644
--- a/pkgs/applications/science/biology/minimap2/default.nix
+++ b/pkgs/applications/science/biology/minimap2/default.nix
@@ -13,6 +13,8 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ zlib ];
 
+  makeFlags = lib.optionals stdenv.isAarch64 [ "arm_neon=1" "aarch64=1" ];
+
   installPhase = ''
     mkdir -p $out/bin
     cp minimap2 $out/bin
@@ -25,7 +27,6 @@ stdenv.mkDerivation rec {
     homepage = "https://lh3.github.io/minimap2";
     license = licenses.mit;
     platforms = platforms.all;
-    badPlatforms = platforms.aarch64;
     maintainers = [ maintainers.arcadio ];
   };
 }
diff --git a/pkgs/applications/science/chemistry/jmol/default.nix b/pkgs/applications/science/chemistry/jmol/default.nix
index cc983e24618f..5860279d56ec 100644
--- a/pkgs/applications/science/chemistry/jmol/default.nix
+++ b/pkgs/applications/science/chemistry/jmol/default.nix
@@ -25,14 +25,14 @@ let
   };
 in
 stdenv.mkDerivation rec {
-  version = "14.32.24";
+  version = "14.32.28";
   pname = "jmol";
 
   src = let
     baseVersion = "${lib.versions.major version}.${lib.versions.minor version}";
   in fetchurl {
     url = "mirror://sourceforge/jmol/Jmol/Version%20${baseVersion}/Jmol%20${version}/Jmol-${version}-binary.tar.gz";
-    sha256 = "sha256-YxYNb2fS7KiUkZDSRx4FN+ZeMMNpfTaElitRE4RtD0g=";
+    sha256 = "sha256-J5m18pHjm3mbMwmCR1v9ycPNFwJdewp6zP4pxCZ+lF0=";
   };
 
   patchPhase = ''
diff --git a/pkgs/applications/version-management/gitea/default.nix b/pkgs/applications/version-management/gitea/default.nix
index 7da383e325db..37000982d8e4 100644
--- a/pkgs/applications/version-management/gitea/default.nix
+++ b/pkgs/applications/version-management/gitea/default.nix
@@ -16,12 +16,12 @@ with lib;
 
 buildGoPackage rec {
   pname = "gitea";
-  version = "1.16.2";
+  version = "1.16.3";
 
   # not fetching directly from the git repo, because that lacks several vendor files for the web UI
   src = fetchurl {
     url = "https://github.com/go-gitea/gitea/releases/download/v${version}/gitea-src-${version}.tar.gz";
-    sha256 = "sha256-fN7F76TzxBwvUbe2Ha5sfAk6x+FaUDIdx8YaQKfndSU=";
+    sha256 = "sha256-kT87CV/P1MUBLRetzYdIsIGVDjp9F6zmD2ovmcmy4Ys=";
   };
 
   unpackPhase = ''
diff --git a/pkgs/applications/virtualization/podman/default.nix b/pkgs/applications/virtualization/podman/default.nix
index 456141629ea8..7d783b211bbd 100644
--- a/pkgs/applications/virtualization/podman/default.nix
+++ b/pkgs/applications/virtualization/podman/default.nix
@@ -58,6 +58,7 @@ buildGoModule rec {
 
   installPhase = ''
     runHook preInstall
+    mkdir -p {$out/{bin,etc,lib,share},$man} # ensure paths exist for the wrapper
     ${if stdenv.isDarwin then ''
       mv bin/{darwin/podman,podman}
     '' else ''
diff --git a/pkgs/applications/virtualization/qemu/default.nix b/pkgs/applications/virtualization/qemu/default.nix
index 2c220c7d3637..2c2094763cc6 100644
--- a/pkgs/applications/virtualization/qemu/default.nix
+++ b/pkgs/applications/virtualization/qemu/default.nix
@@ -220,6 +220,7 @@ stdenv.mkDerivation rec {
 
   # Add a ‘qemu-kvm’ wrapper for compatibility/convenience.
   postInstall = ''
+    ln -s $out/libexec/virtiofsd $out/bin
     ln -s $out/bin/qemu-system-${stdenv.hostPlatform.qemuArch} $out/bin/qemu-kvm
   '';
 
@@ -240,5 +241,6 @@ stdenv.mkDerivation rec {
     mainProgram = "qemu-kvm";
     maintainers = with maintainers; [ eelco qyliss ];
     platforms = platforms.unix;
+    priority = 10; # Prefer virtiofsd from the virtiofsd package.
   };
 }
diff --git a/pkgs/applications/virtualization/seabios/default.nix b/pkgs/applications/virtualization/seabios/default.nix
index af2c4939ad04..c6442b57a421 100644
--- a/pkgs/applications/virtualization/seabios/default.nix
+++ b/pkgs/applications/virtualization/seabios/default.nix
@@ -1,13 +1,14 @@
-{ lib, stdenv, fetchurl, acpica-tools, python3 }:
+{ lib, stdenv, fetchgit, acpica-tools, python3 }:
 
 stdenv.mkDerivation rec {
 
   pname = "seabios";
-  version = "1.15.0";
+  version = "1.16.0";
 
-  src = fetchurl {
-    url = "https://www.seabios.org/downloads/${pname}-${version}.tar.gz";
-    sha256 = "sha256-YownF8mUMmtFMlFXPRBZ4qOhEtSqSIds4nyz8d4ZiPg=";
+  src = fetchgit {
+    url = "https://git.seabios.org/seabios.git";
+    rev = "rel-${version}";
+    sha256 = "0acal1rr7sya86wlhw2mgimabwhjnr0y1pl5zxwb79j8k1w1r8sh";
   };
 
   nativeBuildInputs = [ python3 ];
@@ -43,7 +44,7 @@ stdenv.mkDerivation rec {
     '';
     homepage = "http://www.seabios.org";
     license = licenses.lgpl3;
-    maintainers = [ maintainers.tstrobel ];
+    maintainers = with maintainers; [ tstrobel ];
     platforms = [ "i686-linux" "x86_64-linux" ];
   };
 }
diff --git a/pkgs/build-support/singularity-tools/default.nix b/pkgs/build-support/singularity-tools/default.nix
index a6a3cd001b4a..46df792bdf6c 100644
--- a/pkgs/build-support/singularity-tools/default.nix
+++ b/pkgs/build-support/singularity-tools/default.nix
@@ -38,7 +38,8 @@ rec {
     contents ? [],
     diskSize ? 1024,
     runScript ? "#!${stdenv.shell}\nexec /bin/sh",
-    runAsRoot ? null
+    runAsRoot ? null,
+    memSize ? 512
   }:
     let layer = mkLayer {
           inherit name;
@@ -54,6 +55,7 @@ rec {
               size = diskSize;
               fullName = "singularity-run-disk";
             };
+            inherit memSize;
           }
           ''
             rm -rf $out
diff --git a/pkgs/data/fonts/sarasa-gothic/default.nix b/pkgs/data/fonts/sarasa-gothic/default.nix
index 17b87ada2275..efd58b348dcd 100644
--- a/pkgs/data/fonts/sarasa-gothic/default.nix
+++ b/pkgs/data/fonts/sarasa-gothic/default.nix
@@ -1,14 +1,14 @@
 { lib, fetchurl, libarchive }:
 
 let
-  version = "0.35.9";
+  version = "0.36.0";
 in fetchurl {
   name = "sarasa-gothic-${version}";
 
   # Use the 'ttc' files here for a smaller closure size.
   # (Using 'ttf' files gives a closure size about 15x larger, as of November 2021.)
   url = "https://github.com/be5invis/Sarasa-Gothic/releases/download/v${version}/sarasa-gothic-ttc-${version}.7z";
-  sha256 = "sha256-zG1VVI7QRQMC4MBA3otD26LUvnkUxaxt6UkiweY0l1w=";
+  sha256 = "sha256-ENBF7dVFp9lrGGRwNIB0Yg7y1F5XbVivgD2e9pLZQwQ=";
 
   recursiveHash = true;
   downloadToTemp = true;
diff --git a/pkgs/data/icons/numix-icon-theme-circle/default.nix b/pkgs/data/icons/numix-icon-theme-circle/default.nix
index 79ca07dd5b5a..2a5d60898bb2 100644
--- a/pkgs/data/icons/numix-icon-theme-circle/default.nix
+++ b/pkgs/data/icons/numix-icon-theme-circle/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "numix-icon-theme-circle";
-  version = "22.02.06";
+  version = "22.03.01";
 
   src = fetchFromGitHub {
     owner = "numixproject";
     repo = pname;
     rev = version;
-    sha256 = "sha256-a+h5DMxVM1TPVx8yuKwRzjjnBLnIWMCCKG+BPg1Hq5Y=";
+    sha256 = "sha256-adSoFKvemirQtxoS6KrQvXxtIOKFZ73PTktVXytblbM=";
   };
 
   nativeBuildInputs = [ gtk3 ];
diff --git a/pkgs/data/icons/numix-icon-theme-square/default.nix b/pkgs/data/icons/numix-icon-theme-square/default.nix
index 550b11c7ac89..d335911c2461 100644
--- a/pkgs/data/icons/numix-icon-theme-square/default.nix
+++ b/pkgs/data/icons/numix-icon-theme-square/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "numix-icon-theme-square";
-  version = "22.02.06";
+  version = "22.03.01";
 
   src = fetchFromGitHub {
     owner = "numixproject";
     repo = pname;
     rev = version;
-    sha256 = "sha256-dKBNB1udRysDe3HbUh2qudQDeLgS/wmSnY3nAWnmjQo=";
+    sha256 = "sha256-VCXHInaxn5BKY9Yth6DjoKa/JS2WVjvwAfRMiL2r1B0=";
   };
 
   nativeBuildInputs = [ gtk3 ];
diff --git a/pkgs/data/icons/papirus-icon-theme/default.nix b/pkgs/data/icons/papirus-icon-theme/default.nix
index 9da7178e80ad..9b0a2537f631 100644
--- a/pkgs/data/icons/papirus-icon-theme/default.nix
+++ b/pkgs/data/icons/papirus-icon-theme/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "papirus-icon-theme";
-  version = "20220204";
+  version = "20220302";
 
   src = fetchFromGitHub {
     owner = "PapirusDevelopmentTeam";
     repo = pname;
     rev = version;
-    sha256 = "sha256-DYz2fnn1ZfX09NQcRXmGTYY95K5wOWhlmJeDjEvN1vY=";
+    sha256 = "sha256-X92an2jGRgZ/Q3cr6Q729DA2hs/2y34HoRpB1rxk0hI=";
   };
 
   nativeBuildInputs = [ gtk3 ];
diff --git a/pkgs/desktops/plasma-5/3rdparty/addons/krunner-ssh.nix b/pkgs/desktops/plasma-5/3rdparty/addons/krunner-ssh.nix
new file mode 100644
index 000000000000..caf3819a3611
--- /dev/null
+++ b/pkgs/desktops/plasma-5/3rdparty/addons/krunner-ssh.nix
@@ -0,0 +1,43 @@
+{ lib, stdenv, fetchFromGitLab, python3 }:
+let
+  pythonEnv = python3.withPackages (p: with p; [ dbus-python pygobject3 ]);
+in
+stdenv.mkDerivation rec {
+  pname = "krunner-ssh";
+  version = "1.0";
+
+  src = fetchFromGitLab {
+    owner = "Programie";
+    repo = "krunner-ssh";
+    rev = version;
+    sha256 = "sha256-rFTTvmetDeN6t0axVc+8t1TRiuyPBpwqhvsq2IFxa/A=";
+  };
+
+  postPatch = ''
+    sed -e "s|Exec=.*|Exec=$out/libexec/runner.py|" -i ssh-runner.service
+  '';
+
+  nativeBuildInputs = [
+    pythonEnv
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    patchShebangs runner.py
+
+    install -m 0755 -D runner.py $out/libexec/runner.py
+    install -m 0755 -D ssh-runner.desktop $out/share/kservices5/ssh-runner.desktop
+    install -m 0755 -D ssh-runner.service $out/share/dbus-1/services/com.selfcoders.ssh-runner.service
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "A simple backend for KRunner providing SSH hosts from your .ssh/known_hosts file as search results";
+    homepage = "https://selfcoders.com/projects/krunner-ssh";
+    license = licenses.mit;
+    maintainers = with maintainers; [ aanderse ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/desktops/plasma-5/default.nix b/pkgs/desktops/plasma-5/default.nix
index 0eafc182e46f..072d999b1a92 100644
--- a/pkgs/desktops/plasma-5/default.nix
+++ b/pkgs/desktops/plasma-5/default.nix
@@ -161,6 +161,7 @@ let
         kwin-dynamic-workspaces = callPackage ./3rdparty/kwin/scripts/dynamic-workspaces.nix { };
         kwin-tiling = callPackage ./3rdparty/kwin/scripts/tiling.nix { };
         krohnkite = callPackage ./3rdparty/kwin/scripts/krohnkite.nix { };
+        krunner-ssh = callPackage ./3rdparty/addons/krunner-ssh.nix { };
         krunner-symbols = callPackage ./3rdparty/addons/krunner-symbols.nix { };
         lightly = callPackage ./3rdparty/lightly { };
         parachute = callPackage ./3rdparty/kwin/scripts/parachute.nix { };
diff --git a/pkgs/development/compilers/cudatoolkit/default.nix b/pkgs/development/compilers/cudatoolkit/default.nix
index a284caffa5d1..6e6b27c2cf7c 100644
--- a/pkgs/development/compilers/cudatoolkit/default.nix
+++ b/pkgs/development/compilers/cudatoolkit/default.nix
@@ -80,9 +80,9 @@ rec {
   };
 
   cudatoolkit_11_6 = common {
-    version = "11.6.0";
-    url = "https://developer.download.nvidia.com/compute/cuda/11.6.0/local_installers/cuda_11.6.0_510.39.01_linux.run";
-    sha256 = "10wcv42ljp7hz1k0wzgwb4hi8834rfipzdc01428c1wpcdnxm0qp";
+    version = "11.6.1";
+    url = "https://developer.download.nvidia.com/compute/cuda/11.6.1/local_installers/cuda_11.6.1_510.47.03_linux.run";
+    sha256 = "sha256-qyGa/OALdCABEyaYZvv/derQN7z8I1UagzjCaEyYTX4=";
     gcc = gcc10; # can bump to 11 along with stdenv.cc
   };
 
diff --git a/pkgs/development/compilers/haxe/default.nix b/pkgs/development/compilers/haxe/default.nix
index d5277899892e..4ac022be6a9f 100644
--- a/pkgs/development/compilers/haxe/default.nix
+++ b/pkgs/development/compilers/haxe/default.nix
@@ -3,7 +3,7 @@
 let
   ocamlDependencies = version:
     if lib.versionAtLeast version "4.2"
-    then with ocaml-ng.ocamlPackages; [
+    then with ocaml-ng.ocamlPackages_4_12; [
       ocaml
       findlib
       sedlex_2
diff --git a/pkgs/development/compilers/reason/default.nix b/pkgs/development/compilers/reason/default.nix
index 0937ff8bd840..4404a5108286 100644
--- a/pkgs/development/compilers/reason/default.nix
+++ b/pkgs/development/compilers/reason/default.nix
@@ -2,6 +2,9 @@
 , fix, menhir, menhirLib, menhirSdk, merlin-extend, ppxlib, utop, cppo, ppx_derivers
 }:
 
+lib.throwIfNot (lib.versionOlder ocaml.version "4.13")
+  "reason is not available for OCaml ${ocaml.version}"
+
 stdenv.mkDerivation rec {
   pname = "ocaml${ocaml.version}-reason";
   version = "3.7.0";
diff --git a/pkgs/development/libraries/arrow-cpp/default.nix b/pkgs/development/libraries/arrow-cpp/default.nix
index 274a35c6ccfb..806df81a7080 100644
--- a/pkgs/development/libraries/arrow-cpp/default.nix
+++ b/pkgs/development/libraries/arrow-cpp/default.nix
@@ -19,7 +19,6 @@
 , grpc
 , gtest
 , jemalloc
-, libnsl
 , lz4
 , minio
 , ninja
@@ -39,7 +38,7 @@
 , zlib
 , zstd
 , enableShared ? !stdenv.hostPlatform.isStatic
-, enableFlight ? !stdenv.isDarwin # libnsl is not supported on darwin
+, enableFlight ? true
 , enableJemalloc ? !(stdenv.isAarch64 && stdenv.isDarwin)
   # boost/process is broken in 1.69 on darwin, but fixed in 1.70 and
   # non-existent in older versions
@@ -129,7 +128,6 @@ stdenv.mkDerivation rec {
     python3.pkgs.numpy
   ] ++ lib.optionals enableFlight [
     grpc
-    libnsl
     openssl
     protobuf
   ] ++ lib.optionals enableS3 [ aws-sdk-cpp openssl ]
diff --git a/pkgs/development/libraries/cmark-gfm/default.nix b/pkgs/development/libraries/cmark-gfm/default.nix
index 7641b6043ef8..599ac2b2e7b0 100644
--- a/pkgs/development/libraries/cmark-gfm/default.nix
+++ b/pkgs/development/libraries/cmark-gfm/default.nix
@@ -1,13 +1,13 @@
 { lib, stdenv, fetchFromGitHub, cmake }:
 stdenv.mkDerivation rec {
   pname = "cmark-gfm";
-  version = "0.29.0.gfm.2";
+  version = "0.29.0.gfm.3";
 
   src = fetchFromGitHub {
     owner = "github";
     repo = "cmark-gfm";
     rev = version;
-    sha256 = "sha256-8PjG87hR66ozKx+PSuKi0vHIoKICHSLdl2cKUYf+5m8=";
+    sha256 = "sha256-V3XegSjqKLCMpfnoYHr9/r5fSC2CC7A2jXkAcHUt7eA=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/expat/default.nix b/pkgs/development/libraries/expat/default.nix
index 322c6ecebbf6..9e913fdf52b4 100644
--- a/pkgs/development/libraries/expat/default.nix
+++ b/pkgs/development/libraries/expat/default.nix
@@ -1,4 +1,13 @@
-{ stdenv, fetchurl, lib }:
+{ lib
+, stdenv
+, fetchurl
+# for passthru.tests
+, python3
+, perlPackages
+, haskellPackages
+, luaPackages
+, ocamlPackages
+}:
 
 # Note: this package is used for bootstrapping fetchurl, and thus
 # cannot use fetchpatch! All mutable patches (generated by GitHub or
@@ -34,6 +43,14 @@ stdenv.mkDerivation rec {
       --replace "$"'{_IMPORT_PREFIX}' $out
   '';
 
+  passthru.tests = {
+    inherit python3;
+    inherit (haskellPackages) hexpat;
+    inherit (perlPackages) XMLSAXExpat XMLParser;
+    inherit (luaPackages) luaexpat;
+    inherit (ocamlPackages) ocaml_expat;
+  };
+
   meta = with lib; {
     homepage = "https://libexpat.github.io/";
     description = "A stream-oriented XML parser library written in C";
diff --git a/pkgs/development/libraries/libdeltachat/default.nix b/pkgs/development/libraries/libdeltachat/default.nix
index 8d506efef89d..5b969284995c 100644
--- a/pkgs/development/libraries/libdeltachat/default.nix
+++ b/pkgs/development/libraries/libdeltachat/default.nix
@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libdeltachat";
-  version = "1.75.0";
+  version = "1.76.0";
 
   src = fetchFromGitHub {
     owner = "deltachat";
     repo = "deltachat-core-rust";
     rev = version;
-    hash = "sha256-3oYQwV1Srnq8VfS+M+BwIznXRxQFXr78SwXO3Xu08ws=";
+    hash = "sha256-aeYOszOFyLaC1xKswYZLzqoWSFFWOOeOkc+WrtqU0jo=";
   };
 
   patches = [
@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src;
     name = "${pname}-${version}";
-    hash = "sha256-jti1aY8a9YB8x6fz7UqTY4uDj6gkMnG1hTN/Mgc+mHs=";
+    hash = "sha256-sBFXcLXpAkX+HzRKrLKaHhi5ieS8Yc/Uf30WcXyWrok=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/libwbxml/default.nix b/pkgs/development/libraries/libwbxml/default.nix
new file mode 100644
index 000000000000..d9446d8c8587
--- /dev/null
+++ b/pkgs/development/libraries/libwbxml/default.nix
@@ -0,0 +1,28 @@
+{ stdenv, fetchFromGitHub, lib, cmake, expat }:
+
+stdenv.mkDerivation rec {
+  pname = "libwbxml";
+  version = "0.11.7";
+
+  src = fetchFromGitHub {
+    owner = "libwbxml";
+    repo = "libwbxml";
+    rev = "${pname}-${version}";
+    sha256 = "sha256:1b81rbkd28d9059vh8n5gql73crp8h7av67kkmr6lhicl08fv2xx";
+  };
+
+  nativeBuildInputs = [ cmake ];
+  buildInputs = [ expat ];
+
+  postPatch = ''
+    sed -i 's/^SET.*$//' cmake/CMakeLists.txt
+  '';
+
+  meta = with lib; {
+    homepage = "https://github.com/libwbxml/libwbxml";
+    description = "The WBXML Library (aka libwbxml) contains a library and its associated tools to Parse, Encode and Handle WBXML documents";
+    maintainers = with maintainers; [ mh ];
+    platforms = platforms.linux;
+    license = licenses.lgpl21Plus;
+  };
+}
diff --git a/pkgs/development/libraries/physics/pythia/default.nix b/pkgs/development/libraries/physics/pythia/default.nix
index 03b298908bb0..d33beb665998 100644
--- a/pkgs/development/libraries/physics/pythia/default.nix
+++ b/pkgs/development/libraries/physics/pythia/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "pythia";
-  version = "8.306";
+  version = "8.307";
 
   src = fetchurl {
     url = "https://pythia.org/download/pythia83/pythia${builtins.replaceStrings ["."] [""] version}.tgz";
-    sha256 = "sha256-c0gDtyKxwbU8jPLw08MHR8gPwt3l4LoUG8k5fa03qPY=";
+    sha256 = "sha256-5bFNRKpZQzMuMt1d2poY/dGgCFxxmOKNhA4EFn+mAT0=";
   };
 
   nativeBuildInputs = [ rsync ];
diff --git a/pkgs/development/libraries/pipewire/wireplumber.nix b/pkgs/development/libraries/pipewire/wireplumber.nix
index cde73edf7904..4f738c33a0e4 100644
--- a/pkgs/development/libraries/pipewire/wireplumber.nix
+++ b/pkgs/development/libraries/pipewire/wireplumber.nix
@@ -69,6 +69,7 @@ stdenv.mkDerivation rec {
     "-Dintrospection=${mesonEnableFeature enableGI}"
     "-Dsystemd-system-service=true"
     "-Dsystemd-system-unit-dir=${placeholder "out"}/lib/systemd/system"
+    "-Dsysconfdir=/etc"
   ];
 
   passthru.updateScript = nix-update-script {
diff --git a/pkgs/development/libraries/spice-gtk/default.nix b/pkgs/development/libraries/spice-gtk/default.nix
index 16cf654914d1..db5db61c6e99 100644
--- a/pkgs/development/libraries/spice-gtk/default.nix
+++ b/pkgs/development/libraries/spice-gtk/default.nix
@@ -124,6 +124,8 @@ stdenv.mkDerivation rec {
   mesonFlags = [
     "-Dusb-acl-helper-dir=${placeholder "out"}/bin"
     "-Dusb-ids-path=${hwdata}/share/hwdata/usb.ids"
+  ] ++ lib.optionals (!withPolkit) [
+    "-Dpolkit=disabled"
   ];
 
   meta = with lib; {
diff --git a/pkgs/development/libraries/umockdev/default.nix b/pkgs/development/libraries/umockdev/default.nix
index b00177960d3b..286f5ccc3fcf 100644
--- a/pkgs/development/libraries/umockdev/default.nix
+++ b/pkgs/development/libraries/umockdev/default.nix
@@ -19,13 +19,13 @@
 
 stdenv.mkDerivation rec {
   pname = "umockdev";
-  version = "0.17.6";
+  version = "0.17.7";
 
   outputs = [ "bin" "out" "dev" "devdoc" ];
 
   src = fetchurl {
     url = "https://github.com/martinpitt/umockdev/releases/download/${version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-X60zN3orHU8lOfRVCfbHTdrleKxB7ILCIGvXSZLdoSk=";
+    sha256 = "sha256-BdZCoW3QHM4Oue4bpuSFsuwIU1vsZ5pjqVv9TfGNC7U=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/ocaml-modules/janestreet/0.12.nix b/pkgs/development/ocaml-modules/janestreet/0.12.nix
index ec2f793caf91..c3b4b0c6d705 100644
--- a/pkgs/development/ocaml-modules/janestreet/0.12.nix
+++ b/pkgs/development/ocaml-modules/janestreet/0.12.nix
@@ -24,7 +24,7 @@ with self;
     hash = "0gl89zpgsf3n30nb6v5cns27g2bfg4rf3s2427gqvwbkr5gcf7ri";
     meta.description = "Full standard library replacement for OCaml";
     propagatedBuildInputs = [ sexplib0 ];
-    buildInputs = [ dune-configurator ];
+    buildInputs = [ dune_1 ];
   };
 
   stdio = janePackage {
@@ -208,7 +208,7 @@ with self;
     pname = "jst-config";
     hash = "0yxcz13vda1mdh9ah7qqxwfxpcqang5sgdssd8721rszbwqqaw93";
     meta.description = "Compile-time configuration for Jane Street libraries";
-    buildInputs = [ ppx_assert ];
+    buildInputs = [ dune_1 ppx_assert ];
   };
 
   ppx_optcomp = janePackage {
diff --git a/pkgs/development/ocaml-modules/janestreet/0.14.nix b/pkgs/development/ocaml-modules/janestreet/0.14.nix
index 7d1c85447097..2f9aeea1d628 100644
--- a/pkgs/development/ocaml-modules/janestreet/0.14.nix
+++ b/pkgs/development/ocaml-modules/janestreet/0.14.nix
@@ -666,6 +666,7 @@ with self;
     pname = "pythonlib";
     hash = "0qr0mh9jiv1ham5zlz9i4im23a1vh6x1yp6dp2db2s4icmfph639";
     meta.description = "A library to help writing wrappers around ocaml code for python";
+    meta.broken = lib.versionAtLeast ocaml.version "4.13";
     propagatedBuildInputs = [ ppx_expect ppx_let ppx_python stdio typerep ];
   };
 
diff --git a/pkgs/development/ocaml-modules/janestreet/janePackage_0_12.nix b/pkgs/development/ocaml-modules/janestreet/janePackage_0_12.nix
index ebde7b240ef7..3d280a509acc 100644
--- a/pkgs/development/ocaml-modules/janestreet/janePackage_0_12.nix
+++ b/pkgs/development/ocaml-modules/janestreet/janePackage_0_12.nix
@@ -1,13 +1,11 @@
 { lib, fetchFromGitHub, buildDunePackage, defaultVersion ? "0.12.0" }:
 
-{ pname, version ? defaultVersion, hash, buildInputs ? [], ...}@args:
+{ pname, version ? defaultVersion, hash, ...}@args:
 
 buildDunePackage (args // {
-  inherit version buildInputs;
+  inherit version;
 
-  minimumOCamlVersion = "4.07";
-
-  useDune2 = true;
+  minimalOCamlVersion = "4.07";
 
   src = fetchFromGitHub {
     owner = "janestreet";
diff --git a/pkgs/development/ocaml-modules/ocaml-migrate-parsetree/1.8.x.nix b/pkgs/development/ocaml-modules/ocaml-migrate-parsetree/1.8.x.nix
index 5d8d967bf4fd..009d95992fb7 100644
--- a/pkgs/development/ocaml-modules/ocaml-migrate-parsetree/1.8.x.nix
+++ b/pkgs/development/ocaml-modules/ocaml-migrate-parsetree/1.8.x.nix
@@ -1,5 +1,9 @@
 { lib, fetchFromGitHub, buildDunePackage, ocaml, result, ppx_derivers }:
 
+if lib.versionOlder "4.13" ocaml.version
+then throw "ocaml-migrate-parsetree-1.8 is not available for OCaml ${ocaml.version}"
+else
+
 buildDunePackage rec {
    pname = "ocaml-migrate-parsetree";
    version = "1.8.0";
diff --git a/pkgs/development/ocaml-modules/ppx_deriving/default.nix b/pkgs/development/ocaml-modules/ppx_deriving/default.nix
index 090c8113ce48..fbe484dea044 100644
--- a/pkgs/development/ocaml-modules/ppx_deriving/default.nix
+++ b/pkgs/development/ocaml-modules/ppx_deriving/default.nix
@@ -5,6 +5,7 @@
 , ppxlib
 , ppx_derivers
 , result
+, ounit
 , ounit2
 , ocaml-migrate-parsetree
 , ocaml-migrate-parsetree-2
@@ -51,7 +52,9 @@ buildDunePackage rec {
   ];
 
   doCheck = true;
-  checkInputs = [ ounit2 ];
+  checkInputs = [
+    (if lib.versionAtLeast version "5.2" then ounit2 else ounit)
+  ];
 
   meta = with lib; {
     description = "deriving is a library simplifying type-driven code generation on OCaml >=4.02.";
diff --git a/pkgs/development/ocaml-modules/wasm/default.nix b/pkgs/development/ocaml-modules/wasm/default.nix
index bf7fcb66fe5c..6b0008912906 100644
--- a/pkgs/development/ocaml-modules/wasm/default.nix
+++ b/pkgs/development/ocaml-modules/wasm/default.nix
@@ -1,6 +1,7 @@
 { stdenv, lib, fetchFromGitHub, ocaml, findlib, ocamlbuild }:
 
 if !lib.versionAtLeast ocaml.version "4.02"
+|| lib.versionOlder "4.13" ocaml.version
 then throw "wasm is not available for OCaml ${ocaml.version}"
 else
 
diff --git a/pkgs/development/php-packages/phpstan/default.nix b/pkgs/development/php-packages/phpstan/default.nix
index b00da4972f67..9f8a5feb8a74 100644
--- a/pkgs/development/php-packages/phpstan/default.nix
+++ b/pkgs/development/php-packages/phpstan/default.nix
@@ -1,14 +1,14 @@
 { mkDerivation, fetchurl, makeWrapper, lib, php }:
 let
   pname = "phpstan";
-  version = "1.4.6";
+  version = "1.4.7";
 in
 mkDerivation {
   inherit pname version;
 
   src = fetchurl {
     url = "https://github.com/phpstan/phpstan/releases/download/${version}/phpstan.phar";
-    sha256 = "sha256-h19rFEs7VrdlxGS1qeYJnO5aQaKzpFZTdsN2h3Hmm0w=";
+    sha256 = "sha256-bsSdFfUVQnbDFH8hO1Z9sHA2w7pMHlLEx1hsgDdCUmE=";
   };
 
   dontUnpack = true;
diff --git a/pkgs/development/python-modules/APScheduler/default.nix b/pkgs/development/python-modules/APScheduler/default.nix
index 9ba564fcaac5..b6f79b6c5fc6 100644
--- a/pkgs/development/python-modules/APScheduler/default.nix
+++ b/pkgs/development/python-modules/APScheduler/default.nix
@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "apscheduler";
-  version = "3.9.0.post1";
+  version = "3.9.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "APScheduler";
     inherit version;
-    hash = "sha256-I22/ckQgD/x5xsC5/30u0Q5+mF839I1KI/QUL0ln3LU=";
+    hash = "sha256-ZeZXS2OVSY03HQRfKop+T31Qxq0h73MT0VscfPIN8eM=";
   };
 
   buildInputs = [
diff --git a/pkgs/development/python-modules/awkward/default.nix b/pkgs/development/python-modules/awkward/default.nix
index f1152da2d1d4..2b3b1e4ce8c1 100644
--- a/pkgs/development/python-modules/awkward/default.nix
+++ b/pkgs/development/python-modules/awkward/default.nix
@@ -11,11 +11,11 @@
 
 buildPythonPackage rec {
   pname = "awkward";
-  version = "1.7.0";
+  version = "1.8.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "e4e642dfe496d2acb245c90e37dc18028e25d5e936421e7371ea6ba0fde6435a";
+    sha256 = "sha256-ZlX6ItGx0dy5zO4NUCNQq5DFNGehC1QLdiRCK1lNLnI=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/python-modules/azure-mgmt-containerregistry/default.nix b/pkgs/development/python-modules/azure-mgmt-containerregistry/default.nix
index 8afcde620194..fae7318cd486 100644
--- a/pkgs/development/python-modules/azure-mgmt-containerregistry/default.nix
+++ b/pkgs/development/python-modules/azure-mgmt-containerregistry/default.nix
@@ -6,13 +6,13 @@
 }:
 
 buildPythonPackage rec {
-  version = "9.0.0";
+  version = "9.1.0";
   pname = "azure-mgmt-containerregistry";
   disabled = isPy27;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "9f6c5894d32ba696527ecf0ff155bb43c325dff6a11a6de60cd22ea3f5fb180d";
+    sha256 = "sha256-jkzGLDqrJgwCnz27lGzFk4d2q+j0P+PU8uUVGQg7MkA=";
     extension = "zip";
   };
 
diff --git a/pkgs/development/python-modules/azure-mgmt-datafactory/default.nix b/pkgs/development/python-modules/azure-mgmt-datafactory/default.nix
index 9c6e9e2d80f7..eed367c2206d 100644
--- a/pkgs/development/python-modules/azure-mgmt-datafactory/default.nix
+++ b/pkgs/development/python-modules/azure-mgmt-datafactory/default.nix
@@ -11,12 +11,12 @@
 
 buildPythonPackage rec {
   pname = "azure-mgmt-datafactory";
-  version = "2.2.1";
+  version = "2.3.0";
 
   src = fetchPypi {
     inherit pname version;
     extension = "zip";
-    sha256 = "sha256-/YmFlK5xl3HjaKGAhQu0JUVeujzPkAb8gNik4Lzp470=";
+    sha256 = "sha256-pjBjFPkKhKd8XI6wmzX/rAssHINMzDAZa+XRqG/pLYo=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/bandit/default.nix b/pkgs/development/python-modules/bandit/default.nix
index 0fcf5966d68d..cf1bbd9c54aa 100644
--- a/pkgs/development/python-modules/bandit/default.nix
+++ b/pkgs/development/python-modules/bandit/default.nix
@@ -13,12 +13,12 @@
 
 buildPythonPackage rec {
   pname = "bandit";
-  version = "1.7.3";
+  version = "1.7.4";
   disabled = !isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-WHcsqVG/ESndqKKA01FUfegycgv3tcKfrDEDknmAuKY=";
+    sha256 = "sha256-LWOoxXNBe64ziWLUubBvvGCA907NlVoJKEnh5lxxe9I=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/cfn-lint/default.nix b/pkgs/development/python-modules/cfn-lint/default.nix
index 354f90f12b6b..1c5b96ea48cd 100644
--- a/pkgs/development/python-modules/cfn-lint/default.nix
+++ b/pkgs/development/python-modules/cfn-lint/default.nix
@@ -19,13 +19,13 @@
 
 buildPythonPackage rec {
   pname = "cfn-lint";
-  version = "0.56.4";
+  version = "0.58.2";
 
   src = fetchFromGitHub {
     owner = "aws-cloudformation";
     repo = "cfn-python-lint";
     rev = "v${version}";
-    sha256 = "0li8zkdvmgfxqzqs1rvd48mwim0bhjwmxlywqxjix0a43kvkvh77";
+    sha256 = "sha256-ArpvP4tbRf1fK8BPokRXqS3YyaFiOLBrR8uQHko5iKo=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/djangorestframework-simplejwt/default.nix b/pkgs/development/python-modules/djangorestframework-simplejwt/default.nix
index 4c616bdeb274..d84a542d0bba 100644
--- a/pkgs/development/python-modules/djangorestframework-simplejwt/default.nix
+++ b/pkgs/development/python-modules/djangorestframework-simplejwt/default.nix
@@ -10,12 +10,12 @@
 
 buildPythonPackage rec {
   pname = "djangorestframework-simplejwt";
-  version = "5.0.0";
+  version = "5.1.0";
 
   src = fetchPypi {
     pname = "djangorestframework_simplejwt";
     inherit version;
-    sha256 = "30b10e7732395c44d21980f773214d2b9bdeadf2a6c6809cd1a7c9abe272873c";
+    sha256 = "sha256-dTI1KKe5EIQ7h5GUdG8OvDSBxK2fNU3i3RYhYGYvuVo=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/dropbox/default.nix b/pkgs/development/python-modules/dropbox/default.nix
index 8f53ff4ebbf7..2e2490568e9d 100644
--- a/pkgs/development/python-modules/dropbox/default.nix
+++ b/pkgs/development/python-modules/dropbox/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "dropbox";
-  version = "11.27.0";
+  version = "11.28.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "dropbox";
     repo = "dropbox-sdk-python";
     rev = "v${version}";
-    sha256 = "sha256-atIrrK4BgTfu0UaHTqJ66AxEeSJLanrmYx8myrOCOfo=";
+    sha256 = "sha256-xNenBmeCRIYxQqAkV8IDpPpIHyVAYJs1jAFr8w1tz2Y=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/furo/default.nix b/pkgs/development/python-modules/furo/default.nix
index ab196d23c2d6..615bf3ebe9c0 100644
--- a/pkgs/development/python-modules/furo/default.nix
+++ b/pkgs/development/python-modules/furo/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "furo";
-  version = "2022.2.23";
+  version = "2022.3.4";
   format = "wheel";
   disable = pythonOlder "3.6";
 
@@ -16,7 +16,7 @@ buildPythonPackage rec {
     inherit pname version format;
     dist = "py3";
     python = "py3";
-    sha256 = "sha256-v+1OagURq3uvIRsxlbhRkUvxGnLlkH4HOx3pKW3jkfY=";
+    sha256 = "sha256-bHGCk+v4d1XwufFIseaXyeOqvXr5VWRNS8ruXOddt4E=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/google-resumable-media/default.nix b/pkgs/development/python-modules/google-resumable-media/default.nix
index ff545339da80..0b81aa71eba6 100644
--- a/pkgs/development/python-modules/google-resumable-media/default.nix
+++ b/pkgs/development/python-modules/google-resumable-media/default.nix
@@ -12,11 +12,11 @@
 
 buildPythonPackage rec {
   pname = "google-resumable-media";
-  version = "2.3.0";
+  version = "2.3.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-Gn3OV5CwRRjtwCws4zllVWZg1klXEG1mqUUIbitkJXI=";
+    sha256 = "sha256-H02LFRlnZv34qGD9LPqmGEE4cH7F+SHNGDQGel39Lbc=";
   };
 
   propagatedBuildInputs = [ google-auth google-crc32c requests ];
diff --git a/pkgs/development/python-modules/hypothesmith/default.nix b/pkgs/development/python-modules/hypothesmith/default.nix
index 3ce0f068fec9..ee8b897154bd 100644
--- a/pkgs/development/python-modules/hypothesmith/default.nix
+++ b/pkgs/development/python-modules/hypothesmith/default.nix
@@ -9,10 +9,15 @@ buildPythonPackage rec {
     sha256 = "0fb7b3fd03d76eddd4474b0561e1c2662457593a74cc300fd27e5409cd4d7922";
   };
 
+  postPatch = ''
+    substituteInPlace setup.py --replace "lark-parser" "lark"
+  '';
+
   propagatedBuildInputs = [ hypothesis lark libcst ];
 
   checkInputs = [ black parso pytestCheckHook pytest-cov pytest-xdist ];
 
+  pytestFlagsArray = [ "-v" ];  # tests are fairly slow, prevents timeout due to no stdout printing
   pythonImportsCheck = [ "hypothesmith" ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/kaldi-active-grammar/0001-stub.patch b/pkgs/development/python-modules/kaldi-active-grammar/0001-stub.patch
index 4ebe5472b44a..597907c14be6 100644
--- a/pkgs/development/python-modules/kaldi-active-grammar/0001-stub.patch
+++ b/pkgs/development/python-modules/kaldi-active-grammar/0001-stub.patch
@@ -1,8 +1,8 @@
 diff --git a/CMakeLists.txt b/CMakeLists.txt
-index 66e6d49..78f7b42 100644
+index 17c7032..12ed398 100644
 --- a/CMakeLists.txt
 +++ b/CMakeLists.txt
-@@ -1,23 +1,6 @@
+@@ -1,87 +1,12 @@
  cmake_minimum_required(VERSION 3.13.0)
  project(kaldi_binaries)
  
@@ -24,9 +24,8 @@ index 66e6d49..78f7b42 100644
 -endif()
 -
  set(BINARIES
-   tools/openfst/bin/fstarcsort${CMAKE_EXECUTABLE_SUFFIX}
-   tools/openfst/bin/fstcompile${CMAKE_EXECUTABLE_SUFFIX}
-@@ -29,63 +12,6 @@ set(LIBRARIES
+   )
+ set(LIBRARIES
    src/lib/libkaldi-dragonfly${CMAKE_SHARED_LIBRARY_SUFFIX}
    )
  
@@ -87,30 +86,33 @@ index 66e6d49..78f7b42 100644
 -  message(FATAL_ERROR "KALDI_BRANCH not set! Use 'origin/master'?")
 -  # set(KALDI_BRANCH "origin/master")
 -endif()
- 
+-
  message("MAKE_EXE                  = ${MAKE_EXE}")
  message("PYTHON_EXECUTABLE         = ${PYTHON_EXECUTABLE}")
-@@ -99,63 +25,4 @@ message("CMAKE_CURRENT_BINARY_DIR  = ${CMAKE_CURRENT_BINARY_DIR}")
+ message("PYTHON_INCLUDE_DIR        = ${PYTHON_INCLUDE_DIR}")
+@@ -94,65 +19,4 @@ message("CMAKE_CURRENT_BINARY_DIR  = ${CMAKE_CURRENT_BINARY_DIR}")
  
  # CXXFLAGS are set and exported in kaldi-configure-wrapper.sh
  
 -if(NOT "${CMAKE_HOST_SYSTEM_NAME}" STREQUAL "Windows")
 -  set(STRIP_LIBS_COMMAND find src/lib tools/openfst/lib -name *${CMAKE_SHARED_LIBRARY_SUFFIX} | xargs strip)
--  set(STRIP_DST_COMMAND find ${DST} | xargs strip)
+-  # set(STRIP_DST_COMMAND find ${DST} [[[other specifiers]]] | xargs strip)
 -  if("${CMAKE_HOST_SYSTEM_NAME}" STREQUAL "Darwin")
 -    list(APPEND STRIP_LIBS_COMMAND -x)
--    list(APPEND STRIP_DST_COMMAND -x)
+-    # list(APPEND STRIP_DST_COMMAND -x)
 -  endif()
+-  # set(STRIP_LIBS_COMMAND true)
+-  set(STRIP_DST_COMMAND true)
 -  ExternalProject_Add(kaldi
 -    GIT_CONFIG        advice.detachedHead=false
 -    GIT_REPOSITORY    https://github.com/daanzu/kaldi-fork-active-grammar.git
 -    GIT_TAG           ${KALDI_BRANCH}
 -    GIT_SHALLOW       TRUE
--    CONFIGURE_COMMAND sed -i.bak -e "s/status=0/exit 0/g" tools/extras/check_dependencies.sh && cp ${PROJECT_SOURCE_DIR}/building/kaldi-configure-wrapper.sh src/
+-    CONFIGURE_COMMAND sed -i.bak -e "s/status=0/exit 0/g" tools/extras/check_dependencies.sh && sed -i.bak -e "s/openfst_add_CXXFLAGS = -g -O2/openfst_add_CXXFLAGS = -g0 -O3/g" tools/Makefile && cp ${PROJECT_SOURCE_DIR}/building/kaldi-configure-wrapper.sh src/
 -    BUILD_IN_SOURCE   TRUE
--    BUILD_COMMAND     ${MATHLIB_BUILD_COMMAND} && cd tools && ${MAKE_EXE} ${MAKE_FLAGS} && cd openfst && autoreconf && cd ../../src && bash ./kaldi-configure-wrapper.sh ./configure ${KALDI_CONFIG_FLAGS} && ${MAKE_EXE} ${MAKE_FLAGS} depend && ${MAKE_EXE} ${MAKE_FLAGS} dragonfly dragonflybin bin fstbin lmbin
+-    BUILD_COMMAND     ${MATHLIB_BUILD_COMMAND} && cd tools && ${MAKE_EXE} ${MAKE_FLAGS} && cd openfst && autoreconf && cd ../../src && bash ./kaldi-configure-wrapper.sh ./configure ${KALDI_CONFIG_FLAGS} && ${MAKE_EXE} ${MAKE_FLAGS} depend && ${MAKE_EXE} ${MAKE_FLAGS} dragonfly
 -    LIST_SEPARATOR    " "
--    INSTALL_COMMAND   ${STRIP_LIBS_COMMAND} && mkdir -p ${DST} && cp ${BINARIES} ${LIBRARIES} ${DST}
+-    INSTALL_COMMAND   ${STRIP_LIBS_COMMAND} && mkdir -p ${DST} && cp ${BINARIES} ${LIBRARIES} ${DST} && ${STRIP_DST_COMMAND}
 -    )
 -endif()
 -
diff --git a/pkgs/development/python-modules/kaldi-active-grammar/0002-exec-path.patch b/pkgs/development/python-modules/kaldi-active-grammar/0002-exec-path.patch
index 60f50d707db0..3a45ea7e104d 100644
--- a/pkgs/development/python-modules/kaldi-active-grammar/0002-exec-path.patch
+++ b/pkgs/development/python-modules/kaldi-active-grammar/0002-exec-path.patch
@@ -1,5 +1,5 @@
 diff --git a/kaldi_active_grammar/utils.py b/kaldi_active_grammar/utils.py
-index 0b70c7f..21e1d62 100644
+index 823f997..3850336 100644
 --- a/kaldi_active_grammar/utils.py
 +++ b/kaldi_active_grammar/utils.py
 @@ -79,7 +79,7 @@ elif sys.platform.startswith('linux'): platform = 'linux'
@@ -8,10 +8,10 @@ index 0b70c7f..21e1d62 100644
  
 -exec_dir = os.path.join(os.path.dirname(os.path.abspath(__file__)), 'exec', platform)
 +exec_dir = '/'
- library_extension = dict(windows='.dll', linux='.so', macos='.dylib')[platform]
- subprocess_seperator = '^&' if platform == 'windows' else ';'
  
-@@ -89,13 +89,13 @@ class ExternalProcess(object):
+ import ush
+ 
+@@ -87,13 +87,13 @@ class ExternalProcess(object):
  
      shell = ush.Shell(raise_on_error=True)
  
diff --git a/pkgs/development/python-modules/kaldi-active-grammar/default.nix b/pkgs/development/python-modules/kaldi-active-grammar/default.nix
index d5a906dd733b..46fc619b4cb3 100644
--- a/pkgs/development/python-modules/kaldi-active-grammar/default.nix
+++ b/pkgs/development/python-modules/kaldi-active-grammar/default.nix
@@ -50,6 +50,8 @@ buildPythonPackage rec {
   nativeBuildInputs = [ scikit-build cmake ];
   propagatedBuildInputs = [ ush requests numpy cffi ];
 
+  doCheck = false;  # no tests exist
+
   meta = with lib; {
     description = "Python Kaldi speech recognition";
     homepage = "https://github.com/daanzu/kaldi-active-grammar";
diff --git a/pkgs/development/python-modules/lark/default.nix b/pkgs/development/python-modules/lark/default.nix
index 6c29a662524c..8fc32539d69d 100644
--- a/pkgs/development/python-modules/lark/default.nix
+++ b/pkgs/development/python-modules/lark/default.nix
@@ -3,17 +3,18 @@
 , fetchFromGitHub
 , python
 , regex
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "lark";
-  version = "1.0.0";
+  version = "1.1.2";
 
   src = fetchFromGitHub {
     owner = "lark-parser";
     repo = "lark";
     rev = version;
-    sha256 = "0pfvjh4ydc49gs6m8b3ip85c8nd4da2bhz9714fwcyl3hdp33q7n";
+    sha256 = "sha256-Y1bDSiFnqAKTlIcd8aAgtc+I3TLnWF8hhQK2ez96TQs=";
   };
 
   # Optional import, but fixes some re known bugs & allows advanced regex features
@@ -26,15 +27,11 @@ buildPythonPackage rec {
     "lark.grammars"
   ];
 
-  checkPhase = ''
-    runHook preCheck
+  checkInputs = [ pytestCheckHook ];
 
-    # Official way to run the tests. Runs unittest internally.
-    # pytest produces issues with some test resource paths (relies on __main__)
-    ${python.interpreter} -m tests
-
-    runHook postCheck
-  '';
+  disabledTestPaths = [
+    "tests/test_nearley/test_nearley.py"  # requires unpackaged Js2Py library
+  ];
 
   meta = with lib; {
     description = "A modern parsing library for Python, implementing Earley & LALR(1) and an easy interface";
diff --git a/pkgs/development/python-modules/pg8000/default.nix b/pkgs/development/python-modules/pg8000/default.nix
index 57c9f77f1fed..8653c28c878d 100644
--- a/pkgs/development/python-modules/pg8000/default.nix
+++ b/pkgs/development/python-modules/pg8000/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "pg8000";
-  version = "1.24.0";
+  version = "1.24.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-BsawsGjQfONm97ztrfdqC12mph+GMCyMr/aQt/xd/ts=";
+    sha256 = "sha256-KRIixd39ZqP8DTIXAM9ZHIsPkw0vyEh3fWz8/1VEPOY=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pycfmodel/default.nix b/pkgs/development/python-modules/pycfmodel/default.nix
index 9f3a61a990e3..a6a2446da07b 100644
--- a/pkgs/development/python-modules/pycfmodel/default.nix
+++ b/pkgs/development/python-modules/pycfmodel/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "pycfmodel";
-  version = "0.17.0";
+  version = "0.17.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "Skyscanner";
     repo = pname;
     rev = version;
-    hash = "sha256-IfeGNAgVCnrzipQpGiEqfWWNkUNmeH7TInl8kje52js=";
+    hash = "sha256-Rw0sZ2k+tXo04mvlL83hUgdHIND5NIsVH/CzrfmbKlE=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pyobihai/default.nix b/pkgs/development/python-modules/pyobihai/default.nix
index 79d8363372be..0cc62311f329 100644
--- a/pkgs/development/python-modules/pyobihai/default.nix
+++ b/pkgs/development/python-modules/pyobihai/default.nix
@@ -7,13 +7,15 @@
 
 buildPythonPackage rec {
   pname = "pyobihai";
-  version = "1.3.1";
-  disabled = pythonOlder "3.6";
+  version = "1.3.2";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   # GitHub release, https://github.com/dshokouhi/pyobihai/issues/10
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1vvf5if57dfd091a7fb5rvx63hvf0isrx28j72nj2aav1as460qp";
+    hash = "sha256-zhsnJyhXlugK0nJ7FJZZcrq2VDQt1a9uCgsJAIABZ28=";
   };
 
   propagatedBuildInputs = [
@@ -23,7 +25,9 @@ buildPythonPackage rec {
   # Project has no tests
   doCheck = false;
 
-  pythonImportsCheck = [ "pyobihai" ];
+  pythonImportsCheck = [
+    "pyobihai"
+  ];
 
   meta = with lib; {
     description = "Python package to interact with Obihai devices";
diff --git a/pkgs/development/python-modules/slack-sdk/default.nix b/pkgs/development/python-modules/slack-sdk/default.nix
index 7b94067aeee9..09682a2a3d0e 100644
--- a/pkgs/development/python-modules/slack-sdk/default.nix
+++ b/pkgs/development/python-modules/slack-sdk/default.nix
@@ -20,7 +20,7 @@
 
 buildPythonPackage rec {
   pname = "slack-sdk";
-  version = "3.15.1";
+  version = "3.15.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -29,7 +29,7 @@ buildPythonPackage rec {
     owner = "slackapi";
     repo = "python-slack-sdk";
     rev = "v${version}";
-    sha256 = "sha256-N8JvNK1ddlCabzCmEv9TItqXDT7A4Dt8dhMLBICWXHA=";
+    sha256 = "sha256-lhdh4Eo7yIsukXoKI6Ss793fYmAu91O1UElmxV9xAc4=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/sybil/default.nix b/pkgs/development/python-modules/sybil/default.nix
index 55cea70924e6..41baf697fff3 100644
--- a/pkgs/development/python-modules/sybil/default.nix
+++ b/pkgs/development/python-modules/sybil/default.nix
@@ -7,14 +7,14 @@
 
 buildPythonApplication rec {
   pname = "sybil";
-  version = "3.0.0";
+  version = "3.0.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-dpLtZueT5eea5qcM8s+GGRftSOr/DYrfgl5k2Fgg8lE=";
+    hash = "sha256-bwLcIgSvflohIDeSTZdPcngfbcGP08RMx85GOhIPUw0=";
   };
 
   checkInputs = [
@@ -22,7 +22,7 @@ buildPythonApplication rec {
   ];
 
   disabledTests = [
-    # sensitive to output of other commands
+    # Sensitive to output of other commands
     "test_namespace"
     "test_unittest"
   ];
diff --git a/pkgs/development/python-modules/testfixtures/default.nix b/pkgs/development/python-modules/testfixtures/default.nix
index 93fc92bd6320..91f91a3d7b17 100644
--- a/pkgs/development/python-modules/testfixtures/default.nix
+++ b/pkgs/development/python-modules/testfixtures/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "testfixtures";
-  version = "6.18.3";
+  version = "6.18.5";
   format = "setuptools";
   # DO NOT CONTACT upstream.
   # https://github.com/simplistix/ is only concerned with internal CI process.
@@ -25,12 +25,9 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-JgAQCulv/QgjNLN441VVD++LSlKab6TDT0cTCQXHQm0=";
+    hash = "sha256-Atrog/Vn9bcP0608nu+5WRLniskL5sdES14vRr9XLIQ=";
   };
 
-  # no longer compatible with sybil
-  # https://github.com/simplistix/testfixtures/issues/169
-  doCheck = false;
   checkInputs = [
     mock
     pytestCheckHook
@@ -44,19 +41,6 @@ buildPythonPackage rec {
     "testfixtures/tests/test_django"
   ];
 
-  disabledTests = lib.optionals (pythonAtLeast "3.10") [
-    # https://github.com/simplistix/testfixtures/issues/168
-    "test_invalid_communicate_call"
-    "test_invalid_kill"
-    "test_invalid_parameters"
-    "test_invalid_poll"
-    "test_invalid_send_signal"
-    "test_invalid_terminate"
-    "test_invalid_wait_call"
-    "test_replace_delattr_cant_remove"
-    "test_replace_delattr_cant_remove_not_strict"
-  ];
-
   pytestFlagsArray = [
     "testfixtures/tests"
   ];
diff --git a/pkgs/development/python-modules/tikzplotlib/default.nix b/pkgs/development/python-modules/tikzplotlib/default.nix
new file mode 100644
index 000000000000..ebf58dd12e9c
--- /dev/null
+++ b/pkgs/development/python-modules/tikzplotlib/default.nix
@@ -0,0 +1,44 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, matplotlib
+, numpy
+, pillow
+, webcolors
+, flit-core
+, pytestCheckHook
+, pandas
+}:
+
+buildPythonPackage rec {
+  pname = "tikzplotlib";
+  version = "0.10.1";
+  format = "pyproject";
+
+  src = fetchFromGitHub {
+    owner = "nschloe";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "sha256-PLExHhEnxkEiXsE0rqvpNWwVZ+YoaDa2BTx8LktdHl0=";
+  };
+
+  propagatedBuildInputs = [
+    matplotlib
+    numpy
+    pillow
+    webcolors
+    flit-core
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+    pandas
+  ];
+
+  meta = with lib; {
+    description = "Save matplotlib figures as TikZ/PGFplots for smooth integration into LaTeX";
+    homepage = "https://github.com/nschloe/tikzplotlib";
+    license = licenses.mit;
+    maintainers = with maintainers; [ doronbehar ];
+  };
+}
diff --git a/pkgs/development/tools/checkmate/default.nix b/pkgs/development/tools/checkmate/default.nix
index b8ad9c6d7789..bcb115e409b7 100644
--- a/pkgs/development/tools/checkmate/default.nix
+++ b/pkgs/development/tools/checkmate/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "checkmate";
-  version = "0.5.7";
+  version = "0.5.8";
 
   src = fetchFromGitHub {
     owner = "adedayo";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-RCGJ7Xa5HLzcngv79NyocbNGoYZMAKyv/svRScM1vq0=";
+    sha256 = "sha256-nzhzeXy70UQ1HP3/PCBnUPhrjg7CnKURMCH0iJ099E0=";
   };
 
-  vendorSha256 = "sha256-ZURtNED8gb0QsuXxJd9oBSx68ABcwlvVpkbd7lhiA9s=";
+  vendorSha256 = "sha256-uQRAVbLnzY+E3glMJ3AvmbtmwD2LkuqCh2mUpqZbmaA=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/development/tools/devpi-client/default.nix b/pkgs/development/tools/devpi-client/default.nix
index 2b122326bfe5..863336257251 100644
--- a/pkgs/development/tools/devpi-client/default.nix
+++ b/pkgs/development/tools/devpi-client/default.nix
@@ -1,26 +1,24 @@
 { lib
+, argon2-cffi-bindings
 , buildPythonApplication
+, check-manifest
+, devpi-common
+, devpi-server
 , fetchPypi
-# buildInputs
+, git
 , glibcLocales
+, mercurial
+, mock
 , pkginfo
-, check-manifest
-# propagatedBuildInputs
-, py
-, devpi-common
 , pluggy
-, setuptools
-# CheckInputs
-, pytest
+, py
+, pytestCheckHook
 , pytest-flake8
-, webtest
-, mock
-, devpi-server
-, tox
+, setuptools
 , sphinx
+, tox
+, webtest
 , wheel
-, git
-, mercurial
 }:
 
 buildPythonApplication rec {
@@ -29,24 +27,45 @@ buildPythonApplication rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "362eb26e95136a792491861cc2728d14a6309a9d4c4f13a7b9c3e6fd39de58ec";
+    hash = "sha256-Ni6ybpUTankkkYYcwnKNFKYwmp1MTxOnucPm/TneWOw=";
   };
 
-  buildInputs = [ glibcLocales ];
+  buildInputs = [
+    glibcLocales
+  ];
 
-  propagatedBuildInputs = [ py devpi-common pluggy setuptools check-manifest pkginfo ];
+  propagatedBuildInputs = [
+    argon2-cffi-bindings
+    check-manifest
+    devpi-common
+    pkginfo
+    pluggy
+    py
+    setuptools
+  ];
 
   checkInputs = [
-    pytest pytest-flake8 webtest mock
-    devpi-server tox
-    sphinx wheel git mercurial
+    devpi-server
+    git
+    mercurial
+    mock
+    pytestCheckHook
+    pytest-flake8
+    sphinx
+    tox
+    webtest
+    wheel
   ];
 
-  # --fast skips tests which try to start a devpi-server improperly
-  checkPhase = ''
-    HOME=$TMPDIR py.test --fast
+  preCheck = ''
+    export HOME=$(mktemp -d);
   '';
 
+  pytestFlagsArray = [
+    # --fast skips tests which try to start a devpi-server improperly
+    "--fast"
+  ];
+
   LC_ALL = "en_US.UTF-8";
 
   __darwinAllowLocalNetworking = true;
@@ -57,5 +76,4 @@ buildPythonApplication rec {
     license = licenses.mit;
     maintainers = with maintainers; [ lewo makefu ];
   };
-
 }
diff --git a/pkgs/development/tools/earthly/default.nix b/pkgs/development/tools/earthly/default.nix
index cd324ae387d2..e37801d2722f 100644
--- a/pkgs/development/tools/earthly/default.nix
+++ b/pkgs/development/tools/earthly/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "earthly";
-  version = "0.6.8";
+  version = "0.6.9";
 
   src = fetchFromGitHub {
     owner = "earthly";
     repo = "earthly";
     rev = "v${version}";
-    sha256 = "sha256-VXBDgBcByONEOznUVbzxySE7rcevIwCk8rVxRxhF0Gc=";
+    sha256 = "sha256-FZHz46GUPG5LgJcuKxheERWcctuHdDWgGPslEAu+j08=";
   };
 
-  vendorSha256 = "sha256-6lzusbfedDJESJIxsTVGoRnjdtPnMSDdL2OjXIFFL04=";
+  vendorSha256 = "sha256-uUx9C7uEdXjhDWxehGHuhuFQXdUjZAXK3qogESkRm8E=";
 
   ldflags = [
     "-s" "-w"
diff --git a/pkgs/development/tools/esbuild/default.nix b/pkgs/development/tools/esbuild/default.nix
index 82e69c2d91ee..d6903f464fd2 100644
--- a/pkgs/development/tools/esbuild/default.nix
+++ b/pkgs/development/tools/esbuild/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "esbuild";
-  version = "0.14.23";
+  version = "0.14.24";
 
   src = fetchFromGitHub {
     owner = "evanw";
     repo = "esbuild";
     rev = "v${version}";
-    sha256 = "sha256-7J8l4PCXDSddlUdMYaTo3KQjhUl1IRpks0iMiYxJzD4=";
+    sha256 = "sha256-ayL5aTfYFdsmZ4Zpkij27HE/2MCyt6J5qQ1d0BIX0eE=";
   };
 
   vendorSha256 = "sha256-QPkBR+FscUc3jOvH7olcGUhM6OW4vxawmNJuRQxPuGs=";
diff --git a/pkgs/development/tools/go-bindata/default.nix b/pkgs/development/tools/go-bindata/default.nix
index fc44efca8289..f3a5ab297eeb 100644
--- a/pkgs/development/tools/go-bindata/default.nix
+++ b/pkgs/development/tools/go-bindata/default.nix
@@ -2,7 +2,7 @@
 
 buildGoPackage rec {
   pname = "go-bindata";
-  version = "3.22.0";
+  version = "3.23.0";
 
   goPackagePath = "github.com/kevinburke/go-bindata";
 
@@ -10,7 +10,7 @@ buildGoPackage rec {
     owner = "kevinburke";
     repo = pname;
     rev = "v${version}";
-    sha256 = "10dq77dml5jvvq2jkdq81a9yjg7rncq8iw8r84cc3dz6l9hxzj0x";
+    sha256 = "sha256-pIEkD0HD/6JFOzkvEG9j9yQP7hLWvmXU3MiyvVFH2rY=";
   };
 
   subPackages = [ "go-bindata" ];
diff --git a/pkgs/development/tools/ocaml/camlp5/default.nix b/pkgs/development/tools/ocaml/camlp5/default.nix
index e94e98d8f723..65debca11c23 100644
--- a/pkgs/development/tools/ocaml/camlp5/default.nix
+++ b/pkgs/development/tools/ocaml/camlp5/default.nix
@@ -1,6 +1,7 @@
 { lib, stdenv, fetchFromGitHub, ocaml, perl }:
 
 if lib.versionOlder ocaml.version "4.02"
+|| lib.versionOlder "4.13" ocaml.version
 then throw "camlp5 is not available for OCaml ${ocaml.version}"
 else
 
diff --git a/pkgs/development/tools/ocaml/ocamlformat/generic.nix b/pkgs/development/tools/ocaml/ocamlformat/generic.nix
index 7cd3196317fa..517ca6585fe1 100644
--- a/pkgs/development/tools/ocaml/ocamlformat/generic.nix
+++ b/pkgs/development/tools/ocaml/ocamlformat/generic.nix
@@ -28,8 +28,10 @@ let src =
     }."${version}";
   };
   ocamlPackages =
-  if lib.versionAtLeast version "0.17.0"
+  if lib.versionAtLeast version "0.19.0"
   then ocaml-ng.ocamlPackages
+  else if lib.versionAtLeast version "0.17.0"
+  then ocaml-ng.ocamlPackages_4_12
   else if lib.versionAtLeast version "0.14.3"
   then ocaml-ng.ocamlPackages_4_10
   else ocaml-ng.ocamlPackages_4_07
diff --git a/pkgs/development/tools/rust/cargo-llvm-lines/default.nix b/pkgs/development/tools/rust/cargo-llvm-lines/default.nix
index 7fc1da095e5f..eede871e38c6 100644
--- a/pkgs/development/tools/rust/cargo-llvm-lines/default.nix
+++ b/pkgs/development/tools/rust/cargo-llvm-lines/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-llvm-lines";
-  version = "0.4.13";
+  version = "0.4.14";
 
   src = fetchFromGitHub {
     owner = "dtolnay";
     repo = pname;
     rev = version;
-    sha256 = "sha256-sN0i2oo0XuxneIK/w+jpxkcdm2rtqhyH2Y3CMPnH+ro=";
+    sha256 = "sha256-ooFkw6QlMnlvyHPMkqAZUDaOHH8dktzbob5WevQsYXQ=";
   };
 
-  cargoSha256 = "sha256-Gv7C4NFThNawhT+IYO0ZbpOh6w/yPeIJKZjzTyM/GJw=";
+  cargoSha256 = "sha256-MgtFNrSjSvyjp1uD/OueSh+MCYSvZCyDabP20pI/8HI=";
 
   meta = with lib; {
     description = "Count the number of lines of LLVM IR across all instantiations of a generic function";
diff --git a/pkgs/games/minecraft-servers/versions.json b/pkgs/games/minecraft-servers/versions.json
index ba0b652a6bdc..af1b032bd781 100644
--- a/pkgs/games/minecraft-servers/versions.json
+++ b/pkgs/games/minecraft-servers/versions.json
@@ -1,8 +1,8 @@
 {
   "1.18": {
-    "url": "https://launcher.mojang.com/v1/objects/125e5adf40c659fd3bce3e66e67a16bb49ecc1b9/server.jar",
-    "sha1": "125e5adf40c659fd3bce3e66e67a16bb49ecc1b9",
-    "version": "1.18.1",
+    "url": "https://launcher.mojang.com/v1/objects/c8f83c5655308435b3dcf03c06d9fe8740a77469/server.jar",
+    "sha1": "c8f83c5655308435b3dcf03c06d9fe8740a77469",
+    "version": "1.18.2",
     "javaVersion": 17
   },
   "1.17": {
diff --git a/pkgs/games/steam/fhsenv.nix b/pkgs/games/steam/fhsenv.nix
index e54e87bf48b8..bd0abf48bb53 100644
--- a/pkgs/games/steam/fhsenv.nix
+++ b/pkgs/games/steam/fhsenv.nix
@@ -274,7 +274,7 @@ in buildFHSUserEnv rec {
     name = "steam-run";
 
     targetPkgs = commonTargetPkgs;
-    inherit multiPkgs extraBuildCommands profile;
+    inherit multiPkgs extraBuildCommands profile extraInstallCommands;
 
     inherit unshareIpc unsharePid;
 
diff --git a/pkgs/os-specific/linux/kernel/hardened/patches.json b/pkgs/os-specific/linux/kernel/hardened/patches.json
index 2a923ee57836..cdb6099d4a17 100644
--- a/pkgs/os-specific/linux/kernel/hardened/patches.json
+++ b/pkgs/os-specific/linux/kernel/hardened/patches.json
@@ -2,51 +2,51 @@
     "4.14": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-4.14.267-hardened1.patch",
-            "sha256": "0fd3x22j8i3w3knilh8v6sadw3pvl03vfzg9dpi2mgy6kxxxb3qv",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.14.267-hardened1/linux-hardened-4.14.267-hardened1.patch"
+            "name": "linux-hardened-4.14.269-hardened1.patch",
+            "sha256": "1hj3yn70aifprcfz4k088pj0lbr92cl5y840g08p0cqz3f3jvf24",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.14.269-hardened1/linux-hardened-4.14.269-hardened1.patch"
         },
-        "sha256": "13hq4hcq686gdragjcgmz3m0kkk8abz5lna0ildaa9gybj43yd4c",
-        "version": "4.14.267"
+        "sha256": "1lhqq3va468k8w5f4hhsq1rgjcfrgi5l8lnrikfy9jisbi05z9h3",
+        "version": "4.14.269"
     },
     "4.19": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-4.19.230-hardened1.patch",
-            "sha256": "1yf65n69rlhl0cdgaaj45ylsjf8x4xrbvj0wfxfwd2kxwbjxp9jr",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.19.230-hardened1/linux-hardened-4.19.230-hardened1.patch"
+            "name": "linux-hardened-4.19.232-hardened1.patch",
+            "sha256": "195gbiial5rpiak4mszw3kn1dmm38npk2bchyb9lfvk1f26h2ybc",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.19.232-hardened1/linux-hardened-4.19.232-hardened1.patch"
         },
-        "sha256": "107sqv4izdnazscwhyam88vbinsvnd33z8agn4awc42hkqh9l20p",
-        "version": "4.19.230"
+        "sha256": "0b520cwwqr5b1skc3gbq35hfjqpidxcl3gq7x5bdqqqdg0afiksg",
+        "version": "4.19.232"
     },
     "5.10": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-5.10.101-hardened1.patch",
-            "sha256": "1nhxkzkhqff97lhc0piczn8v02hyva5gm004l79v31xklxhpc9r0",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.10.101-hardened1/linux-hardened-5.10.101-hardened1.patch"
+            "name": "linux-hardened-5.10.103-hardened1.patch",
+            "sha256": "0i70cya9llz6nnhf4d5zz3f8xhj21si8capymmzcjczz0378argj",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.10.103-hardened1/linux-hardened-5.10.103-hardened1.patch"
         },
-        "sha256": "13hwpb85dynbayghxs3ln3hbyh8djgl5fj63vxwc8izfny62aj87",
-        "version": "5.10.101"
+        "sha256": "02jq126r8dgqrhgdg8dym2v8xgp9jkjm8kf9zgj440s3wrasvf2g",
+        "version": "5.10.103"
     },
     "5.15": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-5.15.24-hardened1.patch",
-            "sha256": "1lz4p2rvp1q9c4s6czqvwlhb2gkcix8vmg9gcyd4vpzjmd0dhws4",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.15.24-hardened1/linux-hardened-5.15.24-hardened1.patch"
+            "name": "linux-hardened-5.15.26-hardened1.patch",
+            "sha256": "14pdmiqnn06by8mvxw4gklqfrnngrimyz1ag76pr60iz6ka6y5g8",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.15.26-hardened1/linux-hardened-5.15.26-hardened1.patch"
         },
-        "sha256": "0zx9big7n8gh6y14c05llxsqh543q0czjdrq906m8cc7r01yp5pl",
-        "version": "5.15.24"
+        "sha256": "0fmydc5v51iacd5ys7p1m1k2318p47prj8xv02rcngv1y8s224jq",
+        "version": "5.15.26"
     },
     "5.4": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-5.4.180-hardened1.patch",
-            "sha256": "1cjxi6i8l5s2q54jiqpki4m25w9wp91yrbck86sxfr2ljhll0j1c",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.4.180-hardened1/linux-hardened-5.4.180-hardened1.patch"
+            "name": "linux-hardened-5.4.182-hardened1.patch",
+            "sha256": "0hcxy2hn836mivydmrbqrpvm4bfdsgf9xpx0iyz92rhd91ipgcyq",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.4.182-hardened1/linux-hardened-5.4.182-hardened1.patch"
         },
-        "sha256": "07ckmgcqpr39bzpp8v60b2vkb03p8931k7sl3ywg6f00lvcbaf8n",
-        "version": "5.4.180"
+        "sha256": "03gly4ivsdahixmshi021al48ycsalx30vsxr3iyj47hchgj1wdj",
+        "version": "5.4.182"
     }
 }
diff --git a/pkgs/os-specific/linux/kernel/linux-4.14.nix b/pkgs/os-specific/linux/kernel/linux-4.14.nix
index 8e00263a2e14..85b5532db881 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.14.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.14.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "4.14.268";
+  version = "4.14.269";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "1xdn247j5n3xzm93wr9ff75rg9hbp64ypfp5sf78hnkzm8m44qng";
+    sha256 = "1lhqq3va468k8w5f4hhsq1rgjcfrgi5l8lnrikfy9jisbi05z9h3";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-4.19.nix b/pkgs/os-specific/linux/kernel/linux-4.19.nix
index 56af836e8d95..0d3aabde3134 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.19.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.19.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "4.19.231";
+  version = "4.19.232";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "0cc1ipar37gvzr1xdbda5hghnvjmy8pk8an8hs2jspmhnfrj6cb7";
+    sha256 = "0b520cwwqr5b1skc3gbq35hfjqpidxcl3gq7x5bdqqqdg0afiksg";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-4.9.nix b/pkgs/os-specific/linux/kernel/linux-4.9.nix
index 83179c4bbe2b..920128b90454 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.9.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.9.nix
@@ -1,12 +1,12 @@
 { buildPackages, fetchurl, perl, buildLinux, nixosTests, stdenv, ... } @ args:
 
 buildLinux (args // rec {
-  version = "4.9.303";
+  version = "4.9.304";
   extraMeta.branch = "4.9";
   extraMeta.broken = stdenv.isAarch64;
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "1r8s28ckmg0av9716350hadn99q738k2slciw8pzxw1xq47hbsa5";
+    sha256 = "099bkypbkb8an8jsl49f83kg6ic1yw9ssfc1qksaji1jparlnpi9";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-5.10.nix b/pkgs/os-specific/linux/kernel/linux-5.10.nix
index f87aa91b58d3..f5fb4144814a 100644
--- a/pkgs/os-specific/linux/kernel/linux-5.10.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.10.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "5.10.102";
+  version = "5.10.103";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "0yg3y2cb3lb0whxkdrgbdig0kwjf5c71ci473aj0dr62n6alhhg6";
+    sha256 = "02jq126r8dgqrhgdg8dym2v8xgp9jkjm8kf9zgj440s3wrasvf2g";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-5.15.nix b/pkgs/os-specific/linux/kernel/linux-5.15.nix
index e02262c79a47..472b1f58d38e 100644
--- a/pkgs/os-specific/linux/kernel/linux-5.15.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.15.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "5.15.25";
+  version = "5.15.26";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -15,6 +15,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "0y9qahkya5dfnr6g04w5ym0p6h9ixmcdhvgz9g2b64aaaazgz6a3";
+    sha256 = "0fmydc5v51iacd5ys7p1m1k2318p47prj8xv02rcngv1y8s224jq";
   };
 } // (args.argsOverride or { }))
diff --git a/pkgs/os-specific/linux/kernel/linux-5.16.nix b/pkgs/os-specific/linux/kernel/linux-5.16.nix
index 8144bb2df502..e7c755d68245 100644
--- a/pkgs/os-specific/linux/kernel/linux-5.16.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.16.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "5.16.11";
+  version = "5.16.12";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "08xhm3ngg9157r69v44akp6cj73g33l6wa7073s4sjn4lic6263d";
+    sha256 = "1wnpn5w0rfniy60m2a25wjm3flvpzvs2z1s4ga01b9qhbbqisnmv";
   };
 } // (args.argsOverride or { }))
diff --git a/pkgs/os-specific/linux/kernel/linux-5.4.nix b/pkgs/os-specific/linux/kernel/linux-5.4.nix
index 239f5181a382..b99c51e8e025 100644
--- a/pkgs/os-specific/linux/kernel/linux-5.4.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.4.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "5.4.181";
+  version = "5.4.182";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "0awsv38cclk7npp6q7kb5n0dsdic3k8xnqdsz780yl92dh6s0qzw";
+    sha256 = "03gly4ivsdahixmshi021al48ycsalx30vsxr3iyj47hchgj1wdj";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/rtl88x2bu/default.nix b/pkgs/os-specific/linux/rtl88x2bu/default.nix
index 310dac3933f1..31d8f50a5288 100644
--- a/pkgs/os-specific/linux/rtl88x2bu/default.nix
+++ b/pkgs/os-specific/linux/rtl88x2bu/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "rtl88x2bu";
-  version = "${kernel.version}-unstable-2021-11-04";
+  version = "${kernel.version}-unstable-2022-02-22";
 
   src = fetchFromGitHub {
     owner = "morrownr";
-    repo = "88x2bu";
-    rev = "745d134080b74b92389ffe59c03dcfd6658f8655";
-    sha256 = "0f1hsfdw3ar78kqzr4hi04kpp5wnx0hd29f9rm698k0drxaw1g44";
+    repo = "88x2bu-20210702";
+    rev = "6a5b7f005c071ffa179b6183ee034c98ed30db80";
+    sha256 = "sha256-BqTyJpICW3D4EfHHoN5svasteJnunu2Uz449u/CmNE0=";
   };
 
   hardeningDisable = [ "pic" ];
@@ -32,7 +32,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "Realtek rtl88x2bu driver";
-    homepage = "https://github.com/morrownr/88x2bu";
+    homepage = "https://github.com/morrownr/88x2bu-20210702";
     license = licenses.gpl2Only;
     platforms = platforms.linux;
     maintainers = [ maintainers.ralith ];
diff --git a/pkgs/servers/endlessh-go/default.nix b/pkgs/servers/endlessh-go/default.nix
new file mode 100644
index 000000000000..ba0dc66a7405
--- /dev/null
+++ b/pkgs/servers/endlessh-go/default.nix
@@ -0,0 +1,22 @@
+{ buildGoModule, fetchFromGitHub, lib }:
+
+buildGoModule rec {
+  pname = "endlessh-go";
+  version = "20220213";
+
+  src = fetchFromGitHub {
+    owner = "shizunge";
+    repo = "endlessh-go";
+    rev = version;
+    sha256 = "sha256-x/38w0GtzYBGWr0ZkfY2HmDEAUI54R833aH0RZSCTC0=";
+  };
+  vendorSha256 = "sha256-h/DpbXO+LUsB9NOAXUfNx3VOfEsiolfBEMBrAqVlU3A=";
+  proxyVendor = true;
+
+  meta = with lib; {
+    homepage = "https://github.com/shizunge/endlessh-go";
+    description = "An implementation of endlessh exporting Prometheus metrics";
+    license = licenses.gpl3;
+    maintainers = with maintainers; [ azahi ];
+  };
+}
diff --git a/pkgs/servers/http/envoy/0001-quiche-update-QUICHE-tar-13949.patch b/pkgs/servers/http/envoy/0001-quiche-update-QUICHE-tar-13949.patch
deleted file mode 100644
index 4bf0a0d0e95d..000000000000
--- a/pkgs/servers/http/envoy/0001-quiche-update-QUICHE-tar-13949.patch
+++ /dev/null
@@ -1,2980 +0,0 @@
-From 97d7c456e03d4a11157fac17c7b8cbcee1d8a657 Mon Sep 17 00:00:00 2001
-From: danzh <danzh2010@users.noreply.github.com>
-Date: Mon, 16 Nov 2020 14:27:13 -0500
-Subject: [PATCH] quiche: update QUICHE tar (#13949)
-
-Signed-off-by: Dan Zhang <danzh@google.com>
----
- bazel/envoy_internal.bzl                      |   2 +
- bazel/external/quiche.BUILD                   |  85 +--
- bazel/repository_locations.bzl                |   6 +-
- source/extensions/quic_listeners/quiche/BUILD |   1 +
- .../quiche/active_quic_listener.cc            |   2 +-
- .../quiche/envoy_quic_client_connection.cc    |   2 +-
- .../quiche/envoy_quic_client_stream.cc        |   1 +
- .../quiche/envoy_quic_connection.cc           |   6 +-
- .../quiche/envoy_quic_connection.h            |   1 +
- .../quiche/envoy_quic_dispatcher.cc           |   6 +-
- .../quiche/envoy_quic_dispatcher.h            |   2 +-
- .../quiche/envoy_quic_proof_source.cc         |   2 +-
- .../quiche/envoy_quic_proof_source.h          |   2 +-
- .../quiche/envoy_quic_proof_source_base.cc    |   7 +-
- .../quiche/envoy_quic_proof_source_base.h     |   6 +-
- .../quiche/envoy_quic_proof_verifier_base.cc  |   4 +-
- .../quiche/envoy_quic_server_connection.cc    |  10 +-
- .../quiche/envoy_quic_server_connection.h     |   1 +
- .../quic_listeners/quiche/platform/BUILD      |  42 +-
- .../quiche/platform/flags_impl.cc             | 108 +++-
- .../quiche/platform/flags_impl.h              |  46 +-
- .../quiche/platform/flags_list.h              | 502 ------------------
- .../quiche/platform/http2_flags_impl.h        |   4 +-
- .../quiche/platform/quic_aligned_impl.h       |  18 -
- .../quiche/platform/quic_cert_utils_impl.cc   |  38 +-
- .../quiche/platform/quic_cert_utils_impl.h    |   9 +-
- .../quiche/platform/quic_fallthrough_impl.h   |  11 -
- .../quiche/platform/quic_file_utils_impl.cc   |   4 +-
- .../quiche/platform/quic_file_utils_impl.h    |   6 +-
- .../quiche/platform/quic_flags_impl.h         |   6 +-
- .../platform/quic_hostname_utils_impl.cc      |   6 +-
- .../platform/quic_hostname_utils_impl.h       |   8 +-
- .../quiche/platform/quic_macros_impl.h        |  13 -
- .../platform/quic_mem_slice_span_impl.cc      |   3 +-
- .../platform/quic_mem_slice_span_impl.h       |   9 +-
- ..._ptr_util_impl.h => quic_testvalue_impl.h} |  11 +-
- .../platform/quic_udp_socket_platform_impl.h  |   3 +
- .../quiche/platform/quiche_arraysize_impl.h   |  11 -
- .../quiche/platform/quiche_optional_impl.h    |  17 -
- .../quiche/platform/quiche_text_utils_impl.h  |  63 +--
- .../quiche/platform/quiche_time_utils_impl.cc |   4 +-
- .../quiche/platform/quiche_time_utils_impl.h  |   4 +-
- .../platform/spdy_endianness_util_impl.h      |  29 -
- .../quiche/platform/spdy_flags_impl.h         |   4 +-
- .../quiche/platform/spdy_string_utils_impl.h  |   2 +-
- .../spdy_server_push_utils_for_envoy.cc       |  10 +-
- .../quiche/envoy_quic_client_session_test.cc  |   2 +-
- .../quiche/envoy_quic_client_stream_test.cc   |  44 +-
- .../quiche/envoy_quic_proof_source_test.cc    |   6 +-
- .../quiche/envoy_quic_proof_verifier_test.cc  |   8 +-
- .../quiche/envoy_quic_server_session_test.cc  |   3 +-
- .../quiche/envoy_quic_server_stream_test.cc   |  53 +-
- .../quic_listeners/quiche/platform/BUILD      |  22 -
- .../quiche/platform/http2_platform_test.cc    |  22 +-
- .../quiche/platform/quic_platform_test.cc     |  61 +--
- .../quiche/platform/quic_test_output_impl.cc  |  15 +-
- .../quiche/platform/quic_test_output_impl.h   |  12 +-
- .../quiche/platform/quiche_platform_test.cc   |  39 --
- .../quiche/platform/spdy_platform_test.cc     |  20 +-
- .../quic_listeners/quiche/test_proof_source.h |   2 +-
- .../quic_listeners/quiche/test_utils.h        |   4 +-
- 61 files changed, 396 insertions(+), 1054 deletions(-)
- delete mode 100644 source/extensions/quic_listeners/quiche/platform/flags_list.h
- delete mode 100644 source/extensions/quic_listeners/quiche/platform/quic_aligned_impl.h
- delete mode 100644 source/extensions/quic_listeners/quiche/platform/quic_fallthrough_impl.h
- delete mode 100644 source/extensions/quic_listeners/quiche/platform/quic_macros_impl.h
- rename source/extensions/quic_listeners/quiche/platform/{quiche_ptr_util_impl.h => quic_testvalue_impl.h} (52%)
- delete mode 100644 source/extensions/quic_listeners/quiche/platform/quiche_arraysize_impl.h
- delete mode 100644 source/extensions/quic_listeners/quiche/platform/quiche_optional_impl.h
- delete mode 100644 source/extensions/quic_listeners/quiche/platform/spdy_endianness_util_impl.h
- delete mode 100644 test/extensions/quic_listeners/quiche/platform/quiche_platform_test.cc
-
-diff --git a/bazel/envoy_internal.bzl b/bazel/envoy_internal.bzl
-index 5ad86609a..3f9ddfd23 100644
---- a/bazel/envoy_internal.bzl
-+++ b/bazel/envoy_internal.bzl
-@@ -54,6 +54,8 @@ def envoy_copts(repository, test = False):
-            }) + select({
-                repository + "//bazel:clang_build": ["-fno-limit-debug-info", "-Wgnu-conditional-omitted-operand", "-Wc++2a-extensions", "-Wrange-loop-analysis"],
-                repository + "//bazel:gcc_build": ["-Wno-maybe-uninitialized"],
-+               # TODO: Replace with /Zc:preprocessor for cl.exe versions >= 16.5
-+               repository + "//bazel:windows_x86_64": ["-experimental:preprocessor", "-Wv:19.4"],
-                "//conditions:default": [],
-            }) + select({
-                repository + "//bazel:no_debug_info": ["-g0"],
-diff --git a/bazel/external/quiche.BUILD b/bazel/external/quiche.BUILD
-index 7541909aa..b6b208fc5 100644
---- a/bazel/external/quiche.BUILD
-+++ b/bazel/external/quiche.BUILD
-@@ -57,16 +57,12 @@ quiche_common_copts = [
-     "-Wno-unused-function",
-     # quic_inlined_frame.h uses offsetof() to optimize memory usage in frames.
-     "-Wno-invalid-offsetof",
--    "-Wno-range-loop-analysis",
- ]
- 
- quiche_copts = select({
-     # Ignore unguarded #pragma GCC statements in QUICHE sources
-     "@envoy//bazel:windows_x86_64": ["-wd4068"],
-     # Remove these after upstream fix.
--    "@envoy//bazel:gcc_build": [
--        "-Wno-sign-compare",
--    ] + quiche_common_copts,
-     "//conditions:default": quiche_common_copts,
- })
- 
-@@ -737,7 +733,6 @@ envoy_cc_library(
-     hdrs = [
-         "quiche/spdy/platform/api/spdy_bug_tracker.h",
-         "quiche/spdy/platform/api/spdy_containers.h",
--        "quiche/spdy/platform/api/spdy_endianness_util.h",
-         "quiche/spdy/platform/api/spdy_estimate_memory_usage.h",
-         "quiche/spdy/platform/api/spdy_flags.h",
-         "quiche/spdy/platform/api/spdy_logging.h",
-@@ -935,6 +930,7 @@ envoy_cc_library(
-     copts = quiche_copts,
-     repository = "@envoy",
-     deps = [
-+        ":http2_hpack_huffman_hpack_huffman_encoder_lib",
-         ":spdy_core_protocol_lib",
-         ":spdy_platform",
-     ],
-@@ -1049,19 +1045,16 @@ envoy_cc_library(
- envoy_cc_library(
-     name = "quic_platform_base",
-     hdrs = [
--        "quiche/quic/platform/api/quic_aligned.h",
-         "quiche/quic/platform/api/quic_bug_tracker.h",
-         "quiche/quic/platform/api/quic_client_stats.h",
-         "quiche/quic/platform/api/quic_containers.h",
-         "quiche/quic/platform/api/quic_error_code_wrappers.h",
-         "quiche/quic/platform/api/quic_estimate_memory_usage.h",
-         "quiche/quic/platform/api/quic_exported_stats.h",
--        "quiche/quic/platform/api/quic_fallthrough.h",
-         "quiche/quic/platform/api/quic_flag_utils.h",
-         "quiche/quic/platform/api/quic_flags.h",
-         "quiche/quic/platform/api/quic_iovec.h",
-         "quiche/quic/platform/api/quic_logging.h",
--        "quiche/quic/platform/api/quic_macros.h",
-         "quiche/quic/platform/api/quic_map_util.h",
-         "quiche/quic/platform/api/quic_mem_slice.h",
-         "quiche/quic/platform/api/quic_prefetch.h",
-@@ -1072,6 +1065,7 @@ envoy_cc_library(
-         "quiche/quic/platform/api/quic_stream_buffer_allocator.h",
-         "quiche/quic/platform/api/quic_string_utils.h",
-         "quiche/quic/platform/api/quic_uint128.h",
-+        "quiche/quic/platform/api/quic_testvalue.h",
-         # TODO: uncomment the following files as implementations are added.
-         # "quiche/quic/platform/api/quic_fuzzed_data_provider.h",
-         # "quiche/quic/platform/api/quic_test_loopback.h",
-@@ -1147,7 +1141,6 @@ envoy_cc_test_library(
-     hdrs = ["quiche/quic/platform/api/quic_port_utils.h"],
-     repository = "@envoy",
-     tags = ["nofips"],
--    deps = ["@envoy//test/extensions/quic_listeners/quiche/platform:quic_platform_port_utils_impl_lib"],
- )
- 
- envoy_cc_library(
-@@ -1216,15 +1209,14 @@ envoy_cc_test_library(
- )
- 
- envoy_cc_library(
--    name = "quiche_common_platform_endian",
--    hdrs = ["quiche/common/platform/api/quiche_endian.h"],
-+    name = "quiche_common_endian_lib",
-+    hdrs = ["quiche/common/quiche_endian.h"],
-     repository = "@envoy",
-     tags = ["nofips"],
-     visibility = ["//visibility:public"],
-     deps =
-         [
-             ":quiche_common_platform_export",
--            "@envoy//source/extensions/quic_listeners/quiche/platform:quiche_common_platform_endian_impl_lib",
-         ],
- )
- 
-@@ -1932,6 +1924,7 @@ envoy_cc_library(
-     visibility = ["//visibility:public"],
-     deps = [
-         ":quic_core_clock_lib",
-+        ":quic_core_crypto_certificate_view_lib",
-         ":quic_core_crypto_encryption_lib",
-         ":quic_core_crypto_hkdf_lib",
-         ":quic_core_crypto_proof_source_interface_lib",
-@@ -2167,6 +2160,15 @@ envoy_cc_library(
-     ],
- )
- 
-+envoy_cc_library(
-+    name = "quic_core_flags_list_lib",
-+    hdrs = ["quiche/quic/core/quic_flags_list.h"],
-+    copts = quiche_copts,
-+    repository = "@envoy",
-+    tags = ["nofips"],
-+    visibility = ["//visibility:public"],
-+)
-+
- envoy_cc_library(
-     name = "quic_core_framer_lib",
-     srcs = ["quiche/quic/core/quic_framer.cc"],
-@@ -2339,6 +2341,7 @@ envoy_cc_library(
-     repository = "@envoy",
-     tags = ["nofips"],
-     deps = [
-+        ":http2_constants_lib",
-         ":quic_core_data_lib",
-         ":quic_core_error_codes_lib",
-         ":quic_core_http_http_frames_lib",
-@@ -2723,6 +2726,27 @@ envoy_cc_library(
-     ],
- )
- 
-+envoy_cc_library(
-+    name = "quic_core_path_validator_lib",
-+    srcs = ["quiche/quic/core/quic_path_validator.cc"],
-+    hdrs = ["quiche/quic/core/quic_path_validator.h"],
-+    copts = quiche_copts,
-+    repository = "@envoy",
-+    tags = ["nofips"],
-+    deps = [
-+        ":quic_core_alarm_factory_interface_lib",
-+        ":quic_core_alarm_interface_lib",
-+        ":quic_core_arena_scoped_ptr_lib",
-+        ":quic_core_clock_lib",
-+        ":quic_core_constants_lib",
-+        ":quic_core_crypto_random_lib",
-+        ":quic_core_one_block_arena_lib",
-+        ":quic_core_packet_writer_interface_lib",
-+        ":quic_core_types_lib",
-+        ":quic_platform",
-+    ],
-+)
-+
- envoy_cc_library(
-     name = "quic_core_process_packet_interface_lib",
-     hdrs = ["quiche/quic/core/quic_process_packet_interface.h"],
-@@ -2735,6 +2759,15 @@ envoy_cc_library(
-     ],
- )
- 
-+envoy_cc_library(
-+    name = "quic_core_protocol_flags_list_lib",
-+    hdrs = ["quiche/quic/core/quic_protocol_flags_list.h"],
-+    copts = quiche_copts,
-+    repository = "@envoy",
-+    tags = ["nofips"],
-+    visibility = ["//visibility:public"],
-+)
-+
- envoy_cc_library(
-     name = "quic_core_qpack_blocking_manager_lib",
-     srcs = ["quiche/quic/core/qpack/qpack_blocking_manager.cc"],
-@@ -2896,6 +2929,7 @@ envoy_cc_library(
-     deps = [
-         ":http2_decoder_decode_buffer_lib",
-         ":http2_decoder_decode_status_lib",
-+        ":quic_core_error_codes_lib",
-         ":quic_core_qpack_qpack_instruction_decoder_lib",
-         ":quic_core_qpack_qpack_instructions_lib",
-         ":quic_core_qpack_qpack_stream_receiver_lib",
-@@ -3368,7 +3402,7 @@ envoy_cc_library(
-         ":quic_core_error_codes_lib",
-         ":quic_core_time_lib",
-         ":quic_platform_base",
--        ":quiche_common_platform_endian",
-+        ":quiche_common_endian_lib",
-     ],
- )
- 
-@@ -3420,6 +3454,7 @@ envoy_cc_library(
-     repository = "@envoy",
-     tags = ["nofips"],
-     deps = [
-+        ":quic_core_circular_deque_lib",
-         ":quic_core_connection_stats_lib",
-         ":quic_core_packets_lib",
-         ":quic_core_session_notifier_interface_lib",
-@@ -3459,6 +3494,7 @@ envoy_cc_library(
-     deps = [
-         ":quic_core_versions_lib",
-         ":quic_platform_base",
-+        ":quiche_common_endian_lib",
-     ],
- )
- 
-@@ -3475,7 +3511,6 @@ envoy_cc_library(
-         ":quic_core_tag_lib",
-         ":quic_core_types_lib",
-         ":quic_platform_base",
--        ":quiche_common_platform_endian",
-     ],
- )
- 
-@@ -3746,6 +3781,7 @@ envoy_cc_test_library(
-         ":quic_core_packet_creator_lib",
-         ":quic_core_packet_writer_interface_lib",
-         ":quic_core_packets_lib",
-+        ":quic_core_path_validator_lib",
-         ":quic_core_received_packet_manager_lib",
-         ":quic_core_sent_packet_manager_lib",
-         ":quic_core_server_id_lib",
-@@ -3836,25 +3872,10 @@ envoy_cc_test_library(
-     deps = [":epoll_server_platform"],
- )
- 
--envoy_cc_library(
--    name = "quiche_common_platform_optional",
--    hdrs = ["quiche/common/platform/api/quiche_optional.h"],
--    repository = "@envoy",
--    tags = ["nofips"],
--    visibility = ["//visibility:public"],
--    deps = [
--        ":quiche_common_platform_export",
--        "@envoy//source/extensions/quic_listeners/quiche/platform:quiche_common_platform_optional_impl_lib",
--    ],
--)
--
- envoy_cc_library(
-     name = "quiche_common_platform",
-     hdrs = [
--        "quiche/common/platform/api/quiche_arraysize.h",
-         "quiche/common/platform/api/quiche_logging.h",
--        "quiche/common/platform/api/quiche_optional.h",
--        "quiche/common/platform/api/quiche_ptr_util.h",
-         "quiche/common/platform/api/quiche_str_cat.h",
-         "quiche/common/platform/api/quiche_string_piece.h",
-         "quiche/common/platform/api/quiche_text_utils.h",
-@@ -3866,7 +3887,6 @@ envoy_cc_library(
-     visibility = ["//visibility:public"],
-     deps = [
-         ":quiche_common_platform_export",
--        ":quiche_common_platform_optional",
-         "@envoy//source/extensions/quic_listeners/quiche/platform:quiche_common_platform_impl_lib",
-     ],
- )
-@@ -3874,7 +3894,6 @@ envoy_cc_library(
- envoy_cc_test_library(
-     name = "quiche_common_platform_test",
-     srcs = [
--        "quiche/common/platform/api/quiche_endian_test.cc",
-         "quiche/common/platform/api/quiche_str_cat_test.cc",
-         "quiche/common/platform/api/quiche_text_utils_test.cc",
-         "quiche/common/platform/api/quiche_time_utils_test.cc",
-@@ -3884,7 +3903,6 @@ envoy_cc_test_library(
-     tags = ["nofips"],
-     deps = [
-         ":quiche_common_platform",
--        ":quiche_common_platform_endian",
-         "@envoy//test/extensions/quic_listeners/quiche/platform:quiche_common_platform_test_impl_lib",
-     ],
- )
-@@ -3904,8 +3922,8 @@ envoy_cc_library(
-     tags = ["nofips"],
-     visibility = ["//visibility:public"],
-     deps = [
-+        ":quiche_common_endian_lib",
-         ":quiche_common_platform",
--        ":quiche_common_platform_endian",
-     ],
- )
- 
-@@ -3944,6 +3962,7 @@ envoy_cc_test(
-     deps = [
-         ":http2_platform",
-         ":http2_test_tools_random",
-+        ":quiche_common_test_tools_test_utils_lib",
-     ],
- )
- 
-diff --git a/bazel/repository_locations.bzl b/bazel/repository_locations.bzl
-index 6eba5a821..19ddc76e8 100644
---- a/bazel/repository_locations.bzl
-+++ b/bazel/repository_locations.bzl
-@@ -671,9 +671,9 @@ DEPENDENCY_REPOSITORIES_SPEC = dict(
-         project_name = "QUICHE",
-         project_desc = "QUICHE (QUIC, HTTP/2, Etc) is Google‘s implementation of QUIC and related protocols",
-         project_url = "https://quiche.googlesource.com/quiche",
--        # Static snapshot of https://quiche.googlesource.com/quiche/+archive/f555d99a084cdd086a349548c70fb558ac5847cf.tar.gz
--        version = "f555d99a084cdd086a349548c70fb558ac5847cf",
--        sha256 = "1833f08e7b0f18b49d7498b029b7f3e6559a82113ec82a98a9e945553756e351",
-+        # Static snapshot of https://quiche.googlesource.com/quiche/+archive/ecc28c0d7428f3323ea26eb1ddb98a5e06b23dea.tar.gz
-+        version = "ecc28c0d7428f3323ea26eb1ddb98a5e06b23dea",
-+        sha256 = "52680dea984dbe899c27176155578b97276e1f1516b7c3a63fb16ba593061859",
-         urls = ["https://storage.googleapis.com/quiche-envoy-integration/{version}.tar.gz"],
-         use_category = ["dataplane_ext"],
-         extensions = ["envoy.transport_sockets.quic"],
-diff --git a/source/extensions/quic_listeners/quiche/BUILD b/source/extensions/quic_listeners/quiche/BUILD
-index 29eb78d15..a90cfde6d 100644
---- a/source/extensions/quic_listeners/quiche/BUILD
-+++ b/source/extensions/quic_listeners/quiche/BUILD
-@@ -212,6 +212,7 @@ envoy_cc_library(
-         "//source/common/buffer:buffer_lib",
-         "//source/common/common:assert_lib",
-         "//source/common/http:header_map_lib",
-+        "//source/common/http:header_utility_lib",
-         "//source/extensions/quic_listeners/quiche/platform:quic_platform_mem_slice_storage_impl_lib",
-         "@com_googlesource_quiche//:quic_core_http_client_lib",
-     ],
-diff --git a/source/extensions/quic_listeners/quiche/active_quic_listener.cc b/source/extensions/quic_listeners/quiche/active_quic_listener.cc
-index f4808adc5..86912292a 100644
---- a/source/extensions/quic_listeners/quiche/active_quic_listener.cc
-+++ b/source/extensions/quic_listeners/quiche/active_quic_listener.cc
-@@ -55,7 +55,7 @@ ActiveQuicListener::ActiveQuicListener(
-   quic::QuicRandom* const random = quic::QuicRandom::GetInstance();
-   random->RandBytes(random_seed_, sizeof(random_seed_));
-   crypto_config_ = std::make_unique<quic::QuicCryptoServerConfig>(
--      quiche::QuicheStringPiece(reinterpret_cast<char*>(random_seed_), sizeof(random_seed_)),
-+      absl::string_view(reinterpret_cast<char*>(random_seed_), sizeof(random_seed_)),
-       quic::QuicRandom::GetInstance(),
-       std::make_unique<EnvoyQuicProofSource>(listen_socket_, listener_config.filterChainManager(),
-                                              stats_),
-diff --git a/source/extensions/quic_listeners/quiche/envoy_quic_client_connection.cc b/source/extensions/quic_listeners/quiche/envoy_quic_client_connection.cc
-index e79b08ad9..95d63729d 100644
---- a/source/extensions/quic_listeners/quiche/envoy_quic_client_connection.cc
-+++ b/source/extensions/quic_listeners/quiche/envoy_quic_client_connection.cc
-@@ -43,7 +43,7 @@ EnvoyQuicClientConnection::EnvoyQuicClientConnection(
-     const quic::ParsedQuicVersionVector& supported_versions, Event::Dispatcher& dispatcher,
-     Network::ConnectionSocketPtr&& connection_socket)
-     : EnvoyQuicConnection(
--          server_connection_id,
-+          server_connection_id, quic::QuicSocketAddress(),
-           envoyIpAddressToQuicSocketAddress(connection_socket->remoteAddress()->ip()), helper,
-           alarm_factory, writer, owns_writer, quic::Perspective::IS_CLIENT, supported_versions,
-           std::move(connection_socket)),
-diff --git a/source/extensions/quic_listeners/quiche/envoy_quic_client_stream.cc b/source/extensions/quic_listeners/quiche/envoy_quic_client_stream.cc
-index 866e35416..a759b26b1 100644
---- a/source/extensions/quic_listeners/quiche/envoy_quic_client_stream.cc
-+++ b/source/extensions/quic_listeners/quiche/envoy_quic_client_stream.cc
-@@ -20,6 +20,7 @@
- 
- #include "common/buffer/buffer_impl.h"
- #include "common/http/header_map_impl.h"
-+#include "common/http/header_utility.h"
- #include "common/common/assert.h"
- 
- namespace Envoy {
-diff --git a/source/extensions/quic_listeners/quiche/envoy_quic_connection.cc b/source/extensions/quic_listeners/quiche/envoy_quic_connection.cc
-index dcc311a6e..d813dfe4b 100644
---- a/source/extensions/quic_listeners/quiche/envoy_quic_connection.cc
-+++ b/source/extensions/quic_listeners/quiche/envoy_quic_connection.cc
-@@ -6,6 +6,7 @@ namespace Envoy {
- namespace Quic {
- 
- EnvoyQuicConnection::EnvoyQuicConnection(const quic::QuicConnectionId& server_connection_id,
-+                                         quic::QuicSocketAddress initial_self_address,
-                                          quic::QuicSocketAddress initial_peer_address,
-                                          quic::QuicConnectionHelperInterface& helper,
-                                          quic::QuicAlarmFactory& alarm_factory,
-@@ -13,8 +14,9 @@ EnvoyQuicConnection::EnvoyQuicConnection(const quic::QuicConnectionId& server_co
-                                          quic::Perspective perspective,
-                                          const quic::ParsedQuicVersionVector& supported_versions,
-                                          Network::ConnectionSocketPtr&& connection_socket)
--    : quic::QuicConnection(server_connection_id, initial_peer_address, &helper, &alarm_factory,
--                           writer, owns_writer, perspective, supported_versions),
-+    : quic::QuicConnection(server_connection_id, initial_self_address, initial_peer_address,
-+                           &helper, &alarm_factory, writer, owns_writer, perspective,
-+                           supported_versions),
-       connection_socket_(std::move(connection_socket)) {}
- 
- EnvoyQuicConnection::~EnvoyQuicConnection() { connection_socket_->close(); }
-diff --git a/source/extensions/quic_listeners/quiche/envoy_quic_connection.h b/source/extensions/quic_listeners/quiche/envoy_quic_connection.h
-index f4c8589d7..f8543bc93 100644
---- a/source/extensions/quic_listeners/quiche/envoy_quic_connection.h
-+++ b/source/extensions/quic_listeners/quiche/envoy_quic_connection.h
-@@ -26,6 +26,7 @@ class EnvoyQuicConnection : public quic::QuicConnection,
-                             protected Logger::Loggable<Logger::Id::connection> {
- public:
-   EnvoyQuicConnection(const quic::QuicConnectionId& server_connection_id,
-+                      quic::QuicSocketAddress initial_self_address,
-                       quic::QuicSocketAddress initial_peer_address,
-                       quic::QuicConnectionHelperInterface& helper,
-                       quic::QuicAlarmFactory& alarm_factory, quic::QuicPacketWriter* writer,
-diff --git a/source/extensions/quic_listeners/quiche/envoy_quic_dispatcher.cc b/source/extensions/quic_listeners/quiche/envoy_quic_dispatcher.cc
-index ba8f7f3a8..e6351f643 100644
---- a/source/extensions/quic_listeners/quiche/envoy_quic_dispatcher.cc
-+++ b/source/extensions/quic_listeners/quiche/envoy_quic_dispatcher.cc
-@@ -48,11 +48,11 @@ void EnvoyQuicDispatcher::OnConnectionClosed(quic::QuicConnectionId connection_i
- }
- 
- std::unique_ptr<quic::QuicSession> EnvoyQuicDispatcher::CreateQuicSession(
--    quic::QuicConnectionId server_connection_id, const quic::QuicSocketAddress& /*self_address*/,
--    const quic::QuicSocketAddress& peer_address, quiche::QuicheStringPiece /*alpn*/,
-+    quic::QuicConnectionId server_connection_id, const quic::QuicSocketAddress& self_address,
-+    const quic::QuicSocketAddress& peer_address, absl::string_view /*alpn*/,
-     const quic::ParsedQuicVersion& version) {
-   auto quic_connection = std::make_unique<EnvoyQuicServerConnection>(
--      server_connection_id, peer_address, *helper(), *alarm_factory(), writer(),
-+      server_connection_id, self_address, peer_address, *helper(), *alarm_factory(), writer(),
-       /*owns_writer=*/false, quic::ParsedQuicVersionVector{version}, listen_socket_);
-   auto quic_session = std::make_unique<EnvoyQuicServerSession>(
-       config(), quic::ParsedQuicVersionVector{version}, std::move(quic_connection), this,
-diff --git a/source/extensions/quic_listeners/quiche/envoy_quic_dispatcher.h b/source/extensions/quic_listeners/quiche/envoy_quic_dispatcher.h
-index 589ff5327..d59307f41 100644
---- a/source/extensions/quic_listeners/quiche/envoy_quic_dispatcher.h
-+++ b/source/extensions/quic_listeners/quiche/envoy_quic_dispatcher.h
-@@ -62,7 +62,7 @@ protected:
-   std::unique_ptr<quic::QuicSession>
-   CreateQuicSession(quic::QuicConnectionId server_connection_id,
-                     const quic::QuicSocketAddress& self_address,
--                    const quic::QuicSocketAddress& peer_address, quiche::QuicheStringPiece alpn,
-+                    const quic::QuicSocketAddress& peer_address, absl::string_view alpn,
-                     const quic::ParsedQuicVersion& version) override;
- 
- private:
-diff --git a/source/extensions/quic_listeners/quiche/envoy_quic_proof_source.cc b/source/extensions/quic_listeners/quiche/envoy_quic_proof_source.cc
-index 1f65e4e7e..967765829 100644
---- a/source/extensions/quic_listeners/quiche/envoy_quic_proof_source.cc
-+++ b/source/extensions/quic_listeners/quiche/envoy_quic_proof_source.cc
-@@ -36,7 +36,7 @@ EnvoyQuicProofSource::GetCertChain(const quic::QuicSocketAddress& server_address
- 
- void EnvoyQuicProofSource::signPayload(
-     const quic::QuicSocketAddress& server_address, const quic::QuicSocketAddress& client_address,
--    const std::string& hostname, uint16_t signature_algorithm, quiche::QuicheStringPiece in,
-+    const std::string& hostname, uint16_t signature_algorithm, absl::string_view in,
-     std::unique_ptr<quic::ProofSource::SignatureCallback> callback) {
-   CertConfigWithFilterChain res =
-       getTlsCertConfigAndFilterChain(server_address, client_address, hostname);
-diff --git a/source/extensions/quic_listeners/quiche/envoy_quic_proof_source.h b/source/extensions/quic_listeners/quiche/envoy_quic_proof_source.h
-index 6e1c74c92..e22bf3465 100644
---- a/source/extensions/quic_listeners/quiche/envoy_quic_proof_source.h
-+++ b/source/extensions/quic_listeners/quiche/envoy_quic_proof_source.h
-@@ -28,7 +28,7 @@ protected:
-   // quic::ProofSource
-   void signPayload(const quic::QuicSocketAddress& server_address,
-                    const quic::QuicSocketAddress& client_address, const std::string& hostname,
--                   uint16_t signature_algorithm, quiche::QuicheStringPiece in,
-+                   uint16_t signature_algorithm, absl::string_view in,
-                    std::unique_ptr<quic::ProofSource::SignatureCallback> callback) override;
- 
- private:
-diff --git a/source/extensions/quic_listeners/quiche/envoy_quic_proof_source_base.cc b/source/extensions/quic_listeners/quiche/envoy_quic_proof_source_base.cc
-index 2c82c04d9..9ad3cb07f 100644
---- a/source/extensions/quic_listeners/quiche/envoy_quic_proof_source_base.cc
-+++ b/source/extensions/quic_listeners/quiche/envoy_quic_proof_source_base.cc
-@@ -21,7 +21,7 @@ void EnvoyQuicProofSourceBase::GetProof(const quic::QuicSocketAddress& server_ad
-                                         const std::string& hostname,
-                                         const std::string& server_config,
-                                         quic::QuicTransportVersion /*transport_version*/,
--                                        quiche::QuicheStringPiece chlo_hash,
-+                                        absl::string_view chlo_hash,
-                                         std::unique_ptr<quic::ProofSource::Callback> callback) {
-   quic::QuicReferenceCountedPointer<quic::ProofSource::Chain> chain =
-       GetCertChain(server_address, client_address, hostname);
-@@ -68,13 +68,12 @@ void EnvoyQuicProofSourceBase::GetProof(const quic::QuicSocketAddress& server_ad
-   auto signature_callback = std::make_unique<SignatureCallback>(std::move(callback), chain);
- 
-   signPayload(server_address, client_address, hostname, sign_alg,
--              quiche::QuicheStringPiece(payload.get(), payload_size),
--              std::move(signature_callback));
-+              absl::string_view(payload.get(), payload_size), std::move(signature_callback));
- }
- 
- void EnvoyQuicProofSourceBase::ComputeTlsSignature(
-     const quic::QuicSocketAddress& server_address, const quic::QuicSocketAddress& client_address,
--    const std::string& hostname, uint16_t signature_algorithm, quiche::QuicheStringPiece in,
-+    const std::string& hostname, uint16_t signature_algorithm, absl::string_view in,
-     std::unique_ptr<quic::ProofSource::SignatureCallback> callback) {
-   signPayload(server_address, client_address, hostname, signature_algorithm, in,
-               std::move(callback));
-diff --git a/source/extensions/quic_listeners/quiche/envoy_quic_proof_source_base.h b/source/extensions/quic_listeners/quiche/envoy_quic_proof_source_base.h
-index b7d76981e..a9e7e8c3f 100644
---- a/source/extensions/quic_listeners/quiche/envoy_quic_proof_source_base.h
-+++ b/source/extensions/quic_listeners/quiche/envoy_quic_proof_source_base.h
-@@ -57,7 +57,7 @@ public:
-   void GetProof(const quic::QuicSocketAddress& server_address,
-                 const quic::QuicSocketAddress& client_address, const std::string& hostname,
-                 const std::string& server_config, quic::QuicTransportVersion /*transport_version*/,
--                quiche::QuicheStringPiece chlo_hash,
-+                absl::string_view chlo_hash,
-                 std::unique_ptr<quic::ProofSource::Callback> callback) override;
- 
-   TicketCrypter* GetTicketCrypter() override { return nullptr; }
-@@ -65,14 +65,14 @@ public:
-   void ComputeTlsSignature(const quic::QuicSocketAddress& server_address,
-                            const quic::QuicSocketAddress& client_address,
-                            const std::string& hostname, uint16_t signature_algorithm,
--                           quiche::QuicheStringPiece in,
-+                           absl::string_view in,
-                            std::unique_ptr<quic::ProofSource::SignatureCallback> callback) override;
- 
- protected:
-   virtual void signPayload(const quic::QuicSocketAddress& server_address,
-                            const quic::QuicSocketAddress& client_address,
-                            const std::string& hostname, uint16_t signature_algorithm,
--                           quiche::QuicheStringPiece in,
-+                           absl::string_view in,
-                            std::unique_ptr<quic::ProofSource::SignatureCallback> callback) PURE;
- 
- private:
-diff --git a/source/extensions/quic_listeners/quiche/envoy_quic_proof_verifier_base.cc b/source/extensions/quic_listeners/quiche/envoy_quic_proof_verifier_base.cc
-index 229b3ab36..e37590529 100644
---- a/source/extensions/quic_listeners/quiche/envoy_quic_proof_verifier_base.cc
-+++ b/source/extensions/quic_listeners/quiche/envoy_quic_proof_verifier_base.cc
-@@ -58,8 +58,8 @@ bool EnvoyQuicProofVerifierBase::verifySignature(const std::string& server_confi
-     *error_details = "QuicPacketWriter error.";
-     return false;
-   }
--  bool valid = cert_view->VerifySignature(quiche::QuicheStringPiece(payload.get(), payload_size),
--                                          signature, sign_alg);
-+  bool valid = cert_view->VerifySignature(absl::string_view(payload.get(), payload_size), signature,
-+                                          sign_alg);
-   if (!valid) {
-     *error_details = "Signature is not valid.";
-   }
-diff --git a/source/extensions/quic_listeners/quiche/envoy_quic_server_connection.cc b/source/extensions/quic_listeners/quiche/envoy_quic_server_connection.cc
-index b8fa94221..974c6c8eb 100644
---- a/source/extensions/quic_listeners/quiche/envoy_quic_server_connection.cc
-+++ b/source/extensions/quic_listeners/quiche/envoy_quic_server_connection.cc
-@@ -11,11 +11,13 @@ namespace Quic {
- 
- EnvoyQuicServerConnection::EnvoyQuicServerConnection(
-     const quic::QuicConnectionId& server_connection_id,
--    quic::QuicSocketAddress initial_peer_address, quic::QuicConnectionHelperInterface& helper,
--    quic::QuicAlarmFactory& alarm_factory, quic::QuicPacketWriter* writer, bool owns_writer,
-+    quic::QuicSocketAddress initial_self_address, quic::QuicSocketAddress initial_peer_address,
-+    quic::QuicConnectionHelperInterface& helper, quic::QuicAlarmFactory& alarm_factory,
-+    quic::QuicPacketWriter* writer, bool owns_writer,
-     const quic::ParsedQuicVersionVector& supported_versions, Network::Socket& listen_socket)
--    : EnvoyQuicConnection(server_connection_id, initial_peer_address, helper, alarm_factory, writer,
--                          owns_writer, quic::Perspective::IS_SERVER, supported_versions,
-+    : EnvoyQuicConnection(server_connection_id, initial_self_address, initial_peer_address, helper,
-+                          alarm_factory, writer, owns_writer, quic::Perspective::IS_SERVER,
-+                          supported_versions,
-                           std::make_unique<Network::ConnectionSocketImpl>(
-                               // Wraps the real IoHandle instance so that if the connection socket
-                               // gets closed, the real IoHandle won't be affected.
-diff --git a/source/extensions/quic_listeners/quiche/envoy_quic_server_connection.h b/source/extensions/quic_listeners/quiche/envoy_quic_server_connection.h
-index 7b7fac05e..7625fad02 100644
---- a/source/extensions/quic_listeners/quiche/envoy_quic_server_connection.h
-+++ b/source/extensions/quic_listeners/quiche/envoy_quic_server_connection.h
-@@ -10,6 +10,7 @@ namespace Quic {
- class EnvoyQuicServerConnection : public EnvoyQuicConnection {
- public:
-   EnvoyQuicServerConnection(const quic::QuicConnectionId& server_connection_id,
-+                            quic::QuicSocketAddress initial_self_address,
-                             quic::QuicSocketAddress initial_peer_address,
-                             quic::QuicConnectionHelperInterface& helper,
-                             quic::QuicAlarmFactory& alarm_factory, quic::QuicPacketWriter* writer,
-diff --git a/source/extensions/quic_listeners/quiche/platform/BUILD b/source/extensions/quic_listeners/quiche/platform/BUILD
-index f53e07b58..839664d52 100644
---- a/source/extensions/quic_listeners/quiche/platform/BUILD
-+++ b/source/extensions/quic_listeners/quiche/platform/BUILD
-@@ -36,15 +36,16 @@ envoy_extension_package()
- envoy_cc_library(
-     name = "flags_impl_lib",
-     srcs = ["flags_impl.cc"],
--    hdrs = [
--        "flags_impl.h",
--        "flags_list.h",
--    ],
-+    hdrs = ["flags_impl.h"],
-     external_deps = [
-         "abseil_base",
-         "abseil_synchronization",
-     ],
-     visibility = ["//visibility:public"],
-+    deps = [
-+        "@com_googlesource_quiche//:quic_core_flags_list_lib",
-+        "@com_googlesource_quiche//:quic_core_protocol_flags_list_lib",
-+    ],
- )
- 
- envoy_cc_library(
-@@ -62,7 +63,6 @@ envoy_cc_library(
- envoy_cc_library(
-     name = "http2_platform_impl_lib",
-     hdrs = [
--        "http2_arraysize_impl.h",
-         "http2_bug_tracker_impl.h",
-         "http2_containers_impl.h",
-         "http2_estimate_memory_usage_impl.h",
-@@ -74,7 +74,6 @@ envoy_cc_library(
-     ],
-     external_deps = [
-         "abseil_base",
--        "abseil_optional",
-         "abseil_str_format",
-     ],
-     visibility = ["//visibility:public"],
-@@ -114,16 +113,13 @@ envoy_cc_library(
-         "quic_mem_slice_impl.cc",
-     ],
-     hdrs = [
--        "quic_aligned_impl.h",
-         "quic_client_stats_impl.h",
-         "quic_containers_impl.h",
-         "quic_error_code_wrappers_impl.h",
-         "quic_estimate_memory_usage_impl.h",
--        "quic_fallthrough_impl.h",
-         "quic_flag_utils_impl.h",
-         "quic_flags_impl.h",
-         "quic_iovec_impl.h",
--        "quic_macros_impl.h",
-         "quic_map_util_impl.h",
-         "quic_mem_slice_impl.h",
-         "quic_prefetch_impl.h",
-@@ -132,6 +128,7 @@ envoy_cc_library(
-         "quic_server_stats_impl.h",
-         "quic_stack_trace_impl.h",
-         "quic_stream_buffer_allocator_impl.h",
-+        "quic_testvalue_impl.h",
-         "quic_uint128_impl.h",
-     ],
-     external_deps = [
-@@ -141,7 +138,6 @@ envoy_cc_library(
-         "abseil_memory",
-         "abseil_node_hash_map",
-         "abseil_node_hash_set",
--        "abseil_optional",
-     ],
-     tags = ["nofips"],
-     visibility = ["//visibility:public"],
-@@ -236,6 +232,7 @@ envoy_cc_library(
-     }),
-     repository = "@envoy",
-     tags = ["nofips"],
-+    visibility = ["//visibility:public"],
- )
- 
- envoy_cc_library(
-@@ -250,23 +247,12 @@ envoy_cc_library(
-     ],
- )
- 
--envoy_cc_library(
--    name = "quiche_common_platform_optional_impl_lib",
--    hdrs = ["quiche_optional_impl.h"],
--    external_deps = [
--        "abseil_node_hash_map",
--    ],
--    visibility = ["//visibility:public"],
--)
--
- envoy_cc_library(
-     name = "quiche_common_platform_impl_lib",
-     srcs = ["quiche_time_utils_impl.cc"],
-     hdrs = [
--        "quiche_arraysize_impl.h",
-         "quiche_logging_impl.h",
-         "quiche_map_util_impl.h",
--        "quiche_ptr_util_impl.h",
-         "quiche_str_cat_impl.h",
-         "quiche_string_piece_impl.h",
-         "quiche_text_utils_impl.h",
-@@ -281,17 +267,14 @@ envoy_cc_library(
-     deps = [
-         ":quic_platform_logging_impl_lib",
-         ":string_utils_lib",
--        "@com_googlesource_quiche//:quiche_common_platform_optional",
-     ],
- )
- 
- envoy_cc_library(
-     name = "spdy_platform_impl_lib",
-     hdrs = [
--        "spdy_arraysize_impl.h",
-         "spdy_bug_tracker_impl.h",
-         "spdy_containers_impl.h",
--        "spdy_endianness_util_impl.h",
-         "spdy_estimate_memory_usage_impl.h",
-         "spdy_flags_impl.h",
-         "spdy_logging_impl.h",
-@@ -331,14 +314,3 @@ envoy_cc_library(
-     tags = ["nofips"],
-     visibility = ["//visibility:public"],
- )
--
--envoy_cc_library(
--    name = "quiche_common_platform_endian_impl_lib",
--    hdrs = ["quiche_endian_impl.h"],
--    tags = ["nofips"],
--    visibility = ["//visibility:public"],
--    deps = [
--        "quiche_common_platform_export_impl_lib",
--        "//source/common/common:byte_order_lib",
--    ],
--)
-diff --git a/source/extensions/quic_listeners/quiche/platform/flags_impl.cc b/source/extensions/quic_listeners/quiche/platform/flags_impl.cc
-index 70fb182d6..9d4ea89ce 100644
---- a/source/extensions/quic_listeners/quiche/platform/flags_impl.cc
-+++ b/source/extensions/quic_listeners/quiche/platform/flags_impl.cc
-@@ -15,12 +15,24 @@ namespace quiche {
- 
- namespace {
- 
--absl::flat_hash_map<std::string, Flag*> MakeFlagMap() {
-+absl::flat_hash_map<std::string, Flag*> makeFlagMap() {
-   absl::flat_hash_map<std::string, Flag*> flags;
- 
--#define QUICHE_FLAG(type, flag, value, help) flags.emplace(FLAGS_##flag->name(), FLAGS_##flag);
--#include "extensions/quic_listeners/quiche/platform/flags_list.h"
--#undef QUICHE_FLAG
-+#define QUIC_FLAG(flag, ...) flags.emplace(flag->name(), flag);
-+#include "quiche/quic/core/quic_flags_list.h"
-+  QUIC_FLAG(FLAGS_quic_reloadable_flag_spdy_testonly_default_false, false)
-+  QUIC_FLAG(FLAGS_quic_reloadable_flag_spdy_testonly_default_true, true)
-+  QUIC_FLAG(FLAGS_quic_restart_flag_spdy_testonly_default_false, false)
-+  QUIC_FLAG(FLAGS_quic_restart_flag_spdy_testonly_default_true, true)
-+  QUIC_FLAG(FLAGS_quic_reloadable_flag_http2_testonly_default_false, false)
-+  QUIC_FLAG(FLAGS_quic_reloadable_flag_http2_testonly_default_true, true)
-+  QUIC_FLAG(FLAGS_quic_restart_flag_http2_testonly_default_false, false)
-+  QUIC_FLAG(FLAGS_quic_restart_flag_http2_testonly_default_true, true)
-+#undef QUIC_FLAG
-+
-+#define QUIC_PROTOCOL_FLAG(type, flag, ...) flags.emplace(FLAGS_##flag->name(), FLAGS_##flag);
-+#include "quiche/quic/core/quic_protocol_flags_list.h"
-+#undef QUIC_PROTOCOL_FLAG
- 
-   return flags;
- }
-@@ -28,75 +40,123 @@ absl::flat_hash_map<std::string, Flag*> MakeFlagMap() {
- } // namespace
- 
- // static
--FlagRegistry& FlagRegistry::GetInstance() {
-+FlagRegistry& FlagRegistry::getInstance() {
-   static auto* instance = new FlagRegistry();
-   return *instance;
- }
- 
--FlagRegistry::FlagRegistry() : flags_(MakeFlagMap()) {}
-+FlagRegistry::FlagRegistry() : flags_(makeFlagMap()) {}
- 
--void FlagRegistry::ResetFlags() const {
-+void FlagRegistry::resetFlags() const {
-   for (auto& kv : flags_) {
--    kv.second->ResetValue();
-+    kv.second->resetValue();
-   }
- }
- 
--Flag* FlagRegistry::FindFlag(const std::string& name) const {
-+Flag* FlagRegistry::findFlag(const std::string& name) const {
-   auto it = flags_.find(name);
-   return (it != flags_.end()) ? it->second : nullptr;
- }
- 
--template <> bool TypedFlag<bool>::SetValueFromString(const std::string& value_str) {
-+template <> bool TypedFlag<bool>::setValueFromString(const std::string& value_str) {
-   static const auto* kTrueValues = new std::set<std::string>({"1", "t", "true", "y", "yes"});
-   static const auto* kFalseValues = new std::set<std::string>({"0", "f", "false", "n", "no"});
-   auto lower = absl::AsciiStrToLower(value_str);
-   if (kTrueValues->find(lower) != kTrueValues->end()) {
--    SetValue(true);
-+    setValue(true);
-     return true;
-   }
-   if (kFalseValues->find(lower) != kFalseValues->end()) {
--    SetValue(false);
-+    setValue(false);
-     return true;
-   }
-   return false;
- }
- 
--template <> bool TypedFlag<int32_t>::SetValueFromString(const std::string& value_str) {
-+template <> bool TypedFlag<int32_t>::setValueFromString(const std::string& value_str) {
-   int32_t value;
-   if (absl::SimpleAtoi(value_str, &value)) {
--    SetValue(value);
-+    setValue(value);
-     return true;
-   }
-   return false;
- }
- 
--template <> bool TypedFlag<int64_t>::SetValueFromString(const std::string& value_str) {
-+template <> bool TypedFlag<int64_t>::setValueFromString(const std::string& value_str) {
-   int64_t value;
-   if (absl::SimpleAtoi(value_str, &value)) {
--    SetValue(value);
-+    setValue(value);
-     return true;
-   }
-   return false;
- }
- 
--template <> bool TypedFlag<double>::SetValueFromString(const std::string& value_str) {
-+template <> bool TypedFlag<double>::setValueFromString(const std::string& value_str) {
-   double value;
-   if (absl::SimpleAtod(value_str, &value)) {
--    SetValue(value);
-+    setValue(value);
-     return true;
-   }
-   return false;
- }
- 
--template <> bool TypedFlag<std::string>::SetValueFromString(const std::string& value_str) {
--  SetValue(value_str);
-+template <> bool TypedFlag<std::string>::setValueFromString(const std::string& value_str) {
-+  setValue(value_str);
-   return true;
- }
- 
-+template <> bool TypedFlag<unsigned long>::setValueFromString(const std::string& value_str) {
-+  unsigned long value;
-+  if (absl::SimpleAtoi(value_str, &value)) {
-+    setValue(value);
-+    return true;
-+  }
-+  return false;
-+}
-+
-+template <> bool TypedFlag<unsigned long long>::setValueFromString(const std::string& value_str) {
-+  unsigned long long value;
-+  if (absl::SimpleAtoi(value_str, &value)) {
-+    setValue(value);
-+    return true;
-+  }
-+  return false;
-+}
-+
- // Flag definitions
--#define QUICHE_FLAG(type, flag, value, help)                                                       \
--  TypedFlag<type>* FLAGS_##flag = new TypedFlag<type>(#flag, value, help);
--#include "extensions/quic_listeners/quiche/platform/flags_list.h"
--#undef QUICHE_FLAG
-+#define QUIC_FLAG(flag, value) TypedFlag<bool>* flag = new TypedFlag<bool>(#flag, value, "");
-+#include "quiche/quic/core/quic_flags_list.h"
-+QUIC_FLAG(FLAGS_quic_reloadable_flag_spdy_testonly_default_false, false)
-+QUIC_FLAG(FLAGS_quic_reloadable_flag_spdy_testonly_default_true, true)
-+QUIC_FLAG(FLAGS_quic_restart_flag_spdy_testonly_default_false, false)
-+QUIC_FLAG(FLAGS_quic_restart_flag_spdy_testonly_default_true, true)
-+QUIC_FLAG(FLAGS_quic_reloadable_flag_http2_testonly_default_false, false)
-+QUIC_FLAG(FLAGS_quic_reloadable_flag_http2_testonly_default_true, true)
-+QUIC_FLAG(FLAGS_quic_restart_flag_http2_testonly_default_false, false)
-+QUIC_FLAG(FLAGS_quic_restart_flag_http2_testonly_default_true, true)
-+
-+#undef QUIC_FLAG
-+
-+#define STRINGIFY(X) #X
-+
-+#define DEFINE_QUIC_PROTOCOL_FLAG_IMPL(type, flag, value, help)                                    \
-+  TypedFlag<type>* FLAGS_##flag = new TypedFlag<type>(STRINGIFY(FLAGS_##flag), value, help);
-+
-+#define DEFINE_QUIC_PROTOCOL_FLAG_SINGLE_VALUE(type, flag, value, doc)                             \
-+  DEFINE_QUIC_PROTOCOL_FLAG_IMPL(type, flag, value, doc)
-+
-+#define DEFINE_QUIC_PROTOCOL_FLAG_TWO_VALUES(type, flag, internal_value, external_value, doc)      \
-+  DEFINE_QUIC_PROTOCOL_FLAG_IMPL(type, flag, external_value, doc)
-+
-+// Select the right macro based on the number of arguments.
-+#define GET_6TH_ARG(arg1, arg2, arg3, arg4, arg5, arg6, ...) arg6
-+
-+#define QUIC_PROTOCOL_FLAG_MACRO_CHOOSER(...)                                                      \
-+  GET_6TH_ARG(__VA_ARGS__, DEFINE_QUIC_PROTOCOL_FLAG_TWO_VALUES,                                   \
-+              DEFINE_QUIC_PROTOCOL_FLAG_SINGLE_VALUE)
-+
-+#define QUIC_PROTOCOL_FLAG(...) QUIC_PROTOCOL_FLAG_MACRO_CHOOSER(__VA_ARGS__)(__VA_ARGS__)
-+#include "quiche/quic/core/quic_protocol_flags_list.h"
-+#undef QUIC_PROTOCOL_FLAG
- 
- } // namespace quiche
-diff --git a/source/extensions/quic_listeners/quiche/platform/flags_impl.h b/source/extensions/quic_listeners/quiche/platform/flags_impl.h
-index 5db939925..83ed8430c 100644
---- a/source/extensions/quic_listeners/quiche/platform/flags_impl.h
-+++ b/source/extensions/quic_listeners/quiche/platform/flags_impl.h
-@@ -26,13 +26,13 @@ public:
-   ~FlagRegistry() = default;
- 
-   // Return singleton instance.
--  static FlagRegistry& GetInstance();
-+  static FlagRegistry& getInstance();
- 
-   // Reset all registered flags to their default values.
--  void ResetFlags() const;
-+  void resetFlags() const;
- 
-   // Look up a flag by name.
--  Flag* FindFlag(const std::string& name) const;
-+  Flag* findFlag(const std::string& name) const;
- 
- private:
-   FlagRegistry();
-@@ -48,10 +48,10 @@ public:
-   virtual ~Flag() = default;
- 
-   // Set flag value from given string, returning true iff successful.
--  virtual bool SetValueFromString(const std::string& value_str) = 0;
-+  virtual bool setValueFromString(const std::string& value_str) = 0;
- 
-   // Reset flag to default value.
--  virtual void ResetValue() = 0;
-+  virtual void resetValue() = 0;
- 
-   // Return flag name.
-   std::string name() const { return name_; }
-@@ -70,15 +70,15 @@ public:
-   TypedFlag(const char* name, T default_value, const char* help)
-       : Flag(name, help), value_(default_value), default_value_(default_value) {}
- 
--  bool SetValueFromString(const std::string& value_str) override;
-+  bool setValueFromString(const std::string& value_str) override;
- 
--  void ResetValue() override {
-+  void resetValue() override {
-     absl::MutexLock lock(&mutex_);
-     value_ = default_value_;
-   }
- 
-   // Set flag value.
--  void SetValue(T value) {
-+  void setValue(T value) {
-     absl::MutexLock lock(&mutex_);
-     value_ = value;
-   }
-@@ -96,15 +96,29 @@ private:
- };
- 
- // SetValueFromString specializations
--template <> bool TypedFlag<bool>::SetValueFromString(const std::string& value_str);
--template <> bool TypedFlag<int32_t>::SetValueFromString(const std::string& value_str);
--template <> bool TypedFlag<int64_t>::SetValueFromString(const std::string& value_str);
--template <> bool TypedFlag<double>::SetValueFromString(const std::string& value_str);
--template <> bool TypedFlag<std::string>::SetValueFromString(const std::string& value_str);
-+template <> bool TypedFlag<bool>::setValueFromString(const std::string& value_str);
-+template <> bool TypedFlag<int32_t>::setValueFromString(const std::string& value_str);
-+template <> bool TypedFlag<int64_t>::setValueFromString(const std::string& value_str);
-+template <> bool TypedFlag<double>::setValueFromString(const std::string& value_str);
-+template <> bool TypedFlag<std::string>::setValueFromString(const std::string& value_str);
-+template <> bool TypedFlag<unsigned long>::setValueFromString(const std::string& value_str);
-+template <> bool TypedFlag<unsigned long long>::setValueFromString(const std::string& value_str);
- 
- // Flag declarations
--#define QUICHE_FLAG(type, flag, value, help) extern TypedFlag<type>* FLAGS_##flag;
--#include "extensions/quic_listeners/quiche/platform/flags_list.h"
--#undef QUICHE_FLAG
-+#define QUIC_FLAG(flag, ...) extern TypedFlag<bool>* flag;
-+#include "quiche/quic/core/quic_flags_list.h"
-+QUIC_FLAG(FLAGS_quic_reloadable_flag_spdy_testonly_default_false, false)
-+QUIC_FLAG(FLAGS_quic_reloadable_flag_spdy_testonly_default_true, true)
-+QUIC_FLAG(FLAGS_quic_restart_flag_spdy_testonly_default_false, false)
-+QUIC_FLAG(FLAGS_quic_restart_flag_spdy_testonly_default_true, true)
-+QUIC_FLAG(FLAGS_quic_reloadable_flag_http2_testonly_default_false, false)
-+QUIC_FLAG(FLAGS_quic_reloadable_flag_http2_testonly_default_true, true)
-+QUIC_FLAG(FLAGS_quic_restart_flag_http2_testonly_default_false, false)
-+QUIC_FLAG(FLAGS_quic_restart_flag_http2_testonly_default_true, true)
-+#undef QUIC_FLAG
-+
-+#define QUIC_PROTOCOL_FLAG(type, flag, ...) extern TypedFlag<type>* FLAGS_##flag;
-+#include "quiche/quic/core/quic_protocol_flags_list.h"
-+#undef QUIC_PROTOCOL_FLAG
- 
- } // namespace quiche
-diff --git a/source/extensions/quic_listeners/quiche/platform/flags_list.h b/source/extensions/quic_listeners/quiche/platform/flags_list.h
-deleted file mode 100644
-index 7e9e20a7c..000000000
---- a/source/extensions/quic_listeners/quiche/platform/flags_list.h
-+++ /dev/null
-@@ -1,502 +0,0 @@
--// This file intentionally does not have header guards. It is intended to be
--// included multiple times, each time with a different definition of
--// QUICHE_FLAG.
--
--// NOLINT(namespace-envoy)
--
--// This file is part of the QUICHE platform implementation, and is not to be
--// consumed or referenced directly by other Envoy code. It serves purely as a
--// porting layer for QUICHE.
--
--// This file is generated by //third_party/quic/tools:quic_flags_list in
--// Google3.
--
--#if defined(QUICHE_FLAG)
--
--QUICHE_FLAG(
--    bool, http2_reloadable_flag_http2_backend_alpn_failure_error_code, false,
--    "If true, the GFE will return a new ResponseCodeDetails error when ALPN to the backend fails.")
--
--QUICHE_FLAG(bool, http2_reloadable_flag_http2_ip_based_cwnd_exp, true,
--            "If true, enable IP address based CWND bootstrapping experiment with different "
--            "bandwidth models and priorities in HTTP2.")
--
--QUICHE_FLAG(
--    bool, http2_reloadable_flag_http2_load_based_goaway_warning, false,
--    "If true, load-based connection closures will send a warning GOAWAY before the actual GOAWAY.")
--
--QUICHE_FLAG(bool, http2_reloadable_flag_http2_security_requirement_for_client3, false,
--            "If true, check whether client meets security requirements during SSL handshake. If "
--            "flag is true and client does not meet security requirements, do not negotiate HTTP/2 "
--            "with client or terminate the session with SPDY_INADEQUATE_SECURITY if HTTP/2 is "
--            "already negotiated. The spec contains both cipher and TLS version requirements.")
--
--QUICHE_FLAG(bool, http2_reloadable_flag_http2_websocket_detection, false,
--            "If true, uses a HTTP/2-specific method of detecting websocket upgrade requests.")
--
--QUICHE_FLAG(bool, http2_reloadable_flag_permissive_http2_switch, false,
--            "If true, the GFE allows both HTTP/1.0 and HTTP/1.1 versions in HTTP/2 upgrade "
--            "requests/responses.")
--
--QUICHE_FLAG(bool, quic_reloadable_flag_advertise_quic_for_https_for_debugips, false, "")
--
--QUICHE_FLAG(bool, quic_reloadable_flag_advertise_quic_for_https_for_external_users, false, "")
--
--QUICHE_FLAG(bool, quic_reloadable_flag_gclb_quic_allow_alia, true,
--            "If gfe2_reloadable_flag_gclb_use_alia is also true, use Alia for GCLB QUIC "
--            "handshakes. To be used as a big red button if there's a problem with Alia/QUIC.")
--
--QUICHE_FLAG(bool, quic_reloadable_flag_quic_abort_qpack_on_stream_close, false,
--            "If true, abort async QPACK header decompression in QuicSpdyStream::OnClose().")
--
--QUICHE_FLAG(bool, quic_reloadable_flag_quic_ack_delay_alarm_granularity, false,
--            "When true, ensure the ACK delay is never less than the alarm granularity when ACK "
--            "decimation is enabled.")
--
--QUICHE_FLAG(bool, quic_reloadable_flag_quic_add_missing_connected_checks, false,
--            "If true, add missing connected checks.")
--
--QUICHE_FLAG(bool, quic_reloadable_flag_quic_add_silent_idle_timeout, true,
--            "If true, when server is silently closing connections due to idle timeout, serialize "
--            "the connection close packets which will be added to time wait list.")
--
--QUICHE_FLAG(bool, quic_reloadable_flag_quic_add_stream_info_to_idle_close_detail, false,
--            "If true, include stream information in idle timeout connection close detail.")
--
--QUICHE_FLAG(bool, quic_reloadable_flag_quic_allow_backend_set_stream_ttl, false,
--            "If true, check backend response header for X-Response-Ttl. If it is provided, the "
--            "stream TTL is set. A QUIC stream will be immediately canceled when tries to write "
--            "data if this TTL expired.")
--
--QUICHE_FLAG(bool, quic_reloadable_flag_quic_allow_client_enabled_bbr_v2, true,
--            "If true, allow client to enable BBRv2 on server via connection option 'B2ON'.")
--
--QUICHE_FLAG(bool, quic_reloadable_flag_quic_alpn_dispatch, false,
--            "Support different QUIC sessions, as indicated by ALPN. Used for QBONE.")
--
--QUICHE_FLAG(bool, quic_reloadable_flag_quic_bbr2_avoid_too_low_probe_bw_cwnd, false,
--            "If true, QUIC BBRv2's PROBE_BW mode will not reduce cwnd below BDP+ack_height.")
--
--QUICHE_FLAG(bool, quic_reloadable_flag_quic_bbr2_fewer_startup_round_trips, false,
--            "When true, the 1RTT and 2RTT connection options decrease the number of round trips in "
--            "BBRv2 STARTUP without a 25% bandwidth increase to 1 or 2 round trips respectively.")
--
--QUICHE_FLAG(
--    bool, quic_reloadable_flag_quic_bbr2_limit_inflight_hi, false,
--    "When true, the B2HI connection option limits reduction of inflight_hi to (1-Beta)*CWND.")
--
--QUICHE_FLAG(bool, quic_reloadable_flag_quic_bbr2_use_post_inflight_to_detect_queuing, false,
--            "If true, QUIC BBRv2 will use inflight byte after congestion event to detect queuing "
--            "during PROBE_UP.")
--
--QUICHE_FLAG(bool, quic_reloadable_flag_quic_bbr_no_bytes_acked_in_startup_recovery, false,
--            "When in STARTUP and recovery, do not add bytes_acked to QUIC BBR's CWND in "
--            "CalculateCongestionWindow()")
--
--QUICHE_FLAG(bool, quic_reloadable_flag_quic_bootstrap_cwnd_by_spdy_priority, true,
--            "If true, bootstrap initial QUIC cwnd by SPDY priorities.")
--
--QUICHE_FLAG(bool, quic_reloadable_flag_quic_cap_large_client_initial_rtt, true,
--            "If true, cap client suggested initial RTT to 1s if it is longer than 1s.")
--
--QUICHE_FLAG(bool, quic_reloadable_flag_quic_clean_up_spdy_session_destructor, false,
--            "If true, QuicSpdySession's destructor won't need to do cleanup.")
--
--QUICHE_FLAG(bool, quic_reloadable_flag_quic_close_connection_in_on_can_write_with_blocked_writer,
--            false,
--            "If true, close connection if writer is still blocked while OnCanWrite is called.")
--
--QUICHE_FLAG(bool, quic_reloadable_flag_quic_close_connection_on_serialization_failure, false,
--            "If true, close connection on packet serialization failures.")
--
--QUICHE_FLAG(bool, quic_reloadable_flag_quic_conservative_bursts, false,
--            "If true, set burst token to 2 in cwnd bootstrapping experiment.")
--
--QUICHE_FLAG(bool, quic_reloadable_flag_quic_conservative_cwnd_and_pacing_gains, false,
--            "If true, uses conservative cwnd gain and pacing gain when cwnd gets bootstrapped.")
--
--QUICHE_FLAG(
--    bool, quic_reloadable_flag_quic_copy_bbr_cwnd_to_bbr2, false,
--    "If true, when switching from BBR to BBRv2, BBRv2 will use BBR's cwnd as its initial cwnd.")
--
--QUICHE_FLAG(bool, quic_reloadable_flag_quic_default_enable_5rto_blackhole_detection2, true,
--            "If true, default-enable 5RTO blachole detection.")
--
--QUICHE_FLAG(bool, quic_reloadable_flag_quic_default_on_pto, false,
--            "If true, default on PTO which unifies TLP + RTO loss recovery.")
--
--QUICHE_FLAG(bool, quic_reloadable_flag_quic_default_to_bbr, true,
--            "When true, defaults to BBR congestion control instead of Cubic.")
--
--QUICHE_FLAG(bool, quic_reloadable_flag_quic_default_to_bbr_v2, false,
--            "If true, use BBRv2 as the default congestion controller. Takes precedence over "
--            "--quic_default_to_bbr.")
--
--QUICHE_FLAG(bool, quic_reloadable_flag_quic_disable_server_blackhole_detection, false,
--            "If true, disable blackhole detection on server side.")
--
--QUICHE_FLAG(bool, quic_reloadable_flag_quic_disable_version_draft_27, false,
--            "If true, disable QUIC version h3-27.")
--
--QUICHE_FLAG(bool, quic_reloadable_flag_quic_disable_version_draft_29, false,
--            "If true, disable QUIC version h3-29.")
--
--QUICHE_FLAG(bool, quic_reloadable_flag_quic_disable_version_q043, false,
--            "If true, disable QUIC version Q043.")
--
--QUICHE_FLAG(bool, quic_reloadable_flag_quic_disable_version_q046, false,
--            "If true, disable QUIC version Q046.")
--
--QUICHE_FLAG(bool, quic_reloadable_flag_quic_disable_version_q050, false,
--            "If true, disable QUIC version Q050.")
--
--QUICHE_FLAG(bool, quic_reloadable_flag_quic_disable_version_t050, false,
--            "If true, disable QUIC version h3-T050.")
--
--QUICHE_FLAG(bool, quic_reloadable_flag_quic_disable_version_t051, false,
--            "If true, disable QUIC version h3-T051.")
--
--QUICHE_FLAG(bool, quic_reloadable_flag_quic_discard_initial_packet_with_key_dropped, false,
--            "If true, discard INITIAL packet if the key has been dropped.")
--
--QUICHE_FLAG(
--    bool, quic_reloadable_flag_quic_do_not_accept_stop_waiting, false,
--    "In v44 and above, where STOP_WAITING is never sent, close the connection if it's received.")
--
--QUICHE_FLAG(bool, quic_reloadable_flag_quic_donot_reset_ideal_next_packet_send_time, false,
--            "If true, stop resetting ideal_next_packet_send_time_ in pacing sender.")
--
--QUICHE_FLAG(bool, quic_reloadable_flag_quic_enable_loss_detection_experiment_at_gfe, false,
--            "If ture, enable GFE-picked loss detection experiment.")
--
--QUICHE_FLAG(bool, quic_reloadable_flag_quic_enable_loss_detection_tuner, false,
--            "If true, allow QUIC loss detection tuning to be enabled by connection option ELDT.")
--
--QUICHE_FLAG(
--    bool, quic_reloadable_flag_quic_enable_mtu_discovery_at_server, false,
--    "If true, QUIC will default enable MTU discovery at server, with a target of 1450 bytes.")
--
--QUICHE_FLAG(bool, quic_reloadable_flag_quic_enabled, false, "")
--
--QUICHE_FLAG(bool, quic_reloadable_flag_quic_fix_arm_pto_for_application_data, false,
--            "If true, do not arm PTO for application data until handshake confirmed.")
--
--QUICHE_FLAG(bool, quic_reloadable_flag_quic_fix_bytes_left_for_batch_write, false,
--            "If true, convert bytes_left_for_batch_write_ to unsigned int.")
--
--QUICHE_FLAG(
--    bool, quic_reloadable_flag_quic_fix_http3_goaway_stream_id, false,
--    "If true, send the lowest stream ID that can be retried by the client in a GOAWAY frame. If "
--    "false, send the highest received stream ID, which actually should not be retried.")
--
--QUICHE_FLAG(bool, quic_reloadable_flag_quic_fix_out_of_order_sending, false,
--            "If true, fix a potential out of order sending caused by handshake gets confirmed "
--            "while the coalescer is not empty.")
--
--QUICHE_FLAG(
--    bool, quic_reloadable_flag_quic_fix_pto_pending_timer_count, false,
--    "If true, make sure there is pending timer credit when trying to PTO retransmit any packets.")
--
--QUICHE_FLAG(bool, quic_reloadable_flag_quic_fix_undecryptable_packets2, false,
--            "If true, remove processed undecryptable packets.")
--
--QUICHE_FLAG(bool, quic_reloadable_flag_quic_get_stream_information_from_stream_map, true,
--            "If true, gQUIC will only consult stream_map in QuicSession::GetNumActiveStreams().")
--
--QUICHE_FLAG(bool, quic_reloadable_flag_quic_give_sent_packet_to_debug_visitor_after_sent, false,
--            "If true, QUIC connection will pass sent packet information to the debug visitor after "
--            "a packet is recorded as sent in sent packet manager.")
--
--QUICHE_FLAG(bool, quic_reloadable_flag_quic_http3_new_default_urgency_value, false,
--            "If true, QuicStream::kDefaultUrgency is 3, otherwise 1.")
--
--QUICHE_FLAG(bool, quic_reloadable_flag_quic_ip_based_cwnd_exp, true,
--            "If true, enable IP address based CWND bootstrapping experiment with different "
--            "bandwidth models and priorities. ")
--
--QUICHE_FLAG(bool, quic_reloadable_flag_quic_listener_never_fake_epollout, false,
--            "If true, QuicListener::OnSocketIsWritable will always return false, which means there "
--            "will never be a fake EPOLLOUT event in the next epoll iteration.")
--
--QUICHE_FLAG(bool,
--            quic_reloadable_flag_quic_neuter_initial_packet_in_coalescer_with_initial_key_discarded,
--            false, "If true, neuter initial packet in the coalescer when discarding initial keys.")
--
--QUICHE_FLAG(bool, quic_reloadable_flag_quic_no_dup_experiment_id_2, false,
--            "If true, transport connection stats doesn't report duplicated experiments for same "
--            "connection.")
--
--QUICHE_FLAG(bool, quic_reloadable_flag_quic_no_silent_close_for_idle_timeout, true,
--            "If true, always send connection close for idle timeout if NSLC is received.")
--
--QUICHE_FLAG(bool, quic_reloadable_flag_quic_only_set_uaid_in_tcs_visitor, false,
--            "If true, QuicTransportConnectionStatsVisitor::PopulateTransportConnectionStats will "
--            "be the only place where TCS's uaid field is set.")
--
--QUICHE_FLAG(bool, quic_reloadable_flag_quic_only_truncate_long_cids, true,
--            "In IETF QUIC, only truncate long CIDs from the client's Initial, don't modify them.")
--
--QUICHE_FLAG(bool, quic_reloadable_flag_quic_preferred_altsvc_version, false,
--            "When true, we will send a preferred QUIC version at the start of our Alt-Svc list.")
--
--QUICHE_FLAG(bool, quic_reloadable_flag_quic_proxy_write_packed_strings, false,
--            "If true, QuicProxyDispatcher will write packed_client_address and packed_server_vip "
--            "in TcpProxyHeaderProto.")
--
--QUICHE_FLAG(bool, quic_reloadable_flag_quic_record_frontend_service_vip_mapping, true,
--            "If true, for L1 GFE, as requests come in, record frontend service to VIP mapping "
--            "which is used to announce VIP in SHLO for proxied sessions. ")
--
--QUICHE_FLAG(bool, quic_reloadable_flag_quic_record_received_min_ack_delay, false,
--            "If true, record the received min_ack_delay in transport parameters to QUIC config.")
--
--QUICHE_FLAG(bool, quic_reloadable_flag_quic_reject_all_traffic, false, "")
--
--QUICHE_FLAG(bool, quic_reloadable_flag_quic_remove_zombie_streams, true,
--            "If true, QuicSession doesn't keep a separate zombie_streams. Instead, all streams are "
--            "stored in stream_map_.")
--
--QUICHE_FLAG(bool, quic_reloadable_flag_quic_require_handshake_confirmation, false,
--            "If true, require handshake confirmation for QUIC connections, functionally disabling "
--            "0-rtt handshakes.")
--
--QUICHE_FLAG(
--    bool, quic_reloadable_flag_quic_send_key_update_not_yet_supported, false,
--    "When true, QUIC+TLS versions will send the key_update_not_yet_supported transport parameter.")
--
--QUICHE_FLAG(bool, quic_reloadable_flag_quic_send_path_response, false,
--            "If true, send PATH_RESPONSE upon receiving PATH_CHALLENGE regardless of perspective. "
--            "--gfe2_reloadable_flag_quic_start_peer_migration_earlier has to be true before turn "
--            "on this flag.")
--
--QUICHE_FLAG(bool, quic_reloadable_flag_quic_send_timestamps, false,
--            "When the STMP connection option is sent by the client, timestamps in the QUIC ACK "
--            "frame are sent and processed.")
--
--QUICHE_FLAG(bool, quic_reloadable_flag_quic_server_push, false,
--            "If true, enable server push feature on QUIC.")
--
--QUICHE_FLAG(bool, quic_reloadable_flag_quic_set_resumed_ssl_session_early, false,
--            "If true, set resumed_ssl_session if this is a 0-RTT connection.")
--
--QUICHE_FLAG(bool, quic_reloadable_flag_quic_start_peer_migration_earlier, false,
--            "If true, while reading an IETF quic packet, start peer migration immediately when "
--            "detecting the existence of any non-probing frame instead of at the end of the packet.")
--
--QUICHE_FLAG(bool, quic_reloadable_flag_quic_stop_sending_uses_ietf_error_code, false,
--            "If true, use IETF QUIC application error codes in STOP_SENDING frames. If false, use "
--            "QuicRstStreamErrorCodes.")
--
--QUICHE_FLAG(bool, quic_reloadable_flag_quic_testonly_default_false, false,
--            "A testonly reloadable flag that will always default to false.")
--
--QUICHE_FLAG(bool, quic_reloadable_flag_quic_testonly_default_true, true,
--            "A testonly reloadable flag that will always default to true.")
--
--QUICHE_FLAG(bool, quic_reloadable_flag_quic_unified_iw_options, false,
--            "When true, set the initial congestion control window from connection options in "
--            "QuicSentPacketManager rather than TcpCubicSenderBytes.")
--
--QUICHE_FLAG(bool, quic_reloadable_flag_quic_use_header_stage_idle_list2, false,
--            "If true, use header stage idle list for QUIC connections in GFE.")
--
--QUICHE_FLAG(bool, quic_reloadable_flag_quic_use_leto_key_exchange, false,
--            "If true, QUIC will attempt to use the Leto key exchange service and only fall back to "
--            "local key exchange if that fails.")
--
--QUICHE_FLAG(bool, quic_reloadable_flag_send_quic_fallback_server_config_on_leto_error, false,
--            "If true and using Leto for QUIC shared-key calculations, GFE will react to a failure "
--            "to contact Leto by sending a REJ containing a fallback ServerConfig, allowing the "
--            "client to continue the handshake.")
--
--QUICHE_FLAG(
--    bool, quic_restart_flag_dont_fetch_quic_private_keys_from_leto, false,
--    "If true, GFE will not request private keys when fetching QUIC ServerConfigs from Leto.")
--
--QUICHE_FLAG(bool, quic_restart_flag_quic_adjust_initial_cwnd_by_gws, true,
--            "If true, GFE informs backend that a client request is the first one on the connection "
--            "via frontline header \"first_request=1\". Also, adjust initial cwnd based on "
--            "X-Google-Gws-Initial-Cwnd-Mode sent by GWS.")
--
--QUICHE_FLAG(
--    bool, quic_restart_flag_quic_allow_loas_multipacket_chlo, false,
--    "If true, inspects QUIC CHLOs for kLOAS and early creates sessions to allow multi-packet CHLOs")
--
--QUICHE_FLAG(
--    bool, quic_restart_flag_quic_disable_gws_cwnd_experiment, false,
--    "If true, X-Google-Gws-Initial-Cwnd-Mode related header sent by GWS becomes no-op for QUIC.")
--
--QUICHE_FLAG(bool, quic_restart_flag_quic_enable_tls_resumption_v4, true,
--            "If true, enables support for TLS resumption in QUIC.")
--
--QUICHE_FLAG(bool, quic_restart_flag_quic_enable_zero_rtt_for_tls_v2, true,
--            "If true, support for IETF QUIC 0-rtt is enabled.")
--
--QUICHE_FLAG(bool, quic_restart_flag_quic_offload_pacing_to_usps2, false,
--            "If true, QUIC offload pacing when using USPS as egress method.")
--
--QUICHE_FLAG(bool, quic_restart_flag_quic_rx_ring_use_tpacket_v3, false,
--            "If true, use TPACKET_V3 for QuicRxRing instead of TPACKET_V2.")
--
--QUICHE_FLAG(bool, quic_restart_flag_quic_should_accept_new_connection, false,
--            "If true, reject QUIC CHLO packets when dispatcher is asked to do so.")
--
--QUICHE_FLAG(bool, quic_restart_flag_quic_support_release_time_for_gso, false,
--            "If true, QuicGsoBatchWriter will support release time if it is available and the "
--            "process has the permission to do so.")
--
--QUICHE_FLAG(bool, quic_restart_flag_quic_testonly_default_false, false,
--            "A testonly restart flag that will always default to false.")
--
--QUICHE_FLAG(bool, quic_restart_flag_quic_testonly_default_true, true,
--            "A testonly restart flag that will always default to true.")
--
--QUICHE_FLAG(
--    bool, quic_restart_flag_quic_use_leto_for_quic_configs, false,
--    "If true, use Leto to fetch QUIC server configs instead of using the seeds from Memento.")
--
--QUICHE_FLAG(bool, quic_restart_flag_quic_use_pigeon_socket_to_backend, false,
--            "If true, create a shared pigeon socket for all quic to backend connections and switch "
--            "to use it after successful handshake.")
--
--QUICHE_FLAG(bool, spdy_reloadable_flag_quic_bootstrap_cwnd_by_spdy_priority, true,
--            "If true, bootstrap initial QUIC cwnd by SPDY priorities.")
--
--QUICHE_FLAG(bool, spdy_reloadable_flag_quic_clean_up_spdy_session_destructor, false,
--            "If true, QuicSpdySession's destructor won't need to do cleanup.")
--
--QUICHE_FLAG(
--    bool, spdy_reloadable_flag_spdy_discard_response_body_if_disallowed, false,
--    "If true, SPDY will discard all response body bytes when response code indicates no response "
--    "body should exist. Previously, we only discard partial bytes on the first response processing "
--    "and the rest of the response bytes would still be delivered even though the response code "
--    "said there should not be any body associated with the response code.")
--
--QUICHE_FLAG(bool, quic_allow_chlo_buffering, true,
--            "If true, allows packets to be buffered in anticipation of a "
--            "future CHLO, and allow CHLO packets to be buffered until next "
--            "iteration of the event loop.")
--
--QUICHE_FLAG(bool, quic_disable_pacing_for_perf_tests, false, "If true, disable pacing in QUIC")
--
--QUICHE_FLAG(bool, quic_enforce_single_packet_chlo, true,
--            "If true, enforce that QUIC CHLOs fit in one packet")
--
--QUICHE_FLAG(int64_t, quic_time_wait_list_max_connections, 600000,
--            "Maximum number of connections on the time-wait list. "
--            "A negative value implies no configured limit.")
--
--QUICHE_FLAG(int64_t, quic_time_wait_list_seconds, 200,
--            "Time period for which a given connection_id should live in "
--            "the time-wait state.")
--
--QUICHE_FLAG(double, quic_bbr_cwnd_gain, 2.0f,
--            "Congestion window gain for QUIC BBR during PROBE_BW phase.")
--
--QUICHE_FLAG(int32_t, quic_buffered_data_threshold, 8 * 1024,
--            "If buffered data in QUIC stream is less than this "
--            "threshold, buffers all provided data or asks upper layer for more data")
--
--QUICHE_FLAG(int32_t, quic_send_buffer_max_data_slice_size, 4 * 1024,
--            "Max size of data slice in bytes for QUIC stream send buffer.")
--
--QUICHE_FLAG(int32_t, quic_lumpy_pacing_size, 2,
--            "Number of packets that the pacing sender allows in bursts during "
--            "pacing. This flag is ignored if a flow's estimated bandwidth is "
--            "lower than 1200 kbps.")
--
--QUICHE_FLAG(double, quic_lumpy_pacing_cwnd_fraction, 0.25f,
--            "Congestion window fraction that the pacing sender allows in bursts "
--            "during pacing.")
--
--QUICHE_FLAG(int32_t, quic_max_pace_time_into_future_ms, 10,
--            "Max time that QUIC can pace packets into the future in ms.")
--
--QUICHE_FLAG(double, quic_pace_time_into_future_srtt_fraction, 0.125f,
--            "Smoothed RTT fraction that a connection can pace packets into the future.")
--
--QUICHE_FLAG(bool, quic_export_server_num_packets_per_write_histogram, false,
--            "If true, export number of packets written per write operation histogram.")
--
--QUICHE_FLAG(bool, quic_disable_version_negotiation_grease_randomness, false,
--            "If true, use predictable version negotiation versions.")
--
--QUICHE_FLAG(bool, quic_enable_http3_grease_randomness, true,
--            "If true, use random greased settings and frames.")
--
--QUICHE_FLAG(int64_t, quic_max_tracked_packet_count, 10000, "Maximum number of tracked packets.")
--
--QUICHE_FLAG(bool, quic_prober_uses_length_prefixed_connection_ids, false,
--            "If true, QuicFramer::WriteClientVersionNegotiationProbePacket uses "
--            "length-prefixed connection IDs.")
--
--QUICHE_FLAG(bool, quic_client_convert_http_header_name_to_lowercase, true,
--            "If true, HTTP request header names sent from QuicSpdyClientBase(and "
--            "descendents) will be automatically converted to lower case.")
--
--QUICHE_FLAG(bool, quic_enable_http3_server_push, false,
--            "If true, server push will be allowed in QUIC versions that use HTTP/3.")
--
--QUICHE_FLAG(int32_t, quic_bbr2_default_probe_bw_base_duration_ms, 2000,
--            "The default minimum duration for BBRv2-native probes, in milliseconds.")
--
--QUICHE_FLAG(int32_t, quic_bbr2_default_probe_bw_max_rand_duration_ms, 1000,
--            "The default upper bound of the random amount of BBRv2-native "
--            "probes, in milliseconds.")
--
--QUICHE_FLAG(int32_t, quic_bbr2_default_probe_rtt_period_ms, 10000,
--            "The default period for entering PROBE_RTT, in milliseconds.")
--
--QUICHE_FLAG(double, quic_bbr2_default_loss_threshold, 0.02,
--            "The default loss threshold for QUIC BBRv2, should be a value "
--            "between 0 and 1.")
--
--QUICHE_FLAG(int32_t, quic_bbr2_default_startup_full_loss_count, 8,
--            "The default minimum number of loss marking events to exit STARTUP.")
--
--QUICHE_FLAG(int32_t, quic_bbr2_default_probe_bw_full_loss_count, 2,
--            "The default minimum number of loss marking events to exit PROBE_UP phase.")
--
--QUICHE_FLAG(double, quic_bbr2_default_inflight_hi_headroom, 0.01,
--            "The default fraction of unutilized headroom to try to leave in path "
--            "upon high loss.")
--
--QUICHE_FLAG(int32_t, quic_bbr2_default_initial_ack_height_filter_window, 10,
--            "The default initial value of the max ack height filter's window length.")
--
--QUICHE_FLAG(double, quic_ack_aggregation_bandwidth_threshold, 1.0,
--            "If the bandwidth during ack aggregation is smaller than (estimated "
--            "bandwidth * this flag), consider the current aggregation completed "
--            "and starts a new one.")
--
--QUICHE_FLAG(int32_t, quic_anti_amplification_factor, 5,
--            "Anti-amplification factor. Before address validation, server will "
--            "send no more than factor times bytes received.")
--
--QUICHE_FLAG(int32_t, quic_max_buffered_crypto_bytes, 16 * 1024,
--            "The maximum amount of CRYPTO frame data that can be buffered.")
--
--QUICHE_FLAG(int32_t, quic_max_aggressive_retransmittable_on_wire_ping_count, 0,
--            "If set to non-zero, the maximum number of consecutive pings that "
--            "can be sent with aggressive initial retransmittable on wire timeout "
--            "if there is no new data received. After which, the timeout will be "
--            "exponentially back off until exceeds the default ping timeout.")
--
--QUICHE_FLAG(int32_t, quic_max_congestion_window, 2000, "The maximum congestion window in packets.")
--
--QUICHE_FLAG(int32_t, quic_max_streams_window_divisor, 2,
--            "The divisor that controls how often MAX_STREAMS frame is sent.")
--
--QUICHE_FLAG(bool, http2_reloadable_flag_http2_testonly_default_false, false,
--            "A testonly reloadable flag that will always default to false.")
--
--QUICHE_FLAG(bool, http2_restart_flag_http2_testonly_default_false, false,
--            "A testonly restart flag that will always default to false.")
--
--QUICHE_FLAG(bool, spdy_reloadable_flag_spdy_testonly_default_false, false,
--            "A testonly reloadable flag that will always default to false.")
--
--QUICHE_FLAG(bool, spdy_restart_flag_spdy_testonly_default_false, false,
--            "A testonly restart flag that will always default to false.")
--
--#endif
-diff --git a/source/extensions/quic_listeners/quiche/platform/http2_flags_impl.h b/source/extensions/quic_listeners/quiche/platform/http2_flags_impl.h
-index 7d2561469..dc6fe5429 100644
---- a/source/extensions/quic_listeners/quiche/platform/http2_flags_impl.h
-+++ b/source/extensions/quic_listeners/quiche/platform/http2_flags_impl.h
-@@ -8,10 +8,10 @@
- 
- #include "extensions/quic_listeners/quiche/platform/flags_impl.h"
- 
--#define GetHttp2ReloadableFlagImpl(flag) quiche::FLAGS_http2_reloadable_flag_##flag->value()
-+#define GetHttp2ReloadableFlagImpl(flag) quiche::FLAGS_quic_reloadable_flag_##flag->value()
- 
- #define SetHttp2ReloadableFlagImpl(flag, value)                                                    \
--  quiche::FLAGS_http2_reloadable_flag_##flag->SetValue(value)
-+  quiche::FLAGS_quic_reloadable_flag_##flag->setValue(value)
- 
- #define HTTP2_CODE_COUNT_N_IMPL(flag, instance, total)                                             \
-   do {                                                                                             \
-diff --git a/source/extensions/quic_listeners/quiche/platform/quic_aligned_impl.h b/source/extensions/quic_listeners/quiche/platform/quic_aligned_impl.h
-deleted file mode 100644
-index 3f595380b..000000000
---- a/source/extensions/quic_listeners/quiche/platform/quic_aligned_impl.h
-+++ /dev/null
-@@ -1,18 +0,0 @@
--#pragma once
--
--#include "absl/base/optimization.h"
--
--// NOLINT(namespace-envoy)
--
--// This file is part of the QUICHE platform implementation, and is not to be
--// consumed or referenced directly by other Envoy code. It serves purely as a
--// porting layer for QUICHE.
--
--#define QUIC_ALIGN_OF_IMPL alignof
--#ifdef _MSC_VER
--#define QUIC_ALIGNED_IMPL(X) __declspec(align(X))
--#else
--#define QUIC_ALIGNED_IMPL(X) __attribute__((aligned(X)))
--#endif
--#define QUIC_CACHELINE_ALIGNED_IMPL ABSL_CACHELINE_ALIGNED
--#define QUIC_CACHELINE_SIZE_IMPL ABSL_CACHELINE_SIZE
-diff --git a/source/extensions/quic_listeners/quiche/platform/quic_cert_utils_impl.cc b/source/extensions/quic_listeners/quiche/platform/quic_cert_utils_impl.cc
-index 2a886a12c..27b977908 100644
---- a/source/extensions/quic_listeners/quiche/platform/quic_cert_utils_impl.cc
-+++ b/source/extensions/quic_listeners/quiche/platform/quic_cert_utils_impl.cc
-@@ -10,25 +10,7 @@
- 
- namespace quic {
- 
--// static
--bool QuicCertUtilsImpl::ExtractSubjectNameFromDERCert(quiche::QuicheStringPiece cert,
--                                                      quiche::QuicheStringPiece* subject_out) {
--  CBS tbs_certificate;
--  if (!SeekToSubject(cert, &tbs_certificate)) {
--    return false;
--  }
--
--  CBS subject;
--  if (!CBS_get_asn1_element(&tbs_certificate, &subject, CBS_ASN1_SEQUENCE)) {
--    return false;
--  }
--  *subject_out =
--      absl::string_view(reinterpret_cast<const char*>(CBS_data(&subject)), CBS_len(&subject));
--  return true;
--}
--
--// static
--bool QuicCertUtilsImpl::SeekToSubject(quiche::QuicheStringPiece cert, CBS* tbs_certificate) {
-+bool seekToSubject(absl::string_view cert, CBS* tbs_certificate) {
-   CBS der;
-   CBS_init(&der, reinterpret_cast<const uint8_t*>(cert.data()), cert.size());
-   CBS certificate;
-@@ -65,4 +47,22 @@ bool QuicCertUtilsImpl::SeekToSubject(quiche::QuicheStringPiece cert, CBS* tbs_c
-   return true;
- }
- 
-+// static
-+// NOLINTNEXTLINE(readability-identifier-naming)
-+bool QuicCertUtilsImpl::ExtractSubjectNameFromDERCert(absl::string_view cert,
-+                                                      absl::string_view* subject_out) {
-+  CBS tbs_certificate;
-+  if (!seekToSubject(cert, &tbs_certificate)) {
-+    return false;
-+  }
-+
-+  CBS subject;
-+  if (!CBS_get_asn1_element(&tbs_certificate, &subject, CBS_ASN1_SEQUENCE)) {
-+    return false;
-+  }
-+  *subject_out =
-+      absl::string_view(reinterpret_cast<const char*>(CBS_data(&subject)), CBS_len(&subject));
-+  return true;
-+}
-+
- } // namespace quic
-diff --git a/source/extensions/quic_listeners/quiche/platform/quic_cert_utils_impl.h b/source/extensions/quic_listeners/quiche/platform/quic_cert_utils_impl.h
-index 0c41b9dbc..29b882b7d 100644
---- a/source/extensions/quic_listeners/quiche/platform/quic_cert_utils_impl.h
-+++ b/source/extensions/quic_listeners/quiche/platform/quic_cert_utils_impl.h
-@@ -6,18 +6,15 @@
- // consumed or referenced directly by other Envoy code. It serves purely as a
- // porting layer for QUICHE.
- 
-+#include "absl/strings/string_view.h"
- #include "openssl/base.h"
--#include "quiche/common/platform/api/quiche_string_piece.h"
- 
- namespace quic {
- 
- class QuicCertUtilsImpl {
- public:
--  static bool ExtractSubjectNameFromDERCert(quiche::QuicheStringPiece cert,
--                                            quiche::QuicheStringPiece* subject_out);
--
--private:
--  static bool SeekToSubject(quiche::QuicheStringPiece cert, CBS* tbs_certificate);
-+  // NOLINTNEXTLINE(readability-identifier-naming)
-+  static bool ExtractSubjectNameFromDERCert(absl::string_view cert, absl::string_view* subject_out);
- };
- 
- } // namespace quic
-diff --git a/source/extensions/quic_listeners/quiche/platform/quic_fallthrough_impl.h b/source/extensions/quic_listeners/quiche/platform/quic_fallthrough_impl.h
-deleted file mode 100644
-index aa9d6bc36..000000000
---- a/source/extensions/quic_listeners/quiche/platform/quic_fallthrough_impl.h
-+++ /dev/null
-@@ -1,11 +0,0 @@
--#pragma once
--
--// NOLINT(namespace-envoy)
--
--// This file is part of the QUICHE platform implementation, and is not to be
--// consumed or referenced directly by other Envoy code. It serves purely as a
--// porting layer for QUICHE.
--
--#include "absl/base/macros.h"
--
--#define QUIC_FALLTHROUGH_INTENDED_IMPL ABSL_FALLTHROUGH_INTENDED
-diff --git a/source/extensions/quic_listeners/quiche/platform/quic_file_utils_impl.cc b/source/extensions/quic_listeners/quiche/platform/quic_file_utils_impl.cc
-index 91d52c44a..b2e396fab 100644
---- a/source/extensions/quic_listeners/quiche/platform/quic_file_utils_impl.cc
-+++ b/source/extensions/quic_listeners/quiche/platform/quic_file_utils_impl.cc
-@@ -36,6 +36,7 @@ void depthFirstTraverseDirectory(const std::string& dirname, std::vector<std::st
- } // namespace
- 
- // Traverses the directory |dirname| and returns all of the files it contains.
-+// NOLINTNEXTLINE(readability-identifier-naming)
- std::vector<std::string> ReadFileContentsImpl(const std::string& dirname) {
-   std::vector<std::string> files;
-   depthFirstTraverseDirectory(dirname, files);
-@@ -43,7 +44,8 @@ std::vector<std::string> ReadFileContentsImpl(const std::string& dirname) {
- }
- 
- // Reads the contents of |filename| as a string into |contents|.
--void ReadFileContentsImpl(quiche::QuicheStringPiece filename, std::string* contents) {
-+// NOLINTNEXTLINE(readability-identifier-naming)
-+void ReadFileContentsImpl(absl::string_view filename, std::string* contents) {
- #ifdef WIN32
-   Envoy::Filesystem::InstanceImplWin32 fs;
- #else
-diff --git a/source/extensions/quic_listeners/quiche/platform/quic_file_utils_impl.h b/source/extensions/quic_listeners/quiche/platform/quic_file_utils_impl.h
-index 654c1ad18..25c31e9de 100644
---- a/source/extensions/quic_listeners/quiche/platform/quic_file_utils_impl.h
-+++ b/source/extensions/quic_listeners/quiche/platform/quic_file_utils_impl.h
-@@ -8,7 +8,7 @@
- 
- #include <vector>
- 
--#include "quiche/common/platform/api/quiche_string_piece.h"
-+#include "absl/strings/string_view.h"
- 
- namespace quic {
- 
-@@ -16,6 +16,7 @@ namespace quic {
-  * Traverses the directory |dirname| and returns all of the files it contains.
-  * @param dirname full path without trailing '/'.
-  */
-+// NOLINTNEXTLINE(readability-identifier-naming)`
- std::vector<std::string> ReadFileContentsImpl(const std::string& dirname);
- 
- /**
-@@ -23,6 +24,7 @@ std::vector<std::string> ReadFileContentsImpl(const std::string& dirname);
-  *  @param filename the full path to the file.
-  *  @param contents output location of the file content.
-  */
--void ReadFileContentsImpl(quiche::QuicheStringPiece filename, std::string* contents);
-+// NOLINTNEXTLINE(readability-identifier-naming)
-+void ReadFileContentsImpl(absl::string_view filename, std::string* contents);
- 
- } // namespace quic
-diff --git a/source/extensions/quic_listeners/quiche/platform/quic_flags_impl.h b/source/extensions/quic_listeners/quiche/platform/quic_flags_impl.h
-index 872495f2d..d562bb1a4 100644
---- a/source/extensions/quic_listeners/quiche/platform/quic_flags_impl.h
-+++ b/source/extensions/quic_listeners/quiche/platform/quic_flags_impl.h
-@@ -15,16 +15,16 @@
- #define GetQuicFlagImpl(flag) (quiche::flag)->value()
- 
- // |flag| is the global flag variable, which is a pointer to TypedFlag<type>.
--#define SetQuicFlagImpl(flag, value) (quiche::flag)->SetValue(value)
-+#define SetQuicFlagImpl(flag, value) (quiche::flag)->setValue(value)
- 
- #define GetQuicReloadableFlagImpl(flag) quiche::FLAGS_quic_reloadable_flag_##flag->value()
- 
- #define SetQuicReloadableFlagImpl(flag, value)                                                     \
--  quiche::FLAGS_quic_reloadable_flag_##flag->SetValue(value)
-+  quiche::FLAGS_quic_reloadable_flag_##flag->setValue(value)
- 
- #define GetQuicRestartFlagImpl(flag) quiche::FLAGS_quic_restart_flag_##flag->value()
- 
--#define SetQuicRestartFlagImpl(flag, value) quiche::FLAGS_quic_restart_flag_##flag->SetValue(value)
-+#define SetQuicRestartFlagImpl(flag, value) quiche::FLAGS_quic_restart_flag_##flag->setValue(value)
- 
- // Not wired into command-line parsing.
- #define DEFINE_QUIC_COMMAND_LINE_FLAG_IMPL(type, flag, value, help)                                \
-diff --git a/source/extensions/quic_listeners/quiche/platform/quic_hostname_utils_impl.cc b/source/extensions/quic_listeners/quiche/platform/quic_hostname_utils_impl.cc
-index bcbafb566..75849611d 100644
---- a/source/extensions/quic_listeners/quiche/platform/quic_hostname_utils_impl.cc
-+++ b/source/extensions/quic_listeners/quiche/platform/quic_hostname_utils_impl.cc
-@@ -19,7 +19,8 @@
- namespace quic {
- 
- // static
--bool QuicHostnameUtilsImpl::IsValidSNI(quiche::QuicheStringPiece sni) {
-+// NOLINTNEXTLINE(readability-identifier-naming)
-+bool QuicHostnameUtilsImpl::IsValidSNI(absl::string_view sni) {
-   // TODO(wub): Implement it on top of GoogleUrl, once it is available.
- 
-   return sni.find_last_of('.') != std::string::npos &&
-@@ -27,7 +28,8 @@ bool QuicHostnameUtilsImpl::IsValidSNI(quiche::QuicheStringPiece sni) {
- }
- 
- // static
--std::string QuicHostnameUtilsImpl::NormalizeHostname(quiche::QuicheStringPiece hostname) {
-+// NOLINTNEXTLINE(readability-identifier-naming)
-+std::string QuicHostnameUtilsImpl::NormalizeHostname(absl::string_view hostname) {
-   // TODO(wub): Implement it on top of GoogleUrl, once it is available.
-   std::string host = absl::AsciiStrToLower(hostname);
- 
-diff --git a/source/extensions/quic_listeners/quiche/platform/quic_hostname_utils_impl.h b/source/extensions/quic_listeners/quiche/platform/quic_hostname_utils_impl.h
-index 2b7ed4357..67cd787d0 100644
---- a/source/extensions/quic_listeners/quiche/platform/quic_hostname_utils_impl.h
-+++ b/source/extensions/quic_listeners/quiche/platform/quic_hostname_utils_impl.h
-@@ -6,7 +6,7 @@
- // consumed or referenced directly by other Envoy code. It serves purely as a
- // porting layer for QUICHE.
- 
--#include "quiche/common/platform/api/quiche_string_piece.h"
-+#include "absl/strings/string_view.h"
- #include "quiche/quic/platform/api/quic_export.h"
- 
- namespace quic {
-@@ -18,7 +18,8 @@ public:
-   //  (2) check that the hostname contains valid characters only; and
-   //  (3) contains at least one dot.
-   // NOTE(wub): Only (3) is implemented for now.
--  static bool IsValidSNI(quiche::QuicheStringPiece sni);
-+  // NOLINTNEXTLINE(readability-identifier-naming)
-+  static bool IsValidSNI(absl::string_view sni);
- 
-   // Normalize a hostname:
-   //  (1) Canonicalize it, similar to what Chromium does in
-@@ -27,7 +28,8 @@ public:
-   //  (3) Remove the trailing '.'.
-   // WARNING: May mutate |hostname| in place.
-   // NOTE(wub): Only (2) and (3) are implemented for now.
--  static std::string NormalizeHostname(quiche::QuicheStringPiece hostname);
-+  // NOLINTNEXTLINE(readability-identifier-naming)
-+  static std::string NormalizeHostname(absl::string_view hostname);
- 
- private:
-   QuicHostnameUtilsImpl() = delete;
-diff --git a/source/extensions/quic_listeners/quiche/platform/quic_macros_impl.h b/source/extensions/quic_listeners/quiche/platform/quic_macros_impl.h
-deleted file mode 100644
-index b8b70a042..000000000
---- a/source/extensions/quic_listeners/quiche/platform/quic_macros_impl.h
-+++ /dev/null
-@@ -1,13 +0,0 @@
--#pragma once
--
--// NOLINT(namespace-envoy)
--
--// This file is part of the QUICHE platform implementation, and is not to be
--// consumed or referenced directly by other Envoy code. It serves purely as a
--// porting layer for QUICHE.
--
--#include "absl/base/attributes.h"
--
--#define QUIC_MUST_USE_RESULT_IMPL ABSL_MUST_USE_RESULT
--#define QUIC_UNUSED_IMPL ABSL_ATTRIBUTE_UNUSED
--#define QUIC_CONST_INIT_IMPL ABSL_CONST_INIT
-diff --git a/source/extensions/quic_listeners/quiche/platform/quic_mem_slice_span_impl.cc b/source/extensions/quic_listeners/quiche/platform/quic_mem_slice_span_impl.cc
-index c2eb527d6..9e46c37df 100644
---- a/source/extensions/quic_listeners/quiche/platform/quic_mem_slice_span_impl.cc
-+++ b/source/extensions/quic_listeners/quiche/platform/quic_mem_slice_span_impl.cc
-@@ -10,7 +10,8 @@
- 
- namespace quic {
- 
--quiche::QuicheStringPiece QuicMemSliceSpanImpl::GetData(size_t index) {
-+// NOLINTNEXTLINE(readability-identifier-naming)
-+absl::string_view QuicMemSliceSpanImpl::GetData(size_t index) {
-   Envoy::Buffer::RawSliceVector slices = buffer_->getRawSlices(/*max_slices=*/index + 1);
-   ASSERT(slices.size() > index);
-   return {reinterpret_cast<char*>(slices[index].mem_), slices[index].len_};
-diff --git a/source/extensions/quic_listeners/quiche/platform/quic_mem_slice_span_impl.h b/source/extensions/quic_listeners/quiche/platform/quic_mem_slice_span_impl.h
-index 1824fb8d1..ef40e6387 100644
---- a/source/extensions/quic_listeners/quiche/platform/quic_mem_slice_span_impl.h
-+++ b/source/extensions/quic_listeners/quiche/platform/quic_mem_slice_span_impl.h
-@@ -9,7 +9,7 @@
- #include "envoy/buffer/buffer.h"
- 
- #include "absl/container/fixed_array.h"
--#include "quiche/common/platform/api/quiche_string_piece.h"
-+#include "absl/strings/string_view.h"
- #include "quiche/quic/core/quic_types.h"
- #include "quiche/quic/platform/api/quic_mem_slice.h"
- 
-@@ -43,9 +43,13 @@ public:
-   }
- 
-   // QuicMemSliceSpan
--  quiche::QuicheStringPiece GetData(size_t index);
-+  // NOLINTNEXTLINE(readability-identifier-naming)
-+  absl::string_view GetData(size_t index);
-+  // NOLINTNEXTLINE(readability-identifier-naming)
-   QuicByteCount total_length() { return buffer_->length(); };
-+  // NOLINTNEXTLINE(readability-identifier-naming)
-   size_t NumSlices() { return buffer_->getRawSlices().size(); }
-+  // NOLINTNEXTLINE(readability-identifier-naming)
-   template <typename ConsumeFunction> QuicByteCount ConsumeAll(ConsumeFunction consume);
-   bool empty() const { return buffer_->length() == 0; }
- 
-@@ -54,6 +58,7 @@ private:
- };
- 
- template <typename ConsumeFunction>
-+// NOLINTNEXTLINE(readability-identifier-naming)
- QuicByteCount QuicMemSliceSpanImpl::ConsumeAll(ConsumeFunction consume) {
-   size_t saved_length = 0;
-   for (auto& slice : buffer_->getRawSlices()) {
-diff --git a/source/extensions/quic_listeners/quiche/platform/quiche_ptr_util_impl.h b/source/extensions/quic_listeners/quiche/platform/quic_testvalue_impl.h
-similarity index 52%
-rename from source/extensions/quic_listeners/quiche/platform/quiche_ptr_util_impl.h
-rename to source/extensions/quic_listeners/quiche/platform/quic_testvalue_impl.h
-index aaebe5d5c..4b0201c35 100644
---- a/source/extensions/quic_listeners/quiche/platform/quiche_ptr_util_impl.h
-+++ b/source/extensions/quic_listeners/quiche/platform/quic_testvalue_impl.h
-@@ -6,12 +6,11 @@
- // consumed or referenced directly by other Envoy code. It serves purely as a
- // porting layer for QUICHE.
- 
--#include "absl/memory/memory.h"
-+#include "absl/strings/string_view.h"
- 
--namespace quiche {
-+namespace quic {
- 
--template <typename T> std::unique_ptr<T> QuicheWrapUniqueImpl(T* ptr) {
--  return absl::WrapUnique<T>(ptr);
--}
-+// NOLINTNEXTLINE(readability-identifier-naming)
-+template <class T> void AdjustTestValueImpl(absl::string_view /*label*/, T* /*var*/) {}
- 
--} // namespace quiche
-+} // namespace quic
-diff --git a/source/extensions/quic_listeners/quiche/platform/quic_udp_socket_platform_impl.h b/source/extensions/quic_listeners/quiche/platform/quic_udp_socket_platform_impl.h
-index 248cfc193..1e88abe46 100644
---- a/source/extensions/quic_listeners/quiche/platform/quic_udp_socket_platform_impl.h
-+++ b/source/extensions/quic_listeners/quiche/platform/quic_udp_socket_platform_impl.h
-@@ -19,4 +19,7 @@ inline bool GetGooglePacketHeadersFromControlMessageImpl(struct ::cmsghdr* /*cms
-   return false;
- }
- 
-+// NOLINTNEXTLINE(readability-identifier-naming)
-+inline void SetGoogleSocketOptionsImpl(int /*fd*/) {}
-+
- } // namespace quic
-diff --git a/source/extensions/quic_listeners/quiche/platform/quiche_arraysize_impl.h b/source/extensions/quic_listeners/quiche/platform/quiche_arraysize_impl.h
-deleted file mode 100644
-index 7a23b53da..000000000
---- a/source/extensions/quic_listeners/quiche/platform/quiche_arraysize_impl.h
-+++ /dev/null
-@@ -1,11 +0,0 @@
--#pragma once
--
--#include "absl/base/macros.h"
--
--// NOLINT(namespace-envoy)
--
--// This file is part of the QUICHE platform implementation, and is not to be
--// consumed or referenced directly by other Envoy code. It serves purely as a
--// porting layer for QUICHE.
--
--#define QUICHE_ARRAYSIZE_IMPL(array) ABSL_ARRAYSIZE(array)
-diff --git a/source/extensions/quic_listeners/quiche/platform/quiche_optional_impl.h b/source/extensions/quic_listeners/quiche/platform/quiche_optional_impl.h
-deleted file mode 100644
-index f8b2b6c08..000000000
---- a/source/extensions/quic_listeners/quiche/platform/quiche_optional_impl.h
-+++ /dev/null
-@@ -1,17 +0,0 @@
--#pragma once
--
--#include "absl/types/optional.h"
--
--// NOLINT(namespace-envoy)
--
--// This file is part of the QUICHE platform implementation, and is not to be
--// consumed or referenced directly by other Envoy code. It serves purely as a
--// porting layer for QUICHE.
--
--namespace quiche {
--
--template <typename T> using QuicheOptionalImpl = absl::optional<T>;
--
--#define QUICHE_NULLOPT_IMPL absl::nullopt
--
--} // namespace quiche
-diff --git a/source/extensions/quic_listeners/quiche/platform/quiche_text_utils_impl.h b/source/extensions/quic_listeners/quiche/platform/quiche_text_utils_impl.h
-index 3a6d1a393..7b87c1cd6 100644
---- a/source/extensions/quic_listeners/quiche/platform/quiche_text_utils_impl.h
-+++ b/source/extensions/quic_listeners/quiche/platform/quiche_text_utils_impl.h
-@@ -2,7 +2,6 @@
- 
- #include "common/common/base64.h"
- 
--#include "extensions/quic_listeners/quiche/platform/quiche_optional_impl.h"
- #include "extensions/quic_listeners/quiche/platform/quiche_string_piece_impl.h"
- #include "extensions/quic_listeners/quiche/platform/string_utils.h"
- 
-@@ -13,6 +12,7 @@
- #include "absl/strings/str_cat.h"
- #include "absl/strings/str_format.h"
- #include "absl/strings/str_split.h"
-+#include "absl/types/optional.h"
- 
- // NOLINT(namespace-envoy)
- 
-@@ -25,58 +25,16 @@ namespace quiche {
- class QuicheTextUtilsImpl {
- public:
-   // NOLINTNEXTLINE(readability-identifier-naming)
--  static bool StartsWith(QuicheStringPieceImpl data, QuicheStringPieceImpl prefix) {
--    return absl::StartsWith(data, prefix);
--  }
--
--  // NOLINTNEXTLINE(readability-identifier-naming)
--  static bool EndsWith(QuicheStringPieceImpl data, QuicheStringPieceImpl suffix) {
--    return absl::EndsWith(data, suffix);
--  }
--
--  // NOLINTNEXTLINE(readability-identifier-naming)
--  static bool EndsWithIgnoreCase(QuicheStringPieceImpl data, QuicheStringPieceImpl suffix) {
--    return absl::EndsWithIgnoreCase(data, suffix);
--  }
--
--  // NOLINTNEXTLINE(readability-identifier-naming)
--  static std::string ToLower(QuicheStringPieceImpl data) { return absl::AsciiStrToLower(data); }
-+  static std::string ToLower(absl::string_view data) { return absl::AsciiStrToLower(data); }
- 
-   // NOLINTNEXTLINE(readability-identifier-naming)
--  static void RemoveLeadingAndTrailingWhitespace(QuicheStringPieceImpl* data) {
-+  static void RemoveLeadingAndTrailingWhitespace(absl::string_view* data) {
-     *data = absl::StripAsciiWhitespace(*data);
-   }
- 
--  // NOLINTNEXTLINE(readability-identifier-naming)
--  static bool StringToUint64(QuicheStringPieceImpl in, uint64_t* out) {
--    return absl::SimpleAtoi(in, out);
--  }
--
--  // NOLINTNEXTLINE(readability-identifier-naming)
--  static bool StringToInt(QuicheStringPieceImpl in, int* out) { return absl::SimpleAtoi(in, out); }
--
--  // NOLINTNEXTLINE(readability-identifier-naming)
--  static bool StringToUint32(QuicheStringPieceImpl in, uint32_t* out) {
--    return absl::SimpleAtoi(in, out);
--  }
--
--  // NOLINTNEXTLINE(readability-identifier-naming)
--  static bool StringToSizeT(QuicheStringPieceImpl in, size_t* out) {
--    return absl::SimpleAtoi(in, out);
--  }
--
--  // NOLINTNEXTLINE(readability-identifier-naming)
--  static std::string Uint64ToString(uint64_t in) { return absl::StrCat(in); }
--
--  // NOLINTNEXTLINE(readability-identifier-naming)
--  static std::string HexEncode(QuicheStringPieceImpl data) { return absl::BytesToHexString(data); }
--
-   // NOLINTNEXTLINE(readability-identifier-naming)
-   static std::string Hex(uint32_t v) { return absl::StrCat(absl::Hex(v)); }
- 
--  // NOLINTNEXTLINE(readability-identifier-naming)
--  static std::string HexDecode(QuicheStringPieceImpl data) { return absl::HexStringToBytes(data); }
--
-   // NOLINTNEXTLINE(readability-identifier-naming)
-   static void Base64Encode(const uint8_t* data, size_t data_len, std::string* output) {
-     *output =
-@@ -84,27 +42,28 @@ public:
-   }
- 
-   // NOLINTNEXTLINE(readability-identifier-naming)
--  static QuicheOptionalImpl<std::string> Base64Decode(QuicheStringPieceImpl input) {
-+  static absl::optional<std::string> Base64Decode(absl::string_view input) {
-     return Envoy::Base64::decodeWithoutPadding(input);
-   }
- 
-   // NOLINTNEXTLINE(readability-identifier-naming)
--  static std::string HexDump(QuicheStringPieceImpl binary_data) {
--    return quiche::HexDump(binary_data);
--  }
-+  static std::string Uint64ToString(uint64_t in) { return absl::StrCat(in); }
-+
-+  // NOLINTNEXTLINE(readability-identifier-naming)
-+  static std::string HexDump(absl::string_view binary_data) { return quiche::HexDump(binary_data); }
- 
-   // NOLINTNEXTLINE(readability-identifier-naming)
--  static bool ContainsUpperCase(QuicheStringPieceImpl data) {
-+  static bool ContainsUpperCase(absl::string_view data) {
-     return std::any_of(data.begin(), data.end(), absl::ascii_isupper);
-   }
- 
-   // NOLINTNEXTLINE(readability-identifier-naming)
--  static bool IsAllDigits(QuicheStringPieceImpl data) {
-+  static bool IsAllDigits(absl::string_view data) {
-     return std::all_of(data.begin(), data.end(), absl::ascii_isdigit);
-   }
- 
-   // NOLINTNEXTLINE(readability-identifier-naming)
--  static std::vector<QuicheStringPieceImpl> Split(QuicheStringPieceImpl data, char delim) {
-+  static std::vector<absl::string_view> Split(absl::string_view data, char delim) {
-     return absl::StrSplit(data, delim);
-   }
- };
-diff --git a/source/extensions/quic_listeners/quiche/platform/quiche_time_utils_impl.cc b/source/extensions/quic_listeners/quiche/platform/quiche_time_utils_impl.cc
-index 3260eafee..5387e0598 100644
---- a/source/extensions/quic_listeners/quiche/platform/quiche_time_utils_impl.cc
-+++ b/source/extensions/quic_listeners/quiche/platform/quiche_time_utils_impl.cc
-@@ -9,7 +9,7 @@
- namespace quiche {
- 
- namespace {
--QuicheOptional<int64_t> quicheUtcDateTimeToUnixSecondsInner(int year, int month, int day, int hour,
-+absl::optional<int64_t> quicheUtcDateTimeToUnixSecondsInner(int year, int month, int day, int hour,
-                                                             int minute, int second) {
-   const absl::CivilSecond civil_time(year, month, day, hour, minute, second);
-   if (second != 60 && (civil_time.year() != year || civil_time.month() != month ||
-@@ -24,7 +24,7 @@ QuicheOptional<int64_t> quicheUtcDateTimeToUnixSecondsInner(int year, int month,
- } // namespace
- 
- // NOLINTNEXTLINE(readability-identifier-naming)
--QuicheOptional<int64_t> QuicheUtcDateTimeToUnixSecondsImpl(int year, int month, int day, int hour,
-+absl::optional<int64_t> QuicheUtcDateTimeToUnixSecondsImpl(int year, int month, int day, int hour,
-                                                            int minute, int second) {
-   // Handle leap seconds without letting any other irregularities happen.
-   if (second == 60) {
-diff --git a/source/extensions/quic_listeners/quiche/platform/quiche_time_utils_impl.h b/source/extensions/quic_listeners/quiche/platform/quiche_time_utils_impl.h
-index a1b70b70a..5e2ef7956 100644
---- a/source/extensions/quic_listeners/quiche/platform/quiche_time_utils_impl.h
-+++ b/source/extensions/quic_listeners/quiche/platform/quiche_time_utils_impl.h
-@@ -10,12 +10,12 @@
- 
- #include "absl/time/civil_time.h"
- #include "absl/time/time.h"
--#include "quiche/common/platform/api/quiche_optional.h"
-+#include "absl/types/optional.h"
- 
- namespace quiche {
- 
- // NOLINTNEXTLINE(readability-identifier-naming)
--QuicheOptional<int64_t> QuicheUtcDateTimeToUnixSecondsImpl(int year, int month, int day, int hour,
-+absl::optional<int64_t> QuicheUtcDateTimeToUnixSecondsImpl(int year, int month, int day, int hour,
-                                                            int minute, int second);
- 
- } // namespace quiche
-diff --git a/source/extensions/quic_listeners/quiche/platform/spdy_endianness_util_impl.h b/source/extensions/quic_listeners/quiche/platform/spdy_endianness_util_impl.h
-deleted file mode 100644
-index 737b81ee2..000000000
---- a/source/extensions/quic_listeners/quiche/platform/spdy_endianness_util_impl.h
-+++ /dev/null
-@@ -1,29 +0,0 @@
--#pragma once
--
--#include <cstdint>
--
--#include "envoy/common/platform.h"
--
--// NOLINT(namespace-envoy)
--
--// This file is part of the QUICHE platform implementation, and is not to be
--// consumed or referenced directly by other Envoy code. It serves purely as a
--// porting layer for QUICHE.
--
--namespace spdy {
--
--inline uint16_t SpdyNetToHost16Impl(uint16_t x) { return ntohs(x); }
--
--inline uint32_t SpdyNetToHost32Impl(uint32_t x) { return ntohl(x); }
--
--// TODO: implement
--inline uint64_t SpdyNetToHost64Impl(uint64_t /*x*/) { return 0; }
--
--inline uint16_t SpdyHostToNet16Impl(uint16_t x) { return htons(x); }
--
--inline uint32_t SpdyHostToNet32Impl(uint32_t x) { return htonl(x); }
--
--// TODO: implement
--inline uint64_t SpdyHostToNet64Impl(uint64_t /*x*/) { return 0; }
--
--} // namespace spdy
-diff --git a/source/extensions/quic_listeners/quiche/platform/spdy_flags_impl.h b/source/extensions/quic_listeners/quiche/platform/spdy_flags_impl.h
-index a3cbd680f..833562fab 100644
---- a/source/extensions/quic_listeners/quiche/platform/spdy_flags_impl.h
-+++ b/source/extensions/quic_listeners/quiche/platform/spdy_flags_impl.h
-@@ -8,9 +8,9 @@
- 
- #include "extensions/quic_listeners/quiche/platform/flags_impl.h"
- 
--#define GetSpdyReloadableFlagImpl(flag) quiche::FLAGS_spdy_reloadable_flag_##flag->value()
-+#define GetSpdyReloadableFlagImpl(flag) quiche::FLAGS_quic_reloadable_flag_##flag->value()
- 
--#define GetSpdyRestartFlagImpl(flag) quiche::FLAGS_spdy_restart_flag_##flag->value()
-+#define GetSpdyRestartFlagImpl(flag) quiche::FLAGS_quic_restart_flag_##flag->value()
- 
- #define SPDY_CODE_COUNT_N_IMPL(flag, instance, total)                                              \
-   do {                                                                                             \
-diff --git a/source/extensions/quic_listeners/quiche/platform/spdy_string_utils_impl.h b/source/extensions/quic_listeners/quiche/platform/spdy_string_utils_impl.h
-index 41fa3cad8..4b01b2dbd 100644
---- a/source/extensions/quic_listeners/quiche/platform/spdy_string_utils_impl.h
-+++ b/source/extensions/quic_listeners/quiche/platform/spdy_string_utils_impl.h
-@@ -50,7 +50,7 @@ inline std::string SpdyHexEncodeUInt32AndTrimImpl(uint32_t data) {
- inline std::string SpdyHexDumpImpl(absl::string_view data) { return quiche::HexDump(data); }
- 
- struct SpdyStringPieceCaseHashImpl {
--  size_t operator()(quiche::QuicheStringPiece data) const {
-+  size_t operator()(absl::string_view data) const {
-     std::string lower = absl::AsciiStrToLower(data);
-     return absl::Hash<std::string>()(lower);
-   }
-diff --git a/source/extensions/quic_listeners/quiche/spdy_server_push_utils_for_envoy.cc b/source/extensions/quic_listeners/quiche/spdy_server_push_utils_for_envoy.cc
-index 3bd0bc295..5ac5738c4 100644
---- a/source/extensions/quic_listeners/quiche/spdy_server_push_utils_for_envoy.cc
-+++ b/source/extensions/quic_listeners/quiche/spdy_server_push_utils_for_envoy.cc
-@@ -12,25 +12,29 @@ using spdy::SpdyHeaderBlock;
- namespace quic {
- 
- // static
-+// NOLINTNEXTLINE(readability-identifier-naming)
- std::string SpdyServerPushUtils::GetPromisedUrlFromHeaders(const SpdyHeaderBlock& /*headers*/) {
-   NOT_IMPLEMENTED_GCOVR_EXCL_LINE;
- }
- 
- // static
- std::string
-+// NOLINTNEXTLINE(readability-identifier-naming)
- SpdyServerPushUtils::GetPromisedHostNameFromHeaders(const SpdyHeaderBlock& /*headers*/) {
-   NOT_IMPLEMENTED_GCOVR_EXCL_LINE;
- }
- 
- // static
-+// NOLINTNEXTLINE(readability-identifier-naming)
- bool SpdyServerPushUtils::PromisedUrlIsValid(const SpdyHeaderBlock& /*headers*/) {
-   NOT_IMPLEMENTED_GCOVR_EXCL_LINE;
- }
- 
- // static
--std::string SpdyServerPushUtils::GetPushPromiseUrl(quiche::QuicheStringPiece /*scheme*/,
--                                                   quiche::QuicheStringPiece /*authority*/,
--                                                   quiche::QuicheStringPiece /*path*/) {
-+// NOLINTNEXTLINE(readability-identifier-naming)
-+std::string SpdyServerPushUtils::GetPushPromiseUrl(absl::string_view /*scheme*/,
-+                                                   absl::string_view /*authority*/,
-+                                                   absl::string_view /*path*/) {
-   NOT_IMPLEMENTED_GCOVR_EXCL_LINE;
- }
- 
-diff --git a/test/extensions/quic_listeners/quiche/envoy_quic_client_session_test.cc b/test/extensions/quic_listeners/quiche/envoy_quic_client_session_test.cc
-index e2d90d916..8fa7d9fe9 100644
---- a/test/extensions/quic_listeners/quiche/envoy_quic_client_session_test.cc
-+++ b/test/extensions/quic_listeners/quiche/envoy_quic_client_session_test.cc
-@@ -49,9 +49,9 @@ public:
-                                 Network::ConnectionSocketPtr&& connection_socket)
-       : EnvoyQuicClientConnection(server_connection_id, helper, alarm_factory, &writer, false,
-                                   supported_versions, dispatcher, std::move(connection_socket)) {
--    SetDefaultEncryptionLevel(quic::ENCRYPTION_FORWARD_SECURE);
-     SetEncrypter(quic::ENCRYPTION_FORWARD_SECURE,
-                  std::make_unique<quic::NullEncrypter>(quic::Perspective::IS_CLIENT));
-+    SetDefaultEncryptionLevel(quic::ENCRYPTION_FORWARD_SECURE);
-   }
- 
-   MOCK_METHOD(void, SendConnectionClosePacket, (quic::QuicErrorCode, const std::string&));
-diff --git a/test/extensions/quic_listeners/quiche/envoy_quic_client_stream_test.cc b/test/extensions/quic_listeners/quiche/envoy_quic_client_stream_test.cc
-index 98359c618..f3b02f4cc 100644
---- a/test/extensions/quic_listeners/quiche/envoy_quic_client_stream_test.cc
-+++ b/test/extensions/quic_listeners/quiche/envoy_quic_client_stream_test.cc
-@@ -48,11 +48,11 @@ public:
-     quic_session_.ActivateStream(std::unique_ptr<EnvoyQuicClientStream>(quic_stream_));
-     EXPECT_CALL(quic_session_, ShouldYield(_)).WillRepeatedly(testing::Return(false));
-     EXPECT_CALL(quic_session_, WritevData(_, _, _, _, _, _))
--        .WillRepeatedly(Invoke([](quic::QuicStreamId, size_t write_length, quic::QuicStreamOffset,
--                                  quic::StreamSendingState state, bool,
--                                  quiche::QuicheOptional<quic::EncryptionLevel>) {
--          return quic::QuicConsumedData{write_length, state != quic::NO_FIN};
--        }));
-+        .WillRepeatedly(
-+            Invoke([](quic::QuicStreamId, size_t write_length, quic::QuicStreamOffset,
-+                      quic::StreamSendingState state, bool, absl::optional<quic::EncryptionLevel>) {
-+              return quic::QuicConsumedData{write_length, state != quic::NO_FIN};
-+            }));
-     EXPECT_CALL(writer_, WritePacket(_, _, _, _, _))
-         .WillRepeatedly(Invoke([](const char*, size_t buf_len, const quic::QuicIpAddress&,
-                                   const quic::QuicSocketAddress&, quic::PerPacketOptions*) {
-@@ -146,7 +146,7 @@ TEST_P(EnvoyQuicClientStreamTest, PostRequestAndResponse) {
-     std::unique_ptr<char[]> data_buffer;
-     quic::QuicByteCount data_frame_header_length =
-         quic::HttpEncoder::SerializeDataFrameHeader(response_body_.length(), &data_buffer);
--    quiche::QuicheStringPiece data_frame_header(data_buffer.get(), data_frame_header_length);
-+    absl::string_view data_frame_header(data_buffer.get(), data_frame_header_length);
-     data = absl::StrCat(data_frame_header, response_body_);
-   }
-   quic::QuicStreamFrame frame(stream_id_, false, 0, data);
-@@ -184,7 +184,7 @@ TEST_P(EnvoyQuicClientStreamTest, OutOfOrderTrailers) {
-     std::unique_ptr<char[]> data_buffer;
-     quic::QuicByteCount data_frame_header_length =
-         quic::HttpEncoder::SerializeDataFrameHeader(response_body_.length(), &data_buffer);
--    quiche::QuicheStringPiece data_frame_header(data_buffer.get(), data_frame_header_length);
-+    absl::string_view data_frame_header(data_buffer.get(), data_frame_header_length);
-     data = absl::StrCat(data_frame_header, response_body_);
-   }
-   quic::QuicStreamFrame frame(stream_id_, false, 0, data);
-@@ -301,11 +301,11 @@ TEST_P(EnvoyQuicClientStreamTest, HeadersContributeToWatermarkIquic) {
-   // Unblock writing now, and this will write out 16kB data and cause stream to
-   // be blocked by the flow control limit.
-   EXPECT_CALL(quic_session_, WritevData(_, _, _, _, _, _))
--      .WillOnce(Invoke([](quic::QuicStreamId, size_t write_length, quic::QuicStreamOffset,
--                          quic::StreamSendingState state, bool,
--                          quiche::QuicheOptional<quic::EncryptionLevel>) {
--        return quic::QuicConsumedData{write_length, state != quic::NO_FIN};
--      }));
-+      .WillOnce(
-+          Invoke([](quic::QuicStreamId, size_t write_length, quic::QuicStreamOffset,
-+                    quic::StreamSendingState state, bool, absl::optional<quic::EncryptionLevel>) {
-+            return quic::QuicConsumedData{write_length, state != quic::NO_FIN};
-+          }));
-   EXPECT_CALL(stream_callbacks_, onBelowWriteBufferLowWatermark());
-   quic_session_.OnCanWrite();
-   EXPECT_TRUE(quic_stream_->IsFlowControlBlocked());
-@@ -315,20 +315,20 @@ TEST_P(EnvoyQuicClientStreamTest, HeadersContributeToWatermarkIquic) {
-                                              32 * 1024);
-   quic_stream_->OnWindowUpdateFrame(window_update1);
-   EXPECT_CALL(quic_session_, WritevData(_, _, _, _, _, _))
--      .WillOnce(Invoke([](quic::QuicStreamId, size_t write_length, quic::QuicStreamOffset,
--                          quic::StreamSendingState state, bool,
--                          quiche::QuicheOptional<quic::EncryptionLevel>) {
--        return quic::QuicConsumedData{write_length, state != quic::NO_FIN};
--      }));
-+      .WillOnce(
-+          Invoke([](quic::QuicStreamId, size_t write_length, quic::QuicStreamOffset,
-+                    quic::StreamSendingState state, bool, absl::optional<quic::EncryptionLevel>) {
-+            return quic::QuicConsumedData{write_length, state != quic::NO_FIN};
-+          }));
-   quic_session_.OnCanWrite();
-   // No data should be buffered at this point.
- 
-   EXPECT_CALL(quic_session_, WritevData(_, _, _, _, _, _))
--      .WillOnce(Invoke([](quic::QuicStreamId, size_t, quic::QuicStreamOffset,
--                          quic::StreamSendingState state, bool,
--                          quiche::QuicheOptional<quic::EncryptionLevel>) {
--        return quic::QuicConsumedData{0u, state != quic::NO_FIN};
--      }));
-+      .WillOnce(
-+          Invoke([](quic::QuicStreamId, size_t, quic::QuicStreamOffset,
-+                    quic::StreamSendingState state, bool, absl::optional<quic::EncryptionLevel>) {
-+            return quic::QuicConsumedData{0u, state != quic::NO_FIN};
-+          }));
-   // Send more data. If watermark bytes counting were not cleared in previous
-   // OnCanWrite, this write would have caused the stream to exceed its high watermark.
-   std::string request1(16 * 1024 - 3, 'a');
-diff --git a/test/extensions/quic_listeners/quiche/envoy_quic_proof_source_test.cc b/test/extensions/quic_listeners/quiche/envoy_quic_proof_source_test.cc
-index cbf66f511..8a493a8e8 100644
---- a/test/extensions/quic_listeners/quiche/envoy_quic_proof_source_test.cc
-+++ b/test/extensions/quic_listeners/quiche/envoy_quic_proof_source_test.cc
-@@ -25,7 +25,7 @@ namespace Quic {
- class TestGetProofCallback : public quic::ProofSource::Callback {
- public:
-   TestGetProofCallback(bool& called, bool should_succeed, const std::string& server_config,
--                       quic::QuicTransportVersion& version, quiche::QuicheStringPiece chlo_hash,
-+                       quic::QuicTransportVersion& version, absl::string_view chlo_hash,
-                        Network::FilterChain& filter_chain)
-       : called_(called), should_succeed_(should_succeed), server_config_(server_config),
-         version_(version), chlo_hash_(chlo_hash), expected_filter_chain_(filter_chain) {
-@@ -100,7 +100,7 @@ private:
-   bool should_succeed_;
-   const std::string& server_config_;
-   const quic::QuicTransportVersion& version_;
--  quiche::QuicheStringPiece chlo_hash_;
-+  absl::string_view chlo_hash_;
-   Network::FilterChain& expected_filter_chain_;
-   NiceMock<Stats::MockStore> store_;
-   Event::GlobalTimeSystem time_system_;
-@@ -178,7 +178,7 @@ protected:
-   quic::QuicSocketAddress server_address_;
-   quic::QuicSocketAddress client_address_;
-   quic::QuicTransportVersion version_{quic::QUIC_VERSION_UNSUPPORTED};
--  quiche::QuicheStringPiece chlo_hash_{"aaaaa"};
-+  absl::string_view chlo_hash_{"aaaaa"};
-   std::string server_config_{"Server Config"};
-   std::string expected_certs_{quic::test::kTestCertificateChainPem};
-   std::string pkey_{quic::test::kTestCertificatePrivateKeyPem};
-diff --git a/test/extensions/quic_listeners/quiche/envoy_quic_proof_verifier_test.cc b/test/extensions/quic_listeners/quiche/envoy_quic_proof_verifier_test.cc
-index 4a1dfe144..9cdc169cd 100644
---- a/test/extensions/quic_listeners/quiche/envoy_quic_proof_verifier_test.cc
-+++ b/test/extensions/quic_listeners/quiche/envoy_quic_proof_verifier_test.cc
-@@ -163,7 +163,7 @@ TEST_F(EnvoyQuicProofVerifierTest, VerifyProofFailureEmptyCertChain) {
-   std::unique_ptr<quic::CertificateView> cert_view =
-       quic::CertificateView::ParseSingleCertificate(leaf_cert_);
-   quic::QuicTransportVersion version{quic::QUIC_VERSION_UNSUPPORTED};
--  quiche::QuicheStringPiece chlo_hash{"aaaaa"};
-+  absl::string_view chlo_hash{"aaaaa"};
-   std::string server_config{"Server Config"};
-   const std::string ocsp_response;
-   const std::string cert_sct;
-@@ -181,7 +181,7 @@ TEST_F(EnvoyQuicProofVerifierTest, VerifyProofFailureInvalidLeafCert) {
-   std::unique_ptr<quic::CertificateView> cert_view =
-       quic::CertificateView::ParseSingleCertificate(leaf_cert_);
-   quic::QuicTransportVersion version{quic::QUIC_VERSION_UNSUPPORTED};
--  quiche::QuicheStringPiece chlo_hash{"aaaaa"};
-+  absl::string_view chlo_hash{"aaaaa"};
-   std::string server_config{"Server Config"};
-   const std::string ocsp_response;
-   const std::string cert_sct;
-@@ -197,7 +197,7 @@ TEST_F(EnvoyQuicProofVerifierTest, VerifyProofFailureInvalidLeafCert) {
- TEST_F(EnvoyQuicProofVerifierTest, VerifyProofFailureUnsupportedECKey) {
-   configCertVerificationDetails(true);
-   quic::QuicTransportVersion version{quic::QUIC_VERSION_UNSUPPORTED};
--  quiche::QuicheStringPiece chlo_hash{"aaaaa"};
-+  absl::string_view chlo_hash{"aaaaa"};
-   std::string server_config{"Server Config"};
-   const std::string ocsp_response;
-   const std::string cert_sct;
-@@ -236,7 +236,7 @@ TEST_F(EnvoyQuicProofVerifierTest, VerifyProofFailureInvalidSignature) {
-   std::unique_ptr<quic::CertificateView> cert_view =
-       quic::CertificateView::ParseSingleCertificate(leaf_cert_);
-   quic::QuicTransportVersion version{quic::QUIC_VERSION_UNSUPPORTED};
--  quiche::QuicheStringPiece chlo_hash{"aaaaa"};
-+  absl::string_view chlo_hash{"aaaaa"};
-   std::string server_config{"Server Config"};
-   const std::string ocsp_response;
-   const std::string cert_sct;
-diff --git a/test/extensions/quic_listeners/quiche/envoy_quic_server_session_test.cc b/test/extensions/quic_listeners/quiche/envoy_quic_server_session_test.cc
-index 05307c6b9..4fc376857 100644
---- a/test/extensions/quic_listeners/quiche/envoy_quic_server_session_test.cc
-+++ b/test/extensions/quic_listeners/quiche/envoy_quic_server_session_test.cc
-@@ -61,6 +61,7 @@ public:
-                                 const quic::ParsedQuicVersionVector& supported_versions,
-                                 Network::Socket& listen_socket)
-       : EnvoyQuicServerConnection(quic::test::TestConnectionId(),
-+                                  quic::QuicSocketAddress(quic::QuicIpAddress::Any4(), 12345),
-                                   quic::QuicSocketAddress(quic::QuicIpAddress::Loopback4(), 12345),
-                                   helper, alarm_factory, &writer, /*owns_writer=*/false,
-                                   supported_versions, listen_socket) {}
-@@ -201,10 +202,10 @@ public:
-       crypto_stream_ = test_crypto_stream;
-     }
-     quic::test::QuicServerSessionBasePeer::SetCryptoStream(&envoy_quic_session_, crypto_stream);
--    quic_connection_->SetDefaultEncryptionLevel(quic::ENCRYPTION_FORWARD_SECURE);
-     quic_connection_->SetEncrypter(
-         quic::ENCRYPTION_FORWARD_SECURE,
-         std::make_unique<quic::NullEncrypter>(quic::Perspective::IS_SERVER));
-+    quic_connection_->SetDefaultEncryptionLevel(quic::ENCRYPTION_FORWARD_SECURE);
-   }
- 
-   bool installReadFilter() {
-diff --git a/test/extensions/quic_listeners/quiche/envoy_quic_server_stream_test.cc b/test/extensions/quic_listeners/quiche/envoy_quic_server_stream_test.cc
-index c2fd31c6f..f602e2c9a 100644
---- a/test/extensions/quic_listeners/quiche/envoy_quic_server_stream_test.cc
-+++ b/test/extensions/quic_listeners/quiche/envoy_quic_server_stream_test.cc
-@@ -51,6 +51,7 @@ public:
-                                             POOL_GAUGE(listener_config_.listenerScope()),
-                                             POOL_HISTOGRAM(listener_config_.listenerScope()))}),
-         quic_connection_(quic::test::TestConnectionId(),
-+                         quic::QuicSocketAddress(quic::QuicIpAddress::Any6(), 123),
-                          quic::QuicSocketAddress(quic::QuicIpAddress::Any6(), 12345),
-                          connection_helper_, alarm_factory_, &writer_,
-                          /*owns_writer=*/false, {quic_version_}, *listener_config_.socket_),
-@@ -66,11 +67,11 @@ public:
-     quic_session_.ActivateStream(std::unique_ptr<EnvoyQuicServerStream>(quic_stream_));
-     EXPECT_CALL(quic_session_, ShouldYield(_)).WillRepeatedly(testing::Return(false));
-     EXPECT_CALL(quic_session_, WritevData(_, _, _, _, _, _))
--        .WillRepeatedly(Invoke([](quic::QuicStreamId, size_t write_length, quic::QuicStreamOffset,
--                                  quic::StreamSendingState state, bool,
--                                  quiche::QuicheOptional<quic::EncryptionLevel>) {
--          return quic::QuicConsumedData{write_length, state != quic::NO_FIN};
--        }));
-+        .WillRepeatedly(
-+            Invoke([](quic::QuicStreamId, size_t write_length, quic::QuicStreamOffset,
-+                      quic::StreamSendingState state, bool, absl::optional<quic::EncryptionLevel>) {
-+              return quic::QuicConsumedData{write_length, state != quic::NO_FIN};
-+            }));
-     EXPECT_CALL(writer_, WritePacket(_, _, _, _, _))
-         .WillRepeatedly(Invoke([](const char*, size_t buf_len, const quic::QuicIpAddress&,
-                                   const quic::QuicSocketAddress&, quic::PerPacketOptions*) {
-@@ -110,7 +111,7 @@ public:
-       std::unique_ptr<char[]> data_buffer;
-       quic::QuicByteCount data_frame_header_length =
-           quic::HttpEncoder::SerializeDataFrameHeader(body.length(), &data_buffer);
--      quiche::QuicheStringPiece data_frame_header(data_buffer.get(), data_frame_header_length);
-+      absl::string_view data_frame_header(data_buffer.get(), data_frame_header_length);
-       data = absl::StrCat(data_frame_header, body);
-     }
-     return data;
-@@ -397,11 +398,11 @@ TEST_P(EnvoyQuicServerStreamTest, HeadersContributeToWatermarkIquic) {
- 
-   // Make the stream blocked by congestion control.
-   EXPECT_CALL(quic_session_, WritevData(_, _, _, _, _, _))
--      .WillOnce(Invoke([](quic::QuicStreamId, size_t /*write_length*/, quic::QuicStreamOffset,
--                          quic::StreamSendingState state, bool,
--                          quiche::QuicheOptional<quic::EncryptionLevel>) {
--        return quic::QuicConsumedData{0u, state != quic::NO_FIN};
--      }));
-+      .WillOnce(
-+          Invoke([](quic::QuicStreamId, size_t /*write_length*/, quic::QuicStreamOffset,
-+                    quic::StreamSendingState state, bool, absl::optional<quic::EncryptionLevel>) {
-+            return quic::QuicConsumedData{0u, state != quic::NO_FIN};
-+          }));
-   quic_stream_->encodeHeaders(response_headers_, /*end_stream=*/false);
- 
-   // Encode 16kB -10 bytes request body. Because the high watermark is 16KB, with previously
-@@ -415,11 +416,11 @@ TEST_P(EnvoyQuicServerStreamTest, HeadersContributeToWatermarkIquic) {
-   // Unblock writing now, and this will write out 16kB data and cause stream to
-   // be blocked by the flow control limit.
-   EXPECT_CALL(quic_session_, WritevData(_, _, _, _, _, _))
--      .WillOnce(Invoke([](quic::QuicStreamId, size_t write_length, quic::QuicStreamOffset,
--                          quic::StreamSendingState state, bool,
--                          quiche::QuicheOptional<quic::EncryptionLevel>) {
--        return quic::QuicConsumedData{write_length, state != quic::NO_FIN};
--      }));
-+      .WillOnce(
-+          Invoke([](quic::QuicStreamId, size_t write_length, quic::QuicStreamOffset,
-+                    quic::StreamSendingState state, bool, absl::optional<quic::EncryptionLevel>) {
-+            return quic::QuicConsumedData{write_length, state != quic::NO_FIN};
-+          }));
-   EXPECT_CALL(stream_callbacks_, onBelowWriteBufferLowWatermark());
-   quic_session_.OnCanWrite();
-   EXPECT_TRUE(quic_stream_->IsFlowControlBlocked());
-@@ -429,20 +430,20 @@ TEST_P(EnvoyQuicServerStreamTest, HeadersContributeToWatermarkIquic) {
-                                              32 * 1024);
-   quic_stream_->OnWindowUpdateFrame(window_update1);
-   EXPECT_CALL(quic_session_, WritevData(_, _, _, _, _, _))
--      .WillOnce(Invoke([](quic::QuicStreamId, size_t write_length, quic::QuicStreamOffset,
--                          quic::StreamSendingState state, bool,
--                          quiche::QuicheOptional<quic::EncryptionLevel>) {
--        return quic::QuicConsumedData{write_length, state != quic::NO_FIN};
--      }));
-+      .WillOnce(
-+          Invoke([](quic::QuicStreamId, size_t write_length, quic::QuicStreamOffset,
-+                    quic::StreamSendingState state, bool, absl::optional<quic::EncryptionLevel>) {
-+            return quic::QuicConsumedData{write_length, state != quic::NO_FIN};
-+          }));
-   quic_session_.OnCanWrite();
-   // No data should be buffered at this point.
- 
-   EXPECT_CALL(quic_session_, WritevData(_, _, _, _, _, _))
--      .WillRepeatedly(Invoke([](quic::QuicStreamId, size_t, quic::QuicStreamOffset,
--                                quic::StreamSendingState state, bool,
--                                quiche::QuicheOptional<quic::EncryptionLevel>) {
--        return quic::QuicConsumedData{0u, state != quic::NO_FIN};
--      }));
-+      .WillRepeatedly(
-+          Invoke([](quic::QuicStreamId, size_t, quic::QuicStreamOffset,
-+                    quic::StreamSendingState state, bool, absl::optional<quic::EncryptionLevel>) {
-+            return quic::QuicConsumedData{0u, state != quic::NO_FIN};
-+          }));
-   // Send more data. If watermark bytes counting were not cleared in previous
-   // OnCanWrite, this write would have caused the stream to exceed its high watermark.
-   std::string response1(16 * 1024 - 3, 'a');
-diff --git a/test/extensions/quic_listeners/quiche/platform/BUILD b/test/extensions/quic_listeners/quiche/platform/BUILD
-index 420e812b8..7dbb08d82 100644
---- a/test/extensions/quic_listeners/quiche/platform/BUILD
-+++ b/test/extensions/quic_listeners/quiche/platform/BUILD
-@@ -9,16 +9,6 @@ licenses(["notice"])  # Apache 2
- 
- envoy_package()
- 
--envoy_cc_test(
--    name = "quiche_platform_test",
--    srcs = ["quiche_platform_test.cc"],
--    external_deps = ["quiche_common_platform"],
--    deps = [
--        "@com_googlesource_quiche//:quiche_common_platform",
--        "@com_googlesource_quiche//:quiche_common_platform_endian",
--    ],
--)
--
- envoy_cc_test(
-     name = "http2_platform_test",
-     srcs = ["http2_platform_test.cc"],
-@@ -63,7 +53,6 @@ envoy_cc_test(
-         "@com_googlesource_quiche//:quic_platform_mem_slice_span",
-         "@com_googlesource_quiche//:quic_platform_mem_slice_storage",
-         "@com_googlesource_quiche//:quic_platform_mock_log",
--        "@com_googlesource_quiche//:quic_platform_port_utils",
-         "@com_googlesource_quiche//:quic_platform_sleep",
-         "@com_googlesource_quiche//:quic_platform_system_event_loop",
-         "@com_googlesource_quiche//:quic_platform_test",
-@@ -150,17 +139,6 @@ envoy_cc_test_library(
-     deps = ["@com_googlesource_quiche//:quic_platform_base"],
- )
- 
--envoy_cc_test_library(
--    name = "quic_platform_port_utils_impl_lib",
--    srcs = ["quic_port_utils_impl.cc"],
--    hdrs = ["quic_port_utils_impl.h"],
--    tags = ["nofips"],
--    deps = [
--        "//source/common/network:utility_lib",
--        "//test/test_common:environment_lib",
--    ],
--)
--
- envoy_cc_test_library(
-     name = "quic_platform_test_mem_slice_vector_impl_lib",
-     hdrs = ["quic_test_mem_slice_vector_impl.h"],
-diff --git a/test/extensions/quic_listeners/quiche/platform/http2_platform_test.cc b/test/extensions/quic_listeners/quiche/platform/http2_platform_test.cc
-index 069a79eab..35aee5d27 100644
---- a/test/extensions/quic_listeners/quiche/platform/http2_platform_test.cc
-+++ b/test/extensions/quic_listeners/quiche/platform/http2_platform_test.cc
-@@ -72,20 +72,14 @@ TEST(Http2PlatformTest, Http2Log) {
-   HTTP2_DLOG_EVERY_N(ERROR, 2) << "DLOG_EVERY_N(ERROR, 2)";
- }
- 
--TEST(Http2PlatformTest, Http2StringPiece) {
--  std::string s = "bar";
--  quiche::QuicheStringPiece sp(s);
--  EXPECT_EQ('b', sp[0]);
--}
--
- TEST(Http2PlatformTest, Http2Macro) {
-   EXPECT_DEBUG_DEATH(HTTP2_UNREACHABLE(), "");
-   EXPECT_DEATH(HTTP2_DIE_IF_NULL(nullptr), "");
- }
- 
- TEST(Http2PlatformTest, Http2Flags) {
--  auto& flag_registry = quiche::FlagRegistry::GetInstance();
--  flag_registry.ResetFlags();
-+  auto& flag_registry = quiche::FlagRegistry::getInstance();
-+  flag_registry.resetFlags();
-   EXPECT_FALSE(GetHttp2ReloadableFlag(http2_testonly_default_false));
-   SetHttp2ReloadableFlag(http2_testonly_default_false, true);
-   EXPECT_TRUE(GetHttp2ReloadableFlag(http2_testonly_default_false));
-@@ -93,22 +87,22 @@ TEST(Http2PlatformTest, Http2Flags) {
-   for (std::string s : {"1", "t", "true", "TRUE", "y", "yes", "Yes"}) {
-     SetHttp2ReloadableFlag(http2_testonly_default_false, false);
-     EXPECT_FALSE(GetHttp2ReloadableFlag(http2_testonly_default_false));
--    EXPECT_TRUE(flag_registry.FindFlag("http2_reloadable_flag_http2_testonly_default_false")
--                    ->SetValueFromString(s));
-+    EXPECT_TRUE(flag_registry.findFlag("FLAGS_quic_reloadable_flag_http2_testonly_default_false")
-+                    ->setValueFromString(s));
-     EXPECT_TRUE(GetHttp2ReloadableFlag(http2_testonly_default_false));
-   }
-   for (std::string s : {"0", "f", "false", "FALSE", "n", "no", "No"}) {
-     SetHttp2ReloadableFlag(http2_testonly_default_false, true);
-     EXPECT_TRUE(GetHttp2ReloadableFlag(http2_testonly_default_false));
--    EXPECT_TRUE(flag_registry.FindFlag("http2_reloadable_flag_http2_testonly_default_false")
--                    ->SetValueFromString(s));
-+    EXPECT_TRUE(flag_registry.findFlag("FLAGS_quic_reloadable_flag_http2_testonly_default_false")
-+                    ->setValueFromString(s));
-     EXPECT_FALSE(GetHttp2ReloadableFlag(http2_testonly_default_false));
-   }
-   for (std::string s : {"some", "invalid", "values", ""}) {
-     SetHttp2ReloadableFlag(http2_testonly_default_false, false);
-     EXPECT_FALSE(GetHttp2ReloadableFlag(http2_testonly_default_false));
--    EXPECT_FALSE(flag_registry.FindFlag("http2_reloadable_flag_http2_testonly_default_false")
--                     ->SetValueFromString(s));
-+    EXPECT_FALSE(flag_registry.findFlag("FLAGS_quic_reloadable_flag_http2_testonly_default_false")
-+                     ->setValueFromString(s));
-     EXPECT_FALSE(GetHttp2ReloadableFlag(http2_testonly_default_false));
-   }
- }
-diff --git a/test/extensions/quic_listeners/quiche/platform/quic_platform_test.cc b/test/extensions/quic_listeners/quiche/platform/quic_platform_test.cc
-index 68141aa94..902ad1a9e 100644
---- a/test/extensions/quic_listeners/quiche/platform/quic_platform_test.cc
-+++ b/test/extensions/quic_listeners/quiche/platform/quic_platform_test.cc
-@@ -30,7 +30,6 @@
- #include "gtest/gtest.h"
- #include "quiche/common/platform/api/quiche_string_piece.h"
- #include "quiche/epoll_server/fake_simple_epoll_server.h"
--#include "quiche/quic/platform/api/quic_aligned.h"
- #include "quiche/quic/platform/api/quic_bug_tracker.h"
- #include "quiche/quic/platform/api/quic_cert_utils.h"
- #include "quiche/quic/platform/api/quic_client_stats.h"
-@@ -42,7 +41,6 @@
- #include "quiche/quic/platform/api/quic_flags.h"
- #include "quiche/quic/platform/api/quic_hostname_utils.h"
- #include "quiche/quic/platform/api/quic_logging.h"
--#include "quiche/quic/platform/api/quic_macros.h"
- #include "quiche/quic/platform/api/quic_map_util.h"
- #include "quiche/quic/platform/api/quic_mem_slice.h"
- #include "quiche/quic/platform/api/quic_mem_slice_span.h"
-@@ -50,7 +48,6 @@
- #include "quiche/quic/platform/api/quic_mock_log.h"
- #include "quiche/quic/platform/api/quic_mutex.h"
- #include "quiche/quic/platform/api/quic_pcc_sender.h"
--#include "quiche/quic/platform/api/quic_port_utils.h"
- #include "quiche/quic/platform/api/quic_ptr_util.h"
- #include "quiche/quic/platform/api/quic_server_stats.h"
- #include "quiche/quic/platform/api/quic_sleep.h"
-@@ -92,8 +89,6 @@ protected:
-   const int verbosity_log_threshold_;
- };
- 
--TEST_F(QuicPlatformTest, QuicAlignOf) { EXPECT_LT(0, QUIC_ALIGN_OF(int)); }
--
- enum class TestEnum { ZERO = 0, ONE, TWO, COUNT };
- 
- TEST_F(QuicPlatformTest, QuicBugTracker) {
-@@ -468,9 +463,9 @@ TEST_F(QuicPlatformTest, QuicCertUtils) {
-   unsigned char* der = nullptr;
-   int len = i2d_X509(x509_cert.get(), &der);
-   ASSERT_GT(len, 0);
--  quiche::QuicheStringPiece out;
-+  absl::string_view out;
-   QuicCertUtils::ExtractSubjectNameFromDERCert(
--      quiche::QuicheStringPiece(reinterpret_cast<const char*>(der), len), &out);
-+      absl::string_view(reinterpret_cast<const char*>(der), len), &out);
-   EXPECT_EQ("0z1\v0\t\x6\x3U\x4\x6\x13\x2US1\x13"
-             "0\x11\x6\x3U\x4\b\f\nCalifornia1\x16"
-             "0\x14\x6\x3U\x4\a\f\rSan Francisco1\r"
-@@ -566,8 +561,8 @@ TEST_F(QuicPlatformTest, MonotonicityWithFakeEpollClock) {
- }
- 
- TEST_F(QuicPlatformTest, QuicFlags) {
--  auto& flag_registry = quiche::FlagRegistry::GetInstance();
--  flag_registry.ResetFlags();
-+  auto& flag_registry = quiche::FlagRegistry::getInstance();
-+  flag_registry.resetFlags();
- 
-   EXPECT_FALSE(GetQuicReloadableFlag(quic_testonly_default_false));
-   EXPECT_TRUE(GetQuicReloadableFlag(quic_testonly_default_true));
-@@ -583,14 +578,15 @@ TEST_F(QuicPlatformTest, QuicFlags) {
-   SetQuicFlag(FLAGS_quic_time_wait_list_seconds, 100);
-   EXPECT_EQ(100, GetQuicFlag(FLAGS_quic_time_wait_list_seconds));
- 
--  flag_registry.ResetFlags();
-+  flag_registry.resetFlags();
-   EXPECT_FALSE(GetQuicReloadableFlag(quic_testonly_default_false));
-   EXPECT_TRUE(GetQuicRestartFlag(quic_testonly_default_true));
-   EXPECT_EQ(200, GetQuicFlag(FLAGS_quic_time_wait_list_seconds));
--  flag_registry.FindFlag("quic_reloadable_flag_quic_testonly_default_false")
--      ->SetValueFromString("true");
--  flag_registry.FindFlag("quic_restart_flag_quic_testonly_default_true")->SetValueFromString("0");
--  flag_registry.FindFlag("quic_time_wait_list_seconds")->SetValueFromString("100");
-+  flag_registry.findFlag("FLAGS_quic_reloadable_flag_quic_testonly_default_false")
-+      ->setValueFromString("true");
-+  flag_registry.findFlag("FLAGS_quic_restart_flag_quic_testonly_default_true")
-+      ->setValueFromString("0");
-+  flag_registry.findFlag("FLAGS_quic_time_wait_list_seconds")->setValueFromString("100");
-   EXPECT_TRUE(GetQuicReloadableFlag(quic_testonly_default_false));
-   EXPECT_FALSE(GetQuicRestartFlag(quic_testonly_default_true));
-   EXPECT_EQ(100, GetQuicFlag(FLAGS_quic_time_wait_list_seconds));
-@@ -661,35 +657,6 @@ TEST_F(FileUtilsTest, ReadFileContents) {
-   EXPECT_EQ(data, output);
- }
- 
--TEST_F(QuicPlatformTest, PickUnsedPort) {
--  int port = QuicPickServerPortForTestsOrDie();
--  std::vector<Envoy::Network::Address::IpVersion> supported_versions =
--      Envoy::TestEnvironment::getIpVersionsForTest();
--  for (auto ip_version : supported_versions) {
--    Envoy::Network::Address::InstanceConstSharedPtr addr =
--        Envoy::Network::Test::getCanonicalLoopbackAddress(ip_version);
--    Envoy::Network::Address::InstanceConstSharedPtr addr_with_port =
--        Envoy::Network::Utility::getAddressWithPort(*addr, port);
--    Envoy::Network::SocketImpl sock(Envoy::Network::Socket::Type::Datagram, addr_with_port);
--    // binding of given port should success.
--    EXPECT_EQ(0, sock.bind(addr_with_port).rc_);
--  }
--}
--
--TEST_F(QuicPlatformTest, FailToPickUnsedPort) {
--  Envoy::Api::MockOsSysCalls os_sys_calls;
--  Envoy::TestThreadsafeSingletonInjector<Envoy::Api::OsSysCallsImpl> os_calls(&os_sys_calls);
--  // Actually create sockets.
--  EXPECT_CALL(os_sys_calls, socket(_, _, _)).WillRepeatedly([](int domain, int type, int protocol) {
--    os_fd_t fd = ::socket(domain, type, protocol);
--    return Envoy::Api::SysCallSocketResult{fd, errno};
--  });
--  // Fail bind call's to mimic port exhaustion.
--  EXPECT_CALL(os_sys_calls, bind(_, _, _))
--      .WillRepeatedly(Return(Envoy::Api::SysCallIntResult{-1, SOCKET_ERROR_ADDR_IN_USE}));
--  EXPECT_DEATH(QuicPickServerPortForTestsOrDie(), "Failed to pick a port for test.");
--}
--
- TEST_F(QuicPlatformTest, TestEnvoyQuicBufferAllocator) {
-   QuicStreamBufferAllocator allocator;
-   Envoy::Stats::TestUtil::MemoryTest memory_test;
-@@ -711,14 +678,6 @@ TEST_F(QuicPlatformTest, TestSystemEventLoop) {
-   QuicSystemEventLoop("dummy");
- }
- 
--QUIC_MUST_USE_RESULT bool dummyTestFunction() { return false; }
--
--TEST_F(QuicPlatformTest, TestQuicMacros) {
--  // Just make sure it compiles.
--  EXPECT_FALSE(dummyTestFunction());
--  int a QUIC_UNUSED;
--}
--
- TEST(EnvoyQuicMemSliceTest, ConstructMemSliceFromBuffer) {
-   std::string str(512, 'b');
-   // Fragment needs to out-live buffer.
-diff --git a/test/extensions/quic_listeners/quiche/platform/quic_test_output_impl.cc b/test/extensions/quic_listeners/quiche/platform/quic_test_output_impl.cc
-index 556f6cd3e..9eaf8532a 100644
---- a/test/extensions/quic_listeners/quiche/platform/quic_test_output_impl.cc
-+++ b/test/extensions/quic_listeners/quiche/platform/quic_test_output_impl.cc
-@@ -19,7 +19,7 @@
- namespace quic {
- namespace {
- 
--void QuicRecordTestOutputToFile(const std::string& filename, quiche::QuicheStringPiece data) {
-+void quicRecordTestOutputToFile(const std::string& filename, absl::string_view data) {
-   const char* output_dir_env = std::getenv("QUIC_TEST_OUTPUT_DIR");
-   if (output_dir_env == nullptr) {
-     QUIC_LOG(WARNING) << "Could not save test output since QUIC_TEST_OUTPUT_DIR is not set";
-@@ -64,11 +64,13 @@ void QuicRecordTestOutputToFile(const std::string& filename, quiche::QuicheStrin
- }
- } // namespace
- 
--void QuicSaveTestOutputImpl(quiche::QuicheStringPiece filename, quiche::QuicheStringPiece data) {
--  QuicRecordTestOutputToFile(filename.data(), data);
-+// NOLINTNEXTLINE(readability-identifier-naming)
-+void QuicSaveTestOutputImpl(absl::string_view filename, absl::string_view data) {
-+  quicRecordTestOutputToFile(filename.data(), data);
- }
- 
--bool QuicLoadTestOutputImpl(quiche::QuicheStringPiece filename, std::string* data) {
-+// NOLINTNEXTLINE(readability-identifier-naming)
-+bool QuicLoadTestOutputImpl(absl::string_view filename, std::string* data) {
-   const char* read_dir_env = std::getenv("QUIC_TEST_OUTPUT_DIR");
-   if (read_dir_env == nullptr) {
-     QUIC_LOG(WARNING) << "Could not load test output since QUIC_TEST_OUTPUT_DIR is not set";
-@@ -96,7 +98,8 @@ bool QuicLoadTestOutputImpl(quiche::QuicheStringPiece filename, std::string* dat
-   return true;
- }
- 
--void QuicRecordTraceImpl(quiche::QuicheStringPiece identifier, quiche::QuicheStringPiece data) {
-+// NOLINTNEXTLINE(readability-identifier-naming)
-+void QuicRecordTraceImpl(absl::string_view identifier, absl::string_view data) {
-   const testing::TestInfo* test_info = testing::UnitTest::GetInstance()->current_test_info();
- 
-   std::string timestamp = absl::FormatTime("%Y%m%d%H%M%S", absl::Now(), absl::LocalTimeZone());
-@@ -104,7 +107,7 @@ void QuicRecordTraceImpl(quiche::QuicheStringPiece identifier, quiche::QuicheStr
-   std::string filename = fmt::sprintf("%s.%s.%s.%s.qtr", test_info->name(),
-                                       test_info->test_case_name(), identifier.data(), timestamp);
- 
--  QuicRecordTestOutputToFile(filename, data);
-+  quicRecordTestOutputToFile(filename, data);
- }
- 
- } // namespace quic
-diff --git a/test/extensions/quic_listeners/quiche/platform/quic_test_output_impl.h b/test/extensions/quic_listeners/quiche/platform/quic_test_output_impl.h
-index a1c6c7305..fcf0c47b3 100644
---- a/test/extensions/quic_listeners/quiche/platform/quic_test_output_impl.h
-+++ b/test/extensions/quic_listeners/quiche/platform/quic_test_output_impl.h
-@@ -6,14 +6,16 @@
- // consumed or referenced directly by other Envoy code. It serves purely as a
- // porting layer for QUICHE.
- 
--#include "quiche/common/platform/api/quiche_string_piece.h"
-+#include "absl/strings/string_view.h"
- 
- namespace quic {
-+// NOLINTNEXTLINE(readability-identifier-naming)
-+void QuicSaveTestOutputImpl(absl::string_view filename, absl::string_view data);
- 
--void QuicSaveTestOutputImpl(quiche::QuicheStringPiece filename, quiche::QuicheStringPiece data);
-+// NOLINTNEXTLINE(readability-identifier-naming)
-+bool QuicLoadTestOutputImpl(absl::string_view filename, std::string* data);
- 
--bool QuicLoadTestOutputImpl(quiche::QuicheStringPiece filename, std::string* data);
--
--void QuicRecordTraceImpl(quiche::QuicheStringPiece identifier, quiche::QuicheStringPiece data);
-+// NOLINTNEXTLINE(readability-identifier-naming)
-+void QuicRecordTraceImpl(absl::string_view identifier, absl::string_view data);
- 
- } // namespace quic
-diff --git a/test/extensions/quic_listeners/quiche/platform/quiche_platform_test.cc b/test/extensions/quic_listeners/quiche/platform/quiche_platform_test.cc
-deleted file mode 100644
-index a733894b5..000000000
---- a/test/extensions/quic_listeners/quiche/platform/quiche_platform_test.cc
-+++ /dev/null
-@@ -1,39 +0,0 @@
--// NOLINT(namespace-envoy)
--
--// This file is part of the QUICHE platform implementation, and is not to be
--// consumed or referenced directly by other Envoy code. It serves purely as a
--// porting layer for QUICHE.
--
--#include "gtest/gtest.h"
--#include "quiche/common/platform/api/quiche_arraysize.h"
--#include "quiche/common/platform/api/quiche_endian.h"
--#include "quiche/common/platform/api/quiche_optional.h"
--#include "quiche/common/platform/api/quiche_ptr_util.h"
--#include "quiche/common/platform/api/quiche_string_piece.h"
--
--namespace quiche {
--
--TEST(QuichePlatformTest, Arraysize) {
--  int array[] = {0, 1, 2, 3, 4};
--  EXPECT_EQ(5, QUICHE_ARRAYSIZE(array));
--}
--
--TEST(QuichePlatformTest, StringPiece) {
--  std::string s = "bar";
--  QuicheStringPiece sp(s);
--  EXPECT_EQ('b', sp[0]);
--}
--
--TEST(QuichePlatformTest, WrapUnique) {
--  auto p = QuicheWrapUnique(new int(6));
--  EXPECT_EQ(6, *p);
--}
--
--TEST(QuichePlatformTest, TestQuicheOptional) {
--  QuicheOptional<int32_t> maybe_a;
--  EXPECT_FALSE(maybe_a.has_value());
--  maybe_a = 1;
--  EXPECT_EQ(1, *maybe_a);
--}
--
--} // namespace quiche
-diff --git a/test/extensions/quic_listeners/quiche/platform/spdy_platform_test.cc b/test/extensions/quic_listeners/quiche/platform/spdy_platform_test.cc
-index 56453e232..eeae58c0a 100644
---- a/test/extensions/quic_listeners/quiche/platform/spdy_platform_test.cc
-+++ b/test/extensions/quic_listeners/quiche/platform/spdy_platform_test.cc
-@@ -8,7 +8,6 @@
- #include "gtest/gtest.h"
- #include "quiche/spdy/platform/api/spdy_bug_tracker.h"
- #include "quiche/spdy/platform/api/spdy_containers.h"
--#include "quiche/spdy/platform/api/spdy_endianness_util.h"
- #include "quiche/spdy/platform/api/spdy_estimate_memory_usage.h"
- #include "quiche/spdy/platform/api/spdy_flags.h"
- #include "quiche/spdy/platform/api/spdy_logging.h"
-@@ -47,11 +46,6 @@ TEST(SpdyPlatformTest, SpdyHashSet) {
-   EXPECT_EQ(0, hset.count("qux"));
- }
- 
--TEST(SpdyPlatformTest, SpdyEndianness) {
--  EXPECT_EQ(0x1234, spdy::SpdyNetToHost16(spdy::SpdyHostToNet16(0x1234)));
--  EXPECT_EQ(0x12345678, spdy::SpdyNetToHost32(spdy::SpdyHostToNet32(0x12345678)));
--}
--
- TEST(SpdyPlatformTest, SpdyEstimateMemoryUsage) {
-   std::string s = "foo";
-   // Stubbed out to always return 0.
-@@ -92,19 +86,19 @@ TEST(SpdyPlatformTest, SpdyTestHelpers) {
- }
- 
- TEST(SpdyPlatformTest, SpdyFlags) {
--  auto& flag_registry = quiche::FlagRegistry::GetInstance();
--  flag_registry.ResetFlags();
-+  auto& flag_registry = quiche::FlagRegistry::getInstance();
-+  flag_registry.resetFlags();
-   EXPECT_FALSE(GetSpdyReloadableFlag(spdy_testonly_default_false));
-   EXPECT_FALSE(GetSpdyRestartFlag(spdy_testonly_default_false));
- 
--  flag_registry.FindFlag("spdy_reloadable_flag_spdy_testonly_default_false")
--      ->SetValueFromString("true");
-+  flag_registry.findFlag("FLAGS_quic_reloadable_flag_spdy_testonly_default_false")
-+      ->setValueFromString("true");
-   EXPECT_TRUE(GetSpdyReloadableFlag(spdy_testonly_default_false));
-   EXPECT_FALSE(GetSpdyRestartFlag(spdy_testonly_default_false));
- 
--  flag_registry.ResetFlags();
--  flag_registry.FindFlag("spdy_restart_flag_spdy_testonly_default_false")
--      ->SetValueFromString("yes");
-+  flag_registry.resetFlags();
-+  flag_registry.findFlag("FLAGS_quic_restart_flag_spdy_testonly_default_false")
-+      ->setValueFromString("yes");
-   EXPECT_FALSE(GetSpdyReloadableFlag(spdy_testonly_default_false));
-   EXPECT_TRUE(GetSpdyRestartFlag(spdy_testonly_default_false));
- }
-diff --git a/test/extensions/quic_listeners/quiche/test_proof_source.h b/test/extensions/quic_listeners/quiche/test_proof_source.h
-index a249b4314..bbedfd6c7 100644
---- a/test/extensions/quic_listeners/quiche/test_proof_source.h
-+++ b/test/extensions/quic_listeners/quiche/test_proof_source.h
-@@ -36,7 +36,7 @@ protected:
-   void signPayload(const quic::QuicSocketAddress& /*server_address*/,
-                    const quic::QuicSocketAddress& /*client_address*/,
-                    const std::string& /*hostname*/, uint16_t /*signature_algorithm*/,
--                   quiche::QuicheStringPiece in,
-+                   absl::string_view in,
-                    std::unique_ptr<quic::ProofSource::SignatureCallback> callback) override {
-     callback->Run(true, absl::StrCat("Fake signature for { ", in, " }"),
-                   std::make_unique<EnvoyQuicProofSourceDetails>(filter_chain_));
-diff --git a/test/extensions/quic_listeners/quiche/test_utils.h b/test/extensions/quic_listeners/quiche/test_utils.h
-index 102f7608e..7f0ea78e8 100644
---- a/test/extensions/quic_listeners/quiche/test_utils.h
-+++ b/test/extensions/quic_listeners/quiche/test_utils.h
-@@ -46,7 +46,7 @@ public:
-   MOCK_METHOD(quic::QuicConsumedData, WritevData,
-               (quic::QuicStreamId id, size_t write_length, quic::QuicStreamOffset offset,
-                quic::StreamSendingState state, quic::TransmissionType type,
--               quiche::QuicheOptional<quic::EncryptionLevel> level));
-+               absl::optional<quic::EncryptionLevel> level));
-   MOCK_METHOD(bool, ShouldYield, (quic::QuicStreamId id));
- 
-   absl::string_view requestedServerName() const override {
-@@ -90,7 +90,7 @@ public:
-   MOCK_METHOD(quic::QuicConsumedData, WritevData,
-               (quic::QuicStreamId id, size_t write_length, quic::QuicStreamOffset offset,
-                quic::StreamSendingState state, quic::TransmissionType type,
--               quiche::QuicheOptional<quic::EncryptionLevel> level));
-+               absl::optional<quic::EncryptionLevel> level));
-   MOCK_METHOD(bool, ShouldYield, (quic::QuicStreamId id));
- 
-   absl::string_view requestedServerName() const override {
--- 
-2.29.2
-
diff --git a/pkgs/servers/http/envoy/0002-Add-upb-patch-to-make-it-compile-under-GCC10.patch b/pkgs/servers/http/envoy/0002-Add-upb-patch-to-make-it-compile-under-GCC10.patch
deleted file mode 100644
index 370682efaa39..000000000000
--- a/pkgs/servers/http/envoy/0002-Add-upb-patch-to-make-it-compile-under-GCC10.patch
+++ /dev/null
@@ -1,91 +0,0 @@
-From 8b531c41f956b27e4be32b430db2e7a44e0cdd3e Mon Sep 17 00:00:00 2001
-From: Luke Granger-Brown <git@lukegb.com>
-Date: Thu, 7 Jan 2021 11:09:18 +0000
-Subject: [PATCH] Add upb patch to make it compile under GCC10
-
----
- bazel/repositories.bzl |  5 +++-
- bazel/upb2.patch       | 55 ++++++++++++++++++++++++++++++++++++++++++
- 2 files changed, 59 insertions(+), 1 deletion(-)
- create mode 100644 bazel/upb2.patch
-
-diff --git a/bazel/repositories.bzl b/bazel/repositories.bzl
-index 64d61ea49..c6cadc9df 100644
---- a/bazel/repositories.bzl
-+++ b/bazel/repositories.bzl
-@@ -811,7 +811,10 @@ def _com_github_grpc_grpc():
- def _upb():
-     _repository_impl(
-         name = "upb",
--        patches = ["@envoy//bazel:upb.patch"],
-+        patches = [
-+            "@envoy//bazel:upb.patch",
-+            "@envoy//bazel:upb2.patch",
-+        ],
-         patch_args = ["-p1"],
-     )
- 
-diff --git a/bazel/upb2.patch b/bazel/upb2.patch
-new file mode 100644
-index 000000000..6e436c61b
---- /dev/null
-+++ b/bazel/upb2.patch
-@@ -0,0 +1,55 @@
-+From 9bd23dab4240b015321a53c45b3c9e4847fbf020 Mon Sep 17 00:00:00 2001
-+From: Joshua Haberman <jhaberman@gmail.com>
-+Date: Tue, 7 Apr 2020 15:22:11 -0700
-+Subject: [PATCH] Changed upb status to suit GCC10's warning about strncpy().
-+ (#268)
-+
-+Added tests for all cases. Also removed ellipses from truncated
-+messages, they were more trouble than they are worth.
-+---
-+ tests/test_generated_code.c | 33 +++++++++++++++++++++++++++++++++
-+ upb/upb.c                   | 17 +++--------------
-+ 2 files changed, 36 insertions(+), 14 deletions(-)
-+
-+diff --git a/upb/upb.c b/upb/upb.c
-+index cb2cdfd9d..258192d79 100644
-+--- a/upb/upb.c
-++++ b/upb/upb.c
-+@@ -11,17 +11,6 @@
-+ 
-+ #include "upb/port_def.inc"
-+ 
-+-/* Guarantee null-termination and provide ellipsis truncation.
-+- * It may be tempting to "optimize" this by initializing these final
-+- * four bytes up-front and then being careful never to overwrite them,
-+- * this is safer and simpler. */
-+-static void nullz(upb_status *status) {
-+-  const char *ellipsis = "...";
-+-  size_t len = strlen(ellipsis);
-+-  UPB_ASSERT(sizeof(status->msg) > len);
-+-  memcpy(status->msg + sizeof(status->msg) - len, ellipsis, len);
-+-}
-+-
-+ /* upb_status *****************************************************************/
-+ 
-+ void upb_status_clear(upb_status *status) {
-+@@ -37,8 +26,8 @@ const char *upb_status_errmsg(const upb_status *status) { return status->msg; }
-+ void upb_status_seterrmsg(upb_status *status, const char *msg) {
-+   if (!status) return;
-+   status->ok = false;
-+-  strncpy(status->msg, msg, sizeof(status->msg));
-+-  nullz(status);
-++  strncpy(status->msg, msg, UPB_STATUS_MAX_MESSAGE - 1);
-++  status->msg[UPB_STATUS_MAX_MESSAGE - 1] = '\0';
-+ }
-+ 
-+ void upb_status_seterrf(upb_status *status, const char *fmt, ...) {
-+@@ -52,7 +41,7 @@ void upb_status_vseterrf(upb_status *status, const char *fmt, va_list args) {
-+   if (!status) return;
-+   status->ok = false;
-+   _upb_vsnprintf(status->msg, sizeof(status->msg), fmt, args);
-+-  nullz(status);
-++  status->msg[UPB_STATUS_MAX_MESSAGE - 1] = '\0';
-+ }
-+ 
-+ /* upb_alloc ******************************************************************/
--- 
-2.29.2
-
diff --git a/pkgs/servers/http/envoy/default.nix b/pkgs/servers/http/envoy/default.nix
index c81d79dbb24b..0c5038898ea3 100644
--- a/pkgs/servers/http/envoy/default.nix
+++ b/pkgs/servers/http/envoy/default.nix
@@ -1,6 +1,8 @@
 { lib
+, bazel_4
 , buildBazelPackage
 , fetchFromGitHub
+, fetchpatch
 , stdenv
 , cmake
 , gn
@@ -8,6 +10,7 @@
 , jdk
 , ninja
 , python3
+, linuxHeaders
 , nixosTests
 }:
 
@@ -17,23 +20,24 @@ let
     # However, the version string is more useful for end-users.
     # These are contained in a attrset of their own to make it obvious that
     # people should update both.
-    version = "1.19.1";
-    commit = "a2a1e3eed4214a38608ec223859fcfa8fb679b14";
+    version = "1.21.1";
+    rev = "af50070ee60866874b0a9383daf9364e884ded22";
   };
 in
 buildBazelPackage rec {
   pname = "envoy";
-  version = srcVer.version;
+  inherit (srcVer) version;
+  bazel = bazel_4;
   src = fetchFromGitHub {
     owner = "envoyproxy";
     repo = "envoy";
-    rev = srcVer.commit;
-    hash = "sha256:1v1hv4blrppnhllsxd9d3k2wl6nhd59r4ydljy389na3bb41jwf9";
+    inherit (srcVer) rev ;
+    hash = "sha256:11mm72zmb479ss585jzqzhklyyqmdadnvr91ghzvjxc0j2a1hrr4";
 
     extraPostFetch = ''
       chmod -R +w $out
       rm $out/.bazelversion
-      echo ${srcVer.commit} > $out/SOURCE_VERSION
+      echo ${srcVer.rev} > $out/SOURCE_VERSION
       sed -i 's/GO_VERSION = ".*"/GO_VERSION = "host"/g' $out/bazel/dependency_imports.bzl
     '';
   };
@@ -48,6 +52,14 @@ buildBazelPackage rec {
       --replace '"''$$WEE8_BUILD_ARGS"' '"''$$WEE8_BUILD_ARGS use_gold=false"'
   '';
 
+  patches = [
+    # make linux/tcp.h relative. drop when upgrading to >1.21
+    (fetchpatch {
+      url = "https://github.com/envoyproxy/envoy/commit/68448aae7a78a3123097b6ea96016b270457e7b8.patch";
+      sha256 = "123kv3x37p8fgfp29jhw5xg5js5q5ipibs8hsm7gzfd5bcllnpfh";
+    })
+  ];
+
   nativeBuildInputs = [
     cmake
     python3
@@ -57,8 +69,12 @@ buildBazelPackage rec {
     ninja
   ];
 
+  buildInputs = [
+    linuxHeaders
+  ];
+
   fetchAttrs = {
-    sha256 = "sha256:0vnl0gq6nhvyzz39jg1bvvna0xyhxalg71bp1jbxib7ql026004r";
+    sha256 = "0f7mls2zrpjjvbz6pgkzrvr55bv05xn2l76j9i1r0cf367qqfkz8";
     dontUseCmakeConfigure = true;
     dontUseGnConfigure = true;
     preInstall = ''
@@ -84,7 +100,7 @@ buildBazelPackage rec {
     dontUseGnConfigure = true;
     dontUseNinjaInstall = true;
     preConfigure = ''
-      sed -i 's,#!/usr/bin/env bash,#!${stdenv.shell},' $bazelOut/external/rules_foreign_cc/tools/build_defs/framework.bzl
+      sed -i 's,#!/usr/bin/env bash,#!${stdenv.shell},' $bazelOut/external/rules_foreign_cc/foreign_cc/private/framework/toolchains/linux_commands.bzl
 
       # Add paths to Nix store back.
       sed -i \
diff --git a/pkgs/servers/jackett/default.nix b/pkgs/servers/jackett/default.nix
index 50d526f6e0f9..f78d1c8755d2 100644
--- a/pkgs/servers/jackett/default.nix
+++ b/pkgs/servers/jackett/default.nix
@@ -9,13 +9,13 @@
 
 buildDotnetModule rec {
   pname = "jackett";
-  version = "0.20.643";
+  version = "0.20.660";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    sha256 = "EdAUF42R1CISzN8LmzmYyHjAxWQlQv8NUKSInMkSZUA=";
+    sha256 = "9k9v5/5zlpQJgBPlBYmCxUoucKL6D2vBFhjisvIAM4A=";
   };
 
   projectFile = "src/Jackett.Server/Jackett.Server.csproj";
diff --git a/pkgs/servers/misc/gobgpd/default.nix b/pkgs/servers/misc/gobgpd/default.nix
index dc1b0d6bd6a2..0a3e9af51073 100644
--- a/pkgs/servers/misc/gobgpd/default.nix
+++ b/pkgs/servers/misc/gobgpd/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "gobgpd";
-  version = "2.34.0";
+  version = "3.0.0";
 
   src = fetchFromGitHub {
     owner = "osrg";
     repo = "gobgp";
     rev = "v${version}";
-    sha256 = "sha256-xyakq5DXwzONEP6EvDpAuzCrTDWcs+7asDlq9Vf4c1k=";
+    sha256 = "sha256-gyaAtFJubvDiz5b7lk6vmPHIqr9ccWK3N2iy4LvYiMg=";
   };
 
-  vendorSha256 = "sha256-+dX/XByFW5/zvfXvyWePAv9X71dJEKaQf6xNXAXoMxw=";
+  vendorSha256 = "sha256-RSsvFD3RvYKxdwPDGG3YHVUzKLgwReZkoVabH5KWXMA=";
 
   postConfigure = ''
     export CGO_ENABLED=0
diff --git a/pkgs/servers/monitoring/prometheus/varnish-exporter.nix b/pkgs/servers/monitoring/prometheus/varnish-exporter.nix
index 27eb3721c95d..8f9e5884ae7c 100644
--- a/pkgs/servers/monitoring/prometheus/varnish-exporter.nix
+++ b/pkgs/servers/monitoring/prometheus/varnish-exporter.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "prometheus_varnish_exporter";
-  version = "1.6";
+  version = "1.6.1";
 
   src = fetchFromGitHub {
     owner = "jonnenauha";
     repo = "prometheus_varnish_exporter";
     rev = version;
-    sha256 = "1cp7c1w237r271m8b1y8pj5jy7j2iadp4vbislxfyp4kga9i4dcc";
+    sha256 = "15w2ijz621caink2imlp1666j0ih5pmlj62cbzggyb34ncl37ifn";
   };
 
-  vendorSha256 = "1cslg29l9mmyhpdz14ca9m18iaz4hhznplz8fmi3wa3l8r7ih751";
+  vendorSha256 = "00i9znb1pk5jpmyhxfg9zbw935fk3c1r0qrgf868xlcf9p8x2rrz";
 
   nativeBuildInputs = [ makeWrapper ];
 
diff --git a/pkgs/tools/admin/cf-vault/default.nix b/pkgs/tools/admin/cf-vault/default.nix
new file mode 100644
index 000000000000..455ed270379f
--- /dev/null
+++ b/pkgs/tools/admin/cf-vault/default.nix
@@ -0,0 +1,23 @@
+{buildGoModule, fetchFromGitHub, lib}:
+buildGoModule rec {
+  pname = "cf-vault";
+  version = "0.0.11";
+
+  src = fetchFromGitHub {
+    owner = "jacobbednarz";
+    repo = pname;
+    rev = version;
+    sha256 = "sha256-Imd9qeT4xg5ujVPLHSSqoteSPl9t97q3Oc4C/vzHphg=";
+  };
+
+  vendorSha256 = "sha256-PkmbVg5HnsUaSL/Kp3YJVdyzpjgvr/p9mKNmOubwXQA=";
+
+  meta = with lib; {
+    description = ''
+      A tool for managing your Cloudflare credentials, securely..
+    '';
+    homepage = "https://github.com/jacobbednarz/cf-vault/";
+    license = licenses.mit;
+    maintainers = with maintainers; [ viraptor ];
+  };
+}
diff --git a/pkgs/tools/admin/ejson2env/default.nix b/pkgs/tools/admin/ejson2env/default.nix
new file mode 100644
index 000000000000..cb82a689e943
--- /dev/null
+++ b/pkgs/tools/admin/ejson2env/default.nix
@@ -0,0 +1,22 @@
+{ buildGoModule, fetchFromGitHub, lib }:
+
+buildGoModule rec {
+  pname = "ejson2env";
+  version = "2.0.2";
+
+  src = fetchFromGitHub {
+    owner = "Shopify";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "sha256-1nfMmjYKRo5vjOwLb3fX9SQ0CDHme1DAz0AGGpV4piI=";
+  };
+
+  vendorSha256 = "sha256-lais54Gm4UGJN8D+iFbP8utTfDr+v8qXZKLdpNKzJi8=";
+
+  meta = with lib; {
+    description = "A tool to simplify storing secrets that should be accessible in the shell environment in your git repo.";
+    homepage = "https://github.com/Shopify/ejson2env";
+    maintainers = with maintainers; [ viraptor ];
+    license = licenses.mit;
+  };
+}
diff --git a/pkgs/tools/admin/exoscale-cli/default.nix b/pkgs/tools/admin/exoscale-cli/default.nix
index d6b1933a57c0..ecab060ee975 100644
--- a/pkgs/tools/admin/exoscale-cli/default.nix
+++ b/pkgs/tools/admin/exoscale-cli/default.nix
@@ -2,13 +2,13 @@
 
 buildGoPackage rec {
   pname = "exoscale-cli";
-  version = "1.49.3";
+  version = "1.50.0";
 
   src = fetchFromGitHub {
     owner  = "exoscale";
     repo   = "cli";
     rev    = "v${version}";
-    sha256 = "sha256-ANykklex/T7JwZ/G3dB4UPkYx5jSE5AnztGsWHGfL8I=";
+    sha256 = "sha256-RpUnJzMnYIvPpJd6+IVpDxCS/FGM+PHXvbQPJQEoS8Y=";
   };
 
   goPackagePath = "github.com/exoscale/cli";
diff --git a/pkgs/tools/admin/syft/default.nix b/pkgs/tools/admin/syft/default.nix
index f3a1c6d10c33..22b39ae123a4 100644
--- a/pkgs/tools/admin/syft/default.nix
+++ b/pkgs/tools/admin/syft/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "syft";
-  version = "0.38.0";
+  version = "0.39.3";
 
   src = fetchFromGitHub {
     owner = "anchore";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-YJQ0gWhhcB+jkVzu1KP+QMOiiCOyQnSuQ4rSfVGMOCU=";
+    sha256 = "sha256-tPjODqBJ85B9uEFExs8z2T/RNKuIvphxX8U1tQLRr+A=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
@@ -22,7 +22,7 @@ buildGoModule rec {
       find "$out" -name .git -print0 | xargs -0 rm -rf
     '';
   };
-  vendorSha256 = "sha256-dT+MPuMQoA8Spx8CkF3OBhWdXXssg62ZHIZBrokUkp4=";
+  vendorSha256 = "sha256-fHrKg1+9428feTv3wngV2EjJEUqE5ItbwFu7DxXmkCw=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/tools/audio/midimonster/default.nix b/pkgs/tools/audio/midimonster/default.nix
new file mode 100644
index 000000000000..3792d997aa00
--- /dev/null
+++ b/pkgs/tools/audio/midimonster/default.nix
@@ -0,0 +1,57 @@
+{ lib
+, stdenv
+, fetchurl
+, zlib
+, fetchFromGitHub
+, gnumake
+, gcc
+, pkg-config
+, lua5_4
+, openssl
+, jack1
+, python3
+, alsa-lib
+, ncurses
+, libevdev
+}:
+
+stdenv.mkDerivation rec {
+  pname = "midimonster";
+  version = "0.6.0";
+
+  buildInputs = [pkg-config gnumake gcc lua5_4 openssl jack1 python3 alsa-lib ncurses libevdev];
+
+  src = fetchFromGitHub {
+    repo = "midimonster";
+    owner = "cbdevnet";
+    rev = "f16f7db86662fcdbf45b6373257c90c824b0b4b0";
+    sha256 = "131zs4j9asq9xl72cbyi463xpkj064ca1s7i77q5jrwqysgy52sp";
+};
+
+  doCheck = true;
+  enableParallelBuilding = true;
+
+  outputs = ["out" "man"];
+
+  buildPhase = ''
+    PLUGINS=$out/lib/midimonster make all
+  '';
+
+  installPhase = ''
+    PREFIX=$out make install
+
+    mkdir -p "$man/share/man/man1"
+    cp assets/midimonster.1 "$man/share/man/man1"
+
+    mkdir -p "$out/share/icons/hicolor/scalable/apps"
+    cp assets/MIDIMonster.svg "$out/share/icons/hicolor/scalable/apps/"
+  '';
+
+  meta = with lib; {
+    homepage = "https://midimonster.net";
+    description = "Multi-protocol translation tool";
+    license = licenses.bsd2;
+    platforms = platforms.unix;
+    maintainers = with maintainers; [keldu];
+  };
+}
diff --git a/pkgs/tools/misc/cloud-sql-proxy/default.nix b/pkgs/tools/misc/cloud-sql-proxy/default.nix
index 005e1f4d02af..a60624a904b8 100644
--- a/pkgs/tools/misc/cloud-sql-proxy/default.nix
+++ b/pkgs/tools/misc/cloud-sql-proxy/default.nix
@@ -2,18 +2,18 @@
 
 buildGoModule rec {
   pname = "cloud-sql-proxy";
-  version = "1.28.1";
+  version = "1.29.0";
 
   src = fetchFromGitHub {
     owner = "GoogleCloudPlatform";
     repo = "cloudsql-proxy";
     rev = "v${version}";
-    sha256 = "sha256-mQYzc5OPYEsxBeSRiPHvYvh8grPOgB5sWB9EBrY3a6A=";
+    sha256 = "sha256-V/dNS/tbPPkVpgaCkGa5pfH/vj8y7mO9OQDLhgWbRCE=";
   };
 
   subPackages = [ "cmd/cloud_sql_proxy" ];
 
-  vendorSha256 = "sha256-+vuhOrUvA6W6y/6oEvJtsYixyvRzFPzpbw0Qn0AnYRI=";
+  vendorSha256 = "sha256-6td7rDye0sBUhDn9YARvdCgdfS/8z+VY1wYcEcUzHBs=";
 
   checkFlags = [ "-short" ];
 
diff --git a/pkgs/tools/misc/shellspec/default.nix b/pkgs/tools/misc/shellspec/default.nix
new file mode 100644
index 000000000000..27eead6e1c3a
--- /dev/null
+++ b/pkgs/tools/misc/shellspec/default.nix
@@ -0,0 +1,34 @@
+{ lib, stdenv, fetchFromGitHub }:
+
+stdenv.mkDerivation rec {
+  pname = "shellspec";
+  version = "0.28.1";
+
+  src = fetchFromGitHub {
+    owner = "shellspec";
+    repo = pname;
+    rev = version;
+    sha256 = "1ib5qp29f2fmivwnv6hq35qhvdxz42xgjlkvy0i3qn758riyqf46";
+  };
+
+  makeFlags = [ "PREFIX=${placeholder "out"}" ];
+
+  checkPhase = ''
+    ./shellspec --no-banner --task fixture:stat:prepare
+    ./shellspec --no-banner spec --jobs "$(nproc)"
+  '';
+
+  # "Building" the script happens in Docker
+  dontBuild = true;
+
+  meta = with lib; {
+    description =
+      "A full-featured BDD unit testing framework for bash, ksh, zsh, dash and all POSIX shells";
+    homepage = "https://shellspec.info/";
+    changelog =
+      "https://github.com/shellspec/shellspec/releases/tag/${version}";
+    license = licenses.mit;
+    maintainers = with maintainers; [ j0hax ];
+    platforms = platforms.unix;
+  };
+}
diff --git a/pkgs/tools/misc/smug/default.nix b/pkgs/tools/misc/smug/default.nix
new file mode 100644
index 000000000000..afa21afa6666
--- /dev/null
+++ b/pkgs/tools/misc/smug/default.nix
@@ -0,0 +1,24 @@
+{ lib, buildGoModule, fetchFromGitHub }:
+
+buildGoModule rec {
+  pname = "smug";
+  version = "0.2.7";
+
+  subPackages = [ "." ];
+
+  src = fetchFromGitHub {
+    owner = "ivaaaan";
+    repo = "smug";
+    rev = "3399f02a6e01324f5bb881f6b049c9e8d94733ee";
+    sha256 = "178125835dhnaq9k42yv4pfxpyhgb5179wrxkimb59fy0nk8jzx8";
+  };
+
+  vendorSha256 = "1rba5rpvlr8dyhj145b5i57pm4skfpj3vm7vydkn79k6ak6x985x";
+
+  meta = with lib; {
+    homepage = "https://github.com/ivaaaan/smug";
+    description = "Smug - tmux session manager";
+    license = licenses.mit;
+    maintainers = with maintainers; [ juboba ];
+  };
+}
diff --git a/pkgs/tools/misc/vtm/default.nix b/pkgs/tools/misc/vtm/default.nix
new file mode 100644
index 000000000000..5066145b72af
--- /dev/null
+++ b/pkgs/tools/misc/vtm/default.nix
@@ -0,0 +1,28 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, cmake
+}:
+stdenv.mkDerivation rec {
+  pname = "vtm";
+  version = "0.6.0";
+
+  src = fetchFromGitHub {
+    owner = "netxs-group";
+    repo = "vtm";
+    rev = "v${version}";
+    sha256 = "sha256-Z6PSx7TwarQx0Mc3fSRPwV7yIPJK3xtW4k0LJ6RPYRY=";
+  };
+
+  nativeBuildInputs = [ cmake ];
+
+  cmakeFlags = [ "../src" ];
+
+  meta = {
+    homepage = "https://vtm.netxs.online/";
+    description = "Terminal multiplexer with window manager and session sharing";
+    license = lib.licenses.mit;
+    platforms = lib.platforms.all;
+    maintainers = with lib.maintainers; [ ahuzik ];
+  };
+}
diff --git a/pkgs/tools/networking/gobgp/default.nix b/pkgs/tools/networking/gobgp/default.nix
index df159d292327..8789ae6fa162 100644
--- a/pkgs/tools/networking/gobgp/default.nix
+++ b/pkgs/tools/networking/gobgp/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "gobgp";
-  version = "2.34.0";
+  version = "3.0.0";
 
   src = fetchFromGitHub {
     owner = "osrg";
     repo = "gobgp";
     rev = "v${version}";
-    sha256 = "sha256-xyakq5DXwzONEP6EvDpAuzCrTDWcs+7asDlq9Vf4c1k=";
+    sha256 = "sha256-gyaAtFJubvDiz5b7lk6vmPHIqr9ccWK3N2iy4LvYiMg=";
   };
 
-  vendorSha256 = "sha256-+dX/XByFW5/zvfXvyWePAv9X71dJEKaQf6xNXAXoMxw=";
+  vendorSha256 = "sha256-RSsvFD3RvYKxdwPDGG3YHVUzKLgwReZkoVabH5KWXMA=";
 
   postConfigure = ''
     export CGO_ENABLED=0
diff --git a/pkgs/tools/networking/minio-client/default.nix b/pkgs/tools/networking/minio-client/default.nix
index cee280c8ec9e..4fbdec621b4b 100644
--- a/pkgs/tools/networking/minio-client/default.nix
+++ b/pkgs/tools/networking/minio-client/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "minio-client";
-  version = "2022-02-26T03-58-31Z";
+  version = "2022-03-03T21-12-24Z";
 
   src = fetchFromGitHub {
     owner = "minio";
     repo = "mc";
     rev = "RELEASE.${version}";
-    sha256 = "sha256-9JA9xwg+U8BQa66xPVghaGZQO5+efwG8/CqAXm2kg3Q=";
+    sha256 = "sha256-z+t8aMyGlqXcooCzJgn0xxOhuS+p3/qMTBJByDJPd40=";
   };
 
   vendorSha256 = "sha256-mk0ga3o6LeZ4uwV3vlP6qyFXLiORwNQLhXoCxSmvXsU=";
diff --git a/pkgs/tools/networking/openssh/default.nix b/pkgs/tools/networking/openssh/default.nix
index e8cad75698f4..36125a5893be 100644
--- a/pkgs/tools/networking/openssh/default.nix
+++ b/pkgs/tools/networking/openssh/default.nix
@@ -19,12 +19,12 @@ in
 
   openssh_hpn = common rec {
     pname = "openssh-with-hpn";
-    version = "8.8p1";
+    version = "8.9p1";
     extraDesc = " with high performance networking patches";
 
     src = fetchurl {
       url = "mirror://openbsd/OpenSSH/portable/openssh-${version}.tar.gz";
-      sha256 = "1s8z6f7mi1pwsl79cqai8cr350m5lf2ifcxff57wx6mvm478k425";
+      sha256 = "1ry5prcax0134v6srkgznpl9ch5snkgq7yvjqvd8c5mbnxa7cjgx";
     };
 
     extraPatches = [
@@ -33,9 +33,9 @@ in
       # HPN Patch from FreeBSD ports
       (fetchpatch {
         name = "ssh-hpn.patch";
-        url = "https://raw.githubusercontent.com/freebsd/freebsd-ports/a981593e/security/openssh-portable/files/extra-patch-hpn";
+        url = "https://raw.githubusercontent.com/freebsd/freebsd-ports/ae66cffc19f357cbd51d5841c9b110a9ffd63e32/security/openssh-portable/files/extra-patch-hpn";
         stripLen = 1;
-        sha256 = "sha256-+JvpPxktZAjhxLLK1lF4ijG9VlSWkqbRwotaLe6en64=";
+        sha256 = "sha256-p3CmMqTgrqFZUo4ZuqaPLczAhjmPufkCvptVW5dI+MI=";
       })
     ];
 
diff --git a/pkgs/tools/networking/rdap/default.nix b/pkgs/tools/networking/rdap/default.nix
new file mode 100644
index 000000000000..22966d7afaea
--- /dev/null
+++ b/pkgs/tools/networking/rdap/default.nix
@@ -0,0 +1,25 @@
+{ lib, buildGoModule, fetchFromGitHub }:
+
+buildGoModule rec {
+  pname = "rdap";
+  version = "2019-10-17";
+  vendorSha256 = "sha256-j7sE62NqbN8UrU1mM9WYGYu/tkqw56sNKQ125QQXAmo=";
+
+  src = fetchFromGitHub {
+    owner = "openrdap";
+    repo = "rdap";
+    rev = "af93e7ef17b78dee3e346814731377d5ef7b89f3";
+    sha256 = "sha256-7MR4izJommdvxDZSRxguwqJWu6KXw/X73RJxSmUD7oQ=";
+  };
+
+  doCheck = false;
+
+  ldflags = [ "-s" "-w" "-X \"github.com/openrdap/rdap.version=OpenRDAP ${version}\"" ];
+
+  meta = with lib; {
+    homepage = "https://www.openrdap.org/";
+    description = "Command line client for the Registration Data Access Protocol (RDAP)";
+    license = licenses.mit;
+    maintainers = with maintainers; [ sebastianblunt ];
+  };
+}
diff --git a/pkgs/tools/package-management/pdm/default.nix b/pkgs/tools/package-management/pdm/default.nix
index e9db7f63fba6..4e59333ed79b 100644
--- a/pkgs/tools/package-management/pdm/default.nix
+++ b/pkgs/tools/package-management/pdm/default.nix
@@ -47,6 +47,9 @@ buildPythonApplication rec {
       hash = "sha256:1dizf9j3z7zk4lxvnszwx63xzd9r68f2iva5sszzf8s8na831dvd";
     })
   ];
+  postPatch = ''
+    substituteInPlace pyproject.toml --replace "pdm-pep517>=0.9,<0.10" "pdm-pep517"
+  '';
 
   propagatedBuildInputs = [
     blinker
diff --git a/pkgs/tools/security/exploitdb/default.nix b/pkgs/tools/security/exploitdb/default.nix
index e15b626dfa81..232e689d957e 100644
--- a/pkgs/tools/security/exploitdb/default.nix
+++ b/pkgs/tools/security/exploitdb/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "exploitdb";
-  version = "2022-03-01";
+  version = "2022-03-03";
 
   src = fetchFromGitHub {
     owner = "offensive-security";
     repo = pname;
     rev = version;
-    sha256 = "sha256-3bMroTIVjSMHV4tg3Um2E90Ph6j0vXRy0fSjGe9EPNE=";
+    sha256 = "sha256-EH4PlUb0PGUwkgfk1oFPKimoJcWI/mozzzaTST1De7A=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/tools/security/jadx/default.nix b/pkgs/tools/security/jadx/default.nix
index eae06ea64910..e5b805b89cc5 100644
--- a/pkgs/tools/security/jadx/default.nix
+++ b/pkgs/tools/security/jadx/default.nix
@@ -2,13 +2,13 @@
 
 let
   pname = "jadx";
-  version = "1.3.2";
+  version = "1.3.3";
 
   src = fetchFromGitHub {
     owner = "skylot";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-5meBBBijX49EQc9VejySwiIKsyCBEKGKIXvH7en6XuU=";
+    hash = "sha256-z8u6j6YLBHmgZKSGh/rFDDSnWZrBgWsqfKP3vhaukbY=";
   };
 
   deps = stdenv.mkDerivation {
@@ -40,7 +40,7 @@ let
     '';
 
     outputHashMode = "recursive";
-    outputHash = "sha256-t+CkjoZqWqphxbg/4E3/7U8nKoV0AlITyRScLN8x6yY=";
+    outputHash = "sha256-kiNtA63sINX7VRsq4JKAiZYzymHe1TrNetZsE6S9KVM=";
   };
 in stdenv.mkDerivation {
   inherit pname version src;
diff --git a/pkgs/tools/security/krunner-pass/default.nix b/pkgs/tools/security/krunner-pass/default.nix
index 7904235b86a4..a9f2c241d21c 100644
--- a/pkgs/tools/security/krunner-pass/default.nix
+++ b/pkgs/tools/security/krunner-pass/default.nix
@@ -1,9 +1,17 @@
-{ mkDerivation, lib, fetchFromGitHub, fetchpatch, cmake, extra-cmake-modules
-, kauth, krunner
-, pass, pass-otp ? null }:
+{ mkDerivation
+, lib
+, fetchFromGitHub
+, fetchpatch
+, cmake
+, extra-cmake-modules
+, kauth
+, krunner
+, pass
+}:
 
 mkDerivation rec {
   pname = "krunner-pass";
+  # when upgrading the version, check if cmakeFlags is still needed
   version = "1.3.0";
 
   src = fetchFromGitHub {
@@ -13,9 +21,10 @@ mkDerivation rec {
     sha256 = "032fs2174ls545kjixbhzyd65wgxkw4s5vg8b20irc5c9ak3pxm0";
   };
 
-  buildInputs  = [
-    kauth krunner
-    pass pass-otp
+  buildInputs = [
+    kauth
+    krunner
+    (pass.withExtensions (p: with p; [ pass-otp ]))
   ];
 
   nativeBuildInputs = [ cmake extra-cmake-modules ];
@@ -33,6 +42,9 @@ mkDerivation rec {
     ''-DNIXPKGS_PASS=\"${lib.getBin pass}/bin/pass\"''
   ];
 
+  # there are *lots* of pointless warnings in v1.3.0
+  cmakeFlags = [ "-Wno-dev" ];
+
   meta = with lib; {
     description = "Integrates krunner with pass the unix standard password manager (https://www.passwordstore.org/)";
     homepage = "https://github.com/akermu/krunner-pass";
diff --git a/pkgs/tools/security/tboot/default.nix b/pkgs/tools/security/tboot/default.nix
index d11426a2b48c..a33c26419e16 100644
--- a/pkgs/tools/security/tboot/default.nix
+++ b/pkgs/tools/security/tboot/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "tboot";
-  version = "1.10.3";
+  version = "1.10.4";
 
   src = fetchurl {
     url = "mirror://sourceforge/tboot/${pname}-${version}.tar.gz";
-    sha256 = "sha256-ixFs9Bd6VNT1n5RU6n38hFR+m4+SBNzwrCNXRmCHgOQ=";
+    sha256 = "sha256-iEn6mZ0tuDBA1a2POpJEBaIM0TMVDohbVvp/6OO4nAY=";
   };
 
   buildInputs = [ openssl trousers zlib ];
diff --git a/pkgs/tools/system/btop/default.nix b/pkgs/tools/system/btop/default.nix
index c7db9e363f9d..d3d982da4d7c 100644
--- a/pkgs/tools/system/btop/default.nix
+++ b/pkgs/tools/system/btop/default.nix
@@ -8,8 +8,8 @@
 
 stdenv.mkDerivation rec {
   pname = "btop";
-  version = "1.2.3";
-  hash = "sha256-vH167BL2ekWwxIhQWXkgJxl8z77S8SkmHVclW6XGc+8=";
+  version = "1.2.4";
+  hash = "sha256-IFuDpqRtsim2dfSTODuNK62xaLvKKcB5YBNHSQI6q44=";
 
   src = fetchFromGitHub {
     owner = "aristocratos";
diff --git a/pkgs/tools/system/consul-template/default.nix b/pkgs/tools/system/consul-template/default.nix
index 7a16c5ab592c..5d09020eec34 100644
--- a/pkgs/tools/system/consul-template/default.nix
+++ b/pkgs/tools/system/consul-template/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "consul-template";
-  version = "0.27.2";
+  version = "0.28.0";
 
   src = fetchFromGitHub {
     owner = "hashicorp";
     repo = "consul-template";
     rev = "v${version}";
-    sha256 = "sha256-Uqb0HXaYHGcW7lkUNLa2oXM0gu+SWwpv+NdPnOO87cs=";
+    sha256 = "sha256-9NsudhalFm0km7BmK+2QzK9LxirrVtIFzNrugpw4f8g=";
   };
 
-  vendorSha256 = "sha256-my4ECzmvrPhbKlcEptQ0xi4lYxHm42IrEsOvcetuMeQ=";
+  vendorSha256 = "sha256-SUbQPzFZUBgFZvaLc8730hZhJvt3/ni306Vt3EZMOmU=";
 
   # consul-template tests depend on vault and consul services running to
   # execute tests so we skip them here
diff --git a/pkgs/tools/system/thermald/default.nix b/pkgs/tools/system/thermald/default.nix
index eb1e8ab5a346..f2fae161daa8 100644
--- a/pkgs/tools/system/thermald/default.nix
+++ b/pkgs/tools/system/thermald/default.nix
@@ -55,6 +55,7 @@ stdenv.mkDerivation rec {
     "--enable-gtk-doc"
     "--with-dbus-sys-dir=${placeholder "out"}/share/dbus-1/system.d"
     "--with-systemdsystemunitdir=${placeholder "out"}/etc/systemd/system"
+    "--disable-werror"
   ];
 
   preConfigure = "NO_CONFIGURE=1 ./autogen.sh";
diff --git a/pkgs/tools/text/diffr/default.nix b/pkgs/tools/text/diffr/default.nix
index 844a09f0d581..85d78ffb7329 100644
--- a/pkgs/tools/text/diffr/default.nix
+++ b/pkgs/tools/text/diffr/default.nix
@@ -11,7 +11,7 @@ rustPlatform.buildRustPackage rec {
     sha256 = "18ks5g4bx6iz9hdjxmi6a41ncxpb1hnsscdlddp2gr40k3vgd0pa";
   };
 
-  cargoSha256 = "05rfjangmyvmqm0bvl4bcvc7m4zhg66gknh85sxr3bzrlwzacwgw";
+  cargoSha256 = "0pn3vqv13n29h8069a38306vjlzlxf1m08ldv7lpzgqxhl8an00r";
 
   buildInputs = (lib.optional stdenv.isDarwin Security);
 
diff --git a/pkgs/tools/text/igrep/default.nix b/pkgs/tools/text/igrep/default.nix
new file mode 100644
index 000000000000..5a05501f1eb5
--- /dev/null
+++ b/pkgs/tools/text/igrep/default.nix
@@ -0,0 +1,35 @@
+{ lib
+, rustPlatform
+, fetchFromGitHub
+, stdenv
+, Security
+, testVersion
+, igrep
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "igrep";
+  version = "0.1.2";
+
+  src = fetchFromGitHub {
+    owner = "konradsz";
+    repo = "igrep";
+    rev = "v${version}";
+    sha256 = "sha256-ZbJogp4rTc3GAD71iQUIf5EqwJ8XD9/WmvdAcGIgcvY=";
+  };
+
+  cargoSha256 = "sha256-sj2GEyUPq9+JXlGpKYRNfhfwGf5F/J46AoOjUu4xm7I=";
+
+  buildInputs = lib.optionals stdenv.isDarwin [ Security ];
+
+  passthru.tests = {
+    version = testVersion { package = igrep; command = "ig --version"; };
+  };
+
+  meta = with lib; {
+    description = "Interactive Grep";
+    homepage = "https://github.com/konradsz/igrep";
+    license = licenses.mit;
+    maintainers = with maintainers; [ _0x4A6F ];
+  };
+}
diff --git a/pkgs/tools/text/recode/default.nix b/pkgs/tools/text/recode/default.nix
index ce377fada9f3..8c49fb5ee7fc 100644
--- a/pkgs/tools/text/recode/default.nix
+++ b/pkgs/tools/text/recode/default.nix
@@ -2,24 +2,27 @@
 
 stdenv.mkDerivation rec {
   pname = "recode";
-  version = "3.7.9";
+  version = "3.7.12";
 
   # Use official tarball, avoid need to bootstrap/generate build system
   src = fetchurl {
     url = "https://github.com/rrthomas/${pname}/releases/download/v${version}/${pname}-${version}.tar.gz";
-    sha256 = "sha256-5DIKaw9c2DfNtFT7WFQBjd+pcJEWCOHwHMLGX2M2csQ=";
+    hash = "sha256-TbHJB28E26oVlyb1AAhH5eWoOuyOXGT4ygQ4P2zaEtU=";
   };
 
   nativeBuildInputs = [ python3 python3.pkgs.cython perl intltool flex texinfo libiconv ];
   buildInputs = [ libintl ];
 
+  enableParallelBuilding = true;
+
   doCheck = true;
 
   meta = {
     homepage = "https://github.com/rrthomas/recode";
     description = "Converts files between various character sets and usages";
+    changelog = "https://github.com/rrthomas/recode/raw/v${version}/NEWS";
     platforms = lib.platforms.unix;
-    license = lib.licenses.gpl2Plus;
+    license = with lib.licenses; [ lgpl3Plus gpl3Plus ];
     maintainers = with lib.maintainers; [ jcumming ];
   };
 }
diff --git a/pkgs/tools/video/svt-av1/default.nix b/pkgs/tools/video/svt-av1/default.nix
index b094e223031f..469f76fdc2b2 100644
--- a/pkgs/tools/video/svt-av1/default.nix
+++ b/pkgs/tools/video/svt-av1/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "svt-av1";
-  version = "0.9.0";
+  version = "0.9.1";
 
   src = fetchFromGitLab {
     owner = "AOMediaCodec";
     repo = "SVT-AV1";
     rev = "v${version}";
-    sha256 = "sha256-kmFyJ5b0EiesWUN71rbULF2cQt2pICF0P/MeZ+h7W9U=";
+    sha256 = "sha256-PIr2bCEKj1dXKiGWloZv2v+ed6JdHK3z+p11ugWGzAk=";
   };
 
   nativeBuildInputs = [ cmake nasm ];
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 3dfc5cf510d6..02bc197f92ad 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -1441,6 +1441,7 @@ mapAliases ({
 
   inherit (plasma5Packages.thirdParty)
     krohnkite
+    krunner-ssh
     krunner-symbols
     kwin-dynamic-workspaces
     kwin-tiling
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 2ef0f1f1f8c7..fdfff70ef101 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -1035,8 +1035,12 @@ with pkgs;
 
   amidst = callPackage ../tools/games/minecraft/amidst { };
 
+  cf-vault = callPackage ../tools/admin/cf-vault { };
+
   cope = callPackage ../tools/misc/cope { };
 
+  ejson2env = callPackage ../tools/admin/ejson2env { };
+
   gamemode = callPackage ../tools/games/gamemode {
     libgamemode32 = pkgsi686Linux.gamemode.lib;
   };
@@ -1073,6 +1077,8 @@ with pkgs;
 
   metapixel = callPackage ../tools/graphics/metapixel { };
 
+  midimonster = callPackage ../tools/audio/midimonster { };
+
   pferd = callPackage ../tools/misc/pferd {};
 
   qFlipper = libsForQt515.callPackage ../tools/misc/qflipper { };
@@ -2569,7 +2575,7 @@ with pkgs;
 
   cht-sh = callPackage ../tools/misc/cht.sh { };
 
-  cinny = callPackage ../applications/networking/instant-messengers/cinny {};
+  cinny = callPackage ../applications/networking/instant-messengers/cinny { stdenv = stdenvNoCC; };
 
   ckbcomp = callPackage ../tools/X11/ckbcomp { };
 
@@ -4544,7 +4550,8 @@ with pkgs;
     cudatoolkit_11_2
     cudatoolkit_11_3
     cudatoolkit_11_4
-    cudatoolkit_11_5;
+    cudatoolkit_11_5
+    cudatoolkit_11_6;
 
   cudatoolkit = cudatoolkit_10;
 
@@ -5203,6 +5210,8 @@ with pkgs;
 
   endlessh = callPackage ../servers/endlessh { };
 
+  endlessh-go = callPackage ../servers/endlessh-go { };
+
   ericw-tools = callPackage ../applications/misc/ericw-tools { };
 
   cryfs = callPackage ../tools/filesystems/cryfs { };
@@ -6205,6 +6214,10 @@ with pkgs;
 
   grin = callPackage ../tools/text/grin { };
 
+  igrep = callPackage ../tools/text/igrep {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
+
   ripgrep = callPackage ../tools/text/ripgrep {
     inherit (darwin.apple_sdk.frameworks) Security;
   };
@@ -7451,7 +7464,7 @@ with pkgs;
   leatherman = callPackage ../development/libraries/leatherman { };
 
   ledit = callPackage ../tools/misc/ledit {
-    inherit (ocamlPackages) camlp5;
+    inherit (ocaml-ng.ocamlPackages_4_12) ocaml camlp5;
   };
 
   ledmon = callPackage ../tools/system/ledmon { };
@@ -9304,6 +9317,8 @@ with pkgs;
 
   rcon = callPackage ../tools/networking/rcon { };
 
+  rdap = callPackage ../tools/networking/rdap { };
+
   rdbtools = callPackage ../development/tools/rdbtools { python = python3; };
 
   rdma-core = callPackage ../os-specific/linux/rdma-core { };
@@ -9734,6 +9749,8 @@ with pkgs;
 
   shelldap = callPackage ../tools/misc/shelldap { };
 
+  shellspec = callPackage ../tools/misc/shellspec { };
+
   schema2ldif = callPackage ../tools/text/schema2ldif { };
 
   sharedown = callPackage ../tools/misc/sharedown { };
@@ -9817,7 +9834,9 @@ with pkgs;
 
   skippy-xd = callPackage ../tools/X11/skippy-xd {};
 
-  sks = callPackage ../servers/sks { };
+  sks = callPackage ../servers/sks {
+    ocamlPackages = ocaml-ng.ocamlPackages_4_12;
+  };
 
   skydns = callPackage ../servers/skydns { };
 
@@ -9865,6 +9884,8 @@ with pkgs;
 
   smu = callPackage ../tools/text/smu { };
 
+  smug = callPackage ../tools/misc/smug { };
+
   smpq = callPackage ../applications/misc/smpq { };
 
   sn0int = callPackage ../tools/security/sn0int { };
@@ -10838,6 +10859,8 @@ with pkgs;
     SDL = SDL_sixel;
   };
 
+  vtm = callPackage ../tools/misc/vtm { };
+
   witness = callPackage ../tools/security/witness { };
 
   openconnect = openconnect_gnutls;
@@ -14023,7 +14046,7 @@ with pkgs;
 
   regina = callPackage ../development/interpreters/regina { };
 
-  inherit (ocamlPackages) reason;
+  inherit (ocaml-ng.ocamlPackages_4_12) reason;
 
   pixie = callPackage ../development/interpreters/pixie { };
   dust = callPackage ../development/interpreters/pixie/dust.nix { };
@@ -14929,6 +14952,7 @@ with pkgs;
 
   flow = callPackage ../development/tools/analysis/flow {
     inherit (darwin.apple_sdk.frameworks) CoreServices;
+    ocamlPackages = ocaml-ng.ocamlPackages_4_12;
   };
 
   fly = callPackage ../development/tools/continuous-integration/fly { };
@@ -18838,6 +18862,8 @@ with pkgs;
 
   libvori = callPackage ../development/libraries/libvori { };
 
+  libwbxml = callPackage ../development/libraries/libwbxml { };
+
   libwebcam = callPackage ../os-specific/linux/libwebcam { };
 
   libwebp = callPackage ../development/libraries/libwebp { };
@@ -24845,6 +24871,8 @@ with pkgs;
 
   carddav-util = callPackage ../tools/networking/carddav-util { };
 
+  cardinal = callPackage ../applications/audio/cardinal { };
+
   carla = libsForQt5.callPackage ../applications/audio/carla { };
 
   castor = callPackage ../applications/networking/browsers/castor { };
@@ -28063,7 +28091,9 @@ with pkgs;
 
   opusTools = callPackage ../applications/audio/opus-tools { };
 
-  orpie = callPackage ../applications/misc/orpie { };
+  orpie = callPackage ../applications/misc/orpie {
+    ocamlPackages = ocaml-ng.ocamlPackages_4_12;
+  };
 
   osmo = callPackage ../applications/office/osmo { };
 
@@ -28988,7 +29018,7 @@ with pkgs;
 
   stalonetray = callPackage ../applications/window-managers/stalonetray {};
 
-  inherit (ocamlPackages) stog;
+  inherit (ocaml-ng.ocamlPackages_4_12) stog;
 
   stp = callPackage ../applications/science/logic/stp { };
 
@@ -31877,6 +31907,8 @@ with pkgs;
 
   alliance = callPackage ../applications/science/electronics/alliance { };
 
+  angsd = callPackage ../applications/science/biology/angsd { };
+
   ants = callPackage ../applications/science/biology/ants {
     inherit (darwin.apple_sdk.frameworks) Cocoa;
   };
@@ -32345,7 +32377,9 @@ with pkgs;
 
   abc-verifier = callPackage ../applications/science/logic/abc {};
 
-  abella = callPackage ../applications/science/logic/abella { };
+  abella = callPackage ../applications/science/logic/abella {
+    ocamlPackages = ocaml-ng.ocamlPackages_4_12;
+  };
 
   acgtk = callPackage ../applications/science/logic/acgtk {};
 
@@ -32424,7 +32458,7 @@ with pkgs;
 
   hol = callPackage ../applications/science/logic/hol { };
 
-  inherit (ocamlPackages) hol_light;
+  inherit (ocaml-ng.ocamlPackages_4_12) hol_light;
 
   hologram = callPackage ../tools/security/hologram { };
 
@@ -32488,7 +32522,9 @@ with pkgs;
 
   libpoly = callPackage ../applications/science/logic/poly {};
 
-  prooftree = callPackage  ../applications/science/logic/prooftree {};
+  prooftree = callPackage  ../applications/science/logic/prooftree {
+    ocamlPackages = ocaml-ng.ocamlPackages_4_12;
+  };
 
   prover9 = callPackage ../applications/science/logic/prover9 { };
 
diff --git a/pkgs/top-level/ocaml-packages.nix b/pkgs/top-level/ocaml-packages.nix
index 01848d823217..bf8a055e1a38 100644
--- a/pkgs/top-level/ocaml-packages.nix
+++ b/pkgs/top-level/ocaml-packages.nix
@@ -1539,5 +1539,5 @@ in let inherit (pkgs) callPackage; in rec
 
   ocamlPackages_latest = ocamlPackages_4_13;
 
-  ocamlPackages = ocamlPackages_4_12;
+  ocamlPackages = ocamlPackages_4_13;
 }
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 3a9c01a08fd9..fbf04320b1c3 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -18,7 +18,7 @@ self:
 
 let
   inherit (self) callPackage;
-  inherit (python.passthru) isPy27 isPy35 isPy36 isPy37 isPy38 isPy39 isPy3k isPyPy pythonAtLeast pythonOlder;
+  inherit (python.passthru) isPy27 isPy35 isPy36 isPy37 isPy38 isPy39 isPy310 isPy311 isPy3k isPyPy pythonAtLeast pythonOlder;
 
   namePrefix = python.libPrefix + "-";
 
@@ -107,7 +107,7 @@ in {
 
   inherit pkgs stdenv;
 
-  inherit (python.passthru) isPy27 isPy35 isPy36 isPy37 isPy38 isPy39 isPy3k isPyPy pythonAtLeast pythonOlder;
+  inherit (python.passthru) isPy27 isPy35 isPy36 isPy37 isPy38 isPy39 isPy310 isPy311 isPy3k isPyPy pythonAtLeast pythonOlder;
   inherit python bootstrapped-pip buildPythonPackage buildPythonApplication;
   inherit fetchPypi;
   inherit hasPythonModule requiredPythonModules makePythonPath disabled disabledIf;
@@ -9935,6 +9935,8 @@ in {
 
   tika = callPackage ../development/python-modules/tika { };
 
+  tikzplotlib = callPackage ../development/python-modules/tikzplotlib { };
+
   tiledb = callPackage ../development/python-modules/tiledb {
     inherit (pkgs) tiledb;
   };