about summary refs log tree commit diff
diff options
context:
space:
mode:
authorVladimír Čunát <v@cunat.cz>2022-12-09 10:27:46 +0100
committerVladimír Čunát <v@cunat.cz>2022-12-09 10:27:46 +0100
commit9c497bb8d6015ee01fd78001539d73c3caa42eae (patch)
tree96062a61d173626b1337ecef982421e81ae8d29a
parent1f4a528dc10a88466f5b15198cf3be139b847e7e (diff)
parent63c06ac400aa4d06fee7f32cb2504486862f2ff4 (diff)
downloadnixlib-9c497bb8d6015ee01fd78001539d73c3caa42eae.tar
nixlib-9c497bb8d6015ee01fd78001539d73c3caa42eae.tar.gz
nixlib-9c497bb8d6015ee01fd78001539d73c3caa42eae.tar.bz2
nixlib-9c497bb8d6015ee01fd78001539d73c3caa42eae.tar.lz
nixlib-9c497bb8d6015ee01fd78001539d73c3caa42eae.tar.xz
nixlib-9c497bb8d6015ee01fd78001539d73c3caa42eae.tar.zst
nixlib-9c497bb8d6015ee01fd78001539d73c3caa42eae.zip
Merge branch 'staging-next' into staging
-rw-r--r--.mailmap13
-rw-r--r--doc/builders/images/dockertools.section.md4
-rw-r--r--doc/languages-frameworks/cuelang.section.md93
-rw-r--r--doc/languages-frameworks/go.section.md8
-rw-r--r--doc/languages-frameworks/index.xml1
-rw-r--r--lib/default.nix1
-rw-r--r--lib/generators.nix40
-rw-r--r--lib/options.nix21
-rw-r--r--lib/strings.nix65
-rw-r--r--lib/tests/misc.nix20
-rw-r--r--maintainers/maintainer-list.nix6
-rw-r--r--maintainers/scripts/update-luarocks-shell.nix2
-rw-r--r--maintainers/team-list.nix12
-rw-r--r--nixos/doc/manual/from_md/release-notes/rl-2111.section.xml8
-rw-r--r--nixos/doc/manual/from_md/release-notes/rl-2305.section.xml18
-rw-r--r--nixos/doc/manual/release-notes/rl-2111.section.md2
-rw-r--r--nixos/doc/manual/release-notes/rl-2305.section.md7
-rw-r--r--nixos/lib/make-options-doc/default.nix29
-rw-r--r--nixos/lib/make-options-doc/generateAsciiDoc.py37
-rw-r--r--nixos/lib/make-options-doc/generateCommonMark.py27
-rw-r--r--nixos/lib/make-options-doc/generateDoc.py108
-rw-r--r--nixos/lib/make-options-doc/options-to-docbook.xsl82
-rw-r--r--nixos/modules/config/krb5/default.nix4
-rw-r--r--nixos/modules/config/no-x-libs.nix1
-rw-r--r--nixos/modules/installer/tools/nix-fallback-paths.nix10
-rw-r--r--nixos/modules/misc/documentation.nix11
-rw-r--r--nixos/modules/module-list.nix4
-rw-r--r--nixos/modules/programs/bash/blesh.nix16
-rw-r--r--nixos/modules/programs/htop.nix2
-rw-r--r--nixos/modules/programs/weylus.nix2
-rw-r--r--nixos/modules/services/audio/icecast.nix2
-rw-r--r--nixos/modules/services/audio/liquidsoap.nix12
-rw-r--r--nixos/modules/services/audio/mpd.nix2
-rw-r--r--nixos/modules/services/backup/borgbackup.xml2
-rw-r--r--nixos/modules/services/cluster/kubernetes/kubelet.nix4
-rw-r--r--nixos/modules/services/cluster/kubernetes/scheduler.nix2
-rw-r--r--nixos/modules/services/continuous-integration/buildbot/master.nix2
-rw-r--r--nixos/modules/services/databases/cassandra.nix31
-rw-r--r--nixos/modules/services/databases/clickhouse.nix2
-rw-r--r--nixos/modules/services/databases/mysql.nix10
-rw-r--r--nixos/modules/services/databases/openldap.nix2
-rw-r--r--nixos/modules/services/development/jupyter/default.nix2
-rw-r--r--nixos/modules/services/games/asf.nix8
-rw-r--r--nixos/modules/services/games/terraria.nix2
-rw-r--r--nixos/modules/services/hardware/argonone.nix2
-rw-r--r--nixos/modules/services/hardware/bluetooth.nix6
-rw-r--r--nixos/modules/services/hardware/joycond.nix2
-rw-r--r--nixos/modules/services/hardware/supergfxd.nix6
-rw-r--r--nixos/modules/services/home-automation/home-assistant.nix4
-rw-r--r--nixos/modules/services/matrix/conduit.nix3
-rw-r--r--nixos/modules/services/matrix/synapse.nix1
-rw-r--r--nixos/modules/services/misc/autorandr.nix4
-rw-r--r--nixos/modules/services/misc/gitlab.nix4
-rw-r--r--nixos/modules/services/misc/heisenbridge.nix3
-rw-r--r--nixos/modules/services/misc/libreddit.nix9
-rw-r--r--nixos/modules/services/misc/portunus.nix4
-rw-r--r--nixos/modules/services/misc/ripple-data-api.nix6
-rw-r--r--nixos/modules/services/misc/sourcehut/default.nix2
-rw-r--r--nixos/modules/services/monitoring/grafana-agent.nix26
-rw-r--r--nixos/modules/services/monitoring/graphite.nix2
-rw-r--r--nixos/modules/services/monitoring/kapacitor.nix2
-rw-r--r--nixos/modules/services/monitoring/prometheus/alertmanager.nix2
-rw-r--r--nixos/modules/services/monitoring/prometheus/exporters/smartctl.nix32
-rw-r--r--nixos/modules/services/monitoring/uptime-kuma.nix3
-rw-r--r--nixos/modules/services/monitoring/zabbix-proxy.nix2
-rw-r--r--nixos/modules/services/network-filesystems/tahoe.nix6
-rw-r--r--nixos/modules/services/networking/ddclient.nix2
-rw-r--r--nixos/modules/services/networking/dnsmasq.nix86
-rw-r--r--nixos/modules/services/networking/ergochat.nix4
-rw-r--r--nixos/modules/services/networking/morty.nix2
-rw-r--r--nixos/modules/services/networking/multipath.nix2
-rw-r--r--nixos/modules/services/networking/nomad.nix2
-rw-r--r--nixos/modules/services/networking/nsd.nix4
-rw-r--r--nixos/modules/services/networking/nylon.nix2
-rw-r--r--nixos/modules/services/networking/pdns-recursor.nix4
-rw-r--r--nixos/modules/services/networking/redsocks.nix2
-rw-r--r--nixos/modules/services/networking/sabnzbd.nix2
-rw-r--r--nixos/modules/services/networking/twingate.nix28
-rw-r--r--nixos/modules/services/networking/znc/options.nix4
-rw-r--r--nixos/modules/services/printing/ipp-usb.nix63
-rw-r--r--nixos/modules/services/search/elasticsearch-curator.nix2
-rw-r--r--nixos/modules/services/search/elasticsearch.nix2
-rw-r--r--nixos/modules/services/search/meilisearch.nix2
-rw-r--r--nixos/modules/services/security/opensnitch.nix2
-rw-r--r--nixos/modules/services/system/kerberos/mit.nix2
-rw-r--r--nixos/modules/services/web-apps/code-server.nix2
-rw-r--r--nixos/modules/services/web-apps/hedgedoc.nix2
-rw-r--r--nixos/modules/services/web-apps/invidious.nix2
-rw-r--r--nixos/modules/services/web-apps/limesurvey.nix2
-rw-r--r--nixos/modules/services/web-apps/mastodon.nix10
-rw-r--r--nixos/modules/services/web-apps/mattermost.nix4
-rw-r--r--nixos/modules/services/web-apps/moodle.nix2
-rw-r--r--nixos/modules/services/web-apps/onlyoffice.nix2
-rw-r--r--nixos/modules/services/web-apps/peering-manager.nix265
-rw-r--r--nixos/modules/services/web-apps/zabbix.nix4
-rw-r--r--nixos/modules/services/web-servers/lighttpd/default.nix2
-rw-r--r--nixos/modules/services/web-servers/nginx/vhost-options.nix2
-rw-r--r--nixos/modules/services/x11/desktop-managers/cinnamon.nix4
-rw-r--r--nixos/modules/system/activation/test.nix27
-rw-r--r--nixos/modules/system/activation/top-level.nix32
-rw-r--r--nixos/modules/virtualisation/qemu-vm.nix9
-rw-r--r--nixos/tests/all-tests.nix3
-rw-r--r--nixos/tests/bazarr.nix1
-rw-r--r--nixos/tests/dnscrypt-proxy2.nix2
-rw-r--r--nixos/tests/docker-tools.nix14
-rw-r--r--nixos/tests/kerberos/mit.nix2
-rw-r--r--nixos/tests/krb5/example-config.nix2
-rw-r--r--nixos/tests/kubernetes/dns.nix2
-rw-r--r--nixos/tests/prometheus-exporters.nix7
-rw-r--r--nixos/tests/schleuder.nix4
-rw-r--r--nixos/tests/web-apps/peering-manager.nix40
-rw-r--r--pkgs/applications/audio/audacity/default.nix4
-rw-r--r--pkgs/applications/audio/cardinal/default.nix4
-rw-r--r--pkgs/applications/audio/mmtc/default.nix6
-rw-r--r--pkgs/applications/audio/praat/default.nix4
-rw-r--r--pkgs/applications/audio/pt2-clone/default.nix4
-rw-r--r--pkgs/applications/audio/sooperlooper/default.nix4
-rw-r--r--pkgs/applications/audio/soundux/default.nix142
-rw-r--r--pkgs/applications/audio/spek/default.nix4
-rw-r--r--pkgs/applications/backup/deja-dup/default.nix4
-rw-r--r--pkgs/applications/backup/unifi-protect-backup/default.nix8
-rw-r--r--pkgs/applications/blockchains/electrs/default.nix3
-rw-r--r--pkgs/applications/blockchains/ledger-live-desktop/default.nix4
-rw-r--r--pkgs/applications/blockchains/lighthouse/default.nix13
-rw-r--r--pkgs/applications/blockchains/lndhub-go/default.nix6
-rw-r--r--pkgs/applications/blockchains/nearcore/default.nix10
-rw-r--r--pkgs/applications/blockchains/polkadot/default.nix3
-rw-r--r--pkgs/applications/blockchains/snarkos/default.nix4
-rw-r--r--pkgs/applications/blockchains/solana-validator/default.nix7
-rw-r--r--pkgs/applications/blockchains/teos/default.nix9
-rw-r--r--pkgs/applications/editors/emacs/elisp-packages/manual-packages/tsc/default.nix6
-rw-r--r--pkgs/applications/editors/gnome-builder/default.nix4
-rw-r--r--pkgs/applications/editors/helix/default.nix6
-rw-r--r--pkgs/applications/editors/jove/default.nix25
-rw-r--r--pkgs/applications/editors/kakoune/plugins/update-shell.nix2
-rw-r--r--pkgs/applications/editors/neovim/default.nix13
-rw-r--r--pkgs/applications/editors/tiled/default.nix60
-rw-r--r--pkgs/applications/editors/vim/macvim.nix33
-rw-r--r--pkgs/applications/editors/vim/plugins/generated.nix558
-rw-r--r--pkgs/applications/editors/vim/plugins/nvim-treesitter/generated.nix85
-rw-r--r--pkgs/applications/editors/vim/plugins/update-shell.nix2
-rw-r--r--pkgs/applications/editors/vim/plugins/vim-utils.nix12
-rw-r--r--pkgs/applications/editors/vscode/extensions/default.nix12
-rw-r--r--pkgs/applications/editors/zee/default.nix9
-rw-r--r--pkgs/applications/editors/zee/update-ropey-for-rust-1.65.diff28
-rw-r--r--pkgs/applications/emulators/dolphin-emu/default.nix8
-rw-r--r--pkgs/applications/emulators/dolphin-emu/master.nix4
-rw-r--r--pkgs/applications/emulators/dolphin-emu/primehack.nix4
-rw-r--r--pkgs/applications/emulators/mame/001-use-absolute-paths.diff (renamed from pkgs/applications/emulators/mame/emuopts.patch)16
-rw-r--r--pkgs/applications/emulators/mame/default.nix77
-rw-r--r--pkgs/applications/graphics/ImageMagick/6.x.nix6
-rw-r--r--pkgs/applications/graphics/ImageMagick/default.nix4
-rw-r--r--pkgs/applications/graphics/digikam/default.nix4
-rw-r--r--pkgs/applications/graphics/drawio/default.nix4
-rw-r--r--pkgs/applications/graphics/freecad/default.nix4
-rw-r--r--pkgs/applications/graphics/rnote/default.nix9
-rw-r--r--pkgs/applications/misc/1password/default.nix10
-rw-r--r--pkgs/applications/misc/authenticator/default.nix4
-rw-r--r--pkgs/applications/misc/clipcat/default.nix5
-rw-r--r--pkgs/applications/misc/hugo/default.nix6
-rw-r--r--pkgs/applications/misc/imag/default.nix4
-rw-r--r--pkgs/applications/misc/latte-dock/default.nix2
-rw-r--r--pkgs/applications/misc/lenmus/default.nix4
-rw-r--r--pkgs/applications/misc/lutris/fhsenv.nix2
-rw-r--r--pkgs/applications/misc/mediainfo-gui/default.nix4
-rw-r--r--pkgs/applications/misc/openrgb/default.nix4
-rw-r--r--pkgs/applications/misc/oxker/default.nix6
-rw-r--r--pkgs/applications/misc/pwsafe/default.nix4
-rw-r--r--pkgs/applications/misc/tippecanoe/default.nix4
-rw-r--r--pkgs/applications/misc/tut/default.nix6
-rw-r--r--pkgs/applications/misc/xplr/default.nix6
-rw-r--r--pkgs/applications/networking/browsers/chromium/upstream-info.json14
-rw-r--r--pkgs/applications/networking/browsers/dillo/default.nix4
-rw-r--r--pkgs/applications/networking/browsers/dillong/default.nix4
-rw-r--r--pkgs/applications/networking/browsers/offpunk/default.nix4
-rw-r--r--pkgs/applications/networking/browsers/vivaldi/default.nix7
-rw-r--r--pkgs/applications/networking/cluster/argocd/default.nix4
-rw-r--r--pkgs/applications/networking/cluster/kyverno/default.nix4
-rw-r--r--pkgs/applications/networking/cluster/ssm-agent/default.nix7
-rw-r--r--pkgs/applications/networking/cluster/terraform-compliance/default.nix58
-rw-r--r--pkgs/applications/networking/cluster/terraform-providers/providers.json122
-rw-r--r--pkgs/applications/networking/cluster/terragrunt/default.nix4
-rw-r--r--pkgs/applications/networking/cluster/velero/default.nix6
-rw-r--r--pkgs/applications/networking/flexget/default.nix4
-rw-r--r--pkgs/applications/networking/ftp/filezilla/default.nix7
-rw-r--r--pkgs/applications/networking/instant-messengers/signal-desktop/default.nix4
-rw-r--r--pkgs/applications/networking/instant-messengers/slack/default.nix12
-rw-r--r--pkgs/applications/networking/instant-messengers/teams-for-linux/default.nix91
-rw-r--r--pkgs/applications/networking/instant-messengers/telegram/tdesktop/default.nix4
-rw-r--r--pkgs/applications/networking/irc/senpai/default.nix8
-rw-r--r--pkgs/applications/networking/mailreaders/evolution/evolution-ews/default.nix4
-rw-r--r--pkgs/applications/networking/mailreaders/evolution/evolution/default.nix4
-rw-r--r--pkgs/applications/networking/remote/freerdp/default.nix2
-rw-r--r--pkgs/applications/networking/sniffers/kismet/default.nix24
-rw-r--r--pkgs/applications/networking/soulseek/nicotine-plus/default.nix4
-rw-r--r--pkgs/applications/networking/syncthing/default.nix6
-rw-r--r--pkgs/applications/networking/twingate/default.nix51
-rw-r--r--pkgs/applications/networking/yaup/default.nix47
-rw-r--r--pkgs/applications/office/libreoffice/default.nix4
-rw-r--r--pkgs/applications/office/portfolio/default.nix4
-rw-r--r--pkgs/applications/office/trilium/default.nix11
-rw-r--r--pkgs/applications/office/zk/default.nix4
-rw-r--r--pkgs/applications/radio/chirp/default.nix37
-rw-r--r--pkgs/applications/radio/freedv/default.nix4
-rw-r--r--pkgs/applications/science/astronomy/phd2/default.nix4
-rw-r--r--pkgs/applications/science/biology/ecopcr/default.nix14
-rw-r--r--pkgs/applications/science/logic/isabelle/default.nix39
-rwxr-xr-xpkgs/applications/science/machine-learning/streamlit/default.nix20
-rw-r--r--pkgs/applications/science/misc/snakemake/default.nix2
-rw-r--r--pkgs/applications/version-management/git-and-tools/git-annex-remote-googledrive/default.nix21
-rw-r--r--pkgs/applications/version-management/git-and-tools/git-privacy/default.nix4
-rw-r--r--pkgs/applications/version-management/git-and-tools/git-repo-updater/default.nix16
-rw-r--r--pkgs/applications/version-management/git-and-tools/git-up/default.nix16
-rw-r--r--pkgs/applications/version-management/git-and-tools/gitmux/default.nix35
-rw-r--r--pkgs/applications/version-management/git-and-tools/glab/default.nix4
-rw-r--r--pkgs/applications/version-management/git-and-tools/lefthook/default.nix4
-rw-r--r--pkgs/applications/version-management/git-and-tools/legit/default.nix7
-rw-r--r--pkgs/applications/version-management/jujutsu/default.nix6
-rw-r--r--pkgs/applications/version-management/rapidsvn/default.nix4
-rw-r--r--pkgs/applications/version-management/tailor/default.nix40
-rw-r--r--pkgs/applications/video/dvdstyler/default.nix4
-rw-r--r--pkgs/applications/video/mpv/default.nix77
-rw-r--r--pkgs/applications/virtualization/containerd/default.nix4
-rw-r--r--pkgs/applications/virtualization/docker/default.nix2
-rw-r--r--pkgs/applications/virtualization/pods/default.nix8
-rw-r--r--pkgs/applications/window-managers/icewm/default.nix4
-rw-r--r--pkgs/build-support/docker/default.nix16
-rw-r--r--pkgs/build-support/docker/examples.nix17
-rw-r--r--pkgs/build-support/mkshell/default.nix15
-rw-r--r--pkgs/build-support/rust/build-rust-crate/configure-crate.nix5
-rw-r--r--pkgs/build-support/rust/build-rust-crate/lib.sh6
-rw-r--r--pkgs/data/fonts/amiri/default.nix5
-rw-r--r--pkgs/data/fonts/carlito/default.nix21
-rw-r--r--pkgs/data/fonts/lexend/default.nix10
-rw-r--r--pkgs/data/fonts/material-design-icons/default.nix18
-rw-r--r--pkgs/data/icons/simp1e-cursors/default.nix42
-rw-r--r--pkgs/data/misc/v2ray-geoip/default.nix6
-rw-r--r--pkgs/desktops/cinnamon/mint-artwork/default.nix6
-rw-r--r--pkgs/desktops/gnome/apps/gedit/default.nix4
-rw-r--r--pkgs/desktops/gnome/apps/gnome-characters/default.nix4
-rw-r--r--pkgs/desktops/gnome/apps/gnome-maps/default.nix4
-rw-r--r--pkgs/desktops/gnome/core/evolution-data-server/default.nix4
-rw-r--r--pkgs/desktops/gnome/core/evolution-data-server/hardcode-gsettings.patch4
-rw-r--r--pkgs/desktops/gnome/core/gnome-initial-setup/default.nix4
-rw-r--r--pkgs/desktops/gnome/core/gnome-remote-desktop/default.nix4
-rw-r--r--pkgs/desktops/gnome/core/gnome-shell/default.nix4
-rw-r--r--pkgs/desktops/gnome/core/gnome-software/default.nix4
-rw-r--r--pkgs/desktops/gnome/core/gucharmap/default.nix8
-rw-r--r--pkgs/desktops/gnome/core/mutter/default.nix11
-rw-r--r--pkgs/desktops/gnome/core/nautilus/default.nix16
-rw-r--r--pkgs/desktops/pantheon/apps/elementary-calculator/default.nix4
-rw-r--r--pkgs/desktops/pantheon/apps/elementary-camera/default.nix4
-rw-r--r--pkgs/desktops/pantheon/apps/elementary-feedback/default.nix4
-rw-r--r--pkgs/desktops/pantheon/apps/elementary-feedback/fix-metadata-path.patch27
-rw-r--r--pkgs/development/androidndk-pkgs/androidndk-pkgs.nix19
-rw-r--r--pkgs/development/compilers/chicken/4/chicken.nix1
-rw-r--r--pkgs/development/compilers/cmdstan/default.nix33
-rw-r--r--pkgs/development/compilers/go/1.18.nix4
-rw-r--r--pkgs/development/compilers/haxe/default.nix4
-rw-r--r--pkgs/development/compilers/julia/1.8.nix4
-rw-r--r--pkgs/development/compilers/neko/default.nix4
-rw-r--r--pkgs/development/compilers/openjdk/11.nix3
-rw-r--r--pkgs/development/compilers/openjdk/12.nix3
-rw-r--r--pkgs/development/compilers/openjdk/13.nix3
-rw-r--r--pkgs/development/compilers/openjdk/14.nix3
-rw-r--r--pkgs/development/compilers/openjdk/openjfx/11.nix37
-rw-r--r--pkgs/development/compilers/openjdk/openjfx/15.nix3
-rw-r--r--pkgs/development/embedded/jtag-remote-server/default.nix6
-rw-r--r--pkgs/development/embedded/nmrpflash/default.nix4
-rw-r--r--pkgs/development/interpreters/hashlink/default.nix4
-rw-r--r--pkgs/development/interpreters/php/8.2.nix10
-rw-r--r--pkgs/development/interpreters/python/cpython/default.nix10
-rw-r--r--pkgs/development/interpreters/python/default.nix12
-rw-r--r--pkgs/development/interpreters/wasmtime/default.nix6
-rw-r--r--pkgs/development/libraries/amtk/default.nix4
-rw-r--r--pkgs/development/libraries/arrow-cpp/default.nix3
-rw-r--r--pkgs/development/libraries/audio/suil/default.nix12
-rw-r--r--pkgs/development/libraries/aws-c-s3/default.nix4
-rw-r--r--pkgs/development/libraries/bctoolbox/default.nix4
-rw-r--r--pkgs/development/libraries/belle-sip/default.nix4
-rw-r--r--pkgs/development/libraries/fancypp/default.nix31
-rw-r--r--pkgs/development/libraries/fox/clang.patch13
-rw-r--r--pkgs/development/libraries/fox/default.nix18
-rw-r--r--pkgs/development/libraries/google-cloud-cpp/default.nix21
-rw-r--r--pkgs/development/libraries/google-cloud-cpp/skipped_tests.toml8
-rw-r--r--pkgs/development/libraries/grpc/default.nix36
-rw-r--r--pkgs/development/libraries/gssdp/1.6.nix6
-rw-r--r--pkgs/development/libraries/gtk-frdp/default.nix2
-rw-r--r--pkgs/development/libraries/gupnp/1.6.nix4
-rw-r--r--pkgs/development/libraries/httplib/default.nix31
-rw-r--r--pkgs/development/libraries/liblouis/default.nix4
-rw-r--r--pkgs/development/libraries/libnfs/default.nix19
-rw-r--r--pkgs/development/libraries/libplctag/default.nix4
-rw-r--r--pkgs/development/libraries/libredwg/default.nix33
-rw-r--r--pkgs/development/libraries/libshumate/default.nix4
-rw-r--r--pkgs/development/libraries/mbedtls/2.nix6
-rw-r--r--pkgs/development/libraries/mbedtls/3.nix6
-rw-r--r--pkgs/development/libraries/mbedtls/generic.nix (renamed from pkgs/development/libraries/mbedtls/default.nix)20
-rw-r--r--pkgs/development/libraries/mdds/default.nix17
-rw-r--r--pkgs/development/libraries/mm-common/default.nix4
-rw-r--r--pkgs/development/libraries/mysocketw/default.nix6
-rw-r--r--pkgs/development/libraries/ntirpc/default.nix4
-rw-r--r--pkgs/development/libraries/ogre/default.nix127
-rw-r--r--pkgs/development/libraries/openscenegraph/default.nix4
-rw-r--r--pkgs/development/libraries/openssl/default.nix22
-rw-r--r--pkgs/development/libraries/proj/default.nix4
-rw-r--r--pkgs/development/libraries/qt-6/modules/qtbase.nix2
-rw-r--r--pkgs/development/libraries/qt-6/modules/qtwayland.nix3
-rw-r--r--pkgs/development/libraries/s2n-tls/default.nix4
-rw-r--r--pkgs/development/libraries/semver-cpp/default.nix31
-rw-r--r--pkgs/development/libraries/smokegen/default.nix20
-rw-r--r--pkgs/development/libraries/smokeqt/default.nix18
-rw-r--r--pkgs/development/libraries/tracker-miners/default.nix4
-rw-r--r--pkgs/development/libraries/vapoursynth/default.nix4
-rw-r--r--pkgs/development/libraries/vte/default.nix4
-rw-r--r--pkgs/development/libraries/wolfssl/default.nix2
-rw-r--r--pkgs/development/libraries/wxwidgets/wxGTK30.nix10
-rw-r--r--pkgs/development/libraries/xdg-desktop-portal-gtk/default.nix4
-rw-r--r--pkgs/development/libraries/yojimbo/default.nix4
-rw-r--r--pkgs/development/mobile/androidenv/compose-android-packages.nix6
-rw-r--r--pkgs/development/node-packages/overrides.nix4
-rw-r--r--pkgs/development/ocaml-modules/camlzip/default.nix21
-rw-r--r--pkgs/development/ocaml-modules/gen_js_api/default.nix1
-rw-r--r--pkgs/development/ocaml-modules/gen_js_api/ojs.nix1
-rw-r--r--pkgs/development/ocaml-modules/janestreet/0.14.nix4
-rw-r--r--pkgs/development/ocaml-modules/janestreet/0.15.nix14
-rw-r--r--pkgs/development/ocaml-modules/lambda-term/default.nix2
-rw-r--r--pkgs/development/ocaml-modules/ocsigen-toolkit/default.nix6
-rw-r--r--pkgs/development/python-modules/GitPython/hardcode-git-path.patch13
-rw-r--r--pkgs/development/python-modules/ailment/default.nix4
-rw-r--r--pkgs/development/python-modules/aiogithubapi/default.nix7
-rw-r--r--pkgs/development/python-modules/aiohomekit/default.nix4
-rw-r--r--pkgs/development/python-modules/aioshelly/default.nix10
-rw-r--r--pkgs/development/python-modules/aiosmb/default.nix5
-rw-r--r--pkgs/development/python-modules/aioswitcher/default.nix5
-rw-r--r--pkgs/development/python-modules/aiounifi/default.nix4
-rw-r--r--pkgs/development/python-modules/angr/default.nix8
-rw-r--r--pkgs/development/python-modules/apache-airflow/default.nix4
-rw-r--r--pkgs/development/python-modules/archinfo/default.nix4
-rw-r--r--pkgs/development/python-modules/asysocks/default.nix5
-rw-r--r--pkgs/development/python-modules/azure-storage-queue/default.nix7
-rw-r--r--pkgs/development/python-modules/bandit/default.nix41
-rw-r--r--pkgs/development/python-modules/bellows/default.nix4
-rw-r--r--pkgs/development/python-modules/bleak-retry-connector/default.nix6
-rw-r--r--pkgs/development/python-modules/bluetooth-adapters/default.nix10
-rw-r--r--pkgs/development/python-modules/bluetooth-auto-recovery/default.nix4
-rw-r--r--pkgs/development/python-modules/btrfsutil/default.nix26
-rw-r--r--pkgs/development/python-modules/bundlewrap/default.nix2
-rw-r--r--pkgs/development/python-modules/cccolutils/default.nix42
-rw-r--r--pkgs/development/python-modules/chat-downloader/default.nix4
-rw-r--r--pkgs/development/python-modules/claripy/default.nix4
-rw-r--r--pkgs/development/python-modules/cle/default.nix4
-rw-r--r--pkgs/development/python-modules/cryptolyzer/default.nix26
-rw-r--r--pkgs/development/python-modules/cryptoparser/default.nix11
-rw-r--r--pkgs/development/python-modules/cvelib/default.nix4
-rw-r--r--pkgs/development/python-modules/dateparser/default.nix4
-rw-r--r--pkgs/development/python-modules/db-dtypes/default.nix5
-rw-r--r--pkgs/development/python-modules/django/4.nix5
-rw-r--r--pkgs/development/python-modules/docstring-to-markdown/default.nix11
-rw-r--r--pkgs/development/python-modules/flake8-bugbear/default.nix4
-rw-r--r--pkgs/development/python-modules/furo/default.nix5
-rw-r--r--pkgs/development/python-modules/gamble/default.nix9
-rw-r--r--pkgs/development/python-modules/gcal-sync/default.nix4
-rw-r--r--pkgs/development/python-modules/git-sweep/default.nix19
-rw-r--r--pkgs/development/python-modules/gitpython/default.nix (renamed from pkgs/development/python-modules/GitPython/default.nix)31
-rw-r--r--pkgs/development/python-modules/google-cloud-bigtable/default.nix5
-rw-r--r--pkgs/development/python-modules/google-cloud-logging/default.nix5
-rw-r--r--pkgs/development/python-modules/google-cloud-spanner/default.nix5
-rw-r--r--pkgs/development/python-modules/greeclimate/default.nix4
-rw-r--r--pkgs/development/python-modules/gsd/default.nix5
-rw-r--r--pkgs/development/python-modules/gspread/default.nix5
-rw-r--r--pkgs/development/python-modules/gssapi/default.nix6
-rw-r--r--pkgs/development/python-modules/hass-nabucasa/default.nix5
-rw-r--r--pkgs/development/python-modules/home-assistant-bluetooth/default.nix8
-rw-r--r--pkgs/development/python-modules/homematicip/default.nix4
-rw-r--r--pkgs/development/python-modules/ical/default.nix4
-rw-r--r--pkgs/development/python-modules/intellifire4py/default.nix7
-rw-r--r--pkgs/development/python-modules/json-schema-for-humans/default.nix7
-rw-r--r--pkgs/development/python-modules/jupyterlab_server/default.nix2
-rw-r--r--pkgs/development/python-modules/jupytext/default.nix6
-rw-r--r--pkgs/development/python-modules/k5test/default.nix6
-rw-r--r--pkgs/development/python-modules/k5test/fix-paths.patch36
-rw-r--r--pkgs/development/python-modules/knack/default.nix13
-rw-r--r--pkgs/development/python-modules/losant-rest/default.nix4
-rw-r--r--pkgs/development/python-modules/mac-vendor-lookup/default.nix4
-rw-r--r--pkgs/development/python-modules/mathlibtools/default.nix4
-rw-r--r--pkgs/development/python-modules/metakernel/default.nix6
-rw-r--r--pkgs/development/python-modules/mitmproxy/default.nix29
-rw-r--r--pkgs/development/python-modules/mlflow/default.nix5
-rw-r--r--pkgs/development/python-modules/mypy-boto3-builder/default.nix4
-rw-r--r--pkgs/development/python-modules/mypy-boto3-s3/default.nix8
-rw-r--r--pkgs/development/python-modules/nbdime/default.nix20
-rw-r--r--pkgs/development/python-modules/nettigo-air-monitor/default.nix8
-rw-r--r--pkgs/development/python-modules/nextdns/default.nix5
-rw-r--r--pkgs/development/python-modules/opentimestamps/default.nix5
-rw-r--r--pkgs/development/python-modules/passlib/default.nix6
-rw-r--r--pkgs/development/python-modules/pip-requirements-parser/default.nix5
-rw-r--r--pkgs/development/python-modules/pontos/default.nix4
-rw-r--r--pkgs/development/python-modules/protobuf/default.nix2
-rw-r--r--pkgs/development/python-modules/psrpcore/default.nix7
-rw-r--r--pkgs/development/python-modules/ptpython/default.nix4
-rw-r--r--pkgs/development/python-modules/pulumi-aws/default.nix4
-rw-r--r--pkgs/development/python-modules/py-desmume/default.nix56
-rw-r--r--pkgs/development/python-modules/pycryptodome/default.nix8
-rw-r--r--pkgs/development/python-modules/pylint/default.nix4
-rw-r--r--pkgs/development/python-modules/pyrainbird/default.nix7
-rw-r--r--pkgs/development/python-modules/pyrisco/default.nix13
-rw-r--r--pkgs/development/python-modules/pyshark/default.nix2
-rw-r--r--pkgs/development/python-modules/pytest-random-order/default.nix4
-rw-r--r--pkgs/development/python-modules/python-arango/default.nix138
-rw-r--r--pkgs/development/python-modules/python-glanceclient/default.nix4
-rw-r--r--pkgs/development/python-modules/python-lsp-server/default.nix2
-rw-r--r--pkgs/development/python-modules/python-manilaclient/default.nix5
-rw-r--r--pkgs/development/python-modules/python-novaclient/default.nix4
-rw-r--r--pkgs/development/python-modules/pytibber/default.nix4
-rw-r--r--pkgs/development/python-modules/pyunifiprotect/default.nix4
-rw-r--r--pkgs/development/python-modules/pyvesync/default.nix5
-rw-r--r--pkgs/development/python-modules/pyvex/default.nix4
-rw-r--r--pkgs/development/python-modules/qcengine/default.nix4
-rw-r--r--pkgs/development/python-modules/rich-click/default.nix18
-rw-r--r--pkgs/development/python-modules/rstcheck-core/default.nix13
-rw-r--r--pkgs/development/python-modules/rstcheck/default.nix13
-rw-r--r--pkgs/development/python-modules/ruuvitag-ble/default.nix57
-rw-r--r--pkgs/development/python-modules/scmrepo/default.nix4
-rw-r--r--pkgs/development/python-modules/sense-energy/default.nix8
-rw-r--r--pkgs/development/python-modules/simplisafe-python/default.nix4
-rw-r--r--pkgs/development/python-modules/strenum/default.nix7
-rw-r--r--pkgs/development/python-modules/stytra/default.nix71
-rw-r--r--pkgs/development/python-modules/subarulink/default.nix7
-rw-r--r--pkgs/development/python-modules/tern/default.nix29
-rw-r--r--pkgs/development/python-modules/tilequant/default.nix33
-rw-r--r--pkgs/development/python-modules/versionfinder/default.nix5
-rw-r--r--pkgs/development/python-modules/wandb/default.nix4
-rw-r--r--pkgs/development/python-modules/wxPython/4.0.nix5
-rw-r--r--pkgs/development/python-modules/xiaomi-ble/default.nix7
-rw-r--r--pkgs/development/python-modules/xknx/default.nix4
-rw-r--r--pkgs/development/python-modules/zamg/default.nix5
-rw-r--r--pkgs/development/python-modules/zha-quirks/default.nix4
-rw-r--r--pkgs/development/python-modules/zigpy-deconz/default.nix4
-rw-r--r--pkgs/development/python-modules/zigpy-znp/default.nix4
-rw-r--r--pkgs/development/python-modules/zigpy/default.nix4
-rw-r--r--pkgs/development/python-modules/zwave-js-server-python/default.nix4
-rw-r--r--pkgs/development/python2-modules/TurboCheetah/default.nix26
-rw-r--r--pkgs/development/python2-modules/cheetah/default.nix33
-rw-r--r--pkgs/development/python2-modules/construct/default.nix39
-rw-r--r--pkgs/development/python2-modules/httpretty/default.nix52
-rw-r--r--pkgs/development/python2-modules/markdown/default.nix33
-rw-r--r--pkgs/development/python2-modules/mutagen/default.nix34
-rw-r--r--pkgs/development/python2-modules/numpy/default.nix99
-rw-r--r--pkgs/development/python2-modules/numpy/numpy-distutils-C++.patch30
-rw-r--r--pkgs/development/python2-modules/pillow/default.nix47
-rw-r--r--pkgs/development/python2-modules/pillow/generic.nix77
-rw-r--r--pkgs/development/python2-modules/prettytable/default.nix37
-rw-r--r--pkgs/development/python2-modules/pyyaml/default.nix38
-rw-r--r--pkgs/development/python2-modules/qpid-python/default.nix26
-rw-r--r--pkgs/development/r-modules/default.nix6
-rw-r--r--pkgs/development/tools/agda-pkg/default.nix6
-rw-r--r--pkgs/development/tools/analysis/checkov/default.nix2
-rw-r--r--pkgs/development/tools/analysis/cvehound/default.nix2
-rw-r--r--pkgs/development/tools/analysis/smatch/default.nix6
-rw-r--r--pkgs/development/tools/ansible-language-server/default.nix3
-rw-r--r--pkgs/development/tools/bbin/default.nix44
-rw-r--r--pkgs/development/tools/build-managers/muon/default.nix13
-rw-r--r--pkgs/development/tools/buildpack/default.nix6
-rw-r--r--pkgs/development/tools/castxml/default.nix4
-rw-r--r--pkgs/development/tools/coder/default.nix10
-rw-r--r--pkgs/development/tools/continuous-integration/github-runner/default.nix8
-rw-r--r--pkgs/development/tools/cue/validator.nix17
-rw-r--r--pkgs/development/tools/ddosify/default.nix4
-rw-r--r--pkgs/development/tools/esbuild/default.nix4
-rw-r--r--pkgs/development/tools/fdroidserver/default.nix18
-rw-r--r--pkgs/development/tools/fnm/default.nix6
-rw-r--r--pkgs/development/tools/go-mockery/default.nix4
-rw-r--r--pkgs/development/tools/go-task/default.nix4
-rw-r--r--pkgs/development/tools/godot/4/default.nix2
-rw-r--r--pkgs/development/tools/hcloud/default.nix4
-rw-r--r--pkgs/development/tools/misc/circleci-cli/default.nix4
-rw-r--r--pkgs/development/tools/misc/svls/default.nix6
-rw-r--r--pkgs/development/tools/misc/terraform-ls/default.nix6
-rw-r--r--pkgs/development/tools/ocaml/js_of_ocaml/compiler.nix6
-rw-r--r--pkgs/development/tools/ocaml/js_of_ocaml/default.nix3
-rw-r--r--pkgs/development/tools/ocaml/js_of_ocaml/lwt.nix3
-rw-r--r--pkgs/development/tools/ocaml/js_of_ocaml/ppx.nix3
-rw-r--r--pkgs/development/tools/ocaml/js_of_ocaml/ppx_deriving_json.nix3
-rw-r--r--pkgs/development/tools/open-policy-agent/default.nix4
-rw-r--r--pkgs/development/tools/pip-audit/default.nix4
-rw-r--r--pkgs/development/tools/poetry2nix/poetry2nix/default.nix12
-rw-r--r--pkgs/development/tools/poetry2nix/poetry2nix/overrides/build-systems.json96
-rw-r--r--pkgs/development/tools/poetry2nix/poetry2nix/overrides/default.nix20
-rw-r--r--pkgs/development/tools/protoc-gen-validate/default.nix6
-rw-r--r--pkgs/development/tools/refurb/default.nix6
-rw-r--r--pkgs/development/tools/ruff/default.nix6
-rw-r--r--pkgs/development/tools/rust/cargo-about/default.nix6
-rw-r--r--pkgs/development/tools/rust/cargo-about/zstd-pkg-config.patch21
-rw-r--r--pkgs/development/tools/rust/cargo-modules/default.nix21
-rw-r--r--pkgs/development/tools/rust/cargo-public-api/default.nix6
-rw-r--r--pkgs/development/tools/rust/cargo-update/default.nix6
-rw-r--r--pkgs/development/tools/rust/rust-analyzer/default.nix6
-rw-r--r--pkgs/development/tools/rust/sqlx-cli/default.nix24
-rw-r--r--pkgs/development/tools/selene/default.nix6
-rw-r--r--pkgs/development/tools/stylua/default.nix6
-rw-r--r--pkgs/development/tools/tarmac/default.nix45
-rw-r--r--pkgs/development/tools/wxformbuilder/default.nix1
-rw-r--r--pkgs/development/tools/ytt/default.nix4
-rw-r--r--pkgs/games/btanks/default.nix26
-rw-r--r--pkgs/games/heroic/fhsenv.nix10
-rw-r--r--pkgs/games/megaglest/default.nix6
-rw-r--r--pkgs/games/opendungeons/default.nix5
-rw-r--r--pkgs/games/portmod/default.nix35
-rw-r--r--pkgs/games/quakespasm/vulkan.nix4
-rw-r--r--pkgs/games/rigsofrods/default.nix4
-rw-r--r--pkgs/games/tennix/default.nix21
-rw-r--r--pkgs/os-specific/linux/intel-compute-runtime/default.nix4
-rw-r--r--pkgs/os-specific/linux/ipp-usb/default.nix42
-rw-r--r--pkgs/os-specific/linux/kernel/common-config.nix5
-rw-r--r--pkgs/os-specific/linux/kernel/hardened/config.nix20
-rw-r--r--pkgs/os-specific/linux/kernel/linux-4.14.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/linux-4.19.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/linux-5.10.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/linux-5.15.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/linux-5.4.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/linux-6.0.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/linux-testing.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/manual-config.nix9
-rw-r--r--pkgs/os-specific/linux/systemd/default.nix21
-rw-r--r--pkgs/os-specific/linux/wireguard/default.nix2
-rw-r--r--pkgs/servers/bazarr/default.nix4
-rw-r--r--pkgs/servers/dns/knot-dns/default.nix6
-rw-r--r--pkgs/servers/home-assistant/component-packages.nix365
-rw-r--r--pkgs/servers/home-assistant/default.nix80
-rw-r--r--pkgs/servers/home-assistant/frontend.nix4
-rw-r--r--pkgs/servers/home-assistant/tests.nix8
-rw-r--r--pkgs/servers/home-automation/evcc/default.nix8
-rw-r--r--pkgs/servers/http/dufs/default.nix5
-rw-r--r--pkgs/servers/http/hiawatha/default.nix4
-rw-r--r--pkgs/servers/invidious/versions.json6
-rw-r--r--pkgs/servers/klipper/klipper-firmware.nix4
-rw-r--r--pkgs/servers/libreddit/default.nix2
-rw-r--r--pkgs/servers/matrix-synapse/default.nix6
-rw-r--r--pkgs/servers/monitoring/do-agent/default.nix4
-rw-r--r--pkgs/servers/monitoring/nagios/plugins/check_ssl_cert.nix4
-rw-r--r--pkgs/servers/monitoring/prometheus/smartctl-exporter/default.nix29
-rw-r--r--pkgs/servers/monitoring/sensu-go/default.nix4
-rw-r--r--pkgs/servers/monitoring/telegraf/default.nix6
-rw-r--r--pkgs/servers/monitoring/uptime-kuma/default.nix6
-rw-r--r--pkgs/servers/nfs-ganesha/default.nix10
-rw-r--r--pkgs/servers/nosql/cassandra/4.json4
-rw-r--r--pkgs/servers/nosql/cassandra/4.nix8
-rw-r--r--pkgs/servers/nosql/ferretdb/default.nix6
-rw-r--r--pkgs/servers/nosql/mongodb/mongodb.nix4
-rw-r--r--pkgs/servers/openafs/1.8/default.nix6
-rw-r--r--pkgs/servers/photoprism/default.nix2
-rw-r--r--pkgs/servers/pocketbase/default.nix6
-rw-r--r--pkgs/servers/pulseaudio/default.nix4
-rw-r--r--pkgs/servers/search/elasticsearch/6.x.nix2
-rw-r--r--pkgs/servers/search/zinc/default.nix56
-rw-r--r--pkgs/servers/snappymail/default.nix4
-rw-r--r--pkgs/servers/tailscale/default.nix6
-rw-r--r--pkgs/servers/traefik/default.nix6
-rw-r--r--pkgs/servers/web-apps/invoiceplane/default.nix4
-rw-r--r--pkgs/servers/web-apps/peering-manager/default.nix100
-rw-r--r--pkgs/servers/web-apps/peering-manager/redis-unix-sock.patch47
-rw-r--r--pkgs/shells/bash/blesh/default.nix53
-rw-r--r--pkgs/shells/nushell/default.nix6
-rw-r--r--pkgs/shells/zsh/default.nix2
-rw-r--r--pkgs/test/cue/default.nix24
-rw-r--r--pkgs/test/default.nix2
-rw-r--r--pkgs/tools/X11/bumblebee/default.nix8
-rw-r--r--pkgs/tools/admin/awscli2/default.nix3
-rw-r--r--pkgs/tools/admin/scaleway-cli/default.nix6
-rw-r--r--pkgs/tools/admin/syft/default.nix6
-rw-r--r--pkgs/tools/backup/dar/default.nix4
-rw-r--r--pkgs/tools/backup/ugarit-manifest-maker/default.nix1
-rw-r--r--pkgs/tools/backup/ugarit/default.nix1
-rw-r--r--pkgs/tools/cd-dvd/ventoy-bin/default.nix14
-rw-r--r--pkgs/tools/filesystems/btrfs-progs/default.nix16
-rw-r--r--pkgs/tools/filesystems/dislocker/default.nix4
-rw-r--r--pkgs/tools/filesystems/stratisd/default.nix6
-rw-r--r--pkgs/tools/graphics/oxipng/default.nix6
-rw-r--r--pkgs/tools/graphics/zbar/default.nix5
-rw-r--r--pkgs/tools/misc/fd/default.nix5
-rw-r--r--pkgs/tools/misc/flexoptix-app/default.nix4
-rw-r--r--pkgs/tools/misc/hexyl/default.nix12
-rw-r--r--pkgs/tools/misc/lemmy-help/default.nix8
-rw-r--r--pkgs/tools/misc/mcfly/default.nix2
-rw-r--r--pkgs/tools/misc/opentimestamps-client/default.nix31
-rw-r--r--pkgs/tools/misc/opentsdb/default.nix4
-rw-r--r--pkgs/tools/misc/page/default.nix6
-rw-r--r--pkgs/tools/misc/plocate/default.nix14
-rw-r--r--pkgs/tools/misc/pmbootstrap/default.nix11
-rw-r--r--pkgs/tools/misc/popsicle/default.nix69
-rw-r--r--pkgs/tools/misc/pspg/default.nix4
-rw-r--r--pkgs/tools/misc/tbls/default.nix4
-rw-r--r--pkgs/tools/misc/tio/default.nix4
-rw-r--r--pkgs/tools/misc/topgrade/default.nix6
-rw-r--r--pkgs/tools/misc/tz/default.nix6
-rw-r--r--pkgs/tools/misc/wwcd/default.nix3
-rw-r--r--pkgs/tools/networking/aardvark-dns/default.nix6
-rw-r--r--pkgs/tools/networking/clash/default.nix6
-rw-r--r--pkgs/tools/networking/croc/default.nix6
-rw-r--r--pkgs/tools/networking/httplz/default.nix10
-rw-r--r--pkgs/tools/networking/linkchecker/default.nix57
-rw-r--r--pkgs/tools/networking/mu/default.nix4
-rw-r--r--pkgs/tools/networking/netavark/default.nix10
-rw-r--r--pkgs/tools/networking/netbird/default.nix4
-rw-r--r--pkgs/tools/networking/networkmanager/libnma/default.nix8
-rw-r--r--pkgs/tools/networking/p2p/amule/default.nix4
-rw-r--r--pkgs/tools/networking/shadowsocks-libev/default.nix4
-rw-r--r--pkgs/tools/package-management/nix/default.nix10
-rw-r--r--pkgs/tools/security/clairvoyance/default.nix6
-rw-r--r--pkgs/tools/security/crowdsec/default.nix4
-rw-r--r--pkgs/tools/security/nuclei/default.nix7
-rw-r--r--pkgs/tools/security/pinentry/default.nix35
-rw-r--r--pkgs/tools/security/teler/default.nix11
-rw-r--r--pkgs/tools/security/tpm2-tools/default.nix4
-rw-r--r--pkgs/tools/security/trufflehog/default.nix17
-rw-r--r--pkgs/tools/security/uncover/default.nix7
-rw-r--r--pkgs/tools/security/vaultwarden/vault.nix4
-rw-r--r--pkgs/tools/system/automatic-timezoned/default.nix6
-rw-r--r--pkgs/tools/system/plan9port/default.nix8
-rw-r--r--pkgs/tools/text/d2/default.nix12
-rw-r--r--pkgs/tools/text/poedit/default.nix4
-rw-r--r--pkgs/tools/text/transifex-client/default.nix15
-rw-r--r--pkgs/tools/wayland/slurp/default.nix27
-rw-r--r--pkgs/tools/wayland/waynergy/default.nix6
-rw-r--r--pkgs/top-level/aliases.nix4
-rw-r--r--pkgs/top-level/all-packages.nix136
-rw-r--r--pkgs/top-level/perl-packages.nix18
-rw-r--r--pkgs/top-level/python-aliases.nix1
-rw-r--r--pkgs/top-level/python-packages.nix23
-rw-r--r--pkgs/top-level/python2-packages.nix25
631 files changed, 5653 insertions, 3441 deletions
diff --git a/.mailmap b/.mailmap
index d3858d78dde7..d2bf6d0e4769 100644
--- a/.mailmap
+++ b/.mailmap
@@ -1,3 +1,14 @@
+ajs124 <git@ajs124.de> <ajs124@users.noreply.github.com>
+Anderson Torres <torres.anderson.85@protonmail.com>
 Daniel Løvbrøtte Olsen <me@dandellion.xyz> <daniel.olsen99@gmail.com>
+Fabian Affolter <mail@fabian-affolter.ch> <fabian@affolter-engineering.ch>
+Janne Heß <janne@hess.ooo> <dasJ@users.noreply.github.com>
+Jörg Thalheim <joerg@thalheim.io> <Mic92@users.noreply.github.com>
+Martin Weinelt <hexa@darmstadt.ccc.de> <mweinelt@users.noreply.github.com>
 R. RyanTM <ryantm-bot@ryantm.com>
-Sandro <sandro.jaeckel@gmail.com>
+Robert Hensing <robert@roberthensing.nl> <roberth@users.noreply.github.com>
+Sandro Jäckel <sandro.jaeckel@gmail.com>
+Sandro Jäckel <sandro.jaeckel@gmail.com> <sandro.jaeckel@sap.com>
+superherointj <5861043+superherointj@users.noreply.github.com>
+Vladimír Čunát <v@cunat.cz> <vcunat@gmail.com>
+Vladimír Čunát <v@cunat.cz> <vladimir.cunat@nic.cz>
diff --git a/doc/builders/images/dockertools.section.md b/doc/builders/images/dockertools.section.md
index 6203b3786bfa..dfc012b80c5a 100644
--- a/doc/builders/images/dockertools.section.md
+++ b/doc/builders/images/dockertools.section.md
@@ -62,6 +62,8 @@ The above example will build a Docker image `redis/latest` from the given base i
 
 - `config` is used to specify the configuration of the containers that will be started off the built image in Docker. The available options are listed in the [Docker Image Specification v1.2.0](https://github.com/moby/moby/blob/master/image/spec/v1.2.md#image-json-field-descriptions).
 
+- `architecture` is _optional_ and used to specify the image architecture, this is useful for multi-architecture builds that don't need cross compiling. If not specified it will default to `hostPlatform`.
+
 - `diskSize` is used to specify the disk size of the VM used to build the image in megabytes. By default it's 1024 MiB.
 
 - `buildVMMemorySize` is used to specify the memory size of the VM to build the image in megabytes. By default it's 512 MiB.
@@ -141,6 +143,8 @@ Create a Docker image with many of the store paths being on their own layer to i
 
 `config` _optional_
 
+`architecture` is _optional_ and used to specify the image architecture, this is useful for multi-architecture builds that don't need cross compiling. If not specified it will default to `hostPlatform`.
+
 : Run-time configuration of the container. A full list of the options are available at in the [Docker Image Specification v1.2.0](https://github.com/moby/moby/blob/master/image/spec/v1.2.md#image-json-field-descriptions).
 
     *Default:* `{}`
diff --git a/doc/languages-frameworks/cuelang.section.md b/doc/languages-frameworks/cuelang.section.md
new file mode 100644
index 000000000000..93c94027ae29
--- /dev/null
+++ b/doc/languages-frameworks/cuelang.section.md
@@ -0,0 +1,93 @@
+# Cue (Cuelang) {#cuelang}
+
+[Cuelang](https://cuelang.org/) is a language to:
+
+- describe schemas and validate backward-compatibility
+- generate code and schemas in various formats (e.g. JSON Schema, OpenAPI)
+- do configuration akin to [Dhall Lang](https://dhall-lang.org/)
+- perform data validation
+
+## Cuelang schema quick start
+
+Cuelang schemas are similar to JSON, here is a quick cheatsheet:
+
+- Default types includes: `null`, `string`, `bool`, `bytes`, `number`, `int`, `float`, lists as `[...T]` where `T` is a type.
+- All structures, defined by: `myStructName: { <fields> }` are **open** -- they accept fields which are not specified.
+- Closed structures can be built by doing `myStructName: close({ <fields> })` -- they are strict in what they accept.
+- `#X` are **definitions**, referenced definitions are **recursively closed**, i.e. all its children structures are **closed**.
+- `&` operator is the [unification operator](https://cuelang.org/docs/references/spec/#unification) (similar to a type-level merging operator), `|` is the [disjunction operator](https://cuelang.org/docs/references/spec/#disjunction) (similar to a type-level union operator).
+- Values **are** types, i.e. `myStruct: { a: 3 }` is a valid type definition that only allows `3` as value.
+
+- Read <https://cuelang.org/docs/concepts/logic/> to learn more about the semantics.
+- Read <https://cuelang.org/docs/references/spec/> to learn about the language specification.
+
+## `writeCueValidator`
+
+Nixpkgs provides a `pkgs.writeCueValidator` helper, which will write a validation script based on the provided Cuelang schema.
+
+Here is an example:
+```
+pkgs.writeCueValidator
+  (pkgs.writeText "schema.cue" ''
+    #Def1: {
+      field1: string
+    }
+  '')
+  { document = "#Def1"; }
+```
+
+- The first parameter is the Cue schema file.
+- The second paramter is an options parameter, currently, only: `document` can be passed.
+
+`document` : match your input data against this fragment of structure or definition, e.g. you may use the same schema file but differents documents based on the data you are validating.
+
+Another example, given the following `validator.nix` :
+```
+{ pkgs ? import <nixpkgs> {} }:
+let
+  genericValidator = version:
+  pkgs.writeCueValidator
+    (pkgs.writeText "schema.cue" ''
+      #Version1: {
+        field1: string
+      }
+      #Version2: #Version1 & {
+        field1: "unused"
+      }''
+    )
+    { document = "#Version${toString version}"; };
+in
+{
+  validateV1 = genericValidator 1;
+  validateV2 = genericValidator 2;
+}
+```
+
+The result is a script that will validate the file you pass as the first argument against the schema you provided `writeCueValidator`.
+
+It can be any format that `cue vet` supports, i.e. YAML or JSON for example.
+
+Here is an example, named `example.json`, given the following JSON:
+```
+{ "field1": "abc" }
+```
+
+You can run the result script (named `validate`) as the following:
+
+```console
+$ nix-build validator.nix
+$ ./result example.json
+$ ./result-2 example.json
+field1: conflicting values "unused" and "abc":
+    ./example.json:1:13
+    ../../../../../../nix/store/v64dzx3vr3glpk0cq4hzmh450lrwh6sg-schema.cue:5:11
+$ sed -i 's/"abc"/3/' example.json
+$ ./result example.json
+field1: conflicting values 3 and string (mismatched types int and string):
+    ./example.json:1:13
+    ../../../../../../nix/store/v64dzx3vr3glpk0cq4hzmh450lrwh6sg-schema.cue:5:11
+```
+
+**Known limitations**
+
+* The script will enforce **concrete** values and will not accept lossy transformations (strictness). You can add these options if you need them.
diff --git a/doc/languages-frameworks/go.section.md b/doc/languages-frameworks/go.section.md
index 42acab817b6a..523f5b26ec7f 100644
--- a/doc/languages-frameworks/go.section.md
+++ b/doc/languages-frameworks/go.section.md
@@ -11,7 +11,13 @@ The function `buildGoModule` builds Go programs managed with Go modules. It buil
 
 In the following is an example expression using `buildGoModule`, the following arguments are of special significance to the function:
 
-- `vendorHash`: is the hash of the output of the intermediate fetcher derivation. `vendorHash` can also take `null` as an input. When `null` is used as a value, rather than fetching the dependencies and vendoring them, we use the vendoring included within the source repo. If you'd like to not have to update this field on dependency changes, run `go mod vendor` in your source repo and set `vendorHash = null;`
+- `vendorHash`: is the hash of the output of the intermediate fetcher derivation.
+
+  `vendorHash` can also be set to `null`.
+  In that case, rather than fetching the dependencies and vendoring them, the dependencies vendored in the source repo will be used.
+
+  To avoid updating this field when dependencies change, run `go mod vendor` in your source repo and set `vendorHash = null;`  
+  To obtain the actual hash, set `vendorHash = lib.fakeSha256;` and run the build ([more details here](#sec-source-hashes)).
 - `proxyVendor`: Fetches (go mod download) and proxies the vendor directory. This is useful if your code depends on c code and go mod tidy does not include the needed sources to build or if any dependency has case-insensitive conflicts which will produce platform dependant `vendorHash` checksums.
 
 ```nix
diff --git a/doc/languages-frameworks/index.xml b/doc/languages-frameworks/index.xml
index 3d5b2f738976..7df241436ff5 100644
--- a/doc/languages-frameworks/index.xml
+++ b/doc/languages-frameworks/index.xml
@@ -13,6 +13,7 @@
  <xi:include href="coq.section.xml" />
  <xi:include href="crystal.section.xml" />
  <xi:include href="cuda.section.xml" />
+ <xi:include href="cuelang.section.xml" />
  <xi:include href="dhall.section.xml" />
  <xi:include href="dotnet.section.xml" />
  <xi:include href="emscripten.section.xml" />
diff --git a/lib/default.nix b/lib/default.nix
index cc4bedc5869b..68e5b8dea1eb 100644
--- a/lib/default.nix
+++ b/lib/default.nix
@@ -101,6 +101,7 @@ let
       upperChars toLower toUpper addContextFrom splitString
       removePrefix removeSuffix versionOlder versionAtLeast
       getName getVersion
+      mesonOption mesonBool mesonEnable
       nameFromURL enableFeature enableFeatureAs withFeature
       withFeatureAs fixedWidthString fixedWidthNumber isStorePath
       toInt toIntBase10 readPathsFromFile fileContents;
diff --git a/lib/generators.nix b/lib/generators.nix
index b77cca75010f..c0fe69389e00 100644
--- a/lib/generators.nix
+++ b/lib/generators.nix
@@ -278,8 +278,11 @@ rec {
         mapAny 0;
 
   /* Pretty print a value, akin to `builtins.trace`.
-    * Should probably be a builtin as well.
-    */
+   * Should probably be a builtin as well.
+   * The pretty-printed string should be suitable for rendering default values
+   * in the NixOS manual. In particular, it should be as close to a valid Nix expression
+   * as possible.
+   */
   toPretty = {
     /* If this option is true, attrsets like { __pretty = fn; val = …; }
        will use fn to convert val to a pretty printed representation.
@@ -294,20 +297,25 @@ rec {
             introSpace = if multiline then "\n${indent}  " else " ";
             outroSpace = if multiline then "\n${indent}" else " ";
     in if   isInt      v then toString v
-    else if isFloat    v then "~${toString v}"
+    # toString loses precision on floats, so we use toJSON instead. This isn't perfect
+    # as the resulting string may not parse back as a float (e.g. 42, 1e-06), but for
+    # pretty-printing purposes this is acceptable.
+    else if isFloat    v then builtins.toJSON v
     else if isString   v then
       let
-        # Separate a string into its lines
-        newlineSplits = filter (v: ! isList v) (builtins.split "\n" v);
-        # For a '' string terminated by a \n, which happens when the closing '' is on a new line
-        multilineResult = "''" + introSpace + concatStringsSep introSpace (lib.init newlineSplits) + outroSpace + "''";
-        # For a '' string not terminated by a \n, which happens when the closing '' is not on a new line
-        multilineResult' = "''" + introSpace + concatStringsSep introSpace newlineSplits + "''";
-        # For single lines, replace all newlines with their escaped representation
-        singlelineResult = "\"" + libStr.escape [ "\"" ] (concatStringsSep "\\n" newlineSplits) + "\"";
-      in if multiline && length newlineSplits > 1 then
-        if lib.last newlineSplits == "" then multilineResult else multilineResult'
-      else singlelineResult
+        lines = filter (v: ! isList v) (builtins.split "\n" v);
+        escapeSingleline = libStr.escape [ "\\" "\"" "\${" ];
+        escapeMultiline = libStr.replaceStrings [ "\${" "''" ] [ "''\${" "'''" ];
+        singlelineResult = "\"" + concatStringsSep "\\n" (map escapeSingleline lines) + "\"";
+        multilineResult = let
+          escapedLines = map escapeMultiline lines;
+          # The last line gets a special treatment: if it's empty, '' is on its own line at the "outer"
+          # indentation level. Otherwise, '' is appended to the last line.
+          lastLine = lib.last escapedLines;
+        in "''" + introSpace + concatStringsSep introSpace (lib.init escapedLines)
+                + (if lastLine == "" then outroSpace else introSpace + lastLine) + "''";
+      in
+        if multiline && length lines > 1 then multilineResult else singlelineResult
     else if true  ==   v then "true"
     else if false ==   v then "false"
     else if null  ==   v then "null"
@@ -326,11 +334,11 @@ rec {
                          else "<function, args: {${showFnas}}>"
     else if isAttrs    v then
       # apply pretty values if allowed
-      if attrNames v == [ "__pretty" "val" ] && allowPrettyValues
+      if allowPrettyValues && v ? __pretty && v ? val
          then v.__pretty v.val
       else if v == {} then "{ }"
       else if v ? type && v.type == "derivation" then
-        "<derivation ${v.drvPath or "???"}>"
+        "<derivation ${v.name or "???"}>"
       else "{" + introSpace
           + libStr.concatStringsSep introSpace (libAttr.mapAttrsToList
               (name: value:
diff --git a/lib/options.nix b/lib/options.nix
index c80256c0e653..b13687576e81 100644
--- a/lib/options.nix
+++ b/lib/options.nix
@@ -218,7 +218,7 @@ rec {
   # the set generated with filterOptionSets.
   optionAttrSetToDocList = optionAttrSetToDocList' [];
 
-  optionAttrSetToDocList' = prefix: options:
+  optionAttrSetToDocList' = _: options:
     concatMap (opt:
       let
         docOption = rec {
@@ -234,9 +234,8 @@ rec {
           readOnly = opt.readOnly or false;
           type = opt.type.description or "unspecified";
         }
-        // optionalAttrs (opt ? example) { example = scrubOptionValue opt.example; }
-        // optionalAttrs (opt ? default) { default = scrubOptionValue opt.default; }
-        // optionalAttrs (opt ? defaultText) { default = opt.defaultText; }
+        // optionalAttrs (opt ? example) { example = renderOptionValue opt.example; }
+        // optionalAttrs (opt ? default) { default = renderOptionValue (opt.defaultText or opt.default); }
         // optionalAttrs (opt ? relatedPackages && opt.relatedPackages != null) { inherit (opt) relatedPackages; };
 
         subOptions =
@@ -256,6 +255,9 @@ rec {
      efficient: the XML representation of derivations is very large
      (on the order of megabytes) and is not actually used by the
      manual generator.
+
+     This function was made obsolete by renderOptionValue and is kept for
+     compatibility with out-of-tree code.
   */
   scrubOptionValue = x:
     if isDerivation x then
@@ -265,6 +267,17 @@ rec {
     else x;
 
 
+  /* Ensures that the given option value (default or example) is a `_type`d string
+     by rendering Nix values to `literalExpression`s.
+  */
+  renderOptionValue = v:
+    if v ? _type && v ? text then v
+    else literalExpression (lib.generators.toPretty {
+      multiline = true;
+      allowPrettyValues = true;
+    } v);
+
+
   /* For use in the `defaultText` and `example` option attributes. Causes the
      given string to be rendered verbatim in the documentation as Nix code. This
      is necessary for complex values, e.g. functions, or values that depend on
diff --git a/lib/strings.nix b/lib/strings.nix
index b5f5a4d9060b..9a4f29380d0d 100644
--- a/lib/strings.nix
+++ b/lib/strings.nix
@@ -510,7 +510,7 @@ rec {
   toUpper = replaceChars lowerChars upperChars;
 
   /* Appends string context from another string.  This is an implementation
-     detail of Nix.
+     detail of Nix and should be used carefully.
 
      Strings in Nix carry an invisible `context` which is a list of strings
      representing store paths.  If the string is later used in a derivation
@@ -533,13 +533,11 @@ rec {
        splitString "/" "/usr/local/bin"
        => [ "" "usr" "local" "bin" ]
   */
-  splitString = _sep: _s:
+  splitString = sep: s:
     let
-      sep = builtins.unsafeDiscardStringContext _sep;
-      s = builtins.unsafeDiscardStringContext _s;
-      splits = builtins.filter builtins.isString (builtins.split (escapeRegex sep) s);
+      splits = builtins.filter builtins.isString (builtins.split (escapeRegex (toString sep)) (toString s));
     in
-      map (v: addContextFrom _sep (addContextFrom _s v)) splits;
+      map (addContextFrom s) splits;
 
   /* Return a string without the specified prefix, if the prefix matches.
 
@@ -661,6 +659,61 @@ rec {
       name = head (splitString sep filename);
     in assert name != filename; name;
 
+  /* Create a -D<feature>=<value> string that can be passed to typical Meson
+     invocations.
+
+    Type: mesonOption :: string -> string -> string
+
+     @param feature The feature to be set
+     @param value The desired value
+
+     Example:
+       mesonOption "engine" "opengl"
+       => "-Dengine=opengl"
+  */
+  mesonOption = feature: value:
+    assert (lib.isString feature);
+    assert (lib.isString value);
+    "-D${feature}=${value}";
+
+  /* Create a -D<condition>={true,false} string that can be passed to typical
+     Meson invocations.
+
+    Type: mesonBool :: string -> bool -> string
+
+     @param condition The condition to be made true or false
+     @param flag The controlling flag of the condition
+
+     Example:
+       mesonBool "hardened" true
+       => "-Dhardened=true"
+       mesonBool "static" false
+       => "-Dstatic=false"
+  */
+  mesonBool = condition: flag:
+    assert (lib.isString condition);
+    assert (lib.isBool flag);
+    mesonOption condition (lib.boolToString flag);
+
+  /* Create a -D<feature>={enabled,disabled} string that can be passed to
+     typical Meson invocations.
+
+    Type: mesonEnable :: string -> bool -> string
+
+     @param feature The feature to be enabled or disabled
+     @param flag The controlling flag
+
+     Example:
+       mesonEnable "docs" true
+       => "-Ddocs=enabled"
+       mesonEnable "savage" false
+       => "-Dsavage=disabled"
+  */
+  mesonEnable = feature: flag:
+    assert (lib.isString feature);
+    assert (lib.isBool flag);
+    mesonOption feature (if flag then "enabled" else "disabled");
+
   /* Create an --{enable,disable}-<feat> string that can be passed to
      standard GNU Autoconf scripts.
 
diff --git a/lib/tests/misc.nix b/lib/tests/misc.nix
index b73da4f1010d..648c05ab3572 100644
--- a/lib/tests/misc.nix
+++ b/lib/tests/misc.nix
@@ -727,7 +727,7 @@ runTests {
       float = 0.1337;
       bool = true;
       emptystring = "";
-      string = ''fno"rd'';
+      string = "fn\${o}\"r\\d";
       newlinestring = "\n";
       path = /. + "/foo";
       null_ = null;
@@ -735,16 +735,16 @@ runTests {
       functionArgs = { arg ? 4, foo }: arg;
       list = [ 3 4 function [ false ] ];
       emptylist = [];
-      attrs = { foo = null; "foo bar" = "baz"; };
+      attrs = { foo = null; "foo b/ar" = "baz"; };
       emptyattrs = {};
       drv = deriv;
     };
     expected = rec {
       int = "42";
-      float = "~0.133700";
+      float = "0.1337";
       bool = "true";
       emptystring = ''""'';
-      string = ''"fno\"rd"'';
+      string = ''"fn\''${o}\"r\\d"'';
       newlinestring = "\"\\n\"";
       path = "/foo";
       null_ = "null";
@@ -752,9 +752,9 @@ runTests {
       functionArgs = "<function, args: {arg?, foo}>";
       list = "[ 3 4 ${function} [ false ] ]";
       emptylist = "[ ]";
-      attrs = "{ foo = null; \"foo bar\" = \"baz\"; }";
+      attrs = "{ foo = null; \"foo b/ar\" = \"baz\"; }";
       emptyattrs = "{ }";
-      drv = "<derivation ${deriv.drvPath}>";
+      drv = "<derivation ${deriv.name}>";
     };
   };
 
@@ -799,8 +799,8 @@ runTests {
       newlinestring = "\n";
       multilinestring = ''
         hello
-        there
-        test
+        ''${there}
+        te'''st
       '';
       multilinestring' = ''
         hello
@@ -827,8 +827,8 @@ runTests {
       multilinestring = ''
         '''
           hello
-          there
-          test
+          '''''${there}
+          te''''st
         ''''';
       multilinestring' = ''
         '''
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index a66d32294f77..21e53a2ecc94 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -14127,6 +14127,12 @@
     githubId = 8794235;
     name = "Tom Siewert";
   };
+  tonyshkurenko = {
+    email = "support@twingate.com";
+    github = "tonyshkurenko";
+    githubId = 8597964;
+    name = "Anton Shkurenko";
+  };
   toonn = {
     email = "nixpkgs@toonn.io";
     matrix = "@toonn:matrix.org";
diff --git a/maintainers/scripts/update-luarocks-shell.nix b/maintainers/scripts/update-luarocks-shell.nix
index a58674fca8d3..346b0319b08c 100644
--- a/maintainers/scripts/update-luarocks-shell.nix
+++ b/maintainers/scripts/update-luarocks-shell.nix
@@ -2,7 +2,7 @@
 }:
 with nixpkgs;
 let
-  pyEnv = python3.withPackages(ps: [ ps.GitPython ]);
+  pyEnv = python3.withPackages(ps: [ ps.gitpython ]);
 in
 mkShell {
   packages = [
diff --git a/maintainers/team-list.nix b/maintainers/team-list.nix
index c75f9aa71773..5e5a61875dbf 100644
--- a/maintainers/team-list.nix
+++ b/maintainers/team-list.nix
@@ -506,6 +506,18 @@ with lib.maintainers; {
     enableFeatureFreezePing = true;
   };
 
+  node = {
+    members = [
+      lilyinstarlight
+      marsam
+      winter
+      yuka
+    ];
+    scope = "Maintain Node.js runtimes and build tooling.";
+    shortName = "Node.js";
+    enableFeatureFreezePing = true;
+  };
+
   numtide = {
     members = [
       mic92
diff --git a/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml b/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml
index 688f0f47676c..9b6e755fd470 100644
--- a/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml
@@ -561,6 +561,14 @@
           <link xlink:href="options.html#opt-services.prometheus.exporters.smartctl.enable">services.prometheus.exporters.smartctl</link>.
         </para>
       </listitem>
+      <listitem>
+        <para>
+          <link xlink:href="https://docs.twingate.com/docs/linux">twingate</link>,
+          a high performance, easy to use zero trust solution that
+          enables access to private resources from any device with
+          better security than a VPN.
+        </para>
+      </listitem>
     </itemizedlist>
   </section>
   <section xml:id="sec-release-21.11-incompatibilities">
diff --git a/nixos/doc/manual/from_md/release-notes/rl-2305.section.xml b/nixos/doc/manual/from_md/release-notes/rl-2305.section.xml
index 914be23576e0..cc330e2f8870 100644
--- a/nixos/doc/manual/from_md/release-notes/rl-2305.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2305.section.xml
@@ -22,7 +22,14 @@
   </section>
   <section xml:id="sec-release-23.05-new-services">
     <title>New Services</title>
-    <itemizedlist spacing="compact">
+    <itemizedlist>
+      <listitem>
+        <para>
+          <link xlink:href="https://github.com/akinomyoga/ble.sh">blesh</link>,
+          a line editor written in pure bash. Available as
+          <link linkend="opt-programs.bash.blesh.enable">programs.bash.blesh</link>.
+        </para>
+      </listitem>
       <listitem>
         <para>
           <link xlink:href="https://github.com/junegunn/fzf">fzf</link>,
@@ -170,6 +177,15 @@
       </listitem>
       <listitem>
         <para>
+          The <literal>dnsmasq</literal> service now takes configuration
+          via the <literal>services.dnsmasq.settings</literal> attribute
+          set. The option
+          <literal>services.dnsmasq.extraConfig</literal> will be
+          deprecated when NixOS 22.11 reaches end of life.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
           A new <literal>virtualisation.rosetta</literal> module was
           added to allow running <literal>x86_64</literal> binaries
           through
diff --git a/nixos/doc/manual/release-notes/rl-2111.section.md b/nixos/doc/manual/release-notes/rl-2111.section.md
index 1ff2e826c601..fc4b44957c36 100644
--- a/nixos/doc/manual/release-notes/rl-2111.section.md
+++ b/nixos/doc/manual/release-notes/rl-2111.section.md
@@ -164,6 +164,8 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - [smartctl_exporter](https://github.com/prometheus-community/smartctl_exporter), a Prometheus exporter for [S.M.A.R.T.](https://en.wikipedia.org/wiki/S.M.A.R.T.) data. Available as [services.prometheus.exporters.smartctl](options.html#opt-services.prometheus.exporters.smartctl.enable).
 
+- [twingate](https://docs.twingate.com/docs/linux), a high performance, easy to use zero trust solution that enables access to private resources from any device with better security than a VPN.
+
 ## Backward Incompatibilities {#sec-release-21.11-incompatibilities}
 
 - The NixOS VM test framework, `pkgs.nixosTest`/`make-test-python.nix` (`pkgs.testers.nixosTest` since 22.05), now requires detaching commands such as `succeed("foo &")` and `succeed("foo | xclip -i")` to close stdout.
diff --git a/nixos/doc/manual/release-notes/rl-2305.section.md b/nixos/doc/manual/release-notes/rl-2305.section.md
index 3640cf8e963e..886db43c68eb 100644
--- a/nixos/doc/manual/release-notes/rl-2305.section.md
+++ b/nixos/doc/manual/release-notes/rl-2305.section.md
@@ -14,6 +14,8 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
 
+- [blesh](https://github.com/akinomyoga/ble.sh), a line editor written in pure bash. Available as [programs.bash.blesh](#opt-programs.bash.blesh.enable).
+
 - [fzf](https://github.com/junegunn/fzf), a command line fuzzyfinder. Available as [programs.fzf](#opt-programs.fzf.fuzzyCompletion).
 
 ## Backward Incompatibilities {#sec-release-23.05-incompatibilities}
@@ -51,6 +53,11 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - `services.mastodon` gained a tootctl wrapped named `mastodon-tootctl` similar to `nextcloud-occ` which can be executed from any user and switches to the configured mastodon user with sudo and sources the environment variables.
 
+- The `dnsmasq` service now takes configuration via the
+  `services.dnsmasq.settings` attribute set. The option
+  `services.dnsmasq.extraConfig` will be deprecated when NixOS 22.11 reaches
+  end of life.
+
 - A new `virtualisation.rosetta` module was added to allow running `x86_64` binaries through [Rosetta](https://developer.apple.com/documentation/apple-silicon/about-the-rosetta-translation-environment) inside virtualised NixOS guests on Apple silicon. This feature works by default with the [UTM](https://docs.getutm.app/) virtualisation [package](https://search.nixos.org/packages?channel=unstable&show=utm&from=0&size=1&sort=relevance&type=packages&query=utm).
 
 - Resilio sync secret keys can now be provided using a secrets file at runtime, preventing these secrets from ending up in the Nix store.
diff --git a/nixos/lib/make-options-doc/default.nix b/nixos/lib/make-options-doc/default.nix
index e097aa5eebd8..dea3eec5bd6d 100644
--- a/nixos/lib/make-options-doc/default.nix
+++ b/nixos/lib/make-options-doc/default.nix
@@ -26,7 +26,7 @@
   # If you include more than one option list into a document, you need to
   # provide different ids.
 , variablelistId ? "configuration-variable-list"
-  # Strig to prefix to the option XML/HTML id attributes.
+  # String to prefix to the option XML/HTML id attributes.
 , optionIdPrefix ? "opt-"
 , revision ? "" # Specify revision for the options
 # a set of options the docs we are generating will be merged into, as if by recursiveUpdate.
@@ -45,28 +45,11 @@
 }:
 
 let
-  # Make a value safe for JSON. Functions are replaced by the string "<function>",
-  # derivations are replaced with an attrset
-  # { _type = "derivation"; name = <name of that derivation>; }.
-  # We need to handle derivations specially because consumers want to know about them,
-  # but we can't easily use the type,name subset of keys (since type is often used as
-  # a module option and might cause confusion). Use _type,name instead to the same
-  # effect, since _type is already used by the module system.
-  substSpecial = x:
-    if lib.isDerivation x then { _type = "derivation"; name = x.name; }
-    else if builtins.isAttrs x then lib.mapAttrs (name: substSpecial) x
-    else if builtins.isList x then map substSpecial x
-    else if lib.isFunction x then "<function>"
-    else x;
-
   rawOpts = lib.optionAttrSetToDocList options;
   transformedOpts = map transformOptions rawOpts;
   filteredOpts = lib.filter (opt: opt.visible && !opt.internal) transformedOpts;
   optionsList = lib.flip map filteredOpts
    (opt: opt
-    // lib.optionalAttrs (opt ? example) { example = substSpecial opt.example; }
-    // lib.optionalAttrs (opt ? default) { default = substSpecial opt.default; }
-    // lib.optionalAttrs (opt ? type) { type = substSpecial opt.type; }
     // lib.optionalAttrs (opt ? relatedPackages && opt.relatedPackages != []) { relatedPackages = genRelatedPackages opt.relatedPackages opt.name; }
    );
 
@@ -111,14 +94,16 @@ in rec {
   inherit optionsNix;
 
   optionsAsciiDoc = pkgs.runCommand "options.adoc" {} ''
-    ${pkgs.python3Minimal}/bin/python ${./generateAsciiDoc.py} \
-      < ${optionsJSON}/share/doc/nixos/options.json \
+    ${pkgs.python3Minimal}/bin/python ${./generateDoc.py} \
+      --format asciidoc \
+      ${optionsJSON}/share/doc/nixos/options.json \
       > $out
   '';
 
   optionsCommonMark = pkgs.runCommand "options.md" {} ''
-    ${pkgs.python3Minimal}/bin/python ${./generateCommonMark.py} \
-      < ${optionsJSON}/share/doc/nixos/options.json \
+    ${pkgs.python3Minimal}/bin/python ${./generateDoc.py} \
+      --format commonmark \
+      ${optionsJSON}/share/doc/nixos/options.json \
       > $out
   '';
 
diff --git a/nixos/lib/make-options-doc/generateAsciiDoc.py b/nixos/lib/make-options-doc/generateAsciiDoc.py
deleted file mode 100644
index 48eadd248c5a..000000000000
--- a/nixos/lib/make-options-doc/generateAsciiDoc.py
+++ /dev/null
@@ -1,37 +0,0 @@
-import json
-import sys
-
-options = json.load(sys.stdin)
-# TODO: declarations: link to github
-for (name, value) in options.items():
-    print(f'== {name}')
-    print()
-    print(value['description'])
-    print()
-    print('[discrete]')
-    print('=== details')
-    print()
-    print(f'Type:: {value["type"]}')
-    if 'default' in value:
-        print('Default::')
-        print('+')
-        print('----')
-        print(json.dumps(value['default'], ensure_ascii=False, separators=(',', ':')))
-        print('----')
-        print()
-    else:
-        print('No Default:: {blank}')
-    if value['readOnly']:
-        print('Read Only:: {blank}')
-    else:
-        print()
-    if 'example' in value:
-        print('Example::')
-        print('+')
-        print('----')
-        print(json.dumps(value['example'], ensure_ascii=False, separators=(',', ':')))
-        print('----')
-        print()
-    else:
-        print('No Example:: {blank}')
-    print()
diff --git a/nixos/lib/make-options-doc/generateCommonMark.py b/nixos/lib/make-options-doc/generateCommonMark.py
deleted file mode 100644
index bf487bd89c3f..000000000000
--- a/nixos/lib/make-options-doc/generateCommonMark.py
+++ /dev/null
@@ -1,27 +0,0 @@
-import json
-import sys
-
-options = json.load(sys.stdin)
-for (name, value) in options.items():
-    print('##', name.replace('<', '&lt;').replace('>', '&gt;'))
-    print(value['description'])
-    print()
-    if 'type' in value:
-        print('*_Type_*:')
-        print(value['type'])
-        print()
-    print()
-    if 'default' in value:
-        print('*_Default_*')
-        print('```')
-        print(json.dumps(value['default'], ensure_ascii=False, separators=(',', ':')))
-        print('```')
-    print()
-    print()
-    if 'example' in value:
-        print('*_Example_*')
-        print('```')
-        print(json.dumps(value['example'], ensure_ascii=False, separators=(',', ':')))
-        print('```')
-    print()
-    print()
diff --git a/nixos/lib/make-options-doc/generateDoc.py b/nixos/lib/make-options-doc/generateDoc.py
new file mode 100644
index 000000000000..1fe4eb0253ad
--- /dev/null
+++ b/nixos/lib/make-options-doc/generateDoc.py
@@ -0,0 +1,108 @@
+import argparse
+import json
+import sys
+
+formats = ['commonmark', 'asciidoc']
+
+parser = argparse.ArgumentParser(
+    description = 'Generate documentation for a set of JSON-formatted NixOS options'
+)
+parser.add_argument(
+    'nix_options_path',
+    help = 'a path to a JSON file containing the NixOS options'
+)
+parser.add_argument(
+    '-f',
+    '--format',
+    choices = formats,
+    required = True,
+    help = f'the documentation format to generate'
+)
+
+args = parser.parse_args()
+
+# Pretty-print certain Nix types, like literal expressions.
+def render_types(obj):
+    if '_type' not in obj: return obj
+
+    _type = obj['_type']
+    if _type == 'literalExpression' or _type == 'literalDocBook':
+        return obj['text']
+
+    if _type == 'derivation':
+        return obj['name']
+
+    raise Exception(f'Unexpected type `{_type}` in {json.dumps(obj)}')
+
+def generate_commonmark(options):
+    for (name, value) in options.items():
+        print('##', name.replace('<', '&lt;').replace('>', '&gt;'))
+        print(value['description'])
+        print()
+        if 'type' in value:
+            print('*_Type_*')
+            print ('```')
+            print(value['type'])
+            print ('```')
+        print()
+        print()
+        if 'default' in value:
+            print('*_Default_*')
+            print('```')
+            print(json.dumps(value['default'], ensure_ascii=False, separators=(',', ':')))
+            print('```')
+        print()
+        print()
+        if 'example' in value:
+            print('*_Example_*')
+            print('```')
+            print(json.dumps(value['example'], ensure_ascii=False, separators=(',', ':')))
+            print('```')
+        print()
+        print()
+
+# TODO: declarations: link to github
+def generate_asciidoc(options):
+    for (name, value) in options.items():
+        print(f'== {name}')
+        print()
+        print(value['description'])
+        print()
+        print('[discrete]')
+        print('=== details')
+        print()
+        print(f'Type:: {value["type"]}')
+        if 'default' in value:
+            print('Default::')
+            print('+')
+            print('----')
+            print(json.dumps(value['default'], ensure_ascii=False, separators=(',', ':')))
+            print('----')
+            print()
+        else:
+            print('No Default:: {blank}')
+        if value['readOnly']:
+            print('Read Only:: {blank}')
+        else:
+            print()
+        if 'example' in value:
+            print('Example::')
+            print('+')
+            print('----')
+            print(json.dumps(value['example'], ensure_ascii=False, separators=(',', ':')))
+            print('----')
+            print()
+        else:
+            print('No Example:: {blank}')
+        print()
+
+with open(args.nix_options_path) as nix_options_json:
+    options = json.load(nix_options_json, object_hook=render_types)
+
+    if args.format == 'commonmark':
+        generate_commonmark(options)
+    elif args.format == 'asciidoc':
+        generate_asciidoc(options)
+    else:
+        raise Exception(f'Unsupported documentation format `--format {args.format}`')
+
diff --git a/nixos/lib/make-options-doc/options-to-docbook.xsl b/nixos/lib/make-options-doc/options-to-docbook.xsl
index 0fe14a6d2d16..ac49659c681f 100644
--- a/nixos/lib/make-options-doc/options-to-docbook.xsl
+++ b/nixos/lib/make-options-doc/options-to-docbook.xsl
@@ -138,82 +138,6 @@
   </xsl:template>
 
 
-  <xsl:template match="string[contains(@value, '&#010;')]" mode="top">
-    <programlisting>
-      <xsl:text>''&#010;</xsl:text>
-      <xsl:value-of select='str:replace(str:replace(@value, "&apos;&apos;", "&apos;&apos;&apos;"), "${", "&apos;&apos;${")' />
-      <xsl:text>''</xsl:text>
-    </programlisting>
-  </xsl:template>
-
-
-  <xsl:template match="*" mode="top">
-    <literal><xsl:apply-templates select="." /></literal>
-  </xsl:template>
-
-
-  <xsl:template match="null">
-    <xsl:text>null</xsl:text>
-  </xsl:template>
-
-
-  <xsl:template match="string">
-    <xsl:choose>
-      <xsl:when test="(contains(@value, '&quot;') or contains(@value, '\')) and not(contains(@value, '&#010;'))">
-        <xsl:text>''</xsl:text><xsl:value-of select='str:replace(str:replace(@value, "&apos;&apos;", "&apos;&apos;&apos;"), "${", "&apos;&apos;${")' /><xsl:text>''</xsl:text>
-      </xsl:when>
-      <xsl:otherwise>
-        <xsl:text>"</xsl:text><xsl:value-of select="str:replace(str:replace(str:replace(str:replace(@value, '\', '\\'), '&quot;', '\&quot;'), '&#010;', '\n'), '${', '\${')" /><xsl:text>"</xsl:text>
-      </xsl:otherwise>
-    </xsl:choose>
-  </xsl:template>
-
-
-  <xsl:template match="int">
-    <xsl:value-of select="@value" />
-  </xsl:template>
-
-
-  <xsl:template match="bool[@value = 'true']">
-    <xsl:text>true</xsl:text>
-  </xsl:template>
-
-
-  <xsl:template match="bool[@value = 'false']">
-    <xsl:text>false</xsl:text>
-  </xsl:template>
-
-
-  <xsl:template match="list">
-    [
-    <xsl:for-each select="*">
-      <xsl:apply-templates select="." />
-      <xsl:text> </xsl:text>
-    </xsl:for-each>
-    ]
-  </xsl:template>
-
-
-  <xsl:template match="attrs[attr[@name = '_type' and string[@value = 'literalExpression']]]">
-    <xsl:value-of select="attr[@name = 'text']/string/@value" />
-  </xsl:template>
-
-
-  <xsl:template match="attrs">
-    {
-    <xsl:for-each select="attr">
-      <xsl:value-of select="@name" />
-      <xsl:text> = </xsl:text>
-      <xsl:apply-templates select="*" /><xsl:text>; </xsl:text>
-    </xsl:for-each>
-    }
-  </xsl:template>
-
-
-  <xsl:template match="attrs[attr[@name = '_type' and string[@value = 'derivation']]]">
-    <replaceable>(build of <xsl:value-of select="attr[@name = 'name']/string/@value" />)</replaceable>
-  </xsl:template>
-
   <xsl:template match="attr[@name = 'declarations' or @name = 'definitions']">
     <simplelist>
       <!--
@@ -275,10 +199,4 @@
     </simplelist>
   </xsl:template>
 
-
-  <xsl:template match="function">
-    <xsl:text>λ</xsl:text>
-  </xsl:template>
-
-
 </xsl:stylesheet>
diff --git a/nixos/modules/config/krb5/default.nix b/nixos/modules/config/krb5/default.nix
index e3e0fadf0963..df7a3f48236f 100644
--- a/nixos/modules/config/krb5/default.nix
+++ b/nixos/modules/config/krb5/default.nix
@@ -82,8 +82,8 @@ in {
 
       kerberos = mkOption {
         type = types.package;
-        default = pkgs.krb5Full;
-        defaultText = literalExpression "pkgs.krb5Full";
+        default = pkgs.krb5;
+        defaultText = literalExpression "pkgs.krb5";
         example = literalExpression "pkgs.heimdal";
         description = lib.mdDoc ''
           The Kerberos implementation that will be present in
diff --git a/nixos/modules/config/no-x-libs.nix b/nixos/modules/config/no-x-libs.nix
index eeb61289c44b..3efadea82355 100644
--- a/nixos/modules/config/no-x-libs.nix
+++ b/nixos/modules/config/no-x-libs.nix
@@ -43,6 +43,7 @@ with lib;
       networkmanager-openvpn = super.networkmanager-openvpn.override { withGnome = false; };
       networkmanager-sstp = super.networkmanager-vpnc.override { withGnome = false; };
       networkmanager-vpnc = super.networkmanager-vpnc.override { withGnome = false; };
+      pinentry = super.pinentry.override { enabledFlavors = [ "curses" "tty" "emacs" ]; withLibsecret = false; };
       qemu = super.qemu.override { gtkSupport = false; spiceSupport = false; sdlSupport = false; };
       qrencode = super.qrencode.overrideAttrs (_: { doCheck = false; });
       zbar = super.zbar.override { enableVideo = false; withXorg = false; };
diff --git a/nixos/modules/installer/tools/nix-fallback-paths.nix b/nixos/modules/installer/tools/nix-fallback-paths.nix
index 675674cf5b4b..3eca901bdbf7 100644
--- a/nixos/modules/installer/tools/nix-fallback-paths.nix
+++ b/nixos/modules/installer/tools/nix-fallback-paths.nix
@@ -1,7 +1,7 @@
 {
-  x86_64-linux = "/nix/store/xdlpraypxdimjyfrr4k06narrv8nmfgh-nix-2.11.1";
-  i686-linux = "/nix/store/acghbpn3aaj2q64mz3ljipsgf9d9qxlp-nix-2.11.1";
-  aarch64-linux = "/nix/store/0lrf6danhdqjsrhala134ak8vn0b9ghj-nix-2.11.1";
-  x86_64-darwin = "/nix/store/60sx4c6xflgqk11gvijwzlsczbxgxgwh-nix-2.11.1";
-  aarch64-darwin = "/nix/store/dmk5m3nlqp1awaqrp1f06qhhkh3l102n-nix-2.11.1";
+  x86_64-linux = "/nix/store/h88w1442c7hzkbw8sgpcsbqp4lhz6l5p-nix-2.12.0";
+  i686-linux = "/nix/store/j23527l1c3hfx17nssc0v53sq6c741zs-nix-2.12.0";
+  aarch64-linux = "/nix/store/zgzmdymyh934y3r4vqh8z337ba4cwsjb-nix-2.12.0";
+  x86_64-darwin = "/nix/store/wnlrzllazdyg1nrw9na497p4w0m7i7mm-nix-2.12.0";
+  aarch64-darwin = "/nix/store/7n5yamgzg5dpp5vb6ipdqgfh6cf30wmn-nix-2.12.0";
 }
diff --git a/nixos/modules/misc/documentation.nix b/nixos/modules/misc/documentation.nix
index aa6e40f43705..64a8f7846b46 100644
--- a/nixos/modules/misc/documentation.nix
+++ b/nixos/modules/misc/documentation.nix
@@ -48,10 +48,15 @@ let
         };
         scrubDerivations = namePrefix: pkgSet: mapAttrs
           (name: value:
-            let wholeName = "${namePrefix}.${name}"; in
-            if isAttrs value then
+            let
+              wholeName = "${namePrefix}.${name}";
+              guard = lib.warn "Attempt to evaluate package ${wholeName} in option documentation; this is not supported and will eventually be an error. Use `mkPackageOption` or `literalExpression` instead.";
+            in if isAttrs value then
               scrubDerivations wholeName value
-              // (optionalAttrs (isDerivation value) { outPath = "\${${wholeName}}"; })
+              // optionalAttrs (isDerivation value) {
+                outPath = guard "\${${wholeName}}";
+                drvPath = guard drvPath;
+              }
             else value
           )
           pkgSet;
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 9faa58409b19..24dd30e15750 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -135,6 +135,7 @@
   ./programs/bandwhich.nix
   ./programs/bash/bash.nix
   ./programs/bash/bash-completion.nix
+  ./programs/bash/blesh.nix
   ./programs/bash/ls-colors.nix
   ./programs/bash/undistract-me.nix
   ./programs/bash-my-aws.nix
@@ -988,6 +989,7 @@
   ./services/networking/tox-node.nix
   ./services/networking/toxvpn.nix
   ./services/networking/tvheadend.nix
+  ./services/networking/twingate.nix
   ./services/networking/ucarp.nix
   ./services/networking/unbound.nix
   ./services/networking/unifi.nix
@@ -1015,6 +1017,7 @@
   ./services/networking/zerotierone.nix
   ./services/networking/znc/default.nix
   ./services/printing/cupsd.nix
+  ./services/printing/ipp-usb.nix
   ./services/scheduling/atd.nix
   ./services/scheduling/cron.nix
   ./services/scheduling/fcron.nix
@@ -1139,6 +1142,7 @@
   ./services/web-apps/onlyoffice.nix
   ./services/web-apps/pict-rs.nix
   ./services/web-apps/peertube.nix
+  ./services/web-apps/peering-manager.nix
   ./services/web-apps/plantuml-server.nix
   ./services/web-apps/plausible.nix
   ./services/web-apps/pgpkeyserver-lite.nix
diff --git a/nixos/modules/programs/bash/blesh.nix b/nixos/modules/programs/bash/blesh.nix
new file mode 100644
index 000000000000..8fa51bef7744
--- /dev/null
+++ b/nixos/modules/programs/bash/blesh.nix
@@ -0,0 +1,16 @@
+{ lib, config, pkgs, ... }:
+with lib;
+let
+  cfg = config.programs.bash.blesh;
+in {
+  options = {
+    programs.bash.blesh.enable = mkEnableOption (mdDoc "blesh");
+  };
+
+  config = mkIf cfg.enable {
+    programs.bash.interactiveShellInit = mkBefore ''
+      source ${pkgs.blesh}/share/blesh/ble.sh
+    '';
+  };
+  meta.maintainers = with maintainers; [ laalsaas ];
+}
diff --git a/nixos/modules/programs/htop.nix b/nixos/modules/programs/htop.nix
index 521287f9352d..2682ced490ca 100644
--- a/nixos/modules/programs/htop.nix
+++ b/nixos/modules/programs/htop.nix
@@ -20,7 +20,7 @@ in
     package = mkOption {
       type = types.package;
       default = pkgs.htop;
-      defaultText = "pkgs.htop";
+      defaultText = lib.literalExpression "pkgs.htop";
       description = lib.mdDoc ''
         The htop package that should be used.
       '';
diff --git a/nixos/modules/programs/weylus.nix b/nixos/modules/programs/weylus.nix
index eab8afdf2cc8..a5775f3b981c 100644
--- a/nixos/modules/programs/weylus.nix
+++ b/nixos/modules/programs/weylus.nix
@@ -29,7 +29,7 @@ in
     package = mkOption {
       type = package;
       default = pkgs.weylus;
-      defaultText = "pkgs.weylus";
+      defaultText = lib.literalExpression "pkgs.weylus";
       description = lib.mdDoc "Weylus package to install.";
     };
   };
diff --git a/nixos/modules/services/audio/icecast.nix b/nixos/modules/services/audio/icecast.nix
index 759f1ab0db9b..f71a13b9626d 100644
--- a/nixos/modules/services/audio/icecast.nix
+++ b/nixos/modules/services/audio/icecast.nix
@@ -74,7 +74,7 @@ in {
 
       listen = {
         port = mkOption {
-          type = types.int;
+          type = types.port;
           description = lib.mdDoc "TCP port that will be used to accept client connections.";
           default = 8000;
         };
diff --git a/nixos/modules/services/audio/liquidsoap.nix b/nixos/modules/services/audio/liquidsoap.nix
index c313104c4609..5c10d13af5fd 100644
--- a/nixos/modules/services/audio/liquidsoap.nix
+++ b/nixos/modules/services/audio/liquidsoap.nix
@@ -38,11 +38,13 @@ in
 
       default = {};
 
-      example = {
-        myStream1 = "/etc/liquidsoap/myStream1.liq";
-        myStream2 = literalExpression "./myStream2.liq";
-        myStream3 = "out(playlist(\"/srv/music/\"))";
-      };
+      example = literalExpression ''
+        {
+          myStream1 = "/etc/liquidsoap/myStream1.liq";
+          myStream2 = ./myStream2.liq;
+          myStream3 = "out(playlist(\"/srv/music/\"))";
+        }
+      '';
 
       type = types.attrsOf (types.either types.path types.str);
     };
diff --git a/nixos/modules/services/audio/mpd.nix b/nixos/modules/services/audio/mpd.nix
index bbfccec98c4a..ba1e4716c9b9 100644
--- a/nixos/modules/services/audio/mpd.nix
+++ b/nixos/modules/services/audio/mpd.nix
@@ -142,7 +142,7 @@ in {
         };
 
         port = mkOption {
-          type = types.int;
+          type = types.port;
           default = 6600;
           description = lib.mdDoc ''
             This setting is the TCP port that is desired for the daemon to get assigned
diff --git a/nixos/modules/services/backup/borgbackup.xml b/nixos/modules/services/backup/borgbackup.xml
index 8f623c936568..f38064f86775 100644
--- a/nixos/modules/services/backup/borgbackup.xml
+++ b/nixos/modules/services/backup/borgbackup.xml
@@ -179,7 +179,7 @@ sudo borg init --encryption=repokey-blake2  \
           mode = "repokey-blake2";
           passCommand = "cat /run/keys/borgbackup_passphrase";
         };
-        BORG_RSH = "ssh -i /run/keys/id_ed25519_borgbase";
+        environment = { BORG_RSH = "ssh -i /run/keys/id_ed25519_borgbase"; };
         compression = "auto,lzma";
         startAt = "daily";
     };
diff --git a/nixos/modules/services/cluster/kubernetes/kubelet.nix b/nixos/modules/services/cluster/kubernetes/kubelet.nix
index 0898fee9bdb7..3ede1cb80e85 100644
--- a/nixos/modules/services/cluster/kubernetes/kubelet.nix
+++ b/nixos/modules/services/cluster/kubernetes/kubelet.nix
@@ -171,7 +171,7 @@ in
       port = mkOption {
         description = lib.mdDoc "Kubernetes kubelet healthz port.";
         default = 10248;
-        type = int;
+        type = port;
       };
     };
 
@@ -204,7 +204,7 @@ in
     port = mkOption {
       description = lib.mdDoc "Kubernetes kubelet info server listening port.";
       default = 10250;
-      type = int;
+      type = port;
     };
 
     seedDockerImages = mkOption {
diff --git a/nixos/modules/services/cluster/kubernetes/scheduler.nix b/nixos/modules/services/cluster/kubernetes/scheduler.nix
index 2eada43eb4ec..f31a92f36840 100644
--- a/nixos/modules/services/cluster/kubernetes/scheduler.nix
+++ b/nixos/modules/services/cluster/kubernetes/scheduler.nix
@@ -43,7 +43,7 @@ in
     port = mkOption {
       description = lib.mdDoc "Kubernetes scheduler listening port.";
       default = 10251;
-      type = int;
+      type = port;
     };
 
     verbosity = mkOption {
diff --git a/nixos/modules/services/continuous-integration/buildbot/master.nix b/nixos/modules/services/continuous-integration/buildbot/master.nix
index d00e0ba39565..680b21dbf21b 100644
--- a/nixos/modules/services/continuous-integration/buildbot/master.nix
+++ b/nixos/modules/services/continuous-integration/buildbot/master.nix
@@ -206,7 +206,7 @@ in {
 
       port = mkOption {
         default = 8010;
-        type = types.int;
+        type = types.port;
         description = lib.mdDoc "Specifies port number on which the buildbot HTTP interface listens.";
       };
 
diff --git a/nixos/modules/services/databases/cassandra.nix b/nixos/modules/services/databases/cassandra.nix
index 7556dbfc7b84..e26acb88d8c8 100644
--- a/nixos/modules/services/databases/cassandra.nix
+++ b/nixos/modules/services/databases/cassandra.nix
@@ -19,6 +19,10 @@ let
 
   cfg = config.services.cassandra;
 
+  atLeast3 = versionAtLeast cfg.package.version "3";
+  atLeast3_11 = versionAtLeast cfg.package.version "3.11";
+  atLeast4 = versionAtLeast cfg.package.version "4";
+
   defaultUser = "cassandra";
 
   cassandraConfig = flip recursiveUpdate cfg.extraConfig (
@@ -39,7 +43,7 @@ let
           parameters = [{ seeds = concatStringsSep "," cfg.seedAddresses; }];
         }
       ];
-    } // optionalAttrs (versionAtLeast cfg.package.version "3") {
+    } // optionalAttrs atLeast3 {
       hints_directory = "${cfg.homeDir}/hints";
     }
   );
@@ -62,7 +66,7 @@ let
     cassandraLogbackConfig = pkgs.writeText "logback.xml" cfg.logbackConfig;
 
     passAsFile = [ "extraEnvSh" ];
-    inherit (cfg) extraEnvSh;
+    inherit (cfg) extraEnvSh package;
 
     buildCommand = ''
       mkdir -p "$out"
@@ -80,6 +84,10 @@ let
 
       # Delete default password file
       sed -i '/-Dcom.sun.management.jmxremote.password.file=\/etc\/cassandra\/jmxremote.password/d' "$out/cassandra-env.sh"
+
+      ${lib.optionalString atLeast4 ''
+        cp $package/conf/jvm*.options $out/
+      ''}
     '';
   };
 
@@ -95,8 +103,20 @@ let
       "-Dcom.sun.management.jmxremote.password.file=${cfg.jmxRolesFile}"
     ] ++ optionals cfg.remoteJmx [
       "-Djava.rmi.server.hostname=${cfg.rpcAddress}"
+    ] ++ optionals atLeast4 [
+      # Historically, we don't use a log dir, whereas the upstream scripts do
+      # expect this. We override those by providing our own -Xlog:gc flag.
+      "-Xlog:gc=warning,heap*=warning,age*=warning,safepoint=warning,promotion*=warning"
     ];
 
+  commonEnv = {
+    # Sufficient for cassandra 2.x, 3.x
+    CASSANDRA_CONF = "${cassandraEtc}";
+
+    # Required since cassandra 4
+    CASSANDRA_LOGBACK_CONF = "${cassandraEtc}/logback.xml";
+  };
+
 in
 {
   options.services.cassandra = {
@@ -435,7 +455,7 @@ in
     jmxRolesFile = mkOption {
       type = types.nullOr types.path;
       default =
-        if versionAtLeast cfg.package.version "3.11"
+        if atLeast3_11
         then pkgs.writeText "jmx-roles-file" defaultJmxRolesFile
         else null;
       defaultText = literalMD ''generated configuration file if version is at least 3.11, otherwise `null`'';
@@ -486,8 +506,7 @@ in
     systemd.services.cassandra = {
       description = "Apache Cassandra service";
       after = [ "network.target" ];
-      environment = {
-        CASSANDRA_CONF = "${cassandraEtc}";
+      environment = commonEnv // {
         JVM_OPTS = builtins.concatStringsSep " " fullJvmOptions;
         MAX_HEAP_SIZE = toString cfg.maxHeapSize;
         HEAP_NEWSIZE = toString cfg.heapNewSize;
@@ -508,6 +527,7 @@ in
       description = "Perform a full repair on this Cassandra node";
       after = [ "cassandra.service" ];
       requires = [ "cassandra.service" ];
+      environment = commonEnv;
       serviceConfig = {
         User = cfg.user;
         Group = cfg.group;
@@ -536,6 +556,7 @@ in
       description = "Perform an incremental repair on this cassandra node.";
       after = [ "cassandra.service" ];
       requires = [ "cassandra.service" ];
+      environment = commonEnv;
       serviceConfig = {
         User = cfg.user;
         Group = cfg.group;
diff --git a/nixos/modules/services/databases/clickhouse.nix b/nixos/modules/services/databases/clickhouse.nix
index 96607d9a783c..04dd20b5f14d 100644
--- a/nixos/modules/services/databases/clickhouse.nix
+++ b/nixos/modules/services/databases/clickhouse.nix
@@ -16,7 +16,7 @@ with lib;
       package = mkOption {
         type = types.package;
         default = pkgs.clickhouse;
-        defaultText = "pkgs.clickhouse";
+        defaultText = lib.literalExpression "pkgs.clickhouse";
         description = lib.mdDoc ''
           ClickHouse package to use.
         '';
diff --git a/nixos/modules/services/databases/mysql.nix b/nixos/modules/services/databases/mysql.nix
index ec4524e9061d..128bb0862175 100644
--- a/nixos/modules/services/databases/mysql.nix
+++ b/nixos/modules/services/databases/mysql.nix
@@ -160,10 +160,12 @@ in
           List of database names and their initial schemas that should be used to create databases on the first startup
           of MySQL. The schema attribute is optional: If not specified, an empty database is created.
         '';
-        example = [
-          { name = "foodatabase"; schema = literalExpression "./foodatabase.sql"; }
-          { name = "bardatabase"; }
-        ];
+        example = literalExpression ''
+          [
+            { name = "foodatabase"; schema = ./foodatabase.sql; }
+            { name = "bardatabase"; }
+          ]
+        '';
       };
 
       initialScript = mkOption {
diff --git a/nixos/modules/services/databases/openldap.nix b/nixos/modules/services/databases/openldap.nix
index 7a59de372f24..cba3442023cb 100644
--- a/nixos/modules/services/databases/openldap.nix
+++ b/nixos/modules/services/databases/openldap.nix
@@ -16,7 +16,7 @@ let
       # systemd/systemd#19604
       description = ''
         LDAP value - either a string, or an attrset containing
-        <literal>path</literal> or <literal>base64</literal> for included
+        `path` or `base64` for included
         values or base-64 encoded values respectively.
       '';
       check = x: lib.isString x || (lib.isAttrs x && (x ? path || x ? base64));
diff --git a/nixos/modules/services/development/jupyter/default.nix b/nixos/modules/services/development/jupyter/default.nix
index c3ef040ebe65..9f7910844468 100644
--- a/nixos/modules/services/development/jupyter/default.nix
+++ b/nixos/modules/services/development/jupyter/default.nix
@@ -57,7 +57,7 @@ in {
     };
 
     port = mkOption {
-      type = types.int;
+      type = types.port;
       default = 8888;
       description = lib.mdDoc ''
         Port number Jupyter will be listening on.
diff --git a/nixos/modules/services/games/asf.nix b/nixos/modules/services/games/asf.nix
index 10847e8f11f3..d3f7883421ce 100644
--- a/nixos/modules/services/games/asf.nix
+++ b/nixos/modules/services/games/asf.nix
@@ -43,12 +43,14 @@ in
     web-ui = mkOption {
       type = types.submodule {
         options = {
-          enable = mkEnableOption
-            (lib.mdDoc "Wheter to start the web-ui. This is the preferred way of configuring things such as the steam guard token");
+          enable = mkEnableOption "" // {
+            description = lib.mdDoc "Whether to start the web-ui. This is the preferred way of configuring things such as the steam guard token.";
+          };
 
           package = mkOption {
             type = types.package;
             default = pkgs.ArchiSteamFarm.ui;
+            defaultText = lib.literalExpression "pkgs.ArchiSteamFarm.ui";
             description =
               lib.mdDoc "Web-UI package to use. Contents must be in lib/dist.";
           };
@@ -56,7 +58,6 @@ in
       };
       default = {
         enable = true;
-        package = pkgs.ArchiSteamFarm.ui;
       };
       example = {
         enable = false;
@@ -67,6 +68,7 @@ in
     package = mkOption {
       type = types.package;
       default = pkgs.ArchiSteamFarm;
+      defaultText = lib.literalExpression "pkgs.ArchiSteamFarm";
       description =
         lib.mdDoc "Package to use. Should always be the latest version, for security reasons, since this module uses very new features and to not get out of sync with the Steam API.";
     };
diff --git a/nixos/modules/services/games/terraria.nix b/nixos/modules/services/games/terraria.nix
index 571bcde2c5b2..ccdd779165b8 100644
--- a/nixos/modules/services/games/terraria.nix
+++ b/nixos/modules/services/games/terraria.nix
@@ -116,7 +116,7 @@ in
       openFirewall = mkOption {
         type = types.bool;
         default = false;
-        description = lib.mdDoc "Wheter to open ports in the firewall";
+        description = lib.mdDoc "Whether to open ports in the firewall";
       };
 
       dataDir = mkOption {
diff --git a/nixos/modules/services/hardware/argonone.nix b/nixos/modules/services/hardware/argonone.nix
index dc90e09e985b..e67c2625062e 100644
--- a/nixos/modules/services/hardware/argonone.nix
+++ b/nixos/modules/services/hardware/argonone.nix
@@ -9,7 +9,7 @@ in
     package = lib.mkOption {
       type = lib.types.package;
       default = pkgs.argononed;
-      defaultText = "pkgs.argononed";
+      defaultText = lib.literalExpression "pkgs.argononed";
       description = lib.mdDoc ''
         The package implementing the Argon One driver
       '';
diff --git a/nixos/modules/services/hardware/bluetooth.nix b/nixos/modules/services/hardware/bluetooth.nix
index 8b90c1913bc5..6453e6968dcc 100644
--- a/nixos/modules/services/hardware/bluetooth.nix
+++ b/nixos/modules/services/hardware/bluetooth.nix
@@ -50,14 +50,8 @@ in
         type = types.package;
         default = pkgs.bluez;
         defaultText = literalExpression "pkgs.bluez";
-        example = literalExpression "pkgs.bluezFull";
         description = lib.mdDoc ''
           Which BlueZ package to use.
-
-          ::: {.note}
-          Use the `pkgs.bluezFull` package to enable all
-          bluez plugins.
-          :::
         '';
       };
 
diff --git a/nixos/modules/services/hardware/joycond.nix b/nixos/modules/services/hardware/joycond.nix
index f4da00762a43..1af18b3b63d3 100644
--- a/nixos/modules/services/hardware/joycond.nix
+++ b/nixos/modules/services/hardware/joycond.nix
@@ -14,7 +14,7 @@ with lib;
     package = mkOption {
       type = types.package;
       default = pkgs.joycond;
-      defaultText = "pkgs.joycond";
+      defaultText = lib.literalExpression "pkgs.joycond";
       description = lib.mdDoc ''
         The joycond package to use.
       '';
diff --git a/nixos/modules/services/hardware/supergfxd.nix b/nixos/modules/services/hardware/supergfxd.nix
index abb6bedb98ff..5cc07e02f317 100644
--- a/nixos/modules/services/hardware/supergfxd.nix
+++ b/nixos/modules/services/hardware/supergfxd.nix
@@ -2,7 +2,7 @@
 
 let
   cfg = config.services.supergfxd;
-  ini = pkgs.formats.ini { };
+  json = pkgs.formats.json { };
 in
 {
   options = {
@@ -10,7 +10,7 @@ in
       enable = lib.mkEnableOption (lib.mdDoc "Enable the supergfxd service");
 
       settings = lib.mkOption {
-        type = lib.types.nullOr ini.type;
+        type = lib.types.nullOr json.type;
         default = null;
         description = lib.mdDoc ''
           The content of /etc/supergfxd.conf.
@@ -23,7 +23,7 @@ in
   config = lib.mkIf cfg.enable {
     environment.systemPackages = [ pkgs.supergfxctl ];
 
-    environment.etc."supergfxd.conf" = lib.mkIf (cfg.settings != null) (ini.generate "supergfxd.conf" cfg.settings);
+    environment.etc."supergfxd.conf".source = lib.mkIf (cfg.settings != null) (json.generate "supergfxd.conf" cfg.settings);
 
     services.dbus.enable = true;
 
diff --git a/nixos/modules/services/home-automation/home-assistant.nix b/nixos/modules/services/home-automation/home-assistant.nix
index 2962e52c08bb..fa06e5391bbf 100644
--- a/nixos/modules/services/home-automation/home-assistant.nix
+++ b/nixos/modules/services/home-automation/home-assistant.nix
@@ -435,6 +435,7 @@ in {
           "august"
           "august_ble"
           "airthings_ble"
+          "aranet"
           "bluemaestro"
           "bluetooth"
           "bluetooth_le_tracker"
@@ -453,8 +454,11 @@ in {
           "moat"
           "oralb"
           "qingping"
+          "ruuvitag_ble"
+          "sensirion_ble"
           "sensorpro"
           "sensorpush"
+          "shelly"
           "snooz"
           "switchbot"
           "thermobeacon"
diff --git a/nixos/modules/services/matrix/conduit.nix b/nixos/modules/services/matrix/conduit.nix
index 812d463e9e86..c8d89ed33f51 100644
--- a/nixos/modules/services/matrix/conduit.nix
+++ b/nixos/modules/services/matrix/conduit.nix
@@ -23,8 +23,7 @@ in
       package = mkOption {
         type = types.package;
         default = pkgs.matrix-conduit;
-        defaultText = "pkgs.matrix-conduit";
-        example = "pkgs.matrix-conduit";
+        defaultText = lib.literalExpression "pkgs.matrix-conduit";
         description = lib.mdDoc ''
           Package of the conduit matrix server to use.
         '';
diff --git a/nixos/modules/services/matrix/synapse.nix b/nixos/modules/services/matrix/synapse.nix
index 86662055222a..a80d4cabfec0 100644
--- a/nixos/modules/services/matrix/synapse.nix
+++ b/nixos/modules/services/matrix/synapse.nix
@@ -286,6 +286,7 @@ in {
             log_config = mkOption {
               type = types.path;
               default = ./synapse-log_config.yaml;
+              defaultText = lib.literalExpression "nixos/modules/services/matrix/synapse-log_config.yaml";
               description = lib.mdDoc ''
                 The file that holds the logging configuration.
               '';
diff --git a/nixos/modules/services/misc/autorandr.nix b/nixos/modules/services/misc/autorandr.nix
index 365fdd5fcc39..072064143dbd 100644
--- a/nixos/modules/services/misc/autorandr.nix
+++ b/nixos/modules/services/misc/autorandr.nix
@@ -258,7 +258,7 @@ in {
         type = hooksModule;
         description = lib.mdDoc "Global hook scripts";
         default = { };
-        example = ''
+        example = literalExpression ''
           {
             postswitch = {
               "notify-i3" = "''${pkgs.i3}/bin/i3-msg restart";
@@ -279,7 +279,7 @@ in {
                     exit 1
                 esac
                 echo "Xft.dpi: $DPI" | ''${pkgs.xorg.xrdb}/bin/xrdb -merge
-              '''
+              ''';
             };
           }
         '';
diff --git a/nixos/modules/services/misc/gitlab.nix b/nixos/modules/services/misc/gitlab.nix
index e206d5bb7c6d..e7c707228f1b 100644
--- a/nixos/modules/services/misc/gitlab.nix
+++ b/nixos/modules/services/misc/gitlab.nix
@@ -560,7 +560,7 @@ in {
           description = lib.mdDoc "GitLab container registry host name.";
         };
         port = mkOption {
-          type = types.int;
+          type = types.port;
           default = 4567;
           description = lib.mdDoc "GitLab container registry port.";
         };
@@ -613,7 +613,7 @@ in {
         };
 
         port = mkOption {
-          type = types.int;
+          type = types.port;
           default = 25;
           description = lib.mdDoc "Port of the SMTP server for GitLab.";
         };
diff --git a/nixos/modules/services/misc/heisenbridge.nix b/nixos/modules/services/misc/heisenbridge.nix
index 13ba362b33db..d07e0e420462 100644
--- a/nixos/modules/services/misc/heisenbridge.nix
+++ b/nixos/modules/services/misc/heisenbridge.nix
@@ -28,8 +28,7 @@ in
     package = mkOption {
       type = types.package;
       default = pkgs.heisenbridge;
-      defaultText = "pkgs.heisenbridge";
-      example = "pkgs.heisenbridge.override { … = …; }";
+      defaultText = lib.literalExpression "pkgs.heisenbridge";
       description = lib.mdDoc ''
         Package of the application to run, exposed for overriding purposes.
       '';
diff --git a/nixos/modules/services/misc/libreddit.nix b/nixos/modules/services/misc/libreddit.nix
index c961d13da473..fd58928d2821 100644
--- a/nixos/modules/services/misc/libreddit.nix
+++ b/nixos/modules/services/misc/libreddit.nix
@@ -15,6 +15,13 @@ in
     services.libreddit = {
       enable = mkEnableOption (lib.mdDoc "Private front-end for Reddit");
 
+      package = mkOption {
+        type = types.package;
+        default = pkgs.libreddit;
+        defaultText = literalExpression "pkgs.libreddit";
+        description = lib.mdDoc "Libreddit package to use.";
+      };
+
       address = mkOption {
         default = "0.0.0.0";
         example = "127.0.0.1";
@@ -45,7 +52,7 @@ in
         after = [ "network.target" ];
         serviceConfig = {
           DynamicUser = true;
-          ExecStart = "${pkgs.libreddit}/bin/libreddit ${args}";
+          ExecStart = "${cfg.package}/bin/libreddit ${args}";
           AmbientCapabilities = lib.mkIf (cfg.port < 1024) [ "CAP_NET_BIND_SERVICE" ];
           Restart = "on-failure";
           RestartSec = "2s";
diff --git a/nixos/modules/services/misc/portunus.nix b/nixos/modules/services/misc/portunus.nix
index 0b283ea27d82..1dae605e46f2 100644
--- a/nixos/modules/services/misc/portunus.nix
+++ b/nixos/modules/services/misc/portunus.nix
@@ -29,7 +29,7 @@ in
     package = mkOption {
       type = types.package;
       default = pkgs.portunus;
-      defaultText = "pkgs.portunus";
+      defaultText = lib.literalExpression "pkgs.portunus";
       description = lib.mdDoc "The Portunus package to use.";
     };
 
@@ -108,7 +108,7 @@ in
       package = mkOption {
         type = types.package;
         default = pkgs.openldap;
-        defaultText = "pkgs.openldap";
+        defaultText = lib.literalExpression "pkgs.openldap";
         description = lib.mdDoc "The OpenLDAP package to use.";
       };
 
diff --git a/nixos/modules/services/misc/ripple-data-api.nix b/nixos/modules/services/misc/ripple-data-api.nix
index 2663d734980f..30623a321338 100644
--- a/nixos/modules/services/misc/ripple-data-api.nix
+++ b/nixos/modules/services/misc/ripple-data-api.nix
@@ -40,7 +40,7 @@ in {
       port = mkOption {
         description = lib.mdDoc "Ripple data api port";
         default = 5993;
-        type = types.int;
+        type = types.port;
       };
 
       importMode = mkOption {
@@ -77,7 +77,7 @@ in {
         port = mkOption {
           description = lib.mdDoc "Ripple data api redis port.";
           default = 5984;
-          type = types.int;
+          type = types.port;
         };
       };
 
@@ -91,7 +91,7 @@ in {
         port = mkOption {
           description = lib.mdDoc "Ripple data api couchdb port.";
           default = 5984;
-          type = types.int;
+          type = types.port;
         };
 
         db = mkOption {
diff --git a/nixos/modules/services/misc/sourcehut/default.nix b/nixos/modules/services/misc/sourcehut/default.nix
index aaa7bb057546..7dd254e34920 100644
--- a/nixos/modules/services/misc/sourcehut/default.nix
+++ b/nixos/modules/services/misc/sourcehut/default.nix
@@ -505,7 +505,7 @@ in
             description = lib.mdDoc "Origin URL for API, 100 more than web.";
             type = types.str;
             default = "http://${cfg.listenAddress}:${toString (cfg.meta.port + 100)}";
-            defaultText = ''http://<xref linkend="opt-services.sourcehut.listenAddress"/>:''${toString (<xref linkend="opt-services.sourcehut.meta.port"/> + 100)}'';
+            defaultText = lib.literalMD ''`"http://''${`[](#opt-services.sourcehut.listenAddress)`}:''${toString (`[](#opt-services.sourcehut.meta.port)` + 100)}"`'';
           };
           webhooks = mkOption {
             description = lib.mdDoc "The Redis connection used for the webhooks worker.";
diff --git a/nixos/modules/services/monitoring/grafana-agent.nix b/nixos/modules/services/monitoring/grafana-agent.nix
index ecb39a924f58..270d888afb78 100644
--- a/nixos/modules/services/monitoring/grafana-agent.nix
+++ b/nixos/modules/services/monitoring/grafana-agent.nix
@@ -16,7 +16,7 @@ in
     package = mkOption {
       type = types.package;
       default = pkgs.grafana-agent;
-      defaultText = "pkgs.grafana-agent";
+      defaultText = lib.literalExpression "pkgs.grafana-agent";
       description = lib.mdDoc "The grafana-agent package to use.";
     };
 
@@ -49,17 +49,19 @@ in
       };
 
       default = { };
-      defaultText = ''
-        metrics = {
-          wal_directory = "\''${STATE_DIRECTORY}";
-          global.scrape_interval = "5s";
-        };
-        integrations = {
-          agent.enabled = true;
-          agent.scrape_integration = true;
-          node_exporter.enabled = true;
-          replace_instance_label = true;
-        };
+      defaultText = lib.literalExpression ''
+        {
+          metrics = {
+            wal_directory = "\''${STATE_DIRECTORY}";
+            global.scrape_interval = "5s";
+          };
+          integrations = {
+            agent.enabled = true;
+            agent.scrape_integration = true;
+            node_exporter.enabled = true;
+            replace_instance_label = true;
+          };
+        }
       '';
       example = {
         metrics.global.remote_write = [{
diff --git a/nixos/modules/services/monitoring/graphite.nix b/nixos/modules/services/monitoring/graphite.nix
index 017e8a1ba47c..8d92e60d3bad 100644
--- a/nixos/modules/services/monitoring/graphite.nix
+++ b/nixos/modules/services/monitoring/graphite.nix
@@ -225,7 +225,7 @@ in {
       port = mkOption {
         description = lib.mdDoc "Seyren listening port.";
         default = 8081;
-        type = types.int;
+        type = types.port;
       };
 
       seyrenUrl = mkOption {
diff --git a/nixos/modules/services/monitoring/kapacitor.nix b/nixos/modules/services/monitoring/kapacitor.nix
index 61529c2e4526..727b694047b4 100644
--- a/nixos/modules/services/monitoring/kapacitor.nix
+++ b/nixos/modules/services/monitoring/kapacitor.nix
@@ -66,7 +66,7 @@ in
     };
 
     port = mkOption {
-      type = types.int;
+      type = types.port;
       default = 9092;
       description = lib.mdDoc "Port of Kapacitor";
     };
diff --git a/nixos/modules/services/monitoring/prometheus/alertmanager.nix b/nixos/modules/services/monitoring/prometheus/alertmanager.nix
index ee2533ef1213..8706a18a184d 100644
--- a/nixos/modules/services/monitoring/prometheus/alertmanager.nix
+++ b/nixos/modules/services/monitoring/prometheus/alertmanager.nix
@@ -107,7 +107,7 @@ in {
       };
 
       port = mkOption {
-        type = types.int;
+        type = types.port;
         default = 9093;
         description = lib.mdDoc ''
           Port to listen on for the web interface and API.
diff --git a/nixos/modules/services/monitoring/prometheus/exporters/smartctl.nix b/nixos/modules/services/monitoring/prometheus/exporters/smartctl.nix
index df424ede6066..0c5648c14149 100644
--- a/nixos/modules/services/monitoring/prometheus/exporters/smartctl.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters/smartctl.nix
@@ -4,16 +4,12 @@ with lib;
 
 let
   cfg = config.services.prometheus.exporters.smartctl;
-  format = pkgs.formats.yaml {};
-  configFile = format.generate "smartctl-exporter.yml" {
-    smartctl_exporter = {
-      bind_to = "${cfg.listenAddress}:${toString cfg.port}";
-      url_path = "/metrics";
-      smartctl_location = "${pkgs.smartmontools}/bin/smartctl";
-      collect_not_more_than_period = cfg.maxInterval;
-      devices = cfg.devices;
-    };
-  };
+  args = concatStrings [
+    "--web.listen-address=\"${cfg.listenAddress}:${toString cfg.port}\" "
+    "--smartctl.path=\"${pkgs.smartmontools}/bin/smartctl\" "
+    "--smartctl.interval=\"${cfg.maxInterval}\" "
+    "${concatMapStringsSep " " (device: "--smartctl.device=${device}") cfg.devices}"
+  ];
 in {
   port = 9633;
 
@@ -50,17 +46,13 @@ in {
         "CAP_SYS_ADMIN"
       ];
       DevicePolicy = "closed";
-      DeviceAllow = lib.mkOverride 50 (
-        if cfg.devices != [] then
-          cfg.devices
-        else [
-          "block-blkext rw"
-          "block-sd rw"
-          "char-nvme rw"
-        ]
-      );
+      DeviceAllow = lib.mkOverride 50 [
+        "block-blkext rw"
+        "block-sd rw"
+        "char-nvme rw"
+      ];
       ExecStart = ''
-        ${pkgs.prometheus-smartctl-exporter}/bin/smartctl_exporter -config ${configFile}
+        ${pkgs.prometheus-smartctl-exporter}/bin/smartctl_exporter ${args}
       '';
       PrivateDevices = lib.mkForce false;
       ProtectProc = "invisible";
diff --git a/nixos/modules/services/monitoring/uptime-kuma.nix b/nixos/modules/services/monitoring/uptime-kuma.nix
index 3a6091de679d..b6dc993e6a05 100644
--- a/nixos/modules/services/monitoring/uptime-kuma.nix
+++ b/nixos/modules/services/monitoring/uptime-kuma.nix
@@ -13,9 +13,8 @@ in
 
       package = mkOption {
         type = types.package;
-        example = literalExpression "pkgs.uptime-kuma";
         default = pkgs.uptime-kuma;
-        defaultText = "pkgs.uptime-kuma";
+        defaultText = literalExpression "pkgs.uptime-kuma";
         description = lib.mdDoc "Uptime Kuma package to use.";
       };
 
diff --git a/nixos/modules/services/monitoring/zabbix-proxy.nix b/nixos/modules/services/monitoring/zabbix-proxy.nix
index e7e353f36604..85da416ba6c3 100644
--- a/nixos/modules/services/monitoring/zabbix-proxy.nix
+++ b/nixos/modules/services/monitoring/zabbix-proxy.nix
@@ -102,7 +102,7 @@ in
         };
 
         port = mkOption {
-          type = types.int;
+          type = types.port;
           default = if cfg.database.type == "mysql" then mysql.port else pgsql.port;
           defaultText = literalExpression ''
             if config.${opt.database.type} == "mysql"
diff --git a/nixos/modules/services/network-filesystems/tahoe.nix b/nixos/modules/services/network-filesystems/tahoe.nix
index 4213f437f4b2..14c0a3d4725f 100644
--- a/nixos/modules/services/network-filesystems/tahoe.nix
+++ b/nixos/modules/services/network-filesystems/tahoe.nix
@@ -18,7 +18,7 @@ in
             };
             tub.port = mkOption {
               default = 3458;
-              type = types.int;
+              type = types.port;
               description = lib.mdDoc ''
                 The port on which the introducer will listen.
               '';
@@ -58,7 +58,7 @@ in
             };
             tub.port = mkOption {
               default = 3457;
-              type = types.int;
+              type = types.port;
               description = lib.mdDoc ''
                 The port on which the tub will listen.
 
@@ -80,7 +80,7 @@ in
             };
             web.port = mkOption {
               default = 3456;
-              type = types.int;
+              type = types.port;
               description = lib.mdDoc ''
                 The port on which the Web server will listen.
 
diff --git a/nixos/modules/services/networking/ddclient.nix b/nixos/modules/services/networking/ddclient.nix
index 5c32817979af..4d843641f58a 100644
--- a/nixos/modules/services/networking/ddclient.nix
+++ b/nixos/modules/services/networking/ddclient.nix
@@ -71,7 +71,7 @@ with lib;
       package = mkOption {
         type = package;
         default = pkgs.ddclient;
-        defaultText = "pkgs.ddclient";
+        defaultText = lib.literalExpression "pkgs.ddclient";
         description = lib.mdDoc ''
           The ddclient executable package run by the service.
         '';
diff --git a/nixos/modules/services/networking/dnsmasq.nix b/nixos/modules/services/networking/dnsmasq.nix
index cfc37b74b9a9..4886654e8c03 100644
--- a/nixos/modules/services/networking/dnsmasq.nix
+++ b/nixos/modules/services/networking/dnsmasq.nix
@@ -7,15 +7,27 @@ let
   dnsmasq = pkgs.dnsmasq;
   stateDir = "/var/lib/dnsmasq";
 
+  # True values are just put as `name` instead of `name=true`, and false values
+  # are turned to comments (false values are expected to be overrides e.g.
+  # mkForce)
+  formatKeyValue =
+    name: value:
+    if value == true
+    then name
+    else if value == false
+    then "# setting `${name}` explicitly set to false"
+    else generators.mkKeyValueDefault { } "=" name value;
+
+  settingsFormat = pkgs.formats.keyValue {
+    mkKeyValue = formatKeyValue;
+    listsAsDuplicateKeys = true;
+  };
+
+  # Because formats.generate is outputting a file, we use of conf-file. Once
+  # `extraConfig` is deprecated we can just use
+  # `dnsmasqConf = format.generate "dnsmasq.conf" cfg.settings`
   dnsmasqConf = pkgs.writeText "dnsmasq.conf" ''
-    dhcp-leasefile=${stateDir}/dnsmasq.leases
-    ${optionalString cfg.resolveLocalQueries ''
-      conf-file=/etc/dnsmasq-conf.conf
-      resolv-file=/etc/dnsmasq-resolv.conf
-    ''}
-    ${flip concatMapStrings cfg.servers (server: ''
-      server=${server}
-    '')}
+    conf-file=${settingsFormat.generate "dnsmasq.conf" cfg.settings}
     ${cfg.extraConfig}
   '';
 
@@ -23,6 +35,10 @@ in
 
 {
 
+  imports = [
+    (mkRenamedOptionModule [ "services" "dnsmasq" "servers" ] [ "services" "dnsmasq" "settings" "server" ])
+  ];
+
   ###### interface
 
   options = {
@@ -46,15 +62,6 @@ in
         '';
       };
 
-      servers = mkOption {
-        type = types.listOf types.str;
-        default = [];
-        example = [ "8.8.8.8" "8.8.4.4" ];
-        description = lib.mdDoc ''
-          The DNS servers which dnsmasq should query.
-        '';
-      };
-
       alwaysKeepRunning = mkOption {
         type = types.bool;
         default = false;
@@ -63,12 +70,49 @@ in
         '';
       };
 
+      settings = mkOption {
+        type = types.submodule {
+
+          freeformType = settingsFormat.type;
+
+          options.server = mkOption {
+            type = types.listOf types.str;
+            default = [ ];
+            example = [ "8.8.8.8" "8.8.4.4" ];
+            description = lib.mdDoc ''
+              The DNS servers which dnsmasq should query.
+            '';
+          };
+
+        };
+        default = { };
+        description = lib.mdDoc ''
+          Configuration of dnsmasq. Lists get added one value per line (empty
+          lists and false values don't get added, though false values get
+          turned to comments). Gets merged with
+
+              {
+                dhcp-leasefile = "${stateDir}/dnsmasq.leases";
+                conf-file = optional cfg.resolveLocalQueries "/etc/dnsmasq-conf.conf";
+                resolv-file = optional cfg.resolveLocalQueries "/etc/dnsmasq-resolv.conf";
+              }
+        '';
+        example = literalExpression ''
+          {
+            domain-needed = true;
+            dhcp-range = [ "192.168.0.2,192.168.0.254" ];
+          }
+        '';
+      };
+
       extraConfig = mkOption {
         type = types.lines;
         default = "";
         description = lib.mdDoc ''
           Extra configuration directives that should be added to
           `dnsmasq.conf`.
+
+          This option is deprecated, please use {option}`settings` instead.
         '';
       };
 
@@ -81,6 +125,14 @@ in
 
   config = mkIf cfg.enable {
 
+    warnings = lib.optional (cfg.extraConfig != "") "Text based config is deprecated, dnsmasq now supports `services.dnsmasq.settings` for an attribute-set based config";
+
+    services.dnsmasq.settings = {
+      dhcp-leasefile = mkDefault "${stateDir}/dnsmasq.leases";
+      conf-file = mkDefault (optional cfg.resolveLocalQueries "/etc/dnsmasq-conf.conf");
+      resolv-file = mkDefault (optional cfg.resolveLocalQueries "/etc/dnsmasq-resolv.conf");
+    };
+
     networking.nameservers =
       optional cfg.resolveLocalQueries "127.0.0.1";
 
diff --git a/nixos/modules/services/networking/ergochat.nix b/nixos/modules/services/networking/ergochat.nix
index 1a70b1f8613e..a003512677eb 100644
--- a/nixos/modules/services/networking/ergochat.nix
+++ b/nixos/modules/services/networking/ergochat.nix
@@ -17,10 +17,10 @@ in {
       configFile = lib.mkOption {
         type = lib.types.path;
         default = (pkgs.formats.yaml {}).generate "ergo.conf" cfg.settings;
-        defaultText = "generated config file from <literal>.settings</literal>";
+        defaultText = lib.literalMD "generated config file from `settings`";
         description = lib.mdDoc ''
           Path to configuration file.
-          Setting this will skip any configuration done via `.settings`
+          Setting this will skip any configuration done via `settings`
         '';
       };
 
diff --git a/nixos/modules/services/networking/morty.nix b/nixos/modules/services/networking/morty.nix
index 4b20c34cfc9b..72514764a7c6 100644
--- a/nixos/modules/services/networking/morty.nix
+++ b/nixos/modules/services/networking/morty.nix
@@ -50,7 +50,7 @@ in
       };
 
       port = mkOption {
-        type = types.int;
+        type = types.port;
         default = 3000;
         description = lib.mdDoc "Listing port";
       };
diff --git a/nixos/modules/services/networking/multipath.nix b/nixos/modules/services/networking/multipath.nix
index cb6b6db272c2..54ee2a015687 100644
--- a/nixos/modules/services/networking/multipath.nix
+++ b/nixos/modules/services/networking/multipath.nix
@@ -28,7 +28,7 @@ in {
       type = package;
       description = lib.mdDoc "multipath-tools package to use";
       default = pkgs.multipath-tools;
-      defaultText = "pkgs.multipath-tools";
+      defaultText = lib.literalExpression "pkgs.multipath-tools";
     };
 
     devices = mkOption {
diff --git a/nixos/modules/services/networking/nomad.nix b/nixos/modules/services/networking/nomad.nix
index 5e5d9469efc7..890ee0b7d8d1 100644
--- a/nixos/modules/services/networking/nomad.nix
+++ b/nixos/modules/services/networking/nomad.nix
@@ -67,7 +67,7 @@ in
           Additional plugins dir used to configure nomad.
         '';
         example = literalExpression ''
-          [ "<pluginDir>" "pkgs.<plugins-name>"]
+          [ "<pluginDir>" pkgs.<plugins-name> ]
         '';
       };
 
diff --git a/nixos/modules/services/networking/nsd.nix b/nixos/modules/services/networking/nsd.nix
index 57da208bd7af..0ded92652093 100644
--- a/nixos/modules/services/networking/nsd.nix
+++ b/nixos/modules/services/networking/nsd.nix
@@ -588,7 +588,7 @@ in
     };
 
     port = mkOption {
-      type = types.int;
+      type = types.port;
       default = 53;
       description = lib.mdDoc ''
         Port the service should bind do.
@@ -825,7 +825,7 @@ in
       };
 
       port = mkOption {
-        type = types.int;
+        type = types.port;
         default = 8952;
         description = lib.mdDoc ''
           Port number for remote control operations (uses TLS over TCP).
diff --git a/nixos/modules/services/networking/nylon.nix b/nixos/modules/services/networking/nylon.nix
index 6ed832b6fa1b..401dbe97c52d 100644
--- a/nixos/modules/services/networking/nylon.nix
+++ b/nixos/modules/services/networking/nylon.nix
@@ -81,7 +81,7 @@ let
       };
 
       port = mkOption {
-        type = types.int;
+        type = types.port;
         default = 1080;
         description = lib.mdDoc ''
           What port to listen for client requests, default is 1080.
diff --git a/nixos/modules/services/networking/pdns-recursor.nix b/nixos/modules/services/networking/pdns-recursor.nix
index 473c2a1f1fba..2f07cefc736e 100644
--- a/nixos/modules/services/networking/pdns-recursor.nix
+++ b/nixos/modules/services/networking/pdns-recursor.nix
@@ -38,7 +38,7 @@ in {
     };
 
     dns.port = mkOption {
-      type = types.int;
+      type = types.port;
       default = 53;
       description = lib.mdDoc ''
         Port number Recursor DNS server will bind to.
@@ -67,7 +67,7 @@ in {
     };
 
     api.port = mkOption {
-      type = types.int;
+      type = types.port;
       default = 8082;
       description = lib.mdDoc ''
         Port number Recursor REST API server will bind to.
diff --git a/nixos/modules/services/networking/redsocks.nix b/nixos/modules/services/networking/redsocks.nix
index 85ae3125ded8..45feb1313c92 100644
--- a/nixos/modules/services/networking/redsocks.nix
+++ b/nixos/modules/services/networking/redsocks.nix
@@ -81,7 +81,7 @@ in
           };
 
           port = mkOption {
-            type = types.int;
+            type = types.port;
             default = 12345;
             description = lib.mdDoc "Port on which redsocks should listen.";
           };
diff --git a/nixos/modules/services/networking/sabnzbd.nix b/nixos/modules/services/networking/sabnzbd.nix
index 8486be1bc66c..8f3545df8995 100644
--- a/nixos/modules/services/networking/sabnzbd.nix
+++ b/nixos/modules/services/networking/sabnzbd.nix
@@ -20,7 +20,7 @@ in
       package = mkOption {
         type = types.package;
         default = pkgs.sabnzbd;
-        defaultText = "pkgs.sabnzbd";
+        defaultText = lib.literalExpression "pkgs.sabnzbd";
         description = lib.mdDoc "The sabnzbd executable package run by the service.";
       };
 
diff --git a/nixos/modules/services/networking/twingate.nix b/nixos/modules/services/networking/twingate.nix
new file mode 100644
index 000000000000..17140bffd218
--- /dev/null
+++ b/nixos/modules/services/networking/twingate.nix
@@ -0,0 +1,28 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.services.twingate;
+
+in {
+
+  options.services.twingate = {
+    enable = mkEnableOption (lib.mdDoc "Twingate Client daemon");
+  };
+
+  config = mkIf cfg.enable {
+
+    networking.firewall.checkReversePath = lib.mkDefault false;
+    networking.networkmanager.enable = true;
+
+    environment.systemPackages = [ pkgs.twingate ]; # for the CLI
+    systemd.packages = [ pkgs.twingate ];
+
+    systemd.services.twingate.preStart = ''
+      cp -r -n ${pkgs.twingate}/etc/twingate/. /etc/twingate/
+    '';
+
+    systemd.services.twingate.wantedBy = [ "multi-user.target" ];
+  };
+}
diff --git a/nixos/modules/services/networking/znc/options.nix b/nixos/modules/services/networking/znc/options.nix
index ce8e7a89a4df..bd67ec86d513 100644
--- a/nixos/modules/services/networking/znc/options.nix
+++ b/nixos/modules/services/networking/znc/options.nix
@@ -18,7 +18,7 @@ let
       };
 
       port = mkOption {
-        type = types.ints.u16;
+        type = types.port;
         default = 6697;
         description = lib.mdDoc ''
           IRC server port.
@@ -188,7 +188,7 @@ in
 
         port = mkOption {
           default = 5000;
-          type = types.int;
+          type = types.port;
           description = lib.mdDoc ''
             Specifies the port on which to listen.
           '';
diff --git a/nixos/modules/services/printing/ipp-usb.nix b/nixos/modules/services/printing/ipp-usb.nix
new file mode 100644
index 000000000000..0425eb913731
--- /dev/null
+++ b/nixos/modules/services/printing/ipp-usb.nix
@@ -0,0 +1,63 @@
+{ config, lib, pkgs, ... }: {
+  options = {
+    services.ipp-usb = {
+      enable = lib.mkEnableOption (lib.mdDoc "ipp-usb, a daemon to turn an USB printer/scanner supporting IPP everywhere (aka AirPrint, WSD, AirScan) into a locally accessible network printer/scanner");
+    };
+  };
+  config = lib.mkIf config.services.ipp-usb.enable {
+    systemd.services.ipp-usb = {
+      description = "Daemon for IPP over USB printer support";
+      after = [ "cups.service" "avahi-deamon.service" ];
+      wants = [ "avahi-daemon.service" ];
+      serviceConfig = {
+        ExecStart = [ "${pkgs.ipp-usb}/bin/ipp-usb" ];
+        Type = "simple";
+        Restart = "on-failure";
+        StateDirectory = "ipp-usb";
+        LogsDirectory = "ipp-usb";
+
+        # hardening.
+        ProtectHome = true;
+        PrivateTmp = true;
+        PrivateUsers = true;
+        ProtectControlGroups = true;
+        MemoryDenyWriteExecute = true;
+        # breaks the daemon, presumably because it messes with DeviceAllow
+        ProtectClock = false;
+        ProtectKernelTunables = true;
+        ProtectKernelLogs = true;
+        ProtectSystem = "strict";
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        SystemCallArchitectures = "native";
+        PrivateMounts = true;
+        ProtectHostname = true;
+        ProtectKernelModules = true;
+        RemoveIPC = true;
+        RestrictNamespaces = true;
+        AmbientCapabilities = "";
+        CapabilityBoundingSet = "";
+        NoNewPrivileges = true;
+        RestrictAddressFamilies = [ "AF_UNIX" "AF_NETLINK" "AF_INET" "AF_INET6" ];
+        ProtectProc = "noaccess";
+      };
+    };
+
+    # starts the systemd service
+    services.udev.packages = [ pkgs.ipp-usb ];
+    services.avahi = {
+      enable = true;
+      publish = {
+        enable = true;
+        userServices = true;
+      };
+    };
+    # enable printing and scanning by default, but not required.
+    services.printing.enable = lib.mkDefault true;
+    hardware.sane.enable = lib.mkDefault true;
+    # so that sane discovers scanners
+    hardware.sane.extraBackends = [ pkgs.sane-airscan ];
+  };
+}
+
+
diff --git a/nixos/modules/services/search/elasticsearch-curator.nix b/nixos/modules/services/search/elasticsearch-curator.nix
index f073ec7cf2bd..0a21d705ef87 100644
--- a/nixos/modules/services/search/elasticsearch-curator.nix
+++ b/nixos/modules/services/search/elasticsearch-curator.nix
@@ -50,7 +50,7 @@ in {
     };
     port = mkOption {
       description = lib.mdDoc "the port that elasticsearch is listening on";
-      type = types.int;
+      type = types.port;
       default = 9200;
     };
     actionYAML = mkOption {
diff --git a/nixos/modules/services/search/elasticsearch.nix b/nixos/modules/services/search/elasticsearch.nix
index 4a9dd50310e2..fa1627566ebe 100644
--- a/nixos/modules/services/search/elasticsearch.nix
+++ b/nixos/modules/services/search/elasticsearch.nix
@@ -66,7 +66,7 @@ in
     port = mkOption {
       description = lib.mdDoc "Elasticsearch port to listen for HTTP traffic.";
       default = 9200;
-      type = types.int;
+      type = types.port;
     };
 
     tcp_port = mkOption {
diff --git a/nixos/modules/services/search/meilisearch.nix b/nixos/modules/services/search/meilisearch.nix
index 9262b927cba4..3983b1b2c92c 100644
--- a/nixos/modules/services/search/meilisearch.nix
+++ b/nixos/modules/services/search/meilisearch.nix
@@ -21,7 +21,7 @@ in
     package = mkOption {
       description = lib.mdDoc "The package to use for meilisearch. Use this if you require specific features to be enabled. The default package has no features.";
       default = pkgs.meilisearch;
-      defaultText = "pkgs.meilisearch";
+      defaultText = lib.literalExpression "pkgs.meilisearch";
       type = types.package;
     };
 
diff --git a/nixos/modules/services/security/opensnitch.nix b/nixos/modules/services/security/opensnitch.nix
index 8f1407b555fb..98695b1ef060 100644
--- a/nixos/modules/services/security/opensnitch.nix
+++ b/nixos/modules/services/security/opensnitch.nix
@@ -91,7 +91,7 @@ in {
             InterceptUnknown = mkOption {
               type = types.bool;
               description = mdDoc ''
-                Wheter to intercept spare connections.
+                Whether to intercept spare connections.
               '';
             };
 
diff --git a/nixos/modules/services/system/kerberos/mit.nix b/nixos/modules/services/system/kerberos/mit.nix
index 25d7d51e808a..112000140453 100644
--- a/nixos/modules/services/system/kerberos/mit.nix
+++ b/nixos/modules/services/system/kerberos/mit.nix
@@ -33,7 +33,7 @@ let
 in
 
 {
-  config = mkIf (cfg.enable && kerberos == pkgs.krb5Full) {
+  config = mkIf (cfg.enable && kerberos == pkgs.krb5) {
     systemd.services.kadmind = {
       description = "Kerberos Administration Daemon";
       wantedBy = [ "multi-user.target" ];
diff --git a/nixos/modules/services/web-apps/code-server.nix b/nixos/modules/services/web-apps/code-server.nix
index 0d6b6c529b6d..24e34e0c5833 100644
--- a/nixos/modules/services/web-apps/code-server.nix
+++ b/nixos/modules/services/web-apps/code-server.nix
@@ -15,7 +15,7 @@ in {
 
       package = mkOption {
         default = pkgs.code-server;
-        defaultText = "pkgs.code-server";
+        defaultText = lib.literalExpression "pkgs.code-server";
         description = lib.mdDoc "Which code-server derivation to use.";
         type = types.package;
       };
diff --git a/nixos/modules/services/web-apps/hedgedoc.nix b/nixos/modules/services/web-apps/hedgedoc.nix
index ea27eb7ba390..a623e45691df 100644
--- a/nixos/modules/services/web-apps/hedgedoc.nix
+++ b/nixos/modules/services/web-apps/hedgedoc.nix
@@ -449,7 +449,7 @@ in
               '';
             };
             port = mkOption {
-              type = types.int;
+              type = types.port;
               default = 9000;
               description = lib.mdDoc ''
                 Minio listen port.
diff --git a/nixos/modules/services/web-apps/invidious.nix b/nixos/modules/services/web-apps/invidious.nix
index e106478628f5..a153aa3fb0c3 100644
--- a/nixos/modules/services/web-apps/invidious.nix
+++ b/nixos/modules/services/web-apps/invidious.nix
@@ -151,7 +151,7 @@ in
     package = lib.mkOption {
       type = types.package;
       default = pkgs.invidious;
-      defaultText = "pkgs.invidious";
+      defaultText = lib.literalExpression "pkgs.invidious";
       description = lib.mdDoc "The Invidious package to use.";
     };
 
diff --git a/nixos/modules/services/web-apps/limesurvey.nix b/nixos/modules/services/web-apps/limesurvey.nix
index f6a1b5595243..7093d1de0dac 100644
--- a/nixos/modules/services/web-apps/limesurvey.nix
+++ b/nixos/modules/services/web-apps/limesurvey.nix
@@ -49,7 +49,7 @@ in
       };
 
       port = mkOption {
-        type = types.int;
+        type = types.port;
         default = if cfg.database.type == "pgsql" then 5442 else 3306;
         defaultText = literalExpression "3306";
         description = lib.mdDoc "Database host port.";
diff --git a/nixos/modules/services/web-apps/mastodon.nix b/nixos/modules/services/web-apps/mastodon.nix
index 8122c2449491..35b96734be77 100644
--- a/nixos/modules/services/web-apps/mastodon.nix
+++ b/nixos/modules/services/web-apps/mastodon.nix
@@ -546,7 +546,7 @@ in {
       environment = env;
       serviceConfig = {
         Type = "oneshot";
-        EnvironmentFile = "/var/lib/mastodon/.secrets_env";
+        EnvironmentFile = [ "/var/lib/mastodon/.secrets_env" ];
         WorkingDirectory = cfg.package;
         # System Call Filtering
         SystemCallFilter = [ ("~" + lib.concatStringsSep " " (systemCallsList ++ [ "@resources" ])) "@chown" "pipe" "pipe2" ];
@@ -574,7 +574,7 @@ in {
         ExecStart = "${cfg.package}/run-streaming.sh";
         Restart = "always";
         RestartSec = 20;
-        EnvironmentFile = "/var/lib/mastodon/.secrets_env";
+        EnvironmentFile = [ "/var/lib/mastodon/.secrets_env" ];
         WorkingDirectory = cfg.package;
         # Runtime directory and mode
         RuntimeDirectory = "mastodon-streaming";
@@ -601,7 +601,7 @@ in {
         ExecStart = "${cfg.package}/bin/puma -C config/puma.rb";
         Restart = "always";
         RestartSec = 20;
-        EnvironmentFile = "/var/lib/mastodon/.secrets_env";
+        EnvironmentFile = [ "/var/lib/mastodon/.secrets_env" ];
         WorkingDirectory = cfg.package;
         # Runtime directory and mode
         RuntimeDirectory = "mastodon-web";
@@ -629,7 +629,7 @@ in {
         ExecStart = "${cfg.package}/bin/sidekiq -c ${toString cfg.sidekiqThreads} -r ${cfg.package}";
         Restart = "always";
         RestartSec = 20;
-        EnvironmentFile = "/var/lib/mastodon/.secrets_env";
+        EnvironmentFile = [ "/var/lib/mastodon/.secrets_env" ];
         WorkingDirectory = cfg.package;
         # System Call Filtering
         SystemCallFilter = [ ("~" + lib.concatStringsSep " " systemCallsList) "@chown" "pipe" "pipe2" ];
@@ -642,7 +642,7 @@ in {
       environment = env;
       serviceConfig = {
         Type = "oneshot";
-        EnvironmentFile = "/var/lib/mastodon/.secrets_env";
+        EnvironmentFile = [ "/var/lib/mastodon/.secrets_env" ];
       } // cfgService;
       script = let
         olderThanDays = toString cfg.mediaAutoRemove.olderThanDays;
diff --git a/nixos/modules/services/web-apps/mattermost.nix b/nixos/modules/services/web-apps/mattermost.nix
index 71292c47d63a..99042821f5eb 100644
--- a/nixos/modules/services/web-apps/mattermost.nix
+++ b/nixos/modules/services/web-apps/mattermost.nix
@@ -106,7 +106,7 @@ in
       package = mkOption {
         type = types.package;
         default = pkgs.mattermost;
-        defaultText = "pkgs.mattermost";
+        defaultText = lib.literalExpression "pkgs.mattermost";
         description = lib.mdDoc "Mattermost derivation to use.";
       };
 
@@ -238,7 +238,7 @@ in
         package = mkOption {
           type = types.package;
           default = pkgs.matterircd;
-          defaultText = "pkgs.matterircd";
+          defaultText = lib.literalExpression "pkgs.matterircd";
           description = lib.mdDoc "matterircd derivation to use.";
         };
         parameters = mkOption {
diff --git a/nixos/modules/services/web-apps/moodle.nix b/nixos/modules/services/web-apps/moodle.nix
index dc434d0fc803..5f8d9c5b15f4 100644
--- a/nixos/modules/services/web-apps/moodle.nix
+++ b/nixos/modules/services/web-apps/moodle.nix
@@ -96,7 +96,7 @@ in
       };
 
       port = mkOption {
-        type = types.int;
+        type = types.port;
         description = lib.mdDoc "Database host port.";
         default = {
           mysql = 3306;
diff --git a/nixos/modules/services/web-apps/onlyoffice.nix b/nixos/modules/services/web-apps/onlyoffice.nix
index db4a9582794e..1478e8da87a1 100644
--- a/nixos/modules/services/web-apps/onlyoffice.nix
+++ b/nixos/modules/services/web-apps/onlyoffice.nix
@@ -29,7 +29,7 @@ in
     package = mkOption {
       type = types.package;
       default = pkgs.onlyoffice-documentserver;
-      defaultText = "pkgs.onlyoffice-documentserver";
+      defaultText = lib.literalExpression "pkgs.onlyoffice-documentserver";
       description = lib.mdDoc "Which package to use for the OnlyOffice instance.";
     };
 
diff --git a/nixos/modules/services/web-apps/peering-manager.nix b/nixos/modules/services/web-apps/peering-manager.nix
new file mode 100644
index 000000000000..0db2e8e4aeda
--- /dev/null
+++ b/nixos/modules/services/web-apps/peering-manager.nix
@@ -0,0 +1,265 @@
+{ config, lib, pkgs, buildEnv, ... }:
+
+with lib;
+
+let
+  cfg = config.services.peering-manager;
+  configFile = pkgs.writeTextFile {
+    name = "configuration.py";
+    text = ''
+      ALLOWED_HOSTS = ['*']
+      DATABASE = {
+        'NAME': 'peering-manager',
+        'USER': 'peering-manager',
+        'HOST': '/run/postgresql',
+      }
+
+      # Redis database settings. Redis is used for caching and for queuing background tasks such as webhook events. A separate
+      # configuration exists for each. Full connection details are required in both sections, and it is strongly recommended
+      # to use two separate database IDs.
+      REDIS = {
+        'tasks': {
+          'UNIX_SOCKET_PATH': '${config.services.redis.servers.peering-manager.unixSocket}',
+          'DATABASE': 0,
+        },
+        'caching': {
+          'UNIX_SOCKET_PATH': '${config.services.redis.servers.peering-manager.unixSocket}',
+          'DATABASE': 1,
+        }
+      }
+
+      with open("${cfg.secretKeyFile}", "r") as file:
+        SECRET_KEY = file.readline()
+    '' + lib.optionalString (cfg.peeringdbApiKeyFile != null) ''
+      with open("${cfg.peeringdbApiKeyFile}", "r") as file:
+        PEERINGDB_API_KEY = file.readline()
+    '' + ''
+
+      ${cfg.extraConfig}
+    '';
+  };
+  pkg = (pkgs.peering-manager.overrideAttrs (old: {
+    postInstall = ''
+      ln -s ${configFile} $out/opt/peering-manager/peering_manager/configuration.py
+    '' + optionalString cfg.enableLdap ''
+      ln -s ${cfg.ldapConfigPath} $out/opt/peering-manager/peering_manager/ldap_config.py
+    '';
+  })).override {
+    inherit (cfg) plugins;
+  };
+  peeringManagerManageScript = with pkgs; (writeScriptBin "peering-manager-manage" ''
+    #!${stdenv.shell}
+    export PYTHONPATH=${pkg.pythonPath}
+    sudo -u peering-manager ${pkg}/bin/peering-manager "$@"
+  '');
+
+in {
+  options.services.peering-manager = {
+    enable = mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = lib.mdDoc ''
+        Enable Peering Manager.
+
+        This module requires a reverse proxy that serves `/static` separately.
+        See this [example](https://github.com/peering-manager-community/peering-manager/blob/develop/contrib/nginx.conf/) on how to configure this.
+      '';
+    };
+
+    listenAddress = mkOption {
+      type = types.str;
+      default = "[::1]";
+      description = lib.mdDoc ''
+        Address the server will listen on.
+      '';
+    };
+
+    port = mkOption {
+      type = types.port;
+      default = 8001;
+      description = lib.mdDoc ''
+        Port the server will listen on.
+      '';
+    };
+
+    plugins = mkOption {
+      type = types.functionTo (types.listOf types.package);
+      default = _: [];
+      defaultText = literalExpression ''
+        python3Packages: with python3Packages; [];
+      '';
+      description = lib.mdDoc ''
+        List of plugin packages to install.
+      '';
+    };
+
+    secretKeyFile = mkOption {
+      type = types.path;
+      description = lib.mdDoc ''
+        Path to a file containing the secret key.
+      '';
+    };
+
+    peeringdbApiKeyFile = mkOption {
+      type = with types; nullOr path;
+      default = null;
+      description = lib.mdDoc ''
+        Path to a file containing the PeeringDB API key.
+      '';
+    };
+
+    extraConfig = mkOption {
+      type = types.lines;
+      default = "";
+      description = lib.mdDoc ''
+        Additional lines of configuration appended to the `configuration.py`.
+        See the [documentation](https://peering-manager.readthedocs.io/en/stable/configuration/optional-settings/) for more possible options.
+      '';
+    };
+
+    enableLdap = mkOption {
+      type = types.bool;
+      default = false;
+      description = lib.mdDoc ''
+        Enable LDAP-Authentication for Peering Manager.
+
+        This requires a configuration file being pass through `ldapConfigPath`.
+      '';
+    };
+
+    ldapConfigPath = mkOption {
+      type = types.path;
+      description = lib.mdDoc ''
+        Path to the Configuration-File for LDAP-Authentification, will be loaded as `ldap_config.py`.
+        See the [documentation](https://peering-manager.readthedocs.io/en/stable/setup/6-ldap/#configuration) for possible options.
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable {
+    services.peering-manager.plugins = mkIf cfg.enableLdap (ps: [ ps.django-auth-ldap ]);
+
+    system.build.peeringManagerPkg = pkg;
+
+    services.redis.servers.peering-manager.enable = true;
+
+    services.postgresql = {
+      enable = true;
+      ensureDatabases = [ "peering-manager" ];
+      ensureUsers = [
+        {
+          name = "peering-manager";
+          ensurePermissions = {
+            "DATABASE \"peering-manager\"" = "ALL PRIVILEGES";
+          };
+        }
+      ];
+    };
+
+    environment.systemPackages = [ peeringManagerManageScript ];
+
+    systemd.targets.peering-manager = {
+      description = "Target for all Peering Manager services";
+      wantedBy = [ "multi-user.target" ];
+      after = [ "network-online.target" "redis-peering-manager.service" ];
+    };
+
+    systemd.services = let
+      defaultServiceConfig = {
+        WorkingDirectory = "/var/lib/peering-manager";
+        User = "peering-manager";
+        Group = "peering-manager";
+        StateDirectory = "peering-manager";
+        StateDirectoryMode = "0750";
+        Restart = "on-failure";
+      };
+    in {
+      peering-manager-migration = {
+        description = "Peering Manager migrations";
+        wantedBy = [ "peering-manager.target" ];
+
+        environment = {
+          PYTHONPATH = pkg.pythonPath;
+        };
+
+        serviceConfig = defaultServiceConfig // {
+          Type = "oneshot";
+          ExecStart = ''
+            ${pkg}/bin/peering-manager migrate
+          '';
+        };
+      };
+
+      peering-manager = {
+        description = "Peering Manager WSGI Service";
+        wantedBy = [ "peering-manager.target" ];
+        after = [ "peering-manager-migration.service" ];
+
+        preStart = ''
+          ${pkg}/bin/peering-manager remove_stale_contenttypes --no-input
+        '';
+
+        environment = {
+          PYTHONPATH = pkg.pythonPath;
+        };
+
+        serviceConfig = defaultServiceConfig // {
+          ExecStart = ''
+            ${pkg.python.pkgs.gunicorn}/bin/gunicorn peering_manager.wsgi \
+              --bind ${cfg.listenAddress}:${toString cfg.port} \
+              --pythonpath ${pkg}/opt/peering-manager
+          '';
+        };
+      };
+
+      peering-manager-rq = {
+        description = "Peering Manager Request Queue Worker";
+        wantedBy = [ "peering-manager.target" ];
+        after = [ "peering-manager.service" ];
+
+        environment = {
+          PYTHONPATH = pkg.pythonPath;
+        };
+
+        serviceConfig = defaultServiceConfig // {
+          ExecStart = ''
+            ${pkg}/bin/peering-manager rqworker high default low
+          '';
+        };
+      };
+
+      peering-manager-housekeeping = {
+        description = "Peering Manager housekeeping job";
+        after = [ "peering-manager.service" ];
+
+        environment = {
+          PYTHONPATH = pkg.pythonPath;
+        };
+
+        serviceConfig = defaultServiceConfig // {
+          Type = "oneshot";
+          ExecStart = ''
+            ${pkg}/bin/peering-manager housekeeping
+          '';
+        };
+      };
+    };
+
+    systemd.timers.peering-manager-housekeeping = {
+      description = "Run Peering Manager housekeeping job";
+      wantedBy = [ "timers.target" ];
+
+      timerConfig = {
+        OnCalendar = "daily";
+      };
+    };
+
+    users.users.peering-manager = {
+      home = "/var/lib/peering-manager";
+      isSystemUser = true;
+      group = "peering-manager";
+    };
+    users.groups.peering-manager = {};
+    users.groups."${config.services.redis.servers.peering-manager.user}".members = [ "peering-manager" ];
+  };
+}
diff --git a/nixos/modules/services/web-apps/zabbix.nix b/nixos/modules/services/web-apps/zabbix.nix
index 0e43922f35de..2cea7e7cea72 100644
--- a/nixos/modules/services/web-apps/zabbix.nix
+++ b/nixos/modules/services/web-apps/zabbix.nix
@@ -51,7 +51,7 @@ in
 
       server = {
         port = mkOption {
-          type = types.int;
+          type = types.port;
           description = lib.mdDoc "The port of the Zabbix server to connect to.";
           default = 10051;
         };
@@ -78,7 +78,7 @@ in
         };
 
         port = mkOption {
-          type = types.int;
+          type = types.port;
           default =
             if cfg.database.type == "mysql" then config.services.mysql.port
             else if cfg.database.type == "pgsql" then config.services.postgresql.port
diff --git a/nixos/modules/services/web-servers/lighttpd/default.nix b/nixos/modules/services/web-servers/lighttpd/default.nix
index ec847495d741..811afe8e0af6 100644
--- a/nixos/modules/services/web-servers/lighttpd/default.nix
+++ b/nixos/modules/services/web-servers/lighttpd/default.nix
@@ -137,7 +137,7 @@ in
 
       package = mkOption {
         default = pkgs.lighttpd;
-        defaultText = "pkgs.lighttpd";
+        defaultText = lib.literalExpression "pkgs.lighttpd";
         type = types.package;
         description = lib.mdDoc ''
           lighttpd package to use.
diff --git a/nixos/modules/services/web-servers/nginx/vhost-options.nix b/nixos/modules/services/web-servers/nginx/vhost-options.nix
index e3d4afc074cf..2bdc046c0d8f 100644
--- a/nixos/modules/services/web-servers/nginx/vhost-options.nix
+++ b/nixos/modules/services/web-servers/nginx/vhost-options.nix
@@ -29,7 +29,7 @@ with lib;
     listen = mkOption {
       type = with types; listOf (submodule { options = {
         addr = mkOption { type = str;  description = lib.mdDoc "IP address.";  };
-        port = mkOption { type = int;  description = lib.mdDoc "Port number."; default = 80; };
+        port = mkOption { type = port;  description = lib.mdDoc "Port number."; default = 80; };
         ssl  = mkOption { type = bool; description = lib.mdDoc "Enable SSL.";  default = false; };
         extraParameters = mkOption { type = listOf str; description = lib.mdDoc "Extra parameters of this listen directive."; default = []; example = [ "backlog=1024" "deferred" ]; };
       }; });
diff --git a/nixos/modules/services/x11/desktop-managers/cinnamon.nix b/nixos/modules/services/x11/desktop-managers/cinnamon.nix
index 8e6a44428fce..aaad1de5f87b 100644
--- a/nixos/modules/services/x11/desktop-managers/cinnamon.nix
+++ b/nixos/modules/services/x11/desktop-managers/cinnamon.nix
@@ -67,11 +67,11 @@ in
 
         # Taken from mint-artwork.gschema.override
         theme = mkIf (notExcluded pkgs.cinnamon.mint-themes) {
-          name = mkDefault "Mint-X";
+          name = mkDefault "Mint-Y-Aqua";
           package = mkDefault pkgs.cinnamon.mint-themes;
         };
         iconTheme = mkIf (notExcluded pkgs.cinnamon.mint-x-icons) {
-          name = mkDefault "Mint-X-Dark";
+          name = mkDefault "Mint-Y-Aqua";
           package = mkDefault pkgs.cinnamon.mint-x-icons;
         };
         cursorTheme = mkIf (notExcluded pkgs.cinnamon.mint-cursor-themes) {
diff --git a/nixos/modules/system/activation/test.nix b/nixos/modules/system/activation/test.nix
new file mode 100644
index 000000000000..8cf000451c6e
--- /dev/null
+++ b/nixos/modules/system/activation/test.nix
@@ -0,0 +1,27 @@
+{ lib
+, nixos
+, expect
+, testers
+}:
+let
+  node-forbiddenDependencies-fail = nixos ({ ... }: {
+    system.forbiddenDependenciesRegex = "-dev$";
+    environment.etc."dev-dependency" = {
+      text = "${expect.dev}";
+    };
+    documentation.enable = false;
+    fileSystems."/".device = "ignore-root-device";
+    boot.loader.grub.enable = false;
+  });
+  node-forbiddenDependencies-succeed = nixos ({ ... }: {
+    system.forbiddenDependenciesRegex = "-dev$";
+    system.extraDependencies = [ expect.dev ];
+    documentation.enable = false;
+    fileSystems."/".device = "ignore-root-device";
+    boot.loader.grub.enable = false;
+  });
+in
+lib.recurseIntoAttrs {
+  test-forbiddenDependencies-fail = testers.testBuildFailure node-forbiddenDependencies-fail.config.system.build.toplevel;
+  test-forbiddenDependencies-succeed = node-forbiddenDependencies-succeed.config.system.build.toplevel;
+}
diff --git a/nixos/modules/system/activation/top-level.nix b/nixos/modules/system/activation/top-level.nix
index 55ff98db5382..64e97b510b06 100644
--- a/nixos/modules/system/activation/top-level.nix
+++ b/nixos/modules/system/activation/top-level.nix
@@ -77,7 +77,7 @@ let
 
       ${config.system.systemBuilderCommands}
 
-      echo -n "${toString config.system.extraDependencies}" > $out/extra-dependencies
+      echo -n "$extraDependencies" > $out/extra-dependencies
 
       ${config.system.extraSystemBuilderCmds}
     '';
@@ -105,6 +105,8 @@ let
     dryActivationScript = config.system.dryActivationScript;
     nixosLabel = config.system.nixos.label;
 
+    inherit (config.system) extraDependencies;
+
     # Needed by switch-to-configuration.
     perl = pkgs.perl.withPackages (p: with p; [ ConfigIniFiles FileSlurp ]);
   } // config.system.systemBuilderArgs);
@@ -223,6 +225,16 @@ in
       '';
     };
 
+    system.forbiddenDependenciesRegex = mkOption {
+      default = "";
+      example = "-dev$";
+      type = types.str;
+      description = lib.mdDoc ''
+        A POSIX Extended Regular Expression that matches store paths that
+        should not appear in the system closure, with the exception of {option}`system.extraDependencies`, which is not checked.
+      '';
+    };
+
     system.extraSystemBuilderCmds = mkOption {
       type = types.lines;
       internal = true;
@@ -298,8 +310,26 @@ in
         config.system.copySystemConfiguration
         ''ln -s '${import ../../../lib/from-env.nix "NIXOS_CONFIG" <nixos-config>}' \
             "$out/configuration.nix"
+        '' +
+      optionalString
+        (config.system.forbiddenDependenciesRegex != "")
+        ''
+          if [[ $forbiddenDependenciesRegex != "" && -n $closureInfo ]]; then
+            if forbiddenPaths="$(grep -E -- "$forbiddenDependenciesRegex" $closureInfo/store-paths)"; then
+              echo -e "System closure $out contains the following disallowed paths:\n$forbiddenPaths"
+              exit 1
+            fi
+          fi
         '';
 
+    system.systemBuilderArgs = lib.optionalAttrs (config.system.forbiddenDependenciesRegex != "") {
+      inherit (config.system) forbiddenDependenciesRegex;
+      closureInfo = pkgs.closureInfo { rootPaths = [
+        # override to avoid  infinite recursion (and to allow using extraDependencies to add forbidden dependencies)
+        (config.system.build.toplevel.overrideAttrs (_: { extraDependencies = []; closureInfo = null; }))
+      ]; };
+    };
+
     system.build.toplevel = system;
 
   };
diff --git a/nixos/modules/virtualisation/qemu-vm.nix b/nixos/modules/virtualisation/qemu-vm.nix
index eae898a08a69..1b3c0e23f97d 100644
--- a/nixos/modules/virtualisation/qemu-vm.nix
+++ b/nixos/modules/virtualisation/qemu-vm.nix
@@ -580,7 +580,7 @@ in
     virtualisation.host.pkgs = mkOption {
       type = options.nixpkgs.pkgs.type;
       default = pkgs;
-      defaultText = "pkgs";
+      defaultText = literalExpression "pkgs";
       example = literalExpression ''
         import pkgs.path { system = "x86_64-darwin"; }
       '';
@@ -595,7 +595,8 @@ in
         mkOption {
           type = types.package;
           default = cfg.host.pkgs.qemu_kvm;
-          example = "pkgs.qemu_test";
+          defaultText = literalExpression "config.virtualisation.host.pkgs.qemu_kvm";
+          example = literalExpression "pkgs.qemu_test";
           description = lib.mdDoc "QEMU package to use.";
         };
 
@@ -721,7 +722,7 @@ in
       firmware = mkOption {
         type = types.path;
         default = pkgs.OVMF.firmware;
-        defaultText = "pkgs.OVMF.firmware";
+        defaultText = literalExpression "pkgs.OVMF.firmware";
         description =
           lib.mdDoc ''
             Firmware binary for EFI implementation, defaults to OVMF.
@@ -731,7 +732,7 @@ in
       variables = mkOption {
         type = types.path;
         default = pkgs.OVMF.variables;
-        defaultText = "pkgs.OVMF.variables";
+        defaultText = literalExpression "pkgs.OVMF.variables";
         description =
           lib.mdDoc ''
             Platform-specific flash binary for EFI variables, implementation-dependent to the EFI firmware.
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 895cbe4290dc..b372ae20480b 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -113,6 +113,7 @@ in {
   calibre-web = handleTest ./calibre-web.nix {};
   cassandra_3_0 = handleTest ./cassandra.nix { testPackage = pkgs.cassandra_3_0; };
   cassandra_3_11 = handleTest ./cassandra.nix { testPackage = pkgs.cassandra_3_11; };
+  cassandra_4 = handleTest ./cassandra.nix { testPackage = pkgs.cassandra_4; };
   ceph-multi-node = handleTestOn ["x86_64-linux"] ./ceph-multi-node.nix {};
   ceph-single-node = handleTestOn ["x86_64-linux"] ./ceph-single-node.nix {};
   ceph-single-node-bluestore = handleTestOn ["x86_64-linux"] ./ceph-single-node-bluestore.nix {};
@@ -193,6 +194,7 @@ in {
   ergo = handleTest ./ergo.nix {};
   ergochat = handleTest ./ergochat.nix {};
   etc = pkgs.callPackage ../modules/system/etc/test.nix { inherit evalMinimalConfig; };
+  activation = pkgs.callPackage ../modules/system/activation/test.nix { };
   etcd = handleTestOn ["x86_64-linux"] ./etcd.nix {};
   etcd-cluster = handleTestOn ["x86_64-linux"] ./etcd-cluster.nix {};
   etebase-server = handleTest ./etebase-server.nix {};
@@ -488,6 +490,7 @@ in {
   parsedmarc = handleTest ./parsedmarc {};
   pdns-recursor = handleTest ./pdns-recursor.nix {};
   peerflix = handleTest ./peerflix.nix {};
+  peering-manager = handleTest ./web-apps/peering-manager.nix {};
   peertube = handleTestOn ["x86_64-linux"] ./web-apps/peertube.nix {};
   pgadmin4 = handleTest ./pgadmin4.nix {};
   pgadmin4-standalone = handleTest ./pgadmin4-standalone.nix {};
diff --git a/nixos/tests/bazarr.nix b/nixos/tests/bazarr.nix
index 2e49c958dd00..e59833e5e945 100644
--- a/nixos/tests/bazarr.nix
+++ b/nixos/tests/bazarr.nix
@@ -16,7 +16,6 @@ in
         enable = true;
         listenPort = port;
       };
-      nixpkgs.config.allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg) ["unrar"];
     };
 
   testScript = ''
diff --git a/nixos/tests/dnscrypt-proxy2.nix b/nixos/tests/dnscrypt-proxy2.nix
index 4435d77bbf3b..a75a745d3553 100644
--- a/nixos/tests/dnscrypt-proxy2.nix
+++ b/nixos/tests/dnscrypt-proxy2.nix
@@ -26,7 +26,7 @@ in {
       };
 
       services.dnsmasq.enable = true;
-      services.dnsmasq.servers = [ "127.0.0.1#${toString localProxyPort}" ];
+      services.dnsmasq.settings.server = [ "127.0.0.1#${toString localProxyPort}" ];
     };
   };
 
diff --git a/nixos/tests/docker-tools.nix b/nixos/tests/docker-tools.nix
index e76a46131929..98704ecb2fb6 100644
--- a/nixos/tests/docker-tools.nix
+++ b/nixos/tests/docker-tools.nix
@@ -419,6 +419,20 @@ import ./make-test-python.nix ({ pkgs, ... }: {
             "docker rmi layered-image-with-path",
         )
 
+    with subtest("Ensure correct architecture is present in manifests."):
+        docker.succeed("""
+            docker load --input='${examples.build-image-with-architecture}'
+            docker inspect build-image-with-architecture \
+              | ${pkgs.jq}/bin/jq -er '.[] | select(.Architecture=="arm64").Architecture'
+            docker rmi build-image-with-architecture
+        """)
+        docker.succeed("""
+            ${examples.layered-image-with-architecture} | docker load
+            docker inspect layered-image-with-architecture \
+              | ${pkgs.jq}/bin/jq -er '.[] | select(.Architecture=="arm64").Architecture'
+            docker rmi layered-image-with-architecture
+        """)
+
     with subtest("etc"):
         docker.succeed("${examples.etc} | docker load")
         docker.succeed("docker run --rm etc | grep localhost")
diff --git a/nixos/tests/kerberos/mit.nix b/nixos/tests/kerberos/mit.nix
index b475b7e4c92b..7e427ffef0ba 100644
--- a/nixos/tests/kerberos/mit.nix
+++ b/nixos/tests/kerberos/mit.nix
@@ -9,7 +9,7 @@ import ../make-test-python.nix ({pkgs, ...}: {
     };
     krb5 = {
       enable = true;
-      kerberos = pkgs.krb5Full;
+      kerberos = pkgs.krb5;
       libdefaults = {
         default_realm = "FOO.BAR";
       };
diff --git a/nixos/tests/krb5/example-config.nix b/nixos/tests/krb5/example-config.nix
index 1125b02f01ca..9a5c3b2af249 100644
--- a/nixos/tests/krb5/example-config.nix
+++ b/nixos/tests/krb5/example-config.nix
@@ -11,7 +11,7 @@ import ../make-test-python.nix ({ pkgs, ...} : {
     { pkgs, ... }: {
       krb5 = {
         enable = true;
-        kerberos = pkgs.krb5Full;
+        kerberos = pkgs.krb5;
         libdefaults = {
           default_realm = "ATHENA.MIT.EDU";
         };
diff --git a/nixos/tests/kubernetes/dns.nix b/nixos/tests/kubernetes/dns.nix
index 6299b7ff988a..1b7145eb5d5e 100644
--- a/nixos/tests/kubernetes/dns.nix
+++ b/nixos/tests/kubernetes/dns.nix
@@ -69,7 +69,7 @@ let
   extraConfiguration = { config, pkgs, lib, ... }: {
     environment.systemPackages = [ pkgs.bind.host ];
     services.dnsmasq.enable = true;
-    services.dnsmasq.servers = [
+    services.dnsmasq.settings.server = [
       "/cluster.local/${config.services.kubernetes.addons.dns.clusterIp}#53"
     ];
   };
diff --git a/nixos/tests/prometheus-exporters.nix b/nixos/tests/prometheus-exporters.nix
index cdf666378fa3..8b40d7e41c00 100644
--- a/nixos/tests/prometheus-exporters.nix
+++ b/nixos/tests/prometheus-exporters.nix
@@ -1086,13 +1086,8 @@ let
         ];
       };
       exporterTest = ''
-        wait_for_unit("prometheus-smartctl-exporter.service")
-        wait_for_open_port(9633)
         wait_until_succeeds(
-          "curl -sSf 'localhost:9633/metrics'"
-        )
-        wait_until_succeeds(
-            'journalctl -eu prometheus-smartctl-exporter.service -o cat | grep "/dev/vda: Unable to detect device type"'
+            'journalctl -eu prometheus-smartctl-exporter.service -o cat | grep "Device unavailable"'
         )
       '';
     };
diff --git a/nixos/tests/schleuder.nix b/nixos/tests/schleuder.nix
index a9e4cc325bc7..e57ef66bb8f9 100644
--- a/nixos/tests/schleuder.nix
+++ b/nixos/tests/schleuder.nix
@@ -82,9 +82,7 @@ import ./make-test-python.nix {
     # Since we don't have internet here, use dnsmasq to provide MX records from /etc/hosts
     services.dnsmasq = {
       enable = true;
-      extraConfig = ''
-        selfmx
-      '';
+      settings.selfmx = true;
     };
 
     networking.extraHosts = ''
diff --git a/nixos/tests/web-apps/peering-manager.nix b/nixos/tests/web-apps/peering-manager.nix
new file mode 100644
index 000000000000..56b7eebfadff
--- /dev/null
+++ b/nixos/tests/web-apps/peering-manager.nix
@@ -0,0 +1,40 @@
+import ../make-test-python.nix ({ lib, pkgs, ... }: {
+  name = "peering-manager";
+
+  meta = with lib.maintainers; {
+    maintainers = [ yuka ];
+  };
+
+  nodes.machine = { ... }: {
+    services.peering-manager = {
+      enable = true;
+      secretKeyFile = pkgs.writeText "secret" ''
+        abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789
+      '';
+    };
+  };
+
+  testScript = { nodes }: ''
+    machine.start()
+    machine.wait_for_unit("peering-manager.target")
+    machine.wait_until_succeeds("journalctl --since -1m --unit peering-manager --grep Listening")
+
+    print(machine.succeed(
+        "curl -sSfL http://[::1]:8001"
+    ))
+    with subtest("Home screen loads"):
+        machine.succeed(
+            "curl -sSfL http://[::1]:8001 | grep '<title>Home - Peering Manager</title>'"
+        )
+    with subtest("checks succeed"):
+        machine.succeed(
+            "systemctl stop peering-manager peering-manager-rq"
+        )
+        machine.succeed(
+            "sudo -u postgres psql -c 'ALTER USER \"peering-manager\" WITH SUPERUSER;'"
+        )
+        machine.succeed(
+            "cd ${nodes.machine.config.system.build.peeringManagerPkg}/opt/peering-manager ; peering-manager-manage test --no-input"
+        )
+  '';
+})
diff --git a/pkgs/applications/audio/audacity/default.nix b/pkgs/applications/audio/audacity/default.nix
index c12cc30df26d..7acf919ea5ea 100644
--- a/pkgs/applications/audio/audacity/default.nix
+++ b/pkgs/applications/audio/audacity/default.nix
@@ -67,7 +67,7 @@
 let
   inherit (lib) optionals;
   pname = "audacity";
-  version = "3.2.1";
+  version = "3.2.2";
 in
 stdenv.mkDerivation rec {
   inherit pname version;
@@ -76,7 +76,7 @@ stdenv.mkDerivation rec {
     owner = pname;
     repo = pname;
     rev = "Audacity-${version}";
-    sha256 = "sha256-7rfttp9LnfM2LBT5seupPyDckS7LEzWDZoqtLsGgqgI=";
+    sha256 = "sha256-vDkIBsXINo7g8lbDfXYTaz2AB6HWPc5resITllVNd6o=";
   };
 
   postPatch = ''
diff --git a/pkgs/applications/audio/cardinal/default.nix b/pkgs/applications/audio/cardinal/default.nix
index e1f6d25c2d7b..f1487312684e 100644
--- a/pkgs/applications/audio/cardinal/default.nix
+++ b/pkgs/applications/audio/cardinal/default.nix
@@ -21,12 +21,12 @@
 
 stdenv.mkDerivation rec {
   pname = "cardinal";
-  version = "22.10";
+  version = "22.11";
 
   src = fetchurl {
     url =
       "https://github.com/DISTRHO/Cardinal/releases/download/${version}/cardinal+deps-${version}.tar.xz";
-    sha256 = "sha256-qr6akeSN0y6cDVZ8Y6SNuJ8OnAuwrlJL1pqhPPJ+/EQ=";
+    sha256 = "sha256-xYQi209whY5/lN+6Fp7PTp7JSzL6RS6VL+Exst7RrS0=";
   };
 
   prePatch = ''
diff --git a/pkgs/applications/audio/mmtc/default.nix b/pkgs/applications/audio/mmtc/default.nix
index db6e0d27be75..5a229f0ae348 100644
--- a/pkgs/applications/audio/mmtc/default.nix
+++ b/pkgs/applications/audio/mmtc/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "mmtc";
-  version = "0.3.0";
+  version = "0.3.1";
 
   src = fetchFromGitHub {
     owner = "figsoda";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-fWd349IDlN6XNv7MrqJeLwkmevZoKXLSz8a09YWsNcI=";
+    sha256 = "sha256-7jQwa4BfyI1CPnMt1YEP9rE6cok90FbEJpyLAPFuxtE=";
   };
 
-  cargoSha256 = "sha256-WrEC3zWwY1plOn8DrspbJFI3R/fE6yDQT2u2lVubbQU=";
+  cargoSha256 = "sha256-f18aXs8PyA0IaGnPG568ZB/oPsAO+U44WsoDNEgKKXk=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/applications/audio/praat/default.nix b/pkgs/applications/audio/praat/default.nix
index b41913c4b91e..9ef53b980b93 100644
--- a/pkgs/applications/audio/praat/default.nix
+++ b/pkgs/applications/audio/praat/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "praat";
-  version = "6.3.01";
+  version = "6.3.02";
 
   src = fetchFromGitHub {
     owner = "praat";
     repo = "praat";
     rev = "v${version}";
-    sha256 = "sha256-BgfVbD/xQ3IaTMJhac6eSnbZQdBTDdqboruxSbKvbyE=";
+    sha256 = "sha256-sn/GWCw1bxtFjUUKkrPZVOe5qRQ5ATyII52CPHmlB3g=";
   };
 
   configurePhase = ''
diff --git a/pkgs/applications/audio/pt2-clone/default.nix b/pkgs/applications/audio/pt2-clone/default.nix
index bbabcb45187e..77695f968969 100644
--- a/pkgs/applications/audio/pt2-clone/default.nix
+++ b/pkgs/applications/audio/pt2-clone/default.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "pt2-clone";
-  version = "1.53.1";
+  version = "1.54";
 
   src = fetchFromGitHub {
     owner = "8bitbubsy";
     repo = "pt2-clone";
     rev = "v${version}";
-    sha256 = "sha256-7qBvv4D86uX8oqqJ+UDI+fbaG5g1+Zg1otuU9lqyTdo=";
+    sha256 = "sha256-d/BUt6jqJmw2MnerbvvhuUWpTHgQr47XuSoFDXo7GEQ=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/applications/audio/sooperlooper/default.nix b/pkgs/applications/audio/sooperlooper/default.nix
index a05a0174afc0..63cb7398201b 100644
--- a/pkgs/applications/audio/sooperlooper/default.nix
+++ b/pkgs/applications/audio/sooperlooper/default.nix
@@ -9,7 +9,7 @@
 , libxml2
 , libjack2
 , libsndfile
-, wxGTK30-gtk3
+, wxGTK30
 , libsigcxx
 , libsamplerate
 , rubberband
@@ -47,7 +47,7 @@ stdenv.mkDerivation rec {
     libxml2
     libjack2
     libsndfile
-    wxGTK30-gtk3
+    wxGTK30
     libsigcxx
     libsamplerate
     rubberband
diff --git a/pkgs/applications/audio/soundux/default.nix b/pkgs/applications/audio/soundux/default.nix
new file mode 100644
index 000000000000..f6616e58353e
--- /dev/null
+++ b/pkgs/applications/audio/soundux/default.nix
@@ -0,0 +1,142 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, cmake
+, pkg-config
+, makeBinaryWrapper
+, pipewire
+, libpulseaudio
+, libappindicator
+, libstartup_notification
+, openssl
+, libwnck
+, pcre
+, util-linux
+, libselinux
+, libsepol
+, libthai
+, libdatrie
+, xorg
+, libxkbcommon
+, libepoxy
+, dbus
+, at-spi2-core
+, nlohmann_json
+, fancypp
+, httplib
+, semver-cpp
+, webkitgtk
+, yt-dlp
+, ffmpeg
+, lsb-release
+}:
+
+stdenv.mkDerivation rec {
+  pname = "soundux";
+  version = "0.2.7";
+
+  src = fetchFromGitHub {
+    owner = "Soundux";
+    repo = "Soundux";
+    rev = version;
+    sha256 = "sha256-aSCsg6nJt6F+6O7UeXnvYva0vllTfsxK/cjaeOhObZY=";
+    fetchSubmodules = true;
+  };
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+    makeBinaryWrapper
+  ];
+
+  buildInputs = [
+    pipewire
+    libpulseaudio
+    libappindicator
+    openssl
+    libwnck
+    pcre
+    util-linux
+    libselinux
+    libsepol
+    libthai
+    libdatrie
+    xorg.libXdmcp
+    xorg.libXtst
+    xorg.libXres
+    libxkbcommon
+    libepoxy
+    dbus
+    at-spi2-core
+    nlohmann_json
+    fancypp
+    httplib
+    semver-cpp
+    libstartup_notification
+    webkitgtk
+    yt-dlp
+    ffmpeg
+  ];
+
+  postPatch = ''
+    # cannot be overwritten with variables
+    substituteInPlace CMakeLists.txt \
+      --replace "set(CMAKE_INSTALL_PREFIX \"/opt/soundux\" CACHE PATH \"Install path prefix, prepended onto install directories.\" FORCE)" "" \
+      --replace "/usr/share" "$out/usr/share"
+    substituteInPlace src/ui/impl/webview/webview.cpp \
+      --replace "/usr/share/pixmaps/soundux.png" "$out/share/pixmaps/soundux.png"
+  '';
+
+  # We need to append /opt to our CMAKE_INSTALL_PREFIX
+  dontAddPrefix = true;
+
+  preConfigure = ''
+    # This needs to be set in preConfigure to access the $prefix variable
+    export cmakeFlags="-DCMAKE_INSTALL_PREFIX=$prefix/opt $cmakeFlags"
+
+    # Replace some fetched submodules with symlinks nix packages.
+    rm -rf \
+      lib/json \
+      lib/fancypp \
+      lib/lib-httplib \
+      lib/semver
+
+    ln -s ${nlohmann_json} lib/json
+    ln -s ${fancypp} lib/fancypp
+    ln -s ${httplib} lib/lib-httplib
+    ln -s ${semver-cpp} lib/semver
+  '';
+
+  # Somehow some of the install destination paths in the build system still
+  # gets transformed to point to /var/empty/share, even though they are at least
+  # relative to the nix output directory with our earlier patching.
+  postInstall = ''
+    mv "$out/var/empty/share" "$out"
+    rm -rf "$out/var"
+    mkdir "$out/bin"
+    ln -s "$out/opt/soundux" "$out/bin"
+    substituteInPlace "$out/share/applications/soundux.desktop" \
+      --replace "/opt/soundux/soundux" "soundux"
+  '';
+
+  postFixup = let
+    rpaths = lib.makeLibraryPath [libwnck pipewire libpulseaudio];
+  in ''
+    # Wnck, PipeWire, and PulseAudio are dlopen-ed by Soundux, so they do
+    # not end up on the RPATH during the build process.
+    patchelf --add-rpath "${rpaths}" "$out/opt/soundux-${version}"
+
+    # Work around upstream bug https://github.com/Soundux/Soundux/issues/435
+    wrapProgram "$out/bin/soundux" \
+      --set WEBKIT_DISABLE_COMPOSITING_MODE 1 \
+      --prefix PATH : ${lib.makeBinPath [ yt-dlp ffmpeg lsb-release ]} \
+  '';
+
+  meta = with lib; {
+    description = "A cross-platform soundboard.";
+    homepage = "https://soundux.rocks/";
+    license = licenses.gpl3Plus;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ aidalgol ];
+  };
+}
diff --git a/pkgs/applications/audio/spek/default.nix b/pkgs/applications/audio/spek/default.nix
index 1a73b8adea72..74c53f96efdc 100644
--- a/pkgs/applications/audio/spek/default.nix
+++ b/pkgs/applications/audio/spek/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, autoreconfHook, intltool, pkg-config, ffmpeg, wxGTK30-gtk3, wrapGAppsHook }:
+{ lib, stdenv, fetchFromGitHub, autoreconfHook, intltool, pkg-config, ffmpeg, wxGTK30, gtk3, wrapGAppsHook }:
 
 stdenv.mkDerivation rec {
   pname = "spek";
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ autoreconfHook intltool pkg-config wrapGAppsHook ];
 
-  buildInputs = [ ffmpeg wxGTK30-gtk3 wxGTK30-gtk3.gtk ];
+  buildInputs = [ ffmpeg wxGTK30 gtk3 ];
 
   meta = with lib; {
     description = "Analyse your audio files by showing their spectrogram";
diff --git a/pkgs/applications/backup/deja-dup/default.nix b/pkgs/applications/backup/deja-dup/default.nix
index 9055b46284c0..afe3cde3a596 100644
--- a/pkgs/applications/backup/deja-dup/default.nix
+++ b/pkgs/applications/backup/deja-dup/default.nix
@@ -22,14 +22,14 @@
 
 stdenv.mkDerivation rec {
   pname = "deja-dup";
-  version = "43.4";
+  version = "44.0";
 
   src = fetchFromGitLab {
     domain = "gitlab.gnome.org";
     owner = "World";
     repo = pname;
     rev = version;
-    sha256 = "sha256-8eqrBQrMvS4cta5RP0ibo4Zc3B8hlkftxaRyvb6JuEY=";
+    sha256 = "sha256-dIH6VPgzJxvXEUtPAYQzpQ8I9R9MwsfeylV25ASfW/k=";
   };
 
   patches = [
diff --git a/pkgs/applications/backup/unifi-protect-backup/default.nix b/pkgs/applications/backup/unifi-protect-backup/default.nix
index dbfff51d8fde..b3d5acb85625 100644
--- a/pkgs/applications/backup/unifi-protect-backup/default.nix
+++ b/pkgs/applications/backup/unifi-protect-backup/default.nix
@@ -2,7 +2,7 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "unifi-protect-backup";
-  version = "0.7.4";
+  version = "0.8.3";
 
   format = "pyproject";
 
@@ -10,12 +10,14 @@ python3.pkgs.buildPythonApplication rec {
     owner = "ep1cman";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-4Kpz89yqKmxHmnaPYpvJ2hx46yfcaCYjOioyya+38vE=";
+    hash = "sha256-3iOaJZAvkhjiWLKI1m2hmVkWLaNtq74nQZYIm/XCgeA=";
   };
 
   preBuild = ''
     sed -i 's_click = "8.0.1"_click = "^8"_' pyproject.toml
     sed -i 's_pyunifiprotect = .*_pyunifiprotect = "*"_' pyproject.toml
+    sed -i 's_aiorun = .*_aiorun = "*"_' pyproject.toml
+    sed -i '/pylint/d' pyproject.toml
   '';
 
   nativeBuildInputs = with python3.pkgs; [
@@ -24,6 +26,8 @@ python3.pkgs.buildPythonApplication rec {
 
   propagatedBuildInputs = with python3.pkgs; [
     aiocron
+    aiorun
+    aiosqlite
     click
     pyunifiprotect
   ];
diff --git a/pkgs/applications/blockchains/electrs/default.nix b/pkgs/applications/blockchains/electrs/default.nix
index 35470a7b8542..0bc5c7baa416 100644
--- a/pkgs/applications/blockchains/electrs/default.nix
+++ b/pkgs/applications/blockchains/electrs/default.nix
@@ -24,8 +24,7 @@ rustPlatform.buildRustPackage rec {
   cargoHash = "sha256-p4t+G13XaCl7+IbX5YyBFF0PmARbw4XlRvnA0PRcjvQ=";
 
   # needed for librocksdb-sys
-  nativeBuildInputs = [ llvmPackages.clang ];
-  LIBCLANG_PATH = "${llvmPackages.libclang.lib}/lib";
+  nativeBuildInputs = [ rustPlatform.bindgenHook ];
 
   # link rocksdb dynamically
   ROCKSDB_INCLUDE_DIR = "${rocksdb}/include";
diff --git a/pkgs/applications/blockchains/ledger-live-desktop/default.nix b/pkgs/applications/blockchains/ledger-live-desktop/default.nix
index 4f6ae53ec784..3bed576e5dbf 100644
--- a/pkgs/applications/blockchains/ledger-live-desktop/default.nix
+++ b/pkgs/applications/blockchains/ledger-live-desktop/default.nix
@@ -2,11 +2,11 @@
 
 let
   pname = "ledger-live-desktop";
-  version = "2.49.2";
+  version = "2.50.0";
 
   src = fetchurl {
     url = "https://download.live.ledger.com/${pname}-${version}-linux-x86_64.AppImage";
-    hash = "sha256-8KGZRTJu3uGFyf4vogoC9kDrKegD8Op4Z7gqQK+UFl8=";
+    hash = "sha256-Xh0UwE2rgFmUI4mx/PHqhRkgw51/CuNPxrsxI9al2E8=";
   };
 
   appimageContents = appimageTools.extractType2 {
diff --git a/pkgs/applications/blockchains/lighthouse/default.nix b/pkgs/applications/blockchains/lighthouse/default.nix
index c778ce3f7575..8b54cc093159 100644
--- a/pkgs/applications/blockchains/lighthouse/default.nix
+++ b/pkgs/applications/blockchains/lighthouse/default.nix
@@ -10,6 +10,7 @@
 , protobuf
 , rustPlatform
 , Security
+, CoreFoundation
 , stdenv
 , testers
 , unzip
@@ -17,7 +18,7 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "lighthouse";
-  version = "3.2.1";
+  version = "3.3.0";
 
   # lighthouse/common/deposit_contract/build.rs
   depositContractSpecVersion = "0.12.1";
@@ -27,21 +28,21 @@ rustPlatform.buildRustPackage rec {
     owner = "sigp";
     repo = "lighthouse";
     rev = "v${version}";
-    sha256 = "sha256-Aqc3kk1rquhLKNZDlEun4bQpKI4Nsk7+Wr7E2IkJQEs=";
+    hash = "sha256-py64CWY3k5Z2mm9WduJ4Fh7lQ8b3sF6iIFsYYjndU5I=";
   };
 
-  cargoSha256 = "sha256-wGEk7OfEmyeRW65kq5stvKCdnCjfssyXUmNWGkGq42M=";
+  cargoHash = "sha256-0gWTniLkhuPpgdUkE6gpF9uHYT6BeWWgH6Mu7KpFx9w=";
 
   buildFeatures = [ "modern" "gnosis" ];
 
-  nativeBuildInputs = [ clang cmake perl protobuf ];
+  nativeBuildInputs = [ rustPlatform.bindgenHook cmake perl protobuf ];
 
   buildInputs = lib.optionals stdenv.isDarwin [
     Security
+  ] ++ lib.optionals (stdenv.isDarwin && stdenv.isx86_64) [
+    CoreFoundation
   ];
 
-  LIBCLANG_PATH = "${llvmPackages.libclang.lib}/lib";
-
   depositContractSpec = fetchurl {
     url = "https://raw.githubusercontent.com/ethereum/eth2.0-specs/v${depositContractSpecVersion}/deposit_contract/contracts/validator_registration.json";
     hash = "sha256-ZslAe1wkmkg8Tua/AmmEfBmjqMVcGIiYHwi+WssEwa8=";
diff --git a/pkgs/applications/blockchains/lndhub-go/default.nix b/pkgs/applications/blockchains/lndhub-go/default.nix
index a563703c6bcb..74f0d4f9f7bf 100644
--- a/pkgs/applications/blockchains/lndhub-go/default.nix
+++ b/pkgs/applications/blockchains/lndhub-go/default.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "lndhub-go";
-  version = "0.10.0";
+  version = "0.11.0";
 
   src = fetchFromGitHub {
     owner = "getAlby";
     repo = "lndhub.go";
     rev = "${version}";
-    sha256 = "sha256-f/CkmO0KHupmi4XZDWRbvesLnYIxT6DlThgX3S/kdJ8=";
+    sha256 = "sha256-UGrIj/0ysU4i6PQVkuIeyGdKNCMa9LxikaIPhSKGvaQ=";
   };
 
-  vendorSha256 = "sha256-SWQudULFRMrKmxY6ZgH0NL8d6UPxowQnovhRx+209D4=";
+  vendorSha256 = "sha256-AiRbUSgMoU8nTzis/7H9HRW2/xZxXFf39JipRbukeiA=";
 
   doCheck = false; # tests require networking
 
diff --git a/pkgs/applications/blockchains/nearcore/default.nix b/pkgs/applications/blockchains/nearcore/default.nix
index e484538f4168..a929406cee92 100644
--- a/pkgs/applications/blockchains/nearcore/default.nix
+++ b/pkgs/applications/blockchains/nearcore/default.nix
@@ -4,7 +4,7 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "nearcore";
-  version = "1.29.2";
+  version = "1.29.3";
 
   # https://github.com/near/nearcore/tags
   src = fetchFromGitHub {
@@ -13,10 +13,10 @@ rustPlatform.buildRustPackage rec {
     # there is also a branch for this version number, so we need to be explicit
     rev = "refs/tags/${version}";
 
-    sha256 = "sha256-dVju9emwTqNQCYST4HuwSWdafM0yxVS3JXXJqCdFEpc=";
+    sha256 = "sha256-Qbpp+ITWVFbigWLdSDHAo5JhHejEN2FknRIjcpcS2wY=";
   };
 
-  cargoSha256 = "sha256-k/JzKbWn5M+H6w1UEv2APzZNBZOBYZY09keyCrXaGCM=";
+  cargoSha256 = "sha256-GSgzJNpVGxbvGF6AtFQxGyev/9c8Roav1HBz0SCQyvw=";
   cargoPatches = [ ./0001-make-near-test-contracts-optional.patch ];
 
   postPatch = ''
@@ -42,14 +42,12 @@ rustPlatform.buildRustPackage rec {
   nativeBuildInputs = [
     pkg-config
     protobuf
+    rustPlatform.bindgenHook
   ];
 
   # fat LTO requires ~3.4GB RAM
   requiredSystemFeatures = [ "big-parallel" ];
 
-  LIBCLANG_PATH = "${llvmPackages.libclang.lib}/lib";
-  BINDGEN_EXTRA_CLANG_ARGS = "-isystem ${llvmPackages.libclang.lib}/lib/clang/${lib.getVersion llvmPackages.clang}/include";
-
   meta = with lib; {
     description = "Reference client for NEAR Protocol";
     homepage = "https://github.com/near/nearcore";
diff --git a/pkgs/applications/blockchains/polkadot/default.nix b/pkgs/applications/blockchains/polkadot/default.nix
index 443fe36143c5..596130337c7a 100644
--- a/pkgs/applications/blockchains/polkadot/default.nix
+++ b/pkgs/applications/blockchains/polkadot/default.nix
@@ -36,14 +36,13 @@ rustPlatform.buildRustPackage rec {
 
   buildInputs = lib.optionals stdenv.isDarwin [ Security ];
 
-  nativeBuildInputs = [ clang ];
+  nativeBuildInputs = [ rustPlatform.bindgenHook ];
 
   preBuild = ''
     export SUBSTRATE_CLI_GIT_COMMIT_HASH=$(cat .git_commit)
     rm .git_commit
   '';
 
-  LIBCLANG_PATH = "${llvmPackages.libclang.lib}/lib";
   PROTOC = "${protobuf}/bin/protoc";
 
   # NOTE: We don't build the WASM runtimes since this would require a more
diff --git a/pkgs/applications/blockchains/snarkos/default.nix b/pkgs/applications/blockchains/snarkos/default.nix
index 82c3555f64d6..fe8b24b6ca22 100644
--- a/pkgs/applications/blockchains/snarkos/default.nix
+++ b/pkgs/applications/blockchains/snarkos/default.nix
@@ -23,15 +23,13 @@ rustPlatform.buildRustPackage rec {
 
   # buildAndTestSubdir = "cli";
 
-  nativeBuildInputs = lib.optionals stdenv.isLinux [ pkg-config llvmPackages.clang ];
+  nativeBuildInputs = lib.optionals stdenv.isLinux [ pkg-config rustPlatform.bindgenHook ];
 
   # Needed to get openssl-sys to use pkg-config.
   OPENSSL_NO_VENDOR = 1;
   OPENSSL_LIB_DIR = "${lib.getLib openssl}/lib";
   OPENSSL_DIR="${lib.getDev openssl}";
 
-  LIBCLANG_PATH="${llvmPackages.libclang.lib}/lib";
-
   # TODO check why rust compilation fails by including the rocksdb from nixpkgs
   # Used by build.rs in the rocksdb-sys crate. If we don't set these, it would
   # try to build RocksDB from source.
diff --git a/pkgs/applications/blockchains/solana-validator/default.nix b/pkgs/applications/blockchains/solana-validator/default.nix
index 503d4b404e72..bb35f7be3889 100644
--- a/pkgs/applications/blockchains/solana-validator/default.nix
+++ b/pkgs/applications/blockchains/solana-validator/default.nix
@@ -68,12 +68,9 @@ rustPlatform.buildRustPackage rec {
   cargoBuildFlags = builtins.map (n: "--bin=${n}") solanaPkgs;
 
   # weird errors. see https://github.com/NixOS/nixpkgs/issues/52447#issuecomment-852079285
-  LIBCLANG_PATH = "${libclang.lib}/lib";
-  BINDGEN_EXTRA_CLANG_ARGS =
-    "-isystem ${libclang.lib}/lib/clang/${lib.getVersion clang}/include";
-  LLVM_CONFIG_PATH = "${llvm}/bin/llvm-config";
+  # LLVM_CONFIG_PATH = "${llvm}/bin/llvm-config";
 
-  nativeBuildInputs = [ clang llvm pkg-config protobuf rustfmt perl ];
+  nativeBuildInputs = [ pkg-config protobuf rustfmt perl rustPlatform.bindgenHook ];
   buildInputs =
     [ openssl zlib libclang hidapi ] ++ (lib.optionals stdenv.isLinux [ udev ]);
   strictDeps = true;
diff --git a/pkgs/applications/blockchains/teos/default.nix b/pkgs/applications/blockchains/teos/default.nix
index 197246770d0d..b1fb1a77c1d4 100644
--- a/pkgs/applications/blockchains/teos/default.nix
+++ b/pkgs/applications/blockchains/teos/default.nix
@@ -38,11 +38,8 @@ let
     perl  # used by openssl-sys to configure
     protobuf
     rustfmt
-    llvmPackages.clang
+    rustPlatform.bindgenHook
   ];
-
-
-  LIBCLANG_PATH = "${llvmPackages.libclang.lib}/lib";
 in
 {
   teos = rustPlatform.buildRustPackage {
@@ -50,7 +47,7 @@ in
     cargoSha256 = "sha256-7VYYYSMJ2JP1KuA8sD0X3wInubH/jbA/sgzsTsomyEc=";
     buildAndTestSubdir = "teos";
 
-    inherit version src cargoPatches buildInputs nativeBuildInputs LIBCLANG_PATH;
+    inherit version src cargoPatches buildInputs nativeBuildInputs;
 
     meta = common.meta // {
       description = "A Lightning watchtower compliant with BOLT13, written in Rust";
@@ -66,7 +63,7 @@ in
     cargoSha256 = "sha256-xL+DiEfgBYJQ1UJm7LAr1/f34pkU8FRl4Seic8MFAlM=";
     buildAndTestSubdir = "watchtower-plugin";
 
-    inherit version src cargoPatches buildInputs nativeBuildInputs LIBCLANG_PATH;
+    inherit version src cargoPatches buildInputs nativeBuildInputs;
 
     meta = common.meta // {
       description = "A Lightning watchtower plugin for clightning";
diff --git a/pkgs/applications/editors/emacs/elisp-packages/manual-packages/tsc/default.nix b/pkgs/applications/editors/emacs/elisp-packages/manual-packages/tsc/default.nix
index a9462298979d..9825ed0834a2 100644
--- a/pkgs/applications/editors/emacs/elisp-packages/manual-packages/tsc/default.nix
+++ b/pkgs/applications/editors/emacs/elisp-packages/manual-packages/tsc/default.nix
@@ -43,13 +43,9 @@ let
 
     pname = "tsc-dyn";
 
-    nativeBuildInputs = [ clang ];
+    nativeBuildInputs = [ rustPlatform.bindgenHook ];
     sourceRoot = "source/core";
 
-    configurePhase = ''
-      export LIBCLANG_PATH="${llvmPackages.libclang.lib}/lib"
-    '';
-
     postInstall = ''
       LIB=($out/lib/libtsc_dyn.*)
       TSC_PATH=$out/share/emacs/site-lisp/elpa/tsc-${version}
diff --git a/pkgs/applications/editors/gnome-builder/default.nix b/pkgs/applications/editors/gnome-builder/default.nix
index e7a018b26c62..634fd79282d4 100644
--- a/pkgs/applications/editors/gnome-builder/default.nix
+++ b/pkgs/applications/editors/gnome-builder/default.nix
@@ -41,13 +41,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-builder";
-  version = "43.2";
+  version = "43.4";
 
   outputs = [ "out" "devdoc" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "dzIhF6ERsnR7zOitYFeKZ5wgIeSGkRz29OY0FjKKuzM=";
+    sha256 = "Hg1tZ4RcGb7J463VlpX5pTHXKg5UKyA6zJD7OBInwrw=";
   };
 
   patches = [
diff --git a/pkgs/applications/editors/helix/default.nix b/pkgs/applications/editors/helix/default.nix
index d3d0c7c2f939..55135c255bfb 100644
--- a/pkgs/applications/editors/helix/default.nix
+++ b/pkgs/applications/editors/helix/default.nix
@@ -2,17 +2,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "helix";
-  version = "22.08.1";
+  version = "22.12";
 
   # This release tarball includes source code for the tree-sitter grammars,
   # which is not ordinarily part of the repository.
   src = fetchzip {
     url = "https://github.com/helix-editor/helix/releases/download/${version}/helix-${version}-source.tar.xz";
-    sha256 = "sha256-pqAhUxKeFN7eebVdNN3Ge38sA30SUSu4Xn4HDZAjjyY=";
+    sha256 = "sha256-En6SOyAPNPPzDGdm2XTjbGG0NQFGBVzjjoyCbdnHFao=";
     stripRoot = false;
   };
 
-  cargoSha256 = "sha256-idItRkymr+cxk3zv2mPBR/frCGvzEUdSAhY7gghfR3M=";
+  cargoSha256 = "sha256-oSS0LkLg2JSRLYoF0+FVQzFUJtFuVKtU2MWYenmFC0s=";
 
   nativeBuildInputs = [ installShellFiles makeWrapper ];
 
diff --git a/pkgs/applications/editors/jove/default.nix b/pkgs/applications/editors/jove/default.nix
index 2fd28714481c..01a428a9fd68 100644
--- a/pkgs/applications/editors/jove/default.nix
+++ b/pkgs/applications/editors/jove/default.nix
@@ -1,21 +1,24 @@
-{ lib, stdenv, fetchFromGitHub
+{ lib
+, stdenv
+, fetchFromGitHub
 , groff
-, ncurses
 , makeWrapper
-} :
+, ncurses
+}:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "jove";
-  version = "4.17.4.6";
+  version = "4.17.4.7";
 
   src = fetchFromGitHub {
     owner = "jonmacs";
     repo = "jove";
-    rev = version;
-    sha256 = "sha256-UCjqF0i43TSvtG5uxb2SA/F9oGBeo/WdEVJlrSSHV8g=";
+    rev = finalAttrs.version;
+    sha256 = "sha256-a8amp8JAI25XIeL8MzvJEAvv6B0oIaQvUOQlAaS3PeI=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
+
   buildInputs = [
     groff
     ncurses
@@ -34,11 +37,13 @@ stdenv.mkDerivation rec {
   '';
 
   meta = with lib; {
-    description = "Jonathan's Own Version of Emacs";
     homepage = "https://github.com/jonmacs/jove";
+    description = "Jonathan's Own Version of Emacs";
+    changelog = "https://github.com/jonmacs/jove/releases/tag/${finalAttrs.version}";
     license = licenses.bsd2;
     maintainers = with maintainers; [ AndersonTorres ];
     platforms = platforms.unix;
-    broken = stdenv.isDarwin; # never built on Hydra https://hydra.nixos.org/job/nixpkgs/trunk/jove.x86_64-darwin
+    # never built on Hydra: https://hydra.nixos.org/job/nixpkgs/trunk/jove.x86_64-darwin
+    broken = stdenv.isDarwin;
   };
-}
+})
diff --git a/pkgs/applications/editors/kakoune/plugins/update-shell.nix b/pkgs/applications/editors/kakoune/plugins/update-shell.nix
index ca83f09c7154..b323574169aa 100644
--- a/pkgs/applications/editors/kakoune/plugins/update-shell.nix
+++ b/pkgs/applications/editors/kakoune/plugins/update-shell.nix
@@ -2,7 +2,7 @@
 
 with pkgs;
 let
-  pyEnv = python3.withPackages (ps: [ ps.GitPython ]);
+  pyEnv = python3.withPackages (ps: [ ps.gitpython ]);
 in
 
 mkShell {
diff --git a/pkgs/applications/editors/neovim/default.nix b/pkgs/applications/editors/neovim/default.nix
index 0a3b5ca421d3..98859ec2ef3b 100644
--- a/pkgs/applications/editors/neovim/default.nix
+++ b/pkgs/applications/editors/neovim/default.nix
@@ -12,12 +12,10 @@
 , nodejs ? null, fish ? null, python3 ? null
 }:
 
-with lib;
-
 let
   neovimLuaEnv = lua.withPackages(ps:
     (with ps; [ lpeg luabitop mpack ]
-    ++ optionals doCheck [
+    ++ lib.optionals doCheck [
         nvim-client luv coxpcall busted luafilesystem penlight inspect
       ]
     ));
@@ -61,8 +59,8 @@ in
       neovimLuaEnv
       tree-sitter
       unibilium
-    ] ++ optionals stdenv.isDarwin [ libiconv CoreServices ]
-      ++ optionals doCheck [ glibcLocales procps ]
+    ] ++ lib.optionals stdenv.isDarwin [ libiconv CoreServices ]
+      ++ lib.optionals doCheck [ glibcLocales procps ]
     ;
 
     inherit doCheck;
@@ -86,7 +84,6 @@ in
       pyEnv      # for src/clint.py
     ];
 
-
     # nvim --version output retains compilation flags and references to build tools
     postPatch = ''
       substituteInPlace src/nvim/version.c --replace NVIM_VERSION_CFLAGS "";
@@ -101,7 +98,7 @@ in
       # third-party/CMakeLists.txt is not read at all.
       "-DUSE_BUNDLED=OFF"
     ]
-    ++ optional (!lua.pkgs.isLuaJIT) "-DPREFER_LUA=ON"
+    ++ lib.optional (!lua.pkgs.isLuaJIT) "-DPREFER_LUA=ON"
     ;
 
     preConfigure = lib.optionalString stdenv.isDarwin ''
@@ -112,7 +109,7 @@ in
       export VIMRUNTIME=$PWD/runtime
     '';
 
-    meta = {
+    meta = with lib; {
       description = "Vim text editor fork focused on extensibility and agility";
       longDescription = ''
         Neovim is a project that seeks to aggressively refactor Vim in order to:
diff --git a/pkgs/applications/editors/tiled/default.nix b/pkgs/applications/editors/tiled/default.nix
index 7be6d4897109..03c6d19b80c4 100644
--- a/pkgs/applications/editors/tiled/default.nix
+++ b/pkgs/applications/editors/tiled/default.nix
@@ -1,19 +1,65 @@
-{ lib, mkDerivation, fetchFromGitHub, pkg-config, qmake
-, python3, qtbase, qttools }:
+{ lib
+, stdenv
+, env
+, fetchFromGitHub
+, pkg-config
+, qbs
+, wrapQtAppsHook
+, qtbase
+, qtdeclarative
+, qttools
+, qtsvg
+, zlib
+, libGL
+}:
 
-mkDerivation rec {
+let
+  qtEnv = env "tiled-qt-env" [ qtbase qtdeclarative qtsvg qttools ];
+in
+
+stdenv.mkDerivation rec {
   pname = "tiled";
-  version = "1.8.4";
+  version = "1.9.2";
 
   src = fetchFromGitHub {
     owner = "bjorn";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-QYA2krbwH807BkzVST+/+sjSR6So/aGY/YenEjYxE48=";
+    sha256 = "sha256-026OO7r8n1BUapUtKRHvqKdSZiClTQIiYfajiC2TAcQ=";
   };
 
-  nativeBuildInputs = [ pkg-config qmake ];
-  buildInputs = [ python3 qtbase qttools ];
+  nativeBuildInputs = [ pkg-config qbs wrapQtAppsHook ];
+  buildInputs = [ qtEnv zlib libGL ];
+
+  outputs = [ "out" "dev" ];
+
+  strictDeps = true;
+
+  configurePhase = ''
+    runHook preConfigure
+
+    qbs setup-qt --settings-dir . ${qtEnv}/bin/qmake qtenv
+    qbs config --settings-dir . defaultProfile qtenv
+    qbs resolve --settings-dir . config:release qbs.installPrefix:/ projects.Tiled.installHeaders:true
+
+    runHook postConfigure
+  '';
+
+  buildPhase = ''
+    runHook preBuild
+
+    qbs build --settings-dir . config:release
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    qbs install --settings-dir . --install-root $out config:release
+
+    runHook postInstall
+  '';
 
   meta = with lib; {
     description = "Free, easy to use and flexible tile map editor";
diff --git a/pkgs/applications/editors/vim/macvim.nix b/pkgs/applications/editors/vim/macvim.nix
index 806e2f9d4fd0..f5b79ecdb01e 100644
--- a/pkgs/applications/editors/vim/macvim.nix
+++ b/pkgs/applications/editors/vim/macvim.nix
@@ -1,19 +1,20 @@
-{ lib, stdenv, fetchFromGitHub, runCommand, ncurses, gettext
-, pkg-config, cscope, ruby, tcl, perl, luajit
+{ lib
+, stdenv
+, fetchFromGitHub
+, runCommand
+, ncurses
+, gettext
+, pkg-config
+, cscope
+, ruby
+, tcl
+, perl
+, luajit
 , darwin
-
-, usePython27 ? false
-, python27 ? null, python37 ? null
+, python37
 }:
 
 let
-  python = if usePython27
-           then { pkg = python27; name = "python"; }
-           else { pkg = python37; name = "python3"; };
-in
-assert python.pkg != null;
-
-let
   # Building requires a few system tools to be in PATH.
   # Some of these we could patch into the relevant source files (such as xcodebuild and
   # qlmanage) but some are used by Xcode itself and we have no choice but to put them in PATH.
@@ -40,7 +41,7 @@ stdenv.mkDerivation {
 
   nativeBuildInputs = [ pkg-config buildSymlinks ];
   buildInputs = [
-    gettext ncurses cscope luajit ruby tcl perl python.pkg
+    gettext ncurses cscope luajit ruby tcl perl python37
   ];
 
   patches = [ ./macvim.patch ];
@@ -53,14 +54,14 @@ stdenv.mkDerivation {
       "--enable-multibyte"
       "--enable-nls"
       "--enable-luainterp=dynamic"
-      "--enable-${python.name}interp=dynamic"
+      "--enable-python3interp=dynamic"
       "--enable-perlinterp=dynamic"
       "--enable-rubyinterp=dynamic"
       "--enable-tclinterp=yes"
       "--without-local-dir"
       "--with-luajit"
       "--with-lua-prefix=${luajit}"
-      "--with-${python.name}-command=${python.pkg}/bin/${python.name}"
+      "--with-python3-command=${python37}/bin/python3"
       "--with-ruby-command=${ruby}/bin/ruby"
       "--with-tclsh=${tcl}/bin/tclsh"
       "--with-tlib=ncurses"
@@ -158,7 +159,7 @@ stdenv.mkDerivation {
     libperl=$(dirname $(find ${perl} -name "libperl.dylib"))
     install_name_tool -add_rpath ${luajit}/lib $exe
     install_name_tool -add_rpath ${tcl}/lib $exe
-    install_name_tool -add_rpath ${python.pkg}/lib $exe
+    install_name_tool -add_rpath ${python37}/lib $exe
     install_name_tool -add_rpath $libperl $exe
     install_name_tool -add_rpath ${ruby}/lib $exe
 
diff --git a/pkgs/applications/editors/vim/plugins/generated.nix b/pkgs/applications/editors/vim/plugins/generated.nix
index 0e7f5ecb3ed8..6188496a80ba 100644
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@@ -161,12 +161,12 @@ final: prev:
 
   LeaderF = buildVimPluginFrom2Nix {
     pname = "LeaderF";
-    version = "2022-10-13";
+    version = "2022-12-06";
     src = fetchFromGitHub {
       owner = "Yggdroot";
       repo = "LeaderF";
-      rev = "ebb1f3a20b83a950938c59200434a4e66b69612d";
-      sha256 = "0f25qsfpk5m92cc70pjjsbh1ph11aybw2rfraxwdrcywwdr61w7w";
+      rev = "1326f60715adf6c434c0a6287e071af02d13dc26";
+      sha256 = "1zk7xy8fm5hqvbcn3jcpw7x0l4vcjx7zi09a04xvds1jf09s8l6g";
     };
     meta.homepage = "https://github.com/Yggdroot/LeaderF/";
   };
@@ -281,12 +281,12 @@ final: prev:
 
   SchemaStore-nvim = buildVimPluginFrom2Nix {
     pname = "SchemaStore.nvim";
-    version = "2022-11-30";
+    version = "2022-12-06";
     src = fetchFromGitHub {
       owner = "b0o";
       repo = "SchemaStore.nvim";
-      rev = "39260e77f7471da2a14182f83ac58e1d2b1ff5be";
-      sha256 = "07jqpm7vhm10pjni0i4q0bjzf5mahi9rvz698cj66idzkmz2i89k";
+      rev = "cb67722e14fbfafd2ba3913bd9850005816ccccf";
+      sha256 = "1afsd603v2v68d7cwp9vhjbdy5b89jwrkrra284akc1gmzkbck3d";
     };
     meta.homepage = "https://github.com/b0o/SchemaStore.nvim/";
   };
@@ -486,12 +486,12 @@ final: prev:
 
   aerial-nvim = buildVimPluginFrom2Nix {
     pname = "aerial.nvim";
-    version = "2022-11-29";
+    version = "2022-12-01";
     src = fetchFromGitHub {
       owner = "stevearc";
       repo = "aerial.nvim";
-      rev = "38c6fe1c199b8f35918f7efc09cae3f8af56fd68";
-      sha256 = "0p5b05psbhm5aig4106vc6cd795zqwnc0blnngi3jb1snvzb22a5";
+      rev = "50d28ad4e3e1ff89b5fc1bff985760c19c2fa782";
+      sha256 = "1m8wix6myx572d13qbn3g77az9zwbiszcldjk1nqq3isz2ix2b8n";
       fetchSubmodules = true;
     };
     meta.homepage = "https://github.com/stevearc/aerial.nvim/";
@@ -535,12 +535,12 @@ final: prev:
 
   ale = buildVimPluginFrom2Nix {
     pname = "ale";
-    version = "2022-11-25";
+    version = "2022-12-06";
     src = fetchFromGitHub {
       owner = "dense-analysis";
       repo = "ale";
-      rev = "5ce2bf84ca00cee8f375f108952789302980ae57";
-      sha256 = "0494g5nd7289zvmk5k0x7wh1psiwdx3vnhzjz7sf3rcxi8nifc7g";
+      rev = "42a17dec166783dc50b7105a0837f715fe9bd432";
+      sha256 = "1l8g4aiyxw207nrrb0vjbyqc1n91smxv5g8n8m0hd6wlw0fia1ls";
     };
     meta.homepage = "https://github.com/dense-analysis/ale/";
   };
@@ -703,12 +703,12 @@ final: prev:
 
   aurora = buildVimPluginFrom2Nix {
     pname = "aurora";
-    version = "2022-11-15";
+    version = "2022-12-02";
     src = fetchFromGitHub {
       owner = "ray-x";
       repo = "aurora";
-      rev = "87ecb98982f11bb62a61a2ed4d46676c72918a4d";
-      sha256 = "147yd7v21y8b59wj89zc103q1lp8dzmkyciby2nn8qb1kzvwvh0g";
+      rev = "40e5b7d38b08b32a872986959cfad79b2ac00f12";
+      sha256 = "0xc6h7kpwjg3nmxlpzg1q2kbr396kq1wirgrrb8lfg6bywr8iari";
     };
     meta.homepage = "https://github.com/ray-x/aurora/";
   };
@@ -799,24 +799,24 @@ final: prev:
 
   barbar-nvim = buildVimPluginFrom2Nix {
     pname = "barbar.nvim";
-    version = "2022-11-21";
+    version = "2022-12-03";
     src = fetchFromGitHub {
       owner = "romgrk";
       repo = "barbar.nvim";
-      rev = "9347ed838e0bfd8993d29eac1294f82b8e04c0c3";
-      sha256 = "0iyxsvp2n2achwc8pxwb554wkv5dhsnblgydrh8wwkdld6116sva";
+      rev = "e5f1393350cf842389be289c03885b92ab29ffb3";
+      sha256 = "1dkbplm6h7gmf4w7gjs823qjczvvmlqqpnljlb91mglqpcd7wc87";
     };
     meta.homepage = "https://github.com/romgrk/barbar.nvim/";
   };
 
   barbecue-nvim = buildVimPluginFrom2Nix {
     pname = "barbecue.nvim";
-    version = "2022-11-30";
+    version = "2022-12-05";
     src = fetchFromGitHub {
       owner = "utilyre";
       repo = "barbecue.nvim";
-      rev = "2a8bff5c47ae7ef3ee2d362634be2d143948dc38";
-      sha256 = "0ncqyb5a5mxhzj3mpsn11342mbl0m54jfqga90ds5430d02mm6fb";
+      rev = "2f242375df96e8a82089d4424e5db0d237c5ae46";
+      sha256 = "14gbx10gpng0n2bb3x7lbzx9n3vdw900yw19fa8qf9mlvi36gpxx";
     };
     meta.homepage = "https://github.com/utilyre/barbecue.nvim/";
   };
@@ -919,12 +919,12 @@ final: prev:
 
   bufdelete-nvim = buildVimPluginFrom2Nix {
     pname = "bufdelete.nvim";
-    version = "2022-11-16";
+    version = "2022-12-04";
     src = fetchFromGitHub {
       owner = "famiu";
       repo = "bufdelete.nvim";
-      rev = "3ebf4a98c380ec27b3066eaa5f1fdda332df1a9d";
-      sha256 = "1cnlhl7kin27v57l2v4yn9v4kvdb9lp4h20ipyw3jh7r13p3y8gv";
+      rev = "f79e9d186b42fba5f1b1362006e7c70240db97a4";
+      sha256 = "08avd9icr7jclljlkzg8q74c95g0knzhxkldgfg9kl298h7qc521";
     };
     meta.homepage = "https://github.com/famiu/bufdelete.nvim/";
   };
@@ -979,12 +979,12 @@ final: prev:
 
   calendar-vim = buildVimPluginFrom2Nix {
     pname = "calendar.vim";
-    version = "2022-10-27";
+    version = "2022-12-05";
     src = fetchFromGitHub {
       owner = "itchyny";
       repo = "calendar.vim";
-      rev = "e4b6212f028f4293f965ed7d83e21516fe9d94c1";
-      sha256 = "10dblr72w8zjckjz8ikpfh0f06ljm07aby27m6cbgjyf0qmsyjjv";
+      rev = "8eee411e280277cd186a3fea0debe754132b5b7b";
+      sha256 = "0haf5ls2y7p6b6nc7b9wlr47h7wbxnk8v6m2mpgvdmbrqylwp9zp";
     };
     meta.homepage = "https://github.com/itchyny/calendar.vim/";
   };
@@ -1195,12 +1195,12 @@ final: prev:
 
   cmp-conjure = buildVimPluginFrom2Nix {
     pname = "cmp-conjure";
-    version = "2021-10-09";
+    version = "2022-12-05";
     src = fetchFromGitHub {
       owner = "PaterJason";
       repo = "cmp-conjure";
-      rev = "ca39e595a0a64150a3fbad340635b0179fe275ec";
-      sha256 = "08vpd8ibz9472iblw0qc64phvwvkm0byrkvw9b9lq0jcsmw2sgs5";
+      rev = "d76e1fe5d724afe604dfa7b4b5ba93f3d3730617";
+      sha256 = "026kmjrhfwqllr8qh0z4jgdl2fcxy4cqf33yy4lnalkgvapnja5s";
     };
     meta.homepage = "https://github.com/PaterJason/cmp-conjure/";
   };
@@ -1735,12 +1735,12 @@ final: prev:
 
   coc-nvim = buildVimPluginFrom2Nix {
     pname = "coc.nvim";
-    version = "2022-11-30";
+    version = "2022-12-06";
     src = fetchFromGitHub {
       owner = "neoclide";
       repo = "coc.nvim";
-      rev = "2c4d06e9fc712b259ae2320020818fbf4c533273";
-      sha256 = "0b5fq7p5ddydxk1zy1s2b93x019n5mxn7vma3ij4ry9lhc1sqxi3";
+      rev = "6adfb13aa16733aa5ede483f428750ce03954c4d";
+      sha256 = "02nchj8kb038x75p7p4kvlpvvhfnc51v88ymffpjszplxmih5znn";
     };
     meta.homepage = "https://github.com/neoclide/coc.nvim/";
   };
@@ -1759,12 +1759,12 @@ final: prev:
 
   codi-vim = buildVimPluginFrom2Nix {
     pname = "codi.vim";
-    version = "2022-08-16";
+    version = "2022-12-02";
     src = fetchFromGitHub {
       owner = "metakirby5";
       repo = "codi.vim";
-      rev = "28983696f59f47221380b4f7d78237dc04f9c62f";
-      sha256 = "11di3w5gvw6a0npjj6y4n7ajra0xzv20nmz7rvq4aw78cvgrxa6a";
+      rev = "6537ba677a0c7c6c796b195f29077b57fad33716";
+      sha256 = "01rk4i212zcas64hk3d2a15qvn8rxwlkghzci2cd1n79ywj0q9xd";
     };
     meta.homepage = "https://github.com/metakirby5/codi.vim/";
   };
@@ -1807,12 +1807,12 @@ final: prev:
 
   command-t = buildVimPluginFrom2Nix {
     pname = "command-t";
-    version = "2022-10-21";
+    version = "2022-12-01";
     src = fetchFromGitHub {
       owner = "wincent";
       repo = "command-t";
-      rev = "491ffa37ea7033850998d7f0ef04387c063ed2f6";
-      sha256 = "19pdrway7zx0rd9w96i8dl84v5m2ac8ag1c0qg3dny9c6ain2bjv";
+      rev = "429b6b7b77764f5a660bd1d0c356029e32d71062";
+      sha256 = "0d6854rm5q782hvapais9lnhrblmr9vvwanhc6jqa42g7946d61p";
     };
     meta.homepage = "https://github.com/wincent/command-t/";
   };
@@ -2011,36 +2011,36 @@ final: prev:
 
   copilot-vim = buildVimPluginFrom2Nix {
     pname = "copilot.vim";
-    version = "2022-11-09";
+    version = "2022-12-06";
     src = fetchFromGitHub {
       owner = "github";
       repo = "copilot.vim";
-      rev = "5a411d19ce7334ab10ba12516743fc25dad363fa";
-      sha256 = "1v72i3f1w7q481grffm2grb9m11qiazs85xq3j89yiqh6jvvpvzh";
+      rev = "2f4f9259a5c0f927b31c4256cd3e4d7c6df87662";
+      sha256 = "0sl6n0hi3y7hw7yyd4p93dpqxq8vvgl4h89640579k28hms22i45";
     };
     meta.homepage = "https://github.com/github/copilot.vim/";
   };
 
   coq-artifacts = buildVimPluginFrom2Nix {
     pname = "coq.artifacts";
-    version = "2022-12-01";
+    version = "2022-12-07";
     src = fetchFromGitHub {
       owner = "ms-jpq";
       repo = "coq.artifacts";
-      rev = "eea760e43c5800bbcb8d6053f5502ada3774b860";
-      sha256 = "0n853wbpg02lw41lzs3c8yyq7ag363li0sslgrmli5h3fsd8d3j4";
+      rev = "295c64b9f9084a78db4eee7450483ce3caf541e0";
+      sha256 = "1ga254s56gbyyywwif4lhfgak3w5gam5ldry33d8h7nqfrvbmmdr";
     };
     meta.homepage = "https://github.com/ms-jpq/coq.artifacts/";
   };
 
   coq-thirdparty = buildVimPluginFrom2Nix {
     pname = "coq.thirdparty";
-    version = "2022-12-01";
+    version = "2022-12-07";
     src = fetchFromGitHub {
       owner = "ms-jpq";
       repo = "coq.thirdparty";
-      rev = "ed621364ec22289e912f680b9e5adc17be5af817";
-      sha256 = "1xwnv4agszdqj7izspgzy8qsyhdzg8ydamrpn51611aafxzz74vm";
+      rev = "b601b48b9a12ab4cd5baedc633f88b48a74100c5";
+      sha256 = "0m93y7m159plhwwrsdqr7d651fzbp0z3p49g9l4v199kvsq0x50a";
     };
     meta.homepage = "https://github.com/ms-jpq/coq.thirdparty/";
   };
@@ -2059,12 +2059,12 @@ final: prev:
 
   coq_nvim = buildVimPluginFrom2Nix {
     pname = "coq_nvim";
-    version = "2022-12-01";
+    version = "2022-12-07";
     src = fetchFromGitHub {
       owner = "ms-jpq";
       repo = "coq_nvim";
-      rev = "61ba300a71bf274af5c7a5069ab102729af79297";
-      sha256 = "0718b7fpl10hpsaw09c4ylkxw8dflb0s2b449q8b8dcwqpgssm51";
+      rev = "fd9c9eb2361f327969368f8eeadd063e5a7d5abe";
+      sha256 = "070a632szjhb342jz41gg7lhw4m11wi5n33f1z8mhc976yy53cas";
     };
     meta.homepage = "https://github.com/ms-jpq/coq_nvim/";
   };
@@ -2589,12 +2589,12 @@ final: prev:
 
   diffview-nvim = buildVimPluginFrom2Nix {
     pname = "diffview.nvim";
-    version = "2022-11-29";
+    version = "2022-12-06";
     src = fetchFromGitHub {
       owner = "sindrets";
       repo = "diffview.nvim";
-      rev = "6a82dfcb59f0af1e814f34bf8344d68afe8618ec";
-      sha256 = "1yggvdb0mzcimpv83jbrvyvp1m6k31i67dq05grwq879dr05igm9";
+      rev = "e37b2d9aaba408954d0e894e27e6f4dbf939ef95";
+      sha256 = "0a9m0ymjj6y1nmpf0yxzvqnz1j2ppwis43a26iqr94i4n5kva393";
     };
     meta.homepage = "https://github.com/sindrets/diffview.nvim/";
   };
@@ -2613,36 +2613,36 @@ final: prev:
 
   doki-theme-vim = buildVimPluginFrom2Nix {
     pname = "doki-theme-vim";
-    version = "2022-11-16";
+    version = "2022-12-06";
     src = fetchFromGitHub {
       owner = "doki-theme";
       repo = "doki-theme-vim";
-      rev = "2d1345239ae7327339bcbd645425ec993bc855d1";
-      sha256 = "1p2vjxry2bf9avxnf3hfbvxz8h37gh9rsdw4km3v42aphk49lvr0";
+      rev = "a83452264666eeb966b7fd5f48ddf15b8ca05450";
+      sha256 = "1v84dz04xbwwhh61fvpmfvydpvj5wkqskml908rgjzmk6y3hp8wq";
     };
     meta.homepage = "https://github.com/doki-theme/doki-theme-vim/";
   };
 
   dracula-nvim = buildVimPluginFrom2Nix {
     pname = "dracula.nvim";
-    version = "2022-11-29";
+    version = "2022-12-06";
     src = fetchFromGitHub {
       owner = "Mofiqul";
       repo = "dracula.nvim";
-      rev = "3023bc68d286676115b660142fe126fc5a4374ae";
-      sha256 = "1c7swpgbwss6f39c28p4gh5di153k7x3ycpkpx99qn8pjg27cfiv";
+      rev = "7645a4de7d60a31ff75ddda52f224889ee4cc3f5";
+      sha256 = "0nc4pzwa6nzk5nc5h6qx9srawq5vb0nl2f7dhkcrwv2k4mci3b56";
     };
     meta.homepage = "https://github.com/Mofiqul/dracula.nvim/";
   };
 
   dressing-nvim = buildVimPluginFrom2Nix {
     pname = "dressing.nvim";
-    version = "2022-11-18";
+    version = "2022-12-05";
     src = fetchFromGitHub {
       owner = "stevearc";
       repo = "dressing.nvim";
-      rev = "7894d5bc504deacf37f0a479a53fa4746fe30a45";
-      sha256 = "1jw8y86lq7k9d1ss4dg3ch1ij8c3b196g8giz881jipdkjy9q7w1";
+      rev = "ed44aa798ab07dc298f43f35c8e0c93a1b335abb";
+      sha256 = "0di5cwq25in8q9vj8ww8blrvf76hsm5qd1bac67blx3z8qsdpb16";
     };
     meta.homepage = "https://github.com/stevearc/dressing.nvim/";
   };
@@ -2747,12 +2747,12 @@ final: prev:
 
   everforest = buildVimPluginFrom2Nix {
     pname = "everforest";
-    version = "2022-11-21";
+    version = "2022-12-07";
     src = fetchFromGitHub {
       owner = "sainnhe";
       repo = "everforest";
-      rev = "d855af543410c4047fc03798f5d58ddd07abcf2d";
-      sha256 = "0sjy8gpmcfs2byj23bnscfjawabdbkj5nqk0mkhax3p1kcvcm1fx";
+      rev = "bed286c9f787a2b6f49edaa47bc286ff93a304b5";
+      sha256 = "1987f2nm1rg5ig5qbi1nfsmm2iamypbimhw38m7ammv1wda840fx";
     };
     meta.homepage = "https://github.com/sainnhe/everforest/";
   };
@@ -2807,12 +2807,12 @@ final: prev:
 
   feline-nvim = buildVimPluginFrom2Nix {
     pname = "feline.nvim";
-    version = "2022-11-16";
+    version = "2022-12-04";
     src = fetchFromGitHub {
       owner = "feline-nvim";
       repo = "feline.nvim";
-      rev = "6d4e3f934bffaa1893a690cd9b8f8b584ef0a7ea";
-      sha256 = "10bwbw2fhmyhscm135jd4qc091xzqb155y2bbn7ms35jrwvaz0z4";
+      rev = "573e6d1e213de976256c84e1cb2f55665549b828";
+      sha256 = "0m54mdxkpx4ds7clydiclq8m41vcf1sg6689r3kyp3q537kmc9k1";
     };
     meta.homepage = "https://github.com/feline-nvim/feline.nvim/";
   };
@@ -2976,12 +2976,12 @@ final: prev:
 
   friendly-snippets = buildVimPluginFrom2Nix {
     pname = "friendly-snippets";
-    version = "2022-11-30";
+    version = "2022-12-05";
     src = fetchFromGitHub {
       owner = "rafamadriz";
       repo = "friendly-snippets";
-      rev = "b4f857a1d94d05e747951b1e8cb1a6c567396898";
-      sha256 = "1z4nkk846dh3c8rj7dliw42vz6fwhj7rf1gwjwa4s7nk8f6xq545";
+      rev = "9b3e497cf0c3abcf73d791968a9768a22405fa13";
+      sha256 = "14j3w7aqnz62fxkrhyklbip9qpdj0cmfxj3japvxbjksh7iba35b";
     };
     meta.homepage = "https://github.com/rafamadriz/friendly-snippets/";
   };
@@ -3132,12 +3132,12 @@ final: prev:
 
   gentoo-syntax = buildVimPluginFrom2Nix {
     pname = "gentoo-syntax";
-    version = "2022-07-13";
+    version = "2022-12-04";
     src = fetchFromGitHub {
       owner = "gentoo";
       repo = "gentoo-syntax";
-      rev = "3bc67579b990d53cdcf2ba9b016995b41d2b26a3";
-      sha256 = "1przyjqp6pjgbmiwx378k5dx5p1j18c5f89zqjihr52q0p7x90f0";
+      rev = "526aeb1acda9504a4293b2a221700f6441211a7d";
+      sha256 = "0nzsn79m3xk338gikz0qk7lqriia0fjfxbw3k9aj5h3kqxw7qgmw";
     };
     meta.homepage = "https://github.com/gentoo/gentoo-syntax/";
   };
@@ -3396,12 +3396,12 @@ final: prev:
 
   gruvbox-nvim = buildVimPluginFrom2Nix {
     pname = "gruvbox.nvim";
-    version = "2022-11-28";
+    version = "2022-12-06";
     src = fetchFromGitHub {
       owner = "ellisonleao";
       repo = "gruvbox.nvim";
-      rev = "02a9182c66a8347d8328a32d58535dfb9785f6aa";
-      sha256 = "0dwi86i6bzzbhblr8whb2bnkra4lv5zm0xvyfjn1s0qj5gs3ammw";
+      rev = "d2efdea91ec79e480e51d5149d58daa328633c43";
+      sha256 = "1nqx2g2z1gbg907n7vhcgak4bd0qz7na5pl8i3jyk5cc22z0mzfc";
     };
     meta.homepage = "https://github.com/ellisonleao/gruvbox.nvim/";
   };
@@ -3467,12 +3467,12 @@ final: prev:
 
   haskell-tools-nvim = buildVimPluginFrom2Nix {
     pname = "haskell-tools.nvim";
-    version = "2022-11-29";
+    version = "2022-12-06";
     src = fetchFromGitHub {
       owner = "MrcJkb";
       repo = "haskell-tools.nvim";
-      rev = "9aa1de666b94ba31a3527f3316a202542bc528c9";
-      sha256 = "1c54bk8125a5bjra58h2fkpmcv7p1kgpjdq62rkdhl7ygqvp59r5";
+      rev = "d21677e8901577b52b37dadec03030c4e5f4cd53";
+      sha256 = "1jlr8yp5vkx3vs5i3cprmhljsnrq54ssj1nqcjgmmak2brhlgrjz";
     };
     meta.homepage = "https://github.com/MrcJkb/haskell-tools.nvim/";
   };
@@ -3586,12 +3586,12 @@ final: prev:
 
   hotpot-nvim = buildVimPluginFrom2Nix {
     pname = "hotpot.nvim";
-    version = "2022-11-12";
+    version = "2022-12-02";
     src = fetchFromGitHub {
       owner = "rktjmp";
       repo = "hotpot.nvim";
-      rev = "562e3e0e04c092c43a9cddffae4c9a748afb186f";
-      sha256 = "0gvr9fwbc22m2rfwz3ficlrk5yk0q4zaaplma4l5zarrxswv9csb";
+      rev = "1002bcdea7af06c5a7bfce0536d96bc4b03ab42e";
+      sha256 = "0cbw07w65kmp1w2l2k4vbnv10vhpj30ija14mdn8mfbqwbp8pb2j";
     };
     meta.homepage = "https://github.com/rktjmp/hotpot.nvim/";
   };
@@ -4007,12 +4007,12 @@ final: prev:
 
   lean-nvim = buildVimPluginFrom2Nix {
     pname = "lean.nvim";
-    version = "2022-11-30";
+    version = "2022-12-04";
     src = fetchFromGitHub {
       owner = "Julian";
       repo = "lean.nvim";
-      rev = "9fad72569b54f067b6ad0bdafd47ce7b23578b79";
-      sha256 = "1cvj59v267av6lh2wzpmqd05pa7fjvfprbs2r7gql6gr992x2s59";
+      rev = "25cfbde4c5c01133ec36fbc0fd44d9c7cf99e397";
+      sha256 = "02d43j8v5lnwg48x11nzdh270fhia1flbqv682ss391zcl0z2h7q";
     };
     meta.homepage = "https://github.com/Julian/lean.nvim/";
   };
@@ -4043,24 +4043,24 @@ final: prev:
 
   leap-nvim = buildVimPluginFrom2Nix {
     pname = "leap.nvim";
-    version = "2022-11-28";
+    version = "2022-12-05";
     src = fetchFromGitHub {
       owner = "ggandor";
       repo = "leap.nvim";
-      rev = "f7391b5fe9771d788816383ee3c75e0be92022af";
-      sha256 = "1xxlpz6y66h8xs8bfl0bq46gkhvdi275vsmrwbac1lwk76v9b8kq";
+      rev = "f28b1e7c1eee525adb17c24de3cc15a7fa1a6ef9";
+      sha256 = "0b311535cvqybg4m517wm7xpjrc0shi3za56c0v5zs6sjnm0n2vs";
     };
     meta.homepage = "https://github.com/ggandor/leap.nvim/";
   };
 
   legendary-nvim = buildVimPluginFrom2Nix {
     pname = "legendary.nvim";
-    version = "2022-11-17";
+    version = "2022-12-07";
     src = fetchFromGitHub {
       owner = "mrjones2014";
       repo = "legendary.nvim";
-      rev = "3b643d7bb4a521e0c9f0fcd00f299b1432441eb8";
-      sha256 = "1mq7c382bzd8kwqlx2lljqkd96cr0yz9zha2zyg6vz4l60aa53h3";
+      rev = "78cc8984cd5f3afb71f8f053f0a1d4708069f2c8";
+      sha256 = "08n243nz39sw6c6ihaz9x64ws1vlj7pp180lrhl3ifqgnaj1ymfb";
     };
     meta.homepage = "https://github.com/mrjones2014/legendary.nvim/";
   };
@@ -4343,24 +4343,24 @@ final: prev:
 
   lsp-inlayhints-nvim = buildVimPluginFrom2Nix {
     pname = "lsp-inlayhints.nvim";
-    version = "2022-10-11";
+    version = "2022-12-05";
     src = fetchFromGitHub {
       owner = "lvimuser";
       repo = "lsp-inlayhints.nvim";
-      rev = "439b4811276a149e3fccb226cc9a43ff2fb0e33b";
-      sha256 = "08yhjc5zqvjv8m254d7vrhz3nhm8dr4xckhmd9q0sazp8pjd5b8h";
+      rev = "a28c51a6362e3faa17f67749436cb5c8b55dcc6d";
+      sha256 = "1hvn8y1mqd853aa2dm7156g4fvwq21qmmkicsl50czq4mf9vgvd1";
     };
     meta.homepage = "https://github.com/lvimuser/lsp-inlayhints.nvim/";
   };
 
   lsp-overloads-nvim = buildVimPluginFrom2Nix {
     pname = "lsp-overloads.nvim";
-    version = "2022-10-21";
+    version = "2022-12-04";
     src = fetchFromGitHub {
       owner = "Issafalcon";
       repo = "lsp-overloads.nvim";
-      rev = "2d8671d6787045bed518dce9c2f82a0ece76ed66";
-      sha256 = "1v873y2b52v2sa09ans6rs3f5kylb6izx2ffd9wpdg5y8i9s83s1";
+      rev = "12f5468781d2d1d3feb6ad7459de764fc33898fe";
+      sha256 = "1lxsg05qv87v2imhsfwa9mqfib4332cvhflivpzkamg1acs6bc9j";
     };
     meta.homepage = "https://github.com/Issafalcon/lsp-overloads.nvim/";
   };
@@ -4414,12 +4414,12 @@ final: prev:
 
   lsp_signature-nvim = buildVimPluginFrom2Nix {
     pname = "lsp_signature.nvim";
-    version = "2022-11-30";
+    version = "2022-12-04";
     src = fetchFromGitHub {
       owner = "ray-x";
       repo = "lsp_signature.nvim";
-      rev = "2f3e5745ee7a0610ffde2b4331460151d4707724";
-      sha256 = "0c0ap6xkncbsvy08897ah4sw4f6s99q9m5jp0i3a0akvw3zpn21n";
+      rev = "9a7e5a093a58b2eefcf77f4a84b8d8c274725d0f";
+      sha256 = "0pmghzzqjm5bvcmaqfq65rabc0p0n6fc5x3j682glm0fjrnlgzj9";
     };
     meta.homepage = "https://github.com/ray-x/lsp_signature.nvim/";
   };
@@ -4450,12 +4450,12 @@ final: prev:
 
   lspsaga-nvim = buildVimPluginFrom2Nix {
     pname = "lspsaga.nvim";
-    version = "2022-08-20";
+    version = "2022-12-06";
     src = fetchFromGitHub {
       owner = "kkharji";
       repo = "lspsaga.nvim";
-      rev = "9ec569a49aa7ff265764081acff9e5da839c13fe";
-      sha256 = "1h4r63na7n18pnfbl0n3x7pkfm1pd01zz2h0py6pxd1az6il9dng";
+      rev = "5faeec9f2508d2d49a66c0ac0d191096b4e3fa81";
+      sha256 = "1bw71db69na2sriv9q167z9bgkir4nwny1bdfv9z606bmng4hhzc";
     };
     meta.homepage = "https://github.com/kkharji/lspsaga.nvim/";
   };
@@ -4486,12 +4486,12 @@ final: prev:
 
   luasnip = buildVimPluginFrom2Nix {
     pname = "luasnip";
-    version = "2022-11-27";
+    version = "2022-12-05";
     src = fetchFromGitHub {
       owner = "l3mon4d3";
       repo = "luasnip";
-      rev = "3fa5c8d938e4ed9dcfd3e07d13b587cba4f87e7d";
-      sha256 = "0pf4z4c4iaqzh40gsc4gs55kl6821sjhyp0x8pjahl2spqxm3nn3";
+      rev = "5ce70a08442e97ac55ce14e71dd7d151ea5f4d8e";
+      sha256 = "1fncj4l72pwhwx9drqplm432zjg76y4clyw2kdpivs6nvghisjfv";
       fetchSubmodules = true;
     };
     meta.homepage = "https://github.com/l3mon4d3/luasnip/";
@@ -4607,12 +4607,12 @@ final: prev:
 
   mini-nvim = buildVimPluginFrom2Nix {
     pname = "mini.nvim";
-    version = "2022-11-22";
+    version = "2022-12-02";
     src = fetchFromGitHub {
       owner = "echasnovski";
       repo = "mini.nvim";
-      rev = "d00abe8169993b95f52ff64fbfe685f353fd1c4f";
-      sha256 = "1vq968253hj82bix9gs7r48dxzfhsrjdlx0ssmbv97g96qd46ai7";
+      rev = "6402c79d73c07ad19374dc7b4f9d4bdfc2f57f42";
+      sha256 = "0iqc4l9qdr1y3nbkzijcp2c1in8r1ybqvbjl9p92x6zdvmxff2jr";
     };
     meta.homepage = "https://github.com/echasnovski/mini.nvim/";
   };
@@ -4967,12 +4967,12 @@ final: prev:
 
   neoconf-nvim = buildVimPluginFrom2Nix {
     pname = "neoconf.nvim";
-    version = "2022-11-30";
+    version = "2022-12-07";
     src = fetchFromGitHub {
       owner = "folke";
       repo = "neoconf.nvim";
-      rev = "681e89d58d46a7c63ee091fee32220373dda1072";
-      sha256 = "000inylrbyyfc1lg1ajmi1rb2jrcisglgc44gk3cf9iv7v1515dd";
+      rev = "a292a8a4927278c4c9e7653cf0a37cd40c17d0fb";
+      sha256 = "1j2n4k02b5648ayarqdcw312ynd9j50gm3l5ish6fav6k4ipngq6";
     };
     meta.homepage = "https://github.com/folke/neoconf.nvim/";
   };
@@ -4991,36 +4991,36 @@ final: prev:
 
   neodev-nvim = buildVimPluginFrom2Nix {
     pname = "neodev.nvim";
-    version = "2022-11-29";
+    version = "2022-12-07";
     src = fetchFromGitHub {
       owner = "folke";
       repo = "neodev.nvim";
-      rev = "dbed20332724909b26b5b1a083303654a6c15c20";
-      sha256 = "1v5x0g49wpfm9qnqdyj27m2bnx7jr2j6hq91fhkqyy13y76qjq2w";
+      rev = "f353ec5ac10a9e581c92dc0f937025c54e216022";
+      sha256 = "1wmy5hncm1lz5r99vcspg95435yyg0jdzm2kjca79nsmqp613ffl";
     };
     meta.homepage = "https://github.com/folke/neodev.nvim/";
   };
 
   neoformat = buildVimPluginFrom2Nix {
     pname = "neoformat";
-    version = "2022-11-24";
+    version = "2022-12-06";
     src = fetchFromGitHub {
       owner = "sbdchd";
       repo = "neoformat";
-      rev = "a09d6ed9eacd0b81c0f8641757e60f7bb0e27f6e";
-      sha256 = "1pqz1bz5nwdrm4x0p38xhabyb089spvp5khhl154k5mi6fsws219";
+      rev = "902f674b9e8a703fad9dafdda9d8f7c88ecf689f";
+      sha256 = "12zxmyhk06xiyr5sahqip9pf6f5zyvr46yb6a4ayzdk81k8wmdky";
     };
     meta.homepage = "https://github.com/sbdchd/neoformat/";
   };
 
   neogit = buildVimPluginFrom2Nix {
     pname = "neogit";
-    version = "2022-11-28";
+    version = "2022-12-06";
     src = fetchFromGitHub {
       owner = "TimUntersberger";
       repo = "neogit";
-      rev = "74e14e3c885f0caf64004d1c1e75dcbef96e10e5";
-      sha256 = "1sdv73v5wzqvfbmrlj6vmwpvgyy9afw6nji5nc1wmhw74cwq2r3a";
+      rev = "19bc8377e61482f36703a3e1651aef206af88086";
+      sha256 = "0599ljv4f8vsk3h4rpisqj69c4sgjw51rpv8nz7s9nbn43crcqy1";
     };
     meta.homepage = "https://github.com/TimUntersberger/neogit/";
   };
@@ -5075,12 +5075,12 @@ final: prev:
 
   neorg = buildVimPluginFrom2Nix {
     pname = "neorg";
-    version = "2022-11-29";
+    version = "2022-12-05";
     src = fetchFromGitHub {
       owner = "nvim-neorg";
       repo = "neorg";
-      rev = "5a536bc033d2ac1ef49ec4c875fd9811cceccb68";
-      sha256 = "08gx5y34abpfmcmhhlmb44hi380cfyapbki32pv9xspq56ng8xpn";
+      rev = "a79bf5969e27a3f1f1478c9b05c187815f2b2390";
+      sha256 = "1a8w2f5s50j4zzwkshxmj48lch7vd680hmmq3scl4q0knvjdyd9h";
     };
     meta.homepage = "https://github.com/nvim-neorg/neorg/";
   };
@@ -5135,12 +5135,12 @@ final: prev:
 
   neotest = buildVimPluginFrom2Nix {
     pname = "neotest";
-    version = "2022-12-01";
+    version = "2022-12-05";
     src = fetchFromGitHub {
       owner = "nvim-neotest";
       repo = "neotest";
-      rev = "a2559f07be901638d555c0d29d8ea22c81553653";
-      sha256 = "177pf0ywxqmxr7472yvrmk579k5vgh5770d1j00r1d3k8yjsnqp4";
+      rev = "d9bd5b05983ccfa349ff2692a5adb17b227088b5";
+      sha256 = "05iqzzmxvzb0s6v68pl2wjc643bwhd1mc3r2mrywkj99n8k6mn3k";
     };
     meta.homepage = "https://github.com/nvim-neotest/neotest/";
   };
@@ -5267,24 +5267,24 @@ final: prev:
 
   nginx-vim = buildVimPluginFrom2Nix {
     pname = "nginx.vim";
-    version = "2021-10-03";
+    version = "2022-12-01";
     src = fetchFromGitHub {
       owner = "chr4";
       repo = "nginx.vim";
-      rev = "ceeab164880ad90e73ab1be31dc3932777b9ef20";
-      sha256 = "178rd4zi8lspsq7qy5ag5gnqr87hivv92pcgqszbriqkga30srpc";
+      rev = "fdebcbfbefdf26f73cd31ec849df784075dbd21f";
+      sha256 = "0zgr4zvhxl3myx9a8pypxbv3f6i7xygzdd4cfi80c4nm3j83j1hk";
     };
     meta.homepage = "https://github.com/chr4/nginx.vim/";
   };
 
   nightfox-nvim = buildVimPluginFrom2Nix {
     pname = "nightfox.nvim";
-    version = "2022-11-28";
+    version = "2022-12-06";
     src = fetchFromGitHub {
       owner = "EdenEast";
       repo = "nightfox.nvim";
-      rev = "dce9cddbccc479dad170270d18f2057a637a0297";
-      sha256 = "0fkgp5hd0wgcpr0pnpk8m1k3xf08p0mfahkch41z16mlach8gjwn";
+      rev = "0903c4886535d97e6e62f710ab97119d2e09aa0b";
+      sha256 = "1s9rrqii367bgi31gnir8vnjhw5wvnxlsyzv6q9myix5zjq5kkml";
     };
     meta.homepage = "https://github.com/EdenEast/nightfox.nvim/";
   };
@@ -5327,12 +5327,12 @@ final: prev:
 
   noice-nvim = buildVimPluginFrom2Nix {
     pname = "noice.nvim";
-    version = "2022-11-29";
+    version = "2022-12-03";
     src = fetchFromGitHub {
       owner = "folke";
       repo = "noice.nvim";
-      rev = "5ca31af06078d6188de7db1369c2b40d1b606d58";
-      sha256 = "1a3n5341fcvjlkp3lv5x50a81z30zaxxw427dvkpjb7bp93rb8h4";
+      rev = "e013b6ebbad0fab34013be6f073da38c53c9e1dc";
+      sha256 = "1pxnj2m7v8m943xs24hspggwhwyv0nla96d38mh1r8bllhh367k8";
     };
     meta.homepage = "https://github.com/folke/noice.nvim/";
   };
@@ -5399,12 +5399,12 @@ final: prev:
 
   null-ls-nvim = buildVimPluginFrom2Nix {
     pname = "null-ls.nvim";
-    version = "2022-11-30";
+    version = "2022-12-05";
     src = fetchFromGitHub {
       owner = "jose-elias-alvarez";
       repo = "null-ls.nvim";
-      rev = "d4254b19e914e6278582d4555c57eb3d2abd9590";
-      sha256 = "03f7m0v5mgpwwvy1qgijiiyvrfzk5n75a1nj5snl0vl8ivancmcs";
+      rev = "b3d2ebdb75cf1fa4290822b43dc31f61bd0023f8";
+      sha256 = "01ri9sk5p67lkv1jf6zia8l87prrsccyz2862pk7brsmyaja22kw";
     };
     meta.homepage = "https://github.com/jose-elias-alvarez/null-ls.nvim/";
   };
@@ -5447,12 +5447,12 @@ final: prev:
 
   nvim-autopairs = buildVimPluginFrom2Nix {
     pname = "nvim-autopairs";
-    version = "2022-11-28";
+    version = "2022-12-07";
     src = fetchFromGitHub {
       owner = "windwp";
       repo = "nvim-autopairs";
-      rev = "99f696339266c22e7313d6a85a95bd538c3fc226";
-      sha256 = "1pv3hfaxd7yifx0n9643wcb9skrqrkzx5x545x944y23xvwvv9di";
+      rev = "9fa996123031b4cad100bd5afad04384a622c8a7";
+      sha256 = "0js7snmg9223d54iayadlm3bjn54fs3mzqck26cpn4fa5m1nc295";
     };
     meta.homepage = "https://github.com/windwp/nvim-autopairs/";
   };
@@ -5483,12 +5483,12 @@ final: prev:
 
   nvim-bqf = buildVimPluginFrom2Nix {
     pname = "nvim-bqf";
-    version = "2022-11-22";
+    version = "2022-12-05";
     src = fetchFromGitHub {
       owner = "kevinhwang91";
       repo = "nvim-bqf";
-      rev = "448fa92e7f3838e3b5adbce58b55c5f97a6d2cec";
-      sha256 = "0b5byaa8l3yhxhcivp62mpcnwr8ix7k98w68ifhlh5ynfk20zf1j";
+      rev = "3389264042e4590ed32ce26d7e47b17ec4e6e6d5";
+      sha256 = "0l9fcy2ic5n7krngrz0cv8darb2kv3whhv2lvf312cx9xmjspq2f";
     };
     meta.homepage = "https://github.com/kevinhwang91/nvim-bqf/";
   };
@@ -5627,12 +5627,12 @@ final: prev:
 
   nvim-dap = buildVimPluginFrom2Nix {
     pname = "nvim-dap";
-    version = "2022-11-28";
+    version = "2022-12-01";
     src = fetchFromGitHub {
       owner = "mfussenegger";
       repo = "nvim-dap";
-      rev = "f0573ea26f29702ad9aa1546e102adb2f5b7ac3a";
-      sha256 = "0d5ng7ffamh24bacyr4xgw393cm55x62f3m9cly8rzd38y7glpvi";
+      rev = "8f396b7836b9bbda9edd9f655f12ca377ae97676";
+      sha256 = "0jbl9ima5q5f0rcjac8p35by96wha3ph2518d1mjbliawfdl23p1";
     };
     meta.homepage = "https://github.com/mfussenegger/nvim-dap/";
   };
@@ -5759,24 +5759,24 @@ final: prev:
 
   nvim-highlite = buildVimPluginFrom2Nix {
     pname = "nvim-highlite";
-    version = "2022-11-22";
+    version = "2022-12-03";
     src = fetchFromGitHub {
       owner = "Iron-E";
       repo = "nvim-highlite";
-      rev = "56887173181ea0915a9931960899d023ea0ae66c";
-      sha256 = "132m5p9jkbj324qjjv0d7kgil3jlacz2lqrh0ygsa6hmyyq5gkay";
+      rev = "bc4f02545a0ee3b474e30d6654efe41f5a0a1cb5";
+      sha256 = "0v0yva74h1gk8piwil0pg5r5w663psrkg42y1sgpbla70i7j12ff";
     };
     meta.homepage = "https://github.com/Iron-E/nvim-highlite/";
   };
 
   nvim-hlslens = buildVimPluginFrom2Nix {
     pname = "nvim-hlslens";
-    version = "2022-11-30";
+    version = "2022-12-04";
     src = fetchFromGitHub {
       owner = "kevinhwang91";
       repo = "nvim-hlslens";
-      rev = "cad6ce2e0d4f9c26467712791a70fae9d0b0b6cf";
-      sha256 = "122dkvvs7cgmba8l09vhnc6laabyv4qakm3931f4kscn6lb4kyzm";
+      rev = "7fb804f504fd0935d65246a1d5ddea73d9ceefc9";
+      sha256 = "1fsqpd3idfqf5r95m2w32ajvldvha3844hl1x4hnwmwn26jn3iib";
     };
     meta.homepage = "https://github.com/kevinhwang91/nvim-hlslens/";
   };
@@ -5795,12 +5795,12 @@ final: prev:
 
   nvim-jdtls = buildVimPluginFrom2Nix {
     pname = "nvim-jdtls";
-    version = "2022-11-30";
+    version = "2022-12-05";
     src = fetchFromGitHub {
       owner = "mfussenegger";
       repo = "nvim-jdtls";
-      rev = "4ea8e66d61c9a7e40c40f4cc6051ebfbf4ce0d38";
-      sha256 = "0wbfy0p7n7s8zp154p06n3nmqc5vxrmzz6abasvlisd8s2khk3g1";
+      rev = "82e9feb6eb6000cea42b4cddf5b31daf624173bb";
+      sha256 = "1f7akw10npsvabgprg4vm23nqxiy679rp2cbyfywkis2hjb4mraw";
     };
     meta.homepage = "https://github.com/mfussenegger/nvim-jdtls/";
   };
@@ -5855,12 +5855,12 @@ final: prev:
 
   nvim-lint = buildVimPluginFrom2Nix {
     pname = "nvim-lint";
-    version = "2022-11-29";
+    version = "2022-12-05";
     src = fetchFromGitHub {
       owner = "mfussenegger";
       repo = "nvim-lint";
-      rev = "2ef3b269546d751e4fc8c673ffddd6216421f4a1";
-      sha256 = "03vdbxqa6z8471l0s65xa55n5hf1c1s59zvx1rn1kgy4h070022w";
+      rev = "46e14866fd2876a18772f913c6c14f5545c6034a";
+      sha256 = "16gnlbghywq6ksfmbzfgl9mj4d9gywdqkj8i4jsgl6h4qkvp4hb3";
     };
     meta.homepage = "https://github.com/mfussenegger/nvim-lint/";
   };
@@ -5879,12 +5879,12 @@ final: prev:
 
   nvim-lspconfig = buildVimPluginFrom2Nix {
     pname = "nvim-lspconfig";
-    version = "2022-12-01";
+    version = "2022-12-07";
     src = fetchFromGitHub {
       owner = "neovim";
       repo = "nvim-lspconfig";
-      rev = "5e0bd39476d4e224dfe5ea6a6624ea3bb467a8bb";
-      sha256 = "11lsa35v6qb1mvnac94i3acc428r6s2zk88i6qp3xz25slmd5773";
+      rev = "c7206327096bedf2e213788a60624a84b3b7552d";
+      sha256 = "1f310ng3i69mlp429fcq65fqrfigdpmnsixq91qyan964cn1b13r";
     };
     meta.homepage = "https://github.com/neovim/nvim-lspconfig/";
   };
@@ -5987,12 +5987,12 @@ final: prev:
 
   nvim-notify = buildVimPluginFrom2Nix {
     pname = "nvim-notify";
-    version = "2022-11-28";
+    version = "2022-12-06";
     src = fetchFromGitHub {
       owner = "rcarriga";
       repo = "nvim-notify";
-      rev = "859056ff7aec327255578c7a98ef02d0cd829f65";
-      sha256 = "01sas5rv0j6rsjml9ibi9ygzpihdn6g8vz5rpwv4grkh0n844jkh";
+      rev = "b005821516f1f37801a73067afd1cef2dbc4dfe8";
+      sha256 = "06y5akjhrnnsdkjxbcci7fxar8qj37qsl5i18xyx4lzzslxf7nvy";
     };
     meta.homepage = "https://github.com/rcarriga/nvim-notify/";
   };
@@ -6023,36 +6023,36 @@ final: prev:
 
   nvim-scrollbar = buildVimPluginFrom2Nix {
     pname = "nvim-scrollbar";
-    version = "2022-11-21";
+    version = "2022-12-07";
     src = fetchFromGitHub {
       owner = "petertriho";
       repo = "nvim-scrollbar";
-      rev = "2cb0a0b36a45118e075699bb3a884ab819a85256";
-      sha256 = "0hmx3fic2cds609a9f4ik79kb9i6hqs9ir1h6x1kamn4fgm4fqcq";
+      rev = "779cf6f5e7ebcd78acf37dff35a240e03f616357";
+      sha256 = "0hz9y3q84azi3grzac7i6dazv982g7di7limd1qajx8x3hbbfvyx";
     };
     meta.homepage = "https://github.com/petertriho/nvim-scrollbar/";
   };
 
   nvim-scrollview = buildVimPluginFrom2Nix {
     pname = "nvim-scrollview";
-    version = "2022-11-18";
+    version = "2022-12-04";
     src = fetchFromGitHub {
       owner = "dstein64";
       repo = "nvim-scrollview";
-      rev = "b10165f3727f519566d69382c4a4830f16375910";
-      sha256 = "0ha1hdrw5cakgxnp0n5dzn0w7kbyxfw0y396rndp70mcqanqg34r";
+      rev = "f51cd5543c9369dc76a226a1b16068abaf604876";
+      sha256 = "1ss4s4m3aqxrqawvlsf6qvg1nk36l3y5vyldm1hzvqa5f6bcm8dv";
     };
     meta.homepage = "https://github.com/dstein64/nvim-scrollview/";
   };
 
   nvim-snippy = buildVimPluginFrom2Nix {
     pname = "nvim-snippy";
-    version = "2022-11-24";
+    version = "2022-12-07";
     src = fetchFromGitHub {
       owner = "dcampos";
       repo = "nvim-snippy";
-      rev = "7b98712fdebda8d20375359622e2cb2795f774d8";
-      sha256 = "131ji85a14cd7f5gx41q76b2n1gvjbj0whlizpk3c62kz44mpgdp";
+      rev = "47def62945611212a242657cc414dac91ca0453a";
+      sha256 = "112h9rrfknqb2z0ph0x4fv3pplwrkp1sn1x2saw3bb8r7fjiqzr4";
     };
     meta.homepage = "https://github.com/dcampos/nvim-snippy/";
   };
@@ -6071,12 +6071,12 @@ final: prev:
 
   nvim-spectre = buildVimPluginFrom2Nix {
     pname = "nvim-spectre";
-    version = "2022-10-20";
+    version = "2022-12-07";
     src = fetchFromGitHub {
       owner = "nvim-pack";
       repo = "nvim-spectre";
-      rev = "e27cf9f4506e39ba11a162c6c4aa8e5ff8f296f1";
-      sha256 = "0f3sy23jac31fgrcbphhdkl6y8iwi79i9c8yi8gsz3m6a3czhkpw";
+      rev = "c332c9c0574a531392818baf4020b86ba5575942";
+      sha256 = "0xkf01sr7pkm26xq8spns8765gpj7ibpdp4cx9klw6a9fx8sir9q";
     };
     meta.homepage = "https://github.com/nvim-pack/nvim-spectre/";
   };
@@ -6107,24 +6107,24 @@ final: prev:
 
   nvim-tree-lua = buildVimPluginFrom2Nix {
     pname = "nvim-tree.lua";
-    version = "2022-11-29";
+    version = "2022-12-03";
     src = fetchFromGitHub {
       owner = "nvim-tree";
       repo = "nvim-tree.lua";
-      rev = "829e9f68e10a998198e17bf5b348a6947f9d3c2e";
-      sha256 = "1xwm3qcba6a2mxmpcdi81c29y3kxw2srm5yi9jvmzpml6zbwqmqp";
+      rev = "f8489c992998e1e1b45aec65bdb9615e5cd59a61";
+      sha256 = "0md5xavzksj4lh1vbd24zq29bwgcb7057dw31invc7adm7sfh1wr";
     };
     meta.homepage = "https://github.com/nvim-tree/nvim-tree.lua/";
   };
 
   nvim-treesitter = buildVimPluginFrom2Nix {
     pname = "nvim-treesitter";
-    version = "2022-12-01";
+    version = "2022-12-07";
     src = fetchFromGitHub {
       owner = "nvim-treesitter";
       repo = "nvim-treesitter";
-      rev = "768532453ac30cbf792b492248a6c3be19b80af1";
-      sha256 = "18lamsy039c90ycxh2gz1qi2ba4npkm1j4q2ibyzljml8kznhzg6";
+      rev = "440401c506ec9b87cd3824ad17631115ab860cc5";
+      sha256 = "1xyb73vavp38mr7lvjbwd9hmqlc4bw41g1wg0fs8fflabjy3bals";
     };
     meta.homepage = "https://github.com/nvim-treesitter/nvim-treesitter/";
   };
@@ -6443,12 +6443,12 @@ final: prev:
 
   packer-nvim = buildVimPluginFrom2Nix {
     pname = "packer.nvim";
-    version = "2022-11-29";
+    version = "2022-12-07";
     src = fetchFromGitHub {
       owner = "wbthomason";
       repo = "packer.nvim";
-      rev = "dcd2f380bb49ec2dfe208f186236dd366434a4d5";
-      sha256 = "01rrangp7lwz75cqqaqfxdzd6j3jq64g816j3bk9p6fqag9pripi";
+      rev = "64ae65fea395d8dc461e3884688f340dd43950ba";
+      sha256 = "106yxm2gi86w8d1k96fr3wfiqnz8z6kkg1c58fvm9izl82anmbxd";
     };
     meta.homepage = "https://github.com/wbthomason/packer.nvim/";
   };
@@ -6672,12 +6672,12 @@ final: prev:
 
   purescript-vim = buildVimPluginFrom2Nix {
     pname = "purescript-vim";
-    version = "2022-06-15";
+    version = "2022-12-07";
     src = fetchFromGitHub {
       owner = "purescript-contrib";
       repo = "purescript-vim";
-      rev = "af5fae0b43241e9fc3e0442782272728844bec3f";
-      sha256 = "05v81i4ialja4wq3rp1fy09zjh7rvwb6pjhig7zg9pfddd015pki";
+      rev = "7af25a840d38dc6767c85edd1f35c1f835618071";
+      sha256 = "1aw0bd0cx76ldm5nx17lqsxshlaiw8v9j0rwf1mlbz5k40c5v2w9";
     };
     meta.homepage = "https://github.com/purescript-contrib/purescript-vim/";
   };
@@ -6853,12 +6853,12 @@ final: prev:
 
   registers-nvim = buildVimPluginFrom2Nix {
     pname = "registers.nvim";
-    version = "2022-11-10";
+    version = "2022-12-03";
     src = fetchFromGitHub {
       owner = "tversteeg";
       repo = "registers.nvim";
-      rev = "2c4f82a8a68b7d3cee7bd345669f2f50bdc6f889";
-      sha256 = "1g6jnql1jrdkw6ckb6q1fivcxjkksdqpcy8najxmmw9lv4sksh4k";
+      rev = "76bf496da0c5e2c71820d93319e468b84b689be4";
+      sha256 = "1sn39ia2n951rj52c596q1sbmzb23224c3zvrmzzrb2ifbfj3f7f";
     };
     meta.homepage = "https://github.com/tversteeg/registers.nvim/";
   };
@@ -7383,12 +7383,12 @@ final: prev:
 
   ssr-nvim = buildVimPluginFrom2Nix {
     pname = "ssr.nvim";
-    version = "2022-11-29";
+    version = "2022-12-04";
     src = fetchFromGitHub {
       owner = "cshuaimin";
       repo = "ssr.nvim";
-      rev = "4304933853e66060ec03048b2ce3853c39c3886a";
-      sha256 = "03yz00x2wqb0b23ddawsciy52ac9q9gz6h3668l9b2srggphnxy2";
+      rev = "6238c102d16779aaa505a16200ac50a01c16b5ef";
+      sha256 = "0w0yljwf5l19sczb8qrzkhl61w7xhyapj8v182c7h60k7nis1qqx";
     };
     meta.homepage = "https://github.com/cshuaimin/ssr.nvim/";
   };
@@ -7600,12 +7600,12 @@ final: prev:
 
   tabnine-vim = buildVimPluginFrom2Nix {
     pname = "tabnine-vim";
-    version = "2022-02-25";
+    version = "2022-12-05";
     src = fetchFromGitHub {
       owner = "codota";
       repo = "tabnine-vim";
-      rev = "e27face391a4d9a3e43ff251010f77deddf0c88d";
-      sha256 = "1y5haygvixnav9cck49yvvm14afyy5gyq8rwiybqvkd6vfxlv99f";
+      rev = "35f1661297b4bf8b12324c8d29442b36a5ef64d2";
+      sha256 = "1snrjrd0ri5d3kkdv81gvbsv6nccjxqh6zpwkzbz9nh7nhb7dmy2";
       fetchSubmodules = true;
     };
     meta.homepage = "https://github.com/codota/tabnine-vim/";
@@ -7709,12 +7709,12 @@ final: prev:
 
   tcomment_vim = buildVimPluginFrom2Nix {
     pname = "tcomment_vim";
-    version = "2022-07-22";
+    version = "2022-12-02";
     src = fetchFromGitHub {
       owner = "tomtom";
       repo = "tcomment_vim";
-      rev = "e77e1bf61b4f1ddc7b13c6160b7389df42aba24d";
-      sha256 = "00cvap0qp016x09h4wkk6d0b9px7q8dplj8fj5c7j95r15k6z2r7";
+      rev = "ced243a049bb6839ff057741de731418879e97e8";
+      sha256 = "1q2q2q8rpd8fzf4sa14mjg42m1d97cqxz82xk4vgg3ml3ffgcsly";
     };
     meta.homepage = "https://github.com/tomtom/tcomment_vim/";
   };
@@ -7757,24 +7757,24 @@ final: prev:
 
   telescope-dap-nvim = buildVimPluginFrom2Nix {
     pname = "telescope-dap.nvim";
-    version = "2021-03-26";
+    version = "2022-12-02";
     src = fetchFromGitHub {
       owner = "nvim-telescope";
       repo = "telescope-dap.nvim";
-      rev = "b4134fff5cbaf3b876e6011212ed60646e56f060";
-      sha256 = "1fcpw42bwl5iych3hxrrl08s5hm6r6k0qx2savw853f3ff982s38";
+      rev = "313d2ea12ae59a1ca51b62bf01fc941a983d9c9c";
+      sha256 = "0dkmmg30bxpbz990wgpndfhzql2015knrlmnscgz4cwyd39wwgpm";
     };
     meta.homepage = "https://github.com/nvim-telescope/telescope-dap.nvim/";
   };
 
   telescope-file-browser-nvim = buildVimPluginFrom2Nix {
     pname = "telescope-file-browser.nvim";
-    version = "2022-11-30";
+    version = "2022-12-04";
     src = fetchFromGitHub {
       owner = "nvim-telescope";
       repo = "telescope-file-browser.nvim";
-      rev = "8646e46b8545b9234e87083d124c0a4e4ed47735";
-      sha256 = "01q34wrk00yxy4jcr666qmkdkpfib80rjbn921dkqqv2d1nalx9b";
+      rev = "cad567e11131a01f2934930c1efc8b1b09a0dc56";
+      sha256 = "0d0l47dmvsba5z8dnywmc55s964wzz3f202amxj5msh9jj051ry3";
     };
     meta.homepage = "https://github.com/nvim-telescope/telescope-file-browser.nvim/";
   };
@@ -7793,12 +7793,12 @@ final: prev:
 
   telescope-fzf-native-nvim = buildVimPluginFrom2Nix {
     pname = "telescope-fzf-native.nvim";
-    version = "2022-11-30";
+    version = "2022-12-02";
     src = fetchFromGitHub {
       owner = "nvim-telescope";
       repo = "telescope-fzf-native.nvim";
-      rev = "7447fe780fed23402a3e0c3a227b549d7506ed38";
-      sha256 = "101zcy6fjrpv19cghg464wrizh82b0ny7pc1mmqsfqw48hl37hwn";
+      rev = "ae9d95da9ff5669eb8e35f758fbf385b3e2fb7cf";
+      sha256 = "1appy9vk69wbm1zzgxhpi42y401rkdbkbl4qpiagnqbwkz2wc6i0";
     };
     meta.homepage = "https://github.com/nvim-telescope/telescope-fzf-native.nvim/";
   };
@@ -7974,12 +7974,12 @@ final: prev:
 
   telescope-nvim = buildVimPluginFrom2Nix {
     pname = "telescope.nvim";
-    version = "2022-11-28";
+    version = "2022-12-02";
     src = fetchFromGitHub {
       owner = "nvim-telescope";
       repo = "telescope.nvim";
-      rev = "3c2e5fb23e9f6ca1aa682ae16bac3319bfe03e38";
-      sha256 = "08r7cjmkqw2pzagyhyv185b86pqrvwk2y6b7g6sjbv3izp4q3krk";
+      rev = "cabf991b1d3996fa6f3232327fc649bbdf676496";
+      sha256 = "04h9hsy6az1hm0bcg8vf8vsj9hqbf0fi3q5fksdjpqpcf2m04j75";
     };
     meta.homepage = "https://github.com/nvim-telescope/telescope.nvim/";
   };
@@ -8203,12 +8203,12 @@ final: prev:
 
   tokyonight-nvim = buildVimPluginFrom2Nix {
     pname = "tokyonight.nvim";
-    version = "2022-11-29";
+    version = "2022-12-06";
     src = fetchFromGitHub {
       owner = "folke";
       repo = "tokyonight.nvim";
-      rev = "58008d1ff7c1105ef702ac5460cb06bdccf278a6";
-      sha256 = "16s593j8ikisnf8xhqqrbpadwlf8sxx3fwcnjjjh6wns6gcmkrry";
+      rev = "0f7b6a5b6cf232f34cb8f51123a084a6eee96b89";
+      sha256 = "0h7msjgg5zg0zza8fasb2km3pcijlb5w69hlb3vfxxb33kjv8104";
     };
     meta.homepage = "https://github.com/folke/tokyonight.nvim/";
   };
@@ -8239,12 +8239,12 @@ final: prev:
 
   treesj = buildVimPluginFrom2Nix {
     pname = "treesj";
-    version = "2022-12-01";
+    version = "2022-12-02";
     src = fetchFromGitHub {
       owner = "Wansmer";
       repo = "treesj";
-      rev = "da296173b61330aebfd16129a5bf1263700014f1";
-      sha256 = "1wbbxdf2k1vfrnfllms0g5mnsf5bhsipacfwa546sfnc41j360v9";
+      rev = "43604d7e1504571c768024e90907dc7b581456a4";
+      sha256 = "0k9swbihxjynzkhfg5dgnkm5ajzaq75py4lpxfiql54pvbbllcb5";
     };
     meta.homepage = "https://github.com/Wansmer/treesj/";
   };
@@ -8395,12 +8395,12 @@ final: prev:
 
   urlview-nvim = buildVimPluginFrom2Nix {
     pname = "urlview.nvim";
-    version = "2022-11-17";
+    version = "2022-12-06";
     src = fetchFromGitHub {
       owner = "axieax";
       repo = "urlview.nvim";
-      rev = "f8d30320ca277956852fda6db082e231153b8618";
-      sha256 = "0y6vqv83f075a3728jrzrzx11wf8a1p3l6rn2irwgxd037b1ql7z";
+      rev = "53c53bce3bffa96be2b5f855d7ffb1d1f208eee5";
+      sha256 = "1hdx4k9wcn3j9zyaw0d4fg83w7phn59hh7zblqhzd8z61h8kfdpa";
     };
     meta.homepage = "https://github.com/axieax/urlview.nvim/";
   };
@@ -8803,12 +8803,12 @@ final: prev:
 
   vim-airline = buildVimPluginFrom2Nix {
     pname = "vim-airline";
-    version = "2022-11-28";
+    version = "2022-12-07";
     src = fetchFromGitHub {
       owner = "vim-airline";
       repo = "vim-airline";
-      rev = "25d53a80f4d68932de4b10fc31aa9a393e19b41e";
-      sha256 = "169gxfb6lfd29ln0qwx6kch2ndik8bmj7npq9wpblpczg3g5sn4j";
+      rev = "5f5e00faad728f12f9ca9d9200208d8a39fd60f4";
+      sha256 = "0z3rkdf0k95789x5yqrvkq2jfnl8hc1h4pxbfnhy9hc1l0kxhc9n";
     };
     meta.homepage = "https://github.com/vim-airline/vim-airline/";
   };
@@ -9199,12 +9199,12 @@ final: prev:
 
   vim-clap = buildVimPluginFrom2Nix {
     pname = "vim-clap";
-    version = "2022-11-26";
+    version = "2022-12-03";
     src = fetchFromGitHub {
       owner = "liuchengxu";
       repo = "vim-clap";
-      rev = "aca487d01058c36c245cf35d30913cfb7311eebb";
-      sha256 = "1q4nsjzq7cirqbg5kwc3pww4mqai5i53fq9p8cqw0pyi1vzhvc90";
+      rev = "ea90c8cf804feea294bae47423a15b733a74b5b7";
+      sha256 = "1v6f5ra84sdhrsbqp5vjyhlcjxnykmasbghni600l6ygzlgd2saq";
     };
     meta.homepage = "https://github.com/liuchengxu/vim-clap/";
   };
@@ -9271,12 +9271,12 @@ final: prev:
 
   vim-codefmt = buildVimPluginFrom2Nix {
     pname = "vim-codefmt";
-    version = "2022-11-28";
+    version = "2022-12-04";
     src = fetchFromGitHub {
       owner = "google";
       repo = "vim-codefmt";
-      rev = "0fbe1b695676039b56dd09dcf66dcd23c2a92a47";
-      sha256 = "1j0nfhd7nhr0xynvajf85vg27c5rf2xzsmp7gdswx6nvbwgxni8q";
+      rev = "b97c8fcdaed5c3915e49f70f7fa7aa148d528428";
+      sha256 = "1j3g4rcjy5fr7pbm45bkzsq0kppvrp54wd6dsdzxwd2y1nkrm82l";
     };
     meta.homepage = "https://github.com/google/vim-codefmt/";
   };
@@ -9463,12 +9463,12 @@ final: prev:
 
   vim-dadbod = buildVimPluginFrom2Nix {
     pname = "vim-dadbod";
-    version = "2022-10-29";
+    version = "2022-12-03";
     src = fetchFromGitHub {
       owner = "tpope";
       repo = "vim-dadbod";
-      rev = "87785156a7919f51409f3e6656ea2b3a9e0e8e97";
-      sha256 = "0rbrp8cnkngfnvfvrfv2nfs3c7ryyv9zs738xay15nmcgif4by1s";
+      rev = "c8034ea7160c0fa9351f9f07f964bb335cdd6187";
+      sha256 = "1kbll59gzcrawwgfiv63psciab330id3jc19kmbl3dvbs3m9if8q";
     };
     meta.homepage = "https://github.com/tpope/vim-dadbod/";
   };
@@ -9991,12 +9991,12 @@ final: prev:
 
   vim-fugitive = buildVimPluginFrom2Nix {
     pname = "vim-fugitive";
-    version = "2022-11-23";
+    version = "2022-12-02";
     src = fetchFromGitHub {
       owner = "tpope";
       repo = "vim-fugitive";
-      rev = "49cc58573e746d02024110d9af99e95994ea4b72";
-      sha256 = "09lnf0r3szzqc9ykyq5w1bgx528k0jnhhlwyzcricmrlls67pnsc";
+      rev = "5b0b138483de17a8fd8dfcec0b491782c8fbf102";
+      sha256 = "1nlr50kv90rafy85cr2k2n7pmr5mvmvqiza7qnk0rzlccdada6ry";
     };
     meta.homepage = "https://github.com/tpope/vim-fugitive/";
   };
@@ -10869,12 +10869,12 @@ final: prev:
 
   vim-lsp = buildVimPluginFrom2Nix {
     pname = "vim-lsp";
-    version = "2022-11-10";
+    version = "2022-12-03";
     src = fetchFromGitHub {
       owner = "prabirshrestha";
       repo = "vim-lsp";
-      rev = "e42203b4f0e46a927dd17b28f142fa91661d7163";
-      sha256 = "12v2mh049b037b70q5cpkz0dgqi07hsz4sx2ywvqvwmykv5lrpcv";
+      rev = "0a8d2dfaedf1e51859317f675cefe8403041e76a";
+      sha256 = "03yipczl11q76db7s1a11nmn3k6rw066y4x5jzracfny9f63miw3";
     };
     meta.homepage = "https://github.com/prabirshrestha/vim-lsp/";
   };
@@ -10978,12 +10978,12 @@ final: prev:
 
   vim-matchup = buildVimPluginFrom2Nix {
     pname = "vim-matchup";
-    version = "2022-11-13";
+    version = "2022-12-04";
     src = fetchFromGitHub {
       owner = "andymass";
       repo = "vim-matchup";
-      rev = "55e3330436784fb8ccc35a5cfeb13e48bab9dcd2";
-      sha256 = "170ic9lp566x1l0brj2gj2zpbz5wl57df9wbi3zixm3agj56gnh6";
+      rev = "db5120dd9887c988de7cd973ddb951e465d413e5";
+      sha256 = "047l43z9ak7xrl4p8p8rw5wjakg95b6y2labfp16qq139g3bib0w";
     };
     meta.homepage = "https://github.com/andymass/vim-matchup/";
   };
@@ -11254,12 +11254,12 @@ final: prev:
 
   vim-obsession = buildVimPluginFrom2Nix {
     pname = "vim-obsession";
-    version = "2022-04-05";
+    version = "2022-12-02";
     src = fetchFromGitHub {
       owner = "tpope";
       repo = "vim-obsession";
-      rev = "7d39576149d17bde3c096fd57e3a2cdae65deaf5";
-      sha256 = "0g716c3dvd7068lfgcbxlzn86529kji4zms5n2xgrn3h0vn722zz";
+      rev = "fe9d3e1a9a50171e7d316a52e1e56d868e4c1fe5";
+      sha256 = "0x60j6bq9aql9fqq704cg8bc930c7n1jiaczwsn6slwa55c03zmr";
     };
     meta.homepage = "https://github.com/tpope/vim-obsession/";
   };
@@ -11998,12 +11998,12 @@ final: prev:
 
   vim-sensible = buildVimPluginFrom2Nix {
     pname = "vim-sensible";
-    version = "2022-08-26";
+    version = "2022-12-03";
     src = fetchFromGitHub {
       owner = "tpope";
       repo = "vim-sensible";
-      rev = "8985da7669bbd73afce85ef0e4a3e1ce2e488595";
-      sha256 = "15pvhbk7hkf3z7zsv1bqizqmiw75nvckf3j6njckj5ijx6kzjsnj";
+      rev = "1be4e4e5409caccddf5c2f1bbfa16519f4c93de0";
+      sha256 = "1l2ax16r0bqxzdmgpz4rlx7zj0g4d8d696ibdzwmr0q6nbkpy4w5";
     };
     meta.homepage = "https://github.com/tpope/vim-sensible/";
   };
@@ -12575,12 +12575,12 @@ final: prev:
 
   vim-tmux-navigator = buildVimPluginFrom2Nix {
     pname = "vim-tmux-navigator";
-    version = "2022-11-13";
+    version = "2022-12-04";
     src = fetchFromGitHub {
       owner = "christoomey";
       repo = "vim-tmux-navigator";
-      rev = "c2dab181185101070b0ad6c33451f4e2f56a446a";
-      sha256 = "15581nighr1a82gkn0blkx75l6bz0vfq573nf626dw1qa652nipz";
+      rev = "a40cc7a52787e06fd57650e09be490432e3d4717";
+      sha256 = "0l98v8lbadz32z7i1d1n0b1ggpvbsc71ni3lqm9hd2xhx9rixps1";
     };
     meta.homepage = "https://github.com/christoomey/vim-tmux-navigator/";
   };
@@ -12851,12 +12851,12 @@ final: prev:
 
   vim-wayland-clipboard = buildVimPluginFrom2Nix {
     pname = "vim-wayland-clipboard";
-    version = "2022-11-20";
+    version = "2022-12-07";
     src = fetchFromGitHub {
       owner = "jasonccox";
       repo = "vim-wayland-clipboard";
-      rev = "1d938c6062ccd1d7fe1fcc658f36503e3283c5f6";
-      sha256 = "1dgpgaq0hby85zvcl8vm3jfrpbx1dyx1xrd5i9kd3g64nngbblrv";
+      rev = "c16b7cfed0c4ec22cc6a7f67dfbdd4d8c4ab1848";
+      sha256 = "1l9wcgsj8wrmhcxkw4s82i68954060xafb7jkym3519bx4kq4jxi";
     };
     meta.homepage = "https://github.com/jasonccox/vim-wayland-clipboard/";
   };
@@ -12923,12 +12923,12 @@ final: prev:
 
   vim-xkbswitch = buildVimPluginFrom2Nix {
     pname = "vim-xkbswitch";
-    version = "2022-11-14";
+    version = "2022-12-07";
     src = fetchFromGitHub {
       owner = "lyokha";
       repo = "vim-xkbswitch";
-      rev = "9ac90d328f7863039c6edff0b4b8081349a378e8";
-      sha256 = "1j5vmavmgwvwrarc768x1p5ng4bjyb3fdm118z019r0zpcdknpgx";
+      rev = "e64864ec2e01ba554c6ee5396e4e77f732433738";
+      sha256 = "0sg4ynwr5mw0qpgnvl752d9yslvd8rxl6swz61gnzgg8j3fyhk5f";
     };
     meta.homepage = "https://github.com/lyokha/vim-xkbswitch/";
   };
@@ -13128,12 +13128,12 @@ final: prev:
 
   vimtex = buildVimPluginFrom2Nix {
     pname = "vimtex";
-    version = "2022-11-27";
+    version = "2022-12-06";
     src = fetchFromGitHub {
       owner = "lervag";
       repo = "vimtex";
-      rev = "01333a47ebe70eac21e4b0016b04e031b9cf7b17";
-      sha256 = "0vrmh4ccarz11a2904y3m1n1gp4zl00k5n8jc5231bhv8psdnlj7";
+      rev = "7a887028e91b12268fe812028621152dba549b3c";
+      sha256 = "0q6qf5572b6v4k4xnf5ra5brkpjclh8r34rrhpidc3xkdmgifyg4";
     };
     meta.homepage = "https://github.com/lervag/vimtex/";
   };
@@ -13152,12 +13152,12 @@ final: prev:
 
   vimwiki = buildVimPluginFrom2Nix {
     pname = "vimwiki";
-    version = "2022-03-10";
+    version = "2022-12-05";
     src = fetchFromGitHub {
       owner = "vimwiki";
       repo = "vimwiki";
-      rev = "63af6e72dd3fa840bffb3ebcb8c96970c02e0913";
-      sha256 = "1cvi3bb9kqfwjh3d4biwxgavankj2ljiyss36q8z96czzaz2w40v";
+      rev = "fea8bee382b2051b0137fd2cacf0862823ee69b3";
+      sha256 = "1iwwy7ay01jkxgq83frr1xq0y3jvvs86paa43mn1ky6gk3q57s80";
     };
     meta.homepage = "https://github.com/vimwiki/vimwiki/";
   };
@@ -13465,12 +13465,12 @@ final: prev:
 
   zk-nvim = buildVimPluginFrom2Nix {
     pname = "zk-nvim";
-    version = "2022-11-13";
+    version = "2022-12-04";
     src = fetchFromGitHub {
       owner = "mickael-menu";
       repo = "zk-nvim";
-      rev = "1d2ebc679eeea8bfddc908e31bbe9e8b0928ef21";
-      sha256 = "0inbay3sn8f78wvf1pl785nl0pdiv6m4604d3zh8a27myhw6lr2b";
+      rev = "60478c653aa5fbeac3035b71f5800c5c7a2f5361";
+      sha256 = "0jkmdr7db8rs3cv9xziy58sx4fikxjz1wyaag4g1r7l5mwsf9zrh";
     };
     meta.homepage = "https://github.com/mickael-menu/zk-nvim/";
   };
@@ -13501,12 +13501,12 @@ final: prev:
 
   catppuccin-nvim = buildVimPluginFrom2Nix {
     pname = "catppuccin-nvim";
-    version = "2022-12-01";
+    version = "2022-12-06";
     src = fetchFromGitHub {
       owner = "catppuccin";
       repo = "nvim";
-      rev = "4d2ed20bda0c07e9473c374826721ac16154698b";
-      sha256 = "0xdxfpqlm68s6629h8j3pmpw4p7kfnsxlvbk5k3ii6f2yw0b8fd4";
+      rev = "08ef4cb230a16c5f6b8f33ef1bf0c5b3e192905a";
+      sha256 = "1xzh1ql0iix33ixkdcrvf80xa9c995b6gq2ag0k9q4ikvmid5lx2";
     };
     meta.homepage = "https://github.com/catppuccin/nvim/";
   };
@@ -13525,12 +13525,12 @@ final: prev:
 
   chad = buildVimPluginFrom2Nix {
     pname = "chad";
-    version = "2022-12-01";
+    version = "2022-12-07";
     src = fetchFromGitHub {
       owner = "ms-jpq";
       repo = "chadtree";
-      rev = "4c95882b5e3d67bf31f2b7ea996e0251966e43eb";
-      sha256 = "002r53w9rq13lca4sw34631b526h2wvaf5x9l87kqq0ddm2nwslh";
+      rev = "b0e0b05e5aa8156fe9c8f3a3a3804a434394ab65";
+      sha256 = "1kakayg4v5fdi1hs1zyv6f9hd9im0f36z4f4bk1yszsgycrcyl1z";
     };
     meta.homepage = "https://github.com/ms-jpq/chadtree/";
   };
@@ -13597,12 +13597,12 @@ final: prev:
 
   rose-pine = buildVimPluginFrom2Nix {
     pname = "rose-pine";
-    version = "2022-11-20";
+    version = "2022-12-03";
     src = fetchFromGitHub {
       owner = "rose-pine";
       repo = "neovim";
-      rev = "77b86d932746179a50246692612e889d1cdd72da";
-      sha256 = "11j9nv2n2lgqk5dap89i8irsbwb2l8arilnhv4p5bzi3zv43vy3n";
+      rev = "7610f245821e98232e7ee8dcbf3364725807187d";
+      sha256 = "1050yycxlinnj0fcpwvb18b6i1ahkm3mwc56qmkspj1glhk64cs9";
     };
     meta.homepage = "https://github.com/rose-pine/neovim/";
   };
diff --git a/pkgs/applications/editors/vim/plugins/nvim-treesitter/generated.nix b/pkgs/applications/editors/vim/plugins/nvim-treesitter/generated.nix
index 56c9bf213003..1b3a191a9daf 100644
--- a/pkgs/applications/editors/vim/plugins/nvim-treesitter/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/nvim-treesitter/generated.nix
@@ -115,23 +115,23 @@
   };
   clojure = buildGrammar {
     language = "clojure";
-    version = "087bac7";
+    version = "8c23e0e";
     source = fetchFromGitHub {
       owner = "sogaiu";
       repo = "tree-sitter-clojure";
-      rev = "087bac78c53fe1387756cd5b8e68a69b3f6d7244";
-      hash = "sha256-KiuSAchtqlVlwyBL4rU+p0fPjm52DrNDPq2ETVXOHQU=";
+      rev = "8c23e0ec078af461ccad43fffbbfc204aa6bc238";
+      hash = "sha256-rbR5/f9Cznl4AFybmpKgEcjKBw4GrUVP67tf4UT6/ZE=";
     };
     meta.homepage = "https://github.com/sogaiu/tree-sitter-clojure";
   };
   cmake = buildGrammar {
     language = "cmake";
-    version = "6e51463";
+    version = "a322653";
     source = fetchFromGitHub {
       owner = "uyha";
       repo = "tree-sitter-cmake";
-      rev = "6e51463ef3052dd3b328322c22172eda093727ad";
-      hash = "sha256-2xJaDgrCJQ2obGYvhsHk2/2p8lFNwuScjbjdxJihh5I=";
+      rev = "a32265307aa2d31941056d69e8b6633e61750b2f";
+      hash = "sha256-LBd3SMem1dxZr/dOdJdEFTQxI6d+H8uYE46yN02E/6Y=";
     };
     meta.homepage = "https://github.com/uyha/tree-sitter-cmake";
   };
@@ -249,12 +249,12 @@
   };
   dockerfile = buildGrammar {
     language = "dockerfile";
-    version = "f913be9";
+    version = "09e316d";
     source = fetchFromGitHub {
       owner = "camdencheek";
       repo = "tree-sitter-dockerfile";
-      rev = "f913be9bb8689af22114605012693146fbe9ddaa";
-      hash = "sha256-EoZDjUyL4dEwE6E9r9KruQ8Kb83bAyyFq7a/NFBdZjU=";
+      rev = "09e316dba307b869831e9399b11a83bbf0f2a24b";
+      hash = "sha256-FffwAt9FJurxFJajLTsQe5tLeZty3nSbXBRkgdjNOJ4=";
     };
     meta.homepage = "https://github.com/camdencheek/tree-sitter-dockerfile";
   };
@@ -371,12 +371,12 @@
   };
   foam = buildGrammar {
     language = "foam";
-    version = "fdb7f14";
+    version = "c238f4a";
     source = fetchFromGitHub {
       owner = "FoamScience";
       repo = "tree-sitter-foam";
-      rev = "fdb7f14b885abfc4df57728c9b2a2f2ad24d3cb7";
-      hash = "sha256-E5Fr8185ypZbkaGIDE9lhQ0Vf1Dphx7n5suNkK0AFHU=";
+      rev = "c238f4af9a5723a212cf1a4c9b31dd5c1d5270a2";
+      hash = "sha256-GCVV7kj+5S12jedyMajw2OcFOJ0Wz8hiDCImh/G1ngg=";
     };
     meta.homepage = "https://github.com/FoamScience/tree-sitter-foam";
   };
@@ -437,12 +437,12 @@
   };
   gitcommit = buildGrammar {
     language = "gitcommit";
-    version = "d3c15bd";
+    version = "f838621";
     source = fetchFromGitHub {
       owner = "gbprod";
       repo = "tree-sitter-gitcommit";
-      rev = "d3c15bdf0165c89872cc1345c5f8815be3cad9cc";
-      hash = "sha256-3ufluVDeCXLksgj68f7MfK+3QrtvLDoc9Xhbh7xz+t0=";
+      rev = "f838621d00831967a39ac8293cd3c23b0f49252e";
+      hash = "sha256-9OulAtUDMP1jKYPOFBfctBVX2TWktkmwPtE3sCh1qD8=";
     };
     meta.homepage = "https://github.com/gbprod/tree-sitter-gitcommit";
   };
@@ -493,12 +493,12 @@
   };
   go = buildGrammar {
     language = "go";
-    version = "05900fa";
+    version = "e34b8a4";
     source = fetchFromGitHub {
       owner = "tree-sitter";
       repo = "tree-sitter-go";
-      rev = "05900faa3cdb5d2d8c8bd5e77ee698487e0a8611";
-      hash = "sha256-f885YTswEDH/QfRPUxcLp/1E2zXLKl25R9IyTGKb1eM=";
+      rev = "e34b8a418c33bba8bdf3375e8e55903dff7c68b9";
+      hash = "sha256-Bfp2XsT83x+VPMPB5rHAbSpEkHD7lG0iDq2Yt63Ug8I=";
     };
     meta.homepage = "https://github.com/tree-sitter/tree-sitter-go";
   };
@@ -571,12 +571,12 @@
   };
   hcl = buildGrammar {
     language = "hcl";
-    version = "45ce22c";
+    version = "0ff887f";
     source = fetchFromGitHub {
       owner = "MichaHoffmann";
       repo = "tree-sitter-hcl";
-      rev = "45ce22c16ec924e34517cf785e23c07952e45893";
-      hash = "sha256-SczU8y70mdqDl2iVKTfD8Taq580x31xMswUhoU48yfE=";
+      rev = "0ff887f2a60a147452d52db060de6b42f42f1441";
+      hash = "sha256-L4B2qtGqrtyLHyUMx1p0t4aKncm72dUE+e19Fv5iqUA=";
     };
     meta.homepage = "https://github.com/MichaHoffmann/tree-sitter-hcl";
   };
@@ -747,12 +747,12 @@
   };
   julia = buildGrammar {
     language = "julia";
-    version = "6287135";
+    version = "91ba1c3";
     source = fetchFromGitHub {
       owner = "tree-sitter";
       repo = "tree-sitter-julia";
-      rev = "628713553c42f30595a3b0085bb587e9359b986a";
-      hash = "sha256-vB9HnWQ+659Itu8cvd0meLbbLzn62/dDroA3vB7ZtIs=";
+      rev = "91ba1c3c9b50f388d4b67518c04bc9a003ed3475";
+      hash = "sha256-NLUVDfZUjvTnbYwxwij+f9WL7qhduEGrfAUKvEZh/QU=";
     };
     meta.homepage = "https://github.com/tree-sitter/tree-sitter-julia";
   };
@@ -780,12 +780,12 @@
   };
   latex = buildGrammar {
     language = "latex";
-    version = "8c75e93";
+    version = "1ec3941";
     source = fetchFromGitHub {
       owner = "latex-lsp";
       repo = "tree-sitter-latex";
-      rev = "8c75e93cd08ccb7ce1ccab22c1fbd6360e3bcea6";
-      hash = "sha256-zkp4De2eBoOsPZRHHT3mIPVWFPYboTvn6AQ4AkwXhFE=";
+      rev = "1ec3941b971dccfa36cb1cd6221a2e4a1cd3e250";
+      hash = "sha256-m/6GWV797gaJnWVU07RvHjfAeRzGT9GZH3M9HkcjUq0=";
     };
     meta.homepage = "https://github.com/latex-lsp/tree-sitter-latex";
   };
@@ -1137,12 +1137,12 @@
   };
   racket = buildGrammar {
     language = "racket";
-    version = "09cb27a";
+    version = "dc9c334";
     source = fetchFromGitHub {
       owner = "6cdh";
       repo = "tree-sitter-racket";
-      rev = "09cb27a06415bce529a26774a842f5a80d50d362";
-      hash = "sha256-+chEzpHh4eBTEpx2+sFXDMco18zNPFUu5HMQ3dB+LwI=";
+      rev = "dc9c33451fefc2d84d226e55c828adc8a66f2e37";
+      hash = "sha256-ie64no94TtAWsSYaBXmic4oyRAA01fMl97+JWcFU1E8=";
     };
     meta.homepage = "https://github.com/6cdh/tree-sitter-racket";
   };
@@ -1214,12 +1214,12 @@
   };
   rust = buildGrammar {
     language = "rust";
-    version = "0431a2c";
+    version = "f7fb205";
     source = fetchFromGitHub {
       owner = "tree-sitter";
       repo = "tree-sitter-rust";
-      rev = "0431a2c60828731f27491ee9fdefe25e250ce9c9";
-      hash = "sha256-DnUq8TwLGPtN1GXw0AV2t+tj7UKrU4kU32rjGoCHMpE=";
+      rev = "f7fb205c424b0962de59b26b931fe484e1262b35";
+      hash = "sha256-Onk8i2vGHySsjg/O3OZvl7OlDpg3b5/7481f+jJMPCU=";
     };
     meta.homepage = "https://github.com/tree-sitter/tree-sitter-rust";
   };
@@ -1291,13 +1291,14 @@
   };
   sql = buildGrammar {
     language = "sql";
-    version = "41f1de2";
+    version = "54b363b";
     source = fetchFromGitHub {
       owner = "derekstride";
       repo = "tree-sitter-sql";
-      rev = "41f1de238b7b4a8cc9e118759881aad8585d36ad";
-      hash = "sha256-LORSWO5Ui/Nq1SReERSWZ+BEtxKEJ545LPpA6HbY8Z4=";
+      rev = "54b363b87c22787f9dcfabb5d8aa221cb65ace42";
+      hash = "sha256-ku4t3IyPNIIXVt3RvUoCG+TUbe62m7EFtXLUiAPb+pQ=";
     };
+    generate = true;
     meta.homepage = "https://github.com/derekstride/tree-sitter-sql";
   };
   supercollider = buildGrammar {
@@ -1414,12 +1415,12 @@
   };
   tsx = buildGrammar {
     language = "tsx";
-    version = "0ae3828";
+    version = "faad909";
     source = fetchFromGitHub {
       owner = "tree-sitter";
       repo = "tree-sitter-typescript";
-      rev = "0ae382803abce0807e90f498105c713b9233e0b2";
-      hash = "sha256-we8jkX8Nl9+eGw8c6ZmH5hW7yfzFaNhQ+WDzRvMMx9A=";
+      rev = "faad9094f4061a43d4e9005439e9e85c6541ebe7";
+      hash = "sha256-8W/YX2EP3brbDsURZ8YI04KqgLOK6QqXaiFikpwrTV0=";
     };
     location = "tsx";
     meta.homepage = "https://github.com/tree-sitter/tree-sitter-typescript";
@@ -1448,12 +1449,12 @@
   };
   typescript = buildGrammar {
     language = "typescript";
-    version = "0ae3828";
+    version = "faad909";
     source = fetchFromGitHub {
       owner = "tree-sitter";
       repo = "tree-sitter-typescript";
-      rev = "0ae382803abce0807e90f498105c713b9233e0b2";
-      hash = "sha256-we8jkX8Nl9+eGw8c6ZmH5hW7yfzFaNhQ+WDzRvMMx9A=";
+      rev = "faad9094f4061a43d4e9005439e9e85c6541ebe7";
+      hash = "sha256-8W/YX2EP3brbDsURZ8YI04KqgLOK6QqXaiFikpwrTV0=";
     };
     location = "typescript";
     meta.homepage = "https://github.com/tree-sitter/tree-sitter-typescript";
diff --git a/pkgs/applications/editors/vim/plugins/update-shell.nix b/pkgs/applications/editors/vim/plugins/update-shell.nix
index 52a9e741af21..eae7db7f53ec 100644
--- a/pkgs/applications/editors/vim/plugins/update-shell.nix
+++ b/pkgs/applications/editors/vim/plugins/update-shell.nix
@@ -3,7 +3,7 @@
 # Ideally, pkgs points to default.nix file of Nixpkgs official tree
 with pkgs;
 let
-  pyEnv = python3.withPackages (ps: [ ps.GitPython ]);
+  pyEnv = python3.withPackages (ps: [ ps.gitpython ]);
 in
 
 mkShell {
diff --git a/pkgs/applications/editors/vim/plugins/vim-utils.nix b/pkgs/applications/editors/vim/plugins/vim-utils.nix
index 09c5527cd0ec..f0e4e8e982e8 100644
--- a/pkgs/applications/editors/vim/plugins/vim-utils.nix
+++ b/pkgs/applications/editors/vim/plugins/vim-utils.nix
@@ -1,8 +1,6 @@
 # tests available at pkgs/test/vim
-{ lib, stdenv, vim, vimPlugins, vim_configurable, buildEnv, writeText
+{ lib, stdenv, vim, vimPlugins, buildEnv, writeText
 , runCommand, makeWrapper
-, nix-prefetch-hg, nix-prefetch-git
-, fetchFromGitHub, runtimeShell
 , python3
 , callPackage, makeSetupHook
 , linkFarm
@@ -186,9 +184,9 @@ let
       depsOfOptionalPlugins = lib.subtractLists opt (findDependenciesRecursively opt);
       startWithDeps = findDependenciesRecursively start;
       allPlugins = lib.unique (startWithDeps ++ depsOfOptionalPlugins);
-      python3Env = python3.withPackages (ps:
-        lib.flatten (builtins.map (plugin: (plugin.python3Dependencies or (_: [])) ps) allPlugins)
-      );
+      allPython3Dependencies = ps:
+        lib.flatten (builtins.map (plugin: (plugin.python3Dependencies or (_: [])) ps) allPlugins);
+      python3Env = python3.withPackages allPython3Dependencies;
 
       packdirStart = vimFarm "pack/${packageName}/start" "packdir-start" allPlugins;
       packdirOpt = vimFarm "pack/${packageName}/opt" "packdir-opt" opt;
@@ -201,7 +199,7 @@ let
         ln -s ${python3Env}/${python3Env.sitePackages} $out/pack/${packageName}/start/__python3_dependencies/python3
       '';
     in
-      [ packdirStart packdirOpt python3link ];
+      [ packdirStart packdirOpt ] ++ lib.optional (allPython3Dependencies python3.pkgs != []) python3link;
   in
     buildEnv {
       name = "vim-pack-dir";
diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix
index 36ce6758aed3..834386997e3c 100644
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -891,8 +891,8 @@ let
         mktplcRef = {
           name = "gitlens";
           publisher = "eamodio";
-          version = "2022.11.2204";
-          sha256 = "0npr9fymfjnrq7xvfj6fdc04lysz28qncf9r8syv0w9873f3695h";
+          version = "2022.12.604";
+          sha256 = "sha256-yfqGITviASp5ZDEJA+zyVz1LpPWV4FM/4fU4eq52Xng=";
         };
         meta = with lib; {
           changelog = "https://marketplace.visualstudio.com/items/eamodio.gitlens/changelog";
@@ -1468,8 +1468,8 @@ let
         mktplcRef = {
           name = "latex-workshop";
           publisher = "James-Yu";
-          version = "9.1.0";
-          sha256 = "sha256-a/v8/5ztB9DXqYpGWMYSRIwZIj1D+iebG35fO0yDjQQ=";
+          version = "9.1.1";
+          sha256 = "sha256-Xt/z5r9R090Z9nP1v7k+jYm9EOcjy0GfYiYpc7jNid4=";
         };
         meta = with lib; {
           changelog = "https://marketplace.visualstudio.com/items/James-Yu.latex-workshop/changelog";
@@ -2544,8 +2544,8 @@ let
         mktplcRef = {
           name = "code-spell-checker";
           publisher = "streetsidesoftware";
-          version = "2.11.1";
-          sha256 = "sha256-o6Se+xpqwrdJIMnVE/HaDGIoDqZkeX0nTGHa8GjaqVQ=";
+          version = "2.12.0";
+          sha256 = "sha256-Dhd0QVWdCCvdGKuu8OB4KrBS0XUHWLzRSyreAf7sGLU=";
         };
         meta = with lib; {
           changelog = "https://marketplace.visualstudio.com/items/streetsidesoftware.code-spell-checker/changelog";
diff --git a/pkgs/applications/editors/zee/default.nix b/pkgs/applications/editors/zee/default.nix
index 9442044a1697..8de11fd5d59c 100644
--- a/pkgs/applications/editors/zee/default.nix
+++ b/pkgs/applications/editors/zee/default.nix
@@ -1,4 +1,4 @@
-{ lib, rustPlatform, fetchFromGitHub, pkg-config, openssl, stdenv, Security }:
+{ lib, rustPlatform, fetchFromGitHub, fetchpatch, pkg-config, openssl, stdenv, Security }:
 
 rustPlatform.buildRustPackage rec {
   pname = "zee";
@@ -11,6 +11,11 @@ rustPlatform.buildRustPackage rec {
     sha256 = "sha256-/9SogKOaXdFDB+e0//lrenTTbfmXqNFGr23L+6Pnm8w=";
   };
 
+  cargoPatches = [
+    # fixed upstream but unreleased
+    ./update-ropey-for-rust-1.65.diff
+  ];
+
   nativeBuildInputs = [ pkg-config ];
 
   buildInputs = [ openssl ] ++ lib.optional stdenv.isDarwin Security;
@@ -20,7 +25,7 @@ rustPlatform.buildRustPackage rec {
   # see https://github.com/zee-editor/zee#syntax-highlighting
   ZEE_DISABLE_GRAMMAR_BUILD=1;
 
-  cargoSha256 = "sha256-mbqI1csnU95VWgax4GjIxB+nhMtmpaeJ8QQ3qb0hY4c=";
+  cargoHash = "sha256-fBBjtjM7AnyAL6EOFstL4h6yS+UoLgxck6Mc0tJcXaI=";
 
   meta = with lib; {
     description = "A modern text editor for the terminal written in Rust";
diff --git a/pkgs/applications/editors/zee/update-ropey-for-rust-1.65.diff b/pkgs/applications/editors/zee/update-ropey-for-rust-1.65.diff
new file mode 100644
index 000000000000..edc3f6baa4b7
--- /dev/null
+++ b/pkgs/applications/editors/zee/update-ropey-for-rust-1.65.diff
@@ -0,0 +1,28 @@
+diff --git a/Cargo.lock b/Cargo.lock
+index 7159c28..0fa43c2 100644
+--- a/Cargo.lock
++++ b/Cargo.lock
+@@ -1248,9 +1248,9 @@ dependencies = [
+ 
+ [[package]]
+ name = "ropey"
+-version = "1.4.1"
++version = "1.5.0"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "fa0dd9b26e2a102b33d400b7b7d196c81a4014eb96eda90b1c5b48d7215d9633"
++checksum = "bbd22239fafefc42138ca5da064f3c17726a80d2379d817a3521240e78dd0064"
+ dependencies = [
+  "smallvec",
+  "str_indices",
+@@ -1408,9 +1408,9 @@ checksum = "a2eb9349b6444b326872e140eb1cf5e7c522154d69e7a0ffb0fb81c06b37543f"
+ 
+ [[package]]
+ name = "str_indices"
+-version = "0.3.2"
++version = "0.4.0"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "adfad63a1b47951101cd667a85b2959a62910cf03f814fff25df89c460b873f8"
++checksum = "9d9199fa80c817e074620be84374a520062ebac833f358d74b37060ce4a0f2c0"
+ 
+ [[package]]
+ name = "strsim"
diff --git a/pkgs/applications/emulators/dolphin-emu/default.nix b/pkgs/applications/emulators/dolphin-emu/default.nix
index 5eec3c865df5..ad9c470bf427 100644
--- a/pkgs/applications/emulators/dolphin-emu/default.nix
+++ b/pkgs/applications/emulators/dolphin-emu/default.nix
@@ -21,10 +21,10 @@
 , fetchFromGitHub
 , libusb1
 , libevdev
-, wxGTK30-gtk3
+, wxGTK30
 , soundtouch
 , miniupnpc
-, mbedtls
+, mbedtls_2
 , curl
 , lzo
 , sfml
@@ -101,10 +101,10 @@ stdenv.mkDerivation rec {
     portaudio
     libusb1
     libpulseaudio
-    wxGTK30-gtk3
+    wxGTK30
     soundtouch
     miniupnpc
-    mbedtls
+    mbedtls_2
     curl
     lzo
     sfml
diff --git a/pkgs/applications/emulators/dolphin-emu/master.nix b/pkgs/applications/emulators/dolphin-emu/master.nix
index eee0213ea12b..17a3049ea4f0 100644
--- a/pkgs/applications/emulators/dolphin-emu/master.nix
+++ b/pkgs/applications/emulators/dolphin-emu/master.nix
@@ -20,7 +20,7 @@
 , alsa-lib
 , miniupnpc
 , enet
-, mbedtls
+, mbedtls_2
 , soundtouch
 , sfml
 , xz
@@ -90,7 +90,7 @@ stdenv.mkDerivation rec {
     hidapi
     miniupnpc
     enet
-    mbedtls
+    mbedtls_2
     soundtouch
     sfml
     xz
diff --git a/pkgs/applications/emulators/dolphin-emu/primehack.nix b/pkgs/applications/emulators/dolphin-emu/primehack.nix
index 93ed03097be9..73a4485af260 100644
--- a/pkgs/applications/emulators/dolphin-emu/primehack.nix
+++ b/pkgs/applications/emulators/dolphin-emu/primehack.nix
@@ -29,7 +29,7 @@
 , alsa-lib
 , miniupnpc
 , enet
-, mbedtls
+, mbedtls_2
 , soundtouch
 , sfml
 , fmt
@@ -87,7 +87,7 @@ stdenv.mkDerivation rec {
     hidapi
     miniupnpc
     enet
-    mbedtls
+    mbedtls_2
     soundtouch
     sfml
     fmt
diff --git a/pkgs/applications/emulators/mame/emuopts.patch b/pkgs/applications/emulators/mame/001-use-absolute-paths.diff
index 233d64eb15d0..35ed10d18172 100644
--- a/pkgs/applications/emulators/mame/emuopts.patch
+++ b/pkgs/applications/emulators/mame/001-use-absolute-paths.diff
@@ -10,18 +10,18 @@
 -	{ OPTION_CTRLRPATH,                                  "ctrlr",     core_options::option_type::STRING,     "path to controller definitions" },
 -	{ OPTION_INIPATH,                                    ".;ini;ini/presets",     core_options::option_type::STRING,     "path to ini files" },
 -	{ OPTION_FONTPATH,                                   ".",         core_options::option_type::STRING,     "path to font files" },
-+	{ OPTION_HASHPATH ";hash_directory;hash",            "hash;@mame@/hash",      core_options::option_type::STRING,     "path to software definition files" },
-+	{ OPTION_SAMPLEPATH ";sp",                           "samples;@mame@/samples",   core_options::option_type::STRING,     "path to audio sample sets" },
-+	{ OPTION_ARTPATH,                                    "artwork;@mame@/artwork",   core_options::option_type::STRING,     "path to artwork files" },
-+	{ OPTION_CTRLRPATH,                                  "ctrlr;@mame@/ctrlr",     core_options::option_type::STRING,     "path to controller definitions" },
-+	{ OPTION_INIPATH,                                    ".;ini;ini/presets;@mame@/ini/presets",     core_options::option_type::STRING,     "path to ini files" },
-+	{ OPTION_FONTPATH,                                   ".;@mame@",         core_options::option_type::STRING,     "path to font files" },
++	{ OPTION_HASHPATH ";hash_directory;hash",            "hash;@mamePath@/hash",      core_options::option_type::STRING,     "path to software definition files" },
++	{ OPTION_SAMPLEPATH ";sp",                           "samples;@mamePath@/samples",   core_options::option_type::STRING,     "path to audio sample sets" },
++	{ OPTION_ARTPATH,                                    "artwork;@mamePath@/artwork",   core_options::option_type::STRING,     "path to artwork files" },
++	{ OPTION_CTRLRPATH,                                  "ctrlr;@mamePath@/ctrlr",     core_options::option_type::STRING,     "path to controller definitions" },
++	{ OPTION_INIPATH,                                    ".;ini;ini/presets;@mamePath@/ini/presets",     core_options::option_type::STRING,     "path to ini files" },
++	{ OPTION_FONTPATH,                                   ".;@mamePath@",         core_options::option_type::STRING,     "path to font files" },
  	{ OPTION_CHEATPATH,                                  "cheat",     core_options::option_type::STRING,     "path to cheat files" },
  	{ OPTION_CROSSHAIRPATH,                              "crosshair", core_options::option_type::STRING,     "path to crosshair files" },
 -	{ OPTION_PLUGINSPATH,                                "plugins",   core_options::option_type::STRING,     "path to plugin files" },
 -	{ OPTION_LANGUAGEPATH,                               "language",  core_options::option_type::STRING,     "path to UI translation files" },
-+	{ OPTION_PLUGINSPATH,                                "plugins;@mame@/plugins",   core_options::option_type::STRING,     "path to plugin files" },
-+	{ OPTION_LANGUAGEPATH,                               "language;@mame@/language",  core_options::option_type::STRING,     "path to UI translation files" },
++	{ OPTION_PLUGINSPATH,                                "plugins;@mamePath@/plugins",   core_options::option_type::STRING,     "path to plugin files" },
++	{ OPTION_LANGUAGEPATH,                               "language;@mamePath@/language",  core_options::option_type::STRING,     "path to UI translation files" },
  	{ OPTION_SWPATH,                                     "software",  core_options::option_type::STRING,     "path to loose software" },
  
  	// output directory options
diff --git a/pkgs/applications/emulators/mame/default.nix b/pkgs/applications/emulators/mame/default.nix
index a5b104d31abe..760b9e63d282 100644
--- a/pkgs/applications/emulators/mame/default.nix
+++ b/pkgs/applications/emulators/mame/default.nix
@@ -1,24 +1,24 @@
 { lib
 , stdenv
+, fetchFromGitHub
 , alsa-lib
+, SDL2
+, SDL2_ttf
 , copyDesktopItems
-, CoreAudioKit
 , expat
-, fetchFromGitHub
-, fetchurl
 , flac
 , fontconfig
-, ForceFeedback
 , glm
 , installShellFiles
+, libXi
+, libXinerama
 , libjpeg
 , libpcap
 , libpulseaudio
-, libXi
-, libXinerama
 , lua5_3
 , makeDesktopItem
 , makeWrapper
+, papirus-icon-theme
 , pkg-config
 , portaudio
 , portmidi
@@ -26,31 +26,26 @@
 , python3
 , qtbase
 , rapidjson
-, SDL2
-, SDL2_ttf
 , sqlite
 , utf8proc
 , which
 , writeScript
 , zlib
+, darwin
 }:
 
 let
-  # Get icon from Arch Linux package
-  icon = fetchurl {
-    url = "https://raw.githubusercontent.com/archlinux/svntogit-community/614b24ef3856cb52b5cafc386b0f77923cbc9156/trunk/mame.svg";
-    sha256 = "sha256-F8RCyTPXZBdeTOHeUKgMDC3dXXM8rwnDzV5rppesQ/Q=";
-  };
-  dest = "$out/opt/mame";
+  inherit (darwin.apple_sdk.frameworks) CoreAudioKit ForceFeedback;
 in
 stdenv.mkDerivation rec {
   pname = "mame";
   version = "0.250";
+  srcVersion = builtins.replaceStrings [ "." ] [ "" ] version;
 
   src = fetchFromGitHub {
     owner = "mamedev";
     repo = "mame";
-    rev = "mame${builtins.replaceStrings [ "." ] [ "" ] version}";
+    rev = "mame${srcVersion}";
     sha256 = "sha256-jexs/1ovRk9Is5orD7hT9fN+dYm+WA+57aZ6JH7zjL4=";
   };
 
@@ -109,15 +104,17 @@ stdenv.mkDerivation rec {
   ];
 
   patches = [
-    # by default MAME assumes that paths with stock resources
-    # are relative and that you run MAME changing to
-    # install directory, so we add absolute paths here
-    ./emuopts.patch
+    # by default MAME assumes that paths with stock resources are relative and
+    # that you run MAME changing to install directory, so we add absolute paths
+    # here
+    ./001-use-absolute-paths.diff
   ];
 
+  # Since the bug described in https://github.com/NixOS/nixpkgs/issues/135438,
+  # it is not possible to use substituteAll
   postPatch = ''
     substituteInPlace src/emu/emuopts.cpp \
-      --subst-var-by mame ${dest}
+      --subst-var-by mamePath "$out/opt/mame"
   '';
 
   desktopItems = [
@@ -134,23 +131,26 @@ stdenv.mkDerivation rec {
     })
   ];
 
-  installPhase = ''
+  # TODO: copy shaders from src/osd/modules/opengl/shader/glsl*.*h
+  # to the final package after we figure out how they work
+  installPhase = let
+    icon = "${papirus-icon-theme}/share/icons/Papirus/32x32/apps/mame.svg";
+  in ''
     runHook preInstall
 
     # mame
-    mkdir -p ${dest}
+    mkdir -p $out/opt/mame
 
     install -Dm755 mame -t $out/bin
     install -Dm644 ${icon} $out/share/icons/hicolor/scalable/apps/mame.svg
     installManPage docs/man/*.1 docs/man/*.6
-    cp -ar {artwork,bgfx,plugins,language,ctrlr,keymaps,hash} ${dest}
-    # TODO: copy shaders from src/osd/modules/opengl/shader/glsl*.*h
-    # to the final package after we figure out how they work
+    cp -ar {artwork,bgfx,plugins,language,ctrlr,keymaps,hash} $out/opt/mame
 
     # mame-tools
-    for _i in castool chdman floptool imgtool jedutil ldresample ldverify nltool nlwav pngcmp regrep romcmp \
-              split srcclean testkeys unidasm; do
-      install -Dm755 $_i -t $tools/bin
+    for _tool in castool chdman floptool imgtool jedutil ldresample ldverify \
+                 nltool nlwav pngcmp regrep romcmp split srcclean testkeys \
+                 unidasm; do
+       install -Dm755 $_tool -t $tools/bin
     done
     mv $tools/bin/{,mame-}split
 
@@ -176,11 +176,26 @@ stdenv.mkDerivation rec {
   '';
 
   meta = with lib; {
-    broken = stdenv.isDarwin;
-    description = "Is a multi-purpose emulation framework";
     homepage = "https://www.mamedev.org/";
+    description = "A multi-purpose emulation framework";
+    longDescription = ''
+      MAME's purpose is to preserve decades of software history. As electronic
+      technology continues to rush forward, MAME prevents this important
+      "vintage" software from being lost and forgotten. This is achieved by
+      documenting the hardware and how it functions. The source code to MAME
+      serves as this documentation. The fact that the software is usable serves
+      primarily to validate the accuracy of the documentation (how else can you
+      prove that you have recreated the hardware faithfully?). Over time, MAME
+      (originally stood for Multiple Arcade Machine Emulator) absorbed the
+      sister-project MESS (Multi Emulator Super System), so MAME now documents a
+      wide variety of (mostly vintage) computers, video game consoles and
+      calculators, in addition to the arcade video games that were its initial
+      focus.
+    '';
+    changelog = "https://github.com/mamedev/mame/releases/download/mame${srcVersion}/whatsnew_${srcVersion}.txt";
     license = with licenses; [ bsd3 gpl2Plus ];
-    platforms = platforms.unix;
     maintainers = with maintainers; [ thiagokokada ];
+    platforms = platforms.unix;
+    broken = stdenv.isDarwin;
   };
 }
diff --git a/pkgs/applications/graphics/ImageMagick/6.x.nix b/pkgs/applications/graphics/ImageMagick/6.x.nix
index d0b76706dc92..e09de1b25023 100644
--- a/pkgs/applications/graphics/ImageMagick/6.x.nix
+++ b/pkgs/applications/graphics/ImageMagick/6.x.nix
@@ -35,13 +35,13 @@ in
 
 stdenv.mkDerivation rec {
   pname = "imagemagick";
-  version = "6.9.12-26";
+  version = "6.9.12-68";
 
   src = fetchFromGitHub {
     owner = "ImageMagick";
     repo = "ImageMagick6";
     rev = version;
-    sha256 = "sha256-oNorY/93jk1v5BS1T3wqctXuzV4o8JlyZtHnsNYmO4U=";
+    sha256 = "sha256-slQcA0cblxtG/1DiJx5swUh7Kfwgz5HG70eqJFLaQJI=";
   };
 
   outputs = [ "out" "dev" "doc" ]; # bin/ isn't really big
@@ -91,7 +91,7 @@ stdenv.mkDerivation rec {
     ++ lib.optional libXtSupport libXt
     ++ lib.optional libwebpSupport libwebp;
 
-  doCheck = false; # fails 6 out of 76 tests
+  doCheck = false; # fails 2 out of 76 tests
 
   postInstall = ''
     (cd "$dev/include" && ln -s ImageMagick* ImageMagick)
diff --git a/pkgs/applications/graphics/ImageMagick/default.nix b/pkgs/applications/graphics/ImageMagick/default.nix
index 44397108f245..5de210fcad25 100644
--- a/pkgs/applications/graphics/ImageMagick/default.nix
+++ b/pkgs/applications/graphics/ImageMagick/default.nix
@@ -46,13 +46,13 @@ in
 
 stdenv.mkDerivation rec {
   pname = "imagemagick";
-  version = "7.1.0-52";
+  version = "7.1.0-53";
 
   src = fetchFromGitHub {
     owner = "ImageMagick";
     repo = "ImageMagick";
     rev = version;
-    hash = "sha256-GV71O4cHUKJ7+6u4T+vdaFz5q2SpZVDCfEAbfz0s6f4=";
+    hash = "sha256-U111mor498zAyoYKqCerb9cnxUUOlXKYPfaIzKxZiUM=";
   };
 
   outputs = [ "out" "dev" "doc" ]; # bin/ isn't really big
diff --git a/pkgs/applications/graphics/digikam/default.nix b/pkgs/applications/graphics/digikam/default.nix
index f08e49283c12..19d0f5242e06 100644
--- a/pkgs/applications/graphics/digikam/default.nix
+++ b/pkgs/applications/graphics/digikam/default.nix
@@ -56,11 +56,11 @@
 
 mkDerivation rec {
   pname   = "digikam";
-  version = "7.8.0";
+  version = "7.9.0";
 
   src = fetchurl {
     url = "mirror://kde/stable/${pname}/${version}/digiKam-${version}.tar.xz";
-    sha256 = "sha256-sIV3sLFe+ZhDaVcIqiwOmNVHMD2Fvio7OZBUhPLKts4=";
+    sha256 = "sha256-w7gKvAkNo8u8QuZ6QDCA1/X+CnyYaYc1vaVWxgMUurQ=";
   };
 
   nativeBuildInputs = [ cmake doxygen extra-cmake-modules kdoctools wrapGAppsHook ];
diff --git a/pkgs/applications/graphics/drawio/default.nix b/pkgs/applications/graphics/drawio/default.nix
index e755b708a063..513822b4e744 100644
--- a/pkgs/applications/graphics/drawio/default.nix
+++ b/pkgs/applications/graphics/drawio/default.nix
@@ -11,11 +11,11 @@
 
 stdenv.mkDerivation rec {
   pname = "drawio";
-  version = "20.3.0";
+  version = "20.6.1";
 
   src = fetchurl {
     url = "https://github.com/jgraph/drawio-desktop/releases/download/v${version}/drawio-x86_64-${version}.rpm";
-    sha256 = "bfcd363f549ce8dc13ae2287cec5099e4bf1d0d4b6f8deef40a81279f78817e1";
+    sha256 = "8d1e3d44e53e62dd6dc7f231af5b682c9ff0e798a6480528444ba52cce02b4c9";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/graphics/freecad/default.nix b/pkgs/applications/graphics/freecad/default.nix
index 3794f7cf84fa..bcc504effec2 100644
--- a/pkgs/applications/graphics/freecad/default.nix
+++ b/pkgs/applications/graphics/freecad/default.nix
@@ -4,7 +4,7 @@
 , fetchFromGitHub
 , cmake
 , ninja
-, GitPython
+, gitpython
 , boost
 , coin3d
 , eigen
@@ -68,7 +68,7 @@ mkDerivation rec {
   ];
 
   buildInputs = [
-    GitPython # for addon manager
+    gitpython # for addon manager
     boost
     coin3d
     eigen
diff --git a/pkgs/applications/graphics/rnote/default.nix b/pkgs/applications/graphics/rnote/default.nix
index eb0eaaeda95d..560c5c6a4927 100644
--- a/pkgs/applications/graphics/rnote/default.nix
+++ b/pkgs/applications/graphics/rnote/default.nix
@@ -6,7 +6,6 @@
 , clang
 , cmake
 , desktop-file-utils
-, gio-sharp
 , glib
 , gstreamer
 , gtk4
@@ -24,20 +23,20 @@
 
 stdenv.mkDerivation rec {
   pname = "rnote";
-  version = "0.5.7";
+  version = "0.5.9";
 
   src = fetchFromGitHub {
     owner = "flxzt";
     repo = "rnote";
     rev = "v${version}";
     fetchSubmodules = true;
-    hash = "sha256-w4y+t8idcaNwvC2Wp9SRjcd4m23Zt+yHG2fjOA2rBU8=";
+    hash = "sha256-Sy8EHl4UuDMwRAKDkl7njD9GSzKpy1Cfsgw53On+nxo=";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src;
     name = "${pname}-${version}";
-    hash = "sha256-Hybbbokru4vz5ly3oZuNGdBa+lYbhdYjESUpRxIUqJc=";
+    hash = "sha256-Pe4lNcvJNELAitaGY56EUJ8iN7Dkh8DoUpA/t+aRuqk=";
   };
 
   nativeBuildInputs = [
@@ -60,7 +59,6 @@ stdenv.mkDerivation rec {
 
   buildInputs = [
     alsa-lib
-    gio-sharp
     glib
     gstreamer
     gtk4
@@ -81,6 +79,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     homepage = "https://github.com/flxzt/rnote";
+    changelog = "https://github.com/flxzt/rnote/releases/tag/${src.rev}";
     description = "Simple drawing application to create handwritten notes";
     license = licenses.gpl3Only;
     maintainers = with maintainers; [ dotlambda yrd ];
diff --git a/pkgs/applications/misc/1password/default.nix b/pkgs/applications/misc/1password/default.nix
index e744388b8649..5498651cfe80 100644
--- a/pkgs/applications/misc/1password/default.nix
+++ b/pkgs/applications/misc/1password/default.nix
@@ -12,12 +12,12 @@ let
     if extension == "zip" then fetchzip args else fetchurl args;
 
   pname = "1password-cli";
-  version = "2.7.3";
+  version = "2.9.1";
   sources = rec {
-    aarch64-linux = fetch "linux_arm64" "sha256-FxApOWyExyfuRFQhxAVBWZGqQNmarBFBRB4jqsreWL0=" "zip";
-    i686-linux = fetch "linux_386" "sha256-Ta6mdmcsKnNRMz9vwEadZ/xXVBran5BIJQngzNz3PUs=" "zip";
-    x86_64-linux = fetch "linux_amd64" "sha256-Lvxnp5KmkIj9jnaWg02a27eRYIx7WTNSLx+RJ04Vt+g=" "zip";
-    aarch64-darwin = fetch "apple_universal" "sha256-6qrNgb5ae+qqlNsNDLbKNeWj0o/SRs+2G/4DfK5Wnhg=" "pkg";
+    aarch64-linux = fetch "linux_arm64" "sha256-sFh3jIGknR7RA3/pckvBkFvVoxYfXqYuyUJuc/AfecU=" "zip";
+    i686-linux = fetch "linux_386" "sha256-JbBjAdGRtpwkk1svoyNw22BGbslwD8ZuNJRihUoFMP4=" "zip";
+    x86_64-linux = fetch "linux_amd64" "sha256-yUo8LhT9iTl1z5+Cs9/E/YPMrnnimhFK9A1b1og0TSA=" "zip";
+    aarch64-darwin = fetch "apple_universal" "sha256-IFaLcMXOLc0oZIWVOaDuyUmUxJc+Keeg77RR/SlCGxI=" "pkg";
     x86_64-darwin = aarch64-darwin;
   };
   platforms = builtins.attrNames sources;
diff --git a/pkgs/applications/misc/authenticator/default.nix b/pkgs/applications/misc/authenticator/default.nix
index cdf6ca3e6f80..735355107ef2 100644
--- a/pkgs/applications/misc/authenticator/default.nix
+++ b/pkgs/applications/misc/authenticator/default.nix
@@ -42,7 +42,6 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [
     appstream-glib
-    clang
     desktop-file-utils
     meson
     ninja
@@ -52,6 +51,7 @@ stdenv.mkDerivation rec {
     cargoSetupHook
     rust.cargo
     rust.rustc
+    bindgenHook
   ]);
 
   buildInputs = [
@@ -69,8 +69,6 @@ stdenv.mkDerivation rec {
     zbar
   ];
 
-  LIBCLANG_PATH = "${lib.getLib libclang}/lib";
-
   meta = {
     description = "Two-factor authentication code generator for GNOME";
     homepage = "https://gitlab.gnome.org/World/Authenticator";
diff --git a/pkgs/applications/misc/clipcat/default.nix b/pkgs/applications/misc/clipcat/default.nix
index 38c0c103943a..be197e819371 100644
--- a/pkgs/applications/misc/clipcat/default.nix
+++ b/pkgs/applications/misc/clipcat/default.nix
@@ -14,8 +14,6 @@ rustPlatform.buildRustPackage rec {
 
   cargoSha256 = "1n4il3l59m2a6ca54vfaivzg25abf8s4w5kpd5q51p13624iz0kb";
 
-  LIBCLANG_PATH = "${llvmPackages.libclang.lib}/lib";
-
   # needed for internal protobuf c wrapper library
   PROTOC = "${protobuf}/bin/protoc";
   PROTOC_INCLUDE = "${protobuf}/include";
@@ -23,8 +21,7 @@ rustPlatform.buildRustPackage rec {
   nativeBuildInputs = [
     pkg-config
 
-    clang
-    llvmPackages.libclang
+    rustPlatform.bindgenHook
 
     rustfmt
     protobuf
diff --git a/pkgs/applications/misc/hugo/default.nix b/pkgs/applications/misc/hugo/default.nix
index bfe380275899..a92a6801ba90 100644
--- a/pkgs/applications/misc/hugo/default.nix
+++ b/pkgs/applications/misc/hugo/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "hugo";
-  version = "0.107.0";
+  version = "0.108.0";
 
   src = fetchFromGitHub {
     owner = "gohugoio";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-8Ru1T6GSz5TfMxFvUU2QgpiWNLJK+ky723qc3flrDIw=";
+    sha256 = "sha256-MbpBGqu7IwQCf9DjSfIDi25ZGJYTI6xxSk9wPWxychw=";
   };
 
-  vendorSha256 = "sha256-92QLkSUrwMEZ/8pIeOj4KKtC47oN+ITxJnpp7Fb0Z10=";
+  vendorSha256 = "sha256-qFqSpQExz4u1ngjpt2Li6dk/qz4DCKEY9IcFFCna5is=";
 
   doCheck = false;
 
diff --git a/pkgs/applications/misc/imag/default.nix b/pkgs/applications/misc/imag/default.nix
index b637cd077d76..acc03f59a701 100644
--- a/pkgs/applications/misc/imag/default.nix
+++ b/pkgs/applications/misc/imag/default.nix
@@ -21,13 +21,11 @@ rustPlatform.buildRustPackage rec {
     sha256 = "0f9915f083z5qqcxyavj0w6m973c8m1x7kfb89pah5agryy5mkaq";
   };
 
-  nativeBuildInputs = [ installShellFiles pkg-config ];
+  nativeBuildInputs = [ installShellFiles pkg-config rustPlatform.bindgenHook ];
   buildInputs = [ openssl ]
     ++ lib.optional stdenv.isDarwin Security;
   checkInputs = [ gitMinimal util-linuxMinimal ];
 
-  LIBCLANG_PATH = "${llvmPackages.libclang.lib}/lib";
-
   cargoSha256 = "1vnrc72g2271i2p847z30kplxmdpi60n3dzpw0s7dahg33g14ai6";
 
   checkPhase = ''
diff --git a/pkgs/applications/misc/latte-dock/default.nix b/pkgs/applications/misc/latte-dock/default.nix
index 7e48781f5c47..f232400fbfbf 100644
--- a/pkgs/applications/misc/latte-dock/default.nix
+++ b/pkgs/applications/misc/latte-dock/default.nix
@@ -22,7 +22,7 @@ mkDerivation rec {
     ./0001-Disable-autostart.patch
   ];
 
-  fixupPhase = ''
+  postInstall = ''
     mkdir -p $out/etc/xdg/autostart
     cp $out/share/applications/org.kde.latte-dock.desktop $out/etc/xdg/autostart
   '';
diff --git a/pkgs/applications/misc/lenmus/default.nix b/pkgs/applications/misc/lenmus/default.nix
index f50dd23ff013..023045d67917 100644
--- a/pkgs/applications/misc/lenmus/default.nix
+++ b/pkgs/applications/misc/lenmus/default.nix
@@ -11,7 +11,7 @@
 , libpng
 , pngpp
 , zlib
-, wxGTK30-gtk3
+, wxGTK30
 , wxsqlite3
 }:
 
@@ -55,7 +55,7 @@ stdenv.mkDerivation rec {
     libpng
     pngpp
     zlib
-    wxGTK30-gtk3
+    wxGTK30
     wxsqlite3
   ];
 
diff --git a/pkgs/applications/misc/lutris/fhsenv.nix b/pkgs/applications/misc/lutris/fhsenv.nix
index b4b2b2e2ac5d..075755bf217d 100644
--- a/pkgs/applications/misc/lutris/fhsenv.nix
+++ b/pkgs/applications/misc/lutris/fhsenv.nix
@@ -30,7 +30,7 @@ in buildFHSUserEnv {
     # DGen // TODO: libarchive is broken
 
     # Dolphin
-    bluez ffmpeg gettext portaudio wxGTK30-gtk3 miniupnpc mbedtls lzo sfml gsm
+    bluez ffmpeg gettext portaudio wxGTK30 miniupnpc mbedtls_2 lzo sfml gsm
     wavpack orc nettle gmp pcre vulkan-loader
 
     # DOSBox
diff --git a/pkgs/applications/misc/mediainfo-gui/default.nix b/pkgs/applications/misc/mediainfo-gui/default.nix
index a15733dd526c..b3ca8032b196 100644
--- a/pkgs/applications/misc/mediainfo-gui/default.nix
+++ b/pkgs/applications/misc/mediainfo-gui/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, autoreconfHook, pkg-config, libmediainfo, wxGTK30-gtk3
+{ lib, stdenv, fetchurl, autoreconfHook, pkg-config, libmediainfo, wxGTK30
 , desktop-file-utils, libSM, imagemagick }:
 
 stdenv.mkDerivation rec {
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ autoreconfHook pkg-config ];
-  buildInputs = [ libmediainfo wxGTK30-gtk3 desktop-file-utils libSM imagemagick ];
+  buildInputs = [ libmediainfo wxGTK30 desktop-file-utils libSM imagemagick ];
 
   sourceRoot = "./MediaInfo/Project/GNU/GUI/";
 
diff --git a/pkgs/applications/misc/openrgb/default.nix b/pkgs/applications/misc/openrgb/default.nix
index 6de5736e9ac8..ab8415a18823 100644
--- a/pkgs/applications/misc/openrgb/default.nix
+++ b/pkgs/applications/misc/openrgb/default.nix
@@ -1,4 +1,4 @@
-{ lib, mkDerivation, fetchFromGitLab, qmake, libusb1, hidapi, pkg-config, coreutils, mbedtls }:
+{ lib, mkDerivation, fetchFromGitLab, qmake, libusb1, hidapi, pkg-config, coreutils, mbedtls_2 }:
 
 mkDerivation rec {
   pname = "openrgb";
@@ -12,7 +12,7 @@ mkDerivation rec {
   };
 
   nativeBuildInputs = [ qmake pkg-config ];
-  buildInputs = [ libusb1 hidapi mbedtls ];
+  buildInputs = [ libusb1 hidapi mbedtls_2 ];
 
   installPhase = ''
     runHook preInstall
diff --git a/pkgs/applications/misc/oxker/default.nix b/pkgs/applications/misc/oxker/default.nix
index 50d0e5a012b4..0647ba26dc0e 100644
--- a/pkgs/applications/misc/oxker/default.nix
+++ b/pkgs/applications/misc/oxker/default.nix
@@ -2,14 +2,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "oxker";
-  version = "0.1.7";
+  version = "0.1.9";
 
   src = fetchCrate {
     inherit pname version;
-    sha256 = "sha256-kMomzIViN7ooBsjUfCIk0XRi4WtXtiaHWHT2pECx//k=";
+    sha256 = "sha256-3J3Xe9LT4bHatU/wWsF0Gq9gGRcSdCzyQnIIfLXE8KA=";
   };
 
-  cargoSha256 = "sha256-ASBu4p8+/Donmynnyryktc6dXA3yiOb9w5XpmN4PotY=";
+  cargoSha256 = "sha256-TWpshqvWMRk2A6RvjWWQc7Nu6tOrctUBZmzyjEFKPRw=";
 
   meta = with lib; {
     description = "A simple tui to view & control docker containers";
diff --git a/pkgs/applications/misc/pwsafe/default.nix b/pkgs/applications/misc/pwsafe/default.nix
index 75f09742c1e2..8f8aef6c8cfd 100644
--- a/pkgs/applications/misc/pwsafe/default.nix
+++ b/pkgs/applications/misc/pwsafe/default.nix
@@ -6,7 +6,7 @@
 , zip
 , gettext
 , perl
-, wxGTK30-gtk3
+, wxGTK30
 , libXext
 , libXi
 , libXt
@@ -46,7 +46,7 @@ stdenv.mkDerivation rec {
     libXi
     libXt
     libXtst
-    wxGTK30-gtk3
+    wxGTK30
     curl
     qrencode
     libuuid
diff --git a/pkgs/applications/misc/tippecanoe/default.nix b/pkgs/applications/misc/tippecanoe/default.nix
index 4d0936c0b431..a11e1c517411 100644
--- a/pkgs/applications/misc/tippecanoe/default.nix
+++ b/pkgs/applications/misc/tippecanoe/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "tippecanoe";
-  version = "2.13.1";
+  version = "2.15.0";
 
   src = fetchFromGitHub {
     owner = "felt";
     repo = "tippecanoe";
     rev = finalAttrs.version;
-    hash = "sha256-cDNaZ3ZYCUWg30Td1hlzzaB46tI7cFZLvgwCAZN72QI=";
+    hash = "sha256-InKVwB031BLOngcLAa1zRbgoswUb4z5I0FPNMZk9KVI=";
   };
 
   buildInputs = [ sqlite zlib ];
diff --git a/pkgs/applications/misc/tut/default.nix b/pkgs/applications/misc/tut/default.nix
index 1e7c61dca2bc..b33182dc68a9 100644
--- a/pkgs/applications/misc/tut/default.nix
+++ b/pkgs/applications/misc/tut/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "tut";
-  version = "1.0.23";
+  version = "1.0.24";
 
   src = fetchFromGitHub {
     owner = "RasmusLindroth";
     repo = pname;
     rev = version;
-    sha256 = "sha256-nFN0F80QZh3SALtG3xe6mH0zbhcLSRtmcHosD6aPvrE=";
+    sha256 = "sha256-UkgZOBNEeeYkcdp8beePrFmFLa7UWGbQ4dynl8QwnK8=";
   };
 
-  vendorSha256 = "sha256-Y5nHADLKCaqHIje7vMS3mAwiGx4tHixBzYZM+iHEZb8=";
+  vendorSha256 = "sha256-af+uO3NEkMt+aZoOa8NWccgtLD0Kggr2ZZwfIxoP3EU=";
 
   meta = with lib; {
     description = "A TUI for Mastodon with vim inspired keys";
diff --git a/pkgs/applications/misc/xplr/default.nix b/pkgs/applications/misc/xplr/default.nix
index 772d479ff78a..678b8968aae1 100644
--- a/pkgs/applications/misc/xplr/default.nix
+++ b/pkgs/applications/misc/xplr/default.nix
@@ -2,18 +2,18 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "xplr";
-  version = "0.20.0";
+  version = "0.20.1";
 
   src = fetchFromGitHub {
     owner = "sayanarijit";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-TH5ksbEVBlOPmqQOtRmoHTDBRkj/KaMsM+Xc7e2ObzY=";
+    sha256 = "sha256-b3TdhziXPytHitilMBkr6OGaI+CBI3w4qcTIkQtOAjs=";
   };
 
   buildInputs = lib.optional stdenv.isDarwin libiconv;
 
-  cargoSha256 = "sha256-RcH1J5I9FPQ/Npq4I5lcOsZHzvKyYhxmqOIEYcBXqU0=";
+  cargoSha256 = "sha256-pdXLuogkz5q4+B/y/alA900OHVGBT8W6BR7I2aH8IaA=";
 
   meta = with lib; {
     description = "A hackable, minimal, fast TUI file explorer";
diff --git a/pkgs/applications/networking/browsers/chromium/upstream-info.json b/pkgs/applications/networking/browsers/chromium/upstream-info.json
index 5c9c3ae72701..72dd05fdc1d3 100644
--- a/pkgs/applications/networking/browsers/chromium/upstream-info.json
+++ b/pkgs/applications/networking/browsers/chromium/upstream-info.json
@@ -1,8 +1,8 @@
 {
   "stable": {
-    "version": "108.0.5359.94",
-    "sha256": "1zmndi4q9x8fyixwl1mp5qyf883x9xafq7ipzf9vk9d8h62521q6",
-    "sha256bin64": "03s85hf4vxpil27c1kkdicihb42diyyxwfcjji0bq950nl8vpx2d",
+    "version": "108.0.5359.98",
+    "sha256": "07jnhd5y7k4zp2ipz052isw7llagxn8l8rbz8x3jkjz3f5wi7dk0",
+    "sha256bin64": "1hx49932g8abnb5f3a4ly7kjbrkh5bs040dh96zpxvfqx7dn6vrs",
     "deps": {
       "gn": {
         "version": "2022-10-05",
@@ -45,8 +45,8 @@
     }
   },
   "ungoogled-chromium": {
-    "version": "108.0.5359.95",
-    "sha256": "1b3r2yl8qkp8k0kq5yi0a1xsmglniqn3v318fhx0k12cagrgbd5b",
+    "version": "108.0.5359.99",
+    "sha256": "0v5ynal3s28s4f9s4s95hblnjxiy6498qmk04s0vf2ixqwi7rivn",
     "sha256bin64": null,
     "deps": {
       "gn": {
@@ -56,8 +56,8 @@
         "sha256": "1rhadb6qk867jafr85x2m3asis3jv7x06blhmad2d296p26d5w6x"
       },
       "ungoogled-patches": {
-        "rev": "108.0.5359.95-1",
-        "sha256": "0fl95hw6ll0g4lrccfxhhnkz3plqm003z09dz8dr6ycx5x3vqk0b"
+        "rev": "108.0.5359.99-1",
+        "sha256": "0qibibgi54mdwmmcmz613qk9mgjczspvq09bz5m0wpkxbx7hla0i"
       }
     }
   }
diff --git a/pkgs/applications/networking/browsers/dillo/default.nix b/pkgs/applications/networking/browsers/dillo/default.nix
index 9c409c29818c..aff0042ded30 100644
--- a/pkgs/applications/networking/browsers/dillo/default.nix
+++ b/pkgs/applications/networking/browsers/dillo/default.nix
@@ -8,7 +8,7 @@
 , libXinerama
 , libjpeg
 , libpng
-, mbedtls
+, mbedtls_2
 , openssl
 , perl
 , pkg-config
@@ -38,7 +38,7 @@ stdenv.mkDerivation {
     libXinerama
     libjpeg
     libpng
-    mbedtls
+    mbedtls_2
     openssl
     perl
   ];
diff --git a/pkgs/applications/networking/browsers/dillong/default.nix b/pkgs/applications/networking/browsers/dillong/default.nix
index 2d12134caadd..7fc7cc07121d 100644
--- a/pkgs/applications/networking/browsers/dillong/default.nix
+++ b/pkgs/applications/networking/browsers/dillong/default.nix
@@ -5,7 +5,7 @@
 , pkg-config
 , which
 , fltk
-, mbedtls
+, mbedtls_2
 }:
 
 stdenv.mkDerivation {
@@ -27,7 +27,7 @@ stdenv.mkDerivation {
 
   buildInputs = [
     fltk
-    mbedtls
+    mbedtls_2
   ];
 
   # The start_page and home settings refer to /usr.
diff --git a/pkgs/applications/networking/browsers/offpunk/default.nix b/pkgs/applications/networking/browsers/offpunk/default.nix
index 98a5b1cf50f8..82ba0cab8e24 100644
--- a/pkgs/applications/networking/browsers/offpunk/default.nix
+++ b/pkgs/applications/networking/browsers/offpunk/default.nix
@@ -31,14 +31,14 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "offpunk";
-  version = "1.6";
+  version = "1.7.1";
 
   src = fetchFromGitea {
     domain = "notabug.org";
     owner = "ploum";
     repo = "offpunk";
     rev = "v${finalAttrs.version}";
-    sha256 = "1pfafb96xk7vis26zhfq254waz1ic9p0zdkxwpqs84p3vsmny775";
+    sha256 = "1y1xb1ccsprl0xkn4hlh09j8y5xpdn6r860xlrmk12wfk2xrfbfy";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/applications/networking/browsers/vivaldi/default.nix b/pkgs/applications/networking/browsers/vivaldi/default.nix
index 53c01b977e4e..435b5c4fe5dc 100644
--- a/pkgs/applications/networking/browsers/vivaldi/default.nix
+++ b/pkgs/applications/networking/browsers/vivaldi/default.nix
@@ -11,6 +11,7 @@
 , isSnapshot ? false
 , proprietaryCodecs ? false, vivaldi-ffmpeg-codecs ? null
 , enableWidevine ? false, vivaldi-widevine ? null
+, forceDarkMode ? false
 , commandLineArgs ? ""
 , pulseSupport ? stdenv.isLinux, libpulseaudio
 }:
@@ -20,11 +21,11 @@ let
   vivaldiName = if isSnapshot then "vivaldi-snapshot" else "vivaldi";
 in stdenv.mkDerivation rec {
   pname = "vivaldi";
-  version = "5.4.2753.47";
+  version = "5.6.2867.36";
 
   src = fetchurl {
     url = "https://downloads.vivaldi.com/${branch}/vivaldi-${branch}_${version}-1_amd64.deb";
-    sha256 = "1p155mcrmfz395yajxa6fqjk1paac216kim26i3r56wah5329gmr";
+    sha256 = "sha256-dTXppRn/bl+HYVzqyrKBXb2YAaw0lRJkwAeukalv3a4=d";
   };
 
   unpackPhase = ''
@@ -79,7 +80,7 @@ in stdenv.mkDerivation rec {
     substituteInPlace "$out"/share/applications/*.desktop \
       --replace /usr/bin/${vivaldiName} "$out"/bin/vivaldi
     substituteInPlace "$out"/share/applications/*.desktop \
-      --replace vivaldi-stable vivaldi
+      --replace vivaldi-stable "vivaldi ${lib.optionalString forceDarkMode "--force-dark-mode"}"
     local d
     for d in 16 22 24 32 48 64 128 256; do
       mkdir -p "$out"/share/icons/hicolor/''${d}x''${d}/apps
diff --git a/pkgs/applications/networking/cluster/argocd/default.nix b/pkgs/applications/networking/cluster/argocd/default.nix
index d6ca151e7a6a..3fce464f4447 100644
--- a/pkgs/applications/networking/cluster/argocd/default.nix
+++ b/pkgs/applications/networking/cluster/argocd/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "argocd";
-  version = "2.5.3";
+  version = "2.5.4";
 
   src = fetchFromGitHub {
     owner = "argoproj";
     repo = "argo-cd";
     rev = "v${version}";
-    sha256 = "sha256-cL1QV0D8m8rqSDuQgsYBPY7n5K2dy9s9c8VRx65+SV0=";
+    sha256 = "sha256-Wwm9YN/gPsb4AU+JFUDrJQbuK5AEqzX5/D64/6tOtkw=";
   };
 
   proxyVendor = true; # darwin/linux hash mismatch
diff --git a/pkgs/applications/networking/cluster/kyverno/default.nix b/pkgs/applications/networking/cluster/kyverno/default.nix
index b1d486c51801..ebaca441c338 100644
--- a/pkgs/applications/networking/cluster/kyverno/default.nix
+++ b/pkgs/applications/networking/cluster/kyverno/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "kyverno";
-  version = "1.8.2";
+  version = "1.8.3";
 
   src = fetchFromGitHub {
     owner = "kyverno";
     repo = "kyverno";
     rev = "v${version}";
-    sha256 = "sha256-U0VcLxI5hSVqU9N+99/qOjueKi6EdVMT2dTyZUSpNXw=";
+    sha256 = "sha256-AsUgjGoDoT/GN+Z2tXd0KjVFcVI1KF3nVRsLDWkY9HM=";
   };
 
   ldflags = [
diff --git a/pkgs/applications/networking/cluster/ssm-agent/default.nix b/pkgs/applications/networking/cluster/ssm-agent/default.nix
index 86b48633c253..baf85847875c 100644
--- a/pkgs/applications/networking/cluster/ssm-agent/default.nix
+++ b/pkgs/applications/networking/cluster/ssm-agent/default.nix
@@ -3,6 +3,7 @@
 , buildGoPackage
 , makeWrapper
 , fetchFromGitHub
+, fetchpatch
 , coreutils
 , nettools
 , dmidecode
@@ -47,6 +48,12 @@ buildGoPackage rec {
     # They used constants from another package that I couldn't figure
     # out how to resolve, so hardcoded the constants.
     ./0002-version-gen-don-t-use-unnecessary-constants.patch
+
+    (fetchpatch {
+      name = "CVE-2022-29527.patch";
+      url = "https://github.com/aws/amazon-ssm-agent/commit/0fe8ae99b2ff25649c7b86d3bc05fc037400aca7.patch";
+      sha256 = "sha256-5g14CxhsHLIgs1Vkfw8FCKEJ4AebNqZKf3ZzoAN/T9U=";
+    })
   ];
 
   preConfigure = ''
diff --git a/pkgs/applications/networking/cluster/terraform-compliance/default.nix b/pkgs/applications/networking/cluster/terraform-compliance/default.nix
index e60c4f14e306..590abb80acef 100644
--- a/pkgs/applications/networking/cluster/terraform-compliance/default.nix
+++ b/pkgs/applications/networking/cluster/terraform-compliance/default.nix
@@ -1,47 +1,31 @@
 { lib
-, GitPython
-, buildPythonApplication
-, emoji
 , fetchFromGitHub
-, filetype
-, ipython
-, junit-xml
-, lxml
-, mock
-, netaddr
-, pytestCheckHook
-, radish-bdd
-, semver
+, python3
 }:
 
-buildPythonApplication rec {
+python3.pkgs.buildPythonApplication rec {
   pname = "terraform-compliance";
-  version = "1.2.11";
+  version = "1.3.34";
+  format = "setuptools";
 
-  # No tests in Pypi package
   src = fetchFromGitHub {
-    owner = "eerkunt";
-    repo = pname;
-    rev = version;
-    sha256 = "161mszmxqp3wypnda48ama2mmq8yjilkxahwc1mxjwzy1n19sn7v";
+    owner = "terraform-compliance";
+    repo = "cli";
+    rev = "refs/tags/${version}";
+    sha256 = "sha256-1TFLpBwkpMMdiJJfVvDXlJg4SXWQ8VV605wMFGU+InQ=";
   };
 
   postPatch = ''
     substituteInPlace setup.py \
-      --replace "IPython==7.16.1" "IPython"
+      --replace "IPython==7.16.1" "IPython" \
+      --replace "diskcache==5.1.0" "diskcache>=5.1.0"
   '';
 
-  checkInputs = [ pytestCheckHook ];
-
-  disabledTests = [
-    "test_which_success"
-    "test_readable_plan_file_is_not_json"
-  ];
-
-  propagatedBuildInputs = [
-    GitPython
+  propagatedBuildInputs = with python3.pkgs; [
+    diskcache
     emoji
     filetype
+    gitpython
     ipython
     junit-xml
     lxml
@@ -51,9 +35,23 @@ buildPythonApplication rec {
     semver
   ];
 
+  checkInputs = with python3.pkgs; [
+    pytestCheckHook
+  ];
+
+  disabledTests = [
+    "test_which_success"
+    "test_readable_plan_file_is_not_json"
+  ];
+
+  pythonImportsCheck = [
+    "terraform_compliance"
+  ];
+
   meta = with lib; {
     description = "BDD test framework for terraform";
-    homepage = "https://github.com/eerkunt/terraform-compliance";
+    homepage = "https://github.com/terraform-compliance/cli";
+    changelog = "https://github.com/terraform-compliance/cli/releases/tag/${version}";
     license = licenses.mit;
     maintainers = with maintainers; [ kalbasit ];
   };
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index 54a3a16e6d10..6fc1405b7067 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -48,11 +48,11 @@
     "vendorHash": "sha256-byReViTX0KRFVgWMkte00CDB/3Mw8Ov5GyD48sENmIA="
   },
   "alicloud": {
-    "hash": "sha256-YdXnw0j2PSuT2BoQQUxyomH+dycjy6Fed7+xVuOwJhk=",
+    "hash": "sha256-4f29+7irL+6uNTEFnUu46LGz4aBDwortClCZ0+EDZ4Q=",
     "homepage": "https://registry.terraform.io/providers/aliyun/alicloud",
     "owner": "aliyun",
     "repo": "terraform-provider-alicloud",
-    "rev": "v1.193.0",
+    "rev": "v1.193.1",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
@@ -112,13 +112,13 @@
     "vendorHash": null
   },
   "aws": {
-    "hash": "sha256-g38aJ8JN/0PZ0ArSti1/5nzflIlkz/qhn5Qz4yXCie8=",
+    "hash": "sha256-5eqUaO8XRPh2wkltGu7D3GToNAq1zSpQ1LS/h0W/CQA=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/aws",
     "owner": "hashicorp",
     "repo": "terraform-provider-aws",
-    "rev": "v4.45.0",
+    "rev": "v4.46.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-C3wr/3huORBacbe0+Z0qqH+iSaJCxQwLq9wqLSirDiM="
+    "vendorHash": "sha256-xo9Z50jK8dWxQ8DeGLjB8ppnGuUmGlQLhzRHpKs8hYg="
   },
   "azuread": {
     "hash": "sha256-itaFeOEnoTIJfACvJZCIe9RWNVgewdVFZzXUK7yGglQ=",
@@ -167,20 +167,20 @@
     "vendorHash": null
   },
   "bitbucket": {
-    "hash": "sha256-eU8vA2fxtdsObgh2dTExGLzzBnfSc2DSGdFHrLXR3SA=",
+    "hash": "sha256-tT5JSiUPeezQFn4tnKrsUxfm/llaBk8R2eOGqGIbEH4=",
     "homepage": "https://registry.terraform.io/providers/DrFaust92/bitbucket",
     "owner": "DrFaust92",
     "repo": "terraform-provider-bitbucket",
-    "rev": "v2.22.0",
+    "rev": "v2.23.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-Qkla3OEcyiMn6eqBj+4LB8JwpIwceLAASI1qvOcUBD0="
+    "vendorHash": "sha256-CFRZSdQnbhV7n10r2R1+cGxn7nKD+GvXWf85rYFRPVI="
   },
   "brightbox": {
-    "hash": "sha256-l4gN7gxLMTuUMjf50Hc2Els5pJ4BId1QlRAhykseK7c=",
+    "hash": "sha256-F/AQq45ADM0+PbFpMPtpMvbYw8F41GDBzk7LoY/L/Qg=",
     "homepage": "https://registry.terraform.io/providers/brightbox/brightbox",
     "owner": "brightbox",
     "repo": "terraform-provider-brightbox",
-    "rev": "v3.0.5",
+    "rev": "v3.0.6",
     "spdx": "MPL-2.0",
     "vendorHash": "sha256-ZT+SOHn/8aoZLXUau9toc3NtQNaXfttM0agIw8T28tk="
   },
@@ -213,13 +213,13 @@
     "vendorHash": null
   },
   "cloudamqp": {
-    "hash": "sha256-EtFGqYNfyDbS4f1tjRTKcrQNFqEZmmILeuEOpwkx6/4=",
+    "hash": "sha256-ocwPi39Wn+nHtkRshqFKkCknFCKgmrxSMy1SJFd7ni8=",
     "homepage": "https://registry.terraform.io/providers/cloudamqp/cloudamqp",
     "owner": "cloudamqp",
     "repo": "terraform-provider-cloudamqp",
-    "rev": "v1.20.0",
+    "rev": "v1.20.1",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-fDYkeUOW9wuypAJR1YFEQp8KhtTfMr8NZeT7TMYXEmU="
+    "vendorHash": "sha256-pnQHWSXI3rqYv0EeG9rGINtInSgQ/NSMMYiPrXRMUuM="
   },
   "cloudflare": {
     "hash": "sha256-1Ak5NPaOSqF0mJU2/CnssQjz7ekyVE/kqDOS5rYSN10=",
@@ -349,11 +349,11 @@
     "vendorHash": "sha256-EaWVf8GmNsabpfeOEzRjKPubCyEReGjdzRy7Ohb4mno="
   },
   "elasticsearch": {
-    "hash": "sha256-+cktPArBOysc4V+uR3KWsVlxtxSIbuVMCmPSU21xF/U=",
+    "hash": "sha256-a6kHN3w0sQCP+0+ZtFwcg9erfVBYkhNo+yOrnwweGWo=",
     "homepage": "https://registry.terraform.io/providers/phillbaker/elasticsearch",
     "owner": "phillbaker",
     "repo": "terraform-provider-elasticsearch",
-    "rev": "v2.0.6",
+    "rev": "v2.0.7",
     "spdx": "MPL-2.0",
     "vendorHash": "sha256-oVTanZpCWs05HwyIKW2ajiBPz1HXOFzBAt5Us+EtTRw="
   },
@@ -386,11 +386,11 @@
     "vendorHash": "sha256-0t+2ixMSsgDK9zzst3s0YWdnS6p7jO0stHnaKio5lvY="
   },
   "fastly": {
-    "hash": "sha256-X2T/t3uDY1jDPhx7IZOwVLx1o4pse5/0T+nrJtRB1Lk=",
+    "hash": "sha256-AlEO9isKHdOxhI7M7Egxv7lmrQ066s2zcIz9fm5dobM=",
     "homepage": "https://registry.terraform.io/providers/fastly/fastly",
     "owner": "fastly",
     "repo": "terraform-provider-fastly",
-    "rev": "v3.0.2",
+    "rev": "v3.0.3",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
@@ -442,24 +442,24 @@
     "vendorHash": "sha256-QAFx/Ew86T4LWJ6ZtJTUWwR5rGunWj0E5Vzt++BN9ks="
   },
   "google": {
-    "hash": "sha256-e2jVnL13j4iSb288CB/H6G3vR58bjwi+2ZHzve1tuUo=",
+    "hash": "sha256-VqQK6NifhilmnJL5L4EHmmeFWZPBmQhoUl3mz8igSck=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/google",
     "owner": "hashicorp",
     "proxyVendor": true,
     "repo": "terraform-provider-google",
-    "rev": "v4.44.1",
+    "rev": "v4.45.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-X5wjho+hotqi9aZ5ABv3RY0xJj1HFH7IN/HLPKIxi2c="
+    "vendorHash": "sha256-nwA+OD0gtnV5di43wgH1OZp/RngLvnVRAuKQxsxnlLw="
   },
   "google-beta": {
-    "hash": "sha256-ejMWZTSrkGMAKr02TIg0yngzpqEVL8y56JSoQrCJ7lA=",
+    "hash": "sha256-/fdgwdIIFHLEMeqsWashkQJlIoFU86ZmsbA4pX18FhE=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/google-beta",
     "owner": "hashicorp",
     "proxyVendor": true,
     "repo": "terraform-provider-google-beta",
-    "rev": "v4.44.1",
+    "rev": "v4.45.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-X5wjho+hotqi9aZ5ABv3RY0xJj1HFH7IN/HLPKIxi2c="
+    "vendorHash": "sha256-nwA+OD0gtnV5di43wgH1OZp/RngLvnVRAuKQxsxnlLw="
   },
   "googleworkspace": {
     "hash": "sha256-dedYnsKHizxJZibuvJOMbJoux0W6zgKaK5fxIofKqCY=",
@@ -507,11 +507,11 @@
     "vendorHash": null
   },
   "heroku": {
-    "hash": "sha256-NabwjOTbBRlDNFBpCshxZMO9E958tfAIPPuyArvacFI=",
+    "hash": "sha256-GmrzvE1Wc1dQSlEL4mLYHIkAVxKwElx2fCWkrnZra18=",
     "homepage": "https://registry.terraform.io/providers/heroku/heroku",
     "owner": "heroku",
     "repo": "terraform-provider-heroku",
-    "rev": "v5.1.6",
+    "rev": "v5.1.8",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
@@ -589,22 +589,22 @@
     "vendorHash": null
   },
   "infoblox": {
-    "hash": "sha256-VquTyQxbVFPImZCwthwf8hJPlUxAxhmed/r1V+qm/ak=",
+    "hash": "sha256-bLZK2lZqnpiE5vsJAAiGw4BrBzVWGyg5VZq/Ngr8VlA=",
     "homepage": "https://registry.terraform.io/providers/infobloxopen/infoblox",
     "owner": "infobloxopen",
     "repo": "terraform-provider-infoblox",
-    "rev": "v2.1.0",
+    "rev": "v2.2.0",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
   "kafka": {
-    "hash": "sha256-bKbY2cOIORy3D9yCBqVuKUZb650sx+87d4wtUB3dPdg=",
+    "hash": "sha256-p8KT6K9fcd0OFy+NoZyZzQxG13fIiyMJg2yNPKIWH60=",
     "homepage": "https://registry.terraform.io/providers/Mongey/kafka",
     "owner": "Mongey",
     "repo": "terraform-provider-kafka",
-    "rev": "v0.5.1",
+    "rev": "v0.5.2",
     "spdx": "MIT",
-    "vendorHash": "sha256-03QV6C2DEN5xwMwABwSvv5Ts6pTHQDBP2zUUqIcOtVQ="
+    "vendorHash": "sha256-RzC8j+Toub7kiOKW6IppjwyJ0vGEJ0YHb8YXrWFkZW4="
   },
   "kafka-connect": {
     "hash": "sha256-PiSVfzNPEXAgONb/eaVAN4yPudn5glcHL0BLqE5PWsw=",
@@ -643,11 +643,11 @@
     "vendorHash": "sha256-lXQHo66b9X0jZhoF+5Ix5qewQGyI82VPJ7gGzc2CHao="
   },
   "kubernetes": {
-    "hash": "sha256-hWFC8VBbM3BRGrX1Y45Znd/W3klYy/7aS7JbbKN7EUg=",
+    "hash": "sha256-aKGcKmnlYxNS7SrFW2SouRQUXYy339qHrDtQMXGD4DE=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/kubernetes",
     "owner": "hashicorp",
     "repo": "terraform-provider-kubernetes",
-    "rev": "v2.16.0",
+    "rev": "v2.16.1",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
@@ -743,13 +743,13 @@
     "vendorHash": "sha256-VxISNcWEnBAa+8WsmqxcT+DPF74X8rLlvdSNJtx0++I="
   },
   "mongodbatlas": {
-    "hash": "sha256-rHT/x3Wpd7b4u7v1/g6DY85TwRkf5A7KaOiqoWeN05Y=",
+    "hash": "sha256-QMwsVD1RZwL9DPF0gnio4quqUa1b4G0SK73yd6BYnG4=",
     "homepage": "https://registry.terraform.io/providers/mongodb/mongodbatlas",
     "owner": "mongodb",
     "repo": "terraform-provider-mongodbatlas",
-    "rev": "v1.6.0",
+    "rev": "v1.6.1",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-dFlDUJGVTWQwXXGaWeG07kKyXcWWzuyqYlPm11yaCqI="
+    "vendorHash": "sha256-WO8B5tiDYQTbKbqWfjjgyMLCmclhE0r2XNRTQ2uyu7s="
   },
   "namecheap": {
     "hash": "sha256-cms8YUL+SjTeYyIOQibksi8ZHEBYq2JlgTEpOO1uMZE=",
@@ -770,13 +770,13 @@
     "vendorHash": null
   },
   "newrelic": {
-    "hash": "sha256-wTQmqe7oicD7MOZdKgRHlz4Vs8dQqEUjnrKU/1pldRI=",
+    "hash": "sha256-nN4KXXSYp4HWxImfgd/C/ykQi02EIpq4mb20EpKboaE=",
     "homepage": "https://registry.terraform.io/providers/newrelic/newrelic",
     "owner": "newrelic",
     "repo": "terraform-provider-newrelic",
-    "rev": "v3.8.0",
+    "rev": "v3.9.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-CIiRPwzlx5WWyRmg2tXEB+yp05ZbN5mLBGuFxm0h//4="
+    "vendorHash": "sha256-WuGf6gMOOCTwUTzbinyT7yNM3S8ddHY5aS5VTAEf5Js="
   },
   "nomad": {
     "hash": "sha256-oHY+jM4JQgLlE1wd+/H9H8H2g0e9ZuxI6OMlz3Izfjg=",
@@ -816,11 +816,11 @@
     "vendorHash": "sha256-LRIfxQGwG988HE5fftGl6JmBG7tTknvmgpm4Fu1NbWI="
   },
   "oci": {
-    "hash": "sha256-t8GrhKnKredpbRmx/MAA4tx0kV0yZoFNnacKsp0Htro=",
+    "hash": "sha256-DGkjk9siXkknuNxWcUnDfR56xPYFS111J8QcAgj0cPU=",
     "homepage": "https://registry.terraform.io/providers/oracle/oci",
     "owner": "oracle",
     "repo": "terraform-provider-oci",
-    "rev": "v4.100.0",
+    "rev": "v4.101.0",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
@@ -843,13 +843,13 @@
     "vendorHash": null
   },
   "opennebula": {
-    "hash": "sha256-jm7k0k28TSfnUA6P2RjSfF36o/nznvDWcDmJz/MAMXU=",
+    "hash": "sha256-+EbEVwgo2HWmVhff7u5ohSJW8wuxK1kvWfvRWRwIP4o=",
     "homepage": "https://registry.terraform.io/providers/OpenNebula/opennebula",
     "owner": "OpenNebula",
     "repo": "terraform-provider-opennebula",
-    "rev": "v1.0.2",
+    "rev": "v1.1.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-tkb+P+eTid5dgCw6bErr7i0F+E8UCt/HyFA2e3y0XT0="
+    "vendorHash": "sha256-zKtBDnvlQHe+q0OZUMUGu1gNsx2wIrIoArtJrt0VaBk="
   },
   "openstack": {
     "hash": "sha256-k5UyK9jmjZzHw8AwmDRtyCyJgILAcCK+nN+hklJ9VFw=",
@@ -861,13 +861,13 @@
     "vendorHash": "sha256-hHwFm+gSMjN4YQEFd/dd50G0uZsxzqi21tHDf4mPBLY="
   },
   "opentelekomcloud": {
-    "hash": "sha256-H1X+wWxdP7MwUtUaQiw0usOO6jwAAVLYMoG5Ut2OcqM=",
+    "hash": "sha256-vmsnpu4FThMY0OfCAj0DnI4fpOwVGvJXpQ3u+kAieFc=",
     "homepage": "https://registry.terraform.io/providers/opentelekomcloud/opentelekomcloud",
     "owner": "opentelekomcloud",
     "repo": "terraform-provider-opentelekomcloud",
-    "rev": "v1.31.9",
+    "rev": "v1.32.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-n7Ez596JnRwsKYPuR8lCLo6ez/TFch2kMgoScg7pPUI="
+    "vendorHash": "sha256-TCeAqQLdeCS3NPDAppinRv4qBPBWtG/qAUKc+4acqEE="
   },
   "opsgenie": {
     "hash": "sha256-6lbJyBppfRqqmYpPgyzUTvnvHPSWjE3SJULqliZ2iUI=",
@@ -879,11 +879,11 @@
     "vendorHash": null
   },
   "ovh": {
-    "hash": "sha256-6lBhEmeAvTv8xRMi5ZabcJg/59xJ9o4/MaAJP+H7pqk=",
+    "hash": "sha256-G1YRp6ScdlPnV8cCC05TKToJk+iLx2l28x7Lv4GS2/k=",
     "homepage": "https://registry.terraform.io/providers/ovh/ovh",
     "owner": "ovh",
     "repo": "terraform-provider-ovh",
-    "rev": "v0.23.0",
+    "rev": "v0.24.0",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
@@ -969,13 +969,13 @@
     "vendorHash": null
   },
   "scaleway": {
-    "hash": "sha256-0NQRAv05GuVRAkZd580TINEur/G+c0jUmMtyMv05+PY=",
+    "hash": "sha256-2991jDjOlyJuVcgzTmfKfMt4NfLc1QP7TY9mw+5Z5aM=",
     "homepage": "https://registry.terraform.io/providers/scaleway/scaleway",
     "owner": "scaleway",
     "repo": "terraform-provider-scaleway",
-    "rev": "v2.7.1",
+    "rev": "v2.8.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-XlEvaXd+mAvbFeQmTOE+bFsYok/Ke1mVwIUY3VY8zDI="
+    "vendorHash": "sha256-YlZSM3duS2QEZo5j+WvCw5KFPbY+NadYonylpB8Zw+o="
   },
   "secret": {
     "hash": "sha256-MmAnA/4SAPqLY/gYcJSTnEttQTsDd2kEdkQjQj6Bb+A=",
@@ -1032,13 +1032,13 @@
     "vendorHash": null
   },
   "snowflake": {
-    "hash": "sha256-V2N9Lq425fdjlJ+lCVQzMAYfEiS2/Oqevz1dIve//FA=",
+    "hash": "sha256-folCDzwXDfWGVxqX+wMBtRqUXdecYL0Rj7XYzb5QBvA=",
     "homepage": "https://registry.terraform.io/providers/Snowflake-Labs/snowflake",
     "owner": "Snowflake-Labs",
     "repo": "terraform-provider-snowflake",
-    "rev": "v0.52.0",
+    "rev": "v0.53.0",
     "spdx": "MIT",
-    "vendorHash": "sha256-n6ov9eTlNF/jNDTDOZuuqyFfuv8lDZHKP/5jhFauwY8="
+    "vendorHash": "sha256-5sqPDUNg1uH3LAMnvQ4YAm5LDdcywQHp1DVKYLFZG7Q="
   },
   "sops": {
     "hash": "sha256-6FuThi6iuuUGcMhswAk3Z6Lxth/2nuI57A02Xu2s+/U=",
@@ -1095,22 +1095,22 @@
     "vendorHash": "sha256-2wPmLpjhG6QgG+BUCO0oIzHjBOWIOYuptgdtSIm9TZw="
   },
   "tencentcloud": {
-    "hash": "sha256-beoS4io1KffsMCvYHwpWzo6NNwdi7JyPBBi/BwGFU9Y=",
+    "hash": "sha256-jel9zn2i/xt7Up4o8Tf5S5Z63zRbQszt9IY5xjcQhLo=",
     "homepage": "https://registry.terraform.io/providers/tencentcloudstack/tencentcloud",
     "owner": "tencentcloudstack",
     "repo": "terraform-provider-tencentcloud",
-    "rev": "v1.79.0",
+    "rev": "v1.79.1",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
   "tfe": {
-    "hash": "sha256-ikuLRGm9Z+tt0Zsx7DYKNBrS08rW4DOvVWYpl3wvaeU=",
+    "hash": "sha256-y9v+13/u91tpRwyI/oLHsd7oUUj0OGFJkqzbk2z8MxU=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/tfe",
     "owner": "hashicorp",
     "repo": "terraform-provider-tfe",
-    "rev": "v0.39.0",
+    "rev": "v0.40.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-Ws9IzlZQDDAdQ4JJ326jHXUe9oQphBXb/ZNO7Kl/A1w="
+    "vendorHash": "sha256-Z2pIUAe2Beq5Hi7HBxNenFEtAFhJFMPi3k2qiifN+Jg="
   },
   "thunder": {
     "hash": "sha256-fXvwBOIW3/76V3O9t25wff0oGViqSaSB2VgMdItXyn4=",
@@ -1232,11 +1232,11 @@
     "vendorHash": "sha256-160GDEQfymeCJpjYOoWP5sGQ0PJHw9kKPaefmbF5Ig4="
   },
   "vultr": {
-    "hash": "sha256-6NiVW6kqUCeit6Dc9GbP4mV03UJkqo+UwHsDE4xMwzQ=",
+    "hash": "sha256-DfiJgN1R7qW3c13hBabsMizY3mYamIq8AGms1q9kdVU=",
     "homepage": "https://registry.terraform.io/providers/vultr/vultr",
     "owner": "vultr",
     "repo": "terraform-provider-vultr",
-    "rev": "v2.11.4",
+    "rev": "v2.12.0",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
diff --git a/pkgs/applications/networking/cluster/terragrunt/default.nix b/pkgs/applications/networking/cluster/terragrunt/default.nix
index b15f60afe016..437f5813a3ac 100644
--- a/pkgs/applications/networking/cluster/terragrunt/default.nix
+++ b/pkgs/applications/networking/cluster/terragrunt/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "terragrunt";
-  version = "0.41.0";
+  version = "0.42.3";
 
   src = fetchFromGitHub {
     owner = "gruntwork-io";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-1if7Z+4Lr5eevf1NUJn//pcVU3Ts/FznDd/604aJO/c=";
+    sha256 = "sha256-CK2+leFJuNQqX1t34LLTJ6eVEUFdZSb/0E3XTf3S9gQ=";
   };
 
   vendorSha256 = "sha256-Qc0FnNxyErtieVvEj/eKPW5PpvYFwiYtv+ReJTVFAPA=";
diff --git a/pkgs/applications/networking/cluster/velero/default.nix b/pkgs/applications/networking/cluster/velero/default.nix
index 8bb4dc5ad80d..bc4f1959eaac 100644
--- a/pkgs/applications/networking/cluster/velero/default.nix
+++ b/pkgs/applications/networking/cluster/velero/default.nix
@@ -2,14 +2,14 @@
 
 buildGoModule rec {
   pname = "velero";
-  version = "1.9.3";
+  version = "1.10.0";
 
 
   src = fetchFromGitHub {
     owner = "vmware-tanzu";
     repo = "velero";
     rev = "v${version}";
-    sha256 = "sha256-UN1nxzcoaUrqmFAJ6LQ+Ro6Ywn/mG7J+MEJIUbpBiK4=";
+    sha256 = "sha256-PBCTVws5N42q68rKcMLW7GgZvdsQgmdlsKMpJ5bCF00=";
   };
 
   ldflags = [
@@ -20,7 +20,7 @@ buildGoModule rec {
     "-X github.com/vmware-tanzu/velero/pkg/buildinfo.GitSHA=none"
   ];
 
-  vendorSha256 = "sha256-QSR8nSKSKaFyFC6yik3f44mdNvSBgE4bFIGttuJ5oRM=";
+  vendorSha256 = "sha256-5Po8TRCE6VP+RcaIJImYjElTMHHS/2JwbrHreeWLxio=";
 
   excludedPackages = [ "issue-template-gen" "release-tools" "v1" "velero-restic-restore-helper" ];
 
diff --git a/pkgs/applications/networking/flexget/default.nix b/pkgs/applications/networking/flexget/default.nix
index 90193971cd75..30d6666c05dc 100644
--- a/pkgs/applications/networking/flexget/default.nix
+++ b/pkgs/applications/networking/flexget/default.nix
@@ -5,7 +5,7 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "flexget";
-  version = "3.5.6";
+  version = "3.5.9";
   format = "pyproject";
 
   # Fetch from GitHub in order to use `requirements.in`
@@ -13,7 +13,7 @@ python3Packages.buildPythonApplication rec {
     owner = "flexget";
     repo = "flexget";
     rev = "refs/tags/v${version}";
-    hash = "sha256-MO/BwlgSAt9rZC+kELdjJm6F15MJJPpvn412CndvqXk=";
+    hash = "sha256-oxWN+gFjy/Kf447SBiD7oUTA9+JhmtQ2oaAMQESsGUs=";
   };
 
   postPatch = ''
diff --git a/pkgs/applications/networking/ftp/filezilla/default.nix b/pkgs/applications/networking/ftp/filezilla/default.nix
index 5a4585135f01..49f2aaa37e9c 100644
--- a/pkgs/applications/networking/ftp/filezilla/default.nix
+++ b/pkgs/applications/networking/ftp/filezilla/default.nix
@@ -12,7 +12,8 @@
 , sqlite
 , tinyxml
 , wrapGAppsHook
-, wxGTK30-gtk3
+, wxGTK30
+, gtk3
 , xdg-utils
 }:
 
@@ -42,8 +43,8 @@ stdenv.mkDerivation rec {
     pugixml
     sqlite
     tinyxml
-    wxGTK30-gtk3
-    wxGTK30-gtk3.gtk
+    wxGTK30
+    gtk3
     xdg-utils
   ];
 
diff --git a/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix b/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
index a71cad3224af..cb7801d3896b 100644
--- a/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
@@ -9,7 +9,7 @@
 
 stdenv.mkDerivation rec {
   pname = "signal-desktop";
-  version = "6.0.0"; # Please backport all updates to the stable channel.
+  version = "6.0.1"; # Please backport all updates to the stable channel.
   # All releases have a limited lifetime and "expire" 90 days after the release.
   # When releases "expire" the application becomes unusable until an update is
   # applied. The expiration date for the current release can be extracted with:
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://updates.signal.org/desktop/apt/pool/main/s/signal-desktop/signal-desktop_${version}_amd64.deb";
-    sha256 = "sha256-aJLsRxxpLWKl0Y/91uR56nIUUOALd572LtXpqXGTXSg=";
+    sha256 = "sha256-7Cojhz3wBPd/13uVg2MgJXvR9QMPZcwBibk/sCrRMAE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/networking/instant-messengers/slack/default.nix b/pkgs/applications/networking/instant-messengers/slack/default.nix
index 325d5330d62e..7e3dd42b578d 100644
--- a/pkgs/applications/networking/instant-messengers/slack/default.nix
+++ b/pkgs/applications/networking/instant-messengers/slack/default.nix
@@ -44,14 +44,14 @@ let
 
   pname = "slack";
 
-  x86_64-darwin-version = "4.28.182";
-  x86_64-darwin-sha256 = "0x0zc45k0jh0hivgjymcxnnwc2lwyfq68rw39lbxp4i1ir2sbnxg";
+  x86_64-darwin-version = "4.29.149";
+  x86_64-darwin-sha256 = "sha256-E0YnOPnaWFe17gCpFywxu5uHs1pEktA1tUu4QqvKhYw=";
 
-  x86_64-linux-version = "4.28.184";
-  x86_64-linux-sha256 = "sha256-qAc9rHJbM7lmqNxOcOSnqnuib5zJ0Ry3hAGri8DKIlo=";
+  x86_64-linux-version = "4.29.149";
+  x86_64-linux-sha256 = "sha256-ulXIGLp2ql47ZS6IeaMuqye39deDtukOB1dxy5BNCwI=";
 
-  aarch64-darwin-version = "4.28.182";
-  aarch64-darwin-sha256 = "0bc8lhmpm0310gh1w9xkb8i1cpldchm4b4mzsr9h0mhvljxmvlyf";
+  aarch64-darwin-version = "4.29.149";
+  aarch64-darwin-sha256 = "sha256-Nn+dFD3H/By+aBPLDxnPneNXuFl+tHdLhxJXeYBMORg=";
 
   version = {
     x86_64-darwin = x86_64-darwin-version;
diff --git a/pkgs/applications/networking/instant-messengers/teams-for-linux/default.nix b/pkgs/applications/networking/instant-messengers/teams-for-linux/default.nix
new file mode 100644
index 000000000000..3a6c97073ab6
--- /dev/null
+++ b/pkgs/applications/networking/instant-messengers/teams-for-linux/default.nix
@@ -0,0 +1,91 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, makeWrapper
+, makeDesktopItem
+, copyDesktopItems
+, fixup_yarn_lock
+, yarn
+, nodejs
+, fetchYarnDeps
+, electron
+}:
+
+stdenv.mkDerivation rec {
+  pname = "teams-for-linux";
+  version = "1.0.45";
+
+  src = fetchFromGitHub {
+    owner = "IsmaelMartinez";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "sha256-Q6DFegFrLUW/YiRyYJI4ITVVyMC5IkazlzhdR8203cY=";
+  };
+
+  offlineCache = fetchYarnDeps {
+    yarnLock = src + "/yarn.lock";
+    sha256 = "sha256-jaAieO5q+tNfWN7Rp6ueasl45cfp9W1QxPdqIeCnVkE=";
+  };
+
+  nativeBuildInputs = [ yarn fixup_yarn_lock nodejs copyDesktopItems makeWrapper ];
+
+  configurePhase = ''
+    runHook preConfigure
+
+    export HOME=$(mktemp -d)
+    yarn config --offline set yarn-offline-mirror $offlineCache
+    fixup_yarn_lock yarn.lock
+    yarn install --offline --frozen-lockfile --ignore-platform --ignore-scripts --no-progress --non-interactive
+    patchShebangs node_modules/
+
+    runHook postConfigure
+  '';
+
+  buildPhase = ''
+    runHook preBuild
+
+    yarn --offline electron-builder \
+      --dir --linux ${if stdenv.hostPlatform.isAarch64 then "--arm64" else "--x64"} \
+      -c.electronDist=${electron}/lib/electron \
+      -c.electronVersion=${electron.version}
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/share/{applications,teams-for-linux}
+    cp dist/linux-${lib.optionalString stdenv.hostPlatform.isAarch64 "arm64-"}unpacked/resources/app.asar $out/share/teams-for-linux/
+
+    pushd build/icons
+    for image in *png; do
+      mkdir -p $out/share/icons/hicolor/''${image%.png}/apps
+      cp -r $image $out/share/icons/hicolor/''${image%.png}/apps/teams-for-linux.png
+    done
+    popd
+
+    makeWrapper '${electron}/bin/electron' "$out/bin/teams-for-linux" \
+      --add-flags "$out/share/teams-for-linux/app.asar" \
+      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}"
+
+    runHook postInstall
+  '';
+
+  desktopItems = [(makeDesktopItem {
+    name = pname;
+    exec = pname;
+    icon = pname;
+    desktopName = "Microsoft Teams for Linux";
+    comment = meta.description;
+    categories = [ "Network" "InstantMessaging" "Chat" ];
+  })];
+
+  meta = with lib; {
+    description = "Unofficial Microsoft Teams client for Linux";
+    homepage = "https://github.com/IsmaelMartinez/teams-for-linux";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ muscaln ];
+    platforms = [ "x86_64-linux" "aarch64-linux" ];
+  };
+}
diff --git a/pkgs/applications/networking/instant-messengers/telegram/tdesktop/default.nix b/pkgs/applications/networking/instant-messengers/telegram/tdesktop/default.nix
index ca89b0d5fcf3..1df0aee84219 100644
--- a/pkgs/applications/networking/instant-messengers/telegram/tdesktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/telegram/tdesktop/default.nix
@@ -75,7 +75,7 @@ let
 in
 env.mkDerivation rec {
   pname = "telegram-desktop";
-  version = "4.3.4";
+  version = "4.4.1";
   # Note: Update via pkgs/applications/networking/instant-messengers/telegram/tdesktop/update.py
 
   # Telegram-Desktop with submodules
@@ -84,7 +84,7 @@ env.mkDerivation rec {
     repo = "tdesktop";
     rev = "v${version}";
     fetchSubmodules = true;
-    sha256 = "0x18m48k6abpbfgavjad5sg3mf3j0kfmyayyvkqxr31viw8kq6m5";
+    sha256 = "0c30kxgp48ha1xv3l59ry21n2c536ax8a15cfk2n1r5n1ns2pfq0";
   };
 
   postPatch = ''
diff --git a/pkgs/applications/networking/irc/senpai/default.nix b/pkgs/applications/networking/irc/senpai/default.nix
index 0721d720cc7c..28d51650b263 100644
--- a/pkgs/applications/networking/irc/senpai/default.nix
+++ b/pkgs/applications/networking/irc/senpai/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "senpai";
-  version = "unstable-2022-11-15";
+  version = "unstable-2022-12-02";
 
   src = fetchFromSourcehut {
     owner = "~taiite";
     repo = "senpai";
-    rev = "cb0ba0669522ecf8ab0b0c3ccd0f14827eb65832";
-    sha256 = "sha256-Ny7TAKdh7RFGlrMRVIyCFFLqOanNWK+qGBbh+dVngMs=";
+    rev = "870e2e51feb2186bcb4c719e17967eb1311678a3";
+    sha256 = "sha256-YWEgA1KAa1cj2YaqOXVVBw70gSxK7WEMNDyGJOFq4DQ=";
   };
 
-  vendorSha256 = "sha256-dCADJ+k2vWLpgN251/gEyAg6WhPGK2DEWRaAHSHp1aM=";
+  vendorSha256 = "sha256-+78Ln8179MfDKSfT/jnN9Y5CIbpdq28XMDHsIu+4f4c=";
 
   subPackages = [
     "cmd/senpai"
diff --git a/pkgs/applications/networking/mailreaders/evolution/evolution-ews/default.nix b/pkgs/applications/networking/mailreaders/evolution/evolution-ews/default.nix
index 51e1c2e52c87..ba5f5d10226f 100644
--- a/pkgs/applications/networking/mailreaders/evolution/evolution-ews/default.nix
+++ b/pkgs/applications/networking/mailreaders/evolution/evolution-ews/default.nix
@@ -21,11 +21,11 @@
 
 stdenv.mkDerivation rec {
   pname = "evolution-ews";
-  version = "3.46.1";
+  version = "3.46.2";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "p5Jp7wnoqAuo8My8ZDMl0rsFc0158G8x8lAehWfLjb0=";
+    sha256 = "6spQz4oq6sFT2bCmaixVJDbTw1wM3LQFmg3E1trZ30E=";
   };
 
   patches = [
diff --git a/pkgs/applications/networking/mailreaders/evolution/evolution/default.nix b/pkgs/applications/networking/mailreaders/evolution/evolution/default.nix
index 1e61c5ffc884..0c7f5a417536 100644
--- a/pkgs/applications/networking/mailreaders/evolution/evolution/default.nix
+++ b/pkgs/applications/networking/mailreaders/evolution/evolution/default.nix
@@ -44,11 +44,11 @@
 
 stdenv.mkDerivation rec {
   pname = "evolution";
-  version = "3.46.1";
+  version = "3.46.2";
 
   src = fetchurl {
     url = "mirror://gnome/sources/evolution/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "GshFg+0sr4l7B06Z+TVCrRRG//Cs+rhtXmeeAzrgLIY=";
+    sha256 = "cks7uFOapRxpJsPxfTO7zjWpnBbqY7gJCzRsWr9ol30=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/networking/remote/freerdp/default.nix b/pkgs/applications/networking/remote/freerdp/default.nix
index d072a03c0b47..58c22375af47 100644
--- a/pkgs/applications/networking/remote/freerdp/default.nix
+++ b/pkgs/applications/networking/remote/freerdp/default.nix
@@ -156,7 +156,7 @@ stdenv.mkDerivation rec {
     WITH_X11 = true;
   };
 
-  NIX_CFLAGS_COMPILE = lib.optional stdenv.isDarwin [
+  NIX_CFLAGS_COMPILE = lib.optionals stdenv.isDarwin [
     "-DTARGET_OS_IPHONE=0"
     "-DTARGET_OS_WATCH=0"
     "-include AudioToolbox/AudioToolbox.h"
diff --git a/pkgs/applications/networking/sniffers/kismet/default.nix b/pkgs/applications/networking/sniffers/kismet/default.nix
index 1e4bb853742e..b0feaf38ecc4 100644
--- a/pkgs/applications/networking/sniffers/kismet/default.nix
+++ b/pkgs/applications/networking/sniffers/kismet/default.nix
@@ -71,25 +71,27 @@ stdenv.mkDerivation rec {
   ] ++ lib.optionals withNetworkManager [
     networkmanager
     glib
-  ] ++ lib.optional withSensors [
+  ] ++ lib.optionals withSensors [
     lm_sensors
   ];
 
   propagatedBuildInputs = [
-  ] ++ lib.optional withPython (python3.withPackages (ps: [
-    ps.numpy
-    ps.protobuf
-    ps.pyserial
-    ps.setuptools
-    ps.websockets
-  ]));
+  ] ++ lib.optionals withPython [
+    (python3.withPackages (ps: [
+      ps.numpy
+      ps.protobuf
+      ps.pyserial
+      ps.setuptools
+      ps.websockets
+    ]))
+  ];
 
   configureFlags = [
-  ] ++ lib.optional (!withNetworkManager) [
+  ] ++ lib.optionals (!withNetworkManager) [
     "--disable-libnm"
-  ] ++ lib.optional (!withPython) [
+  ] ++ lib.optionals (!withPython) [
     "--disable-python-tools"
-  ] ++ lib.optional (!withSensors) [
+  ] ++ lib.optionals (!withSensors) [
     "--disable-lmsensors"
   ];
 
diff --git a/pkgs/applications/networking/soulseek/nicotine-plus/default.nix b/pkgs/applications/networking/soulseek/nicotine-plus/default.nix
index 2f0ee430b4f9..02a7fe0622f3 100644
--- a/pkgs/applications/networking/soulseek/nicotine-plus/default.nix
+++ b/pkgs/applications/networking/soulseek/nicotine-plus/default.nix
@@ -11,13 +11,13 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "nicotine-plus";
-  version = "3.2.6";
+  version = "3.2.7";
 
   src = fetchFromGitHub {
     owner = "nicotine-plus";
     repo = "nicotine-plus";
     rev = "refs/tags/${version}";
-    sha256 = "sha256-ELpM5hnyHsqTqB0R1JPcbxkw9XR19CnasIYXJCbKBho=";
+    sha256 = "sha256-MPhMKbDBKZAF5fktzA6bZBlVkyDrBnhEFhRWkRbXP/A=";
   };
 
   nativeBuildInputs = [ gettext wrapGAppsHook gobject-introspection ];
diff --git a/pkgs/applications/networking/syncthing/default.nix b/pkgs/applications/networking/syncthing/default.nix
index 4bfe3efec121..297520dcb923 100644
--- a/pkgs/applications/networking/syncthing/default.nix
+++ b/pkgs/applications/networking/syncthing/default.nix
@@ -4,16 +4,16 @@ let
   common = { stname, target, postInstall ? "" }:
     buildGoModule rec {
       pname = stname;
-      version = "1.22.1";
+      version = "1.22.2";
 
       src = fetchFromGitHub {
         owner = "syncthing";
         repo = "syncthing";
         rev = "v${version}";
-        hash = "sha256-XndTMPO1lN6bsjeHbvrZ+i4VwaKoUOcWOfbVQ2E7/eo=";
+        hash = "sha256-t1JIkUjSEshSm3Zi5Ck8IOmTv2tC0dUYyJvlKua/BcI=";
       };
 
-      vendorSha256 = "sha256-ZxA05K5zKmQIm2R525DNXpGXqwM33j3PCuPN5d2qcj8=";
+      vendorSha256 = "sha256-UdzWD8I8ulPBXdF5wZQ7hQoVO9Bnj18Gw5t4wqolSPA=";
 
       doCheck = false;
 
diff --git a/pkgs/applications/networking/twingate/default.nix b/pkgs/applications/networking/twingate/default.nix
new file mode 100644
index 000000000000..33e0820bec9f
--- /dev/null
+++ b/pkgs/applications/networking/twingate/default.nix
@@ -0,0 +1,51 @@
+{ autoPatchelfHook
+, curl
+, dpkg
+, dbus
+, fetchurl
+, lib
+, libnl
+, udev
+, cryptsetup
+, stdenv
+}:
+
+stdenv.mkDerivation rec {
+  pname = "twingate";
+  version = "1.0.60";
+
+  src = fetchurl {
+    url = "https://binaries.twingate.com/client/linux/DEB/${version}/twingate-amd64.deb";
+    sha256 = "b308c422af8a33ecd58e21a10a72c353351a189df67006e38d1ec029a93d5678";
+  };
+
+  buildInputs = [ dbus curl libnl udev cryptsetup ];
+  nativeBuildInputs = [ dpkg autoPatchelfHook ];
+
+  unpackCmd = "mkdir root ; dpkg-deb -x $curSrc root";
+
+  postPatch = ''
+    while read file; do
+      substituteInPlace "$file" \
+        --replace "/usr/bin" "$out/bin" \
+        --replace "/usr/sbin" "$out/bin"
+    done < <(find etc usr/lib usr/share -type f)
+  '';
+
+  installPhase = ''
+    mkdir $out
+    mv etc $out/
+    mv usr/bin $out/bin
+    mv usr/sbin/* $out/bin
+    mv usr/lib $out/lib
+    mv usr/share $out/share
+  '';
+
+  meta = with lib; {
+    description = "Twingate Client";
+    homepage = "https://twingate.com";
+    license = licenses.unfree;
+    maintainers = with maintainers; [ tonyshkurenko ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/applications/networking/yaup/default.nix b/pkgs/applications/networking/yaup/default.nix
new file mode 100644
index 000000000000..5894e758e9d9
--- /dev/null
+++ b/pkgs/applications/networking/yaup/default.nix
@@ -0,0 +1,47 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, intltool
+, pkg-config
+, wrapGAppsHook
+, gtk3
+, miniupnpc
+}:
+
+stdenv.mkDerivation rec {
+  pname = "yaup";
+  version = "unstable-2019-10-16";
+
+  src = fetchFromGitHub {
+    owner = "Holarse-Linuxgaming";
+    repo = "yaup";
+    rev = "7ee3fdbd8c1ecf0a0e6469c47560e26082808250";
+    hash = "sha256-RWnNjpgXRYncz9ID8zirENffy1UsfHD1H6Mmd8DKN4k=";
+  };
+
+  nativeBuildInputs = [
+    intltool
+    pkg-config
+    wrapGAppsHook
+  ];
+
+  buildInputs = [
+    gtk3
+    miniupnpc
+  ];
+
+  meta = with lib; {
+    homepage = "https://github.com/Holarse-Linuxgaming/yaup";
+    description = "Yet Another UPnP Portmapper";
+    longDescription = ''
+      Portmapping made easy.
+      Portforward your incoming traffic to a specified local ip.
+      Mostly used for IPv4.
+    '';
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ fgaz ];
+    platforms = platforms.all;
+    # ld: unknown option: --export-dynamic
+    broken = stdenv.isDarwin;
+  };
+}
diff --git a/pkgs/applications/office/libreoffice/default.nix b/pkgs/applications/office/libreoffice/default.nix
index e88ae758d2ad..cc40237d1552 100644
--- a/pkgs/applications/office/libreoffice/default.nix
+++ b/pkgs/applications/office/libreoffice/default.nix
@@ -119,7 +119,7 @@ let
     flatten flip
     concatMapStrings concatStringsSep
     getDev getLib
-    optional optionals optionalString;
+    optionals optionalString;
 
   jre' = jre17_minimal.override {
     modules = [ "java.base" "java.desktop" "java.logging" "java.sql" ];
@@ -195,7 +195,7 @@ in
     tar -xf ${srcs.translations}
   '';
 
-  patches = optional (variant == "still") [ ./skip-failed-test-with-icu70.patch ./gpgme-1.18.patch ]
+  patches = optionals (variant == "still") [ ./skip-failed-test-with-icu70.patch ./gpgme-1.18.patch ]
   ;
 
   ### QT/KDE
diff --git a/pkgs/applications/office/portfolio/default.nix b/pkgs/applications/office/portfolio/default.nix
index 030d5cdb7eb2..6e5941bd3eef 100644
--- a/pkgs/applications/office/portfolio/default.nix
+++ b/pkgs/applications/office/portfolio/default.nix
@@ -27,11 +27,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "PortfolioPerformance";
-  version = "0.59.4";
+  version = "0.59.5";
 
   src = fetchurl {
     url = "https://github.com/buchen/portfolio/releases/download/${version}/PortfolioPerformance-${version}-linux.gtk.x86_64.tar.gz";
-    sha256 = "sha256-Yjp69p1UCLkGgTm8jn/sJfh2dYSKVbHdi1OLIYeB18w=";
+    sha256 = "sha256-6AEc9wc3/8AubPvqq8s9R1RnO+P8+92UsNEt6AdQv+w=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/office/trilium/default.nix b/pkgs/applications/office/trilium/default.nix
index 0ac2f4eac134..73d595cf699d 100644
--- a/pkgs/applications/office/trilium/default.nix
+++ b/pkgs/applications/office/trilium/default.nix
@@ -10,13 +10,13 @@ let
     maintainers = with maintainers; [ fliegendewurst ];
   };
 
-  version = "0.56.2";
+  version = "0.57.3";
 
   desktopSource.url = "https://github.com/zadam/trilium/releases/download/v${version}/trilium-linux-x64-${version}.tar.xz";
-  desktopSource.sha256 = "1rqfkbxgcd32kpi6xfd590nivd1ga0d0kf5zvffyypyy28q95pyz";
+  desktopSource.sha256 = "0ch2l0raysdzkm131rq3xgsk52f9h2f1nx1zjc0zzlvs4qz657l3";
 
   serverSource.url = "https://github.com/zadam/trilium/releases/download/v${version}/trilium-linux-x64-server-${version}.tar.xz";
-  serverSource.sha256 = "1pyi2b649n2rihr4dcz8brfkqrbvssbzhr3dnmyrhrp3qdyxamb6";
+  serverSource.sha256 = "0666pm2pzh1srzpdvs36nw1w2yp4k67k3idz6pyargziqh9pkyqf";
 
 in {
 
@@ -49,6 +49,11 @@ in {
       })
     ];
 
+    # Remove trilium-portable.sh, so trilium knows it is packaged making it stop auto generating a desktop item on launch
+    postPatch = ''
+      rm ./trilium-portable.sh
+    '';
+
     installPhase = ''
       runHook preInstall
       mkdir -p $out/bin
diff --git a/pkgs/applications/office/zk/default.nix b/pkgs/applications/office/zk/default.nix
index 23b1977308c0..a6e1909a2880 100644
--- a/pkgs/applications/office/zk/default.nix
+++ b/pkgs/applications/office/zk/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "zk";
-  version = "0.11.1";
+  version = "0.12.0";
 
   src = fetchFromGitHub {
     owner = "mickael-menu";
     repo = "zk";
     rev = "v${version}";
-    sha256 = "sha256-30Vw6RGREg/ULS+eNExulHNOsOssMjXE+/tuRBQ17kI=";
+    sha256 = "sha256-F56jbYVbKegy38MIaEZvmeqp++bz37wFnHswkXt45t0=";
   };
 
   vendorSha256 = "sha256-11GzI3aEhKKTiULoWq9uIc66E3YCrW/HJQUYXRhCaek=";
diff --git a/pkgs/applications/radio/chirp/default.nix b/pkgs/applications/radio/chirp/default.nix
index 95d33d6f1eec..e73f438f76b8 100644
--- a/pkgs/applications/radio/chirp/default.nix
+++ b/pkgs/applications/radio/chirp/default.nix
@@ -1,24 +1,39 @@
 { lib
-, fetchurl
-, python2
+, fetchFromGitHub
+, python3
+, unstableGitUpdater
 }:
-python2.pkgs.buildPythonApplication rec {
-  pname = "chirp-daily";
-  version = "20220823";
 
-  src = fetchurl {
-    url = "https://trac.chirp.danplanet.com/chirp_daily/daily-${version}/${pname}-${version}.tar.gz";
-    sha256 = "sha256-V+8HQAYU2XjOYeku0XEHqkY4m0XjiUBxM61QcupnlVM=";
+python3.pkgs.buildPythonApplication rec {
+  pname = "chirp";
+  version = "unstable-2022-12-07";
+
+  src = fetchFromGitHub {
+    owner = "kk7ds";
+    repo = "chirp";
+    rev = "dc0c98d22423b496faf0a86296a6ec0bb3b3e11a";
+    hash = "sha256-z0xD11CB7Vt8k0dPXE+E5ZD9XAFwWNxjnUs25/Gd7zI=";
   };
 
-  propagatedBuildInputs = with python2.pkgs; [
-    pygtk pyserial libxml2 future
+  propagatedBuildInputs = with python3.pkgs; [
+    future
+    pyserial
+    requests
+    six
+    wxPython_4_2
   ];
 
+  # "running build_ext" fails with no output
+  doCheck = false;
+
+  passthru.updateScript = unstableGitUpdater {
+    branch = "py3";
+  };
+
   meta = with lib; {
     description = "A free, open-source tool for programming your amateur radio";
     homepage = "https://chirp.danplanet.com/";
-    license = licenses.gpl3;
+    license = licenses.gpl3Plus;
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/applications/radio/freedv/default.nix b/pkgs/applications/radio/freedv/default.nix
index b648c04577e0..c7877f96e843 100644
--- a/pkgs/applications/radio/freedv/default.nix
+++ b/pkgs/applications/radio/freedv/default.nix
@@ -21,13 +21,13 @@
 
 stdenv.mkDerivation rec {
   pname = "freedv";
-  version = "1.8.4";
+  version = "1.8.5";
 
   src = fetchFromGitHub {
     owner = "drowe67";
     repo = "freedv-gui";
     rev = "v${version}";
-    hash = "sha256-X/jL6q2yLNtRq7Xg9JeXu1zXD0KCs59D1poA9hM3Ndo=";
+    hash = "sha256-BkxEg4vQ943QyDo9V1hG2XimguGn8XpO9aIz5si0PKU=";
   };
 
   postPatch = lib.optionalString stdenv.isDarwin ''
diff --git a/pkgs/applications/science/astronomy/phd2/default.nix b/pkgs/applications/science/astronomy/phd2/default.nix
index 52049302a27b..dc84dcfd98d7 100644
--- a/pkgs/applications/science/astronomy/phd2/default.nix
+++ b/pkgs/applications/science/astronomy/phd2/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, pkg-config, cmake, gtk3, wxGTK30-gtk3
+{ lib, stdenv, fetchFromGitHub, pkg-config, cmake, gtk3, wxGTK30
 , curl, gettext, glib, indi-full, libnova, wrapGAppsHook }:
 
 stdenv.mkDerivation rec {
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [
     gtk3
-    wxGTK30-gtk3
+    wxGTK30
     curl
     gettext
     glib
diff --git a/pkgs/applications/science/biology/ecopcr/default.nix b/pkgs/applications/science/biology/ecopcr/default.nix
index 4a6b093e1d0b..c5ab32a68838 100644
--- a/pkgs/applications/science/biology/ecopcr/default.nix
+++ b/pkgs/applications/science/biology/ecopcr/default.nix
@@ -1,17 +1,19 @@
-{ lib, stdenv, fetchurl, gcc, zlib, python27 }:
+{ lib, stdenv, fetchurl, gcc, zlib, python3 }:
 
 stdenv.mkDerivation rec {
   pname = "ecopcr";
-  version = "0.8.0";
+  version = "1.0.1";
 
   src = fetchurl {
-    url = "https://git.metabarcoding.org/obitools/ecopcr/uploads/6f37991b325c8c171df7e79e6ae8d080/ecopcr-${version}.tar.gz";
-    sha256 = "10c58hj25z78jh0g3zcbx4890yd2qrvaaanyx8mn9p49mmyf5pk6";
+    url = "https://git.metabarcoding.org/obitools/ecopcr/-/archive/ecopcr_v${version}/ecopcr-ecopcr_v${version}.tar.gz";
+    hash = "sha256-ssvWpi7HuuRRAkpqqrX3ijLuBqM3QsrmrG+t7/m6fZA=";
   };
 
-  sourceRoot = "ecoPCR/src";
+  buildInputs = [ gcc python3 zlib ];
 
-  buildInputs = [ gcc python27 zlib ];
+  preConfigure = ''
+    cd src
+  '';
 
   installPhase = ''
     mkdir -p $out/bin
diff --git a/pkgs/applications/science/logic/isabelle/default.nix b/pkgs/applications/science/logic/isabelle/default.nix
index 1bb7ede6da7b..d2326d2d4d0e 100644
--- a/pkgs/applications/science/logic/isabelle/default.nix
+++ b/pkgs/applications/science/logic/isabelle/default.nix
@@ -6,7 +6,6 @@
 , java
 , scala_3
 , polyml
-, z3
 , veriT
 , vampire
 , eprover-ho
@@ -15,7 +14,6 @@
 , perl
 , makeDesktopItem
 , isabelle-components
-, isabelle
 , symlinkJoin
 , fetchhg
 }:
@@ -46,7 +44,7 @@ let
       cp libsha1.so $out/lib/
     '';
   };
-in stdenv.mkDerivation rec {
+in stdenv.mkDerivation (finalAttrs: rec {
   pname = "isabelle";
   version = "2022";
 
@@ -68,25 +66,22 @@ in stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ java ];
 
-  buildInputs = [ polyml z3 veriT vampire eprover-ho nettools ]
+  buildInputs = [ polyml veriT vampire eprover-ho nettools ]
     ++ lib.optionals (!stdenv.isDarwin) [ java ];
 
-  sourceRoot = dirname;
+  sourceRoot = "${dirname}${lib.optionalString stdenv.isDarwin ".app"}";
+
+  doCheck = true;
+  checkPhase = "bin/isabelle build -v HOL-SMT_Examples";
 
   postUnpack = lib.optionalString stdenv.isDarwin ''
-    mv $sourceRoot.app $sourceRoot
+    mv $sourceRoot ${dirname}
+    sourceRoot=${dirname}
   '';
 
   postPatch = ''
     patchShebangs lib/Tools/ bin/
 
-    cat >contrib/z3*/etc/settings <<EOF
-      Z3_HOME=${z3}
-      Z3_VERSION=${z3.version}
-      Z3_SOLVER=${z3}/bin/z3
-      Z3_INSTALLED=yes
-    EOF
-
     cat >contrib/verit-*/etc/settings <<EOF
       ISABELLE_VERIT=${veriT}/bin/veriT
     EOF
@@ -122,7 +117,7 @@ in stdenv.mkDerivation rec {
 
     echo ISABELLE_LINE_EDITOR=${rlwrap}/bin/rlwrap >>etc/settings
 
-    for comp in contrib/jdk* contrib/polyml-* contrib/z3-* contrib/verit-* contrib/vampire-* contrib/e-*; do
+    for comp in contrib/jdk* contrib/polyml-* contrib/verit-* contrib/vampire-* contrib/e-*; do
       rm -rf $comp/x86*
     done
 
@@ -143,15 +138,14 @@ in stdenv.mkDerivation rec {
       --replace 'ISABELLE_APPLE_PLATFORM64=arm64-darwin' ""
   '' + lib.optionalString stdenv.isLinux ''
     arch=${if stdenv.hostPlatform.system == "x86_64-linux" then "x86_64-linux" else "x86-linux"}
-    for f in contrib/*/$arch/{bash_process,epclextract,nunchaku,SPASS,zipperposition}; do
-      patchelf --set-interpreter $(cat ${stdenv.cc}/nix-support/dynamic-linker) "$f"
-    done
-    for f in contrib/*/platform_$arch/{bash_process,epclextract,nunchaku,SPASS,zipperposition}; do
+    for f in contrib/*/$arch/{z3,epclextract,nunchaku,SPASS,zipperposition}; do
       patchelf --set-interpreter $(cat ${stdenv.cc}/nix-support/dynamic-linker) "$f"
     done
+    patchelf --set-interpreter $(cat ${stdenv.cc}/nix-support/dynamic-linker) contrib/bash_process-*/platform_$arch/bash_process
     for d in contrib/kodkodi-*/jni/$arch; do
       patchelf --set-rpath "${lib.concatStringsSep ":" [ "${java}/lib/openjdk/lib/server" "${stdenv.cc.cc.lib}/lib" ]}" $d/*.so
     done
+    patchelf --set-rpath "${stdenv.cc.cc.lib}/lib" contrib/z3-*/$arch/z3
   '';
 
   buildPhase = ''
@@ -219,14 +213,15 @@ in stdenv.mkDerivation rec {
     maintainers = [ maintainers.jwiegley maintainers.jvanbruegge ];
     platforms = platforms.unix;
   };
-} // {
-  withComponents = f:
+
+  passthru.withComponents = f:
     let
+      isabelle = finalAttrs.finalPackage;
       base = "$out/${isabelle.dirname}";
       components = f isabelle-components;
     in symlinkJoin {
       name = "isabelle-with-components-${isabelle.version}";
-      paths = [ isabelle ] ++ components;
+      paths = [ isabelle ] ++ (builtins.map (c: c.override { inherit isabelle; }) components);
 
       postBuild = ''
         rm $out/bin/*
@@ -244,4 +239,4 @@ in stdenv.mkDerivation rec {
         echo contrib/${c.pname}-${c.version} >> ${base}/etc/components
       '') components;
     };
-}
+})
diff --git a/pkgs/applications/science/machine-learning/streamlit/default.nix b/pkgs/applications/science/machine-learning/streamlit/default.nix
index 90830ae9ffca..189c4cf97d3b 100755
--- a/pkgs/applications/science/machine-learning/streamlit/default.nix
+++ b/pkgs/applications/science/machine-learning/streamlit/default.nix
@@ -1,21 +1,18 @@
-{
-  # Nix
-  lib
-, buildPythonApplication
-, fetchPypi
-, # Build inputs
-  altair
+{ lib
+, altair
 , blinker
-, click
+, buildPythonApplication
 , cachetools
-, GitPython
+, click
+, fetchPypi
+, gitpython
 , importlib-metadata
 , jinja2
 , pillow
+, protobuf3
 , pyarrow
 , pydeck
 , pympler
-, protobuf3
 , requests
 , rich
 , semver
@@ -25,7 +22,6 @@
 , tzlocal
 , validators
 , watchdog
-,
 }:
 
 buildPythonApplication rec {
@@ -43,7 +39,7 @@ buildPythonApplication rec {
     blinker
     cachetools
     click
-    GitPython
+    gitpython
     importlib-metadata
     jinja2
     pillow
diff --git a/pkgs/applications/science/misc/snakemake/default.nix b/pkgs/applications/science/misc/snakemake/default.nix
index 956b98ffd5f1..89b174515c47 100644
--- a/pkgs/applications/science/misc/snakemake/default.nix
+++ b/pkgs/applications/science/misc/snakemake/default.nix
@@ -22,7 +22,7 @@ python3.pkgs.buildPythonApplication rec {
     datrie
     docutils
     filelock
-    GitPython
+    gitpython
     jinja2
     jsonschema
     nbformat
diff --git a/pkgs/applications/version-management/git-and-tools/git-annex-remote-googledrive/default.nix b/pkgs/applications/version-management/git-and-tools/git-annex-remote-googledrive/default.nix
index 66dc5ece90a8..16c5b49406f6 100644
--- a/pkgs/applications/version-management/git-and-tools/git-annex-remote-googledrive/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git-annex-remote-googledrive/default.nix
@@ -1,29 +1,38 @@
 { lib
-, buildPythonApplication
-, fetchPypi
 , annexremote
+, buildPythonApplication
 , drivelib
-, GitPython
-, tenacity
+, fetchPypi
+, gitpython
 , humanfriendly
+, tenacity
 }:
 
 buildPythonApplication rec {
   pname = "git-annex-remote-googledrive";
   version = "1.3.2";
+  format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
     sha256 = "0rwjcdvfgzdlfgrn1rrqwwwiqqzyh114qddrbfwd46ld5spry6r1";
   };
 
-  propagatedBuildInputs = [ annexremote drivelib GitPython tenacity humanfriendly ];
+  propagatedBuildInputs = [
+    annexremote
+    drivelib
+    gitpython
+    tenacity
+    humanfriendly
+  ];
 
   # while git-annex does come with a testremote command that *could* be used,
   # testing this special remote obviously depends on authenticating with google
   doCheck = false;
 
-  pythonImportsCheck = [ "git_annex_remote_googledrive" ];
+  pythonImportsCheck = [
+    "git_annex_remote_googledrive"
+  ];
 
   meta = with lib; {
     description = "A git-annex special remote for Google Drive";
diff --git a/pkgs/applications/version-management/git-and-tools/git-privacy/default.nix b/pkgs/applications/version-management/git-and-tools/git-privacy/default.nix
index c17654174382..d162f9ce20ba 100644
--- a/pkgs/applications/version-management/git-and-tools/git-privacy/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git-privacy/default.nix
@@ -9,8 +9,6 @@ python3.pkgs.buildPythonApplication rec {
   version = "2.1.0";
   format = "setuptools";
 
-  disabled = python3.pythonOlder "3.6";
-
   src = fetchFromGitHub {
     owner = "EMPRI-DEVOPS";
     repo = pname;
@@ -21,7 +19,7 @@ python3.pkgs.buildPythonApplication rec {
   propagatedBuildInputs = with python3.pkgs; [
     click
     git-filter-repo
-    GitPython
+    gitpython
     pynacl
     setuptools
   ];
diff --git a/pkgs/applications/version-management/git-and-tools/git-repo-updater/default.nix b/pkgs/applications/version-management/git-and-tools/git-repo-updater/default.nix
index d78972aa07bd..ebea57c1552a 100644
--- a/pkgs/applications/version-management/git-and-tools/git-repo-updater/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git-repo-updater/default.nix
@@ -1,5 +1,9 @@
-{ lib, buildPythonApplication, fetchPypi
-, colorama, GitPython }:
+{ lib
+, buildPythonApplication
+, colorama
+, fetchPypi
+, gitpython
+}:
 
 buildPythonApplication rec {
   pname = "gitup";
@@ -10,7 +14,10 @@ buildPythonApplication rec {
     sha256 = "1pa612rcc94nc461zs9sag9p46sycc214622b06gdn35rmwp0y2g";
   };
 
-  propagatedBuildInputs = [ colorama GitPython ];
+  propagatedBuildInputs = [
+    colorama
+    gitpython
+  ];
 
   # no tests
   doCheck = false;
@@ -19,7 +26,6 @@ buildPythonApplication rec {
     description = "Easily update multiple Git repositories at once";
     homepage = "https://github.com/earwig/git-repo-updater";
     license = licenses.mit;
-    maintainers = [ maintainers.bdesham ];
-    platforms = platforms.all;
+    maintainers = with maintainers; [bdesham ];
   };
 }
diff --git a/pkgs/applications/version-management/git-and-tools/git-up/default.nix b/pkgs/applications/version-management/git-and-tools/git-up/default.nix
index 0a366827e40d..71ae40e25d35 100644
--- a/pkgs/applications/version-management/git-and-tools/git-up/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git-up/default.nix
@@ -1,4 +1,7 @@
-{ lib, pythonPackages, git }:
+{ lib
+, pythonPackages
+, git
+}:
 
 pythonPackages.buildPythonApplication rec {
   pname = "git-up";
@@ -10,7 +13,16 @@ pythonPackages.buildPythonApplication rec {
   };
 
   # git should be on path for tool to work correctly
-  propagatedBuildInputs = [ git ] ++ (with pythonPackages; [ click colorama docopt GitPython six termcolor ]);
+  propagatedBuildInputs = [
+    git
+  ] ++ (with pythonPackages; [
+    click
+    colorama
+    docopt
+    gitpython
+    six
+    termcolor
+  ]);
 
   checkInputs = [ git pythonPackages.nose ]; # git needs to be on path
   # 1. git fails to run as it cannot detect the email address, so we set it
diff --git a/pkgs/applications/version-management/git-and-tools/gitmux/default.nix b/pkgs/applications/version-management/git-and-tools/gitmux/default.nix
new file mode 100644
index 000000000000..7e66985bb886
--- /dev/null
+++ b/pkgs/applications/version-management/git-and-tools/gitmux/default.nix
@@ -0,0 +1,35 @@
+{ fetchFromGitHub, buildGoModule, lib, testers, gitmux }:
+
+buildGoModule rec {
+  pname = "gitmux";
+  version = "0.7.10";
+
+  src = fetchFromGitHub {
+    owner = "arl";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "sha256-kBrE3jU7N8+kdT4tqC6gIGPz3soagStzLy5Iz4vNFI0=";
+  };
+
+  vendorSha256 = "sha256-V6xe+19NiHYIIN4rgkyzdP4eGnRXo0aW4fVbdlIcvig=";
+
+  # GitHub source does contain a regression test for the module
+  # but it requires networking as it git clones a repo from github
+  doCheck = false;
+
+  ldflags = [ "-X main.version=${version}" ];
+
+  passthru.tests.version = testers.testVersion {
+    package = gitmux;
+    command = "gitmux -V";
+  };
+
+  subPackages = [ "." ];
+
+  meta = with lib; {
+    description = "Git in your tmux status bar";
+    homepage = "https://github.com/arl/gitmux";
+    license = licenses.mit;
+    maintainers = with maintainers; [ nialov ];
+  };
+}
diff --git a/pkgs/applications/version-management/git-and-tools/glab/default.nix b/pkgs/applications/version-management/git-and-tools/glab/default.nix
index 6bfc8df1313c..9d6bbbd13f67 100644
--- a/pkgs/applications/version-management/git-and-tools/glab/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/glab/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "glab";
-  version = "1.23.0";
+  version = "1.24.1";
 
   src = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "cli";
     rev = "v${version}";
-    sha256 = "sha256-NHBLaUEWurWnwbLiEsi3/pHqxKcgjjx+oRAGZXxni/Q=";
+    sha256 = "sha256-CUchYPMBTINkMJg8TC8rKMVkrcj/Gy+ZxV7jbtMFvpg=";
   };
 
   vendorSha256 = "sha256-NuK63ibb1t+HnSR/gCFS7HWVtfGLazVx2M+qxRNCR1I=";
diff --git a/pkgs/applications/version-management/git-and-tools/lefthook/default.nix b/pkgs/applications/version-management/git-and-tools/lefthook/default.nix
index e73d4de6dc41..38d6d740c83c 100644
--- a/pkgs/applications/version-management/git-and-tools/lefthook/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/lefthook/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "lefthook";
-  version = "1.2.3";
+  version = "1.2.4";
 
   src = fetchFromGitHub {
     rev = "v${version}";
     owner = "evilmartians";
     repo = "lefthook";
-    sha256 = "sha256-tns/JUOYlgG+oiFACnXlCwHBF4enctV4GPlpEZCM/nM=";
+    sha256 = "sha256-Z6j/Y8b9lq2nYS5Ki8iJoDsG3l5M6RylfDqQL7WrwNg=";
   };
 
   vendorSha256 = "sha256-sBcgt2YsV9RQhSjPN6N54tRk7nNvcOVhPEsEP+0Dtco=";
diff --git a/pkgs/applications/version-management/git-and-tools/legit/default.nix b/pkgs/applications/version-management/git-and-tools/legit/default.nix
index df2866527115..33efad77f908 100644
--- a/pkgs/applications/version-management/git-and-tools/legit/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/legit/default.nix
@@ -1,8 +1,11 @@
-{ lib, python3Packages }:
+{ lib
+, python3Packages
+}:
 
 python3Packages.buildPythonApplication rec {
   pname = "legit";
   version = "1.2.0";
+
   src = python3Packages.fetchPypi {
     inherit pname version;
     sha256 = "0ngh3ar6v15516f52j21k6qz7hykmxfjadhb2rakvl27b5xvjy1c";
@@ -12,7 +15,7 @@ python3Packages.buildPythonApplication rec {
     click
     clint
     crayons
-    GitPython
+    gitpython
     six
   ];
 
diff --git a/pkgs/applications/version-management/jujutsu/default.nix b/pkgs/applications/version-management/jujutsu/default.nix
index e9b9d02ca6c3..19eb42c3cef4 100644
--- a/pkgs/applications/version-management/jujutsu/default.nix
+++ b/pkgs/applications/version-management/jujutsu/default.nix
@@ -15,16 +15,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "jujutsu";
-  version = "0.5.1";
+  version = "0.6.0";
 
   src = fetchFromGitHub {
     owner = "martinvonz";
     repo = "jj";
     rev = "v${version}";
-    sha256 = "sha256-ITYpdCUh+WzP2RrAkSep3DsQ7dztvOMuwESKimn8JBQ=";
+    sha256 = "sha256-xS4uktydrvkeTsR9QGT9gYdhFh92XdpoG0TrDt7IPdc=";
   };
 
-  cargoSha256 = "sha256-eH8/R4dwQ08Q7Dyw8CnE+DGjneAmtTdsRben2cxpG8Q=";
+  cargoSha256 = "sha256-VM+Oq0nf4pMK3nbPbHbl7E2qgUnGlu7kf2p47d8cm1c=";
 
   # Needed to get openssl-sys to use pkg-config.
   OPENSSL_NO_VENDOR = 1;
diff --git a/pkgs/applications/version-management/rapidsvn/default.nix b/pkgs/applications/version-management/rapidsvn/default.nix
index 4bede0ac82b6..0027af3defe9 100644
--- a/pkgs/applications/version-management/rapidsvn/default.nix
+++ b/pkgs/applications/version-management/rapidsvn/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, wxGTK30-gtk3, subversion, apr, aprutil, python3, fetchpatch }:
+{ lib, stdenv, fetchurl, wxGTK30, subversion, apr, aprutil, python3, fetchpatch }:
 
 stdenv.mkDerivation rec {
   pname = "rapidsvn";
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
     sha256 = "1bmcqjc12k5w0z40k7fkk8iysqv4fw33i80gvcmbakby3d4d4i4p";
   };
 
-  buildInputs = [ wxGTK30-gtk3 subversion apr aprutil python3 ];
+  buildInputs = [ wxGTK30 subversion apr aprutil python3 ];
 
   NIX_CFLAGS_COMPILE = [ "-std=c++14" ];
 
diff --git a/pkgs/applications/version-management/tailor/default.nix b/pkgs/applications/version-management/tailor/default.nix
index e3b5891720fb..bd824a71633c 100644
--- a/pkgs/applications/version-management/tailor/default.nix
+++ b/pkgs/applications/version-management/tailor/default.nix
@@ -1,19 +1,37 @@
-{ fetchurl, pypy2Packages }:
+{ lib
+, python3
+, fetchurl
+}:
 
-pypy2Packages.buildPythonApplication rec {
+python3.pkgs.buildPythonApplication rec {
   pname = "tailor";
-  version = "0.9.35";
+  version = "0.9.37";
 
   src = fetchurl {
-    urls = [
-      "http://darcs.arstecnica.it/tailor/tailor-${version}.tar.gz"
-      "https://src.fedoraproject.org/repo/pkgs/tailor/tailor-${version}.tar.gz/58a6bc1c1d922b0b1e4579c6440448d1/tailor-${version}.tar.gz"
-    ];
-    sha256 = "061acapxxn5ab3ipb5nd3nm8pk2xj67bi83jrfd6lqq3273fmdjh";
+    url = "https://gitlab.com/ports1/tailor/-/archive/0.937/tailor-0.937.tar.gz";
+    hash = "sha256-Bdf8ZCRsbCsFz1GRxyQxxndXSsm8oOL2738m9UxOTVc=";
   };
 
-  meta = {
-    description = "Version control tools integration tool";
+  propagatedBuildInputs = with python3.pkgs; [
+    future
+  ];
+
+  # AssertionError: Tailor Darcs repository not found!
+  doCheck = false;
+
+  meta = with lib; {
+    description = "A tool to migrate changesets between various kinds of version control system.";
+    longDescription = ''
+      With its ability to "translate the history" from one VCS kind to another,
+      this tool makes it easier to keep the upstream changes merged in
+      a own branch of a product.
+
+      Tailor is able to fetch the history from Arch, Bazaar, CVS, Darcs, Monotone,
+      Perforce or Subversion and rewrite it over Aegis, Bazaar, CVS, Darcs, Git,
+      Mercurial, Monotone and Subversion.
+    '';
+    homepage = "https://gitlab.com/ports1/tailor";
+    license = licenses.gpl1Plus;
+    platforms = platforms.unix;
   };
 }
-
diff --git a/pkgs/applications/video/dvdstyler/default.nix b/pkgs/applications/video/dvdstyler/default.nix
index 8d42c2b2bfd6..cd3691458336 100644
--- a/pkgs/applications/video/dvdstyler/default.nix
+++ b/pkgs/applications/video/dvdstyler/default.nix
@@ -17,7 +17,7 @@
 , libjpeg
 , pkg-config
 , wrapGAppsHook
-, wxGTK30-gtk3 # crash with wxGTK30 with GTK2 compat
+, wxGTK30 # crash with wxGTK30 with GTK2 compat
 , wxSVG
 , xine-ui
 , xmlto
@@ -62,7 +62,7 @@ in stdenv.mkDerivation rec {
     libexif
     libjpeg
     wxSVG
-    wxGTK30-gtk3
+    wxGTK30
     xine-ui
  ]
   ++ optionals dvdisasterSupport [ dvdisaster ]
diff --git a/pkgs/applications/video/mpv/default.nix b/pkgs/applications/video/mpv/default.nix
index 05ec95d006bd..da5e6366fb61 100644
--- a/pkgs/applications/video/mpv/default.nix
+++ b/pkgs/applications/video/mpv/default.nix
@@ -4,11 +4,10 @@
 , fetchFromGitHub
 , addOpenGLRunpath
 , docutils
-, perl
+, meson
+, ninja
 , pkg-config
 , python3
-, wafHook
-, which
 , ffmpeg
 , freefont_ttf
 , freetype
@@ -19,6 +18,7 @@
 , libuchardet
 , libiconv
 , CoreFoundation, Cocoa, CoreAudio, MediaPlayer
+, xcbuild
 
 , waylandSupport ? stdenv.isLinux
   , wayland
@@ -97,42 +97,38 @@ in stdenv.mkDerivation rec {
     patchShebangs version.* ./TOOLS/
   '';
 
-  NIX_LDFLAGS = lib.optionalString x11Support "-lX11 -lXext "
-    + lib.optionalString stdenv.isDarwin "-framework CoreFoundation";
-
-  # These flags are not supported and cause the build
-  # to fail, even when cross compilation itself works.
-  dontAddWafCrossFlags = true;
-
-  wafConfigureFlags = [
-    "--enable-libmpv-shared"
-    "--enable-manpage-build"
-    "--disable-libmpv-static"
-    "--disable-static-build"
-    "--disable-build-date" # Purity
-    (lib.enableFeature archiveSupport  "libarchive")
-    (lib.enableFeature cddaSupport     "cdda")
-    (lib.enableFeature dvdnavSupport   "dvdnav")
-    (lib.enableFeature javascriptSupport "javascript")
-    (lib.enableFeature openalSupport   "openal")
-    (lib.enableFeature sdl2Support     "sdl2")
-    (lib.enableFeature sixelSupport    "sixel")
-    (lib.enableFeature vaapiSupport    "vaapi")
-    (lib.enableFeature waylandSupport  "wayland")
-    (lib.enableFeature dvbinSupport  "dvbin")
-  ] # Disable whilst Swift isn't supported
-    ++ lib.optional (!swiftSupport) "--disable-macos-cocoa-cb";
+  NIX_LDFLAGS = lib.optionalString x11Support "-lX11 -lXext ";
+
+  mesonFlags = let
+    inherit (lib) mesonOption mesonBool mesonEnable;
+  in [
+    (mesonOption "default_library" "shared")
+    (mesonBool "libmpv" true)
+    (mesonEnable "libarchive" archiveSupport)
+    (mesonEnable "manpage-build" true)
+    (mesonEnable "cdda" cddaSupport)
+    (mesonEnable "dvbin" dvbinSupport)
+    (mesonEnable "dvdnav" dvdnavSupport)
+    (mesonEnable "openal" openalSupport)
+    (mesonEnable "sdl2" sdl2Support)
+    # Disable whilst Swift isn't supported
+    (mesonEnable "swift-build" swiftSupport)
+    (mesonEnable "macos-cocoa-cb" swiftSupport)
+  ];
+
+  mesonAutoFeatures = "auto";
 
   nativeBuildInputs = [
     addOpenGLRunpath
     docutils # for rst2man
-    perl
+    meson
+    ninja
     pkg-config
     python3
-    wafHook
-    which
-  ] ++ lib.optionals swiftSupport [ swift ]
-    ++ lib.optionals waylandSupport [ wayland-scanner ];
+  ]
+  ++ lib.optionals stdenv.isDarwin [ xcbuild.xcrun ]
+  ++ lib.optionals swiftSupport [ swift ]
+  ++ lib.optionals waylandSupport [ wayland-scanner ];
 
   buildInputs = [
     ffmpeg
@@ -175,10 +171,10 @@ in stdenv.mkDerivation rec {
     ++ lib.optionals stdenv.isDarwin    [ libiconv ]
     ++ lib.optionals stdenv.isDarwin    [ CoreFoundation Cocoa CoreAudio MediaPlayer ];
 
-  enableParallelBuilding = true;
-
   postBuild = lib.optionalString stdenv.isDarwin ''
+    pushd .. # Must be run from the source dir because it uses relative paths
     python3 TOOLS/osxbundle.py -s build/mpv
+    popd
   '';
 
   postInstall = ''
@@ -186,16 +182,13 @@ in stdenv.mkDerivation rec {
     mkdir -p $out/share/mpv
     ln -s ${freefont_ttf}/share/fonts/truetype/FreeSans.ttf $out/share/mpv/subfont.ttf
 
-    cp TOOLS/mpv_identify.sh $out/bin
-    cp TOOLS/umpv $out/bin
+    cp ../TOOLS/mpv_identify.sh $out/bin
+    cp ../TOOLS/umpv $out/bin
     cp $out/share/applications/mpv.desktop $out/share/applications/umpv.desktop
     sed -i '/Icon=/ ! s/mpv/umpv/g' $out/share/applications/umpv.desktop
-
-    substituteInPlace $out/lib/pkgconfig/mpv.pc \
-      --replace "$out/include" "$dev/include"
   '' + lib.optionalString stdenv.isDarwin ''
     mkdir -p $out/Applications
-    cp -r build/mpv.app $out/Applications
+    cp -r mpv.app $out/Applications
   '';
 
   # Set RUNPATH so that libcuda in /run/opengl-driver(-32)/lib can be found.
@@ -227,6 +220,6 @@ in stdenv.mkDerivation rec {
     '';
     license = licenses.gpl2Plus;
     maintainers = with maintainers; [ AndersonTorres fpletz globin ma27 tadeokondrak ];
-    platforms = platforms.darwin ++ platforms.linux;
+    platforms = platforms.unix;
   };
 }
diff --git a/pkgs/applications/virtualization/containerd/default.nix b/pkgs/applications/virtualization/containerd/default.nix
index 7a99bfd0ecc5..c84ba7a6c46e 100644
--- a/pkgs/applications/virtualization/containerd/default.nix
+++ b/pkgs/applications/virtualization/containerd/default.nix
@@ -10,13 +10,13 @@
 
 buildGoModule rec {
   pname = "containerd";
-  version = "1.6.10";
+  version = "1.6.12";
 
   src = fetchFromGitHub {
     owner = "containerd";
     repo = "containerd";
     rev = "v${version}";
-    sha256 = "sha256-kz2UuWzVK5lu/d6K0LHauu2yhBF6Hl83P/a/HCCSObc=";
+    sha256 = "sha256-02eg2RNEim47Q3TyTLYc0IdaBJcOf89qTab8GV8fDgA=";
   };
 
   vendorSha256 = null;
diff --git a/pkgs/applications/virtualization/docker/default.nix b/pkgs/applications/virtualization/docker/default.nix
index c8d3de79f155..fff9200285aa 100644
--- a/pkgs/applications/virtualization/docker/default.nix
+++ b/pkgs/applications/virtualization/docker/default.nix
@@ -48,7 +48,7 @@ rec {
       };
 
       buildInputs = oldAttrs.buildInputs
-        ++ lib.optional withSeccomp [ libseccomp ];
+        ++ lib.optionals withSeccomp [ libseccomp ];
     });
 
     docker-tini = tini.overrideAttrs (oldAttrs: {
diff --git a/pkgs/applications/virtualization/pods/default.nix b/pkgs/applications/virtualization/pods/default.nix
index 70219f995387..614f2591b516 100644
--- a/pkgs/applications/virtualization/pods/default.nix
+++ b/pkgs/applications/virtualization/pods/default.nix
@@ -12,23 +12,24 @@
 , gtksourceview5
 , libadwaita
 , libpanel
+, vte-gtk4
 }:
 
 stdenv.mkDerivation rec {
   pname = "pods";
-  version = "1.0.0-beta.8";
+  version = "1.0.0-beta.9";
 
   src = fetchFromGitHub {
     owner = "marhkb";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-WLjXeTtg5DlZbENWYC6lHj6ccU1HGLN+v7xl5sXXvE0=";
+    sha256 = "sha256-cW6n00EPe7eFuqT2Vk27Ax0fxjz9kWSlYuS2oIj0mXY=";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src;
     name = "${pname}-${version}";
-    sha256 = "sha256-/Z0vp9Fn49+PhXwtt4Z0on4CghU1Hnu4gWcjzAWeCFk=";
+    sha256 = "sha256-y0njqlzAx1M7iC8bZrKlKACSiYnSRaHOrcAxs3bFF30=";
   };
 
   nativeBuildInputs = [
@@ -49,6 +50,7 @@ stdenv.mkDerivation rec {
     gtksourceview5
     libadwaita
     libpanel
+    vte-gtk4
   ];
 
   meta = with lib; {
diff --git a/pkgs/applications/window-managers/icewm/default.nix b/pkgs/applications/window-managers/icewm/default.nix
index 07c45bbcc693..fe0c275b72e2 100644
--- a/pkgs/applications/window-managers/icewm/default.nix
+++ b/pkgs/applications/window-managers/icewm/default.nix
@@ -41,13 +41,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "icewm";
-  version = "3.2.2";
+  version = "3.2.3";
 
   src = fetchFromGitHub {
     owner = "ice-wm";
     repo = "icewm";
     rev = finalAttrs.version;
-    hash = "sha256-tVbBV3eaZ9MUXlzriiOeEuzojI3GHNaXRBjdsQjXrzw=";
+    hash = "sha256-cG+I7WMWboMNH6A0eKFI3evN16C5EGE127q+a/PBR5E=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/build-support/docker/default.nix b/pkgs/build-support/docker/default.nix
index c6ab4589aefa..48c780e2dbe4 100644
--- a/pkgs/build-support/docker/default.nix
+++ b/pkgs/build-support/docker/default.nix
@@ -74,7 +74,7 @@ let
   # Reference: https://github.com/opencontainers/image-spec/blob/master/config.md#properties
   # For the mapping from Nixpkgs system parameters to GOARCH, we can reuse the
   # mapping from the go package.
-  defaultArch = go.GOARCH;
+  defaultArchitecture = go.GOARCH;
 
 in
 rec {
@@ -101,8 +101,8 @@ rec {
     , imageDigest
     , sha256
     , os ? "linux"
-    , arch ? defaultArch
-
+    , # Image architecture, defaults to the architecture of the `hostPlatform` when unset
+      arch ? defaultArchitecture
       # This is used to set name to the pulled image
     , finalImageName ? imageName
       # This used to set a tag to the pulled image
@@ -514,6 +514,8 @@ rec {
       keepContentsDirlinks ? false
     , # Docker config; e.g. what command to run on the container.
       config ? null
+    , # Image architecture, defaults to the architecture of the `hostPlatform` when unset
+      architecture ? defaultArchitecture
     , # Optional bash script to run on the files prior to fixturizing the layer.
       extraCommands ? ""
     , uid ? 0
@@ -546,8 +548,7 @@ rec {
       baseJson =
         let
           pure = writeText "${baseName}-config.json" (builtins.toJSON {
-            inherit created config;
-            architecture = defaultArch;
+            inherit created config architecture;
             preferLocalBuild = true;
             os = "linux";
           });
@@ -838,6 +839,8 @@ rec {
       contents ? [ ]
     , # Docker config; e.g. what command to run on the container.
       config ? { }
+    , # Image architecture, defaults to the architecture of the `hostPlatform` when unset
+      architecture ? defaultArchitecture
     , # Time of creation of the image. Passing "now" will make the
       # created date be the time of building.
       created ? "1970-01-01T00:00:01Z"
@@ -869,8 +872,7 @@ rec {
 
         streamScript = writePython3 "stream" { } ./stream_layered_image.py;
         baseJson = writeText "${baseName}-base.json" (builtins.toJSON {
-          inherit config;
-          architecture = defaultArch;
+          inherit config architecture;
           os = "linux";
         });
 
diff --git a/pkgs/build-support/docker/examples.nix b/pkgs/build-support/docker/examples.nix
index 71c3574963c8..5784e650dc2e 100644
--- a/pkgs/build-support/docker/examples.nix
+++ b/pkgs/build-support/docker/examples.nix
@@ -92,7 +92,7 @@ rec {
     ];
 
     extraCommands = ''
-      mkdir -p tmp
+      mkdir -p tmp/nginx_client_body
 
       # nginx still tries to read this directory even if error_log
       # directive is specifying another file :/
@@ -700,6 +700,21 @@ rec {
     contents = [ pkgs.bashInteractive ./test-dummy ];
   };
 
+  build-image-with-architecture = buildImage {
+    name = "build-image-with-architecture";
+    tag = "latest";
+    architecture = "arm64";
+    # Not recommended. Use `buildEnv` between copy and packages to avoid file duplication.
+    copyToRoot = [ pkgs.bashInteractive ./test-dummy ];
+  };
+
+  layered-image-with-architecture = pkgs.dockerTools.streamLayeredImage {
+    name = "layered-image-with-architecture";
+    tag = "latest";
+    architecture = "arm64";
+    contents = [ pkgs.bashInteractive ./test-dummy ];
+  };
+
   # ensure that caCertificates builds
   image-with-certs = buildImage {
     name = "image-with-certs";
diff --git a/pkgs/build-support/mkshell/default.nix b/pkgs/build-support/mkshell/default.nix
index e7552f434848..39b02a47141a 100644
--- a/pkgs/build-support/mkshell/default.nix
+++ b/pkgs/build-support/mkshell/default.nix
@@ -44,12 +44,13 @@ stdenv.mkDerivation ({
   phases = [ "buildPhase" ];
 
   buildPhase = ''
-    echo "------------------------------------------------------------" >>$out
-    echo " WARNING: the existence of this path is not guaranteed." >>$out
-    echo " It is an internal implementation detail for pkgs.mkShell."   >>$out
-    echo "------------------------------------------------------------" >>$out
-    echo >> $out
-    # Record all build inputs as runtime dependencies
-    export >> $out
+    { echo "------------------------------------------------------------";
+      echo " WARNING: the existence of this path is not guaranteed.";
+      echo " It is an internal implementation detail for pkgs.mkShell.";
+      echo "------------------------------------------------------------";
+      echo;
+      # Record all build inputs as runtime dependencies
+      export;
+    } >> "$out"
   '';
 } // rest)
diff --git a/pkgs/build-support/rust/build-rust-crate/configure-crate.nix b/pkgs/build-support/rust/build-rust-crate/configure-crate.nix
index 473a91f9ce07..ea150c2fe85d 100644
--- a/pkgs/build-support/rust/build-rust-crate/configure-crate.nix
+++ b/pkgs/build-support/rust/build-rust-crate/configure-crate.nix
@@ -186,7 +186,10 @@ in ''
      set +e
      EXTRA_BUILD=$(sed -n "s/^cargo:rustc-flags=\(.*\)/\1/p" target/build/${crateName}.opt | tr '\n' ' ' | sort -u)
      EXTRA_FEATURES=$(sed -n "s/^cargo:rustc-cfg=\(.*\)/--cfg \1/p" target/build/${crateName}.opt | tr '\n' ' ')
-     EXTRA_LINK=$(sed -n "s/^cargo:rustc-link-lib=\(.*\)/\1/p" target/build/${crateName}.opt | tr '\n' ' ')
+     EXTRA_LINK_ARGS=$(sed -n "s/^cargo:rustc-link-arg=\(.*\)/-C link-arg=\1/p" target/build/${crateName}.opt | tr '\n' ' ')
+     EXTRA_LINK_ARGS_BINS=$(sed -n "s/^cargo:rustc-link-arg-bins=\(.*\)/-C link-arg=\1/p" target/build/${crateName}.opt | tr '\n' ' ')
+     EXTRA_LINK_ARGS_LIB=$(sed -n "s/^cargo:rustc-link-arg-lib=\(.*\)/-C link-arg=\1/p" target/build/${crateName}.opt | tr '\n' ' ')
+     EXTRA_LINK_LIBS=$(sed -n "s/^cargo:rustc-link-lib=\(.*\)/\1/p" target/build/${crateName}.opt | tr '\n' ' ')
      EXTRA_LINK_SEARCH=$(sed -n "s/^cargo:rustc-link-search=\(.*\)/\1/p" target/build/${crateName}.opt | tr '\n' ' ' | sort -u)
 
      # We want to read part of every line that has cargo:rustc-env= prefix and
diff --git a/pkgs/build-support/rust/build-rust-crate/lib.sh b/pkgs/build-support/rust/build-rust-crate/lib.sh
index 39f7d53f6f75..7f98701b5409 100644
--- a/pkgs/build-support/rust/build-rust-crate/lib.sh
+++ b/pkgs/build-support/rust/build-rust-crate/lib.sh
@@ -17,6 +17,8 @@ build_lib() {
     -L dependency=target/deps \
     --cap-lints allow \
     $LINK \
+    $EXTRA_LINK_ARGS \
+    $EXTRA_LINK_ARGS_LIB \
     $LIB_RUSTC_OPTS \
     $BUILD_OUT_DIR \
     $EXTRA_BUILD \
@@ -47,6 +49,8 @@ build_bin() {
     --out-dir target/bin \
     -L dependency=target/deps \
     $LINK \
+    $EXTRA_LINK_ARGS \
+    $EXTRA_LINK_ARGS_BINS \
     $EXTRA_LIB \
     --cap-lints allow \
     $BUILD_OUT_DIR \
@@ -94,7 +98,7 @@ setup_link_paths() {
        done
      fi
   done
-  echo "$EXTRA_LINK" | while read i; do
+  echo "$EXTRA_LINK_LIBS" | while read i; do
      if [[ ! -z "$i" ]]; then
        for library in $i; do
          echo "-l $library" >> target/link
diff --git a/pkgs/data/fonts/amiri/default.nix b/pkgs/data/fonts/amiri/default.nix
index 2c9acc391711..87185e8469fd 100644
--- a/pkgs/data/fonts/amiri/default.nix
+++ b/pkgs/data/fonts/amiri/default.nix
@@ -1,17 +1,16 @@
 { lib, fetchzip }:
 
 let
-  version = "0.900";
+  version = "1.000";
 
 in fetchzip rec {
   name = "Amiri-${version}";
 
   url = "https://github.com/alif-type/amiri/releases/download/${version}/${name}.zip";
 
-  sha256 = "sha256-FjuzWW9xVWDOxHBwYL4pmopQVc9KYHGHhye5tPdw68s=";
+  sha256 = "sha256-hG6m/zsGoGF5/xhHz9EHVL9Sg9dlQqfXpQ/lqNyI1vU=";
 
   postFetch = ''
-    rm -rf $out/otf
     mkdir -p $out/share/fonts/truetype
     mv $out/*.ttf $out/share/fonts/truetype/
     mkdir -p $out/share/doc/${name}
diff --git a/pkgs/data/fonts/carlito/default.nix b/pkgs/data/fonts/carlito/default.nix
index 1de2e9afc0f9..0ecd3f85c693 100644
--- a/pkgs/data/fonts/carlito/default.nix
+++ b/pkgs/data/fonts/carlito/default.nix
@@ -1,22 +1,21 @@
-{ lib, fetchzip }:
+{ lib, fetchzip, stdenvNoCC }:
 
-let
+stdenvNoCC.mkDerivation rec {
+  pname = "carlito";
   version = "20130920";
-in fetchzip {
-  name = "carlito-${version}";
 
-  url = "https://commondatastorage.googleapis.com/chromeos-localmirror/distfiles/crosextrafonts-carlito-${version}.tar.gz";
+  src = fetchzip {
+    url = "https://commondatastorage.googleapis.com/chromeos-localmirror/distfiles/crosextrafonts-carlito-${version}.tar.gz";
+    sha256 = "sha256-OGDO5WoF7OmiRdLRRrIXMzg276Pgeq1L3Offcl0W2jg=";
+  };
 
-  postFetch = ''
-    tar -xzvf $downloadedFile --strip-components=1
+  installPhase = ''
     mkdir -p $out/etc/fonts/conf.d
     mkdir -p $out/share/fonts/truetype
-    cp -v *.ttf $out/share/fonts/truetype
+    cp -v $src/*.ttf $out/share/fonts/truetype
     cp -v ${./calibri-alias.conf} $out/etc/fonts/conf.d/30-calibri.conf
   '';
 
-  sha256 = "0d72zy6kdmxgpi63r3yvi3jh1hb7lvlgv8hgd4ag0x10dz18mbzv";
-
   meta = with lib; {
     # This font doesn't appear to have any official web site but this
     # one provides some good information and samples.
@@ -25,7 +24,7 @@ in fetchzip {
     longDescription = ''
       Carlito is a free font that is metric-compatible with the
       Microsoft Calibri font. The font is designed by Łukasz Dziedzic
-      of the tyPoland foundry and based his Lato font.
+      of the tyPoland foundry and based upon his Lato font.
     '';
     license = licenses.ofl;
     platforms = platforms.all;
diff --git a/pkgs/data/fonts/lexend/default.nix b/pkgs/data/fonts/lexend/default.nix
index 3efb1886b171..9bb00bf10595 100644
--- a/pkgs/data/fonts/lexend/default.nix
+++ b/pkgs/data/fonts/lexend/default.nix
@@ -5,13 +5,13 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "lexend";
-  version = "0.pre+date=2022-01-27";
+  version = "0.pre+date=2022-09-22";
 
   src = fetchFromGitHub {
     owner = "googlefonts";
     repo = pname;
-    rev = "57e6c14e2a9b457e8376044a31525c2100297e9c";
-    sha256 = "sha256-+tPggQIO50a8kOSnOVN/MR9ZwX5xZqYVNZO79eog9QA=";
+    rev = "cd26b9c2538d758138c20c3d2f10362ed613854b";
+    sha256 = "ZKogntyJ/44GBZmFwbtw5Ujw5Gnvv0tVB59ciKqR4c8=";
   };
 
   installPhase = ''
@@ -19,8 +19,8 @@ stdenvNoCC.mkDerivation rec {
 
     cd fonts
     for f in *; do
-      mkdir -p $out/share/fonts/truetype/lexend/$f
-      install $f/ttf/* $out/share/fonts/truetype/lexend/$f/
+      install -D -t $out/share/fonts/truetype/lexend/$f $f/ttf/*
+      install -D -t $out/share/fonts/variable/lexend/$f $f/variable/*
     done
 
     runHook postInstall
diff --git a/pkgs/data/fonts/material-design-icons/default.nix b/pkgs/data/fonts/material-design-icons/default.nix
index 80c887f58913..82f422146ac7 100644
--- a/pkgs/data/fonts/material-design-icons/default.nix
+++ b/pkgs/data/fonts/material-design-icons/default.nix
@@ -1,7 +1,7 @@
 { lib, fetchFromGitHub }:
 
 let
-  version = "6.6.96";
+  version = "7.0.96";
 in fetchFromGitHub {
   name = "material-design-icons-${version}";
   owner  = "Templarian";
@@ -9,17 +9,19 @@ in fetchFromGitHub {
   rev    = "v${version}";
 
   postFetch = ''
-    tar xf $downloadedFile --strip=1
     mkdir -p $out/share/fonts/{eot,truetype,woff,woff2}
-    cp fonts/*.eot $out/share/fonts/eot/
-    cp fonts/*.ttf $out/share/fonts/truetype/
-    cp fonts/*.woff $out/share/fonts/woff/
-    cp fonts/*.woff2 $out/share/fonts/woff2/
+    mv $out/fonts/*.eot $out/share/fonts/eot/
+    mv $out/fonts/*.ttf $out/share/fonts/truetype/
+    mv $out/fonts/*.woff $out/share/fonts/woff/
+    mv $out/fonts/*.woff2 $out/share/fonts/woff2/
+    shopt -s extglob dotglob
+    rm -rf $out/!(share)
+    shopt -u extglob dotglob
   '';
-  sha256 = "sha256-rfDb9meTF0Y0kiCQd11SgnntQnw34Ti/IXn35xaPO1M=";
+  sha256 = "sha256-l60LRXLwLh+7Ls3kMTJ5eDTVpVMcqtshMv/ehIk8fCk=";
 
   meta = with lib; {
-    description = "4600+ Material Design Icons from the Community";
+    description = "7000+ Material Design Icons from the Community";
     longDescription = ''
       Material Design Icons' growing icon collection allows designers and
       developers targeting various platforms to download icons in the format,
diff --git a/pkgs/data/icons/simp1e-cursors/default.nix b/pkgs/data/icons/simp1e-cursors/default.nix
new file mode 100644
index 000000000000..962f4ea2618a
--- /dev/null
+++ b/pkgs/data/icons/simp1e-cursors/default.nix
@@ -0,0 +1,42 @@
+{ lib, stdenvNoCC, fetchFromGitLab, python3, librsvg, xcursorgen }:
+
+stdenvNoCC.mkDerivation rec {
+  pname = "simp1e-cursors";
+  version = "20221103.2";
+
+  src = fetchFromGitLab {
+    owner = "cursors";
+    repo = "simp1e";
+    rev = version;
+    sha256 = "sha256-3DCF6TwxWwYK5pF2Ykr3OwF76H7J03vLNZch/XoZZZk=";
+    fetchSubmodules = true;
+  };
+
+  nativeBuildInputs = [
+    (python3.withPackages (ps: with ps; [ pillow ]))
+    librsvg
+    xcursorgen
+  ];
+
+  buildPhase = ''
+    runHook preBuild
+    patchShebangs ./build.sh ./cursor-generator
+    HOME=$TMP ./build.sh
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+    install -dm 755 $out/share/icons
+    cp -r built_themes/* $out/share/icons/
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "An aesthetic cursor theme for Linux desktops";
+    homepage = "https://gitlab.com/cursors/simp1e";
+    license = licenses.gpl3;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ natto1784 ];
+  };
+}
diff --git a/pkgs/data/misc/v2ray-geoip/default.nix b/pkgs/data/misc/v2ray-geoip/default.nix
index a92bfec486c1..bbd994d61363 100644
--- a/pkgs/data/misc/v2ray-geoip/default.nix
+++ b/pkgs/data/misc/v2ray-geoip/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "v2ray-geoip";
-  version = "202211240054";
+  version = "202212010055";
 
   src = fetchFromGitHub {
     owner = "v2fly";
     repo = "geoip";
-    rev = "1887d855ed4b4b92999d3afecf71f43358029369";
-    sha256 = "sha256-WozqLA/akUF7T0LyR/nQkTxuZPNCpYarOQG5zQwGAMk=";
+    rev = "350625ecfeec1300d541cc618fddb1922d5d2365";
+    sha256 = "sha256-EnqINoG6nB1m1K7mp0UBW3K2MDuaE7Z84wfCJBFwweU=";
   };
 
   installPhase = ''
diff --git a/pkgs/desktops/cinnamon/mint-artwork/default.nix b/pkgs/desktops/cinnamon/mint-artwork/default.nix
index fab1c48578fb..490c4fa068f3 100644
--- a/pkgs/desktops/cinnamon/mint-artwork/default.nix
+++ b/pkgs/desktops/cinnamon/mint-artwork/default.nix
@@ -7,14 +7,14 @@
 
 stdenv.mkDerivation rec {
   pname = "mint-artwork";
-  version = "1.7.2";
+  version = "1.7.3";
 
   src = fetchurl {
     urls = [
       "http://packages.linuxmint.com/pool/main/m/mint-artwork/mint-artwork_${version}.tar.xz"
-      "https://web.archive.org/web/20221203023403/http://packages.linuxmint.com/pool/main/m/mint-artwork/mint-artwork_${version}.tar.xz"
+      "https://web.archive.org/web/20221206154838/http://packages.linuxmint.com/pool/main/m/mint-artwork/mint-artwork_${version}.tar.xz"
     ];
-    hash = "sha256-I8gLWwwuXZkgc5zZ9QVkSarugcNWLFIz2mU1d4QqJRU=";
+    hash = "sha256-lusYlmTL71VTGSJFssuIZVu7xJMuZQ7wj2rMtO1lhZ8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/desktops/gnome/apps/gedit/default.nix b/pkgs/desktops/gnome/apps/gedit/default.nix
index 7ab30f8aafea..d7895df784b6 100644
--- a/pkgs/desktops/gnome/apps/gedit/default.nix
+++ b/pkgs/desktops/gnome/apps/gedit/default.nix
@@ -28,13 +28,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gedit";
-  version = "43.1";
+  version = "43.2";
 
   outputs = [ "out" "devdoc" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/gedit/${lib.versions.major version}/gedit-${version}.tar.xz";
-    sha256 = "mDg7Sv0/0eoYzcdP7G4SjneFgvOyP1NgGRQT//jw5qY=";
+    sha256 = "+VDS01xZS7bI28n1RAytd4jKCoaI4rB4Rvg96aTj/CU=";
   };
 
   patches = [
diff --git a/pkgs/desktops/gnome/apps/gnome-characters/default.nix b/pkgs/desktops/gnome/apps/gnome-characters/default.nix
index 9dc7d113571d..5617272acc33 100644
--- a/pkgs/desktops/gnome/apps/gnome-characters/default.nix
+++ b/pkgs/desktops/gnome/apps/gnome-characters/default.nix
@@ -23,11 +23,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-characters";
-  version = "43.0";
+  version = "43.1";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-characters/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "poW5y/k1Re05EWjEHJ2L+DeFq7+0iWdYJ+5zQkcbqsg=";
+    sha256 = "sj4V2VCXizY8gaRyYe4aO0fbPGaX7haf8hPuplcqeEE=";
   };
 
   patches = [
diff --git a/pkgs/desktops/gnome/apps/gnome-maps/default.nix b/pkgs/desktops/gnome/apps/gnome-maps/default.nix
index 99d4d27ef660..dea63dd14d0b 100644
--- a/pkgs/desktops/gnome/apps/gnome-maps/default.nix
+++ b/pkgs/desktops/gnome/apps/gnome-maps/default.nix
@@ -28,11 +28,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-maps";
-  version = "43.1";
+  version = "43.2";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-H3UaNb1YmteT9bFBNfKT5OxtSywwcz/sdgxofY8UMSY=";
+    sha256 = "sha256-wCIdJQvkXqNulxrmO/3pcaRhRclnscZZ6WxbBypxVR0=";
   };
 
   doCheck = true;
diff --git a/pkgs/desktops/gnome/core/evolution-data-server/default.nix b/pkgs/desktops/gnome/core/evolution-data-server/default.nix
index 726333d1f747..3b0a5caa59f6 100644
--- a/pkgs/desktops/gnome/core/evolution-data-server/default.nix
+++ b/pkgs/desktops/gnome/core/evolution-data-server/default.nix
@@ -49,13 +49,13 @@
 
 stdenv.mkDerivation rec {
   pname = "evolution-data-server";
-  version = "3.46.1";
+  version = "3.46.2";
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/evolution-data-server/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "xV5yz/QZC0LmPdbqvG3OSKGh95BAUx8a9tUcHvpKpus=";
+    sha256 = "+b1SAIt+U12BaSDPzscKDlViveKK9x+ZbiA/9qhuRuA=";
   };
 
   patches = [
diff --git a/pkgs/desktops/gnome/core/evolution-data-server/hardcode-gsettings.patch b/pkgs/desktops/gnome/core/evolution-data-server/hardcode-gsettings.patch
index 20a94cc70791..1774717affe4 100644
--- a/pkgs/desktops/gnome/core/evolution-data-server/hardcode-gsettings.patch
+++ b/pkgs/desktops/gnome/core/evolution-data-server/hardcode-gsettings.patch
@@ -298,10 +298,10 @@ index e61160c..b6553a4 100644
  		G_CALLBACK (mi_user_headers_settings_changed_cb), NULL);
  	G_UNLOCK (mi_user_headers);
 diff --git a/src/camel/providers/imapx/camel-imapx-server.c b/src/camel/providers/imapx/camel-imapx-server.c
-index e5645e2..96a1ce3 100644
+index 611d5c8..4790fca 100644
 --- a/src/camel/providers/imapx/camel-imapx-server.c
 +++ b/src/camel/providers/imapx/camel-imapx-server.c
-@@ -5573,7 +5573,18 @@ camel_imapx_server_skip_old_flags_update (CamelStore *store)
+@@ -5593,7 +5593,18 @@ camel_imapx_server_skip_old_flags_update (CamelStore *store)
  	if (!skip_old_flags_update) {
  		GSettings *eds_settings;
  
diff --git a/pkgs/desktops/gnome/core/gnome-initial-setup/default.nix b/pkgs/desktops/gnome/core/gnome-initial-setup/default.nix
index f1d63a78df16..0bfa9226e0d4 100644
--- a/pkgs/desktops/gnome/core/gnome-initial-setup/default.nix
+++ b/pkgs/desktops/gnome/core/gnome-initial-setup/default.nix
@@ -38,11 +38,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-initial-setup";
-  version = "43.1";
+  version = "43.2";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "gQTnBD75uY4rULKrOP2gX9BDf4xVVp+haDC3vle+DfY=";
+    sha256 = "I9eWOlTUlZRQTQ6s2FCWyvtfhvHnSljgQGdbbnmK5pg=";
   };
 
   patches = [
diff --git a/pkgs/desktops/gnome/core/gnome-remote-desktop/default.nix b/pkgs/desktops/gnome/core/gnome-remote-desktop/default.nix
index daf0e8f4fcdc..251d0af37f83 100644
--- a/pkgs/desktops/gnome/core/gnome-remote-desktop/default.nix
+++ b/pkgs/desktops/gnome/core/gnome-remote-desktop/default.nix
@@ -30,11 +30,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-remote-desktop";
-  version = "43.1";
+  version = "43.2";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    hash = "sha256-vYR8PKdzYJlTNEYs1GnkWhJHnxHAxI6WUCjtXLgHpbI=";
+    hash = "sha256-hKn9Zam62M73NIL9otIKzRIvC4Uhsd6GyUE4ibn6l3E=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/desktops/gnome/core/gnome-shell/default.nix b/pkgs/desktops/gnome/core/gnome-shell/default.nix
index b71b9c02d909..c13ed844c28d 100644
--- a/pkgs/desktops/gnome/core/gnome-shell/default.nix
+++ b/pkgs/desktops/gnome/core/gnome-shell/default.nix
@@ -68,13 +68,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "gnome-shell";
-  version = "43.1";
+  version = "43.2";
 
   outputs = [ "out" "devdoc" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-shell/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "3wREdl3vG9Cv7pYX0rWRm8ebTbhufnV6wOH3N0jsG9w=";
+    sha256 = "52/UvpNCQQ7p+9zday2Bxv8GDnyMxaDxyuanq6JdGGA=";
   };
 
   patches = [
diff --git a/pkgs/desktops/gnome/core/gnome-software/default.nix b/pkgs/desktops/gnome/core/gnome-software/default.nix
index e971d5ce9293..ee15653d1254 100644
--- a/pkgs/desktops/gnome/core/gnome-software/default.nix
+++ b/pkgs/desktops/gnome/core/gnome-software/default.nix
@@ -45,11 +45,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "gnome-software";
-  version = "43.1";
+  version = "43.2";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-software/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "wmdWie53vhHY/waq+kFsTK/EjTgRVTpz7PdkvWr/RHA=";
+    sha256 = "Iqp/CjF8dw9ouJfp5RKyy+2xgbaV/9sLZY2Zu9ZPNo0=";
   };
 
   patches = [
diff --git a/pkgs/desktops/gnome/core/gucharmap/default.nix b/pkgs/desktops/gnome/core/gucharmap/default.nix
index a98d9f2ceea7..c822605cf3e6 100644
--- a/pkgs/desktops/gnome/core/gucharmap/default.nix
+++ b/pkgs/desktops/gnome/core/gucharmap/default.nix
@@ -45,7 +45,7 @@ let
   };
 in stdenv.mkDerivation rec {
   pname = "gucharmap";
-  version = "15.0.1";
+  version = "15.0.2";
 
   outputs = [ "out" "lib" "dev" "devdoc" ];
 
@@ -54,7 +54,7 @@ in stdenv.mkDerivation rec {
     owner = "GNOME";
     repo = "gucharmap";
     rev = version;
-    sha256 = "sha256-uVXWgnNpPcky9N3FXkDu5oaqaEALECooFnf43Ed+zTY=";
+    sha256 = "sha256-QoHLMq3U/BvpCFKttxLo0qs2xmZ/pCqPjsgq/MMWNbo=";
   };
 
   nativeBuildInputs = [
@@ -90,7 +90,9 @@ in stdenv.mkDerivation rec {
   doCheck = true;
 
   postPatch = ''
-    patchShebangs data/meson_desktopfile.py gucharmap/gen-guch-unicode-tables.pl gucharmap/meson_compileschemas.py
+    patchShebangs \
+      data/meson_desktopfile.py \
+      gucharmap/gen-guch-unicode-tables.pl
   '';
 
   passthru = {
diff --git a/pkgs/desktops/gnome/core/mutter/default.nix b/pkgs/desktops/gnome/core/mutter/default.nix
index 3cba6b652cce..48320f7100b6 100644
--- a/pkgs/desktops/gnome/core/mutter/default.nix
+++ b/pkgs/desktops/gnome/core/mutter/default.nix
@@ -49,13 +49,13 @@
 
 let self = stdenv.mkDerivation rec {
   pname = "mutter";
-  version = "43.1";
+  version = "43.2";
 
   outputs = [ "out" "dev" "man" "devdoc" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/mutter/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "8vCLJSeDlIpezILwDp6TWmHrv4VkhEvdkniKtEqngmQ=";
+    sha256 = "/S63B63DM8wnevhoXlzzkTXhxNeYofnQXojkU9w+u4Q=";
   };
 
   patches = [
@@ -75,13 +75,6 @@ let self = stdenv.mkDerivation rec {
       sha256 = "NYoKCRh5o1Q15c11a79Hk5tGKq/jOa+e6GpgBjPEepo=";
       revert = true;
     })
-
-    # Backport edge resistance fix (should be part of 43.2)
-    # https://gitlab.gnome.org/GNOME/mutter/-/merge_requests/2687
-    (fetchpatch {
-      url = "https://gitlab.gnome.org/GNOME/mutter/-/commit/accf532a29ea9a1d70880dfaa1834050aa3ae7be.patch";
-      sha256 = "XAHcPGQFWfZujlqO/cvUryojPCMBBSxeIG06BesDQQw=";
-    })
   ];
 
   mesonFlags = [
diff --git a/pkgs/desktops/gnome/core/nautilus/default.nix b/pkgs/desktops/gnome/core/nautilus/default.nix
index 48cc47b5d8e2..2b277f42d491 100644
--- a/pkgs/desktops/gnome/core/nautilus/default.nix
+++ b/pkgs/desktops/gnome/core/nautilus/default.nix
@@ -1,6 +1,5 @@
 { lib
 , stdenv
-, fetchpatch
 , fetchurl
 , meson
 , ninja
@@ -39,27 +38,16 @@
 
 stdenv.mkDerivation rec {
   pname = "nautilus";
-  version = "43.0";
+  version = "43.1";
 
   outputs = [ "out" "dev" "devdoc" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "PPVPrAqKvuCQ4VVBf3sW9j6grAwmTvT1RXSvNFgBqRE=";
+    sha256 = "DaEAPAzaCKwFRqTBQ+06FpfjaCPGD6c/TS9Np3I7zK8=";
   };
 
   patches = [
-    # Switch to GTK 4 settings schema to avoid crash when GTK 3 did not manage to contaminate environment.
-    # https://gitlab.gnome.org/GNOME/nautilus/-/merge_requests/1013
-    (fetchpatch {
-      url = "https://gitlab.gnome.org/GNOME/nautilus/-/commit/96d542a0d84da4ad6915a7727642490a5c433d4a.patch";
-      sha256 = "BO/0ifRwSTDe7RV+DI3CPZg+UQezk0tbM+UidgoJRQM=";
-    })
-    (fetchpatch {
-      url = "https://gitlab.gnome.org/GNOME/nautilus/-/commit/52b4daf4396fd3b21755b3a0d1fbf85c3831c6b1.patch";
-      sha256 = "+8KCw2HZUi9UgOEUBNp4kbwqOI1qz6i0Q/wvzqTb8OA=";
-    })
-
     # Allow changing extension directory using environment variable.
     ./extension_dir.patch
 
diff --git a/pkgs/desktops/pantheon/apps/elementary-calculator/default.nix b/pkgs/desktops/pantheon/apps/elementary-calculator/default.nix
index 17b241e7a9cb..ac133fa54d3c 100644
--- a/pkgs/desktops/pantheon/apps/elementary-calculator/default.nix
+++ b/pkgs/desktops/pantheon/apps/elementary-calculator/default.nix
@@ -15,13 +15,13 @@
 
 stdenv.mkDerivation rec {
   pname = "elementary-calculator";
-  version = "2.0.0";
+  version = "2.0.1";
 
   src = fetchFromGitHub {
     owner = "elementary";
     repo = "calculator";
     rev = version;
-    sha256 = "sha256-NE7x5vSfwakwJJe2VGRFiYc7GCB1M6xU5945EC6Em34=";
+    sha256 = "sha256-7aKJDlpODIysrHtqtD5wfd+dULFpD+LfWsjzg3OAxkY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/desktops/pantheon/apps/elementary-camera/default.nix b/pkgs/desktops/pantheon/apps/elementary-camera/default.nix
index 9682f17a8162..b967341c468c 100644
--- a/pkgs/desktops/pantheon/apps/elementary-camera/default.nix
+++ b/pkgs/desktops/pantheon/apps/elementary-camera/default.nix
@@ -19,13 +19,13 @@
 
 stdenv.mkDerivation rec {
   pname = "elementary-camera";
-  version = "6.2.0";
+  version = "6.2.1";
 
   src = fetchFromGitHub {
     owner = "elementary";
     repo = "camera";
     rev = version;
-    sha256 = "sha256-866Iky0GKQv2yUJVNY1McgXGeup5WqONN3gvoOlilGU=";
+    sha256 = "sha256-ijzEMGXoH0gACem/3JaC/aOIaOQgP7Y7n48NgoDMKBk=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/desktops/pantheon/apps/elementary-feedback/default.nix b/pkgs/desktops/pantheon/apps/elementary-feedback/default.nix
index 6c6113e6be92..532159cd7060 100644
--- a/pkgs/desktops/pantheon/apps/elementary-feedback/default.nix
+++ b/pkgs/desktops/pantheon/apps/elementary-feedback/default.nix
@@ -18,13 +18,13 @@
 
 stdenv.mkDerivation rec {
   pname = "elementary-feedback";
-  version = "6.1.1";
+  version = "6.1.2";
 
   src = fetchFromGitHub {
     owner = "elementary";
     repo = "feedback";
     rev = version;
-    sha256 = "sha256-YLYHaFQAAeSt25xHF7xDJWhw+rbH9SpzoRoXaYP42jg=";
+    sha256 = "sha256-vZTc6n7SHtHTCmC/RsCibVHcj67ksbghDosHBZfOIHM=";
   };
 
   patches = [
diff --git a/pkgs/desktops/pantheon/apps/elementary-feedback/fix-metadata-path.patch b/pkgs/desktops/pantheon/apps/elementary-feedback/fix-metadata-path.patch
index 20676937e0a7..cc56b7e0d035 100644
--- a/pkgs/desktops/pantheon/apps/elementary-feedback/fix-metadata-path.patch
+++ b/pkgs/desktops/pantheon/apps/elementary-feedback/fix-metadata-path.patch
@@ -1,17 +1,20 @@
 diff --git a/src/MainWindow.vala b/src/MainWindow.vala
-index 6fee9d3..b0eb28c 100644
+index 14b0701..13638a5 100644
 --- a/src/MainWindow.vala
 +++ b/src/MainWindow.vala
-@@ -89,6 +89,12 @@ public class Feedback.MainWindow : Gtk.ApplicationWindow {
+@@ -82,6 +82,7 @@ public class Feedback.MainWindow : Gtk.ApplicationWindow {
+             AppStream.PoolFlags.LOAD_FLATPAK |
+             AppStream.PoolFlags.RESOLVE_ADDONS
+         );
++        appstream_pool.add_extra_data_location ("/run/current-system/sw/share/metainfo/", AppStream.FormatStyle.METAINFO);
+ #else
+         appstream_pool.clear_metadata_locations ();
+         // flatpak's appstream files exists only inside they sandbox
+@@ -89,6 +90,7 @@ public class Feedback.MainWindow : Gtk.ApplicationWindow {
+         foreach (var app in app_entries) {
+             appstream_pool.add_metadata_location (appdata_dir.printf (app));
+         }
++        appstream_pool.add_metadata_location ("/run/current-system/sw/share/metainfo/");
  #endif
-             }
  
-+#if HAS_APPSTREAM_0_15
-+            appstream_pool.add_extra_data_location ("/run/current-system/sw/share/metainfo/", AppStream.FormatStyle.METAINFO);
-+#else
-+            appstream_pool.add_metadata_location ("/run/current-system/sw/share/metainfo/");
-+#endif
-+
-             // flatpak's appstream files exists only inside they sandbox
-             unowned var appdata_dir = "/var/lib/flatpak/app/%s/current/active/files/share/appdata";
-             foreach (var app in app_entries) {
+         try {
diff --git a/pkgs/development/androidndk-pkgs/androidndk-pkgs.nix b/pkgs/development/androidndk-pkgs/androidndk-pkgs.nix
index 2d5619620417..5c04ca4a50ff 100644
--- a/pkgs/development/androidndk-pkgs/androidndk-pkgs.nix
+++ b/pkgs/development/androidndk-pkgs/androidndk-pkgs.nix
@@ -49,17 +49,18 @@ let
   # targetInfo.triple is what Google thinks the toolchain should be, this is a little
   # different from what we use. We make it four parts to conform with the existing
   # standard more properly.
-  targetConfig = lib.optionalString (stdenv.targetPlatform != stdenv.hostPlatform) (stdenv.targetPlatform.config);
+  targetPrefix = lib.optionalString (stdenv.targetPlatform != stdenv.hostPlatform) (stdenv.targetPlatform.config + "-");
 in
 
 rec {
   # Misc tools
   binaries = stdenv.mkDerivation {
-    pname = "${targetConfig}-ndk-toolchain";
+    pname = "${targetPrefix}ndk-toolchain";
     inherit (androidndk) version;
     nativeBuildInputs = [ makeWrapper autoPatchelfHook ];
     propagatedBuildInputs = [ androidndk ];
     passthru = {
+      inherit targetPrefix;
       isClang = true; # clang based cc, but bintools ld
     };
     dontUnpack = true;
@@ -91,23 +92,23 @@ rec {
       ln -s $out/toolchain/bin $out/bin
       ln -s $out/toolchain/${targetInfo.triple}/bin/* $out/bin/
       for f in $out/bin/${targetInfo.triple}-*; do
-        ln -s $f ''${f/${targetInfo.triple}-/${targetConfig}-}
+        ln -s $f ''${f/${targetInfo.triple}-/${targetPrefix}}
       done
       for f in $(find $out/toolchain -type d -name ${targetInfo.triple}); do
-        ln -s $f ''${f/${targetInfo.triple}/${targetConfig}}
+        ln -s $f ''${f/${targetInfo.triple}/${targetPrefix}}
       done
 
-      rm -f $out/bin/${targetConfig}-ld
-      ln -s $out/bin/lld $out/bin/${targetConfig}-ld
+      rm -f $out/bin/${targetPrefix}ld
+      ln -s $out/bin/lld $out/bin/${targetPrefix}ld
 
       (cd $out/bin;
         for tool in llvm-*; do
-          ln -sf $tool ${targetConfig}-$(echo $tool | sed 's/llvm-//')
+          ln -sf $tool ${targetPrefix}$(echo $tool | sed 's/llvm-//')
           ln -sf $tool $(echo $tool | sed 's/llvm-//')
         done)
 
       # handle last, as llvm-as is for llvm bytecode
-      ln -sf $out/bin/${targetInfo.triple}-as $out/bin/${targetConfig}-as
+      ln -sf $out/bin/${targetInfo.triple}-as $out/bin/${targetPrefix}as
       ln -sf $out/bin/${targetInfo.triple}-as $out/bin/as
 
       patchShebangs $out/bin
@@ -131,7 +132,7 @@ rec {
       # Android needs executables linked with -pie since version 5.0
       # Use -fPIC for compilation, and link with -pie if no -shared flag used in ldflags
       echo "-target ${targetInfo.triple} -fPIC" >> $out/nix-support/cc-cflags
-      echo "-z,noexecstack -z,relro -z,now" >> $out/nix-support/cc-ldflags
+      echo "-z,noexecstack -z,relro -z,now -z,muldefs" >> $out/nix-support/cc-ldflags
       echo 'if [[ ! " $@ " =~ " -shared " ]]; then NIX_LDFLAGS_${suffixSalt}+=" -pie"; fi' >> $out/nix-support/add-flags.sh
       echo "-Xclang -mnoexecstack" >> $out/nix-support/cc-cxxflags
       if [ ${targetInfo.triple} == arm-linux-androideabi ]; then
diff --git a/pkgs/development/compilers/chicken/4/chicken.nix b/pkgs/development/compilers/chicken/4/chicken.nix
index 47625a4d5de9..f33e594b7e25 100644
--- a/pkgs/development/compilers/chicken/4/chicken.nix
+++ b/pkgs/development/compilers/chicken/4/chicken.nix
@@ -31,6 +31,7 @@ stdenv.mkDerivation {
   ] ++ (lib.optionals stdenv.isDarwin [
     "XCODE_TOOL_PATH=${darwin.binutils.bintools}/bin"
     "C_COMPILER=$(CC)"
+    "POSTINSTALL_PROGRAM=install_name_tool"
   ]);
 
   # We need a bootstrap-chicken to regenerate the c-files after
diff --git a/pkgs/development/compilers/cmdstan/default.nix b/pkgs/development/compilers/cmdstan/default.nix
index 6aa30a584a8e..c82fc654b47a 100644
--- a/pkgs/development/compilers/cmdstan/default.nix
+++ b/pkgs/development/compilers/cmdstan/default.nix
@@ -1,14 +1,25 @@
 { lib, stdenv, fetchurl, python3, runtimeShell }:
 
-stdenv.mkDerivation rec {
-  pname = "cmdstan";
-  version = "2.31.0";
-
+let
+  # FIXME: remove conditional on future release
+  version = if stdenv.isx86_64 then "2.31.0" else "2.30.1";
   # includes stanc binaries needed to build cmdstand
-  src = fetchurl {
-    url = "https://github.com/stan-dev/cmdstan/releases/download/v${version}/cmdstan-${version}.tar.gz";
-    sha256 = "sha256-BMqRRWIC/Z7It2qkESJd9L3ycyxvA6NHiWbAvzVMzIQ=";
+  srcs = rec {
+    aarch64-linux = fetchurl {
+      url = "https://github.com/stan-dev/cmdstan/releases/download/v${version}/cmdstan-${version}-linux-arm64.tar.gz";
+      sha256 = "sha256-oj/7JHT4LZcRAHiA2KbM6pZbOe6C98Ff//cNsG9DIm8=";
+    };
+    x86_64-darwin = fetchurl {
+      url = "https://github.com/stan-dev/cmdstan/releases/download/v${version}/cmdstan-${version}.tar.gz";
+      sha256 = "sha256-BMqRRWIC/Z7It2qkESJd9L3ycyxvA6NHiWbAvzVMzIQ=";
+    };
+    x86_64-linux = x86_64-darwin;
   };
+  src = srcs.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
+in
+stdenv.mkDerivation rec {
+  pname = "cmdstan";
+  inherit version src;
 
   buildFlags = [ "build" ];
   enableParallelBuilding = true;
@@ -22,6 +33,9 @@ stdenv.mkDerivation rec {
     substituteInPlace stan/lib/stan_math/make/libraries \
       --replace "/usr/bin/env bash" "bash"
     patchShebangs .
+  '' + lib.optionalString stdenv.isAarch64 ''
+    sed -z -i "s/TEST(CommandStansummary, check_console_output).*TEST(CommandStansummary, check_csv_output)/TEST(CommandStansummary, check_csv_output)/" \
+      src/test/interface/stansummary_test.cpp
   '';
 
   checkPhase = ''
@@ -41,10 +55,9 @@ stdenv.mkDerivation rec {
   '';
 
   # Hack to ensure that patchelf --shrink-rpath get rids of a $TMPDIR reference.
-  preFixup = "rm -rf $(pwd)";
+  preFixup = "rm -rf stan";
 
   meta = {
-    broken = stdenv.isLinux && stdenv.isAarch64;
     description = "Command-line interface to Stan";
     longDescription = ''
       Stan is a probabilistic programming language implementing full Bayesian
@@ -54,6 +67,6 @@ stdenv.mkDerivation rec {
     '';
     homepage = "https://mc-stan.org/interfaces/cmdstan.html";
     license = lib.licenses.bsd3;
-    platforms = lib.platforms.all;
+    platforms = [ "aarch64-linux" "x86_64-darwin" "x86_64-linux" ];
   };
 }
diff --git a/pkgs/development/compilers/go/1.18.nix b/pkgs/development/compilers/go/1.18.nix
index 7f6e2ce6ace8..1bad4bba76e8 100644
--- a/pkgs/development/compilers/go/1.18.nix
+++ b/pkgs/development/compilers/go/1.18.nix
@@ -45,11 +45,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "go";
-  version = "1.18.8";
+  version = "1.18.9";
 
   src = fetchurl {
     url = "https://go.dev/dl/go${version}.src.tar.gz";
-    sha256 = "sha256-H3mAIwUBVHnnfYxkFTC8VOyZRlfVxSceAXLrcRg0ahI=";
+    sha256 = "sha256-++fwm5aso9tvrq8YDai7Yyho7ASXMeNV/2FpUZfA4+o=";
   };
 
   strictDeps = true;
diff --git a/pkgs/development/compilers/haxe/default.nix b/pkgs/development/compilers/haxe/default.nix
index 7a6c019c16da..58370c1a15a2 100644
--- a/pkgs/development/compilers/haxe/default.nix
+++ b/pkgs/development/compilers/haxe/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, coreutils, ocaml-ng, zlib, pcre, neko, mbedtls, Security }:
+{ lib, stdenv, fetchFromGitHub, coreutils, ocaml-ng, zlib, pcre, neko, mbedtls_2, Security }:
 
 let
   ocamlDependencies = version:
@@ -42,7 +42,7 @@ let
       inherit version;
 
       buildInputs = [ zlib pcre neko ]
-        ++ lib.optional (lib.versionAtLeast version "4.1") mbedtls
+        ++ lib.optional (lib.versionAtLeast version "4.1") mbedtls_2
         ++ lib.optional (lib.versionAtLeast version "4.1" && stdenv.isDarwin) Security
         ++ ocamlDependencies version;
 
diff --git a/pkgs/development/compilers/julia/1.8.nix b/pkgs/development/compilers/julia/1.8.nix
index 1c614103bdec..f975b39773d5 100644
--- a/pkgs/development/compilers/julia/1.8.nix
+++ b/pkgs/development/compilers/julia/1.8.nix
@@ -15,7 +15,7 @@
 , libgit2
 , curl
 , nghttp2
-, mbedtls
+, mbedtls_2
 , libssh2
 , gmp
 , mpfr
@@ -80,7 +80,7 @@ stdenv.mkDerivation rec {
     libgit2
     curl
     nghttp2
-    mbedtls
+    mbedtls_2
     libssh2
     gmp
     mpfr
diff --git a/pkgs/development/compilers/neko/default.nix b/pkgs/development/compilers/neko/default.nix
index 96bf06e41ea0..40e39d411d69 100644
--- a/pkgs/development/compilers/neko/default.nix
+++ b/pkgs/development/compilers/neko/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchFromGitHub, fetchpatch, boehmgc, zlib, sqlite, pcre, cmake, pkg-config
-, git, apacheHttpd, apr, aprutil, libmysqlclient, mbedtls, openssl, pkgs, gtk2, libpthreadstubs
+, git, apacheHttpd, apr, aprutil, libmysqlclient, mbedtls_2, openssl, pkgs, gtk2, libpthreadstubs
 }:
 
 stdenv.mkDerivation rec {
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ cmake pkg-config git ];
   buildInputs =
     [ boehmgc zlib sqlite pcre apacheHttpd apr aprutil
-      libmysqlclient mbedtls openssl libpthreadstubs ]
+      libmysqlclient mbedtls_2 openssl libpthreadstubs ]
       ++ lib.optional stdenv.isLinux gtk2
       ++ lib.optionals stdenv.isDarwin [ pkgs.darwin.apple_sdk.frameworks.Security
                                                 pkgs.darwin.apple_sdk.frameworks.Carbon];
diff --git a/pkgs/development/compilers/openjdk/11.nix b/pkgs/development/compilers/openjdk/11.nix
index 95abb373272c..820469ab8f15 100644
--- a/pkgs/development/compilers/openjdk/11.nix
+++ b/pkgs/development/compilers/openjdk/11.nix
@@ -4,8 +4,7 @@
 , libXcursor, libXrandr, fontconfig, openjdk11-bootstrap
 , setJavaClassPath
 , headless ? false
-# disabled by default since openjfx11 depends on python2 (EOL)
-, enableJavaFX ? false, openjfx
+, enableJavaFX ? openjfx.meta.available, openjfx
 , enableGnome2 ? true, gtk3, gnome_vfs, glib, GConf
 }:
 
diff --git a/pkgs/development/compilers/openjdk/12.nix b/pkgs/development/compilers/openjdk/12.nix
index 60100a5ecc16..a8de9fe43ffc 100644
--- a/pkgs/development/compilers/openjdk/12.nix
+++ b/pkgs/development/compilers/openjdk/12.nix
@@ -4,8 +4,7 @@
 , libXcursor, libXrandr, fontconfig, openjdk11, fetchpatch
 , setJavaClassPath
 , headless ? false
-# disabled by default since openjfx11 depends on python2 (EOL)
-, enableJavaFX ? false, openjfx
+, enableJavaFX ? openjfx.meta.available, openjfx
 , enableGnome2 ? true, gtk3, gnome_vfs, glib, GConf
 }:
 
diff --git a/pkgs/development/compilers/openjdk/13.nix b/pkgs/development/compilers/openjdk/13.nix
index 68a0a9fa7007..5b7e87b0ef3a 100644
--- a/pkgs/development/compilers/openjdk/13.nix
+++ b/pkgs/development/compilers/openjdk/13.nix
@@ -4,8 +4,7 @@
 , libXcursor, libXrandr, fontconfig, openjdk13-bootstrap, fetchpatch
 , setJavaClassPath
 , headless ? false
-# disabled by default since openjfx11 depends on python2 (EOL)
-, enableJavaFX ? false, openjfx
+, enableJavaFX ? openjfx.meta.available, openjfx
 , enableGnome2 ? true, gtk3, gnome_vfs, glib, GConf
 }:
 
diff --git a/pkgs/development/compilers/openjdk/14.nix b/pkgs/development/compilers/openjdk/14.nix
index 37c3a6a3de3a..1381b0995a76 100644
--- a/pkgs/development/compilers/openjdk/14.nix
+++ b/pkgs/development/compilers/openjdk/14.nix
@@ -4,8 +4,7 @@
 , libXcursor, libXrandr, fontconfig, openjdk14-bootstrap
 , setJavaClassPath
 , headless ? false
-# disabled by default since openjfx11 depends on python2 (EOL)
-, enableJavaFX ? false, openjfx
+, enableJavaFX ? openjfx.meta.available, openjfx
 , enableGnome2 ? true, gtk3, gnome_vfs, glib, GConf
 }:
 
diff --git a/pkgs/development/compilers/openjdk/openjfx/11.nix b/pkgs/development/compilers/openjdk/openjfx/11.nix
index f67c18289134..1bbb4e42dbc5 100644
--- a/pkgs/development/compilers/openjdk/openjfx/11.nix
+++ b/pkgs/development/compilers/openjdk/openjfx/11.nix
@@ -1,26 +1,36 @@
 { stdenv, lib, fetchurl, writeText, gradle_4, pkg-config, perl, cmake
-, gperf, gtk2, gtk3, libXtst, libXxf86vm, glib, alsa-lib, ffmpeg_4-headless, python2, ruby
+, gperf, gtk2, gtk3, libXtst, libXxf86vm, glib, alsa-lib, ffmpeg_4-headless, python3, ruby
 , openjdk11-bootstrap }:
 
 let
   major = "11";
-  update = ".0.3";
+  update = ".0.11";
   build = "1";
   repover = "${major}${update}+${build}";
   gradle_ = (gradle_4.override {
     java = openjdk11-bootstrap;
   });
 
+  NIX_CFLAGS_COMPILE = [
+    # avoids errors about deprecation of GTypeDebugFlags, GTimeVal, etc.
+    "-DGLIB_DISABLE_DEPRECATION_WARNINGS"
+    # glib-2.62 deprecations
+    # -fcommon: gstreamer workaround for -fno-common toolchains:
+    #   ld: gsttypefindelement.o:(.bss._gst_disable_registry_cache+0x0): multiple definition of
+    #     `_gst_disable_registry_cache'; gst.o:(.bss._gst_disable_registry_cache+0x0): first defined here
+    "-fcommon"
+  ];
+
   makePackage = args: stdenv.mkDerivation ({
     version = "${major}${update}-${build}";
 
     src = fetchurl {
-      url = "https://hg.openjdk.java.net/openjfx/${major}/rt/archive/${repover}.tar.gz";
-      sha256 = "1h7qsylr7rnwnbimqjyn3whszp9kv4h3gpicsrb3mradxc9yv194";
+      url = "https://hg.openjdk.java.net/openjfx/${major}-dev/rt/archive/${repover}.tar.gz";
+      sha256 = "sha256-mbEALUxuwbtlGeZ2Xsm3m3aNDdthLYWd6QHmdkAILxc=";
     };
 
     buildInputs = [ gtk2 gtk3 libXtst libXxf86vm glib alsa-lib ffmpeg_4-headless ];
-    nativeBuildInputs = [ gradle_ perl pkg-config cmake gperf python2 ruby ];
+    nativeBuildInputs = [ gradle_ perl pkg-config cmake gperf python3 ruby ];
 
     dontUseCmakeConfigure = true;
 
@@ -34,8 +44,7 @@ let
       JDK_HOME = ${openjdk11-bootstrap.home}
     '' + args.gradleProperties or "");
 
-    #avoids errors about deprecation of GTypeDebugFlags, GTimeVal, etc.
-    NIX_CFLAGS_COMPILE = [ "-DGLIB_DISABLE_DEPRECATION_WARNINGS" ];
+    inherit NIX_CFLAGS_COMPILE;
 
     buildPhase = ''
       runHook preBuild
@@ -67,8 +76,7 @@ let
     outputHashMode = "recursive";
     # Downloaded AWT jars differ by platform.
     outputHash = {
-      i686-linux = "0mjlyf6jvbis7nrm5d394sjv4hjw6k3753hr1nwdxk8skwc3ry08";
-      x86_64-linux = "0d4msxswdav1xsfkpr0qd3xgqkcbxzf47v1zdy5jmg5w4bs6a78a";
+      x86_64-linux = "sha256-syceJMUEknBDCHK8eGs6rUU3IQn+HnQfURfCrDxYPa8=";
     }.${stdenv.system} or (throw "Unsupported platform");
   };
 
@@ -91,11 +99,7 @@ in makePackage {
     cp -r build/modular-sdk $out
   '';
 
-  # glib-2.62 deprecations
-  # -fcommon: gstreamer workaround for -fno-common toolchains:
-  #   ld: gsttypefindelement.o:(.bss._gst_disable_registry_cache+0x0): multiple definition of
-  #     `_gst_disable_registry_cache'; gst.o:(.bss._gst_disable_registry_cache+0x0): first defined here
-  NIX_CFLAGS_COMPILE = "-DGLIB_DISABLE_DEPRECATION_WARNINGS -fcommon";
+  inherit NIX_CFLAGS_COMPILE;
 
   stripDebugList = [ "." ];
 
@@ -105,6 +109,9 @@ in makePackage {
       new_refs="$(patchelf --print-rpath "$lib" | sed -E 's,:?${openjdk11-bootstrap}[^:]*,,')"
       patchelf --set-rpath "$new_refs" "$lib"
     done
+
+    # Remove licenses, otherwise they may conflict with the ones included in the openjdk
+    rm -rf $out/modules_legal/*
   '';
 
   disallowedReferences = [ openjdk11-bootstrap ];
@@ -119,6 +126,6 @@ in makePackage {
     license = licenses.gpl2;
     description = "The next-generation Java client toolkit";
     maintainers = with maintainers; [ abbradar ];
-    platforms = [ "i686-linux" "x86_64-linux" ];
+    platforms = [ "x86_64-linux" ];
   };
 }
diff --git a/pkgs/development/compilers/openjdk/openjfx/15.nix b/pkgs/development/compilers/openjdk/openjfx/15.nix
index 4ffe8abd47b9..d2903c685a90 100644
--- a/pkgs/development/compilers/openjdk/openjfx/15.nix
+++ b/pkgs/development/compilers/openjdk/openjfx/15.nix
@@ -72,7 +72,6 @@ let
     # Downloaded AWT jars differ by platform.
     outputHash = {
       x86_64-linux = "0hmyr5nnjgwyw3fcwqf0crqg9lny27jfirycg3xmkzbcrwqd6qkw";
-      i686-linux = "0hx69p2z96p7jbyq4r20jykkb8gx6r8q2cj7m30pldlsw3650bqx";
     }.${stdenv.system} or (throw "Unsupported platform");
   };
 
@@ -121,6 +120,6 @@ in makePackage {
     license = licenses.gpl2;
     description = "The next-generation Java client toolkit";
     maintainers = with maintainers; [ abbradar ];
-    platforms = [ "i686-linux" "x86_64-linux" ];
+    platforms = [ "x86_64-linux" ];
   };
 }
diff --git a/pkgs/development/embedded/jtag-remote-server/default.nix b/pkgs/development/embedded/jtag-remote-server/default.nix
index bcfba506a002..4a2c9c3df3d2 100644
--- a/pkgs/development/embedded/jtag-remote-server/default.nix
+++ b/pkgs/development/embedded/jtag-remote-server/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "jtag-remote-server";
-  version = "unstable-2022-06-09";
+  version = "1.2";
 
   src = fetchFromGitHub {
     owner = "jiegec";
     repo = pname;
-    rev = "917d8d298423ba1aa6e75aa92e009b7f27f74a57";
-    hash = "sha256-Jy0OyRgn9SYpjP3HYWPvRirfxXk4/vMYvZuI3XpPtBw=";
+    rev = "v${version}";
+    hash = "sha256-qtgO0BO2hvWi/E2RzGTTuQynKbh7/OLeoLcm60dqro8=";
   };
 
   nativeBuildInputs = [ cmake pkg-config ];
diff --git a/pkgs/development/embedded/nmrpflash/default.nix b/pkgs/development/embedded/nmrpflash/default.nix
index a05170b1bd80..76c8902f590a 100644
--- a/pkgs/development/embedded/nmrpflash/default.nix
+++ b/pkgs/development/embedded/nmrpflash/default.nix
@@ -9,13 +9,13 @@
 }:
 stdenv.mkDerivation rec {
   pname = "nmrpflash";
-  version = "0.9.18.2";
+  version = "0.9.19";
 
   src = fetchFromGitHub {
     owner  = "jclehner";
     repo   = "nmrpflash";
     rev    = "v${version}";
-    sha256 = "sha256-hKE9FEBkbN39zBRSoy3Ntq/fziizskJXNBcwQZX9igE=";
+    sha256 = "sha256-bXxJiIbMk8JG0nbWOgINUAb8zaGBN3XUdA3JZev4Igs=";
   };
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/development/interpreters/hashlink/default.nix b/pkgs/development/interpreters/hashlink/default.nix
index 1af48cba55ab..e24742ac136e 100644
--- a/pkgs/development/interpreters/hashlink/default.nix
+++ b/pkgs/development/interpreters/hashlink/default.nix
@@ -7,7 +7,7 @@
 , libjpeg_turbo
 , libuv
 , libvorbis
-, mbedtls
+, mbedtls_2
 , openal
 , pcre
 , SDL2
@@ -37,7 +37,7 @@ stdenv.mkDerivation rec {
     libpng
     libuv
     libvorbis
-    mbedtls
+    mbedtls_2
     openal
     pcre
     SDL2
diff --git a/pkgs/development/interpreters/php/8.2.nix b/pkgs/development/interpreters/php/8.2.nix
index 6ea49852a40e..1ac48d7f0575 100644
--- a/pkgs/development/interpreters/php/8.2.nix
+++ b/pkgs/development/interpreters/php/8.2.nix
@@ -1,17 +1,9 @@
 { callPackage, lib, stdenv, fetchurl, ... }@_args:
 
 let
-  hash = "sha256-MSBENMUl+F5k9manZvYjRDY3YWsYToZSQU9hmhJ8Xvc=";
-
   base = callPackage ./generic.nix (_args // {
     version = "8.2.0";
-    phpAttrsOverrides = attrs: attrs // {
-      src = fetchurl {
-        url = "https://downloads.php.net/~pierrick/php-8.2.0RC7.tar.xz";
-        inherit hash;
-      };
-    };
-    inherit hash;
+    hash = "sha256-G/T8pmP5PZ4LSQm9bq4Fg6HOOD5/Bd8Sbyjycvof1Ro=";
   });
 
 in
diff --git a/pkgs/development/interpreters/python/cpython/default.nix b/pkgs/development/interpreters/python/cpython/default.nix
index fb6bffd2594f..5dca71f7eefd 100644
--- a/pkgs/development/interpreters/python/cpython/default.nix
+++ b/pkgs/development/interpreters/python/cpython/default.nix
@@ -486,7 +486,15 @@ in with passthru; stdenv.mkDerivation {
   enableParallelBuilding = true;
 
   meta = {
-    homepage = "http://python.org";
+    homepage = "https://www.python.org";
+    changelog = let
+      majorMinor = lib.versions.majorMinor version;
+      dashedVersion = lib.replaceStrings [ "." "a" ] [ "-" "-alpha-" ] version;
+    in
+      if sourceVersion.suffix == "" then
+        "https://docs.python.org/release/${version}/whatsnew/changelog.html"
+      else
+        "https://docs.python.org/${majorMinor}/whatsnew/changelog.html#python-${dashedVersion}";
     description = "A high-level dynamically-typed programming language";
     longDescription = ''
       Python is a remarkably powerful dynamic programming language that
diff --git a/pkgs/development/interpreters/python/default.nix b/pkgs/development/interpreters/python/default.nix
index 307b2521b75d..18282bc6d26c 100644
--- a/pkgs/development/interpreters/python/default.nix
+++ b/pkgs/development/interpreters/python/default.nix
@@ -156,10 +156,10 @@ in {
     sourceVersion = {
       major = "3";
       minor = "7";
-      patch = "15";
+      patch = "16";
       suffix = "";
     };
-    sha256 = "sha256-WRFHWgesK1PXRuiKBxavbStHNJQZGRNuoNM/ucdblxQ=";
+    sha256 = "sha256-gzjwwiIthH6QTJVTaRVdwb7u7YBujV7wSwDvR4cji/0=";
     inherit (darwin) configd;
     inherit passthruFun;
   };
@@ -169,10 +169,10 @@ in {
     sourceVersion = {
       major = "3";
       minor = "8";
-      patch = "15";
+      patch = "16";
       suffix = "";
     };
-    sha256 = "sha256-URT8eRiipeIOtarGlrMMNvQSxu8ksT9cnrngVpgtlVA=";
+    sha256 = "sha256-2F27N3QTJHPYCB3LFY80oQzK16kLlsflDqS7YfXORWI=";
     inherit (darwin) configd;
     inherit passthruFun;
   };
@@ -194,10 +194,10 @@ in {
     sourceVersion = {
       major = "3";
       minor = "11";
-      patch = "0";
+      patch = "1";
       suffix = "";
     };
-    sha256 = "sha256-pX3ILXc1hhe6ZbmEHO4eO0QfOGw3id3AZ27KB38pUcM=";
+    sha256 = "sha256-hYeRkvLP/VbLFsCSkFlJ6/Pl45S392RyNSljeQHftY8=";
     inherit (darwin) configd;
     inherit passthruFun;
   };
diff --git a/pkgs/development/interpreters/wasmtime/default.nix b/pkgs/development/interpreters/wasmtime/default.nix
index 4feefd2be02a..dc9e93b0450f 100644
--- a/pkgs/development/interpreters/wasmtime/default.nix
+++ b/pkgs/development/interpreters/wasmtime/default.nix
@@ -2,17 +2,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "wasmtime";
-  version = "3.0.0";
+  version = "3.0.1";
 
   src = fetchFromGitHub {
     owner = "bytecodealliance";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-DDgt7NjTNiqSq8+yC7bjlpKvWt36ybRCGByx07N4hC8=";
+    sha256 = "sha256-DJEX/BoiabAQKRKyXuefCoJouFKZ3sAnCQDsHmNC/t8=";
     fetchSubmodules = true;
   };
 
-  cargoSha256 = "sha256-xYOSMWPGLI6xnYhAZDM+MvD/zI0hsoqie86SUGn2EDI=";
+  cargoSha256 = "sha256-L+VozBK1RJGg2F51Aeau8jH1XM5IfR7qkhb7iXmQXE4=";
 
   cargoBuildFlags = [
     "--package wasmtime-cli"
diff --git a/pkgs/development/libraries/amtk/default.nix b/pkgs/development/libraries/amtk/default.nix
index 0dff90313538..74f83a30a502 100644
--- a/pkgs/development/libraries/amtk/default.nix
+++ b/pkgs/development/libraries/amtk/default.nix
@@ -15,13 +15,13 @@
 
 stdenv.mkDerivation rec {
   pname = "amtk";
-  version = "5.6.0";
+  version = "5.6.1";
 
   outputs = [ "out" "dev" "devdoc" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "89uHl0Qqm4UGKs0LPheskSWgtIfhQhbQmwOwiEGCDrk=";
+    sha256 = "1QEVuFyHKqwpaTS17nJqP6FWxvWtltJ+Dt0Kpa0XMig=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/arrow-cpp/default.nix b/pkgs/development/libraries/arrow-cpp/default.nix
index 2ce613c78534..81e5763aa3eb 100644
--- a/pkgs/development/libraries/arrow-cpp/default.nix
+++ b/pkgs/development/libraries/arrow-cpp/default.nix
@@ -205,7 +205,8 @@ stdenv.mkDerivation rec {
   ] ++ lib.optionals stdenv.isDarwin [
     "-DCMAKE_INSTALL_RPATH=@loader_path/../lib" # needed for tools executables
   ] ++ lib.optional (!stdenv.isx86_64) "-DARROW_USE_SIMD=OFF"
-  ++ lib.optional enableS3 "-DAWSSDK_CORE_HEADER_FILE=${aws-sdk-cpp}/include/aws/core/Aws.h";
+  ++ lib.optional enableS3 "-DAWSSDK_CORE_HEADER_FILE=${aws-sdk-cpp}/include/aws/core/Aws.h"
+  ++ lib.optionals enableGcs [ "-DCMAKE_CXX_STANDARD=17" ];
 
   doInstallCheck = true;
   ARROW_TEST_DATA = lib.optionalString doInstallCheck "${arrow-testing}/data";
diff --git a/pkgs/development/libraries/audio/suil/default.nix b/pkgs/development/libraries/audio/suil/default.nix
index ac10472e014e..3dc3bb5dacdc 100644
--- a/pkgs/development/libraries/audio/suil/default.nix
+++ b/pkgs/development/libraries/audio/suil/default.nix
@@ -1,16 +1,11 @@
 { stdenv, lib, fetchurl, gtk2, lv2, pkg-config, python3, serd, sord, sratom
 , wafHook
-, withQt4 ? true, qt4 ? null
-, withQt5 ? false, qt5 ? null }:
-
-# I haven't found an XOR operator in nix...
-assert withQt4 || withQt5;
-assert !(withQt4 && withQt5);
+, withQt5 ? true, qt5 ? null
+}:
 
 stdenv.mkDerivation rec {
   pname = "suil";
   version = "0.10.6";
-  name = "${pname}-qt${if withQt4 then "4" else "5"}-${version}";
 
   src = fetchurl {
     url = "https://download.drobilla.net/${pname}-${version}.tar.bz2";
@@ -19,8 +14,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ pkg-config wafHook python3 ];
   buildInputs = [ gtk2 lv2 serd sord sratom ]
-    ++ (lib.optionals withQt4 [ qt4 ])
-    ++ (lib.optionals withQt5 (with qt5; [ qtbase qttools ]));
+    ++ lib.optionals withQt5 (with qt5; [ qtbase qttools ]);
 
   dontWrapQtApps = true;
 
diff --git a/pkgs/development/libraries/aws-c-s3/default.nix b/pkgs/development/libraries/aws-c-s3/default.nix
index 0692c5ef7abb..19ad8053c19f 100644
--- a/pkgs/development/libraries/aws-c-s3/default.nix
+++ b/pkgs/development/libraries/aws-c-s3/default.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation rec {
   pname = "aws-c-s3";
-  version = "0.1.51";
+  version = "0.2.0";
 
   src = fetchFromGitHub {
     owner = "awslabs";
     repo = "aws-c-s3";
     rev = "v${version}";
-    sha256 = "sha256-10SDOl0XoALdSxJWHDLDkvX7rArUQKXjjXfAECFy/Vw=";
+    sha256 = "sha256-tFweXB610Ua8+x05rg+rOqh9QPhXjpvvzGf8EVVIHks=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/bctoolbox/default.nix b/pkgs/development/libraries/bctoolbox/default.nix
index 6c1c2cdefb9c..2bc457cac18e 100644
--- a/pkgs/development/libraries/bctoolbox/default.nix
+++ b/pkgs/development/libraries/bctoolbox/default.nix
@@ -2,7 +2,7 @@
 , cmake
 , bc-decaf
 , fetchFromGitLab
-, mbedtls
+, mbedtls_2
 , lib
 , stdenv
 }:
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
     # Vendored by BC
     bc-decaf
 
-    mbedtls
+    mbedtls_2
   ];
 
   src = fetchFromGitLab {
diff --git a/pkgs/development/libraries/belle-sip/default.nix b/pkgs/development/libraries/belle-sip/default.nix
index 22817feadeda..187264caed19 100644
--- a/pkgs/development/libraries/belle-sip/default.nix
+++ b/pkgs/development/libraries/belle-sip/default.nix
@@ -4,7 +4,7 @@
 , fetchFromGitLab
 , lib
 , libantlr3c
-, mbedtls
+, mbedtls_2
 , stdenv
 , zlib
 }:
@@ -36,7 +36,7 @@ stdenv.mkDerivation rec {
     "-Wno-error=stringop-overflow"
   ];
 
-  propagatedBuildInputs = [ libantlr3c mbedtls bctoolbox belr ];
+  propagatedBuildInputs = [ libantlr3c mbedtls_2 bctoolbox belr ];
 
   meta = with lib; {
     homepage = "https://linphone.org/technical-corner/belle-sip";
diff --git a/pkgs/development/libraries/fancypp/default.nix b/pkgs/development/libraries/fancypp/default.nix
new file mode 100644
index 000000000000..f93ab77c63de
--- /dev/null
+++ b/pkgs/development/libraries/fancypp/default.nix
@@ -0,0 +1,31 @@
+{ lib
+, stdenvNoCC
+, fetchFromGitHub
+}:
+
+stdenvNoCC.mkDerivation rec {
+  pname = "fancypp";
+  version = "unstable-2021-04-08";
+
+  src = fetchFromGitHub {
+    owner = "Curve";
+    repo = "fancypp";
+    rev = "ede7f712a08f7c66ff4a5590ad94a477c48850a5";
+    sha256 = "sha256-E2JsQnvrqrZFYo+xBJr7xDCoPnRQftqUjjBpZzFvIic=";
+  };
+
+  # Header-only library.
+  dontBuild = true;
+
+  installPhase = ''
+    mkdir "$out"
+    cp -r include "$out"
+  '';
+
+  meta = with lib; {
+    description = "Tiny C++ Library for terminal colors and more!";
+    homepage = "https://github.com/Curve/fancypp";
+    maintainers = with maintainers; [ aidalgol ];
+    license = licenses.mit;
+  };
+}
diff --git a/pkgs/development/libraries/fox/clang.patch b/pkgs/development/libraries/fox/clang.patch
deleted file mode 100644
index 0ca2ebf0d8da..000000000000
--- a/pkgs/development/libraries/fox/clang.patch
+++ /dev/null
@@ -1,13 +0,0 @@
-diff --git a/src/FXReactor.cpp b/src/FXReactor.cpp
-index 1ecdb45..9058a30 100644
---- a/src/FXReactor.cpp
-+++ b/src/FXReactor.cpp
-@@ -452,7 +452,7 @@ FXint FXReactor::processActiveHandles(FXTime block,FXuint flags){
-     }
- 
-   // Normal case
--  if(0<=hand){
-+  if(0==hand){
- 
-     // Any handles active?
-     if(0<nhand){
diff --git a/pkgs/development/libraries/fox/default.nix b/pkgs/development/libraries/fox/default.nix
index 2eda944048ab..49526b99c53b 100644
--- a/pkgs/development/libraries/fox/default.nix
+++ b/pkgs/development/libraries/fox/default.nix
@@ -1,30 +1,31 @@
 { lib
 , stdenv
 , fetchurl
+, fetchpatch
 , libpng
 , libjpeg
 , libtiff
 , zlib
 , bzip2
+, libGL
+, libGLU
 , libXcursor
 , libXext
 , libXrandr
 , libXft
-, CoreServices ? null
+, CoreServices
 }:
 
 stdenv.mkDerivation rec {
   pname = "fox";
-  version = "1.7.9";
+  version = "1.7.81";
 
   src = fetchurl {
-    url = "ftp://ftp.fox-toolkit.org/pub/${pname}-${version}.tar.gz";
-    sha256 = "1jb9368xsin3ppdf6979n5s7in3s9klbxqbwcp0z8misjixl7nzg";
+    url = "http://fox-toolkit.org/ftp/${pname}-${version}.tar.gz";
+    sha256 = "sha256-bu+IEqNkv9OAf96dPYre3CP759pjalVIbYyc3QSQW2w=";
   };
 
-  patches = [ ./clang.patch ];
-
-  buildInputs = [ libpng libjpeg libtiff zlib bzip2 libXcursor libXext libXrandr libXft ]
+  buildInputs = [ libpng libjpeg libtiff zlib bzip2 libGL libGLU libXcursor libXext libXrandr libXft ]
     ++ lib.optional stdenv.isDarwin CoreServices;
 
   doCheck = true;
@@ -42,9 +43,8 @@ stdenv.mkDerivation rec {
       Current aims are to make FOX completely platform independent, and thus programs written against the FOX library will be only a compile away from running on a variety of platforms.
     '';
     homepage = "http://fox-toolkit.org";
-    license = licenses.lgpl3;
+    license = licenses.lgpl3Plus;
     maintainers = [];
-    broken = stdenv.isDarwin && stdenv.isAarch64;
     platforms = platforms.all;
   };
 }
diff --git a/pkgs/development/libraries/google-cloud-cpp/default.nix b/pkgs/development/libraries/google-cloud-cpp/default.nix
index fb2929a72f16..3ffaedb6b729 100644
--- a/pkgs/development/libraries/google-cloud-cpp/default.nix
+++ b/pkgs/development/libraries/google-cloud-cpp/default.nix
@@ -18,37 +18,31 @@
 , staticOnly ? stdenv.hostPlatform.isStatic
 }:
 let
-  googleapisRev = "d4f3468ef85278428005ed555b3a85db91551ee6";
+  googleapisRev = "13d5b3f3f9412f38427c8ad48068f04ad1ee9808";
   googleapis = fetchFromGitHub {
+    name = "googleapis-src";
     owner = "googleapis";
     repo = "googleapis";
     rev = googleapisRev;
-    hash = "sha256-sIQVFQhE3Ae6ia45apzdgtwzglMM4hFZ8efNAhMO5ZY=";
+    hash = "sha256-SiU7N1EQ/7LWhUwgf4c0CBfUzNGiLe4sSbbJmJF3sao=";
   };
   excludedTests = builtins.fromTOML (builtins.readFile ./skipped_tests.toml);
 in
 stdenv.mkDerivation rec {
   pname = "google-cloud-cpp";
-  version = "1.38.0";
+  version = "2.4.0";
 
   src = fetchFromGitHub {
     owner = "googleapis";
     repo = "google-cloud-cpp";
     rev = "v${version}";
-    sha256 = "sha256-kobOkohWIDTQaaihhoh/25tZUNv+CjKFwj2xQqO52bA=";
+    sha256 = "sha256-o8aURM8fvxn0FZjuqJGclq9Brss8LOFZzD0FV2j/lUc=";
   };
 
   postPatch = ''
     substituteInPlace external/googleapis/CMakeLists.txt \
-      --replace "https://github.com/googleapis/googleapis/archive/\''${GOOGLE_CLOUD_CPP_GOOGLEAPIS_COMMIT_SHA}.tar.gz" "file://${googleapis}"
-
-    # https://github.com/googleapis/google-cloud-cpp/issues/8992
-    for file in external/googleapis/config.pc.in google/cloud/{,*/}config.pc.in; do
-      substituteInPlace "$file" \
-        --replace '$'{prefix}/@CMAKE_INSTALL_LIBDIR@ @CMAKE_INSTALL_FULL_LIBDIR@ \
-        --replace '$'{prefix}/@CMAKE_INSTALL_INCLUDEDIR@ @CMAKE_INSTALL_FULL_INCLUDEDIR@ \
-        --replace '$'{prefix}/@CMAKE_INSTALL_BINDIR@ @CMAKE_INSTALL_FULL_BINDIR@
-    done
+      --replace "https://github.com/googleapis/googleapis/archive/\''${_GOOGLE_CLOUD_CPP_GOOGLEAPIS_COMMIT_SHA}.tar.gz" "file://${googleapis}"
+    sed -i '/https:\/\/storage.googleapis.com\/cloud-cpp-community-archive\/com_google_googleapis/d' external/googleapis/CMakeLists.txt
   '';
 
   nativeBuildInputs = [
@@ -123,6 +117,7 @@ stdenv.mkDerivation rec {
     # this adds a good chunk of time to the build
     "-DBUILD_TESTING:BOOL=ON"
     "-DGOOGLE_CLOUD_CPP_ENABLE_EXAMPLES:BOOL=OFF"
+    "-DCMAKE_CXX_STANDARD=17"
   ] ++ lib.optionals (apis != [ "*" ]) [
     "-DGOOGLE_CLOUD_CPP_ENABLE=${lib.concatStringsSep ";" apis}"
   ];
diff --git a/pkgs/development/libraries/google-cloud-cpp/skipped_tests.toml b/pkgs/development/libraries/google-cloud-cpp/skipped_tests.toml
index 8cbe766862b2..71529bfb4550 100644
--- a/pkgs/development/libraries/google-cloud-cpp/skipped_tests.toml
+++ b/pkgs/development/libraries/google-cloud-cpp/skipped_tests.toml
@@ -13,6 +13,7 @@ whole = [
   "bigtable_read_sync_vs_async_benchmark",
   "bigtable_scan_throughput_benchmark",
   "bigtable_table_sample_rows_integration_test",
+  "common_grpc_utils_internal_grpc_impersonate_service_account_integration_test",
   "iam_iam_credentials_integration_test",
   "iam_iam_integration_test",
   "logging_quickstart",
@@ -48,6 +49,7 @@ whole = [
   "storage_curl_request_integration_test",
   "storage_curl_resumable_upload_session_integration_test",
   "storage_curl_sign_blob_integration_test",
+  "storage_decompressive_transcoding_integration_test",
   "storage_grpc_integration_test",
   "storage_key_file_integration_test",
   "storage_minimal_iam_credentials_rest_integration_test",
@@ -84,13 +86,13 @@ whole = [
   "storage_throughput_experiment_test",
   "storage_tracing_integration_test",
   "storage_unified_credentials_integration_test",
-  "common_grpc_utils_internal_grpc_impersonate_service_account_integration_test"
 ]
 cases = [
   "BackupExtraIntegrationTest.CreateBackupWithExpiredVersionTime",
   "BackupExtraIntegrationTest.BackupWithExpiredVersionTime",
   "BackupExtraIntegrationTest.BackupWithFutureVersionTime",
   "BackupExtraIntegrationTest.CreateBackupWithFutureVersionTime",
+  "BlockingPublisherIntegrationTest.Basic",
   "DatabaseAdminClientTest.CreateWithEncryptionKey",
   "DatabaseAdminClientTest.CreateWithNonexistentEncryptionKey",
   "DatabaseAdminClientTest.DatabaseBasicCRUD",
@@ -98,12 +100,16 @@ cases = [
   "DatabaseAdminClientTest.VersionRetentionPeriodCreateFailure",
   "DatabaseAdminClientTest.VersionRetentionPeriodUpdate",
   "DatabaseAdminClientTest.VersionRetentionPeriodUpdateFailure",
+  "ErrorParsingIntegrationTest.FailureContainsErrorInfo",
+  "GrpcServiceAccountIntegrationTest.GetServiceAccount",
+  "GrpcBucketMetadataIntegrationTest.ObjectMetadataCRUD",
   "InstanceAdminClientTest.InstanceConfig",
   "InstanceAdminClientTest.InstanceIam",
   "InstanceAdminClientTest.InstanceReadOperations",
   "LoggingIntegrationTest.ListMonitoredResourceDescriptors",
   "LoggingIntegrationTest.WriteLogEntries",
   "ObjectFileMultiThreadedTest.Download",
+  "ObjectReadLargeIntegrationTest.LimitedMemoryGrowth",
   "SubscriberIntegrationTest.FireAndForget",
   "SubscriberIntegrationTest.PublishOrdered",
   "SubscriberIntegrationTest.PublishPullAck",
diff --git a/pkgs/development/libraries/grpc/default.nix b/pkgs/development/libraries/grpc/default.nix
index 56f3cf0e7abd..744f9652378f 100644
--- a/pkgs/development/libraries/grpc/default.nix
+++ b/pkgs/development/libraries/grpc/default.nix
@@ -54,22 +54,26 @@ stdenv.mkDerivation rec {
   buildInputs = [ openssl protobuf ]
     ++ lib.optionals stdenv.isLinux [ libnsl ];
 
-  cmakeFlags = [
-    "-DgRPC_ZLIB_PROVIDER=package"
-    "-DgRPC_CARES_PROVIDER=package"
-    "-DgRPC_RE2_PROVIDER=package"
-    "-DgRPC_SSL_PROVIDER=package"
-    "-DgRPC_PROTOBUF_PROVIDER=package"
-    "-DgRPC_ABSL_PROVIDER=package"
-    "-DBUILD_SHARED_LIBS=ON"
-  ] ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
-    "-D_gRPC_PROTOBUF_PROTOC_EXECUTABLE=${buildPackages.protobuf}/bin/protoc"
-  ] ++ lib.optionals ((stdenv.hostPlatform.useLLVM or false) && lib.versionOlder stdenv.cc.cc.version "11.0") [
-    # Needs to be compiled with -std=c++11 for clang < 11. Interestingly this is
-    # only an issue with the useLLVM stdenv, not the darwin stdenv…
-    # https://github.com/grpc/grpc/issues/26473#issuecomment-860885484
-    "-DCMAKE_CXX_STANDARD=11"
-  ];
+  cmakeFlags =
+    let
+      # Needs to be compiled with -std=c++11 for clang < 11. Interestingly this is
+      # only an issue with the useLLVM stdenv, not the darwin stdenv…
+      # https://github.com/grpc/grpc/issues/26473#issuecomment-860885484
+      useLLVMAndOldCC = (stdenv.hostPlatform.useLLVM or false) && lib.versionOlder stdenv.cc.cc.version "11.0";
+      cxxStandard = if useLLVMAndOldCC then "11" else "17";
+    in
+    [
+      "-DgRPC_ZLIB_PROVIDER=package"
+      "-DgRPC_CARES_PROVIDER=package"
+      "-DgRPC_RE2_PROVIDER=package"
+      "-DgRPC_SSL_PROVIDER=package"
+      "-DgRPC_PROTOBUF_PROVIDER=package"
+      "-DgRPC_ABSL_PROVIDER=package"
+      "-DBUILD_SHARED_LIBS=ON"
+      "-DCMAKE_CXX_STANDARD=${cxxStandard}"
+    ] ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
+      "-D_gRPC_PROTOBUF_PROTOC_EXECUTABLE=${buildPackages.protobuf}/bin/protoc"
+    ];
 
   # CMake creates a build directory by default, this conflicts with the
   # basel BUILD file on case-insensitive filesystems.
diff --git a/pkgs/development/libraries/gssdp/1.6.nix b/pkgs/development/libraries/gssdp/1.6.nix
index 19c46d4776c4..80b518ab27b8 100644
--- a/pkgs/development/libraries/gssdp/1.6.nix
+++ b/pkgs/development/libraries/gssdp/1.6.nix
@@ -6,6 +6,7 @@
 , pkg-config
 , gobject-introspection
 , vala
+, pandoc
 , gi-docgen
 , python3
 , libsoup_3
@@ -16,14 +17,14 @@
 
 stdenv.mkDerivation rec {
   pname = "gssdp";
-  version = "1.6.1";
+  version = "1.6.2";
 
   outputs = [ "out" "dev" ]
     ++ lib.optionals (stdenv.buildPlatform == stdenv.hostPlatform) [ "devdoc" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/gssdp/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "0r4KbiWREJpuQlhRFhpKU7xUtPBqAhTHlwVmMpvVYzA=";
+    sha256 = "QQs3be7O2YNrV/SI+ABS/koU+J4HWxzszyjlH0kPn7k=";
   };
 
   nativeBuildInputs = [
@@ -32,6 +33,7 @@ stdenv.mkDerivation rec {
     pkg-config
     gobject-introspection
     vala
+    pandoc
     gi-docgen
     python3
   ];
diff --git a/pkgs/development/libraries/gtk-frdp/default.nix b/pkgs/development/libraries/gtk-frdp/default.nix
index a76805d8d1fb..acd2cae6abfc 100644
--- a/pkgs/development/libraries/gtk-frdp/default.nix
+++ b/pkgs/development/libraries/gtk-frdp/default.nix
@@ -44,7 +44,7 @@ stdenv.mkDerivation rec {
     };
   };
 
-  NIX_CFLAGS_COMPILE = lib.optional stdenv.isDarwin [
+  NIX_CFLAGS_COMPILE = lib.optionals stdenv.isDarwin [
     "-DTARGET_OS_IPHONE=0"
     "-DTARGET_OS_WATCH=0"
   ];
diff --git a/pkgs/development/libraries/gupnp/1.6.nix b/pkgs/development/libraries/gupnp/1.6.nix
index 0e4afedc369f..fc9fc1da08b9 100644
--- a/pkgs/development/libraries/gupnp/1.6.nix
+++ b/pkgs/development/libraries/gupnp/1.6.nix
@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gupnp";
-  version = "1.6.1";
+  version = "1.6.2";
 
   outputs = [ "out" "dev" "devdoc" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/gupnp/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-hTgUUtKvlbjhSyTUqYljPQ2DzYjRJy8nzLJBbMyDbUc=";
+    sha256 = "sha256-6QBZzIOAXa2T6DvkflOVjwdHHMRk+UQ5HntcgqpRoY8=";
   };
 
   depsBuildBuild = [
diff --git a/pkgs/development/libraries/httplib/default.nix b/pkgs/development/libraries/httplib/default.nix
new file mode 100644
index 000000000000..19618613ee17
--- /dev/null
+++ b/pkgs/development/libraries/httplib/default.nix
@@ -0,0 +1,31 @@
+{ lib
+, stdenvNoCC
+, fetchFromGitHub
+}:
+
+stdenvNoCC.mkDerivation rec {
+  pname = "httplib";
+  version = "0.11.1";
+
+  src = fetchFromGitHub {
+    owner = "yhirose";
+    repo = "cpp-httplib";
+    rev = "v${version}";
+    sha256 = "sha256-rsElqtoRz/sOXpAsfSJbMlwIKdaGJkSZfKHzB/wMhY8=";
+  };
+
+  # Header-only library.
+  dontBuild = true;
+
+  installPhase = ''
+    mkdir -p "$out/include"
+    cp -r httplib.h "$out/include"
+  '';
+
+  meta = with lib; {
+    description = "A C++ header-only HTTP/HTTPS server and client library";
+    homepage = "https://github.com/yhirose/cpp-httplib";
+    maintainers = with maintainers; [ aidalgol ];
+    license = licenses.mit;
+  };
+}
diff --git a/pkgs/development/libraries/liblouis/default.nix b/pkgs/development/libraries/liblouis/default.nix
index 33ec04734f5b..da724aaac9b4 100644
--- a/pkgs/development/libraries/liblouis/default.nix
+++ b/pkgs/development/libraries/liblouis/default.nix
@@ -13,7 +13,7 @@
 
 stdenv.mkDerivation rec {
   pname = "liblouis";
-  version = "3.23.0";
+  version = "3.24.0";
 
   outputs = [ "out" "dev" "info" "doc" ]
     # configure: WARNING: cannot generate manual pages while cross compiling
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
     owner = "liblouis";
     repo = "liblouis";
     rev = "v${version}";
-    sha256 = "sha256-jXNhHzydWaMhFbEKoFHyZ77GCvAqxyT3P0xIAgFlTzY=";
+    sha256 = "sha256-QSrCQhP3t+WPyBQPLJbZEaDCjXD8Lo6IAGKHsbL2S1o=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/libnfs/default.nix b/pkgs/development/libraries/libnfs/default.nix
index cbfc06bc81c5..d9beee7933fa 100644
--- a/pkgs/development/libraries/libnfs/default.nix
+++ b/pkgs/development/libraries/libnfs/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, autoreconfHook }:
+{ lib, stdenv, fetchFromGitHub, fetchpatch, autoreconfHook }:
 
 stdenv.mkDerivation rec {
   pname = "libnfs";
@@ -13,7 +13,22 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ autoreconfHook ];
 
-  NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang "-Wno-error=tautological-compare";
+  patches = [
+    # Fixes 100% CPU usage in multi-threaded mode
+    (fetchpatch {
+      url = "https://github.com/sahlberg/libnfs/commit/34d6fe37e986da5b0ced86cd028a88e482537d5a.patch";
+      sha256 = "sha256-i7mi+TVdkLb4MztT5Ic/Q8XBIWk9lo8v5bNjHOr6LaI=";
+    })
+    # Fixes deprecation warnings on macOS
+    (fetchpatch {
+      url = "https://github.com/sahlberg/libnfs/commit/f6631c54a7b0385988f11357bf96728a6d7345b9.patch";
+      sha256 = "sha256-xLRZ9J1vr04n//gNv9ljUBt5LHUGBRRVIXJCMlFbHFI=";
+    })
+  ];
+
+  configureFlags = [
+    "--enable-pthread"
+  ];
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/development/libraries/libplctag/default.nix b/pkgs/development/libraries/libplctag/default.nix
index df209993bb10..de71d021d015 100644
--- a/pkgs/development/libraries/libplctag/default.nix
+++ b/pkgs/development/libraries/libplctag/default.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libplctag";
-  version = "2.5.4";
+  version = "2.5.5";
 
   src = fetchFromGitHub {
     owner = "libplctag";
     repo = "libplctag";
     rev = "v${version}";
-    sha256 = "sha256-RQlT+G0aSHHETyJaWKhGFdBLSv0qoZsavggv/ubeSQA=";
+    sha256 = "sha256-eWtQaYUWZNQYQOUXnbUfjrtpoO6CnNJ8WjlowA49sG0=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/libredwg/default.nix b/pkgs/development/libraries/libredwg/default.nix
index ad7a7e5473e9..a3b43e9377e1 100644
--- a/pkgs/development/libraries/libredwg/default.nix
+++ b/pkgs/development/libraries/libredwg/default.nix
@@ -1,21 +1,46 @@
-{ lib, stdenv, fetchFromGitHub, autoreconfHook, pkg-config, texinfo, pcre2
-, enablePython ? false, python ? null, swig, libxml2, ncurses
+{ lib
+, stdenv
+, fetchFromGitHub
+, autoreconfHook
+, writeShellScript
+, pkg-config
+, texinfo
+, pcre2
+, swig
+, libxml2
+, ncurses
+, enablePython ? false
+, python ? null
 }:
 let
   isPython3 = enablePython && python.pythonAtLeast "3";
 in
 stdenv.mkDerivation rec {
   pname = "libredwg";
-  version = "0.12.4";
+  version = "0.12.5";
 
   src = fetchFromGitHub {
     owner = "LibreDWG";
     repo = pname;
     rev = version;
-    sha256 = "sha256-CZZ5/uCls2tY3PKmD+hBBvp7d7KX8nZuCPf03sa4iXc=";
+    sha256 = "sha256-s9aiOKSM7+3LJNE+jRrEMcL1QKRWrlTKbwO7oL9VhuE=";
     fetchSubmodules = true;
   };
 
+  postPatch = let
+    printVersion = writeShellScript "print-version" ''
+      echo ${lib.escapeShellArg version}
+    '';
+  in ''
+    # avoid git dependency
+    cp ${printVersion} build-aux/git-version-gen
+  '';
+
+  preConfigure = lib.optionalString (stdenv.isDarwin && enablePython) ''
+    # prevent configure picking up stack_size from distutils.sysconfig
+    export PYTHON_EXTRA_LDFLAGS=" "
+  '';
+
   nativeBuildInputs = [ autoreconfHook pkg-config texinfo ]
     ++ lib.optional enablePython swig;
 
diff --git a/pkgs/development/libraries/libshumate/default.nix b/pkgs/development/libraries/libshumate/default.nix
index ef56f936dccf..2d7e6c5fb7a2 100644
--- a/pkgs/development/libraries/libshumate/default.nix
+++ b/pkgs/development/libraries/libshumate/default.nix
@@ -18,7 +18,7 @@
 
 stdenv.mkDerivation rec {
   pname = "libshumate";
-  version = "1.0.2";
+  version = "1.0.3";
 
   outputs = [ "out" "dev" "devdoc" ];
   outputBin = "devdoc"; # demo app
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
     owner = "GNOME";
     repo = "libshumate";
     rev = version;
-    sha256 = "zmPsWdTbM+T50X0BsVTn1Aw/5N6sL5hIQiRG5WSG1eg=";
+    sha256 = "gT6jpFN0mkSdDs+8GQa0qKuL5KLzxanBMGwA4EATW7Y=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/mbedtls/2.nix b/pkgs/development/libraries/mbedtls/2.nix
new file mode 100644
index 000000000000..ba1f520b08cf
--- /dev/null
+++ b/pkgs/development/libraries/mbedtls/2.nix
@@ -0,0 +1,6 @@
+{ callPackage }:
+
+callPackage ./generic.nix {
+  version = "2.28.1";
+  hash = "sha256-brbZB3fINDeVWXf50ct4bxYkoBVyD6bBBijZyFQSnyw=";
+}
diff --git a/pkgs/development/libraries/mbedtls/3.nix b/pkgs/development/libraries/mbedtls/3.nix
new file mode 100644
index 000000000000..d6f53feb086b
--- /dev/null
+++ b/pkgs/development/libraries/mbedtls/3.nix
@@ -0,0 +1,6 @@
+{ callPackage }:
+
+callPackage ./generic.nix {
+  version = "3.2.1";
+  hash = "sha256-+M36NvFe4gw2PRbld/2JV3yBGrqK6soWcmrSEkUNcrc=";
+}
diff --git a/pkgs/development/libraries/mbedtls/default.nix b/pkgs/development/libraries/mbedtls/generic.nix
index 2bd924d870c7..bb87c6dbc8ad 100644
--- a/pkgs/development/libraries/mbedtls/default.nix
+++ b/pkgs/development/libraries/mbedtls/generic.nix
@@ -1,4 +1,7 @@
-{ lib, stdenv
+{ lib
+, stdenv
+, version
+, hash
 , fetchFromGitHub
 
 , cmake
@@ -11,17 +14,13 @@
 
 stdenv.mkDerivation rec {
   pname = "mbedtls";
-  # Auto updates are disabled due to repology listing dev releases as release
-  # versions. See
-  #  * https://github.com/NixOS/nixpkgs/pull/119838#issuecomment-822100428
-  #  * https://github.com/NixOS/nixpkgs/commit/0ee02a9d42b5fe1825b0f7cee7a9986bb4ba975d
-  version = "2.28.1"; # nixpkgs-update: no auto update
+  inherit version;
 
   src = fetchFromGitHub {
-    owner = "ARMmbed";
+    owner = "Mbed-TLS";
     repo = "mbedtls";
     rev = "${pname}-${version}";
-    sha256 = "sha256-brbZB3fINDeVWXf50ct4bxYkoBVyD6bBBijZyFQSnyw=";
+    inherit hash;
   };
 
   nativeBuildInputs = [ cmake ninja perl python3 ];
@@ -40,10 +39,11 @@ stdenv.mkDerivation rec {
   ];
 
   meta = with lib; {
-    homepage = "https://tls.mbed.org/";
+    homepage = "https://www.trustedfirmware.org/projects/mbed-tls/";
+    changelog = "https://github.com/Mbed-TLS/mbedtls/blob/${pname}-${version}/ChangeLog";
     description = "Portable cryptographic and TLS library, formerly known as PolarSSL";
     license = licenses.asl20;
     platforms = platforms.all;
-    maintainers = with maintainers; [ ];
+    maintainers = with maintainers; [ raphaelr ];
   };
 }
diff --git a/pkgs/development/libraries/mdds/default.nix b/pkgs/development/libraries/mdds/default.nix
index 8ca137e66119..d85e24f90781 100644
--- a/pkgs/development/libraries/mdds/default.nix
+++ b/pkgs/development/libraries/mdds/default.nix
@@ -1,12 +1,14 @@
-{ lib, stdenv, fetchurl, boost, llvmPackages }:
+{ lib, stdenv, fetchFromGitLab, autoreconfHook, boost, llvmPackages }:
 
 stdenv.mkDerivation rec {
   pname = "mdds";
   version = "2.0.2";
 
-  src = fetchurl {
-    url = "https://kohei.us/files/${pname}/src/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-EyEfLy44fvO3TXOh3O5Soa1c4G34+OZkdnnfknijEWo=";
+  src = fetchFromGitLab {
+    owner = "mdds";
+    repo = pname;
+    rev = version;
+    sha256 = "sha256-jCzF0REocpnP56LfY42zlGTXyKyz4GPovDshhrh4jyo=";
   };
 
   postInstall = ''
@@ -14,14 +16,17 @@ stdenv.mkDerivation rec {
     cp "$out/share/pkgconfig/"* "$out/lib/pkgconfig"
   '';
 
+  nativeBuildInputs = [ autoreconfHook ];
+
   buildInputs = lib.optionals stdenv.cc.isClang [ llvmPackages.openmp ];
 
   checkInputs = [ boost ];
 
   meta = with lib; {
-    homepage = "https://gitlab.com/mdds/mdds";
     description = "A collection of multi-dimensional data structure and indexing algorithm";
-    platforms = platforms.all;
+    homepage = "https://gitlab.com/mdds/mdds";
+    maintainers = [];
     license = licenses.mit;
+    platforms = platforms.all;
   };
 }
diff --git a/pkgs/development/libraries/mm-common/default.nix b/pkgs/development/libraries/mm-common/default.nix
index e1eaa1d924b7..225ce967080d 100644
--- a/pkgs/development/libraries/mm-common/default.nix
+++ b/pkgs/development/libraries/mm-common/default.nix
@@ -8,11 +8,11 @@
 
 stdenv.mkDerivation rec {
   pname = "mm-common";
-  version = "1.0.4";
+  version = "1.0.5";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "6VTAm0MJp++T4TtpJgrNxXOMkHR36zgbeLseQU7m29g=";
+    sha256 = "cFxtKfQRaim95ONs/BsEbJK274xtrk6uyFAYdH5tpao=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/mysocketw/default.nix b/pkgs/development/libraries/mysocketw/default.nix
index 5ee10c854a55..880f5d50a042 100644
--- a/pkgs/development/libraries/mysocketw/default.nix
+++ b/pkgs/development/libraries/mysocketw/default.nix
@@ -49,15 +49,11 @@ stdenv.mkDerivation rec {
     printf %s 'https://AnotherFoxGuy.com/CMakeCM::modules/JoinPaths.cmake.1' > JoinPaths.cmake.whence
   )'';
 
-  postPatch = lib.optionalString stdenv.isDarwin ''
-    substituteInPlace src/Makefile \
-        --replace -Wl,-soname, -Wl,-install_name,$out/lib/
-  '';
-
   meta = with lib; {
     description = "Cross platform (Linux/FreeBSD/Unix/Win32) streaming socket C++";
     homepage = "https://github.com/RigsOfRods/socketw";
     license = licenses.lgpl21Plus;
     maintainers = with maintainers; [ ];
+    platforms = platforms.unix;
   };
 }
diff --git a/pkgs/development/libraries/ntirpc/default.nix b/pkgs/development/libraries/ntirpc/default.nix
index 95003a0b00ef..66002df49052 100644
--- a/pkgs/development/libraries/ntirpc/default.nix
+++ b/pkgs/development/libraries/ntirpc/default.nix
@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   pname = "ntirpc";
-  version = "4.1";
+  version = "4.2";
 
   src = fetchFromGitHub {
     owner = "nfs-ganesha";
     repo = "ntirpc";
     rev = "v${version}";
-    sha256 = "sha256-RTuWj795YrXVo3TIiEr3Dy/QmSL5Ch0VVc4gRlDhNTM=";
+    sha256 = "sha256-rVv5TLxirtmoRJl0+RupbkvzChuSMSGi3NTa0dchZSU=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/libraries/ogre/default.nix b/pkgs/development/libraries/ogre/default.nix
index 2017d5435ea4..34cb8d21f839 100644
--- a/pkgs/development/libraries/ogre/default.nix
+++ b/pkgs/development/libraries/ogre/default.nix
@@ -1,29 +1,34 @@
-{ fetchFromGitHub
+{ lib
 , stdenv
-, lib
+, fetchFromGitHub
 , cmake
-, libGLU
-, libGL
-, freetype
+, pkg-config
+, unzip
+, SDL2
+, boost
 , freeimage
-, zziplib
-, xorgproto
-, libXrandr
-, libXaw
-, freeglut
-, libXt
+, freetype
 , libpng
-, boost
 , ois
+, pugixml
+, zziplib
+  # linux
+, freeglut
+, libGL
+, libGLU
+, libICE
+, libSM
 , libX11
+, libXaw
 , libXmu
-, libSM
-, pkg-config
-, libXxf86vm
-, libICE
-, unzip
+, libXrandr
 , libXrender
-, SDL2
+, libXt
+, libXxf86vm
+, xorgproto
+  # darwin
+, Cocoa
+  # optional
 , withNvidiaCg ? false
 , nvidia_cg_toolkit
 , withSamples ? false
@@ -31,59 +36,63 @@
 
 stdenv.mkDerivation rec {
   pname = "ogre";
-  version = "1.12.1";
+  version = "13.5.3";
 
   src = fetchFromGitHub {
     owner = "OGRECave";
     repo = "ogre";
     rev = "v${version}";
-    sha256 = "sha256-FHW0+DZhw6MLlhjh4DRYhA+6vBBXMN9K6GEVoR6P5kM=";
+    sha256 = "sha256-fjgMAuIA7rm3Gt2z//kPkc7LOcfddoFgY38B7bs6zZo=";
   };
 
-  # fix for ARM. sys/sysctl.h has moved in later glibcs, and
-  # https://github.com/OGRECave/ogre-next/issues/132 suggests it isn't
-  # needed anyway.
-  postPatch = ''
-    substituteInPlace OgreMain/src/OgrePlatformInformation.cpp \
-      --replace '#include <sys/sysctl.h>' ""
-  '';
-
-  cmakeFlags = [ "-DOGRE_BUILD_DEPENDENCIES=OFF" "-DOGRE_BUILD_SAMPLES=${toString withSamples}" ]
-    ++ map (x: "-DOGRE_BUILD_PLUGIN_${x}=on")
-    ([ "BSP" "OCTREE" "PCZ" "PFX" ] ++ lib.optional withNvidiaCg "CG")
-    ++ map (x: "-DOGRE_BUILD_RENDERSYSTEM_${x}=on") [ "GL" ];
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+    unzip
+  ];
 
+  buildInputs = [
+    SDL2
+    boost
+    freeimage
+    freetype
+    libpng
+    ois
+    pugixml
+    zziplib
+  ] ++ lib.optionals stdenv.isLinux [
+    freeglut
+    libGL
+    libGLU
+    libICE
+    libSM
+    libX11
+    libXaw
+    libXmu
+    libXrandr
+    libXrender
+    libXt
+    libXxf86vm
+    xorgproto
+  ] ++ lib.optionals stdenv.isDarwin [
+    Cocoa
+  ] ++ lib.optionals withNvidiaCg [
+    nvidia_cg_toolkit
+  ];
 
-  nativeBuildInputs = [ cmake unzip pkg-config ];
-  buildInputs =
-    [
-      libGLU
-      libGL
-      freetype
-      freeimage
-      zziplib
-      xorgproto
-      libXrandr
-      libXaw
-      freeglut
-      libXt
-      libpng
-      boost
-      ois
-      libX11
-      libXmu
-      libSM
-      libXxf86vm
-      libICE
-      libXrender
-      SDL2
-    ] ++ lib.optional withNvidiaCg nvidia_cg_toolkit;
+  cmakeFlags = [
+    "-DOGRE_BUILD_COMPONENT_OVERLAY_IMGUI=FALSE"
+    "-DOGRE_BUILD_DEPENDENCIES=OFF"
+    "-DOGRE_BUILD_SAMPLES=${toString withSamples}"
+  ] ++ lib.optionals stdenv.isDarwin [
+    "-DOGRE_BUILD_LIBS_AS_FRAMEWORKS=FALSE"
+  ];
 
   meta = {
-    description = "A 3D engine";
+    description = "3D Object-Oriented Graphics Rendering Engine";
     homepage = "https://www.ogre3d.org/";
-    maintainers = [ lib.maintainers.raskin ];
-    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [ raskin wegank ];
+    platforms = lib.platforms.unix;
     license = lib.licenses.mit;
   };
 }
diff --git a/pkgs/development/libraries/openscenegraph/default.nix b/pkgs/development/libraries/openscenegraph/default.nix
index 885fbb058bd1..3a6a7b57c40f 100644
--- a/pkgs/development/libraries/openscenegraph/default.nix
+++ b/pkgs/development/libraries/openscenegraph/default.nix
@@ -23,7 +23,7 @@
   sdlSupport ? false, SDL2,
   restSupport ? false, asio,
   withApps ? false,
-  withExamples ? false, fltk, wxGTK30-gtk3,
+  withExamples ? false, fltk, wxGTK30,
 }:
 
 stdenv.mkDerivation rec {
@@ -61,7 +61,7 @@ stdenv.mkDerivation rec {
     ++ lib.optional luaSupport lua
     ++ lib.optional sdlSupport SDL2
     ++ lib.optional restSupport asio
-    ++ lib.optionals withExamples [ fltk wxGTK30-gtk3 ]
+    ++ lib.optionals withExamples [ fltk wxGTK30 ]
     ++ lib.optionals stdenv.isDarwin [ AGL Carbon Cocoa Foundation ]
     ++ lib.optional (restSupport || colladaSupport) boost
   ;
diff --git a/pkgs/development/libraries/openssl/default.nix b/pkgs/development/libraries/openssl/default.nix
index 61f758b7c4a9..45a34971c8f0 100644
--- a/pkgs/development/libraries/openssl/default.nix
+++ b/pkgs/development/libraries/openssl/default.nix
@@ -87,28 +87,24 @@ let
         x86_64-linux = "./Configure linux-x86_64";
         x86_64-solaris = "./Configure solaris64-x86_64-gcc";
         riscv64-linux = "./Configure linux64-riscv64";
-        mipsel-linux = "./Configure linux-mips32";
-        mips64el-linux =
-          if stdenv.hostPlatform.isMips64n64
-          then "./Configure linux64-mips64"
-          else if stdenv.hostPlatform.isMips64n32
-          then "./Configure linux-mips64"
-          else throw "unsupported ABI for ${stdenv.hostPlatform.system}";
       }.${stdenv.hostPlatform.system} or (
         if stdenv.hostPlatform == stdenv.buildPlatform
           then "./config"
-        else if stdenv.hostPlatform.isBSD && stdenv.hostPlatform.isx86_64
-          then "./Configure BSD-x86_64"
-        else if stdenv.hostPlatform.isBSD && stdenv.hostPlatform.isx86_32
-          then "./Configure BSD-x86" + lib.optionalString (stdenv.hostPlatform.parsed.kernel.execFormat.name == "elf") "-elf"
         else if stdenv.hostPlatform.isBSD
-          then "./Configure BSD-generic${toString stdenv.hostPlatform.parsed.cpu.bits}"
+          then if stdenv.hostPlatform.isx86_64 then "./Configure BSD-x86_64"
+          else if stdenv.hostPlatform.isx86_32
+            then "./Configure BSD-x86" + lib.optionalString (stdenv.hostPlatform.parsed.kernel.execFormat.name == "elf") "-elf"
+          else "./Configure BSD-generic${toString stdenv.hostPlatform.parsed.cpu.bits}"
         else if stdenv.hostPlatform.isMinGW
           then "./Configure mingw${lib.optionalString
                                      (stdenv.hostPlatform.parsed.cpu.bits != 32)
                                      (toString stdenv.hostPlatform.parsed.cpu.bits)}"
         else if stdenv.hostPlatform.isLinux
-          then "./Configure linux-generic${toString stdenv.hostPlatform.parsed.cpu.bits}"
+          then if stdenv.hostPlatform.isx86_64 then "./Configure linux-x86_64"
+          else if stdenv.hostPlatform.isMips32 then "./Configure linux-mips32"
+          else if stdenv.hostPlatform.isMips64n32 then "./Configure linux-mips64"
+          else if stdenv.hostPlatform.isMips64n64 then "./Configure linux64-mips64"
+          else "./Configure linux-generic${toString stdenv.hostPlatform.parsed.cpu.bits}"
         else if stdenv.hostPlatform.isiOS
           then "./Configure ios${toString stdenv.hostPlatform.parsed.cpu.bits}-cross"
         else
diff --git a/pkgs/development/libraries/proj/default.nix b/pkgs/development/libraries/proj/default.nix
index 2e1000ef5e64..87736e1ebc75 100644
--- a/pkgs/development/libraries/proj/default.nix
+++ b/pkgs/development/libraries/proj/default.nix
@@ -15,13 +15,13 @@
 
 stdenv.mkDerivation rec {
   pname = "proj";
-  version = "9.1.0";
+  version = "9.1.1";
 
   src = fetchFromGitHub {
     owner = "OSGeo";
     repo = "PROJ";
     rev = version;
-    hash = "sha256-Upsp72RorV+5PFPHOK3zCJgVTRZ6fSVVFRope8Bp8/M=";
+    hash = "sha256-yw7eSm64qFFt9egJWKVyVo0e7xQRSmfUY7pk6Cwvwdk=";
   };
 
   patches = [
diff --git a/pkgs/development/libraries/qt-6/modules/qtbase.nix b/pkgs/development/libraries/qt-6/modules/qtbase.nix
index e1675e029fc3..d396e18aad24 100644
--- a/pkgs/development/libraries/qt-6/modules/qtbase.nix
+++ b/pkgs/development/libraries/qt-6/modules/qtbase.nix
@@ -18,7 +18,6 @@
 , ccache
 , xmlstarlet
 , libproxy
-, xlibsWrapper
 , xorg
 , zstd
 , double-conversion
@@ -129,7 +128,6 @@ stdenv.mkDerivation rec {
     unixODBCDrivers.sqlite
     unixODBCDrivers.mariadb
   ] ++ lib.optionals stdenv.isLinux [
-    xlibsWrapper
     util-linux
     systemd
     mtdev
diff --git a/pkgs/development/libraries/qt-6/modules/qtwayland.nix b/pkgs/development/libraries/qt-6/modules/qtwayland.nix
index 3ac23d28a798..e28cdb438e5e 100644
--- a/pkgs/development/libraries/qt-6/modules/qtwayland.nix
+++ b/pkgs/development/libraries/qt-6/modules/qtwayland.nix
@@ -4,13 +4,12 @@
 , qtdeclarative
 , wayland
 , pkg-config
-, xlibsWrapper
 , libdrm
 }:
 
 qtModule {
   pname = "qtwayland";
   qtInputs = [ qtbase qtdeclarative ];
-  buildInputs = [ wayland xlibsWrapper libdrm ];
+  buildInputs = [ wayland libdrm ];
   nativeBuildInputs = [ pkg-config ];
 }
diff --git a/pkgs/development/libraries/s2n-tls/default.nix b/pkgs/development/libraries/s2n-tls/default.nix
index d22f59271fec..451e856c4e01 100644
--- a/pkgs/development/libraries/s2n-tls/default.nix
+++ b/pkgs/development/libraries/s2n-tls/default.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "s2n-tls";
-  version = "1.3.28";
+  version = "1.3.29";
 
   src = fetchFromGitHub {
     owner = "aws";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-RkOP+et8wFb44NLqkizXB68U0NRKKvhDl4PyQWz2m6A=";
+    sha256 = "sha256-MKrZP81PrpOsVhS+kAjcd1Eumhq7F4HWWbFnypZttuY=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/semver-cpp/default.nix b/pkgs/development/libraries/semver-cpp/default.nix
new file mode 100644
index 000000000000..966f170eaad0
--- /dev/null
+++ b/pkgs/development/libraries/semver-cpp/default.nix
@@ -0,0 +1,31 @@
+{ lib
+, stdenvNoCC
+, fetchFromGitHub
+}:
+
+stdenvNoCC.mkDerivation rec {
+  pname = "semver-cpp";
+  version = "0.3.0";
+
+  src = fetchFromGitHub {
+    owner = "Neargye";
+    repo = "semver";
+    rev = "v${version}";
+    sha256 = "sha256-nRWmY/GJtSkPJIW7i7/eIr/YtfyvYhJVZBRIDXUC7xg=";
+  };
+
+  # Header-only library.
+  dontBuild = true;
+
+  installPhase = ''
+    mkdir "$out"
+    cp -r include "$out"
+  '';
+
+  meta = with lib; {
+    description = "Semantic Versioning for modern C++";
+    homepage = "https://github.com/Neargye/semver";
+    maintainers = with maintainers; [ aidalgol ];
+    license = licenses.mit;
+  };
+}
diff --git a/pkgs/development/libraries/smokegen/default.nix b/pkgs/development/libraries/smokegen/default.nix
index 643ae1064db7..2a93965aeb39 100644
--- a/pkgs/development/libraries/smokegen/default.nix
+++ b/pkgs/development/libraries/smokegen/default.nix
@@ -1,16 +1,18 @@
-{ pkgs, lib, ... }:
+{ stdenv, lib, cmake, qt4, fetchzip }:
 
-pkgs.stdenv.mkDerivation rec {
+stdenv.mkDerivation rec {
   pname = "smokegen";
-  version = "v4.14.3";
-  src = pkgs.fetchzip {
-    url = "https://invent.kde.org/unmaintained/${pname}/-/archive/${version}/${pname}-${version}.tar.gz";
+  version = "4.14.3";
+
+  src = fetchzip {
+    url = "https://invent.kde.org/unmaintained/${pname}/-/archive/v${version}/${pname}-v${version}.tar.gz";
     hash = "sha256-finsoruPeJZLawIjNUJ25Pq54eaCByfALVraNQJPk7c=";
   };
-  buildInputs = [ pkgs.cmake pkgs.qt4 ];
-  buildPhase = ''
-      cmake .
-    '';
+
+  strictDeps = true;
+  nativeBuildInputs = [ cmake qt4 ];
+  buildInputs = [ qt4 ];
+
   meta = with lib; {
     description = "A general purpose C++ parser with a plugin infrastructure";
     homepage = "https://invent.kde.org/unmaintained/smokegen";
diff --git a/pkgs/development/libraries/smokeqt/default.nix b/pkgs/development/libraries/smokeqt/default.nix
index 145a9f243bb3..1c427b8abb70 100644
--- a/pkgs/development/libraries/smokeqt/default.nix
+++ b/pkgs/development/libraries/smokeqt/default.nix
@@ -1,16 +1,22 @@
-{ pkgs, lib, ... }:
+{ stdenv, lib, cmake, qt4, smokegen, fetchzip }:
 
-pkgs.stdenv.mkDerivation rec {
+stdenv.mkDerivation rec {
   pname = "smokeqt";
-  version = "v4.14.3";
-  src = pkgs.fetchzip {
-    url = "https://invent.kde.org/unmaintained/${pname}/-/archive/${version}/${pname}-${version}.tar.gz";
+  version = "4.14.3";
+
+  src = fetchzip {
+    url = "https://invent.kde.org/unmaintained/${pname}/-/archive/v${version}/${pname}-v${version}.tar.gz";
     hash = "sha256-8FiEGF8gduVw5I/bi2wExGUWmjIjYEhWpjpXKJGBNMg=";
   };
+
+  strictDeps = true;
+  nativeBuildInputs = [ cmake smokegen ];
+  buildInputs = [ qt4 ];
+
   cmakeFlags = [
     "-DCMAKE_CXX_STANDARD=98"
   ];
-  buildInputs = [ pkgs.cmake pkgs.qt4 pkgs.smokegen ];
+
   meta = with lib; {
     description = "Bindings for the Qt libraries";
     homepage = "https://invent.kde.org/unmaintained/smokeqt";
diff --git a/pkgs/development/libraries/tracker-miners/default.nix b/pkgs/development/libraries/tracker-miners/default.nix
index 55793719dd81..32225a7bb0d8 100644
--- a/pkgs/development/libraries/tracker-miners/default.nix
+++ b/pkgs/development/libraries/tracker-miners/default.nix
@@ -46,11 +46,11 @@
 
 stdenv.mkDerivation rec {
   pname = "tracker-miners";
-  version = "3.4.1";
+  version = "3.4.2";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "L84OyF+3YXyLKIfCJ5d0DV3shOwDbbdNbCCLurXFjCQ=";
+    sha256 = "EB42CPHCi/7YriVSL3pyC1WfiJp24oCvvlCk2LBk+Sw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/vapoursynth/default.nix b/pkgs/development/libraries/vapoursynth/default.nix
index 0aa6fc39baad..3a88e3bd04b4 100644
--- a/pkgs/development/libraries/vapoursynth/default.nix
+++ b/pkgs/development/libraries/vapoursynth/default.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "vapoursynth";
-  version = "60";
+  version = "61";
 
   src = fetchFromGitHub {
     owner  = "vapoursynth";
     repo   = "vapoursynth";
     rev    = "R${version}";
-    sha256 = "sha256-E1uHNcGxBrwg00tNnY3qH6BpvXtBEGkX7QFy0aMLSnA=";
+    sha256 = "sha256-JJWq706GLywUO5voYKzxcOvMWF4/NXEbqOrj5uG4DWw=";
   };
 
   patches = [
diff --git a/pkgs/development/libraries/vte/default.nix b/pkgs/development/libraries/vte/default.nix
index 07ec683bf05a..f87557ac4623 100644
--- a/pkgs/development/libraries/vte/default.nix
+++ b/pkgs/development/libraries/vte/default.nix
@@ -30,13 +30,13 @@
 
 stdenv.mkDerivation rec {
   pname = "vte";
-  version = "0.70.1";
+  version = "0.70.2";
 
   outputs = [ "out" "dev" "devdoc" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-H0YBy/6lMCuWkCIIyPGF5bGLJZtTWLyTzzkr9ZhxxbY=";
+    sha256 = "sha256-TRW0OA3j9WTVfqvQBjicQHxwXfWwxwAw/cwklxozTYA=";
   };
 
   patches = [
diff --git a/pkgs/development/libraries/wolfssl/default.nix b/pkgs/development/libraries/wolfssl/default.nix
index 580af7235e05..e61a6f6c3931 100644
--- a/pkgs/development/libraries/wolfssl/default.nix
+++ b/pkgs/development/libraries/wolfssl/default.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
     owner = "wolfSSL";
     repo = "wolfssl";
     rev = "v${version}-stable";
-    hash = "sha256-d8DDyEsK35WK7c0udZI5HxQLO+mbod8hlbSoa3IWWS0=";
+    hash = "sha256-36L7kZ9Dqp3pDjodqELBdSBFwrf+GnRP7KNFYrRUCuU=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/libraries/wxwidgets/wxGTK30.nix b/pkgs/development/libraries/wxwidgets/wxGTK30.nix
index 3b848f788c10..b60e1f486dc8 100644
--- a/pkgs/development/libraries/wxwidgets/wxGTK30.nix
+++ b/pkgs/development/libraries/wxwidgets/wxGTK30.nix
@@ -3,8 +3,6 @@
 , expat
 , fetchFromGitHub
 , gst_all_1
-, withGtk2 ? true
-, gtk2
 , gtk3
 , libGL
 , libGLU
@@ -34,11 +32,6 @@
 , WebKit
 }:
 
-assert withGtk2 -> (!withWebKit);
-
-let
-  gtk = if withGtk2 then gtk2 else gtk3;
-in
 stdenv.mkDerivation rec {
   pname = "wxwidgets";
   version = "3.0.5.1";
@@ -60,7 +53,7 @@ stdenv.mkDerivation rec {
     libjpeg_turbo
     zlib
   ] ++ lib.optionals stdenv.isLinux [
-    gtk
+    gtk3
     libSM
     libXinerama
     libXxf86vm
@@ -148,7 +141,6 @@ stdenv.mkDerivation rec {
   };
 
   passthru = {
-    inherit gtk;
     inherit compat26 compat28 unicode;
   };
 }
diff --git a/pkgs/development/libraries/xdg-desktop-portal-gtk/default.nix b/pkgs/development/libraries/xdg-desktop-portal-gtk/default.nix
index e54f764f9a50..903de4d9a232 100644
--- a/pkgs/development/libraries/xdg-desktop-portal-gtk/default.nix
+++ b/pkgs/development/libraries/xdg-desktop-portal-gtk/default.nix
@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation rec {
   pname = "xdg-desktop-portal-gtk";
-  version = "1.14.0";
+  version = "1.14.1";
 
   src = fetchFromGitHub {
     owner = "flatpak";
     repo = pname;
     rev = version;
-    sha256 = "I9xQgiE3lNb2vRodO5R1y40lqoOKzALskrVePidant4=";
+    sha256 = "8eyWeoiJ3b/GlqGVfmkf2/uS7FnOpRNgbfxwWjclw8w=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/yojimbo/default.nix b/pkgs/development/libraries/yojimbo/default.nix
index b72820c77a68..d8c29e56aaab 100644
--- a/pkgs/development/libraries/yojimbo/default.nix
+++ b/pkgs/development/libraries/yojimbo/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, premake5, doxygen, libsodium, mbedtls }:
+{ lib, stdenv, fetchFromGitHub, premake5, doxygen, libsodium, mbedtls_2 }:
 
 stdenv.mkDerivation {
   pname = "yojimbo";
@@ -13,7 +13,7 @@ stdenv.mkDerivation {
   };
 
   nativeBuildInputs = [ premake5 doxygen ];
-  propagatedBuildInputs = [ libsodium mbedtls ];
+  propagatedBuildInputs = [ libsodium mbedtls_2 ];
 
   postBuild = ''
     premake5 docs
diff --git a/pkgs/development/mobile/androidenv/compose-android-packages.nix b/pkgs/development/mobile/androidenv/compose-android-packages.nix
index 217922886df8..e379c12f9716 100644
--- a/pkgs/development/mobile/androidenv/compose-android-packages.nix
+++ b/pkgs/development/mobile/androidenv/compose-android-packages.nix
@@ -312,6 +312,12 @@ rec {
           ln -s $i $out/bin
       done
 
+      # the emulator auto-linked from platform-tools does not find its local qemu, while this one does
+      ${lib.optionalString includeEmulator ''
+        rm $out/bin/emulator
+        ln -s $out/libexec/android-sdk/emulator/emulator $out/bin
+      ''}
+
       # Write licenses
       mkdir -p licenses
       ${lib.concatMapStrings (licenseName:
diff --git a/pkgs/development/node-packages/overrides.nix b/pkgs/development/node-packages/overrides.nix
index 1ef63d3f6b92..4e5b04e62404 100644
--- a/pkgs/development/node-packages/overrides.nix
+++ b/pkgs/development/node-packages/overrides.nix
@@ -135,10 +135,6 @@ final: prev: {
     meta = oldAttrs.meta // { broken = since "12"; };
   });
 
-  deltachat-desktop = prev."deltachat-desktop-../../applications/networking/instant-messengers/deltachat-desktop".override (oldAttrs: {
-    meta = oldAttrs.meta // { broken = true; }; # use the top-level package instead
-  });
-
   eask = prev."@emacs-eask/cli".override {
     name = "eask";
   };
diff --git a/pkgs/development/ocaml-modules/camlzip/default.nix b/pkgs/development/ocaml-modules/camlzip/default.nix
index caf3e7a63f0d..761453739e29 100644
--- a/pkgs/development/ocaml-modules/camlzip/default.nix
+++ b/pkgs/development/ocaml-modules/camlzip/default.nix
@@ -1,17 +1,24 @@
 {lib, stdenv, fetchurl, zlib, ocaml, findlib}:
 
 let
-  param =
-    if lib.versionAtLeast ocaml.version "4.02"
-    then {
-      version = "1.10";
-      url = "https://github.com/xavierleroy/camlzip/archive/rel110.tar.gz";
-      sha256 = "X0YcczaQ3lFeJEiTIgjSSZ1zi32KFMtmZsP0FFpyfbI=";
+  common = {
       patches = [];
       postPatchInit = ''
         cp META-zip META-camlzip
         echo 'directory="../zip"' >> META-camlzip
       '';
+  };
+  param =
+    if lib.versionAtLeast ocaml.version "4.07"
+    then common // {
+      version = "1.11";
+      url = "https://github.com/xavierleroy/camlzip/archive/rel111.tar.gz";
+      sha256 = "sha256-/7vF3j4cE9wOWScjdtIy0u3pGzJ1UQY9R/3bdPHV7Tc=";
+    } else if lib.versionAtLeast ocaml.version "4.02"
+    then common // {
+      version = "1.10";
+      url = "https://github.com/xavierleroy/camlzip/archive/rel110.tar.gz";
+      sha256 = "X0YcczaQ3lFeJEiTIgjSSZ1zi32KFMtmZsP0FFpyfbI=";
     } else {
       version = "1.05";
       download_id = "1037";
@@ -25,7 +32,7 @@ let
 in
 
 stdenv.mkDerivation {
-  pname = "camlzip";
+  pname = "ocaml${ocaml.version}-camlzip";
   version = param.version;
 
   src = fetchurl {
diff --git a/pkgs/development/ocaml-modules/gen_js_api/default.nix b/pkgs/development/ocaml-modules/gen_js_api/default.nix
index 4baa21c57cf1..39f325b5fe76 100644
--- a/pkgs/development/ocaml-modules/gen_js_api/default.nix
+++ b/pkgs/development/ocaml-modules/gen_js_api/default.nix
@@ -10,6 +10,7 @@
 buildDunePackage rec {
   pname = "gen_js_api";
   version = "1.1.1";
+  duneVersion = "3";
 
   src = fetchFromGitHub {
     owner = "LexiFi";
diff --git a/pkgs/development/ocaml-modules/gen_js_api/ojs.nix b/pkgs/development/ocaml-modules/gen_js_api/ojs.nix
index 381fda7acd93..0cfe8f4bbfc1 100644
--- a/pkgs/development/ocaml-modules/gen_js_api/ojs.nix
+++ b/pkgs/development/ocaml-modules/gen_js_api/ojs.nix
@@ -7,6 +7,7 @@ buildDunePackage rec {
   pname = "ojs";
 
   inherit (gen_js_api) version src;
+  duneVersion = "3";
 
   propagatedBuildInputs = [ js_of_ocaml-compiler ];
 
diff --git a/pkgs/development/ocaml-modules/janestreet/0.14.nix b/pkgs/development/ocaml-modules/janestreet/0.14.nix
index 67d0e6c7896e..8a640437bcaf 100644
--- a/pkgs/development/ocaml-modules/janestreet/0.14.nix
+++ b/pkgs/development/ocaml-modules/janestreet/0.14.nix
@@ -84,6 +84,7 @@ with self;
 
   async_js = janePackage {
     pname = "async_js";
+    duneVersion = "3";
     hash = "0rld8792lfwbinn9rhrgacivz49vppgy29smpqnvpga89wchjv0v";
     meta.description = "A small library that provide Async support for JavaScript platforms";
     buildInputs = [ js_of_ocaml-ppx ];
@@ -190,6 +191,7 @@ with self;
 
   bonsai = janePackage {
     pname = "bonsai";
+    duneVersion = "3";
     hash = "0k4grabwqc9sy4shzp77bgfvyajvvc0l8qq89ia7cvlwvly7gv6a";
     meta.description = "A library for building dynamic webapps, using Js_of_ocaml";
     buildInputs = [ ppx_pattern_bind ];
@@ -309,6 +311,7 @@ with self;
 
   incr_dom = janePackage {
     pname = "incr_dom";
+    duneVersion = "3";
     hash = "0mi98cwi4npdh5vvcz0pb4sbb9j9dydl52s51rswwc3kn8mipxfx";
     meta.description = "A library for building dynamic webapps, using Js_of_ocaml";
     buildInputs = [ js_of_ocaml-ppx ];
@@ -877,6 +880,7 @@ with self;
 
   virtual_dom = janePackage {
     pname = "virtual_dom";
+    duneVersion = "3";
     hash = "0vcydxx0jhbd5hbriahgp947mc7n3xymyrsfny1c4adk6aaq3c5w";
     meta.description = "OCaml bindings for the virtual-dom library";
     buildInputs = [ js_of_ocaml-ppx ];
diff --git a/pkgs/development/ocaml-modules/janestreet/0.15.nix b/pkgs/development/ocaml-modules/janestreet/0.15.nix
index 5ced2323ea70..676bea0e47fe 100644
--- a/pkgs/development/ocaml-modules/janestreet/0.15.nix
+++ b/pkgs/development/ocaml-modules/janestreet/0.15.nix
@@ -87,6 +87,7 @@ with self;
 
   async_js = janePackage {
     pname = "async_js";
+    duneVersion = "3";
     hash = "184j077bz686k5lrqswircnrdqldb316ngpzq7xri1pcsl39sy3q";
     meta.description = "A small library that provide Async support for JavaScript platforms";
     buildInputs = [ js_of_ocaml-ppx ];
@@ -207,6 +208,7 @@ with self;
 
   bonsai = janePackage {
     pname = "bonsai";
+    duneVersion = "3";
     hash = "150zx2g1dmhyrxwqq8j7f2m3hjpmk5bk182ihx2gdbarhw1ainpm";
     meta.description = "A library for building dynamic webapps, using Js_of_ocaml";
     buildInputs = [ ppx_pattern_bind ];
@@ -281,7 +283,8 @@ with self;
 
   core_unix = janePackage {
     pname = "core_unix";
-    hash = "1xzxqzg23in5ivz0v3qshzpr4w92laayscqj9im7jylh2ar1xi0a";
+    version = "0.15.2";
+    hash = "sha256-9f2PiLo+4Bjnfvh3scvIiPHj0wPZozmMMiCTe7vC1EA=";
     meta.description = "Unix-specific portions of Core";
     buildInputs = [ jst-config ];
     propagatedBuildInputs = [ core_kernel expect_test_helpers_core ocaml_intrinsics ppx_jane timezone spawn ];
@@ -292,7 +295,8 @@ with self;
 
   csvfields = janePackage {
     pname = "csvfields";
-    hash = "0z47pq17bw776hzvk48ypbd92ps9vlvl86mnhw3j6cqx4ahbjik3";
+    version = "0.15.1";
+    hash = "sha256-bBupsarwjte2NCncNDFSkrrmMR3EYPn+D7xI9zQOhFA=";
     propagatedBuildInputs = [ core num ];
     meta.description = "Runtime support for ppx_xml_conv and ppx_csv_conv";
   };
@@ -382,6 +386,7 @@ with self;
 
   incr_dom = janePackage {
     pname = "incr_dom";
+    duneVersion = "3";
     hash = "1sija9w2im8vdp61h387w0mww9hh7jgkgsjcccps4lbv936ac7c1";
     meta.description = "A library for building dynamic webapps, using Js_of_ocaml";
     buildInputs = [ js_of_ocaml-ppx ];
@@ -570,6 +575,7 @@ with self;
 
   ppx_css = janePackage {
     pname = "ppx_css";
+    duneVersion = "3";
     hash = "09dpmj3f3m3z1ji9hq775iqr3cfmv5gh7q9zlblizj4wx4y0ibyi";
     meta.description = "A ppx that takes in css strings and produces a module for accessing the unique names defined within";
     propagatedBuildInputs = [ core_kernel ppxlib js_of_ocaml js_of_ocaml-ppx sedlex ];
@@ -900,7 +906,8 @@ with self;
 
   sexp_pretty = janePackage {
     pname = "sexp_pretty";
-    hash = "1p1jspwjvrhm8li22xl0n8wngs12d9g7nc1svk6xc32jralnxblg";
+    version = "0.15.1";
+    hash = "sha256-UJEO2P4C7ZaD110MEfkG4FXfGDVAAW2TAK489faV6SM=";
     minimumOCamlVersion = "4.07";
     meta.description = "S-expression pretty-printer";
     propagatedBuildInputs = [ ppx_base re sexplib ];
@@ -1045,6 +1052,7 @@ with self;
     hash = "15xia9v4ighzm0gv3vbqk9nvg47cvzqmfnl2zr67yxv4b98kyzv3";
     meta.description = "OCaml bindings for the virtual-dom library";
     buildInputs = [ js_of_ocaml-ppx ];
+    duneVersion = "3";
     propagatedBuildInputs = [ core_kernel gen_js_api js_of_ocaml lambdasoup tyxml ];
   };
 
diff --git a/pkgs/development/ocaml-modules/lambda-term/default.nix b/pkgs/development/ocaml-modules/lambda-term/default.nix
index 239cbca42986..c073ddf39cd2 100644
--- a/pkgs/development/ocaml-modules/lambda-term/default.nix
+++ b/pkgs/development/ocaml-modules/lambda-term/default.nix
@@ -26,7 +26,7 @@ buildDunePackage rec {
   };
 
   propagatedBuildInputs = [ zed lwt_log lwt_react mew_vi ]
-    ++ lib.optional (lib.versionAtLeast version "3.3.1") [ uucp logs ] ;
+    ++ lib.optionals (lib.versionAtLeast version "3.3.1") [ uucp logs ] ;
 
   meta = {
     description = "Terminal manipulation library for OCaml";
diff --git a/pkgs/development/ocaml-modules/ocsigen-toolkit/default.nix b/pkgs/development/ocaml-modules/ocsigen-toolkit/default.nix
index 60a07d30d059..aaa68c214460 100644
--- a/pkgs/development/ocaml-modules/ocsigen-toolkit/default.nix
+++ b/pkgs/development/ocaml-modules/ocsigen-toolkit/default.nix
@@ -10,6 +10,12 @@ stdenv.mkDerivation rec {
  propagatedBuildInputs = [ calendar js_of_ocaml-ppx_deriving_json eliom ];
  nativeBuildInputs = [ ocaml findlib opaline eliom ];
 
+ # Remove widgets not compatible with jsoo 4.1.0
+ # https://github.com/ocsigen/ocsigen-toolkit/issues/221
+ preConfigure = ''
+   rm src/widgets/ot_{carousel,drawer,swipe,tongue}.eliom{,i}
+ '';
+
   strictDeps = true;
 
  installPhase = ''
diff --git a/pkgs/development/python-modules/GitPython/hardcode-git-path.patch b/pkgs/development/python-modules/GitPython/hardcode-git-path.patch
deleted file mode 100644
index 937479959926..000000000000
--- a/pkgs/development/python-modules/GitPython/hardcode-git-path.patch
+++ /dev/null
@@ -1,13 +0,0 @@
-diff --git a/git/cmd.py b/git/cmd.py
-index a4faefe..51ad442 100644
---- a/git/cmd.py
-+++ b/git/cmd.py
-@@ -175,7 +175,7 @@ class Git(LazyMixin):
- 
-     # CONFIGURATION
- 
--    git_exec_name = "git"           # default that should work on linux and windows
-+    git_exec_name = "@git@/bin/git"
- 
-     # Enables debugging of GitPython's git commands
-     GIT_PYTHON_TRACE = os.environ.get("GIT_PYTHON_TRACE", False)
diff --git a/pkgs/development/python-modules/ailment/default.nix b/pkgs/development/python-modules/ailment/default.nix
index 6253c43d60c6..5333d2e29fa1 100644
--- a/pkgs/development/python-modules/ailment/default.nix
+++ b/pkgs/development/python-modules/ailment/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "ailment";
-  version = "9.2.27";
+  version = "9.2.28";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "angr";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-siODqRqji2u+EJag/wTXCZG4LATNxggpMtqMHZAfQ9o=";
+    hash = "sha256-6+3lZygQEezEbGIMbB6NINjVDkgt5sYO2FV5wpienuY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/aiogithubapi/default.nix b/pkgs/development/python-modules/aiogithubapi/default.nix
index 051913ccce56..283fd87c55fb 100644
--- a/pkgs/development/python-modules/aiogithubapi/default.nix
+++ b/pkgs/development/python-modules/aiogithubapi/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "aiogithubapi";
-  version = "22.10.1";
+  version = "22.12.2";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -21,8 +21,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "ludeeus";
     repo = pname;
-    rev = version;
-    hash = "sha256-ceBuqaMqqL6qwN52765MG4sLt+08hx2G9rUVNC7x6ik=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-j7ikJS6lcqr7K4fU/EL43lFlWtGvPT4V9JC2Iqhi0ec=";
   };
 
   postPatch = ''
@@ -60,6 +60,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Python client for the GitHub API";
     homepage = "https://github.com/ludeeus/aiogithubapi";
+    changelog = "https://github.com/ludeeus/aiogithubapi/releases/tag/${version}";
     license = with licenses; [ mit ];
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/aiohomekit/default.nix b/pkgs/development/python-modules/aiohomekit/default.nix
index a4e39cb98aa3..40d9003a7ba7 100644
--- a/pkgs/development/python-modules/aiohomekit/default.nix
+++ b/pkgs/development/python-modules/aiohomekit/default.nix
@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "aiohomekit";
-  version = "2.3.5";
+  version = "2.4.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
@@ -27,7 +27,7 @@ buildPythonPackage rec {
     owner = "Jc2k";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-rZagtP0DwYr6+eQOEaLXRnZUnhKXcWbn6wOJPAA6WVM=";
+    hash = "sha256-xgk42/g5mRQiTjYuUnXCfLnQm6DNIJsvMbBOhr2NncQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/aioshelly/default.nix b/pkgs/development/python-modules/aioshelly/default.nix
index c4881dcdd56f..b3cb92b95fe6 100644
--- a/pkgs/development/python-modules/aioshelly/default.nix
+++ b/pkgs/development/python-modules/aioshelly/default.nix
@@ -1,14 +1,15 @@
 { lib
 , aiohttp
+, bluetooth-data-tools
 , buildPythonPackage
 , fetchFromGitHub
-, netifaces
+, orjson
 , pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "aioshelly";
-  version = "4.1.2";
+  version = "5.1.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.9";
@@ -17,12 +18,13 @@ buildPythonPackage rec {
     owner = "home-assistant-libs";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-0BxbcWA2Kdk1xTSKN/dH9LJc3yI60kmyMCrK77tqyNE=";
+    hash = "sha256-jhoPgwydB/DZx7hC16XgM0UBhmByVZRT5b7BDETA+FY=";
   };
 
   propagatedBuildInputs = [
     aiohttp
-    netifaces
+    bluetooth-data-tools
+    orjson
   ];
 
   # Project has no test
diff --git a/pkgs/development/python-modules/aiosmb/default.nix b/pkgs/development/python-modules/aiosmb/default.nix
index 70737dcca796..97cbd60db1ab 100644
--- a/pkgs/development/python-modules/aiosmb/default.nix
+++ b/pkgs/development/python-modules/aiosmb/default.nix
@@ -16,14 +16,14 @@
 
 buildPythonPackage rec {
   pname = "aiosmb";
-  version = "0.4.3";
+  version = "0.4.4";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-jJVXGBK8wWXEGvCzOTicHUh9jH35d1ARIxkLwn/ctjM=";
+    hash = "sha256-IGIEmM9eZ5T+op3ctGr72oy/cU48+OHaFJaZ8DRTY38=";
   };
 
   propagatedBuildInputs = [
@@ -49,6 +49,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Python SMB library";
     homepage = "https://github.com/skelsec/aiosmb";
+    changelog = "https://github.com/skelsec/aiosmb/releases/tag/${version}";
     license = with licenses; [ mit ];
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/aioswitcher/default.nix b/pkgs/development/python-modules/aioswitcher/default.nix
index 5a671bce26ce..4106049be0b7 100644
--- a/pkgs/development/python-modules/aioswitcher/default.nix
+++ b/pkgs/development/python-modules/aioswitcher/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "aioswitcher";
-  version = "3.2.0";
+  version = "3.2.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "TomerFi";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-Vob5p0+SlZR2eHj5Br2pWp3FCxW+zgY6crh8jrkreT0=";
+    hash = "sha256-k3xmW8aMBz6dbWuLnd6tw2BFoTuD80fpY7q2NfYqMlw=";
   };
 
   nativeBuildInputs = [
@@ -60,6 +60,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Python module to interact with Switcher water heater";
     homepage = "https://github.com/TomerFi/aioswitcher";
+    changelog = "https://github.com/TomerFi/aioswitcher/releases/tag/${version}";
     license = with licenses; [ mit ];
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/aiounifi/default.nix b/pkgs/development/python-modules/aiounifi/default.nix
index b75b9ac31810..2ac587ddff3a 100644
--- a/pkgs/development/python-modules/aiounifi/default.nix
+++ b/pkgs/development/python-modules/aiounifi/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "aiounifi";
-  version = "41";
+  version = "42";
 
   disabled = pythonOlder "3.9";
 
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "Kane610";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-rBluo4080m9jFnquXaQY/Cntp7wHToY16aNFhzrQJs8=";
+    hash = "sha256-vScAWEjdzXSy1gktz+Tfhx13S6OeXZbwZgoS6D1BBtk=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/angr/default.nix b/pkgs/development/python-modules/angr/default.nix
index f592ba98e390..6f3319e8375f 100644
--- a/pkgs/development/python-modules/angr/default.nix
+++ b/pkgs/development/python-modules/angr/default.nix
@@ -11,7 +11,7 @@
 , cppheaderparser
 , dpkt
 , fetchFromGitHub
-, GitPython
+, gitpython
 , itanium-demangler
 , mulpyplexer
 , nampa
@@ -31,7 +31,7 @@
 
 buildPythonPackage rec {
   pname = "angr";
-  version = "9.2.27";
+  version = "9.2.28";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -40,7 +40,7 @@ buildPythonPackage rec {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-ttq9V+Bhmbeit3OBUquIlLW7HQeCe2+KE/QkuvLJMjE=";
+    hash = "sha256-16/hocVfd2RI8qQ9Qt7EM/gGfyGpWabyZhtfwOscqQY=";
   };
 
   propagatedBuildInputs = [
@@ -53,7 +53,7 @@ buildPythonPackage rec {
     cle
     cppheaderparser
     dpkt
-    GitPython
+    gitpython
     itanium-demangler
     mulpyplexer
     nampa
diff --git a/pkgs/development/python-modules/apache-airflow/default.nix b/pkgs/development/python-modules/apache-airflow/default.nix
index a916ac01144b..cbedbeb70dca 100644
--- a/pkgs/development/python-modules/apache-airflow/default.nix
+++ b/pkgs/development/python-modules/apache-airflow/default.nix
@@ -24,7 +24,7 @@
 , flask-caching
 , flask-session
 , flask-wtf
-, GitPython
+, gitpython
 , graphviz
 , gunicorn
 , httpx
@@ -160,7 +160,7 @@ buildPythonPackage rec {
     flask-session
     flask-wtf
     flask-login
-    GitPython
+    gitpython
     graphviz
     gunicorn
     httpx
diff --git a/pkgs/development/python-modules/archinfo/default.nix b/pkgs/development/python-modules/archinfo/default.nix
index 7081f426c66f..0c81edc1cc22 100644
--- a/pkgs/development/python-modules/archinfo/default.nix
+++ b/pkgs/development/python-modules/archinfo/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "archinfo";
-  version = "9.2.27";
+  version = "9.2.28";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "angr";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-dzD73jmbeQQY/IjF6XRdOcDIhR2lzeA2XQdipssiT00=";
+    hash = "sha256-LUrLO9BFbpB2p6PtTZPdpLsGHPh088aPHIyoxgv4dGg=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/asysocks/default.nix b/pkgs/development/python-modules/asysocks/default.nix
index e4f5f8758b1c..863a2fd5417f 100644
--- a/pkgs/development/python-modules/asysocks/default.nix
+++ b/pkgs/development/python-modules/asysocks/default.nix
@@ -7,14 +7,14 @@
 
 buildPythonPackage rec {
   pname = "asysocks";
-  version = "0.2.2";
+  version = "0.2.3";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-rhqML/w8Hp8xZogjc2ZD+Y9C9c/w1e4X7WNoFaLz9Ps=";
+    hash = "sha256-JHGkQmxt/29GRnVS/GLU1g5Yc+q6voKNOh3n3LfcfcY=";
   };
 
   propagatedBuildInputs = [
@@ -31,6 +31,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Python Socks4/5 client and server library";
     homepage = "https://github.com/skelsec/asysocks";
+    changelog = "https://github.com/skelsec/asysocks/releases/tag/${version}";
     license = with licenses; [ mit ];
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/azure-storage-queue/default.nix b/pkgs/development/python-modules/azure-storage-queue/default.nix
index 515b3f398dfd..aa69731809ba 100644
--- a/pkgs/development/python-modules/azure-storage-queue/default.nix
+++ b/pkgs/development/python-modules/azure-storage-queue/default.nix
@@ -3,20 +3,23 @@
 , fetchPypi
 , azure-common
 , azure-storage-common
+, msrest
 }:
 
 buildPythonPackage rec {
   pname = "azure-storage-queue";
-  version = "2.1.0";
+  version = "12.5.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "14e82d3691f1bbd23f2aff143a6c17af3c297164f6e597d223b65a67051ba278";
+    sha256 = "sha256-OzdEJK9y0y2v+Lr5tkYwB0w6iz/VMypFIWs7yWvHsXI=";
+    extension = "zip";
   };
 
   propagatedBuildInputs = [
     azure-common
     azure-storage-common
+    msrest
   ];
 
   # has no tests
diff --git a/pkgs/development/python-modules/bandit/default.nix b/pkgs/development/python-modules/bandit/default.nix
index cf1bbd9c54aa..73de9a4688d0 100644
--- a/pkgs/development/python-modules/bandit/default.nix
+++ b/pkgs/development/python-modules/bandit/default.nix
@@ -1,31 +1,35 @@
-{ buildPythonPackage
+{ lib
+, buildPythonPackage
 , fetchPypi
-, lib
 , isPy3k
-
-# pythonPackages
-, GitPython
+, pythonOlder
+, gitpython
 , pbr
 , pyyaml
-, six
+, rich
 , stevedore
 }:
 
 buildPythonPackage rec {
   pname = "bandit";
   version = "1.7.4";
-  disabled = !isPy3k;
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-LWOoxXNBe64ziWLUubBvvGCA907NlVoJKEnh5lxxe9I=";
+    hash = "sha256-LWOoxXNBe64ziWLUubBvvGCA907NlVoJKEnh5lxxe9I=";
   };
 
-  propagatedBuildInputs = [
-    GitPython
+  nativeBuildInputs = [
     pbr
+  ];
+
+  propagatedBuildInputs = [
+    gitpython
     pyyaml
-    six
+    rich
     stevedore
   ];
 
@@ -33,12 +37,15 @@ buildPythonPackage rec {
   #   and this requires Network Connectivity
   doCheck = false;
 
-  meta = {
+  pythonImportsCheck = [
+    "bandit"
+  ];
+
+  meta = with lib; {
     description = "Security oriented static analyser for python code";
-    homepage = "https://bandit.readthedocs.io/en/latest/";
-    license = lib.licenses.asl20;
-    maintainers = with lib.maintainers; [
-      kamadorueda
-    ];
+    homepage = "https://bandit.readthedocs.io/";
+    changelog = "https://github.com/PyCQA/bandit/releases/tag/${version}";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ kamadorueda ];
   };
 }
diff --git a/pkgs/development/python-modules/bellows/default.nix b/pkgs/development/python-modules/bellows/default.nix
index 1125e45e6282..041af30ddfd9 100644
--- a/pkgs/development/python-modules/bellows/default.nix
+++ b/pkgs/development/python-modules/bellows/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "bellows";
-  version = "0.34.4";
+  version = "0.34.5";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     owner = "zigpy";
     repo = "bellows";
     rev = "refs/tags/${version}";
-    hash = "sha256-JUI2jUUc2i+/6mRYNhmuAOmAS4nCzMZwyM8ug0pOFfc=";
+    hash = "sha256-GJG3rmJoBxDrqzsNY2r1cEywRfB4tlLn2DDsaDEI3Bo=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/bleak-retry-connector/default.nix b/pkgs/development/python-modules/bleak-retry-connector/default.nix
index b040ef83d9d9..6961a9c93221 100644
--- a/pkgs/development/python-modules/bleak-retry-connector/default.nix
+++ b/pkgs/development/python-modules/bleak-retry-connector/default.nix
@@ -1,6 +1,7 @@
 { lib
 , async-timeout
 , bleak
+, bluetooth-adapters
 , dbus-fast
 , buildPythonPackage
 , fetchFromGitHub
@@ -12,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "bleak-retry-connector";
-  version = "2.9.0";
+  version = "2.10.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -21,7 +22,7 @@ buildPythonPackage rec {
     owner = "Bluetooth-Devices";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-U9Urxu7BdTTecONcb2d6jg9oE6fmdNMEVSayLNQiyvY=";
+    hash = "sha256-QAQQ53T3MTNNaK0rzsBb2F1/qMvMHtr6/+3k1CAKXi0=";
   };
 
   postPatch = ''
@@ -36,6 +37,7 @@ buildPythonPackage rec {
   propagatedBuildInputs = [
     async-timeout
     bleak
+    bluetooth-adapters
     dbus-fast
   ];
 
diff --git a/pkgs/development/python-modules/bluetooth-adapters/default.nix b/pkgs/development/python-modules/bluetooth-adapters/default.nix
index b696b6b9369e..6e750422120f 100644
--- a/pkgs/development/python-modules/bluetooth-adapters/default.nix
+++ b/pkgs/development/python-modules/bluetooth-adapters/default.nix
@@ -3,18 +3,21 @@
 , pythonOlder
 , fetchFromGitHub
 , poetry-core
+, aiohttp
 , async-timeout
 , bleak
 , dbus-fast
+, mac-vendor-lookup
 , myst-parser
 , pytestCheckHook
 , sphinxHook
 , sphinx-rtd-theme
+, usb-devices
 }:
 
 buildPythonPackage rec {
   pname = "bluetooth-adapters";
-  version = "0.8.0";
+  version = "0.12.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
@@ -23,7 +26,7 @@ buildPythonPackage rec {
     owner = "Bluetooth-Devices";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-K5EeDcGcjrZYQTbuYAzT7XhcAqpYW1w/jP5T0cOPsVU=";
+    hash = "sha256-meBCjWKAIN6sNrBp/Riptu9igvVwIPf0G2x+Z3Kqkts=";
   };
 
   postPatch = ''
@@ -44,9 +47,12 @@ buildPythonPackage rec {
   ];
 
   propagatedBuildInputs = [
+    aiohttp
     async-timeout
     bleak
     dbus-fast
+    mac-vendor-lookup
+    usb-devices
   ];
 
   pythonImportsCheck = [
diff --git a/pkgs/development/python-modules/bluetooth-auto-recovery/default.nix b/pkgs/development/python-modules/bluetooth-auto-recovery/default.nix
index a4353a19204f..3a673c9c264b 100644
--- a/pkgs/development/python-modules/bluetooth-auto-recovery/default.nix
+++ b/pkgs/development/python-modules/bluetooth-auto-recovery/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "bluetooth-auto-recovery";
-  version = "0.5.1";
+  version = "0.5.4";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "Bluetooth-Devices";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-LvLav3OCud1EZe3JXvjbuuKU9xtd6ywrx6pZLLP0N/A=";
+    hash = "sha256-C3CO4nqKVTjD07QturJNeg0GLx2N9cbsBatXcehJLRs=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/btrfsutil/default.nix b/pkgs/development/python-modules/btrfsutil/default.nix
new file mode 100644
index 000000000000..d529ec09c705
--- /dev/null
+++ b/pkgs/development/python-modules/btrfsutil/default.nix
@@ -0,0 +1,26 @@
+{ lib
+, buildPythonPackage
+, btrfs-progs
+}:
+buildPythonPackage {
+  pname = "btrfsutil";
+  inherit (btrfs-progs) version src;
+  format = "setuptools";
+
+  buildInputs = [ btrfs-progs ];
+
+  preConfigure = ''
+    cd libbtrfsutil/python
+  '';
+
+  # No tests
+  doCheck = false;
+  pythonImportsCheck = [ "btrfsutil" ];
+
+  meta = with lib; {
+    description = "Library for managing Btrfs filesystems";
+    homepage = "https://btrfs.wiki.kernel.org/";
+    license = licenses.lgpl21Plus;
+    maintainers = with maintainers; [ raskin lopsided98 ];
+  };
+}
diff --git a/pkgs/development/python-modules/bundlewrap/default.nix b/pkgs/development/python-modules/bundlewrap/default.nix
index e4eae0d3fe75..75e3cd4f4b3b 100644
--- a/pkgs/development/python-modules/bundlewrap/default.nix
+++ b/pkgs/development/python-modules/bundlewrap/default.nix
@@ -32,7 +32,7 @@ buildPythonPackage rec {
   nativeBuildInputs = [ setuptools ];
   propagatedBuildInputs = [
     cryptography jinja2 Mako passlib pyyaml requests tomlkit librouteros
-  ] ++ lib.optional (pythonOlder "3.11") [ rtoml ];
+  ] ++ lib.optionals (pythonOlder "3.11") [ rtoml ];
 
   pythonImportsCheck = [ "bundlewrap" ];
 
diff --git a/pkgs/development/python-modules/cccolutils/default.nix b/pkgs/development/python-modules/cccolutils/default.nix
index e231624e40f8..2e3e1778d175 100644
--- a/pkgs/development/python-modules/cccolutils/default.nix
+++ b/pkgs/development/python-modules/cccolutils/default.nix
@@ -1,23 +1,49 @@
-{ lib, buildPythonPackage, fetchPypi, isPy3k, krb5Full, nose, GitPython, mock, git }:
+{ lib
+, buildPythonPackage
+, fetchPypi
+, git
+, gitpython
+, krb5
+, mock
+, pytestCheckHook
+, pythonOlder
+}:
 
 buildPythonPackage rec {
-  pname = "CCColUtils";
+  pname = "cccolutils";
   version = "1.5";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
-    inherit pname version;
-    sha256 = "1gwcq4xan9as1j3q9k2zqrywxp46qx0ljwxbck9id2fvilds6ck3";
+    pname = "CCColUtils";
+    inherit version;
+    hash = "sha256-YzKjG43biRbTZKtzSUHHhtzOfcZfzISHDFolqzrBjL8=";
   };
 
-  buildInputs = [ krb5Full ];
-  propagatedBuildInputs = [ nose GitPython mock git ];
+  buildInputs = [
+    krb5
+  ];
+
+  propagatedBuildInputs = [
+    git
+    gitpython
+    mock
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+  ];
 
-  doCheck = isPy3k; # needs unpackaged module to run tests on python2
+  pythonImportsCheck = [
+    "cccolutils"
+  ];
 
   meta = with lib; {
     description = "Python Kerberos 5 Credential Cache Collection Utilities";
     homepage = "https://pagure.io/cccolutils";
-    license = licenses.gpl2;
+    license = licenses.gpl2Plus;
     maintainers = with maintainers; [ disassembler ];
   };
 }
diff --git a/pkgs/development/python-modules/chat-downloader/default.nix b/pkgs/development/python-modules/chat-downloader/default.nix
index 5b8a75c7c123..741ed3791368 100644
--- a/pkgs/development/python-modules/chat-downloader/default.nix
+++ b/pkgs/development/python-modules/chat-downloader/default.nix
@@ -11,12 +11,12 @@
 
 buildPythonPackage rec {
   pname = "chat-downloader";
-  version = "0.2.2";
+  version = "0.2.3";
   format = "setuptools";
 
   src = fetchPypi {
     inherit version pname;
-    sha256 = "f095cd90c312eecec647de2ff49f3ef4cfc30e3935731d21315380f331bdd095";
+    sha256 = "e19f961480b14b55d03d4d4aaa766d46131bdf2ea8a79b47d20037dfd980201a";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/claripy/default.nix b/pkgs/development/python-modules/claripy/default.nix
index 9afd28132e15..5ccf2e257438 100644
--- a/pkgs/development/python-modules/claripy/default.nix
+++ b/pkgs/development/python-modules/claripy/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "claripy";
-  version = "9.2.27";
+  version = "9.2.28";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
     owner = "angr";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-7tn/OdPNUnbF2T0wASCBfuTZ0zI1j8GY5kh0QwbzS+8=";
+    hash = "sha256-CGYX8IzVBqhF0IenTFKtx79J81X6UGkvm/XvFovnHYE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/cle/default.nix b/pkgs/development/python-modules/cle/default.nix
index 88d472a9de7a..1a8a3f2b871e 100644
--- a/pkgs/development/python-modules/cle/default.nix
+++ b/pkgs/development/python-modules/cle/default.nix
@@ -16,7 +16,7 @@
 
 let
   # The binaries are following the argr projects release cycle
-  version = "9.2.27";
+  version = "9.2.28";
 
   # Binary files from https://github.com/angr/binaries (only used for testing and only here)
   binaries = fetchFromGitHub {
@@ -38,7 +38,7 @@ buildPythonPackage rec {
     owner = "angr";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-PP8TdAiyqdcgJNz5jYjAFcuv42ca0zfLwL289XKDqk4=";
+    hash = "sha256-t3TO1rHf5iA+9WW3Adi37fL7XjRUZFPowUWchX9eEVI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/cryptolyzer/default.nix b/pkgs/development/python-modules/cryptolyzer/default.nix
index 2fd90b23bee0..5928a9b90ecf 100644
--- a/pkgs/development/python-modules/cryptolyzer/default.nix
+++ b/pkgs/development/python-modules/cryptolyzer/default.nix
@@ -1,22 +1,26 @@
 { lib
+, attrs
 , buildPythonPackage
-, fetchPypi
 , certvalidator
-, attrs
-, six
-, urllib3
 , cryptoparser
+, fetchPypi
+, pythonOlder
 , requests
+, six
+, urllib3
 }:
 
 buildPythonPackage rec {
   pname = "cryptolyzer";
-  version = "0.8.1";
+  version = "0.8.2";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     pname = "CryptoLyzer";
     inherit version;
-    sha256 = "sha256-FbxSjKxhzlpj3IezuLCQvoeZMG1q+OE/yn5vB/XE1rI=";
+    hash = "sha256-Bo8w9ijJu9IWdgr8OQws2iErzmuxUhs9YE6NAydPYgM=";
   };
 
   propagatedBuildInputs = [
@@ -28,13 +32,17 @@ buildPythonPackage rec {
     requests
   ];
 
-  doCheck = false; # Tests require networking
+  # Tests require networking
+  doCheck = false;
 
-  pythonImportsCheck = [ "cryptolyzer" ];
+  pythonImportsCheck = [
+    "cryptolyzer"
+  ];
 
   meta = with lib; {
-    description = "Fast and flexible cryptographic protocol analyzer";
+    description = "Cryptographic protocol analyzer";
     homepage = "https://gitlab.com/coroner/cryptolyzer";
+    changelog = "https://gitlab.com/coroner/cryptolyzer/-/blob/v${version}/CHANGELOG.md";
     license = licenses.mpl20;
     maintainers = with maintainers; [ kranzes ];
   };
diff --git a/pkgs/development/python-modules/cryptoparser/default.nix b/pkgs/development/python-modules/cryptoparser/default.nix
index cfac7f20376e..c4771b394994 100644
--- a/pkgs/development/python-modules/cryptoparser/default.nix
+++ b/pkgs/development/python-modules/cryptoparser/default.nix
@@ -9,11 +9,11 @@
 
 buildPythonPackage rec {
   pname = "cryptoparser";
-  version = "0.8.0";
+  version = "0.8.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-kJg8d1PoGIC0feefbJM8oyXcRyMGdg1wWkQUl/nSNCo=";
+    hash = "sha256-eLQNqeCUnjcxWbazhWHtqJJgvPUMH42fboU5y2ZMy44=";
   };
 
   propagatedBuildInputs = [
@@ -23,11 +23,14 @@ buildPythonPackage rec {
     python-dateutil
   ];
 
-  pythonImportsCheck = [ "cryptoparser" ];
+  pythonImportsCheck = [
+    "cryptoparser"
+  ];
 
   meta = with lib; {
-    description = "Fast and flexible security protocol parser and generator";
+    description = "Security protocol parser and generator";
     homepage = "https://gitlab.com/coroner/cryptoparser";
+    changelog = "https://gitlab.com/coroner/cryptoparser/-/blob/v${version}/CHANGELOG.md";
     license = licenses.mpl20;
     maintainers = with maintainers; [ kranzes ];
   };
diff --git a/pkgs/development/python-modules/cvelib/default.nix b/pkgs/development/python-modules/cvelib/default.nix
index 49b5c7590691..8bdcb400b96f 100644
--- a/pkgs/development/python-modules/cvelib/default.nix
+++ b/pkgs/development/python-modules/cvelib/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "cvelib";
-  version = "1.1.0";
+  version = "1.2.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "RedHatProductSecurity";
     repo = "cvelib";
     rev = "tags/${version}";
-    hash = "sha256-MZzCTUleEddIlZBRhxD8ZgaWAOFcpa5hvNuIjrBJRzk=";
+    hash = "sha256-8qlXwEbgLRZ1qYtBJ1c0nv6qfIOW5zAK9eOS+n+afWQ=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = "v${version}";
diff --git a/pkgs/development/python-modules/dateparser/default.nix b/pkgs/development/python-modules/dateparser/default.nix
index 7db2e1d15b74..950afaabb8dc 100644
--- a/pkgs/development/python-modules/dateparser/default.nix
+++ b/pkgs/development/python-modules/dateparser/default.nix
@@ -13,7 +13,7 @@
 , langdetect
 , parameterized
 , pytestCheckHook
-, GitPython
+, gitpython
 , parsel
 , requests
 , ruamel-yaml
@@ -50,7 +50,7 @@ buildPythonPackage rec {
   checkInputs = [
     parameterized
     pytestCheckHook
-    GitPython
+    gitpython
     parsel
     requests
     ruamel-yaml
diff --git a/pkgs/development/python-modules/db-dtypes/default.nix b/pkgs/development/python-modules/db-dtypes/default.nix
index 8efa6983150d..db9d6bde1614 100644
--- a/pkgs/development/python-modules/db-dtypes/default.nix
+++ b/pkgs/development/python-modules/db-dtypes/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "db-dtypes";
-  version = "1.0.4";
+  version = "1.0.5";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "googleapis";
     repo = "python-db-dtypes-pandas";
     rev = "refs/tags/v${version}";
-    hash = "sha256-ilcVog6mhF83GVa68BppUzvKNRPdSDXla2MU6M2EzLg=";
+    hash = "sha256-RlSze0e2NNHJ6kAbj9TX58MaEPutyjcLXIOYjpugO6o=";
   };
 
   propagatedBuildInputs = [
@@ -41,6 +41,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Pandas Data Types for SQL systems (BigQuery, Spanner)";
     homepage = "https://github.com/googleapis/python-db-dtypes-pandas";
+    changelog = "https://github.com/googleapis/python-db-dtypes-pandas/blob/v${version}/CHANGELOG.md";
     license = licenses.asl20;
     maintainers = with maintainers; [ SuperSandro2000 ];
   };
diff --git a/pkgs/development/python-modules/django/4.nix b/pkgs/development/python-modules/django/4.nix
index 935abb99c8db..cb6f40e422ce 100644
--- a/pkgs/development/python-modules/django/4.nix
+++ b/pkgs/development/python-modules/django/4.nix
@@ -43,14 +43,14 @@
 
 buildPythonPackage rec {
   pname = "Django";
-  version = "4.1.3";
+  version = "4.1.4";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-Z4u/yGBOskbtVOIGPwdl8TsyGlBSa9yMsflD7af6MfE=";
+    hash = "sha256-04pOEI0jhsuWN9pmqC3I0HM8rt5Mg8Sv29p4r0IUIRs=";
   };
 
   patches = [
@@ -113,6 +113,7 @@ buildPythonPackage rec {
   '';
 
   meta = with lib; {
+    changelog = "https://docs.djangoproject.com/en/${lib.versions.majorMinor version}/releases/${version}/";
     description = "A high-level Python Web framework that encourages rapid development and clean, pragmatic design.";
     homepage = "https://www.djangoproject.com";
     license = licenses.bsd3;
diff --git a/pkgs/development/python-modules/docstring-to-markdown/default.nix b/pkgs/development/python-modules/docstring-to-markdown/default.nix
index 432f77220adc..9a17d19a9d14 100644
--- a/pkgs/development/python-modules/docstring-to-markdown/default.nix
+++ b/pkgs/development/python-modules/docstring-to-markdown/default.nix
@@ -2,17 +2,21 @@
 , buildPythonPackage
 , fetchFromGitHub
 , pytestCheckHook
+, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "docstring-to-markdown";
-  version = "0.10";
+  version = "0.11";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "python-lsp";
     repo = pname;
-    rev = "v${version}";
-    sha256 = "0rflkbms94wkcypjcnz30bc4w4iww91h7sqq3j2b6ypzl4g48csa";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-4Jl1XJpxwbxGWxdF4bOerjHyzHCIHtrydklwwk1WGs4=";
   };
 
   patches = [
@@ -31,6 +35,7 @@ buildPythonPackage rec {
   meta = with lib; {
     homepage = "https://github.com/python-lsp/docstring-to-markdown";
     description = "On the fly conversion of Python docstrings to markdown";
+    changelog = "https://github.com/python-lsp/docstring-to-markdown/releases/tag/v${version}";
     license = licenses.lgpl2Plus;
     maintainers = with maintainers; [ doronbehar ];
   };
diff --git a/pkgs/development/python-modules/flake8-bugbear/default.nix b/pkgs/development/python-modules/flake8-bugbear/default.nix
index d80b703522dc..d1abca2b6e53 100644
--- a/pkgs/development/python-modules/flake8-bugbear/default.nix
+++ b/pkgs/development/python-modules/flake8-bugbear/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "flake8-bugbear";
-  version = "22.10.27";
+  version = "22.12.6";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "PyCQA";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-pzVzCEkndbesX3tzuuPqtpEmCd5/bSuQmJ2J2IPFRMk=";
+    hash = "sha256-/XV0dwCkp1kOrXepEaPPEWefBphGB6rQPeTWmo3cHPY=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/furo/default.nix b/pkgs/development/python-modules/furo/default.nix
index 7ee4c0999b4e..14401f7e53fd 100644
--- a/pkgs/development/python-modules/furo/default.nix
+++ b/pkgs/development/python-modules/furo/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "furo";
-  version = "2022.9.29";
+  version = "2022.12.7";
   format = "wheel";
 
   disable = pythonOlder "3.7";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     inherit pname version format;
     dist = "py3";
     python = "py3";
-    hash = "sha256-VZ7heZnA9ScoSB3PaxsM+Ml0PmjF46GMtFp5knR4aak=";
+    hash = "sha256-fLdsEqJe9l24WrB0PfkHVz0DAnozYx8X0mflmOuxkfc=";
   };
 
   propagatedBuildInputs = [
@@ -45,6 +45,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "A clean customizable documentation theme for Sphinx";
     homepage = "https://github.com/pradyunsg/furo";
+    changelog = "https://github.com/pradyunsg/furo/blob/${version}/docs/changelog.md";
     license = licenses.mit;
     maintainers = with maintainers; [ Luflosi ];
   };
diff --git a/pkgs/development/python-modules/gamble/default.nix b/pkgs/development/python-modules/gamble/default.nix
index 0df84510efd4..3b62893e149f 100644
--- a/pkgs/development/python-modules/gamble/default.nix
+++ b/pkgs/development/python-modules/gamble/default.nix
@@ -7,12 +7,14 @@
 
 buildPythonPackage rec {
   pname = "gamble";
-  version = "0.10";
-  disabled = pythonOlder "3.6";
+  version = "0.11";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1lb5x076blnnz2hj7k92pyq0drbjwsls6pmnabpvyvs4ddhz5w9w";
+    hash = "sha256-zsEBqhKidgO1e0lpKhw+LY75I2Df+IefNLaSkBBFKFU=";
   };
 
   checkInputs = [
@@ -26,6 +28,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Collection of gambling classes/tools";
     homepage = "https://github.com/jpetrucciani/gamble";
+    changelog = "https://github.com/jpetrucciani/gamble/releases/tag/${version}";
     license = licenses.mit;
     maintainers = with maintainers; [ jpetrucciani ];
   };
diff --git a/pkgs/development/python-modules/gcal-sync/default.nix b/pkgs/development/python-modules/gcal-sync/default.nix
index 5e4b40e612bc..110b04f658df 100644
--- a/pkgs/development/python-modules/gcal-sync/default.nix
+++ b/pkgs/development/python-modules/gcal-sync/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "gcal-sync";
-  version = "4.0.3";
+  version = "4.0.4";
   format = "setuptools";
 
   disabled = pythonOlder "3.9";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "allenporter";
     repo = "gcal_sync";
     rev = "refs/tags/${version}";
-    hash = "sha256-FDxyuSR0Ekal/3+OhR3Z0pkiWYMToeCcfwBQp3bjnyw=";
+    hash = "sha256-g0hnwUX33qZ36JgKx3KHP3BciYujQ+Eahe6bF3m87FM=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/git-sweep/default.nix b/pkgs/development/python-modules/git-sweep/default.nix
index 2d7da28535cf..0f223b03760a 100644
--- a/pkgs/development/python-modules/git-sweep/default.nix
+++ b/pkgs/development/python-modules/git-sweep/default.nix
@@ -1,24 +1,32 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, GitPython
+, gitpython
+, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "git-sweep";
   version = "0.1.1";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1csp0zd049d643d409rfivbswwzrayb4i6gkypp5mc27fb1z2afd";
+    hash = "sha256-zSnxw3JHsFru9fOZSJZX+XOu144uJ0DaIKYlAtoHV7M=";
   };
 
-  propagatedBuildInputs = [ GitPython ];
+  propagatedBuildInputs = [
+    gitpython
+  ];
 
-  # no tests
+  # Module has no tests
   doCheck = false;
 
-  pythonImportsCheck = [ "gitsweep" ];
+  pythonImportsCheck = [
+    "gitsweep"
+  ];
 
   meta = with lib; {
     description = "A command-line tool that helps you clean up Git branches";
@@ -26,5 +34,4 @@ buildPythonPackage rec {
     license = licenses.mit;
     maintainers = with maintainers; [ pSub ];
   };
-
 }
diff --git a/pkgs/development/python-modules/GitPython/default.nix b/pkgs/development/python-modules/gitpython/default.nix
index 8d89c1af8d0c..e577a1e508a4 100644
--- a/pkgs/development/python-modules/GitPython/default.nix
+++ b/pkgs/development/python-modules/gitpython/default.nix
@@ -1,44 +1,47 @@
 { lib
 , buildPythonPackage
+, ddt
 , fetchFromGitHub
-, substituteAll
-, git
 , gitdb
-, ddt
+, pkgs
 , pythonOlder
+, substituteAll
 , typing-extensions
 }:
 
 buildPythonPackage rec {
   pname = "gitpython";
-  version = "3.1.27";
+  version = "3.1.29";
+  format = "setuptools";
+
   disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "gitpython-developers";
     repo = "GitPython";
     rev = version;
-    sha256 = "sha256-RA+6JFXHUQoXGErV8+aYuJPsfXzNSZK3kTm6eMbQIss=";
+    hash = "sha256-RNDBoGWnkirPZjxn5oqH3zwYqVFLedNrSRpZOHU0j+w=";
   };
 
-  patches = [
-    (substituteAll {
-      src = ./hardcode-git-path.patch;
-      inherit git;
-    })
-  ];
-
   propagatedBuildInputs = [
-    gitdb
     ddt
+    gitdb
+    pkgs.gitMinimal
   ] ++ lib.optionals (pythonOlder "3.10") [
     typing-extensions
   ];
 
+  postPatch = ''
+    substituteInPlace git/cmd.py \
+      --replace 'git_exec_name = "git"' 'git_exec_name = "${pkgs.gitMinimal}/bin/git"'
+  '';
+
   # Tests require a git repo
   doCheck = false;
 
-  pythonImportsCheck = [ "git" ];
+  pythonImportsCheck = [
+    "git"
+  ];
 
   meta = with lib; {
     description = "Python Git Library";
diff --git a/pkgs/development/python-modules/google-cloud-bigtable/default.nix b/pkgs/development/python-modules/google-cloud-bigtable/default.nix
index b45eb0ce1201..9b785a61c907 100644
--- a/pkgs/development/python-modules/google-cloud-bigtable/default.nix
+++ b/pkgs/development/python-modules/google-cloud-bigtable/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-bigtable";
-  version = "2.13.2";
+  version = "2.14.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-a0R8CefN6gtIYqtNdCW9QKJulsbDnH6dFuUfTp8jUnA=";
+    hash = "sha256-hJgEFRr65eGuV0xx/4leyBZzdd9jt/SEKm3MApzHCGA=";
   };
 
   propagatedBuildInputs = [
@@ -54,6 +54,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Google Cloud Bigtable API client library";
     homepage = "https://github.com/googleapis/python-bigtable";
+    changelog = "https://github.com/googleapis/python-bigtable/blob/v${version}/CHANGELOG.md";
     license = licenses.asl20;
     maintainers = with maintainers; [ costrouc ];
   };
diff --git a/pkgs/development/python-modules/google-cloud-logging/default.nix b/pkgs/development/python-modules/google-cloud-logging/default.nix
index 7fbc6ad0bb51..2fb93c8a73d1 100644
--- a/pkgs/development/python-modules/google-cloud-logging/default.nix
+++ b/pkgs/development/python-modules/google-cloud-logging/default.nix
@@ -19,14 +19,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-logging";
-  version = "3.3.0";
+  version = "3.3.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-qr2RiIFl1njOOhoblub93foMQ63xpgp9Wj5p0SoLoHw=";
+    hash = "sha256-bxFBWi6cx7TeeofMP59XVRX9aDpCP2N5lAkUpWYW1wU=";
   };
 
   propagatedBuildInputs = [
@@ -68,6 +68,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Stackdriver Logging API client library";
     homepage = "https://github.com/googleapis/python-logging";
+    changelog = "https://github.com/googleapis/python-logging/blob/v${version}/CHANGELOG.md";
     license = licenses.asl20;
     maintainers = with maintainers; [ SuperSandro2000 ];
   };
diff --git a/pkgs/development/python-modules/google-cloud-spanner/default.nix b/pkgs/development/python-modules/google-cloud-spanner/default.nix
index 8272416b29f2..2704b357004c 100644
--- a/pkgs/development/python-modules/google-cloud-spanner/default.nix
+++ b/pkgs/development/python-modules/google-cloud-spanner/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-spanner";
-  version = "3.23.0";
+  version = "3.24.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-1RHzpCRYU2dUxZLa+zzopHd+xfnq7eWF6HDIkVk+2NY=";
+    hash = "sha256-Ko/9gfcR7BBX+U60vlWgdh4d1xptUJRRyWmAGq6a4/E=";
   };
 
   propagatedBuildInputs = [
@@ -69,6 +69,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Cloud Spanner API client library";
     homepage = "https://github.com/googleapis/python-spanner";
+    changelog = "https://github.com/googleapis/python-spanner/blob/v${version}/CHANGELOG.md";
     license = licenses.asl20;
     maintainers = with maintainers; [ SuperSandro2000 ];
   };
diff --git a/pkgs/development/python-modules/greeclimate/default.nix b/pkgs/development/python-modules/greeclimate/default.nix
index c2da89dc6c44..2059d7c092f8 100644
--- a/pkgs/development/python-modules/greeclimate/default.nix
+++ b/pkgs/development/python-modules/greeclimate/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "greeclimate";
-  version = "1.3.0";
+  version = "1.4.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "cmroche";
     repo = "greeclimate";
     rev = "refs/tags/v${version}";
-    hash = "sha256-4kR3Hc5M4FDG/WFtIW20a9d0vwLzmqtrlhd+teMiejA=";
+    hash = "sha256-UBkfe4d+K+730TbvModZF1ET7uxMpQGxOkq0PF/WiWc=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/gsd/default.nix b/pkgs/development/python-modules/gsd/default.nix
index ab64a78c103f..a2543ae227bd 100644
--- a/pkgs/development/python-modules/gsd/default.nix
+++ b/pkgs/development/python-modules/gsd/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "gsd";
-  version = "2.6.1";
+  version = "2.7.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "glotzerlab";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-vQutfkSilfgRHuu/THWMG6bmkT1eKlAAniQM4DP8mqI=";
+    hash = "sha256-drzmlHfU2ut3o7JASvFbEcf6OVtWa8kAyzpeDV5iGlc=";
   };
 
   nativeBuildInputs = [
@@ -49,6 +49,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "General simulation data file format";
     homepage = "https://github.com/glotzerlab/gsd";
+    changelog = "https://github.com/glotzerlab/gsd/blob/v${version}/CHANGELOG.rst";
     license = licenses.bsd2;
     maintainers = with maintainers; [ costrouc ];
   };
diff --git a/pkgs/development/python-modules/gspread/default.nix b/pkgs/development/python-modules/gspread/default.nix
index 35133847139c..c38746299c5d 100644
--- a/pkgs/development/python-modules/gspread/default.nix
+++ b/pkgs/development/python-modules/gspread/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "gspread";
-  version = "5.7.1";
+  version = "5.7.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-XznXohg0O2UU8G4iUODEE+tOgU3eaqv0hdrLaqMcqrA=";
+    hash = "sha256-znb5wWuIzLeSNQFCIkpZr6jmn3Rj89NBcUjL6JLvx8s=";
   };
 
   propagatedBuildInputs = [
@@ -35,6 +35,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Google Spreadsheets client library";
     homepage = "https://github.com/burnash/gspread";
+    changelog = "https://github.com/burnash/gspread/blob/v${version}/HISTORY.rst";
     license = licenses.mit;
     maintainers = with maintainers; [ ];
   };
diff --git a/pkgs/development/python-modules/gssapi/default.nix b/pkgs/development/python-modules/gssapi/default.nix
index f703820a4f5c..16c6eb513c6d 100644
--- a/pkgs/development/python-modules/gssapi/default.nix
+++ b/pkgs/development/python-modules/gssapi/default.nix
@@ -6,7 +6,7 @@
 , six
 , decorator
 , nose
-, krb5Full
+, krb5
 , GSS
 , parameterized
 , shouldbe
@@ -30,12 +30,12 @@ buildPythonPackage rec {
   # It's used to locate headers
   postPatch = ''
     substituteInPlace setup.py \
-      --replace 'get_output(f"{kc} gssapi --prefix")' '"${lib.getDev krb5Full}"'
+      --replace 'get_output(f"{kc} gssapi --prefix")' '"${lib.getDev krb5}"'
   '';
 
   nativeBuildInputs = [
     cython
-    krb5Full
+    krb5
   ];
 
   propagatedBuildInputs =  [
diff --git a/pkgs/development/python-modules/hass-nabucasa/default.nix b/pkgs/development/python-modules/hass-nabucasa/default.nix
index a1c07368c0de..375e975d969a 100644
--- a/pkgs/development/python-modules/hass-nabucasa/default.nix
+++ b/pkgs/development/python-modules/hass-nabucasa/default.nix
@@ -15,19 +15,18 @@
 
 buildPythonPackage rec {
   pname = "hass-nabucasa";
-  version = "0.56.0";
+  version = "0.61.0";
 
   src = fetchFromGitHub {
     owner = "nabucasa";
     repo = pname;
     rev = version;
-    sha256 = "sha256-IgDOugHr4fCD9o3QQY5w/ibjak/d56R31KgQAbjUkkI=";
+    sha256 = "sha256-KG2eCwGZWVtepJQdsSwFziWsT1AbV6rYWRIO/I/CR8g=";
   };
 
   postPatch = ''
     substituteInPlace setup.py \
       --replace "acme==" "acme>=" \
-      --replace "cryptography>=2.8,<38.0" "cryptography" \
       --replace "pycognito==" "pycognito>=" \
       --replace "snitun==" "snitun>=" \
   '';
diff --git a/pkgs/development/python-modules/home-assistant-bluetooth/default.nix b/pkgs/development/python-modules/home-assistant-bluetooth/default.nix
index 4b0a9b660cfb..68261007b7c5 100644
--- a/pkgs/development/python-modules/home-assistant-bluetooth/default.nix
+++ b/pkgs/development/python-modules/home-assistant-bluetooth/default.nix
@@ -2,14 +2,16 @@
 , buildPythonPackage
 , fetchFromGitHub
 , pythonOlder
+, cython
 , poetry-core
+, setuptools
 , bleak
 , pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "home-assistant-bluetooth";
-  version = "1.6.0";
+  version = "1.8.1";
   format = "pyproject";
   disabled = pythonOlder "3.9";
 
@@ -17,7 +19,7 @@ buildPythonPackage rec {
     owner = "home-assistant-libs";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-6w940Yn0WgVC0Rn9OX40+6hO4maPSC7VrT3ARD8CIjQ=";
+    hash = "sha256-oOrsZmAXLYsJ19DrQ70O0RpeSz8Jn8oD41Tsc5DVUng=";
   };
 
   postPatch = ''
@@ -26,7 +28,9 @@ buildPythonPackage rec {
   '';
 
   nativeBuildInputs = [
+    cython
     poetry-core
+    setuptools
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/homematicip/default.nix b/pkgs/development/python-modules/homematicip/default.nix
index 50819a3c3444..3f983681316e 100644
--- a/pkgs/development/python-modules/homematicip/default.nix
+++ b/pkgs/development/python-modules/homematicip/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "homematicip";
-  version = "1.0.12";
+  version = "1.0.13";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "hahn-th";
     repo = "homematicip-rest-api";
     rev = "refs/tags/${version}";
-    hash = "sha256-gad+sg5MZvAzy1xE+xF/4GdLClB5EiyPH39nIlhO7IQ=";
+    hash = "sha256-bNVvQbwtef7Q0OBtR/8vsDDPkgGQgzdBC3QyoxLW3Wo=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/ical/default.nix b/pkgs/development/python-modules/ical/default.nix
index f11dd0e87642..9c12520e9718 100644
--- a/pkgs/development/python-modules/ical/default.nix
+++ b/pkgs/development/python-modules/ical/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "ical";
-  version = "4.1.2";
+  version = "4.2.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.9";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     owner = "allenporter";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-kbPiyHu8k0cIkeX1XF2p5yQwiDvEWJhclENQly5QJa0=";
+    hash = "sha256-YvBcfrZiHTornCEAFhNLN/siNvl119pD+o+0yNsRBA8=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/intellifire4py/default.nix b/pkgs/development/python-modules/intellifire4py/default.nix
index f0b702b1b513..f17af2b24fa5 100644
--- a/pkgs/development/python-modules/intellifire4py/default.nix
+++ b/pkgs/development/python-modules/intellifire4py/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "intellifire4py";
-  version = "2.2.1";
+  version = "2.2.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -21,8 +21,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "jeeftor";
     repo = pname;
-    rev = version;
-    hash = "sha256-dn5814eRZ9456Fn7blf1UzXPii4dXu3sjoXBV7CmwSs=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-iqlKfpnETLqQwy5sNcK2x/TgmuN2hCfYoHEFK2WWVXI=";
   };
 
   propagatedBuildInputs = [
@@ -50,6 +50,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Module to read Intellifire fireplace status data";
     homepage = "https://github.com/jeeftor/intellifire4py";
+    changelog = "https://github.com/jeeftor/intellifire4py/blob/${version}/CHANGELOG";
     license = with licenses; [ mit ];
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/json-schema-for-humans/default.nix b/pkgs/development/python-modules/json-schema-for-humans/default.nix
index f420aefd7df9..47cd5fed605a 100644
--- a/pkgs/development/python-modules/json-schema-for-humans/default.nix
+++ b/pkgs/development/python-modules/json-schema-for-humans/default.nix
@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "json-schema-for-humans";
-  version = "0.42.1";
+  version = "0.44";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -26,8 +26,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "coveooss";
     repo = pname;
-    rev = "v${version}";
-    hash = "sha256-WVLIx85ivHz5b6C1AfgMAApngeFCuWwWhaBWNcfOvXA=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-LsZPf5PVXPSyHNgfBdjH4hG4OFIdSprO5uj3saPDqzo=";
   };
 
   postPatch = ''
@@ -70,6 +70,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Quickly generate HTML documentation from a JSON schema";
     homepage = "https://github.com/coveooss/json-schema-for-humans";
+    changelog = "https://github.com/coveooss/json-schema-for-humans/releases/tag/v${version}";
     license = licenses.asl20;
     maintainers = with maintainers; [ astro ];
   };
diff --git a/pkgs/development/python-modules/jupyterlab_server/default.nix b/pkgs/development/python-modules/jupyterlab_server/default.nix
index c7a294eef44f..cc709c4f47a3 100644
--- a/pkgs/development/python-modules/jupyterlab_server/default.nix
+++ b/pkgs/development/python-modules/jupyterlab_server/default.nix
@@ -40,7 +40,7 @@ buildPythonPackage rec {
     babel
     jupyter_server
     tomli
-  ] ++ lib.optional (pythonOlder "3.10") [
+  ] ++ lib.optionals (pythonOlder "3.10") [
     importlib-metadata
   ];
 
diff --git a/pkgs/development/python-modules/jupytext/default.nix b/pkgs/development/python-modules/jupytext/default.nix
index dabbe303e161..dc5b56c3c010 100644
--- a/pkgs/development/python-modules/jupytext/default.nix
+++ b/pkgs/development/python-modules/jupytext/default.nix
@@ -3,7 +3,7 @@
 , buildPythonPackage
 , fetchFromGitHub
 , fetchpatch
-, GitPython
+, gitpython
 , isort
 , jupyter-client
 , jupyter-packaging
@@ -29,7 +29,7 @@ buildPythonPackage rec {
     owner = "mwouts";
     repo = pname;
     rev = "refs/tags/v${version}";
-    sha256 = "sha256-DDF4aTLkhEl4xViYh/E0/y6swcwZ9KbeS0qKm+HdFz8=";
+    hash = "sha256-DDF4aTLkhEl4xViYh/E0/y6swcwZ9KbeS0qKm+HdFz8=";
   };
 
   patches = [
@@ -53,7 +53,7 @@ buildPythonPackage rec {
   ];
 
   checkInputs = [
-    GitPython
+    gitpython
     isort
     jupyter-client
     notebook
diff --git a/pkgs/development/python-modules/k5test/default.nix b/pkgs/development/python-modules/k5test/default.nix
index 6123f4d410f6..6c2e8466a1de 100644
--- a/pkgs/development/python-modules/k5test/default.nix
+++ b/pkgs/development/python-modules/k5test/default.nix
@@ -3,7 +3,7 @@
 , buildPythonPackage
 , fetchPypi
 , substituteAll
-, krb5Full
+, krb5
 , findutils
 , which
 , pythonOlder
@@ -23,9 +23,9 @@ buildPythonPackage rec {
   patches = [
     (substituteAll {
       src = ./fix-paths.patch;
-      inherit findutils krb5Full;
+      inherit findutils krb5;
       # krb5-config is in dev output
-      krb5FullDev = krb5Full.dev;
+      krb5Dev = krb5.dev;
       which = "${which}/bin/which";
     })
   ];
diff --git a/pkgs/development/python-modules/k5test/fix-paths.patch b/pkgs/development/python-modules/k5test/fix-paths.patch
index dc6caf815809..c455ecf00ef7 100644
--- a/pkgs/development/python-modules/k5test/fix-paths.patch
+++ b/pkgs/development/python-modules/k5test/fix-paths.patch
@@ -7,13 +7,13 @@ index e289fac..e2f486a 100644
      # if there was no LD_LIBRARY_PATH, or the above failed
      if _PLUGIN_DIR is None:
 -        lib_dir = os.path.join(get_output('krb5-config --prefix'), 'lib64')
-+        lib_dir = os.path.join(get_output('@krb5FullDev@/bin/krb5-config --prefix'), 'lib64')
++        lib_dir = os.path.join(get_output('@krb5Dev@/bin/krb5-config --prefix'), 'lib64')
          _PLUGIN_DIR = _decide_plugin_dir(_find_plugin_dirs_installed(lib_dir))
  
      # /usr/lib64 seems only to be distinct on Fedora/RHEL/Centos family
      if _PLUGIN_DIR is None:
 -        lib_dir = os.path.join(get_output('krb5-config --prefix'), 'lib')
-+        lib_dir = os.path.join(get_output('@krb5FullDev@/bin/krb5-config --prefix'), 'lib')
++        lib_dir = os.path.join(get_output('@krb5Dev@/bin/krb5-config --prefix'), 'lib')
          _PLUGIN_DIR = _decide_plugin_dir(_find_plugin_dirs_installed(lib_dir))
  
      if _PLUGIN_DIR is not None:
@@ -53,7 +53,7 @@ index 161e5ad..9f50049 100644
          if provider_cls == K5Realm:
              krb5_config = _discover_path('krb5-config',
 -                                         '/usr/bin/krb5-config', kwargs)
-+                                         '@krb5Full@/bin/krb5-config', kwargs)
++                                         '@krb5@/bin/krb5-config', kwargs)
  
              try:
                  krb5_version = subprocess.check_output(
@@ -62,7 +62,7 @@ index 161e5ad..9f50049 100644
                  if 'heimdal' in krb5_version.lower() or (
                          sys.platform == 'darwin' and
 -                        krb5_config == '/usr/bin/krb5-config'):
-+                        krb5_config == '@krb5Full@/bin/krb5-config'):
++                        krb5_config == '@krb5@/bin/krb5-config'):
                      provider_cls = HeimdalRealm
                  else:
                      provider_cls = MITRealm
@@ -78,14 +78,14 @@ index 161e5ad..9f50049 100644
 -            ('kprop', 'kprop', '/usr/sbin/kprop'),
 -            ('_kinit', 'kinit', '/usr/bin/kinit'),
 -            ('_klist', 'klist', '/usr/bin/klist'),
-+            ('kdb5_util', 'kdb5_util', '@krb5Full@/bin/kdb5_util'),
-+            ('krb5kdc', 'krb5kdc', '@krb5Full@/bin/kdb5kdc'),
-+            ('kadmin', 'kadmin', '@krb5Full@/bin/admin'),
-+            ('kadmin_local', 'kadmin.local', '@krb5Full@/bin/kadmin.local'),
-+            ('kadmind', 'kadmind', '@krb5Full@/bin/kadmind'),
-+            ('kprop', 'kprop', '@krb5Full@/bin/kprop'),
-+            ('_kinit', 'kinit', '@krb5Full@/bin/kinit'),
-+            ('_klist', 'klist', '@krb5Full@/bin/klist'),
++            ('kdb5_util', 'kdb5_util', '@krb5@/bin/kdb5_util'),
++            ('krb5kdc', 'krb5kdc', '@krb5@/bin/kdb5kdc'),
++            ('kadmin', 'kadmin', '@krb5@/bin/admin'),
++            ('kadmin_local', 'kadmin.local', '@krb5@/bin/kadmin.local'),
++            ('kadmind', 'kadmind', '@krb5@/bin/kadmind'),
++            ('kprop', 'kprop', '@krb5@/bin/kprop'),
++            ('_kinit', 'kinit', '@krb5@/bin/kinit'),
++            ('_klist', 'klist', '@krb5@/bin/klist'),
          ]
  
      @property
@@ -95,15 +95,15 @@ index 161e5ad..9f50049 100644
              ('krb5kdc', 'kdc', os.path.join(base, 'kdc')),
 -            ('kadmin', 'kadmin', '/usr/bin/kadmin'),
 -            ('kadmin_local', 'kadmin', '/usr/bin/kadmin'),
-+            ('kadmin', 'kadmin', '@krb5Full@/bin/kadmin'),
-+            ('kadmin_local', 'kadmin', '@krb5Full@/bin/kadmin'),
++            ('kadmin', 'kadmin', '@krb5@/bin/kadmin'),
++            ('kadmin_local', 'kadmin', '@krb5@/bin/kadmin'),
              ('kadmind', 'kadmind', os.path.join(base, 'kadmind')),
 -            ('_kinit', 'kinit', '/usr/bin/kinit'),
 -            ('_klist', 'klist', '/usr/bin/klist'),
 -            ('_ktutil', 'ktutil', '/usr/bin/ktutil'),
-+            ('_kinit', 'kinit', '@krb5Full@/bin/kinit'),
-+            ('_klist', 'klist', '@krb5Full@/bin/klist'),
-+            ('_ktutil', 'ktutil', '@krb5Full@/bin/ktutil'),
++            ('_kinit', 'kinit', '@krb5@/bin/kinit'),
++            ('_klist', 'klist', '@krb5@/bin/klist'),
++            ('_ktutil', 'ktutil', '@krb5@/bin/ktutil'),
          ]
  
      @property
@@ -116,7 +116,7 @@ index 3c64b9e..59da1ab 100644
      global _KRB_VERSION
      if _KRB_VERSION is None:
 -        _KRB_VERSION = _utils.get_output("krb5-config --version")
-+        _KRB_VERSION = _utils.get_output("@krb5FullDev@/bin/krb5-config --version")
++        _KRB_VERSION = _utils.get_output("@krb5Dev@/bin/krb5-config --version")
          _KRB_VERSION = _KRB_VERSION.split(' ')[-1].split('.')
  
      def make_ext_test(func):
diff --git a/pkgs/development/python-modules/knack/default.nix b/pkgs/development/python-modules/knack/default.nix
index 2e3808db8561..c858dcde6619 100644
--- a/pkgs/development/python-modules/knack/default.nix
+++ b/pkgs/development/python-modules/knack/default.nix
@@ -11,15 +11,19 @@
 , mock
 , vcrpy
 , pytest
+, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "knack";
-  version = "0.10.0";
+  version = "0.10.1";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-ExkPqV1MIbzgS0vuItak4/sZqTtpmbHRBL0CxHZwbCg=";
+    hash = "sha256-xXKBKCl+bSaXkQhc+Wwv/fzvWM+DxjSly5LrA7KSmDg=";
   };
 
   propagatedBuildInputs = [
@@ -42,9 +46,14 @@ buildPythonPackage rec {
     HOME=$TMPDIR pytest .
   '';
 
+  pythonImportsCheck = [
+    "knack"
+  ];
+
   meta = with lib; {
     homepage = "https://github.com/microsoft/knack";
     description = "A Command-Line Interface framework";
+    changelog = "https://github.com/microsoft/knack/blob/v${version}/HISTORY.rst";
     platforms = platforms.all;
     license = licenses.mit;
     maintainers = with maintainers; [ jonringer ];
diff --git a/pkgs/development/python-modules/losant-rest/default.nix b/pkgs/development/python-modules/losant-rest/default.nix
index 0e80ef1da88b..0054d8916362 100644
--- a/pkgs/development/python-modules/losant-rest/default.nix
+++ b/pkgs/development/python-modules/losant-rest/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "losant-rest";
-  version = "1.16.6";
+  version = "1.17.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "Losant";
     repo = "losant-rest-python";
     rev = "v${version}";
-    sha256 = "sha256-x8a2W64zLDi8r7d8B7GYCwWtSAB3BH+Sprbw+Xr7mH4=";
+    hash = "sha256-nR7ZKKpqiCrQbXsS+znmNht1OvcYL6hSQxHMcJ+/yKA=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/mac-vendor-lookup/default.nix b/pkgs/development/python-modules/mac-vendor-lookup/default.nix
index 2c0a7d4f7240..d4a1be562f9e 100644
--- a/pkgs/development/python-modules/mac-vendor-lookup/default.nix
+++ b/pkgs/development/python-modules/mac-vendor-lookup/default.nix
@@ -13,8 +13,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "bauerj";
     repo = "mac_vendor_lookup";
-    rev = "5b57faac0c5a701a7e18085e331853397b68c07c";
-    hash = "sha256-F/aiMs+J4bAesr6mKy+tYVjAjZ3l9vyHxV7zaaB6KbA=";
+    rev = "90dbea48f8a9d567b5f9039ebd151ddfe7d12a19";
+    hash = "sha256-mPPJDrWdyvkTdb4WfeTNYwuC+Ek9vH7ORKRTREg+vK8=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/mathlibtools/default.nix b/pkgs/development/python-modules/mathlibtools/default.nix
index f913beb07ef1..02a6b5348ed4 100644
--- a/pkgs/development/python-modules/mathlibtools/default.nix
+++ b/pkgs/development/python-modules/mathlibtools/default.nix
@@ -3,7 +3,7 @@
 , buildPythonPackage
 , click
 , fetchPypi
-, GitPython
+, gitpython
 , networkx
 , pydot
 , PyGithub
@@ -28,7 +28,7 @@ buildPythonPackage rec {
   propagatedBuildInputs = [
     atomicwrites
     click
-    GitPython
+    gitpython
     networkx
     pydot
     PyGithub
diff --git a/pkgs/development/python-modules/metakernel/default.nix b/pkgs/development/python-modules/metakernel/default.nix
index 5cc40f4a6ca6..bb3d4b917f1f 100644
--- a/pkgs/development/python-modules/metakernel/default.nix
+++ b/pkgs/development/python-modules/metakernel/default.nix
@@ -1,18 +1,24 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, hatchling
 , ipykernel
 }:
 
 buildPythonPackage rec {
   pname = "metakernel";
   version = "0.29.2";
+  format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
     sha256 = "sha256-A++uLR4hhOQYmA6o9wBTejFju3CpbK0hwIs7XFscddQ=";
   };
 
+  nativeBuildInputs = [
+    hatchling
+  ];
+
   propagatedBuildInputs = [ ipykernel ];
 
   # Tests hang, so disable
diff --git a/pkgs/development/python-modules/mitmproxy/default.nix b/pkgs/development/python-modules/mitmproxy/default.nix
index 4b4cf1315b5f..b85000fe05c5 100644
--- a/pkgs/development/python-modules/mitmproxy/default.nix
+++ b/pkgs/development/python-modules/mitmproxy/default.nix
@@ -1,6 +1,5 @@
 { lib
 , fetchFromGitHub
-, fetchpatch
 , buildPythonPackage
 , pythonOlder
   # Mitmproxy requirements
@@ -8,7 +7,6 @@
 , blinker
 , brotli
 , certifi
-, click
 , cryptography
 , flask
 , h11
@@ -16,6 +14,7 @@
 , hyperframe
 , kaitaistruct
 , ldap3
+, mitmproxy-wireguard
 , msgpack
 , passlib
 , protobuf
@@ -42,24 +41,16 @@
 
 buildPythonPackage rec {
   pname = "mitmproxy";
-  version = "8.1.1";
-  disabled = pythonOlder "3.8";
+  version = "9.0.1";
+  disabled = pythonOlder "3.9";
 
   src = fetchFromGitHub {
-    owner = pname;
-    repo = pname;
+    owner = "mitmproxy";
+    repo = "mitmproxy";
     rev = "refs/tags/v${version}";
     sha256 = "sha256-nW/WfiY6uF67qNa95tvNvSv/alP2WmzTk34LEBma/04=";
   };
 
-  patches = [
-    # Fix onboarding addon tests failing with Flask >= v2.2
-    (fetchpatch {
-      url = "https://github.com/mitmproxy/mitmproxy/commit/bc370276a19c1d1039e7a45ecdc23c362626c81a.patch";
-      hash = "sha256-Cp7RnYpZEuRhlWYOk8BOnAKBAUa7Vy296UmQi3/ufes=";
-    })
-  ];
-
   propagatedBuildInputs = [
     setuptools
     # setup.py
@@ -67,7 +58,6 @@ buildPythonPackage rec {
     blinker
     brotli
     certifi
-    click
     cryptography
     flask
     h11
@@ -75,11 +65,12 @@ buildPythonPackage rec {
     hyperframe
     kaitaistruct
     ldap3
+    mitmproxy-wireguard
     msgpack
     passlib
     protobuf
-    publicsuffix2
     pyopenssl
+    publicsuffix2
     pyparsing
     pyperclip
     ruamel-yaml
@@ -120,6 +111,12 @@ buildPythonPackage rec {
     # ValueError: Exceeds the limit (4300) for integer string conversion
     "test_roundtrip_big_integer"
   ];
+
+  disabledTestPaths = [
+    # teardown of half the tests broken
+    "test/mitmproxy/addons/test_onboarding.py"
+  ];
+
   dontUsePytestXdist = true;
 
   pythonImportsCheck = [ "mitmproxy" ];
diff --git a/pkgs/development/python-modules/mlflow/default.nix b/pkgs/development/python-modules/mlflow/default.nix
index cc5abbdd3d2f..375c56b6885a 100644
--- a/pkgs/development/python-modules/mlflow/default.nix
+++ b/pkgs/development/python-modules/mlflow/default.nix
@@ -9,7 +9,7 @@
 , fetchpatch
 , fetchPypi
 , flask
-, GitPython
+, gitpython
 , gorilla
 , gunicorn
 , importlib-metadata
@@ -50,7 +50,7 @@ buildPythonPackage rec {
     docker
     entrypoints
     flask
-    GitPython
+    gitpython
     gorilla
     gunicorn
     importlib-metadata
@@ -81,6 +81,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Open source platform for the machine learning lifecycle";
     homepage = "https://github.com/mlflow/mlflow";
+    changelog = "https://github.com/mlflow/mlflow/blob/v${version}/CHANGELOG.md";
     license = licenses.asl20;
     maintainers = with maintainers; [ tbenst ];
   };
diff --git a/pkgs/development/python-modules/mypy-boto3-builder/default.nix b/pkgs/development/python-modules/mypy-boto3-builder/default.nix
index 00be47cf8207..9ae495cf55e2 100644
--- a/pkgs/development/python-modules/mypy-boto3-builder/default.nix
+++ b/pkgs/development/python-modules/mypy-boto3-builder/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "mypy-boto3-builder";
-  version = "7.11.11";
+  version = "7.12.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.10";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "youtype";
     repo = "mypy_boto3_builder";
     rev = "refs/tags/${version}";
-    hash = "sha256-4iyh/oXuYsdtqEf1Dh4Z3y8AHWiS1TmimO5HUwsHrHA=";
+    hash = "sha256-YmWQZvSABE0IKvISJWeB0rYryZ9FNTCgS7/lE2/sO04=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/mypy-boto3-s3/default.nix b/pkgs/development/python-modules/mypy-boto3-s3/default.nix
index eb36da387f60..6825978f19f3 100644
--- a/pkgs/development/python-modules/mypy-boto3-s3/default.nix
+++ b/pkgs/development/python-modules/mypy-boto3-s3/default.nix
@@ -11,7 +11,7 @@ buildPythonPackage rec {
   version = "1.26.0.post1";
   format = "setuptools";
 
-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
@@ -31,9 +31,9 @@ buildPythonPackage rec {
   ];
 
   meta = with lib; {
-    description = "Type annotations for boto3";
-    homepage = "https://vemel.github.io/boto3_stubs_docs/mypy_boto3_s3/";
-    license = with licenses; [ bsd3 ];
+    description = "Type annotations for boto3.s3";
+    homepage = "https://github.com/youtype/mypy_boto3_builder";
+    license = with licenses; [ mit ];
     maintainers = with maintainers; [ fab ];
   };
 }
diff --git a/pkgs/development/python-modules/nbdime/default.nix b/pkgs/development/python-modules/nbdime/default.nix
index da00ff3702dd..78cb915b29e6 100644
--- a/pkgs/development/python-modules/nbdime/default.nix
+++ b/pkgs/development/python-modules/nbdime/default.nix
@@ -1,7 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, isPy3k
+, pythonOlder
 , hypothesis
 , setuptools-scm
 , six
@@ -19,7 +19,7 @@
 , pygments
 , tornado
 , requests
-, GitPython
+, gitpython
 , jupyter-server-mathjax
 , notebook
 , jinja2
@@ -28,14 +28,18 @@
 buildPythonPackage rec {
   pname = "nbdime";
   version = "3.1.1";
-  disabled = !isPy3k;
+  format = "setuptools";
+
+  disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "67767320e971374f701a175aa59abd3a554723039d39fae908e72d16330d648b";
+    hash = "sha256-Z3ZzIOlxN09wGhdapZq9OlVHIwOdOfrpCOctFjMNZIs=";
   };
 
-  nativeBuildInputs = [ setuptools-scm ];
+  nativeBuildInputs = [
+    setuptools-scm
+  ];
 
   propagatedBuildInputs = [
     attrs
@@ -48,7 +52,7 @@ buildPythonPackage rec {
     pygments
     tornado
     requests
-    GitPython
+    gitpython
     notebook
     jinja2
   ];
@@ -78,6 +82,10 @@ buildPythonPackage rec {
 
   __darwinAllowLocalNetworking = true;
 
+  pythonImportsCheck = [
+    "nbdime"
+  ];
+
   meta = with lib; {
     homepage = "https://github.com/jupyter/nbdime";
     description = "Tools for diffing and merging of Jupyter notebooks.";
diff --git a/pkgs/development/python-modules/nettigo-air-monitor/default.nix b/pkgs/development/python-modules/nettigo-air-monitor/default.nix
index 3ae81a4afed6..de424d8afdf9 100644
--- a/pkgs/development/python-modules/nettigo-air-monitor/default.nix
+++ b/pkgs/development/python-modules/nettigo-air-monitor/default.nix
@@ -5,6 +5,7 @@
 , dacite
 , fetchFromGitHub
 , aqipy-atmotech
+, orjson
 , pytest-asyncio
 , pytest-error-for-skips
 , pytestCheckHook
@@ -13,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "nettigo-air-monitor";
-  version = "1.4.2";
+  version = "1.5.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
@@ -22,13 +23,14 @@ buildPythonPackage rec {
     owner = "bieniu";
     repo = pname;
     rev = version;
-    hash = "sha256-UbknJ+dX+4kzfe6/gg/Nj1Ay8YXtIRj203B6NkhGVys=";
+    hash = "sha256-84cd869k+JZZpjBBoHH2AyIo8ixJzVgpLLRBV4cMNKA=";
   };
 
   propagatedBuildInputs = [
     aiohttp
-    dacite
     aqipy-atmotech
+    dacite
+    orjson
   ];
 
   checkInputs = [
diff --git a/pkgs/development/python-modules/nextdns/default.nix b/pkgs/development/python-modules/nextdns/default.nix
index a0aac69df9e1..41b22ee21703 100644
--- a/pkgs/development/python-modules/nextdns/default.nix
+++ b/pkgs/development/python-modules/nextdns/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "nextdns";
-  version = "1.1.1";
+  version = "1.2.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "bieniu";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-hMTafmG3mk6jyrqxI7L/rQxKGpgNgEZ+b6d6/yISCng=";
+    hash = "sha256-F6vTOwE8WdcELH+W7VuRbGDLD+7+a09iai/TDMBfv4s=";
   };
 
   propagatedBuildInputs = [
@@ -41,6 +41,7 @@ buildPythonPackage rec {
   ];
 
   meta = with lib; {
+    changelog = "https://github.com/bieniu/nextdns/releases/tag/${version}";
     description = "Module for the NextDNS API";
     homepage = "https://github.com/bieniu/nextdns";
     license = licenses.asl20;
diff --git a/pkgs/development/python-modules/opentimestamps/default.nix b/pkgs/development/python-modules/opentimestamps/default.nix
index e253c0b5c9bf..e5d37fcfba8d 100644
--- a/pkgs/development/python-modules/opentimestamps/default.nix
+++ b/pkgs/development/python-modules/opentimestamps/default.nix
@@ -3,7 +3,7 @@
 , buildPythonPackage
 , fetchFromGitHub
 , git
-, GitPython
+, gitpython
 , pycryptodomex
 , pytestCheckHook
 , pythonOlder
@@ -25,7 +25,7 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [
     bitcoinlib
-    GitPython
+    gitpython
     pycryptodomex
   ];
 
@@ -46,6 +46,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Create and verify OpenTimestamps proofs";
     homepage = "https://github.com/opentimestamps/python-opentimestamps";
+    changelog = "https://github.com/opentimestamps/python-opentimestamps/releases/tag/python-opentimestamps-v${version}";
     license = licenses.lgpl3Plus;
     maintainers = with maintainers; [ erikarvstedt ];
   };
diff --git a/pkgs/development/python-modules/passlib/default.nix b/pkgs/development/python-modules/passlib/default.nix
index 72892a109539..2f9e2d0c4b08 100644
--- a/pkgs/development/python-modules/passlib/default.nix
+++ b/pkgs/development/python-modules/passlib/default.nix
@@ -32,9 +32,9 @@ buildPythonPackage rec {
   disabledTests = [
     # timming sensitive
     "test_dummy_verify"
-  ]
-  # These tests fail because they don't expect support for algorithms provided through libxcrypt
-  ++ lib.optionals stdenv.isDarwin [
+    "test_encrypt_cost_timing"
+  ] ++ lib.optionals stdenv.isDarwin [
+    # These tests fail because they don't expect support for algorithms provided through libxcrypt
     "test_82_crypt_support"
   ];
 
diff --git a/pkgs/development/python-modules/pip-requirements-parser/default.nix b/pkgs/development/python-modules/pip-requirements-parser/default.nix
index 0693fbf4fde8..fd1b95c48226 100644
--- a/pkgs/development/python-modules/pip-requirements-parser/default.nix
+++ b/pkgs/development/python-modules/pip-requirements-parser/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "pip-requirements-parser";
-  version = "31.2.0";
+  version = "32.0.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "nexB";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-i4hw3tS4i2ek2JzcDiGo5aFFJ9J2JJ9MB5vxDhOilb0=";
+    hash = "sha256-Wu4C93PWujygKIzXqUjCmKWcllr+hkuvnqDuw6/D9Do=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
@@ -44,6 +44,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Module to parse pip requirements";
     homepage = "https://github.com/nexB/pip-requirements-parser";
+    changelog = "https://github.com/nexB/pip-requirements-parser/blob/v${version}/CHANGELOG.rst";
     license = licenses.mit;
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/pontos/default.nix b/pkgs/development/python-modules/pontos/default.nix
index 4d207628cf8e..59980857560f 100644
--- a/pkgs/development/python-modules/pontos/default.nix
+++ b/pkgs/development/python-modules/pontos/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "pontos";
-  version = "22.11.0";
+  version = "22.12.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
     owner = "greenbone";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-WGtHMQ+8hACt8SMyO0zO80ASlfykJfHQOtNwyk1fsFE=";
+    hash = "sha256-8enSKOVEkYPI/2d2nzDkf1GO15kpMI6xDktroK9Ti2s=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/protobuf/default.nix b/pkgs/development/python-modules/protobuf/default.nix
index 4061edfc5ae4..cd1fb4806f18 100644
--- a/pkgs/development/python-modules/protobuf/default.nix
+++ b/pkgs/development/python-modules/protobuf/default.nix
@@ -37,7 +37,7 @@ buildPythonPackage {
     buildPackages."protobuf${lib.versions.major protobuf.version}_${lib.versions.minor protobuf.version}"
   ];
 
-  setupPyGlobalFlags = "--cpp_implementation";
+  setupPyGlobalFlags = [ "--cpp_implementation" ];
 
   pythonImportsCheck = [
     "google.protobuf"
diff --git a/pkgs/development/python-modules/psrpcore/default.nix b/pkgs/development/python-modules/psrpcore/default.nix
index 41c514d2ca63..09c624bbdc1d 100644
--- a/pkgs/development/python-modules/psrpcore/default.nix
+++ b/pkgs/development/python-modules/psrpcore/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "psrpcore";
-  version = "0.1.2";
+  version = "0.2.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -17,8 +17,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "jborean93";
     repo = pname;
-    rev = "v${version}";
-    hash = "sha256-f1NGE+wSgi8yqBicZZRfUqzinsqazuIaoAje2y+dK1w=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-uX99BsQn1Ckl+2Lt4I0EMZLTKeDrX0mtSc9w5aFpvxQ=";
   };
 
   propagatedBuildInputs = [
@@ -38,6 +38,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Library for the PowerShell Remoting Protocol (PSRP)";
     homepage = "https://github.com/jborean93/psrpcore";
+    changelog = "https://github.com/jborean93/psrpcore/blob/v${version}/CHANGELOG.md";
     license = licenses.mit;
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/ptpython/default.nix b/pkgs/development/python-modules/ptpython/default.nix
index af07f013ee05..c78aacc8d5a2 100644
--- a/pkgs/development/python-modules/ptpython/default.nix
+++ b/pkgs/development/python-modules/ptpython/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "ptpython";
-  version = "3.0.21";
+  version = "3.0.22";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-pXuZUurEoSVApN+0zNSiQ0A+zrJ7DRMkW15BRMhzHTI=";
+    hash = "sha256-wJezJEBgFKAFxrCfSTu73eVx5BI2CvK6FVGHOhDDbPg=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pulumi-aws/default.nix b/pkgs/development/python-modules/pulumi-aws/default.nix
index b397d4cf59f1..7ff24f974ee4 100644
--- a/pkgs/development/python-modules/pulumi-aws/default.nix
+++ b/pkgs/development/python-modules/pulumi-aws/default.nix
@@ -12,7 +12,7 @@
 buildPythonPackage rec {
   pname = "pulumi-aws";
   # Version is independant of pulumi's.
-  version = "5.21.1";
+  version = "5.23.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "pulumi";
     repo = "pulumi-aws";
     rev = "refs/tags/v${version}";
-    hash = "sha256-b/X+UHJnGCzE3AR+spXJWv/NVq5BVvNlzEyHpqDhquY=";
+    hash = "sha256-YT667WBOnObGpagml9xAj6N+Kdhq3rhx0XspJJXhrUE=";
   };
 
   sourceRoot = "${src.name}/sdk/python";
diff --git a/pkgs/development/python-modules/py-desmume/default.nix b/pkgs/development/python-modules/py-desmume/default.nix
index 0c700151f694..30631de36e52 100644
--- a/pkgs/development/python-modules/py-desmume/default.nix
+++ b/pkgs/development/python-modules/py-desmume/default.nix
@@ -1,32 +1,68 @@
-{ lib, buildPythonPackage, fetchFromGitHub, GitPython
-, libpcap, meson, ninja, pillow, pkg-config, pygobject3, SDL2
-, alsa-lib, soundtouch, openal
+{ lib
+, alsa-lib
+, buildPythonPackage
+, fetchFromGitHub
+, gitpython
+, libpcap
+, meson
+, ninja
+, openal
+, pillow
+, pkg-config
+, pygobject3
+, pythonOlder
+, SDL2
+, soundtouch
 }:
 
 buildPythonPackage rec {
   pname = "py-desmume";
   version = "0.0.4.post2";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "SkyTemple";
     repo = pname;
     rev = version;
-    sha256 = "sha256-a819+K/Ovnz53ViDKpUGGjeblWvrAO5ozt/tizdLKCY=";
+    hash = "sha256-a819+K/Ovnz53ViDKpUGGjeblWvrAO5ozt/tizdLKCY=";
     fetchSubmodules = true;
   };
 
-  buildInputs = [ GitPython libpcap SDL2 alsa-lib soundtouch openal ];
-  nativeBuildInputs = [ meson ninja pkg-config ];
-  propagatedBuildInputs = [ pillow pygobject3 ];
+  nativeBuildInputs = [
+    meson
+    ninja
+    pkg-config
+  ];
+
+  buildInputs = [
+    alsa-lib
+    gitpython
+    libpcap
+    openal
+    SDL2
+    soundtouch
+  ];
+
+  propagatedBuildInputs = [
+    pillow
+    pygobject3
+  ];
 
-  hardeningDisable = [ "format" ];
+  hardeningDisable = [
+    "format"
+  ];
 
   doCheck = false; # there are no tests
-  pythonImportsCheck = [ "desmume" ];
+
+  pythonImportsCheck = [
+    "desmume"
+  ];
 
   meta = with lib; {
-    homepage = "https://github.com/SkyTemple/py-desmume";
     description = "Python library to interface with DeSmuME, the Nintendo DS emulator";
+    homepage = "https://github.com/SkyTemple/py-desmume";
     license = licenses.gpl3Plus;
     maintainers = with maintainers; [ xfix ];
   };
diff --git a/pkgs/development/python-modules/pycryptodome/default.nix b/pkgs/development/python-modules/pycryptodome/default.nix
index 41d7dc1d1514..1d3d3d0d9e08 100644
--- a/pkgs/development/python-modules/pycryptodome/default.nix
+++ b/pkgs/development/python-modules/pycryptodome/default.nix
@@ -2,6 +2,7 @@
 , buildPythonPackage
 , callPackage
 , fetchFromGitHub
+, fetchpatch
 , gmp
 }:
 
@@ -20,6 +21,13 @@ buildPythonPackage rec {
     hash = "sha256-8EAgeAU3HQiPrMKOtoVQQLbgq47cbveU2eQYp15XS/U=";
   };
 
+  patches = [
+    (fetchpatch {
+      url = "https://github.com/Legrandin/pycryptodome/commit/1c043abb089ddbc2fc43d1c169672688ccc64c64.patch";
+      sha256 = "sha256-QklwOlFpQNAH0CpR06fWSZqx8C97RV8BRsKbp2j8js8=";
+    })
+  ];
+
   postPatch = ''
     substituteInPlace lib/Crypto/Math/_IntegerGMP.py \
       --replace 'load_lib("gmp"' 'load_lib("${gmp}/lib/libgmp.so.10"'
diff --git a/pkgs/development/python-modules/pylint/default.nix b/pkgs/development/python-modules/pylint/default.nix
index 6c98fdf83a16..a8a0229f8621 100644
--- a/pkgs/development/python-modules/pylint/default.nix
+++ b/pkgs/development/python-modules/pylint/default.nix
@@ -15,7 +15,7 @@
 , tomli
 , tomlkit
 , typing-extensions
-, GitPython
+, gitpython
 , pytest-timeout
 , pytest-xdist
 , pytestCheckHook
@@ -73,7 +73,7 @@ buildPythonPackage rec {
   '';
 
   checkInputs = [
-    GitPython
+    gitpython
     # https://github.com/PyCQA/pylint/blob/main/requirements_test_min.txt
     pytest-timeout
     pytest-xdist
diff --git a/pkgs/development/python-modules/pyrainbird/default.nix b/pkgs/development/python-modules/pyrainbird/default.nix
index 5035f7c1a369..5461dc44523a 100644
--- a/pkgs/development/python-modules/pyrainbird/default.nix
+++ b/pkgs/development/python-modules/pyrainbird/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "pyrainbird";
-  version = "0.6.2";
+  version = "0.6.3";
   format = "setuptools";
 
   disabled = pythonOlder "3.9";
@@ -22,12 +22,15 @@ buildPythonPackage rec {
     owner = "jbarrancos";
     repo = pname;
     rev = version;
-    hash = "sha256-MikJDW5Fo2DNpn9/Hyc1ecIIMEwE8GD5LKpka2t7aCk=";
+    hash = "sha256-yGUBCs1IxbGKBo21gExFIqDawM2EHlO+jiRqonEUnPk=";
   };
 
   postPatch = ''
     substituteInPlace pytest.ini \
       --replace "--cov=pyrainbird --cov-report=term-missing" ""
+
+    substituteInPlace setup.cfg \
+      --replace "pycryptodome>=3.16.0" "pycryptodome"
   '';
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pyrisco/default.nix b/pkgs/development/python-modules/pyrisco/default.nix
index 5ce800af4d25..72fc5ab0a200 100644
--- a/pkgs/development/python-modules/pyrisco/default.nix
+++ b/pkgs/development/python-modules/pyrisco/default.nix
@@ -7,21 +7,26 @@
 
 buildPythonPackage rec {
   pname = "pyrisco";
-  version = "0.5.6";
+  version = "0.5.7";
   disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "OnFreund";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-jhThPU4wlujZVC9v/8JSRFxC0LlJedFevOENdRHidV8=";
+    hash = "sha256-ySFHB+PZmjsqKJQrfFoupylowsOiV5B2feHX7nF8dUA=";
   };
 
-  propagatedBuildInputs = [ aiohttp ];
+  propagatedBuildInputs = [
+    aiohttp
+  ];
 
   # Project has no tests
   doCheck = false;
-  pythonImportsCheck = [ "pyrisco" ];
+
+  pythonImportsCheck = [
+    "pyrisco"
+  ];
 
   meta = with lib; {
     description = "Python interface to Risco alarm systems through Risco Cloud";
diff --git a/pkgs/development/python-modules/pyshark/default.nix b/pkgs/development/python-modules/pyshark/default.nix
index c7b469dbf760..b33a1bd9f385 100644
--- a/pkgs/development/python-modules/pyshark/default.nix
+++ b/pkgs/development/python-modules/pyshark/default.nix
@@ -35,7 +35,7 @@ buildPythonPackage rec {
   ];
 
   # `stripLen` does not seem to work here
-  patchFlags = "-p2";
+  patchFlags = [ "-p2" ];
 
   sourceRoot = "${src.name}/src";
 
diff --git a/pkgs/development/python-modules/pytest-random-order/default.nix b/pkgs/development/python-modules/pytest-random-order/default.nix
index d95af8651f34..223024fe6451 100644
--- a/pkgs/development/python-modules/pytest-random-order/default.nix
+++ b/pkgs/development/python-modules/pytest-random-order/default.nix
@@ -6,12 +6,12 @@
 }:
 
 buildPythonPackage rec {
-  version = "1.0.4";
+  version = "1.1.0";
   pname = "pytest-random-order";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "6b2159342a4c8c10855bc4fc6d65ee890fc614cb2b4ff688979b008a82a0ff52";
+    sha256 = "sha256-2+beu5NTp6+YTMnt2+s1d91Nu8wVKaeePSH2jtm0VgU=";
   };
 
   disabled = pythonOlder "3.5";
diff --git a/pkgs/development/python-modules/python-arango/default.nix b/pkgs/development/python-modules/python-arango/default.nix
new file mode 100644
index 000000000000..ba44e94b9a31
--- /dev/null
+++ b/pkgs/development/python-modules/python-arango/default.nix
@@ -0,0 +1,138 @@
+{ lib
+, arangodb
+, buildPythonPackage
+, fetchFromGitHub
+, pythonOlder
+, pytestCheckHook
+, pyjwt
+, pytest
+, mock
+, requests
+, requests-toolbelt
+}:
+
+let
+  testDBOpts = {
+    host = "127.0.0.1";
+    port = "8529";
+    password = "test";
+    secret = "secret";
+  };
+in
+
+buildPythonPackage rec {
+  pname = "python-arango";
+  version = "7.5.3";
+  disabled = pythonOlder "3.7";
+  format = "setuptools";
+
+  src = fetchFromGitHub {
+    owner = "ArangoDB-Community";
+    repo = "python-arango";
+    rev = version;
+    sha256 = "0qb2yp05z8dmgsyyxqrl3q0a60jaiih96zhxmqrn2yf7as45n07j";
+  };
+
+  propagatedBuildInputs = [
+    requests
+    requests-toolbelt
+    pyjwt
+  ];
+
+  checkInputs = [
+    arangodb
+    mock
+    pytestCheckHook
+  ];
+
+  # arangodb is compiled only for particular target architectures
+  # (i.e. "haswell"). Thus, these tests may not pass reproducibly,
+  # failing with: `166: Illegal instruction` if not run on arangodb's
+  # specified architecture.
+  #
+  # nonetheless, the client library should remain in nixpkgs - since
+  # the client library will talk to arangodb across the network and
+  # architecture issues will be irrelevant.
+  doCheck = false;
+
+  preCheck = lib.optionalString doCheck ''
+    # Start test DB
+    mkdir -p .nix-test/{data,work}
+
+    ICU_DATA=${arangodb}/share/arangodb3 \
+    GLIBCXX_FORCE_NEW=1 \
+    TZ=UTC \
+    TZ_DATA=${arangodb}/share/arangodb3/tzdata \
+    ARANGO_ROOT_PASSWORD=${testDBOpts.password} \
+    ${arangodb}/bin/arangod \
+      --server.uid=$(id -u) \
+      --server.gid=$(id -g) \
+      --server.authentication=true \
+      --server.endpoint=http+tcp://${testDBOpts.host}:${testDBOpts.port} \
+      --server.descriptors-minimum=4096 \
+      --server.jwt-secret=${testDBOpts.secret} \
+      --javascript.app-path=.nix-test/app \
+      --log.file=.nix-test/log \
+      --database.directory=.nix-test/data \
+      --foxx.api=false &
+  '';
+
+  pytestFlagsArray = [
+    "--host"
+    testDBOpts.host
+    "--port"
+    testDBOpts.port
+    "--passwd"
+    testDBOpts.password
+    "--secret"
+    testDBOpts.secret
+  ];
+
+  disabledTests = [
+    # AssertionError geo-related - try enabling later
+    "test_document_find_in_box"
+
+    # maybe arangod misconfig - try enabling later
+    # arango.exceptions.JWTAuthError: [HTTP 401][ERR 401] Wrong credentials
+    "test_auth_jwt"
+
+    # ValueError - try enabling later
+    # maybe missed 3.9.3->3.10.0 changes
+    # most caused by key change: isNewlyCreated->new
+    "test_add_hash_index"
+    "test_add_skiplist_index"
+    "test_add_persistent_index"
+    "test_add_ttl_index"
+    "test_delete_index"
+    "test_pregel_management"
+
+    # formatting error - try enabling later
+    # maybe missed 3.9.3->3.10.0 changes
+    # caused by: body["computedValues"] = None
+    "test_permission_management"
+    "test_collection_misc_methods"
+    "test_collection_management"
+    "test_replication_inventory"
+
+    # want outgoing network to update foxx apis
+    # so foxx.api disabled in arangod startup
+    "test_foxx_service_management_file"
+    "test_foxx_service_management_json"
+    "test_foxx_config_management"
+    "test_foxx_dependency_management"
+    "test_foxx_development_toggle"
+    "test_foxx_misc_functions"
+
+    # no replication configured via arangod invocation
+    "test_replication_applier"
+  ];
+
+  pythonImportsCheck = [ "arango" ];
+
+  meta = with lib; {
+    description = "Python Driver for ArangoDB";
+    homepage = "https://github.com/ArangoDB-Community/python-arango";
+    license = licenses.mit;
+    maintainers = [ maintainers.jsoo1 ];
+  };
+}
diff --git a/pkgs/development/python-modules/python-glanceclient/default.nix b/pkgs/development/python-modules/python-glanceclient/default.nix
index 390aad8b55cd..560e0db14241 100644
--- a/pkgs/development/python-modules/python-glanceclient/default.nix
+++ b/pkgs/development/python-modules/python-glanceclient/default.nix
@@ -20,14 +20,14 @@
 
 buildPythonPackage rec {
   pname = "python-glanceclient";
-  version = "4.1.0";
+  version = "4.2.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-fknYBKZzCA6sThugNQT5+p+/hqv8vW6M2LMMpbT+7rY=";
+    hash = "sha256-+CmOh9Dr6Gx8MLkR1u/YNpScOxIO7OUIbJAio+omOpg=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/python-lsp-server/default.nix b/pkgs/development/python-modules/python-lsp-server/default.nix
index 4c9cf5003cce..62e6ce951bde 100644
--- a/pkgs/development/python-modules/python-lsp-server/default.nix
+++ b/pkgs/development/python-modules/python-lsp-server/default.nix
@@ -133,7 +133,7 @@ buildPythonPackage rec {
     # https://github.com/python-lsp/python-lsp-server/issues/243
     "test_numpy_completions"
     "test_workspace_loads_pycodestyle_config"
-  ] ++ lib.optional (stdenv.isDarwin && stdenv.isAarch64) [
+  ] ++ lib.optionals (stdenv.isDarwin && stdenv.isAarch64) [
     # pyqt5 is broken on aarch64-darwin
     "test_pyqt_completion"
   ];
diff --git a/pkgs/development/python-modules/python-manilaclient/default.nix b/pkgs/development/python-modules/python-manilaclient/default.nix
index 301ce42f0c77..4e10af5b40d3 100644
--- a/pkgs/development/python-modules/python-manilaclient/default.nix
+++ b/pkgs/development/python-modules/python-manilaclient/default.nix
@@ -18,17 +18,16 @@
 , python-keystoneclient
 , debtcollector
 , callPackage
-, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "python-manilaclient";
-  version = "4.1.0";
+  version = "4.2.0";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-yoyQyhyqRQZ8yyn3sv94JqkVZQMybwxLGFForZowr3o=";
+    hash = "sha256-Hf/U3LFcIsT00lIzvvZaowfMth/zj5WY6UAxYWjC1JA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/python-novaclient/default.nix b/pkgs/development/python-modules/python-novaclient/default.nix
index 5ae75098ddd3..62adeb1fe759 100644
--- a/pkgs/development/python-modules/python-novaclient/default.nix
+++ b/pkgs/development/python-modules/python-novaclient/default.nix
@@ -17,14 +17,14 @@
 
 buildPythonPackage rec {
   pname = "python-novaclient";
-  version = "18.1.0";
+  version = "18.2.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-eCBVnRZfGk2BDn2nyV+IQl2L5JX20aPG9CA7isGH4lQ=";
+    hash = "sha256-GFu/LK+189dh8nLj4YSnAMx7pc99UWGQZb5/XEtbfPQ=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pytibber/default.nix b/pkgs/development/python-modules/pytibber/default.nix
index 2f7614e5bb57..a4047483eb63 100644
--- a/pkgs/development/python-modules/pytibber/default.nix
+++ b/pkgs/development/python-modules/pytibber/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "pytibber";
-  version = "0.26.3";
+  version = "0.26.4";
   format = "setuptools";
 
   disabled = pythonOlder "3.9";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "Danielhiversen";
     repo = "pyTibber";
     rev = "refs/tags/${version}";
-    hash = "sha256-4yDV6tH1XSWZfcjCJ/3r4hl1n4Sbgc3x7YPE6GOfA3Y=";
+    hash = "sha256-R++vsJ2CJwPxG/32qam/LRj7GUj3obh9z20xXNMAnQ4=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pyunifiprotect/default.nix b/pkgs/development/python-modules/pyunifiprotect/default.nix
index af7c4b1cc52a..9cf53fb9e210 100644
--- a/pkgs/development/python-modules/pyunifiprotect/default.nix
+++ b/pkgs/development/python-modules/pyunifiprotect/default.nix
@@ -29,7 +29,7 @@
 
 buildPythonPackage rec {
   pname = "pyunifiprotect";
-  version = "4.5.1";
+  version = "4.5.2";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
@@ -38,7 +38,7 @@ buildPythonPackage rec {
     owner = "briis";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-7LgAK0AzQ7uoVW7fXwoU512iI5LG0BL8N0R9f7AjFN4=";
+    hash = "sha256-xYDt/vvzI7qIK/8XE6mhcI5GPDKyHRj73Lagn0QOOz0=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/pyvesync/default.nix b/pkgs/development/python-modules/pyvesync/default.nix
index 19d8fee57ef4..25e075b31806 100644
--- a/pkgs/development/python-modules/pyvesync/default.nix
+++ b/pkgs/development/python-modules/pyvesync/default.nix
@@ -7,14 +7,14 @@
 
 buildPythonPackage rec {
   pname = "pyvesync";
-  version = "2.0.4";
+  version = "2.1.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-1Svz/9ZS5ynr88/We1fa+H1IGdC5ljUa4M5O8X+muX4=";
+    sha256 = "sha256-ulYOzCIpHkL/2nQExomoV4mLkU6e0ns4MHxEbjCPGrQ=";
   };
 
   propagatedBuildInputs = [
@@ -31,6 +31,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Python library to manage Etekcity Devices and Levoit Air Purifier";
     homepage = "https://github.com/webdjoe/pyvesync";
+    changelog = "https://github.com/webdjoe/pyvesync/releases/tag/${version}";
     license = with licenses; [ mit ];
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/pyvex/default.nix b/pkgs/development/python-modules/pyvex/default.nix
index 88670ec9f7a5..b928c2a4549e 100644
--- a/pkgs/development/python-modules/pyvex/default.nix
+++ b/pkgs/development/python-modules/pyvex/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "pyvex";
-  version = "9.2.27";
+  version = "9.2.28";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-r46rTS9MOMUUWRwGF3pohV+1bPL03VmoILEjEKfr04o=";
+    hash = "sha256-fDsJqilxIt/LApXVrTm3JyOrZ6BR0+IbnFux/huF2ZU=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/qcengine/default.nix b/pkgs/development/python-modules/qcengine/default.nix
index af842c6c9559..e275e4303174 100644
--- a/pkgs/development/python-modules/qcengine/default.nix
+++ b/pkgs/development/python-modules/qcengine/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "qcengine";
-  version = "0.24.1";
+  version = "0.26.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-KUOGbGQd1ffXNkQiW8yeUxValCOAfd8nBv9nnk9giVU=";
+    hash = "sha256-jBA3exH/qzEaKZeumvgKD0tKnDptZdlv1KykyUHs8Bg=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/rich-click/default.nix b/pkgs/development/python-modules/rich-click/default.nix
index 4b6f8b4874c8..104e5bfb8297 100644
--- a/pkgs/development/python-modules/rich-click/default.nix
+++ b/pkgs/development/python-modules/rich-click/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "rich-click";
-  version = "1.5.2";
+  version = "1.6.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
@@ -17,8 +17,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "ewels";
     repo = pname;
-    rev = "v${version}";
-    hash = "sha256-eW5CR7ReVsFLJ09F4EUQbvFB+GdlnTay0bX4NNLQ0xo=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-l8tMyxSkh4eckD21NofK9FBgeGKAqZB0J3B98HpWZ0s=";
   };
 
   propagatedBuildInputs = [
@@ -26,17 +26,6 @@ buildPythonPackage rec {
     rich
   ];
 
-  passthru.optional-dependencies = {
-    typer = [
-      typer
-    ];
-  };
-
-  postPatch = ''
-    substituteInPlace setup.py \
-      --replace "typer>=0.4,<0.6" "typer>=0.4"
-  '';
-
   # Module has no test
   doCheck = false;
 
@@ -47,6 +36,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Module to format click help output nicely with rich";
     homepage = "https://github.com/ewels/rich-click";
+    changelog = "https://github.com/ewels/rich-click/blob/v${version}/CHANGELOG.md";
     license = licenses.mit;
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/rstcheck-core/default.nix b/pkgs/development/python-modules/rstcheck-core/default.nix
index b296f5dc168d..31938569ca5a 100644
--- a/pkgs/development/python-modules/rstcheck-core/default.nix
+++ b/pkgs/development/python-modules/rstcheck-core/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "rstcheck-core";
-  version = "1.0.2";
+  version = "1.0.3";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -23,8 +23,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "rstcheck";
     repo = pname;
-    rev = "v${version}";
-    hash = "sha256-XNr+prK9VDP66ZaFvh3Qrx+eJs6mnVO8lvoMC/qrCLs=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-9U+GhkwBr+f3yEe7McOxqPRUuTp9vP+3WT5wZ92n32w=";
   };
 
   nativeBuildInputs = [
@@ -45,12 +45,6 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
-  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace 'types-docutils = ">=0.18, <0.19"' 'types-docutils = ">=0.18"' \
-      --replace 'docutils = ">=0.7, <0.19"' 'docutils = ">=0.7"'
-  '';
-
   pythonImportsCheck = [
     "rstcheck_core"
   ];
@@ -58,6 +52,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Library for checking syntax of reStructuredText";
     homepage = "https://github.com/rstcheck/rstcheck-core";
+    changelog = "https://github.com/rstcheck/rstcheck-core/blob/v${version}/CHANGELOG.md";
     license = licenses.mit;
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/rstcheck/default.nix b/pkgs/development/python-modules/rstcheck/default.nix
index a3789b97088a..2f2ee962e89a 100644
--- a/pkgs/development/python-modules/rstcheck/default.nix
+++ b/pkgs/development/python-modules/rstcheck/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "rstcheck";
-  version = "6.1.0";
+  version = "6.1.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -23,8 +23,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "rstcheck";
     repo = pname;
-    rev = "v${version}";
-    hash = "sha256-dw/KggiZpKaFZMcTIaSBUhR4oQsZI3iSmEj9Sy80wTs=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-6TpDzk0GjIn9AnWadwHoYRc3SNi9nBAM7GyKm338wH8=";
   };
 
   nativeBuildInputs = [
@@ -47,12 +47,6 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
-  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace 'docutils = ">=0.7, <0.19"' 'docutils = ">=0.7"' \
-      --replace 'types-docutils = ">=0.18, <0.19"' 'types-docutils = ">=0.18"'
-  '';
-
   pythonImportsCheck = [
     "rstcheck"
   ];
@@ -65,6 +59,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Checks syntax of reStructuredText and code blocks nested within it";
     homepage = "https://github.com/myint/rstcheck";
+    changelog = "https://github.com/rstcheck/rstcheck/blob/v${version}/CHANGELOG.md";
     license = licenses.mit;
     maintainers = with maintainers; [ staccato ];
   };
diff --git a/pkgs/development/python-modules/ruuvitag-ble/default.nix b/pkgs/development/python-modules/ruuvitag-ble/default.nix
new file mode 100644
index 000000000000..dd8c338fd314
--- /dev/null
+++ b/pkgs/development/python-modules/ruuvitag-ble/default.nix
@@ -0,0 +1,57 @@
+{ lib
+, bluetooth-data-tools
+, bluetooth-sensor-state-data
+, buildPythonPackage
+, fetchFromGitHub
+, hatchling
+, home-assistant-bluetooth
+, pytestCheckHook
+, pythonOlder
+, sensor-state-data
+}:
+
+buildPythonPackage rec {
+  pname = "ruuvitag-ble";
+  version = "0.1.1";
+  format = "pyproject";
+
+  disabled = pythonOlder "3.9";
+
+  src = fetchFromGitHub {
+    owner = "Bluetooth-Devices";
+    repo = pname;
+    rev = "refs/tags/v${version}";
+    hash = "sha256-WkPYlEkUH1xvGjBVr6JkLx5CfIPvAa9vX50OjCOmTME=";
+  };
+
+  nativeBuildInputs = [
+    hatchling
+  ];
+
+  propagatedBuildInputs = [
+    bluetooth-data-tools
+    bluetooth-sensor-state-data
+    home-assistant-bluetooth
+    sensor-state-data
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace " --cov=ruuvitag_ble --cov-report=term-missing:skip-covered" ""
+  '';
+
+  pythonImportsCheck = [
+    "ruuvitag_ble"
+  ];
+
+  meta = with lib; {
+    description = "Library for Ruuvitag BLE devices";
+    homepage = "https://github.com/Bluetooth-Devices/ruuvitag-ble";
+    license = with licenses; [ mit ];
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/development/python-modules/scmrepo/default.nix b/pkgs/development/python-modules/scmrepo/default.nix
index 4c3dffd0f80f..873073e105cd 100644
--- a/pkgs/development/python-modules/scmrepo/default.nix
+++ b/pkgs/development/python-modules/scmrepo/default.nix
@@ -5,7 +5,7 @@
 , fetchFromGitHub
 , fsspec
 , funcy
-, GitPython
+, gitpython
 , pathspec
 , pygit2
 , pygtrie
@@ -42,7 +42,7 @@ buildPythonPackage rec {
     dulwich
     fsspec
     funcy
-    GitPython
+    gitpython
     pathspec
     pygit2
     pygtrie
diff --git a/pkgs/development/python-modules/sense-energy/default.nix b/pkgs/development/python-modules/sense-energy/default.nix
index b3f2d6955709..22e7b4897e0a 100644
--- a/pkgs/development/python-modules/sense-energy/default.nix
+++ b/pkgs/development/python-modules/sense-energy/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "sense-energy";
-  version = "0.10.4";
+  version = "0.11.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -19,9 +19,13 @@ buildPythonPackage rec {
     owner = "scottbonline";
     repo = "sense";
     rev = version;
-    hash = "sha256-yflI17lLZMXXB0ye+jz3VWWMdZtcBTwbg8deA4ENmWw=";
+    hash = "sha256-QX8CPf3o0IaAhjWYeUjDoAgktNrh/sSRjFhOweAxxco=";
   };
 
+  postPatch = ''
+    sed -i '/download_url/d' setup.py
+  '';
+
   propagatedBuildInputs = [
     aiohttp
     requests
diff --git a/pkgs/development/python-modules/simplisafe-python/default.nix b/pkgs/development/python-modules/simplisafe-python/default.nix
index 97b844613b18..90df4d2847cc 100644
--- a/pkgs/development/python-modules/simplisafe-python/default.nix
+++ b/pkgs/development/python-modules/simplisafe-python/default.nix
@@ -20,7 +20,7 @@
 
 buildPythonPackage rec {
   pname = "simplisafe-python";
-  version = "2022.11.2";
+  version = "2022.12.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -29,7 +29,7 @@ buildPythonPackage rec {
     owner = "bachya";
     repo = pname;
     rev = "refs/tags/${version}";
-    sha256 = "sha256-fGCYsuhqPs3ZYInx6Z3iRb4dtjoA7mJKpBDVx+6d/qA=";
+    hash = "sha256-oajFn/aMZvDpagLKadQ0Ez1uJhfUaJK4Rv6IUq3lRVE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/strenum/default.nix b/pkgs/development/python-modules/strenum/default.nix
index d73b60906cc5..563f20f6f7d0 100644
--- a/pkgs/development/python-modules/strenum/default.nix
+++ b/pkgs/development/python-modules/strenum/default.nix
@@ -7,7 +7,7 @@
 
 buildPythonPackage rec {
   pname = "strenum";
-  version = "0.4.8";
+  version = "0.4.9";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -15,8 +15,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "irgeek";
     repo = "StrEnum";
-    rev = "v${version}";
-    hash = "sha256-S64YfF+cbefXRWoeJK99ZPTiO9DUcDaT77hVQd7pKDk=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-tElXpwyjrgTw9eHqGPgXakY+G9JXkBQYG7jSZSjv6P0=";
   };
 
   postPatch = ''
@@ -37,6 +37,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "MOdule for enum that inherits from str";
     homepage = "https://github.com/irgeek/StrEnum";
+    changelog = "https://github.com/irgeek/StrEnum/releases/tag/v${version}";
     license = with licenses; [ mit ];
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/stytra/default.nix b/pkgs/development/python-modules/stytra/default.nix
index fba544789a81..6923fe36c8ae 100644
--- a/pkgs/development/python-modules/stytra/default.nix
+++ b/pkgs/development/python-modules/stytra/default.nix
@@ -1,36 +1,41 @@
-{ lib, buildPythonPackage, fetchPypi, isPy3k
-, opencv3
-, pyqt5
-, pyqtgraph
-, numpy
-, scipy
-, numba
-, pandas
-, tables
-, git
-, scikitimage
-, matplotlib
-, qdarkstyle
-, GitPython
+{ lib
 , anytree
-, pims
+, arrayqueues
+, av
+, buildPythonPackage
+, colorspacious
+, fetchPypi
+, flammkuchen
+, git
+, gitpython
 , imageio
 , imageio-ffmpeg
-, av
+, lightparam
+, matplotlib
 , nose
-, pytestCheckHook
+, numba
+, numpy
+, opencv3
+, pandas
+, pims
+, pyqt5
+, pyqtgraph
 , pyserial
-, arrayqueues
-, colorspacious
+, pytestCheckHook
+, pythonOlder
+, qdarkstyle
 , qimage2ndarray
-, flammkuchen
-, lightparam
+, scikitimage
+, scipy
+, tables
 }:
 
 buildPythonPackage rec {
   pname = "stytra";
   version = "0.8.34";
-  disabled = !isPy3k;
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
@@ -42,12 +47,6 @@ buildPythonPackage rec {
     rm stytra/tests/test_z_experiments.py
   '';
 
-  checkInputs = [
-    nose
-    pytestCheckHook
-    pyserial
-  ];
-
   propagatedBuildInputs = [
     opencv3
     pyqt5
@@ -61,7 +60,7 @@ buildPythonPackage rec {
     scikitimage
     matplotlib
     qdarkstyle
-    GitPython
+    gitpython
     anytree
     qimage2ndarray
     flammkuchen
@@ -74,10 +73,16 @@ buildPythonPackage rec {
     av
   ];
 
-  meta = {
-    homepage = "https://github.com/portugueslab/stytra";
+  checkInputs = [
+    nose
+    pytestCheckHook
+    pyserial
+  ];
+
+  meta = with lib; {
     description = "A modular package to control stimulation and track behaviour";
-    license = lib.licenses.gpl3Plus;
-    maintainers = with lib.maintainers; [ tbenst ];
+    homepage = "https://github.com/portugueslab/stytra";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ tbenst ];
   };
 }
diff --git a/pkgs/development/python-modules/subarulink/default.nix b/pkgs/development/python-modules/subarulink/default.nix
index bf975f5e8483..a8e00cace53e 100644
--- a/pkgs/development/python-modules/subarulink/default.nix
+++ b/pkgs/development/python-modules/subarulink/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "subarulink";
-  version = "0.6.1";
+  version = "0.7.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -20,8 +20,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "G-Two";
     repo = pname;
-    rev = "v${version}";
-    hash = "sha256-esZ+nIHIXKfilb8dBFbAbQQFI6fFRUcoFVCPdnqGXYw=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-igfC/Hi/cbNnHmrzgWQnhJ9cdWHPI0fIqPIYeIZuxgU=";
   };
 
   propagatedBuildInputs = [
@@ -54,6 +54,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Python module for interacting with STARLINK-enabled vehicle";
     homepage = "https://github.com/G-Two/subarulink";
+    changelog = "https://github.com/G-Two/subarulink/releases/tag/v${version}";
     license = with licenses; [ asl20 ];
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/tern/default.nix b/pkgs/development/python-modules/tern/default.nix
index 635733149504..4769dc64e7ab 100644
--- a/pkgs/development/python-modules/tern/default.nix
+++ b/pkgs/development/python-modules/tern/default.nix
@@ -1,28 +1,32 @@
 { lib
 , buildPythonPackage
-, fetchPypi
-, pyyaml
+, debian-inspector
 , docker
 , dockerfile-parse
-, requests
-, stevedore
-, pbr
-, debian-inspector
-, license-expression
-, regex
-, GitPython
-, prettytable
+, fetchPypi
+, gitpython
 , idna
+, license-expression
 , packageurl-python
+, pbr
+, prettytable
+, pythonOlder
+, pyyaml
+, regex
+, requests
+, stevedore
 }:
 
 buildPythonPackage rec {
   pname = "tern";
   version = "2.10.1";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-MMsq8/Obe3ogQSjiP8EebYseUJGcchMOczUrxE9jht4=";
+    hash = "sha256-MMsq8/Obe3ogQSjiP8EebYseUJGcchMOczUrxE9jht4=";
   };
 
   preBuild = ''
@@ -42,7 +46,7 @@ buildPythonPackage rec {
     stevedore
     debian-inspector
     regex
-    GitPython
+    gitpython
     prettytable
     idna
     packageurl-python
@@ -58,6 +62,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "A software composition analysis tool and Python library that generates a Software Bill of Materials for container images and Dockerfiles";
     homepage = "https://github.com/tern-tools/tern";
+    changelog = "https://github.com/tern-tools/tern/releases/tag/v${version}";
     license = licenses.bsd2;
     maintainers = teams.determinatesystems.members;
   };
diff --git a/pkgs/development/python-modules/tilequant/default.nix b/pkgs/development/python-modules/tilequant/default.nix
index 90caab8ebef8..a72802e2c7b3 100644
--- a/pkgs/development/python-modules/tilequant/default.nix
+++ b/pkgs/development/python-modules/tilequant/default.nix
@@ -1,4 +1,13 @@
-{ lib, buildPythonPackage, fetchFromGitHub, GitPython, click, ordered-set, pillow, sortedcollections }:
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, gitpython
+, click
+, ordered-set
+, pythonOlder
+, pillow
+, sortedcollections
+}:
 
 let
   aikku93-tilequant = fetchFromGitHub {
@@ -11,6 +20,9 @@ in
 buildPythonPackage rec {
   pname = "tilequant";
   version = "0.4.0.post0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "SkyTemple";
@@ -23,15 +35,26 @@ buildPythonPackage rec {
     cp -R --no-preserve=mode ${aikku93-tilequant} __aikku93_tilequant
   '';
 
-  buildInputs = [ GitPython ];
-  propagatedBuildInputs = [ click ordered-set pillow sortedcollections ];
+  buildInputs = [
+    gitpython
+  ];
+
+  propagatedBuildInputs = [
+    click
+    ordered-set
+    pillow
+    sortedcollections
+  ];
 
   doCheck = false; # there are no tests
-  pythonImportsCheck = [ "skytemple_tilequant" ];
+
+  pythonImportsCheck = [
+    "skytemple_tilequant"
+  ];
 
   meta = with lib; {
-    homepage = "https://github.com/SkyTemple/tilequant";
     description = "Tool for quantizing image colors using tile-based palette restrictions";
+    homepage = "https://github.com/SkyTemple/tilequant";
     license = licenses.gpl3Plus;
     maintainers = with maintainers; [ xfix ];
   };
diff --git a/pkgs/development/python-modules/versionfinder/default.nix b/pkgs/development/python-modules/versionfinder/default.nix
index 951ae8d9874d..5ca8d7649901 100644
--- a/pkgs/development/python-modules/versionfinder/default.nix
+++ b/pkgs/development/python-modules/versionfinder/default.nix
@@ -2,7 +2,7 @@
 , backoff
 , buildPythonPackage
 , fetchFromGitHub
-, GitPython
+, gitpython
 , pytestCheckHook
 , pythonOlder
 , requests
@@ -23,7 +23,7 @@ buildPythonPackage rec {
   };
 
   propagatedBuildInputs = [
-    GitPython
+    gitpython
     backoff
   ];
 
@@ -49,6 +49,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Find the version of another package, whether installed via pip, setuptools or git";
     homepage = "https://github.com/jantman/versionfinder";
+    changelog = "https://github.com/jantman/versionfinder/blob/${version}/CHANGES.rst";
     license = licenses.agpl3Plus;
     maintainers = with maintainers; [ zakame ];
   };
diff --git a/pkgs/development/python-modules/wandb/default.nix b/pkgs/development/python-modules/wandb/default.nix
index f9e862c0fbbb..ad1ac6da5dd3 100644
--- a/pkgs/development/python-modules/wandb/default.nix
+++ b/pkgs/development/python-modules/wandb/default.nix
@@ -8,7 +8,7 @@
 , fetchFromGitHub
 , flask
 , git
-, GitPython
+, gitpython
 , jsonref
 , jsonschema
 , matplotlib
@@ -67,7 +67,7 @@ buildPythonPackage rec {
   propagatedBuildInputs = [
     click
     docker_pycreds
-    GitPython
+    gitpython
     pathtools
     promise
     protobuf
diff --git a/pkgs/development/python-modules/wxPython/4.0.nix b/pkgs/development/python-modules/wxPython/4.0.nix
index d9fead66e355..380fefbc4cd0 100644
--- a/pkgs/development/python-modules/wxPython/4.0.nix
+++ b/pkgs/development/python-modules/wxPython/4.0.nix
@@ -12,6 +12,7 @@
 , ncurses
 , libintl
 , wxGTK
+, gtk3
 , IOKit
 , Carbon
 , Cocoa
@@ -42,7 +43,7 @@ buildPythonPackage rec {
   then
     [ AudioToolbox Carbon Cocoa CoreFoundation IOKit OpenGL ]
   else
-    [ wxGTK.gtk ]
+    [ gtk3 ]
   );
 
   propagatedBuildInputs = [
@@ -58,7 +59,7 @@ buildPythonPackage rec {
       --replace 'cairoLib = None' 'cairoLib = ctypes.CDLL("${cairo}/lib/libcairo.so")'
     substituteInPlace wx/lib/wxcairo/wx_pycairo.py \
       --replace '_dlls = dict()' '_dlls = {k: ctypes.CDLL(v) for k, v in [
-        ("gdk",        "${wxGTK.gtk}/lib/libgtk-x11-2.0.so"),
+        ("gdk",        "${gtk3}/lib/libgtk-x11-2.0.so"),
         ("pangocairo", "${pango.out}/lib/libpangocairo-1.0.so"),
         ("appsvc",     None)
       ]}'
diff --git a/pkgs/development/python-modules/xiaomi-ble/default.nix b/pkgs/development/python-modules/xiaomi-ble/default.nix
index 676afd2a44dd..8aa63e8f3948 100644
--- a/pkgs/development/python-modules/xiaomi-ble/default.nix
+++ b/pkgs/development/python-modules/xiaomi-ble/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "xiaomi-ble";
-  version = "0.11.0";
+  version = "0.12.2";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
@@ -22,8 +22,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "Bluetooth-Devices";
     repo = pname;
-    rev = "v${version}";
-    hash = "sha256-qAqXg+skA7FfAjRXljt1UpyOcC3KYghc+5wjiRzlyyg=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-MwKhoerfloFT5/x1darfMP/qF5sEy6LiKEogINIUq0c=";
   };
 
   nativeBuildInputs = [
@@ -55,6 +55,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Library for Xiaomi BLE devices";
     homepage = "https://github.com/Bluetooth-Devices/xiaomi-ble";
+    changelog = "https://github.com/Bluetooth-Devices/xiaomi-ble/releases/tag/v${version}";
     license = with licenses; [ mit ];
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/xknx/default.nix b/pkgs/development/python-modules/xknx/default.nix
index 7b22508e2a20..2f3a3768331f 100644
--- a/pkgs/development/python-modules/xknx/default.nix
+++ b/pkgs/development/python-modules/xknx/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "xknx";
-  version = "1.2.1";
+  version = "2.1.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "XKNX";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-5uRPMu9qZ0ofMdgk8d1IpKjHjnEP+zhWs+EDQx9wk6U=";
+    hash = "sha256-a8hC63G+FZBe6yePgrmzRsRTzpHWS+tBQmVUS/uHfzI=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/zamg/default.nix b/pkgs/development/python-modules/zamg/default.nix
index 11066aa26332..e24e712e7c07 100644
--- a/pkgs/development/python-modules/zamg/default.nix
+++ b/pkgs/development/python-modules/zamg/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "zamg";
-  version = "0.1.2";
+  version = "0.2.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "killer0071234";
     repo = "python-zamg";
     rev = "refs/tags/v${version}";
-    hash = "sha256-R3byV8llg7X+KYuYTsEtdLSFfLsPD4tyqAaU0CifDks=";
+    hash = "sha256-mql3r1TdVHwpJi54TMj6kfP3uZO2maa5dynUL4fOiNY=";
   };
 
   postPatch = ''
@@ -44,6 +44,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Library to read weather data from ZAMG Austria";
     homepage = "https://github.com/killer0071234/python-zamg";
+    changelog = "https://github.com/killer0071234/python-zamg/releases/tag/v${version}";
     license = with licenses; [ mit ];
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/zha-quirks/default.nix b/pkgs/development/python-modules/zha-quirks/default.nix
index 86059d60b0cb..73ed507444b6 100644
--- a/pkgs/development/python-modules/zha-quirks/default.nix
+++ b/pkgs/development/python-modules/zha-quirks/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "zha-quirks";
-  version = "0.0.87";
+  version = "0.0.88";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "zigpy";
     repo = "zha-device-handlers";
     rev = "refs/tags/${version}";
-    hash = "sha256-MX+UWS1h2HMIhyrhtn/tzti2w9RBHptVE3klATIXvAM=";
+    hash = "sha256-GjKYa8wgNugGC4IZJfMLVJnlPAgBmTLd8Wwy6e4g/+U=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/zigpy-deconz/default.nix b/pkgs/development/python-modules/zigpy-deconz/default.nix
index babfcf54c04e..5671a7c12256 100644
--- a/pkgs/development/python-modules/zigpy-deconz/default.nix
+++ b/pkgs/development/python-modules/zigpy-deconz/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "zigpy-deconz";
-  version = "0.19.1";
+  version = "0.19.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "zigpy";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-qbzHG6qoTAm773HAoAjmmanqVtuIDR72ECQH+N+iw3o=";
+    hash = "sha256-Eu+6I904vwPewQesYtn8cWXoo36fQpa1Bw660tnV+Lw=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/zigpy-znp/default.nix b/pkgs/development/python-modules/zigpy-znp/default.nix
index 083805f8e7ee..b545752b4ef5 100644
--- a/pkgs/development/python-modules/zigpy-znp/default.nix
+++ b/pkgs/development/python-modules/zigpy-znp/default.nix
@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "zigpy-znp";
-  version = "0.9.1";
+  version = "0.9.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -27,7 +27,7 @@ buildPythonPackage rec {
     owner = "zigpy";
     repo = pname;
     rev = "refs/tags/v${version}";
-    sha256 = "sha256-32QSFBzYg+E++5euCWKgbF3/uLEn1uObenmR/Wv9XZc=";
+    sha256 = "sha256-orJDOnkZH9siDg8H8M8C0UTxJfWPTB+gBNtUM6s4F94=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/zigpy/default.nix b/pkgs/development/python-modules/zigpy/default.nix
index 9b5bd33f85e7..5fd59516d492 100644
--- a/pkgs/development/python-modules/zigpy/default.nix
+++ b/pkgs/development/python-modules/zigpy/default.nix
@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "zigpy";
-  version = "0.51.6";
+  version = "0.52.3";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -27,7 +27,7 @@ buildPythonPackage rec {
     owner = "zigpy";
     repo = "zigpy";
     rev = "refs/tags/${version}";
-    hash = "sha256-keQFFWPl2SCy1cyvbqDrA9/Yude8bf0qNiyEbFjFv/o=";
+    hash = "sha256-axk6C8RLuoKWUdJ3sOklWqnlYTWKTaQh51eWZm2Dy+0=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/zwave-js-server-python/default.nix b/pkgs/development/python-modules/zwave-js-server-python/default.nix
index dcbeca33f827..42aaaa4d13e1 100644
--- a/pkgs/development/python-modules/zwave-js-server-python/default.nix
+++ b/pkgs/development/python-modules/zwave-js-server-python/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "zwave-js-server-python";
-  version = "0.43.0";
+  version = "0.43.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.9";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "home-assistant-libs";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-qzAM3vcVySJB6OfOHKXYYXDR+xOSbGpyH7b9TaYkOLM=";
+    hash = "sha256-qnGMUY7c2jqLQbVybVdu9vWcPMFoxCnCCTBhWP+AXE0=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python2-modules/TurboCheetah/default.nix b/pkgs/development/python2-modules/TurboCheetah/default.nix
deleted file mode 100644
index 717b2b5f2780..000000000000
--- a/pkgs/development/python2-modules/TurboCheetah/default.nix
+++ /dev/null
@@ -1,26 +0,0 @@
-{ lib
-, buildPythonPackage
-, fetchPypi
-, cheetah
-, nose
-}:
-
-buildPythonPackage rec {
-  pname = "TurboCheetah";
-  version = "1.0";
-
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "9e4c7ecb0d061bfb58281363ee1b09337083f013a8b4d0355326a5d8668f450c";
-  };
-
-  propagatedBuildInputs = [ cheetah ];
-
-  checkInputs = [ nose ];
-
-  meta = {
-    description = "TurboGears plugin to support use of Cheetah templates";
-    homepage = "http://docs.turbogears.org/TurboCheetah";
-    license = lib.licenses.mit;
-  };
-}
diff --git a/pkgs/development/python2-modules/cheetah/default.nix b/pkgs/development/python2-modules/cheetah/default.nix
deleted file mode 100644
index 1cee46fa7252..000000000000
--- a/pkgs/development/python2-modules/cheetah/default.nix
+++ /dev/null
@@ -1,33 +0,0 @@
-{ lib
-, buildPythonPackage
-, fetchPypi
-, markdown
-, isPy3k
-, TurboCheetah
-}:
-
-buildPythonPackage rec {
-  pname = "cheetah";
-  version = "2.4.4";
-
-  disabled = isPy3k;
-
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "be308229f0c1e5e5af4f27d7ee06d90bb19e6af3059794e5fd536a6f29a9b550";
-  };
-
-  propagatedBuildInputs = [ markdown ];
-
-  doCheck = false; # Circular dependency
-
-  checkInputs = [
-    TurboCheetah
-  ];
-
-  meta = {
-    homepage = "http://www.cheetahtemplate.org/";
-    description = "A template engine and code generation tool";
-    license = lib.licenses.mit;
-  };
-}
diff --git a/pkgs/development/python2-modules/construct/default.nix b/pkgs/development/python2-modules/construct/default.nix
deleted file mode 100644
index 5bbbd1501453..000000000000
--- a/pkgs/development/python2-modules/construct/default.nix
+++ /dev/null
@@ -1,39 +0,0 @@
-{ lib, stdenv, buildPythonPackage, fetchFromGitHub
-, pytestCheckHook, pytest-benchmark, enum34, numpy, arrow, ruamel-yaml
-}:
-
-buildPythonPackage rec {
-  pname   = "construct";
-  version = "2.10.54";
-
-  # no tests in PyPI tarball
-  src = fetchFromGitHub {
-    owner  = pname;
-    repo   = pname;
-    rev    = "v${version}";
-    sha256 = "1mqspsn6bf3ibvih1zna2glkg8iw7vy5zg9gzg0d1m8zcndk2c48";
-  };
-
-  checkInputs = [ pytestCheckHook enum34 numpy ];
-
-  # these have dependencies that are broken on Python 2
-  disabledTestPaths = [
-    "tests/gallery/test_gallery.py"
-    "tests/test_benchmarks.py"
-    "tests/test_compiler.py"
-  ];
-
-  disabledTests = [
-    "test_benchmarks"
-    "test_timestamp"
-  ] ++ lib.optionals stdenv.isDarwin [
-    "test_multiprocessing"
-  ];
-
-  meta = with lib; {
-    description = "Powerful declarative parser (and builder) for binary data";
-    homepage = "https://construct.readthedocs.org/";
-    license = licenses.mit;
-    maintainers = with maintainers; [ dotlambda ];
-  };
-}
diff --git a/pkgs/development/python2-modules/httpretty/default.nix b/pkgs/development/python2-modules/httpretty/default.nix
deleted file mode 100644
index 92ed5c6616e0..000000000000
--- a/pkgs/development/python2-modules/httpretty/default.nix
+++ /dev/null
@@ -1,52 +0,0 @@
-{ lib
-, buildPythonPackage
-, fetchPypi
-, tornado
-, requests
-, httplib2
-, sure
-, nose
-, nose-exclude
-, coverage
-, rednose
-, nose-randomly
-, six
-, mock
-}:
-
-buildPythonPackage rec {
-  pname = "httpretty";
-  version = "0.9.7";
-
-  # drop this for version > 0.9.7
-  # Flaky tests: https://github.com/gabrielfalcao/HTTPretty/pull/394
-  doCheck = lib.versionAtLeast version "0.9.8";
-
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "66216f26b9d2c52e81808f3e674a6fb65d4bf719721394a1a9be926177e55fbe";
-  };
-
-  propagatedBuildInputs = [ six ];
-
-  checkInputs = [ nose sure coverage mock rednose
-    # Following not declared in setup.py
-    nose-randomly requests tornado httplib2 nose-exclude
-  ];
-
-  __darwinAllowLocalNetworking = true;
-
-  # Those flaky tests are failing intermittently on all platforms
-  NOSE_EXCLUDE = lib.concatStringsSep "," [
-    "tests.functional.test_httplib2.test_callback_response"
-    "tests.functional.test_requests.test_streaming_responses"
-    "tests.functional.test_httplib2.test_callback_response"
-    "tests.functional.test_requests.test_httpretty_should_allow_adding_and_overwritting_by_kwargs_u2"
-  ];
-
-  meta = with lib; {
-    homepage = "https://httpretty.readthedocs.org/";
-    description = "HTTP client request mocking tool";
-    license = licenses.mit;
-  };
-}
diff --git a/pkgs/development/python2-modules/markdown/default.nix b/pkgs/development/python2-modules/markdown/default.nix
deleted file mode 100644
index 13ed2f1744a2..000000000000
--- a/pkgs/development/python2-modules/markdown/default.nix
+++ /dev/null
@@ -1,33 +0,0 @@
-{ lib
-, buildPythonPackage
-, fetchPypi
-, setuptools
-, nose
-, pyyaml
-, pythonOlder
-, importlib-metadata
-}:
-
-buildPythonPackage rec {
-  pname = "Markdown";
-  version = "3.1.1";
-
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "2e50876bcdd74517e7b71f3e7a76102050edec255b3983403f1a63e7c8a41e7a";
-  };
-
-  propagatedBuildInputs = [
-    setuptools
-  ] ++ lib.optionals (pythonOlder "3.8") [
-    importlib-metadata
-  ];
-
-  checkInputs = [ nose pyyaml ];
-
-  meta = {
-    description = "A Python implementation of John Gruber's Markdown with Extension support";
-    homepage = "https://github.com/Python-Markdown/markdown";
-    license = lib.licenses.bsd3;
-  };
-}
diff --git a/pkgs/development/python2-modules/mutagen/default.nix b/pkgs/development/python2-modules/mutagen/default.nix
deleted file mode 100644
index 7f2e9f452b4d..000000000000
--- a/pkgs/development/python2-modules/mutagen/default.nix
+++ /dev/null
@@ -1,34 +0,0 @@
-{ lib
-, buildPythonPackage
-, fetchPypi
-, hypothesis
-, pycodestyle
-, pyflakes
-, pytest
-, setuptools
-, pkgs
-}:
-
-buildPythonPackage rec {
-  pname = "mutagen";
-  version = "1.43.1";
-
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "d873baeb7815311d3420aab0a1d83f050f628228cbc2d6045a14a16460411bc9";
-  };
-
-  propagatedBuildInputs = [ setuptools ];
-  checkInputs = [
-    pkgs.faad2 pkgs.flac pkgs.vorbis-tools pkgs.liboggz
-    pkgs.glibcLocales pycodestyle pyflakes pytest hypothesis
-  ];
-  LC_ALL = "en_US.UTF-8";
-
-  meta = with lib; {
-    description = "Python multimedia tagging library";
-    homepage = "https://mutagen.readthedocs.io";
-    license = licenses.lgpl2Plus;
-    platforms = platforms.all;
-  };
-}
diff --git a/pkgs/development/python2-modules/numpy/default.nix b/pkgs/development/python2-modules/numpy/default.nix
deleted file mode 100644
index 0bb01ef6812a..000000000000
--- a/pkgs/development/python2-modules/numpy/default.nix
+++ /dev/null
@@ -1,99 +0,0 @@
-{ lib
-, fetchPypi
-, python
-, buildPythonPackage
-, gfortran
-, pytest
-, blas
-, lapack
-, writeTextFile
-, isPyPy
-, cython
-, setuptools
- }:
-
-assert (!blas.isILP64) && (!lapack.isILP64);
-
-let
-  cfg = writeTextFile {
-    name = "site.cfg";
-    text = (lib.generators.toINI {} {
-      ${blas.implementation} = {
-        include_dirs = "${lib.getDev blas}/include:${lib.getDev lapack}/include";
-        library_dirs = "${blas}/lib:${lapack}/lib";
-        runtime_library_dirs = "${blas}/lib:${lapack}/lib";
-        libraries = "lapack,lapacke,blas,cblas";
-      };
-      lapack = {
-        include_dirs = "${lib.getDev lapack}/include";
-        library_dirs = "${lapack}/lib";
-        runtime_library_dirs = "${lapack}/lib";
-      };
-      blas = {
-        include_dirs = "${lib.getDev blas}/include";
-        library_dirs = "${blas}/lib";
-        runtime_library_dirs = "${blas}/lib";
-      };
-    });
-  };
-in buildPythonPackage rec {
-  pname = "numpy";
-  version = "1.16.6";
-  format = "pyproject";
-
-  src = fetchPypi {
-    inherit pname version;
-    extension = "zip";
-    sha256 = "e5cf3fdf13401885e8eea8170624ec96225e2174eb0c611c6f26dd33b489e3ff";
-  };
-
-  nativeBuildInputs = [ gfortran pytest cython setuptools ];
-  buildInputs = [ blas lapack ];
-
-  patches = lib.optionals python.hasDistutilsCxxPatch [
-    # We patch cpython/distutils to fix https://bugs.python.org/issue1222585
-    # Patching of numpy.distutils is needed to prevent it from undoing the
-    # patch to distutils.
-    ./numpy-distutils-C++.patch
-  ];
-
-  preConfigure = ''
-    sed -i 's/-faltivec//' numpy/distutils/system_info.py
-    export NPY_NUM_BUILD_JOBS=$NIX_BUILD_CORES
-    export OMP_NUM_THREADS=$((NIX_BUILD_CORES > 64 ? 64 : NIX_BUILD_CORES))
-  '';
-
-  preBuild = ''
-    ln -s ${cfg} site.cfg
-  '';
-
-  enableParallelBuilding = true;
-
-  doCheck = !isPyPy; # numpy 1.16+ hits a bug in pypy's ctypes, using either numpy or pypy HEAD fixes this (https://github.com/numpy/numpy/issues/13807)
-
-  checkPhase = ''
-    runHook preCheck
-    pushd "$out"
-    ${python.interpreter} -c 'import numpy; numpy.test("fast", verbose=10)'
-    popd
-    runHook postCheck
-  '';
-
-  passthru = {
-    # just for backwards compatibility
-    blas = blas.provider;
-    blasImplementation = blas.implementation;
-    inherit cfg;
-  };
-
-  # Disable test
-  # - test_large_file_support: takes a long time and can cause the machine to run out of disk space
-  NOSE_EXCLUDE="test_large_file_support";
-
-  meta = {
-    description = "Scientific tools for Python";
-    homepage = "https://numpy.org/";
-    license = lib.licenses.bsd3;
-    maintainers = with lib.maintainers; [ fridh ];
-  };
-}
diff --git a/pkgs/development/python2-modules/numpy/numpy-distutils-C++.patch b/pkgs/development/python2-modules/numpy/numpy-distutils-C++.patch
deleted file mode 100644
index b2626ea26e5b..000000000000
--- a/pkgs/development/python2-modules/numpy/numpy-distutils-C++.patch
+++ /dev/null
@@ -1,30 +0,0 @@
-diff --git a/numpy/distutils/unixccompiler.py b/numpy/distutils/unixccompiler.py
---- a/numpy/distutils/unixccompiler.py
-+++ b/numpy/distutils/unixccompiler.py
-@@ -44,8 +44,6 @@ def UnixCCompiler__compile(self, obj, src, ext, cc_args, extra_postargs, pp_opts
-         if opt not in llink_s:
-             self.linker_so = llink_s.split() + opt.split()
- 
--    display = '%s: %s' % (os.path.basename(self.compiler_so[0]), src)
--
-     # gcc style automatic dependencies, outputs a makefile (-MF) that lists
-     # all headers needed by a c file as a side effect of compilation (-MMD)
-     if getattr(self, '_auto_depends', False):
-@@ -54,8 +52,15 @@ def UnixCCompiler__compile(self, obj, src, ext, cc_args, extra_postargs, pp_opts
-         deps = []
- 
-     try:
--        self.spawn(self.compiler_so + cc_args + [src, '-o', obj] + deps +
--                   extra_postargs, display = display)
-+        if self.detect_language(src) == 'c++':
-+            display = '%s: %s' % (os.path.basename(self.compiler_so_cxx[0]), src)
-+            self.spawn(self.compiler_so_cxx + cc_args + [src, '-o', obj] + deps +
-+                       extra_postargs, display = display)
-+        else:
-+            display = '%s: %s' % (os.path.basename(self.compiler_so[0]), src)
-+            self.spawn(self.compiler_so + cc_args + [src, '-o', obj] + deps +
-+                       extra_postargs, display = display)
-+
-     except DistutilsExecError:
-         msg = str(get_exception())
-         raise CompileError(msg)
diff --git a/pkgs/development/python2-modules/pillow/default.nix b/pkgs/development/python2-modules/pillow/default.nix
deleted file mode 100644
index 61242c894a89..000000000000
--- a/pkgs/development/python2-modules/pillow/default.nix
+++ /dev/null
@@ -1,47 +0,0 @@
-{ lib, stdenv, buildPythonPackage, fetchPypi, isPyPy, isPy3k
-, olefile, freetype, libjpeg, zlib, libtiff, libwebp, tcl, lcms2, tk, libX11
-, openjpeg, libimagequant, pyroma, numpy, pytestCheckHook
-}@args:
-
-import ./generic.nix (rec {
-  pname = "Pillow";
-  version = "6.2.2";
-
-  disabled = !isPy3k;
-
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "0l5rv8jkdrb5q846v60v03mcq64yrhklidjkgwv6s1pda71g17yv";
-  };
-
-  meta = with lib; {
-    homepage = "https://python-pillow.org/";
-    description = "The friendly PIL fork (Python Imaging Library)";
-    longDescription = ''
-      The Python Imaging Library (PIL) adds image processing
-      capabilities to your Python interpreter.  This library
-      supports many file formats, and provides powerful image
-      processing and graphics capabilities.
-    '';
-    license = "http://www.pythonware.com/products/pil/license.htm";
-    maintainers = with maintainers; [ goibhniu prikhi SuperSandro2000 ];
-    knownVulnerabilities = [
-      "CVE-2020-10177"
-      "CVE-2020-10378"
-      "CVE-2020-10379"
-      "CVE-2020-10994"
-      "CVE-2020-11538"
-      "CVE-2020-35653"
-      "CVE-2020-35654"
-      "CVE-2020-35655"
-      "CVE-2021-25289"
-      "CVE-2021-25290"
-      "CVE-2021-25291"
-      "CVE-2021-25292"
-      "CVE-2021-25293"
-      "CVE-2021-27921"
-      "CVE-2021-27922"
-      "CVE-2021-27923"
-    ];
-  };
-} // args )
diff --git a/pkgs/development/python2-modules/pillow/generic.nix b/pkgs/development/python2-modules/pillow/generic.nix
deleted file mode 100644
index 3e33f1a8aa0f..000000000000
--- a/pkgs/development/python2-modules/pillow/generic.nix
+++ /dev/null
@@ -1,77 +0,0 @@
-{ pname
-, version
-, disabled
-, src
-, meta
-, ...
-}@args:
-
-with args;
-
-buildPythonPackage rec {
-  inherit pname version src meta;
-
-  # Disable imagefont tests, because they don't work well with infinality:
-  # https://github.com/python-pillow/Pillow/issues/1259
-  postPatch = ''
-    rm Tests/test_imagefont.py
-  '';
-
-  # Disable darwin tests which require executables: `iconutil` and `screencapture`
-  disabledTests = lib.optionals stdenv.isDarwin [
-    "test_grab"
-    "test_grabclipboard"
-    "test_save"
-
-    # pillow-simd
-    "test_roundtrip"
-    "test_basic"
-  ] ++ lib.optionals (lib.versions.major version == "6") [
-    # RuntimeError: Error setting from dictionary
-    "test_custom_metadata"
-  ];
-
-  propagatedBuildInputs = [ olefile ]
-    ++ lib.optionals (lib.versionAtLeast version "8.2.0") [ defusedxml ];
-
-  checkInputs = [ pytestCheckHook pyroma numpy ];
-
-  buildInputs = [ freetype libjpeg openjpeg libimagequant zlib libtiff libwebp tcl lcms2 ]
-    ++ lib.optionals (lib.versionAtLeast version "7.1.0") [ libxcb ]
-    ++ lib.optionals (isPyPy) [ tk libX11 ];
-
-  # NOTE: we use LCMS_ROOT as WEBP root since there is not other setting for webp.
-  # NOTE: The Pillow install script will, by default, add paths like /usr/lib
-  # and /usr/include to the search paths. This can break things when building
-  # on a non-NixOS system that has some libraries installed that are not
-  # installed in Nix (for example, Arch Linux has jpeg2000 but Nix doesn't
-  # build Pillow with this support). We patch the `disable_platform_guessing`
-  # setting here, instead of passing the `--disable-platform-guessing`
-  # command-line option, since the command-line option doesn't work when we run
-  # tests.
-  preConfigure = let
-    libinclude' = pkg: ''"${pkg.out}/lib", "${pkg.out}/include"'';
-    libinclude = pkg: ''"${pkg.out}/lib", "${pkg.dev}/include"'';
-  in ''
-    sed -i "setup.py" \
-        -e 's|^FREETYPE_ROOT =.*$|FREETYPE_ROOT = ${libinclude freetype}|g ;
-            s|^JPEG_ROOT =.*$|JPEG_ROOT = ${libinclude libjpeg}|g ;
-            s|^JPEG2K_ROOT =.*$|JPEG2K_ROOT = ${libinclude openjpeg}|g ;
-            s|^IMAGEQUANT_ROOT =.*$|IMAGEQUANT_ROOT = ${libinclude' libimagequant}|g ;
-            s|^ZLIB_ROOT =.*$|ZLIB_ROOT = ${libinclude zlib}|g ;
-            s|^LCMS_ROOT =.*$|LCMS_ROOT = ${libinclude lcms2}|g ;
-            s|^TIFF_ROOT =.*$|TIFF_ROOT = ${libinclude libtiff}|g ;
-            s|^TCL_ROOT=.*$|TCL_ROOT = ${libinclude' tcl}|g ;
-            s|self\.disable_platform_guessing = None|self.disable_platform_guessing = True|g ;'
-    export LDFLAGS="$LDFLAGS -L${libwebp}/lib"
-    export CFLAGS="$CFLAGS -I${libwebp}/include"
-  '' + lib.optionalString (lib.versionAtLeast version "7.1.0") ''
-    export LDFLAGS="$LDFLAGS -L${libxcb}/lib"
-    export CFLAGS="$CFLAGS -I${libxcb.dev}/include"
-  '' + lib.optionalString stdenv.isDarwin ''
-    # Remove impurities
-    substituteInPlace setup.py \
-      --replace '"/Library/Frameworks",' "" \
-      --replace '"/System/Library/Frameworks"' ""
-  '';
-}
diff --git a/pkgs/development/python2-modules/prettytable/default.nix b/pkgs/development/python2-modules/prettytable/default.nix
deleted file mode 100644
index 8191e9b5f579..000000000000
--- a/pkgs/development/python2-modules/prettytable/default.nix
+++ /dev/null
@@ -1,37 +0,0 @@
-{ lib
-, buildPythonPackage
-, fetchPypi
-, glibcLocales
-, setuptools-scm
-, wcwidth
-}:
-
-buildPythonPackage rec {
-  pname = "prettytable";
-  version = "1.0.1";
-
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "0wcpp1nkicrswb353yn6xd2x535cpif62nw5rgz33c1wj0wzbdvb";
-  };
-
-  nativeBuildInputs = [ setuptools-scm ];
-  buildInputs = [ glibcLocales ];
-
-  propagatedBuildInputs = [ wcwidth ];
-
-  preCheck = ''
-    export LANG="en_US.UTF-8"
-  '';
-
-  # no test no longer available in pypi package
-  doCheck = false;
-  pythonImportsCheck = [ "prettytable" ];
-
-  meta = with lib; {
-    description = "Simple Python library for easily displaying tabular data in a visually appealing ASCII table format";
-    homepage = "http://code.google.com/p/prettytable/";
-    license = licenses.bsd3;
-  };
-
-}
diff --git a/pkgs/development/python2-modules/pyyaml/default.nix b/pkgs/development/python2-modules/pyyaml/default.nix
deleted file mode 100644
index 3edfae90e668..000000000000
--- a/pkgs/development/python2-modules/pyyaml/default.nix
+++ /dev/null
@@ -1,38 +0,0 @@
-{ lib
-, buildPythonPackage
-, fetchFromGitHub
-, cython
-, libyaml
-, isPy27
-, python
-}:
-
-buildPythonPackage rec {
-  pname = "PyYAML";
-  version = "5.4.1.1";
-
-  src = fetchFromGitHub {
-    owner = "yaml";
-    repo = "pyyaml";
-    rev = version;
-    sha256 = "1v386gzdvsjg0mgix6v03rd0cgs9dl81qvn3m547849jm8r41dx8";
-  };
-
-  nativeBuildInputs = [ cython ];
-
-  buildInputs = [ libyaml ];
-
-  checkPhase = ''
-    runHook preCheck
-    PYTHONPATH=""tests/lib":$PYTHONPATH" ${python.interpreter} -m test_all
-    runHook postCheck
-  '';
-
-  pythonImportsCheck = [ "yaml" ];
-
-  meta = with lib; {
-    description = "The next generation YAML parser and emitter for Python";
-    homepage = "https://github.com/yaml/pyyaml";
-    license = licenses.mit;
-  };
-}
diff --git a/pkgs/development/python2-modules/qpid-python/default.nix b/pkgs/development/python2-modules/qpid-python/default.nix
deleted file mode 100644
index e22b3215e81f..000000000000
--- a/pkgs/development/python2-modules/qpid-python/default.nix
+++ /dev/null
@@ -1,26 +0,0 @@
-{ lib
-, buildPythonPackage
-, fetchurl
-, isPy3k
-}:
-
-buildPythonPackage rec {
-  pname = "qpid-python";
-  version = "0.32";
-  disabled = isPy3k;
-
-  src = fetchurl {
-    url = "http://www.us.apache.org/dist/qpid/${version}/${pname}-${version}.tar.gz";
-    sha256 = "09hdfjgk8z4s3dr8ym2r6xn97j1f9mkb2743pr6zd0bnj01vhsv4";
-  };
-
-  # needs a broker running and then ./qpid-python-test
-  doCheck = false;
-
-  meta = with lib; {
-    homepage = "https://qpid.apache.org/";
-    description = "Python client implementation and AMQP conformance tests for Apache Qpid";
-    license = licenses.asl20;
-  };
-
-}
diff --git a/pkgs/development/r-modules/default.nix b/pkgs/development/r-modules/default.nix
index f5bed2e3f5b2..229410315150 100644
--- a/pkgs/development/r-modules/default.nix
+++ b/pkgs/development/r-modules/default.nix
@@ -321,13 +321,13 @@ let
     Biostrings = [ pkgs.zlib ];
     bnpmr = [ pkgs.gsl ];
     cairoDevice = [ pkgs.gtk2.dev ];
-    Cairo = with pkgs; [ libtiff libjpeg cairo.dev xlibsWrapper fontconfig.lib ];
+    Cairo = with pkgs; [ libtiff libjpeg cairo.dev xorg.libXt.dev fontconfig.lib ];
     Cardinal = [ pkgs.which ];
     chebpol = [ pkgs.fftw.dev ];
     ChemmineOB = with pkgs; [ openbabel pkg-config ];
     curl = [ pkgs.curl.dev ];
     data_table = [ pkgs.zlib.dev ] ++ lib.optional stdenv.isDarwin pkgs.llvmPackages.openmp;
-    devEMF = with pkgs; [ xorg.libXft.dev xlibsWrapper ];
+    devEMF = with pkgs; [ xorg.libXft.dev ];
     diversitree = with pkgs; [ gsl fftw ];
     exactextractr = [ pkgs.geos ];
     EMCluster = [ pkgs.lapack ];
@@ -346,7 +346,7 @@ let
     haven = with pkgs; [ libiconv zlib.dev ];
     h5vc = [ pkgs.zlib.dev ];
     HiCseg = [ pkgs.gsl ];
-    imager = [ pkgs.xlibsWrapper ];
+    imager = [ pkgs.xorg.libX11.dev ];
     iBMQ = [ pkgs.gsl ];
     igraph = with pkgs; [ gmp libxml2.dev ];
     JavaGD = [ pkgs.jdk ];
diff --git a/pkgs/development/tools/agda-pkg/default.nix b/pkgs/development/tools/agda-pkg/default.nix
index 7c4ddb8a6883..498b38ec7aff 100644
--- a/pkgs/development/tools/agda-pkg/default.nix
+++ b/pkgs/development/tools/agda-pkg/default.nix
@@ -1,4 +1,6 @@
-{ lib, python3Packages }:
+{ lib
+, python3Packages
+}:
 
 with python3Packages;
 
@@ -22,7 +24,7 @@ buildPythonApplication rec {
 
   propagatedBuildInputs = [
     click
-    GitPython
+    gitpython
     pony
     whoosh
     natsort
diff --git a/pkgs/development/tools/analysis/checkov/default.nix b/pkgs/development/tools/analysis/checkov/default.nix
index 105080ce2230..2db9533590a3 100644
--- a/pkgs/development/tools/analysis/checkov/default.nix
+++ b/pkgs/development/tools/analysis/checkov/default.nix
@@ -70,7 +70,7 @@ buildPythonApplication rec {
     dockerfile-parse
     dpath
     flake8
-    GitPython
+    gitpython
     jmespath
     jsonpath-ng
     jsonschema
diff --git a/pkgs/development/tools/analysis/cvehound/default.nix b/pkgs/development/tools/analysis/cvehound/default.nix
index 12d36dc6089e..5bd6cdc00697 100644
--- a/pkgs/development/tools/analysis/cvehound/default.nix
+++ b/pkgs/development/tools/analysis/cvehound/default.nix
@@ -27,7 +27,7 @@ python3.pkgs.buildPythonApplication rec {
   ];
 
   checkInputs = with python3.pkgs; [
-    GitPython
+    gitpython
     psutil
     pytestCheckHook
   ];
diff --git a/pkgs/development/tools/analysis/smatch/default.nix b/pkgs/development/tools/analysis/smatch/default.nix
index ff7462091069..2100b72c9878 100644
--- a/pkgs/development/tools/analysis/smatch/default.nix
+++ b/pkgs/development/tools/analysis/smatch/default.nix
@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation rec {
   pname = "smatch";
-  version = "1.72";
+  version = "1.73";
 
   src = fetchFromGitHub {
     owner = "error27";
     repo = "smatch";
     rev = version;
-    sha256 = "sha256-XVW4sAgIxaJjAk75bp/O286uddIfgfKtIA2LniUGWBM=";
+    sha256 = "sha256-Pv3bd2cjnQKnhH7TrkYWfDEeaq6u/q/iK1ZErzn6bME=";
   };
 
   nativeBuildInputs = [ pkg-config ];
@@ -31,7 +31,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "A semantic analysis tool for C";
-    homepage = "http://smatch.sourceforge.net/";
+    homepage = "https://sparse.docs.kernel.org/";
     maintainers = with maintainers; [ marsam ];
     license = licenses.gpl2Plus;
     platforms = platforms.all;
diff --git a/pkgs/development/tools/ansible-language-server/default.nix b/pkgs/development/tools/ansible-language-server/default.nix
index be4bba8c2659..8d9b1f0ca50f 100644
--- a/pkgs/development/tools/ansible-language-server/default.nix
+++ b/pkgs/development/tools/ansible-language-server/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildNpmPackage
 , fetchFromGitHub
+, nix-update-script
 }:
 
 buildNpmPackage rec {
@@ -29,7 +30,7 @@ buildNpmPackage rec {
     sed -i '/"prepack"/d' package.json
   '';
 
-  passthru.updateScript = {
+  passthru.updateScript = nix-update-script {
     attrPath = pname;
   };
 
diff --git a/pkgs/development/tools/bbin/default.nix b/pkgs/development/tools/bbin/default.nix
new file mode 100644
index 000000000000..55e152e22ab4
--- /dev/null
+++ b/pkgs/development/tools/bbin/default.nix
@@ -0,0 +1,44 @@
+{ lib
+, stdenvNoCC
+, fetchFromGitHub
+, makeWrapper
+, babashka
+, graalvm17-ce
+}:
+
+stdenvNoCC.mkDerivation rec {
+  pname = "bbin";
+  version = "0.1.4";
+
+  src = fetchFromGitHub {
+    owner = "babashka";
+    repo = "bbin";
+    rev = "v${version}";
+    sha256 = "sha256-Oo6YF+uxcUG26Pz1X5uzPE/Hsx0UToOErZ2oUiKuZyI=";
+  };
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  dontConfigure = true;
+  dontBuild = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    install -D bbin $out/bin/bbin
+    mkdir -p $out/share
+    cp -r docs $out/share/docs
+    wrapProgram $out/bin/bbin \
+      --prefix PATH : "${lib.makeBinPath [ babashka graalvm17-ce ]}"
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    homepage = "https://github.com/babashka/bbin";
+    description = "Install any Babashka script or project with one command";
+    license = licenses.mit;
+    inherit (babashka.meta) platforms;
+    maintainers = with maintainers; [ sohalt ];
+  };
+}
diff --git a/pkgs/development/tools/build-managers/muon/default.nix b/pkgs/development/tools/build-managers/muon/default.nix
index b94a376ebb34..69320cc217e7 100644
--- a/pkgs/development/tools/build-managers/muon/default.nix
+++ b/pkgs/development/tools/build-managers/muon/default.nix
@@ -81,14 +81,13 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   buildPhase = let
-    muonFeatureFlag = feature: flag:
-      "-D${feature}=${if flag then "enabled" else "disabled"}";
-    muonConditionFlag = condition: flag:
-      "-D${condition}=${lib.boolToString flag}";
+    muonBool = lib.mesonBool;
+    muonEnable = lib.mesonEnable;
+
     cmdlineForMuon = lib.concatStringsSep " " [
-      (muonConditionFlag "static" stdenv.targetPlatform.isStatic)
-      (muonFeatureFlag "docs" buildDocs)
-      (muonFeatureFlag "samurai" embedSamurai)
+      (muonBool "static" stdenv.targetPlatform.isStatic)
+      (muonEnable "docs" buildDocs)
+      (muonEnable "samurai" embedSamurai)
     ];
     cmdlineForSamu = "-j$NIX_BUILD_CORES";
   in ''
diff --git a/pkgs/development/tools/buildpack/default.nix b/pkgs/development/tools/buildpack/default.nix
index db5898a6059e..c8a74bd03085 100644
--- a/pkgs/development/tools/buildpack/default.nix
+++ b/pkgs/development/tools/buildpack/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "pack";
-  version = "0.27.0";
+  version = "0.28.0";
 
   src = fetchFromGitHub {
     owner = "buildpacks";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-b1lqgY6pu4yt3yY2UupG7PQUkgotK0VDffCW/0thxoo=";
+    sha256 = "sha256-FKnOqK3qmzWEmf+92up8ApeotyQyZpbmLDY72U3+mY8=";
   };
 
-  vendorSha256 = "sha256-JqSk4w0chtWNYDQXo8oh5spAxor2kixo3fZcpV4LJ+8=";
+  vendorSha256 = "sha256-dYa6OuC2ingAh2VOzyGR4lK1GbTJ/l9iKXYWqRJmByc=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/development/tools/castxml/default.nix b/pkgs/development/tools/castxml/default.nix
index 5e3801628e7c..a944550f0792 100644
--- a/pkgs/development/tools/castxml/default.nix
+++ b/pkgs/development/tools/castxml/default.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "castxml";
-  version = "0.4.8";
+  version = "0.5.0";
 
   src = fetchFromGitHub {
     owner = "CastXML";
     repo = "CastXML";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-9IdQWNbk28OdpxVU1t4d1sGvjc62GeWUueYGDKRfOy4=";
+    hash = "sha256-NJ6DIZWab9KayFALHON9GfYg6sQOf71SbtfV+3TYKLQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/tools/coder/default.nix b/pkgs/development/tools/coder/default.nix
index 080e73ab2687..6cc572b87bc1 100644
--- a/pkgs/development/tools/coder/default.nix
+++ b/pkgs/development/tools/coder/default.nix
@@ -5,19 +5,19 @@
 }:
 buildGoModule rec {
   pname = "coder";
-  version = "0.12.5";
+  version = "0.13.1";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-tPpWj2MV2LLIOGq+RTpHpLozgqv7gBgYD3jjehRXOvk=";
+    hash = "sha256-85eH3gKn1khMiksA/kL+fHt1WiaOzVntYCiL1PR/0Cg=";
   };
 
   # integration tests require network access
   doCheck = false;
 
-  vendorHash = "sha256-3SStGCDpo+AS4PM9mbXM0EjsJ/3CVFQyb/NRK9RSZ3A=";
+  vendorHash = "sha256-tdqqGM2b8un4BFtvRJsmiIGdb1AOKP8XxcgGg2DilXA=";
 
   nativeBuildInputs = [ installShellFiles ];
 
@@ -29,9 +29,9 @@ buildGoModule rec {
   '';
 
   meta = with lib; {
-    description = "Remote development environments on your infrastructure provisioned with Terraform";
+    description = "Provision software development environments via Terraform on Linux, macOS, Windows, X86, ARM, and of course, Kubernetes";
     homepage = "https://coder.com";
     license = licenses.agpl3;
-    maintainers = with maintainers; [ urandom ];
+    maintainers = with maintainers; [ ghuntley urandom ];
   };
 }
diff --git a/pkgs/development/tools/continuous-integration/github-runner/default.nix b/pkgs/development/tools/continuous-integration/github-runner/default.nix
index 84c9c9268496..9947f12e523e 100644
--- a/pkgs/development/tools/continuous-integration/github-runner/default.nix
+++ b/pkgs/development/tools/continuous-integration/github-runner/default.nix
@@ -7,6 +7,7 @@
 , fetchFromGitHub
 , fetchurl
 , git
+, glibc
 , icu
 , libkrb5
 , lib
@@ -259,7 +260,12 @@ stdenv.mkDerivation rec {
     substituteInPlace $out/lib/run.sh    --replace '"$DIR"/bin' '"$DIR"/lib'
     substituteInPlace $out/lib/config.sh --replace './bin' $out'/lib' \
       --replace 'source ./env.sh' $out/bin/env.sh
-
+  '' + lib.optionalString stdenv.isLinux ''
+    # Make binary paths absolute
+    substituteInPlace $out/lib/config.sh \
+      --replace 'ldd' '${glibc}/bin/ldd' \
+      --replace '/sbin/ldconfig' '${glibc}/bin/ldconfig'
+  '' + ''
     # Remove uneeded copy for run-helper template
     substituteInPlace $out/lib/run.sh --replace 'cp -f "$DIR"/run-helper.sh.template "$DIR"/run-helper.sh' ' '
     substituteInPlace $out/lib/run-helper.sh --replace '"$DIR"/bin/' '"$DIR"/'
diff --git a/pkgs/development/tools/cue/validator.nix b/pkgs/development/tools/cue/validator.nix
new file mode 100644
index 000000000000..cddc3fe342b7
--- /dev/null
+++ b/pkgs/development/tools/cue/validator.nix
@@ -0,0 +1,17 @@
+{ cue, writeShellScript, lib }:
+# `document` must be a fragment of definition or structure that the input data will be matched against.
+# `document` must exist in the Cue schema file provided (`cueSchemaFile`).
+# The result is a script that can be used to validate the input data (JSON/YAML and more can be supported depending on Cue)
+# against the fragment described by `document` or the whole definition.
+# The script will be strict and enforce concrete values, i.e. partial documents are not supported.
+cueSchemaFile: { document ? null }:
+  writeShellScript "validate-using-cue"
+  ''${cue}/bin/cue \
+      --all-errors \
+      --strict \
+      vet \
+      --concrete \
+      "$1" \
+      ${cueSchemaFile} \
+      ${lib.optionalString (document != null) "-d \"${document}\""}
+  ''
diff --git a/pkgs/development/tools/ddosify/default.nix b/pkgs/development/tools/ddosify/default.nix
index 0cefbfc9281f..b13b396cbf37 100644
--- a/pkgs/development/tools/ddosify/default.nix
+++ b/pkgs/development/tools/ddosify/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "ddosify";
-  version = "0.9.0";
+  version = "0.9.1";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-8sqOhhuneLFxhmZjoMYYfWw9wv55zWzw3QQEZW+hxBU=";
+    sha256 = "sha256-CUCIY3tDkmNPnHFgfjWa5wVFvaSWV9DAyPFx3+dHxZQ=";
   };
 
   vendorSha256 = "sha256-mq82KNa01gHvW+RUREra+ysaJ1YWIwX0v/uYMxmFN4M=";
diff --git a/pkgs/development/tools/esbuild/default.nix b/pkgs/development/tools/esbuild/default.nix
index df4729eeb816..afb3b1c17e07 100644
--- a/pkgs/development/tools/esbuild/default.nix
+++ b/pkgs/development/tools/esbuild/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "esbuild";
-  version = "0.15.18";
+  version = "0.16.1";
 
   src = fetchFromGitHub {
     owner = "evanw";
     repo = "esbuild";
     rev = "v${version}";
-    sha256 = "sha256-b9R1ML+pgRg9j2yrkQmBulPuLHYLUQvW+WTyR/Cq6zE=";
+    sha256 = "sha256-5b9uJfIGWDQi5exPVCgK/9wrozptX1FebPMrWJ0v4TM=";
   };
 
   vendorSha256 = "sha256-+BfxCyg0KkDQpHt/wycy/8CTG6YBA/VJvJFhhzUnSiQ=";
diff --git a/pkgs/development/tools/fdroidserver/default.nix b/pkgs/development/tools/fdroidserver/default.nix
index 69c4e9907804..07448b21bb80 100644
--- a/pkgs/development/tools/fdroidserver/default.nix
+++ b/pkgs/development/tools/fdroidserver/default.nix
@@ -1,12 +1,12 @@
-{ fetchFromGitLab
+{ lib
+, fetchFromGitLab
 , python
-, lib
 , apksigner
 }:
 
 python.pkgs.buildPythonApplication rec {
-  version = "2.1.1";
   pname = "fdroidserver";
+  version = "2.1.1";
 
   src = fetchFromGitLab {
     owner = "fdroid";
@@ -16,24 +16,28 @@ python.pkgs.buildPythonApplication rec {
   };
 
   postPatch = ''
-    substituteInPlace fdroidserver/common.py --replace "FDROID_PATH = os.path.realpath(os.path.join(os.path.dirname(__file__), '..'))" "FDROID_PATH = '$out/bin'"
+    substituteInPlace fdroidserver/common.py \
+      --replace "FDROID_PATH = os.path.realpath(os.path.join(os.path.dirname(__file__), '..'))" "FDROID_PATH = '$out/bin'"
   '';
 
   preConfigure = ''
     ${python.interpreter} setup.py compile_catalog
   '';
+
   postInstall = ''
     patchShebangs gradlew-fdroid
     install -m 0755 gradlew-fdroid $out/bin
   '';
 
-  buildInputs = [ python.pkgs.babel ];
+  buildInputs = with python.pkgs; [
+    babel
+  ];
 
   propagatedBuildInputs = with python.pkgs; [
     androguard
     clint
     defusedxml
-    GitPython
+    gitpython
     libcloud
     mwclient
     paramiko
@@ -59,7 +63,7 @@ python.pkgs.buildPythonApplication rec {
     homepage = "https://f-droid.org";
     description = "Server and tools for F-Droid, the Free Software repository system for Android";
     license = licenses.agpl3;
-    maintainers = [ lib.maintainers.obfusk ];
+    maintainers = with maintainers; [ obfusk ];
   };
 
 }
diff --git a/pkgs/development/tools/fnm/default.nix b/pkgs/development/tools/fnm/default.nix
index b6d1688e5e68..6509f371e4fc 100644
--- a/pkgs/development/tools/fnm/default.nix
+++ b/pkgs/development/tools/fnm/default.nix
@@ -10,20 +10,20 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "fnm";
-  version = "1.32.0";
+  version = "1.33.1";
 
   src = fetchFromGitHub {
     owner = "Schniz";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-ttprb8w4EWq2F8TbeUt+rCc0paxLXkEzISnAskIstmo=";
+    sha256 = "sha256-dwnPFbgfrc+1qF3u5Nm1KQu84UWK6H6VerSUaQacbRs=";
   };
 
   nativeBuildInputs = [ installShellFiles ];
 
   buildInputs = lib.optionals stdenv.isDarwin [ DiskArbitration Foundation Security ];
 
-  cargoSha256 = "sha256-6nw7q/XQ3EOaXmyiqJJjLSX4W9Mn9W5nfl8shUttBx0=";
+  cargoSha256 = "sha256-T88C5oYyVfepUw0cdNRhEwrvEI0t1gw/5qZL1E46pkY=";
 
   doCheck = false;
 
diff --git a/pkgs/development/tools/go-mockery/default.nix b/pkgs/development/tools/go-mockery/default.nix
index a1b406ff8666..3b7911c20fe3 100644
--- a/pkgs/development/tools/go-mockery/default.nix
+++ b/pkgs/development/tools/go-mockery/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "go-mockery";
-  version = "2.14.1";
+  version = "2.15.0";
 
   src = fetchFromGitHub {
     owner = "vektra";
     repo = "mockery";
     rev = "v${version}";
-    sha256 = "sha256-FgDjuiBFzOaT8GlJYI7xNfxC9uhyZtBAIBFXZgW0BDU=";
+    sha256 = "sha256-RowVdrpUQdoxgJCrg9rzaF/7ZA09SKzjsVrzQb5wzR8=";
   };
 
   preCheck = ''
diff --git a/pkgs/development/tools/go-task/default.nix b/pkgs/development/tools/go-task/default.nix
index c428c8160ecc..c9d15f020125 100644
--- a/pkgs/development/tools/go-task/default.nix
+++ b/pkgs/development/tools/go-task/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "go-task";
-  version = "3.18.0";
+  version = "3.19.0";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = "task";
     rev = "v${version}";
-    sha256 = "sha256-b5YNiMnk1tBk7kO4YWAU8cyg5oHhKu95ogTtZ3N/6IY=";
+    sha256 = "sha256-UsMUBdhoWl2e4i3m7Tu4R3qULRf85V4Uw/52xMMyWio=";
   };
 
   vendorSha256 = "sha256-+DmnYd415FWgbY+gkDVWjnvbjTppfFV5NMpIE3Mm124=";
diff --git a/pkgs/development/tools/godot/4/default.nix b/pkgs/development/tools/godot/4/default.nix
index 177e2448cc31..13ccfcc80964 100644
--- a/pkgs/development/tools/godot/4/default.nix
+++ b/pkgs/development/tools/godot/4/default.nix
@@ -91,7 +91,7 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  sconsFlags = "platform=linuxbsd target=editor production=true";
+  sconsFlags = [ "platform=linuxbsd target=editor production=true" ];
   preConfigure = ''
     sconsFlags+=" ${
       lib.concatStringsSep " "
diff --git a/pkgs/development/tools/hcloud/default.nix b/pkgs/development/tools/hcloud/default.nix
index 6aa8cd74f1f8..758a4c1fbaa6 100644
--- a/pkgs/development/tools/hcloud/default.nix
+++ b/pkgs/development/tools/hcloud/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "hcloud";
-  version = "1.31.0";
+  version = "1.31.1";
 
   src = fetchFromGitHub {
     owner = "hetznercloud";
     repo = "cli";
     rev = "v${version}";
-    sha256 = "sha256-AYxuH0R8vS7vBcEca1xM/0F70x5Zr+NUmcfRrRjb6cs=";
+    sha256 = "sha256-GyUobaU8ZJG/LrMM2LevBBhZN70grx6iJIMRxBRMqBg=";
   };
 
   vendorSha256 = "sha256-sSsu8p9dHLzJRWSLQHQNMmoziOrlDL4BoLIcBo2REbQ=";
diff --git a/pkgs/development/tools/misc/circleci-cli/default.nix b/pkgs/development/tools/misc/circleci-cli/default.nix
index c70569fd7518..c4e0a47257eb 100644
--- a/pkgs/development/tools/misc/circleci-cli/default.nix
+++ b/pkgs/development/tools/misc/circleci-cli/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "circleci-cli";
-  version = "0.1.22675";
+  version = "0.1.22770";
 
   src = fetchFromGitHub {
     owner = "CircleCI-Public";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-yCjCsUxl2IUIsiHBlqdNLtjbr+wNn6BpssD3+EHsHKA=";
+    sha256 = "sha256-3IQSI2cG+wEH7IgV8nEWvQRdfsSap8wQCniMWL/khOg=";
   };
 
   vendorSha256 = "sha256-tTG2i6ZEck0arKfCiFK7pGg9SE4n7FrF16US67Wj1gY=";
diff --git a/pkgs/development/tools/misc/svls/default.nix b/pkgs/development/tools/misc/svls/default.nix
index e5a26b75aa03..5b5b87b0392f 100644
--- a/pkgs/development/tools/misc/svls/default.nix
+++ b/pkgs/development/tools/misc/svls/default.nix
@@ -5,16 +5,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "svls";
-  version = "0.2.5";
+  version = "0.2.6";
 
   src = fetchFromGitHub {
     owner = "dalance";
     repo = "svls";
     rev = "v${version}";
-    sha256 = "sha256-SeVLQ05vPywSOnOEhJhQXYhdptmIhvYbbf9SX5eVzik=";
+    sha256 = "sha256-1qYTYAXNMM3umRFpWoij8VU3rhBI4QWePa5Uaz2Y4Ik=";
   };
 
-  cargoSha256 = "sha256-jp84LqFuK6Du2mWmgvadD7p8n/zcLKAKBOMQiERTKBI=";
+  cargoSha256 = "sha256-il7n8uxeXPKCBpRv3rqZZzqWjfpy558YNKBs9qOJ2oI=";
 
   meta = with lib; {
     description = "SystemVerilog language server";
diff --git a/pkgs/development/tools/misc/terraform-ls/default.nix b/pkgs/development/tools/misc/terraform-ls/default.nix
index 0148cbb7f97c..175f2b016e33 100644
--- a/pkgs/development/tools/misc/terraform-ls/default.nix
+++ b/pkgs/development/tools/misc/terraform-ls/default.nix
@@ -2,15 +2,15 @@
 
 buildGoModule rec {
   pname = "terraform-ls";
-  version = "0.30.0";
+  version = "0.30.1";
 
   src = fetchFromGitHub {
     owner = "hashicorp";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-CyWOXyJ9c7gf+WznU1SLX7tEM1f95015w9ePVwZ7GJU=";
+    sha256 = "sha256-enPnj4/p83hQkVv821MGyGipgEmVo12IZzy/3y8UprQ=";
   };
-  vendorSha256 = "sha256-UYFw9srf4FcF2XGIfsJQsRapEwcOHql59rKeKUnXPLo=";
+  vendorSha256 = "sha256-U3zslBDVz5nvhNgcn5L84hSUolf7XFCuh7zMZxyW/gQ=";
 
   ldflags = [ "-s" "-w" "-X main.version=v${version}" "-X main.prerelease=" ];
 
diff --git a/pkgs/development/tools/ocaml/js_of_ocaml/compiler.nix b/pkgs/development/tools/ocaml/js_of_ocaml/compiler.nix
index 64313112f43b..cec91a02f209 100644
--- a/pkgs/development/tools/ocaml/js_of_ocaml/compiler.nix
+++ b/pkgs/development/tools/ocaml/js_of_ocaml/compiler.nix
@@ -5,12 +5,12 @@
 
 buildDunePackage rec {
   pname = "js_of_ocaml-compiler";
-  version = "4.0.0";
-  useDune2 = true;
+  version = "4.1.0";
+  duneVersion = "3";
 
   src = fetchurl {
     url = "https://github.com/ocsigen/js_of_ocaml/releases/download/${version}/js_of_ocaml-${version}.tbz";
-    sha256 = "sha256:0pj9jjrmi0xxrzmygv4b5whsibw1jxy3wgibmws85x5jwlczh0nz";
+    sha256 = "sha256-kXk/KaWvPeq6P301zqsR5znP4KXMMFVvYgFGGm1CNu8=";
   };
 
   nativeBuildInputs = [ menhir ];
diff --git a/pkgs/development/tools/ocaml/js_of_ocaml/default.nix b/pkgs/development/tools/ocaml/js_of_ocaml/default.nix
index 679fd9ab9de8..9a86e52c65a4 100644
--- a/pkgs/development/tools/ocaml/js_of_ocaml/default.nix
+++ b/pkgs/development/tools/ocaml/js_of_ocaml/default.nix
@@ -5,7 +5,8 @@
 buildDunePackage {
   pname = "js_of_ocaml";
 
-  inherit (js_of_ocaml-compiler) version src useDune2;
+  inherit (js_of_ocaml-compiler) version src;
+  duneVersion = "3";
 
   buildInputs = [ ppxlib ];
 
diff --git a/pkgs/development/tools/ocaml/js_of_ocaml/lwt.nix b/pkgs/development/tools/ocaml/js_of_ocaml/lwt.nix
index 8cdb7224d891..741dd1f6acd3 100644
--- a/pkgs/development/tools/ocaml/js_of_ocaml/lwt.nix
+++ b/pkgs/development/tools/ocaml/js_of_ocaml/lwt.nix
@@ -5,7 +5,8 @@
 buildDunePackage {
   pname = "js_of_ocaml-lwt";
 
-  inherit (js_of_ocaml-compiler) version src useDune2;
+  inherit (js_of_ocaml-compiler) version src;
+  duneVersion = "3";
 
   buildInputs = [ js_of_ocaml-ppx ];
 
diff --git a/pkgs/development/tools/ocaml/js_of_ocaml/ppx.nix b/pkgs/development/tools/ocaml/js_of_ocaml/ppx.nix
index 535fe6dae79c..8c473d90996e 100644
--- a/pkgs/development/tools/ocaml/js_of_ocaml/ppx.nix
+++ b/pkgs/development/tools/ocaml/js_of_ocaml/ppx.nix
@@ -6,7 +6,8 @@
 buildDunePackage {
   pname = "js_of_ocaml-ppx";
 
-  inherit (js_of_ocaml-compiler) version src useDune2;
+  inherit (js_of_ocaml-compiler) version src;
+  duneVersion = "3";
 
   buildInputs = [ js_of_ocaml ];
   propagatedBuildInputs = [ ppxlib ];
diff --git a/pkgs/development/tools/ocaml/js_of_ocaml/ppx_deriving_json.nix b/pkgs/development/tools/ocaml/js_of_ocaml/ppx_deriving_json.nix
index 5256cd4037fc..0bb0674d322e 100644
--- a/pkgs/development/tools/ocaml/js_of_ocaml/ppx_deriving_json.nix
+++ b/pkgs/development/tools/ocaml/js_of_ocaml/ppx_deriving_json.nix
@@ -5,7 +5,8 @@
 buildDunePackage {
   pname = "js_of_ocaml-ppx_deriving_json";
 
-  inherit (js_of_ocaml-compiler) version src useDune2;
+  inherit (js_of_ocaml-compiler) version src;
+  duneVersion = "3";
 
   propagatedBuildInputs = [ js_of_ocaml ppxlib ];
 
diff --git a/pkgs/development/tools/open-policy-agent/default.nix b/pkgs/development/tools/open-policy-agent/default.nix
index b7f94177c586..3631c0e9e7fd 100644
--- a/pkgs/development/tools/open-policy-agent/default.nix
+++ b/pkgs/development/tools/open-policy-agent/default.nix
@@ -11,13 +11,13 @@ assert enableWasmEval && stdenv.isDarwin -> builtins.throw "building with wasm o
 
 buildGoModule rec {
   pname = "open-policy-agent";
-  version = "0.45.0";
+  version = "0.47.0";
 
   src = fetchFromGitHub {
     owner = "open-policy-agent";
     repo = "opa";
     rev = "v${version}";
-    sha256 = "sha256-7w5HOZr1cei7AvMdHdVzjB3ZQGWCOgm/g9UhuO3vSJI=";
+    sha256 = "sha256-aN/3xJFAc4r1nXF01tz4G4lP1KEQZQ3y+QuJ+wToD6M=";
   };
   vendorSha256 = null;
 
diff --git a/pkgs/development/tools/pip-audit/default.nix b/pkgs/development/tools/pip-audit/default.nix
index c734cfd3c0f0..cf9c2cf585cc 100644
--- a/pkgs/development/tools/pip-audit/default.nix
+++ b/pkgs/development/tools/pip-audit/default.nix
@@ -25,14 +25,14 @@ with py.pkgs;
 
 buildPythonApplication rec {
   pname = "pip-audit";
-  version = "2.4.7";
+  version = "2.4.8";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "trailofbits";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-LiL1TtMKypI8tVa0uZm1sCudCbw+pnTo/Z/J/PL2+44=";
+    hash = "sha256-j5B/aDDVV/Wb71nVwc4CUxS8AY05AI+n042Q/yNAl0c=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/tools/poetry2nix/poetry2nix/default.nix b/pkgs/development/tools/poetry2nix/poetry2nix/default.nix
index 4b10b3f8dd9a..6dad28bbdc05 100644
--- a/pkgs/development/tools/poetry2nix/poetry2nix/default.nix
+++ b/pkgs/development/tools/poetry2nix/poetry2nix/default.nix
@@ -5,7 +5,7 @@
 }:
 let
   # Poetry2nix version
-  version = "1.37.0";
+  version = "1.38.0";
 
   inherit (poetryLib) isCompatible readTOML normalizePackageName normalizePackageSet;
 
@@ -221,6 +221,16 @@ lib.makeScope pkgs.newScope (self: {
         getFunctorFn
         (
           [
+            # Remove Python packages aliases with non-normalized names to avoid issues with infinite recursion (issue #750).
+            (self: super: lib.attrsets.mapAttrs
+              (
+                name: value:
+                  if lib.isDerivation value && self.hasPythonModule value && (normalizePackageName name) != name
+                  then null
+                  else value
+              )
+              super)
+
             (
               self: super:
                 {
diff --git a/pkgs/development/tools/poetry2nix/poetry2nix/overrides/build-systems.json b/pkgs/development/tools/poetry2nix/poetry2nix/overrides/build-systems.json
index b0607e261601..a2c30400a60d 100644
--- a/pkgs/development/tools/poetry2nix/poetry2nix/overrides/build-systems.json
+++ b/pkgs/development/tools/poetry2nix/poetry2nix/overrides/build-systems.json
@@ -1204,6 +1204,9 @@
   "autobahn": [
     "setuptools"
   ],
+  "autoflake": [
+    "hatchling"
+  ],
   "autograd": [
     "setuptools"
   ],
@@ -1262,6 +1265,27 @@
     "poetry-core",
     "setuptools"
   ],
+  "aws-cdk-asset-awscli-v1": [
+    "setuptools"
+  ],
+  "aws-cdk-asset-kubectl-v20": [
+    "setuptools"
+  ],
+  "aws-cdk-asset-node-proxy-agent": [
+    "setuptools"
+  ],
+  "aws-cdk-asset-node-proxy-agent-v5": [
+    "setuptools"
+  ],
+  "aws-cdk-aws-batch-alpha": [
+    "setuptools"
+  ],
+  "aws-cdk-aws-lambda-python-alpha": [
+    "setuptools"
+  ],
+  "aws-cdk-lib": [
+    "setuptools"
+  ],
   "aws-error-utils": [
     "poetry"
   ],
@@ -1280,6 +1304,9 @@
   "awscli-cwlogs": [
     "setuptools"
   ],
+  "awscli-local": [
+    "setuptools"
+  ],
   "awscrt": [
     "setuptools"
   ],
@@ -2995,6 +3022,9 @@
   "construct": [
     "setuptools"
   ],
+  "constructs": [
+    "setuptools"
+  ],
   "consul": [
     "setuptools"
   ],
@@ -3707,6 +3737,9 @@
   "django-4": [
     "setuptools"
   ],
+  "django-admin-sortable2": [
+    "setuptools"
+  ],
   "django-allauth": [
     "setuptools"
   ],
@@ -3763,6 +3796,9 @@
   "django-cors-headers": [
     "setuptools"
   ],
+  "django-countries": [
+    "setuptools"
+  ],
   "django-crispy-forms": [
     "setuptools"
   ],
@@ -3850,6 +3886,9 @@
   "django-modelcluster": [
     "setuptools"
   ],
+  "django-modeltranslation": [
+    "setuptools"
+  ],
   "django-mptt": [
     "setuptools"
   ],
@@ -4706,6 +4745,9 @@
   "fabric": [
     "setuptools"
   ],
+  "fabric2": [
+    "setuptools"
+  ],
   "fabulous": [
     "setuptools"
   ],
@@ -7168,6 +7210,9 @@
     "pbr",
     "setuptools"
   ],
+  "jsii": [
+    "setuptools"
+  ],
   "jsmin": [
     "setuptools"
   ],
@@ -8882,6 +8927,15 @@
   "mypy-boto3-sqs": [
     "setuptools"
   ],
+  "mypy-boto3-ssm": [
+    "setuptools"
+  ],
+  "mypy-boto3-stepfunctions": [
+    "setuptools"
+  ],
+  "mypy-boto3-sts": [
+    "setuptools"
+  ],
   "mypy-extensions": [
     "setuptools"
   ],
@@ -8983,7 +9037,11 @@
     "setuptools"
   ],
   "nbclient": [
-    "setuptools"
+    "setuptools",
+    {
+      "buildSystem": "hatchling",
+      "from": "0.7.1"
+    }
   ],
   "nbconflux": [
     "setuptools"
@@ -9521,6 +9579,9 @@
   "openapi-core": [
     "setuptools"
   ],
+  "openapi-python-client": [
+    "poetry-core"
+  ],
   "openapi-schema-validator": [
     "poetry-core",
     "setuptools"
@@ -12038,7 +12099,8 @@
     "setuptools"
   ],
   "pymssql": [
-    "cython"
+    "cython",
+    "setuptools"
   ],
   "pymsteams": [
     "setuptools"
@@ -12771,6 +12833,9 @@
   "pyssim": [
     "setuptools"
   ],
+  "pystac": [
+    "setuptools"
+  ],
   "pystache": [
     "setuptools"
   ],
@@ -12932,6 +12997,9 @@
     "setuptools",
     "setuptools-scm"
   ],
+  "pytest-docker": [
+    "setuptools"
+  ],
   "pytest-doctestplus": [
     "setuptools",
     "setuptools-scm"
@@ -13640,6 +13708,9 @@
   "python-uinput": [
     "setuptools"
   ],
+  "python-ulid": [
+    "setuptools"
+  ],
   "python-unshare": [
     "setuptools"
   ],
@@ -15995,6 +16066,9 @@
   "streamlabswater": [
     "setuptools"
   ],
+  "streamlink": [
+    "setuptools"
+  ],
   "streamz": [
     "setuptools"
   ],
@@ -16702,6 +16776,9 @@
   "tornado": [
     "setuptools"
   ],
+  "tornado-utils": [
+    "setuptools"
+  ],
   "torpy": [
     "setuptools"
   ],
@@ -16982,6 +17059,9 @@
     "flit-core",
     "setuptools"
   ],
+  "types-aioboto3": [
+    "setuptools"
+  ],
   "types-aiobotocore": [
     "setuptools"
   ],
@@ -16994,6 +17074,9 @@
   "types-aiobotocore-elbv2": [
     "setuptools"
   ],
+  "types-aiobotocore-resourcegroupstaggingapi": [
+    "setuptools"
+  ],
   "types-aiobotocore-ssm": [
     "setuptools"
   ],
@@ -17039,9 +17122,15 @@
   "types-markdown": [
     "setuptools"
   ],
+  "types-pkg-resources": [
+    "setuptools"
+  ],
   "types-protobuf": [
     "setuptools"
   ],
+  "types-python-dateutil": [
+    "setuptools"
+  ],
   "types-pytz": [
     "setuptools"
   ],
@@ -17060,6 +17149,9 @@
   "types-setuptools": [
     "setuptools"
   ],
+  "types-six": [
+    "setuptools"
+  ],
   "types-tabulate": [
     "setuptools"
   ],
diff --git a/pkgs/development/tools/poetry2nix/poetry2nix/overrides/default.nix b/pkgs/development/tools/poetry2nix/poetry2nix/overrides/default.nix
index a19095230826..6a140ca25289 100644
--- a/pkgs/development/tools/poetry2nix/poetry2nix/overrides/default.nix
+++ b/pkgs/development/tools/poetry2nix/poetry2nix/overrides/default.nix
@@ -59,9 +59,6 @@ let
 
 in
 lib.composeManyExtensions [
-  # normalize all the names
-  (self: super: poetryLib.normalizePackageSet super)
-
   # NixOps
   (self: super:
     lib.mapAttrs (_: v: addBuildSystem { inherit self; drv = v; attr = "poetry"; }) (lib.filterAttrs (n: _: lib.strings.hasPrefix "nixops" n) super)
@@ -400,7 +397,7 @@ lib.composeManyExtensions [
           (
             old: {
               nativeBuildInputs = (old.nativeBuildInputs or [ ])
-                ++ lib.optional (lib.versionAtLeast old.version "3.4") [ self.setuptools-rust ]
+                ++ lib.optionals (lib.versionAtLeast old.version "3.4") [ self.setuptools-rust ]
                 ++ lib.optional (!self.isPyPy) pyBuildPackages.cffi
                 ++ lib.optional (lib.versionAtLeast old.version "3.5" && !isWheel)
                 (with pkgs.rustPlatform; [ cargoSetupHook rust.cargo rust.rustc ]);
@@ -639,6 +636,7 @@ lib.composeManyExtensions [
 
       fiona = super.fiona.overridePythonAttrs (
         old: {
+          format = "setuptools";
           buildInputs = (old.buildInputs or [ ]) ++ [ pkgs.gdal ];
           nativeBuildInputs = [
             pkgs.gdal # for gdal-config
@@ -1080,9 +1078,9 @@ lib.composeManyExtensions [
 
           buildInputs = old.buildInputs or [ ] ++ [
             pkgs.which
-          ] ++ lib.optional enableGhostscript [
+          ] ++ lib.optionals enableGhostscript [
             pkgs.ghostscript
-          ] ++ lib.optional stdenv.isDarwin [
+          ] ++ lib.optionals stdenv.isDarwin [
             Cocoa
           ];
 
@@ -1099,7 +1097,7 @@ lib.composeManyExtensions [
 
           nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [
             pkg-config
-          ] ++ lib.optional (lib.versionAtLeast super.matplotlib.version "3.5.0") [
+          ] ++ lib.optionals (lib.versionAtLeast super.matplotlib.version "3.5.0") [
             self.setuptools-scm
             self.setuptools-scm-git-archive
           ];
@@ -1395,6 +1393,7 @@ lib.composeManyExtensions [
             "3.7.9" = "sha256-QHzAhjHgm4XLxY2zUdnIsd/WWMI7dJLQQAvTXC+2asQ=";
             "3.8.0" = "sha256-8k0DetamwLqkdcg8V/D2J5ja6IJSLi50CE+ZjFa7Hdc=";
             "3.8.1" = "sha256-QXguyDxQHW9Fd3Nhmi5JzSxZQuk3HGPhhh/RGuOTZNY=";
+            "3.8.3" = "sha256-oSZO4cN1sJKd0T7pYrKG63is8AZMKaLRZqj5UCVY/14=";
           }.${version} or (
             lib.warn "Unknown orjson version: '${version}'. Please update getCargoHash." lib.fakeHash
           );
@@ -1771,7 +1770,7 @@ lib.composeManyExtensions [
 
       pymssql = super.pymssql.overridePythonAttrs (old: {
         buildInputs = (old.buildInputs or [ ])
-          ++ [ pkgs.openssl ];
+          ++ [ pkgs.openssl pkgs.libkrb5 ];
         propagatedBuildInputs = (old.propagatedBuildInputs or [ ])
           ++ [ pkgs.freetds ];
       });
@@ -2112,8 +2111,8 @@ lib.composeManyExtensions [
         if old.format != "wheel" then {
           nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++
             [ pkgs.gfortran ] ++
-            lib.optional (lib.versionAtLeast super.scipy.version "1.7.0") [ self.pythran ] ++
-            lib.optional (lib.versionAtLeast super.scipy.version "1.9.0") [ self.meson-python pkg-config ];
+            lib.optionals (lib.versionAtLeast super.scipy.version "1.7.0") [ self.pythran ] ++
+            lib.optionals (lib.versionAtLeast super.scipy.version "1.9.0") [ self.meson-python pkg-config ];
           propagatedBuildInputs = (old.propagatedBuildInputs or [ ]) ++ [ self.pybind11 ];
           setupPyBuildFlags = [ "--fcompiler='gnu95'" ];
           enableParallelBuilding = true;
@@ -2399,6 +2398,7 @@ lib.composeManyExtensions [
         let
           # Watchfiles does not include Cargo.lock in tarball released on PyPi for versions up to 0.17.0
           getRepoHash = version: {
+            "0.18.1" = "sha256-XEhu6M1hFi3/gAKZcei7KJSrIhhlZhlvZvbfyA6VLR4=";
             "0.18.0" = "sha256-biGGn0YAUbSO1hCJ4kU0ZWlqlXl/HRrBS3iIA3myRI8=";
             "0.17.0" = "1swpf265h9qq30cx55iy6jjirba3wml16wzb68k527ynrxr7hvqx";
             "0.16.1" = "1ss6gzcr6js2d2sddgz1p52gyiwpqmgrxm8r6wim7gnm4wvhav8a";
diff --git a/pkgs/development/tools/protoc-gen-validate/default.nix b/pkgs/development/tools/protoc-gen-validate/default.nix
index b06f345d71f3..13b61e1d694d 100644
--- a/pkgs/development/tools/protoc-gen-validate/default.nix
+++ b/pkgs/development/tools/protoc-gen-validate/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "protoc-gen-validate";
-  version = "0.9.0";
+  version = "0.9.1";
 
   src = fetchFromGitHub {
     owner = "bufbuild";
     repo = "protoc-gen-validate";
     rev = "v${version}";
-    sha256 = "sha256-k8FUdQDgtR6g/LRCT45RYVUImEKCneQh9BG6P4y1SME=";
+    sha256 = "sha256-5Vr7qE6AFesvBkOpgStxI26m8rbQ8pXOXvNxbcX/ilc=";
   };
 
-  vendorSha256 = "sha256-ZchgruaQOokgCh+6qkVr/d+PVflh/lKd10Ty+bMBEH0=";
+  vendorSha256 = "sha256-D8ITrzEwas/UElfsXBG2BfHGFcFsxzWFar2ehgLwy5U=";
 
   excludedPackages = [ "tests" ];
 
diff --git a/pkgs/development/tools/refurb/default.nix b/pkgs/development/tools/refurb/default.nix
index 1ecfd6e2bfe2..89fc4e87438a 100644
--- a/pkgs/development/tools/refurb/default.nix
+++ b/pkgs/development/tools/refurb/default.nix
@@ -5,14 +5,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "refurb";
-  version = "1.7.0";
+  version = "1.8.0";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "dosisod";
     repo = "refurb";
-    rev = "v${version}";
-    hash = "sha256-JA/kU+2cpNKY2umA3NXwsqbfOMv9t6I7GlMYhiA6GTg";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-dpPPhA5bVLiG9DsJ3RnO9RpCd0j4u5f//x/OTdlC+GQ=";
   };
 
   nativeBuildInputs = with python3Packages; [
diff --git a/pkgs/development/tools/ruff/default.nix b/pkgs/development/tools/ruff/default.nix
index dcf13834a51f..6bff31436ac9 100644
--- a/pkgs/development/tools/ruff/default.nix
+++ b/pkgs/development/tools/ruff/default.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "ruff";
-  version = "0.0.132";
+  version = "0.0.169";
 
   src = fetchFromGitHub {
     owner = "charliermarsh";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-0UcZBGD1l2hP8VH0tdNKY/SiXVTPLL0/eZpOwYnUgPs=";
+    sha256 = "sha256-YPVI1SaaLSqrpTu/uFTSyWbPVSDeADNVv2OfgR9K4qI=";
   };
 
-  cargoSha256 = "sha256-DlSSzFf2AludfAKrXSsI/V0K2ZjCy/ehZd3ULe3fjK4=";
+  cargoSha256 = "sha256-bP6gn/UIv1reytd8atNdoXZxsFFJCt+axl3UiCayERo=";
 
   buildInputs = lib.optionals stdenv.isDarwin [
     CoreServices
diff --git a/pkgs/development/tools/rust/cargo-about/default.nix b/pkgs/development/tools/rust/cargo-about/default.nix
index 4229f762bbcf..88b99889f1ba 100644
--- a/pkgs/development/tools/rust/cargo-about/default.nix
+++ b/pkgs/development/tools/rust/cargo-about/default.nix
@@ -9,13 +9,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-about";
-  version = "0.5.1";
+  version = "0.5.2";
 
   src = fetchFromGitHub {
     owner = "EmbarkStudios";
     repo = "cargo-about";
     rev = version;
-    sha256 = "sha256-T8Hhody0jMmZb6/xMkSvKCv4STZPbcrf/UB3APspYDM=";
+    sha256 = "sha256-8476jJK1oiXVX9G09NSL+xvXZdZ+h7grCHC6R0XXewo=";
   };
 
   cargoPatches = [
@@ -26,7 +26,7 @@ rustPlatform.buildRustPackage rec {
     ./zstd-pkg-config.patch
   ];
 
-  cargoSha256 = "sha256-2Reqj+WP6OoaB/3Z5llZP4c5ToVmMNX0Fe0IqDwcg2E=";
+  cargoSha256 = "sha256-EFpkBWQSWYyMrUa9Dh+n9kDNmXL/2yuEmFN3DcPeE7U=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/development/tools/rust/cargo-about/zstd-pkg-config.patch b/pkgs/development/tools/rust/cargo-about/zstd-pkg-config.patch
index e084538ca924..ea8b67085fd2 100644
--- a/pkgs/development/tools/rust/cargo-about/zstd-pkg-config.patch
+++ b/pkgs/development/tools/rust/cargo-about/zstd-pkg-config.patch
@@ -1,6 +1,6 @@
 --- a/Cargo.lock
 +++ b/Cargo.lock
-@@ -183,6 +183,7 @@ dependencies = [
+@@ -207,6 +207,7 @@ dependencies = [
   "toml_edit",
   "twox-hash",
   "url",
@@ -8,32 +8,33 @@
  ]
  
  [[package]]
-@@ -1039,6 +1040,12 @@ version = "0.1.0"
+@@ -1093,6 +1094,12 @@ version = "0.1.0"
  source = "registry+https://github.com/rust-lang/crates.io-index"
  checksum = "8b870d8c151b6f2fb93e84a13146138f05d02ed11c7e7c54f8826aaaf7c9f184"
  
 +[[package]]
 +name = "pkg-config"
-+version = "0.3.22"
++version = "0.3.26"
 +source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "12295df4f294471248581bc09bef3c38a5e46f1e36d6a37353621a0c6c357e1f"
++checksum = "6ac9a59f73473f1b8d852421e59e64809f025994837ef743615c6d0c5b305160"
 +
  [[package]]
  name = "ppv-lite86"
- version = "0.2.15"
-@@ -1902,4 +1909,5 @@ checksum = "2141bed8922b427761470e6bbfeff255da94fa20b0bbeab0d9297fcaf71e3aa7"
+ version = "0.2.16"
+@@ -2045,4 +2052,5 @@ checksum = "2141bed8922b427761470e6bbfeff255da94fa20b0bbeab0d9297fcaf71e3aa7"
  dependencies = [
   "cc",
   "libc",
 + "pkg-config",
  ]
-diff --git a/Cargo.toml b/Cargo.toml
-index bf2a896..35cbf7c 100644
 --- a/Cargo.toml
 +++ b/Cargo.toml
-@@ -80,3 +80,5 @@ toml_edit = "0.9"
+@@ -80,6 +80,8 @@ toml_edit = "0.15"
  twox-hash = "1.6"
  # Url parsing
  url = "2.2"
-+
++# Use pkg-config feature of zstd
 +zstd = { version = "*", features = ["pkg-config"] }
+ 
+ [dev-dependencies]
+ # Filesystems - Filesystem fixtures and assertions for testing
diff --git a/pkgs/development/tools/rust/cargo-modules/default.nix b/pkgs/development/tools/rust/cargo-modules/default.nix
index b6a6c2f53539..99d3eb61e43f 100644
--- a/pkgs/development/tools/rust/cargo-modules/default.nix
+++ b/pkgs/development/tools/rust/cargo-modules/default.nix
@@ -1,27 +1,26 @@
-{ lib, rustPlatform, fetchCrate, stdenv, CoreFoundation, CoreServices }:
+{ lib, rustPlatform, fetchFromGitHub, stdenv, darwin }:
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-modules";
-  version = "0.5.14";
+  version = "0.7.0";
 
-  src = fetchCrate {
-    inherit pname version;
-    sha256 = "sha256-urbyWNbmj2qEO4JJ/waRXGRJ9L5KgwsRB5Wh9yib8zc=";
+  src = fetchFromGitHub {
+    owner = "regexident";
+    repo = pname;
+    rev = version;
+    sha256 = "sha256-IBvSuyr3ERfPIivw6sEJSRta07Awmwd47cV1iKmvt8A=";
   };
 
-  cargoSha256 = "sha256-3OxO+j5UuPEg9xNmN+kIqpdq6fVnFpgx5xCaMNue52g=";
+  cargoSha256 = "sha256-zX3lBNQVWBrVQh+02TDUqU7Xmbd7hBOzJxD7cSNTNR0=";
 
   buildInputs = lib.optionals stdenv.isDarwin [
-    CoreFoundation
-    CoreServices
+    darwin.apple_sdk.frameworks.CoreServices
   ];
 
-  # the crate version doesn't include all the files required to run tests
-  doCheck = false;
-
   meta = with lib; {
     description = "A cargo plugin for showing a tree-like overview of a crate's modules";
     homepage = "https://github.com/regexident/cargo-modules";
+    changelog = "https://github.com/regexident/cargo-modules/blob/${version}/CHANGELOG.md";
     license = with licenses; [ mpl20 ];
     maintainers = with maintainers; [ figsoda rvarago ];
   };
diff --git a/pkgs/development/tools/rust/cargo-public-api/default.nix b/pkgs/development/tools/rust/cargo-public-api/default.nix
index 4bc23ae141d0..d5627993e298 100644
--- a/pkgs/development/tools/rust/cargo-public-api/default.nix
+++ b/pkgs/development/tools/rust/cargo-public-api/default.nix
@@ -8,14 +8,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-public-api";
-  version = "0.24.0";
+  version = "0.24.1";
 
   src = fetchCrate {
     inherit pname version;
-    sha256 = "sha256-6PAOyZmaqsHHyzS9sI591tnAi3/kwRlQR4K4iZJmR5Q=";
+    sha256 = "sha256-xXwJ6MXnSgqIQ5IuqfDm/TUXgkppKCPG3TB7veza/H8=";
   };
 
-  cargoSha256 = "sha256-wWSVpWmD1ZItXgH5q0u16oBQ+d4wKjg+pvt/ZlgiWBg=";
+  cargoSha256 = "sha256-1sSvK8oZspIxDcMAl2MyAQzuijAxj1kpiZf1QwwyYDs=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/development/tools/rust/cargo-update/default.nix b/pkgs/development/tools/rust/cargo-update/default.nix
index 30aa56aa29f2..61dc0d655fbb 100644
--- a/pkgs/development/tools/rust/cargo-update/default.nix
+++ b/pkgs/development/tools/rust/cargo-update/default.nix
@@ -15,14 +15,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-update";
-  version = "11.1.0";
+  version = "11.1.1";
 
   src = fetchCrate {
     inherit pname version;
-    sha256 = "sha256-WQUWAE8PR3FxTmWxoXmi6nsiyfbmLaIzOBJhC/8QYQw=";
+    sha256 = "sha256-ml+LqfnDld+I3G6+LaPJOeZa+swCtuu0ndW0yJraSxs=";
   };
 
-  cargoSha256 = "sha256-GirS6Tu5gkNPVGAKzfFkyi3tTlu3RRzp/PWHhPbmKdI=";
+  cargoSha256 = "sha256-0exatgmksg07KQO/3s9BD4uIZRHwjytQPtaRv+JydPc=";
 
   nativeBuildInputs = [ cmake installShellFiles pkg-config ronn ];
 
diff --git a/pkgs/development/tools/rust/rust-analyzer/default.nix b/pkgs/development/tools/rust/rust-analyzer/default.nix
index f9ec10f34301..8021ab2e6319 100644
--- a/pkgs/development/tools/rust/rust-analyzer/default.nix
+++ b/pkgs/development/tools/rust/rust-analyzer/default.nix
@@ -12,14 +12,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "rust-analyzer-unwrapped";
-  version = "2022-10-31";
-  cargoSha256 = "sha256-yehukhYwNhFqHUYmIe0P/LPgRHvyj1/DFCl2yzBkB8Q=";
+  version = "2022-12-05";
+  cargoSha256 = "sha256-lD52qI6LX5ORBWknCC4gAWQG8FPlNhOj6xQo1eXpO30=";
 
   src = fetchFromGitHub {
     owner = "rust-lang";
     repo = "rust-analyzer";
     rev = version;
-    sha256 = "sha256-D0YwkSqwtD08twtCtN5q0a8S0Y26kgDWg1ruRNEQEOw=";
+    sha256 = "sha256-2Syd2jVpY0UIfsYlmzvWICZTDVRG4UchcbRlNhuJSpM=";
   };
 
   cargoBuildFlags = [ "--bin" "rust-analyzer" "--bin" "rust-analyzer-proc-macro-srv" ];
diff --git a/pkgs/development/tools/rust/sqlx-cli/default.nix b/pkgs/development/tools/rust/sqlx-cli/default.nix
index df451e863481..7883e8841b0a 100644
--- a/pkgs/development/tools/rust/sqlx-cli/default.nix
+++ b/pkgs/development/tools/rust/sqlx-cli/default.nix
@@ -1,4 +1,17 @@
-{ stdenv, lib, rustPlatform, fetchFromGitHub, pkg-config, openssl, SystemConfiguration, CoreFoundation, Security, libiconv, testers, sqlx-cli }:
+{ stdenv
+, lib
+, rustPlatform
+, fetchFromGitHub
+, fetchpatch
+, pkg-config
+, openssl
+, SystemConfiguration
+, CoreFoundation
+, Security
+, libiconv
+, testers
+, sqlx-cli
+}:
 
 rustPlatform.buildRustPackage rec {
   pname = "sqlx-cli";
@@ -11,6 +24,15 @@ rustPlatform.buildRustPackage rec {
     sha256 = "sha256-pQlrKjhOJfjNEmLxqnFmmBY1naheZUsaq2tGdLKGxjg=";
   };
 
+  patches = [
+    # https://github.com/launchbadge/sqlx/pull/2228
+    (fetchpatch {
+      name = "fix-rust-1.65-compile.patch";
+      url = "https://github.com/launchbadge/sqlx/commit/2fdf85b212332647dc4ac47e087df946151feedf.patch";
+      hash = "sha256-5BCuIwmECe9qQrdYll7T+UOGwuTBolWEhKNE7GcZqJw=";
+    })
+  ];
+
   cargoSha256 = "sha256-AbA8L7rkyZfKW0vvjyrcW5eU6jGD+zAqIcEUOJmeqJs=";
 
   doCheck = false;
diff --git a/pkgs/development/tools/selene/default.nix b/pkgs/development/tools/selene/default.nix
index 27f61f4e7021..ec780ccef057 100644
--- a/pkgs/development/tools/selene/default.nix
+++ b/pkgs/development/tools/selene/default.nix
@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "selene";
-  version = "0.22.0";
+  version = "0.23.0";
 
   src = fetchFromGitHub {
     owner = "kampfkarren";
     repo = pname;
     rev = version;
-    sha256 = "sha256-6DbWz4u4mbW/aSDpaLxP4bG14gHxMGc4A8zMTVH/vj0=";
+    sha256 = "sha256-z1jefnWtaV97kq7CpfKsnFOgLHXDBonsmZTfUKJ4VIM=";
   };
 
-  cargoSha256 = "sha256-6dYXGxDNiLzpyZCmF2OJl2HAFyzJeAeQpEfaIZBBJD8=";
+  cargoSha256 = "sha256-TjkileWGB7ocBJPGh2Bm1ucigwL4j/uXgIOAonPHjbA=";
 
   nativeBuildInputs = lib.optional robloxSupport pkg-config;
 
diff --git a/pkgs/development/tools/stylua/default.nix b/pkgs/development/tools/stylua/default.nix
index 871fbb64b7fd..f83535a10e47 100644
--- a/pkgs/development/tools/stylua/default.nix
+++ b/pkgs/development/tools/stylua/default.nix
@@ -7,16 +7,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "stylua";
-  version = "0.15.2";
+  version = "0.15.3";
 
   src = fetchFromGitHub {
     owner = "johnnymorganz";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-cMT6+U9tfucPE5IkHjsWlzcD+nLQC24fqTyOhsTwFqk=";
+    sha256 = "sha256-EVsgiG16R4wh4Dh10rv7/H+VDONaVPWOfRNStrw8aso=";
   };
 
-  cargoSha256 = "sha256-H8oD769xdsXIJWqfFCL76MIKrKkHUSTzzciuHJBdjyI=";
+  cargoSha256 = "sha256-fDh6TchwQO+FvyPJzrso1Ls9ZIKMHDdFBTzf6AuvGqs=";
 
   # remove cargo config so it can find the linker on aarch64-unknown-linux-gnu
   postPatch = ''
diff --git a/pkgs/development/tools/tarmac/default.nix b/pkgs/development/tools/tarmac/default.nix
new file mode 100644
index 000000000000..15e5ecfe10a8
--- /dev/null
+++ b/pkgs/development/tools/tarmac/default.nix
@@ -0,0 +1,45 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, rustPlatform
+, pkg-config
+, openssl_1_1
+, Security
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "tarmac";
+  version = "0.7.0";
+
+  src = fetchFromGitHub {
+    owner = "Roblox";
+    repo = "tarmac";
+    rev = "v${version}";
+    sha256 = "sha256-O6qrAzGiAxiE56kpuvH/jDKHRXxHZ2SlDL5nwOOd4EU=";
+  };
+
+  cargoSha256 = "sha256-QnpowYv/TBXjPHK8z6KAzN3gSsfNOf9POybqsyugeWc=";
+
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
+  buildInputs = [
+    openssl_1_1
+  ] ++ lib.optionals stdenv.isDarwin [
+    Security
+  ];
+
+  meta = with lib; {
+    description = "Resource compiler and asset manager for Roblox";
+    longDescription = ''
+      Tarmac is a resource compiler and asset manager for Roblox projects.
+      It helps enable hermetic place builds when used with tools like Rojo.
+    '';
+    homepage = "https://github.com/Roblox/tarmac";
+    downloadPage = "https://github.com/Roblox/tarmac/releases/tag/v${version}";
+    changelog = "https://github.com/Roblox/tarmac/raw/v${version}/CHANGELOG.md";
+    license = licenses.mit;
+    maintainers = with maintainers; [ wackbyte ];
+  };
+}
diff --git a/pkgs/development/tools/wxformbuilder/default.nix b/pkgs/development/tools/wxformbuilder/default.nix
index b8db2d4aac43..9e4d2caabc30 100644
--- a/pkgs/development/tools/wxformbuilder/default.nix
+++ b/pkgs/development/tools/wxformbuilder/default.nix
@@ -52,5 +52,6 @@ stdenv.mkDerivation {
     homepage = "https://github.com/wxFormBuilder/wxFormBuilder";
     license = licenses.gpl2Only;
     maintainers = with maintainers; [ matthuszagh wegank ];
+    platforms = platforms.unix;
   };
 }
diff --git a/pkgs/development/tools/ytt/default.nix b/pkgs/development/tools/ytt/default.nix
index a26e71522e5f..8e33b84b364e 100644
--- a/pkgs/development/tools/ytt/default.nix
+++ b/pkgs/development/tools/ytt/default.nix
@@ -1,13 +1,13 @@
 { lib, buildGoModule, fetchFromGitHub }:
 buildGoModule rec {
   pname = "ytt";
-  version = "0.44.0";
+  version = "0.44.1";
 
   src = fetchFromGitHub {
     owner = "vmware-tanzu";
     repo = "carvel-ytt";
     rev = "v${version}";
-    sha256 = "sha256-mhfRrmZkeQWbYlgDEsjiUSOALXc6tI8eK81rjLYSXwk=";
+    sha256 = "sha256-3uyMwW8v2rPguXbPKy8IyQxroNaNS6rrXEcgRP91fdU=";
   };
 
   vendorSha256 = null;
diff --git a/pkgs/games/btanks/default.nix b/pkgs/games/btanks/default.nix
index 202bab0df667..cec88ab51bdc 100644
--- a/pkgs/games/btanks/default.nix
+++ b/pkgs/games/btanks/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, fetchpatch, sconsPackages, pkg-config, SDL, libGL, zlib, smpeg
+{ lib, stdenv, fetchurl, fetchpatch, scons, pkg-config, SDL, libGL, zlib, smpeg
 , SDL_image, libvorbis, expat, zip, lua }:
 
 stdenv.mkDerivation rec {
@@ -7,10 +7,10 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://sourceforge/${pname}/${pname}-${version}.tar.bz2";
-    sha256 = "0ha35kxc8xlbg74wsrbapfgxvcrwy6psjkqi7c6adxs55dmcxliz";
+    hash = "sha256-P9LOaitF96YMOxFPqa/xPLPdn7tqZc3JeYt2xPosQ0E=";
   };
 
-  nativeBuildInputs = [ sconsPackages.scons_3_0_1 pkg-config ];
+  nativeBuildInputs = [ scons pkg-config ];
 
   buildInputs = [ SDL libGL zlib smpeg SDL_image libvorbis expat zip lua ];
 
@@ -20,17 +20,25 @@ stdenv.mkDerivation rec {
 
   patches = [
     (fetchpatch {
-      url = "https://aur.archlinux.org/cgit/aur.git/plain/lua52.patch?h=btanks";
-      sha256 = "0ip563kz6lhwiims5djrxq3mvb7jx9yzkpsqxxhbi9n6qzz7y2az";
       name = "lua52.patch";
+      url = "https://aur.archlinux.org/cgit/aur.git/plain/lua52.patch?h=btanks&id=cd0e016963238f16209baa2da658aa3fad36e33d";
+      hash = "sha256-Xwl//sfGprhg71jf+X3q8qxdB+5ZtqJrjBxS8+cw5UY=";
     })
     (fetchpatch {
-      url = "https://salsa.debian.org/games-team/btanks/raw/master/debian/patches/gcc-4.7.patch";
-      sha256 = "1dxlk1xh69gj10sqcsyckiakb8an3h41206wby4z44mpmvxc7pi4";
+      url = "https://salsa.debian.org/games-team/btanks/-/raw/debian/0.9.8083-9/debian/patches/gcc-4.7.patch";
+      hash = "sha256-JN7D+q63EvKJX9wAEQgcVqE1VZzMa4Y1CPIlA3uYtLc=";
     })
     (fetchpatch {
-      url = "https://salsa.debian.org/games-team/btanks/raw/master/debian/patches/pow10f.patch";
-      sha256 = "1h45790v2dpdbccfn6lwfgl8782q54i14cz9gpipkaghcka4y0g9";
+      url = "https://salsa.debian.org/games-team/btanks/-/raw/debian/0.9.8083-9/debian/patches/pow10f.patch";
+      hash = "sha256-6QFP1GTwqXnjfekzEiIpWKCD6HOcGusYW+02sUE6hcA=";
+    })
+    (fetchpatch {
+      url = "https://salsa.debian.org/games-team/btanks/-/raw/debian/0.9.8083-9/debian/patches/python3.patch";
+      hash = "sha256-JpK409Myi8mxQaunmLFKKh1NKvKLXpNHHsDvRee8OoQ=";
+    })
+    (fetchpatch {
+      url = "https://salsa.debian.org/games-team/btanks/-/raw/debian/0.9.8083-9/debian/patches/scons.patch";
+      hash = "sha256-JCvBY2fOV8Sc/mpvEsJQv1wKcS1dHqYxvRk6I9p7ZKc=";
     })
   ];
 
diff --git a/pkgs/games/heroic/fhsenv.nix b/pkgs/games/heroic/fhsenv.nix
index 75012f405f81..d3625ad129b6 100644
--- a/pkgs/games/heroic/fhsenv.nix
+++ b/pkgs/games/heroic/fhsenv.nix
@@ -12,6 +12,7 @@ buildFHSUserEnv {
 
   targetPkgs = pkgs: with pkgs; [
     heroic-unwrapped
+    gamemode
     curl
     gawk
     gnome.zenity
@@ -49,21 +50,27 @@ buildFHSUserEnv {
     ];
   in pkgs: with pkgs; [
     alsa-lib
+    alsa-plugins
     bash
+    cabextract
     cairo
     coreutils
     cups
     dbus
+    freealut
     freetype
     fribidi
     giflib
     glib
     gnutls
+    gst_all_1.gst-plugins-base
     gtk3
     lcms2
     libevdev
+    libgcrypt
     libGLU
     libglvnd
+    libgpg-error
     libjpeg
     libkrb5
     libmpeg2
@@ -83,16 +90,19 @@ buildFHSUserEnv {
     libxkbcommon
     libxml2
     mpg123
+    ncurses
     ocl-icd
     openldap
     pipewire
     samba4
     sane-backends
     SDL2
+    sqlite
     udev
     udev
     unixODBC
     util-linux
+    v4l-utils
     vulkan-loader
     wayland
     zlib
diff --git a/pkgs/games/megaglest/default.nix b/pkgs/games/megaglest/default.nix
index 21ee6fa37448..e8558af0732a 100644
--- a/pkgs/games/megaglest/default.nix
+++ b/pkgs/games/megaglest/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, cmake, pkg-config, git, curl, SDL2, xercesc, openal, lua, libvlc
-, libjpeg, wxGTK30-gtk3, cppunit, ftgl, glew, libogg, libvorbis, buildEnv, libpng
+, libjpeg, wxGTK30, cppunit, ftgl, glew, libogg, libvorbis, buildEnv, libpng
 , fontconfig, freetype, xorg, makeWrapper, bash, which, gnome, libGLU, glib
 , fetchFromGitHub, fetchpatch
 }:
@@ -9,7 +9,7 @@ let
     name = "megaglest-lib-env";
     paths = [ SDL2 xorg.libSM xorg.libICE xorg.libX11 xorg.libXext
       xercesc openal libvorbis lua libjpeg libpng curl fontconfig ftgl freetype
-      stdenv.cc.cc glew libGLU wxGTK30-gtk3 ];
+      stdenv.cc.cc glew libGLU wxGTK30 ];
   };
   path-env = buildEnv {
     name = "megaglest-path-env";
@@ -38,7 +38,7 @@ stdenv.mkDerivation {
   ];
 
   nativeBuildInputs = [ cmake pkg-config makeWrapper git ];
-  buildInputs = [ curl SDL2 xercesc openal lua libpng libjpeg libvlc wxGTK30-gtk3
+  buildInputs = [ curl SDL2 xercesc openal lua libpng libjpeg libvlc wxGTK30
     glib cppunit fontconfig freetype ftgl glew libogg libvorbis libGLU ];
 
   cmakeFlags = [
diff --git a/pkgs/games/opendungeons/default.nix b/pkgs/games/opendungeons/default.nix
index 9afcbd898785..61f8aad304c8 100644
--- a/pkgs/games/opendungeons/default.nix
+++ b/pkgs/games/opendungeons/default.nix
@@ -16,6 +16,11 @@ stdenv.mkDerivation rec {
     ./fix_link_date_time.patch
   ];
 
+  # source/utils/StackTraceUnix.cpp:122:2: error: #error Unsupported architecture.
+  postPatch = lib.optionalString (!stdenv.isx86_64) ''
+    cp source/utils/StackTrace{Stub,Unix}.cpp
+  '';
+
   nativeBuildInputs = [ cmake pkg-config ];
   buildInputs = [ ogre cegui boost sfml openal ois ];
 
diff --git a/pkgs/games/portmod/default.nix b/pkgs/games/portmod/default.nix
index 27e00a746486..3ae372a0a8c5 100644
--- a/pkgs/games/portmod/default.nix
+++ b/pkgs/games/portmod/default.nix
@@ -1,6 +1,21 @@
-{ lib, callPackage, python3Packages, fetchFromGitLab, cacert
-, rustPlatform, bubblewrap, git, perlPackages, imagemagick, fetchurl, fetchzip
-, jre, makeWrapper, tr-patcher, tes3cmd, openmw }:
+{ lib
+, bubblewrap
+, cacert
+, callPackage
+, fetchFromGitLab
+, fetchurl
+, fetchzip
+, git
+, imagemagick
+, jre
+, makeWrapper
+, openmw
+, perlPackages
+, python3Packages
+, rustPlatform
+, tes3cmd
+, tr-patcher
+}:
 
 let
   version = "2.1.0";
@@ -9,7 +24,7 @@ let
     owner = "portmod";
     repo = "Portmod";
     rev = "v${version}";
-    sha256 = "sha256-b/ENApFovMPNUMbJhwY+TZCnSzpr1e/IKJ/5XAGTQjE=";
+    hash = "sha256-b/ENApFovMPNUMbJhwY+TZCnSzpr1e/IKJ/5XAGTQjE=";
   };
 
   portmod-rust = rustPlatform.buildRustPackage rec {
@@ -18,7 +33,9 @@ let
 
     cargoHash = "sha256-3EfMMpSWSYsB3nXaoGGDuKQ9duyCKzbrT6oeATnzqLE=";
 
-    nativeBuildInputs = [ python3Packages.python ];
+    nativeBuildInputs = [
+      python3Packages.python
+    ];
 
     doCheck = false;
   };
@@ -56,7 +73,7 @@ python3Packages.buildPythonApplication rec {
     colorama
     restrictedpython
     appdirs
-    GitPython
+    gitpython
     progressbar2
     python-sat
     redbaron
@@ -94,10 +111,10 @@ python3Packages.buildPythonApplication rec {
       "--prefix" "PATH" ":" "${lib.makeBinPath bin-programs }")
   '';
 
-  meta = {
+  meta = with lib; {
     description = "mod manager for openMW based on portage";
     homepage = "https://gitlab.com/portmod/portmod";
-    license = lib.licenses.gpl3;
-    maintainers = with lib.maintainers; [ marius851000 ];
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ marius851000 ];
   };
 }
diff --git a/pkgs/games/quakespasm/vulkan.nix b/pkgs/games/quakespasm/vulkan.nix
index bfd9691fe148..cc6793d2c058 100644
--- a/pkgs/games/quakespasm/vulkan.nix
+++ b/pkgs/games/quakespasm/vulkan.nix
@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   pname = "vkquake";
-  version = "1.20.3";
+  version = "1.22.1";
 
   src = fetchFromGitHub {
     owner = "Novum";
     repo = "vkQuake";
     rev = version;
-    sha256 = "sha256-ocxXkayWujqAFV5N67VfmzJOUbjCPBZut9zmwNRYDeI=";
+    sha256 = "sha256-v0KLYAI9X1JYN7v8vpoAMWEHVMXytX72lOnJl2gJako=";
   };
 
   sourceRoot = "source/Quake";
diff --git a/pkgs/games/rigsofrods/default.nix b/pkgs/games/rigsofrods/default.nix
index 1e1b8130e377..c3bf4498fa4b 100644
--- a/pkgs/games/rigsofrods/default.nix
+++ b/pkgs/games/rigsofrods/default.nix
@@ -1,4 +1,4 @@
-{ fetchFromGitHub, lib, stdenv, wxGTK30-gtk3, freeimage, cmake, zziplib, libGLU, libGL, boost,
+{ fetchFromGitHub, lib, stdenv, wxGTK30, freeimage, cmake, zziplib, libGLU, libGL, boost,
   pkg-config, libuuid, openal, ogre, ois, curl, gtk3, mygui, unzip,
   angelscript, ogrepaged, mysocketw, libxcb
   }:
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
   '';
 
   nativeBuildInputs = [ cmake pkg-config unzip ];
-  buildInputs = [ wxGTK30-gtk3 freeimage zziplib libGLU libGL boost
+  buildInputs = [ wxGTK30 freeimage zziplib libGLU libGL boost
     libuuid openal ogre ois curl gtk3 mygui angelscript
     ogrepaged mysocketw libxcb ];
 
diff --git a/pkgs/games/tennix/default.nix b/pkgs/games/tennix/default.nix
index 809ed7a146d0..e5b2b358f329 100644
--- a/pkgs/games/tennix/default.nix
+++ b/pkgs/games/tennix/default.nix
@@ -1,20 +1,21 @@
-{lib, stdenv, fetchurl, SDL, SDL_mixer, SDL_image, SDL_ttf, SDL_net, python2 } :
+{ lib, stdenv, fetchgit, which, SDL, SDL_mixer, SDL_image, SDL_ttf, SDL_net, python3 } :
 
 stdenv.mkDerivation rec {
   pname = "tennix";
-  version = "1.1";
-  src = fetchurl {
-    url = "https://icculus.org/tennix/downloads/tennix-${version}.tar.gz";
-    sha256 = "0np5kw1y7i0z0dsqx4r2nvmq86qj8hv3mmgavm3hxraqnds5z8cm";
+  version = "1.3.1";
+
+  src = fetchgit {
+    url = "git://repo.or.cz/tennix.git";
+    rev = "refs/tags/tennix-${version}";
+    sha256 = "sha256-U5+S1jEeg+7gdM1++dln6ePTqxZu2Zt0oUrH3DIlkgk=";
   };
 
-  buildInputs = [ python2 SDL SDL_mixer SDL_image SDL_ttf SDL_net ];
+  nativeBuildInputs = [ which ];
 
-  patches = [ ./fix_FTBFS.patch ];
+  buildInputs = [ python3 SDL SDL_mixer SDL_image SDL_ttf SDL_net ];
 
-  preConfigure = ''
-    makeFlags="PREFIX=$out"
-    installFlags="PREFIX=$out install"
+  configurePhase = ''
+    ./configure --prefix $out
   '';
 
   meta = with lib; {
diff --git a/pkgs/os-specific/linux/intel-compute-runtime/default.nix b/pkgs/os-specific/linux/intel-compute-runtime/default.nix
index d97dbf0eb262..d2d7c6218ae7 100644
--- a/pkgs/os-specific/linux/intel-compute-runtime/default.nix
+++ b/pkgs/os-specific/linux/intel-compute-runtime/default.nix
@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation rec {
   pname = "intel-compute-runtime";
-  version = "22.43.24558";
+  version = "22.43.24595.35";
 
   src = fetchFromGitHub {
     owner = "intel";
     repo = "compute-runtime";
     rev = version;
-    sha256 = "sha256-/hiDJLtEOLbnFjT697yLie5E7819fZM3xricPwe4xN0=";
+    sha256 = "sha256-CWiWkv3CmHhXAk2M92voeQ06ximSOnT9hgIA4rIxWmM=";
   };
 
   nativeBuildInputs = [ cmake pkg-config ];
diff --git a/pkgs/os-specific/linux/ipp-usb/default.nix b/pkgs/os-specific/linux/ipp-usb/default.nix
new file mode 100644
index 000000000000..0e79b89cfa34
--- /dev/null
+++ b/pkgs/os-specific/linux/ipp-usb/default.nix
@@ -0,0 +1,42 @@
+{ buildGoModule, avahi, libusb1, pkg-config, lib, fetchFromGitHub, ronn }:
+buildGoModule rec {
+  pname = "ipp-usb";
+  version = "0.9.23";
+
+  src = fetchFromGitHub {
+    owner = "openprinting";
+    repo = "ipp-usb";
+    rev = version;
+    sha256 = "sha256-sbPQWKqkTaD3kLNs0noVIzAN9cwDEaULsqO7SMQH2Jo=";
+  };
+
+  postPatch = ''
+    # rebuild with patched paths
+    rm ipp-usb.8
+    substituteInPlace Makefile --replace "install: all" "install: man"
+    substituteInPlace systemd-udev/ipp-usb.service --replace "/sbin" "$out/bin"
+    for i in Makefile paths.go ipp-usb.8.md; do
+      substituteInPlace $i --replace "/usr" "$out"
+      substituteInPlace $i --replace "/var/ipp-usb" "/var/lib/ipp-usb"
+    done
+  '';
+
+  nativeBuildInputs = [ pkg-config ronn ];
+  buildInputs = [ libusb1 avahi ];
+
+  vendorSha256 = "sha256-KwW6KgopjF4tVo8eB4OtpXF5R8jfrJ9nibNmaN8U4l8=";
+
+  postInstall = ''
+    # to accomodate the makefile
+    cp $out/bin/ipp-usb .
+    make install DESTDIR=$out
+  '';
+
+  meta = {
+    description = "Daemon to use the IPP everywhere protocol with USB printers";
+    homepage = "https://github.com/OpenPrinting/ipp-usb";
+    maintainers = [ lib.maintainers.symphorien ];
+    platforms = lib.platforms.linux;
+    license = lib.licenses.bsd2;
+  };
+}
diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix
index 5e6fea31f86f..5ac3a827f686 100644
--- a/pkgs/os-specific/linux/kernel/common-config.nix
+++ b/pkgs/os-specific/linux/kernel/common-config.nix
@@ -390,7 +390,7 @@ let
 
       TMPFS           = yes;
       TMPFS_POSIX_ACL = yes;
-      FS_ENCRYPTION   = if (versionAtLeast version "5.1") then yes else whenAtLeast "4.9" (option module);
+      FS_ENCRYPTION   = if (versionAtLeast version "5.1") then yes else option module;
 
       EXT2_FS_XATTR     = yes;
       EXT2_FS_POSIX_ACL = yes;
@@ -637,7 +637,6 @@ let
     media = {
       MEDIA_DIGITAL_TV_SUPPORT = yes;
       MEDIA_CAMERA_SUPPORT     = yes;
-      MEDIA_RC_SUPPORT         = whenOlder "4.14" yes;
       MEDIA_CONTROLLER         = yes;
       MEDIA_PCI_SUPPORT        = yes;
       MEDIA_USB_SUPPORT        = yes;
@@ -717,7 +716,7 @@ let
       LOCK_TORTURE_TEST        = option no;
       MTD_TESTS                = option no;
       NOTIFIER_ERROR_INJECTION = option no;
-      RCU_PERF_TEST            = whenBetween "4.13" "5.9" no;
+      RCU_PERF_TEST            = whenOlder "5.9" no;
       RCU_SCALE_TEST           = whenAtLeast "5.10" no;
       RCU_TORTURE_TEST         = option no;
       TEST_ASYNC_DRIVER_PROBE  = option no;
diff --git a/pkgs/os-specific/linux/kernel/hardened/config.nix b/pkgs/os-specific/linux/kernel/hardened/config.nix
index c90027f3eb14..198cd8681646 100644
--- a/pkgs/os-specific/linux/kernel/hardened/config.nix
+++ b/pkgs/os-specific/linux/kernel/hardened/config.nix
@@ -21,10 +21,6 @@ assert (stdenv.hostPlatform.isx86_64 -> versions.majorMinor version != "5.4");
   # Report BUG() conditions and kill the offending process.
   BUG = yes;
 
-  # Safer page access permissions (wrt. code injection).  Default on >=4.11.
-  DEBUG_RODATA          = whenOlder "4.11" yes;
-  DEBUG_SET_MODULE_RONX = whenOlder "4.11" yes;
-
   # Mark LSM hooks read-only after init.  SECURITY_WRITABLE_HOOKS n
   # conflicts with SECURITY_SELINUX_DISABLE y; disabling the latter
   # implicitly marks LSM hooks read-only after init.
@@ -33,10 +29,10 @@ assert (stdenv.hostPlatform.isx86_64 -> versions.majorMinor version != "5.4");
   #
   # We set SECURITY_WRITABLE_HOOKS n primarily for documentation purposes; the
   # config builder fails to detect that it has indeed been unset.
-  SECURITY_SELINUX_DISABLE = whenAtLeast "4.12" no;
-  SECURITY_WRITABLE_HOOKS  = whenAtLeast "4.12" (option no);
+  SECURITY_SELINUX_DISABLE = no;
+  SECURITY_WRITABLE_HOOKS  = option no;
 
-  STRICT_KERNEL_RWX = whenAtLeast "4.11" yes;
+  STRICT_KERNEL_RWX = yes;
 
   # Perform additional validation of commonly targeted structures.
   DEBUG_CREDENTIALS     = yes;
@@ -46,7 +42,7 @@ assert (stdenv.hostPlatform.isx86_64 -> versions.majorMinor version != "5.4");
   DEBUG_SG              = yes;
   SCHED_STACK_END_CHECK = yes;
 
-  REFCOUNT_FULL = whenBetween "4.13" "5.5" yes;
+  REFCOUNT_FULL = whenOlder "5.5" yes;
 
   # Randomize page allocator when page_alloc.shuffle=1
   SHUFFLE_PAGE_ALLOCATOR = whenAtLeast "5.2" yes;
@@ -69,11 +65,11 @@ assert (stdenv.hostPlatform.isx86_64 -> versions.majorMinor version != "5.4");
   # Gather additional entropy at boot time for systems that may not have appropriate entropy sources.
   GCC_PLUGIN_LATENT_ENTROPY = yes;
 
-  GCC_PLUGIN_STRUCTLEAK = whenAtLeast "4.11" yes; # A port of the PaX structleak plugin
-  GCC_PLUGIN_STRUCTLEAK_BYREF_ALL = whenAtLeast "4.14" yes; # Also cover structs passed by address
+  GCC_PLUGIN_STRUCTLEAK = yes; # A port of the PaX structleak plugin
+  GCC_PLUGIN_STRUCTLEAK_BYREF_ALL = yes; # Also cover structs passed by address
   GCC_PLUGIN_STACKLEAK = whenAtLeast "4.20" yes; # A port of the PaX stackleak plugin
-  GCC_PLUGIN_RANDSTRUCT = whenBetween "4.13" "5.19" yes; # A port of the PaX randstruct plugin
-  GCC_PLUGIN_RANDSTRUCT_PERFORMANCE = whenBetween "4.13" "5.19" yes;
+  GCC_PLUGIN_RANDSTRUCT = whenOlder "5.19" yes; # A port of the PaX randstruct plugin
+  GCC_PLUGIN_RANDSTRUCT_PERFORMANCE = whenOlder "5.19" yes;
 
   # Same as GCC_PLUGIN_RANDSTRUCT*, but has been renamed to `RANDSTRUCT*` in 5.19.
   RANDSTRUCT = whenAtLeast "5.19" yes;
diff --git a/pkgs/os-specific/linux/kernel/linux-4.14.nix b/pkgs/os-specific/linux/kernel/linux-4.14.nix
index 676302eb1e05..31f2e25c8f65 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.14.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.14.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "4.14.300";
+  version = "4.14.301";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "047vmh09icm45g7mnmdvyj9cam7747bcpah1s7n9dm5i2j2f906y";
+    sha256 = "16zrpfadsnznpl37crbq5g1hz1ch0zfp2a75yzlqy2fs0f7fxlmc";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-4.19.nix b/pkgs/os-specific/linux/kernel/linux-4.19.nix
index 734fa93fa207..167f7cd84792 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.19.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.19.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "4.19.267";
+  version = "4.19.268";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "035yxx13jz5f5ig2r6ybzgivm8vjafgnvjws0jfzha4w6klf7r9l";
+    sha256 = "0kr0di4gr6p57c8h6ybcli01kazq235npbh6qrpx0hpmqcdcx6r1";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-5.10.nix b/pkgs/os-specific/linux/kernel/linux-5.10.nix
index 8be0db43fb0d..3b56aa0c8e1a 100644
--- a/pkgs/os-specific/linux/kernel/linux-5.10.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.10.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "5.10.157";
+  version = "5.10.158";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "0zrjdmaj3sx0w7397glaiq6w9wwdj7lpff77a09kzmbyfz0dfk7w";
+    sha256 = "1rq7lyp41fydybs53rcdjhiy271arh95xch16s5s3jhhanxj82hy";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-5.15.nix b/pkgs/os-specific/linux/kernel/linux-5.15.nix
index f0e341f540a2..5892aead9007 100644
--- a/pkgs/os-specific/linux/kernel/linux-5.15.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.15.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "5.15.81";
+  version = "5.15.82";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "1awny3lgfkh5n2gdksajbyzips8kawz6rkr0p5inwkbmppg5r24g";
+    sha256 = "0r8v7113favmch2x6br7jk6idihza99l9qyd7ik99i5sg6xzdvpw";
   };
 } // (args.argsOverride or { }))
diff --git a/pkgs/os-specific/linux/kernel/linux-5.4.nix b/pkgs/os-specific/linux/kernel/linux-5.4.nix
index d4f06b7b2f83..8d874fc72694 100644
--- a/pkgs/os-specific/linux/kernel/linux-5.4.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.4.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "5.4.225";
+  version = "5.4.226";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "1ak0qlxzfylgvkldh2whq4mzynh1rymhnnc1yif9a5s3f7v9dxar";
+    sha256 = "0i4s1hl5q0ax55z7m5krzyw1zj9v03q8jcfksknb6qrg3lm5a7qc";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-6.0.nix b/pkgs/os-specific/linux/kernel/linux-6.0.nix
index 0815279fb4fa..e882de626a15 100644
--- a/pkgs/os-specific/linux/kernel/linux-6.0.nix
+++ b/pkgs/os-specific/linux/kernel/linux-6.0.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "6.0.11";
+  version = "6.0.12";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v6.x/linux-${version}.tar.xz";
-    sha256 = "0qn7m74wfixqk832j2yvgf2lq4vi55agm5gk9ziy2wa9wqqn3bib";
+    sha256 = "00ag63lnxw2gijw3b6v29lhrlv480m12954q5zh4jawlz3nk1dw9";
   };
 } // (args.argsOverride or { }))
diff --git a/pkgs/os-specific/linux/kernel/linux-testing.nix b/pkgs/os-specific/linux/kernel/linux-testing.nix
index 2e07f957efe1..76db1b11bbd2 100644
--- a/pkgs/os-specific/linux/kernel/linux-testing.nix
+++ b/pkgs/os-specific/linux/kernel/linux-testing.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "6.1-rc3";
+  version = "6.1-rc8";
   extraMeta.branch = lib.versions.majorMinor version;
 
   # modDirVersion needs to be x.y.z, will always add .0
@@ -11,7 +11,7 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "https://git.kernel.org/torvalds/t/linux-${version}.tar.gz";
-    hash = "sha256-qz863wvIe/JJjqSYoxxbt+2xTqgNNZJpAfWr8nG8wKk=";
+    hash = "sha256-YQYxNWZ7HmF3z5M88S8I8tjOaglNYWFtCGlGbDttx64=";
   };
 
   # Should the testing kernels ever be built on Hydra?
diff --git a/pkgs/os-specific/linux/kernel/manual-config.nix b/pkgs/os-specific/linux/kernel/manual-config.nix
index d046c8c7d192..edfd1f7dbc28 100644
--- a/pkgs/os-specific/linux/kernel/manual-config.nix
+++ b/pkgs/os-specific/linux/kernel/manual-config.nix
@@ -55,8 +55,7 @@ let
     hasAttr getAttr optional optionals optionalString optionalAttrs maintainers platforms;
 
   # Dependencies that are required to build kernel modules
-  moduleBuildDependencies = [ perl ]
-    ++ optional (lib.versionAtLeast version "4.14") libelf
+  moduleBuildDependencies = [ perl libelf ]
     ++ optional (lib.versionAtLeast version "5.13") zstd;
 
   drvAttrs = config_: kernelConf: kernelPatches: configfile:
@@ -100,7 +99,7 @@ let
       patches =
         map (p: p.patch) kernelPatches
         # Required for deterministic builds along with some postPatch magic.
-        ++ optional (lib.versionAtLeast version "4.13" && lib.versionOlder version "5.19") ./randstruct-provide-seed.patch
+        ++ optional (lib.versionOlder version "5.19") ./randstruct-provide-seed.patch
         ++ optional (lib.versionAtLeast version "5.19") ./randstruct-provide-seed-5.19.patch
         # Fixes determinism by normalizing metadata for the archive of kheaders
         ++ optional (lib.versionAtLeast version "5.2" && lib.versionOlder version "5.4") ./gen-kheaders-metadata.patch;
@@ -353,7 +352,7 @@ let
     };
 in
 
-assert (lib.versionAtLeast version "4.14" && lib.versionOlder version "5.8") -> libelf != null;
+assert lib.versionOlder version "5.8" -> libelf != null;
 assert lib.versionAtLeast version "5.8" -> elfutils != null;
 
 stdenv.mkDerivation ((drvAttrs config stdenv.hostPlatform.linux-kernel kernelPatches configfile) // {
@@ -365,7 +364,7 @@ stdenv.mkDerivation ((drvAttrs config stdenv.hostPlatform.linux-kernel kernelPat
   depsBuildBuild = [ buildPackages.stdenv.cc ];
   nativeBuildInputs = [ perl bc nettools openssl rsync gmp libmpc mpfr zstd python3Minimal ]
       ++ optional  (stdenv.hostPlatform.linux-kernel.target == "uImage") buildPackages.ubootTools
-      ++ optional  (lib.versionAtLeast version "4.14" && lib.versionOlder version "5.8") libelf
+      ++ optional  (lib.versionOlder version "5.8") libelf
       # Removed util-linuxMinimal since it should not be a dependency.
       ++ optionals (lib.versionAtLeast version "4.16") [ bison flex ]
       ++ optionals (lib.versionAtLeast version "5.2")  [ cpio pahole zlib ]
diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index 7c57d9edf601..0178cd7d6d45 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -6,6 +6,7 @@
 , fetchFromGitHub
 , fetchpatch
 , fetchzip
+, applyPatches
 , buildPackages
 , makeBinaryWrapper
 , ninja
@@ -79,7 +80,7 @@
 , withCoredump ? true
 , withCryptsetup ? true
 , withDocumentation ? true
-, withEfi ? stdenv.hostPlatform.isEfi
+, withEfi ? stdenv.hostPlatform.isEfi && !stdenv.hostPlatform.isMusl
 , withFido2 ? true
 , withHomed ? false
 , withHostnamed ? true
@@ -169,10 +170,20 @@ stdenv.mkDerivation {
   ] ++ lib.optional stdenv.hostPlatform.isMusl (
     let
       oe-core = fetchzip {
-        url = "https://git.openembedded.org/openembedded-core/snapshot/openembedded-core-86a33f98a7c0d6f2c2b51d02ba9e01b63062cf98.tar.bz2";
-        sha256 = "081j01sw21hl405l7g9z4bavvq0q0k4g80365677m0ykhiqlx3am";
+        url = "https://git.openembedded.org/openembedded-core/snapshot/openembedded-core-d43ec090ceb2bf0016a065103a4c34d0c43cb906.tar.gz";
+        sha256 = "sha256-e5rHmz0uyNgJwrAj96VGWWu9YHhZtJXoDpCtj17eC5w=";
       };
-      musl-patches = oe-core + "/meta/recipes-core/systemd/systemd";
+      oe-core-patched = applyPatches {
+        src = oe-core;
+        patches = [
+          (fetchpatch {
+            url = "https://lore.kernel.org/all/20221109002306.853567-1-raj.khem@gmail.com/raw";
+            includes = [ "meta/recipes-core/systemd/systemd/*" ];
+            sha256 = "sha256-aPJjN4vesZwFzgY4Nb6uaIuHz/quH1HccSVEof32IOU=";
+          })
+        ];
+      };
+      musl-patches = oe-core-patched + "/meta/recipes-core/systemd/systemd";
     in
     [
       (musl-patches + "/0003-missing_type.h-add-comparison_fn_t.patch")
@@ -194,6 +205,8 @@ stdenv.mkDerivation {
       (musl-patches + "/0001-pass-correct-parameters-to-getdents64.patch")
       (musl-patches + "/0002-Add-sys-stat.h-for-S_IFDIR.patch")
       (musl-patches + "/0001-Adjust-for-musl-headers.patch")
+      (musl-patches + "/0001-networkd-ipv4acd.c-Use-net-if.h-for-getting-IFF_LOOP.patch")
+      (musl-patches + "/0001-test-compile-test-utmp.c-only-if-UTMP-is-enabled.patch")
     ]
   );
 
diff --git a/pkgs/os-specific/linux/wireguard/default.nix b/pkgs/os-specific/linux/wireguard/default.nix
index 244092441b24..8d8342cce980 100644
--- a/pkgs/os-specific/linux/wireguard/default.nix
+++ b/pkgs/os-specific/linux/wireguard/default.nix
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
   buildFlags = [ "module" ];
   makeFlags = [
     "ARCH=${stdenv.hostPlatform.linuxArch}"
-  ] ++ lib.optional (stdenv.hostPlatform != stdenv.buildPlatform) [
+  ] ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
     "CROSS_COMPILE=${stdenv.cc.targetPrefix}"
   ];
 
diff --git a/pkgs/servers/bazarr/default.nix b/pkgs/servers/bazarr/default.nix
index 71f2272e3b52..3463e3688c09 100644
--- a/pkgs/servers/bazarr/default.nix
+++ b/pkgs/servers/bazarr/default.nix
@@ -1,9 +1,9 @@
-{ stdenv, lib, fetchurl, makeWrapper, unzip, python3, unrar, ffmpeg, nixosTests }:
+{ stdenv, lib, fetchurl, makeWrapper, unzip, python3, unar, ffmpeg, nixosTests }:
 
 let
   runtimeProgDeps = [
     ffmpeg
-    unrar
+    unar
   ];
 in
 stdenv.mkDerivation rec {
diff --git a/pkgs/servers/dns/knot-dns/default.nix b/pkgs/servers/dns/knot-dns/default.nix
index eaa1d0658581..29a296dcef68 100644
--- a/pkgs/servers/dns/knot-dns/default.nix
+++ b/pkgs/servers/dns/knot-dns/default.nix
@@ -1,6 +1,6 @@
 { lib, stdenv, fetchurl, pkg-config, gnutls, liburcu, lmdb, libcap_ng, libidn2, libunistring
 , systemd, nettle, libedit, zlib, libiconv, libintl, libmaxminddb, libbpf, nghttp2, libmnl
-, ngtcp2-gnutls
+, ngtcp2-gnutls, xdp-tools
 , autoreconfHook
 , nixosTests, knot-resolver, knot-dns, runCommandLocal
 }:
@@ -41,7 +41,7 @@ stdenv.mkDerivation rec {
     # TODO: add dnstap support?
   ] ++ lib.optionals stdenv.isLinux [
     libcap_ng systemd
-    libbpf libmnl # XDP support (it's Linux kernel API)
+    xdp-tools libbpf libmnl # XDP support (it's Linux kernel API)
   ] ++ lib.optional stdenv.isDarwin zlib; # perhaps due to gnutls
 
   enableParallelBuilding = true;
@@ -66,7 +66,7 @@ stdenv.mkDerivation rec {
     deps = runCommandLocal "knot-deps-test"
       { nativeBuildInputs = [ (lib.getBin stdenv.cc.libc) ]; }
       ''
-        for libname in libngtcp2 libbpf; do
+        for libname in libngtcp2 libxdp libbpf; do
           echo "Checking for $libname:"
           ldd '${knot-dns.bin}/bin/knotd' | grep -F "$libname"
           echo "OK"
diff --git a/pkgs/servers/home-assistant/component-packages.nix b/pkgs/servers/home-assistant/component-packages.nix
index a4b2f5c14cdd..8f635e6d0666 100644
--- a/pkgs/servers/home-assistant/component-packages.nix
+++ b/pkgs/servers/home-assistant/component-packages.nix
@@ -2,7 +2,7 @@
 # Do not edit!
 
 {
-  version = "2022.11.5";
+  version = "2022.12.0";
   components = {
     "3_day_blinds" = ps: with ps; [
     ];
@@ -50,6 +50,9 @@
     "airnow" = ps: with ps; [
       pyairnow
     ];
+    "airq" = ps: with ps; [
+      aioairq
+    ];
     "airthings" = ps: with ps; [
       airthings-cloud
     ];
@@ -60,9 +63,11 @@
       bleak
       bluetooth-adapters
       bluetooth-auto-recovery
+      bluetooth-data-tools
       dbus-fast
       fnvhash
       home-assistant-frontend
+      janus
       pillow
       pyserial
       pyudev
@@ -151,12 +156,16 @@
     ];
     "apple_tv" = ps: with ps; [
       aiohttp-cors
+      fnvhash
       ifaddr
       pyatv
+      sqlalchemy
       zeroconf
     ];
     "application_credentials" = ps: with ps; [
       aiohttp-cors
+      fnvhash
+      sqlalchemy
     ];
     "apprise" = ps: with ps; [
       apprise
@@ -170,6 +179,22 @@
     ];
     "aquostv" = ps: with ps; [
     ]; # missing inputs: sharp_aquos_rc
+    "aranet" = ps: with ps; [
+      aiohttp-cors
+      bleak-retry-connector
+      bleak
+      bluetooth-adapters
+      bluetooth-auto-recovery
+      bluetooth-data-tools
+      dbus-fast
+      fnvhash
+      home-assistant-frontend
+      janus
+      pillow
+      pyserial
+      pyudev
+      sqlalchemy
+    ]; # missing inputs: aranet4
     "arcam_fmj" = ps: with ps; [
       arcam-fmj
     ];
@@ -183,6 +208,7 @@
     ];
     "arwn" = ps: with ps; [
       aiohttp-cors
+      janus
       paho-mqtt
     ];
     "aseko_pool_live" = ps: with ps; [
@@ -207,20 +233,8 @@
       pyatome
     ];
     "august" = ps: with ps; [
-      aiohttp-cors
-      bleak-retry-connector
-      bleak
-      bluetooth-adapters
-      bluetooth-auto-recovery
-      dbus-fast
-      fnvhash
-      home-assistant-frontend
-      pillow
-      pyserial
-      pyudev
-      sqlalchemy
-      yalexs-ble
       yalexs
+      yalexs-ble
     ];
     "august_ble" = ps: with ps; [
     ];
@@ -254,6 +268,7 @@
     "axis" = ps: with ps; [
       aiohttp-cors
       axis
+      janus
       paho-mqtt
     ];
     "azure_devops" = ps: with ps; [
@@ -267,7 +282,9 @@
     ];
     "backup" = ps: with ps; [
       aiohttp-cors
+      fnvhash
       securetar
+      sqlalchemy
     ];
     "baf" = ps: with ps; [
     ]; # missing inputs: aiobafi6
@@ -317,9 +334,11 @@
       bluemaestro-ble
       bluetooth-adapters
       bluetooth-auto-recovery
+      bluetooth-data-tools
       dbus-fast
       fnvhash
       home-assistant-frontend
+      janus
       pillow
       pyserial
       pyudev
@@ -336,9 +355,11 @@
       bleak
       bluetooth-adapters
       bluetooth-auto-recovery
+      bluetooth-data-tools
       dbus-fast
       fnvhash
       home-assistant-frontend
+      janus
       pillow
       pyserial
       pyudev
@@ -350,9 +371,11 @@
       bleak
       bluetooth-adapters
       bluetooth-auto-recovery
+      bluetooth-data-tools
       dbus-fast
       fnvhash
       home-assistant-frontend
+      janus
       pillow
       pyserial
       pyudev
@@ -371,9 +394,13 @@
     "bosch_shc" = ps: with ps; [
       aiohttp-cors
       boschshcpy
+      fnvhash
       ifaddr
+      sqlalchemy
       zeroconf
     ];
+    "brandt" = ps: with ps; [
+    ];
     "braviatv" = ps: with ps; [
       pybravia
     ];
@@ -408,10 +435,12 @@
       bleak
       bluetooth-adapters
       bluetooth-auto-recovery
+      bluetooth-data-tools
       bthome-ble
       dbus-fast
       fnvhash
       home-assistant-frontend
+      janus
       pillow
       pyserial
       pyudev
@@ -443,6 +472,7 @@
     "cast" = ps: with ps; [
       pyturbojpeg
       aiohttp-cors
+      fnvhash
       hass-nabucasa
       ifaddr
       mutagen
@@ -450,6 +480,7 @@
       plexauth
       plexwebsocket
       PyChromecast
+      sqlalchemy
       zeroconf
     ];
     "cert_expiry" = ps: with ps; [
@@ -544,8 +575,10 @@
       crownstone-cloud
       crownstone-sse
       crownstone-uart
+      fnvhash
       pyserial
       pyudev
+      sqlalchemy
     ];
     "cups" = ps: with ps; [
       pycups
@@ -589,11 +622,13 @@
       bleak
       bluetooth-adapters
       bluetooth-auto-recovery
+      bluetooth-data-tools
       dbus-fast
       fnvhash
       hass-nabucasa
       home-assistant-frontend
       ifaddr
+      janus
       pillow
       psutil-home-assistant
       pyserial
@@ -634,7 +669,9 @@
     "devolo_home_control" = ps: with ps; [
       aiohttp-cors
       devolo-home-control-api
+      fnvhash
       ifaddr
+      sqlalchemy
       zeroconf
     ];
     "devolo_home_network" = ps: with ps; [
@@ -671,8 +708,10 @@
     ];
     "discovery" = ps: with ps; [
       aiohttp-cors
+      fnvhash
       ifaddr
       netdisco
+      sqlalchemy
       zeroconf
     ];
     "dlib_face_detect" = ps: with ps; [
@@ -686,13 +725,17 @@
     "dlna_dmr" = ps: with ps; [
       aiohttp-cors
       async-upnp-client
+      fnvhash
       ifaddr
+      sqlalchemy
       zeroconf
     ];
     "dlna_dms" = ps: with ps; [
       aiohttp-cors
       async-upnp-client
+      fnvhash
       ifaddr
+      sqlalchemy
       zeroconf
     ];
     "dnsip" = ps: with ps; [
@@ -720,6 +763,7 @@
     ];
     "dsmr_reader" = ps: with ps; [
       aiohttp-cors
+      janus
       paho-mqtt
     ];
     "dte_energy_bridge" = ps: with ps; [
@@ -788,7 +832,9 @@
     "elkm1" = ps: with ps; [
       aiohttp-cors
       elkm1-lib
+      fnvhash
       ifaddr
+      sqlalchemy
     ];
     "elmax" = ps: with ps; [
       elmax-api
@@ -808,7 +854,9 @@
     ];
     "emulated_hue" = ps: with ps; [
       aiohttp-cors
+      fnvhash
       ifaddr
+      sqlalchemy
     ];
     "emulated_kasa" = ps: with ps; [
       sense-energy
@@ -816,7 +864,9 @@
     "emulated_roku" = ps: with ps; [
       aiohttp-cors
       emulated-roku
+      fnvhash
       ifaddr
+      sqlalchemy
     ];
     "energy" = ps: with ps; [
       aiohttp-cors
@@ -855,10 +905,12 @@
       bleak
       bluetooth-adapters
       bluetooth-auto-recovery
+      bluetooth-data-tools
       construct
       dbus-fast
       fnvhash
       home-assistant-frontend
+      janus
       pillow
       pyserial
       pyudev
@@ -874,10 +926,12 @@
       bleak
       bluetooth-adapters
       bluetooth-auto-recovery
+      bluetooth-data-tools
       dbus-fast
       fnvhash
       home-assistant-frontend
       ifaddr
+      janus
       pillow
       pyserial
       pyudev
@@ -940,6 +994,7 @@
     ];
     "file_upload" = ps: with ps; [
       aiohttp-cors
+      janus
     ];
     "filesize" = ps: with ps; [
     ];
@@ -972,10 +1027,12 @@
       bleak
       bluetooth-adapters
       bluetooth-auto-recovery
+      bluetooth-data-tools
       dbus-fast
       fjaraskupan
       fnvhash
       home-assistant-frontend
+      janus
       pillow
       pyserial
       pyudev
@@ -1011,7 +1068,9 @@
     "flux_led" = ps: with ps; [
       aiohttp-cors
       flux-led
+      fnvhash
       ifaddr
+      sqlalchemy
     ];
     "folder" = ps: with ps; [
     ];
@@ -1026,7 +1085,9 @@
     ];
     "forked_daapd" = ps: with ps; [
       aiohttp-cors
+      fnvhash
       spotipy
+      sqlalchemy
     ]; # missing inputs: pyforked-daapd pylibrespot-java
     "fortios" = ps: with ps; [
       fortiosapi
@@ -1049,8 +1110,10 @@
     ];
     "fritz" = ps: with ps; [
       aiohttp-cors
+      fnvhash
       fritzconnection
       ifaddr
+      sqlalchemy
       xmltodict
     ];
     "fritzbox" = ps: with ps; [
@@ -1066,6 +1129,7 @@
       aiohttp-cors
       fnvhash
       home-assistant-frontend
+      janus
       pillow
       sqlalchemy
     ];
@@ -1114,7 +1178,9 @@
     ];
     "geocaching" = ps: with ps; [
       aiohttp-cors
+      fnvhash
       geocachingapi
+      sqlalchemy
     ];
     "geofency" = ps: with ps; [
       aiohttp-cors
@@ -1152,8 +1218,10 @@
     ];
     "google" = ps: with ps; [
       aiohttp-cors
+      fnvhash
       gcal-sync
       oauth2client
+      sqlalchemy
     ];
     "google_assistant" = ps: with ps; [
       pyturbojpeg
@@ -1172,7 +1240,9 @@
     ];
     "google_sheets" = ps: with ps; [
       aiohttp-cors
+      fnvhash
       gspread
+      sqlalchemy
     ];
     "google_translate" = ps: with ps; [
       gtts
@@ -1188,10 +1258,12 @@
       bleak
       bluetooth-adapters
       bluetooth-auto-recovery
+      bluetooth-data-tools
       dbus-fast
       fnvhash
       govee-ble
       home-assistant-frontend
+      janus
       pillow
       pyserial
       pyudev
@@ -1207,8 +1279,10 @@
     ];
     "gree" = ps: with ps; [
       aiohttp-cors
+      fnvhash
       greeclimate
       ifaddr
+      sqlalchemy
     ];
     "greeneye_monitor" = ps: with ps; [
       greeneye-monitor
@@ -1231,13 +1305,11 @@
     "habitica" = ps: with ps; [
       habitipy
     ];
-    "hangouts" = ps: with ps; [
-      hangups
-    ];
     "hardkernel" = ps: with ps; [
       aiohttp-cors
       fnvhash
       home-assistant-frontend
+      janus
       pillow
       psutil-home-assistant
       sqlalchemy
@@ -1255,6 +1327,7 @@
       aiohttp-cors
       fnvhash
       home-assistant-frontend
+      janus
       pillow
       sqlalchemy
     ];
@@ -1275,7 +1348,8 @@
       pyheos
     ];
     "here_travel_time" = ps: with ps; [
-      herepy
+    ]; # missing inputs: here_routing here_transit
+    "hexaom" = ps: with ps; [
     ];
     "hi_kumo" = ps: with ps; [
     ];
@@ -1306,7 +1380,9 @@
     ];
     "home_connect" = ps: with ps; [
       aiohttp-cors
+      fnvhash
       homeconnect
+      sqlalchemy
     ];
     "home_plus_control" = ps: with ps; [
       aiohttp-cors
@@ -1316,19 +1392,67 @@
     ];
     "homeassistant_alerts" = ps: with ps; [
     ];
+    "homeassistant_hardware" = ps: with ps; [
+      aiohttp-cors
+      bellows
+      fnvhash
+      home-assistant-frontend
+      ifaddr
+      janus
+      pillow
+      pyserial-asyncio
+      pyserial
+      pyudev
+      sqlalchemy
+      zeroconf
+      zha-quirks
+      zigpy-deconz
+      zigpy-xbee
+      zigpy-zigate
+      zigpy-znp
+      zigpy
+    ];
     "homeassistant_sky_connect" = ps: with ps; [
       aiohttp-cors
+      bellows
+      fnvhash
+      home-assistant-frontend
+      ifaddr
+      janus
+      pillow
       psutil-home-assistant
+      pyserial-asyncio
       pyserial
       pyudev
+      sqlalchemy
+      zeroconf
+      zha-quirks
+      zigpy-deconz
+      zigpy-xbee
+      zigpy-zigate
+      zigpy-znp
+      zigpy
     ];
     "homeassistant_yellow" = ps: with ps; [
       aiohttp-cors
+      bellows
       fnvhash
       home-assistant-frontend
+      ifaddr
+      janus
       pillow
       psutil-home-assistant
+      pyserial-asyncio
+      pyserial
+      pyudev
       sqlalchemy
+      zeroconf
+      zha-quirks
+      zigpy-deconz
+      zigpy-xbee
+      zigpy-zigate
+      zigpy-znp
+      zigpy
     ];
     "homekit" = ps: with ps; [
       pyqrcode
@@ -1339,6 +1463,7 @@
       hap-python
       ha-ffmpeg
       ifaddr
+      sqlalchemy
       zeroconf
     ];
     "homekit_controller" = ps: with ps; [
@@ -1348,10 +1473,12 @@
       bleak
       bluetooth-adapters
       bluetooth-auto-recovery
+      bluetooth-data-tools
       dbus-fast
       fnvhash
       home-assistant-frontend
       ifaddr
+      janus
       pillow
       pyserial
       pyudev
@@ -1427,10 +1554,12 @@
       bleak
       bluetooth-adapters
       bluetooth-auto-recovery
+      bluetooth-data-tools
       dbus-fast
       fnvhash
       home-assistant-frontend
       ibeacon-ble
+      janus
       pillow
       pyserial
       pyudev
@@ -1479,10 +1608,12 @@
       bleak
       bluetooth-adapters
       bluetooth-auto-recovery
+      bluetooth-data-tools
       dbus-fast
       fnvhash
       home-assistant-frontend
       inkbird-ble
+      janus
       pillow
       pyserial
       pyudev
@@ -1507,6 +1638,7 @@
       fnvhash
       home-assistant-frontend
       insteon-frontend-home-assistant
+      janus
       pillow
       pyinsteon
       pyserial
@@ -1528,7 +1660,9 @@
     ];
     "ios" = ps: with ps; [
       aiohttp-cors
+      fnvhash
       ifaddr
+      sqlalchemy
       zeroconf
     ];
     "iotawatt" = ps: with ps; [
@@ -1600,9 +1734,11 @@
       bleak
       bluetooth-adapters
       bluetooth-auto-recovery
+      bluetooth-data-tools
       dbus-fast
       fnvhash
       home-assistant-frontend
+      janus
       kegtron-ble
       pillow
       pyserial
@@ -1622,9 +1758,11 @@
       bleak
       bluetooth-adapters
       bluetooth-auto-recovery
+      bluetooth-data-tools
       dbus-fast
       fnvhash
       home-assistant-frontend
+      janus
       pillow
       pyserial
       pyudev
@@ -1669,8 +1807,15 @@
     "lametric" = ps: with ps; [
       aiohttp-cors
       demetriek
+      fnvhash
+      sqlalchemy
     ];
     "landisgyr_heat_meter" = ps: with ps; [
+      aiohttp-cors
+      fnvhash
+      pyserial
+      pyudev
+      sqlalchemy
       ultraheat-api
     ];
     "lannouncer" = ps: with ps; [
@@ -1693,9 +1838,11 @@
       bleak
       bluetooth-adapters
       bluetooth-auto-recovery
+      bluetooth-data-tools
       dbus-fast
       fnvhash
       home-assistant-frontend
+      janus
       led-ble
       pillow
       pyserial
@@ -1721,7 +1868,9 @@
       aiolifx
       aiolifx-effects
       aiolifx-themes
+      fnvhash
       ifaddr
+      sqlalchemy
     ];
     "lifx_cloud" = ps: with ps; [
     ];
@@ -1748,13 +1897,20 @@
     "litterrobot" = ps: with ps; [
       pylitterbot
     ];
+    "livisi" = ps: with ps; [
+    ]; # missing inputs: aiolivisi
     "llamalab_automate" = ps: with ps; [
     ];
+    "local_calendar" = ps: with ps; [
+      ical
+    ];
     "local_file" = ps: with ps; [
     ];
     "local_ip" = ps: with ps; [
       aiohttp-cors
+      fnvhash
       ifaddr
+      sqlalchemy
     ];
     "locative" = ps: with ps; [
       aiohttp-cors
@@ -1765,6 +1921,7 @@
       aiohttp-cors
       fnvhash
       home-assistant-frontend
+      janus
       pillow
       sqlalchemy
     ];
@@ -1808,6 +1965,8 @@
     "lyric" = ps: with ps; [
       aiohttp-cors
       aiolyric
+      fnvhash
+      sqlalchemy
     ];
     "magicseaweed" = ps: with ps; [
     ]; # missing inputs: magicseaweed
@@ -1822,12 +1981,14 @@
     ];
     "manual_mqtt" = ps: with ps; [
       aiohttp-cors
+      janus
       paho-mqtt
     ];
     "map" = ps: with ps; [
       aiohttp-cors
       fnvhash
       home-assistant-frontend
+      janus
       pillow
       sqlalchemy
     ];
@@ -1843,6 +2004,11 @@
     "matrix" = ps: with ps; [
       matrix-client
     ];
+    "matter" = ps: with ps; [
+      aiohttp-cors
+      fnvhash
+      sqlalchemy
+    ]; # missing inputs: python-matter-server
     "maxcube" = ps: with ps; [
       maxcube-api
     ];
@@ -1876,9 +2042,11 @@
       bleak
       bluetooth-adapters
       bluetooth-auto-recovery
+      bluetooth-data-tools
       dbus-fast
       fnvhash
       home-assistant-frontend
+      janus
       pillow
       pyserial
       pyudev
@@ -1953,9 +2121,11 @@
       bleak
       bluetooth-adapters
       bluetooth-auto-recovery
+      bluetooth-data-tools
       dbus-fast
       fnvhash
       home-assistant-frontend
+      janus
       moat-ble
       pillow
       pyserial
@@ -1966,8 +2136,10 @@
       pynacl
       pyturbojpeg
       aiohttp-cors
+      fnvhash
       hass-nabucasa
       pillow
+      sqlalchemy
     ];
     "mochad" = ps: with ps; [
     ]; # missing inputs: pymochad
@@ -1976,9 +2148,11 @@
     ];
     "modem_callerid" = ps: with ps; [
       aiohttp-cors
+      fnvhash
       phone-modem
       pyserial
       pyudev
+      sqlalchemy
     ];
     "modern_forms" = ps: with ps; [
       aiomodernforms
@@ -1993,8 +2167,10 @@
     ];
     "motion_blinds" = ps: with ps; [
       aiohttp-cors
+      fnvhash
       ifaddr
       motionblinds
+      sqlalchemy
     ];
     "motioneye" = ps: with ps; [
       aiohttp-cors
@@ -2005,22 +2181,27 @@
     ];
     "mqtt" = ps: with ps; [
       aiohttp-cors
+      janus
       paho-mqtt
     ];
     "mqtt_eventstream" = ps: with ps; [
       aiohttp-cors
+      janus
       paho-mqtt
     ];
     "mqtt_json" = ps: with ps; [
       aiohttp-cors
+      janus
       paho-mqtt
     ];
     "mqtt_room" = ps: with ps; [
       aiohttp-cors
+      janus
       paho-mqtt
     ];
     "mqtt_statestream" = ps: with ps; [
       aiohttp-cors
+      janus
       paho-mqtt
     ];
     "msteams" = ps: with ps; [
@@ -2039,6 +2220,7 @@
       aiohttp-cors
       fnvhash
       home-assistant-frontend
+      janus
       pillow
       sqlalchemy
     ];
@@ -2049,6 +2231,7 @@
     ];
     "mysensors" = ps: with ps; [
       aiohttp-cors
+      janus
       paho-mqtt
       pymysensors
     ];
@@ -2073,7 +2256,9 @@
     ];
     "neato" = ps: with ps; [
       aiohttp-cors
+      fnvhash
       pybotvac
+      sqlalchemy
     ];
     "nederlandse_spoorwegen" = ps: with ps; [
       nsapi
@@ -2083,15 +2268,19 @@
     ];
     "nest" = ps: with ps; [
       aiohttp-cors
+      fnvhash
       google-nest-sdm
       ha-ffmpeg
       python-nest
+      sqlalchemy
     ];
     "netatmo" = ps: with ps; [
       pyturbojpeg
       aiohttp-cors
+      fnvhash
       hass-nabucasa
       pyatmo
+      sqlalchemy
     ];
     "netdata" = ps: with ps; [
       netdata
@@ -2107,7 +2296,9 @@
     ]; # missing inputs: pynetio
     "network" = ps: with ps; [
       aiohttp-cors
+      fnvhash
       ifaddr
+      sqlalchemy
     ];
     "neurio_energy" = ps: with ps; [
     ]; # missing inputs: neurio
@@ -2129,7 +2320,6 @@
     ]; # missing inputs: notifications-android-tv
     "nibe_heatpump" = ps: with ps; [
       nibe
-      tenacity
     ];
     "nightscout" = ps: with ps; [
       py-nightscout
@@ -2148,10 +2338,12 @@
     ];
     "nmap_tracker" = ps: with ps; [
       aiohttp-cors
+      fnvhash
       getmac
       ifaddr
       mac-vendor-lookup
       netmap
+      sqlalchemy
     ];
     "nmbs" = ps: with ps; [
     ]; # missing inputs: pyrail
@@ -2225,6 +2417,7 @@
       aiohttp-cors
       fnvhash
       home-assistant-frontend
+      janus
       pillow
       sqlalchemy
     ];
@@ -2299,9 +2492,11 @@
       bleak
       bluetooth-adapters
       bluetooth-auto-recovery
+      bluetooth-data-tools
       dbus-fast
       fnvhash
       home-assistant-frontend
+      janus
       oralb-ble
       pillow
       pyserial
@@ -2329,6 +2524,7 @@
       pyturbojpeg
       aiohttp-cors
       hass-nabucasa
+      janus
       paho-mqtt
     ];
     "p1_monitor" = ps: with ps; [
@@ -2347,6 +2543,7 @@
       aiohttp-cors
       fnvhash
       home-assistant-frontend
+      janus
       pillow
       sqlalchemy
     ];
@@ -2354,6 +2551,7 @@
       aiohttp-cors
       fnvhash
       home-assistant-frontend
+      janus
       pillow
       sqlalchemy
     ];
@@ -2492,9 +2690,11 @@
       bleak
       bluetooth-adapters
       bluetooth-auto-recovery
+      bluetooth-data-tools
       dbus-fast
       fnvhash
       home-assistant-frontend
+      janus
       pillow
       pyserial
       pyudev
@@ -2556,6 +2756,7 @@
       aiohttp-cors
       fnvhash
       home-assistant-frontend
+      janus
       pillow
       psutil-home-assistant
       sqlalchemy
@@ -2674,6 +2875,22 @@
     ]; # missing inputs: russound_rio
     "russound_rnet" = ps: with ps; [
     ]; # missing inputs: russound
+    "ruuvitag_ble" = ps: with ps; [
+      aiohttp-cors
+      bleak-retry-connector
+      bleak
+      bluetooth-adapters
+      bluetooth-auto-recovery
+      bluetooth-data-tools
+      dbus-fast
+      fnvhash
+      home-assistant-frontend
+      janus
+      pillow
+      pyserial
+      pyudev
+      sqlalchemy
+    ]; # missing inputs: ruuvitag-ble
     "sabnzbd" = ps: with ps; [
       pysabnzbd
     ];
@@ -2683,6 +2900,7 @@
       fnvhash
       hass-nabucasa
       home-assistant-frontend
+      janus
       pillow
       sqlalchemy
     ];
@@ -2692,10 +2910,12 @@
     "samsungtv" = ps: with ps; [
       aiohttp-cors
       async-upnp-client
+      fnvhash
       getmac
       ifaddr
       samsungctl
       samsungtvws
+      sqlalchemy
       wakeonlan
       zeroconf
     ]
@@ -2727,6 +2947,8 @@
     ]; # missing inputs: scsgate
     "search" = ps: with ps; [
       aiohttp-cors
+      fnvhash
+      sqlalchemy
     ];
     "season" = ps: with ps; [
       ephem
@@ -2745,6 +2967,22 @@
     "sensibo" = ps: with ps; [
       pysensibo
     ];
+    "sensirion_ble" = ps: with ps; [
+      aiohttp-cors
+      bleak-retry-connector
+      bleak
+      bluetooth-adapters
+      bluetooth-auto-recovery
+      bluetooth-data-tools
+      dbus-fast
+      fnvhash
+      home-assistant-frontend
+      janus
+      pillow
+      pyserial
+      pyudev
+      sqlalchemy
+    ]; # missing inputs: sensirion-ble
     "sensor" = ps: with ps; [
       fnvhash
       sqlalchemy
@@ -2757,9 +2995,11 @@
       bleak
       bluetooth-adapters
       bluetooth-auto-recovery
+      bluetooth-data-tools
       dbus-fast
       fnvhash
       home-assistant-frontend
+      janus
       pillow
       pyserial
       pyudev
@@ -2772,9 +3012,11 @@
       bleak
       bluetooth-adapters
       bluetooth-auto-recovery
+      bluetooth-data-tools
       dbus-fast
       fnvhash
       home-assistant-frontend
+      janus
       pillow
       pyserial
       pyudev
@@ -2787,6 +3029,8 @@
     "senz" = ps: with ps; [
       aiohttp-cors
       aiosenz
+      fnvhash
+      sqlalchemy
     ];
     "serial" = ps: with ps; [
       pyserial-asyncio
@@ -2810,6 +3054,19 @@
     "shelly" = ps: with ps; [
       aiohttp-cors
       aioshelly
+      bleak-retry-connector
+      bleak
+      bluetooth-adapters
+      bluetooth-auto-recovery
+      bluetooth-data-tools
+      dbus-fast
+      fnvhash
+      home-assistant-frontend
+      janus
+      pillow
+      pyserial
+      pyudev
+      sqlalchemy
     ];
     "shiftr" = ps: with ps; [
       paho-mqtt
@@ -2839,6 +3096,8 @@
     ];
     "simply_automated" = ps: with ps; [
     ];
+    "simu" = ps: with ps; [
+    ];
     "simulated" = ps: with ps; [
     ];
     "sinch" = ps: with ps; [
@@ -2911,6 +3170,7 @@
     ];
     "snips" = ps: with ps; [
       aiohttp-cors
+      janus
       paho-mqtt
     ];
     "snmp" = ps: with ps; [
@@ -2922,9 +3182,11 @@
       bleak
       bluetooth-adapters
       bluetooth-auto-recovery
+      bluetooth-data-tools
       dbus-fast
       fnvhash
       home-assistant-frontend
+      janus
       pillow
       pyserial
       pysnooz
@@ -2960,12 +3222,14 @@
     "sonos" = ps: with ps; [
       aiohttp-cors
       async-upnp-client
+      fnvhash
       ifaddr
       plexapi
       plexauth
       plexwebsocket
       soco
       spotipy
+      sqlalchemy
       zeroconf
     ];
     "sony_projector" = ps: with ps; [
@@ -2990,7 +3254,9 @@
     ]; # missing inputs: hass_splunk
     "spotify" = ps: with ps; [
       aiohttp-cors
+      fnvhash
       spotipy
+      sqlalchemy
     ];
     "sql" = ps: with ps; [
       sqlalchemy
@@ -3004,7 +3270,9 @@
     "ssdp" = ps: with ps; [
       aiohttp-cors
       async-upnp-client
+      fnvhash
       ifaddr
+      sqlalchemy
       zeroconf
     ];
     "starline" = ps: with ps; [
@@ -3029,7 +3297,9 @@
       aiohttp-cors
       aiosteamist
       discovery30303
+      fnvhash
       ifaddr
+      sqlalchemy
     ];
     "stiebel_eltron" = ps: with ps; [
       pymodbus
@@ -3041,6 +3311,7 @@
       pyturbojpeg
       aiohttp-cors
       av
+      numpy
     ];
     "streamlabswater" = ps: with ps; [
       streamlabswater
@@ -3084,9 +3355,11 @@
       bleak
       bluetooth-adapters
       bluetooth-auto-recovery
+      bluetooth-data-tools
       dbus-fast
       fnvhash
       home-assistant-frontend
+      janus
       pillow
       pyserial
       pyudev
@@ -3117,7 +3390,9 @@
     ];
     "system_bridge" = ps: with ps; [
       aiohttp-cors
+      fnvhash
       ifaddr
+      sqlalchemy
       zeroconf
     ]; # missing inputs: systembridgeconnector
     "system_health" = ps: with ps; [
@@ -3147,6 +3422,7 @@
     "tasmota" = ps: with ps; [
       aiohttp-cors
       hatasmota
+      janus
       paho-mqtt
     ];
     "tautulli" = ps: with ps; [
@@ -3188,6 +3464,8 @@
     "tesla_wall_connector" = ps: with ps; [
       tesla-wall-connector
     ];
+    "text" = ps: with ps; [
+    ];
     "tfiac" = ps: with ps; [
     ]; # missing inputs: pytfiac
     "thermobeacon" = ps: with ps; [
@@ -3196,9 +3474,11 @@
       bleak
       bluetooth-adapters
       bluetooth-auto-recovery
+      bluetooth-data-tools
       dbus-fast
       fnvhash
       home-assistant-frontend
+      janus
       pillow
       pyserial
       pyudev
@@ -3213,9 +3493,11 @@
       bleak
       bluetooth-adapters
       bluetooth-auto-recovery
+      bluetooth-data-tools
       dbus-fast
       fnvhash
       home-assistant-frontend
+      janus
       pillow
       pyserial
       pyudev
@@ -3251,9 +3533,11 @@
       bleak
       bluetooth-adapters
       bluetooth-auto-recovery
+      bluetooth-data-tools
       dbus-fast
       fnvhash
       home-assistant-frontend
+      janus
       pillow
       pyserial
       pyudev
@@ -3296,8 +3580,10 @@
     ]; # missing inputs: pytouchline
     "tplink" = ps: with ps; [
       aiohttp-cors
+      fnvhash
       ifaddr
       python-kasa
+      sqlalchemy
     ];
     "tplink_lte" = ps: with ps; [
     ]; # missing inputs: tp-connected
@@ -3367,6 +3653,8 @@
     "twitter" = ps: with ps; [
       twitterapi
     ];
+    "ubiwizz" = ps: with ps; [
+    ];
     "ubus" = ps: with ps; [
       openwrt-ubus-rpc
     ];
@@ -3409,8 +3697,10 @@
     "upnp" = ps: with ps; [
       aiohttp-cors
       async-upnp-client
+      fnvhash
       getmac
       ifaddr
+      sqlalchemy
       zeroconf
     ];
     "uprise_smart_shades" = ps: with ps; [
@@ -3422,8 +3712,10 @@
     ];
     "usb" = ps: with ps; [
       aiohttp-cors
+      fnvhash
       pyserial
       pyudev
+      sqlalchemy
     ];
     "usgs_earthquakes_feed" = ps: with ps; [
       aio-geojson-usgs-earthquakes
@@ -3443,8 +3735,10 @@
     ]; # missing inputs: vtjp
     "velbus" = ps: with ps; [
       aiohttp-cors
+      fnvhash
       pyserial
       pyudev
+      sqlalchemy
       velbus-aio
     ];
     "velux" = ps: with ps; [
@@ -3542,6 +3836,8 @@
     ];
     "websocket_api" = ps: with ps; [
       aiohttp-cors
+      fnvhash
+      sqlalchemy
     ];
     "wemo" = ps: with ps; [
       pywemo
@@ -3562,12 +3858,16 @@
     ]; # missing inputs: wirelesstagpy
     "withings" = ps: with ps; [
       aiohttp-cors
+      fnvhash
+      sqlalchemy
       withings-api
     ];
     "wiz" = ps: with ps; [
       aiohttp-cors
+      fnvhash
       ifaddr
       pywizlight
+      sqlalchemy
     ];
     "wled" = ps: with ps; [
       wled
@@ -3592,6 +3892,8 @@
     ];
     "xbox" = ps: with ps; [
       aiohttp-cors
+      fnvhash
+      sqlalchemy
       xbox-webapi
     ];
     "xbox_live" = ps: with ps; [
@@ -3606,8 +3908,10 @@
     "xiaomi_aqara" = ps: with ps; [
       pyxiaomigateway
       aiohttp-cors
+      fnvhash
       ifaddr
       netdisco
+      sqlalchemy
       zeroconf
     ];
     "xiaomi_ble" = ps: with ps; [
@@ -3616,9 +3920,11 @@
       bleak
       bluetooth-adapters
       bluetooth-auto-recovery
+      bluetooth-data-tools
       dbus-fast
       fnvhash
       home-assistant-frontend
+      janus
       pillow
       pyserial
       pyudev
@@ -3647,9 +3953,11 @@
       bleak
       bluetooth-adapters
       bluetooth-auto-recovery
+      bluetooth-data-tools
       dbus-fast
       fnvhash
       home-assistant-frontend
+      janus
       pillow
       pyserial
       pyudev
@@ -3663,7 +3971,9 @@
       aiohttp-cors
       aiomusiccast
       async-upnp-client
+      fnvhash
       ifaddr
+      sqlalchemy
       zeroconf
     ];
     "yandex_transport" = ps: with ps; [
@@ -3674,7 +3984,9 @@
     "yeelight" = ps: with ps; [
       aiohttp-cors
       async-upnp-client
+      fnvhash
       ifaddr
+      sqlalchemy
       yeelight
       zeroconf
     ];
@@ -3686,6 +3998,8 @@
     ];
     "yolink" = ps: with ps; [
       aiohttp-cors
+      fnvhash
+      sqlalchemy
       yolink-api
     ];
     "youless" = ps: with ps; [
@@ -3702,7 +4016,9 @@
     ]; # missing inputs: zengge
     "zeroconf" = ps: with ps; [
       aiohttp-cors
+      fnvhash
       ifaddr
+      sqlalchemy
       zeroconf
     ];
     "zerproc" = ps: with ps; [
@@ -3717,6 +4033,7 @@
       fnvhash
       home-assistant-frontend
       ifaddr
+      janus
       pillow
       pyserial-asyncio
       pyserial
@@ -3743,13 +4060,17 @@
     ];
     "zwave_js" = ps: with ps; [
       aiohttp-cors
+      fnvhash
       pyserial
       pyudev
+      sqlalchemy
       zwave-js-server-python
     ];
     "zwave_me" = ps: with ps; [
       aiohttp-cors
+      fnvhash
       ifaddr
+      sqlalchemy
       url-normalize
       zeroconf
       zwave-me-ws
@@ -3768,6 +4089,7 @@
     "air_quality"
     "airly"
     "airnow"
+    "airq"
     "airthings"
     "airthings_ble"
     "airtouch4"
@@ -3982,7 +4304,6 @@
     "growatt_server"
     "guardian"
     "habitica"
-    "hangouts"
     "hardkernel"
     "hardware"
     "harmony"
@@ -3990,7 +4311,6 @@
     "hddtemp"
     "hdmi_cec"
     "heos"
-    "here_travel_time"
     "hisense_aehw4a1"
     "history"
     "history_stats"
@@ -4000,6 +4320,7 @@
     "home_plus_control"
     "homeassistant"
     "homeassistant_alerts"
+    "homeassistant_hardware"
     "homeassistant_sky_connect"
     "homeassistant_yellow"
     "homekit"
@@ -4074,6 +4395,7 @@
     "lifx"
     "light"
     "litterrobot"
+    "local_calendar"
     "local_file"
     "local_ip"
     "locative"
@@ -4343,6 +4665,7 @@
     "tellduslive"
     "template"
     "tesla_wall_connector"
+    "text"
     "thermobeacon"
     "thermopro"
     "threshold"
diff --git a/pkgs/servers/home-assistant/default.nix b/pkgs/servers/home-assistant/default.nix
index d2cdd24d4f27..9ef566004144 100644
--- a/pkgs/servers/home-assistant/default.nix
+++ b/pkgs/servers/home-assistant/default.nix
@@ -41,16 +41,6 @@ let
         };
       });
 
-      arcam-fmj = super.arcam-fmj.overridePythonAttrs (old: rec {
-        disabledTestPaths = [
-          # incompatible with pytest-aiohttp 0.3.0
-          # see https://github.com/elupus/arcam_fmj/pull/12
-          "tests/test_fake.py"
-          "tests/test_standard.py"
-          "tests/test_utils.py"
-        ];
-      });
-
       caldav = super.caldav.overridePythonAttrs (old: rec {
         version = "0.9.1";
         src = fetchFromGitHub {
@@ -88,62 +78,6 @@ let
         };
       });
 
-      nibe = super.nibe.overridePythonAttrs (oldAttrs: rec {
-        version = "0.5.0";
-        src = fetchFromGitHub {
-          owner = "yozik04";
-          repo = "nibe";
-          rev = "refs/tags/${version}";
-          hash = "sha256-DguGWNJfc5DfbcKMX2eMM2U1WyVPcdtv2BmpVloOFSU=";
-        };
-      });
-
-      # pytest-aiohttp>0.3.0 breaks home-assistant tests
-      pytest-aiohttp = super.pytest-aiohttp.overridePythonAttrs (oldAttrs: rec {
-        version = "0.3.0";
-        src = self.fetchPypi {
-          inherit version;
-          pname = "pytest-aiohttp";
-          hash = "sha256-ySmFQzljeXc3WDhwO2L+9jUoWYvAqdRRY566lfSqpE8=";
-        };
-        propagatedBuildInputs = with self; [ aiohttp pytest ];
-        doCheck = false;
-        patches = [];
-      });
-      aioecowitt = super.aioecowitt.overridePythonAttrs (oldAttrs: {
-        doCheck = false; # requires aiohttp>=1.0.0
-      });
-      aiohomekit = super.aiohomekit.overridePythonAttrs (oldAttrs: {
-        doCheck = false; # requires aiohttp>=1.0.0
-      });
-      aioopenexchangerates = super.aioopenexchangerates.overridePythonAttrs (oldAttrs: {
-        doCheck = false; # requires aiohttp>=1.0.0
-      });
-      gcal-sync = super.gcal-sync.overridePythonAttrs (oldAttrs: {
-        doCheck = false; # requires aiohttp>=1.0.0
-      });
-      hass-nabucasa = super.hass-nabucasa.overridePythonAttrs (oldAttrs: {
-        doCheck = false; # requires aiohttp>=1.0.0
-      });
-      pylitterbot = super.pylitterbot.overridePythonAttrs (oldAttrs: {
-        doCheck = false; # requires pytest-aiohttp>=1.0.0
-      });
-      pynws = super.pynws.overridePythonAttrs (oldAttrs: {
-        doCheck = false; # requires pytest-aiohttp>=1.0.0
-      });
-      pytomorrowio = super.pytomorrowio.overridePythonAttrs (oldAttrs: {
-        doCheck = false; # requires pytest-aiohttp>=1.0.0
-      });
-      rtsp-to-webrtc = super.rtsp-to-webrtc.overridePythonAttrs (oldAttrs: {
-        doCheck = false; # requires pytest-aiohttp>=1.0.0
-      });
-      snitun = super.snitun.overridePythonAttrs (oldAttrs: {
-        doCheck = false; # requires aiohttp>=1.0.0
-      });
-      zwave-js-server-python = super.zwave-js-server-python.overridePythonAttrs (oldAttrs: {
-        doCheck = false; # requires aiohttp>=1.0.0
-      });
-
       # Pinned due to API changes in 0.1.0
       poolsense = super.poolsense.overridePythonAttrs (oldAttrs: rec {
         version = "0.0.8";
@@ -165,16 +99,6 @@ let
         };
       });
 
-      pydaikin = super.pydaikin.overridePythonAttrs (oldAttrs: rec {
-        disabledTests = [
-          "test_power_sensors"
-        ];
-      });
-
-      pydeconz = super.pydeconz.overridePythonAttrs (oldAttrs: rec {
-        doCheck = false; # requires pytest-aiohttp>=1.0.0
-      });
-
       python-slugify = super.python-slugify.overridePythonAttrs (oldAttrs: rec {
         pname = "python-slugify";
         version = "4.0.1";
@@ -264,7 +188,7 @@ let
   extraPackagesFile = writeText "home-assistant-packages" (lib.concatMapStringsSep "\n" (pkg: pkg.pname) extraBuildInputs);
 
   # Don't forget to run parse-requirements.py after updating
-  hassVersion = "2022.11.5";
+  hassVersion = "2022.12.0";
 
 in python.pkgs.buildPythonApplication rec {
   pname = "homeassistant";
@@ -282,7 +206,7 @@ in python.pkgs.buildPythonApplication rec {
     owner = "home-assistant";
     repo = "core";
     rev = version;
-    hash = "sha256-5QV9k3aMMhkB5ZVNOzkwAcA2qTLT7HBays8BoRyshVo=";
+    hash = "sha256-EucTvr/XISdRIpbNkLZjSAHubIbEE3VvMf2y5XE7/n8=";
   };
 
   # leave this in, so users don't have to constantly update their downstream patch handling
diff --git a/pkgs/servers/home-assistant/frontend.nix b/pkgs/servers/home-assistant/frontend.nix
index dd6831b196fc..b8bdb7e84dae 100644
--- a/pkgs/servers/home-assistant/frontend.nix
+++ b/pkgs/servers/home-assistant/frontend.nix
@@ -4,7 +4,7 @@ buildPythonPackage rec {
   # the frontend version corresponding to a specific home-assistant version can be found here
   # https://github.com/home-assistant/home-assistant/blob/master/homeassistant/components/frontend/manifest.json
   pname = "home-assistant-frontend";
-  version = "20221108.0";
+  version = "20221207.0";
   format = "wheel";
 
   src = fetchPypi {
@@ -12,7 +12,7 @@ buildPythonPackage rec {
     pname = "home_assistant_frontend";
     dist = "py3";
     python = "py3";
-    sha256 = "sha256-jwDKWDI5fhrQNtEqMMWQZJFjjJYSqjNZFOVRsQvI9pY=";
+    hash = "sha256-8sLk9cWbsEkPf3sL0UWhrlxLOUABXKqDrKZfE0HVDjw=";
   };
 
   # there is nothing to strip in this package
diff --git a/pkgs/servers/home-assistant/tests.nix b/pkgs/servers/home-assistant/tests.nix
index 1651e3026644..cbcd0847b790 100644
--- a/pkgs/servers/home-assistant/tests.nix
+++ b/pkgs/servers/home-assistant/tests.nix
@@ -14,12 +14,14 @@ let
     generic = [ av ];
     google_translate = [ mutagen ];
     google_sheets = [ oauth2client ];
-    homeassistant_sky_connect = [ bellows zha-quirks zigpy-deconz zigpy-xbee zigpy-zigate zigpy-znp ];
+    hassio = [ bellows zha-quirks zigpy-deconz zigpy-xbee zigpy-zigate zigpy-znp ];
+    homeassistant_sky_connect = [ bellows zha-quirks zigpy-deconz zigpy-xbee zigpy-zigate zigpy-znp zwave-js-server-python ];
     homeassistant_yellow = [ bellows zha-quirks zigpy-deconz zigpy-xbee zigpy-zigate zigpy-znp ];
     lovelace = [ PyChromecast ];
     nest = [ av ];
     onboarding = [ pymetno radios rpi-bad-power ];
     raspberry_pi = [ rpi-bad-power ];
+    shelly = [ pyswitchbot ];
     tilt_ble = [ govee-ble ibeacon-ble ];
     tomorrowio = [ pyclimacell ];
     version = [ aioaseko ];
@@ -70,6 +72,10 @@ let
       # aioserial mock produces wrong state
       "--deselect tests/components/modem_callerid/test_init.py::test_setup_entry"
     ];
+    unifiprotect = [
+      # "TypeError: object Mock can't be used in 'await' expression
+      "--deselect tests/components/unifiprotect/test_repairs.py::test_ea_warning_fix"
+    ];
     skybell = [
       # Sandbox network limitations: Cannot connect to host cloud.myskybell.com:443
       "--deselect tests/components/skybell/test_config_flow.py::test_flow_user_unknown_error"
diff --git a/pkgs/servers/home-automation/evcc/default.nix b/pkgs/servers/home-automation/evcc/default.nix
index bd611627908e..70af6e4530e3 100644
--- a/pkgs/servers/home-automation/evcc/default.nix
+++ b/pkgs/servers/home-automation/evcc/default.nix
@@ -16,20 +16,20 @@
 
 buildGoModule rec {
   pname = "evcc";
-  version = "0.108.3";
+  version = "0.109.2";
 
   src = fetchFromGitHub {
     owner = "evcc-io";
     repo = pname;
     rev = version;
-    hash = "sha256-jBUKMsSpcMoW4v9S5pCpojoYzFASj8hmWPzUcqL3doQ=";
+    hash = "sha256-/Mklf+F9OHq56Qj/kn8JpRAgWwCZqwsH9EwrBFdi/mQ=";
   };
 
-  vendorHash = "sha256-10W1BNHcdP77m7lJ/mc+jQeUigoUid3K0wI4bUm5y+s=";
+  vendorHash = "sha256-H3ACmang+DPOCnccHLG6YzKvi7Rf5k8RkJDD1CgGBrw=";
 
   npmDeps = fetchNpmDeps {
     inherit src;
-    hash = "sha256-+l5LuxJAjrTvOL5XEQ4OIktdupSpn6IqrNX5x4MRmNw=";
+    hash = "sha256-oxoENlZNThW1PrwcGwiNP5Q7BZyhhtuCwXFey0t3Kz8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/servers/http/dufs/default.nix b/pkgs/servers/http/dufs/default.nix
index e162a42863a5..af02b7199610 100644
--- a/pkgs/servers/http/dufs/default.nix
+++ b/pkgs/servers/http/dufs/default.nix
@@ -23,6 +23,11 @@ rustPlatform.buildRustPackage rec {
     Security
   ];
 
+  checkFlags = [
+    # tests depend on network interface, may fail with virtual IPs.
+    "--skip=validate_printed_urls"
+  ];
+
   meta = with lib; {
     description = "A file server that supports static serving, uploading, searching, accessing control, webdav";
     homepage = "https://github.com/sigoden/dufs";
diff --git a/pkgs/servers/http/hiawatha/default.nix b/pkgs/servers/http/hiawatha/default.nix
index 2ab0b12c483f..d92d5d51a4f8 100644
--- a/pkgs/servers/http/hiawatha/default.nix
+++ b/pkgs/servers/http/hiawatha/default.nix
@@ -3,7 +3,7 @@
 
 , cmake
 , ninja
-, mbedtls
+, mbedtls_2
 , libxcrypt
 
 , enableCache     ? true     # Internal cache support.
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ cmake ninja ];
-  buildInputs = [ mbedtls libxcrypt ] ++ lib.optionals enableXslt [ libxslt libxml2 ];
+  buildInputs = [ mbedtls_2 libxcrypt ] ++ lib.optionals enableXslt [ libxslt libxml2 ];
 
   prePatch = ''
     substituteInPlace CMakeLists.txt --replace SETUID ""
diff --git a/pkgs/servers/invidious/versions.json b/pkgs/servers/invidious/versions.json
index b7d890a83a09..615517b0b19d 100644
--- a/pkgs/servers/invidious/versions.json
+++ b/pkgs/servers/invidious/versions.json
@@ -4,9 +4,9 @@
     "sha256": "sha256-EU6T9yQCdOLx98Io8o01rEsgxDFF/Xoy42LgPopD2/A="
   },
   "invidious": {
-    "rev": "516efd2df3f7d242c2d1df416053b4991a554116",
-    "sha256": "sha256-4Rd8SZv2c61ROBPjOEMbVTZ8aFjerPROfU9iRt1KOg4=",
-    "version": "unstable-2022-11-17"
+    "rev": "5160d8bae39dc5cc5d51abee90571a03c08d0f2b",
+    "sha256": "sha256-cM/5xnzO5wyzudXHeud9k3M5BsralRUgO4vSoebYRZ8=",
+    "version": "unstable-2022-11-22"
   },
   "lsquic": {
     "sha256": "sha256-hG8cUvhbCNeMOsKkaJlgGpzUrIx47E/WhmPIdI5F3qM=",
diff --git a/pkgs/servers/klipper/klipper-firmware.nix b/pkgs/servers/klipper/klipper-firmware.nix
index 3d37f91b11f6..4c9e4e293542 100644
--- a/pkgs/servers/klipper/klipper-firmware.nix
+++ b/pkgs/servers/klipper/klipper-firmware.nix
@@ -5,7 +5,7 @@
 , bintools-unwrapped
 , libffi
 , libusb1
-, wxGTK30-gtk3
+, wxGTK30
 , python3
 , gcc-arm-embedded
 , klipper
@@ -28,7 +28,7 @@
     avrdude
     stm32flash
     pkg-config
-    wxGTK30-gtk3 # Required for bossac
+    wxGTK30 # Required for bossac
   ];
 
   preBuild = "cp ${firmwareConfig} ./.config";
diff --git a/pkgs/servers/libreddit/default.nix b/pkgs/servers/libreddit/default.nix
index 0209102eb8d9..2aa7159a5f99 100644
--- a/pkgs/servers/libreddit/default.nix
+++ b/pkgs/servers/libreddit/default.nix
@@ -19,7 +19,7 @@ rustPlatform.buildRustPackage rec {
 
   cargoSha256 = "sha256-uIr8aUDErHVUKML2l6nITSBpOxqg3h1Md0948BxvutI=";
 
-  buildInputs = lib.optional stdenv.isDarwin [
+  buildInputs = lib.optionals stdenv.isDarwin [
     Security
   ];
 
diff --git a/pkgs/servers/matrix-synapse/default.nix b/pkgs/servers/matrix-synapse/default.nix
index 27c2fe3069b8..b7a7c85bfc2f 100644
--- a/pkgs/servers/matrix-synapse/default.nix
+++ b/pkgs/servers/matrix-synapse/default.nix
@@ -11,20 +11,20 @@ in
 with python3.pkgs;
 buildPythonApplication rec {
   pname = "matrix-synapse";
-  version = "1.72.0";
+  version = "1.73.0";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "matrix-org";
     repo = "synapse";
     rev = "v${version}";
-    hash = "sha256-LkzUrEXC+jonkEpAGIEDQhAKisrKNQB8/elchN/4YMU=";
+    hash = "sha256-Er5a+0Qyvm5V1ObWjDQ8fs+r/XB+4aRItJMqaz1VSqk=";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src;
     name = "${pname}-${version}";
-    hash = "sha256-AuQURcVaIoOYG9jh6QhPpXB0akASVWMYe4fA/376cwo=";
+    hash = "sha256-yU72e8OBnUtNdUI/crX7v2KRYHHHOY4Ga9CI3PJwais=";
   };
 
   postPatch = ''
diff --git a/pkgs/servers/monitoring/do-agent/default.nix b/pkgs/servers/monitoring/do-agent/default.nix
index 2508e135431f..1aa130803913 100644
--- a/pkgs/servers/monitoring/do-agent/default.nix
+++ b/pkgs/servers/monitoring/do-agent/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "do-agent";
-  version = "3.15.1";
+  version = "3.15.2";
 
   src = fetchFromGitHub {
     owner = "digitalocean";
     repo = "do-agent";
     rev = version;
-    sha256 = "sha256-a3/zwBxxTdcDQkvKb/Fj1M2U1qhKRXg7dtRzEgkKCu0=";
+    sha256 = "sha256-YK4k2iSKrRVraUjbUCYxNjH+CGn6eASsEKIU5QsfcNM=";
   };
 
   ldflags = [
diff --git a/pkgs/servers/monitoring/nagios/plugins/check_ssl_cert.nix b/pkgs/servers/monitoring/nagios/plugins/check_ssl_cert.nix
index 2442735ffc4b..bd1a5f2758a7 100644
--- a/pkgs/servers/monitoring/nagios/plugins/check_ssl_cert.nix
+++ b/pkgs/servers/monitoring/nagios/plugins/check_ssl_cert.nix
@@ -17,13 +17,13 @@
 
 stdenv.mkDerivation rec {
   pname = "check_ssl_cert";
-  version = "2.56.0";
+  version = "2.57.0";
 
   src = fetchFromGitHub {
     owner = "matteocorti";
     repo = "check_ssl_cert";
     rev = "v${version}";
-    hash = "sha256-2Ch5XnHs2PIsmI6JKYQPsDqcUSgWE5+u3vHqAW/SB8E=";
+    hash = "sha256-N+VkdVeJ6UdRPFUFmIpZoL/Mc8MkTd+hAPjha5pimt8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/servers/monitoring/prometheus/smartctl-exporter/default.nix b/pkgs/servers/monitoring/prometheus/smartctl-exporter/default.nix
index 21ccb8178c34..df21ef09f9f1 100644
--- a/pkgs/servers/monitoring/prometheus/smartctl-exporter/default.nix
+++ b/pkgs/servers/monitoring/prometheus/smartctl-exporter/default.nix
@@ -1,42 +1,33 @@
 { lib
 , fetchFromGitHub
-, fetchpatch
 , buildGoModule
+, nixosTests
 }:
 
 buildGoModule rec {
   pname = "smartctl_exporter";
-  version = "unstable-2020-11-14";
+  version = "0.9.1";
 
   src = fetchFromGitHub {
     owner = "prometheus-community";
     repo = pname;
-    rev = "e27581d56ad80340fb076d3ce22cef337ed76679";
-    sha256 = "sha256-iWaFDjVLBIAA9zGe0utbuvmEdA3R5lge0iCh3j2JfE8=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-fc1NZ5QwzR/jJkeaDm5PMT4wBFFlqZOXKTJMBJWKJJ8=";
   };
 
-  patches = [
-    # Fixes out of range panic (https://github.com/prometheus-community/smartctl_exporter/issues/19)
-    (fetchpatch {
-      url = "https://github.com/prometheus-community/smartctl_exporter/commit/15575301a8e2fe5802a8c066c6fa9765d50b8cfa.patch";
-      sha256 = "sha256-HLUrGXNz3uKpuQBUgQBSw6EGbGl23hQnimTGl64M5bQ=";
-    })
-    # Fix validation on empty smartctl response (https://github.com/prometheus-community/smartctl_exporter/pull/31)
-    (fetchpatch {
-      url = "https://github.com/prometheus-community/smartctl_exporter/commit/744b4e5f6a46e029d31d5aa46642e85f429c2cfa.patch";
-      sha256 = "sha256-MgLtYR1SpM6XrZQQ3AgQRmNF3OnaBCqXMJRV9BOzKPc=";
-    })
-    # Fixes missing metrics if outside of query interval (https://github.com/prometheus-community/smartctl_exporter/pull/18)
-    ./0001-Return-the-cached-value-if-it-s-not-time-to-scan-aga.patch
+  vendorSha256 = "sha256-lQKuT5dzjDHFpRSmcXpKD1RJDlEv+0kcxENkv3mT4FU=";
+
+  ldflags = [
+    "-X github.com/prometheus/common/version.Version=${version}"
   ];
 
-  vendorSha256 = "1xhrzkfm2p20k7prgdfax4408g4qpa4wbxigmcmfz7kjg2zi88ld";
+  passthru.tests = { inherit (nixosTests.prometheus-exporters) smartctl; };
 
   meta = with lib; {
     description = "Export smartctl statistics for Prometheus";
     homepage = "https://github.com/prometheus-community/smartctl_exporter";
     license = licenses.lgpl3;
     platforms = platforms.linux;
-    maintainers = with maintainers; [ hexa ];
+    maintainers = with maintainers; [ hexa Frostman ];
   };
 }
diff --git a/pkgs/servers/monitoring/sensu-go/default.nix b/pkgs/servers/monitoring/sensu-go/default.nix
index 68a8a0cf4cf9..68ecb29169f6 100644
--- a/pkgs/servers/monitoring/sensu-go/default.nix
+++ b/pkgs/servers/monitoring/sensu-go/default.nix
@@ -4,14 +4,14 @@ let
   generic = { subPackages, pname, postInstall ? "", mainProgram }:
     buildGoModule rec {
       inherit pname;
-      version = "6.9.0";
+      version = "6.9.1";
       shortRev = "3a1ac58"; # for internal version info
 
       src = fetchFromGitHub {
         owner = "sensu";
         repo = "sensu-go";
         rev = "v${version}";
-        sha256 = "sha256-H6mpry6uJtMVJmsdLgka7X/IzMP1dbp+hOl3pGVWUAE=";
+        sha256 = "sha256-vw5A5Cg4envrDfLsdauSONgd6rPZSu5wPiPOoNIcS9w=";
       };
 
       inherit subPackages postInstall;
diff --git a/pkgs/servers/monitoring/telegraf/default.nix b/pkgs/servers/monitoring/telegraf/default.nix
index 464e04a29257..715e8da0b753 100644
--- a/pkgs/servers/monitoring/telegraf/default.nix
+++ b/pkgs/servers/monitoring/telegraf/default.nix
@@ -2,7 +2,7 @@
 
 buildGoModule rec {
   pname = "telegraf";
-  version = "1.24.3";
+  version = "1.24.4";
 
   excludedPackages = "test";
 
@@ -12,10 +12,10 @@ buildGoModule rec {
     owner = "influxdata";
     repo = "telegraf";
     rev = "v${version}";
-    sha256 = "sha256-3KQJRapgl36+QwWHjh+nri3FcFtXhre7l3XN8Oj9t+0=";
+    sha256 = "sha256-GlbkCT85gbQehN2SgWY0WNSQ1FbpgZKBpqm6ImlWASk=";
   };
 
-  vendorSha256 = "sha256-0PQYnJKDR/CtZviy0FXvVja7fvcvY+BH8zQXiGdKqRg=";
+  vendorSha256 = "sha256-sBCUs9m04bdkeAIRCJ2Esw68JJIsyVNcoZ3W1WrNKJ4=";
   proxyVendor = true;
 
   ldflags = [
diff --git a/pkgs/servers/monitoring/uptime-kuma/default.nix b/pkgs/servers/monitoring/uptime-kuma/default.nix
index 45d9e2c19f3a..515e4e2edaf4 100644
--- a/pkgs/servers/monitoring/uptime-kuma/default.nix
+++ b/pkgs/servers/monitoring/uptime-kuma/default.nix
@@ -1,4 +1,4 @@
-{ pkgs, lib, stdenv, fetchFromGitHub, fetchzip, substituteAll, nixosTests, iputils }:
+{ pkgs, lib, stdenv, fetchFromGitHub, fetchzip, nixosTests, iputils, nodejs, makeWrapper }:
 let
   deps = import ./composition.nix { inherit pkgs; };
 in
@@ -28,7 +28,7 @@ stdenv.mkDerivation (finalAttrs: {
       --replace "/sbin/ping" "${iputils}/bin/ping"
   '';
 
-  buildInputs = [ pkgs.makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   installPhase = ''
     mkdir -p $out/share/
@@ -41,7 +41,7 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   postFixup = ''
-    makeWrapper ${pkgs.nodejs}/bin/node $out/bin/uptime-kuma-server \
+    makeWrapper ${nodejs}/bin/node $out/bin/uptime-kuma-server \
       --add-flags $out/share/server/server.js \
       --chdir $out/share/
   '';
diff --git a/pkgs/servers/nfs-ganesha/default.nix b/pkgs/servers/nfs-ganesha/default.nix
index a434b48388ac..2ac109cb0dad 100644
--- a/pkgs/servers/nfs-ganesha/default.nix
+++ b/pkgs/servers/nfs-ganesha/default.nix
@@ -5,18 +5,22 @@
 
 stdenv.mkDerivation rec {
   pname = "nfs-ganesha";
-  version = "4.1";
+  version = "4.2";
 
   src = fetchFromGitHub {
     owner = "nfs-ganesha";
     repo = "nfs-ganesha";
     rev = "V${version}";
-    sha256 = "sha256-M7lQkO36I4Cwxs49XdxsUVVI2/Nz7fhU36j9fxUuMfM=";
+    sha256 = "sha256-9Hn1teHo5sHJLYQYM+nAIwq7Gckxl1TCTk/GxLME1qo=";
   };
 
   preConfigure = "cd src";
 
-  cmakeFlags = [ "-DUSE_SYSTEM_NTIRPC=ON" ];
+  cmakeFlags = [
+    "-DUSE_SYSTEM_NTIRPC=ON"
+    "-DSYSSTATEDIR=/var"
+    "-DENABLE_VFS_POSIX_ACL=ON"
+  ];
 
   nativeBuildInputs = [
     cmake
diff --git a/pkgs/servers/nosql/cassandra/4.json b/pkgs/servers/nosql/cassandra/4.json
new file mode 100644
index 000000000000..fd0a4be8f49b
--- /dev/null
+++ b/pkgs/servers/nosql/cassandra/4.json
@@ -0,0 +1,4 @@
+{
+  "version": "4.0.7",
+  "sha256": "03k7mvm5im4lahl8wfafk5ljxd95b6zsmskip4kcpzqi6naf6s4s"
+}
diff --git a/pkgs/servers/nosql/cassandra/4.nix b/pkgs/servers/nosql/cassandra/4.nix
new file mode 100644
index 000000000000..0a96e2579035
--- /dev/null
+++ b/pkgs/servers/nosql/cassandra/4.nix
@@ -0,0 +1,8 @@
+# GENERATED BY update.sh
+{ callPackage, ... } @ args:
+callPackage ./generic.nix (
+  args
+  // builtins.fromJSON (builtins.readFile ./4.json)
+  // {
+    generation = "4";
+  })
diff --git a/pkgs/servers/nosql/ferretdb/default.nix b/pkgs/servers/nosql/ferretdb/default.nix
index f8281eefb00b..56a8ba6630dd 100644
--- a/pkgs/servers/nosql/ferretdb/default.nix
+++ b/pkgs/servers/nosql/ferretdb/default.nix
@@ -5,20 +5,20 @@
 
 buildGoModule rec {
   pname = "ferretdb";
-  version = "0.6.2";
+  version = "0.7.0";
 
   src = fetchFromGitHub {
     owner = "FerretDB";
     repo = "FerretDB";
     rev = "v${version}";
-    sha256 = "sha256-wjqTYrAVrUl+i+2glSUW1xS/qjvTqRXYu4s3F5Wi0Sc=";
+    sha256 = "sha256-BjGK1HvAFBs82bDyI6A7QsJcIaEjEKCw3dyiSqaS2tA=";
   };
 
   postPatch = ''
     echo ${version} > internal/util/version/gen/version.txt
   '';
 
-  vendorSha256 = "sha256-wjlGAhut9/jZ2GmKg7XmenphkgxWn0VbuvYEtORpbtw=";
+  vendorSha256 = "sha256-xmUSjkl41jwC/vaUcqZBvLo2wWp8XlXjzzemN5Ja2gg=";
 
   CGO_ENABLED = 0;
 
diff --git a/pkgs/servers/nosql/mongodb/mongodb.nix b/pkgs/servers/nosql/mongodb/mongodb.nix
index 88dcfdcb7080..f0039a509c15 100644
--- a/pkgs/servers/nosql/mongodb/mongodb.nix
+++ b/pkgs/servers/nosql/mongodb/mongodb.nix
@@ -63,9 +63,9 @@ let
 
     } else rec {
       python = scons.python.withPackages (ps: with ps; [
-        pyyaml
+        setuptools
         typing
-        cheetah
+        cheetah3
       ]);
 
       scons = sconsPackages.scons_3_1_2;
diff --git a/pkgs/servers/openafs/1.8/default.nix b/pkgs/servers/openafs/1.8/default.nix
index fb6dcdeecde8..d6e2f20ecdbe 100644
--- a/pkgs/servers/openafs/1.8/default.nix
+++ b/pkgs/servers/openafs/1.8/default.nix
@@ -18,7 +18,7 @@
 , withDevdoc ? false
 , doxygen
 , dblatex # Extra developer documentation
-, withNcurses
+, withNcurses ? false
 , ncurses # Extra ncurses utilities. Needed for debugging and monitoring.
 , withTsm ? false
 , tsm-client # Tivoli Storage Manager Backup Client from IBM
@@ -45,7 +45,7 @@ stdenv.mkDerivation {
     bison
   ] ++ optionals withDevdoc [ doxygen dblatex ];
 
-  buildInputs = [ libkrb5 ncurses ];
+  buildInputs = [ libkrb5 ] ++ optional withNcurses ncurses;
 
   patches = [ ./bosserver.patch ./cross-build.patch ]
     ++ optional withTsm ./tsmbac.patch;
@@ -84,7 +84,7 @@ stdenv.mkDerivation {
       "--disable-fuse-client"
       "--with-docbook-stylesheets=${docbook_xsl}/share/xml/docbook-xsl"
       ${optionalString withTsm "--enable-tivoli-tsm"}
-      ${optionalString withNcurses "--disable-gtx"}
+      ${optionalString (!withNcurses) "--disable-gtx"}
       "--disable-linux-d_splice-alias-extra-iput"
     )
   '' + optionalString withTsm ''
diff --git a/pkgs/servers/photoprism/default.nix b/pkgs/servers/photoprism/default.nix
index 678f30c372d0..a33d3d183004 100644
--- a/pkgs/servers/photoprism/default.nix
+++ b/pkgs/servers/photoprism/default.nix
@@ -42,7 +42,7 @@ in
 stdenv.mkDerivation {
   inherit pname version;
 
-  buildInputs = [
+  nativeBuildInputs = [
     makeWrapper
   ];
 
diff --git a/pkgs/servers/pocketbase/default.nix b/pkgs/servers/pocketbase/default.nix
index a96431cc3126..4cc6369b7eb5 100644
--- a/pkgs/servers/pocketbase/default.nix
+++ b/pkgs/servers/pocketbase/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "pocketbase";
-  version = "0.8.0";
+  version = "0.9.0";
 
   src = fetchFromGitHub {
     owner = "pocketbase";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-z7Vs+Z34r5g62X9DnEVkqTrr+V2bWwkfMXitNz+pVN8=";
+    sha256 = "sha256-eWYx45k18HDcXkgfKl9G4Q1h/BcCy+NDVhh5ndoW+Fk=";
   };
 
-  vendorSha256 = "sha256-Ya+D15eAJ7qgEQoM2LcN2VEmmyp4cuS6/wCOEGdrgA8=";
+  vendorSha256 = "sha256-+wPcCF5AZ1HzNH1egCiK4eUQ0UmPPJzKB45lk7SOuCI=";
 
   # This is the released subpackage from upstream repo
   subPackages = [ "examples/base" ];
diff --git a/pkgs/servers/pulseaudio/default.nix b/pkgs/servers/pulseaudio/default.nix
index 056710a588f7..11c56b925412 100644
--- a/pkgs/servers/pulseaudio/default.nix
+++ b/pkgs/servers/pulseaudio/default.nix
@@ -48,9 +48,9 @@ stdenv.mkDerivation rec {
     # Install sysconfdir files inside of the nix store,
     # but use a conventional runtime sysconfdir outside the store
     ./add-option-for-installation-sysconfdir.patch
-    # https://gitlab.freedesktop.org/pulseaudio/pulseaudio/-/merge_requests/654
+    # https://gitlab.freedesktop.org/pulseaudio/pulseaudio/-/merge_requests/654 (merged)
     ./0001-Make-gio-2.0-optional-16.patch
-    # TODO (not sent upstream)
+    # https://gitlab.freedesktop.org/pulseaudio/pulseaudio/-/merge_requests/746 (merged)
     ./0002-Ignore-SCM_CREDS-on-darwin.patch
     ./0003-Ignore-HAVE_CPUID_H-on-aarch64-darwin.patch
     ./0004-Prefer-HAVE_CLOCK_GETTIME-on-darwin.patch
diff --git a/pkgs/servers/search/elasticsearch/6.x.nix b/pkgs/servers/search/elasticsearch/6.x.nix
index f14138ca0897..87750f196f3f 100644
--- a/pkgs/servers/search/elasticsearch/6.x.nix
+++ b/pkgs/servers/search/elasticsearch/6.x.nix
@@ -38,7 +38,7 @@ stdenv.mkDerivation (rec {
 
   nativeBuildInputs = [ makeWrapper ];
   buildInputs = [ jre_headless util-linux ]
-             ++ optional enableUnfree [ zlib libxcrypt ];
+             ++ optionals enableUnfree [ zlib libxcrypt ];
 
   installPhase = ''
     mkdir -p $out
diff --git a/pkgs/servers/search/zinc/default.nix b/pkgs/servers/search/zinc/default.nix
new file mode 100644
index 000000000000..c9a7a256d76c
--- /dev/null
+++ b/pkgs/servers/search/zinc/default.nix
@@ -0,0 +1,56 @@
+{ lib
+, buildGoModule
+, fetchFromGitHub
+, buildNpmPackage
+}:
+let
+  version = "0.3.5";
+  src = fetchFromGitHub {
+    owner = "zinclabs";
+    repo = "zinc";
+    rev = "v${version}";
+    sha256 = "sha256-qu3foI5Rnt2sf+B+roJOwUNvOfawKmcKq7UrmviQsHA=";
+  };
+
+  webui = buildNpmPackage {
+    inherit src version;
+    pname = "zinc-ui";
+
+    sourceRoot = "source/web";
+
+    npmDepsHash = "sha256-Ao/kDryui4thurqap/d/+82z058HoF2ZJSVKQqVwfVg=";
+
+    CYPRESS_INSTALL_BINARY = 0; # cypress tries to download binaries otherwise
+
+    installPhase = ''
+      mkdir -p $out/share
+      mv dist $out/share/zinc-ui
+    '';
+  };
+in
+buildGoModule rec {
+  pname = "zinc";
+  inherit src version;
+
+  preBuild = ''
+    cp -r ${webui}/share/zinc-ui web/dist
+  '';
+
+  vendorSha256 = "sha256-akjb0cxHbITKS26c+7lVSHWO/KRoQVVKzAOra+tdAD8=";
+  subPackages = [ "cmd/zinc" ];
+
+  CGO_ENABLED = 0;
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X github.com/zinclabs/zinc/pkg/meta.Version=${version}"
+  ];
+
+  meta = with lib; {
+    description = "A lightweight alternative to elasticsearch that requires minimal resources, written in Go";
+    homepage = "https://github.com/zinclabs/zinc";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ dit7ya ];
+  };
+}
diff --git a/pkgs/servers/snappymail/default.nix b/pkgs/servers/snappymail/default.nix
index f9ac080a7fd6..7da5c489ded4 100644
--- a/pkgs/servers/snappymail/default.nix
+++ b/pkgs/servers/snappymail/default.nix
@@ -2,11 +2,11 @@
 , dataPath ? "/var/lib/snappymail" }:
 stdenv.mkDerivation rec {
   pname = "snappymail";
-  version = "2.22.4";
+  version = "2.22.6";
 
   src = fetchurl {
     url = "https://github.com/the-djmaze/snappymail/releases/download/v${version}/snappymail-${version}.tar.gz";
-    sha256 = "sha256-SMuposSGpmJgfAXYu3YhYJWN7zxyxtAAuRI1IBibq5c=";
+    sha256 = "sha256-B3ojd6Xd5qk6KL5JAnrp52XeW0xJ7z9VJQRPjVmPgv0=";
   };
 
   sourceRoot = "snappymail";
diff --git a/pkgs/servers/tailscale/default.nix b/pkgs/servers/tailscale/default.nix
index 3cd302c6bf75..6b2710b7ba28 100644
--- a/pkgs/servers/tailscale/default.nix
+++ b/pkgs/servers/tailscale/default.nix
@@ -2,15 +2,15 @@
 
 buildGoModule rec {
   pname = "tailscale";
-  version = "1.32.3";
+  version = "1.34.0";
 
   src = fetchFromGitHub {
     owner = "tailscale";
     repo = "tailscale";
     rev = "v${version}";
-    sha256 = "sha256-mM9+qumB7pbP1LIN3ZJRNYHywwASKL4jmsmz5jQGRtg=";
+    sha256 = "sha256-ngcFoEDec/6I9gWpJ767ju2OvZfS4RhlSbK//xXIFxs=";
   };
-  vendorSha256 = "sha256-VW6FvbgLcokVGunTCHUXKuH5+O6T55hGIP2g5kFfBsE=";
+  vendorSha256 = "sha256-nSllDi6G4QAGyuoGduDhI0vaVuN2//eg+gXRSZ3ERiQ=";
 
   nativeBuildInputs = lib.optionals stdenv.isLinux [ makeWrapper ];
 
diff --git a/pkgs/servers/traefik/default.nix b/pkgs/servers/traefik/default.nix
index 5f064beaab9b..60eb9a22a829 100644
--- a/pkgs/servers/traefik/default.nix
+++ b/pkgs/servers/traefik/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "traefik";
-  version = "2.9.5";
+  version = "2.9.6";
 
   # Archive with static assets for webui
   src = fetchzip {
     url = "https://github.com/traefik/traefik/releases/download/v${version}/traefik-v${version}.src.tar.gz";
-    sha256 = "sha256-o8SFR6xPh6oc6vr9xhSyOnkJTxFv142BovmvAURY3SY=";
+    sha256 = "sha256-T1yJT45bCjGizS6bqkzc6EF9uhJ3dhXsSc5X3di6SJ4=";
     stripRoot = false;
   };
 
-  vendorSha256 = "sha256-/+cyh0hFPc+Mu1tmlLDU/v0w6N1czqLVDBbEJT907wE=";
+  vendorSha256 = "sha256-g/UL+cUenWW94afWIGFU2fBSpo48YcUIUaX/1M5vhNk=";
 
   subPackages = [ "cmd/traefik" ];
 
diff --git a/pkgs/servers/web-apps/invoiceplane/default.nix b/pkgs/servers/web-apps/invoiceplane/default.nix
index a091a10d8890..ebf40fe3cee7 100644
--- a/pkgs/servers/web-apps/invoiceplane/default.nix
+++ b/pkgs/servers/web-apps/invoiceplane/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "invoiceplane";
-  version = "1.6-beta-3";
+  version = "1.6.0";
 
   src = fetchurl {
     url = "https://github.com/InvoicePlane/InvoicePlane/releases/download/v${version}/v${version}.zip";
-    sha256 = "sha256-sw5LaU3v4MIdX99WGKOaerVc9m3d8aQVuvrLn7KvcKE=";
+    sha256 = "sha256-EwhOwUoOy3LNZTDgp9kvR/0OsO2TDpWkdT0fd7u0Ns8=";
   };
 
   nativeBuildInputs = [ unzip ];
diff --git a/pkgs/servers/web-apps/peering-manager/default.nix b/pkgs/servers/web-apps/peering-manager/default.nix
new file mode 100644
index 000000000000..dd60980e3290
--- /dev/null
+++ b/pkgs/servers/web-apps/peering-manager/default.nix
@@ -0,0 +1,100 @@
+{ python3
+, fetchFromGitHub
+, fetchpatch
+, nixosTests
+
+, plugins ? ps: []
+}:
+
+let
+  py = python3.override {
+    packageOverrides = final: prev: {
+      django = final.django_4;
+      drf-nested-routers = prev.drf-nested-routers.overridePythonAttrs (oldAttrs: {
+        patches = [
+          # all for django 4 compat
+          (fetchpatch {
+            url = "https://github.com/alanjds/drf-nested-routers/commit/59764cc356f7f593422b26845a9dfac0ad196120.diff";
+            hash = "sha256-mq3vLHzQlGl2EReJ5mVVQMMcYgGIVt/T+qi1STtQ0aI=";
+          })
+          (fetchpatch {
+            url = "https://github.com/alanjds/drf-nested-routers/commit/723a5729dd2ffcb66fe315f229789ca454986fa4.diff";
+            hash = "sha256-UCbBjwlidqsJ9vEEWlGzfqqMOr0xuB2TAaUxHsLzFfU=";
+          })
+          (fetchpatch {
+            url = "https://github.com/alanjds/drf-nested-routers/commit/38e49eb73759bc7dcaaa9166169590f5315e1278.diff";
+            hash = "sha256-IW4BLhHHhXDUZqHaXg46qWoQ89pMXv0ZxKjOCTnDcI0=";
+          })
+        ];
+      });
+    };
+  };
+
+in py.pkgs.buildPythonApplication rec {
+  pname = "peering-manager";
+  version = "1.7.3";
+
+  src = fetchFromGitHub {
+    owner = pname;
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "sha256-vrRMdqEpsps4ZKgunMhznJr/TQ9+WVMNYFu76ZU7iMI=";
+  };
+
+  patches = [
+    ./redis-unix-sock.patch
+  ];
+
+  format = "other";
+
+  propagatedBuildInputs = with py.pkgs; [
+    django
+    djangorestframework
+    django-cacheops
+    django-debug-toolbar
+    django-filter
+    django-postgresql-netfields
+    django-prometheus
+    django-rq
+    django-tables2
+    django-taggit
+    drf-spectacular
+    jinja2
+    markdown
+    napalm
+    packaging
+    psycopg2
+    pynetbox
+    pyyaml
+    requests
+    tzdata
+  ] ++ plugins py.pkgs;
+
+  buildPhase = ''
+    runHook preBuild
+    cp peering_manager/configuration{.example,}.py
+    python3 manage.py collectstatic --no-input
+    rm -f peering_manager/configuration.py
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p $out/opt/peering-manager
+    cp -r . $out/opt/peering-manager
+    chmod +x $out/opt/peering-manager/manage.py
+    makeWrapper $out/opt/peering-manager/manage.py $out/bin/peering-manager \
+      --prefix PYTHONPATH : "$PYTHONPATH"
+    runHook postInstall
+  '';
+
+  passthru = {
+    # PYTHONPATH of all dependencies used by the package
+    python = py;
+    pythonPath = py.pkgs.makePythonPath propagatedBuildInputs;
+
+    tests = {
+      inherit (nixosTests) peering-manager;
+    };
+  };
+}
diff --git a/pkgs/servers/web-apps/peering-manager/redis-unix-sock.patch b/pkgs/servers/web-apps/peering-manager/redis-unix-sock.patch
new file mode 100644
index 000000000000..5db0d0dd0125
--- /dev/null
+++ b/pkgs/servers/web-apps/peering-manager/redis-unix-sock.patch
@@ -0,0 +1,47 @@
+commit 1e64a7f6ca456249305f6a3c90f9acf84af194db
+Author: Yureka <yuka@yuka.dev>
+Date:   Tue Nov 29 14:03:08 2022 +0100
+
+    support unix sockets for redis connections
+
+diff --git a/peering_manager/settings.py b/peering_manager/settings.py
+index 739d6ff..b5edf4d 100644
+--- a/peering_manager/settings.py
++++ b/peering_manager/settings.py
+@@ -270,6 +270,7 @@ TASKS_REDIS_PASSWORD = TASKS_REDIS.get("PASSWORD", "")
+ TASKS_REDIS_DATABASE = TASKS_REDIS.get("DATABASE", 0)
+ TASKS_REDIS_DEFAULT_TIMEOUT = TASKS_REDIS.get("DEFAULT_TIMEOUT", 300)
+ TASKS_REDIS_SSL = TASKS_REDIS.get("SSL", False)
++TASKS_REDIS_UNIX_SOCKET_PATH = TASKS_REDIS.get("UNIX_SOCKET_PATH", "")
+ if "DEFAULT_TIMEOUT" in TASKS_REDIS:
+     warnings.warn(
+         "DEFAULT_TIMEOUT is no longer supported under REDIS configuration. Set RQ_DEFAULT_TIMEOUT instead."
+@@ -294,6 +295,7 @@ CACHING_REDIS_PASSWORD = CACHING_REDIS.get("PASSWORD", "")
+ CACHING_REDIS_DATABASE = CACHING_REDIS.get("DATABASE", 0)
+ CACHING_REDIS_DEFAULT_TIMEOUT = CACHING_REDIS.get("DEFAULT_TIMEOUT", 300)
+ CACHING_REDIS_SSL = CACHING_REDIS.get("SSL", False)
++CACHING_REDIS_UNIX_SOCKET_PATH = CACHING_REDIS.get("UNIX_SOCKET_PATH", "")
+ 
+ if CACHING_REDIS_USING_SENTINEL:
+     CACHEOPS_SENTINEL = {
+@@ -301,6 +303,8 @@ if CACHING_REDIS_USING_SENTINEL:
+         "service_name": CACHING_REDIS_SENTINEL_SERVICE,
+         "db": CACHING_REDIS_DATABASE,
+     }
++elif CACHING_REDIS_UNIX_SOCKET_PATH != "":
++    CACHEOPS_REDIS = f"unix://{CACHING_REDIS_UNIX_SOCKET_PATH}?db={CACHING_REDIS_DATABASE}"
+ else:
+     REDIS_CACHE_CON_STRING = "rediss://" if CACHING_REDIS_SSL else "redis://"
+     if CACHING_REDIS_PASSWORD:
+@@ -334,6 +338,11 @@ if TASKS_REDIS_USING_SENTINEL:
+         "SOCKET_TIMEOUT": None,
+         "CONNECTION_KWARGS": {"socket_connect_timeout": TASKS_REDIS_DEFAULT_TIMEOUT},
+     }
++elif TASKS_REDIS_UNIX_SOCKET_PATH != "":
++    RQ_PARAMS = {
++        "UNIX_SOCKET_PATH": TASKS_REDIS_UNIX_SOCKET_PATH,
++        "DB": TASKS_REDIS_DATABASE,
++    }
+ else:
+     RQ_PARAMS = {
+         "HOST": TASKS_REDIS_HOST,
diff --git a/pkgs/shells/bash/blesh/default.nix b/pkgs/shells/bash/blesh/default.nix
index f342f408540f..26ff975dae33 100644
--- a/pkgs/shells/bash/blesh/default.nix
+++ b/pkgs/shells/bash/blesh/default.nix
@@ -1,51 +1,54 @@
 { lib
 , stdenvNoCC
-, fetchFromGitHub
-, git
+, fetchzip
+, runtimeShell
 , bashInteractive
 , glibcLocales
-, runtimeShell
 }:
 
 stdenvNoCC.mkDerivation rec {
   name = "blesh";
-  version = "unstable-2022-07-24";
-
-  src = fetchFromGitHub {
-    owner = "akinomyoga";
-    repo = "ble.sh";
-    rev = "0b95d5d900b79a63e7f0834da5aa7276b8332a44";
-    hash = "sha256-s/RQKcAFcCUB3Xd/4uOsIgigOE0lCCeVC9K3dfnP/EQ=";
-    fetchSubmodules = true;
-    leaveDotGit = true;
+  version = "unstable-2022-07-29";
+
+  src = fetchzip {
+    url = "https://github.com/akinomyoga/ble.sh/releases/download/nightly/ble-nightly-20220729+a22e145.tar.xz";
+    sha256 = "088jv02y40pjcfzgrbx8n6aksznfh6zl0j5siwfw3pmwn3i16njw";
   };
 
-  nativeBuildInputs = [ git ];
+  dontBuild = true;
 
   doCheck = true;
   checkInputs = [ bashInteractive glibcLocales ];
   preCheck = "export LC_ALL=en_US.UTF-8";
 
-  installFlags = [ "INSDIR=$(out)/share" ];
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p "$out/share/blesh/lib"
+
+    cat <<EOF >"$out/share/blesh/lib/_package.sh"
+    _ble_base_package_type=nix
+
+    function ble/base/package:nix/update {
+      echo "Ble.sh is installed by Nix. You can update it there." >&2
+      return 1
+    }
+    EOF
+
+    cp -rv $src/* $out/share/blesh
+
+    runHook postInstall
+  '';
+
   postInstall = ''
     mkdir -p "$out/bin"
     cat <<EOF >"$out/bin/blesh-share"
     #!${runtimeShell}
     # Run this script to find the ble.sh shared folder
     # where all the shell scripts are living.
-    echo "$out/share/ble.sh"
+    echo "$out/share/blesh"
     EOF
     chmod +x "$out/bin/blesh-share"
-
-    mkdir -p "$out/share/lib"
-    cat <<EOF >"$out/share/lib/_package.sh"
-    _ble_base_package_type=nix
-
-    function ble/base/package:nix/update {
-      echo "Ble.sh is installed by Nix. You can update it there." >/dev/stderr
-      return 1
-    }
-    EOF
   '';
 
   meta = with lib; {
diff --git a/pkgs/shells/nushell/default.nix b/pkgs/shells/nushell/default.nix
index 432cbfe9ac9f..8c33839a83cf 100644
--- a/pkgs/shells/nushell/default.nix
+++ b/pkgs/shells/nushell/default.nix
@@ -24,16 +24,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "nushell";
-  version = "0.72.0";
+  version = "0.72.1";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = version;
-    sha256 = "sha256-CWFG3ltSWwUPz+cVXUL0RaDxmm1A3Ie0BUBFFZfR9Mc=";
+    sha256 = "sha256-OVJr+usN+47yBHFAy94rIVlU2F+Klo6xdrV2MwUoKUE=";
   };
 
-  cargoSha256 = "sha256-VgE14440BumaL/wZz1ONjIK1nsJWaPlvy7M0R+ojb9A=";
+  cargoSha256 = "sha256-v6mPr+gOT64rKYuog+hS7/AqUZDailoOBXX3Sfeo+sk=";
 
   # enable pkg-config feature of zstd
   cargoPatches = [ ./zstd-pkg-config.patch ];
diff --git a/pkgs/shells/zsh/default.nix b/pkgs/shells/zsh/default.nix
index 782c2fb2bea3..5a003b889a04 100644
--- a/pkgs/shells/zsh/default.nix
+++ b/pkgs/shells/zsh/default.nix
@@ -44,7 +44,7 @@ stdenv.mkDerivation {
     "--enable-pcre"
     "--enable-zprofile=${placeholder "out"}/etc/zprofile"
     "--disable-site-fndir"
-  ] ++ lib.optional (stdenv.hostPlatform != stdenv.buildPlatform && !stdenv.hostPlatform.isStatic) [
+  ] ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform && !stdenv.hostPlatform.isStatic) [
     # Also see: https://github.com/buildroot/buildroot/commit/2f32e668aa880c2d4a2cce6c789b7ca7ed6221ba
     "zsh_cv_shared_environ=yes"
     "zsh_cv_shared_tgetent=yes"
diff --git a/pkgs/test/cue/default.nix b/pkgs/test/cue/default.nix
new file mode 100644
index 000000000000..2cc8bf34bb04
--- /dev/null
+++ b/pkgs/test/cue/default.nix
@@ -0,0 +1,24 @@
+{ writeCueValidator, runCommand, writeText, ... }:
+
+let
+  validator = writeCueValidator
+    (writeText "schema.cue" ''
+      #Def1: {
+        field1: string
+      }
+    '')
+    { document = "#Def1"; };
+in runCommand "cue-validation" {} ''
+  cat > valid.json <<EOF
+  { "field1": "abc" }
+  EOF
+  cat > invalid.json <<EOF
+  { "field2": "abc" }
+  EOF
+  ${validator} valid.json
+  if ${validator} invalid.json; then
+    echo "this example should fail"
+    exit 1
+  fi
+  touch $out
+''
diff --git a/pkgs/test/default.nix b/pkgs/test/default.nix
index 3a39d247c8fe..e72afbb39980 100644
--- a/pkgs/test/default.nix
+++ b/pkgs/test/default.nix
@@ -77,6 +77,8 @@ with pkgs;
 
   dhall = callPackage ./dhall { };
 
+  cue-validation = callPackage ./cue {};
+
   coq = callPackage ./coq {};
 
   makeWrapper = callPackage ./make-wrapper { };
diff --git a/pkgs/tools/X11/bumblebee/default.nix b/pkgs/tools/X11/bumblebee/default.nix
index 914972d91aa7..0415489bd765 100644
--- a/pkgs/tools/X11/bumblebee/default.nix
+++ b/pkgs/tools/X11/bumblebee/default.nix
@@ -52,6 +52,10 @@ let
     url = "https://github.com/Bumblebee-Project/Bumblebee/commit/deceb14cdf2c90ff64ebd1010a674305464587da.patch";
     sha256 = "00c05i5lxz7vdbv445ncxac490vbl5g9w3vy3gd71qw1f0si8vwh";
   };
+  gcc10Patch = fetchpatch {
+    url = "https://github.com/Bumblebee-Project/Bumblebee/commit/f94a118a88cd76e2dbea33d735bd53cf54b486a1.patch";
+    hash = "sha256-3b5tLoMrGYSdg9Hz5bh0c44VIrbSZrY56JpWEyU/Pik=";
+  };
 
 in stdenv.mkDerivation rec {
   pname = "bumblebee";
@@ -67,6 +71,7 @@ in stdenv.mkDerivation rec {
 
     modprobePatch
     libkmodPatch
+    gcc10Patch
   ];
 
   # By default we don't want to use a display device
@@ -137,8 +142,5 @@ in stdenv.mkDerivation rec {
     license = licenses.gpl3;
     maintainers = with maintainers; [ abbradar ];
     platforms = platforms.linux;
-    # linking fails with multiple error of type:
-    # multiple definition of `bb_pm_method_string'; src/module.o:(.bss+0x0): first defined here
-    broken = true; # Added 03-08-2022
   };
 }
diff --git a/pkgs/tools/admin/awscli2/default.nix b/pkgs/tools/admin/awscli2/default.nix
index 2b82570431e1..4431283f40d5 100644
--- a/pkgs/tools/admin/awscli2/default.nix
+++ b/pkgs/tools/admin/awscli2/default.nix
@@ -78,7 +78,8 @@ with py.pkgs; buildPythonApplication rec {
       --replace "colorama>=0.2.5,<0.4.4" "colorama" \
       --replace "distro>=1.5.0,<1.6.0" "distro" \
       --replace "docutils>=0.10,<0.16" "docutils" \
-      --replace "wcwidth<0.2.0" "wcwidth"
+      --replace "wcwidth<0.2.0" "wcwidth" \
+      --replace "cryptography>=3.3.2,<=38.0.1" "cryptography>=3.3.2,<=38.0.3"
   '';
 
   postInstall = ''
diff --git a/pkgs/tools/admin/scaleway-cli/default.nix b/pkgs/tools/admin/scaleway-cli/default.nix
index 6e38400677a3..6169f22eb12b 100644
--- a/pkgs/tools/admin/scaleway-cli/default.nix
+++ b/pkgs/tools/admin/scaleway-cli/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "scaleway-cli";
-  version = "2.6.2";
+  version = "2.7.0";
 
   src = fetchFromGitHub {
     owner = "scaleway";
     repo = "scaleway-cli";
     rev = "v${version}";
-    sha256 = "sha256-WEEmU0YslQcjleM6jFLXNxogkXlRAUjkj0q+saugPYA=";
+    sha256 = "sha256-DWr5I6xMESRWhQCgDY/xJsSw0XhlNSJiVsHNvL+xmH4=";
   };
 
-  vendorSha256 = "sha256-1YXw6b8xUa2yEfMURetImg2TnFTDUsiQi441pX/O57M=";
+  vendorSha256 = "sha256-1Ke01pc+RyqxCuD1SGypTSKCFnnHazz6IaybL0TylhA=";
 
   ldflags = [
     "-w"
diff --git a/pkgs/tools/admin/syft/default.nix b/pkgs/tools/admin/syft/default.nix
index 855061ef3e2d..d882890bba78 100644
--- a/pkgs/tools/admin/syft/default.nix
+++ b/pkgs/tools/admin/syft/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "syft";
-  version = "0.62.2";
+  version = "0.62.3";
 
   src = fetchFromGitHub {
     owner = "anchore";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-n3ZkSsyaNreIohCrGYQUnRAnher1VqbV8vQKA20bnPs=";
+    sha256 = "sha256-rDj/yerLY7EN/jeAh/xaUX04LqGqijajSZLFhjiyuSg=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
@@ -22,7 +22,7 @@ buildGoModule rec {
   };
   # hash mismatch with darwin
   proxyVendor = true;
-  vendorSha256 = "sha256-FJtyCUzp/osfXtNRWH/gK7PGoe4gd23YxBxbF4o1qos=";
+  vendorSha256 = "sha256-MUNXMdzLVgbFtVo1CRCnZfpZl8Ze2R98mx7Y9QreLRw=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/tools/backup/dar/default.nix b/pkgs/tools/backup/dar/default.nix
index c697bb4f20f7..f17a805531c7 100644
--- a/pkgs/tools/backup/dar/default.nix
+++ b/pkgs/tools/backup/dar/default.nix
@@ -28,12 +28,12 @@ let
 in
 
 stdenv.mkDerivation rec {
-  version = "2.7.7";
+  version = "2.7.8";
   pname = "dar";
 
   src = fetchzip {
     url = "mirror://sourceforge/dar/${pname}-${version}.tar.gz";
-    sha256 = "sha256-643hU28Vl0QaqdKoKdQ1Z/j5drE59/jw5xkVO/g+MSw=";
+    sha256 = "sha256-W/6kSkIaeHumE2yGGbU4Z2lk1d2toQ1AM012TUI1EZw=";
   };
 
   outputs = [ "out" "dev" ];
diff --git a/pkgs/tools/backup/ugarit-manifest-maker/default.nix b/pkgs/tools/backup/ugarit-manifest-maker/default.nix
index 980aaa05ec36..8c37a7b72ac7 100644
--- a/pkgs/tools/backup/ugarit-manifest-maker/default.nix
+++ b/pkgs/tools/backup/ugarit-manifest-maker/default.nix
@@ -27,6 +27,5 @@ in with pkgs; eggDerivation rec {
     license = licenses.bsd3;
     maintainers = [ maintainers.ebzzry ];
     platforms = platforms.unix;
-    broken = stdenv.isDarwin && stdenv.isAarch64;
   };
 }
diff --git a/pkgs/tools/backup/ugarit/default.nix b/pkgs/tools/backup/ugarit/default.nix
index 9000ff54f673..39c11cc0c91a 100644
--- a/pkgs/tools/backup/ugarit/default.nix
+++ b/pkgs/tools/backup/ugarit/default.nix
@@ -37,6 +37,5 @@ in with pkgs; eggDerivation rec {
     license = licenses.bsd3;
     maintainers = [ maintainers.ebzzry ];
     platforms = platforms.unix;
-    broken = stdenv.isDarwin && stdenv.isAarch64;
   };
 }
diff --git a/pkgs/tools/cd-dvd/ventoy-bin/default.nix b/pkgs/tools/cd-dvd/ventoy-bin/default.nix
index 8f1571d1aee6..a9f853cc7fe6 100644
--- a/pkgs/tools/cd-dvd/ventoy-bin/default.nix
+++ b/pkgs/tools/cd-dvd/ventoy-bin/default.nix
@@ -51,13 +51,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "ventoy-bin";
-  version = "1.0.82";
+  version = "1.0.84";
 
   src = let
     inherit (finalAttrs) version;
   in fetchurl {
     url = "https://github.com/ventoy/Ventoy/releases/download/v${version}/ventoy-${version}-linux.tar.gz";
-    hash = "sha256-NN36gg2rUZgAxyMoYhMc7IbWgQLrPvuWERDF7JVsFfw=";
+    hash = "sha256-ygIAw270Px5nRrSrsD3yLBRFBKGwzdxXzQ6udS9g2ZI=";
   };
 
   patches = [
@@ -120,11 +120,11 @@ stdenv.mkDerivation (finalAttrs: {
   installPhase = ''
     runHook preInstall
 
-    # Setup variables.
+    # Setup variables
     local VENTOY_PATH="$out"/share/ventoy
     local ARCH='${arch}'
 
-    # Prepare.
+    # Prepare
     cd tool/"$ARCH"
     rm ash* hexdump* mkexfatfs* mount.exfat-fuse* xzcat*
     for archive in *.xz; do
@@ -144,11 +144,11 @@ stdenv.mkDerivation (finalAttrs: {
     rm README
     rm tool/"$ARCH"/Ventoy2Disk.gtk2 || true  # For aarch64 and mips64el.
 
-    # Copy from "$src" to "$out".
+    # Copy from "$src" to "$out"
     mkdir -p "$out"/bin "$VENTOY_PATH"
     cp -r . "$VENTOY_PATH"
 
-    # Fill bin dir.
+    # Fill bin dir
     for f in Ventoy2Disk.sh_ventoy VentoyWeb.sh_ventoy-web \
              CreatePersistentImg.sh_ventoy-persistent \
              ExtendPersistentImg.sh_ventoy-extend-persistent \
@@ -184,9 +184,9 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   meta = with lib; {
+    homepage = "https://www.ventoy.net";
     description = "A New Bootable USB Solution";
     longDescription = ''
-    homepage = "https://www.ventoy.net";
       Ventoy is an open source tool to create bootable USB drive for
       ISO/WIM/IMG/VHD(x)/EFI files.  With ventoy, you don't need to format the
       disk over and over, you just need to copy the ISO/WIM/IMG/VHD(x)/EFI files
diff --git a/pkgs/tools/filesystems/btrfs-progs/default.nix b/pkgs/tools/filesystems/btrfs-progs/default.nix
index ee1bea9c29ef..e01ee2a8cf47 100644
--- a/pkgs/tools/filesystems/btrfs-progs/default.nix
+++ b/pkgs/tools/filesystems/btrfs-progs/default.nix
@@ -1,11 +1,10 @@
 { lib, stdenv, fetchurl
-, pkg-config, python3, sphinx
+, pkg-config, sphinx
 , zstd
 , acl, attr, e2fsprogs, libuuid, lzo, udev, zlib
 , runCommand, btrfs-progs
 , gitUpdater
 , udevSupport ? true
-, enablePython ? true
 }:
 
 stdenv.mkDerivation rec {
@@ -19,13 +18,11 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [
     pkg-config
-  ] ++ lib.optionals enablePython [
-    python3 python3.pkgs.setuptools
   ] ++ [
     sphinx
   ];
 
-  buildInputs = [ acl attr e2fsprogs libuuid lzo python3 udev zlib zstd ];
+  buildInputs = [ acl attr e2fsprogs libuuid lzo udev zlib zstd ];
 
   # gcc bug with -O1 on ARM with gcc 4.8
   # This should be fine on all platforms so apply universally
@@ -35,18 +32,17 @@ stdenv.mkDerivation rec {
     install -v -m 444 -D btrfs-completion $out/share/bash-completion/completions/btrfs
   '';
 
-  configureFlags = lib.optionals stdenv.hostPlatform.isMusl [
-    "--disable-backtrace"
-  ] ++ lib.optionals (!enablePython) [
+  configureFlags = [
+    # Built separately, see python3Packages.btrfsutil
     "--disable-python"
+  ] ++ lib.optionals stdenv.hostPlatform.isMusl [
+    "--disable-backtrace"
   ] ++ lib.optionals (!udevSupport) [
     "--disable-libudev"
   ];
 
   makeFlags = [ "udevruledir=$(out)/lib/udev/rules.d" ];
 
-  installFlags = lib.optionals enablePython [ "install_python" ];
-
   enableParallelBuilding = true;
 
   passthru.tests = {
diff --git a/pkgs/tools/filesystems/dislocker/default.nix b/pkgs/tools/filesystems/dislocker/default.nix
index 10559985f867..396f8142ba93 100644
--- a/pkgs/tools/filesystems/dislocker/default.nix
+++ b/pkgs/tools/filesystems/dislocker/default.nix
@@ -3,7 +3,7 @@
 , fetchpatch
 , cmake
 , pkg-config
-, mbedtls
+, mbedtls_2
 , fuse
 }:
 
@@ -33,7 +33,7 @@ stdenv.mkDerivation rec {
   ];
 
   nativeBuildInputs = [ cmake pkg-config ];
-  buildInputs = [ fuse mbedtls ];
+  buildInputs = [ fuse mbedtls_2 ];
 
   meta = with lib; {
     description = "Read BitLocker encrypted partitions in Linux";
diff --git a/pkgs/tools/filesystems/stratisd/default.nix b/pkgs/tools/filesystems/stratisd/default.nix
index 0594d1c30658..b4405f81fb6b 100644
--- a/pkgs/tools/filesystems/stratisd/default.nix
+++ b/pkgs/tools/filesystems/stratisd/default.nix
@@ -24,18 +24,18 @@
 
 stdenv.mkDerivation rec {
   pname = "stratisd";
-  version = "3.4.1";
+  version = "3.4.2";
 
   src = fetchFromGitHub {
     owner = "stratis-storage";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-NM6+1Etf7pOOSKNuxGIUlAbtZwixof7wNgkPoMwPn7w=";
+    hash = "sha256-Ui0L03KLePqLvxWaJm+qGQ8q+S8Sz0jwtLhIORNWeAk=";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src;
-    hash = "sha256-anxDfls5MTfvklIDst+Ocduzc8ds5pD3WDaDUtF6R+g=";
+    hash = "sha256-o4MKnJycyzlFfE1YyByyjn/XENheLw4tdVXtgzVxDJM=";
   };
 
   postPatch = ''
diff --git a/pkgs/tools/graphics/oxipng/default.nix b/pkgs/tools/graphics/oxipng/default.nix
index 27268bead2aa..57c7a35e0b94 100644
--- a/pkgs/tools/graphics/oxipng/default.nix
+++ b/pkgs/tools/graphics/oxipng/default.nix
@@ -1,15 +1,15 @@
 { lib, stdenv, fetchCrate, rustPlatform }:
 
 rustPlatform.buildRustPackage rec {
-  version = "6.0.1";
+  version = "7.0.0";
   pname = "oxipng";
 
   src = fetchCrate {
     inherit version pname;
-    sha256 = "sha256-YH4sIEOTPBbzsEMvHyphOsf12ZZRKsRPMlZ4emMMTrw=";
+    hash = "sha256-egAt2XypPFxsOuo8RsIXTmFdmBUe+eZh3p3vlnnx8wo=";
   };
 
-  cargoSha256 = "sha256-c7uEb64epjzU3pmHRr69FoxFGCN+1WVMLm8LsBwQ50o=";
+  cargoHash = "sha256-GbJU31UBdRai2JLEdx9sPh6rJWnU4RlDL8DooI9MCUg=";
 
   doCheck = !stdenv.isAarch64 && !stdenv.isDarwin;
 
diff --git a/pkgs/tools/graphics/zbar/default.nix b/pkgs/tools/graphics/zbar/default.nix
index 4e850e4fe6c7..9bf4a281e062 100644
--- a/pkgs/tools/graphics/zbar/default.nix
+++ b/pkgs/tools/graphics/zbar/default.nix
@@ -22,6 +22,8 @@
   # see https://github.com/mchehab/zbar/issues/104
 , enableDbus ? false
 , libintl
+, libiconv
+, Foundation
 }:
 
 stdenv.mkDerivation rec {
@@ -50,6 +52,9 @@ stdenv.mkDerivation rec {
   buildInputs = [
     imagemagickBig
     libintl
+  ] ++ lib.optionals stdenv.isDarwin [
+    libiconv
+    Foundation
   ] ++ lib.optionals enableDbus [
     dbus
   ] ++ lib.optionals withXorg [
diff --git a/pkgs/tools/misc/fd/default.nix b/pkgs/tools/misc/fd/default.nix
index 6dd0e7a6e7cb..2795210101c3 100644
--- a/pkgs/tools/misc/fd/default.nix
+++ b/pkgs/tools/misc/fd/default.nix
@@ -7,7 +7,10 @@ rustPlatform.buildRustPackage rec {
   src = fetchFromGitHub {
     owner = "sharkdp";
     repo = "fd";
-    rev = "v${version}";
+    # On the next release, go back to `rev = "v${version}";`
+    # The 8.5.3 release appears to have been mysteriously re-tagged:
+    # https://github.com/sharkdp/fd/issues/1184
+    rev = "f6e74407e80a5563a9e4d0530371aed281e05838";
     sha256 = "sha256-7QQHLw+isXtr1FDQr4aiUhvOjJUPbaxFGDwukiWBG9g=";
   };
 
diff --git a/pkgs/tools/misc/flexoptix-app/default.nix b/pkgs/tools/misc/flexoptix-app/default.nix
index b86a6a992e18..b7318c119dac 100644
--- a/pkgs/tools/misc/flexoptix-app/default.nix
+++ b/pkgs/tools/misc/flexoptix-app/default.nix
@@ -1,11 +1,11 @@
 { lib, appimageTools, fetchurl, nodePackages }: let
   pname = "flexoptix-app";
-  version = "5.13.0";
+  version = "5.13.1";
 
   src = fetchurl {
     name = "${pname}-${version}.AppImage";
     url = "https://flexbox.reconfigure.me/download/electron/linux/x64/FLEXOPTIX%20App.${version}.AppImage";
-    hash = "sha256-PUGxrGHjebCxtN7Q0N/crqOHTeunWqy3wmWTGqCFYTw=";
+    hash = "sha256-+rHktjZd6P4JGYRhEXdZYVI64XMYc7cBGojAQNd8Mq8=";
   };
 
   udevRules = fetchurl {
diff --git a/pkgs/tools/misc/hexyl/default.nix b/pkgs/tools/misc/hexyl/default.nix
index 07c3d54d3108..c1832acb11ca 100644
--- a/pkgs/tools/misc/hexyl/default.nix
+++ b/pkgs/tools/misc/hexyl/default.nix
@@ -1,20 +1,19 @@
-{ lib, fetchFromGitHub, rustPlatform }:
+{ lib, rustPlatform, fetchFromGitHub }:
 
 rustPlatform.buildRustPackage rec {
   pname = "hexyl";
-  version = "0.11.0";
+  version = "0.12.0";
 
   src = fetchFromGitHub {
     owner = "sharkdp";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-Y/zEJx+tUYCA/Clvwvnsy7L3whIXT7e5bgluhrOOPjM=";
+    hash = "sha256-vh3U4JhjlqA8i6vlOF4dhhinhD/rMWLYRx5wx5bdrGw=";
   };
 
-  cargoHash = "sha256-NpEwuVz0tFkbUZQ4W+ojeD3omEXZ7YRqDmy/zLe5Z1o=";
+  cargoHash = "sha256-lsRwzD+4p9ijTjMLvoFxFEkvUhioUab5oVe+EZJCEwc=";
 
   meta = with lib; {
-    changelog = "https://github.com/sharkdp/hexyl/releases/tag/v${version}";
     description = "A command-line hex viewer";
     longDescription = ''
       `hexyl` is a simple hex viewer for the terminal. It uses a colored
@@ -23,7 +22,8 @@ rustPlatform.buildRustPackage rec {
       characters and non-ASCII).
     '';
     homepage = "https://github.com/sharkdp/hexyl";
+    changelog = "https://github.com/sharkdp/hexyl/blob/v${version}/CHANGELOG.md";
     license = with licenses; [ asl20 /* or */ mit ];
-    maintainers = with maintainers; [ dywedir SuperSandro2000 ];
+    maintainers = with maintainers; [ dywedir figsoda SuperSandro2000 ];
   };
 }
diff --git a/pkgs/tools/misc/lemmy-help/default.nix b/pkgs/tools/misc/lemmy-help/default.nix
index 1bc07257a2fd..1d5415a79d19 100644
--- a/pkgs/tools/misc/lemmy-help/default.nix
+++ b/pkgs/tools/misc/lemmy-help/default.nix
@@ -2,18 +2,18 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "lemmy-help";
-  version = "0.9.0";
+  version = "0.10.0";
 
   src = fetchFromGitHub {
     owner = "numToStr";
     repo = "lemmy-help";
     rev = "v${version}";
-    sha256 = "sha256-VY8sGxS8wwrezTe4ht9xdr4iE2n9fNSNhfCeGDJL5Lo=";
+    sha256 = "sha256-gsYVrqPcabLCMYN3Gmr6CXTCKKFAy2rDCxmcRwR1Iic=";
   };
 
   buildFeatures = [ "cli" ];
 
-  cargoSha256 = "sha256-yj14kg41EqOco0gx79n8xhf8cyotZ1Mxj2AbNV9TImU=";
+  cargoSha256 = "sha256-iyMEzxCTxJ/CP3UEnLc4SN5zhIjCLGUl4OOk0u0bCJc=";
 
   meta = with lib; {
     description = "A CLI for generating vim help docs from emmylua comments";
@@ -21,6 +21,8 @@ rustPlatform.buildRustPackage rec {
       `lemmy-help` is an emmylua parser as well as a CLI which takes that parsed tree and converts it into vim help docs.
     '';
     homepage = "https://github.com/numToStr/lemmy-help";
+    changelog = "https://github.com/numToStr/lemmy-help/releases/tag/v${version}";
     license = with licenses; [ mit ];
+    maintainers = with maintainers; [ figsoda ];
   };
 }
diff --git a/pkgs/tools/misc/mcfly/default.nix b/pkgs/tools/misc/mcfly/default.nix
index bdefd4a1b2d2..79c9238b9e27 100644
--- a/pkgs/tools/misc/mcfly/default.nix
+++ b/pkgs/tools/misc/mcfly/default.nix
@@ -21,7 +21,7 @@ rustPlatform.buildRustPackage rec {
 
   meta = with lib; {
     homepage = "https://github.com/cantino/mcfly";
-    description = "An upgraded ctrl-r for Bash whose history results make sense for what you're working on right now";
+    description = "An upgraded ctrl-r where history results make sense for what you're working on right now";
     changelog = "https://github.com/cantino/mcfly/raw/v${version}/CHANGELOG.txt";
     license = licenses.mit;
     maintainers = [ maintainers.melkor333 ];
diff --git a/pkgs/tools/misc/opentimestamps-client/default.nix b/pkgs/tools/misc/opentimestamps-client/default.nix
index 6c17cf62a640..93c10530697f 100644
--- a/pkgs/tools/misc/opentimestamps-client/default.nix
+++ b/pkgs/tools/misc/opentimestamps-client/default.nix
@@ -1,27 +1,40 @@
-{ lib, buildPythonApplication, fetchFromGitHub, isPy3k
-, opentimestamps, appdirs, GitPython, pysocks, fetchpatch, git
+{ lib
+, fetchFromGitHub
+, python3
 }:
 
-buildPythonApplication rec {
+python3.pkgs.buildPythonApplication rec {
   pname = "opentimestamps-client";
   version = "0.7.1";
-  disabled = (!isPy3k);
+  format = "setuptools";
 
-  # We can't use the pypi source because it doesn't include README.md which is
-  # needed in setup.py
   src = fetchFromGitHub {
     owner = "opentimestamps";
     repo = "opentimestamps-client";
     rev = "refs/tags/opentimestamps-client-v${version}";
-    sha256 = "sha256-0dWaXetRlF1MveBdJ0sAdqJ5HCdn08gkbX+nen/ygsQ=";
+    hash = "sha256-0dWaXetRlF1MveBdJ0sAdqJ5HCdn08gkbX+nen/ygsQ=";
   };
 
-  propagatedBuildInputs = [ opentimestamps appdirs GitPython pysocks ];
+  propagatedBuildInputs = with python3.pkgs; [
+    appdirs
+    gitpython
+    opentimestamps
+    pysocks
+  ];
+
+  checkInputs = with python3.pkgs; [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "otsclient"
+  ];
 
   meta = with lib; {
     description = "Command-line tool to create and verify OpenTimestamps proofs";
     homepage = "https://github.com/opentimestamps/opentimestamps-client";
-    license = licenses.lgpl3;
+    changelog = "https://github.com/opentimestamps/opentimestamps-client/releases/tag/opentimestamps-client-v${version}";
+    license = licenses.lgpl3Only;
     maintainers = with maintainers; [ erikarvstedt ];
   };
 }
diff --git a/pkgs/tools/misc/opentsdb/default.nix b/pkgs/tools/misc/opentsdb/default.nix
index 18ba5f4b5fc5..0429e854338b 100644
--- a/pkgs/tools/misc/opentsdb/default.nix
+++ b/pkgs/tools/misc/opentsdb/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, autoconf, automake, curl, fetchurl, fetchpatch, jdk8, makeWrapper, nettools
-, python2, git
+, python3, git
 }:
 
 let jdk = jdk8; jre = jdk8.jre; in
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
   ];
 
   nativeBuildInputs = [ makeWrapper autoconf automake ];
-  buildInputs = [ curl jdk nettools python2 git ];
+  buildInputs = [ curl jdk nettools python3 git ];
 
   preConfigure = ''
     patchShebangs ./build-aux/
diff --git a/pkgs/tools/misc/page/default.nix b/pkgs/tools/misc/page/default.nix
index c096d96d17ae..61edaef5f2b7 100644
--- a/pkgs/tools/misc/page/default.nix
+++ b/pkgs/tools/misc/page/default.nix
@@ -2,13 +2,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "page";
-  version = "4.1.0";
+  version = "4.3.0";
 
   src = fetchFromGitHub {
     owner = "I60R";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-w/6uCzBRXsmq7Khe+8ysfgBoxnWBLyRMyb43sCxNYMA=";
+    sha256 = "sha256-ywOT/R6YYK5MOfiCxJDw7grQqUj7NvOv7ulNp6EdK/E=";
   };
 
   nativeBuildInputs = [ installShellFiles ];
@@ -19,7 +19,7 @@ rustPlatform.buildRustPackage rec {
     installShellCompletion --zsh $completions_dir/_page
   '';
 
-  cargoSha256 = "sha256-xHGlJxUpmqR+WoKURpRAJAhmmKXIO0SWg9VLFiinKfo=";
+  cargoSha256 = "sha256-UGPgqmoCqyeqCZS3YlwNAXrJl42nR/Cz+83Jkz5rSrw=";
 
   meta = with lib; {
     description = "Use neovim as pager";
diff --git a/pkgs/tools/misc/plocate/default.nix b/pkgs/tools/misc/plocate/default.nix
index 468b2ca7842b..f767d31f6b97 100644
--- a/pkgs/tools/misc/plocate/default.nix
+++ b/pkgs/tools/misc/plocate/default.nix
@@ -2,6 +2,7 @@
 , stdenv
 , lib
 , fetchgit
+, fetchpatch
 , pkg-config
 , meson
 , ninja
@@ -14,14 +15,23 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "plocate";
-  version = "1.1.16";
+  version = "1.1.17";
 
   src = fetchgit {
     url = "https://git.sesse.net/plocate";
     rev = version;
-    sha256 = "sha256-rwvzDr3leve8BQ30+c3l1+q/7+u7FhPQ7iFcvbx/HjM=";
+    sha256 = "sha256-EcWzvbY8ey5asEJxUeSl10ozApgg+wL5o8NCNw7/W7k=";
   };
 
+  patches = [
+    # fix redefinition error
+    (fetchpatch {
+      url = "https://git.sesse.net/?p=plocate;a=patch;h=0125004cd28c5f9124632b594e51dde73af1691c";
+      revert = true;
+      sha256 = "sha256-1TDpxIdpDZQ0IZ/wGG91RVZDrpMpWkvhRF8oE0CJWIY=";
+    })
+  ];
+
   postPatch = ''
     sed -i meson.build \
       -e '/mkdir\.sh/d'
diff --git a/pkgs/tools/misc/pmbootstrap/default.nix b/pkgs/tools/misc/pmbootstrap/default.nix
index aa6c8ebae2eb..fe2eb882c13e 100644
--- a/pkgs/tools/misc/pmbootstrap/default.nix
+++ b/pkgs/tools/misc/pmbootstrap/default.nix
@@ -3,11 +3,11 @@
 
 buildPythonApplication rec {
   pname = "pmbootstrap";
-  version = "1.50.0";
+  version = "1.50.1";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-UtXUq+B3EMHS3CTqfzbyQK0gHgrFwcwQ6zTzw/EwIuA=";
+    hash = "sha256-2S3I3J3wmRkVSUshyQCUTuYgHLsDMnXZQHt7KySBzIY=";
   };
 
   repo = fetchFromGitLab {
@@ -15,11 +15,14 @@ buildPythonApplication rec {
     owner = "postmarketOS";
     repo = pname;
     rev = version;
-    hash = "sha256-wuNsmc7FBk05VgH+E4uwMJeZRTlqAUe6kLvHqCLAwEY=";
+    hash = "sha256-UkgCNob4nazFO8xXyosV+11Sj4yveYBfgh7aw+/6Rlg=";
   };
 
   pmb_test = "${repo}/test";
 
+  # Tests depend on sudo
+  doCheck = stdenv.isLinux;
+
   checkInputs = [ pytestCheckHook git openssl ps sudo ];
 
   # Add test dependency in PATH
@@ -93,7 +96,5 @@ buildPythonApplication rec {
     homepage = "https://gitlab.com/postmarketOS/pmbootstrap";
     license = licenses.gpl3Plus;
     maintainers = with maintainers; [ onny ];
-    # https://github.com/NixOS/nixpkgs/pull/146576#issuecomment-974267651
-    broken = stdenv.isDarwin && stdenv.isAarch64;
   };
 }
diff --git a/pkgs/tools/misc/popsicle/default.nix b/pkgs/tools/misc/popsicle/default.nix
index bae9465c7cb8..3caba8f2cfc7 100644
--- a/pkgs/tools/misc/popsicle/default.nix
+++ b/pkgs/tools/misc/popsicle/default.nix
@@ -1,73 +1,54 @@
-{ stdenv
+{ lib
+, stdenv
 , fetchFromGitHub
-, rustc
-, cargo
 , rustPlatform
-, pkg-config
-, dbus
 , glib
-, cairo
-, pango
-, atk
-, lib
+, pkg-config
 , gdk-pixbuf
 , gtk3
+, wrapGAppsHook
 }:
 
-rustPlatform.buildRustPackage.override { stdenv = stdenv; } rec {
+stdenv.mkDerivation rec {
   pname = "popsicle";
-  version = "unstable-2021-12-20";
+  version = "1.3.1";
 
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = pname;
-    rev = "b02ebf5f2e6c18777453ca9a144d69689a6fa901";
-    sha256 = "03ilhvnr4mwy7b8bipp616h16m2ilxzxz2zjpkzy3afwvh9bz1mx";
+    rev = version;
+    sha256 = "sha256-NqzuZmVabQ5WHOlBEsJhL/5Yet3TMSuo/gofSabCjTY=";
   };
 
-  cargoSha256 = "1c54wxyrfxk5chnjhxw6vaznm7ff9dkx1rxlgp417jfygiwijjs4";
+  cargoDeps = rustPlatform.fetchCargoTarball {
+    inherit src;
+    sha256 = "sha256-k2M1c9kk1blE0ZKjstDQANdbUzI4oS1Ho5P+sR4cRtg=";
+  };
 
-  nativeBuildInputs = [ gtk3 pkg-config ];
+  nativeBuildInputs = [
+    glib
+    pkg-config
+    rustPlatform.cargoSetupHook
+    rustPlatform.rust.cargo
+    rustPlatform.rust.rustc
+    wrapGAppsHook
+  ];
 
   buildInputs = [
-    gtk3
-    dbus
-    glib
-    cairo
-    pango
-    atk
     gdk-pixbuf
+    gtk3
   ];
 
-  # Use the stdenv default phases (./configure; make) instead of the
-  # ones from buildRustPackage.
-  configurePhase = "configurePhase";
-  buildPhase = "buildPhase";
-  checkPhase = "checkPhase";
-  installPhase = "installPhase";
-
-  postPatch = ''
-    # Have to do this here instead of in preConfigure because
-    # cargoDepsCopy gets unset after postPatch.
-    configureFlagsArray+=("RUST_VENDORED_SOURCES=$cargoDepsCopy")
-  '';
-
   makeFlags = [
-    "PREFIX=${placeholder "out"}"
-    "DESTDIR=${placeholder "out"}"
+    "prefix=$(out)"
   ];
 
-  postInstall = ''
-    # install man page, icon, etc...
-    mv $out/usr/local/* $out
-    rm -rf $out/usr
-  '';
-
   meta = with lib; {
     description = "Multiple USB File Flasher";
     homepage = "https://github.com/pop-os/popsicle";
-    maintainers = with maintainers; [ _13r0ck ];
+    changelog = "https://github.com/pop-os/popsicle/releases/tag/${version}";
+    maintainers = with maintainers; [ _13r0ck figsoda ];
     license = licenses.mit;
-    platforms = [ "aarch64-linux" "x86_64-linux" ];
+    platforms = platforms.linux;
   };
 }
diff --git a/pkgs/tools/misc/pspg/default.nix b/pkgs/tools/misc/pspg/default.nix
index 575ae895ea72..ffd467f08393 100644
--- a/pkgs/tools/misc/pspg/default.nix
+++ b/pkgs/tools/misc/pspg/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "pspg";
-  version = "5.6.0";
+  version = "5.6.4";
 
   src = fetchFromGitHub {
     owner = "okbob";
     repo = pname;
     rev = version;
-    sha256 = "sha256-3vCOrNzVFH2xx9egBx86MnOOEl6ZpAc+lYVu8vkHTJc=";
+    sha256 = "sha256-89dW4XILS+nlGgRRePyrSFVb1QR5KQL5OmHJAeyjrZw=";
   };
 
   nativeBuildInputs = [ pkg-config installShellFiles ];
diff --git a/pkgs/tools/misc/tbls/default.nix b/pkgs/tools/misc/tbls/default.nix
index fff80b4fc1ae..78f5c2fb8f06 100644
--- a/pkgs/tools/misc/tbls/default.nix
+++ b/pkgs/tools/misc/tbls/default.nix
@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "tbls";
-  version = "1.56.8";
+  version = "1.56.9";
 
   src = fetchFromGitHub {
     owner = "k1LoW";
     repo = "tbls";
     rev = "v${version}";
-    hash = "sha256-ARqWLm2EEqeV3/VxjSRTXoXywrmQLLGxHab4H6+JMpg=";
+    hash = "sha256-mZUmQoGfTc8nwzcAMIewB7usO5vfBZNCtZEOfYkYgvY=";
   };
 
   vendorHash = "sha256-pmnSeQHZEtsshldfq6D/r5pMYA5ivMWkzjOq2/WseYU=";
diff --git a/pkgs/tools/misc/tio/default.nix b/pkgs/tools/misc/tio/default.nix
index cacc770052fa..713465814422 100644
--- a/pkgs/tools/misc/tio/default.nix
+++ b/pkgs/tools/misc/tio/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "tio";
-  version = "2.3";
+  version = "2.4";
 
   src = fetchFromGitHub {
     owner = "tio";
     repo = "tio";
     rev = "v${version}";
-    hash = "sha256-BjA9Zl6JcgDxTj4KPiWItSq9XuX9FJkpZnhdMBGZQpQ=";
+    hash = "sha256-cRwjg0+p+1u+tdG+skqGWzxwM375P4aUsF4JVGgCXOI=";
   };
 
   nativeBuildInputs = [ meson ninja pkg-config inih bash-completion ];
diff --git a/pkgs/tools/misc/topgrade/default.nix b/pkgs/tools/misc/topgrade/default.nix
index b393269127f4..3b8677273d7b 100644
--- a/pkgs/tools/misc/topgrade/default.nix
+++ b/pkgs/tools/misc/topgrade/default.nix
@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "topgrade";
-  version = "10.2.1";
+  version = "10.2.2";
 
   src = fetchFromGitHub {
     owner = "topgrade-rs";
     repo = "topgrade";
     rev = "v${version}";
-    sha256 = "sha256-ljjbTqFhDDHqyA+UzqxICAM9YI1U0fI6J864o9ee6kg=";
+    sha256 = "sha256-TDuTrtVqEy0g13zdWHz2+cQhMEMSbvameBkJUcyTfGw=";
   };
 
-  cargoSha256 = "sha256-PezSEd2/98us2KPNPTmVIuPlWcRIWF7TUuT/m4df1Fs=";
+  cargoSha256 = "sha256-4uq4lksfgTI+x7E/p27gs0Zh0NQq3kIBB9KVD2tvmtQ=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/tools/misc/tz/default.nix b/pkgs/tools/misc/tz/default.nix
index 30e2fa3ece21..9027ef20bc7f 100644
--- a/pkgs/tools/misc/tz/default.nix
+++ b/pkgs/tools/misc/tz/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "tz";
-  version = "0.6.1";
+  version = "0.6.2";
 
   src = fetchFromGitHub {
     owner = "oz";
     repo = "tz";
     rev = "v${version}";
-    sha256 = "sha256-D0rakLZ+swrDwBMcr+EJPgaYsQTWob50QteW1PoIdNk=";
+    sha256 = "sha256-fl+Q6HNMSIo6E5SMBkTr6/hJN9akfJRBwSPaq7FcYDY=";
   };
 
-  vendorSha256 = "sha256-PGsj7pLtd+xpy9Dhv6qJX5sHin4YAOdXaYj4QCSFte4=";
+  vendorSha256 = "sha256-lcCra4LyebkmelvBs0Dd2mn6R64Q5MaUWc5AP8V9pec=";
 
   meta = with lib; {
     description = "A time zone helper";
diff --git a/pkgs/tools/misc/wwcd/default.nix b/pkgs/tools/misc/wwcd/default.nix
index d18c72a25eeb..41c66d945f40 100644
--- a/pkgs/tools/misc/wwcd/default.nix
+++ b/pkgs/tools/misc/wwcd/default.nix
@@ -17,11 +17,12 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-laf1DEtdEs7q+rtp5Y5rb+7AGsKUv5T413CFWJiURWw=";
   };
 
-  autoreconfFlags = "-if";
   nativeBuildInputs = [
     autoreconfHook pkg-config check
   ];
 
+  autoreconfFlags = [ "-if" ];
+
   meta = with lib; {
     description = "What would cron do? Read crontab entries from stdin and print time of next execution(s)";
     homepage = "https://git.sr.ht/~bitfehler/wwcd";
diff --git a/pkgs/tools/networking/aardvark-dns/default.nix b/pkgs/tools/networking/aardvark-dns/default.nix
index 546d22fe46a9..fdf76d459a29 100644
--- a/pkgs/tools/networking/aardvark-dns/default.nix
+++ b/pkgs/tools/networking/aardvark-dns/default.nix
@@ -5,16 +5,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "aardvark-dns";
-  version = "1.3.0";
+  version = "1.4.0";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-wlaOgWptD4qdaSRg6NNkQNARHMZe3z3QVoXjp133guQ=";
+    sha256 = "sha256-tQTa/iIo7kpcQq1p2romoOG2qNOiSDH7DHx3iZYLY8w=";
   };
 
-  cargoHash = "sha256-BnIGoLIuV/uDaskMA8CeVX2McAHJPT+gchZsS0bQxjI=";
+  cargoHash = "sha256-naWkSXQHfImd6R+RHKkmTe8UiqxknZEFYoJ0g/URCVY=";
 
   meta = with lib; {
     description = "Authoritative dns server for A/AAAA container records";
diff --git a/pkgs/tools/networking/clash/default.nix b/pkgs/tools/networking/clash/default.nix
index 5013ad60caff..e5594d2e0c43 100644
--- a/pkgs/tools/networking/clash/default.nix
+++ b/pkgs/tools/networking/clash/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "clash";
-  version = "1.11.4";
+  version = "1.12.0";
 
   src = fetchFromGitHub {
     owner = "Dreamacro";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-NLGX72eZCfyh6y3mud/btMh15rNXnss7S0P7ujCX1ms=";
+    sha256 = "sha256-SE+nZIatvwyc6JubMb7YUlNiJv+LYtJjFMlKEoJzEn8=";
   };
 
-  vendorSha256 = "sha256-zaWN/zI4WhHnEK12k1tWZ/qjLGvaZbJ4WfEvCZJ0+ms=";
+  vendorSha256 = "sha256-ikcGZ1Gfxb4zBkav8MDi3+xNbvhqHIk6NhLfI2ne3ns=";
 
   # Do not build testing suit
   excludedPackages = [ "./test" ];
diff --git a/pkgs/tools/networking/croc/default.nix b/pkgs/tools/networking/croc/default.nix
index cc9099877c1e..77d8de4294b0 100644
--- a/pkgs/tools/networking/croc/default.nix
+++ b/pkgs/tools/networking/croc/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "croc";
-  version = "9.6.1";
+  version = "9.6.2";
 
   src = fetchFromGitHub {
     owner = "schollz";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-4yikcuAhrVzWYsNOI546tA94Eho7QDCyBCmpaQ2tLW8=";
+    sha256 = "sha256-MaIvxO2bvLGrZmBLXZk2vgW1NtyoVKRxXEZALEwI/lY=";
   };
 
-  vendorSha256 = "sha256-i/80caEjr5kZAK30sXF9dKh+jAi3msntfB/BUqpGuRY=";
+  vendorSha256 = "sha256-X+DxN0DAyZ/z8YRRjuezegcPHa6SJ3/XXPYP+1Apmjw=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/tools/networking/httplz/default.nix b/pkgs/tools/networking/httplz/default.nix
index f02623329c3e..d32792149974 100644
--- a/pkgs/tools/networking/httplz/default.nix
+++ b/pkgs/tools/networking/httplz/default.nix
@@ -1,6 +1,7 @@
 { lib
 , rustPlatform
 , fetchCrate
+, fetchpatch
 , installShellFiles
 , makeWrapper
 , pkg-config
@@ -21,6 +22,15 @@ rustPlatform.buildRustPackage rec {
     sha256 = "sha256-+nCqMTLrBYNQvoKo1PzkyzRCkKdlE88+NYoJcIlAJts=";
   };
 
+  patches = [
+    # https://github.com/thecoshman/http/pull/151
+    (fetchpatch {
+      name = "fix-rust-1.65-compile.patch";
+      url = "https://github.com/thecoshman/http/commit/6e4c8e97cce09d0d18d4936f90aa643659d813fc.patch";
+      hash = "sha256-mXclXfp2Nzq6Pr9VFmxiOzECGZEQRNOAcXoKhiOyuFs=";
+    })
+  ];
+
   cargoSha256 = "sha256-odiVIfNJPpagoASnYvdOosHXa37gbQM8Zmvtnao0pAs=";
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/networking/linkchecker/default.nix b/pkgs/tools/networking/linkchecker/default.nix
index 1facde5bc792..b7ae9f00996a 100644
--- a/pkgs/tools/networking/linkchecker/default.nix
+++ b/pkgs/tools/networking/linkchecker/default.nix
@@ -1,28 +1,29 @@
-{ stdenv, lib, fetchFromGitHub, python3Packages, gettext }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, python3
+, gettext
+}:
 
-let
-  pypkgs = python3Packages;
-
-in
-pypkgs.buildPythonApplication rec {
+python3.pkgs.buildPythonApplication rec {
   pname = "linkchecker";
-  version = "10.2.0";
+  version = "10.2.1";
   format = "pyproject";
 
-  disabled = pypkgs.pythonOlder "3.7";
-
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
-    rev = "v" + version;
-    hash = "sha256-wMiKS14fX5mkY1OwxQPFKm7i4WMFQKg3tdZZqD0g0Rw=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-z7Qp74cai8GfsxB4n9dSCWQepp0/4PimFiRJQBaVSoo=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
 
-  nativeBuildInputs = [ gettext ];
+  nativeBuildInputs = [
+    gettext
+  ];
 
-  propagatedBuildInputs = with pypkgs; [
+  propagatedBuildInputs = with python3.pkgs; [
     argcomplete
     beautifulsoup4
     configargparse
@@ -33,24 +34,32 @@ pypkgs.buildPythonApplication rec {
     requests
   ];
 
-  checkInputs = with pypkgs; [
+  checkInputs = with python3.pkgs; [
     parameterized
-    pytest
+    pytestCheckHook
   ];
 
-  # test_timeit2 is flakey, and depends sleep being precise to the milisecond
-  checkPhase = lib.optionalString stdenv.isDarwin ''
-    # network tests fails on darwin
-    rm tests/test_network.py tests/checker/test_http*.py tests/checker/test_content_allows_robots.py tests/checker/test_noproxy.py
-  '' + ''
-    pytest --ignore=tests/checker/{test_telnet,telnetserver}.py \
-      -k 'not TestLoginUrl and not test_timeit2'
-  '';
+  disabledTests = [
+    # test_timeit2 is flakey, and depends sleep being precise to the milisecond
+    "TestLoginUrl"
+    "test_timeit2"
+  ];
+
+  disabledTestPaths = [
+    "tests/checker/telnetserver.py"
+    "tests/checker/test_telnet.py"
+  ] ++ lib.optionals stdenv.isDarwin [
+    "tests/checker/test_content_allows_robots.py"
+    "tests/checker/test_http*.py"
+    "tests/checker/test_noproxy.py"
+    "tests/test_network.py"
+  ];
 
   meta = with lib; {
     description = "Check websites for broken links";
     homepage = "https://linkcheck.github.io/linkchecker/";
-    license = licenses.gpl2;
+    changelog = "https://github.com/linkchecker/linkchecker/releases/tag/v${version}";
+    license = licenses.gpl2Plus;
     maintainers = with maintainers; [ peterhoeg tweber ];
   };
 }
diff --git a/pkgs/tools/networking/mu/default.nix b/pkgs/tools/networking/mu/default.nix
index 0544b6d1ec11..8c09f1e430f6 100644
--- a/pkgs/tools/networking/mu/default.nix
+++ b/pkgs/tools/networking/mu/default.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation rec {
   pname = "mu";
-  version = "1.8.11";
+  version = "1.8.13";
 
   src = fetchFromGitHub {
     owner = "djcb";
     repo = "mu";
     rev = "v${version}";
-    hash = "sha256-IEfwAAUqEGtN4vww0pfW7iuIY/U3eqzC+MJsqtossCw=";
+    hash = "sha256-uXrJOBF3X8UF1ktTfAoYgzc0QBLvyzzGQVJVfs8tjng=";
   };
 
   postPatch = ''
diff --git a/pkgs/tools/networking/netavark/default.nix b/pkgs/tools/networking/netavark/default.nix
index 0bfe7f974e8d..fbd0a8119c51 100644
--- a/pkgs/tools/networking/netavark/default.nix
+++ b/pkgs/tools/networking/netavark/default.nix
@@ -7,22 +7,22 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "netavark";
-  version = "1.3.0";
+  version = "1.4.0";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-5LczayUgIJ2mcSiHKadegzTM8PvejAD0lhUlXO4Js30=";
+    sha256 = "sha256-nG+HTwF3v8FUK2SE+I312Ec5y6YPShS9si9Pc2SG1jc=";
   };
 
-  cargoHash = "sha256-gBdhdJD5EkkYNdpTNq+spySaoWnWViy9+bXTL7ps4PE=";
+  cargoHash = "sha256-szIG1udBCZj18sN3IiQtOuR8qw/xWhTMgb/n4lyTwvs=";
 
   nativeBuildInputs = [ installShellFiles mandown ];
 
   postBuild = ''
-    make -C docs
-    installManPage docs/*.1
+    make -C docs netavark.1
+    installManPage docs/netavark.1
   '';
 
   meta = with lib; {
diff --git a/pkgs/tools/networking/netbird/default.nix b/pkgs/tools/networking/netbird/default.nix
index 7997962f3b97..80897a13679e 100644
--- a/pkgs/tools/networking/netbird/default.nix
+++ b/pkgs/tools/networking/netbird/default.nix
@@ -14,13 +14,13 @@ let
 in
 buildGoModule rec {
   pname = "netbird";
-  version = "0.11.1";
+  version = "0.11.4";
 
   src = fetchFromGitHub {
     owner = "netbirdio";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-9dp/OMHIA1qYM4XLWOTPmlUm6+7EOE9PFsIa8IcZ/8M=";
+    sha256 = "sha256-2luUuCRcFkoUqPCXHBn1g4T6TxmSzzhDESlFSetowsA=";
   };
 
   vendorSha256 = "sha256-TfHBvcG3e+yjifPVo0ZgcvLvD16fni4m71nCr4cCBD4=";
diff --git a/pkgs/tools/networking/networkmanager/libnma/default.nix b/pkgs/tools/networking/networkmanager/libnma/default.nix
index 5db28c427d1e..3b5f8bba148f 100644
--- a/pkgs/tools/networking/networkmanager/libnma/default.nix
+++ b/pkgs/tools/networking/networkmanager/libnma/default.nix
@@ -19,7 +19,7 @@
 , withGtk4 ? false
 , gtk4
 , withGnome ? true
-, gcr
+, gcr_4
 , glib
 , substituteAll
 , lib
@@ -27,13 +27,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libnma";
-  version = "1.10.2";
+  version = "1.10.4";
 
   outputs = [ "out" "dev" "devdoc" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "T8PZxAS3sTMD2TlPlpYcUpjXGvqfH6evXk8PboQqCUA=";
+    sha256 = "eecw3aGfmzSIb0BkqhcPGiMmsIMp1lXYC2fpBsf3i3w=";
   };
 
   patches = [
@@ -65,7 +65,7 @@ stdenv.mkDerivation rec {
     gtk4
   ] ++ lib.optionals withGnome [
     # advanced certificate chooser
-    gcr
+    gcr_4
   ];
 
   mesonFlags = [
diff --git a/pkgs/tools/networking/p2p/amule/default.nix b/pkgs/tools/networking/p2p/amule/default.nix
index 7538bb941260..8cd0f7935ecf 100644
--- a/pkgs/tools/networking/p2p/amule/default.nix
+++ b/pkgs/tools/networking/p2p/amule/default.nix
@@ -7,7 +7,7 @@
 , lib
 , cmake
 , zlib
-, wxGTK30-gtk3 # WxGTK 3.0 must be used because aMule does not yet work well with 3.1
+, wxGTK30 # WxGTK 3.0 must be used because aMule does not yet work well with 3.1
 , perl
 , cryptopp
 , libupnp
@@ -41,7 +41,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [
     zlib
-    wxGTK30-gtk3
+    wxGTK30
     perl
     cryptopp.dev
     libupnp
diff --git a/pkgs/tools/networking/shadowsocks-libev/default.nix b/pkgs/tools/networking/shadowsocks-libev/default.nix
index 6018e77e5e43..4b268213c94c 100644
--- a/pkgs/tools/networking/shadowsocks-libev/default.nix
+++ b/pkgs/tools/networking/shadowsocks-libev/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchFromGitHub, cmake
-, libsodium, mbedtls, libev, c-ares, pcre
+, libsodium, mbedtls_2, libev, c-ares, pcre
 , asciidoc, xmlto, docbook_xml_dtd_45, docbook_xsl, libxslt
 }:
 
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
     fetchSubmodules = true;
   };
 
-  buildInputs = [ libsodium mbedtls libev c-ares pcre ];
+  buildInputs = [ libsodium mbedtls_2 libev c-ares pcre ];
   nativeBuildInputs = [ cmake asciidoc xmlto docbook_xml_dtd_45
                         docbook_xsl libxslt ];
 
diff --git a/pkgs/tools/package-management/nix/default.nix b/pkgs/tools/package-management/nix/default.nix
index e6ee3ffe1d87..a6bf0a585fb7 100644
--- a/pkgs/tools/package-management/nix/default.nix
+++ b/pkgs/tools/package-management/nix/default.nix
@@ -119,7 +119,15 @@ in lib.makeExtensible (self: {
     ];
   };
 
-  stable = self.nix_2_11;
+  nix_2_12 = common {
+    version = "2.12.0";
+    sha256 = "sha256-sQ9C101CL/eVN5JgH91ozHFWU4+bXr8/Fi/8NQk6xRI=";
+    patches = [
+      ./patches/flaky-tests.patch
+    ];
+  };
+
+  stable = self.nix_2_12;
 
   unstable = self.stable;
 })
diff --git a/pkgs/tools/security/clairvoyance/default.nix b/pkgs/tools/security/clairvoyance/default.nix
index 6d4fc13ed468..fd7942bdd5d3 100644
--- a/pkgs/tools/security/clairvoyance/default.nix
+++ b/pkgs/tools/security/clairvoyance/default.nix
@@ -5,14 +5,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "clairvoyance";
-  version = "2.0.4";
+  version = "2.0.6";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "nikitastupin";
     repo = pname;
-    rev = "v${version}";
-    hash = "sha256-b69a3UTRt5axTSjLcEYkqGe7bFlQKCiMzoNtw91HCyI=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-Jsb/UjqAppAUz9AGgON6AyVgUdOY6aswjQ9EL939Kro=";
   };
 
   nativeBuildInputs = with python3.pkgs; [
diff --git a/pkgs/tools/security/crowdsec/default.nix b/pkgs/tools/security/crowdsec/default.nix
index ce76c5d9b450..55107d627104 100644
--- a/pkgs/tools/security/crowdsec/default.nix
+++ b/pkgs/tools/security/crowdsec/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "crowdsec";
-  version = "1.4.2";
+  version = "1.4.3";
 
   src = fetchFromGitHub {
     owner = "crowdsecurity";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-hL3+hTOuwcbxiVZeq9oZjfKI1TJJt64g+74NolA3Drc=";
+    hash = "sha256-joLnKWKJR4XSoGTTx5xIKB8OH3EwSJbjEArYsPaVAOk=";
   };
 
   vendorHash = "sha256-FPsoufB9UDgBDIE3yUq4doBse3qgjP19ussYnMAxntk=";
diff --git a/pkgs/tools/security/nuclei/default.nix b/pkgs/tools/security/nuclei/default.nix
index 3d2d909a399e..b8ffc2f6ba6e 100644
--- a/pkgs/tools/security/nuclei/default.nix
+++ b/pkgs/tools/security/nuclei/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "nuclei";
-  version = "2.7.9";
+  version = "2.8.1";
 
   src = fetchFromGitHub {
     owner = "projectdiscovery";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-cAXIb8C14cpBKLpvQfJT2JbSy7Jf3SL4XyXVISoI8vE=";
+    hash = "sha256-4qymEc2uYLi+6YDMbW6aUbe3RgOMaj6DT+6EfK3JaKk=";
   };
 
-  vendorSha256 = "sha256-qIEKGnFURtfh8CdHSbAtEaQRrsjfpvwyK+uPmYNXpiA=";
+  vendorHash = "sha256-BW3IaF8etjUklX7RpxVWQoTIXSmu+qT7xyQrPKjTbD4=";
 
   modRoot = "./v2";
   subPackages = [
@@ -34,6 +34,7 @@ buildGoModule rec {
       CVEs across targets that are known and easily detectable.
     '';
     homepage = "https://github.com/projectdiscovery/nuclei";
+    changelog = "https://github.com/projectdiscovery/nuclei/releases/tag/v${version}";
     license = licenses.mit;
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/tools/security/pinentry/default.nix b/pkgs/tools/security/pinentry/default.nix
index 68e72171eca4..61f84e5d76e9 100644
--- a/pkgs/tools/security/pinentry/default.nix
+++ b/pkgs/tools/security/pinentry/default.nix
@@ -1,14 +1,13 @@
 { fetchurl, mkDerivation, fetchpatch, stdenv, lib, pkg-config, autoreconfHook, wrapGAppsHook
 , libgpg-error, libassuan, qtbase, wrapQtAppsHook
-, ncurses, gtk2, gcr, libcap, libsecret
+, ncurses, gtk2, gcr, libcap
+, withLibsecret ? true, libsecret
 , enabledFlavors ? [ "curses" "tty" "gtk2" "emacs" ]
   ++ lib.optionals stdenv.isLinux [ "gnome3" ]
   ++ lib.optionals (!stdenv.isDarwin) [ "qt" ]
 }:
 
-with lib;
-
-assert isList enabledFlavors && enabledFlavors != [];
+assert lib.isList enabledFlavors && enabledFlavors != [];
 
 let
   pinentryMkDerivation =
@@ -18,11 +17,10 @@ let
 
   enableFeaturePinentry = f:
     let
-      info = flavorInfo.${f};
       flag = flavorInfo.${f}.flag or null;
     in
-      optionalString (flag != null)
-        (enableFeature (elem f enabledFlavors) ("pinentry-" + flag));
+      lib.optionalString (flag != null)
+        (lib.enableFeature (lib.elem f enabledFlavors) ("pinentry-" + flag));
 
   flavorInfo = {
     curses = { bin = "curses"; flag = "curses"; buildInputs = [ ncurses ]; };
@@ -45,17 +43,18 @@ pinentryMkDerivation rec {
   };
 
   nativeBuildInputs = [ pkg-config autoreconfHook ]
-    ++ concatMap(f: flavorInfo.${f}.nativeBuildInputs or []) enabledFlavors;
-  buildInputs = [ libgpg-error libassuan libsecret ]
+    ++ lib.concatMap(f: flavorInfo.${f}.nativeBuildInputs or []) enabledFlavors;
+  buildInputs = [ libgpg-error libassuan ]
+    ++ lib.optional withLibsecret libsecret
     ++ lib.optional (!stdenv.isDarwin) libcap
-    ++ concatMap(f: flavorInfo.${f}.buildInputs or []) enabledFlavors;
+    ++ lib.concatMap(f: flavorInfo.${f}.buildInputs or []) enabledFlavors;
 
   dontWrapGApps = true;
   dontWrapQtApps = true;
 
   patches = [
     ./autoconf-ar.patch
-  ] ++ optionals (elem "gtk2" enabledFlavors) [
+  ] ++ lib.optionals (lib.elem "gtk2" enabledFlavors) [
     (fetchpatch {
       url = "https://salsa.debian.org/debian/pinentry/raw/debian/1.1.0-1/debian/patches/0007-gtk2-When-X11-input-grabbing-fails-try-again-over-0..patch";
       sha256 = "15r1axby3fdlzz9wg5zx7miv7gqx2jy4immaw4xmmw5skiifnhfd";
@@ -63,23 +62,23 @@ pinentryMkDerivation rec {
   ];
 
   configureFlags = [
-    (withFeature   (libcap != null)    "libcap")
-    (enableFeature (libsecret != null) "libsecret")
-  ] ++ (map enableFeaturePinentry (attrNames flavorInfo));
+    (lib.withFeature   (libcap != null) "libcap")
+    (lib.enableFeature withLibsecret    "libsecret")
+  ] ++ (map enableFeaturePinentry (lib.attrNames flavorInfo));
 
   postInstall =
-    concatStrings (flip map enabledFlavors (f:
+    lib.concatStrings (lib.flip map enabledFlavors (f:
       let
         binary = "pinentry-" + flavorInfo.${f}.bin;
       in ''
         moveToOutput bin/${binary} ${placeholder f}
         ln -sf ${placeholder f}/bin/${binary} ${placeholder f}/bin/pinentry
-      '' + optionalString (f == "gnome3") ''
+      '' + lib.optionalString (f == "gnome3") ''
         wrapGApp ${placeholder f}/bin/${binary}
-      '' + optionalString (f == "qt") ''
+      '' + lib.optionalString (f == "qt") ''
         wrapQtApp ${placeholder f}/bin/${binary}
       '')) + ''
-      ln -sf ${placeholder (head enabledFlavors)}/bin/pinentry-${flavorInfo.${head enabledFlavors}.bin} $out/bin/pinentry
+      ln -sf ${placeholder (lib.head enabledFlavors)}/bin/pinentry-${flavorInfo.${lib.head enabledFlavors}.bin} $out/bin/pinentry
     '';
 
   outputs = [ "out" ] ++ enabledFlavors;
diff --git a/pkgs/tools/security/teler/default.nix b/pkgs/tools/security/teler/default.nix
index ffcab3a41877..1a66d7aea0dd 100644
--- a/pkgs/tools/security/teler/default.nix
+++ b/pkgs/tools/security/teler/default.nix
@@ -5,19 +5,21 @@
 
 buildGoModule rec {
   pname = "teler";
-  version = "1.2.2";
+  version = "2.0.0-dev.2";
 
   src = fetchFromGitHub {
     owner = "kitabisa";
     repo = "teler";
     rev = "v${version}";
-    sha256 = "sha256-i4106PtoCJt5CY9ahczZYe9GufBkaZS+9Peh0IY9r1M=";
+    hash = "sha256-GlpQBmJ7HSKPFieM7E5NOnqGlUjQv9Ywe6XF5QIi+c4=";
   };
 
-  vendorSha256 = "sha256-TQjwPem+RMuoF5T02CL/CTvBS6W7Q786gTvYUFIvxjE=";
+  vendorHash = "sha256-g2YBMyLDGQZKxDBcZ1mca16jxODnJzcmMfFivBn6SdE=";
 
   ldflags = [
-    "-s" "-w" "-X ktbs.dev/teler/common.Version=${version}"
+    "-s"
+    "-w"
+    "-X ktbs.dev/teler/common.Version=${version}"
   ];
 
   # test require internet access
@@ -31,6 +33,7 @@ buildGoModule rec {
       we collect and provide by the community.
     '';
     homepage = "https://github.com/kitabisa/teler";
+    changelog = "https://github.com/kitabisa/teler/releases/tag/v${version}";
     license = licenses.asl20;
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/tools/security/tpm2-tools/default.nix b/pkgs/tools/security/tpm2-tools/default.nix
index 63b2f911a53a..a7147911a865 100644
--- a/pkgs/tools/security/tpm2-tools/default.nix
+++ b/pkgs/tools/security/tpm2-tools/default.nix
@@ -4,11 +4,11 @@
 
 stdenv.mkDerivation rec {
   pname = "tpm2-tools";
-  version = "5.3";
+  version = "5.4";
 
   src = fetchurl {
     url = "https://github.com/tpm2-software/${pname}/releases/download/${version}/${pname}-${version}.tar.gz";
-    sha256 = "sha256-584v0271zb14ctgjpELodUpPDKfFS2DvzbdcEqH5j48=";
+    sha256 = "sha256-9jVx0j7dltAkoiRTJry5o2+sLPia71psBaOwhS0pLJk=";
   };
 
   nativeBuildInputs = [ pandoc pkg-config makeWrapper ];
diff --git a/pkgs/tools/security/trufflehog/default.nix b/pkgs/tools/security/trufflehog/default.nix
index 57f49988e75b..27574241576a 100644
--- a/pkgs/tools/security/trufflehog/default.nix
+++ b/pkgs/tools/security/trufflehog/default.nix
@@ -1,4 +1,6 @@
-{ lib, python3Packages }:
+{ lib
+, python3Packages
+}:
 
 let
   truffleHogRegexes = python3Packages.buildPythonPackage rec {
@@ -16,7 +18,7 @@ in
 
     src = python3Packages.fetchPypi {
       inherit pname version;
-      sha256 = "sha256-fw0JyM2iqQrkL4FAXllEozJdkKWELS3eAURx5NZcceQ=";
+      hash = "sha256-fw0JyM2iqQrkL4FAXllEozJdkKWELS3eAURx5NZcceQ=";
     };
 
     # Relax overly restricted version constraint
@@ -24,15 +26,18 @@ in
       substituteInPlace setup.py --replace "GitPython ==" "GitPython >= "
     '';
 
-    propagatedBuildInputs = [ python3Packages.GitPython truffleHogRegexes ];
+    propagatedBuildInputs = [
+      python3Packages.gitpython
+      truffleHogRegexes
+    ];
 
     # Test cases run git clone and require network access
     doCheck = false;
 
-    meta = {
+    meta = with lib; {
       homepage = "https://github.com/dxa4481/truffleHog";
       description = "Searches through git repositories for high entropy strings and secrets, digging deep into commit history";
-      license = with lib.licenses; [ gpl2 ];
-      maintainers = with lib.maintainers; [ bhipple ];
+      license = with licenses; [ gpl2 ];
+      maintainers = with maintainers; [ bhipple ];
     };
   }
diff --git a/pkgs/tools/security/uncover/default.nix b/pkgs/tools/security/uncover/default.nix
index 177e46b423a4..fdfa3c108057 100644
--- a/pkgs/tools/security/uncover/default.nix
+++ b/pkgs/tools/security/uncover/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "uncover";
-  version = "0.0.9";
+  version = "1.0.1";
 
   src = fetchFromGitHub {
     owner = "projectdiscovery";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-bYSqfxjJGue+7gPr8XgkcPF7UUuKWmLuQO07KCJp4jY=";
+    hash = "sha256-N2560u3rkLhB9wL48hLzrw8NksXruGQuvjQGvVFOxsk=";
   };
 
-  vendorSha256 = "sha256-FG0pqzSoqT/KjTOjXidAGjSABMFWgChJJYOhBfyzM7w=";
+  vendorSha256 = "sha256-71tXOm444xmRuOkw7Sa1T0afrZowvhreiwIxwlAeK6A=";
 
   meta = with lib; {
     description = "API wrapper to search for exposed hosts";
@@ -25,6 +25,7 @@ buildGoModule rec {
       Currently, it supports shodan,shodan-internetdb, censys, and fofa search API.
     '';
     homepage = "https://github.com/projectdiscovery/uncover";
+    changelog = "https://github.com/projectdiscovery/uncover/releases/tag/v${version}";
     license = licenses.mit;
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/tools/security/vaultwarden/vault.nix b/pkgs/tools/security/vaultwarden/vault.nix
index 4353303a9160..0a80c1079532 100644
--- a/pkgs/tools/security/vaultwarden/vault.nix
+++ b/pkgs/tools/security/vaultwarden/vault.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "vaultwarden-vault";
-  version = "2022.6.2";
+  version = "2022.11.1";
 
   src = fetchurl {
     url = "https://github.com/dani-garcia/bw_web_builds/releases/download/v${version}/bw_web_v${version}.tar.gz";
-    sha256 = "sha256-IG/eCBTUa7eKeaelqxCWO+rrXJUuBanhsYwklftxdOE=";
+    sha256 = "sha256-nd32Q0uTsnrdVPDe1Yglvkg2QcwgLR+x0dFvKSD8o8I=";
   };
 
   buildCommand = ''
diff --git a/pkgs/tools/system/automatic-timezoned/default.nix b/pkgs/tools/system/automatic-timezoned/default.nix
index ee235fe695a6..cc32210b3dda 100644
--- a/pkgs/tools/system/automatic-timezoned/default.nix
+++ b/pkgs/tools/system/automatic-timezoned/default.nix
@@ -5,16 +5,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "automatic-timezoned";
-  version = "1.0.45";
+  version = "1.0.49";
 
   src = fetchFromGitHub {
     owner = "maxbrunet";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-Q/FekjyEgeZAhX4Ni8XcBPSto/UwXU4TD9b3yrBNIZ4=";
+    sha256 = "sha256-Y4QKTO85f8RHJp0tn4+/EF7uL0j2UPprDUhNaNhTfM4=";
   };
 
-  cargoSha256 = "sha256-gvJRN9YGaY1mfBn8gopTW8p+7AE7JI/A/1rixWVX2tU=";
+  cargoSha256 = "sha256-JJcmQBK39ld0pDDnrpJVJzn5fHmR5A7+NLDB+h3JHlo=";
 
   meta = with lib; {
     description = "Automatically update system timezone based on location";
diff --git a/pkgs/tools/system/plan9port/default.nix b/pkgs/tools/system/plan9port/default.nix
index 3e52d10a240b..b4a277eeec4e 100644
--- a/pkgs/tools/system/plan9port/default.nix
+++ b/pkgs/tools/system/plan9port/default.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "plan9port";
-  version = "2021-10-19";
+  version = "2022-09-12";
 
   src = fetchFromGitHub {
     owner = "9fans";
     repo = pname;
-    rev = "d0d440860f2000a1560abb3f593cdc325fcead4c";
-    hash = "sha256-2aYXqPGwrReyFPrLDtEjgQd/RJjpOfI3ge/tDocYpRQ=";
+    rev = "ffbdd1aa20c8a20a8e9dcd3cec644b6dfa3c6acb";
+    hash = "sha256-Lq5B4VYUetkHwhFX2EaLr33wR1aLIiVn8OBobxjFt7I=";
   };
 
   postPatch = ''
@@ -67,7 +67,7 @@ stdenv.mkDerivation rec {
 
   buildPhase = ''
     runHook preBuild
-    ./INSTALL -b
+    PLAN9_TARGET=$out/plan9 ./INSTALL -b
     runHook postBuild
   '';
 
diff --git a/pkgs/tools/text/d2/default.nix b/pkgs/tools/text/d2/default.nix
index 3d7774c029ad..6fa5e64e3023 100644
--- a/pkgs/tools/text/d2/default.nix
+++ b/pkgs/tools/text/d2/default.nix
@@ -2,20 +2,22 @@
 , buildGoModule
 , fetchFromGitHub
 , installShellFiles
+, testers
+, d2
 }:
 
 buildGoModule rec {
   pname = "d2";
-  version = "0.0.13";
+  version = "0.1.0";
 
   src = fetchFromGitHub {
     owner = "terrastruct";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-2abGQmgwqxWFk7NScdgfEjRYZF2rw8kxTKRwcl2LRg0=";
+    hash = "sha256-QRgHmQOrw1ZdZffjVnqY3epNkVvCNtR06fyQgKVXoRk=";
   };
 
-  vendorSha256 = "sha256-/BEl4UqOL4Ux7I2eubNH2YGGl4DxntpI5WN9ggvYu80=";
+  vendorHash = "sha256-SO3ZeAJu4XOPDlJ2gUSYFPNG8RcOHfCsn2RKPT+FZy4=";
 
   ldflags = [
     "-s"
@@ -29,7 +31,9 @@ buildGoModule rec {
     installManPage ci/release/template/man/d2.1
   '';
 
-  subPackages = [ "cmd/d2" ];
+  subPackages = [ "." ];
+
+  passthru.tests.version = testers.testVersion { package = d2; };
 
   meta = with lib; {
     description = "A modern diagram scripting language that turns text to diagrams";
diff --git a/pkgs/tools/text/poedit/default.nix b/pkgs/tools/text/poedit/default.nix
index 1a9f33438c8b..37fc346eb0a9 100644
--- a/pkgs/tools/text/poedit/default.nix
+++ b/pkgs/tools/text/poedit/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, autoconf, automake, libtool, gettext, pkg-config, wxGTK30-gtk3,
+{ lib, stdenv, fetchFromGitHub, autoconf, automake, libtool, gettext, pkg-config, wxGTK30,
   boost, icu, lucenepp, asciidoc, libxslt, xmlto, gtk3, gtkspell3, pugixml,
   nlohmann_json, hicolor-icon-theme, wrapGAppsHook }:
 
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ autoconf automake asciidoc wrapGAppsHook
     libxslt xmlto boost libtool pkg-config ];
 
-  buildInputs = [ lucenepp nlohmann_json wxGTK30-gtk3 icu pugixml gtk3 gtkspell3 hicolor-icon-theme ];
+  buildInputs = [ lucenepp nlohmann_json wxGTK30 icu pugixml gtk3 gtkspell3 hicolor-icon-theme ];
 
   propagatedBuildInputs = [ gettext ];
 
diff --git a/pkgs/tools/text/transifex-client/default.nix b/pkgs/tools/text/transifex-client/default.nix
index ae23e5775592..07a49c3d4505 100644
--- a/pkgs/tools/text/transifex-client/default.nix
+++ b/pkgs/tools/text/transifex-client/default.nix
@@ -6,7 +6,7 @@
 , urllib3
 , six
 , setuptools
-, GitPython
+, gitpython
 , pythonRelaxDepsHook
 }:
 
@@ -20,11 +20,16 @@ buildPythonApplication rec {
   };
 
   # https://github.com/transifex/transifex-client/issues/323
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
-  pythonRelaxDeps = [ "python-slugify" ];
+  nativeBuildInputs = [
+    pythonRelaxDepsHook
+  ];
+
+  pythonRelaxDeps = [
+    "python-slugify"
+  ];
 
   propagatedBuildInputs = [
-    GitPython
+    gitpython
     python-slugify
     requests
     setuptools
@@ -36,9 +41,9 @@ buildPythonApplication rec {
   doCheck = false;
 
   meta = with lib; {
+    description = "Transifex translation service client";
     homepage = "https://www.transifex.com/";
     license = licenses.gpl2Only;
-    description = "Transifex translation service client";
     maintainers = with maintainers; [ sikmir ];
   };
 }
diff --git a/pkgs/tools/wayland/slurp/default.nix b/pkgs/tools/wayland/slurp/default.nix
index 87238a50f560..17b2bb3521b1 100644
--- a/pkgs/tools/wayland/slurp/default.nix
+++ b/pkgs/tools/wayland/slurp/default.nix
@@ -1,29 +1,29 @@
 { lib
 , stdenv
 , fetchFromGitHub
+, cairo
+, libxkbcommon
 , meson
 , ninja
 , pkg-config
-, cairo
-, libxkbcommon
+, scdoc
 , wayland
 , wayland-protocols
 , wayland-scanner
-, buildDocs ? true, scdoc
+, buildDocs ? true
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "slurp";
-  version = "1.3.2";
+  version = "1.4.0";
 
   src = fetchFromGitHub {
     owner = "emersion";
     repo = "slurp";
-    rev = "v${version}";
-    sha256 = "sha256-5ZB34rqLyZmfjT/clxNRDmF0qgITFZ5xt/gIEXQzvQE=";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-jUuY2wuN00libHDaJEmrvQAb1o989Ly3nLyKHV0jz8Q=";
   };
 
-  strictDeps = true;
   nativeBuildInputs = [
     meson
     ninja
@@ -38,13 +38,16 @@ stdenv.mkDerivation rec {
     wayland-protocols
   ];
 
-  mesonFlags = lib.optional buildDocs "-Dman-pages=enabled";
+  strictDeps = true;
+
+  mesonFlags = [ (lib.mesonEnable "man-pages" buildDocs) ];
 
   meta = with lib; {
-    description = "Select a region in a Wayland compositor";
     homepage = "https://github.com/emersion/slurp";
+    description = "Select a region in a Wayland compositor";
+    changelog = "https://github.com/emersion/slurp/releases/tag/v${finalAttrs.version}";
     license = licenses.mit;
     maintainers = with maintainers; [ buffet ];
-    platforms = platforms.linux;
+    inherit (wayland.meta) platforms;
   };
-}
+})
diff --git a/pkgs/tools/wayland/waynergy/default.nix b/pkgs/tools/wayland/waynergy/default.nix
index 36ad2fd19b42..fce7ac6605af 100644
--- a/pkgs/tools/wayland/waynergy/default.nix
+++ b/pkgs/tools/wayland/waynergy/default.nix
@@ -15,18 +15,18 @@
 }:
 stdenv.mkDerivation rec {
   pname = "waynergy";
-  version = "0.0.14";
+  version = "0.0.15";
 
   src = fetchFromGitHub {
     owner = "r-c-f";
     repo = "waynergy";
     rev = "v${version}";
-    hash = "sha256-LtLZDYZGoKNPRZeceMf/ndbO1QfMLkfxHeAo1YNjmm4=";
+    hash = "sha256-pk1U3svy9r7O9ivFjBNXsaOmgc+nv2QTuwwHejB7B4Q=";
   };
 
   depsBuildBuild = [ pkg-config ];
-  buildInputs = [ libdrm wayland wayland-protocols wl-clipboard libxkbcommon cmake libressl ];
   nativeBuildInputs = [ meson ninja ];
+  buildInputs = [ libdrm wayland wayland-protocols wl-clipboard libxkbcommon libressl ];
 
   postPatch = ''
     substituteInPlace waynergy.desktop --replace "Exec=/usr/bin/waynergy" "Exec=$out/bin/waynergy"
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 48c591de5991..990d68374886 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -729,6 +729,7 @@ mapAliases ({
   kodiPlainWayland = kodi-wayland;
   kodiPlugins = kodiPackages; # Added 2021-03-09;
   kramdown-rfc2629 = rubyPackages.kramdown-rfc2629; # Added 2021-03-23
+  krb5Full = krb5;
   krename-qt5 = throw "'krename-qt5' has been renamed to/replaced by 'krename'"; # Converted to throw 2022-02-22
   krita-beta = krita; # moved from top-level 2021-12-23
   kube-aws = throw "kube-aws is deprecated and archived by upstream"; # Added 2022-04-05
@@ -749,6 +750,7 @@ mapAliases ({
   libayatana-appindicator-gtk3 = libayatana-appindicator; # Added 2022-10-18
   libbencodetools = bencodetools; # Added 2022-07-30
   libbluedevil = throw "'libbluedevil' (Qt4) is unmaintained and unused since 'kde4.bluedevil's removal in 2017"; # Added 2022-06-14
+  libbpf_1 = libbpf; # Added 2022-12-06
   libcanberra_gtk2 = throw "'libcanberra_gtk2' has been renamed to/replaced by 'libcanberra-gtk2'"; # Converted to throw 2022-02-22
   libcanberra_gtk3 = throw "'libcanberra_gtk3' has been renamed to/replaced by 'libcanberra-gtk3'"; # Converted to throw 2022-02-22
   libcap_manpages = throw "'libcap_manpages' has been renamed to/replaced by 'libcap.doc'"; # Converted to throw 2022-02-22
@@ -1594,6 +1596,8 @@ mapAliases ({
   wxGTK = throw "wxGTK28 has been removed from nixpkgs as it has reached end of life"; # Added 2022-11-04
   wxGTK28 = throw "wxGTK28 has been removed from nixpkgs as it has reached end of life"; # Added 2022-11-04
   wxGTK29 = throw "wxGTK29 has been removed from nixpkgs as it has reached end of life"; # Added 2022-11-04
+  wxGTK30-gtk2 = throw "'wxGTK30-gtk2' has been removed from nixpkgs as it depends on deprecated GTK2"; # Added 2022-12-03
+  wxGTK30-gtk3 = throw "'wxGTK30-gtk3' has been renamed to/replaced by 'wxGTK30'"; # Added 2022-12-03
   wxGTK31-gtk2 = throw "'wxGTK31-gtk2' has been removed from nixpkgs as it depends on deprecated GTK2"; # Added 2022-10-27
   wxGTK31-gtk3 = throw "'wxGTK31-gtk3' has been renamed to/replaced by 'wxGTK31'"; # Added 2022-10-27
   wxmupen64plus = throw "wxmupen64plus was removed because the upstream disappeared"; # Added 2022-01-31
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 1f350f68d89e..c0aa65cf219b 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -1640,7 +1640,7 @@ with pkgs;
     fetchPypi
     annexremote
     drivelib
-    GitPython
+    gitpython
     tenacity
     humanfriendly;
   };
@@ -1827,6 +1827,8 @@ with pkgs;
 
   gitls = callPackage ../applications/version-management/git-and-tools/gitls { };
 
+  gitmux = callPackage ../applications/version-management/git-and-tools/gitmux { };
+
   gitnuro = callPackage ../applications/version-management/git-and-tools/gitnuro { };
 
   gitsign = callPackage ../applications/version-management/git-and-tools/gitsign { };
@@ -2024,11 +2026,11 @@ with pkgs;
 
   maiko = callPackage ../applications/emulators/maiko { };
 
-  mame = libsForQt5.callPackage ../applications/emulators/mame {
-    inherit (darwin.apple_sdk.frameworks) CoreAudioKit ForceFeedback;
-  };
+  mame = libsForQt5.callPackage ../applications/emulators/mame { };
 
-  mame-tools = (lib.getOutput "tools" mame);
+  mame-tools = lib.addMetaAttrs {
+    description = mame.meta.description + " (tools only)";
+  } (lib.getOutput "tools" mame);
 
   mednafen = callPackage ../applications/emulators/mednafen {
     inherit (darwin) libiconv;
@@ -2065,7 +2067,7 @@ with pkgs;
   pcem = callPackage ../applications/emulators/pcem { };
 
   pcsx2 = callPackage ../applications/emulators/pcsx2 {
-    wxGTK = wxGTK30-gtk3;
+    wxGTK = wxGTK30;
   };
 
   pcsxr = callPackage ../applications/emulators/pcsxr { };
@@ -2788,9 +2790,7 @@ with pkgs;
 
   bcachefs-tools = callPackage ../tools/filesystems/bcachefs-tools { };
 
-  bisq-desktop = callPackage ../applications/blockchains/bisq-desktop {
-    openjdk11 = openjdk11.override { enableJavaFX = true; };
-  };
+  bisq-desktop = callPackage ../applications/blockchains/bisq-desktop { };
 
   bic = callPackage ../development/interpreters/bic { };
 
@@ -2932,6 +2932,8 @@ with pkgs;
     buildGoModule = buildGo118Module; # tests fail with 1.19
   };
 
+  writeCueValidator = callPackage ../development/tools/cue/validator.nix { };
+
   cuelsp = callPackage ../development/tools/cuelsp {};
 
   cyclone-scheme = callPackage ../development/interpreters/cyclone { };
@@ -3190,6 +3192,8 @@ with pkgs;
 
   ipgrep = callPackage ../tools/networking/ipgrep { };
 
+  ipp-usb = callPackage ../os-specific/linux/ipp-usb { };
+
   itch = callPackage ../games/itch {};
 
   itd = callPackage ../applications/misc/itd { };
@@ -5974,6 +5978,8 @@ with pkgs;
 
   artim-dark = callPackage ../data/themes/artim-dark {};
 
+  bbin = callPackage ../development/tools/bbin {};
+
   bore = callPackage ../tools/networking/bore {
     inherit (darwin) Libsystem;
     inherit (darwin.apple_sdk.frameworks) SystemConfiguration;
@@ -7173,7 +7179,6 @@ with pkgs;
   fortune = callPackage ../tools/misc/fortune { };
 
   fox = callPackage ../development/libraries/fox {
-    libpng = libpng12;
     inherit (darwin.apple_sdk.frameworks) CoreServices;
   };
 
@@ -7587,9 +7592,7 @@ with pkgs;
 
   google-guest-oslogin = callPackage ../tools/virtualization/google-guest-oslogin { };
 
-  google-cloud-cpp = callPackage ../development/libraries/google-cloud-cpp {
-    openssl = openssl_1_1;
-  };
+  google-cloud-cpp = callPackage ../development/libraries/google-cloud-cpp { };
 
   google-java-format = callPackage ../development/tools/google-java-format { };
 
@@ -10695,7 +10698,7 @@ with pkgs;
   pod2mdoc = callPackage ../tools/misc/pod2mdoc { };
 
   poedit = callPackage ../tools/text/poedit {
-    wxGTK30-gtk3 = wxGTK30-gtk3.override { withWebKit = true; };
+    wxGTK30 = wxGTK30.override { withWebKit = true; };
   };
 
   polaris = callPackage ../servers/polaris { };
@@ -11719,6 +11722,7 @@ with pkgs;
 
   suricata = callPackage ../applications/networking/ids/suricata {
     python = python3;
+    libbpf = libbpf_0;
   };
 
   sof-firmware = callPackage ../os-specific/linux/firmware/sof-firmware { };
@@ -12343,9 +12347,7 @@ with pkgs;
 
   tracebox = callPackage ../tools/networking/tracebox { stdenv = gcc10StdenvCompat; };
 
-  tracee = callPackage ../tools/security/tracee {
-    libbpf = libbpf_1; # keep inline with their submodule
-  };
+  tracee = callPackage ../tools/security/tracee { };
 
   tracefilegen = callPackage ../development/tools/analysis/garcosim/tracefilegen { };
 
@@ -13309,6 +13311,7 @@ with pkgs;
   zbackup = callPackage ../tools/backup/zbackup {};
 
   zbar = libsForQt5.callPackage ../tools/graphics/zbar {
+    inherit (darwin.apple_sdk.frameworks) Foundation;
     autoreconfHook = buildPackages.autoreconfHook269;
   };
 
@@ -13362,6 +13365,8 @@ with pkgs;
 
   zip = callPackage ../tools/archivers/zip { };
 
+  zinc = callPackage ../servers/search/zinc { };
+
   zkfuse = callPackage ../tools/filesystems/zkfuse { };
 
   zpaq = callPackage ../tools/archivers/zpaq { };
@@ -15319,9 +15324,7 @@ with pkgs;
   cargo-make = callPackage ../development/tools/rust/cargo-make {
     inherit (darwin.apple_sdk.frameworks) Security SystemConfiguration;
   };
-  cargo-modules = callPackage ../development/tools/rust/cargo-modules {
-    inherit (darwin.apple_sdk.frameworks) CoreFoundation CoreServices;
-  };
+  cargo-modules = callPackage ../development/tools/rust/cargo-modules { };
   cargo-msrv = callPackage ../development/tools/rust/cargo-msrv {
     inherit (darwin.apple_sdk.frameworks) Security;
   };
@@ -16734,7 +16737,7 @@ with pkgs;
   bloop = callPackage ../development/tools/build-managers/bloop { };
 
   bossa = callPackage ../development/embedded/bossa {
-    wxGTK = wxGTK30-gtk3;
+    wxGTK = wxGTK30;
   };
 
   bossa-arduino = callPackage ../development/embedded/bossa/arduino.nix { };
@@ -16776,10 +16779,8 @@ with pkgs;
 
   bump = callPackage ../development/tools/github/bump { };
 
-  libbpf_1 = callPackage ../os-specific/linux/libbpf { };
+  libbpf = callPackage ../os-specific/linux/libbpf { };
   libbpf_0 = callPackage ../os-specific/linux/libbpf/0.x.nix { };
-  # until more issues are fixed default to libbpf 0.x
-  libbpf = libbpf_0;
 
   bundlewrap = with python3.pkgs; toPythonApplication bundlewrap;
 
@@ -16787,12 +16788,10 @@ with pkgs;
 
   bcc = callPackage ../os-specific/linux/bcc {
     python = python3;
-    libbpf = libbpf_1;
     llvmPackages = llvmPackages_14;
   };
 
   bpftrace = callPackage ../os-specific/linux/bpftrace {
-    libbpf = libbpf_1;
     llvmPackages = llvmPackages_14;
   };
 
@@ -17701,9 +17700,7 @@ with pkgs;
     inherit (darwin.apple_sdk.frameworks) Security;
   };
 
-  pahole = callPackage ../development/tools/misc/pahole {
-    libbpf = libbpf_1;
-  };
+  pahole = callPackage ../development/tools/misc/pahole { };
 
   panopticon = callPackage ../development/tools/analysis/panopticon {};
 
@@ -18100,6 +18097,10 @@ with pkgs;
 
   taoup = callPackage ../tools/misc/taoup { };
 
+  tarmac = callPackage ../development/tools/tarmac {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
+
   tcptrack = callPackage ../development/tools/misc/tcptrack { };
 
   teensyduino = arduino-core.override { withGui = true; withTeensyduino = true; };
@@ -18947,6 +18948,8 @@ with pkgs;
   factor-lang-scope = callPackage ../development/compilers/factor-lang/scope.nix { };
   factor-lang = factor-lang-scope.interpreter;
 
+  fancypp = callPackage ../development/libraries/fancypp { };
+
   far2l = callPackage ../applications/misc/far2l {
     stdenv = if stdenv.cc.isClang then llvmPackages.stdenv else stdenv;
     inherit (darwin.apple_sdk.frameworks) IOKit Carbon Cocoa AudioToolbox OpenGL;
@@ -19249,6 +19252,8 @@ with pkgs;
 
   graphinder = callPackage ../tools/security/graphinder { };
 
+  httplib = callPackage ../development/libraries/httplib { };
+
   icon-lang = callPackage ../development/interpreters/icon-lang { };
 
   libgit2 = callPackage ../development/libraries/libgit2 {
@@ -19470,9 +19475,9 @@ with pkgs;
   grilo-plugins = callPackage ../development/libraries/grilo-plugins { };
 
   grpc = callPackage ../development/libraries/grpc {
-    # grpc builds with c++14 so abseil must also be built that way
+    # grpc builds with c++17 so abseil must also be built that way
     abseil-cpp = abseil-cpp_202206.override {
-      cxxStandard = "14";
+      cxxStandard = "17";
     };
   };
 
@@ -19989,7 +19994,6 @@ with pkgs;
   krb5 = callPackage ../development/libraries/kerberos/krb5.nix {
     inherit (buildPackages.darwin) bootstrap_cmds;
   };
-  krb5Full = krb5;
   libkrb5 = krb5.override { type = "lib"; };
 
   kronosnet = callPackage ../development/libraries/kronosnet { };
@@ -21478,7 +21482,8 @@ with pkgs;
 
   maxflow = callPackage ../development/libraries/maxflow { };
 
-  mbedtls = callPackage ../development/libraries/mbedtls { };
+  mbedtls_2 = callPackage ../development/libraries/mbedtls/2.nix { };
+  mbedtls = callPackage ../development/libraries/mbedtls/3.nix { };
 
   mdctags = callPackage ../development/tools/misc/mdctags { };
 
@@ -21794,11 +21799,15 @@ with pkgs;
 
   ode = callPackage ../development/libraries/ode { };
 
-  ogre = callPackage ../development/libraries/ogre {};
+  ogre = callPackage ../development/libraries/ogre {
+    inherit (darwin.apple_sdk.frameworks) Cocoa;
+  };
   ogre1_9 = callPackage ../development/libraries/ogre/1.9.x.nix {};
   ogre1_10 = callPackage ../development/libraries/ogre/1.10.x.nix {};
 
-  ogrepaged = callPackage ../development/libraries/ogrepaged { };
+  ogrepaged = callPackage ../development/libraries/ogrepaged {
+    ogre = ogre1_9;
+  };
 
   olm = callPackage ../development/libraries/olm { };
 
@@ -22475,6 +22484,8 @@ with pkgs;
 
   seasocks = callPackage ../development/libraries/seasocks { };
 
+  semver-cpp = callPackage ../development/libraries/semver-cpp { };
+
   serd = callPackage ../development/libraries/serd {};
 
   serf = callPackage ../development/libraries/serf {
@@ -22778,15 +22789,6 @@ with pkgs;
 
   suil = callPackage ../development/libraries/audio/suil { };
 
-  suil-qt5 = suil.override {
-    withQt4 = false;
-    withQt5 = true;
-  };
-  suil-qt4 = suil.override {
-    withQt4 = true;
-    withQt5 = false;
-  };
-
   sundials = callPackage ../development/libraries/sundials {
     python = python3;
   };
@@ -23121,12 +23123,9 @@ with pkgs;
   };
 
   wxGTK30 = callPackage ../development/libraries/wxwidgets/wxGTK30.nix {
-    withGtk2 = true;
     inherit (darwin.stubs) setfile;
     inherit (darwin.apple_sdk.frameworks) AGL Carbon Cocoa Kernel QTKit AVFoundation AVKit WebKit;
   };
-  wxGTK30-gtk2 = wxGTK30.override { withGtk2 = true; };
-  wxGTK30-gtk3 = wxGTK30.override { withGtk2 = false; };
 
   wxmac = callPackage ../development/libraries/wxwidgets/wxmac30.nix {
     inherit (darwin.stubs) derez rez setfile;
@@ -23144,7 +23143,7 @@ with pkgs;
   };
 
   wxSVG = callPackage ../development/libraries/wxSVG {
-    wxGTK = wxGTK30-gtk3;
+    wxGTK = wxGTK30;
     inherit (darwin.apple_sdk.frameworks) Cocoa;
   };
 
@@ -23611,6 +23610,11 @@ with pkgs;
   cassandra_3_11 = callPackage ../servers/nosql/cassandra/3.11.nix {
     jre = jre8; # TODO: remove override https://github.com/NixOS/nixpkgs/pull/89731
   };
+  cassandra_4 = callPackage ../servers/nosql/cassandra/4.nix {
+    # Effective Cassandra 4.0.2 there is full Java 11 support
+    #  -- https://cassandra.apache.org/doc/latest/cassandra/new/java11.html
+    jre = pkgs.jdk11_headless;
+  };
   cassandra = cassandra_3_11;
 
   cassandra-cpp-driver = callPackage ../development/libraries/cassandra-cpp-driver/default.nix { };
@@ -23742,6 +23746,8 @@ with pkgs;
 
   hyp = callPackage ../servers/http/hyp { };
 
+  peering-manager = callPackage ../servers/web-apps/peering-manager { };
+
   podgrab = callPackage ../servers/misc/podgrab { };
 
   portunus = callPackage ../servers/portunus { };
@@ -24221,6 +24227,10 @@ with pkgs;
     boost = boost172;
   };
 
+  soundux = callPackage ../applications/audio/soundux {
+    yt-dlp = yt-dlp.override { withAlias = true; };
+  };
+
   tomcat_connectors = callPackage ../servers/http/apache-modules/tomcat-connectors { };
 
   tomcat-native = callPackage ../servers/http/tomcat/tomcat-native.nix { };
@@ -25685,9 +25695,7 @@ with pkgs;
 
   go-migrate = callPackage ../development/tools/go-migrate { };
 
-  go-mockery = callPackage ../development/tools/go-mockery {
-    buildGoModule = buildGo118Module; # tests fail with 1.19
-  };
+  go-mockery = callPackage ../development/tools/go-mockery { };
 
   gomacro = callPackage ../development/tools/gomacro { };
 
@@ -25963,7 +25971,6 @@ with pkgs;
       enableMinimal = true;
       guiSupport = false;
     };
-    libbpf = libbpf_1;
   };
   systemdMinimal = systemd.override {
     pname = "systemd-minimal";
@@ -26041,6 +26048,8 @@ with pkgs;
 
   twa = callPackage ../tools/networking/twa { };
 
+  twingate = callPackage ../applications/networking/twingate { };
+
   # Upstream U-Boots:
   inherit (callPackage ../misc/uboot {})
     buildUBoot
@@ -27004,6 +27013,8 @@ with pkgs;
 
   sierra-breeze-enhanced = libsForQt5.callPackage ../data/themes/kwin-decorations/sierra-breeze-enhanced { };
 
+  simp1e-cursors = callPackage ../data/icons/simp1e-cursors { };
+
   sjasmplus = callPackage ../development/compilers/sjasmplus { };
 
   skeu = callPackage ../data/themes/skeu { };
@@ -27536,7 +27547,6 @@ with pkgs;
 
   audacity = callPackage ../applications/audio/audacity {
     inherit (darwin.apple_sdk.frameworks) AppKit AudioToolbox AudioUnit Carbon CoreAudio CoreAudioKit CoreServices;
-    suil = suil-qt5;
   };
 
   audio-recorder = callPackage ../applications/audio/audio-recorder { };
@@ -28924,7 +28934,7 @@ with pkgs;
   freecad = libsForQt5.callPackage ../applications/graphics/freecad {
     boost = python3Packages.boost;
     inherit (python3Packages)
-      GitPython
+      gitpython
       matplotlib
       pivy
       ply
@@ -31718,7 +31728,7 @@ with pkgs;
   radioboat = callPackage ../applications/audio/radioboat { };
 
   radiotray-ng = callPackage ../applications/audio/radiotray-ng {
-    wxGTK = wxGTK30-gtk3;
+    wxGTK = wxGTK30;
   };
 
   raiseorlaunch = callPackage ../applications/misc/raiseorlaunch {};
@@ -32320,6 +32330,8 @@ with pkgs;
 
   teams = callPackage ../applications/networking/instant-messengers/teams { };
 
+  teams-for-linux = callPackage ../applications/networking/instant-messengers/teams-for-linux { };
+
   teamspeak_client = libsForQt5.callPackage ../applications/networking/instant-messengers/teamspeak/client.nix { };
   teamspeak5_client = callPackage ../applications/networking/instant-messengers/teamspeak/client5.nix { };
   teamspeak_server = callPackage ../applications/networking/instant-messengers/teamspeak/server.nix { };
@@ -33414,6 +33426,8 @@ with pkgs;
 
   yate = callPackage ../applications/misc/yate { };
 
+  yaup = callPackage ../applications/networking/yaup { };
+
   ydiff = with python3.pkgs; toPythonApplication ydiff;
 
   ydict = callPackage ../applications/misc/ydict {};
@@ -35911,14 +35925,6 @@ with pkgs;
     });
 
     java = openjdk17;
-    z3 = z3_4_4_0.overrideAttrs (_: {
-      src = fetchFromGitHub {
-        owner = "Z3Prover";
-        repo = "z3";
-        rev = "0482e7fe727c75e259ac55a932b28cf1842c530e";
-        sha256 = "1m53avlljxqd2p8w266ksmjywjycsd23h224yn786qsnf36dr63x";
-      };
-    });
   };
   isabelle-components = recurseIntoAttrs (callPackage ../applications/science/logic/isabelle/components { });
 
@@ -36779,8 +36785,8 @@ with pkgs;
 
   lguf-brightness = callPackage ../misc/lguf-brightness { };
 
-  lighthouse = callPackage ../applications/blockchains/lighthouse {
-    inherit (darwin.apple_sdk.frameworks) Security;
+  lighthouse = darwin.apple_sdk_11_0.callPackage ../applications/blockchains/lighthouse {
+    inherit (darwin.apple_sdk_11_0.frameworks) CoreFoundation Security;
   };
 
   lilypond = callPackage ../misc/lilypond { guile = guile_1_8; };
diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index e0cecf43d264..c9879db71650 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -389,7 +389,7 @@ let
       substituteInPlace Build.PL \
         --replace "gtk+-2.0" "gtk+-3.0"
     '';
-    propagatedBuildInputs = [ pkgs.pkg-config pkgs.gtk3 pkgs.wxGTK30-gtk3 ModulePluggable ];
+    propagatedBuildInputs = [ pkgs.pkg-config pkgs.gtk3 pkgs.wxGTK30 ModulePluggable ];
     buildInputs = [ LWPProtocolHttps ];
     meta = {
       description = "Building, finding and using wxWidgets binaries";
@@ -1207,15 +1207,15 @@ let
       url = "mirror://cpan/authors/id/S/SJ/SJQUINNEY/Authen-Krb5-Admin-0.17.tar.gz";
       hash = "sha256-XdScrNmD79YajD8aVlcbtzeF6xVZCLXXvsl+7XjfDFQ=";
     };
-    propagatedBuildInputs = [ pkgs.krb5Full.dev AuthenKrb5 ];
+    propagatedBuildInputs = [ pkgs.krb5.dev AuthenKrb5 ];
     # The following ENV variables are required by Makefile.PL to find
-    # programs in krb5Full.dev. It is not enough to just specify the
-    # path to krb5-config as this tool returns the prefix of krb5Full,
+    # programs in krb5.dev. It is not enough to just specify the
+    # path to krb5-config as this tool returns the prefix of krb5,
     # which implies a working value for KRB5_LIBDIR, but not the others.
     perlPreHook = ''
-      export KRB5_CONFTOOL=${pkgs.krb5Full.dev}/bin/krb5-config
-      export KRB5_BINDIR=${pkgs.krb5Full.dev}/bin
-      export KRB5_INCDIR=${pkgs.krb5Full.dev}/include
+      export KRB5_CONFTOOL=${pkgs.krb5.dev}/bin/krb5-config
+      export KRB5_BINDIR=${pkgs.krb5.dev}/bin
+      export KRB5_INCDIR=${pkgs.krb5.dev}/include
     '';
     # Tests require working Kerberos infrastructure so replace with a
     # simple attempt to exercise the module.
@@ -10529,8 +10529,8 @@ let
       url = "mirror://cpan/authors/id/A/AG/AGROLMS/GSSAPI-0.28.tar.gz";
       hash = "sha256-fY8se2F2L7TsctLsKBKQ8vh/nH0pgnPaRSVDKmXncNY=";
     };
-    propagatedBuildInputs = [ pkgs.krb5Full.dev ];
-    makeMakerFlags = [ "--gssapiimpl" "${pkgs.krb5Full.dev}" ];
+    propagatedBuildInputs = [ pkgs.krb5.dev ];
+    makeMakerFlags = [ "--gssapiimpl" "${pkgs.krb5.dev}" ];
     meta = {
       description = "Perl extension providing access to the GSSAPIv2 library";
       license = with lib.licenses; [ artistic1 gpl1Plus ];
diff --git a/pkgs/top-level/python-aliases.nix b/pkgs/top-level/python-aliases.nix
index ed90d54f263b..e338c2615973 100644
--- a/pkgs/top-level/python-aliases.nix
+++ b/pkgs/top-level/python-aliases.nix
@@ -87,6 +87,7 @@ mapAliases ({
   garminconnect-ha = garminconnect; # added 2022-02-05
   gigalixir = throw "gigalixir has been promoted to a top-level attribute"; # Added 2022-10-02
   gitdb2 = throw "gitdb2 has been deprecated, use gitdb instead."; # added 2020-03-14
+  GitPython = gitpython; # added 2022-10-28
   glances = throw "glances has moved to pkgs.glances"; # added 2020-20-28
   google_api_python_client = google-api-python-client; # added 2021-03-19
   googleapis_common_protos = googleapis-common-protos; # added 2021-03-19
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index a4d9a8737072..0530337d0a60 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -1426,7 +1426,7 @@ self: super: with self; {
 
   btrfs = callPackage ../development/python-modules/btrfs { };
 
-  btrfsutil = toPythonModule (pkgs.btrfs-progs.override { python3 = self.python; });
+  btrfsutil = callPackage ../development/python-modules/btrfsutil { };
 
   btsocket = callPackage ../development/python-modules/btsocket { };
 
@@ -3726,18 +3726,19 @@ self: super: with self; {
 
   git-filter-repo = callPackage ../development/python-modules/git-filter-repo { };
 
-  gitdb = callPackage ../development/python-modules/gitdb { };
+  git-revise = callPackage ../development/python-modules/git-revise { };
 
-  github3_py = callPackage ../development/python-modules/github3_py { };
+  git-sweep = callPackage ../development/python-modules/git-sweep { };
+
+  gitdb = callPackage ../development/python-modules/gitdb { };
 
   github-to-sqlite = callPackage ../development/python-modules/github-to-sqlite { };
 
   github-webhook = callPackage ../development/python-modules/github-webhook { };
-  GitPython = callPackage ../development/python-modules/GitPython { };
 
-  git-revise = callPackage ../development/python-modules/git-revise { };
+  github3_py = callPackage ../development/python-modules/github3_py { };
 
-  git-sweep = callPackage ../development/python-modules/git-sweep { };
+  gitpython = callPackage ../development/python-modules/gitpython { };
 
   glad =  callPackage ../development/python-modules/glad { };
 
@@ -4035,7 +4036,7 @@ self: super: with self; {
   gspread = callPackage ../development/python-modules/gspread { };
 
   gssapi = callPackage ../development/python-modules/gssapi {
-    inherit (pkgs) krb5Full;
+    inherit (pkgs) krb5;
     inherit (pkgs.darwin.apple_sdk.frameworks) GSS;
   };
 
@@ -4929,7 +4930,7 @@ self: super: with self; {
   jxmlease = callPackage ../development/python-modules/jxmlease { };
 
   k5test = callPackage ../development/python-modules/k5test {
-    inherit (pkgs) krb5Full findutils which;
+    inherit (pkgs) krb5 findutils which;
   };
 
   kaa-base = callPackage ../development/python-modules/kaa-base { };
@@ -8967,6 +8968,8 @@ self: super: with self; {
 
   python3-openid = callPackage ../development/python-modules/python3-openid { };
 
+  python-arango = callPackage ../development/python-modules/python-arango { };
+
   python-awair = callPackage ../development/python-modules/python-awair { };
 
   python3-saml = callPackage ../development/python-modules/python3-saml { };
@@ -9948,6 +9951,8 @@ self: super: with self; {
 
   runway-python = callPackage ../development/python-modules/runway-python { };
 
+  ruuvitag-ble = callPackage ../development/python-modules/ruuvitag-ble { };
+
   ruyaml = callPackage ../development/python-modules/ruyaml { };
 
   rx = callPackage ../development/python-modules/rx { };
@@ -12029,7 +12034,7 @@ self: super: with self; {
 
   wxPython_4_0 = callPackage ../development/python-modules/wxPython/4.0.nix {
     inherit (pkgs.darwin.apple_sdk.frameworks) AudioToolbox Carbon Cocoa CoreFoundation IOKit OpenGL;
-    wxGTK = pkgs.wxGTK30-gtk3.override {
+    wxGTK = pkgs.wxGTK30.override {
       withWebKit = true;
     };
   };
diff --git a/pkgs/top-level/python2-packages.nix b/pkgs/top-level/python2-packages.nix
index 3d970d8bc4b2..534f9fa0490e 100644
--- a/pkgs/top-level/python2-packages.nix
+++ b/pkgs/top-level/python2-packages.nix
@@ -19,12 +19,8 @@ with self; with super; {
 
   chardet = callPackage ../development/python2-modules/chardet { };
 
-  cheetah = callPackage ../development/python2-modules/cheetah { };
-
   configparser = callPackage ../development/python2-modules/configparser { };
 
-  construct = callPackage ../development/python2-modules/construct { };
-
   contextlib2 = callPackage ../development/python2-modules/contextlib2 { };
 
   coverage = callPackage ../development/python2-modules/coverage { };
@@ -39,8 +35,6 @@ with self; with super; {
 
   gtkme = callPackage ../development/python2-modules/gtkme { };
 
-  httpretty = callPackage ../development/python2-modules/httpretty { };
-
   hypothesis = callPackage ../development/python2-modules/hypothesis { };
 
   idna = callPackage ../development/python2-modules/idna { };
@@ -53,31 +47,18 @@ with self; with super; {
     inherit (pkgs) marisa;
   };
 
-  markdown = callPackage ../development/python2-modules/markdown { };
-
   markupsafe = callPackage ../development/python2-modules/markupsafe { };
 
   mock = callPackage ../development/python2-modules/mock { };
 
   more-itertools = callPackage ../development/python2-modules/more-itertools { };
 
-  mutagen = callPackage ../development/python2-modules/mutagen { };
-
-  numpy = callPackage ../development/python2-modules/numpy { };
-
   packaging = callPackage ../development/python2-modules/packaging { };
 
-  pillow = callPackage ../development/python2-modules/pillow {
-    inherit (pkgs) freetype libjpeg zlib libtiff libwebp tcl lcms2 tk;
-    inherit (pkgs.xorg) libX11;
-  };
-
   pip = callPackage ../development/python2-modules/pip { };
 
   pluggy = callPackage ../development/python2-modules/pluggy { };
 
-  prettytable = callPackage ../development/python2-modules/prettytable { };
-
   protobuf = callPackage ../development/python2-modules/protobuf {
     disabled = isPyPy;
     protobuf = pkgs.protobuf3_17; # last version compatible with Python 2
@@ -115,10 +96,6 @@ with self; with super; {
 
   pytest-xdist = callPackage ../development/python2-modules/pytest-xdist { };
 
-  pyyaml = callPackage ../development/python2-modules/pyyaml { };
-
-  qpid-python = callPackage ../development/python2-modules/qpid-python { };
-
   recoll = disabled super.recoll;
 
   rivet = disabled super.rivet;
@@ -139,8 +116,6 @@ with self; with super; {
 
   sphinx = callPackage ../development/python2-modules/sphinx { };
 
-  TurboCheetah = callPackage ../development/python2-modules/TurboCheetah { };
-
   typing = callPackage ../development/python2-modules/typing { };
 
   zeek = disabled super.zeek;